@kya-os/mcp 1.12.0 → 1.13.0

package/CHANGELOG.md

@@ -7,6 +7,34 @@ Versioning: https://semver.org/spec/v2.0.0.html
 
 ## [Unreleased]
 
+## [1.13.0] - 2026-08-12
+
+### Security
+
+- **Delegation verifier: revocation status and expiry are now evaluated on
+  every verification.** The per-instance cache previously stored the entire
+  verdict for `cacheTtl` (default 60 s), so a cache hit skipped the
+  credential-status check — a revoked credential kept verifying (and, on the
+  Data Integrity path, an expired one) until the entry lapsed. The cache now
+  holds only the signature/DID-validity result; basic checks and revocation
+  status run on every call, with signature and status still checked in
+  parallel. Warm-path latency now includes one status read — freshness policy
+  belongs in your `StatusListResolver`, never in the verdict. The `cached`
+  result flag now means "signature served from cache".
+
+### Added
+
+- **`withStatusCache(resolver, { maxStalenessMs, maxEntries? })`** — wraps any
+  `StatusListResolver` to cache status *bits* for an explicitly declared
+  staleness bound: the deployment names its revocation SLA instead of
+  inheriting a silent verdict cache. Throws are never cached (fail-closed
+  retry); `maxStalenessMs: 0` is a pass-through.
+- **`delegation.verificationCache` middleware config** (`{ ttlMs, maxEntries }`)
+  tuning the signature-verification cache; `ttlMs: 0` disables signature
+  caching (immediate issuer key-rotation pickup). Constructor `cacheTtl: 0`
+  is now honored (`??`, previously swallowed by `||`), and
+  `createDelegationVerifier` gains `maxCacheSize` parity.
+
 ## [1.12.0] - 2026-08-04
 
 ### Added

package/CONFORMANCE.md

@@ -430,6 +430,12 @@ protocol, and `negotiation` exercises the MCP extension admission gate
 A `fail` vector passes the suite only when the implementation correctly **rejects**
 it. The runner exits non-zero on any mismatch.
 
+**On `signed-proof/tampered-meta`.**
+The proof's `meta` block mirrors the claims signed inside the JWS, but it is a convenience for consumers that read the proof without decoding the token, not an authoritative copy.
+This vector leaves the JWS byte-identical to `valid-basic` and alters only the mirrored `meta.requestHash`, so the JWS signature still verifies.
+A conformant verifier MUST reconcile `meta` against the decoded JWS payload and reject on any mismatch.
+Signature validity alone does not pass this vector: it is the `requestHash` counterpart of the `responseHash` recompute rule in L2.11.
+
 ### Running the reference implementation
 
 ```bash

package/SPEC.md

@@ -23,7 +23,7 @@ The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "S
 
 ## Status
 
-**Stable 1.0.0** — Donated to DIF TAAWG (Decentralized Identity Foundation, Trusted AI Agents Working Group). Under review for ratification as a DIF standard. The wire format is stable: any future change that breaks compatibility with this version will require a major version bump.
+**Stable 1.0.0** — Donated to DIF TAAWG (Decentralized Identity Foundation, Trusted AI Agents Working Group) and ratified as a DIF standard. The wire format is stable: any future change that breaks compatibility with this version will require a major version bump.
 
 ---
 

package/dist/delegation/index.d.ts

@@ -6,6 +6,7 @@
  */
 export * from './vc-issuer.js';
 export * from './vc-verifier.js';
+export * from './status-cache.js';
 export * from './vc-jwt-verify.js';
 export * from './bitstring.js';
 export * from './statuslist-manager.js';

package/dist/delegation/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,gBAAgB,EAChB,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,GAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,gBAAgB,EAChB,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,GAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC"}

package/dist/delegation/index.js

@@ -6,6 +6,7 @@
  */
 export * from './vc-issuer.js';
 export * from './vc-verifier.js';
+export * from './status-cache.js';
 export * from './vc-jwt-verify.js';
 export * from './bitstring.js';
 export * from './statuslist-manager.js';

package/dist/delegation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,gBAAgB,GAGjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,gBAAgB,GAGjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC"}

package/dist/delegation/status-cache.d.ts

@@ -0,0 +1,9 @@
+import type { StatusListResolver } from './vc-verifier.types.js';
+export interface StatusCacheOptions {
+    /** Upper bound on served staleness, in ms — your declared revocation SLA. `<= 0` disables caching. */
+    maxStalenessMs: number;
+    /** Maximum cached entries (FIFO eviction). Default 1000. */
+    maxEntries?: number;
+}
+export declare function withStatusCache(resolver: StatusListResolver, options: StatusCacheOptions): StatusListResolver;
+//# sourceMappingURL=status-cache.d.ts.map

package/dist/delegation/status-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-cache.d.ts","sourceRoot":"","sources":["../../src/delegation/status-cache.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,MAAM,WAAW,kBAAkB;IACjC,sGAAsG;IACtG,cAAc,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,kBAAkB,GAC1B,kBAAkB,CAiBpB"}

package/dist/delegation/status-cache.js

@@ -0,0 +1,20 @@
+import { TtlCache } from '../utils/ttl-cache.js';
+export function withStatusCache(resolver, options) {
+    const cache = new TtlCache({
+        ttlMs: options.maxStalenessMs,
+        maxEntries: options.maxEntries ?? 1000,
+    });
+    return {
+        async checkStatus(status) {
+            const key = `${status.statusListCredential}\0${status.statusListIndex}\0${status.statusPurpose}`;
+            const hit = cache.get(key);
+            if (hit !== undefined)
+                return hit;
+            // A throw propagates uncached — fail-closed deny now, retry next call.
+            const revoked = await resolver.checkStatus(status);
+            cache.set(key, revoked);
+            return revoked;
+        },
+    };
+}
+//# sourceMappingURL=status-cache.js.map

package/dist/delegation/status-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-cache.js","sourceRoot":"","sources":["../../src/delegation/status-cache.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AASjD,MAAM,UAAU,eAAe,CAC7B,QAA4B,EAC5B,OAA2B;IAE3B,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAU;QAClC,KAAK,EAAE,OAAO,CAAC,cAAc;QAC7B,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;KACvC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,MAAwB;YACxC,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,oBAAoB,KAAK,MAAM,CAAC,eAAe,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;YACjG,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC;YAClC,uEAAuE;YACvE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACnD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACxB,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/delegation/vc-verifier.d.ts

@@ -10,7 +10,8 @@
  *
  * The stateless checks live in `./vc-verification-checks.ts`; the shapes in
  * `./vc-verifier.types.ts` (re-exported below). This class owns orchestration
- * and the per-instance result cache.
+ * and the per-instance SIGNATURE-result cache — revocation status and basic
+ * checks (expiry) are evaluated on every call, never served from cache.
  *
  * Related Spec: KYA-OS §4.3, W3C VC Data Model 1.1
  */
@@ -21,19 +22,17 @@ export declare class DelegationCredentialVerifier {
     private didResolver?;
     private statusListResolver?;
     private signatureVerifier?;
-    private cache;
-    private cacheInsertionOrder;
-    private cacheTtl;
     /**
-     * Maximum number of entries in the verification cache.
-     * In production deployments, configure maxCacheSize based on expected concurrent delegations.
-     * Default of 1000 is suitable for most use cases.
+     * Signature-result cache (FIFO eviction, TTL-bounded). Holds only REAL
+     * signature verifications; size `maxCacheSize` to the expected number of
+     * DISTINCT live credentials — the default of 1000 suits most deployments.
      */
-    private maxCacheSize;
+    private cache;
     constructor(options?: {
         didResolver?: DIDResolver;
         statusListResolver?: StatusListResolver;
         signatureVerifier?: SignatureVerificationFunction;
+        /** Signature-result TTL in ms. `0` disables signature caching. Default 60_000. */
         cacheTtl?: number;
         /** Maximum cache entries. Default: 1000 */
         maxCacheSize?: number;
@@ -63,18 +62,32 @@ export declare class DelegationCredentialVerifier {
      */
     verifyDelegationJwt(jwt: string, options?: VerifyDelegationVCOptions): Promise<DelegationVCVerificationResult>;
     /**
-     * Await the parallel signature + status checks, fold them into the final
-     * result via {@link combineVerificationResult}, and cache a valid one. Shared
-     * by the Data Integrity and VC-JWT paths; both reach here only after
-     * `validateBasicProperties` has passed.
+     * Resolve the signature dimension: an unexpired cached result when
+     * available, else `run()` — cached only when valid (failures are never
+     * cached). Returned as a promise so callers can race it with the status
+     * check; a hit reports `durationMs: 0` (the retrieval, not the original
+     * compute).
+     */
+    private cachedSignature;
+    /**
+     * Await the parallel signature + status checks and fold them into the final
+     * result via {@link combineVerificationResult}. The combined verdict is
+     * NEVER cached — only the signature dimension is (inside
+     * {@link cachedSignature}) — so revocation status is consulted on every
+     * call. Shared by the Data Integrity and VC-JWT paths; both reach here only
+     * after `validateBasicProperties` has passed.
      */
     private finalizeVerification;
     private cacheKeyForCredential;
     private cacheKeyForJwt;
+    /**
+     * The cache holds only REAL signature verifications: a `skipSignature` run
+     * fabricates `{ valid: true }` at zero cost, so it neither reads nor writes
+     * the cache (which is what lets the key drop the old per-profile
+     * dimension). Per-call resolver overrides also bypass — conservative,
+     * unchanged.
+     */
     private cacheAllowed;
-    private verificationProfile;
-    private getFromCache;
-    private setInCache;
     clearCache(): void;
     clearCacheEntry(id: string): void;
 }
@@ -82,6 +95,9 @@ export declare function createDelegationVerifier(options?: {
     didResolver?: DIDResolver;
     statusListResolver?: StatusListResolver;
     signatureVerifier?: SignatureVerificationFunction;
+    /** Signature-result TTL in ms. `0` disables signature caching. Default 60_000. */
     cacheTtl?: number;
+    /** Maximum cache entries. Default: 1000 */
+    maxCacheSize?: number;
 }): DelegationCredentialVerifier;
 //# sourceMappingURL=vc-verifier.d.ts.map

package/dist/delegation/vc-verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vc-verifier.d.ts","sourceRoot":"","sources":["../../src/delegation/vc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EACV,8BAA8B,EAC9B,yBAAyB,EACzB,WAAW,EACX,kBAAkB,EAElB,6BAA6B,EAC9B,MAAM,wBAAwB,CAAC;AAgBhC,cAAc,wBAAwB,CAAC;AAEvC,qBAAa,4BAA4B;IACvC,OAAO,CAAC,WAAW,CAAC,CAAc;IAClC,OAAO,CAAC,kBAAkB,CAAC,CAAqB;IAChD,OAAO,CAAC,iBAAiB,CAAC,CAAgC;IAC1D,OAAO,CAAC,KAAK,CAGT;IACJ,OAAO,CAAC,mBAAmB,CAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAS;IACzB;;;;OAIG;IACH,OAAO,CAAC,YAAY,CAAS;gBAEjB,OAAO,CAAC,EAAE;QACpB,WAAW,CAAC,EAAE,WAAW,CAAC;QAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;QACxC,iBAAiB,CAAC,EAAE,6BAA6B,CAAC;QAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,2CAA2C;QAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB;IAQD;;;;;;;;;;OAUG;IACG,0BAA0B,CAC9B,EAAE,EAAE,oBAAoB,EACxB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,8BAA8B,CAAC;IAkE1C;;;;;;;;;;OAUG;IACG,mBAAmB,CACvB,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,8BAA8B,CAAC;IA8C1C;;;;;OAKG;YACW,oBAAoB;IA8BlC,OAAO,CAAC,qBAAqB;IAa7B,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,UAAU;IAgBlB,UAAU,IAAI,IAAI;IAKlB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;CAUlC;AAED,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE;IACjD,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,iBAAiB,CAAC,EAAE,6BAA6B,CAAC;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,4BAA4B,CAE/B"}
+{"version":3,"file":"vc-verifier.d.ts","sourceRoot":"","sources":["../../src/delegation/vc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EACV,8BAA8B,EAC9B,yBAAyB,EACzB,WAAW,EACX,kBAAkB,EAElB,6BAA6B,EAE9B,MAAM,wBAAwB,CAAC;AAiBhC,cAAc,wBAAwB,CAAC;AAEvC,qBAAa,4BAA4B;IACvC,OAAO,CAAC,WAAW,CAAC,CAAc;IAClC,OAAO,CAAC,kBAAkB,CAAC,CAAqB;IAChD,OAAO,CAAC,iBAAiB,CAAC,CAAgC;IAC1D;;;;OAIG;IACH,OAAO,CAAC,KAAK,CAAwC;gBAEzC,OAAO,CAAC,EAAE;QACpB,WAAW,CAAC,EAAE,WAAW,CAAC;QAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;QACxC,iBAAiB,CAAC,EAAE,6BAA6B,CAAC;QAClD,kFAAkF;QAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,2CAA2C;QAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB;IAWD;;;;;;;;;;OAUG;IACG,0BAA0B,CAC9B,EAAE,EAAE,oBAAoB,EACxB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,8BAA8B,CAAC;IA6D1C;;;;;;;;;;OAUG;IACG,mBAAmB,CACvB,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,8BAA8B,CAAC;IA2C1C;;;;;;OAMG;YACW,eAAe;IAiB7B;;;;;;;OAOG;YACW,oBAAoB;IA4BlC,OAAO,CAAC,qBAAqB;IAa7B,OAAO,CAAC,cAAc;IAStB;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAOpB,UAAU,IAAI,IAAI;IAIlB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;CAOlC;AAED,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE;IACjD,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,iBAAiB,CAAC,EAAE,6BAA6B,CAAC;IAClD,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,4BAA4B,CAE/B"}

package/dist/delegation/vc-verifier.js

@@ -10,13 +10,15 @@
  *
  * The stateless checks live in `./vc-verification-checks.ts`; the shapes in
  * `./vc-verifier.types.ts` (re-exported below). This class owns orchestration
- * and the per-instance result cache.
+ * and the per-instance SIGNATURE-result cache — revocation status and basic
+ * checks (expiry) are evaluated on every call, never served from cache.
  *
  * Related Spec: KYA-OS §4.3, W3C VC Data Model 1.1
  */
 import { validateBasicProperties, verifySignature, checkCredentialStatus, combineVerificationResult, } from "./vc-verification-checks.js";
 import { verifyVcJwtSignature, prepareVcJwtCredential, } from "./vc-jwt-verify.js";
 import { canonicalizeJson } from "../utils/canonical-json.js";
+import { TtlCache } from "../utils/ttl-cache.js";
 // Re-export the shared type surface so existing imports of DIDResolver /
 // SignatureVerificationFunction / StatusListResolver / … are unchanged.
 export * from "./vc-verifier.types.js";
@@ -24,21 +26,21 @@ export class DelegationCredentialVerifier {
     didResolver;
     statusListResolver;
     signatureVerifier;
-    cache = new Map();
-    cacheInsertionOrder = [];
-    cacheTtl;
     /**
-     * Maximum number of entries in the verification cache.
-     * In production deployments, configure maxCacheSize based on expected concurrent delegations.
-     * Default of 1000 is suitable for most use cases.
+     * Signature-result cache (FIFO eviction, TTL-bounded). Holds only REAL
+     * signature verifications; size `maxCacheSize` to the expected number of
+     * DISTINCT live credentials — the default of 1000 suits most deployments.
      */
-    maxCacheSize;
+    cache;
     constructor(options) {
         this.didResolver = options?.didResolver;
         this.statusListResolver = options?.statusListResolver;
         this.signatureVerifier = options?.signatureVerifier;
-        this.cacheTtl = options?.cacheTtl || 60_000;
-        this.maxCacheSize = options?.maxCacheSize ?? 1000;
+        this.cache = new TtlCache({
+            // `??`, not `||`: cacheTtl 0 means "no signature caching", not "the default".
+            ttlMs: options?.cacheTtl ?? 60_000,
+            maxEntries: options?.maxCacheSize ?? 1000,
+        });
     }
     /**
      * Verify a delegation credential through progressive enhancement.
@@ -54,12 +56,8 @@ export class DelegationCredentialVerifier {
     async verifyDelegationCredential(vc, options = {}) {
         const startTime = Date.now();
         const cacheKey = this.cacheKeyForCredential('di', vc, options);
-        if (cacheKey !== null) {
-            const cached = this.getFromCache(cacheKey);
-            if (cached) {
-                return { ...cached, cached: true };
-            }
-        }
+        // Basic checks run on EVERY call — expiry is time-sensitive, so a warm
+        // signature cache must never carry a credential past its window.
         const basicCheckStart = Date.now();
         const basicValidation = validateBasicProperties(vc);
         const basicCheckMs = Date.now() - basicCheckStart;
@@ -78,19 +76,22 @@ export class DelegationCredentialVerifier {
             };
             return result;
         }
-        const signaturePromise = !options.skipSignature
-            ? verifySignature(vc, options.didResolver || this.didResolver, this.signatureVerifier)
-            : Promise.resolve({
+        // Both promises are constructed before either is awaited: a signature
+        // cache hit resolves instantly ALONGSIDE the live status read; a miss
+        // runs signature and status concurrently (unchanged parallelism).
+        const signaturePromise = this.cachedSignature(cacheKey, () => options.skipSignature
+            ? Promise.resolve({
                 valid: true,
                 durationMs: 0,
-            });
+            })
+            : verifySignature(vc, options.didResolver || this.didResolver, this.signatureVerifier));
         const statusPromise = !options.skipStatus && vc.credentialStatus
             ? checkCredentialStatus(vc.credentialStatus, options.statusListResolver || this.statusListResolver)
             : Promise.resolve({
                 valid: true,
                 durationMs: 0,
             });
-        return this.finalizeVerification(signaturePromise, statusPromise, basicCheckMs, startTime, cacheKey);
+        return this.finalizeVerification(signaturePromise, statusPromise, basicCheckMs, startTime);
     }
     /**
      * Verify a delegation credential presented as a compact VC-JWT — the JWT
@@ -111,37 +112,56 @@ export class DelegationCredentialVerifier {
         }
         const { vc, issuerDid, kid, basicCheckMs } = prepared;
         const cacheKey = this.cacheKeyForJwt(jwt, vc, options);
-        if (cacheKey !== null) {
-            const cached = this.getFromCache(cacheKey);
-            if (cached) {
-                return { ...cached, cached: true };
-            }
-        }
-        const signaturePromise = !options.skipSignature
-            ? verifyVcJwtSignature(jwt, issuerDid, kid, options.didResolver || this.didResolver)
-            : Promise.resolve({ valid: true, durationMs: 0 });
+        // Same construction as the Data Integrity path: both promises exist
+        // before either is awaited, so a cached signature races a LIVE status
+        // read and a miss keeps full signature/status parallelism.
+        const signaturePromise = this.cachedSignature(cacheKey, () => options.skipSignature
+            ? Promise.resolve({ valid: true, durationMs: 0 })
+            : verifyVcJwtSignature(jwt, issuerDid, kid, options.didResolver || this.didResolver));
         const statusPromise = !options.skipStatus && vc.credentialStatus
             ? checkCredentialStatus(vc.credentialStatus, options.statusListResolver || this.statusListResolver)
             : Promise.resolve({
                 valid: true,
                 durationMs: 0,
             });
-        return this.finalizeVerification(signaturePromise, statusPromise, basicCheckMs, startTime, cacheKey);
+        return this.finalizeVerification(signaturePromise, statusPromise, basicCheckMs, startTime);
+    }
+    /**
+     * Resolve the signature dimension: an unexpired cached result when
+     * available, else `run()` — cached only when valid (failures are never
+     * cached). Returned as a promise so callers can race it with the status
+     * check; a hit reports `durationMs: 0` (the retrieval, not the original
+     * compute).
+     */
+    async cachedSignature(cacheKey, run) {
+        if (cacheKey !== null) {
+            const hit = this.cache.get(cacheKey);
+            if (hit) {
+                return { result: { ...hit, durationMs: 0 }, cached: true };
+            }
+        }
+        const result = await run();
+        if (result.valid && cacheKey !== null) {
+            this.cache.set(cacheKey, result);
+        }
+        return { result, cached: false };
     }
     /**
-     * Await the parallel signature + status checks, fold them into the final
-     * result via {@link combineVerificationResult}, and cache a valid one. Shared
-     * by the Data Integrity and VC-JWT paths; both reach here only after
-     * `validateBasicProperties` has passed.
+     * Await the parallel signature + status checks and fold them into the final
+     * result via {@link combineVerificationResult}. The combined verdict is
+     * NEVER cached — only the signature dimension is (inside
+     * {@link cachedSignature}) — so revocation status is consulted on every
+     * call. Shared by the Data Integrity and VC-JWT paths; both reach here only
+     * after `validateBasicProperties` has passed.
      */
-    async finalizeVerification(signaturePromise, statusPromise, basicCheckMs, startTime, cacheKey) {
-        const [signatureResult, statusResult] = await Promise.all([
+    async finalizeVerification(signaturePromise, statusPromise, basicCheckMs, startTime) {
+        const [signature, statusResult] = await Promise.all([
             signaturePromise,
             statusPromise,
         ]);
-        const result = combineVerificationResult(signatureResult, statusResult, basicCheckMs, startTime);
-        if (result.valid && cacheKey !== null) {
-            this.setInCache(cacheKey, result);
+        const result = combineVerificationResult(signature.result, statusResult, basicCheckMs, startTime);
+        if (signature.cached) {
+            result.cached = true;
         }
         return result;
     }
@@ -149,7 +169,7 @@ export class DelegationCredentialVerifier {
         if (!this.cacheAllowed(options))
             return null;
         try {
-            return `${mode}\0${vc.id ?? ''}\0${this.verificationProfile(options)}\0${canonicalizeJson(vc)}`;
+            return `${mode}\0${vc.id ?? ''}\0${canonicalizeJson(vc)}`;
         }
         catch {
             return null;
@@ -158,55 +178,28 @@ export class DelegationCredentialVerifier {
     cacheKeyForJwt(jwt, vc, options) {
         if (!this.cacheAllowed(options))
             return null;
-        return `jwt\0${vc.id ?? ''}\0${this.verificationProfile(options)}\0${jwt}`;
+        return `jwt\0${vc.id ?? ''}\0${jwt}`;
     }
+    /**
+     * The cache holds only REAL signature verifications: a `skipSignature` run
+     * fabricates `{ valid: true }` at zero cost, so it neither reads nor writes
+     * the cache (which is what lets the key drop the old per-profile
+     * dimension). Per-call resolver overrides also bypass — conservative,
+     * unchanged.
+     */
     cacheAllowed(options) {
         return !options.skipCache &&
+            !options.skipSignature &&
             options.didResolver === undefined &&
             options.statusListResolver === undefined;
     }
-    verificationProfile(options) {
-        return `signature:${options.skipSignature ? 'skip' : 'verify'}|status:${options.skipStatus ? 'skip' : 'verify'}`;
-    }
-    getFromCache(id) {
-        const entry = this.cache.get(id);
-        if (!entry)
-            return null;
-        if (Date.now() > entry.expiresAt) {
-            this.cache.delete(id);
-            return null;
-        }
-        return entry.result;
-    }
-    setInCache(id, result) {
-        // Evict oldest entry if cache exceeds maxCacheSize (simple FIFO)
-        while (this.cache.size >= this.maxCacheSize && this.cacheInsertionOrder.length > 0) {
-            const oldestId = this.cacheInsertionOrder.shift();
-            if (oldestId) {
-                this.cache.delete(oldestId);
-            }
-        }
-        this.cache.set(id, {
-            result,
-            expiresAt: Date.now() + this.cacheTtl,
-        });
-        this.cacheInsertionOrder.push(id);
-    }
     clearCache() {
         this.cache.clear();
-        this.cacheInsertionOrder = [];
     }
     clearCacheEntry(id) {
         const diPrefix = `di\0${id}\0`;
         const jwtPrefix = `jwt\0${id}\0`;
-        for (const key of [...this.cache.keys()]) {
-            if (!key.startsWith(diPrefix) && !key.startsWith(jwtPrefix))
-                continue;
-            this.cache.delete(key);
-            const index = this.cacheInsertionOrder.indexOf(key);
-            if (index !== -1)
-                this.cacheInsertionOrder.splice(index, 1);
-        }
+        this.cache.deleteWhere((key) => key.startsWith(diPrefix) || key.startsWith(jwtPrefix));
     }
 }
 export function createDelegationVerifier(options) {

package/dist/delegation/vc-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"vc-verifier.js","sourceRoot":"","sources":["../../src/delegation/vc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAWH,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAE9D,yEAAyE;AACzE,wEAAwE;AACxE,cAAc,wBAAwB,CAAC;AAEvC,MAAM,OAAO,4BAA4B;IAC/B,WAAW,CAAe;IAC1B,kBAAkB,CAAsB;IACxC,iBAAiB,CAAiC;IAClD,KAAK,GAAG,IAAI,GAAG,EAGpB,CAAC;IACI,mBAAmB,GAAa,EAAE,CAAC;IACnC,QAAQ,CAAS;IACzB;;;;OAIG;IACK,YAAY,CAAS;IAE7B,YAAY,OAOX;QACC,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,WAAW,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,OAAO,EAAE,kBAAkB,CAAC;QACtD,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,CAAC;QACpD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,MAAM,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC;IACpD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,0BAA0B,CAC9B,EAAwB,EACxB,UAAqC,EAAE;QAEvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAE/D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC3C,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,eAAe,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;QAElD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAmC;gBAC7C,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,eAAe,CAAC,MAAM;gBAC9B,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE;oBACP,YAAY;oBACZ,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBAChC;gBACD,MAAM,EAAE;oBACN,UAAU,EAAE,KAAK;iBAClB;aACF,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,aAAa;YAC7C,CAAC,CAAC,eAAe,CACb,EAAE,EACF,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,EACvC,IAAI,CAAC,iBAAiB,CACvB;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAIZ;gBACD,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;QAEP,MAAM,aAAa,GACjB,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,gBAAgB;YACxC,CAAC,CAAC,qBAAqB,CACnB,EAAE,CAAC,gBAAgB,EACnB,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,kBAAkB,CACtD;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAoB;gBACjC,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;QAET,OAAO,IAAI,CAAC,oBAAoB,CAC9B,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,SAAS,EACT,QAAQ,CACT,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,mBAAmB,CACvB,GAAW,EACX,UAAqC,EAAE;QAEvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC1B,OAAO,QAAQ,CAAC,OAAO,CAAC;QAC1B,CAAC;QACD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAEvD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC3C,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,aAAa;YAC7C,CAAC,CAAC,oBAAoB,CAClB,GAAG,EACH,SAAS,EACT,GAAG,EACH,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CACxC;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QAE1E,MAAM,aAAa,GACjB,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,gBAAgB;YACxC,CAAC,CAAC,qBAAqB,CACnB,EAAE,CAAC,gBAAgB,EACnB,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,kBAAkB,CACtD;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAoB;gBACjC,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;QAET,OAAO,IAAI,CAAC,oBAAoB,CAC9B,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,SAAS,EACT,QAAQ,CACT,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,oBAAoB,CAChC,gBAIE,EACF,aAAyC,EACzC,YAAoB,EACpB,SAAiB,EACjB,QAAuB;QAEvB,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxD,gBAAgB;YAChB,aAAa;SACd,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,yBAAyB,CACtC,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,SAAS,CACV,CAAC;QAEF,IAAI,MAAM,CAAC,KAAK,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,qBAAqB,CAC3B,IAAU,EACV,EAAwB,EACxB,OAAkC;QAElC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC;QAClG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,cAAc,CACpB,GAAW,EACX,EAAwB,EACxB,OAAkC;QAElC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,OAAO,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC;IAC7E,CAAC;IAEO,YAAY,CAAC,OAAkC;QACrD,OAAO,CAAC,OAAO,CAAC,SAAS;YACvB,OAAO,CAAC,WAAW,KAAK,SAAS;YACjC,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC;IAC7C,CAAC;IAEO,mBAAmB,CAAC,OAAkC;QAC5D,OAAO,aAAa,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,WAAW,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnH,CAAC;IAEO,YAAY,CAAC,EAAU;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IAEO,UAAU,CAAC,EAAU,EAAE,MAAsC;QACnE,iEAAiE;QACjE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAClD,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE;YACjB,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,mBAAmB,GAAG,EAAE,CAAC;IAChC,CAAC;IAED,eAAe,CAAC,EAAU;QACxB,MAAM,QAAQ,GAAG,OAAO,EAAE,IAAI,CAAC;QAC/B,MAAM,SAAS,GAAG,QAAQ,EAAE,IAAI,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,SAAS;YACtE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,KAAK,KAAK,CAAC,CAAC;gBAAE,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CAAC,OAKxC;IACC,OAAO,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"vc-verifier.js","sourceRoot":"","sources":["../../src/delegation/vc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAYH,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD,yEAAyE;AACzE,wEAAwE;AACxE,cAAc,wBAAwB,CAAC;AAEvC,MAAM,OAAO,4BAA4B;IAC/B,WAAW,CAAe;IAC1B,kBAAkB,CAAsB;IACxC,iBAAiB,CAAiC;IAC1D;;;;OAIG;IACK,KAAK,CAAwC;IAErD,YAAY,OAQX;QACC,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,WAAW,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,OAAO,EAAE,kBAAkB,CAAC;QACtD,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,CAAC;QACpD,IAAI,CAAC,KAAK,GAAG,IAAI,QAAQ,CAA8B;YACrD,8EAA8E;YAC9E,KAAK,EAAE,OAAO,EAAE,QAAQ,IAAI,MAAM;YAClC,UAAU,EAAE,OAAO,EAAE,YAAY,IAAI,IAAI;SAC1C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,0BAA0B,CAC9B,EAAwB,EACxB,UAAqC,EAAE;QAEvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAE/D,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,eAAe,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;QAElD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAmC;gBAC7C,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,eAAe,CAAC,MAAM;gBAC9B,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE;oBACP,YAAY;oBACZ,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBAChC;gBACD,MAAM,EAAE;oBACN,UAAU,EAAE,KAAK;iBAClB;aACF,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,sEAAsE;QACtE,sEAAsE;QACtE,kEAAkE;QAClE,MAAM,gBAAgB,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,CAC3D,OAAO,CAAC,aAAa;YACnB,CAAC,CAAC,OAAO,CAAC,OAAO,CAA8B;gBAC3C,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,CAAC;aACd,CAAC;YACJ,CAAC,CAAC,eAAe,CACb,EAAE,EACF,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,EACvC,IAAI,CAAC,iBAAiB,CACvB,CACN,CAAC;QAEF,MAAM,aAAa,GACjB,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,gBAAgB;YACxC,CAAC,CAAC,qBAAqB,CACnB,EAAE,CAAC,gBAAgB,EACnB,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,kBAAkB,CACtD;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAoB;gBACjC,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;QAET,OAAO,IAAI,CAAC,oBAAoB,CAC9B,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,mBAAmB,CACvB,GAAW,EACX,UAAqC,EAAE;QAEvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC1B,OAAO,QAAQ,CAAC,OAAO,CAAC;QAC1B,CAAC;QACD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAEvD,oEAAoE;QACpE,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,gBAAgB,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,CAC3D,OAAO,CAAC,aAAa;YACnB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YACvE,CAAC,CAAC,oBAAoB,CAClB,GAAG,EACH,SAAS,EACT,GAAG,EACH,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CACxC,CACN,CAAC;QAEF,MAAM,aAAa,GACjB,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,gBAAgB;YACxC,CAAC,CAAC,qBAAqB,CACnB,EAAE,CAAC,gBAAgB,EACnB,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,kBAAkB,CACtD;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAoB;gBACjC,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;QAET,OAAO,IAAI,CAAC,oBAAoB,CAC9B,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,eAAe,CAC3B,QAAuB,EACvB,GAA+C;QAE/C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,KAAK,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,oBAAoB,CAChC,gBAGE,EACF,aAAyC,EACzC,YAAoB,EACpB,SAAiB;QAEjB,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAClD,gBAAgB;YAChB,aAAa;SACd,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,yBAAyB,CACtC,SAAS,CAAC,MAAM,EAChB,YAAY,EACZ,YAAY,EACZ,SAAS,CACV,CAAC;QAEF,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACrB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QACvB,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,qBAAqB,CAC3B,IAAU,EACV,EAAwB,EACxB,OAAkC;QAElC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,cAAc,CACpB,GAAW,EACX,EAAwB,EACxB,OAAkC;QAElC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,OAAO,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACK,YAAY,CAAC,OAAkC;QACrD,OAAO,CAAC,OAAO,CAAC,SAAS;YACvB,CAAC,OAAO,CAAC,aAAa;YACtB,OAAO,CAAC,WAAW,KAAK,SAAS;YACjC,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC;IAC7C,CAAC;IAED,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,eAAe,CAAC,EAAU;QACxB,MAAM,QAAQ,GAAG,OAAO,EAAE,IAAI,CAAC;QAC/B,MAAM,SAAS,GAAG,QAAQ,EAAE,IAAI,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,WAAW,CACpB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAC/D,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CAAC,OAQxC;IACC,OAAO,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC"}

package/dist/delegation/vc-verifier.types.d.ts

@@ -16,6 +16,17 @@ import type { CredentialStatus } from "../types/protocol.js";
  *   good; safe to retry once status resolution recovers.
  */
 export type StatusOutcome = "revoked" | "status_unresolvable";
+/**
+ * The signature/DID-validity dimension of a verification — the expensive,
+ * slow-changing half that the verifier caches. Shared by the Data Integrity
+ * path (`verifySignature`) and the VC-JWT path (`verifyVcJwtSignature`,
+ * whose `VcJwtSignatureResult` is structurally identical).
+ */
+export interface SignatureVerificationResult {
+    valid: boolean;
+    reason?: string;
+    durationMs?: number;
+}
 export interface DelegationVCVerificationResult {
     valid: boolean;
     reason?: string;
@@ -26,6 +37,13 @@ export interface DelegationVCVerificationResult {
      */
     statusOutcome?: StatusOutcome;
     stage: "basic" | "signature" | "status" | "complete";
+    /**
+     * True when the SIGNATURE verification was served from the per-instance
+     * cache. Basic checks (schema/expiry) and revocation status are always
+     * evaluated fresh on every call — only the signature/DID-validity result
+     * is ever cached. On a hit, `metrics.signatureCheckMs` reports the
+     * near-zero cache retrieval, not the original compute.
+     */
     cached?: boolean;
     metrics?: {
         basicCheckMs?: number;

package/dist/delegation/vc-verifier.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vc-verifier.types.d.ts","sourceRoot":"","sources":["../../src/delegation/vc-verifier.types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,qBAAqB,CAAC;AAE9D,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAC;IACrD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE;QACR,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,kBAAkB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC1C,cAAc,CAAC,EAAE,CAAC,MAAM,GAAG,kBAAkB,CAAC,EAAE,CAAC;IACjD,eAAe,CAAC,EAAE,CAAC,MAAM,GAAG,kBAAkB,CAAC,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzD;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,6BAA6B;IAC5C,CACE,EAAE,EAAE,OAAO,sBAAsB,EAAE,oBAAoB,EACvD,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC;QACT,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ"}
+{"version":3,"file":"vc-verifier.types.d.ts","sourceRoot":"","sources":["../../src/delegation/vc-verifier.types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,qBAAqB,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAC;IACrD;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE;QACR,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,kBAAkB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC1C,cAAc,CAAC,EAAE,CAAC,MAAM,GAAG,kBAAkB,CAAC,EAAE,CAAC;IACjD,eAAe,CAAC,EAAE,CAAC,MAAM,GAAG,kBAAkB,CAAC,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzD;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,6BAA6B;IAC5C,CACE,EAAE,EAAE,OAAO,sBAAsB,EAAE,oBAAoB,EACvD,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC;QACT,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ"}

package/dist/middleware/with-kya-os.config-types.d.ts

@@ -91,6 +91,19 @@ export interface KyaOsDelegationConfig {
      * rejected — so enabling `'enforce'` never breaks did:web traffic.
      */
     holderBinding?: "off" | "warn" | "enforce";
+    /**
+     * Tuning for the delegation verifier's SIGNATURE-verification cache (the
+     * expensive DID-resolve + crypto dimension). Revocation status and basic
+     * checks (expiry) are always evaluated fresh on every call and are NOT
+     * affected by this setting. Set `ttlMs: 0` to disable signature caching
+     * entirely (e.g. when issuer key rotation must take effect immediately).
+     */
+    verificationCache?: {
+        /** Signature-result TTL in milliseconds. Default 60_000. `0` disables caching. */
+        ttlMs?: number;
+        /** Maximum cached signature results (FIFO eviction). Default 1000. */
+        maxEntries?: number;
+    };
 }
 export interface KyaOsConfig {
     /** Agent identity (DID + key material) */

package/dist/middleware/with-kya-os.config-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.config-types.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.config-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAEtF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACpC,oFAAoF;IACpF,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,sFAAsF;IACtF,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AACD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,cAAc,kDAAmD,CAAC;AAC/E,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CACvB,cAAc,EAAE,oBAAoB,KACjC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACrC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,WAAW;IAC1B,0CAA0C;IAC1C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,sCAAsC;IACtC,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC5C;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC;;;;;;;;;;;;;;;OAeG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,wCAAwC;IACxC,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,eAAe,GAAG,KAAK,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B"}
+{"version":3,"file":"with-kya-os.config-types.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.config-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAEtF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACpC,oFAAoF;IACpF,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,sFAAsF;IACtF,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AACD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,cAAc,kDAAmD,CAAC;AAC/E,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CACvB,cAAc,EAAE,oBAAoB,KACjC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACrC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE;QAClB,kFAAkF;QAClF,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,sEAAsE;QACtE,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,WAAW;IAC1B,0CAA0C;IAC1C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,sCAAsC;IACtC,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC5C;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC;;;;;;;;;;;;;;;OAeG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,wCAAwC;IACxC,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,eAAe,GAAG,KAAK,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B"}

package/dist/middleware/with-kya-os.delegation-verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.delegation-verify.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiBH,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAG5D,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,CAChB,SAAS,EAAE,uBAAuB,KAC/B,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,uBAAuB,CACrB,cAAc,EAAE,oBAAoB,EACpC,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACpC,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,8EAA8E;IAC9E,4BAA4B,CAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACzC;;;;;OAKG;IACH,gCAAgC,CAC9B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC;QACT,gBAAgB,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACxD,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,cAAc,GACnB,sBAAsB,CAuLxB"}
+{"version":3,"file":"with-kya-os.delegation-verify.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiBH,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAG5D,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,CAChB,SAAS,EAAE,uBAAuB,KAC/B,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,uBAAuB,CACrB,cAAc,EAAE,oBAAoB,EACpC,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACpC,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,8EAA8E;IAC9E,4BAA4B,CAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACzC;;;;;OAKG;IACH,gCAAgC,CAC9B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC;QACT,gBAAgB,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACxD,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,cAAc,GACnB,sBAAsB,CAyLxB"}

package/dist/middleware/with-kya-os.delegation-verify.js

@@ -98,6 +98,8 @@ export function createDelegationVerification(deps) {
         didResolver,
         signatureVerifier,
         statusListResolver: delegationConfig?.statusListResolver,
+        cacheTtl: delegationConfig?.verificationCache?.ttlMs,
+        maxCacheSize: delegationConfig?.verificationCache?.maxEntries,
     });
     const buildDelegationErrorResponse = (error, reason) => ({
         content: [

package/dist/middleware/with-kya-os.delegation-verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.delegation-verify.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EACL,4BAA4B,GAG7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,IAAI,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GAGzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AA0C9D,MAAM,UAAU,4BAA4B,CAC1C,IAAoB;IAEpB,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAE5D,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;IAC9C,MAAM,aAAa,GACjB,gBAAgB,EAAE,aAAa;QAC/B,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;YACrC,CAAC,CAAC,IAAI,oBAAoB,EAAE;YAC5B,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,MAAM,cAAc,GAAG,aAAa;QAClC,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,sBAAsB,GAAG,wBAAwB,CACrD,gBAAgB,EAAE,YAAY,EAC9B,aAAa,CACd,CAAC;IACF,MAAM,WAAW,GAAgB;QAC/B,KAAK,CAAC,OAAO,CAAC,GAAW;YACvB,MAAM,cAAc,GAAG,gBAAgB,EAAE,WAAW,CAAC;YACrD,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,QAAQ,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,kBAAkB,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/E,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACvD,IAAI,QAAQ,EAAE,CAAC;wBACb,OAAO,QAAQ,CAAC;oBAClB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;YAC9C,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IAEF,MAAM,iBAAiB,GAAkC,KAAK,EAC5D,EAAwB,EACxB,YAAqB,EACyB,EAAE;QAChD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAgC,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACjE,CAAC;QAED,yEAAyE;QACzE,MAAM,QAAQ,GAAG,EAA6B,CAAC;QAC/C,MAAM,cAAc,GAA4B,EAAE,CAAC;QACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,OAAO;gBAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEjD,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEpD,iEAAiE;QACjE,MAAM,GAAG,GAAG,YAA8B,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAChE,CAAC;QAED,mEAAmE;QACnE,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAEhD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QACxE,OAAO;YACL,KAAK;YACL,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B;SAC5D,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAAC;QAChD,WAAW;QACX,iBAAiB;QACjB,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB;KACzD,CAAC,CAAC;IAEH,MAAM,4BAA4B,GAAG,CACnC,KAAa,EACb,MAAc,EACyB,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;aACpE;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,MAAM,uBAAuB,GAAG,CAC9B,cAAoC,EACpC,OAAqC,EACS,EAAE,CAChD,2BAA2B,CACzB,cAAc,EACd;QACE,SAAS,EAAE,QAAQ,CAAC,GAAG;QACvB,QAAQ;QACR,sBAAsB,EAAE,gBAAgB,EAAE,sBAAsB;QAChE,oBAAoB,EAAE,CAAC,CAAC,gBAAgB,EAAE,kBAAkB;QAC5D,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB;KACvD,EACD,OAAO,CACR,CAAC;IAEJ,KAAK,UAAU,gCAAgC,CAC7C,QAAgB,EAChB,MAA4B;QAK5B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,WAAW,GAAG;YAClB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;SACd,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;QAEtD,MAAM,SAAS,GAAG,6BAA6B,CAAC;YAC9C,OAAO,EAAE,SAAS,QAAQ,qCAAqC,MAAM,CAAC,OAAO,EAAE;YAC/E,gBAAgB,EAAE,MAAM,CAAC,UAAU;YACnC,WAAW;YACX,SAAS;YACT,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;QAEH,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,uBAAuB,GAAG;YAC9B,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;SAC3D,CAAC;QACF,IAAI,gBAAgB,GAAG,uBAAuB,CAAC;QAC/C,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,gBAAgB,GAAG,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE;oBAC1E,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,gBAAgB,GAAG,uBAAuB,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,uBAAuB;QACvB,4BAA4B;QAC5B,gCAAgC;KACjC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"with-kya-os.delegation-verify.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EACL,4BAA4B,GAG7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,IAAI,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GAGzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AA0C9D,MAAM,UAAU,4BAA4B,CAC1C,IAAoB;IAEpB,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAE5D,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;IAC9C,MAAM,aAAa,GACjB,gBAAgB,EAAE,aAAa;QAC/B,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;YACrC,CAAC,CAAC,IAAI,oBAAoB,EAAE;YAC5B,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,MAAM,cAAc,GAAG,aAAa;QAClC,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,sBAAsB,GAAG,wBAAwB,CACrD,gBAAgB,EAAE,YAAY,EAC9B,aAAa,CACd,CAAC;IACF,MAAM,WAAW,GAAgB;QAC/B,KAAK,CAAC,OAAO,CAAC,GAAW;YACvB,MAAM,cAAc,GAAG,gBAAgB,EAAE,WAAW,CAAC;YACrD,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,QAAQ,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,kBAAkB,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/E,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACvD,IAAI,QAAQ,EAAE,CAAC;wBACb,OAAO,QAAQ,CAAC;oBAClB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;YAC9C,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IAEF,MAAM,iBAAiB,GAAkC,KAAK,EAC5D,EAAwB,EACxB,YAAqB,EACyB,EAAE;QAChD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAgC,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACjE,CAAC;QAED,yEAAyE;QACzE,MAAM,QAAQ,GAAG,EAA6B,CAAC;QAC/C,MAAM,cAAc,GAA4B,EAAE,CAAC;QACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,OAAO;gBAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEjD,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEpD,iEAAiE;QACjE,MAAM,GAAG,GAAG,YAA8B,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAChE,CAAC;QAED,mEAAmE;QACnE,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAEhD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QACxE,OAAO;YACL,KAAK;YACL,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B;SAC5D,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAAC;QAChD,WAAW;QACX,iBAAiB;QACjB,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB;QACxD,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK;QACpD,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU;KAC9D,CAAC,CAAC;IAEH,MAAM,4BAA4B,GAAG,CACnC,KAAa,EACb,MAAc,EACyB,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;aACpE;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,MAAM,uBAAuB,GAAG,CAC9B,cAAoC,EACpC,OAAqC,EACS,EAAE,CAChD,2BAA2B,CACzB,cAAc,EACd;QACE,SAAS,EAAE,QAAQ,CAAC,GAAG;QACvB,QAAQ;QACR,sBAAsB,EAAE,gBAAgB,EAAE,sBAAsB;QAChE,oBAAoB,EAAE,CAAC,CAAC,gBAAgB,EAAE,kBAAkB;QAC5D,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB;KACvD,EACD,OAAO,CACR,CAAC;IAEJ,KAAK,UAAU,gCAAgC,CAC7C,QAAgB,EAChB,MAA4B;QAK5B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,WAAW,GAAG;YAClB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;SACd,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;QAEtD,MAAM,SAAS,GAAG,6BAA6B,CAAC;YAC9C,OAAO,EAAE,SAAS,QAAQ,qCAAqC,MAAM,CAAC,OAAO,EAAE;YAC/E,gBAAgB,EAAE,MAAM,CAAC,UAAU;YACnC,WAAW;YACX,SAAS;YACT,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;QAEH,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,uBAAuB,GAAG;YAC9B,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;SAC3D,CAAC;QACF,IAAI,gBAAgB,GAAG,uBAAuB,CAAC;QAC/C,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,gBAAgB,GAAG,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE;oBAC1E,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,gBAAgB,GAAG,uBAAuB,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,uBAAuB;QACvB,4BAA4B;QAC5B,gCAAgC;KACjC,CAAC;AACJ,CAAC"}

package/dist/utils/ttl-cache.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Minimal TTL + FIFO-bounded map — the ONE eviction implementation shared by
+ * the delegation verifier's signature-result cache and the `withStatusCache`
+ * resolver wrapper (DRY). Internal utility; not exported from the package
+ * surface.
+ *
+ * Semantics: `ttlMs <= 0` or `maxEntries <= 0` disables storage entirely (an
+ * entry that is born expired or unstorable must never serve); expired entries
+ * are deleted on read; overwriting a key re-inserts it as newest; when full,
+ * the oldest inserted entry is evicted (simple FIFO, no LRU bookkeeping).
+ */
+export declare class TtlCache<T> {
+    private options;
+    private entries;
+    private insertionOrder;
+    constructor(options: {
+        ttlMs: number;
+        maxEntries: number;
+    });
+    get(key: string): T | undefined;
+    set(key: string, value: T): void;
+    delete(key: string): void;
+    deleteWhere(predicate: (key: string) => boolean): void;
+    clear(): void;
+}
+//# sourceMappingURL=ttl-cache.d.ts.map

package/dist/utils/ttl-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ttl-cache.d.ts","sourceRoot":"","sources":["../../src/utils/ttl-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,qBAAa,QAAQ,CAAC,CAAC;IAIT,OAAO,CAAC,OAAO;IAH3B,OAAO,CAAC,OAAO,CAAsD;IACrE,OAAO,CAAC,cAAc,CAAgB;gBAElB,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;IAElE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS;IAU/B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;IAyBhC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMzB,WAAW,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI;IAMtD,KAAK,IAAI,IAAI;CAId"}

package/dist/utils/ttl-cache.js

@@ -0,0 +1,68 @@
+/**
+ * Minimal TTL + FIFO-bounded map — the ONE eviction implementation shared by
+ * the delegation verifier's signature-result cache and the `withStatusCache`
+ * resolver wrapper (DRY). Internal utility; not exported from the package
+ * surface.
+ *
+ * Semantics: `ttlMs <= 0` or `maxEntries <= 0` disables storage entirely (an
+ * entry that is born expired or unstorable must never serve); expired entries
+ * are deleted on read; overwriting a key re-inserts it as newest; when full,
+ * the oldest inserted entry is evicted (simple FIFO, no LRU bookkeeping).
+ */
+export class TtlCache {
+    options;
+    entries = new Map();
+    insertionOrder = [];
+    constructor(options) {
+        this.options = options;
+    }
+    get(key) {
+        const entry = this.entries.get(key);
+        if (!entry)
+            return undefined;
+        if (Date.now() > entry.expiresAt) {
+            this.delete(key);
+            return undefined;
+        }
+        return entry.value;
+    }
+    set(key, value) {
+        if (this.options.ttlMs <= 0 || this.options.maxEntries <= 0)
+            return;
+        // Overwrite = delete + re-insert, keeping `entries` and `insertionOrder`
+        // in bijection. Without this, N concurrent misses on one key leave N-1
+        // phantom order entries (a slow leak keyed by KB-scale cache keys), and
+        // an at-capacity refresh evicts an innocent neighbor.
+        if (this.entries.has(key))
+            this.delete(key);
+        // Evict oldest entries if the cache is full (simple FIFO)
+        while (this.entries.size >= this.options.maxEntries &&
+            this.insertionOrder.length > 0) {
+            const oldest = this.insertionOrder.shift();
+            if (oldest)
+                this.entries.delete(oldest);
+        }
+        this.entries.set(key, {
+            value,
+            expiresAt: Date.now() + this.options.ttlMs,
+        });
+        this.insertionOrder.push(key);
+    }
+    delete(key) {
+        this.entries.delete(key);
+        const index = this.insertionOrder.indexOf(key);
+        if (index !== -1)
+            this.insertionOrder.splice(index, 1);
+    }
+    deleteWhere(predicate) {
+        for (const key of [...this.entries.keys()]) {
+            if (predicate(key))
+                this.delete(key);
+        }
+    }
+    clear() {
+        this.entries.clear();
+        this.insertionOrder = [];
+    }
+}
+//# sourceMappingURL=ttl-cache.js.map

package/dist/utils/ttl-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ttl-cache.js","sourceRoot":"","sources":["../../src/utils/ttl-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,OAAO,QAAQ;IAIC;IAHZ,OAAO,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC7D,cAAc,GAAa,EAAE,CAAC;IAEtC,YAAoB,OAA8C;QAA9C,YAAO,GAAP,OAAO,CAAuC;IAAG,CAAC;IAEtE,GAAG,CAAC,GAAW;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAQ;QACvB,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC;YAAE,OAAO;QAEpE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,sDAAsD;QACtD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAE5C,0DAA0D;QAC1D,OACE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU;YAC5C,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAC9B,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YAC3C,IAAI,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;YACpB,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,WAAW,CAAC,SAAmC;QAC7C,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3C,IAAI,SAAS,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC;IAC3B,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "description": "Reference implementation of the KYA-OS protocol for Model Context Protocol servers: identity, delegation, proofs, sessions, and verifiable audit trails",
   "license": "MIT",
   "type": "module",