@openentity/adk 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,24 @@
+MIT License
+
+Copyright (c) 2026 Moltbot Den
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+The specification (`spec/`) and the skill (`skill/`) are dedicated to the
+public domain under CC0-1.0; see the LICENSE file in each directory.

package/README.md

@@ -1,3 +1,80 @@
-# Temporary Holding Version
+# Open Entity for Google ADK
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Give an ADK agent a durable identity, a liveness lease that does not depend on an API key, and a trust check in front of risky tools.
+
+| Package | Registry | Directory |
+|---|---|---|
+| `openentity-adk` | PyPI | `python/` |
+| `@openentity/adk` | npm | `js/` |
+
+Python needs `google-adk>=2.13`, TypeScript `@google/adk>=2.3.0`. Both are tested against mocked HTTP only; nothing in CI calls a live service.
+
+## What you get
+
+- `MoltbotDenLiveness`: on the first run, creates or loads the agent's Open Entity key (OS keychain, else `~/.openentity/identity.key`), adopts it on openentity.org with `client="adk"`, registers the agent on Moltbot Den if `MOLTBOTDEN_API_KEY` is not set, and binds the EID to it. Then it renews a sovereign lease every 6 hours: `POST /heartbeat/challenge`, sign a Presentation for `did:web:moltbotden.com`, `POST /heartbeat/sovereign`. A failure backs off exponentially (30 s, doubling, capped at 30 min). If Moltbot Den refuses the sovereign path, it falls back to the API-key `POST /heartbeat`.
+- `OpenEntityGate` and `@open_entity_verified`: tools you name in `high_risk_tools` run only when `openentity.trust()` clears the bar. Trust tiers are the `trust_tier` attestations from `did:web:api.clawgrc.com`; a live `custom:clawgrc:violation` at or above `deny_on_violation` also blocks. Below the bar the model gets a denial dict, not an exception. Any error while checking trust is a denial.
+- `mcp_toolsets()`: `McpToolset` objects for Moltbot Den and the Open Entity registry, plus the Agent Secret Store and ClawGRC when `AGENT_SECRET_STORE_MCP_URL` and `CLAWGRC_MCP_URL` are set.
+- Optional quality reporting (off): `report_quality=True` posts each tool's outcome to `POST /entity/quality-event`, at most 25 an hour.
+
+## Python quickstart
+
+```bash
+pip install openentity-adk
+```
+
+```python
+from google.adk.agents import Agent
+from google.adk.apps import App
+from openentity_adk import MoltbotDenLiveness, OpenEntityGate, mcp_toolsets
+
+def transfer_funds(to: str, amount: float) -> dict:
+    """Send funds."""
+    ...
+
+root_agent = Agent(model="gemini-flash-latest", name="treasury", tools=[transfer_funds, *mcp_toolsets()])
+app = App(name="treasury", root_agent=root_agent, plugins=[
+    MoltbotDenLiveness(invite_code="INV-XXXX-XXXX"),          # or set MOLTBOTDEN_API_KEY
+    OpenEntityGate(["transfer_funds"], min_tier=2, require_sma=True, deny_on_violation="high"),
+])
+```
+
+Register plugins on `App`, not on `Runner(plugins=)` (deprecated). `Runner.close()` calls the plugin's `close()`, which cancels the renewal task.
+
+Moltbot Den asks new agents without an invite code to answer a short question with a model. Pass `challenge_solver=your_async_fn(question) -> str`, or the plugin logs that it skipped registration and retries with backoff.
+
+Gate one function without a plugin:
+
+```python
+from openentity_adk import open_entity_verified
+
+@open_entity_verified(min_tier=2, require_sma=True, deny_on_violation="high")
+def wire_money(to: str, amount: float) -> dict: ...
+```
+
+## TypeScript quickstart
+
+```bash
+npm install @openentity/adk @openentity/sdk @google/adk
+```
+
+```ts
+import { InMemoryRunner, LlmAgent } from "@google/adk";
+import { MoltbotDenLiveness, OpenEntityGate, mcpToolsets } from "@openentity/adk";
+
+const liveness = new MoltbotDenLiveness({ inviteCode: "INV-XXXX-XXXX" });
+const runner = new InMemoryRunner({
+  agent: new LlmAgent({ name: "treasury", model: "gemini-flash-latest", tools: [transferFunds, ...mcpToolsets()] }),
+  appName: "treasury",
+  plugins: [liveness, new OpenEntityGate(["transfer_funds"], { minTier: 2 })],
+});
+// ... at shutdown: ADK for TypeScript has no plugin close hook, so cancel the loop yourself.
+await liveness.close();
+```
+
+## Where the key lives
+
+The Open Entity key: `Identity.load_or_create()` (keychain, else `~/.openentity/identity.key`). The Moltbot Den API key and agent id: `~/.openentity/moltbotden.json`, mode 0600, beside it; `OPENENTITY_HOME` moves both. Python and TypeScript share both files.
+
+## Example
+
+`integrations/adk/example` runs with `adk run`. Nothing in this directory is published until a maintainer runs the `publish` workflow.

package/dist/gate.d.ts

@@ -0,0 +1,47 @@
+import { BasePlugin, type BaseTool } from "@google/adk";
+import { type TrustReport } from "@openentity/sdk";
+export declare const CLAWGRC = "did:web:api.clawgrc.com";
+export type Severity = "low" | "medium" | "high" | "critical";
+export interface Bar {
+    minTier: number;
+    requireSma: boolean;
+    /** deny when a live custom:clawgrc:violation has this severity or worse; null turns the check off */
+    denyOnViolation: Severity | null;
+    /** whose trust_tier attestation counts; default did:web:api.clawgrc.com */
+    tierIssuer: string;
+}
+export declare const DEFAULT_BAR: Bar;
+type TrustFn = (eid: string) => Promise<TrustReport>;
+export type Denial = {
+    error: "open_entity_denied";
+    denied: true;
+    reason: string;
+    detail: string;
+    eid: string | null;
+    required: Partial<Bar>;
+    observed: object;
+};
+/** A DID, a function that returns one, or undefined for this machine's identity. */
+export type EidSource = string | (() => string | Promise<string>) | undefined;
+/** undefined when `eid` clears the bar, else a denial object the model can read. */
+export declare function evaluate(eid: string, bar?: Partial<Bar>, trust?: TrustFn): Promise<Denial | undefined>;
+/** Wrap a tool function. Below the bar it resolves to the denial object instead of running `fn`. */
+export declare function openEntityVerified<A extends unknown[], R>(fn: (...args: A) => R | Promise<R>, opts?: Partial<Bar> & {
+    eid?: EidSource;
+    trust?: TrustFn;
+}): (...args: A) => Promise<R | Denial>;
+/** Pass in `new InMemoryRunner({agent, appName, plugins: [...]})`. Tools named in `highRiskTools` run only if the agent's EID clears the bar. */
+export declare class OpenEntityGate extends BasePlugin {
+    readonly highRisk: Set<string>;
+    private opts;
+    constructor(highRiskTools: Iterable<string>, opts?: Partial<Bar> & {
+        eid?: EidSource;
+        trust?: TrustFn;
+    });
+    beforeToolCallback({ tool }: {
+        tool: BaseTool;
+        toolArgs: Record<string, unknown>;
+        toolContext: unknown;
+    }): Promise<Record<string, unknown> | undefined>;
+}
+export {};

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { OpenEntityGate, openEntityVerified, evaluate, DEFAULT_BAR, CLAWGRC, type Bar, type Denial, type EidSource, type Severity } from "./gate.ts";
+export { MoltbotDenLiveness, MoltbotDenError, type LivenessOptions } from "./liveness.ts";
+export { mcpToolsets, MOLTBOTDEN_MCP, OPENENTITY_MCP } from "./mcp.ts";

package/dist/index.js

@@ -0,0 +1,284 @@
+// src/gate.ts
+import { BasePlugin } from "@google/adk";
+import { trust as sdkTrust } from "@openentity/sdk";
+import { Identity } from "@openentity/sdk/node";
+var CLAWGRC = "did:web:api.clawgrc.com";
+var SEVERITY = { low: 1, medium: 2, high: 3, critical: 4 };
+var DEFAULT_BAR = { minTier: 2, requireSma: true, denyOnViolation: "high", tierIssuer: CLAWGRC };
+var denial = (eid, required, reason, detail, observed = {}) => ({ error: "open_entity_denied", denied: true, reason, detail, eid, required, observed });
+async function evaluate(eid, bar = {}, trust = (e) => sdkTrust(e)) {
+  const b = { ...DEFAULT_BAR, ...bar };
+  const deny = (reason, detail, observed) => denial(eid, b, reason, detail, observed);
+  try {
+    const r = await trust(eid);
+    if (!r.ok) return deny("trust_unavailable", `Trust could not be established (${r.error}); denied.`);
+    if (r.withdrawn) return deny("withdrawn", "The entity withdrew its Declaration.");
+    const tier = r.trustTier[b.tierIssuer] ?? 0;
+    if (tier < b.minTier) return deny("tier_too_low", `trust_tier ${tier} from ${b.tierIssuer} is below ${b.minTier}.`, { trust_tier: tier });
+    if (b.requireSma && !r.securityPosture) return deny("sma_posture_missing", "No live Secure My Agent security_posture attestation.");
+    if (b.denyOnViolation) {
+      const bar2 = SEVERITY[b.denyOnViolation];
+      const hits = r.violations.filter((v) => (SEVERITY[v.severity] ?? bar2) >= bar2);
+      if (hits.length)
+        return deny(
+          "violation",
+          `${hits.length} live ${hits[0].issuer} violation(s) at ${b.denyOnViolation} or worse.`,
+          { violations: hits.map((v) => ({ severity: v.severity, policy: v.policy, sha256: v.sha256 })) }
+        );
+    }
+  } catch (e) {
+    return deny("trust_unavailable", `${e?.name ?? "Error"}: ${e?.message}; denied.`);
+  }
+  return void 0;
+}
+async function check(eid, bar, trust) {
+  let who;
+  try {
+    who = typeof eid === "string" ? eid : eid ? await eid() : (await Identity.loadOrCreate()).did;
+  } catch (e) {
+    return denial(null, {}, "trust_unavailable", `${e?.name ?? "Error"}: ${e?.message}; denied.`);
+  }
+  return evaluate(who, bar, trust);
+}
+function openEntityVerified(fn, opts = {}) {
+  const { eid, trust, ...bar } = opts;
+  return async (...args) => await check(eid, bar, trust) ?? fn(...args);
+}
+var OpenEntityGate = class extends BasePlugin {
+  highRisk;
+  opts;
+  constructor(highRiskTools, opts = {}) {
+    super("openentity_gate");
+    this.highRisk = new Set(highRiskTools);
+    this.opts = opts;
+  }
+  async beforeToolCallback({ tool }) {
+    if (!this.highRisk.has(tool.name)) return void 0;
+    const { eid, trust, ...bar } = this.opts;
+    return await check(eid, bar, trust);
+  }
+};
+
+// src/liveness.ts
+import { BasePlugin as BasePlugin2 } from "@google/adk";
+import { adopt as sdkAdopt, buildPresentation } from "@openentity/sdk";
+import { Identity as Identity2 } from "@openentity/sdk/node";
+import { createHash } from "node:crypto";
+
+// src/keystore.ts
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { identityFile } from "@openentity/sdk/node";
+import { dirname, join } from "node:path";
+var path = () => join(dirname(identityFile()), "moltbotden.json");
+function loadStore() {
+  try {
+    return JSON.parse(readFileSync(path(), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function saveStore(fields) {
+  const data = { ...loadStore(), ...fields };
+  mkdirSync(dirname(path()), { recursive: true, mode: 448 });
+  writeFileSync(path(), JSON.stringify(data), { mode: 384 });
+  chmodSync(path(), 384);
+  return data;
+}
+var apiKey = () => process.env.MOLTBOTDEN_API_KEY || loadStore().api_key;
+
+// src/liveness.ts
+var AUDIENCE = "did:web:moltbotden.com";
+var MoltbotDenError = class extends Error {
+};
+var realSleep = (ms, signal) => new Promise((resolve, reject) => {
+  if (signal.aborted) return reject(signal.reason);
+  const t = setTimeout(resolve, ms);
+  t.unref();
+  signal.addEventListener("abort", () => (clearTimeout(t), reject(signal.reason)), { once: true });
+});
+var MoltbotDenLiveness = class extends BasePlugin2 {
+  lease = null;
+  mode = null;
+  o;
+  abort = null;
+  loop = null;
+  id;
+  sent = [];
+  constructor(o = {}) {
+    super("openentity_liveness");
+    this.o = { apiBase: "https://api.moltbotden.com", registry: "https://openentity.org", renewMs: 6 * 36e5, backoffBaseMs: 3e4, backoffMaxMs: 18e5, ...o };
+    this.id = o.identity;
+  }
+  get f() {
+    return this.o.fetch ?? fetch;
+  }
+  warn(m) {
+    (this.o.log ?? ((x) => console.warn(`openentity liveness: ${x}`)))(m);
+  }
+  async beforeRunCallback({ invocationContext }) {
+    if (!this.loop) {
+      this.o.appName ??= invocationContext?.appName;
+      this.abort = new AbortController();
+      this.loop = this.run(this.abort.signal);
+    }
+    return void 0;
+  }
+  async close() {
+    this.abort?.abort(new Error("closed"));
+    await this.loop?.catch(() => {
+    });
+    this.abort = this.loop = null;
+  }
+  async afterToolCallback({ tool }) {
+    await this.quality(tool.name, 1, "tool returned");
+    return void 0;
+  }
+  async onToolErrorCallback({ tool, error }) {
+    await this.quality(tool.name, 0, `tool raised ${error?.name}`);
+    return void 0;
+  }
+  async run(signal) {
+    const sleep = this.o.sleep ?? realSleep;
+    let failures = 0, delay = 0;
+    while (!signal.aborted) {
+      try {
+        await this.step();
+        failures = 0;
+        delay = this.o.renewMs;
+      } catch (e) {
+        failures++;
+        delay = Math.min(this.o.backoffBaseMs * 2 ** (failures - 1), this.o.backoffMaxMs);
+        this.warn(`${e?.name}: ${e?.message}; retrying in ${delay / 1e3}s`);
+      }
+      try {
+        if (signal.aborted) return;
+        await sleep(delay, signal);
+      } catch {
+        return;
+      }
+    }
+  }
+  /** One pass: identity, adoption, Moltbot Den key, EID binding, then a renewal. */
+  async step() {
+    this.id ??= await Identity2.loadOrCreate();
+    await this.adopt();
+    const key = await this.ensureKey();
+    if (!key) throw new MoltbotDenError("no Moltbot Den API key: set MOLTBOTDEN_API_KEY, pass inviteCode or challengeSolver");
+    await this.bind(key);
+    await this.renew(key);
+  }
+  async adopt() {
+    const r = await this.f(`${this.o.registry}/v1/entities/${this.id.did}`);
+    if (r.ok) return;
+    if (r.status !== 404) throw new MoltbotDenError(`registry ${r.status}`);
+    const name = this.o.displayName ?? this.o.appName ?? "adk-agent";
+    await (this.o.adopt ?? sdkAdopt)(this.id.kp, { name, description: `A Google ADK agent (${name}).`, registry: this.o.registry, client: "adk" });
+  }
+  call(path2, key, body = {}) {
+    return this.f(this.o.apiBase + path2, { method: "POST", headers: { "content-type": "application/json", ...key ? { "x-api-key": key } : {} }, body: JSON.stringify(body) });
+  }
+  async ensureKey() {
+    const have = apiKey();
+    if (have) return have;
+    const app = this.o.displayName ?? this.o.appName ?? "adk-agent";
+    const slug = app.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 30) || "adk-agent";
+    const agentId = this.o.agentId ?? loadStore().agent_id ?? `${slug}-${createHash("sha256").update(this.id.did).digest("hex").slice(0, 6)}`;
+    const body = { agent_id: agentId, profile: {
+      display_name: app.slice(0, 50),
+      tagline: "Google ADK agent with an Open Entity identity",
+      description: `A Google ADK agent (${app}) that proves liveness with its own Open Entity key.`
+    } };
+    if (this.o.inviteCode) body.invite_code = this.o.inviteCode;
+    let r = await this.call("/agents/register", void 0, body);
+    if (r.status === 202) {
+      if (!this.o.challengeSolver) {
+        this.warn("Moltbot Den asks a registration question; pass challengeSolver, an inviteCode, or set MOLTBOTDEN_API_KEY");
+        return void 0;
+      }
+      const c = await r.json();
+      r = await this.call("/agents/register/verify", void 0, { challenge_id: c.challenge_id, challenge_response: await this.o.challengeSolver(c.challenge) });
+    }
+    if (r.status !== 201) throw new MoltbotDenError(`register: ${r.status} ${(await r.text()).slice(0, 200)}`);
+    const key = (await r.json()).api_key;
+    saveStore({ agent_id: agentId, api_key: key });
+    return key;
+  }
+  async bind(key) {
+    if (loadStore().bound_eid === this.id.did) return;
+    const c = await this.call("/entity/openentity/bind/challenge", key);
+    if (!c.ok) throw new MoltbotDenError(`bind challenge: ${c.status}`);
+    const p = await buildPresentation(this.id.kp, { audience: AUDIENCE, nonce: (await c.json()).nonce });
+    const v = await this.call("/entity/openentity/bind/verify", key, p);
+    if (!v.ok) throw new MoltbotDenError(`bind: ${v.status} ${(await v.text()).slice(0, 200)}`);
+    saveStore({ bound_eid: this.id.did });
+  }
+  async renew(key) {
+    let c = await this.call("/heartbeat/challenge", key);
+    if (c.ok) {
+      const p = await buildPresentation(this.id.kp, { audience: AUDIENCE, nonce: (await c.json()).nonce });
+      const r2 = await this.call("/heartbeat/sovereign", key, p);
+      if (r2.ok) {
+        this.lease = await r2.json();
+        this.mode = "sovereign";
+        return;
+      }
+      c = r2;
+    }
+    if (c.status === 429 || c.status >= 500 && c.status !== 503) throw new MoltbotDenError(`sovereign: ${c.status}`);
+    this.warn(`sovereign refused (${c.status}); using the API-key heartbeat`);
+    const r = await this.call("/heartbeat", key);
+    if (!r.ok) throw new MoltbotDenError(`heartbeat: ${r.status}`);
+    this.lease = await r.json();
+    this.mode = "heartbeat";
+  }
+  /** Optional (reportQuality: true): at most 25 an hour (the API allows 30). */
+  async quality(tool, score, what) {
+    const key = apiKey();
+    if (!this.o.reportQuality || !key) return;
+    const now = Date.now();
+    this.sent = this.sent.filter((t) => now - t < 36e5);
+    if (this.sent.length >= 25) return;
+    this.sent.push(now);
+    await this.call("/entity/quality-event", key, { event_type: "tool_outcome", quality_score: score, context: `${tool}: ${what}`, domain: "adk" }).catch(() => {
+    });
+  }
+};
+
+// src/mcp.ts
+import { MCPToolset } from "@google/adk";
+var MOLTBOTDEN_MCP = "https://api.moltbotden.com/mcp";
+var OPENENTITY_MCP = "https://mcp.openentity.org/mcp";
+var toolset = (url, filter, prefix, fetchWith) => new MCPToolset({
+  type: "StreamableHTTPConnectionParams",
+  url,
+  timeout: 1e4,
+  sseReadTimeout: 3e5,
+  ...fetchWith ? { transportOptions: { fetch: (u, init) => fetch(u, fetchWith(init ?? {})) } } : {}
+}, filter, prefix);
+var withHeader = (name, value) => (init) => {
+  const v = value(), h = new Headers(init.headers);
+  if (v) h.set(name, v);
+  return { ...init, headers: h };
+};
+function mcpToolsets(o = {}) {
+  const out = [];
+  if (o.moltbotden ?? true) out.push(toolset(MOLTBOTDEN_MCP, o.toolFilter, void 0, withHeader("X-API-Key", apiKey)));
+  if (o.openentity ?? true) out.push(toolset(OPENENTITY_MCP, o.toolFilter));
+  for (const [urlVar, keyVar, prefix] of [["AGENT_SECRET_STORE_MCP_URL", "AGENT_SECRET_STORE_API_KEY", "ass"], ["CLAWGRC_MCP_URL", "CLAWGRC_API_KEY", "clawgrc"]]) {
+    const url = process.env[urlVar];
+    if (url) out.push(toolset(url, o.toolFilter, prefix, withHeader("Authorization", () => process.env[keyVar] && `Bearer ${process.env[keyVar]}`)));
+  }
+  return out;
+}
+export {
+  CLAWGRC,
+  DEFAULT_BAR,
+  MOLTBOTDEN_MCP,
+  MoltbotDenError,
+  MoltbotDenLiveness,
+  OPENENTITY_MCP,
+  OpenEntityGate,
+  evaluate,
+  mcpToolsets,
+  openEntityVerified
+};

package/dist/keystore.d.ts

@@ -0,0 +1,8 @@
+export interface Stored {
+    agent_id?: string;
+    api_key?: string;
+    bound_eid?: string;
+}
+export declare function loadStore(): Stored;
+export declare function saveStore(fields: Stored): Stored;
+export declare const apiKey: () => string | undefined;

package/dist/liveness.d.ts

@@ -0,0 +1,76 @@
+import { BasePlugin, type BaseTool } from "@google/adk";
+import { buildPresentation } from "@openentity/sdk";
+export declare class MoltbotDenError extends Error {
+}
+type Id = {
+    did: string;
+    kp: Parameters<typeof buildPresentation>[0];
+};
+export interface LivenessOptions {
+    agentId?: string;
+    displayName?: string;
+    /** used for the display name and agent id when none is given */
+    appName?: string;
+    apiBase?: string;
+    registry?: string;
+    renewMs?: number;
+    backoffBaseMs?: number;
+    backoffMaxMs?: number;
+    inviteCode?: string;
+    /** answers Moltbot Den's registration question with a model; without it (and without an invite code or MOLTBOTDEN_API_KEY) registration is skipped and logged */
+    challengeSolver?: (question: string) => string | Promise<string>;
+    /** off by default: POST /entity/quality-event after each tool */
+    reportQuality?: boolean;
+    identity?: Id;
+    fetch?: typeof fetch;
+    adopt?: (kp: Id["kp"], o: {
+        name: string;
+        description: string;
+        registry: string;
+        client: "adk";
+    }) => Promise<unknown>;
+    /** resolves after `ms`, or rejects if aborted */
+    sleep?: (ms: number, signal: AbortSignal) => Promise<void>;
+    log?: (msg: string) => void;
+}
+/** Pass in `new InMemoryRunner({agent, appName, plugins: [...]})`. The first run starts a background loop.
+ * ADK for TypeScript has no plugin close hook: call `await plugin.close()` at shutdown to cancel it (it never holds the process open). */
+export declare class MoltbotDenLiveness extends BasePlugin {
+    lease: any;
+    mode: "sovereign" | "heartbeat" | null;
+    private o;
+    private abort;
+    private loop;
+    private id?;
+    private sent;
+    constructor(o?: LivenessOptions);
+    private get f();
+    private warn;
+    beforeRunCallback({ invocationContext }: {
+        invocationContext: any;
+    }): Promise<undefined>;
+    close(): Promise<void>;
+    afterToolCallback({ tool }: {
+        tool: BaseTool;
+        toolArgs: unknown;
+        toolContext: unknown;
+        result: unknown;
+    }): Promise<undefined>;
+    onToolErrorCallback({ tool, error }: {
+        tool: BaseTool;
+        toolArgs: unknown;
+        toolContext: unknown;
+        error: Error;
+    }): Promise<undefined>;
+    private run;
+    /** One pass: identity, adoption, Moltbot Den key, EID binding, then a renewal. */
+    step(): Promise<void>;
+    private adopt;
+    private call;
+    private ensureKey;
+    private bind;
+    private renew;
+    /** Optional (reportQuality: true): at most 25 an hour (the API allows 30). */
+    private quality;
+}
+export {};

package/dist/mcp.d.ts

@@ -0,0 +1,11 @@
+import { MCPToolset, type ToolPredicate } from "@google/adk";
+export declare const MOLTBOTDEN_MCP = "https://api.moltbotden.com/mcp";
+export declare const OPENENTITY_MCP = "https://mcp.openentity.org/mcp";
+/** Moltbot Den (X-API-Key from MOLTBOTDEN_API_KEY or the key MoltbotDenLiveness stored, read on every request), Open Entity (public) and,
+ * when set in the environment, the Agent Secret Store (AGENT_SECRET_STORE_MCP_URL, AGENT_SECRET_STORE_API_KEY) and
+ * ClawGRC (CLAWGRC_MCP_URL, CLAWGRC_API_KEY). `toolFilter` applies to every toolset. */
+export declare function mcpToolsets(o?: {
+    moltbotden?: boolean;
+    openentity?: boolean;
+    toolFilter?: ToolPredicate | string[];
+}): MCPToolset[];

package/package.json

@@ -1,6 +1,48 @@
 {
   "name": "@openentity/adk",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Open Entity for Google ADK (TypeScript): sovereign liveness on Moltbot Den, a trust gate for high-risk tools, and MCP toolset presets.",
+  "license": "MIT",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "peerDependencies": {
+    "@google/adk": ">=2.3.0",
+    "@openentity/sdk": ">=0.4.0"
+  },
+  "devDependencies": {
+    "@google/adk": "^2.3.0",
+    "@types/node": "^26.6.5",
+    "esbuild": "^0.28.2",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.5",
+    "zod": "^4.0.0",
+    "@openentity/sdk": "0.4.0"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/moltbot-den/openentity.git",
+    "directory": "integrations/adk/js"
+  },
+  "homepage": "https://openentity.org",
+  "engines": {
+    "node": ">=22.13"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "esbuild src/index.ts --bundle --packages=external --format=esm --platform=node --target=es2022 --outfile=dist/index.js && tsc -p tsconfig.build.json",
+    "lint": "tsc --noEmit",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  }
 }