@agenticprimitives/service-host 0.0.0-alpha.0 → 0.0.0-alpha.10

package/dist/tools/find.js

@@ -0,0 +1,95 @@
+export const DISCOVERY_FIND_CAPABILITY = 'discovery.agents.find';
+export const DISCOVERY_FIND_TOOL = {
+    id: DISCOVERY_FIND_CAPABILITY,
+    answers: ['who offers', 'find an organization', 'find an agent that', 'who can', 'who teaches', 'find services', 'discover'],
+    verbs: ['find', 'discover'],
+    description: 'FINDS AGENTS IN THE PUBLIC REGISTRY BY WHAT THE PERSON WANTS — an organization with a course on a subject, a service '
+        + 'that offers a capability, a publisher on a topic. The registry searches its entries (public, on-chain-anchored facts) '
+        + 'and answers with matching agents: name, description, declared capabilities, card, relevance. Use it BEFORE '
+        + 'engagement.agent.invoke when the ask names a kind of agent rather than a specific one. It reads only; it authorizes '
+        + 'nothing. Args: intent (what the person wants, in their words), capability (optional: a capability id, or a WORD the '
+        + 'registry resolves to one it knows — an unknown word is refused with the reason, never widened), language (optional '
+        + 'BCP-47 tag), limit (default 5, max 25).',
+    inputSchema: {
+        type: 'object',
+        properties: {
+            intent: { type: 'string', description: 'What the person wants, in their words' },
+            capability: { type: 'string', description: 'A capability id or word to filter by (optional)' },
+            language: { type: 'string', description: 'A BCP-47 language tag (optional)' },
+            limit: { type: 'integer', description: 'How many to return (default 5, max 25)' },
+        },
+        required: ['intent'],
+    },
+    establishes: 'lookup',
+};
+/** DETERMINISTIC: the person's words become ONE registry query, reproducible by a reviewer. No model plans it. */
+export function planFind(args) {
+    const intent = String(args.intent ?? '').trim();
+    const capability = String(args.capability ?? '').trim();
+    const lang = String(args.language ?? '').trim().toLowerCase();
+    const n = Number(args.limit);
+    const limit = Number.isInteger(n) && n >= 1 ? Math.min(n, 25) : 5;
+    if (lang && !/^[a-z]{2,3}(-[a-z0-9]{2,8})*$/.test(lang))
+        return { body: { query: { text: '' }, pageSize: limit, federation: 'none' }, refused: `language must be a BCP-47 tag (got “${args.language}”)` };
+    if (!intent && !capability)
+        return { body: { query: { text: '' }, pageSize: limit, federation: 'none' }, refused: 'say what the person wants (intent), a capability, or both — the registry needs a question' };
+    const filter = {};
+    if (capability)
+        filter.capabilities = [capability];
+    if (lang)
+        filter['ap:language'] = [lang];
+    return { body: { query: { text: intent || capability, ...(Object.keys(filter).length ? { filter } : {}) }, pageSize: limit, federation: 'none' } };
+}
+/** The ONE mechanism (ADR-0013): the registry's ARD `POST /search`. A registry error is the tool's refusal, in its words. */
+export function discoveryFindInvoker(deps) {
+    return async (_toolId, args) => {
+        const origin = (deps.registryOrigin ?? '').replace(/\/$/, '');
+        if (!/^https?:\/\//.test(origin))
+            return { refused: 'no agent registry is configured for this deployment' };
+        const plan = planFind(args);
+        if (plan.refused)
+            return { refused: plan.refused };
+        const url = `${origin}/search`;
+        let res;
+        try {
+            res = await (deps.fetch ?? fetch)(url, { method: 'POST', headers: { 'content-type': 'application/json', accept: 'application/json' }, body: JSON.stringify(plan.body) });
+        }
+        catch (e) {
+            return { refused: `the registry at ${origin} could not be reached: ${e instanceof Error ? e.message : String(e)}`, query: plan.body };
+        }
+        const out = (await res.json().catch(() => null));
+        if (!res.ok || !out)
+            return { refused: `the registry answered ${res.status}${out?.error ? `: ${typeof out.error === 'string' ? out.error : JSON.stringify(out.error).slice(0, 160)}` : ''}`, query: plan.body };
+        const rows = Array.isArray(out.results) ? out.results : [];
+        const agents = await Promise.all(rows.map(async (e) => {
+            const agent = typeof e['ap:canonicalAgentId'] === 'string' ? e['ap:canonicalAgentId'].toLowerCase() : null;
+            const name = agent && deps.nameOf ? await deps.nameOf(agent).catch(() => null) : null;
+            return {
+                agent, name,
+                displayName: String(e.displayName ?? e.identifier ?? ''),
+                ...(typeof e.description === 'string' ? { description: e.description } : {}),
+                capabilities: Array.isArray(e.capabilities) ? e.capabilities.map(String) : [],
+                card: typeof e.url === 'string' ? e.url : null,
+                website: typeof e['ap:siteUrl'] === 'string' ? e['ap:siteUrl'] : null,
+                ...(typeof e['ap:agentType'] === 'string' ? { agentType: e['ap:agentType'] } : {}),
+                ...(typeof e['ap:registryStatus'] === 'string' ? { registryStatus: e['ap:registryStatus'] } : {}),
+                relevance: typeof e.score === 'number' ? e.score : null,
+                ...(e['ap:trustEvidence'] ? { evidence: e['ap:trustEvidence'] } : {}),
+            };
+        }));
+        const resolution = out['ap:capabilityResolution'];
+        return {
+            agents, query: plan.body, referral: { registry: url },
+            ...(resolution ? { capabilityResolution: resolution } : {}),
+            ...(out['ap:capabilityIdsFromText']?.length ? { capabilityIdsFromText: out['ap:capabilityIdsFromText'] } : {}),
+            interpretation: `asked the registry at ${origin} for “${plan.body.query.text}”${plan.body.query.filter?.capabilities ? ` with capability ${plan.body.query.filter.capabilities.join(', ')}` : ''}`,
+            note: agents.length
+                ? `${agents.length} agent(s) from the public registry, ordered by relevance — public facts, never a record of ours and never authority; engage one by its name or address.`
+                : resolution && !resolution.resolvedTo
+                    ? `nothing matched: the registry could not read the capability — ${resolution.because}${resolution.candidates?.length ? ` (candidates: ${resolution.candidates.join(', ')})` : ''}. Say it another way.`
+                    : 'nothing registered matched; the registry was asked, not guessed for.',
+            untrusted: true,
+        };
+    };
+}
+//# sourceMappingURL=find.js.map

package/dist/tools/find.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"find.js","sourceRoot":"","sources":["../../src/tools/find.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,MAAM,yBAAyB,GAAG,uBAAgC,CAAC;AAE1E,MAAM,CAAC,MAAM,mBAAmB,GAAa;IAC3C,EAAE,EAAE,yBAAyB;IAC7B,OAAO,EAAE,CAAC,YAAY,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,CAAC;IAC5H,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;IAC3B,WAAW,EACT,uHAAuH;UACrH,wHAAwH;UACxH,6GAA6G;UAC7G,sHAAsH;UACtH,sHAAsH;UACtH,qHAAqH;UACrH,yCAAyC;IAC7C,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uCAAuC,EAAE;YAChF,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iDAAiD,EAAE;YAC9F,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE;YAC7E,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,wCAAwC,EAAE;SAClF;QACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;KACrB;IACD,WAAW,EAAE,QAAQ;CACtB,CAAC;AAIF,kHAAkH;AAClH,MAAM,UAAU,QAAQ,CAAC,IAA6B;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,IAAI,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,uCAAuC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC1M,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,2FAA2F,EAAE,CAAC;IAChN,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,IAAI,UAAU;QAAE,MAAM,CAAC,YAAY,GAAG,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,IAAI;QAAE,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,IAAI,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC;AACrJ,CAAC;AAgBD,6HAA6H;AAC7H,MAAM,UAAU,oBAAoB,CAAC,IAAc;IACjD,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;QAC5G,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QACnD,MAAM,GAAG,GAAG,GAAG,MAAM,SAAS,CAAC;QAC/B,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QACjL,OAAO,CAAC,EAAE,CAAC;YAAC,OAAO,EAAE,OAAO,EAAE,mBAAmB,MAAM,0BAA0B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QACpJ,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAqO,CAAC;QACrR,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,yBAAyB,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QAChN,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAiB,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YAClE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,qBAAqB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,qBAAqB,CAAY,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACvH,MAAM,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACtF,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;gBACxD,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC7E,IAAI,EAAE,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;gBAC9C,OAAO,EAAE,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,YAAY,CAAY,CAAC,CAAC,CAAC,IAAI;gBACjF,GAAG,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,cAAc,CAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5F,GAAG,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,mBAAmB,CAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3G,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;gBACvD,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE,CAAC;QACJ,CAAC,CAAC,CAAC,CAAC;QACJ,MAAM,UAAU,GAAG,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAClD,OAAO;YACL,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE;YACrD,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9G,cAAc,EAAE,yBAAyB,MAAM,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAClM,IAAI,EAAE,MAAM,CAAC,MAAM;gBACjB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,yJAAyJ;gBAC3K,CAAC,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU;oBACpC,CAAC,CAAC,iEAAiE,UAAU,CAAC,OAAO,GAAG,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,uBAAuB;oBACxM,CAAC,CAAC,sEAAsE;YAC5E,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/tools/index.d.ts

@@ -0,0 +1,8 @@
+export { DISCOVERY_FIND_CAPABILITY, DISCOVERY_FIND_TOOL, planFind, discoveryFindInvoker } from './find.js';
+export type { ArdSearchBody, FoundAgent, FindDeps } from './find.js';
+export { DISCOVERY_INSPECT_CAPABILITY, DISCOVERY_INSPECT_TOOL, discoveryInspectInvoker } from './inspect.js';
+export { EXTERNAL_AGENT_CAPABILITY, EXTERNAL_AGENT_TOOL, TYPED_NAME, cardOfName, externalAgentInvoker } from './external.js';
+export type { ExternalAgentDeps, NameRecordsPort } from './external.js';
+export { ENGAGEMENT_INVOKE_CAPABILITY, ENGAGEMENT_INVOKE_TOOL, engagementInvokeInvoker, readSubjectReply } from './invoke.js';
+export type { InvokeDeps } from './invoke.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAC3G,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC7G,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC7H,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC9H,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC"}

package/dist/tools/index.js

@@ -0,0 +1,5 @@
+export { DISCOVERY_FIND_CAPABILITY, DISCOVERY_FIND_TOOL, planFind, discoveryFindInvoker } from './find.js';
+export { DISCOVERY_INSPECT_CAPABILITY, DISCOVERY_INSPECT_TOOL, discoveryInspectInvoker } from './inspect.js';
+export { EXTERNAL_AGENT_CAPABILITY, EXTERNAL_AGENT_TOOL, TYPED_NAME, cardOfName, externalAgentInvoker } from './external.js';
+export { ENGAGEMENT_INVOKE_CAPABILITY, ENGAGEMENT_INVOKE_TOOL, engagementInvokeInvoker, readSubjectReply } from './invoke.js';
+//# sourceMappingURL=index.js.map

package/dist/tools/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAE3G,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC7G,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE7H,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC"}

package/dist/tools/inspect.d.ts

@@ -0,0 +1,6 @@
+import type { ToolSpec, ToolInvoker } from '@agenticprimitives/orchestration';
+import { type ExternalAgentDeps } from './external.js';
+export declare const DISCOVERY_INSPECT_CAPABILITY: "discovery.agent.inspect";
+export declare const DISCOVERY_INSPECT_TOOL: ToolSpec;
+export declare function discoveryInspectInvoker(deps: Pick<ExternalAgentDeps, 'nameRecords' | 'fetch'>): ToolInvoker;
+//# sourceMappingURL=inspect.d.ts.map

package/dist/tools/inspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspect.d.ts","sourceRoot":"","sources":["../../src/tools/inspect.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAE9E,OAAO,EAAc,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEnE,eAAO,MAAM,4BAA4B,EAAG,yBAAkC,CAAC;AAE/E,eAAO,MAAM,sBAAsB,EAAE,QAWpC,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,GAAG,OAAO,CAAC,GAAG,WAAW,CAoB3G"}

package/dist/tools/inspect.js

@@ -0,0 +1,43 @@
+import { resolveAgentCard } from '@agenticprimitives/a2a/standard';
+import { cardOfName } from './external.js';
+export const DISCOVERY_INSPECT_CAPABILITY = 'discovery.agent.inspect';
+export const DISCOVERY_INSPECT_TOOL = {
+    id: DISCOVERY_INSPECT_CAPABILITY,
+    answers: ['what does this agent offer', 'inspect', 'what skills does', 'who runs', 'is the card current'],
+    verbs: ['inspect'],
+    description: 'INSPECTS ONE AGENT BEFORE ENGAGING IT: its public A2A card, re-fetched through its registry NAME\'s own records (the card '
+        + 'URL and the digest the name pins on chain) — who it says it is, what it declares, its provider, and whether the card '
+        + 'served now still matches what its records pin. Public facts, read only; it authorizes nothing and it never asks the '
+        + 'agent anything. Args: agent (the registry name, e.g. catalog.svc, as discovery returned it).',
+    inputSchema: { type: 'object', properties: { agent: { type: 'string', description: 'The agent\'s registry name (catalog.svc)' } }, required: ['agent'] },
+    establishes: 'lookup',
+};
+export function discoveryInspectInvoker(deps) {
+    return async (_toolId, args) => {
+        const name = String(args.agent ?? '').trim().toLowerCase();
+        if (!name || /^0x[0-9a-f]{40}$/.test(name))
+            return { refused: 'inspect by registry NAME (catalog.svc) — the name\'s own records say where its card is and what pins it' };
+        if (!deps.nameRecords)
+            return { refused: 'no name records are readable here' };
+        const where = await cardOfName(name, deps.nameRecords);
+        if ('refused' in where)
+            return { refused: where.refused };
+        let resolved;
+        try {
+            resolved = await resolveAgentCard(where.cardUrl, deps.fetch ?? fetch);
+        }
+        catch (e) {
+            return { refused: `the card at ${where.cardUrl} could not be read: ${e instanceof Error ? e.message : String(e)}`, cardUrl: where.cardUrl };
+        }
+        const card = resolved.card;
+        const matchesPin = where.pinnedDigest ? where.pinnedDigest.toLowerCase() === resolved.cardDigest.toLowerCase() : null;
+        return {
+            name, cardUrl: where.cardUrl, endpoint: resolved.endpoint, cardDigest: resolved.cardDigest,
+            pinned: !!where.pinnedDigest, ...(matchesPin !== null ? { matchesPin } : {}),
+            card: { name: card.name, description: card.description, provider: card.provider, protocolVersion: card.protocolVersion, version: card.version, declares: (card.skills ?? []).map((s) => ({ id: s.id, name: s.name, description: s.description })) },
+            note: matchesPin === false ? 'THE SERVED CARD DIFFERS from the digest its records pin — say so; do not engage on it as if current.' : `Public facts from ${name}'s own card${where.pinnedDigest ? ', matching the digest its records pin' : ' (its records pin no digest)'} — never authority.`,
+            untrusted: true,
+        };
+    };
+}
+//# sourceMappingURL=inspect.js.map

package/dist/tools/inspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspect.js","sourceRoot":"","sources":["../../src/tools/inspect.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,UAAU,EAA0B,MAAM,eAAe,CAAC;AAEnE,MAAM,CAAC,MAAM,4BAA4B,GAAG,yBAAkC,CAAC;AAE/E,MAAM,CAAC,MAAM,sBAAsB,GAAa;IAC9C,EAAE,EAAE,4BAA4B;IAChC,OAAO,EAAE,CAAC,4BAA4B,EAAE,SAAS,EAAE,kBAAkB,EAAE,UAAU,EAAE,qBAAqB,CAAC;IACzG,KAAK,EAAE,CAAC,SAAS,CAAC;IAClB,WAAW,EACT,4HAA4H;UAC1H,uHAAuH;UACvH,sHAAsH;UACtH,8FAA8F;IAClG,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0CAA0C,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE;IACxJ,WAAW,EAAE,QAAQ;CACtB,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,IAAsD;IAC5F,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,IAAI,CAAC,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,yGAAyG,EAAE,CAAC;QAC1K,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;QAC/E,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACvD,IAAI,SAAS,IAAI,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1D,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YAAC,QAAQ,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC;QAAC,CAAC;QAC9E,OAAO,CAAC,EAAE,CAAC;YAAC,OAAO,EAAE,OAAO,EAAE,eAAe,KAAK,CAAC,OAAO,uBAAuB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QAAC,CAAC;QAC1J,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAqN,CAAC;QAC5O,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACtH,OAAO;YACL,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC1F,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE;YACnP,IAAI,EAAE,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,sGAAsG,CAAC,CAAC,CAAC,qBAAqB,IAAI,cAAc,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,8BAA8B,qBAAqB;YAC/R,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/tools/invoke.d.ts

@@ -0,0 +1,59 @@
+import type { ToolSpec, ToolInvoker } from '@agenticprimitives/orchestration';
+import { type SubjectAskV1 } from '@agenticprimitives/a2a';
+import type { Address } from '@agenticprimitives/types';
+import { type NameRecordsPort } from './external.js';
+import type { AskReplyEnvelopeV1 } from '../run.js';
+export declare const ENGAGEMENT_INVOKE_CAPABILITY: "engagement.agent.invoke";
+export declare const ENGAGEMENT_INVOKE_TOOL: ToolSpec;
+/** Spec 366 — WHAT THE SUBJECT'S AGENT SAID, read from its `/harness/ask` envelope. Pure. An `answer` for the routed tool
+ *  is the result; anything else is relayed in the subject's own words — never retried, never guessed. Reading `kind` off
+ *  the ENVELOPE instead of `reply` once made every real answer read as "needs more". */
+export declare function readSubjectReply(envelope: (AskReplyEnvelopeV1 & {
+    subjectAnswer?: {
+        outcome?: string;
+        said?: string;
+        result?: unknown;
+        run?: {
+            runRef: string;
+            receipts?: Array<{
+                stepRef: string;
+                capability?: string;
+                status: string;
+            }>;
+        };
+    };
+}) | null, toolId: string, who: string, status: number): {
+    ok: boolean;
+    result?: unknown;
+    refused?: string;
+    needs?: boolean;
+    said?: string;
+    runRef?: string;
+    receipts?: Array<{
+        stepRef: string;
+        capability?: string;
+        status: string;
+    }>;
+};
+export interface InvokeDeps {
+    /** The name's records: where the subject's card is. An address needs a name here too (`nameOf`), or it cannot be reached. */
+    nameRecords?: NameRecordsPort;
+    nameOf?: (address: string) => Promise<string | null>;
+    fetch: (input: string, init: RequestInit) => Promise<Response>;
+    /** The asker's credential the profile carries — a forwarded app credential, or nothing (an agent asking as itself). */
+    credentialFor?: () => SubjectAskV1['asker']['credential'];
+    /** The request's trace, carried into the hop (spec 390 W2). */
+    trace?: () => {
+        traceparent?: string;
+        tracestate?: string;
+    } | null;
+    now?: () => number;
+}
+/** The invoker for ONE run: who asks and which run/step the hop belongs to are fixed at construction, by the turn. */
+export declare function engagementInvokeInvoker(run: {
+    asker: Address;
+    runRef: string;
+    intentDigest: string;
+    operationId?: () => string;
+}, deps: InvokeDeps): ToolInvoker;
+//# sourceMappingURL=invoke.d.ts.map

package/dist/tools/invoke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invoke.d.ts","sourceRoot":"","sources":["../../src/tools/invoke.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAA2C,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEpG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAA0B,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEpD,eAAO,MAAM,4BAA4B,EAAG,yBAAkC,CAAC;AAE/E,eAAO,MAAM,sBAAsB,EAAE,QAoBpC,CAAC;AAEF;;wFAEwF;AACxF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,CAAC,kBAAkB,GAAG;IAAE,aAAa,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;gBAAE,OAAO,EAAE,MAAM,CAAC;gBAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBAAC,MAAM,EAAE,MAAM,CAAA;aAAE,CAAC,CAAA;SAAE,CAAA;KAAE,CAAA;CAAE,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAoBvd;AAED,MAAM,WAAW,UAAU;IACzB,6HAA6H;IAC7H,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrD,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,uHAAuH;IACvH,aAAa,CAAC,EAAE,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC;IAC1D,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACnE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,sHAAsH;AACtH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE,EAAE,IAAI,EAAE,UAAU,GAAG,WAAW,CA6BhK"}

package/dist/tools/invoke.js

@@ -0,0 +1,92 @@
+import { sendSubjectAskOverWire, routedRunRefFor } from '@agenticprimitives/a2a';
+import { STANDARD_SURFACE_SKILL } from '@agenticprimitives/a2a/standard';
+import { cardOfName, TYPED_NAME } from './external.js';
+export const ENGAGEMENT_INVOKE_CAPABILITY = 'engagement.agent.invoke';
+export const ENGAGEMENT_INVOKE_TOOL = {
+    id: ENGAGEMENT_INVOKE_CAPABILITY,
+    answers: ['ask them', 'engage', 'what does the organization say'],
+    verbs: ['engage', 'ask', 'consult'],
+    description: 'ENGAGES A DISCOVERED AGENT: sends the person\'s words, as them, to another agent — one discovery.agents.find returned '
+        + '(its name or address) or one the person named — and returns that agent\'s own answer, made under ITS OWN playbook '
+        + 'from its own catalog or records. The answer is that agent\'s, with its source named; it is never a record of ours. If '
+        + 'the other agent needs its own steward\'s authority, it says so and the ask waits there. Args: agent (the name — '
+        + 'catalog.svc — or 0x address, as discovery returned it), message (what to ask, in the person\'s words, complete — '
+        + 'the other agent sees only this).',
+    inputSchema: {
+        type: 'object',
+        properties: {
+            agent: { type: 'string', description: 'The other agent\'s name (catalog.svc) or 0x address' },
+            message: { type: 'string', description: 'The ask, complete and in the person\'s words' },
+        },
+        required: ['agent', 'message'],
+    },
+    establishes: 'lookup',
+};
+/** Spec 366 — WHAT THE SUBJECT'S AGENT SAID, read from its `/harness/ask` envelope. Pure. An `answer` for the routed tool
+ *  is the result; anything else is relayed in the subject's own words — never retried, never guessed. Reading `kind` off
+ *  the ENVELOPE instead of `reply` once made every real answer read as "needs more". */
+export function readSubjectReply(envelope, toolId, who, status) {
+    if (!envelope)
+        return { ok: false, refused: `${who} answered with something that was not a reply (${status})` };
+    const sa = envelope.subjectAnswer;
+    if (sa?.outcome) {
+        const receipts = sa.run?.receipts;
+        if (sa.outcome === 'answer')
+            return { ok: true, result: sa.result, ...(sa.run?.runRef ? { runRef: sa.run.runRef } : {}), ...(receipts ? { receipts } : {}) };
+        const why = (sa.said ?? '').trim() || String(envelope.reply?.error ?? envelope.error ?? '').trim() || 'it gave no reason';
+        return { ok: false, refused: `${who} ${sa.outcome === 'refused' ? 'refused' : sa.outcome === 'needs' ? 'needs more before it can answer —' : 'could not answer:'} ${why}`, ...(sa.outcome === 'needs' ? { needs: true, said: sa.said ?? '' } : {}), ...(sa.run?.runRef ? { runRef: sa.run.runRef } : {}) };
+    }
+    if (envelope.ok === false || envelope.error)
+        return { ok: false, refused: `${who} refused: ${envelope.error ?? status}` };
+    const reply = envelope.reply;
+    if (!reply)
+        return { ok: false, refused: `${who} answered with no reply (${status})` };
+    const runRef = reply.runRef ?? envelope.runRef;
+    if (reply.kind === 'answer' || reply.kind === 'done') {
+        const hit = reply.results?.find((r) => r.toolId === toolId) ?? reply.results?.[0];
+        return { ok: true, result: hit ? hit.result : { text: reply.text }, ...(runRef ? { runRef } : {}), ...(reply.receipts ? { receipts: reply.receipts } : {}) };
+    }
+    if (reply.kind === 'prompt')
+        return { ok: false, needs: true, said: reply.text, refused: `${who} needs more before it can answer — ${reply.text}`, ...(runRef ? { runRef } : {}) };
+    if (reply.kind === 'authority_required')
+        return { ok: false, refused: `${who} needs its steward's authority for that — it waits there`, ...(runRef ? { runRef } : {}) };
+    return { ok: false, refused: `${who} refused: ${reply.text || status}`, ...(runRef ? { runRef } : {}) };
+}
+/** The invoker for ONE run: who asks and which run/step the hop belongs to are fixed at construction, by the turn. */
+export function engagementInvokeInvoker(run, deps) {
+    return async (toolId, args, ctx) => {
+        const said = String(args.agent ?? '').trim().toLowerCase();
+        const message = String(args.message ?? '').trim();
+        if (!said)
+            return { refused: 'name the agent to engage (a registry name or an address)' };
+        if (!message)
+            return { refused: 'nothing to ask — the message is empty' };
+        if (!deps.nameRecords)
+            return { refused: 'no name records are readable here — nothing can be reached' };
+        const name = /^0x[0-9a-f]{40}$/.test(said) ? await deps.nameOf?.(said).catch(() => null) : TYPED_NAME.test(said) ? said : null;
+        if (!name)
+            return { refused: `“${said}” is neither a registry name nor an address with a name — nothing to reach` };
+        const where = await cardOfName(name, deps.nameRecords);
+        if ('refused' in where)
+            return { refused: where.refused };
+        const stepRef = ctx.step.id ?? `s${ctx.index + 1}`;
+        const profile = {
+            extension: 'https://agenticprimitives.org/a2a/subject-ask/v1',
+            version: 1,
+            request: { capability: STANDARD_SURFACE_SKILL, args: {}, goal: message },
+            asker: { agent: run.asker, credential: deps.credentialFor?.() ?? { kind: 'none' } },
+            correlation: { operationId: run.operationId?.() ?? `${run.runRef}:${stepRef}`, runRef: run.runRef, stepRef, intentDigest: run.intentDigest },
+        };
+        const trace = deps.trace?.() ?? null;
+        const hop = await sendSubjectAskOverWire({ ...(trace?.traceparent ? { traceparent: trace.traceparent } : {}), ...(trace?.tracestate ? { tracestate: trace.tracestate } : {}), cardUrl: where.cardUrl, ...(where.pinnedDigest ? { pinnedDigest: where.pinnedDigest } : {}), profile, fetch: deps.fetch });
+        const via = { agent: name, cardUrl: where.cardUrl, receiverRunRef: routedRunRefFor(profile.correlation) };
+        if (!hop.ok)
+            return { refused: `${name} could not be asked over the wire — ${hop.refused}`, via };
+        const read = readSubjectReply(hop.envelope, toolId, name, 200);
+        const viaRun = { ...via, ...(read.runRef ? { runRef: read.runRef } : {}), ...(read.receipts?.length ? { receipts: read.receipts } : {}) };
+        return read.ok
+            ? { ...(read.result && typeof read.result === 'object' ? read.result : { text: String(read.result ?? '') }), via: viaRun, untrusted: true, note: `${name}'s own answer, under its own playbook — an observation with its source named, never a record of ours and never authority.` }
+            : { refused: read.refused ?? `${name} did not answer`, via: viaRun, ...(read.needs ? { needs: true, said: read.said ?? '' } : {}) };
+    };
+}
+//# sourceMappingURL=invoke.js.map

package/dist/tools/invoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invoke.js","sourceRoot":"","sources":["../../src/tools/invoke.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAqB,MAAM,wBAAwB,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAwB,MAAM,eAAe,CAAC;AAG7E,MAAM,CAAC,MAAM,4BAA4B,GAAG,yBAAkC,CAAC;AAE/E,MAAM,CAAC,MAAM,sBAAsB,GAAa;IAC9C,EAAE,EAAE,4BAA4B;IAChC,OAAO,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,gCAAgC,CAAC;IACjE,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC;IACnC,WAAW,EACT,wHAAwH;UACtH,oHAAoH;UACpH,wHAAwH;UACxH,kHAAkH;UAClH,mHAAmH;UACnH,kCAAkC;IACtC,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qDAAqD,EAAE;YAC7F,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8CAA8C,EAAE;SACzF;QACD,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;KAC/B;IACD,WAAW,EAAE,QAAQ;CACtB,CAAC;AAEF;;wFAEwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,QAAuN,EAAE,MAAc,EAAE,GAAW,EAAE,MAAc;IACnS,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,kDAAkD,MAAM,GAAG,EAAE,CAAC;IAChH,MAAM,EAAE,GAAG,QAAQ,CAAC,aAAa,CAAC;IAClC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC;QAClC,IAAI,EAAE,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7J,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAE,QAAQ,CAAC,KAAwC,EAAE,KAAK,IAAI,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,mBAAmB,CAAC;QAC9J,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,mBAAmB,IAAI,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC7S,CAAC;IACD,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI,QAAQ,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,aAAa,QAAQ,CAAC,KAAK,IAAI,MAAM,EAAE,EAAE,CAAC;IAC1H,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,4BAA4B,MAAM,GAAG,EAAE,CAAC;IACvF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC;IAC/C,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAClF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/J,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,GAAG,sCAAsC,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACnL,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,0DAA0D,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACxK,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,aAAa,KAAK,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1G,CAAC;AAcD,sHAAsH;AACtH,MAAM,UAAU,uBAAuB,CAAC,GAAyF,EAAE,IAAgB;IACjJ,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC;QAC1F,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;QAC1E,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC;QACxG,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/H,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,4EAA4E,EAAE,CAAC;QACpH,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACvD,IAAI,SAAS,IAAI,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,OAAO,GAAiB;YAC5B,SAAS,EAAE,kDAA+E;YAC1F,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,EAAE,UAAU,EAAE,sBAAsB,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YACxE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,IAAK,EAAE,IAAI,EAAE,MAAM,EAAqD,EAAE;YACvI,WAAW,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,GAAG,GAAG,CAAC,MAAM,IAAI,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE;SAC7I,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI,CAAC;QACrC,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACzS,MAAM,GAAG,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1G,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,uCAAuC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC;QAClG,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAyC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1I,OAAO,IAAI,CAAC,EAAE;YACZ,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,MAAkC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,2HAA2H,EAAE;YAClT,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,GAAG,IAAI,iBAAiB,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACxI,CAAC,CAAC;AACJ,CAAC"}

package/dist/wire-admission.d.ts

@@ -0,0 +1,52 @@
+import type { Address, Hex } from '@agenticprimitives/types';
+import type { Delegation } from '@agenticprimitives/delegation';
+import { type DelegationWireV1 } from '@agenticprimitives/a2a/standard';
+import type { AdmissionPorts } from './routes.js';
+import type { RunStore } from './run-store.js';
+/** The skill a READ wire pins: `/harness/runs|records|progress|provenance` under it, never `/harness/ask`. */
+export declare const HARNESS_READ_SKILL: "harness.read";
+/** The assertion method → the skill the wire must name. `null` ⇒ the method is not admitted under any wire here. */
+export declare function skillForMethod(method: string): string | null;
+export interface WireAdmissionDeps {
+    /** This agent — the only delegator a wire presented here may name. */
+    agent: Address;
+    /** The deployment's enforcer addresses the wire's caveats must carry. */
+    enforcers: {
+        timestamp: string;
+        allowedMethods: string;
+    };
+    /** ERC-1271 / ECDSA verification of the wire against its delegator — the app's chain read (a validator contract). */
+    verifyDelegationSig: (d: Delegation) => Promise<boolean>;
+    /** On-chain revocation — a custodian's revoke kills the caller at the next request. */
+    isRevoked: (d: Delegation) => Promise<boolean>;
+    /** The agent's own object spends each assertion once (`assertion-claim`). */
+    runStore: Pick<RunStore, 'claimAssertion'>;
+    /** Which skill each method requires; default `skillForMethod`. */
+    skillFor?: (method: string) => string | null;
+    maxAgeSec?: number;
+    skewSec?: number;
+    now?: () => number;
+    /** Why a caller was refused — for the operator's log, never the caller. */
+    onRefused?: (reason: string, agent?: string) => void;
+}
+/** The `AdmissionPorts.wire` port over the a2a session-wire principal: the admitted agent is the wire's DELEGATOR, and it
+ *  must be this agent — a wire some other agent issued is not a credential here, whoever signed it. */
+export declare function wireAdmission(deps: WireAdmissionDeps): NonNullable<AdmissionPorts['wire']>;
+/** THE CLIENT HALF of a read — what the Home's runtime sends a self-hosted agent: the `/harness/<read>` body as the bytes the
+ *  assertion hashes (`method: harness.read`, a fresh nonce so the agent's ledger spends each once) and the `A2A-Session`
+ *  headers signed by the wire's delegate key over them. The signer is the runtime's own (a KMS account, never a person's key). */
+export declare function wireReadRequest(input: {
+    /** The self-hosted agent's wire: delegator = that agent, delegate = this runtime's key, pinned `harness.read`. */
+    wire: DelegationWireV1;
+    /** The read's fields (`runRef`, `after`, `full`, …); `addressee` defaults to the wire's delegator. */
+    body: Record<string, unknown>;
+    /** The self-hosted agent's origin (`https://host`). */
+    audience: string;
+    signDigest: (digest: Hex) => Promise<Hex>;
+    nonce?: string;
+    now?: () => number;
+}): Promise<{
+    raw: string;
+    headers: Record<string, string>;
+}>;
+//# sourceMappingURL=wire-admission.d.ts.map

package/dist/wire-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-admission.d.ts","sourceRoot":"","sources":["../src/wire-admission.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAmE,KAAK,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACzI,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,8GAA8G;AAC9G,eAAO,MAAM,kBAAkB,EAAG,cAAuB,CAAC;AAE1D,oHAAoH;AACpH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI5D;AAED,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,KAAK,EAAE,OAAO,CAAC;IACf,yEAAyE;IACzE,SAAS,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,qHAAqH;IACrH,mBAAmB,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,uFAAuF;IACvF,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,6EAA6E;IAC7E,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD;AAED;uGACuG;AACvG,wBAAgB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAoB1F;AAED;;kIAEkI;AAClI,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,kHAAkH;IAClH,IAAI,EAAE,gBAAgB,CAAC;IACvB,sGAAsG;IACtG,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC,CAM5D"}

package/dist/wire-admission.js

@@ -0,0 +1,49 @@
+import { sessionWirePrincipal, sessionWireSigner, STANDARD_SURFACE_SKILL } from '@agenticprimitives/a2a/standard';
+/** The skill a READ wire pins: `/harness/runs|records|progress|provenance` under it, never `/harness/ask`. */
+export const HARNESS_READ_SKILL = 'harness.read';
+/** The assertion method → the skill the wire must name. `null` ⇒ the method is not admitted under any wire here. */
+export function skillForMethod(method) {
+    if (method === STANDARD_SURFACE_SKILL)
+        return STANDARD_SURFACE_SKILL;
+    if (method === HARNESS_READ_SKILL)
+        return HARNESS_READ_SKILL;
+    return null;
+}
+/** The `AdmissionPorts.wire` port over the a2a session-wire principal: the admitted agent is the wire's DELEGATOR, and it
+ *  must be this agent — a wire some other agent issued is not a credential here, whoever signed it. */
+export function wireAdmission(deps) {
+    const self = deps.agent.toLowerCase();
+    const principal = sessionWirePrincipal({
+        enforcers: deps.enforcers,
+        verifyDelegationSig: deps.verifyDelegationSig,
+        isRevoked: deps.isRevoked,
+        skill: deps.skillFor ?? skillForMethod,
+        claim: async (digest, expiresAt) => (await deps.runStore.claimAssertion(deps.agent, digest, expiresAt)).claimed,
+        ...(deps.maxAgeSec !== undefined ? { maxAgeSec: deps.maxAgeSec } : {}),
+        ...(deps.skewSec !== undefined ? { skewSec: deps.skewSec } : {}),
+        ...(deps.now ? { now: deps.now } : {}),
+        ...(deps.onRefused ? { onRefused: deps.onRefused } : {}),
+    });
+    return async (request, raw) => {
+        const auth = request.headers.get('authorization') ?? '';
+        const p = await principal(new Request(request.url, { method: 'POST', headers: { authorization: auth, 'content-type': 'application/json' }, body: raw }));
+        if (!p)
+            return null;
+        if (p.agent.toLowerCase() !== self) {
+            deps.onRefused?.(`the wire's delegator is ${p.agent}, not this agent`, p.agent);
+            return null;
+        }
+        return { agent: p.agent.toLowerCase() };
+    };
+}
+/** THE CLIENT HALF of a read — what the Home's runtime sends a self-hosted agent: the `/harness/<read>` body as the bytes the
+ *  assertion hashes (`method: harness.read`, a fresh nonce so the agent's ledger spends each once) and the `A2A-Session`
+ *  headers signed by the wire's delegate key over them. The signer is the runtime's own (a KMS account, never a person's key). */
+export async function wireReadRequest(input) {
+    const nonce = input.nonce ?? [...crypto.getRandomValues(new Uint8Array(8))].map((b) => b.toString(16).padStart(2, '0')).join('');
+    const raw = JSON.stringify({ method: HARNESS_READ_SKILL, nonce, addressee: input.wire.delegator, ...input.body });
+    const sign = sessionWireSigner({ agent: input.wire.delegator, wire: input.wire, signDigest: input.signDigest, audience: input.audience, ...(input.now ? { now: input.now } : {}) });
+    const headers = await sign(raw, HARNESS_READ_SKILL);
+    return { raw, headers: { 'content-type': 'application/json', accept: 'application/json', ...headers } };
+}
+//# sourceMappingURL=wire-admission.js.map

package/dist/wire-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-admission.js","sourceRoot":"","sources":["../src/wire-admission.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,sBAAsB,EAAyB,MAAM,iCAAiC,CAAC;AAIzI,8GAA8G;AAC9G,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAuB,CAAC;AAE1D,oHAAoH;AACpH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,IAAI,MAAM,KAAK,sBAAsB;QAAE,OAAO,sBAAsB,CAAC;IACrE,IAAI,MAAM,KAAK,kBAAkB;QAAE,OAAO,kBAAkB,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC;AAsBD;uGACuG;AACvG,MAAM,UAAU,aAAa,CAAC,IAAuB;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,oBAAoB,CAAC;QACrC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,QAAQ,IAAI,cAAc;QACtC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO;QAC/G,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC,CAAC;IACH,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACzJ,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,SAAS,EAAE,CAAC,2BAA2B,CAAC,CAAC,KAAK,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACrI,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAa,EAAE,CAAC;IACrD,CAAC,CAAC;AACJ,CAAC;AAED;;kIAEkI;AAClI,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAUrC;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjI,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAClH,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,SAAoB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/L,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACpD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC;AAC1G,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/service-host",
-  "version": "0.0.0-alpha.0",
+  "version": "0.0.0-alpha.10",
   "description": "The Service Host (spec 433): the harness run pipeline a service agent embeds — run store, progress, routes, tools, provenance sink — so a service built as an app runs the same harness the runtime hosts. W1 step 1: the run store behind a port.",
   "homepage": "https://agenticprimitives.dev",
   "bugs": {
@@ -28,9 +28,12 @@
     "README.md"
   ],
   "dependencies": {
-    "@agenticprimitives/types": "1.0.0-alpha.30",
-    "@agenticprimitives/a2a": "0.0.0-alpha.28",
-    "@agenticprimitives/orchestration": "0.0.0-alpha.9"
+    "@agenticprimitives/a2a": "0.0.0-alpha.34",
+    "@agenticprimitives/delegation": "1.0.0-alpha.33",
+    "@agenticprimitives/harness": "0.0.0-alpha.14",
+    "@agenticprimitives/orchestration": "0.0.0-alpha.13",
+    "@agenticprimitives/provenance": "0.0.0-alpha.5",
+    "@agenticprimitives/types": "1.0.0-alpha.33"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20240117.0",