@kya-os/mcp 1.10.1 → 1.12.0

package/dist/extension/declaration.js

@@ -0,0 +1,75 @@
+/**
+ * Reading a peer's `org.kya-os/decentralized-authority` declaration (SPEC-MCP-EXTENSION.md §3.1).
+ *
+ * Two carriage forms are normalized into one shape:
+ *
+ *   - stateless (2026-07-28): the request's
+ *     `params._meta["io.modelcontextprotocol/clientCapabilities"].extensions[id]`
+ *   - initialize-era (2025-11-25): `capabilities.extensions[id]` from the
+ *     initialize exchange, supplied by the host as `initializeCapabilities`
+ *
+ * Precedence: the per-request stateless entry, when PRESENT, is final - a
+ * malformed stateless entry is classified as `malformed` (never a silent
+ * fallback to the initialize-era entry), because the per-request carriage
+ * supersedes initialize-era state. What a malformed entry MEANS is the gate's
+ * call (§3.2): degrade-to-absent in optional mode, -32602 in required mode.
+ */
+import { isRecord } from '../utils/guards.js';
+import { KYA_OS_EXTENSION_ID, MCP_CLIENT_CAPABILITIES_META_KEY, parseExtensionSettings, } from './settings.js';
+/**
+ * Classify the peer's declaration from either carriage, distinguishing a
+ * present-but-malformed entry from a genuinely absent one. That distinction is
+ * what lets the gate answer malformed with `-32602` in required mode (§3.2)
+ * while still degrading it to core behavior in optional mode - so a corrupted,
+ * untrusted, proof-excluded `_meta` member never turns an otherwise-valid
+ * optional-mode request into a rejection.
+ */
+export function classifyExtensionDeclaration(input) {
+    const id = input.extensionId ?? KYA_OS_EXTENSION_ID;
+    const stateless = extensionsEntry(clientCapabilitiesFromMeta(input.meta), id);
+    if (stateless.present) {
+        const settings = parseExtensionSettings(stateless.value);
+        return settings === undefined
+            ? { status: 'malformed', carriage: 'stateless' }
+            : { status: 'declared', declaration: { settings, carriage: 'stateless' } };
+    }
+    const legacy = extensionsEntry(input.initializeCapabilities, id);
+    if (legacy.present) {
+        const settings = parseExtensionSettings(legacy.value);
+        return settings === undefined
+            ? { status: 'malformed', carriage: 'initialize' }
+            : { status: 'declared', declaration: { settings, carriage: 'initialize' } };
+    }
+    return { status: 'absent' };
+}
+/**
+ * Read and validate the peer's declaration from either carriage.
+ * Returns `undefined` when there is no usable declaration - including a
+ * malformed one; callers that must distinguish malformed from absent (the gate)
+ * use {@link classifyExtensionDeclaration} instead.
+ */
+export function readExtensionDeclaration(input) {
+    const classification = classifyExtensionDeclaration(input);
+    return classification.status === 'declared' ? classification.declaration : undefined;
+}
+/** Pull `io.modelcontextprotocol/clientCapabilities` out of a `_meta` bag. */
+function clientCapabilitiesFromMeta(meta) {
+    return isRecord(meta) ? meta[MCP_CLIENT_CAPABILITIES_META_KEY] : undefined;
+}
+/**
+ * Locate the extension's entry inside a capabilities object. Presence is
+ * detected with `hasOwnProperty` so an explicit empty-object declaration
+ * (`{ "org.kya-os/decentralized-authority": {} }` - legal per SEP-2133) is distinguishable
+ * from an absent one.
+ */
+function extensionsEntry(capabilities, id) {
+    if (!isRecord(capabilities))
+        return { present: false };
+    const extensions = capabilities['extensions'];
+    if (!isRecord(extensions))
+        return { present: false };
+    if (!Object.prototype.hasOwnProperty.call(extensions, id))
+        return { present: false };
+    return { present: true, value: extensions[id] };
+}
+//# sourceMappingURL=declaration.js.map

package/dist/extension/declaration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declaration.js","sourceRoot":"","sources":["../../src/extension/declaration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,sBAAsB,GAEvB,MAAM,eAAe,CAAC;AA2BvB;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAA2B;IAE3B,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAEpD,MAAM,SAAS,GAAG,eAAe,CAAC,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,QAAQ,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE;YAChD,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,QAAQ,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE;YACjD,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAA2B;IAE3B,MAAM,cAAc,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC3D,OAAO,cAAc,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AAED,8EAA8E;AAC9E,SAAS,0BAA0B,CAAC,IAAa;IAC/C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,YAAqB,EACrB,EAAU;IAEV,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACvD,MAAM,UAAU,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACrF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;AAClD,CAAC"}

package/dist/extension/gate.d.ts

@@ -0,0 +1,110 @@
+/**
+ * The `org.kya-os/decentralized-authority` admission gate (SPEC-MCP-EXTENSION.md §4-§5).
+ *
+ * Mirrors the `requireProof` guard idiom (`src/card/middleware.ts`): the host
+ * builds a guard once from its server settings and runs it per request. Nothing
+ * in the default path changes for hosts that never install the gate - the
+ * extension is strictly opt-in.
+ *
+ *   - `required: false` (default): an undeclared peer gets core MCP behavior;
+ *     the gate always admits and merely reports the declaration when present. A
+ *     malformed declaration also degrades to core behavior here (§3.2), so a
+ *     corrupted untrusted `_meta` member can never reject a valid request.
+ *   - `required: true`: a request without a declaration is rejected with the
+ *     core MCP error `-32021` (`MissingRequiredClientCapabilityError`); a
+ *     present-but-malformed one is rejected with `-32602` (Invalid params,
+ *     `malformed_declaration`). Both carry this extension's `reason`/`extension`
+ *     pair, and exempt methods (`server/discover`, `ping` by default) are never
+ *     gated so discovery stays reachable.
+ *
+ * A stripped declaration is an ABSENT declaration (fail closed, §4.3) - never
+ * silent acceptance, never a guess.
+ */
+import { type ExtensionDeclaration } from './declaration.js';
+import { type KyaOsExtensionSettings } from './settings.js';
+/**
+ * Default JSON-RPC code for KYA-OS domain failures (SPEC-MCP-EXTENSION.md §5).
+ * The number is deliberately NOT the dispatch surface - clients dispatch on
+ * `error.data.reason` - and it sits outside the JSON-RPC reserved range
+ * (`-32768..-32000`), per the 2026-07-28 allocation policy: new codes MUST NOT
+ * be allocated in the legacy `-32000..-32019` sub-range and new
+ * implementations SHOULD NOT use that sub-range at all.
+ */
+export declare const KYA_OS_DOMAIN_ERROR_CODE = -31000;
+/**
+ * Methods a required-mode server never gates (SPEC-MCP-EXTENSION.md §4.2):
+ * `server/discover` MUST stay reachable so a non-declaring client can learn
+ * the requirement it fails; `ping` is exempted for peers on earlier protocol
+ * revisions.
+ */
+export declare const DEFAULT_EXEMPT_METHODS: readonly string[];
+/** A JSON-RPC error object (the `error` member of a JSON-RPC response). */
+export interface JsonRpcErrorObject {
+    code: number;
+    message: string;
+    data: {
+        /** The snake_case KYA-OS reason code - the mandatory dispatch surface (§5.2). */
+        reason: string;
+        /** The core schema's -32021 payload: the capabilities the server requires (§4.2). */
+        requiredCapabilities?: Record<string, unknown>;
+        /** The extension id, on negotiation failures. */
+        extension?: string;
+        /** The proof profile, on proof-gate failures. */
+        profile?: string;
+        /** Fine-grained verification reasons (SPEC-ENTITY-CARD Appendix D.1), for diagnostics. */
+        reasons?: string[];
+    };
+}
+/** The gate verdict: admitted (with the declaration when one was made) or a JSON-RPC rejection. */
+export type ExtensionGateResult = {
+    ok: true;
+    declaration?: ExtensionDeclaration;
+} | {
+    ok: false;
+    error: JsonRpcErrorObject;
+};
+/** Per-request admission guard built by {@link requireExtension}. */
+export type ExtensionGuard = (input: {
+    meta?: unknown;
+    initializeCapabilities?: unknown;
+    /** The request's JSON-RPC method; exempt methods are never gated in required mode (§4.2). */
+    method?: string;
+}) => ExtensionGateResult;
+/**
+ * Build the admission guard from the server's own settings (validated here,
+ * throwing on malformed OWN settings - a programmer error, unlike peer input).
+ */
+export declare function requireExtension(serverSettings?: KyaOsExtensionSettings, opts?: {
+    extensionId?: string;
+    exemptMethods?: readonly string[];
+}): ExtensionGuard;
+/** The `-32021` rejection for a required-but-undeclared extension (SPEC-MCP-EXTENSION.md §4.2). */
+export declare function missingRequiredCapabilityError(extensionId?: string): JsonRpcErrorObject;
+/** JSON-RPC "Invalid params" - the core code a present-but-malformed declaration rejects with (§3.2). */
+export declare const INVALID_PARAMS_CODE = -32602;
+/**
+ * The `-32602` rejection for a required-mode request whose declaration is present
+ * but malformed (SPEC-MCP-EXTENSION.md §3.2). Distinct from
+ * {@link missingRequiredCapabilityError}: a garbled declaration is a client-
+ * integrity error, not a missing one. In optional mode the gate never reaches
+ * here - a malformed declaration degrades to core behavior instead.
+ */
+export declare function malformedDeclarationError(extensionId?: string): JsonRpcErrorObject;
+/** The 401-shaped proof-gate error shape (`requireProof`, `src/card/middleware.ts`), structurally. */
+export interface ProofGateErrorLike {
+    /** A snake_case gate code (`proof_missing` | `proof_invalid` | `proof_level_insufficient`). */
+    code: string;
+    message: string;
+    reasons?: string[];
+}
+/**
+ * Map a proof-gate rejection onto the JSON-RPC surface per SPEC-MCP-EXTENSION.md
+ * §5.2: the snake_case code rides `error.data.reason` VERBATIM, the numeric code
+ * stays implementation-defined, and codes inside the MCP-reserved range
+ * (`-32099..-32020`) are refused outright.
+ */
+export declare function proofGateToJsonRpcError(gateError: ProofGateErrorLike, opts?: {
+    code?: number;
+    profile?: string;
+}): JsonRpcErrorObject;
+//# sourceMappingURL=gate.d.ts.map

package/dist/extension/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/extension/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAOL,KAAK,sBAAsB,EAC5B,MAAM,eAAe,CAAC;AAEvB;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,SAAS,CAAC;AAM/C;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAAgC,CAAC;AAErF,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE;QACJ,iFAAiF;QACjF,MAAM,EAAE,MAAM,CAAC;QACf,qFAAqF;QACrF,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/C,iDAAiD;QACjD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iDAAiD;QACjD,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,0FAA0F;QAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH;AAED,mGAAmG;AACnG,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,oBAAoB,CAAA;CAAE,GAChD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAE7C,qEAAqE;AACrE,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE;IACnC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,6FAA6F;IAC7F,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,KAAK,mBAAmB,CAAC;AAE1B;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,cAAc,GAAE,sBAA2B,EAC3C,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GACrE,cAAc,CA6BhB;AAED,mGAAmG;AACnG,wBAAgB,8BAA8B,CAC5C,WAAW,GAAE,MAA4B,GACxC,kBAAkB,CAUpB;AAED,yGAAyG;AACzG,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,GAAE,MAA4B,GACxC,kBAAkB,CASpB;AAED,sGAAsG;AACtG,MAAM,WAAW,kBAAkB;IACjC,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,kBAAkB,EAC7B,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7C,kBAAkB,CAkBpB"}

package/dist/extension/gate.js

@@ -0,0 +1,133 @@
+/**
+ * The `org.kya-os/decentralized-authority` admission gate (SPEC-MCP-EXTENSION.md §4-§5).
+ *
+ * Mirrors the `requireProof` guard idiom (`src/card/middleware.ts`): the host
+ * builds a guard once from its server settings and runs it per request. Nothing
+ * in the default path changes for hosts that never install the gate - the
+ * extension is strictly opt-in.
+ *
+ *   - `required: false` (default): an undeclared peer gets core MCP behavior;
+ *     the gate always admits and merely reports the declaration when present. A
+ *     malformed declaration also degrades to core behavior here (§3.2), so a
+ *     corrupted untrusted `_meta` member can never reject a valid request.
+ *   - `required: true`: a request without a declaration is rejected with the
+ *     core MCP error `-32021` (`MissingRequiredClientCapabilityError`); a
+ *     present-but-malformed one is rejected with `-32602` (Invalid params,
+ *     `malformed_declaration`). Both carry this extension's `reason`/`extension`
+ *     pair, and exempt methods (`server/discover`, `ping` by default) are never
+ *     gated so discovery stays reachable.
+ *
+ * A stripped declaration is an ABSENT declaration (fail closed, §4.3) - never
+ * silent acceptance, never a guess.
+ */
+import { PROOF_PROFILE_ID } from '../card/schema.js';
+import { classifyExtensionDeclaration, } from './declaration.js';
+import { EXTENSION_NOT_DECLARED_REASON, KYA_OS_EXTENSION_ID, MALFORMED_DECLARATION_REASON, MISSING_REQUIRED_CLIENT_CAPABILITY_CODE, buildExtensionSettings, resolveExtensionSettings, } from './settings.js';
+/**
+ * Default JSON-RPC code for KYA-OS domain failures (SPEC-MCP-EXTENSION.md §5).
+ * The number is deliberately NOT the dispatch surface - clients dispatch on
+ * `error.data.reason` - and it sits outside the JSON-RPC reserved range
+ * (`-32768..-32000`), per the 2026-07-28 allocation policy: new codes MUST NOT
+ * be allocated in the legacy `-32000..-32019` sub-range and new
+ * implementations SHOULD NOT use that sub-range at all.
+ */
+export const KYA_OS_DOMAIN_ERROR_CODE = -31000;
+/** The MCP-reserved code range this extension MUST NOT allocate from (§5.1). */
+const MCP_RESERVED_MIN = -32099;
+const MCP_RESERVED_MAX = -32020;
+/**
+ * Methods a required-mode server never gates (SPEC-MCP-EXTENSION.md §4.2):
+ * `server/discover` MUST stay reachable so a non-declaring client can learn
+ * the requirement it fails; `ping` is exempted for peers on earlier protocol
+ * revisions.
+ */
+export const DEFAULT_EXEMPT_METHODS = ['server/discover', 'ping'];
+/**
+ * Build the admission guard from the server's own settings (validated here,
+ * throwing on malformed OWN settings - a programmer error, unlike peer input).
+ */
+export function requireExtension(serverSettings = {}, opts = {}) {
+    const settings = resolveExtensionSettings(buildExtensionSettings(serverSettings));
+    const extensionId = opts.extensionId ?? KYA_OS_EXTENSION_ID;
+    const exemptMethods = opts.exemptMethods ?? DEFAULT_EXEMPT_METHODS;
+    return (input) => {
+        const classification = classifyExtensionDeclaration({ ...input, extensionId });
+        if (classification.status === 'declared') {
+            return { ok: true, declaration: classification.declaration };
+        }
+        // Optional mode: both absent AND malformed degrade to core MCP behavior. The
+        // declaration is an untrusted, intermediary-mutable, proof-excluded `_meta`
+        // member (§7), so rejecting on a malformed one would let a corrupting
+        // intermediary turn an otherwise-valid request into a failure while a mere
+        // strip lets it through - the "corrupt vs. strip" asymmetry (§3.2).
+        if (!settings.required) {
+            return { ok: true };
+        }
+        // Discovery/ping stay reachable so a non-declaring client can learn the requirement.
+        if (input.method !== undefined && exemptMethods.includes(input.method)) {
+            return { ok: true };
+        }
+        // Required mode rejects an absent declaration anyway, so surfacing the
+        // distinction carries no new DoS: a present-but-malformed declaration is a
+        // client-integrity error (-32602); a genuinely absent one is the
+        // missing-capability error (-32021).
+        return classification.status === 'malformed'
+            ? { ok: false, error: malformedDeclarationError(extensionId) }
+            : { ok: false, error: missingRequiredCapabilityError(extensionId) };
+    };
+}
+/** The `-32021` rejection for a required-but-undeclared extension (SPEC-MCP-EXTENSION.md §4.2). */
+export function missingRequiredCapabilityError(extensionId = KYA_OS_EXTENSION_ID) {
+    return {
+        code: MISSING_REQUIRED_CLIENT_CAPABILITY_CODE,
+        message: `Missing required client capability: ${extensionId}`,
+        data: {
+            requiredCapabilities: { extensions: { [extensionId]: {} } },
+            reason: EXTENSION_NOT_DECLARED_REASON,
+            extension: extensionId,
+        },
+    };
+}
+/** JSON-RPC "Invalid params" - the core code a present-but-malformed declaration rejects with (§3.2). */
+export const INVALID_PARAMS_CODE = -32602;
+/**
+ * The `-32602` rejection for a required-mode request whose declaration is present
+ * but malformed (SPEC-MCP-EXTENSION.md §3.2). Distinct from
+ * {@link missingRequiredCapabilityError}: a garbled declaration is a client-
+ * integrity error, not a missing one. In optional mode the gate never reaches
+ * here - a malformed declaration degrades to core behavior instead.
+ */
+export function malformedDeclarationError(extensionId = KYA_OS_EXTENSION_ID) {
+    return {
+        code: INVALID_PARAMS_CODE,
+        message: `Invalid params: the ${extensionId} settings declaration is present but malformed`,
+        data: {
+            reason: MALFORMED_DECLARATION_REASON,
+            extension: extensionId,
+        },
+    };
+}
+/**
+ * Map a proof-gate rejection onto the JSON-RPC surface per SPEC-MCP-EXTENSION.md
+ * §5.2: the snake_case code rides `error.data.reason` VERBATIM, the numeric code
+ * stays implementation-defined, and codes inside the MCP-reserved range
+ * (`-32099..-32020`) are refused outright.
+ */
+export function proofGateToJsonRpcError(gateError, opts = {}) {
+    if (opts.code !== undefined && opts.code >= MCP_RESERVED_MIN && opts.code <= MCP_RESERVED_MAX) {
+        throw new Error(`JSON-RPC code ${opts.code} is inside the MCP-reserved range (${MCP_RESERVED_MIN}..${MCP_RESERVED_MAX}); ` +
+            'KYA-OS domain errors use implementation-defined codes (SPEC-MCP-EXTENSION.md §5.1)');
+    }
+    return {
+        code: opts.code ?? KYA_OS_DOMAIN_ERROR_CODE,
+        message: gateError.message,
+        data: {
+            reason: gateError.code,
+            profile: opts.profile ?? PROOF_PROFILE_ID,
+            ...(gateError.reasons && gateError.reasons.length > 0
+                ? { reasons: [...gateError.reasons] }
+                : {}),
+        },
+    };
+}
+//# sourceMappingURL=gate.js.map

package/dist/extension/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/extension/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACL,4BAA4B,GAE7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,6BAA6B,EAC7B,mBAAmB,EACnB,4BAA4B,EAC5B,uCAAuC,EACvC,sBAAsB,EACtB,wBAAwB,GAEzB,MAAM,eAAe,CAAC;AAEvB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,KAAK,CAAC;AAE/C,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,CAAC,KAAK,CAAC;AAChC,MAAM,gBAAgB,GAAG,CAAC,KAAK,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;AAiCrF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,iBAAyC,EAAE,EAC3C,OAAoE,EAAE;IAEtE,MAAM,QAAQ,GAAG,wBAAwB,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC,CAAC;IAClF,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAC5D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,sBAAsB,CAAC;IACnE,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,MAAM,cAAc,GAAG,4BAA4B,CAAC,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC/E,IAAI,cAAc,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACzC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,EAAE,CAAC;QAC/D,CAAC;QACD,6EAA6E;QAC7E,4EAA4E;QAC5E,sEAAsE;QACtE,2EAA2E;QAC3E,oEAAoE;QACpE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,qFAAqF;QACrF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACvE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,uEAAuE;QACvE,2EAA2E;QAC3E,iEAAiE;QACjE,qCAAqC;QACrC,OAAO,cAAc,CAAC,MAAM,KAAK,WAAW;YAC1C,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,CAAC,WAAW,CAAC,EAAE;YAC9D,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,CAAC,WAAW,CAAC,EAAE,CAAC;IACxE,CAAC,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,8BAA8B,CAC5C,cAAsB,mBAAmB;IAEzC,OAAO;QACL,IAAI,EAAE,uCAAuC;QAC7C,OAAO,EAAE,uCAAuC,WAAW,EAAE;QAC7D,IAAI,EAAE;YACJ,oBAAoB,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE;YAC3D,MAAM,EAAE,6BAA6B;YACrC,SAAS,EAAE,WAAW;SACvB;KACF,CAAC;AACJ,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAK,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,cAAsB,mBAAmB;IAEzC,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,uBAAuB,WAAW,gDAAgD;QAC3F,IAAI,EAAE;YACJ,MAAM,EAAE,4BAA4B;YACpC,SAAS,EAAE,WAAW;SACvB;KACF,CAAC;AACJ,CAAC;AAUD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAA6B,EAC7B,OAA4C,EAAE;IAE9C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,IAAI,gBAAgB,IAAI,IAAI,CAAC,IAAI,IAAI,gBAAgB,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,CAAC,IAAI,sCAAsC,gBAAgB,KAAK,gBAAgB,KAAK;YACxG,oFAAoF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,wBAAwB;QAC3C,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,IAAI,EAAE;YACJ,MAAM,EAAE,SAAS,CAAC,IAAI;YACtB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,gBAAgB;YACzC,GAAG,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBACnD,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,EAAE;gBACrC,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;AACJ,CAAC"}

package/dist/extension/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * KYA-OS MCP extension negotiation (`org.kya-os/decentralized-authority`).
+ *
+ * The MCP binding surface of SPEC-MCP-EXTENSION.md: the extension id and
+ * settings object (§1, §3), the declaration reader for both carriage forms
+ * (§3.1), the admission gate with core `-32021` required-mode enforcement
+ * (§4), and the JSON-RPC error mapping that keeps snake_case reason codes as
+ * the dispatch surface (§5). Strictly additive: nothing here runs unless the
+ * host opts in.
+ */
+export { KYA_OS_EXTENSION_ID, MCP_CLIENT_CAPABILITIES_META_KEY, MISSING_REQUIRED_CLIENT_CAPABILITY_CODE, EXTENSION_NOT_DECLARED_REASON, ExtensionSettingsSchema, DEFAULT_EXTENSION_SETTINGS, parseExtensionSettings, resolveExtensionSettings, buildExtensionSettings, buildExtensionsEntry, type KyaOsExtensionSettings, type ResolvedExtensionSettings, } from './settings.js';
+export { readExtensionDeclaration, type DeclarationCarriage, type ExtensionDeclaration, type ReadDeclarationInput, } from './declaration.js';
+export { KYA_OS_DOMAIN_ERROR_CODE, DEFAULT_EXEMPT_METHODS, requireExtension, missingRequiredCapabilityError, proofGateToJsonRpcError, type ExtensionGateResult, type ExtensionGuard, type JsonRpcErrorObject, type ProofGateErrorLike, } from './gate.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/extension/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/extension/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,uCAAuC,EACvC,6BAA6B,EAC7B,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,GAC/B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,wBAAwB,EACxB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,gBAAgB,EAChB,8BAA8B,EAC9B,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,WAAW,CAAC"}

package/dist/extension/index.js

@@ -0,0 +1,14 @@
+/**
+ * KYA-OS MCP extension negotiation (`org.kya-os/decentralized-authority`).
+ *
+ * The MCP binding surface of SPEC-MCP-EXTENSION.md: the extension id and
+ * settings object (§1, §3), the declaration reader for both carriage forms
+ * (§3.1), the admission gate with core `-32021` required-mode enforcement
+ * (§4), and the JSON-RPC error mapping that keeps snake_case reason codes as
+ * the dispatch surface (§5). Strictly additive: nothing here runs unless the
+ * host opts in.
+ */
+export { KYA_OS_EXTENSION_ID, MCP_CLIENT_CAPABILITIES_META_KEY, MISSING_REQUIRED_CLIENT_CAPABILITY_CODE, EXTENSION_NOT_DECLARED_REASON, ExtensionSettingsSchema, DEFAULT_EXTENSION_SETTINGS, parseExtensionSettings, resolveExtensionSettings, buildExtensionSettings, buildExtensionsEntry, } from './settings.js';
+export { readExtensionDeclaration, } from './declaration.js';
+export { KYA_OS_DOMAIN_ERROR_CODE, DEFAULT_EXEMPT_METHODS, requireExtension, missingRequiredCapabilityError, proofGateToJsonRpcError, } from './gate.js';
+//# sourceMappingURL=index.js.map

package/dist/extension/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/extension/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,uCAAuC,EACvC,6BAA6B,EAC7B,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,GAGrB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,wBAAwB,GAIzB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,gBAAgB,EAChB,8BAA8B,EAC9B,uBAAuB,GAKxB,MAAM,WAAW,CAAC"}

package/dist/extension/settings.d.ts

@@ -0,0 +1,70 @@
+/**
+ * KYA-OS MCP extension negotiation - identifiers and the settings object
+ * (SPEC-MCP-EXTENSION.md §1, §3; wire schema: `schemas/mcp-extension-settings.json`).
+ *
+ * The extension is declared under `capabilities.extensions["org.kya-os/decentralized-authority"]`
+ * as a small settings object. Per SEP-2133 an empty object means "supported, with
+ * default configuration". Every identifier lives here as a single constant
+ * (mirroring `KYA_OS_PROOF_META_KEY`), so a future re-pointing of the extension id
+ * (SEP-2133 graduation) is a constant change, never a call-site sweep.
+ */
+import { z } from 'zod';
+/** The proposed reverse-DNS MCP extension id (SPEC-MCP-EXTENSION.md §1.1). */
+export declare const KYA_OS_EXTENSION_ID = "org.kya-os/decentralized-authority";
+/** The per-request `_meta` key carrying MCP `ClientCapabilities` (SEP-2575, stateless carriage). */
+export declare const MCP_CLIENT_CAPABILITIES_META_KEY = "io.modelcontextprotocol/clientCapabilities";
+/** Core MCP `MissingRequiredClientCapabilityError` code (2026-07-28 error allocation policy). */
+export declare const MISSING_REQUIRED_CLIENT_CAPABILITY_CODE = -32021;
+/**
+ * The reason codes this extension defines itself (SPEC-MCP-EXTENSION.md §5.2),
+ * each riding the `data.reason` member of a core JSON-RPC error:
+ * `extension_not_declared` inside a `-32021` (required mode, no declaration) and
+ * `malformed_declaration` inside a `-32602` (required mode, a present-but-
+ * unparseable declaration). Every other reason code is defined by
+ * SPEC-ENTITY-CARD Appendix D or SPEC.md Appendix A.
+ */
+export declare const EXTENSION_NOT_DECLARED_REASON = "extension_not_declared";
+export declare const MALFORMED_DECLARATION_REASON = "malformed_declaration";
+/**
+ * Zod mirror of `schemas/mcp-extension-settings.json`: every member OPTIONAL,
+ * unknown members tolerated (and stripped on parse) for forward compatibility.
+ * `required` is meaningful only on a server declaration and ignored client-side
+ * (SPEC-MCP-EXTENSION.md §3.2).
+ */
+export declare const ExtensionSettingsSchema: z.ZodObject<{
+    version: z.ZodOptional<z.ZodString>;
+    proofProfiles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    didMethods: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    required: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+/** A declared (wire-shaped) settings object; all members optional, `{}` legal. */
+export type KyaOsExtensionSettings = z.infer<typeof ExtensionSettingsSchema>;
+/** Settings with every default applied (SPEC-MCP-EXTENSION.md §3.2 defaults column). */
+export interface ResolvedExtensionSettings {
+    version: string;
+    proofProfiles: string[];
+    didMethods: string[];
+    required: boolean;
+}
+/** The §3.2 defaults an empty declaration resolves to. */
+export declare const DEFAULT_EXTENSION_SETTINGS: ResolvedExtensionSettings;
+/**
+ * Parse a PEER's settings value. A malformed value returns `undefined` - the
+ * declaration is treated as ABSENT (fail closed to non-declaration, never a
+ * guess at intent; SPEC-MCP-EXTENSION.md §3.2). `{}` parses successfully.
+ */
+export declare function parseExtensionSettings(value: unknown): KyaOsExtensionSettings | undefined;
+/** Apply the §3.2 defaults to a declared settings object. */
+export declare function resolveExtensionSettings(settings?: KyaOsExtensionSettings): ResolvedExtensionSettings;
+/**
+ * Validate OWN settings before putting them on the wire. Unlike a peer's input
+ * (parsed fail-closed), malformed own settings are a programmer error and throw.
+ */
+export declare function buildExtensionSettings(settings?: KyaOsExtensionSettings): KyaOsExtensionSettings;
+/**
+ * Build the `extensions` map fragment - `{ "org.kya-os/decentralized-authority": settings }` -
+ * ready to merge into `ClientCapabilities.extensions` / `ServerCapabilities.extensions`
+ * (or the per-request `_meta` carriage; SPEC-MCP-EXTENSION.md §3.1).
+ */
+export declare function buildExtensionsEntry(settings?: KyaOsExtensionSettings, extensionId?: string): Record<string, KyaOsExtensionSettings>;
+//# sourceMappingURL=settings.d.ts.map

package/dist/extension/settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../src/extension/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,uCAAuC,CAAC;AAExE,oGAAoG;AACpG,eAAO,MAAM,gCAAgC,+CAA+C,CAAC;AAE7F,iGAAiG;AACjG,eAAO,MAAM,uCAAuC,SAAS,CAAC;AAE9D;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,2BAA2B,CAAC;AACtE,eAAO,MAAM,4BAA4B,0BAA0B,CAAC;AAOpE;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;iBAalC,CAAC;AAEH,kFAAkF;AAClF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE7E,wFAAwF;AACxF,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,0DAA0D;AAC1D,eAAO,MAAM,0BAA0B,EAAE,yBAKxC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,GAAG,SAAS,CAGzF;AAED,6DAA6D;AAC7D,wBAAgB,wBAAwB,CACtC,QAAQ,GAAE,sBAA2B,GACpC,yBAAyB,CAO3B;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,GAAE,sBAA2B,GACpC,sBAAsB,CAMxB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,GAAE,sBAA2B,EACrC,WAAW,GAAE,MAA4B,GACxC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAExC"}

package/dist/extension/settings.js

@@ -0,0 +1,96 @@
+/**
+ * KYA-OS MCP extension negotiation - identifiers and the settings object
+ * (SPEC-MCP-EXTENSION.md §1, §3; wire schema: `schemas/mcp-extension-settings.json`).
+ *
+ * The extension is declared under `capabilities.extensions["org.kya-os/decentralized-authority"]`
+ * as a small settings object. Per SEP-2133 an empty object means "supported, with
+ * default configuration". Every identifier lives here as a single constant
+ * (mirroring `KYA_OS_PROOF_META_KEY`), so a future re-pointing of the extension id
+ * (SEP-2133 graduation) is a constant change, never a call-site sweep.
+ */
+import { z } from 'zod';
+import { PROOF_PROFILE_ID } from '../card/schema.js';
+/** The proposed reverse-DNS MCP extension id (SPEC-MCP-EXTENSION.md §1.1). */
+export const KYA_OS_EXTENSION_ID = 'org.kya-os/decentralized-authority';
+/** The per-request `_meta` key carrying MCP `ClientCapabilities` (SEP-2575, stateless carriage). */
+export const MCP_CLIENT_CAPABILITIES_META_KEY = 'io.modelcontextprotocol/clientCapabilities';
+/** Core MCP `MissingRequiredClientCapabilityError` code (2026-07-28 error allocation policy). */
+export const MISSING_REQUIRED_CLIENT_CAPABILITY_CODE = -32021;
+/**
+ * The reason codes this extension defines itself (SPEC-MCP-EXTENSION.md §5.2),
+ * each riding the `data.reason` member of a core JSON-RPC error:
+ * `extension_not_declared` inside a `-32021` (required mode, no declaration) and
+ * `malformed_declaration` inside a `-32602` (required mode, a present-but-
+ * unparseable declaration). Every other reason code is defined by
+ * SPEC-ENTITY-CARD Appendix D or SPEC.md Appendix A.
+ */
+export const EXTENSION_NOT_DECLARED_REASON = 'extension_not_declared';
+export const MALFORMED_DECLARATION_REASON = 'malformed_declaration';
+const SEMVER = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/;
+const DID_METHOD = /^did:[a-z0-9]+$/;
+const unique = (values) => new Set(values).size === values.length;
+/**
+ * Zod mirror of `schemas/mcp-extension-settings.json`: every member OPTIONAL,
+ * unknown members tolerated (and stripped on parse) for forward compatibility.
+ * `required` is meaningful only on a server declaration and ignored client-side
+ * (SPEC-MCP-EXTENSION.md §3.2).
+ */
+export const ExtensionSettingsSchema = z.object({
+    version: z.string().regex(SEMVER, 'version must be a semver string').optional(),
+    proofProfiles: z
+        .array(z.string().min(1))
+        .min(1)
+        .refine(unique, 'proofProfiles must be unique')
+        .optional(),
+    didMethods: z
+        .array(z.string().regex(DID_METHOD, 'didMethods entries look like "did:web"'))
+        .min(1)
+        .refine(unique, 'didMethods must be unique')
+        .optional(),
+    required: z.boolean().optional(),
+});
+/** The §3.2 defaults an empty declaration resolves to. */
+export const DEFAULT_EXTENSION_SETTINGS = {
+    version: '1.0.0',
+    proofProfiles: [PROOF_PROFILE_ID],
+    didMethods: ['did:key', 'did:web'],
+    required: false,
+};
+/**
+ * Parse a PEER's settings value. A malformed value returns `undefined` - the
+ * declaration is treated as ABSENT (fail closed to non-declaration, never a
+ * guess at intent; SPEC-MCP-EXTENSION.md §3.2). `{}` parses successfully.
+ */
+export function parseExtensionSettings(value) {
+    const parsed = ExtensionSettingsSchema.safeParse(value);
+    return parsed.success ? parsed.data : undefined;
+}
+/** Apply the §3.2 defaults to a declared settings object. */
+export function resolveExtensionSettings(settings = {}) {
+    return {
+        version: settings.version ?? DEFAULT_EXTENSION_SETTINGS.version,
+        proofProfiles: settings.proofProfiles ?? [...DEFAULT_EXTENSION_SETTINGS.proofProfiles],
+        didMethods: settings.didMethods ?? [...DEFAULT_EXTENSION_SETTINGS.didMethods],
+        required: settings.required ?? DEFAULT_EXTENSION_SETTINGS.required,
+    };
+}
+/**
+ * Validate OWN settings before putting them on the wire. Unlike a peer's input
+ * (parsed fail-closed), malformed own settings are a programmer error and throw.
+ */
+export function buildExtensionSettings(settings = {}) {
+    const parsed = ExtensionSettingsSchema.safeParse(settings);
+    if (!parsed.success) {
+        throw new Error(`invalid ${KYA_OS_EXTENSION_ID} settings: ${parsed.error.message}`);
+    }
+    return parsed.data;
+}
+/**
+ * Build the `extensions` map fragment - `{ "org.kya-os/decentralized-authority": settings }` -
+ * ready to merge into `ClientCapabilities.extensions` / `ServerCapabilities.extensions`
+ * (or the per-request `_meta` carriage; SPEC-MCP-EXTENSION.md §3.1).
+ */
+export function buildExtensionsEntry(settings = {}, extensionId = KYA_OS_EXTENSION_ID) {
+    return { [extensionId]: buildExtensionSettings(settings) };
+}
+//# sourceMappingURL=settings.js.map

package/dist/extension/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../src/extension/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,oCAAoC,CAAC;AAExE,oGAAoG;AACpG,MAAM,CAAC,MAAM,gCAAgC,GAAG,4CAA4C,CAAC;AAE7F,iGAAiG;AACjG,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,KAAK,CAAC;AAE9D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,wBAAwB,CAAC;AACtE,MAAM,CAAC,MAAM,4BAA4B,GAAG,uBAAuB,CAAC;AAEpE,MAAM,MAAM,GAAG,mCAAmC,CAAC;AACnD,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAErC,MAAM,MAAM,GAAG,CAAC,MAAyB,EAAW,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC;AAE9F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC,QAAQ,EAAE;IAC/E,aAAa,EAAE,CAAC;SACb,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC;SACN,MAAM,CAAC,MAAM,EAAE,8BAA8B,CAAC;SAC9C,QAAQ,EAAE;IACb,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,wCAAwC,CAAC,CAAC;SAC7E,GAAG,CAAC,CAAC,CAAC;SACN,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC;SAC3C,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAaH,0DAA0D;AAC1D,MAAM,CAAC,MAAM,0BAA0B,GAA8B;IACnE,OAAO,EAAE,OAAO;IAChB,aAAa,EAAE,CAAC,gBAAgB,CAAC;IACjC,UAAU,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;IAClC,QAAQ,EAAE,KAAK;CAChB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,wBAAwB,CACtC,WAAmC,EAAE;IAErC,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,0BAA0B,CAAC,OAAO;QAC/D,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,CAAC,GAAG,0BAA0B,CAAC,aAAa,CAAC;QACtF,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,CAAC,GAAG,0BAA0B,CAAC,UAAU,CAAC;QAC7E,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,0BAA0B,CAAC,QAAQ;KACnE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAmC,EAAE;IAErC,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,WAAW,mBAAmB,cAAc,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmC,EAAE,EACrC,cAAsB,mBAAmB;IAEzC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7D,CAAC"}

package/dist/index.d.ts

@@ -4,7 +4,7 @@
  * Delegation, proof, and session for Model Context Protocol Identity.
  * This package is a DIF TAAWG protocol reference implementation.
  *
- * Related Spec: https://kya-os.ai/mcp
+ * Related Spec: https://kya-os.org/mcp
  *
  * ## Error handling strategy
  *
@@ -38,7 +38,7 @@ export { buildDidResolverRegistry, type DIDResolverFactory, type DIDResolverRegi
 export { base58Encode, base58Decode, isValidBase58, } from './utils/base58.js';
 export { isValidDid, getDidMethod, normalizeDid, compareDids, getServerDid, extractAgentId, extractAgentSlug, generateDidKeyFromBytes, generateDidKeyFromBase64, didKeyFragment, } from './utils/did-helpers.js';
 export { verifyOrHints, hasSensitiveScopes, MemoryResumeTokenStore, type AuthHandshakeConfig, type VerifyOrHintsResult, type AgentReputation, type ResumeTokenStore, type UnknownAgentPolicy, type DelegationVerifier, type VerifyDelegationResult, } from './auth/index.js';
-export { ProofGenerator, createProofResponse, extractCanonicalData, KYA_OS_PROOF_META_KEY, LEGACY_PROOF_META_KEY, type ProofAgentIdentity, type ToolRequest, type ToolResponse, type ProofOptions, } from './proof/index.js';
+export { ProofGenerator, createProofResponse, extractCanonicalData, KYA_OS_PROOF_META_KEY, LEGACY_NAMESPACED_PROOF_META_KEY, LEGACY_PROOF_META_KEY, type ProofAgentIdentity, type ToolRequest, type ToolResponse, type ProofOptions, } from './proof/index.js';
 export { ProofVerifier, validateMetaStructure, extractProofFromMeta, isReservedMcpMetaKey, DEFAULT_CLOCK_SKEW_SECONDS, MIN_CLOCK_SKEW_SECONDS, MAX_CLOCK_SKEW_SECONDS, type ProofVerifierConfig, type ProofVerificationResult, } from './proof/verifier.js';
 export { ProofVerificationError, PROOF_VERIFICATION_ERROR_CODES, createProofVerificationError, type ProofVerificationErrorCode, } from './proof/errors.js';
 export { SessionManager, createHandshakeRequest, validateHandshakeFormat, SessionStore, MemorySessionStore, type SessionConfig, type HandshakeResult, type MemorySessionStoreOptions, } from './session/index.js';
@@ -48,6 +48,7 @@ export { NodeCryptoProvider } from './providers/node-crypto.js';
 export { SystemClockProvider } from './providers/system-clock.js';
 export { RuntimeFetchProvider, NoopFetchProvider } from './providers/runtime-fetch.js';
 export { AuditLogProvider, MemoryAuditLogProvider, NoopAuditLogProvider, buildAuditRecord, } from './providers/audit-log.js';
+export * from './audit/index.js';
 export { GrantStore, MemoryGrantStore, type Grant, type MemoryGrantStoreOptions, } from './providers/grant-store.js';
 export { PendingFlowStore, MemoryPendingFlowStore, type PendingFlow, type MemoryPendingFlowStoreOptions, } from './authz/oidc/pending-flow-store.js';
 export { createKyaOsMiddleware, type KyaOsConfig, type KyaOsDelegationConfig, type KyaOsIdentityConfig, type KyaOsMiddleware, type KyaOsToolDefinition, type KyaOsToolHandler, type KyaOsServer, withKyaOs, generateIdentity, type WithKyaOsOptions, } from './middleware/index.js';
@@ -55,4 +56,5 @@ export * from './policy/index.js';
 export { matchScope, scopeSatisfies, type ScopeMatcher, type ScopeSatisfaction, } from './delegation/scope-matcher.js';
 export { logger, createDefaultConsoleLogger, type Logger, type Level, } from './logging/index.js';
 export { ED25519_PKCS8_DER_HEADER, ED25519_SPKI_DER_HEADER_LENGTH, ED25519_KEY_SIZE, } from './utils/index.js';
+export { KYA_OS_EXTENSION_ID, MCP_CLIENT_CAPABILITIES_META_KEY, MISSING_REQUIRED_CLIENT_CAPABILITY_CODE, EXTENSION_NOT_DECLARED_REASON, KYA_OS_DOMAIN_ERROR_CODE, DEFAULT_EXEMPT_METHODS, ExtensionSettingsSchema, DEFAULT_EXTENSION_SETTINGS, parseExtensionSettings, resolveExtensionSettings, buildExtensionSettings, buildExtensionsEntry, readExtensionDeclaration, requireExtension, missingRequiredCapabilityError, proofGateToJsonRpcError, type KyaOsExtensionSettings, type ResolvedExtensionSettings, type DeclarationCarriage, type ExtensionDeclaration, type ReadDeclarationInput, type ExtensionGateResult, type ExtensionGuard, type JsonRpcErrorObject, type ProofGateErrorLike, } from './extension/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAC;AAG3B,YAAY,EACV,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,EACL,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,SAAS,EACT,eAAe,EACf,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,UAAU,GACX,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,UAAU,GAChB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,IAAI,0BAA0B,GACpD,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,KAAK,8BAA8B,EACnC,KAAK,aAAa,EAClB,KAAK,yBAAyB,EAC9B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,GACnC,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,cAAc,EACnB,KAAK,8BAA8B,GACpC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,GAChC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,EAChC,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,0BAA0B,GAChC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,GAC/B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAE5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAE5F,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,GAC7B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,uCAAuC,CAAC;AAG/C,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,EAC5B,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,yBAAyB,GAC/B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,KAAK,KAAK,EACV,KAAK,uBAAuB,GAC7B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,KAAK,WAAW,EAChB,KAAK,6BAA6B,GACnC,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EACL,qBAAqB,EACrB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,SAAS,EACT,gBAAgB,EAChB,KAAK,gBAAgB,GACtB,MAAM,uBAAuB,CAAC;AAG/B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,iBAAiB,GACvB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,MAAM,EACN,0BAA0B,EAC1B,KAAK,MAAM,EACX,KAAK,KAAK,GACX,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAC;AAG3B,YAAY,EACV,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,EACL,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,SAAS,EACT,eAAe,EACf,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,UAAU,GACX,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,UAAU,GAChB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,IAAI,0BAA0B,GACpD,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,KAAK,8BAA8B,EACnC,KAAK,aAAa,EAClB,KAAK,yBAAyB,EAC9B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,GACnC,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,cAAc,EACnB,KAAK,8BAA8B,GACpC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,GAChC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,EAChC,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,0BAA0B,GAChC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,GAC/B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAE5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAE5F,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,GAC7B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,uCAAuC,CAAC;AAG/C,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,gCAAgC,EAChC,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,EAC5B,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,yBAAyB,GAC/B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAGlC,cAAc,kBAAkB,CAAC;AAIjC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,KAAK,KAAK,EACV,KAAK,uBAAuB,GAC7B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,KAAK,WAAW,EAChB,KAAK,6BAA6B,GACnC,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EACL,qBAAqB,EACrB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,SAAS,EACT,gBAAgB,EAChB,KAAK,gBAAgB,GACtB,MAAM,uBAAuB,CAAC;AAG/B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,iBAAiB,GACvB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,MAAM,EACN,0BAA0B,EAC1B,KAAK,MAAM,EACX,KAAK,KAAK,GACX,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,uCAAuC,EACvC,6BAA6B,EAC7B,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,gBAAgB,EAChB,8BAA8B,EAC9B,uBAAuB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,sBAAsB,CAAC"}