@kya-os/mcp 1.11.0 → 1.12.0

package/dist/card/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/card/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAA6B,CAAC;AAE5E,eAAO,MAAM,uBAAuB,kCAAmC,CAAC;AAIxE,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,wEAAwE;IACxE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,6HAA6H;IAC7H,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAC/B,YAAY,EAAE,UAAU,EAAE,EAC1B,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,KAC3D,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAEpC,8EAA8E;AAC9E,MAAM,MAAM,mBAAmB,GAAG,CAChC,WAAW,EAAE,WAAW,EACxB,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,KAC3D,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,wGAAwG;IACxG,QAAQ,EAAE,OAAO,CAAC;IAClB,uGAAuG;IACvG,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACnC,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE;IAAE,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,KAC1D,OAAO,CAAC,OAAO,GAAG,oBAAoB,CAAC,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,WAAW,KACjB,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhC,MAAM,WAAW,cAAc;IAC7B,yFAAyF;IACzF,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,0FAA0F;IAC1F,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,8FAA8F;IAC9F,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD,qGAAqG;IACrG,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yFAAyF;IACzF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,iGAAiG;IACjG,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,qFAAqF;IACrF,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,oGAAoG;IACpG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oEAAoE;IACpE,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,kHAAkH;IAClH,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,EAAE,UAAU,CAAC;IACvB,iFAAiF;IACjF,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,cAAc,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACvG,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC3E,2EAA2E;IAC3E,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,cAAc,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvF,0FAA0F;IAC1F,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;IAClD,kFAAkF;IAClF,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8BlG;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,qBAAqB,EAC5B,OAAO,EAAE,OAAO,EAChB,eAAe,UAAO,GACrB,gBAAgB,CAIlB"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/card/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAA6B,CAAC;AAE5E,eAAO,MAAM,uBAAuB,kCAAmC,CAAC;AAIxE,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,wEAAwE;IACxE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,6HAA6H;IAC7H,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAC/B,YAAY,EAAE,UAAU,EAAE,EAC1B,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,KAC3D,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAEpC,8EAA8E;AAC9E,MAAM,MAAM,mBAAmB,GAAG,CAChC,WAAW,EAAE,WAAW,EACxB,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,KAC3D,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,wGAAwG;IACxG,QAAQ,EAAE,OAAO,CAAC;IAClB,uGAAuG;IACvG,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACnC,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE;IAAE,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,KAC1D,OAAO,CAAC,OAAO,GAAG,oBAAoB,CAAC,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,WAAW,KACjB,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhC,MAAM,WAAW,cAAc;IAC7B,yFAAyF;IACzF,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,0FAA0F;IAC1F,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,8FAA8F;IAC9F,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD,2GAA2G;IAC3G,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yFAAyF;IACzF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,iGAAiG;IACjG,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,qFAAqF;IACrF,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,oGAAoG;IACpG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oEAAoE;IACpE,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,kHAAkH;IAClH,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,EAAE,UAAU,CAAC;IACvB,iFAAiF;IACjF,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,cAAc,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACvG,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC3E,2EAA2E;IAC3E,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,cAAc,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvF,0FAA0F;IAC1F,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;IAClD,kFAAkF;IAClF,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8BlG;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,qBAAqB,EAC5B,OAAO,EAAE,OAAO,EAChB,eAAe,UAAO,GACrB,gBAAgB,CAIlB"}

package/dist/delegation/vc-verification-checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vc-verification-checks.d.ts","sourceRoot":"","sources":["../../src/delegation/vc-verification-checks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAM9B,OAAO,KAAK,EACV,WAAW,EAGX,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,8BAA8B,EAC/B,MAAM,wBAAwB,CAAC;AAShC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,oBAAoB,EACxB,OAAO,GAAE;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/C;IACD,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAuCA;AAqCD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,eAAe,EAAE;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,EACzE,YAAY,EAAE,iBAAiB,EAC/B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,8BAA8B,CAqBhC;AAED,gFAAgF;AAChF,wBAAsB,eAAe,CACnC,EAAE,EAAE,oBAAoB,EACxB,WAAW,EAAE,WAAW,GAAG,SAAS,EACpC,iBAAiB,EAAE,6BAA6B,GAAG,SAAS,GAC3D,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6EnE;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,gBAAgB,EACxB,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,GACjD,OAAO,CAAC,iBAAiB,CAAC,CAqC5B"}
+{"version":3,"file":"vc-verification-checks.d.ts","sourceRoot":"","sources":["../../src/delegation/vc-verification-checks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAO9B,OAAO,KAAK,EACV,WAAW,EAGX,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,8BAA8B,EAC/B,MAAM,wBAAwB,CAAC;AAShC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,oBAAoB,EACxB,OAAO,GAAE;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/C;IACD,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAuCA;AAqCD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,eAAe,EAAE;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,EACzE,YAAY,EAAE,iBAAiB,EAC/B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,8BAA8B,CAqBhC;AAED,gFAAgF;AAChF,wBAAsB,eAAe,CACnC,EAAE,EAAE,oBAAoB,EACxB,WAAW,EAAE,WAAW,GAAG,SAAS,EACpC,iBAAiB,EAAE,6BAA6B,GAAG,SAAS,GAC3D,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6FnE;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,gBAAgB,EACxB,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,GACjD,OAAO,CAAC,iBAAiB,CAAC,CAqC5B"}

package/dist/delegation/vc-verification-checks.js

@@ -5,7 +5,7 @@
  * checks, as pure functions. Extracted from `DelegationCredentialVerifier` (in
  * `./vc-verifier.ts`) so the class holds only orchestration + its cache.
  */
-import { isDelegationCredentialExpired, isDelegationCredentialNotYetValid, validateDelegationCredential, } from "../types/protocol.js";
+import { isDelegationCredentialExpired, isDelegationCredentialNotYetValid, isSupportedCredentialProofType, validateDelegationCredential, } from "../types/protocol.js";
 /**
  * Properties a DelegationCredential `credentialSubject` may carry. Anything
  * else is treated as a claim-intended field and rejected by default — a
@@ -114,6 +114,21 @@ export async function verifySignature(vc, didResolver, signatureVerifier) {
                 durationMs: Date.now() - startTime,
             };
         }
+        // Bind the declared proof suite to one this path can actually verify. The
+        // embedded-proof signature check below authenticates an Ed25519 signature
+        // over `proofValue`; a credential naming an unsupported/unknown `proof.type`
+        // must not verify merely because that signature happens to validate (#151).
+        // Checked here, before resolving the issuer DID, so an unrecognized suite
+        // fails fast without a network round-trip. The VC-JWT path skips signature
+        // verification entirely (its envelope JWS is the proof), so it never reaches
+        // this check and its `JwtProof2020` marker is correctly exempt.
+        if (vc.proof && !isSupportedCredentialProofType(vc.proof.type)) {
+            return {
+                valid: false,
+                reason: `Unsupported credential proof.type: ${String(vc.proof.type)}`,
+                durationMs: Date.now() - startTime,
+            };
+        }
         const didDoc = await didResolver.resolve(issuerDid);
         if (!didDoc) {
             return {

package/dist/delegation/vc-verification-checks.js.map

@@ -1 +1 @@
-{"version":3,"file":"vc-verification-checks.js","sourceRoot":"","sources":["../../src/delegation/vc-verification-checks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAW9B;;;;GAIG;AACH,MAAM,uBAAuB,GAAsB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,EAAwB,EACxB,UAA8C,EAAE;IAKhD,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,6BAA6B,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE;SACvE,CAAC;IACJ,CAAC;IAED,IAAI,6BAA6B,CAAC,EAAE,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,iCAAiC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC;IACnD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,YAAY,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,EAAwB;IAIpD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,MAAM,CACzD,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAChD,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM,EACJ,uDAAuD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAChF,sFAAsF;KACzF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,MAAmB,EACnB,oBAA4B;IAE5B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,CACpC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,oBAAoB,CACvC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,eAAyE,EACzE,YAA+B,EAC/B,YAAoB,EACpB,SAAiB;IAEjB,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC;IAC7D,OAAO;QACL,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,CAAC,QAAQ;YACf,CAAC,CAAC,eAAe,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,IAAI,iBAAiB;YACpE,CAAC,CAAC,SAAS;QACb,aAAa,EAAE,YAAY,CAAC,OAAO;QACnC,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE;YACP,YAAY;YACZ,gBAAgB,EAAE,eAAe,CAAC,UAAU,IAAI,CAAC;YACjD,aAAa,EAAE,YAAY,CAAC,UAAU,IAAI,CAAC;YAC3C,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SAChC;QACD,MAAM,EAAE;YACN,UAAU,EAAE,IAAI;YAChB,cAAc,EAAE,eAAe,CAAC,KAAK;YACrC,WAAW,EAAE,YAAY,CAAC,KAAK;SAChC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAwB,EACxB,WAAoC,EACpC,iBAA4D;IAE5D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,SAAS,GACb,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QAE3D,IAAI,CAAC,WAAW,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EACJ,iFAAiF;gBACnF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iCAAiC,SAAS,EAAE;gBACpD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,oBAAoB,GAAG,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC5D,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,kCAAkC;gBAC1C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,kBAAkB,GAAG,sBAAsB,CAC/C,MAAM,EACN,oBAA8B,CAC/B,CAAC;QACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uBAAuB,oBAAoB,YAAY;gBAC/D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,kBAAkB,CAAC,YAAY,CAAC;QACrD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,0CAA0C;gBAClD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,kBAAkB,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAErE,OAAO;YACL,KAAK,EAAE,kBAAkB,CAAC,KAAK;YAC/B,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;YACnG,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAwB,EACxB,kBAAkD;IAElD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EACJ,6GAA6G;gBAC/G,OAAO,EAAE,qBAAqB;gBAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAE/D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,0CAA0C,MAAM,CAAC,aAAa,GAAG;gBACzE,OAAO,EAAE,SAAS;gBAClB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;YACzF,OAAO,EAAE,qBAAqB;YAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"vc-verification-checks.js","sourceRoot":"","sources":["../../src/delegation/vc-verification-checks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAW9B;;;;GAIG;AACH,MAAM,uBAAuB,GAAsB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,EAAwB,EACxB,UAA8C,EAAE;IAKhD,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,6BAA6B,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE;SACvE,CAAC;IACJ,CAAC;IAED,IAAI,6BAA6B,CAAC,EAAE,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,iCAAiC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC;IACnD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACxD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,YAAY,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,EAAwB;IAIpD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,MAAM,CACzD,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAChD,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM,EACJ,uDAAuD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAChF,sFAAsF;KACzF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,MAAmB,EACnB,oBAA4B;IAE5B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,CACpC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,oBAAoB,CACvC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,eAAyE,EACzE,YAA+B,EAC/B,YAAoB,EACpB,SAAiB;IAEjB,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC;IAC7D,OAAO;QACL,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,CAAC,QAAQ;YACf,CAAC,CAAC,eAAe,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,IAAI,iBAAiB;YACpE,CAAC,CAAC,SAAS;QACb,aAAa,EAAE,YAAY,CAAC,OAAO;QACnC,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE;YACP,YAAY;YACZ,gBAAgB,EAAE,eAAe,CAAC,UAAU,IAAI,CAAC;YACjD,aAAa,EAAE,YAAY,CAAC,UAAU,IAAI,CAAC;YAC3C,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SAChC;QACD,MAAM,EAAE;YACN,UAAU,EAAE,IAAI;YAChB,cAAc,EAAE,eAAe,CAAC,KAAK;YACrC,WAAW,EAAE,YAAY,CAAC,KAAK;SAChC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAwB,EACxB,WAAoC,EACpC,iBAA4D;IAE5D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,SAAS,GACb,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QAE3D,IAAI,CAAC,WAAW,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EACJ,iFAAiF;gBACnF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,6EAA6E;QAC7E,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,gEAAgE;QAChE,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,8BAA8B,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,sCAAsC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;gBACrE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iCAAiC,SAAS,EAAE;gBACpD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,oBAAoB,GAAG,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC5D,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,kCAAkC;gBAC1C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,kBAAkB,GAAG,sBAAsB,CAC/C,MAAM,EACN,oBAA8B,CAC/B,CAAC;QACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uBAAuB,oBAAoB,YAAY;gBAC/D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,kBAAkB,CAAC,YAAY,CAAC;QACrD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,0CAA0C;gBAClD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,kBAAkB,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAErE,OAAO;YACL,KAAK,EAAE,kBAAkB,CAAC,KAAK;YAC/B,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;YACnG,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAwB,EACxB,kBAAkD;IAElD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EACJ,6GAA6G;gBAC/G,OAAO,EAAE,qBAAqB;gBAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAE/D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,0CAA0C,MAAM,CAAC,aAAa,GAAG;gBACzE,OAAO,EAAE,SAAS;gBAClB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;YACzF,OAAO,EAAE,qBAAqB;YAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/extension/declaration.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Reading a peer's `org.kya-os/decentralized-authority` declaration (SPEC-MCP-EXTENSION.md §3.1).
+ *
+ * Two carriage forms are normalized into one shape:
+ *
+ *   - stateless (2026-07-28): the request's
+ *     `params._meta["io.modelcontextprotocol/clientCapabilities"].extensions[id]`
+ *   - initialize-era (2025-11-25): `capabilities.extensions[id]` from the
+ *     initialize exchange, supplied by the host as `initializeCapabilities`
+ *
+ * Precedence: the per-request stateless entry, when PRESENT, is final - a
+ * malformed stateless entry is classified as `malformed` (never a silent
+ * fallback to the initialize-era entry), because the per-request carriage
+ * supersedes initialize-era state. What a malformed entry MEANS is the gate's
+ * call (§3.2): degrade-to-absent in optional mode, -32602 in required mode.
+ */
+import { type KyaOsExtensionSettings } from './settings.js';
+/** Which carriage form a declaration arrived on. */
+export type DeclarationCarriage = 'stateless' | 'initialize';
+/** A normalized, validated peer declaration. */
+export interface ExtensionDeclaration {
+    settings: KyaOsExtensionSettings;
+    carriage: DeclarationCarriage;
+}
+/** Input to {@link readExtensionDeclaration}; both carriage sources are optional. */
+export interface ReadDeclarationInput {
+    /** The request's `params._meta` bag (stateless carriage). */
+    meta?: unknown;
+    /** Initialize-era `ClientCapabilities` (2025-11-25 carriage). */
+    initializeCapabilities?: unknown;
+    /** Extension id override (defaults to {@link KYA_OS_EXTENSION_ID}). */
+    extensionId?: string;
+}
+/** The three outcomes of reading a peer's declaration (SPEC-MCP-EXTENSION.md §3.2). */
+export type DeclarationClassification = {
+    status: 'declared';
+    declaration: ExtensionDeclaration;
+} | {
+    status: 'absent';
+} | {
+    status: 'malformed';
+    carriage: DeclarationCarriage;
+};
+/**
+ * Classify the peer's declaration from either carriage, distinguishing a
+ * present-but-malformed entry from a genuinely absent one. That distinction is
+ * what lets the gate answer malformed with `-32602` in required mode (§3.2)
+ * while still degrading it to core behavior in optional mode - so a corrupted,
+ * untrusted, proof-excluded `_meta` member never turns an otherwise-valid
+ * optional-mode request into a rejection.
+ */
+export declare function classifyExtensionDeclaration(input: ReadDeclarationInput): DeclarationClassification;
+/**
+ * Read and validate the peer's declaration from either carriage.
+ * Returns `undefined` when there is no usable declaration - including a
+ * malformed one; callers that must distinguish malformed from absent (the gate)
+ * use {@link classifyExtensionDeclaration} instead.
+ */
+export declare function readExtensionDeclaration(input: ReadDeclarationInput): ExtensionDeclaration | undefined;
+//# sourceMappingURL=declaration.d.ts.map

package/dist/extension/declaration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"declaration.d.ts","sourceRoot":"","sources":["../../src/extension/declaration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,eAAe,CAAC;AAEvB,oDAAoD;AACpD,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,YAAY,CAAC;AAE7D,gDAAgD;AAChD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,sBAAsB,CAAC;IACjC,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,iEAAiE;IACjE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,uFAAuF;AACvF,MAAM,MAAM,yBAAyB,GACjC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,oBAAoB,CAAA;CAAE,GACzD;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAE3D;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,oBAAoB,GAC1B,yBAAyB,CAoB3B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,oBAAoB,GAC1B,oBAAoB,GAAG,SAAS,CAGlC"}

package/dist/extension/declaration.js

@@ -0,0 +1,75 @@
+/**
+ * Reading a peer's `org.kya-os/decentralized-authority` declaration (SPEC-MCP-EXTENSION.md §3.1).
+ *
+ * Two carriage forms are normalized into one shape:
+ *
+ *   - stateless (2026-07-28): the request's
+ *     `params._meta["io.modelcontextprotocol/clientCapabilities"].extensions[id]`
+ *   - initialize-era (2025-11-25): `capabilities.extensions[id]` from the
+ *     initialize exchange, supplied by the host as `initializeCapabilities`
+ *
+ * Precedence: the per-request stateless entry, when PRESENT, is final - a
+ * malformed stateless entry is classified as `malformed` (never a silent
+ * fallback to the initialize-era entry), because the per-request carriage
+ * supersedes initialize-era state. What a malformed entry MEANS is the gate's
+ * call (§3.2): degrade-to-absent in optional mode, -32602 in required mode.
+ */
+import { isRecord } from '../utils/guards.js';
+import { KYA_OS_EXTENSION_ID, MCP_CLIENT_CAPABILITIES_META_KEY, parseExtensionSettings, } from './settings.js';
+/**
+ * Classify the peer's declaration from either carriage, distinguishing a
+ * present-but-malformed entry from a genuinely absent one. That distinction is
+ * what lets the gate answer malformed with `-32602` in required mode (§3.2)
+ * while still degrading it to core behavior in optional mode - so a corrupted,
+ * untrusted, proof-excluded `_meta` member never turns an otherwise-valid
+ * optional-mode request into a rejection.
+ */
+export function classifyExtensionDeclaration(input) {
+    const id = input.extensionId ?? KYA_OS_EXTENSION_ID;
+    const stateless = extensionsEntry(clientCapabilitiesFromMeta(input.meta), id);
+    if (stateless.present) {
+        const settings = parseExtensionSettings(stateless.value);
+        return settings === undefined
+            ? { status: 'malformed', carriage: 'stateless' }
+            : { status: 'declared', declaration: { settings, carriage: 'stateless' } };
+    }
+    const legacy = extensionsEntry(input.initializeCapabilities, id);
+    if (legacy.present) {
+        const settings = parseExtensionSettings(legacy.value);
+        return settings === undefined
+            ? { status: 'malformed', carriage: 'initialize' }
+            : { status: 'declared', declaration: { settings, carriage: 'initialize' } };
+    }
+    return { status: 'absent' };
+}
+/**
+ * Read and validate the peer's declaration from either carriage.
+ * Returns `undefined` when there is no usable declaration - including a
+ * malformed one; callers that must distinguish malformed from absent (the gate)
+ * use {@link classifyExtensionDeclaration} instead.
+ */
+export function readExtensionDeclaration(input) {
+    const classification = classifyExtensionDeclaration(input);
+    return classification.status === 'declared' ? classification.declaration : undefined;
+}
+/** Pull `io.modelcontextprotocol/clientCapabilities` out of a `_meta` bag. */
+function clientCapabilitiesFromMeta(meta) {
+    return isRecord(meta) ? meta[MCP_CLIENT_CAPABILITIES_META_KEY] : undefined;
+}
+/**
+ * Locate the extension's entry inside a capabilities object. Presence is
+ * detected with `hasOwnProperty` so an explicit empty-object declaration
+ * (`{ "org.kya-os/decentralized-authority": {} }` - legal per SEP-2133) is distinguishable
+ * from an absent one.
+ */
+function extensionsEntry(capabilities, id) {
+    if (!isRecord(capabilities))
+        return { present: false };
+    const extensions = capabilities['extensions'];
+    if (!isRecord(extensions))
+        return { present: false };
+    if (!Object.prototype.hasOwnProperty.call(extensions, id))
+        return { present: false };
+    return { present: true, value: extensions[id] };
+}
+//# sourceMappingURL=declaration.js.map

package/dist/extension/declaration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declaration.js","sourceRoot":"","sources":["../../src/extension/declaration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,sBAAsB,GAEvB,MAAM,eAAe,CAAC;AA2BvB;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAA2B;IAE3B,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAEpD,MAAM,SAAS,GAAG,eAAe,CAAC,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,QAAQ,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE;YAChD,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,QAAQ,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE;YACjD,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAA2B;IAE3B,MAAM,cAAc,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC3D,OAAO,cAAc,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AAED,8EAA8E;AAC9E,SAAS,0BAA0B,CAAC,IAAa;IAC/C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,YAAqB,EACrB,EAAU;IAEV,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACvD,MAAM,UAAU,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACrF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;AAClD,CAAC"}

package/dist/extension/gate.d.ts

@@ -0,0 +1,110 @@
+/**
+ * The `org.kya-os/decentralized-authority` admission gate (SPEC-MCP-EXTENSION.md §4-§5).
+ *
+ * Mirrors the `requireProof` guard idiom (`src/card/middleware.ts`): the host
+ * builds a guard once from its server settings and runs it per request. Nothing
+ * in the default path changes for hosts that never install the gate - the
+ * extension is strictly opt-in.
+ *
+ *   - `required: false` (default): an undeclared peer gets core MCP behavior;
+ *     the gate always admits and merely reports the declaration when present. A
+ *     malformed declaration also degrades to core behavior here (§3.2), so a
+ *     corrupted untrusted `_meta` member can never reject a valid request.
+ *   - `required: true`: a request without a declaration is rejected with the
+ *     core MCP error `-32021` (`MissingRequiredClientCapabilityError`); a
+ *     present-but-malformed one is rejected with `-32602` (Invalid params,
+ *     `malformed_declaration`). Both carry this extension's `reason`/`extension`
+ *     pair, and exempt methods (`server/discover`, `ping` by default) are never
+ *     gated so discovery stays reachable.
+ *
+ * A stripped declaration is an ABSENT declaration (fail closed, §4.3) - never
+ * silent acceptance, never a guess.
+ */
+import { type ExtensionDeclaration } from './declaration.js';
+import { type KyaOsExtensionSettings } from './settings.js';
+/**
+ * Default JSON-RPC code for KYA-OS domain failures (SPEC-MCP-EXTENSION.md §5).
+ * The number is deliberately NOT the dispatch surface - clients dispatch on
+ * `error.data.reason` - and it sits outside the JSON-RPC reserved range
+ * (`-32768..-32000`), per the 2026-07-28 allocation policy: new codes MUST NOT
+ * be allocated in the legacy `-32000..-32019` sub-range and new
+ * implementations SHOULD NOT use that sub-range at all.
+ */
+export declare const KYA_OS_DOMAIN_ERROR_CODE = -31000;
+/**
+ * Methods a required-mode server never gates (SPEC-MCP-EXTENSION.md §4.2):
+ * `server/discover` MUST stay reachable so a non-declaring client can learn
+ * the requirement it fails; `ping` is exempted for peers on earlier protocol
+ * revisions.
+ */
+export declare const DEFAULT_EXEMPT_METHODS: readonly string[];
+/** A JSON-RPC error object (the `error` member of a JSON-RPC response). */
+export interface JsonRpcErrorObject {
+    code: number;
+    message: string;
+    data: {
+        /** The snake_case KYA-OS reason code - the mandatory dispatch surface (§5.2). */
+        reason: string;
+        /** The core schema's -32021 payload: the capabilities the server requires (§4.2). */
+        requiredCapabilities?: Record<string, unknown>;
+        /** The extension id, on negotiation failures. */
+        extension?: string;
+        /** The proof profile, on proof-gate failures. */
+        profile?: string;
+        /** Fine-grained verification reasons (SPEC-ENTITY-CARD Appendix D.1), for diagnostics. */
+        reasons?: string[];
+    };
+}
+/** The gate verdict: admitted (with the declaration when one was made) or a JSON-RPC rejection. */
+export type ExtensionGateResult = {
+    ok: true;
+    declaration?: ExtensionDeclaration;
+} | {
+    ok: false;
+    error: JsonRpcErrorObject;
+};
+/** Per-request admission guard built by {@link requireExtension}. */
+export type ExtensionGuard = (input: {
+    meta?: unknown;
+    initializeCapabilities?: unknown;
+    /** The request's JSON-RPC method; exempt methods are never gated in required mode (§4.2). */
+    method?: string;
+}) => ExtensionGateResult;
+/**
+ * Build the admission guard from the server's own settings (validated here,
+ * throwing on malformed OWN settings - a programmer error, unlike peer input).
+ */
+export declare function requireExtension(serverSettings?: KyaOsExtensionSettings, opts?: {
+    extensionId?: string;
+    exemptMethods?: readonly string[];
+}): ExtensionGuard;
+/** The `-32021` rejection for a required-but-undeclared extension (SPEC-MCP-EXTENSION.md §4.2). */
+export declare function missingRequiredCapabilityError(extensionId?: string): JsonRpcErrorObject;
+/** JSON-RPC "Invalid params" - the core code a present-but-malformed declaration rejects with (§3.2). */
+export declare const INVALID_PARAMS_CODE = -32602;
+/**
+ * The `-32602` rejection for a required-mode request whose declaration is present
+ * but malformed (SPEC-MCP-EXTENSION.md §3.2). Distinct from
+ * {@link missingRequiredCapabilityError}: a garbled declaration is a client-
+ * integrity error, not a missing one. In optional mode the gate never reaches
+ * here - a malformed declaration degrades to core behavior instead.
+ */
+export declare function malformedDeclarationError(extensionId?: string): JsonRpcErrorObject;
+/** The 401-shaped proof-gate error shape (`requireProof`, `src/card/middleware.ts`), structurally. */
+export interface ProofGateErrorLike {
+    /** A snake_case gate code (`proof_missing` | `proof_invalid` | `proof_level_insufficient`). */
+    code: string;
+    message: string;
+    reasons?: string[];
+}
+/**
+ * Map a proof-gate rejection onto the JSON-RPC surface per SPEC-MCP-EXTENSION.md
+ * §5.2: the snake_case code rides `error.data.reason` VERBATIM, the numeric code
+ * stays implementation-defined, and codes inside the MCP-reserved range
+ * (`-32099..-32020`) are refused outright.
+ */
+export declare function proofGateToJsonRpcError(gateError: ProofGateErrorLike, opts?: {
+    code?: number;
+    profile?: string;
+}): JsonRpcErrorObject;
+//# sourceMappingURL=gate.d.ts.map

package/dist/extension/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/extension/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAOL,KAAK,sBAAsB,EAC5B,MAAM,eAAe,CAAC;AAEvB;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,SAAS,CAAC;AAM/C;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAAgC,CAAC;AAErF,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE;QACJ,iFAAiF;QACjF,MAAM,EAAE,MAAM,CAAC;QACf,qFAAqF;QACrF,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/C,iDAAiD;QACjD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iDAAiD;QACjD,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,0FAA0F;QAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH;AAED,mGAAmG;AACnG,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,oBAAoB,CAAA;CAAE,GAChD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAE7C,qEAAqE;AACrE,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE;IACnC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,6FAA6F;IAC7F,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,KAAK,mBAAmB,CAAC;AAE1B;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,cAAc,GAAE,sBAA2B,EAC3C,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GACrE,cAAc,CA6BhB;AAED,mGAAmG;AACnG,wBAAgB,8BAA8B,CAC5C,WAAW,GAAE,MAA4B,GACxC,kBAAkB,CAUpB;AAED,yGAAyG;AACzG,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,GAAE,MAA4B,GACxC,kBAAkB,CASpB;AAED,sGAAsG;AACtG,MAAM,WAAW,kBAAkB;IACjC,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,kBAAkB,EAC7B,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7C,kBAAkB,CAkBpB"}

package/dist/extension/gate.js

@@ -0,0 +1,133 @@
+/**
+ * The `org.kya-os/decentralized-authority` admission gate (SPEC-MCP-EXTENSION.md §4-§5).
+ *
+ * Mirrors the `requireProof` guard idiom (`src/card/middleware.ts`): the host
+ * builds a guard once from its server settings and runs it per request. Nothing
+ * in the default path changes for hosts that never install the gate - the
+ * extension is strictly opt-in.
+ *
+ *   - `required: false` (default): an undeclared peer gets core MCP behavior;
+ *     the gate always admits and merely reports the declaration when present. A
+ *     malformed declaration also degrades to core behavior here (§3.2), so a
+ *     corrupted untrusted `_meta` member can never reject a valid request.
+ *   - `required: true`: a request without a declaration is rejected with the
+ *     core MCP error `-32021` (`MissingRequiredClientCapabilityError`); a
+ *     present-but-malformed one is rejected with `-32602` (Invalid params,
+ *     `malformed_declaration`). Both carry this extension's `reason`/`extension`
+ *     pair, and exempt methods (`server/discover`, `ping` by default) are never
+ *     gated so discovery stays reachable.
+ *
+ * A stripped declaration is an ABSENT declaration (fail closed, §4.3) - never
+ * silent acceptance, never a guess.
+ */
+import { PROOF_PROFILE_ID } from '../card/schema.js';
+import { classifyExtensionDeclaration, } from './declaration.js';
+import { EXTENSION_NOT_DECLARED_REASON, KYA_OS_EXTENSION_ID, MALFORMED_DECLARATION_REASON, MISSING_REQUIRED_CLIENT_CAPABILITY_CODE, buildExtensionSettings, resolveExtensionSettings, } from './settings.js';
+/**
+ * Default JSON-RPC code for KYA-OS domain failures (SPEC-MCP-EXTENSION.md §5).
+ * The number is deliberately NOT the dispatch surface - clients dispatch on
+ * `error.data.reason` - and it sits outside the JSON-RPC reserved range
+ * (`-32768..-32000`), per the 2026-07-28 allocation policy: new codes MUST NOT
+ * be allocated in the legacy `-32000..-32019` sub-range and new
+ * implementations SHOULD NOT use that sub-range at all.
+ */
+export const KYA_OS_DOMAIN_ERROR_CODE = -31000;
+/** The MCP-reserved code range this extension MUST NOT allocate from (§5.1). */
+const MCP_RESERVED_MIN = -32099;
+const MCP_RESERVED_MAX = -32020;
+/**
+ * Methods a required-mode server never gates (SPEC-MCP-EXTENSION.md §4.2):
+ * `server/discover` MUST stay reachable so a non-declaring client can learn
+ * the requirement it fails; `ping` is exempted for peers on earlier protocol
+ * revisions.
+ */
+export const DEFAULT_EXEMPT_METHODS = ['server/discover', 'ping'];
+/**
+ * Build the admission guard from the server's own settings (validated here,
+ * throwing on malformed OWN settings - a programmer error, unlike peer input).
+ */
+export function requireExtension(serverSettings = {}, opts = {}) {
+    const settings = resolveExtensionSettings(buildExtensionSettings(serverSettings));
+    const extensionId = opts.extensionId ?? KYA_OS_EXTENSION_ID;
+    const exemptMethods = opts.exemptMethods ?? DEFAULT_EXEMPT_METHODS;
+    return (input) => {
+        const classification = classifyExtensionDeclaration({ ...input, extensionId });
+        if (classification.status === 'declared') {
+            return { ok: true, declaration: classification.declaration };
+        }
+        // Optional mode: both absent AND malformed degrade to core MCP behavior. The
+        // declaration is an untrusted, intermediary-mutable, proof-excluded `_meta`
+        // member (§7), so rejecting on a malformed one would let a corrupting
+        // intermediary turn an otherwise-valid request into a failure while a mere
+        // strip lets it through - the "corrupt vs. strip" asymmetry (§3.2).
+        if (!settings.required) {
+            return { ok: true };
+        }
+        // Discovery/ping stay reachable so a non-declaring client can learn the requirement.
+        if (input.method !== undefined && exemptMethods.includes(input.method)) {
+            return { ok: true };
+        }
+        // Required mode rejects an absent declaration anyway, so surfacing the
+        // distinction carries no new DoS: a present-but-malformed declaration is a
+        // client-integrity error (-32602); a genuinely absent one is the
+        // missing-capability error (-32021).
+        return classification.status === 'malformed'
+            ? { ok: false, error: malformedDeclarationError(extensionId) }
+            : { ok: false, error: missingRequiredCapabilityError(extensionId) };
+    };
+}
+/** The `-32021` rejection for a required-but-undeclared extension (SPEC-MCP-EXTENSION.md §4.2). */
+export function missingRequiredCapabilityError(extensionId = KYA_OS_EXTENSION_ID) {
+    return {
+        code: MISSING_REQUIRED_CLIENT_CAPABILITY_CODE,
+        message: `Missing required client capability: ${extensionId}`,
+        data: {
+            requiredCapabilities: { extensions: { [extensionId]: {} } },
+            reason: EXTENSION_NOT_DECLARED_REASON,
+            extension: extensionId,
+        },
+    };
+}
+/** JSON-RPC "Invalid params" - the core code a present-but-malformed declaration rejects with (§3.2). */
+export const INVALID_PARAMS_CODE = -32602;
+/**
+ * The `-32602` rejection for a required-mode request whose declaration is present
+ * but malformed (SPEC-MCP-EXTENSION.md §3.2). Distinct from
+ * {@link missingRequiredCapabilityError}: a garbled declaration is a client-
+ * integrity error, not a missing one. In optional mode the gate never reaches
+ * here - a malformed declaration degrades to core behavior instead.
+ */
+export function malformedDeclarationError(extensionId = KYA_OS_EXTENSION_ID) {
+    return {
+        code: INVALID_PARAMS_CODE,
+        message: `Invalid params: the ${extensionId} settings declaration is present but malformed`,
+        data: {
+            reason: MALFORMED_DECLARATION_REASON,
+            extension: extensionId,
+        },
+    };
+}
+/**
+ * Map a proof-gate rejection onto the JSON-RPC surface per SPEC-MCP-EXTENSION.md
+ * §5.2: the snake_case code rides `error.data.reason` VERBATIM, the numeric code
+ * stays implementation-defined, and codes inside the MCP-reserved range
+ * (`-32099..-32020`) are refused outright.
+ */
+export function proofGateToJsonRpcError(gateError, opts = {}) {
+    if (opts.code !== undefined && opts.code >= MCP_RESERVED_MIN && opts.code <= MCP_RESERVED_MAX) {
+        throw new Error(`JSON-RPC code ${opts.code} is inside the MCP-reserved range (${MCP_RESERVED_MIN}..${MCP_RESERVED_MAX}); ` +
+            'KYA-OS domain errors use implementation-defined codes (SPEC-MCP-EXTENSION.md §5.1)');
+    }
+    return {
+        code: opts.code ?? KYA_OS_DOMAIN_ERROR_CODE,
+        message: gateError.message,
+        data: {
+            reason: gateError.code,
+            profile: opts.profile ?? PROOF_PROFILE_ID,
+            ...(gateError.reasons && gateError.reasons.length > 0
+                ? { reasons: [...gateError.reasons] }
+                : {}),
+        },
+    };
+}
+//# sourceMappingURL=gate.js.map

package/dist/extension/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/extension/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACL,4BAA4B,GAE7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,6BAA6B,EAC7B,mBAAmB,EACnB,4BAA4B,EAC5B,uCAAuC,EACvC,sBAAsB,EACtB,wBAAwB,GAEzB,MAAM,eAAe,CAAC;AAEvB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,KAAK,CAAC;AAE/C,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,CAAC,KAAK,CAAC;AAChC,MAAM,gBAAgB,GAAG,CAAC,KAAK,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;AAiCrF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,iBAAyC,EAAE,EAC3C,OAAoE,EAAE;IAEtE,MAAM,QAAQ,GAAG,wBAAwB,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC,CAAC;IAClF,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAC5D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,sBAAsB,CAAC;IACnE,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,MAAM,cAAc,GAAG,4BAA4B,CAAC,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC/E,IAAI,cAAc,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACzC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,EAAE,CAAC;QAC/D,CAAC;QACD,6EAA6E;QAC7E,4EAA4E;QAC5E,sEAAsE;QACtE,2EAA2E;QAC3E,oEAAoE;QACpE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,qFAAqF;QACrF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACvE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,uEAAuE;QACvE,2EAA2E;QAC3E,iEAAiE;QACjE,qCAAqC;QACrC,OAAO,cAAc,CAAC,MAAM,KAAK,WAAW;YAC1C,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,CAAC,WAAW,CAAC,EAAE;YAC9D,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,CAAC,WAAW,CAAC,EAAE,CAAC;IACxE,CAAC,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,8BAA8B,CAC5C,cAAsB,mBAAmB;IAEzC,OAAO;QACL,IAAI,EAAE,uCAAuC;QAC7C,OAAO,EAAE,uCAAuC,WAAW,EAAE;QAC7D,IAAI,EAAE;YACJ,oBAAoB,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE;YAC3D,MAAM,EAAE,6BAA6B;YACrC,SAAS,EAAE,WAAW;SACvB;KACF,CAAC;AACJ,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAK,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,cAAsB,mBAAmB;IAEzC,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,uBAAuB,WAAW,gDAAgD;QAC3F,IAAI,EAAE;YACJ,MAAM,EAAE,4BAA4B;YACpC,SAAS,EAAE,WAAW;SACvB;KACF,CAAC;AACJ,CAAC;AAUD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAA6B,EAC7B,OAA4C,EAAE;IAE9C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,IAAI,gBAAgB,IAAI,IAAI,CAAC,IAAI,IAAI,gBAAgB,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,CAAC,IAAI,sCAAsC,gBAAgB,KAAK,gBAAgB,KAAK;YACxG,oFAAoF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,wBAAwB;QAC3C,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,IAAI,EAAE;YACJ,MAAM,EAAE,SAAS,CAAC,IAAI;YACtB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,gBAAgB;YACzC,GAAG,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBACnD,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,EAAE;gBACrC,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;AACJ,CAAC"}

package/dist/extension/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * KYA-OS MCP extension negotiation (`org.kya-os/decentralized-authority`).
+ *
+ * The MCP binding surface of SPEC-MCP-EXTENSION.md: the extension id and
+ * settings object (§1, §3), the declaration reader for both carriage forms
+ * (§3.1), the admission gate with core `-32021` required-mode enforcement
+ * (§4), and the JSON-RPC error mapping that keeps snake_case reason codes as
+ * the dispatch surface (§5). Strictly additive: nothing here runs unless the
+ * host opts in.
+ */
+export { KYA_OS_EXTENSION_ID, MCP_CLIENT_CAPABILITIES_META_KEY, MISSING_REQUIRED_CLIENT_CAPABILITY_CODE, EXTENSION_NOT_DECLARED_REASON, ExtensionSettingsSchema, DEFAULT_EXTENSION_SETTINGS, parseExtensionSettings, resolveExtensionSettings, buildExtensionSettings, buildExtensionsEntry, type KyaOsExtensionSettings, type ResolvedExtensionSettings, } from './settings.js';
+export { readExtensionDeclaration, type DeclarationCarriage, type ExtensionDeclaration, type ReadDeclarationInput, } from './declaration.js';
+export { KYA_OS_DOMAIN_ERROR_CODE, DEFAULT_EXEMPT_METHODS, requireExtension, missingRequiredCapabilityError, proofGateToJsonRpcError, type ExtensionGateResult, type ExtensionGuard, type JsonRpcErrorObject, type ProofGateErrorLike, } from './gate.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/extension/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/extension/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,uCAAuC,EACvC,6BAA6B,EAC7B,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,GAC/B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,wBAAwB,EACxB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,gBAAgB,EAChB,8BAA8B,EAC9B,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,WAAW,CAAC"}

package/dist/extension/index.js

@@ -0,0 +1,14 @@
+/**
+ * KYA-OS MCP extension negotiation (`org.kya-os/decentralized-authority`).
+ *
+ * The MCP binding surface of SPEC-MCP-EXTENSION.md: the extension id and
+ * settings object (§1, §3), the declaration reader for both carriage forms
+ * (§3.1), the admission gate with core `-32021` required-mode enforcement
+ * (§4), and the JSON-RPC error mapping that keeps snake_case reason codes as
+ * the dispatch surface (§5). Strictly additive: nothing here runs unless the
+ * host opts in.
+ */
+export { KYA_OS_EXTENSION_ID, MCP_CLIENT_CAPABILITIES_META_KEY, MISSING_REQUIRED_CLIENT_CAPABILITY_CODE, EXTENSION_NOT_DECLARED_REASON, ExtensionSettingsSchema, DEFAULT_EXTENSION_SETTINGS, parseExtensionSettings, resolveExtensionSettings, buildExtensionSettings, buildExtensionsEntry, } from './settings.js';
+export { readExtensionDeclaration, } from './declaration.js';
+export { KYA_OS_DOMAIN_ERROR_CODE, DEFAULT_EXEMPT_METHODS, requireExtension, missingRequiredCapabilityError, proofGateToJsonRpcError, } from './gate.js';
+//# sourceMappingURL=index.js.map

package/dist/extension/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/extension/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,uCAAuC,EACvC,6BAA6B,EAC7B,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,GAGrB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,wBAAwB,GAIzB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,gBAAgB,EAChB,8BAA8B,EAC9B,uBAAuB,GAKxB,MAAM,WAAW,CAAC"}

package/dist/extension/settings.d.ts

@@ -0,0 +1,70 @@
+/**
+ * KYA-OS MCP extension negotiation - identifiers and the settings object
+ * (SPEC-MCP-EXTENSION.md §1, §3; wire schema: `schemas/mcp-extension-settings.json`).
+ *
+ * The extension is declared under `capabilities.extensions["org.kya-os/decentralized-authority"]`
+ * as a small settings object. Per SEP-2133 an empty object means "supported, with
+ * default configuration". Every identifier lives here as a single constant
+ * (mirroring `KYA_OS_PROOF_META_KEY`), so a future re-pointing of the extension id
+ * (SEP-2133 graduation) is a constant change, never a call-site sweep.
+ */
+import { z } from 'zod';
+/** The proposed reverse-DNS MCP extension id (SPEC-MCP-EXTENSION.md §1.1). */
+export declare const KYA_OS_EXTENSION_ID = "org.kya-os/decentralized-authority";
+/** The per-request `_meta` key carrying MCP `ClientCapabilities` (SEP-2575, stateless carriage). */
+export declare const MCP_CLIENT_CAPABILITIES_META_KEY = "io.modelcontextprotocol/clientCapabilities";
+/** Core MCP `MissingRequiredClientCapabilityError` code (2026-07-28 error allocation policy). */
+export declare const MISSING_REQUIRED_CLIENT_CAPABILITY_CODE = -32021;
+/**
+ * The reason codes this extension defines itself (SPEC-MCP-EXTENSION.md §5.2),
+ * each riding the `data.reason` member of a core JSON-RPC error:
+ * `extension_not_declared` inside a `-32021` (required mode, no declaration) and
+ * `malformed_declaration` inside a `-32602` (required mode, a present-but-
+ * unparseable declaration). Every other reason code is defined by
+ * SPEC-ENTITY-CARD Appendix D or SPEC.md Appendix A.
+ */
+export declare const EXTENSION_NOT_DECLARED_REASON = "extension_not_declared";
+export declare const MALFORMED_DECLARATION_REASON = "malformed_declaration";
+/**
+ * Zod mirror of `schemas/mcp-extension-settings.json`: every member OPTIONAL,
+ * unknown members tolerated (and stripped on parse) for forward compatibility.
+ * `required` is meaningful only on a server declaration and ignored client-side
+ * (SPEC-MCP-EXTENSION.md §3.2).
+ */
+export declare const ExtensionSettingsSchema: z.ZodObject<{
+    version: z.ZodOptional<z.ZodString>;
+    proofProfiles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    didMethods: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    required: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+/** A declared (wire-shaped) settings object; all members optional, `{}` legal. */
+export type KyaOsExtensionSettings = z.infer<typeof ExtensionSettingsSchema>;
+/** Settings with every default applied (SPEC-MCP-EXTENSION.md §3.2 defaults column). */
+export interface ResolvedExtensionSettings {
+    version: string;
+    proofProfiles: string[];
+    didMethods: string[];
+    required: boolean;
+}
+/** The §3.2 defaults an empty declaration resolves to. */
+export declare const DEFAULT_EXTENSION_SETTINGS: ResolvedExtensionSettings;
+/**
+ * Parse a PEER's settings value. A malformed value returns `undefined` - the
+ * declaration is treated as ABSENT (fail closed to non-declaration, never a
+ * guess at intent; SPEC-MCP-EXTENSION.md §3.2). `{}` parses successfully.
+ */
+export declare function parseExtensionSettings(value: unknown): KyaOsExtensionSettings | undefined;
+/** Apply the §3.2 defaults to a declared settings object. */
+export declare function resolveExtensionSettings(settings?: KyaOsExtensionSettings): ResolvedExtensionSettings;
+/**
+ * Validate OWN settings before putting them on the wire. Unlike a peer's input
+ * (parsed fail-closed), malformed own settings are a programmer error and throw.
+ */
+export declare function buildExtensionSettings(settings?: KyaOsExtensionSettings): KyaOsExtensionSettings;
+/**
+ * Build the `extensions` map fragment - `{ "org.kya-os/decentralized-authority": settings }` -
+ * ready to merge into `ClientCapabilities.extensions` / `ServerCapabilities.extensions`
+ * (or the per-request `_meta` carriage; SPEC-MCP-EXTENSION.md §3.1).
+ */
+export declare function buildExtensionsEntry(settings?: KyaOsExtensionSettings, extensionId?: string): Record<string, KyaOsExtensionSettings>;
+//# sourceMappingURL=settings.d.ts.map

package/dist/extension/settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../src/extension/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,uCAAuC,CAAC;AAExE,oGAAoG;AACpG,eAAO,MAAM,gCAAgC,+CAA+C,CAAC;AAE7F,iGAAiG;AACjG,eAAO,MAAM,uCAAuC,SAAS,CAAC;AAE9D;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,2BAA2B,CAAC;AACtE,eAAO,MAAM,4BAA4B,0BAA0B,CAAC;AAOpE;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;iBAalC,CAAC;AAEH,kFAAkF;AAClF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE7E,wFAAwF;AACxF,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,0DAA0D;AAC1D,eAAO,MAAM,0BAA0B,EAAE,yBAKxC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,GAAG,SAAS,CAGzF;AAED,6DAA6D;AAC7D,wBAAgB,wBAAwB,CACtC,QAAQ,GAAE,sBAA2B,GACpC,yBAAyB,CAO3B;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,GAAE,sBAA2B,GACpC,sBAAsB,CAMxB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,GAAE,sBAA2B,EACrC,WAAW,GAAE,MAA4B,GACxC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAExC"}