@peac/mappings-a2a 0.12.1 → 0.12.2

package/dist/attach.d.ts

@@ -2,7 +2,7 @@
  * Attach PEAC evidence carriers to A2A metadata.
  *
  * Places carrier data under metadata[PEAC_EXTENSION_URI] per A2A v0.3.0
- * metadata convention (DD-128). Uses computeReceiptRef() from @peac/schema
+ * metadata convention. Uses computeReceiptRef() from @peac/schema
  * for receipt reference computation (correction item 4).
  */
 import type { PeacEvidenceCarrier, CarrierMeta } from '@peac/kernel';

package/dist/carrier.d.ts

@@ -1,7 +1,7 @@
 /**
  * A2A carrier adapter implementing CarrierAdapter<A2ATaskStatusLike, A2ATaskStatusLike>.
  *
- * Bridges PeacEvidenceCarrier to A2A TaskStatus metadata per DD-124.
+ * Bridges PeacEvidenceCarrier to A2A TaskStatus metadata per .
  */
 import type { PeacEvidenceCarrier, CarrierMeta, CarrierValidationResult, CarrierAdapter } from '@peac/kernel';
 import type { A2ATaskStatusLike } from './types';

package/dist/extract.d.ts

@@ -2,8 +2,8 @@
  * Extract PEAC evidence carriers from A2A metadata.
  *
  * Reads carrier data from metadata[PEAC_EXTENSION_URI] and validates
- * against PeacEvidenceCarrierSchema (DD-131). Provides both sync (structural)
- * and async (receipt_ref consistency) extraction paths per DD-129.
+ * against PeacEvidenceCarrierSchema. Provides both sync (structural)
+ * and async (receipt_ref consistency) extraction paths per .
  */
 import type { PeacEvidenceCarrier, CarrierMeta } from '@peac/kernel';
 import type { A2AMetadata, A2ATaskStatusLike, A2AMessageLike, A2AArtifactLike } from './types';
@@ -20,13 +20,13 @@ export interface A2AExtractAsyncResult extends A2AExtractResult {
 /**
  * Extract PEAC evidence carriers from A2A metadata (sync).
  *
- * Performs structural validation only (schema check, DD-131).
+ * Performs structural validation only (schema check).
  * Returns null if no PEAC extension data is present.
  * Silently skips carriers that fail schema validation.
  */
 export declare function extractReceiptFromMetadata(metadata: A2AMetadata): A2AExtractResult | null;
 /**
- * Extract PEAC evidence carriers from A2A metadata (async, DD-129).
+ * Extract PEAC evidence carriers from A2A metadata (async).
  *
  * Performs structural validation AND receipt_ref consistency check.
  * When receipt_jws is present, verifies sha256(receipt_jws) === receipt_ref.
@@ -35,14 +35,14 @@ export declare function extractReceiptFromMetadata(metadata: A2AMetadata): A2AEx
 export declare function extractReceiptFromMetadataAsync(metadata: A2AMetadata): Promise<A2AExtractAsyncResult | null>;
 /** Extract carriers from A2A TaskStatus (sync) */
 export declare function extractReceiptFromTaskStatus(status: A2ATaskStatusLike): A2AExtractResult | null;
-/** Extract carriers from A2A TaskStatus (async, DD-129) */
+/** Extract carriers from A2A TaskStatus (async) */
 export declare function extractReceiptFromTaskStatusAsync(status: A2ATaskStatusLike): Promise<A2AExtractAsyncResult | null>;
 /** Extract carriers from A2A Message (sync) */
 export declare function extractReceiptFromMessage(msg: A2AMessageLike): A2AExtractResult | null;
-/** Extract carriers from A2A Message (async, DD-129) */
+/** Extract carriers from A2A Message (async) */
 export declare function extractReceiptFromMessageAsync(msg: A2AMessageLike): Promise<A2AExtractAsyncResult | null>;
 /** Extract carriers from A2A Artifact (sync) */
 export declare function extractReceiptFromArtifact(artifact: A2AArtifactLike): A2AExtractResult | null;
-/** Extract carriers from A2A Artifact (async, DD-129) */
+/** Extract carriers from A2A Artifact (async) */
 export declare function extractReceiptFromArtifactAsync(artifact: A2AArtifactLike): Promise<A2AExtractAsyncResult | null>;
 //# sourceMappingURL=extract.d.ts.map

package/dist/extract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extract.d.ts","sourceRoot":"","sources":["../src/extract.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGrE,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,eAAe,EAEhB,MAAM,SAAS,CAAC;AAOjB,mCAAmC;AACnC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,IAAI,EAAE,WAAW,CAAC;CACnB;AAED,wDAAwD;AACxD,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,+DAA+D;IAC/D,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAMD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,WAAW,GAAG,gBAAgB,GAAG,IAAI,CAoCzF;AAED;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAuBvC;AAMD,kDAAkD;AAClD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,iBAAiB,GAAG,gBAAgB,GAAG,IAAI,CAG/F;AAED,2DAA2D;AAC3D,wBAAsB,iCAAiC,CACrD,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAGvC;AAED,+CAA+C;AAC/C,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,cAAc,GAAG,gBAAgB,GAAG,IAAI,CAGtF;AAED,wDAAwD;AACxD,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAGvC;AAED,gDAAgD;AAChD,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,eAAe,GAAG,gBAAgB,GAAG,IAAI,CAG7F;AAED,yDAAyD;AACzD,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAGvC"}
+{"version":3,"file":"extract.d.ts","sourceRoot":"","sources":["../src/extract.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGrE,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,eAAe,EAEhB,MAAM,SAAS,CAAC;AAOjB,mCAAmC;AACnC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,IAAI,EAAE,WAAW,CAAC;CACnB;AAED,wDAAwD;AACxD,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,+DAA+D;IAC/D,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAMD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,WAAW,GAAG,gBAAgB,GAAG,IAAI,CAoCzF;AAED;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAuBvC;AAMD,kDAAkD;AAClD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,iBAAiB,GAAG,gBAAgB,GAAG,IAAI,CAG/F;AAED,mDAAmD;AACnD,wBAAsB,iCAAiC,CACrD,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAGvC;AAED,+CAA+C;AAC/C,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,cAAc,GAAG,gBAAgB,GAAG,IAAI,CAGtF;AAED,gDAAgD;AAChD,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAGvC;AAED,gDAAgD;AAChD,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,eAAe,GAAG,gBAAgB,GAAG,IAAI,CAG7F;AAED,iDAAiD;AACjD,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAGvC"}

package/dist/header.d.ts

@@ -2,7 +2,7 @@
  * A2A extension header utilities.
  *
  * Handles the A2A-Extensions header for advertising supported extensions
- * per DD-86 (no X- prefix headers).
+ * per (no X- prefix headers).
  */
 /**
  * Parse comma-separated A2A extension URIs from header value.

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/types.ts","../src/attach.ts","../src/extract.ts","../src/carrier.ts","../src/header.ts","../src/discovery.ts"],"names":["validateCarrierConstraints","PeacEvidenceCarrierSchema","verifyReceiptRefConsistency","PEAC_RECEIPT_HEADER"],"mappings":";;;;;;AAeO,IAAM,kBAAA,GAAqB;AAG3B,IAAM,oBAAA,GAAuB;ACMpC,SAAS,cAAA,GAA8B;AACrC,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,KAAA;AAAA,IACX,MAAA,EAAQ,OAAA;AAAA,IACR,QAAA,EAAU;AAAA,GACZ;AACF;AAcO,SAAS,uBAAA,CACd,QAAA,EACA,QAAA,EACA,IAAA,EACa;AACb,EAAA,MAAM,aAAA,GAAgB,QAAQ,cAAA,EAAe;AAE7C,EAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,IAAA,MAAM,MAAA,GAASA,iCAAA,CAA2B,OAAA,EAAS,aAAa,CAAA;AAChE,IAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,MAAA,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,MAAA,CAAO,WAAW,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IACjF;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAA0B,EAAE,QAAA,EAAU,IAAA,EAAM,aAAA,EAAc;AAChE,EAAA,QAAA,CAAS,kBAAkB,CAAA,GAAI,OAAA;AAC/B,EAAA,OAAO,QAAA;AACT;AAUO,SAAS,yBAAA,CACd,MAAA,EACA,QAAA,EACA,IAAA,EACmB;AACnB,EAAA,IAAI,CAAC,OAAO,QAAA,EAAU;AACpB,IAAA,MAAA,CAAO,WAAW,EAAC;AAAA,EACrB;AACA,EAAA,uBAAA,CAAwB,MAAA,CAAO,QAAA,EAAU,QAAA,EAAU,IAAI,CAAA;AACvD,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,sBAAA,CACd,GAAA,EACA,QAAA,EACA,IAAA,EACgB;AAChB,EAAA,IAAI,CAAC,IAAI,QAAA,EAAU;AACjB,IAAA,GAAA,CAAI,WAAW,EAAC;AAAA,EAClB;AACA,EAAA,uBAAA,CAAwB,GAAA,CAAI,QAAA,EAAU,QAAA,EAAU,IAAI,CAAA;AACpD,EAAA,OAAO,GAAA;AACT;AAMO,SAAS,uBAAA,CACd,QAAA,EACA,QAAA,EACA,IAAA,EACiB;AACjB,EAAA,IAAI,CAAC,SAAS,QAAA,EAAU;AACtB,IAAA,QAAA,CAAS,WAAW,EAAC;AAAA,EACvB;AACA,EAAA,uBAAA,CAAwB,QAAA,CAAS,QAAA,EAAU,QAAA,EAAU,IAAI,CAAA;AACzD,EAAA,OAAO,QAAA;AACT;AClEO,SAAS,2BAA2B,QAAA,EAAgD;AACzF,EAAA,MAAM,GAAA,GAAM,SAAS,kBAAkB,CAAA;AACvC,EAAA,IAAI,GAAA,KAAQ,MAAA,IAAa,GAAA,KAAQ,IAAA,EAAM;AACrC,IAAA,OAAO,IAAA;AAAA,EACT;AAGA,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,EAAE,cAAe,GAAA,CAAA,EAAiB;AAC/D,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAU,GAAA;AAChB,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,OAAA,CAAQ,QAAQ,CAAA,IAAK,OAAA,CAAQ,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AACrE,IAAA,OAAO,IAAA;AAAA,EACT;AAGA,EAAA,MAAM,gBAAuC,EAAC;AAC9C,EAAA,KAAA,MAAW,OAAA,IAAW,QAAQ,QAAA,EAAU;AACtC,IAAA,MAAM,MAAA,GAASC,gCAAA,CAA0B,SAAA,CAAU,OAAO,CAAA;AAC1D,IAAA,IAAI,OAAO,OAAA,EAAS;AAClB,MAAA,aAAA,CAAc,IAAA,CAAK,OAAO,IAA2B,CAAA;AAAA,IACvD;AAAA,EACF;AAEA,EAAA,IAAI,aAAA,CAAc,WAAW,CAAA,EAAG;AAC9B,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,IAAA,GAAoB,QAAQ,IAAA,IAAQ;AAAA,IACxC,SAAA,EAAW,KAAA;AAAA,IACX,MAAA,EAAQ,OAAA;AAAA,IACR,QAAA,EAAU;AAAA,GACZ;AAEA,EAAA,OAAO,EAAE,QAAA,EAAU,aAAA,EAAe,IAAA,EAAK;AACzC;AASA,eAAsB,gCACpB,QAAA,EACuC;AACvC,EAAA,MAAM,UAAA,GAAa,2BAA2B,QAAQ,CAAA;AACtD,EAAA,IAAI,eAAe,IAAA,EAAM;AACvB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,aAAuB,EAAC;AAC9B,EAAA,MAAM,gBAAuC,EAAC;AAE9C,EAAA,KAAA,MAAW,OAAA,IAAW,WAAW,QAAA,EAAU;AACzC,IAAA,MAAM,KAAA,GAAQ,MAAMC,kCAAA,CAA4B,OAAO,CAAA;AACvD,IAAA,IAAI,UAAU,IAAA,EAAM;AAClB,MAAA,UAAA,CAAW,KAAK,KAAK,CAAA;AAAA,IACvB,CAAA,MAAO;AACL,MAAA,aAAA,CAAc,KAAK,OAAO,CAAA;AAAA,IAC5B;AAAA,EACF;AAEA,EAAA,IAAI,aAAA,CAAc,MAAA,KAAW,CAAA,IAAK,UAAA,CAAW,SAAS,CAAA,EAAG;AACvD,IAAA,OAAO,EAAE,QAAA,EAAU,IAAI,IAAA,EAAM,UAAA,CAAW,MAAM,UAAA,EAAW;AAAA,EAC3D;AAEA,EAAA,OAAO,EAAE,QAAA,EAAU,aAAA,EAAe,IAAA,EAAM,UAAA,CAAW,MAAM,UAAA,EAAW;AACtE;AAOO,SAAS,6BAA6B,MAAA,EAAoD;AAC/F,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,EAAU,OAAO,IAAA;AAC7B,EAAA,OAAO,0BAAA,CAA2B,OAAO,QAAQ,CAAA;AACnD;AAGA,eAAsB,kCACpB,MAAA,EACuC;AACvC,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,EAAU,OAAO,IAAA;AAC7B,EAAA,OAAO,+BAAA,CAAgC,OAAO,QAAQ,CAAA;AACxD;AAGO,SAAS,0BAA0B,GAAA,EAA8C;AACtF,EAAA,IAAI,CAAC,GAAA,CAAI,QAAA,EAAU,OAAO,IAAA;AAC1B,EAAA,OAAO,0BAAA,CAA2B,IAAI,QAAQ,CAAA;AAChD;AAGA,eAAsB,+BACpB,GAAA,EACuC;AACvC,EAAA,IAAI,CAAC,GAAA,CAAI,QAAA,EAAU,OAAO,IAAA;AAC1B,EAAA,OAAO,+BAAA,CAAgC,IAAI,QAAQ,CAAA;AACrD;AAGO,SAAS,2BAA2B,QAAA,EAAoD;AAC7F,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,OAAO,IAAA;AAC/B,EAAA,OAAO,0BAAA,CAA2B,SAAS,QAAQ,CAAA;AACrD;AAGA,eAAsB,gCACpB,QAAA,EACuC;AACvC,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,OAAO,IAAA;AAC/B,EAAA,OAAO,+BAAA,CAAgC,SAAS,QAAQ,CAAA;AAC1D;AC3IO,IAAM,oBAAN,MAAwF;AAAA,EAC7F,QAAQ,KAAA,EAAyF;AAC/F,IAAA,OAAO,6BAA6B,KAAK,CAAA;AAAA,EAC3C;AAAA,EAEA,MAAA,CACE,MAAA,EACA,QAAA,EACA,IAAA,EACmB;AACnB,IAAA,OAAO,yBAAA,CAA0B,MAAA,EAAQ,QAAA,EAAU,IAAI,CAAA;AAAA,EACzD;AAAA,EAEA,mBAAA,CAAoB,SAA8B,IAAA,EAA4C;AAC5F,IAAA,OAAOF,iCAAAA,CAA2B,SAAS,IAAI,CAAA;AAAA,EACjD;AACF;AAGO,SAAS,qBAAqB,SAAA,EAA+C;AAClF,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,KAAA;AAAA,IACX,MAAA,EAAQ,OAAA;AAAA,IACR,QAAA,EAAU,oBAAA;AAAA,IACV,GAAG;AAAA,GACL;AACF;;;ACrCO,SAAS,yBAAyB,MAAA,EAA0B;AACjE,EAAA,OAAO,OACJ,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,EACnB,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,CAAC,CAAA;AAC/B;AAQO,SAAS,yBAAyB,UAAA,EAA8B;AACrE,EAAA,OAAO,UAAA,CAAW,KAAK,IAAI,CAAA;AAC7B;ACRA,IAAM,oBAAoB,GAAA,GAAM,IAAA;AAGhC,IAAM,oBAAA,GAAuB,GAAA;AAG7B,IAAM,mBAAA,GAAsB;AAAA,EAC1B,QAAA;AAAA;AAAA,EACA,OAAA;AAAA;AAAA,EACA,4BAAA;AAAA;AAAA,EACA,aAAA;AAAA;AAAA,EACA,aAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA,OAAA;AAAA;AAAA,EACA,iBAAA;AAAA;AAAA,EACA,QAAA;AAAA;AAAA,EACA;AAAA;AACF,CAAA;AAkCA,SAAS,YAAY,EAAA,EAAqB;AACxC,EAAA,OAAO,oBAAoB,IAAA,CAAK,CAAC,YAAY,OAAA,CAAQ,IAAA,CAAK,EAAE,CAAC,CAAA;AAC/D;AAEA,SAAS,mBAAmB,QAAA,EAA2B;AACrD,EAAA,OAAO,QAAA,KAAa,WAAA,IAAe,QAAA,KAAa,WAAA,IAAe,QAAA,KAAa,KAAA;AAC9E;AAUA,eAAe,uBAAA,CAAwB,KAAa,OAAA,EAA0C;AAC5F,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAG1B,EAAA,IAAI,MAAA,CAAO,QAAA,IAAY,MAAA,CAAO,QAAA,EAAU;AACtC,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AAGA,EAAA,IAAI,MAAA,CAAO,aAAa,OAAA,EAAS;AAC/B,IAAA,IAAI,CAAC,OAAA,CAAQ,sBAAA,IAA0B,CAAC,kBAAA,CAAmB,MAAA,CAAO,QAAQ,CAAA,EAAG;AAC3E,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,kCAAA,EAAqC,OAAO,QAAQ,CAAA,mEAAA;AAAA,OAEtD;AAAA,IACF;AAAA,EACF,CAAA,MAAA,IAAW,MAAA,CAAO,QAAA,KAAa,QAAA,EAAU;AACvC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,MAAA,CAAO,QAAQ,CAAA,CAAE,CAAA;AAAA,EAC/D;AAGA,EAAA,IAAI,WAAA,CAAY,OAAO,QAAQ,CAAA,IAAK,CAAC,kBAAA,CAAmB,MAAA,CAAO,QAAQ,CAAA,EAAG;AACxE,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,MAAA,CAAO,QAAQ,CAAA,YAAA,CAAc,CAAA;AAAA,EAC3E;AAGA,EAAA,IAAI,QAAQ,eAAA,IAAmB,CAAC,kBAAA,CAAmB,MAAA,CAAO,QAAQ,CAAA,EAAG;AACnE,IAAA,MAAM,WAAA,GAAc,MAAM,OAAA,CAAQ,eAAA,CAAgB,OAAO,QAAQ,CAAA;AACjE,IAAA,KAAA,MAAW,MAAM,WAAA,EAAa;AAC5B,MAAA,IAAI,WAAA,CAAY,EAAE,CAAA,EAAG;AACnB,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,OAAO,QAAQ,CAAA,wBAAA,EAA2B,EAAE,CAAA,CAAE,CAAA;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;AAqBA,eAAsB,iBAAA,CACpB,OAAA,EACA,OAAA,GAA4B,EAAC,EACC;AAC9B,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC5C,EAAA,MAAM,KAAA,GAAQ,CAAC,8BAAA,EAAgC,yBAAyB,CAAA;AAExE,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,IAAA,EAAM,OAAO,EAAE,QAAA,EAAS;AAE5C,IAAA,IAAI;AACF,MAAA,MAAM,uBAAA,CAAwB,KAAK,OAAO,CAAA;AAE1C,MAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,GAAA,EAAK;AAAA,QAClC,MAAA,EAAQ,KAAA;AAAA,QACR,QAAA,EAAU,OAAA;AAAA;AAAA,QACV,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,oBAAoB;AAAA,OACjD,CAAA;AAED,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA;AAAA,MACF;AAGA,MAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC5D,MAAA,IACE,CAAC,YAAY,QAAA,CAAS,kBAAkB,KACxC,CAAC,WAAA,CAAY,KAAA,CAAM,iCAAiC,CAAA,EACpD;AACA,QAAA;AAAA,MACF;AAGA,MAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC3D,MAAA,IAAI,aAAA,IAAiB,QAAA,CAAS,aAAA,EAAe,EAAE,IAAI,iBAAA,EAAmB;AACpE,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,MAAA,IAAI,IAAA,CAAK,SAAS,iBAAA,EAAmB;AACnC,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAG5B,MAAA,IAAI,OAAO,IAAA,CAAK,IAAA,KAAS,YAAY,OAAO,IAAA,CAAK,QAAQ,QAAA,EAAU;AACjE,QAAA;AAAA,MACF;AAEA,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AAEN,MAAA;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAOO,SAAS,iBAAiB,IAAA,EAA6B;AAC5D,EAAA,MAAM,UAAA,GAAa,KAAK,YAAA,EAAc,UAAA;AACtC,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA,EAAG;AAC9B,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,UAAA,CAAW,IAAA;AAAA,IAChB,CAAC,QAAQ,OAAO,GAAA,KAAQ,YAAY,GAAA,KAAQ,IAAA,IAAQ,IAAI,GAAA,KAAQ;AAAA,GAClE;AACF;AAOO,SAAS,iBAAiB,IAAA,EAAmD;AAClF,EAAA,MAAM,UAAA,GAAa,KAAK,YAAA,EAAc,UAAA;AACtC,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA,EAAG;AAC9B,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,QAAQ,UAAA,CAAW,IAAA;AAAA,IACvB,CAAC,QAAQ,OAAO,GAAA,KAAQ,YAAY,GAAA,KAAQ,IAAA,IAAQ,IAAI,GAAA,KAAQ;AAAA,GAClE;AACA,EAAA,OAAQ,KAAA,IAAoC,IAAA;AAC9C;AA+BA,eAAsB,wBAAA,CACpB,OAAA,EACA,OAAA,GAA4B,EAAC,EACQ;AAErC,EAAA,MAAM,IAAA,GAAO,MAAM,iBAAA,CAAkB,OAAA,EAAS,OAAO,CAAA;AACrD,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,MAAM,GAAA,GAAM,iBAAiB,IAAI,CAAA;AACjC,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,YAAA;AAAA,QACR,KAAA,EAAO,GAAA,CAAI,MAAA,EAAQ,eAAA,IAAmB,CAAC,kBAAkB,CAAA;AAAA,QACzD,eAAA,EAAiB,GAAA,CAAI,MAAA,EAAQ,eAAA,IAAmB,CAAC,OAAO,CAAA;AAAA,QACxD,GAAI,GAAA,CAAI,MAAA,EAAQ,iBAAA,IAAqB;AAAA,UACnC,iBAAA,EAAmB,IAAI,MAAA,CAAO;AAAA;AAChC,OACF;AAAA,IACF;AAAA,EACF;AAGA,EAAA,MAAM,SAAA,GAAY,MAAM,qBAAA,CAAsB,OAAA,EAAS,OAAO,CAAA;AAC9D,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,OAAO,SAAA;AAAA,EACT;AAGA,EAAA,MAAM,WAAA,GAAc,MAAM,0BAAA,CAA2B,OAAA,EAAS,OAAO,CAAA;AACrE,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,OAAO,WAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA;AACT;AAKA,eAAe,qBAAA,CACb,SACA,OAAA,EACqC;AACrC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC5C,EAAA,MAAM,MAAM,IAAI,GAAA,CAAI,wBAAA,EAA0B,OAAO,EAAE,QAAA,EAAS;AAEhE,EAAA,IAAI;AACF,IAAA,MAAM,uBAAA,CAAwB,KAAK,OAAO,CAAA;AAE1C,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,GAAA,EAAK;AAAA,MAClC,MAAA,EAAQ,KAAA;AAAA,MACR,QAAA,EAAU,OAAA;AAAA,MACV,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,oBAAoB;AAAA,KACjD,CAAA;AAED,IAAA,IAAI,CAAC,QAAA,CAAS,EAAA,EAAI,OAAO,IAAA;AAEzB,IAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC5D,IAAA,IACE,CAAC,YAAY,QAAA,CAAS,kBAAkB,KACxC,CAAC,WAAA,CAAY,KAAA,CAAM,iCAAiC,CAAA,EACpD;AACA,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC3D,IAAA,IAAI,aAAA,IAAiB,QAAA,CAAS,aAAA,EAAe,EAAE,IAAI,iBAAA,EAAmB;AACpE,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,IAAI,IAAA,CAAK,MAAA,GAAS,iBAAA,EAAmB,OAAO,IAAA;AAE5C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAE5B,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,YAAA;AAAA,MACR,KAAA,EAAO,MAAM,OAAA,CAAQ,IAAA,CAAK,eAAe,CAAA,GACpC,IAAA,CAAK,eAAA,GACN,CAAC,kBAAkB,CAAA;AAAA,MACvB,eAAA,EAAiB,MAAM,OAAA,CAAQ,IAAA,CAAK,eAAe,CAAA,GAC9C,IAAA,CAAK,eAAA,GACN,CAAC,OAAO,CAAA;AAAA,MACZ,GAAI,OAAO,IAAA,CAAK,iBAAA,KAAsB,QAAA,IAAY;AAAA,QAChD,mBAAmB,IAAA,CAAK;AAAA;AAC1B,KACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAQA,eAAe,0BAAA,CACb,SACA,OAAA,EACqC;AACrC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAE5C,EAAA,IAAI;AACF,IAAA,MAAM,uBAAA,CAAwB,SAAS,OAAO,CAAA;AAE9C,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,OAAA,EAAS;AAAA,MACtC,MAAA,EAAQ,MAAA;AAAA,MACR,QAAA,EAAU,OAAA;AAAA,MACV,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,oBAAoB;AAAA,KACjD,CAAA;AAED,IAAA,MAAM,YAAY,CAAC,GAAG,SAAS,OAAA,CAAQ,IAAA,EAAM,CAAA,CAAE,IAAA;AAAA,MAC7C,CAAC,CAAA,KAAM,CAAA,CAAE,WAAA,EAAY,KAAMG,2BAAoB,WAAA;AAAY,KAC7D;AAEA,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,cAAA;AAAA,QACR,KAAA,EAAO,CAAC,kBAAkB,CAAA;AAAA,QAC1B,eAAA,EAAiB,CAAC,OAAO;AAAA,OAC3B;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,OAAO,IAAA;AACT","file":"index.cjs","sourcesContent":["/**\n * Minimal A2A types from spec v0.3.0 (DD-126).\n *\n * These types are defined locally rather than importing @a2a-js/sdk,\n * which brings protobuf + gRPC + express peer dependencies that are\n * not needed for evidence placement.\n */\n\nimport type { CarrierFormat, PeacEvidenceCarrier, CarrierMeta } from '@peac/kernel';\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/** PEAC traceability extension URI for A2A metadata */\nexport const PEAC_EXTENSION_URI = 'https://www.peacprotocol.org/ext/traceability/v1' as const;\n\n/** Maximum carrier size for A2A metadata (64 KB, DD-127) */\nexport const A2A_MAX_CARRIER_SIZE = 65_536;\n\n// ---------------------------------------------------------------------------\n// A2A Agent Card types (v0.3.0)\n// ---------------------------------------------------------------------------\n\n/** A2A extension entry in capabilities.extensions[] */\nexport interface AgentCardExtension {\n  uri: string;\n  description?: string;\n  required?: boolean;\n  params?: Record<string, unknown>;\n}\n\n/** PEAC-specific extension entry for A2A Agent Card */\nexport interface AgentCardPeacExtension {\n  uri: typeof PEAC_EXTENSION_URI;\n  description: string;\n  required: boolean;\n  params?: {\n    supported_kinds?: string[];\n    carrier_formats?: CarrierFormat[];\n    issuer_config_url?: string;\n  };\n}\n\n/** Minimal A2A Agent Card shape (v0.3.0) */\nexport interface A2AAgentCard {\n  name: string;\n  url: string;\n  capabilities?: {\n    extensions?: AgentCardExtension[];\n    [key: string]: unknown;\n  };\n  [key: string]: unknown;\n}\n\n// ---------------------------------------------------------------------------\n// A2A message types (minimal shapes)\n// ---------------------------------------------------------------------------\n\n/** A2A metadata map */\nexport type A2AMetadata = Record<string, unknown>;\n\n/** Minimal A2A TaskStatus shape */\nexport interface A2ATaskStatusLike {\n  state: string;\n  metadata?: A2AMetadata;\n  [key: string]: unknown;\n}\n\n/** Minimal A2A Message shape */\nexport interface A2AMessageLike {\n  role: string;\n  parts: unknown[];\n  metadata?: A2AMetadata;\n  [key: string]: unknown;\n}\n\n/** Minimal A2A Artifact shape */\nexport interface A2AArtifactLike {\n  artifactId: string;\n  parts: unknown[];\n  metadata?: A2AMetadata;\n  [key: string]: unknown;\n}\n\n// ---------------------------------------------------------------------------\n// Carrier payload type\n// ---------------------------------------------------------------------------\n\n/**\n * A2A carrier payload: the value stored under metadata[PEAC_EXTENSION_URI].\n *\n * Contains an array of carriers (even for single-receipt cases) and\n * optional transport metadata.\n */\nexport interface A2APeacPayload {\n  carriers: PeacEvidenceCarrier[];\n  meta?: CarrierMeta;\n}\n","/**\n * Attach PEAC evidence carriers to A2A metadata.\n *\n * Places carrier data under metadata[PEAC_EXTENSION_URI] per A2A v0.3.0\n * metadata convention (DD-128). Uses computeReceiptRef() from @peac/schema\n * for receipt reference computation (correction item 4).\n */\n\nimport type { PeacEvidenceCarrier, CarrierMeta } from '@peac/kernel';\nimport { validateCarrierConstraints } from '@peac/schema';\n\nimport type {\n  A2AMetadata,\n  A2ATaskStatusLike,\n  A2AMessageLike,\n  A2AArtifactLike,\n  A2APeacPayload,\n} from './types';\nimport { PEAC_EXTENSION_URI, A2A_MAX_CARRIER_SIZE } from './types';\n\n// ---------------------------------------------------------------------------\n// Default meta for A2A transport\n// ---------------------------------------------------------------------------\n\nfunction defaultA2AMeta(): CarrierMeta {\n  return {\n    transport: 'a2a',\n    format: 'embed',\n    max_size: A2A_MAX_CARRIER_SIZE,\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Core attach: metadata map\n// ---------------------------------------------------------------------------\n\n/**\n * Attach PEAC evidence carrier(s) to an A2A metadata map.\n *\n * Writes `metadata[PEAC_EXTENSION_URI] = { carriers: [...], meta }`.\n * Validates carrier constraints before attachment; throws on violation.\n *\n * @returns The modified metadata map (mutated in place and returned)\n */\nexport function attachReceiptToMetadata(\n  metadata: A2AMetadata,\n  carriers: PeacEvidenceCarrier[],\n  meta?: CarrierMeta\n): A2AMetadata {\n  const effectiveMeta = meta ?? defaultA2AMeta();\n\n  for (const carrier of carriers) {\n    const result = validateCarrierConstraints(carrier, effectiveMeta);\n    if (!result.valid) {\n      throw new Error(`Carrier constraint violation: ${result.violations.join('; ')}`);\n    }\n  }\n\n  const payload: A2APeacPayload = { carriers, meta: effectiveMeta };\n  metadata[PEAC_EXTENSION_URI] = payload;\n  return metadata;\n}\n\n// ---------------------------------------------------------------------------\n// Convenience: attach to A2A message types\n// ---------------------------------------------------------------------------\n\n/**\n * Attach PEAC evidence carrier(s) to an A2A TaskStatus.\n * Initializes `metadata` if absent.\n */\nexport function attachReceiptToTaskStatus(\n  status: A2ATaskStatusLike,\n  carriers: PeacEvidenceCarrier[],\n  meta?: CarrierMeta\n): A2ATaskStatusLike {\n  if (!status.metadata) {\n    status.metadata = {};\n  }\n  attachReceiptToMetadata(status.metadata, carriers, meta);\n  return status;\n}\n\n/**\n * Attach PEAC evidence carrier(s) to an A2A Message.\n * Initializes `metadata` if absent.\n */\nexport function attachReceiptToMessage(\n  msg: A2AMessageLike,\n  carriers: PeacEvidenceCarrier[],\n  meta?: CarrierMeta\n): A2AMessageLike {\n  if (!msg.metadata) {\n    msg.metadata = {};\n  }\n  attachReceiptToMetadata(msg.metadata, carriers, meta);\n  return msg;\n}\n\n/**\n * Attach PEAC evidence carrier(s) to an A2A Artifact.\n * Initializes `metadata` if absent.\n */\nexport function attachReceiptToArtifact(\n  artifact: A2AArtifactLike,\n  carriers: PeacEvidenceCarrier[],\n  meta?: CarrierMeta\n): A2AArtifactLike {\n  if (!artifact.metadata) {\n    artifact.metadata = {};\n  }\n  attachReceiptToMetadata(artifact.metadata, carriers, meta);\n  return artifact;\n}\n","/**\n * Extract PEAC evidence carriers from A2A metadata.\n *\n * Reads carrier data from metadata[PEAC_EXTENSION_URI] and validates\n * against PeacEvidenceCarrierSchema (DD-131). Provides both sync (structural)\n * and async (receipt_ref consistency) extraction paths per DD-129.\n */\n\nimport type { PeacEvidenceCarrier, CarrierMeta } from '@peac/kernel';\nimport { PeacEvidenceCarrierSchema, verifyReceiptRefConsistency } from '@peac/schema';\n\nimport type {\n  A2AMetadata,\n  A2ATaskStatusLike,\n  A2AMessageLike,\n  A2AArtifactLike,\n  A2APeacPayload,\n} from './types';\nimport { PEAC_EXTENSION_URI, A2A_MAX_CARRIER_SIZE } from './types';\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/** Result of carrier extraction */\nexport interface A2AExtractResult {\n  receipts: PeacEvidenceCarrier[];\n  meta: CarrierMeta;\n}\n\n/** Result of async extraction with consistency check */\nexport interface A2AExtractAsyncResult extends A2AExtractResult {\n  /** Consistency violations (empty if all receipts are valid) */\n  violations: string[];\n}\n\n// ---------------------------------------------------------------------------\n// Core extract: metadata map (sync, structural only)\n// ---------------------------------------------------------------------------\n\n/**\n * Extract PEAC evidence carriers from A2A metadata (sync).\n *\n * Performs structural validation only (schema check, DD-131).\n * Returns null if no PEAC extension data is present.\n * Silently skips carriers that fail schema validation.\n */\nexport function extractReceiptFromMetadata(metadata: A2AMetadata): A2AExtractResult | null {\n  const raw = metadata[PEAC_EXTENSION_URI];\n  if (raw === undefined || raw === null) {\n    return null;\n  }\n\n  // Validate payload shape\n  if (typeof raw !== 'object' || !('carriers' in (raw as object))) {\n    return null;\n  }\n\n  const payload = raw as A2APeacPayload;\n  if (!Array.isArray(payload.carriers) || payload.carriers.length === 0) {\n    return null;\n  }\n\n  // Validate each carrier against schema (DD-131: validate at extraction)\n  const validCarriers: PeacEvidenceCarrier[] = [];\n  for (const carrier of payload.carriers) {\n    const result = PeacEvidenceCarrierSchema.safeParse(carrier);\n    if (result.success) {\n      validCarriers.push(result.data as PeacEvidenceCarrier);\n    }\n  }\n\n  if (validCarriers.length === 0) {\n    return null;\n  }\n\n  const meta: CarrierMeta = payload.meta ?? {\n    transport: 'a2a',\n    format: 'embed',\n    max_size: A2A_MAX_CARRIER_SIZE,\n  };\n\n  return { receipts: validCarriers, meta };\n}\n\n/**\n * Extract PEAC evidence carriers from A2A metadata (async, DD-129).\n *\n * Performs structural validation AND receipt_ref consistency check.\n * When receipt_jws is present, verifies sha256(receipt_jws) === receipt_ref.\n * Returns violations array for any carriers that fail the consistency check.\n */\nexport async function extractReceiptFromMetadataAsync(\n  metadata: A2AMetadata\n): Promise<A2AExtractAsyncResult | null> {\n  const syncResult = extractReceiptFromMetadata(metadata);\n  if (syncResult === null) {\n    return null;\n  }\n\n  const violations: string[] = [];\n  const validCarriers: PeacEvidenceCarrier[] = [];\n\n  for (const carrier of syncResult.receipts) {\n    const error = await verifyReceiptRefConsistency(carrier);\n    if (error !== null) {\n      violations.push(error);\n    } else {\n      validCarriers.push(carrier);\n    }\n  }\n\n  if (validCarriers.length === 0 && violations.length > 0) {\n    return { receipts: [], meta: syncResult.meta, violations };\n  }\n\n  return { receipts: validCarriers, meta: syncResult.meta, violations };\n}\n\n// ---------------------------------------------------------------------------\n// Convenience: extract from A2A message types\n// ---------------------------------------------------------------------------\n\n/** Extract carriers from A2A TaskStatus (sync) */\nexport function extractReceiptFromTaskStatus(status: A2ATaskStatusLike): A2AExtractResult | null {\n  if (!status.metadata) return null;\n  return extractReceiptFromMetadata(status.metadata);\n}\n\n/** Extract carriers from A2A TaskStatus (async, DD-129) */\nexport async function extractReceiptFromTaskStatusAsync(\n  status: A2ATaskStatusLike\n): Promise<A2AExtractAsyncResult | null> {\n  if (!status.metadata) return null;\n  return extractReceiptFromMetadataAsync(status.metadata);\n}\n\n/** Extract carriers from A2A Message (sync) */\nexport function extractReceiptFromMessage(msg: A2AMessageLike): A2AExtractResult | null {\n  if (!msg.metadata) return null;\n  return extractReceiptFromMetadata(msg.metadata);\n}\n\n/** Extract carriers from A2A Message (async, DD-129) */\nexport async function extractReceiptFromMessageAsync(\n  msg: A2AMessageLike\n): Promise<A2AExtractAsyncResult | null> {\n  if (!msg.metadata) return null;\n  return extractReceiptFromMetadataAsync(msg.metadata);\n}\n\n/** Extract carriers from A2A Artifact (sync) */\nexport function extractReceiptFromArtifact(artifact: A2AArtifactLike): A2AExtractResult | null {\n  if (!artifact.metadata) return null;\n  return extractReceiptFromMetadata(artifact.metadata);\n}\n\n/** Extract carriers from A2A Artifact (async, DD-129) */\nexport async function extractReceiptFromArtifactAsync(\n  artifact: A2AArtifactLike\n): Promise<A2AExtractAsyncResult | null> {\n  if (!artifact.metadata) return null;\n  return extractReceiptFromMetadataAsync(artifact.metadata);\n}\n","/**\n * A2A carrier adapter implementing CarrierAdapter<A2ATaskStatusLike, A2ATaskStatusLike>.\n *\n * Bridges PeacEvidenceCarrier to A2A TaskStatus metadata per DD-124.\n */\n\nimport type {\n  PeacEvidenceCarrier,\n  CarrierMeta,\n  CarrierValidationResult,\n  CarrierAdapter,\n} from '@peac/kernel';\nimport { validateCarrierConstraints } from '@peac/schema';\n\nimport type { A2ATaskStatusLike } from './types';\nimport { A2A_MAX_CARRIER_SIZE } from './types';\nimport { attachReceiptToTaskStatus } from './attach';\nimport { extractReceiptFromTaskStatus } from './extract';\n\n/**\n * CarrierAdapter implementation for A2A TaskStatus messages.\n *\n * Uses metadata[PEAC_EXTENSION_URI] = { carriers: [...] } layout.\n */\nexport class A2ACarrierAdapter implements CarrierAdapter<A2ATaskStatusLike, A2ATaskStatusLike> {\n  extract(input: A2ATaskStatusLike): { receipts: PeacEvidenceCarrier[]; meta: CarrierMeta } | null {\n    return extractReceiptFromTaskStatus(input);\n  }\n\n  attach(\n    output: A2ATaskStatusLike,\n    carriers: PeacEvidenceCarrier[],\n    meta?: CarrierMeta\n  ): A2ATaskStatusLike {\n    return attachReceiptToTaskStatus(output, carriers, meta);\n  }\n\n  validateConstraints(carrier: PeacEvidenceCarrier, meta: CarrierMeta): CarrierValidationResult {\n    return validateCarrierConstraints(carrier, meta);\n  }\n}\n\n/** Default CarrierMeta for A2A transport */\nexport function createA2ACarrierMeta(overrides?: Partial<CarrierMeta>): CarrierMeta {\n  return {\n    transport: 'a2a',\n    format: 'embed',\n    max_size: A2A_MAX_CARRIER_SIZE,\n    ...overrides,\n  };\n}\n","/**\n * A2A extension header utilities.\n *\n * Handles the A2A-Extensions header for advertising supported extensions\n * per DD-86 (no X- prefix headers).\n */\n\n/**\n * Parse comma-separated A2A extension URIs from header value.\n *\n * @param header - Raw header value (e.g. \"https://example.com/ext/a, https://example.com/ext/b\")\n * @returns Array of trimmed, non-empty extension URIs\n */\nexport function parseA2AExtensionsHeader(header: string): string[] {\n  return header\n    .split(',')\n    .map((s) => s.trim())\n    .filter((s) => s.length > 0);\n}\n\n/**\n * Build comma-separated A2A-Extensions header value from URIs.\n *\n * @param extensions - Array of extension URIs\n * @returns Comma-separated header value\n */\nexport function buildA2AExtensionsHeader(extensions: string[]): string {\n  return extensions.join(', ');\n}\n","/**\n * A2A agent discovery with SSRF hardening (Polish C).\n *\n * Discovers A2A Agent Cards and checks for PEAC extension support.\n * Implements literal-IP blocking, optional DNS resolution checks,\n * scheme allowlist, userinfo rejection, response size cap,\n * content-type check, and redirect rejection.\n */\n\nimport type { CarrierFormat } from '@peac/kernel';\nimport { PEAC_RECEIPT_HEADER } from '@peac/kernel';\n\nimport type { A2AAgentCard, AgentCardPeacExtension } from './types';\nimport { PEAC_EXTENSION_URI } from './types';\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/** Maximum response body size (256 KB) */\nconst MAX_RESPONSE_SIZE = 256 * 1024;\n\n/** Request timeout in milliseconds */\nconst DISCOVERY_TIMEOUT_MS = 5_000;\n\n/** Private/reserved IP ranges (RFC 1918, RFC 4193, loopback, link-local) */\nconst PRIVATE_IP_PATTERNS = [\n  /^127\\./, // loopback\n  /^10\\./, // RFC 1918 Class A\n  /^172\\.(1[6-9]|2\\d|3[01])\\./, // RFC 1918 Class B\n  /^192\\.168\\./, // RFC 1918 Class C\n  /^169\\.254\\./, // link-local\n  /^0\\./, // current network\n  /^::1$/, // IPv6 loopback\n  /^fd[0-9a-f]{2}:/, // RFC 4193 ULA\n  /^fe80:/, // IPv6 link-local\n  /^fc[0-9a-f]{2}:/, // RFC 4193 ULA\n];\n\n// ---------------------------------------------------------------------------\n// Options\n// ---------------------------------------------------------------------------\n\n/** Discovery options */\nexport interface DiscoveryOptions {\n  /**\n   * Allow HTTP (insecure) for localhost addresses only (dev mode).\n   * Default: false (HTTPS only in production).\n   */\n  allowInsecureLocalhost?: boolean;\n\n  /** Custom fetch implementation (for testing or strict environments) */\n  fetch?: typeof globalThis.fetch;\n\n  /**\n   * Optional DNS resolver for DNS rebinding defense.\n   *\n   * When provided, discovery resolves the hostname and checks all returned\n   * IP addresses against private ranges before connecting. This provides\n   * full DNS rebinding protection.\n   *\n   * When omitted, discovery checks only literal IP addresses in the URL\n   * hostname (weaker posture, but portable across runtimes).\n   */\n  resolveHostname?: (hostname: string) => Promise<string[]>;\n}\n\n// ---------------------------------------------------------------------------\n// SSRF helpers\n// ---------------------------------------------------------------------------\n\nfunction isPrivateIP(ip: string): boolean {\n  return PRIVATE_IP_PATTERNS.some((pattern) => pattern.test(ip));\n}\n\nfunction isLocalhostAddress(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1';\n}\n\n/**\n * Validate URL scheme, hostname, and credentials for SSRF protection.\n *\n * - Only HTTPS in production (Polish C item 6)\n * - HTTP allowed only for localhost when allowInsecureLocalhost is true\n * - Rejects private IP ranges (literal check always; DNS resolution when resolver provided)\n * - Rejects URLs with userinfo (user:pass@host) to prevent confusion in allowlists\n */\nasync function validateUrlForDiscovery(url: string, options: DiscoveryOptions): Promise<void> {\n  const parsed = new URL(url);\n\n  // Reject URLs with userinfo (user:pass@host)\n  if (parsed.username || parsed.password) {\n    throw new Error('SSRF: URLs with userinfo (credentials) are not allowed');\n  }\n\n  // Scheme allowlist (Polish C item 6)\n  if (parsed.protocol === 'http:') {\n    if (!options.allowInsecureLocalhost || !isLocalhostAddress(parsed.hostname)) {\n      throw new Error(\n        `SSRF: HTTP scheme not allowed for ${parsed.hostname}. ` +\n          'Use HTTPS or enable allowInsecureLocalhost for local development.'\n      );\n    }\n  } else if (parsed.protocol !== 'https:') {\n    throw new Error(`SSRF: unsupported scheme ${parsed.protocol}`);\n  }\n\n  // Check for private IP in hostname (literal IP check)\n  if (isPrivateIP(parsed.hostname) && !isLocalhostAddress(parsed.hostname)) {\n    throw new Error(`SSRF: private IP address ${parsed.hostname} not allowed`);\n  }\n\n  // DNS rebinding defense: resolve hostname and check all IPs (when resolver provided)\n  if (options.resolveHostname && !isLocalhostAddress(parsed.hostname)) {\n    const resolvedIPs = await options.resolveHostname(parsed.hostname);\n    for (const ip of resolvedIPs) {\n      if (isPrivateIP(ip)) {\n        throw new Error(`SSRF: hostname ${parsed.hostname} resolved to private IP ${ip}`);\n      }\n    }\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Core discovery\n// ---------------------------------------------------------------------------\n\n/**\n * Discover A2A Agent Card from a base URL.\n *\n * Tries `/.well-known/agent-card.json` first, then `/.well-known/agent.json`\n * as a legacy fallback per A2A v0.3.0.\n *\n * SSRF protection per Polish C:\n * 1. Private IP blocking (literal check; DNS resolution when resolveHostname provided)\n * 2. Response size cap (256 KB)\n * 3. Content-Type check (application/json)\n * 4. Redirect rejection (redirect: \"error\")\n * 5. Timeout (5 seconds)\n * 6. Scheme allowlist (HTTPS only; HTTP for localhost dev only)\n * 7. Userinfo rejection (no credentials in URLs)\n */\nexport async function discoverAgentCard(\n  baseUrl: string,\n  options: DiscoveryOptions = {}\n): Promise<A2AAgentCard | null> {\n  const fetchFn = options.fetch ?? globalThis.fetch;\n  const paths = ['/.well-known/agent-card.json', '/.well-known/agent.json'];\n\n  for (const path of paths) {\n    const url = new URL(path, baseUrl).toString();\n\n    try {\n      await validateUrlForDiscovery(url, options);\n\n      const response = await fetchFn(url, {\n        method: 'GET',\n        redirect: 'error', // Polish C item 4\n        signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),\n      });\n\n      if (!response.ok) {\n        continue;\n      }\n\n      // Content-Type check (Polish C item 3)\n      const contentType = response.headers.get('content-type') ?? '';\n      if (\n        !contentType.includes('application/json') &&\n        !contentType.match(/application\\/[a-z0-9.+-]*\\+json/)\n      ) {\n        continue;\n      }\n\n      // Response size cap (Polish C item 2)\n      const contentLength = response.headers.get('content-length');\n      if (contentLength && parseInt(contentLength, 10) > MAX_RESPONSE_SIZE) {\n        continue;\n      }\n\n      const text = await response.text();\n      if (text.length > MAX_RESPONSE_SIZE) {\n        continue;\n      }\n\n      const card = JSON.parse(text) as A2AAgentCard;\n\n      // Basic validation: must have name and url\n      if (typeof card.name !== 'string' || typeof card.url !== 'string') {\n        continue;\n      }\n\n      return card;\n    } catch {\n      // SSRF validation errors, network errors, parse errors: try next path\n      continue;\n    }\n  }\n\n  return null;\n}\n\n/**\n * Check if an A2A Agent Card advertises PEAC extension support.\n *\n * Looks for the PEAC extension URI in capabilities.extensions[].\n */\nexport function hasPeacExtension(card: A2AAgentCard): boolean {\n  const extensions = card.capabilities?.extensions;\n  if (!Array.isArray(extensions)) {\n    return false;\n  }\n  return extensions.some(\n    (ext) => typeof ext === 'object' && ext !== null && ext.uri === PEAC_EXTENSION_URI\n  );\n}\n\n/**\n * Extract PEAC extension parameters from an A2A Agent Card.\n *\n * Returns the PEAC extension entry or null if not present.\n */\nexport function getPeacExtension(card: A2AAgentCard): AgentCardPeacExtension | null {\n  const extensions = card.capabilities?.extensions;\n  if (!Array.isArray(extensions)) {\n    return null;\n  }\n  const entry = extensions.find(\n    (ext) => typeof ext === 'object' && ext !== null && ext.uri === PEAC_EXTENSION_URI\n  );\n  return (entry as AgentCardPeacExtension) ?? null;\n}\n\n// ---------------------------------------------------------------------------\n// PEAC discovery result\n// ---------------------------------------------------------------------------\n\n/** Source of PEAC capability discovery */\nexport type PeacDiscoverySource = 'agent_card' | 'well_known' | 'header_probe';\n\n/** Result of PEAC capability discovery */\nexport interface PeacDiscoveryResult {\n  source: PeacDiscoverySource;\n  kinds: string[];\n  carrier_formats: CarrierFormat[];\n  issuer_config_url?: string;\n}\n\n// ---------------------------------------------------------------------------\n// 3-step discovery (DD-110)\n// ---------------------------------------------------------------------------\n\n/**\n * Discover PEAC capabilities from a base URL using a 3-step algorithm:\n *\n * 1. Agent Card: check `/.well-known/agent-card.json` for PEAC extension\n * 2. Well-known: check `/.well-known/peac.json` (standalone PEAC discovery)\n * 3. Header probe: HEAD request to base URL, check for `PEAC-Receipt` header\n *\n * Returns the first successful result or null if PEAC is not supported.\n * All steps apply SSRF protections per Polish C.\n */\nexport async function discoverPeacCapabilities(\n  baseUrl: string,\n  options: DiscoveryOptions = {}\n): Promise<PeacDiscoveryResult | null> {\n  // Step 1: Agent Card\n  const card = await discoverAgentCard(baseUrl, options);\n  if (card) {\n    const ext = getPeacExtension(card);\n    if (ext) {\n      return {\n        source: 'agent_card',\n        kinds: ext.params?.supported_kinds ?? ['peac-receipt/0.1'],\n        carrier_formats: ext.params?.carrier_formats ?? ['embed'],\n        ...(ext.params?.issuer_config_url && {\n          issuer_config_url: ext.params.issuer_config_url,\n        }),\n      };\n    }\n  }\n\n  // Step 2: /.well-known/peac.json\n  const wellKnown = await discoverPeacWellKnown(baseUrl, options);\n  if (wellKnown) {\n    return wellKnown;\n  }\n\n  // Step 3: Header probe\n  const headerProbe = await discoverPeacViaHeaderProbe(baseUrl, options);\n  if (headerProbe) {\n    return headerProbe;\n  }\n\n  return null;\n}\n\n/**\n * Step 2: Discover PEAC support via `/.well-known/peac.json`.\n */\nasync function discoverPeacWellKnown(\n  baseUrl: string,\n  options: DiscoveryOptions\n): Promise<PeacDiscoveryResult | null> {\n  const fetchFn = options.fetch ?? globalThis.fetch;\n  const url = new URL('/.well-known/peac.json', baseUrl).toString();\n\n  try {\n    await validateUrlForDiscovery(url, options);\n\n    const response = await fetchFn(url, {\n      method: 'GET',\n      redirect: 'error',\n      signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),\n    });\n\n    if (!response.ok) return null;\n\n    const contentType = response.headers.get('content-type') ?? '';\n    if (\n      !contentType.includes('application/json') &&\n      !contentType.match(/application\\/[a-z0-9.+-]*\\+json/)\n    ) {\n      return null;\n    }\n\n    const contentLength = response.headers.get('content-length');\n    if (contentLength && parseInt(contentLength, 10) > MAX_RESPONSE_SIZE) {\n      return null;\n    }\n\n    const text = await response.text();\n    if (text.length > MAX_RESPONSE_SIZE) return null;\n\n    const data = JSON.parse(text) as Record<string, unknown>;\n\n    return {\n      source: 'well_known',\n      kinds: Array.isArray(data.supported_kinds)\n        ? (data.supported_kinds as string[])\n        : ['peac-receipt/0.1'],\n      carrier_formats: Array.isArray(data.carrier_formats)\n        ? (data.carrier_formats as CarrierFormat[])\n        : ['embed'],\n      ...(typeof data.issuer_config_url === 'string' && {\n        issuer_config_url: data.issuer_config_url,\n      }),\n    };\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Step 3: Discover PEAC support via header probe.\n *\n * Sends a HEAD request and checks for the presence of a PEAC-Receipt header.\n * This is a lightweight probe; it indicates support but provides minimal detail.\n */\nasync function discoverPeacViaHeaderProbe(\n  baseUrl: string,\n  options: DiscoveryOptions\n): Promise<PeacDiscoveryResult | null> {\n  const fetchFn = options.fetch ?? globalThis.fetch;\n\n  try {\n    await validateUrlForDiscovery(baseUrl, options);\n\n    const response = await fetchFn(baseUrl, {\n      method: 'HEAD',\n      redirect: 'error',\n      signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),\n    });\n\n    const headerKey = [...response.headers.keys()].find(\n      (k) => k.toLowerCase() === PEAC_RECEIPT_HEADER.toLowerCase()\n    );\n\n    if (headerKey) {\n      return {\n        source: 'header_probe',\n        kinds: ['peac-receipt/0.1'],\n        carrier_formats: ['embed'],\n      };\n    }\n  } catch {\n    // Network errors, SSRF: no PEAC support detected\n  }\n\n  return null;\n}\n"]}
+{"version":3,"sources":["../src/types.ts","../src/attach.ts","../src/extract.ts","../src/carrier.ts","../src/header.ts","../src/discovery.ts"],"names":["validateCarrierConstraints","PeacEvidenceCarrierSchema","verifyReceiptRefConsistency","PEAC_RECEIPT_HEADER"],"mappings":";;;;;;AAeO,IAAM,kBAAA,GAAqB;AAG3B,IAAM,oBAAA,GAAuB;ACMpC,SAAS,cAAA,GAA8B;AACrC,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,KAAA;AAAA,IACX,MAAA,EAAQ,OAAA;AAAA,IACR,QAAA,EAAU;AAAA,GACZ;AACF;AAcO,SAAS,uBAAA,CACd,QAAA,EACA,QAAA,EACA,IAAA,EACa;AACb,EAAA,MAAM,aAAA,GAAgB,QAAQ,cAAA,EAAe;AAE7C,EAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,IAAA,MAAM,MAAA,GAASA,iCAAA,CAA2B,OAAA,EAAS,aAAa,CAAA;AAChE,IAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,MAAA,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,MAAA,CAAO,WAAW,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IACjF;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAA0B,EAAE,QAAA,EAAU,IAAA,EAAM,aAAA,EAAc;AAChE,EAAA,QAAA,CAAS,kBAAkB,CAAA,GAAI,OAAA;AAC/B,EAAA,OAAO,QAAA;AACT;AAUO,SAAS,yBAAA,CACd,MAAA,EACA,QAAA,EACA,IAAA,EACmB;AACnB,EAAA,IAAI,CAAC,OAAO,QAAA,EAAU;AACpB,IAAA,MAAA,CAAO,WAAW,EAAC;AAAA,EACrB;AACA,EAAA,uBAAA,CAAwB,MAAA,CAAO,QAAA,EAAU,QAAA,EAAU,IAAI,CAAA;AACvD,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,sBAAA,CACd,GAAA,EACA,QAAA,EACA,IAAA,EACgB;AAChB,EAAA,IAAI,CAAC,IAAI,QAAA,EAAU;AACjB,IAAA,GAAA,CAAI,WAAW,EAAC;AAAA,EAClB;AACA,EAAA,uBAAA,CAAwB,GAAA,CAAI,QAAA,EAAU,QAAA,EAAU,IAAI,CAAA;AACpD,EAAA,OAAO,GAAA;AACT;AAMO,SAAS,uBAAA,CACd,QAAA,EACA,QAAA,EACA,IAAA,EACiB;AACjB,EAAA,IAAI,CAAC,SAAS,QAAA,EAAU;AACtB,IAAA,QAAA,CAAS,WAAW,EAAC;AAAA,EACvB;AACA,EAAA,uBAAA,CAAwB,QAAA,CAAS,QAAA,EAAU,QAAA,EAAU,IAAI,CAAA;AACzD,EAAA,OAAO,QAAA;AACT;AClEO,SAAS,2BAA2B,QAAA,EAAgD;AACzF,EAAA,MAAM,GAAA,GAAM,SAAS,kBAAkB,CAAA;AACvC,EAAA,IAAI,GAAA,KAAQ,MAAA,IAAa,GAAA,KAAQ,IAAA,EAAM;AACrC,IAAA,OAAO,IAAA;AAAA,EACT;AAGA,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,EAAE,cAAe,GAAA,CAAA,EAAiB;AAC/D,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAU,GAAA;AAChB,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,OAAA,CAAQ,QAAQ,CAAA,IAAK,OAAA,CAAQ,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AACrE,IAAA,OAAO,IAAA;AAAA,EACT;AAGA,EAAA,MAAM,gBAAuC,EAAC;AAC9C,EAAA,KAAA,MAAW,OAAA,IAAW,QAAQ,QAAA,EAAU;AACtC,IAAA,MAAM,MAAA,GAASC,gCAAA,CAA0B,SAAA,CAAU,OAAO,CAAA;AAC1D,IAAA,IAAI,OAAO,OAAA,EAAS;AAClB,MAAA,aAAA,CAAc,IAAA,CAAK,OAAO,IAA2B,CAAA;AAAA,IACvD;AAAA,EACF;AAEA,EAAA,IAAI,aAAA,CAAc,WAAW,CAAA,EAAG;AAC9B,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,IAAA,GAAoB,QAAQ,IAAA,IAAQ;AAAA,IACxC,SAAA,EAAW,KAAA;AAAA,IACX,MAAA,EAAQ,OAAA;AAAA,IACR,QAAA,EAAU;AAAA,GACZ;AAEA,EAAA,OAAO,EAAE,QAAA,EAAU,aAAA,EAAe,IAAA,EAAK;AACzC;AASA,eAAsB,gCACpB,QAAA,EACuC;AACvC,EAAA,MAAM,UAAA,GAAa,2BAA2B,QAAQ,CAAA;AACtD,EAAA,IAAI,eAAe,IAAA,EAAM;AACvB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,aAAuB,EAAC;AAC9B,EAAA,MAAM,gBAAuC,EAAC;AAE9C,EAAA,KAAA,MAAW,OAAA,IAAW,WAAW,QAAA,EAAU;AACzC,IAAA,MAAM,KAAA,GAAQ,MAAMC,kCAAA,CAA4B,OAAO,CAAA;AACvD,IAAA,IAAI,UAAU,IAAA,EAAM;AAClB,MAAA,UAAA,CAAW,KAAK,KAAK,CAAA;AAAA,IACvB,CAAA,MAAO;AACL,MAAA,aAAA,CAAc,KAAK,OAAO,CAAA;AAAA,IAC5B;AAAA,EACF;AAEA,EAAA,IAAI,aAAA,CAAc,MAAA,KAAW,CAAA,IAAK,UAAA,CAAW,SAAS,CAAA,EAAG;AACvD,IAAA,OAAO,EAAE,QAAA,EAAU,IAAI,IAAA,EAAM,UAAA,CAAW,MAAM,UAAA,EAAW;AAAA,EAC3D;AAEA,EAAA,OAAO,EAAE,QAAA,EAAU,aAAA,EAAe,IAAA,EAAM,UAAA,CAAW,MAAM,UAAA,EAAW;AACtE;AAOO,SAAS,6BAA6B,MAAA,EAAoD;AAC/F,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,EAAU,OAAO,IAAA;AAC7B,EAAA,OAAO,0BAAA,CAA2B,OAAO,QAAQ,CAAA;AACnD;AAGA,eAAsB,kCACpB,MAAA,EACuC;AACvC,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,EAAU,OAAO,IAAA;AAC7B,EAAA,OAAO,+BAAA,CAAgC,OAAO,QAAQ,CAAA;AACxD;AAGO,SAAS,0BAA0B,GAAA,EAA8C;AACtF,EAAA,IAAI,CAAC,GAAA,CAAI,QAAA,EAAU,OAAO,IAAA;AAC1B,EAAA,OAAO,0BAAA,CAA2B,IAAI,QAAQ,CAAA;AAChD;AAGA,eAAsB,+BACpB,GAAA,EACuC;AACvC,EAAA,IAAI,CAAC,GAAA,CAAI,QAAA,EAAU,OAAO,IAAA;AAC1B,EAAA,OAAO,+BAAA,CAAgC,IAAI,QAAQ,CAAA;AACrD;AAGO,SAAS,2BAA2B,QAAA,EAAoD;AAC7F,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,OAAO,IAAA;AAC/B,EAAA,OAAO,0BAAA,CAA2B,SAAS,QAAQ,CAAA;AACrD;AAGA,eAAsB,gCACpB,QAAA,EACuC;AACvC,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,OAAO,IAAA;AAC/B,EAAA,OAAO,+BAAA,CAAgC,SAAS,QAAQ,CAAA;AAC1D;AC3IO,IAAM,oBAAN,MAAwF;AAAA,EAC7F,QAAQ,KAAA,EAAyF;AAC/F,IAAA,OAAO,6BAA6B,KAAK,CAAA;AAAA,EAC3C;AAAA,EAEA,MAAA,CACE,MAAA,EACA,QAAA,EACA,IAAA,EACmB;AACnB,IAAA,OAAO,yBAAA,CAA0B,MAAA,EAAQ,QAAA,EAAU,IAAI,CAAA;AAAA,EACzD;AAAA,EAEA,mBAAA,CAAoB,SAA8B,IAAA,EAA4C;AAC5F,IAAA,OAAOF,iCAAAA,CAA2B,SAAS,IAAI,CAAA;AAAA,EACjD;AACF;AAGO,SAAS,qBAAqB,SAAA,EAA+C;AAClF,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,KAAA;AAAA,IACX,MAAA,EAAQ,OAAA;AAAA,IACR,QAAA,EAAU,oBAAA;AAAA,IACV,GAAG;AAAA,GACL;AACF;;;ACrCO,SAAS,yBAAyB,MAAA,EAA0B;AACjE,EAAA,OAAO,OACJ,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,EACnB,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,CAAC,CAAA;AAC/B;AAQO,SAAS,yBAAyB,UAAA,EAA8B;AACrE,EAAA,OAAO,UAAA,CAAW,KAAK,IAAI,CAAA;AAC7B;ACRA,IAAM,oBAAoB,GAAA,GAAM,IAAA;AAGhC,IAAM,oBAAA,GAAuB,GAAA;AAG7B,IAAM,mBAAA,GAAsB;AAAA,EAC1B,QAAA;AAAA;AAAA,EACA,OAAA;AAAA;AAAA,EACA,4BAAA;AAAA;AAAA,EACA,aAAA;AAAA;AAAA,EACA,aAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA,OAAA;AAAA;AAAA,EACA,iBAAA;AAAA;AAAA,EACA,QAAA;AAAA;AAAA,EACA;AAAA;AACF,CAAA;AAkCA,SAAS,YAAY,EAAA,EAAqB;AACxC,EAAA,OAAO,oBAAoB,IAAA,CAAK,CAAC,YAAY,OAAA,CAAQ,IAAA,CAAK,EAAE,CAAC,CAAA;AAC/D;AAEA,SAAS,mBAAmB,QAAA,EAA2B;AACrD,EAAA,OAAO,QAAA,KAAa,WAAA,IAAe,QAAA,KAAa,WAAA,IAAe,QAAA,KAAa,KAAA;AAC9E;AAUA,eAAe,uBAAA,CAAwB,KAAa,OAAA,EAA0C;AAC5F,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAG1B,EAAA,IAAI,MAAA,CAAO,QAAA,IAAY,MAAA,CAAO,QAAA,EAAU;AACtC,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AAGA,EAAA,IAAI,MAAA,CAAO,aAAa,OAAA,EAAS;AAC/B,IAAA,IAAI,CAAC,OAAA,CAAQ,sBAAA,IAA0B,CAAC,kBAAA,CAAmB,MAAA,CAAO,QAAQ,CAAA,EAAG;AAC3E,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,kCAAA,EAAqC,OAAO,QAAQ,CAAA,mEAAA;AAAA,OAEtD;AAAA,IACF;AAAA,EACF,CAAA,MAAA,IAAW,MAAA,CAAO,QAAA,KAAa,QAAA,EAAU;AACvC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,MAAA,CAAO,QAAQ,CAAA,CAAE,CAAA;AAAA,EAC/D;AAGA,EAAA,IAAI,WAAA,CAAY,OAAO,QAAQ,CAAA,IAAK,CAAC,kBAAA,CAAmB,MAAA,CAAO,QAAQ,CAAA,EAAG;AACxE,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,MAAA,CAAO,QAAQ,CAAA,YAAA,CAAc,CAAA;AAAA,EAC3E;AAGA,EAAA,IAAI,QAAQ,eAAA,IAAmB,CAAC,kBAAA,CAAmB,MAAA,CAAO,QAAQ,CAAA,EAAG;AACnE,IAAA,MAAM,WAAA,GAAc,MAAM,OAAA,CAAQ,eAAA,CAAgB,OAAO,QAAQ,CAAA;AACjE,IAAA,KAAA,MAAW,MAAM,WAAA,EAAa;AAC5B,MAAA,IAAI,WAAA,CAAY,EAAE,CAAA,EAAG;AACnB,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,OAAO,QAAQ,CAAA,wBAAA,EAA2B,EAAE,CAAA,CAAE,CAAA;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;AAqBA,eAAsB,iBAAA,CACpB,OAAA,EACA,OAAA,GAA4B,EAAC,EACC;AAC9B,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC5C,EAAA,MAAM,KAAA,GAAQ,CAAC,8BAAA,EAAgC,yBAAyB,CAAA;AAExE,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,IAAA,EAAM,OAAO,EAAE,QAAA,EAAS;AAE5C,IAAA,IAAI;AACF,MAAA,MAAM,uBAAA,CAAwB,KAAK,OAAO,CAAA;AAE1C,MAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,GAAA,EAAK;AAAA,QAClC,MAAA,EAAQ,KAAA;AAAA,QACR,QAAA,EAAU,OAAA;AAAA;AAAA,QACV,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,oBAAoB;AAAA,OACjD,CAAA;AAED,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA;AAAA,MACF;AAGA,MAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC5D,MAAA,IACE,CAAC,YAAY,QAAA,CAAS,kBAAkB,KACxC,CAAC,WAAA,CAAY,KAAA,CAAM,iCAAiC,CAAA,EACpD;AACA,QAAA;AAAA,MACF;AAGA,MAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC3D,MAAA,IAAI,aAAA,IAAiB,QAAA,CAAS,aAAA,EAAe,EAAE,IAAI,iBAAA,EAAmB;AACpE,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,MAAA,IAAI,IAAA,CAAK,SAAS,iBAAA,EAAmB;AACnC,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAG5B,MAAA,IAAI,OAAO,IAAA,CAAK,IAAA,KAAS,YAAY,OAAO,IAAA,CAAK,QAAQ,QAAA,EAAU;AACjE,QAAA;AAAA,MACF;AAEA,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AAEN,MAAA;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAOO,SAAS,iBAAiB,IAAA,EAA6B;AAC5D,EAAA,MAAM,UAAA,GAAa,KAAK,YAAA,EAAc,UAAA;AACtC,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA,EAAG;AAC9B,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,UAAA,CAAW,IAAA;AAAA,IAChB,CAAC,QAAQ,OAAO,GAAA,KAAQ,YAAY,GAAA,KAAQ,IAAA,IAAQ,IAAI,GAAA,KAAQ;AAAA,GAClE;AACF;AAOO,SAAS,iBAAiB,IAAA,EAAmD;AAClF,EAAA,MAAM,UAAA,GAAa,KAAK,YAAA,EAAc,UAAA;AACtC,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA,EAAG;AAC9B,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,QAAQ,UAAA,CAAW,IAAA;AAAA,IACvB,CAAC,QAAQ,OAAO,GAAA,KAAQ,YAAY,GAAA,KAAQ,IAAA,IAAQ,IAAI,GAAA,KAAQ;AAAA,GAClE;AACA,EAAA,OAAQ,KAAA,IAAoC,IAAA;AAC9C;AA+BA,eAAsB,wBAAA,CACpB,OAAA,EACA,OAAA,GAA4B,EAAC,EACQ;AAErC,EAAA,MAAM,IAAA,GAAO,MAAM,iBAAA,CAAkB,OAAA,EAAS,OAAO,CAAA;AACrD,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,MAAM,GAAA,GAAM,iBAAiB,IAAI,CAAA;AACjC,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,YAAA;AAAA,QACR,KAAA,EAAO,GAAA,CAAI,MAAA,EAAQ,eAAA,IAAmB,CAAC,kBAAkB,CAAA;AAAA,QACzD,eAAA,EAAiB,GAAA,CAAI,MAAA,EAAQ,eAAA,IAAmB,CAAC,OAAO,CAAA;AAAA,QACxD,GAAI,GAAA,CAAI,MAAA,EAAQ,iBAAA,IAAqB;AAAA,UACnC,iBAAA,EAAmB,IAAI,MAAA,CAAO;AAAA;AAChC,OACF;AAAA,IACF;AAAA,EACF;AAGA,EAAA,MAAM,SAAA,GAAY,MAAM,qBAAA,CAAsB,OAAA,EAAS,OAAO,CAAA;AAC9D,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,OAAO,SAAA;AAAA,EACT;AAGA,EAAA,MAAM,WAAA,GAAc,MAAM,0BAAA,CAA2B,OAAA,EAAS,OAAO,CAAA;AACrE,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,OAAO,WAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA;AACT;AAKA,eAAe,qBAAA,CACb,SACA,OAAA,EACqC;AACrC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC5C,EAAA,MAAM,MAAM,IAAI,GAAA,CAAI,wBAAA,EAA0B,OAAO,EAAE,QAAA,EAAS;AAEhE,EAAA,IAAI;AACF,IAAA,MAAM,uBAAA,CAAwB,KAAK,OAAO,CAAA;AAE1C,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,GAAA,EAAK;AAAA,MAClC,MAAA,EAAQ,KAAA;AAAA,MACR,QAAA,EAAU,OAAA;AAAA,MACV,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,oBAAoB;AAAA,KACjD,CAAA;AAED,IAAA,IAAI,CAAC,QAAA,CAAS,EAAA,EAAI,OAAO,IAAA;AAEzB,IAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC5D,IAAA,IACE,CAAC,YAAY,QAAA,CAAS,kBAAkB,KACxC,CAAC,WAAA,CAAY,KAAA,CAAM,iCAAiC,CAAA,EACpD;AACA,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC3D,IAAA,IAAI,aAAA,IAAiB,QAAA,CAAS,aAAA,EAAe,EAAE,IAAI,iBAAA,EAAmB;AACpE,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,IAAI,IAAA,CAAK,MAAA,GAAS,iBAAA,EAAmB,OAAO,IAAA;AAE5C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAE5B,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,YAAA;AAAA,MACR,KAAA,EAAO,MAAM,OAAA,CAAQ,IAAA,CAAK,eAAe,CAAA,GACpC,IAAA,CAAK,eAAA,GACN,CAAC,kBAAkB,CAAA;AAAA,MACvB,eAAA,EAAiB,MAAM,OAAA,CAAQ,IAAA,CAAK,eAAe,CAAA,GAC9C,IAAA,CAAK,eAAA,GACN,CAAC,OAAO,CAAA;AAAA,MACZ,GAAI,OAAO,IAAA,CAAK,iBAAA,KAAsB,QAAA,IAAY;AAAA,QAChD,mBAAmB,IAAA,CAAK;AAAA;AAC1B,KACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAQA,eAAe,0BAAA,CACb,SACA,OAAA,EACqC;AACrC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAE5C,EAAA,IAAI;AACF,IAAA,MAAM,uBAAA,CAAwB,SAAS,OAAO,CAAA;AAE9C,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,OAAA,EAAS;AAAA,MACtC,MAAA,EAAQ,MAAA;AAAA,MACR,QAAA,EAAU,OAAA;AAAA,MACV,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,oBAAoB;AAAA,KACjD,CAAA;AAED,IAAA,MAAM,YAAY,CAAC,GAAG,SAAS,OAAA,CAAQ,IAAA,EAAM,CAAA,CAAE,IAAA;AAAA,MAC7C,CAAC,CAAA,KAAM,CAAA,CAAE,WAAA,EAAY,KAAMG,2BAAoB,WAAA;AAAY,KAC7D;AAEA,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,cAAA;AAAA,QACR,KAAA,EAAO,CAAC,kBAAkB,CAAA;AAAA,QAC1B,eAAA,EAAiB,CAAC,OAAO;AAAA,OAC3B;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,OAAO,IAAA;AACT","file":"index.cjs","sourcesContent":["/**\n * Minimal A2A types from spec v0.3.0.\n *\n * These types are defined locally rather than importing @a2a-js/sdk,\n * which brings protobuf + gRPC + express peer dependencies that are\n * not needed for evidence placement.\n */\n\nimport type { CarrierFormat, PeacEvidenceCarrier, CarrierMeta } from '@peac/kernel';\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/** PEAC traceability extension URI for A2A metadata */\nexport const PEAC_EXTENSION_URI = 'https://www.peacprotocol.org/ext/traceability/v1' as const;\n\n/** Maximum carrier size for A2A metadata (64 KB) */\nexport const A2A_MAX_CARRIER_SIZE = 65_536;\n\n// ---------------------------------------------------------------------------\n// A2A Agent Card types (v0.3.0)\n// ---------------------------------------------------------------------------\n\n/** A2A extension entry in capabilities.extensions[] */\nexport interface AgentCardExtension {\n  uri: string;\n  description?: string;\n  required?: boolean;\n  params?: Record<string, unknown>;\n}\n\n/** PEAC-specific extension entry for A2A Agent Card */\nexport interface AgentCardPeacExtension {\n  uri: typeof PEAC_EXTENSION_URI;\n  description: string;\n  required: boolean;\n  params?: {\n    supported_kinds?: string[];\n    carrier_formats?: CarrierFormat[];\n    issuer_config_url?: string;\n  };\n}\n\n/** Minimal A2A Agent Card shape (v0.3.0) */\nexport interface A2AAgentCard {\n  name: string;\n  url: string;\n  capabilities?: {\n    extensions?: AgentCardExtension[];\n    [key: string]: unknown;\n  };\n  [key: string]: unknown;\n}\n\n// ---------------------------------------------------------------------------\n// A2A message types (minimal shapes)\n// ---------------------------------------------------------------------------\n\n/** A2A metadata map */\nexport type A2AMetadata = Record<string, unknown>;\n\n/** Minimal A2A TaskStatus shape */\nexport interface A2ATaskStatusLike {\n  state: string;\n  metadata?: A2AMetadata;\n  [key: string]: unknown;\n}\n\n/** Minimal A2A Message shape */\nexport interface A2AMessageLike {\n  role: string;\n  parts: unknown[];\n  metadata?: A2AMetadata;\n  [key: string]: unknown;\n}\n\n/** Minimal A2A Artifact shape */\nexport interface A2AArtifactLike {\n  artifactId: string;\n  parts: unknown[];\n  metadata?: A2AMetadata;\n  [key: string]: unknown;\n}\n\n// ---------------------------------------------------------------------------\n// Carrier payload type\n// ---------------------------------------------------------------------------\n\n/**\n * A2A carrier payload: the value stored under metadata[PEAC_EXTENSION_URI].\n *\n * Contains an array of carriers (even for single-receipt cases) and\n * optional transport metadata.\n */\nexport interface A2APeacPayload {\n  carriers: PeacEvidenceCarrier[];\n  meta?: CarrierMeta;\n}\n","/**\n * Attach PEAC evidence carriers to A2A metadata.\n *\n * Places carrier data under metadata[PEAC_EXTENSION_URI] per A2A v0.3.0\n * metadata convention. Uses computeReceiptRef() from @peac/schema\n * for receipt reference computation (correction item 4).\n */\n\nimport type { PeacEvidenceCarrier, CarrierMeta } from '@peac/kernel';\nimport { validateCarrierConstraints } from '@peac/schema';\n\nimport type {\n  A2AMetadata,\n  A2ATaskStatusLike,\n  A2AMessageLike,\n  A2AArtifactLike,\n  A2APeacPayload,\n} from './types';\nimport { PEAC_EXTENSION_URI, A2A_MAX_CARRIER_SIZE } from './types';\n\n// ---------------------------------------------------------------------------\n// Default meta for A2A transport\n// ---------------------------------------------------------------------------\n\nfunction defaultA2AMeta(): CarrierMeta {\n  return {\n    transport: 'a2a',\n    format: 'embed',\n    max_size: A2A_MAX_CARRIER_SIZE,\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Core attach: metadata map\n// ---------------------------------------------------------------------------\n\n/**\n * Attach PEAC evidence carrier(s) to an A2A metadata map.\n *\n * Writes `metadata[PEAC_EXTENSION_URI] = { carriers: [...], meta }`.\n * Validates carrier constraints before attachment; throws on violation.\n *\n * @returns The modified metadata map (mutated in place and returned)\n */\nexport function attachReceiptToMetadata(\n  metadata: A2AMetadata,\n  carriers: PeacEvidenceCarrier[],\n  meta?: CarrierMeta\n): A2AMetadata {\n  const effectiveMeta = meta ?? defaultA2AMeta();\n\n  for (const carrier of carriers) {\n    const result = validateCarrierConstraints(carrier, effectiveMeta);\n    if (!result.valid) {\n      throw new Error(`Carrier constraint violation: ${result.violations.join('; ')}`);\n    }\n  }\n\n  const payload: A2APeacPayload = { carriers, meta: effectiveMeta };\n  metadata[PEAC_EXTENSION_URI] = payload;\n  return metadata;\n}\n\n// ---------------------------------------------------------------------------\n// Convenience: attach to A2A message types\n// ---------------------------------------------------------------------------\n\n/**\n * Attach PEAC evidence carrier(s) to an A2A TaskStatus.\n * Initializes `metadata` if absent.\n */\nexport function attachReceiptToTaskStatus(\n  status: A2ATaskStatusLike,\n  carriers: PeacEvidenceCarrier[],\n  meta?: CarrierMeta\n): A2ATaskStatusLike {\n  if (!status.metadata) {\n    status.metadata = {};\n  }\n  attachReceiptToMetadata(status.metadata, carriers, meta);\n  return status;\n}\n\n/**\n * Attach PEAC evidence carrier(s) to an A2A Message.\n * Initializes `metadata` if absent.\n */\nexport function attachReceiptToMessage(\n  msg: A2AMessageLike,\n  carriers: PeacEvidenceCarrier[],\n  meta?: CarrierMeta\n): A2AMessageLike {\n  if (!msg.metadata) {\n    msg.metadata = {};\n  }\n  attachReceiptToMetadata(msg.metadata, carriers, meta);\n  return msg;\n}\n\n/**\n * Attach PEAC evidence carrier(s) to an A2A Artifact.\n * Initializes `metadata` if absent.\n */\nexport function attachReceiptToArtifact(\n  artifact: A2AArtifactLike,\n  carriers: PeacEvidenceCarrier[],\n  meta?: CarrierMeta\n): A2AArtifactLike {\n  if (!artifact.metadata) {\n    artifact.metadata = {};\n  }\n  attachReceiptToMetadata(artifact.metadata, carriers, meta);\n  return artifact;\n}\n","/**\n * Extract PEAC evidence carriers from A2A metadata.\n *\n * Reads carrier data from metadata[PEAC_EXTENSION_URI] and validates\n * against PeacEvidenceCarrierSchema. Provides both sync (structural)\n * and async (receipt_ref consistency) extraction paths per .\n */\n\nimport type { PeacEvidenceCarrier, CarrierMeta } from '@peac/kernel';\nimport { PeacEvidenceCarrierSchema, verifyReceiptRefConsistency } from '@peac/schema';\n\nimport type {\n  A2AMetadata,\n  A2ATaskStatusLike,\n  A2AMessageLike,\n  A2AArtifactLike,\n  A2APeacPayload,\n} from './types';\nimport { PEAC_EXTENSION_URI, A2A_MAX_CARRIER_SIZE } from './types';\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/** Result of carrier extraction */\nexport interface A2AExtractResult {\n  receipts: PeacEvidenceCarrier[];\n  meta: CarrierMeta;\n}\n\n/** Result of async extraction with consistency check */\nexport interface A2AExtractAsyncResult extends A2AExtractResult {\n  /** Consistency violations (empty if all receipts are valid) */\n  violations: string[];\n}\n\n// ---------------------------------------------------------------------------\n// Core extract: metadata map (sync, structural only)\n// ---------------------------------------------------------------------------\n\n/**\n * Extract PEAC evidence carriers from A2A metadata (sync).\n *\n * Performs structural validation only (schema check).\n * Returns null if no PEAC extension data is present.\n * Silently skips carriers that fail schema validation.\n */\nexport function extractReceiptFromMetadata(metadata: A2AMetadata): A2AExtractResult | null {\n  const raw = metadata[PEAC_EXTENSION_URI];\n  if (raw === undefined || raw === null) {\n    return null;\n  }\n\n  // Validate payload shape\n  if (typeof raw !== 'object' || !('carriers' in (raw as object))) {\n    return null;\n  }\n\n  const payload = raw as A2APeacPayload;\n  if (!Array.isArray(payload.carriers) || payload.carriers.length === 0) {\n    return null;\n  }\n\n  // Validate each carrier against schema (validate at extraction)\n  const validCarriers: PeacEvidenceCarrier[] = [];\n  for (const carrier of payload.carriers) {\n    const result = PeacEvidenceCarrierSchema.safeParse(carrier);\n    if (result.success) {\n      validCarriers.push(result.data as PeacEvidenceCarrier);\n    }\n  }\n\n  if (validCarriers.length === 0) {\n    return null;\n  }\n\n  const meta: CarrierMeta = payload.meta ?? {\n    transport: 'a2a',\n    format: 'embed',\n    max_size: A2A_MAX_CARRIER_SIZE,\n  };\n\n  return { receipts: validCarriers, meta };\n}\n\n/**\n * Extract PEAC evidence carriers from A2A metadata (async).\n *\n * Performs structural validation AND receipt_ref consistency check.\n * When receipt_jws is present, verifies sha256(receipt_jws) === receipt_ref.\n * Returns violations array for any carriers that fail the consistency check.\n */\nexport async function extractReceiptFromMetadataAsync(\n  metadata: A2AMetadata\n): Promise<A2AExtractAsyncResult | null> {\n  const syncResult = extractReceiptFromMetadata(metadata);\n  if (syncResult === null) {\n    return null;\n  }\n\n  const violations: string[] = [];\n  const validCarriers: PeacEvidenceCarrier[] = [];\n\n  for (const carrier of syncResult.receipts) {\n    const error = await verifyReceiptRefConsistency(carrier);\n    if (error !== null) {\n      violations.push(error);\n    } else {\n      validCarriers.push(carrier);\n    }\n  }\n\n  if (validCarriers.length === 0 && violations.length > 0) {\n    return { receipts: [], meta: syncResult.meta, violations };\n  }\n\n  return { receipts: validCarriers, meta: syncResult.meta, violations };\n}\n\n// ---------------------------------------------------------------------------\n// Convenience: extract from A2A message types\n// ---------------------------------------------------------------------------\n\n/** Extract carriers from A2A TaskStatus (sync) */\nexport function extractReceiptFromTaskStatus(status: A2ATaskStatusLike): A2AExtractResult | null {\n  if (!status.metadata) return null;\n  return extractReceiptFromMetadata(status.metadata);\n}\n\n/** Extract carriers from A2A TaskStatus (async) */\nexport async function extractReceiptFromTaskStatusAsync(\n  status: A2ATaskStatusLike\n): Promise<A2AExtractAsyncResult | null> {\n  if (!status.metadata) return null;\n  return extractReceiptFromMetadataAsync(status.metadata);\n}\n\n/** Extract carriers from A2A Message (sync) */\nexport function extractReceiptFromMessage(msg: A2AMessageLike): A2AExtractResult | null {\n  if (!msg.metadata) return null;\n  return extractReceiptFromMetadata(msg.metadata);\n}\n\n/** Extract carriers from A2A Message (async) */\nexport async function extractReceiptFromMessageAsync(\n  msg: A2AMessageLike\n): Promise<A2AExtractAsyncResult | null> {\n  if (!msg.metadata) return null;\n  return extractReceiptFromMetadataAsync(msg.metadata);\n}\n\n/** Extract carriers from A2A Artifact (sync) */\nexport function extractReceiptFromArtifact(artifact: A2AArtifactLike): A2AExtractResult | null {\n  if (!artifact.metadata) return null;\n  return extractReceiptFromMetadata(artifact.metadata);\n}\n\n/** Extract carriers from A2A Artifact (async) */\nexport async function extractReceiptFromArtifactAsync(\n  artifact: A2AArtifactLike\n): Promise<A2AExtractAsyncResult | null> {\n  if (!artifact.metadata) return null;\n  return extractReceiptFromMetadataAsync(artifact.metadata);\n}\n","/**\n * A2A carrier adapter implementing CarrierAdapter<A2ATaskStatusLike, A2ATaskStatusLike>.\n *\n * Bridges PeacEvidenceCarrier to A2A TaskStatus metadata per .\n */\n\nimport type {\n  PeacEvidenceCarrier,\n  CarrierMeta,\n  CarrierValidationResult,\n  CarrierAdapter,\n} from '@peac/kernel';\nimport { validateCarrierConstraints } from '@peac/schema';\n\nimport type { A2ATaskStatusLike } from './types';\nimport { A2A_MAX_CARRIER_SIZE } from './types';\nimport { attachReceiptToTaskStatus } from './attach';\nimport { extractReceiptFromTaskStatus } from './extract';\n\n/**\n * CarrierAdapter implementation for A2A TaskStatus messages.\n *\n * Uses metadata[PEAC_EXTENSION_URI] = { carriers: [...] } layout.\n */\nexport class A2ACarrierAdapter implements CarrierAdapter<A2ATaskStatusLike, A2ATaskStatusLike> {\n  extract(input: A2ATaskStatusLike): { receipts: PeacEvidenceCarrier[]; meta: CarrierMeta } | null {\n    return extractReceiptFromTaskStatus(input);\n  }\n\n  attach(\n    output: A2ATaskStatusLike,\n    carriers: PeacEvidenceCarrier[],\n    meta?: CarrierMeta\n  ): A2ATaskStatusLike {\n    return attachReceiptToTaskStatus(output, carriers, meta);\n  }\n\n  validateConstraints(carrier: PeacEvidenceCarrier, meta: CarrierMeta): CarrierValidationResult {\n    return validateCarrierConstraints(carrier, meta);\n  }\n}\n\n/** Default CarrierMeta for A2A transport */\nexport function createA2ACarrierMeta(overrides?: Partial<CarrierMeta>): CarrierMeta {\n  return {\n    transport: 'a2a',\n    format: 'embed',\n    max_size: A2A_MAX_CARRIER_SIZE,\n    ...overrides,\n  };\n}\n","/**\n * A2A extension header utilities.\n *\n * Handles the A2A-Extensions header for advertising supported extensions\n * per (no X- prefix headers).\n */\n\n/**\n * Parse comma-separated A2A extension URIs from header value.\n *\n * @param header - Raw header value (e.g. \"https://example.com/ext/a, https://example.com/ext/b\")\n * @returns Array of trimmed, non-empty extension URIs\n */\nexport function parseA2AExtensionsHeader(header: string): string[] {\n  return header\n    .split(',')\n    .map((s) => s.trim())\n    .filter((s) => s.length > 0);\n}\n\n/**\n * Build comma-separated A2A-Extensions header value from URIs.\n *\n * @param extensions - Array of extension URIs\n * @returns Comma-separated header value\n */\nexport function buildA2AExtensionsHeader(extensions: string[]): string {\n  return extensions.join(', ');\n}\n","/**\n * A2A agent discovery with SSRF hardening (Polish C).\n *\n * Discovers A2A Agent Cards and checks for PEAC extension support.\n * Implements literal-IP blocking, optional DNS resolution checks,\n * scheme allowlist, userinfo rejection, response size cap,\n * content-type check, and redirect rejection.\n */\n\nimport type { CarrierFormat } from '@peac/kernel';\nimport { PEAC_RECEIPT_HEADER } from '@peac/kernel';\n\nimport type { A2AAgentCard, AgentCardPeacExtension } from './types';\nimport { PEAC_EXTENSION_URI } from './types';\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/** Maximum response body size (256 KB) */\nconst MAX_RESPONSE_SIZE = 256 * 1024;\n\n/** Request timeout in milliseconds */\nconst DISCOVERY_TIMEOUT_MS = 5_000;\n\n/** Private/reserved IP ranges (RFC 1918, RFC 4193, loopback, link-local) */\nconst PRIVATE_IP_PATTERNS = [\n  /^127\\./, // loopback\n  /^10\\./, // RFC 1918 Class A\n  /^172\\.(1[6-9]|2\\d|3[01])\\./, // RFC 1918 Class B\n  /^192\\.168\\./, // RFC 1918 Class C\n  /^169\\.254\\./, // link-local\n  /^0\\./, // current network\n  /^::1$/, // IPv6 loopback\n  /^fd[0-9a-f]{2}:/, // RFC 4193 ULA\n  /^fe80:/, // IPv6 link-local\n  /^fc[0-9a-f]{2}:/, // RFC 4193 ULA\n];\n\n// ---------------------------------------------------------------------------\n// Options\n// ---------------------------------------------------------------------------\n\n/** Discovery options */\nexport interface DiscoveryOptions {\n  /**\n   * Allow HTTP (insecure) for localhost addresses only (dev mode).\n   * Default: false (HTTPS only in production).\n   */\n  allowInsecureLocalhost?: boolean;\n\n  /** Custom fetch implementation (for testing or strict environments) */\n  fetch?: typeof globalThis.fetch;\n\n  /**\n   * Optional DNS resolver for DNS rebinding defense.\n   *\n   * When provided, discovery resolves the hostname and checks all returned\n   * IP addresses against private ranges before connecting. This provides\n   * full DNS rebinding protection.\n   *\n   * When omitted, discovery checks only literal IP addresses in the URL\n   * hostname (weaker posture, but portable across runtimes).\n   */\n  resolveHostname?: (hostname: string) => Promise<string[]>;\n}\n\n// ---------------------------------------------------------------------------\n// SSRF helpers\n// ---------------------------------------------------------------------------\n\nfunction isPrivateIP(ip: string): boolean {\n  return PRIVATE_IP_PATTERNS.some((pattern) => pattern.test(ip));\n}\n\nfunction isLocalhostAddress(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1';\n}\n\n/**\n * Validate URL scheme, hostname, and credentials for SSRF protection.\n *\n * - Only HTTPS in production (Polish C item 6)\n * - HTTP allowed only for localhost when allowInsecureLocalhost is true\n * - Rejects private IP ranges (literal check always; DNS resolution when resolver provided)\n * - Rejects URLs with userinfo (user:pass@host) to prevent confusion in allowlists\n */\nasync function validateUrlForDiscovery(url: string, options: DiscoveryOptions): Promise<void> {\n  const parsed = new URL(url);\n\n  // Reject URLs with userinfo (user:pass@host)\n  if (parsed.username || parsed.password) {\n    throw new Error('SSRF: URLs with userinfo (credentials) are not allowed');\n  }\n\n  // Scheme allowlist (Polish C item 6)\n  if (parsed.protocol === 'http:') {\n    if (!options.allowInsecureLocalhost || !isLocalhostAddress(parsed.hostname)) {\n      throw new Error(\n        `SSRF: HTTP scheme not allowed for ${parsed.hostname}. ` +\n          'Use HTTPS or enable allowInsecureLocalhost for local development.'\n      );\n    }\n  } else if (parsed.protocol !== 'https:') {\n    throw new Error(`SSRF: unsupported scheme ${parsed.protocol}`);\n  }\n\n  // Check for private IP in hostname (literal IP check)\n  if (isPrivateIP(parsed.hostname) && !isLocalhostAddress(parsed.hostname)) {\n    throw new Error(`SSRF: private IP address ${parsed.hostname} not allowed`);\n  }\n\n  // DNS rebinding defense: resolve hostname and check all IPs (when resolver provided)\n  if (options.resolveHostname && !isLocalhostAddress(parsed.hostname)) {\n    const resolvedIPs = await options.resolveHostname(parsed.hostname);\n    for (const ip of resolvedIPs) {\n      if (isPrivateIP(ip)) {\n        throw new Error(`SSRF: hostname ${parsed.hostname} resolved to private IP ${ip}`);\n      }\n    }\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Core discovery\n// ---------------------------------------------------------------------------\n\n/**\n * Discover A2A Agent Card from a base URL.\n *\n * Tries `/.well-known/agent-card.json` first, then `/.well-known/agent.json`\n * as a legacy fallback per A2A v0.3.0.\n *\n * SSRF protection per Polish C:\n * 1. Private IP blocking (literal check; DNS resolution when resolveHostname provided)\n * 2. Response size cap (256 KB)\n * 3. Content-Type check (application/json)\n * 4. Redirect rejection (redirect: \"error\")\n * 5. Timeout (5 seconds)\n * 6. Scheme allowlist (HTTPS only; HTTP for localhost dev only)\n * 7. Userinfo rejection (no credentials in URLs)\n */\nexport async function discoverAgentCard(\n  baseUrl: string,\n  options: DiscoveryOptions = {}\n): Promise<A2AAgentCard | null> {\n  const fetchFn = options.fetch ?? globalThis.fetch;\n  const paths = ['/.well-known/agent-card.json', '/.well-known/agent.json'];\n\n  for (const path of paths) {\n    const url = new URL(path, baseUrl).toString();\n\n    try {\n      await validateUrlForDiscovery(url, options);\n\n      const response = await fetchFn(url, {\n        method: 'GET',\n        redirect: 'error', // Polish C item 4\n        signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),\n      });\n\n      if (!response.ok) {\n        continue;\n      }\n\n      // Content-Type check (Polish C item 3)\n      const contentType = response.headers.get('content-type') ?? '';\n      if (\n        !contentType.includes('application/json') &&\n        !contentType.match(/application\\/[a-z0-9.+-]*\\+json/)\n      ) {\n        continue;\n      }\n\n      // Response size cap (Polish C item 2)\n      const contentLength = response.headers.get('content-length');\n      if (contentLength && parseInt(contentLength, 10) > MAX_RESPONSE_SIZE) {\n        continue;\n      }\n\n      const text = await response.text();\n      if (text.length > MAX_RESPONSE_SIZE) {\n        continue;\n      }\n\n      const card = JSON.parse(text) as A2AAgentCard;\n\n      // Basic validation: must have name and url\n      if (typeof card.name !== 'string' || typeof card.url !== 'string') {\n        continue;\n      }\n\n      return card;\n    } catch {\n      // SSRF validation errors, network errors, parse errors: try next path\n      continue;\n    }\n  }\n\n  return null;\n}\n\n/**\n * Check if an A2A Agent Card advertises PEAC extension support.\n *\n * Looks for the PEAC extension URI in capabilities.extensions[].\n */\nexport function hasPeacExtension(card: A2AAgentCard): boolean {\n  const extensions = card.capabilities?.extensions;\n  if (!Array.isArray(extensions)) {\n    return false;\n  }\n  return extensions.some(\n    (ext) => typeof ext === 'object' && ext !== null && ext.uri === PEAC_EXTENSION_URI\n  );\n}\n\n/**\n * Extract PEAC extension parameters from an A2A Agent Card.\n *\n * Returns the PEAC extension entry or null if not present.\n */\nexport function getPeacExtension(card: A2AAgentCard): AgentCardPeacExtension | null {\n  const extensions = card.capabilities?.extensions;\n  if (!Array.isArray(extensions)) {\n    return null;\n  }\n  const entry = extensions.find(\n    (ext) => typeof ext === 'object' && ext !== null && ext.uri === PEAC_EXTENSION_URI\n  );\n  return (entry as AgentCardPeacExtension) ?? null;\n}\n\n// ---------------------------------------------------------------------------\n// PEAC discovery result\n// ---------------------------------------------------------------------------\n\n/** Source of PEAC capability discovery */\nexport type PeacDiscoverySource = 'agent_card' | 'well_known' | 'header_probe';\n\n/** Result of PEAC capability discovery */\nexport interface PeacDiscoveryResult {\n  source: PeacDiscoverySource;\n  kinds: string[];\n  carrier_formats: CarrierFormat[];\n  issuer_config_url?: string;\n}\n\n// ---------------------------------------------------------------------------\n// 3-step discovery\n// ---------------------------------------------------------------------------\n\n/**\n * Discover PEAC capabilities from a base URL using a 3-step algorithm:\n *\n * 1. Agent Card: check `/.well-known/agent-card.json` for PEAC extension\n * 2. Well-known: check `/.well-known/peac.json` (standalone PEAC discovery)\n * 3. Header probe: HEAD request to base URL, check for `PEAC-Receipt` header\n *\n * Returns the first successful result or null if PEAC is not supported.\n * All steps apply SSRF protections per Polish C.\n */\nexport async function discoverPeacCapabilities(\n  baseUrl: string,\n  options: DiscoveryOptions = {}\n): Promise<PeacDiscoveryResult | null> {\n  // Step 1: Agent Card\n  const card = await discoverAgentCard(baseUrl, options);\n  if (card) {\n    const ext = getPeacExtension(card);\n    if (ext) {\n      return {\n        source: 'agent_card',\n        kinds: ext.params?.supported_kinds ?? ['peac-receipt/0.1'],\n        carrier_formats: ext.params?.carrier_formats ?? ['embed'],\n        ...(ext.params?.issuer_config_url && {\n          issuer_config_url: ext.params.issuer_config_url,\n        }),\n      };\n    }\n  }\n\n  // Step 2: /.well-known/peac.json\n  const wellKnown = await discoverPeacWellKnown(baseUrl, options);\n  if (wellKnown) {\n    return wellKnown;\n  }\n\n  // Step 3: Header probe\n  const headerProbe = await discoverPeacViaHeaderProbe(baseUrl, options);\n  if (headerProbe) {\n    return headerProbe;\n  }\n\n  return null;\n}\n\n/**\n * Step 2: Discover PEAC support via `/.well-known/peac.json`.\n */\nasync function discoverPeacWellKnown(\n  baseUrl: string,\n  options: DiscoveryOptions\n): Promise<PeacDiscoveryResult | null> {\n  const fetchFn = options.fetch ?? globalThis.fetch;\n  const url = new URL('/.well-known/peac.json', baseUrl).toString();\n\n  try {\n    await validateUrlForDiscovery(url, options);\n\n    const response = await fetchFn(url, {\n      method: 'GET',\n      redirect: 'error',\n      signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),\n    });\n\n    if (!response.ok) return null;\n\n    const contentType = response.headers.get('content-type') ?? '';\n    if (\n      !contentType.includes('application/json') &&\n      !contentType.match(/application\\/[a-z0-9.+-]*\\+json/)\n    ) {\n      return null;\n    }\n\n    const contentLength = response.headers.get('content-length');\n    if (contentLength && parseInt(contentLength, 10) > MAX_RESPONSE_SIZE) {\n      return null;\n    }\n\n    const text = await response.text();\n    if (text.length > MAX_RESPONSE_SIZE) return null;\n\n    const data = JSON.parse(text) as Record<string, unknown>;\n\n    return {\n      source: 'well_known',\n      kinds: Array.isArray(data.supported_kinds)\n        ? (data.supported_kinds as string[])\n        : ['peac-receipt/0.1'],\n      carrier_formats: Array.isArray(data.carrier_formats)\n        ? (data.carrier_formats as CarrierFormat[])\n        : ['embed'],\n      ...(typeof data.issuer_config_url === 'string' && {\n        issuer_config_url: data.issuer_config_url,\n      }),\n    };\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Step 3: Discover PEAC support via header probe.\n *\n * Sends a HEAD request and checks for the presence of a PEAC-Receipt header.\n * This is a lightweight probe; it indicates support but provides minimal detail.\n */\nasync function discoverPeacViaHeaderProbe(\n  baseUrl: string,\n  options: DiscoveryOptions\n): Promise<PeacDiscoveryResult | null> {\n  const fetchFn = options.fetch ?? globalThis.fetch;\n\n  try {\n    await validateUrlForDiscovery(baseUrl, options);\n\n    const response = await fetchFn(baseUrl, {\n      method: 'HEAD',\n      redirect: 'error',\n      signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),\n    });\n\n    const headerKey = [...response.headers.keys()].find(\n      (k) => k.toLowerCase() === PEAC_RECEIPT_HEADER.toLowerCase()\n    );\n\n    if (headerKey) {\n      return {\n        source: 'header_probe',\n        kinds: ['peac-receipt/0.1'],\n        carrier_formats: ['embed'],\n      };\n    }\n  } catch {\n    // Network errors, SSRF: no PEAC support detected\n  }\n\n  return null;\n}\n"]}

package/dist/index.d.ts

@@ -3,7 +3,7 @@
  *
  * Agent-to-Agent Protocol (A2A) integration for PEAC.
  * Maps PEAC evidence carriers to A2A metadata (TaskStatus, Message, Artifact)
- * per A2A spec v0.3.0 (DD-126, DD-128).
+ * per A2A spec v0.3.0.
  */
 export type { AgentCardExtension, AgentCardPeacExtension, A2AAgentCard, A2AMetadata, A2ATaskStatusLike, A2AMessageLike, A2AArtifactLike, A2APeacPayload, } from './types';
 export { PEAC_EXTENSION_URI, A2A_MAX_CARRIER_SIZE } from './types';

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/types.ts","../src/attach.ts","../src/extract.ts","../src/carrier.ts","../src/header.ts","../src/discovery.ts"],"names":["validateCarrierConstraints"],"mappings":";;;;AAeO,IAAM,kBAAA,GAAqB;AAG3B,IAAM,oBAAA,GAAuB;ACMpC,SAAS,cAAA,GAA8B;AACrC,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,KAAA;AAAA,IACX,MAAA,EAAQ,OAAA;AAAA,IACR,QAAA,EAAU;AAAA,GACZ;AACF;AAcO,SAAS,uBAAA,CACd,QAAA,EACA,QAAA,EACA,IAAA,EACa;AACb,EAAA,MAAM,aAAA,GAAgB,QAAQ,cAAA,EAAe;AAE7C,EAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,IAAA,MAAM,MAAA,GAAS,0BAAA,CAA2B,OAAA,EAAS,aAAa,CAAA;AAChE,IAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,MAAA,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,MAAA,CAAO,WAAW,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IACjF;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAA0B,EAAE,QAAA,EAAU,IAAA,EAAM,aAAA,EAAc;AAChE,EAAA,QAAA,CAAS,kBAAkB,CAAA,GAAI,OAAA;AAC/B,EAAA,OAAO,QAAA;AACT;AAUO,SAAS,yBAAA,CACd,MAAA,EACA,QAAA,EACA,IAAA,EACmB;AACnB,EAAA,IAAI,CAAC,OAAO,QAAA,EAAU;AACpB,IAAA,MAAA,CAAO,WAAW,EAAC;AAAA,EACrB;AACA,EAAA,uBAAA,CAAwB,MAAA,CAAO,QAAA,EAAU,QAAA,EAAU,IAAI,CAAA;AACvD,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,sBAAA,CACd,GAAA,EACA,QAAA,EACA,IAAA,EACgB;AAChB,EAAA,IAAI,CAAC,IAAI,QAAA,EAAU;AACjB,IAAA,GAAA,CAAI,WAAW,EAAC;AAAA,EAClB;AACA,EAAA,uBAAA,CAAwB,GAAA,CAAI,QAAA,EAAU,QAAA,EAAU,IAAI,CAAA;AACpD,EAAA,OAAO,GAAA;AACT;AAMO,SAAS,uBAAA,CACd,QAAA,EACA,QAAA,EACA,IAAA,EACiB;AACjB,EAAA,IAAI,CAAC,SAAS,QAAA,EAAU;AACtB,IAAA,QAAA,CAAS,WAAW,EAAC;AAAA,EACvB;AACA,EAAA,uBAAA,CAAwB,QAAA,CAAS,QAAA,EAAU,QAAA,EAAU,IAAI,CAAA;AACzD,EAAA,OAAO,QAAA;AACT;AClEO,SAAS,2BAA2B,QAAA,EAAgD;AACzF,EAAA,MAAM,GAAA,GAAM,SAAS,kBAAkB,CAAA;AACvC,EAAA,IAAI,GAAA,KAAQ,MAAA,IAAa,GAAA,KAAQ,IAAA,EAAM;AACrC,IAAA,OAAO,IAAA;AAAA,EACT;AAGA,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,EAAE,cAAe,GAAA,CAAA,EAAiB;AAC/D,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAU,GAAA;AAChB,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,OAAA,CAAQ,QAAQ,CAAA,IAAK,OAAA,CAAQ,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AACrE,IAAA,OAAO,IAAA;AAAA,EACT;AAGA,EAAA,MAAM,gBAAuC,EAAC;AAC9C,EAAA,KAAA,MAAW,OAAA,IAAW,QAAQ,QAAA,EAAU;AACtC,IAAA,MAAM,MAAA,GAAS,yBAAA,CAA0B,SAAA,CAAU,OAAO,CAAA;AAC1D,IAAA,IAAI,OAAO,OAAA,EAAS;AAClB,MAAA,aAAA,CAAc,IAAA,CAAK,OAAO,IAA2B,CAAA;AAAA,IACvD;AAAA,EACF;AAEA,EAAA,IAAI,aAAA,CAAc,WAAW,CAAA,EAAG;AAC9B,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,IAAA,GAAoB,QAAQ,IAAA,IAAQ;AAAA,IACxC,SAAA,EAAW,KAAA;AAAA,IACX,MAAA,EAAQ,OAAA;AAAA,IACR,QAAA,EAAU;AAAA,GACZ;AAEA,EAAA,OAAO,EAAE,QAAA,EAAU,aAAA,EAAe,IAAA,EAAK;AACzC;AASA,eAAsB,gCACpB,QAAA,EACuC;AACvC,EAAA,MAAM,UAAA,GAAa,2BAA2B,QAAQ,CAAA;AACtD,EAAA,IAAI,eAAe,IAAA,EAAM;AACvB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,aAAuB,EAAC;AAC9B,EAAA,MAAM,gBAAuC,EAAC;AAE9C,EAAA,KAAA,MAAW,OAAA,IAAW,WAAW,QAAA,EAAU;AACzC,IAAA,MAAM,KAAA,GAAQ,MAAM,2BAAA,CAA4B,OAAO,CAAA;AACvD,IAAA,IAAI,UAAU,IAAA,EAAM;AAClB,MAAA,UAAA,CAAW,KAAK,KAAK,CAAA;AAAA,IACvB,CAAA,MAAO;AACL,MAAA,aAAA,CAAc,KAAK,OAAO,CAAA;AAAA,IAC5B;AAAA,EACF;AAEA,EAAA,IAAI,aAAA,CAAc,MAAA,KAAW,CAAA,IAAK,UAAA,CAAW,SAAS,CAAA,EAAG;AACvD,IAAA,OAAO,EAAE,QAAA,EAAU,IAAI,IAAA,EAAM,UAAA,CAAW,MAAM,UAAA,EAAW;AAAA,EAC3D;AAEA,EAAA,OAAO,EAAE,QAAA,EAAU,aAAA,EAAe,IAAA,EAAM,UAAA,CAAW,MAAM,UAAA,EAAW;AACtE;AAOO,SAAS,6BAA6B,MAAA,EAAoD;AAC/F,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,EAAU,OAAO,IAAA;AAC7B,EAAA,OAAO,0BAAA,CAA2B,OAAO,QAAQ,CAAA;AACnD;AAGA,eAAsB,kCACpB,MAAA,EACuC;AACvC,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,EAAU,OAAO,IAAA;AAC7B,EAAA,OAAO,+BAAA,CAAgC,OAAO,QAAQ,CAAA;AACxD;AAGO,SAAS,0BAA0B,GAAA,EAA8C;AACtF,EAAA,IAAI,CAAC,GAAA,CAAI,QAAA,EAAU,OAAO,IAAA;AAC1B,EAAA,OAAO,0BAAA,CAA2B,IAAI,QAAQ,CAAA;AAChD;AAGA,eAAsB,+BACpB,GAAA,EACuC;AACvC,EAAA,IAAI,CAAC,GAAA,CAAI,QAAA,EAAU,OAAO,IAAA;AAC1B,EAAA,OAAO,+BAAA,CAAgC,IAAI,QAAQ,CAAA;AACrD;AAGO,SAAS,2BAA2B,QAAA,EAAoD;AAC7F,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,OAAO,IAAA;AAC/B,EAAA,OAAO,0BAAA,CAA2B,SAAS,QAAQ,CAAA;AACrD;AAGA,eAAsB,gCACpB,QAAA,EACuC;AACvC,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,OAAO,IAAA;AAC/B,EAAA,OAAO,+BAAA,CAAgC,SAAS,QAAQ,CAAA;AAC1D;AC3IO,IAAM,oBAAN,MAAwF;AAAA,EAC7F,QAAQ,KAAA,EAAyF;AAC/F,IAAA,OAAO,6BAA6B,KAAK,CAAA;AAAA,EAC3C;AAAA,EAEA,MAAA,CACE,MAAA,EACA,QAAA,EACA,IAAA,EACmB;AACnB,IAAA,OAAO,yBAAA,CAA0B,MAAA,EAAQ,QAAA,EAAU,IAAI,CAAA;AAAA,EACzD;AAAA,EAEA,mBAAA,CAAoB,SAA8B,IAAA,EAA4C;AAC5F,IAAA,OAAOA,0BAAAA,CAA2B,SAAS,IAAI,CAAA;AAAA,EACjD;AACF;AAGO,SAAS,qBAAqB,SAAA,EAA+C;AAClF,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,KAAA;AAAA,IACX,MAAA,EAAQ,OAAA;AAAA,IACR,QAAA,EAAU,oBAAA;AAAA,IACV,GAAG;AAAA,GACL;AACF;;;ACrCO,SAAS,yBAAyB,MAAA,EAA0B;AACjE,EAAA,OAAO,OACJ,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,EACnB,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,CAAC,CAAA;AAC/B;AAQO,SAAS,yBAAyB,UAAA,EAA8B;AACrE,EAAA,OAAO,UAAA,CAAW,KAAK,IAAI,CAAA;AAC7B;ACRA,IAAM,oBAAoB,GAAA,GAAM,IAAA;AAGhC,IAAM,oBAAA,GAAuB,GAAA;AAG7B,IAAM,mBAAA,GAAsB;AAAA,EAC1B,QAAA;AAAA;AAAA,EACA,OAAA;AAAA;AAAA,EACA,4BAAA;AAAA;AAAA,EACA,aAAA;AAAA;AAAA,EACA,aAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA,OAAA;AAAA;AAAA,EACA,iBAAA;AAAA;AAAA,EACA,QAAA;AAAA;AAAA,EACA;AAAA;AACF,CAAA;AAkCA,SAAS,YAAY,EAAA,EAAqB;AACxC,EAAA,OAAO,oBAAoB,IAAA,CAAK,CAAC,YAAY,OAAA,CAAQ,IAAA,CAAK,EAAE,CAAC,CAAA;AAC/D;AAEA,SAAS,mBAAmB,QAAA,EAA2B;AACrD,EAAA,OAAO,QAAA,KAAa,WAAA,IAAe,QAAA,KAAa,WAAA,IAAe,QAAA,KAAa,KAAA;AAC9E;AAUA,eAAe,uBAAA,CAAwB,KAAa,OAAA,EAA0C;AAC5F,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAG1B,EAAA,IAAI,MAAA,CAAO,QAAA,IAAY,MAAA,CAAO,QAAA,EAAU;AACtC,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AAGA,EAAA,IAAI,MAAA,CAAO,aAAa,OAAA,EAAS;AAC/B,IAAA,IAAI,CAAC,OAAA,CAAQ,sBAAA,IAA0B,CAAC,kBAAA,CAAmB,MAAA,CAAO,QAAQ,CAAA,EAAG;AAC3E,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,kCAAA,EAAqC,OAAO,QAAQ,CAAA,mEAAA;AAAA,OAEtD;AAAA,IACF;AAAA,EACF,CAAA,MAAA,IAAW,MAAA,CAAO,QAAA,KAAa,QAAA,EAAU;AACvC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,MAAA,CAAO,QAAQ,CAAA,CAAE,CAAA;AAAA,EAC/D;AAGA,EAAA,IAAI,WAAA,CAAY,OAAO,QAAQ,CAAA,IAAK,CAAC,kBAAA,CAAmB,MAAA,CAAO,QAAQ,CAAA,EAAG;AACxE,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,MAAA,CAAO,QAAQ,CAAA,YAAA,CAAc,CAAA;AAAA,EAC3E;AAGA,EAAA,IAAI,QAAQ,eAAA,IAAmB,CAAC,kBAAA,CAAmB,MAAA,CAAO,QAAQ,CAAA,EAAG;AACnE,IAAA,MAAM,WAAA,GAAc,MAAM,OAAA,CAAQ,eAAA,CAAgB,OAAO,QAAQ,CAAA;AACjE,IAAA,KAAA,MAAW,MAAM,WAAA,EAAa;AAC5B,MAAA,IAAI,WAAA,CAAY,EAAE,CAAA,EAAG;AACnB,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,OAAO,QAAQ,CAAA,wBAAA,EAA2B,EAAE,CAAA,CAAE,CAAA;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;AAqBA,eAAsB,iBAAA,CACpB,OAAA,EACA,OAAA,GAA4B,EAAC,EACC;AAC9B,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC5C,EAAA,MAAM,KAAA,GAAQ,CAAC,8BAAA,EAAgC,yBAAyB,CAAA;AAExE,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,IAAA,EAAM,OAAO,EAAE,QAAA,EAAS;AAE5C,IAAA,IAAI;AACF,MAAA,MAAM,uBAAA,CAAwB,KAAK,OAAO,CAAA;AAE1C,MAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,GAAA,EAAK;AAAA,QAClC,MAAA,EAAQ,KAAA;AAAA,QACR,QAAA,EAAU,OAAA;AAAA;AAAA,QACV,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,oBAAoB;AAAA,OACjD,CAAA;AAED,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA;AAAA,MACF;AAGA,MAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC5D,MAAA,IACE,CAAC,YAAY,QAAA,CAAS,kBAAkB,KACxC,CAAC,WAAA,CAAY,KAAA,CAAM,iCAAiC,CAAA,EACpD;AACA,QAAA;AAAA,MACF;AAGA,MAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC3D,MAAA,IAAI,aAAA,IAAiB,QAAA,CAAS,aAAA,EAAe,EAAE,IAAI,iBAAA,EAAmB;AACpE,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,MAAA,IAAI,IAAA,CAAK,SAAS,iBAAA,EAAmB;AACnC,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAG5B,MAAA,IAAI,OAAO,IAAA,CAAK,IAAA,KAAS,YAAY,OAAO,IAAA,CAAK,QAAQ,QAAA,EAAU;AACjE,QAAA;AAAA,MACF;AAEA,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AAEN,MAAA;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAOO,SAAS,iBAAiB,IAAA,EAA6B;AAC5D,EAAA,MAAM,UAAA,GAAa,KAAK,YAAA,EAAc,UAAA;AACtC,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA,EAAG;AAC9B,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,UAAA,CAAW,IAAA;AAAA,IAChB,CAAC,QAAQ,OAAO,GAAA,KAAQ,YAAY,GAAA,KAAQ,IAAA,IAAQ,IAAI,GAAA,KAAQ;AAAA,GAClE;AACF;AAOO,SAAS,iBAAiB,IAAA,EAAmD;AAClF,EAAA,MAAM,UAAA,GAAa,KAAK,YAAA,EAAc,UAAA;AACtC,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA,EAAG;AAC9B,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,QAAQ,UAAA,CAAW,IAAA;AAAA,IACvB,CAAC,QAAQ,OAAO,GAAA,KAAQ,YAAY,GAAA,KAAQ,IAAA,IAAQ,IAAI,GAAA,KAAQ;AAAA,GAClE;AACA,EAAA,OAAQ,KAAA,IAAoC,IAAA;AAC9C;AA+BA,eAAsB,wBAAA,CACpB,OAAA,EACA,OAAA,GAA4B,EAAC,EACQ;AAErC,EAAA,MAAM,IAAA,GAAO,MAAM,iBAAA,CAAkB,OAAA,EAAS,OAAO,CAAA;AACrD,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,MAAM,GAAA,GAAM,iBAAiB,IAAI,CAAA;AACjC,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,YAAA;AAAA,QACR,KAAA,EAAO,GAAA,CAAI,MAAA,EAAQ,eAAA,IAAmB,CAAC,kBAAkB,CAAA;AAAA,QACzD,eAAA,EAAiB,GAAA,CAAI,MAAA,EAAQ,eAAA,IAAmB,CAAC,OAAO,CAAA;AAAA,QACxD,GAAI,GAAA,CAAI,MAAA,EAAQ,iBAAA,IAAqB;AAAA,UACnC,iBAAA,EAAmB,IAAI,MAAA,CAAO;AAAA;AAChC,OACF;AAAA,IACF;AAAA,EACF;AAGA,EAAA,MAAM,SAAA,GAAY,MAAM,qBAAA,CAAsB,OAAA,EAAS,OAAO,CAAA;AAC9D,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,OAAO,SAAA;AAAA,EACT;AAGA,EAAA,MAAM,WAAA,GAAc,MAAM,0BAAA,CAA2B,OAAA,EAAS,OAAO,CAAA;AACrE,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,OAAO,WAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA;AACT;AAKA,eAAe,qBAAA,CACb,SACA,OAAA,EACqC;AACrC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC5C,EAAA,MAAM,MAAM,IAAI,GAAA,CAAI,wBAAA,EAA0B,OAAO,EAAE,QAAA,EAAS;AAEhE,EAAA,IAAI;AACF,IAAA,MAAM,uBAAA,CAAwB,KAAK,OAAO,CAAA;AAE1C,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,GAAA,EAAK;AAAA,MAClC,MAAA,EAAQ,KAAA;AAAA,MACR,QAAA,EAAU,OAAA;AAAA,MACV,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,oBAAoB;AAAA,KACjD,CAAA;AAED,IAAA,IAAI,CAAC,QAAA,CAAS,EAAA,EAAI,OAAO,IAAA;AAEzB,IAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC5D,IAAA,IACE,CAAC,YAAY,QAAA,CAAS,kBAAkB,KACxC,CAAC,WAAA,CAAY,KAAA,CAAM,iCAAiC,CAAA,EACpD;AACA,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC3D,IAAA,IAAI,aAAA,IAAiB,QAAA,CAAS,aAAA,EAAe,EAAE,IAAI,iBAAA,EAAmB;AACpE,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,IAAI,IAAA,CAAK,MAAA,GAAS,iBAAA,EAAmB,OAAO,IAAA;AAE5C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAE5B,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,YAAA;AAAA,MACR,KAAA,EAAO,MAAM,OAAA,CAAQ,IAAA,CAAK,eAAe,CAAA,GACpC,IAAA,CAAK,eAAA,GACN,CAAC,kBAAkB,CAAA;AAAA,MACvB,eAAA,EAAiB,MAAM,OAAA,CAAQ,IAAA,CAAK,eAAe,CAAA,GAC9C,IAAA,CAAK,eAAA,GACN,CAAC,OAAO,CAAA;AAAA,MACZ,GAAI,OAAO,IAAA,CAAK,iBAAA,KAAsB,QAAA,IAAY;AAAA,QAChD,mBAAmB,IAAA,CAAK;AAAA;AAC1B,KACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAQA,eAAe,0BAAA,CACb,SACA,OAAA,EACqC;AACrC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAE5C,EAAA,IAAI;AACF,IAAA,MAAM,uBAAA,CAAwB,SAAS,OAAO,CAAA;AAE9C,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,OAAA,EAAS;AAAA,MACtC,MAAA,EAAQ,MAAA;AAAA,MACR,QAAA,EAAU,OAAA;AAAA,MACV,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,oBAAoB;AAAA,KACjD,CAAA;AAED,IAAA,MAAM,YAAY,CAAC,GAAG,SAAS,OAAA,CAAQ,IAAA,EAAM,CAAA,CAAE,IAAA;AAAA,MAC7C,CAAC,CAAA,KAAM,CAAA,CAAE,WAAA,EAAY,KAAM,oBAAoB,WAAA;AAAY,KAC7D;AAEA,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,cAAA;AAAA,QACR,KAAA,EAAO,CAAC,kBAAkB,CAAA;AAAA,QAC1B,eAAA,EAAiB,CAAC,OAAO;AAAA,OAC3B;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,OAAO,IAAA;AACT","file":"index.mjs","sourcesContent":["/**\n * Minimal A2A types from spec v0.3.0 (DD-126).\n *\n * These types are defined locally rather than importing @a2a-js/sdk,\n * which brings protobuf + gRPC + express peer dependencies that are\n * not needed for evidence placement.\n */\n\nimport type { CarrierFormat, PeacEvidenceCarrier, CarrierMeta } from '@peac/kernel';\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/** PEAC traceability extension URI for A2A metadata */\nexport const PEAC_EXTENSION_URI = 'https://www.peacprotocol.org/ext/traceability/v1' as const;\n\n/** Maximum carrier size for A2A metadata (64 KB, DD-127) */\nexport const A2A_MAX_CARRIER_SIZE = 65_536;\n\n// ---------------------------------------------------------------------------\n// A2A Agent Card types (v0.3.0)\n// ---------------------------------------------------------------------------\n\n/** A2A extension entry in capabilities.extensions[] */\nexport interface AgentCardExtension {\n  uri: string;\n  description?: string;\n  required?: boolean;\n  params?: Record<string, unknown>;\n}\n\n/** PEAC-specific extension entry for A2A Agent Card */\nexport interface AgentCardPeacExtension {\n  uri: typeof PEAC_EXTENSION_URI;\n  description: string;\n  required: boolean;\n  params?: {\n    supported_kinds?: string[];\n    carrier_formats?: CarrierFormat[];\n    issuer_config_url?: string;\n  };\n}\n\n/** Minimal A2A Agent Card shape (v0.3.0) */\nexport interface A2AAgentCard {\n  name: string;\n  url: string;\n  capabilities?: {\n    extensions?: AgentCardExtension[];\n    [key: string]: unknown;\n  };\n  [key: string]: unknown;\n}\n\n// ---------------------------------------------------------------------------\n// A2A message types (minimal shapes)\n// ---------------------------------------------------------------------------\n\n/** A2A metadata map */\nexport type A2AMetadata = Record<string, unknown>;\n\n/** Minimal A2A TaskStatus shape */\nexport interface A2ATaskStatusLike {\n  state: string;\n  metadata?: A2AMetadata;\n  [key: string]: unknown;\n}\n\n/** Minimal A2A Message shape */\nexport interface A2AMessageLike {\n  role: string;\n  parts: unknown[];\n  metadata?: A2AMetadata;\n  [key: string]: unknown;\n}\n\n/** Minimal A2A Artifact shape */\nexport interface A2AArtifactLike {\n  artifactId: string;\n  parts: unknown[];\n  metadata?: A2AMetadata;\n  [key: string]: unknown;\n}\n\n// ---------------------------------------------------------------------------\n// Carrier payload type\n// ---------------------------------------------------------------------------\n\n/**\n * A2A carrier payload: the value stored under metadata[PEAC_EXTENSION_URI].\n *\n * Contains an array of carriers (even for single-receipt cases) and\n * optional transport metadata.\n */\nexport interface A2APeacPayload {\n  carriers: PeacEvidenceCarrier[];\n  meta?: CarrierMeta;\n}\n","/**\n * Attach PEAC evidence carriers to A2A metadata.\n *\n * Places carrier data under metadata[PEAC_EXTENSION_URI] per A2A v0.3.0\n * metadata convention (DD-128). Uses computeReceiptRef() from @peac/schema\n * for receipt reference computation (correction item 4).\n */\n\nimport type { PeacEvidenceCarrier, CarrierMeta } from '@peac/kernel';\nimport { validateCarrierConstraints } from '@peac/schema';\n\nimport type {\n  A2AMetadata,\n  A2ATaskStatusLike,\n  A2AMessageLike,\n  A2AArtifactLike,\n  A2APeacPayload,\n} from './types';\nimport { PEAC_EXTENSION_URI, A2A_MAX_CARRIER_SIZE } from './types';\n\n// ---------------------------------------------------------------------------\n// Default meta for A2A transport\n// ---------------------------------------------------------------------------\n\nfunction defaultA2AMeta(): CarrierMeta {\n  return {\n    transport: 'a2a',\n    format: 'embed',\n    max_size: A2A_MAX_CARRIER_SIZE,\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Core attach: metadata map\n// ---------------------------------------------------------------------------\n\n/**\n * Attach PEAC evidence carrier(s) to an A2A metadata map.\n *\n * Writes `metadata[PEAC_EXTENSION_URI] = { carriers: [...], meta }`.\n * Validates carrier constraints before attachment; throws on violation.\n *\n * @returns The modified metadata map (mutated in place and returned)\n */\nexport function attachReceiptToMetadata(\n  metadata: A2AMetadata,\n  carriers: PeacEvidenceCarrier[],\n  meta?: CarrierMeta\n): A2AMetadata {\n  const effectiveMeta = meta ?? defaultA2AMeta();\n\n  for (const carrier of carriers) {\n    const result = validateCarrierConstraints(carrier, effectiveMeta);\n    if (!result.valid) {\n      throw new Error(`Carrier constraint violation: ${result.violations.join('; ')}`);\n    }\n  }\n\n  const payload: A2APeacPayload = { carriers, meta: effectiveMeta };\n  metadata[PEAC_EXTENSION_URI] = payload;\n  return metadata;\n}\n\n// ---------------------------------------------------------------------------\n// Convenience: attach to A2A message types\n// ---------------------------------------------------------------------------\n\n/**\n * Attach PEAC evidence carrier(s) to an A2A TaskStatus.\n * Initializes `metadata` if absent.\n */\nexport function attachReceiptToTaskStatus(\n  status: A2ATaskStatusLike,\n  carriers: PeacEvidenceCarrier[],\n  meta?: CarrierMeta\n): A2ATaskStatusLike {\n  if (!status.metadata) {\n    status.metadata = {};\n  }\n  attachReceiptToMetadata(status.metadata, carriers, meta);\n  return status;\n}\n\n/**\n * Attach PEAC evidence carrier(s) to an A2A Message.\n * Initializes `metadata` if absent.\n */\nexport function attachReceiptToMessage(\n  msg: A2AMessageLike,\n  carriers: PeacEvidenceCarrier[],\n  meta?: CarrierMeta\n): A2AMessageLike {\n  if (!msg.metadata) {\n    msg.metadata = {};\n  }\n  attachReceiptToMetadata(msg.metadata, carriers, meta);\n  return msg;\n}\n\n/**\n * Attach PEAC evidence carrier(s) to an A2A Artifact.\n * Initializes `metadata` if absent.\n */\nexport function attachReceiptToArtifact(\n  artifact: A2AArtifactLike,\n  carriers: PeacEvidenceCarrier[],\n  meta?: CarrierMeta\n): A2AArtifactLike {\n  if (!artifact.metadata) {\n    artifact.metadata = {};\n  }\n  attachReceiptToMetadata(artifact.metadata, carriers, meta);\n  return artifact;\n}\n","/**\n * Extract PEAC evidence carriers from A2A metadata.\n *\n * Reads carrier data from metadata[PEAC_EXTENSION_URI] and validates\n * against PeacEvidenceCarrierSchema (DD-131). Provides both sync (structural)\n * and async (receipt_ref consistency) extraction paths per DD-129.\n */\n\nimport type { PeacEvidenceCarrier, CarrierMeta } from '@peac/kernel';\nimport { PeacEvidenceCarrierSchema, verifyReceiptRefConsistency } from '@peac/schema';\n\nimport type {\n  A2AMetadata,\n  A2ATaskStatusLike,\n  A2AMessageLike,\n  A2AArtifactLike,\n  A2APeacPayload,\n} from './types';\nimport { PEAC_EXTENSION_URI, A2A_MAX_CARRIER_SIZE } from './types';\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/** Result of carrier extraction */\nexport interface A2AExtractResult {\n  receipts: PeacEvidenceCarrier[];\n  meta: CarrierMeta;\n}\n\n/** Result of async extraction with consistency check */\nexport interface A2AExtractAsyncResult extends A2AExtractResult {\n  /** Consistency violations (empty if all receipts are valid) */\n  violations: string[];\n}\n\n// ---------------------------------------------------------------------------\n// Core extract: metadata map (sync, structural only)\n// ---------------------------------------------------------------------------\n\n/**\n * Extract PEAC evidence carriers from A2A metadata (sync).\n *\n * Performs structural validation only (schema check, DD-131).\n * Returns null if no PEAC extension data is present.\n * Silently skips carriers that fail schema validation.\n */\nexport function extractReceiptFromMetadata(metadata: A2AMetadata): A2AExtractResult | null {\n  const raw = metadata[PEAC_EXTENSION_URI];\n  if (raw === undefined || raw === null) {\n    return null;\n  }\n\n  // Validate payload shape\n  if (typeof raw !== 'object' || !('carriers' in (raw as object))) {\n    return null;\n  }\n\n  const payload = raw as A2APeacPayload;\n  if (!Array.isArray(payload.carriers) || payload.carriers.length === 0) {\n    return null;\n  }\n\n  // Validate each carrier against schema (DD-131: validate at extraction)\n  const validCarriers: PeacEvidenceCarrier[] = [];\n  for (const carrier of payload.carriers) {\n    const result = PeacEvidenceCarrierSchema.safeParse(carrier);\n    if (result.success) {\n      validCarriers.push(result.data as PeacEvidenceCarrier);\n    }\n  }\n\n  if (validCarriers.length === 0) {\n    return null;\n  }\n\n  const meta: CarrierMeta = payload.meta ?? {\n    transport: 'a2a',\n    format: 'embed',\n    max_size: A2A_MAX_CARRIER_SIZE,\n  };\n\n  return { receipts: validCarriers, meta };\n}\n\n/**\n * Extract PEAC evidence carriers from A2A metadata (async, DD-129).\n *\n * Performs structural validation AND receipt_ref consistency check.\n * When receipt_jws is present, verifies sha256(receipt_jws) === receipt_ref.\n * Returns violations array for any carriers that fail the consistency check.\n */\nexport async function extractReceiptFromMetadataAsync(\n  metadata: A2AMetadata\n): Promise<A2AExtractAsyncResult | null> {\n  const syncResult = extractReceiptFromMetadata(metadata);\n  if (syncResult === null) {\n    return null;\n  }\n\n  const violations: string[] = [];\n  const validCarriers: PeacEvidenceCarrier[] = [];\n\n  for (const carrier of syncResult.receipts) {\n    const error = await verifyReceiptRefConsistency(carrier);\n    if (error !== null) {\n      violations.push(error);\n    } else {\n      validCarriers.push(carrier);\n    }\n  }\n\n  if (validCarriers.length === 0 && violations.length > 0) {\n    return { receipts: [], meta: syncResult.meta, violations };\n  }\n\n  return { receipts: validCarriers, meta: syncResult.meta, violations };\n}\n\n// ---------------------------------------------------------------------------\n// Convenience: extract from A2A message types\n// ---------------------------------------------------------------------------\n\n/** Extract carriers from A2A TaskStatus (sync) */\nexport function extractReceiptFromTaskStatus(status: A2ATaskStatusLike): A2AExtractResult | null {\n  if (!status.metadata) return null;\n  return extractReceiptFromMetadata(status.metadata);\n}\n\n/** Extract carriers from A2A TaskStatus (async, DD-129) */\nexport async function extractReceiptFromTaskStatusAsync(\n  status: A2ATaskStatusLike\n): Promise<A2AExtractAsyncResult | null> {\n  if (!status.metadata) return null;\n  return extractReceiptFromMetadataAsync(status.metadata);\n}\n\n/** Extract carriers from A2A Message (sync) */\nexport function extractReceiptFromMessage(msg: A2AMessageLike): A2AExtractResult | null {\n  if (!msg.metadata) return null;\n  return extractReceiptFromMetadata(msg.metadata);\n}\n\n/** Extract carriers from A2A Message (async, DD-129) */\nexport async function extractReceiptFromMessageAsync(\n  msg: A2AMessageLike\n): Promise<A2AExtractAsyncResult | null> {\n  if (!msg.metadata) return null;\n  return extractReceiptFromMetadataAsync(msg.metadata);\n}\n\n/** Extract carriers from A2A Artifact (sync) */\nexport function extractReceiptFromArtifact(artifact: A2AArtifactLike): A2AExtractResult | null {\n  if (!artifact.metadata) return null;\n  return extractReceiptFromMetadata(artifact.metadata);\n}\n\n/** Extract carriers from A2A Artifact (async, DD-129) */\nexport async function extractReceiptFromArtifactAsync(\n  artifact: A2AArtifactLike\n): Promise<A2AExtractAsyncResult | null> {\n  if (!artifact.metadata) return null;\n  return extractReceiptFromMetadataAsync(artifact.metadata);\n}\n","/**\n * A2A carrier adapter implementing CarrierAdapter<A2ATaskStatusLike, A2ATaskStatusLike>.\n *\n * Bridges PeacEvidenceCarrier to A2A TaskStatus metadata per DD-124.\n */\n\nimport type {\n  PeacEvidenceCarrier,\n  CarrierMeta,\n  CarrierValidationResult,\n  CarrierAdapter,\n} from '@peac/kernel';\nimport { validateCarrierConstraints } from '@peac/schema';\n\nimport type { A2ATaskStatusLike } from './types';\nimport { A2A_MAX_CARRIER_SIZE } from './types';\nimport { attachReceiptToTaskStatus } from './attach';\nimport { extractReceiptFromTaskStatus } from './extract';\n\n/**\n * CarrierAdapter implementation for A2A TaskStatus messages.\n *\n * Uses metadata[PEAC_EXTENSION_URI] = { carriers: [...] } layout.\n */\nexport class A2ACarrierAdapter implements CarrierAdapter<A2ATaskStatusLike, A2ATaskStatusLike> {\n  extract(input: A2ATaskStatusLike): { receipts: PeacEvidenceCarrier[]; meta: CarrierMeta } | null {\n    return extractReceiptFromTaskStatus(input);\n  }\n\n  attach(\n    output: A2ATaskStatusLike,\n    carriers: PeacEvidenceCarrier[],\n    meta?: CarrierMeta\n  ): A2ATaskStatusLike {\n    return attachReceiptToTaskStatus(output, carriers, meta);\n  }\n\n  validateConstraints(carrier: PeacEvidenceCarrier, meta: CarrierMeta): CarrierValidationResult {\n    return validateCarrierConstraints(carrier, meta);\n  }\n}\n\n/** Default CarrierMeta for A2A transport */\nexport function createA2ACarrierMeta(overrides?: Partial<CarrierMeta>): CarrierMeta {\n  return {\n    transport: 'a2a',\n    format: 'embed',\n    max_size: A2A_MAX_CARRIER_SIZE,\n    ...overrides,\n  };\n}\n","/**\n * A2A extension header utilities.\n *\n * Handles the A2A-Extensions header for advertising supported extensions\n * per DD-86 (no X- prefix headers).\n */\n\n/**\n * Parse comma-separated A2A extension URIs from header value.\n *\n * @param header - Raw header value (e.g. \"https://example.com/ext/a, https://example.com/ext/b\")\n * @returns Array of trimmed, non-empty extension URIs\n */\nexport function parseA2AExtensionsHeader(header: string): string[] {\n  return header\n    .split(',')\n    .map((s) => s.trim())\n    .filter((s) => s.length > 0);\n}\n\n/**\n * Build comma-separated A2A-Extensions header value from URIs.\n *\n * @param extensions - Array of extension URIs\n * @returns Comma-separated header value\n */\nexport function buildA2AExtensionsHeader(extensions: string[]): string {\n  return extensions.join(', ');\n}\n","/**\n * A2A agent discovery with SSRF hardening (Polish C).\n *\n * Discovers A2A Agent Cards and checks for PEAC extension support.\n * Implements literal-IP blocking, optional DNS resolution checks,\n * scheme allowlist, userinfo rejection, response size cap,\n * content-type check, and redirect rejection.\n */\n\nimport type { CarrierFormat } from '@peac/kernel';\nimport { PEAC_RECEIPT_HEADER } from '@peac/kernel';\n\nimport type { A2AAgentCard, AgentCardPeacExtension } from './types';\nimport { PEAC_EXTENSION_URI } from './types';\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/** Maximum response body size (256 KB) */\nconst MAX_RESPONSE_SIZE = 256 * 1024;\n\n/** Request timeout in milliseconds */\nconst DISCOVERY_TIMEOUT_MS = 5_000;\n\n/** Private/reserved IP ranges (RFC 1918, RFC 4193, loopback, link-local) */\nconst PRIVATE_IP_PATTERNS = [\n  /^127\\./, // loopback\n  /^10\\./, // RFC 1918 Class A\n  /^172\\.(1[6-9]|2\\d|3[01])\\./, // RFC 1918 Class B\n  /^192\\.168\\./, // RFC 1918 Class C\n  /^169\\.254\\./, // link-local\n  /^0\\./, // current network\n  /^::1$/, // IPv6 loopback\n  /^fd[0-9a-f]{2}:/, // RFC 4193 ULA\n  /^fe80:/, // IPv6 link-local\n  /^fc[0-9a-f]{2}:/, // RFC 4193 ULA\n];\n\n// ---------------------------------------------------------------------------\n// Options\n// ---------------------------------------------------------------------------\n\n/** Discovery options */\nexport interface DiscoveryOptions {\n  /**\n   * Allow HTTP (insecure) for localhost addresses only (dev mode).\n   * Default: false (HTTPS only in production).\n   */\n  allowInsecureLocalhost?: boolean;\n\n  /** Custom fetch implementation (for testing or strict environments) */\n  fetch?: typeof globalThis.fetch;\n\n  /**\n   * Optional DNS resolver for DNS rebinding defense.\n   *\n   * When provided, discovery resolves the hostname and checks all returned\n   * IP addresses against private ranges before connecting. This provides\n   * full DNS rebinding protection.\n   *\n   * When omitted, discovery checks only literal IP addresses in the URL\n   * hostname (weaker posture, but portable across runtimes).\n   */\n  resolveHostname?: (hostname: string) => Promise<string[]>;\n}\n\n// ---------------------------------------------------------------------------\n// SSRF helpers\n// ---------------------------------------------------------------------------\n\nfunction isPrivateIP(ip: string): boolean {\n  return PRIVATE_IP_PATTERNS.some((pattern) => pattern.test(ip));\n}\n\nfunction isLocalhostAddress(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1';\n}\n\n/**\n * Validate URL scheme, hostname, and credentials for SSRF protection.\n *\n * - Only HTTPS in production (Polish C item 6)\n * - HTTP allowed only for localhost when allowInsecureLocalhost is true\n * - Rejects private IP ranges (literal check always; DNS resolution when resolver provided)\n * - Rejects URLs with userinfo (user:pass@host) to prevent confusion in allowlists\n */\nasync function validateUrlForDiscovery(url: string, options: DiscoveryOptions): Promise<void> {\n  const parsed = new URL(url);\n\n  // Reject URLs with userinfo (user:pass@host)\n  if (parsed.username || parsed.password) {\n    throw new Error('SSRF: URLs with userinfo (credentials) are not allowed');\n  }\n\n  // Scheme allowlist (Polish C item 6)\n  if (parsed.protocol === 'http:') {\n    if (!options.allowInsecureLocalhost || !isLocalhostAddress(parsed.hostname)) {\n      throw new Error(\n        `SSRF: HTTP scheme not allowed for ${parsed.hostname}. ` +\n          'Use HTTPS or enable allowInsecureLocalhost for local development.'\n      );\n    }\n  } else if (parsed.protocol !== 'https:') {\n    throw new Error(`SSRF: unsupported scheme ${parsed.protocol}`);\n  }\n\n  // Check for private IP in hostname (literal IP check)\n  if (isPrivateIP(parsed.hostname) && !isLocalhostAddress(parsed.hostname)) {\n    throw new Error(`SSRF: private IP address ${parsed.hostname} not allowed`);\n  }\n\n  // DNS rebinding defense: resolve hostname and check all IPs (when resolver provided)\n  if (options.resolveHostname && !isLocalhostAddress(parsed.hostname)) {\n    const resolvedIPs = await options.resolveHostname(parsed.hostname);\n    for (const ip of resolvedIPs) {\n      if (isPrivateIP(ip)) {\n        throw new Error(`SSRF: hostname ${parsed.hostname} resolved to private IP ${ip}`);\n      }\n    }\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Core discovery\n// ---------------------------------------------------------------------------\n\n/**\n * Discover A2A Agent Card from a base URL.\n *\n * Tries `/.well-known/agent-card.json` first, then `/.well-known/agent.json`\n * as a legacy fallback per A2A v0.3.0.\n *\n * SSRF protection per Polish C:\n * 1. Private IP blocking (literal check; DNS resolution when resolveHostname provided)\n * 2. Response size cap (256 KB)\n * 3. Content-Type check (application/json)\n * 4. Redirect rejection (redirect: \"error\")\n * 5. Timeout (5 seconds)\n * 6. Scheme allowlist (HTTPS only; HTTP for localhost dev only)\n * 7. Userinfo rejection (no credentials in URLs)\n */\nexport async function discoverAgentCard(\n  baseUrl: string,\n  options: DiscoveryOptions = {}\n): Promise<A2AAgentCard | null> {\n  const fetchFn = options.fetch ?? globalThis.fetch;\n  const paths = ['/.well-known/agent-card.json', '/.well-known/agent.json'];\n\n  for (const path of paths) {\n    const url = new URL(path, baseUrl).toString();\n\n    try {\n      await validateUrlForDiscovery(url, options);\n\n      const response = await fetchFn(url, {\n        method: 'GET',\n        redirect: 'error', // Polish C item 4\n        signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),\n      });\n\n      if (!response.ok) {\n        continue;\n      }\n\n      // Content-Type check (Polish C item 3)\n      const contentType = response.headers.get('content-type') ?? '';\n      if (\n        !contentType.includes('application/json') &&\n        !contentType.match(/application\\/[a-z0-9.+-]*\\+json/)\n      ) {\n        continue;\n      }\n\n      // Response size cap (Polish C item 2)\n      const contentLength = response.headers.get('content-length');\n      if (contentLength && parseInt(contentLength, 10) > MAX_RESPONSE_SIZE) {\n        continue;\n      }\n\n      const text = await response.text();\n      if (text.length > MAX_RESPONSE_SIZE) {\n        continue;\n      }\n\n      const card = JSON.parse(text) as A2AAgentCard;\n\n      // Basic validation: must have name and url\n      if (typeof card.name !== 'string' || typeof card.url !== 'string') {\n        continue;\n      }\n\n      return card;\n    } catch {\n      // SSRF validation errors, network errors, parse errors: try next path\n      continue;\n    }\n  }\n\n  return null;\n}\n\n/**\n * Check if an A2A Agent Card advertises PEAC extension support.\n *\n * Looks for the PEAC extension URI in capabilities.extensions[].\n */\nexport function hasPeacExtension(card: A2AAgentCard): boolean {\n  const extensions = card.capabilities?.extensions;\n  if (!Array.isArray(extensions)) {\n    return false;\n  }\n  return extensions.some(\n    (ext) => typeof ext === 'object' && ext !== null && ext.uri === PEAC_EXTENSION_URI\n  );\n}\n\n/**\n * Extract PEAC extension parameters from an A2A Agent Card.\n *\n * Returns the PEAC extension entry or null if not present.\n */\nexport function getPeacExtension(card: A2AAgentCard): AgentCardPeacExtension | null {\n  const extensions = card.capabilities?.extensions;\n  if (!Array.isArray(extensions)) {\n    return null;\n  }\n  const entry = extensions.find(\n    (ext) => typeof ext === 'object' && ext !== null && ext.uri === PEAC_EXTENSION_URI\n  );\n  return (entry as AgentCardPeacExtension) ?? null;\n}\n\n// ---------------------------------------------------------------------------\n// PEAC discovery result\n// ---------------------------------------------------------------------------\n\n/** Source of PEAC capability discovery */\nexport type PeacDiscoverySource = 'agent_card' | 'well_known' | 'header_probe';\n\n/** Result of PEAC capability discovery */\nexport interface PeacDiscoveryResult {\n  source: PeacDiscoverySource;\n  kinds: string[];\n  carrier_formats: CarrierFormat[];\n  issuer_config_url?: string;\n}\n\n// ---------------------------------------------------------------------------\n// 3-step discovery (DD-110)\n// ---------------------------------------------------------------------------\n\n/**\n * Discover PEAC capabilities from a base URL using a 3-step algorithm:\n *\n * 1. Agent Card: check `/.well-known/agent-card.json` for PEAC extension\n * 2. Well-known: check `/.well-known/peac.json` (standalone PEAC discovery)\n * 3. Header probe: HEAD request to base URL, check for `PEAC-Receipt` header\n *\n * Returns the first successful result or null if PEAC is not supported.\n * All steps apply SSRF protections per Polish C.\n */\nexport async function discoverPeacCapabilities(\n  baseUrl: string,\n  options: DiscoveryOptions = {}\n): Promise<PeacDiscoveryResult | null> {\n  // Step 1: Agent Card\n  const card = await discoverAgentCard(baseUrl, options);\n  if (card) {\n    const ext = getPeacExtension(card);\n    if (ext) {\n      return {\n        source: 'agent_card',\n        kinds: ext.params?.supported_kinds ?? ['peac-receipt/0.1'],\n        carrier_formats: ext.params?.carrier_formats ?? ['embed'],\n        ...(ext.params?.issuer_config_url && {\n          issuer_config_url: ext.params.issuer_config_url,\n        }),\n      };\n    }\n  }\n\n  // Step 2: /.well-known/peac.json\n  const wellKnown = await discoverPeacWellKnown(baseUrl, options);\n  if (wellKnown) {\n    return wellKnown;\n  }\n\n  // Step 3: Header probe\n  const headerProbe = await discoverPeacViaHeaderProbe(baseUrl, options);\n  if (headerProbe) {\n    return headerProbe;\n  }\n\n  return null;\n}\n\n/**\n * Step 2: Discover PEAC support via `/.well-known/peac.json`.\n */\nasync function discoverPeacWellKnown(\n  baseUrl: string,\n  options: DiscoveryOptions\n): Promise<PeacDiscoveryResult | null> {\n  const fetchFn = options.fetch ?? globalThis.fetch;\n  const url = new URL('/.well-known/peac.json', baseUrl).toString();\n\n  try {\n    await validateUrlForDiscovery(url, options);\n\n    const response = await fetchFn(url, {\n      method: 'GET',\n      redirect: 'error',\n      signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),\n    });\n\n    if (!response.ok) return null;\n\n    const contentType = response.headers.get('content-type') ?? '';\n    if (\n      !contentType.includes('application/json') &&\n      !contentType.match(/application\\/[a-z0-9.+-]*\\+json/)\n    ) {\n      return null;\n    }\n\n    const contentLength = response.headers.get('content-length');\n    if (contentLength && parseInt(contentLength, 10) > MAX_RESPONSE_SIZE) {\n      return null;\n    }\n\n    const text = await response.text();\n    if (text.length > MAX_RESPONSE_SIZE) return null;\n\n    const data = JSON.parse(text) as Record<string, unknown>;\n\n    return {\n      source: 'well_known',\n      kinds: Array.isArray(data.supported_kinds)\n        ? (data.supported_kinds as string[])\n        : ['peac-receipt/0.1'],\n      carrier_formats: Array.isArray(data.carrier_formats)\n        ? (data.carrier_formats as CarrierFormat[])\n        : ['embed'],\n      ...(typeof data.issuer_config_url === 'string' && {\n        issuer_config_url: data.issuer_config_url,\n      }),\n    };\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Step 3: Discover PEAC support via header probe.\n *\n * Sends a HEAD request and checks for the presence of a PEAC-Receipt header.\n * This is a lightweight probe; it indicates support but provides minimal detail.\n */\nasync function discoverPeacViaHeaderProbe(\n  baseUrl: string,\n  options: DiscoveryOptions\n): Promise<PeacDiscoveryResult | null> {\n  const fetchFn = options.fetch ?? globalThis.fetch;\n\n  try {\n    await validateUrlForDiscovery(baseUrl, options);\n\n    const response = await fetchFn(baseUrl, {\n      method: 'HEAD',\n      redirect: 'error',\n      signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),\n    });\n\n    const headerKey = [...response.headers.keys()].find(\n      (k) => k.toLowerCase() === PEAC_RECEIPT_HEADER.toLowerCase()\n    );\n\n    if (headerKey) {\n      return {\n        source: 'header_probe',\n        kinds: ['peac-receipt/0.1'],\n        carrier_formats: ['embed'],\n      };\n    }\n  } catch {\n    // Network errors, SSRF: no PEAC support detected\n  }\n\n  return null;\n}\n"]}
+{"version":3,"sources":["../src/types.ts","../src/attach.ts","../src/extract.ts","../src/carrier.ts","../src/header.ts","../src/discovery.ts"],"names":["validateCarrierConstraints"],"mappings":";;;;AAeO,IAAM,kBAAA,GAAqB;AAG3B,IAAM,oBAAA,GAAuB;ACMpC,SAAS,cAAA,GAA8B;AACrC,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,KAAA;AAAA,IACX,MAAA,EAAQ,OAAA;AAAA,IACR,QAAA,EAAU;AAAA,GACZ;AACF;AAcO,SAAS,uBAAA,CACd,QAAA,EACA,QAAA,EACA,IAAA,EACa;AACb,EAAA,MAAM,aAAA,GAAgB,QAAQ,cAAA,EAAe;AAE7C,EAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,IAAA,MAAM,MAAA,GAAS,0BAAA,CAA2B,OAAA,EAAS,aAAa,CAAA;AAChE,IAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,MAAA,MAAM,IAAI,MAAM,CAAA,8BAAA,EAAiC,MAAA,CAAO,WAAW,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IACjF;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAA0B,EAAE,QAAA,EAAU,IAAA,EAAM,aAAA,EAAc;AAChE,EAAA,QAAA,CAAS,kBAAkB,CAAA,GAAI,OAAA;AAC/B,EAAA,OAAO,QAAA;AACT;AAUO,SAAS,yBAAA,CACd,MAAA,EACA,QAAA,EACA,IAAA,EACmB;AACnB,EAAA,IAAI,CAAC,OAAO,QAAA,EAAU;AACpB,IAAA,MAAA,CAAO,WAAW,EAAC;AAAA,EACrB;AACA,EAAA,uBAAA,CAAwB,MAAA,CAAO,QAAA,EAAU,QAAA,EAAU,IAAI,CAAA;AACvD,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,sBAAA,CACd,GAAA,EACA,QAAA,EACA,IAAA,EACgB;AAChB,EAAA,IAAI,CAAC,IAAI,QAAA,EAAU;AACjB,IAAA,GAAA,CAAI,WAAW,EAAC;AAAA,EAClB;AACA,EAAA,uBAAA,CAAwB,GAAA,CAAI,QAAA,EAAU,QAAA,EAAU,IAAI,CAAA;AACpD,EAAA,OAAO,GAAA;AACT;AAMO,SAAS,uBAAA,CACd,QAAA,EACA,QAAA,EACA,IAAA,EACiB;AACjB,EAAA,IAAI,CAAC,SAAS,QAAA,EAAU;AACtB,IAAA,QAAA,CAAS,WAAW,EAAC;AAAA,EACvB;AACA,EAAA,uBAAA,CAAwB,QAAA,CAAS,QAAA,EAAU,QAAA,EAAU,IAAI,CAAA;AACzD,EAAA,OAAO,QAAA;AACT;AClEO,SAAS,2BAA2B,QAAA,EAAgD;AACzF,EAAA,MAAM,GAAA,GAAM,SAAS,kBAAkB,CAAA;AACvC,EAAA,IAAI,GAAA,KAAQ,MAAA,IAAa,GAAA,KAAQ,IAAA,EAAM;AACrC,IAAA,OAAO,IAAA;AAAA,EACT;AAGA,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,EAAE,cAAe,GAAA,CAAA,EAAiB;AAC/D,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAU,GAAA;AAChB,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,OAAA,CAAQ,QAAQ,CAAA,IAAK,OAAA,CAAQ,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AACrE,IAAA,OAAO,IAAA;AAAA,EACT;AAGA,EAAA,MAAM,gBAAuC,EAAC;AAC9C,EAAA,KAAA,MAAW,OAAA,IAAW,QAAQ,QAAA,EAAU;AACtC,IAAA,MAAM,MAAA,GAAS,yBAAA,CAA0B,SAAA,CAAU,OAAO,CAAA;AAC1D,IAAA,IAAI,OAAO,OAAA,EAAS;AAClB,MAAA,aAAA,CAAc,IAAA,CAAK,OAAO,IAA2B,CAAA;AAAA,IACvD;AAAA,EACF;AAEA,EAAA,IAAI,aAAA,CAAc,WAAW,CAAA,EAAG;AAC9B,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,IAAA,GAAoB,QAAQ,IAAA,IAAQ;AAAA,IACxC,SAAA,EAAW,KAAA;AAAA,IACX,MAAA,EAAQ,OAAA;AAAA,IACR,QAAA,EAAU;AAAA,GACZ;AAEA,EAAA,OAAO,EAAE,QAAA,EAAU,aAAA,EAAe,IAAA,EAAK;AACzC;AASA,eAAsB,gCACpB,QAAA,EACuC;AACvC,EAAA,MAAM,UAAA,GAAa,2BAA2B,QAAQ,CAAA;AACtD,EAAA,IAAI,eAAe,IAAA,EAAM;AACvB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,aAAuB,EAAC;AAC9B,EAAA,MAAM,gBAAuC,EAAC;AAE9C,EAAA,KAAA,MAAW,OAAA,IAAW,WAAW,QAAA,EAAU;AACzC,IAAA,MAAM,KAAA,GAAQ,MAAM,2BAAA,CAA4B,OAAO,CAAA;AACvD,IAAA,IAAI,UAAU,IAAA,EAAM;AAClB,MAAA,UAAA,CAAW,KAAK,KAAK,CAAA;AAAA,IACvB,CAAA,MAAO;AACL,MAAA,aAAA,CAAc,KAAK,OAAO,CAAA;AAAA,IAC5B;AAAA,EACF;AAEA,EAAA,IAAI,aAAA,CAAc,MAAA,KAAW,CAAA,IAAK,UAAA,CAAW,SAAS,CAAA,EAAG;AACvD,IAAA,OAAO,EAAE,QAAA,EAAU,IAAI,IAAA,EAAM,UAAA,CAAW,MAAM,UAAA,EAAW;AAAA,EAC3D;AAEA,EAAA,OAAO,EAAE,QAAA,EAAU,aAAA,EAAe,IAAA,EAAM,UAAA,CAAW,MAAM,UAAA,EAAW;AACtE;AAOO,SAAS,6BAA6B,MAAA,EAAoD;AAC/F,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,EAAU,OAAO,IAAA;AAC7B,EAAA,OAAO,0BAAA,CAA2B,OAAO,QAAQ,CAAA;AACnD;AAGA,eAAsB,kCACpB,MAAA,EACuC;AACvC,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,EAAU,OAAO,IAAA;AAC7B,EAAA,OAAO,+BAAA,CAAgC,OAAO,QAAQ,CAAA;AACxD;AAGO,SAAS,0BAA0B,GAAA,EAA8C;AACtF,EAAA,IAAI,CAAC,GAAA,CAAI,QAAA,EAAU,OAAO,IAAA;AAC1B,EAAA,OAAO,0BAAA,CAA2B,IAAI,QAAQ,CAAA;AAChD;AAGA,eAAsB,+BACpB,GAAA,EACuC;AACvC,EAAA,IAAI,CAAC,GAAA,CAAI,QAAA,EAAU,OAAO,IAAA;AAC1B,EAAA,OAAO,+BAAA,CAAgC,IAAI,QAAQ,CAAA;AACrD;AAGO,SAAS,2BAA2B,QAAA,EAAoD;AAC7F,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,OAAO,IAAA;AAC/B,EAAA,OAAO,0BAAA,CAA2B,SAAS,QAAQ,CAAA;AACrD;AAGA,eAAsB,gCACpB,QAAA,EACuC;AACvC,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,OAAO,IAAA;AAC/B,EAAA,OAAO,+BAAA,CAAgC,SAAS,QAAQ,CAAA;AAC1D;AC3IO,IAAM,oBAAN,MAAwF;AAAA,EAC7F,QAAQ,KAAA,EAAyF;AAC/F,IAAA,OAAO,6BAA6B,KAAK,CAAA;AAAA,EAC3C;AAAA,EAEA,MAAA,CACE,MAAA,EACA,QAAA,EACA,IAAA,EACmB;AACnB,IAAA,OAAO,yBAAA,CAA0B,MAAA,EAAQ,QAAA,EAAU,IAAI,CAAA;AAAA,EACzD;AAAA,EAEA,mBAAA,CAAoB,SAA8B,IAAA,EAA4C;AAC5F,IAAA,OAAOA,0BAAAA,CAA2B,SAAS,IAAI,CAAA;AAAA,EACjD;AACF;AAGO,SAAS,qBAAqB,SAAA,EAA+C;AAClF,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,KAAA;AAAA,IACX,MAAA,EAAQ,OAAA;AAAA,IACR,QAAA,EAAU,oBAAA;AAAA,IACV,GAAG;AAAA,GACL;AACF;;;ACrCO,SAAS,yBAAyB,MAAA,EAA0B;AACjE,EAAA,OAAO,OACJ,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,EACnB,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,CAAC,CAAA;AAC/B;AAQO,SAAS,yBAAyB,UAAA,EAA8B;AACrE,EAAA,OAAO,UAAA,CAAW,KAAK,IAAI,CAAA;AAC7B;ACRA,IAAM,oBAAoB,GAAA,GAAM,IAAA;AAGhC,IAAM,oBAAA,GAAuB,GAAA;AAG7B,IAAM,mBAAA,GAAsB;AAAA,EAC1B,QAAA;AAAA;AAAA,EACA,OAAA;AAAA;AAAA,EACA,4BAAA;AAAA;AAAA,EACA,aAAA;AAAA;AAAA,EACA,aAAA;AAAA;AAAA,EACA,MAAA;AAAA;AAAA,EACA,OAAA;AAAA;AAAA,EACA,iBAAA;AAAA;AAAA,EACA,QAAA;AAAA;AAAA,EACA;AAAA;AACF,CAAA;AAkCA,SAAS,YAAY,EAAA,EAAqB;AACxC,EAAA,OAAO,oBAAoB,IAAA,CAAK,CAAC,YAAY,OAAA,CAAQ,IAAA,CAAK,EAAE,CAAC,CAAA;AAC/D;AAEA,SAAS,mBAAmB,QAAA,EAA2B;AACrD,EAAA,OAAO,QAAA,KAAa,WAAA,IAAe,QAAA,KAAa,WAAA,IAAe,QAAA,KAAa,KAAA;AAC9E;AAUA,eAAe,uBAAA,CAAwB,KAAa,OAAA,EAA0C;AAC5F,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAG1B,EAAA,IAAI,MAAA,CAAO,QAAA,IAAY,MAAA,CAAO,QAAA,EAAU;AACtC,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EAC1E;AAGA,EAAA,IAAI,MAAA,CAAO,aAAa,OAAA,EAAS;AAC/B,IAAA,IAAI,CAAC,OAAA,CAAQ,sBAAA,IAA0B,CAAC,kBAAA,CAAmB,MAAA,CAAO,QAAQ,CAAA,EAAG;AAC3E,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,kCAAA,EAAqC,OAAO,QAAQ,CAAA,mEAAA;AAAA,OAEtD;AAAA,IACF;AAAA,EACF,CAAA,MAAA,IAAW,MAAA,CAAO,QAAA,KAAa,QAAA,EAAU;AACvC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,MAAA,CAAO,QAAQ,CAAA,CAAE,CAAA;AAAA,EAC/D;AAGA,EAAA,IAAI,WAAA,CAAY,OAAO,QAAQ,CAAA,IAAK,CAAC,kBAAA,CAAmB,MAAA,CAAO,QAAQ,CAAA,EAAG;AACxE,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,MAAA,CAAO,QAAQ,CAAA,YAAA,CAAc,CAAA;AAAA,EAC3E;AAGA,EAAA,IAAI,QAAQ,eAAA,IAAmB,CAAC,kBAAA,CAAmB,MAAA,CAAO,QAAQ,CAAA,EAAG;AACnE,IAAA,MAAM,WAAA,GAAc,MAAM,OAAA,CAAQ,eAAA,CAAgB,OAAO,QAAQ,CAAA;AACjE,IAAA,KAAA,MAAW,MAAM,WAAA,EAAa;AAC5B,MAAA,IAAI,WAAA,CAAY,EAAE,CAAA,EAAG;AACnB,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,OAAO,QAAQ,CAAA,wBAAA,EAA2B,EAAE,CAAA,CAAE,CAAA;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;AAqBA,eAAsB,iBAAA,CACpB,OAAA,EACA,OAAA,GAA4B,EAAC,EACC;AAC9B,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC5C,EAAA,MAAM,KAAA,GAAQ,CAAC,8BAAA,EAAgC,yBAAyB,CAAA;AAExE,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,IAAA,EAAM,OAAO,EAAE,QAAA,EAAS;AAE5C,IAAA,IAAI;AACF,MAAA,MAAM,uBAAA,CAAwB,KAAK,OAAO,CAAA;AAE1C,MAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,GAAA,EAAK;AAAA,QAClC,MAAA,EAAQ,KAAA;AAAA,QACR,QAAA,EAAU,OAAA;AAAA;AAAA,QACV,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,oBAAoB;AAAA,OACjD,CAAA;AAED,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA;AAAA,MACF;AAGA,MAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC5D,MAAA,IACE,CAAC,YAAY,QAAA,CAAS,kBAAkB,KACxC,CAAC,WAAA,CAAY,KAAA,CAAM,iCAAiC,CAAA,EACpD;AACA,QAAA;AAAA,MACF;AAGA,MAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC3D,MAAA,IAAI,aAAA,IAAiB,QAAA,CAAS,aAAA,EAAe,EAAE,IAAI,iBAAA,EAAmB;AACpE,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,MAAA,IAAI,IAAA,CAAK,SAAS,iBAAA,EAAmB;AACnC,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAG5B,MAAA,IAAI,OAAO,IAAA,CAAK,IAAA,KAAS,YAAY,OAAO,IAAA,CAAK,QAAQ,QAAA,EAAU;AACjE,QAAA;AAAA,MACF;AAEA,MAAA,OAAO,IAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AAEN,MAAA;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAOO,SAAS,iBAAiB,IAAA,EAA6B;AAC5D,EAAA,MAAM,UAAA,GAAa,KAAK,YAAA,EAAc,UAAA;AACtC,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA,EAAG;AAC9B,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,UAAA,CAAW,IAAA;AAAA,IAChB,CAAC,QAAQ,OAAO,GAAA,KAAQ,YAAY,GAAA,KAAQ,IAAA,IAAQ,IAAI,GAAA,KAAQ;AAAA,GAClE;AACF;AAOO,SAAS,iBAAiB,IAAA,EAAmD;AAClF,EAAA,MAAM,UAAA,GAAa,KAAK,YAAA,EAAc,UAAA;AACtC,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA,EAAG;AAC9B,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,QAAQ,UAAA,CAAW,IAAA;AAAA,IACvB,CAAC,QAAQ,OAAO,GAAA,KAAQ,YAAY,GAAA,KAAQ,IAAA,IAAQ,IAAI,GAAA,KAAQ;AAAA,GAClE;AACA,EAAA,OAAQ,KAAA,IAAoC,IAAA;AAC9C;AA+BA,eAAsB,wBAAA,CACpB,OAAA,EACA,OAAA,GAA4B,EAAC,EACQ;AAErC,EAAA,MAAM,IAAA,GAAO,MAAM,iBAAA,CAAkB,OAAA,EAAS,OAAO,CAAA;AACrD,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,MAAM,GAAA,GAAM,iBAAiB,IAAI,CAAA;AACjC,IAAA,IAAI,GAAA,EAAK;AACP,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,YAAA;AAAA,QACR,KAAA,EAAO,GAAA,CAAI,MAAA,EAAQ,eAAA,IAAmB,CAAC,kBAAkB,CAAA;AAAA,QACzD,eAAA,EAAiB,GAAA,CAAI,MAAA,EAAQ,eAAA,IAAmB,CAAC,OAAO,CAAA;AAAA,QACxD,GAAI,GAAA,CAAI,MAAA,EAAQ,iBAAA,IAAqB;AAAA,UACnC,iBAAA,EAAmB,IAAI,MAAA,CAAO;AAAA;AAChC,OACF;AAAA,IACF;AAAA,EACF;AAGA,EAAA,MAAM,SAAA,GAAY,MAAM,qBAAA,CAAsB,OAAA,EAAS,OAAO,CAAA;AAC9D,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,OAAO,SAAA;AAAA,EACT;AAGA,EAAA,MAAM,WAAA,GAAc,MAAM,0BAAA,CAA2B,OAAA,EAAS,OAAO,CAAA;AACrE,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,OAAO,WAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA;AACT;AAKA,eAAe,qBAAA,CACb,SACA,OAAA,EACqC;AACrC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAC5C,EAAA,MAAM,MAAM,IAAI,GAAA,CAAI,wBAAA,EAA0B,OAAO,EAAE,QAAA,EAAS;AAEhE,EAAA,IAAI;AACF,IAAA,MAAM,uBAAA,CAAwB,KAAK,OAAO,CAAA;AAE1C,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,GAAA,EAAK;AAAA,MAClC,MAAA,EAAQ,KAAA;AAAA,MACR,QAAA,EAAU,OAAA;AAAA,MACV,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,oBAAoB;AAAA,KACjD,CAAA;AAED,IAAA,IAAI,CAAC,QAAA,CAAS,EAAA,EAAI,OAAO,IAAA;AAEzB,IAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC5D,IAAA,IACE,CAAC,YAAY,QAAA,CAAS,kBAAkB,KACxC,CAAC,WAAA,CAAY,KAAA,CAAM,iCAAiC,CAAA,EACpD;AACA,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC3D,IAAA,IAAI,aAAA,IAAiB,QAAA,CAAS,aAAA,EAAe,EAAE,IAAI,iBAAA,EAAmB;AACpE,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,IAAI,IAAA,CAAK,MAAA,GAAS,iBAAA,EAAmB,OAAO,IAAA;AAE5C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAE5B,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,YAAA;AAAA,MACR,KAAA,EAAO,MAAM,OAAA,CAAQ,IAAA,CAAK,eAAe,CAAA,GACpC,IAAA,CAAK,eAAA,GACN,CAAC,kBAAkB,CAAA;AAAA,MACvB,eAAA,EAAiB,MAAM,OAAA,CAAQ,IAAA,CAAK,eAAe,CAAA,GAC9C,IAAA,CAAK,eAAA,GACN,CAAC,OAAO,CAAA;AAAA,MACZ,GAAI,OAAO,IAAA,CAAK,iBAAA,KAAsB,QAAA,IAAY;AAAA,QAChD,mBAAmB,IAAA,CAAK;AAAA;AAC1B,KACF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAQA,eAAe,0BAAA,CACb,SACA,OAAA,EACqC;AACrC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAE5C,EAAA,IAAI;AACF,IAAA,MAAM,uBAAA,CAAwB,SAAS,OAAO,CAAA;AAE9C,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,OAAA,EAAS;AAAA,MACtC,MAAA,EAAQ,MAAA;AAAA,MACR,QAAA,EAAU,OAAA;AAAA,MACV,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,oBAAoB;AAAA,KACjD,CAAA;AAED,IAAA,MAAM,YAAY,CAAC,GAAG,SAAS,OAAA,CAAQ,IAAA,EAAM,CAAA,CAAE,IAAA;AAAA,MAC7C,CAAC,CAAA,KAAM,CAAA,CAAE,WAAA,EAAY,KAAM,oBAAoB,WAAA;AAAY,KAC7D;AAEA,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,cAAA;AAAA,QACR,KAAA,EAAO,CAAC,kBAAkB,CAAA;AAAA,QAC1B,eAAA,EAAiB,CAAC,OAAO;AAAA,OAC3B;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,OAAO,IAAA;AACT","file":"index.mjs","sourcesContent":["/**\n * Minimal A2A types from spec v0.3.0.\n *\n * These types are defined locally rather than importing @a2a-js/sdk,\n * which brings protobuf + gRPC + express peer dependencies that are\n * not needed for evidence placement.\n */\n\nimport type { CarrierFormat, PeacEvidenceCarrier, CarrierMeta } from '@peac/kernel';\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/** PEAC traceability extension URI for A2A metadata */\nexport const PEAC_EXTENSION_URI = 'https://www.peacprotocol.org/ext/traceability/v1' as const;\n\n/** Maximum carrier size for A2A metadata (64 KB) */\nexport const A2A_MAX_CARRIER_SIZE = 65_536;\n\n// ---------------------------------------------------------------------------\n// A2A Agent Card types (v0.3.0)\n// ---------------------------------------------------------------------------\n\n/** A2A extension entry in capabilities.extensions[] */\nexport interface AgentCardExtension {\n  uri: string;\n  description?: string;\n  required?: boolean;\n  params?: Record<string, unknown>;\n}\n\n/** PEAC-specific extension entry for A2A Agent Card */\nexport interface AgentCardPeacExtension {\n  uri: typeof PEAC_EXTENSION_URI;\n  description: string;\n  required: boolean;\n  params?: {\n    supported_kinds?: string[];\n    carrier_formats?: CarrierFormat[];\n    issuer_config_url?: string;\n  };\n}\n\n/** Minimal A2A Agent Card shape (v0.3.0) */\nexport interface A2AAgentCard {\n  name: string;\n  url: string;\n  capabilities?: {\n    extensions?: AgentCardExtension[];\n    [key: string]: unknown;\n  };\n  [key: string]: unknown;\n}\n\n// ---------------------------------------------------------------------------\n// A2A message types (minimal shapes)\n// ---------------------------------------------------------------------------\n\n/** A2A metadata map */\nexport type A2AMetadata = Record<string, unknown>;\n\n/** Minimal A2A TaskStatus shape */\nexport interface A2ATaskStatusLike {\n  state: string;\n  metadata?: A2AMetadata;\n  [key: string]: unknown;\n}\n\n/** Minimal A2A Message shape */\nexport interface A2AMessageLike {\n  role: string;\n  parts: unknown[];\n  metadata?: A2AMetadata;\n  [key: string]: unknown;\n}\n\n/** Minimal A2A Artifact shape */\nexport interface A2AArtifactLike {\n  artifactId: string;\n  parts: unknown[];\n  metadata?: A2AMetadata;\n  [key: string]: unknown;\n}\n\n// ---------------------------------------------------------------------------\n// Carrier payload type\n// ---------------------------------------------------------------------------\n\n/**\n * A2A carrier payload: the value stored under metadata[PEAC_EXTENSION_URI].\n *\n * Contains an array of carriers (even for single-receipt cases) and\n * optional transport metadata.\n */\nexport interface A2APeacPayload {\n  carriers: PeacEvidenceCarrier[];\n  meta?: CarrierMeta;\n}\n","/**\n * Attach PEAC evidence carriers to A2A metadata.\n *\n * Places carrier data under metadata[PEAC_EXTENSION_URI] per A2A v0.3.0\n * metadata convention. Uses computeReceiptRef() from @peac/schema\n * for receipt reference computation (correction item 4).\n */\n\nimport type { PeacEvidenceCarrier, CarrierMeta } from '@peac/kernel';\nimport { validateCarrierConstraints } from '@peac/schema';\n\nimport type {\n  A2AMetadata,\n  A2ATaskStatusLike,\n  A2AMessageLike,\n  A2AArtifactLike,\n  A2APeacPayload,\n} from './types';\nimport { PEAC_EXTENSION_URI, A2A_MAX_CARRIER_SIZE } from './types';\n\n// ---------------------------------------------------------------------------\n// Default meta for A2A transport\n// ---------------------------------------------------------------------------\n\nfunction defaultA2AMeta(): CarrierMeta {\n  return {\n    transport: 'a2a',\n    format: 'embed',\n    max_size: A2A_MAX_CARRIER_SIZE,\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Core attach: metadata map\n// ---------------------------------------------------------------------------\n\n/**\n * Attach PEAC evidence carrier(s) to an A2A metadata map.\n *\n * Writes `metadata[PEAC_EXTENSION_URI] = { carriers: [...], meta }`.\n * Validates carrier constraints before attachment; throws on violation.\n *\n * @returns The modified metadata map (mutated in place and returned)\n */\nexport function attachReceiptToMetadata(\n  metadata: A2AMetadata,\n  carriers: PeacEvidenceCarrier[],\n  meta?: CarrierMeta\n): A2AMetadata {\n  const effectiveMeta = meta ?? defaultA2AMeta();\n\n  for (const carrier of carriers) {\n    const result = validateCarrierConstraints(carrier, effectiveMeta);\n    if (!result.valid) {\n      throw new Error(`Carrier constraint violation: ${result.violations.join('; ')}`);\n    }\n  }\n\n  const payload: A2APeacPayload = { carriers, meta: effectiveMeta };\n  metadata[PEAC_EXTENSION_URI] = payload;\n  return metadata;\n}\n\n// ---------------------------------------------------------------------------\n// Convenience: attach to A2A message types\n// ---------------------------------------------------------------------------\n\n/**\n * Attach PEAC evidence carrier(s) to an A2A TaskStatus.\n * Initializes `metadata` if absent.\n */\nexport function attachReceiptToTaskStatus(\n  status: A2ATaskStatusLike,\n  carriers: PeacEvidenceCarrier[],\n  meta?: CarrierMeta\n): A2ATaskStatusLike {\n  if (!status.metadata) {\n    status.metadata = {};\n  }\n  attachReceiptToMetadata(status.metadata, carriers, meta);\n  return status;\n}\n\n/**\n * Attach PEAC evidence carrier(s) to an A2A Message.\n * Initializes `metadata` if absent.\n */\nexport function attachReceiptToMessage(\n  msg: A2AMessageLike,\n  carriers: PeacEvidenceCarrier[],\n  meta?: CarrierMeta\n): A2AMessageLike {\n  if (!msg.metadata) {\n    msg.metadata = {};\n  }\n  attachReceiptToMetadata(msg.metadata, carriers, meta);\n  return msg;\n}\n\n/**\n * Attach PEAC evidence carrier(s) to an A2A Artifact.\n * Initializes `metadata` if absent.\n */\nexport function attachReceiptToArtifact(\n  artifact: A2AArtifactLike,\n  carriers: PeacEvidenceCarrier[],\n  meta?: CarrierMeta\n): A2AArtifactLike {\n  if (!artifact.metadata) {\n    artifact.metadata = {};\n  }\n  attachReceiptToMetadata(artifact.metadata, carriers, meta);\n  return artifact;\n}\n","/**\n * Extract PEAC evidence carriers from A2A metadata.\n *\n * Reads carrier data from metadata[PEAC_EXTENSION_URI] and validates\n * against PeacEvidenceCarrierSchema. Provides both sync (structural)\n * and async (receipt_ref consistency) extraction paths per .\n */\n\nimport type { PeacEvidenceCarrier, CarrierMeta } from '@peac/kernel';\nimport { PeacEvidenceCarrierSchema, verifyReceiptRefConsistency } from '@peac/schema';\n\nimport type {\n  A2AMetadata,\n  A2ATaskStatusLike,\n  A2AMessageLike,\n  A2AArtifactLike,\n  A2APeacPayload,\n} from './types';\nimport { PEAC_EXTENSION_URI, A2A_MAX_CARRIER_SIZE } from './types';\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/** Result of carrier extraction */\nexport interface A2AExtractResult {\n  receipts: PeacEvidenceCarrier[];\n  meta: CarrierMeta;\n}\n\n/** Result of async extraction with consistency check */\nexport interface A2AExtractAsyncResult extends A2AExtractResult {\n  /** Consistency violations (empty if all receipts are valid) */\n  violations: string[];\n}\n\n// ---------------------------------------------------------------------------\n// Core extract: metadata map (sync, structural only)\n// ---------------------------------------------------------------------------\n\n/**\n * Extract PEAC evidence carriers from A2A metadata (sync).\n *\n * Performs structural validation only (schema check).\n * Returns null if no PEAC extension data is present.\n * Silently skips carriers that fail schema validation.\n */\nexport function extractReceiptFromMetadata(metadata: A2AMetadata): A2AExtractResult | null {\n  const raw = metadata[PEAC_EXTENSION_URI];\n  if (raw === undefined || raw === null) {\n    return null;\n  }\n\n  // Validate payload shape\n  if (typeof raw !== 'object' || !('carriers' in (raw as object))) {\n    return null;\n  }\n\n  const payload = raw as A2APeacPayload;\n  if (!Array.isArray(payload.carriers) || payload.carriers.length === 0) {\n    return null;\n  }\n\n  // Validate each carrier against schema (validate at extraction)\n  const validCarriers: PeacEvidenceCarrier[] = [];\n  for (const carrier of payload.carriers) {\n    const result = PeacEvidenceCarrierSchema.safeParse(carrier);\n    if (result.success) {\n      validCarriers.push(result.data as PeacEvidenceCarrier);\n    }\n  }\n\n  if (validCarriers.length === 0) {\n    return null;\n  }\n\n  const meta: CarrierMeta = payload.meta ?? {\n    transport: 'a2a',\n    format: 'embed',\n    max_size: A2A_MAX_CARRIER_SIZE,\n  };\n\n  return { receipts: validCarriers, meta };\n}\n\n/**\n * Extract PEAC evidence carriers from A2A metadata (async).\n *\n * Performs structural validation AND receipt_ref consistency check.\n * When receipt_jws is present, verifies sha256(receipt_jws) === receipt_ref.\n * Returns violations array for any carriers that fail the consistency check.\n */\nexport async function extractReceiptFromMetadataAsync(\n  metadata: A2AMetadata\n): Promise<A2AExtractAsyncResult | null> {\n  const syncResult = extractReceiptFromMetadata(metadata);\n  if (syncResult === null) {\n    return null;\n  }\n\n  const violations: string[] = [];\n  const validCarriers: PeacEvidenceCarrier[] = [];\n\n  for (const carrier of syncResult.receipts) {\n    const error = await verifyReceiptRefConsistency(carrier);\n    if (error !== null) {\n      violations.push(error);\n    } else {\n      validCarriers.push(carrier);\n    }\n  }\n\n  if (validCarriers.length === 0 && violations.length > 0) {\n    return { receipts: [], meta: syncResult.meta, violations };\n  }\n\n  return { receipts: validCarriers, meta: syncResult.meta, violations };\n}\n\n// ---------------------------------------------------------------------------\n// Convenience: extract from A2A message types\n// ---------------------------------------------------------------------------\n\n/** Extract carriers from A2A TaskStatus (sync) */\nexport function extractReceiptFromTaskStatus(status: A2ATaskStatusLike): A2AExtractResult | null {\n  if (!status.metadata) return null;\n  return extractReceiptFromMetadata(status.metadata);\n}\n\n/** Extract carriers from A2A TaskStatus (async) */\nexport async function extractReceiptFromTaskStatusAsync(\n  status: A2ATaskStatusLike\n): Promise<A2AExtractAsyncResult | null> {\n  if (!status.metadata) return null;\n  return extractReceiptFromMetadataAsync(status.metadata);\n}\n\n/** Extract carriers from A2A Message (sync) */\nexport function extractReceiptFromMessage(msg: A2AMessageLike): A2AExtractResult | null {\n  if (!msg.metadata) return null;\n  return extractReceiptFromMetadata(msg.metadata);\n}\n\n/** Extract carriers from A2A Message (async) */\nexport async function extractReceiptFromMessageAsync(\n  msg: A2AMessageLike\n): Promise<A2AExtractAsyncResult | null> {\n  if (!msg.metadata) return null;\n  return extractReceiptFromMetadataAsync(msg.metadata);\n}\n\n/** Extract carriers from A2A Artifact (sync) */\nexport function extractReceiptFromArtifact(artifact: A2AArtifactLike): A2AExtractResult | null {\n  if (!artifact.metadata) return null;\n  return extractReceiptFromMetadata(artifact.metadata);\n}\n\n/** Extract carriers from A2A Artifact (async) */\nexport async function extractReceiptFromArtifactAsync(\n  artifact: A2AArtifactLike\n): Promise<A2AExtractAsyncResult | null> {\n  if (!artifact.metadata) return null;\n  return extractReceiptFromMetadataAsync(artifact.metadata);\n}\n","/**\n * A2A carrier adapter implementing CarrierAdapter<A2ATaskStatusLike, A2ATaskStatusLike>.\n *\n * Bridges PeacEvidenceCarrier to A2A TaskStatus metadata per .\n */\n\nimport type {\n  PeacEvidenceCarrier,\n  CarrierMeta,\n  CarrierValidationResult,\n  CarrierAdapter,\n} from '@peac/kernel';\nimport { validateCarrierConstraints } from '@peac/schema';\n\nimport type { A2ATaskStatusLike } from './types';\nimport { A2A_MAX_CARRIER_SIZE } from './types';\nimport { attachReceiptToTaskStatus } from './attach';\nimport { extractReceiptFromTaskStatus } from './extract';\n\n/**\n * CarrierAdapter implementation for A2A TaskStatus messages.\n *\n * Uses metadata[PEAC_EXTENSION_URI] = { carriers: [...] } layout.\n */\nexport class A2ACarrierAdapter implements CarrierAdapter<A2ATaskStatusLike, A2ATaskStatusLike> {\n  extract(input: A2ATaskStatusLike): { receipts: PeacEvidenceCarrier[]; meta: CarrierMeta } | null {\n    return extractReceiptFromTaskStatus(input);\n  }\n\n  attach(\n    output: A2ATaskStatusLike,\n    carriers: PeacEvidenceCarrier[],\n    meta?: CarrierMeta\n  ): A2ATaskStatusLike {\n    return attachReceiptToTaskStatus(output, carriers, meta);\n  }\n\n  validateConstraints(carrier: PeacEvidenceCarrier, meta: CarrierMeta): CarrierValidationResult {\n    return validateCarrierConstraints(carrier, meta);\n  }\n}\n\n/** Default CarrierMeta for A2A transport */\nexport function createA2ACarrierMeta(overrides?: Partial<CarrierMeta>): CarrierMeta {\n  return {\n    transport: 'a2a',\n    format: 'embed',\n    max_size: A2A_MAX_CARRIER_SIZE,\n    ...overrides,\n  };\n}\n","/**\n * A2A extension header utilities.\n *\n * Handles the A2A-Extensions header for advertising supported extensions\n * per (no X- prefix headers).\n */\n\n/**\n * Parse comma-separated A2A extension URIs from header value.\n *\n * @param header - Raw header value (e.g. \"https://example.com/ext/a, https://example.com/ext/b\")\n * @returns Array of trimmed, non-empty extension URIs\n */\nexport function parseA2AExtensionsHeader(header: string): string[] {\n  return header\n    .split(',')\n    .map((s) => s.trim())\n    .filter((s) => s.length > 0);\n}\n\n/**\n * Build comma-separated A2A-Extensions header value from URIs.\n *\n * @param extensions - Array of extension URIs\n * @returns Comma-separated header value\n */\nexport function buildA2AExtensionsHeader(extensions: string[]): string {\n  return extensions.join(', ');\n}\n","/**\n * A2A agent discovery with SSRF hardening (Polish C).\n *\n * Discovers A2A Agent Cards and checks for PEAC extension support.\n * Implements literal-IP blocking, optional DNS resolution checks,\n * scheme allowlist, userinfo rejection, response size cap,\n * content-type check, and redirect rejection.\n */\n\nimport type { CarrierFormat } from '@peac/kernel';\nimport { PEAC_RECEIPT_HEADER } from '@peac/kernel';\n\nimport type { A2AAgentCard, AgentCardPeacExtension } from './types';\nimport { PEAC_EXTENSION_URI } from './types';\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/** Maximum response body size (256 KB) */\nconst MAX_RESPONSE_SIZE = 256 * 1024;\n\n/** Request timeout in milliseconds */\nconst DISCOVERY_TIMEOUT_MS = 5_000;\n\n/** Private/reserved IP ranges (RFC 1918, RFC 4193, loopback, link-local) */\nconst PRIVATE_IP_PATTERNS = [\n  /^127\\./, // loopback\n  /^10\\./, // RFC 1918 Class A\n  /^172\\.(1[6-9]|2\\d|3[01])\\./, // RFC 1918 Class B\n  /^192\\.168\\./, // RFC 1918 Class C\n  /^169\\.254\\./, // link-local\n  /^0\\./, // current network\n  /^::1$/, // IPv6 loopback\n  /^fd[0-9a-f]{2}:/, // RFC 4193 ULA\n  /^fe80:/, // IPv6 link-local\n  /^fc[0-9a-f]{2}:/, // RFC 4193 ULA\n];\n\n// ---------------------------------------------------------------------------\n// Options\n// ---------------------------------------------------------------------------\n\n/** Discovery options */\nexport interface DiscoveryOptions {\n  /**\n   * Allow HTTP (insecure) for localhost addresses only (dev mode).\n   * Default: false (HTTPS only in production).\n   */\n  allowInsecureLocalhost?: boolean;\n\n  /** Custom fetch implementation (for testing or strict environments) */\n  fetch?: typeof globalThis.fetch;\n\n  /**\n   * Optional DNS resolver for DNS rebinding defense.\n   *\n   * When provided, discovery resolves the hostname and checks all returned\n   * IP addresses against private ranges before connecting. This provides\n   * full DNS rebinding protection.\n   *\n   * When omitted, discovery checks only literal IP addresses in the URL\n   * hostname (weaker posture, but portable across runtimes).\n   */\n  resolveHostname?: (hostname: string) => Promise<string[]>;\n}\n\n// ---------------------------------------------------------------------------\n// SSRF helpers\n// ---------------------------------------------------------------------------\n\nfunction isPrivateIP(ip: string): boolean {\n  return PRIVATE_IP_PATTERNS.some((pattern) => pattern.test(ip));\n}\n\nfunction isLocalhostAddress(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1';\n}\n\n/**\n * Validate URL scheme, hostname, and credentials for SSRF protection.\n *\n * - Only HTTPS in production (Polish C item 6)\n * - HTTP allowed only for localhost when allowInsecureLocalhost is true\n * - Rejects private IP ranges (literal check always; DNS resolution when resolver provided)\n * - Rejects URLs with userinfo (user:pass@host) to prevent confusion in allowlists\n */\nasync function validateUrlForDiscovery(url: string, options: DiscoveryOptions): Promise<void> {\n  const parsed = new URL(url);\n\n  // Reject URLs with userinfo (user:pass@host)\n  if (parsed.username || parsed.password) {\n    throw new Error('SSRF: URLs with userinfo (credentials) are not allowed');\n  }\n\n  // Scheme allowlist (Polish C item 6)\n  if (parsed.protocol === 'http:') {\n    if (!options.allowInsecureLocalhost || !isLocalhostAddress(parsed.hostname)) {\n      throw new Error(\n        `SSRF: HTTP scheme not allowed for ${parsed.hostname}. ` +\n          'Use HTTPS or enable allowInsecureLocalhost for local development.'\n      );\n    }\n  } else if (parsed.protocol !== 'https:') {\n    throw new Error(`SSRF: unsupported scheme ${parsed.protocol}`);\n  }\n\n  // Check for private IP in hostname (literal IP check)\n  if (isPrivateIP(parsed.hostname) && !isLocalhostAddress(parsed.hostname)) {\n    throw new Error(`SSRF: private IP address ${parsed.hostname} not allowed`);\n  }\n\n  // DNS rebinding defense: resolve hostname and check all IPs (when resolver provided)\n  if (options.resolveHostname && !isLocalhostAddress(parsed.hostname)) {\n    const resolvedIPs = await options.resolveHostname(parsed.hostname);\n    for (const ip of resolvedIPs) {\n      if (isPrivateIP(ip)) {\n        throw new Error(`SSRF: hostname ${parsed.hostname} resolved to private IP ${ip}`);\n      }\n    }\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Core discovery\n// ---------------------------------------------------------------------------\n\n/**\n * Discover A2A Agent Card from a base URL.\n *\n * Tries `/.well-known/agent-card.json` first, then `/.well-known/agent.json`\n * as a legacy fallback per A2A v0.3.0.\n *\n * SSRF protection per Polish C:\n * 1. Private IP blocking (literal check; DNS resolution when resolveHostname provided)\n * 2. Response size cap (256 KB)\n * 3. Content-Type check (application/json)\n * 4. Redirect rejection (redirect: \"error\")\n * 5. Timeout (5 seconds)\n * 6. Scheme allowlist (HTTPS only; HTTP for localhost dev only)\n * 7. Userinfo rejection (no credentials in URLs)\n */\nexport async function discoverAgentCard(\n  baseUrl: string,\n  options: DiscoveryOptions = {}\n): Promise<A2AAgentCard | null> {\n  const fetchFn = options.fetch ?? globalThis.fetch;\n  const paths = ['/.well-known/agent-card.json', '/.well-known/agent.json'];\n\n  for (const path of paths) {\n    const url = new URL(path, baseUrl).toString();\n\n    try {\n      await validateUrlForDiscovery(url, options);\n\n      const response = await fetchFn(url, {\n        method: 'GET',\n        redirect: 'error', // Polish C item 4\n        signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),\n      });\n\n      if (!response.ok) {\n        continue;\n      }\n\n      // Content-Type check (Polish C item 3)\n      const contentType = response.headers.get('content-type') ?? '';\n      if (\n        !contentType.includes('application/json') &&\n        !contentType.match(/application\\/[a-z0-9.+-]*\\+json/)\n      ) {\n        continue;\n      }\n\n      // Response size cap (Polish C item 2)\n      const contentLength = response.headers.get('content-length');\n      if (contentLength && parseInt(contentLength, 10) > MAX_RESPONSE_SIZE) {\n        continue;\n      }\n\n      const text = await response.text();\n      if (text.length > MAX_RESPONSE_SIZE) {\n        continue;\n      }\n\n      const card = JSON.parse(text) as A2AAgentCard;\n\n      // Basic validation: must have name and url\n      if (typeof card.name !== 'string' || typeof card.url !== 'string') {\n        continue;\n      }\n\n      return card;\n    } catch {\n      // SSRF validation errors, network errors, parse errors: try next path\n      continue;\n    }\n  }\n\n  return null;\n}\n\n/**\n * Check if an A2A Agent Card advertises PEAC extension support.\n *\n * Looks for the PEAC extension URI in capabilities.extensions[].\n */\nexport function hasPeacExtension(card: A2AAgentCard): boolean {\n  const extensions = card.capabilities?.extensions;\n  if (!Array.isArray(extensions)) {\n    return false;\n  }\n  return extensions.some(\n    (ext) => typeof ext === 'object' && ext !== null && ext.uri === PEAC_EXTENSION_URI\n  );\n}\n\n/**\n * Extract PEAC extension parameters from an A2A Agent Card.\n *\n * Returns the PEAC extension entry or null if not present.\n */\nexport function getPeacExtension(card: A2AAgentCard): AgentCardPeacExtension | null {\n  const extensions = card.capabilities?.extensions;\n  if (!Array.isArray(extensions)) {\n    return null;\n  }\n  const entry = extensions.find(\n    (ext) => typeof ext === 'object' && ext !== null && ext.uri === PEAC_EXTENSION_URI\n  );\n  return (entry as AgentCardPeacExtension) ?? null;\n}\n\n// ---------------------------------------------------------------------------\n// PEAC discovery result\n// ---------------------------------------------------------------------------\n\n/** Source of PEAC capability discovery */\nexport type PeacDiscoverySource = 'agent_card' | 'well_known' | 'header_probe';\n\n/** Result of PEAC capability discovery */\nexport interface PeacDiscoveryResult {\n  source: PeacDiscoverySource;\n  kinds: string[];\n  carrier_formats: CarrierFormat[];\n  issuer_config_url?: string;\n}\n\n// ---------------------------------------------------------------------------\n// 3-step discovery\n// ---------------------------------------------------------------------------\n\n/**\n * Discover PEAC capabilities from a base URL using a 3-step algorithm:\n *\n * 1. Agent Card: check `/.well-known/agent-card.json` for PEAC extension\n * 2. Well-known: check `/.well-known/peac.json` (standalone PEAC discovery)\n * 3. Header probe: HEAD request to base URL, check for `PEAC-Receipt` header\n *\n * Returns the first successful result or null if PEAC is not supported.\n * All steps apply SSRF protections per Polish C.\n */\nexport async function discoverPeacCapabilities(\n  baseUrl: string,\n  options: DiscoveryOptions = {}\n): Promise<PeacDiscoveryResult | null> {\n  // Step 1: Agent Card\n  const card = await discoverAgentCard(baseUrl, options);\n  if (card) {\n    const ext = getPeacExtension(card);\n    if (ext) {\n      return {\n        source: 'agent_card',\n        kinds: ext.params?.supported_kinds ?? ['peac-receipt/0.1'],\n        carrier_formats: ext.params?.carrier_formats ?? ['embed'],\n        ...(ext.params?.issuer_config_url && {\n          issuer_config_url: ext.params.issuer_config_url,\n        }),\n      };\n    }\n  }\n\n  // Step 2: /.well-known/peac.json\n  const wellKnown = await discoverPeacWellKnown(baseUrl, options);\n  if (wellKnown) {\n    return wellKnown;\n  }\n\n  // Step 3: Header probe\n  const headerProbe = await discoverPeacViaHeaderProbe(baseUrl, options);\n  if (headerProbe) {\n    return headerProbe;\n  }\n\n  return null;\n}\n\n/**\n * Step 2: Discover PEAC support via `/.well-known/peac.json`.\n */\nasync function discoverPeacWellKnown(\n  baseUrl: string,\n  options: DiscoveryOptions\n): Promise<PeacDiscoveryResult | null> {\n  const fetchFn = options.fetch ?? globalThis.fetch;\n  const url = new URL('/.well-known/peac.json', baseUrl).toString();\n\n  try {\n    await validateUrlForDiscovery(url, options);\n\n    const response = await fetchFn(url, {\n      method: 'GET',\n      redirect: 'error',\n      signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),\n    });\n\n    if (!response.ok) return null;\n\n    const contentType = response.headers.get('content-type') ?? '';\n    if (\n      !contentType.includes('application/json') &&\n      !contentType.match(/application\\/[a-z0-9.+-]*\\+json/)\n    ) {\n      return null;\n    }\n\n    const contentLength = response.headers.get('content-length');\n    if (contentLength && parseInt(contentLength, 10) > MAX_RESPONSE_SIZE) {\n      return null;\n    }\n\n    const text = await response.text();\n    if (text.length > MAX_RESPONSE_SIZE) return null;\n\n    const data = JSON.parse(text) as Record<string, unknown>;\n\n    return {\n      source: 'well_known',\n      kinds: Array.isArray(data.supported_kinds)\n        ? (data.supported_kinds as string[])\n        : ['peac-receipt/0.1'],\n      carrier_formats: Array.isArray(data.carrier_formats)\n        ? (data.carrier_formats as CarrierFormat[])\n        : ['embed'],\n      ...(typeof data.issuer_config_url === 'string' && {\n        issuer_config_url: data.issuer_config_url,\n      }),\n    };\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Step 3: Discover PEAC support via header probe.\n *\n * Sends a HEAD request and checks for the presence of a PEAC-Receipt header.\n * This is a lightweight probe; it indicates support but provides minimal detail.\n */\nasync function discoverPeacViaHeaderProbe(\n  baseUrl: string,\n  options: DiscoveryOptions\n): Promise<PeacDiscoveryResult | null> {\n  const fetchFn = options.fetch ?? globalThis.fetch;\n\n  try {\n    await validateUrlForDiscovery(baseUrl, options);\n\n    const response = await fetchFn(baseUrl, {\n      method: 'HEAD',\n      redirect: 'error',\n      signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),\n    });\n\n    const headerKey = [...response.headers.keys()].find(\n      (k) => k.toLowerCase() === PEAC_RECEIPT_HEADER.toLowerCase()\n    );\n\n    if (headerKey) {\n      return {\n        source: 'header_probe',\n        kinds: ['peac-receipt/0.1'],\n        carrier_formats: ['embed'],\n      };\n    }\n  } catch {\n    // Network errors, SSRF: no PEAC support detected\n  }\n\n  return null;\n}\n"]}

package/dist/types.d.ts

@@ -1,5 +1,5 @@
 /**
- * Minimal A2A types from spec v0.3.0 (DD-126).
+ * Minimal A2A types from spec v0.3.0.
  *
  * These types are defined locally rather than importing @a2a-js/sdk,
  * which brings protobuf + gRPC + express peer dependencies that are
@@ -8,7 +8,7 @@
 import type { CarrierFormat, PeacEvidenceCarrier, CarrierMeta } from '@peac/kernel';
 /** PEAC traceability extension URI for A2A metadata */
 export declare const PEAC_EXTENSION_URI: "https://www.peacprotocol.org/ext/traceability/v1";
-/** Maximum carrier size for A2A metadata (64 KB, DD-127) */
+/** Maximum carrier size for A2A metadata (64 KB) */
 export declare const A2A_MAX_CARRIER_SIZE = 65536;
 /** A2A extension entry in capabilities.extensions[] */
 export interface AgentCardExtension {

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAMpF,uDAAuD;AACvD,eAAO,MAAM,kBAAkB,EAAG,kDAA2D,CAAC;AAE9F,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAM3C,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,uDAAuD;AACvD,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,OAAO,kBAAkB,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE;QACP,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC;QAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH;AAED,4CAA4C;AAC5C,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE;QACb,UAAU,CAAC,EAAE,kBAAkB,EAAE,CAAC;QAClC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAMD,uBAAuB;AACvB,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAElD,mCAAmC;AACnC,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,gCAAgC;AAChC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,iCAAiC;AACjC,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAMD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAMpF,uDAAuD;AACvD,eAAO,MAAM,kBAAkB,EAAG,kDAA2D,CAAC;AAE9F,oDAAoD;AACpD,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAM3C,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,uDAAuD;AACvD,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,OAAO,kBAAkB,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE;QACP,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC;QAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH;AAED,4CAA4C;AAC5C,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE;QACb,UAAU,CAAC,EAAE,kBAAkB,EAAE,CAAC;QAClC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAMD,uBAAuB;AACvB,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAElD,mCAAmC;AACnC,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,gCAAgC;AAChC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,iCAAiC;AACjC,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAMD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peac/mappings-a2a",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "description": "Agent-to-Agent Protocol (A2A) integration for PEAC",
   "main": "dist/index.cjs",
   "types": "dist/index.d.ts",
@@ -23,8 +23,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@peac/kernel": "0.12.1",
-    "@peac/schema": "0.12.1"
+    "@peac/kernel": "0.12.2",
+    "@peac/schema": "0.12.2"
   },
   "devDependencies": {
     "@types/node": "^22.19.11",