@agenticprimitives/agent-profile 1.0.0-alpha.22 → 1.0.0-alpha.24

package/dist/a2a/release.js

@@ -0,0 +1,197 @@
+/**
+ * Card release lifecycle (spec 347 §3):
+ *
+ *   draft → validated → approvalPending → approved → signed → published → { superseded | deprecated | revoked }
+ *
+ * A release is immutable and identified by release id AND content digest. Editing at `approved` or later
+ * forks a NEW draft (`forkDraft`). Superseding never erases; revocation records reason, authority, date and
+ * successor, and a revoked release is not projection-ready. Every function here is pure and returns a new
+ * object; illegal moves throw `A2ACardLifecycleError` instead of being ignored.
+ */
+import { cardContentDigest, signedCardContentDigest } from './canonical.js';
+import { draftEtag } from './field-binding.js';
+import { decodeProtectedHeader } from './jws.js';
+import { hasErrors, validateA2ACard } from './validation.js';
+export class A2ACardLifecycleError extends Error {
+    from;
+    to;
+    constructor(message, from, to) {
+        super(message);
+        this.from = from;
+        this.to = to;
+        this.name = 'A2ACardLifecycleError';
+    }
+}
+/** Legal transitions. `revoked` is reachable from every non-terminal state via `revoke()`. */
+export const CARD_RELEASE_TRANSITIONS = {
+    validated: ['approvalPending', 'revoked'],
+    approvalPending: ['approved', 'revoked'],
+    approved: ['signed', 'deprecated', 'revoked'],
+    signed: ['published', 'deprecated', 'revoked'],
+    published: ['superseded', 'deprecated', 'revoked'],
+    superseded: [],
+    deprecated: [],
+    revoked: [],
+};
+export const TERMINAL_RELEASE_STATES = new Set(['superseded', 'deprecated', 'revoked']);
+/** Can a projection consume this release? Only approved-and-signed (or published) releases, never revoked. */
+export function isProjectionReady(r) {
+    return (r.state === 'signed' || r.state === 'published') && r.signatures.length > 0 && !r.revocation;
+}
+export class A2ACardValidationError extends Error {
+    diagnostics;
+    constructor(diagnostics) {
+        super(`card has ${diagnostics.filter((d) => d.severity === 'error').length} validation error(s): ${diagnostics.filter((d) => d.severity === 'error').map((d) => d.code).join(', ')}`);
+        this.diagnostics = diagnostics;
+        this.name = 'A2ACardValidationError';
+    }
+}
+/** Freeze a draft into a `validated` release. Throws `A2ACardValidationError` when validation has errors. */
+export function createRelease(draft, opts) {
+    const diagnostics = validateA2ACard(draft.card, {
+        ...opts.validation,
+        fieldBindings: opts.validation.fieldBindings ?? draft.fieldBindings,
+        extendedCardPolicyConfigured: opts.validation.extendedCardPolicyConfigured ?? draft.extendedCardPolicies.length > 0,
+    });
+    if (hasErrors(diagnostics))
+        throw new A2ACardValidationError(diagnostics);
+    const { signatures: _drop, ...unsigned } = draft.card;
+    if (unsigned.version !== opts.agentVersion) {
+        throw new A2ACardValidationError([
+            { code: 'VERSION_MISMATCH', severity: 'error', sourcePointer: '/version', message: `card.version "${unsigned.version}" ≠ release agentVersion "${opts.agentVersion}"` },
+        ]);
+    }
+    const unsignedCard = unsigned;
+    return {
+        releaseId: opts.releaseId ?? `${draft.cardResourceId}:r${opts.releaseNumber}`,
+        cardResourceId: draft.cardResourceId,
+        releaseNumber: opts.releaseNumber,
+        agentVersion: opts.agentVersion,
+        protocolVersion: unsignedCard.protocolVersion,
+        unsignedContentDigest: cardContentDigest(unsignedCard),
+        unsignedCard,
+        fieldBindings: { ...draft.fieldBindings },
+        extendedCardPolicies: draft.extendedCardPolicies.map((p) => ({ ...p })),
+        approvals: [],
+        signatures: [],
+        state: 'validated',
+        createdAt: opts.now,
+        ...(opts.supersedes ? { supersedes: opts.supersedes } : {}),
+    };
+}
+/** Move a release along a legal transition. Throws `A2ACardLifecycleError` otherwise. */
+export function transition(release, to, ctx) {
+    const from = release.state;
+    const fail = (why) => {
+        throw new A2ACardLifecycleError(`illegal release transition ${from} → ${to}: ${why}`, from, to);
+    };
+    if (to === 'revoked')
+        return fail('use revoke() — a revocation records reason and authority');
+    if (!CARD_RELEASE_TRANSITIONS[from].includes(to))
+        return fail('no such transition (spec 347 §3)');
+    switch (to) {
+        case 'approved': {
+            const a = ctx.approval;
+            if (!a)
+                return fail('an ApprovalRefV1 is required');
+            if (a.approvedDigest !== release.unsignedContentDigest)
+                return fail(`approval names digest ${a.approvedDigest}, release is ${release.unsignedContentDigest}`);
+            if (a.expiresAt && Date.parse(a.expiresAt) < Date.parse(ctx.now))
+                return fail('approval has expired');
+            return { ...release, state: 'approved', approvals: [...release.approvals, a] };
+        }
+        case 'signed':
+            if (release.signatures.length === 0 || !release.signedCard)
+                return fail('attach at least one signature first (attachSignature)');
+            return { ...release, state: 'signed' };
+        case 'published':
+            if (!ctx.publication?.uri)
+                return fail('a publication uri is required');
+            return { ...release, state: 'published', publication: { uri: ctx.publication.uri, publishedAt: ctx.now } };
+        case 'superseded':
+            if (!ctx.successor)
+                return fail('a successor release id is required');
+            return { ...release, state: 'superseded', supersededBy: ctx.successor };
+        case 'deprecated':
+        case 'approvalPending':
+            return { ...release, state: to };
+        default:
+            return fail('unhandled');
+    }
+}
+/** Attach a JWS signature (state `approved` or `signed` → `signed`). Refuses a signature over other bytes. */
+export function attachSignature(release, input) {
+    if (release.state !== 'approved' && release.state !== 'signed') {
+        throw new A2ACardLifecycleError(`cannot sign a release in state ${release.state}`, release.state, 'signed');
+    }
+    if (cardContentDigest(input.signedCard) !== release.unsignedContentDigest) {
+        throw new A2ACardLifecycleError('signed card bytes differ from the released unsigned card', release.state, 'signed');
+    }
+    const sigs = input.signedCard.signatures ?? [];
+    if (!sigs.some((s) => s.protected === input.signature.protected && s.signature === input.signature.signature)) {
+        throw new A2ACardLifecycleError('signature entry is not present on the signed card', release.state, 'signed');
+    }
+    const header = decodeProtectedHeader(input.signature);
+    if ((header.alg !== 'ES256' && header.alg !== 'EdDSA') || !header.kid) {
+        throw new A2ACardLifecycleError('signature protected header must carry alg ∈ ES256|EdDSA and kid', release.state, 'signed');
+    }
+    const ref = {
+        kid: header.kid,
+        alg: header.alg,
+        protected: input.signature.protected,
+        signature: input.signature.signature,
+        ...(input.signedAt ? { signedAt: input.signedAt } : {}),
+    };
+    return {
+        ...release,
+        state: 'signed',
+        signedCard: input.signedCard,
+        signedContentDigest: signedCardContentDigest(input.signedCard),
+        signatures: [...release.signatures, ref],
+    };
+}
+/** Attach the SA's EIP-712 binding (state `signed` or `published`). Digests MUST match this release. */
+export function attachSmartAgentBinding(release, signed) {
+    if (release.state !== 'signed' && release.state !== 'published') {
+        throw new A2ACardLifecycleError(`cannot bind a release in state ${release.state}`, release.state, release.state);
+    }
+    const b = signed.binding;
+    if (b.cardReleaseId !== release.releaseId || b.cardResourceId !== release.cardResourceId) {
+        throw new A2ACardLifecycleError('binding names a different card resource / release', release.state, release.state);
+    }
+    if (b.unsignedCardDigest !== release.unsignedContentDigest || !release.signedContentDigest || b.signedCardDigest !== release.signedContentDigest) {
+        throw new A2ACardLifecycleError('binding digests do not match this release', release.state, release.state);
+    }
+    return { ...release, smartAgentBinding: signed };
+}
+/** Revoke from any non-terminal state. Records reason / authority / date / successor; never erases. */
+export function revoke(release, opts) {
+    if (TERMINAL_RELEASE_STATES.has(release.state)) {
+        throw new A2ACardLifecycleError(`cannot revoke a release in terminal state ${release.state}`, release.state, 'revoked');
+    }
+    if (!opts.reason || !opts.authority) {
+        throw new A2ACardLifecycleError('revocation requires reason and authority', release.state, 'revoked');
+    }
+    return {
+        ...release,
+        state: 'revoked',
+        revocation: { reason: opts.reason, authority: opts.authority, revokedAt: opts.now, ...(opts.successor ? { successor: opts.successor } : {}) },
+    };
+}
+/** Editing after `approved` = a new draft. Starts from the release's unsigned card + bindings. */
+export function forkDraft(release, opts) {
+    const draft = {
+        cardResourceId: release.cardResourceId,
+        revision: opts.revision ?? 1,
+        state: 'draft',
+        card: { ...release.unsignedCard },
+        fieldBindings: { ...release.fieldBindings },
+        extendedCardPolicies: release.extendedCardPolicies.map((p) => ({ ...p })),
+        sourceSnapshotDigest: release.unsignedContentDigest,
+        etag: '',
+        updatedAt: opts.now,
+        basedOnReleaseId: release.releaseId,
+    };
+    return { ...draft, etag: draftEtag(draft) };
+}
+//# sourceMappingURL=release.js.map

package/dist/a2a/release.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release.js","sourceRoot":"","sources":["../../src/a2a/release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAUjD,OAAO,EAAE,SAAS,EAAE,eAAe,EAA+B,MAAM,iBAAiB,CAAC;AAE1F,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACR;IAA2C;IAAjF,YAAY,OAAe,EAAW,IAAgC,EAAW,EAAoB;QACnG,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,SAAI,GAAJ,IAAI,CAA4B;QAAW,OAAE,GAAF,EAAE,CAAkB;QAEnG,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAoE;IACvG,SAAS,EAAE,CAAC,iBAAiB,EAAE,SAAS,CAAC;IACzC,eAAe,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC;IACxC,QAAQ,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC;IAC7C,MAAM,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC;IAC9C,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,SAAS,CAAC;IAClD,UAAU,EAAE,EAAE;IACd,UAAU,EAAE,EAAE;IACd,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAkC,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;AAEvH,8GAA8G;AAC9G,MAAM,UAAU,iBAAiB,CAAC,CAAwB;IACxD,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AACvG,CAAC;AAaD,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC1B;IAArB,YAAqB,WAA+C;QAClE,KAAK,CAAC,YAAY,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,yBAAyB,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QADnK,gBAAW,GAAX,WAAW,CAAoC;QAElE,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,6GAA6G;AAC7G,MAAM,UAAU,aAAa,CAAC,KAA0B,EAAE,IAA0B;IAClF,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE;QAC9C,GAAG,IAAI,CAAC,UAAU;QAClB,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa;QACnE,4BAA4B,EAAE,IAAI,CAAC,UAAU,CAAC,4BAA4B,IAAI,KAAK,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC;KACpH,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAC1E,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC;IACtD,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,IAAI,sBAAsB,CAAC;YAC/B,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,QAAQ,CAAC,OAAO,6BAA6B,IAAI,CAAC,YAAY,GAAG,EAAE;SACxK,CAAC,CAAC;IACL,CAAC;IACD,MAAM,YAAY,GAAG,QAA0B,CAAC;IAChD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,GAAG,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,aAAa,EAAE;QAC7E,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,eAAe,EAAE,YAAY,CAAC,eAAe;QAC7C,qBAAqB,EAAE,iBAAiB,CAAC,YAAY,CAAC;QACtD,YAAY;QACZ,aAAa,EAAE,EAAE,GAAG,KAAK,CAAC,aAAa,EAAE;QACzC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACvE,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,EAAE;QACd,KAAK,EAAE,WAAW;QAClB,SAAS,EAAE,IAAI,CAAC,GAAG;QACnB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAaD,yFAAyF;AACzF,MAAM,UAAU,UAAU,CAAC,OAA8B,EAAE,EAAoB,EAAE,GAAsB;IACrG,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAS,EAAE;QAClC,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,IAAI,MAAM,EAAE,KAAK,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAClG,CAAC,CAAC;IACF,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,0DAA0D,CAAC,CAAC;IAC9F,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAClG,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC;YACvB,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,8BAA8B,CAAC,CAAC;YACpD,IAAI,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,qBAAqB;gBAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC,cAAc,gBAAgB,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;YAC9J,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACtG,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;QACjF,CAAC;QACD,KAAK,QAAQ;YACX,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC,uDAAuD,CAAC,CAAC;YACjI,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACzC,KAAK,WAAW;YACd,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG;gBAAE,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAC;YACxE,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7G,KAAK,YAAY;YACf,IAAI,CAAC,GAAG,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACtE,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QAC1E,KAAK,YAAY,CAAC;QAClB,KAAK,iBAAiB;YACpB,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACnC;YACE,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AASD,8GAA8G;AAC9G,MAAM,UAAU,eAAe,CAAC,OAA8B,EAAE,KAA2B;IACzF,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,qBAAqB,EAAE,CAAC;QAC1E,MAAM,IAAI,qBAAqB,CAAC,0DAA0D,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9G,MAAM,IAAI,qBAAqB,CAAC,mDAAmD,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACtE,MAAM,IAAI,qBAAqB,CAAC,iEAAiE,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9H,CAAC;IACD,MAAM,GAAG,GAA0B;QACjC,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS;QACpC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC;IACF,OAAO;QACL,GAAG,OAAO;QACV,KAAK,EAAE,QAAQ;QACf,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,mBAAmB,EAAE,uBAAuB,CAAC,KAAK,CAAC,UAAU,CAAC;QAC9D,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,uBAAuB,CAAC,OAA8B,EAAE,MAAqC;IAC3G,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QAChE,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACnH,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,IAAI,CAAC,CAAC,aAAa,KAAK,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;QACzF,MAAM,IAAI,qBAAqB,CAAC,mDAAmD,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,CAAC,CAAC,kBAAkB,KAAK,OAAO,CAAC,qBAAqB,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,CAAC,CAAC,gBAAgB,KAAK,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACjJ,MAAM,IAAI,qBAAqB,CAAC,2CAA2C,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC;AASD,uGAAuG;AACvG,MAAM,UAAU,MAAM,CAAC,OAA8B,EAAE,IAAmB;IACxE,IAAI,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,qBAAqB,CAAC,0CAA0C,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACxG,CAAC;IACD,OAAO;QACL,GAAG,OAAO;QACV,KAAK,EAAE,SAAS;QAChB,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KAC9I,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,SAAS,CAAC,OAA8B,EAAE,IAAwC;IAChG,MAAM,KAAK,GAAwB;QACjC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC;QAC5B,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE;QACjC,aAAa,EAAE,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE;QAC3C,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACzE,oBAAoB,EAAE,OAAO,CAAC,qBAAqB;QACnD,IAAI,EAAE,EAAE;QACR,SAAS,EAAE,IAAI,CAAC,GAAG;QACnB,gBAAgB,EAAE,OAAO,CAAC,SAAS;KACpC,CAAC;IACF,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;AAC9C,CAAC"}

package/dist/a2a/types.d.ts

@@ -0,0 +1,312 @@
+/**
+ * A2A Agent Card model (spec 347 §4.1; ADR-0062).
+ *
+ * `A2AAgentCardV1` mirrors the A2A 1.0 Agent Card — what THIS A2A server does and how to talk to it. It is
+ * NOT the identity (that is the Smart Agent address, ADR-0010), NOT the Canonical Agent Profile
+ * (`CanonicalAgentProfileV1`, registry-neutral facts), and NOT a registry entry (registries are projected
+ * FROM a released card, never the reverse).
+ *
+ * Hand-authored to mirror A2A 1.0; the standards lock (`docs/standards-lock.json`, spec 347 §6.5) records the
+ * pinned source digest once the proto is vendored. Unknown fields are never dropped silently on import —
+ * they travel beside the typed card in `A2AImportedCardV1.unknownFields` (§7).
+ */
+import type { Address, Hex, ApprovalRefV1, EvidenceRefV1 } from '@agenticprimitives/types';
+import type { Sha256 } from '../types.js';
+export type { Sha256 };
+/** Well-known protocol bindings; the open string keeps forward-compat with bindings A2A adds later. */
+export type A2AProtocolBinding = 'JSONRPC' | 'GRPC' | 'HTTP+JSON' | (string & {});
+export interface A2AAgentInterfaceV1 {
+    /** Absolute URL of the endpoint. In production MUST be `https:` (validation `URL_NOT_HTTPS`). */
+    url: string;
+    protocolBinding: A2AProtocolBinding;
+    /** Protocol version served at this interface when it differs from the card's `protocolVersion`. */
+    protocolVersion?: string;
+    /** Multi-tenant deployments: the tenant this interface serves. */
+    tenant?: string;
+}
+export interface A2AAgentProviderV1 {
+    organization: string;
+    url: string;
+}
+export interface A2AAgentExtensionV1 {
+    uri: string;
+    required?: boolean;
+    description?: string;
+    params?: Record<string, unknown>;
+}
+export interface A2AAgentCapabilitiesV1 {
+    streaming?: boolean;
+    /** DERIVED by the runtime. Claiming it without runtime evidence is `CAPABILITY_UNVERIFIED`. */
+    pushNotifications?: boolean;
+    stateTransitionHistory?: boolean;
+    /** MAY be true only when an extended-card policy is configured AND the authenticated op is implemented. */
+    extendedAgentCard?: boolean;
+    extensions?: A2AAgentExtensionV1[];
+}
+/**
+ * Security schemes — exactly ONE scheme kind per entry, discriminated on `type`. A verifier that finds an
+ * entry claiming two kinds (or none) rejects it (`SECURITY_SCHEME_INVALID`).
+ */
+export interface A2AApiKeySecuritySchemeV1 {
+    type: 'apiKey';
+    name: string;
+    in: 'header' | 'query' | 'cookie';
+    description?: string;
+}
+export interface A2AHttpSecuritySchemeV1 {
+    type: 'http';
+    /** RFC 7235 scheme, e.g. `bearer`, `basic`. */
+    scheme: string;
+    bearerFormat?: string;
+    description?: string;
+}
+export interface A2AOAuthFlowV1 {
+    authorizationUrl?: string;
+    tokenUrl?: string;
+    refreshUrl?: string;
+    scopes: Record<string, string>;
+}
+export interface A2AOAuth2SecuritySchemeV1 {
+    type: 'oauth2';
+    flows: {
+        authorizationCode?: A2AOAuthFlowV1;
+        clientCredentials?: A2AOAuthFlowV1;
+        implicit?: A2AOAuthFlowV1;
+        password?: A2AOAuthFlowV1;
+    };
+    oauth2MetadataUrl?: string;
+    description?: string;
+}
+export interface A2AOpenIdConnectSecuritySchemeV1 {
+    type: 'openIdConnect';
+    openIdConnectUrl: string;
+    description?: string;
+}
+export interface A2AMutualTlsSecuritySchemeV1 {
+    type: 'mutualTLS';
+    description?: string;
+}
+export type A2ASecuritySchemeV1 = A2AApiKeySecuritySchemeV1 | A2AHttpSecuritySchemeV1 | A2AOAuth2SecuritySchemeV1 | A2AOpenIdConnectSecuritySchemeV1 | A2AMutualTlsSecuritySchemeV1;
+export declare const A2A_SECURITY_SCHEME_TYPES: readonly ["apiKey", "http", "oauth2", "openIdConnect", "mutualTLS"];
+/** One requirement: every named scheme (→ its scopes) must be satisfied together. Names MUST resolve
+ *  into `securitySchemes` (`SECURITY_REF_UNRESOLVED`). Alternatives are separate array entries. */
+export type A2ASecurityRequirementV1 = Record<string, string[]>;
+export interface A2AAgentSkillV1 {
+    id: string;
+    name: string;
+    description: string;
+    tags: string[];
+    examples?: string[];
+    inputModes?: string[];
+    outputModes?: string[];
+    securityRequirements?: A2ASecurityRequirementV1[];
+}
+/** One A2A card signature: detached JWS over the canonical card bytes (§4.2). */
+export interface A2AAgentCardSignatureV1 {
+    /** base64url(JSON protected header) — carries `alg` + `kid`. */
+    protected: string;
+    /** base64url(JWS signature bytes). */
+    signature: string;
+    /** Unprotected header (never covered by the signature; informational only). */
+    header?: Record<string, unknown>;
+}
+export interface A2AAgentCardV1 {
+    /** A2A protocol version this card conforms to (`'1.0'`). */
+    protocolVersion: string;
+    name: string;
+    description: string;
+    /** The AGENT IMPLEMENTATION version — never the protocol version (`VERSION_EQUALS_PROTOCOL_VERSION`). */
+    version: string;
+    provider?: A2AAgentProviderV1;
+    documentationUrl?: string;
+    iconUrl?: string;
+    /** Ordered: the FIRST entry is the preferred interface; the rest are equivalent bindings. */
+    supportedInterfaces: A2AAgentInterfaceV1[];
+    capabilities: A2AAgentCapabilitiesV1;
+    defaultInputModes: string[];
+    defaultOutputModes: string[];
+    securitySchemes?: Record<string, A2ASecuritySchemeV1>;
+    securityRequirements?: A2ASecurityRequirementV1[];
+    skills: A2AAgentSkillV1[];
+    /** Excluded from the canonical bytes; each entry signs everything else. */
+    signatures?: A2AAgentCardSignatureV1[];
+}
+/** Top-level A2A 1.0 field names. Anything else on an imported document is an unknown field. */
+export declare const A2A_CARD_KNOWN_FIELDS: readonly ["protocolVersion", "name", "description", "version", "provider", "documentationUrl", "iconUrl", "supportedInterfaces", "capabilities", "defaultInputModes", "defaultOutputModes", "securitySchemes", "securityRequirements", "skills", "signatures"];
+/**
+ * An imported card: the typed card PLUS everything the import could not type, keyed by RFC 6901 JSON
+ * pointer, PLUS the untouched source. The source is evidence; the typed card is a derived view of it.
+ */
+export interface A2AImportedCardV1 {
+    card: A2AAgentCardV1;
+    /** Fields the A2A 1.0 model does not define, by JSON pointer (`/agentAddress`, `/capabilities/foo`). */
+    unknownFields: Record<string, unknown>;
+    /** The exact bytes received — never mutated. */
+    sourceBytes: Uint8Array;
+    /** `sha256:` of `sourceBytes` (NOT of the canonical form). */
+    sourceDigest: Sha256;
+    retrievedAt?: string;
+    uri?: string;
+}
+/**
+ * Editor-only tri-state for optional fields: "omitted" and "explicitly set to the default" are DIFFERENT
+ * documents (different bytes, different digests), and a form must be able to say which one it means.
+ * Never serialized into a card.
+ */
+export type OptionalPresence<T> = {
+    presence: 'unset';
+} | {
+    presence: 'set';
+    value: T;
+};
+export type FieldBindingMode = 'inherit' | 'override' | 'computed' | 'manual';
+export type FieldBindingSourceKind = 'agent-profile' | 'agent-naming' | 'surface-catalog' | 'runtime' | 'capability-claims' | 'attestation' | 'deployment' | 'import' | 'user';
+export type FieldBindingState = 'fresh' | 'stale' | 'conflict' | 'verified';
+/** Provenance of ONE effective card field. A human override is a recorded, reviewable decision. */
+export interface FieldBindingV1 {
+    /** RFC 6901 JSON pointer into the card (`/name`, `/skills/2`). */
+    pointer: string;
+    mode: FieldBindingMode;
+    source: {
+        kind: FieldBindingSourceKind;
+        ref?: string;
+    };
+    evidence?: EvidenceRefV1[];
+    state: FieldBindingState;
+    updatedAt: string;
+    /**
+     * For `override`: `sha256:` of the INHERITED value this override replaced (JCS of the value). Lets
+     * `detectStale` tell "the base changed under my override" (→ `conflict`) apart from "still what I overrode".
+     */
+    baseDigest?: Sha256;
+}
+export type CardEnvironment = 'production' | 'staging' | 'development';
+export type CardDraftState = 'draft' | 'validated' | 'stale';
+/** Release lifecycle (spec 347 §3). Editing at `approved` or later forks a NEW draft. */
+export type CardReleaseState = 'validated' | 'approvalPending' | 'approved' | 'signed' | 'published' | 'superseded' | 'deprecated' | 'revoked';
+/** Audience overlay on the public base card — the effective extended card is base + policy, never a copy. */
+export interface ExtendedCardPolicyV1 {
+    policyId: string;
+    audienceId: string;
+    requiredScheme?: string;
+    /** Entitlement resource/action or scope a caller must hold to receive the overlay. Never a grant. */
+    requiredEntitlement?: string;
+    additionalSkills?: A2AAgentSkillV1[];
+    additionalInterfaces?: A2AAgentInterfaceV1[];
+    additionalDocumentationUrl?: string;
+    additionalSecuritySchemes?: Record<string, A2ASecuritySchemeV1>;
+    expiresAt?: string;
+    reviewBy?: string;
+    auditRequirements?: string[];
+}
+/** The managed object: one canonical agent → 0..n card resources; one production primary. */
+export interface A2AAgentCardResourceV1 {
+    cardResourceId: string;
+    /** `eip155:<chain>:<sa>` — the canonical agent this card describes. */
+    canonicalAgentId: string;
+    displayName?: string;
+    environment: CardEnvironment;
+    primary: boolean;
+    currentDraftRevision?: number;
+    latestReleaseId?: string;
+    createdAt: string;
+    updatedAt: string;
+}
+/** The mutable draft: card + provenance. Optimistic-concurrent by `revision` / `etag`. */
+export interface A2AAgentCardDraftV1 {
+    cardResourceId: string;
+    revision: number;
+    state: CardDraftState;
+    card: A2AAgentCardV1;
+    fieldBindings: Record<string, FieldBindingV1>;
+    extendedCardPolicies: ExtendedCardPolicyV1[];
+    /** `sha256:` of the inherited base card the draft was derived from (`inheritCardBase` output). */
+    sourceSnapshotDigest: Sha256;
+    etag: string;
+    updatedAt: string;
+    basedOnReleaseId?: string;
+}
+/** Reference to one JWS signature on a release. */
+export interface A2ACardSignatureRefV1 {
+    kid: string;
+    alg: 'ES256' | 'EdDSA';
+    protected: string;
+    signature: string;
+    signedAt?: string;
+}
+/** EIP-712 message (§4.2). Digests are `sha256:` strings here; `bytes32` on the wire (`sha256ToBytes32`). */
+export interface SmartAgentCardBindingV1 {
+    canonicalAgentId: string;
+    cardResourceId: string;
+    cardReleaseId: string;
+    cardUri: string;
+    unsignedCardDigest: Sha256;
+    signedCardDigest: Sha256;
+    /** RFC 7638 JWK thumbprint (base64url, sha256) of the JWS signing key. */
+    signerKeyThumbprint: string;
+    /** Unix seconds. */
+    validFrom: number;
+    validUntil: number;
+}
+/** A binding plus the SA's ERC-1271-validatable signature over its EIP-712 digest. */
+export interface SignedSmartAgentCardBindingV1 {
+    binding: SmartAgentCardBindingV1;
+    chainId: number;
+    /** The Smart Agent (EIP-712 `verifyingContract`; ERC-1271 validator). */
+    verifyingContract: Address;
+    signature: Hex;
+}
+export interface CardRevocationV1 {
+    reason: string;
+    /** Who/what authorized the revocation (approval id, authority ref). */
+    authority: string;
+    revokedAt: string;
+    successor?: string;
+}
+/** An immutable release, identified by release id AND content digest. */
+export interface A2AAgentCardReleaseV1 {
+    releaseId: string;
+    cardResourceId: string;
+    releaseNumber: number;
+    agentVersion: string;
+    protocolVersion: string;
+    unsignedContentDigest: Sha256;
+    signedContentDigest?: Sha256;
+    unsignedCard: A2AAgentCardV1;
+    signedCard?: A2AAgentCardV1;
+    fieldBindings: Record<string, FieldBindingV1>;
+    extendedCardPolicies: ExtendedCardPolicyV1[];
+    approvals: ApprovalRefV1[];
+    signatures: A2ACardSignatureRefV1[];
+    smartAgentBinding?: SignedSmartAgentCardBindingV1;
+    state: CardReleaseState;
+    createdAt: string;
+    supersedes?: string;
+    supersededBy?: string;
+    publication?: {
+        uri: string;
+        publishedAt: string;
+    };
+    revocation?: CardRevocationV1;
+}
+/**
+ * The SA's published authorization of a card-signing key (§4.2): an AP-aware verifier checks
+ * JWS valid → key thumbprint authorized → binding valid. Published beside the card in the AP Registry entry.
+ * This record DESCRIBES the authorization; the grant itself is issued by the SA through its authority
+ * machinery — carrying this record grants nothing.
+ */
+export interface CardSigningKeyAuthorizationV1 {
+    keyThumbprint: string;
+    permittedCardIds: string[];
+    permittedDomains: string[];
+    algorithms: ('ES256' | 'EdDSA')[];
+    validity: {
+        from: string;
+        until: string;
+    };
+    /** Where a verifier checks for revocation of this authorization. */
+    revocationRef?: string;
+    /** Reference to the SA-issued grant record this authorization mirrors. */
+    authorityRef?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/a2a/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/a2a/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,YAAY,EAAE,MAAM,EAAE,CAAC;AAIvB,uGAAuG;AACvG,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElF,MAAM,WAAW,mBAAmB;IAClC,iGAAiG;IACjG,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,EAAE,kBAAkB,CAAC;IACpC,mGAAmG;IACnG,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+FAA+F;IAC/F,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,2GAA2G;IAC3G,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,UAAU,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AACD,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AACD,MAAM,WAAW,cAAc;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AACD,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE;QACL,iBAAiB,CAAC,EAAE,cAAc,CAAC;QACnC,iBAAiB,CAAC,EAAE,cAAc,CAAC;QACnC,QAAQ,CAAC,EAAE,cAAc,CAAC;QAC1B,QAAQ,CAAC,EAAE,cAAc,CAAC;KAC3B,CAAC;IACF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AACD,MAAM,WAAW,gCAAgC;IAC/C,IAAI,EAAE,eAAe,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AACD,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AACD,MAAM,MAAM,mBAAmB,GAC3B,yBAAyB,GACzB,uBAAuB,GACvB,yBAAyB,GACzB,gCAAgC,GAChC,4BAA4B,CAAC;AAEjC,eAAO,MAAM,yBAAyB,qEAAsE,CAAC;AAE7G;mGACmG;AACnG,MAAM,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAEhE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,oBAAoB,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACnD;AAED,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACtC,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,yGAAyG;IACzG,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6FAA6F;IAC7F,mBAAmB,EAAE,mBAAmB,EAAE,CAAC;IAC3C,YAAY,EAAE,sBAAsB,CAAC;IACrC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACtD,oBAAoB,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAClD,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,2EAA2E;IAC3E,UAAU,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACxC;AAED,gGAAgG;AAChG,eAAO,MAAM,qBAAqB,gQAgBoB,CAAC;AAEvD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,cAAc,CAAC;IACrB,wGAAwG;IACxG,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,gDAAgD;IAChD,WAAW,EAAE,UAAU,CAAC;IACxB,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;IAAE,QAAQ,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CAAC;AAIxF,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE9E,MAAM,MAAM,sBAAsB,GAC9B,eAAe,GACf,cAAc,GACd,iBAAiB,GACjB,SAAS,GACT,mBAAmB,GACnB,aAAa,GACb,YAAY,GACZ,QAAQ,GACR,MAAM,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;AAE5E,mGAAmG;AACnG,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE;QAAE,IAAI,EAAE,sBAAsB,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC;IAC3B,KAAK,EAAE,iBAAiB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,eAAe,GAAG,YAAY,GAAG,SAAS,GAAG,aAAa,CAAC;AAEvE,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,WAAW,GAAG,OAAO,CAAC;AAE7D,yFAAyF;AACzF,MAAM,MAAM,gBAAgB,GACxB,WAAW,GACX,iBAAiB,GACjB,UAAU,GACV,QAAQ,GACR,WAAW,GACX,YAAY,GACZ,YAAY,GACZ,SAAS,CAAC;AAEd,6GAA6G;AAC7G,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qGAAqG;IACrG,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAC;IACrC,oBAAoB,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC7C,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,yBAAyB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,6FAA6F;AAC7F,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,eAAe,CAAC;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,cAAc,CAAC;IACtB,IAAI,EAAE,cAAc,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC9C,oBAAoB,EAAE,oBAAoB,EAAE,CAAC;IAC7C,kGAAkG;IAClG,oBAAoB,EAAE,MAAM,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,6GAA6G;AAC7G,MAAM,WAAW,uBAAuB;IACtC,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,sFAAsF;AACtF,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,uBAAuB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,EAAE,GAAG,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,EAAE,cAAc,CAAC;IAC7B,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC9C,oBAAoB,EAAE,oBAAoB,EAAE,CAAC;IAC7C,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,UAAU,EAAE,qBAAqB,EAAE,CAAC;IACpC,iBAAiB,CAAC,EAAE,6BAA6B,CAAC;IAClD,KAAK,EAAE,gBAAgB,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED;;;;;GAKG;AACH,MAAM,WAAW,6BAA6B;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,UAAU,EAAE,CAAC,OAAO,GAAG,OAAO,CAAC,EAAE,CAAC;IAClC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB"}

package/dist/a2a/types.js

@@ -0,0 +1,32 @@
+/**
+ * A2A Agent Card model (spec 347 §4.1; ADR-0062).
+ *
+ * `A2AAgentCardV1` mirrors the A2A 1.0 Agent Card — what THIS A2A server does and how to talk to it. It is
+ * NOT the identity (that is the Smart Agent address, ADR-0010), NOT the Canonical Agent Profile
+ * (`CanonicalAgentProfileV1`, registry-neutral facts), and NOT a registry entry (registries are projected
+ * FROM a released card, never the reverse).
+ *
+ * Hand-authored to mirror A2A 1.0; the standards lock (`docs/standards-lock.json`, spec 347 §6.5) records the
+ * pinned source digest once the proto is vendored. Unknown fields are never dropped silently on import —
+ * they travel beside the typed card in `A2AImportedCardV1.unknownFields` (§7).
+ */
+export const A2A_SECURITY_SCHEME_TYPES = ['apiKey', 'http', 'oauth2', 'openIdConnect', 'mutualTLS'];
+/** Top-level A2A 1.0 field names. Anything else on an imported document is an unknown field. */
+export const A2A_CARD_KNOWN_FIELDS = [
+    'protocolVersion',
+    'name',
+    'description',
+    'version',
+    'provider',
+    'documentationUrl',
+    'iconUrl',
+    'supportedInterfaces',
+    'capabilities',
+    'defaultInputModes',
+    'defaultOutputModes',
+    'securitySchemes',
+    'securityRequirements',
+    'skills',
+    'signatures',
+];
+//# sourceMappingURL=types.js.map

package/dist/a2a/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/a2a/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA8FH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW,CAAU,CAAC;AAiD7G,gGAAgG;AAChG,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,iBAAiB;IACjB,MAAM;IACN,aAAa;IACb,SAAS;IACT,UAAU;IACV,kBAAkB;IAClB,SAAS;IACT,qBAAqB;IACrB,cAAc;IACd,mBAAmB;IACnB,oBAAoB;IACpB,iBAAiB;IACjB,sBAAsB;IACtB,QAAQ;IACR,YAAY;CACwC,CAAC"}

package/dist/a2a/validation.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Pure validation of an A2A Agent Card (spec 347 §4.4) → `ProjectionDiagnosticV1[]`.
+ *
+ * Four families, all PURE (no network, no clock, no randomness):
+ *   structural  — required fields, one-of security schemes, absolute HTTPS URLs (production), MIME shape,
+ *                 unique skill ids, security refs resolve;
+ *   serialization — JCS reproducible (canonicalize twice, compare);
+ *   semantic    — ≥1 interface (first = preferred), `extendedAgentCard` only with a policy, push claims
+ *                 need runtime evidence (`CAPABILITY_UNVERIFIED`), version ≠ protocol version, catalog
+ *                 agreement without an `override` binding (`CATALOG_DIVERGENCE`, spec 347 §13(b));
+ *   security/privacy — secret-looking strings, loopback/private/link-local/metadata URLs, vault refs,
+ *                 PII patterns (warning).
+ * Runtime checks (reachability, handshake, TLS, digest-at-well-known) are a separate app-side port —
+ * deliberately NOT here.
+ */
+import type { ProjectionDiagnosticV1 } from '@agenticprimitives/types';
+import { type CardLike } from './canonical.js';
+import { type A2AAgentCardV1, type A2AAgentInterfaceV1, type CardEnvironment, type FieldBindingV1 } from './types.js';
+/** Stable diagnostic codes. Each is emitted by exactly one check; consumers key on these, not messages. */
+export declare const DIAGNOSTIC_CODES: {
+    readonly STRUCT_MISSING_FIELD: "STRUCT_MISSING_FIELD";
+    readonly STRUCT_INVALID_TYPE: "STRUCT_INVALID_TYPE";
+    readonly PROTOCOL_VERSION_MISMATCH: "PROTOCOL_VERSION_MISMATCH";
+    readonly URL_NOT_ABSOLUTE: "URL_NOT_ABSOLUTE";
+    readonly URL_NOT_HTTPS: "URL_NOT_HTTPS";
+    readonly MIME_TYPE_INVALID: "MIME_TYPE_INVALID";
+    readonly SKILL_ID_DUPLICATE: "SKILL_ID_DUPLICATE";
+    readonly SECURITY_SCHEME_INVALID: "SECURITY_SCHEME_INVALID";
+    readonly SECURITY_REF_UNRESOLVED: "SECURITY_REF_UNRESOLVED";
+    readonly EXTENSION_URI_INVALID: "EXTENSION_URI_INVALID";
+    readonly CANONICALIZATION_FAILED: "CANONICALIZATION_FAILED";
+    readonly JCS_NOT_REPRODUCIBLE: "JCS_NOT_REPRODUCIBLE";
+    readonly NO_INTERFACE: "NO_INTERFACE";
+    readonly INTERFACE_BINDING_UNKNOWN: "INTERFACE_BINDING_UNKNOWN";
+    readonly EXTENDED_CARD_WITHOUT_POLICY: "EXTENDED_CARD_WITHOUT_POLICY";
+    readonly CAPABILITY_UNVERIFIED: "CAPABILITY_UNVERIFIED";
+    readonly VERSION_EQUALS_PROTOCOL_VERSION: "VERSION_EQUALS_PROTOCOL_VERSION";
+    readonly PROVIDER_MISSING: "PROVIDER_MISSING";
+    readonly CATALOG_DIVERGENCE: "CATALOG_DIVERGENCE";
+    readonly SECRET_MATERIAL_DETECTED: "SECRET_MATERIAL_DETECTED";
+    readonly PRIVATE_URL_DETECTED: "PRIVATE_URL_DETECTED";
+    readonly VAULT_REFERENCE_DETECTED: "VAULT_REFERENCE_DETECTED";
+    readonly PII_SUSPECTED: "PII_SUSPECTED";
+    readonly UNKNOWN_FIELD: "UNKNOWN_FIELD";
+    readonly SIGNATURE_INVALID: "SIGNATURE_INVALID";
+    readonly SIGNATURE_UNVERIFIED: "SIGNATURE_UNVERIFIED";
+    readonly SOURCE_NOT_JSON: "SOURCE_NOT_JSON";
+};
+export type DiagnosticCode = (typeof DIAGNOSTIC_CODES)[keyof typeof DIAGNOSTIC_CODES];
+/** Structural view of `surface-catalog`'s `A2aCardSkillLike` — no package dependency (spec 347 §10.2 note). */
+export interface CatalogSkillLike {
+    id: string;
+    name?: string;
+    description?: string;
+}
+/** Runtime-declared capabilities — evidence for `capabilities.*` claims. */
+export interface RuntimeCapabilityEvidence {
+    streaming?: boolean;
+    pushNotifications?: boolean;
+    stateTransitionHistory?: boolean;
+    extendedAgentCard?: boolean;
+}
+export interface ValidateA2ACardOptions {
+    /** Pinned A2A version the card MUST declare. Default `'1.0'`. */
+    protocolVersion?: string;
+    environment: CardEnvironment;
+    /** Interfaces the surface catalog / deployment says are served. Disagreement without an override ⇒ error. */
+    surfaceInterfaces?: Pick<A2AAgentInterfaceV1, 'url' | 'protocolBinding'>[];
+    /** What the runtime actually implements. Absent ⇒ `pushNotifications:true` is unverifiable. */
+    runtimeCapabilities?: RuntimeCapabilityEvidence;
+    /** Skills the surface catalog serves (`toCardProjectionSet(...).public`). */
+    catalogSkills?: CatalogSkillLike[];
+    fieldBindings?: Record<string, FieldBindingV1>;
+    /** Whether ≥1 extended-card policy is configured (needed for `capabilities.extendedAgentCard`). */
+    extendedCardPolicyConfigured?: boolean;
+}
+export declare function hasErrors(diagnostics: readonly ProjectionDiagnosticV1[]): boolean;
+/** Validate a card. Returns diagnostics; never throws on card content. */
+export declare function validateA2ACard(card: A2AAgentCardV1 | CardLike, opts: ValidateA2ACardOptions): ProjectionDiagnosticV1[];
+export declare function isPrivateHost(hostname: string): boolean;
+//# sourceMappingURL=validation.d.ts.map