@kya-os/cli 2.0.0 → 2.0.2

package/node_modules/@kya-os/contracts/dist/well-known/index.js

@@ -0,0 +1,302 @@
+"use strict";
+/**
+ * MCP-I Well-Known Endpoints Specification
+ *
+ * This module defines the types for well-known endpoints as specified in the
+ * MCP-I protocol. These endpoints provide identity discovery and verification
+ * capabilities for MCP-I agents.
+ *
+ * @module @kya-os/contracts/well-known
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WellKnownResponseSchema = exports.WellKnownConfigSchema = exports.MCPClientConfigSchema = exports.MCPServerConfigSchema = exports.MCPServerCardSchema = exports.MCPIdentitySchema = exports.AgentDocumentSchema = exports.DIDDocumentSchema = exports.WellKnownPath = void 0;
+exports.isDIDDocument = isDIDDocument;
+exports.isAgentDocument = isAgentDocument;
+exports.isMCPIdentity = isMCPIdentity;
+exports.validateDIDDocument = validateDIDDocument;
+exports.validateAgentDocument = validateAgentDocument;
+exports.validateMCPIdentity = validateMCPIdentity;
+exports.isWellKnownPath = isWellKnownPath;
+exports.getWellKnownContentType = getWellKnownContentType;
+exports.isMCPServerCard = isMCPServerCard;
+exports.validateMCPServerCard = validateMCPServerCard;
+exports.isMCPServerConfig = isMCPServerConfig;
+exports.validateMCPServerConfig = validateMCPServerConfig;
+exports.isMCPClientConfig = isMCPClientConfig;
+exports.validateMCPClientConfig = validateMCPClientConfig;
+const zod_1 = require("zod");
+/**
+ * Well-known endpoint paths
+ */
+var WellKnownPath;
+(function (WellKnownPath) {
+    WellKnownPath["DID_DOCUMENT"] = "/.well-known/did.json";
+    WellKnownPath["AGENT_DOCUMENT"] = "/.well-known/agent.json";
+    WellKnownPath["MCP_IDENTITY"] = "/.well-known/mcp-identity";
+    WellKnownPath["TOOL_PROTECTIONS"] = "/.well-known/tool-protections.json";
+    /** SEP-1649 MCP Server Card (current usage by Cursor/Claude Desktop) */
+    WellKnownPath["MCP_SERVER_CONFIG"] = "/.well-known/mcp.json";
+    /** SEP-1649 MCP Server Card (proposed spec path) */
+    WellKnownPath["MCP_SERVER_CARD"] = "/.well-known/mcp/server-card.json";
+    /** Client configuration helper (Cursor/Claude Desktop ready-to-use config) */
+    WellKnownPath["MCP_CLIENT_CONFIG"] = "/.well-known/mcp-client-config.json";
+})(WellKnownPath || (exports.WellKnownPath = WellKnownPath = {}));
+/**
+ * Zod Schemas for Validation
+ */
+exports.DIDDocumentSchema = zod_1.z.object({
+    '@context': zod_1.z.array(zod_1.z.string()),
+    id: zod_1.z.string(),
+    verificationMethod: zod_1.z.array(zod_1.z.object({
+        id: zod_1.z.string(),
+        type: zod_1.z.string(),
+        controller: zod_1.z.string(),
+        publicKeyBase64: zod_1.z.string().optional(),
+        publicKeyMultibase: zod_1.z.string().optional()
+    })),
+    authentication: zod_1.z.array(zod_1.z.string()).optional(),
+    assertionMethod: zod_1.z.array(zod_1.z.string()).optional(),
+    capabilityInvocation: zod_1.z.array(zod_1.z.string()).optional(),
+    capabilityDelegation: zod_1.z.array(zod_1.z.string()).optional(),
+    keyAgreement: zod_1.z.array(zod_1.z.string()).optional(),
+    service: zod_1.z.array(zod_1.z.object({
+        id: zod_1.z.string(),
+        type: zod_1.z.string(),
+        serviceEndpoint: zod_1.z.string()
+    })).optional()
+});
+exports.AgentDocumentSchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    capabilities: zod_1.z.object({
+        'mcp-i': zod_1.z.array(zod_1.z.enum(['handshake', 'signing', 'verification', 'delegation', 'proof-generation']))
+    }).catchall(zod_1.z.array(zod_1.z.string())),
+    metadata: zod_1.z.object({
+        name: zod_1.z.string().optional(),
+        serviceEndpoint: zod_1.z.string().optional(),
+        version: zod_1.z.string().optional(),
+        description: zod_1.z.string().optional()
+    }).optional()
+});
+exports.MCPIdentitySchema = zod_1.z.object({
+    did: zod_1.z.string(),
+    publicKey: zod_1.z.string(),
+    serviceName: zod_1.z.string(),
+    serviceEndpoint: zod_1.z.string(),
+    timestamp: zod_1.z.number(),
+    metadata: zod_1.z.record(zod_1.z.unknown()).optional()
+});
+/** SEP-1649 MCP Server Card Schema */
+exports.MCPServerCardSchema = zod_1.z.object({
+    $schema: zod_1.z.string().optional(),
+    version: zod_1.z.string(),
+    protocolVersion: zod_1.z.string(),
+    serverInfo: zod_1.z.object({
+        name: zod_1.z.string(),
+        title: zod_1.z.string().optional(),
+        version: zod_1.z.string()
+    }),
+    description: zod_1.z.string().optional(),
+    iconUrl: zod_1.z.string().optional(),
+    documentationUrl: zod_1.z.string().optional(),
+    transport: zod_1.z.object({
+        type: zod_1.z.enum(['streamable-http', 'sse', 'stdio']),
+        endpoint: zod_1.z.string()
+    }),
+    capabilities: zod_1.z.object({
+        tools: zod_1.z.object({ listChanged: zod_1.z.boolean().optional() }).optional(),
+        prompts: zod_1.z.object({ listChanged: zod_1.z.boolean().optional() }).optional(),
+        resources: zod_1.z.object({
+            subscribe: zod_1.z.boolean().optional(),
+            listChanged: zod_1.z.boolean().optional()
+        }).optional(),
+        logging: zod_1.z.record(zod_1.z.unknown()).optional(),
+        completions: zod_1.z.record(zod_1.z.unknown()).optional(),
+        experimental: zod_1.z.record(zod_1.z.unknown()).optional()
+    }).optional(),
+    requires: zod_1.z.object({
+        sampling: zod_1.z.record(zod_1.z.unknown()).optional(),
+        roots: zod_1.z.record(zod_1.z.unknown()).optional(),
+        elicitation: zod_1.z.record(zod_1.z.unknown()).optional(),
+        experimental: zod_1.z.record(zod_1.z.unknown()).optional()
+    }).optional(),
+    authentication: zod_1.z.object({
+        required: zod_1.z.boolean(),
+        schemes: zod_1.z.array(zod_1.z.string())
+    }).optional(),
+    instructions: zod_1.z.string().optional(),
+    resources: zod_1.z.union([
+        zod_1.z.literal('dynamic'),
+        zod_1.z.array(zod_1.z.object({
+            name: zod_1.z.string(),
+            title: zod_1.z.string().optional(),
+            uri: zod_1.z.string(),
+            description: zod_1.z.string().optional(),
+            mimeType: zod_1.z.string().optional()
+        }))
+    ]).optional(),
+    tools: zod_1.z.union([
+        zod_1.z.literal('dynamic'),
+        zod_1.z.array(zod_1.z.object({
+            name: zod_1.z.string(),
+            title: zod_1.z.string().optional(),
+            description: zod_1.z.string().optional(),
+            inputSchema: zod_1.z.record(zod_1.z.unknown()).optional()
+        }))
+    ]).optional(),
+    prompts: zod_1.z.union([
+        zod_1.z.literal('dynamic'),
+        zod_1.z.array(zod_1.z.object({
+            name: zod_1.z.string(),
+            title: zod_1.z.string().optional(),
+            description: zod_1.z.string().optional(),
+            arguments: zod_1.z.array(zod_1.z.object({
+                name: zod_1.z.string(),
+                description: zod_1.z.string().optional(),
+                required: zod_1.z.boolean().optional()
+            })).optional()
+        }))
+    ]).optional(),
+    _meta: zod_1.z.record(zod_1.z.unknown()).optional()
+});
+/** Legacy MCP Server Config Schema */
+exports.MCPServerConfigSchema = zod_1.z.object({
+    name: zod_1.z.string(),
+    description: zod_1.z.string().optional(),
+    url: zod_1.z.string(),
+    transport: zod_1.z.enum(['sse', 'stdio', 'http']),
+    version: zod_1.z.string().optional(),
+    agentDid: zod_1.z.string().optional(),
+    capabilities: zod_1.z.array(zod_1.z.string()).optional(),
+    requiresAuth: zod_1.z.boolean().optional(),
+    authProvider: zod_1.z.string().optional(),
+    metadata: zod_1.z.record(zod_1.z.unknown()).optional()
+});
+/** MCP Client Config Schema */
+exports.MCPClientConfigSchema = zod_1.z.object({
+    claudeDesktop: zod_1.z.object({
+        mcpServers: zod_1.z.record(zod_1.z.object({
+            url: zod_1.z.string(),
+            transport: zod_1.z.literal('sse').optional()
+        }))
+    }),
+    cursor: zod_1.z.object({
+        mcpServers: zod_1.z.record(zod_1.z.object({
+            url: zod_1.z.string(),
+            transport: zod_1.z.literal('sse').optional()
+        }))
+    }),
+    cursorDeepLink: zod_1.z.string().optional(),
+    _meta: zod_1.z.object({
+        serverName: zod_1.z.string().optional(),
+        serverUrl: zod_1.z.string().optional(),
+        mcpEndpoint: zod_1.z.string().optional(),
+        agentDid: zod_1.z.string().optional(),
+        generatedAt: zod_1.z.number().optional(),
+        instructions: zod_1.z.string().optional()
+    }).catchall(zod_1.z.unknown()).optional()
+});
+exports.WellKnownConfigSchema = zod_1.z.object({
+    serviceName: zod_1.z.string().optional(),
+    serviceTitle: zod_1.z.string().optional(),
+    serviceEndpoint: zod_1.z.string().optional(),
+    description: zod_1.z.string().optional(),
+    serverVersion: zod_1.z.string().optional(),
+    protocolVersion: zod_1.z.string().optional(),
+    iconUrl: zod_1.z.string().optional(),
+    documentationUrl: zod_1.z.string().optional(),
+    requiresAuth: zod_1.z.boolean().optional(),
+    authSchemes: zod_1.z.array(zod_1.z.string()).optional(),
+    instructions: zod_1.z.string().optional(),
+    metadata: zod_1.z.record(zod_1.z.unknown()).optional()
+});
+exports.WellKnownResponseSchema = zod_1.z.object({
+    status: zod_1.z.number(),
+    headers: zod_1.z.record(zod_1.z.string()),
+    body: zod_1.z.string()
+});
+/**
+ * Type Guards
+ */
+function isDIDDocument(obj) {
+    return exports.DIDDocumentSchema.safeParse(obj).success;
+}
+function isAgentDocument(obj) {
+    return exports.AgentDocumentSchema.safeParse(obj).success;
+}
+function isMCPIdentity(obj) {
+    return exports.MCPIdentitySchema.safeParse(obj).success;
+}
+/**
+ * Validation Functions
+ */
+function validateDIDDocument(obj) {
+    return exports.DIDDocumentSchema.parse(obj);
+}
+function validateAgentDocument(obj) {
+    return exports.AgentDocumentSchema.parse(obj);
+}
+function validateMCPIdentity(obj) {
+    return exports.MCPIdentitySchema.parse(obj);
+}
+/**
+ * Utility Functions
+ */
+/**
+ * Check if a path is a well-known endpoint
+ */
+function isWellKnownPath(path) {
+    return Object.values(WellKnownPath).includes(path);
+}
+/**
+ * Get the content type for a well-known endpoint
+ */
+function getWellKnownContentType(path) {
+    switch (path) {
+        case WellKnownPath.DID_DOCUMENT:
+            return 'application/did+json';
+        case WellKnownPath.AGENT_DOCUMENT:
+        case WellKnownPath.TOOL_PROTECTIONS:
+        case WellKnownPath.MCP_SERVER_CONFIG:
+            return 'application/json';
+        case WellKnownPath.MCP_IDENTITY:
+            return 'application/json';
+        default:
+            return 'application/json';
+    }
+}
+/**
+ * Type guard for MCPServerCard (SEP-1649)
+ */
+function isMCPServerCard(obj) {
+    return exports.MCPServerCardSchema.safeParse(obj).success;
+}
+/**
+ * Validation function for MCPServerCard (SEP-1649)
+ */
+function validateMCPServerCard(obj) {
+    return exports.MCPServerCardSchema.parse(obj);
+}
+/**
+ * Type guard for MCPServerConfig (legacy)
+ */
+function isMCPServerConfig(obj) {
+    return exports.MCPServerConfigSchema.safeParse(obj).success;
+}
+/**
+ * Validation function for MCPServerConfig (legacy)
+ */
+function validateMCPServerConfig(obj) {
+    return exports.MCPServerConfigSchema.parse(obj);
+}
+/**
+ * Type guard for MCPClientConfig
+ */
+function isMCPClientConfig(obj) {
+    return exports.MCPClientConfigSchema.safeParse(obj).success;
+}
+/**
+ * Validation function for MCPClientConfig
+ */
+function validateMCPClientConfig(obj) {
+    return exports.MCPClientConfigSchema.parse(obj);
+}

package/node_modules/@kya-os/contracts/dist/workbench/a2a.d.ts

@@ -0,0 +1,267 @@
+import { z } from 'zod';
+/** Application admission profile for the A2A 1.0 JSON-RPC binding. This is not a
+ * replacement for the normative upstream proto or a complete A2A SDK schema. */
+export declare const KYA_A2A_EXTENSION = "https://kya-os.ai/a2a/task-source/v1";
+export declare const A2ARpcEnvelopeSchema: z.ZodObject<{
+    jsonrpc: z.ZodLiteral<"2.0">;
+    id: z.ZodUnion<[z.ZodString, z.ZodNumber]>;
+    method: z.ZodString;
+    params: z.ZodUnknown;
+}, "strict", z.ZodTypeAny, {
+    id: string | number;
+    method: string;
+    jsonrpc: "2.0";
+    params?: unknown;
+}, {
+    id: string | number;
+    method: string;
+    jsonrpc: "2.0";
+    params?: unknown;
+}>;
+export declare const A2ATaskRequestSchema: z.ZodDiscriminatedUnion<"method", [z.ZodObject<{
+    method: z.ZodLiteral<"SendMessage">;
+    params: z.ZodObject<{
+        tenant: z.ZodString;
+        message: z.ZodObject<{
+            messageId: z.ZodString;
+            role: z.ZodLiteral<"ROLE_USER">;
+            parts: z.ZodArray<z.ZodObject<{
+                text: z.ZodString;
+                mediaType: z.ZodOptional<z.ZodLiteral<"text/plain">>;
+            }, "strict", z.ZodTypeAny, {
+                text: string;
+                mediaType?: "text/plain" | undefined;
+            }, {
+                text: string;
+                mediaType?: "text/plain" | undefined;
+            }>, "many">;
+            taskId: z.ZodOptional<z.ZodString>;
+            contextId: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            role: "ROLE_USER";
+            messageId: string;
+            parts: {
+                text: string;
+                mediaType?: "text/plain" | undefined;
+            }[];
+            taskId?: string | undefined;
+            contextId?: string | undefined;
+        }, {
+            role: "ROLE_USER";
+            messageId: string;
+            parts: {
+                text: string;
+                mediaType?: "text/plain" | undefined;
+            }[];
+            taskId?: string | undefined;
+            contextId?: string | undefined;
+        }>;
+        configuration: z.ZodObject<{
+            returnImmediately: z.ZodLiteral<true>;
+            historyLength: z.ZodOptional<z.ZodNumber>;
+            acceptedOutputModes: z.ZodOptional<z.ZodArray<z.ZodEnum<["application/json", "text/plain"]>, "many">>;
+        }, "strict", z.ZodTypeAny, {
+            returnImmediately: true;
+            historyLength?: number | undefined;
+            acceptedOutputModes?: ("text/plain" | "application/json")[] | undefined;
+        }, {
+            returnImmediately: true;
+            historyLength?: number | undefined;
+            acceptedOutputModes?: ("text/plain" | "application/json")[] | undefined;
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        message: {
+            role: "ROLE_USER";
+            messageId: string;
+            parts: {
+                text: string;
+                mediaType?: "text/plain" | undefined;
+            }[];
+            taskId?: string | undefined;
+            contextId?: string | undefined;
+        };
+        configuration: {
+            returnImmediately: true;
+            historyLength?: number | undefined;
+            acceptedOutputModes?: ("text/plain" | "application/json")[] | undefined;
+        };
+        tenant: string;
+    }, {
+        message: {
+            role: "ROLE_USER";
+            messageId: string;
+            parts: {
+                text: string;
+                mediaType?: "text/plain" | undefined;
+            }[];
+            taskId?: string | undefined;
+            contextId?: string | undefined;
+        };
+        configuration: {
+            returnImmediately: true;
+            historyLength?: number | undefined;
+            acceptedOutputModes?: ("text/plain" | "application/json")[] | undefined;
+        };
+        tenant: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    params: {
+        message: {
+            role: "ROLE_USER";
+            messageId: string;
+            parts: {
+                text: string;
+                mediaType?: "text/plain" | undefined;
+            }[];
+            taskId?: string | undefined;
+            contextId?: string | undefined;
+        };
+        configuration: {
+            returnImmediately: true;
+            historyLength?: number | undefined;
+            acceptedOutputModes?: ("text/plain" | "application/json")[] | undefined;
+        };
+        tenant: string;
+    };
+    method: "SendMessage";
+}, {
+    params: {
+        message: {
+            role: "ROLE_USER";
+            messageId: string;
+            parts: {
+                text: string;
+                mediaType?: "text/plain" | undefined;
+            }[];
+            taskId?: string | undefined;
+            contextId?: string | undefined;
+        };
+        configuration: {
+            returnImmediately: true;
+            historyLength?: number | undefined;
+            acceptedOutputModes?: ("text/plain" | "application/json")[] | undefined;
+        };
+        tenant: string;
+    };
+    method: "SendMessage";
+}>, z.ZodObject<{
+    method: z.ZodLiteral<"GetTask">;
+    params: z.ZodObject<{
+        tenant: z.ZodString;
+        id: z.ZodString;
+        historyLength: z.ZodOptional<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        tenant: string;
+        historyLength?: number | undefined;
+    }, {
+        id: string;
+        tenant: string;
+        historyLength?: number | undefined;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    params: {
+        id: string;
+        tenant: string;
+        historyLength?: number | undefined;
+    };
+    method: "GetTask";
+}, {
+    params: {
+        id: string;
+        tenant: string;
+        historyLength?: number | undefined;
+    };
+    method: "GetTask";
+}>, z.ZodObject<{
+    method: z.ZodLiteral<"CancelTask">;
+    params: z.ZodObject<{
+        tenant: z.ZodString;
+        id: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        tenant: string;
+    }, {
+        id: string;
+        tenant: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    params: {
+        id: string;
+        tenant: string;
+    };
+    method: "CancelTask";
+}, {
+    params: {
+        id: string;
+        tenant: string;
+    };
+    method: "CancelTask";
+}>]>;
+export type A2ATaskRequest = z.infer<typeof A2ATaskRequestSchema>;
+export declare const A2ATaskStateSchema: z.ZodEnum<["TASK_STATE_UNSPECIFIED", "TASK_STATE_SUBMITTED", "TASK_STATE_WORKING", "TASK_STATE_COMPLETED", "TASK_STATE_FAILED", "TASK_STATE_CANCELED", "TASK_STATE_INPUT_REQUIRED", "TASK_STATE_REJECTED"]>;
+export type A2ATaskState = z.infer<typeof A2ATaskStateSchema>;
+export interface A2ATaskProjection {
+    id: string;
+    contextId: string;
+    status: {
+        state: A2ATaskState;
+    };
+    metadata: {
+        kyaTaskSource: {
+            operationId: string;
+            sourceRevision: number;
+            ownerEpoch: number;
+            deliveryState: string;
+            cancellationRequested: boolean;
+            authorization: 'requires_task_approval';
+            completionBasis: 'none' | 'recorded_host_receipt';
+            resultDigest?: string;
+            evidenceRefs?: string[];
+            executionState?: string;
+        };
+    };
+}
+/** Out-of-band discovery profile returned to the installation administrator.
+ * RFC 9421 holder signatures require the extension; they are not bearer auth. */
+export declare function createKyaA2AAgentCard(endpoint: string, tenant: string): {
+    name: string;
+    description: string;
+    version: string;
+    supportedInterfaces: {
+        url: string;
+        protocolBinding: string;
+        protocolVersion: string;
+        tenant: string;
+    }[];
+    capabilities: {
+        streaming: boolean;
+        pushNotifications: boolean;
+        extendedAgentCard: boolean;
+        extensions: {
+            uri: string;
+            required: boolean;
+            description: string;
+            params: {
+                methods: string[];
+                maxRequestBytes: number;
+                returnImmediatelyRequired: boolean;
+                historyReturned: boolean;
+                authentication: {
+                    profile: string;
+                    headers: string[];
+                    bearerSupported: boolean;
+                };
+                retry: string;
+            };
+        }[];
+    };
+    defaultInputModes: string[];
+    defaultOutputModes: string[];
+    skills: {
+        id: string;
+        name: string;
+        description: string;
+        tags: string[];
+    }[];
+};

package/node_modules/@kya-os/contracts/dist/workbench/a2a.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.A2ATaskStateSchema = exports.A2ATaskRequestSchema = exports.A2ARpcEnvelopeSchema = exports.KYA_A2A_EXTENSION = void 0;
+exports.createKyaA2AAgentCard = createKyaA2AAgentCard;
+const zod_1 = require("zod");
+/** Application admission profile for the A2A 1.0 JSON-RPC binding. This is not a
+ * replacement for the normative upstream proto or a complete A2A SDK schema. */
+exports.KYA_A2A_EXTENSION = 'https://kya-os.ai/a2a/task-source/v1';
+const Id = zod_1.z.string().min(1).max(255);
+const Tenant = zod_1.z.string().regex(/^[0-9a-f-]{36}:[1-9][0-9]{0,9}$/);
+exports.A2ARpcEnvelopeSchema = zod_1.z
+    .object({
+    jsonrpc: zod_1.z.literal('2.0'),
+    id: zod_1.z.union([Id, zod_1.z.number().int().safe()]),
+    method: Id,
+    params: zod_1.z.unknown(),
+})
+    .strict();
+const Send = zod_1.z
+    .object({
+    tenant: Tenant,
+    message: zod_1.z
+        .object({
+        messageId: Id,
+        role: zod_1.z.literal('ROLE_USER'),
+        parts: zod_1.z
+            .array(zod_1.z
+            .object({
+            text: zod_1.z.string().min(1).max(7000),
+            mediaType: zod_1.z.literal('text/plain').optional(),
+        })
+            .strict())
+            .min(1)
+            .max(32),
+        taskId: zod_1.z.string().uuid().optional(),
+        contextId: zod_1.z.string().uuid().optional(),
+    })
+        .strict(),
+    configuration: zod_1.z
+        .object({
+        returnImmediately: zod_1.z.literal(true),
+        historyLength: zod_1.z.number().int().min(0).max(1000).optional(),
+        acceptedOutputModes: zod_1.z
+            .array(zod_1.z.enum(['application/json', 'text/plain']))
+            .min(1)
+            .max(2)
+            .optional(),
+    })
+        .strict(),
+})
+    .strict();
+const Get = zod_1.z
+    .object({
+    tenant: Tenant,
+    id: zod_1.z.string().uuid(),
+    historyLength: zod_1.z.number().int().min(0).max(1000).optional(),
+})
+    .strict();
+const Cancel = zod_1.z.object({ tenant: Tenant, id: zod_1.z.string().uuid() }).strict();
+exports.A2ATaskRequestSchema = zod_1.z.discriminatedUnion('method', [
+    zod_1.z.object({ method: zod_1.z.literal('SendMessage'), params: Send }).strict(),
+    zod_1.z.object({ method: zod_1.z.literal('GetTask'), params: Get }).strict(),
+    zod_1.z.object({ method: zod_1.z.literal('CancelTask'), params: Cancel }).strict(),
+]);
+exports.A2ATaskStateSchema = zod_1.z.enum([
+    'TASK_STATE_UNSPECIFIED',
+    'TASK_STATE_SUBMITTED',
+    'TASK_STATE_WORKING',
+    'TASK_STATE_COMPLETED',
+    'TASK_STATE_FAILED',
+    'TASK_STATE_CANCELED',
+    'TASK_STATE_INPUT_REQUIRED',
+    'TASK_STATE_REJECTED',
+]);
+/** Out-of-band discovery profile returned to the installation administrator.
+ * RFC 9421 holder signatures require the extension; they are not bearer auth. */
+function createKyaA2AAgentCard(endpoint, tenant) {
+    const url = new URL(endpoint);
+    if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash)
+        throw new Error('A2A endpoint must be an exact HTTPS target');
+    Tenant.parse(tenant);
+    return {
+        name: 'KYA accountable task intake',
+        description: 'Queue bounded work, send steering and request cancellation. Execution requires separately admitted authority. This text-only asynchronous profile requires the KYA extension.',
+        version: '1.0.0',
+        supportedInterfaces: [
+            { url: endpoint, protocolBinding: 'JSONRPC', protocolVersion: '1.0', tenant },
+        ],
+        capabilities: {
+            streaming: false,
+            pushNotifications: false,
+            extendedAgentCard: false,
+            extensions: [
+                {
+                    uri: exports.KYA_A2A_EXTENSION,
+                    required: true,
+                    description: 'KYA HTTP/2 Ed25519 holder proof over the exact JSON body and target; registered actors only. Source text never grants authority.',
+                    params: {
+                        methods: ['SendMessage', 'GetTask', 'CancelTask'],
+                        maxRequestBytes: 8192,
+                        returnImmediatelyRequired: true,
+                        historyReturned: false,
+                        authentication: {
+                            profile: 'kya-http/2',
+                            headers: ['Signature-Input', 'Signature', 'Content-Digest', 'Content-Type'],
+                            bearerSupported: false,
+                        },
+                        retry: 'Reuse the same messageId and unchanged parameters with a fresh HTTP proof after an uncertain acknowledgement.',
+                    },
+                },
+            ],
+        },
+        defaultInputModes: ['text/plain'],
+        defaultOutputModes: ['application/json'],
+        skills: [
+            {
+                id: 'accountable-work',
+                name: 'Accountable work',
+                description: 'Submit and inspect durable tasks; completion identifies a recorded host receipt, with separate artifact and acceptance verification.',
+                tags: ['tasks', 'governance', 'evidence'],
+            },
+        ],
+    };
+}