@kya-os/mcp 1.11.0 → 1.13.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (123) hide show
  1. package/CHANGELOG.md +48 -0
  2. package/CONFORMANCE.md +16 -8
  3. package/README.md +2 -2
  4. package/SPEC.md +23 -30
  5. package/dist/audit/index.d.ts +3 -0
  6. package/dist/audit/index.d.ts.map +1 -1
  7. package/dist/audit/index.js +3 -0
  8. package/dist/audit/index.js.map +1 -1
  9. package/dist/audit/read-contract.d.ts +445 -0
  10. package/dist/audit/read-contract.d.ts.map +1 -0
  11. package/dist/audit/read-contract.js +126 -0
  12. package/dist/audit/read-contract.js.map +1 -0
  13. package/dist/audit/read-service.d.ts +99 -0
  14. package/dist/audit/read-service.d.ts.map +1 -0
  15. package/dist/audit/read-service.js +124 -0
  16. package/dist/audit/read-service.js.map +1 -0
  17. package/dist/audit/reference-recorder.d.ts +43 -0
  18. package/dist/audit/reference-recorder.d.ts.map +1 -0
  19. package/dist/audit/reference-recorder.js +131 -0
  20. package/dist/audit/reference-recorder.js.map +1 -0
  21. package/dist/audit/schemas.d.ts +1 -0
  22. package/dist/audit/schemas.d.ts.map +1 -1
  23. package/dist/audit/schemas.js +1 -1
  24. package/dist/audit/schemas.js.map +1 -1
  25. package/dist/card/builder.d.ts +1 -1
  26. package/dist/card/builder.js +1 -1
  27. package/dist/card/emit.d.ts +3 -3
  28. package/dist/card/emit.d.ts.map +1 -1
  29. package/dist/card/emit.js.map +1 -1
  30. package/dist/card/index.d.ts +1 -1
  31. package/dist/card/index.js +1 -1
  32. package/dist/card/middleware.d.ts +6 -4
  33. package/dist/card/middleware.d.ts.map +1 -1
  34. package/dist/card/middleware.js +11 -7
  35. package/dist/card/middleware.js.map +1 -1
  36. package/dist/card/proof/build.d.ts +3 -3
  37. package/dist/card/proof/build.js +3 -3
  38. package/dist/card/proof/http-sig.d.ts +1 -1
  39. package/dist/card/proof/http-sig.js +1 -1
  40. package/dist/card/proof/index.d.ts +2 -2
  41. package/dist/card/proof/index.js +2 -2
  42. package/dist/card/proof/nonce-cache.d.ts +1 -1
  43. package/dist/card/proof/nonce-cache.js +1 -1
  44. package/dist/card/proof/types.d.ts +16 -7
  45. package/dist/card/proof/types.d.ts.map +1 -1
  46. package/dist/card/proof/types.js +16 -7
  47. package/dist/card/proof/types.js.map +1 -1
  48. package/dist/card/proof/verify.d.ts +2 -2
  49. package/dist/card/proof/verify.js +2 -2
  50. package/dist/card/schema.d.ts +14 -6
  51. package/dist/card/schema.d.ts.map +1 -1
  52. package/dist/card/schema.js +14 -3
  53. package/dist/card/schema.js.map +1 -1
  54. package/dist/card/verify.d.ts +1 -1
  55. package/dist/card/verify.d.ts.map +1 -1
  56. package/dist/delegation/index.d.ts +1 -0
  57. package/dist/delegation/index.d.ts.map +1 -1
  58. package/dist/delegation/index.js +1 -0
  59. package/dist/delegation/index.js.map +1 -1
  60. package/dist/delegation/status-cache.d.ts +9 -0
  61. package/dist/delegation/status-cache.d.ts.map +1 -0
  62. package/dist/delegation/status-cache.js +20 -0
  63. package/dist/delegation/status-cache.js.map +1 -0
  64. package/dist/delegation/vc-verification-checks.d.ts.map +1 -1
  65. package/dist/delegation/vc-verification-checks.js +16 -1
  66. package/dist/delegation/vc-verification-checks.js.map +1 -1
  67. package/dist/delegation/vc-verifier.d.ts +31 -15
  68. package/dist/delegation/vc-verifier.d.ts.map +1 -1
  69. package/dist/delegation/vc-verifier.js +71 -78
  70. package/dist/delegation/vc-verifier.js.map +1 -1
  71. package/dist/delegation/vc-verifier.types.d.ts +18 -0
  72. package/dist/delegation/vc-verifier.types.d.ts.map +1 -1
  73. package/dist/extension/declaration.d.ts +60 -0
  74. package/dist/extension/declaration.d.ts.map +1 -0
  75. package/dist/extension/declaration.js +75 -0
  76. package/dist/extension/declaration.js.map +1 -0
  77. package/dist/extension/gate.d.ts +110 -0
  78. package/dist/extension/gate.d.ts.map +1 -0
  79. package/dist/extension/gate.js +133 -0
  80. package/dist/extension/gate.js.map +1 -0
  81. package/dist/extension/index.d.ts +14 -0
  82. package/dist/extension/index.d.ts.map +1 -0
  83. package/dist/extension/index.js +14 -0
  84. package/dist/extension/index.js.map +1 -0
  85. package/dist/extension/settings.d.ts +70 -0
  86. package/dist/extension/settings.d.ts.map +1 -0
  87. package/dist/extension/settings.js +96 -0
  88. package/dist/extension/settings.js.map +1 -0
  89. package/dist/index.d.ts +2 -1
  90. package/dist/index.d.ts.map +1 -1
  91. package/dist/index.js +3 -1
  92. package/dist/index.js.map +1 -1
  93. package/dist/middleware/kya-os-transport.d.ts +1 -1
  94. package/dist/middleware/kya-os-transport.js +1 -1
  95. package/dist/middleware/with-kya-os.config-types.d.ts +13 -0
  96. package/dist/middleware/with-kya-os.config-types.d.ts.map +1 -1
  97. package/dist/middleware/with-kya-os.delegation-verify.d.ts.map +1 -1
  98. package/dist/middleware/with-kya-os.delegation-verify.js +4 -2
  99. package/dist/middleware/with-kya-os.delegation-verify.js.map +1 -1
  100. package/dist/proof/generator.d.ts +14 -2
  101. package/dist/proof/generator.d.ts.map +1 -1
  102. package/dist/proof/generator.js +14 -2
  103. package/dist/proof/generator.js.map +1 -1
  104. package/dist/proof/index.d.ts +1 -1
  105. package/dist/proof/index.d.ts.map +1 -1
  106. package/dist/proof/index.js +1 -1
  107. package/dist/proof/index.js.map +1 -1
  108. package/dist/proof/verifier.d.ts +3 -2
  109. package/dist/proof/verifier.d.ts.map +1 -1
  110. package/dist/proof/verifier.js +13 -8
  111. package/dist/proof/verifier.js.map +1 -1
  112. package/dist/types/protocol.d.ts +22 -0
  113. package/dist/types/protocol.d.ts.map +1 -1
  114. package/dist/types/protocol.js +31 -5
  115. package/dist/types/protocol.js.map +1 -1
  116. package/dist/utils/ttl-cache.d.ts +26 -0
  117. package/dist/utils/ttl-cache.d.ts.map +1 -0
  118. package/dist/utils/ttl-cache.js +68 -0
  119. package/dist/utils/ttl-cache.js.map +1 -0
  120. package/package.json +1 -1
  121. package/schemas/README.md +1 -0
  122. package/schemas/kya-os-card.schema.json +6 -6
  123. package/schemas/mcp-extension-settings.json +37 -0
@@ -1 +1 @@
1
- {"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../src/card/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAEL,oBAAoB,EAIrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,UAAU,EACf,KAAK,UAAU,EAChB,MAAM,aAAa,CAAC;AAErB;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,8CAA8C,CAAC;AACnF,qEAAqE;AACrE,eAAO,MAAM,+BAA+B,qDAAqD,CAAC;AAClG,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB,yCAAyC,CAAC;AAC7E,4FAA4F;AAC5F,eAAO,MAAM,aAAa,uBAAmB,CAAC;AAI9C,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,wBAAwB,CAAC;CACvC;AAED,gFAAgF;AAChF,MAAM,MAAM,YAAY,GAAG;IAAE,oBAAoB,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,sFAAsF;AACtF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,oBAAoB,EAAE,iBAAiB,GAAG,YAAY,CAAC,CAAC;AAEnG,+DAA+D;AAC/D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,cAAc,CAAC;CACvB;AAED,0DAA0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE;QACN,EAAE,EAAE,MAAM,CAAC;QACX,UAAU,EAAE,OAAO,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,6FAA6F;QAC7F,YAAY,CAAC,EAAE,OAAO,aAAa,CAAC;KACrC,CAAC;CACH;AAED,6CAA6C;AAC7C,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,UAAU,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAID;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,GAAE,eAAoB,GAAG,eAAe,CAM/F;AAED,+FAA+F;AAC/F,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,eAAe,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/C,cAAc,CAKhB;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,CAE7D;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,eAAe,GAAG;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAClD,YAAY,CAkBd;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAazD"}
1
+ {"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../src/card/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAEL,oBAAoB,EAIrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,wBAAwB,EAC7B,KAAK,UAAU,EACf,KAAK,UAAU,EAChB,MAAM,aAAa,CAAC;AAErB;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,8CAA8C,CAAC;AACnF,qEAAqE;AACrE,eAAO,MAAM,+BAA+B,qDAAqD,CAAC;AAClG,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB,yCAAyC,CAAC;AAC7E,4FAA4F;AAC5F,eAAO,MAAM,aAAa,wBAAmB,CAAC;AAI9C,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,wBAAwB,CAAC;CACvC;AAED,gFAAgF;AAChF,MAAM,MAAM,YAAY,GAAG;IAAE,oBAAoB,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,sFAAsF;AACtF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,oBAAoB,EAAE,iBAAiB,GAAG,YAAY,CAAC,CAAC;AAEnG,+DAA+D;AAC/D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,cAAc,CAAC;CACvB;AAED,0DAA0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE;QACN,EAAE,EAAE,MAAM,CAAC;QACX,UAAU,EAAE,OAAO,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,6FAA6F;QAC7F,YAAY,CAAC,EAAE,YAAY,CAAC;KAC7B,CAAC;CACH;AAED,6CAA6C;AAC7C,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,UAAU,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAID;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,GAAE,eAAoB,GAAG,eAAe,CAM/F;AAED,+FAA+F;AAC/F,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,eAAe,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/C,cAAc,CAKhB;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,CAE7D;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,eAAe,GAAG;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAClD,YAAY,CAkBd;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAazD"}
@@ -1 +1 @@
1
- {"version":3,"file":"emit.js","sourceRoot":"","sources":["../../src/card/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,gBAAgB,GAIjB,MAAM,aAAa,CAAC;AAYrB,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,2CAA2C,CAAC;AACnF,qEAAqE;AACrE,MAAM,CAAC,MAAM,+BAA+B,GAAG,kDAAkD,CAAC;AAClG,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,sCAAsC,CAAC;AAC7E,4FAA4F;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAuE9C,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAgB,EAAE,OAAwB,EAAE;IAC5E,OAAO;QACL,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,wBAAwB;QAC9B,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,gBAAgB,CAC9B,IAAgB,EAChB,OAA8C,EAAE;IAEhD,MAAM,KAAK,GAAqC,IAAI,CAAC,KAAK;QACxD,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAC7E,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,IAAgB;IAC7C,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAgB,EAChB,OAAiD,EAAE;IAEnD,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,gFAAgF,IAAI,CAAC,UAAU,IAAI,CACpG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAA2B;QACrC,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,UAAU,EAAE,OAAO;QACnB,OAAO,EAAE,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IAC7E,OAAO;QACL,GAAG,EAAE,uBAAuB;QAC5B,WAAW,EAAE,+BAA+B;QAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;QAChC,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAgB;IAC3C,MAAM,KAAK,GAAe;QACxB,UAAU,EAAE,EAAE,GAAG,EAAE,sBAAsB,EAAE;QAC3C,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,UAAU,EAAE,IAAI,CAAC,IAAI;QACrB,gBAAgB,EAAE,IAAI,CAAC,UAAU;KAClC,CAAC;IACF,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS;QAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC7E,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,KAAK,CAAC,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7F,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS;QAAE,KAAK,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC/F,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,KAAK,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;IACnF,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;QAAE,KAAK,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC;IACtF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAE/E;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,IAAgB;IACnC,MAAM,OAAO,GAAsB,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACjG,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,CAAC,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/F,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS;QAAE,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC1F,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IACjF,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9E,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACxE,OAAO,OAAO,CAAC;AACjB,CAAC"}
1
+ {"version":3,"file":"emit.js","sourceRoot":"","sources":["../../src/card/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,gBAAgB,GAKjB,MAAM,aAAa,CAAC;AAYrB,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,2CAA2C,CAAC;AACnF,qEAAqE;AACrE,MAAM,CAAC,MAAM,+BAA+B,GAAG,kDAAkD,CAAC;AAClG,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,sCAAsC,CAAC;AAC7E,4FAA4F;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAuE9C,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAgB,EAAE,OAAwB,EAAE;IAC5E,OAAO;QACL,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,wBAAwB;QAC9B,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,gBAAgB,CAC9B,IAAgB,EAChB,OAA8C,EAAE;IAEhD,MAAM,KAAK,GAAqC,IAAI,CAAC,KAAK;QACxD,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAC7E,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,IAAgB;IAC7C,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAgB,EAChB,OAAiD,EAAE;IAEnD,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,gFAAgF,IAAI,CAAC,UAAU,IAAI,CACpG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAA2B;QACrC,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,UAAU,EAAE,OAAO;QACnB,OAAO,EAAE,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IAC7E,OAAO;QACL,GAAG,EAAE,uBAAuB;QAC5B,WAAW,EAAE,+BAA+B;QAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;QAChC,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAgB;IAC3C,MAAM,KAAK,GAAe;QACxB,UAAU,EAAE,EAAE,GAAG,EAAE,sBAAsB,EAAE;QAC3C,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,UAAU,EAAE,IAAI,CAAC,IAAI;QACrB,gBAAgB,EAAE,IAAI,CAAC,UAAU;KAClC,CAAC;IACF,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS;QAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC7E,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,KAAK,CAAC,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7F,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS;QAAE,KAAK,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC/F,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,KAAK,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;IACnF,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;QAAE,KAAK,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC;IACtF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAE/E;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,IAAgB;IACnC,MAAM,OAAO,GAAsB,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACjG,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,CAAC,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/F,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS;QAAE,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC1F,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IACjF,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9E,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACxE,OAAO,OAAO,CAAC;AACjB,CAAC"}
@@ -13,7 +13,7 @@
13
13
  * - cimd (./cimd): BIND the L1 CIMD on-ramp — `client_id` ⇄ `did:web`, DID-keyed
14
14
  * JWKS, and the fail-closed origin/`alsoKnownAs` substitution graft.
15
15
  * - proof (./proof): MINT + VERIFY the stateless per-request holder-of-key proof
16
- * (`org.kya-os/proof@1`) — sender-constrained, fail-closed.
16
+ * (`org.kya-os/proof.v1`) — sender-constrained, fail-closed.
17
17
  * - delegation (./delegation): VALIDATE the W3C VC 2.0 + ZCAP-LD delegation chain — CRISP
18
18
  * attenuation + continuity, `responsibleParty`/leaf-invoker, fail-closed.
19
19
  * - builder (./builder): the fluent `card()` chain — the 10-minute path to a valid card.
@@ -13,7 +13,7 @@
13
13
  * - cimd (./cimd): BIND the L1 CIMD on-ramp — `client_id` ⇄ `did:web`, DID-keyed
14
14
  * JWKS, and the fail-closed origin/`alsoKnownAs` substitution graft.
15
15
  * - proof (./proof): MINT + VERIFY the stateless per-request holder-of-key proof
16
- * (`org.kya-os/proof@1`) — sender-constrained, fail-closed.
16
+ * (`org.kya-os/proof.v1`) — sender-constrained, fail-closed.
17
17
  * - delegation (./delegation): VALIDATE the W3C VC 2.0 + ZCAP-LD delegation chain — CRISP
18
18
  * attenuation + continuity, `responsibleParty`/leaf-invoker, fail-closed.
19
19
  * - builder (./builder): the fluent `card()` chain — the 10-minute path to a valid card.
@@ -10,7 +10,7 @@
10
10
  * both immutably (a shallow clone; a stripped `_meta` degrades to a fetch, never a failure).
11
11
  *
12
12
  * - `requireProof(deps, { minLevel? })` — the VERIFY side. Returns a per-request guard that
13
- * reads the holder-of-key proof from `_meta['org.kya-os/proof@1']`, RECOMPUTES it via
13
+ * reads the holder-of-key proof from `_meta['org.kya-os/request-proof']` (legacy `org.kya-os/proof.v1` accepted), RECOMPUTES it via
14
14
  * `./proof` ({@link verifyCardProof}) — every binding, fail-closed — enforces a minimum
15
15
  * assurance, and returns a 401-shaped result on any failure. The caller passes the exact
16
16
  * `{ method, params }` the client signed (i.e. WITHOUT `_meta`), so the recomputed
@@ -94,7 +94,7 @@ export interface RequireProofOptions {
94
94
  }
95
95
  /**
96
96
  * Build a per-request holder-of-key guard from the pre-bound proof-verification seams. The returned
97
- * guard reads `_meta['org.kya-os/proof@1']`, RECOMPUTES it against the request via {@link verifyCardProof},
97
+ * guard reads `_meta['org.kya-os/request-proof']` (legacy `org.kya-os/proof.v1` accepted), RECOMPUTES it against the request via {@link verifyCardProof},
98
98
  * enforces `opts.minLevel`, and returns `{ ok: true, did, level }` or a 401-shaped rejection. Fail-closed
99
99
  * throughout: a missing proof, a broken binding, a throwing verifier, or an assurance below `minLevel`
100
100
  * all reject.
@@ -106,7 +106,9 @@ export interface RequireProofOptions {
106
106
  * request FAILS CLOSED (`nonce_seam_missing`).
107
107
  */
108
108
  export declare function requireProof(deps: VerifyProofDeps, opts?: RequireProofOptions): ProofGuard;
109
- /** Read the card proof (`org.kya-os/proof@1`) out of a `_meta` record (undefined when absent / not an
110
- * object). A legacy session proof under `org.kya-os/proof` is a different key and is simply not seen. */
109
+ /** Read the card proof out of a `_meta` record (undefined when absent / not an object). Reads the
110
+ * canonical `org.kya-os/request-proof` key, falling back to the earlier draft key (`org.kya-os/proof.v1`,
111
+ * accepted for one major version); the canonical key wins when both are present. A legacy session
112
+ * proof under `org.kya-os/proof` is a different key and is simply not seen. */
111
113
  export declare function readCardProof(meta: unknown): unknown;
112
114
  //# sourceMappingURL=middleware.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/card/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EAGL,KAAK,cAAc,EAEnB,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAI9C,wFAAwF;AACxF,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,kGAAkG;AAClG,MAAM,WAAW,cAAc;IAC7B,uFAAuF;IACvF,QAAQ,EAAE,UAAU,CAAC;IACrB;;;OAGG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,8DAA8D;IAC9D,UAAU,EAAE,cAAc,CAAC;IAC3B,qGAAqG;IACrG,eAAe,CAAC,CAAC,SAAS,cAAc,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACjG,0GAA0G;IAC1G,gBAAgB,CAAC,CAAC,SAAS,eAAe,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;CACpF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,cAAc,CA4B9F;AAsBD,kGAAkG;AAClG,MAAM,MAAM,aAAa,GAAG,cAAc,CAAC;AAE3C,gFAAgF;AAChF,MAAM,MAAM,aAAa,GAAG,eAAe,GAAG,eAAe,GAAG,0BAA0B,CAAC;AAE3F,iGAAiG;AACjG,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,qGAAqG;AACrG,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACrE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,CAAC;AAEtD;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAEvF,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,sFAAsF;IACtF,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAKD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,GAAE,mBAAwB,GAAG,UAAU,CAsB9F;AAED;0GAC0G;AAC1G,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEpD"}
1
+ {"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/card/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EAIL,KAAK,cAAc,EAEnB,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAI9C,wFAAwF;AACxF,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,kGAAkG;AAClG,MAAM,WAAW,cAAc;IAC7B,uFAAuF;IACvF,QAAQ,EAAE,UAAU,CAAC;IACrB;;;OAGG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,8DAA8D;IAC9D,UAAU,EAAE,cAAc,CAAC;IAC3B,qGAAqG;IACrG,eAAe,CAAC,CAAC,SAAS,cAAc,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACjG,0GAA0G;IAC1G,gBAAgB,CAAC,CAAC,SAAS,eAAe,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;CACpF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,cAAc,CA4B9F;AAsBD,kGAAkG;AAClG,MAAM,MAAM,aAAa,GAAG,cAAc,CAAC;AAE3C,gFAAgF;AAChF,MAAM,MAAM,aAAa,GAAG,eAAe,GAAG,eAAe,GAAG,0BAA0B,CAAC;AAE3F,iGAAiG;AACjG,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,qGAAqG;AACrG,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACrE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,CAAC;AAEtD;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAEvF,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,sFAAsF;IACtF,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAKD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,GAAE,mBAAwB,GAAG,UAAU,CAsB9F;AAED;;;gFAGgF;AAChF,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAGpD"}
@@ -10,7 +10,7 @@
10
10
  * both immutably (a shallow clone; a stripped `_meta` degrades to a fetch, never a failure).
11
11
  *
12
12
  * - `requireProof(deps, { minLevel? })` — the VERIFY side. Returns a per-request guard that
13
- * reads the holder-of-key proof from `_meta['org.kya-os/proof@1']`, RECOMPUTES it via
13
+ * reads the holder-of-key proof from `_meta['org.kya-os/request-proof']` (legacy `org.kya-os/proof.v1` accepted), RECOMPUTES it via
14
14
  * `./proof` ({@link verifyCardProof}) — every binding, fail-closed — enforces a minimum
15
15
  * assurance, and returns a 401-shaped result on any failure. The caller passes the exact
16
16
  * `{ method, params }` the client signed (i.e. WITHOUT `_meta`), so the recomputed
@@ -20,7 +20,7 @@
20
20
  */
21
21
  import { isRecord } from '../utils/guards.js';
22
22
  import { toDidServiceEntry, toServerCardMeta, } from './emit.js';
23
- import { verifyCardProof, KYA_OS_CARD_PROOF_META_KEY, } from './proof/index.js';
23
+ import { verifyCardProof, KYA_OS_CARD_PROOF_META_KEY, LEGACY_CARD_PROOF_META_KEY, } from './proof/index.js';
24
24
  /**
25
25
  * Bundle a card into its three discovery artifacts and hand back immutable mounters. `opts.byRef`
26
26
  * projects the `_meta` as a lazy-fetch `cardRef` instead of an inline summary. NOTE: the DID
@@ -66,7 +66,7 @@ function appendService(didDoc, entry) {
66
66
  const ASSURANCE_RANK = { 'L3-minus': 1, L3: 2 };
67
67
  /**
68
68
  * Build a per-request holder-of-key guard from the pre-bound proof-verification seams. The returned
69
- * guard reads `_meta['org.kya-os/proof@1']`, RECOMPUTES it against the request via {@link verifyCardProof},
69
+ * guard reads `_meta['org.kya-os/request-proof']` (legacy `org.kya-os/proof.v1` accepted), RECOMPUTES it against the request via {@link verifyCardProof},
70
70
  * enforces `opts.minLevel`, and returns `{ ok: true, did, level }` or a 401-shaped rejection. Fail-closed
71
71
  * throughout: a missing proof, a broken binding, a throwing verifier, or an assurance below `minLevel`
72
72
  * all reject.
@@ -81,7 +81,7 @@ export function requireProof(deps, opts = {}) {
81
81
  return async (req, meta) => {
82
82
  const proof = readCardProof(meta);
83
83
  if (proof === undefined) {
84
- return fail('proof_missing', 'no org.kya-os/proof@1 in _meta', ['proof_missing']);
84
+ return fail('proof_missing', 'no org.kya-os/request-proof in _meta', ['proof_missing']);
85
85
  }
86
86
  const result = await recompute(proof, req, deps);
87
87
  if (!result.ok || result.did === undefined || result.level === undefined) {
@@ -100,10 +100,14 @@ export function requireProof(deps, opts = {}) {
100
100
  };
101
101
  };
102
102
  }
103
- /** Read the card proof (`org.kya-os/proof@1`) out of a `_meta` record (undefined when absent / not an
104
- * object). A legacy session proof under `org.kya-os/proof` is a different key and is simply not seen. */
103
+ /** Read the card proof out of a `_meta` record (undefined when absent / not an object). Reads the
104
+ * canonical `org.kya-os/request-proof` key, falling back to the earlier draft key (`org.kya-os/proof.v1`,
105
+ * accepted for one major version); the canonical key wins when both are present. A legacy session
106
+ * proof under `org.kya-os/proof` is a different key and is simply not seen. */
105
107
  export function readCardProof(meta) {
106
- return isRecord(meta) ? meta[KYA_OS_CARD_PROOF_META_KEY] : undefined;
108
+ if (!isRecord(meta))
109
+ return undefined;
110
+ return meta[KYA_OS_CARD_PROOF_META_KEY] ?? meta[LEGACY_CARD_PROOF_META_KEY];
107
111
  }
108
112
  /** Recompute the proof, fail-closed: a throwing verifier demotes to a rejected result (never escapes). */
109
113
  async function recompute(proof, req, deps) {
@@ -1 +1 @@
1
- {"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/card/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GAGjB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,eAAe,EACf,0BAA0B,GAI3B,MAAM,kBAAkB,CAAC;AAkC1B;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAgB,EAAE,OAA4B,EAAE;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,uFAAuF,IAAI,CAAC,EAAE,MAAM;YAClG,mDAAmD,CACtD,CAAC;IACJ,CAAC;IACD,iGAAiG;IACjG,mGAAmG;IACnG,8FAA8F;IAC9F,MAAM,eAAe,GAAG,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,eAAe;QACf,UAAU;QACV,eAAe,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC;QACxE,gBAAgB,EAAE,CAAC,MAAM,EAAE,EAAE;YAC3B,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,CAAC,EAAE,6DAA6D;oBAC1F,6EAA6E,CAChF,CAAC;YACJ,CAAC;YACD,OAAO,aAAa,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,SAAS,eAAe,CACtB,UAAa,EACb,IAAoB;IAEpB,OAAO,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED,uGAAuG;AACvG,SAAS,aAAa,CACpB,MAAS,EACT,KAAsB;IAEtB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;AACrD,CAAC;AAkCD,8FAA8F;AAC9F,MAAM,cAAc,GAAmC,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,IAAqB,EAAE,OAA4B,EAAE;IAChF,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,eAAe,EAAE,gCAAgC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC,eAAe,EAAE,oCAAoC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3E,MAAM,OAAO,GAAG,mBAAmB,KAAK,0BAA0B,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC,0BAA0B,EAAE,OAAO,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,KAAK;YACL,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;0GAC0G;AAC1G,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,0GAA0G;AAC1G,KAAK,UAAU,SAAS,CACtB,KAAc,EACd,GAAgB,EAChB,IAAqB;IAErB,IAAI,CAAC;QACH,OAAO,MAAM,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,8BAA8B;AAC9B,SAAS,IAAI,CAAC,IAAmB,EAAE,OAAe,EAAE,OAAiB;IACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;AACvE,CAAC"}
1
+ {"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/card/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GAGjB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,0BAA0B,GAI3B,MAAM,kBAAkB,CAAC;AAkC1B;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAgB,EAAE,OAA4B,EAAE;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,uFAAuF,IAAI,CAAC,EAAE,MAAM;YAClG,mDAAmD,CACtD,CAAC;IACJ,CAAC;IACD,iGAAiG;IACjG,mGAAmG;IACnG,8FAA8F;IAC9F,MAAM,eAAe,GAAG,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,eAAe;QACf,UAAU;QACV,eAAe,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC;QACxE,gBAAgB,EAAE,CAAC,MAAM,EAAE,EAAE;YAC3B,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,CAAC,EAAE,6DAA6D;oBAC1F,6EAA6E,CAChF,CAAC;YACJ,CAAC;YACD,OAAO,aAAa,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,SAAS,eAAe,CACtB,UAAa,EACb,IAAoB;IAEpB,OAAO,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED,uGAAuG;AACvG,SAAS,aAAa,CACpB,MAAS,EACT,KAAsB;IAEtB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;AACrD,CAAC;AAkCD,8FAA8F;AAC9F,MAAM,cAAc,GAAmC,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,IAAqB,EAAE,OAA4B,EAAE;IAChF,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,eAAe,EAAE,sCAAsC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC,eAAe,EAAE,oCAAoC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3E,MAAM,OAAO,GAAG,mBAAmB,KAAK,0BAA0B,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC,0BAA0B,EAAE,OAAO,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,KAAK;YACL,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;gFAGgF;AAChF,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,IAAI,CAAC,0BAA0B,CAAC,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;AAC9E,CAAC;AAED,0GAA0G;AAC1G,KAAK,UAAU,SAAS,CACtB,KAAc,EACd,GAAgB,EAChB,IAAqB;IAErB,IAAI,CAAC;QACH,OAAO,MAAM,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,8BAA8B;AAC9B,SAAS,IAAI,CAAC,IAAmB,EAAE,OAAe,EAAE,OAAiB;IACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;AACvE,CAAC"}
@@ -1,8 +1,8 @@
1
1
  /**
2
2
  * KYA-OS Entity Card proof — MINT (`buildCardProof`).
3
3
  *
4
- * Mint a stateless, sender-constrained `org.kya-os/proof@1` for one request and return it under the
5
- * card proof's OWN `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/proof@1`), distinct
4
+ * Mint a stateless, sender-constrained `org.kya-os/proof.v1` for one request and return it under the
5
+ * card proof's OWN `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/request-proof`), distinct
6
6
  * from the legacy session proof's `org.kya-os/proof` so the two coexist. The proof binds:
7
7
  * `requestHash` → THIS body (JCS), `audience` → THIS recipient, `nonce` + `created`/`expires` → NOW,
8
8
  * `kid` → the signing DID key, and (optionally) `cnf.jkt` → the token's RFC 9449 sender-constraint.
@@ -11,7 +11,7 @@
11
11
  import type { ToolRequest } from '../../proof/generator.js';
12
12
  import { KYA_OS_CARD_PROOF_META_KEY, type BuildProofContext, type CardProofMeta, type ProofSigner } from './types.js';
13
13
  /**
14
- * Mint an `org.kya-os/proof@1` for `req`, signed by `signer`, bound to `ctx`. Returns the proof
14
+ * Mint an `org.kya-os/proof.v1` for `req`, signed by `signer`, bound to `ctx`. Returns the proof
15
15
  * keyed by {@link KYA_OS_CARD_PROOF_META_KEY} so it can be spread straight into an MCP request
16
16
  * `_meta`. The `cnf.jkt` is `ctx.cnfJkt` when given, else the signer's own key thumbprint, else
17
17
  * omitted (an L3-minus proof — still bound by request + audience + nonce + key).
@@ -1,8 +1,8 @@
1
1
  /**
2
2
  * KYA-OS Entity Card proof — MINT (`buildCardProof`).
3
3
  *
4
- * Mint a stateless, sender-constrained `org.kya-os/proof@1` for one request and return it under the
5
- * card proof's OWN `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/proof@1`), distinct
4
+ * Mint a stateless, sender-constrained `org.kya-os/proof.v1` for one request and return it under the
5
+ * card proof's OWN `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/request-proof`), distinct
6
6
  * from the legacy session proof's `org.kya-os/proof` so the two coexist. The proof binds:
7
7
  * `requestHash` → THIS body (JCS), `audience` → THIS recipient, `nonce` + `created`/`expires` → NOW,
8
8
  * `kid` → the signing DID key, and (optionally) `cnf.jkt` → the token's RFC 9449 sender-constraint.
@@ -12,7 +12,7 @@ import { canonicalPayloadBytes, computeRequestHash } from './canonical.js';
12
12
  import { httpSignatureBaseBytes } from './http-sig.js';
13
13
  import { DEFAULT_TTL_SEC, KYA_OS_CARD_PROOF_META_KEY, MAX_TTL_SEC, PROOF_PROFILE_V1, } from './types.js';
14
14
  /**
15
- * Mint an `org.kya-os/proof@1` for `req`, signed by `signer`, bound to `ctx`. Returns the proof
15
+ * Mint an `org.kya-os/proof.v1` for `req`, signed by `signer`, bound to `ctx`. Returns the proof
16
16
  * keyed by {@link KYA_OS_CARD_PROOF_META_KEY} so it can be spread straight into an MCP request
17
17
  * `_meta`. The `cnf.jkt` is `ctx.cnfJkt` when given, else the signer's own key thumbprint, else
18
18
  * omitted (an L3-minus proof — still bound by request + audience + nonce + key).
@@ -46,7 +46,7 @@ export declare function httpSignatureBase(proof: CardProofMeta): string;
46
46
  /** The UTF-8 bytes of {@link httpSignatureBase} — the payload the `signRaw` seam signs at mint. */
47
47
  export declare function httpSignatureBaseBytes(proof: CardProofMeta): Uint8Array;
48
48
  /**
49
- * Project a minted `org.kya-os/proof@1` into its RFC 9421 header set. Emits EVERY covered
49
+ * Project a minted `org.kya-os/proof.v1` into its RFC 9421 header set. Emits EVERY covered
50
50
  * component as a real HTTP field — `Content-Digest`/`Kya-Audience`/`Kya-Nonce` (and `Kya-Cnf`
51
51
  * when a `cnf` is present), each byte-identical to its {@link httpSignatureBase} line — plus
52
52
  * `Signature-Input` (the covered-component list + params) and `Signature` (the RAW `httpSig` as a
@@ -56,7 +56,7 @@ export function httpSignatureBaseBytes(proof) {
56
56
  return encoder.encode(httpSignatureBase(proof));
57
57
  }
58
58
  /**
59
- * Project a minted `org.kya-os/proof@1` into its RFC 9421 header set. Emits EVERY covered
59
+ * Project a minted `org.kya-os/proof.v1` into its RFC 9421 header set. Emits EVERY covered
60
60
  * component as a real HTTP field — `Content-Digest`/`Kya-Audience`/`Kya-Nonce` (and `Kya-Cnf`
61
61
  * when a `cnf` is present), each byte-identical to its {@link httpSignatureBase} line — plus
62
62
  * `Signature-Input` (the covered-component list + params) and `Signature` (the RAW `httpSig` as a
@@ -1,5 +1,5 @@
1
1
  /**
2
- * KYA-OS Entity Card — stateless per-request holder-of-key proof (`org.kya-os/proof@1`).
2
+ * KYA-OS Entity Card — stateless per-request holder-of-key proof (`org.kya-os/proof.v1`).
3
3
  *
4
4
  * The security-critical module, split into focused units re-exported here:
5
5
  * - types (./types): CardProofMeta + the minting/verifying seams and result shapes.
@@ -12,7 +12,7 @@
12
12
  * + the NonceCacheProvider adapter) so the safe consume is the default.
13
13
  *
14
14
  * Distinct from — and orthogonal to — the legacy session-bound proof in `src/proof`: the card proof
15
- * rides its OWN `_meta['org.kya-os/proof@1']` key, separate from the legacy `org.kya-os/proof`, so
15
+ * rides its OWN `_meta['org.kya-os/request-proof']` key, separate from the legacy `org.kya-os/proof`, so
16
16
  * both regimes can run on one server without either guard seeing the other's proof.
17
17
  */
18
18
  export * from './types.js';
@@ -1,5 +1,5 @@
1
1
  /**
2
- * KYA-OS Entity Card — stateless per-request holder-of-key proof (`org.kya-os/proof@1`).
2
+ * KYA-OS Entity Card — stateless per-request holder-of-key proof (`org.kya-os/proof.v1`).
3
3
  *
4
4
  * The security-critical module, split into focused units re-exported here:
5
5
  * - types (./types): CardProofMeta + the minting/verifying seams and result shapes.
@@ -12,7 +12,7 @@
12
12
  * + the NonceCacheProvider adapter) so the safe consume is the default.
13
13
  *
14
14
  * Distinct from — and orthogonal to — the legacy session-bound proof in `src/proof`: the card proof
15
- * rides its OWN `_meta['org.kya-os/proof@1']` key, separate from the legacy `org.kya-os/proof`, so
15
+ * rides its OWN `_meta['org.kya-os/request-proof']` key, separate from the legacy `org.kya-os/proof`, so
16
16
  * both regimes can run on one server without either guard seeing the other's proof.
17
17
  */
18
18
  export * from './types.js';
@@ -1,5 +1,5 @@
1
1
  /**
2
- * KYA-OS Entity Card — batteries-included replay defense for `org.kya-os/proof@1`.
2
+ * KYA-OS Entity Card — batteries-included replay defense for `org.kya-os/proof.v1`.
3
3
  *
4
4
  * The {@link ConsumeNonceIfFresh} seam is security-critical: it MUST be an ATOMIC test-AND-set
5
5
  * (record the nonce AND report whether it was already seen, in one step). Hand-rolling it is the
@@ -1,5 +1,5 @@
1
1
  /**
2
- * KYA-OS Entity Card — batteries-included replay defense for `org.kya-os/proof@1`.
2
+ * KYA-OS Entity Card — batteries-included replay defense for `org.kya-os/proof.v1`.
3
3
  *
4
4
  * The {@link ConsumeNonceIfFresh} seam is security-critical: it MUST be an ATOMIC test-AND-set
5
5
  * (record the nonce AND report whether it was already seen, in one step). Hand-rolling it is the
@@ -1,8 +1,8 @@
1
1
  /**
2
2
  * KYA-OS Entity Card — stateless per-request holder-of-key proof: shapes + seams.
3
3
  *
4
- * `org.kya-os/proof@1` is the STATELESS, sender-constrained proof profile. It rides its OWN
5
- * `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/proof@1`), DISTINCT from the legacy
4
+ * `org.kya-os/proof.v1` is the STATELESS, sender-constrained proof profile. It rides its OWN
5
+ * `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/request-proof`), DISTINCT from the legacy
6
6
  * session-bound `ProofMeta` (which carries `sessionId` + a handshake nonce under
7
7
  * `org.kya-os/proof`). Separate keys let the two regimes coexist on one server without either guard
8
8
  * seeing — or rejecting — the other's proof. Every request self-proves; there is no session state.
@@ -14,16 +14,25 @@
14
14
  import { z } from 'zod';
15
15
  import { type ProofPublicJwk } from '../schema.js';
16
16
  /** The stateless per-request proof profile tag (the `prf` discriminator). */
17
- export declare const PROOF_PROFILE_V1 = "org.kya-os/proof@1";
17
+ export declare const PROOF_PROFILE_V1 = "org.kya-os/proof.v1";
18
18
  /**
19
19
  * The `_meta` key the STATELESS card proof rides under — DISTINCT from the legacy session proof's
20
20
  * `org.kya-os/proof` (`KYA_OS_PROOF_META_KEY`). Sharing one key made the two regimes mutually
21
21
  * exclusive on a server (a legacy proof failed the card schema and was 401'd; a card proof failed
22
22
  * the legacy structure check). With separate keys each guard reads its OWN key and simply does not
23
23
  * see the other's proof, so both can run on one server — genuinely additive, no legacy coupling. The
24
- * key equals the `prf` profile id, so it is self-describing and versioned.
24
+ * key names the slot by ROLE (the request proof), pairing with the response proof's
25
+ * `org.kya-os/response-proof`; the profile VERSION lives inside the object, in its `prf` field.
26
+ * Keys carry no versions and no `@` (which MCP's `_meta` key grammar forbids anyway).
25
27
  */
26
- export declare const KYA_OS_CARD_PROOF_META_KEY = "org.kya-os/proof@1";
28
+ export declare const KYA_OS_CARD_PROOF_META_KEY = "org.kya-os/request-proof";
29
+ /**
30
+ * The earlier draft carrier key, which used the then-profile-id verbatim and therefore violated
31
+ * MCP's `_meta` key grammar. Verifiers accept it for one major version (SPEC-ENTITY-CARD §8.1);
32
+ * producers emit {@link KYA_OS_CARD_PROOF_META_KEY} and MAY mirror under this key for verifiers
33
+ * older than the rename. When both keys are present, the canonical key wins.
34
+ */
35
+ export declare const LEGACY_CARD_PROOF_META_KEY = "org.kya-os/proof@1";
27
36
  /** Default proof lifetime in seconds (SPEC §8: short-lived, ≤ 60s). */
28
37
  export declare const DEFAULT_TTL_SEC = 60;
29
38
  /** Maximum accepted proof lifetime in seconds — a longer window fails closed. */
@@ -47,7 +56,7 @@ export declare const CardProofCnfSchema: z.ZodObject<{
47
56
  jkt: z.ZodString;
48
57
  }, z.core.$strip>;
49
58
  /**
50
- * The `org.kya-os/proof@1` payload. Every field except the two signatures (`jws`, `httpSig`) is a
59
+ * The `org.kya-os/proof.v1` payload. Every field except the two signatures (`jws`, `httpSig`) is a
51
60
  * COVERED claim: the detached EdDSA `jws` signs the RFC 8785 (JCS) canonicalization of the claims,
52
61
  * so tampering any of them fails the signature. `cnf.jkt` is OPTIONAL — present it degrades to
53
62
  * L3-minus rather than blocking when the authorization server does not emit an RFC 9449 `cnf`.
@@ -60,7 +69,7 @@ export declare const CardProofCnfSchema: z.ZodObject<{
60
69
  * It degrades gracefully: a signer without a `signRaw` seam mints a JWS-only proof (no sibling).
61
70
  */
62
71
  export declare const CardProofMetaSchema: z.ZodObject<{
63
- prf: z.ZodLiteral<"org.kya-os/proof@1">;
72
+ prf: z.ZodUnion<readonly [z.ZodLiteral<"org.kya-os/proof.v1">, z.ZodLiteral<"org.kya-os/proof@1">]>;
64
73
  alg: z.ZodEnum<{
65
74
  EdDSA: "EdDSA";
66
75
  ES256: "ES256";
@@ -1 +1 @@
1
- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/card/proof/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAE1E,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,uBAAmB,CAAC;AAEjD;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,uBAAmB,CAAC;AAE3D,uEAAuE;AACvE,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,iFAAiF;AACjF,eAAO,MAAM,WAAW,KAAK,CAAC;AAE9B,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,QAAyC,CAAC;AAY1E,8FAA8F;AAC9F,eAAO,MAAM,kBAAkB;;iBAE7B,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;kBAerB,CAAC;AAEZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,mGAAmG;AACnG,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,SAAS,CAAC;IACf,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,OAAO,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAEjE;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,0GAA0G;IAC1G,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IACjC,qGAAqG;IACrG,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C;;;;;OAKG;IACH,OAAO,CAAC,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChD;AAED,gGAAgG;AAChG,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AAEnF,gGAAgG;AAChG,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,cAAc,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;AAE3F;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE7F;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,UAAU,CAAC;IACvB;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,oFAAoF;IACpF,gBAAgB,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,UAAU,CAAC;AAE/C,6FAA6F;AAC7F,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,uFAAuF;IACvF,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB"}
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/card/proof/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkD,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnG,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,wBAAmB,CAAC;AAEjD;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,6BAA6B,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,uBAA0B,CAAC;AAElE,uEAAuE;AACvE,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,iFAAiF;AACjF,eAAO,MAAM,WAAW,KAAK,CAAC;AAE9B,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,QAAyC,CAAC;AAY1E,8FAA8F;AAC9F,eAAO,MAAM,kBAAkB;;iBAE7B,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;kBAerB,CAAC;AAEZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,mGAAmG;AACnG,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,SAAS,CAAC;IACf,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,IAAI,CAAC;IACV,GAAG,EAAE,OAAO,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAEjE;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,0GAA0G;IAC1G,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IACjC,qGAAqG;IACrG,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C;;;;;OAKG;IACH,OAAO,CAAC,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChD;AAED,gGAAgG;AAChG,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AAEnF,gGAAgG;AAChG,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,cAAc,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;AAE3F;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE7F;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,UAAU,CAAC;IACvB;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,oFAAoF;IACpF,gBAAgB,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,UAAU,CAAC;AAE/C,6FAA6F;AAC7F,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,uFAAuF;IACvF,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB"}
@@ -1,8 +1,8 @@
1
1
  /**
2
2
  * KYA-OS Entity Card — stateless per-request holder-of-key proof: shapes + seams.
3
3
  *
4
- * `org.kya-os/proof@1` is the STATELESS, sender-constrained proof profile. It rides its OWN
5
- * `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/proof@1`), DISTINCT from the legacy
4
+ * `org.kya-os/proof.v1` is the STATELESS, sender-constrained proof profile. It rides its OWN
5
+ * `_meta` key ({@link KYA_OS_CARD_PROOF_META_KEY} = `org.kya-os/request-proof`), DISTINCT from the legacy
6
6
  * session-bound `ProofMeta` (which carries `sessionId` + a handshake nonce under
7
7
  * `org.kya-os/proof`). Separate keys let the two regimes coexist on one server without either guard
8
8
  * seeing — or rejecting — the other's proof. Every request self-proves; there is no session state.
@@ -12,7 +12,7 @@
12
12
  * uses only `jose` + `json-canonicalize`, already direct dependencies.
13
13
  */
14
14
  import { z } from 'zod';
15
- import { Did, PROOF_PROFILE_ID } from '../schema.js';
15
+ import { Did, LEGACY_PROOF_PROFILE_ID, PROOF_PROFILE_ID } from '../schema.js';
16
16
  /** The stateless per-request proof profile tag (the `prf` discriminator). */
17
17
  export const PROOF_PROFILE_V1 = PROOF_PROFILE_ID;
18
18
  /**
@@ -21,9 +21,18 @@ export const PROOF_PROFILE_V1 = PROOF_PROFILE_ID;
21
21
  * exclusive on a server (a legacy proof failed the card schema and was 401'd; a card proof failed
22
22
  * the legacy structure check). With separate keys each guard reads its OWN key and simply does not
23
23
  * see the other's proof, so both can run on one server — genuinely additive, no legacy coupling. The
24
- * key equals the `prf` profile id, so it is self-describing and versioned.
24
+ * key names the slot by ROLE (the request proof), pairing with the response proof's
25
+ * `org.kya-os/response-proof`; the profile VERSION lives inside the object, in its `prf` field.
26
+ * Keys carry no versions and no `@` (which MCP's `_meta` key grammar forbids anyway).
25
27
  */
26
- export const KYA_OS_CARD_PROOF_META_KEY = PROOF_PROFILE_V1;
28
+ export const KYA_OS_CARD_PROOF_META_KEY = 'org.kya-os/request-proof';
29
+ /**
30
+ * The earlier draft carrier key, which used the then-profile-id verbatim and therefore violated
31
+ * MCP's `_meta` key grammar. Verifiers accept it for one major version (SPEC-ENTITY-CARD §8.1);
32
+ * producers emit {@link KYA_OS_CARD_PROOF_META_KEY} and MAY mirror under this key for verifiers
33
+ * older than the rename. When both keys are present, the canonical key wins.
34
+ */
35
+ export const LEGACY_CARD_PROOF_META_KEY = LEGACY_PROOF_PROFILE_ID;
27
36
  /** Default proof lifetime in seconds (SPEC §8: short-lived, ≤ 60s). */
28
37
  export const DEFAULT_TTL_SEC = 60;
29
38
  /** Maximum accepted proof lifetime in seconds — a longer window fails closed. */
@@ -56,7 +65,7 @@ export const CardProofCnfSchema = z.object({
56
65
  jkt: z.string().min(1).regex(BASE64URL, 'cnf.jkt must be a base64url RFC 7638 thumbprint'),
57
66
  });
58
67
  /**
59
- * The `org.kya-os/proof@1` payload. Every field except the two signatures (`jws`, `httpSig`) is a
68
+ * The `org.kya-os/proof.v1` payload. Every field except the two signatures (`jws`, `httpSig`) is a
60
69
  * COVERED claim: the detached EdDSA `jws` signs the RFC 8785 (JCS) canonicalization of the claims,
61
70
  * so tampering any of them fails the signature. `cnf.jkt` is OPTIONAL — present it degrades to
62
71
  * L3-minus rather than blocking when the authorization server does not emit an RFC 9449 `cnf`.
@@ -69,7 +78,7 @@ export const CardProofCnfSchema = z.object({
69
78
  * It degrades gracefully: a signer without a `signRaw` seam mints a JWS-only proof (no sibling).
70
79
  */
71
80
  export const CardProofMetaSchema = z.object({
72
- prf: z.literal(PROOF_PROFILE_V1),
81
+ prf: z.union([z.literal(PROOF_PROFILE_V1), z.literal(LEGACY_PROOF_PROFILE_ID)]),
73
82
  alg: z.enum(['EdDSA', 'ES256']),
74
83
  did: Did,
75
84
  // The signing key reference MUST carry a `#fragment` (a verificationMethod id); the runtime also
@@ -1 +1 @@
1
- {"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/card/proof/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAuB,MAAM,cAAc,CAAC;AAE1E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,gBAAgB,CAAC;AAE3D,uEAAuE;AACvE,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC,iFAAiF;AACjF,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAE9B,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,GAAG,CAAC,GAAG,gBAAgB,GAAG,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,iDAAiD,CAAC;CAC3F,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAChC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/B,GAAG,EAAE,GAAG;IACR,iGAAiG;IACjG,8FAA8F;IAC9F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,EAAE,8DAA8D,CAAC;IAC9G,QAAQ,EAAE,GAAG;IACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,uFAAuF,CAAC;IAClI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,GAAG,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,uFAAuF"}
1
+ {"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/card/proof/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,GAAG,EAAE,uBAAuB,EAAE,gBAAgB,EAAuB,MAAM,cAAc,CAAC;AAEnG,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAEjD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,0BAA0B,CAAC;AAErE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AAElE,uEAAuE;AACvE,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC,iFAAiF;AACjF,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAE9B,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,GAAG,CAAC,GAAG,gBAAgB,GAAG,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,iDAAiD,CAAC;CAC3F,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC/E,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/B,GAAG,EAAE,GAAG;IACR,iGAAiG;IACjG,8FAA8F;IAC9F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,EAAE,8DAA8D,CAAC;IAC9G,QAAQ,EAAE,GAAG;IACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,uFAAuF,CAAC;IAClI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,GAAG,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,uFAAuF"}
@@ -1,7 +1,7 @@
1
1
  /**
2
2
  * KYA-OS Entity Card proof — VERIFY (`verifyCardProof`), fail-closed.
3
3
  *
4
- * Recompute EVERY binding a stateless `org.kya-os/proof@1` asserts and reject on the first thing
4
+ * Recompute EVERY binding a stateless `org.kya-os/proof.v1` asserts and reject on the first thing
5
5
  * that does not hold. The signature only proves the proof is AUTHENTIC (signed by the holder of
6
6
  * `kid`); accountability requires binding that key to the accountable principal `did`:
7
7
  *
@@ -19,7 +19,7 @@
19
19
  import type { ToolRequest } from '../../proof/generator.js';
20
20
  import { type ProofVerifyResult, type VerifyProofDeps } from './types.js';
21
21
  /**
22
- * Verify an `org.kya-os/proof@1` against the request it should bind and the injected seams.
22
+ * Verify an `org.kya-os/proof.v1` against the request it should bind and the injected seams.
23
23
  * Fail-closed: returns `{ ok:false, reasons }` on any broken binding; on success returns the
24
24
  * derived assurance (`L3` on full cnf fusion, `L3-minus` without an AS `cnf`) and the principal.
25
25
  */
@@ -1,7 +1,7 @@
1
1
  /**
2
2
  * KYA-OS Entity Card proof — VERIFY (`verifyCardProof`), fail-closed.
3
3
  *
4
- * Recompute EVERY binding a stateless `org.kya-os/proof@1` asserts and reject on the first thing
4
+ * Recompute EVERY binding a stateless `org.kya-os/proof.v1` asserts and reject on the first thing
5
5
  * that does not hold. The signature only proves the proof is AUTHENTIC (signed by the holder of
6
6
  * `kid`); accountability requires binding that key to the accountable principal `did`:
7
7
  *
@@ -21,7 +21,7 @@ import { base64urlDecodeToString, base64urlEncodeFromBytes } from '../../utils/b
21
21
  import { canonicalPayloadBytes, computeRequestHash } from './canonical.js';
22
22
  import { CardProofMetaSchema, DEFAULT_SKEW_SEC, MAX_TTL_SEC, } from './types.js';
23
23
  /**
24
- * Verify an `org.kya-os/proof@1` against the request it should bind and the injected seams.
24
+ * Verify an `org.kya-os/proof.v1` against the request it should bind and the injected seams.
25
25
  * Fail-closed: returns `{ ok:false, reasons }` on any broken binding; on success returns the
26
26
  * derived assurance (`L3` on full cnf fusion, `L3-minus` without an AS `cnf`) and the principal.
27
27
  */
@@ -7,10 +7,10 @@ import { z } from 'zod';
7
7
  /** A `did:key` or `did:web` DID — the single source of truth for the DID shape (imported, never re-declared). */
8
8
  export declare const Did: z.ZodString;
9
9
  export declare const EntityTypeSchema: z.ZodEnum<{
10
+ verifier: "verifier";
10
11
  mcp: "mcp";
11
12
  agent: "agent";
12
13
  client: "client";
13
- verifier: "verifier";
14
14
  human: "human";
15
15
  }>;
16
16
  export declare const ConformanceLevelSchema: z.ZodEnum<{
@@ -80,14 +80,22 @@ export declare const AttestationSchema: z.ZodObject<{
80
80
  }, z.core.$strict>;
81
81
  /** The canonical per-request proof profile id — the ONE source of truth every consumer
82
82
  * references (the proof's `prf` tag, its `_meta` key, and the card's `proofProfile` field). */
83
- export declare const PROOF_PROFILE_ID = "org.kya-os/proof@1";
83
+ export declare const PROOF_PROFILE_ID = "org.kya-os/proof.v1";
84
+ /**
85
+ * The profile id of the earlier draft (`proof@1`), replaced because the `@`
86
+ * spelling collided with MCP's `_meta` key grammar and duplicated the version
87
+ * the `prf` field already carries. Verifiers accept it (in `prf` and in
88
+ * `proofProfile`) for one major version; producers emit only
89
+ * {@link PROOF_PROFILE_ID}.
90
+ */
91
+ export declare const LEGACY_PROOF_PROFILE_ID = "org.kya-os/proof@1";
84
92
  /**
85
93
  * Self-declared per-request holder-of-key proof profile. A card carrying this advertises
86
- * that its requests ride the stateless, sender-constrained `org.kya-os/proof@1` envelope
94
+ * that its requests ride the stateless, sender-constrained `org.kya-os/proof.v1` envelope
87
95
  * (distinct from the legacy session-bound ProofMeta). The proof itself is NEVER on the
88
96
  * static card — it rides per-request `_meta`; this field only names the profile.
89
97
  */
90
- export declare const ProofProfileSchema: z.ZodLiteral<"org.kya-os/proof@1">;
98
+ export declare const ProofProfileSchema: z.ZodUnion<readonly [z.ZodLiteral<"org.kya-os/proof.v1">, z.ZodLiteral<"org.kya-os/proof@1">]>;
91
99
  /**
92
100
  * CIMD (draft-ietf-oauth-client-id-metadata-document) binding — the L1 on-ramp
93
101
  * coordinates. `clientId` is the `did:web` HTTPS form; `jwksUri` is the DID-keyed JWKS the
@@ -108,10 +116,10 @@ export declare const BitstringStatusListEntrySchema: z.ZodObject<{
108
116
  export declare const EntityCardSchema: z.ZodObject<{
109
117
  id: z.ZodString;
110
118
  entityType: z.ZodEnum<{
119
+ verifier: "verifier";
111
120
  mcp: "mcp";
112
121
  agent: "agent";
113
122
  client: "client";
114
- verifier: "verifier";
115
123
  human: "human";
116
124
  }>;
117
125
  name: z.ZodString;
@@ -148,7 +156,7 @@ export declare const EntityCardSchema: z.ZodObject<{
148
156
  issuer: z.ZodOptional<z.ZodString>;
149
157
  }, z.core.$strict>>>;
150
158
  didDocument: z.ZodOptional<z.ZodString>;
151
- proofProfile: z.ZodOptional<z.ZodLiteral<"org.kya-os/proof@1">>;
159
+ proofProfile: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"org.kya-os/proof.v1">, z.ZodLiteral<"org.kya-os/proof@1">]>>;
152
160
  cimd: z.ZodOptional<z.ZodObject<{
153
161
  clientId: z.ZodString;
154
162
  jwksUri: z.ZodString;
@@ -1 +1 @@
1
- {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/card/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAEH,iHAAiH;AACjH,eAAO,MAAM,GAAG,aAA6E,CAAC;AAE9F,eAAO,MAAM,gBAAgB;;;;;;EAA0D,CAAC;AAExF,eAAO,MAAM,sBAAsB;;;;EAA6B,CAAC;AAEjE,eAAO,MAAM,sBAAsB;;;;;;kBAQxB,CAAC;AAEZ,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB;;;;;;;kBASrB,CAAC;AAEZ,iGAAiG;AACjG,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;oBAAyD,CAAC;AAK3F;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;iBAEtC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;kBAKxB,CAAC;AAEZ,kEAAkE;AAClE,eAAO,MAAM,gBAAgB;;;;;oBAAuD,CAAC;AAErF,eAAO,MAAM,iBAAiB;;;;;;;;kBAOnB,CAAC;AAEZ;gGACgG;AAChG,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,oCAA8B,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;kBAKnB,CAAC;AAEZ;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;;kBAKhC,CAAC;AAEZ,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAyBlB,CAAC;AAEZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,oFAAoF;AACpF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,CAE5D"}
1
+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/card/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAEH,iHAAiH;AACjH,eAAO,MAAM,GAAG,aAA6E,CAAC;AAE9F,eAAO,MAAM,gBAAgB;;;;;;EAA0D,CAAC;AAExF,eAAO,MAAM,sBAAsB;;;;EAA6B,CAAC;AAEjE,eAAO,MAAM,sBAAsB;;;;;;kBAQxB,CAAC;AAEZ,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB;;;;;;;kBASrB,CAAC;AAEZ,iGAAiG;AACjG,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;oBAAyD,CAAC;AAK3F;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;iBAEtC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;kBAKxB,CAAC;AAEZ,kEAAkE;AAClE,eAAO,MAAM,gBAAgB;;;;;oBAAuD,CAAC;AAErF,eAAO,MAAM,iBAAiB;;;;;;;;kBAOnB,CAAC;AAEZ;gGACgG;AAChG,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AAEtD;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAE5D;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,gGAG7B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;kBAKnB,CAAC;AAEZ;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;;kBAKhC,CAAC;AAEZ,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAyBlB,CAAC;AAEZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,oFAAoF;AACpF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,CAE5D"}
@@ -57,14 +57,25 @@ export const AttestationSchema = z
57
57
  .strict();
58
58
  /** The canonical per-request proof profile id — the ONE source of truth every consumer
59
59
  * references (the proof's `prf` tag, its `_meta` key, and the card's `proofProfile` field). */
60
- export const PROOF_PROFILE_ID = 'org.kya-os/proof@1';
60
+ export const PROOF_PROFILE_ID = 'org.kya-os/proof.v1';
61
+ /**
62
+ * The profile id of the earlier draft (`proof@1`), replaced because the `@`
63
+ * spelling collided with MCP's `_meta` key grammar and duplicated the version
64
+ * the `prf` field already carries. Verifiers accept it (in `prf` and in
65
+ * `proofProfile`) for one major version; producers emit only
66
+ * {@link PROOF_PROFILE_ID}.
67
+ */
68
+ export const LEGACY_PROOF_PROFILE_ID = 'org.kya-os/proof@1';
61
69
  /**
62
70
  * Self-declared per-request holder-of-key proof profile. A card carrying this advertises
63
- * that its requests ride the stateless, sender-constrained `org.kya-os/proof@1` envelope
71
+ * that its requests ride the stateless, sender-constrained `org.kya-os/proof.v1` envelope
64
72
  * (distinct from the legacy session-bound ProofMeta). The proof itself is NEVER on the
65
73
  * static card — it rides per-request `_meta`; this field only names the profile.
66
74
  */
67
- export const ProofProfileSchema = z.literal(PROOF_PROFILE_ID);
75
+ export const ProofProfileSchema = z.union([
76
+ z.literal(PROOF_PROFILE_ID),
77
+ z.literal(LEGACY_PROOF_PROFILE_ID),
78
+ ]);
68
79
  /**
69
80
  * CIMD (draft-ietf-oauth-client-id-metadata-document) binding — the L1 on-ramp
70
81
  * coordinates. `clientId` is the `did:web` HTTPS form; `jwksUri` is the DID-keyed JWKS the
@@ -1 +1 @@
1
- {"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/card/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAEH,iHAAiH;AACjH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,kCAAkC,CAAC,CAAC;AAE9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAExF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACrB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACzB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACpB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACvB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE3F,gFAAgF;AAChF,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAErF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;IAC/D,EAAE,EAAE,OAAO;IACX,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE;IACvB,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;gGACgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,0DAA0D,CAAC;CAC1G,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,GAAG;IACP,UAAU,EAAE,gBAAgB;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,YAAY,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClD,2EAA2E;IAC3E,gBAAgB,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACnD,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,sFAAsF;IACtF,YAAY,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC3C,8EAA8E;IAC9E,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAClC,kFAAkF;IAClF,UAAU,EAAE,8BAA8B,CAAC,QAAQ,EAAE;CACtD,CAAC;IACF,mFAAmF;IACnF,mFAAmF;KAClF,MAAM,EAAE,CAAC;AAiBZ,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,IAAkB;IAChD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC"}
1
+ {"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/card/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAEH,iHAAiH;AACjH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,kCAAkC,CAAC,CAAC;AAE9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAExF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACrB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACzB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACpB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACvB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE3F,gFAAgF;AAChF,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,EAAE,EAAE,OAAO;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAErF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;IAC/D,EAAE,EAAE,OAAO;IACX,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE;IACvB,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;gGACgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IACxC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAC3B,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;CACnC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,0DAA0D,CAAC;CAC1G,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,GAAG;IACP,UAAU,EAAE,gBAAgB;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,YAAY,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClD,2EAA2E;IAC3E,gBAAgB,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACnD,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,sFAAsF;IACtF,YAAY,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC3C,8EAA8E;IAC9E,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAClC,kFAAkF;IAClF,UAAU,EAAE,8BAA8B,CAAC,QAAQ,EAAE;CACtD,CAAC;IACF,mFAAmF;IACnF,mFAAmF;KAClF,MAAM,EAAE,CAAC;AAiBZ,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,IAAkB;IAChD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC"}
@@ -79,7 +79,7 @@ export interface VerifyCardDeps {
79
79
  attestationVerifier?: AttestationVerifier;
80
80
  /** Verifies the accountability edge (delegationRef → responsibleParty, leaf-invoker join). */
81
81
  accountabilityVerifier?: AccountabilityVerifier;
82
- /** The per-request holder-of-key proof that rode `_meta['org.kya-os/proof@1']` (recomputed here). */
82
+ /** The per-request holder-of-key proof that rode `_meta['org.kya-os/request-proof']` (recomputed here). */
83
83
  proof?: unknown;
84
84
  /** The request the proof must bind (`method` + `params`); required alongside `proof`. */
85
85
  request?: ToolRequest;