@kya-os/mcp 1.16.1 → 1.17.0

package/dist/middleware/with-kya-os-server.d.ts

@@ -10,11 +10,12 @@
  *   // All tools registered on `server` now get proofs automatically.
  *   await server.connect(transport); // transport is transparently wrapped
  */
-import type { CryptoProvider } from "../providers/base.js";
+import type { CryptoProvider, NonceCacheProvider } from "../providers/base.js";
 import type { GrantStore } from "../providers/grant-store.js";
 import type { AuditLogProvider } from "../providers/audit-log.js";
 import type { KyaOsAuditTrail } from "./with-kya-os.config-types.js";
 import type { SessionConfig } from "../session/manager.js";
+import type { ResponseProofProfile } from "../types/protocol.js";
 import { type KyaOsIdentityConfig, type KyaOsDelegationConfig, type KyaOsMiddleware } from "./with-kya-os.js";
 import { type Transport } from "./kya-os-transport.js";
 export interface WithKyaOsOptions {
@@ -24,10 +25,30 @@ export interface WithKyaOsOptions {
     identity?: KyaOsIdentityConfig;
     /**
      * Session configuration. Accepts the full {@link SessionConfig} (minus the
-     * `nonceCache`, which is set at the top level), so an optional durable
-     * `sessionStore` can be injected for cross-instance session continuity.
+     * `nonceCache`, which is set by the top-level {@link nonceCache} option), so
+     * an optional durable `sessionStore` can be injected for cross-instance
+     * session continuity.
      */
     session?: Omit<SessionConfig, "nonceCache">;
+    /**
+     * Replay-protection store shared by the session handshake and holder
+     * binding. Defaults to an in-memory store, which protects one process only;
+     * a multi-replica deployment MUST inject a shared store with an atomic
+     * `consume()`. Passed through to the middleware (see `KyaOsConfig.nonceCache`).
+     */
+    nonceCache?: NonceCacheProvider;
+    /**
+     * Refuse a `nonceCache` without an atomic `consume()` instead of warning
+     * once. Passed through to the middleware (see `KyaOsConfig.requireAtomicNonce`).
+     */
+    requireAtomicNonce?: boolean;
+    /**
+     * Response-proof profile for every proof this server mints (SPEC §7.3).
+     * Defaults to the body profile; the envelope profile also binds
+     * `structuredContent` and `isError`. Passed through to the middleware (see
+     * `KyaOsConfig.responseProofProfile`).
+     */
+    responseProofProfile?: ResponseProofProfile;
     /** Auto-create sessions for non-KYA-OS clients (default: true) */
     autoSession?: boolean;
     /** Attach proofs to all tool responses (default: true) */
@@ -98,4 +119,3 @@ interface McpServerLike {
  */
 export declare function withKyaOs(server: McpServerLike, options: WithKyaOsOptions): Promise<KyaOsMiddleware>;
 export {};
-//# sourceMappingURL=with-kya-os-server.d.ts.map

package/dist/middleware/with-kya-os-server.js

@@ -64,6 +64,13 @@ export async function withKyaOs(server, options) {
         ...(options.emitLegacyProofKey !== undefined
             ? { emitLegacyProofKey: options.emitLegacyProofKey }
             : {}),
+        ...(options.nonceCache !== undefined ? { nonceCache: options.nonceCache } : {}),
+        ...(options.requireAtomicNonce !== undefined
+            ? { requireAtomicNonce: options.requireAtomicNonce }
+            : {}),
+        ...(options.responseProofProfile !== undefined
+            ? { responseProofProfile: options.responseProofProfile }
+            : {}),
     }, options.crypto);
     if ((options.handshakeExposure ?? "tool") === "tool") {
         // Register the unified _kyaos tool for protocol operations.

package/dist/middleware/with-kya-os-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os-server.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,EACL,cAAc,EACd,qBAAqB,GAItB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAkB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA8CxB;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO;QACL,GAAG;QACH,GAAG,EAAE,GAAG,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;QACpC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAWD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAqB,EACrB,OAAyB;IAEzB,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,IAAI,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/D,MAAM,KAAK,GAAG,qBAAqB,CACjC;QACE,QAAQ;QACR,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QACxC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;YACpD,CAAC,CAAC,EAAE,CAAC;KACR,EACD,OAAO,CAAC,MAAM,CACf,CAAC;IAEF,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QACrD,4DAA4D;QAC5D,MAAM,CAAC,YAAY,CACjB,QAAQ,EACR;YACE,WAAW,EACT,iFAAiF;YACnF,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,IAAI,EAAE;YAC7D,WAAW,EAAE;gBACX,MAAM,EAAE,CAAC;qBACN,IAAI,CAAC,cAAc,CAAC;qBACpB,QAAQ,CAAC,+BAA+B,CAAC;gBAC5C,KAAK,EAAE,CAAC;qBACL,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,2CAA2C,CAAC;gBACxD,QAAQ,EAAE,CAAC;qBACR,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,+BAA+B,CAAC;gBAC5C,SAAS,EAAE,CAAC;qBACT,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,gCAAgC,CAAC;gBAC7C,QAAQ,EAAE,CAAC;qBACR,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,wCAAwC,CAAC;aACtD;SACF,EACD,KAAK,EAAE,IAAa,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CACpC,IAA+B,CAChC,CAAC;YACF,OAAO;gBACL,GAAG,MAAM;gBACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC;aACtE,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,EAAE;IACF,yEAAyE;IACzE,oEAAoE;IACpE,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEpD,MAAM,CAAC,OAAO,GAAG,CAAC,SAAoB,EAAE,EAAE,CACxC,eAAe,CAAC,oBAAoB,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"with-kya-os-server.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,EACL,cAAc,EACd,qBAAqB,GAItB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAkB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkExB;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO;QACL,GAAG;QACH,GAAG,EAAE,GAAG,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;QACpC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAWD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAqB,EACrB,OAAyB;IAEzB,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,IAAI,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/D,MAAM,KAAK,GAAG,qBAAqB,CACjC;QACE,QAAQ;QACR,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QACxC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;YACpD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;YACpD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,oBAAoB,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;KACR,EACD,OAAO,CAAC,MAAM,CACf,CAAC;IAEF,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QACrD,4DAA4D;QAC5D,MAAM,CAAC,YAAY,CACjB,QAAQ,EACR;YACE,WAAW,EACT,iFAAiF;YACnF,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,IAAI,EAAE;YAC7D,WAAW,EAAE;gBACX,MAAM,EAAE,CAAC;qBACN,IAAI,CAAC,cAAc,CAAC;qBACpB,QAAQ,CAAC,+BAA+B,CAAC;gBAC5C,KAAK,EAAE,CAAC;qBACL,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,2CAA2C,CAAC;gBACxD,QAAQ,EAAE,CAAC;qBACR,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,+BAA+B,CAAC;gBAC5C,SAAS,EAAE,CAAC;qBACT,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,gCAAgC,CAAC;gBAC7C,QAAQ,EAAE,CAAC;qBACR,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,wCAAwC,CAAC;aACtD;SACF,EACD,KAAK,EAAE,IAAa,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CACpC,IAA+B,CAChC,CAAC;YACF,OAAO;gBACL,GAAG,MAAM;gBACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC;aACtE,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,EAAE;IACF,yEAAyE;IACzE,oEAAoE;IACpE,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEpD,MAAM,CAAC,OAAO,GAAG,CAAC,SAAoB,EAAE,EAAE,CACxC,eAAe,CAAC,oBAAoB,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/middleware/with-kya-os.config-types.d.ts

@@ -74,6 +74,15 @@ export interface KyaOsDelegationConfig {
      * reference adapter. Omit to keep the prior per-credential-status behavior.
      */
     revocationChecker?: RevocationChecker;
+    /**
+     * DIDs allowed to issue root delegations, the chain's Responsible Party
+     * (SPEC §6). When set, a delegation whose root credential is signed by any
+     * other DID is rejected, both when presented and when a stored grant is
+     * reused. Compared as exact strings against the verified signer. An empty
+     * list trusts no issuer. When unset, any issuer is accepted and the
+     * middleware logs a warning at startup; set it for production.
+     */
+    trustedRootIssuers?: readonly string[];
     /**
      * Holder-of-key enforcement for inbound calls (spec §11.8). A valid delegation
      * is a *bearer* credential; holder binding additionally requires the caller to
@@ -113,11 +122,21 @@ export interface KyaOsConfig {
     /**
      * Replay-protection store, shared by the session handshake AND inbound holder
      * binding so both draw on one nonce namespace. Defaults to an in-memory store
-     * (single-process only); inject a Redis / Durable Object / KV-backed
-     * {@link NonceCacheProvider} for multi-instance deployments. Set here, not on
-     * `session`, so there is exactly one cache and the two cannot diverge.
+     * (single-process only). For multi-instance deployments inject a shared
+     * {@link NonceCacheProvider} whose `consume()` is an atomic conditional insert
+     * with expiry (Redis `SET NX PX`, a DynamoDB conditional write, a Durable
+     * Object transaction). Eventually consistent stores such as Workers KV cannot
+     * make that claim atomic on their own. Set here, not on `session`, so there is
+     * exactly one cache and the two cannot diverge.
      */
     nonceCache?: NonceCacheProvider;
+    /**
+     * Refuse a `nonceCache` without an atomic `consume()`: middleware creation
+     * throws instead of falling back to `has()` then `add()`, which lets concurrent
+     * duplicates of one signed request through. Applies to the handshake and to
+     * holder binding. Default false, with a startup warning for such a cache.
+     */
+    requireAtomicNonce?: boolean;
     /**
      * Durable store for approved authorization grants, enabling the no-paste
      * retry: an agent that already obtained a grant can call again — even on a
@@ -192,4 +211,3 @@ export interface KyaOsConfig {
      */
     auditLog?: AuditLogProvider;
 }
-//# sourceMappingURL=with-kya-os.config-types.d.ts.map

package/dist/middleware/with-kya-os.d.ts

@@ -43,4 +43,3 @@ export * from "./with-kya-os.types.js";
  * durable `SessionStore` via `config.session.sessionStore`.
  */
 export declare function createKyaOsMiddleware(config: KyaOsConfig, cryptoProvider: CryptoProvider): KyaOsMiddleware;
-//# sourceMappingURL=with-kya-os.d.ts.map

package/dist/middleware/with-kya-os.delegation-gate.d.ts

@@ -9,11 +9,12 @@
 import type { KyaOsDelegationGate } from "./with-kya-os.types.js";
 import type { MiddlewareDeps, AttachOutcomeProof } from "./with-kya-os.deps.js";
 import type { GrantResolution } from "./with-kya-os.grants.js";
+import { type DelegationVerification } from "./with-kya-os.delegation-verify.js";
 /** Collaborators the delegation gate borrows from its sibling sub-factories. */
 export interface DelegationGateWiring {
+    delegationVerification: DelegationVerification;
     attachOutcomeProof: AttachOutcomeProof;
     resolveExistingGrant: GrantResolution["resolveExistingGrant"];
     bindGrantOnSuccess: GrantResolution["bindGrantOnSuccess"];
 }
 export declare function createDelegationGate(deps: MiddlewareDeps, wiring: DelegationGateWiring): Pick<KyaOsDelegationGate, "wrapWithDelegation">;
-//# sourceMappingURL=with-kya-os.delegation-gate.d.ts.map

package/dist/middleware/with-kya-os.delegation-gate.js

@@ -8,11 +8,11 @@
  */
 import { isHolderBindingApplicable, isKyaOsControlArg, assertHolderBinding, toHolderBindingRequest, } from "../delegation/holder-binding.js";
 import { scopeSatisfies } from "../delegation/scope-matcher.js";
+import { getDelegationScopes } from "../delegation/chain-enforcement.js";
 import { logger } from "../logging/index.js";
 import { KYA_OS_ERROR_CODES } from "../errors.js";
 import { sanitizeForMessage } from "./with-kya-os.helpers.js";
 import { canonicalizeJsonBytes } from "../utils/canonical-json.js";
-import { createDelegationVerification, } from "./with-kya-os.delegation-verify.js";
 const MAX_AUDIT_REFERENCE_LENGTH = 256;
 /** Extract only a bounded string from an untrusted credential-shaped value. */
 function rejectedDelegationRef(value) {
@@ -40,21 +40,31 @@ function rejectedDelegationRef(value) {
         return 'unknown';
     }
 }
+/**
+ * Approval grants for a composed policy gate. They ride the reserved
+ * `_kyaos_approvals` argument, which is withheld from the handler like every
+ * control argument, so they travel on in the call context instead.
+ */
+function forwardedApprovals(args) {
+    const approvals = args["_kyaos_approvals"];
+    return approvals === undefined ? {} : { approvals };
+}
 export function createDelegationGate(deps, wiring) {
     const { identity, holderBindingMode, holderBindingVerifier, audit, cryptoProvider } = deps;
     const { attachOutcomeProof, resolveExistingGrant, bindGrantOnSuccess } = wiring;
-    const { verifyDelegation, buildDelegationErrorResponse, buildNeedsAuthorizationChallenge, } = createDelegationVerification(deps);
+    const { verifyDelegation, buildDelegationErrorResponse, buildNeedsAuthorizationChallenge, } = wiring.delegationVerification;
     function wrapWithDelegation(toolName, config, handler) {
         return async (args, sessionId) => {
             const delegationArg = args["_kyaos_delegation"];
             if (delegationArg === undefined || delegationArg === null) {
                 // No delegation pasted — a durable grant may already authorize this call
                 // (the no-paste retry), even on a fresh instance with empty memory.
-                // Holder-of-key first (agent-anchored, proof-gated), then the session
-                // bearer capability. On a hit, skip the challenge and run the handler
+                // Holder-of-key first, then policy-permitted session reuse. The resolver
+                // revalidates signed evidence on both paths. On a hit, run the handler
                 // with exactly the call shape a verified delegation would have produced.
-                const existingGrant = await resolveExistingGrant(toolName, args, sessionId, config.scopeId);
-                if (existingGrant) {
+                const resolvedGrant = await resolveExistingGrant(toolName, args, sessionId, config.scopeId);
+                if (resolvedGrant) {
+                    const existingGrant = resolvedGrant.grant;
                     const grantArgs = {};
                     for (const [k, v] of Object.entries(args)) {
                         if (!isKyaOsControlArg(k))
@@ -80,7 +90,17 @@ export function createDelegationGate(deps, wiring) {
                         grantRef: existingGrant.id,
                         context: grantContext,
                     });
-                    return handler(grantArgs, sessionId, grantContext);
+                    return handler(grantArgs, sessionId, {
+                        ...grantContext,
+                        principal: {
+                            agentDid: existingGrant.agentDid,
+                            ...(existingGrant.userDid !== undefined
+                                ? { responsibleParty: existingGrant.userDid }
+                                : {}),
+                            delegatedScopes: resolvedGrant.delegatedScopes,
+                        },
+                        ...forwardedApprovals(args),
+                    });
                 }
                 // No delegation provided — sign & return the needs_authorization
                 // challenge. The proof binds a responseHash over the EMITTED challenge
@@ -218,9 +238,17 @@ export function createDelegationGate(deps, wiring) {
             }
             // Mint a durable grant from this verified delegation so the next call —
             // on any instance — resolves via resolveExistingGrant with no re-paste.
-            await bindGrantOnSuccess(vc, delegationArg, isJwt, sessionId, config.scopeId);
+            await bindGrantOnSuccess(vc, delegationArg, isJwt, sessionId, config.scopeId, check.expiresAt);
             logger.debug(`[kya-os] Delegation verified for "${toolName}", scope "${config.scopeId}"`);
-            return handler(cleanArgs, sessionId, callContext);
+            return handler(cleanArgs, sessionId, {
+                ...callContext,
+                principal: {
+                    agentDid: vc.credentialSubject.id,
+                    ...(controller !== undefined ? { responsibleParty: controller } : {}),
+                    delegatedScopes: getDelegationScopes(vc),
+                },
+                ...forwardedApprovals(args),
+            });
         };
     }
     return { wrapWithDelegation };

package/dist/middleware/with-kya-os.delegation-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.delegation-gate.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,4BAA4B,GAE7B,MAAM,oCAAoC,CAAC;AAE5C,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC,+EAA+E;AAC/E,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAClE,MAAM,UAAU,GAAG,KAAgC,CAAC;QACpD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC;QAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACtE,MAAM,UAAU,GAAI,OAAmC,CAAC,UAAU,CAAC;QACnE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5E,MAAM,MAAM,GAAI,UAAsC,CAAC,EAAE,CAAC;QAC1D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YACpD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AASD,MAAM,UAAU,oBAAoB,CAClC,IAAoB,EACpB,MAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAC3F,MAAM,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GACpE,MAAM,CAAC;IACT,MAAM,EACJ,gBAAgB,EAChB,4BAA4B,EAC5B,gCAAgC,GACjC,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAEvC,SAAS,kBAAkB,CACzB,QAAgB,EAChB,MAA4B,EAC5B,OAAyB;QAEzB,OAAO,KAAK,EAAE,IAA6B,EAAE,SAAkB,EAAE,EAAE;YACjE,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAEhD,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC1D,yEAAyE;gBACzE,oEAAoE;gBACpE,sEAAsE;gBACtE,sEAAsE;gBACtE,yEAAyE;gBACzE,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAC9C,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CAAC,OAAO,CACf,CAAC;gBACF,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,SAAS,GAA4B,EAAE,CAAC;oBAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;4BAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBAC9C,CAAC;oBACD,MAAM,CAAC,KAAK,CACV,gCAAgC,QAAQ,aAAa,MAAM,CAAC,OAAO,2BAA2B,CAC/F,CAAC;oBACF,MAAM,YAAY,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,KAAK,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE;wBACrE,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;4BAC3C,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,EAAE;4BACrF,CAAC,CAAC,EAAE,CAAC;wBACP,aAAa,EAAE;4BACb,MAAM,EAAE,OAAgB;4BACxB,QAAQ,EAAE,SAAkB;4BAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;4BACvB,QAAQ,EAAE,aAAa,CAAC,EAAE;4BAC1B,gBAAgB,EAAE,wBAAwB;yBAC3C;qBACF,CAAC;oBACF,MAAM,KAAK,EAAE,aAAa,CAAC,YAAY,EAAE;wBACvC,OAAO,EAAE,WAAW;wBACpB,QAAQ,EAAE,aAAa,CAAC,EAAE;wBAC1B,OAAO,EAAE,YAAY;qBACtB,CAAC,CAAC;oBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;gBACrD,CAAC;gBAED,iEAAiE;gBACjE,uEAAuE;gBACvE,yEAAyE;gBACzE,uEAAuE;gBACvE,sEAAsE;gBACtE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,GACjC,MAAM,gCAAgC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC3D,OAAO,kBAAkB,CACvB,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,OAAO,EACP,qBAAqB,EACrB,SAAS,EACT,gBAAgB,CACjB,CAAC;YACJ,CAAC;YAED,yEAAyE;YACzE,2EAA2E;YAC3E,gEAAgE;YAChE,qEAAqE;YACrE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,aAAa,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE;wBAClC,aAAa,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC9C,OAAO,EAAE,QAAQ;wBACjB,UAAU,EAAE,gCAAgC;qBAC7C,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE;wBACxE,IAAI,EAAE,QAAQ;wBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,CAAC,IAAI,CACT,gDAAgD,QAAQ,MAAM,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CACjG,CAAC;gBACF,OAAO,kBAAkB,CACvB,4BAA4B,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,EACjF,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,KAAK,CAAC,MAAM,CACb,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;YAE5B,oEAAoE;YACpE,0EAA0E;YAC1E,2EAA2E;YAC3E,4EAA4E;YAC5E,4EAA4E;YAC5E,IAAI,iBAAiB,KAAK,KAAK,IAAI,qBAAqB,EAAE,CAAC;gBACzD,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBAC5C,IAAI,UAAU,IAAI,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;oBACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;oBACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAC3B,MAAM,MAAM,GACV,4EAA4E,CAAC;wBAC/E,MAAM,CAAC,IAAI,CACT,6BAA6B,QAAQ,+BAA+B,CACrE,CAAC;wBACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;4BACpC,OAAO,kBAAkB,CACvB,4BAA4B,CAC1B,kBAAkB,CAAC,qBAAqB,EACxC,MAAM,CACP,EACD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;wBACJ,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,IAAI,WAAW,GAAY,QAAQ,CAAC;wBACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;4BACjC,IAAI,CAAC;gCACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;4BACrC,CAAC;4BAAC,MAAM,CAAC;gCACP,WAAW,GAAG,EAAE,CAAC;4BACnB,CAAC;wBACH,CAAC;wBACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;4BACxC,KAAK,EAAE,WAA4B;4BACnC,UAAU;4BACV,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC;4BAC/C,gBAAgB,EAAE,QAAQ,CAAC,GAAG;4BAC9B,aAAa,EAAE,qBAAqB;yBACrC,CAAC,CAAC;wBACH,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;4BAC/B,MAAM,MAAM,GACV,OAAO,CAAC,MAAM;gCACd,yDAAyD,CAAC;4BAC5D,MAAM,CAAC,IAAI,CACT,2BAA2B,OAAO,CAAC,MAAM,SAAS,QAAQ,MAAM,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC7F,CAAC;4BACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gCACpC,OAAO,kBAAkB,CACvB,4BAA4B,CAC1B,kBAAkB,CAAC,qBAAqB,EACxC,MAAM,CACP,EACD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;4BACJ,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,UAAU,EAAE,CAAC;oBACtB,iEAAiE;oBACjE,2DAA2D;oBAC3D,MAAM,CAAC,IAAI,CACT,qCAAqC,UAAU,sDAAsD,CACtG,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,uEAAuE;YACvE,0DAA0D;YAC1D,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACvD,IAAI,WAAW,CAAC,mBAAmB,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CACT,mBAAmB,MAAM,CAAC,OAAO,UAAU,QAAQ,4BAA4B;oBAC7E,uFAAuF,CAC1F,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,mBAAmB,MAAM,CAAC,OAAO,4BAA4B,CAAC;gBAC7E,MAAM,CAAC,IAAI,CACT,+CAA+C,MAAM,CAAC,OAAO,UAAU,QAAQ,GAAG,CACnF,CAAC;gBACF,OAAO,kBAAkB,CACvB,4BAA4B,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAC3E,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,KAAK;gBAChC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAuB,CAAC;gBACnD,CAAC,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC9B,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,oBAAoB,CAAW,CAAC;YACnF,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YAClE,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC;YAC9E,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,UAAU,CAAC;YAC9D,MAAM,aAAa,GAAG;gBACpB,MAAM,EAAE,YAAqB;gBAC7B,QAAQ,EAAE,SAAkB;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,aAAa;gBACb,0BAA0B,EAAE,gBAAgB;gBAC5C,gBAAgB,EAAE,wBAAwB;aAC3C,CAAC;YACF,MAAM,WAAW,GAAG;gBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK;gBACL,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC;oBAChC,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;oBAC1E,CAAC,CAAC,EAAE,CAAC;gBACP,aAAa;aACd,CAAC;YAEF,MAAM,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE;gBAClC,aAAa;gBACb,OAAO,EAAE,WAAW;gBACpB,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,QAAQ;gBACnD,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;gBACrC,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YAEH,qEAAqE;YACrE,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;oBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YAED,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,kBAAkB,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAE9E,MAAM,CAAC,KAAK,CACV,qCAAqC,QAAQ,aAAa,MAAM,CAAC,OAAO,GAAG,CAC5E,CAAC;YACF,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAChC,CAAC"}
+{"version":3,"file":"with-kya-os.delegation-gate.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAEzE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAQlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAOnE,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC,+EAA+E;AAC/E,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAClE,MAAM,UAAU,GAAG,KAAgC,CAAC;QACpD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC;QAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACtE,MAAM,UAAU,GAAI,OAAmC,CAAC,UAAU,CAAC;QACnE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5E,MAAM,MAAM,GAAI,UAAsC,CAAC,EAAE,CAAC;QAC1D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YACpD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,IAA6B;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC3C,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;AACtD,CAAC;AAUD,MAAM,UAAU,oBAAoB,CAClC,IAAoB,EACpB,MAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAC3F,MAAM,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GACpE,MAAM,CAAC;IACT,MAAM,EACJ,gBAAgB,EAChB,4BAA4B,EAC5B,gCAAgC,GACjC,GAAG,MAAM,CAAC,sBAAsB,CAAC;IAElC,SAAS,kBAAkB,CACzB,QAAgB,EAChB,MAA4B,EAC5B,OAAyB;QAEzB,OAAO,KAAK,EAAE,IAA6B,EAAE,SAAkB,EAAE,EAAE;YACjE,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAEhD,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC1D,yEAAyE;gBACzE,oEAAoE;gBACpE,yEAAyE;gBACzE,uEAAuE;gBACvE,yEAAyE;gBACzE,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAC9C,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CAAC,OAAO,CACf,CAAC;gBACF,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC;oBAC1C,MAAM,SAAS,GAA4B,EAAE,CAAC;oBAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;4BAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBAC9C,CAAC;oBACD,MAAM,CAAC,KAAK,CACV,gCAAgC,QAAQ,aAAa,MAAM,CAAC,OAAO,2BAA2B,CAC/F,CAAC;oBACF,MAAM,YAAY,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,KAAK,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE;wBACrE,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;4BAC3C,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,EAAE;4BACrF,CAAC,CAAC,EAAE,CAAC;wBACP,aAAa,EAAE;4BACb,MAAM,EAAE,OAAgB;4BACxB,QAAQ,EAAE,SAAkB;4BAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;4BACvB,QAAQ,EAAE,aAAa,CAAC,EAAE;4BAC1B,gBAAgB,EAAE,wBAAwB;yBAC3C;qBACF,CAAC;oBACF,MAAM,KAAK,EAAE,aAAa,CAAC,YAAY,EAAE;wBACvC,OAAO,EAAE,WAAW;wBACpB,QAAQ,EAAE,aAAa,CAAC,EAAE;wBAC1B,OAAO,EAAE,YAAY;qBACtB,CAAC,CAAC;oBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE;wBACnC,GAAG,YAAY;wBACf,SAAS,EAAE;4BACT,QAAQ,EAAE,aAAa,CAAC,QAAQ;4BAChC,GAAG,CAAC,aAAa,CAAC,OAAO,KAAK,SAAS;gCACrC,CAAC,CAAC,EAAE,gBAAgB,EAAE,aAAa,CAAC,OAAO,EAAE;gCAC7C,CAAC,CAAC,EAAE,CAAC;4BACP,eAAe,EAAE,aAAa,CAAC,eAAe;yBAC/C;wBACD,GAAG,kBAAkB,CAAC,IAAI,CAAC;qBAC5B,CAAC,CAAC;gBACL,CAAC;gBAED,iEAAiE;gBACjE,uEAAuE;gBACvE,yEAAyE;gBACzE,uEAAuE;gBACvE,sEAAsE;gBACtE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,GACjC,MAAM,gCAAgC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC3D,OAAO,kBAAkB,CACvB,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,OAAO,EACP,qBAAqB,EACrB,SAAS,EACT,gBAAgB,CACjB,CAAC;YACJ,CAAC;YAED,yEAAyE;YACzE,2EAA2E;YAC3E,gEAAgE;YAChE,qEAAqE;YACrE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,aAAa,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE;wBAClC,aAAa,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC9C,OAAO,EAAE,QAAQ;wBACjB,UAAU,EAAE,gCAAgC;qBAC7C,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE;wBACxE,IAAI,EAAE,QAAQ;wBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,CAAC,IAAI,CACT,gDAAgD,QAAQ,MAAM,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CACjG,CAAC;gBACF,OAAO,kBAAkB,CACvB,4BAA4B,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,EACjF,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,KAAK,CAAC,MAAM,CACb,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;YAE5B,oEAAoE;YACpE,0EAA0E;YAC1E,2EAA2E;YAC3E,4EAA4E;YAC5E,4EAA4E;YAC5E,IAAI,iBAAiB,KAAK,KAAK,IAAI,qBAAqB,EAAE,CAAC;gBACzD,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBAC5C,IAAI,UAAU,IAAI,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;oBACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;oBACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAC3B,MAAM,MAAM,GACV,4EAA4E,CAAC;wBAC/E,MAAM,CAAC,IAAI,CACT,6BAA6B,QAAQ,+BAA+B,CACrE,CAAC;wBACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;4BACpC,OAAO,kBAAkB,CACvB,4BAA4B,CAC1B,kBAAkB,CAAC,qBAAqB,EACxC,MAAM,CACP,EACD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;wBACJ,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,IAAI,WAAW,GAAY,QAAQ,CAAC;wBACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;4BACjC,IAAI,CAAC;gCACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;4BACrC,CAAC;4BAAC,MAAM,CAAC;gCACP,WAAW,GAAG,EAAE,CAAC;4BACnB,CAAC;wBACH,CAAC;wBACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;4BACxC,KAAK,EAAE,WAA4B;4BACnC,UAAU;4BACV,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC;4BAC/C,gBAAgB,EAAE,QAAQ,CAAC,GAAG;4BAC9B,aAAa,EAAE,qBAAqB;yBACrC,CAAC,CAAC;wBACH,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;4BAC/B,MAAM,MAAM,GACV,OAAO,CAAC,MAAM;gCACd,yDAAyD,CAAC;4BAC5D,MAAM,CAAC,IAAI,CACT,2BAA2B,OAAO,CAAC,MAAM,SAAS,QAAQ,MAAM,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC7F,CAAC;4BACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gCACpC,OAAO,kBAAkB,CACvB,4BAA4B,CAC1B,kBAAkB,CAAC,qBAAqB,EACxC,MAAM,CACP,EACD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;4BACJ,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,UAAU,EAAE,CAAC;oBACtB,iEAAiE;oBACjE,2DAA2D;oBAC3D,MAAM,CAAC,IAAI,CACT,qCAAqC,UAAU,sDAAsD,CACtG,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,uEAAuE;YACvE,0DAA0D;YAC1D,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACvD,IAAI,WAAW,CAAC,mBAAmB,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CACT,mBAAmB,MAAM,CAAC,OAAO,UAAU,QAAQ,4BAA4B;oBAC7E,uFAAuF,CAC1F,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,mBAAmB,MAAM,CAAC,OAAO,4BAA4B,CAAC;gBAC7E,MAAM,CAAC,IAAI,CACT,+CAA+C,MAAM,CAAC,OAAO,UAAU,QAAQ,GAAG,CACnF,CAAC;gBACF,OAAO,kBAAkB,CACvB,4BAA4B,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAC3E,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,KAAK;gBAChC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAuB,CAAC;gBACnD,CAAC,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC9B,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,oBAAoB,CAAW,CAAC;YACnF,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YAClE,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC;YAC9E,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,UAAU,CAAC;YAC9D,MAAM,aAAa,GAAG;gBACpB,MAAM,EAAE,YAAqB;gBAC7B,QAAQ,EAAE,SAAkB;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,aAAa;gBACb,0BAA0B,EAAE,gBAAgB;gBAC5C,gBAAgB,EAAE,wBAAwB;aAC3C,CAAC;YACF,MAAM,WAAW,GAAG;gBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK;gBACL,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC;oBAChC,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;oBAC1E,CAAC,CAAC,EAAE,CAAC;gBACP,aAAa;aACd,CAAC;YAEF,MAAM,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE;gBAClC,aAAa;gBACb,OAAO,EAAE,WAAW;gBACpB,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,QAAQ;gBACnD,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;gBACrC,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YAEH,qEAAqE;YACrE,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;oBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YAED,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,kBAAkB,CACtB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CACrE,CAAC;YAEF,MAAM,CAAC,KAAK,CACV,qCAAqC,QAAQ,aAAa,MAAM,CAAC,OAAO,GAAG,CAC5E,CAAC;YACF,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE;gBACnC,GAAG,WAAW;gBACd,SAAS,EAAE;oBACT,QAAQ,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE;oBACjC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrE,eAAe,EAAE,mBAAmB,CAAC,EAAE,CAAC;iBACzC;gBACD,GAAG,kBAAkB,CAAC,IAAI,CAAC;aAC5B,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAChC,CAAC"}

package/dist/middleware/with-kya-os.delegation-verify.d.ts

@@ -27,6 +27,7 @@ export type DelegationCheck = {
     valid: true;
     vc: DelegationCredential;
     isJwt: boolean;
+    expiresAt?: number;
 } | {
     valid: false;
     reason: string;
@@ -61,4 +62,3 @@ export interface DelegationVerification {
     }>;
 }
 export declare function createDelegationVerification(deps: MiddlewareDeps): DelegationVerification;
-//# sourceMappingURL=with-kya-os.delegation-verify.d.ts.map

package/dist/middleware/with-kya-os.delegation-verify.js

@@ -11,12 +11,13 @@ import { createDidWebResolver } from "../delegation/did-web-resolver.js";
 import { buildDidResolverRegistry, } from "../delegation/did-resolver-registry.js";
 import { getDidMethod } from "../utils/did-helpers.js";
 import { DelegationCredentialVerifier, } from "../delegation/vc-verifier.js";
-import { validateDelegationChain as validateDelegationChainCore } from "../delegation/chain-enforcement.js";
+import { validateDelegationChain as validateDelegationChainCore, } from "../delegation/chain-enforcement.js";
 import { RuntimeFetchProvider } from "../providers/runtime-fetch.js";
 import { canonicalizeJSON, parseVCJWT } from "../delegation/utils.js";
 import { base64urlDecodeToBytes, bytesToBase64 } from "../utils/base64.js";
 import { createNeedsAuthorizationError, readCredentialProofValue, } from "../types/protocol.js";
 import { logger } from "../logging/index.js";
+import { TtlCache } from "../utils/ttl-cache.js";
 import { sanitizeForMessage } from "./with-kya-os.helpers.js";
 export function createDelegationVerification(deps) {
     const { identity, cryptoProvider, delegationConfig } = deps;
@@ -110,19 +111,43 @@ export function createDelegationVerification(deps) {
         ],
         isError: true,
     });
-    const validateDelegationChain = (leafCredential, options) => validateDelegationChainCore(leafCredential, {
-        serverDid: identity.did,
-        verifier,
-        resolveDelegationChain: delegationConfig?.resolveDelegationChain,
-        statusListConfigured: !!delegationConfig?.statusListResolver,
-        revocationChecker: delegationConfig?.revocationChecker,
-    }, options);
+    const trustedRootIssuers = delegationConfig?.trustedRootIssuers;
+    if (trustedRootIssuers === undefined) {
+        logger.warn("[kya-os] delegation.trustedRootIssuers is not set, so a delegation from any issuer is " +
+            "accepted, including one an agent signs for itself. Set it to the DIDs allowed to grant authority.");
+    }
+    // Root credentials whose claimed issuerDid is not their signer are accepted
+    // for compatibility but reported: each distinct message at most once an hour,
+    // with the oldest evicted first so the set stays bounded.
+    const reportedChainWarnings = new TtlCache({ ttlMs: 60 * 60 * 1000, maxEntries: 256 });
+    const reportChainWarnings = (warnings) => {
+        for (const warning of warnings ?? []) {
+            if (reportedChainWarnings.get(warning))
+                continue;
+            reportedChainWarnings.set(warning, true);
+            logger.warn(`[kya-os] ${sanitizeForMessage(warning)}`);
+        }
+    };
+    const validateDelegationChain = async (leafCredential, options) => {
+        const result = await validateDelegationChainCore(leafCredential, {
+            serverDid: identity.did,
+            verifier,
+            resolveDelegationChain: delegationConfig?.resolveDelegationChain,
+            statusListConfigured: !!delegationConfig?.statusListResolver,
+            revocationChecker: delegationConfig?.revocationChecker,
+            ...(trustedRootIssuers !== undefined ? { trustedRootIssuers } : {}),
+        }, options);
+        if (result.valid)
+            reportChainWarnings(result.warnings);
+        return result;
+    };
     async function verifyDelegation(delegationArg) {
         // Normalize to a DelegationCredential, authenticating by wire form. A VC-JWT
         // string carries its signature in the compact-JWS ENVELOPE; an object carries
         // an embedded Data-Integrity proof (verified inside validateDelegationChain).
         let vc;
         let isJwt = false;
+        let jwtExpiresAt;
         if (typeof delegationArg === "string") {
             const parsed = parseVCJWT(delegationArg);
             if (!parsed || !parsed.payload.vc) {
@@ -142,6 +167,9 @@ export function createDelegationVerification(deps) {
                     vc: parsed.payload.vc,
                 };
             }
+            // This exact JWT's optional exp has passed the envelope verifier's live
+            // time checks. Preserve its narrower deadline when caching the grant.
+            jwtExpiresAt = parsed.payload.exp !== undefined ? parsed.payload.exp * 1000 : undefined;
             vc = parsed.payload.vc;
             // A JWT has no embedded `proof`; add a marker so basic validation (which
             // requires proof presence) passes. The already-verified envelope is the
@@ -181,7 +209,15 @@ export function createDelegationVerification(deps) {
                 vc,
             };
         }
-        return { valid: true, vc, isJwt };
+        const expiresAt = jwtExpiresAt === undefined
+            ? chain.expiresAt
+            : Math.min(jwtExpiresAt, chain.expiresAt ?? jwtExpiresAt);
+        return {
+            valid: true,
+            vc,
+            isJwt,
+            ...(expiresAt !== undefined ? { expiresAt } : {}),
+        };
     }
     async function buildNeedsAuthorizationChallenge(toolName, config) {
         const tokenBytes = await cryptoProvider.randomBytes(16);

package/dist/middleware/with-kya-os.delegation-verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.delegation-verify.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EACL,4BAA4B,GAG7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,IAAI,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GAGzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAoD9D,MAAM,UAAU,4BAA4B,CAC1C,IAAoB;IAEpB,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAE5D,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;IAC9C,MAAM,aAAa,GACjB,gBAAgB,EAAE,aAAa;QAC/B,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;YACrC,CAAC,CAAC,IAAI,oBAAoB,EAAE;YAC5B,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,MAAM,cAAc,GAAG,aAAa;QAClC,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,sBAAsB,GAAG,wBAAwB,CACrD,gBAAgB,EAAE,YAAY,EAC9B,aAAa,CACd,CAAC;IACF,MAAM,WAAW,GAAgB;QAC/B,KAAK,CAAC,OAAO,CAAC,GAAW;YACvB,MAAM,cAAc,GAAG,gBAAgB,EAAE,WAAW,CAAC;YACrD,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,QAAQ,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,kBAAkB,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/E,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACvD,IAAI,QAAQ,EAAE,CAAC;wBACb,OAAO,QAAQ,CAAC;oBAClB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;YAC9C,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IAEF,MAAM,iBAAiB,GAAkC,KAAK,EAC5D,EAAwB,EACxB,YAAqB,EACyB,EAAE;QAChD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAgC,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACjE,CAAC;QAED,yEAAyE;QACzE,MAAM,QAAQ,GAAG,EAA6B,CAAC;QAC/C,MAAM,cAAc,GAA4B,EAAE,CAAC;QACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,OAAO;gBAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEjD,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEpD,iEAAiE;QACjE,MAAM,GAAG,GAAG,YAA8B,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAChE,CAAC;QAED,mEAAmE;QACnE,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAEhD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QACxE,OAAO;YACL,KAAK;YACL,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B;SAC5D,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAAC;QAChD,WAAW;QACX,iBAAiB;QACjB,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB;QACxD,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK;QACpD,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU;KAC9D,CAAC,CAAC;IAEH,MAAM,4BAA4B,GAAG,CACnC,KAAa,EACb,MAAc,EACyB,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;aACpE;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,MAAM,uBAAuB,GAAG,CAC9B,cAAoC,EACpC,OAAqC,EACS,EAAE,CAChD,2BAA2B,CACzB,cAAc,EACd;QACE,SAAS,EAAE,QAAQ,CAAC,GAAG;QACvB,QAAQ;QACR,sBAAsB,EAAE,gBAAgB,EAAE,sBAAsB;QAChE,oBAAoB,EAAE,CAAC,CAAC,gBAAgB,EAAE,kBAAkB;QAC5D,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB;KACvD,EACD,OAAO,CACR,CAAC;IAEJ,KAAK,UAAU,gBAAgB,CAC7B,aAAsB;QAEtB,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,IAAI,EAAwB,CAAC;QAC7B,IAAI,KAAK,GAAG,KAAK,CAAC;QAElB,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;YAC3D,CAAC;YACD,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,4DAA4D;YAC5D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,aAAa,EAAE;gBACjE,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACpB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,wCAAwC;oBACnE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAA0B;iBAC9C,CAAC;YACJ,CAAC;YACD,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAA0B,CAAC;YAC/C,yEAAyE;YACzE,wEAAwE;YACxE,iEAAiE;YACjE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACd,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC;YACtE,CAAC;YACD,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,aAAqC,CAAC;QAC7C,CAAC;QAED,0EAA0E;QAC1E,8EAA8E;QAC9E,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,KAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;gBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;aACxD,CAAC,CAAC;YACH,KAAK,GAAG;gBACN,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,6CAA6C;aACtD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,qCAAqC;gBAC7D,EAAE;aACH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,UAAU,gCAAgC,CAC7C,QAAgB,EAChB,MAA4B;QAK5B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,WAAW,GAAG;YAClB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;SACd,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;QAEtD,MAAM,SAAS,GAAG,6BAA6B,CAAC;YAC9C,OAAO,EAAE,SAAS,QAAQ,qCAAqC,MAAM,CAAC,OAAO,EAAE;YAC/E,gBAAgB,EAAE,MAAM,CAAC,UAAU;YACnC,WAAW;YACX,SAAS;YACT,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;QAEH,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,uBAAuB,GAAG;YAC9B,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;SAC3D,CAAC;QACF,IAAI,gBAAgB,GAAG,uBAAuB,CAAC;QAC/C,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,gBAAgB,GAAG,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE;oBAC1E,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,gBAAgB,GAAG,uBAAuB,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,gBAAgB;QAChB,4BAA4B;QAC5B,gCAAgC;KACjC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"with-kya-os.delegation-verify.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EACL,4BAA4B,GAG7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uBAAuB,IAAI,2BAA2B,GAEvD,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GAGzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAoD9D,MAAM,UAAU,4BAA4B,CAC1C,IAAoB;IAEpB,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAE5D,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;IAC9C,MAAM,aAAa,GACjB,gBAAgB,EAAE,aAAa;QAC/B,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;YACrC,CAAC,CAAC,IAAI,oBAAoB,EAAE;YAC5B,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,MAAM,cAAc,GAAG,aAAa;QAClC,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,sBAAsB,GAAG,wBAAwB,CACrD,gBAAgB,EAAE,YAAY,EAC9B,aAAa,CACd,CAAC;IACF,MAAM,WAAW,GAAgB;QAC/B,KAAK,CAAC,OAAO,CAAC,GAAW;YACvB,MAAM,cAAc,GAAG,gBAAgB,EAAE,WAAW,CAAC;YACrD,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,QAAQ,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,kBAAkB,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/E,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACvD,IAAI,QAAQ,EAAE,CAAC;wBACb,OAAO,QAAQ,CAAC;oBAClB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;YAC9C,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IAEF,MAAM,iBAAiB,GAAkC,KAAK,EAC5D,EAAwB,EACxB,YAAqB,EACyB,EAAE;QAChD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAgC,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACjE,CAAC;QAED,yEAAyE;QACzE,MAAM,QAAQ,GAAG,EAA6B,CAAC;QAC/C,MAAM,cAAc,GAA4B,EAAE,CAAC;QACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,OAAO;gBAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEjD,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEpD,iEAAiE;QACjE,MAAM,GAAG,GAAG,YAA8B,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAChE,CAAC;QAED,mEAAmE;QACnE,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAEhD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QACxE,OAAO;YACL,KAAK;YACL,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B;SAC5D,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAAC;QAChD,WAAW;QACX,iBAAiB;QACjB,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB;QACxD,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK;QACpD,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU;KAC9D,CAAC,CAAC;IAEH,MAAM,4BAA4B,GAAG,CACnC,KAAa,EACb,MAAc,EACyB,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;aACpE;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAAG,gBAAgB,EAAE,kBAAkB,CAAC;IAChE,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CACT,wFAAwF;YACtF,mGAAmG,CACtG,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,0DAA0D;IAC1D,MAAM,qBAAqB,GAAG,IAAI,QAAQ,CAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7F,MAAM,mBAAmB,GAAG,CAAC,QAAuC,EAAQ,EAAE;QAC5E,KAAK,MAAM,OAAO,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YACjD,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,YAAY,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,uBAAuB,GAAG,KAAK,EACnC,cAAoC,EACpC,OAAqC,EACL,EAAE;QAClC,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAC9C,cAAc,EACd;YACE,SAAS,EAAE,QAAQ,CAAC,GAAG;YACvB,QAAQ;YACR,sBAAsB,EAAE,gBAAgB,EAAE,sBAAsB;YAChE,oBAAoB,EAAE,CAAC,CAAC,gBAAgB,EAAE,kBAAkB;YAC5D,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB;YACtD,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,EACD,OAAO,CACR,CAAC;QACF,IAAI,MAAM,CAAC,KAAK;YAAE,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,KAAK,UAAU,gBAAgB,CAC7B,aAAsB;QAEtB,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,IAAI,EAAwB,CAAC;QAC7B,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,YAAgC,CAAC;QAErC,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;YAC3D,CAAC;YACD,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,4DAA4D;YAC5D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,aAAa,EAAE;gBACjE,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACpB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,wCAAwC;oBACnE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAA0B;iBAC9C,CAAC;YACJ,CAAC;YACD,wEAAwE;YACxE,sEAAsE;YACtE,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAA0B,CAAC;YAC/C,yEAAyE;YACzE,wEAAwE;YACxE,iEAAiE;YACjE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACd,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC;YACtE,CAAC;YACD,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,aAAqC,CAAC;QAC7C,CAAC;QAED,0EAA0E;QAC1E,8EAA8E;QAC9E,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,KAA4B,CAAC;QACjC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;gBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;aACxD,CAAC,CAAC;YACH,KAAK,GAAG;gBACN,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,6CAA6C;aACtD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,qCAAqC;gBAC7D,EAAE;aACH,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,KAAK,SAAS;YAC1C,CAAC,CAAC,KAAK,CAAC,SAAS;YACjB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,IAAI,YAAY,CAAC,CAAC;QAC5D,OAAO;YACL,KAAK,EAAE,IAAI;YACX,EAAE;YACF,KAAK;YACL,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,gCAAgC,CAC7C,QAAgB,EAChB,MAA4B;QAK5B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,WAAW,GAAG;YAClB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;SACd,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;QAEtD,MAAM,SAAS,GAAG,6BAA6B,CAAC;YAC9C,OAAO,EAAE,SAAS,QAAQ,qCAAqC,MAAM,CAAC,OAAO,EAAE;YAC/E,gBAAgB,EAAE,MAAM,CAAC,UAAU;YACnC,WAAW;YACX,SAAS;YACT,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;QAEH,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,uBAAuB,GAAG;YAC9B,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;SAC3D,CAAC;QACF,IAAI,gBAAgB,GAAG,uBAAuB,CAAC;QAC/C,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,gBAAgB,GAAG,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE;oBAC1E,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,gBAAgB,GAAG,uBAAuB,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,gBAAgB;QAChB,4BAA4B;QAC5B,gCAAgC;KACjC,CAAC;AACJ,CAAC"}

package/dist/middleware/with-kya-os.deps.d.ts

@@ -46,4 +46,3 @@ export interface MiddlewareDeps {
      */
     responseProofProfile: ResponseProofProfile;
 }
-//# sourceMappingURL=with-kya-os.deps.d.ts.map

package/dist/middleware/with-kya-os.grants.d.ts

@@ -8,23 +8,30 @@
  */
 import type { Grant } from "../providers/grant-store.js";
 import type { DelegationCredential } from "../types/protocol.js";
+import type { DelegationVerification } from "./with-kya-os.delegation-verify.js";
 import type { MiddlewareDeps } from "./with-kya-os.deps.js";
+/** A durable grant whose retained delegation re-verified for this call. */
+export interface ResolvedGrant {
+    grant: Grant;
+    /** The scopes the re-verified credential grants (not the store's copy). */
+    delegatedScopes: string[];
+}
 export interface GrantResolution {
     /**
      * Resolve an existing durable grant for a no-delegation (retry) call, so a
      * fresh instance with empty memory authorizes the retry from the shared store.
-     * Fail-closed, holder-of-key first (agent-anchored, portable), then the
-     * session bearer capability. Returns undefined to fall through to the
+     * Fail-closed, holder-of-key first (agent-anchored, portable), then session
+     * reuse only where the configured binding policy permits it. Every path
+     * revalidates the retained delegation. Returns undefined to fall through to the
      * needs_authorization challenge.
      */
-    resolveExistingGrant(toolName: string, args: Record<string, unknown>, sessionId: string | undefined, scopeId: string): Promise<Grant | undefined>;
+    resolveExistingGrant(toolName: string, args: Record<string, unknown>, sessionId: string | undefined, scopeId: string): Promise<ResolvedGrant | undefined>;
     /**
      * Mint a durable grant from a freshly-verified delegation so the NEXT call —
      * on any instance — resolves via {@link resolveExistingGrant} without
      * re-pasting the VC. Best-effort: a store failure must not break the
      * already-authorized response.
      */
-    bindGrantOnSuccess(vc: DelegationCredential, delegationArg: unknown, isVCJWT: boolean, sessionId: string | undefined, scopeId: string): Promise<void>;
+    bindGrantOnSuccess(vc: DelegationCredential, delegationArg: unknown, isVCJWT: boolean, sessionId: string | undefined, scopeId: string, expiresAt?: number): Promise<void>;
 }
-export declare function createGrantResolution(deps: MiddlewareDeps): GrantResolution;
-//# sourceMappingURL=with-kya-os.grants.d.ts.map
+export declare function createGrantResolution(deps: MiddlewareDeps, verifyDelegation: DelegationVerification["verifyDelegation"]): GrantResolution;

package/dist/middleware/with-kya-os.grants.js

@@ -6,10 +6,11 @@
  * instance with empty memory. Extracted from `./with-kya-os.ts`; depends only on
  * the immutable {@link MiddlewareDeps} (no shared session state).
  */
+import { scopeSatisfies } from "../delegation/scope-matcher.js";
 import { getDelegationScopes } from "../delegation/chain-enforcement.js";
 import { assertHolderBinding, isHolderBindingApplicable, toHolderBindingRequest, } from "../delegation/holder-binding.js";
 import { logger } from "../logging/index.js";
-export function createGrantResolution(deps) {
+export function createGrantResolution(deps, verifyDelegation) {
     const { identity, cryptoProvider, grantStore, holderBindingMode, holderBindingVerifier, } = deps;
     /**
      * Deterministic grant id from (agentDid, sessionId, sorted scopes). Stable for
@@ -21,17 +22,37 @@ export function createGrantResolution(deps) {
         const digest = await cryptoProvider.hash(new TextEncoder().encode(key));
         return `grant_${digest.replace(/^sha256:/, "")}`;
     }
-    /** Grant expiry (ms epoch) derived from the VC, or undefined for no expiry. */
-    function delegationExpiryMs(vc) {
-        if (vc.expirationDate) {
-            const parsed = Date.parse(vc.expirationDate);
-            if (!Number.isNaN(parsed))
-                return parsed;
+    /**
+     * A grant caches evidence, never a permanent authorization decision. Returns
+     * the grant with the scopes of its re-verified credential, or undefined when
+     * the grant does not authorize `scopeId` now.
+     */
+    async function authorizeGrant(grant, scopeId) {
+        if (grant.status !== "active" || !grant.scopes.includes(scopeId))
+            return undefined;
+        if (grant.expiresAt !== undefined &&
+            (!Number.isFinite(grant.expiresAt) || grant.expiresAt <= Date.now()))
+            return undefined;
+        // Prefer the original JWT wire form when present: its envelope is the proof.
+        // Legacy rows without signed evidence intentionally require authorization again.
+        const evidence = grant.credentialJwt ?? grant.delegationCredential;
+        if (evidence === undefined)
+            return undefined;
+        try {
+            const check = await verifyDelegation(evidence);
+            if (!check.valid)
+                return undefined;
+            const subject = check.vc.credentialSubject;
+            if (subject.id !== grant.agentDid ||
+                subject.delegation.controller !== grant.userDid ||
+                !scopeSatisfies(scopeId, check.vc).satisfied)
+                return undefined;
+            return { grant, delegatedScopes: getDelegationScopes(check.vc) };
+        }
+        catch {
+            // Resolver/provider failures must not turn cached authority into a bypass.
+            return undefined;
         }
-        const notAfter = vc.credentialSubject?.delegation?.constraints?.notAfter;
-        if (typeof notAfter === "number")
-            return notAfter * 1000;
-        return undefined;
     }
     /**
      * Resolve a durable, agent-anchored grant for a no-delegation call — BUT ONLY
@@ -74,20 +95,38 @@ export function createGrantResolution(deps) {
         const grants = await grantStore.getByAgent(agentDid, [scopeId]);
         // A session-bound grant is usable only from its own session; an
         // agent-anchored (session-less) grant is portable across transports.
-        return grants.find((g) => g.sessionId === undefined || g.sessionId === sessionId);
+        for (const grant of grants) {
+            if (grant.agentDid !== agentDid ||
+                (grant.sessionId !== undefined && grant.sessionId !== sessionId))
+                continue;
+            const resolved = await authorizeGrant(grant, scopeId);
+            if (resolved)
+                return resolved;
+        }
+        return undefined;
     }
     async function resolveExistingGrant(toolName, args, sessionId, scopeId) {
         const agentGrant = await resolveAgentGrant(toolName, args, sessionId, scopeId);
         if (agentGrant)
             return agentGrant;
         if (sessionId) {
-            const [sessionGrant] = await grantStore.getBySession(sessionId, [scopeId]);
-            if (sessionGrant)
-                return sessionGrant;
+            const grants = await grantStore.getBySession(sessionId, [scopeId]);
+            for (const grant of grants) {
+                if (grant.sessionId !== sessionId)
+                    continue;
+                // Enforce applies to every did:key retry, even with a session bearer.
+                // A verified proof would already have resolved it through the agent path.
+                if (holderBindingMode === "enforce" &&
+                    isHolderBindingApplicable(grant.agentDid))
+                    continue;
+                const resolved = await authorizeGrant(grant, scopeId);
+                if (resolved)
+                    return resolved;
+            }
         }
         return undefined;
     }
-    async function bindGrantOnSuccess(vc, delegationArg, isVCJWT, sessionId, scopeId) {
+    async function bindGrantOnSuccess(vc, delegationArg, isVCJWT, sessionId, scopeId, expiresAt) {
         try {
             const agentDid = vc.credentialSubject?.id;
             if (!agentDid)
@@ -116,7 +155,6 @@ export function createGrantResolution(deps) {
             // re-challenge. Including scopeId makes the grant resolvable.
             const scopes = Array.from(new Set([scopeId, ...delegatedScopes]));
             const userDid = vc.credentialSubject?.delegation?.controller;
-            const expiresAt = delegationExpiryMs(vc);
             const grant = {
                 id: await grantId(agentDid, sessionId, scopes),
                 agentDid,
@@ -126,7 +164,7 @@ export function createGrantResolution(deps) {
                 authorization: { type: "delegation" },
                 ...(isVCJWT && typeof delegationArg === "string"
                     ? { credentialJwt: delegationArg }
-                    : {}),
+                    : { delegationCredential: structuredClone(vc) }),
                 issuedAt: Date.now(),
                 ...(expiresAt !== undefined ? { expiresAt } : {}),
                 status: "active",

package/dist/middleware/with-kya-os.grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.grants.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.grants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAgC7C,MAAM,UAAU,qBAAqB,CAAC,IAAoB;IACxD,MAAM,EACJ,QAAQ,EACR,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,qBAAqB,GACtB,GAAG,IAAI,CAAC;IAET;;;;OAIG;IACH,KAAK,UAAU,OAAO,CACpB,QAAgB,EAChB,SAA6B,EAC7B,MAAgB;QAEhB,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,SAAS,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,OAAO,SAAS,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;IACnD,CAAC;IAED,+EAA+E;IAC/E,SAAS,kBAAkB,CAAC,EAAwB;QAClD,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;QAC3C,CAAC;QACD,MAAM,QAAQ,GAAG,EAAE,CAAC,iBAAiB,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC;QACzE,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,QAAQ,GAAG,IAAI,CAAC;QACzD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,iBAAiB,CAC9B,QAAgB,EAChB,IAA6B,EAC7B,SAA6B,EAC7B,OAAe;QAEf,IAAI,CAAC,qBAAqB;YAAE,OAAO,SAAS,CAAC,CAAC,oCAAoC;QAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,IAAI,WAAW,GAAY,QAAQ,CAAC;QACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,WAA4B,CAAC;QAC3C,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC;QAClC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;YACxC,KAAK;YACL,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC;YAC/C,gBAAgB,EAAE,QAAQ,CAAC,GAAG;YAC9B,aAAa,EAAE,qBAAqB;SACrC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,gEAAgE;QAChE,qEAAqE;QACrE,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAC9D,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,oBAAoB,CACjC,QAAgB,EAChB,IAA6B,EAC7B,SAA6B,EAC7B,OAAe;QAEf,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/E,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAElC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3E,IAAI,YAAY;gBAAE,OAAO,YAAY,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,UAAU,kBAAkB,CAC/B,EAAwB,EACxB,aAAsB,EACtB,OAAgB,EAChB,SAA6B,EAC7B,OAAe;QAEf,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAEtB,yEAAyE;YACzE,sEAAsE;YACtE,2EAA2E;YAC3E,4EAA4E;YAC5E,4EAA4E;YAC5E,uCAAuC;YACvC,IAAI,iBAAiB,KAAK,KAAK,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC3D,MAAM,CAAC,KAAK,CACV,mEAAmE,OAAO,wCAAwC,CACnH,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,eAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,eAAe,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,2EAA2E;YAC3E,2EAA2E;YAC3E,yEAAyE;YACzE,uEAAuE;YACvE,8DAA8D;YAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,EAAE,CAAC,iBAAiB,EAAE,UAAU,EAAE,UAAU,CAAC;YAC7D,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;YAEzC,MAAM,KAAK,GAAU;gBACnB,EAAE,EAAE,MAAM,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;gBAC9C,QAAQ;gBACR,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,MAAM;gBACN,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,aAAa,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;gBACrC,GAAG,CAAC,OAAO,IAAI,OAAO,aAAa,KAAK,QAAQ;oBAC9C,CAAC,CAAC,EAAE,aAAa,EAAE,aAAa,EAAE;oBAClC,CAAC,CAAC,EAAE,CAAC;gBACP,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;gBACpB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,MAAM,EAAE,QAAQ;aACjB,CAAC;YACF,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;gBACzC,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,CAAC;AACtD,CAAC"}
+{"version":3,"file":"with-kya-os.grants.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.grants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAyC7C,MAAM,UAAU,qBAAqB,CACnC,IAAoB,EACpB,gBAA4D;IAE5D,MAAM,EACJ,QAAQ,EACR,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,qBAAqB,GACtB,GAAG,IAAI,CAAC;IAET;;;;OAIG;IACH,KAAK,UAAU,OAAO,CACpB,QAAgB,EAChB,SAA6B,EAC7B,MAAgB;QAEhB,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,SAAS,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,OAAO,SAAS,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,cAAc,CAC3B,KAAY,EACZ,OAAe;QAEf,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QACnF,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;YAC7B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACpE,OAAO,SAAS,CAAC;QAEnB,6EAA6E;QAC7E,iFAAiF;QACjF,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,oBAAoB,CAAC;QACnE,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YACnC,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC;YAC3C,IACE,OAAO,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ;gBAC7B,OAAO,CAAC,UAAU,CAAC,UAAU,KAAK,KAAK,CAAC,OAAO;gBAC/C,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS;gBAC5C,OAAO,SAAS,CAAC;YACnB,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;YAC3E,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,iBAAiB,CAC9B,QAAgB,EAChB,IAA6B,EAC7B,SAA6B,EAC7B,OAAe;QAEf,IAAI,CAAC,qBAAqB;YAAE,OAAO,SAAS,CAAC,CAAC,oCAAoC;QAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,IAAI,WAAW,GAAY,QAAQ,CAAC;QACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,WAA4B,CAAC;QAC3C,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC;QAClC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;YACxC,KAAK;YACL,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC;YAC/C,gBAAgB,EAAE,QAAQ,CAAC,GAAG;YAC9B,aAAa,EAAE,qBAAqB;SACrC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,gEAAgE;QAChE,qEAAqE;QACrE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IACE,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAC3B,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC;gBAChE,SAAS;YACX,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACtD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;QAChC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,UAAU,oBAAoB,CACjC,QAAgB,EAChB,IAA6B,EAC7B,SAA6B,EAC7B,OAAe;QAEf,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/E,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAElC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YACnE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;oBAAE,SAAS;gBAC5C,sEAAsE;gBACtE,0EAA0E;gBAC1E,IACE,iBAAiB,KAAK,SAAS;oBAC/B,yBAAyB,CAAC,KAAK,CAAC,QAAQ,CAAC;oBACzC,SAAS;gBACX,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACtD,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;YAChC,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,UAAU,kBAAkB,CAC/B,EAAwB,EACxB,aAAsB,EACtB,OAAgB,EAChB,SAA6B,EAC7B,OAAe,EACf,SAAkB;QAElB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAEtB,yEAAyE;YACzE,sEAAsE;YACtE,2EAA2E;YAC3E,4EAA4E;YAC5E,4EAA4E;YAC5E,uCAAuC;YACvC,IAAI,iBAAiB,KAAK,KAAK,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC3D,MAAM,CAAC,KAAK,CACV,mEAAmE,OAAO,wCAAwC,CACnH,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,eAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,eAAe,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,2EAA2E;YAC3E,2EAA2E;YAC3E,yEAAyE;YACzE,uEAAuE;YACvE,8DAA8D;YAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,EAAE,CAAC,iBAAiB,EAAE,UAAU,EAAE,UAAU,CAAC;YAE7D,MAAM,KAAK,GAAU;gBACnB,EAAE,EAAE,MAAM,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;gBAC9C,QAAQ;gBACR,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,MAAM;gBACN,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,aAAa,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;gBACrC,GAAG,CAAC,OAAO,IAAI,OAAO,aAAa,KAAK,QAAQ;oBAC9C,CAAC,CAAC,EAAE,aAAa,EAAE,aAAa,EAAE;oBAClC,CAAC,CAAC,EAAE,oBAAoB,EAAE,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClD,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;gBACpB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,MAAM,EAAE,QAAQ;aACjB,CAAC;YACF,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;gBACzC,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,CAAC;AACtD,CAAC"}