@heddleagent/execution-host-client 6.0.0-next.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jay / Fienna Liang
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,305 @@
+# `@heddleagent/execution-host-client`
+
+`@heddleagent/execution-host-client` is the lightweight backend-side SDK for
+products that invoke a separately deployed Heddle Execution Host. It lets an
+adopter keep its own language stack, authentication, database, product policy,
+MCP tools, and UI while reusing the security-sensitive v1 contract machinery.
+
+> **Current availability:** version `6.0.0-next.0` is an unpublished v6
+> prerelease candidate. Until it is published, the stable package remains
+> `@roackb2/heddle-adopter@5.13.0`. Heddle does not currently distribute
+> the compatible Execution Host implementation or offer a hosted service. The
+> public surface documents and tests the adopter boundary without implying a
+> generally available deployment.
+
+After npm confirms the `next` dist-tag:
+
+```bash
+npm install @heddleagent/execution-host-client@next
+```
+
+The package does **not** contain Heddle's agent loop, AgentCore deployment,
+Terraform, product MCP tools, or product logic. It uses the official MCP SDK,
+plus `jose`, `zod`, `dayjs`, and `eventsource-parser`, for its optional
+reference edges.
+
+## What it owns
+
+| Import | Reusable responsibility |
+| --- | --- |
+| `@heddleagent/execution-host-client/contracts` | Runtime-validated v1 request, stream, identity, capability, and header contracts |
+| `@heddleagent/execution-host-client/authority` | ES256 execution assertion and optional MCP capability issuance plus public JWKS projection |
+| `@heddleagent/execution-host-client/conversation` | Turn orchestration across authority, model credentials, optional MCP policy, an `ExecutionHost`, and an optional adopter-implemented durable lifecycle store |
+| `@heddleagent/execution-host-client/mcp` | Independent capability verification at the adopter's MCP edge |
+| `@heddleagent/execution-host-client/mcp/node` | Stateless official-SDK Streamable HTTP lifecycle around adopter-defined toolsets |
+| `@heddleagent/execution-host-client/http-sse` | Transport-neutral `ExecutionHost` port and strict direct-development HTTP/SSE client |
+| `@heddleagent/execution-host-client/testing` | Node-only loopback v1 fixture plus durable-turn store conformance for real adapters |
+| `@heddleagent/execution-host-client/node` | Optional Node JWKS/conversation HTTP edge plus safe local signing-key helpers |
+
+Non-TypeScript adopters can consume the versioned candidate
+[`spec/v1`](spec/v1/README.md) OpenAPI 3.1.1 document, JSON Schema bundle, and
+golden conformance fixtures directly. The
+[`Python v1 conformance reference`](conformance/reference-adopters/python-v1/README.md)
+is an independent executable proof of that path, not another required service
+or a separately supported SDK. It follows the contract version, not the
+TypeScript source-module layout.
+
+The adopter still owns:
+
+- authenticating its users and mapping them to tenant, subject, and product
+  session IDs;
+- deciding which product capabilities that identity may use;
+- production signing-key storage and rotation, route placement, invocation-ID
+  allocation, the lifecycle-store implementation/schema/migrations, retention,
+  and history queries;
+- implementing and hosting product MCP tools against its own APIs and data;
+- choosing an AgentCore/SigV4 transport, applying results, and rendering UI.
+
+## Issue one invocation's authority
+
+Load an ES256 key pair from your normal secret-management boundary, then create
+one long-lived authority service at application composition:
+
+```ts
+import { JoseExecutionAuthority } from '@heddleagent/execution-host-client/authority'
+
+const authority = await JoseExecutionAuthority.create(
+  {
+    issuer: 'https://api.example.com',
+    adopterId: 'example-product',
+    executionAudience: 'heddle-execution-host',
+    keyId: 'execution-key-2026-08',
+    executionTtlSeconds: 300,
+    mcp: {
+      audience: 'example-product-mcp',
+      serverId: 'product_capabilities',
+      ttlSeconds: 900,
+    },
+  },
+  { privateKey, publicKey },
+)
+
+// Serve only this public projection from a stable JWKS URL.
+const publicJwks = authority.publicJwks()
+
+// These IDs must come from authenticated and authorized product state.
+const issued = await authority.issue({
+  scope: {
+    tenantId: authenticatedTenant.id,
+    subjectId: authenticatedUser.id,
+    productSessionId: conversation.id,
+  },
+  runtimeSessionId,
+  invocationId,
+  workflow: 'conversation-turn',
+  mcp: { allowedTools: ['read_workspace_snapshot'] },
+})
+```
+
+An invocation without product MCP tools omits both the `mcp` deployment config
+and issue input. The execution assertion remains available through
+`issued.executionAssertion()`; an optional capability is available through
+`issued.mcpCapability()`. JSON serialization emits only credential-free
+metadata, although those identifiers still require normal logging
+minimization.
+
+## Use the lowest-code Node path
+
+The optional Node surface removes generic HTTP and local key-file code without
+taking product decisions away from the adopter:
+
+```ts
+import { JoseExecutionAuthority } from '@heddleagent/execution-host-client/authority'
+import {
+  DurableHostedConversationTurnService,
+  HostedConversationTurnService,
+} from '@heddleagent/execution-host-client/conversation'
+import {
+  loadExecutionAuthorityKeyPairFromFile,
+  NodeExecutionAdopterHttpService,
+} from '@heddleagent/execution-host-client/node'
+
+const authority = await JoseExecutionAuthority.create(
+  authorityConfig,
+  await loadExecutionAuthorityKeyPairFromFile(signingJwkPath),
+)
+const executionTurns = new HostedConversationTurnService({
+  authority,
+  executionHost,
+  modelCredentials,
+  mcp: { allowedTools: ['read_workspace_snapshot'] },
+})
+const turns = new DurableHostedConversationTurnService({
+  turns: executionTurns,
+  store: productPostgresTurnStore,
+})
+const hostedHttp = new NodeExecutionAdopterHttpService({
+  authority,
+  authenticator: productAuthenticator,
+  conversations: productAdmissionService(turns),
+})
+
+// In a raw Node server, call this before the application's fallback router.
+if (hostedHttp.handle(request, response)) return
+```
+
+`productAdmissionService` is intentionally product-owned: it maps an
+authenticated principal to authorized tenant, subject, product-session,
+Runtime-session, and invocation IDs before calling `turns.streamTurn(...)`.
+The durable wrapper owns persistence-before-event ordering, safe terminal
+projection, interruption semantics, and expiry reconciliation. The supplied
+store owns atomic database transitions and is certifiable through
+`HostedConversationTurnStoreConformance`.
+The normative behavior and cross-language scenarios are included in the
+[durable v1 lifecycle profile](spec/v1/durable-hosted-conversation-lifecycle.md).
+The Node service owns bounded JSON parsing, `Authorization` redaction, JWKS,
+SSE framing/backpressure, disconnect cancellation, safe failures, and graceful
+shutdown. Its individual `handleJwks` and `handleConversationTurn` methods are
+also available when a framework already owns route matching.
+
+For local setup, `generateExecutionAuthorityKeyFile(path)` creates a new
+owner-only JWK without overwriting an existing file. The loader imports its
+private key as non-exportable. Production KMS/HSM or secret-manager storage,
+rotation, revocation, and Windows ACL policy still belong to deployment.
+
+## Verify product authority again at MCP
+
+The adopter MCP service must independently verify the bearer. Do not trust
+identity forwarded in model-controlled arguments or assume the Execution Host's
+earlier check is sufficient.
+
+```ts
+import {
+  JwtMcpCapabilityVerifier,
+  assertMcpCapabilityActive,
+} from '@heddleagent/execution-host-client/mcp'
+
+const verifier = new JwtMcpCapabilityVerifier({
+  issuer: 'https://api.example.com',
+  audience: 'example-product-mcp',
+  jwksUrl: new URL('https://api.example.com/.well-known/jwks.json'),
+  trustedAdopterId: 'example-product',
+  serverId: 'product_capabilities',
+  supportedTools: ['read_workspace_snapshot'] as const,
+  maxCapabilityAgeSeconds: 900,
+})
+
+const capability = await verifier.verify(bearer)
+assertMcpCapabilityActive(capability)
+
+// Resolve data only from capability.scope; tool arguments do not carry scope.
+await readWorkspaceSnapshot(capability.scope)
+```
+
+For Node adopters, the declarative JSON-tool path also removes the repetitive
+allowlist, expiry, cancellation, serialization, and safe-error code:
+
+```ts
+import {
+  defineNodeMcpJsonTool,
+  NodeMcpJsonToolset,
+  NodeStreamableHttpMcpService,
+} from '@heddleagent/execution-host-client/mcp/node'
+import { z } from 'zod'
+
+const toolset = new NodeMcpJsonToolset({
+  serverInfo: { name: 'example-product', version: '1.0.0' },
+  tools: [defineNodeMcpJsonTool({
+    name: 'read_workspace_snapshot' as const,
+    description: 'Read the authenticated subject workspace.',
+    inputSchema: z.object({}).strict(),
+    annotations: { readOnlyHint: true },
+    failureMessage: 'The workspace is unavailable.',
+    execute: async (_input, { capability, signal }) => (
+      readWorkspaceSnapshot(capability.scope, signal)
+    ),
+  })],
+})
+
+const productMcp = new NodeStreamableHttpMcpService({
+  capabilityVerifier: verifier,
+  toolset,
+})
+```
+
+Use the lower-level `NodeMcpToolset` interface only when a tool needs custom MCP
+content or lifecycle semantics.
+
+## Invoke the direct development host
+
+The direct client is useful for local and reviewed HTTPS deployments. A
+managed AgentCore deployment should supply a separate SigV4/AWS SDK transport
+which implements the same `ExecutionHost` port.
+
+```ts
+import { DirectHttpExecutionHost } from '@heddleagent/execution-host-client/http-sse'
+
+const host = new DirectHttpExecutionHost({
+  baseUrl: new URL('http://127.0.0.1:8080'),
+  localToken: process.env.HEDDLE_EXECUTION_HOST_LOCAL_TOKEN!,
+})
+
+for await (const event of host.streamConversationTurn({
+  invocationId,
+  runtimeSessionId,
+  prompt: 'Summarize the relevant product state.',
+  executionAssertion: issued.executionAssertion(),
+  mcpCapability: issued.mcpCapability(),
+  modelApiKey,
+})) {
+  applyExecutionEvent(event)
+}
+```
+
+The client refuses redirects, bounds parser and error bodies, validates ordered
+SSE identity, streams accepted/activity events incrementally, and withholds the
+terminal event until clean EOF. It never retries an ambiguous invocation.
+
+## Verify an adopter integration locally
+
+The explicit `testing` subpath provides a real loopback implementation of the
+v1 request/SSE boundary. Its callback can call the adopter's real local MCP
+server, while the fixture supplies deterministic success, cancellation,
+failure, and interrupted-EOF behavior without invoking a model or AWS.
+
+```ts
+import {
+  LocalExecutionHostContractFixture,
+} from '@heddleagent/execution-host-client/testing'
+
+const fixture = await LocalExecutionHostContractFixture.start({
+  execute: async (invocation) => {
+    await callProductMcp(invocation.mcpCapability(), invocation.signal)
+    return { kind: 'result', result: { outcome: 'done' } }
+  },
+})
+
+try {
+  const host = fixture.createExecutionHost()
+  await consume(host.streamConversationTurn(input))
+} finally {
+  await fixture.close()
+}
+```
+
+This proves the adopter-facing wire and product callback, not the Heddle loop,
+real-host JWT verification, shell/filesystem behavior, tenant isolation, or
+managed AgentCore behavior. See the [testing boundary](src/testing/README.md)
+for the exact evidence limit.
+
+## Language-neutral posture
+
+This TypeScript package is a reference implementation, not a requirement that
+adopter backends use TypeScript. The wire and claim contracts are
+language-neutral. The checked-in OpenAPI 3.1.1 document, JSON Schema bundle,
+and golden fixtures are the canonical interoperability surface. A clean-room
+Python implementation passes those fixtures without importing Heddle or the
+private Execution Host code.
+
+That is the deliberate stop line for this milestone. Heddle does not promise a
+gateway, generated clients for every language, or a framework starter matrix.
+Further adapters should follow a real adopter and a concrete protocol gap.
+
+The runnable
+[`node-control-plane.ts`](examples/node-control-plane.ts) example composes the
+default Node path against the local fixture.

package/dist/authority/index.d.ts

@@ -0,0 +1,3 @@
+export { JoseExecutionAuthority } from './jose-execution-authority.js';
+export type { ExecutionAuthority, ExecutionAuthorityConfig, ExecutionAuthorityIssueInput, ExecutionAuthorityKeyPair, ExecutionAuthorityMcpConfig, IssuedExecutionAuthority, IssuedExecutionAuthorityMetadata, IssuedMcpCapabilityMetadata, JoseExecutionAuthorityOptions, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/authority/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authority/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,4BAA4B,EAC5B,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,gCAAgC,EAChC,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,YAAY,CAAC"}

package/dist/authority/index.js

@@ -0,0 +1,2 @@
+export { JoseExecutionAuthority } from './jose-execution-authority.js';
+//# sourceMappingURL=index.js.map

package/dist/authority/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authority/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC","sourcesContent":["export { JoseExecutionAuthority } from './jose-execution-authority.js';\nexport type {\n  ExecutionAuthority,\n  ExecutionAuthorityConfig,\n  ExecutionAuthorityIssueInput,\n  ExecutionAuthorityKeyPair,\n  ExecutionAuthorityMcpConfig,\n  IssuedExecutionAuthority,\n  IssuedExecutionAuthorityMetadata,\n  IssuedMcpCapabilityMetadata,\n  JoseExecutionAuthorityOptions,\n} from './types.js';\n"]}

package/dist/authority/jose-execution-authority.d.ts

@@ -0,0 +1,14 @@
+import { type JSONWebKeySet } from 'jose';
+import type { ExecutionAuthority, ExecutionAuthorityConfig, ExecutionAuthorityIssueInput, ExecutionAuthorityKeyPair, IssuedExecutionAuthority, JoseExecutionAuthorityOptions } from './types.js';
+/**
+ * ES256 reference adapter for issuing one invocation's admission assertion and
+ * optional product-MCP capability.
+ */
+export declare class JoseExecutionAuthority implements ExecutionAuthority {
+    #private;
+    private constructor();
+    static create(config: ExecutionAuthorityConfig, keyPair: ExecutionAuthorityKeyPair, options?: JoseExecutionAuthorityOptions): Promise<JoseExecutionAuthority>;
+    issue(input: ExecutionAuthorityIssueInput): Promise<IssuedExecutionAuthority>;
+    publicJwks(): JSONWebKeySet;
+}
+//# sourceMappingURL=jose-execution-authority.d.ts.map

package/dist/authority/jose-execution-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jose-execution-authority.d.ts","sourceRoot":"","sources":["../../src/authority/jose-execution-authority.ts"],"names":[],"mappings":"AACA,OAAO,EAOL,KAAK,aAAa,EACnB,MAAM,MAAM,CAAC;AAgBd,OAAO,KAAK,EACV,kBAAkB,EAClB,wBAAwB,EACxB,4BAA4B,EAC5B,yBAAyB,EACzB,wBAAwB,EAExB,6BAA6B,EAC9B,MAAM,YAAY,CAAC;AA2DpB;;;GAGG;AACH,qBAAa,sBAAuB,YAAW,kBAAkB;;IAO/D,OAAO;WAaM,MAAM,CACjB,MAAM,EAAE,wBAAwB,EAChC,OAAO,EAAE,yBAAyB,EAClC,OAAO,GAAE,6BAAkC,GAC1C,OAAO,CAAC,sBAAsB,CAAC;IAc5B,KAAK,CACT,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,wBAAwB,CAAC;IAyCpC,UAAU,IAAI,aAAa;CAkF5B"}

package/dist/authority/jose-execution-authority.js

@@ -0,0 +1,266 @@
+import { randomUUID } from 'node:crypto';
+import { CompactSign, SignJWT, compactVerify, exportJWK, } from 'jose';
+import { z } from 'zod';
+import { CONVERSATION_TURN_WORKFLOW, EXECUTION_ASSERTION_TYPE, EXECUTION_CONTRACT_VERSION, ExecutionScopeSchema, JwtAudienceSchema, JwtIssuerSchema, MCP_CAPABILITY_TYPE, McpAllowedToolsSchema, McpServerIdSchema, OpaqueIdSchema, RuntimeSessionIdSchema, } from '../contracts/index.js';
+const SIGNING_ALGORITHM = 'ES256';
+const ExecutionAuthorityMcpConfigSchema = z.object({
+    audience: JwtAudienceSchema,
+    serverId: McpServerIdSchema,
+    ttlSeconds: z.number().int().min(1).max(15 * 60),
+}).strict();
+const ExecutionAuthorityConfigSchema = z.object({
+    issuer: JwtIssuerSchema,
+    adopterId: OpaqueIdSchema,
+    executionAudience: JwtAudienceSchema,
+    keyId: OpaqueIdSchema,
+    executionTtlSeconds: z.number().int().min(1).max(15 * 60),
+    mcp: ExecutionAuthorityMcpConfigSchema.optional(),
+}).strict().superRefine((config, context) => {
+    if (!config.mcp) {
+        return;
+    }
+    if (config.executionAudience === config.mcp.audience) {
+        context.addIssue({
+            code: 'custom',
+            path: ['mcp', 'audience'],
+            message: 'must be distinct from the execution audience',
+        });
+    }
+    if (config.mcp.ttlSeconds < config.executionTtlSeconds) {
+        context.addIssue({
+            code: 'custom',
+            path: ['mcp', 'ttlSeconds'],
+            message: 'must not expire before execution admission authority',
+        });
+    }
+});
+const ExecutionIssueScopeSchema = ExecutionScopeSchema.omit({ adopterId: true });
+const ExecutionAuthorityIssueInputSchema = z.object({
+    scope: ExecutionIssueScopeSchema,
+    runtimeSessionId: RuntimeSessionIdSchema,
+    invocationId: OpaqueIdSchema,
+    workflow: z.literal(CONVERSATION_TURN_WORKFLOW),
+    mcp: z.object({
+        allowedTools: McpAllowedToolsSchema,
+    }).strict().optional(),
+}).strict();
+const PublicP256JwkSchema = z.object({
+    kty: z.literal('EC'),
+    crv: z.literal('P-256'),
+    x: z.string().regex(/^[A-Za-z0-9_-]+$/),
+    y: z.string().regex(/^[A-Za-z0-9_-]+$/),
+}).passthrough().superRefine((jwk, context) => {
+    const privateFields = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth', 'k'];
+    if (privateFields.some((field) => field in jwk)) {
+        context.addIssue({
+            code: 'custom',
+            message: 'must not contain private key material',
+        });
+    }
+});
+/**
+ * ES256 reference adapter for issuing one invocation's admission assertion and
+ * optional product-MCP capability.
+ */
+export class JoseExecutionAuthority {
+    #config;
+    #privateKey;
+    #publicJwk;
+    #now;
+    #createCapabilityId;
+    constructor(config, key, options) {
+        this.#config = deepFreezeConfig(ExecutionAuthorityConfigSchema.parse(config));
+        assertPrivateSigningKey(key.privateKey);
+        this.#privateKey = key.privateKey;
+        this.#publicJwk = projectPublicJwk(key.publicJwk, this.#config.keyId);
+        this.#now = options.now ?? (() => new Date());
+        this.#createCapabilityId = options.createCapabilityId ?? randomUUID;
+    }
+    static async create(config, keyPair, options = {}) {
+        assertPrivateSigningKey(keyPair.privateKey);
+        assertPublicVerificationKey(keyPair.publicKey);
+        await assertMatchingKeyPair(keyPair);
+        return new JoseExecutionAuthority(config, {
+            privateKey: keyPair.privateKey,
+            publicJwk: await exportJWK(keyPair.publicKey),
+        }, options);
+    }
+    async issue(input) {
+        const authority = ExecutionAuthorityIssueInputSchema.parse(input);
+        if (authority.mcp && !this.#config.mcp) {
+            throw new Error('Execution authority cannot issue an MCP capability without MCP deployment configuration.');
+        }
+        const issuedAt = toEpochSeconds(this.#now());
+        const executionExpiresAt = issuedAt + this.#config.executionTtlSeconds;
+        const executionAssertion = await this.#signExecutionAssertion(authority, issuedAt, executionExpiresAt);
+        const mcp = authority.mcp && this.#config.mcp
+            ? await this.#issueMcpCapability({ ...authority, mcp: authority.mcp }, issuedAt)
+            : undefined;
+        return new ProtectedIssuedExecutionAuthority(executionAssertion, mcp?.assertion, freezeIssuedMetadata({
+            scope: {
+                adopterId: this.#config.adopterId,
+                ...authority.scope,
+            },
+            runtimeSessionId: authority.runtimeSessionId,
+            invocationId: authority.invocationId,
+            workflow: authority.workflow,
+            issuedAt: toIsoTimestamp(issuedAt),
+            executionExpiresAt: toIsoTimestamp(executionExpiresAt),
+            ...(mcp ? { mcp: mcp.metadata } : {}),
+        }));
+    }
+    publicJwks() {
+        return { keys: [{ ...this.#publicJwk }] };
+    }
+    #signExecutionAssertion(input, issuedAt, expiresAt) {
+        return new SignJWT({
+            contractVersion: EXECUTION_CONTRACT_VERSION,
+            adopterId: this.#config.adopterId,
+            tenantId: input.scope.tenantId,
+            productSessionId: input.scope.productSessionId,
+            runtimeSessionId: input.runtimeSessionId,
+            workflow: input.workflow,
+        })
+            .setProtectedHeader({
+            alg: SIGNING_ALGORITHM,
+            kid: this.#config.keyId,
+            typ: EXECUTION_ASSERTION_TYPE,
+        })
+            .setIssuer(this.#config.issuer)
+            .setAudience(this.#config.executionAudience)
+            .setSubject(input.scope.subjectId)
+            .setJti(input.invocationId)
+            .setIssuedAt(issuedAt)
+            .setExpirationTime(expiresAt)
+            .sign(this.#privateKey);
+    }
+    async #issueMcpCapability(input, issuedAt) {
+        const mcpConfig = this.#config.mcp;
+        const capabilityId = OpaqueIdSchema.parse(this.#createCapabilityId());
+        if (capabilityId === input.invocationId) {
+            throw new Error('MCP capability identity must be distinct from the invocation identity.');
+        }
+        const expiresAt = issuedAt + mcpConfig.ttlSeconds;
+        const assertion = await new SignJWT({
+            contractVersion: EXECUTION_CONTRACT_VERSION,
+            adopterId: this.#config.adopterId,
+            tenantId: input.scope.tenantId,
+            productSessionId: input.scope.productSessionId,
+            runtimeSessionId: input.runtimeSessionId,
+            invocationId: input.invocationId,
+            workflow: input.workflow,
+            serverId: mcpConfig.serverId,
+            allowedTools: [...input.mcp.allowedTools],
+        })
+            .setProtectedHeader({
+            alg: SIGNING_ALGORITHM,
+            kid: this.#config.keyId,
+            typ: MCP_CAPABILITY_TYPE,
+        })
+            .setIssuer(this.#config.issuer)
+            .setAudience(mcpConfig.audience)
+            .setSubject(input.scope.subjectId)
+            .setJti(capabilityId)
+            .setIssuedAt(issuedAt)
+            .setExpirationTime(expiresAt)
+            .sign(this.#privateKey);
+        return {
+            assertion,
+            metadata: {
+                capabilityId,
+                serverId: mcpConfig.serverId,
+                allowedTools: Object.freeze([...input.mcp.allowedTools]),
+                expiresAt: toIsoTimestamp(expiresAt),
+            },
+        };
+    }
+}
+class ProtectedIssuedExecutionAuthority {
+    metadata;
+    #executionAssertion;
+    #mcpCapability;
+    constructor(executionAssertion, mcpCapability, metadata) {
+        this.#executionAssertion = executionAssertion;
+        this.#mcpCapability = mcpCapability;
+        this.metadata = metadata;
+    }
+    executionAssertion() {
+        return this.#executionAssertion;
+    }
+    mcpCapability() {
+        return this.#mcpCapability;
+    }
+    toJSON() {
+        return this.metadata;
+    }
+}
+function projectPublicJwk(jwk, keyId) {
+    const parsed = PublicP256JwkSchema.parse(jwk);
+    return Object.freeze({
+        kty: parsed.kty,
+        crv: parsed.crv,
+        x: parsed.x,
+        y: parsed.y,
+        alg: SIGNING_ALGORITHM,
+        kid: keyId,
+        use: 'sig',
+    });
+}
+function assertPrivateSigningKey(key) {
+    const algorithm = key.algorithm;
+    const accepted = key.type === 'private'
+        && algorithm.name === 'ECDSA'
+        && algorithm.namedCurve === 'P-256'
+        && key.usages.includes('sign');
+    if (!accepted) {
+        throw new Error('Execution authority requires an ES256 private signing key.');
+    }
+}
+function assertPublicVerificationKey(key) {
+    const algorithm = key.algorithm;
+    const accepted = key.type === 'public'
+        && algorithm.name === 'ECDSA'
+        && algorithm.namedCurve === 'P-256'
+        && key.usages.includes('verify');
+    if (!accepted) {
+        throw new Error('Execution authority requires an ES256 public verification key.');
+    }
+}
+async function assertMatchingKeyPair(keyPair) {
+    try {
+        const probe = await new CompactSign(new TextEncoder().encode('heddle-adopter-execution-authority-key-pair'))
+            .setProtectedHeader({ alg: SIGNING_ALGORITHM })
+            .sign(keyPair.privateKey);
+        await compactVerify(probe, keyPair.publicKey, {
+            algorithms: [SIGNING_ALGORITHM],
+        });
+    }
+    catch {
+        throw new Error('Execution authority signing keys do not match.');
+    }
+}
+function toEpochSeconds(value) {
+    const seconds = Math.floor(value.getTime() / 1_000);
+    if (!Number.isSafeInteger(seconds) || seconds < 0) {
+        throw new Error('Execution authority could not resolve a valid issue time.');
+    }
+    return seconds;
+}
+function toIsoTimestamp(epochSeconds) {
+    return new Date(epochSeconds * 1_000).toISOString();
+}
+function deepFreezeConfig(config) {
+    const mcp = config.mcp ? Object.freeze({ ...config.mcp }) : undefined;
+    return Object.freeze({ ...config, ...(mcp ? { mcp } : {}) });
+}
+function freezeIssuedMetadata(metadata) {
+    const scope = Object.freeze({ ...metadata.scope });
+    const mcp = metadata.mcp
+        ? Object.freeze({
+            ...metadata.mcp,
+            allowedTools: Object.freeze([...metadata.mcp.allowedTools]),
+        })
+        : undefined;
+    return Object.freeze({ ...metadata, scope, ...(mcp ? { mcp } : {}) });
+}
+//# sourceMappingURL=jose-execution-authority.js.map