@agenticprimitives/delegation 1.0.0-alpha.40 → 1.0.0-alpha.42

package/dist/es256-evidence-minter.d.ts

@@ -0,0 +1,28 @@
+export interface Es256EvidenceMinterInput {
+    /** The attestation key's P-256 private scalar (32 bytes, hex). */
+    privateKeyHex: string;
+    /** `iss`, as the key service pins it. */
+    issuer: string;
+    /** `aud`, as the key service pins it. */
+    audience: string;
+    /** Statement lifetime; the key service checks `exp`. Default 120 s. */
+    ttlSeconds?: number;
+    /** Clock skew the statement tolerates backwards (`nbf`/`iat` = now − skew); the pilot CVM's clock lags. Default 120 s. */
+    skewSeconds?: number;
+    now?: () => number;
+    randomId?: () => string;
+}
+export interface Es256EvidenceMinter {
+    readonly kid: string;
+    publicJwk(): {
+        kty: 'EC';
+        crv: 'P-256';
+        x: string;
+        y: string;
+        kid: string;
+    };
+    /** A signed statement for `subject` carrying `claims` beside iss/aud/sub/iat/nbf/exp/jti. */
+    mint(subject: string, claims: Record<string, string | number | boolean>): Promise<string>;
+}
+export declare function createEs256EvidenceMinter(input: Es256EvidenceMinterInput): Es256EvidenceMinter;
+//# sourceMappingURL=es256-evidence-minter.d.ts.map

package/dist/es256-evidence-minter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"es256-evidence-minter.d.ts","sourceRoot":"","sources":["../src/es256-evidence-minter.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,wBAAwB;IACvC,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0HAA0H;IAC1H,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,SAAS,IAAI;QAAE,GAAG,EAAE,IAAI,CAAC;QAAC,GAAG,EAAE,OAAO,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5E,6FAA6F;IAC7F,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3F;AASD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,CAuB9F"}

package/dist/es256-evidence-minter.js

@@ -0,0 +1,48 @@
+// THE RELEASE'S OWN ATTESTATION KEY — the ES256 key a runtime signs its bound-evidence statements with (faithkms ADR-0012 /
+// zkID alignment Z6). It lives beside `createPresentationRelease` because the statement IS the release's: what it judged. A key service's P-256 device key signs only under a statement naming the digest, the venue and the
+// predicate digest the presentation release judged; this is the minter of that statement, as a compact JWS (RFC 7515)
+// with JWT claims (RFC 7519): `iss` / `aud` pinned by the key service's `[authority_evidence]` section, `sub` = the actor
+// the release acted for, `jti` fresh, a short window, and the caller's claims beside them.
+//
+// NOT a device key and NOT a person's key: it is a secret the runtime holds the way it holds its relay key, so it carries
+// no local-provider production guard — the guard is the key service's: it verifies the statement against the JWKS the
+// operator pinned, and refuses any other issuer. `kid` = RFC 7638 thumbprint, published beside the public JWK.
+import { p256 } from '@noble/curves/nist.js';
+import { hexToBytes } from 'viem';
+import { p256JwkThumbprint } from '@agenticprimitives/key-custody';
+const b64url = (b) => {
+    const bytes = typeof b === 'string' ? new TextEncoder().encode(b) : b;
+    let s = '';
+    for (let i = 0; i < bytes.length; i++)
+        s += String.fromCharCode(bytes[i]);
+    return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+export function createEs256EvidenceMinter(input) {
+    const hex = input.privateKeyHex.startsWith('0x') ? input.privateKeyHex : `0x${input.privateKeyHex}`;
+    const priv = hexToBytes(hex);
+    if (priv.length !== 32)
+        throw new Error(`[es256-evidence] a P-256 private key is 32 bytes; got ${priv.length}`);
+    if (!input.issuer || !input.audience)
+        throw new Error('[es256-evidence] issuer and audience are pinned by the key service and must be named');
+    const pub = p256.getPublicKey(priv, false);
+    const x = b64url(pub.slice(1, 33)), y = b64url(pub.slice(33, 65));
+    const kid = p256JwkThumbprint({ x, y });
+    const now = input.now ?? (() => Math.floor(Date.now() / 1000));
+    const randomId = input.randomId ?? (() => crypto.randomUUID());
+    const ttl = input.ttlSeconds ?? 120, skew = input.skewSeconds ?? 120;
+    const header = b64url(JSON.stringify({ alg: 'ES256', typ: 'JWT', kid }));
+    return {
+        kid,
+        publicJwk: () => ({ kty: 'EC', crv: 'P-256', x, y, kid }),
+        async mint(subject, claims) {
+            for (const k of ['iss', 'aud', 'sub', 'iat', 'nbf', 'exp', 'jti'])
+                if (k in claims)
+                    throw new Error(`[es256-evidence] ${k} is the minter's, not the caller's`);
+            const t = now();
+            const body = b64url(JSON.stringify({ iss: input.issuer, aud: input.audience, sub: subject, iat: t - skew, nbf: t - skew, exp: t + ttl, jti: randomId(), ...claims }));
+            const sig = p256.sign(new TextEncoder().encode(`${header}.${body}`), priv, { prehash: true, lowS: true });
+            return `${header}.${body}.${b64url(sig)}`;
+        },
+    };
+}
+//# sourceMappingURL=es256-evidence-minter.js.map

package/dist/es256-evidence-minter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"es256-evidence-minter.js","sourceRoot":"","sources":["../src/es256-evidence-minter.ts"],"names":[],"mappings":"AAAA,4HAA4H;AAC5H,6NAA6N;AAC7N,sHAAsH;AACtH,0HAA0H;AAC1H,2FAA2F;AAC3F,EAAE;AACF,0HAA0H;AAC1H,sHAAsH;AACtH,+GAA+G;AAC/G,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAwBnE,MAAM,MAAM,GAAG,CAAC,CAAsB,EAAU,EAAE;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC,CAAC;AAEF,MAAM,UAAU,yBAAyB,CAAC,KAA+B;IACvE,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;IACpG,MAAM,IAAI,GAAG,UAAU,CAAC,GAAoB,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAChH,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;IAC9I,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,IAAI,GAAG,KAAK,CAAC,WAAW,IAAI,GAAG,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACzE,OAAO;QACL,GAAG;QACH,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM;YACxB,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;gBAAE,IAAI,CAAC,IAAI,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,oCAAoC,CAAC,CAAC;YAC/J,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;YACtK,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1G,OAAO,GAAG,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -35,5 +35,7 @@ export { reissueForRotation, currentWireOf, wireSigning, lineageRecordType, LINE
 export { buildStandingWire, signedStandingWire, parkedNeedOf, standingCovers, standingFor, deriveFromStanding, isStandingWire, standingRequirementType, type StandingWireV1, type BuildStandingWireInput, type ParkedNeedV1, type DerivedChain, } from './standing.js';
 export { PRESENTATION_SCOPE_ENFORCER, encodePresentationScopeTerms, decodePresentationScopeTerms, buildPresentationScopeCaveat, type PresentationScopeTerms, } from './caveats.js';
 export { PRESENTATION_RAR_TYPE, PRESENTATION_CAPABILITY, presentationHandler } from './mandate-handlers.js';
-export { createPresentationRelease, presentationIntent, parseAudienceBoundChallenge, PresentationReleaseRefused, type PresentationIntentV1, type PresentationStepV1, type PresentationRelease, type PresentationReleaseInput, type DeviceSignerLike, type PresentationRefusalCode, } from './presentation-release.js';
+export { createPresentationRelease, presentationIntent, parseAudienceBoundChallenge, PresentationReleaseRefused, boundEvidenceClaims, boundEvidenceFrom, type BoundEvidenceFactsV1, type BoundEvidencePort, } from './presentation-release.js';
+export { createEs256EvidenceMinter, type Es256EvidenceMinter, type Es256EvidenceMinterInput } from './es256-evidence-minter.js';
+export { type PresentationIntentV1, type PresentationStepV1, type PresentationRelease, type PresentationReleaseInput, type DeviceSignerLike, type PresentationRefusalCode, } from './presentation-release.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,EACtB,2BAA2B,EAAE,uCAAuC;AACpE,yBAAyB,EAAE,qDAAqD;AAChF,0BAA0B,EAC1B,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,yBAAyB,EACzG,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAElJ,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAEnG,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhF;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAIhE,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,2BAA2B,EAC3B,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAM3E,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AACrG,OAAO,EAAE,SAAS,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAG9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAIxG,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,wBAAwB,EACxB,2BAA2B,EAC3B,gCAAgC,EAChC,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACV,OAAO,EACP,GAAG,EACH,MAAM,EACN,aAAa,EACb,aAAa,EACb,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,YAAY,EACZ,SAAS,EACT,WAAW,EACX,UAAU,GACX,MAAM,YAAY,CAAC;AAKpB,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,oBAAoB,EAEpB,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,GACrE,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,UAAU,GACX,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,cAAc,EACd,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAC/G,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AAExI,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,KAAK,mBAAmB,EAAE,KAAK,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGtN,OAAO,EACL,iBAAiB,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE,cAAc,EAAE,uBAAuB,EAC7I,KAAK,cAAc,EAAE,KAAK,sBAAsB,EAAE,KAAK,YAAY,EAAE,KAAK,YAAY,GACvF,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,2BAA2B,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,4BAA4B,EACrH,KAAK,sBAAsB,GAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5G,OAAO,EACL,yBAAyB,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,0BAA0B,EACtG,KAAK,oBAAoB,EAAE,KAAK,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,KAAK,gBAAgB,EAAE,KAAK,uBAAuB,GACjK,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,EACtB,2BAA2B,EAAE,uCAAuC;AACpE,yBAAyB,EAAE,qDAAqD;AAChF,0BAA0B,EAC1B,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,yBAAyB,EACzG,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAElJ,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAEnG,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhF;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAIhE,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,2BAA2B,EAC3B,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAM3E,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AACrG,OAAO,EAAE,SAAS,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAG9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAIxG,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,wBAAwB,EACxB,2BAA2B,EAC3B,gCAAgC,EAChC,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACV,OAAO,EACP,GAAG,EACH,MAAM,EACN,aAAa,EACb,aAAa,EACb,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,YAAY,EACZ,SAAS,EACT,WAAW,EACX,UAAU,GACX,MAAM,YAAY,CAAC;AAKpB,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,oBAAoB,EAEpB,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,GACrE,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,UAAU,GACX,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,cAAc,EACd,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAC/G,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AAExI,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,KAAK,mBAAmB,EAAE,KAAK,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGtN,OAAO,EACL,iBAAiB,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE,cAAc,EAAE,uBAAuB,EAC7I,KAAK,cAAc,EAAE,KAAK,sBAAsB,EAAE,KAAK,YAAY,EAAE,KAAK,YAAY,GACvF,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,2BAA2B,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,4BAA4B,EACrH,KAAK,sBAAsB,GAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5G,OAAO,EACL,yBAAyB,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,0BAA0B,EACtG,mBAAmB,EAAE,iBAAiB,EAAE,KAAK,oBAAoB,EAAE,KAAK,iBAAiB,GAC1F,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,yBAAyB,EAAE,KAAK,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAChI,OAAO,EACL,KAAK,oBAAoB,EAAE,KAAK,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,KAAK,gBAAgB,EAAE,KAAK,uBAAuB,GACjK,MAAM,2BAA2B,CAAC"}

package/dist/index.js

@@ -47,5 +47,7 @@ export { buildStandingWire, signedStandingWire, parkedNeedOf, standingCovers, st
 // presentation-scope caveat, and the key release that judges a mandate per signature before the device key signs.
 export { PRESENTATION_SCOPE_ENFORCER, encodePresentationScopeTerms, decodePresentationScopeTerms, buildPresentationScopeCaveat, } from './caveats.js';
 export { PRESENTATION_RAR_TYPE, PRESENTATION_CAPABILITY, presentationHandler } from './mandate-handlers.js';
-export { createPresentationRelease, presentationIntent, parseAudienceBoundChallenge, PresentationReleaseRefused, } from './presentation-release.js';
+export { createPresentationRelease, presentationIntent, parseAudienceBoundChallenge, PresentationReleaseRefused, boundEvidenceClaims, boundEvidenceFrom, } from './presentation-release.js';
+// The release's attestation key: mints the bound-evidence statement a key-service P-256 key signs under (faithkms ADR-0012).
+export { createEs256EvidenceMinter } from './es256-evidence-minter.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,EAAE;AACF,2DAA2D;AAE3D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,EACtB,2BAA2B,EAAE,uCAAuC;AACpE,yBAAyB,EAAE,qDAAqD;AAChF,0BAA0B,EAC1B,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,yBAAyB,EACzG,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACnG,2FAA2F;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhF;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,gGAAgG;AAChG,yFAAyF;AACzF,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,2BAA2B,EAC3B,cAAc,GACf,MAAM,2BAA2B,CAAC;AAUnC,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,iEAAiE;AACjE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AACrG,OAAO,EAAE,SAAS,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAE9F,8FAA8F;AAC9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGnD,6EAA6E;AAC7E,0EAA0E;AAC1E,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAuC/B,sGAAsG;AACtG,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,oBAAoB;AACpB,gCAAgC;AAChC,YAAY,EAAE,UAAU,EAAE,mBAAmB,GAC9C,MAAM,cAAc,CAAC;AAetB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,cAAc,EACd,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,uIAAuI;AACvI,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAE/G,6GAA6G;AAC7G,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,wBAAwB,EAAsE,MAAM,cAAc,CAAC;AACtN,uHAAuH;AACvH,wGAAwG;AACxG,OAAO,EACL,iBAAiB,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE,cAAc,EAAE,uBAAuB,GAE9I,MAAM,eAAe,CAAC;AACvB,gHAAgH;AAChH,kHAAkH;AAClH,OAAO,EACL,2BAA2B,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,4BAA4B,GAEtH,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5G,OAAO,EACL,yBAAyB,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,0BAA0B,GAEvG,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,EAAE;AACF,2DAA2D;AAE3D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,EACtB,2BAA2B,EAAE,uCAAuC;AACpE,yBAAyB,EAAE,qDAAqD;AAChF,0BAA0B,EAC1B,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,yBAAyB,EACzG,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACnG,2FAA2F;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhF;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,gGAAgG;AAChG,yFAAyF;AACzF,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,2BAA2B,EAC3B,cAAc,GACf,MAAM,2BAA2B,CAAC;AAUnC,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,iEAAiE;AACjE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AACrG,OAAO,EAAE,SAAS,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAE9F,8FAA8F;AAC9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGnD,6EAA6E;AAC7E,0EAA0E;AAC1E,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAuC/B,sGAAsG;AACtG,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,oBAAoB;AACpB,gCAAgC;AAChC,YAAY,EAAE,UAAU,EAAE,mBAAmB,GAC9C,MAAM,cAAc,CAAC;AAetB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,cAAc,EACd,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,uIAAuI;AACvI,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAE/G,6GAA6G;AAC7G,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,wBAAwB,EAAsE,MAAM,cAAc,CAAC;AACtN,uHAAuH;AACvH,wGAAwG;AACxG,OAAO,EACL,iBAAiB,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE,cAAc,EAAE,uBAAuB,GAE9I,MAAM,eAAe,CAAC;AACvB,gHAAgH;AAChH,kHAAkH;AAClH,OAAO,EACL,2BAA2B,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,4BAA4B,GAEtH,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5G,OAAO,EACL,yBAAyB,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,0BAA0B,EACtG,mBAAmB,EAAE,iBAAiB,GACvC,MAAM,2BAA2B,CAAC;AACnC,6HAA6H;AAC7H,OAAO,EAAE,yBAAyB,EAA2D,MAAM,4BAA4B,CAAC"}

package/dist/presentation-release.d.ts

@@ -1,10 +1,37 @@
 import type { Address, Delegation, Hex } from './types.js';
 import { type EnforcerAddresses, type MandateDecision, type SubsetHandlers } from './mandate.js';
 import type { MethodAuthorizationChecks } from './method-authorization.js';
-/** ES256 over a MESSAGE (hash inside), raw r||s low-S — key-custody's `JwsSignerPort`, structurally. */
+/** ES256 over a MESSAGE (hash inside), raw r||s low-S — key-custody's `JwsSignerPort`, structurally. `context` is the bound
+ *  evidence this release minted for the signature (a key-service key refuses without it; a local key ignores it). */
 export interface DeviceSignerLike {
-    sign(message: Uint8Array): Promise<Uint8Array>;
+    sign(message: Uint8Array, context?: {
+        evidenceToken: string;
+        audience: string;
+    }): Promise<Uint8Array>;
 }
+/** WHAT THE RELEASE JUDGED, as facts a key service can hold the signature to (faithkms ADR-0012): the digest the key will
+ *  sign, the venue (the audience the challenge is bound to), the predicate program, and the actor the release acted for. */
+export interface BoundEvidenceFactsV1 {
+    digest: Hex;
+    venue: string;
+    predicateDigest: Hex;
+    subject: Address;
+}
+/** The claims a key service reads off the evidence statement — its wire names. */
+export declare const boundEvidenceClaims: (f: BoundEvidenceFactsV1) => {
+    digest: Hex;
+    venue: string;
+    predicate_digest: Hex;
+};
+/** Mints the evidence statement for ONE judged signature — the release calls it after `allow`, never before. */
+export type BoundEvidencePort = (facts: BoundEvidenceFactsV1) => Promise<{
+    evidenceToken: string;
+    audience: string;
+}>;
+/** A `BoundEvidencePort` over key-custody's `createEs256EvidenceMinter` (structurally: anything that `mint(subject, claims)`). */
+export declare const boundEvidenceFrom: (minter: {
+    mint(subject: string, claims: Record<string, string>): Promise<string>;
+}) => BoundEvidencePort;
 /** THE REASON a presentation mandate is bound to: the statement the person agreed her agent may prove. One intent per
  *  (audience, predicate program, issuer facet); every challenge under it is the same reason, which is what makes the
  *  wire standing within its window rather than a signature per nonce. */
@@ -43,6 +70,8 @@ export interface PresentationReleaseInput {
     now: () => number;
     /** The custodied device key. */
     signer: DeviceSignerLike;
+    /** The release's attestation of what it judged, handed to the key with each signature (required by a key-service key). */
+    evidence?: BoundEvidencePort;
     handlers?: SubsetHandlers;
     /** Every decision, allow or deny, with its evidence — the receipt's raw material. */
     onDecision?: (d: {

package/dist/presentation-release.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"presentation-release.d.ts","sourceRoot":"","sources":["../src/presentation-release.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAwB,KAAK,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AACvH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAG3E,wGAAwG;AACxG,MAAM,WAAW,gBAAgB;IAAG,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CAAE;AAEpF;;yEAEyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,GAAG,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AACD,eAAO,MAAM,kBAAkB,MAAO;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,GAAG,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,KAAG,oBACuC,CAAC;AAEhJ;+FAC+F;AAC/F,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,UAAU,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAM3H;AAED,MAAM,MAAM,uBAAuB,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,mBAAmB,CAAC;AACzH,qBAAa,0BAA2B,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,uBAAuB;IAAmB,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe;gBAAnF,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,EAAW,QAAQ,CAAC,EAAE,eAAe,YAAA;CAIzG;AAED,MAAM,WAAW,wBAAwB;IACvC,gHAAgH;IAChH,OAAO,EAAE,UAAU,CAAC;IACpB,4EAA4E;IAC5E,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,iBAAiB,CAAC;IAC7B,MAAM,EAAE,yBAAyB,CAAC;IAClC,0CAA0C;IAC1C,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,gCAAgC;IAChC,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,qFAAqF;IACrF,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAC;QAAC,QAAQ,EAAE,eAAe,CAAA;KAAE,KAAK,IAAI,CAAC;CACnF;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,GAAG,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,wHAAwH;IACxH,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACzE,yGAAyG;IACzG,KAAK,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC3D;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,CAgC9F"}
+{"version":3,"file":"presentation-release.d.ts","sourceRoot":"","sources":["../src/presentation-release.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAwB,KAAK,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AACvH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAG3E;qHACqH;AACrH,MAAM,WAAW,gBAAgB;IAAG,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CAAE;AAE3I;4HAC4H;AAC5H,MAAM,WAAW,oBAAoB;IAAG,MAAM,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE;AAC5G,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,MAAO,oBAAoB,KAAG;IAAE,MAAM,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,GAAG,CAAA;CACM,CAAC;AACxH,gHAAgH;AAChH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AACtH,kIAAkI;AAClI,eAAO,MAAM,iBAAiB,WAAY;IAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,KAAG,iBACI,CAAC;AAE5H;;yEAEyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,GAAG,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AACD,eAAO,MAAM,kBAAkB,MAAO;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,GAAG,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,KAAG,oBACuC,CAAC;AAEhJ;+FAC+F;AAC/F,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,UAAU,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAM3H;AAED,MAAM,MAAM,uBAAuB,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,mBAAmB,CAAC;AACzH,qBAAa,0BAA2B,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,uBAAuB;IAAmB,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe;gBAAnF,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,EAAW,QAAQ,CAAC,EAAE,eAAe,YAAA;CAIzG;AAED,MAAM,WAAW,wBAAwB;IACvC,gHAAgH;IAChH,OAAO,EAAE,UAAU,CAAC;IACpB,4EAA4E;IAC5E,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,iBAAiB,CAAC;IAC7B,MAAM,EAAE,yBAAyB,CAAC;IAClC,0CAA0C;IAC1C,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,gCAAgC;IAChC,MAAM,EAAE,gBAAgB,CAAC;IACzB,0HAA0H;IAC1H,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,qFAAqF;IACrF,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAC;QAAC,QAAQ,EAAE,eAAe,CAAA;KAAE,KAAK,IAAI,CAAC;CACnF;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,GAAG,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,wHAAwH;IACxH,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACzE,yGAAyG;IACzG,KAAK,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC3D;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,CAqC9F"}

package/dist/presentation-release.js

@@ -13,8 +13,14 @@
 // from a session EOA to a custodied P-256 key and the policy moved from code the MCP ran to a caveat the key enforces.
 // Where a managed KMS holds the key (AKCS, once it has a P-256 kind), THIS check is what it runs before releasing the
 // signature; until then it runs in front of the local signer, with the same wire and the same reasons.
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex } from 'viem';
 import { verifyMandateForStep } from './mandate.js';
 import { PRESENTATION_CAPABILITY, PRESENTATION_RAR_TYPE, DEFAULT_SUBSET_HANDLERS } from './mandate-handlers.js';
+/** The claims a key service reads off the evidence statement — its wire names. */
+export const boundEvidenceClaims = (f) => ({ digest: f.digest.toLowerCase(), venue: f.venue, predicate_digest: f.predicateDigest.toLowerCase() });
+/** A `BoundEvidencePort` over key-custody's `createEs256EvidenceMinter` (structurally: anything that `mint(subject, claims)`). */
+export const boundEvidenceFrom = (minter) => async (facts) => ({ evidenceToken: await minter.mint(facts.subject, boundEvidenceClaims(facts)), audience: facts.venue });
 export const presentationIntent = (i) => ({ type: 'PresentationIntentV1', audience: i.audience, predicateDigest: i.predicateDigest.toLowerCase(), issuerKeyId: i.issuerKeyId });
 /** An audience-bound challenge: `<scheme>:<audience>:<nonce>`. The audience is everything between the first and the
  *  last colon, so a URL audience with its own colon survives; the nonce never contains one. */
@@ -74,7 +80,13 @@ export function createPresentationRelease(input) {
                 throw new PresentationReleaseRefused('mandate-denied', decision.reasons.map((r) => `${r.code}: ${r.message}`).join('; '), decision);
             if (decision.decision === 'approval-required')
                 throw new PresentationReleaseRefused('approval-required', 'the mandate requires an approval this release cannot collect', decision);
-            return input.signer.sign(message);
+            if (!input.evidence)
+                return input.signer.sign(message);
+            // THE JUDGE ATTESTS WHAT IT JUDGED: the digest the key is about to sign, the venue the challenge is bound to, the
+            // predicate program of this step, the actor — minted only after `allow`, so a key that requires it cannot be asked
+            // for a signature the mandate did not cover.
+            const context = await input.evidence({ digest: bytesToHex(sha256(message)), venue: bound.audience, predicateDigest: step.predicateDigest.toLowerCase(), subject: input.actor });
+            return input.signer.sign(message, context);
         },
     };
 }

package/dist/presentation-release.js.map

@@ -1 +1 @@
-{"version":3,"file":"presentation-release.js","sourceRoot":"","sources":["../src/presentation-release.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,EAAE;AACF,iHAAiH;AACjH,qHAAqH;AACrH,4GAA4G;AAC5G,mHAAmH;AACnH,sHAAsH;AACtH,qHAAqH;AACrH,gHAAgH;AAChH,qHAAqH;AACrH,EAAE;AACF,sHAAsH;AACtH,uHAAuH;AACvH,sHAAsH;AACtH,uGAAuG;AAGvG,OAAO,EAAE,oBAAoB,EAAqE,MAAM,cAAc,CAAC;AAEvH,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAchH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAkE,EAAwB,EAAE,CAC7H,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,WAAW,EAAS,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAEhJ;+FAC+F;AAC/F,MAAM,UAAU,2BAA2B,CAAC,OAAmB;IAC7D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAChG,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9D,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;AAC9G,CAAC;AAGD,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC9B;IAAyD;IAA9E,YAAqB,IAA6B,EAAE,OAAe,EAAW,QAA0B;QACtG,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,SAAI,GAAJ,IAAI,CAAyB;QAA4B,aAAQ,GAAR,QAAQ,CAAkB;QAEtG,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AA+BD,MAAM,UAAU,yBAAyB,CAAC,KAA+B;IACvE,MAAM,KAAK,GAAG,KAAK,EAAE,IAAwB,EAA4B,EAAE;QACzE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC;YAC1C,SAAS,EAAE,KAAK,CAAC,OAAO;YACxB,eAAe,EAAE,qBAAqB;YACtC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE;gBACJ,UAAU,EAAE,uBAAuB;gBACnC,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC;gBAChC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;aACtH;YACD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,uBAAuB;SACpD,CAAC,CAAC;QACH,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvC,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,OAAO;QACL,KAAK;QACL,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO;YACtB,MAAM,KAAK,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,0BAA0B,CAAC,mBAAmB,EAAE,0GAA0G,CAAC,CAAC;YAClL,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,0BAA0B,CAAC,mBAAmB,EAAE,6BAA6B,KAAK,CAAC,QAAQ,kCAAkC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC9L,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM;gBAAE,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;YACtK,IAAI,QAAQ,CAAC,QAAQ,KAAK,mBAAmB;gBAAE,MAAM,IAAI,0BAA0B,CAAC,mBAAmB,EAAE,8DAA8D,EAAE,QAAQ,CAAC,CAAC;YACnL,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"presentation-release.js","sourceRoot":"","sources":["../src/presentation-release.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,EAAE;AACF,iHAAiH;AACjH,qHAAqH;AACrH,4GAA4G;AAC5G,mHAAmH;AACnH,sHAAsH;AACtH,qHAAqH;AACrH,gHAAgH;AAChH,qHAAqH;AACrH,EAAE;AACF,sHAAsH;AACtH,uHAAuH;AACvH,sHAAsH;AACtH,uGAAuG;AAEvG,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAElC,OAAO,EAAE,oBAAoB,EAAqE,MAAM,cAAc,CAAC;AAEvH,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAShH,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAuB,EAAyD,EAAE,CACpH,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,EAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,eAAe,CAAC,WAAW,EAAS,EAAE,CAAC,CAAC;AAGxH,kIAAkI;AAClI,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAkF,EAAqB,EAAE,CACzI,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;AAW5H,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAkE,EAAwB,EAAE,CAC7H,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,WAAW,EAAS,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAEhJ;+FAC+F;AAC/F,MAAM,UAAU,2BAA2B,CAAC,OAAmB;IAC7D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAChG,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9D,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;AAC9G,CAAC;AAGD,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC9B;IAAyD;IAA9E,YAAqB,IAA6B,EAAE,OAAe,EAAW,QAA0B;QACtG,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,SAAI,GAAJ,IAAI,CAAyB;QAA4B,aAAQ,GAAR,QAAQ,CAAkB;QAEtG,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAiCD,MAAM,UAAU,yBAAyB,CAAC,KAA+B;IACvE,MAAM,KAAK,GAAG,KAAK,EAAE,IAAwB,EAA4B,EAAE;QACzE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC;YAC1C,SAAS,EAAE,KAAK,CAAC,OAAO;YACxB,eAAe,EAAE,qBAAqB;YACtC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE;gBACJ,UAAU,EAAE,uBAAuB;gBACnC,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC;gBAChC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;aACtH;YACD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,uBAAuB;SACpD,CAAC,CAAC;QACH,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvC,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,OAAO;QACL,KAAK;QACL,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO;YACtB,MAAM,KAAK,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,0BAA0B,CAAC,mBAAmB,EAAE,0GAA0G,CAAC,CAAC;YAClL,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,0BAA0B,CAAC,mBAAmB,EAAE,6BAA6B,KAAK,CAAC,QAAQ,kCAAkC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC9L,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM;gBAAE,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;YACtK,IAAI,QAAQ,CAAC,QAAQ,KAAK,mBAAmB;gBAAE,MAAM,IAAI,0BAA0B,CAAC,mBAAmB,EAAE,8DAA8D,EAAE,QAAQ,CAAC,CAAC;YACnL,IAAI,CAAC,KAAK,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvD,kHAAkH;YAClH,mHAAmH;YACnH,6CAA6C;YAC7C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAS,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACvL,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/delegation",
-  "version": "1.0.0-alpha.40",
+  "version": "1.0.0-alpha.42",
   "description": "EIP-712 smart-account delegations with caveats; web→agent→MCP token flow; session lifecycle.",
   "homepage": "https://agenticprimitives.dev",
   "bugs": {
@@ -40,11 +40,11 @@
   },
   "peerDependencies": {
     "viem": "^2.52.2",
-    "@agenticprimitives/agent-account": "^1.0.0-alpha.40",
-    "@agenticprimitives/audit": "^1.0.0-alpha.40",
-    "@agenticprimitives/connect-auth": "^1.0.0-alpha.40",
-    "@agenticprimitives/key-custody": "^1.0.0-alpha.40",
-    "@agenticprimitives/types": "^1.0.0-alpha.40"
+    "@agenticprimitives/agent-account": "^1.0.0-alpha.42",
+    "@agenticprimitives/audit": "^1.0.0-alpha.42",
+    "@agenticprimitives/connect-auth": "^1.0.0-alpha.42",
+    "@agenticprimitives/key-custody": "^1.0.0-alpha.42",
+    "@agenticprimitives/types": "^1.0.0-alpha.42"
   },
   "devDependencies": {
     "vitest": "^4.1.11"