@ouro.bot/cli 0.1.0-alpha.88 → 0.1.0-alpha.880

package/dist/a2a/client.js

@@ -0,0 +1,238 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cardDid = cardDid;
+exports.endpointForCard = endpointForCard;
+exports.fetchA2AAgentCard = fetchA2AAgentCard;
+exports.postJsonRpc = postJsonRpc;
+exports.sendA2AMessage = sendA2AMessage;
+exports.postA2AMessageEnvelope = postA2AMessageEnvelope;
+exports.getA2ATask = getA2ATask;
+exports.sendSealedA2AChat = sendSealedA2AChat;
+const node_crypto_1 = require("node:crypto");
+const a2a_client_1 = require("@ouro.bot/friends/a2a-client");
+const runtime_1 = require("../nerves/runtime");
+const sealed_chat_1 = require("./sealed-chat");
+/** The trimmed `did:key` a card serves, or undefined when the card is did-less. */
+function cardDid(card) {
+    const did = card.did;
+    return typeof did === "string" && did.trim() ? did.trim() : undefined;
+}
+function endpointForCard(card) {
+    const jsonRpc = card.supportedInterfaces?.find((entry) => (entry.protocolBinding ?? entry.transport)?.toUpperCase() === "JSONRPC");
+    if (jsonRpc?.url)
+        return jsonRpc.url;
+    if (card.preferredTransport?.toUpperCase() === "JSONRPC" && card.url)
+        return card.url;
+    const legacyJsonRpc = card.additionalInterfaces?.find((entry) => entry.transport.toUpperCase() === "JSONRPC");
+    return legacyJsonRpc?.url ?? card.url;
+}
+async function fetchA2AAgentCard(cardUrl, fetchImpl = fetch) {
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_card_fetch_start",
+        message: "fetching A2A agent card",
+        meta: { cardUrl },
+    });
+    const response = await fetchImpl(cardUrl);
+    if (!response.ok) {
+        throw new Error(`A2A card fetch failed (${response.status} ${response.statusText})`);
+    }
+    const parsed = await response.json();
+    const endpoint = endpointForCard(parsed);
+    if (!parsed || typeof parsed !== "object" || typeof endpoint !== "string" || typeof parsed.name !== "string") {
+        throw new Error("A2A card is missing required name or JSONRPC endpoint fields");
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_card_fetch_end",
+        message: "fetched A2A agent card",
+        meta: { cardUrl, endpoint, name: parsed.name },
+    });
+    return parsed;
+}
+async function postJsonRpc(endpointUrl, request, fetchImpl, protocolVersion = "1.0") {
+    const response = await fetchImpl(endpointUrl, {
+        method: "POST",
+        headers: { "content-type": "application/json", "A2A-Version": protocolVersion },
+        body: JSON.stringify(request),
+    });
+    if (!response.ok) {
+        throw new Error(`A2A JSON-RPC request failed (${response.status} ${response.statusText})`);
+    }
+    return await response.json();
+}
+function methodNotFound(response) {
+    return "error" in response && response.error.code === -32601;
+}
+function senderMetadata(input) {
+    return {
+        ...(input.senderAgentId ? { senderAgentId: input.senderAgentId } : {}),
+        ...(input.senderName ? { senderName: input.senderName } : {}),
+        ...(input.senderCardUrl ? { senderCardUrl: input.senderCardUrl } : {}),
+    };
+}
+async function sendA2AMessage(input) {
+    const fetchImpl = input.fetchImpl ?? fetch;
+    const messageId = (0, node_crypto_1.randomUUID)();
+    const request = {
+        jsonrpc: "2.0",
+        id: (0, node_crypto_1.randomUUID)(),
+        method: "message/send",
+        params: {
+            message: {
+                kind: "message",
+                role: "user",
+                messageId,
+                ...(input.taskId ? { taskId: input.taskId } : {}),
+                contextId: input.sessionKey ?? "default",
+                parts: [{ kind: "text", text: input.message }],
+                metadata: senderMetadata(input),
+            },
+            ...(input.accessToken ? { accessToken: input.accessToken } : {}),
+        },
+    };
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_message_send_start",
+        message: "sending A2A message",
+        meta: { endpointUrl: input.endpointUrl, messageId },
+    });
+    let rpc = await postJsonRpc(input.endpointUrl, request, fetchImpl, "0.3");
+    if (methodNotFound(rpc)) {
+        rpc = await postJsonRpc(input.endpointUrl, {
+            ...request,
+            method: "SendMessage",
+            params: {
+                ...request.params,
+                message: {
+                    ...(request.params.message),
+                    role: "ROLE_USER",
+                },
+            },
+        }, fetchImpl);
+    }
+    if ("error" in rpc) {
+        throw new Error(`A2A error ${rpc.error.code}: ${rpc.error.message}`);
+    }
+    const result = rpc.result;
+    const task = "task" in result && result.task ? result.task : result;
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_message_send_end",
+        message: "sent A2A message",
+        meta: { endpointUrl: input.endpointUrl, messageId, taskId: task.id },
+    });
+    return task;
+}
+/**
+ * POST a pre-built friends A2A message (a `wrapInDataPart` sealed-envelope message)
+ * to a peer endpoint as a JSON-RPC `message/send`. This is the `direct`-rung wire
+ * the harness `A2ATransport` uses: friends' `sendShare` builds the sealed message and
+ * hands it to the transport, which delivers it here. Unlike `sendA2AMessage` (which
+ * builds a text part), this carries the caller's exact `message` (the sealed DataPart)
+ * untouched. Throws on a non-2xx response (transport failure).
+ */
+async function postA2AMessageEnvelope(input) {
+    const fetchImpl = input.fetchImpl ?? fetch;
+    const request = {
+        jsonrpc: "2.0",
+        id: (0, node_crypto_1.randomUUID)(),
+        method: "message/send",
+        params: { message: input.message },
+    };
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_envelope_post_start",
+        message: "posting sealed A2A message envelope (direct rung)",
+        meta: { endpointUrl: input.endpointUrl },
+    });
+    let rpc = await postJsonRpc(input.endpointUrl, request, fetchImpl, "0.3");
+    if (methodNotFound(rpc)) {
+        rpc = await postJsonRpc(input.endpointUrl, { ...request, method: "SendMessage" }, fetchImpl);
+    }
+    if ("error" in rpc) {
+        throw new Error(`A2A error ${rpc.error.code}: ${rpc.error.message}`);
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_envelope_post_end",
+        message: "posted sealed A2A message envelope",
+        meta: { endpointUrl: input.endpointUrl },
+    });
+}
+async function getA2ATask(input) {
+    const fetchImpl = input.fetchImpl ?? fetch;
+    const metadata = senderMetadata(input);
+    const request = {
+        jsonrpc: "2.0",
+        id: (0, node_crypto_1.randomUUID)(),
+        method: "tasks/get",
+        params: {
+            id: input.taskId,
+            ...(input.accessToken ? { accessToken: input.accessToken } : {}),
+            ...(Object.keys(metadata).length > 0 ? { metadata } : {}),
+        },
+    };
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_task_get",
+        message: "fetching A2A task",
+        meta: { endpointUrl: input.endpointUrl, taskId: input.taskId },
+    });
+    let rpc = await postJsonRpc(input.endpointUrl, request, fetchImpl, "0.3");
+    if (methodNotFound(rpc)) {
+        rpc = await postJsonRpc(input.endpointUrl, { ...request, method: "GetTask" }, fetchImpl);
+    }
+    if ("error" in rpc) {
+        throw new Error(`A2A error ${rpc.error.code}: ${rpc.error.message}`);
+    }
+    return rpc.result;
+}
+/**
+ * Talk to an A2A agent as a verified friend: seal `text` to the agent's card DID,
+ * signed by `identity`, send it, and open the sealed reply. The card must serve a
+ * did:key bound to it (the same check onboarding applies), so the reply can only be
+ * accepted from that key. Neither direction ever travels in plaintext.
+ */
+async function sendSealedA2AChat(input) {
+    const fetchImpl = input.fetchImpl ?? fetch;
+    const sodium = input.sodium ?? await (0, a2a_client_1.ready)();
+    const card = await fetchA2AAgentCard(input.cardUrl, fetchImpl);
+    const peerDid = cardDid(card);
+    if (!peerDid)
+        throw new Error(`A2A card ${input.cardUrl} serves no DID; sealed chat needs one`);
+    const parsed = (0, a2a_client_1.parseDidKey)(peerDid);
+    if (!parsed || !(0, a2a_client_1.verifyCardDidBinding)({ card: { did: peerDid, url: input.cardUrl }, did: peerDid, didDoc: null })) {
+        throw new Error(`A2A card↔DID binding failed for ${peerDid}`);
+    }
+    const endpointUrl = endpointForCard(card);
+    const conversationId = input.conversationId ?? (0, node_crypto_1.randomUUID)();
+    const sealed = (0, sealed_chat_1.sealChatMessage)({
+        sodium,
+        from: input.identity,
+        recipientDid: peerDid,
+        recipientEd25519Pub: parsed.ed25519Pub,
+        text: input.text,
+        conversationId,
+        ...(input.onBehalfOf ? { onBehalfOf: input.onBehalfOf } : {}),
+    });
+    const request = {
+        jsonrpc: "2.0",
+        id: (0, node_crypto_1.randomUUID)(),
+        method: "SendMessage",
+        params: { message: { kind: "message", role: "ROLE_USER", messageId: (0, node_crypto_1.randomUUID)(), contextId: conversationId, parts: sealed.parts } },
+    };
+    (0, runtime_1.emitNervesEvent)({ component: "channels", event: "channel.a2a_chat_send_start", message: "sending sealed A2A chat message", meta: { endpointUrl, peerDid } });
+    const rpc = await postJsonRpc(endpointUrl, request, fetchImpl);
+    if ("error" in rpc)
+        throw new Error(`A2A error ${rpc.error.code}: ${rpc.error.message}`);
+    const task = rpc.result;
+    const replyMessage = task?.status?.message;
+    if (!replyMessage)
+        throw new Error("A2A chat returned no reply message");
+    const opened = await (0, sealed_chat_1.openChatMessage)({ sodium, self: input.identity, message: replyMessage, senderDid: peerDid, senderEd25519Pub: parsed.ed25519Pub });
+    if (!opened.ok)
+        throw new Error(`A2A chat reply rejected: ${opened.reason}`);
+    (0, runtime_1.emitNervesEvent)({ component: "channels", event: "channel.a2a_chat_send_end", message: "received sealed A2A chat reply", meta: { endpointUrl, peerDid, taskId: task.id } });
+    return { text: opened.text, conversationId, taskId: task.id, peerDid, peerName: card.name };
+}

package/dist/a2a/config.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.A2A_DEFAULT_PATH = exports.A2A_DEFAULT_HOST = exports.A2A_DEFAULT_PROTOCOL_VERSION = void 0;
+exports.defaultA2APort = defaultA2APort;
+exports.normalizeA2APath = normalizeA2APath;
+exports.a2aEndpointFromBaseUrl = a2aEndpointFromBaseUrl;
+const node_crypto_1 = require("node:crypto");
+const runtime_1 = require("../nerves/runtime");
+exports.A2A_DEFAULT_PROTOCOL_VERSION = "1.0";
+exports.A2A_DEFAULT_HOST = "127.0.0.1";
+exports.A2A_DEFAULT_PATH = "/a2a";
+function defaultA2APort(agentName) {
+    const digest = (0, node_crypto_1.createHash)("sha256").update(agentName).digest();
+    const port = 18920 + (digest[0] % 60);
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_default_port",
+        message: "computed default A2A port",
+        meta: { agentName, port },
+    });
+    return port;
+}
+function normalizeA2APath(value) {
+    const trimmed = value?.trim();
+    const normalized = !trimmed
+        ? exports.A2A_DEFAULT_PATH
+        : trimmed.startsWith("/")
+            ? trimmed
+            : `/${trimmed}`;
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_path_normalized",
+        message: "normalized A2A path",
+        meta: { normalized },
+    });
+    return normalized;
+}
+function a2aEndpointFromBaseUrl(baseUrl, a2aPath = exports.A2A_DEFAULT_PATH) {
+    const url = new URL(baseUrl);
+    url.pathname = normalizeA2APath(a2aPath);
+    url.search = "";
+    url.hash = "";
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_endpoint_built",
+        message: "built A2A endpoint URL",
+        meta: { endpoint: url.toString() },
+    });
+    return url.toString();
+}

package/dist/a2a/delegated-command.js

@@ -0,0 +1,151 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DELEGATED_BANNER = exports.A2A_PRINCIPAL_PROFILE_ID = void 0;
+exports.delegatedCommandWasNoticed = delegatedCommandWasNoticed;
+exports.delegatedCommandNotice = delegatedCommandNotice;
+exports.admitDelegatedCommand = admitDelegatedCommand;
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../nerves/runtime");
+const replay_harness_1 = require("./replay-harness");
+const relationship_authorization_1 = require("../repertoire/relationship-authorization");
+const NOTICE_EXCERPT_CHARS = 200;
+/** The relationship profile that names the principal a delegated peer acts for. */
+exports.A2A_PRINCIPAL_PROFILE_ID = "sanctuary-owner";
+/**
+ * True when the owner was told about delegated command `commandId` in their own chat: admission only runs a command
+ * after that notice is delivered, and the Telegram effect journal keeps the notice under a key derived from the
+ * command id. A request id with no such record never came through a signed, owner-notified delegated command.
+ * A missing record is `false`; an unreadable or malformed one throws, so the caller retries instead of deciding.
+ */
+function delegatedCommandWasNoticed(agentRoot, commandId, principalFriendId, delegateFriendId) {
+    const idempotencyKey = `owner-notice:delegated:${commandId}`;
+    const file = path.join(agentRoot, "state", "telegram", "effects", `${(0, crypto_1.createHash)("sha256").update(idempotencyKey).digest("hex")}.json`);
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return delegateFriendId !== undefined && (0, replay_harness_1.isReplayWindowOpen)(agentRoot, delegateFriendId) && (0, replay_harness_1.replayNoticeRecorded)(agentRoot, `delegated:${commandId}`, delegateFriendId);
+        throw error;
+    }
+    const artifact = JSON.parse(raw);
+    return artifact.idempotencyKey === idempotencyKey && artifact.authorClass === "butler" && artifact.target?.friendId === principalFriendId;
+}
+/** Matches the banner only the server may put in front of an admitted command. */
+exports.DELEGATED_BANNER = /^\s*\[\s*delegated command/iu;
+function delegatedCommandNotice(input) {
+    const flat = input.text.replace(/\s+/gu, " ").trim();
+    const excerpt = flat.length > NOTICE_EXCERPT_CHARS ? `${flat.slice(0, NOTICE_EXCERPT_CHARS)}…` : flat;
+    return `Delegated command from you via ${input.delegateName}: "${excerpt}". If this wasn't you, say so here: it is on record, and the grant can be revoked.`;
+}
+function hasPrincipalGrant(friend) {
+    return friend.delegationGrant?.scope === "principal_commands";
+}
+async function resolvePrincipal(store, profileId) {
+    const friends = await store.listAll?.() ?? [];
+    const matches = friends.filter((friend) => friend.capabilityProfileId === profileId
+        && friend.trustLevel === "family" && friend.admissionState === "active");
+    return matches.length === 1 ? matches[0] : null;
+}
+async function admitDelegatedCommand(input) {
+    const refuse = (reason) => {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "senses",
+            event: "senses.a2a_delegated_command_refused",
+            message: "refused a delegated A2A command",
+            meta: { reason, delegateFriendId: input.friend.id, commandId: input.commandId },
+        });
+        return { ok: false, reason };
+    };
+    if (!input.options)
+        return refuse("not_enabled");
+    if (!hasPrincipalGrant(input.friend))
+        return refuse("no_grant");
+    if (input.friend.trustLevel !== "family" || input.friend.admissionState === "revoked")
+        return refuse("not_family");
+    const registry = input.registry;
+    if (!registry)
+        return refuse("principal_unresolved");
+    const principal = await resolvePrincipal(input.store, input.options.principalProfileId);
+    if (!principal || principal.id === input.friend.id)
+        return refuse("principal_unresolved");
+    const noticeId = `delegated:${input.commandId}`;
+    try {
+        const text = delegatedCommandNotice({ delegateName: input.friend.name, text: input.text });
+        const agentRoot = input.options.agentRoot;
+        if (agentRoot && (0, replay_harness_1.isReplayWindowOpen)(agentRoot, input.friend.id))
+            (0, replay_harness_1.appendReplayNotice)(agentRoot, { noticeId, text, friendId: input.friend.id });
+        else
+            await input.options.notifyPrincipal({ noticeId, text });
+    }
+    catch {
+        return refuse("notice_failed");
+    }
+    // Owner-gated tools (steward policy) bind the mutation to `requestId` on the tool
+    // context's relationship, as the Telegram owner turn does; the evaluator alone
+    // only scopes its receipts by it, so carry it on the relationship itself.
+    const relationship = {
+        ...(0, relationship_authorization_1.createRelationshipAuthorizationEvaluator)({
+            friend: principal,
+            registry,
+            requestId: input.commandId,
+            requestPhase: "inbound",
+            sessionEventId: `a2a-delegated:${input.commandId}`,
+        }),
+        requestId: input.commandId,
+    };
+    const context = {
+        principalFriendId: principal.id,
+        principalName: principal.name,
+        delegateFriendId: input.friend.id,
+        delegateName: input.friend.name,
+        delegateDid: input.did,
+        commandId: input.commandId,
+        noticeId,
+    };
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.a2a_delegated_command_admitted",
+        message: "admitted a delegated A2A command after notifying the principal",
+        meta: { delegateFriendId: context.delegateFriendId, principalFriendId: context.principalFriendId, commandId: context.commandId },
+    });
+    const turnText = `[delegated command from ${principal.name} via ${input.friend.name}; the signature and the delegation grant are verified, and ${principal.name} has been notified; act on it as ${principal.name}'s own request]\n\n${input.text}`;
+    return { ok: true, relationship, context, turnText };
+}

package/dist/a2a/delegation-stores.js

@@ -0,0 +1,56 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.delegationStoresFor = delegationStoresFor;
+const path = __importStar(require("node:path"));
+const friends_1 = require("@ouro.bot/friends");
+const runtime_1 = require("../nerves/runtime");
+function delegationStoresFor(agentRoot) {
+    const friendsDir = path.join(agentRoot, "friends");
+    const missionsDir = (0, friends_1.missionsDirFor)(friendsDir);
+    const grantsDir = (0, friends_1.grantsDirFor)(friendsDir);
+    (0, runtime_1.emitNervesEvent)({
+        component: "channels",
+        event: "channel.a2a_delegation_stores_init",
+        message: "initialized A2A delegation stores (mission + grant)",
+        meta: { missionsDir, grantsDir },
+    });
+    return {
+        missionStore: new friends_1.FileMissionStore(missionsDir),
+        grantStore: new friends_1.FileGrantStore(grantsDir),
+        missionsDir,
+        grantsDir,
+    };
+}

package/dist/a2a/did-resolution.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeDidResolution = makeDidResolution;
+const a2a_client_1 = require("@ouro.bot/friends/a2a-client");
+const runtime_1 = require("../nerves/runtime");
+/**
+ * Build the friends `DidResolution` for did:key peers. `resolveAndPin` is the
+ * verify-and-pin core the inbound bridge consumes:
+ *   parse the did:key → derive the presented Ed25519 key →
+ *     first contact (no pin under `fromAgentId`) → TOFU `pinOnFirstContact`
+ *     already pinned → `evaluateRotation` against the pin:
+ *       unchanged  → pin-hit, return the pinned key
+ *       accepted   → (re-pinned by evaluateRotation) return the NEW key
+ *       rejected   → loud security event, return null
+ *
+ * The pin is keyed by the STABLE `fromAgentId` (NOT the did:key string), so a
+ * rotation is "same `fromAgentId`, new (did, key)". An unparseable or empty DID is
+ * refused (null) and never matchable. The crypto is the friends primitives' — this
+ * only sequences them.
+ */
+function makeDidResolution(input) {
+    const { sodium, rotationProofFor } = input;
+    return {
+        async resolveAndPin(args) {
+            const { fromAgentId, did, pinStore, trustOfSource } = args;
+            // Empty DID is never a matchable key.
+            if (!did) {
+                (0, runtime_1.emitNervesEvent)({
+                    component: "channels",
+                    event: "channel.a2a_did_resolve_refused",
+                    message: "A2A DID resolve refused (empty DID)",
+                    meta: { fromAgentId, reason: "empty_did" },
+                });
+                return null;
+            }
+            const parsed = (0, a2a_client_1.parseDidKey)(did);
+            if (!parsed) {
+                (0, runtime_1.emitNervesEvent)({
+                    component: "channels",
+                    event: "channel.a2a_did_resolve_refused",
+                    message: "A2A DID resolve refused (unparseable did:key)",
+                    meta: { fromAgentId, reason: "parse_failed" },
+                });
+                return null;
+            }
+            const pinned = pinStore.get(fromAgentId);
+            if (!pinned) {
+                // First contact (TOFU): accept + pin the (did, key) under fromAgentId.
+                (0, a2a_client_1.pinOnFirstContact)({ pinStore, fromAgentId, did, ed25519Pub: parsed.ed25519Pub });
+                (0, runtime_1.emitNervesEvent)({
+                    component: "channels",
+                    event: "channel.a2a_pin_first_contact",
+                    message: "A2A DID pinned on first contact",
+                    meta: { fromAgentId, did },
+                });
+                return { ed25519Pub: parsed.ed25519Pub };
+            }
+            // Already pinned: evaluate the presented key against the pin.
+            const rotationProof = rotationProofFor?.(fromAgentId, did, parsed.ed25519Pub);
+            const decision = (0, a2a_client_1.evaluateRotation)({
+                sodium,
+                pinStore,
+                fromAgentId,
+                trustOfSource,
+                newDid: did,
+                newEd25519Pub: parsed.ed25519Pub,
+                rotationProof,
+            });
+            if (decision.decision === "unchanged") {
+                // Same key — pin-hit. (FileA2APinStore.get already emitted a2a_pin_hit.)
+                return { ed25519Pub: parsed.ed25519Pub };
+            }
+            if (decision.decision === "accepted") {
+                // evaluateRotation already re-pinned to the new key under fromAgentId.
+                (0, runtime_1.emitNervesEvent)({
+                    component: "channels",
+                    event: "channel.a2a_rotation_accepted",
+                    message: "A2A signed key rotation accepted",
+                    meta: { fromAgentId, newDid: did, trustOfSource },
+                });
+                return { ed25519Pub: parsed.ed25519Pub };
+            }
+            // Rejected — loud security signal (carries the reason).
+            (0, runtime_1.emitNervesEvent)({
+                component: "channels",
+                event: "channel.a2a_rotation_rejected",
+                message: "A2A key rotation rejected",
+                meta: { fromAgentId, newDid: did, trustOfSource, reason: decision.reason },
+            });
+            return null;
+        },
+    };
+}