@agenticprimitives/devkit 0.0.0-alpha.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Agentic Trust Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,62 @@
+# @agenticprimitives/devkit
+
+The Developer Kit core — `ap`, the CLI that is the packages' own front door (spec 398 §10, spec 399 §3, ADR-0063).
+
+```
+npx ap doctor                          # every rule, this tree, the config it found
+npx ap doctor --rule no-private-keys   # one rule; --json for a coding agent
+npx ap doctor --rules --write          # project the rules source; pin digests in agentic.lock.json
+npx ap upgrade --canary                # newest canary of every @agenticprimitives/* pin, one exact set
+npx ap upgrade --pin 1.0.0-alpha.24    # or one named version / dist-tag
+npx ap conform a2a https://…           # A2A 1.0 conformance (dispatches to @agenticprimitives/a2a)
+npx ap test --live-gates live-gates.json
+npx ap create my-product --template product-repo --pin 1.0.0-alpha.24
+```
+
+## Doctor rules
+
+Each rule is one file under `src/rules/`, data plus one pure judgement, parameterised by a config section. The
+ids are the ones spec 399 §2.3 gives to the root checks they replace:
+
+| Rule | Twin (root check) | Enforces |
+| --- | --- | --- |
+| `web-no-direct-mcp` | `check:no-direct-mcp-in-web` | ADR-0044 — browser code reaches MCP only via `/a2a/*` |
+| `no-private-keys` | `check:no-app-private-keys` | no raw key material in app source; allow-list with reasons |
+| `no-hmac-home-bridge` | `check:no-hmac-home-bridge` | spec 341 ratchet — the bridge count only falls |
+| `no-cross-subject-vault-reads` | `check:no-cross-subject-vault-reads` | spec 366 R3 — reads only at the own subject |
+| `fail-open-knobs` | `check:fail-open-knobs` | ADR-0045 — every permissive knob allow-listed by name |
+| `internal-marker-split` | `check:internal-marker-split` | spec 341 §7 — marker ≠ custody secret |
+| `custodian-coverage` | `check:custodian-coverage` | specs 294/295 — provider-neutral custodian |
+| `archetype-catalog` | `check:archetype-catalog` | spec 354 §3 — catalog validates at recorded digests |
+| `capability-vocabulary` | `check:capability-vocabulary` | ADR-0051 — capability / protocol features / playbook |
+| `demo-person-org-distinct` | `check:demo-person-org-distinct` | ADR-0046 — person SA ≠ org SA |
+| `rules-drift` | — | 399 §3.4 — projections match the pinned source by digest |
+| `lock-coherent` | — | 399 §3.1 — exact, coherent `@agenticprimitives/*` pins |
+
+Config resolution is one mechanism: `ap.config.json#doctor`, else `agentic.lock.json#doctor`, else the built-in
+reference layout of the agenticprimitives monorepo. A product repo gets its own section from `create-app`.
+
+Exit codes: `0` clean · `1` findings · `2` usage or config · `3` a rule or dispatch errored. Error codes are
+stable strings (`E_CONFIG`, `E_RULE_UNKNOWN`, `E_MODULE_ABSENT`, …) so an agent branches on the code.
+
+## Rules projection
+
+`ap doctor --rules` projects one rules source into `.cursor/rules/*.mdc` (frontmatter from `rules/sidecar.json`,
+body byte-for-byte) and into the `<!-- ap:rules -->…<!-- /ap:rules -->` block of `AGENTS.md` and `CLAUDE.md`.
+A file without the block is left alone. Digests are pinned in `agentic.lock.json#rules`; `rules-drift` fails when a
+projection or a pin no longer matches the source. In this monorepo the source is `docs/architecture/agent-rules`;
+a consumer uses the copy bundled in the package.
+
+## `agentic.lock.json`
+
+```json
+{ "lockVersion": 1, "packages": { "@agenticprimitives/a2a": "1.0.0-alpha.24" }, "rules": { "skill-terminology": "sha256:…" }, "devkit": "…", "template": { "name": "product-repo", "revision": "…" }, "doctor": { … } }
+```
+
+`packages` is the coherent set `ap upgrade` maintains; `rules` the source digests; `doctor` the product's rule
+config (each section replaces the reference section whole).
+
+## What it will not do
+
+Hold a key, read a vault, mint authority, invoke a production effect. A doctor finding is a review checkpoint;
+no verifier reads it (spec 361 §1).

package/bin/ap.mjs

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+// `ap` — the Developer Kit CLI (spec 398 §10.3; every command takes --json for coding agents).
+//
+//   ap doctor [--rule <id>[,<id>]] [--root <dir>] [--verbose] [--json]
+//   ap doctor --rules [--write] [--all] [--source <dir>]       project the rules source; report drift by digest
+//   ap upgrade --canary | --pin <version|tag> [--dry-run] [--no-install] [--json]
+//   ap conform a2a|mcp <url> [--bearer <token>] [--timeout <ms>] [--json]
+//   ap test --live-gates <ledger.json> [--only a,b] [--json]
+//   ap create <dir> --template product-repo [--name <n>] [--pin <version>] [--json]
+//
+// Exit: 0 clean · 1 findings · 2 usage/config · 3 a rule or dispatch errored.
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import {
+  DevkitError, EXIT, RULE_IDS, runDoctor, formatDoctorReport, loadDoctorConfig, loadRulesCorpus, projectRules, rulesLockEntries,
+  readLock, writeLock, planUpgrade, applyUpgradePlan, formatUpgradePlan, loadConform, loadLiveGatesRunner, loadCreateApp, formatConformanceReport,
+} from '../dist/index.js';
+
+const argv = process.argv.slice(2);
+const cmd = argv[0];
+const rest = argv.slice(1);
+const flag = (n) => rest.includes(`--${n}`);
+const opt = (n) => { const i = rest.indexOf(`--${n}`); return i >= 0 && !String(rest[i + 1] ?? '--').startsWith('--') ? rest[i + 1] : undefined; };
+const positional = () => rest.filter((a, i) => !a.startsWith('--') && !(i > 0 && rest[i - 1].startsWith('--') && opt(rest[i - 1].slice(2)) === a));
+const json = flag('json');
+const root = resolve(opt('root') ?? process.cwd());
+const devkitVersion = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
+
+const out = (obj, text) => { if (json) console.log(JSON.stringify(obj, null, 2)); else console.log(text); };
+const fail = (e) => {
+  const code = e instanceof DevkitError ? e.code : 'E_UNEXPECTED';
+  if (json) console.log(JSON.stringify({ ok: false, error: { code, message: e.message } }, null, 2));
+  else console.error(`✗ ${code}: ${e.message}`);
+  process.exit(code === 'E_USAGE' || code === 'E_CONFIG' || code === 'E_RULE_UNKNOWN' ? EXIT.USAGE : EXIT.ERROR);
+};
+
+const USAGE = `ap <doctor|upgrade|conform|test|create> … (see the header of bin/ap.mjs). Rules: ${RULE_IDS.join(', ')}`;
+
+async function doctor() {
+  if (flag('rules')) {
+    const loaded = loadDoctorConfig(root);
+    const cfg = loaded.config.rulesDrift;
+    const corpus = loadRulesCorpus({ root, source: opt('source') ?? cfg.source, hardRulesFrom: cfg.hardRulesFrom });
+    const results = projectRules({ root, corpus, cursorRules: cfg.cursorRules, agentsMd: cfg.agentsMd, claudeMd: cfg.claudeMd, write: flag('write'), all: flag('all'), createCursorDir: flag('write') && flag('create-cursor') });
+    const digests = rulesLockEntries(corpus);
+    let lockStatus = 'not written';
+    if (flag('write')) {
+      const lock = readLock(root) ?? { lockVersion: 1, packages: {}, rules: {} };
+      lock.rules = digests; lock.devkit = devkitVersion; writeLock(root, lock); lockStatus = 'agentic.lock.json#rules written';
+    }
+    const drift = results.filter((r) => r.status === 'would-write');
+    const text = [`ap doctor --rules · source ${corpus.sourceDir} · ${corpus.rules.length} rule(s) · lock ${lockStatus}`, ...results.map((r) => `  ${r.status === 'unchanged' || r.status === 'written' ? '✓' : r.status === 'would-write' ? '✗' : '·'} ${r.status.padEnd(11)} ${r.path}${r.reason ? ` (${r.reason})` : ''}`), '', drift.length ? `✗ ${drift.length} projection(s) differ from the source — run with --write` : '✓ every projection matches the source (no-op)'].join('\n');
+    out({ ok: drift.length === 0, source: corpus.sourceDir, rules: digests, projections: results }, text);
+    process.exit(drift.length ? EXIT.FINDINGS : EXIT.OK);
+  }
+  const only = opt('rule')?.split(',').map((s) => s.trim()).filter(Boolean);
+  const report = await runDoctor({ root, only });
+  out({ ok: report.ok, ...report }, formatDoctorReport(report, { verbose: flag('verbose') }));
+  process.exit(report.errored ? EXIT.ERROR : report.ok ? EXIT.OK : EXIT.FINDINGS);
+}
+
+async function upgrade() {
+  const mode = flag('canary') ? 'canary' : opt('pin') !== undefined ? 'pin' : null;
+  if (!mode) throw new DevkitError('E_USAGE', 'ap upgrade needs --canary or --pin <version|tag>');
+  const plan = await planUpgrade({ root, mode, pin: opt('pin') });
+  if (plan.unresolved.length) { out({ ok: false, plan }, formatUpgradePlan(plan)); throw new DevkitError('E_RESOLVE', `${plan.unresolved.length} package(s) could not be resolved`); }
+  if (flag('dry-run')) { out({ ok: true, dryRun: true, plan }, formatUpgradePlan(plan)); return; }
+  const touched = applyUpgradePlan(root, plan, { devkitVersion });
+  const steps = [];
+  if (!flag('no-install') && plan.changes.length) {
+    for (const args of [['install'], ['dedupe']]) {
+      const r = spawnSync('pnpm', args, { cwd: root, stdio: json ? 'pipe' : 'inherit', encoding: 'utf8' });
+      steps.push({ cmd: `pnpm ${args.join(' ')}`, status: r.status });
+      if (r.status !== 0) { out({ ok: false, plan, touched, steps }, `${formatUpgradePlan(plan)}\n✗ pnpm ${args.join(' ')} exited ${r.status}`); process.exit(EXIT.ERROR); }
+    }
+  }
+  const report = await runDoctor({ root });
+  out({ ok: report.ok, plan, touched, steps, doctor: report }, `${formatUpgradePlan(plan)}\n  wrote ${touched.join(', ')}\n\n${formatDoctorReport(report)}`);
+  process.exit(report.ok ? EXIT.OK : EXIT.FINDINGS);
+}
+
+async function conform() {
+  const [kind, url] = positional();
+  if (!['a2a', 'mcp'].includes(kind) || !url) throw new DevkitError('E_USAGE', 'ap conform a2a|mcp <url>');
+  const fn = await loadConform(kind);
+  const report = await fn(url, { bearer: opt('bearer') ?? process.env.AP_CONFORM_BEARER, timeoutMs: opt('timeout') ? Number(opt('timeout')) : undefined });
+  out({ ok: report.ok, report }, formatConformanceReport(report));
+  process.exit(report.ok ? EXIT.OK : EXIT.FINDINGS);
+}
+
+async function test() {
+  const ledgerPath = opt('live-gates');
+  if (!ledgerPath) throw new DevkitError('E_USAGE', 'ap test --live-gates <ledger.json> (interaction-coverage and ask-truth modes land with 399 W1)');
+  if (!existsSync(resolve(root, ledgerPath))) throw new DevkitError('E_INPUT_MISSING', `live-gates ledger not found: ${ledgerPath}`);
+  const runner = await loadLiveGatesRunner();
+  const ledger = JSON.parse(readFileSync(resolve(root, ledgerPath), 'utf8'));
+  const result = await runner(ledger, { root, only: opt('only')?.split(','), home: opt('home') ?? process.env.HOME_URL });
+  out({ ok: result.ok, result }, `ap test --live-gates · ${result.ok ? 'passed' : 'FAILED'} · ${Array.isArray(result.results) ? result.results.length : 0} gate(s)`);
+  process.exit(result.ok ? EXIT.OK : EXIT.FINDINGS);
+}
+
+async function create() {
+  const [dir] = positional();
+  if (!dir) throw new DevkitError('E_USAGE', 'ap create <dir> --template product-repo [--name <n>] [--pin <version>]');
+  const createApp = await loadCreateApp();
+  const result = await createApp({ dir: resolve(root, dir), template: opt('template') ?? 'product-repo', name: opt('name'), pin: opt('pin'), devkitVersion });
+  out({ ok: true, result }, `ap create · ${result.dir}\n${(result.files ?? []).map((f) => `  ${f}`).join('\n')}`);
+}
+
+const commands = { doctor, upgrade, conform, test, create };
+try {
+  if (!cmd || flag('help') || cmd === '--help' || !commands[cmd]) {
+    if (json) console.log(JSON.stringify({ ok: !cmd || cmd === '--help', usage: USAGE }));
+    else console.log(USAGE);
+    process.exit(!cmd || cmd === '--help' ? EXIT.OK : EXIT.USAGE);
+  }
+  await commands[cmd]();
+} catch (e) { fail(e); }

package/dist/config.d.ts

@@ -0,0 +1,130 @@
+/** Any section may carry `skip: <reason>`: the rule reports `skip` with that sentence instead of judging — for a
+ *  product that has no Home custody surface yet, no archetype catalog, no persona roster. A reason is required;
+ *  a silent off-switch is the drift this kit refuses. */
+export interface Skippable {
+    skip?: string;
+}
+export interface WhyEntry {
+    file: string;
+    why: string;
+}
+export interface KnobAllow {
+    file: string;
+    knob: string;
+    why: string;
+}
+export interface DoctorConfig {
+    /** ADR-0044 — browser apps reach MCP data only via /a2a/*. */
+    webNoDirectMcp: Skippable & {
+        browserApps: string[];
+        allowMarkers: string[];
+    };
+    /** key-custody doctrine — no raw key material in app source. */
+    noPrivateKeys: Skippable & {
+        roots: string[];
+        allowedIn: WhyEntry[];
+        toleratedEnvNames: Array<{
+            name: string;
+            why: string;
+        }>;
+    };
+    /** spec 341 / ADR-0059 — the control plane never rides a shared secret; a ratchet that only falls. */
+    noHmacHomeBridge: Skippable & {
+        dir: string;
+        hmacCall: string;
+        sessionRpcCall: string;
+        ceilings: {
+            hmac: number;
+            total: number;
+        };
+    };
+    /** spec 366 R3 — a read tool reads only at its own subject. */
+    noCrossSubjectVaultReads: Skippable & {
+        roots: string[];
+        exemptFiles: string[];
+        gate: string;
+    };
+    /** ADR-0045 — a fail-open knob is allow-listed by name, never silent. */
+    failOpenKnobs: Skippable & {
+        roots: string[];
+        allowlist: KnobAllow[];
+    };
+    /** spec 341 §7 — the in-Worker marker and the custody secret never re-merge. */
+    internalMarkerSplit: Skippable & {
+        src: string;
+        secret: string;
+        marker: string;
+        budget: Record<string, number | 'unbounded'>;
+    };
+    /** specs 294/295 — the connection custodian is provider-neutral and the Home offers every custody class. */
+    custodianCoverage: Skippable & {
+        matrix: string;
+        matrixKinds: string[];
+        homeVia: string;
+        viaRequired: string[];
+        viaSocialAny: string[];
+        relyingApp: {
+            dir: string;
+            entryFiles: string[];
+            mustImport: string;
+        };
+        providerNamedCustody: string[];
+        browserApps: string[];
+    };
+    /** spec 354 §3 — the compiled archetype catalog validates and its digests are the recorded ones. */
+    archetypeCatalog: Skippable & {
+        module: string;
+        exportName: string;
+        expected: Record<string, string>;
+    };
+    /** ADR-0051 — capability · protocol features · playbook stay distinct. */
+    capabilityVocabulary: Skippable & {
+        homeGlobs: string[];
+        packagesGlob: string;
+        wireAllowed: string[];
+    };
+    /** ADR-0046 — a person SA is never also their org SA, on the roster of record. */
+    demoPersonOrgDistinct: Skippable & {
+        roster: string;
+    };
+    /** 399 §3.4 — projected rules match their pinned source by digest. */
+    rulesDrift: Skippable & {
+        source?: string;
+        hardRulesFrom?: string;
+        cursorRules: string;
+        lock: string;
+        agentsMd: string;
+        claudeMd: string;
+    };
+    /** 399 §3.1 — exact, coherent @agenticprimitives/* pins (the ~/skills lesson). */
+    lockCoherent: Skippable & {
+        allowWorkspace: boolean;
+        scope: string;
+    };
+}
+/** A section override replaces the reference section whole — or names only `{ skip }` to keep the reference shape and
+ *  switch the rule off with a reason. */
+export type DoctorConfigOverrides = {
+    [K in keyof DoctorConfig]?: DoctorConfig[K] | {
+        skip: string;
+    };
+};
+/**
+ * The REFERENCE layout — the agenticprimitives monorepo as it stands, so `ap doctor` run at its root reproduces
+ * every root check's verdict (399 §3.3 "side by side"). A product repo never inherits this: `create-app`
+ * writes its own `agentic.lock.json#doctor`. Names here are directory names, never hostnames.
+ */
+export declare const RING0_DOCTOR_CONFIG: DoctorConfig;
+export type ConfigSource = 'ap.config.json' | 'agentic.lock.json#doctor' | 'built-in ring-0 layout';
+export interface LoadedConfig {
+    config: DoctorConfig;
+    source: ConfigSource;
+    overrides: string[];
+}
+/** Merge a per-rule override set over the reference layout: a section given replaces that section whole. */
+export declare function mergeDoctorConfig(base: DoctorConfig, overrides: DoctorConfigOverrides): {
+    config: DoctorConfig;
+    applied: string[];
+};
+export declare function loadDoctorConfig(root: string): LoadedConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAQA;;yDAEyD;AACzD,MAAM,WAAW,SAAS;IAAG,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE;AAC5C,MAAM,WAAW,QAAQ;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AACvD,MAAM,WAAW,SAAS;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AAEtE,MAAM,WAAW,YAAY;IAE3B,8DAA8D;IAC9D,cAAc,EAAE,SAAS,GAAG;QAAE,WAAW,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC9E,gEAAgE;IAChE,aAAa,EAAE,SAAS,GAAG;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;QAAC,iBAAiB,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAC/H,sGAAsG;IACtG,gBAAgB,EAAE,SAAS,GAAG;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IACnI,+DAA+D;IAC/D,wBAAwB,EAAE,SAAS,GAAG;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/F,yEAAyE;IACzE,aAAa,EAAE,SAAS,GAAG;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,SAAS,EAAE,CAAA;KAAE,CAAC;IACvE,gFAAgF;IAChF,mBAAmB,EAAE,SAAS,GAAG;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAAC,CAAA;KAAE,CAAC;IAC/H,4GAA4G;IAC5G,iBAAiB,EAAE,SAAS,GAAG;QAC7B,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAC;QACtC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAC/D,UAAU,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,EAAE,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;QACtE,oBAAoB,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAC;KACvD,CAAC;IACF,oGAAoG;IACpG,gBAAgB,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IACvG,0EAA0E;IAC1E,oBAAoB,EAAE,SAAS,GAAG;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvG,kFAAkF;IAClF,qBAAqB,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,sEAAsE;IACtE,UAAU,EAAE,SAAS,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3I,kFAAkF;IAClF,YAAY,EAAE,SAAS,GAAG;QAAE,cAAc,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAED;yCACyC;AACzC,MAAM,MAAM,qBAAqB,GAAG;KAAG,CAAC,IAAI,MAAM,YAAY,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE;CAAE,CAAC;AAEvG;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,YAuEjC,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,gBAAgB,GAAG,0BAA0B,GAAG,wBAAwB,CAAC;AAEpG,MAAM,WAAW,YAAY;IAAG,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE;AAIjG,4GAA4G;AAC5G,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,qBAAqB,GAAG;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAYnI;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAiB3D"}

package/dist/config.js

@@ -0,0 +1,128 @@
+// THE DOCTOR CONFIG. Every rule is parameterised by a section here; the rule LOGIC is generic (ADR-0021), the
+// LAYOUT it judges is data. Resolution order, one mechanism (ADR-0013): `ap.config.json#doctor` if present,
+// else `agentic.lock.json#doctor` if present, else the built-in reference layout below — and the report SAYS
+// which one it used.
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { DevkitError, ERROR_CODES } from './errors.js';
+/**
+ * The REFERENCE layout — the agenticprimitives monorepo as it stands, so `ap doctor` run at its root reproduces
+ * every root check's verdict (399 §3.3 "side by side"). A product repo never inherits this: `create-app`
+ * writes its own `agentic.lock.json#doctor`. Names here are directory names, never hostnames.
+ */
+export const RING0_DOCTOR_CONFIG = {
+    webNoDirectMcp: {
+        browserApps: ['apps/demo-web', 'apps/demo-web-pro', 'apps/demo-web-recovery', 'apps/demo-web-payment', 'apps/demo-org', 'apps/demo-gs', 'apps/demo-jp', 'apps/demo-sso-next'],
+        allowMarkers: ['@external-mcp-client-demo'],
+    },
+    noPrivateKeys: {
+        roots: ['apps'],
+        allowedIn: [
+            { file: 'apps/demo-a2a/src/config.ts', why: 'local-aes dev backend reads A2A_MASTER_PRIVATE_KEY only when A2A_KMS_BACKEND=local-aes; production is gcp-kms (deferred KMS migration, memory project_demo_a2a_kms_deferred)' },
+            { file: 'apps/demo-a2a/scripts/canonical-a2a-e2e.ts', why: 'e2e harness mints an ephemeral SIWE persona; never an identity, never deployed' },
+            { file: 'apps/demo-sso-next/scripts/provision-demo-personas-local.ts', why: 'local-chain provisioner with published dev keys' },
+            { file: 'apps/demo-sso-next/scripts/provision-service-agent-local.ts', why: 'local-chain provisioner with published dev keys' },
+            { file: 'apps/demo-sso-next/scripts/provision-typed-service-agent.ts', why: 'one-run operator CLI; key from env, never written' },
+            { file: 'apps/demo-sso-next/scripts/set-typed-name-records.ts', why: 'one-run operator CLI' },
+            { file: 'apps/demo-sso-next/scripts/publish-capabilities.ts', why: 'one-run operator CLI' },
+            { file: 'apps/demo-sso-next/scripts/link-service-steward-local.ts', why: 'one-run operator CLI' },
+            { file: 'apps/demo-jp/src/lib/personas.ts', why: 'demo personas hold testnet EOAs by design (D-1)' },
+            { file: 'apps/demo-resolution/src/live.ts', why: 'browser personas derived from published seed strings; read-only resolution' },
+            { file: 'apps/demo-jp/src/lib/chain.ts', why: 'persona signer for the D-1 demo custody path' },
+            { file: 'apps/demo-gs/src/lib/personas.ts', why: 'same accepted testnet demo-key pattern as demo-jp' },
+            { file: 'apps/demo-gs/src/lib/chain.ts', why: 'same accepted testnet demo-key pattern as demo-jp' },
+            { file: 'apps/demo-gs/scripts/seed-substrate.ts', why: 'same accepted testnet demo-key pattern as demo-jp' },
+            { file: 'apps/demo-jp/src/connect-client.ts', why: 'ephemeral per-connect session keypair on the relying origin (spec 270 v4)' },
+            { file: 'apps/demo-web-payment/src/lib/personas.ts', why: 'ephemeral payee EOA in sessionStorage; never signs' },
+            { file: 'apps/demo-web-payment/vite.config.ts', why: 'dev-server-only gas faucet reading the local env' },
+            { file: 'apps/demo-discovery/src/lib/abox.ts', why: 'fixture signers for the browser-verified demo bundles' },
+            { file: 'apps/demo-web-pro/src/lib/native-session.ts', why: 'in-memory session keypair for the Act 6 native-ingress demonstration' },
+            { file: 'apps/demo-mcp/scripts/native-mcp-smoke.ts', why: 'dev smoke script with throwaway EOAs' },
+            { file: 'apps/demo-sso-next/server/_lib/demo-custody.ts', why: 'testnet demo-persona custody from DEMO_PERSONA_KEYS' },
+            { file: 'apps/demo-sso-next/server/connect/demo-accounts.ts', why: 'derives the seeded persona custodian address' },
+        ],
+        toleratedEnvNames: [
+            { name: 'A2A_MASTER_PRIVATE_KEY', why: 'the local-aes dev backend signing key; unused under gcp-kms' },
+            { name: 'A2A_INTERACTIONS_SESSION_PRIVATE_KEY', why: 'workstation-only InteractionsDO session signer when no Cloud KMS is present' },
+        ],
+    },
+    noHmacHomeBridge: { dir: 'apps/demo-sso-next', hmacCall: 'bridgeInteractions', sessionRpcCall: 'callInteractions', ceilings: { hmac: 0, total: 42 } },
+    noCrossSubjectVaultReads: { roots: ['packages/context/src', 'apps/demo-a2a/src'], exemptFiles: ['self-only.ts'], gate: 'subjectOfRead' },
+    failOpenKnobs: {
+        roots: ['apps'],
+        allowlist: [
+            { file: 'apps/demo-mcp/src/index.ts', knob: 'allowUnboundSessionToken', why: 'persona/operator-key demo path (accepted testnet hole C-1, spec 248)' },
+            { file: 'apps/demo-mcp/src/kas.ts', knob: 'allowUnsignedGrant', why: 'in-process self-authored grant; real authority is the spec-278 vault-key authorization' },
+            { file: 'apps/demo-mcp/src/kas.ts', knob: 'allowUnboundGrant', why: 'N-4: same in-process single-use grant' },
+            { file: 'apps/demo-a2a/src/index.ts', knob: 'developmentMode', why: 'test/dev session verification; production wires expectedIss/expectedAud' },
+            { file: 'apps/demo-mcp/wrangler.toml', knob: 'DEMO_VAULT_PROVISION_ENABLED', why: 'registers the KEK provision route; the route is proof-gated by default' },
+        ],
+    },
+    internalMarkerSplit: { src: 'apps/demo-a2a/src', secret: 'A2A_CUSTODY_BRIDGE_SECRET', marker: 'x-ap-internal', budget: { 'index.ts': 'unbounded', 'interactions-do.ts': 1 } },
+    custodianCoverage: {
+        matrix: 'docs/architecture/connection-custodian-matrix.md', matrixKinds: ['siwe', 'passkey', 'social'],
+        homeVia: 'apps/demo-sso-next/src/home/onboarding.ts', viaRequired: ['passkey', 'wallet'], viaSocialAny: ['google', 'youversion'],
+        relyingApp: { dir: 'apps/demo-web/src', entryFiles: ['main.tsx', 'connect.ts', 'App.tsx'], mustImport: '@agenticprimitives/connect-client' },
+        providerNamedCustody: ['google', 'youversion'], browserApps: ['apps/demo-web', 'apps/demo-org', 'apps/demo-gs', 'apps/demo-jp'],
+    },
+    archetypeCatalog: {
+        module: 'apps/demo-sso-next/src/lib/archetype-catalog.ts', exportName: 'ARCHETYPE_CATALOG',
+        expected: {
+            'treasury-steward': '0x00f5b03b5724864c5b8edf11048baa6693b520647594997bbffc2fa41391fc0e',
+            bookkeeper: '0xce101b9c3ba2df0ae0a969a1d058a34727a581a5a848d509f617eae68bbde219',
+            'org-steward': '0x20c188049af98ea4ce1aa7d94178d1aacf2848b2531d93010dc158293b4c3567',
+        },
+    },
+    capabilityVocabulary: {
+        homeGlobs: ['apps/demo-sso-next/app/**/*.{ts,tsx}', 'apps/demo-sso-next/src/**/*.{ts,tsx}', 'packages/home/src/**/*.{ts,tsx}'],
+        packagesGlob: 'packages/*/src/**/*.ts',
+        wireAllowed: ['packages/agent-profile/src/a2a/', 'packages/capability-claims/src/', 'apps/demo-sso-next/src/components/studio/Inspector.tsx', 'apps/demo-a2a/src/', 'packages/surface-catalog/src/', 'packages/a2a/src/', 'apps/demo-sso-next/src/whitelabel/'],
+    },
+    demoPersonOrgDistinct: { roster: 'demo/personas.json' },
+    rulesDrift: { source: 'docs/architecture/agent-rules', hardRulesFrom: 'CLAUDE.md', cursorRules: '.cursor/rules', lock: 'agentic.lock.json', agentsMd: 'AGENTS.md', claudeMd: 'CLAUDE.md' },
+    lockCoherent: { allowWorkspace: true, scope: '@agenticprimitives/' },
+};
+function isObject(v) { return typeof v === 'object' && v !== null && !Array.isArray(v); }
+/** Merge a per-rule override set over the reference layout: a section given replaces that section whole. */
+export function mergeDoctorConfig(base, overrides) {
+    const config = { ...base };
+    const applied = [];
+    for (const [k, v] of Object.entries(overrides)) {
+        if (!(k in base))
+            throw new DevkitError(ERROR_CODES.E_CONFIG, `doctor config names an unknown rule section "${k}"`);
+        if (!isObject(v))
+            throw new DevkitError(ERROR_CODES.E_CONFIG, `doctor config section "${k}" must be an object`);
+        if ('skip' in v && typeof v['skip'] !== 'string')
+            throw new DevkitError(ERROR_CODES.E_CONFIG, `doctor config section "${k}": skip must be a sentence saying why`);
+        const only = Object.keys(v).length === 1 && 'skip' in v;
+        config[k] = only ? { ...base[k], skip: v['skip'] } : v;
+        applied.push(k);
+    }
+    return { config, applied };
+}
+export function loadDoctorConfig(root) {
+    const apConfig = join(root, 'ap.config.json');
+    const lock = join(root, 'agentic.lock.json');
+    const readSection = (path, label) => {
+        if (!existsSync(path))
+            return null;
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(path, 'utf8'));
+        }
+        catch (e) {
+            throw new DevkitError(ERROR_CODES.E_CONFIG, `${label}: not valid JSON (${e.message})`);
+        }
+        if (!isObject(parsed))
+            throw new DevkitError(ERROR_CODES.E_CONFIG, `${label}: top level must be an object`);
+        const section = parsed['doctor'];
+        if (section === undefined)
+            return null;
+        if (!isObject(section))
+            throw new DevkitError(ERROR_CODES.E_CONFIG, `${label}: "doctor" must be an object of rule sections`);
+        const { config, applied } = mergeDoctorConfig(RING0_DOCTOR_CONFIG, section);
+        return { config, source: label, overrides: applied };
+    };
+    return readSection(apConfig, 'ap.config.json') ?? readSection(lock, 'agentic.lock.json#doctor') ?? { config: RING0_DOCTOR_CONFIG, source: 'built-in ring-0 layout', overrides: [] };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,4GAA4G;AAC5G,6GAA6G;AAC7G,qBAAqB;AACrB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA8CvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAiB;IAC/C,cAAc,EAAE;QACd,WAAW,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,oBAAoB,CAAC;QAC7K,YAAY,EAAE,CAAC,2BAA2B,CAAC;KAC5C;IACD,aAAa,EAAE;QACb,KAAK,EAAE,CAAC,MAAM,CAAC;QACf,SAAS,EAAE;YACT,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,8KAA8K,EAAE;YAC5N,EAAE,IAAI,EAAE,4CAA4C,EAAE,GAAG,EAAE,gFAAgF,EAAE;YAC7I,EAAE,IAAI,EAAE,6DAA6D,EAAE,GAAG,EAAE,iDAAiD,EAAE;YAC/H,EAAE,IAAI,EAAE,6DAA6D,EAAE,GAAG,EAAE,iDAAiD,EAAE;YAC/H,EAAE,IAAI,EAAE,6DAA6D,EAAE,GAAG,EAAE,mDAAmD,EAAE;YACjI,EAAE,IAAI,EAAE,sDAAsD,EAAE,GAAG,EAAE,sBAAsB,EAAE;YAC7F,EAAE,IAAI,EAAE,oDAAoD,EAAE,GAAG,EAAE,sBAAsB,EAAE;YAC3F,EAAE,IAAI,EAAE,0DAA0D,EAAE,GAAG,EAAE,sBAAsB,EAAE;YACjG,EAAE,IAAI,EAAE,kCAAkC,EAAE,GAAG,EAAE,iDAAiD,EAAE;YACpG,EAAE,IAAI,EAAE,kCAAkC,EAAE,GAAG,EAAE,4EAA4E,EAAE;YAC/H,EAAE,IAAI,EAAE,+BAA+B,EAAE,GAAG,EAAE,8CAA8C,EAAE;YAC9F,EAAE,IAAI,EAAE,kCAAkC,EAAE,GAAG,EAAE,mDAAmD,EAAE;YACtG,EAAE,IAAI,EAAE,+BAA+B,EAAE,GAAG,EAAE,mDAAmD,EAAE;YACnG,EAAE,IAAI,EAAE,wCAAwC,EAAE,GAAG,EAAE,mDAAmD,EAAE;YAC5G,EAAE,IAAI,EAAE,oCAAoC,EAAE,GAAG,EAAE,2EAA2E,EAAE;YAChI,EAAE,IAAI,EAAE,2CAA2C,EAAE,GAAG,EAAE,oDAAoD,EAAE;YAChH,EAAE,IAAI,EAAE,sCAAsC,EAAE,GAAG,EAAE,kDAAkD,EAAE;YACzG,EAAE,IAAI,EAAE,qCAAqC,EAAE,GAAG,EAAE,uDAAuD,EAAE;YAC7G,EAAE,IAAI,EAAE,6CAA6C,EAAE,GAAG,EAAE,sEAAsE,EAAE;YACpI,EAAE,IAAI,EAAE,2CAA2C,EAAE,GAAG,EAAE,sCAAsC,EAAE;YAClG,EAAE,IAAI,EAAE,gDAAgD,EAAE,GAAG,EAAE,qDAAqD,EAAE;YACtH,EAAE,IAAI,EAAE,oDAAoD,EAAE,GAAG,EAAE,8CAA8C,EAAE;SACpH;QACD,iBAAiB,EAAE;YACjB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,6DAA6D,EAAE;YACtG,EAAE,IAAI,EAAE,sCAAsC,EAAE,GAAG,EAAE,6EAA6E,EAAE;SACrI;KACF;IACD,gBAAgB,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,cAAc,EAAE,kBAAkB,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;IACrJ,wBAAwB,EAAE,EAAE,KAAK,EAAE,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,EAAE,WAAW,EAAE,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE;IACxI,aAAa,EAAE;QACb,KAAK,EAAE,CAAC,MAAM,CAAC;QACf,SAAS,EAAE;YACT,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,sEAAsE,EAAE;YACrJ,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,wFAAwF,EAAE;YAC/J,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,uCAAuC,EAAE;YAC7G,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,yEAAyE,EAAE;YAC/I,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,8BAA8B,EAAE,GAAG,EAAE,wEAAwE,EAAE;SAC7J;KACF;IACD,mBAAmB,EAAE,EAAE,GAAG,EAAE,mBAAmB,EAAE,MAAM,EAAE,2BAA2B,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC,EAAE,EAAE;IAC7K,iBAAiB,EAAE;QACjB,MAAM,EAAE,kDAAkD,EAAE,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;QACtG,OAAO,EAAE,2CAA2C,EAAE,WAAW,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;QAChI,UAAU,EAAE,EAAE,GAAG,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,UAAU,EAAE,mCAAmC,EAAE;QAC5I,oBAAoB,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,CAAC;KAChI;IACD,gBAAgB,EAAE;QAChB,MAAM,EAAE,iDAAiD,EAAE,UAAU,EAAE,mBAAmB;QAC1F,QAAQ,EAAE;YACR,kBAAkB,EAAE,oEAAoE;YACxF,UAAU,EAAE,oEAAoE;YAChF,aAAa,EAAE,oEAAoE;SACpF;KACF;IACD,oBAAoB,EAAE;QACpB,SAAS,EAAE,CAAC,sCAAsC,EAAE,sCAAsC,EAAE,iCAAiC,CAAC;QAC9H,YAAY,EAAE,wBAAwB;QACtC,WAAW,EAAE,CAAC,iCAAiC,EAAE,iCAAiC,EAAE,wDAAwD,EAAE,oBAAoB,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,oCAAoC,CAAC;KAChQ;IACD,qBAAqB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE;IACvD,UAAU,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE;IAC1L,YAAY,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE,qBAAqB,EAAE;CACrE,CAAC;AAMF,SAAS,QAAQ,CAAC,CAAU,IAAkC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhI,4GAA4G;AAC5G,MAAM,UAAU,iBAAiB,CAAC,IAAkB,EAAE,SAAgC;IACpF,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,EAAkB,CAAC;IAC3C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,CAAC,QAAQ,EAAE,gDAAgD,CAAC,GAAG,CAAC,CAAC;QACpH,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,CAAC,QAAQ,EAAE,0BAA0B,CAAC,qBAAqB,CAAC,CAAC;QAChH,IAAI,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,CAAC,QAAQ,EAAE,0BAA0B,CAAC,uCAAuC,CAAC,CAAC;QAClK,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC;QACvD,MAA6C,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,GAAI,IAA0C,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACtI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,KAAmB,EAAuB,EAAE;QAC7E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,WAAW,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,KAAK,qBAAsB,CAAW,CAAC,OAAO,GAAG,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,KAAK,+BAA+B,CAAC,CAAC;QAC5G,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,KAAK,+CAA+C,CAAC,CAAC;QAC7H,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,mBAAmB,EAAE,OAAgC,CAAC,CAAC;QACrG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACvD,CAAC,CAAC;IACF,OAAO,WAAW,CAAC,QAAQ,EAAE,gBAAgB,CAAC,IAAI,WAAW,CAAC,IAAI,EAAE,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,wBAAwB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AACtL,CAAC"}

package/dist/dispatch.d.ts

@@ -0,0 +1,44 @@
+export interface ConformanceCheck {
+    id: string;
+    level: 'MUST' | 'SHOULD' | 'MAY';
+    ok: boolean;
+    detail?: string;
+}
+export interface ConformanceReport {
+    target: string;
+    ok: boolean;
+    checks: ConformanceCheck[];
+}
+export type ConformFn = (url: string, opts?: {
+    bearer?: string;
+    timeoutMs?: number;
+}) => Promise<ConformanceReport>;
+export interface LiveGatesRunner {
+    (ledger: unknown, opts?: Record<string, unknown>): Promise<{
+        ok: boolean;
+        results: unknown[];
+    }>;
+}
+export declare const CONFORM_MODULES: {
+    readonly a2a: {
+        readonly spec: "@agenticprimitives/a2a/conform";
+        readonly fn: "conformA2a";
+    };
+    readonly mcp: {
+        readonly spec: "@agenticprimitives/mcp-protocol/conform";
+        readonly fn: "conformMcp";
+    };
+};
+export declare function loadConform(kind: keyof typeof CONFORM_MODULES): Promise<ConformFn>;
+export declare const LIVE_GATES_MODULE: {
+    readonly spec: "@agenticprimitives/evaluation";
+    readonly fn: "runLiveGates";
+};
+export declare function loadLiveGatesRunner(): Promise<LiveGatesRunner>;
+export declare const CREATE_APP_MODULE: {
+    readonly spec: "@agenticprimitives/create-app";
+    readonly fn: "createApp";
+};
+export declare function loadCreateApp(): Promise<(opts: Record<string, unknown>) => Promise<unknown>>;
+export declare function formatConformanceReport(r: ConformanceReport): string;
+//# sourceMappingURL=dispatch.d.ts.map

package/dist/dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,gBAAgB;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AAChH,MAAM,WAAW,iBAAiB;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,gBAAgB,EAAE,CAAA;CAAE;AAC9F,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEpH,MAAM,WAAW,eAAe;IAC9B,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC,CAAC;CACjG;AAoBD,eAAO,MAAM,eAAe;;;;;;;;;CAA6J,CAAC;AAE1L,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,OAAO,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAGxF;AAED,eAAO,MAAM,iBAAiB;;;CAAyE,CAAC;AAExG,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,eAAe,CAAC,CAEpE;AAED,eAAO,MAAM,iBAAiB;;;CAAsE,CAAC;AAErG,wBAAsB,aAAa,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAElG;AAED,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAIpE"}

package/dist/dispatch.js

@@ -0,0 +1,43 @@
+// Dispatchers to the packages that OWN a conformance suite or a runner (spec 399 §3.3): `ap conform a2a|mcp` calls
+// `@agenticprimitives/a2a/conform` / `@agenticprimitives/mcp-protocol/conform`; `ap test --live-gates` calls
+// `@agenticprimitives/evaluation`'s runner. Resolved at run time from the consumer's install, so this kit does
+// not carry the protocol packages: an absent module is a stable E_MODULE_ABSENT, never a fallback (ADR-0013).
+import { DevkitError, ERROR_CODES } from './errors.js';
+const MODULE_NOT_FOUND = new Set(['ERR_MODULE_NOT_FOUND', 'ERR_PACKAGE_PATH_NOT_EXPORTED', 'MODULE_NOT_FOUND']);
+async function loadModule(spec, what) {
+    try {
+        return (await import(spec));
+    }
+    catch (e) {
+        const code = e.code ?? '';
+        if (MODULE_NOT_FOUND.has(code))
+            throw new DevkitError(ERROR_CODES.E_MODULE_ABSENT, `${what} needs ${spec.split('/').slice(0, 2).join('/')} installed (${spec} not found)`, { cause: e });
+        throw e;
+    }
+}
+function pick(mod, name, spec) {
+    const fn = mod[name];
+    if (typeof fn !== 'function')
+        throw new DevkitError(ERROR_CODES.E_MODULE_SHAPE, `${spec} does not export ${name}() — upgrade the package or this kit so their contracts agree`);
+    return fn;
+}
+export const CONFORM_MODULES = { a2a: { spec: '@agenticprimitives/a2a/conform', fn: 'conformA2a' }, mcp: { spec: '@agenticprimitives/mcp-protocol/conform', fn: 'conformMcp' } };
+export async function loadConform(kind) {
+    const m = CONFORM_MODULES[kind];
+    return pick(await loadModule(m.spec, `ap conform ${kind}`), m.fn, m.spec);
+}
+export const LIVE_GATES_MODULE = { spec: '@agenticprimitives/evaluation', fn: 'runLiveGates' };
+export async function loadLiveGatesRunner() {
+    return pick(await loadModule(LIVE_GATES_MODULE.spec, 'ap test --live-gates'), LIVE_GATES_MODULE.fn, LIVE_GATES_MODULE.spec);
+}
+export const CREATE_APP_MODULE = { spec: '@agenticprimitives/create-app', fn: 'createApp' };
+export async function loadCreateApp() {
+    return pick(await loadModule(CREATE_APP_MODULE.spec, 'ap create'), CREATE_APP_MODULE.fn, CREATE_APP_MODULE.spec);
+}
+export function formatConformanceReport(r) {
+    const lines = [`ap conform · ${r.target} · ${r.ok ? 'CONFORMANT' : 'NOT conformant'}`];
+    for (const c of r.checks)
+        lines.push(`  ${c.ok ? '✓' : c.level === 'MUST' ? '✗' : '⚠'} ${c.level.padEnd(6)} ${c.id}${c.detail ? ` — ${c.detail}` : ''}`);
+    return lines.join('\n');
+}
+//# sourceMappingURL=dispatch.js.map

package/dist/dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAAA,mHAAmH;AACnH,6GAA6G;AAC7G,+GAA+G;AAC/G,8GAA8G;AAC9G,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAUvD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,sBAAsB,EAAE,+BAA+B,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAEhH,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,IAAY;IAClD,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAA4B,CAAC;IACzD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,GAAI,CAAuB,CAAC,IAAI,IAAI,EAAE,CAAC;QACjD,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,CAAC,eAAe,EAAE,GAAG,IAAI,UAAU,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACzL,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAI,GAA4B,EAAE,IAAY,EAAE,IAAY;IACvE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,IAAI,OAAO,EAAE,KAAK,UAAU;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,CAAC,cAAc,EAAE,GAAG,IAAI,oBAAoB,IAAI,+DAA+D,CAAC,CAAC;IAChL,OAAO,EAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,yCAAyC,EAAE,EAAE,EAAE,YAAY,EAAE,EAAW,CAAC;AAE1L,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAkC;IAClE,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,IAAI,CAAY,MAAM,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,IAAI,EAAE,+BAA+B,EAAE,EAAE,EAAE,cAAc,EAAW,CAAC;AAExG,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,OAAO,IAAI,CAAkB,MAAM,UAAU,CAAC,iBAAiB,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,iBAAiB,CAAC,EAAE,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAC/I,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,IAAI,EAAE,+BAA+B,EAAE,EAAE,EAAE,WAAW,EAAW,CAAC;AAErG,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,OAAO,IAAI,CAAC,MAAM,UAAU,CAAC,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,iBAAiB,CAAC,EAAE,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACnH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,CAAoB;IAC1D,MAAM,KAAK,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACvF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzJ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/doctor.d.ts

@@ -0,0 +1,21 @@
+import { type DoctorConfig, type LoadedConfig } from './config.js';
+import type { RuleContext, RuleResult } from './rules/types.js';
+export interface DoctorReport {
+    root: string;
+    configSource: LoadedConfig['source'];
+    configOverrides: string[];
+    rules: RuleResult[];
+    ok: boolean;
+    errored: boolean;
+}
+export declare function makeRuleContext(root: string): RuleContext;
+export declare function runDoctor(opts: {
+    root: string;
+    config?: DoctorConfig;
+    only?: string[];
+    loaded?: LoadedConfig;
+}): Promise<DoctorReport>;
+export declare function formatDoctorReport(report: DoctorReport, opts?: {
+    verbose?: boolean;
+}): string;
+//# sourceMappingURL=doctor.d.ts.map

package/dist/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,YAAY,EAAoB,MAAM,aAAa,CAAC;AAKrF,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEhE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;IACrC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAUzD;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,YAAY,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAoB5I;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CAcjG"}