@kya-os/mcp-i-core 1.7.0 → 1.8.1

package/dist/conformance/vc-jwt-verifier.d.ts

@@ -0,0 +1,55 @@
+/**
+ * VC-JWT Signature Verifier
+ *
+ * A {@link CapabilityVCSignatureVerifier} (the pluggable signature hook accepted
+ * by {@link verifyCapabilities}) that cryptographically verifies a capability
+ * attestation presented as a compact VC-JWT (JWS).
+ *
+ * Flow:
+ *   1. If no compact JWS was supplied (object-form VC) → reject. There is
+ *      nothing to verify cryptographically.
+ *   2. Resolve the credential's `issuer` DID via a combined, pluggable resolver
+ *      (did:key built in, plus the did:web resolver).
+ *   3. Select the verification method whose id matches the JWS header `kid`.
+ *   4. Import its `publicKeyJwk` as an EdDSA key and verify the compact JWS.
+ *
+ * The verifier never throws — every failure path returns
+ * `{ valid: false, reason }` so it composes cleanly inside the validator's
+ * per-attestation loop.
+ *
+ * @see ./validate-level2.ts — the validator this plugs into.
+ */
+import { type DidWebFetch } from '../delegation/did-web-resolver.js';
+import type { DIDResolver } from '../delegation/vc-verifier.js';
+import type { CapabilityVCSignatureVerifier } from './validate-level2.js';
+/** Options for {@link createVcJwtSignatureVerifier}. */
+export interface VcJwtVerifierOptions {
+    /**
+     * DID resolver used to fetch the issuer's verification keys. Defaults to a
+     * combined did:key + did:web resolver (see {@link createCombinedDidResolver}).
+     */
+    didResolver?: DIDResolver;
+    /**
+     * Pluggable fetch passed to the default did:web resolver. Ignored when a
+     * `didResolver` is supplied. Defaults to the global `fetch`.
+     */
+    fetch?: DidWebFetch;
+}
+/**
+ * Create a DID resolver that dispatches by method: did:key is resolved locally,
+ * did:web is fetched over HTTPS, and every other method resolves to `null`.
+ *
+ * @param options - Optional pluggable fetch for the did:web branch.
+ */
+export declare function createCombinedDidResolver(options?: {
+    fetch?: DidWebFetch;
+}): DIDResolver;
+/**
+ * Create a VC-JWT signature verifier suitable for
+ * {@link verifyCapabilities}'s `signatureVerifier` option.
+ *
+ * @param options - DID resolver / fetch overrides.
+ * @returns A `(vc, rawJwt) => Promise<{ valid; reason? }>` function.
+ */
+export declare function createVcJwtSignatureVerifier(options?: VcJwtVerifierOptions): CapabilityVCSignatureVerifier;
+//# sourceMappingURL=vc-jwt-verifier.d.ts.map

package/dist/conformance/vc-jwt-verifier.js

@@ -0,0 +1,147 @@
+"use strict";
+/**
+ * VC-JWT Signature Verifier
+ *
+ * A {@link CapabilityVCSignatureVerifier} (the pluggable signature hook accepted
+ * by {@link verifyCapabilities}) that cryptographically verifies a capability
+ * attestation presented as a compact VC-JWT (JWS).
+ *
+ * Flow:
+ *   1. If no compact JWS was supplied (object-form VC) → reject. There is
+ *      nothing to verify cryptographically.
+ *   2. Resolve the credential's `issuer` DID via a combined, pluggable resolver
+ *      (did:key built in, plus the did:web resolver).
+ *   3. Select the verification method whose id matches the JWS header `kid`.
+ *   4. Import its `publicKeyJwk` as an EdDSA key and verify the compact JWS.
+ *
+ * The verifier never throws — every failure path returns
+ * `{ valid: false, reason }` so it composes cleanly inside the validator's
+ * per-attestation loop.
+ *
+ * @see ./validate-level2.ts — the validator this plugs into.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCombinedDidResolver = createCombinedDidResolver;
+exports.createVcJwtSignatureVerifier = createVcJwtSignatureVerifier;
+const jose_1 = require("jose");
+const did_key_resolver_js_1 = require("../delegation/did-key-resolver.js");
+const did_web_resolver_js_1 = require("../delegation/did-web-resolver.js");
+/**
+ * Create a DID resolver that dispatches by method: did:key is resolved locally,
+ * did:web is fetched over HTTPS, and every other method resolves to `null`.
+ *
+ * @param options - Optional pluggable fetch for the did:web branch.
+ */
+function createCombinedDidResolver(options = {}) {
+    const didKey = (0, did_key_resolver_js_1.createDidKeyResolver)();
+    const didWeb = (0, did_web_resolver_js_1.createDidWebResolver)({ fetch: options.fetch });
+    return {
+        resolve: async (did) => {
+            if (did.startsWith('did:key:'))
+                return didKey.resolve(did);
+            if (did.startsWith('did:web:'))
+                return didWeb.resolve(did);
+            return null;
+        },
+    };
+}
+/**
+ * Create a VC-JWT signature verifier suitable for
+ * {@link verifyCapabilities}'s `signatureVerifier` option.
+ *
+ * @param options - DID resolver / fetch overrides.
+ * @returns A `(vc, rawJwt) => Promise<{ valid; reason? }>` function.
+ */
+function createVcJwtSignatureVerifier(options = {}) {
+    const resolver = options.didResolver ?? createCombinedDidResolver({ fetch: options.fetch });
+    return async (vc, rawJwt) => {
+        if (rawJwt === undefined) {
+            return { valid: false, reason: 'no compact JWS' };
+        }
+        const issuerDid = extractIssuerDid(vc);
+        if (!issuerDid) {
+            return { valid: false, reason: 'VC missing issuer' };
+        }
+        let kid;
+        try {
+            kid = (0, jose_1.decodeProtectedHeader)(rawJwt).kid;
+        }
+        catch {
+            return { valid: false, reason: 'malformed JWS protected header' };
+        }
+        let didDoc;
+        try {
+            didDoc = await resolver.resolve(issuerDid);
+        }
+        catch (err) {
+            return {
+                valid: false,
+                reason: `issuer resolution failed: ${errorMessage(err)}`,
+            };
+        }
+        if (!didDoc) {
+            return { valid: false, reason: `could not resolve issuer ${issuerDid}` };
+        }
+        const method = selectVerificationMethod(didDoc, kid);
+        if (!method?.publicKeyJwk) {
+            return {
+                valid: false,
+                reason: kid
+                    ? `no verification method matching kid ${kid}`
+                    : 'no verification method with a publicKeyJwk',
+            };
+        }
+        try {
+            const key = await (0, jose_1.importJWK)(method.publicKeyJwk, 'EdDSA');
+            await (0, jose_1.compactVerify)(rawJwt, key);
+            return { valid: true };
+        }
+        catch (err) {
+            return {
+                valid: false,
+                reason: `signature verification failed: ${errorMessage(err)}`,
+            };
+        }
+    };
+}
+/**
+ * Select the verification method to verify against.
+ *
+ * When the JWS carries a `kid`, prefer an exact id match; only when none exists
+ * fall back to matching by fragment — so a fragment-only kid (`#key-1`) and a
+ * fully-qualified id (`did:web:example#key-1`), both common across did:web
+ * documents and JWTs, still resolve to the same key, while a later exact match
+ * is never shadowed by an earlier fragment-only one. Stays fail-closed: a kid
+ * that matches no method is rejected, and a wrongly-matched key fails the
+ * subsequent signature check. Without a `kid`, fall back to the first method
+ * with a `publicKeyJwk`.
+ */
+function selectVerificationMethod(didDoc, kid) {
+    const methods = didDoc.verificationMethod ?? [];
+    if (kid) {
+        const exact = methods.find((method) => method.id === kid);
+        if (exact)
+            return exact;
+        const kidFragment = fragmentOf(kid);
+        return methods.find((method) => fragmentOf(method.id) === kidFragment);
+    }
+    return methods.find((method) => method.publicKeyJwk);
+}
+/** The fragment of a DID-URL reference (the part after `#`), or the whole ref if none. */
+function fragmentOf(ref) {
+    const hash = ref.indexOf('#');
+    return hash >= 0 ? ref.slice(hash + 1) : ref;
+}
+function extractIssuerDid(vc) {
+    const issuer = vc.issuer;
+    if (typeof issuer === 'string')
+        return issuer;
+    if (issuer && typeof issuer === 'object' && typeof issuer.id === 'string') {
+        return issuer.id;
+    }
+    return undefined;
+}
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=vc-jwt-verifier.js.map

package/dist/delegation/did-web-resolver.d.ts

@@ -0,0 +1,60 @@
+/**
+ * did:web Resolver
+ *
+ * Resolves did:web DIDs to DID Documents by fetching the well-known document
+ * over HTTPS, per the did:web method spec.
+ *
+ * URL mapping (did:web method spec §3.2):
+ *   did:web:example.com         → https://example.com/.well-known/did.json
+ *   did:web:example.com:a:b     → https://example.com/a/b/did.json
+ *   did:web:example.com%3A3000  → https://example.com:3000/.well-known/did.json
+ *
+ * Percent-encoded characters in each colon-separated segment are decoded
+ * (notably `%3A` for a host:port colon).
+ *
+ * The fetch implementation is pluggable so callers — and tests — can supply
+ * their own transport; it defaults to the global `fetch`. The resolver never
+ * throws: a non-did:web input, non-OK response, malformed document, or
+ * transport error all resolve to `null`.
+ *
+ * Mirrors the shape of {@link createDidKeyResolver}.
+ *
+ * @see https://w3c-ccg.github.io/did-method-web/
+ */
+import type { DIDResolver } from './vc-verifier';
+/** Minimal subset of a fetch `Response` consumed by the resolver. */
+export interface DidWebFetchResponse {
+    ok: boolean;
+    json(): Promise<unknown>;
+}
+/**
+ * Pluggable fetch signature. The global `fetch` satisfies this structurally,
+ * so it is the default.
+ */
+export type DidWebFetch = (url: string) => Promise<DidWebFetchResponse>;
+/** Options for {@link createDidWebResolver}. */
+export interface DidWebResolverOptions {
+    /** Transport used to retrieve the DID document. Defaults to global `fetch`. */
+    fetch?: DidWebFetch;
+    /**
+     * Max time (ms) to wait for the DID document before failing closed (returning
+     * `null`). Guards against a stalled issuer endpoint hanging verification.
+     * Defaults to {@link DEFAULT_TIMEOUT_MS}.
+     */
+    timeoutMs?: number;
+}
+/**
+ * Convert a did:web DID into the HTTPS URL of its DID document.
+ *
+ * @param did - The did:web DID to map.
+ * @returns The document URL, or `null` if the DID is not a well-formed did:web.
+ */
+export declare function didWebToUrl(did: string): string | null;
+/**
+ * Create a did:web resolver.
+ *
+ * @param options - Optional pluggable fetch transport.
+ * @returns A {@link DIDResolver} for did:web DIDs.
+ */
+export declare function createDidWebResolver(options?: DidWebResolverOptions): DIDResolver;
+//# sourceMappingURL=did-web-resolver.d.ts.map

package/dist/delegation/did-web-resolver.js

@@ -0,0 +1,129 @@
+"use strict";
+/**
+ * did:web Resolver
+ *
+ * Resolves did:web DIDs to DID Documents by fetching the well-known document
+ * over HTTPS, per the did:web method spec.
+ *
+ * URL mapping (did:web method spec §3.2):
+ *   did:web:example.com         → https://example.com/.well-known/did.json
+ *   did:web:example.com:a:b     → https://example.com/a/b/did.json
+ *   did:web:example.com%3A3000  → https://example.com:3000/.well-known/did.json
+ *
+ * Percent-encoded characters in each colon-separated segment are decoded
+ * (notably `%3A` for a host:port colon).
+ *
+ * The fetch implementation is pluggable so callers — and tests — can supply
+ * their own transport; it defaults to the global `fetch`. The resolver never
+ * throws: a non-did:web input, non-OK response, malformed document, or
+ * transport error all resolve to `null`.
+ *
+ * Mirrors the shape of {@link createDidKeyResolver}.
+ *
+ * @see https://w3c-ccg.github.io/did-method-web/
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.didWebToUrl = didWebToUrl;
+exports.createDidWebResolver = createDidWebResolver;
+/** did:web method prefix. */
+const DID_WEB_PREFIX = 'did:web:';
+/** Default time budget (ms) for retrieving a DID document before failing closed. */
+const DEFAULT_TIMEOUT_MS = 5000;
+/**
+ * Convert a did:web DID into the HTTPS URL of its DID document.
+ *
+ * @param did - The did:web DID to map.
+ * @returns The document URL, or `null` if the DID is not a well-formed did:web.
+ */
+function didWebToUrl(did) {
+    if (!did.startsWith(DID_WEB_PREFIX)) {
+        return null;
+    }
+    const identifier = did.slice(DID_WEB_PREFIX.length);
+    if (identifier.length === 0) {
+        return null;
+    }
+    const segments = identifier.split(':');
+    let host;
+    let path;
+    try {
+        host = decodeURIComponent(segments[0]);
+        path = segments.slice(1).map((segment) => decodeURIComponent(segment));
+    }
+    catch {
+        // Malformed percent-encoding (decodeURIComponent throws URIError).
+        return null;
+    }
+    if (host.length === 0 || path.some((segment) => segment.length === 0)) {
+        return null;
+    }
+    const suffix = path.length === 0
+        ? '/.well-known/did.json'
+        : `/${path.join('/')}/did.json`;
+    return `https://${host}${suffix}`;
+}
+/**
+ * Create a did:web resolver.
+ *
+ * @param options - Optional pluggable fetch transport.
+ * @returns A {@link DIDResolver} for did:web DIDs.
+ */
+function createDidWebResolver(options = {}) {
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const doFetch = options.fetch ?? ((url) => fetch(url, { signal: AbortSignal.timeout(timeoutMs) }));
+    return {
+        resolve: async (did) => {
+            const url = didWebToUrl(did);
+            if (!url) {
+                return null;
+            }
+            let response;
+            try {
+                response = await withTimeout(doFetch(url), timeoutMs);
+            }
+            catch {
+                // Transport error, abort, or timeout → fail closed.
+                return null;
+            }
+            if (!response.ok) {
+                return null;
+            }
+            let doc;
+            try {
+                doc = await response.json();
+            }
+            catch {
+                return null;
+            }
+            return isDidDocument(doc) ? doc : null;
+        },
+    };
+}
+/**
+ * Minimal structural check: a DID Document is an object with a string `id`.
+ */
+function isDidDocument(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        typeof value.id === 'string');
+}
+/**
+ * Reject if `promise` does not settle within `ms`, so a stalled fetch fails
+ * closed (the resolver returns `null`) instead of hanging verification
+ * indefinitely. The default transport additionally aborts the underlying request
+ * via `AbortSignal.timeout`; this race also bounds a custom transport.
+ */
+async function withTimeout(promise, ms) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`did:web fetch timed out after ${ms}ms`)), ms);
+    });
+    try {
+        return await Promise.race([promise, timeout]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=did-web-resolver.js.map

package/dist/delegation/outbound-proof.d.ts

@@ -6,9 +6,10 @@
  * without trusting the MCP server.
  *
  * Wire format: signed compact EdDSA JWT (60s TTL, per-call jti)
- * Header injection: KYA-Delegation-Id, KYA-Delegation-Chain, KYA-Delegation-Proof, KYA-Granted-Scopes
+ * Header injection: KYA-OS-Delegation-Chain, KYA-OS-Delegation-Proof, KYA-OS-Granted-Scopes,
+ * and KYA-OS-Delegation-Credential (the JWS-compact DelegationCredential VC) when present
  *
- * Related Spec: MCP-I §2 — Outbound Delegation Propagation
+ * Related Spec: DIF MCP-I §8 — Outbound Delegation Propagation
  */
 import type { DelegationRecord } from "@kya-os/contracts/delegation";
 /**

package/dist/delegation/outbound-proof.js

@@ -7,9 +7,10 @@
  * without trusting the MCP server.
  *
  * Wire format: signed compact EdDSA JWT (60s TTL, per-call jti)
- * Header injection: KYA-Delegation-Id, KYA-Delegation-Chain, KYA-Delegation-Proof, KYA-Granted-Scopes
+ * Header injection: KYA-OS-Delegation-Chain, KYA-OS-Delegation-Proof, KYA-OS-Granted-Scopes,
+ * and KYA-OS-Delegation-Credential (the JWS-compact DelegationCredential VC) when present
  *
- * Related Spec: MCP-I §2 — Outbound Delegation Propagation
+ * Related Spec: DIF MCP-I §8 — Outbound Delegation Propagation
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildDelegationProofJWT = buildDelegationProofJWT;

package/dist/delegation/utils.d.ts

@@ -40,8 +40,10 @@ export interface VCJWTPayload {
     sub?: string;
     /** Audience (e.g., project ID the credential is scoped to). Per RFC 7519, can be string or array. */
     aud?: string | string[];
-    /** Expiration time (from vc.expirationDate) */
+    /** Expiration time (from vc.expirationDate / validUntil) */
     exp?: number;
+    /** Not-before time (RFC 7519 nbf; maps to vc.validFrom) */
+    nbf?: number;
     /** Issued at time (from vc.issuanceDate) */
     iat?: number;
     /** JWT ID (from vc.id) */

package/dist/index.d.ts

@@ -1,53 +1,14 @@
 /**
  * @kya-os/mcp-i-core
  *
- * Core provider-based architecture for MCP-I framework.
- * Platform-agnostic runtime that can be extended for any environment.
+ * Compatibility shim. The product-runtime layer has relocated to
+ * @kya-os/mcp-i-runtime; this package re-exports it so existing
+ * `@kya-os/mcp-i-core` importers keep resolving during the C4 drain window.
+ *
+ * Delegation (W3C VC) symbols remain sourced here — `src/delegation/**` is
+ * pinned by E3.5 (#2904) and is intentionally NOT relocated.
  */
-export { CryptoProvider, ClockProvider, FetchProvider, StorageProvider, NonceCacheProvider, IdentityProvider, type AgentIdentity, } from "./providers/base";
-export { MemoryStorageProvider, MemoryNonceCacheProvider, MemoryIdentityProvider, } from "./providers/memory";
-export { MCPIRuntimeBase } from "./runtime/base";
-export type { RuntimeWithAccessControl } from "./runtime/base";
-export { CONSENT_UI_RESOURCE_URI } from "./runtime/ext-apps-constants";
-export type { IAuditLogger } from "./runtime/audit-logger";
-export * from "./utils";
-export { ToolProtectionService } from "./services/tool-protection.service";
-export { PolicyService } from "./services/policy.service";
-export type { PolicyEvaluationContext, PolicyEvaluationResult, PolicyServiceConfig, } from "./services/policy.service";
-export { CryptoService } from "./services/crypto.service";
-export type { Ed25519JWK, ParsedJWS } from "./services/crypto.service";
-export { ProofVerifier } from "./services/proof-verifier";
-export type { ProofVerificationResult, ProofVerifierConfig, } from "./services/proof-verifier";
-export { AccessControlApiService, authorizationMatches, } from "./services/access-control.service";
-export type { AccessControlApiServiceConfig, AccessControlApiServiceMetrics, } from "./services/access-control.service";
-export { SessionRegistrationService, createSessionRegistrationService, } from "./services/session-registration.service";
-export type { SessionRegistrationServiceConfig, SessionRegistrationResult, } from "./services/session-registration.service";
-export { OAuthConfigService } from "./services/oauth-config.service";
-export type { OAuthConfigServiceConfig } from "./services/oauth-config.service";
-export { OAuthService, defaultSecretResolver } from "./services/oauth-service";
-export type { OAuthServiceConfig, SecretResolver } from "./services/oauth-service";
-export { ToolContextBuilder } from "./services/tool-context-builder";
-export type { ToolContextBuilderConfig } from "./services/tool-context-builder";
-export { OAuthProviderRegistry } from "./services/oauth-provider-registry";
-export { ProviderResolver, ConsentOnlyModeError, CredentialAuthModeError, } from "./services/provider-resolver";
-export { ProviderValidator, ProviderValidationError, } from "./services/provider-validator";
-export { OAuthTokenRetrievalService } from "./services/oauth-token-retrieval.service";
-export type { OAuthTokenRetrievalServiceConfig } from "./services/oauth-token-retrieval.service";
-export { BatchDelegationService } from "./services/batch-delegation.service";
-export type { ToolGroup } from "./services/batch-delegation.service";
-export { InMemoryOAuthConfigCache, NoOpOAuthConfigCache, } from "./cache/oauth-config-cache";
-export type { OAuthConfigCache } from "./cache/oauth-config-cache";
-export { createStorageProviders, StorageKeyHelpers, migrateLegacyKeys, } from "./services/storage.service";
-export type { StorageServiceConfig, StorageProviders, } from "./services/storage.service";
-export { ProofVerificationError, PROOF_VERIFICATION_ERROR_CODES, createProofVerificationError, } from "./services/errors";
-export type { ProofVerificationErrorCode } from "./services/errors";
-export { ToolProtectionCache, InMemoryToolProtectionCache, NoOpToolProtectionCache, } from "./cache/tool-protection-cache";
-export type { ToolProtection, ToolProtectionConfig, ToolProtectionServiceConfig, } from "./types/tool-protection";
-export { DelegationRequiredError } from "./types/tool-protection";
-export { OAuthRequiredError } from "./types/oauth-required-error";
-export type { OAuthRequiredErrorOptions } from "./types/oauth-required-error";
-export { DelegationErrorFormatter, createDelegationErrorFormatter, } from "./services/delegation-error-formatter";
-export type { DelegationErrorFormatOptions, DelegationErrorResult, ClientMessageTemplate, ClientMessagesConfig, } from "./services/delegation-error-formatter";
+export * from "@kya-os/mcp-i-runtime";
 export { DelegationCredentialIssuer, createDelegationIssuer, type IssueDelegationOptions, type VCSigningFunction, type IdentityProvider as DelegationIdentityProvider, } from "./delegation/vc-issuer";
 export { DelegationCredentialVerifier, createDelegationVerifier, type DelegationVCVerificationResult, type VerifyDelegationVCOptions, type DIDResolver, type DIDDocument, type VerificationMethod, type StatusListResolver, type SignatureVerificationFunction, } from "./delegation/vc-verifier";
 export { StatusList2021Manager, createStatusListManager, type StatusListStorageProvider, type StatusListIdentityProvider, } from "./delegation/statuslist-manager";
@@ -58,22 +19,7 @@ export { MemoryStatusListStorage } from "./delegation/storage/memory-statuslist-
 export { MemoryDelegationGraphStorage } from "./delegation/storage/memory-graph-storage";
 export { buildDelegationProofJWT, buildChainString, type DelegationProofOptions, type Ed25519PrivateJWK, } from "./delegation/outbound-proof";
 export { createDidKeyResolver, isEd25519DidKey, extractPublicKeyFromDidKey, publicKeyToJwk, resolveDidKeySync, } from "./delegation/did-key-resolver";
-export { base58Encode, base58Decode, isValidBase58 } from "./utils/base58";
-export { SchemaVerifier, createSchemaVerifier, type SchemaMetadata, type FieldComplianceResult, type SchemaComplianceReport, type FullComplianceReport, } from "./compliance/schema-verifier";
-export { SCHEMA_REGISTRY, getAllSchemas, getSchemasByCategory, getSchemaById, getCriticalSchemas, getSchemaStats, } from "./compliance/schema-registry";
+export { createDidWebResolver, didWebToUrl, type DidWebFetch, type DidWebFetchResponse, type DidWebResolverOptions, } from "./delegation/did-web-resolver";
 export { canonicalizeJSON, createUnsignedVCJWT, completeVCJWT, parseVCJWT, type VCJWTHeader, type VCJWTPayload, type EncodeVCAsJWTOptions, } from "./delegation/utils";
-export { base64urlEncodeFromBytes, base64urlEncodeFromString, base64urlDecodeToBytes, base64urlDecodeToString, bytesToBase64, } from "./utils/base64";
-import type { HandshakeRequest, SessionContext, NonceCache, NonceCacheEntry, NonceCacheConfig, ProofMeta, DetachedProof, CanonicalHashes, AuditRecord } from "@kya-os/contracts";
-export type { HandshakeRequest, SessionContext, NonceCache, NonceCacheEntry, NonceCacheConfig, ProofMeta, DetachedProof, CanonicalHashes, AuditRecord, };
-export * from "./config";
-export { fetchRemoteConfig, type RemoteConfigCache, type RemoteConfigOptions, getToolProtection, extractToolProtections, hasMergedToolProtections, getPolicy, extractPolicy, hasMergedPolicy, isPolicyEnabled, } from "./config/remote-config";
-export { UserDidManager } from "./identity/user-did-manager";
-export type { UserDidStorage, UserDidManagerConfig, UserKeyPair, OAuthIdentity, } from "./identity/user-did-manager";
-export { IdpTokenResolver } from "./identity/idp-token-resolver";
-export type { IdpTokenResolverConfig } from "./identity/idp-token-resolver";
-export type { IIdpTokenStorage, TokenUsageMetadata, IdpTokensWithMetadata, } from "./identity/idp-token-storage.interface";
-export { logger, createDefaultConsoleLogger, type Logger, type Level, } from "./logging";
-export { ProofGenerator, createProofResponse, extractCanonicalData, type ProofAgentIdentity, type ToolRequest, type ToolResponse, type ProofOptions, } from "./proof";
-export { SessionManager, createHandshakeRequest, validateHandshakeFormat, type SessionConfig, type HandshakeResult, } from "./session";
-export { verifyOrHints, hasSensitiveScopes, MemoryResumeTokenStore, type AuthHandshakeConfig, type VerifyOrHintsResult, type AgentReputation, type ResumeTokenStore, type DelegationVerifier, type VerifyDelegationResult, } from "./auth";
+export { verifyCapabilities, validateLevel2, DEFAULT_TRUSTED_ISSUERS, type CapabilityName, type CapabilityAttestation, type CapabilityAttestationCredential, type Level2Capability, type ManifestCapabilities, type CapabilityVCSignatureVerifier, type CapabilityStatusListResolver, type ValidateLevel2Options, type ValidateLevel2Result, type InvalidCapability, createVcJwtSignatureVerifier, createCombinedDidResolver, type VcJwtVerifierOptions, createCapabilityVerifier, type DuckTypedCapability, type CapabilityVerificationContext, type CapabilityVerificationResult, type CapabilityVerifier, type CreateCapabilityVerifierOptions, } from "./conformance/index.js";
 //# sourceMappingURL=index.d.ts.map