@agenticprimitives/service-host 0.0.0-alpha.27 → 0.0.0-alpha.29

package/dist/tools/outbound.js

@@ -0,0 +1,93 @@
+// OUTBOUND CONTAINMENT — spec 445 W0 (audit 2026-11-10, RUN-4). `external.agent.ask` and `engagement.agent.invoke` send
+// words to ANOTHER PARTY. Both are informational (no capability, no mandate), so once a run has read untrusted content —
+// a tool result, another agent's reply, a message someone else wrote — nothing but prompt wording stopped that content
+// from steering an outbound call that carries private-tier text to a host of its author's choosing. Containment is
+// mechanical here, at the point of use, in three parts:
+//   (a) `neutraliseDataDelimiters` — untrusted text can no longer close the `<data>…</data>` frame a continuation
+//       prompt puts it in (the frame is built in orchestration's `renderContinuation`; this package builds none, so the
+//       text is neutralised where this package PRODUCES and RELAYS it: the two tools' own results and every
+//       untrusted-labelled result that passes through `runTurn`'s invoke wrapper);
+//   (b) `guardOutbound` — after untrusted content, an outbound cross-party call needs an EXPLICIT decision. The capability
+//       contract model has no "disclose to an external party" requirement type (`SkillExecutionContractV1`), so the call
+//       PARKS for the person's confirmation through the loop's own parking mechanism (`InputRequired`, kind
+//       `confirmation`) and runs only when the resume carries a confirmation BOUND to exactly what would be sent
+//       (`disclosureDigest` over the party and the outgoing arguments). A host may bind `OutboundDisclosurePort` to decide
+//       otherwise (a derivation rule, a standing policy); the default parks, and parks when the signal is unavailable;
+//   (c) what leaves is the step's own arguments — never the conversation, the intent or earlier results.
+// A confirmation is an INPUT from the run's owner, never authority: the tools still spend none.
+import { InputRequired, outboundDigest } from '@agenticprimitives/orchestration';
+/** The safe default: silent only when the run is KNOWN to have read nothing untrusted; otherwise it parks. */
+export const defaultOutboundDisclosure = (request) => (request.untrustedSeen === false ? 'allow' : 'park');
+const canonical = (v) => {
+    if (v === null || typeof v !== 'object')
+        return JSON.stringify(v) ?? 'null';
+    if (Array.isArray(v))
+        return `[${v.map(canonical).join(',')}]`;
+    return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${canonical(v[k])}`).join(',')}}`;
+};
+/** The digest a confirmation is bound to: a `yes` to one disclosure is not a `yes` to another. */
+export async function disclosureDigest(input) {
+    const bytes = new TextEncoder().encode(canonical({ party: input.party, sends: input.sends, toolId: input.toolId }));
+    const hash = new Uint8Array(await crypto.subtle.digest('SHA-256', bytes));
+    return `0x${[...hash].map((b) => b.toString(16).padStart(2, '0')).join('')}`;
+}
+/**
+ * The gate every outbound tool passes BEFORE any byte leaves (the card fetch included — a URL can carry data).
+ * Returns `null` to proceed, `{ refused }` when the decision or the person said no; THROWS `InputRequired` to park.
+ */
+export async function guardOutbound(ctx, toolId, party, sends, decide = defaultOutboundDisclosure, 
+/** The step's arguments exactly as the loop resolved them — what the LOOP's outbound gate (orchestration
+ *  `ToolSpec.outbound`, spec 445 decision 8) bound the person's confirmation to (`outboundDigest`). */
+stepArgs) {
+    const stepRef = ctx?.step?.id ?? `s${Number(ctx?.index ?? 0) + 1}`;
+    const digest = await disclosureDigest({ toolId, party, sends });
+    const untrustedSeen = typeof ctx?.untrustedSeen === 'boolean' ? ctx.untrustedSeen : undefined;
+    let decision;
+    try {
+        decision = await decide({ toolId, stepRef, party, sends, untrustedSeen, goal: String(ctx?.intent?.goal ?? ''), digest });
+    }
+    catch {
+        decision = 'park';
+    }
+    if (decision === 'allow')
+        return null;
+    if (decision === 'refuse')
+        return { refused: `nothing was sent to ${party}: this run has read content written by others, and sending to an outside party after that is not permitted here` };
+    // Spec 445 decision 8 — DEFENCE IN DEPTH BESIDE THE LOOP. The tool is declared `outbound` on its ToolSpec, so the loop
+    // parks it first and confirms the person's answer against `outboundDigest(toolId, args)`. That confirmation, recomputed
+    // here over these exact arguments, is the same decision — accepted, not asked twice under a second digest.
+    if (ctx?.outboundConfirmed && stepArgs && ctx.outboundConfirmed === (await outboundDigest(toolId, stepArgs)))
+        return null;
+    const answers = (ctx?.supplied ?? []).filter((s) => s.stepRef === stepRef);
+    if (answers.some((s) => s.confirmed === false))
+        return { refused: `nothing was sent to ${party} — the person declined` };
+    if (answers.some((s) => s.confirmed === true && String(s.data?.disclosure ?? '') === digest))
+        return null;
+    throw new InputRequired({
+        kind: 'confirmation', stepRef, toolId,
+        prompt: `This run has read content written by others. Send this to ${party}? Nothing leaves until you confirm exactly this.`,
+        summary: { party, sends, disclosure: digest, why: untrustedSeen === undefined ? 'untrusted-signal-unavailable' : 'untrusted-content-seen', confirmWith: { confirmed: true, data: { disclosure: digest } } },
+    });
+}
+const DELIMITER = /<(\s*\/?\s*data\b[^<>]*)>/gi;
+const neutraliseText = (s) => s.replace(DELIMITER, '&lt;$1&gt;');
+/** (a) No string in an untrusted value keeps a `<data>` / `</data>` tag: the frame a prompt puts it in cannot be closed
+ *  or re-opened from inside. Keys and values, at any depth; non-strings are untouched. */
+export function neutraliseDataDelimiters(value) {
+    if (typeof value === 'string')
+        return neutraliseText(value);
+    if (Array.isArray(value))
+        return value.map((v) => neutraliseDataDelimiters(v));
+    if (value && typeof value === 'object' && Object.getPrototypeOf(value) === Object.prototype) {
+        const out = {};
+        for (const [k, v] of Object.entries(value))
+            out[neutraliseText(k)] = neutraliseDataDelimiters(v);
+        return out;
+    }
+    return value;
+}
+/** Does a tool result carry untrusted content — the label the loop reads (`untrusted: true` / `x-ap-untrusted`). */
+export function isUntrustedResult(result) {
+    return !!result && typeof result === 'object' && (result.untrusted === true || result['x-ap-untrusted'] === true);
+}
+//# sourceMappingURL=outbound.js.map

package/dist/tools/outbound.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound.js","sourceRoot":"","sources":["../../src/tools/outbound.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,yHAAyH;AACzH,uHAAuH;AACvH,mHAAmH;AACnH,wDAAwD;AACxD,kHAAkH;AAClH,wHAAwH;AACxH,4GAA4G;AAC5G,mFAAmF;AACnF,2HAA2H;AAC3H,yHAAyH;AACzH,4GAA4G;AAC5G,iHAAiH;AACjH,2HAA2H;AAC3H,uHAAuH;AACvH,yGAAyG;AACzG,gGAAgG;AAChG,OAAO,EAAE,aAAa,EAAE,cAAc,EAAsB,MAAM,kCAAkC,CAAC;AAuBrG,8GAA8G;AAC9G,MAAM,CAAC,MAAM,yBAAyB,GAA2B,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnI,MAAM,SAAS,GAAG,CAAC,CAAU,EAAU,EAAE;IACvC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAC5E,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC/D,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAA4B,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAE,CAA6B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC9J,CAAC,CAAC;AAEF,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAwE;IAC7G,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACpH,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAsH,EACtH,MAAc,EAAE,KAAa,EAAE,KAA8B,EAAE,SAAiC,yBAAyB;AACzH;uGACuG;AACvG,QAAkC;IAElC,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,MAAM,aAAa,GAAG,OAAO,GAAG,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,IAAI,QAAoC,CAAC;IACzC,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAAC,CAAC;IACjI,MAAM,CAAC;QAAC,QAAQ,GAAG,MAAM,CAAC;IAAC,CAAC;IAC5B,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,uBAAuB,KAAK,iHAAiH,EAAE,CAAC;IAC7L,uHAAuH;IACvH,wHAAwH;IACxH,2GAA2G;IAC3G,IAAI,GAAG,EAAE,iBAAiB,IAAI,QAAQ,IAAI,GAAG,CAAC,iBAAiB,KAAK,CAAC,MAAM,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1H,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,uBAAuB,KAAK,wBAAwB,EAAE,CAAC;IACzH,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAE,CAAC,CAAC,IAA6C,EAAE,UAAU,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACpJ,MAAM,IAAI,aAAa,CAAC;QACtB,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM;QACrC,MAAM,EAAE,6DAA6D,KAAK,kDAAkD;QAC5H,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,wBAAwB,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE;KAC5M,CAAC,CAAC;AACL,CAAC;AAED,MAAM,SAAS,GAAG,6BAA6B,CAAC;AAChD,MAAM,cAAc,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;AAEjF;0FAC0F;AAC1F,MAAM,UAAU,wBAAwB,CAAI,KAAQ;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC,KAAK,CAAiB,CAAC;IAC5E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAiB,CAAC;IAC/F,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5F,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;YAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;QAC5H,OAAO,GAAQ,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,iBAAiB,CAAC,MAAe;IAC/C,OAAO,CAAC,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAE,MAAkC,CAAC,SAAS,KAAK,IAAI,IAAK,MAAkC,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC,CAAC;AAC9K,CAAC"}

package/dist/wire-admission.d.ts

@@ -1,6 +1,7 @@
 import type { Address, Hex } from '@agenticprimitives/types';
 import type { Delegation } from '@agenticprimitives/delegation';
 import { type DelegationWireV1 } from '@agenticprimitives/a2a/standard';
+import type { SessionWireCaveatCheck } from '@agenticprimitives/a2a';
 import type { AdmissionPorts } from './routes.js';
 import type { RunStore } from './run-store.js';
 /** The skill a READ wire pins: `/harness/runs|records|progress|provenance` under it, never `/harness/ask`. */
@@ -10,10 +11,12 @@ export declare function skillForMethod(method: string): string | null;
 export interface WireAdmissionDeps {
     /** This agent — the only delegator a wire presented here may name. */
     agent: Address;
-    /** The deployment's enforcer addresses the wire's caveats must carry. */
+    /** The deployment's enforcer addresses the wire's caveats must carry. All three: the wire's allowedTargets caveat must
+     *  name THIS agent (RUN-9 — a wire minted for another host, or for none, is not a credential here). */
     enforcers: {
         timestamp: string;
         allowedMethods: string;
+        allowedTargets: string;
     };
     /** ERC-1271 / ECDSA verification of the wire against its delegator — the app's chain read (a validator contract). */
     verifyDelegationSig: (d: Delegation) => Promise<boolean>;
@@ -23,6 +26,9 @@ export interface WireAdmissionDeps {
     runStore: Pick<RunStore, 'claimAssertion'>;
     /** Which skill each method requires; default `skillForMethod`. */
     skillFor?: (method: string) => string | null;
+    /** RUNB-17 (spec 445 §9 decision 8) — caveats beyond the three that this host ENFORCES, each with its check. A wire
+     *  carrying any other caveat is refused (a2a `checkSessionWireShape`). */
+    recognisedCaveats?: readonly SessionWireCaveatCheck[];
     maxAgeSec?: number;
     skewSec?: number;
     now?: () => number;

package/dist/wire-admission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wire-admission.d.ts","sourceRoot":"","sources":["../src/wire-admission.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAmE,KAAK,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACzI,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,8GAA8G;AAC9G,eAAO,MAAM,kBAAkB,EAAG,cAAuB,CAAC;AAE1D,oHAAoH;AACpH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI5D;AAED,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,KAAK,EAAE,OAAO,CAAC;IACf,yEAAyE;IACzE,SAAS,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,qHAAqH;IACrH,mBAAmB,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,uFAAuF;IACvF,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,6EAA6E;IAC7E,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD;AAED;uGACuG;AACvG,wBAAgB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAoB1F;AAED;;kIAEkI;AAClI,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,kHAAkH;IAClH,IAAI,EAAE,gBAAgB,CAAC;IACvB,sGAAsG;IACtG,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC,CAM5D"}
+{"version":3,"file":"wire-admission.d.ts","sourceRoot":"","sources":["../src/wire-admission.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAmE,KAAK,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACzI,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,8GAA8G;AAC9G,eAAO,MAAM,kBAAkB,EAAG,cAAuB,CAAC;AAE1D,oHAAoH;AACpH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI5D;AAED,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,KAAK,EAAE,OAAO,CAAC;IACf;2GACuG;IACvG,SAAS,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IACjF,qHAAqH;IACrH,mBAAmB,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,uFAAuF;IACvF,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,6EAA6E;IAC7E,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC7C;8EAC0E;IAC1E,iBAAiB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD;AAED;uGACuG;AACvG,wBAAgB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAuB1F;AAED;;kIAEkI;AAClI,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,kHAAkH;IAClH,IAAI,EAAE,gBAAgB,CAAC;IACvB,sGAAsG;IACtG,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC,CAM5D"}

package/dist/wire-admission.js

@@ -15,10 +15,13 @@ export function wireAdmission(deps) {
     const self = deps.agent.toLowerCase();
     const principal = sessionWirePrincipal({
         enforcers: deps.enforcers,
+        // The host's OWN identity, never anything the request says: the wire must have been minted for this agent.
+        target: deps.agent,
         verifyDelegationSig: deps.verifyDelegationSig,
         isRevoked: deps.isRevoked,
         skill: deps.skillFor ?? skillForMethod,
         claim: async (digest, expiresAt) => (await deps.runStore.claimAssertion(deps.agent, digest, expiresAt)).claimed,
+        ...(deps.recognisedCaveats ? { recognisedCaveats: deps.recognisedCaveats } : {}),
         ...(deps.maxAgeSec !== undefined ? { maxAgeSec: deps.maxAgeSec } : {}),
         ...(deps.skewSec !== undefined ? { skewSec: deps.skewSec } : {}),
         ...(deps.now ? { now: deps.now } : {}),

package/dist/wire-admission.js.map

@@ -1 +1 @@
-{"version":3,"file":"wire-admission.js","sourceRoot":"","sources":["../src/wire-admission.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,sBAAsB,EAAyB,MAAM,iCAAiC,CAAC;AAIzI,8GAA8G;AAC9G,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAuB,CAAC;AAE1D,oHAAoH;AACpH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,IAAI,MAAM,KAAK,sBAAsB;QAAE,OAAO,sBAAsB,CAAC;IACrE,IAAI,MAAM,KAAK,kBAAkB;QAAE,OAAO,kBAAkB,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC;AAsBD;uGACuG;AACvG,MAAM,UAAU,aAAa,CAAC,IAAuB;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,oBAAoB,CAAC;QACrC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,QAAQ,IAAI,cAAc;QACtC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO;QAC/G,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC,CAAC;IACH,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACzJ,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,SAAS,EAAE,CAAC,2BAA2B,CAAC,CAAC,KAAK,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACrI,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAa,EAAE,CAAC;IACrD,CAAC,CAAC;AACJ,CAAC;AAED;;kIAEkI;AAClI,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAUrC;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjI,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAClH,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,SAAoB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/L,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACpD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC;AAC1G,CAAC"}
+{"version":3,"file":"wire-admission.js","sourceRoot":"","sources":["../src/wire-admission.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,sBAAsB,EAAyB,MAAM,iCAAiC,CAAC;AAKzI,8GAA8G;AAC9G,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAuB,CAAC;AAE1D,oHAAoH;AACpH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,IAAI,MAAM,KAAK,sBAAsB;QAAE,OAAO,sBAAsB,CAAC;IACrE,IAAI,MAAM,KAAK,kBAAkB;QAAE,OAAO,kBAAkB,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC;AA0BD;uGACuG;AACvG,MAAM,UAAU,aAAa,CAAC,IAAuB;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,oBAAoB,CAAC;QACrC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,2GAA2G;QAC3G,MAAM,EAAE,IAAI,CAAC,KAAK;QAClB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,QAAQ,IAAI,cAAc;QACtC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO;QAC/G,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC,CAAC;IACH,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACzJ,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,SAAS,EAAE,CAAC,2BAA2B,CAAC,CAAC,KAAK,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACrI,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAa,EAAE,CAAC;IACrD,CAAC,CAAC;AACJ,CAAC;AAED;;kIAEkI;AAClI,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAUrC;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjI,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAClH,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,SAAoB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/L,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACpD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC;AAC1G,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/service-host",
-  "version": "0.0.0-alpha.27",
+  "version": "0.0.0-alpha.29",
   "description": "The Service Host (spec 433): the harness run pipeline a service agent embeds — run store, progress, routes, tools, provenance sink — so a service built as an app runs the same harness the runtime hosts. W1 step 1: the run store behind a port.",
   "homepage": "https://agenticprimitives.dev",
   "bugs": {
@@ -28,12 +28,12 @@
     "README.md"
   ],
   "dependencies": {
-    "@agenticprimitives/a2a": "0.0.0-alpha.48",
-    "@agenticprimitives/delegation": "1.0.0-alpha.46",
-    "@agenticprimitives/orchestration": "0.0.0-alpha.27",
-    "@agenticprimitives/provenance": "0.0.0-alpha.6",
-    "@agenticprimitives/types": "1.0.0-alpha.46",
-    "@agenticprimitives/harness": "0.0.0-alpha.30"
+    "@agenticprimitives/a2a": "0.0.0-alpha.50",
+    "@agenticprimitives/delegation": "1.0.0-alpha.48",
+    "@agenticprimitives/harness": "0.0.0-alpha.32",
+    "@agenticprimitives/orchestration": "0.0.0-alpha.29",
+    "@agenticprimitives/provenance": "0.0.0-alpha.7",
+    "@agenticprimitives/types": "1.0.0-alpha.48"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20240117.0",