{"_id":"@a2a-compliance/core","_rev":"5-eea279ed0e8e7ffd544efd589bf348dd","name":"@a2a-compliance/core","dist-tags":{"latest":"0.3.3"},"versions":{"0.1.0":{"name":"@a2a-compliance/core","version":"0.1.0","keywords":["a2a","agent2agent","compliance","testing","tck","llm","protocol"],"author":{"name":"a2a-compliance contributors"},"license":"MIT","_id":"@a2a-compliance/core@0.1.0","maintainers":[{"name":"demonskye","email":"rainer.lute.vp@gmail.com"}],"homepage":"https://github.com/UltraSkye/a2a-compliance#readme","bugs":{"url":"https://github.com/UltraSkye/a2a-compliance/issues"},"dist":{"shasum":"4a2e46e60bce6d30eef1933dcbe6eb214429a69c","tarball":"https://registry.npmjs.org/@a2a-compliance/core/-/core-0.1.0.tgz","fileCount":67,"integrity":"sha512-EZBkuLKaCmOMLipqIGcSaxGOox40oqOyWe+550NZs6aB3Vn/jLp3rf4P6HQTlNeu2czd5Jo+ht79vgv965St3A==","signatures":[{"sig":"MEQCIDLbtuTk/nvoexuxOWpn8aJtGQoE6d7sePqW+DYux0DoAiBkVH+G5Qrv9YR/r3gjwR6Qs+5Rp7GalXHFjipQvzIRkA==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":119353},"main":"./dist/index.js","type":"module","_from":"file:a2a-compliance-core-0.1.0.tgz","types":"./dist/index.d.ts","engines":{"node":">=22.10.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"scripts":{"dev":"tsc -p tsconfig.json --watch","test":"vitest run","build":"tsc -p tsconfig.build.json","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"demonskye","email":"rainer.lute.vp@gmail.com"},"_resolved":"/tmp/6523eac2a50c38a77a19e4f7f956cb2f/a2a-compliance-core-0.1.0.tgz","_integrity":"sha512-EZBkuLKaCmOMLipqIGcSaxGOox40oqOyWe+550NZs6aB3Vn/jLp3rf4P6HQTlNeu2czd5Jo+ht79vgv965St3A==","repository":{"url":"git+https://github.com/UltraSkye/a2a-compliance.git","type":"git","directory":"packages/core"},"_npmVersion":"11.11.0","description":"Assertion engine and reporters (JSON, JUnit, badge SVG) for A2A protocol compliance testing","directories":{},"sideEffects":false,"_nodeVersion":"24.14.1","dependencies":{"zod":"^4.0.0","@a2a-compliance/schemas":"0.1.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^4.1.4","typescript":"^5.6.0"},"_npmOperationalInternal":{"tmp":"tmp/core_0.1.0_1776502468611_0.2967531370706131","host":"s3://npm-registry-packages-npm-production"}},"0.3.0":{"name":"@a2a-compliance/core","version":"0.3.0","keywords":["a2a","a2a-protocol","a2a-compliance","a2a-validator","a2a-test-kit","a2a-conformance","a2a-security","a2a-sarif","agent2agent","agent-card","agent-card-validator","agent-compliance","agent-endpoint-tester","agent-protocol","ai-agent","ai-agents","llm-agent","llm-tools","google-a2a","jsonrpc","json-rpc","json-rpc-2.0","jsonrpc-compliance","compliance","compliance-testing","conformance","conformance-testing","tck","test-kit","validator","library","protocol","protocol-testing","security","security-audit","security-scanner","ssrf","ssrf-protection","cors","tls","dns-rebinding","oauth","oidc","openid-connect","sarif","junit","code-scanning","snapshot-testing","regression-testing","typescript","zod"],"author":{"name":"a2a-compliance contributors"},"license":"MIT","_id":"@a2a-compliance/core@0.3.0","maintainers":[{"name":"demonskye","email":"rainer.lute.vp@gmail.com"}],"homepage":"https://github.com/UltraSkye/a2a-compliance#readme","bugs":{"url":"https://github.com/UltraSkye/a2a-compliance/issues"},"dist":{"shasum":"c7d756aaf8ff82e424162cb972f11ba076ee9ef1","tarball":"https://registry.npmjs.org/@a2a-compliance/core/-/core-0.3.0.tgz","fileCount":91,"integrity":"sha512-JCK0MscSQAkRTIDpx5BId2QgQeT9l+ev95WrqspvCnhBSURWv5/sMK3kEwlnvLFek5ihbCYgcbm4f+hbm5HWGQ==","signatures":[{"sig":"MEYCIQD+QaPcplHcSiWkGeE36bafwzu0SgXb7/ezJDEPmis5cwIhALTkZpHe1tmip9rJfJYMtGzaADndbjj6bkU+c+t86CHb","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":198845},"main":"./dist/index.js","type":"module","_from":"file:a2a-compliance-core-0.3.0.tgz","types":"./dist/index.d.ts","engines":{"node":">=22.10.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"scripts":{"dev":"tsc -p tsconfig.json --watch","test":"vitest run","build":"tsc -p tsconfig.build.json","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"demonskye","email":"rainer.lute.vp@gmail.com"},"_resolved":"/tmp/d72d596e5f0518ca513d408686083b86/a2a-compliance-core-0.3.0.tgz","_integrity":"sha512-JCK0MscSQAkRTIDpx5BId2QgQeT9l+ev95WrqspvCnhBSURWv5/sMK3kEwlnvLFek5ihbCYgcbm4f+hbm5HWGQ==","repository":{"url":"git+https://github.com/UltraSkye/a2a-compliance.git","type":"git","directory":"packages/core"},"_npmVersion":"11.11.0","description":"Library for probing, validating, and reporting on A2A (Agent2Agent) protocol endpoints. Assertion engine + reporters (JSON, JUnit, SARIF 2.1.0, badge SVG, snapshot diff), SSRF guard, DNS-rebinding pin, check catalog. Used by @a2a-compliance/cli.","directories":{},"sideEffects":false,"_nodeVersion":"24.14.1","dependencies":{"zod":"^4.0.0","undici":"^8.1.0","@a2a-compliance/schemas":"0.3.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^4.1.4","typescript":"^5.6.0"},"_npmOperationalInternal":{"tmp":"tmp/core_0.3.0_1776508803170_0.349366272574158","host":"s3://npm-registry-packages-npm-production"}},"0.3.1":{"name":"@a2a-compliance/core","version":"0.3.1","keywords":["a2a","a2a-protocol","a2a-compliance","a2a-validator","a2a-test-kit","a2a-conformance","a2a-security","a2a-sarif","agent2agent","agent-card","agent-card-validator","agent-compliance","agent-endpoint-tester","agent-protocol","ai-agent","ai-agents","llm-agent","llm-tools","google-a2a","jsonrpc","json-rpc","json-rpc-2.0","jsonrpc-compliance","compliance","compliance-testing","conformance","conformance-testing","tck","test-kit","validator","library","protocol","protocol-testing","security","security-audit","security-scanner","ssrf","ssrf-protection","cors","tls","dns-rebinding","oauth","oidc","openid-connect","sarif","junit","code-scanning","snapshot-testing","regression-testing","typescript","zod"],"author":{"name":"a2a-compliance contributors"},"license":"MIT","_id":"@a2a-compliance/core@0.3.1","maintainers":[{"name":"demonskye","email":"rainer.lute.vp@gmail.com"}],"homepage":"https://github.com/UltraSkye/a2a-compliance#readme","bugs":{"url":"https://github.com/UltraSkye/a2a-compliance/issues"},"dist":{"shasum":"5fbe63314c10076082bdc3834659062ff0268e07","tarball":"https://registry.npmjs.org/@a2a-compliance/core/-/core-0.3.1.tgz","fileCount":91,"integrity":"sha512-qXonI8Ifd9V+UPiA1F2tO6xJkKbsrZ9YyGjr8oSE0UoAtn5rSM9oAXI/cXnZY+bXhZcONmEhw4Igr5j9HU01fg==","signatures":[{"sig":"MEYCIQDqdw7pvwKaSPyLTKZl6h0mN6pBoSbd1aWmvUp2yHGYuwIhAOV86EfpMkYD7m7mb4Tj3t4VwaERKe6rvsFyVgjV8fBj","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":198845},"main":"./dist/index.js","type":"module","_from":"file:a2a-compliance-core-0.3.1.tgz","types":"./dist/index.d.ts","engines":{"node":">=22.10.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"scripts":{"dev":"tsc -p tsconfig.json --watch","test":"vitest run","build":"tsc -p tsconfig.build.json","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"demonskye","email":"rainer.lute.vp@gmail.com"},"_resolved":"/tmp/1120e3a722a0a47f307a336a75ba6835/a2a-compliance-core-0.3.1.tgz","_integrity":"sha512-qXonI8Ifd9V+UPiA1F2tO6xJkKbsrZ9YyGjr8oSE0UoAtn5rSM9oAXI/cXnZY+bXhZcONmEhw4Igr5j9HU01fg==","repository":{"url":"git+https://github.com/UltraSkye/a2a-compliance.git","type":"git","directory":"packages/core"},"_npmVersion":"11.11.0","description":"Library for probing, validating, and reporting on A2A (Agent2Agent) protocol endpoints. Assertion engine + reporters (JSON, JUnit, SARIF 2.1.0, badge SVG, snapshot diff), SSRF guard, DNS-rebinding pin, check catalog. Used by @a2a-compliance/cli.","directories":{},"sideEffects":false,"_nodeVersion":"24.14.1","dependencies":{"zod":"^4.0.0","undici":"^8.1.0","@a2a-compliance/schemas":"0.3.1"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^4.1.4","typescript":"^5.6.0"},"_npmOperationalInternal":{"tmp":"tmp/core_0.3.1_1776509210782_0.14254044780594954","host":"s3://npm-registry-packages-npm-production"}},"0.3.2":{"name":"@a2a-compliance/core","version":"0.3.2","keywords":["a2a","a2a-protocol","a2a-compliance","a2a-validator","a2a-test-kit","a2a-conformance","a2a-security","a2a-sarif","agent2agent","agent-card","agent-card-validator","agent-compliance","agent-endpoint-tester","agent-protocol","ai-agent","ai-agents","llm-agent","llm-tools","google-a2a","jsonrpc","json-rpc","json-rpc-2.0","jsonrpc-compliance","compliance","compliance-testing","conformance","conformance-testing","tck","test-kit","validator","library","protocol","protocol-testing","security","security-audit","security-scanner","ssrf","ssrf-protection","cors","tls","dns-rebinding","oauth","oidc","openid-connect","sarif","junit","code-scanning","snapshot-testing","regression-testing","typescript","zod"],"author":{"name":"a2a-compliance contributors"},"license":"MIT","_id":"@a2a-compliance/core@0.3.2","maintainers":[{"name":"demonskye","email":"rainer.lute.vp@gmail.com"}],"homepage":"https://github.com/UltraSkye/a2a-compliance#readme","bugs":{"url":"https://github.com/UltraSkye/a2a-compliance/issues"},"dist":{"shasum":"a386011ea658e30ec7649fd1f178fc3ea82a7883","tarball":"https://registry.npmjs.org/@a2a-compliance/core/-/core-0.3.2.tgz","fileCount":91,"integrity":"sha512-jlYSZSqmQUyU6JRFlwsaLW9b0KUPmlBlf+AZUB1HYfMAq6kR5Qxn46gmTApXUMt5CQikYrWZUdor8XiZ4FwTLQ==","signatures":[{"sig":"MEQCIBAHkc4FOvsem31G2R0+imEgLQ4uP35ufGQkBAwtXQi1AiBNZ59i+mp06Xs4htefnCh6CwzvOqRmtK5y2JYY9/GwvQ==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":198845},"main":"./dist/index.js","type":"module","_from":"file:a2a-compliance-core-0.3.2.tgz","types":"./dist/index.d.ts","engines":{"node":">=22.10.0"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"scripts":{"dev":"tsc -p tsconfig.json --watch","test":"vitest run","build":"tsc -p tsconfig.build.json","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"demonskye","email":"rainer.lute.vp@gmail.com"},"_resolved":"/tmp/0fa7491a7725f750d91cacf47bc71ec6/a2a-compliance-core-0.3.2.tgz","_integrity":"sha512-jlYSZSqmQUyU6JRFlwsaLW9b0KUPmlBlf+AZUB1HYfMAq6kR5Qxn46gmTApXUMt5CQikYrWZUdor8XiZ4FwTLQ==","repository":{"url":"git+https://github.com/UltraSkye/a2a-compliance.git","type":"git","directory":"packages/core"},"_npmVersion":"11.11.0","description":"Library for probing, validating, and reporting on A2A (Agent2Agent) protocol endpoints. Assertion engine + reporters (JSON, JUnit, SARIF 2.1.0, badge SVG, snapshot diff), SSRF guard, DNS-rebinding pin, check catalog. Used by @a2a-compliance/cli.","directories":{},"sideEffects":false,"_nodeVersion":"24.14.1","dependencies":{"zod":"^4.0.0","undici":"^8.1.0","@a2a-compliance/schemas":"0.3.2"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^4.1.4","typescript":"^5.6.0"},"_npmOperationalInternal":{"tmp":"tmp/core_0.3.2_1776515200814_0.8747240215636478","host":"s3://npm-registry-packages-npm-production"}},"0.3.3":{"name":"@a2a-compliance/core","version":"0.3.3","description":"Library for probing, validating, and reporting on A2A (Agent2Agent) protocol endpoints. Assertion engine + reporters (JSON, JUnit, SARIF 2.1.0, badge SVG, snapshot diff), SSRF guard, DNS-rebinding pin, check catalog. Used by @a2a-compliance/cli.","keywords":["a2a","a2a-protocol","a2a-compliance","a2a-validator","a2a-test-kit","a2a-conformance","a2a-security","a2a-sarif","agent2agent","agent-card","agent-card-validator","agent-compliance","agent-endpoint-tester","agent-protocol","ai-agent","ai-agents","llm-agent","llm-tools","google-a2a","jsonrpc","json-rpc","json-rpc-2.0","jsonrpc-compliance","compliance","compliance-testing","conformance","conformance-testing","tck","test-kit","validator","library","protocol","protocol-testing","security","security-audit","security-scanner","ssrf","ssrf-protection","cors","tls","dns-rebinding","oauth","oidc","openid-connect","sarif","junit","code-scanning","snapshot-testing","regression-testing","typescript","zod"],"license":"MIT","author":{"name":"a2a-compliance contributors"},"homepage":"https://github.com/UltraSkye/a2a-compliance#readme","bugs":{"url":"https://github.com/UltraSkye/a2a-compliance/issues"},"repository":{"type":"git","url":"git+https://github.com/UltraSkye/a2a-compliance.git","directory":"packages/core"},"publishConfig":{"access":"public"},"engines":{"node":">=22.10.0"},"type":"module","sideEffects":false,"main":"./dist/index.js","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"dependencies":{"undici":"^8.1.0","zod":"^4.0.0","@a2a-compliance/schemas":"0.3.3"},"devDependencies":{"typescript":"^5.6.0","vitest":"^4.1.4"},"scripts":{"build":"tsc -p tsconfig.build.json","dev":"tsc -p tsconfig.json --watch","typecheck":"tsc -p tsconfig.json --noEmit","test":"vitest run"},"_id":"@a2a-compliance/core@0.3.3","_integrity":"sha512-pi07E0vw0N+9i4AnsgZpeq9EX1eAD5jSBVBoy8GqSF0mjjEMO2eS9/Z7ADmWG1xtG6KFm6kK+DufRDtRsiktcg==","_resolved":"/tmp/42253476f4cbb13245ce1a58bc4a019e/a2a-compliance-core-0.3.3.tgz","_from":"file:a2a-compliance-core-0.3.3.tgz","_nodeVersion":"24.14.1","_npmVersion":"11.11.0","dist":{"integrity":"sha512-pi07E0vw0N+9i4AnsgZpeq9EX1eAD5jSBVBoy8GqSF0mjjEMO2eS9/Z7ADmWG1xtG6KFm6kK+DufRDtRsiktcg==","shasum":"6831be74cbd8ecf6328b83b641bd0c0885e888de","tarball":"https://registry.npmjs.org/@a2a-compliance/core/-/core-0.3.3.tgz","fileCount":91,"unpackedSize":203702,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQDQJZLMOWxOhAvx2kcDvro/1kNWLYxmQUgNGPycafTL/AIgb0RWMgOo3CsJ29e+3B35XsfwcM0KQfikx0UYJqwFkk8="}]},"_npmUser":{"name":"demonskye","email":"rainer.lute.vp@gmail.com"},"directories":{},"maintainers":[{"name":"demonskye","email":"rainer.lute.vp@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/core_0.3.3_1777021542538_0.7198970141356036"},"_hasShrinkwrap":false}},"time":{"created":"2026-04-18T08:54:28.251Z","modified":"2026-04-24T09:05:42.834Z","0.1.0":"2026-04-18T08:54:28.763Z","0.3.0":"2026-04-18T10:40:03.543Z","0.3.1":"2026-04-18T10:46:50.949Z","0.3.2":"2026-04-18T12:26:40.947Z","0.3.3":"2026-04-24T09:05:42.703Z"},"bugs":{"url":"https://github.com/UltraSkye/a2a-compliance/issues"},"author":{"name":"a2a-compliance contributors"},"license":"MIT","homepage":"https://github.com/UltraSkye/a2a-compliance#readme","keywords":["a2a","a2a-protocol","a2a-compliance","a2a-validator","a2a-test-kit","a2a-conformance","a2a-security","a2a-sarif","agent2agent","agent-card","agent-card-validator","agent-compliance","agent-endpoint-tester","agent-protocol","ai-agent","ai-agents","llm-agent","llm-tools","google-a2a","jsonrpc","json-rpc","json-rpc-2.0","jsonrpc-compliance","compliance","compliance-testing","conformance","conformance-testing","tck","test-kit","validator","library","protocol","protocol-testing","security","security-audit","security-scanner","ssrf","ssrf-protection","cors","tls","dns-rebinding","oauth","oidc","openid-connect","sarif","junit","code-scanning","snapshot-testing","regression-testing","typescript","zod"],"repository":{"type":"git","url":"git+https://github.com/UltraSkye/a2a-compliance.git","directory":"packages/core"},"description":"Library for probing, validating, and reporting on A2A (Agent2Agent) protocol endpoints. Assertion engine + reporters (JSON, JUnit, SARIF 2.1.0, badge SVG, snapshot diff), SSRF guard, DNS-rebinding pin, check catalog. Used by @a2a-compliance/cli.","maintainers":[{"name":"demonskye","email":"rainer.lute.vp@gmail.com"}],"readme":"# @a2a-compliance/core\n\n> **TypeScript library for probing, validating, and reporting on\n> [A2A (Agent2Agent) protocol](https://a2a-protocol.org/) endpoints.**\n> Assertion engine, reporters (JSON / JUnit / SARIF / badge / snapshot),\n> SSRF guard, DNS-rebinding pin, check catalog. Zero CLI assumptions —\n> drop it into your own server, test harness, or agent dashboard.\n\n[![npm](https://img.shields.io/npm/v/%40a2a-compliance%2Fcore.svg)](https://www.npmjs.com/package/@a2a-compliance/core)\n[![license](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/UltraSkye/a2a-compliance/blob/main/LICENSE)\n\nPart of [`a2a-compliance`](https://github.com/UltraSkye/a2a-compliance).\nIf you just want the command-line tool, use\n[`@a2a-compliance/cli`](https://www.npmjs.com/package/@a2a-compliance/cli)\ninstead.\n\n## Install\n\n```bash\nnpm i @a2a-compliance/core\n# or\npnpm add @a2a-compliance/core\n```\n\nNode 22.10+ required.\n\n## Quick start\n\n```ts\nimport { runFullChecks } from '@a2a-compliance/core';\n\nconst report = await runFullChecks('https://agent.example.com');\n\nconsole.log(report.summary);\n// → { total: 16, pass: 15, fail: 1, warn: 0, skip: 0, tier: 'NON_COMPLIANT' }\n\nfor (const check of report.checks) {\n  if (check.status === 'fail') {\n    console.warn(`${check.id} [${check.category}]: ${check.message}`);\n  }\n}\n```\n\n### Card-only, faster\n\n```ts\nimport { runCardChecks } from '@a2a-compliance/core';\nconst report = await runCardChecks('https://agent.example.com');\n```\n\n### Reporters\n\n```ts\nimport { toBadgeSvg, toJUnitXml, toSarif } from '@a2a-compliance/core';\nimport { writeFileSync } from 'node:fs';\n\nwriteFileSync('./report.junit.xml', toJUnitXml(report));\nwriteFileSync('./badge.svg', toBadgeSvg(report, { tier: true }));\nwriteFileSync('./report.sarif', toSarif(report)); // SARIF 2.1.0 for GitHub code-scanning\n```\n\n### Snapshot regression detection\n\n```ts\nimport { toSnapshot, diffSnapshot, hasRegressions, parseSnapshot }\n  from '@a2a-compliance/core';\nimport { readFileSync, writeFileSync } from 'node:fs';\n\n// Capture a baseline\nwriteFileSync('./baseline.json', JSON.stringify(toSnapshot(report)));\n\n// Later: compare\nconst base = parseSnapshot(JSON.parse(readFileSync('./baseline.json', 'utf8')));\nif (base) {\n  const diff = diffSnapshot(base, newReport);\n  if (hasRegressions(diff)) process.exit(1);\n}\n```\n\n### SSRF guard for your own service\n\n```ts\nimport { ssrfCheckForUrl } from '@a2a-compliance/core';\n\nconst safety = await ssrfCheckForUrl(userSuppliedUrl);\nif (!safety.ok) throw new Error(`refusing to probe: ${safety.reason}`);\n```\n\nRejects loopback, RFC 1918, link-local (incl. `169.254.169.254` cloud\nmetadata), carrier-grade NAT, and IPv4-mapped / IPv4-compat / NAT64\nIPv6 forms of all the above.\n\n### Introspect the check catalog\n\n```ts\nimport { CHECK_CATALOG, explain, listCheckIds } from '@a2a-compliance/core';\n\nfor (const id of listCheckIds()) {\n  console.log(id, '→', CHECK_CATALOG[id]?.category);\n}\n\nconst meta = explain('sec.ssrf');\n// { id, category, severity, title, description, specRef? }\n```\n\n## CheckResult shape\n\n```ts\ntype Category = 'card' | 'protocol' | 'methods' | 'security' | 'spec' | 'auth';\ntype Severity = 'must' | 'should' | 'info';  // maps to RFC 2119\ntype CheckStatus = 'pass' | 'fail' | 'warn' | 'skip';\ntype ComplianceTier =\n  | 'NON_COMPLIANT'   // any MUST failed\n  | 'MANDATORY'       // all MUSTs pass, some SHOULDs fail/warn\n  | 'RECOMMENDED'     // all MUSTs + SHOULDs pass, some were skipped\n  | 'FULL_FEATURED';  // every emitted check passed\n\ninterface CheckResult {\n  id: string;                       // stable dotted id, e.g. 'sec.ssrf'\n  title: string;\n  category?: Category;\n  severity: Severity;\n  status: CheckStatus;\n  specRef?: { section: string; url: string };\n  message?: string;\n  evidence?: unknown;\n  durationMs: number;\n}\n```\n\nThe full assertion list is in\n[`docs/ARCHITECTURE.md`](https://github.com/UltraSkye/a2a-compliance/blob/main/docs/ARCHITECTURE.md)\non the repo — or read it at runtime via `CHECK_CATALOG`.\n\n## Spec version adaptation\n\n`runFullChecks` reads `protocolVersion` from the agent card and swaps\nthe JSON-RPC method names accordingly (A2A v0.3 `tasks/send` ↔ v1.0\n`message/send`, etc.). Unknown versions fall back to v1.0 with a\nSHOULD-level warning.\n\n## Capability-gated severity\n\nWhen the card declares `capabilities.streaming` or\n`capabilities.pushNotifications`, the corresponding probes are\npromoted from SHOULD to MUST — the \"false advertising\" rule.\n\n## DNS-rebinding pin\n\n`fetchWithTimeout(url, { pinDns: true })` resolves the hostname once,\nrefuses private-space targets, and feeds undici a\n`connect.lookup` that returns the pinned IP for every subsequent\nconnect — closes the TOCTOU residual documented in `SECURITY.md`.\n\n## Safety limits\n\n- 10 s timeout per outbound HTTP call\n- 2 MB response-body cap (`ResponseTooLargeError` on overrun)\n- Redirects followed manually with per-hop SSRF re-check (max 10 hops)\n\n## See also\n\n- 🏠 [Repository + full docs](https://github.com/UltraSkye/a2a-compliance)\n- 🤖 [`AGENTS.md`](https://github.com/UltraSkye/a2a-compliance/blob/main/AGENTS.md) — AI-agent quick reference\n- 🔌 [`@a2a-compliance/cli`](https://www.npmjs.com/package/@a2a-compliance/cli) — CLI wrapper\n- 🧪 [`@a2a-compliance/schemas`](https://www.npmjs.com/package/@a2a-compliance/schemas) — Zod schemas alone\n\n## License\n\nMIT.\n","readmeFilename":"README.md"}