@kya-os/mcp 1.14.2 → 1.15.0

package/CHANGELOG.md

@@ -7,6 +7,65 @@ Versioning: https://semver.org/spec/v2.0.0.html
 
 ## [Unreleased]
 
+## [1.15.0] - 2026-08-25
+
+### Added
+
+- **Response-proof `envelope` profile** (`org.kya-os/response-proof.envelope`).
+  The `body` profile binds `responseHash` over the response body only, leaving
+  result members such as `structuredContent`, `isError` and `resultType`
+  unauthenticated - an in-path intermediary could rewrite them under a still
+  valid proof. The envelope profile covers the ENTIRE result object with the
+  top-level `_meta` member removed, mirroring the request side's
+  `{method, params minus _meta}` rule, so every present and future result
+  member is authenticated while `_meta` stays intermediary-mutable (which is
+  what keeps attach-after-sign sound). The profile is discriminated by a `prf`
+  claim COVERED by the JWS signature, so a proof cannot be silently downgraded
+  to body semantics, and `validateDetachedProof` rejects unknown `prf` values
+  fail-closed. Verification always derives the profile from the proof's own
+  claim, never from configuration, so one verifier accepts both.
+- **Conformance vector-set immutability.** `conformance/SUITE-MANIFEST.json`
+  pins the vector set by hash, `scripts/suite-hash.mjs` computes and checks it,
+  and CI enforces it as its own line - a published vector set can no longer be
+  edited in place without the check failing. Suite is at 1.1.0.
+- **`DEPRECATIONS.md`** - an internal ledger of deferred breaking changes.
+
+### Fixed
+
+- **Sessionless request proofs now bind.** `generateRequestProof` defaulted
+  `meta.sessionId` to `''` when the caller omitted it, but `sessionId` is a
+  required non-empty string in the proof meta schema, so the proof failed
+  validation as `INVALID_PROOF_STRUCTURE` and `assertHolderBinding` returned
+  `unbound` for the LEGITIMATE holder - indistinguishable from the thief the
+  gate exists to catch. `sessionId` is documented as optional and a request
+  proof routinely precedes any handshake on a stateless core, so this was the
+  normal path rather than an edge case. It failed closed (nothing was wrongly
+  admitted), but phase-1 holder binding was unusable without a `sessionId` the
+  signature never said was mandatory. A per-proof id is now minted when none is
+  supplied; verification, the schema and the conformance vectors are unchanged.
+- The `prf` claim is derived only from the profile option, and the proof schema
+  id is bumped accordingly.
+- A challenge proof that the degraded-audit `isError` flip would have broken is
+  now stripped rather than emitted.
+- `suite-hash` hashes the committed blob bytes rather than the working tree, so
+  a dirty checkout cannot produce a passing hash.
+
+### Changed
+
+- **Response-proof profiles are named by mechanism, not sequence**:
+  `org.kya-os/response-proof.v2` -> `.envelope`, `.v1` -> `.body`, and
+  `RESPONSE_PROOF_PROFILE_V2`/`_V1` -> `_ENVELOPE`/`_BODY`. The sequence
+  framing was wrong on its own terms - original proofs carry no profile
+  identifier at all, so the first wire identifier would have debuted as `.v2`
+  naming a v1 that never existed. **No published API changes**: these
+  identifiers and constants are new in this release and never shipped in
+  1.14.2, so nothing downstream can be pinned to the old names. The
+  request-proof profile keeps its shipped `org.kya-os/proof.v1` name.
+- Conformance vectors use semantic names and a more robust signature-tamper
+  case.
+- Dependency bumps across the minor-and-patch group.
+- README restructures `did:cheqd` into a hierarchical Integrations section.
+
 ## [1.14.2] - 2026-08-19
 
 ### Fixed

package/CONFORMANCE.md

@@ -2,7 +2,7 @@
 
 **Compliance levels for KYA-OS implementations**
 
-Version: 1.0.0
+Version: 1.1.0
 Status: Stable
 
 ---
@@ -411,7 +411,7 @@ so it is reproducible against any implementation without re-signing.
 
 | File | Category | Positive | Negative |
 |------|----------|----------|----------|
-| `vectors/signed-proof.json` | Detached proof verification | valid signature + in-window ts | tampered signature, tampered meta, wrong key, timestamp skew exceeded |
+| `vectors/signed-proof.json` | Detached proof verification | valid signature + in-window ts; envelope content binding (profile `org.kya-os/response-proof.envelope`) | tampered signature, tampered meta, wrong key, timestamp skew exceeded; tampered `structuredContent` under envelope coverage, `prf` stripped (downgrade), unknown profile |
 | `vectors/delegation-chain.json` | Delegation chain verification | single-hop, two-hop attenuated | broken issuer↔subject linkage, scope widening, tampered signature, audience mismatch |
 | `vectors/status-list.json` | StatusList2021 revocation | active (bit unset) | revoked (bit set) |
 | `vectors/did-key-resolution.json` | did:key resolution | valid Ed25519 | malformed multibase, wrong method |
@@ -430,6 +430,11 @@ protocol, and `negotiation` exercises the MCP extension admission gate
 A `fail` vector passes the suite only when the implementation correctly **rejects**
 it. The runner exits non-zero on any mismatch.
 
+**On the envelope-profile vectors (`signed-proof/envelope-*`, `prf-stripped-downgrade`, `unknown-profile`; suite ≥ 1.1.0).**
+These exercise the `org.kya-os/response-proof.envelope` profile (SPEC.md §7.3): `responseHash` covers the full result envelope with the top-level `_meta` member removed, discriminated by a signature-covered `prf` claim.
+Their inputs carry an OPTIONAL `expected` member (`{ request, response }`) — the content the verifier "received" — which a conformant verifier re-hashes under the proof's own `prf` profile and reconciles against the bound hashes.
+Vectors without `expected` remain pure signature/skew checks.
+
 **On `signed-proof/tampered-meta`.**
 The proof's `meta` block mirrors the claims signed inside the JWS, but it is a convenience for consumers that read the proof without decoding the token, not an authoritative copy.
 This vector leaves the JWS byte-identical to `valid-basic` and alters only the mirrored `meta.requestHash`, so the JWS signature still verifies.
@@ -457,6 +462,16 @@ pnpm run conformance:generate
 
 Re-running mints fresh keys but preserves every positive/negative relationship by
 construction.
+Because fresh keys change the committed bytes, regenerated output MUST NOT be committed over an existing `suiteVersion` (see [Suite versioning and immutability](#suite-versioning-and-immutability)).
+
+### Suite versioning and immutability
+
+The committed vector set is immutable at a given `suiteVersion`: the vector bytes may only change together with a `suiteVersion` bump.
+`conformance/SUITE-MANIFEST.json` pins the current set (`suiteVersion`, `vectorSetHash`, `vectorCount`, per-file hashes) and is the anchor CI verifies against.
+The hash recipe: SHA-256 each vector file's raw committed bytes, sort the `[filename, hex]` pairs by filename, canonicalize the array with RFC 8785 (JCS), SHA-256 that, prefix with `sha256:`.
+CI enforces the invariant twice: a vitest guard (`conformance/__tests__/suite-immutability.test.ts`) and a dedicated step running `node conformance/suite-hash.mjs --check`.
+To change vectors intentionally, bump `suiteVersion` (including the in-file `version` fields), regenerate the manifest with `node conformance/suite-hash.mjs --json`, and keep `pinnedAt` current.
+The SIGNED public suite manifest published by the Conformance Attestation Program is a separate artifact built on this committed one.
 
 ### Running the harness against YOUR implementation
 

package/README.md

@@ -265,182 +265,52 @@ flows, and sessions are shared across instances and survive restarts.
 
 ---
 
-## Optional did:cheqd and DID-Linked Resources
+## Integrations
 
-`did:cheqd` support is additive and opt-in. Existing `did:key` and `did:web`
-flows remain unchanged, and operators can keep `did:web` as their canonical
-identifier while linking to a cheqd DID over time.
+KYA-OS reaches the outside world two ways: shipped **modules** for specific
+systems and standards, and typed **adapter seams** with in-memory defaults you
+swap out. Adding one is "drop a folder under `src/integrations/`" or "implement
+this interface" — contributions welcome.
 
-### Resolver configuration
+### Modules
+
+| Module | Adds | Docs |
+| --- | --- | --- |
+| **cheqd** (on-chain) | `did:cheqd` resolution, StatusList2021 revocation, DID-Linked Resources + registrar | [src/integrations/cheqd](./src/integrations/cheqd/README.md) |
+| **OAuth / OIDC** | PKCE + protected-resource metadata; generic-OIDC reference adapter | [`@kya-os/mcp/authz`](./src/authz/) · [example](./examples/authz-inspector/) |
+| **Verifiable audit** | RFC 9162 ledger; local or Checkpoint recorders, on-chain anchoring | [AUDITABILITY.md](./AUDITABILITY.md) |
+
+Enabling a module is a small config change. cheqd, for example, is a resolver
+you register under `didResolvers`:
 
 ```typescript
-import { RuntimeFetchProvider, withKyaOs, NodeCryptoProvider } from '@kya-os/mcp';
 import { cheqdResolver } from '@kya-os/mcp/cheqd';
 
-const crypto = new NodeCryptoProvider();
-const fetchProvider = new RuntimeFetchProvider();
-const didResolvers = {
-  cheqd: cheqdResolver({ resolverUrl: 'https://resolver.cheqd.net' }),
-};
-
 await withKyaOs(server, {
   crypto,
   delegation: {
-    fetchProvider,
-    didResolvers,
-  },
-});
-```
-
-`did:cheqd` is resolved only when a resolver for the `cheqd` DID method is
-explicitly supplied. The core middleware and fetch provider use the generic
-`didResolvers` registry; cheqd-specific URL/cache/header options live in the
-`cheqdResolver()` factory from `@kya-os/mcp/cheqd`.
-`RuntimeFetchProvider` accepts the same registry when it is used directly by a
-standalone verifier or operator script.
-Unsupported methods, malformed DIDs, fetch failures, invalid JSON, malformed DID
-Documents, and DID id mismatches fail closed by returning `null`. The resolver
-accepts both raw DID Documents and Universal Resolver-style DID Resolution
-Results (`{ didDocument: ... }`).
-
-### Registrar writes
-
-Registrar writes are explicit operator/admin actions. The package exposes
-`CheqdDidRegistrarClient` for cheqd DID Registrar `/create`, `/update`, and
-`/{did}/create-resource` flows, using cheqd's client-managed-secret pattern:
-the registrar returns a serialized payload, your signer signs it, and the
-signature is submitted back. Private keys are not sent to the registrar.
-
-```typescript
-import {
-  CheqdDidRegistrarClient,
-  createLocalEd25519CheqdRegistrarSigner,
-} from '@kya-os/mcp/cheqd';
-import {
-  NodeCryptoProvider,
-} from '@kya-os/mcp';
-
-const crypto = new NodeCryptoProvider();
-const registrar = new CheqdDidRegistrarClient({
-  registrarUrl: 'https://did-registrar-staging.cheqd.net/1.0',
-  fetchProvider,
-  // Optional static or async auth headers for private registrar deployments.
-  // headers: async () => ({ Authorization: `Bearer ${token}` }),
-});
-
-const signer = createLocalEd25519CheqdRegistrarSigner({
-  cryptoProvider: crypto,
-  privateKey: process.env.CHEQD_DID_PRIVATE_KEY_BASE64!,
-  verificationMethodId: 'did:cheqd:testnet:...#key-1',
-  signatureEncoding: 'base64url',
-});
-```
-
-For mainnet, run or contract against your own fee-payer registrar deployment and
-provide the signer hook from your KMS/HSM boundary. The local Ed25519 helper is
-for simple controlled deployments and tests; it still signs locally and sends
-only signatures to the registrar.
-
-Runtime proof generation does not perform registrar writes. Create/update/DLR
-publishing should be triggered by an explicit operator workflow, deployment
-step, or admin tool.
-
-### DID linkage
-
-For `did:web` <-> `did:cheqd` binding, publish reciprocal `alsoKnownAs` values
-and verify both DID Documents with `verifyDidLinkage()`. `buildDidWebDocument`
-can include the `did:cheqd` reference on the `did:web` side, while
-`updateCheqdAlsoKnownAs()` updates the cheqd side through the registrar.
-
-```typescript
-import { verifyDidLinkage } from '@kya-os/mcp';
-import { updateCheqdAlsoKnownAs } from '@kya-os/mcp/cheqd';
-
-await updateCheqdAlsoKnownAs({
-  didWeb: 'did:web:agent.example.com',
-  didCheqd: 'did:cheqd:testnet:...',
-  resolver: cheqdResolver,
-  registrar,
-  signer,
-  verificationMethodId: 'did:cheqd:testnet:...#key-1',
-});
-
-const linkage = verifyDidLinkage({
-  primaryDid: 'did:web:agent.example.com',
-  secondaryDid: 'did:cheqd:testnet:...',
-  primaryDidDocument: didWebDocument,
-  secondaryDidDocument: didCheqdDocument,
-});
-```
-
-### DID-Linked Resource helpers
-
-DID-Linked Resource helpers are intended for durable manifests only. Supported
-artifact types are:
-
-- `CapabilityManifest`
-- `ConformanceManifest`
-- `AccessHashManifest`
-- `TrustConfigManifest`
-
-`prepareCheqdDlrResource()` validates the artifact, canonicalizes its `content`
-with JSON Canonicalization Scheme, computes or validates a `sha256:<64 hex>`
-content hash, and returns a registrar resource body. Updates are modeled as new
-resource versions under the same resource `name` and `type`; prior resources are
-not overwritten. Do not write high-volume tool calls, raw operational logs, or
-normal runtime proof events to cheqd; keep those in your normal audit/hash
-stores.
-
-```typescript
-import { prepareCheqdDlrResource } from '@kya-os/mcp/cheqd';
-
-const prepared = await prepareCheqdDlrResource({
-  type: 'TrustConfigManifest',
-  subjectDid: 'did:cheqd:testnet:...',
-  name: 'agent-trust-config',
-  resourceType: 'TrustConfigManifest',
-  version: '2026-06-01',
-  content: {
-    acceptedDidMethods: ['did:web', 'did:key', 'did:cheqd'],
-    requiredLinkage: { type: 'alsoKnownAs', bidirectional: true },
+    didResolvers: { cheqd: cheqdResolver({ resolverUrl: 'https://resolver.cheqd.net' }) },
   },
-}, crypto);
-
-await registrar.createResource({
-  did: 'did:cheqd:testnet:...',
-  resource: prepared.resource,
-  signer,
-  verificationMethodId: 'did:cheqd:testnet:...#key-1',
 });
 ```
 
-See [examples/cheqd-dlr](./examples/cheqd-dlr/) for a complete operator flow.
-
-### Live cheqd registrar E2E tests
-
-Live registrar coverage is opt-in because it performs real writes to cheqd
-testnet. The default endpoint is the cheqd-published testnet staging registrar;
-override it only with another testnet registrar. The live test creates a testnet
-DID, adds a realistic `did:web` alias via `alsoKnownAs`, then publishes one
-resource for each supported KYA DLR artifact type.
-
-```powershell
-$env:KYA_OS_CHEQD_E2E = '1'
-npm run test:e2e:cheqd:testnet
-Remove-Item Env:\KYA_OS_CHEQD_E2E
-```
+Its full reference (registrar writes, `did:web` <-> `did:cheqd` linkage,
+DID-Linked Resource helpers, live testnet E2E) lives in
+[src/integrations/cheqd/README.md](./src/integrations/cheqd/README.md); see
+[examples/cheqd-dlr](./examples/cheqd-dlr/) for a complete operator flow.
 
-Optional environment variables:
+### Adapter seams (bring your own)
 
-| Variable | Default |
-| --- | --- |
-| `KYA_OS_CHEQD_TESTNET_REGISTRAR_URL` | `https://did-registrar-staging.cheqd.net/1.0` |
-| `KYA_OS_CHEQD_TESTNET_RESOLVER_URL` | `https://resolver.cheqd.net` |
-| `KYA_OS_CHEQD_E2E_TIMEOUT_MS` | `180000` |
+Every external dependency is a typed interface with an in-memory default, so you
+can swap in your own backend without touching the middleware.
 
-Out of scope for this package: replacing `did:web` as the canonical identity,
-writing runtime proof events on-chain, KYC/KYB issuance, reputation VC snapshot
-publication, status-list backend hosting, and external registry changes.
+| Seam | Default | Swap in |
+| --- | --- | --- |
+| DID resolution — `DIDResolver` | `did:key`, `did:web` | `did:cheqd`, custom |
+| Revocation — `StatusListResolver` | none | cheqd StatusList2021 |
+| State — `GrantStore`, `SessionStore`, `NonceCacheProvider`, `PendingFlowStore` | in-memory | Redis, DynamoDB, KV, Durable Objects, DB ([multi-instance](#multi-instance-deployments)) |
+| Crypto — `CryptoProvider` | Node, WebCrypto | your KMS / HSM |
+| Policy — `PolicyEngine` | default | custom |
 
 ## Links
 

package/SPEC.md

@@ -878,6 +878,11 @@ interface ProofMeta {
   outcome?: 'allowed' | 'denied' | 'step_up_required' | 'needs_authorization';
                          // Authorization outcome; ABSENT ⇒ implicitly 'allowed' (success)
   reason?: string;       // Human-readable reason on a non-'allowed' outcome
+  prf?: 'org.kya-os/response-proof.envelope';
+                         // Response-proof profile discriminator, COVERED by the
+                         // JWS signature. ABSENT ⇒ the body profile (body-only
+                         // responseHash, the original wire shape). Verifiers
+                         // MUST reject any other value (fail-closed; §7.3).
 }
 ```
 
@@ -895,7 +900,16 @@ Request canonicalization includes:
 }
 ```
 
-Response canonicalization is the `data` field only (excludes `_meta`).
+Response canonicalization is selected by the proof's response-proof profile, named by the signature-covered `prf` claim (§7.2):
+
+- **body** (`prf` ABSENT — the original profile): the `data` field only (excludes `_meta`).
+  Under MCP carriage, `data` is the result's `content` array; result members outside it are NOT covered.
+- **envelope** (`prf: "org.kya-os/response-proof.envelope"`): the ENTIRE result object with the top-level `_meta` member removed, mirroring the request side's `{method, params minus _meta}` rule.
+  This authenticates result members such as `structuredContent`, `isError`, and `resultType` that the body profile leaves uncovered, while `_meta` stays intermediary-mutable — which is what lets the proof itself be attached there after signing.
+
+A verifier derives the profile from the received proof's own `prf` claim, never from configuration, and MUST reject an unrecognized `prf` outright.
+Because `prf` is covered by the signature, stripping it from an envelope-profile proof breaks verification — a downgrade to body-only semantics is a hard failure, not a silent fallback.
+Producers default to the body profile (wire compatibility with existing verifiers); the envelope profile is an explicit opt-in (`responseProofProfile` in the middleware configuration).
 
 ### 7.4 JWS Compact Serialization
 
@@ -927,6 +941,9 @@ BASE64URL(header) . BASE64URL(payload) . BASE64URL(signature)
 }
 ```
 
+An envelope-profile proof (§7.3) additionally carries its `prf` claim in this payload — profile selection is signed, never advisory.
+Every optional `ProofMeta` member present on the proof (`scopeId`, `delegationRef`, `clientDid`, `outcome`, `reason`, `prf`) appears in the payload; the mirrored `meta` block and the decoded payload MUST reconcile exactly.
+
 **Denial** and **step-up** proofs have no response body, so `responseHash` is
 omitted and `outcome` (plus an optional `reason`) is included instead. Keys
 remain RFC 8785-sorted:
@@ -1040,8 +1057,9 @@ verifier treats `_meta` keys that are *not* KYA-OS's proof key:
   `_meta` keys to the application layer rather than discarding them.
 
 Under no policy does a verifier include any non-proof `_meta` key in a hash or
-signature computation. The signature covers the `data`/response body only; it
-never covers `_meta` (§7.3).
+signature computation. The signature covers the profile-selected response
+material only — the `data` body under the body profile, the result envelope minus
+its top-level `_meta` under the envelope profile — and never covers `_meta` itself (§7.3).
 
 > **Note.** The proof object's shape is normatively defined by
 > `schemas/detached-proof.json` (`$schema: draft/2020-12`). The *placement* key

package/dist/delegation/holder-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"holder-binding.d.ts","sourceRoot":"","sources":["../../src/delegation/holder-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAU3D;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,WAAW,CAMb;AAED,MAAM,WAAW,yBAAyB;IACxC,uEAAuE;IACvE,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,sEAAsE;IACtE,MAAM,EAAE,cAAc,CAAC;IACvB,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,aAAa,CAAC,CAgBxB;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAEzE;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAErE;AAED,MAAM,WAAW,wBAAwB;IACvC,8DAA8D;IAC9D,KAAK,EAAE,aAAa,CAAC;IACrB,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,OAAO,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACrC,uFAAuF;IACvF,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,OAAO,oBAAoB,CAAC;IACxC,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CA4E9B"}
+{"version":3,"file":"holder-binding.d.ts","sourceRoot":"","sources":["../../src/delegation/holder-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAU3D;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,WAAW,CAMb;AAED,MAAM,WAAW,yBAAyB;IACxC,uEAAuE;IACvE,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,sEAAsE;IACtE,MAAM,EAAE,cAAc,CAAC;IACvB,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,aAAa,CAAC,CAuBxB;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAEzE;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAErE;AAED,MAAM,WAAW,wBAAwB;IACvC,8DAA8D;IAC9D,KAAK,EAAE,aAAa,CAAC;IACrB,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,OAAO,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACrC,uFAAuF;IACvF,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,OAAO,oBAAoB,CAAC;IACxC,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CA4E9B"}

package/dist/delegation/holder-binding.js

@@ -69,8 +69,15 @@ export async function generateRequestProof(input) {
     const request = toHolderBindingRequest(toolName, args);
     const nonce = base64urlEncodeFromBytes(await crypto.randomBytes(16));
     const now = Math.floor(Date.now() / 1000);
+    // `sessionId` is optional on the way in (a request proof can precede any
+    // handshake), but `meta.sessionId` is a REQUIRED non-empty string in the
+    // proof schema. Defaulting to '' therefore minted a proof that could never
+    // verify: `assertHolderBinding` rejected the LEGITIMATE holder as
+    // INVALID_PROOF_STRUCTURE, indistinguishably from a thief. Mint a per-proof
+    // id instead, so the sessionless case (the stateless MCP core) works.
+    const boundSessionId = sessionId ?? `req-${base64urlEncodeFromBytes(await crypto.randomBytes(9))}`;
     return generator.generateProof(request, undefined, {
-        sessionId: sessionId ?? '',
+        sessionId: boundSessionId,
         audience,
         nonce,
         timestamp: now,

package/dist/delegation/holder-binding.js.map

@@ -1 +1 @@
-{"version":3,"file":"holder-binding.js","sourceRoot":"","sources":["../../src/delegation/holder-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,0BAA0B,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAO9D;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAEtC;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO,GAAG,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,IAA6B;IAE7B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAiBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAgC;IAEhC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,OAAO,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE;QACjD,SAAS,EAAE,SAAS,IAAI,EAAE;QAC1B,QAAQ;QACR,KAAK;QACL,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;QACd,YAAY,EAAE,GAAG;QACjB,UAAU,EAAE,EAAE;QACd,aAAa,EAAE,WAAW;KAC3B,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAY5D;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,OAAO,0BAA0B,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC;AACzD,CAAC;AAoCD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA+B;IAE/B,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAExF,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,eAAe,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,MAAM,EACJ,yDAAyD;gBACzD,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,SAAS,oCAAoC;SAChF,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,2EAA2E;IAC3E,+EAA+E;IAC/E,IAAI,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3D,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,oBAAoB;YAC/B,MAAM,EAAE,+BAA+B;SACxC,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,gEAAgE;IAChE,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,oBAAoB;YAC/B,MAAM,EAAE,qDAAqD;SAC9D,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,yEAAyE;IACzE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACxF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,oBAAoB;gBAC/B,MAAM,EAAE,2CAA2C;gBACnD,KAAK,EAAE,mBAAmB;aAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,gFAAgF;IAChF,sEAAsE;IACtE,2EAA2E;IAC3E,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,+EAA+E;IAC/E,MAAM,UAAU,GAAG,cAAc,CAAC,eAAe,CAAe,CAAC;IACjE,UAAU,CAAC,GAAG,GAAG,GAAG,UAAU,IAAI,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;IAC/D,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE;QACtE,OAAO;QACP,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,oBAAoB;YAC/B,MAAM,EAAE,sDAAsD;YAC9D,GAAG,CAAC,YAAY,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"holder-binding.js","sourceRoot":"","sources":["../../src/delegation/holder-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,0BAA0B,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAO9D;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAEtC;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO,GAAG,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,IAA6B;IAE7B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAiBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAgC;IAEhC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,kEAAkE;IAClE,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,cAAc,GAAG,SAAS,IAAI,OAAO,wBAAwB,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnG,OAAO,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE;QACjD,SAAS,EAAE,cAAc;QACzB,QAAQ;QACR,KAAK;QACL,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;QACd,YAAY,EAAE,GAAG;QACjB,UAAU,EAAE,EAAE;QACd,aAAa,EAAE,WAAW;KAC3B,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAY5D;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,OAAO,0BAA0B,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC;AACzD,CAAC;AAoCD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA+B;IAE/B,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAExF,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,eAAe,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,MAAM,EACJ,yDAAyD;gBACzD,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,SAAS,oCAAoC;SAChF,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,2EAA2E;IAC3E,+EAA+E;IAC/E,IAAI,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3D,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,oBAAoB;YAC/B,MAAM,EAAE,+BAA+B;SACxC,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,gEAAgE;IAChE,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,oBAAoB;YAC/B,MAAM,EAAE,qDAAqD;SAC9D,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,yEAAyE;IACzE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACxF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,oBAAoB;gBAC/B,MAAM,EAAE,2CAA2C;gBACnD,KAAK,EAAE,mBAAmB;aAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,gFAAgF;IAChF,sEAAsE;IACtE,2EAA2E;IAC3E,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,+EAA+E;IAC/E,MAAM,UAAU,GAAG,cAAc,CAAC,eAAe,CAAe,CAAC;IACjE,UAAU,CAAC,GAAG,GAAG,GAAG,UAAU,IAAI,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;IAC/D,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE;QACtE,OAAO;QACP,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,oBAAoB;YAC/B,MAAM,EAAE,sDAAsD;YAC9D,GAAG,CAAC,YAAY,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}

package/dist/index.d.ts

@@ -16,8 +16,8 @@
  */
 export { KYA_OS_ERROR_CODES, createKyaOsError, type KyaOsErrorCode, type KyaOsErrorResponse, } from './errors.js';
 export { base64urlEncodeFromBytes, base64urlDecodeToBytes, bytesToBase64, base64ToBytes, } from './utils/base64.js';
-export type { DelegationConstraints, DelegationRecord, DelegationCredential, DelegationStatus, CredentialStatus, StatusList2021Credential, Proof, HandshakeRequest, SessionContext, NonceCache, MCPClientInfo, MCPClientSessionInfo, SessionIdentityState, DetachedProof, ProofMeta, CanonicalHashes, AuditRecord, AuditContext, AuditEventContext, NeedsAuthorizationError, NeedsApprovalError, AuthorizationDisplay, CrispBudget, CrispScope, } from './types/protocol.js';
-export { wrapDelegationAsVC, extractDelegationFromVC, isDelegationCredentialExpired, isDelegationCredentialNotYetValid, validateDelegationCredential, validateDetachedProof, createNeedsAuthorizationError, isNeedsAuthorizationError, createNeedsApprovalError, isNeedsApprovalError, DELEGATION_CREDENTIAL_CONTEXT, DEFAULT_SESSION_TTL_MINUTES, DEFAULT_TIMESTAMP_SKEW_SECONDS, NONCE_LENGTH_BYTES, AUTH_NONCE_TTL_MS, ANON_NONCE_TTL_MS, type MetaPolicy, } from './types/protocol.js';
+export type { DelegationConstraints, DelegationRecord, DelegationCredential, DelegationStatus, CredentialStatus, StatusList2021Credential, Proof, HandshakeRequest, SessionContext, NonceCache, MCPClientInfo, MCPClientSessionInfo, SessionIdentityState, DetachedProof, ProofMeta, ResponseProofProfile, CanonicalHashes, AuditRecord, AuditContext, AuditEventContext, NeedsAuthorizationError, NeedsApprovalError, AuthorizationDisplay, CrispBudget, CrispScope, } from './types/protocol.js';
+export { wrapDelegationAsVC, extractDelegationFromVC, isDelegationCredentialExpired, isDelegationCredentialNotYetValid, validateDelegationCredential, validateDetachedProof, createNeedsAuthorizationError, isNeedsAuthorizationError, createNeedsApprovalError, isNeedsApprovalError, DELEGATION_CREDENTIAL_CONTEXT, DEFAULT_SESSION_TTL_MINUTES, DEFAULT_TIMESTAMP_SKEW_SECONDS, NONCE_LENGTH_BYTES, AUTH_NONCE_TTL_MS, ANON_NONCE_TTL_MS, RESPONSE_PROOF_PROFILE_BODY, RESPONSE_PROOF_PROFILE_ENVELOPE, type MetaPolicy, } from './types/protocol.js';
 export { DelegationCredentialIssuer, createDelegationIssuer, type IssueDelegationOptions, type VCSigningFunction, type IdentityProvider as DelegationIdentityProvider, } from './delegation/vc-issuer.js';
 export { DelegationCredentialVerifier, createDelegationVerifier, type DelegationVCVerificationResult, type StatusOutcome, type VerifyDelegationVCOptions, type DIDResolver, type DIDDocument, type VerificationMethod, type StatusListResolver, type SignatureVerificationFunction, } from './delegation/vc-verifier.js';
 export { DelegationGraphManager, createDelegationGraph, type DelegationNode, type DelegationGraphStorageProvider, } from './delegation/delegation-graph.js';
@@ -38,7 +38,7 @@ export { buildDidResolverRegistry, type DIDResolverFactory, type DIDResolverRegi
 export { base58Encode, base58Decode, isValidBase58, } from './utils/base58.js';
 export { isValidDid, getDidMethod, normalizeDid, compareDids, getServerDid, extractAgentId, extractAgentSlug, generateDidKeyFromBytes, generateDidKeyFromBase64, didKeyFragment, } from './utils/did-helpers.js';
 export { verifyOrHints, hasSensitiveScopes, MemoryResumeTokenStore, type AuthHandshakeConfig, type VerifyOrHintsResult, type AgentReputation, type ResumeTokenStore, type UnknownAgentPolicy, type DelegationVerifier, type VerifyDelegationResult, } from './auth/index.js';
-export { ProofGenerator, createProofResponse, extractCanonicalData, KYA_OS_PROOF_META_KEY, LEGACY_NAMESPACED_PROOF_META_KEY, LEGACY_PROOF_META_KEY, type ProofAgentIdentity, type ToolRequest, type ToolResponse, type ProofOptions, } from './proof/index.js';
+export { ProofGenerator, createProofResponse, extractCanonicalData, computeCanonicalHashes, buildProofJwsPayload, KYA_OS_PROOF_META_KEY, LEGACY_NAMESPACED_PROOF_META_KEY, LEGACY_PROOF_META_KEY, type ProofAgentIdentity, type ToolRequest, type ToolResponse, type ProofOptions, } from './proof/index.js';
 export { ProofVerifier, validateMetaStructure, extractProofFromMeta, isReservedMcpMetaKey, DEFAULT_CLOCK_SKEW_SECONDS, MIN_CLOCK_SKEW_SECONDS, MAX_CLOCK_SKEW_SECONDS, type ProofVerifierConfig, type ProofVerificationResult, } from './proof/verifier.js';
 export { ProofVerificationError, PROOF_VERIFICATION_ERROR_CODES, createProofVerificationError, type ProofVerificationErrorCode, } from './proof/errors.js';
 export { SessionManager, createHandshakeRequest, validateHandshakeFormat, SessionStore, MemorySessionStore, type SessionConfig, type HandshakeResult, type MemorySessionStoreOptions, } from './session/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAC;AAG3B,YAAY,EACV,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,EACL,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,SAAS,EACT,eAAe,EACf,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,UAAU,GACX,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,UAAU,GAChB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,IAAI,0BAA0B,GACpD,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,KAAK,8BAA8B,EACnC,KAAK,aAAa,EAClB,KAAK,yBAAyB,EAC9B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,GACnC,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,cAAc,EACnB,KAAK,8BAA8B,GACpC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,GAChC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,EAChC,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,0BAA0B,GAChC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,GAC/B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAE5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAE5F,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,GAC7B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,uCAAuC,CAAC;AAG/C,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,gCAAgC,EAChC,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,EAC5B,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,yBAAyB,GAC/B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAGlC,cAAc,kBAAkB,CAAC;AAIjC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,KAAK,KAAK,EACV,KAAK,uBAAuB,GAC7B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,KAAK,WAAW,EAChB,KAAK,6BAA6B,GACnC,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EACL,qBAAqB,EACrB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,SAAS,EACT,gBAAgB,EAChB,KAAK,gBAAgB,GACtB,MAAM,uBAAuB,CAAC;AAG/B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,iBAAiB,GACvB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,MAAM,EACN,0BAA0B,EAC1B,KAAK,MAAM,EACX,KAAK,KAAK,GACX,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,uCAAuC,EACvC,6BAA6B,EAC7B,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,gBAAgB,EAChB,8BAA8B,EAC9B,uBAAuB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAC;AAG3B,YAAY,EACV,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,EACL,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,SAAS,EACT,oBAAoB,EACpB,eAAe,EACf,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,UAAU,GACX,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,+BAA+B,EAC/B,KAAK,UAAU,GAChB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,IAAI,0BAA0B,GACpD,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,KAAK,8BAA8B,EACnC,KAAK,aAAa,EAClB,KAAK,yBAAyB,EAC9B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,GACnC,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,cAAc,EACnB,KAAK,8BAA8B,GACpC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,GAChC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,EAChC,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,0BAA0B,GAChC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,GAC/B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAE5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAE5F,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,GAC7B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,uCAAuC,CAAC;AAG/C,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,gCAAgC,EAChC,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,EAC5B,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,yBAAyB,GAC/B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAGlC,cAAc,kBAAkB,CAAC;AAIjC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,KAAK,KAAK,EACV,KAAK,uBAAuB,GAC7B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,KAAK,WAAW,EAChB,KAAK,6BAA6B,GACnC,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EACL,qBAAqB,EACrB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,SAAS,EACT,gBAAgB,EAChB,KAAK,gBAAgB,GACtB,MAAM,uBAAuB,CAAC;AAG/B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,iBAAiB,GACvB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,MAAM,EACN,0BAA0B,EAC1B,KAAK,MAAM,EACX,KAAK,KAAK,GACX,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,uCAAuC,EACvC,6BAA6B,EAC7B,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,gBAAgB,EAChB,8BAA8B,EAC9B,uBAAuB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -18,7 +18,7 @@
 export { KYA_OS_ERROR_CODES, createKyaOsError, } from './errors.js';
 // Encoding utilities (RFC 4648 base64url + standard base64, byte variants)
 export { base64urlEncodeFromBytes, base64urlDecodeToBytes, bytesToBase64, base64ToBytes, } from './utils/base64.js';
-export { wrapDelegationAsVC, extractDelegationFromVC, isDelegationCredentialExpired, isDelegationCredentialNotYetValid, validateDelegationCredential, validateDetachedProof, createNeedsAuthorizationError, isNeedsAuthorizationError, createNeedsApprovalError, isNeedsApprovalError, DELEGATION_CREDENTIAL_CONTEXT, DEFAULT_SESSION_TTL_MINUTES, DEFAULT_TIMESTAMP_SKEW_SECONDS, NONCE_LENGTH_BYTES, AUTH_NONCE_TTL_MS, ANON_NONCE_TTL_MS, } from './types/protocol.js';
+export { wrapDelegationAsVC, extractDelegationFromVC, isDelegationCredentialExpired, isDelegationCredentialNotYetValid, validateDelegationCredential, validateDetachedProof, createNeedsAuthorizationError, isNeedsAuthorizationError, createNeedsApprovalError, isNeedsApprovalError, DELEGATION_CREDENTIAL_CONTEXT, DEFAULT_SESSION_TTL_MINUTES, DEFAULT_TIMESTAMP_SKEW_SECONDS, NONCE_LENGTH_BYTES, AUTH_NONCE_TTL_MS, ANON_NONCE_TTL_MS, RESPONSE_PROOF_PROFILE_BODY, RESPONSE_PROOF_PROFILE_ENVELOPE, } from './types/protocol.js';
 // Delegation module
 export { DelegationCredentialIssuer, createDelegationIssuer, } from './delegation/vc-issuer.js';
 export { DelegationCredentialVerifier, createDelegationVerifier, } from './delegation/vc-verifier.js';
@@ -43,7 +43,7 @@ export { isValidDid, getDidMethod, normalizeDid, compareDids, getServerDid, extr
 // Auth module
 export { verifyOrHints, hasSensitiveScopes, MemoryResumeTokenStore, } from './auth/index.js';
 // Proof module
-export { ProofGenerator, createProofResponse, extractCanonicalData, KYA_OS_PROOF_META_KEY, LEGACY_NAMESPACED_PROOF_META_KEY, LEGACY_PROOF_META_KEY, } from './proof/index.js';
+export { ProofGenerator, createProofResponse, extractCanonicalData, computeCanonicalHashes, buildProofJwsPayload, KYA_OS_PROOF_META_KEY, LEGACY_NAMESPACED_PROOF_META_KEY, LEGACY_PROOF_META_KEY, } from './proof/index.js';
 export { ProofVerifier, validateMetaStructure, extractProofFromMeta, isReservedMcpMetaKey, DEFAULT_CLOCK_SKEW_SECONDS, MIN_CLOCK_SKEW_SECONDS, MAX_CLOCK_SKEW_SECONDS, } from './proof/verifier.js';
 export { ProofVerificationError, PROOF_VERIFICATION_ERROR_CODES, createProofVerificationError, } from './proof/errors.js';
 // Session module

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,iBAAiB;AACjB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GAGjB,MAAM,aAAa,CAAC;AAErB,2EAA2E;AAC3E,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAC;AA8B3B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,qBAAqB,CAAC;AAE7B,oBAAoB;AACpB,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GAIvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,GASzB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GAGtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAGxB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GAIjC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,gBAAgB,EAChB,UAAU,GAGX,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GAGjB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,GAGtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,UAAU,GAGX,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,GAKrB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAE5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAE5F,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,GAEpB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,GAGjB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,wBAAwB,GAIzB,MAAM,uCAAuC,CAAC;AAE/C,QAAQ;AACR,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAEhC,cAAc;AACd,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,GAQvB,MAAM,iBAAiB,CAAC;AAEzB,eAAe;AACf,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,gCAAgC,EAChC,qBAAqB,GAKtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,GAGvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,mBAAmB,CAAC;AAE3B,iBAAiB;AACjB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,kBAAkB,GAInB,MAAM,oBAAoB,CAAC;AAE5B,YAAY;AACZ,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GAGjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAElC,8CAA8C;AAC9C,cAAc,kBAAkB,CAAC;AAEjC,8EAA8E;AAC9E,8EAA8E;AAC9E,OAAO,EACL,UAAU,EACV,gBAAgB,GAGjB,MAAM,4BAA4B,CAAC;AAEpC,iFAAiF;AACjF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,GAGvB,MAAM,oCAAoC,CAAC;AAE5C,aAAa;AACb,OAAO,EACL,qBAAqB,EAQrB,SAAS,EACT,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAE/B,0CAA0C;AAC1C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,UAAU,EACV,cAAc,GAGf,MAAM,+BAA+B,CAAC;AAEvC,UAAU;AACV,OAAO,EACL,MAAM,EACN,0BAA0B,GAG3B,MAAM,oBAAoB,CAAC;AAE5B,oBAAoB;AACpB,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAE1B,yFAAyF;AACzF,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,uCAAuC,EACvC,6BAA6B,EAC7B,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,gBAAgB,EAChB,8BAA8B,EAC9B,uBAAuB,GAUxB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,iBAAiB;AACjB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GAGjB,MAAM,aAAa,CAAC;AAErB,2EAA2E;AAC3E,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAC;AA+B3B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,+BAA+B,GAEhC,MAAM,qBAAqB,CAAC;AAE7B,oBAAoB;AACpB,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GAIvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,GASzB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GAGtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAGxB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GAIjC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,gBAAgB,EAChB,UAAU,GAGX,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GAGjB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,GAGtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,UAAU,GAGX,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,GAKrB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAE5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAE5F,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,GAEpB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,GAGjB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,wBAAwB,GAIzB,MAAM,uCAAuC,CAAC;AAE/C,QAAQ;AACR,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAEhC,cAAc;AACd,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,GAQvB,MAAM,iBAAiB,CAAC;AAEzB,eAAe;AACf,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,gCAAgC,EAChC,qBAAqB,GAKtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,GAGvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,mBAAmB,CAAC;AAE3B,iBAAiB;AACjB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,kBAAkB,GAInB,MAAM,oBAAoB,CAAC;AAE5B,YAAY;AACZ,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GAGjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAElC,8CAA8C;AAC9C,cAAc,kBAAkB,CAAC;AAEjC,8EAA8E;AAC9E,8EAA8E;AAC9E,OAAO,EACL,UAAU,EACV,gBAAgB,GAGjB,MAAM,4BAA4B,CAAC;AAEpC,iFAAiF;AACjF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,GAGvB,MAAM,oCAAoC,CAAC;AAE5C,aAAa;AACb,OAAO,EACL,qBAAqB,EAQrB,SAAS,EACT,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAE/B,0CAA0C;AAC1C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,UAAU,EACV,cAAc,GAGf,MAAM,+BAA+B,CAAC;AAEvC,UAAU;AACV,OAAO,EACL,MAAM,EACN,0BAA0B,GAG3B,MAAM,oBAAoB,CAAC;AAE5B,oBAAoB;AACpB,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAE1B,yFAAyF;AACzF,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,uCAAuC,EACvC,6BAA6B,EAC7B,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,gBAAgB,EAChB,8BAA8B,EAC9B,uBAAuB,GAUxB,MAAM,sBAAsB,CAAC"}

package/dist/middleware/with-kya-os.config-types.d.ts

@@ -22,7 +22,7 @@ import type { SessionConfig } from "../session/manager.js";
 import type { DIDResolver, StatusListResolver } from "../delegation/vc-verifier.js";
 import type { DIDResolverRegistry } from "../delegation/did-resolver-registry.js";
 import type { RevocationChecker } from "../delegation/chain-enforcement.js";
-import type { DelegationCredential } from "../types/protocol.js";
+import type { DelegationCredential, ResponseProofProfile } from "../types/protocol.js";
 export interface KyaOsIdentityConfig {
     did: string;
     kid: string;
@@ -150,6 +150,27 @@ export interface KyaOsConfig {
      * dropped at 2.0.
      */
     emitLegacyProofKey?: boolean;
+    /**
+     * Response-proof profile every proof this server mints is bound under
+     * (SPEC §7.3).
+     *
+     * - `"org.kya-os/response-proof.body"` (default): `responseHash` covers the
+     *   response BODY only (the MCP `content` array). Wire-identical to earlier
+     *   releases — any existing verifier keeps working.
+     * - `"org.kya-os/response-proof.envelope"`: `responseHash` covers the ENTIRE result
+     *   object with the top-level `_meta` member removed, so `structuredContent`,
+     *   `isError`, and `resultType` are authenticated. Each proof carries a
+     *   signature-covered `prf` claim naming the profile, so verification cannot
+     *   silently fall back to body-only semantics.
+     *
+     * Opting into the envelope profile requires clients whose verifiers
+     * understand `prf` (this package's verifier accepts both profiles, keyed off
+     * each proof's own claim); an older verifier rejects envelope-profile proofs
+     * outright rather than mis-verifying them. The default stays body-only so
+     * existing verifiers keep working; opt in once your client population
+     * verifies the envelope profile.
+     */
+    responseProofProfile?: ResponseProofProfile;
     /** Delegation verification overrides */
     delegation?: KyaOsDelegationConfig;
     /**

package/dist/middleware/with-kya-os.config-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.config-types.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.config-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAEtF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACpC,oFAAoF;IACpF,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,sFAAsF;IACtF,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AACD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,cAAc,kDAAmD,CAAC;AAC/E,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CACvB,cAAc,EAAE,oBAAoB,KACjC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACrC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE;QAClB,kFAAkF;QAClF,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,sEAAsE;QACtE,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,WAAW;IAC1B,0CAA0C;IAC1C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,sCAAsC;IACtC,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC5C;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC;;;;;;;;;;;;;;;OAeG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,wCAAwC;IACxC,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,eAAe,GAAG,KAAK,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B"}
+{"version":3,"file":"with-kya-os.config-types.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.config-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAEtF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACpC,oFAAoF;IACpF,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACrC,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,sFAAsF;IACtF,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AACD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEvF,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,cAAc,kDAAmD,CAAC;AAC/E,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CACvB,cAAc,EAAE,oBAAoB,KACjC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACrC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE;QAClB,kFAAkF;QAClF,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,sEAAsE;QACtE,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,WAAW;IAC1B,0CAA0C;IAC1C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,sCAAsC;IACtC,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC5C;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC;;;;;;;;;;;;;;;OAeG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,wCAAwC;IACxC,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,eAAe,GAAG,KAAK,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B"}

package/dist/middleware/with-kya-os.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAe3D,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAC;AAUhC,cAAc,wBAAwB,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,WAAW,EACnB,cAAc,EAAE,cAAc,GAC7B,eAAe,CA+HjB"}
+{"version":3,"file":"with-kya-os.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAgB3D,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAC;AAUhC,cAAc,wBAAwB,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,WAAW,EACnB,cAAc,EAAE,cAAc,GAC7B,eAAe,CAsIjB"}

package/dist/middleware/with-kya-os.deps.d.ts

@@ -11,6 +11,7 @@ import type { GrantStore } from "../providers/grant-store.js";
 import type { SessionManager } from "../session/manager.js";
 import type { ProofGenerator, ProofAgentIdentity } from "../proof/generator.js";
 import type { ProofVerifier } from "../proof/verifier.js";
+import type { ResponseProofProfile } from "../types/protocol.js";
 import type { McpAuditEventAdapter } from "../audit/adapters/mcp.js";
 import type { KyaOsConfig, KyaOsDelegationConfig, KyaOsToolHandler } from "./with-kya-os.types.js";
 /**
@@ -38,5 +39,11 @@ export interface MiddlewareDeps {
     holderBindingVerifier: ProofVerifier | undefined;
     /** Mirror the proof under the legacy bare `_meta.proof` key (pre-1.1 back-compat). */
     emitLegacyProofKey: boolean;
+    /**
+     * Response-proof profile every minted proof is bound under (resolved from
+     * `config.responseProofProfile`, default body-only). The envelope profile binds the full result
+     * envelope minus `_meta`; the body profile binds the content array only.
+     */
+    responseProofProfile: ResponseProofProfile;
 }
 //# sourceMappingURL=with-kya-os.deps.d.ts.map

package/dist/middleware/with-kya-os.deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.deps.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.deps.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EACV,WAAW,EACX,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,wBAAwB,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAC/B,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,EAC/C,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,QAAQ,GAAG,kBAAkB,GAAG,qBAAqB,EAC/D,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,YAAY,CAAC,EAAE,OAAO,KACnB,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;AAEpD,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,sDAAsD;IACtD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,yEAAyE;IACzE,MAAM,EAAE,WAAW,CAAC;IACpB,cAAc,EAAE,cAAc,CAAC;IAC/B,cAAc,EAAE,cAAc,CAAC;IAC/B,cAAc,EAAE,cAAc,CAAC;IAC/B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,KAAK,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACxC,UAAU,EAAE,UAAU,CAAC;IACvB,gBAAgB,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACpD,iBAAiB,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IAC9C,qFAAqF;IACrF,qBAAqB,EAAE,aAAa,GAAG,SAAS,CAAC;IACjD,sFAAsF;IACtF,kBAAkB,EAAE,OAAO,CAAC;CAC7B"}
+{"version":3,"file":"with-kya-os.deps.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.deps.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EACV,WAAW,EACX,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,wBAAwB,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAC/B,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,EAC/C,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,QAAQ,GAAG,kBAAkB,GAAG,qBAAqB,EAC/D,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,YAAY,CAAC,EAAE,OAAO,KACnB,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;AAEpD,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,sDAAsD;IACtD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,yEAAyE;IACzE,MAAM,EAAE,WAAW,CAAC;IACpB,cAAc,EAAE,cAAc,CAAC;IAC/B,cAAc,EAAE,cAAc,CAAC;IAC/B,cAAc,EAAE,cAAc,CAAC;IAC/B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,KAAK,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACxC,UAAU,EAAE,UAAU,CAAC;IACvB,gBAAgB,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACpD,iBAAiB,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IAC9C,qFAAqF;IACrF,qBAAqB,EAAE,aAAa,GAAG,SAAS,CAAC;IACjD,sFAAsF;IACtF,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,oBAAoB,EAAE,oBAAoB,CAAC;CAC5C"}