@kya-os/mcp 1.16.1 → 1.17.0

package/dist/middleware/with-kya-os.helpers.d.ts

@@ -21,4 +21,3 @@ export declare function extractPolicyPrincipal(del: unknown): {
     responsibleParty?: string;
     delegatedScopes: string[];
 };
-//# sourceMappingURL=with-kya-os.helpers.d.ts.map

package/dist/middleware/with-kya-os.js

@@ -25,6 +25,7 @@ import { ProofVerifier } from "../proof/verifier.js";
 import { SystemClockProvider } from "../providers/system-clock.js";
 import { MemoryNonceCacheProvider } from "../providers/memory.js";
 import { logger } from "../logging/index.js";
+import { createDelegationVerification } from "./with-kya-os.delegation-verify.js";
 import { createGrantResolution } from "./with-kya-os.grants.js";
 import { createPolicyGate } from "./with-kya-os.policy-gate.js";
 import { createDelegationGate } from "./with-kya-os.delegation-gate.js";
@@ -81,12 +82,16 @@ export function createKyaOsMiddleware(config, cryptoProvider) {
         publicKey: config.identity.publicKey,
     };
     // One replay-protection store, shared by the handshake and holder binding.
-    // Defaults to in-memory; SessionManager.cleanup() drives its expiry sweep.
+    // Defaults to in-memory, which sweeps its own expired entries as it is written to.
     const nonceCache = config.nonceCache ?? new MemoryNonceCacheProvider();
+    // SessionManager and ProofVerifier each check the cache at construction:
+    // refused under requireAtomicNonce, otherwise one warning if not atomic.
+    const requireAtomicNonce = config.requireAtomicNonce ?? false;
     const sessionManager = new SessionManager(cryptoProvider, {
         ...config.session,
         serverDid: identity.did,
         nonceCache,
+        requireAtomicNonce,
     });
     const proofGenerator = new ProofGenerator(identity, cryptoProvider);
     const delegationConfig = config.delegation;
@@ -124,6 +129,7 @@ export function createKyaOsMiddleware(config, cryptoProvider) {
             cryptoProvider,
             clockProvider: new SystemClockProvider(),
             nonceCacheProvider: nonceCache,
+            requireAtomicNonce,
             fetchProvider: delegationConfig?.fetchProvider ??
                 (typeof globalThis.fetch === "function"
                     ? new RuntimeFetchProvider()
@@ -151,10 +157,14 @@ export function createKyaOsMiddleware(config, cryptoProvider) {
     const protocol = createProtocol(deps, {
         handleHandshake: session.handleHandshake,
     });
-    // Durable-grant resolution (the no-paste retry). Depends only on the immutable
-    // deps above, so it lifts out cleanly with no shared session state.
-    const { resolveExistingGrant, bindGrantOnSuccess } = createGrantResolution(deps);
+    // Durable-grant resolution (the no-paste retry) re-verifies stored evidence
+    // with the same delegation verification the gate applies to presented
+    // credentials. Both depend only on the immutable deps above, so they lift out
+    // cleanly with no shared session state.
+    const delegationVerification = createDelegationVerification(deps);
+    const { resolveExistingGrant, bindGrantOnSuccess } = createGrantResolution(deps, delegationVerification.verifyDelegation);
     const { wrapWithDelegation } = createDelegationGate(deps, {
+        delegationVerification,
         attachOutcomeProof: session.attachOutcomeProof,
         resolveExistingGrant,
         bindGrantOnSuccess,

package/dist/middleware/with-kya-os.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,cAAc,EACd,2BAA2B,GAE5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAM7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,kFAAkF;AAClF,qFAAqF;AACrF,cAAc,wBAAwB,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,UAAU,qBAAqB,CACnC,MAAmB,EACnB,cAA8B;IAE9B,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5C,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS;gBACzC,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBAClE,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;YAC5F,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAuB;QACnC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QACxB,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QACxB,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU;QACtC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;KACrC,CAAC;IAEF,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,wBAAwB,EAAE,CAAC;IAEvE,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,cAAc,EAAE;QACxD,GAAG,MAAM,CAAC,OAAO;QACjB,SAAS,EAAE,QAAQ,CAAC,GAAG;QACvB,UAAU;KACX,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAChE,CAAC,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE;YACrC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK;SACzD,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,4EAA4E;IAC5E,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,IAAI,CAAC;IAE7D,kEAAkE;IAClE,oEAAoE;IACpE,gDAAgD;IAChD,MAAM,oBAAoB,GACxB,MAAM,CAAC,oBAAoB,IAAI,2BAA2B,CAAC;IAE7D,8EAA8E;IAC9E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,gBAAgB,EAAE,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CACT,uEAAuE;YACrE,uEAAuE;YACvE,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,iBAAiB,GAAG,gBAAgB,EAAE,aAAa,IAAI,KAAK,CAAC;IACnE,MAAM,qBAAqB,GACzB,iBAAiB,KAAK,KAAK;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,aAAa,CAAC;YAChB,cAAc;YACd,aAAa,EAAE,IAAI,mBAAmB,EAAE;YACxC,kBAAkB,EAAE,UAAU;YAC9B,aAAa,EACX,gBAAgB,EAAE,aAAa;gBAC/B,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;oBACrC,CAAC,CAAC,IAAI,oBAAoB,EAAE;oBAC5B,CAAC,CAAC,IAAI,iBAAiB,EAAE,CAAC;SAC/B,CAAC,CAAC;IAET,iEAAiE;IACjE,MAAM,IAAI,GAAmB;QAC3B,QAAQ;QACR,MAAM;QACN,cAAc;QACd,cAAc;QACd,cAAc;QACd,QAAQ;QACR,KAAK;QACL,UAAU;QACV,gBAAgB;QAChB,iBAAiB;QACjB,qBAAqB;QACrB,kBAAkB;QAClB,oBAAoB;KACrB,CAAC;IAEF,gFAAgF;IAChF,iEAAiE;IACjE,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE;QACpC,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,oEAAoE;IACpE,MAAM,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAChD,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAE9B,MAAM,EAAE,kBAAkB,EAAE,GAAG,oBAAoB,CAAC,IAAI,EAAE;QACxD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,oBAAoB;QACpB,kBAAkB;KACnB,CAAC,CAAC;IAEH,MAAM,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE;QAChD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;KAC/C,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc;QACd,cAAc;QACd,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,kBAAkB;QAClB,cAAc;KACf,CAAC;AACJ,CAAC"}
+{"version":3,"file":"with-kya-os.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,cAAc,EACd,2BAA2B,GAE5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAM7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,kFAAkF;AAClF,qFAAqF;AACrF,cAAc,wBAAwB,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,UAAU,qBAAqB,CACnC,MAAmB,EACnB,cAA8B;IAE9B,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5C,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS;gBACzC,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBAClE,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;YAC5F,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAuB;QACnC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QACxB,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QACxB,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU;QACtC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;KACrC,CAAC;IAEF,2EAA2E;IAC3E,mFAAmF;IACnF,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,wBAAwB,EAAE,CAAC;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAE9D,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,cAAc,EAAE;QACxD,GAAG,MAAM,CAAC,OAAO;QACjB,SAAS,EAAE,QAAQ,CAAC,GAAG;QACvB,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAChE,CAAC,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE;YACrC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK;SACzD,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,4EAA4E;IAC5E,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,IAAI,CAAC;IAE7D,kEAAkE;IAClE,oEAAoE;IACpE,gDAAgD;IAChD,MAAM,oBAAoB,GACxB,MAAM,CAAC,oBAAoB,IAAI,2BAA2B,CAAC;IAE7D,8EAA8E;IAC9E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,gBAAgB,EAAE,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CACT,uEAAuE;YACrE,uEAAuE;YACvE,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,iBAAiB,GAAG,gBAAgB,EAAE,aAAa,IAAI,KAAK,CAAC;IACnE,MAAM,qBAAqB,GACzB,iBAAiB,KAAK,KAAK;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,aAAa,CAAC;YAChB,cAAc;YACd,aAAa,EAAE,IAAI,mBAAmB,EAAE;YACxC,kBAAkB,EAAE,UAAU;YAC9B,kBAAkB;YAClB,aAAa,EACX,gBAAgB,EAAE,aAAa;gBAC/B,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;oBACrC,CAAC,CAAC,IAAI,oBAAoB,EAAE;oBAC5B,CAAC,CAAC,IAAI,iBAAiB,EAAE,CAAC;SAC/B,CAAC,CAAC;IAET,iEAAiE;IACjE,MAAM,IAAI,GAAmB;QAC3B,QAAQ;QACR,MAAM;QACN,cAAc;QACd,cAAc;QACd,cAAc;QACd,QAAQ;QACR,KAAK;QACL,UAAU;QACV,gBAAgB;QAChB,iBAAiB;QACjB,qBAAqB;QACrB,kBAAkB;QAClB,oBAAoB;KACrB,CAAC;IAEF,gFAAgF;IAChF,iEAAiE;IACjE,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE;QACpC,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,sEAAsE;IACtE,8EAA8E;IAC9E,wCAAwC;IACxC,MAAM,sBAAsB,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAChD,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAEvE,MAAM,EAAE,kBAAkB,EAAE,GAAG,oBAAoB,CAAC,IAAI,EAAE;QACxD,sBAAsB;QACtB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,oBAAoB;QACpB,kBAAkB;KACnB,CAAC,CAAC;IAEH,MAAM,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE;QAChD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;KAC/C,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc;QACd,cAAc;QACd,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,kBAAkB;QAClB,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/middleware/with-kya-os.policy-gate.d.ts

@@ -13,4 +13,3 @@ export interface PolicyGateWiring {
     attachOutcomeProof: AttachOutcomeProof;
 }
 export declare function createPolicyGate(deps: MiddlewareDeps, wiring: PolicyGateWiring): Pick<KyaOsPolicyGate, "withPolicyGate">;
-//# sourceMappingURL=with-kya-os.policy-gate.d.ts.map

package/dist/middleware/with-kya-os.policy-gate.js

@@ -12,10 +12,11 @@ import { verifyApprovalQuorum } from "../policy/approval.js";
 import { buildPolicyRequest } from "../policy/projection.js";
 import { createNeedsApprovalError } from "../types/protocol.js";
 import { isKyaOsControlArg } from "../delegation/holder-binding.js";
+import { acceptedRequestHashes } from "../proof/generator.js";
 import { KYA_OS_ERROR_CODES } from "../errors.js";
 import { sanitizeForMessage, extractPolicyPrincipal } from "./with-kya-os.helpers.js";
 export function createPolicyGate(deps, wiring) {
-    const { proofGenerator, audit } = deps;
+    const { proofGenerator, cryptoProvider, audit } = deps;
     const { attachOutcomeProof } = wiring;
     const defaultRiskClassifier = new RiskClassifier();
     const defaultPolicyEngine = new DefaultPolicyEngine();
@@ -24,7 +25,13 @@ export function createPolicyGate(deps, wiring) {
         const classifier = opts.classifier ?? defaultRiskClassifier;
         const approvalsKey = opts.approvalsArgKey ?? "_kyaos_approvals";
         const isValidApprovalSignature = opts.isValidApprovalSignature ?? (async () => false);
-        return async (args, sessionId, context) => {
+        return async (callArgs, sessionId, context) => {
+            // Composed after wrapWithDelegation, the approvals argument has already
+            // been stripped and arrives in the call context; restore it so a step-up
+            // resume verifies the same grants either way.
+            const args = callArgs[approvalsKey] === undefined && context?.approvals !== undefined
+                ? { ...callArgs, [approvalsKey]: context.approvals }
+                : callArgs;
             // Drop the reserved _kyaos* namespace plus the (possibly custom) approvals
             // key, so no control arg reaches the handler.
             const cleanArgs = {};
@@ -34,7 +41,9 @@ export function createPolicyGate(deps, wiring) {
             }
             const namespace = opts.resolveNamespace?.(args) ?? toolName;
             const risk = classifier.classify({ toolName, namespace });
-            const principal = extractPolicyPrincipal(args["_kyaos_delegation"]);
+            // Prefer the principal wrapWithDelegation authenticated; the raw
+            // `_kyaos_delegation` projection is the unverified standalone fallback.
+            const principal = context?.principal ?? extractPolicyPrincipal(args["_kyaos_delegation"]);
             const policyRequest = buildPolicyRequest({
                 principal: {
                     agentDid: principal.agentDid,
@@ -44,7 +53,7 @@ export function createPolicyGate(deps, wiring) {
                 },
                 action: { toolName },
                 resource: { namespace },
-                delegatedScopes: principal.delegatedScopes,
+                delegatedScopes: [...principal.delegatedScopes],
                 scopeMatched: opts.scopeMatched ?? false,
                 risk,
             });
@@ -89,14 +98,14 @@ export function createPolicyGate(deps, wiring) {
                 return attachOutcomeProof(denied, toolName, args, sessionId, decision.reason, "denied", cleanArgs);
             }
             // step_up: verify any supplied approval grants, bound to this exact action.
-            const requestHash = await proofGenerator.hashRequest({
-                method: toolName,
-                params: cleanArgs,
-            });
+            // The challenge advertises the legacy-shape hash; a grant over the SPEC
+            // §7.3 `tools/call` shape of the same action is accepted as well.
+            const action = { method: toolName, params: cleanArgs };
+            const requestHash = await proofGenerator.hashRequest(action);
             const grants = Array.isArray(args[approvalsKey])
                 ? args[approvalsKey]
                 : [];
-            const quorumResult = await verifyApprovalQuorum(grants, requestHash, decision.quorum, isValidApprovalSignature);
+            const quorumResult = await verifyApprovalQuorum(grants, await acceptedRequestHashes(action, (bytes) => cryptoProvider.hash(bytes)), decision.quorum, isValidApprovalSignature);
             if (quorumResult.satisfied) {
                 await audit?.authorization('approved', {
                     outcome: 'succeeded',

package/dist/middleware/with-kya-os.policy-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.policy-gate.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.policy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAsB,MAAM,uBAAuB,CAAC;AAEjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAQlD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAOtF,MAAM,UAAU,gBAAgB,CAC9B,IAAoB,EACpB,MAAwB;IAExB,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC;IAEtC,MAAM,qBAAqB,GAAG,IAAI,cAAc,EAAE,CAAC;IACnD,MAAM,mBAAmB,GAAiB,IAAI,mBAAmB,EAAE,CAAC;IAEpE,SAAS,cAAc,CACrB,QAAgB,EAChB,OAAyB,EACzB,OAA0B,EAAE;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,qBAAqB,CAAC;QAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,IAAI,kBAAkB,CAAC;QAChE,MAAM,wBAAwB,GAC5B,IAAI,CAAC,wBAAwB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;QAEvD,OAAO,KAAK,EACV,IAA6B,EAC7B,SAAkB,EAClB,OAA0B,EAC1B,EAAE;YACF,2EAA2E;YAC3E,8CAA8C;YAC9C,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,YAAY;oBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;YAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAEpE,MAAM,aAAa,GAAG,kBAAkB,CAAC;gBACvC,SAAS,EAAE;oBACT,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,GAAG,CAAC,SAAS,CAAC,gBAAgB;wBAC5B,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE;wBAClD,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,MAAM,EAAE,EAAE,QAAQ,EAAE;gBACpB,QAAQ,EAAE,EAAE,SAAS,EAAE;gBACvB,eAAe,EAAE,SAAS,CAAC,eAAe;gBAC1C,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,KAAK;gBACxC,IAAI;aACL,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YAEtD,MAAM,YAAY,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;gBACvD,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChE,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBACnD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;aAC9C,CAAC;YACF,MAAM,KAAK,EAAE,aAAa,CAAC,WAAW,EAAE;gBACtC,OAAO,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW;oBAClD,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;gBAC1D,UAAU,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO;oBACvC,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB;gBACrE,OAAO,EAAE,YAAY;aACtB,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAClC,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;oBACrC,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACjC,MAAM,MAAM,GAA0C;oBACpD,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACnB,KAAK,EAAE,kBAAkB,CAAC,aAAa;gCACvC,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC;6BAC5C,CAAC;yBACH;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;gBACF,OAAO,kBAAkB,CACvB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,QAAQ,EACR,SAAS,CACV,CAAC;YACJ,CAAC;YAED,4EAA4E;YAC5E,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC;gBACnD,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC9C,CAAC,CAAE,IAAI,CAAC,YAAY,CAAqB;gBACzC,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAC7C,MAAM,EACN,WAAW,EACX,QAAQ,CAAC,MAAM,EACf,wBAAwB,CACzB,CAAC;YACF,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;oBACrC,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,aAAa,GAAG,wBAAwB,CAAC;gBAC7C,OAAO,EAAE,SAAS,QAAQ,cAAc,QAAQ,CAAC,MAAM,CAAC,CAAC,yCAAyC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI;gBACzI,WAAW,EAAE,WAAW,WAAW,EAAE;gBACrC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;gBAC9C,WAAW;gBACX,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;YACH,MAAM,MAAM,GAA0C;gBACpD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;gBAChE,OAAO,EAAE,IAAI;aACd,CAAC;YACF,OAAO,kBAAkB,CACvB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,kBAAkB,EAClB,SAAS,CACV,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"with-kya-os.policy-gate.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.policy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAsB,MAAM,uBAAuB,CAAC;AAEjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAoB,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAQlD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAOtF,MAAM,UAAU,gBAAgB,CAC9B,IAAoB,EACpB,MAAwB;IAExB,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvD,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC;IAEtC,MAAM,qBAAqB,GAAG,IAAI,cAAc,EAAE,CAAC;IACnD,MAAM,mBAAmB,GAAiB,IAAI,mBAAmB,EAAE,CAAC;IAEpE,SAAS,cAAc,CACrB,QAAgB,EAChB,OAAyB,EACzB,OAA0B,EAAE;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,qBAAqB,CAAC;QAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,IAAI,kBAAkB,CAAC;QAChE,MAAM,wBAAwB,GAC5B,IAAI,CAAC,wBAAwB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;QAEvD,OAAO,KAAK,EACV,QAAiC,EACjC,SAAkB,EAClB,OAA0B,EAC1B,EAAE;YACF,wEAAwE;YACxE,yEAAyE;YACzE,8CAA8C;YAC9C,MAAM,IAAI,GACR,QAAQ,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS;gBACtE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE;gBACpD,CAAC,CAAC,QAAQ,CAAC;YAEf,2EAA2E;YAC3E,8CAA8C;YAC9C,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,YAAY;oBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;YAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,iEAAiE;YACjE,wEAAwE;YACxE,MAAM,SAAS,GACb,OAAO,EAAE,SAAS,IAAI,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAE1E,MAAM,aAAa,GAAG,kBAAkB,CAAC;gBACvC,SAAS,EAAE;oBACT,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,GAAG,CAAC,SAAS,CAAC,gBAAgB;wBAC5B,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE;wBAClD,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,MAAM,EAAE,EAAE,QAAQ,EAAE;gBACpB,QAAQ,EAAE,EAAE,SAAS,EAAE;gBACvB,eAAe,EAAE,CAAC,GAAG,SAAS,CAAC,eAAe,CAAC;gBAC/C,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,KAAK;gBACxC,IAAI;aACL,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YAEtD,MAAM,YAAY,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;gBACvD,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChE,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBACnD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;aAC9C,CAAC;YACF,MAAM,KAAK,EAAE,aAAa,CAAC,WAAW,EAAE;gBACtC,OAAO,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW;oBAClD,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;gBAC1D,UAAU,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO;oBACvC,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB;gBACrE,OAAO,EAAE,YAAY;aACtB,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAClC,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;oBACrC,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACjC,MAAM,MAAM,GAA0C;oBACpD,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACnB,KAAK,EAAE,kBAAkB,CAAC,aAAa;gCACvC,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC;6BAC5C,CAAC;yBACH;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;gBACF,OAAO,kBAAkB,CACvB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,QAAQ,EACR,SAAS,CACV,CAAC;YACJ,CAAC;YAED,4EAA4E;YAC5E,wEAAwE;YACxE,kEAAkE;YAClE,MAAM,MAAM,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACpE,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC9C,CAAC,CAAE,IAAI,CAAC,YAAY,CAAqB;gBACzC,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAC7C,MAAM,EACN,MAAM,qBAAqB,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC1E,QAAQ,CAAC,MAAM,EACf,wBAAwB,CACzB,CAAC;YACF,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;oBACrC,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,aAAa,GAAG,wBAAwB,CAAC;gBAC7C,OAAO,EAAE,SAAS,QAAQ,cAAc,QAAQ,CAAC,MAAM,CAAC,CAAC,yCAAyC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI;gBACzI,WAAW,EAAE,WAAW,WAAW,EAAE;gBACrC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;gBAC9C,WAAW;gBACX,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;YACH,MAAM,MAAM,GAA0C;gBACpD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;gBAChE,OAAO,EAAE,IAAI;aACd,CAAC;YACF,OAAO,kBAAkB,CACvB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,kBAAkB,EAClB,SAAS,CACV,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,CAAC;AAC5B,CAAC"}

package/dist/middleware/with-kya-os.protocol.d.ts

@@ -26,4 +26,3 @@ export interface Protocol {
 }
 export declare function createProtocol(deps: MiddlewareDeps, wiring: ProtocolWiring): Protocol;
 export {};
-//# sourceMappingURL=with-kya-os.protocol.d.ts.map

package/dist/middleware/with-kya-os.session.d.ts

@@ -8,6 +8,33 @@
  */
 import type { KyaOsToolHandler } from "./with-kya-os.types.js";
 import type { MiddlewareDeps, AttachOutcomeProof } from "./with-kya-os.deps.js";
+/**
+ * The private `_meta` member a middleware's wrappers stamp their results with
+ * while an outer layer (the withKyaOs transport) reads them. It holds a random
+ * per-middleware token, and the transport strips it before a message leaves,
+ * so it never reaches the wire. It lives in `_meta` because the MCP SDK
+ * re-creates the result object when it validates it, and `_meta` survives
+ * that.
+ */
+export declare const LIFECYCLE_STAMP_META_KEY = "org.kya-os/lifecycle-stamp";
+type ToolResult = Awaited<ReturnType<KyaOsToolHandler>>;
+/**
+ * Remove the `_meta` members only the middleware may set (proofs, proof error,
+ * audit marker, lifecycle stamp) from a result it did not produce, keeping
+ * every other member (traceparent and the like). Returns a copy when anything
+ * is removed.
+ */
+export declare function withoutOutcomeMeta<T extends ToolResult>(result: T): T;
+/** Remove the lifecycle stamp, which must never leave the process. */
+export declare function withoutLifecycleStamp<T extends ToolResult>(result: T): T;
+/**
+ * Tell the middleware behind `wrapWithProof` that an outer layer (the withKyaOs
+ * transport) reads its results. From then on its wrappers stamp what they
+ * return with the middleware's token. Returns the check for that stamp, or
+ * undefined for a middleware this module did not create, whose results are
+ * then never treated as its own.
+ */
+export declare function attachOuterProofLayer(wrapWithProof: object): ((result: ToolResult) => boolean) | undefined;
 export interface SessionProof {
     /** Establish a session from a handshake and cache it as the fallback. */
     handleHandshake(args: Record<string, unknown>): Promise<{
@@ -29,4 +56,4 @@ export interface SessionProof {
     attachOutcomeProof: AttachOutcomeProof;
 }
 export declare function createSessionProof(deps: MiddlewareDeps): SessionProof;
-//# sourceMappingURL=with-kya-os.session.d.ts.map
+export {};

package/dist/middleware/with-kya-os.session.js

@@ -6,17 +6,90 @@
  * paths: `wrapWithProof` (success responses) and `attachOutcomeProof` (denied /
  * step-up / needs-authorization outcomes). Extracted from `./with-kya-os.ts`.
  */
-import { KYA_OS_PROOF_META_KEY, LEGACY_PROOF_META_KEY, RESPONSE_PROOF_PROFILE_ENVELOPE, } from "../proof/generator.js";
+import { KYA_OS_PROOF_META_KEY, LEGACY_NAMESPACED_PROOF_META_KEY, LEGACY_PROOF_META_KEY, RESPONSE_PROOF_PROFILE_ENVELOPE, } from "../proof/generator.js";
 import { validateHandshakeFormat, } from "../session/manager.js";
 import { base64urlEncodeFromBytes } from "../utils/base64.js";
 import { logger } from "../logging/index.js";
 import { KYA_OS_ERROR_CODES } from "../errors.js";
 import { sanitizeForMessage } from "./with-kya-os.helpers.js";
+/** The `_meta` member carrying this middleware's audit-lifecycle marker. */
+const auditMetaKey = 'org.kya-os/audit';
+/**
+ * The private `_meta` member a middleware's wrappers stamp their results with
+ * while an outer layer (the withKyaOs transport) reads them. It holds a random
+ * per-middleware token, and the transport strips it before a message leaves,
+ * so it never reaches the wire. It lives in `_meta` because the MCP SDK
+ * re-creates the result object when it validates it, and `_meta` survives
+ * that.
+ */
+export const LIFECYCLE_STAMP_META_KEY = 'org.kya-os/lifecycle-stamp';
+/**
+ * `_meta` members only the middleware itself may set: proofs, a proof error,
+ * the audit marker and the lifecycle stamp. A tool result carrying them that
+ * the middleware did not produce (content relayed from an upstream server, or
+ * set by the handler) cannot be told apart from a forgery.
+ */
+const outcomeMetaKeys = [
+    KYA_OS_PROOF_META_KEY,
+    LEGACY_NAMESPACED_PROOF_META_KEY,
+    LEGACY_PROOF_META_KEY,
+    'proofError',
+    auditMetaKey,
+    LIFECYCLE_STAMP_META_KEY,
+];
+/** `result` without the `_meta` members in `keys`, dropping `_meta` if nothing else is left. */
+function withoutMetaKeys(result, keys) {
+    const metadata = result._meta;
+    if (metadata === undefined || !keys.some((key) => Object.hasOwn(metadata, key))) {
+        return result;
+    }
+    const kept = Object.fromEntries(Object.entries(metadata).filter(([key]) => !keys.includes(key)));
+    const copy = { ...result };
+    if (Object.keys(kept).length > 0)
+        copy._meta = kept;
+    else
+        delete copy._meta;
+    return copy;
+}
+/**
+ * Remove the `_meta` members only the middleware may set (proofs, proof error,
+ * audit marker, lifecycle stamp) from a result it did not produce, keeping
+ * every other member (traceparent and the like). Returns a copy when anything
+ * is removed.
+ */
+export function withoutOutcomeMeta(result) {
+    return withoutMetaKeys(result, outcomeMetaKeys);
+}
+/** Remove the lifecycle stamp, which must never leave the process. */
+export function withoutLifecycleStamp(result) {
+    return withoutMetaKeys(result, [LIFECYCLE_STAMP_META_KEY]);
+}
+/**
+ * Each middleware's hook for an outer auto-proof layer, keyed by its
+ * `wrapWithProof` so the transport can reach it from whatever
+ * `KyaOsMiddleware` it is handed without widening the public interface; a
+ * custom implementation simply has no entry.
+ */
+const outerProofLayerHooks = new WeakMap();
+/**
+ * Tell the middleware behind `wrapWithProof` that an outer layer (the withKyaOs
+ * transport) reads its results. From then on its wrappers stamp what they
+ * return with the middleware's token. Returns the check for that stamp, or
+ * undefined for a middleware this module did not create, whose results are
+ * then never treated as its own.
+ */
+export function attachOuterProofLayer(wrapWithProof) {
+    return outerProofLayerHooks.get(wrapWithProof)?.();
+}
 export function createSessionProof(deps) {
     const { identity, config, cryptoProvider, sessionManager, proofGenerator, auditLog, audit, emitLegacyProofKey, responseProofProfile, } = deps;
     const bindsEnvelope = responseProofProfile === RESPONSE_PROOF_PROFILE_ENVELOPE;
     const auditedTerminalResponses = new WeakSet();
-    const auditMetaKey = 'org.kya-os/audit';
+    // This middleware's lifecycle token, minted once an outer layer reads its
+    // results. Only wrappers holding it can stamp a result as their own.
+    let lifecycleStamp;
+    const hasOwnStamp = (response) => lifecycleStamp !== undefined &&
+        response._meta?.[LIFECYCLE_STAMP_META_KEY] === lifecycleStamp;
     const emitAudit = async (label, operation, toolName) => {
         try {
             await operation();
@@ -73,6 +146,27 @@ export function createSessionProof(deps) {
         return typeof auditMetadata === 'object' && auditMetadata !== null &&
             auditMetadata.terminal === true;
     };
+    /**
+     * The handler's `_meta` members a proof or proof error is merged into: every
+     * member except the proofs, proof error, audit marker and stamp, which only
+     * the middleware sets. A handler relaying an upstream result could
+     * otherwise ship them next to this middleware's proof.
+     */
+    const handlerMeta = (response) => withoutOutcomeMeta(response)._meta ?? {};
+    /**
+     * Stamp a result whose lifecycle a wrapper has run, so the outer layer
+     * neither re-proves nor re-audits it. Without an outer layer there is no
+     * token, nothing would strip the stamp, and the result is returned as it was.
+     */
+    const stampLifecycle = (response) => {
+        if (lifecycleStamp === undefined)
+            return response;
+        response._meta = {
+            ...(response._meta ?? {}),
+            [LIFECYCLE_STAMP_META_KEY]: lifecycleStamp,
+        };
+        return response;
+    };
     const auditContext = (context) => context === undefined
         ? undefined
         : {
@@ -163,11 +257,40 @@ export function createSessionProof(deps) {
             ...(result.error && { isError: true }),
         };
     }
+    // The store keeps an expired session until something deletes it, so its raw
+    // size overcounts live sessions: one stale session would leave the fallback
+    // ambiguous for good. A count above one triggers a sweep first, at most once
+    // per interval so a genuinely multi-client deployment does not scan the
+    // whole store on every unthreaded call.
+    const sessionSweepIntervalMs = 60_000;
+    let lastSessionSweepAt;
+    async function liveSessionCount() {
+        const count = sessionManager.getStats().activeSessions;
+        const now = Date.now();
+        if (count <= 1 ||
+            (lastSessionSweepAt !== undefined && now - lastSessionSweepAt < sessionSweepIntervalMs)) {
+            return count;
+        }
+        lastSessionSweepAt = now;
+        try {
+            await sessionManager.cleanup();
+        }
+        catch (error) {
+            logger.error("[kya-os] Session sweep failed", {
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return count;
+        }
+        return sessionManager.getStats().activeSessions;
+    }
+    // Concurrent first calls share one in-flight auto session: one per caller
+    // would leave several live sessions, and every later call ambiguous.
+    let autoSessionInFlight;
     async function ensureSession() {
         if (activeSessionId) {
             const existing = await sessionManager.getSession(activeSessionId);
             if (existing) {
-                if (sessionManager.getStats().activeSessions <= 1) {
+                if ((await liveSessionCount()) <= 1) {
                     return activeSessionId;
                 }
                 // Ambiguous: more than one session and none threaded — do NOT borrow.
@@ -179,6 +302,12 @@ export function createSessionProof(deps) {
         }
         if (!config.autoSession)
             return undefined;
+        autoSessionInFlight ??= createAutoSession().finally(() => {
+            autoSessionInFlight = undefined;
+        });
+        return autoSessionInFlight;
+    }
+    async function createAutoSession() {
         // Generate a server-side session with cryptographically random nonce (SPEC.md §4)
         const nonceBytes = await cryptoProvider.randomBytes(16);
         const nonce = base64urlEncodeFromBytes(nonceBytes);
@@ -195,7 +324,7 @@ export function createSessionProof(deps) {
         return undefined;
     }
     function wrapWithProof(toolName, handler) {
-        return async (args, sessionId, context) => {
+        const run = async (args, sessionId, context) => {
             const intentDelivered = await emitAudit('Required tool intent audit delivery failed', () => audit?.tool('started', {
                 toolName,
                 outcome: 'unknown',
@@ -277,8 +406,9 @@ export function createSessionProof(deps) {
                 const proof = await proofGenerator.generateProof(request, response, session, { scopeId: context?.scopeId, profile: responseProofProfile });
                 // Attach proof under the namespaced _meta key (rendered by MCP
                 // Inspector, invisible to LLMs), plus the legacy bare key when enabled.
-                // Other _meta keys may coexist (SEP-414).
-                result._meta = withProofMeta({}, proof);
+                // Keys the handler set (traceparent, related-task, ...) are kept: the
+                // middleware does not own `_meta` (SPEC §7.6).
+                result._meta = withProofMeta(handlerMeta(result), proof);
                 const proofAuditDelivered = await emitAudit('Required generated-proof audit delivery failed', () => audit?.proof('generated', {
                     outcome: 'succeeded',
                     context: auditContext(context),
@@ -318,6 +448,7 @@ export function createSessionProof(deps) {
                     error: error instanceof Error ? error.message : String(error),
                 });
                 result._meta = {
+                    ...handlerMeta(result),
                     proofError: "Proof generation failed — response is unproven",
                 };
                 const rejectionAuditDelivered = await emitAudit('Failed to record proof-generation rejection', () => audit?.proof('rejected', {
@@ -331,8 +462,13 @@ export function createSessionProof(deps) {
             }
             return result;
         };
+        return async (args, sessionId, context) => stampLifecycle(await run(args, sessionId, context));
     }
-    const attachOutcomeProof = async (response, toolName, args, sessionId, reason, outcome = "denied", paramsOverride, responseData) => {
+    outerProofLayerHooks.set(wrapWithProof, () => {
+        lifecycleStamp ??= base64urlEncodeFromBytes(globalThis.crypto.getRandomValues(new Uint8Array(16)));
+        return hasOwnStamp;
+    });
+    const outcomeProof = async (response, toolName, args, sessionId, reason, outcome = "denied", paramsOverride, responseData) => {
         const phase = outcome === 'denied' ? 'denied' : 'step_up_required';
         const reasonCode = outcome === 'needs_authorization'
             ? 'NEEDS_AUTHORIZATION'
@@ -424,6 +560,9 @@ export function createSessionProof(deps) {
         }
         return response;
     };
+    // Outcome results are stamped like wrapper results, so the outer layer
+    // passes a signed denial or challenge through instead of re-proving it.
+    const attachOutcomeProof = async (...outcome) => stampLifecycle(await outcomeProof(...outcome));
     return { handleHandshake, ensureSession, wrapWithProof, attachOutcomeProof };
 }
 //# sourceMappingURL=with-kya-os.session.js.map

package/dist/middleware/with-kya-os.session.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.session.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.session.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,+BAA+B,GAGhC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,GAExB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAwB9D,MAAM,UAAU,kBAAkB,CAAC,IAAoB;IACrD,MAAM,EACJ,QAAQ,EACR,MAAM,EACN,cAAc,EACd,cAAc,EACd,cAAc,EACd,QAAQ,EACR,KAAK,EACL,kBAAkB,EAClB,oBAAoB,GACrB,GAAG,IAAI,CAAC;IACT,MAAM,aAAa,GAAG,oBAAoB,KAAK,+BAA+B,CAAC;IAC/E,MAAM,wBAAwB,GAAG,IAAI,OAAO,EAAU,CAAC;IACvD,MAAM,YAAY,GAAG,kBAAkB,CAAC;IAIxC,MAAM,SAAS,GAAG,KAAK,EACrB,KAAa,EACb,SAA0C,EAC1C,QAAiB,EACC,EAAE;QACpB,IAAI,CAAC;YACH,MAAM,SAAS,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,EAAE,EAAE;gBAChC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;gBACrD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,CACxB,QAA6B,EAC7B,MAAc,EACd,iBAA0B,EACL,EAAE;QACvB,MAAM,QAAQ,GAAG;YACf,GAAG,CAAE,QAAQ,CAAC,KAA6C,IAAI,EAAE,CAAC;SACnE,CAAC;QACF,IAAI,iBAAiB,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC,qBAAqB,CAAC,CAAC;YACvC,OAAO,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,QAAQ,CAAC,YAAY,CAAC,GAAG;YACvB,GAAG,CAAC,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,IAAI;gBAC/E,CAAC,CAAC,QAAQ,CAAC,YAAY,CAA4B;gBACnD,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,UAAU;YAClB,MAAM;SACP,CAAC;QACF,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC;QAC1B,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,wBAAwB,GAAG,CAAC,MAAc,EAAuB,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,EAAE;iBAC1D,CAAC;aACH,CAAC;QACF,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE;KAC1D,CAAC,CAAC;IAEH,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,6BAA6B;IAC7B,MAAM,sBAAsB,GAAG,CAAC,QAA6B,EAAW,EAAE;QACxE,IAAI,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAA4C,CAAC;QACvE,MAAM,aAAa,GAAG,QAAQ,EAAE,CAAC,YAAY,CAAC,CAAC;QAC/C,OAAO,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI;YAC/D,aAAyC,CAAC,QAAQ,KAAK,IAAI,CAAC;IACjE,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CACnB,OAAqC,EACR,EAAE,CAAC,OAAO,KAAK,SAAS;QACrD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC;YACE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAChE,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACnD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;SACnF,CAAC;IAEN;;;;OAIG;IACH,MAAM,aAAa,GAAG,CACpB,IAA6B,EAC7B,KAAoB,EACK,EAAE,CAAC,CAAC;QAC7B,GAAG,IAAI;QACP,CAAC,qBAAqB,CAAC,EAAE,KAAK;QAC9B,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC,CAAC;IAEH,gFAAgF;IAChF,iFAAiF;IACjF,iFAAiF;IACjF,iFAAiF;IACjF,kCAAkC;IAClC,IAAI,eAAmC,CAAC;IAExC,KAAK,UAAU,eAAe,CAAC,IAA6B;QAI1D,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,SAAS,CACb,+CAA+C,EAC/C,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE;gBAC/B,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,kBAAkB,CAAC,gBAAgB;aAChD,CAAC,CACH,CAAC;YACF,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,OAAO,EAAE,KAAK;4BACd,KAAK,EAAE;gCACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;gCACzC,OAAO,EACL,wGAAwG;6BAC3G;yBACF,CAAC;qBACH;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GACV,MAAM,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAE/C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO;YAC/B,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,KAAK,kBAAkB,CAAC,YAAY;gBACtD,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,UAAU,CAAC;QACjB,MAAM,qBAAqB,GAAG,MAAM,SAAS,CAC3C,oBAAoB,UAAU,sBAAsB,EACpD,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE;YAC/B,SAAS,EAAE,MAAM,CAAC,OAAO;YACzB,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SACzE,CAAC,CACH,CAAC;QAEF,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,wBAAwB,CACrC,mEAAmE,CACpE,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACpD,CAAC;QAED,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7C,CAAC;QAED,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI;4BACpB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;4BACnC,SAAS,EAAE,QAAQ,CAAC,GAAG;4BACvB,SAAS,EAAE,QAAQ,CAAC,GAAG;yBACxB,CAAC;wBACF,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;qBAC7C,CAAC;iBACH;aACF;YACD,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACvC,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,aAAa;QAC1B,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAClE,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC,cAAc,IAAI,CAAC,EAAE,CAAC;oBAClD,OAAO,eAAe,CAAC;gBACzB,CAAC;gBACD,sEAAsE;gBACtE,MAAM,CAAC,IAAI,CACT,wEAAwE;oBACtE,oEAAoE;oBACpE,oEAAoE,CACvE,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAE1C,kFAAkF;QAClF,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,iBAAiB,CAAC;YACpD,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,GAAG;YACtB,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;YAC3C,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,SAAS,aAAa,CACpB,QAAgB,EAChB,OAA4B;QAE5B,OAAO,KAAK,EACV,IAA6B,EAC7B,SAAkB,EAClB,OAA0B,EAC1B,EAAE;YACF,MAAM,eAAe,GAAG,MAAM,SAAS,CACrC,4CAA4C,EAC5C,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;gBAC3B,QAAQ;gBACR,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;aAC/B,CAAC,EACF,QAAQ,CACT,CAAC;YACF,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,OAAO,wBAAwB,CAC7B,6DAA6D,CAC9D,CAAC;YACJ,CAAC;YACD,IAAI,MAA6C,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,OAAO,CAAC,IAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,SAAS,CACb,yEAAyE,EACzE,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;oBAC1B,QAAQ;oBACR,OAAO,EAAE,QAAQ;oBACjB,UAAU,EAAE,gBAAgB;oBAC5B,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,MAAM,KAAK,CAAC;YACd,CAAC;YAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpC,MAAM,SAAS,GAAG,MAAM,SAAS,CAC/B,qCAAqC,EACrC,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;wBAC1B,QAAQ;wBACR,OAAO,EAAE,QAAQ;wBACjB,UAAU,EAAE,sBAAsB;wBAClC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;qBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;oBACF,IAAI,CAAC,SAAS,EAAE,CAAC;wBACf,iBAAiB,CACf,MAAM,EACN,+DAA+D,EAC/D,KAAK,CACN,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,iEAAiE;YACjE,MAAM,iBAAiB,GAAG,SAAS,IAAI,MAAM,aAAa,EAAE,CAAC;YAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,mBAAmB,GAAG,MAAM,SAAS,CACzC,4CAA4C,EAC5C,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,QAAQ;oBACjB,gBAAgB,EAAE,2BAA2B;oBAC7C,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,MAAM,sBAAsB,GAAG,mBAAmB,IAAI,MAAM,SAAS,CACnE,yCAAyC,EACzC,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC7B,QAAQ;oBACR,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;oBAC5B,OAAO,iBAAiB,CACtB,MAAM,EACN,+DAA+D,EAC/D,IAAI,CACL,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,mBAAmB,GAAG,MAAM,SAAS,CACzC,wCAAwC,EACxC,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,QAAQ;oBACjB,gBAAgB,EAAE,yBAAyB;oBAC3C,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,MAAM,sBAAsB,GAAG,mBAAmB,IAAI,MAAM,SAAS,CACnE,yCAAyC,EACzC,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC7B,QAAQ;oBACR,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;oBAC5B,OAAO,iBAAiB,CACtB,MAAM,EACN,+DAA+D,EAC/D,IAAI,CACL,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBAChE,oFAAoF;gBACpF,iFAAiF;gBACjF,mDAAmD;gBACnD,MAAM,QAAQ,GAAiB;oBAC7B,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO;iBAC9C,CAAC;gBAEF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,aAAa,CAC9C,OAAO,EACP,QAAQ,EACR,OAAO,EACP,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAC7D,CAAC;gBAEF,+DAA+D;gBAC/D,wEAAwE;gBACxE,0CAA0C;gBAC1C,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBAExC,MAAM,mBAAmB,GAAG,MAAM,SAAS,CACzC,gDAAgD,EAChD,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;oBAC9B,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,MAAM,sBAAsB,GAAG,mBAAmB,IAAI,MAAM,SAAS,CACnE,+CAA+C,EAC/C,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC7B,QAAQ;oBACR,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;oBAC5B,OAAO,iBAAiB,CACtB,MAAM,EACN,+DAA+D,EAC/D,IAAI,CACL,CAAC;gBACJ,CAAC;gBAED,oEAAoE;gBACpE,0DAA0D;gBAC1D,IAAI,CAAC;oBACH,MAAM,QAAQ,CAAC,cAAc,CAAC;wBAC5B,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE;wBAClD,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;wBACrE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;wBACnC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;wBACrC,QAAQ,EAAE,KAAK;wBACf,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;qBAC5B,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;wBACxC,IAAI,EAAE,QAAQ;wBACd,KAAK,EACH,UAAU,YAAY,KAAK;4BACzB,CAAC,CAAC,UAAU,CAAC,OAAO;4BACpB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;oBAC/C,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,MAAM,CAAC,KAAK,GAAG;oBACb,UAAU,EAAE,gDAAgD;iBAC7D,CAAC;gBACF,MAAM,uBAAuB,GAAG,MAAM,SAAS,CAC7C,6CAA6C,EAC7C,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,QAAQ;oBACjB,gBAAgB,EAAE,yBAAyB;oBAC3C,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,uBAAuB,EAAE,CAAC;oBAC7B,iBAAiB,CACf,MAAM,EACN,oEAAoE,EACpE,IAAI,CACL,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GAAuB,KAAK,EAClD,QAAQ,EACR,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,EACN,OAAO,GAAG,QAAQ,EAClB,cAAc,EACd,YAAY,EACZ,EAAE;QACF,MAAM,KAAK,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACnE,MAAM,UAAU,GAAG,OAAO,KAAK,qBAAqB;YAClD,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,OAAO,KAAK,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,sBAAsB,CAAC;QACjF,MAAM,2BAA2B,GAAG,MAAM,SAAS,CACjD,wCAAwC,EACxC,GAAG,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE;YAChC,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;YACvD,UAAU;SACX,CAAC,EACF,QAAQ,CACT,CAAC;QACF,MAAM,sBAAsB,GAAG,2BAA2B,IAAI,MAAM,SAAS,CAC3E,sDAAsD,EACtD,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE;YAChE,QAAQ;YACR,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;YACvD,UAAU;SACX,CAAC,EACF,QAAQ,CACT,CAAC;QACF,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,QAAQ,CAAC,KAAK,GAAG;YACf,GAAG,CAAE,QAAQ,CAAC,KAA6C,IAAI,EAAE,CAAC;YAClE,CAAC,YAAY,CAAC,EAAE;gBACd,QAAQ,EAAE,IAAI;gBACd,OAAO;gBACP,GAAG,CAAC,CAAC,sBAAsB;oBACzB,CAAC,CAAC;wBACE,MAAM,EAAE,UAAU;wBAClB,MAAM,EAAE,mEAAmE;qBAC5E;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAC;QACF,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,SAAS,IAAI,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,iBAAiB;gBAAE,OAAO,QAAQ,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,CAAC,OAAO;gBAAE,OAAO,QAAQ,CAAC;YAE9B,sEAAsE;YACtE,gEAAgE;YAChE,IAAI,SAAkC,CAAC;YACvC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,SAAS,GAAG,cAAc,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,EAAE,CAAC;gBACf,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,IAAI,CAAC,KAAK,mBAAmB;wBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACrE,uEAAuE;YACvE,oEAAoE;YACpE,sEAAsE;YACtE,qFAAqF;YACrF,oFAAoF;YACpF,wCAAwC;YACxC,MAAM,aAAa,GACjB,YAAY,KAAK,SAAS;gBACxB,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE;gBACnD,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE;gBAChF,OAAO;gBACP,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC;gBAClC,OAAO,EAAE,oBAAoB;aAC9B,CAAC,CAAC;YACH,QAAQ,CAAC,KAAK,GAAG,aAAa,CAC3B,QAAQ,CAAC,KAA6C,IAAI,EAAE,EAC7D,KAAK,CACN,CAAC;YACF,IAAI,sBAAsB,EAAE,CAAC;gBAC3B,MAAM,mBAAmB,GAAG,MAAM,SAAS,CACzC,0CAA0C,EAC1C,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EACzD,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzB,+EAA+E;oBAC/E,8DAA8D;oBAC9D,+EAA+E;oBAC/E,mEAAmE;oBACnE,gEAAgE;oBAChE,iEAAiE;oBACjE,gFAAgF;oBAChF,iBAAiB,CACf,QAAQ,EACR,gEAAgE,EAChE,aAAa,CACd,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE;gBACvD,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,IAAI,sBAAsB,EAAE,CAAC;gBAC3B,MAAM,SAAS,CACb,0CAA0C,EAC1C,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,QAAQ;oBACjB,gBAAgB,EAAE,iCAAiC;iBACpD,CAAC,EACF,QAAQ,CACT,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC;AAC/E,CAAC"}
+{"version":3,"file":"with-kya-os.session.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.session.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,qBAAqB,EACrB,gCAAgC,EAChC,qBAAqB,EACrB,+BAA+B,GAGhC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,GAExB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAG9D,4EAA4E;AAC5E,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;AAErE;;;;;GAKG;AACH,MAAM,eAAe,GAAsB;IACzC,qBAAqB;IACrB,gCAAgC;IAChC,qBAAqB;IACrB,YAAY;IACZ,YAAY;IACZ,wBAAwB;CACzB,CAAC;AAIF,gGAAgG;AAChG,SAAS,eAAe,CAAuB,MAAS,EAAE,IAAuB;IAC/E,MAAM,QAAQ,GAAG,MAAM,CAAC,KAA4C,CAAC;IACrE,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAC7B,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAChE,CAAC;IACF,MAAM,IAAI,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IACpD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC;IACvB,OAAO,IAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAuB,MAAS;IAChE,OAAO,eAAe,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAClD,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,qBAAqB,CAAuB,MAAS;IACnE,OAAO,eAAe,CAAC,MAAM,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,IAAI,OAAO,EAAiD,CAAC;AAE1F;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAAqB;IAErB,OAAO,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;AACrD,CAAC;AAuBD,MAAM,UAAU,kBAAkB,CAAC,IAAoB;IACrD,MAAM,EACJ,QAAQ,EACR,MAAM,EACN,cAAc,EACd,cAAc,EACd,cAAc,EACd,QAAQ,EACR,KAAK,EACL,kBAAkB,EAClB,oBAAoB,GACrB,GAAG,IAAI,CAAC;IACT,MAAM,aAAa,GAAG,oBAAoB,KAAK,+BAA+B,CAAC;IAC/E,MAAM,wBAAwB,GAAG,IAAI,OAAO,EAAU,CAAC;IACvD,0EAA0E;IAC1E,qEAAqE;IACrE,IAAI,cAAkC,CAAC;IAEvC,MAAM,WAAW,GAAG,CAAC,QAAoB,EAAW,EAAE,CACpD,cAAc,KAAK,SAAS;QAC3B,QAAQ,CAAC,KAA6C,EAAE,CAAC,wBAAwB,CAAC,KAAK,cAAc,CAAC;IAIzG,MAAM,SAAS,GAAG,KAAK,EACrB,KAAa,EACb,SAA0C,EAC1C,QAAiB,EACC,EAAE;QACpB,IAAI,CAAC;YACH,MAAM,SAAS,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,EAAE,EAAE;gBAChC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;gBACrD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,CACxB,QAA6B,EAC7B,MAAc,EACd,iBAA0B,EACL,EAAE;QACvB,MAAM,QAAQ,GAAG;YACf,GAAG,CAAE,QAAQ,CAAC,KAA6C,IAAI,EAAE,CAAC;SACnE,CAAC;QACF,IAAI,iBAAiB,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC,qBAAqB,CAAC,CAAC;YACvC,OAAO,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,QAAQ,CAAC,YAAY,CAAC,GAAG;YACvB,GAAG,CAAC,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,IAAI;gBAC/E,CAAC,CAAC,QAAQ,CAAC,YAAY,CAA4B;gBACnD,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,UAAU;YAClB,MAAM;SACP,CAAC;QACF,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC;QAC1B,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,wBAAwB,GAAG,CAAC,MAAc,EAAuB,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,EAAE;iBAC1D,CAAC;aACH,CAAC;QACF,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE;KAC1D,CAAC,CAAC;IAEH,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,6BAA6B;IAC7B,MAAM,sBAAsB,GAAG,CAAC,QAA6B,EAAW,EAAE;QACxE,IAAI,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAA4C,CAAC;QACvE,MAAM,aAAa,GAAG,QAAQ,EAAE,CAAC,YAAY,CAAC,CAAC;QAC/C,OAAO,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI;YAC/D,aAAyC,CAAC,QAAQ,KAAK,IAAI,CAAC;IACjE,CAAC,CAAC;IAEF;;;;;OAKG;IACH,MAAM,WAAW,GAAG,CAAC,QAA6B,EAA2B,EAAE,CAC5E,kBAAkB,CAAC,QAAQ,CAAC,CAAC,KAA6C,IAAI,EAAE,CAAC;IAEpF;;;;OAIG;IACH,MAAM,cAAc,GAAG,CAAC,QAA6B,EAAuB,EAAE;QAC5E,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAClD,QAAQ,CAAC,KAAK,GAAG;YACf,GAAG,CAAE,QAAQ,CAAC,KAA6C,IAAI,EAAE,CAAC;YAClE,CAAC,wBAAwB,CAAC,EAAE,cAAc;SAC3C,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CACnB,OAAqC,EACR,EAAE,CAAC,OAAO,KAAK,SAAS;QACrD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC;YACE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAChE,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACnD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;SACnF,CAAC;IAEN;;;;OAIG;IACH,MAAM,aAAa,GAAG,CACpB,IAA6B,EAC7B,KAAoB,EACK,EAAE,CAAC,CAAC;QAC7B,GAAG,IAAI;QACP,CAAC,qBAAqB,CAAC,EAAE,KAAK;QAC9B,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC,CAAC;IAEH,gFAAgF;IAChF,iFAAiF;IACjF,iFAAiF;IACjF,iFAAiF;IACjF,kCAAkC;IAClC,IAAI,eAAmC,CAAC;IAExC,KAAK,UAAU,eAAe,CAAC,IAA6B;QAI1D,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,SAAS,CACb,+CAA+C,EAC/C,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE;gBAC/B,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,kBAAkB,CAAC,gBAAgB;aAChD,CAAC,CACH,CAAC;YACF,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,OAAO,EAAE,KAAK;4BACd,KAAK,EAAE;gCACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;gCACzC,OAAO,EACL,wGAAwG;6BAC3G;yBACF,CAAC;qBACH;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GACV,MAAM,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAE/C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO;YAC/B,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,KAAK,kBAAkB,CAAC,YAAY;gBACtD,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,UAAU,CAAC;QACjB,MAAM,qBAAqB,GAAG,MAAM,SAAS,CAC3C,oBAAoB,UAAU,sBAAsB,EACpD,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE;YAC/B,SAAS,EAAE,MAAM,CAAC,OAAO;YACzB,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SACzE,CAAC,CACH,CAAC;QAEF,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,wBAAwB,CACrC,mEAAmE,CACpE,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACpD,CAAC;QAED,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7C,CAAC;QAED,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI;4BACpB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;4BACnC,SAAS,EAAE,QAAQ,CAAC,GAAG;4BACvB,SAAS,EAAE,QAAQ,CAAC,GAAG;yBACxB,CAAC;wBACF,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;qBAC7C,CAAC;iBACH;aACF;YACD,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACvC,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,wCAAwC;IACxC,MAAM,sBAAsB,GAAG,MAAM,CAAC;IACtC,IAAI,kBAAsC,CAAC;IAE3C,KAAK,UAAU,gBAAgB;QAC7B,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IACE,KAAK,IAAI,CAAC;YACV,CAAC,kBAAkB,KAAK,SAAS,IAAI,GAAG,GAAG,kBAAkB,GAAG,sBAAsB,CAAC,EACvF,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,kBAAkB,GAAG,GAAG,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,OAAO,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;gBAC5C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,cAAc,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC;IAClD,CAAC;IAED,0EAA0E;IAC1E,qEAAqE;IACrE,IAAI,mBAA4D,CAAC;IAEjE,KAAK,UAAU,aAAa;QAC1B,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAClE,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,gBAAgB,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpC,OAAO,eAAe,CAAC;gBACzB,CAAC;gBACD,sEAAsE;gBACtE,MAAM,CAAC,IAAI,CACT,wEAAwE;oBACtE,oEAAoE;oBACpE,oEAAoE,CACvE,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAE1C,mBAAmB,KAAK,iBAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACvD,mBAAmB,GAAG,SAAS,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,KAAK,UAAU,iBAAiB;QAC9B,kFAAkF;QAClF,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,iBAAiB,CAAC;YACpD,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,GAAG;YACtB,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;YAC3C,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,SAAS,aAAa,CACpB,QAAgB,EAChB,OAA4B;QAE5B,MAAM,GAAG,GAAG,KAAK,EACf,IAA6B,EAC7B,SAAkB,EAClB,OAA0B,EACI,EAAE;YAChC,MAAM,eAAe,GAAG,MAAM,SAAS,CACrC,4CAA4C,EAC5C,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;gBAC3B,QAAQ;gBACR,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;aAC/B,CAAC,EACF,QAAQ,CACT,CAAC;YACF,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,OAAO,wBAAwB,CAC7B,6DAA6D,CAC9D,CAAC;YACJ,CAAC;YACD,IAAI,MAA6C,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,OAAO,CAAC,IAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,SAAS,CACb,yEAAyE,EACzE,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;oBAC1B,QAAQ;oBACR,OAAO,EAAE,QAAQ;oBACjB,UAAU,EAAE,gBAAgB;oBAC5B,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,MAAM,KAAK,CAAC;YACd,CAAC;YAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpC,MAAM,SAAS,GAAG,MAAM,SAAS,CAC/B,qCAAqC,EACrC,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;wBAC1B,QAAQ;wBACR,OAAO,EAAE,QAAQ;wBACjB,UAAU,EAAE,sBAAsB;wBAClC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;qBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;oBACF,IAAI,CAAC,SAAS,EAAE,CAAC;wBACf,iBAAiB,CACf,MAAM,EACN,+DAA+D,EAC/D,KAAK,CACN,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,iEAAiE;YACjE,MAAM,iBAAiB,GAAG,SAAS,IAAI,MAAM,aAAa,EAAE,CAAC;YAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,mBAAmB,GAAG,MAAM,SAAS,CACzC,4CAA4C,EAC5C,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,QAAQ;oBACjB,gBAAgB,EAAE,2BAA2B;oBAC7C,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,MAAM,sBAAsB,GAAG,mBAAmB,IAAI,MAAM,SAAS,CACnE,yCAAyC,EACzC,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC7B,QAAQ;oBACR,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;oBAC5B,OAAO,iBAAiB,CACtB,MAAM,EACN,+DAA+D,EAC/D,IAAI,CACL,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,mBAAmB,GAAG,MAAM,SAAS,CACzC,wCAAwC,EACxC,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,QAAQ;oBACjB,gBAAgB,EAAE,yBAAyB;oBAC3C,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,MAAM,sBAAsB,GAAG,mBAAmB,IAAI,MAAM,SAAS,CACnE,yCAAyC,EACzC,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC7B,QAAQ;oBACR,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;oBAC5B,OAAO,iBAAiB,CACtB,MAAM,EACN,+DAA+D,EAC/D,IAAI,CACL,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBAChE,oFAAoF;gBACpF,iFAAiF;gBACjF,mDAAmD;gBACnD,MAAM,QAAQ,GAAiB;oBAC7B,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO;iBAC9C,CAAC;gBAEF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,aAAa,CAC9C,OAAO,EACP,QAAQ,EACR,OAAO,EACP,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAC7D,CAAC;gBAEF,+DAA+D;gBAC/D,wEAAwE;gBACxE,sEAAsE;gBACtE,+CAA+C;gBAC/C,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;gBAEzD,MAAM,mBAAmB,GAAG,MAAM,SAAS,CACzC,gDAAgD,EAChD,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;oBAC9B,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,MAAM,sBAAsB,GAAG,mBAAmB,IAAI,MAAM,SAAS,CACnE,+CAA+C,EAC/C,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC7B,QAAQ;oBACR,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;oBAC5B,OAAO,iBAAiB,CACtB,MAAM,EACN,+DAA+D,EAC/D,IAAI,CACL,CAAC;gBACJ,CAAC;gBAED,oEAAoE;gBACpE,0DAA0D;gBAC1D,IAAI,CAAC;oBACH,MAAM,QAAQ,CAAC,cAAc,CAAC;wBAC5B,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE;wBAClD,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;wBACrE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;wBACnC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;wBACrC,QAAQ,EAAE,KAAK;wBACf,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;qBAC5B,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;wBACxC,IAAI,EAAE,QAAQ;wBACd,KAAK,EACH,UAAU,YAAY,KAAK;4BACzB,CAAC,CAAC,UAAU,CAAC,OAAO;4BACpB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;oBAC/C,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,MAAM,CAAC,KAAK,GAAG;oBACb,GAAG,WAAW,CAAC,MAAM,CAAC;oBACtB,UAAU,EAAE,gDAAgD;iBAC7D,CAAC;gBACF,MAAM,uBAAuB,GAAG,MAAM,SAAS,CAC7C,6CAA6C,EAC7C,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,QAAQ;oBACjB,gBAAgB,EAAE,yBAAyB;oBAC3C,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,uBAAuB,EAAE,CAAC;oBAC7B,iBAAiB,CACf,MAAM,EACN,oEAAoE,EACpE,IAAI,CACL,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QACF,OAAO,KAAK,EACV,IAA6B,EAC7B,SAAkB,EAClB,OAA0B,EAC1B,EAAE,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,oBAAoB,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3C,cAAc,KAAK,wBAAwB,CACzC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CACtD,CAAC;QACF,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAuB,KAAK,EAC5C,QAAQ,EACR,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,EACN,OAAO,GAAG,QAAQ,EAClB,cAAc,EACd,YAAY,EACZ,EAAE;QACF,MAAM,KAAK,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACnE,MAAM,UAAU,GAAG,OAAO,KAAK,qBAAqB;YAClD,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,OAAO,KAAK,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,sBAAsB,CAAC;QACjF,MAAM,2BAA2B,GAAG,MAAM,SAAS,CACjD,wCAAwC,EACxC,GAAG,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE;YAChC,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;YACvD,UAAU;SACX,CAAC,EACF,QAAQ,CACT,CAAC;QACF,MAAM,sBAAsB,GAAG,2BAA2B,IAAI,MAAM,SAAS,CAC3E,sDAAsD,EACtD,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE;YAChE,QAAQ;YACR,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;YACvD,UAAU;SACX,CAAC,EACF,QAAQ,CACT,CAAC;QACF,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,QAAQ,CAAC,KAAK,GAAG;YACf,GAAG,CAAE,QAAQ,CAAC,KAA6C,IAAI,EAAE,CAAC;YAClE,CAAC,YAAY,CAAC,EAAE;gBACd,QAAQ,EAAE,IAAI;gBACd,OAAO;gBACP,GAAG,CAAC,CAAC,sBAAsB;oBACzB,CAAC,CAAC;wBACE,MAAM,EAAE,UAAU;wBAClB,MAAM,EAAE,mEAAmE;qBAC5E;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAC;QACF,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,SAAS,IAAI,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,iBAAiB;gBAAE,OAAO,QAAQ,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,CAAC,OAAO;gBAAE,OAAO,QAAQ,CAAC;YAE9B,sEAAsE;YACtE,gEAAgE;YAChE,IAAI,SAAkC,CAAC;YACvC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,SAAS,GAAG,cAAc,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,EAAE,CAAC;gBACf,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,IAAI,CAAC,KAAK,mBAAmB;wBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACrE,uEAAuE;YACvE,oEAAoE;YACpE,sEAAsE;YACtE,qFAAqF;YACrF,oFAAoF;YACpF,wCAAwC;YACxC,MAAM,aAAa,GACjB,YAAY,KAAK,SAAS;gBACxB,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE;gBACnD,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE;gBAChF,OAAO;gBACP,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC;gBAClC,OAAO,EAAE,oBAAoB;aAC9B,CAAC,CAAC;YACH,QAAQ,CAAC,KAAK,GAAG,aAAa,CAC3B,QAAQ,CAAC,KAA6C,IAAI,EAAE,EAC7D,KAAK,CACN,CAAC;YACF,IAAI,sBAAsB,EAAE,CAAC;gBAC3B,MAAM,mBAAmB,GAAG,MAAM,SAAS,CACzC,0CAA0C,EAC1C,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EACzD,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzB,+EAA+E;oBAC/E,8DAA8D;oBAC9D,+EAA+E;oBAC/E,mEAAmE;oBACnE,gEAAgE;oBAChE,iEAAiE;oBACjE,gFAAgF;oBAChF,iBAAiB,CACf,QAAQ,EACR,gEAAgE,EAChE,aAAa,CACd,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE;gBACvD,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,IAAI,sBAAsB,EAAE,CAAC;gBAC3B,MAAM,SAAS,CACb,0CAA0C,EAC1C,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,QAAQ;oBACjB,gBAAgB,EAAE,iCAAiC;iBACpD,CAAC,EACF,QAAQ,CACT,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,kBAAkB,GAAuB,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,CAClE,cAAc,CAAC,MAAM,YAAY,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAEjD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC;AAC/E,CAAC"}

package/dist/middleware/with-kya-os.types.d.ts

@@ -38,6 +38,24 @@ export interface KyaOsCallContext {
     authorization?: AuthorizationEvidence;
     correlationId?: string;
     causationId?: string;
+    /**
+     * The principal `wrapWithDelegation` authenticated: the delegation subject,
+     * its controller, and the scopes the verified credential (or durable grant)
+     * carries. A composed `withPolicyGate` evaluates these instead of re-reading
+     * `_kyaos_delegation`, which the delegation gate has already stripped.
+     */
+    principal?: {
+        agentDid: string;
+        responsibleParty?: string;
+        delegatedScopes: readonly string[];
+    };
+    /**
+     * Approval grants the caller supplied as `_kyaos_approvals`. The delegation
+     * gate withholds every `_kyaos*` argument from the handler (and from the
+     * holder-binding hash), so it forwards these here for a composed
+     * `withPolicyGate` to verify on a step-up resume.
+     */
+    approvals?: unknown;
 }
 export interface KyaOsToolHandler<T extends Record<string, unknown> = Record<string, unknown>> {
     (args: T, sessionId?: string, context?: KyaOsCallContext): Promise<{
@@ -164,7 +182,12 @@ export interface PolicyGateOptions {
     classifier?: RiskClassifier;
     /** Derive the resource namespace from the tool args (defaults to the tool name). */
     resolveNamespace?: (args: Record<string, unknown>) => string;
-    /** Tool-arg key carrying approval grants on resume. Default "_kyaos_approvals". */
+    /**
+     * Tool-arg key carrying approval grants on resume. Default "_kyaos_approvals".
+     * Composed after `wrapWithDelegation`, the default key arrives through the
+     * call context (the outer gate strips `_kyaos*` arguments); a custom key
+     * outside that prefix passes through as an ordinary argument.
+     */
     approvalsArgKey?: string;
     /** Verifier for approval-grant signatures (identity-layer). Default: reject all. */
     isValidApprovalSignature?: (grant: ApprovalGrant) => Promise<boolean>;
@@ -175,10 +198,10 @@ export interface PolicyGateOptions {
      * scope or identity, so it must NOT be trusted to allow on its own. When you
      * compose it AFTER wrapWithDelegation (the expected usage), pass
      * `scopeMatched: true` to signal that the delegated scope was already verified.
-     * Note: principal facts are projected from the (unverified) `_kyaos_delegation`
-     * arg on a best-effort basis and must not be treated as authenticated unless
-     * wrapWithDelegation ran first.
+     * Composed that way, the engine sees the principal and scopes the delegation
+     * gate authenticated (via the call context). Used standalone, principal facts
+     * are projected from the (unverified) `_kyaos_delegation` arg on a best-effort
+     * basis and must not be treated as authenticated.
      */
     scopeMatched?: boolean;
 }
-//# sourceMappingURL=with-kya-os.types.d.ts.map

package/dist/policy/approval.d.ts

@@ -19,6 +19,14 @@ export interface ApprovalGrant {
 export interface QuorumResult {
     satisfied: boolean;
     reason?: string;
+    /**
+     * The distinct approver DIDs whose grants verified (allowlisted, bound to the
+     * request, signature accepted), whether or not they reached the quorum. The
+     * only set a policy engine's `humanApprovals` should be built from.
+     * `verifyApprovalQuorum` always sets it; it is optional so that code
+     * building its own `QuorumResult` keeps compiling.
+     */
+    approvers?: string[];
 }
 export interface Quorum {
     n: number;
@@ -29,6 +37,9 @@ export interface Quorum {
  * Quorum is satisfied iff at least `quorum.n` DISTINCT approvers each signed an
  * `approve` grant over EXACTLY `requestHash`, drawn from `quorum.approvers`
  * (empty = any), with a signature accepted by `isValidSignature`.
+ *
+ * `requestHash` may list several hashes when they all identify the one
+ * suspended action, as the hashes of its legacy and SPEC §7.3 request shapes
+ * do; a grant over any of them counts.
  */
-export declare function verifyApprovalQuorum(grants: ApprovalGrant[], requestHash: string, quorum: Quorum, isValidSignature: (g: ApprovalGrant) => Promise<boolean>): Promise<QuorumResult>;
-//# sourceMappingURL=approval.d.ts.map
+export declare function verifyApprovalQuorum(grants: ApprovalGrant[], requestHash: string | readonly string[], quorum: Quorum, isValidSignature: (g: ApprovalGrant) => Promise<boolean>): Promise<QuorumResult>;