@atlasauth/pca-agent 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Atlas Authorization
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,64 @@
-# Temporary Holding Version
+# @atlasauth/pca-agent
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Agent-side client for Proof-Carrying Authority (PCA). It commits a plan, builds and signs a PCActn (a proof-carrying action) for a plan node, posts it to a resource server, handles step-up approval, delegates attenuated authority to sub-agents, and checks ledger inclusion receipts.
+
+The client talks to a resource server that exposes the PCA HTTP surface: `POST /v1/pca/plans`, `POST /v1/pca/actions` and `GET /v1/pca/stepups/:id` (the hosted Atlas API does, and so can your own server). `act` emits a proof; it does not authorize anything on its own. The resource server's verifier decides allow, step-up or deny.
+
+## Install
+
+```sh
+npm i @atlasauth/pca-agent
+```
+
+Depends on `@atlasauth/pca` (installed transitively).
+
+## Usage
+
+```ts
+import { createAgent } from '@atlasauth/pca-agent';
+
+const client = createAgent({
+  grant,                 // principal-signed Capability (see @atlasauth/pca)
+  agentSecret,           // Ed25519 secret key (32 bytes) of the leaf holder
+  rsBaseUrl: 'https://api.example.com',
+  audience: 'ins_acme',  // required: the id the resource server verifies against
+});
+
+// 1. Commit the principal-authorised plan (once).
+await client.commitPlan([{ id: 'refund-1', verb: 'stripe.refund', resource: 'ch_123' }]);
+
+// 2. Act on a plan node: builds and signs a PCActn, then POSTs it.
+const res = await client.act('refund-1', { amount: 500 });
+
+if (res.status === 'allowed') {
+  client.verifyReceipt(res.receipt);                       // ledger inclusion proof -> boolean
+} else if (res.status === 'step_up') {
+  const outcome = await client.awaitStepUp(res.stepupId);  // polls for human co-sign
+} else if (res.status === 'denied') {
+  console.log(res.verdict.reason);
+}
+
+// 3. Hand a narrower slice of authority to a sub-agent.
+const sub = client.delegate({
+  toPublic: subAgentPublicKey,
+  addedCaveats: [{ type: 'ttl', secs: 60 }],
+  agentSecret: subAgentSecret,
+});
+```
+
+`audience` is required because a PCActn only verifies at the audience it names, which stops it being replayed at another server. A fresh random nonce is stamped on each action by default, and the per-action counter only moves forward. `act` resolves to `{ status: 'error', error }` (a `PcaAgentError`) for local failures such as calling before `commitPlan` or an unknown node id. Pass `fetch` to supply your own HTTP client.
+
+## API
+
+- `createAgent(options)` returns an `AgentClient` with `commitPlan`, `act`, `awaitStepUp`, `delegate`, `verifyReceipt`, plus `grant`, `chain`, `counter`, `budget`, `planRoot`.
+- Types: `ActResult`, `StepUpOutcome`, `Receipt`, `Verdict`, `ActSlots` (optional signed slots such as `caution`), `PcaAgentError`.
+
+## Status
+
+Experimental. The underlying cryptography in `@atlasauth/pca` has not been independently audited.
+
+Source and issues: https://github.com/Atlas-Authorization/pca
+
+## License
+
+MIT - see LICENSE

package/dist/agent.d.ts

@@ -0,0 +1,128 @@
+import { type Capability, type CapabilityChain, type Caveat, type InclusionProof, type PCActn, type PlanNode } from '@atlasauth/pca';
+export type FetchLike = (url: string, init?: {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+}) => Promise<{
+    status: number;
+    json(): Promise<unknown>;
+}>;
+export interface TrustBudget {
+    B: number;
+    tau: number;
+    asOf: number;
+}
+export interface Verdict {
+    allow: boolean;
+    checks?: Record<string, string>;
+    reason?: string;
+    budget?: TrustBudget;
+    [k: string]: unknown;
+}
+export interface Receipt {
+    grant_ref?: string;
+    index: number;
+    commit: string;
+    root: string;
+    size?: number;
+    inclusion_proof: InclusionProof;
+}
+export type StepUpOutcome = {
+    status: 'approved';
+    pcactn?: PCActn;
+    [k: string]: unknown;
+} | {
+    status: 'denied';
+    [k: string]: unknown;
+} | {
+    status: 'expired';
+    [k: string]: unknown;
+} | {
+    status: 'timeout';
+};
+export type ActResult = {
+    status: 'allowed';
+    verdict: Verdict;
+    receipt: Receipt;
+    pcactn: PCActn;
+} | {
+    status: 'denied';
+    verdict: Verdict;
+    httpStatus: number;
+    pcactn: PCActn;
+} | {
+    status: 'step_up';
+    stepupId: string;
+    requiredT: number;
+    pcactn: PCActn;
+} | {
+    status: 'error';
+    error: PcaAgentError;
+};
+export declare class PcaAgentError extends Error {
+    readonly code: 'no_plan' | 'unknown_node' | 'no_secret' | 'network' | 'bad_response' | 'build_failed';
+    readonly httpStatus?: number | undefined;
+    constructor(code: 'no_plan' | 'unknown_node' | 'no_secret' | 'network' | 'bad_response' | 'build_failed', message: string, httpStatus?: number | undefined);
+}
+export interface CreateAgentOptions {
+    grant: Capability;
+    /** Capability chain starting at the grant; defaults to `[grant]`. */
+    chain?: CapabilityChain;
+    /** Ed25519 secret key (32 bytes) of the leaf holder. Omit only for a sub-agent client you do not drive. */
+    agentSecret?: Uint8Array;
+    /** b64u public key of the agent (informational). */
+    agentPublic?: string;
+    rsBaseUrl: string;
+    /**
+     * REQUIRED. The audience the PCActns are FOR (wire v2 `aud`): for the hosted Atlas API this is the Atlas
+     * INSTANCE id (`ins_...`); for your own resource server, the id it passes to `requirePCA({ audience })`.
+     * A PCActn only verifies at the audience it names, so it cannot be replayed at another server / instance.
+     */
+    audience: string;
+    /** Lifetime stamped into each PCActn (`exp = iat + ttlMs`), default 20 min (covers the 15-min step-up window). */
+    ttlMs?: number;
+    /** Clock (epoch ms) for `iat`; default `Date.now`. */
+    now?: () => number;
+    /** Stamp a fresh random per-action `nonce` (default true). */
+    nonce?: boolean;
+    fetch?: FetchLike;
+    /** Initial counter (last used); the first act() uses counter+1. Default 0. */
+    counter?: number;
+    budget?: TrustBudget;
+}
+/** Optional signed slots of wire v2 (all signed into the PCActn when present; absent = current behaviour). */
+export interface ActSlots {
+    /** Uncertainty attestation in [0,1]; MONOTONE (the verifier takes max with its own risk). */
+    caution?: number;
+    /** b64u(32) commitment to your rationale. */
+    rationaleCommitment?: string;
+    progressStep?: Record<string, unknown>;
+    prohibitionEvidence?: Record<string, unknown> | unknown[];
+    /** The tool signature you will dispatch to (hashed with `hashCanonical`) or its b64u(32) digest. */
+    toolBinding?: string;
+    /** Override the generated nonce. */
+    nonce?: string;
+}
+export interface AgentClient {
+    readonly grant: Capability;
+    readonly chain: CapabilityChain;
+    readonly agentPublic?: string;
+    readonly counter: number;
+    readonly budget: TrustBudget | undefined;
+    readonly planRoot: string | undefined;
+    commitPlan(nodes: PlanNode[]): Promise<{
+        planRoot: string;
+    }>;
+    act(nodeId: string, params?: Record<string, unknown>, slots?: ActSlots): Promise<ActResult>;
+    awaitStepUp(stepupId: string, opts?: {
+        pollMs?: number;
+        timeoutMs?: number;
+    }): Promise<StepUpOutcome>;
+    delegate(opts: {
+        toPublic: string;
+        addedCaveats?: Caveat[];
+        agentSecret?: Uint8Array;
+    }): AgentClient;
+    verifyReceipt(receipt: Receipt): boolean;
+}
+export declare function createAgent(opts: CreateAgentOptions): AgentClient;

package/dist/agent.js

@@ -0,0 +1,183 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PcaAgentError = void 0;
+exports.createAgent = createAgent;
+const pca_1 = require("@atlasauth/pca");
+class PcaAgentError extends Error {
+    code;
+    httpStatus;
+    constructor(code, message, httpStatus) {
+        super(message);
+        this.code = code;
+        this.httpStatus = httpStatus;
+        this.name = 'PcaAgentError';
+    }
+}
+exports.PcaAgentError = PcaAgentError;
+const newNonce = () => {
+    const b = new Uint8Array(16);
+    globalThis.crypto.getRandomValues(b);
+    return Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('');
+};
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function createAgent(opts) {
+    if (typeof opts.audience !== 'string' || opts.audience.length === 0) {
+        throw new PcaAgentError('build_failed', 'createAgent: `audience` is required (the resource-server / Atlas instance id PCActns are for)');
+    }
+    const base = opts.rsBaseUrl.replace(/\/+$/, '');
+    const doFetch = opts.fetch ?? ((u, i) => globalThis.fetch(u, i));
+    const chain = opts.chain ?? [opts.grant];
+    let counter = opts.counter ?? 0;
+    let budget = opts.budget;
+    let plan;
+    let planRoot;
+    const call = async (method, path, body) => {
+        const res = await doFetch(`${base}${path}`, {
+            method,
+            headers: { 'content-type': 'application/json', accept: 'application/json' },
+            body: body === undefined ? undefined : JSON.stringify(body),
+        });
+        let json = {};
+        try {
+            json = ((await res.json()) ?? {});
+        }
+        catch {
+            /* non-JSON body */
+        }
+        return { status: res.status, json };
+    };
+    const client = {
+        grant: opts.grant,
+        chain,
+        agentPublic: opts.agentPublic,
+        get counter() {
+            return counter;
+        },
+        get budget() {
+            return budget;
+        },
+        get planRoot() {
+            return planRoot;
+        },
+        async commitPlan(nodes) {
+            const local = (0, pca_1.commitPlan)(nodes).root;
+            const res = await call('POST', '/v1/pca/plans', { grant_ref: opts.grant.id, nodes });
+            if (res.status < 200 || res.status >= 300) {
+                throw new PcaAgentError('bad_response', `plan commit failed (${res.status})`, res.status);
+            }
+            const remote = res.json.plan_root;
+            if (typeof remote === 'string' && remote !== local) {
+                throw new PcaAgentError('bad_response', 'server plan_root differs from the locally computed root', res.status);
+            }
+            plan = nodes;
+            planRoot = local;
+            return { planRoot: local };
+        },
+        async act(nodeId, params, slots) {
+            if (!plan)
+                return { status: 'error', error: new PcaAgentError('no_plan', 'commitPlan() first') };
+            if (!opts.agentSecret)
+                return { status: 'error', error: new PcaAgentError('no_secret', 'no agentSecret for this client') };
+            if (!plan.some((n) => n.id === nodeId)) {
+                return { status: 'error', error: new PcaAgentError('unknown_node', `unknown plan node ${nodeId}`) };
+            }
+            const next = counter + 1;
+            let pcactn;
+            try {
+                // The leaf `sig` IS the agent's threshold share: no separate agent share is carried.
+                pcactn = (0, pca_1.buildPCActn)({
+                    grant: opts.grant,
+                    chain,
+                    plan,
+                    nodeId,
+                    params,
+                    counter: next,
+                    signerSecret: opts.agentSecret,
+                    aud: opts.audience,
+                    now: (opts.now ?? Date.now)(),
+                    ...(opts.ttlMs !== undefined ? { ttlMs: opts.ttlMs } : {}),
+                    ...(slots?.nonce !== undefined ? { nonce: slots.nonce } : opts.nonce !== false ? { nonce: newNonce() } : {}),
+                    ...(slots?.caution !== undefined ? { caution: slots.caution } : {}),
+                    ...(slots?.rationaleCommitment !== undefined ? { rationaleCommitment: slots.rationaleCommitment } : {}),
+                    ...(slots?.progressStep !== undefined ? { progressStep: slots.progressStep } : {}),
+                    ...(slots?.prohibitionEvidence !== undefined ? { prohibitionEvidence: slots.prohibitionEvidence } : {}),
+                    ...(slots?.toolBinding !== undefined ? { toolBinding: slots.toolBinding } : {}),
+                });
+            }
+            catch (e) {
+                return { status: 'error', error: new PcaAgentError('build_failed', e.message) };
+            }
+            counter = next; // monotonic: never reuse a counter, even if the call fails
+            let res;
+            try {
+                res = await call('POST', '/v1/pca/actions', { pcactn });
+            }
+            catch (e) {
+                return { status: 'error', error: new PcaAgentError('network', e.message) };
+            }
+            const j = res.json;
+            if (res.status === 202 || j.status === 'step_up_required' || j.step_up_required === true) {
+                const id = (j.stepup_id ?? j.stepupId ?? j.id);
+                const t = (j.required_t ?? j.requiredT ?? j.t);
+                if (typeof id !== 'string') {
+                    return { status: 'error', error: new PcaAgentError('bad_response', 'step-up response missing stepup_id', res.status) };
+                }
+                return { status: 'step_up', stepupId: id, requiredT: typeof t === 'number' ? t : 2, pcactn };
+            }
+            const verdict = (j.verdict ?? { allow: j.allow === true });
+            if (verdict.budget)
+                budget = verdict.budget;
+            if (res.status >= 200 && res.status < 300 && (j.allow === true || verdict.allow)) {
+                const receipt = j.receipt;
+                if (!receipt)
+                    return { status: 'error', error: new PcaAgentError('bad_response', 'allow without receipt', res.status) };
+                return { status: 'allowed', verdict, receipt, pcactn };
+            }
+            return { status: 'denied', verdict, httpStatus: res.status, pcactn };
+        },
+        async awaitStepUp(stepupId, o = {}) {
+            const pollMs = o.pollMs ?? 1000;
+            const deadline = Date.now() + (o.timeoutMs ?? 5 * 60_000);
+            for (;;) {
+                const res = await call('GET', `/v1/pca/stepups/${encodeURIComponent(stepupId)}`);
+                const s = res.json.status;
+                if (s === 'approved' || s === 'denied' || s === 'expired') {
+                    return { ...res.json, status: s };
+                }
+                if (Date.now() + pollMs > deadline)
+                    return { status: 'timeout' };
+                await sleep(pollMs);
+            }
+        },
+        delegate({ toPublic, addedCaveats = [], agentSecret }) {
+            if (!opts.agentSecret)
+                throw new PcaAgentError('no_secret', 'cannot delegate without agentSecret');
+            const leaf = chain[chain.length - 1];
+            const child = (0, pca_1.delegate)(leaf, toPublic, addedCaveats, opts.agentSecret);
+            const sub = createAgent({
+                grant: opts.grant,
+                chain: [...chain, child],
+                agentSecret,
+                agentPublic: toPublic,
+                rsBaseUrl: base,
+                audience: opts.audience,
+                ...(opts.ttlMs !== undefined ? { ttlMs: opts.ttlMs } : {}),
+                ...(opts.now ? { now: opts.now } : {}),
+                ...(opts.nonce !== undefined ? { nonce: opts.nonce } : {}),
+                fetch: doFetch,
+                counter: 0,
+            });
+            return sub;
+        },
+        verifyReceipt(r) {
+            try {
+                return (0, pca_1.verifyLedgerInclusion)(r.root, r.inclusion_proof, r.commit);
+            }
+            catch {
+                return false;
+            }
+        },
+    };
+    return client;
+}
+//# sourceMappingURL=agent.js.map

package/dist/agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":";;;AA+HA,kCA4JC;AA3RD,wCAWwB;AA0CxB,MAAa,aAAc,SAAQ,KAAK;IAEpB;IAEA;IAHlB,YACkB,IAA4F,EAC5G,OAAe,EACC,UAAmB;QAEnC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAwF;QAE5F,eAAU,GAAV,UAAU,CAAS;QAGnC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AATD,sCASC;AAyDD,MAAM,QAAQ,GAAG,GAAW,EAAE;IAC5B,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC5B,UAAoF,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAChH,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpE,SAAgB,WAAW,CAAC,IAAwB;IAClD,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,+FAA+F,CAAC,CAAC;IAC3I,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,OAAO,GAAc,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAE,UAA8C,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;IAChC,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACzB,IAAI,IAA4B,CAAC;IACjC,IAAI,QAA4B,CAAC;IAEjC,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAE,IAAY,EAAE,IAAc,EAAE,EAAE;QAClE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;YAC1C,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC5D,CAAC,CAAC;QACH,IAAI,IAAI,GAA4B,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC,CAAC;IAEF,MAAM,MAAM,GAAgB;QAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,IAAI,OAAO;YACT,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,MAAM;YACR,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,QAAQ;YACV,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,KAAK;YACpB,MAAM,KAAK,GAAG,IAAA,gBAAe,EAAC,KAAK,CAAC,CAAC,IAAI,CAAC;YAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACrF,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC1C,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,uBAAuB,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YAClC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACnD,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,yDAAyD,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACjH,CAAC;YACD,IAAI,GAAG,KAAK,CAAC;YACb,QAAQ,GAAG,KAAK,CAAC;YACjB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC7B,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK;YAC7B,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,aAAa,CAAC,SAAS,EAAE,oBAAoB,CAAC,EAAE,CAAC;YACjG,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,aAAa,CAAC,WAAW,EAAE,gCAAgC,CAAC,EAAE,CAAC;YAC3H,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;gBACvC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,aAAa,CAAC,cAAc,EAAE,qBAAqB,MAAM,EAAE,CAAC,EAAE,CAAC;YACtG,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,CAAC;YACzB,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,qFAAqF;gBACrF,MAAM,GAAG,IAAA,iBAAW,EAAC;oBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK;oBACL,IAAI;oBACJ,MAAM;oBACN,MAAM;oBACN,OAAO,EAAE,IAAI;oBACb,YAAY,EAAE,IAAI,CAAC,WAAW;oBAC9B,GAAG,EAAE,IAAI,CAAC,QAAQ;oBAClB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE;oBAC7B,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC1D,GAAG,CAAC,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5G,GAAG,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnE,GAAG,CAAC,KAAK,EAAE,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvG,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClF,GAAG,CAAC,KAAK,EAAE,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvG,GAAG,CAAC,KAAK,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,aAAa,CAAC,cAAc,EAAG,CAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7F,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,CAAC,2DAA2D;YAC3E,IAAI,GAAG,CAAC;YACR,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,aAAa,CAAC,SAAS,EAAG,CAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACxF,CAAC;YACD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;YACnB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,kBAAkB,IAAI,CAAC,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;gBACzF,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAY,CAAC;gBAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAY,CAAC;gBAC1D,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;oBAC3B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,aAAa,CAAC,cAAc,EAAE,oCAAoC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzH,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;YAC/F,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,EAAE,CAAY,CAAC;YACtE,IAAI,OAAO,CAAC,MAAM;gBAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC5C,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjF,MAAM,OAAO,GAAG,CAAC,CAAC,OAA8B,CAAC;gBACjD,IAAI,CAAC,OAAO;oBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,aAAa,CAAC,cAAc,EAAE,uBAAuB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YACzD,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QACvE,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE;YAChC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;YAC1D,SAAS,CAAC;gBACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,mBAAmB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACjF,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC1B,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC1D,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAmB,CAAC;gBACrD,CAAC;gBACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,GAAG,QAAQ;oBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBACjE,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,QAAQ,CAAC,EAAE,QAAQ,EAAE,YAAY,GAAG,EAAE,EAAE,WAAW,EAAE;YACnD,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,qCAAqC,CAAC,CAAC;YACnG,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;YACtC,MAAM,KAAK,GAAG,IAAA,cAAW,EAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1E,MAAM,GAAG,GAAG,WAAW,CAAC;gBACtB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC;gBACxB,WAAW;gBACX,WAAW,EAAE,QAAQ;gBACrB,SAAS,EAAE,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,CAAC;aACX,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACb,CAAC;QAED,aAAa,CAAC,CAAC;YACb,IAAI,CAAC;gBACH,OAAO,IAAA,2BAAqB,EAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YACpE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1 @@
+export * from './agent';

package/dist/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./agent"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB"}

package/package.json

@@ -1,6 +1,57 @@
 {
   "name": "@atlasauth/pca-agent",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "description": "Agent-side client for Proof-Carrying Authority: commit a plan, act with a PCActn + threshold share, handle step-up, delegate to sub-agents, verify receipts.",
+  "keywords": [
+    "agent client",
+    "step-up",
+    "delegation",
+    "receipts",
+    "agent authorization",
+    "proof-carrying authority",
+    "pca",
+    "ai agents"
+  ],
+  "license": "MIT",
+  "homepage": "https://github.com/Atlas-Authorization/pca#readme",
+  "bugs": {
+    "url": "https://github.com/Atlas-Authorization/pca/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Atlas-Authorization/pca.git",
+    "directory": "packages/pca-agent"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@atlasauth/pca": "0.2.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.4"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
 }