@agentvalet/client 0.1.2 → 0.2.1

package/README.md

@@ -28,7 +28,8 @@ npx @agentvalet/register
 ```
 
 This generates an RSA keypair **locally** — the private key never leaves your
-machine — registers the public half, and writes `~/.agentvalet/agent.key`.
+machine — registers the public half, and records the agent id and key path in
+`~/.agentvalet/config.json` (and `./.env.agentvalet`), which `fromEnv()` reads.
 
 ## Use it
 
@@ -62,8 +63,13 @@ outside it.
 
 `fromEnv()` reads `AGENTVALET_AGENT_ID` / `AGENTVALET_OWNER_ID` (or the bare
 `AGENT_ID` / `OWNER_ID` the CLI writes) and finds the key via
-`AGENT_PRIVATE_KEY_B64`, `AGENT_PRIVATE_KEY_PATH`, `AGENT_PRIVATE_KEY`, or
-`~/.agentvalet/agent.key`. To wire it up explicitly:
+`AGENT_PRIVATE_KEY_B64`, `AGENT_PRIVATE_KEY_PATH` (alias
+`AGENTVALET_PRIVATE_KEY_PATH`), `AGENT_PRIVATE_KEY`, or `~/.agentvalet/agent.key`.
+Env vars always win. When no agent id is set in the environment it falls back, in
+order, to `./.env.agentvalet`, `~/.agentvalet/config.json` and
+`~/.agentvalet/agent.json`, taking the agent id, owner id, proxy URL and key path
+from the same file. An agent saved under a label (`~/.agentvalet/<label>/`) is
+never picked automatically: set the env vars for it. To wire it up explicitly:
 
 ```typescript
 const av = new AgentValet({
@@ -184,6 +190,53 @@ It's absent when there's nothing to act on — a connection you pinned, a platfo
 with one connection, or a lookup that failed — so treat its absence as "no
 alternatives", never as "this is definitely the right account".
 
+## One identity per subagent
+
+If your orchestrator fans work out to subagents, don't hand them your key. Mint
+each one a child identity: a bearer token that is scope-attenuated, time-boxed,
+independently revocable, and audited under its own agent id.
+
+```typescript
+const child = await av.issueChild(
+  [{ platform: "github", scopes: ["github:issues.read"] }],
+  { name: "triage-worker", ttlSeconds: 600 },
+);
+
+// Hand the subagent the token and nothing else.
+const sub = child.client();          // or AgentValet.fromBearer(child.bearerToken)
+await sub.call({ platform: "github", endpoint: "/issues", scope: "github:issues.read" });
+```
+
+The proxy attenuates every grant against what *you* currently hold — you cannot
+delegate more than you have — and refuses the whole call if the intersection is
+empty. `child.granted` is what it actually issued, which is not necessarily what
+you asked for. Revoking or suspending the parent contains every child on its
+next call.
+
+Bounds that are enforced server-side, and that you should design around rather
+than discover:
+
+| | |
+|---|---|
+| Delegation depth | 1 — a child cannot mint children. `issueChild()` on a bearer client throws `ConfigError` locally. |
+| TTL | 60–3600s, default 900. **No refresh endpoint** — a longer run must re-mint from the parent. |
+| Live children | 25 per parent. |
+| Grants per call | 25. |
+
+## Tagging a run
+
+`sessionId` tags everything a client does, so an audit reader can group one run —
+or tell a parent's calls from its children's.
+
+```typescript
+const av = AgentValet.fromEnv({ sessionId: `run:${runId}` });
+```
+
+It rides the signed assertion as a `session_id` claim, or `X-AV-Session` in
+bearer mode, and also reads from `AGENTVALET_SESSION_ID`. **Attribution only** —
+the proxy never branches an authorization decision on it, and it is not verified
+to belong to the calling agent. Don't treat it as a security boundary.
+
 ## Self-hosting
 
 Point `proxyUrl` at your own deployment. Everything else is identical.

package/dist/child.d.ts

@@ -0,0 +1,51 @@
+import type { AgentValet } from "./client.js";
+/** One platform's worth of authority to hand down. Attenuated server-side
+ *  against what the parent itself currently holds — you cannot delegate more
+ *  than you have, and the proxy rejects the whole call if the intersection is
+ *  empty (`no_scopes_after_attenuation`). */
+export interface ChildGrant {
+    platform: string;
+    scopes: string[];
+    /** Pin the child to one connection when the platform has several. Omitted
+     *  from the wire entirely when absent — the proxy's per-connection rows win
+     *  over the platform-wide row, so a stray null would change the selection. */
+    connectionId?: string;
+}
+/** What the proxy actually granted, after attenuation. Not necessarily what
+ *  was asked for — always the intersection with the parent's live grants. */
+export interface GrantedScope {
+    platform: string;
+    scopes: string[];
+    require_approval: boolean;
+}
+/**
+ * A time-boxed, scope-attenuated bearer identity for a subagent.
+ *
+ * Hand `bearerToken` to the subagent and nothing else — not this client, not
+ * your private key. The token IS the identity: already attenuated, already
+ * expiring, independently revocable, and audited under its own agent id.
+ *
+ * Server-side bounds worth knowing before you design around this:
+ *   - delegation depth is capped at 1, so a child cannot mint children;
+ *   - the TTL is 60..3600s and there is NO refresh endpoint — a run longer
+ *     than the TTL must re-mint from the parent;
+ *   - a parent may hold at most 25 live children at once.
+ */
+export declare class ChildIdentity {
+    readonly childAgentId: string;
+    readonly bearerToken: string;
+    /** ISO-8601. After this the token is dead and cannot be renewed. */
+    readonly expiresAt: string;
+    readonly granted: GrantedScope[];
+    private readonly buildClient;
+    constructor(childAgentId: string, bearerToken: string, 
+    /** ISO-8601. After this the token is dead and cannot be renewed. */
+    expiresAt: string, granted: GrantedScope[], buildClient: (bearerToken: string) => AgentValet);
+    /**
+     * A bearer-mode client for this child. Inherits the issuing client's
+     * proxyUrl, fetch and timeouts — a child pointed at a different host than
+     * the parent that minted it would simply 401.
+     */
+    client(): AgentValet;
+}
+//# sourceMappingURL=child.d.ts.map

package/dist/child.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"child.d.ts","sourceRoot":"","sources":["../src/child.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C;;;6CAG6C;AAC7C,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;kFAE8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;6EAC6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAa;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW;gBALnB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM;IAC5B,oEAAoE;IAC3D,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,YAAY,EAAE,EACf,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,UAAU;IAGnE;;;;OAIG;IACH,MAAM,IAAI,UAAU;CAGrB"}

package/dist/child.js

@@ -0,0 +1,48 @@
+// packages/client/src/child.ts
+//
+// Child identities minted via AgentValet.issueChild().
+//
+// Mirrors packages/python-client/src/agentvalet/child.py, including the reason
+// it is a separate module: client.ts needs ChildIdentity as a return type and
+// ChildIdentity needs AgentValet for .client(). Python breaks that cycle with a
+// deferred import; ESM lets us do the same with a dynamic import, but a plain
+// factory injected at construction time is cheaper and keeps the type graph
+// acyclic — so the client hands ChildIdentity the builder it should use.
+/**
+ * A time-boxed, scope-attenuated bearer identity for a subagent.
+ *
+ * Hand `bearerToken` to the subagent and nothing else — not this client, not
+ * your private key. The token IS the identity: already attenuated, already
+ * expiring, independently revocable, and audited under its own agent id.
+ *
+ * Server-side bounds worth knowing before you design around this:
+ *   - delegation depth is capped at 1, so a child cannot mint children;
+ *   - the TTL is 60..3600s and there is NO refresh endpoint — a run longer
+ *     than the TTL must re-mint from the parent;
+ *   - a parent may hold at most 25 live children at once.
+ */
+export class ChildIdentity {
+    childAgentId;
+    bearerToken;
+    expiresAt;
+    granted;
+    buildClient;
+    constructor(childAgentId, bearerToken, 
+    /** ISO-8601. After this the token is dead and cannot be renewed. */
+    expiresAt, granted, buildClient) {
+        this.childAgentId = childAgentId;
+        this.bearerToken = bearerToken;
+        this.expiresAt = expiresAt;
+        this.granted = granted;
+        this.buildClient = buildClient;
+    }
+    /**
+     * A bearer-mode client for this child. Inherits the issuing client's
+     * proxyUrl, fetch and timeouts — a child pointed at a different host than
+     * the parent that minted it would simply 401.
+     */
+    client() {
+        return this.buildClient(this.bearerToken);
+    }
+}
+//# sourceMappingURL=child.js.map

package/dist/child.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"child.js","sourceRoot":"","sources":["../src/child.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,uDAAuD;AACvD,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AAyBzE;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,aAAa;IAEb;IACA;IAEA;IACA;IACQ;IANnB,YACW,YAAoB,EACpB,WAAmB;IAC5B,oEAAoE;IAC3D,SAAiB,EACjB,OAAuB,EACf,WAAgD;QALxD,iBAAY,GAAZ,YAAY,CAAQ;QACpB,gBAAW,GAAX,WAAW,CAAQ;QAEnB,cAAS,GAAT,SAAS,CAAQ;QACjB,YAAO,GAAP,OAAO,CAAgB;QACf,gBAAW,GAAX,WAAW,CAAqC;IAChE,CAAC;IAEJ;;;;OAIG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;CACF"}

package/dist/client.d.ts

@@ -1,9 +1,20 @@
 import { type FetchLike } from "./http.js";
+import { ChildIdentity, type ChildGrant } from "./child.js";
 export interface AgentValetOptions {
     agentId: string;
     ownerId: string;
     /** RS256 private key, PEM (PKCS#8). */
     privateKey: string;
+    /**
+     * Forensic attribution tag for everything this client does. Rides the signed
+     * assertion as a `session_id` claim, or the `X-AV-Session` header in bearer
+     * mode. Free text, `[A-Za-z0-9._:-]{1,128}`.
+     *
+     * Attribution ONLY. The proxy never branches an authorization decision on
+     * it, and it is not verified to belong to the calling agent — do not treat
+     * it as a security boundary.
+     */
+    sessionId?: string;
     /** Defaults to https://api.agentvalet.ai. */
     proxyUrl?: string;
     /** Per-request network timeout. Default 15s. */
@@ -27,6 +38,9 @@ export interface AgentValetOptions {
         endpoint: string;
     }) => void;
 }
+/** Options for a bearer-mode client. It has no keypair: the token carries the
+ *  identity, so agentId/ownerId/privateKey are neither needed nor accepted. */
+export type BearerOptions = Omit<Partial<AgentValetOptions>, "privateKey">;
 export interface CallRequest {
     platform: string;
     endpoint: string;
@@ -44,19 +58,40 @@ export declare class AgentValet {
     readonly agentId: string;
     readonly ownerId: string;
     readonly proxyUrl: string;
+    /** Forensic tag sent with every request, or undefined if unset. */
+    readonly sessionId: string | undefined;
     private readonly privateKeyPem;
+    /** Set only in bearer mode (a child identity). Mutually exclusive with a key. */
+    private readonly bearerToken;
     private readonly timeoutMs;
     private readonly approvalTimeoutMs;
     private readonly approvalPollMs;
     private readonly doFetch;
     private readonly onApprovalPending?;
     private importedKey;
-    constructor(opts: AgentValetOptions);
+    constructor(opts: AgentValetOptions & {
+        bearerToken?: string;
+    });
     /**
-     * Builds a client from the environment. Works out of the box on a machine
-     * that has run `npx @agentvalet/register`. See env.ts for the accepted names.
+     * Builds a client from the environment. Env vars win; when no agent id is
+     * set there, falls back to the identity files `npx @agentvalet/register` and
+     * the Python `agentvalet register` write (see identityFromDisk() in env.ts),
+     * signing with the key path recorded beside that identity.
      */
     static fromEnv(overrides?: Partial<AgentValetOptions>): AgentValet;
+    /**
+     * Builds a client authenticated with a pre-issued bearer token.
+     *
+     * This is how a subagent uses the token from `issueChild()`: no agentId,
+     * ownerId, or private key — the token itself carries the (already
+     * attenuated, already time-boxed) identity, and it is sent verbatim as
+     * `Authorization: Bearer <token>` on every call instead of being signed
+     * fresh per request. Everything else behaves identically.
+     *
+     * A bearer-mode client cannot call `issueChild()` — the server caps
+     * delegation depth at 1.
+     */
+    static fromBearer(bearerToken: string, overrides?: BearerOptions): AgentValet;
     /**
      * Calls an approved platform through the broker. Returns the upstream SaaS
      * response body, parsed.
@@ -103,7 +138,34 @@ export declare class AgentValet {
         status: "approved" | "denied" | "pending";
         requestToken: string;
     }>;
-    /** Signs a short-lived (60s) RS256 assertion of this agent's identity. */
+    /**
+     * Mints a time-boxed, scope-attenuated bearer identity for a subagent.
+     *
+     * The proxy attenuates every grant against what THIS agent currently holds —
+     * you cannot hand out more than you have — and refuses outright if the
+     * intersection is empty (`no_scopes_after_attenuation`). Revoking or
+     * suspending this agent contains every child it minted on their next call.
+     *
+     * Give `bearerToken` to the subagent and nothing else: not this client, not
+     * your private key. Build its client with `child.client()` or
+     * `AgentValet.fromBearer(child.bearerToken)`.
+     *
+     * @throws ConfigError on a bearer-mode client (depth cap is 1, so this fails
+     *   locally before any network call), or on locally-invalid grants/TTL.
+     * @throws ProxyError if the proxy refused — `.status` and `.body` carry the
+     *   code (`agent_not_active`, `delegation_depth_exceeded`, the 25-live-child
+     *   cap, `as_signing_unavailable`, ...).
+     */
+    issueChild(grants: ChildGrant[], opts?: {
+        name?: string;
+        ttlSeconds?: number;
+    }): Promise<ChildIdentity>;
+    /**
+     * Signs a short-lived (60s) RS256 assertion of this agent's identity.
+     *
+     * Not available in bearer mode — a child has no key to sign with; it sends
+     * its pre-issued token as-is on every request.
+     */
     signJWT(): Promise<string>;
     private authedFetch;
     private getJson;

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAwBA,OAAO,EAA+D,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAcxG,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KAClB,KAAK,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAYD,qBAAa,UAAU;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAY;IACpC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAyC;IAC5E,OAAO,CAAC,WAAW,CAAwB;gBAE/B,IAAI,EAAE,iBAAiB;IAgBnC;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,SAAS,GAAE,OAAO,CAAC,iBAAiB,CAAM,GAAG,UAAU;IAoBtE;;;;;;;;;OASG;IACG,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;IAwCrD;;;;OAIG;IACG,eAAe,CAAC,CAAC,GAAG,OAAO,EAC/B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GACrF,OAAO,CAAC,CAAC,CAAC;IAiDb;4CACwC;IAClC,aAAa,CAAC,CAAC,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC;IAI9C,yEAAyE;IACnE,cAAc,CAAC,CAAC,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC;IAI/C;;;OAGG;IACG,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAcxE;;;;OAIG;IACG,aAAa,CACjB,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7E,OAAO,CAAC;QAAE,MAAM,EAAE,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IA8B/E,0EAA0E;IACpE,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;YAiBlB,WAAW;YAyBX,OAAO;CAMtB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAwBA,OAAO,EAA+D,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACxG,OAAO,EAAE,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAuB5D,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KAClB,KAAK,IAAI,CAAC;CACZ;AAED;+EAC+E;AAC/E,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,YAAY,CAAC,CAAC;AAE3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAYD,qBAAa,UAAU;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAY;IACpC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAyC;IAC5E,OAAO,CAAC,WAAW,CAAwB;gBAE/B,IAAI,EAAE,iBAAiB,GAAG;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;IAsB9D;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,SAAS,GAAE,OAAO,CAAC,iBAAiB,CAAM,GAAG,UAAU;IAuBtE;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,GAAE,aAAkB,GAAG,UAAU;IAiBjF;;;;;;;;;OASG;IACG,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC;IAwCrD;;;;OAIG;IACG,eAAe,CAAC,CAAC,GAAG,OAAO,EAC/B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GACrF,OAAO,CAAC,CAAC,CAAC;IAiDb;4CACwC;IAClC,aAAa,CAAC,CAAC,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC;IAI9C,yEAAyE;IACnE,cAAc,CAAC,CAAC,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC;IAI/C;;;OAGG;IACG,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAcxE;;;;OAIG;IACG,aAAa,CACjB,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7E,OAAO,CAAC;QAAE,MAAM,EAAE,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IA8B/E;;;;;;;;;;;;;;;;;OAiBG;IACG,UAAU,CACd,MAAM,EAAE,UAAU,EAAE,EACpB,IAAI,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC,aAAa,CAAC;IA6BzB;;;;;OAKG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;YA8BlB,WAAW;YAkCX,OAAO;CAMtB"}

package/dist/client.js

@@ -13,7 +13,8 @@
 import { SignJWT, importPKCS8 } from "jose";
 import { AccessDeniedError, ApprovalDeniedError, ApprovalExpiredError, ApprovalTimeoutError, ConfigError, ProxyError, UpstreamError, } from "./errors.js";
 import { diagnoseNetworkError, fetchWithTimeout, sleep, tryParseJson } from "./http.js";
-import { DEFAULT_PROXY_URL, agentIdFromEnv, ownerIdFromEnv, privateKeyFromEnv, proxyUrlFromEnv, } from "./env.js";
+import { CHILD_TTL_DEFAULT_S, buildIssueChildBody, identityFromBearer, interpretIssueChildResponse, validateSessionId, } from "./protocol.js";
+import { DEFAULT_PROXY_URL, agentIdFromEnv, identityFromDisk, ownerIdFromEnv, privateKeyFromEnv, proxyUrlFromEnv, sessionIdFromEnv, } from "./env.js";
 /** Matches the mcp-server's budget: under Claude Desktop's 60s tool timeout. */
 const DEFAULT_APPROVAL_TIMEOUT_MS = 50_000;
 const DEFAULT_APPROVAL_POLL_MS = 2_000;
@@ -22,7 +23,11 @@ export class AgentValet {
     agentId;
     ownerId;
     proxyUrl;
+    /** Forensic tag sent with every request, or undefined if unset. */
+    sessionId;
     privateKeyPem;
+    /** Set only in bearer mode (a child identity). Mutually exclusive with a key. */
+    bearerToken;
     timeoutMs;
     approvalTimeoutMs;
     approvalPollMs;
@@ -30,15 +35,21 @@ export class AgentValet {
     onApprovalPending;
     importedKey = null;
     constructor(opts) {
-        if (!opts.agentId)
-            throw new ConfigError("agentId is required");
-        if (!opts.ownerId)
-            throw new ConfigError("ownerId is required");
-        if (!opts.privateKey)
-            throw new ConfigError("privateKey is required");
+        // Bearer mode skips the keypair checks — the token IS the identity, and
+        // ids are recovered from its payload rather than supplied by the caller.
+        if (!opts.bearerToken) {
+            if (!opts.agentId)
+                throw new ConfigError("agentId is required");
+            if (!opts.ownerId)
+                throw new ConfigError("ownerId is required");
+            if (!opts.privateKey)
+                throw new ConfigError("privateKey is required");
+        }
+        this.bearerToken = opts.bearerToken ?? null;
         this.agentId = opts.agentId;
         this.ownerId = opts.ownerId;
         this.privateKeyPem = opts.privateKey;
+        this.sessionId = validateSessionId(opts.sessionId);
         this.proxyUrl = (opts.proxyUrl ?? DEFAULT_PROXY_URL).replace(/\/$/, "");
         this.timeoutMs = opts.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
         this.approvalTimeoutMs = opts.approvalTimeoutMs ?? DEFAULT_APPROVAL_TIMEOUT_MS;
@@ -47,22 +58,56 @@ export class AgentValet {
         this.onApprovalPending = opts.onApprovalPending;
     }
     /**
-     * Builds a client from the environment. Works out of the box on a machine
-     * that has run `npx @agentvalet/register`. See env.ts for the accepted names.
+     * Builds a client from the environment. Env vars win; when no agent id is
+     * set there, falls back to the identity files `npx @agentvalet/register` and
+     * the Python `agentvalet register` write (see identityFromDisk() in env.ts),
+     * signing with the key path recorded beside that identity.
      */
     static fromEnv(overrides = {}) {
-        const agentId = overrides.agentId ?? agentIdFromEnv();
-        const ownerId = overrides.ownerId ?? ownerIdFromEnv();
+        const envAgentId = overrides.agentId ?? agentIdFromEnv();
+        const disk = envAgentId ? null : identityFromDisk();
+        const agentId = envAgentId ?? disk?.agentId ?? null;
+        const ownerId = overrides.ownerId ?? ownerIdFromEnv() ?? disk?.ownerId ?? null;
         if (!agentId || !ownerId) {
-            throw new ConfigError("AgentValet identity not found in the environment. Set AGENTVALET_AGENT_ID and " +
-                "AGENTVALET_OWNER_ID (or AGENT_ID / OWNER_ID), or run `npx @agentvalet/register`.");
+            throw new ConfigError("AgentValet identity not found. Set AGENTVALET_AGENT_ID and AGENTVALET_OWNER_ID " +
+                "(or AGENT_ID / OWNER_ID), or run `npx @agentvalet/register` to write " +
+                "~/.agentvalet/config.json." +
+                (disk ? ` (${disk.source} names an agent but no owner id.)` : ""));
         }
         return new AgentValet({
             ...overrides,
             agentId,
             ownerId,
-            privateKey: overrides.privateKey ?? privateKeyFromEnv(),
-            proxyUrl: overrides.proxyUrl ?? proxyUrlFromEnv(),
+            privateKey: overrides.privateKey ?? privateKeyFromEnv(disk?.keyPath),
+            proxyUrl: overrides.proxyUrl ?? proxyUrlFromEnv(disk?.proxyUrl),
+            sessionId: overrides.sessionId ?? sessionIdFromEnv() ?? undefined,
+        });
+    }
+    /**
+     * Builds a client authenticated with a pre-issued bearer token.
+     *
+     * This is how a subagent uses the token from `issueChild()`: no agentId,
+     * ownerId, or private key — the token itself carries the (already
+     * attenuated, already time-boxed) identity, and it is sent verbatim as
+     * `Authorization: Bearer <token>` on every call instead of being signed
+     * fresh per request. Everything else behaves identically.
+     *
+     * A bearer-mode client cannot call `issueChild()` — the server caps
+     * delegation depth at 1.
+     */
+    static fromBearer(bearerToken, overrides = {}) {
+        if (!bearerToken)
+            throw new ConfigError("bearerToken is required");
+        // The token already names its own subject. Recover it so anything that has
+        // to identify the caller (evaluate(), logging) works in bearer mode too;
+        // an explicit override always wins.
+        const derived = identityFromBearer(bearerToken);
+        return new AgentValet({
+            ...overrides,
+            bearerToken,
+            agentId: overrides.agentId ?? derived.agentId ?? "",
+            ownerId: overrides.ownerId ?? derived.ownerId ?? "",
+            privateKey: "",
         });
     }
     // ---- core ---------------------------------------------------------------
@@ -222,9 +267,58 @@ export class AgentValet {
         }
         return { status: "pending", requestToken: token };
     }
+    // ---- delegation ---------------------------------------------------------
+    /**
+     * Mints a time-boxed, scope-attenuated bearer identity for a subagent.
+     *
+     * The proxy attenuates every grant against what THIS agent currently holds —
+     * you cannot hand out more than you have — and refuses outright if the
+     * intersection is empty (`no_scopes_after_attenuation`). Revoking or
+     * suspending this agent contains every child it minted on their next call.
+     *
+     * Give `bearerToken` to the subagent and nothing else: not this client, not
+     * your private key. Build its client with `child.client()` or
+     * `AgentValet.fromBearer(child.bearerToken)`.
+     *
+     * @throws ConfigError on a bearer-mode client (depth cap is 1, so this fails
+     *   locally before any network call), or on locally-invalid grants/TTL.
+     * @throws ProxyError if the proxy refused — `.status` and `.body` carry the
+     *   code (`agent_not_active`, `delegation_depth_exceeded`, the 25-live-child
+     *   cap, `as_signing_unavailable`, ...).
+     */
+    async issueChild(grants, opts = {}) {
+        if (this.bearerToken !== null) {
+            throw new ConfigError("issueChild cannot be called on a bearer-mode client — the server enforces delegation " +
+                "depth 1, so a child identity cannot itself mint children. Call issueChild from the " +
+                "keypair-authenticated parent agent instead.");
+        }
+        const body = buildIssueChildBody(grants, opts.name, opts.ttlSeconds ?? CHILD_TTL_DEFAULT_S);
+        const res = await this.authedFetch("/v1/agents/children", {
+            method: "POST",
+            body: JSON.stringify(body),
+        });
+        return interpretIssueChildResponse(res.status, await res.text(), (token) => AgentValet.fromBearer(token, {
+            proxyUrl: this.proxyUrl,
+            timeoutMs: this.timeoutMs,
+            approvalTimeoutMs: this.approvalTimeoutMs,
+            approvalPollMs: this.approvalPollMs,
+            fetch: this.doFetch,
+            onApprovalPending: this.onApprovalPending,
+            sessionId: this.sessionId,
+        }));
+    }
     // ---- transport ----------------------------------------------------------
-    /** Signs a short-lived (60s) RS256 assertion of this agent's identity. */
+    /**
+     * Signs a short-lived (60s) RS256 assertion of this agent's identity.
+     *
+     * Not available in bearer mode — a child has no key to sign with; it sends
+     * its pre-issued token as-is on every request.
+     */
     async signJWT() {
+        if (this.bearerToken !== null) {
+            throw new ConfigError("signJWT() is not available on a bearer-mode client — it authenticates with a " +
+                "pre-issued bearer token, not a signed assertion.");
+        }
         if (!this.importedKey) {
             try {
                 this.importedKey = await importPKCS8(this.privateKeyPem, "RS256");
@@ -233,7 +327,14 @@ export class AgentValet {
                 throw new ConfigError(`Private key is not a valid PKCS#8 RS256 PEM: ${err instanceof Error ? err.message : err}`);
             }
         }
-        return new SignJWT({ agent_id: this.agentId, owner_id: this.ownerId })
+        return new SignJWT({
+            agent_id: this.agentId,
+            owner_id: this.ownerId,
+            // Omitted entirely when unset. A present-but-invalid claim resolves to
+            // null server-side WITHOUT falling back to the header, so sending an
+            // empty string here would silently cost the attribution.
+            ...(this.sessionId ? { session_id: this.sessionId } : {}),
+        })
             .setProtectedHeader({ alg: "RS256" })
             .setIssuedAt()
             .setExpirationTime("60s")
@@ -242,11 +343,18 @@ export class AgentValet {
     async authedFetch(path, init) {
         const url = `${this.proxyUrl}${path}`;
         const once = async () => {
-            const token = await this.signJWT();
+            // Bearer mode has nothing to re-sign: the child token is fixed for its
+            // whole 60..3600s life. Its session tag rides a header instead of a claim.
+            const token = this.bearerToken ?? (await this.signJWT());
             try {
                 return await fetchWithTimeout(this.doFetch, url, {
                     ...init,
-                    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", ...init.headers },
+                    headers: {
+                        Authorization: `Bearer ${token}`,
+                        "Content-Type": "application/json",
+                        ...(this.bearerToken && this.sessionId ? { "X-AV-Session": this.sessionId } : {}),
+                        ...init.headers,
+                    },
                 }, this.timeoutMs);
             }
             catch (err) {
@@ -255,8 +363,11 @@ export class AgentValet {
         };
         const res = await once();
         // Retry once on 401 — the JWT may have been minted either side of a clock
-        // skew boundary. Same one-shot retry the mcp-server does.
-        return res.status === 401 ? once() : res;
+        // skew boundary. Same one-shot retry the mcp-server does. Pointless in
+        // bearer mode (the token is fixed), so don't burn a second round trip.
+        if (res.status !== 401 || this.bearerToken !== null)
+            return res;
+        return once();
     }
     async getJson(path) {
         const res = await this.authedFetch(path, { method: "GET" });

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,wEAAwE;AACxE,8BAA8B;AAE9B,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAE5C,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,UAAU,EACV,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,KAAK,EAAE,YAAY,EAAkB,MAAM,WAAW,CAAC;AACxG,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,eAAe,GAChB,MAAM,UAAU,CAAC;AAElB,gFAAgF;AAChF,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAuD1C,MAAM,OAAO,UAAU;IACZ,OAAO,CAAS;IAChB,OAAO,CAAS;IAChB,QAAQ,CAAS;IACT,aAAa,CAAS;IACtB,SAAS,CAAS;IAClB,iBAAiB,CAAS;IAC1B,cAAc,CAAS;IACvB,OAAO,CAAY;IACnB,iBAAiB,CAA0C;IACpE,WAAW,GAAmB,IAAI,CAAC;IAE3C,YAAY,IAAuB;QACjC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,WAAW,CAAC,qBAAqB,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,WAAW,CAAC,qBAAqB,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,WAAW,CAAC,wBAAwB,CAAC,CAAC;QAEtE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,0BAA0B,CAAC;QAC9D,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,2BAA2B,CAAC;QAC/E,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;QACtE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAClD,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,YAAwC,EAAE;QACvD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;QACtD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;QACtD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,CACnB,gFAAgF;gBAC9E,kFAAkF,CACrF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,UAAU,CAAC;YACpB,GAAG,SAAS;YACZ,OAAO;YACP,OAAO;YACP,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,iBAAiB,EAAE;YACvD,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,eAAe,EAAE;SAClD,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAE5E;;;;;;;;;OASG;IACH,KAAK,CAAC,IAAI,CAAc,GAAgB;QACtC,MAAM,IAAI,GAAG;YACX,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;YAC3B,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;YACjD,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClG,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAE9B,uEAAuE;QACvE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,UAAU,GAAI,YAAY,CAAC,IAAI,CAA0C,EAAE,WAAW,CAAC;YAC7F,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,MAAM,IAAI,CAAC,eAAe,CAAI,UAAU,EAAE;oBAChD,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,SAAS,EAAE,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB;iBAC3D,CAAC,CAAM,CAAC;YACX,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,oEAAoE;YACpE,kEAAkE;YAClE,+DAA+D;YAC/D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAM,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CACnB,UAAkB,EAClB,MAAoF,EAAE;QAEtF,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,iBAAiB,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAAC;YACvC,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAEvC,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,kBAAkB,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACrG,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,kCAAkC;YAC9C,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAEhE,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;YAE5D,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC3B,wEAAwE;gBACxE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,qCAAqC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBACxE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;gBACxB,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG;oBAAE,MAAM,IAAI,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACjF,OAAO,CAAC,CAAC,IAAS,CAAC;YACrB,CAAC;YAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,UAAU;gBACV,SAAS,EAAE,OAAO;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE;gBAC5B,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE;gBACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,oBAAoB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,2EAA2E;IAE3E;4CACwC;IACxC,KAAK,CAAC,aAAa;QACjB,OAAO,IAAI,CAAC,OAAO,CAAI,uBAAuB,CAAC,CAAC;IAClD,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,cAAc;QAClB,OAAO,IAAI,CAAC,OAAO,CAAI,+BAA+B,CAAC,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAc,QAAgB,EAAE,KAAa;QACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE;gBAC5C,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;gBAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,GAAG,QAAQ,IAAI,KAAK,EAAE,EAAE;aACjE,CAAC;SACH,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpD,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAM,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CACjB,GAA8E;QAE9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;SACvF,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxC,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAA+B,CAAC;QACrF,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,gDAAgD,CAAC,CAAC;QAElG,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,6BAA6B,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5G,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,SAAS;YACtB,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;YACpD,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;YAChF,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAC9E,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACpD,CAAC;IAED,4EAA4E;IAE5E,0EAA0E;IAC1E,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,IAAI,CAAC,WAAW,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,WAAW,CACnB,gDAAgD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC3F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;aACnE,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;aACpC,WAAW,EAAE;aACb,iBAAiB,CAAC,KAAK,CAAC;aACxB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAAY,EAAE,IAAiB;QACvD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;YACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,OAAO,MAAM,gBAAgB,CAC3B,IAAI,CAAC,OAAO,EACZ,GAAG,EACH;oBACE,GAAG,IAAI;oBACP,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE;iBACnG,EACD,IAAI,CAAC,SAAS,CACf,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;QACzB,0EAA0E;QAC1E,0DAA0D;QAC1D,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,IAAY;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpD,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAM,CAAC;IAC3C,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,wEAAwE;AACxE,8BAA8B;AAE9B,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAE5C,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,UAAU,EACV,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,KAAK,EAAE,YAAY,EAAkB,MAAM,WAAW,CAAC;AAExG,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,2BAA2B,EAC3B,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GACjB,MAAM,UAAU,CAAC;AAElB,gFAAgF;AAChF,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAqE1C,MAAM,OAAO,UAAU;IACZ,OAAO,CAAS;IAChB,OAAO,CAAS;IAChB,QAAQ,CAAS;IAC1B,mEAAmE;IAC1D,SAAS,CAAqB;IACtB,aAAa,CAAS;IACvC,iFAAiF;IAChE,WAAW,CAAgB;IAC3B,SAAS,CAAS;IAClB,iBAAiB,CAAS;IAC1B,cAAc,CAAS;IACvB,OAAO,CAAY;IACnB,iBAAiB,CAA0C;IACpE,WAAW,GAAmB,IAAI,CAAC;IAE3C,YAAY,IAAkD;QAC5D,wEAAwE;QACxE,yEAAyE;QACzE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,WAAW,CAAC,qBAAqB,CAAC,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,WAAW,CAAC,qBAAqB,CAAC,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,WAAW,CAAC,wBAAwB,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,0BAA0B,CAAC;QAC9D,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,2BAA2B,CAAC;QAC/E,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;QACtE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,YAAwC,EAAE;QACvD,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,UAAU,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;QACpD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,IAAI,cAAc,EAAE,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;QAC/E,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,CACnB,iFAAiF;gBAC/E,uEAAuE;gBACvE,4BAA4B;gBAC5B,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,mCAAmC,CAAC,CAAC,CAAC,EAAE,CAAC,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,UAAU,CAAC;YACpB,GAAG,SAAS;YACZ,OAAO;YACP,OAAO;YACP,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC;YACpE,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC/D,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,gBAAgB,EAAE,IAAI,SAAS;SAClE,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,UAAU,CAAC,WAAmB,EAAE,YAA2B,EAAE;QAClE,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,WAAW,CAAC,yBAAyB,CAAC,CAAC;QACnE,2EAA2E;QAC3E,yEAAyE;QACzE,oCAAoC;QACpC,MAAM,OAAO,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAChD,OAAO,IAAI,UAAU,CAAC;YACpB,GAAG,SAAS;YACZ,WAAW;YACX,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE;YACnD,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE;YACnD,UAAU,EAAE,EAAE;SACf,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAE5E;;;;;;;;;OASG;IACH,KAAK,CAAC,IAAI,CAAc,GAAgB;QACtC,MAAM,IAAI,GAAG;YACX,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;YAC3B,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;YACjD,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClG,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAE9B,uEAAuE;QACvE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,UAAU,GAAI,YAAY,CAAC,IAAI,CAA0C,EAAE,WAAW,CAAC;YAC7F,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,MAAM,IAAI,CAAC,eAAe,CAAI,UAAU,EAAE;oBAChD,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,SAAS,EAAE,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB;iBAC3D,CAAC,CAAM,CAAC;YACX,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,oEAAoE;YACpE,kEAAkE;YAClE,+DAA+D;YAC/D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAM,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CACnB,UAAkB,EAClB,MAAoF,EAAE;QAEtF,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,iBAAiB,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAAC;YACvC,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAEvC,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,kBAAkB,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACrG,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,kCAAkC;YAC9C,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAEhE,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;YAE5D,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC3B,wEAAwE;gBACxE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,qCAAqC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBACxE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;gBACxB,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG;oBAAE,MAAM,IAAI,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACjF,OAAO,CAAC,CAAC,IAAS,CAAC;YACrB,CAAC;YAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,UAAU;gBACV,SAAS,EAAE,OAAO;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE;gBAC5B,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE;gBACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,oBAAoB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,2EAA2E;IAE3E;4CACwC;IACxC,KAAK,CAAC,aAAa;QACjB,OAAO,IAAI,CAAC,OAAO,CAAI,uBAAuB,CAAC,CAAC;IAClD,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,cAAc;QAClB,OAAO,IAAI,CAAC,OAAO,CAAI,+BAA+B,CAAC,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAc,QAAgB,EAAE,KAAa;QACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE;gBAC5C,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;gBAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,GAAG,QAAQ,IAAI,KAAK,EAAE,EAAE;aACjE,CAAC;SACH,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpD,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAM,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CACjB,GAA8E;QAE9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;SACvF,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxC,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAA+B,CAAC;QACrF,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,gDAAgD,CAAC,CAAC;QAElG,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACjC,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,6BAA6B,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5G,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,SAAS;YACtB,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;YACpD,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;YAChF,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAC9E,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACpD,CAAC;IAED,4EAA4E;IAE5E;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,UAAU,CACd,MAAoB,EACpB,OAA+C,EAAE;QAEjD,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,WAAW,CACnB,uFAAuF;gBACrF,qFAAqF;gBACrF,6CAA6C,CAChD,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC,CAAC;QAC5F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,OAAO,2BAA2B,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CACzE,UAAU,CAAC,UAAU,CAAC,KAAK,EAAE;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,KAAK,EAAE,IAAI,CAAC,OAAO;YACnB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,4EAA4E;IAE5E;;;;;OAKG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,WAAW,CACnB,+EAA+E;gBAC7E,kDAAkD,CACrD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,IAAI,CAAC,WAAW,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,WAAW,CACnB,gDAAgD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC3F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,IAAI,OAAO,CAAC;YACjB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,uEAAuE;YACvE,qEAAqE;YACrE,yDAAyD;YACzD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC;aACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;aACpC,WAAW,EAAE;aACb,iBAAiB,CAAC,KAAK,CAAC;aACxB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAAY,EAAE,IAAiB;QACvD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;YACtB,uEAAuE;YACvE,2EAA2E;YAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACzD,IAAI,CAAC;gBACH,OAAO,MAAM,gBAAgB,CAC3B,IAAI,CAAC,OAAO,EACZ,GAAG,EACH;oBACE,GAAG,IAAI;oBACP,OAAO,EAAE;wBACP,aAAa,EAAE,UAAU,KAAK,EAAE;wBAChC,cAAc,EAAE,kBAAkB;wBAClC,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACjF,GAAG,IAAI,CAAC,OAAO;qBAChB;iBACF,EACD,IAAI,CAAC,SAAS,CACf,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;QACzB,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC;QAChE,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,IAAY;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpD,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAM,CAAC;IAC3C,CAAC;CACF"}

package/dist/env.d.ts

@@ -1,16 +1,46 @@
 export declare const DEFAULT_PROXY_URL = "https://api.agentvalet.ai";
 export declare function agentIdFromEnv(): string | null;
 export declare function ownerIdFromEnv(): string | null;
-export declare function proxyUrlFromEnv(): string;
+/** Optional forensic attribution tag — AGENTVALET_SESSION_ID / SESSION_ID.
+ *  Matches the Python client, so a mixed-language fleet tags one run alike. */
+export declare function sessionIdFromEnv(): string | null;
+/** AGENTVALET_API_URL is the name `.env.agentvalet` uses; accepted as an alias.
+ *  `fallback` (e.g. from an identity file) is used only when no env var is set. */
+export declare function proxyUrlFromEnv(fallback?: string | null): string;
 /**
  * Resolves the RS256 private key PEM, in precedence order:
  *   1. AGENT_PRIVATE_KEY_B64  — base64-encoded PEM (12-factor / container safe)
- *   2. AGENT_PRIVATE_KEY_PATH — path to a PEM file
+ *   2. AGENT_PRIVATE_KEY_PATH — path to a PEM file (AGENTVALET_PRIVATE_KEY_PATH,
+ *                               the name `.env.agentvalet` uses, is an alias)
  *   3. AGENT_PRIVATE_KEY      — raw multi-line PEM, or \n-escaped single line
- *   4. ~/.agentvalet/agent.key — written by `npx @agentvalet/register`
+ *   4. `fallbackPath`         — the key path recorded beside an on-disk identity
+ *   5. ~/.agentvalet/agent.key — written by `npx @agentvalet/register`
  *
  * Same order and same formats as the mcp-server's pem.ts, so a dev who already
  * has the MCP server working can construct the SDK with no new setup.
  */
-export declare function privateKeyFromEnv(): string;
+export declare function privateKeyFromEnv(fallbackPath?: string | null): string;
+export interface DiskIdentity {
+    agentId: string;
+    ownerId: string | null;
+    /** Key file written beside this identity; null = use ~/.agentvalet/agent.key. */
+    keyPath: string | null;
+    proxyUrl: string | null;
+    /** File the identity came from, for error messages. */
+    source: string;
+}
+/**
+ * The identity the registration flows leave on disk. First hit wins:
+ *   1. <cwd>/.env.agentvalet     written by `npx @agentvalet/register` (project-level)
+ *   2. ~/.agentvalet/config.json written by the Node CLI and the Python
+ *                                `agentvalet register`; the most recent registration
+ *   3. ~/.agentvalet/agent.json  written by `agentvalet-register claim` (unlabelled)
+ * Each source yields an agent id together with the key path written beside it,
+ * never mixed with another source's. Labelled agents (~/.agentvalet/<label>/)
+ * are not guessed at: point AGENT_PRIVATE_KEY_PATH etc. at them explicitly.
+ */
+export declare function identityFromDisk(opts?: {
+    cwd?: string;
+    home?: string;
+}): DiskIdentity | null;
 //# sourceMappingURL=env.d.ts.map

package/dist/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,iBAAiB,8BAA8B,CAAC;AAmB7D,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAiC1C"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,iBAAiB,8BAA8B,CAAC;AAmB7D,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AAED;+EAC+E;AAC/E,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAEhD;AAED;mFACmF;AACnF,wBAAgB,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAIhE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CA8CtE;AAUD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,iFAAiF;IACjF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;CAChB;AAqCD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GACzC,YAAY,GAAG,IAAI,CAoDrB"}

package/dist/env.js

@@ -5,9 +5,12 @@
 // Accepts BOTH naming conventions already in the wild: the bare names the
 // mcp-server/MCPB write (AGENT_ID, OWNER_ID, PROXY_URL, AGENT_PRIVATE_KEY*)
 // and AGENTVALET_-prefixed aliases, which is what the docs and the
-// credentials-not-configured message tell people to set. A machine that has
-// been through `npx @agentvalet/register` already satisfies the bare set, so
-// fromEnv() works with zero extra config there.
+// credentials-not-configured message tell people to set.
+//
+// Env vars always win. When no agent id is set in the environment, fromEnv()
+// falls back to the identity files the registration flows write (see
+// identityFromDisk()), so a machine that has run `npx @agentvalet/register`
+// or the Python `agentvalet register` works with zero extra config.
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -37,24 +40,33 @@ export function agentIdFromEnv() {
 export function ownerIdFromEnv() {
     return readEither("OWNER_ID");
 }
-export function proxyUrlFromEnv() {
-    return (readEither("PROXY_URL") ?? DEFAULT_PROXY_URL).replace(/\/$/, "");
+/** Optional forensic attribution tag — AGENTVALET_SESSION_ID / SESSION_ID.
+ *  Matches the Python client, so a mixed-language fleet tags one run alike. */
+export function sessionIdFromEnv() {
+    return readEither("SESSION_ID");
+}
+/** AGENTVALET_API_URL is the name `.env.agentvalet` uses; accepted as an alias.
+ *  `fallback` (e.g. from an identity file) is used only when no env var is set. */
+export function proxyUrlFromEnv(fallback) {
+    return (readEither("PROXY_URL") ?? readEnv("AGENTVALET_API_URL") ?? fallback ?? DEFAULT_PROXY_URL).replace(/\/$/, "");
 }
 /**
  * Resolves the RS256 private key PEM, in precedence order:
  *   1. AGENT_PRIVATE_KEY_B64  — base64-encoded PEM (12-factor / container safe)
- *   2. AGENT_PRIVATE_KEY_PATH — path to a PEM file
+ *   2. AGENT_PRIVATE_KEY_PATH — path to a PEM file (AGENTVALET_PRIVATE_KEY_PATH,
+ *                               the name `.env.agentvalet` uses, is an alias)
  *   3. AGENT_PRIVATE_KEY      — raw multi-line PEM, or \n-escaped single line
- *   4. ~/.agentvalet/agent.key — written by `npx @agentvalet/register`
+ *   4. `fallbackPath`         — the key path recorded beside an on-disk identity
+ *   5. ~/.agentvalet/agent.key — written by `npx @agentvalet/register`
  *
  * Same order and same formats as the mcp-server's pem.ts, so a dev who already
  * has the MCP server working can construct the SDK with no new setup.
  */
-export function privateKeyFromEnv() {
+export function privateKeyFromEnv(fallbackPath) {
     const b64 = readEither("AGENT_PRIVATE_KEY_B64");
     if (b64)
         return Buffer.from(b64, "base64").toString("utf-8").trim();
-    const path = readEither("AGENT_PRIVATE_KEY_PATH");
+    const path = readEither("AGENT_PRIVATE_KEY_PATH") ?? readEnv("AGENTVALET_PRIVATE_KEY_PATH");
     if (path) {
         try {
             return readFileSync(path, "utf-8").trim();
@@ -73,6 +85,17 @@ export function privateKeyFromEnv() {
         }
         return unescaped;
     }
+    if (fallbackPath) {
+        // Paired with the on-disk agent id. Failing loudly beats silently signing
+        // with the default key, which may belong to a different agent.
+        try {
+            return readFileSync(fallbackPath, "utf-8").trim();
+        }
+        catch (err) {
+            throw new ConfigError(`Cannot read the agent key at ${fallbackPath} (named by your AgentValet identity file): ` +
+                `${err instanceof Error ? err.message : err}`);
+        }
+    }
     const diskKey = readDiskKey();
     if (diskKey)
         return diskKey;
@@ -87,4 +110,99 @@ function readDiskKey() {
         return null;
     }
 }
+function readText(path) {
+    try {
+        return readFileSync(path, "utf-8");
+    }
+    catch {
+        return null;
+    }
+}
+function readJson(path) {
+    const text = readText(path);
+    if (text === null)
+        return null;
+    try {
+        const v = JSON.parse(text);
+        return v && typeof v === "object" ? v : null;
+    }
+    catch {
+        return null;
+    }
+}
+function str(v) {
+    return typeof v === "string" && v.trim() !== "" ? v.trim() : null;
+}
+function parseDotEnv(text) {
+    const out = {};
+    for (const line of text.split(/\r?\n/)) {
+        const t = line.trim();
+        if (!t || t.startsWith("#"))
+            continue;
+        const eq = t.indexOf("=");
+        if (eq === -1)
+            continue;
+        out[t.slice(0, eq).trim()] = t.slice(eq + 1).trim().replace(/^(["'])(.*)\1$/, "$2");
+    }
+    return out;
+}
+/**
+ * The identity the registration flows leave on disk. First hit wins:
+ *   1. <cwd>/.env.agentvalet     written by `npx @agentvalet/register` (project-level)
+ *   2. ~/.agentvalet/config.json written by the Node CLI and the Python
+ *                                `agentvalet register`; the most recent registration
+ *   3. ~/.agentvalet/agent.json  written by `agentvalet-register claim` (unlabelled)
+ * Each source yields an agent id together with the key path written beside it,
+ * never mixed with another source's. Labelled agents (~/.agentvalet/<label>/)
+ * are not guessed at: point AGENT_PRIVATE_KEY_PATH etc. at them explicitly.
+ */
+export function identityFromDisk(opts = {}) {
+    const cwd = opts.cwd ?? process.cwd();
+    const avDir = join(opts.home ?? homedir(), ".agentvalet");
+    const envFile = join(cwd, ".env.agentvalet");
+    const envText = readText(envFile);
+    if (envText !== null) {
+        const v = parseDotEnv(envText);
+        const agentId = str(v["AGENTVALET_AGENT_ID"]);
+        if (agentId) {
+            return {
+                agentId,
+                ownerId: str(v["AGENTVALET_OWNER_ID"]),
+                keyPath: str(v["AGENTVALET_PRIVATE_KEY_PATH"]),
+                proxyUrl: str(v["AGENTVALET_API_URL"]),
+                source: envFile,
+            };
+        }
+    }
+    const configFile = join(avDir, "config.json");
+    const cfg = readJson(configFile);
+    if (cfg) {
+        // Every register flow rewrites lastAgentId/lastKeyPath as a pair; the
+        // Node `onboard` flow leaves agentId/keyPath stale, so the "last" pair wins.
+        const last = str(cfg.lastAgentId);
+        const agentId = last ?? str(cfg.agentId);
+        if (agentId) {
+            return {
+                agentId,
+                ownerId: str(cfg.ownerId),
+                keyPath: last ? str(cfg.lastKeyPath) : str(cfg.keyPath),
+                proxyUrl: str(cfg.apiUrl) ?? str(cfg.proxyUrl),
+                source: configFile,
+            };
+        }
+    }
+    const agentFile = join(avDir, "agent.json");
+    const ident = readJson(agentFile);
+    const claimedId = ident ? str(ident.agent_id) : null;
+    if (ident && claimedId) {
+        return {
+            agentId: claimedId,
+            ownerId: str(ident.owner_id),
+            keyPath: join(avDir, "agent.key"),
+            proxyUrl: str(ident.proxy_url),
+            source: agentFile,
+        };
+    }
+    return null;
+}
 //# sourceMappingURL=env.js.map

package/dist/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,EAAE;AACF,mDAAmD;AACnD,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,mEAAmE;AACnE,4EAA4E;AAC5E,6EAA6E;AAC7E,gDAAgD;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,2BAA2B,CAAC;AAE7D,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,2EAA2E;AAC3E,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,OAAO,CAAC,cAAc,MAAM,EAAE,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,iBAAiB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAChD,IAAI,GAAG;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAEpE,MAAM,IAAI,GAAG,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAClD,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CACnB,uCAAuC,IAAI,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAC5C,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5C,sEAAsE;QACtE,wEAAwE;QACxE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,OAAO,gCAAgC,SAAS,6BAA6B,CAAC;QAChF,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,IAAI,WAAW,CACnB,iGAAiG;QAC/F,yFAAyF,CAC5F,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,EAAE;AACF,mDAAmD;AACnD,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,mEAAmE;AACnE,yDAAyD;AACzD,EAAE;AACF,6EAA6E;AAC7E,qEAAqE;AACrE,4EAA4E;AAC5E,oEAAoE;AAEpE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,2BAA2B,CAAC;AAE7D,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,2EAA2E;AAC3E,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,OAAO,CAAC,cAAc,MAAM,EAAE,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED;+EAC+E;AAC/E,MAAM,UAAU,gBAAgB;IAC9B,OAAO,UAAU,CAAC,YAAY,CAAC,CAAC;AAClC,CAAC;AAED;mFACmF;AACnF,MAAM,UAAU,eAAe,CAAC,QAAwB;IACtD,OAAO,CACL,UAAU,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,oBAAoB,CAAC,IAAI,QAAQ,IAAI,iBAAiB,CAC1F,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAA4B;IAC5D,MAAM,GAAG,GAAG,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAChD,IAAI,GAAG;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAEpE,MAAM,IAAI,GAAG,UAAU,CAAC,wBAAwB,CAAC,IAAI,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC5F,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CACnB,uCAAuC,IAAI,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAC5C,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5C,sEAAsE;QACtE,wEAAwE;QACxE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,OAAO,gCAAgC,SAAS,6BAA6B,CAAC;QAChF,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,0EAA0E;QAC1E,+DAA+D;QAC/D,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CACnB,gCAAgC,YAAY,6CAA6C;gBACvF,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,IAAI,WAAW,CACnB,iGAAiG;QAC/F,yFAAyF,CAC5F,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAYD,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,CAAC,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACtC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAwC,EAAE;IAE1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;IAE1D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;gBACtC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC;gBAC9C,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;gBACtC,MAAM,EAAE,OAAO;aAChB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,GAAG,EAAE,CAAC;QACR,sEAAsE;QACtE,6EAA6E;QAC7E,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC;gBACzB,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC;gBACvD,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAC9C,MAAM,EAAE,UAAU;aACnB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC5B,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC;YACjC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;YAC9B,MAAM,EAAE,SAAS;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,8 @@
 export { AgentValet } from "./client.js";
-export type { AgentValetOptions, CallRequest } from "./client.js";
+export type { AgentValetOptions, BearerOptions, CallRequest } from "./client.js";
+export { ChildIdentity } from "./child.js";
+export type { ChildGrant, GrantedScope } from "./child.js";
+export { CHILD_MAX_GRANTS, CHILD_TTL_DEFAULT_S, CHILD_TTL_MAX_S, CHILD_TTL_MIN_S, } from "./protocol.js";
 export { AgentValetError, AccessDeniedError, ApprovalDeniedError, ApprovalExpiredError, ApprovalTimeoutError, ConfigError, NetworkError, ProxyError, UpstreamError, } from "./errors.js";
 export { DEFAULT_PROXY_URL } from "./env.js";
 export type { FetchLike } from "./http.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,YAAY,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGjF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,YAAY,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -6,6 +6,9 @@
 // @agentvalet/mcp-server instead and call use_platform. This package is for
 // agents that aren't MCP: LangChain tools, cron jobs, plain Node services.
 export { AgentValet } from "./client.js";
+// Delegation — mint a scope-attenuated, time-boxed identity per subagent.
+export { ChildIdentity } from "./child.js";
+export { CHILD_MAX_GRANTS, CHILD_TTL_DEFAULT_S, CHILD_TTL_MAX_S, CHILD_TTL_MIN_S, } from "./protocol.js";
 export { AgentValetError, AccessDeniedError, ApprovalDeniedError, ApprovalExpiredError, ApprovalTimeoutError, ConfigError, NetworkError, ProxyError, UpstreamError, } from "./errors.js";
 export { DEFAULT_PROXY_URL } from "./env.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,oEAAoE;AACpE,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAE3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,oEAAoE;AACpE,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAE3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,0EAA0E;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC"}

package/dist/protocol.d.ts

@@ -0,0 +1,58 @@
+import { ChildIdentity, type ChildGrant } from "./child.js";
+import type { AgentValet } from "./client.js";
+/** The proxy's own bound (apps/proxy/src/routes/agent-children.ts). Checked
+ *  client-side too so a typo costs a local throw, not a round trip and a 400. */
+export declare const CHILD_TTL_MIN_S = 60;
+export declare const CHILD_TTL_MAX_S = 3600;
+export declare const CHILD_TTL_DEFAULT_S = 900;
+/** Each grant costs the proxy a permissions query; it rejects >25. */
+export declare const CHILD_MAX_GRANTS = 25;
+/**
+ * Rejects an out-of-charset session id before it ever reaches the wire.
+ *
+ * This has to fail loud. The proxy resolves the session as
+ * `jwtSessionId ?? header` — a claim that is PRESENT but invalid resolves to
+ * null and does NOT fall back to a valid header, so a malformed id silently
+ * costs you the attribution you thought you had.
+ */
+export declare function validateSessionId(sessionId: string | undefined): string | undefined;
+export interface IssueChildBody {
+    ttl_seconds: number;
+    grants: Array<{
+        platform: string;
+        scopes: string[];
+        connection_id?: string;
+    }>;
+    name?: string;
+}
+/** Wire body for POST /v1/agents/children. Optional fields are omitted rather
+ *  than sent as null — the route distinguishes absent from null. */
+export declare function buildIssueChildBody(grants: ChildGrant[], name: string | undefined, ttlSeconds: number): IssueChildBody;
+/**
+ * Turns a /v1/agents/children reply into a ChildIdentity.
+ *
+ * The route's non-2xx bodies (`no_scopes_after_attenuation`, `agent_not_active`,
+ * `delegation_depth_exceeded`, `as_signing_unavailable`, the child cap) describe
+ * an issuance outcome, not the grant-check/owner-decision outcomes the specific
+ * error types model. There is nothing endpoint-specific to attach, so this
+ * reuses ProxyError — `.status` and `.body` carry the code to branch on.
+ */
+export declare function interpretIssueChildResponse(status: number, text: string, buildClient: (bearerToken: string) => AgentValet): ChildIdentity;
+/**
+ * Reads the agent/owner id out of a bearer token's payload.
+ *
+ * A child bearer is a JWT carrying its own agent_id (and sub, and owner_id).
+ * Without this the client has no idea who it is, which breaks anything that
+ * has to name the subject — evaluate() would send an empty subject.id and the
+ * proxy answers 400.
+ *
+ * **This is not a security check.** The signature is not verified and must not
+ * be trusted; the server is the sole authority on whether a token is valid.
+ * Anything unparseable yields {} rather than throwing: failing locally would
+ * replace a clear 401 from the server with a confusing client-side crash.
+ */
+export declare function identityFromBearer(token: string): {
+    agentId?: string;
+    ownerId?: string;
+};
+//# sourceMappingURL=protocol.d.ts.map

package/dist/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,aAAa,EAAE,KAAK,UAAU,EAAqB,MAAM,YAAY,CAAC;AAC/E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAI9C;iFACiF;AACjF,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,eAAO,MAAM,eAAe,OAAO,CAAC;AACpC,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,KAAK,CAAC;AASnC;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAQnF;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;oEACoE;AACpE,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,EAAE,EACpB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,UAAU,EAAE,MAAM,GACjB,cAAc,CA0BhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,UAAU,GAC/C,aAAa,CAgBf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAkBxF"}

package/dist/protocol.js

@@ -0,0 +1,121 @@
+// packages/client/src/protocol.ts
+//
+// Pure protocol logic — no I/O. What we send, and what a reply means.
+//
+// Mirrors packages/python-client/src/agentvalet/_protocol.py. Keeping the
+// decisions here (rather than inline in client.ts) is what makes the two SDKs
+// auditable against each other: if a branch exists in one and not the other,
+// this is the file where the difference shows up.
+import { ChildIdentity } from "./child.js";
+import { ConfigError, ProxyError } from "./errors.js";
+import { tryParseJson } from "./http.js";
+/** The proxy's own bound (apps/proxy/src/routes/agent-children.ts). Checked
+ *  client-side too so a typo costs a local throw, not a round trip and a 400. */
+export const CHILD_TTL_MIN_S = 60;
+export const CHILD_TTL_MAX_S = 3600;
+export const CHILD_TTL_DEFAULT_S = 900;
+/** Each grant costs the proxy a permissions query; it rejects >25. */
+export const CHILD_MAX_GRANTS = 25;
+/**
+ * Matches the Python client. Deliberately loose (dots, colons, underscores,
+ * hyphens) so it accepts both a bare UUID and a namespaced trace id like
+ * `run:2026-08-21:abcd`.
+ */
+const SESSION_ID_RE = /^[A-Za-z0-9._:-]{1,128}$/;
+/**
+ * Rejects an out-of-charset session id before it ever reaches the wire.
+ *
+ * This has to fail loud. The proxy resolves the session as
+ * `jwtSessionId ?? header` — a claim that is PRESENT but invalid resolves to
+ * null and does NOT fall back to a valid header, so a malformed id silently
+ * costs you the attribution you thought you had.
+ */
+export function validateSessionId(sessionId) {
+    if (sessionId === undefined)
+        return undefined;
+    if (!SESSION_ID_RE.test(sessionId)) {
+        throw new ConfigError(`sessionId ${JSON.stringify(sessionId)} is invalid — must match [A-Za-z0-9._:-]{1,128}.`);
+    }
+    return sessionId;
+}
+/** Wire body for POST /v1/agents/children. Optional fields are omitted rather
+ *  than sent as null — the route distinguishes absent from null. */
+export function buildIssueChildBody(grants, name, ttlSeconds) {
+    if (!Array.isArray(grants) || grants.length === 0) {
+        throw new ConfigError("issueChild requires at least one grant.");
+    }
+    if (grants.length > CHILD_MAX_GRANTS) {
+        throw new ConfigError(`issueChild accepts at most ${CHILD_MAX_GRANTS} grants (got ${grants.length}).`);
+    }
+    if (!Number.isInteger(ttlSeconds) || ttlSeconds < CHILD_TTL_MIN_S || ttlSeconds > CHILD_TTL_MAX_S) {
+        throw new ConfigError(`ttlSeconds must be an integer ${CHILD_TTL_MIN_S}..${CHILD_TTL_MAX_S} (got ${ttlSeconds}). ` +
+            "There is no refresh endpoint — a longer run must re-mint from the parent.");
+    }
+    const body = {
+        ttl_seconds: ttlSeconds,
+        grants: grants.map((g) => ({
+            platform: g.platform,
+            scopes: g.scopes,
+            ...(g.connectionId ? { connection_id: g.connectionId } : {}),
+        })),
+    };
+    if (name)
+        body.name = name;
+    return body;
+}
+/**
+ * Turns a /v1/agents/children reply into a ChildIdentity.
+ *
+ * The route's non-2xx bodies (`no_scopes_after_attenuation`, `agent_not_active`,
+ * `delegation_depth_exceeded`, `as_signing_unavailable`, the child cap) describe
+ * an issuance outcome, not the grant-check/owner-decision outcomes the specific
+ * error types model. There is nothing endpoint-specific to attach, so this
+ * reuses ProxyError — `.status` and `.body` carry the code to branch on.
+ */
+export function interpretIssueChildResponse(status, text, buildClient) {
+    if (status < 200 || status >= 300)
+        throw new ProxyError(status, text);
+    const payload = tryParseJson(text);
+    if (typeof payload !== "object" || payload === null || Array.isArray(payload)) {
+        throw new ProxyError(status, text);
+    }
+    const p = payload;
+    return new ChildIdentity(String(p.child_agent_id ?? ""), String(p.bearer_token ?? ""), String(p.expires_at ?? ""), Array.isArray(p.granted) ? p.granted : [], buildClient);
+}
+/**
+ * Reads the agent/owner id out of a bearer token's payload.
+ *
+ * A child bearer is a JWT carrying its own agent_id (and sub, and owner_id).
+ * Without this the client has no idea who it is, which breaks anything that
+ * has to name the subject — evaluate() would send an empty subject.id and the
+ * proxy answers 400.
+ *
+ * **This is not a security check.** The signature is not verified and must not
+ * be trusted; the server is the sole authority on whether a token is valid.
+ * Anything unparseable yields {} rather than throwing: failing locally would
+ * replace a clear 401 from the server with a confusing client-side crash.
+ */
+export function identityFromBearer(token) {
+    let claims;
+    try {
+        const parts = token.split(".");
+        if (parts.length !== 3)
+            return {};
+        const decoded = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
+        if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded))
+            return {};
+        claims = decoded;
+    }
+    catch {
+        return {};
+    }
+    const out = {};
+    const agentId = claims.agent_id ?? claims.av_agent_id ?? claims.sub;
+    const ownerId = claims.owner_id ?? claims.av_owner_id;
+    if (typeof agentId === "string" && agentId)
+        out.agentId = agentId;
+    if (typeof ownerId === "string" && ownerId)
+        out.ownerId = ownerId;
+    return out;
+}
+//# sourceMappingURL=protocol.js.map

package/dist/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,0EAA0E;AAC1E,8EAA8E;AAC9E,6EAA6E;AAC7E,kDAAkD;AAElD,OAAO,EAAE,aAAa,EAAsC,MAAM,YAAY,CAAC;AAE/E,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC;iFACiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AACpC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC;;;;GAIG;AACH,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAA6B;IAC7D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,WAAW,CACnB,aAAa,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,kDAAkD,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAQD;oEACoE;AACpE,MAAM,UAAU,mBAAmB,CACjC,MAAoB,EACpB,IAAwB,EACxB,UAAkB;IAElB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,WAAW,CAAC,yCAAyC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACrC,MAAM,IAAI,WAAW,CACnB,8BAA8B,gBAAgB,gBAAgB,MAAM,CAAC,MAAM,IAAI,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,eAAe,IAAI,UAAU,GAAG,eAAe,EAAE,CAAC;QAClG,MAAM,IAAI,WAAW,CACnB,iCAAiC,eAAe,KAAK,eAAe,SAAS,UAAU,KAAK;YAC1F,2EAA2E,CAC9E,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAmB;QAC3B,WAAW,EAAE,UAAU;QACvB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;KACJ,CAAC;IACF,IAAI,IAAI;QAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAc,EACd,IAAY,EACZ,WAAgD;IAEhD,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,MAAM,IAAI,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAEtE,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAE7C,OAAO,IAAI,aAAa,CACtB,MAAM,CAAC,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC,EAC9B,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,EAC5B,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,EAC1B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,OAA0B,CAAC,CAAC,CAAC,EAAE,EAC7D,WAAW,CACZ,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACjF,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QACzF,MAAM,GAAG,OAAkC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,GAAG,GAA2C,EAAE,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC;IACtD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO;QAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;IAClE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO;QAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;IAClE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvalet/client",
-  "version": "0.1.2",
+  "version": "0.2.1",
   "description": "AgentValet client SDK \u2014 call approved SaaS platforms from any Node agent. Signs the agent JWT, brokers through the AgentValet proxy, and waits out owner approvals.",
   "type": "module",
   "main": "dist/index.js",