@agenticprimitives/fabric 0.0.0-alpha.1

package/dist/cloudflare/provenance-store.d.ts

@@ -0,0 +1,9 @@
+import type { ProvenanceRecordV1 } from '@agenticprimitives/provenance';
+export interface ProvenanceStore {
+    /** Merge a projected record into the exchange's A-box (accretes activities/entities/agents/plans; de-dupes
+     *  by id so a re-projection is idempotent). */
+    put(exchangeId: string, record: ProvenanceRecordV1, at: string): Promise<void>;
+    get(exchangeId: string): Promise<ProvenanceRecordV1 | null>;
+}
+export declare function createDurableObjectProvenanceStore(sql: SqlStorage): ProvenanceStore;
+//# sourceMappingURL=provenance-store.d.ts.map

package/dist/cloudflare/provenance-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance-store.d.ts","sourceRoot":"","sources":["../../src/cloudflare/provenance-store.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAcxE,MAAM,WAAW,eAAe;IAC9B;mDAC+C;IAC/C,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;CAC7D;AAOD,wBAAgB,kCAAkC,CAAC,GAAG,EAAE,UAAU,GAAG,eAAe,CA8BnF"}

package/dist/cloudflare/provenance-store.js

@@ -0,0 +1,36 @@
+const CREATE_TABLE = `CREATE TABLE IF NOT EXISTS provenance_records (
+  exchange_id TEXT PRIMARY KEY,
+  record_json TEXT NOT NULL,
+  updated_at  TEXT NOT NULL
+)`;
+function mergeById(a, b) {
+    const seen = new Set(a.map((x) => x.id));
+    return [...a, ...b.filter((x) => !seen.has(x.id))];
+}
+export function createDurableObjectProvenanceStore(sql) {
+    sql.exec(CREATE_TABLE);
+    const read = (exchangeId) => {
+        const rows = sql.exec('SELECT record_json FROM provenance_records WHERE exchange_id = ?', exchangeId).toArray();
+        return rows[0] ? JSON.parse(rows[0].record_json) : null;
+    };
+    return {
+        async put(exchangeId, record, at) {
+            const prev = read(exchangeId);
+            const merged = prev
+                ? {
+                    version: 'ap.provenance.v1',
+                    agents: mergeById(prev.agents, record.agents),
+                    activities: mergeById(prev.activities, record.activities),
+                    entities: mergeById(prev.entities, record.entities),
+                    plans: mergeById(prev.plans, record.plans),
+                }
+                : record;
+            sql.exec(`INSERT INTO provenance_records (exchange_id, record_json, updated_at) VALUES (?, ?, ?)
+         ON CONFLICT(exchange_id) DO UPDATE SET record_json = excluded.record_json, updated_at = excluded.updated_at`, exchangeId, JSON.stringify(merged), at);
+        },
+        async get(exchangeId) {
+            return read(exchangeId);
+        },
+    };
+}
+//# sourceMappingURL=provenance-store.js.map

package/dist/cloudflare/provenance-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance-store.js","sourceRoot":"","sources":["../../src/cloudflare/provenance-store.ts"],"names":[],"mappings":"AAUA,MAAM,YAAY,GAAG;;;;EAInB,CAAC;AAeH,SAAS,SAAS,CAA2B,CAAM,EAAE,CAAM;IACzD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,GAAe;IAChE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,CAAC,UAAkB,EAA6B,EAAE;QAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAU,kEAAkE,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;QACzH,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAwB,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;YAC9B,MAAM,MAAM,GAAuB,IAAI;gBACrC,CAAC,CAAC;oBACE,OAAO,EAAE,kBAAkB;oBAC3B,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;oBAC7C,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;oBACzD,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;oBACnD,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;iBAC3C;gBACH,CAAC,CAAC,MAAM,CAAC;YACX,GAAG,CAAC,IAAI,CACN;qHAC6G,EAC7G,UAAU,EACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EACtB,EAAE,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,UAAU;YAClB,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cloudflare/receipt-signer.d.ts

@@ -0,0 +1,26 @@
+export interface DeliveryReceiptInput {
+    exchangeId: string;
+    /** The delivered message id the receipt attests. */
+    messageId: string;
+    /** The gateway principal (owner) that admitted the message. */
+    recipient: string;
+    /** Delivery time T (ISO) — the caller supplies it (a DO has no ambient wall-clock in tests). */
+    at: string;
+}
+export interface SignedDeliveryReceiptV1 extends DeliveryReceiptInput {
+    version: 'ap.delivery-receipt.v1';
+    /** The DO-local secp256k1 attestation pubkey (uncompressed hex). */
+    signerPubkey: string;
+    /** Compact secp256k1 signature (hex) over `sha256(canonical receipt bytes)`. */
+    signature: string;
+}
+export interface DeliveryReceiptSigner {
+    /** The DO-local attestation pubkey (uncompressed hex) — publish it so senders can verify receipts. */
+    pubkey(): Promise<string>;
+    /** Sign a delivery receipt with the DO-local key. */
+    sign(input: DeliveryReceiptInput): Promise<SignedDeliveryReceiptV1>;
+}
+export declare function createDurableObjectReceiptSigner(storage: DurableObjectStorage): DeliveryReceiptSigner;
+/** Verify a signed delivery receipt against its embedded signer pubkey. Fail-closed on any error. */
+export declare function verifyDeliveryReceipt(receipt: SignedDeliveryReceiptV1): boolean;
+//# sourceMappingURL=receipt-signer.d.ts.map

package/dist/cloudflare/receipt-signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt-signer.d.ts","sourceRoot":"","sources":["../../src/cloudflare/receipt-signer.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,gGAAgG;IAChG,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,uBAAwB,SAAQ,oBAAoB;IACnE,OAAO,EAAE,wBAAwB,CAAC;IAClC,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAC;CACnB;AAwBD,MAAM,WAAW,qBAAqB;IACpC,sGAAsG;IACtG,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1B,qDAAqD;IACrD,IAAI,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACrE;AAED,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,oBAAoB,GAAG,qBAAqB,CAqBrG;AAED,qGAAqG;AACrG,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAS/E"}

package/dist/cloudflare/receipt-signer.js

@@ -0,0 +1,69 @@
+/// <reference types="@cloudflare/workers-types" />
+// DO-local delivery-receipt signer (spec 316 W2 / §3a receipt + Blocker 4).
+//
+// When the gateway admits a message (T0 delivery), it signs a DeliveryReceipt attesting "this message was
+// accepted under valid authority at time T" — the delivery-proof the sender gets (the review's "signed append
+// receipt, decoupled from body storage"). The signing key is a DO-LOCAL software secp256k1 key, generated
+// once + persisted in DO storage: it attests delivery (ADR-0011 delegated authority-to-attest), it is NOT the
+// SA custody key, and it is NEVER a KMS round-trip on the hot warm path (Blocker 4). Verify with
+// `verifyDeliveryReceipt` against the embedded signer pubkey.
+import { secp256k1 } from '@noble/curves/secp256k1.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils.js';
+const STORAGE_KEY = 'fabric:receipt-signing-key';
+/** The exact bytes the signature covers — a stable field order (the signer + verifier MUST agree). */
+function digestOf(r) {
+    const canonical = JSON.stringify({
+        version: 'ap.delivery-receipt.v1',
+        exchangeId: r.exchangeId,
+        messageId: r.messageId,
+        recipient: r.recipient.toLowerCase(),
+        at: r.at,
+    });
+    return sha256(new TextEncoder().encode(canonical));
+}
+function genSecretKey() {
+    for (let i = 0; i < 8; i += 1) {
+        const k = globalThis.crypto.getRandomValues(new Uint8Array(32));
+        if (secp256k1.utils.isValidSecretKey(k))
+            return k;
+    }
+    throw new Error('receipt-signer: could not generate a valid secp256k1 secret key');
+}
+export function createDurableObjectReceiptSigner(storage) {
+    let priv = null;
+    let pub = null;
+    async function key() {
+        if (priv && pub)
+            return { priv, pub };
+        const stored = await storage.get(STORAGE_KEY);
+        priv = stored ? hexToBytes(stored) : genSecretKey();
+        if (!stored)
+            await storage.put(STORAGE_KEY, bytesToHex(priv));
+        pub = bytesToHex(secp256k1.getPublicKey(priv, false));
+        return { priv, pub };
+    }
+    return {
+        async pubkey() {
+            return (await key()).pub;
+        },
+        async sign(input) {
+            const k = await key();
+            const sig = secp256k1.sign(digestOf(input), k.priv, { lowS: true, prehash: false, format: 'compact' });
+            return { version: 'ap.delivery-receipt.v1', ...input, signerPubkey: k.pub, signature: bytesToHex(sig) };
+        },
+    };
+}
+/** Verify a signed delivery receipt against its embedded signer pubkey. Fail-closed on any error. */
+export function verifyDeliveryReceipt(receipt) {
+    try {
+        return secp256k1.verify(hexToBytes(receipt.signature), digestOf(receipt), hexToBytes(receipt.signerPubkey), {
+            format: 'compact',
+            prehash: false,
+        });
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=receipt-signer.js.map

package/dist/cloudflare/receipt-signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt-signer.js","sourceRoot":"","sources":["../../src/cloudflare/receipt-signer.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,4EAA4E;AAC5E,EAAE;AACF,0GAA0G;AAC1G,8GAA8G;AAC9G,0GAA0G;AAC1G,8GAA8G;AAC9G,iGAAiG;AACjG,8DAA8D;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAoBhE,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAEjD,sGAAsG;AACtG,SAAS,QAAQ,CAAC,CAAuB;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,OAAO,EAAE,wBAAwB;QACjC,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;QACpC,EAAE,EAAE,CAAC,CAAC,EAAE;KACT,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,YAAY;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,IAAI,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;AACrF,CAAC;AASD,MAAM,UAAU,gCAAgC,CAAC,OAA6B;IAC5E,IAAI,IAAI,GAAsB,IAAI,CAAC;IACnC,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,KAAK,UAAU,GAAG;QAChB,IAAI,IAAI,IAAI,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAS,WAAW,CAAC,CAAC;QACtD,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;QACpD,IAAI,CAAC,MAAM;YAAE,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACtD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACvB,CAAC;IACD,OAAO;QACL,KAAK,CAAC,MAAM;YACV,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,MAAM,CAAC,GAAG,MAAM,GAAG,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACvG,OAAO,EAAE,OAAO,EAAE,wBAAwB,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1G,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,qBAAqB,CAAC,OAAgC;IACpE,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;YAC1G,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/cloudflare/request-id-ledger.d.ts

@@ -0,0 +1,13 @@
+export interface RequestIdReservation {
+    /** Mark the request permanently consumed (the row already exists from reserve — this is a no-op marker). */
+    commit(): Promise<void>;
+    /** Release the reservation so a legitimate retry of the SAME requestId may re-reserve. */
+    release(): Promise<void>;
+}
+export interface RequestIdLedger {
+    /** Reserve `requestId` one-shot. Returns a reservation, or `null` if the id is already present (replay ⇒
+     *  the caller denies). `now` is the caller-supplied timestamp (DOs have no ambient wall-clock in tests). */
+    reserve(requestId: string, now: string): Promise<RequestIdReservation | null>;
+}
+export declare function createDurableObjectRequestIdLedger(sql: SqlStorage): RequestIdLedger;
+//# sourceMappingURL=request-id-ledger.d.ts.map

package/dist/cloudflare/request-id-ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-id-ledger.d.ts","sourceRoot":"","sources":["../../src/cloudflare/request-id-ledger.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,oBAAoB;IACnC,4GAA4G;IAC5G,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,0FAA0F;IAC1F,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B;gHAC4G;IAC5G,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CAC/E;AAED,wBAAgB,kCAAkC,CAAC,GAAG,EAAE,UAAU,GAAG,eAAe,CAmBnF"}

package/dist/cloudflare/request-id-ledger.js

@@ -0,0 +1,38 @@
+/// <reference types="@cloudflare/workers-types" />
+// RequestIdLedger (spec 316 §3a — the T1 single-use replay guard, L2).
+//
+// Every T1 invoke binds its evaluated `argsHash` into a single-use `requestId` (the caller computes
+// `requestId = H(sessionKey, delegationHash, toolSelector, argsHash, …)`); this ledger makes that id
+// one-shot so a replayed (or concurrent-duplicate) invoke is denied. Two-phase (mirrors the a2a
+// `reserveMessageId`, spec 290 §3): the row's PRESENCE is the durable guard — present ⇒ in-flight OR
+// consumed ⇒ replay ⇒ deny. `reserve` writes it (in-flight); `commit` leaves it (permanently consumed);
+// `release` deletes it so a legitimate retry of the SAME request may re-reserve. A crash between reserve and
+// commit/release leaves the row present ⇒ that exact id can't retry (fail-closed; the caller mints a fresh
+// requestId), the safe posture. Single-writer in the DO ⇒ the check-then-write is atomic (no CAS needed).
+//
+// Stored on the DO's `state.storage.sql` (co-located, one trust domain).
+const CREATE_TABLE = `CREATE TABLE IF NOT EXISTS request_ids (
+  request_id TEXT PRIMARY KEY,
+  at         TEXT NOT NULL
+)`;
+export function createDurableObjectRequestIdLedger(sql) {
+    sql.exec(CREATE_TABLE);
+    return {
+        async reserve(requestId, now) {
+            const id = requestId.toLowerCase();
+            const existing = sql.exec('SELECT request_id FROM request_ids WHERE request_id = ?', id).toArray();
+            if (existing.length > 0)
+                return null; // present ⇒ in-flight or consumed ⇒ replay
+            sql.exec('INSERT INTO request_ids (request_id, at) VALUES (?, ?)', id, now);
+            return {
+                async commit() {
+                    /* the row was written on reserve — the id stays consumed */
+                },
+                async release() {
+                    sql.exec('DELETE FROM request_ids WHERE request_id = ?', id);
+                },
+            };
+        },
+    };
+}
+//# sourceMappingURL=request-id-ledger.js.map

package/dist/cloudflare/request-id-ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-id-ledger.js","sourceRoot":"","sources":["../../src/cloudflare/request-id-ledger.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,uEAAuE;AACvE,EAAE;AACF,oGAAoG;AACpG,qGAAqG;AACrG,gGAAgG;AAChG,qGAAqG;AACrG,wGAAwG;AACxG,6GAA6G;AAC7G,2GAA2G;AAC3G,0GAA0G;AAC1G,EAAE;AACF,yEAAyE;AAEzE,MAAM,YAAY,GAAG;;;EAGnB,CAAC;AAoBH,MAAM,UAAU,kCAAkC,CAAC,GAAe;IAChE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEvB,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG;YAC1B,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAe,yDAAyD,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACjH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;YACjF,GAAG,CAAC,IAAI,CAAC,wDAAwD,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAC5E,OAAO;gBACL,KAAK,CAAC,MAAM;oBACV,4DAA4D;gBAC9D,CAAC;gBACD,KAAK,CAAC,OAAO;oBACX,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE,EAAE,CAAC,CAAC;gBAC/D,CAAC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cloudflare/sql-vault.d.ts

@@ -0,0 +1,10 @@
+import type { Vault, DekWrapper } from '@agenticprimitives/vault';
+/**
+ * Build a `Vault` over a Durable Object's `SqlStorage`, sealing/opening under the injected per-owner
+ * `DekWrapper` (the owner's KEK). Schema is created idempotently on construction. `data: null` on write
+ * tombstones (soft-delete); reads and lists skip tombstones. `owner` is lower-cased for case-insensitive
+ * keying (mirrors the D1 adapter + the in-memory reference). Generic: it stores arbitrary `resource`
+ * records (e.g. `message.body:<id>`) — no demo-mcp PII/profile seeding (that stays app-side).
+ */
+export declare function createDurableObjectSqlVault(sql: SqlStorage, wrapper: DekWrapper): Vault;
+//# sourceMappingURL=sql-vault.d.ts.map

package/dist/cloudflare/sql-vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-vault.d.ts","sourceRoot":"","sources":["../../src/cloudflare/sql-vault.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,KAAK,EAML,UAAU,EACX,MAAM,0BAA0B,CAAC;AA4ClC;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,KAAK,CAiFvF"}

package/dist/cloudflare/sql-vault.js

@@ -0,0 +1,98 @@
+import { sealEnvelope, openEnvelope, projectFields } from '@agenticprimitives/vault';
+// One statement per `exec` (DO SQLite runs a single statement per call).
+const CREATE_TABLE = `CREATE TABLE IF NOT EXISTS vault_objects (
+  owner_address   TEXT NOT NULL,
+  resource        TEXT NOT NULL,
+  classification  TEXT NOT NULL,
+  ciphertext_b64  TEXT NOT NULL,
+  wrapped_dek_b64 TEXT NOT NULL,
+  crypto_meta     TEXT NOT NULL,
+  created_at      TEXT NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+  updated_at      TEXT NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+  deleted_at      TEXT,
+  PRIMARY KEY (owner_address, resource)
+)`;
+const CREATE_INDEX = `CREATE INDEX IF NOT EXISTS idx_vault_objects_owner ON vault_objects (owner_address) WHERE deleted_at IS NULL`;
+function b64encode(bytes) {
+    let s = '';
+    for (let i = 0; i < bytes.length; i += 1)
+        s += String.fromCharCode(bytes[i]);
+    return btoa(s);
+}
+function b64decode(s) {
+    const bin = atob(s);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i += 1)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+const DEFAULT_CLASSIFICATION = 'internal';
+/**
+ * Build a `Vault` over a Durable Object's `SqlStorage`, sealing/opening under the injected per-owner
+ * `DekWrapper` (the owner's KEK). Schema is created idempotently on construction. `data: null` on write
+ * tombstones (soft-delete); reads and lists skip tombstones. `owner` is lower-cased for case-insensitive
+ * keying (mirrors the D1 adapter + the in-memory reference). Generic: it stores arbitrary `resource`
+ * records (e.g. `message.body:<id>`) — no demo-mcp PII/profile seeding (that stays app-side).
+ */
+export function createDurableObjectSqlVault(sql, wrapper) {
+    sql.exec(CREATE_TABLE);
+    sql.exec(CREATE_INDEX);
+    return {
+        async read(req) {
+            const owner = req.owner.toLowerCase();
+            const rows = sql
+                .exec('SELECT * FROM vault_objects WHERE owner_address = ? AND resource = ? AND deleted_at IS NULL', owner, req.resource)
+                .toArray();
+            const row = rows[0];
+            if (!row)
+                return null;
+            const data = await openEnvelope({
+                envelope: {
+                    owner: row.owner_address,
+                    resource: row.resource,
+                    classification: row.classification,
+                    crypto: JSON.parse(row.crypto_meta),
+                },
+                ciphertext: b64decode(row.ciphertext_b64),
+                wrappedDek: b64decode(row.wrapped_dek_b64),
+                wrapper,
+            });
+            return {
+                owner: row.owner_address,
+                resource: row.resource,
+                classification: row.classification,
+                data: projectFields(data, req.fields),
+                updatedAt: row.updated_at,
+            };
+        },
+        async write(req) {
+            const owner = req.owner.toLowerCase();
+            if (req.data === null) {
+                sql.exec('UPDATE vault_objects SET deleted_at = CURRENT_TIMESTAMP, updated_at = CURRENT_TIMESTAMP WHERE owner_address = ? AND resource = ?', owner, req.resource);
+                return;
+            }
+            const classification = req.classification ?? DEFAULT_CLASSIFICATION;
+            const sealed = await sealEnvelope({ owner, resource: req.resource, classification, data: req.data, wrapper });
+            sql.exec(`INSERT INTO vault_objects (owner_address, resource, classification, ciphertext_b64, wrapped_dek_b64, crypto_meta)
+         VALUES (?, ?, ?, ?, ?, ?)
+         ON CONFLICT(owner_address, resource) DO UPDATE SET
+           classification = excluded.classification,
+           ciphertext_b64 = excluded.ciphertext_b64,
+           wrapped_dek_b64 = excluded.wrapped_dek_b64,
+           crypto_meta = excluded.crypto_meta,
+           updated_at = CURRENT_TIMESTAMP,
+           deleted_at = NULL`, owner, req.resource, classification, b64encode(sealed.ciphertext), b64encode(sealed.wrappedDek), JSON.stringify(sealed.envelope.crypto));
+        },
+        async list(owner) {
+            const rows = sql
+                .exec('SELECT resource, classification, updated_at FROM vault_objects WHERE owner_address = ? AND deleted_at IS NULL ORDER BY resource', owner.toLowerCase())
+                .toArray();
+            return rows.map((r) => ({
+                resource: r.resource,
+                classification: r.classification,
+                updatedAt: r.updated_at,
+            }));
+        },
+    };
+}
+//# sourceMappingURL=sql-vault.js.map

package/dist/cloudflare/sql-vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-vault.js","sourceRoot":"","sources":["../../src/cloudflare/sql-vault.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAErF,yEAAyE;AACzE,MAAM,YAAY,GAAG;;;;;;;;;;;EAWnB,CAAC;AACH,MAAM,YAAY,GAAG,8GAA8G,CAAC;AAcpI,SAAS,SAAS,CAAC,KAAiB;IAClC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AACD,SAAS,SAAS,CAAC,CAAS;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,sBAAsB,GAAwB,UAAU,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAe,EAAE,OAAmB;IAC9E,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvB,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEvB,OAAO;QACL,KAAK,CAAC,IAAI,CAAc,GAAqB;YAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG;iBACb,IAAI,CACH,6FAA6F,EAC7F,KAAK,EACL,GAAG,CAAC,QAAQ,CACb;iBACA,OAAO,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAI;gBACjC,QAAQ,EAAE;oBACR,KAAK,EAAE,GAAG,CAAC,aAAa;oBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,cAAc,EAAE,GAAG,CAAC,cAAqC;oBACzD,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;iBACpC;gBACD,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC;gBACzC,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC;gBAC1C,OAAO;aACR,CAAC,CAAC;YACH,OAAO;gBACL,KAAK,EAAE,GAAG,CAAC,aAAa;gBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,cAAc,EAAE,GAAG,CAAC,cAAqC;gBACzD,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAM;gBAC1C,SAAS,EAAE,GAAG,CAAC,UAAU;aAC1B,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,KAAK,CAAc,GAAyB;YAChD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACtB,GAAG,CAAC,IAAI,CACN,kIAAkI,EAClI,KAAK,EACL,GAAG,CAAC,QAAQ,CACb,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,cAAc,GAAG,GAAG,CAAC,cAAc,IAAI,sBAAsB,CAAC;YACpE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9G,GAAG,CAAC,IAAI,CACN;;;;;;;;6BAQqB,EACrB,KAAK,EACL,GAAG,CAAC,QAAQ,EACZ,cAAc,EACd,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAC5B,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAC5B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CACvC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,KAAa;YACtB,MAAM,IAAI,GAAG,GAAG;iBACb,IAAI,CACH,iIAAiI,EACjI,KAAK,CAAC,WAAW,EAAE,CACpB;iBACA,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,cAAc,EAAE,CAAC,CAAC,cAAqC;gBACvD,SAAS,EAAE,CAAC,CAAC,UAAU;aACxB,CAAC,CAAC,CAAC;QACN,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/communicative-act.d.ts

@@ -0,0 +1,47 @@
+import type { CanonicalAgentId } from '@agenticprimitives/types';
+import type { Hex32, MessageId, MessageKind } from './messaging/index.js';
+import type { VaultRef } from '@agenticprimitives/vault';
+export type Performative = 'INFORM' | 'QUERY' | 'REQUEST' | 'PROPOSE' | 'COUNTER' | 'ACCEPT' | 'REJECT' | 'NOTIFY' | 'ACKNOWLEDGE' | 'ISSUE' | 'RETRACT' | 'SUBSCRIBE' | 'UNSUBSCRIBE';
+/** A by-reference pointer at a piece of semantic content an act expresses or carries — a Situation, a
+ *  credential, a delegation hash, an intent, an outcome. Display/provenance metadata, NEVER inline authority. */
+export interface SemanticContentRef {
+    /** App/ontology kind, e.g. 'situation' | 'credential' | 'delegation' | 'intent' | 'outcome'. */
+    kind: string;
+    /** Stable id: a Situation id, CAIP-10, delegation hash, URI, content hash. */
+    id: string;
+    /** Optional content binding (situation hash, credential digest, delegation hash). */
+    hash?: Hex32;
+}
+/** A by-reference pointer at evidence backing an act (a vault-resident artifact, a receipt). */
+export interface EvidenceRef {
+    ref: VaultRef;
+    hash?: Hex32;
+    contentType?: string;
+}
+/**
+ * A semantic act performed within an exchange (spec 324 §9). Body-adjacent in V1 (travels alongside the
+ * envelope, not inside the signed wire); native on `ap.exchange.v2`.
+ */
+export interface CommunicativeActV1 {
+    version: 'ap.act.v1';
+    performative: Performative;
+    /** Who performed the act. */
+    actor: CanonicalAgentId;
+    /** On whose behalf (== actor unless delegated; the authorizing delegation lives in the record's authorityRefs). */
+    principal: CanonicalAgentId;
+    addressedTo: CanonicalAgentId[];
+    /** Zero, one, or many intents this act expresses. */
+    expressesIntentRefs?: SemanticContentRef[];
+    /** Situations, credentials, delegation hashes, outcomes this act carries or references. */
+    semanticContentRefs?: SemanticContentRef[];
+    evidenceRefs?: EvidenceRef[];
+    /** The message this act responds to, if any. */
+    inRespondsTo?: MessageId;
+}
+/**
+ * The TOTAL `MessageKind` → `Performative` derivation for V1 envelopes (spec 324 §9). Exhaustive: every
+ * `MessageKind` maps. A `response` refines to the act's performative when it is one of the response family
+ * (`INFORM`/`ACCEPT`/`REJECT`/`COUNTER`), defaulting to `INFORM`.
+ */
+export declare function performativeForKind(kind: MessageKind, act?: CommunicativeActV1): Performative;
+//# sourceMappingURL=communicative-act.d.ts.map

package/dist/communicative-act.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"communicative-act.d.ts","sourceRoot":"","sources":["../src/communicative-act.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEzD,MAAM,MAAM,YAAY,GACpB,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAC5E,QAAQ,GAAG,aAAa,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAC;AAEjF;iHACiH;AACjH,MAAM,WAAW,kBAAkB;IACjC,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,EAAE,EAAE,MAAM,CAAC;IACX,qFAAqF;IACrF,IAAI,CAAC,EAAE,KAAK,CAAC;CACd;AAED,gGAAgG;AAChG,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,QAAQ,CAAC;IACd,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,WAAW,CAAC;IACrB,YAAY,EAAE,YAAY,CAAC;IAC3B,6BAA6B;IAC7B,KAAK,EAAE,gBAAgB,CAAC;IACxB,mHAAmH;IACnH,SAAS,EAAE,gBAAgB,CAAC;IAC5B,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,qDAAqD;IACrD,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC3C,2FAA2F;IAC3F,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC3C,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,gDAAgD;IAChD,YAAY,CAAC,EAAE,SAAS,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,kBAAkB,GAAG,YAAY,CAmB7F"}

package/dist/communicative-act.js

@@ -0,0 +1,36 @@
+// Fabric semantic acts — spec 324 W5 (§9). A `CommunicativeActV1` names WHAT an exchange move DOES
+// (inform / request / propose / accept / …) as an explicit speech act, distinct from the transport envelope
+// that carries it. It NEVER grants authority: a message may ISSUE or reference a Delegation, but verification
+// always re-evaluates the signed wire + caveats + session binding + revocation (ADR-0041/ADR-0047). The act
+// carries `actor` (who performed it) AND `principal` (on whose behalf) — a service agent acting for an org is
+// never erased from provenance and never pretends to BE the org.
+//
+// V1 envelopes carry no native performative, so for legacy/communication envelopes the performative is DERIVED
+// from `MessageKind` via one TOTAL mapping (`performativeForKind`, golden-vectored). A future `ap.exchange.v2`
+// envelope carries `performative`/`actor`/`principal` natively.
+/**
+ * The TOTAL `MessageKind` → `Performative` derivation for V1 envelopes (spec 324 §9). Exhaustive: every
+ * `MessageKind` maps. A `response` refines to the act's performative when it is one of the response family
+ * (`INFORM`/`ACCEPT`/`REJECT`/`COUNTER`), defaulting to `INFORM`.
+ */
+export function performativeForKind(kind, act) {
+    switch (kind) {
+        case 'plain':
+            return 'INFORM';
+        case 'request':
+            return 'REQUEST';
+        case 'response': {
+            const p = act?.performative;
+            return p === 'ACCEPT' || p === 'REJECT' || p === 'COUNTER' || p === 'INFORM' ? p : 'INFORM';
+        }
+        case 'credential-delivery':
+            return 'ISSUE';
+        case 'receipt':
+            return 'ACKNOWLEDGE';
+        case 'system':
+            return 'NOTIFY';
+        case 'tombstone':
+            return 'RETRACT';
+    }
+}
+//# sourceMappingURL=communicative-act.js.map

package/dist/communicative-act.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"communicative-act.js","sourceRoot":"","sources":["../src/communicative-act.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,4GAA4G;AAC5G,8GAA8G;AAC9G,4GAA4G;AAC5G,8GAA8G;AAC9G,iEAAiE;AACjE,EAAE;AACF,+GAA+G;AAC/G,+GAA+G;AAC/G,gEAAgE;AAiDhE;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAiB,EAAE,GAAwB;IAC7E,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO,QAAQ,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,CAAC,GAAG,GAAG,EAAE,YAAY,CAAC;YAC5B,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9F,CAAC;QACD,KAAK,qBAAqB;YACxB,OAAO,OAAO,CAAC;QACjB,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC;QACvB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,WAAW;YACd,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/delivery-envelope.d.ts

@@ -0,0 +1,38 @@
+import type { CanonicalAgentId } from '@agenticprimitives/types';
+import type { AuthorityTier } from '@agenticprimitives/tool-policy';
+import type { IntentEnvelopeV1, ExchangeRecordV1, ExchangeId } from './exchange-record.js';
+export interface DeliveryEnvelopeV1 {
+    version: 'ap.delivery-envelope.v1';
+    exchangeId: ExchangeId | string;
+    /** The signed message envelope being delivered — carries its own sender-proof + `bodyHash`. */
+    envelope: IntentEnvelopeV1;
+    /** Routing: the sending + receiving gateway principals (advisory; authority rides `envelope.signature`). */
+    fromGateway: CanonicalAgentId;
+    toGateway: CanonicalAgentId;
+    at: string;
+    /** Transport-level replay-dedup nonce (also the OutboxStore key). */
+    nonce: string;
+}
+export declare function buildDeliveryEnvelope(input: Omit<DeliveryEnvelopeV1, 'version'>): DeliveryEnvelopeV1;
+export type DeliveryAdmission = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * TRANSPORT-level admission of a peer delivery at the recipient gateway (fail-closed): correct version, routed
+ * to THIS gateway, the envelope addressed to it, and structurally sound (`id` + `bodyHash`). It does NOT verify
+ * the sender's on-chain authority — that is the gateway's separate re-verification (ADR-0041). `recipient` is
+ * this gateway's principal.
+ */
+export declare function admitDeliveryEnvelope(delivery: DeliveryEnvelopeV1, opts: {
+    recipient: CanonicalAgentId;
+}): DeliveryAdmission;
+/** Build the initial T0 `ExchangeRecordV1` the recipient gateway persists for an admitted delivery. The DO
+ *  then applies the `delivered` message event + signs a receipt. */
+export declare function deliveryToExchangeRecord(delivery: DeliveryEnvelopeV1, opts: {
+    tier: AuthorityTier;
+    at: string;
+}): ExchangeRecordV1;
+//# sourceMappingURL=delivery-envelope.d.ts.map

package/dist/delivery-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-envelope.d.ts","sourceRoot":"","sources":["../src/delivery-envelope.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAE3F,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,yBAAyB,CAAC;IACnC,UAAU,EAAE,UAAU,GAAG,MAAM,CAAC;IAChC,+FAA+F;IAC/F,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,4GAA4G;IAC5G,WAAW,EAAE,gBAAgB,CAAC;IAC9B,SAAS,EAAE,gBAAgB,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,GAAG,kBAAkB,CAGpG;AAED,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE;IAAE,SAAS,EAAE,gBAAgB,CAAA;CAAE,GACpC,iBAAiB,CAQnB;AAED;oEACoE;AACpE,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACxC,gBAAgB,CAelB"}

package/dist/delivery-envelope.js

@@ -0,0 +1,43 @@
+export function buildDeliveryEnvelope(input) {
+    if (!input.exchangeId || !input.nonce)
+        throw new Error('buildDeliveryEnvelope: exchangeId + nonce required');
+    return { version: 'ap.delivery-envelope.v1', ...input };
+}
+/**
+ * TRANSPORT-level admission of a peer delivery at the recipient gateway (fail-closed): correct version, routed
+ * to THIS gateway, the envelope addressed to it, and structurally sound (`id` + `bodyHash`). It does NOT verify
+ * the sender's on-chain authority — that is the gateway's separate re-verification (ADR-0041). `recipient` is
+ * this gateway's principal.
+ */
+export function admitDeliveryEnvelope(delivery, opts) {
+    if (delivery.version !== 'ap.delivery-envelope.v1')
+        return { ok: false, reason: 'bad_version' };
+    const recip = opts.recipient.toLowerCase();
+    if (delivery.toGateway.toLowerCase() !== recip)
+        return { ok: false, reason: 'wrong_gateway' };
+    const e = delivery.envelope;
+    if (!e || !e.id || !e.bodyHash)
+        return { ok: false, reason: 'malformed_envelope' };
+    if (!e.to.some((t) => t.toLowerCase() === recip))
+        return { ok: false, reason: 'not_addressed' };
+    return { ok: true };
+}
+/** Build the initial T0 `ExchangeRecordV1` the recipient gateway persists for an admitted delivery. The DO
+ *  then applies the `delivered` message event + signs a receipt. */
+export function deliveryToExchangeRecord(delivery, opts) {
+    const e = delivery.envelope;
+    return {
+        version: 'ap.exchange.v1',
+        exchangeId: delivery.exchangeId,
+        kind: e.kind,
+        tier: opts.tier,
+        principal: delivery.toGateway,
+        parties: { from: e.from, to: e.to },
+        exec: 'submitted',
+        envelopes: [e],
+        events: [],
+        rev: 0,
+        updatedAt: opts.at,
+    };
+}
+//# sourceMappingURL=delivery-envelope.js.map

package/dist/delivery-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-envelope.js","sourceRoot":"","sources":["../src/delivery-envelope.ts"],"names":[],"mappings":"AA0BA,MAAM,UAAU,qBAAqB,CAAC,KAA0C;IAC9E,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAC7G,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,GAAG,KAAK,EAAE,CAAC;AAC1D,CAAC;AAID;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,IAAqC;IAErC,IAAI,QAAQ,CAAC,OAAO,KAAK,yBAAyB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAChG,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC9F,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACnF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;oEACoE;AACpE,MAAM,UAAU,wBAAwB,CACtC,QAA4B,EAC5B,IAAyC;IAEzC,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC5B,OAAO;QACL,OAAO,EAAE,gBAAgB;QACzB,UAAU,EAAE,QAAQ,CAAC,UAAwB;QAC7C,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE;QACnC,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,EAAE;QACV,GAAG,EAAE,CAAC;QACN,SAAS,EAAE,IAAI,CAAC,EAAE;KACnB,CAAC;AACJ,CAAC"}