@agenticprimitives/agent-profile 1.0.0-alpha.12 → 1.0.0-alpha.14

package/README.md

@@ -1,6 +1,6 @@
 # @agenticprimitives/agent-profile
 
-**A profile describes the identity; it never becomes the identity.** Agent discovery is consolidating right now — ERC-8004 registries on mainnet, agent naming services shipping agent cards, HCS-11 profiles on Hedera. Each standard wants to be the place an agent "lives." This package takes the other position: every agent already lives at one canonical ERC-4337 Smart Agent address, and a profile is a typed, content-hashed manifest *about* that address ([ADR-0010](../../docs/architecture/decisions/0010-smart-agent-canonical-identifier.md)). Registry entries in any standard become facets that back-link to the same anchor — so one identity serves all of them, and no registry can quietly fork who the agent is.
+**A profile describes the identity; it never becomes the identity.** Agent discovery is consolidating right now — on-chain registries, DNS/PKI agent naming, Hedera-style profiles, A2A cards, and MCP registries. Each standard wants to be the place an agent "lives." This package takes the other position: every agent already lives at one canonical ERC-4337 Smart Agent address, and a profile is an AP-native, typed, content-hashed manifest *about* that address ([ADR-0010](../../docs/architecture/decisions/0010-smart-agent-canonical-identifier.md)). Registry entries in any standard are external projections/facets that back-link to the same anchor — so one identity serves all of them, and no registry can quietly fork who the agent is.
 
 Part of [agenticprimitives](../../README.md) — the trust substrate for the agent economy: one canonical Smart Agent identity with custody, delegation, naming, credentials, and audit evidence designed as one system.
 
@@ -13,7 +13,7 @@ Where [`agent-naming`](../agent-naming) maps names → addresses, this package m
 
 - You author or validate an `AgentCard` (person, org, service, treasury, MCP server, multisig).
 - You need a deterministic `profileContentHash` for the on-chain `metadata-hash` anchor — so a tampered profile is detectable by anyone holding the hash.
-- You need CAIP-10 `nativeId` encode/decode (strict encode, permissive decode) aligned with HCS-14 / ERC-8004 ([ADR-0008](../../docs/architecture/decisions/0008-caip10-nativeid-record-predicate.md)).
+- You need CAIP-10 `nativeId` encode/decode (strict encode, permissive decode) as a portable back-link to the canonical SA ([ADR-0008](../../docs/architecture/decisions/0008-caip10-nativeid-record-predicate.md)).
 - You need endpoint-verification methods (DNS TXT, signed URL, HTTP challenge, verifiable presentation) — Phase 2+.
 - You build encoded calls to register or update on-chain profile anchors.
 
@@ -61,16 +61,16 @@ const nativeId = buildCaip10Address({
 
 ## How it's different
 
-The reference points are **ERC-8004 registries and agent-card formats** (including the GoDaddy ANS `agent-card.json` pattern, which inspired the manifest shape — without importing its PKI):
+The reference points are registry and agent-card ecosystems, but this package defines the AP-native primitive:
 
-- **Anchor, not authority.** In registry-first designs, the registry entry *is* the agent, and each registry mints its own notion of identity. Here the `AgentCard` is HCS-11-aligned typed JSON discriminated on `type`, and every external registry facet must back-link to the canonical Smart Agent via CAIP-10 `nativeId` ([spec 220 §4](../../specs/220-agent-identity-bootstrap.md)). One agent, many registries, zero identity forks.
+- **Anchor, not authority.** In registry-first designs, the registry entry *is* the agent, and each registry mints its own notion of identity. Here the `AgentCard` is AP-native typed JSON discriminated on `type`, and every external registry facet must back-link to the canonical Smart Agent via CAIP-10 `nativeId` ([spec 220 §4](../../specs/220-agent-identity-bootstrap.md)). One agent, many registries, zero identity forks.
 - **Tamper evidence built in.** `profileContentHash` is deterministic canonical JSON — sorted keys, fixed numeric format — matching the on-chain `metadata-hash` predicate. Two semantically equal profiles hash identically; a mutated profile cannot pass against its anchor.
 - **Endpoint claims are not endpoint proof.** A profile may *claim* an MCP or A2A URL; `VerificationMethod` is the explicit, caller-selected proof that the Smart Agent controls it. We never silently pick a verification method — you always know what "verified" meant.
 - **CAIP-10 done strictly.** Encoders reject unknown namespaces (Phase 1: eip155, hedera, solana); decoders accept any grammar-valid CAIP-10 string for forward compatibility.
 
 ## Main concepts
 
-- **AgentCard**: HCS-11-aligned typed JSON discriminated by `type`, with type-specific sub-objects (`AiAgentProfile`, `McpServerProfile`, `MultisigProfile`, `ServiceProfile`).
+- **AgentCard**: AP-native typed JSON discriminated by `type`, with type-specific sub-objects (`AiAgentProfile`, `McpServerProfile`, `MultisigProfile`, `ServiceProfile`).
 - **Profile facet**: `metadata-uri` + `metadata-hash` pointing at the canonical SA.
 - **CAIP-10 `nativeId`**: the cross-registry back-link; must match the SA on EVM chains.
 - **Verification**: proves an MCP/A2A URL is controlled by the SA (distinct from naming).

package/dist/caip10.d.ts

@@ -1,6 +1,7 @@
 /**
- * CAIP-10 chain-agnostic account identifier helpers (HCS-14 +
- * ERC-8004 aligned; ADR-0008).
+ * CAIP-10 chain-agnostic account identifier helpers. AP uses CAIP-10
+ * as a portable back-link to the canonical Smart Agent (ADR-0008);
+ * external registry-specific identifiers are derived outside Ring 0.
  *
  * Subpath: `@agenticprimitives/agent-profile/caip10`.
  *

package/dist/caip10.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caip10.d.ts","sourceRoot":"","sources":["../src/caip10.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAM3E,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;AAC3C,OAAO,EAAE,0BAA0B,EAAE,CAAC;AAItC;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,aAAa,CAcpE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAMtD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD"}
+{"version":3,"file":"caip10.d.ts","sourceRoot":"","sources":["../src/caip10.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAM3E,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;AAC3C,OAAO,EAAE,0BAA0B,EAAE,CAAC;AAItC;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,aAAa,CAcpE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAMtD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD"}

package/dist/caip10.js

@@ -1,6 +1,7 @@
 /**
- * CAIP-10 chain-agnostic account identifier helpers (HCS-14 +
- * ERC-8004 aligned; ADR-0008).
+ * CAIP-10 chain-agnostic account identifier helpers. AP uses CAIP-10
+ * as a portable back-link to the canonical Smart Agent (ADR-0008);
+ * external registry-specific identifiers are derived outside Ring 0.
  *
  * Subpath: `@agenticprimitives/agent-profile/caip10`.
  *

package/dist/caip10.js.map

@@ -1 +1 @@
-{"version":3,"file":"caip10.js","sourceRoot":"","sources":["../src/caip10.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQjD,OAAO,EAAE,0BAA0B,EAAE,CAAC;AAEtC,MAAM,cAAc,GAAG,kEAAkE,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAkB;IACnD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAChD,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,kBAAkB,CAC1B,GAAG,SAAS,IAAI,SAAS,IAAI,OAAO,EAAE,EACtC,cAAc,SAAS,uBAAuB,CAAC,GAAG,0BAA0B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACnF,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,SAAS,IAAI,iBAAiB,EAAE,CAAC;IAC7D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,GAAoB,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC"}
+{"version":3,"file":"caip10.js","sourceRoot":"","sources":["../src/caip10.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQjD,OAAO,EAAE,0BAA0B,EAAE,CAAC;AAEtC,MAAM,cAAc,GAAG,kEAAkE,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAkB;IACnD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAChD,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,kBAAkB,CAC1B,GAAG,SAAS,IAAI,SAAS,IAAI,OAAO,EAAE,EACtC,cAAc,SAAS,uBAAuB,CAAC,GAAG,0BAA0B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACnF,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,SAAS,IAAI,iBAAiB,EAAE,CAAC;IAC7D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,GAAoB,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC"}

package/dist/card.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Signed agent card bundle (spec 279 §3.2) — the discovery-substrate primitive that lets a verifier prove
+ * `cardHash → subjectAgent` WITHOUT trusting the registry or server that served the card.
+ *
+ * Subpath: `@agenticprimitives/agent-profile/card`.
+ *
+ * Shape: `cardHash` = sha256 of the canonical-JSON card; the subject Smart Agent signs (ERC-1271) a digest
+ * binding `{cardHash, subjectAgent, issuedAt, expiresAt, chainId, verifyingContract}`. Verification
+ * recomputes the card hash (catches a card tamper) AND re-checks the subject SA's ERC-1271 signature over
+ * that digest (authoritative — catches a tamper that also rewrote the hash). Both the signer and the
+ * on-chain ERC-1271 read are INJECTED so the module stays a pure, network-free helper (ADR-0006/0021);
+ * fail-closed throughout (ADR-0013).
+ *
+ * This is the off-chain card whose hash a registry entry references (`@agenticprimitives/registry-kit`).
+ * It is descriptive evidence only and carries NO authority to act.
+ */
+import { type Address, type Hex } from 'viem';
+import type { AgentCard, Sha256, SignedAgentCardBundleV1 } from './types.js';
+/** sha256 over the canonical-JSON encoding of a card → `sha256:<hex>`. Deterministic across runtimes
+ *  (UTF-8 byte-level). Reuses {@link canonicalProfileJson} so the bytes hashed here match the package's
+ *  one canonical card encoding. */
+export declare function hashAgentCard(card: AgentCard): Sha256;
+/** Injected ERC-1271 read — `verifyingContract.isValidSignature(hash, signature)` resolved to a bool.
+ *  Satisfied structurally by a viem `PublicClient` (`verifyHash`). */
+export interface Erc1271Verifier {
+    verifyHash(args: {
+        address: Address;
+        hash: Hex;
+        signature: Hex;
+    }): Promise<boolean>;
+}
+/** Injected Smart-Agent signer: signs the 32-byte digest, returning the ERC-1271-validatable signature. */
+export type SmartAgentCardSigner = (digest: Hex) => Promise<Hex>;
+export interface BuildSignedAgentCardInput {
+    card: AgentCard;
+    /** The canonical Smart Agent the card describes. Also the signer + verifying contract in V1. */
+    subjectAgent: Address;
+    chainId: number;
+    issuedAt: string;
+    expiresAt?: string;
+    /** ERC-1271 verifying contract; defaults to `subjectAgent` (the SA validates its own card). */
+    verifyingContract?: Address;
+}
+/** Build a signed card bundle: hash the card, have the subject SA sign the digest (ERC-1271), return the
+ *  signed {@link SignedAgentCardBundleV1}. */
+export declare function buildSignedAgentCardBundle(input: BuildSignedAgentCardInput, sign: SmartAgentCardSigner): Promise<SignedAgentCardBundleV1>;
+export type VerifySignedAgentCardResult = {
+    ok: true;
+    subjectAgent: Address;
+    cardHash: Sha256;
+    card: AgentCard;
+} | {
+    ok: false;
+    reason: 'bad_shape' | 'card_hash_mismatch' | 'subject_mismatch' | 'expired' | 'signature_invalid';
+};
+/** Verify a signed card bundle WITHOUT trusting whoever served it: recompute `cardHash` from the card
+ *  (catches a card tamper that left the hash stale), confirm the proof is self-asserted by the subject SA
+ *  (signer == verifyingContract == subjectAgent — V1), enforce expiry, then re-check the subject SA's
+ *  ERC-1271 signature over the digest (authoritative). Fail-closed: any anomaly → `ok:false`. */
+export declare function verifySignedAgentCardBundle(bundle: SignedAgentCardBundleV1, opts: {
+    verifier: Erc1271Verifier;
+    now?: number;
+}): Promise<VerifySignedAgentCardResult>;
+//# sourceMappingURL=card.d.ts.map

package/dist/card.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"card.d.ts","sourceRoot":"","sources":["../src/card.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAA+B,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAE3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE7E;;mCAEmC;AACnC,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAErD;AAsCD;sEACsE;AACtE,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,GAAG,CAAC;QAAC,SAAS,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrF;AAED,2GAA2G;AAC3G,MAAM,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;AAEjE,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,SAAS,CAAC;IAChB,gGAAgG;IAChG,YAAY,EAAE,OAAO,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+FAA+F;IAC/F,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;8CAC8C;AAC9C,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,yBAAyB,EAChC,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,uBAAuB,CAAC,CA4BlC;AAED,MAAM,MAAM,2BAA2B,GACnC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GACtE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,oBAAoB,GAAG,kBAAkB,GAAG,SAAS,GAAG,mBAAmB,CAAA;CAAE,CAAC;AAErH;;;iGAGiG;AACjG,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,uBAAuB,EAC/B,IAAI,EAAE;IAAE,QAAQ,EAAE,eAAe,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD,OAAO,CAAC,2BAA2B,CAAC,CAkDtC"}

package/dist/card.js

@@ -0,0 +1,133 @@
+/**
+ * Signed agent card bundle (spec 279 §3.2) — the discovery-substrate primitive that lets a verifier prove
+ * `cardHash → subjectAgent` WITHOUT trusting the registry or server that served the card.
+ *
+ * Subpath: `@agenticprimitives/agent-profile/card`.
+ *
+ * Shape: `cardHash` = sha256 of the canonical-JSON card; the subject Smart Agent signs (ERC-1271) a digest
+ * binding `{cardHash, subjectAgent, issuedAt, expiresAt, chainId, verifyingContract}`. Verification
+ * recomputes the card hash (catches a card tamper) AND re-checks the subject SA's ERC-1271 signature over
+ * that digest (authoritative — catches a tamper that also rewrote the hash). Both the signer and the
+ * on-chain ERC-1271 read are INJECTED so the module stays a pure, network-free helper (ADR-0006/0021);
+ * fail-closed throughout (ADR-0013).
+ *
+ * This is the off-chain card whose hash a registry entry references (`@agenticprimitives/registry-kit`).
+ * It is descriptive evidence only and carries NO authority to act.
+ */
+import { sha256 as viemSha256, toHex } from 'viem';
+import { canonicalProfileJson } from './profile.js';
+/** sha256 over the canonical-JSON encoding of a card → `sha256:<hex>`. Deterministic across runtimes
+ *  (UTF-8 byte-level). Reuses {@link canonicalProfileJson} so the bytes hashed here match the package's
+ *  one canonical card encoding. */
+export function hashAgentCard(card) {
+    return `sha256:${viemSha256(toHex(canonicalProfileJson(card))).slice(2)}`;
+}
+/** Deterministic JSON (sorted keys, `undefined` dropped) for the signed-card proof body. */
+function canonicalize(v) {
+    if (v === null || typeof v !== 'object')
+        return JSON.stringify(v) ?? 'null';
+    if (Array.isArray(v))
+        return `[${v.map(canonicalize).join(',')}]`;
+    const o = v;
+    return `{${Object.keys(o)
+        .sort()
+        .filter((k) => o[k] !== undefined)
+        .map((k) => `${JSON.stringify(k)}:${canonicalize(o[k])}`)
+        .join(',')}}`;
+}
+/** The 32-byte digest (0x-hex) the subject SA signs / the ERC-1271 read validates over. Binds the card
+ *  hash to the subject + chain + verifying contract, so a card cannot be replayed for another SA/chain. */
+function cardDigest(b) {
+    return viemSha256(toHex(canonicalize({
+        cardHash: b.cardHash,
+        subjectAgent: b.subjectAgent.toLowerCase(),
+        issuedAt: b.issuedAt,
+        expiresAt: b.expiresAt,
+        chainId: b.chainId,
+        verifyingContract: b.verifyingContract.toLowerCase(),
+    })));
+}
+/** Build a signed card bundle: hash the card, have the subject SA sign the digest (ERC-1271), return the
+ *  signed {@link SignedAgentCardBundleV1}. */
+export async function buildSignedAgentCardBundle(input, sign) {
+    const verifyingContract = input.verifyingContract ?? input.subjectAgent;
+    const cardHash = hashAgentCard(input.card);
+    const signature = await sign(cardDigest({
+        cardHash,
+        subjectAgent: input.subjectAgent,
+        issuedAt: input.issuedAt,
+        expiresAt: input.expiresAt,
+        chainId: input.chainId,
+        verifyingContract,
+    }));
+    return {
+        type: 'SignedAgentCardBundleV1',
+        card: input.card,
+        cardHash,
+        subjectAgent: input.subjectAgent,
+        issuedAt: input.issuedAt,
+        expiresAt: input.expiresAt,
+        proof: {
+            type: 'ERC1271SmartAgentSignature',
+            chainId: input.chainId,
+            verifyingContract,
+            signer: input.subjectAgent,
+            signature,
+        },
+    };
+}
+/** Verify a signed card bundle WITHOUT trusting whoever served it: recompute `cardHash` from the card
+ *  (catches a card tamper that left the hash stale), confirm the proof is self-asserted by the subject SA
+ *  (signer == verifyingContract == subjectAgent — V1), enforce expiry, then re-check the subject SA's
+ *  ERC-1271 signature over the digest (authoritative). Fail-closed: any anomaly → `ok:false`. */
+export async function verifySignedAgentCardBundle(bundle, opts) {
+    if (!bundle ||
+        bundle.type !== 'SignedAgentCardBundleV1' ||
+        !bundle.card ||
+        !bundle.proof?.signature ||
+        bundle.proof.type !== 'ERC1271SmartAgentSignature') {
+        return { ok: false, reason: 'bad_shape' };
+    }
+    let recomputed;
+    try {
+        recomputed = hashAgentCard(bundle.card);
+    }
+    catch {
+        return { ok: false, reason: 'bad_shape' }; // invalid card shape
+    }
+    if (recomputed !== bundle.cardHash)
+        return { ok: false, reason: 'card_hash_mismatch' };
+    // V1: the subject SA self-asserts its own card. A delegated signer is a future version.
+    const subject = bundle.subjectAgent.toLowerCase();
+    if (bundle.proof.signer.toLowerCase() !== subject || bundle.proof.verifyingContract.toLowerCase() !== subject) {
+        return { ok: false, reason: 'subject_mismatch' };
+    }
+    if (bundle.expiresAt) {
+        const exp = Date.parse(bundle.expiresAt);
+        const now = opts.now ?? Date.now();
+        if (!Number.isNaN(exp) && now > exp)
+            return { ok: false, reason: 'expired' };
+    }
+    let valid;
+    try {
+        valid = await opts.verifier.verifyHash({
+            address: bundle.proof.verifyingContract,
+            hash: cardDigest({
+                cardHash: bundle.cardHash,
+                subjectAgent: bundle.subjectAgent,
+                issuedAt: bundle.issuedAt,
+                expiresAt: bundle.expiresAt,
+                chainId: bundle.proof.chainId,
+                verifyingContract: bundle.proof.verifyingContract,
+            }),
+            signature: bundle.proof.signature,
+        });
+    }
+    catch {
+        return { ok: false, reason: 'signature_invalid' };
+    }
+    if (!valid)
+        return { ok: false, reason: 'signature_invalid' };
+    return { ok: true, subjectAgent: bundle.subjectAgent, cardHash: bundle.cardHash, card: bundle.card };
+}
+//# sourceMappingURL=card.js.map

package/dist/card.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card.js","sourceRoot":"","sources":["../src/card.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,KAAK,EAA0B,MAAM,MAAM,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGpD;;mCAEmC;AACnC,MAAM,UAAU,aAAa,CAAC,IAAe;IAC3C,OAAO,UAAU,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAY,CAAC;AACtF,CAAC;AAED,4FAA4F;AAC5F,SAAS,YAAY,CAAC,CAAU;IAC9B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAC5E,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClE,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;SACtB,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC;AAED;2GAC2G;AAC3G,SAAS,UAAU,CAAC,CAOnB;IACC,OAAO,UAAU,CACf,KAAK,CACH,YAAY,CAAC;QACX,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE;QAC1C,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,CAAC,WAAW,EAAE;KACrD,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAsBD;8CAC8C;AAC9C,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAgC,EAChC,IAA0B;IAE1B,MAAM,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,YAAY,CAAC;IACxE,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,IAAI,CAC1B,UAAU,CAAC;QACT,QAAQ;QACR,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB;KAClB,CAAC,CACH,CAAC;IACF,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ;QACR,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE;YACL,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,iBAAiB;YACjB,MAAM,EAAE,KAAK,CAAC,YAAY;YAC1B,SAAS;SACV;KACF,CAAC;AACJ,CAAC;AAMD;;;iGAGiG;AACjG,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAA+B,EAC/B,IAAiD;IAEjD,IACE,CAAC,MAAM;QACP,MAAM,CAAC,IAAI,KAAK,yBAAyB;QACzC,CAAC,MAAM,CAAC,IAAI;QACZ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS;QACxB,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,4BAA4B,EAClD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,qBAAqB;IAClE,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAEvF,wFAAwF;IACxF,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;QAC9G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/E,CAAC;IAED,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;YACrC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB;YACvC,IAAI,EAAE,UAAU,CAAC;gBACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;gBAC7B,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB;aAClD,CAAC;YACF,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACvG,CAAC"}

package/dist/index.d.ts

@@ -1,8 +1,9 @@
 export { CAIP10_NAMESPACE_ALLOWLIST, AGENT_CARD_SCHEMA_VERSION, AUTH_ORIGIN, } from './constants.js';
 export { buildCaip10Address, parseCaip10, isValidCaip10, type Caip10Parts, } from './caip10.js';
 export { canonicalProfileJson, profileContentHash, } from './profile.js';
+export { hashAgentCard, buildSignedAgentCardBundle, verifySignedAgentCardBundle, type Erc1271Verifier, type SmartAgentCardSigner, type BuildSignedAgentCardInput, type VerifySignedAgentCardResult, } from './card.js';
 export { InvalidProfileError, ProfileHashMismatchError, EndpointVerificationError, InvalidCaip10Error, } from './errors.js';
-export type { ProfileType, Caip10Address, VerificationMethod, AiAgentProfile, McpServerProfile, MultisigProfile, ServiceProfile, AgentCard, AgentIdentityClientOpts, PublishProfileInput, } from './types.js';
+export type { ProfileType, Caip10Address, VerificationMethod, AiAgentProfile, McpServerProfile, MultisigProfile, ServiceProfile, AgentCard, Sha256, SignedAgentCardBundleV1, AgentIdentityClientOpts, PublishProfileInput, } from './types.js';
 export { AgentIdentityClient, type WriteContext } from './client.js';
 export { agentProfileResolverAbi } from './abis.js';
 export { buildRegisterProfileCall, buildSetProfileMetadataCall, buildSetProfileStringCall, buildSetProfileAddressCall, buildSetProfileBytes32Call, buildSetProfileActiveCall, type ContractCall, } from './calls.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,WAAW,GACZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,SAAS,EACT,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,mBAAmB,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAMrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAIpD,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,WAAW,GACZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,aAAa,EACb,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,GACjC,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,SAAS,EACT,MAAM,EACN,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,mBAAmB,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAMrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAIpD,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -9,6 +9,8 @@
 export { CAIP10_NAMESPACE_ALLOWLIST, AGENT_CARD_SCHEMA_VERSION, AUTH_ORIGIN, } from './constants.js';
 export { buildCaip10Address, parseCaip10, isValidCaip10, } from './caip10.js';
 export { canonicalProfileJson, profileContentHash, } from './profile.js';
+// Signed agent card bundle (spec 279 §3.2) — prove `cardHash → subjectAgent` without trusting the server.
+export { hashAgentCard, buildSignedAgentCardBundle, verifySignedAgentCardBundle, } from './card.js';
 export { InvalidProfileError, ProfileHashMismatchError, EndpointVerificationError, InvalidCaip10Error, } from './errors.js';
 export { AgentIdentityClient } from './client.js';
 // Phase 3 contract ABIs (live at deployed addresses recorded in

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,EAAE;AACF,OAAO;AACP,0CAA0C;AAC1C,2BAA2B;AAC3B,gDAAgD;AAChD,8EAA8E;AAC9E,2EAA2E;AAE3E,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,WAAW,GACZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,aAAa,GAEd,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAerB,OAAO,EAAE,mBAAmB,EAAqB,MAAM,aAAa,CAAC;AAErE,gEAAgE;AAChE,mEAAmE;AACnE,+DAA+D;AAC/D,0CAA0C;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEpD,kEAAkE;AAClE,yDAAyD;AACzD,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,GAE1B,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,EAAE;AACF,OAAO;AACP,0CAA0C;AAC1C,2BAA2B;AAC3B,gDAAgD;AAChD,8EAA8E;AAC9E,2EAA2E;AAE3E,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,WAAW,GACZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,aAAa,GAEd,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,0GAA0G;AAC1G,OAAO,EACL,aAAa,EACb,0BAA0B,EAC1B,2BAA2B,GAK5B,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAiBrB,OAAO,EAAE,mBAAmB,EAAqB,MAAM,aAAa,CAAC;AAErE,gEAAgE;AAChE,mEAAmE;AACnE,+DAA+D;AAC/D,0CAA0C;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEpD,kEAAkE;AAClE,yDAAyD;AACzD,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,GAE1B,MAAM,YAAY,CAAC"}

package/dist/types.d.ts

@@ -1,8 +1,9 @@
 import type { Address, Hex, Caip10Address } from '@agenticprimitives/types';
 export type { Caip10Address };
 /**
- * Discriminator for AgentCard sub-shapes. Mirrors HCS-11 § typed-profile
- * categories with two additions specific to our model:
+ * Discriminator for AP-native AgentCard sub-shapes. Borrows the useful
+ * typed-profile idea from external registry/card ecosystems while keeping
+ * Ring 0 vocabulary AP-owned:
  *   - `treasury` (custody-policy-governed asset account)
  *   - `multisig` (collective Smart Agent with named members)
  *
@@ -12,8 +13,8 @@ export type { Caip10Address };
  */
 export type ProfileType = 'person' | 'org' | 'service' | 'treasury' | 'mcpServer' | 'multisig';
 /**
- * Endpoint-control verification methods (matches GoDaddy ANS
- * `mcpServer.verification` pattern; we don't import their PKI).
+ * Endpoint-control verification methods. Inspired by external agent-card
+ * verification patterns, but not tied to any DNS/PKI registry integration.
  *
  * - `dns-txt` — owner publishes a TXT record at a known label;
  *   resolver fetches and matches against the on-chain digest.
@@ -64,6 +65,34 @@ export interface ServiceProfile extends BaseProfile {
     endpoint?: string;
 }
 export type AgentCard = AiAgentProfile | McpServerProfile | MultisigProfile | ServiceProfile;
+/** sha256 content hash, e.g. `sha256:ab12…`. The discovery substrate hashes cards with sha256
+ *  (distinct from the keccac `profileContentHash` used as the on-chain `metadata-hash` predicate). */
+export type Sha256 = `sha256:${string}`;
+/**
+ * A self-asserted, SA-signed agent card (spec 279 §3.2). The distinct guarantee: a verifier can prove
+ * `cardHash → subjectAgent` WITHOUT trusting the registry or server that served the card — the subject
+ * Smart Agent signs (via ERC-1271) a digest binding the card hash to its own address + chain. This is the
+ * card that a registry entry's `cardHash` references; it is descriptive evidence and carries NO authority to act.
+ */
+export interface SignedAgentCardBundleV1 {
+    type: 'SignedAgentCardBundleV1';
+    card: AgentCard;
+    /** sha256 over the canonical-JSON card (`hashAgentCard`). */
+    cardHash: Sha256;
+    /** The canonical Smart Agent this card is a facet of (= signer = verifyingContract in V1). */
+    subjectAgent: Address;
+    issuedAt: string;
+    expiresAt?: string;
+    proof: {
+        type: 'ERC1271SmartAgentSignature';
+        chainId: number;
+        /** The ERC-1271 contract whose `isValidSignature` validates the signature (the subject SA in V1). */
+        verifyingContract: Address;
+        /** The signing identity (the subject SA in V1). */
+        signer: Address;
+        signature: Hex;
+    };
+}
 export interface AgentIdentityClientOpts {
     rpcUrl: string;
     chainId: number;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAK5E,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B;;;;;;;;;GASG;AACH,MAAM,MAAM,WAAW,GACnB,QAAQ,GACR,KAAK,GACL,SAAS,GACT,UAAU,GACV,WAAW,GACX,UAAU,CAAC;AAEf;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,YAAY,GACZ,gBAAgB,GAChB,yBAAyB,CAAC;AAE9B,mDAAmD;AACnD,UAAU,WAAW;IACnB,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,IAAI,EAAE,QAAQ,GAAG,KAAK,CAAC;IACvB,2HAA2H;IAC3H,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,IAAI,EAAE,WAAW,CAAC;IAClB,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD,IAAI,EAAE,UAAU,CAAC;IACjB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,OAAO,EAAE,OAAO,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,IAAI,EAAE,SAAS,GAAG,UAAU,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG,gBAAgB,GAAG,eAAe,GAAG,cAAc,CAAC;AAE7F,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,KAAK,EAAE,OAAO,CAAC;IACf,4EAA4E;IAC5E,OAAO,EAAE,SAAS,CAAC;IACnB;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,YAAY,CAAC,EAAE,GAAG,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,GAAG,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAK5E,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B;;;;;;;;;;GAUG;AACH,MAAM,MAAM,WAAW,GACnB,QAAQ,GACR,KAAK,GACL,SAAS,GACT,UAAU,GACV,WAAW,GACX,UAAU,CAAC;AAEf;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,YAAY,GACZ,gBAAgB,GAChB,yBAAyB,CAAC;AAE9B,mDAAmD;AACnD,UAAU,WAAW;IACnB,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,IAAI,EAAE,QAAQ,GAAG,KAAK,CAAC;IACvB,2HAA2H;IAC3H,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,IAAI,EAAE,WAAW,CAAC;IAClB,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD,IAAI,EAAE,UAAU,CAAC;IACjB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,OAAO,EAAE,OAAO,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,IAAI,EAAE,SAAS,GAAG,UAAU,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG,gBAAgB,GAAG,eAAe,GAAG,cAAc,CAAC;AAE7F;sGACsG;AACtG,MAAM,MAAM,MAAM,GAAG,UAAU,MAAM,EAAE,CAAC;AAExC;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,yBAAyB,CAAC;IAChC,IAAI,EAAE,SAAS,CAAC;IAChB,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,8FAA8F;IAC9F,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE;QACL,IAAI,EAAE,4BAA4B,CAAC;QACnC,OAAO,EAAE,MAAM,CAAC;QAChB,qGAAqG;QACrG,iBAAiB,EAAE,OAAO,CAAC;QAC3B,mDAAmD;QACnD,MAAM,EAAE,OAAO,CAAC;QAChB,SAAS,EAAE,GAAG,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,KAAK,EAAE,OAAO,CAAC;IACf,4EAA4E;IAC5E,OAAO,EAAE,SAAS,CAAC;IACnB;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,YAAY,CAAC,EAAE,GAAG,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,GAAG,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@agenticprimitives/agent-profile",
-  "version": "1.0.0-alpha.12",
-  "description": "Agent identity SDK: HCS-11-aligned typed profile schema (AgentCard), HCS-14 CAIP-10 nativeId helpers, mcpServer.verification methods (DNS TXT / signed URL / HTTP challenge / VP), canonical-JSON content-hash. Speaks identity-domain vocabulary only.",
+  "version": "1.0.0-alpha.14",
+  "description": "Agent identity SDK: AP-native typed profile/card schema (AgentCard), CAIP-10 nativeId helpers, endpoint verification methods (DNS TXT / signed URL / HTTP challenge / VP), canonical-JSON content-hash. External registry projections stay outside Ring 0.",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -27,6 +27,10 @@
     "./profile": {
       "types": "./dist/profile.d.ts",
       "import": "./dist/profile.js"
+    },
+    "./card": {
+      "types": "./dist/card.d.ts",
+      "import": "./dist/card.js"
     }
   },
   "files": [
@@ -40,9 +44,9 @@
   },
   "peerDependencies": {
     "viem": "^2.52.2",
-    "@agenticprimitives/agent-account": "1.0.0-alpha.12",
-    "@agenticprimitives/connect-auth": "1.0.0-alpha.12",
-    "@agenticprimitives/types": "1.0.0-alpha.12"
+    "@agenticprimitives/agent-account": "1.0.0-alpha.14",
+    "@agenticprimitives/connect-auth": "1.0.0-alpha.14",
+    "@agenticprimitives/types": "1.0.0-alpha.14"
   },
   "devDependencies": {
     "@types/node": "^22.7.0",