@agenticprimitives/agent-profile 1.0.0-alpha.38 → 1.0.0-alpha.39

package/dist/calls.d.ts

@@ -14,6 +14,7 @@
  * pure encode-only.
  */
 import type { Address, Hex } from '@agenticprimitives/types';
+import { type ClientKeysRecordV1 } from './client-key-binding.js';
 import type { AgentDistributionV1 } from './types.js';
 /** Minimal call-shape: the standard `{ to, value, data }` triple. */
 export interface ContractCall {
@@ -63,6 +64,16 @@ export declare function buildSetDistributionCall(args: {
     agent: Address;
     distribution: AgentDistributionV1;
 }): ContractCall;
+/**
+ * Set the SA-keyed `atl:clientKeys` record (spec 442 §3) via `setStringProperty`. The SA signs this call itself —
+ * a registry never writes it. Validates first and throws `InvalidProfileError`. Writing a record WITHOUT a row is
+ * the explicit revocation of that key (the custody-epoch bump is the other).
+ */
+export declare function buildSetClientKeysCall(args: {
+    profileResolver: Address;
+    agent: Address;
+    clientKeys: ClientKeysRecordV1;
+}): ContractCall;
 /** Set a single address property on an agent's profile. */
 export declare function buildSetProfileAddressCall(args: {
     profileResolver: Address;

package/dist/calls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"calls.d.ts","sourceRoot":"","sources":["../src/calls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAI7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,qEAAqE;AACrE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,GAAG,CAAC;CACX;AAID;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,YAAY,CAgBf;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,GAAG,CAAC;CACnB,GAAG,YAAY,CAUf;AAED,0DAA0D;AAC1D,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,GAAG,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,YAAY,CAUf;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,mBAAmB,CAAC;CACnC,GAAG,YAAY,CAOf;AAED,2DAA2D;AAC3D,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,GAAG,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,YAAY,CAUf;AAED,2DAA2D;AAC3D,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,GAAG,CAAC;IACf,KAAK,EAAE,GAAG,CAAC;CACZ,GAAG,YAAY,CAUf;AAED,yDAAyD;AACzD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,YAAY,CAUf"}
+{"version":3,"file":"calls.d.ts","sourceRoot":"","sources":["../src/calls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAG7D,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAEpF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,qEAAqE;AACrE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,GAAG,CAAC;CACX;AAID;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,YAAY,CAgBf;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,GAAG,CAAC;CACnB,GAAG,YAAY,CAUf;AAED,0DAA0D;AAC1D,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,GAAG,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,YAAY,CAUf;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,mBAAmB,CAAC;CACnC,GAAG,YAAY,CAOf;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,kBAAkB,CAAC;CAChC,GAAG,YAAY,CAOf;AAED,2DAA2D;AAC3D,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,GAAG,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,YAAY,CAUf;AAED,2DAA2D;AAC3D,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,GAAG,CAAC;IACf,KAAK,EAAE,GAAG,CAAC;CACZ,GAAG,YAAY,CAUf;AAED,yDAAyD;AACzD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,YAAY,CAUf"}

package/dist/calls.js

@@ -15,7 +15,8 @@
  */
 import { encodeFunctionData } from 'viem';
 import { agentProfileResolverAbi } from './abis.js';
-import { DISTRIBUTION } from './constants.js';
+import { CLIENT_KEYS, DISTRIBUTION } from './constants.js';
+import { encodeClientKeys } from './client-key-binding.js';
 import { encodeDistribution } from './distribution.js';
 const ZERO_BYTES32 = '0x0000000000000000000000000000000000000000000000000000000000000000';
 /**
@@ -82,6 +83,19 @@ export function buildSetDistributionCall(args) {
         value: encodeDistribution(args.distribution),
     });
 }
+/**
+ * Set the SA-keyed `atl:clientKeys` record (spec 442 §3) via `setStringProperty`. The SA signs this call itself —
+ * a registry never writes it. Validates first and throws `InvalidProfileError`. Writing a record WITHOUT a row is
+ * the explicit revocation of that key (the custody-epoch bump is the other).
+ */
+export function buildSetClientKeysCall(args) {
+    return buildSetProfileStringCall({
+        profileResolver: args.profileResolver,
+        agent: args.agent,
+        predicate: CLIENT_KEYS,
+        value: encodeClientKeys(args.clientKeys),
+    });
+}
 /** Set a single address property on an agent's profile. */
 export function buildSetProfileAddressCall(args) {
     return {

package/dist/calls.js.map

@@ -1 +1 @@
-{"version":3,"file":"calls.js","sourceRoot":"","sources":["../src/calls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAUvD,MAAM,YAAY,GAAG,oEAA2E,CAAC;AAEjG;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAOxC;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,UAAU;YACxB,IAAI,EAAE;gBACJ,IAAI,CAAC,KAAK;gBACV,IAAI,CAAC,WAAW,IAAI,EAAE;gBACtB,IAAI,CAAC,WAAW,IAAI,EAAE;gBACtB,IAAI,CAAC,SAAS,IAAI,YAAY;gBAC9B,IAAI,CAAC,gBAAgB,IAAI,EAAE;aAC5B;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAK3C;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,aAAa;YAC3B,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC;SACxD,CAAC;KACH,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,yBAAyB,CAAC,IAKzC;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,mBAAmB;YACjC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC;SAC/C,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAIxC;IACC,OAAO,yBAAyB,CAAC;QAC/B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,YAAY;QACvB,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC;KAC7C,CAAC,CAAC;AACL,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,0BAA0B,CAAC,IAK1C;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,oBAAoB;YAClC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC;SAC/C,CAAC;KACH,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,0BAA0B,CAAC,IAK1C;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,oBAAoB;YAClC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC;SAC/C,CAAC;KACH,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,yBAAyB,CAAC,IAIzC;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,WAAW;YACzB,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;SAChC,CAAC;KACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"calls.js","sourceRoot":"","sources":["../src/calls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAA2B,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAUvD,MAAM,YAAY,GAAG,oEAA2E,CAAC;AAEjG;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAOxC;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,UAAU;YACxB,IAAI,EAAE;gBACJ,IAAI,CAAC,KAAK;gBACV,IAAI,CAAC,WAAW,IAAI,EAAE;gBACtB,IAAI,CAAC,WAAW,IAAI,EAAE;gBACtB,IAAI,CAAC,SAAS,IAAI,YAAY;gBAC9B,IAAI,CAAC,gBAAgB,IAAI,EAAE;aAC5B;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAK3C;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,aAAa;YAC3B,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC;SACxD,CAAC;KACH,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,yBAAyB,CAAC,IAKzC;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,mBAAmB;YACjC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC;SAC/C,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAIxC;IACC,OAAO,yBAAyB,CAAC;QAC/B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,YAAY;QACvB,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC;KAC7C,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAItC;IACC,OAAO,yBAAyB,CAAC;QAC/B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,WAAW;QACtB,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,0BAA0B,CAAC,IAK1C;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,oBAAoB;YAClC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC;SAC/C,CAAC;KACH,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,0BAA0B,CAAC,IAK1C;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,oBAAoB;YAClC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC;SAC/C,CAAC;KACH,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,yBAAyB,CAAC,IAIzC;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,eAAe;QACxB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,kBAAkB,CAAC;YACvB,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,WAAW;YACzB,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;SAChC,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/client-key-binding.d.ts

@@ -0,0 +1,196 @@
+/**
+ * `ClientKeyBindingV1` — the Smart Agent's EIP-712 statement that ONE public key (a JWK, by RFC 7638
+ * thumbprint) may PRESENT for it at external doors — OAuth `private_key_jwt`, DPoP, RFC 9421 HTTP signatures,
+ * a TAP key directory — under one custody epoch, between `notBefore` and `notAfter`, published under one
+ * `clientId` (spec 442 §3; ontology `ap:ClientKeyBinding`; on-chain record `atl:clientKeys`).
+ *
+ * The service-agent-signing rule, applied to the doors the field runs: the service never holds the identity's
+ * key; it holds a DELEGATE (a custodied P-256 / Ed25519 key behind `JwsSignerPort`) and presents this binding beside
+ * it. Those doors cannot verify an ERC-7710 wire, so the binding takes the form they can carry: a signed
+ * statement the SA stands behind, validated through ERC-1271 by anyone who wants more than OAuth's trust.
+ *
+ * WHAT IT IS NOT. It is not an authority wire: it grants the key NO authority to act. Signatures under this key are the
+ * agent's PRESENTATIONS; what the agent may do at a door is still a mandate, verified per step (spec 350 §3.6).
+ * Revoked by a custody-epoch bump (every binding under the old epoch is dead — rotation re-approves, recovery
+ * does not; spec 410 §1) or by an explicit `atl:clientKeys` write. Short `notAfter` (≤ 90 days) is the default.
+ *
+ * Domain: `{ name:'AgenticPrimitivesClientKey', version:'1', chainId, verifyingContract: <SA> }`. The ERC-1271
+ * read and the custody-epoch read are INJECTED so this module stays network-free (same ports as `a2a/binding`).
+ */
+import { type Address, type Hex } from 'viem';
+import type { Erc1271Verifier, SmartAgentCardSigner } from './card.js';
+import { CLIENT_KEYS } from './constants.js';
+/** What the FIELD verifies at a door. secp256k1 (`ES256K`) is deliberately absent: no OAuth / DPoP / 9421 door checks it. */
+export type ClientKeyAlg = 'ES256' | 'EdDSA';
+export declare const CLIENT_KEY_ALGS: readonly ClientKeyAlg[];
+/**
+ * `service` — the estate's personal-agent SERVICE presents (the only client at a company's door, spec 442 §7.1).
+ * `person` — the person's own SA presents under its own `clientId`; allowed ONLY for a `naming: public` posture,
+ * because a per-person client document publishes the person's label to every company (§7).
+ */
+export type ClientKeyScope = 'service' | 'person';
+export interface ClientKeyBindingV1 {
+    /** The Smart Agent, CAIP-10 (`eip155:<chainId>:<address>`). */
+    canonicalAgentId: string;
+    scope: ClientKeyScope;
+    /** The HTTPS URL the key is published under (the client metadata document / JWKS / key directory). */
+    clientId: string;
+    /** RFC 7638 thumbprint (base64url sha256) of the public JWK. */
+    jwkThumbprint: string;
+    alg: ClientKeyAlg;
+    /** The SA's custody epoch at signing (`AgentAccount.custodyEpoch()`; 0 for a generation-1 account). */
+    custodyEpoch: number;
+    /** Unix seconds. */
+    notBefore: number;
+    notAfter: number;
+}
+/** A binding plus the SA's ERC-1271-validatable signature over its EIP-712 digest. */
+export interface SignedClientKeyBindingV1 {
+    binding: ClientKeyBindingV1;
+    chainId: number;
+    /** The Smart Agent (EIP-712 `verifyingContract`; ERC-1271 validator). */
+    verifyingContract: Address;
+    signature: Hex;
+}
+export declare const CLIENT_KEY_BINDING_DOMAIN_NAME = "AgenticPrimitivesClientKey";
+export declare const CLIENT_KEY_BINDING_DOMAIN_VERSION = "1";
+export declare const CLIENT_KEY_BINDING_TYPES: {
+    readonly ClientKeyBinding: readonly [{
+        readonly name: "canonicalAgentId";
+        readonly type: "string";
+    }, {
+        readonly name: "scope";
+        readonly type: "string";
+    }, {
+        readonly name: "clientId";
+        readonly type: "string";
+    }, {
+        readonly name: "jwkThumbprint";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "alg";
+        readonly type: "string";
+    }, {
+        readonly name: "custodyEpoch";
+        readonly type: "uint64";
+    }, {
+        readonly name: "notBefore";
+        readonly type: "uint64";
+    }, {
+        readonly name: "notAfter";
+        readonly type: "uint64";
+    }];
+};
+/** The EIP-712 type string (for TYPEHASH parity checks). Off-chain only today: no contract consumes it. */
+export declare const CLIENT_KEY_BINDING_TYPE_STRING = "ClientKeyBinding(string canonicalAgentId,string scope,string clientId,bytes32 jwkThumbprint,string alg,uint64 custodyEpoch,uint64 notBefore,uint64 notAfter)";
+/** The default validity a Home signs for: 90 days. Longer is allowed and visible; it is never silently extended. */
+export declare const CLIENT_KEY_BINDING_DEFAULT_TTL_SECONDS: number;
+export declare function clientKeyBindingDomain(chainId: number, smartAgent: Address): {
+    readonly name: "AgenticPrimitivesClientKey";
+    readonly version: "1";
+    readonly chainId: number;
+    readonly verifyingContract: `0x${string}`;
+};
+/**
+ * Validate a candidate binding. Returns `[]` when well-formed, else one issue per violation. Shape only — the
+ * posture rule is `assertClientKeyScopeAllowed`, the epoch rule is `verifySignedClientKeyBinding`.
+ */
+export declare function validateClientKeyBinding(b: unknown): string[];
+/** The EIP-712 message as signed: the thumbprint as bytes32, the integers as uint64. */
+export declare function clientKeyBindingMessage(b: ClientKeyBindingV1): {
+    canonicalAgentId: string;
+    scope: ClientKeyScope;
+    clientId: string;
+    jwkThumbprint: `0x${string}`;
+    alg: ClientKeyAlg;
+    custodyEpoch: bigint;
+    notBefore: bigint;
+    notAfter: bigint;
+};
+/** The 32-byte EIP-712 digest the SA signs and ERC-1271 validates. */
+export declare function clientKeyBindingDigest(binding: ClientKeyBindingV1, chainId: number, smartAgent: Address): Hex;
+/**
+ * Spec 442 §7: a `scope: 'person'` binding publishes a per-person client document, which names the person to
+ * every company and is enumerable — allowed only when the person's naming posture is already `public`. The
+ * posture is the agent's `AgentDiscoveryPolicyV1.naming` (agent-resolution); passed structurally so this module
+ * depends on nothing. The estate's personal-agent SERVICE (`scope: 'service'`) is the client for everyone else.
+ */
+export declare function clientKeyScopeRefusal(binding: Pick<ClientKeyBindingV1, 'scope'>, posture: {
+    naming: string;
+}): string | null;
+export declare function assertClientKeyScopeAllowed(binding: Pick<ClientKeyBindingV1, 'scope'>, posture: {
+    naming: string;
+}): void;
+export interface BuildSignedClientKeyBindingInput {
+    binding: ClientKeyBindingV1;
+    chainId: number;
+    smartAgent: Address;
+    /** Signs the 32-byte digest as the SA (ERC-1271-validatable). */
+    signer: SmartAgentCardSigner;
+    /** The agent's naming posture — the §7 rule runs here, before any signature. */
+    posture: {
+        naming: string;
+    };
+}
+/** Validate → posture → sign. The binding names this SA on this chain or it is refused before signing. */
+export declare function buildSignedClientKeyBinding(input: BuildSignedClientKeyBindingInput): Promise<SignedClientKeyBindingV1>;
+export type VerifyClientKeyBindingResult = {
+    ok: true;
+    smartAgent: Address;
+    digest: Hex;
+} | {
+    ok: false;
+    reason: 'bad_shape' | 'agent_mismatch' | 'alg_not_field_verifiable' | 'scope_refused' | 'thumbprint_mismatch' | 'stale_custody_epoch' | 'not_yet_valid' | 'expired' | 'signature_invalid';
+    detail?: string;
+};
+export interface VerifyClientKeyBindingOptions {
+    erc1271Verifier: Erc1271Verifier;
+    /** The SA's CURRENT custody epoch, read by the caller (`agent-account` `custodyEpochOf`). A binding under any other epoch is dead. */
+    currentCustodyEpoch: number;
+    /** Unix seconds; defaults to now. */
+    now?: number;
+    /** When given, the binding MUST name this key (the key that actually signed the request being verified). */
+    expectThumbprint?: string;
+    /** When given, the §7 posture rule is re-checked at verification (a door that knows the agent's posture). */
+    posture?: {
+        naming: string;
+    };
+}
+/**
+ * Fail-closed: shape → alg the field verifies → names this SA on this chain → expected key → posture → custody
+ * epoch is CURRENT → validity window → ERC-1271 over the EIP-712 digest. Any anomaly ⇒ `ok:false`.
+ */
+export declare function verifySignedClientKeyBinding(signed: SignedClientKeyBindingV1, opts: VerifyClientKeyBindingOptions): Promise<VerifyClientKeyBindingResult>;
+/**
+ * One row of the SA-keyed `atl:clientKeys` string record: the PUBLIC half of every live binding (thumbprint,
+ * alg, scope, clientId, epoch, notAfter) — what a verifier that wants more than OAuth's trust checks a
+ * presented binding against, and what a JWKS / key directory is projected from. Never the signature, never a
+ * private key. Written by the SA itself (`buildSetClientKeysCall`); an explicit write with the row removed is
+ * the second way to revoke (the first is the custody-epoch bump).
+ */
+export interface ClientKeyRecordRowV1 {
+    thumbprint: string;
+    alg: ClientKeyAlg;
+    scope: ClientKeyScope;
+    clientId: string;
+    custodyEpoch: number;
+    notAfter: number;
+}
+export interface ClientKeysRecordV1 {
+    v: 1;
+    keys: ClientKeyRecordRowV1[];
+}
+export declare function clientKeyRecordRow(b: ClientKeyBindingV1): ClientKeyRecordRowV1;
+/** Validate a candidate record. `[]` when valid. */
+export declare function validateClientKeysRecord(r: unknown): string[];
+/** RFC 8785 canonical JSON — two equal records encode to identical bytes (as `atl:distribution`). */
+export declare function encodeClientKeys(record: ClientKeysRecordV1): string;
+/** Fail-closed: anything that is not a valid record is `null` — an unreadable record is an answer, never a guess (ADR-0013). */
+export declare function decodeClientKeys(value: string | null | undefined): ClientKeysRecordV1 | null;
+/** The rows a verifier treats as LIVE now: current epoch, not past `notAfter`. Stale rows are dead, not pruned here. */
+export declare function liveClientKeys(record: ClientKeysRecordV1, opts: {
+    currentCustodyEpoch: number;
+    now?: number;
+}): ClientKeyRecordRowV1[];
+export { CLIENT_KEYS };
+//# sourceMappingURL=client-key-binding.d.ts.map

package/dist/client-key-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-key-binding.d.ts","sourceRoot":"","sources":["../src/client-key-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAiB,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAE7D,OAAO,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEvE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAK7C,6HAA6H;AAC7H,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,CAAC;AAC7C,eAAO,MAAM,eAAe,EAAE,SAAS,YAAY,EAAgC,CAAC;AAEpF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,QAAQ,CAAC;AAElD,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,cAAc,CAAC;IACtB,sGAAsG;IACtG,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,YAAY,CAAC;IAClB,uGAAuG;IACvG,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,sFAAsF;AACtF,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,EAAE,GAAG,CAAC;CAChB;AAID,eAAO,MAAM,8BAA8B,+BAA+B,CAAC;AAC3E,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAErD,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;CAW3B,CAAC;AAEX,2GAA2G;AAC3G,eAAO,MAAM,8BAA8B,iKACqH,CAAC;AAEjK,oHAAoH;AACpH,eAAO,MAAM,sCAAsC,QAAiB,CAAC;AAErE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO;;;;;EAO1E;AAKD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAqB7D;AAED,wFAAwF;AACxF,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,kBAAkB;;;;;;;;;EAa5D;AAED,sEAAsE;AACtE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,GAAG,CAO7G;AAID;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAK5H;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAGzH;AAID,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,iEAAiE;IACjE,MAAM,EAAE,oBAAoB,CAAC;IAC7B,gFAAgF;IAChF,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7B;AAED,0GAA0G;AAC1G,wBAAsB,2BAA2B,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAY5H;AAID,MAAM,MAAM,4BAA4B,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,GAC9C;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EACF,WAAW,GACX,gBAAgB,GAChB,0BAA0B,GAC1B,eAAe,GACf,qBAAqB,GACrB,qBAAqB,GACrB,eAAe,GACf,SAAS,GACT,mBAAmB,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN,MAAM,WAAW,6BAA6B;IAC5C,eAAe,EAAE,eAAe,CAAC;IACjC,sIAAsI;IACtI,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qCAAqC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4GAA4G;IAC5G,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6GAA6G;IAC7G,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,wBAAwB,EAChC,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,4BAA4B,CAAC,CAyCvC;AAID;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,YAAY,CAAC;IAClB,KAAK,EAAE,cAAc,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,oBAAoB,EAAE,CAAC;CAC9B;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,kBAAkB,GAAG,oBAAoB,CAE9E;AAED,oDAAoD;AACpD,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CA0B7D;AAED,qGAAqG;AACrG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAInE;AAED,gIAAgI;AAChI,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,kBAAkB,GAAG,IAAI,CAK5F;AAED,wHAAwH;AACxH,wBAAgB,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE;IAAE,mBAAmB,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,oBAAoB,EAAE,CAGtI;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/client-key-binding.js

@@ -0,0 +1,282 @@
+/**
+ * `ClientKeyBindingV1` — the Smart Agent's EIP-712 statement that ONE public key (a JWK, by RFC 7638
+ * thumbprint) may PRESENT for it at external doors — OAuth `private_key_jwt`, DPoP, RFC 9421 HTTP signatures,
+ * a TAP key directory — under one custody epoch, between `notBefore` and `notAfter`, published under one
+ * `clientId` (spec 442 §3; ontology `ap:ClientKeyBinding`; on-chain record `atl:clientKeys`).
+ *
+ * The service-agent-signing rule, applied to the doors the field runs: the service never holds the identity's
+ * key; it holds a DELEGATE (a custodied P-256 / Ed25519 key behind `JwsSignerPort`) and presents this binding beside
+ * it. Those doors cannot verify an ERC-7710 wire, so the binding takes the form they can carry: a signed
+ * statement the SA stands behind, validated through ERC-1271 by anyone who wants more than OAuth's trust.
+ *
+ * WHAT IT IS NOT. It is not an authority wire: it grants the key NO authority to act. Signatures under this key are the
+ * agent's PRESENTATIONS; what the agent may do at a door is still a mandate, verified per step (spec 350 §3.6).
+ * Revoked by a custody-epoch bump (every binding under the old epoch is dead — rotation re-approves, recovery
+ * does not; spec 410 §1) or by an explicit `atl:clientKeys` write. Short `notAfter` (≤ 90 days) is the default.
+ *
+ * Domain: `{ name:'AgenticPrimitivesClientKey', version:'1', chainId, verifyingContract: <SA> }`. The ERC-1271
+ * read and the custody-epoch read are INJECTED so this module stays network-free (same ports as `a2a/binding`).
+ */
+import { hashTypedData } from 'viem';
+import { jcsCanonicalize } from '@agenticprimitives/types';
+import { thumbprintToBytes32 } from './a2a/binding.js';
+import { CLIENT_KEYS } from './constants.js';
+import { InvalidProfileError } from './errors.js';
+export const CLIENT_KEY_ALGS = ['ES256', 'EdDSA'];
+// ─── EIP-712 ─────────────────────────────────────────────────────────────────────────────────────────
+export const CLIENT_KEY_BINDING_DOMAIN_NAME = 'AgenticPrimitivesClientKey';
+export const CLIENT_KEY_BINDING_DOMAIN_VERSION = '1';
+export const CLIENT_KEY_BINDING_TYPES = {
+    ClientKeyBinding: [
+        { name: 'canonicalAgentId', type: 'string' },
+        { name: 'scope', type: 'string' },
+        { name: 'clientId', type: 'string' },
+        { name: 'jwkThumbprint', type: 'bytes32' },
+        { name: 'alg', type: 'string' },
+        { name: 'custodyEpoch', type: 'uint64' },
+        { name: 'notBefore', type: 'uint64' },
+        { name: 'notAfter', type: 'uint64' },
+    ],
+};
+/** The EIP-712 type string (for TYPEHASH parity checks). Off-chain only today: no contract consumes it. */
+export const CLIENT_KEY_BINDING_TYPE_STRING = 'ClientKeyBinding(string canonicalAgentId,string scope,string clientId,bytes32 jwkThumbprint,string alg,uint64 custodyEpoch,uint64 notBefore,uint64 notAfter)';
+/** The default validity a Home signs for: 90 days. Longer is allowed and visible; it is never silently extended. */
+export const CLIENT_KEY_BINDING_DEFAULT_TTL_SECONDS = 90 * 24 * 3600;
+export function clientKeyBindingDomain(chainId, smartAgent) {
+    return {
+        name: CLIENT_KEY_BINDING_DOMAIN_NAME,
+        version: CLIENT_KEY_BINDING_DOMAIN_VERSION,
+        chainId,
+        verifyingContract: smartAgent,
+    };
+}
+const CAIP10_EVM = /^eip155:(\d+):(0x[0-9a-fA-F]{40})$/;
+const HTTPS_URL = /^https:\/\/[^\s/?#]+(\/[^\s?#]*)?$/;
+/**
+ * Validate a candidate binding. Returns `[]` when well-formed, else one issue per violation. Shape only — the
+ * posture rule is `assertClientKeyScopeAllowed`, the epoch rule is `verifySignedClientKeyBinding`.
+ */
+export function validateClientKeyBinding(b) {
+    const issues = [];
+    if (typeof b !== 'object' || b === null || Array.isArray(b))
+        return ['binding: must be an object'];
+    const x = b;
+    if (typeof x.canonicalAgentId !== 'string' || !CAIP10_EVM.test(x.canonicalAgentId))
+        issues.push('binding.canonicalAgentId: must be eip155:<chainId>:<address>');
+    if (x.scope !== 'service' && x.scope !== 'person')
+        issues.push('binding.scope: must be service | person');
+    if (typeof x.clientId !== 'string' || !HTTPS_URL.test(x.clientId))
+        issues.push('binding.clientId: must be an https URL');
+    if (typeof x.jwkThumbprint !== 'string')
+        issues.push('binding.jwkThumbprint: required');
+    else {
+        try {
+            thumbprintToBytes32(x.jwkThumbprint);
+        }
+        catch {
+            issues.push('binding.jwkThumbprint: must be a base64url sha256 (RFC 7638)');
+        }
+    }
+    if (typeof x.alg !== 'string' || !CLIENT_KEY_ALGS.includes(x.alg)) {
+        issues.push(`binding.alg: must be one of ${CLIENT_KEY_ALGS.join(' | ')} — the field verifies no other (ES256K is not verifiable at these doors)`);
+    }
+    for (const k of ['custodyEpoch', 'notBefore', 'notAfter']) {
+        if (!Number.isInteger(x[k]) || x[k] < 0)
+            issues.push(`binding.${k}: must be a non-negative integer`);
+    }
+    if (Number.isInteger(x.notBefore) && Number.isInteger(x.notAfter) && x.notAfter <= x.notBefore) {
+        issues.push('binding.notAfter: must be after notBefore (an open-ended client key is not a thing)');
+    }
+    return issues;
+}
+/** The EIP-712 message as signed: the thumbprint as bytes32, the integers as uint64. */
+export function clientKeyBindingMessage(b) {
+    const issues = validateClientKeyBinding(b);
+    if (issues.length)
+        throw new InvalidProfileError(`ClientKeyBindingV1: ${issues.join('; ')}`);
+    return {
+        canonicalAgentId: b.canonicalAgentId,
+        scope: b.scope,
+        clientId: b.clientId,
+        jwkThumbprint: thumbprintToBytes32(b.jwkThumbprint),
+        alg: b.alg,
+        custodyEpoch: BigInt(b.custodyEpoch),
+        notBefore: BigInt(b.notBefore),
+        notAfter: BigInt(b.notAfter),
+    };
+}
+/** The 32-byte EIP-712 digest the SA signs and ERC-1271 validates. */
+export function clientKeyBindingDigest(binding, chainId, smartAgent) {
+    return hashTypedData({
+        domain: clientKeyBindingDomain(chainId, smartAgent),
+        types: CLIENT_KEY_BINDING_TYPES,
+        primaryType: 'ClientKeyBinding',
+        message: clientKeyBindingMessage(binding),
+    });
+}
+// ─── posture ─────────────────────────────────────────────────────────────────────────────────────────
+/**
+ * Spec 442 §7: a `scope: 'person'` binding publishes a per-person client document, which names the person to
+ * every company and is enumerable — allowed only when the person's naming posture is already `public`. The
+ * posture is the agent's `AgentDiscoveryPolicyV1.naming` (agent-resolution); passed structurally so this module
+ * depends on nothing. The estate's personal-agent SERVICE (`scope: 'service'`) is the client for everyone else.
+ */
+export function clientKeyScopeRefusal(binding, posture) {
+    if (binding.scope === 'person' && posture.naming !== 'public') {
+        return `a scope:'person' client key is refused for naming posture '${posture.naming}' — the person would be the client_id at every company (spec 442 §7); present through the estate's personal-agent service instead`;
+    }
+    return null;
+}
+export function assertClientKeyScopeAllowed(binding, posture) {
+    const refusal = clientKeyScopeRefusal(binding, posture);
+    if (refusal)
+        throw new InvalidProfileError(refusal);
+}
+/** Validate → posture → sign. The binding names this SA on this chain or it is refused before signing. */
+export async function buildSignedClientKeyBinding(input) {
+    const { binding, chainId, smartAgent } = input;
+    const issues = validateClientKeyBinding(binding);
+    if (issues.length)
+        throw new InvalidProfileError(`ClientKeyBindingV1: ${issues.join('; ')}`);
+    const m = CAIP10_EVM.exec(binding.canonicalAgentId);
+    if (Number(m[1]) !== chainId || m[2].toLowerCase() !== smartAgent.toLowerCase()) {
+        throw new InvalidProfileError('ClientKeyBindingV1: canonicalAgentId does not name this Smart Agent on this chain');
+    }
+    assertClientKeyScopeAllowed(binding, input.posture);
+    const digest = clientKeyBindingDigest(binding, chainId, smartAgent);
+    const signature = await input.signer(digest);
+    return { binding, chainId, verifyingContract: smartAgent, signature };
+}
+/**
+ * Fail-closed: shape → alg the field verifies → names this SA on this chain → expected key → posture → custody
+ * epoch is CURRENT → validity window → ERC-1271 over the EIP-712 digest. Any anomaly ⇒ `ok:false`.
+ */
+export async function verifySignedClientKeyBinding(signed, opts) {
+    const b = signed?.binding;
+    if (!b || typeof signed.chainId !== 'number' || typeof signed.verifyingContract !== 'string' || typeof signed.signature !== 'string') {
+        return { ok: false, reason: 'bad_shape' };
+    }
+    const issues = validateClientKeyBinding(b);
+    if (issues.length) {
+        const alg = issues.find((i) => i.startsWith('binding.alg'));
+        return alg ? { ok: false, reason: 'alg_not_field_verifiable', detail: alg } : { ok: false, reason: 'bad_shape', detail: issues.join('; ') };
+    }
+    const m = CAIP10_EVM.exec(b.canonicalAgentId);
+    if (Number(m[1]) !== signed.chainId || m[2].toLowerCase() !== signed.verifyingContract.toLowerCase()) {
+        return { ok: false, reason: 'agent_mismatch' };
+    }
+    if (opts.expectThumbprint !== undefined && opts.expectThumbprint !== b.jwkThumbprint)
+        return { ok: false, reason: 'thumbprint_mismatch' };
+    if (opts.posture) {
+        const refusal = clientKeyScopeRefusal(b, opts.posture);
+        if (refusal)
+            return { ok: false, reason: 'scope_refused', detail: refusal };
+    }
+    if (!Number.isInteger(opts.currentCustodyEpoch) || opts.currentCustodyEpoch < 0)
+        return { ok: false, reason: 'bad_shape', detail: 'currentCustodyEpoch must be a non-negative integer' };
+    if (b.custodyEpoch !== opts.currentCustodyEpoch) {
+        return { ok: false, reason: 'stale_custody_epoch', detail: `bound under epoch ${b.custodyEpoch}; the account is at ${opts.currentCustodyEpoch}` };
+    }
+    const now = opts.now ?? Math.floor(Date.now() / 1000);
+    if (now < b.notBefore)
+        return { ok: false, reason: 'not_yet_valid' };
+    if (now > b.notAfter)
+        return { ok: false, reason: 'expired' };
+    let digest;
+    try {
+        digest = clientKeyBindingDigest(b, signed.chainId, signed.verifyingContract);
+    }
+    catch {
+        return { ok: false, reason: 'bad_shape' };
+    }
+    let valid;
+    try {
+        valid = await opts.erc1271Verifier.verifyHash({ address: signed.verifyingContract, hash: digest, signature: signed.signature });
+    }
+    catch {
+        return { ok: false, reason: 'signature_invalid' };
+    }
+    if (!valid)
+        return { ok: false, reason: 'signature_invalid' };
+    return { ok: true, smartAgent: signed.verifyingContract, digest };
+}
+export function clientKeyRecordRow(b) {
+    return { thumbprint: b.jwkThumbprint, alg: b.alg, scope: b.scope, clientId: b.clientId, custodyEpoch: b.custodyEpoch, notAfter: b.notAfter };
+}
+/** Validate a candidate record. `[]` when valid. */
+export function validateClientKeysRecord(r) {
+    const issues = [];
+    if (typeof r !== 'object' || r === null || Array.isArray(r))
+        return ['clientKeys: must be an object'];
+    const x = r;
+    for (const k of Object.keys(x))
+        if (k !== 'v' && k !== 'keys')
+            issues.push(`clientKeys.${k}: unknown property`);
+    if (x.v !== 1)
+        issues.push('clientKeys.v: must be 1');
+    if (!Array.isArray(x.keys))
+        return [...issues, 'clientKeys.keys: must be an array'];
+    const seen = new Set();
+    x.keys.forEach((row, i) => {
+        const p = `clientKeys.keys[${i}]`;
+        if (typeof row !== 'object' || row === null || Array.isArray(row)) {
+            issues.push(`${p}: must be an object`);
+            return;
+        }
+        const y = row;
+        for (const k of Object.keys(y))
+            if (!['thumbprint', 'alg', 'scope', 'clientId', 'custodyEpoch', 'notAfter'].includes(k))
+                issues.push(`${p}.${k}: unknown property`);
+        if (typeof y.thumbprint !== 'string')
+            issues.push(`${p}.thumbprint: required`);
+        else {
+            try {
+                thumbprintToBytes32(y.thumbprint);
+            }
+            catch {
+                issues.push(`${p}.thumbprint: must be a base64url sha256`);
+            }
+            if (seen.has(y.thumbprint))
+                issues.push(`${p}.thumbprint: duplicate`);
+            seen.add(y.thumbprint);
+        }
+        if (typeof y.alg !== 'string' || !CLIENT_KEY_ALGS.includes(y.alg))
+            issues.push(`${p}.alg: must be one of ${CLIENT_KEY_ALGS.join(' | ')}`);
+        if (y.scope !== 'service' && y.scope !== 'person')
+            issues.push(`${p}.scope: must be service | person`);
+        if (typeof y.clientId !== 'string' || !HTTPS_URL.test(y.clientId))
+            issues.push(`${p}.clientId: must be an https URL`);
+        if (!Number.isInteger(y.custodyEpoch) || y.custodyEpoch < 0)
+            issues.push(`${p}.custodyEpoch: must be a non-negative integer`);
+        if (!Number.isInteger(y.notAfter) || y.notAfter < 0)
+            issues.push(`${p}.notAfter: must be a non-negative integer`);
+    });
+    return issues;
+}
+/** RFC 8785 canonical JSON — two equal records encode to identical bytes (as `atl:distribution`). */
+export function encodeClientKeys(record) {
+    const issues = validateClientKeysRecord(record);
+    if (issues.length)
+        throw new InvalidProfileError(`ClientKeysRecordV1: ${issues.join('; ')}`);
+    return jcsCanonicalize(record);
+}
+/** Fail-closed: anything that is not a valid record is `null` — an unreadable record is an answer, never a guess (ADR-0013). */
+export function decodeClientKeys(value) {
+    if (!value)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        return null;
+    }
+    return validateClientKeysRecord(parsed).length ? null : parsed;
+}
+/** The rows a verifier treats as LIVE now: current epoch, not past `notAfter`. Stale rows are dead, not pruned here. */
+export function liveClientKeys(record, opts) {
+    const now = opts.now ?? Math.floor(Date.now() / 1000);
+    return record.keys.filter((k) => k.custodyEpoch === opts.currentCustodyEpoch && k.notAfter > now);
+}
+export { CLIENT_KEYS };
+//# sourceMappingURL=client-key-binding.js.map

package/dist/client-key-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-key-binding.js","sourceRoot":"","sources":["../src/client-key-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAA0B,MAAM,MAAM,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAMlD,MAAM,CAAC,MAAM,eAAe,GAA4B,CAAC,OAAO,EAAE,OAAO,CAAU,CAAC;AAkCpF,wGAAwG;AAExG,MAAM,CAAC,MAAM,8BAA8B,GAAG,4BAA4B,CAAC;AAC3E,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAErD,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,gBAAgB,EAAE;QAChB,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC5C,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;QACjC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE;QACpC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE;QAC1C,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC/B,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE;QACrC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE;KACrC;CACO,CAAC;AAEX,2GAA2G;AAC3G,MAAM,CAAC,MAAM,8BAA8B,GACzC,8JAA8J,CAAC;AAEjK,oHAAoH;AACpH,MAAM,CAAC,MAAM,sCAAsC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAErE,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAmB;IACzE,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,iCAAiC;QAC1C,OAAO;QACP,iBAAiB,EAAE,UAAU;KACrB,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,oCAAoC,CAAC;AACxD,MAAM,SAAS,GAAG,oCAAoC,CAAC;AAEvD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,CAAU;IACjD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACnG,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAChK,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IAC1G,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACzH,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;SACnF,CAAC;QACJ,IAAI,CAAC;YAAC,mBAAmB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;QAAC,CAAC;IACtI,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAE,eAAqC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACzF,MAAM,CAAC,IAAI,CAAC,+BAA+B,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACpJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,EAAE,UAAU,CAAU,EAAE,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC,CAAC,CAAY,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,kCAAkC,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAK,CAAC,CAAC,QAAmB,IAAK,CAAC,CAAC,SAAoB,EAAE,CAAC;QACvH,MAAM,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,uBAAuB,CAAC,CAAqB;IAC3D,MAAM,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO;QACL,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;QACpC,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,aAAa,EAAE,mBAAmB,CAAC,CAAC,CAAC,aAAa,CAAC;QACnD,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;QACpC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,sBAAsB,CAAC,OAA2B,EAAE,OAAe,EAAE,UAAmB;IACtG,OAAO,aAAa,CAAC;QACnB,MAAM,EAAE,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC;QACnD,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EAAE,kBAAkB;QAC/B,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC;KAC1C,CAAC,CAAC;AACL,CAAC;AAED,wGAAwG;AAExG;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA0C,EAAE,OAA2B;IAC3G,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC9D,OAAO,8DAA8D,OAAO,CAAC,MAAM,mIAAmI,CAAC;IACzN,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAA0C,EAAE,OAA2B;IACjH,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,OAAO;QAAE,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtD,CAAC;AAcD,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAAuC;IACvF,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC/C,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAE,CAAC;IACrD,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QACjF,MAAM,IAAI,mBAAmB,CAAC,mFAAmF,CAAC,CAAC;IACrH,CAAC;IACD,2BAA2B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACxE,CAAC;AAiCD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAgC,EAChC,IAAmC;IAEnC,MAAM,CAAC,GAAG,MAAM,EAAE,OAAO,CAAC;IAC1B,IAAI,CAAC,CAAC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACrI,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9I,CAAC;IACD,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAE,CAAC;IAC/C,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,iBAAiB,CAAC,WAAW,EAAE,EAAE,CAAC;QACtG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,IAAI,CAAC,gBAAgB,KAAK,CAAC,CAAC,aAAa;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC1I,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,qBAAqB,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,mBAAmB,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;IACzL,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC,YAAY,uBAAuB,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;IACpJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACtD,IAAI,GAAG,GAAG,CAAC,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACrE,IAAI,GAAG,GAAG,CAAC,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAE9D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,sBAAsB,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAClI,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;AACpE,CAAC;AAyBD,MAAM,UAAU,kBAAkB,CAAC,CAAqB;IACtD,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC/I,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,wBAAwB,CAAC,CAAU;IACjD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,+BAA+B,CAAC,CAAC;IACtG,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC;IAChH,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,GAAG,MAAM,EAAE,mCAAmC,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACxB,MAAM,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC;QAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACtH,MAAM,CAAC,GAAG,GAA8B,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACpK,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;aAC1E,CAAC;YACJ,IAAI,CAAC;gBAAC,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YAAC,CAAC;YAChH,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YACtE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAE,eAAqC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjK,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QACvG,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QACtH,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,IAAK,CAAC,CAAC,YAAuB,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC1I,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAK,CAAC,CAAC,QAAmB,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IAChI,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,gBAAgB,CAAC,MAA0B;IACzD,MAAM,MAAM,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,gIAAgI;AAChI,MAAM,UAAU,gBAAgB,CAAC,KAAgC;IAC/D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAC1D,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,MAA6B,CAAC;AACzF,CAAC;AAED,wHAAwH;AACxH,MAAM,UAAU,cAAc,CAAC,MAA0B,EAAE,IAAmD;IAC5G,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,mBAAmB,IAAI,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;AACpG,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/constants.d.ts

@@ -44,6 +44,14 @@ export declare const SERVICE_ROLE: Hex;
  * itself (`buildSetDistributionCall`), never by a registry — a registry file is a PROJECTION of it.
  */
 export declare const DISTRIBUTION: Hex;
+/**
+ * The SA-keyed CLIENT KEYS record (spec 442 §3; `client-key-binding.ts`). `getStringProperty(agent, CLIENT_KEYS)`
+ * → the JCS-canonical JSON of a `ClientKeysRecordV1`: the public half of every live `ClientKeyBindingV1`
+ * (thumbprint · alg · scope · clientId · custody epoch · notAfter). Written by the SA itself
+ * (`buildSetClientKeysCall`); what a JWKS / client metadata document / TAP key directory is PROJECTED from
+ * (ap-federation spec 443) and what a verifier checks a presented binding against. Never a signature, never a key.
+ */
+export declare const CLIENT_KEYS: Hex;
 /**
  * The six platform keys an `AgentDistributionV1.binary` map may carry — verbatim from the ACP registry
  * `agent.schema.json` (`binaryDistribution.propertyNames.enum`). Any other key fails validation.

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAElD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,WAAW,EAAE,GAAoC,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAIzD,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAG,CAAU,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,EAAE,GAAuC,CAAC;AACjE,eAAO,MAAM,YAAY,EAAE,GAAyC,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,GAA0C,CAAC;AAEtE;;;GAGG;AACH,eAAO,MAAM,aAAa,oHAOhB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAElD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,WAAW,EAAE,GAAoC,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAIzD,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAG,CAAU,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,EAAE,GAAuC,CAAC;AACjE,eAAO,MAAM,YAAY,EAAE,GAAyC,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,GAA0C,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,GAAwC,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,aAAa,oHAOhB,CAAC"}

package/dist/constants.js

@@ -48,6 +48,14 @@ export const SERVICE_ROLE = keccak256(toHex('atl:serviceRole'));
  * itself (`buildSetDistributionCall`), never by a registry — a registry file is a PROJECTION of it.
  */
 export const DISTRIBUTION = keccak256(toHex('atl:distribution'));
+/**
+ * The SA-keyed CLIENT KEYS record (spec 442 §3; `client-key-binding.ts`). `getStringProperty(agent, CLIENT_KEYS)`
+ * → the JCS-canonical JSON of a `ClientKeysRecordV1`: the public half of every live `ClientKeyBindingV1`
+ * (thumbprint · alg · scope · clientId · custody epoch · notAfter). Written by the SA itself
+ * (`buildSetClientKeysCall`); what a JWKS / client metadata document / TAP key directory is PROJECTED from
+ * (ap-federation spec 443) and what a verifier checks a presented binding against. Never a signature, never a key.
+ */
+export const CLIENT_KEYS = keccak256(toHex('atl:clientKeys'));
 /**
  * The six platform keys an `AgentDistributionV1.binary` map may carry — verbatim from the ACP registry
  * `agent.schema.json` (`binaryDistribution.propertyNames.enum`). Any other key fails validation.

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAY,MAAM,MAAM,CAAC;AAElD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,WAAW,GAAQ,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAC;IACrE,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,mBAAmB;IAC7B,QAAQ,EAAE,SAAS;CACpB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAU,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAQ,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,YAAY,GAAQ,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAQ,SAAS,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAEtE;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,gBAAgB;IAChB,eAAe;IACf,eAAe;IACf,cAAc;IACd,iBAAiB;IACjB,gBAAgB;CACR,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAY,MAAM,MAAM,CAAC;AAElD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,WAAW,GAAQ,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAC;IACrE,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,mBAAmB;IAC7B,QAAQ,EAAE,SAAS;CACpB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAU,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAQ,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,YAAY,GAAQ,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAQ,SAAS,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAQ,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,gBAAgB;IAChB,eAAe;IACf,eAAe;IACf,cAAc;IACd,iBAAiB;IACjB,gBAAgB;CACR,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
-export { CAIP10_NAMESPACE_ALLOWLIST, AGENT_CARD_SCHEMA_VERSION, AUTH_ORIGIN, AGENT_TYPE, SERVICE_ROLE, DISTRIBUTION, ACP_PLATFORMS, } from './constants.js';
+export { CAIP10_NAMESPACE_ALLOWLIST, AGENT_CARD_SCHEMA_VERSION, AUTH_ORIGIN, AGENT_TYPE, SERVICE_ROLE, DISTRIBUTION, CLIENT_KEYS, ACP_PLATFORMS, } from './constants.js';
+export { CLIENT_KEY_ALGS, CLIENT_KEY_BINDING_DOMAIN_NAME, CLIENT_KEY_BINDING_DOMAIN_VERSION, CLIENT_KEY_BINDING_TYPES, CLIENT_KEY_BINDING_TYPE_STRING, CLIENT_KEY_BINDING_DEFAULT_TTL_SECONDS, clientKeyBindingDomain, clientKeyBindingMessage, clientKeyBindingDigest, validateClientKeyBinding, clientKeyScopeRefusal, assertClientKeyScopeAllowed, buildSignedClientKeyBinding, verifySignedClientKeyBinding, clientKeyRecordRow, validateClientKeysRecord, encodeClientKeys, decodeClientKeys, liveClientKeys, type ClientKeyAlg, type ClientKeyScope, type ClientKeyBindingV1, type SignedClientKeyBindingV1, type BuildSignedClientKeyBindingInput, type VerifyClientKeyBindingOptions, type VerifyClientKeyBindingResult, type ClientKeyRecordRowV1, type ClientKeysRecordV1, } from './client-key-binding.js';
 export { validateDistribution, encodeDistribution, decodeDistribution, } from './distribution.js';
 export { derivedTypeId, decodeDerivedTypeId, profileTypesForDerivedType, isProfileTypeConsistent, } from './derived-type.js';
 export { buildCaip10Address, parseCaip10, isValidCaip10, type Caip10Parts, } from './caip10.js';
@@ -8,5 +9,5 @@ export { InvalidProfileError, ProfileHashMismatchError, EndpointVerificationErro
 export type { ProfileType, Caip10Address, VerificationMethod, AiAgentProfile, McpServerProfile, MultisigProfile, ServiceProfile, CanonicalAgentProfileV1, AcpPlatform, AgentPackageDistributionV1, AgentBinaryTargetV1, AgentDistributionV1, ProtocolFeatureSetV1, Sha256, SignedCanonicalProfileBundleV1, AgentCard, SignedAgentCardBundleV1, AgentIdentityClientOpts, PublishProfileInput, } from './types.js';
 export { AgentIdentityClient, type WriteContext } from './client.js';
 export { agentProfileResolverAbi } from './abis.js';
-export { buildRegisterProfileCall, buildSetProfileMetadataCall, buildSetProfileStringCall, buildSetDistributionCall, buildSetProfileAddressCall, buildSetProfileBytes32Call, buildSetProfileActiveCall, type ContractCall, } from './calls.js';
+export { buildRegisterProfileCall, buildSetProfileMetadataCall, buildSetProfileStringCall, buildSetDistributionCall, buildSetClientKeysCall, buildSetProfileAddressCall, buildSetProfileBytes32Call, buildSetProfileActiveCall, type ContractCall, } from './calls.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,WAAW,EACX,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAItB,OAAO,EACL,oBAAoB,EACpB,iCAAiC,EACjC,kCAAkC,EAElC,aAAa,EACb,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,GACjC,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,uBAAuB,EACvB,WAAW,EACX,0BAA0B,EAC1B,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,MAAM,EACN,8BAA8B,EAE9B,SAAS,EACT,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,mBAAmB,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAMrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAIpD,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,WAAW,EACX,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,aAAa,GACd,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EACL,eAAe,EACf,8BAA8B,EAC9B,iCAAiC,EACjC,wBAAwB,EACxB,8BAA8B,EAC9B,sCAAsC,EACtC,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,2BAA2B,EAC3B,4BAA4B,EAC5B,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,gCAAgC,EACrC,KAAK,6BAA6B,EAClC,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,GACxB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAItB,OAAO,EACL,oBAAoB,EACpB,iCAAiC,EACjC,kCAAkC,EAElC,aAAa,EACb,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,GACjC,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,uBAAuB,EACvB,WAAW,EACX,0BAA0B,EAC1B,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,MAAM,EACN,8BAA8B,EAE9B,SAAS,EACT,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,mBAAmB,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAMrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAIpD,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -6,7 +6,10 @@
 //   - specs/217-agent-profile.md — the contract
 //   - docs/architecture/decisions/0007-agent-identity-stack-three-packages.md
 //   - docs/architecture/decisions/0008-caip10-nativeid-record-predicate.md
-export { CAIP10_NAMESPACE_ALLOWLIST, AGENT_CARD_SCHEMA_VERSION, AUTH_ORIGIN, AGENT_TYPE, SERVICE_ROLE, DISTRIBUTION, ACP_PLATFORMS, } from './constants.js';
+export { CAIP10_NAMESPACE_ALLOWLIST, AGENT_CARD_SCHEMA_VERSION, AUTH_ORIGIN, AGENT_TYPE, SERVICE_ROLE, DISTRIBUTION, CLIENT_KEYS, ACP_PLATFORMS, } from './constants.js';
+// A client key the Smart Agent may PRESENT with at external doors (spec 442 §3) — a credential, never authority;
+// the public half on chain as `atl:clientKeys`. The §7 posture rule and the custody-epoch rule run here.
+export { CLIENT_KEY_ALGS, CLIENT_KEY_BINDING_DOMAIN_NAME, CLIENT_KEY_BINDING_DOMAIN_VERSION, CLIENT_KEY_BINDING_TYPES, CLIENT_KEY_BINDING_TYPE_STRING, CLIENT_KEY_BINDING_DEFAULT_TTL_SECONDS, clientKeyBindingDomain, clientKeyBindingMessage, clientKeyBindingDigest, validateClientKeyBinding, clientKeyScopeRefusal, assertClientKeyScopeAllowed, buildSignedClientKeyBinding, verifySignedClientKeyBinding, clientKeyRecordRow, validateClientKeysRecord, encodeClientKeys, decodeClientKeys, liveClientKeys, } from './client-key-binding.js';
 // `distribution` canonical-profile fact (spec 347 §8.5): how to obtain + run the agent's software.
 export { validateDistribution, encodeDistribution, decodeDistribution, } from './distribution.js';
 // Derived-type consistency (spec 346 §2.3 / §6.2).
@@ -27,5 +30,5 @@ export { AgentIdentityClient } from './client.js';
 export { agentProfileResolverAbi } from './abis.js';
 // Phase 4 pure call builders. Compose into AgentAccount.execute /
 // CustodyPolicy ceremonies / ERC-4337 UserOps as needed.
-export { buildRegisterProfileCall, buildSetProfileMetadataCall, buildSetProfileStringCall, buildSetDistributionCall, buildSetProfileAddressCall, buildSetProfileBytes32Call, buildSetProfileActiveCall, } from './calls.js';
+export { buildRegisterProfileCall, buildSetProfileMetadataCall, buildSetProfileStringCall, buildSetDistributionCall, buildSetClientKeysCall, buildSetProfileAddressCall, buildSetProfileBytes32Call, buildSetProfileActiveCall, } from './calls.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,EAAE;AACF,OAAO;AACP,0CAA0C;AAC1C,2BAA2B;AAC3B,gDAAgD;AAChD,8EAA8E;AAC9E,2EAA2E;AAE3E,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,WAAW,EACX,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,gBAAgB,CAAC;AAExB,mGAAmG;AACnG,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,mDAAmD;AACnD,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,aAAa,GAEd,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,yGAAyG;AACzG,gGAAgG;AAChG,OAAO,EACL,oBAAoB,EACpB,iCAAiC,EACjC,kCAAkC;AAClC,gDAAgD;AAChD,aAAa,EACb,0BAA0B,EAC1B,2BAA2B,GAK5B,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAyBrB,OAAO,EAAE,mBAAmB,EAAqB,MAAM,aAAa,CAAC;AAErE,gEAAgE;AAChE,mEAAmE;AACnE,+DAA+D;AAC/D,0CAA0C;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEpD,kEAAkE;AAClE,yDAAyD;AACzD,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,GAE1B,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,EAAE;AACF,OAAO;AACP,0CAA0C;AAC1C,2BAA2B;AAC3B,gDAAgD;AAChD,8EAA8E;AAC9E,2EAA2E;AAE3E,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,WAAW,EACX,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,aAAa,GACd,MAAM,gBAAgB,CAAC;AAExB,iHAAiH;AACjH,yGAAyG;AACzG,OAAO,EACL,eAAe,EACf,8BAA8B,EAC9B,iCAAiC,EACjC,wBAAwB,EACxB,8BAA8B,EAC9B,sCAAsC,EACtC,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,2BAA2B,EAC3B,4BAA4B,EAC5B,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,GAUf,MAAM,yBAAyB,CAAC;AAEjC,mGAAmG;AACnG,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,mDAAmD;AACnD,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,aAAa,GAEd,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,yGAAyG;AACzG,gGAAgG;AAChG,OAAO,EACL,oBAAoB,EACpB,iCAAiC,EACjC,kCAAkC;AAClC,gDAAgD;AAChD,aAAa,EACb,0BAA0B,EAC1B,2BAA2B,GAK5B,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAyBrB,OAAO,EAAE,mBAAmB,EAAqB,MAAM,aAAa,CAAC;AAErE,gEAAgE;AAChE,mEAAmE;AACnE,+DAA+D;AAC/D,0CAA0C;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEpD,kEAAkE;AAClE,yDAAyD;AACzD,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,GAE1B,MAAM,YAAY,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/agent-profile",
-  "version": "1.0.0-alpha.38",
+  "version": "1.0.0-alpha.39",
   "description": "Agent identity SDK: AP-native Canonical Agent Profile (CanonicalAgentProfileV1) + signed profile bundle, CAIP-10 nativeId helpers, endpoint verification methods, and the A2A 1.0 Agent Card model (./a2a: JCS canonical bytes, ES256 JWS, EIP-712 Smart Agent binding, field provenance, pure validation, import, release lifecycle). External registry projections stay outside Ring 0.",
   "homepage": "https://agenticprimitives.dev",
   "bugs": {
@@ -52,9 +52,9 @@
   },
   "peerDependencies": {
     "viem": "^2.52.2",
-    "@agenticprimitives/agent-account": "^1.0.0-alpha.38",
-    "@agenticprimitives/connect-auth": "^1.0.0-alpha.38",
-    "@agenticprimitives/types": "^1.0.0-alpha.38"
+    "@agenticprimitives/agent-account": "^1.0.0-alpha.39",
+    "@agenticprimitives/connect-auth": "^1.0.0-alpha.39",
+    "@agenticprimitives/types": "^1.0.0-alpha.39"
   },
   "devDependencies": {
     "@types/node": "^22.7.0",