@kya-os/mcp 1.14.0 → 1.14.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +20 -0
- package/README.md +12 -0
- package/dist/middleware/with-kya-os.delegation-gate.d.ts.map +1 -1
- package/dist/middleware/with-kya-os.delegation-gate.js +13 -53
- package/dist/middleware/with-kya-os.delegation-gate.js.map +1 -1
- package/dist/middleware/with-kya-os.delegation-verify.d.ts +23 -10
- package/dist/middleware/with-kya-os.delegation-verify.d.ts.map +1 -1
- package/dist/middleware/with-kya-os.delegation-verify.js +68 -2
- package/dist/middleware/with-kya-os.delegation-verify.js.map +1 -1
- package/package.json +13 -13
package/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,26 @@ Versioning: https://semver.org/spec/v2.0.0.html
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
+
## [1.14.2] - 2026-08-19
|
|
11
|
+
|
|
12
|
+
### Fixed
|
|
13
|
+
|
|
14
|
+
- VC-JWT (string) delegations are now verified by their envelope signature in
|
|
15
|
+
the delegation gate before authorization, matching the embedded-proof (object)
|
|
16
|
+
path. Existing object and signed `did:key` VC-JWT flows are unaffected.
|
|
17
|
+
|
|
18
|
+
## [1.14.1] - 2026-08-15
|
|
19
|
+
|
|
20
|
+
### Fixed
|
|
21
|
+
|
|
22
|
+
- **Fresh installs no longer break on `json-canonicalize`.** The dependency is
|
|
23
|
+
now pinned to `2.0.0` exactly. The upstream `2.0.1` publish ships raw
|
|
24
|
+
TypeScript sources with no compiled JavaScript (its `main` points at a
|
|
25
|
+
nonexistent path), so any install resolving `^2.0.0` without a lockfile -
|
|
26
|
+
every new adopter - got a package that cannot be imported. Pinning restores
|
|
27
|
+
installability for `@kya-os/mcp` and everything downstream of it. The pin
|
|
28
|
+
can be relaxed once upstream publishes a corrected release.
|
|
29
|
+
|
|
10
30
|
## [1.14.0] - 2026-08-13
|
|
11
31
|
|
|
12
32
|
### Added
|
package/README.md
CHANGED
|
@@ -188,6 +188,18 @@ Miss the proof, replay a nonce, or tamper the body and `requireProof` fails clos
|
|
|
188
188
|
|
|
189
189
|
## See it in action
|
|
190
190
|
|
|
191
|
+
### REVOKED: an on-chain kill switch for AI agents with wallet access
|
|
192
|
+
|
|
193
|
+
[](https://www.loom.com/share/f32b82a292f14a6c952dba3a0a246e45)
|
|
194
|
+
|
|
195
|
+
A live agent (Claude Desktop) pays invoices from a testnet wallet under a signed, scoped, revocable credential. When it goes rogue, a FIDO2 hardware touch revokes that credential on a public chain: the StatusList2021 bit flips in a cheqd DID-Linked Resource, and the agent's next transaction is refused in about half a second. Funds never move.
|
|
196
|
+
|
|
197
|
+
Built in a weekend on this package (2nd place, DEF CON 34 Cryptocurrency Village), and everything the demo had to invent now ships here: the on-chain resolver, the always-fresh revocation checks, the DLR artifact type ([#165](https://github.com/decentralized-identity/kya-os-mcp/pull/165) through [#169](https://github.com/decentralized-identity/kya-os-mcp/pull/169)).
|
|
198
|
+
|
|
199
|
+
Start with the 60-second path: verify a genuinely revoked credential against the live testnet, zero configuration. **[examples/revoked](./examples/revoked/)**
|
|
200
|
+
|
|
201
|
+
### Run the example servers
|
|
202
|
+
|
|
191
203
|
```bash
|
|
192
204
|
git clone https://github.com/decentralized-identity/kya-os-mcp.git
|
|
193
205
|
cd kya-os-mcp && npm install
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"with-kya-os.delegation-gate.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;
|
|
1
|
+
{"version":3,"file":"with-kya-os.delegation-gate.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAYH,OAAO,KAAK,EAEV,mBAAmB,EACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAkC/D,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,oBAAoB,EAAE,eAAe,CAAC,sBAAsB,CAAC,CAAC;IAC9D,kBAAkB,EAAE,eAAe,CAAC,oBAAoB,CAAC,CAAC;CAC3D;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,oBAAoB,GAC3B,IAAI,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAsQjD"}
|
|
@@ -8,7 +8,6 @@
|
|
|
8
8
|
*/
|
|
9
9
|
import { isHolderBindingApplicable, isKyaOsControlArg, assertHolderBinding, toHolderBindingRequest, } from "../delegation/holder-binding.js";
|
|
10
10
|
import { scopeSatisfies } from "../delegation/scope-matcher.js";
|
|
11
|
-
import { parseVCJWT } from "../delegation/utils.js";
|
|
12
11
|
import { logger } from "../logging/index.js";
|
|
13
12
|
import { KYA_OS_ERROR_CODES } from "../errors.js";
|
|
14
13
|
import { sanitizeForMessage } from "./with-kya-os.helpers.js";
|
|
@@ -44,7 +43,7 @@ function rejectedDelegationRef(value) {
|
|
|
44
43
|
export function createDelegationGate(deps, wiring) {
|
|
45
44
|
const { identity, holderBindingMode, holderBindingVerifier, audit, cryptoProvider } = deps;
|
|
46
45
|
const { attachOutcomeProof, resolveExistingGrant, bindGrantOnSuccess } = wiring;
|
|
47
|
-
const {
|
|
46
|
+
const { verifyDelegation, buildDelegationErrorResponse, buildNeedsAuthorizationChallenge, } = createDelegationVerification(deps);
|
|
48
47
|
function wrapWithDelegation(toolName, config, handler) {
|
|
49
48
|
return async (args, sessionId) => {
|
|
50
49
|
const delegationArg = args["_kyaos_delegation"];
|
|
@@ -91,55 +90,15 @@ export function createDelegationGate(deps, wiring) {
|
|
|
91
90
|
const { challengeContent, message } = await buildNeedsAuthorizationChallenge(toolName, config);
|
|
92
91
|
return attachOutcomeProof({ content: challengeContent }, toolName, args, sessionId, message, "needs_authorization", undefined, challengeContent);
|
|
93
92
|
}
|
|
94
|
-
//
|
|
95
|
-
//
|
|
96
|
-
//
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
if (
|
|
100
|
-
const parsed = parseVCJWT(delegationArg);
|
|
101
|
-
if (!parsed || !parsed.payload.vc) {
|
|
102
|
-
return attachOutcomeProof(buildDelegationErrorResponse(KYA_OS_ERROR_CODES.delegation_invalid, "Invalid VC-JWT format"), toolName, args, sessionId, "Invalid VC-JWT format");
|
|
103
|
-
}
|
|
104
|
-
vc = parsed.payload.vc;
|
|
105
|
-
// VC-JWTs don't have an embedded proof — the JWT signature is the
|
|
106
|
-
// proof. Add a marker so basic validation (which checks for proof
|
|
107
|
-
// presence) passes. The actual signature is in the JWT envelope.
|
|
108
|
-
if (!vc.proof) {
|
|
109
|
-
vc = { ...vc, proof: { type: 'JwtProof2020', jwt: delegationArg } };
|
|
110
|
-
}
|
|
111
|
-
isVCJWT = true;
|
|
112
|
-
}
|
|
113
|
-
else {
|
|
114
|
-
vc = delegationArg;
|
|
115
|
-
}
|
|
116
|
-
// For VC-JWTs the embedded-signature check is skipped (the JWT envelope
|
|
117
|
-
// signature is the proof); schema/expiry/status/scope checks still apply.
|
|
118
|
-
// validateDelegationChain performs the shape check and returns
|
|
119
|
-
// { valid, reason } for malformed input, never throwing on normal or
|
|
120
|
-
// structurally-malformed credentials. This try/catch is therefore a PURE
|
|
121
|
-
// BACKSTOP — it fires only on a truly unexpected throw (e.g. a hostile
|
|
122
|
-
// getter/Proxy accessor or a provider fault): it logs the detail
|
|
123
|
-
// server-side and returns a GENERIC reason, so no internal/implementation
|
|
124
|
-
// detail (stack, raw error text) leaks to the client or the signed proof.
|
|
125
|
-
const verificationResult = await (async () => {
|
|
126
|
-
try {
|
|
127
|
-
return await validateDelegationChain(vc, { skipSignature: isVCJWT });
|
|
128
|
-
}
|
|
129
|
-
catch (error) {
|
|
130
|
-
logger.error("[kya-os] Unexpected error verifying delegation", {
|
|
131
|
-
tool: toolName,
|
|
132
|
-
error: error instanceof Error ? error.message : String(error),
|
|
133
|
-
stack: error instanceof Error ? error.stack : undefined,
|
|
134
|
-
});
|
|
135
|
-
return { valid: false, reason: "Delegation credential could not be verified" };
|
|
136
|
-
}
|
|
137
|
-
})();
|
|
138
|
-
if (!verificationResult.valid) {
|
|
139
|
-
const reason = verificationResult.reason ?? "Unknown delegation validation error";
|
|
93
|
+
// Authenticate the presented delegation (object embedded-proof OR VC-JWT
|
|
94
|
+
// string) and normalize it to a verified credential. verifyDelegation owns
|
|
95
|
+
// the wire-form-specific signature checks — the gate never sets
|
|
96
|
+
// skipSignature itself, so a JWT envelope can't be silently skipped.
|
|
97
|
+
const check = await verifyDelegation(delegationArg);
|
|
98
|
+
if (!check.valid) {
|
|
140
99
|
try {
|
|
141
100
|
await audit?.delegation('rejected', {
|
|
142
|
-
delegationRef: rejectedDelegationRef(vc),
|
|
101
|
+
delegationRef: rejectedDelegationRef(check.vc),
|
|
143
102
|
outcome: 'failed',
|
|
144
103
|
reasonCode: 'DELEGATION_VERIFICATION_FAILED',
|
|
145
104
|
});
|
|
@@ -150,9 +109,10 @@ export function createDelegationGate(deps, wiring) {
|
|
|
150
109
|
error: error instanceof Error ? error.message : String(error),
|
|
151
110
|
});
|
|
152
111
|
}
|
|
153
|
-
logger.warn(`[kya-os] Delegation verification failed for "${toolName}": ${sanitizeForMessage(reason)}`);
|
|
154
|
-
return attachOutcomeProof(buildDelegationErrorResponse(KYA_OS_ERROR_CODES.delegation_invalid, reason), toolName, args, sessionId, reason);
|
|
112
|
+
logger.warn(`[kya-os] Delegation verification failed for "${toolName}": ${sanitizeForMessage(check.reason)}`);
|
|
113
|
+
return attachOutcomeProof(buildDelegationErrorResponse(KYA_OS_ERROR_CODES.delegation_invalid, check.reason), toolName, args, sessionId, check.reason);
|
|
155
114
|
}
|
|
115
|
+
const { vc, isJwt } = check;
|
|
156
116
|
// Holder binding (spec §11.8): the delegation is valid, but a valid
|
|
157
117
|
// *credential* is a bearer token until we also prove the caller holds the
|
|
158
118
|
// delegation SUBJECT's key. Opt-in via `delegation.holderBinding`. did:key
|
|
@@ -215,7 +175,7 @@ export function createDelegationGate(deps, wiring) {
|
|
|
215
175
|
logger.warn(`[kya-os] Delegation missing required scope "${config.scopeId}" for "${toolName}"`);
|
|
216
176
|
return attachOutcomeProof(buildDelegationErrorResponse(KYA_OS_ERROR_CODES.insufficient_scope, reason), toolName, args, sessionId, reason);
|
|
217
177
|
}
|
|
218
|
-
const serializedCredential =
|
|
178
|
+
const serializedCredential = isJwt
|
|
219
179
|
? new TextEncoder().encode(delegationArg)
|
|
220
180
|
: canonicalizeJsonBytes(vc);
|
|
221
181
|
const credentialDigest = await cryptoProvider.hash(serializedCredential);
|
|
@@ -258,7 +218,7 @@ export function createDelegationGate(deps, wiring) {
|
|
|
258
218
|
}
|
|
259
219
|
// Mint a durable grant from this verified delegation so the next call —
|
|
260
220
|
// on any instance — resolves via resolveExistingGrant with no re-paste.
|
|
261
|
-
await bindGrantOnSuccess(vc, delegationArg,
|
|
221
|
+
await bindGrantOnSuccess(vc, delegationArg, isJwt, sessionId, config.scopeId);
|
|
262
222
|
logger.debug(`[kya-os] Delegation verified for "${toolName}", scope "${config.scopeId}"`);
|
|
263
223
|
return handler(cleanArgs, sessionId, callContext);
|
|
264
224
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"with-kya-os.delegation-gate.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;
|
|
1
|
+
{"version":3,"file":"with-kya-os.delegation-gate.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,4BAA4B,GAE7B,MAAM,oCAAoC,CAAC;AAE5C,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC,+EAA+E;AAC/E,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAClE,MAAM,UAAU,GAAG,KAAgC,CAAC;QACpD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC;QAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACtE,MAAM,UAAU,GAAI,OAAmC,CAAC,UAAU,CAAC;QACnE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5E,MAAM,MAAM,GAAI,UAAsC,CAAC,EAAE,CAAC;QAC1D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YACpD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AASD,MAAM,UAAU,oBAAoB,CAClC,IAAoB,EACpB,MAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAC3F,MAAM,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GACpE,MAAM,CAAC;IACT,MAAM,EACJ,gBAAgB,EAChB,4BAA4B,EAC5B,gCAAgC,GACjC,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAEvC,SAAS,kBAAkB,CACzB,QAAgB,EAChB,MAA4B,EAC5B,OAAyB;QAEzB,OAAO,KAAK,EAAE,IAA6B,EAAE,SAAkB,EAAE,EAAE;YACjE,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAEhD,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC1D,yEAAyE;gBACzE,oEAAoE;gBACpE,sEAAsE;gBACtE,sEAAsE;gBACtE,yEAAyE;gBACzE,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAC9C,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CAAC,OAAO,CACf,CAAC;gBACF,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,SAAS,GAA4B,EAAE,CAAC;oBAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;4BAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBAC9C,CAAC;oBACD,MAAM,CAAC,KAAK,CACV,gCAAgC,QAAQ,aAAa,MAAM,CAAC,OAAO,2BAA2B,CAC/F,CAAC;oBACF,MAAM,YAAY,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,KAAK,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE;wBACrE,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;4BAC3C,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,EAAE;4BACrF,CAAC,CAAC,EAAE,CAAC;wBACP,aAAa,EAAE;4BACb,MAAM,EAAE,OAAgB;4BACxB,QAAQ,EAAE,SAAkB;4BAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;4BACvB,QAAQ,EAAE,aAAa,CAAC,EAAE;4BAC1B,gBAAgB,EAAE,wBAAwB;yBAC3C;qBACF,CAAC;oBACF,MAAM,KAAK,EAAE,aAAa,CAAC,YAAY,EAAE;wBACvC,OAAO,EAAE,WAAW;wBACpB,QAAQ,EAAE,aAAa,CAAC,EAAE;wBAC1B,OAAO,EAAE,YAAY;qBACtB,CAAC,CAAC;oBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;gBACrD,CAAC;gBAED,iEAAiE;gBACjE,uEAAuE;gBACvE,yEAAyE;gBACzE,uEAAuE;gBACvE,sEAAsE;gBACtE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,GACjC,MAAM,gCAAgC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC3D,OAAO,kBAAkB,CACvB,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,OAAO,EACP,qBAAqB,EACrB,SAAS,EACT,gBAAgB,CACjB,CAAC;YACJ,CAAC;YAED,yEAAyE;YACzE,2EAA2E;YAC3E,gEAAgE;YAChE,qEAAqE;YACrE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,aAAa,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE;wBAClC,aAAa,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC9C,OAAO,EAAE,QAAQ;wBACjB,UAAU,EAAE,gCAAgC;qBAC7C,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE;wBACxE,IAAI,EAAE,QAAQ;wBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,CAAC,IAAI,CACT,gDAAgD,QAAQ,MAAM,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CACjG,CAAC;gBACF,OAAO,kBAAkB,CACvB,4BAA4B,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,EACjF,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,KAAK,CAAC,MAAM,CACb,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;YAE5B,oEAAoE;YACpE,0EAA0E;YAC1E,2EAA2E;YAC3E,4EAA4E;YAC5E,4EAA4E;YAC5E,IAAI,iBAAiB,KAAK,KAAK,IAAI,qBAAqB,EAAE,CAAC;gBACzD,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBAC5C,IAAI,UAAU,IAAI,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;oBACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;oBACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAC3B,MAAM,MAAM,GACV,4EAA4E,CAAC;wBAC/E,MAAM,CAAC,IAAI,CACT,6BAA6B,QAAQ,+BAA+B,CACrE,CAAC;wBACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;4BACpC,OAAO,kBAAkB,CACvB,4BAA4B,CAC1B,kBAAkB,CAAC,qBAAqB,EACxC,MAAM,CACP,EACD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;wBACJ,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,IAAI,WAAW,GAAY,QAAQ,CAAC;wBACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;4BACjC,IAAI,CAAC;gCACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;4BACrC,CAAC;4BAAC,MAAM,CAAC;gCACP,WAAW,GAAG,EAAE,CAAC;4BACnB,CAAC;wBACH,CAAC;wBACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;4BACxC,KAAK,EAAE,WAA4B;4BACnC,UAAU;4BACV,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC;4BAC/C,gBAAgB,EAAE,QAAQ,CAAC,GAAG;4BAC9B,aAAa,EAAE,qBAAqB;yBACrC,CAAC,CAAC;wBACH,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;4BAC/B,MAAM,MAAM,GACV,OAAO,CAAC,MAAM;gCACd,yDAAyD,CAAC;4BAC5D,MAAM,CAAC,IAAI,CACT,2BAA2B,OAAO,CAAC,MAAM,SAAS,QAAQ,MAAM,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC7F,CAAC;4BACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gCACpC,OAAO,kBAAkB,CACvB,4BAA4B,CAC1B,kBAAkB,CAAC,qBAAqB,EACxC,MAAM,CACP,EACD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;4BACJ,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,UAAU,EAAE,CAAC;oBACtB,iEAAiE;oBACjE,2DAA2D;oBAC3D,MAAM,CAAC,IAAI,CACT,qCAAqC,UAAU,sDAAsD,CACtG,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,uEAAuE;YACvE,0DAA0D;YAC1D,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACvD,IAAI,WAAW,CAAC,mBAAmB,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CACT,mBAAmB,MAAM,CAAC,OAAO,UAAU,QAAQ,4BAA4B;oBAC7E,uFAAuF,CAC1F,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,mBAAmB,MAAM,CAAC,OAAO,4BAA4B,CAAC;gBAC7E,MAAM,CAAC,IAAI,CACT,+CAA+C,MAAM,CAAC,OAAO,UAAU,QAAQ,GAAG,CACnF,CAAC;gBACF,OAAO,kBAAkB,CACvB,4BAA4B,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAC3E,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,KAAK;gBAChC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAuB,CAAC;gBACnD,CAAC,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC9B,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,oBAAoB,CAAW,CAAC;YACnF,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YAClE,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC;YAC9E,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,UAAU,CAAC;YAC9D,MAAM,aAAa,GAAG;gBACpB,MAAM,EAAE,YAAqB;gBAC7B,QAAQ,EAAE,SAAkB;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,aAAa;gBACb,0BAA0B,EAAE,gBAAgB;gBAC5C,gBAAgB,EAAE,wBAAwB;aAC3C,CAAC;YACF,MAAM,WAAW,GAAG;gBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK;gBACL,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC;oBAChC,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;oBAC1E,CAAC,CAAC,EAAE,CAAC;gBACP,aAAa;aACd,CAAC;YAEF,MAAM,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE;gBAClC,aAAa;gBACb,OAAO,EAAE,WAAW;gBACpB,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,QAAQ;gBACnD,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;gBACrC,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YAEH,qEAAqE;YACrE,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;oBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YAED,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,kBAAkB,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAE9E,MAAM,CAAC,KAAK,CACV,qCAAqC,QAAQ,aAAa,MAAM,CAAC,OAAO,GAAG,CAC5E,CAAC;YACF,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAChC,CAAC"}
|
|
@@ -18,19 +18,32 @@ export interface DelegationGateConfig {
|
|
|
18
18
|
text: string;
|
|
19
19
|
}>;
|
|
20
20
|
}
|
|
21
|
+
/**
|
|
22
|
+
* Outcome of authenticating a presented delegation. On success the caller gets
|
|
23
|
+
* the normalized credential and its wire form; on failure a sanitizable reason
|
|
24
|
+
* plus the best-effort parsed credential (for audit references), if any.
|
|
25
|
+
*/
|
|
26
|
+
export type DelegationCheck = {
|
|
27
|
+
valid: true;
|
|
28
|
+
vc: DelegationCredential;
|
|
29
|
+
isJwt: boolean;
|
|
30
|
+
} | {
|
|
31
|
+
valid: false;
|
|
32
|
+
reason: string;
|
|
33
|
+
vc?: DelegationCredential;
|
|
34
|
+
};
|
|
21
35
|
export interface DelegationVerification {
|
|
22
36
|
/**
|
|
23
|
-
*
|
|
24
|
-
*
|
|
25
|
-
*
|
|
26
|
-
*
|
|
37
|
+
* Authenticate and normalize a presented `_kyaos_delegation`, in either wire
|
|
38
|
+
* form, into a single verified credential. A VC-JWT **string** is verified by
|
|
39
|
+
* its compact-JWS ENVELOPE signature against the issuer's published key; an
|
|
40
|
+
* **object** is verified by its embedded Data-Integrity proof. Both then run
|
|
41
|
+
* the full chain / scope-superset / expiry / status / revocation walk. Owning
|
|
42
|
+
* the `skipSignature` decision here (never at the call site) is what stops a
|
|
43
|
+
* JWT envelope from being silently skipped. Returns a {@link DelegationCheck},
|
|
44
|
+
* never throws on normal or structurally-malformed input.
|
|
27
45
|
*/
|
|
28
|
-
|
|
29
|
-
skipSignature?: boolean;
|
|
30
|
-
}): Promise<{
|
|
31
|
-
valid: boolean;
|
|
32
|
-
reason?: string;
|
|
33
|
-
}>;
|
|
46
|
+
verifyDelegation(delegationArg: unknown): Promise<DelegationCheck>;
|
|
34
47
|
/** A structured `{ error, reason }` tool response with a sanitized reason. */
|
|
35
48
|
buildDelegationErrorResponse(error: string, reason: string): Awaited<ReturnType<KyaOsToolHandler>>;
|
|
36
49
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"with-kya-os.delegation-verify.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiBH,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAG5D,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,CAChB,SAAS,EAAE,uBAAuB,KAC/B,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5C;AAED,MAAM,
|
|
1
|
+
{"version":3,"file":"with-kya-os.delegation-verify.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiBH,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAG5D,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,CAChB,SAAS,EAAE,uBAAuB,KAC/B,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5C;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,oBAAoB,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACzD;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEhE,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACnE,8EAA8E;IAC9E,4BAA4B,CAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACzC;;;;;OAKG;IACH,gCAAgC,CAC9B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC;QACT,gBAAgB,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACxD,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,cAAc,GACnB,sBAAsB,CA+PxB"}
|
|
@@ -13,7 +13,7 @@ import { getDidMethod } from "../utils/did-helpers.js";
|
|
|
13
13
|
import { DelegationCredentialVerifier, } from "../delegation/vc-verifier.js";
|
|
14
14
|
import { validateDelegationChain as validateDelegationChainCore } from "../delegation/chain-enforcement.js";
|
|
15
15
|
import { RuntimeFetchProvider } from "../providers/runtime-fetch.js";
|
|
16
|
-
import { canonicalizeJSON } from "../delegation/utils.js";
|
|
16
|
+
import { canonicalizeJSON, parseVCJWT } from "../delegation/utils.js";
|
|
17
17
|
import { base64urlDecodeToBytes, bytesToBase64 } from "../utils/base64.js";
|
|
18
18
|
import { createNeedsAuthorizationError, readCredentialProofValue, } from "../types/protocol.js";
|
|
19
19
|
import { logger } from "../logging/index.js";
|
|
@@ -117,6 +117,72 @@ export function createDelegationVerification(deps) {
|
|
|
117
117
|
statusListConfigured: !!delegationConfig?.statusListResolver,
|
|
118
118
|
revocationChecker: delegationConfig?.revocationChecker,
|
|
119
119
|
}, options);
|
|
120
|
+
async function verifyDelegation(delegationArg) {
|
|
121
|
+
// Normalize to a DelegationCredential, authenticating by wire form. A VC-JWT
|
|
122
|
+
// string carries its signature in the compact-JWS ENVELOPE; an object carries
|
|
123
|
+
// an embedded Data-Integrity proof (verified inside validateDelegationChain).
|
|
124
|
+
let vc;
|
|
125
|
+
let isJwt = false;
|
|
126
|
+
if (typeof delegationArg === "string") {
|
|
127
|
+
const parsed = parseVCJWT(delegationArg);
|
|
128
|
+
if (!parsed || !parsed.payload.vc) {
|
|
129
|
+
return { valid: false, reason: "Invalid VC-JWT format" };
|
|
130
|
+
}
|
|
131
|
+
// Envelope-first: verify the JWT signature against the issuer's published
|
|
132
|
+
// key BEFORE the chain runs with skipSignature. Reuses the vetted verifier
|
|
133
|
+
// (EdDSA-pinned compact-JWS + iss/issuer consistency; fail-closed). Status
|
|
134
|
+
// is checked once by the chain walk below, so skip it here.
|
|
135
|
+
const envelope = await verifier.verifyDelegationJwt(delegationArg, {
|
|
136
|
+
skipStatus: true,
|
|
137
|
+
});
|
|
138
|
+
if (!envelope.valid) {
|
|
139
|
+
return {
|
|
140
|
+
valid: false,
|
|
141
|
+
reason: envelope.reason ?? "VC-JWT envelope signature is not valid",
|
|
142
|
+
vc: parsed.payload.vc,
|
|
143
|
+
};
|
|
144
|
+
}
|
|
145
|
+
vc = parsed.payload.vc;
|
|
146
|
+
// A JWT has no embedded `proof`; add a marker so basic validation (which
|
|
147
|
+
// requires proof presence) passes. The already-verified envelope is the
|
|
148
|
+
// real proof, so the chain walk runs with skipSignature (below).
|
|
149
|
+
if (!vc.proof) {
|
|
150
|
+
vc = { ...vc, proof: { type: "JwtProof2020", jwt: delegationArg } };
|
|
151
|
+
}
|
|
152
|
+
isJwt = true;
|
|
153
|
+
}
|
|
154
|
+
else {
|
|
155
|
+
vc = delegationArg;
|
|
156
|
+
}
|
|
157
|
+
// Chain / scope-superset / expiry / status / revocation. skipSignature is
|
|
158
|
+
// true ONLY for a JWT (its envelope, verified above, is the proof); an object
|
|
159
|
+
// keeps it false so validateDelegationChain verifies the embedded proof.
|
|
160
|
+
// That call never throws on normal/malformed input; this backstop catches
|
|
161
|
+
// only a truly unexpected throw (hostile getter/Proxy, provider fault) and
|
|
162
|
+
// returns a GENERIC reason so no internal detail leaks to the client/proof.
|
|
163
|
+
let chain;
|
|
164
|
+
try {
|
|
165
|
+
chain = await validateDelegationChain(vc, { skipSignature: isJwt });
|
|
166
|
+
}
|
|
167
|
+
catch (error) {
|
|
168
|
+
logger.error("[kya-os] Unexpected error verifying delegation", {
|
|
169
|
+
error: error instanceof Error ? error.message : String(error),
|
|
170
|
+
stack: error instanceof Error ? error.stack : undefined,
|
|
171
|
+
});
|
|
172
|
+
chain = {
|
|
173
|
+
valid: false,
|
|
174
|
+
reason: "Delegation credential could not be verified",
|
|
175
|
+
};
|
|
176
|
+
}
|
|
177
|
+
if (!chain.valid) {
|
|
178
|
+
return {
|
|
179
|
+
valid: false,
|
|
180
|
+
reason: chain.reason ?? "Unknown delegation validation error",
|
|
181
|
+
vc,
|
|
182
|
+
};
|
|
183
|
+
}
|
|
184
|
+
return { valid: true, vc, isJwt };
|
|
185
|
+
}
|
|
120
186
|
async function buildNeedsAuthorizationChallenge(toolName, config) {
|
|
121
187
|
const tokenBytes = await cryptoProvider.randomBytes(16);
|
|
122
188
|
const hex = Array.from(tokenBytes)
|
|
@@ -159,7 +225,7 @@ export function createDelegationVerification(deps) {
|
|
|
159
225
|
return { challengeContent, message: authError.message };
|
|
160
226
|
}
|
|
161
227
|
return {
|
|
162
|
-
|
|
228
|
+
verifyDelegation,
|
|
163
229
|
buildDelegationErrorResponse,
|
|
164
230
|
buildNeedsAuthorizationChallenge,
|
|
165
231
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"with-kya-os.delegation-verify.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EACL,4BAA4B,GAG7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,IAAI,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"with-kya-os.delegation-verify.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EACL,4BAA4B,GAG7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,IAAI,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GAGzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAoD9D,MAAM,UAAU,4BAA4B,CAC1C,IAAoB;IAEpB,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAE5D,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;IAC9C,MAAM,aAAa,GACjB,gBAAgB,EAAE,aAAa;QAC/B,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;YACrC,CAAC,CAAC,IAAI,oBAAoB,EAAE;YAC5B,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,MAAM,cAAc,GAAG,aAAa;QAClC,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,sBAAsB,GAAG,wBAAwB,CACrD,gBAAgB,EAAE,YAAY,EAC9B,aAAa,CACd,CAAC;IACF,MAAM,WAAW,GAAgB;QAC/B,KAAK,CAAC,OAAO,CAAC,GAAW;YACvB,MAAM,cAAc,GAAG,gBAAgB,EAAE,WAAW,CAAC;YACrD,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,QAAQ,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,kBAAkB,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/E,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACvD,IAAI,QAAQ,EAAE,CAAC;wBACb,OAAO,QAAQ,CAAC;oBAClB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;YAC9C,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IAEF,MAAM,iBAAiB,GAAkC,KAAK,EAC5D,EAAwB,EACxB,YAAqB,EACyB,EAAE;QAChD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAgC,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACjE,CAAC;QAED,yEAAyE;QACzE,MAAM,QAAQ,GAAG,EAA6B,CAAC;QAC/C,MAAM,cAAc,GAA4B,EAAE,CAAC;QACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,OAAO;gBAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEjD,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEpD,iEAAiE;QACjE,MAAM,GAAG,GAAG,YAA8B,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAChE,CAAC;QAED,mEAAmE;QACnE,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAEhD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QACxE,OAAO;YACL,KAAK;YACL,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B;SAC5D,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAAC;QAChD,WAAW;QACX,iBAAiB;QACjB,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB;QACxD,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK;QACpD,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU;KAC9D,CAAC,CAAC;IAEH,MAAM,4BAA4B,GAAG,CACnC,KAAa,EACb,MAAc,EACyB,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;aACpE;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,MAAM,uBAAuB,GAAG,CAC9B,cAAoC,EACpC,OAAqC,EACS,EAAE,CAChD,2BAA2B,CACzB,cAAc,EACd;QACE,SAAS,EAAE,QAAQ,CAAC,GAAG;QACvB,QAAQ;QACR,sBAAsB,EAAE,gBAAgB,EAAE,sBAAsB;QAChE,oBAAoB,EAAE,CAAC,CAAC,gBAAgB,EAAE,kBAAkB;QAC5D,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB;KACvD,EACD,OAAO,CACR,CAAC;IAEJ,KAAK,UAAU,gBAAgB,CAC7B,aAAsB;QAEtB,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,IAAI,EAAwB,CAAC;QAC7B,IAAI,KAAK,GAAG,KAAK,CAAC;QAElB,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;YAC3D,CAAC;YACD,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,4DAA4D;YAC5D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,aAAa,EAAE;gBACjE,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACpB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,wCAAwC;oBACnE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAA0B;iBAC9C,CAAC;YACJ,CAAC;YACD,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAA0B,CAAC;YAC/C,yEAAyE;YACzE,wEAAwE;YACxE,iEAAiE;YACjE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACd,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC;YACtE,CAAC;YACD,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,aAAqC,CAAC;QAC7C,CAAC;QAED,0EAA0E;QAC1E,8EAA8E;QAC9E,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,KAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;gBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;aACxD,CAAC,CAAC;YACH,KAAK,GAAG;gBACN,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,6CAA6C;aACtD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,qCAAqC;gBAC7D,EAAE;aACH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,UAAU,gCAAgC,CAC7C,QAAgB,EAChB,MAA4B;QAK5B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,WAAW,GAAG;YAClB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;SACd,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;QAEtD,MAAM,SAAS,GAAG,6BAA6B,CAAC;YAC9C,OAAO,EAAE,SAAS,QAAQ,qCAAqC,MAAM,CAAC,OAAO,EAAE;YAC/E,gBAAgB,EAAE,MAAM,CAAC,UAAU;YACnC,WAAW;YACX,SAAS;YACT,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;QAEH,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,uBAAuB,GAAG;YAC9B,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;SAC3D,CAAC;QACF,IAAI,gBAAgB,GAAG,uBAAuB,CAAC;QAC/C,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,gBAAgB,GAAG,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE;oBAC1E,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,gBAAgB,GAAG,uBAAuB,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,gBAAgB;QAChB,4BAA4B;QAC5B,gCAAgC;KACjC,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@kya-os/mcp",
|
|
3
|
-
"version": "1.14.
|
|
3
|
+
"version": "1.14.2",
|
|
4
4
|
"description": "Reference implementation of the KYA-OS protocol for Model Context Protocol servers: identity, delegation, proofs, sessions, and verifiable audit trails",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -115,9 +115,9 @@
|
|
|
115
115
|
"example:audit-trail": "npx tsx examples/audit-trail/walkthrough.ts"
|
|
116
116
|
},
|
|
117
117
|
"dependencies": {
|
|
118
|
-
"jose": "^6.2.
|
|
119
|
-
"json-canonicalize": "
|
|
120
|
-
"zod": "^4.3
|
|
118
|
+
"jose": "^6.2.8",
|
|
119
|
+
"json-canonicalize": "2.0.0",
|
|
120
|
+
"zod": "^4.4.3"
|
|
121
121
|
},
|
|
122
122
|
"peerDependencies": {
|
|
123
123
|
"@modelcontextprotocol/sdk": ">=1.0.0"
|
|
@@ -129,20 +129,20 @@
|
|
|
129
129
|
},
|
|
130
130
|
"devDependencies": {
|
|
131
131
|
"@eslint/js": "^10.0.1",
|
|
132
|
-
"@kya-os/consent": "^0.1.
|
|
133
|
-
"@modelcontextprotocol/sdk": "^1.
|
|
132
|
+
"@kya-os/consent": "^0.1.47",
|
|
133
|
+
"@modelcontextprotocol/sdk": "^1.30.0",
|
|
134
134
|
"@types/express": "^5.0.6",
|
|
135
|
-
"@types/node": "^26.0
|
|
136
|
-
"@typescript-eslint/eslint-plugin": "^8.
|
|
137
|
-
"@typescript-eslint/parser": "^8.
|
|
135
|
+
"@types/node": "^26.2.0",
|
|
136
|
+
"@typescript-eslint/eslint-plugin": "^8.67.0",
|
|
137
|
+
"@typescript-eslint/parser": "^8.67.0",
|
|
138
138
|
"@vitest/coverage-v8": "^4.1.10",
|
|
139
139
|
"ajv": "^8.20.0",
|
|
140
140
|
"commander": "^15.0.0",
|
|
141
|
-
"eslint": "^10.
|
|
141
|
+
"eslint": "^10.8.1",
|
|
142
142
|
"express": "^5.2.1",
|
|
143
|
-
"tsx": "^4.
|
|
144
|
-
"typescript": "^5.
|
|
145
|
-
"typescript-eslint": "^8.
|
|
143
|
+
"tsx": "^4.23.12",
|
|
144
|
+
"typescript": "^5.9.3",
|
|
145
|
+
"typescript-eslint": "^8.67.0",
|
|
146
146
|
"vitest": "^4.1.10"
|
|
147
147
|
},
|
|
148
148
|
"keywords": [
|