handoffprobe 0.1.0

package/dist/p0-fixture/a2a/executor.d.ts

@@ -0,0 +1,22 @@
+import type { AgentExecutor, ExecutionEventBus, RequestContext } from '@a2a-js/sdk/server';
+import type { HandoffAdapter, SecurityContext } from '../../core/index.js';
+import type { EvidenceRecorder } from '../../protocol-lab/evidence.js';
+import type { P0EnforcementMode, P0McpExecutionResult } from '../mcp/types.js';
+import type { P0Scenario } from '../scenario.js';
+import type { P0FixtureState } from '../state.js';
+export interface P0A2aRunState {
+    translatedContext?: SecurityContext;
+    mcpResult?: P0McpExecutionResult;
+}
+export declare class P0A2aExecutor implements AgentExecutor {
+    private readonly handoffAdapter;
+    private readonly scenario;
+    private readonly enforcementMode;
+    private readonly recorder;
+    private readonly fixtureState;
+    private readonly runState;
+    constructor(handoffAdapter: HandoffAdapter, scenario: P0Scenario, enforcementMode: P0EnforcementMode, recorder: EvidenceRecorder, fixtureState: P0FixtureState, runState: P0A2aRunState);
+    execute(requestContext: RequestContext, eventBus: ExecutionEventBus): Promise<void>;
+    cancelTask(): Promise<void>;
+}
+//# sourceMappingURL=executor.d.ts.map

package/dist/p0-fixture/a2a/executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../../src/p0-fixture/a2a/executor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAG3F,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAGvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,WAAW,aAAa;IAC5B,iBAAiB,CAAC,EAAE,eAAe,CAAC;IAEpC,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAkDD,qBAAa,aAAc,YAAW,aAAa;IAE/C,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBALR,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,UAAU,EACpB,eAAe,EAAE,iBAAiB,EAClC,QAAQ,EAAE,gBAAgB,EAC1B,YAAY,EAAE,cAAc,EAC5B,QAAQ,EAAE,aAAa;IAGpC,OAAO,CAAC,cAAc,EAAE,cAAc,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IA8LzF,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAG5B"}

package/dist/p0-fixture/a2a/executor.js

@@ -0,0 +1,183 @@
+import { Role } from '@a2a-js/sdk';
+import { AgentEvent } from '@a2a-js/sdk/server';
+import { cloneSecurityContext } from '../../core/index.js';
+import { P0_MCP_AUDIENCE } from '../constants.js';
+import { callP0ToolThroughMcp } from '../mcp/harness.js';
+function readContext(value) {
+    if (typeof value !== 'object' || value === null) {
+        throw new Error('A2A request has no P0 security context.');
+    }
+    const candidate = value;
+    const requiredStrings = ['principal', 'caller', 'downstream', 'tenant', 'resource'];
+    for (const key of requiredStrings) {
+        if (typeof candidate[key] !== 'string') {
+            throw new Error(`Invalid P0 security-context field: ${key}`);
+        }
+    }
+    if (!Array.isArray(candidate.capabilities) ||
+        !candidate.capabilities.every((item) => typeof item === 'string')) {
+        throw new Error('Invalid P0 security-context capabilities.');
+    }
+    return cloneSecurityContext(candidate);
+}
+function createTextMessage(messageId, contextId, text) {
+    return {
+        messageId,
+        contextId,
+        taskId: '',
+        role: Role.ROLE_AGENT,
+        metadata: undefined,
+        extensions: [],
+        referenceTaskIds: [],
+        parts: [
+            {
+                content: {
+                    $case: 'text',
+                    value: text,
+                },
+                mediaType: 'application/json',
+                filename: '',
+                metadata: undefined,
+            },
+        ],
+    };
+}
+export class P0A2aExecutor {
+    handoffAdapter;
+    scenario;
+    enforcementMode;
+    recorder;
+    fixtureState;
+    runState;
+    constructor(handoffAdapter, scenario, enforcementMode, recorder, fixtureState, runState) {
+        this.handoffAdapter = handoffAdapter;
+        this.scenario = scenario;
+        this.enforcementMode = enforcementMode;
+        this.recorder = recorder;
+        this.fixtureState = fixtureState;
+        this.runState = runState;
+    }
+    async execute(requestContext, eventBus) {
+        const original = readContext(requestContext.request.metadata?.handoffprobeContext);
+        this.recorder.record({
+            protocol: 'A2A',
+            protocolVersion: '1.0',
+            boundary: 'a2a-rest -> p0-agent-executor',
+            event: 'a2a.receiver.receive',
+            context: original,
+            details: {
+                messageId: requestContext.userMessage.messageId,
+                scenarioId: this.scenario.id,
+            },
+        });
+        const translated = await this.handoffAdapter.translate(original);
+        this.runState.translatedContext = cloneSecurityContext(translated);
+        this.recorder.record({
+            protocol: 'HANDOFF',
+            protocolVersion: 'handoffprobe-p0-v1',
+            boundary: 'a2a-receiver -> p0-mcp-client',
+            event: 'handoff.translate',
+            context: translated,
+            details: {
+                handoffAdapter: this.handoffAdapter.id,
+                scenarioId: this.scenario.id,
+                selectedTool: this.scenario.tool,
+                originalPrincipal: original.principal,
+                translatedPrincipal: translated.principal,
+                originalDownstream: original.downstream,
+                translatedDownstream: translated.downstream,
+                originalTenant: original.tenant,
+                translatedTenant: translated.tenant,
+                originalResource: original.resource,
+                translatedResource: translated.resource,
+                upstreamAuthority: original.upstreamAuthority,
+                translatedAuthority: translated.effectiveAuthority,
+                upstreamCredential: original.upstreamCredential,
+                forwardedCredential: translated.forwardedCredential,
+                lifecycle: translated.lifecycle,
+            },
+        });
+        const downstreamAudience = this.scenario.mcpAudience ?? P0_MCP_AUDIENCE;
+        const mcpContext = cloneSecurityContext(translated);
+        const requestedCredential = translated.forwardedCredential;
+        /*
+         * Upstream credential metadata belongs to
+         * the upstream boundary and must never be
+         * copied into MCP implicitly.
+         */
+        delete mcpContext.upstreamCredential;
+        if (requestedCredential !== undefined) {
+            const audienceMatches = requestedCredential.audience === downstreamAudience;
+            const blockedBySecurePolicy = this.enforcementMode === 'enforce' &&
+                (requestedCredential.credentialClass === 'bearer' || !audienceMatches);
+            if (blockedBySecurePolicy) {
+                delete mcpContext.forwardedCredential;
+            }
+            this.recorder.record({
+                protocol: 'HANDOFF',
+                protocolVersion: 'handoffprobe-p0-v1',
+                boundary: 'handoff-credential-policy -> p0-mcp-client',
+                event: 'p0.credential.forwarding',
+                context: mcpContext,
+                details: {
+                    credentialFingerprint: requestedCredential.fingerprint,
+                    credentialClass: requestedCredential.credentialClass,
+                    originalAudience: requestedCredential.audience,
+                    downstreamAudience,
+                    audienceMatches,
+                    forwardingDecision: blockedBySecurePolicy ? 'blocked' : 'forwarded',
+                },
+            });
+        }
+        if (this.scenario.lifecycleTracking === true) {
+            const lifecycle = mcpContext.lifecycle;
+            if (lifecycle === undefined) {
+                throw new Error('Lifecycle tracking requested without lifecycle context.');
+            }
+            this.recorder.record({
+                protocol: 'CORE',
+                protocolVersion: 'p0-lifecycle-v1',
+                boundary: 'a2a-task -> downstream-operation',
+                event: 'lifecycle.start',
+                context: mcpContext,
+                details: {
+                    taskId: lifecycle.taskId,
+                    state: lifecycle.state,
+                    sideEffectCounterBefore: this.fixtureState.sideEffectCounter,
+                },
+            });
+        }
+        const argumentsForTool = this.scenario.buildArguments(mcpContext);
+        const mcpResult = await callP0ToolThroughMcp({
+            context: mcpContext,
+            recorder: this.recorder,
+            state: this.fixtureState,
+            mode: this.enforcementMode,
+            audience: downstreamAudience,
+            cancelLifecycleBeforeTool: this.scenario.cancelLifecycleBeforeTool ?? false,
+            tool: this.scenario.tool,
+            arguments: argumentsForTool,
+        });
+        this.runState.mcpResult = mcpResult;
+        const responseText = JSON.stringify(mcpResult.envelope);
+        this.recorder.record({
+            protocol: 'A2A',
+            protocolVersion: '1.0',
+            boundary: 'p0-agent-executor -> a2a-rest',
+            event: 'a2a.receiver.respond',
+            context: translated,
+            details: {
+                scenarioId: this.scenario.id,
+                selectedTool: this.scenario.tool,
+                authorizationResult: mcpResult.envelope.authorization.invariantAllowed,
+                executed: mcpResult.envelope.authorization.executed,
+            },
+        });
+        eventBus.publish(AgentEvent.message(createTextMessage(`${this.recorder.runId}-response`, requestContext.contextId, responseText)));
+        eventBus.finished();
+    }
+    cancelTask() {
+        return Promise.resolve();
+    }
+}
+//# sourceMappingURL=executor.js.map

package/dist/p0-fixture/a2a/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../src/p0-fixture/a2a/executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAWzD,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,SAAS,GAAG,KAAgC,CAAC;IAEnD,MAAM,eAAe,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAU,CAAC;IAE7F,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,OAAO,SAAS,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC;QACtC,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EACjE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,oBAAoB,CAAC,SAAuC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB,EAAE,SAAiB,EAAE,IAAY;IAC3E,OAAO;QACL,SAAS;QACT,SAAS;QACT,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,IAAI,CAAC,UAAU;QACrB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,EAAE;QACd,gBAAgB,EAAE,EAAE;QACpB,KAAK,EAAE;YACL;gBACE,OAAO,EAAE;oBACP,KAAK,EAAE,MAAM;oBACb,KAAK,EAAE,IAAI;iBACZ;gBACD,SAAS,EAAE,kBAAkB;gBAC7B,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,SAAS;aACpB;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,aAAa;IAEL;IACA;IACA;IACA;IACA;IACA;IANnB,YACmB,cAA8B,EAC9B,QAAoB,EACpB,eAAkC,EAClC,QAA0B,EAC1B,YAA4B,EAC5B,QAAuB;QALvB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,aAAQ,GAAR,QAAQ,CAAY;QACpB,oBAAe,GAAf,eAAe,CAAmB;QAClC,aAAQ,GAAR,QAAQ,CAAkB;QAC1B,iBAAY,GAAZ,YAAY,CAAgB;QAC5B,aAAQ,GAAR,QAAQ,CAAe;IACvC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,cAA8B,EAAE,QAA2B;QACvE,MAAM,QAAQ,GAAG,WAAW,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QAEnF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,KAAK;YACf,eAAe,EAAE,KAAK;YACtB,QAAQ,EAAE,+BAA+B;YACzC,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE;gBACP,SAAS,EAAE,cAAc,CAAC,WAAW,CAAC,SAAS;gBAC/C,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;aAC7B;SACF,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAEjE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAEnE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,SAAS;YACnB,eAAe,EAAE,oBAAoB;YACrC,QAAQ,EAAE,+BAA+B;YACzC,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,UAAU;YACnB,OAAO,EAAE;gBACP,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE;gBAEtC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAE5B,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;gBAEhC,iBAAiB,EAAE,QAAQ,CAAC,SAAS;gBAErC,mBAAmB,EAAE,UAAU,CAAC,SAAS;gBAEzC,kBAAkB,EAAE,QAAQ,CAAC,UAAU;gBAEvC,oBAAoB,EAAE,UAAU,CAAC,UAAU;gBAE3C,cAAc,EAAE,QAAQ,CAAC,MAAM;gBAE/B,gBAAgB,EAAE,UAAU,CAAC,MAAM;gBAEnC,gBAAgB,EAAE,QAAQ,CAAC,QAAQ;gBAEnC,kBAAkB,EAAE,UAAU,CAAC,QAAQ;gBAEvC,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;gBAE7C,mBAAmB,EAAE,UAAU,CAAC,kBAAkB;gBAElD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;gBAE/C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;gBAEnD,SAAS,EAAE,UAAU,CAAC,SAAS;aAChC;SACF,CAAC,CAAC;QAEH,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,eAAe,CAAC;QAExE,MAAM,UAAU,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAEpD,MAAM,mBAAmB,GAAG,UAAU,CAAC,mBAAmB,CAAC;QAE3D;;;;WAIG;QACH,OAAO,UAAU,CAAC,kBAAkB,CAAC;QAErC,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,eAAe,GAAG,mBAAmB,CAAC,QAAQ,KAAK,kBAAkB,CAAC;YAE5E,MAAM,qBAAqB,GACzB,IAAI,CAAC,eAAe,KAAK,SAAS;gBAClC,CAAC,mBAAmB,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,CAAC;YAEzE,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,OAAO,UAAU,CAAC,mBAAmB,CAAC;YACxC,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACnB,QAAQ,EAAE,SAAS;gBAEnB,eAAe,EAAE,oBAAoB;gBAErC,QAAQ,EAAE,4CAA4C;gBAEtD,KAAK,EAAE,0BAA0B;gBAEjC,OAAO,EAAE,UAAU;gBAEnB,OAAO,EAAE;oBACP,qBAAqB,EAAE,mBAAmB,CAAC,WAAW;oBAEtD,eAAe,EAAE,mBAAmB,CAAC,eAAe;oBAEpD,gBAAgB,EAAE,mBAAmB,CAAC,QAAQ;oBAE9C,kBAAkB;oBAElB,eAAe;oBAEf,kBAAkB,EAAE,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;iBACpE;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YAC7C,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;YAEvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC7E,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACnB,QAAQ,EAAE,MAAM;gBAEhB,eAAe,EAAE,iBAAiB;gBAElC,QAAQ,EAAE,kCAAkC;gBAE5C,KAAK,EAAE,iBAAiB;gBAExB,OAAO,EAAE,UAAU;gBAEnB,OAAO,EAAE;oBACP,MAAM,EAAE,SAAS,CAAC,MAAM;oBAExB,KAAK,EAAE,SAAS,CAAC,KAAK;oBAEtB,uBAAuB,EAAE,IAAI,CAAC,YAAY,CAAC,iBAAiB;iBAC7D;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAElE,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC;YAC3C,OAAO,EAAE,UAAU;YAEnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YAEvB,KAAK,EAAE,IAAI,CAAC,YAAY;YAExB,IAAI,EAAE,IAAI,CAAC,eAAe;YAE1B,QAAQ,EAAE,kBAAkB;YAE5B,yBAAyB,EAAE,IAAI,CAAC,QAAQ,CAAC,yBAAyB,IAAI,KAAK;YAE3E,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YAExB,SAAS,EAAE,gBAAgB;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;QAEpC,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAExD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,KAAK;YACf,eAAe,EAAE,KAAK;YACtB,QAAQ,EAAE,+BAA+B;YACzC,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,UAAU;YACnB,OAAO,EAAE;gBACP,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAC5B,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;gBAChC,mBAAmB,EAAE,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,gBAAgB;gBACtE,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ;aACpD;SACF,CAAC,CAAC;QAEH,QAAQ,CAAC,OAAO,CACd,UAAU,CAAC,OAAO,CAChB,iBAAiB,CACf,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,WAAW,EACjC,cAAc,CAAC,SAAS,EACxB,YAAY,CACb,CACF,CACF,CAAC;QAEF,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IAED,UAAU;QACR,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF"}

package/dist/p0-fixture/a2a/harness.d.ts

@@ -0,0 +1,16 @@
+import type { HandoffAdapter, SecurityContext } from '../../core/index.js';
+import type { EvidenceRecorder } from '../../protocol-lab/evidence.js';
+import type { P0EnforcementMode } from '../mcp/types.js';
+import type { P0Scenario } from '../scenario.js';
+import type { P0FixtureState } from '../state.js';
+import type { P0A2aRunState } from './executor.js';
+export declare function executeP0A2aFixture(input: {
+    recorder: EvidenceRecorder;
+    state: P0A2aRunState;
+    fixtureState: P0FixtureState;
+    context: SecurityContext;
+    handoffAdapter: HandoffAdapter;
+    scenario: P0Scenario;
+    enforcementMode: P0EnforcementMode;
+}): Promise<string>;
+//# sourceMappingURL=harness.d.ts.map

package/dist/p0-fixture/a2a/harness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness.d.ts","sourceRoot":"","sources":["../../../src/p0-fixture/a2a/harness.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAqHnD,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,KAAK,EAAE,aAAa,CAAC;IACrB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,eAAe,CAAC;IACzB,cAAc,EAAE,cAAc,CAAC;IAC/B,QAAQ,EAAE,UAAU,CAAC;IACrB,eAAe,EAAE,iBAAiB,CAAC;CACpC,GAAG,OAAO,CAAC,MAAM,CAAC,CAkGlB"}

package/dist/p0-fixture/a2a/harness.js

@@ -0,0 +1,160 @@
+import { once } from 'node:events';
+import { Role } from '@a2a-js/sdk';
+import { ClientFactory, RestTransportFactory } from '@a2a-js/sdk/client';
+import { DefaultRequestHandler, InMemoryTaskStore } from '@a2a-js/sdk/server';
+import { UserBuilder, agentCardHandler, restHandler } from '@a2a-js/sdk/server/express';
+import express from 'express';
+import { P0A2aExecutor } from './executor.js';
+function createAgentCard(restUrl) {
+    return {
+        name: 'HandoffProbe P0 Fixture Receiver',
+        description: 'Local deterministic A2A receiver for HandoffProbe P0 handoff security tests.',
+        provider: undefined,
+        version: '0.0.0',
+        capabilities: {
+            streaming: false,
+            pushNotifications: false,
+            extensions: [],
+        },
+        defaultInputModes: ['application/json'],
+        defaultOutputModes: ['application/json'],
+        skills: [
+            {
+                id: 'handoffprobe-p0-action',
+                name: 'Execute synthetic P0 action',
+                description: 'Translates an A2A security context into a deterministic local MCP fixture action.',
+                tags: ['handoff', 'security', 'p0', 'fixture'],
+                examples: [],
+                inputModes: ['application/json'],
+                outputModes: ['application/json'],
+                securityRequirements: [],
+            },
+        ],
+        securitySchemes: {},
+        securityRequirements: [],
+        supportedInterfaces: [
+            {
+                url: restUrl,
+                protocolBinding: 'HTTP+JSON',
+                protocolVersion: '1.0',
+                tenant: '',
+            },
+        ],
+        signatures: [],
+    };
+}
+function createRequest(runId, context, scenario) {
+    return {
+        tenant: '',
+        message: {
+            messageId: `${runId}-request`,
+            contextId: `${runId}-context`,
+            taskId: '',
+            role: Role.ROLE_USER,
+            metadata: undefined,
+            extensions: [],
+            referenceTaskIds: [],
+            parts: [
+                {
+                    content: {
+                        $case: 'text',
+                        value: `Execute synthetic P0 scenario ${scenario.id}.`,
+                    },
+                    mediaType: 'text/plain',
+                    filename: '',
+                    metadata: undefined,
+                },
+            ],
+        },
+        configuration: undefined,
+        metadata: {
+            handoffprobeContext: context,
+        },
+    };
+}
+function closeServer(server) {
+    return new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error === undefined) {
+                resolve();
+            }
+            else {
+                reject(error);
+            }
+        });
+    });
+}
+function extractMessageText(result) {
+    if ('messageId' in result) {
+        const part = result.parts[0];
+        if (part?.content?.$case === 'text') {
+            return part.content.value;
+        }
+    }
+    throw new Error('Expected P0 A2A receiver to return a direct Message.');
+}
+export async function executeP0A2aFixture(input) {
+    const app = express();
+    const server = app.listen(0, '127.0.0.1');
+    await once(server, 'listening');
+    const address = server.address();
+    if (address === null || typeof address === 'string') {
+        await closeServer(server);
+        throw new Error('Unable to determine P0 A2A loopback port.');
+    }
+    const baseUrl = `http://127.0.0.1:${address.port}`;
+    const agentCard = createAgentCard(`${baseUrl}/a2a`);
+    const executor = new P0A2aExecutor(input.handoffAdapter, input.scenario, input.enforcementMode, input.recorder, input.fixtureState, input.state);
+    const requestHandler = new DefaultRequestHandler(agentCard, new InMemoryTaskStore(), executor);
+    app.use(express.json());
+    app.use('/.well-known/agent-card.json', agentCardHandler({
+        agentCardProvider: requestHandler,
+    }));
+    app.use('/a2a', restHandler({
+        requestHandler,
+        userBuilder: UserBuilder.noAuthentication,
+    }));
+    try {
+        const factory = new ClientFactory({
+            transports: [new RestTransportFactory()],
+            preferredTransports: ['HTTP+JSON'],
+        });
+        const client = await factory.createFromAgentCard(agentCard);
+        input.recorder.record({
+            protocol: 'A2A',
+            protocolVersion: '1.0',
+            boundary: 'p0-fixture-client -> a2a-rest',
+            event: 'a2a.client.send',
+            context: input.context,
+            details: {
+                binding: 'HTTP+JSON',
+                transport: 'loopback-http',
+                path: '/a2a',
+                scenarioId: input.scenario.id,
+                selectedTool: input.scenario.tool,
+            },
+        });
+        const response = await client.sendMessage(createRequest(input.recorder.runId, input.context, input.scenario));
+        const responseText = extractMessageText(response);
+        const responseContext = input.state.translatedContext;
+        if (responseContext === undefined) {
+            throw new Error('P0 A2A executor did not persist translated context.');
+        }
+        input.recorder.record({
+            protocol: 'A2A',
+            protocolVersion: '1.0',
+            boundary: 'a2a-rest -> p0-fixture-client',
+            event: 'a2a.client.receive',
+            context: responseContext,
+            details: {
+                responseType: 'message',
+                scenarioId: input.scenario.id,
+            },
+        });
+        return responseText;
+    }
+    finally {
+        await closeServer(server);
+    }
+}
+//# sourceMappingURL=harness.js.map

package/dist/p0-fixture/a2a/harness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness.js","sourceRoot":"","sources":["../../../src/p0-fixture/a2a/harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAInC,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACxF,OAAO,OAAO,MAAM,SAAS,CAAC;AAO9B,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAG9C,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO;QACL,IAAI,EAAE,kCAAkC;QAExC,WAAW,EAAE,8EAA8E;QAE3F,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,OAAO;QAEhB,YAAY,EAAE;YACZ,SAAS,EAAE,KAAK;YAChB,iBAAiB,EAAE,KAAK;YACxB,UAAU,EAAE,EAAE;SACf;QAED,iBAAiB,EAAE,CAAC,kBAAkB,CAAC;QAEvC,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;QAExC,MAAM,EAAE;YACN;gBACE,EAAE,EAAE,wBAAwB;gBAC5B,IAAI,EAAE,6BAA6B;gBACnC,WAAW,EACT,mFAAmF;gBACrF,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC;gBAC9C,QAAQ,EAAE,EAAE;gBACZ,UAAU,EAAE,CAAC,kBAAkB,CAAC;gBAChC,WAAW,EAAE,CAAC,kBAAkB,CAAC;gBACjC,oBAAoB,EAAE,EAAE;aACzB;SACF;QAED,eAAe,EAAE,EAAE;QACnB,oBAAoB,EAAE,EAAE;QAExB,mBAAmB,EAAE;YACnB;gBACE,GAAG,EAAE,OAAO;gBACZ,eAAe,EAAE,WAAW;gBAC5B,eAAe,EAAE,KAAK;gBACtB,MAAM,EAAE,EAAE;aACX;SACF;QAED,UAAU,EAAE,EAAE;KACf,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,KAAa,EACb,OAAwB,EACxB,QAAoB;IAEpB,OAAO;QACL,MAAM,EAAE,EAAE;QAEV,OAAO,EAAE;YACP,SAAS,EAAE,GAAG,KAAK,UAAU;YAC7B,SAAS,EAAE,GAAG,KAAK,UAAU;YAC7B,MAAM,EAAE,EAAE;YACV,IAAI,EAAE,IAAI,CAAC,SAAS;YACpB,QAAQ,EAAE,SAAS;YACnB,UAAU,EAAE,EAAE;YACd,gBAAgB,EAAE,EAAE;YAEpB,KAAK,EAAE;gBACL;oBACE,OAAO,EAAE;wBACP,KAAK,EAAE,MAAM;wBACb,KAAK,EAAE,iCAAiC,QAAQ,CAAC,EAAE,GAAG;qBACvD;oBACD,SAAS,EAAE,YAAY;oBACvB,QAAQ,EAAE,EAAE;oBACZ,QAAQ,EAAE,SAAS;iBACpB;aACF;SACF;QAED,aAAa,EAAE,SAAS;QAExB,QAAQ,EAAE;YACR,mBAAmB,EAAE,OAAO;SAC7B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACrB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,EAAE,CAAC;YACZ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CACzB,MAEC;IAED,IAAI,WAAW,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAE7B,IAAI,IAAI,EAAE,OAAO,EAAE,KAAK,KAAK,MAAM,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAQzC;IACC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAE1C,MAAM,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAEhC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IAEjC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QAE1B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,OAAO,GAAG,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC;IAEnD,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC;IAEpD,MAAM,QAAQ,GAAG,IAAI,aAAa,CAChC,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,eAAe,EACrB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,KAAK,CACZ,CAAC;IAEF,MAAM,cAAc,GAAG,IAAI,qBAAqB,CAAC,SAAS,EAAE,IAAI,iBAAiB,EAAE,EAAE,QAAQ,CAAC,CAAC;IAE/F,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAExB,GAAG,CAAC,GAAG,CACL,8BAA8B,EAC9B,gBAAgB,CAAC;QACf,iBAAiB,EAAE,cAAc;KAClC,CAAC,CACH,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,MAAM,EACN,WAAW,CAAC;QACV,cAAc;QACd,WAAW,EAAE,WAAW,CAAC,gBAAgB;KAC1C,CAAC,CACH,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;YAChC,UAAU,EAAE,CAAC,IAAI,oBAAoB,EAAE,CAAC;YACxC,mBAAmB,EAAE,CAAC,WAAW,CAAC;SACnC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAE5D,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,KAAK;YACf,eAAe,EAAE,KAAK;YACtB,QAAQ,EAAE,+BAA+B;YACzC,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE;gBACP,OAAO,EAAE,WAAW;gBACpB,SAAS,EAAE,eAAe;gBAC1B,IAAI,EAAE,MAAM;gBACZ,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;gBAC7B,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;aAClC;SACF,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CACvC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CACnE,CAAC;QAEF,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAElD,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAEtD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,KAAK;YACf,eAAe,EAAE,KAAK;YACtB,QAAQ,EAAE,+BAA+B;YACzC,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EAAE,eAAe;YACxB,OAAO,EAAE;gBACP,YAAY,EAAE,SAAS;gBACvB,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;aAC9B;SACF,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/p0-fixture/authorization.d.ts

@@ -0,0 +1,24 @@
+import type { SecurityContext } from '../core/index.js';
+export interface P0AuthorizationRequest {
+    principal: string;
+    downstream: string;
+    tenant: string;
+    resource: string;
+    capability: string;
+    tool: string;
+}
+export interface P0AuthorizationDecision {
+    allowed: boolean;
+    reasons: string[];
+    upstreamAuthorityPresent: boolean;
+    effectiveAuthorityPresent: boolean;
+    principalMatches: boolean;
+    delegateMatches: boolean;
+    tenantMatches: boolean;
+    resourceMatches: boolean;
+    capabilityAllowed: boolean;
+    authorityNotAmplified: boolean;
+    lifecycleAllows: boolean;
+}
+export declare function evaluateP0Authorization(context: SecurityContext, request: P0AuthorizationRequest): P0AuthorizationDecision;
+//# sourceMappingURL=authorization.d.ts.map

package/dist/p0-fixture/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../src/p0-fixture/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExE,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAElB,wBAAwB,EAAE,OAAO,CAAC;IAElC,yBAAyB,EAAE,OAAO,CAAC;IAEnC,gBAAgB,EAAE,OAAO,CAAC;IAE1B,eAAe,EAAE,OAAO,CAAC;IAEzB,aAAa,EAAE,OAAO,CAAC;IAEvB,eAAe,EAAE,OAAO,CAAC;IAEzB,iBAAiB,EAAE,OAAO,CAAC;IAE3B,qBAAqB,EAAE,OAAO,CAAC;IAE/B,eAAe,EAAE,OAAO,CAAC;CAC1B;AAuBD,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,sBAAsB,GAC9B,uBAAuB,CAyEzB"}

package/dist/p0-fixture/authorization.js

@@ -0,0 +1,66 @@
+function includesAll(subset, superset) {
+    return subset.every((value) => superset.includes(value));
+}
+function authorityDoesNotAmplify(upstream, effective) {
+    if (upstream === undefined || effective === undefined) {
+        return false;
+    }
+    return (effective.principal === upstream.principal &&
+        effective.delegate === upstream.delegate &&
+        effective.tenant === upstream.tenant &&
+        includesAll(effective.resources, upstream.resources) &&
+        includesAll(effective.capabilities, upstream.capabilities));
+}
+export function evaluateP0Authorization(context, request) {
+    const upstream = context.upstreamAuthority;
+    const effective = context.effectiveAuthority;
+    const principalMatches = effective?.principal === request.principal;
+    const delegateMatches = effective?.delegate === request.downstream;
+    const tenantMatches = effective?.tenant === request.tenant;
+    const resourceMatches = effective?.resources.includes(request.resource) ?? false;
+    const capabilityAllowed = effective?.capabilities.includes(request.capability) ?? false;
+    const authorityNotAmplified = authorityDoesNotAmplify(upstream, effective);
+    const lifecycleAllows = context.lifecycle?.state !== 'cancelled';
+    const reasons = [];
+    if (upstream === undefined) {
+        reasons.push('missing_upstream_authority');
+    }
+    if (effective === undefined) {
+        reasons.push('missing_effective_authority');
+    }
+    if (!principalMatches) {
+        reasons.push('principal_mismatch');
+    }
+    if (!delegateMatches) {
+        reasons.push('delegate_mismatch');
+    }
+    if (!tenantMatches) {
+        reasons.push('tenant_mismatch');
+    }
+    if (!resourceMatches) {
+        reasons.push('resource_mismatch');
+    }
+    if (!capabilityAllowed) {
+        reasons.push('capability_not_granted');
+    }
+    if (!authorityNotAmplified) {
+        reasons.push('authority_amplification_or_binding_change');
+    }
+    if (!lifecycleAllows) {
+        reasons.push('governing_task_cancelled');
+    }
+    return {
+        allowed: reasons.length === 0,
+        reasons,
+        upstreamAuthorityPresent: upstream !== undefined,
+        effectiveAuthorityPresent: effective !== undefined,
+        principalMatches,
+        delegateMatches,
+        tenantMatches,
+        resourceMatches,
+        capabilityAllowed,
+        authorityNotAmplified,
+        lifecycleAllows,
+    };
+}
+//# sourceMappingURL=authorization.js.map

package/dist/p0-fixture/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../src/p0-fixture/authorization.ts"],"names":[],"mappings":"AAkCA,SAAS,WAAW,CAAC,MAAyB,EAAE,QAA2B;IACzE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,uBAAuB,CAC9B,QAAoC,EACpC,SAAqC;IAErC,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CACL,SAAS,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;QAC1C,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;QACxC,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACpC,WAAW,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACpD,WAAW,CAAC,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAwB,EACxB,OAA+B;IAE/B,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAE3C,MAAM,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAE7C,MAAM,gBAAgB,GAAG,SAAS,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC;IAEpE,MAAM,eAAe,GAAG,SAAS,EAAE,QAAQ,KAAK,OAAO,CAAC,UAAU,CAAC;IAEnE,MAAM,aAAa,GAAG,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;IAE3D,MAAM,eAAe,GAAG,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;IAEjF,MAAM,iBAAiB,GAAG,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC;IAExF,MAAM,qBAAqB,GAAG,uBAAuB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAE3E,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,EAAE,KAAK,KAAK,WAAW,CAAC;IAEjE,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;QAC7B,OAAO;QAEP,wBAAwB,EAAE,QAAQ,KAAK,SAAS;QAEhD,yBAAyB,EAAE,SAAS,KAAK,SAAS;QAElD,gBAAgB;QAChB,eAAe;QACf,aAAa;QACb,eAAe;QACf,iBAAiB;QACjB,qBAAqB;QACrB,eAAe;KAChB,CAAC;AACJ,CAAC"}

package/dist/p0-fixture/constants.d.ts

@@ -0,0 +1,17 @@
+export declare const P0_PRINCIPAL = "user:alice";
+export declare const P0_CALLER = "agent:sales";
+export declare const P0_AUTHORIZED_DOWNSTREAM = "agent:billing";
+export declare const P0_UNAUTHORIZED_DOWNSTREAM = "agent:support";
+export declare const P0_AUTHORIZED_TENANT = "tenant:acme";
+export declare const P0_UNAUTHORIZED_TENANT = "tenant:globex";
+export declare const P0_AUTHORIZED_RESOURCE = "invoice:INV-1001";
+export declare const P0_UNAUTHORIZED_RESOURCE = "invoice:INV-2002";
+export declare const P0_CAPABILITY_READ = "invoice.read";
+export declare const P0_CAPABILITY_UPDATE = "invoice.update";
+export declare const P0_CAPABILITY_REFUND = "payment.refund";
+export declare const P0_MCP_AUDIENCE = "mcp://billing";
+export declare const P0_ALTERNATE_MCP_AUDIENCE = "mcp://support";
+export declare const P0_CREDENTIAL_FINGERPRINT = "sha256:fixture-upstream-bearer";
+export declare const P0_APPROVAL_ID = "approval:refund-001";
+export declare const P0_TASK_ID = "task:p0-001";
+//# sourceMappingURL=constants.d.ts.map

package/dist/p0-fixture/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/p0-fixture/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,eAAe,CAAC;AAEzC,eAAO,MAAM,SAAS,gBAAgB,CAAC;AAEvC,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AAExD,eAAO,MAAM,0BAA0B,kBAAkB,CAAC;AAE1D,eAAO,MAAM,oBAAoB,gBAAgB,CAAC;AAElD,eAAO,MAAM,sBAAsB,kBAAkB,CAAC;AAEtD,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAEzD,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAE3D,eAAO,MAAM,kBAAkB,iBAAiB,CAAC;AAEjD,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAErD,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAErD,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C,eAAO,MAAM,yBAAyB,kBAAkB,CAAC;AAEzD,eAAO,MAAM,yBAAyB,mCAAmC,CAAC;AAE1E,eAAO,MAAM,cAAc,wBAAwB,CAAC;AAEpD,eAAO,MAAM,UAAU,gBAAgB,CAAC"}

package/dist/p0-fixture/constants.js

@@ -0,0 +1,17 @@
+export const P0_PRINCIPAL = 'user:alice';
+export const P0_CALLER = 'agent:sales';
+export const P0_AUTHORIZED_DOWNSTREAM = 'agent:billing';
+export const P0_UNAUTHORIZED_DOWNSTREAM = 'agent:support';
+export const P0_AUTHORIZED_TENANT = 'tenant:acme';
+export const P0_UNAUTHORIZED_TENANT = 'tenant:globex';
+export const P0_AUTHORIZED_RESOURCE = 'invoice:INV-1001';
+export const P0_UNAUTHORIZED_RESOURCE = 'invoice:INV-2002';
+export const P0_CAPABILITY_READ = 'invoice.read';
+export const P0_CAPABILITY_UPDATE = 'invoice.update';
+export const P0_CAPABILITY_REFUND = 'payment.refund';
+export const P0_MCP_AUDIENCE = 'mcp://billing';
+export const P0_ALTERNATE_MCP_AUDIENCE = 'mcp://support';
+export const P0_CREDENTIAL_FINGERPRINT = 'sha256:fixture-upstream-bearer';
+export const P0_APPROVAL_ID = 'approval:refund-001';
+export const P0_TASK_ID = 'task:p0-001';
+//# sourceMappingURL=constants.js.map

package/dist/p0-fixture/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/p0-fixture/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CAAC;AAEzC,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,CAAC;AAEvC,MAAM,CAAC,MAAM,wBAAwB,GAAG,eAAe,CAAC;AAExD,MAAM,CAAC,MAAM,0BAA0B,GAAG,eAAe,CAAC;AAE1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAElD,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAC;AAEtD,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AAEzD,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AAE3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAEjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAErD,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAErD,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAE/C,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AAEzD,MAAM,CAAC,MAAM,yBAAyB,GAAG,gCAAgC,CAAC;AAE1E,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEpD,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAC"}

package/dist/p0-fixture/handoff/adapter.d.ts

@@ -0,0 +1,6 @@
+import type { HandoffAdapter, SecurityContext } from '../../core/index.js';
+export declare class P0IdentityHandoffAdapter implements HandoffAdapter {
+    readonly id = "p0-handoff:identity";
+    translate(context: SecurityContext): SecurityContext;
+}
+//# sourceMappingURL=adapter.d.ts.map

package/dist/p0-fixture/handoff/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../../src/p0-fixture/handoff/adapter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3E,qBAAa,wBAAyB,YAAW,cAAc;IAC7D,QAAQ,CAAC,EAAE,yBAAyB;IAEpC,SAAS,CAAC,OAAO,EAAE,eAAe,GAAG,eAAe;CAGrD"}

package/dist/p0-fixture/handoff/adapter.js

@@ -0,0 +1,8 @@
+import { cloneSecurityContext } from '../../core/index.js';
+export class P0IdentityHandoffAdapter {
+    id = 'p0-handoff:identity';
+    translate(context) {
+        return cloneSecurityContext(context);
+    }
+}
+//# sourceMappingURL=adapter.js.map

package/dist/p0-fixture/handoff/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../../src/p0-fixture/handoff/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3D,MAAM,OAAO,wBAAwB;IAC1B,EAAE,GAAG,qBAAqB,CAAC;IAEpC,SAAS,CAAC,OAAwB;QAChC,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;CACF"}

package/dist/p0-fixture/index.d.ts

@@ -0,0 +1,11 @@
+export * from './authorization.js';
+export * from './constants.js';
+export * from './payload-hash.js';
+export * from './reference.js';
+export * from './scenario.js';
+export * from './state.js';
+export * from './target-adapter.js';
+export * from './handoff/adapter.js';
+export * from './mcp/harness.js';
+export * from './mcp/types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/p0-fixture/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/p0-fixture/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AAEpC,cAAc,sBAAsB,CAAC;AAErC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC"}

package/dist/p0-fixture/index.js

@@ -0,0 +1,11 @@
+export * from './authorization.js';
+export * from './constants.js';
+export * from './payload-hash.js';
+export * from './reference.js';
+export * from './scenario.js';
+export * from './state.js';
+export * from './target-adapter.js';
+export * from './handoff/adapter.js';
+export * from './mcp/harness.js';
+export * from './mcp/types.js';
+//# sourceMappingURL=index.js.map

package/dist/p0-fixture/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/p0-fixture/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AAEpC,cAAc,sBAAsB,CAAC;AAErC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC"}

package/dist/p0-fixture/mcp/fake-tools.d.ts

@@ -0,0 +1,7 @@
+import { McpServer } from '@modelcontextprotocol/server';
+import type { SecurityContext } from '../../core/index.js';
+import type { EvidenceRecorder } from '../../protocol-lab/evidence.js';
+import type { P0FixtureState } from '../state.js';
+import type { P0EnforcementMode } from './types.js';
+export declare function createP0FakeToolServer(recorder: EvidenceRecorder, context: SecurityContext, state: P0FixtureState, era: string, mode: P0EnforcementMode, downstreamAudience: string): McpServer;
+//# sourceMappingURL=fake-tools.d.ts.map

package/dist/p0-fixture/mcp/fake-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-tools.d.ts","sourceRoot":"","sources":["../../../src/p0-fixture/mcp/fake-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAGzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAUvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EACV,iBAAiB,EAIlB,MAAM,YAAY,CAAC;AAuOpB,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,cAAc,EACrB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,iBAAiB,EACvB,kBAAkB,EAAE,MAAM,GACzB,SAAS,CAyNX"}