@agenticprimitives/agent-profile 1.0.0-alpha.4 → 1.0.0-alpha.41

package/dist/client-key-binding.js

@@ -0,0 +1,282 @@
+/**
+ * `ClientKeyBindingV1` — the Smart Agent's EIP-712 statement that ONE public key (a JWK, by RFC 7638
+ * thumbprint) may PRESENT for it at external doors — OAuth `private_key_jwt`, DPoP, RFC 9421 HTTP signatures,
+ * a TAP key directory — under one custody epoch, between `notBefore` and `notAfter`, published under one
+ * `clientId` (spec 442 §3; ontology `ap:ClientKeyBinding`; on-chain record `atl:clientKeys`).
+ *
+ * The service-agent-signing rule, applied to the doors the field runs: the service never holds the identity's
+ * key; it holds a DELEGATE (a custodied P-256 / Ed25519 key behind `JwsSignerPort`) and presents this binding beside
+ * it. Those doors cannot verify an ERC-7710 wire, so the binding takes the form they can carry: a signed
+ * statement the SA stands behind, validated through ERC-1271 by anyone who wants more than OAuth's trust.
+ *
+ * WHAT IT IS NOT. It is not an authority wire: it grants the key NO authority to act. Signatures under this key are the
+ * agent's PRESENTATIONS; what the agent may do at a door is still a mandate, verified per step (spec 350 §3.6).
+ * Revoked by a custody-epoch bump (every binding under the old epoch is dead — rotation re-approves, recovery
+ * does not; spec 410 §1) or by an explicit `atl:clientKeys` write. Short `notAfter` (≤ 90 days) is the default.
+ *
+ * Domain: `{ name:'AgenticPrimitivesClientKey', version:'1', chainId, verifyingContract: <SA> }`. The ERC-1271
+ * read and the custody-epoch read are INJECTED so this module stays network-free (same ports as `a2a/binding`).
+ */
+import { hashTypedData } from 'viem';
+import { jcsCanonicalize } from '@agenticprimitives/types';
+import { thumbprintToBytes32 } from './a2a/binding.js';
+import { CLIENT_KEYS } from './constants.js';
+import { InvalidProfileError } from './errors.js';
+export const CLIENT_KEY_ALGS = ['ES256', 'EdDSA'];
+// ─── EIP-712 ─────────────────────────────────────────────────────────────────────────────────────────
+export const CLIENT_KEY_BINDING_DOMAIN_NAME = 'AgenticPrimitivesClientKey';
+export const CLIENT_KEY_BINDING_DOMAIN_VERSION = '1';
+export const CLIENT_KEY_BINDING_TYPES = {
+    ClientKeyBinding: [
+        { name: 'canonicalAgentId', type: 'string' },
+        { name: 'scope', type: 'string' },
+        { name: 'clientId', type: 'string' },
+        { name: 'jwkThumbprint', type: 'bytes32' },
+        { name: 'alg', type: 'string' },
+        { name: 'custodyEpoch', type: 'uint64' },
+        { name: 'notBefore', type: 'uint64' },
+        { name: 'notAfter', type: 'uint64' },
+    ],
+};
+/** The EIP-712 type string (for TYPEHASH parity checks). Off-chain only today: no contract consumes it. */
+export const CLIENT_KEY_BINDING_TYPE_STRING = 'ClientKeyBinding(string canonicalAgentId,string scope,string clientId,bytes32 jwkThumbprint,string alg,uint64 custodyEpoch,uint64 notBefore,uint64 notAfter)';
+/** The default validity a Home signs for: 90 days. Longer is allowed and visible; it is never silently extended. */
+export const CLIENT_KEY_BINDING_DEFAULT_TTL_SECONDS = 90 * 24 * 3600;
+export function clientKeyBindingDomain(chainId, smartAgent) {
+    return {
+        name: CLIENT_KEY_BINDING_DOMAIN_NAME,
+        version: CLIENT_KEY_BINDING_DOMAIN_VERSION,
+        chainId,
+        verifyingContract: smartAgent,
+    };
+}
+const CAIP10_EVM = /^eip155:(\d+):(0x[0-9a-fA-F]{40})$/;
+const HTTPS_URL = /^https:\/\/[^\s/?#]+(\/[^\s?#]*)?$/;
+/**
+ * Validate a candidate binding. Returns `[]` when well-formed, else one issue per violation. Shape only — the
+ * posture rule is `assertClientKeyScopeAllowed`, the epoch rule is `verifySignedClientKeyBinding`.
+ */
+export function validateClientKeyBinding(b) {
+    const issues = [];
+    if (typeof b !== 'object' || b === null || Array.isArray(b))
+        return ['binding: must be an object'];
+    const x = b;
+    if (typeof x.canonicalAgentId !== 'string' || !CAIP10_EVM.test(x.canonicalAgentId))
+        issues.push('binding.canonicalAgentId: must be eip155:<chainId>:<address>');
+    if (x.scope !== 'service' && x.scope !== 'person')
+        issues.push('binding.scope: must be service | person');
+    if (typeof x.clientId !== 'string' || !HTTPS_URL.test(x.clientId))
+        issues.push('binding.clientId: must be an https URL');
+    if (typeof x.jwkThumbprint !== 'string')
+        issues.push('binding.jwkThumbprint: required');
+    else {
+        try {
+            thumbprintToBytes32(x.jwkThumbprint);
+        }
+        catch {
+            issues.push('binding.jwkThumbprint: must be a base64url sha256 (RFC 7638)');
+        }
+    }
+    if (typeof x.alg !== 'string' || !CLIENT_KEY_ALGS.includes(x.alg)) {
+        issues.push(`binding.alg: must be one of ${CLIENT_KEY_ALGS.join(' | ')} — the field verifies no other (ES256K is not verifiable at these doors)`);
+    }
+    for (const k of ['custodyEpoch', 'notBefore', 'notAfter']) {
+        if (!Number.isInteger(x[k]) || x[k] < 0)
+            issues.push(`binding.${k}: must be a non-negative integer`);
+    }
+    if (Number.isInteger(x.notBefore) && Number.isInteger(x.notAfter) && x.notAfter <= x.notBefore) {
+        issues.push('binding.notAfter: must be after notBefore (an open-ended client key is not a thing)');
+    }
+    return issues;
+}
+/** The EIP-712 message as signed: the thumbprint as bytes32, the integers as uint64. */
+export function clientKeyBindingMessage(b) {
+    const issues = validateClientKeyBinding(b);
+    if (issues.length)
+        throw new InvalidProfileError(`ClientKeyBindingV1: ${issues.join('; ')}`);
+    return {
+        canonicalAgentId: b.canonicalAgentId,
+        scope: b.scope,
+        clientId: b.clientId,
+        jwkThumbprint: thumbprintToBytes32(b.jwkThumbprint),
+        alg: b.alg,
+        custodyEpoch: BigInt(b.custodyEpoch),
+        notBefore: BigInt(b.notBefore),
+        notAfter: BigInt(b.notAfter),
+    };
+}
+/** The 32-byte EIP-712 digest the SA signs and ERC-1271 validates. */
+export function clientKeyBindingDigest(binding, chainId, smartAgent) {
+    return hashTypedData({
+        domain: clientKeyBindingDomain(chainId, smartAgent),
+        types: CLIENT_KEY_BINDING_TYPES,
+        primaryType: 'ClientKeyBinding',
+        message: clientKeyBindingMessage(binding),
+    });
+}
+// ─── posture ─────────────────────────────────────────────────────────────────────────────────────────
+/**
+ * Spec 442 §7: a `scope: 'person'` binding publishes a per-person client document, which names the person to
+ * every company and is enumerable — allowed only when the person's naming posture is already `public`. The
+ * posture is the agent's `AgentDiscoveryPolicyV1.naming` (agent-resolution); passed structurally so this module
+ * depends on nothing. The estate's personal-agent SERVICE (`scope: 'service'`) is the client for everyone else.
+ */
+export function clientKeyScopeRefusal(binding, posture) {
+    if (binding.scope === 'person' && posture.naming !== 'public') {
+        return `a scope:'person' client key is refused for naming posture '${posture.naming}' — the person would be the client_id at every company (spec 442 §7); present through the estate's personal-agent service instead`;
+    }
+    return null;
+}
+export function assertClientKeyScopeAllowed(binding, posture) {
+    const refusal = clientKeyScopeRefusal(binding, posture);
+    if (refusal)
+        throw new InvalidProfileError(refusal);
+}
+/** Validate → posture → sign. The binding names this SA on this chain or it is refused before signing. */
+export async function buildSignedClientKeyBinding(input) {
+    const { binding, chainId, smartAgent } = input;
+    const issues = validateClientKeyBinding(binding);
+    if (issues.length)
+        throw new InvalidProfileError(`ClientKeyBindingV1: ${issues.join('; ')}`);
+    const m = CAIP10_EVM.exec(binding.canonicalAgentId);
+    if (Number(m[1]) !== chainId || m[2].toLowerCase() !== smartAgent.toLowerCase()) {
+        throw new InvalidProfileError('ClientKeyBindingV1: canonicalAgentId does not name this Smart Agent on this chain');
+    }
+    assertClientKeyScopeAllowed(binding, input.posture);
+    const digest = clientKeyBindingDigest(binding, chainId, smartAgent);
+    const signature = await input.signer(digest);
+    return { binding, chainId, verifyingContract: smartAgent, signature };
+}
+/**
+ * Fail-closed: shape → alg the field verifies → names this SA on this chain → expected key → posture → custody
+ * epoch is CURRENT → validity window → ERC-1271 over the EIP-712 digest. Any anomaly ⇒ `ok:false`.
+ */
+export async function verifySignedClientKeyBinding(signed, opts) {
+    const b = signed?.binding;
+    if (!b || typeof signed.chainId !== 'number' || typeof signed.verifyingContract !== 'string' || typeof signed.signature !== 'string') {
+        return { ok: false, reason: 'bad_shape' };
+    }
+    const issues = validateClientKeyBinding(b);
+    if (issues.length) {
+        const alg = issues.find((i) => i.startsWith('binding.alg'));
+        return alg ? { ok: false, reason: 'alg_not_field_verifiable', detail: alg } : { ok: false, reason: 'bad_shape', detail: issues.join('; ') };
+    }
+    const m = CAIP10_EVM.exec(b.canonicalAgentId);
+    if (Number(m[1]) !== signed.chainId || m[2].toLowerCase() !== signed.verifyingContract.toLowerCase()) {
+        return { ok: false, reason: 'agent_mismatch' };
+    }
+    if (opts.expectThumbprint !== undefined && opts.expectThumbprint !== b.jwkThumbprint)
+        return { ok: false, reason: 'thumbprint_mismatch' };
+    if (opts.posture) {
+        const refusal = clientKeyScopeRefusal(b, opts.posture);
+        if (refusal)
+            return { ok: false, reason: 'scope_refused', detail: refusal };
+    }
+    if (!Number.isInteger(opts.currentCustodyEpoch) || opts.currentCustodyEpoch < 0)
+        return { ok: false, reason: 'bad_shape', detail: 'currentCustodyEpoch must be a non-negative integer' };
+    if (b.custodyEpoch !== opts.currentCustodyEpoch) {
+        return { ok: false, reason: 'stale_custody_epoch', detail: `bound under epoch ${b.custodyEpoch}; the account is at ${opts.currentCustodyEpoch}` };
+    }
+    const now = opts.now ?? Math.floor(Date.now() / 1000);
+    if (now < b.notBefore)
+        return { ok: false, reason: 'not_yet_valid' };
+    if (now > b.notAfter)
+        return { ok: false, reason: 'expired' };
+    let digest;
+    try {
+        digest = clientKeyBindingDigest(b, signed.chainId, signed.verifyingContract);
+    }
+    catch {
+        return { ok: false, reason: 'bad_shape' };
+    }
+    let valid;
+    try {
+        valid = await opts.erc1271Verifier.verifyHash({ address: signed.verifyingContract, hash: digest, signature: signed.signature });
+    }
+    catch {
+        return { ok: false, reason: 'signature_invalid' };
+    }
+    if (!valid)
+        return { ok: false, reason: 'signature_invalid' };
+    return { ok: true, smartAgent: signed.verifyingContract, digest };
+}
+export function clientKeyRecordRow(b) {
+    return { thumbprint: b.jwkThumbprint, alg: b.alg, scope: b.scope, clientId: b.clientId, custodyEpoch: b.custodyEpoch, notAfter: b.notAfter };
+}
+/** Validate a candidate record. `[]` when valid. */
+export function validateClientKeysRecord(r) {
+    const issues = [];
+    if (typeof r !== 'object' || r === null || Array.isArray(r))
+        return ['clientKeys: must be an object'];
+    const x = r;
+    for (const k of Object.keys(x))
+        if (k !== 'v' && k !== 'keys')
+            issues.push(`clientKeys.${k}: unknown property`);
+    if (x.v !== 1)
+        issues.push('clientKeys.v: must be 1');
+    if (!Array.isArray(x.keys))
+        return [...issues, 'clientKeys.keys: must be an array'];
+    const seen = new Set();
+    x.keys.forEach((row, i) => {
+        const p = `clientKeys.keys[${i}]`;
+        if (typeof row !== 'object' || row === null || Array.isArray(row)) {
+            issues.push(`${p}: must be an object`);
+            return;
+        }
+        const y = row;
+        for (const k of Object.keys(y))
+            if (!['thumbprint', 'alg', 'scope', 'clientId', 'custodyEpoch', 'notAfter'].includes(k))
+                issues.push(`${p}.${k}: unknown property`);
+        if (typeof y.thumbprint !== 'string')
+            issues.push(`${p}.thumbprint: required`);
+        else {
+            try {
+                thumbprintToBytes32(y.thumbprint);
+            }
+            catch {
+                issues.push(`${p}.thumbprint: must be a base64url sha256`);
+            }
+            if (seen.has(y.thumbprint))
+                issues.push(`${p}.thumbprint: duplicate`);
+            seen.add(y.thumbprint);
+        }
+        if (typeof y.alg !== 'string' || !CLIENT_KEY_ALGS.includes(y.alg))
+            issues.push(`${p}.alg: must be one of ${CLIENT_KEY_ALGS.join(' | ')}`);
+        if (y.scope !== 'service' && y.scope !== 'person')
+            issues.push(`${p}.scope: must be service | person`);
+        if (typeof y.clientId !== 'string' || !HTTPS_URL.test(y.clientId))
+            issues.push(`${p}.clientId: must be an https URL`);
+        if (!Number.isInteger(y.custodyEpoch) || y.custodyEpoch < 0)
+            issues.push(`${p}.custodyEpoch: must be a non-negative integer`);
+        if (!Number.isInteger(y.notAfter) || y.notAfter < 0)
+            issues.push(`${p}.notAfter: must be a non-negative integer`);
+    });
+    return issues;
+}
+/** RFC 8785 canonical JSON — two equal records encode to identical bytes (as `atl:distribution`). */
+export function encodeClientKeys(record) {
+    const issues = validateClientKeysRecord(record);
+    if (issues.length)
+        throw new InvalidProfileError(`ClientKeysRecordV1: ${issues.join('; ')}`);
+    return jcsCanonicalize(record);
+}
+/** Fail-closed: anything that is not a valid record is `null` — an unreadable record is an answer, never a guess (ADR-0013). */
+export function decodeClientKeys(value) {
+    if (!value)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        return null;
+    }
+    return validateClientKeysRecord(parsed).length ? null : parsed;
+}
+/** The rows a verifier treats as LIVE now: current epoch, not past `notAfter`. Stale rows are dead, not pruned here. */
+export function liveClientKeys(record, opts) {
+    const now = opts.now ?? Math.floor(Date.now() / 1000);
+    return record.keys.filter((k) => k.custodyEpoch === opts.currentCustodyEpoch && k.notAfter > now);
+}
+export { CLIENT_KEYS };
+//# sourceMappingURL=client-key-binding.js.map

package/dist/client-key-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-key-binding.js","sourceRoot":"","sources":["../src/client-key-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAA0B,MAAM,MAAM,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAMlD,MAAM,CAAC,MAAM,eAAe,GAA4B,CAAC,OAAO,EAAE,OAAO,CAAU,CAAC;AAkCpF,wGAAwG;AAExG,MAAM,CAAC,MAAM,8BAA8B,GAAG,4BAA4B,CAAC;AAC3E,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAErD,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,gBAAgB,EAAE;QAChB,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC5C,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;QACjC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE;QACpC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE;QAC1C,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC/B,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE;QACrC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE;KACrC;CACO,CAAC;AAEX,2GAA2G;AAC3G,MAAM,CAAC,MAAM,8BAA8B,GACzC,8JAA8J,CAAC;AAEjK,oHAAoH;AACpH,MAAM,CAAC,MAAM,sCAAsC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAErE,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAmB;IACzE,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,iCAAiC;QAC1C,OAAO;QACP,iBAAiB,EAAE,UAAU;KACrB,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,oCAAoC,CAAC;AACxD,MAAM,SAAS,GAAG,oCAAoC,CAAC;AAEvD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,CAAU;IACjD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACnG,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAChK,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IAC1G,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACzH,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;SACnF,CAAC;QACJ,IAAI,CAAC;YAAC,mBAAmB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;QAAC,CAAC;IACtI,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAE,eAAqC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACzF,MAAM,CAAC,IAAI,CAAC,+BAA+B,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACpJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,EAAE,UAAU,CAAU,EAAE,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC,CAAC,CAAY,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,kCAAkC,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAK,CAAC,CAAC,QAAmB,IAAK,CAAC,CAAC,SAAoB,EAAE,CAAC;QACvH,MAAM,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,uBAAuB,CAAC,CAAqB;IAC3D,MAAM,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO;QACL,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;QACpC,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,aAAa,EAAE,mBAAmB,CAAC,CAAC,CAAC,aAAa,CAAC;QACnD,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;QACpC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,sBAAsB,CAAC,OAA2B,EAAE,OAAe,EAAE,UAAmB;IACtG,OAAO,aAAa,CAAC;QACnB,MAAM,EAAE,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC;QACnD,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EAAE,kBAAkB;QAC/B,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC;KAC1C,CAAC,CAAC;AACL,CAAC;AAED,wGAAwG;AAExG;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA0C,EAAE,OAA2B;IAC3G,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC9D,OAAO,8DAA8D,OAAO,CAAC,MAAM,mIAAmI,CAAC;IACzN,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAA0C,EAAE,OAA2B;IACjH,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,OAAO;QAAE,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtD,CAAC;AAcD,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAAuC;IACvF,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC/C,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAE,CAAC;IACrD,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QACjF,MAAM,IAAI,mBAAmB,CAAC,mFAAmF,CAAC,CAAC;IACrH,CAAC;IACD,2BAA2B,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACxE,CAAC;AAiCD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAgC,EAChC,IAAmC;IAEnC,MAAM,CAAC,GAAG,MAAM,EAAE,OAAO,CAAC;IAC1B,IAAI,CAAC,CAAC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACrI,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9I,CAAC;IACD,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAE,CAAC;IAC/C,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,iBAAiB,CAAC,WAAW,EAAE,EAAE,CAAC;QACtG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,IAAI,CAAC,gBAAgB,KAAK,CAAC,CAAC,aAAa;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC1I,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,qBAAqB,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,mBAAmB,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;IACzL,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC,YAAY,uBAAuB,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;IACpJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACtD,IAAI,GAAG,GAAG,CAAC,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACrE,IAAI,GAAG,GAAG,CAAC,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAE9D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,sBAAsB,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAClI,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;AACpE,CAAC;AAyBD,MAAM,UAAU,kBAAkB,CAAC,CAAqB;IACtD,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC/I,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,wBAAwB,CAAC,CAAU;IACjD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,+BAA+B,CAAC,CAAC;IACtG,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC;IAChH,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,GAAG,MAAM,EAAE,mCAAmC,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACxB,MAAM,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC;QAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACtH,MAAM,CAAC,GAAG,GAA8B,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACpK,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;aAC1E,CAAC;YACJ,IAAI,CAAC;gBAAC,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YAAC,CAAC;YAChH,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YACtE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAE,eAAqC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjK,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QACvG,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QACtH,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,IAAK,CAAC,CAAC,YAAuB,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC1I,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAK,CAAC,CAAC,QAAmB,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IAChI,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,gBAAgB,CAAC,MAA0B;IACzD,MAAM,MAAM,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,gIAAgI;AAChI,MAAM,UAAU,gBAAgB,CAAC,KAAgC;IAC/D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAC1D,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,MAA6B,CAAC;AACzF,CAAC;AAED,wHAAwH;AACxH,MAAM,UAAU,cAAc,CAAC,MAA0B,EAAE,IAAmD;IAC5G,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,mBAAmB,IAAI,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;AACpG,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 import { type Address, type Hex, type WalletClient } from 'viem';
-import type { AgentCard, AgentIdentityClientOpts, PublishProfileInput, VerificationMethod } from './types';
+import type { CanonicalAgentProfileV1, AgentIdentityClientOpts, PublishProfileInput, VerificationMethod } from './types.js';
 /**
  * Optional per-call submission context. Required for write methods.
  */
@@ -29,7 +29,7 @@ export declare class AgentIdentityClient {
     private readonly fetcher;
     constructor(opts: AgentIdentityClientOptsLive);
     /**
-     * Fetch the AgentCard for `agent`:
+     * Fetch the CanonicalAgentProfileV1 for `agent`:
      *   1. Read `atl:metadataURI` + `atl:metadataHash` from the
      *      AgentProfileResolver (on-chain anchor).
      *   2. HTTP-fetch the JSON at metadataURI.
@@ -41,7 +41,9 @@ export declare class AgentIdentityClient {
      * `atl:metadataURI` record (treated equivalently — the on-chain
      * anchor is absent).
      */
-    fetchProfile(agent: Address): Promise<AgentCard | null>;
+    fetchProfile(agent: Address, opts?: {
+        allowUnanchored?: boolean;
+    }): Promise<CanonicalAgentProfileV1 | null>;
     /**
      * Verify endpoint control for an MCP server profile. Phase 2
      * scope: shape-only (caller declares which method). Real
@@ -51,7 +53,7 @@ export declare class AgentIdentityClient {
     verifyEndpoint(agent: Address, endpoint: string, methods: VerificationMethod[]): Promise<VerificationMethod | null>;
     /**
      * Publish a profile by:
-     *   1. Validating the AgentCard + computing its canonical
+     *   1. Validating the CanonicalAgentProfileV1 + computing its canonical
      *      content-hash.
      *   2. (If `expectedHash` set) asserting it matches our computed
      *      hash — anti-spoof self-check.

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8C,KAAK,OAAO,EAAE,KAAK,GAAG,EAAqB,KAAK,YAAY,EAAE,MAAM,MAAM,CAAC;AAQhI,OAAO,KAAK,EACV,SAAS,EACT,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,SAAS,CAAC;AAEjB;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,YAAY,CAAC;CAC5B;AAMD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,2BAA4B,SAAQ,uBAAuB;IAC1E,eAAe,EAAE,OAAO,CAAC;IACzB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,qBAAa,mBAAmB;IAKlB,QAAQ,CAAC,IAAI,EAAE,2BAA2B;IAJtD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;gBAElB,IAAI,EAAE,2BAA2B;IAetD;;;;;;;;;;;;OAYG;IACG,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAiC7D;;;;;OAKG;IACG,cAAc,CAClB,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,kBAAkB,EAAE,GAC5B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAYrC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC;IAiDjF;;;OAGG;YACW,OAAO;CAiCtB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAIA,OAAO,EAA8C,KAAK,OAAO,EAAE,KAAK,GAAG,EAAqB,KAAK,YAAY,EAAE,MAAM,MAAM,CAAC;AAQhI,OAAO,KAAK,EACV,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,YAAY,CAAC;CAC5B;AAwCD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,2BAA4B,SAAQ,uBAAuB;IAC1E,eAAe,EAAE,OAAO,CAAC;IACzB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,qBAAa,mBAAmB;IAKlB,QAAQ,CAAC,IAAI,EAAE,2BAA2B;IAJtD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;gBAElB,IAAI,EAAE,2BAA2B;IAetD;;;;;;;;;;;;OAYG;IACG,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAyCjH;;;;;OAKG;IACG,cAAc,CAClB,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,kBAAkB,EAAE,GAC5B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAYrC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC;IA+DjF;;;OAGG;YACW,OAAO;CAiCtB"}

package/dist/client.js

@@ -1,9 +1,56 @@
+import { AGENT_TYPE } from './constants.js';
+import { decodeDerivedTypeId, isProfileTypeConsistent } from './derived-type.js';
+import { ProfileTypeMismatchError } from './errors.js';
+const ZERO_BYTES32 = '0x0000000000000000000000000000000000000000000000000000000000000000';
 import { createPublicClient, http, keccak256, toHex } from 'viem';
-import { agentProfileResolverAbi } from './abis';
-import { profileContentHash, canonicalProfileJson } from './profile';
-import { ProfileHashMismatchError } from './errors';
-import { buildRegisterProfileCall, buildSetProfileMetadataCall, } from './calls';
+import { agentProfileResolverAbi } from './abis.js';
+import { profileContentHash, canonicalProfileJson } from './profile.js';
+import { ProfileHashMismatchError, InvalidProfileError } from './errors.js';
+import { buildRegisterProfileCall, buildSetProfileMetadataCall, } from './calls.js';
 const ZERO_NODE = '0x0000000000000000000000000000000000000000000000000000000000000000';
+// NEW-AP-2 (2026-07-05 completeness audit): the profile metadata URI is ATTACKER-CONTROLLED on-chain state
+// (any agent sets its own ATL_METADATA_URI). fetchProfile runs server-side (indexer / Worker), so an
+// unguarded fetch is an SSRF — an attacker points the URI at http://169.254.169.254/ (cloud metadata),
+// loopback, or a private host. Allow ONLY https to a public host.
+function isPrivateOrReservedHost(host) {
+    const m = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (m) {
+        const a = Number(m[1]);
+        const b = Number(m[2]);
+        if (a === 0 || a === 127 || a === 10)
+            return true; // this-network / loopback / private
+        if (a === 172 && b >= 16 && b <= 31)
+            return true; // private
+        if (a === 192 && b === 168)
+            return true; // private
+        if (a === 169 && b === 254)
+            return true; // link-local incl 169.254.169.254 cloud metadata
+        if (a >= 224)
+            return true; // multicast / reserved
+    }
+    if (host === '::1' || host === '[::1]')
+        return true; // ipv6 loopback
+    if (host.startsWith('fe80:') || host.startsWith('[fe80:'))
+        return true; // ipv6 link-local
+    if (/^\[?f[cd][0-9a-f]{2}:/.test(host))
+        return true; // ipv6 ULA
+    return false;
+}
+function assertSafeProfileUri(uri) {
+    let u;
+    try {
+        u = new URL(uri);
+    }
+    catch {
+        throw new InvalidProfileError(`profile URI is not a valid URL: ${uri}`);
+    }
+    if (u.protocol !== 'https:')
+        throw new InvalidProfileError(`profile URI must be https (SSRF guard); got ${u.protocol}`);
+    const host = u.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    if (host === 'localhost' || host.endsWith('.localhost') || host === '' || isPrivateOrReservedHost(host)) {
+        throw new InvalidProfileError(`profile URI host not allowed (SSRF guard): ${host}`);
+    }
+}
 const ATL_METADATA_URI = keccak256(toHex('atl:metadataURI'));
 const ATL_METADATA_HASH = keccak256(toHex('atl:metadataHash'));
 export class AgentIdentityClient {
@@ -27,7 +74,7 @@ export class AgentIdentityClient {
     }
     // ─── Reads (Phase 2 — live) ─────────────────────────────────────
     /**
-     * Fetch the AgentCard for `agent`:
+     * Fetch the CanonicalAgentProfileV1 for `agent`:
      *   1. Read `atl:metadataURI` + `atl:metadataHash` from the
      *      AgentProfileResolver (on-chain anchor).
      *   2. HTTP-fetch the JSON at metadataURI.
@@ -39,7 +86,7 @@ export class AgentIdentityClient {
      * `atl:metadataURI` record (treated equivalently — the on-chain
      * anchor is absent).
      */
-    async fetchProfile(agent) {
+    async fetchProfile(agent, opts) {
         const [uri, anchorHash] = await Promise.all([
             this.publicClient.readContract({
                 address: this.profileResolver,
@@ -56,6 +103,8 @@ export class AgentIdentityClient {
         ]);
         if (!uri || uri === '')
             return null;
+        // NEW-AP-2: reject non-https / private / loopback / metadata hosts before touching the network.
+        assertSafeProfileUri(uri);
         const response = await this.fetcher(uri);
         if (!response.ok) {
             throw new Error(`[agent-profile] failed to fetch profile JSON: HTTP ${response.status}`);
@@ -67,7 +116,15 @@ export class AgentIdentityClient {
         const canonical = canonicalProfileJson(parsed);
         void canonical; // forces validation
         const computed = profileContentHash(parsed);
-        if (anchorHash !== ZERO_NODE && computed !== anchorHash) {
+        if (anchorHash === ZERO_NODE) {
+            // NEW-AP-1: a URI set with NO on-chain hash anchor cannot be integrity-checked — the fetched content is
+            // whatever the (mutable, off-chain) host returns. Fail-closed by default: the package's core invariant
+            // is `content-hash === anchor`, so treat an unanchored profile as no verifiable profile. Callers that
+            // genuinely accept unanchored content opt in explicitly (greppable, audit-worthy).
+            if (!opts?.allowUnanchored)
+                return null;
+        }
+        else if (computed !== anchorHash) {
             throw new ProfileHashMismatchError(anchorHash, computed);
         }
         return parsed;
@@ -88,7 +145,7 @@ export class AgentIdentityClient {
     // ─── Writes (Phase 4 — live) ─────────────────────────────────────
     /**
      * Publish a profile by:
-     *   1. Validating the AgentCard + computing its canonical
+     *   1. Validating the CanonicalAgentProfileV1 + computing its canonical
      *      content-hash.
      *   2. (If `expectedHash` set) asserting it matches our computed
      *      hash — anti-spoof self-check.
@@ -115,6 +172,20 @@ export class AgentIdentityClient {
         if (input.expectedHash && input.expectedHash.toLowerCase() !== computed.toLowerCase()) {
             throw new ProfileHashMismatchError(input.expectedHash, computed);
         }
+        // spec 346 §3.6 step 5: the card's `type` MUST agree with the SA-keyed `atl:agentType` when one is
+        // declared. One read; an undeclared type is an answer (no check), never a trigger for a second path.
+        const declaredId = (await this.publicClient.readContract({
+            address: this.profileResolver,
+            abi: agentProfileResolverAbi,
+            functionName: 'getBytes32Property',
+            args: [input.agent, AGENT_TYPE],
+        }));
+        if (declaredId !== ZERO_BYTES32) {
+            const declared = decodeDerivedTypeId(declaredId);
+            if (!declared || !isProfileTypeConsistent(input.profile.type, declared)) {
+                throw new ProfileTypeMismatchError(input.profile.type, declared ?? declaredId);
+            }
+        }
         // Register first if needed.
         const isRegistered = await this.publicClient.readContract({
             address: this.profileResolver,

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAgE,MAAM,MAAM,CAAC;AAChI,OAAO,EAAE,uBAAuB,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,SAAS,CAAC;AAejB,MAAM,SAAS,GAAG,oEAA6E,CAAC;AAChG,MAAM,gBAAgB,GAAI,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAC9D,MAAM,iBAAiB,GAAG,SAAS,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAmB/D,MAAM,OAAO,mBAAmB;IAKT;IAJJ,YAAY,CAAe;IAC3B,eAAe,CAAU;IACzB,OAAO,CAAe;IAEvC,YAAqB,IAAiC;QAAjC,SAAI,GAAJ,IAAI,CAA6B;QACpD,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrE,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjE,CAAC;IAED,mEAAmE;IAEnE;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,YAAY,CAAC,KAAc;QAC/B,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC1C,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;gBAC7B,OAAO,EAAE,IAAI,CAAC,eAAe;gBAC7B,GAAG,EAAE,uBAAuB;gBAC5B,YAAY,EAAE,mBAAmB;gBACjC,IAAI,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC;aAChC,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;gBAC7B,OAAO,EAAE,IAAI,CAAC,eAAe;gBAC7B,GAAG,EAAE,uBAAuB;gBAC5B,YAAY,EAAE,oBAAoB;gBAClC,IAAI,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC;aACjC,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,sDAAsD,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC;QAC7C,gEAAgE;QAChE,oEAAoE;QACpE,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC/C,KAAK,SAAS,CAAC,CAAC,oBAAoB;QACpC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,UAAU,KAAK,SAAS,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YACxD,MAAM,IAAI,wBAAwB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAClB,KAAc,EACd,QAAgB,EAChB,OAA6B;QAE7B,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO,CAAC;QACb,MAAM,IAAI,KAAK,CACb,wDAAwD;YACtD,qEAAqE,CACxE,CAAC;IACJ,CAAC;IAED,oEAAoE;IAEpE;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,CAAC,cAAc,CAAC,KAA0B,EAAE,GAAiB;QAChE,2BAA2B;QAC3B,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B;QAC/D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YACtF,MAAM,IAAI,wBAAwB,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnE,CAAC;QACD,4BAA4B;QAC5B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;YACxD,OAAO,EAAE,IAAI,CAAC,eAAe;YAC7B,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,cAAc;YAC5B,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,YAAY,GAAG,wBAAwB,CAAC;gBAC5C,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,WAAW;gBAC5C,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,WAAW;gBAC5C,SAAS,EAAE,KAAK,CAAC,YAAY,EAAE,SAAS;gBACxC,gBAAgB,EAAE,KAAK,CAAC,YAAY,EAAE,gBAAgB;aACvD,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YACtC,4DAA4D;YAC5D,2DAA2D;YAC3D,6DAA6D;YAC7D,wDAAwD;YACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;oBAC9C,OAAO,EAAE,IAAI,CAAC,eAAe;oBAC7B,GAAG,EAAE,uBAAuB;oBAC5B,YAAY,EAAE,cAAc;oBAC5B,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;iBACpB,CAAC,CAAC;gBACH,IAAI,EAAE;oBAAE,MAAM;gBACd,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,2BAA2B;QAC3B,MAAM,OAAO,GAAG,2BAA2B,CAAC;YAC1C,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,QAAQ;SACvB,CAAC,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,OAAO,CAAC,GAAiB,EAAE,IAA+C;QACtF,MAAM,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC;QAC7B,MAAM,OAAO,GAAI,YAAmD,CAAC,OAAO,CAAC;QAC7E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC7E,IAAI,OAAgB,CAAC;QACrB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC;oBACxD,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,QAAQ,EAAE,SAAS;iBACpB,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC;oBAC9C,EAAE,EAAE,IAAI,CAAC,EAAE;oBACX,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,KAAK;oBACL,OAAO,EAAE,YAAY,CAAC,OAAQ;oBAC9B,KAAK,EAAE,YAAY,CAAC,KAAK,IAAI,IAAI;iBAClC,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5D,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,GAAG,GAAG,CAAC;gBACd,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,IAAI,EAAE,CAAC;gBACzC,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC/D,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;oBAC9C,SAAS;gBACX,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,MAAM,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACpG,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,MAAM,YAAY,GAAG,oEAAoE,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAgE,MAAM,MAAM,CAAC;AAChI,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,YAAY,CAAC;AAepB,MAAM,SAAS,GAAG,oEAA6E,CAAC;AAEhG,2GAA2G;AAC3G,qGAAqG;AACrG,uGAAuG;AACvG,kEAAkE;AAClE,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACrE,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC,CAAC,oCAAoC;QACvF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC,CAAC,UAAU;QAC5D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,UAAU;QACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,iDAAiD;QAC1F,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,uBAAuB;IACpD,CAAC;IACD,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,CAAC,gBAAgB;IACrE,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;IAC1F,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,WAAW;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,oBAAoB,CAAC,GAAW;IACvC,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,mBAAmB,CAAC,+CAA+C,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxH,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC9D,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,KAAK,EAAE,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,mBAAmB,CAAC,8CAA8C,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AACD,MAAM,gBAAgB,GAAI,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAC9D,MAAM,iBAAiB,GAAG,SAAS,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAmB/D,MAAM,OAAO,mBAAmB;IAKT;IAJJ,YAAY,CAAe;IAC3B,eAAe,CAAU;IACzB,OAAO,CAAe;IAEvC,YAAqB,IAAiC;QAAjC,SAAI,GAAJ,IAAI,CAA6B;QACpD,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrE,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjE,CAAC;IAED,mEAAmE;IAEnE;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,YAAY,CAAC,KAAc,EAAE,IAAoC;QACrE,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC1C,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;gBAC7B,OAAO,EAAE,IAAI,CAAC,eAAe;gBAC7B,GAAG,EAAE,uBAAuB;gBAC5B,YAAY,EAAE,mBAAmB;gBACjC,IAAI,EAAE,CAAC,KAAK,EAAE,gBAAgB,CAAC;aAChC,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;gBAC7B,OAAO,EAAE,IAAI,CAAC,eAAe;gBAC7B,GAAG,EAAE,uBAAuB;gBAC5B,YAAY,EAAE,oBAAoB;gBAClC,IAAI,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC;aACjC,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QACpC,gGAAgG;QAChG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,sDAAsD,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QAC3D,gEAAgE;QAChE,oEAAoE;QACpE,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC/C,KAAK,SAAS,CAAC,CAAC,oBAAoB;QACpC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,wGAAwG;YACxG,uGAAuG;YACvG,sGAAsG;YACtG,mFAAmF;YACnF,IAAI,CAAC,IAAI,EAAE,eAAe;gBAAE,OAAO,IAAI,CAAC;QAC1C,CAAC;aAAM,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,wBAAwB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAClB,KAAc,EACd,QAAgB,EAChB,OAA6B;QAE7B,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO,CAAC;QACb,MAAM,IAAI,KAAK,CACb,wDAAwD;YACtD,qEAAqE,CACxE,CAAC;IACJ,CAAC;IAED,oEAAoE;IAEpE;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,CAAC,cAAc,CAAC,KAA0B,EAAE,GAAiB;QAChE,2BAA2B;QAC3B,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B;QAC/D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YACtF,MAAM,IAAI,wBAAwB,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnE,CAAC;QACD,mGAAmG;QACnG,qGAAqG;QACrG,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;YACvD,OAAO,EAAE,IAAI,CAAC,eAAe;YAC7B,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,oBAAoB;YAClC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC;SAChC,CAAC,CAAQ,CAAC;QACX,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC,QAAQ,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACxE,MAAM,IAAI,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,IAAI,UAAU,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QACD,4BAA4B;QAC5B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;YACxD,OAAO,EAAE,IAAI,CAAC,eAAe;YAC7B,GAAG,EAAE,uBAAuB;YAC5B,YAAY,EAAE,cAAc;YAC5B,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,YAAY,GAAG,wBAAwB,CAAC;gBAC5C,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,WAAW;gBAC5C,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,WAAW;gBAC5C,SAAS,EAAE,KAAK,CAAC,YAAY,EAAE,SAAS;gBACxC,gBAAgB,EAAE,KAAK,CAAC,YAAY,EAAE,gBAAgB;aACvD,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YACtC,4DAA4D;YAC5D,2DAA2D;YAC3D,6DAA6D;YAC7D,wDAAwD;YACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;oBAC9C,OAAO,EAAE,IAAI,CAAC,eAAe;oBAC7B,GAAG,EAAE,uBAAuB;oBAC5B,YAAY,EAAE,cAAc;oBAC5B,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;iBACpB,CAAC,CAAC;gBACH,IAAI,EAAE;oBAAE,MAAM;gBACd,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,2BAA2B;QAC3B,MAAM,OAAO,GAAG,2BAA2B,CAAC;YAC1C,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,QAAQ;SACvB,CAAC,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,OAAO,CAAC,GAAiB,EAAE,IAA+C;QACtF,MAAM,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC;QAC7B,MAAM,OAAO,GAAI,YAAmD,CAAC,OAAO,CAAC;QAC7E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC7E,IAAI,OAAgB,CAAC;QACrB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC;oBACxD,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,QAAQ,EAAE,SAAS;iBACpB,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC;oBAC9C,EAAE,EAAE,IAAI,CAAC,EAAE;oBACX,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,KAAK;oBACL,OAAO,EAAE,YAAY,CAAC,OAAQ;oBAC9B,KAAK,EAAE,YAAY,CAAC,KAAK,IAAI,IAAI;iBAClC,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5D,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,GAAG,GAAG,CAAC;gBACd,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,IAAI,EAAE,CAAC;gBACzC,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC/D,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;oBAC9C,SAAS;gBACX,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,MAAM,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACpG,CAAC;CACF"}

package/dist/constants.d.ts

@@ -22,9 +22,39 @@ export declare const AUTH_ORIGIN: Hex;
  */
 export declare const CAIP10_NAMESPACE_ALLOWLIST: ReadonlySet<string>;
 /**
- * AgentCard schema version. Bump on any breaking change to the typed
+ * CanonicalAgentProfileV1 schema version. Bump on any breaking change to the typed
  * profile shape; canonical-JSON content-hash incorporates this field
  * so old + new profiles never collide.
  */
 export declare const AGENT_CARD_SCHEMA_VERSION: 1;
+/**
+ * The SA-keyed DERIVED-TYPE record (spec 346 §2.3; ADR-0061). `getBytes32Property(agent, AGENT_TYPE)` →
+ * `keccak256(<DerivedAgentType>)`; `getStringProperty(agent, SERVICE_ROLE)` → the open-set role. Written by
+ * the SA itself (bootstrap step 1b), read by the naming plane to validate a typed claim, and by
+ * `publishProfile` to refuse a `profileType` that disagrees with it. Predicate ids mirror
+ * `AgentNamePredicates.sol` (`atl:agentType` / `atl:serviceRole`) and `agent-naming/records`.
+ */
+export declare const AGENT_TYPE: Hex;
+export declare const SERVICE_ROLE: Hex;
+/**
+ * The SA-keyed DISTRIBUTION record (spec 347 §8.5; `docs/architecture/ard-acp-crosswalk.md` §2–§3).
+ * `getStringProperty(agent, DISTRIBUTION)` → the JCS-canonical JSON of an `AgentDistributionV1`
+ * (`encodeDistribution` / `decodeDistribution`). Mirrors `AgentProfilePredicates.ATL_DISTRIBUTION`
+ * (`keccak256("atl:distribution")`); the indexer projects it to `approf:distribution`. Written by the SA
+ * itself (`buildSetDistributionCall`), never by a registry — a registry file is a PROJECTION of it.
+ */
+export declare const DISTRIBUTION: Hex;
+/**
+ * The SA-keyed CLIENT KEYS record (spec 442 §3; `client-key-binding.ts`). `getStringProperty(agent, CLIENT_KEYS)`
+ * → the JCS-canonical JSON of a `ClientKeysRecordV1`: the public half of every live `ClientKeyBindingV1`
+ * (thumbprint · alg · scope · clientId · custody epoch · notAfter). Written by the SA itself
+ * (`buildSetClientKeysCall`); what a JWKS / client metadata document / TAP key directory is PROJECTED from
+ * (ap-federation spec 443) and what a verifier checks a presented binding against. Never a signature, never a key.
+ */
+export declare const CLIENT_KEYS: Hex;
+/**
+ * The six platform keys an `AgentDistributionV1.binary` map may carry — verbatim from the ACP registry
+ * `agent.schema.json` (`binaryDistribution.propertyNames.enum`). Any other key fails validation.
+ */
+export declare const ACP_PLATFORMS: readonly ["darwin-aarch64", "darwin-x86_64", "linux-aarch64", "linux-x86_64", "windows-aarch64", "windows-x86_64"];
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAElD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,WAAW,EAAE,GAAoC,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAIzD,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAG,CAAU,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAElD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,WAAW,EAAE,GAAoC,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAIzD,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAG,CAAU,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,EAAE,GAAuC,CAAC;AACjE,eAAO,MAAM,YAAY,EAAE,GAAyC,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,GAA0C,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,GAAwC,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,aAAa,oHAOhB,CAAC"}

package/dist/constants.js

@@ -26,9 +26,46 @@ export const CAIP10_NAMESPACE_ALLOWLIST = new Set([
     'solana', // Solana
 ]);
 /**
- * AgentCard schema version. Bump on any breaking change to the typed
+ * CanonicalAgentProfileV1 schema version. Bump on any breaking change to the typed
  * profile shape; canonical-JSON content-hash incorporates this field
  * so old + new profiles never collide.
  */
 export const AGENT_CARD_SCHEMA_VERSION = 1;
+/**
+ * The SA-keyed DERIVED-TYPE record (spec 346 §2.3; ADR-0061). `getBytes32Property(agent, AGENT_TYPE)` →
+ * `keccak256(<DerivedAgentType>)`; `getStringProperty(agent, SERVICE_ROLE)` → the open-set role. Written by
+ * the SA itself (bootstrap step 1b), read by the naming plane to validate a typed claim, and by
+ * `publishProfile` to refuse a `profileType` that disagrees with it. Predicate ids mirror
+ * `AgentNamePredicates.sol` (`atl:agentType` / `atl:serviceRole`) and `agent-naming/records`.
+ */
+export const AGENT_TYPE = keccak256(toHex('atl:agentType'));
+export const SERVICE_ROLE = keccak256(toHex('atl:serviceRole'));
+/**
+ * The SA-keyed DISTRIBUTION record (spec 347 §8.5; `docs/architecture/ard-acp-crosswalk.md` §2–§3).
+ * `getStringProperty(agent, DISTRIBUTION)` → the JCS-canonical JSON of an `AgentDistributionV1`
+ * (`encodeDistribution` / `decodeDistribution`). Mirrors `AgentProfilePredicates.ATL_DISTRIBUTION`
+ * (`keccak256("atl:distribution")`); the indexer projects it to `approf:distribution`. Written by the SA
+ * itself (`buildSetDistributionCall`), never by a registry — a registry file is a PROJECTION of it.
+ */
+export const DISTRIBUTION = keccak256(toHex('atl:distribution'));
+/**
+ * The SA-keyed CLIENT KEYS record (spec 442 §3; `client-key-binding.ts`). `getStringProperty(agent, CLIENT_KEYS)`
+ * → the JCS-canonical JSON of a `ClientKeysRecordV1`: the public half of every live `ClientKeyBindingV1`
+ * (thumbprint · alg · scope · clientId · custody epoch · notAfter). Written by the SA itself
+ * (`buildSetClientKeysCall`); what a JWKS / client metadata document / TAP key directory is PROJECTED from
+ * (ap-federation spec 443) and what a verifier checks a presented binding against. Never a signature, never a key.
+ */
+export const CLIENT_KEYS = keccak256(toHex('atl:clientKeys'));
+/**
+ * The six platform keys an `AgentDistributionV1.binary` map may carry — verbatim from the ACP registry
+ * `agent.schema.json` (`binaryDistribution.propertyNames.enum`). Any other key fails validation.
+ */
+export const ACP_PLATFORMS = [
+    'darwin-aarch64',
+    'darwin-x86_64',
+    'linux-aarch64',
+    'linux-x86_64',
+    'windows-aarch64',
+    'windows-x86_64',
+];
 //# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAY,MAAM,MAAM,CAAC;AAElD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,WAAW,GAAQ,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAC;IACrE,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,mBAAmB;IAC7B,QAAQ,EAAE,SAAS;CACpB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAU,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAY,MAAM,MAAM,CAAC;AAElD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,WAAW,GAAQ,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAC;IACrE,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,mBAAmB;IAC7B,QAAQ,EAAE,SAAS;CACpB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAU,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAQ,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,YAAY,GAAQ,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAQ,SAAS,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAQ,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,gBAAgB;IAChB,eAAe;IACf,eAAe;IACf,cAAc;IACd,iBAAiB;IACjB,gBAAgB;CACR,CAAC"}

package/dist/derived-type.d.ts

@@ -0,0 +1,14 @@
+import { type Hex } from 'viem';
+import type { DerivedAgentType } from '@agenticprimitives/types';
+import type { ProfileType } from './types.js';
+/** `keccak256(<DerivedAgentType>)` — the enum value stored under `atl:agentType` (mirrors agent-naming `AGENT_TYPE_ID`). */
+export declare function derivedTypeId(t: DerivedAgentType): Hex;
+export declare function decodeDerivedTypeId(id: Hex): DerivedAgentType | null;
+/**
+ * Which derived types a `ProfileType` may describe (spec 346 §6.2 — publish refuses a profileType
+ * inconsistent with the SA's declared `atl:agentType`). `mcpServer` / `multisig` are technology/structure
+ * profiles that may sit on any service- or org-rooted agent.
+ */
+export declare function profileTypesForDerivedType(t: DerivedAgentType): readonly ProfileType[];
+export declare function isProfileTypeConsistent(profileType: ProfileType, declared: DerivedAgentType): boolean;
+//# sourceMappingURL=derived-type.d.ts.map

package/dist/derived-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derived-type.d.ts","sourceRoot":"","sources":["../src/derived-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,4HAA4H;AAC5H,wBAAgB,aAAa,CAAC,CAAC,EAAE,gBAAgB,GAAG,GAAG,CAEtD;AAaD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,GAAG,GAAG,gBAAgB,GAAG,IAAI,CAIpE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,EAAE,gBAAgB,GAAG,SAAS,WAAW,EAAE,CAuBtF;AAED,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAErG"}