@atrib/verify 0.6.0 → 0.7.0

package/README.md

@@ -232,7 +232,30 @@ Checks performed when evidence is present:
 - Optional `client_id`, subject, actor subject, and `cnf.jkt` checks.
 - Optional DPoP proof checks for `htm`, `htu`, `ath`, `jti`, `iat`, nonce when supplied, and `cnf.jkt` binding.
 
-The default signature policy is `require`. Missing trusted keys or unverified decoded claims make the evidence block invalid. Use `signaturePolicy: "best-effort"` only for advisory triage. DPoP replay state stays caller-owned: pass `seenJtis` for one-process checks or a shared `dpopReplayCache` for deployments that need atomic replay defense across workers.
+The default signature policy is `require`. Missing trusted keys or unverified decoded claims make the evidence block invalid. Use `signaturePolicy: "best-effort"` only for advisory triage. DPoP replay state stays caller-owned: pass `seenJtis` for one-process checks, `MemoryDpopReplayCache` for one-process services, or `createFetchDpopReplayCache()` when a deployment exposes a shared atomic replay-cache endpoint.
+
+```typescript
+import { createFetchDpopReplayCache, verifyRecord } from '@atrib/verify'
+
+const dpopReplayCache = createFetchDpopReplayCache({
+  endpoint: 'https://replay-cache.example.com/v1/dpop/check',
+  headers: { Authorization: `Bearer ${process.env.REPLAY_CACHE_TOKEN}` },
+})
+
+const result = await verifyRecord(record, {
+  authorizationEvidence: [
+    {
+      protocol: 'mcp_oauth',
+      claims,
+      claimsVerified: true,
+      dpopProof,
+      dpopReplayCache,
+    },
+  ],
+})
+```
+
+The shared endpoint must atomically remember the posted key until `expires_at_seconds` and return `{ "accepted": true }` for a new proof or `{ "accepted": false }` for replay. The storage backend can be Redis, Durable Objects, Postgres, or another compare-and-set primitive owned by the host.
 
 Producer-side MCP capture lives in `@atrib/mcp` behind the opt-in `authorizationEvidence` option. The producer writes evidence into the local-only sidecar without storing raw bearer tokens by default. Verifiers can pass that sidecar's `authorizationEvidence` and `resolvedFacts` to `verifyRecord()`.
 
@@ -331,6 +354,7 @@ For advanced use (custom calculators, alternative signing flows), the package al
 - `verifyOAuthAuthorizationEvidence(evidence)`: OAuth / MCP authorization evidence checks for access-token JWTs or caller-verified claims
 - `introspectOAuthToken(options)`: host-owned OAuth token introspection helper for opaque-token evidence
 - `oauthEvidenceFromIntrospectionResult(result, base?)`: adapter from host-owned introspection result to OAuth evidence input
+- `createFetchDpopReplayCache(options)`: HTTP-backed DPoP replay-cache adapter for fleet-shared replay checks
 - `MemoryDpopReplayCache`: in-process implementation of the `DpopReplayCache` contract for tests and single-worker deployments
 - `verifyHandoffClaims(claims, options?)`: Pattern 3 handoff claim acceptance before a receiving agent signs an `informed_by` follow-up
 - `recommendationSigningInput(doc)`: the canonical bytes that get signed

package/dist/dpop-replay-cache.d.ts

@@ -21,6 +21,17 @@ export interface MemoryDpopReplayCacheOptions {
     maxEntries?: number;
     nowSeconds?: () => number;
 }
+export interface FetchDpopReplayCacheOptions {
+    /**
+     * Host-owned shared replay-cache endpoint. It must atomically remember the
+     * supplied key until `expires_at_seconds` and reply with `{ "accepted": true }`
+     * for a new key or `{ "accepted": false }` for a replay.
+     */
+    endpoint: string;
+    fetchImpl?: typeof fetch;
+    headers?: Record<string, string>;
+    timeoutMs?: number;
+}
 export declare class MemoryDpopReplayCache implements DpopReplayCache {
     private readonly entries;
     private readonly maxEntries;
@@ -31,5 +42,14 @@ export declare class MemoryDpopReplayCache implements DpopReplayCache {
     private prune;
     private pruneToMax;
 }
+export declare class FetchDpopReplayCache implements DpopReplayCache {
+    private readonly endpoint;
+    private readonly fetchImpl;
+    private readonly headers;
+    private readonly timeoutMs;
+    constructor(options: FetchDpopReplayCacheOptions);
+    checkAndRemember(key: DpopReplayCacheKey, expiresAtSeconds: number): Promise<boolean>;
+}
+export declare function createFetchDpopReplayCache(options: FetchDpopReplayCacheOptions): FetchDpopReplayCache;
 export declare function dpopReplayCacheKeyId(key: DpopReplayCacheKey): string;
 //# sourceMappingURL=dpop-replay-cache.d.ts.map

package/dist/dpop-replay-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dpop-replay-cache.d.ts","sourceRoot":"","sources":["../src/dpop-replay-cache.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;;OAOG;IACH,gBAAgB,CACd,GAAG,EAAE,kBAAkB,EACvB,gBAAgB,EAAE,MAAM,GACvB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC9B;AAED,MAAM,WAAW,4BAA4B;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,MAAM,CAAA;CAC1B;AAED,qBAAa,qBAAsB,YAAW,eAAe;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAc;gBAE7B,OAAO,GAAE,4BAAiC;IAKtD,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO;IAW5E,IAAI,IAAI,MAAM;IAKd,OAAO,CAAC,KAAK;IAMb,OAAO,CAAC,UAAU;CAOnB;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,CASpE"}
+{"version":3,"file":"dpop-replay-cache.d.ts","sourceRoot":"","sources":["../src/dpop-replay-cache.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;;OAOG;IACH,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAChG;AAED,MAAM,WAAW,4BAA4B;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,qBAAa,qBAAsB,YAAW,eAAe;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAc;gBAE7B,OAAO,GAAE,4BAAiC;IAKtD,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO;IAW5E,IAAI,IAAI,MAAM;IAKd,OAAO,CAAC,KAAK;IAMb,OAAO,CAAC,UAAU;CAOnB;AAED,qBAAa,oBAAqB,YAAW,eAAe;IAC1D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAc;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;gBAEtB,OAAO,EAAE,2BAA2B;IAO1C,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CA6B5F;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,2BAA2B,GACnC,oBAAoB,CAEtB;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,CASpE"}

package/dist/dpop-replay-cache.js

@@ -37,6 +37,51 @@ export class MemoryDpopReplayCache {
         }
     }
 }
+export class FetchDpopReplayCache {
+    endpoint;
+    fetchImpl;
+    headers;
+    timeoutMs;
+    constructor(options) {
+        this.endpoint = new URL(options.endpoint).toString();
+        this.fetchImpl = options.fetchImpl ?? fetch;
+        this.headers = options.headers ?? {};
+        this.timeoutMs = options.timeoutMs ?? 5000;
+    }
+    async checkAndRemember(key, expiresAtSeconds) {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const response = await this.fetchImpl(this.endpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...this.headers,
+                },
+                body: JSON.stringify({
+                    key,
+                    key_id: dpopReplayCacheKeyId(key),
+                    expires_at_seconds: expiresAtSeconds,
+                }),
+                signal: controller.signal,
+            });
+            if (!response.ok) {
+                throw new Error(`DPoP replay cache rejected request with HTTP ${response.status}`);
+            }
+            const raw = (await response.json());
+            if (typeof raw.accepted !== 'boolean') {
+                throw new Error('DPoP replay cache response must include boolean accepted');
+            }
+            return raw.accepted;
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+}
+export function createFetchDpopReplayCache(options) {
+    return new FetchDpopReplayCache(options);
+}
 export function dpopReplayCacheKeyId(key) {
     return JSON.stringify({
         issuer: key.issuer ?? null,

package/dist/dpop-replay-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"dpop-replay-cache.js","sourceRoot":"","sources":["../src/dpop-replay-cache.ts"],"names":[],"mappings":"AAAA,sCAAsC;AA+BtC,MAAM,OAAO,qBAAqB;IACf,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;IACnC,UAAU,CAAQ;IAClB,UAAU,CAAc;IAEzC,YAAY,UAAwC,EAAE;QACpD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAA;QAC9C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;IAC/E,CAAC;IAED,gBAAgB,CAAC,GAAuB,EAAE,gBAAwB;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;QAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACf,MAAM,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;QACpC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3C,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,GAAG,GAAG;YAAE,OAAO,KAAK,CAAA;QACtE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QACzD,IAAI,CAAC,UAAU,EAAE,CAAA;QACjB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI;QACF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAA;IAC1B,CAAC;IAEO,KAAK,CAAC,GAAW;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAChD,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC/C,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAM;YAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAuB;IAC1D,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;QAC1B,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAChC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QACpB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QACpB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QACpB,GAAG,EAAE,GAAG,CAAC,GAAG;KACb,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"dpop-replay-cache.js","sourceRoot":"","sources":["../src/dpop-replay-cache.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAwCtC,MAAM,OAAO,qBAAqB;IACf,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;IACnC,UAAU,CAAQ;IAClB,UAAU,CAAc;IAEzC,YAAY,UAAwC,EAAE;QACpD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAA;QAC9C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;IAC/E,CAAC;IAED,gBAAgB,CAAC,GAAuB,EAAE,gBAAwB;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;QAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACf,MAAM,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;QACpC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3C,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,GAAG,GAAG;YAAE,OAAO,KAAK,CAAA;QACtE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QACzD,IAAI,CAAC,UAAU,EAAE,CAAA;QACjB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI;QACF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAA;IAC1B,CAAC;IAEO,KAAK,CAAC,GAAW;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAChD,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC/C,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAM;YAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,oBAAoB;IACd,QAAQ,CAAQ;IAChB,SAAS,CAAc;IACvB,OAAO,CAAwB;IAC/B,SAAS,CAAQ;IAElC,YAAY,OAAoC;QAC9C,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAA;QACpD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;QAC3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAA;QACpC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAA;IAC5C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,GAAuB,EAAE,gBAAwB;QACtE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QACpE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,IAAI,CAAC,OAAO;iBAChB;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,GAAG;oBACH,MAAM,EAAE,oBAAoB,CAAC,GAAG,CAAC;oBACjC,kBAAkB,EAAE,gBAAgB;iBACrC,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAA;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;YACpF,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAA;YAC7D,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;YAC7E,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ,CAAA;QACrB,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAA;QACvB,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAoC;IAEpC,OAAO,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAA;AAC1C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAuB;IAC1D,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;QAC1B,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAChC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QACpB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QACpB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QACpB,GAAG,EAAE,GAAG,CAAC,GAAG;KACb,CAAC,CAAA;AACJ,CAAC"}

package/dist/index.d.ts

@@ -4,8 +4,8 @@ export { verifyRecord } from './verify-record.js';
 export type { RecordVerificationResult, ProvenanceAnnotation, VerifyRecordOptions, ResolvedCapabilityFacts, CrossAttestationAnnotation, } from './verify-record.js';
 export { verifyAuthorizationEvidence, verifyOAuthAuthorizationEvidence, } from './authorization-evidence.js';
 export type { AuthorizationEvidenceInput, EvidenceCheckStatus, EvidenceConstraintCheck, EvidenceVerificationBlock, OAuthAccessTokenClaims, OAuthAuthorizationDetailConstraint, OAuthAuthorizationEvidenceInput, OAuthAuthorizationEvidenceVerification, OAuthDpopCheck, OAuthDpopProofInput, OAuthEvidenceProtocol, OAuthProtectedResourceMetadata, OAuthSignaturePolicy, OAuthTokenIntrospectionResponse, OAuthTokenCheck, } from './authorization-evidence.js';
-export { MemoryDpopReplayCache, dpopReplayCacheKeyId, } from './dpop-replay-cache.js';
-export type { DpopReplayCache, DpopReplayCacheKey, MemoryDpopReplayCacheOptions, } from './dpop-replay-cache.js';
+export { FetchDpopReplayCache, MemoryDpopReplayCache, createFetchDpopReplayCache, dpopReplayCacheKeyId, } from './dpop-replay-cache.js';
+export type { DpopReplayCache, DpopReplayCacheKey, FetchDpopReplayCacheOptions, MemoryDpopReplayCacheOptions, } from './dpop-replay-cache.js';
 export { introspectOAuthToken, oauthEvidenceFromIntrospectionResult, } from './oauth-introspection.js';
 export type { OAuthIntrospectionClientAuthentication, OAuthIntrospectionOptions, OAuthIntrospectionResult, } from './oauth-introspection.js';
 export { handoffClaimsFromEvidencePacket, verifyHandoffClaims } from './handoff.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,eAAe,CAAA;AAKtB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAA;AAG3B,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,6BAA6B,CAAA;AACpC,YAAY,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,yBAAyB,EACzB,sBAAsB,EACtB,kCAAkC,EAClC,+BAA+B,EAC/B,sCAAsC,EACtC,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,8BAA8B,EAC9B,oBAAoB,EACpB,+BAA+B,EAC/B,eAAe,GAChB,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EACL,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,sCAAsC,EACtC,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,0BAA0B,CAAA;AAKjC,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AACnF,YAAY,EACV,uBAAuB,EACvB,gCAAgC,EAChC,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAGzE,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAG7D,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAG5F,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAC3E,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAGxF,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,EAC7B,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,8BAA8B,EAC9B,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,MAAM,GACP,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAG9B,YAAY,EACV,SAAS,EACT,SAAS,EACT,aAAa,EACb,SAAS,EACT,QAAQ,EACR,OAAO,EACP,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,eAAe,CAAA;AAKtB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAA;AAG3B,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,6BAA6B,CAAA;AACpC,YAAY,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,yBAAyB,EACzB,sBAAsB,EACtB,kCAAkC,EAClC,+BAA+B,EAC/B,sCAAsC,EACtC,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,8BAA8B,EAC9B,oBAAoB,EACpB,+BAA+B,EAC/B,eAAe,GAChB,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EACL,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,sCAAsC,EACtC,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,0BAA0B,CAAA;AAKjC,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AACnF,YAAY,EACV,uBAAuB,EACvB,gCAAgC,EAChC,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAGzE,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAG7D,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAG5F,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAC3E,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAGxF,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,EAC7B,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,8BAA8B,EAC9B,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,MAAM,GACP,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAG9B,YAAY,EACV,SAAS,EACT,SAAS,EACT,aAAa,EACb,SAAS,EACT,QAAQ,EACR,OAAO,EACP,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -8,7 +8,7 @@ export { AtribVerifier } from './verifier.js';
 export { verifyRecord } from './verify-record.js';
 // Generic external authorization evidence checks. Off the atrib record-validity path.
 export { verifyAuthorizationEvidence, verifyOAuthAuthorizationEvidence, } from './authorization-evidence.js';
-export { MemoryDpopReplayCache, dpopReplayCacheKeyId, } from './dpop-replay-cache.js';
+export { FetchDpopReplayCache, MemoryDpopReplayCache, createFetchDpopReplayCache, dpopReplayCacheKeyId, } from './dpop-replay-cache.js';
 export { introspectOAuthToken, oauthEvidenceFromIntrospectionResult, } from './oauth-introspection.js';
 // Cross-agent handoff claim verification. Used when one agent receives a
 // record_hash claim plus private body material from another agent and must

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,+CAA+C;AAE/C,4BAA4B;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAO7C,8DAA8D;AAC9D,8EAA8E;AAC9E,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AASjD,sFAAsF;AACtF,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,6BAA6B,CAAA;AAmBpC,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAO/B,OAAO,EACL,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,0BAA0B,CAAA;AAOjC,yEAAyE;AACzE,2EAA2E;AAC3E,8DAA8D;AAC9D,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAcnF,uEAAuE;AACvE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEzE,sDAAsD;AACtD,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAE5B,mDAAmD;AACnD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAE7D,+BAA+B;AAC/B,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE5F,6BAA6B;AAC7B,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAG3E,6EAA6E;AAC7E,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AA6B7B,0DAA0D;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAgCvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,+CAA+C;AAE/C,4BAA4B;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAO7C,8DAA8D;AAC9D,8EAA8E;AAC9E,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AASjD,sFAAsF;AACtF,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,6BAA6B,CAAA;AAmBpC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAQ/B,OAAO,EACL,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,0BAA0B,CAAA;AAOjC,yEAAyE;AACzE,2EAA2E;AAC3E,8DAA8D;AAC9D,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAcnF,uEAAuE;AACvE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEzE,sDAAsD;AACtD,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAE5B,mDAAmD;AACnD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAE7D,+BAA+B;AAC/B,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE5F,6BAA6B;AAC7B,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAG3E,6EAA6E;AAC7E,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AA6B7B,0DAA0D;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAgCvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atrib/verify",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -33,13 +33,13 @@
     "@sd-jwt/sd-jwt-vc": "0.19.0",
     "canonicalize": "^3.0.0",
     "jose": "6.2.3",
-    "@atrib/mcp": "0.15.1"
+    "@atrib/mcp": "0.16.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",
     "fast-check": "^4.8.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.7"
+    "vitest": "^4.1.8"
   },
   "repository": {
     "type": "git",