@agenticprimitives/service-host 0.0.0-alpha.3 → 0.0.0-alpha.5

package/dist/index.d.ts

@@ -24,4 +24,6 @@ export { EXTERNAL_AGENT_CAPABILITY, EXTERNAL_AGENT_TOOL, TYPED_NAME, cardOfName,
 export type { ExternalAgentDeps, NameRecordsPort } from './tools/external.js';
 export { ENGAGEMENT_INVOKE_CAPABILITY, ENGAGEMENT_INVOKE_TOOL, engagementInvokeInvoker, readSubjectReply } from './tools/invoke.js';
 export type { InvokeDeps } from './tools/invoke.js';
+export { HARNESS_READ_SKILL, skillForMethod, wireAdmission, wireReadRequest } from './wire-admission.js';
+export type { WireAdmissionDeps } from './wire-admission.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,YAAY,EAAG,iCAA0C,CAAC;AACvE,eAAO,MAAM,cAAc,EAAG,SAAkB,CAAC;AACjD,eAAO,MAAM,QAAQ,EAAG,wDAAiE,CAAC;AAE1F,OAAO,EACL,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAC1G,eAAe,EAAE,UAAU,GAC5B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,sBAAsB,EAAE,cAAc,EAAE,sBAAsB,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEvJ,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC7F,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAC;AAC3M,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE9H,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAChE,YAAY,EAAE,kBAAkB,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACvG,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjL,YAAY,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtH,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACjH,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AACnH,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACnI,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACpI,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,YAAY,EAAG,iCAA0C,CAAC;AACvE,eAAO,MAAM,cAAc,EAAG,SAAkB,CAAC;AACjD,eAAO,MAAM,QAAQ,EAAG,wDAAiE,CAAC;AAE1F,OAAO,EACL,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAC1G,eAAe,EAAE,UAAU,GAC5B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,sBAAsB,EAAE,cAAc,EAAE,sBAAsB,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEvJ,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC7F,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAC;AAC3M,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE9H,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAChE,YAAY,EAAE,kBAAkB,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACvG,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjL,YAAY,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtH,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACjH,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AACnH,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACnI,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACpI,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACzG,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -15,4 +15,5 @@ export { DISCOVERY_FIND_CAPABILITY, DISCOVERY_FIND_TOOL, planFind, discoveryFind
 export { DISCOVERY_INSPECT_CAPABILITY, DISCOVERY_INSPECT_TOOL, discoveryInspectInvoker } from './tools/inspect.js';
 export { EXTERNAL_AGENT_CAPABILITY, EXTERNAL_AGENT_TOOL, TYPED_NAME, cardOfName, externalAgentInvoker } from './tools/external.js';
 export { ENGAGEMENT_INVOKE_CAPABILITY, ENGAGEMENT_INVOKE_TOOL, engagementInvokeInvoker, readSubjectReply } from './tools/invoke.js';
+export { HARNESS_READ_SKILL, skillForMethod, wireAdmission, wireReadRequest } from './wire-admission.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mHAAmH;AACnH,+GAA+G;AAC/G,MAAM,CAAC,MAAM,YAAY,GAAG,iCAA0C,CAAC;AACvE,MAAM,CAAC,MAAM,cAAc,GAAG,SAAkB,CAAC;AACjD,MAAM,CAAC,MAAM,QAAQ,GAAG,wDAAiE,CAAC;AAE1F,OAAO,EACL,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAC1G,eAAe,EAAE,UAAU,GAC5B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAG7F,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAC;AAG3M,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEhE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjL,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEtH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEjH,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AACnH,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEnI,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mHAAmH;AACnH,+GAA+G;AAC/G,MAAM,CAAC,MAAM,YAAY,GAAG,iCAA0C,CAAC;AACvE,MAAM,CAAC,MAAM,cAAc,GAAG,SAAkB,CAAC;AACjD,MAAM,CAAC,MAAM,QAAQ,GAAG,wDAAiE,CAAC;AAE1F,OAAO,EACL,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAC1G,eAAe,EAAE,UAAU,GAC5B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAG7F,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAC;AAG3M,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEhE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjL,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEtH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEjH,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AACnH,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEnI,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEpI,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/wire-admission.d.ts

@@ -0,0 +1,52 @@
+import type { Address, Hex } from '@agenticprimitives/types';
+import type { Delegation } from '@agenticprimitives/delegation';
+import { type DelegationWireV1 } from '@agenticprimitives/a2a/standard';
+import type { AdmissionPorts } from './routes.js';
+import type { RunStore } from './run-store.js';
+/** The skill a READ wire pins: `/harness/runs|records|progress|provenance` under it, never `/harness/ask`. */
+export declare const HARNESS_READ_SKILL: "harness.read";
+/** The assertion method → the skill the wire must name. `null` ⇒ the method is not admitted under any wire here. */
+export declare function skillForMethod(method: string): string | null;
+export interface WireAdmissionDeps {
+    /** This agent — the only delegator a wire presented here may name. */
+    agent: Address;
+    /** The deployment's enforcer addresses the wire's caveats must carry. */
+    enforcers: {
+        timestamp: string;
+        allowedMethods: string;
+    };
+    /** ERC-1271 / ECDSA verification of the wire against its delegator — the app's chain read (a validator contract). */
+    verifyDelegationSig: (d: Delegation) => Promise<boolean>;
+    /** On-chain revocation — a custodian's revoke kills the caller at the next request. */
+    isRevoked: (d: Delegation) => Promise<boolean>;
+    /** The agent's own object spends each assertion once (`assertion-claim`). */
+    runStore: Pick<RunStore, 'claimAssertion'>;
+    /** Which skill each method requires; default `skillForMethod`. */
+    skillFor?: (method: string) => string | null;
+    maxAgeSec?: number;
+    skewSec?: number;
+    now?: () => number;
+    /** Why a caller was refused — for the operator's log, never the caller. */
+    onRefused?: (reason: string, agent?: string) => void;
+}
+/** The `AdmissionPorts.wire` port over the a2a session-wire principal: the admitted agent is the wire's DELEGATOR, and it
+ *  must be this agent — a wire some other agent issued is not a credential here, whoever signed it. */
+export declare function wireAdmission(deps: WireAdmissionDeps): NonNullable<AdmissionPorts['wire']>;
+/** THE CLIENT HALF of a read — what the Home's runtime sends a self-hosted agent: the `/harness/<read>` body as the bytes the
+ *  assertion hashes (`method: harness.read`, a fresh nonce so the agent's ledger spends each once) and the `A2A-Session`
+ *  headers signed by the wire's delegate key over them. The signer is the runtime's own (a KMS account, never a person's key). */
+export declare function wireReadRequest(input: {
+    /** The self-hosted agent's wire: delegator = that agent, delegate = this runtime's key, pinned `harness.read`. */
+    wire: DelegationWireV1;
+    /** The read's fields (`runRef`, `after`, `full`, …); `addressee` defaults to the wire's delegator. */
+    body: Record<string, unknown>;
+    /** The self-hosted agent's origin (`https://host`). */
+    audience: string;
+    signDigest: (digest: Hex) => Promise<Hex>;
+    nonce?: string;
+    now?: () => number;
+}): Promise<{
+    raw: string;
+    headers: Record<string, string>;
+}>;
+//# sourceMappingURL=wire-admission.d.ts.map

package/dist/wire-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-admission.d.ts","sourceRoot":"","sources":["../src/wire-admission.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAmE,KAAK,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACzI,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,8GAA8G;AAC9G,eAAO,MAAM,kBAAkB,EAAG,cAAuB,CAAC;AAE1D,oHAAoH;AACpH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI5D;AAED,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,KAAK,EAAE,OAAO,CAAC;IACf,yEAAyE;IACzE,SAAS,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,qHAAqH;IACrH,mBAAmB,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,uFAAuF;IACvF,SAAS,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,6EAA6E;IAC7E,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD;AAED;uGACuG;AACvG,wBAAgB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAoB1F;AAED;;kIAEkI;AAClI,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,kHAAkH;IAClH,IAAI,EAAE,gBAAgB,CAAC;IACvB,sGAAsG;IACtG,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC,CAM5D"}

package/dist/wire-admission.js

@@ -0,0 +1,49 @@
+import { sessionWirePrincipal, sessionWireSigner, STANDARD_SURFACE_SKILL } from '@agenticprimitives/a2a/standard';
+/** The skill a READ wire pins: `/harness/runs|records|progress|provenance` under it, never `/harness/ask`. */
+export const HARNESS_READ_SKILL = 'harness.read';
+/** The assertion method → the skill the wire must name. `null` ⇒ the method is not admitted under any wire here. */
+export function skillForMethod(method) {
+    if (method === STANDARD_SURFACE_SKILL)
+        return STANDARD_SURFACE_SKILL;
+    if (method === HARNESS_READ_SKILL)
+        return HARNESS_READ_SKILL;
+    return null;
+}
+/** The `AdmissionPorts.wire` port over the a2a session-wire principal: the admitted agent is the wire's DELEGATOR, and it
+ *  must be this agent — a wire some other agent issued is not a credential here, whoever signed it. */
+export function wireAdmission(deps) {
+    const self = deps.agent.toLowerCase();
+    const principal = sessionWirePrincipal({
+        enforcers: deps.enforcers,
+        verifyDelegationSig: deps.verifyDelegationSig,
+        isRevoked: deps.isRevoked,
+        skill: deps.skillFor ?? skillForMethod,
+        claim: async (digest, expiresAt) => (await deps.runStore.claimAssertion(deps.agent, digest, expiresAt)).claimed,
+        ...(deps.maxAgeSec !== undefined ? { maxAgeSec: deps.maxAgeSec } : {}),
+        ...(deps.skewSec !== undefined ? { skewSec: deps.skewSec } : {}),
+        ...(deps.now ? { now: deps.now } : {}),
+        ...(deps.onRefused ? { onRefused: deps.onRefused } : {}),
+    });
+    return async (request, raw) => {
+        const auth = request.headers.get('authorization') ?? '';
+        const p = await principal(new Request(request.url, { method: 'POST', headers: { authorization: auth, 'content-type': 'application/json' }, body: raw }));
+        if (!p)
+            return null;
+        if (p.agent.toLowerCase() !== self) {
+            deps.onRefused?.(`the wire's delegator is ${p.agent}, not this agent`, p.agent);
+            return null;
+        }
+        return { agent: p.agent.toLowerCase() };
+    };
+}
+/** THE CLIENT HALF of a read — what the Home's runtime sends a self-hosted agent: the `/harness/<read>` body as the bytes the
+ *  assertion hashes (`method: harness.read`, a fresh nonce so the agent's ledger spends each once) and the `A2A-Session`
+ *  headers signed by the wire's delegate key over them. The signer is the runtime's own (a KMS account, never a person's key). */
+export async function wireReadRequest(input) {
+    const nonce = input.nonce ?? [...crypto.getRandomValues(new Uint8Array(8))].map((b) => b.toString(16).padStart(2, '0')).join('');
+    const raw = JSON.stringify({ method: HARNESS_READ_SKILL, nonce, addressee: input.wire.delegator, ...input.body });
+    const sign = sessionWireSigner({ agent: input.wire.delegator, wire: input.wire, signDigest: input.signDigest, audience: input.audience, ...(input.now ? { now: input.now } : {}) });
+    const headers = await sign(raw, HARNESS_READ_SKILL);
+    return { raw, headers: { 'content-type': 'application/json', accept: 'application/json', ...headers } };
+}
+//# sourceMappingURL=wire-admission.js.map

package/dist/wire-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-admission.js","sourceRoot":"","sources":["../src/wire-admission.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,sBAAsB,EAAyB,MAAM,iCAAiC,CAAC;AAIzI,8GAA8G;AAC9G,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAuB,CAAC;AAE1D,oHAAoH;AACpH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,IAAI,MAAM,KAAK,sBAAsB;QAAE,OAAO,sBAAsB,CAAC;IACrE,IAAI,MAAM,KAAK,kBAAkB;QAAE,OAAO,kBAAkB,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC;AAsBD;uGACuG;AACvG,MAAM,UAAU,aAAa,CAAC,IAAuB;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,oBAAoB,CAAC;QACrC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,QAAQ,IAAI,cAAc;QACtC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO;QAC/G,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC,CAAC;IACH,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACzJ,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,SAAS,EAAE,CAAC,2BAA2B,CAAC,CAAC,KAAK,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACrI,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAa,EAAE,CAAC;IACrD,CAAC,CAAC;AACJ,CAAC;AAED;;kIAEkI;AAClI,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAUrC;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjI,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAClH,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,SAAoB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/L,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACpD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC;AAC1G,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/service-host",
-  "version": "0.0.0-alpha.3",
+  "version": "0.0.0-alpha.5",
   "description": "The Service Host (spec 433): the harness run pipeline a service agent embeds — run store, progress, routes, tools, provenance sink — so a service built as an app runs the same harness the runtime hosts. W1 step 1: the run store behind a port.",
   "homepage": "https://agenticprimitives.dev",
   "bugs": {
@@ -28,7 +28,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@agenticprimitives/a2a": "0.0.0-alpha.29",
+    "@agenticprimitives/a2a": "0.0.0-alpha.31",
     "@agenticprimitives/delegation": "1.0.0-alpha.31",
     "@agenticprimitives/harness": "0.0.0-alpha.11",
     "@agenticprimitives/orchestration": "0.0.0-alpha.10",