@kya-os/cli 2.0.0 → 2.0.3

package/node_modules/@kya-os/contracts/dist/config/base.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Base Configuration Types
+ *
+ * Shared configuration interfaces that are platform-agnostic and used
+ * across all XMCP-I implementations. These form the foundation of the
+ * configuration hierarchy.
+ *
+ * @module @kya-os/contracts/config
+ */
+/**
+ * Base configuration shared across ALL platforms
+ *
+ * This interface defines the core configuration options that are
+ * universally applicable regardless of the runtime platform (Node.js,
+ * Cloudflare Workers, etc.).
+ */
+export interface MCPIBaseConfig {
+    /**
+     * Runtime environment setting
+     * - 'development': Enables debug logging, dev identity, relaxed security
+     * - 'production': Production security, identity from env vars, minimal logging
+     */
+    environment: 'development' | 'production';
+    /**
+     * Session configuration
+     * Controls how sessions are managed and validated
+     */
+    session?: {
+        /**
+         * Maximum time skew allowed for timestamp validation (in seconds)
+         * Helps handle clock drift between client and server
+         * @default 120
+         */
+        timestampSkewSeconds?: number;
+        /**
+         * Session time-to-live in minutes
+         * How long a session remains valid after creation
+         * @default 30
+         */
+        ttlMinutes?: number;
+        /**
+         * Absolute session lifetime in minutes (optional)
+         * Maximum lifetime regardless of activity
+         */
+        absoluteLifetime?: number;
+    };
+    /**
+     * Well-known endpoints configuration
+     * Controls the /.well-known/* endpoints for identity discovery
+     */
+    wellKnown?: {
+        /**
+         * Enable well-known endpoints
+         * @default true
+         */
+        enabled: boolean;
+        /**
+         * Service name advertised in well-known endpoints
+         * @default 'MCP-I Service'
+         */
+        serviceName?: string;
+        /**
+         * Service endpoint URL
+         * @default 'https://example.com'
+         */
+        serviceEndpoint?: string;
+    };
+    /**
+     * Enable inline consent UI via MCP Apps extension.
+     * When true AND @modelcontextprotocol/ext-apps is available, consent
+     * forms render inside the chat client's iframe instead of opening
+     * an external browser page.
+     * @default false
+     */
+    inlineConsent?: boolean;
+}

package/node_modules/@kya-os/contracts/dist/config/base.js

@@ -0,0 +1,11 @@
+"use strict";
+/**
+ * Base Configuration Types
+ *
+ * Shared configuration interfaces that are platform-agnostic and used
+ * across all XMCP-I implementations. These form the foundation of the
+ * configuration hierarchy.
+ *
+ * @module @kya-os/contracts/config
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/node_modules/@kya-os/contracts/dist/config/builder.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Configuration Builder Utilities
+ *
+ * Shared utilities for building MCP-I configuration objects with sensible defaults.
+ * These functions are platform-agnostic and can be used by any adapter/platform.
+ *
+ * @module @kya-os/contracts/config
+ */
+import type { MCPIBaseConfig } from './base.js';
+import type { RuntimeIdentityConfig } from './identity.js';
+import type { ProofingConfig } from './proofing.js';
+import type { DelegationConfig } from './delegation.js';
+import type { ToolProtectionSourceConfig } from './tool-protection.js';
+/**
+ * Complete runtime configuration type
+ * This can be extended by platform-specific configs
+ */
+export interface MCPIConfig extends MCPIBaseConfig {
+    identity?: RuntimeIdentityConfig;
+    proofing?: ProofingConfig;
+    delegation?: DelegationConfig;
+    toolProtection?: ToolProtectionSourceConfig;
+}
+/**
+ * Build base MCPIConfig that works across all platforms
+ *
+ * Creates a platform-agnostic configuration object with sensible defaults
+ * for identity, proofing, delegation, and session management.
+ *
+ * @param env - Environment variables object (works with process.env or Cloudflare env)
+ * @returns Complete MCPIConfig object
+ */
+export declare function buildBaseConfig(env: Record<string, any>): MCPIConfig;

package/node_modules/@kya-os/contracts/dist/config/builder.js

@@ -0,0 +1,71 @@
+"use strict";
+/**
+ * Configuration Builder Utilities
+ *
+ * Shared utilities for building MCP-I configuration objects with sensible defaults.
+ * These functions are platform-agnostic and can be used by any adapter/platform.
+ *
+ * @module @kya-os/contracts/config
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildBaseConfig = buildBaseConfig;
+const checkpoint_env_js_1 = require("./checkpoint-env.js");
+/**
+ * Build base MCPIConfig that works across all platforms
+ *
+ * Creates a platform-agnostic configuration object with sensible defaults
+ * for identity, proofing, delegation, and session management.
+ *
+ * @param env - Environment variables object (works with process.env or Cloudflare env)
+ * @returns Complete MCPIConfig object
+ */
+function buildBaseConfig(env) {
+    const checkpoint = (0, checkpoint_env_js_1.withCheckpointNames)(env);
+    const environment = (env.MCPI_ENV || env.ENVIRONMENT || 'development');
+    const isDevelopment = environment === 'development';
+    const baseConfig = {
+        environment,
+        identity: {
+            enabled: true,
+            environment,
+            devIdentityPath: '.mcpi/identity.json'
+        },
+        proofing: {
+            enabled: true,
+            batchQueue: {
+                destinations: [
+                    {
+                        type: 'agentshield',
+                        apiUrl: checkpoint.CHECKPOINT_API_URL || 'https://kya.vouched.id',
+                        apiKey: checkpoint.CHECKPOINT_API_KEY
+                    }
+                ],
+                maxBatchSize: 10,
+                flushIntervalMs: 5000,
+                maxRetries: 3,
+                debug: isDevelopment
+            }
+        },
+        delegation: {
+            enabled: true,
+            enforceDelegations: true,
+            verifier: {
+                type: 'agentshield',
+                apiUrl: checkpoint.CHECKPOINT_API_URL || 'https://kya.vouched.id',
+                apiKey: checkpoint.CHECKPOINT_API_KEY || '',
+                cacheTtl: 60000, // 1 minute cache
+                debug: isDevelopment
+            },
+            authorization: {
+                authorizationUrl: env.AUTHORIZATION_URL || `${checkpoint.CHECKPOINT_API_URL || 'https://kya.vouched.id'}/authorize`,
+                resumeTokenTtl: 600000, // 10 minutes
+                minReputationScore: 76
+            }
+        },
+        session: {
+            timestampSkewSeconds: 120,
+            ttlMinutes: 30
+        }
+    };
+    return baseConfig;
+}

package/node_modules/@kya-os/contracts/dist/config/checkpoint-env.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The Checkpoint settings a server reads from its environment.
+ *
+ * Servers scaffolded before these settings were renamed still set them, as
+ * Worker vars and secrets, under their former names. Those names appear only
+ * here: every reader takes the current names from `withCheckpointNames`, which
+ * fills them from the former ones, so an upgraded server keeps its Checkpoint
+ * key, URL and project without renaming anything it has deployed.
+ *
+ * @module @kya-os/contracts/config
+ */
+declare const FORMER_NAMES: {
+    readonly CHECKPOINT_API_KEY: "AGENTSHIELD_API_KEY";
+    readonly CHECKPOINT_API_URL: "AGENTSHIELD_API_URL";
+    readonly CHECKPOINT_PROJECT_ID: "AGENTSHIELD_PROJECT_ID";
+};
+export type CheckpointSettingName = keyof typeof FORMER_NAMES;
+/**
+ * `source` with every Checkpoint setting under its current name. A current
+ * name that is set always wins. Returns `source` itself when nothing needs
+ * filling; otherwise a copy with the same prototype and every own property,
+ * bindings included, so the platform's environment object is never modified.
+ */
+export declare function withCheckpointNames<T>(source: T): T;
+export {};

package/node_modules/@kya-os/contracts/dist/config/checkpoint-env.js

@@ -0,0 +1,38 @@
+"use strict";
+/**
+ * The Checkpoint settings a server reads from its environment.
+ *
+ * Servers scaffolded before these settings were renamed still set them, as
+ * Worker vars and secrets, under their former names. Those names appear only
+ * here: every reader takes the current names from `withCheckpointNames`, which
+ * fills them from the former ones, so an upgraded server keeps its Checkpoint
+ * key, URL and project without renaming anything it has deployed.
+ *
+ * @module @kya-os/contracts/config
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withCheckpointNames = withCheckpointNames;
+const FORMER_NAMES = {
+    CHECKPOINT_API_KEY: "AGENTSHIELD_API_KEY",
+    CHECKPOINT_API_URL: "AGENTSHIELD_API_URL",
+    CHECKPOINT_PROJECT_ID: "AGENTSHIELD_PROJECT_ID",
+};
+/**
+ * `source` with every Checkpoint setting under its current name. A current
+ * name that is set always wins. Returns `source` itself when nothing needs
+ * filling; otherwise a copy with the same prototype and every own property,
+ * bindings included, so the platform's environment object is never modified.
+ */
+function withCheckpointNames(source) {
+    if (!source || typeof source !== "object")
+        return source;
+    const settings = source;
+    const filled = Object.keys(FORMER_NAMES).filter((name) => settings[name] === undefined && settings[FORMER_NAMES[name]] !== undefined);
+    if (filled.length === 0)
+        return source;
+    const copy = Object.create(Object.getPrototypeOf(source), Object.getOwnPropertyDescriptors(source));
+    for (const name of filled) {
+        copy[name] = settings[FORMER_NAMES[name]];
+    }
+    return copy;
+}

package/node_modules/@kya-os/contracts/dist/config/client-messages.d.ts

@@ -0,0 +1,216 @@
+/**
+ * Client Messages Configuration Types
+ *
+ * Types for configuring client-specific delegation error messages.
+ * Different MCP clients (Claude, ChatGPT, Cursor, etc.) may benefit from
+ * different message formats based on their capabilities.
+ *
+ * @module @kya-os/contracts/config/client-messages
+ */
+import { z } from "zod";
+import { type DelegationDenialCode } from "./delegation-denial.js";
+/**
+ * Template configuration for a specific client's messages
+ */
+export interface ClientMessageTemplate {
+    /**
+     * Message template with placeholders: {toolName}, {consentUrl}, {scopes}
+     *
+     * @example "I need your permission to use {toolName}.\n\n[Click to authorize]({consentUrl})"
+     */
+    message?: string;
+    /**
+     * Message template when no consent URL is available
+     *
+     * @example "Authorization required for {toolName} but no consent URL is available."
+     */
+    noUrlMessage?: string;
+    /**
+     * OAuth-specific message template with placeholders: {toolName}, {oauthUrl}, {provider}, {scopes}
+     *
+     * @example "Sign in with {provider} to use {toolName}.\n\n[Authorize]({oauthUrl})"
+     */
+    oauthMessage?: string;
+    /**
+     * Message template when OAuth URL is unavailable
+     *
+     * @example "Sign-in required for {toolName} but {provider} is not configured."
+     */
+    noOAuthUrlMessage?: string;
+    /**
+     * Custom consent URL format (optional override)
+     * Can include placeholders: {baseUrl}, {toolName}, {sessionId}, etc.
+     */
+    consentUrlFormat?: string;
+    /**
+     * Extra URL parameters to append to consent URL
+     *
+     * @example { utm_source: "chatgpt", utm_campaign: "delegation" }
+     */
+    extraParams?: Record<string, string>;
+    /**
+     * Whether client supports markdown formatting
+     * When false, markdown links [text](url) are converted to "text: url"
+     *
+     * @default true
+     */
+    supportsMarkdown?: boolean;
+    /**
+     * Per-code line shown above the authorization message when the verifier
+     * refused a presented delegation. Placeholder: {toolName}.
+     *
+     * Only configured codes change the message; without an entry the message
+     * is exactly what it would be for a missing delegation.
+     *
+     * @example { delegation_revoked: "Your approval for {toolName} was revoked." }
+     */
+    denialMessages?: Partial<Record<DelegationDenialCode, string>>;
+}
+/**
+ * Configuration for client-specific messages
+ */
+export interface ClientMessagesConfig {
+    /**
+     * Default template for unknown/unrecognized clients
+     */
+    default?: ClientMessageTemplate;
+    /**
+     * Per-client overrides keyed by canonical client ID
+     *
+     * Known client IDs: "claude", "chatgpt", "cursor", "perplexity",
+     * "mcp-inspector", "windsurf", "cline", "zed"
+     */
+    clients?: Record<string, ClientMessageTemplate>;
+}
+export declare const ClientMessageTemplateSchema: z.ZodObject<{
+    message: z.ZodOptional<z.ZodString>;
+    noUrlMessage: z.ZodOptional<z.ZodString>;
+    oauthMessage: z.ZodOptional<z.ZodString>;
+    noOAuthUrlMessage: z.ZodOptional<z.ZodString>;
+    consentUrlFormat: z.ZodOptional<z.ZodString>;
+    extraParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    supportsMarkdown: z.ZodOptional<z.ZodBoolean>;
+    denialMessages: z.ZodOptional<z.ZodRecord<z.ZodEnum<["delegation_revoked", "delegation_expired", "delegation_not_yet_valid", "delegation_invalid", "agent_mismatch", "user_mismatch", "native_binding_mismatch", "budget_exceeded", "insufficient_scope", "policy_denied"]>, z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    message?: string | undefined;
+    noUrlMessage?: string | undefined;
+    oauthMessage?: string | undefined;
+    noOAuthUrlMessage?: string | undefined;
+    consentUrlFormat?: string | undefined;
+    extraParams?: Record<string, string> | undefined;
+    supportsMarkdown?: boolean | undefined;
+    denialMessages?: Partial<Record<"delegation_revoked" | "delegation_expired" | "delegation_not_yet_valid" | "delegation_invalid" | "agent_mismatch" | "user_mismatch" | "native_binding_mismatch" | "budget_exceeded" | "insufficient_scope" | "policy_denied", string>> | undefined;
+}, {
+    message?: string | undefined;
+    noUrlMessage?: string | undefined;
+    oauthMessage?: string | undefined;
+    noOAuthUrlMessage?: string | undefined;
+    consentUrlFormat?: string | undefined;
+    extraParams?: Record<string, string> | undefined;
+    supportsMarkdown?: boolean | undefined;
+    denialMessages?: Partial<Record<"delegation_revoked" | "delegation_expired" | "delegation_not_yet_valid" | "delegation_invalid" | "agent_mismatch" | "user_mismatch" | "native_binding_mismatch" | "budget_exceeded" | "insufficient_scope" | "policy_denied", string>> | undefined;
+}>;
+export declare const ClientMessagesConfigSchema: z.ZodObject<{
+    default: z.ZodOptional<z.ZodObject<{
+        message: z.ZodOptional<z.ZodString>;
+        noUrlMessage: z.ZodOptional<z.ZodString>;
+        oauthMessage: z.ZodOptional<z.ZodString>;
+        noOAuthUrlMessage: z.ZodOptional<z.ZodString>;
+        consentUrlFormat: z.ZodOptional<z.ZodString>;
+        extraParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        supportsMarkdown: z.ZodOptional<z.ZodBoolean>;
+        denialMessages: z.ZodOptional<z.ZodRecord<z.ZodEnum<["delegation_revoked", "delegation_expired", "delegation_not_yet_valid", "delegation_invalid", "agent_mismatch", "user_mismatch", "native_binding_mismatch", "budget_exceeded", "insufficient_scope", "policy_denied"]>, z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        message?: string | undefined;
+        noUrlMessage?: string | undefined;
+        oauthMessage?: string | undefined;
+        noOAuthUrlMessage?: string | undefined;
+        consentUrlFormat?: string | undefined;
+        extraParams?: Record<string, string> | undefined;
+        supportsMarkdown?: boolean | undefined;
+        denialMessages?: Partial<Record<"delegation_revoked" | "delegation_expired" | "delegation_not_yet_valid" | "delegation_invalid" | "agent_mismatch" | "user_mismatch" | "native_binding_mismatch" | "budget_exceeded" | "insufficient_scope" | "policy_denied", string>> | undefined;
+    }, {
+        message?: string | undefined;
+        noUrlMessage?: string | undefined;
+        oauthMessage?: string | undefined;
+        noOAuthUrlMessage?: string | undefined;
+        consentUrlFormat?: string | undefined;
+        extraParams?: Record<string, string> | undefined;
+        supportsMarkdown?: boolean | undefined;
+        denialMessages?: Partial<Record<"delegation_revoked" | "delegation_expired" | "delegation_not_yet_valid" | "delegation_invalid" | "agent_mismatch" | "user_mismatch" | "native_binding_mismatch" | "budget_exceeded" | "insufficient_scope" | "policy_denied", string>> | undefined;
+    }>>;
+    clients: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        message: z.ZodOptional<z.ZodString>;
+        noUrlMessage: z.ZodOptional<z.ZodString>;
+        oauthMessage: z.ZodOptional<z.ZodString>;
+        noOAuthUrlMessage: z.ZodOptional<z.ZodString>;
+        consentUrlFormat: z.ZodOptional<z.ZodString>;
+        extraParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        supportsMarkdown: z.ZodOptional<z.ZodBoolean>;
+        denialMessages: z.ZodOptional<z.ZodRecord<z.ZodEnum<["delegation_revoked", "delegation_expired", "delegation_not_yet_valid", "delegation_invalid", "agent_mismatch", "user_mismatch", "native_binding_mismatch", "budget_exceeded", "insufficient_scope", "policy_denied"]>, z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        message?: string | undefined;
+        noUrlMessage?: string | undefined;
+        oauthMessage?: string | undefined;
+        noOAuthUrlMessage?: string | undefined;
+        consentUrlFormat?: string | undefined;
+        extraParams?: Record<string, string> | undefined;
+        supportsMarkdown?: boolean | undefined;
+        denialMessages?: Partial<Record<"delegation_revoked" | "delegation_expired" | "delegation_not_yet_valid" | "delegation_invalid" | "agent_mismatch" | "user_mismatch" | "native_binding_mismatch" | "budget_exceeded" | "insufficient_scope" | "policy_denied", string>> | undefined;
+    }, {
+        message?: string | undefined;
+        noUrlMessage?: string | undefined;
+        oauthMessage?: string | undefined;
+        noOAuthUrlMessage?: string | undefined;
+        consentUrlFormat?: string | undefined;
+        extraParams?: Record<string, string> | undefined;
+        supportsMarkdown?: boolean | undefined;
+        denialMessages?: Partial<Record<"delegation_revoked" | "delegation_expired" | "delegation_not_yet_valid" | "delegation_invalid" | "agent_mismatch" | "user_mismatch" | "native_binding_mismatch" | "budget_exceeded" | "insufficient_scope" | "policy_denied", string>> | undefined;
+    }>>>;
+}, "strip", z.ZodTypeAny, {
+    default?: {
+        message?: string | undefined;
+        noUrlMessage?: string | undefined;
+        oauthMessage?: string | undefined;
+        noOAuthUrlMessage?: string | undefined;
+        consentUrlFormat?: string | undefined;
+        extraParams?: Record<string, string> | undefined;
+        supportsMarkdown?: boolean | undefined;
+        denialMessages?: Partial<Record<"delegation_revoked" | "delegation_expired" | "delegation_not_yet_valid" | "delegation_invalid" | "agent_mismatch" | "user_mismatch" | "native_binding_mismatch" | "budget_exceeded" | "insufficient_scope" | "policy_denied", string>> | undefined;
+    } | undefined;
+    clients?: Record<string, {
+        message?: string | undefined;
+        noUrlMessage?: string | undefined;
+        oauthMessage?: string | undefined;
+        noOAuthUrlMessage?: string | undefined;
+        consentUrlFormat?: string | undefined;
+        extraParams?: Record<string, string> | undefined;
+        supportsMarkdown?: boolean | undefined;
+        denialMessages?: Partial<Record<"delegation_revoked" | "delegation_expired" | "delegation_not_yet_valid" | "delegation_invalid" | "agent_mismatch" | "user_mismatch" | "native_binding_mismatch" | "budget_exceeded" | "insufficient_scope" | "policy_denied", string>> | undefined;
+    }> | undefined;
+}, {
+    default?: {
+        message?: string | undefined;
+        noUrlMessage?: string | undefined;
+        oauthMessage?: string | undefined;
+        noOAuthUrlMessage?: string | undefined;
+        consentUrlFormat?: string | undefined;
+        extraParams?: Record<string, string> | undefined;
+        supportsMarkdown?: boolean | undefined;
+        denialMessages?: Partial<Record<"delegation_revoked" | "delegation_expired" | "delegation_not_yet_valid" | "delegation_invalid" | "agent_mismatch" | "user_mismatch" | "native_binding_mismatch" | "budget_exceeded" | "insufficient_scope" | "policy_denied", string>> | undefined;
+    } | undefined;
+    clients?: Record<string, {
+        message?: string | undefined;
+        noUrlMessage?: string | undefined;
+        oauthMessage?: string | undefined;
+        noOAuthUrlMessage?: string | undefined;
+        consentUrlFormat?: string | undefined;
+        extraParams?: Record<string, string> | undefined;
+        supportsMarkdown?: boolean | undefined;
+        denialMessages?: Partial<Record<"delegation_revoked" | "delegation_expired" | "delegation_not_yet_valid" | "delegation_invalid" | "agent_mismatch" | "user_mismatch" | "native_binding_mismatch" | "budget_exceeded" | "insufficient_scope" | "policy_denied", string>> | undefined;
+    }> | undefined;
+}>;
+export declare function isClientMessageTemplate(obj: unknown): obj is ClientMessageTemplate;
+export declare function isClientMessagesConfig(obj: unknown): obj is ClientMessagesConfig;
+export declare function validateClientMessageTemplate(obj: unknown): ClientMessageTemplate;
+export declare function validateClientMessagesConfig(obj: unknown): ClientMessagesConfig;

package/node_modules/@kya-os/contracts/dist/config/client-messages.js

@@ -0,0 +1,50 @@
+"use strict";
+/**
+ * Client Messages Configuration Types
+ *
+ * Types for configuring client-specific delegation error messages.
+ * Different MCP clients (Claude, ChatGPT, Cursor, etc.) may benefit from
+ * different message formats based on their capabilities.
+ *
+ * @module @kya-os/contracts/config/client-messages
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientMessagesConfigSchema = exports.ClientMessageTemplateSchema = void 0;
+exports.isClientMessageTemplate = isClientMessageTemplate;
+exports.isClientMessagesConfig = isClientMessagesConfig;
+exports.validateClientMessageTemplate = validateClientMessageTemplate;
+exports.validateClientMessagesConfig = validateClientMessagesConfig;
+const zod_1 = require("zod");
+const delegation_denial_js_1 = require("./delegation-denial.js");
+// Zod Schemas for validation
+exports.ClientMessageTemplateSchema = zod_1.z.object({
+    message: zod_1.z.string().optional(),
+    noUrlMessage: zod_1.z.string().optional(),
+    oauthMessage: zod_1.z.string().optional(),
+    noOAuthUrlMessage: zod_1.z.string().optional(),
+    consentUrlFormat: zod_1.z.string().optional(),
+    extraParams: zod_1.z.record(zod_1.z.string(), zod_1.z.string()).optional(),
+    supportsMarkdown: zod_1.z.boolean().optional(),
+    // Enum keys: an unknown code is rejected rather than silently ignored.
+    denialMessages: zod_1.z
+        .record(zod_1.z.enum(delegation_denial_js_1.DELEGATION_DENIAL_CODES), zod_1.z.string())
+        .optional(),
+});
+exports.ClientMessagesConfigSchema = zod_1.z.object({
+    default: exports.ClientMessageTemplateSchema.optional(),
+    clients: zod_1.z.record(zod_1.z.string(), exports.ClientMessageTemplateSchema).optional(),
+});
+// Type guards
+function isClientMessageTemplate(obj) {
+    return exports.ClientMessageTemplateSchema.safeParse(obj).success;
+}
+function isClientMessagesConfig(obj) {
+    return exports.ClientMessagesConfigSchema.safeParse(obj).success;
+}
+// Validation functions
+function validateClientMessageTemplate(obj) {
+    return exports.ClientMessageTemplateSchema.parse(obj);
+}
+function validateClientMessagesConfig(obj) {
+    return exports.ClientMessagesConfigSchema.parse(obj);
+}

package/node_modules/@kya-os/contracts/dist/config/delegation-denial.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Delegation Denial Codes
+ *
+ * Machine-readable reasons a verifier refused a presented delegation. The
+ * runtime maps upstream verifier codes onto this fixed list, so clients and
+ * the audit ledger see a stable vocabulary instead of free text.
+ *
+ * Defined here rather than in the runtime so client message configuration
+ * can key per-code messages on the same union.
+ *
+ * @module @kya-os/contracts/config/delegation-denial
+ */
+export declare const DELEGATION_DENIAL_CODES: readonly ["delegation_revoked", "delegation_expired", "delegation_not_yet_valid", "delegation_invalid", "agent_mismatch", "user_mismatch", "native_binding_mismatch", "budget_exceeded", "insufficient_scope", "policy_denied"];
+export type DelegationDenialCode = (typeof DELEGATION_DENIAL_CODES)[number];

package/node_modules/@kya-os/contracts/dist/config/delegation-denial.js

@@ -0,0 +1,30 @@
+"use strict";
+/**
+ * Delegation Denial Codes
+ *
+ * Machine-readable reasons a verifier refused a presented delegation. The
+ * runtime maps upstream verifier codes onto this fixed list, so clients and
+ * the audit ledger see a stable vocabulary instead of free text.
+ *
+ * Defined here rather than in the runtime so client message configuration
+ * can key per-code messages on the same union.
+ *
+ * @module @kya-os/contracts/config/delegation-denial
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DELEGATION_DENIAL_CODES = void 0;
+exports.DELEGATION_DENIAL_CODES = [
+    "delegation_revoked",
+    "delegation_expired",
+    "delegation_not_yet_valid",
+    "delegation_invalid",
+    /** The token's agent DID differs from the agent DID the caller named */
+    "agent_mismatch",
+    /** The token's user DID differs from the user DID the caller named */
+    "user_mismatch",
+    /** The verified grant differs from the holder-of-key the runtime admitted on this request (native rail only) */
+    "native_binding_mismatch",
+    "budget_exceeded",
+    "insufficient_scope",
+    "policy_denied",
+];