@kya-os/mcp 1.10.1 → 1.12.0

package/dist/middleware/with-kya-os.policy-gate.js

@@ -15,7 +15,7 @@ import { isKyaOsControlArg } from "../delegation/holder-binding.js";
 import { KYA_OS_ERROR_CODES } from "../errors.js";
 import { sanitizeForMessage, extractPolicyPrincipal } from "./with-kya-os.helpers.js";
 export function createPolicyGate(deps, wiring) {
-    const { proofGenerator } = deps;
+    const { proofGenerator, audit } = deps;
     const { attachOutcomeProof } = wiring;
     const defaultRiskClassifier = new RiskClassifier();
     const defaultPolicyEngine = new DefaultPolicyEngine();
@@ -24,7 +24,7 @@ export function createPolicyGate(deps, wiring) {
         const classifier = opts.classifier ?? defaultRiskClassifier;
         const approvalsKey = opts.approvalsArgKey ?? "_kyaos_approvals";
         const isValidApprovalSignature = opts.isValidApprovalSignature ?? (async () => false);
-        return async (args, sessionId) => {
+        return async (args, sessionId, context) => {
             // Drop the reserved _kyaos* namespace plus the (possibly custom) approvals
             // key, so no control arg reaches the handler.
             const cleanArgs = {};
@@ -49,8 +49,29 @@ export function createPolicyGate(deps, wiring) {
                 risk,
             });
             const decision = await engine.evaluate(policyRequest);
+            const auditContext = context === undefined ? undefined : {
+                ...(context.actor === undefined ? {} : { actor: context.actor }),
+                ...(context.responsibleParty === undefined
+                    ? {}
+                    : { responsibleParty: context.responsibleParty }),
+                ...(context.authorization === undefined
+                    ? {}
+                    : { authorization: context.authorization }),
+            };
+            await audit?.authorization('evaluated', {
+                outcome: decision.decision === 'allow' ? 'succeeded'
+                    : decision.decision === 'deny' ? 'denied' : 'challenged',
+                reasonCode: decision.decision === 'allow'
+                    ? undefined
+                    : decision.decision === 'deny' ? 'POLICY_DENIED' : 'POLICY_STEP_UP',
+                context: auditContext,
+            });
             if (decision.decision === "allow") {
-                return handler(cleanArgs, sessionId);
+                await audit?.authorization('approved', {
+                    outcome: 'succeeded',
+                    context: auditContext,
+                });
+                return handler(cleanArgs, sessionId, context);
             }
             if (decision.decision === "deny") {
                 const denied = {
@@ -77,7 +98,11 @@ export function createPolicyGate(deps, wiring) {
                 : [];
             const quorumResult = await verifyApprovalQuorum(grants, requestHash, decision.quorum, isValidApprovalSignature);
             if (quorumResult.satisfied) {
-                return handler(cleanArgs, sessionId);
+                await audit?.authorization('approved', {
+                    outcome: 'succeeded',
+                    context: auditContext,
+                });
+                return handler(cleanArgs, sessionId, context);
             }
             const needsApproval = createNeedsApprovalError({
                 message: `Tool "${toolName}" requires ${decision.quorum.n}-of-N approval before it may proceed (${sanitizeForMessage(decision.reason)}).`,

package/dist/middleware/with-kya-os.policy-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.policy-gate.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.policy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAsB,MAAM,uBAAuB,CAAC;AAEjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOlD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAOtF,MAAM,UAAU,gBAAgB,CAC9B,IAAoB,EACpB,MAAwB;IAExB,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC;IAEtC,MAAM,qBAAqB,GAAG,IAAI,cAAc,EAAE,CAAC;IACnD,MAAM,mBAAmB,GAAiB,IAAI,mBAAmB,EAAE,CAAC;IAEpE,SAAS,cAAc,CACrB,QAAgB,EAChB,OAAyB,EACzB,OAA0B,EAAE;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,qBAAqB,CAAC;QAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,IAAI,kBAAkB,CAAC;QAChE,MAAM,wBAAwB,GAC5B,IAAI,CAAC,wBAAwB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;QAEvD,OAAO,KAAK,EAAE,IAA6B,EAAE,SAAkB,EAAE,EAAE;YACjE,2EAA2E;YAC3E,8CAA8C;YAC9C,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,YAAY;oBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;YAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAEpE,MAAM,aAAa,GAAG,kBAAkB,CAAC;gBACvC,SAAS,EAAE;oBACT,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,GAAG,CAAC,SAAS,CAAC,gBAAgB;wBAC5B,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE;wBAClD,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,MAAM,EAAE,EAAE,QAAQ,EAAE;gBACpB,QAAQ,EAAE,EAAE,SAAS,EAAE;gBACvB,eAAe,EAAE,SAAS,CAAC,eAAe;gBAC1C,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,KAAK;gBACxC,IAAI;aACL,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YAEtD,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAClC,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACvC,CAAC;YAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACjC,MAAM,MAAM,GAA0C;oBACpD,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACnB,KAAK,EAAE,kBAAkB,CAAC,aAAa;gCACvC,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC;6BAC5C,CAAC;yBACH;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;gBACF,OAAO,kBAAkB,CACvB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,QAAQ,EACR,SAAS,CACV,CAAC;YACJ,CAAC;YAED,4EAA4E;YAC5E,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC;gBACnD,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC9C,CAAC,CAAE,IAAI,CAAC,YAAY,CAAqB;gBACzC,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAC7C,MAAM,EACN,WAAW,EACX,QAAQ,CAAC,MAAM,EACf,wBAAwB,CACzB,CAAC;YACF,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;gBAC3B,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACvC,CAAC;YAED,MAAM,aAAa,GAAG,wBAAwB,CAAC;gBAC7C,OAAO,EAAE,SAAS,QAAQ,cAAc,QAAQ,CAAC,MAAM,CAAC,CAAC,yCAAyC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI;gBACzI,WAAW,EAAE,WAAW,WAAW,EAAE;gBACrC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;gBAC9C,WAAW;gBACX,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;YACH,MAAM,MAAM,GAA0C;gBACpD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;gBAChE,OAAO,EAAE,IAAI;aACd,CAAC;YACF,OAAO,kBAAkB,CACvB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,kBAAkB,EAClB,SAAS,CACV,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"with-kya-os.policy-gate.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.policy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAsB,MAAM,uBAAuB,CAAC;AAEjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAQlD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAOtF,MAAM,UAAU,gBAAgB,CAC9B,IAAoB,EACpB,MAAwB;IAExB,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC;IAEtC,MAAM,qBAAqB,GAAG,IAAI,cAAc,EAAE,CAAC;IACnD,MAAM,mBAAmB,GAAiB,IAAI,mBAAmB,EAAE,CAAC;IAEpE,SAAS,cAAc,CACrB,QAAgB,EAChB,OAAyB,EACzB,OAA0B,EAAE;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,qBAAqB,CAAC;QAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,IAAI,kBAAkB,CAAC;QAChE,MAAM,wBAAwB,GAC5B,IAAI,CAAC,wBAAwB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;QAEvD,OAAO,KAAK,EACV,IAA6B,EAC7B,SAAkB,EAClB,OAA0B,EAC1B,EAAE;YACF,2EAA2E;YAC3E,8CAA8C;YAC9C,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,YAAY;oBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;YAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAEpE,MAAM,aAAa,GAAG,kBAAkB,CAAC;gBACvC,SAAS,EAAE;oBACT,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,GAAG,CAAC,SAAS,CAAC,gBAAgB;wBAC5B,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE;wBAClD,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,MAAM,EAAE,EAAE,QAAQ,EAAE;gBACpB,QAAQ,EAAE,EAAE,SAAS,EAAE;gBACvB,eAAe,EAAE,SAAS,CAAC,eAAe;gBAC1C,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,KAAK;gBACxC,IAAI;aACL,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YAEtD,MAAM,YAAY,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;gBACvD,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChE,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBACnD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;aAC9C,CAAC;YACF,MAAM,KAAK,EAAE,aAAa,CAAC,WAAW,EAAE;gBACtC,OAAO,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW;oBAClD,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;gBAC1D,UAAU,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO;oBACvC,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB;gBACrE,OAAO,EAAE,YAAY;aACtB,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAClC,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;oBACrC,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACjC,MAAM,MAAM,GAA0C;oBACpD,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACnB,KAAK,EAAE,kBAAkB,CAAC,aAAa;gCACvC,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC;6BAC5C,CAAC;yBACH;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;gBACF,OAAO,kBAAkB,CACvB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,QAAQ,EACR,SAAS,CACV,CAAC;YACJ,CAAC;YAED,4EAA4E;YAC5E,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC;gBACnD,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC9C,CAAC,CAAE,IAAI,CAAC,YAAY,CAAqB;gBACzC,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAC7C,MAAM,EACN,WAAW,EACX,QAAQ,CAAC,MAAM,EACf,wBAAwB,CACzB,CAAC;YACF,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;oBACrC,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,aAAa,GAAG,wBAAwB,CAAC;gBAC7C,OAAO,EAAE,SAAS,QAAQ,cAAc,QAAQ,CAAC,MAAM,CAAC,CAAC,yCAAyC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI;gBACzI,WAAW,EAAE,WAAW,WAAW,EAAE;gBACrC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;gBAC9C,WAAW;gBACX,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;YACH,MAAM,MAAM,GAA0C;gBACpD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;gBAChE,OAAO,EAAE,IAAI;aACd,CAAC;YACF,OAAO,kBAAkB,CACvB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,kBAAkB,EAClB,SAAS,CACV,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,CAAC;AAC5B,CAAC"}

package/dist/middleware/with-kya-os.protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.protocol.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,KAAK,gBAAgB,GAAG;IACtB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC3E;AAED,MAAM,WAAW,QAAQ;IACvB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtE,aAAa,EAAE,mBAAmB,CAAC;IACnC,SAAS,EAAE,mBAAmB,CAAC;CAChC;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,cAAc,GACrB,QAAQ,CA2HV"}
+{"version":3,"file":"with-kya-os.protocol.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,KAAK,gBAAgB,GAAG;IACtB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC3E;AAED,MAAM,WAAW,QAAQ;IACvB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtE,aAAa,EAAE,mBAAmB,CAAC;IACnC,SAAS,EAAE,mBAAmB,CAAC;CAChC;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,cAAc,GACrB,QAAQ,CAqIV"}

package/dist/middleware/with-kya-os.protocol.js

@@ -57,6 +57,15 @@ export function createProtocol(deps, wiring) {
         },
     };
     async function handleIdentity() {
+        const auditAssurance = config.audit !== undefined && config.audit !== false
+            ? {
+                enabled: true,
+                profile: config.audit.capabilities?.profile ?? config.audit.auditProfile ?? 'AAP-0',
+                ...(config.audit.capabilities === undefined
+                    ? {}
+                    : { capabilities: config.audit.capabilities }),
+            }
+            : { enabled: false, profile: 'AAP-0' };
         return {
             content: [
                 {
@@ -68,6 +77,7 @@ export function createProtocol(deps, wiring) {
                         capabilities: ["handshake", "signing", "verification"],
                         protocolVersion: "1.0.0",
                         clockSkewSeconds: sessionManager.getStats().config.timestampSkewSeconds,
+                        auditAssurance,
                     }),
                 },
             ],

package/dist/middleware/with-kya-os.protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.protocol.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EACL,cAAc,GAGf,MAAM,wBAAwB,CAAC;AAmBhC,MAAM,UAAU,cAAc,CAC5B,IAAoB,EACpB,MAAsB;IAEtB,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAClD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAEnC,MAAM,aAAa,GAAwB;QACzC,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,iEAAiE;QACnE,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,+BAA+B,EAAE;gBACvE,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,uCAAuC;iBACrD;gBACD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE;gBAChE,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,6BAA6B;iBAC3C;aACF;YACD,QAAQ,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC;SAC7C;KACF,CAAC;IAEF,MAAM,SAAS,GAAwB;QACrC,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,iFAAiF;QACnF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,cAAc,CAAC;oBACzB,WAAW,EAAE,+BAA+B;iBAC7C;gBACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,+BAA+B,EAAE;gBACvE,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,uCAAuC;iBACrD;gBACD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE;gBAChE,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,6BAA6B;iBAC3C;aACF;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB;KACF,CAAC;IAEF,KAAK,UAAU,cAAc;QAC3B,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,GAAG,EAAE,QAAQ,CAAC,GAAG;wBACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;wBACjB,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,GAAG;wBAC/C,YAAY,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,cAAc,CAAC;wBACtD,eAAe,EAAE,OAAO;wBACxB,gBAAgB,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,oBAAoB;qBACxE,CAAC;iBACH;aACF;SACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,WAAW,CACxB,IAA6B;QAE7B,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;YAC7B,CAAC,CAAE,IAAI,CAAC,MAAsB;YAC9B,CAAC,CAAC,SAAS,CAAC;QAEhB,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,WAAW;gBACd,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;YAE/B,KAAK,UAAU;gBACb,OAAO,cAAc,EAAE,CAAC;YAE1B,KAAK,YAAY;gBACf,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACnB,OAAO,EAAE,KAAK;gCACd,KAAK,EAAE;oCACL,IAAI,EAAE,kBAAkB,CAAC,aAAa;oCACtC,OAAO,EAAE,8CAA8C;iCACxD;6BACF,CAAC;yBACH;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;YAEJ;gBACE,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACnB,OAAO,EAAE,KAAK;gCACd,KAAK,EAAE;oCACL,IAAI,EAAE,kBAAkB,CAAC,eAAe;oCACxC,OAAO,EAAE,2BAA2B,MAAM,IAAI,WAAW,qBAAqB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iCAC1G;6BACF,CAAC;yBACH;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;QACN,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC"}
+{"version":3,"file":"with-kya-os.protocol.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EACL,cAAc,GAGf,MAAM,wBAAwB,CAAC;AAmBhC,MAAM,UAAU,cAAc,CAC5B,IAAoB,EACpB,MAAsB;IAEtB,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAClD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAEnC,MAAM,aAAa,GAAwB;QACzC,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,iEAAiE;QACnE,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,+BAA+B,EAAE;gBACvE,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,uCAAuC;iBACrD;gBACD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE;gBAChE,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,6BAA6B;iBAC3C;aACF;YACD,QAAQ,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC;SAC7C;KACF,CAAC;IAEF,MAAM,SAAS,GAAwB;QACrC,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,iFAAiF;QACnF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,cAAc,CAAC;oBACzB,WAAW,EAAE,+BAA+B;iBAC7C;gBACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,+BAA+B,EAAE;gBACvE,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,uCAAuC;iBACrD;gBACD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE;gBAChE,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,6BAA6B;iBAC3C;aACF;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB;KACF,CAAC;IAEF,KAAK,UAAU,cAAc;QAC3B,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;YACzE,CAAC,CAAC;gBACE,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,OAAO;gBACnF,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS;oBACzC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;aACjD;YACH,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACzC,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,GAAG,EAAE,QAAQ,CAAC,GAAG;wBACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;wBACjB,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,GAAG;wBAC/C,YAAY,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,cAAc,CAAC;wBACtD,eAAe,EAAE,OAAO;wBACxB,gBAAgB,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,oBAAoB;wBACvE,cAAc;qBACf,CAAC;iBACH;aACF;SACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,WAAW,CACxB,IAA6B;QAE7B,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;YAC7B,CAAC,CAAE,IAAI,CAAC,MAAsB;YAC9B,CAAC,CAAC,SAAS,CAAC;QAEhB,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,WAAW;gBACd,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;YAE/B,KAAK,UAAU;gBACb,OAAO,cAAc,EAAE,CAAC;YAE1B,KAAK,YAAY;gBACf,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACnB,OAAO,EAAE,KAAK;gCACd,KAAK,EAAE;oCACL,IAAI,EAAE,kBAAkB,CAAC,aAAa;oCACtC,OAAO,EAAE,8CAA8C;iCACxD;6BACF,CAAC;yBACH;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;YAEJ;gBACE,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACnB,OAAO,EAAE,KAAK;gCACd,KAAK,EAAE;oCACL,IAAI,EAAE,kBAAkB,CAAC,eAAe;oCACxC,OAAO,EAAE,2BAA2B,MAAM,IAAI,WAAW,qBAAqB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iCAC1G;6BACF,CAAC;yBACH;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;QACN,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC"}

package/dist/middleware/with-kya-os.session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.session.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.session.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgBH,OAAO,KAAK,EACV,gBAAgB,EAEjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAGhF,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;IACH;;;;OAIG;IACH,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,gFAAgF;IAChF,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvE,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAC3B,gBAAgB,CAAC;IACpB,8EAA8E;IAC9E,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,YAAY,CAsPrE"}
+{"version":3,"file":"with-kya-os.session.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.session.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgBH,OAAO,KAAK,EACV,gBAAgB,EAEjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAIhF,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;IACH;;;;OAIG;IACH,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,gFAAgF;IAChF,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvE,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAC3B,gBAAgB,CAAC;IACpB,8EAA8E;IAC9E,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,YAAY,CAgjBrE"}

package/dist/middleware/with-kya-os.session.js

@@ -13,7 +13,80 @@ import { logger } from "../logging/index.js";
 import { KYA_OS_ERROR_CODES } from "../errors.js";
 import { sanitizeForMessage } from "./with-kya-os.helpers.js";
 export function createSessionProof(deps) {
-    const { identity, config, cryptoProvider, sessionManager, proofGenerator, auditLog, emitLegacyProofKey, } = deps;
+    const { identity, config, cryptoProvider, sessionManager, proofGenerator, auditLog, audit, emitLegacyProofKey, } = deps;
+    const auditedTerminalResponses = new WeakSet();
+    const auditMetaKey = 'org.kya-os/audit';
+    const emitAudit = async (label, operation, toolName) => {
+        try {
+            await operation();
+            return true;
+        }
+        catch (error) {
+            logger.error(`[kya-os] ${label}`, {
+                ...(toolName === undefined ? {} : { tool: toolName }),
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return false;
+        }
+    };
+    const markAuditDegraded = (response, reason, stripSuccessProof) => {
+        const metadata = {
+            ...(response._meta ?? {}),
+        };
+        if (stripSuccessProof) {
+            delete metadata[KYA_OS_PROOF_META_KEY];
+            delete metadata[LEGACY_PROOF_META_KEY];
+        }
+        metadata[auditMetaKey] = {
+            ...(typeof metadata[auditMetaKey] === 'object' && metadata[auditMetaKey] !== null
+                ? metadata[auditMetaKey]
+                : {}),
+            status: 'degraded',
+            reason,
+        };
+        response._meta = metadata;
+        response.isError = true;
+        return response;
+    };
+    const auditUnavailableResponse = (reason) => ({
+        content: [{
+                type: 'text',
+                text: JSON.stringify({
+                    success: false,
+                    error: { code: 'audit_delivery_failed', message: reason },
+                }),
+            }],
+        isError: true,
+        _meta: { [auditMetaKey]: { status: 'degraded', reason } },
+    });
+    // In-process trust boundary: handlers run inside the same process as this
+    // middleware, so a handler can set the terminal marker on its own error
+    // responses to take over terminal-outcome auditing. The marker is not a
+    // defense against untrusted handler code; it only prevents double-auditing
+    // by cooperating code paths.
+    const hasTerminalAuditMarker = (response) => {
+        if (auditedTerminalResponses.has(response))
+            return true;
+        const metadata = response._meta;
+        const auditMetadata = metadata?.[auditMetaKey];
+        return typeof auditMetadata === 'object' && auditMetadata !== null &&
+            auditMetadata.terminal === true;
+    };
+    const auditContext = (context) => context === undefined
+        ? undefined
+        : {
+            ...(context.actor === undefined ? {} : { actor: context.actor }),
+            ...(context.responsibleParty === undefined
+                ? {}
+                : { responsibleParty: context.responsibleParty }),
+            ...(context.authorization === undefined
+                ? {}
+                : { authorization: context.authorization }),
+            ...(context.correlationId === undefined
+                ? {}
+                : { correlationId: context.correlationId }),
+            ...(context.causationId === undefined ? {} : { causationId: context.causationId }),
+        };
     /**
      * Place a detached proof into a `_meta` object: always under the namespaced
      * key, and (when {@link emitLegacyProofKey}) mirrored under the legacy bare
@@ -32,6 +105,10 @@ export function createSessionProof(deps) {
     let activeSessionId;
     async function handleHandshake(args) {
         if (!validateHandshakeFormat(args)) {
+            await emitAudit('Failed to record rejected session audit event', () => audit?.session('rejected', {
+                succeeded: false,
+                reasonCode: KYA_OS_ERROR_CODES.handshake_failed,
+            }));
             return {
                 content: [
                     {
@@ -49,6 +126,19 @@ export function createSessionProof(deps) {
             };
         }
         const result = await sessionManager.validateHandshake(args);
+        const auditPhase = result.success
+            ? 'established'
+            : result.error?.code === KYA_OS_ERROR_CODES.nonce_replay
+                ? 'replay_rejected'
+                : 'rejected';
+        const sessionAuditDelivered = await emitAudit(`Failed to record ${auditPhase} session audit event`, () => audit?.session(auditPhase, {
+            succeeded: result.success,
+            ...(result.error === undefined ? {} : { reasonCode: result.error.code }),
+        }));
+        if (result.success && !sessionAuditDelivered) {
+            const failed = auditUnavailableResponse('Required session audit delivery failed after handshake validation');
+            return { content: failed.content, isError: true };
+        }
         // Cache the established session as the single-process fallback for callers
         // that do not thread a sessionId (e.g. the transport auto-proof path).
         if (result.success && result.session) {
@@ -105,17 +195,74 @@ export function createSessionProof(deps) {
     }
     function wrapWithProof(toolName, handler) {
         return async (args, sessionId, context) => {
-            const result = await handler(args, sessionId, context);
+            const intentDelivered = await emitAudit('Required tool intent audit delivery failed', () => audit?.tool('started', {
+                toolName,
+                outcome: 'unknown',
+                context: auditContext(context),
+            }), toolName);
+            if (!intentDelivered) {
+                return auditUnavailableResponse('Required intent audit delivery failed before tool execution');
+            }
+            let result;
+            try {
+                result = await handler(args, sessionId, context);
+            }
+            catch (error) {
+                await emitAudit('Failed to record thrown tool outcome; preserving original handler error', () => audit?.tool('failed', {
+                    toolName,
+                    outcome: 'failed',
+                    reasonCode: 'HANDLER_THROWN',
+                    context: auditContext(context),
+                }), toolName);
+                throw error;
+            }
             if (result.isError) {
+                if (!hasTerminalAuditMarker(result)) {
+                    const delivered = await emitAudit('Failed to record error tool outcome', () => audit?.tool('failed', {
+                        toolName,
+                        outcome: 'failed',
+                        reasonCode: 'HANDLER_ERROR_RESULT',
+                        context: auditContext(context),
+                    }), toolName);
+                    if (!delivered) {
+                        markAuditDegraded(result, 'Required terminal audit delivery failed for an error response', false);
+                    }
+                }
                 return result;
             }
             // Resolve session: explicit param → active session → auto-create
             const resolvedSessionId = sessionId ?? await ensureSession();
             if (!resolvedSessionId) {
+                const proofAuditDelivered = await emitAudit('Failed to record unavailable proof session', () => audit?.proof('rejected', {
+                    outcome: 'failed',
+                    verificationCode: 'PROOF_SESSION_UNAVAILABLE',
+                    context: auditContext(context),
+                }), toolName);
+                const terminalAuditDelivered = proofAuditDelivered && await emitAudit('Failed to record completed tool outcome', () => audit?.tool('completed', {
+                    toolName,
+                    outcome: 'succeeded',
+                    context: auditContext(context),
+                }), toolName);
+                if (!terminalAuditDelivered) {
+                    return markAuditDegraded(result, 'Required terminal audit delivery failed after tool completion', true);
+                }
                 return result;
             }
             const session = await sessionManager.getSession(resolvedSessionId);
             if (!session) {
+                const proofAuditDelivered = await emitAudit('Failed to record missing proof session', () => audit?.proof('rejected', {
+                    outcome: 'failed',
+                    verificationCode: 'PROOF_SESSION_NOT_FOUND',
+                    context: auditContext(context),
+                }), toolName);
+                const terminalAuditDelivered = proofAuditDelivered && await emitAudit('Failed to record completed tool outcome', () => audit?.tool('completed', {
+                    toolName,
+                    outcome: 'succeeded',
+                    context: auditContext(context),
+                }), toolName);
+                if (!terminalAuditDelivered) {
+                    return markAuditDegraded(result, 'Required terminal audit delivery failed after tool completion', true);
+                }
                 return result;
             }
             try {
@@ -126,6 +273,18 @@ export function createSessionProof(deps) {
                 // Inspector, invisible to LLMs), plus the legacy bare key when enabled.
                 // Other _meta keys may coexist (SEP-414).
                 result._meta = withProofMeta({}, proof);
+                const proofAuditDelivered = await emitAudit('Required generated-proof audit delivery failed', () => audit?.proof('generated', {
+                    outcome: 'succeeded',
+                    context: auditContext(context),
+                }), toolName);
+                const terminalAuditDelivered = proofAuditDelivered && await emitAudit('Required completed-tool audit delivery failed', () => audit?.tool('completed', {
+                    toolName,
+                    outcome: 'succeeded',
+                    context: auditContext(context),
+                }), toolName);
+                if (!terminalAuditDelivered) {
+                    return markAuditDegraded(result, 'Required terminal audit delivery failed after tool completion', true);
+                }
                 // Hand the verified call to the audit sink. A sink failure MUST NOT
                 // break the tool response, so it is logged and swallowed.
                 try {
@@ -155,11 +314,46 @@ export function createSessionProof(deps) {
                 result._meta = {
                     proofError: "Proof generation failed — response is unproven",
                 };
+                const rejectionAuditDelivered = await emitAudit('Failed to record proof-generation rejection', () => audit?.proof('rejected', {
+                    outcome: 'failed',
+                    verificationCode: 'PROOF_GENERATION_FAILED',
+                    context: auditContext(context),
+                }), toolName);
+                if (!rejectionAuditDelivered) {
+                    markAuditDegraded(result, 'Required proof-failure audit delivery failed after tool completion', true);
+                }
             }
             return result;
         };
     }
     const attachOutcomeProof = async (response, toolName, args, sessionId, reason, outcome = "denied", paramsOverride, responseData) => {
+        const phase = outcome === 'denied' ? 'denied' : 'step_up_required';
+        const reasonCode = outcome === 'needs_authorization'
+            ? 'NEEDS_AUTHORIZATION'
+            : outcome === 'step_up_required' ? 'STEP_UP_REQUIRED' : 'AUTHORIZATION_DENIED';
+        const authorizationAuditDelivered = await emitAudit('Failed to record authorization outcome', () => audit?.authorization(phase, {
+            outcome: outcome === 'denied' ? 'denied' : 'challenged',
+            reasonCode,
+        }), toolName);
+        const terminalAuditDelivered = authorizationAuditDelivered && await emitAudit('Failed to record terminal authorization tool outcome', () => audit?.tool(outcome === 'denied' ? 'denied' : 'challenged', {
+            toolName,
+            outcome: outcome === 'denied' ? 'denied' : 'challenged',
+            reasonCode,
+        }), toolName);
+        auditedTerminalResponses.add(response);
+        response._meta = {
+            ...(response._meta ?? {}),
+            [auditMetaKey]: {
+                terminal: true,
+                outcome,
+                ...(!terminalAuditDelivered
+                    ? {
+                        status: 'degraded',
+                        reason: 'Required terminal audit delivery failed for authorization outcome',
+                    }
+                    : {}),
+            },
+        };
         try {
             const resolvedSessionId = sessionId ?? (await ensureSession());
             if (!resolvedSessionId)
@@ -187,12 +381,24 @@ export function createSessionProof(deps) {
                 reason: sanitizeForMessage(reason),
             });
             response._meta = withProofMeta(response._meta ?? {}, proof);
+            if (terminalAuditDelivered) {
+                const proofAuditDelivered = await emitAudit('Failed to record generated outcome proof', () => audit?.proof('generated', { outcome: 'succeeded' }), toolName);
+                if (!proofAuditDelivered) {
+                    markAuditDegraded(response, 'Required proof audit delivery failed for authorization outcome', false);
+                }
+            }
         }
         catch (error) {
             logger.error("[kya-os] Outcome proof generation failed", {
                 tool: toolName,
                 error: error instanceof Error ? error.message : String(error),
             });
+            if (terminalAuditDelivered) {
+                await emitAudit('Failed to record outcome-proof rejection', () => audit?.proof('rejected', {
+                    outcome: 'failed',
+                    verificationCode: 'OUTCOME_PROOF_GENERATION_FAILED',
+                }), toolName);
+            }
         }
         return response;
     };

package/dist/middleware/with-kya-os.session.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.session.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.session.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,qBAAqB,EACrB,qBAAqB,GAGtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,GAExB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAuB9D,MAAM,UAAU,kBAAkB,CAAC,IAAoB;IACrD,MAAM,EACJ,QAAQ,EACR,MAAM,EACN,cAAc,EACd,cAAc,EACd,cAAc,EACd,QAAQ,EACR,kBAAkB,GACnB,GAAG,IAAI,CAAC;IAET;;;;OAIG;IACH,MAAM,aAAa,GAAG,CACpB,IAA6B,EAC7B,KAAoB,EACK,EAAE,CAAC,CAAC;QAC7B,GAAG,IAAI;QACP,CAAC,qBAAqB,CAAC,EAAE,KAAK;QAC9B,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC,CAAC;IAEH,gFAAgF;IAChF,iFAAiF;IACjF,iFAAiF;IACjF,iFAAiF;IACjF,kCAAkC;IAClC,IAAI,eAAmC,CAAC;IAExC,KAAK,UAAU,eAAe,CAAC,IAA6B;QAI1D,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,OAAO,EAAE,KAAK;4BACd,KAAK,EAAE;gCACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;gCACzC,OAAO,EACL,wGAAwG;6BAC3G;yBACF,CAAC;qBACH;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GACV,MAAM,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAE/C,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7C,CAAC;QAED,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI;4BACpB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;4BACnC,SAAS,EAAE,QAAQ,CAAC,GAAG;4BACvB,SAAS,EAAE,QAAQ,CAAC,GAAG;yBACxB,CAAC;wBACF,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;qBAC7C,CAAC;iBACH;aACF;YACD,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACvC,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,aAAa;QAC1B,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAClE,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC,cAAc,IAAI,CAAC,EAAE,CAAC;oBAClD,OAAO,eAAe,CAAC;gBACzB,CAAC;gBACD,sEAAsE;gBACtE,MAAM,CAAC,IAAI,CACT,wEAAwE;oBACtE,oEAAoE;oBACpE,oEAAoE,CACvE,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAE1C,kFAAkF;QAClF,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,iBAAiB,CAAC;YACpD,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,GAAG;YACtB,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;YAC3C,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,SAAS,aAAa,CACpB,QAAgB,EAChB,OAA4B;QAE5B,OAAO,KAAK,EACV,IAA6B,EAC7B,SAAkB,EAClB,OAA0B,EAC1B,EAAE;YACF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAE5D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,iEAAiE;YACjE,MAAM,iBAAiB,GAAG,SAAS,IAAI,MAAM,aAAa,EAAE,CAAC;YAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBAChE,MAAM,QAAQ,GAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;gBAExD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,aAAa,CAC9C,OAAO,EACP,QAAQ,EACR,OAAO,EACP,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAC9B,CAAC;gBAEF,+DAA+D;gBAC/D,wEAAwE;gBACxE,0CAA0C;gBAC1C,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBAExC,oEAAoE;gBACpE,0DAA0D;gBAC1D,IAAI,CAAC;oBACH,MAAM,QAAQ,CAAC,cAAc,CAAC;wBAC5B,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE;wBAClD,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;wBACrE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;wBACnC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;wBACrC,QAAQ,EAAE,KAAK;wBACf,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;qBAC5B,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;wBACxC,IAAI,EAAE,QAAQ;wBACd,KAAK,EACH,UAAU,YAAY,KAAK;4BACzB,CAAC,CAAC,UAAU,CAAC,OAAO;4BACpB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;oBAC/C,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,MAAM,CAAC,KAAK,GAAG;oBACb,UAAU,EAAE,gDAAgD;iBAC7D,CAAC;YACJ,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GAAuB,KAAK,EAClD,QAAQ,EACR,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,EACN,OAAO,GAAG,QAAQ,EAClB,cAAc,EACd,YAAY,EACZ,EAAE;QACF,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,SAAS,IAAI,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,iBAAiB;gBAAE,OAAO,QAAQ,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,CAAC,OAAO;gBAAE,OAAO,QAAQ,CAAC;YAE9B,sEAAsE;YACtE,gEAAgE;YAChE,IAAI,SAAkC,CAAC;YACvC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,SAAS,GAAG,cAAc,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,EAAE,CAAC;gBACf,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,IAAI,CAAC,KAAK,mBAAmB;wBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACrE,MAAM,aAAa,GACjB,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE;gBAChF,OAAO;gBACP,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC;aACnC,CAAC,CAAC;YACH,QAAQ,CAAC,KAAK,GAAG,aAAa,CAC3B,QAAQ,CAAC,KAA6C,IAAI,EAAE,EAC7D,KAAK,CACN,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE;gBACvD,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC;AAC/E,CAAC"}
+{"version":3,"file":"with-kya-os.session.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.session.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,qBAAqB,EACrB,qBAAqB,GAGtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,GAExB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAwB9D,MAAM,UAAU,kBAAkB,CAAC,IAAoB;IACrD,MAAM,EACJ,QAAQ,EACR,MAAM,EACN,cAAc,EACd,cAAc,EACd,cAAc,EACd,QAAQ,EACR,KAAK,EACL,kBAAkB,GACnB,GAAG,IAAI,CAAC;IACT,MAAM,wBAAwB,GAAG,IAAI,OAAO,EAAU,CAAC;IACvD,MAAM,YAAY,GAAG,kBAAkB,CAAC;IAIxC,MAAM,SAAS,GAAG,KAAK,EACrB,KAAa,EACb,SAA0C,EAC1C,QAAiB,EACC,EAAE;QACpB,IAAI,CAAC;YACH,MAAM,SAAS,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,EAAE,EAAE;gBAChC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;gBACrD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,CACxB,QAA6B,EAC7B,MAAc,EACd,iBAA0B,EACL,EAAE;QACvB,MAAM,QAAQ,GAAG;YACf,GAAG,CAAE,QAAQ,CAAC,KAA6C,IAAI,EAAE,CAAC;SACnE,CAAC;QACF,IAAI,iBAAiB,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC,qBAAqB,CAAC,CAAC;YACvC,OAAO,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,QAAQ,CAAC,YAAY,CAAC,GAAG;YACvB,GAAG,CAAC,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,IAAI;gBAC/E,CAAC,CAAC,QAAQ,CAAC,YAAY,CAA4B;gBACnD,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,UAAU;YAClB,MAAM;SACP,CAAC;QACF,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC;QAC1B,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,wBAAwB,GAAG,CAAC,MAAc,EAAuB,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,EAAE;iBAC1D,CAAC;aACH,CAAC;QACF,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE;KAC1D,CAAC,CAAC;IAEH,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,6BAA6B;IAC7B,MAAM,sBAAsB,GAAG,CAAC,QAA6B,EAAW,EAAE;QACxE,IAAI,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAA4C,CAAC;QACvE,MAAM,aAAa,GAAG,QAAQ,EAAE,CAAC,YAAY,CAAC,CAAC;QAC/C,OAAO,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI;YAC/D,aAAyC,CAAC,QAAQ,KAAK,IAAI,CAAC;IACjE,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CACnB,OAAqC,EACR,EAAE,CAAC,OAAO,KAAK,SAAS;QACrD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC;YACE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAChE,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACnD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;SACnF,CAAC;IAEN;;;;OAIG;IACH,MAAM,aAAa,GAAG,CACpB,IAA6B,EAC7B,KAAoB,EACK,EAAE,CAAC,CAAC;QAC7B,GAAG,IAAI;QACP,CAAC,qBAAqB,CAAC,EAAE,KAAK;QAC9B,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC,CAAC;IAEH,gFAAgF;IAChF,iFAAiF;IACjF,iFAAiF;IACjF,iFAAiF;IACjF,kCAAkC;IAClC,IAAI,eAAmC,CAAC;IAExC,KAAK,UAAU,eAAe,CAAC,IAA6B;QAI1D,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,SAAS,CACb,+CAA+C,EAC/C,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE;gBAC/B,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,kBAAkB,CAAC,gBAAgB;aAChD,CAAC,CACH,CAAC;YACF,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,OAAO,EAAE,KAAK;4BACd,KAAK,EAAE;gCACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;gCACzC,OAAO,EACL,wGAAwG;6BAC3G;yBACF,CAAC;qBACH;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GACV,MAAM,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAE/C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO;YAC/B,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,KAAK,kBAAkB,CAAC,YAAY;gBACtD,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,UAAU,CAAC;QACjB,MAAM,qBAAqB,GAAG,MAAM,SAAS,CAC3C,oBAAoB,UAAU,sBAAsB,EACpD,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE;YAC/B,SAAS,EAAE,MAAM,CAAC,OAAO;YACzB,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SACzE,CAAC,CACH,CAAC;QAEF,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,wBAAwB,CACrC,mEAAmE,CACpE,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACpD,CAAC;QAED,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7C,CAAC;QAED,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI;4BACpB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;4BACnC,SAAS,EAAE,QAAQ,CAAC,GAAG;4BACvB,SAAS,EAAE,QAAQ,CAAC,GAAG;yBACxB,CAAC;wBACF,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;qBAC7C,CAAC;iBACH;aACF;YACD,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACvC,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,aAAa;QAC1B,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAClE,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC,cAAc,IAAI,CAAC,EAAE,CAAC;oBAClD,OAAO,eAAe,CAAC;gBACzB,CAAC;gBACD,sEAAsE;gBACtE,MAAM,CAAC,IAAI,CACT,wEAAwE;oBACtE,oEAAoE;oBACpE,oEAAoE,CACvE,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAE1C,kFAAkF;QAClF,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,iBAAiB,CAAC;YACpD,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,GAAG;YACtB,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;YAC3C,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,SAAS,aAAa,CACpB,QAAgB,EAChB,OAA4B;QAE5B,OAAO,KAAK,EACV,IAA6B,EAC7B,SAAkB,EAClB,OAA0B,EAC1B,EAAE;YACF,MAAM,eAAe,GAAG,MAAM,SAAS,CACrC,4CAA4C,EAC5C,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;gBAC3B,QAAQ;gBACR,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;aAC/B,CAAC,EACF,QAAQ,CACT,CAAC;YACF,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,OAAO,wBAAwB,CAC7B,6DAA6D,CAC9D,CAAC;YACJ,CAAC;YACD,IAAI,MAA6C,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,OAAO,CAAC,IAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,SAAS,CACb,yEAAyE,EACzE,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;oBAC1B,QAAQ;oBACR,OAAO,EAAE,QAAQ;oBACjB,UAAU,EAAE,gBAAgB;oBAC5B,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,MAAM,KAAK,CAAC;YACd,CAAC;YAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpC,MAAM,SAAS,GAAG,MAAM,SAAS,CAC/B,qCAAqC,EACrC,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;wBAC1B,QAAQ;wBACR,OAAO,EAAE,QAAQ;wBACjB,UAAU,EAAE,sBAAsB;wBAClC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;qBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;oBACF,IAAI,CAAC,SAAS,EAAE,CAAC;wBACf,iBAAiB,CACf,MAAM,EACN,+DAA+D,EAC/D,KAAK,CACN,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,iEAAiE;YACjE,MAAM,iBAAiB,GAAG,SAAS,IAAI,MAAM,aAAa,EAAE,CAAC;YAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,mBAAmB,GAAG,MAAM,SAAS,CACzC,4CAA4C,EAC5C,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,QAAQ;oBACjB,gBAAgB,EAAE,2BAA2B;oBAC7C,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,MAAM,sBAAsB,GAAG,mBAAmB,IAAI,MAAM,SAAS,CACnE,yCAAyC,EACzC,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC7B,QAAQ;oBACR,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;oBAC5B,OAAO,iBAAiB,CACtB,MAAM,EACN,+DAA+D,EAC/D,IAAI,CACL,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,mBAAmB,GAAG,MAAM,SAAS,CACzC,wCAAwC,EACxC,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,QAAQ;oBACjB,gBAAgB,EAAE,yBAAyB;oBAC3C,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,MAAM,sBAAsB,GAAG,mBAAmB,IAAI,MAAM,SAAS,CACnE,yCAAyC,EACzC,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC7B,QAAQ;oBACR,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;oBAC5B,OAAO,iBAAiB,CACtB,MAAM,EACN,+DAA+D,EAC/D,IAAI,CACL,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBAChE,MAAM,QAAQ,GAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;gBAExD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,aAAa,CAC9C,OAAO,EACP,QAAQ,EACR,OAAO,EACP,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAC9B,CAAC;gBAEF,+DAA+D;gBAC/D,wEAAwE;gBACxE,0CAA0C;gBAC1C,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBAExC,MAAM,mBAAmB,GAAG,MAAM,SAAS,CACzC,gDAAgD,EAChD,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;oBAC9B,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,MAAM,sBAAsB,GAAG,mBAAmB,IAAI,MAAM,SAAS,CACnE,+CAA+C,EAC/C,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC7B,QAAQ;oBACR,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;oBAC5B,OAAO,iBAAiB,CACtB,MAAM,EACN,+DAA+D,EAC/D,IAAI,CACL,CAAC;gBACJ,CAAC;gBAED,oEAAoE;gBACpE,0DAA0D;gBAC1D,IAAI,CAAC;oBACH,MAAM,QAAQ,CAAC,cAAc,CAAC;wBAC5B,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE;wBAClD,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;wBACrE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;wBACnC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;wBACrC,QAAQ,EAAE,KAAK;wBACf,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;qBAC5B,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;wBACxC,IAAI,EAAE,QAAQ;wBACd,KAAK,EACH,UAAU,YAAY,KAAK;4BACzB,CAAC,CAAC,UAAU,CAAC,OAAO;4BACpB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;oBAC/C,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,MAAM,CAAC,KAAK,GAAG;oBACb,UAAU,EAAE,gDAAgD;iBAC7D,CAAC;gBACF,MAAM,uBAAuB,GAAG,MAAM,SAAS,CAC7C,6CAA6C,EAC7C,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,QAAQ;oBACjB,gBAAgB,EAAE,yBAAyB;oBAC3C,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,uBAAuB,EAAE,CAAC;oBAC7B,iBAAiB,CACf,MAAM,EACN,oEAAoE,EACpE,IAAI,CACL,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GAAuB,KAAK,EAClD,QAAQ,EACR,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,EACN,OAAO,GAAG,QAAQ,EAClB,cAAc,EACd,YAAY,EACZ,EAAE;QACF,MAAM,KAAK,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACnE,MAAM,UAAU,GAAG,OAAO,KAAK,qBAAqB;YAClD,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,OAAO,KAAK,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,sBAAsB,CAAC;QACjF,MAAM,2BAA2B,GAAG,MAAM,SAAS,CACjD,wCAAwC,EACxC,GAAG,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE;YAChC,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;YACvD,UAAU;SACX,CAAC,EACF,QAAQ,CACT,CAAC;QACF,MAAM,sBAAsB,GAAG,2BAA2B,IAAI,MAAM,SAAS,CAC3E,sDAAsD,EACtD,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE;YAChE,QAAQ;YACR,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;YACvD,UAAU;SACX,CAAC,EACF,QAAQ,CACT,CAAC;QACF,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,QAAQ,CAAC,KAAK,GAAG;YACf,GAAG,CAAE,QAAQ,CAAC,KAA6C,IAAI,EAAE,CAAC;YAClE,CAAC,YAAY,CAAC,EAAE;gBACd,QAAQ,EAAE,IAAI;gBACd,OAAO;gBACP,GAAG,CAAC,CAAC,sBAAsB;oBACzB,CAAC,CAAC;wBACE,MAAM,EAAE,UAAU;wBAClB,MAAM,EAAE,mEAAmE;qBAC5E;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAC;QACF,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,SAAS,IAAI,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,iBAAiB;gBAAE,OAAO,QAAQ,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,CAAC,OAAO;gBAAE,OAAO,QAAQ,CAAC;YAE9B,sEAAsE;YACtE,gEAAgE;YAChE,IAAI,SAAkC,CAAC;YACvC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,SAAS,GAAG,cAAc,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,EAAE,CAAC;gBACf,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,IAAI,CAAC,KAAK,mBAAmB;wBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACrE,MAAM,aAAa,GACjB,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE;gBAChF,OAAO;gBACP,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC;aACnC,CAAC,CAAC;YACH,QAAQ,CAAC,KAAK,GAAG,aAAa,CAC3B,QAAQ,CAAC,KAA6C,IAAI,EAAE,EAC7D,KAAK,CACN,CAAC;YACF,IAAI,sBAAsB,EAAE,CAAC;gBAC3B,MAAM,mBAAmB,GAAG,MAAM,SAAS,CACzC,0CAA0C,EAC1C,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EACzD,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzB,iBAAiB,CACf,QAAQ,EACR,gEAAgE,EAChE,KAAK,CACN,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE;gBACvD,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,IAAI,sBAAsB,EAAE,CAAC;gBAC3B,MAAM,SAAS,CACb,0CAA0C,EAC1C,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,QAAQ;oBACjB,gBAAgB,EAAE,iCAAiC;iBACpD,CAAC,EACF,QAAQ,CACT,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC;AAC/E,CAAC"}

package/dist/middleware/with-kya-os.types.d.ts

@@ -14,6 +14,7 @@ import type { PolicyEngine } from "../policy/engine.js";
 import type { RiskClassifier } from "../policy/classifier.js";
 import type { ApprovalGrant } from "../policy/approval.js";
 import type { KyaOsIdentityConfig } from "./with-kya-os.config-types.js";
+import type { AuthorizationEvidence, PartyRef } from "../audit/types.js";
 export * from "./with-kya-os.config-types.js";
 export interface KyaOsToolDefinition {
     name: string;
@@ -32,6 +33,11 @@ export interface KyaOsToolDefinition {
  */
 export interface KyaOsCallContext {
     scopeId?: string;
+    actor?: PartyRef;
+    responsibleParty?: PartyRef;
+    authorization?: AuthorizationEvidence;
+    correlationId?: string;
+    causationId?: string;
 }
 export interface KyaOsToolHandler<T extends Record<string, unknown> = Record<string, unknown>> {
     (args: T, sessionId?: string, context?: KyaOsCallContext): Promise<{

package/dist/middleware/with-kya-os.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.types.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAIzE,cAAc,+BAA+B,CAAC;AAE9C,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB,CAC/B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE3D,CACE,IAAI,EAAE,CAAC,EACP,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC;QACT,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC,CAAC;QACvE,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC,CAAC;CACJ;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,iBAAiB,CACf,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,GACvC,IAAI,CAAC;CACT;AAQD,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QAClD,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;IAEH;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;CACJ;AAED,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvE,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAC3B,gBAAgB,CAAC;CACrB;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,kBAAkB,CAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB;;;;;;;WAOG;QACH,eAAe,CAAC,EAAE,CAChB,SAAS,EAAE,uBAAuB,KAC/B,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC5C,EACD,OAAO,EAAE,gBAAgB,GACxB,gBAAgB,CAAC;CACrB;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B;;;;;;;OAOG;IACH,cAAc,CACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,EACzB,IAAI,CAAC,EAAE,iBAAiB,GACvB,gBAAgB,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eACf,SAAQ,oBAAoB,EAC1B,kBAAkB,EAClB,mBAAmB;IACrB,2DAA2D;IAC3D,QAAQ,EAAE,mBAAmB,CAAC;IAE9B,gEAAgE;IAChE,cAAc,EAAE,cAAc,CAAC;IAE/B,8DAA8D;IAC9D,cAAc,EAAE,cAAc,CAAC;IAE/B;;;OAGG;IACH,SAAS,EAAE,mBAAmB,CAAC;IAE/B;;;;OAIG;IACH,aAAa,EAAE,mBAAmB,CAAC;IAInC,cAAc,CAAC,EAAE,eAAe,CAAC,gBAAgB,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,gEAAgE;IAChE,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC;IAC7D,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,wBAAwB,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB"}
+{"version":3,"file":"with-kya-os.types.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAIzE,cAAc,+BAA+B,CAAC;AAE9C,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,gBAAgB,CAAC,EAAE,QAAQ,CAAC;IAC5B,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB,CAC/B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE3D,CACE,IAAI,EAAE,CAAC,EACP,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC;QACT,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC,CAAC;QACvE,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC,CAAC;CACJ;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,iBAAiB,CACf,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,GACvC,IAAI,CAAC;CACT;AAQD,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QAClD,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;IAEH;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;CACJ;AAED,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvE,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAC3B,gBAAgB,CAAC;CACrB;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,kBAAkB,CAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB;;;;;;;WAOG;QACH,eAAe,CAAC,EAAE,CAChB,SAAS,EAAE,uBAAuB,KAC/B,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC5C,EACD,OAAO,EAAE,gBAAgB,GACxB,gBAAgB,CAAC;CACrB;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B;;;;;;;OAOG;IACH,cAAc,CACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,EACzB,IAAI,CAAC,EAAE,iBAAiB,GACvB,gBAAgB,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eACf,SAAQ,oBAAoB,EAC1B,kBAAkB,EAClB,mBAAmB;IACrB,2DAA2D;IAC3D,QAAQ,EAAE,mBAAmB,CAAC;IAE9B,gEAAgE;IAChE,cAAc,EAAE,cAAc,CAAC;IAE/B,8DAA8D;IAC9D,cAAc,EAAE,cAAc,CAAC;IAE/B;;;OAGG;IACH,SAAS,EAAE,mBAAmB,CAAC;IAE/B;;;;OAIG;IACH,aAAa,EAAE,mBAAmB,CAAC;IAInC,cAAc,CAAC,EAAE,eAAe,CAAC,gBAAgB,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,gEAAgE;IAChE,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC;IAC7D,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,wBAAwB,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB"}

package/dist/middleware/with-kya-os.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.types.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAUH,gFAAgF;AAChF,4EAA4E;AAC5E,cAAc,+BAA+B,CAAC"}
+{"version":3,"file":"with-kya-os.types.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAWH,gFAAgF;AAChF,4EAA4E;AAC5E,cAAc,+BAA+B,CAAC"}

package/dist/proof/generator.d.ts

@@ -19,9 +19,21 @@ import type { CryptoProvider } from '../providers/base.js';
  * SINGLE SOURCE OF TRUTH: every emit site (middleware) and verify site
  * (`extractProofFromMeta` / `validateMetaStructure`) references this constant,
  * so renaming the namespace — e.g. once KYA-OS registers as an MCP Extension
- * under SEP-2133 — is a one-line change. See SPEC §7.6.
+ * under SEP-2133 — is a one-line change. Named for its ROLE (the response
+ * proof), so it cannot be misread as a version sibling of the request proof's
+ * `org.kya-os/request-proof`. See SPEC §7.5-§7.6.
  */
-export declare const KYA_OS_PROOF_META_KEY = "org.kya-os/proof";
+export declare const KYA_OS_PROOF_META_KEY = "org.kya-os/response-proof";
+/**
+ * The prior namespaced key (`org.kya-os/proof`), canonical from 1.1 until the
+ * role-named rename. Reads as a lineage sibling of the request proof's
+ * versioned key, which it is not — the two carry different objects — hence the
+ * rename. For one major version verifiers MUST keep accepting a proof
+ * published here; producers emit {@link KYA_OS_PROOF_META_KEY} and MAY mirror
+ * here for older verifiers. When several keys are present the newest canonical
+ * form wins.
+ */
+export declare const LEGACY_NAMESPACED_PROOF_META_KEY = "org.kya-os/proof";
 /**
  * Legacy bare `_meta.proof` key — the legacy `_meta.proof` mirror; drop at 2.0.
  * For one major version verifiers MUST keep accepting a proof published here

package/dist/proof/generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/proof/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EACV,aAAa,EAEb,cAAc,EACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,UAAU,CAAC;AAE7C,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,aAAa,CAAC;QACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,kBAAkB,GAAG,qBAAqB,CAAC;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,GAC3C,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBzD;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,cAAc,CAAiB;gBAE3B,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,cAAc;IAKxE;;;;;;;;;;;;OAYG;IACG,aAAa,CACjB,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,aAAa,CAAC;IAsBzB;;;OAGG;IACG,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;YAI1C,uBAAuB;IASrC;;;;;;OAMG;YACW,iBAAiB;YAOjB,WAAW;IA2CzB,OAAO,CAAC,qBAAqB;IAqBvB,WAAW,CACf,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,YAAY,GACtB,OAAO,CAAC,OAAO,CAAC;IA4BnB,OAAO,CAAC,oBAAoB;CAc7B;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,cAAc,EACvB,cAAc,EAAE,cAAc,EAC9B,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,YAAY,CAAC,CAMvB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GACrB;IACD,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAQA"}
+{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/proof/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EACV,aAAa,EAEb,cAAc,EACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,8BAA8B,CAAC;AAEjE;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,qBAAqB,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,UAAU,CAAC;AAE7C,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,aAAa,CAAC;QACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,kBAAkB,GAAG,qBAAqB,CAAC;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,GAC3C,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAezD;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,cAAc,CAAiB;gBAE3B,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,cAAc;IAKxE;;;;;;;;;;;;OAYG;IACG,aAAa,CACjB,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,aAAa,CAAC;IAyBzB;;;OAGG;IACG,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;YAI1C,uBAAuB;IASrC;;;;;;OAMG;YACW,iBAAiB;YAOjB,WAAW;IA2CzB,OAAO,CAAC,qBAAqB;IAqBvB,WAAW,CACf,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,YAAY,GACtB,OAAO,CAAC,OAAO,CAAC;IA4BnB,OAAO,CAAC,oBAAoB;CAc7B;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,cAAc,EACvB,cAAc,EAAE,cAAc,EAC9B,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,YAAY,CAAC,CAMvB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GACrB;IACD,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAQA"}

package/dist/proof/generator.js

@@ -8,7 +8,7 @@
  * (Node.js, Cloudflare Workers) inject a CryptoProvider and delegate here.
  */
 import { CompactSign, importPKCS8 } from 'jose';
-import { canonicalize } from 'json-canonicalize';
+import { canonicalizeJson, canonicalizeJsonBytes } from '../utils/canonical-json.js';
 import { CryptoService } from '../utils/crypto-service.js';
 import { base64ToBytes, base64urlEncodeFromBytes, bytesToBase64 } from '../utils/base64.js';
 import { ED25519_PKCS8_DER_HEADER, ED25519_KEY_SIZE } from '../utils/ed25519-constants.js';
@@ -22,9 +22,21 @@ import { ED25519_PKCS8_DER_HEADER, ED25519_KEY_SIZE } from '../utils/ed25519-con
  * SINGLE SOURCE OF TRUTH: every emit site (middleware) and verify site
  * (`extractProofFromMeta` / `validateMetaStructure`) references this constant,
  * so renaming the namespace — e.g. once KYA-OS registers as an MCP Extension
- * under SEP-2133 — is a one-line change. See SPEC §7.6.
+ * under SEP-2133 — is a one-line change. Named for its ROLE (the response
+ * proof), so it cannot be misread as a version sibling of the request proof's
+ * `org.kya-os/request-proof`. See SPEC §7.5-§7.6.
  */
-export const KYA_OS_PROOF_META_KEY = 'org.kya-os/proof';
+export const KYA_OS_PROOF_META_KEY = 'org.kya-os/response-proof';
+/**
+ * The prior namespaced key (`org.kya-os/proof`), canonical from 1.1 until the
+ * role-named rename. Reads as a lineage sibling of the request proof's
+ * versioned key, which it is not — the two carry different objects — hence the
+ * rename. For one major version verifiers MUST keep accepting a proof
+ * published here; producers emit {@link KYA_OS_PROOF_META_KEY} and MAY mirror
+ * here for older verifiers. When several keys are present the newest canonical
+ * form wins.
+ */
+export const LEGACY_NAMESPACED_PROOF_META_KEY = 'org.kya-os/proof';
 /**
  * Legacy bare `_meta.proof` key — the legacy `_meta.proof` mirror; drop at 2.0.
  * For one major version verifiers MUST keep accepting a proof published here
@@ -53,11 +65,11 @@ export async function computeCanonicalHashes(request, response, hash) {
         method: request.method,
         ...(request.params ? { params: request.params } : {}),
     };
-    const requestHash = await hash(new TextEncoder().encode(canonicalize(canonicalRequest)));
+    const requestHash = await hash(canonicalizeJsonBytes(canonicalRequest));
     if (response === undefined) {
         return { requestHash };
     }
-    const responseHash = await hash(new TextEncoder().encode(canonicalize(response.data)));
+    const responseHash = await hash(canonicalizeJsonBytes(response.data));
     return { requestHash, responseHash };
 }
 export class ProofGenerator {
@@ -82,11 +94,12 @@ export class ProofGenerator {
      */
     async generateProof(request, response, session, options = {}) {
         const hashes = await this.generateCanonicalHashes(request, response);
+        const proofNonce = base64urlEncodeFromBytes(await this.cryptoProvider.randomBytes(16));
         const meta = {
             did: this.identity.did,
             kid: this.identity.kid,
             ts: Math.floor(Date.now() / 1000),
-            nonce: session.nonce,
+            nonce: proofNonce,
             audience: session.audience,
             sessionId: session.sessionId,
             requestHash: hashes.requestHash,
@@ -144,7 +157,7 @@ export class ProofGenerator {
             };
             // Use canonicalized JSON (RFC 8785) for deterministic payload serialization.
             // This ensures signature verification succeeds regardless of JSON key ordering.
-            const canonicalPayload = canonicalize(payload);
+            const canonicalPayload = canonicalizeJson(payload);
             const payloadBytes = new TextEncoder().encode(canonicalPayload);
             const jws = await new CompactSign(payloadBytes)
                 .setProtectedHeader({