@atlasauth/pca-agentcard 0.0.0-stage → 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,333 @@
+/**
+ * @atlasauth/pca-agentcard — signed agent card + AgentFacts attestor for PCA.
+ *
+ * ┌──────────────────────────────────────────────────────────────────────────────────────────────┐
+ * │  The fix for the spoofable self-declared agent card: PCA becomes the THIRD-PARTY ATTESTOR whose  │
+ * │  card + AgentFacts point at LIVE, VERIFIABLE proof-of-authority instead of a self-assertion.     │
+ * └──────────────────────────────────────────────────────────────────────────────────────────────┘
+ *
+ * The agent-discovery world today has two surfaces that both separate "what an agent says about
+ * itself" from "what a third party will vouch for":
+ *
+ *   • A2A 1.0 Agent Cards (`/.well-known/agent-card.json`) carry an `AgentCardSignature` — a JWS over
+ *     the canonicalized card — so a consumer can tell a signed card from an unsigned, forgeable one.
+ *   • NANDA AgentFacts is a metadata document that explicitly splits SELF-ASSERTED claims from
+ *     third-party ATTESTATIONS (each a signed statement by a named attestor, with a validity window).
+ *
+ * Both schemes answer "is this card authentic?" — they do NOT answer "does this agent actually hold
+ * the authority it advertises?". That is exactly PCA's job. This package makes PCA the third-party
+ * attestor: it signs the agent's AgentFacts attestation block, and it builds a signed Agent Card whose
+ * metadata points at the agent's PCA passport AND a live proof-verification endpoint, so a relying party
+ * resolves verifiable proof-of-authority (a PCActn) instead of trusting the card's word.
+ *
+ * WIRE COMPATIBILITY. The Signed-Agent-Card surface here is byte-identical to the one in
+ * `@atlasauth/pca-a2a` (A2A 1.0 `AgentCardSignature`): the SAME canonical signing bytes (the card minus
+ * its `signatures`), the SAME detached-payload JWS (`b64:false`, `crit:['b64']`), the SAME `pca_passport`
+ * protected-header commitment, and the SAME `signatures[]` shape. A card issued here verifies under
+ * `@atlasauth/pca-a2a`'s `verifyAgentCard` and vice-versa — this module does not define a divergent
+ * scheme, it hosts the A2A card signer and layers AgentFacts + the attestor + the well-known hosting on
+ * top. (It builds only on `@atlasauth/pca` and `jose`, the same two primitives that card signer uses.)
+ *
+ * Everything here FAILS CLOSED: a missing signature, an unresolvable key, a tampered body, a bad/expired
+ * attestation, or an attestation about a different subject is rejected — never silently trusted.
+ */
+import { type AgentPassport } from '@atlasauth/pca';
+import { type JSONWebKeySet, type JWK, type KeyLike } from 'jose';
+/** A key usable to sign. A plain JWK is imported for the given alg; other forms are passed through. */
+export type SignKeyInput = KeyLike | Uint8Array | JWK;
+/** A key usable to verify. A plain JWK is imported for the given alg; other forms are passed through. */
+export type VerifyKeyInput = KeyLike | Uint8Array | JWK;
+/** Default JWS algorithm for card + attestation signatures. */
+export declare const DEFAULT_ALG: "EdDSA";
+/**
+ * A detached-payload JWS, per A2A 1.0's `AgentCardSignature`: `protected` is the base64url JWS protected
+ * header, `signature` the base64url signature. The payload is NOT carried (it is recomputed — the
+ * canonical bytes of the thing being signed — on verify). Reused verbatim for AgentFacts attestations.
+ */
+export interface AgentCardSignature {
+    protected: string;
+    signature: string;
+    header?: Record<string, unknown>;
+}
+/** Options shared by the verify surfaces: either a JWKS (kid-resolved) or a single key. */
+export interface VerifyKeyOptions {
+    /** A JWKS to resolve the signing key from (matched by the JWS `kid` / `alg`). */
+    jwks?: JSONWebKeySet;
+    /** A single verification key (JWK, raw secret, or a crypto key). */
+    key?: VerifyKeyInput;
+    /** Expected JWS algorithm for `importJWK` of a plain JWK `key` (default `'EdDSA'`). */
+    alg?: string;
+}
+/** A reference to the agent's PCA passport (see `@atlasauth/pca` `AgentPassport`). */
+export interface PassportRef {
+    /** The content-addressed passport id (`AgentPassport.id`). */
+    id: string;
+    /** Optional URL where the full, verifiable passport can be resolved. */
+    uri?: string;
+}
+/**
+ * A live proof-of-authority pointer embedded in the signed card. This is what turns the card from a
+ * self-declaration into a pointer at verifiable authority: a relying party presents the agent's PCA
+ * proof (a PCActn) to `verificationEndpoint` and only trusts the agent once that proof verifies.
+ */
+export interface PcaProofRef {
+    /** The HTTP endpoint that verifies a presented PCA proof (PCActn) for this agent. */
+    verificationEndpoint: string;
+    /** Optional reference/digest of a representative or most-recent proof. */
+    proofRef?: string;
+    /** The resource server / Atlas instance id the agent's proofs are audience-bound to. */
+    aud?: string;
+}
+/** An A2A Agent Card skill entry. Structural only; real cards carry more fields, all preserved + signed. */
+export interface AgentSkill {
+    id: string;
+    name: string;
+    description?: string;
+    tags?: string[];
+    [k: string]: unknown;
+}
+/** A minimal, permissive A2A Agent Card. Real cards carry many more fields; all are preserved + signed. */
+export interface AgentCard {
+    name: string;
+    description?: string;
+    url?: string;
+    version?: string;
+    skills?: AgentSkill[];
+    /** The PCA passport this card's authority is rooted in (embedded + covered by the signature). */
+    pcaPassport?: PassportRef;
+    /** The live proof-verification pointer (embedded + covered by the signature). */
+    pcaProof?: PcaProofRef;
+    signatures?: AgentCardSignature[];
+    [k: string]: unknown;
+}
+export interface BuildAgentCardOptions {
+    /** The agent's human name (A2A `name`). */
+    name: string;
+    /** The agent's advertised skills. */
+    skills?: AgentSkill[];
+    /** The agent's A2A service URL. */
+    url?: string;
+    description?: string;
+    version?: string;
+    /** Where/whether the full passport can be resolved (becomes `pcaPassport.uri`). */
+    passportUri?: string;
+    /** The live proof-of-authority pointer embedded in the card. */
+    pcaProofRef?: PcaProofRef;
+}
+/**
+ * Build an (unsigned) A2A Agent Card from a PCA passport. The card's metadata points at the PCA passport
+ * (`pcaPassport`) and, when given, the live proof-verification endpoint (`pcaProof`) — so once signed it
+ * is a pointer at verifiable authority rather than a self-declaration. Sign it with {@link issueSignedAgentCard}.
+ */
+export declare function buildAgentCard(passport: AgentPassport, opts: BuildAgentCardOptions): AgentCard;
+export interface IssueAgentCardOptions {
+    /** JWS algorithm for the signature. Default `'EdDSA'`. */
+    alg?: string;
+    /** A passport reference to embed if the card does not already carry one. */
+    passport?: PassportRef | {
+        id: string;
+    };
+    /** Optional JWS `kid` (set it when verifiers resolve the key from a JWKS). */
+    kid?: string;
+}
+/**
+ * Sign an A2A Agent Card. Ensures a PCA passport reference is embedded (`pcaPassport`) and committed in
+ * the JWS protected header (`pca_passport`), then signs the canonicalized card (minus `signatures`) and
+ * appends the detached-payload `AgentCardSignature`. Wire-identical to `@atlasauth/pca-a2a`.
+ */
+export declare function issueSignedAgentCard(card: AgentCard, signingKey: SignKeyInput, opts?: IssueAgentCardOptions): Promise<AgentCard>;
+/** The outcome of validating a signed Agent Card. */
+export interface AgentCardVerification {
+    ok: boolean;
+    reason?: string;
+    /** The passport id recovered from a verified signature's protected header (proof-of-authority pointer). */
+    passportRef?: string;
+    /** The passport reference embedded in the (verified) card body, when present. */
+    passport?: PassportRef;
+    /** The live proof pointer from the (verified) card body, when present. */
+    pcaProof?: PcaProofRef;
+}
+/**
+ * Validate an A2A Agent Card against its `AgentCardSignature`(s). Fail-closed: a card with no signatures,
+ * an unresolvable key, or ANY signature that does not verify over the canonicalized card (minus
+ * `signatures`) is rejected. On success, returns the PCA passport id the signature commits to plus the
+ * live proof pointer, so a caller can resolve + check them against a `PassportRegistry` / verify endpoint.
+ */
+export declare function verifyAgentCard(card: AgentCard, opts: VerifyKeyOptions): Promise<AgentCardVerification>;
+/**
+ * JSON-LD contexts for an AgentFacts document. The DID context plus the AgentFacts vocabulary (the second
+ * entry is a placeholder for the canonical NANDA AgentFacts context URL — replace before production).
+ */
+export declare const AGENT_FACTS_CONTEXT: readonly string[];
+/**
+ * One third-party attestation inside an AgentFacts doc: a NAMED attestor (`issuer`) vouches, over a
+ * signature, for a set of claims (`attests`) ABOUT a subject (`subject`) within a validity window. PCA
+ * is the issuer; the signature is a detached JWS over the canonical statement (see {@link issueAgentFacts}).
+ */
+export interface AgentFactsAttestation {
+    /** The attestor's identifier (e.g. a DID). PCA's attestor id when PCA signs it. */
+    issuer: string;
+    /** The agent this statement is ABOUT — MUST equal the enclosing doc's `id` (checked on verify). */
+    subject: string;
+    /** The claims this attestor vouches for (third-party-verified, as opposed to self-asserted). */
+    attests: Record<string, unknown>;
+    /** Validity window start (ISO 8601). */
+    validFrom: string;
+    /** Validity window end (ISO 8601), if the attestation expires. */
+    validUntil?: string;
+    /** Detached JWS over the canonicalized statement (issuer + subject + attests + validity). */
+    signature: AgentCardSignature;
+}
+/**
+ * An AgentFacts document: the agent's id (DID / passport ref), its SELF-ASSERTED claims (unverified — the
+ * agent's own word), and a list of third-party ATTESTATIONS, each a signed statement. The split is the
+ * whole point: a relying party can tell what the agent merely claims from what a named attestor vouches for.
+ */
+export interface AgentFacts {
+    '@context': readonly string[];
+    /** The agent's DID / passport reference. */
+    id: string;
+    type: 'AgentFacts';
+    /** Claims the agent declares about itself — NOT verified; trust at your own risk. */
+    selfAsserted: Record<string, unknown>;
+    /** Third-party attestations, each independently verifiable + fail-closed. */
+    attestations: AgentFactsAttestation[];
+}
+/** Default attestor identity used when PCA signs an AgentFacts attestation. */
+export declare const PCA_ATTESTOR_ID: "did:atlas:pca-attestor";
+export interface IssueAgentFactsOptions {
+    /** The agent's self-declared claims (echoed verbatim; never signed). */
+    selfAsserted?: Record<string, unknown>;
+    /** The PCA attestor's signing key. */
+    attestorKey: SignKeyInput;
+    /** The claims PCA (the third party) vouches for about this agent. */
+    attests: Record<string, unknown>;
+    /** The attestor identifier recorded on the attestation. Default {@link PCA_ATTESTOR_ID}. */
+    attestorId?: string;
+    /** Override the agent id / DID (default: the passport id). */
+    agentId?: string;
+    /** JWS algorithm. Default `'EdDSA'`. */
+    alg?: string;
+    /** Optional JWS `kid` so a JWKS verifier can resolve the attestor key. */
+    kid?: string;
+    /** Validity window start (ISO). Default: now. */
+    validFrom?: string;
+    /** Validity window end (ISO). */
+    validUntil?: string;
+    /** Clock for the default `validFrom` (epoch ms). Default `Date.now()`. */
+    now?: number;
+    /** Override the JSON-LD `@context`. */
+    context?: readonly string[];
+}
+/**
+ * Issue an AgentFacts document for a PCA passport, with PCA as the THIRD-PARTY ATTESTOR. The agent's own
+ * `selfAsserted` claims are carried verbatim and left unsigned; the `attests` claims are wrapped in a
+ * statement (issuer + subject + validity) and signed with `attestorKey`. A verifier can then tell exactly
+ * which claims a named third party vouches for. The resulting doc is served at `/.well-known/agent-facts.json`.
+ */
+export declare function issueAgentFacts(passport: AgentPassport, opts: IssueAgentFactsOptions): Promise<AgentFacts>;
+export interface AddAttestationOptions {
+    attestorKey: SignKeyInput;
+    attests: Record<string, unknown>;
+    attestorId?: string;
+    alg?: string;
+    kid?: string;
+    validFrom?: string;
+    validUntil?: string;
+    now?: number;
+}
+/**
+ * Append another third-party attestation to an existing AgentFacts doc (returns a copy; input unmutated).
+ * Lets several independent attestors each vouch for a different subset of claims.
+ */
+export declare function addAttestation(facts: AgentFacts, opts: AddAttestationOptions): Promise<AgentFacts>;
+/** Per-attestation verification outcome. */
+export interface AttestationCheck {
+    issuer: string;
+    ok: boolean;
+    reason?: string;
+    /** The attested claims (present only when this attestation verified). */
+    attests?: Record<string, unknown>;
+}
+/** Whether a claim in the resolved view is third-party attested or merely self-asserted. */
+export type ClaimProvenance = 'attested' | 'self-asserted';
+/** The outcome of verifying an AgentFacts document. */
+export interface AgentFactsVerification {
+    ok: boolean;
+    reason?: string;
+    agentId: string;
+    /** One entry per attestation in the doc, in order. */
+    attestations: AttestationCheck[];
+    /** The union of claims from every VERIFIED attestation (third-party backed). */
+    attested: Record<string, unknown>;
+    /** The agent's self-declared claims, echoed (unverified — flagged as self-asserted). */
+    selfAsserted: Record<string, unknown>;
+    /** Provenance of every claim name seen across self-asserted + attested (attested wins on overlap). */
+    claims: Record<string, ClaimProvenance>;
+}
+export interface VerifyAgentFactsOptions extends VerifyKeyOptions {
+    /** Verification clock for the attestations' validity windows (epoch ms). Default `Date.now()`. */
+    now?: number;
+}
+/**
+ * Verify an AgentFacts document. Fail-closed throughout:
+ *   • an attestation whose `subject` is not this doc's `id` is rejected;
+ *   • an attestation outside its validity window (or with a malformed window) is rejected;
+ *   • an attestation whose detached JWS does not verify under the supplied key/JWKS is rejected;
+ *   • if ANY present attestation fails, the whole document verification returns `ok:false`.
+ * On success, the result marks which claims are third-party ATTESTED and which are merely SELF-ASSERTED
+ * (flagged, never promoted). A doc with zero attestations verifies, but attests nothing.
+ */
+export declare function verifyAgentFacts(facts: AgentFacts, opts: VerifyAgentFactsOptions): Promise<AgentFactsVerification>;
+/** The A2A well-known path a signed Agent Card is served at. */
+export declare const WELL_KNOWN_AGENT_CARD_PATH: "/.well-known/agent-card.json";
+/** The well-known path an AgentFacts document is served at. */
+export declare const WELL_KNOWN_AGENT_FACTS_PATH: "/.well-known/agent-facts.json";
+/** A minimal, framework-agnostic HTTP response the handlers emit. */
+export interface HostedResponse {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+}
+/**
+ * A path handler: given a request path, return the response for the resource it serves, or `undefined`
+ * when the path is not this handler's — so it composes in a router (fall through to the next handler).
+ */
+export type PathHandler = (path: string) => HostedResponse | undefined;
+/** Serve a signed Agent Card at {@link WELL_KNOWN_AGENT_CARD_PATH}; `undefined` for any other path. */
+export declare function agentCardHandler(card: AgentCard, path?: string): PathHandler;
+/** Serve an AgentFacts document at {@link WELL_KNOWN_AGENT_FACTS_PATH}; `undefined` for any other path. */
+export declare function agentFactsHandler(facts: AgentFacts, path?: string): PathHandler;
+/**
+ * A structural entry for publishing an agent to an A2A registry / NANDA index: the identity + discovery
+ * fields a registry indexes, plus the signed card, the AgentFacts doc, and the derived split of which
+ * advertised claim names are third-party ATTESTED vs merely SELF-ASSERTED (so an index can rank/flag them).
+ */
+export interface RegistryEntry {
+    /** The agent id / DID (the AgentFacts `id`). */
+    id: string;
+    name: string;
+    url?: string;
+    version?: string;
+    skills?: AgentSkill[];
+    /** The PCA passport the card commits to. */
+    passport?: PassportRef;
+    /** The live proof-verification pointer. */
+    pcaProof?: PcaProofRef;
+    /** The signed Agent Card (verbatim). */
+    card: AgentCard;
+    /** The well-known URL the card is served at, derived from `card.url` when present. */
+    agentCardUrl?: string;
+    /** The AgentFacts document (verbatim). */
+    facts: AgentFacts;
+    /** Claim names a third party attests (union across attestations). */
+    attestedClaims: string[];
+    /** Claim names the agent only self-asserts (not covered by any attestation). */
+    selfAssertedClaims: string[];
+}
+/**
+ * Shape a {@link RegistryEntry} from a signed card + an AgentFacts doc for submission to an A2A registry /
+ * NANDA index. Purely structural: it does NOT re-verify (a registry re-verifies on ingest) — it derives
+ * the attested-vs-self-asserted claim split from the doc so the index can surface what a third party backs.
+ */
+export declare function toRegistryEntry(card: AgentCard, facts: AgentFacts): RegistryEntry;

package/dist/index.js

@@ -0,0 +1,440 @@
+"use strict";
+/**
+ * @atlasauth/pca-agentcard — signed agent card + AgentFacts attestor for PCA.
+ *
+ * ┌──────────────────────────────────────────────────────────────────────────────────────────────┐
+ * │  The fix for the spoofable self-declared agent card: PCA becomes the THIRD-PARTY ATTESTOR whose  │
+ * │  card + AgentFacts point at LIVE, VERIFIABLE proof-of-authority instead of a self-assertion.     │
+ * └──────────────────────────────────────────────────────────────────────────────────────────────┘
+ *
+ * The agent-discovery world today has two surfaces that both separate "what an agent says about
+ * itself" from "what a third party will vouch for":
+ *
+ *   • A2A 1.0 Agent Cards (`/.well-known/agent-card.json`) carry an `AgentCardSignature` — a JWS over
+ *     the canonicalized card — so a consumer can tell a signed card from an unsigned, forgeable one.
+ *   • NANDA AgentFacts is a metadata document that explicitly splits SELF-ASSERTED claims from
+ *     third-party ATTESTATIONS (each a signed statement by a named attestor, with a validity window).
+ *
+ * Both schemes answer "is this card authentic?" — they do NOT answer "does this agent actually hold
+ * the authority it advertises?". That is exactly PCA's job. This package makes PCA the third-party
+ * attestor: it signs the agent's AgentFacts attestation block, and it builds a signed Agent Card whose
+ * metadata points at the agent's PCA passport AND a live proof-verification endpoint, so a relying party
+ * resolves verifiable proof-of-authority (a PCActn) instead of trusting the card's word.
+ *
+ * WIRE COMPATIBILITY. The Signed-Agent-Card surface here is byte-identical to the one in
+ * `@atlasauth/pca-a2a` (A2A 1.0 `AgentCardSignature`): the SAME canonical signing bytes (the card minus
+ * its `signatures`), the SAME detached-payload JWS (`b64:false`, `crit:['b64']`), the SAME `pca_passport`
+ * protected-header commitment, and the SAME `signatures[]` shape. A card issued here verifies under
+ * `@atlasauth/pca-a2a`'s `verifyAgentCard` and vice-versa — this module does not define a divergent
+ * scheme, it hosts the A2A card signer and layers AgentFacts + the attestor + the well-known hosting on
+ * top. (It builds only on `@atlasauth/pca` and `jose`, the same two primitives that card signer uses.)
+ *
+ * Everything here FAILS CLOSED: a missing signature, an unresolvable key, a tampered body, a bad/expired
+ * attestation, or an attestation about a different subject is rejected — never silently trusted.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WELL_KNOWN_AGENT_FACTS_PATH = exports.WELL_KNOWN_AGENT_CARD_PATH = exports.PCA_ATTESTOR_ID = exports.AGENT_FACTS_CONTEXT = exports.DEFAULT_ALG = void 0;
+exports.buildAgentCard = buildAgentCard;
+exports.issueSignedAgentCard = issueSignedAgentCard;
+exports.verifyAgentCard = verifyAgentCard;
+exports.issueAgentFacts = issueAgentFacts;
+exports.addAttestation = addAttestation;
+exports.verifyAgentFacts = verifyAgentFacts;
+exports.agentCardHandler = agentCardHandler;
+exports.agentFactsHandler = agentFactsHandler;
+exports.toRegistryEntry = toRegistryEntry;
+const pca_1 = require("@atlasauth/pca");
+const jose_1 = require("jose");
+/** Default JWS algorithm for card + attestation signatures. */
+exports.DEFAULT_ALG = 'EdDSA';
+function isJwk(k) {
+    return typeof k === 'object' && k !== null && !(k instanceof Uint8Array) && 'kty' in k;
+}
+/** Produce a detached-payload JWS over `payload` (the canonical bytes of the signed object). */
+async function signDetached(payload, signingKey, opts) {
+    const alg = opts.alg ?? exports.DEFAULT_ALG;
+    const key = isJwk(signingKey) ? await (0, jose_1.importJWK)(signingKey, alg) : signingKey;
+    const protectedHeader = {
+        alg,
+        b64: false,
+        crit: ['b64'],
+        ...(opts.kid !== undefined ? { kid: opts.kid } : {}),
+        ...(opts.header ?? {}),
+    };
+    const jws = await new jose_1.FlattenedSign(payload).setProtectedHeader(protectedHeader).sign(key);
+    if (jws.protected === undefined) {
+        throw new Error('signDetached: produced JWS is missing its protected header');
+    }
+    return { protected: jws.protected, signature: jws.signature };
+}
+async function resolveVerifyKey(opts) {
+    try {
+        if (opts.jwks)
+            return { resolver: (0, jose_1.createLocalJWKSet)(opts.jwks) };
+        if (opts.key !== undefined) {
+            return { resolver: isJwk(opts.key) ? await (0, jose_1.importJWK)(opts.key, opts.alg ?? exports.DEFAULT_ALG) : opts.key };
+        }
+        return { error: 'no verification key or JWKS supplied' };
+    }
+    catch (e) {
+        return { error: `could not resolve verification key: ${e.message}` };
+    }
+}
+/** Verify a detached-payload JWS over `payload`. Never throws; returns a fail-closed result. */
+async function verifyDetached(payload, sig, resolver) {
+    if (typeof sig.protected !== 'string' || typeof sig.signature !== 'string') {
+        return { ok: false, reason: 'signature is malformed' };
+    }
+    const input = { protected: sig.protected, payload, signature: sig.signature };
+    try {
+        // Split so each branch binds a single flattenedVerify overload (key-resolver vs. concrete key).
+        const verified = typeof resolver === 'function'
+            ? await (0, jose_1.flattenedVerify)(input, resolver)
+            : await (0, jose_1.flattenedVerify)(input, resolver);
+        return { ok: true, protectedHeader: verified.protectedHeader ?? {} };
+    }
+    catch (e) {
+        return { ok: false, reason: e.message };
+    }
+}
+const PCA_PASSPORT_HEADER = 'pca_passport';
+function passportRefFrom(p, uri) {
+    if ('model_id' in p)
+        return { id: p.id, ...(uri !== undefined ? { uri } : {}) };
+    return { id: p.id, ...(p.uri !== undefined ? { uri: p.uri } : uri !== undefined ? { uri } : {}) };
+}
+/**
+ * Build an (unsigned) A2A Agent Card from a PCA passport. The card's metadata points at the PCA passport
+ * (`pcaPassport`) and, when given, the live proof-verification endpoint (`pcaProof`) — so once signed it
+ * is a pointer at verifiable authority rather than a self-declaration. Sign it with {@link issueSignedAgentCard}.
+ */
+function buildAgentCard(passport, opts) {
+    const card = {
+        name: opts.name,
+        ...(opts.description !== undefined ? { description: opts.description } : {}),
+        ...(opts.url !== undefined ? { url: opts.url } : {}),
+        ...(opts.version !== undefined ? { version: opts.version } : {}),
+        ...(opts.skills !== undefined ? { skills: opts.skills } : {}),
+        pcaPassport: passportRefFrom(passport, opts.passportUri),
+        ...(opts.pcaProofRef !== undefined ? { pcaProof: opts.pcaProofRef } : {}),
+    };
+    return card;
+}
+/** The canonical bytes a card signature covers: the card with `signatures` removed (everything else kept). */
+function cardSigningBytes(card) {
+    const { signatures: _signatures, ...rest } = card;
+    void _signatures;
+    return (0, pca_1.canonicalBytes)(rest);
+}
+/**
+ * Sign an A2A Agent Card. Ensures a PCA passport reference is embedded (`pcaPassport`) and committed in
+ * the JWS protected header (`pca_passport`), then signs the canonicalized card (minus `signatures`) and
+ * appends the detached-payload `AgentCardSignature`. Wire-identical to `@atlasauth/pca-a2a`.
+ */
+async function issueSignedAgentCard(card, signingKey, opts = {}) {
+    const passport = opts.passport
+        ? {
+            id: opts.passport.id,
+            ...('uri' in opts.passport && opts.passport.uri !== undefined ? { uri: opts.passport.uri } : {}),
+        }
+        : card.pcaPassport;
+    // Embed the passport reference BEFORE signing so the signature covers it.
+    const toSign = { ...card, ...(passport ? { pcaPassport: passport } : {}) };
+    const payload = cardSigningBytes(toSign);
+    const signature = await signDetached(payload, signingKey, {
+        ...(opts.alg !== undefined ? { alg: opts.alg } : {}),
+        ...(opts.kid !== undefined ? { kid: opts.kid } : {}),
+        ...(passport ? { header: { [PCA_PASSPORT_HEADER]: passport.id } } : {}),
+    });
+    const existing = toSign.signatures ?? [];
+    return { ...toSign, signatures: [...existing, signature] };
+}
+/**
+ * Validate an A2A Agent Card against its `AgentCardSignature`(s). Fail-closed: a card with no signatures,
+ * an unresolvable key, or ANY signature that does not verify over the canonicalized card (minus
+ * `signatures`) is rejected. On success, returns the PCA passport id the signature commits to plus the
+ * live proof pointer, so a caller can resolve + check them against a `PassportRegistry` / verify endpoint.
+ */
+async function verifyAgentCard(card, opts) {
+    const signatures = card.signatures;
+    if (!Array.isArray(signatures) || signatures.length === 0) {
+        return { ok: false, reason: 'agent card carries no signatures' };
+    }
+    const resolved = await resolveVerifyKey(opts);
+    if ('error' in resolved)
+        return { ok: false, reason: resolved.error };
+    const payload = cardSigningBytes(card);
+    let passportRef;
+    for (let i = 0; i < signatures.length; i++) {
+        const sig = signatures[i];
+        if (!sig)
+            return { ok: false, reason: `signature ${i} is missing` };
+        const res = await verifyDetached(payload, sig, resolved.resolver);
+        if (!res.ok)
+            return { ok: false, reason: `signature ${i} did not verify: ${res.reason}` };
+        const ref = res.protectedHeader[PCA_PASSPORT_HEADER];
+        if (typeof ref === 'string' && passportRef === undefined)
+            passportRef = ref;
+    }
+    return {
+        ok: true,
+        ...(passportRef !== undefined ? { passportRef } : {}),
+        ...(card.pcaPassport ? { passport: card.pcaPassport } : {}),
+        ...(card.pcaProof ? { pcaProof: card.pcaProof } : {}),
+    };
+}
+// ===================================================================================================
+// 2. AgentFacts — self-asserted vs third-party-attested claims (PCA is the attestor)
+// ===================================================================================================
+/**
+ * JSON-LD contexts for an AgentFacts document. The DID context plus the AgentFacts vocabulary (the second
+ * entry is a placeholder for the canonical NANDA AgentFacts context URL — replace before production).
+ */
+exports.AGENT_FACTS_CONTEXT = [
+    'https://www.w3.org/ns/did/v1',
+    'https://nanda.ai/agentfacts/v1',
+];
+/** The canonical statement bytes an AgentFacts attestation signature covers (everything but the sig). */
+function attestationStatementBytes(a) {
+    return (0, pca_1.canonicalBytes)({
+        d: 'atlas-pca/agentfacts/attestation/v1',
+        issuer: a.issuer,
+        subject: a.subject,
+        attests: a.attests,
+        validFrom: a.validFrom,
+        validUntil: a.validUntil ?? null,
+    });
+}
+/** Default attestor identity used when PCA signs an AgentFacts attestation. */
+exports.PCA_ATTESTOR_ID = 'did:atlas:pca-attestor';
+/** Sign one attestation statement with the attestor key (shared by issue + add). */
+async function signAttestation(statement, key, opts) {
+    const signature = await signDetached(attestationStatementBytes(statement), key, {
+        ...(opts.alg !== undefined ? { alg: opts.alg } : {}),
+        ...(opts.kid !== undefined ? { kid: opts.kid } : {}),
+        header: { attestor: statement.issuer },
+    });
+    return { ...statement, signature };
+}
+/**
+ * Issue an AgentFacts document for a PCA passport, with PCA as the THIRD-PARTY ATTESTOR. The agent's own
+ * `selfAsserted` claims are carried verbatim and left unsigned; the `attests` claims are wrapped in a
+ * statement (issuer + subject + validity) and signed with `attestorKey`. A verifier can then tell exactly
+ * which claims a named third party vouches for. The resulting doc is served at `/.well-known/agent-facts.json`.
+ */
+async function issueAgentFacts(passport, opts) {
+    const agentId = opts.agentId ?? passport.id;
+    const validFrom = opts.validFrom ?? new Date(opts.now ?? Date.now()).toISOString();
+    const statement = {
+        issuer: opts.attestorId ?? exports.PCA_ATTESTOR_ID,
+        subject: agentId,
+        attests: opts.attests,
+        validFrom,
+        ...(opts.validUntil !== undefined ? { validUntil: opts.validUntil } : {}),
+    };
+    const attestation = await signAttestation(statement, opts.attestorKey, {
+        ...(opts.alg !== undefined ? { alg: opts.alg } : {}),
+        ...(opts.kid !== undefined ? { kid: opts.kid } : {}),
+    });
+    return {
+        '@context': opts.context ?? exports.AGENT_FACTS_CONTEXT,
+        id: agentId,
+        type: 'AgentFacts',
+        selfAsserted: opts.selfAsserted ?? {},
+        attestations: [attestation],
+    };
+}
+/**
+ * Append another third-party attestation to an existing AgentFacts doc (returns a copy; input unmutated).
+ * Lets several independent attestors each vouch for a different subset of claims.
+ */
+async function addAttestation(facts, opts) {
+    const validFrom = opts.validFrom ?? new Date(opts.now ?? Date.now()).toISOString();
+    const statement = {
+        issuer: opts.attestorId ?? exports.PCA_ATTESTOR_ID,
+        subject: facts.id,
+        attests: opts.attests,
+        validFrom,
+        ...(opts.validUntil !== undefined ? { validUntil: opts.validUntil } : {}),
+    };
+    const attestation = await signAttestation(statement, opts.attestorKey, {
+        ...(opts.alg !== undefined ? { alg: opts.alg } : {}),
+        ...(opts.kid !== undefined ? { kid: opts.kid } : {}),
+    });
+    return { ...facts, attestations: [...facts.attestations, attestation] };
+}
+function isPlainObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+/**
+ * Verify an AgentFacts document. Fail-closed throughout:
+ *   • an attestation whose `subject` is not this doc's `id` is rejected;
+ *   • an attestation outside its validity window (or with a malformed window) is rejected;
+ *   • an attestation whose detached JWS does not verify under the supplied key/JWKS is rejected;
+ *   • if ANY present attestation fails, the whole document verification returns `ok:false`.
+ * On success, the result marks which claims are third-party ATTESTED and which are merely SELF-ASSERTED
+ * (flagged, never promoted). A doc with zero attestations verifies, but attests nothing.
+ */
+async function verifyAgentFacts(facts, opts) {
+    const selfAsserted = isPlainObject(facts.selfAsserted) ? facts.selfAsserted : {};
+    const now = opts.now ?? Date.now();
+    const base = {
+        ok: false,
+        agentId: facts.id,
+        attestations: [],
+        attested: {},
+        selfAsserted,
+        claims: {},
+    };
+    const list = facts.attestations;
+    if (!Array.isArray(list)) {
+        return { ...base, reason: 'agent facts has no attestations array' };
+    }
+    // Resolve the key once, but only insist on one when there is an attestation to verify.
+    let resolver;
+    if (list.length > 0) {
+        const resolved = await resolveVerifyKey(opts);
+        if ('error' in resolved) {
+            return { ...base, reason: resolved.error, attestations: list.map(mkMissingCheck) };
+        }
+        resolver = resolved.resolver;
+    }
+    const checks = [];
+    const attested = {};
+    let allOk = true;
+    for (const a of list) {
+        const check = await verifyOneAttestation(a, facts.id, now, resolver);
+        checks.push(check);
+        if (!check.ok) {
+            allOk = false;
+            continue;
+        }
+        if (check.attests)
+            for (const [k, v] of Object.entries(check.attests))
+                attested[k] = v;
+    }
+    const claims = {};
+    for (const k of Object.keys(selfAsserted))
+        claims[k] = 'self-asserted';
+    for (const k of Object.keys(attested))
+        claims[k] = 'attested'; // attested wins on overlap
+    return {
+        ok: allOk,
+        ...(allOk ? {} : { reason: 'one or more attestations did not verify' }),
+        agentId: facts.id,
+        attestations: checks,
+        attested,
+        selfAsserted,
+        claims,
+    };
+}
+function mkMissingCheck(a) {
+    const issuer = a && typeof a.issuer === 'string' ? a.issuer : '<unknown>';
+    return { issuer, ok: false, reason: 'no verification key or JWKS supplied' };
+}
+async function verifyOneAttestation(a, docId, now, resolver) {
+    const issuer = a && typeof a.issuer === 'string' ? a.issuer : '<unknown>';
+    if (!a || typeof a.subject !== 'string' || !isPlainObject(a.attests) || typeof a.validFrom !== 'string') {
+        return { issuer, ok: false, reason: 'attestation is malformed' };
+    }
+    if (a.subject !== docId) {
+        return { issuer, ok: false, reason: `attestation subject '${a.subject}' does not match agent id '${docId}'` };
+    }
+    const from = Date.parse(a.validFrom);
+    if (!Number.isFinite(from))
+        return { issuer, ok: false, reason: 'attestation validFrom is not a valid date' };
+    if (now < from)
+        return { issuer, ok: false, reason: 'attestation is not yet valid' };
+    if (a.validUntil !== undefined) {
+        const until = Date.parse(a.validUntil);
+        if (!Number.isFinite(until))
+            return { issuer, ok: false, reason: 'attestation validUntil is not a valid date' };
+        if (now > until)
+            return { issuer, ok: false, reason: 'attestation has expired' };
+    }
+    if (!resolver)
+        return { issuer, ok: false, reason: 'no verification key or JWKS supplied' };
+    const statement = {
+        issuer: a.issuer,
+        subject: a.subject,
+        attests: a.attests,
+        validFrom: a.validFrom,
+        ...(a.validUntil !== undefined ? { validUntil: a.validUntil } : {}),
+    };
+    const res = await verifyDetached(attestationStatementBytes(statement), a.signature, resolver);
+    if (!res.ok)
+        return { issuer, ok: false, reason: `signature did not verify: ${res.reason}` };
+    return { issuer, ok: true, attests: a.attests };
+}
+// ===================================================================================================
+// 3. Well-known hosting layer (framework-agnostic)
+// ===================================================================================================
+/** The A2A well-known path a signed Agent Card is served at. */
+exports.WELL_KNOWN_AGENT_CARD_PATH = '/.well-known/agent-card.json';
+/** The well-known path an AgentFacts document is served at. */
+exports.WELL_KNOWN_AGENT_FACTS_PATH = '/.well-known/agent-facts.json';
+function jsonResponse(value) {
+    return {
+        status: 200,
+        headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
+        body: JSON.stringify(value),
+    };
+}
+function normalizePath(path) {
+    const q = path.indexOf('?');
+    const noQuery = q === -1 ? path : path.slice(0, q);
+    // Drop a single trailing slash (but keep the root "/").
+    return noQuery.length > 1 && noQuery.endsWith('/') ? noQuery.slice(0, -1) : noQuery;
+}
+/** Serve a signed Agent Card at {@link WELL_KNOWN_AGENT_CARD_PATH}; `undefined` for any other path. */
+function agentCardHandler(card, path = exports.WELL_KNOWN_AGENT_CARD_PATH) {
+    const target = normalizePath(path);
+    const response = jsonResponse(card);
+    return (reqPath) => normalizePath(reqPath) === target ? response : undefined;
+}
+/** Serve an AgentFacts document at {@link WELL_KNOWN_AGENT_FACTS_PATH}; `undefined` for any other path. */
+function agentFactsHandler(facts, path = exports.WELL_KNOWN_AGENT_FACTS_PATH) {
+    const target = normalizePath(path);
+    const response = jsonResponse(facts);
+    return (reqPath) => normalizePath(reqPath) === target ? response : undefined;
+}
+function wellKnownUrlFrom(serviceUrl, path) {
+    if (serviceUrl === undefined)
+        return undefined;
+    try {
+        return new URL(path, serviceUrl).toString();
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Shape a {@link RegistryEntry} from a signed card + an AgentFacts doc for submission to an A2A registry /
+ * NANDA index. Purely structural: it does NOT re-verify (a registry re-verifies on ingest) — it derives
+ * the attested-vs-self-asserted claim split from the doc so the index can surface what a third party backs.
+ */
+function toRegistryEntry(card, facts) {
+    const attestedSet = new Set();
+    for (const a of facts.attestations ?? []) {
+        if (a && isPlainObject(a.attests))
+            for (const k of Object.keys(a.attests))
+                attestedSet.add(k);
+    }
+    const selfAssertedOnly = Object.keys(isPlainObject(facts.selfAsserted) ? facts.selfAsserted : {}).filter((k) => !attestedSet.has(k));
+    const agentCardUrl = wellKnownUrlFrom(card.url, exports.WELL_KNOWN_AGENT_CARD_PATH);
+    return {
+        id: facts.id,
+        name: card.name,
+        ...(card.url !== undefined ? { url: card.url } : {}),
+        ...(card.version !== undefined ? { version: card.version } : {}),
+        ...(card.skills !== undefined ? { skills: card.skills } : {}),
+        ...(card.pcaPassport ? { passport: card.pcaPassport } : {}),
+        ...(card.pcaProof ? { pcaProof: card.pcaProof } : {}),
+        card,
+        ...(agentCardUrl !== undefined ? { agentCardUrl } : {}),
+        facts,
+        attestedClaims: [...attestedSet],
+        selfAssertedClaims: selfAssertedOnly,
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;;;AA2MH,wCAWC;AAuBD,oDAwBC;AAoBD,0CA8BC;AA+GD,0CAwBC;AAiBD,wCAcC;AA+CD,4CA0DC;AAkFD,4CAKC;AAGD,8CAKC;AAgDD,0CAwBC;AA3uBD,wCAAoE;AACpE,+BASc;AAWd,+DAA+D;AAClD,QAAA,WAAW,GAAG,OAAgB,CAAC;AAa5C,SAAS,KAAK,CAAC,CAAiB;IAC9B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACzF,CAAC;AASD,gGAAgG;AAChG,KAAK,UAAU,YAAY,CACzB,OAAmB,EACnB,UAAwB,EACxB,IAAyB;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,mBAAW,CAAC;IACpC,MAAM,GAAG,GAAyB,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,IAAA,gBAAS,EAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACpG,MAAM,eAAe,GAA4B;QAC/C,GAAG;QACH,GAAG,EAAE,KAAK;QACV,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;KACvB,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,IAAI,oBAAa,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3F,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;AAChE,CAAC;AAgBD,KAAK,UAAU,gBAAgB,CAAC,IAAsB;IACpD,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAA,wBAAiB,EAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAA,gBAAS,EAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,mBAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACvG,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;IAC3D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,uCAAwC,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;IAClF,CAAC;AACH,CAAC;AAMD,gGAAgG;AAChG,KAAK,UAAU,cAAc,CAC3B,OAAmB,EACnB,GAAuB,EACvB,QAAqB;IAErB,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,KAAK,GAAsB,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;IACjG,IAAI,CAAC;QACH,gGAAgG;QAChG,MAAM,QAAQ,GACZ,OAAO,QAAQ,KAAK,UAAU;YAC5B,CAAC,CAAC,MAAM,IAAA,sBAAe,EAAC,KAAK,EAAE,QAAQ,CAAC;YACxC,CAAC,CAAC,MAAM,IAAA,sBAAe,EAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;IACvE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;IACrD,CAAC;AACH,CAAC;AA4BD,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAE3C,SAAS,eAAe,CAAC,CAA8B,EAAE,GAAY;IACnE,IAAI,UAAU,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAChF,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACpG,CAAC;AA6CD;;;;GAIG;AACH,SAAgB,cAAc,CAAC,QAAuB,EAAE,IAA2B;IACjF,MAAM,IAAI,GAAc;QACtB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,WAAW,EAAE,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8GAA8G;AAC9G,SAAS,gBAAgB,CAAC,IAAe;IACvC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAClD,KAAK,WAAW,CAAC;IACjB,OAAO,IAAA,oBAAc,EAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAWD;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CACxC,IAAe,EACf,UAAwB,EACxB,OAA8B,EAAE;IAEhC,MAAM,QAAQ,GAA4B,IAAI,CAAC,QAAQ;QACrD,CAAC,CAAC;YACE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACpB,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjG;QACH,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAErB,0EAA0E;IAC1E,MAAM,MAAM,GAAc,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACtF,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE;QACxD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IACzC,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC,GAAG,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;AAC7D,CAAC;AAcD;;;;;GAKG;AACI,KAAK,UAAU,eAAe,CACnC,IAAe,EACf,IAAsB;IAEtB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACnE,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,OAAO,IAAI,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAEtE,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,WAA+B,CAAC;IAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,aAAa,EAAE,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClE,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,oBAAoB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1F,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC,mBAAmB,CAAC,CAAC;QACrD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,WAAW,KAAK,SAAS;YAAE,WAAW,GAAG,GAAG,CAAC;IAC9E,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,qFAAqF;AACrF,sGAAsG;AAEtG;;;GAGG;AACU,QAAA,mBAAmB,GAAsB;IACpD,8BAA8B;IAC9B,gCAAgC;CACjC,CAAC;AAsCF,yGAAyG;AACzG,SAAS,yBAAyB,CAAC,CAA2C;IAC5E,OAAO,IAAA,oBAAc,EAAC;QACpB,CAAC,EAAE,qCAAqC;QACxC,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;KACjC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAClE,QAAA,eAAe,GAAG,wBAAiC,CAAC;AA2BjE,oFAAoF;AACpF,KAAK,UAAU,eAAe,CAC5B,SAAmD,EACnD,GAAiB,EACjB,IAAoC;IAEpC,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE;QAC9E,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE;KACvC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,SAAS,EAAE,SAAS,EAAE,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,eAAe,CACnC,QAAuB,EACvB,IAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACnF,MAAM,SAAS,GAA6C;QAC1D,MAAM,EAAE,IAAI,CAAC,UAAU,IAAI,uBAAe;QAC1C,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS;QACT,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE;QACrE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC,CAAC;IACH,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,OAAO,IAAI,2BAAmB;QAC/C,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,YAAY;QAClB,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;QACrC,YAAY,EAAE,CAAC,WAAW,CAAC;KAC5B,CAAC;AACJ,CAAC;AAaD;;;GAGG;AACI,KAAK,UAAU,cAAc,CAAC,KAAiB,EAAE,IAA2B;IACjF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACnF,MAAM,SAAS,GAA6C;QAC1D,MAAM,EAAE,IAAI,CAAC,UAAU,IAAI,uBAAe;QAC1C,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS;QACT,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE;QACrE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;AAC1E,CAAC;AAkCD,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,gBAAgB,CACpC,KAAiB,EACjB,IAA6B;IAE7B,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAEnC,MAAM,IAAI,GAA2B;QACnC,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,YAAY,EAAE,EAAE;QAChB,QAAQ,EAAE,EAAE;QACZ,YAAY;QACZ,MAAM,EAAE,EAAE;KACX,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IACtE,CAAC;IAED,uFAAuF;IACvF,IAAI,QAAiC,CAAC;IACtC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACrF,CAAC;QACD,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,KAAK,GAAG,IAAI,CAAC;IAEjB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,KAAK,GAAG,KAAK,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,OAAO;YAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;gBAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,MAAM,GAAoC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,MAAM,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,2BAA2B;IAE1F,OAAO;QACL,EAAE,EAAE,KAAK;QACT,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;QACvE,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,YAAY,EAAE,MAAM;QACpB,QAAQ;QACR,YAAY;QACZ,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,CAAwB;IAC9C,MAAM,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;IAC1E,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,CAAwB,EACxB,KAAa,EACb,GAAW,EACX,QAAiC;IAEjC,MAAM,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;IAC1E,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACxG,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC,OAAO,8BAA8B,KAAK,GAAG,EAAE,CAAC;IAChH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IAC9G,IAAI,GAAG,GAAG,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IACrF,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;QAChH,IAAI,GAAG,GAAG,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACnF,CAAC;IAED,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IAE5F,MAAM,SAAS,GAA6C;QAC1D,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9F,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;IAC7F,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,sGAAsG;AACtG,mDAAmD;AACnD,sGAAsG;AAEtG,gEAAgE;AACnD,QAAA,0BAA0B,GAAG,8BAAuC,CAAC;AAClF,+DAA+D;AAClD,QAAA,2BAA2B,GAAG,+BAAwC,CAAC;AAepF,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO;QACL,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;QAC5E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,wDAAwD;IACxD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACtF,CAAC;AAED,uGAAuG;AACvG,SAAgB,gBAAgB,CAAC,IAAe,EAAE,OAAe,kCAA0B;IACzF,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,CAAC,OAAe,EAA8B,EAAE,CACrD,aAAa,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,2GAA2G;AAC3G,SAAgB,iBAAiB,CAAC,KAAiB,EAAE,OAAe,mCAA2B;IAC7F,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,CAAC,OAAe,EAA8B,EAAE,CACrD,aAAa,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAkCD,SAAS,gBAAgB,CAAC,UAA8B,EAAE,IAAY;IACpE,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,IAAe,EAAE,KAAiB;IAChE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CACtG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAC3B,CAAC;IACF,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,kCAA0B,CAAC,CAAC;IAE5E,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,IAAI;QACJ,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,KAAK;QACL,cAAc,EAAE,CAAC,GAAG,WAAW,CAAC;QAChC,kBAAkB,EAAE,gBAAgB;KACrC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,34 @@
 {
   "name": "@atlasauth/pca-agentcard",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Signed agent card + AgentFacts attestor for PCA: issue/host a /.well-known/agent-card.json (A2A AgentCardSignature) and an AgentFacts metadata doc where PCA is the THIRD-PARTY attestor (separating self-asserted from attested), pointing to live verifiable proof-of-authority.",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "jose": "^5.9.6",
+    "@atlasauth/pca": "0.1.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.4"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
 }

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.