tenzro-sdk 0.1.0 → 0.2.0

package/LICENSE

@@ -48,7 +48,7 @@
       "Contribution" shall mean any work of authorship, including
       the original version of the Work and any modifications or additions
       to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
+      submitted to the Licensor for inclusion in the Work by the copyright owner
       or by an individual or Legal Entity authorized to submit on behalf of
       the copyright owner. For the purposes of this definition, "submitted"
       means any form of electronic, verbal, or written communication sent
@@ -60,7 +60,7 @@
       designated in writing by the copyright owner as "Not a Contribution."
 
       "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
+      on behalf of whom a Contribution has been received by the Licensor and
       subsequently incorporated within the Work.
 
    2. Grant of Copyright License. Subject to the terms and conditions of
@@ -106,7 +106,7 @@
       (d) If the Work includes a "NOTICE" text file as part of its
           distribution, then any Derivative Works that You distribute must
           include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
+          within such NOTICE file, excluding any notices that do not
           pertain to any part of the Derivative Works, in at least one
           of the following places: within a NOTICE text file distributed
           as part of the Derivative Works; within the Source form or
@@ -175,18 +175,7 @@
 
    END OF TERMS AND CONDITIONS
 
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
+   Copyright 2026 Tenzro Network Contributors
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

package/README.md

@@ -36,6 +36,126 @@ const result = await client.inference.request('gemma3-270m', 'Hello!', 100);
 console.log(result.output);
 ```
 
+## Browser-extension provider
+
+Browser dApps can route SDK calls through `window.tenzro` (any
+EIP-6963-announcing Tenzro extension) instead of opening a direct
+fetch to the node. The extension owns auth (DPoP-bound JWT), session
+management (CAIP-25), and user confirmation:
+
+```typescript
+import { TenzroClient, TenzroNotInstalledError } from 'tenzro-sdk';
+
+try {
+  const client = await TenzroClient.fromInjected();
+  const block = await client.getLatestBlock();
+} catch (err) {
+  if (err instanceof TenzroNotInstalledError) {
+    showInstallCta();
+  } else {
+    throw err;
+  }
+}
+```
+
+`fromInjected()` discovers the Tenzro provider via EIP-6963
+(default `rdns: network.tenzro.wallet`, override with the `rdns`
+option), wraps it in an `Eip1193Transport`, and returns a
+`TenzroClient` whose `rpc.call(...)` becomes `provider.request(...)`.
+No extra dependency to install — the EIP-6963 listener is bundled in
+the SDK. Node consumers can ignore this entrypoint entirely.
+
+## Catch-up sync
+
+A node lagging behind the network can pull batches of historical blocks via
+`getBlockRange`. The call returns up to 256 blocks per request along with a
+`nextHeight` + `moreAvailable` cursor so a sync loop steps over pruning gaps:
+
+```typescript
+let cur = 0;
+while (true) {
+  const r = await client.getBlockRange(cur, cur + 255, 256);
+  for (const b of r.blocks) { /* import block */ }
+  if (!r.moreAvailable) break;
+  cur = r.nextHeight;
+}
+```
+
+`isSyncing()` reports the live gap by comparing the local tip against
+peer-reported network tips (gossiped on `tenzro/status`); pair it with
+`getBlockRange` to drive a catch-up loop only when needed.
+
+## Transaction signing
+
+Every Tenzro transaction is hybrid post-quantum signed: a classical Ed25519
+signature **and** an ML-DSA-65 (FIPS 204) signature, both verified
+synchronously by the node against the canonical `Transaction::hash()`
+preimage (which commits to the PQ public key). An invalid or missing
+signature on either leg returns JSON-RPC error `-32003`.
+
+Two supported flows:
+
+1. **Atomic server-side sign + send (recommended).** The SDK dispatches
+   the request via `tenzro_signAndSendTransaction`. The node identifies
+   the signing wallet from the ambient DPoP-bound bearer JWT, looks up
+   the live nonce and gas price, constructs the hash preimage, signs
+   both legs, verifies them, and submits to the mempool — all in one
+   call. Private keys never travel over the wire. `nonce`, `chainId`,
+   and `gasPrice` are optional; `value` accepts the alias `amount` for
+   parity with the desktop and CLI clients. Self-sends (`from === to`)
+   return a `cannot transfer to self` validation error.
+
+   ```typescript
+   const txHash = await client.wallet.signAndSend({
+     from: '0x...',
+     to: '0x...',
+     value: 1_000_000_000_000_000_000n,
+     // nonce, chainId, gasPrice all optional — looked up live
+   });
+   ```
+
+   `client.sendTransaction(...)` and `client.wallet.signAndSend(...)`
+   are both thin wrappers over this RPC.
+
+2. **Offline sign, then submit.** Call `tenzro_signTransaction` to obtain
+   `{signature, public_key, pq_signature, pq_public_key, timestamp,
+   tx_hash}`, then resubmit later via `eth_sendRawTransaction` with all
+   six fields intact. Use this for batched or air-gapped submission.
+
+## Wallet model
+
+`client.wallet.create()` provisions a chain-agnostic 2-of-3 Ed25519 MPC
+wallet. Tenzro wallets are not per-chain — a single wallet projects into
+EVM, SVM, and Canton via the pointer-token model, so there is no `chain`
+parameter. VM-specific operations are exposed through `client.token`
+(`crossVmTransfer`, `wrapTnzo`); transfers to external chains use
+`client.bridge` (LayerZero V2, Chainlink CCIP), `client.debridge`,
+`client.wormhole`, or `client.lifi`.
+
+`client.getTransaction(hash)` resolves from finalized storage first, then
+falls back to the consensus mempool — `status` is `"pending"` while the
+transaction is in-mempool and `"finalized"` once block-included, so callers
+polling immediately after broadcast can distinguish "not yet finalized" from
+"unknown hash" (the call returns `null` only when the hash is unknown to
+both storage and mempool).
+
+## Durable state
+
+The node persists AI infrastructure to RocksDB and restores it on restart —
+SDK consumers see consistent state across node upgrades and reboots:
+
+- **Model catalog** — `ModelRegistry` writes `ModelInfo` records under
+  `info:<model_id>` in `CF_MODELS`; models survive restart without
+  re-registration.
+- **Agent runtime** — `AgentRuntime` persists `RegisteredAgent`,
+  `AgentLifecycleInfo`, and parent→children spawn trees under
+  `agent:`/`lifecycle:`/`children:` prefixes in `CF_AGENTS`. Terminated
+  agents are retained for audit of `state_history`, `registration_fee`,
+  and `tenzro_did`.
+- **Swarms** — `SwarmManager` persists `SwarmState` under `swarm:<swarm_id>`
+  in `CF_AGENTS` with write-through on create, status transitions, and
+  termination.
+
 ## AppClient (Developer Pattern)
 
 ```typescript
@@ -55,15 +175,33 @@ const result = await app.sponsorInference(user.address, 'gemma3-270m', 'Hello');
 
 | Module | Key Methods |
 |--------|------------|
+| `auth` | `onboardHuman()`, `onboardDelegatedAgent()`, `onboardAutonomousAgent()`, `revokeJwt()`, `revokeDid()`, `listPendingApprovals()`, `decideApproval()` |
 | `wallet` | `createWallet()`, `getBalance()`, `sendTransaction()` |
 | `identity` | `registerHuman()`, `resolveDid()`, `setUsername()` |
 | `agent` | `register()`, `spawnAgent()`, `createSwarm()`, `delegateTask()` |
-| `inference` | `listModels()`, `request()`, `estimateCost()` |
+| `inference` | `listModels()`, `request()`, `estimateCost()`, plus multi-modal helpers for forecast, vision embed/similarity, text embedding, segmentation, detection, audio ASR, video embed (modality-aware routing via `tenzro_forecast`, `tenzro_visionEmbed`, `tenzro_textEmbed`, `tenzro_segment`, `tenzro_detect`, `tenzro_transcribe`, `tenzro_videoEmbed`) |
 | `token` | `createToken()`, `listTokens()`, `crossVmTransfer()` |
 | `nft` | `createCollection()`, `mintNft()`, `transferNft()` |
 | `bridge` | `bridgeTokens()`, `getRoutes()`, `getBridgeStatus()` |
-| `settlement` | `createEscrow()`, `releaseEscrow()`, `openPaymentChannel()` |
-| `payment` | `createChallenge()`, `payMpp()`, `payX402()` |
+| `wormhole` | `wormholeBridge()`, `getVaa()`, `redeemVaa()` |
+| `cct` | `cctListPools()`, `cctGetPool()` (Chainlink CCT v1.6+ pool registry) |
+| `erc8004` | `register8004Agent()`, `submit8004Feedback()`, `request8004Validation()`, `submit8004Validation()` (Trustless Agents Registry) |
+| `ap2` | `createAp2Mandate()`, `validateMandatePair()` (Agent Payments Protocol intent/cart/payment VDCs) |
+| `agentPayments` | Per-agent runtime spending policies (max-per-tx, daily-cap, enforce_operation pre-check) |
+| `bond` | AgentBond stake operations (Spec 9): `getAgentBond()`, `listAgentBonds()`, `postAgentBond()`, `increaseAgentBond()`, `withdrawAgentBond()` |
+| `insurance` | AgentBond insurance claims (Spec 9): `fileInsuranceClaim()`, `listInsuranceClaims()`, `getInsurancePool()` |
+| `lifecycle` | Agent lifecycle + kill-switch audit trail: `getAgentLifecycle()`, `listKillSwitchReceiptsByTarget()` |
+| `principalChain` | Receipt principal-chain queries (Spec 5): walk every receipt back to its human/organisational controller |
+| `cortex` | Reasoning-tier inference with TEE / TEE+ZK attestation; `DEFAULT_CORTEX_PRICING`, `computeCortexCost()` |
+| `adaptiveBurn` | Adaptive-burn governance dial — `getBurnRateConfig()`, `getSupplyMetrics()`, `getBurnRateRecommendation()` |
+| `seedAgent` | SeedAgent treasury earmark + protocol-owned bootstrap agent registry (Spec 10) |
+| `quota` | Dual-rail burn quota (Spec 3), prioritised mempool lanes, hot-state contention, DA backend registry |
+| `nanopayment` | Per-token streaming micropayment channels |
+| `circuitBreaker` | Provider health management for inference routing |
+| `erc7802` | Cross-chain token mint/burn primitive |
+| `provider` | Hardware detection, model serving, scheduling |
+| `settlement` | `createEscrow()`, `releaseEscrow()`, `refundEscrow()`, `getEscrow()`, `openPaymentChannel()` |
+| `payment` | `createChallenge()`, `payMpp()`, `payX402()`, `listX402Schemes()` (pluggable scheme adapters: `exact`, `permit2`) |
 | `compliance` | `registerCompliance()`, `checkCompliance()`, `freezeAddress()` |
 | `crypto` | `signMessage()`, `encrypt()`, `decrypt()`, `hashSha256()` |
 | `tee` | `detectTee()`, `getAttestation()`, `sealData()` |
@@ -81,12 +219,67 @@ const result = await app.sponsorInference(user.address, 'gemma3-270m', 'Hello');
 | `canton` | `listDomains()`, `submitCommand()` |
 | `skill` | `listSkills()`, `registerSkill()` |
 | `tool` | `listTools()`, `registerTool()` |
+| `svm-cross-vm` | Tenzro Cross-VM SVM-native program: `TENZRO_CROSS_VM_PROGRAM_ID_BASE58`, `encodeBridgeToEvm()`, `encodeBridgeFromEvm()`, `encodeRegisterTokenPointer()`, `encodeTransferCrossVm()`, `decodeCrossVmInstruction()` |
+
+## Auth (OAuth 2.1 + DPoP Onboarding)
+
+Onboarding uses OAuth 2.1 (RFC 6749 successor) + DPoP-bound JWTs (RFC 9449) +
+Rich Authorization Requests (RFC 9396). Participants — humans, delegated agents
+under a human controller, and fully autonomous agents — onboard via three RPCs
+that each provision a TDIP identity + MPC wallet and return a JWT bound to a
+holder-supplied DPoP `jkt` (RFC 7638 thumbprint).
+
+```typescript
+import { TenzroClient, TESTNET_CONFIG } from 'tenzro-sdk';
+
+const client = new TenzroClient(TESTNET_CONFIG);
+
+// Onboard a new human — returns identity, MPC wallet, and access token
+const session = await client.auth.onboardHuman('Alice', /* dpopJkt */ undefined);
+console.log('DID:    ', (session.identity as any).did);
+console.log('Wallet: ', (session.wallet as any).address);
+console.log('Token:  ', session.access_token.slice(0, 32), '…');
+
+// Subsequent privileged calls (sign + send tx, escrow, etc.) authenticate
+// ambiently via these env vars — the SDK forwards them as
+// `Authorization: DPoP <jwt>` and `DPoP: <proof>` on every JSON-RPC call:
+process.env.TENZRO_BEARER_JWT = session.access_token;
+process.env.TENZRO_DPOP_PROOF = '<freshly minted DPoP proof>';
+
+// Onboard a delegated agent under Alice's act-chain
+const agent = await client.auth.onboardDelegatedAgent(
+  (session.identity as any).did,
+  ['inference', 'settlement'],
+  { max_transaction_value: '1000000000000000000', allowed_chains: ['tenzro'] },
+);
+
+// Revoke (cascades through act-chain by DID)
+await client.auth.revokeDid((session.identity as any).did, 'lost device');
+```
+
+Holder-side DPoP proof generation is left to the caller — sign a per-request
+JWT with your Ed25519 holder key and the JWS-compact form lands in
+`TENZRO_DPOP_PROOF`. See RFC 9449 §4.
+
+## Examples
+
+```bash
+npx ts-node examples/quickstart.ts
+npx ts-node examples/advanced.ts
+npx ts-node examples/marketplace.ts        # 14 sections covering tasks, agents, skills, tools, NFTs, governance, payments, bridges
+npx ts-node examples/app_developer.ts
+npx ts-node examples/auth-session.ts
+npx ts-node examples/cortex.ts
+```
+
+See the [examples/](examples/) directory and [Tenzro Cookbook](https://github.com/tenzro/tenzro-cookbook).
 
 ## Live Testnet
 
 | Endpoint | URL |
 |----------|-----|
 | JSON-RPC | `https://rpc.tenzro.network` |
+| Web API | `https://api.tenzro.network` |
 | MCP Server | `https://mcp.tenzro.network/mcp` |
 | A2A Server | `https://a2a.tenzro.network` |
 

package/dist/adaptive-burn.d.ts

@@ -0,0 +1,40 @@
+import { RpcClient } from "./rpc";
+/**
+ * Client for the adaptive-burn governance dial (TNZO supply control).
+ *
+ * Surfaces the current `BurnRateConfig`, rolling `SupplyMetricsSnapshot`,
+ * the recommended action computed from the targets and metrics, and the
+ * list of in-flight adaptive-burn governance proposals.
+ *
+ * All endpoints are read-only — the auto-proposal generator and the
+ * EIP-1559 fee-market consumer ship alongside the governance executor
+ * wiring in a later wave.
+ */
+export declare class AdaptiveBurnClient {
+    private rpc;
+    constructor(rpc: RpcClient);
+    /**
+     * Returns the current `BurnRateConfig` (base/local/paymaster burn bps).
+     * @returns Active burn-rate configuration
+     */
+    getBurnRateConfig(): Promise<any>;
+    /**
+     * Returns the latest rolling supply metrics snapshot — circulating
+     * supply, epoch delta, burn breakdown, emission breakdown.
+     * @returns Latest `SupplyMetricsSnapshot`
+     */
+    getSupplyMetrics(): Promise<any>;
+    /**
+     * Computes the recommended adaptive-burn action from the current
+     * metrics and configured supply targets. May return `NoChange`,
+     * `IncreaseBurnPct`, `DecreaseBurnPct`, or alarm variants.
+     * @returns `BurnRateRecommendation`
+     */
+    getBurnRateRecommendation(): Promise<any>;
+    /**
+     * List in-flight adaptive-burn governance proposals.
+     * @returns Array of proposal records
+     */
+    listAdaptiveBurnProposals(): Promise<any[]>;
+}
+//# sourceMappingURL=adaptive-burn.d.ts.map

package/dist/adaptive-burn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adaptive-burn.d.ts","sourceRoot":"","sources":["../src/adaptive-burn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAElC;;;;;;;;;;GAUG;AACH,qBAAa,kBAAkB;IACjB,OAAO,CAAC,GAAG;gBAAH,GAAG,EAAE,SAAS;IAElC;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC;IAIvC;;;;OAIG;IACG,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC;IAItC;;;;;OAKG;IACG,yBAAyB,IAAI,OAAO,CAAC,GAAG,CAAC;IAI/C;;;OAGG;IACG,yBAAyB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;CAGlD"}

package/dist/adaptive-burn.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdaptiveBurnClient = void 0;
+/**
+ * Client for the adaptive-burn governance dial (TNZO supply control).
+ *
+ * Surfaces the current `BurnRateConfig`, rolling `SupplyMetricsSnapshot`,
+ * the recommended action computed from the targets and metrics, and the
+ * list of in-flight adaptive-burn governance proposals.
+ *
+ * All endpoints are read-only — the auto-proposal generator and the
+ * EIP-1559 fee-market consumer ship alongside the governance executor
+ * wiring in a later wave.
+ */
+class AdaptiveBurnClient {
+    rpc;
+    constructor(rpc) {
+        this.rpc = rpc;
+    }
+    /**
+     * Returns the current `BurnRateConfig` (base/local/paymaster burn bps).
+     * @returns Active burn-rate configuration
+     */
+    async getBurnRateConfig() {
+        return this.rpc.call("tenzro_getBurnRateConfig", []);
+    }
+    /**
+     * Returns the latest rolling supply metrics snapshot — circulating
+     * supply, epoch delta, burn breakdown, emission breakdown.
+     * @returns Latest `SupplyMetricsSnapshot`
+     */
+    async getSupplyMetrics() {
+        return this.rpc.call("tenzro_getSupplyMetrics", []);
+    }
+    /**
+     * Computes the recommended adaptive-burn action from the current
+     * metrics and configured supply targets. May return `NoChange`,
+     * `IncreaseBurnPct`, `DecreaseBurnPct`, or alarm variants.
+     * @returns `BurnRateRecommendation`
+     */
+    async getBurnRateRecommendation() {
+        return this.rpc.call("tenzro_getBurnRateRecommendation", []);
+    }
+    /**
+     * List in-flight adaptive-burn governance proposals.
+     * @returns Array of proposal records
+     */
+    async listAdaptiveBurnProposals() {
+        return this.rpc.call("tenzro_listAdaptiveBurnProposals", []);
+    }
+}
+exports.AdaptiveBurnClient = AdaptiveBurnClient;
+//# sourceMappingURL=adaptive-burn.js.map

package/dist/adaptive-burn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adaptive-burn.js","sourceRoot":"","sources":["../src/adaptive-burn.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;GAUG;AACH,MAAa,kBAAkB;IACT;IAApB,YAAoB,GAAc;QAAd,QAAG,GAAH,GAAG,CAAW;IAAG,CAAC;IAEtC;;;OAGG;IACH,KAAK,CAAC,iBAAiB;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,yBAAyB;QAC7B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,yBAAyB;QAC7B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAQ,kCAAkC,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;CACF;AArCD,gDAqCC"}

package/dist/agent.d.ts

@@ -81,12 +81,19 @@ export declare class AgentClient {
     terminateSwarm(swarmId: string): Promise<TerminateSwarmResponse>;
     /**
      * Spawn a new agent from a registered template.
+     *
+     * When `parentMachineDid` is supplied, the spawned agent's effective
+     * delegation scope is the strict intersection of the parent's scope and
+     * the template's spec — the child can never be broader than its parent
+     * on any axis (numeric ceilings, allow-lists, time bound).
+     *
      * @param templateId - The template to instantiate
      * @param displayName - Optional human-readable name for the spawned agent
      * @param context - Optional key-value context passed to the agent at boot
+     * @param parentMachineDid - Optional parent machine DID to attenuate against
      * @returns Spawned agent info with agent_id, template_id, name, and status
      */
-    spawnAgentTemplate(templateId: string, displayName?: string, context?: Record<string, string>): Promise<SpawnAgentTemplateResponse>;
+    spawnAgentTemplate(templateId: string, displayName?: string, context?: Record<string, string>, parentMachineDid?: string): Promise<SpawnAgentTemplateResponse>;
     /**
      * Run an already-spawned template agent through its task loop.
      * @param agentId - The agent to run

package/dist/agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClC,OAAO,EACL,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,EACX,sBAAsB,EACtB,yBAAyB,EACzB,SAAS,EACV,MAAM,SAAS,CAAC;AAWjB;;;GAGG;AACH,qBAAa,WAAW;IACV,OAAO,CAAC,GAAG;gBAAH,GAAG,EAAE,SAAS;IAElC;;;;;;OAMG;IACG,QAAQ,CACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,qBAAqB,CAAC;IAUjC;;;;;OAKG;IACG,WAAW,CACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,oBAAoB,CAAC;IAShC;;;;;OAKG;IACG,YAAY,CAChB,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC;IAehC;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAI5C;;;;;;OAMG;IACG,UAAU,CACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,kBAAkB,CAAC;IAM9B;;;;;;;;OAQG;IACG,YAAY,CAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC;IAMhC;;;;;;OAMG;IACG,WAAW,CACf,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,EACxD,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GACjF,OAAO,CAAC,mBAAmB,CAAC;IAM/B;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAM3D;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAQtE;;;;;;OAMG;IACG,kBAAkB,CACtB,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,0BAA0B,CAAC;IAMtC;;;;;;OAMG;IACG,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,sBAAsB,CAAC;IAMlC;;;;OAIG;IACG,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAMvE;;;;;OAKG;IACG,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,aAAa,CAAC;IAQzB;;;;OAIG;IACG,cAAc,CAAC,OAAO,CAAC,EAAE;QAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,GAAG,CAAC;IAUhB;;;;OAIG;IACG,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAIvD;;;;;;;OAOG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC;IAWf;;;;;;OAMG;IACG,SAAS,CACb,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC;IAUf;;;;;;;;OAQG;IACG,SAAS,CACb,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,GAAG,CAAC;IAYf;;;;;;;OAOG;IACG,oBAAoB,CACxB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC;IAWf;;;;;OAKG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAM1E;;;;OAIG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;CAKxD"}
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClC,OAAO,EACL,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,EACX,sBAAsB,EACtB,yBAAyB,EACzB,SAAS,EACV,MAAM,SAAS,CAAC;AAWjB;;;GAGG;AACH,qBAAa,WAAW;IACV,OAAO,CAAC,GAAG;gBAAH,GAAG,EAAE,SAAS;IAElC;;;;;;OAMG;IACG,QAAQ,CACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,qBAAqB,CAAC;IAUjC;;;;;OAKG;IACG,WAAW,CACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,oBAAoB,CAAC;IAShC;;;;;OAKG;IACG,YAAY,CAChB,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC;IAehC;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAI5C;;;;;;OAMG;IACG,UAAU,CACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,kBAAkB,CAAC;IAM9B;;;;;;;;OAQG;IACG,YAAY,CAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC;IAMhC;;;;;;OAMG;IACG,WAAW,CACf,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,EACxD,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GACjF,OAAO,CAAC,mBAAmB,CAAC;IAM/B;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAM3D;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAQtE;;;;;;;;;;;;;OAaG;IACG,kBAAkB,CACtB,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,0BAA0B,CAAC;IAWtC;;;;;;OAMG;IACG,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,sBAAsB,CAAC;IAMlC;;;;OAIG;IACG,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAMvE;;;;;OAKG;IACG,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,aAAa,CAAC;IAQzB;;;;OAIG;IACG,cAAc,CAAC,OAAO,CAAC,EAAE;QAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,GAAG,CAAC;IAUhB;;;;OAIG;IACG,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAIvD;;;;;;;OAOG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,GAAG,CAAC;IAWf;;;;;;OAMG;IACG,SAAS,CACb,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC;IAUf;;;;;;;;OAQG;IACG,SAAS,CACb,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,GAAG,CAAC;IAYf;;;;;;;OAOG;IACG,oBAAoB,CACxB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC;IAWf;;;;;OAKG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAM1E;;;;OAIG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;CAKxD"}

package/dist/agent.js

@@ -136,14 +136,26 @@ class AgentClient {
     // ─── AgentKit: Template-based agent lifecycle ─────────────────────────────
     /**
      * Spawn a new agent from a registered template.
+     *
+     * When `parentMachineDid` is supplied, the spawned agent's effective
+     * delegation scope is the strict intersection of the parent's scope and
+     * the template's spec — the child can never be broader than its parent
+     * on any axis (numeric ceilings, allow-lists, time bound).
+     *
      * @param templateId - The template to instantiate
      * @param displayName - Optional human-readable name for the spawned agent
      * @param context - Optional key-value context passed to the agent at boot
+     * @param parentMachineDid - Optional parent machine DID to attenuate against
      * @returns Spawned agent info with agent_id, template_id, name, and status
      */
-    async spawnAgentTemplate(templateId, displayName, context) {
+    async spawnAgentTemplate(templateId, displayName, context, parentMachineDid) {
         return this.rpc.call("tenzro_spawnAgentTemplate", [
-            { template_id: templateId, display_name: displayName, context },
+            {
+                template_id: templateId,
+                display_name: displayName,
+                context,
+                parent_machine_did: parentMachineDid,
+            },
         ]);
     }
     /**

package/dist/agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent.js","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":";;;AAkBA,0DAA0D;AAC1D,SAAS,YAAY;IACnB,OAAO,sCAAsC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QACnE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAa,WAAW;IACF;IAApB,YAAoB,GAAc;QAAd,QAAG,GAAH,GAAG,CAAW;IAAG,CAAC;IAEtC;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAe,EACf,IAAY,EACZ,YAAsB;QAEtB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAwB,sBAAsB,EAAE;YAClE;gBACE,QAAQ,EAAE,OAAO;gBACjB,IAAI;gBACJ,YAAY;aACb;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CACf,OAAe,EACf,OAAe;QAEf,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAuB,yBAAyB,EAAE;YACpE;gBACE,QAAQ,EAAE,OAAO;gBACjB,OAAO;aACR;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAChB,OAAe,EACf,eAAuB;QAEvB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAuB,MAAM,EAAE;YACjD,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE;gBACN,EAAE,EAAE,YAAY,EAAE;gBAClB,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;iBACjD;aACF;YACD,EAAE,EAAE,CAAC;SACN,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAkB,mBAAmB,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CACd,QAAgB,EAChB,IAAY,EACZ,YAAsB;QAEtB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAqB,mBAAmB,EAAE;YAC5D,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAChB,OAAe,EACf,IAAY,EACZ,YAAqB;QAErB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAuB,qBAAqB,EAAE;YAChE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE;SACzD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CACf,cAAsB,EACtB,OAAwD,EACxD,OAAkF;QAElF,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAsB,oBAAoB,EAAE;YAC9D,EAAE,eAAe,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE;SACzD,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAc,uBAAuB,EAAE;YACzD,EAAE,QAAQ,EAAE,OAAO,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAyB,uBAAuB,EAAE;YACpE,EAAE,QAAQ,EAAE,OAAO,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAE7E;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CACtB,UAAkB,EAClB,WAAoB,EACpB,OAAgC;QAEhC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAA6B,2BAA2B,EAAE;YAC5E,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE;SAChE,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAe,EACf,aAAsB,EACtB,MAAgB;QAEhB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAyB,yBAAyB,EAAE;YACtE,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE;SACtE,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,qBAAqB,CAAC,UAAkB;QAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAgB,8BAA8B,EAAE;YAClE,EAAE,WAAW,EAAE,UAAU,EAAE;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,mBAAmB,CACvB,UAAkB,EAClB,MAAiC;QAEjC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAgB,4BAA4B,EAAE;YAChE,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE;SACvC,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAE/E;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAIpB;QACC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE;YAC5C;gBACE,QAAQ,EAAE,OAAO,EAAE,QAAQ;gBAC3B,YAAY,EAAE,OAAO,EAAE,WAAW;gBAClC,KAAK,EAAE,OAAO,EAAE,KAAK;aACtB;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,UAAmB;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,mBAAmB,CACvB,QAAgB,EAChB,IAAY,EACZ,OAAe,EACf,YAAuB;QAEvB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE;YACjD;gBACE,SAAS,EAAE,QAAQ;gBACnB,IAAI;gBACJ,QAAQ,EAAE,OAAO;gBACjB,YAAY;aACb;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CACb,OAAe,EACf,WAAmB,EACnB,UAAkB;QAElB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE;YACvC;gBACE,QAAQ,EAAE,OAAO;gBACjB,YAAY,EAAE,WAAW;gBACzB,WAAW,EAAE,UAAU;aACxB;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CACb,OAAe,EACf,SAAiB,EACjB,OAAe,EACf,MAAc,EACd,KAAc;QAEd,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE;YACvC;gBACE,QAAQ,EAAE,OAAO;gBACjB,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,OAAO;gBACjB,MAAM;gBACN,KAAK;aACN;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAAe,EACf,OAAe,EACf,MAAc,EACd,SAAkB;QAElB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE;YAClD;gBACE,QAAQ,EAAE,OAAO;gBACjB,QAAQ,EAAE,OAAO;gBACjB,MAAM;gBACN,UAAU,EAAE,SAAS;aACtB;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,MAAiB;QACnD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAY,0BAA0B,EAAE;YAC1D,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE;SACjC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAY,0BAA0B,EAAE;YAC1D,EAAE,QAAQ,EAAE,OAAO,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;CACF;AAvWD,kCAuWC"}
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":";;;AAkBA,0DAA0D;AAC1D,SAAS,YAAY;IACnB,OAAO,sCAAsC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QACnE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAa,WAAW;IACF;IAApB,YAAoB,GAAc;QAAd,QAAG,GAAH,GAAG,CAAW;IAAG,CAAC;IAEtC;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAe,EACf,IAAY,EACZ,YAAsB;QAEtB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAwB,sBAAsB,EAAE;YAClE;gBACE,QAAQ,EAAE,OAAO;gBACjB,IAAI;gBACJ,YAAY;aACb;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CACf,OAAe,EACf,OAAe;QAEf,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAuB,yBAAyB,EAAE;YACpE;gBACE,QAAQ,EAAE,OAAO;gBACjB,OAAO;aACR;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAChB,OAAe,EACf,eAAuB;QAEvB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAuB,MAAM,EAAE;YACjD,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE;gBACN,EAAE,EAAE,YAAY,EAAE;gBAClB,OAAO,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;iBACjD;aACF;YACD,EAAE,EAAE,CAAC;SACN,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAkB,mBAAmB,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CACd,QAAgB,EAChB,IAAY,EACZ,YAAsB;QAEtB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAqB,mBAAmB,EAAE;YAC5D,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAChB,OAAe,EACf,IAAY,EACZ,YAAqB;QAErB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAuB,qBAAqB,EAAE;YAChE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE;SACzD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CACf,cAAsB,EACtB,OAAwD,EACxD,OAAkF;QAElF,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAsB,oBAAoB,EAAE;YAC9D,EAAE,eAAe,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE;SACzD,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAc,uBAAuB,EAAE;YACzD,EAAE,QAAQ,EAAE,OAAO,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAyB,uBAAuB,EAAE;YACpE,EAAE,QAAQ,EAAE,OAAO,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAE7E;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,kBAAkB,CACtB,UAAkB,EAClB,WAAoB,EACpB,OAAgC,EAChC,gBAAyB;QAEzB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAA6B,2BAA2B,EAAE;YAC5E;gBACE,WAAW,EAAE,UAAU;gBACvB,YAAY,EAAE,WAAW;gBACzB,OAAO;gBACP,kBAAkB,EAAE,gBAAgB;aACrC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAe,EACf,aAAsB,EACtB,MAAgB;QAEhB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAyB,yBAAyB,EAAE;YACtE,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE;SACtE,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,qBAAqB,CAAC,UAAkB;QAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAgB,8BAA8B,EAAE;YAClE,EAAE,WAAW,EAAE,UAAU,EAAE;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,mBAAmB,CACvB,UAAkB,EAClB,MAAiC;QAEjC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAgB,4BAA4B,EAAE;YAChE,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE;SACvC,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAE/E;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAIpB;QACC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE;YAC5C;gBACE,QAAQ,EAAE,OAAO,EAAE,QAAQ;gBAC3B,YAAY,EAAE,OAAO,EAAE,WAAW;gBAClC,KAAK,EAAE,OAAO,EAAE,KAAK;aACtB;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,UAAmB;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,mBAAmB,CACvB,QAAgB,EAChB,IAAY,EACZ,OAAe,EACf,YAAuB;QAEvB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE;YACjD;gBACE,SAAS,EAAE,QAAQ;gBACnB,IAAI;gBACJ,QAAQ,EAAE,OAAO;gBACjB,YAAY;aACb;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CACb,OAAe,EACf,WAAmB,EACnB,UAAkB;QAElB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE;YACvC;gBACE,QAAQ,EAAE,OAAO;gBACjB,YAAY,EAAE,WAAW;gBACzB,WAAW,EAAE,UAAU;aACxB;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CACb,OAAe,EACf,SAAiB,EACjB,OAAe,EACf,MAAc,EACd,KAAc;QAEd,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE;YACvC;gBACE,QAAQ,EAAE,OAAO;gBACjB,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,OAAO;gBACjB,MAAM;gBACN,KAAK;aACN;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAAe,EACf,OAAe,EACf,MAAc,EACd,SAAkB;QAElB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE;YAClD;gBACE,QAAQ,EAAE,OAAO;gBACjB,QAAQ,EAAE,OAAO;gBACjB,MAAM;gBACN,UAAU,EAAE,SAAS;aACtB;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,MAAiB;QACnD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAY,0BAA0B,EAAE;YAC1D,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE;SACjC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAY,0BAA0B,EAAE;YAC1D,EAAE,QAAQ,EAAE,OAAO,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;CACF;AApXD,kCAoXC"}

package/dist/ap2.d.ts

@@ -1,5 +1,57 @@
 import type { RpcClient } from './rpc';
 import type { Ap2Session, Ap2Authorization, PaymentReceipt, CancelResult } from './types';
+/**
+ * Result of verifying a single AP2 mandate (Intent / Cart / Payment VDC).
+ */
+export interface Ap2MandateVerification {
+    /** Whether the VDC proof is valid. */
+    valid: boolean;
+    /** Mandate type: "Intent" | "Cart" | "Payment". */
+    mandate_type: string;
+    /** Issuer DID. */
+    issuer: string;
+    /** Subject DID (agent/merchant). */
+    subject: string;
+    /** Expiration timestamp (Unix seconds). */
+    expires_at: number;
+    /** Reason for failure if `valid` is false. */
+    error?: string;
+}
+/**
+ * Result of validating an Intent+Cart mandate pair.
+ */
+export interface Ap2MandatePairValidation {
+    /** Whether the pair is mutually consistent and both VDCs verify. */
+    valid: boolean;
+    /** Mandate id of the intent VDC (set on success). */
+    intent_mandate_id?: string;
+    /** Mandate id of the cart VDC (set on success). */
+    cart_mandate_id?: string;
+    /** Principal DID — intent signer (set on success). */
+    principal_did?: string;
+    /** Agent DID — cart signer (set on success). */
+    agent_did?: string;
+    /**
+     * Whether the TDIP delegation gate ran in addition to AP2 validation.
+     * Mirrors the `enforce_delegation` request flag.
+     */
+    delegation_enforced: boolean;
+    /** Reason for failure if `valid` is false. */
+    error?: string;
+}
+/**
+ * AP2 protocol metadata.
+ */
+export interface Ap2ProtocolInfo {
+    /** AP2 protocol version. */
+    version: string;
+    /** Supported mandate types (e.g. ["Intent", "Cart", "Payment"]). */
+    supported_mandate_types: string[];
+    /** Supported VC formats (e.g. ["jwt_vc", "ldp_vc"]). */
+    supported_vc_formats: string[];
+    /** Recognized issuer DID methods (e.g. ["did:tenzro", "did:web"]). */
+    supported_did_methods: string[];
+}
 /**
  * Client for the AP2 (Agentic Payment Protocol).
  * Enables agents to establish payment sessions with providers,
@@ -50,5 +102,49 @@ export declare class Ap2Client {
      * @returns Array of AP2 sessions
      */
     listAgentSessions(agentDid: string): Promise<Ap2Session[]>;
+    /**
+     * Sign an AP2 Intent or Cart mandate via the auth-bound wallet's Ed25519
+     * key. The node builds the canonical AP2 v0.2 preimage internally and
+     * signs with `WalletService` — the caller never sees raw key material.
+     * The returned Vdc self-verifies before being returned.
+     *
+     * Auth: DPoP+JWT mandatory. The wallet must be Ed25519. `signerDid` MUST
+     * match the controller of the auth-bound wallet (principal for intent,
+     * agent for cart).
+     *
+     * @param mandateKind - `"intent"` or `"cart"`.
+     * @param mandate - The full IntentMandate or CartMandate JSON.
+     * @param signerDid - Signer DID (principal for intent, agent for cart).
+     */
+    signMandate(mandateKind: 'intent' | 'cart', mandate: unknown, signerDid: string): Promise<unknown>;
+    /**
+     * Verify a single AP2 mandate (Verifiable Digital Credential).
+     *
+     * Checks the VDC proof, issuer, and schema for Intent, Cart, or Payment
+     * mandates per Google's AP2 specification.
+     *
+     * @param vdc - The full JSON-LD VC envelope with proof.
+     */
+    verifyMandate(vdc: unknown): Promise<Ap2MandateVerification>;
+    /**
+     * Validate an AP2 Intent+Cart mandate pair for consistency.
+     *
+     * Ensures the cart references the intent, amounts/items match the intent's
+     * constraints, and both VDCs verify. When `enforceDelegation` is true,
+     * additionally cross-checks the agent's TDIP `DelegationScope` against
+     * the cart total via `IdentityRegistry::enforce_operation(agent_did,
+     * "payment", total)`. Both layers must admit the cart.
+     *
+     * @param intentVdc - The principal-signed IntentMandate VDC.
+     * @param cartVdc - The agent-signed CartMandate VDC.
+     * @param enforceDelegation - If true, run the TDIP delegation gate after
+     *   AP2 validation succeeds. Defaults to false (AP2-only).
+     */
+    validateMandatePair(intentVdc: unknown, cartVdc: unknown, enforceDelegation?: boolean): Promise<Ap2MandatePairValidation>;
+    /**
+     * Return AP2 protocol metadata (version, supported mandate types,
+     * VC formats, and recognized DID methods).
+     */
+    protocolInfo(): Promise<Ap2ProtocolInfo>;
 }
 //# sourceMappingURL=ap2.d.ts.map

package/dist/ap2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ap2.d.ts","sourceRoot":"","sources":["../src/ap2.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,KAAK,EACV,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,YAAY,EACb,MAAM,SAAS,CAAC;AAEjB;;;;GAIG;AACH,qBAAa,SAAS;IACR,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,SAAS;IAE3C;;;;;;;;OAQG;IACG,aAAa,CACjB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,MAAe,GACrB,OAAO,CAAC,UAAU,CAAC;IAYtB;;;;;OAKG;IACG,gBAAgB,CACpB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,gBAAgB,CAAC;IAM5B;;;;;OAKG;IACG,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,cAAc,CAAC;IAM1B;;;;OAIG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAM7D;;;;OAIG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAMxD;;;;OAIG;IACG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;CAKjE"}
+{"version":3,"file":"ap2.d.ts","sourceRoot":"","sources":["../src/ap2.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,KAAK,EACV,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,YAAY,EACb,MAAM,SAAS,CAAC;AAEjB;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,sCAAsC;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,mDAAmD;IACnD,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,oEAAoE;IACpE,KAAK,EAAE,OAAO,CAAC;IACf,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sDAAsD;IACtD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,wDAAwD;IACxD,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,sEAAsE;IACtE,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAED;;;;GAIG;AACH,qBAAa,SAAS;IACR,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,SAAS;IAE3C;;;;;;;;OAQG;IACG,aAAa,CACjB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,MAAe,GACrB,OAAO,CAAC,UAAU,CAAC;IAYtB;;;;;OAKG;IACG,gBAAgB,CACpB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,gBAAgB,CAAC;IAM5B;;;;;OAKG;IACG,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,cAAc,CAAC;IAM1B;;;;OAIG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAM7D;;;;OAIG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAMxD;;;;OAIG;IACG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAQhE;;;;;;;;;;;;;OAaG;IACG,WAAW,CACf,WAAW,EAAE,QAAQ,GAAG,MAAM,EAC9B,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC;IAUnB;;;;;;;OAOG;IACG,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAMlE;;;;;;;;;;;;;OAaG;IACG,mBAAmB,CACvB,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,OAAO,EAChB,iBAAiB,GAAE,OAAe,GACjC,OAAO,CAAC,wBAAwB,CAAC;IAWpC;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC;CAG/C"}