@kya-os/mcp 1.13.0 → 1.14.2

package/dist/integrations/cheqd/statuslist-resolver.js

@@ -0,0 +1,138 @@
+import { verificationMethodJwk } from '../../delegation/verification-method-key.js';
+import { canonicalizeJSON } from '../../delegation/utils.js';
+import { decodeStatusListPayload, parseStatusListIndex, readStatusBit, } from '../../utils/statuslist-bits.js';
+import { assertStatusPurpose } from '../../utils/statuslist-purpose.js';
+import { base64urlDecodeToBytes, bytesToBase64 } from '../../utils/base64.js';
+import { TtlCache } from '../../utils/ttl-cache.js';
+export class CheqdStatusListResolver {
+    opts;
+    cacheTtlMs;
+    cache;
+    bustNextFetch = false;
+    constructor(options) {
+        this.opts = options;
+        this.cacheTtlMs = options.cacheTtlMs ?? 10_000;
+        // A single issuer realistically publishes a handful of lists; 16 entries
+        // is generous without being unbounded.
+        this.cache = new TtlCache({
+            ttlMs: this.cacheTtlMs,
+            maxEntries: 16,
+        });
+    }
+    /** Drop the cached list and defeat upstream HTTP caches on the next fetch. */
+    invalidateCache() {
+        this.cache.clear();
+        this.bustNextFetch = true;
+    }
+    /** TRUE = revoked. Throws on anything unprovable — the verifier fails closed. */
+    async checkStatus(status) {
+        const url = status.statusListCredential;
+        if (typeof url !== 'string' || !/^https:\/\//.test(url)) {
+            throw new Error('credentialStatus.statusListCredential must be an https URL');
+        }
+        const index = parseStatusListIndex(status.statusListIndex);
+        const credential = await this.fetchAndVerifyList(url);
+        // Purpose parity, fail-closed (shared validator): a clear bit on the WRONG
+        // KIND of list would report "not revoked" from a list that never tracked
+        // revocation.
+        assertStatusPurpose(credential.credentialSubject.statusPurpose, status.statusPurpose);
+        const bits = await decodeStatusListPayload(credential.credentialSubject.encodedList, (bytes) => this.opts.decompressor.decompress(bytes));
+        return readStatusBit(bits, index);
+    }
+    async fetchAndVerifyList(url) {
+        const cached = this.cache.get(url);
+        if (cached) {
+            return cached;
+        }
+        // NEVER append query params here: the cheqd resolver parses the query as
+        // DID URL dereferencing input and 400s (invalidDidUrl) on unknown params
+        // (verified live). The endpoint is served cf-cache-status DYNAMIC, so
+        // post-revocation freshness only needs a no-cache header.
+        const response = await this.opts.fetchProvider.fetch(url, {
+            method: 'GET',
+            headers: {
+                Accept: 'application/json',
+                ...(this.bustNextFetch
+                    ? { 'Cache-Control': 'no-cache', Pragma: 'no-cache' }
+                    : {}),
+            },
+        });
+        if (!response.ok) {
+            throw new Error(`Status list fetch failed: HTTP ${response.status} for ${url}`);
+        }
+        const body = (await response.json());
+        this.assertShape(body);
+        this.assertIssuer(body);
+        await this.assertSignature(body);
+        this.bustNextFetch = false;
+        this.cache.set(url, body);
+        return body;
+    }
+    assertShape(vc) {
+        const types = Array.isArray(vc?.type) ? vc.type : [];
+        if (!types.includes('StatusList2021Credential')) {
+            throw new Error('Fetched resource is not a StatusList2021Credential');
+        }
+        const subject = vc.credentialSubject;
+        if (subject?.type !== 'StatusList2021' ||
+            typeof subject.encodedList !== 'string' ||
+            subject.encodedList.length === 0) {
+            throw new Error('Status list credentialSubject is malformed (missing StatusList2021 encodedList)');
+        }
+        if (!vc.proof || typeof vc.proof !== 'object') {
+            throw new Error('Status list credential is unsigned');
+        }
+    }
+    assertIssuer(vc) {
+        const issuer = typeof vc.issuer === 'string' ? vc.issuer : vc.issuer?.id;
+        if (issuer !== this.opts.expectedIssuerDid) {
+            throw new Error(`Status list issuer "${issuer}" is not the expected issuer "${this.opts.expectedIssuerDid}"`);
+        }
+    }
+    /**
+     * Verify the Ed25519Signature2020 proof over the JCS-canonicalized VC
+     * (minus `proof`) against the issuer's on-chain DID document. Key material
+     * arrives however the DID method publishes it — `verificationMethodJwk`
+     * accepts `publicKeyJwk`, `publicKeyMultibase` (cheqd's format), or legacy
+     * `publicKeyBase58`.
+     */
+    async assertSignature(vc) {
+        const proof = vc.proof;
+        const proofValue = proof['proofValue'];
+        if (typeof proofValue !== 'string' || proofValue.length === 0) {
+            throw new Error('Status list proof is missing proofValue');
+        }
+        const unsigned = { ...vc };
+        delete unsigned['proof'];
+        const data = new TextEncoder().encode(canonicalizeJSON(unsigned));
+        const signature = base64urlDecodeToBytes(proofValue);
+        const didDoc = await this.opts.didResolver.resolve(this.opts.expectedIssuerDid);
+        if (!didDoc) {
+            throw new Error(`Could not resolve issuer DID ${this.opts.expectedIssuerDid}`);
+        }
+        const verificationMethodId = typeof proof['verificationMethod'] === 'string'
+            ? proof['verificationMethod']
+            : undefined;
+        const methods = didDoc.verificationMethod ?? [];
+        const candidates = verificationMethodId
+            ? methods.filter((m) => m.id === verificationMethodId)
+            : methods;
+        if (candidates.length === 0) {
+            throw new Error(`Issuer DID document has no verification method matching "${verificationMethodId ?? '(any)'}"`);
+        }
+        for (const method of candidates) {
+            const jwk = verificationMethodJwk(method);
+            if (!jwk)
+                continue;
+            const publicKeyBase64 = bytesToBase64(base64urlDecodeToBytes(jwk.x));
+            if (await this.opts.cryptoProvider.verify(data, signature, publicKeyBase64)) {
+                return;
+            }
+        }
+        throw new Error('Status list signature verification FAILED against the issuer DID document');
+    }
+}
+export function createCheqdStatusListResolver(options) {
+    return new CheqdStatusListResolver(options);
+}
+//# sourceMappingURL=statuslist-resolver.js.map

package/dist/integrations/cheqd/statuslist-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"statuslist-resolver.js","sourceRoot":"","sources":["../../../src/integrations/cheqd/statuslist-resolver.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,aAAa,GACd,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAsBpD,MAAM,OAAO,uBAAuB;IACjB,IAAI,CAAiC;IACrC,UAAU,CAAS;IAC5B,KAAK,CAAqC;IAC1C,aAAa,GAAG,KAAK,CAAC;IAE9B,YAAY,OAAuC;QACjD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC;QAC/C,yEAAyE;QACzE,uCAAuC;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,QAAQ,CAA2B;YAClD,KAAK,EAAE,IAAI,CAAC,UAAU;YACtB,UAAU,EAAE,EAAE;SACf,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,eAAe;QACb,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;IAC5B,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,WAAW,CAAC,MAAwB;QACxC,MAAM,GAAG,GAAG,MAAM,CAAC,oBAAoB,CAAC;QACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAEtD,2EAA2E;QAC3E,yEAAyE;QACzE,cAAc;QACd,mBAAmB,CACjB,UAAU,CAAC,iBAAiB,CAAC,aAAa,EAC1C,MAAM,CAAC,aAAa,CACrB,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,uBAAuB,CACxC,UAAU,CAAC,iBAAiB,CAAC,WAAW,EACxC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CACpD,CAAC;QACF,OAAO,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,GAAW;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE;YACxD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,IAAI,CAAC,aAAa;oBACpB,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE;oBACrD,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA6B,CAAC;QACjE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAEjC,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,WAAW,CAAC,EAA4B;QAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,CAAC,iBAAiB,CAAC;QACrC,IACE,OAAO,EAAE,IAAI,KAAK,gBAAgB;YAClC,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ;YACvC,OAAO,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAChC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,EAA4B;QAC/C,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QACzE,IAAI,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,uBAAuB,MAAM,iCAAiC,IAAI,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,eAAe,CAAC,EAA4B;QACxD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAgC,CAAC;QAClD,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,QAAQ,GAA4B,EAAE,GAAG,EAAE,EAAE,CAAC;QACpD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,oBAAoB,GACxB,OAAO,KAAK,CAAC,oBAAoB,CAAC,KAAK,QAAQ;YAC7C,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;YAC7B,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,OAAO,GAAG,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,oBAAoB;YACrC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,oBAAoB,CAAC;YACtD,CAAC,CAAC,OAAO,CAAC;QACZ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,4DAA4D,oBAAoB,IAAI,OAAO,GAAG,CAC/F,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,eAAe,GAAG,aAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACrE,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC;gBAC5E,OAAO;YACT,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAAuC;IAEvC,OAAO,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC"}

package/dist/middleware/with-kya-os.delegation-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.delegation-gate.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgBH,OAAO,KAAK,EAEV,mBAAmB,EACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAkC/D,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,oBAAoB,EAAE,eAAe,CAAC,sBAAsB,CAAC,CAAC;IAC9D,kBAAkB,EAAE,eAAe,CAAC,oBAAoB,CAAC,CAAC;CAC3D;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,oBAAoB,GAC3B,IAAI,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAyTjD"}
+{"version":3,"file":"with-kya-os.delegation-gate.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAYH,OAAO,KAAK,EAEV,mBAAmB,EACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAkC/D,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,oBAAoB,EAAE,eAAe,CAAC,sBAAsB,CAAC,CAAC;IAC9D,kBAAkB,EAAE,eAAe,CAAC,oBAAoB,CAAC,CAAC;CAC3D;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,oBAAoB,GAC3B,IAAI,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAsQjD"}

package/dist/middleware/with-kya-os.delegation-gate.js

@@ -8,7 +8,6 @@
  */
 import { isHolderBindingApplicable, isKyaOsControlArg, assertHolderBinding, toHolderBindingRequest, } from "../delegation/holder-binding.js";
 import { scopeSatisfies } from "../delegation/scope-matcher.js";
-import { parseVCJWT } from "../delegation/utils.js";
 import { logger } from "../logging/index.js";
 import { KYA_OS_ERROR_CODES } from "../errors.js";
 import { sanitizeForMessage } from "./with-kya-os.helpers.js";
@@ -44,7 +43,7 @@ function rejectedDelegationRef(value) {
 export function createDelegationGate(deps, wiring) {
     const { identity, holderBindingMode, holderBindingVerifier, audit, cryptoProvider } = deps;
     const { attachOutcomeProof, resolveExistingGrant, bindGrantOnSuccess } = wiring;
-    const { validateDelegationChain, buildDelegationErrorResponse, buildNeedsAuthorizationChallenge, } = createDelegationVerification(deps);
+    const { verifyDelegation, buildDelegationErrorResponse, buildNeedsAuthorizationChallenge, } = createDelegationVerification(deps);
     function wrapWithDelegation(toolName, config, handler) {
         return async (args, sessionId) => {
             const delegationArg = args["_kyaos_delegation"];
@@ -91,55 +90,15 @@ export function createDelegationGate(deps, wiring) {
                 const { challengeContent, message } = await buildNeedsAuthorizationChallenge(toolName, config);
                 return attachOutcomeProof({ content: challengeContent }, toolName, args, sessionId, message, "needs_authorization", undefined, challengeContent);
             }
-            // Accept delegation as either a JSON object (embedded proof) or a
-            // VC-JWT string (compact JWT). The Cloudflare consent service issues
-            // VC-JWTs; examples use embedded proofs. Support both transparently.
-            let vc;
-            let isVCJWT = false;
-            if (typeof delegationArg === "string") {
-                const parsed = parseVCJWT(delegationArg);
-                if (!parsed || !parsed.payload.vc) {
-                    return attachOutcomeProof(buildDelegationErrorResponse(KYA_OS_ERROR_CODES.delegation_invalid, "Invalid VC-JWT format"), toolName, args, sessionId, "Invalid VC-JWT format");
-                }
-                vc = parsed.payload.vc;
-                // VC-JWTs don't have an embedded proof — the JWT signature is the
-                // proof. Add a marker so basic validation (which checks for proof
-                // presence) passes. The actual signature is in the JWT envelope.
-                if (!vc.proof) {
-                    vc = { ...vc, proof: { type: 'JwtProof2020', jwt: delegationArg } };
-                }
-                isVCJWT = true;
-            }
-            else {
-                vc = delegationArg;
-            }
-            // For VC-JWTs the embedded-signature check is skipped (the JWT envelope
-            // signature is the proof); schema/expiry/status/scope checks still apply.
-            // validateDelegationChain performs the shape check and returns
-            // { valid, reason } for malformed input, never throwing on normal or
-            // structurally-malformed credentials. This try/catch is therefore a PURE
-            // BACKSTOP — it fires only on a truly unexpected throw (e.g. a hostile
-            // getter/Proxy accessor or a provider fault): it logs the detail
-            // server-side and returns a GENERIC reason, so no internal/implementation
-            // detail (stack, raw error text) leaks to the client or the signed proof.
-            const verificationResult = await (async () => {
-                try {
-                    return await validateDelegationChain(vc, { skipSignature: isVCJWT });
-                }
-                catch (error) {
-                    logger.error("[kya-os] Unexpected error verifying delegation", {
-                        tool: toolName,
-                        error: error instanceof Error ? error.message : String(error),
-                        stack: error instanceof Error ? error.stack : undefined,
-                    });
-                    return { valid: false, reason: "Delegation credential could not be verified" };
-                }
-            })();
-            if (!verificationResult.valid) {
-                const reason = verificationResult.reason ?? "Unknown delegation validation error";
+            // Authenticate the presented delegation (object embedded-proof OR VC-JWT
+            // string) and normalize it to a verified credential. verifyDelegation owns
+            // the wire-form-specific signature checks — the gate never sets
+            // skipSignature itself, so a JWT envelope can't be silently skipped.
+            const check = await verifyDelegation(delegationArg);
+            if (!check.valid) {
                 try {
                     await audit?.delegation('rejected', {
-                        delegationRef: rejectedDelegationRef(vc),
+                        delegationRef: rejectedDelegationRef(check.vc),
                         outcome: 'failed',
                         reasonCode: 'DELEGATION_VERIFICATION_FAILED',
                     });
@@ -150,9 +109,10 @@ export function createDelegationGate(deps, wiring) {
                         error: error instanceof Error ? error.message : String(error),
                     });
                 }
-                logger.warn(`[kya-os] Delegation verification failed for "${toolName}": ${sanitizeForMessage(reason)}`);
-                return attachOutcomeProof(buildDelegationErrorResponse(KYA_OS_ERROR_CODES.delegation_invalid, reason), toolName, args, sessionId, reason);
+                logger.warn(`[kya-os] Delegation verification failed for "${toolName}": ${sanitizeForMessage(check.reason)}`);
+                return attachOutcomeProof(buildDelegationErrorResponse(KYA_OS_ERROR_CODES.delegation_invalid, check.reason), toolName, args, sessionId, check.reason);
             }
+            const { vc, isJwt } = check;
             // Holder binding (spec §11.8): the delegation is valid, but a valid
             // *credential* is a bearer token until we also prove the caller holds the
             // delegation SUBJECT's key. Opt-in via `delegation.holderBinding`. did:key
@@ -215,7 +175,7 @@ export function createDelegationGate(deps, wiring) {
                 logger.warn(`[kya-os] Delegation missing required scope "${config.scopeId}" for "${toolName}"`);
                 return attachOutcomeProof(buildDelegationErrorResponse(KYA_OS_ERROR_CODES.insufficient_scope, reason), toolName, args, sessionId, reason);
             }
-            const serializedCredential = isVCJWT
+            const serializedCredential = isJwt
                 ? new TextEncoder().encode(delegationArg)
                 : canonicalizeJsonBytes(vc);
             const credentialDigest = await cryptoProvider.hash(serializedCredential);
@@ -258,7 +218,7 @@ export function createDelegationGate(deps, wiring) {
             }
             // Mint a durable grant from this verified delegation so the next call —
             // on any instance — resolves via resolveExistingGrant with no re-paste.
-            await bindGrantOnSuccess(vc, delegationArg, isVCJWT, sessionId, config.scopeId);
+            await bindGrantOnSuccess(vc, delegationArg, isJwt, sessionId, config.scopeId);
             logger.debug(`[kya-os] Delegation verified for "${toolName}", scope "${config.scopeId}"`);
             return handler(cleanArgs, sessionId, callContext);
         };

package/dist/middleware/with-kya-os.delegation-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.delegation-gate.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAKpD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,4BAA4B,GAE7B,MAAM,oCAAoC,CAAC;AAE5C,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC,+EAA+E;AAC/E,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAClE,MAAM,UAAU,GAAG,KAAgC,CAAC;QACpD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC;QAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACtE,MAAM,UAAU,GAAI,OAAmC,CAAC,UAAU,CAAC;QACnE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5E,MAAM,MAAM,GAAI,UAAsC,CAAC,EAAE,CAAC;QAC1D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YACpD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AASD,MAAM,UAAU,oBAAoB,CAClC,IAAoB,EACpB,MAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAC3F,MAAM,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GACpE,MAAM,CAAC;IACT,MAAM,EACJ,uBAAuB,EACvB,4BAA4B,EAC5B,gCAAgC,GACjC,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAEvC,SAAS,kBAAkB,CACzB,QAAgB,EAChB,MAA4B,EAC5B,OAAyB;QAEzB,OAAO,KAAK,EAAE,IAA6B,EAAE,SAAkB,EAAE,EAAE;YACjE,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAEhD,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC1D,yEAAyE;gBACzE,oEAAoE;gBACpE,sEAAsE;gBACtE,sEAAsE;gBACtE,yEAAyE;gBACzE,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAC9C,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CAAC,OAAO,CACf,CAAC;gBACF,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,SAAS,GAA4B,EAAE,CAAC;oBAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;4BAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBAC9C,CAAC;oBACD,MAAM,CAAC,KAAK,CACV,gCAAgC,QAAQ,aAAa,MAAM,CAAC,OAAO,2BAA2B,CAC/F,CAAC;oBACF,MAAM,YAAY,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,KAAK,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE;wBACrE,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;4BAC3C,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,EAAE;4BACrF,CAAC,CAAC,EAAE,CAAC;wBACP,aAAa,EAAE;4BACb,MAAM,EAAE,OAAgB;4BACxB,QAAQ,EAAE,SAAkB;4BAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;4BACvB,QAAQ,EAAE,aAAa,CAAC,EAAE;4BAC1B,gBAAgB,EAAE,wBAAwB;yBAC3C;qBACF,CAAC;oBACF,MAAM,KAAK,EAAE,aAAa,CAAC,YAAY,EAAE;wBACvC,OAAO,EAAE,WAAW;wBACpB,QAAQ,EAAE,aAAa,CAAC,EAAE;wBAC1B,OAAO,EAAE,YAAY;qBACtB,CAAC,CAAC;oBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;gBACrD,CAAC;gBAED,iEAAiE;gBACjE,uEAAuE;gBACvE,yEAAyE;gBACzE,uEAAuE;gBACvE,sEAAsE;gBACtE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,GACjC,MAAM,gCAAgC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC3D,OAAO,kBAAkB,CACvB,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,OAAO,EACP,qBAAqB,EACrB,SAAS,EACT,gBAAgB,CACjB,CAAC;YACJ,CAAC;YAED,kEAAkE;YAClE,qEAAqE;YACrE,qEAAqE;YACrE,IAAI,EAAwB,CAAC;YAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;gBACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;oBAClC,OAAO,kBAAkB,CACvB,4BAA4B,CAC1B,kBAAkB,CAAC,kBAAkB,EACrC,uBAAuB,CACxB,EACD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,uBAAuB,CACxB,CAAC;gBACJ,CAAC;gBACD,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAA0B,CAAC;gBAC/C,kEAAkE;gBAClE,kEAAkE;gBAClE,iEAAiE;gBACjE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;oBACd,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC;gBACtE,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACN,EAAE,GAAG,aAAqC,CAAC;YAC7C,CAAC;YAED,wEAAwE;YACxE,0EAA0E;YAC1E,+DAA+D;YAC/D,qEAAqE;YACrE,yEAAyE;YACzE,uEAAuE;YACvE,iEAAiE;YACjE,0EAA0E;YAC1E,0EAA0E;YAC1E,MAAM,kBAAkB,GAAG,MAAM,CAAC,KAAK,IAGpC,EAAE;gBACH,IAAI,CAAC;oBACH,OAAO,MAAM,uBAAuB,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;wBAC7D,IAAI,EAAE,QAAQ;wBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;wBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;qBACxD,CAAC,CAAC;oBACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;gBACjF,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;YAEL,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,IAAI,qCAAqC,CAAC;gBAClF,IAAI,CAAC;oBACH,MAAM,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE;wBAClC,aAAa,EAAE,qBAAqB,CAAC,EAAE,CAAC;wBACxC,OAAO,EAAE,QAAQ;wBACjB,UAAU,EAAE,gCAAgC;qBAC7C,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE;wBACxE,IAAI,EAAE,QAAQ;wBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,CAAC,IAAI,CACT,gDAAgD,QAAQ,MAAM,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC3F,CAAC;gBACF,OAAO,kBAAkB,CACvB,4BAA4B,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAC3E,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;YACJ,CAAC;YAED,oEAAoE;YACpE,0EAA0E;YAC1E,2EAA2E;YAC3E,4EAA4E;YAC5E,4EAA4E;YAC5E,IAAI,iBAAiB,KAAK,KAAK,IAAI,qBAAqB,EAAE,CAAC;gBACzD,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBAC5C,IAAI,UAAU,IAAI,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;oBACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;oBACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAC3B,MAAM,MAAM,GACV,4EAA4E,CAAC;wBAC/E,MAAM,CAAC,IAAI,CACT,6BAA6B,QAAQ,+BAA+B,CACrE,CAAC;wBACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;4BACpC,OAAO,kBAAkB,CACvB,4BAA4B,CAC1B,kBAAkB,CAAC,qBAAqB,EACxC,MAAM,CACP,EACD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;wBACJ,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,IAAI,WAAW,GAAY,QAAQ,CAAC;wBACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;4BACjC,IAAI,CAAC;gCACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;4BACrC,CAAC;4BAAC,MAAM,CAAC;gCACP,WAAW,GAAG,EAAE,CAAC;4BACnB,CAAC;wBACH,CAAC;wBACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;4BACxC,KAAK,EAAE,WAA4B;4BACnC,UAAU;4BACV,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC;4BAC/C,gBAAgB,EAAE,QAAQ,CAAC,GAAG;4BAC9B,aAAa,EAAE,qBAAqB;yBACrC,CAAC,CAAC;wBACH,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;4BAC/B,MAAM,MAAM,GACV,OAAO,CAAC,MAAM;gCACd,yDAAyD,CAAC;4BAC5D,MAAM,CAAC,IAAI,CACT,2BAA2B,OAAO,CAAC,MAAM,SAAS,QAAQ,MAAM,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC7F,CAAC;4BACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gCACpC,OAAO,kBAAkB,CACvB,4BAA4B,CAC1B,kBAAkB,CAAC,qBAAqB,EACxC,MAAM,CACP,EACD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;4BACJ,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,UAAU,EAAE,CAAC;oBACtB,iEAAiE;oBACjE,2DAA2D;oBAC3D,MAAM,CAAC,IAAI,CACT,qCAAqC,UAAU,sDAAsD,CACtG,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,uEAAuE;YACvE,0DAA0D;YAC1D,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACvD,IAAI,WAAW,CAAC,mBAAmB,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CACT,mBAAmB,MAAM,CAAC,OAAO,UAAU,QAAQ,4BAA4B;oBAC7E,uFAAuF,CAC1F,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,mBAAmB,MAAM,CAAC,OAAO,4BAA4B,CAAC;gBAC7E,MAAM,CAAC,IAAI,CACT,+CAA+C,MAAM,CAAC,OAAO,UAAU,QAAQ,GAAG,CACnF,CAAC;gBACF,OAAO,kBAAkB,CACvB,4BAA4B,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAC3E,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,OAAO;gBAClC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAuB,CAAC;gBACnD,CAAC,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC9B,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,oBAAoB,CAAW,CAAC;YACnF,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YAClE,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC;YAC9E,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,UAAU,CAAC;YAC9D,MAAM,aAAa,GAAG;gBACpB,MAAM,EAAE,YAAqB;gBAC7B,QAAQ,EAAE,SAAkB;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,aAAa;gBACb,0BAA0B,EAAE,gBAAgB;gBAC5C,gBAAgB,EAAE,wBAAwB;aAC3C,CAAC;YACF,MAAM,WAAW,GAAG;gBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK;gBACL,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC;oBAChC,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;oBAC1E,CAAC,CAAC,EAAE,CAAC;gBACP,aAAa;aACd,CAAC;YAEF,MAAM,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE;gBAClC,aAAa;gBACb,OAAO,EAAE,WAAW;gBACpB,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,QAAQ;gBACnD,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;gBACrC,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YAEH,qEAAqE;YACrE,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;oBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YAED,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,kBAAkB,CAAC,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAEhF,MAAM,CAAC,KAAK,CACV,qCAAqC,QAAQ,aAAa,MAAM,CAAC,OAAO,GAAG,CAC5E,CAAC;YACF,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAChC,CAAC"}
+{"version":3,"file":"with-kya-os.delegation-gate.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,4BAA4B,GAE7B,MAAM,oCAAoC,CAAC;AAE5C,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC,+EAA+E;AAC/E,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAClE,MAAM,UAAU,GAAG,KAAgC,CAAC;QACpD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC;QAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACtE,MAAM,UAAU,GAAI,OAAmC,CAAC,UAAU,CAAC;QACnE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5E,MAAM,MAAM,GAAI,UAAsC,CAAC,EAAE,CAAC;QAC1D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YACpD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AASD,MAAM,UAAU,oBAAoB,CAClC,IAAoB,EACpB,MAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAC3F,MAAM,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GACpE,MAAM,CAAC;IACT,MAAM,EACJ,gBAAgB,EAChB,4BAA4B,EAC5B,gCAAgC,GACjC,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAEvC,SAAS,kBAAkB,CACzB,QAAgB,EAChB,MAA4B,EAC5B,OAAyB;QAEzB,OAAO,KAAK,EAAE,IAA6B,EAAE,SAAkB,EAAE,EAAE;YACjE,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAEhD,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC1D,yEAAyE;gBACzE,oEAAoE;gBACpE,sEAAsE;gBACtE,sEAAsE;gBACtE,yEAAyE;gBACzE,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAC9C,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CAAC,OAAO,CACf,CAAC;gBACF,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,SAAS,GAA4B,EAAE,CAAC;oBAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;4BAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBAC9C,CAAC;oBACD,MAAM,CAAC,KAAK,CACV,gCAAgC,QAAQ,aAAa,MAAM,CAAC,OAAO,2BAA2B,CAC/F,CAAC;oBACF,MAAM,YAAY,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,KAAK,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE;wBACrE,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;4BAC3C,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,EAAE;4BACrF,CAAC,CAAC,EAAE,CAAC;wBACP,aAAa,EAAE;4BACb,MAAM,EAAE,OAAgB;4BACxB,QAAQ,EAAE,SAAkB;4BAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;4BACvB,QAAQ,EAAE,aAAa,CAAC,EAAE;4BAC1B,gBAAgB,EAAE,wBAAwB;yBAC3C;qBACF,CAAC;oBACF,MAAM,KAAK,EAAE,aAAa,CAAC,YAAY,EAAE;wBACvC,OAAO,EAAE,WAAW;wBACpB,QAAQ,EAAE,aAAa,CAAC,EAAE;wBAC1B,OAAO,EAAE,YAAY;qBACtB,CAAC,CAAC;oBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;gBACrD,CAAC;gBAED,iEAAiE;gBACjE,uEAAuE;gBACvE,yEAAyE;gBACzE,uEAAuE;gBACvE,sEAAsE;gBACtE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,GACjC,MAAM,gCAAgC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC3D,OAAO,kBAAkB,CACvB,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,OAAO,EACP,qBAAqB,EACrB,SAAS,EACT,gBAAgB,CACjB,CAAC;YACJ,CAAC;YAED,yEAAyE;YACzE,2EAA2E;YAC3E,gEAAgE;YAChE,qEAAqE;YACrE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,aAAa,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE;wBAClC,aAAa,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC9C,OAAO,EAAE,QAAQ;wBACjB,UAAU,EAAE,gCAAgC;qBAC7C,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE;wBACxE,IAAI,EAAE,QAAQ;wBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,CAAC,IAAI,CACT,gDAAgD,QAAQ,MAAM,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CACjG,CAAC;gBACF,OAAO,kBAAkB,CACvB,4BAA4B,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,EACjF,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,KAAK,CAAC,MAAM,CACb,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;YAE5B,oEAAoE;YACpE,0EAA0E;YAC1E,2EAA2E;YAC3E,4EAA4E;YAC5E,4EAA4E;YAC5E,IAAI,iBAAiB,KAAK,KAAK,IAAI,qBAAqB,EAAE,CAAC;gBACzD,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBAC5C,IAAI,UAAU,IAAI,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;oBACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;oBACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAC3B,MAAM,MAAM,GACV,4EAA4E,CAAC;wBAC/E,MAAM,CAAC,IAAI,CACT,6BAA6B,QAAQ,+BAA+B,CACrE,CAAC;wBACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;4BACpC,OAAO,kBAAkB,CACvB,4BAA4B,CAC1B,kBAAkB,CAAC,qBAAqB,EACxC,MAAM,CACP,EACD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;wBACJ,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,IAAI,WAAW,GAAY,QAAQ,CAAC;wBACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;4BACjC,IAAI,CAAC;gCACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;4BACrC,CAAC;4BAAC,MAAM,CAAC;gCACP,WAAW,GAAG,EAAE,CAAC;4BACnB,CAAC;wBACH,CAAC;wBACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;4BACxC,KAAK,EAAE,WAA4B;4BACnC,UAAU;4BACV,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC;4BAC/C,gBAAgB,EAAE,QAAQ,CAAC,GAAG;4BAC9B,aAAa,EAAE,qBAAqB;yBACrC,CAAC,CAAC;wBACH,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;4BAC/B,MAAM,MAAM,GACV,OAAO,CAAC,MAAM;gCACd,yDAAyD,CAAC;4BAC5D,MAAM,CAAC,IAAI,CACT,2BAA2B,OAAO,CAAC,MAAM,SAAS,QAAQ,MAAM,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC7F,CAAC;4BACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gCACpC,OAAO,kBAAkB,CACvB,4BAA4B,CAC1B,kBAAkB,CAAC,qBAAqB,EACxC,MAAM,CACP,EACD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;4BACJ,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,UAAU,EAAE,CAAC;oBACtB,iEAAiE;oBACjE,2DAA2D;oBAC3D,MAAM,CAAC,IAAI,CACT,qCAAqC,UAAU,sDAAsD,CACtG,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,uEAAuE;YACvE,0DAA0D;YAC1D,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACvD,IAAI,WAAW,CAAC,mBAAmB,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CACT,mBAAmB,MAAM,CAAC,OAAO,UAAU,QAAQ,4BAA4B;oBAC7E,uFAAuF,CAC1F,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,mBAAmB,MAAM,CAAC,OAAO,4BAA4B,CAAC;gBAC7E,MAAM,CAAC,IAAI,CACT,+CAA+C,MAAM,CAAC,OAAO,UAAU,QAAQ,GAAG,CACnF,CAAC;gBACF,OAAO,kBAAkB,CACvB,4BAA4B,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAC3E,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,KAAK;gBAChC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAuB,CAAC;gBACnD,CAAC,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC9B,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,oBAAoB,CAAW,CAAC;YACnF,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YAClE,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC;YAC9E,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,UAAU,CAAC;YAC9D,MAAM,aAAa,GAAG;gBACpB,MAAM,EAAE,YAAqB;gBAC7B,QAAQ,EAAE,SAAkB;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,aAAa;gBACb,0BAA0B,EAAE,gBAAgB;gBAC5C,gBAAgB,EAAE,wBAAwB;aAC3C,CAAC;YACF,MAAM,WAAW,GAAG;gBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK;gBACL,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC;oBAChC,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;oBAC1E,CAAC,CAAC,EAAE,CAAC;gBACP,aAAa;aACd,CAAC;YAEF,MAAM,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE;gBAClC,aAAa;gBACb,OAAO,EAAE,WAAW;gBACpB,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,QAAQ;gBACnD,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;gBACrC,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YAEH,qEAAqE;YACrE,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;oBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YAED,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,kBAAkB,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAE9E,MAAM,CAAC,KAAK,CACV,qCAAqC,QAAQ,aAAa,MAAM,CAAC,OAAO,GAAG,CAC5E,CAAC;YACF,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAChC,CAAC"}

package/dist/middleware/with-kya-os.delegation-verify.d.ts

@@ -18,19 +18,32 @@ export interface DelegationGateConfig {
         text: string;
     }>;
 }
+/**
+ * Outcome of authenticating a presented delegation. On success the caller gets
+ * the normalized credential and its wire form; on failure a sanitizable reason
+ * plus the best-effort parsed credential (for audit references), if any.
+ */
+export type DelegationCheck = {
+    valid: true;
+    vc: DelegationCredential;
+    isJwt: boolean;
+} | {
+    valid: false;
+    reason: string;
+    vc?: DelegationCredential;
+};
 export interface DelegationVerification {
     /**
-     * Thin adapter over the framework-agnostic core (chain-enforcement.ts): binds
-     * the host's injected verifier + server DID + resolver + the optional
-     * graph-backed RevocationChecker. Returns `{ valid, reason }`, never throws on
-     * normal or structurally-malformed credentials.
+     * Authenticate and normalize a presented `_kyaos_delegation`, in either wire
+     * form, into a single verified credential. A VC-JWT **string** is verified by
+     * its compact-JWS ENVELOPE signature against the issuer's published key; an
+     * **object** is verified by its embedded Data-Integrity proof. Both then run
+     * the full chain / scope-superset / expiry / status / revocation walk. Owning
+     * the `skipSignature` decision here (never at the call site) is what stops a
+     * JWT envelope from being silently skipped. Returns a {@link DelegationCheck},
+     * never throws on normal or structurally-malformed input.
      */
-    validateDelegationChain(leafCredential: DelegationCredential, options?: {
-        skipSignature?: boolean;
-    }): Promise<{
-        valid: boolean;
-        reason?: string;
-    }>;
+    verifyDelegation(delegationArg: unknown): Promise<DelegationCheck>;
     /** A structured `{ error, reason }` tool response with a sanitized reason. */
     buildDelegationErrorResponse(error: string, reason: string): Awaited<ReturnType<KyaOsToolHandler>>;
     /**

package/dist/middleware/with-kya-os.delegation-verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.delegation-verify.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiBH,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAG5D,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,CAChB,SAAS,EAAE,uBAAuB,KAC/B,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,uBAAuB,CACrB,cAAc,EAAE,oBAAoB,EACpC,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACpC,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,8EAA8E;IAC9E,4BAA4B,CAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACzC;;;;;OAKG;IACH,gCAAgC,CAC9B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC;QACT,gBAAgB,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACxD,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,cAAc,GACnB,sBAAsB,CAyLxB"}
+{"version":3,"file":"with-kya-os.delegation-verify.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiBH,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAG5D,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,CAChB,SAAS,EAAE,uBAAuB,KAC/B,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5C;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,oBAAoB,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACzD;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEhE,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACnE,8EAA8E;IAC9E,4BAA4B,CAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACzC;;;;;OAKG;IACH,gCAAgC,CAC9B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC;QACT,gBAAgB,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACxD,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,cAAc,GACnB,sBAAsB,CA+PxB"}

package/dist/middleware/with-kya-os.delegation-verify.js

@@ -13,7 +13,7 @@ import { getDidMethod } from "../utils/did-helpers.js";
 import { DelegationCredentialVerifier, } from "../delegation/vc-verifier.js";
 import { validateDelegationChain as validateDelegationChainCore } from "../delegation/chain-enforcement.js";
 import { RuntimeFetchProvider } from "../providers/runtime-fetch.js";
-import { canonicalizeJSON } from "../delegation/utils.js";
+import { canonicalizeJSON, parseVCJWT } from "../delegation/utils.js";
 import { base64urlDecodeToBytes, bytesToBase64 } from "../utils/base64.js";
 import { createNeedsAuthorizationError, readCredentialProofValue, } from "../types/protocol.js";
 import { logger } from "../logging/index.js";
@@ -117,6 +117,72 @@ export function createDelegationVerification(deps) {
         statusListConfigured: !!delegationConfig?.statusListResolver,
         revocationChecker: delegationConfig?.revocationChecker,
     }, options);
+    async function verifyDelegation(delegationArg) {
+        // Normalize to a DelegationCredential, authenticating by wire form. A VC-JWT
+        // string carries its signature in the compact-JWS ENVELOPE; an object carries
+        // an embedded Data-Integrity proof (verified inside validateDelegationChain).
+        let vc;
+        let isJwt = false;
+        if (typeof delegationArg === "string") {
+            const parsed = parseVCJWT(delegationArg);
+            if (!parsed || !parsed.payload.vc) {
+                return { valid: false, reason: "Invalid VC-JWT format" };
+            }
+            // Envelope-first: verify the JWT signature against the issuer's published
+            // key BEFORE the chain runs with skipSignature. Reuses the vetted verifier
+            // (EdDSA-pinned compact-JWS + iss/issuer consistency; fail-closed). Status
+            // is checked once by the chain walk below, so skip it here.
+            const envelope = await verifier.verifyDelegationJwt(delegationArg, {
+                skipStatus: true,
+            });
+            if (!envelope.valid) {
+                return {
+                    valid: false,
+                    reason: envelope.reason ?? "VC-JWT envelope signature is not valid",
+                    vc: parsed.payload.vc,
+                };
+            }
+            vc = parsed.payload.vc;
+            // A JWT has no embedded `proof`; add a marker so basic validation (which
+            // requires proof presence) passes. The already-verified envelope is the
+            // real proof, so the chain walk runs with skipSignature (below).
+            if (!vc.proof) {
+                vc = { ...vc, proof: { type: "JwtProof2020", jwt: delegationArg } };
+            }
+            isJwt = true;
+        }
+        else {
+            vc = delegationArg;
+        }
+        // Chain / scope-superset / expiry / status / revocation. skipSignature is
+        // true ONLY for a JWT (its envelope, verified above, is the proof); an object
+        // keeps it false so validateDelegationChain verifies the embedded proof.
+        // That call never throws on normal/malformed input; this backstop catches
+        // only a truly unexpected throw (hostile getter/Proxy, provider fault) and
+        // returns a GENERIC reason so no internal detail leaks to the client/proof.
+        let chain;
+        try {
+            chain = await validateDelegationChain(vc, { skipSignature: isJwt });
+        }
+        catch (error) {
+            logger.error("[kya-os] Unexpected error verifying delegation", {
+                error: error instanceof Error ? error.message : String(error),
+                stack: error instanceof Error ? error.stack : undefined,
+            });
+            chain = {
+                valid: false,
+                reason: "Delegation credential could not be verified",
+            };
+        }
+        if (!chain.valid) {
+            return {
+                valid: false,
+                reason: chain.reason ?? "Unknown delegation validation error",
+                vc,
+            };
+        }
+        return { valid: true, vc, isJwt };
+    }
     async function buildNeedsAuthorizationChallenge(toolName, config) {
         const tokenBytes = await cryptoProvider.randomBytes(16);
         const hex = Array.from(tokenBytes)
@@ -159,7 +225,7 @@ export function createDelegationVerification(deps) {
         return { challengeContent, message: authError.message };
     }
     return {
-        validateDelegationChain,
+        verifyDelegation,
         buildDelegationErrorResponse,
         buildNeedsAuthorizationChallenge,
     };

package/dist/middleware/with-kya-os.delegation-verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.delegation-verify.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EACL,4BAA4B,GAG7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,IAAI,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GAGzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AA0C9D,MAAM,UAAU,4BAA4B,CAC1C,IAAoB;IAEpB,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAE5D,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;IAC9C,MAAM,aAAa,GACjB,gBAAgB,EAAE,aAAa;QAC/B,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;YACrC,CAAC,CAAC,IAAI,oBAAoB,EAAE;YAC5B,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,MAAM,cAAc,GAAG,aAAa;QAClC,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,sBAAsB,GAAG,wBAAwB,CACrD,gBAAgB,EAAE,YAAY,EAC9B,aAAa,CACd,CAAC;IACF,MAAM,WAAW,GAAgB;QAC/B,KAAK,CAAC,OAAO,CAAC,GAAW;YACvB,MAAM,cAAc,GAAG,gBAAgB,EAAE,WAAW,CAAC;YACrD,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,QAAQ,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,kBAAkB,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/E,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACvD,IAAI,QAAQ,EAAE,CAAC;wBACb,OAAO,QAAQ,CAAC;oBAClB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;YAC9C,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IAEF,MAAM,iBAAiB,GAAkC,KAAK,EAC5D,EAAwB,EACxB,YAAqB,EACyB,EAAE;QAChD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAgC,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACjE,CAAC;QAED,yEAAyE;QACzE,MAAM,QAAQ,GAAG,EAA6B,CAAC;QAC/C,MAAM,cAAc,GAA4B,EAAE,CAAC;QACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,OAAO;gBAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEjD,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEpD,iEAAiE;QACjE,MAAM,GAAG,GAAG,YAA8B,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAChE,CAAC;QAED,mEAAmE;QACnE,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAEhD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QACxE,OAAO;YACL,KAAK;YACL,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B;SAC5D,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAAC;QAChD,WAAW;QACX,iBAAiB;QACjB,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB;QACxD,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK;QACpD,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU;KAC9D,CAAC,CAAC;IAEH,MAAM,4BAA4B,GAAG,CACnC,KAAa,EACb,MAAc,EACyB,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;aACpE;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,MAAM,uBAAuB,GAAG,CAC9B,cAAoC,EACpC,OAAqC,EACS,EAAE,CAChD,2BAA2B,CACzB,cAAc,EACd;QACE,SAAS,EAAE,QAAQ,CAAC,GAAG;QACvB,QAAQ;QACR,sBAAsB,EAAE,gBAAgB,EAAE,sBAAsB;QAChE,oBAAoB,EAAE,CAAC,CAAC,gBAAgB,EAAE,kBAAkB;QAC5D,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB;KACvD,EACD,OAAO,CACR,CAAC;IAEJ,KAAK,UAAU,gCAAgC,CAC7C,QAAgB,EAChB,MAA4B;QAK5B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,WAAW,GAAG;YAClB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;SACd,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;QAEtD,MAAM,SAAS,GAAG,6BAA6B,CAAC;YAC9C,OAAO,EAAE,SAAS,QAAQ,qCAAqC,MAAM,CAAC,OAAO,EAAE;YAC/E,gBAAgB,EAAE,MAAM,CAAC,UAAU;YACnC,WAAW;YACX,SAAS;YACT,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;QAEH,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,uBAAuB,GAAG;YAC9B,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;SAC3D,CAAC;QACF,IAAI,gBAAgB,GAAG,uBAAuB,CAAC;QAC/C,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,gBAAgB,GAAG,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE;oBAC1E,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,gBAAgB,GAAG,uBAAuB,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,uBAAuB;QACvB,4BAA4B;QAC5B,gCAAgC;KACjC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"with-kya-os.delegation-verify.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EACL,4BAA4B,GAG7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,IAAI,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GAGzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAoD9D,MAAM,UAAU,4BAA4B,CAC1C,IAAoB;IAEpB,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAE5D,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;IAC9C,MAAM,aAAa,GACjB,gBAAgB,EAAE,aAAa;QAC/B,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;YACrC,CAAC,CAAC,IAAI,oBAAoB,EAAE;YAC5B,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,MAAM,cAAc,GAAG,aAAa;QAClC,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,sBAAsB,GAAG,wBAAwB,CACrD,gBAAgB,EAAE,YAAY,EAC9B,aAAa,CACd,CAAC;IACF,MAAM,WAAW,GAAgB;QAC/B,KAAK,CAAC,OAAO,CAAC,GAAW;YACvB,MAAM,cAAc,GAAG,gBAAgB,EAAE,WAAW,CAAC;YACrD,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,QAAQ,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,kBAAkB,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/E,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACvD,IAAI,QAAQ,EAAE,CAAC;wBACb,OAAO,QAAQ,CAAC;oBAClB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;YAC9C,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IAEF,MAAM,iBAAiB,GAAkC,KAAK,EAC5D,EAAwB,EACxB,YAAqB,EACyB,EAAE;QAChD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAgC,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACjE,CAAC;QAED,yEAAyE;QACzE,MAAM,QAAQ,GAAG,EAA6B,CAAC;QAC/C,MAAM,cAAc,GAA4B,EAAE,CAAC;QACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,OAAO;gBAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEjD,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEpD,iEAAiE;QACjE,MAAM,GAAG,GAAG,YAA8B,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAChE,CAAC;QAED,mEAAmE;QACnE,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAEhD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QACxE,OAAO;YACL,KAAK;YACL,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B;SAC5D,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAAC;QAChD,WAAW;QACX,iBAAiB;QACjB,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB;QACxD,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK;QACpD,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU;KAC9D,CAAC,CAAC;IAEH,MAAM,4BAA4B,GAAG,CACnC,KAAa,EACb,MAAc,EACyB,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;aACpE;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,MAAM,uBAAuB,GAAG,CAC9B,cAAoC,EACpC,OAAqC,EACS,EAAE,CAChD,2BAA2B,CACzB,cAAc,EACd;QACE,SAAS,EAAE,QAAQ,CAAC,GAAG;QACvB,QAAQ;QACR,sBAAsB,EAAE,gBAAgB,EAAE,sBAAsB;QAChE,oBAAoB,EAAE,CAAC,CAAC,gBAAgB,EAAE,kBAAkB;QAC5D,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB;KACvD,EACD,OAAO,CACR,CAAC;IAEJ,KAAK,UAAU,gBAAgB,CAC7B,aAAsB;QAEtB,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,IAAI,EAAwB,CAAC;QAC7B,IAAI,KAAK,GAAG,KAAK,CAAC;QAElB,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;YAC3D,CAAC;YACD,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,4DAA4D;YAC5D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,aAAa,EAAE;gBACjE,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACpB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,wCAAwC;oBACnE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAA0B;iBAC9C,CAAC;YACJ,CAAC;YACD,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAA0B,CAAC;YAC/C,yEAAyE;YACzE,wEAAwE;YACxE,iEAAiE;YACjE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACd,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC;YACtE,CAAC;YACD,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,aAAqC,CAAC;QAC7C,CAAC;QAED,0EAA0E;QAC1E,8EAA8E;QAC9E,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,KAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;gBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;aACxD,CAAC,CAAC;YACH,KAAK,GAAG;gBACN,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,6CAA6C;aACtD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,qCAAqC;gBAC7D,EAAE;aACH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,UAAU,gCAAgC,CAC7C,QAAgB,EAChB,MAA4B;QAK5B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,WAAW,GAAG;YAClB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;SACd,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;QAEtD,MAAM,SAAS,GAAG,6BAA6B,CAAC;YAC9C,OAAO,EAAE,SAAS,QAAQ,qCAAqC,MAAM,CAAC,OAAO,EAAE;YAC/E,gBAAgB,EAAE,MAAM,CAAC,UAAU;YACnC,WAAW;YACX,SAAS;YACT,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;QAEH,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,uBAAuB,GAAG;YAC9B,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;SAC3D,CAAC;QACF,IAAI,gBAAgB,GAAG,uBAAuB,CAAC;QAC/C,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,gBAAgB,GAAG,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE;oBAC1E,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,gBAAgB,GAAG,uBAAuB,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,gBAAgB;QAChB,4BAA4B;QAC5B,gCAAgC;KACjC,CAAC;AACJ,CAAC"}

package/dist/utils/statuslist-bits.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Hard ceiling on an INFLATED status bitstring (16 MiB ≈ 134M entries — far
+ * beyond any herd-privacy list). A fixed cap costs nothing legitimate while
+ * stopping a decompression bomb; exceeding it throws (fail-closed).
+ */
+export declare const MAX_STATUS_LIST_BYTES: number;
+/**
+ * The W3C Bitstring Status List `encodedList` multibase prefix (base64url,
+ * no padding). A gzip stream's fixed magic byte (0x1f) makes its base64url
+ * start with `H`, never `u`, so a leading `u` is unambiguously the multibase
+ * code rather than payload.
+ */
+export declare const MULTIBASE_BASE64URL = "u";
+/**
+ * Parse a decimal `statusListIndex` (a non-negative integer expressed as a
+ * string), fail-closed. Canonical decimal ONLY: `Number()` alone would coerce
+ * whitespace (`" "` → 0), hex (`"0x2A"` → 42), `"+42"`, and `"1e1"` → 10 —
+ * silently reading a DIFFERENT (often clear) bit than the credential names,
+ * so a revoked credential could read as live.
+ */
+export declare function parseStatusListIndex(raw: string): number;
+/**
+ * Decode a status-list `encodedList` to the raw bitstring: strip the optional
+ * multibase `u` prefix, base64url-decode, run the injected decompressor, and
+ * re-check the {@link MAX_STATUS_LIST_BYTES} cap POST-inflation as a backstop
+ * (a production decompressor SHOULD also bound output during inflation).
+ * The decompressor is the bare-function common denominator — an
+ * object-shaped `DecompressionFunction` adapts inline:
+ * `(b) => decompressor.decompress(b)`.
+ */
+export declare function decodeStatusListPayload(encodedList: string, decompress: (bytes: Uint8Array) => Uint8Array | Promise<Uint8Array>): Promise<Uint8Array>;
+/**
+ * Read the status bit at `index` — MSB-first within each byte (W3C Bitstring
+ * encoding). Uses FULL-PRECISION arithmetic (`Math.floor(index / 8)`) rather
+ * than 32-bit bitwise ops, which coerce to uint32 first: an index ≥ 2^32
+ * would silently wrap onto a low byte and read the WRONG — often clear — bit,
+ * turning an out-of-range index that MUST fail-closed into a fail-OPEN "not
+ * revoked". NaN/negative/fractional/out-of-buffer indexes throw.
+ */
+export declare function readStatusBit(bits: Uint8Array, index: number): boolean;
+/**
+ * Assert a status-list credential is fit to ANCHOR (publish) — signed, and
+ * actually carrying a bitstring. Method-agnostic on purpose: the cheqd DLR
+ * publisher enforces it today; any future anchoring integration (another
+ * DLR-bearing DID method, a different chain) imports the same guard rather
+ * than re-deriving "what makes a status list publishable". An unsigned or
+ * bitstring-less list anchored on-chain would be an unverifiable — and
+ * therefore fail-closed-unusable — revocation source for every holder.
+ */
+export declare function assertAnchorableStatusListCredential(content: unknown): void;
+//# sourceMappingURL=statuslist-bits.d.ts.map

package/dist/utils/statuslist-bits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"statuslist-bits.d.ts","sourceRoot":"","sources":["../../src/utils/statuslist-bits.ts"],"names":[],"mappings":"AAmBA;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAWxD;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,GAClE,OAAO,CAAC,UAAU,CAAC,CAUrB;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAUtE;AAED;;;;;;;;GAQG;AACH,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAiB3E"}