@agenticprimitives/runtime-member 0.0.0-alpha.10

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Agentic Trust Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,40 @@
+# @agenticprimitives/runtime-member
+
+> Part of **[Agentic Primitives](https://agenticprimitives.dev)** — the open-source trust substrate for agentic applications: identity that can sign, authority checked at act time, evidence the owner carries. [Developer kit](https://github.com/agentictrustlabs/agentic-primitives) · [All packages](https://agenticprimitives.dev/developers)
+
+Admit an existing runtime — Claude Code, goose, Codex, anything that speaks the Agent Client Protocol — as a **member
+of a workspace**, without a rewrite, with the workspace deciding what it may do at every act. Admission, not "add
+coding": what the runtime is for is its own business; what it may do here is the member's grant.
+
+```bash
+# 1. the steward charters goose-1.svc through the Home and invites it to the organization (a member like any other)
+# 2. on the machine that runs goose:
+ap runtime join --member goose-1.svc --workspace missio-nexus.org \
+  --home <home> --edge <edge> --a2a <runtime> --chain faithchain --handle alice --registry <skills registry>
+ap runtime run  --member goose-1.svc --agent "goose acp"
+```
+
+`join` generates the runtime's own key here, has the member's custodian sign a **session wire** (member → key, pinned to
+`harness.ask`, time-bounded, revocable on chain), records the steward link and assigns the `runtime-member` playbook.
+`run` polls the member's own inbox, hands each new message to the agent as an ACP prompt with the workspace context, and
+sends the answer back as the runtime — an act that **parks for the steward's signature**, which the loop reports. The
+agent reaches the workspace through the `workspace` MCP server (`ap runtime mcp`): `workspace_ask`, `workspace_reply`,
+`workspace_inbox`, `workspace_status` — each a wire-signed A2A request as the runtime itself.
+
+**Hosted next to the Worker (W1c).** The same loop, woken instead of clocked: `ap runtime serve` listens for
+`POST /wake` from the workspace's queue consumer and runs one pass per wake. Declare where the runtime lives at join
+(`--wake container`, or `--wake https://…` for a host of your own; `ap runtime host … none` to go back to polling),
+then hand the Container the record without its key (`ap runtime export` → `AP_RUNTIME_RECORD`) and the wire's key
+(`AP_RUNTIME_KEY`) as secrets. A wake carries the member, the thread and a message id — no content, no authority; the
+runtime reads under its own wire. Compromise the Container and you hold a revocable wire, not the agent.
+
+**The open mandate (W2a).** Every write parks — the reply included — unless the steward decides once:
+`ap runtime grant --member goose-2.svc --handle alice --to alice.me messaging.direct.send` signs a **standing grant**
+(member → the runtime's key, one capability, named recipients, 30 days, no intent binding). When a reply then parks,
+the loop derives the child for that very intent, signs it with its own key, and continues the run presenting
+`[child, standing]`; the harness verifies the chain and the message leaves on the member's own rail
+(`ap runtime messaging --to …` enables it). A commit, an allocation, a payment still park; revoke the grant on chain
+and the next derivation is refused. Nothing of anyone else's is ever held.
+
+What never happens here: the runtime holds a person's session; a parked act is retried; a permission prompt about the
+agent's own shell authorizes anything in the workspace.

package/bin/ap-runtime.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+// ap-runtime — an outside runtime as a workspace member (spec 400 W1): join · run · mcp · status.
+import { runtimeCli } from '../dist/index.js';
+process.exitCode = await runtimeCli(process.argv.slice(2)).catch((e) => { process.stderr.write(`✗ ${e instanceof Error ? e.message : String(e)}\n`); return 1; });

package/dist/cli.d.ts

@@ -0,0 +1,8 @@
+export declare const RUNTIME_USAGE = "ap runtime pair <code> --home <url> [--wake container|<url>|none] [--agent <acp agent>]   (the code the custodian minted at the Home \u2014 no session, no keys)\nap runtime join --member <label>.svc --workspace <label>.org --home <url> --edge <url> --a2a <url> --chain faithchain --handle <demo persona> --registry <skills registry url> [--days 30] [--wake container|<url>] [--messaging-to alice.me,bob.me] [--open-mandate messaging.direct.send]\nap runtime messaging --member <label>.svc --handle <demo persona> [--home <url>] --to alice.me,bob.me   (the member's messaging RAIL: whom it may deliver to; widens, never narrows)\nap runtime grant --member <label>.svc --handle <demo persona> [--home <url>] [--days 30] [--to alice.me,bob.me] <capability\u2026>   (the OPEN MANDATE: a standing grant the custodian signs once; replies stop parking; --to bounds the recipients, default anyone)\nap runtime run  --member <label>.svc --agent \"<command \u2026>\" [--poll 15] [--turns N] [--since <cursor>] [--allow-local]\nap runtime serve --member <label>.svc --agent \"<command \u2026>\" [--port 8080] [--fallback-poll <seconds>] [--allow-local]   (W1c: woken by the Worker; a Container's entrypoint)\nap runtime host --member <label>.svc --home <url> --handle <demo persona> (container|<url>|none)   (declare where the Worker wakes this member)\nap runtime playbook --member <label>.svc --handle <demo persona> [--registry <url>] [--archetype runtime-member]   (re-pin the playbook to the registry's current definition)\nap runtime mcp  --member <label>.svc          (the workspace MCP server the ACP agent spawns; stdio)\nap runtime status --member <label>.svc\nap runtime export --member <label>.svc        (the record WITHOUT its key, for a Container's AP_RUNTIME_RECORD; the key goes to AP_RUNTIME_KEY)";
+export declare function personaCustodian(home: string, handle: string): Promise<{
+    bearer: string;
+    agent: `0x${string}`;
+    signDigest: (d: `0x${string}`) => Promise<`0x${string}`>;
+}>;
+export declare function runtimeCli(argv: string[]): Promise<number>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,aAAa,gxDAUsH,CAAC;AAsBjJ,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,CAAC,CAAC,EAAE,KAAK,MAAM,EAAE,KAAK,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAA;CAAE,CAAC,CAahL;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAqHhE"}

package/dist/cli.js

@@ -0,0 +1,201 @@
+// `ap runtime <join|run|mcp|status>` — the commands the devkit dispatches here (spec 400 §5.2). W1a signs the wire with
+// a demo persona's custody signer at the Home (`--handle`); the pairing-code path (W1b) replaces that one function.
+import { runtimeJoin, declareRuntimeHost, assignPlaybook, recordStandingGrant } from './join.js';
+import { runtimePair } from './pair.js';
+import { runRuntimeMember } from './run.js';
+import { serveRuntimeMember } from './serve.js';
+import { runWorkspaceMcpStdio } from './workspace-mcp.js';
+import { loadRuntimeMember, portableRecord, runtimePath, saveRuntimeMember } from './keystore.js';
+import { buildStandingGrant } from './standing.js';
+import { standingEnforcers } from './join.js';
+import { enableMessaging } from './messaging.js';
+const flag = (argv, name) => { const i = argv.indexOf(`--${name}`); return i >= 0 ? argv[i + 1] : undefined; };
+const need = (argv, name) => { const v = flag(argv, name); if (!v)
+    throw new Error(`--${name} is required`); return v; };
+export const RUNTIME_USAGE = `ap runtime pair <code> --home <url> [--wake container|<url>|none] [--agent <acp agent>]   (the code the custodian minted at the Home — no session, no keys)
+ap runtime join --member <label>.svc --workspace <label>.org --home <url> --edge <url> --a2a <url> --chain faithchain --handle <demo persona> --registry <skills registry url> [--days 30] [--wake container|<url>] [--messaging-to alice.me,bob.me] [--open-mandate messaging.direct.send]
+ap runtime messaging --member <label>.svc --handle <demo persona> [--home <url>] --to alice.me,bob.me   (the member's messaging RAIL: whom it may deliver to; widens, never narrows)
+ap runtime grant --member <label>.svc --handle <demo persona> [--home <url>] [--days 30] [--to alice.me,bob.me] <capability…>   (the OPEN MANDATE: a standing grant the custodian signs once; replies stop parking; --to bounds the recipients, default anyone)
+ap runtime run  --member <label>.svc --agent "<command …>" [--poll 15] [--turns N] [--since <cursor>] [--allow-local]
+ap runtime serve --member <label>.svc --agent "<command …>" [--port 8080] [--fallback-poll <seconds>] [--allow-local]   (W1c: woken by the Worker; a Container's entrypoint)
+ap runtime host --member <label>.svc --home <url> --handle <demo persona> (container|<url>|none)   (declare where the Worker wakes this member)
+ap runtime playbook --member <label>.svc --handle <demo persona> [--registry <url>] [--archetype runtime-member]   (re-pin the playbook to the registry's current definition)
+ap runtime mcp  --member <label>.svc          (the workspace MCP server the ACP agent spawns; stdio)
+ap runtime status --member <label>.svc
+ap runtime export --member <label>.svc        (the record WITHOUT its key, for a Container's AP_RUNTIME_RECORD; the key goes to AP_RUNTIME_KEY)`;
+/** Names or addresses, comma-separated → addresses, each resolved at the Home (a name that does not resolve is an error, never skipped). */
+async function resolveNames(home, list) {
+    const out = [];
+    for (const n of list.split(',').map((x) => x.trim()).filter(Boolean)) {
+        if (/^0x[0-9a-fA-F]{40}$/.test(n)) {
+            out.push(n.toLowerCase());
+            continue;
+        }
+        const r = await (await fetch(`${home}/connect/name-info?name=${encodeURIComponent(n)}`)).json().catch(() => ({}));
+        if (!r.exists || !r.agent)
+            throw new Error(`${n} does not resolve at ${home}`);
+        out.push(String(r.agent).toLowerCase());
+    }
+    return out;
+}
+const wakeOf = (v) => {
+    if (v === undefined)
+        return undefined;
+    if (v === 'none')
+        return null;
+    if (v === 'container')
+        return { v: 1, kind: 'container' };
+    if (/^https?:\/\//.test(v))
+        return { v: 1, kind: 'url', url: v.replace(/\/$/, '') };
+    throw new Error(`--wake must be "container", a URL, or "none" (got ${v})`);
+};
+const allowLocalPolicy = (rest) => rest.includes('--allow-local') ? { permission: (req) => ({ outcome: { outcome: 'selected', optionId: (req.options.find((x) => x.kind === 'allow_once') ?? req.options[0]).optionId } }) } : {};
+export async function personaCustodian(home, handle) {
+    const j = async (r) => { const t = await r.text(); try {
+        return JSON.parse(t);
+    }
+    catch {
+        return { _raw: t.slice(0, 200) };
+    } };
+    const si = await j(await fetch(`${home}/connect/demo-signin`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ handle, client_id: 'demo-web' }) }));
+    if (!si.homeSession)
+        throw new Error(`${handle} could not sign in at ${home}: ${JSON.stringify(si).slice(0, 160)}`);
+    const bearer = String(si.homeSession);
+    return {
+        bearer, agent: String(si.agent).toLowerCase(),
+        signDigest: async (digest) => {
+            const b = await j(await fetch(`${home}/connect/persona-sign`, { method: 'POST', headers: { 'content-type': 'application/json', authorization: `Bearer ${bearer}` }, body: JSON.stringify({ digest }) }));
+            if (!b.signature)
+                throw new Error(`persona-sign refused: ${JSON.stringify(b).slice(0, 160)}`);
+            return b.signature;
+        },
+    };
+}
+export async function runtimeCli(argv) {
+    const [cmd, ...rest] = argv;
+    const out = (l) => process.stderr.write(`${l}\n`);
+    if (cmd === 'pair') {
+        const code = rest.find((a) => !a.startsWith('--')) ?? '';
+        const wake = flag(rest, 'wake');
+        const { path } = await runtimePair({ home: need(rest, 'home'), code, ...(wake !== undefined ? { wake: wakeOf(wake) ?? null } : {}), ...(flag(rest, 'agent') ? { agent: flag(rest, 'agent') } : {}), log: out });
+        out(`✓ paired — ${path}`);
+        return 0;
+    }
+    if (cmd === 'join') {
+        const chain = flag(rest, 'chain') ?? 'faithchain';
+        const { getDeployments } = await import('@agenticprimitives/contracts/deployments');
+        const C = getDeployments(chain);
+        const contracts = { chainId: C.chainId, delegationManager: C.delegationManager, timestampEnforcer: C.timestampEnforcer, allowedMethodsEnforcer: C.allowedMethodsEnforcer, valueEnforcer: C.valueEnforcer, allowedTargetsEnforcer: C.allowedTargetsEnforcer, agentRelationship: C.agentRelationship, agentNameRegistry: C.agentNameRegistry, permissionlessSubregistry: C.permissionlessSubregistry, digestBindingEnforcer: C.digestBindingEnforcer };
+        const home = need(rest, 'home');
+        const custodian = await personaCustodian(home, need(rest, 'handle'));
+        const { path } = await runtimeJoin({
+            home, edge: need(rest, 'edge'), a2a: need(rest, 'a2a'), member: need(rest, 'member'), workspace: need(rest, 'workspace'), contracts, custodian,
+            // The registry the playbook is pinned from is the product's to name (agentic.lock.json#definitions, `ap upgrade --pin-definitions`); no default here.
+            registry: { origin: need(rest, 'registry'), context: flag(rest, 'context') ?? 'agentic-trust', archetype: flag(rest, 'archetype') ?? 'runtime-member' },
+            validForSeconds: Number(flag(rest, 'days') ?? 30) * 86_400, log: out,
+            ...((w) => (w ? { wake: w } : {}))(wakeOf(flag(rest, 'wake'))),
+            ...(flag(rest, 'messaging-to') ? { messagingTo: await resolveNames(home, flag(rest, 'messaging-to')) } : {}),
+            ...(flag(rest, 'open-mandate') ? { openMandate: flag(rest, 'open-mandate').split(',').map((x) => x.trim()).filter(Boolean) } : {}),
+        });
+        out(`✓ joined — ${path}`);
+        return 0;
+    }
+    if (cmd === 'playbook') {
+        const rec = loadRuntimeMember(need(rest, 'member'));
+        const custodian = await personaCustodian(flag(rest, 'home') ?? rec.home, need(rest, 'handle'));
+        const rel = await (await fetch(`${rec.home}/connect/related-orgs?surface=any`, { headers: { authorization: `Bearer ${custodian.bearer}` } })).json().catch(() => ({}));
+        const link = (rel.orgs ?? []).find((l) => l.orgAgent.toLowerCase() === rec.agent.toLowerCase() && l.relationship === 'steward');
+        if (!link?.stewardshipDelegation)
+            throw new Error(`${flag(rest, 'handle')} holds no steward link for ${rec.name}`);
+        const digest = await assignPlaybook({ a2a: rec.a2a, member: rec.agent, custodian, stewardship: link.stewardshipDelegation, registry: { origin: need(rest, 'registry'), context: flag(rest, 'context') ?? 'agentic-trust', archetype: flag(rest, 'archetype') ?? 'runtime-member' }, force: true, log: out });
+        out(`✓ ${rec.name} runs the ${flag(rest, 'archetype') ?? 'runtime-member'} playbook at ${digest.slice(0, 14)}…`);
+        return 0;
+    }
+    if (cmd === 'messaging') {
+        const rec = loadRuntimeMember(need(rest, 'member'));
+        const home = (flag(rest, 'home') ?? rec.home).replace(/\/$/, '');
+        const custodian = await personaCustodian(home, need(rest, 'handle'));
+        const rel = await (await fetch(`${home}/connect/related-orgs?surface=any`, { headers: { authorization: `Bearer ${custodian.bearer}` } })).json().catch(() => ({}));
+        const link = (rel.orgs ?? []).find((l) => l.orgAgent.toLowerCase() === rec.agent.toLowerCase() && l.relationship === 'steward');
+        if (!link?.stewardshipDelegation)
+            throw new Error(`${flag(rest, 'handle')} holds no steward link for ${rec.name} — run \`ap runtime join\` first`);
+        const recipients = await resolveNames(home, need(rest, 'to'));
+        const { getDeployments } = await import('@agenticprimitives/contracts/deployments');
+        const C = getDeployments((flag(rest, 'chain') ?? 'faithchain'));
+        const contracts = { chainId: C.chainId, delegationManager: C.delegationManager, timestampEnforcer: C.timestampEnforcer, allowedMethodsEnforcer: C.allowedMethodsEnforcer, valueEnforcer: C.valueEnforcer, allowedTargetsEnforcer: C.allowedTargetsEnforcer, agentRelationship: C.agentRelationship, agentNameRegistry: C.agentNameRegistry, permissionlessSubregistry: C.permissionlessSubregistry, digestBindingEnforcer: C.digestBindingEnforcer };
+        const rail = await enableMessaging({ a2a: rec.a2a, member: rec.agent, recipients, contracts, custodian, stewardship: link.stewardshipDelegation });
+        out(`✓ ${rec.name} may deliver to ${rail.recipients.length} recipient(s) (${rail.hash.slice(0, 12)}…)`);
+        return 0;
+    }
+    if (cmd === 'grant') {
+        const rec = loadRuntimeMember(need(rest, 'member'));
+        const caps = rest.filter((a, i) => !a.startsWith('--') && !(i > 0 && rest[i - 1].startsWith('--')) && a !== 'grant');
+        if (!caps.length)
+            throw new Error('name the capabilities to grant, e.g. messaging.direct.send');
+        const chain = flag(rest, 'chain') ?? 'faithchain';
+        const { getDeployments } = await import('@agenticprimitives/contracts/deployments');
+        const C = getDeployments(chain);
+        const contracts = { chainId: C.chainId, delegationManager: C.delegationManager, timestampEnforcer: C.timestampEnforcer, allowedMethodsEnforcer: C.allowedMethodsEnforcer, valueEnforcer: C.valueEnforcer, allowedTargetsEnforcer: C.allowedTargetsEnforcer, agentRelationship: C.agentRelationship, agentNameRegistry: C.agentNameRegistry, permissionlessSubregistry: C.permissionlessSubregistry, digestBindingEnforcer: C.digestBindingEnforcer };
+        const custodian = await personaCustodian(flag(rest, 'home') ?? rec.home, need(rest, 'handle'));
+        const home = (flag(rest, 'home') ?? rec.home).replace(/\/$/, '');
+        const locations = await resolveNames(home, flag(rest, 'to') ?? '');
+        const standing = await buildStandingGrant({ member: rec.agent, runtimeKey: rec.address, capabilities: caps, ...(locations.length ? { locations } : {}), validForSeconds: Number(flag(rest, 'days') ?? 30) * 86_400, enforcers: standingEnforcers(contracts), chainId: contracts.chainId, delegationManager: contracts.delegationManager, signDigest: custodian.signDigest });
+        saveRuntimeMember({ ...rec, standing });
+        // Recorded on the member's object too (spec 400 B4): the Grants screen lists it; Revoke there expands it.
+        const rel2 = await (await fetch(`${home}/connect/related-orgs?surface=any`, { headers: { authorization: `Bearer ${custodian.bearer}` } })).json().catch(() => ({}));
+        const link2 = (rel2.orgs ?? []).find((l) => l.orgAgent.toLowerCase() === rec.agent.toLowerCase() && l.relationship === 'steward');
+        await recordStandingGrant({ a2a: rec.a2a, member: rec.agent, custodian, ...(link2?.stewardshipDelegation ? { stewardship: link2.stewardshipDelegation } : {}), standing, holderName: `${rec.name} runtime key` });
+        out(`✓ standing grant ${standing.ref.slice(0, 18)}… · ${rec.name} → ${rec.address} · ${caps.join(', ')}${locations.length ? ` to ${locations.length} recipient(s)` : ' to anyone'} · until ${new Date(standing.requirement.validUntil * 1000).toISOString().slice(0, 10)}\n  kept in ${runtimePath(rec.name)}; a Container needs the record re-exported (ap runtime export → AP_RUNTIME_RECORD_<NAME>)`);
+        return 0;
+    }
+    if (cmd === 'host') {
+        const rec = loadRuntimeMember(need(rest, 'member'));
+        const target = rest.filter((a) => !a.startsWith('--') && !['host', flag(rest, 'member'), flag(rest, 'home'), flag(rest, 'handle')].includes(a)).at(-1);
+        const host = wakeOf(target);
+        if (host === undefined)
+            throw new Error('say where: container | <url> | none');
+        const custodian = await personaCustodian(flag(rest, 'home') ?? rec.home, need(rest, 'handle'));
+        // The custodian's steward link for the member — the one join recorded; the Home holds it.
+        const rel = await (await fetch(`${rec.home}/connect/related-orgs?surface=any`, { headers: { authorization: `Bearer ${custodian.bearer}` } })).json().catch(() => ({}));
+        const link = (rel.orgs ?? []).find((l) => l.orgAgent.toLowerCase() === rec.agent.toLowerCase() && l.relationship === 'steward');
+        if (!link?.stewardshipDelegation)
+            throw new Error(`${flag(rest, 'handle')} holds no steward link for ${rec.name} — run \`ap runtime join\` first`);
+        await declareRuntimeHost({ a2a: rec.a2a, member: rec.agent, custodian, host, stewardship: link.stewardshipDelegation });
+        out(host ? `✓ ${rec.name} is woken at ${host.kind === 'url' ? host.url : 'its Container'}` : `✓ ${rec.name} is no longer woken — it polls`);
+        return 0;
+    }
+    if (cmd === 'serve') {
+        const agent = need(rest, 'agent').split(/\s+/).filter(Boolean);
+        const fb = flag(rest, 'fallback-poll');
+        const { close } = await serveRuntimeMember({ member: need(rest, 'member'), agent, port: Number(flag(rest, 'port') ?? process.env.PORT ?? 8080), ...(fb ? { fallbackPollMs: Number(fb) * 1000 } : {}), ...allowLocalPolicy(rest), log: out });
+        await new Promise((resolve) => { for (const sig of ['SIGINT', 'SIGTERM'])
+            process.once(sig, () => { void close().finally(resolve); }); });
+        return 0;
+    }
+    if (cmd === 'export') {
+        process.stdout.write(`${JSON.stringify(portableRecord(loadRuntimeMember(need(rest, 'member'))))}\n`);
+        return 0;
+    }
+    if (cmd === 'run') {
+        const agent = need(rest, 'agent').split(/\s+/).filter(Boolean);
+        await runRuntimeMember({
+            member: need(rest, 'member'), agent, pollMs: Number(flag(rest, 'poll') ?? 15) * 1000,
+            ...(flag(rest, 'turns') ? { maxTurns: Number(flag(rest, 'turns')) } : {}), ...(flag(rest, 'since') ? { since: flag(rest, 'since') } : {}),
+            ...allowLocalPolicy(rest),
+            log: out,
+        });
+        return 0;
+    }
+    if (cmd === 'mcp') {
+        await runWorkspaceMcpStdio(need(rest, 'member'));
+        return 0;
+    }
+    if (cmd === 'status') {
+        const rec = loadRuntimeMember(need(rest, 'member'));
+        out(`${rec.name} ${rec.agent}\n  ${rec.standing ? `standing grant ${rec.standing.ref.slice(0, 18)}… for ${rec.standing.requirement.actions.join(', ')} until ${new Date(rec.standing.requirement.validUntil * 1000).toISOString().slice(0, 10)}` : 'no standing grant — every write parks'}\n  workspace ${rec.workspace.name} ${rec.workspace.agent}\n  key ${rec.address}${rec.key ? '' : ' (not in the record — AP_RUNTIME_KEY or a signer)'} · wire ${rec.wireRef.slice(0, 18)}… valid until ${new Date(rec.validUntil * 1000).toISOString()}\n  edge ${rec.edge} · runtime ${rec.a2a} · home ${rec.home}\n  ${runtimePath(rec.name)}`);
+        return 0;
+    }
+    out(RUNTIME_USAGE);
+    return cmd ? 2 : 0;
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,oHAAoH;AACpH,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAsC,MAAM,WAAW,CAAC;AACrI,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,IAAI,GAAG,CAAC,IAAc,EAAE,IAAY,EAAsB,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACrJ,MAAM,IAAI,GAAG,CAAC,IAAc,EAAE,IAAY,EAAU,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAAE,MAAM,IAAI,KAAK,CAAC,KAAK,IAAI,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAEnJ,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;gJAUmH,CAAC;AAEjJ,4IAA4I;AAC5I,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY;IACpD,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACrE,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAmB,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5F,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,IAAI,2BAA2B,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAyC,CAAC;QAC1J,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;QAC/E,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAmB,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,MAAM,MAAM,GAAG,CAAC,CAAqB,EAAoC,EAAE;IACzE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC,KAAK,WAAW;QAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC1D,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;IACpF,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,GAAG,CAAC,CAAC;AAC7E,CAAC,CAAC;AACF,MAAM,gBAAgB,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAA2D,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,UAAmB,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAE9S,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAAc;IACjE,MAAM,CAAC,GAAG,KAAK,EAAE,CAAW,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC;IACzI,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,IAAI,sBAAsB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7L,IAAI,CAAC,EAAE,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,yBAAyB,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACpH,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC;IACtC,OAAO;QACL,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,WAAW,EAAmB;QAC9D,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,IAAI,uBAAuB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACzM,IAAI,CAAC,CAAC,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9F,OAAO,CAAC,CAAC,SAA0B,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc;IAC7C,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QACjN,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QAC1B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,YAAY,CAAC;QAClD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,0CAA0C,CAAC,CAAC;QACpF,MAAM,CAAC,GAAG,cAAc,CAAC,KAA6C,CAA4D,CAAC;QACnI,MAAM,SAAS,GAAc,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAkC,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAkC,EAAE,sBAAsB,EAAE,CAAC,CAAC,sBAAuC,EAAE,aAAa,EAAE,CAAC,CAAC,aAA8B,EAAE,sBAAsB,EAAE,CAAC,CAAC,sBAAuC,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAkC,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAkC,EAAE,yBAAyB,EAAE,CAAC,CAAC,yBAA0C,EAAE,qBAAqB,EAAE,CAAC,CAAC,qBAAsC,EAAE,CAAC;QACzlB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,CAAC;YACjC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,SAAS;YAC9I,sJAAsJ;YACtJ,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,eAAe,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,gBAAgB,EAAE;YACvJ,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG;YACpE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC9D,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,CAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7G,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpI,CAAC,CAAC;QACH,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QAC1B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,mCAAmC,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAmG,CAAC;QACzQ,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC;QAChI,IAAI,CAAC,IAAI,EAAE,qBAAqB;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,8BAA8B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACnH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,qBAAqB,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,eAAe,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,gBAAgB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7S,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,aAAa,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,gBAAgB,gBAAgB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACjH,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,IAAI,mCAAmC,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAmG,CAAC;QACrQ,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC;QAChI,IAAI,CAAC,IAAI,EAAE,qBAAqB;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,8BAA8B,GAAG,CAAC,IAAI,kCAAkC,CAAC,CAAC;QACnJ,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9D,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,0CAA0C,CAAC,CAAC;QACpF,MAAM,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,YAAY,CAAyC,CAA4D,CAAC;QACnK,MAAM,SAAS,GAAc,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAkC,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAkC,EAAE,sBAAsB,EAAE,CAAC,CAAC,sBAAuC,EAAE,aAAa,EAAE,CAAC,CAAC,aAA8B,EAAE,sBAAsB,EAAE,CAAC,CAAC,sBAAuC,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAkC,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAkC,EAAE,yBAAyB,EAAE,CAAC,CAAC,yBAA0C,EAAE,qBAAqB,EAAE,CAAC,CAAC,qBAAsC,EAAE,CAAC;QACzlB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC;QACnJ,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,mBAAmB,IAAI,CAAC,UAAU,CAAC,MAAM,kBAAkB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QACxG,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC;QACtH,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChG,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,YAAY,CAAC;QAClD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,0CAA0C,CAAC,CAAC;QACpF,MAAM,CAAC,GAAG,cAAc,CAAC,KAA6C,CAA4D,CAAC;QACnI,MAAM,SAAS,GAAc,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAkC,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAkC,EAAE,sBAAsB,EAAE,CAAC,CAAC,sBAAuC,EAAE,aAAa,EAAE,CAAC,CAAC,aAA8B,EAAE,sBAAsB,EAAE,CAAC,CAAC,sBAAuC,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAkC,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAkC,EAAE,yBAAyB,EAAE,CAAC,CAAC,yBAA0C,EAAE,qBAAqB,EAAE,CAAC,CAAC,qBAAsC,EAAE,CAAC;QACzlB,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/F,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,iBAAiB,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,CAAC,iBAAiB,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;QAC7W,iBAAiB,CAAC,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxC,0GAA0G;QAC1G,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,IAAI,mCAAmC,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAmG,CAAC;QACtQ,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC;QAClI,MAAM,mBAAmB,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC;QAClN,GAAG,CAAC,oBAAoB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,MAAM,eAAe,CAAC,CAAC,CAAC,YAAY,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;QACzY,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvJ,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC/E,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/F,0FAA0F;QAC1F,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,mCAAmC,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAmG,CAAC;QACzQ,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC;QAChI,IAAI,CAAC,IAAI,EAAE,qBAAqB;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,8BAA8B,GAAG,CAAC,IAAI,kCAAkC,CAAC,CAAC;QACnJ,MAAM,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC;QACxH,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,gBAAgB,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,gCAAgC,CAAC,CAAC;QAC5I,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACvC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7O,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,KAAK,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzJ,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrG,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,gBAAgB,CAAC;YACrB,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI;YACpF,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzI,GAAG,gBAAgB,CAAC,IAAI,CAAC;YACzB,GAAG,EAAE,GAAG;SACT,CAAC,CAAC;QACH,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAAC,MAAM,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAClF,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpD,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,uCAAuC,iBAAiB,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,WAAW,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mDAAmD,WAAW,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,GAAG,CAAC,IAAI,cAAc,GAAG,CAAC,GAAG,WAAW,GAAG,CAAC,IAAI,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5mB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,GAAG,CAAC,aAAa,CAAC,CAAC;IACnB,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,48 @@
+import type { Hex } from 'viem';
+import { type StandardA2aClient } from '@agenticprimitives/a2a/standard';
+import type { RuntimeMemberRecordV1 } from './keystore.js';
+export declare const endpointFor: (rec: Pick<RuntimeMemberRecordV1, "edge">, target: string) => string;
+/** THE WIRE'S SIGNER — a port. The delegate key signs the request digest; where that key lives is the host's
+ *  business: in the record on a laptop (`~/.ap/runtime/<name>.json`), in a Container's secret (`AP_RUNTIME_KEY`), or
+ *  behind a KMS that never yields it (W1c). Whatever signs, the workspace sees one thing: the wire's delegate. */
+export type Signer = (digest: Hex) => Promise<Hex>;
+/** The record's own key as a signer — the laptop and the env-secret shapes. */
+export declare function recordSigner(rec: Pick<RuntimeMemberRecordV1, 'key' | 'name'>): Signer;
+export interface ClientOptions {
+    fetch?: typeof fetch;
+    signer?: Signer;
+}
+/** A client addressed at ONE agent by name, signing as the runtime. */
+export declare function clientFor(rec: RuntimeMemberRecordV1, target: string, opts?: ClientOptions): StandardA2aClient;
+export interface Plan {
+    steps: Array<{
+        toolId: string;
+        args: Record<string, unknown>;
+    }>;
+}
+/** What one ask came to: the words, the task's state, and the run it opened (for the steward's approval page). */
+export interface AskOutcome {
+    text: string;
+    state: string;
+    taskId?: string;
+    runRef?: string;
+    /** The task parked for a mandate the runtime does not hold — the steward signs at the Home. */
+    parked: boolean;
+    data?: unknown;
+}
+/** Ask an agent, as the runtime. A `plan` rides in the message's metadata (spec 400 W1) — a deterministic read that
+ *  costs no planner turn; the harness admits it like the Home's. */
+export declare function askAs(rec: RuntimeMemberRecordV1, target: string, text: string, opts?: {
+    plan?: Plan;
+    timeoutMs?: number;
+    fetch?: typeof fetch;
+    signer?: Signer;
+}): Promise<AskOutcome>;
+/** Spec 400 W2a — CONTINUE a run of the runtime's own that parked for authority, presenting the chain it derived
+ *  (`[child, standing]`) on the same task. The harness verifies the chain where it is used; the reply is the run's. */
+export declare function continueAs(rec: RuntimeMemberRecordV1, target: string, taskId: string, presented: Array<Record<string, unknown>>, opts?: {
+    timeoutMs?: number;
+    fetch?: typeof fetch;
+    signer?: Signer;
+}): Promise<AskOutcome>;
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAA8C,KAAK,iBAAiB,EAAe,MAAM,iCAAiC,CAAC;AAClI,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE3D,eAAO,MAAM,WAAW,QAAS,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,UAAU,MAAM,KAAG,MAA4D,CAAC;AAEpJ;;kHAEkH;AAClH,MAAM,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;AAEnD,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,qBAAqB,EAAE,KAAK,GAAG,MAAM,CAAC,GAAG,MAAM,CAIrF;AAED,MAAM,WAAW,aAAa;IAAG,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AAExE,uEAAuE;AACvE,wBAAgB,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,aAAkB,GAAG,iBAAiB,CAWjH;AAED,MAAM,WAAW,IAAI;IAAG,KAAK,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAA;CAAE;AAEzF,kHAAkH;AAClH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;oEACoE;AACpE,wBAAsB,KAAK,CAAC,GAAG,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAchM;AAED;uHACuH;AACvH,wBAAsB,UAAU,CAAC,GAAG,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAWrO"}

package/dist/client.js

@@ -0,0 +1,75 @@
+// THE RUNTIME SPEAKING AS ITSELF — one wire-signed A2A request per act, on the standard surface (spec 372 S3c), to any
+// agent by name: its own (`<name>.svc` — its inbox, its records), the workspace (a read under its member standing, an
+// act that parks), a person (a message). The signer holds the runtime's key on this machine; the assertion binds the
+// method, the body, the audience and the moment, and is spent once where it lands.
+import { sign } from 'viem/accounts';
+import { createStandardA2aClient, sessionWireSigner } from '@agenticprimitives/a2a/standard';
+export const endpointFor = (rec, target) => `${rec.edge.replace(/\/$/, '')}/api/a2a/${target}`;
+/** The record's own key as a signer — the laptop and the env-secret shapes. */
+export function recordSigner(rec) {
+    if (!rec.key)
+        throw new Error(`runtime member ${rec.name} has no key in its record and no signer was supplied (set AP_RUNTIME_KEY, or pass a signer)`);
+    const key = rec.key;
+    return (digest) => sign({ hash: digest, privateKey: key, to: 'hex' });
+}
+/** A client addressed at ONE agent by name, signing as the runtime. */
+export function clientFor(rec, target, opts = {}) {
+    return createStandardA2aClient({
+        endpoint: endpointFor(rec, target),
+        fetch: opts.fetch ?? fetch,
+        signRequest: sessionWireSigner({
+            agent: rec.agent,
+            wire: rec.wire,
+            audience: rec.audience,
+            signDigest: opts.signer ?? recordSigner(rec),
+        }),
+    });
+}
+/** Ask an agent, as the runtime. A `plan` rides in the message's metadata (spec 400 W1) — a deterministic read that
+ *  costs no planner turn; the harness admits it like the Home's. */
+export async function askAs(rec, target, text, opts = {}) {
+    const client = clientFor(rec, target, { fetch: opts.fetch, signer: opts.signer });
+    const out = await client.ask(text, { ...(opts.plan ? { metadata: { plan: opts.plan } } : {}), timeoutMs: opts.timeoutMs ?? 60_000 });
+    const task = out.task;
+    const state = task?.status?.state ?? (out.message ? 'MESSAGE' : 'UNKNOWN');
+    const data = dataOf(task);
+    return {
+        text: out.text,
+        state,
+        ...(task?.id ? { taskId: task.id } : {}),
+        ...(typeof task?.metadata?.runRef === 'string' ? { runRef: task.metadata.runRef } : {}),
+        parked: state === 'TASK_STATE_AUTH_REQUIRED' || state === 'TASK_STATE_INPUT_REQUIRED',
+        ...(data !== undefined ? { data } : {}),
+    };
+}
+/** Spec 400 W2a — CONTINUE a run of the runtime's own that parked for authority, presenting the chain it derived
+ *  (`[child, standing]`) on the same task. The harness verifies the chain where it is used; the reply is the run's. */
+export async function continueAs(rec, target, taskId, presented, opts = {}) {
+    const client = clientFor(rec, target, { fetch: opts.fetch, signer: opts.signer });
+    const sent = await client.sendMessage([{ text: 'continuing under the standing grant' }], { taskId, metadata: { presented } });
+    const task = sent.task && !['TASK_STATE_COMPLETED', 'TASK_STATE_FAILED', 'TASK_STATE_REJECTED', 'TASK_STATE_CANCELED'].includes(sent.task.status.state) ? await client.awaitTask(sent.task.id, { timeoutMs: opts.timeoutMs ?? 60_000 }) : sent.task;
+    const state = task?.status?.state ?? 'UNKNOWN';
+    const data = dataOf(task);
+    return {
+        text: (task?.status?.message?.parts ?? []).map((p) => p.text ?? '').join('').trim(),
+        state, ...(task?.id ? { taskId: task.id } : {}), ...(typeof task?.metadata?.runRef === 'string' ? { runRef: task.metadata.runRef } : {}),
+        parked: state === 'TASK_STATE_AUTH_REQUIRED' || state === 'TASK_STATE_INPUT_REQUIRED', ...(data !== undefined ? { data } : {}),
+    };
+}
+/** The structured answer a read returns: the `results` artifact's first step result (what the tool said), else a data
+ *  part on the status message. The `trace` artifact (a flow trace, `ap.flow-trace.v1`) is evidence of what ran, never
+ *  the answer — it is skipped, not mistaken for one. */
+function dataOf(task) {
+    if (!task)
+        return undefined;
+    const results = task.artifacts?.find((a) => a.name === 'results');
+    const rows = results?.parts?.[0]?.data;
+    if (Array.isArray(rows) && rows.length)
+        return rows.length === 1 ? rows[0].result : rows.map((r) => r.result);
+    for (const p of task.status?.message?.parts ?? []) {
+        if (p.data !== undefined && !(typeof p.data === 'object' && p.data && p.data.kind === 'ap.flow-trace.v1'))
+            return p.data;
+    }
+    return undefined;
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,uHAAuH;AACvH,sHAAsH;AACtH,qHAAqH;AACrH,mFAAmF;AACnF,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAuC,MAAM,iCAAiC,CAAC;AAGlI,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAwC,EAAE,MAAc,EAAU,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,MAAM,EAAE,CAAC;AAOpJ,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,GAAgD;IAC3E,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,IAAI,6FAA6F,CAAC,CAAC;IACvJ,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACxE,CAAC;AAID,uEAAuE;AACvE,MAAM,UAAU,SAAS,CAAC,GAA0B,EAAE,MAAc,EAAE,OAAsB,EAAE;IAC5F,OAAO,uBAAuB,CAAC;QAC7B,QAAQ,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC;QAClC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK;QAC1B,WAAW,EAAE,iBAAiB,CAAC;YAC7B,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAa;YACvB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,UAAU,EAAE,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC;SAC7C,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAeD;oEACoE;AACpE,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,GAA0B,EAAE,MAAc,EAAE,IAAY,EAAE,OAAmF,EAAE;IACzK,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC;IACrI,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK;QACL,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,OAAO,IAAI,EAAE,QAAQ,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,EAAE,KAAK,KAAK,0BAA0B,IAAI,KAAK,KAAK,2BAA2B;QACrF,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;uHACuH;AACvH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAA0B,EAAE,MAAc,EAAE,MAAc,EAAE,SAAyC,EAAE,OAAsE,EAAE;IAC9M,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,qCAAqC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC9H,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,sBAAsB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACpP,MAAM,KAAK,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,SAAS,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO;QACL,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE;QACnF,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,QAAQ,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxI,MAAM,EAAE,KAAK,KAAK,0BAA0B,IAAI,KAAK,KAAK,2BAA2B,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/H,CAAC;AACJ,CAAC;AAED;;wDAEwD;AACxD,SAAS,MAAM,CAAC,IAAwB;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAgE,CAAC;IACnG,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/G,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAK,CAAC,CAAC,IAA0B,CAAC,IAAI,KAAK,kBAAkB,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IAClJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/equip-entry.d.ts

@@ -0,0 +1,8 @@
+export { equipRuntimeMember, standingEnforcers, assignPlaybook, recordStandingGrant, declareRuntimeHost } from './equip.js';
+export type { EquipOptions, JoinOptions, Contracts, CustodianSigner, RuntimeHostV1 } from './equip.js';
+export type { RuntimeMemberRecordV1 } from './record.js';
+export { buildStandingGrant } from './standing.js';
+export type { StandingGrantV1, StandingEnforcers } from './standing.js';
+export { enableMessaging, MESSAGING_WIRE_SKILLS } from './messaging.js';
+export { PAIRING_CODE_RE, pairingHandleOf, type PairingStateV1, type PairingClaimV1, type PairingOptionsV1 } from './pairing.js';
+//# sourceMappingURL=equip-entry.d.ts.map

package/dist/equip-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"equip-entry.d.ts","sourceRoot":"","sources":["../src/equip-entry.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,cAAc,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC5H,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACvG,YAAY,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC"}

package/dist/equip-entry.js

@@ -0,0 +1,7 @@
+// `@agenticprimitives/runtime-member/equip` — the browser-safe subset: equip a member for a runtime key, no disk,
+// no key generation, no CLI. The Home imports THIS for the pairing ceremony (spec 400 W1b).
+export { equipRuntimeMember, standingEnforcers, assignPlaybook, recordStandingGrant, declareRuntimeHost } from './equip.js';
+export { buildStandingGrant } from './standing.js';
+export { enableMessaging, MESSAGING_WIRE_SKILLS } from './messaging.js';
+export { PAIRING_CODE_RE, pairingHandleOf } from './pairing.js';
+//# sourceMappingURL=equip-entry.js.map

package/dist/equip-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"equip-entry.js","sourceRoot":"","sources":["../src/equip-entry.ts"],"names":[],"mappings":"AAAA,kHAAkH;AAClH,4FAA4F;AAC5F,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,cAAc,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAG5H,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAmE,MAAM,cAAc,CAAC"}

package/dist/equip.d.ts

@@ -0,0 +1,124 @@
+import { type Address, type Hex } from 'viem';
+import type { RuntimeMemberRecordV1 } from './record.js';
+import { type StandingEnforcers } from './standing.js';
+/** The enforcer map a standing grant is written against; the digest-binding enforcer is required to derive children. */
+export declare function standingEnforcers(c: Contracts): StandingEnforcers;
+export interface Contracts {
+    chainId: number;
+    delegationManager: Address;
+    timestampEnforcer: Address;
+    allowedMethodsEnforcer: Address;
+    valueEnforcer: Address;
+    allowedTargetsEnforcer: Address;
+    agentRelationship: Address;
+    agentNameRegistry: Address;
+    permissionlessSubregistry: Address; /** Spec 400 W2a — needed to derive a child mandate from a standing grant. */
+    digestBindingEnforcer?: Address;
+}
+/** Who signs for the member's Smart Agent — its custodian. A port: the key is never here. */
+export interface CustodianSigner {
+    /** The custodian's Home session bearer (a demo persona's, for W1a) — used only for the Home's own routes. */
+    bearer: string;
+    /** The custodian's own agent address. */
+    agent: Address;
+    signDigest: (digest: Hex) => Promise<Hex>;
+}
+export interface JoinOptions {
+    home: string;
+    /** The standard A2A surface's host (the edge: `<edge>/api/a2a/<name>`). */
+    edge: string;
+    /** The agent runtime's host (the interactions ops: `<a2a>/interactions/<agent>/<op>`). */
+    a2a: string;
+    member: string;
+    workspace: string;
+    contracts: Contracts;
+    custodian: CustodianSigner;
+    /** The registry the playbook is read from and its archetype (context/id). */
+    registry: {
+        origin: string;
+        context: string;
+        archetype: string;
+    };
+    validForSeconds?: number;
+    /** W1c — where the runtime is hosted, so the Worker can WAKE it when a message is admitted instead of the runtime
+     *  polling: `container` (the app's Container binding, one instance per member) or a URL that serves `POST /wake`.
+     *  Omitted: the runtime polls (`ap runtime run`). Declared by the custodian, kept on the member's own object. */
+    wake?: RuntimeHostV1;
+    /** Spec 400 W2a — the OPEN MANDATE: capabilities the custodian pre-authorizes ONCE for this runtime (a standing
+     *  grant, no intent binding, the same window as the wire); the loop derives a child per parked reply. Typically
+     *  `['messaging.direct.send']`. Omitted: every write parks. */
+    openMandate?: string[];
+    /** The open mandate's locations (for messaging: the recipients); omitted: any. */
+    openMandateLocations?: Address[];
+    /** Spec 400 W2a — the member's MESSAGING RAIL: the recipients its custodian lets it deliver to (the signing wire +
+     *  transport grant the Home's ceremony mints). Without a rail an authorized reply cannot leave. */
+    messagingTo?: Address[];
+    fetch?: typeof fetch;
+    log?: (line: string) => void;
+}
+/** Where a runtime member's host lives — the Worker's wake target. Config, never authority: a wake carries no
+ *  content and no grant; the host reads under its own wire. */
+export type RuntimeHostV1 = {
+    v: 1;
+    kind: 'container';
+} | {
+    v: 1;
+    kind: 'url';
+    url: string;
+};
+/** The member's playbook, pinned by digest from the registry (the K3 assignment the Playbook page writes). Kept when
+ *  the same archetype is already assigned unless `force` — a re-pin after the registry's definition changed. */
+export declare function assignPlaybook(o: {
+    a2a: string;
+    member: Address;
+    custodian: CustodianSigner;
+    stewardship?: unknown;
+    registry: {
+        origin: string;
+        context: string;
+        archetype: string;
+    };
+    force?: boolean;
+    fetch?: typeof fetch;
+    log?: (l: string) => void;
+}): Promise<string>;
+/** Spec 400 W2 (B4) — keep the standing grant on the member's own object (like a read grant), so the grants screen
+ *  lists it and a revocation can expand its digest. The object verifies it was issued by the member. */
+export declare function recordStandingGrant(o: {
+    a2a: string;
+    member: Address;
+    custodian: CustodianSigner;
+    stewardship?: unknown;
+    standing: {
+        wire: Record<string, unknown>;
+        requirement: {
+            actions: string[];
+            locations?: string[];
+            validUntil: number;
+        };
+    };
+    holderName?: string;
+    fetch?: typeof fetch;
+}): Promise<string>;
+/** Declare (or clear, with `null`) where the member's runtime is hosted — the custodian's act on the member's object. */
+export declare function declareRuntimeHost(o: {
+    a2a: string;
+    member: string;
+    custodian: CustodianSigner;
+    host: RuntimeHostV1 | null;
+    stewardship?: unknown;
+    fetch?: typeof fetch;
+}): Promise<void>;
+export interface EquipOptions extends Omit<JoinOptions, 'log'> {
+    /** The runtime's OWN key's address — generated on its machine; never the key. */
+    address: Address;
+    /** Where to CALL the Home and the agent runtime from here, when that differs from what the record should name —
+     *  the Home's browser reaches its own origin and the `/a2a` proxy while the record carries the public origins. */
+    call?: {
+        home?: string;
+        a2a?: string;
+    };
+    log?: (line: string) => void;
+}
+export declare function equipRuntimeMember(o: EquipOptions): Promise<Omit<RuntimeMemberRecordV1, 'key'>>;
+//# sourceMappingURL=equip.d.ts.map