Architecture.

The toolkit is not a monolith. Each package solves one external dependency (AFIP, BCRA, MP, Meta, Andreani, etc.) and ships independently to npm. They compose at the agent-loop level, there are no cross-package runtime dependencies beyond optional adapter subpaths.
That matters because an Argentine business-as-agent isn't one thing, it's the simultaneous operation of 5–7 external systems (taxpayer registry, payment processor, banking, invoicing, government identity, shipping carrier, public records). The toolkit is shaped around that fact.

The 16 packages

Composition flow

How a single agent.generate() call traverses the stack when an Argentine SaaS bills a B2B customer. Sequence diagram below, each arrow is a real tool invocation or HTTP round-trip. The audit log records every step with HMAC-signed timestamps; what the diagram hides is that all of those arrows return through AuditLogger.wrap() on the way back.

The Edge-Runtime contract

Every package in this list runs on Edge Runtime (Vercel Edge, Cloudflare Workers, Deno) without code changes. The contract:

1. Web Crypto only. No node:crypto in any production code path. HMAC, signature verification, idempotency-key generation all use crypto.subtle.

2. fetch-based HTTP. No got, axios, or node:http. The toolkit ships its own retry + circuit-breaker + deadline-propagation layer on top of the runtime's native fetch.

3. AbortSignal everywhere. Every long-running tool accepts a parent AbortSignal and propagates cancellation. The runtime kills hung tool calls cleanly when the request times out.

4. Pluggable state via subpath. InMemoryStateAdapter for tests + VercelKVStateAdapter for prod. Same interface; users pick where state lives.

Composition example: 5-package agent

The cookbook ships recipe 10: one agent loop wiring identity + identity-attest + mercadopago + facturacion + whatsapp. The flagship demo of the composition contract.

Full cookbook (17 production patterns): packages/mercadopago/cookbook.

Trust, audit, governance

npm provenance attestations (SLSA v1): every published tarball is cryptographically tied to the GitHub commit it was built from. npm view @ar-agents/mercadopago dist.attestations returns the Sigstore transparency-log entry.

OpenSSF Scorecard: weekly automated audit of 18 supply-chain practices. Score visible at scorecard.dev.

Programmatic HITL on irreversible ops: refunds, cancellations, deletions, marketplace token revokes, all 8 gated behind a requireConfirmationcallback the host implements. Tool functions literally don't execute until your callback returns true.

Audit log adapter: every tool call (input + output + duration + status) gets logged to a pluggable sink (in-memory, Vercel KV, your own). HMAC timestamps make the log forensically sound, see RFC-001 § 9 for the liability framework.