@kya-os/mcp 1.10.1 → 1.12.0

package/dist/utils/canonical-json.js

@@ -0,0 +1,109 @@
+/**
+ * Strict RFC 8785 JSON canonicalization for integrity-critical inputs.
+ *
+ * `json-canonicalize` intentionally follows JSON serialization semantics, which
+ * can silently erase or coerce unsupported JavaScript values. Protocol digests
+ * must fail closed instead: two distinguishable JavaScript inputs must never be
+ * accepted as the same canonical JSON value by accident.
+ */
+import { canonicalize } from 'json-canonicalize';
+const encoder = new TextEncoder();
+/** RFC 8785 requires invalid Unicode data (unpaired UTF-16 surrogates) to fail. */
+function hasLoneSurrogate(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const codeUnit = value.charCodeAt(index);
+        if (codeUnit >= 0xd800 && codeUnit <= 0xdbff) {
+            const next = value.charCodeAt(index + 1);
+            if (index + 1 >= value.length || next < 0xdc00 || next > 0xdfff)
+                return true;
+            index += 1;
+        }
+        else if (codeUnit >= 0xdc00 && codeUnit <= 0xdfff) {
+            return true;
+        }
+    }
+    return false;
+}
+/** Validate that a value has an unambiguous JSON representation. */
+export function assertCanonicalJsonValue(value, path = '$', ancestors = new WeakSet()) {
+    if (value === null || typeof value === 'boolean') {
+        return;
+    }
+    if (typeof value === 'string') {
+        if (hasLoneSurrogate(value)) {
+            throw new TypeError(`Cannot canonicalize string with lone surrogate at ${path}`);
+        }
+        return;
+    }
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value)) {
+            throw new TypeError(`Cannot canonicalize non-finite number at ${path}: ${value}`);
+        }
+        if (Number.isInteger(value) && !Number.isSafeInteger(value)) {
+            throw new TypeError(`Cannot canonicalize unsafe integer at ${path}: ${value}`);
+        }
+        return;
+    }
+    if (typeof value === 'undefined') {
+        throw new TypeError(`Cannot canonicalize undefined at ${path}`);
+    }
+    if (typeof value === 'function') {
+        throw new TypeError(`Cannot canonicalize function at ${path}`);
+    }
+    if (typeof value === 'symbol') {
+        throw new TypeError(`Cannot canonicalize symbol at ${path}`);
+    }
+    if (typeof value === 'bigint') {
+        throw new TypeError(`Cannot canonicalize bigint at ${path}`);
+    }
+    if (typeof value !== 'object') {
+        throw new TypeError(`Cannot canonicalize unsupported value at ${path}`);
+    }
+    if (ancestors.has(value)) {
+        throw new TypeError(`Cannot canonicalize cyclic reference at ${path}`);
+    }
+    ancestors.add(value);
+    try {
+        if (Array.isArray(value)) {
+            for (let index = 0; index < value.length; index += 1) {
+                if (!(index in value)) {
+                    throw new TypeError(`Cannot canonicalize sparse array element at ${path}[${index}]`);
+                }
+                assertCanonicalJsonValue(value[index], `${path}[${index}]`, ancestors);
+            }
+            return;
+        }
+        const prototype = Object.getPrototypeOf(value);
+        if (prototype !== Object.prototype && prototype !== null) {
+            throw new TypeError(`Cannot canonicalize non-plain object at ${path}`);
+        }
+        for (const key of Reflect.ownKeys(value)) {
+            if (typeof key === 'symbol') {
+                throw new TypeError(`Cannot canonicalize symbol-keyed property at ${path}`);
+            }
+            if (hasLoneSurrogate(key)) {
+                throw new TypeError(`Cannot canonicalize object key with lone surrogate at ${path}`);
+            }
+            const descriptor = Object.getOwnPropertyDescriptor(value, key);
+            if (!descriptor?.enumerable)
+                continue;
+            if (!('value' in descriptor)) {
+                throw new TypeError(`Cannot canonicalize accessor property at ${path}.${key}`);
+            }
+            assertCanonicalJsonValue(descriptor.value, `${path}.${key}`, ancestors);
+        }
+    }
+    finally {
+        ancestors.delete(value);
+    }
+}
+/** Canonicalize a strict JSON value according to RFC 8785. */
+export function canonicalizeJson(value) {
+    assertCanonicalJsonValue(value);
+    return canonicalize(value);
+}
+/** Canonical UTF-8 bytes for hashing or signing. */
+export function canonicalizeJsonBytes(value) {
+    return encoder.encode(canonicalizeJson(value));
+}
+//# sourceMappingURL=canonical-json.js.map

package/dist/utils/canonical-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.js","sourceRoot":"","sources":["../../src/utils/canonical-json.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,KAAa;IACrC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,MAAM,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,GAAG,MAAM,IAAI,IAAI,GAAG,MAAM;gBAAE,OAAO,IAAI,CAAC;YAC7E,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,QAAQ,IAAI,MAAM,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,wBAAwB,CACtC,KAAc,EACd,IAAI,GAAG,GAAG,EACV,YAA6B,IAAI,OAAO,EAAU;IAElD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,SAAS,CAAC,qDAAqD,IAAI,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,SAAS,CAAC,4CAA4C,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,SAAS,CAAC,yCAAyC,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,2CAA2C,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;gBACrD,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,EAAE,CAAC;oBACtB,MAAM,IAAI,SAAS,CAAC,+CAA+C,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC;gBACvF,CAAC;gBACD,wBAAwB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,SAAS,CAAC,CAAC;YACzE,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAkB,CAAC;QAChE,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACzD,MAAM,IAAI,SAAS,CAAC,2CAA2C,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,SAAS,CAAC,gDAAgD,IAAI,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,SAAS,CAAC,yDAAyD,IAAI,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/D,IAAI,CAAC,UAAU,EAAE,UAAU;gBAAE,SAAS;YACtC,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,SAAS,CAAC,4CAA4C,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,wBAAwB,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;AACjD,CAAC"}

package/dist/utils/crypto-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto-service.d.ts","sourceRoot":"","sources":["../../src/utils/crypto-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAStD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,SAAS,CAAC;IACf,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,cAAc,EAAE,UAAU,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,aAAa;IACZ,OAAO,CAAC,cAAc;gBAAd,cAAc,EAAE,cAAc;IAE5C,aAAa,CACjB,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC;IAUnB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS;IA0C1B,SAAS,CACb,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,UAAU,EACxB,OAAO,CAAC,EAAE;QACR,eAAe,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;QACtC,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,GAAG,CAAC,EAAE,OAAO,CAAC;KACf,GACA,OAAO,CAAC,OAAO,CAAC;IAuFnB,OAAO,CAAC,iBAAiB;IAczB,OAAO,CAAC,oBAAoB;CAO7B"}
+{"version":3,"file":"crypto-service.d.ts","sourceRoot":"","sources":["../../src/utils/crypto-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAStD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,SAAS,CAAC;IACf,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,cAAc,EAAE,UAAU,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,aAAa;IACZ,OAAO,CAAC,cAAc;gBAAd,cAAc,EAAE,cAAc;IAE5C,aAAa,CACjB,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC;IAUnB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS;IA0C1B,SAAS,CACb,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,UAAU,EACxB,OAAO,CAAC,EAAE;QACR,eAAe,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;QACtC,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,GAAG,CAAC,EAAE,OAAO,CAAC;KACf,GACA,OAAO,CAAC,OAAO,CAAC;IA8FnB,OAAO,CAAC,iBAAiB;IAczB,OAAO,CAAC,oBAAoB;CAO7B"}

package/dist/utils/crypto-service.js

@@ -98,6 +98,11 @@ export class CryptoService {
                 logger.error(`[CryptoService] Unsupported algorithm: ${parsed.header['alg']}, expected ${expectedAlg}`);
                 return false;
             }
+            if (options?.expectedKid !== undefined &&
+                parsed.header['kid'] !== options.expectedKid) {
+                logger.error('[CryptoService] Protected JWS key ID mismatch');
+                return false;
+            }
             let signingInputBytes;
             if (options?.detachedPayload !== undefined) {
                 const headerB64 = jws.split('.')[0];

package/dist/utils/crypto-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto-service.js","sourceRoot":"","sources":["../../src/utils/crypto-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,EACxB,aAAa,GACd,MAAM,aAAa,CAAC;AAoBrB,MAAM,OAAO,aAAa;IACJ;IAApB,YAAoB,cAA8B;QAA9B,mBAAc,GAAd,cAAc,CAAgB;IAAG,CAAC;IAEtD,KAAK,CAAC,aAAa,CACjB,IAAgB,EAChB,SAAqB,EACrB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;YAC5E,OAAO,MAAM,KAAK,IAAI,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;YACnE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;QAEpD,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,SAAU,CAAC,CAA4B,CAAC;QACtF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnF,CAAC;QACJ,CAAC;QAED,IAAI,OAA4C,CAAC;QACjD,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAA4B,CAAC;YACvF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACpF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,cAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,cAAc,GAAG,sBAAsB,CAAC,YAAa,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAElD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,SAAS,CACb,GAAW,EACX,YAAwB,EACxB,OAIC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAC3D,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,OAAO,EAAE,WAAW,IAAI,YAAY,CAAC,GAAG,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;gBACrE,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBAChD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,MAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,OAAO,EAAE,eAAe,KAAK,SAAS,EAAE,CAAC;oBAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;wBAC1C,IAAI,CAAC;4BACH,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;4BAC5B,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;4BAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,uBAAuB,CAAC,SAAS,CAAC,CACR,CAAC;4BAC7B,MAAM,cAAc,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;4BAC5D,MAAM,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;wBAC5E,CAAC;wBAAC,MAAM,CAAC;4BACP,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;4BAC5D,OAAO,KAAK,CAAC;wBACf,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;wBAC3D,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;oBAC3D,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC;YAC5C,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,WAAW,EAAE,CAAC;gBACzC,MAAM,CAAC,KAAK,CACV,0CAA0C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,WAAW,EAAE,CAC1F,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,iBAA6B,CAAC;YAElC,IAAI,OAAO,EAAE,eAAe,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;gBACrC,IAAI,UAAkB,CAAC;gBAEvB,IAAI,OAAO,CAAC,eAAe,YAAY,UAAU,EAAE,CAAC;oBAClD,UAAU,GAAG,wBAAwB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBACjE,CAAC;qBAAM,CAAC;oBACN,UAAU,GAAG,wBAAwB,CACnC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAClD,CAAC;gBACJ,CAAC;gBAED,iBAAiB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;oBACzB,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;oBACtE,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,iBAAiB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,eAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,eAAe,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,+CAA+C,EAAE,KAAK,CAAC,CAAC;gBACrE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,EAAE,MAAM,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,GAAY;QACpC,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;YACvB,GAAG,KAAK,IAAI;YACZ,KAAK,IAAI,GAAG;YACX,GAA+B,CAAC,KAAK,CAAC,KAAK,KAAK;YACjD,KAAK,IAAI,GAAG;YACX,GAA+B,CAAC,KAAK,CAAC,KAAK,SAAS;YACrD,GAAG,IAAI,GAAG;YACV,OAAQ,GAA+B,CAAC,GAAG,CAAC,KAAK,QAAQ;YACvD,GAA+B,CAAC,GAAG,CAAY,CAAC,MAAM,GAAG,CAAC,CAC7D,CAAC;IACJ,CAAC;IAEO,oBAAoB,CAAC,GAAe;QAC1C,MAAM,cAAc,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,cAAc,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,sCAAsC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,aAAa,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC;CACF"}
+{"version":3,"file":"crypto-service.js","sourceRoot":"","sources":["../../src/utils/crypto-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,EACxB,aAAa,GACd,MAAM,aAAa,CAAC;AAoBrB,MAAM,OAAO,aAAa;IACJ;IAApB,YAAoB,cAA8B;QAA9B,mBAAc,GAAd,cAAc,CAAgB;IAAG,CAAC;IAEtD,KAAK,CAAC,aAAa,CACjB,IAAgB,EAChB,SAAqB,EACrB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;YAC5E,OAAO,MAAM,KAAK,IAAI,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;YACnE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;QAEpD,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,SAAU,CAAC,CAA4B,CAAC;QACtF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnF,CAAC;QACJ,CAAC;QAED,IAAI,OAA4C,CAAC;QACjD,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAA4B,CAAC;YACvF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACpF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,cAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,cAAc,GAAG,sBAAsB,CAAC,YAAa,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAElD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,SAAS,CACb,GAAW,EACX,YAAwB,EACxB,OAIC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAC3D,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,OAAO,EAAE,WAAW,IAAI,YAAY,CAAC,GAAG,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;gBACrE,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBAChD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,MAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,OAAO,EAAE,eAAe,KAAK,SAAS,EAAE,CAAC;oBAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;wBAC1C,IAAI,CAAC;4BACH,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;4BAC5B,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;4BAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,uBAAuB,CAAC,SAAS,CAAC,CACR,CAAC;4BAC7B,MAAM,cAAc,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;4BAC5D,MAAM,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;wBAC5E,CAAC;wBAAC,MAAM,CAAC;4BACP,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;4BAC5D,OAAO,KAAK,CAAC;wBACf,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;wBAC3D,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;oBAC3D,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC;YAC5C,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,WAAW,EAAE,CAAC;gBACzC,MAAM,CAAC,KAAK,CACV,0CAA0C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,WAAW,EAAE,CAC1F,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IACE,OAAO,EAAE,WAAW,KAAK,SAAS;gBAClC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,WAAW,EAC5C,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBAC9D,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,iBAA6B,CAAC;YAElC,IAAI,OAAO,EAAE,eAAe,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;gBACrC,IAAI,UAAkB,CAAC;gBAEvB,IAAI,OAAO,CAAC,eAAe,YAAY,UAAU,EAAE,CAAC;oBAClD,UAAU,GAAG,wBAAwB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBACjE,CAAC;qBAAM,CAAC;oBACN,UAAU,GAAG,wBAAwB,CACnC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAClD,CAAC;gBACJ,CAAC;gBAED,iBAAiB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;oBACzB,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;oBACtE,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,iBAAiB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,eAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,eAAe,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,+CAA+C,EAAE,KAAK,CAAC,CAAC;gBACrE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,EAAE,MAAM,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,GAAY;QACpC,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;YACvB,GAAG,KAAK,IAAI;YACZ,KAAK,IAAI,GAAG;YACX,GAA+B,CAAC,KAAK,CAAC,KAAK,KAAK;YACjD,KAAK,IAAI,GAAG;YACX,GAA+B,CAAC,KAAK,CAAC,KAAK,SAAS;YACrD,GAAG,IAAI,GAAG;YACV,OAAQ,GAA+B,CAAC,GAAG,CAAC,KAAK,QAAQ;YACvD,GAA+B,CAAC,GAAG,CAAY,CAAC,MAAM,GAAG,CAAC,CAC7D,CAAC;IACJ,CAAC;IAEO,oBAAoB,CAAC,GAAe;QAC1C,MAAM,cAAc,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,cAAc,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,sCAAsC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,aAAa,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC;CACF"}

package/dist/utils/index.d.ts

@@ -3,6 +3,7 @@
  */
 export { ED25519_PKCS8_DER_HEADER, ED25519_SPKI_DER_HEADER_LENGTH, ED25519_KEY_SIZE, } from './ed25519-constants.js';
 export { isRecord } from './guards.js';
+export { assertCanonicalJsonValue, canonicalizeJson, canonicalizeJsonBytes, } from './canonical-json.js';
 export { stripTrailingSlashes } from './url.js';
 export { createSafeFetch, fetchTransport, isBlockedAddress, type SafeFetch, type SafeFetchResponse, type SafeFetchOptions, type SafeFetchTransport, type TransportInit, type RawResponse, type DnsLookup, type DnsAddress, } from './safe-fetch.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,iBAAiB,CAAC"}

package/dist/utils/index.js

@@ -3,6 +3,7 @@
  */
 export { ED25519_PKCS8_DER_HEADER, ED25519_SPKI_DER_HEADER_LENGTH, ED25519_KEY_SIZE, } from './ed25519-constants.js';
 export { isRecord } from './guards.js';
+export { assertCanonicalJsonValue, canonicalizeJson, canonicalizeJsonBytes, } from './canonical-json.js';
 export { stripTrailingSlashes } from './url.js';
 export { createSafeFetch, fetchTransport, isBlockedAddress, } from './safe-fetch.js';
 //# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,GASjB,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,GASjB,MAAM,iBAAiB,CAAC"}

package/package.json

@@ -1,12 +1,15 @@
 {
   "name": "@kya-os/mcp",
-  "version": "1.10.1",
-  "description": "Reference implementation of the KYA-OS protocol for Model Context Protocol servers: delegation, proof, and session primitives",
+  "version": "1.12.0",
+  "description": "Reference implementation of the KYA-OS protocol for Model Context Protocol servers: identity, delegation, proofs, sessions, and verifiable audit trails",
   "license": "MIT",
   "type": "module",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "bin": {
+    "kya-audit": "./dist/audit/cli.js"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -56,6 +59,14 @@
       "types": "./dist/authz/index.d.ts",
       "default": "./dist/authz/index.js"
     },
+    "./audit": {
+      "types": "./dist/audit/index.d.ts",
+      "default": "./dist/audit/index.js"
+    },
+    "./audit/testing": {
+      "types": "./dist/audit/testing/index.d.ts",
+      "default": "./dist/audit/testing/index.js"
+    },
     "./cheqd": {
       "types": "./dist/integrations/cheqd/index.d.ts",
       "default": "./dist/integrations/cheqd/index.js"
@@ -68,7 +79,10 @@
     "schemas",
     "LICENSE",
     "README.md",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "AUDITABILITY.md",
+    "CONFORMANCE.md",
+    "SPEC.md"
   ],
   "scripts": {
     "build": "tsc",
@@ -97,10 +111,11 @@
     "example:authz-inspector:http": "npx tsx examples/authz-inspector/src/inspector-http.ts",
     "example:authz-inspector:http:server": "npx tsx examples/authz-inspector/src/http.ts",
     "example:authz-inspector:stdio:server": "npx tsx examples/authz-inspector/src/stdio.ts",
-    "example:cheqd-dlr": "npx tsx examples/cheqd-dlr/operator-flow.ts"
+    "example:cheqd-dlr": "npx tsx examples/cheqd-dlr/operator-flow.ts",
+    "example:audit-trail": "npx tsx examples/audit-trail/walkthrough.ts"
   },
   "dependencies": {
-    "jose": "^6.2.3",
+    "jose": "^6.2.4",
     "json-canonicalize": "^2.0.0",
     "zod": "^4.3.6"
   },
@@ -114,20 +129,21 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@kya-os/consent": "^0.1.37",
+    "@kya-os/consent": "^0.1.43",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "@types/express": "^5.0.6",
     "@types/node": "^26.0.1",
-    "@typescript-eslint/eslint-plugin": "^8.57.0",
-    "@typescript-eslint/parser": "^8.57.0",
-    "@vitest/coverage-v8": "^2.0.0",
+    "@typescript-eslint/eslint-plugin": "^8.65.0",
+    "@typescript-eslint/parser": "^8.65.0",
+    "@vitest/coverage-v8": "^4.1.10",
+    "ajv": "^8.20.0",
     "commander": "^15.0.0",
     "eslint": "^10.0.3",
     "express": "^5.2.1",
     "tsx": "^4.22.4",
     "typescript": "^5.5.3",
-    "typescript-eslint": "^8.57.0",
-    "vitest": "^2.0.0"
+    "typescript-eslint": "^8.65.0",
+    "vitest": "^4.1.10"
   },
   "keywords": [
     "kya-os",
@@ -137,6 +153,8 @@
     "did",
     "protocol",
     "identity",
+    "audit",
+    "transparency-log",
     "dif"
   ],
   "repository": {

package/schemas/README.md

@@ -11,7 +11,20 @@ This directory contains JSON Schema definitions for the core KYA-OS (Model Conte
 | [delegation-credential.json](./delegation-credential.json) | W3C Verifiable Credential for delegations (legacy VC 1.0 shape) |
 | [card-delegation-credential.json](./card-delegation-credential.json) | W3C VC 2.0 + ZCAP-LD delegation profile (Entity Card) |
 | [detached-proof.json](./detached-proof.json) | Cryptographic proof for tool request/response |
-| [well-known-kyaos.json](./well-known-kyaos.json) | Service discovery document |
+| [kya-os-card.schema.json](./kya-os-card.schema.json) | Typed KYA-OS Entity Card |
+| [well-known-mcpi.json](./well-known-mcpi.json) | Service discovery document |
+| [mcp-extension-settings.json](./mcp-extension-settings.json) | Negotiation settings for the `org.kya-os/decentralized-authority` MCP extension (SEP-2133) |
+| [audit-event.schema.json](./audit-event.schema.json) | Strict, privacy-minimal producer audit event core |
+| [audit-entry.schema.json](./audit-entry.schema.json) | Recorder-assigned chained entry core |
+| [audit-receipt.schema.json](./audit-receipt.schema.json) | Signed append-receipt core |
+| [audit-checkpoint.schema.json](./audit-checkpoint.schema.json) | RFC 9162 signed-checkpoint core |
+| [audit-bundle-manifest.schema.json](./audit-bundle-manifest.schema.json) | Signed replay-bundle inventory and scope core |
+| [audit-observation.schema.json](./audit-observation.schema.json) | Independently signed checkpoint observation receipt |
+| [audit-anchor-receipt.schema.json](./audit-anchor-receipt.schema.json) | Supporting WORM, RFC 3161, or SCITT receipt |
+| [audit-inclusion-proof.schema.json](./audit-inclusion-proof.schema.json) | RFC 9162 inclusion proof |
+| [audit-consistency-proof.schema.json](./audit-consistency-proof.schema.json) | RFC 9162 consistency proof |
+| [audit-verification-report.schema.json](./audit-verification-report.schema.json) | Multi-dimensional offline verification result |
+| [audit-verification-policy.schema.json](./audit-verification-policy.schema.json) | Out-of-band recorder, observer, anchor, and exporter trust policy |
 
 ## Usage
 
@@ -73,6 +86,19 @@ https://schema.kya-os.org/v1/protocol/{family}/{resource}/v1.0.0
 
 Schemas can reference each other using `$ref`. For example, the delegation credential schema references shared definitions for constraints and proof structures.
 
+### Audit semantic keywords
+
+Three audit schemas use required KYA-OS semantic keywords for invariants that
+JSON Schema draft 2020-12 cannot express with its standard vocabulary:
+
+- `kyaOrderedDecimalRange` compares two canonical decimal-string properties;
+- `kyaOrderedNumberRange` compares two optional integer properties;
+- `kyaUniqueProperty` requires unique values for one property across an array.
+
+Audit validators MUST implement these keywords rather than treating them as
+annotations. The TypeScript/Ajv parity suite in
+`src/audit/__tests__/schema-parity.test.ts` is the executable reference.
+
 ## Protocol Flow
 
 ```
@@ -107,6 +133,7 @@ These schemas implement types defined in the [KYA-OS Specification](../SPEC.md):
 - **Delegation Credentials**: SPEC.md §4.1–4.2
 - **Detached Proofs**: SPEC.md §5
 - **Discovery**: SPEC.md §14 (Transport Binding)
+- **Auditability**: [AUDITABILITY.md](../AUDITABILITY.md)
 
 ## Contributing
 

package/schemas/audit-anchor-receipt.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/anchor-receipt/v1.0.0",
+  "title": "KYA-OS Supporting Checkpoint Anchor Receipt v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "kind", "providerId", "checkpointDigest", "issuedAt"],
+  "properties": {
+    "schema": { "const": "https://schema.kya-os.org/v1/protocol/audit/anchor-receipt/v1.0.0" },
+    "kind": { "enum": ["worm", "rfc3161", "scitt"] },
+    "providerId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "checkpointDigest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "issuedAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "receiptData": { "type": "string", "minLength": 1, "maxLength": 65536 }
+  }
+}

package/schemas/audit-bundle-manifest.schema.json

@@ -0,0 +1,71 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/bundle-manifest/v1.0.0",
+  "title": "KYA-OS Audit Bundle Manifest Core v1",
+  "type": "object",
+  "additionalProperties": false,
+  "kyaUniqueProperty": { "array": "inventory", "property": "path" },
+  "required": ["schema", "bundleId", "formatVersion", "selections", "exporter", "purpose", "exportedAt", "verificationPolicyDigest", "inventory", "integritySuite"],
+  "properties": {
+    "schema": { "const": "https://schema.kya-os.org/v1/protocol/audit/bundle-manifest/v1.0.0" },
+    "bundleId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "formatVersion": { "const": "1.0.0" },
+    "selections": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/selection" } },
+    "exporter": { "$ref": "#/$defs/signerRef" },
+    "purpose": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "exportedAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "verificationPolicyDigest": { "$ref": "#/$defs/digest" },
+    "inventory": { "type": "array", "maxItems": 10000, "items": { "$ref": "#/$defs/inventoryItem" } },
+    "integritySuite": { "const": "KYA-AUDIT-BUNDLE-JCS-SHA256-JWS-2026" }
+  },
+  "$defs": {
+    "decimal": { "type": "string", "maxLength": 20, "pattern": "^(0|[1-9][0-9]*)$" },
+    "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "signerRef": {
+      "type": "object", "additionalProperties": false, "required": ["did", "kid", "alg"],
+      "properties": {
+        "did": { "type": "string", "minLength": 5, "maxLength": 2048, "pattern": "^did:[^\\r\\n]+$" },
+        "kid": { "type": "string", "minLength": 1, "maxLength": 2304 },
+        "alg": { "enum": ["EdDSA", "ES256"] }
+      }
+    },
+    "selection": {
+      "type": "object", "additionalProperties": false,
+      "kyaOrderedDecimalRange": { "first": "firstSequence", "last": "lastSequence" },
+      "required": ["ledgerId", "ledgerEpochId", "firstSequence", "lastSequence", "expectedHeadDigest", "checkpointTreeSizes"],
+      "properties": {
+        "ledgerId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "ledgerEpochId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "firstSequence": { "$ref": "#/$defs/decimal" },
+        "lastSequence": { "$ref": "#/$defs/decimal" },
+        "expectedHeadDigest": { "$ref": "#/$defs/digest" },
+        "checkpointTreeSizes": { "type": "array", "maxItems": 256, "items": { "$ref": "#/$defs/decimal" } }
+      }
+    },
+    "inventoryItem": {
+      "oneOf": [
+        {
+          "type": "object", "additionalProperties": false,
+          "required": ["path", "mediaType", "disposition", "digest", "size"],
+          "properties": {
+            "path": { "type": "string", "minLength": 1, "maxLength": 1024 },
+            "mediaType": { "type": "string", "minLength": 1, "maxLength": 256 },
+            "disposition": { "const": "included" },
+            "digest": { "$ref": "#/$defs/digest" },
+            "size": { "$ref": "#/$defs/decimal" }
+          }
+        },
+        {
+          "type": "object", "additionalProperties": false,
+          "required": ["path", "mediaType", "disposition", "reasonCode"],
+          "properties": {
+            "path": { "type": "string", "minLength": 1, "maxLength": 1024 },
+            "mediaType": { "type": "string", "minLength": 1, "maxLength": 256 },
+            "disposition": { "enum": ["redacted", "disposed", "unavailable", "policy_excluded"] },
+            "reasonCode": { "type": "string", "minLength": 1, "maxLength": 128 }
+          }
+        }
+      ]
+    }
+  }
+}

package/schemas/audit-checkpoint.schema.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/checkpoint/v1.0.0",
+  "title": "KYA-OS Audit Checkpoint Core v1",
+  "type": "object",
+  "additionalProperties": false,
+  "kyaOrderedDecimalRange": { "first": "firstSequence", "last": "lastSequence" },
+  "required": ["schema", "checkpointId", "ledgerId", "ledgerEpochId", "treeSize", "firstSequence", "lastSequence", "rootDigest", "headEntryDigest", "previousCheckpointDigest", "createdAt", "issuer", "integritySuite"],
+  "properties": {
+    "schema": { "const": "https://schema.kya-os.org/v1/protocol/audit/checkpoint/v1.0.0" },
+    "checkpointId": { "type": "string", "minLength": 1, "maxLength": 512 },
+    "ledgerId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "ledgerEpochId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "treeSize": { "$ref": "#/$defs/nonzeroDecimal" },
+    "firstSequence": { "$ref": "#/$defs/decimal" },
+    "lastSequence": { "$ref": "#/$defs/decimal" },
+    "rootDigest": { "$ref": "#/$defs/digest" },
+    "headEntryDigest": { "$ref": "#/$defs/digest" },
+    "previousCheckpointDigest": { "oneOf": [{ "$ref": "#/$defs/digest" }, { "type": "null" }] },
+    "createdAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "issuer": { "$ref": "#/$defs/signerRef" },
+    "integritySuite": { "const": "KYA-AUDIT-RFC9162-SHA256-JWS-2026" }
+  },
+  "$defs": {
+    "decimal": { "type": "string", "maxLength": 20, "pattern": "^(0|[1-9][0-9]*)$" },
+    "nonzeroDecimal": { "type": "string", "maxLength": 20, "pattern": "^[1-9][0-9]*$" },
+    "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "signerRef": {
+      "type": "object", "additionalProperties": false, "required": ["did", "kid", "alg"],
+      "properties": {
+        "did": { "type": "string", "minLength": 5, "maxLength": 2048, "pattern": "^did:[^\\r\\n]+$" },
+        "kid": { "type": "string", "minLength": 1, "maxLength": 2304 },
+        "alg": { "enum": ["EdDSA", "ES256"] }
+      }
+    }
+  }
+}

package/schemas/audit-consistency-proof.schema.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/consistency-proof/v1.0.0",
+  "title": "KYA-OS RFC 9162 Consistency Proof v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["oldTreeSize", "newTreeSize", "auditPath"],
+  "properties": {
+    "oldTreeSize": { "$ref": "#/$defs/decimal" },
+    "newTreeSize": { "$ref": "#/$defs/decimal" },
+    "auditPath": { "type": "array", "items": { "$ref": "#/$defs/digest" } }
+  },
+  "$defs": {
+    "decimal": { "type": "string", "maxLength": 20, "pattern": "^(0|[1-9][0-9]*)$" },
+    "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" }
+  }
+}

package/schemas/audit-entry.schema.json

@@ -0,0 +1,33 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/entry/v1.0.0",
+  "title": "KYA-OS Audit Entry Core v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "ledgerId", "ledgerEpochId", "sequence", "previousEntryDigest", "recordedAt", "recorder", "eventDigest", "event", "evidenceManifestDigest", "integritySuite"],
+  "properties": {
+    "schema": { "const": "https://schema.kya-os.org/v1/protocol/audit/entry/v1.0.0" },
+    "ledgerId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "ledgerEpochId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "sequence": { "$ref": "#/$defs/decimal" },
+    "previousEntryDigest": { "oneOf": [{ "$ref": "#/$defs/digest" }, { "type": "null" }] },
+    "recordedAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "recorder": { "$ref": "#/$defs/signerRef" },
+    "eventDigest": { "$ref": "#/$defs/digest" },
+    "event": { "$ref": "./audit-event.schema.json" },
+    "evidenceManifestDigest": { "$ref": "#/$defs/digest" },
+    "integritySuite": { "const": "KYA-AUDIT-JCS-SHA256-JWS-2026" }
+  },
+  "$defs": {
+    "decimal": { "type": "string", "maxLength": 20, "pattern": "^(0|[1-9][0-9]*)$" },
+    "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "signerRef": {
+      "type": "object", "additionalProperties": false, "required": ["did", "kid", "alg"],
+      "properties": {
+        "did": { "type": "string", "minLength": 5, "maxLength": 2048, "pattern": "^did:[^\\r\\n]+$" },
+        "kid": { "type": "string", "minLength": 1, "maxLength": 2304 },
+        "alg": { "enum": ["EdDSA", "ES256"] }
+      }
+    }
+  }
+}