@kya-os/mcp 1.10.0 → 1.10.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md CHANGED
@@ -7,6 +7,22 @@ Versioning: https://semver.org/spec/v2.0.0.html
7
7
 
8
8
  ## [Unreleased]
9
9
 
10
+ ## [1.10.1] - 2026-07-08
11
+
12
+ ### Fixed
13
+
14
+ - **Cloudflare Worker / workerd bundle compatibility.** `safe-fetch-transports`
15
+ statically imported `node:dns/promises` and `node:https` at the module top
16
+ level, so anything that builds a `SafeFetch` — including the Entity Card /
17
+ VC-JWT verification path (card resolution + status-list revocation) — required
18
+ those node built-ins at bundle time and broke workerd builds. They now load
19
+ **lazily** (only when a node code path actually runs), so the module bundles
20
+ cleanly for workerd / browser. `selectDefaultTransport` transparently falls
21
+ back to `fetchTransport` where `node:https` is absent. The SSRF policy
22
+ (resolve-and-pin, private-range denial, redirect + size + timeout guards) is
23
+ unchanged; a Worker injects its own DNS seam (or uses trusted origins +
24
+ `fetchTransport`) to avoid `node:dns` at runtime.
25
+
10
26
  ## [1.10.0] - 2026-07-08
11
27
 
12
28
  ### Added
@@ -9,6 +9,7 @@
9
9
  * already run in the policy layer via `resolveAndPin`). All addressing policy lives in
10
10
  * `./ip-classifier`; the seam vocabulary lives in `./safe-fetch-types`. No crypto here.
11
11
  */
12
+ import type { LookupFunction } from 'node:net';
12
13
  import type { DnsLookup, SafeFetchTransport } from './safe-fetch-types.js';
13
14
  /** Default DNS seam — resolve every address (`all: true`) for full SSRF screening. */
14
15
  export declare const defaultLookup: DnsLookup;
@@ -29,12 +30,24 @@ export declare const defaultLookup: DnsLookup;
29
30
  * `node:https` works; the first-party escape hatch avoids the window for a caller's own origin.
30
31
  */
31
32
  export declare const fetchTransport: SafeFetchTransport;
33
+ /**
34
+ * Build the custom `node:https` lookup that pins the connection to the pre-validated IP for BOTH
35
+ * call-shapes (closing the DNS-rebinding TOCTOU window). Node ≥20 defaults to
36
+ * `autoSelectFamily=true`, which invokes a custom lookup with `{ all: true }` and expects an ARRAY
37
+ * of `{ address, family }`; a scalar 3-arg callback yields "Invalid IP address: undefined" and
38
+ * breaks every real request. Honour the array form when `all` is asked, the scalar form otherwise.
39
+ * Exported for direct unit testing (the request wiring around it is integration-only — no TLS in
40
+ * the unit suite). Not re-exported from the package barrels; the public surface is unchanged.
41
+ */
42
+ export declare function buildPinnedLookup(pinnedAddress: string, family: 4 | 6): LookupFunction;
32
43
  /** Default transport — node:https pinned to the validated IP, TLS SNI preserved, body-capped. */
33
44
  export declare const nodeHttpsTransport: SafeFetchTransport;
34
45
  /**
35
46
  * Pick the default transport: the `node:https` pinned transport when it is available, else the
36
- * fetch-based transport. This only covers ABSENCE of `node:https`; a runtime where the pinned
37
- * path is present-but-broken (e.g. Vercel Node serverless) must pass `transport: fetchTransport`.
47
+ * fetch-based transport. The `node:https` check is deferred to request time (it lazy-loads), so a
48
+ * runtime without `node:https` (workerd) transparently gets `fetchTransport`. This only covers
49
+ * ABSENCE of `node:https`; a runtime where the pinned path is present-but-broken (e.g. the Vercel
50
+ * Node serverless runtime) must still pass `transport: fetchTransport` explicitly.
38
51
  */
39
52
  export declare function selectDefaultTransport(): SafeFetchTransport;
40
53
  //# sourceMappingURL=safe-fetch-transports.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"safe-fetch-transports.d.ts","sourceRoot":"","sources":["../../src/utils/safe-fetch-transports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,KAAK,EAAE,SAAS,EAAe,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAExF,sFAAsF;AACtF,eAAO,MAAM,aAAa,EAAE,SAG3B,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,cAAc,EAAE,kBAG5B,CAAC;AA2BF,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,EAAE,kBAsC7B,CAAC;AAgBL;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,kBAAkB,CAE3D"}
1
+ {"version":3,"file":"safe-fetch-transports.d.ts","sourceRoot":"","sources":["../../src/utils/safe-fetch-transports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAe,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AA2CxF,sFAAsF;AACtF,eAAO,MAAM,aAAa,EAAE,SAI3B,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,cAAc,EAAE,kBAG5B,CAAC;AA2BF;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,cAAc,CAUtF;AAED,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,EAAE,kBA+BhC,CAAC;AAgBF;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI,kBAAkB,CAK3D"}
@@ -9,10 +9,25 @@
9
9
  * already run in the policy layer via `resolveAndPin`). All addressing policy lives in
10
10
  * `./ip-classifier`; the seam vocabulary lives in `./safe-fetch-types`. No crypto here.
11
11
  */
12
- import { lookup as nodeDnsLookup } from 'node:dns/promises';
13
- import { request as httpsRequest } from 'node:https';
12
+ let dnsLookupPromise;
13
+ /**
14
+ * Lazily load (and cache) `node:dns/promises`' `lookup`. Where `node:dns` is absent (workerd),
15
+ * fail with a guiding error rather than a cryptic module-resolution reject: a Worker should inject
16
+ * its own `lookup` seam (e.g. DNS-over-HTTPS) or use trusted origins + `fetchTransport`.
17
+ */
18
+ function loadNodeDnsLookup() {
19
+ return (dnsLookupPromise ??= import('node:dns/promises').then((m) => m.lookup, (cause) => {
20
+ throw new Error('safe-fetch: node:dns is unavailable in this runtime — inject a `lookup` seam (e.g. DNS-over-HTTPS) or use trusted origins with fetchTransport', { cause });
21
+ }));
22
+ }
23
+ let nodeHttpsPromise;
24
+ /** Lazily load (and cache) `node:https`; resolves to `null` where it's absent (workerd). */
25
+ function loadNodeHttps() {
26
+ return (nodeHttpsPromise ??= import('node:https').then((m) => m, () => null));
27
+ }
14
28
  /** Default DNS seam — resolve every address (`all: true`) for full SSRF screening. */
15
29
  export const defaultLookup = async (hostname) => {
30
+ const nodeDnsLookup = await loadNodeDnsLookup();
16
31
  const resolved = await nodeDnsLookup(hostname, { all: true, verbatim: true });
17
32
  return resolved.map((entry) => ({ address: entry.address, family: entry.family }));
18
33
  };
@@ -61,42 +76,56 @@ async function readCapped(response, maxBytes) {
61
76
  text: () => Promise.resolve(body),
62
77
  };
63
78
  }
64
- /** Default transport — node:https pinned to the validated IP, TLS SNI preserved, body-capped. */
65
- export const nodeHttpsTransport = (url, init) => new Promise((resolve, reject) => {
66
- // Return the pinned IP for BOTH lookup call-shapes. Node ≥20 defaults to
67
- // `autoSelectFamily=true`, which invokes a custom lookup with `{ all: true }` and expects an
68
- // ARRAY of `{ address, family }`; a scalar 3-arg callback yields "Invalid IP address:
69
- // undefined" and breaks every real request. Honour the array form when `all` is asked,
70
- // the scalar form otherwise.
71
- const family = init.family === 6 ? 6 : 4;
72
- const pinnedLookup = (_hostname, options, cb) => {
79
+ /**
80
+ * Build the custom `node:https` lookup that pins the connection to the pre-validated IP for BOTH
81
+ * call-shapes (closing the DNS-rebinding TOCTOU window). Node ≥20 defaults to
82
+ * `autoSelectFamily=true`, which invokes a custom lookup with `{ all: true }` and expects an ARRAY
83
+ * of `{ address, family }`; a scalar 3-arg callback yields "Invalid IP address: undefined" and
84
+ * breaks every real request. Honour the array form when `all` is asked, the scalar form otherwise.
85
+ * Exported for direct unit testing (the request wiring around it is integration-only — no TLS in
86
+ * the unit suite). Not re-exported from the package barrels; the public surface is unchanged.
87
+ */
88
+ export function buildPinnedLookup(pinnedAddress, family) {
89
+ return (_hostname, options, cb) => {
73
90
  if (typeof options === 'object' && options?.all) {
74
91
  cb(null, [
75
- { address: init.pinnedAddress, family },
92
+ { address: pinnedAddress, family },
76
93
  ]);
77
94
  }
78
95
  else {
79
- cb(null, init.pinnedAddress, family);
96
+ cb(null, pinnedAddress, family);
80
97
  }
81
98
  };
82
- const req = httpsRequest(url, { method: 'GET', servername: init.hostname, signal: init.signal, lookup: pinnedLookup }, (res) => {
83
- const chunks = [];
84
- let size = 0;
85
- res.on('data', (chunk) => {
86
- size += chunk.length;
87
- if (size > init.maxBytes) {
88
- req.destroy();
89
- reject(new Error(`safe-fetch: response body exceeds size cap ${init.maxBytes}`));
90
- return;
91
- }
92
- chunks.push(chunk);
99
+ }
100
+ /** Default transport — node:https pinned to the validated IP, TLS SNI preserved, body-capped. */
101
+ export const nodeHttpsTransport = async (url, init) => {
102
+ const https = await loadNodeHttps();
103
+ if (!https) {
104
+ throw new Error('safe-fetch: node:https is unavailable in this runtime; pass transport: fetchTransport');
105
+ }
106
+ const httpsRequest = https.request;
107
+ return new Promise((resolve, reject) => {
108
+ const family = init.family === 6 ? 6 : 4;
109
+ const pinnedLookup = buildPinnedLookup(init.pinnedAddress, family);
110
+ const req = httpsRequest(url, { method: 'GET', servername: init.hostname, signal: init.signal, lookup: pinnedLookup }, (res) => {
111
+ const chunks = [];
112
+ let size = 0;
113
+ res.on('data', (chunk) => {
114
+ size += chunk.length;
115
+ if (size > init.maxBytes) {
116
+ req.destroy();
117
+ reject(new Error(`safe-fetch: response body exceeds size cap ${init.maxBytes}`));
118
+ return;
119
+ }
120
+ chunks.push(chunk);
121
+ });
122
+ res.on('end', () => resolve(toRawResponse(res, chunks)));
123
+ res.on('error', reject);
93
124
  });
94
- res.on('end', () => resolve(toRawResponse(res, chunks)));
95
- res.on('error', reject);
125
+ req.on('error', reject);
126
+ req.end();
96
127
  });
97
- req.on('error', reject);
98
- req.end();
99
- });
128
+ };
100
129
  /** Project a node:http IncomingMessage + buffered chunks into the RawResponse shape. */
101
130
  function toRawResponse(res, chunks) {
102
131
  return {
@@ -112,10 +141,15 @@ function toRawResponse(res, chunks) {
112
141
  }
113
142
  /**
114
143
  * Pick the default transport: the `node:https` pinned transport when it is available, else the
115
- * fetch-based transport. This only covers ABSENCE of `node:https`; a runtime where the pinned
116
- * path is present-but-broken (e.g. Vercel Node serverless) must pass `transport: fetchTransport`.
144
+ * fetch-based transport. The `node:https` check is deferred to request time (it lazy-loads), so a
145
+ * runtime without `node:https` (workerd) transparently gets `fetchTransport`. This only covers
146
+ * ABSENCE of `node:https`; a runtime where the pinned path is present-but-broken (e.g. the Vercel
147
+ * Node serverless runtime) must still pass `transport: fetchTransport` explicitly.
117
148
  */
118
149
  export function selectDefaultTransport() {
119
- return typeof httpsRequest === 'function' ? nodeHttpsTransport : fetchTransport;
150
+ return async (url, init) => {
151
+ const https = await loadNodeHttps();
152
+ return https ? nodeHttpsTransport(url, init) : fetchTransport(url, init);
153
+ };
120
154
  }
121
155
  //# sourceMappingURL=safe-fetch-transports.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"safe-fetch-transports.js","sourceRoot":"","sources":["../../src/utils/safe-fetch-transports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAKrD,sFAAsF;AACtF,MAAM,CAAC,MAAM,aAAa,GAAc,KAAK,EAAE,QAAQ,EAAE,EAAE;IACzD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACrF,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,cAAc,GAAuB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACpE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9F,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,0FAA0F;AAC1F,KAAK,UAAU,UAAU,CAAC,QAAkB,EAAE,QAAgB;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,MAAM,EAAE,CAAC;QACX,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,8CAA8C,QAAQ,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACtD,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,MAAM,kBAAkB,GAAuB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAClE,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC3C,yEAAyE;IACzE,6FAA6F;IAC7F,sFAAsF;IACtF,uFAAuF;IACvF,6BAA6B;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,YAAY,GAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE;QAC9D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,EAAE,GAAG,EAAE,CAAC;YAC/C,EAAkF,CAAC,IAAI,EAAE;gBACxF,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,YAAY,CACtB,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,EACvF,CAAC,GAAoB,EAAE,EAAE;QACvB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACzB,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,KAAK,CAAC,8CAA8C,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBACjF,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACzD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CACF,CAAC;IACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,EAAE,CAAC;AACZ,CAAC,CAAC,CAAC;AAEL,wFAAwF;AACxF,SAAS,aAAa,CAAC,GAAoB,EAAE,MAAgB;IAC3D,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;QAC3B,OAAO,EAAE;YACP,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;gBACZ,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;YACrE,CAAC;SACF;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,cAAc,CAAC;AAClF,CAAC"}
1
+ {"version":3,"file":"safe-fetch-transports.js","sourceRoot":"","sources":["../../src/utils/safe-fetch-transports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAmBH,IAAI,gBAAoD,CAAC;AACzD;;;;GAIG;AACH,SAAS,iBAAiB;IACxB,OAAO,CAAC,gBAAgB,KAAK,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAC3D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EACf,CAAC,KAAK,EAAE,EAAE;QACR,MAAM,IAAI,KAAK,CACb,+IAA+I,EAC/I,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC,CACF,CAAC,CAAC;AACL,CAAC;AAGD,IAAI,gBAAuD,CAAC;AAC5D,4FAA4F;AAC5F,SAAS,aAAa;IACpB,OAAO,CAAC,gBAAgB,KAAK,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CACpD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EACR,GAAG,EAAE,CAAC,IAAI,CACX,CAAC,CAAC;AACL,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,aAAa,GAAc,KAAK,EAAE,QAAQ,EAAE,EAAE;IACzD,MAAM,aAAa,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACrF,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,cAAc,GAAuB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACpE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9F,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC,CAAC;AAEF,0FAA0F;AAC1F,KAAK,UAAU,UAAU,CAAC,QAAkB,EAAE,QAAgB;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,MAAM,EAAE,CAAC;QACX,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,8CAA8C,QAAQ,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACtD,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,aAAqB,EAAE,MAAa;IACpE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE;QAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,EAAE,GAAG,EAAE,CAAC;YAC/C,EAAkF,CAAC,IAAI,EAAE;gBACxF,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE;aACnC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,MAAM,kBAAkB,GAAuB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACxE,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC;IACnC,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,GAAG,GAAG,YAAY,CACtB,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,EACvF,CAAC,GAAoB,EAAE,EAAE;YACvB,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBACrB,IAAI,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACzB,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,MAAM,CAAC,IAAI,KAAK,CAAC,8CAA8C,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;oBACjF,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YACzD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,wFAAwF;AACxF,SAAS,aAAa,CAAC,GAAoB,EAAE,MAAgB;IAC3D,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;QAC3B,OAAO,EAAE;YACP,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;gBACZ,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;YACrE,CAAC;SACF;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3E,CAAC,CAAC;AACJ,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@kya-os/mcp",
3
- "version": "1.10.0",
3
+ "version": "1.10.1",
4
4
  "description": "Reference implementation of the KYA-OS protocol for Model Context Protocol servers: delegation, proof, and session primitives",
5
5
  "license": "MIT",
6
6
  "type": "module",