@kya-os/mcp 1.13.0 → 1.14.2

package/dist/utils/statuslist-bits.js

@@ -0,0 +1,106 @@
+/**
+ * Status-list primitives — the ONE home for the mechanics every W3C
+ * status-list reader AND publisher in this package shares (StatusList2021 /
+ * Bitstring Status List v1.0): canonical index parsing, bounded payload
+ * inflation, the MSB-first bit read, and the anchor-fitness guard.
+ *
+ * Consumers: `delegation/bitstring.ts` (+ `statuslist-manager.ts`) and
+ * `card/revocation.ts` — previously each carried its own copy of exactly this
+ * knowledge, with the drift risk the source comments could only pledge away.
+ * The seams' POLICIES stay where they are (the delegation path throws and the
+ * caller maps to `status_unresolvable`; the card path catches everything into
+ * `FAIL_CLOSED` and models freshness) — only the mechanics live here.
+ *
+ * FAIL-CLOSED throughout: a non-canonical index, an oversized inflation, or
+ * an unreadable bit throws rather than reading as "not revoked".
+ */
+import { base64urlDecodeToBytes } from './base64.js';
+import { isRecord } from './guards.js';
+/**
+ * Hard ceiling on an INFLATED status bitstring (16 MiB ≈ 134M entries — far
+ * beyond any herd-privacy list). A fixed cap costs nothing legitimate while
+ * stopping a decompression bomb; exceeding it throws (fail-closed).
+ */
+export const MAX_STATUS_LIST_BYTES = 16 * 1024 * 1024;
+/**
+ * The W3C Bitstring Status List `encodedList` multibase prefix (base64url,
+ * no padding). A gzip stream's fixed magic byte (0x1f) makes its base64url
+ * start with `H`, never `u`, so a leading `u` is unambiguously the multibase
+ * code rather than payload.
+ */
+export const MULTIBASE_BASE64URL = 'u';
+/**
+ * Parse a decimal `statusListIndex` (a non-negative integer expressed as a
+ * string), fail-closed. Canonical decimal ONLY: `Number()` alone would coerce
+ * whitespace (`" "` → 0), hex (`"0x2A"` → 42), `"+42"`, and `"1e1"` → 10 —
+ * silently reading a DIFFERENT (often clear) bit than the credential names,
+ * so a revoked credential could read as live.
+ */
+export function parseStatusListIndex(raw) {
+    if (!/^[0-9]+$/.test(raw)) {
+        throw new Error(`Invalid statusListIndex "${raw}" — must be a canonical non-negative decimal`);
+    }
+    const index = Number(raw);
+    if (!Number.isSafeInteger(index)) {
+        throw new Error(`statusListIndex "${raw}" exceeds the safe integer range`);
+    }
+    return index;
+}
+/**
+ * Decode a status-list `encodedList` to the raw bitstring: strip the optional
+ * multibase `u` prefix, base64url-decode, run the injected decompressor, and
+ * re-check the {@link MAX_STATUS_LIST_BYTES} cap POST-inflation as a backstop
+ * (a production decompressor SHOULD also bound output during inflation).
+ * The decompressor is the bare-function common denominator — an
+ * object-shaped `DecompressionFunction` adapts inline:
+ * `(b) => decompressor.decompress(b)`.
+ */
+export async function decodeStatusListPayload(encodedList, decompress) {
+    const payload = encodedList[0] === MULTIBASE_BASE64URL ? encodedList.slice(1) : encodedList;
+    const inflated = await decompress(base64urlDecodeToBytes(payload));
+    if (inflated.length > MAX_STATUS_LIST_BYTES) {
+        throw new Error(`Status list too large: ${inflated.length} bytes exceeds ${MAX_STATUS_LIST_BYTES}`);
+    }
+    return inflated instanceof Uint8Array ? inflated : new Uint8Array(inflated);
+}
+/**
+ * Read the status bit at `index` — MSB-first within each byte (W3C Bitstring
+ * encoding). Uses FULL-PRECISION arithmetic (`Math.floor(index / 8)`) rather
+ * than 32-bit bitwise ops, which coerce to uint32 first: an index ≥ 2^32
+ * would silently wrap onto a low byte and read the WRONG — often clear — bit,
+ * turning an out-of-range index that MUST fail-closed into a fail-OPEN "not
+ * revoked". NaN/negative/fractional/out-of-buffer indexes throw.
+ */
+export function readStatusBit(bits, index) {
+    const byte = Number.isInteger(index) && index >= 0
+        ? bits[Math.floor(index / 8)]
+        : undefined;
+    if (byte === undefined) {
+        throw new Error(`Bit index ${index} out of range for the status list`);
+    }
+    return (byte & (0x80 >> index % 8)) !== 0;
+}
+/**
+ * Assert a status-list credential is fit to ANCHOR (publish) — signed, and
+ * actually carrying a bitstring. Method-agnostic on purpose: the cheqd DLR
+ * publisher enforces it today; any future anchoring integration (another
+ * DLR-bearing DID method, a different chain) imports the same guard rather
+ * than re-deriving "what makes a status list publishable". An unsigned or
+ * bitstring-less list anchored on-chain would be an unverifiable — and
+ * therefore fail-closed-unusable — revocation source for every holder.
+ */
+export function assertAnchorableStatusListCredential(content) {
+    if (!isRecord(content)) {
+        throw new Error('Status list credential must be an object');
+    }
+    if (!content.proof) {
+        throw new Error('Refusing to publish an UNSIGNED status list credential');
+    }
+    const subject = content.credentialSubject;
+    if (!isRecord(subject) ||
+        typeof subject.encodedList !== 'string' ||
+        subject.encodedList.length === 0) {
+        throw new Error('Status list credential is missing credentialSubject.encodedList');
+    }
+}
+//# sourceMappingURL=statuslist-bits.js.map

package/dist/utils/statuslist-bits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"statuslist-bits.js","sourceRoot":"","sources":["../../src/utils/statuslist-bits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,4BAA4B,GAAG,8CAA8C,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,kCAAkC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAmB,EACnB,UAAmE;IAEnE,MAAM,OAAO,GACX,WAAW,CAAC,CAAC,CAAC,KAAK,mBAAmB,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAC9E,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,0BAA0B,QAAQ,CAAC,MAAM,kBAAkB,qBAAqB,EAAE,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,YAAY,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,IAAgB,EAAE,KAAa;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAChD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC7B,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,aAAa,KAAK,mCAAmC,CACtD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oCAAoC,CAAC,OAAgB;IACnE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAC1C,IACE,CAAC,QAAQ,CAAC,OAAO,CAAC;QAClB,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ;QACvC,OAAO,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAChC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp",
-  "version": "1.13.0",
+  "version": "1.14.2",
   "description": "Reference implementation of the KYA-OS protocol for Model Context Protocol servers: identity, delegation, proofs, sessions, and verifiable audit trails",
   "license": "MIT",
   "type": "module",
@@ -115,9 +115,9 @@
     "example:audit-trail": "npx tsx examples/audit-trail/walkthrough.ts"
   },
   "dependencies": {
-    "jose": "^6.2.4",
-    "json-canonicalize": "^2.0.0",
-    "zod": "^4.3.6"
+    "jose": "^6.2.8",
+    "json-canonicalize": "2.0.0",
+    "zod": "^4.4.3"
   },
   "peerDependencies": {
     "@modelcontextprotocol/sdk": ">=1.0.0"
@@ -129,20 +129,20 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@kya-os/consent": "^0.1.43",
-    "@modelcontextprotocol/sdk": "^1.12.1",
+    "@kya-os/consent": "^0.1.47",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "@types/express": "^5.0.6",
-    "@types/node": "^26.0.1",
-    "@typescript-eslint/eslint-plugin": "^8.65.0",
-    "@typescript-eslint/parser": "^8.65.0",
+    "@types/node": "^26.2.0",
+    "@typescript-eslint/eslint-plugin": "^8.67.0",
+    "@typescript-eslint/parser": "^8.67.0",
     "@vitest/coverage-v8": "^4.1.10",
     "ajv": "^8.20.0",
     "commander": "^15.0.0",
-    "eslint": "^10.0.3",
+    "eslint": "^10.8.1",
     "express": "^5.2.1",
-    "tsx": "^4.22.4",
-    "typescript": "^5.5.3",
-    "typescript-eslint": "^8.65.0",
+    "tsx": "^4.23.12",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.67.0",
     "vitest": "^4.1.10"
   },
   "keywords": [