@kya-os/mcp 1.11.0 → 1.13.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +48 -0
- package/CONFORMANCE.md +16 -8
- package/README.md +2 -2
- package/SPEC.md +23 -30
- package/dist/audit/index.d.ts +3 -0
- package/dist/audit/index.d.ts.map +1 -1
- package/dist/audit/index.js +3 -0
- package/dist/audit/index.js.map +1 -1
- package/dist/audit/read-contract.d.ts +445 -0
- package/dist/audit/read-contract.d.ts.map +1 -0
- package/dist/audit/read-contract.js +126 -0
- package/dist/audit/read-contract.js.map +1 -0
- package/dist/audit/read-service.d.ts +99 -0
- package/dist/audit/read-service.d.ts.map +1 -0
- package/dist/audit/read-service.js +124 -0
- package/dist/audit/read-service.js.map +1 -0
- package/dist/audit/reference-recorder.d.ts +43 -0
- package/dist/audit/reference-recorder.d.ts.map +1 -0
- package/dist/audit/reference-recorder.js +131 -0
- package/dist/audit/reference-recorder.js.map +1 -0
- package/dist/audit/schemas.d.ts +1 -0
- package/dist/audit/schemas.d.ts.map +1 -1
- package/dist/audit/schemas.js +1 -1
- package/dist/audit/schemas.js.map +1 -1
- package/dist/card/builder.d.ts +1 -1
- package/dist/card/builder.js +1 -1
- package/dist/card/emit.d.ts +3 -3
- package/dist/card/emit.d.ts.map +1 -1
- package/dist/card/emit.js.map +1 -1
- package/dist/card/index.d.ts +1 -1
- package/dist/card/index.js +1 -1
- package/dist/card/middleware.d.ts +6 -4
- package/dist/card/middleware.d.ts.map +1 -1
- package/dist/card/middleware.js +11 -7
- package/dist/card/middleware.js.map +1 -1
- package/dist/card/proof/build.d.ts +3 -3
- package/dist/card/proof/build.js +3 -3
- package/dist/card/proof/http-sig.d.ts +1 -1
- package/dist/card/proof/http-sig.js +1 -1
- package/dist/card/proof/index.d.ts +2 -2
- package/dist/card/proof/index.js +2 -2
- package/dist/card/proof/nonce-cache.d.ts +1 -1
- package/dist/card/proof/nonce-cache.js +1 -1
- package/dist/card/proof/types.d.ts +16 -7
- package/dist/card/proof/types.d.ts.map +1 -1
- package/dist/card/proof/types.js +16 -7
- package/dist/card/proof/types.js.map +1 -1
- package/dist/card/proof/verify.d.ts +2 -2
- package/dist/card/proof/verify.js +2 -2
- package/dist/card/schema.d.ts +14 -6
- package/dist/card/schema.d.ts.map +1 -1
- package/dist/card/schema.js +14 -3
- package/dist/card/schema.js.map +1 -1
- package/dist/card/verify.d.ts +1 -1
- package/dist/card/verify.d.ts.map +1 -1
- package/dist/delegation/index.d.ts +1 -0
- package/dist/delegation/index.d.ts.map +1 -1
- package/dist/delegation/index.js +1 -0
- package/dist/delegation/index.js.map +1 -1
- package/dist/delegation/status-cache.d.ts +9 -0
- package/dist/delegation/status-cache.d.ts.map +1 -0
- package/dist/delegation/status-cache.js +20 -0
- package/dist/delegation/status-cache.js.map +1 -0
- package/dist/delegation/vc-verification-checks.d.ts.map +1 -1
- package/dist/delegation/vc-verification-checks.js +16 -1
- package/dist/delegation/vc-verification-checks.js.map +1 -1
- package/dist/delegation/vc-verifier.d.ts +31 -15
- package/dist/delegation/vc-verifier.d.ts.map +1 -1
- package/dist/delegation/vc-verifier.js +71 -78
- package/dist/delegation/vc-verifier.js.map +1 -1
- package/dist/delegation/vc-verifier.types.d.ts +18 -0
- package/dist/delegation/vc-verifier.types.d.ts.map +1 -1
- package/dist/extension/declaration.d.ts +60 -0
- package/dist/extension/declaration.d.ts.map +1 -0
- package/dist/extension/declaration.js +75 -0
- package/dist/extension/declaration.js.map +1 -0
- package/dist/extension/gate.d.ts +110 -0
- package/dist/extension/gate.d.ts.map +1 -0
- package/dist/extension/gate.js +133 -0
- package/dist/extension/gate.js.map +1 -0
- package/dist/extension/index.d.ts +14 -0
- package/dist/extension/index.d.ts.map +1 -0
- package/dist/extension/index.js +14 -0
- package/dist/extension/index.js.map +1 -0
- package/dist/extension/settings.d.ts +70 -0
- package/dist/extension/settings.d.ts.map +1 -0
- package/dist/extension/settings.js +96 -0
- package/dist/extension/settings.js.map +1 -0
- package/dist/index.d.ts +2 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +3 -1
- package/dist/index.js.map +1 -1
- package/dist/middleware/kya-os-transport.d.ts +1 -1
- package/dist/middleware/kya-os-transport.js +1 -1
- package/dist/middleware/with-kya-os.config-types.d.ts +13 -0
- package/dist/middleware/with-kya-os.config-types.d.ts.map +1 -1
- package/dist/middleware/with-kya-os.delegation-verify.d.ts.map +1 -1
- package/dist/middleware/with-kya-os.delegation-verify.js +4 -2
- package/dist/middleware/with-kya-os.delegation-verify.js.map +1 -1
- package/dist/proof/generator.d.ts +14 -2
- package/dist/proof/generator.d.ts.map +1 -1
- package/dist/proof/generator.js +14 -2
- package/dist/proof/generator.js.map +1 -1
- package/dist/proof/index.d.ts +1 -1
- package/dist/proof/index.d.ts.map +1 -1
- package/dist/proof/index.js +1 -1
- package/dist/proof/index.js.map +1 -1
- package/dist/proof/verifier.d.ts +3 -2
- package/dist/proof/verifier.d.ts.map +1 -1
- package/dist/proof/verifier.js +13 -8
- package/dist/proof/verifier.js.map +1 -1
- package/dist/types/protocol.d.ts +22 -0
- package/dist/types/protocol.d.ts.map +1 -1
- package/dist/types/protocol.js +31 -5
- package/dist/types/protocol.js.map +1 -1
- package/dist/utils/ttl-cache.d.ts +26 -0
- package/dist/utils/ttl-cache.d.ts.map +1 -0
- package/dist/utils/ttl-cache.js +68 -0
- package/dist/utils/ttl-cache.js.map +1 -0
- package/package.json +1 -1
- package/schemas/README.md +1 -0
- package/schemas/kya-os-card.schema.json +6 -6
- package/schemas/mcp-extension-settings.json +37 -0
package/dist/card/emit.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../src/card/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAEL,oBAAoB,EAIrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,UAAU,EACf,KAAK,UAAU,EAChB,MAAM,aAAa,CAAC;AAErB;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,8CAA8C,CAAC;AACnF,qEAAqE;AACrE,eAAO,MAAM,+BAA+B,qDAAqD,CAAC;AAClG,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB,yCAAyC,CAAC;AAC7E,4FAA4F;AAC5F,eAAO,MAAM,aAAa,
|
|
1
|
+
{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../src/card/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAEL,oBAAoB,EAIrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,wBAAwB,EAC7B,KAAK,UAAU,EACf,KAAK,UAAU,EAChB,MAAM,aAAa,CAAC;AAErB;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,8CAA8C,CAAC;AACnF,qEAAqE;AACrE,eAAO,MAAM,+BAA+B,qDAAqD,CAAC;AAClG,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB,yCAAyC,CAAC;AAC7E,4FAA4F;AAC5F,eAAO,MAAM,aAAa,wBAAmB,CAAC;AAI9C,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,wBAAwB,CAAC;CACvC;AAED,gFAAgF;AAChF,MAAM,MAAM,YAAY,GAAG;IAAE,oBAAoB,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,sFAAsF;AACtF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,oBAAoB,EAAE,iBAAiB,GAAG,YAAY,CAAC,CAAC;AAEnG,+DAA+D;AAC/D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,cAAc,CAAC;CACvB;AAED,0DAA0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE;QACN,EAAE,EAAE,MAAM,CAAC;QACX,UAAU,EAAE,OAAO,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,6FAA6F;QAC7F,YAAY,CAAC,EAAE,YAAY,CAAC;KAC7B,CAAC;CACH;AAED,6CAA6C;AAC7C,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,UAAU,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAID;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,GAAE,eAAoB,GAAG,eAAe,CAM/F;AAED,+FAA+F;AAC/F,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,eAAe,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/C,cAAc,CAKhB;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,CAE7D;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,eAAe,GAAG;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAClD,YAAY,CAkBd;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAazD"}
|
package/dist/card/emit.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"emit.js","sourceRoot":"","sources":["../../src/card/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,gBAAgB,
|
|
1
|
+
{"version":3,"file":"emit.js","sourceRoot":"","sources":["../../src/card/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,gBAAgB,GAKjB,MAAM,aAAa,CAAC;AAYrB,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,2CAA2C,CAAC;AACnF,qEAAqE;AACrE,MAAM,CAAC,MAAM,+BAA+B,GAAG,kDAAkD,CAAC;AAClG,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,sCAAsC,CAAC;AAC7E,4FAA4F;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAuE9C,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAgB,EAAE,OAAwB,EAAE;IAC5E,OAAO;QACL,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,wBAAwB;QAC9B,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,gBAAgB,CAC9B,IAAgB,EAChB,OAA8C,EAAE;IAEhD,MAAM,KAAK,GAAqC,IAAI,CAAC,KAAK;QACxD,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAC7E,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,IAAgB;IAC7C,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAgB,EAChB,OAAiD,EAAE;IAEnD,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,gFAAgF,IAAI,CAAC,UAAU,IAAI,CACpG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAA2B;QACrC,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,UAAU,EAAE,OAAO;QACnB,OAAO,EAAE,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IAC7E,OAAO;QACL,GAAG,EAAE,uBAAuB;QAC5B,WAAW,EAAE,+BAA+B;QAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;QAChC,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAgB;IAC3C,MAAM,KAAK,GAAe;QACxB,UAAU,EAAE,EAAE,GAAG,EAAE,sBAAsB,EAAE;QAC3C,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,UAAU,EAAE,IAAI,CAAC,IAAI;QACrB,gBAAgB,EAAE,IAAI,CAAC,UAAU;KAClC,CAAC;IACF,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS;QAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC7E,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,KAAK,CAAC,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7F,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS;QAAE,KAAK,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC/F,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,KAAK,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;IACnF,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;QAAE,KAAK,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC;IACtF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAE/E;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,IAAgB;IACnC,MAAM,OAAO,GAAsB,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACjG,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,CAAC,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/F,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS;QAAE,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC1F,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IACjF,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9E,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACxE,OAAO,OAAO,CAAC;AACjB,CAAC"}
|
package/dist/card/index.d.ts
CHANGED
|
@@ -13,7 +13,7 @@
|
|
|
13
13
|
* - cimd (./cimd): BIND the L1 CIMD on-ramp — `client_id` ⇄ `did:web`, DID-keyed
|
|
14
14
|
* JWKS, and the fail-closed origin/`alsoKnownAs` substitution graft.
|
|
15
15
|
* - proof (./proof): MINT + VERIFY the stateless per-request holder-of-key proof
|
|
16
|
-
* (`org.kya-os/proof
|
|
16
|
+
* (`org.kya-os/proof.v1`) — sender-constrained, fail-closed.
|
|
17
17
|
* - delegation (./delegation): VALIDATE the W3C VC 2.0 + ZCAP-LD delegation chain — CRISP
|
|
18
18
|
* attenuation + continuity, `responsibleParty`/leaf-invoker, fail-closed.
|
|
19
19
|
* - builder (./builder): the fluent `card()` chain — the 10-minute path to a valid card.
|
package/dist/card/index.js
CHANGED
|
@@ -13,7 +13,7 @@
|
|
|
13
13
|
* - cimd (./cimd): BIND the L1 CIMD on-ramp — `client_id` ⇄ `did:web`, DID-keyed
|
|
14
14
|
* JWKS, and the fail-closed origin/`alsoKnownAs` substitution graft.
|
|
15
15
|
* - proof (./proof): MINT + VERIFY the stateless per-request holder-of-key proof
|
|
16
|
-
* (`org.kya-os/proof
|
|
16
|
+
* (`org.kya-os/proof.v1`) — sender-constrained, fail-closed.
|
|
17
17
|
* - delegation (./delegation): VALIDATE the W3C VC 2.0 + ZCAP-LD delegation chain — CRISP
|
|
18
18
|
* attenuation + continuity, `responsibleParty`/leaf-invoker, fail-closed.
|
|
19
19
|
* - builder (./builder): the fluent `card()` chain — the 10-minute path to a valid card.
|
|
@@ -10,7 +10,7 @@
|
|
|
10
10
|
* both immutably (a shallow clone; a stripped `_meta` degrades to a fetch, never a failure).
|
|
11
11
|
*
|
|
12
12
|
* - `requireProof(deps, { minLevel? })` — the VERIFY side. Returns a per-request guard that
|
|
13
|
-
* reads the holder-of-key proof from `_meta['org.kya-os/proof
|
|
13
|
+
* reads the holder-of-key proof from `_meta['org.kya-os/request-proof']` (legacy `org.kya-os/proof.v1` accepted), RECOMPUTES it via
|
|
14
14
|
* `./proof` ({@link verifyCardProof}) — every binding, fail-closed — enforces a minimum
|
|
15
15
|
* assurance, and returns a 401-shaped result on any failure. The caller passes the exact
|
|
16
16
|
* `{ method, params }` the client signed (i.e. WITHOUT `_meta`), so the recomputed
|
|
@@ -94,7 +94,7 @@ export interface RequireProofOptions {
|
|
|
94
94
|
}
|
|
95
95
|
/**
|
|
96
96
|
* Build a per-request holder-of-key guard from the pre-bound proof-verification seams. The returned
|
|
97
|
-
* guard reads `_meta['org.kya-os/proof
|
|
97
|
+
* guard reads `_meta['org.kya-os/request-proof']` (legacy `org.kya-os/proof.v1` accepted), RECOMPUTES it against the request via {@link verifyCardProof},
|
|
98
98
|
* enforces `opts.minLevel`, and returns `{ ok: true, did, level }` or a 401-shaped rejection. Fail-closed
|
|
99
99
|
* throughout: a missing proof, a broken binding, a throwing verifier, or an assurance below `minLevel`
|
|
100
100
|
* all reject.
|
|
@@ -106,7 +106,9 @@ export interface RequireProofOptions {
|
|
|
106
106
|
* request FAILS CLOSED (`nonce_seam_missing`).
|
|
107
107
|
*/
|
|
108
108
|
export declare function requireProof(deps: VerifyProofDeps, opts?: RequireProofOptions): ProofGuard;
|
|
109
|
-
/** Read the card proof
|
|
110
|
-
*
|
|
109
|
+
/** Read the card proof out of a `_meta` record (undefined when absent / not an object). Reads the
|
|
110
|
+
* canonical `org.kya-os/request-proof` key, falling back to the earlier draft key (`org.kya-os/proof.v1`,
|
|
111
|
+
* accepted for one major version); the canonical key wins when both are present. A legacy session
|
|
112
|
+
* proof under `org.kya-os/proof` is a different key and is simply not seen. */
|
|
111
113
|
export declare function readCardProof(meta: unknown): unknown;
|
|
112
114
|
//# sourceMappingURL=middleware.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/card/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AACnB,OAAO,
|
|
1
|
+
{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/card/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EAIL,KAAK,cAAc,EAEnB,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAI9C,wFAAwF;AACxF,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,kGAAkG;AAClG,MAAM,WAAW,cAAc;IAC7B,uFAAuF;IACvF,QAAQ,EAAE,UAAU,CAAC;IACrB;;;OAGG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,8DAA8D;IAC9D,UAAU,EAAE,cAAc,CAAC;IAC3B,qGAAqG;IACrG,eAAe,CAAC,CAAC,SAAS,cAAc,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACjG,0GAA0G;IAC1G,gBAAgB,CAAC,CAAC,SAAS,eAAe,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;CACpF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,cAAc,CA4B9F;AAsBD,kGAAkG;AAClG,MAAM,MAAM,aAAa,GAAG,cAAc,CAAC;AAE3C,gFAAgF;AAChF,MAAM,MAAM,aAAa,GAAG,eAAe,GAAG,eAAe,GAAG,0BAA0B,CAAC;AAE3F,iGAAiG;AACjG,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,qGAAqG;AACrG,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACrE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,CAAC;AAEtD;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAEvF,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,sFAAsF;IACtF,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAKD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,GAAE,mBAAwB,GAAG,UAAU,CAsB9F;AAED;;;gFAGgF;AAChF,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAGpD"}
|
package/dist/card/middleware.js
CHANGED
|
@@ -10,7 +10,7 @@
|
|
|
10
10
|
* both immutably (a shallow clone; a stripped `_meta` degrades to a fetch, never a failure).
|
|
11
11
|
*
|
|
12
12
|
* - `requireProof(deps, { minLevel? })` — the VERIFY side. Returns a per-request guard that
|
|
13
|
-
* reads the holder-of-key proof from `_meta['org.kya-os/proof
|
|
13
|
+
* reads the holder-of-key proof from `_meta['org.kya-os/request-proof']` (legacy `org.kya-os/proof.v1` accepted), RECOMPUTES it via
|
|
14
14
|
* `./proof` ({@link verifyCardProof}) — every binding, fail-closed — enforces a minimum
|
|
15
15
|
* assurance, and returns a 401-shaped result on any failure. The caller passes the exact
|
|
16
16
|
* `{ method, params }` the client signed (i.e. WITHOUT `_meta`), so the recomputed
|
|
@@ -20,7 +20,7 @@
|
|
|
20
20
|
*/
|
|
21
21
|
import { isRecord } from '../utils/guards.js';
|
|
22
22
|
import { toDidServiceEntry, toServerCardMeta, } from './emit.js';
|
|
23
|
-
import { verifyCardProof, KYA_OS_CARD_PROOF_META_KEY, } from './proof/index.js';
|
|
23
|
+
import { verifyCardProof, KYA_OS_CARD_PROOF_META_KEY, LEGACY_CARD_PROOF_META_KEY, } from './proof/index.js';
|
|
24
24
|
/**
|
|
25
25
|
* Bundle a card into its three discovery artifacts and hand back immutable mounters. `opts.byRef`
|
|
26
26
|
* projects the `_meta` as a lazy-fetch `cardRef` instead of an inline summary. NOTE: the DID
|
|
@@ -66,7 +66,7 @@ function appendService(didDoc, entry) {
|
|
|
66
66
|
const ASSURANCE_RANK = { 'L3-minus': 1, L3: 2 };
|
|
67
67
|
/**
|
|
68
68
|
* Build a per-request holder-of-key guard from the pre-bound proof-verification seams. The returned
|
|
69
|
-
* guard reads `_meta['org.kya-os/proof
|
|
69
|
+
* guard reads `_meta['org.kya-os/request-proof']` (legacy `org.kya-os/proof.v1` accepted), RECOMPUTES it against the request via {@link verifyCardProof},
|
|
70
70
|
* enforces `opts.minLevel`, and returns `{ ok: true, did, level }` or a 401-shaped rejection. Fail-closed
|
|
71
71
|
* throughout: a missing proof, a broken binding, a throwing verifier, or an assurance below `minLevel`
|
|
72
72
|
* all reject.
|
|
@@ -81,7 +81,7 @@ export function requireProof(deps, opts = {}) {
|
|
|
81
81
|
return async (req, meta) => {
|
|
82
82
|
const proof = readCardProof(meta);
|
|
83
83
|
if (proof === undefined) {
|
|
84
|
-
return fail('proof_missing', 'no org.kya-os/proof
|
|
84
|
+
return fail('proof_missing', 'no org.kya-os/request-proof in _meta', ['proof_missing']);
|
|
85
85
|
}
|
|
86
86
|
const result = await recompute(proof, req, deps);
|
|
87
87
|
if (!result.ok || result.did === undefined || result.level === undefined) {
|
|
@@ -100,10 +100,14 @@ export function requireProof(deps, opts = {}) {
|
|
|
100
100
|
};
|
|
101
101
|
};
|
|
102
102
|
}
|
|
103
|
-
/** Read the card proof
|
|
104
|
-
*
|
|
103
|
+
/** Read the card proof out of a `_meta` record (undefined when absent / not an object). Reads the
|
|
104
|
+
* canonical `org.kya-os/request-proof` key, falling back to the earlier draft key (`org.kya-os/proof.v1`,
|
|
105
|
+
* accepted for one major version); the canonical key wins when both are present. A legacy session
|
|
106
|
+
* proof under `org.kya-os/proof` is a different key and is simply not seen. */
|
|
105
107
|
export function readCardProof(meta) {
|
|
106
|
-
|
|
108
|
+
if (!isRecord(meta))
|
|
109
|
+
return undefined;
|
|
110
|
+
return meta[KYA_OS_CARD_PROOF_META_KEY] ?? meta[LEGACY_CARD_PROOF_META_KEY];
|
|
107
111
|
}
|
|
108
112
|
/** Recompute the proof, fail-closed: a throwing verifier demotes to a rejected result (never escapes). */
|
|
109
113
|
async function recompute(proof, req, deps) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/card/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GAGjB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,eAAe,EACf,0BAA0B,GAI3B,MAAM,kBAAkB,CAAC;AAkC1B;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAgB,EAAE,OAA4B,EAAE;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,uFAAuF,IAAI,CAAC,EAAE,MAAM;YAClG,mDAAmD,CACtD,CAAC;IACJ,CAAC;IACD,iGAAiG;IACjG,mGAAmG;IACnG,8FAA8F;IAC9F,MAAM,eAAe,GAAG,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,eAAe;QACf,UAAU;QACV,eAAe,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC;QACxE,gBAAgB,EAAE,CAAC,MAAM,EAAE,EAAE;YAC3B,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,CAAC,EAAE,6DAA6D;oBAC1F,6EAA6E,CAChF,CAAC;YACJ,CAAC;YACD,OAAO,aAAa,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,SAAS,eAAe,CACtB,UAAa,EACb,IAAoB;IAEpB,OAAO,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED,uGAAuG;AACvG,SAAS,aAAa,CACpB,MAAS,EACT,KAAsB;IAEtB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;AACrD,CAAC;AAkCD,8FAA8F;AAC9F,MAAM,cAAc,GAAmC,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,IAAqB,EAAE,OAA4B,EAAE;IAChF,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,eAAe,EAAE,
|
|
1
|
+
{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/card/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GAGjB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,0BAA0B,GAI3B,MAAM,kBAAkB,CAAC;AAkC1B;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAgB,EAAE,OAA4B,EAAE;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,uFAAuF,IAAI,CAAC,EAAE,MAAM;YAClG,mDAAmD,CACtD,CAAC;IACJ,CAAC;IACD,iGAAiG;IACjG,mGAAmG;IACnG,8FAA8F;IAC9F,MAAM,eAAe,GAAG,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,eAAe;QACf,UAAU;QACV,eAAe,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC;QACxE,gBAAgB,EAAE,CAAC,MAAM,EAAE,EAAE;YAC3B,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,CAAC,EAAE,6DAA6D;oBAC1F,6EAA6E,CAChF,CAAC;YACJ,CAAC;YACD,OAAO,aAAa,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,SAAS,eAAe,CACtB,UAAa,EACb,IAAoB;IAEpB,OAAO,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED,uGAAuG;AACvG,SAAS,aAAa,CACpB,MAAS,EACT,KAAsB;IAEtB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;AACrD,CAAC;AAkCD,8FAA8F;AAC9F,MAAM,cAAc,GAAmC,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,IAAqB,EAAE,OAA4B,EAAE;IAChF,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,eAAe,EAAE,sCAAsC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC,eAAe,EAAE,oCAAoC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3E,MAAM,OAAO,GAAG,mBAAmB,KAAK,0BAA0B,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC,0BAA0B,EAAE,OAAO,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,KAAK;YACL,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;gFAGgF;AAChF,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,IAAI,CAAC,0BAA0B,CAAC,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;AAC9E,CAAC;AAED,0GAA0G;AAC1G,KAAK,UAAU,SAAS,CACtB,KAAc,EACd,GAAgB,EAChB,IAAqB;IAErB,IAAI,CAAC;QACH,OAAO,MAAM,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,8BAA8B;AAC9B,SAAS,IAAI,CAAC,IAAmB,EAAE,OAAe,EAAE,OAAiB;IACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;AACvE,CAAC"}
|
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* KYA-OS Entity Card proof — MINT (`buildCardProof`).
|
|
3
3
|
*
|
|
4
|
-
* Mint a stateless, sender-constrained `org.kya-os/proof
|
|
5
|
-
* card proof's OWN `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/proof
|
|
4
|
+
* Mint a stateless, sender-constrained `org.kya-os/proof.v1` for one request and return it under the
|
|
5
|
+
* card proof's OWN `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/request-proof`), distinct
|
|
6
6
|
* from the legacy session proof's `org.kya-os/proof` so the two coexist. The proof binds:
|
|
7
7
|
* `requestHash` → THIS body (JCS), `audience` → THIS recipient, `nonce` + `created`/`expires` → NOW,
|
|
8
8
|
* `kid` → the signing DID key, and (optionally) `cnf.jkt` → the token's RFC 9449 sender-constraint.
|
|
@@ -11,7 +11,7 @@
|
|
|
11
11
|
import type { ToolRequest } from '../../proof/generator.js';
|
|
12
12
|
import { KYA_OS_CARD_PROOF_META_KEY, type BuildProofContext, type CardProofMeta, type ProofSigner } from './types.js';
|
|
13
13
|
/**
|
|
14
|
-
* Mint an `org.kya-os/proof
|
|
14
|
+
* Mint an `org.kya-os/proof.v1` for `req`, signed by `signer`, bound to `ctx`. Returns the proof
|
|
15
15
|
* keyed by {@link KYA_OS_CARD_PROOF_META_KEY} so it can be spread straight into an MCP request
|
|
16
16
|
* `_meta`. The `cnf.jkt` is `ctx.cnfJkt` when given, else the signer's own key thumbprint, else
|
|
17
17
|
* omitted (an L3-minus proof — still bound by request + audience + nonce + key).
|
package/dist/card/proof/build.js
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* KYA-OS Entity Card proof — MINT (`buildCardProof`).
|
|
3
3
|
*
|
|
4
|
-
* Mint a stateless, sender-constrained `org.kya-os/proof
|
|
5
|
-
* card proof's OWN `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/proof
|
|
4
|
+
* Mint a stateless, sender-constrained `org.kya-os/proof.v1` for one request and return it under the
|
|
5
|
+
* card proof's OWN `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/request-proof`), distinct
|
|
6
6
|
* from the legacy session proof's `org.kya-os/proof` so the two coexist. The proof binds:
|
|
7
7
|
* `requestHash` → THIS body (JCS), `audience` → THIS recipient, `nonce` + `created`/`expires` → NOW,
|
|
8
8
|
* `kid` → the signing DID key, and (optionally) `cnf.jkt` → the token's RFC 9449 sender-constraint.
|
|
@@ -12,7 +12,7 @@ import { canonicalPayloadBytes, computeRequestHash } from './canonical.js';
|
|
|
12
12
|
import { httpSignatureBaseBytes } from './http-sig.js';
|
|
13
13
|
import { DEFAULT_TTL_SEC, KYA_OS_CARD_PROOF_META_KEY, MAX_TTL_SEC, PROOF_PROFILE_V1, } from './types.js';
|
|
14
14
|
/**
|
|
15
|
-
* Mint an `org.kya-os/proof
|
|
15
|
+
* Mint an `org.kya-os/proof.v1` for `req`, signed by `signer`, bound to `ctx`. Returns the proof
|
|
16
16
|
* keyed by {@link KYA_OS_CARD_PROOF_META_KEY} so it can be spread straight into an MCP request
|
|
17
17
|
* `_meta`. The `cnf.jkt` is `ctx.cnfJkt` when given, else the signer's own key thumbprint, else
|
|
18
18
|
* omitted (an L3-minus proof — still bound by request + audience + nonce + key).
|
|
@@ -46,7 +46,7 @@ export declare function httpSignatureBase(proof: CardProofMeta): string;
|
|
|
46
46
|
/** The UTF-8 bytes of {@link httpSignatureBase} — the payload the `signRaw` seam signs at mint. */
|
|
47
47
|
export declare function httpSignatureBaseBytes(proof: CardProofMeta): Uint8Array;
|
|
48
48
|
/**
|
|
49
|
-
* Project a minted `org.kya-os/proof
|
|
49
|
+
* Project a minted `org.kya-os/proof.v1` into its RFC 9421 header set. Emits EVERY covered
|
|
50
50
|
* component as a real HTTP field — `Content-Digest`/`Kya-Audience`/`Kya-Nonce` (and `Kya-Cnf`
|
|
51
51
|
* when a `cnf` is present), each byte-identical to its {@link httpSignatureBase} line — plus
|
|
52
52
|
* `Signature-Input` (the covered-component list + params) and `Signature` (the RAW `httpSig` as a
|
|
@@ -56,7 +56,7 @@ export function httpSignatureBaseBytes(proof) {
|
|
|
56
56
|
return encoder.encode(httpSignatureBase(proof));
|
|
57
57
|
}
|
|
58
58
|
/**
|
|
59
|
-
* Project a minted `org.kya-os/proof
|
|
59
|
+
* Project a minted `org.kya-os/proof.v1` into its RFC 9421 header set. Emits EVERY covered
|
|
60
60
|
* component as a real HTTP field — `Content-Digest`/`Kya-Audience`/`Kya-Nonce` (and `Kya-Cnf`
|
|
61
61
|
* when a `cnf` is present), each byte-identical to its {@link httpSignatureBase} line — plus
|
|
62
62
|
* `Signature-Input` (the covered-component list + params) and `Signature` (the RAW `httpSig` as a
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* KYA-OS Entity Card — stateless per-request holder-of-key proof (`org.kya-os/proof
|
|
2
|
+
* KYA-OS Entity Card — stateless per-request holder-of-key proof (`org.kya-os/proof.v1`).
|
|
3
3
|
*
|
|
4
4
|
* The security-critical module, split into focused units re-exported here:
|
|
5
5
|
* - types (./types): CardProofMeta + the minting/verifying seams and result shapes.
|
|
@@ -12,7 +12,7 @@
|
|
|
12
12
|
* + the NonceCacheProvider adapter) so the safe consume is the default.
|
|
13
13
|
*
|
|
14
14
|
* Distinct from — and orthogonal to — the legacy session-bound proof in `src/proof`: the card proof
|
|
15
|
-
* rides its OWN `_meta['org.kya-os/proof
|
|
15
|
+
* rides its OWN `_meta['org.kya-os/request-proof']` key, separate from the legacy `org.kya-os/proof`, so
|
|
16
16
|
* both regimes can run on one server without either guard seeing the other's proof.
|
|
17
17
|
*/
|
|
18
18
|
export * from './types.js';
|
package/dist/card/proof/index.js
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* KYA-OS Entity Card — stateless per-request holder-of-key proof (`org.kya-os/proof
|
|
2
|
+
* KYA-OS Entity Card — stateless per-request holder-of-key proof (`org.kya-os/proof.v1`).
|
|
3
3
|
*
|
|
4
4
|
* The security-critical module, split into focused units re-exported here:
|
|
5
5
|
* - types (./types): CardProofMeta + the minting/verifying seams and result shapes.
|
|
@@ -12,7 +12,7 @@
|
|
|
12
12
|
* + the NonceCacheProvider adapter) so the safe consume is the default.
|
|
13
13
|
*
|
|
14
14
|
* Distinct from — and orthogonal to — the legacy session-bound proof in `src/proof`: the card proof
|
|
15
|
-
* rides its OWN `_meta['org.kya-os/proof
|
|
15
|
+
* rides its OWN `_meta['org.kya-os/request-proof']` key, separate from the legacy `org.kya-os/proof`, so
|
|
16
16
|
* both regimes can run on one server without either guard seeing the other's proof.
|
|
17
17
|
*/
|
|
18
18
|
export * from './types.js';
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* KYA-OS Entity Card — batteries-included replay defense for `org.kya-os/proof
|
|
2
|
+
* KYA-OS Entity Card — batteries-included replay defense for `org.kya-os/proof.v1`.
|
|
3
3
|
*
|
|
4
4
|
* The {@link ConsumeNonceIfFresh} seam is security-critical: it MUST be an ATOMIC test-AND-set
|
|
5
5
|
* (record the nonce AND report whether it was already seen, in one step). Hand-rolling it is the
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* KYA-OS Entity Card — batteries-included replay defense for `org.kya-os/proof
|
|
2
|
+
* KYA-OS Entity Card — batteries-included replay defense for `org.kya-os/proof.v1`.
|
|
3
3
|
*
|
|
4
4
|
* The {@link ConsumeNonceIfFresh} seam is security-critical: it MUST be an ATOMIC test-AND-set
|
|
5
5
|
* (record the nonce AND report whether it was already seen, in one step). Hand-rolling it is the
|
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* KYA-OS Entity Card — stateless per-request holder-of-key proof: shapes + seams.
|
|
3
3
|
*
|
|
4
|
-
* `org.kya-os/proof
|
|
5
|
-
* `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/proof
|
|
4
|
+
* `org.kya-os/proof.v1` is the STATELESS, sender-constrained proof profile. It rides its OWN
|
|
5
|
+
* `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/request-proof`), DISTINCT from the legacy
|
|
6
6
|
* session-bound `ProofMeta` (which carries `sessionId` + a handshake nonce under
|
|
7
7
|
* `org.kya-os/proof`). Separate keys let the two regimes coexist on one server without either guard
|
|
8
8
|
* seeing — or rejecting — the other's proof. Every request self-proves; there is no session state.
|
|
@@ -14,16 +14,25 @@
|
|
|
14
14
|
import { z } from 'zod';
|
|
15
15
|
import { type ProofPublicJwk } from '../schema.js';
|
|
16
16
|
/** The stateless per-request proof profile tag (the `prf` discriminator). */
|
|
17
|
-
export declare const PROOF_PROFILE_V1 = "org.kya-os/proof
|
|
17
|
+
export declare const PROOF_PROFILE_V1 = "org.kya-os/proof.v1";
|
|
18
18
|
/**
|
|
19
19
|
* The `_meta` key the STATELESS card proof rides under — DISTINCT from the legacy session proof's
|
|
20
20
|
* `org.kya-os/proof` (`KYA_OS_PROOF_META_KEY`). Sharing one key made the two regimes mutually
|
|
21
21
|
* exclusive on a server (a legacy proof failed the card schema and was 401'd; a card proof failed
|
|
22
22
|
* the legacy structure check). With separate keys each guard reads its OWN key and simply does not
|
|
23
23
|
* see the other's proof, so both can run on one server — genuinely additive, no legacy coupling. The
|
|
24
|
-
* key
|
|
24
|
+
* key names the slot by ROLE (the request proof), pairing with the response proof's
|
|
25
|
+
* `org.kya-os/response-proof`; the profile VERSION lives inside the object, in its `prf` field.
|
|
26
|
+
* Keys carry no versions and no `@` (which MCP's `_meta` key grammar forbids anyway).
|
|
25
27
|
*/
|
|
26
|
-
export declare const KYA_OS_CARD_PROOF_META_KEY = "org.kya-os/proof
|
|
28
|
+
export declare const KYA_OS_CARD_PROOF_META_KEY = "org.kya-os/request-proof";
|
|
29
|
+
/**
|
|
30
|
+
* The earlier draft carrier key, which used the then-profile-id verbatim and therefore violated
|
|
31
|
+
* MCP's `_meta` key grammar. Verifiers accept it for one major version (SPEC-ENTITY-CARD §8.1);
|
|
32
|
+
* producers emit {@link KYA_OS_CARD_PROOF_META_KEY} and MAY mirror under this key for verifiers
|
|
33
|
+
* older than the rename. When both keys are present, the canonical key wins.
|
|
34
|
+
*/
|
|
35
|
+
export declare const LEGACY_CARD_PROOF_META_KEY = "org.kya-os/proof@1";
|
|
27
36
|
/** Default proof lifetime in seconds (SPEC §8: short-lived, ≤ 60s). */
|
|
28
37
|
export declare const DEFAULT_TTL_SEC = 60;
|
|
29
38
|
/** Maximum accepted proof lifetime in seconds — a longer window fails closed. */
|
|
@@ -47,7 +56,7 @@ export declare const CardProofCnfSchema: z.ZodObject<{
|
|
|
47
56
|
jkt: z.ZodString;
|
|
48
57
|
}, z.core.$strip>;
|
|
49
58
|
/**
|
|
50
|
-
* The `org.kya-os/proof
|
|
59
|
+
* The `org.kya-os/proof.v1` payload. Every field except the two signatures (`jws`, `httpSig`) is a
|
|
51
60
|
* COVERED claim: the detached EdDSA `jws` signs the RFC 8785 (JCS) canonicalization of the claims,
|
|
52
61
|
* so tampering any of them fails the signature. `cnf.jkt` is OPTIONAL — present it degrades to
|
|
53
62
|
* L3-minus rather than blocking when the authorization server does not emit an RFC 9449 `cnf`.
|
|
@@ -60,7 +69,7 @@ export declare const CardProofCnfSchema: z.ZodObject<{
|
|
|
60
69
|
* It degrades gracefully: a signer without a `signRaw` seam mints a JWS-only proof (no sibling).
|
|
61
70
|
*/
|
|
62
71
|
export declare const CardProofMetaSchema: z.ZodObject<{
|
|
63
|
-
prf: z.ZodLiteral<"org.kya-os/proof@1">;
|
|
72
|
+
prf: z.ZodUnion<readonly [z.ZodLiteral<"org.kya-os/proof.v1">, z.ZodLiteral<"org.kya-os/proof@1">]>;
|
|
64
73
|
alg: z.ZodEnum<{
|
|
65
74
|
EdDSA: "EdDSA";
|
|
66
75
|
ES256: "ES256";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/card/proof/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/card/proof/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkD,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnG,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,wBAAmB,CAAC;AAEjD;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,6BAA6B,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,uBAA0B,CAAC;AAElE,uEAAuE;AACvE,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,iFAAiF;AACjF,eAAO,MAAM,WAAW,KAAK,CAAC;AAE9B,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,QAAyC,CAAC;AAY1E,8FAA8F;AAC9F,eAAO,MAAM,kBAAkB;;iBAE7B,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;kBAerB,CAAC;AAEZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,mGAAmG;AACnG,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,SAAS,CAAC;IACf,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,OAAO,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAEjE;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,0GAA0G;IAC1G,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IACjC,qGAAqG;IACrG,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C;;;;;OAKG;IACH,OAAO,CAAC,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChD;AAED,gGAAgG;AAChG,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AAEnF,gGAAgG;AAChG,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,cAAc,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;AAE3F;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE7F;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,UAAU,CAAC;IACvB;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,oFAAoF;IACpF,gBAAgB,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,UAAU,CAAC;AAE/C,6FAA6F;AAC7F,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,uFAAuF;IACvF,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB"}
|
package/dist/card/proof/types.js
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* KYA-OS Entity Card — stateless per-request holder-of-key proof: shapes + seams.
|
|
3
3
|
*
|
|
4
|
-
* `org.kya-os/proof
|
|
5
|
-
* `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/proof
|
|
4
|
+
* `org.kya-os/proof.v1` is the STATELESS, sender-constrained proof profile. It rides its OWN
|
|
5
|
+
* `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/request-proof`), DISTINCT from the legacy
|
|
6
6
|
* session-bound `ProofMeta` (which carries `sessionId` + a handshake nonce under
|
|
7
7
|
* `org.kya-os/proof`). Separate keys let the two regimes coexist on one server without either guard
|
|
8
8
|
* seeing — or rejecting — the other's proof. Every request self-proves; there is no session state.
|
|
@@ -12,7 +12,7 @@
|
|
|
12
12
|
* uses only `jose` + `json-canonicalize`, already direct dependencies.
|
|
13
13
|
*/
|
|
14
14
|
import { z } from 'zod';
|
|
15
|
-
import { Did, PROOF_PROFILE_ID } from '../schema.js';
|
|
15
|
+
import { Did, LEGACY_PROOF_PROFILE_ID, PROOF_PROFILE_ID } from '../schema.js';
|
|
16
16
|
/** The stateless per-request proof profile tag (the `prf` discriminator). */
|
|
17
17
|
export const PROOF_PROFILE_V1 = PROOF_PROFILE_ID;
|
|
18
18
|
/**
|
|
@@ -21,9 +21,18 @@ export const PROOF_PROFILE_V1 = PROOF_PROFILE_ID;
|
|
|
21
21
|
* exclusive on a server (a legacy proof failed the card schema and was 401'd; a card proof failed
|
|
22
22
|
* the legacy structure check). With separate keys each guard reads its OWN key and simply does not
|
|
23
23
|
* see the other's proof, so both can run on one server — genuinely additive, no legacy coupling. The
|
|
24
|
-
* key
|
|
24
|
+
* key names the slot by ROLE (the request proof), pairing with the response proof's
|
|
25
|
+
* `org.kya-os/response-proof`; the profile VERSION lives inside the object, in its `prf` field.
|
|
26
|
+
* Keys carry no versions and no `@` (which MCP's `_meta` key grammar forbids anyway).
|
|
25
27
|
*/
|
|
26
|
-
export const KYA_OS_CARD_PROOF_META_KEY =
|
|
28
|
+
export const KYA_OS_CARD_PROOF_META_KEY = 'org.kya-os/request-proof';
|
|
29
|
+
/**
|
|
30
|
+
* The earlier draft carrier key, which used the then-profile-id verbatim and therefore violated
|
|
31
|
+
* MCP's `_meta` key grammar. Verifiers accept it for one major version (SPEC-ENTITY-CARD §8.1);
|
|
32
|
+
* producers emit {@link KYA_OS_CARD_PROOF_META_KEY} and MAY mirror under this key for verifiers
|
|
33
|
+
* older than the rename. When both keys are present, the canonical key wins.
|
|
34
|
+
*/
|
|
35
|
+
export const LEGACY_CARD_PROOF_META_KEY = LEGACY_PROOF_PROFILE_ID;
|
|
27
36
|
/** Default proof lifetime in seconds (SPEC §8: short-lived, ≤ 60s). */
|
|
28
37
|
export const DEFAULT_TTL_SEC = 60;
|
|
29
38
|
/** Maximum accepted proof lifetime in seconds — a longer window fails closed. */
|
|
@@ -56,7 +65,7 @@ export const CardProofCnfSchema = z.object({
|
|
|
56
65
|
jkt: z.string().min(1).regex(BASE64URL, 'cnf.jkt must be a base64url RFC 7638 thumbprint'),
|
|
57
66
|
});
|
|
58
67
|
/**
|
|
59
|
-
* The `org.kya-os/proof
|
|
68
|
+
* The `org.kya-os/proof.v1` payload. Every field except the two signatures (`jws`, `httpSig`) is a
|
|
60
69
|
* COVERED claim: the detached EdDSA `jws` signs the RFC 8785 (JCS) canonicalization of the claims,
|
|
61
70
|
* so tampering any of them fails the signature. `cnf.jkt` is OPTIONAL — present it degrades to
|
|
62
71
|
* L3-minus rather than blocking when the authorization server does not emit an RFC 9449 `cnf`.
|
|
@@ -69,7 +78,7 @@ export const CardProofCnfSchema = z.object({
|
|
|
69
78
|
* It degrades gracefully: a signer without a `signRaw` seam mints a JWS-only proof (no sibling).
|
|
70
79
|
*/
|
|
71
80
|
export const CardProofMetaSchema = z.object({
|
|
72
|
-
prf: z.literal(PROOF_PROFILE_V1),
|
|
81
|
+
prf: z.union([z.literal(PROOF_PROFILE_V1), z.literal(LEGACY_PROOF_PROFILE_ID)]),
|
|
73
82
|
alg: z.enum(['EdDSA', 'ES256']),
|
|
74
83
|
did: Did,
|
|
75
84
|
// The signing key reference MUST carry a `#fragment` (a verificationMethod id); the runtime also
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/card/proof/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAuB,MAAM,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/card/proof/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,GAAG,EAAE,uBAAuB,EAAE,gBAAgB,EAAuB,MAAM,cAAc,CAAC;AAEnG,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAEjD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,0BAA0B,CAAC;AAErE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AAElE,uEAAuE;AACvE,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC,iFAAiF;AACjF,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAE9B,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,GAAG,CAAC,GAAG,gBAAgB,GAAG,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,iDAAiD,CAAC;CAC3F,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC/E,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/B,GAAG,EAAE,GAAG;IACR,iGAAiG;IACjG,8FAA8F;IAC9F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,EAAE,8DAA8D,CAAC;IAC9G,QAAQ,EAAE,GAAG;IACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,uFAAuF,CAAC;IAClI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,GAAG,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,uFAAuF"}
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* KYA-OS Entity Card proof — VERIFY (`verifyCardProof`), fail-closed.
|
|
3
3
|
*
|
|
4
|
-
* Recompute EVERY binding a stateless `org.kya-os/proof
|
|
4
|
+
* Recompute EVERY binding a stateless `org.kya-os/proof.v1` asserts and reject on the first thing
|
|
5
5
|
* that does not hold. The signature only proves the proof is AUTHENTIC (signed by the holder of
|
|
6
6
|
* `kid`); accountability requires binding that key to the accountable principal `did`:
|
|
7
7
|
*
|
|
@@ -19,7 +19,7 @@
|
|
|
19
19
|
import type { ToolRequest } from '../../proof/generator.js';
|
|
20
20
|
import { type ProofVerifyResult, type VerifyProofDeps } from './types.js';
|
|
21
21
|
/**
|
|
22
|
-
* Verify an `org.kya-os/proof
|
|
22
|
+
* Verify an `org.kya-os/proof.v1` against the request it should bind and the injected seams.
|
|
23
23
|
* Fail-closed: returns `{ ok:false, reasons }` on any broken binding; on success returns the
|
|
24
24
|
* derived assurance (`L3` on full cnf fusion, `L3-minus` without an AS `cnf`) and the principal.
|
|
25
25
|
*/
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* KYA-OS Entity Card proof — VERIFY (`verifyCardProof`), fail-closed.
|
|
3
3
|
*
|
|
4
|
-
* Recompute EVERY binding a stateless `org.kya-os/proof
|
|
4
|
+
* Recompute EVERY binding a stateless `org.kya-os/proof.v1` asserts and reject on the first thing
|
|
5
5
|
* that does not hold. The signature only proves the proof is AUTHENTIC (signed by the holder of
|
|
6
6
|
* `kid`); accountability requires binding that key to the accountable principal `did`:
|
|
7
7
|
*
|
|
@@ -21,7 +21,7 @@ import { base64urlDecodeToString, base64urlEncodeFromBytes } from '../../utils/b
|
|
|
21
21
|
import { canonicalPayloadBytes, computeRequestHash } from './canonical.js';
|
|
22
22
|
import { CardProofMetaSchema, DEFAULT_SKEW_SEC, MAX_TTL_SEC, } from './types.js';
|
|
23
23
|
/**
|
|
24
|
-
* Verify an `org.kya-os/proof
|
|
24
|
+
* Verify an `org.kya-os/proof.v1` against the request it should bind and the injected seams.
|
|
25
25
|
* Fail-closed: returns `{ ok:false, reasons }` on any broken binding; on success returns the
|
|
26
26
|
* derived assurance (`L3` on full cnf fusion, `L3-minus` without an AS `cnf`) and the principal.
|
|
27
27
|
*/
|
package/dist/card/schema.d.ts
CHANGED
|
@@ -7,10 +7,10 @@ import { z } from 'zod';
|
|
|
7
7
|
/** A `did:key` or `did:web` DID — the single source of truth for the DID shape (imported, never re-declared). */
|
|
8
8
|
export declare const Did: z.ZodString;
|
|
9
9
|
export declare const EntityTypeSchema: z.ZodEnum<{
|
|
10
|
+
verifier: "verifier";
|
|
10
11
|
mcp: "mcp";
|
|
11
12
|
agent: "agent";
|
|
12
13
|
client: "client";
|
|
13
|
-
verifier: "verifier";
|
|
14
14
|
human: "human";
|
|
15
15
|
}>;
|
|
16
16
|
export declare const ConformanceLevelSchema: z.ZodEnum<{
|
|
@@ -80,14 +80,22 @@ export declare const AttestationSchema: z.ZodObject<{
|
|
|
80
80
|
}, z.core.$strict>;
|
|
81
81
|
/** The canonical per-request proof profile id — the ONE source of truth every consumer
|
|
82
82
|
* references (the proof's `prf` tag, its `_meta` key, and the card's `proofProfile` field). */
|
|
83
|
-
export declare const PROOF_PROFILE_ID = "org.kya-os/proof
|
|
83
|
+
export declare const PROOF_PROFILE_ID = "org.kya-os/proof.v1";
|
|
84
|
+
/**
|
|
85
|
+
* The profile id of the earlier draft (`proof@1`), replaced because the `@`
|
|
86
|
+
* spelling collided with MCP's `_meta` key grammar and duplicated the version
|
|
87
|
+
* the `prf` field already carries. Verifiers accept it (in `prf` and in
|
|
88
|
+
* `proofProfile`) for one major version; producers emit only
|
|
89
|
+
* {@link PROOF_PROFILE_ID}.
|
|
90
|
+
*/
|
|
91
|
+
export declare const LEGACY_PROOF_PROFILE_ID = "org.kya-os/proof@1";
|
|
84
92
|
/**
|
|
85
93
|
* Self-declared per-request holder-of-key proof profile. A card carrying this advertises
|
|
86
|
-
* that its requests ride the stateless, sender-constrained `org.kya-os/proof
|
|
94
|
+
* that its requests ride the stateless, sender-constrained `org.kya-os/proof.v1` envelope
|
|
87
95
|
* (distinct from the legacy session-bound ProofMeta). The proof itself is NEVER on the
|
|
88
96
|
* static card — it rides per-request `_meta`; this field only names the profile.
|
|
89
97
|
*/
|
|
90
|
-
export declare const ProofProfileSchema: z.ZodLiteral<"org.kya-os/proof@1">;
|
|
98
|
+
export declare const ProofProfileSchema: z.ZodUnion<readonly [z.ZodLiteral<"org.kya-os/proof.v1">, z.ZodLiteral<"org.kya-os/proof@1">]>;
|
|
91
99
|
/**
|
|
92
100
|
* CIMD (draft-ietf-oauth-client-id-metadata-document) binding — the L1 on-ramp
|
|
93
101
|
* coordinates. `clientId` is the `did:web` HTTPS form; `jwksUri` is the DID-keyed JWKS the
|
|
@@ -108,10 +116,10 @@ export declare const BitstringStatusListEntrySchema: z.ZodObject<{
|
|
|
108
116
|
export declare const EntityCardSchema: z.ZodObject<{
|
|
109
117
|
id: z.ZodString;
|
|
110
118
|
entityType: z.ZodEnum<{
|
|
119
|
+
verifier: "verifier";
|
|
111
120
|
mcp: "mcp";
|
|
112
121
|
agent: "agent";
|
|
113
122
|
client: "client";
|
|
114
|
-
verifier: "verifier";
|
|
115
123
|
human: "human";
|
|
116
124
|
}>;
|
|
117
125
|
name: z.ZodString;
|
|
@@ -148,7 +156,7 @@ export declare const EntityCardSchema: z.ZodObject<{
|
|
|
148
156
|
issuer: z.ZodOptional<z.ZodString>;
|
|
149
157
|
}, z.core.$strict>>>;
|
|
150
158
|
didDocument: z.ZodOptional<z.ZodString>;
|
|
151
|
-
proofProfile: z.ZodOptional<z.ZodLiteral<"org.kya-os/proof@1">>;
|
|
159
|
+
proofProfile: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"org.kya-os/proof.v1">, z.ZodLiteral<"org.kya-os/proof@1">]>>;
|
|
152
160
|
cimd: z.ZodOptional<z.ZodObject<{
|
|
153
161
|
clientId: z.ZodString;
|
|
154
162
|
jwksUri: z.ZodString;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/card/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAEH,iHAAiH;AACjH,eAAO,MAAM,GAAG,aAA6E,CAAC;AAE9F,eAAO,MAAM,gBAAgB;;;;;;EAA0D,CAAC;AAExF,eAAO,MAAM,sBAAsB;;;;EAA6B,CAAC;AAEjE,eAAO,MAAM,sBAAsB;;;;;;kBAQxB,CAAC;AAEZ,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB;;;;;;;kBASrB,CAAC;AAEZ,iGAAiG;AACjG,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;oBAAyD,CAAC;AAK3F;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;iBAEtC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;kBAKxB,CAAC;AAEZ,kEAAkE;AAClE,eAAO,MAAM,gBAAgB;;;;;oBAAuD,CAAC;AAErF,eAAO,MAAM,iBAAiB;;;;;;;;kBAOnB,CAAC;AAEZ;gGACgG;AAChG,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/card/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAEH,iHAAiH;AACjH,eAAO,MAAM,GAAG,aAA6E,CAAC;AAE9F,eAAO,MAAM,gBAAgB;;;;;;EAA0D,CAAC;AAExF,eAAO,MAAM,sBAAsB;;;;EAA6B,CAAC;AAEjE,eAAO,MAAM,sBAAsB;;;;;;kBAQxB,CAAC;AAEZ,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB;;;;;;;kBASrB,CAAC;AAEZ,iGAAiG;AACjG,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;oBAAyD,CAAC;AAK3F;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;iBAEtC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;kBAKxB,CAAC;AAEZ,kEAAkE;AAClE,eAAO,MAAM,gBAAgB;;;;;oBAAuD,CAAC;AAErF,eAAO,MAAM,iBAAiB;;;;;;;;kBAOnB,CAAC;AAEZ;gGACgG;AAChG,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AAEtD;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAE5D;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,gGAG7B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;kBAKnB,CAAC;AAEZ;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;;kBAKhC,CAAC;AAEZ,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAyBlB,CAAC;AAEZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,oFAAoF;AACpF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,CAE5D"}
|
package/dist/card/schema.js
CHANGED
|
@@ -57,14 +57,25 @@ export const AttestationSchema = z
|
|
|
57
57
|
.strict();
|
|
58
58
|
/** The canonical per-request proof profile id — the ONE source of truth every consumer
|
|
59
59
|
* references (the proof's `prf` tag, its `_meta` key, and the card's `proofProfile` field). */
|
|
60
|
-
export const PROOF_PROFILE_ID = 'org.kya-os/proof
|
|
60
|
+
export const PROOF_PROFILE_ID = 'org.kya-os/proof.v1';
|
|
61
|
+
/**
|
|
62
|
+
* The profile id of the earlier draft (`proof@1`), replaced because the `@`
|
|
63
|
+
* spelling collided with MCP's `_meta` key grammar and duplicated the version
|
|
64
|
+
* the `prf` field already carries. Verifiers accept it (in `prf` and in
|
|
65
|
+
* `proofProfile`) for one major version; producers emit only
|
|
66
|
+
* {@link PROOF_PROFILE_ID}.
|
|
67
|
+
*/
|
|
68
|
+
export const LEGACY_PROOF_PROFILE_ID = 'org.kya-os/proof@1';
|
|
61
69
|
/**
|
|
62
70
|
* Self-declared per-request holder-of-key proof profile. A card carrying this advertises
|
|
63
|
-
* that its requests ride the stateless, sender-constrained `org.kya-os/proof
|
|
71
|
+
* that its requests ride the stateless, sender-constrained `org.kya-os/proof.v1` envelope
|
|
64
72
|
* (distinct from the legacy session-bound ProofMeta). The proof itself is NEVER on the
|
|
65
73
|
* static card — it rides per-request `_meta`; this field only names the profile.
|
|
66
74
|
*/
|
|
67
|
-
export const ProofProfileSchema = z.
|
|
75
|
+
export const ProofProfileSchema = z.union([
|
|
76
|
+
z.literal(PROOF_PROFILE_ID),
|
|
77
|
+
z.literal(LEGACY_PROOF_PROFILE_ID),
|
|
78
|
+
]);
|
|
68
79
|
/**
|
|
69
80
|
* CIMD (draft-ietf-oauth-client-id-metadata-document) binding — the L1 on-ramp
|
|
70
81
|
* coordinates. `clientId` is the `did:web` HTTPS form; `jwksUri` is the DID-keyed JWKS the
|
package/dist/card/schema.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/card/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAEH,iHAAiH;AACjH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,kCAAkC,CAAC,CAAC;AAE9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAExF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACrB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACzB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACpB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACvB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE3F,gFAAgF;AAChF,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAErF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;IAC/D,EAAE,EAAE,OAAO;IACX,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE;IACvB,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;gGACgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/card/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAEH,iHAAiH;AACjH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,kCAAkC,CAAC,CAAC;AAE9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAExF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACrB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACzB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACpB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACvB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE3F,gFAAgF;AAChF,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAErF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;IAC/D,EAAE,EAAE,OAAO;IACX,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE;IACvB,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;gGACgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IACxC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAC3B,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;CACnC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,0DAA0D,CAAC;CAC1G,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,GAAG;IACP,UAAU,EAAE,gBAAgB;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,YAAY,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClD,2EAA2E;IAC3E,gBAAgB,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACnD,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,sFAAsF;IACtF,YAAY,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC3C,8EAA8E;IAC9E,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAClC,kFAAkF;IAClF,UAAU,EAAE,8BAA8B,CAAC,QAAQ,EAAE;CACtD,CAAC;IACF,mFAAmF;IACnF,mFAAmF;KAClF,MAAM,EAAE,CAAC;AAiBZ,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,IAAkB;IAChD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC"}
|
package/dist/card/verify.d.ts
CHANGED
|
@@ -79,7 +79,7 @@ export interface VerifyCardDeps {
|
|
|
79
79
|
attestationVerifier?: AttestationVerifier;
|
|
80
80
|
/** Verifies the accountability edge (delegationRef → responsibleParty, leaf-invoker join). */
|
|
81
81
|
accountabilityVerifier?: AccountabilityVerifier;
|
|
82
|
-
/** The per-request holder-of-key proof that rode `_meta['org.kya-os/proof
|
|
82
|
+
/** The per-request holder-of-key proof that rode `_meta['org.kya-os/request-proof']` (recomputed here). */
|
|
83
83
|
proof?: unknown;
|
|
84
84
|
/** The request the proof must bind (`method` + `params`); required alongside `proof`. */
|
|
85
85
|
request?: ToolRequest;
|