@kya-os/mcp 1.16.1 → 1.17.0

package/dist/proof/verifier.d.ts

@@ -19,13 +19,29 @@ export interface ProofVerificationResult {
     errorCode?: ProofVerificationErrorCode;
     details?: Record<string, unknown>;
 }
+/** Who a verified proof must come from and be addressed to. */
+export interface ProofVerificationOptions {
+    /** `meta.did` must equal this: the signer the caller expects (e.g. the server it called). */
+    expectedDid?: string;
+    /** `meta.audience` must equal this, or be one of the array (DID rotation, multi-DID servers). */
+    expectedAudience?: string | string[];
+}
 export interface ProofVerifierConfig {
     cryptoProvider: CryptoProvider;
     clockProvider: ClockProvider;
     nonceCacheProvider: NonceCacheProvider;
     fetchProvider: FetchProvider;
     timestampSkewSeconds?: number;
+    /**
+     * Minimum retention in seconds; raised to cover the proof's accepted lifetime
+     * and supported skew updates. 0 keeps each nonce for that window only.
+     */
     nonceTtlSeconds?: number;
+    /**
+     * Refuse nonce caches without an atomic `consume()` instead of falling back
+     * to `has()` then `add()`. The constructor throws for such a cache.
+     */
+    requireAtomicNonce?: boolean;
 }
 /** Default timestamp skew for proof verification (seconds) */
 export declare const DEFAULT_CLOCK_SKEW_SECONDS = 120;
@@ -40,6 +56,7 @@ export declare class ProofVerifier {
     private fetch;
     private timestampSkewSeconds;
     private nonceTtlSeconds;
+    private requireAtomicNonce;
     private cryptoProvider;
     constructor(config: ProofVerifierConfig);
     /**
@@ -79,13 +96,20 @@ export declare class ProofVerifier {
      *   `content` array); for an envelope-profile proof (`prf: "org.kya-os/response-proof.envelope"`)
      *   pass the ENTIRE received result object — the verifier removes the
      *   top-level `_meta` member itself, so passing the result as received (proof
-     *   attachment included) is correct.
+     *   attachment included) is correct. Pass the `request` either as the
+     *   `tools/call` request you sent (`{method: "tools/call", params: {name,
+     *   arguments}}`) or in the legacy `{method: <tool name>, params: <arguments>}`
+     *   shape: a `requestHash` over either shape of that call is accepted (SPEC
+     *   §7.3; 1.x producers sign the legacy shape).
+     * @param options - Optional signer binding: the `did` the proof must come
+     *   from and the `audience` it must be addressed to. Independently of these,
+     *   a `kid` naming a key of a DID other than `meta.did` always fails.
      * @returns Verification result
      */
     verifyProof(proof: DetachedProof, publicKeyJwk: Ed25519JWK, expected?: {
         request: ToolRequest;
         response?: ToolResponse;
-    }): Promise<ProofVerificationResult>;
+    }, options?: ProofVerificationOptions): Promise<ProofVerificationResult>;
     /**
      * Verify a retained proof as historical evidence.
      *
@@ -99,7 +123,16 @@ export declare class ProofVerifier {
         response?: ToolResponse;
     }): Promise<ProofVerificationResult>;
     /**
-     * Verify proof with detached payload (for CLI/verifier compatibility)
+     * Verify proof with detached payload (for CLI/verifier compatibility).
+     *
+     * The timestamp and replay checks read `proof.meta`, so the payload the
+     * signature is checked over must be the one rebuilt from that meta: a
+     * supplied payload that differs from it byte for byte is rejected. Otherwise
+     * an accepted proof could be replayed with a fresh `meta.nonce` and the old
+     * payload.
+     *
+     * @deprecated Use {@link verifyProof}. It rebuilds the payload from
+     *   `proof.meta` itself, so supplying the payload adds nothing.
      * @param proof - The proof to verify
      * @param canonicalPayload - Canonical JSON payload (for detached JWS) as string or Uint8Array
      * @param publicKeyJwk - Ed25519 public key in JWK format
@@ -107,10 +140,19 @@ export declare class ProofVerifier {
      */
     verifyProofDetached(proof: DetachedProof, canonicalPayload: string | Uint8Array, publicKeyJwk: Ed25519JWK): Promise<ProofVerificationResult>;
     /**
-     * Shared verification pipeline for proof verification
+     * Shared verification pipeline for a structurally valid proof.
      * @private
      */
     private runVerificationPipeline;
+    /**
+     * Bind the signing key to the principal. `kid` names the signing key; when
+     * it is an absolute DID URL its DID part must be `meta.did`, or a proof could
+     * claim a victim's DID while being signed by a key another DID publishes. A
+     * relative `kid` is resolved against `meta.did`. Then apply the caller's
+     * expected signer and audience, if given.
+     * @private
+     */
+    private validateSigner;
     /**
      * Recompute the canonical hashes of the request/response the verifier actually
      * received (via the same hashing the signer used) and compare to the proof's
@@ -130,10 +172,11 @@ export declare class ProofVerifier {
      */
     private validateProofStructure;
     /**
-     * Validate nonce replay protection
+     * Admit the nonce once every other proof check has passed: atomically through
+     * the cache's consume(), or through the has()/add() fallback without it.
      * @private
      */
-    private validateNonce;
+    private consumeNonce;
     /**
      * Validate timestamp skew
      * @private
@@ -144,11 +187,6 @@ export declare class ProofVerifier {
      * @private
      */
     private verifySignature;
-    /**
-     * Add nonce to cache to prevent replay (scoped to agent DID)
-     * @private
-     */
-    private addNonceToCache;
     /**
      * Fetch public key from DID document
      * @param did - DID to resolve
@@ -168,6 +206,7 @@ export declare class ProofVerifier {
      * @returns Canonical JSON string matching the original JWS payload structure
      */
     buildCanonicalPayload(meta: DetachedProof["meta"]): string;
+    private encodeCanonicalPayload;
 }
 /**
  * Whether `key` is an MCP-reserved / standard `_meta` key (SEP-414) that KYA-OS
@@ -223,4 +262,3 @@ export declare function extractProofFromMeta(meta: Record<string, unknown>, poli
     reason: string;
     errorCode: string;
 };
-//# sourceMappingURL=verifier.d.ts.map

package/dist/proof/verifier.js

@@ -5,17 +5,26 @@
  * signatures, enforces nonce replay protection, and checks timestamp skew.
  */
 import { CryptoService } from "../utils/crypto-service.js";
+import { nonceRetentionSeconds } from "../providers/nonce-retention.js";
+import { admitNonce, checkNonceStore } from "../providers/nonce-admission.js";
 import { validateDetachedProof, } from "../types/protocol.js";
 import { canonicalizeJson } from "../utils/canonical-json.js";
 import { ProofVerificationError, PROOF_VERIFICATION_ERROR_CODES, } from "./errors.js";
 import { logger } from "../logging/index.js";
-import { buildProofJwsPayload, computeCanonicalHashes, KYA_OS_PROOF_META_KEY, LEGACY_NAMESPACED_PROOF_META_KEY, LEGACY_PROOF_META_KEY, RESPONSE_PROOF_PROFILE_BODY, } from "./generator.js";
+import { buildProofJwsPayload, findContentBindingMismatch, KYA_OS_PROOF_META_KEY, LEGACY_NAMESPACED_PROOF_META_KEY, LEGACY_PROOF_META_KEY, } from "./generator.js";
 /** Default timestamp skew for proof verification (seconds) */
 export const DEFAULT_CLOCK_SKEW_SECONDS = 120;
 /** Minimum allowed clock skew (seconds) */
 export const MIN_CLOCK_SKEW_SECONDS = 30;
 /** Maximum allowed clock skew (seconds) */
 export const MAX_CLOCK_SKEW_SECONDS = 600;
+/** Reject a non-finite or negative duration at construction, not on every request. */
+function requireNonNegativeSeconds(name, value) {
+    if (!Number.isFinite(value) || value < 0) {
+        throw new RangeError(`${name} must be a finite, non-negative number of seconds`);
+    }
+    return value;
+}
 export class ProofVerifier {
     cryptoService;
     clock;
@@ -23,6 +32,7 @@ export class ProofVerifier {
     fetch;
     timestampSkewSeconds;
     nonceTtlSeconds;
+    requireAtomicNonce;
     cryptoProvider;
     constructor(config) {
         this.cryptoService = new CryptoService(config.cryptoProvider);
@@ -30,8 +40,10 @@ export class ProofVerifier {
         this.clock = config.clockProvider;
         this.nonceCache = config.nonceCacheProvider;
         this.fetch = config.fetchProvider;
-        this.timestampSkewSeconds = config.timestampSkewSeconds ?? DEFAULT_CLOCK_SKEW_SECONDS;
-        this.nonceTtlSeconds = config.nonceTtlSeconds ?? 300; // Default 5 minutes
+        this.timestampSkewSeconds = requireNonNegativeSeconds("timestampSkewSeconds", config.timestampSkewSeconds ?? DEFAULT_CLOCK_SKEW_SECONDS);
+        this.nonceTtlSeconds = requireNonNegativeSeconds("nonceTtlSeconds", config.nonceTtlSeconds ?? 300);
+        this.requireAtomicNonce = config.requireAtomicNonce ?? false;
+        checkNonceStore(this.nonceCache, { requireAtomicNonce: this.requireAtomicNonce });
     }
     /**
      * Update the timestamp skew from a server-advertised value.
@@ -77,19 +89,23 @@ export class ProofVerifier {
      *   `content` array); for an envelope-profile proof (`prf: "org.kya-os/response-proof.envelope"`)
      *   pass the ENTIRE received result object — the verifier removes the
      *   top-level `_meta` member itself, so passing the result as received (proof
-     *   attachment included) is correct.
+     *   attachment included) is correct. Pass the `request` either as the
+     *   `tools/call` request you sent (`{method: "tools/call", params: {name,
+     *   arguments}}`) or in the legacy `{method: <tool name>, params: <arguments>}`
+     *   shape: a `requestHash` over either shape of that call is accepted (SPEC
+     *   §7.3; 1.x producers sign the legacy shape).
+     * @param options - Optional signer binding: the `did` the proof must come
+     *   from and the `audience` it must be addressed to. Independently of these,
+     *   a `kid` naming a key of a DID other than `meta.did` always fails.
      * @returns Verification result
      */
-    async verifyProof(proof, publicKeyJwk, expected) {
+    async verifyProof(proof, publicKeyJwk, expected, options = {}) {
         try {
             const structureValidation = await this.validateProofStructure(proof);
             if (!structureValidation.valid)
                 return structureValidation;
             const validatedProof = structureValidation.proof;
-            // Reconstruct canonical payload from proof meta
-            const canonicalPayloadString = this.buildCanonicalPayload(validatedProof.meta);
-            const canonicalPayloadBytes = new TextEncoder().encode(canonicalPayloadString);
-            return await this.runVerificationPipeline(validatedProof, publicKeyJwk, canonicalPayloadBytes, expected);
+            return await this.runVerificationPipeline(validatedProof, publicKeyJwk, this.encodeCanonicalPayload(validatedProof.meta), expected, options);
         }
         catch (error) {
             return this.handleVerificationError(error);
@@ -109,8 +125,10 @@ export class ProofVerifier {
             if (!structureValidation.valid)
                 return structureValidation;
             const validatedProof = structureValidation.proof;
-            const canonicalPayloadBytes = new TextEncoder().encode(this.buildCanonicalPayload(validatedProof.meta));
-            const signatureValidation = await this.verifySignature(validatedProof.jws, publicKeyJwk, canonicalPayloadBytes, validatedProof.meta.kid);
+            const signerValidation = this.validateSigner(validatedProof.meta);
+            if (!signerValidation.valid)
+                return signerValidation;
+            const signatureValidation = await this.verifySignature(validatedProof.jws, publicKeyJwk, this.encodeCanonicalPayload(validatedProof.meta), validatedProof.meta.kid);
             if (!signatureValidation.valid)
                 return signatureValidation;
             if (expected !== undefined) {
@@ -123,7 +141,16 @@ export class ProofVerifier {
         }
     }
     /**
-     * Verify proof with detached payload (for CLI/verifier compatibility)
+     * Verify proof with detached payload (for CLI/verifier compatibility).
+     *
+     * The timestamp and replay checks read `proof.meta`, so the payload the
+     * signature is checked over must be the one rebuilt from that meta: a
+     * supplied payload that differs from it byte for byte is rejected. Otherwise
+     * an accepted proof could be replayed with a fresh `meta.nonce` and the old
+     * payload.
+     *
+     * @deprecated Use {@link verifyProof}. It rebuilds the payload from
+     *   `proof.meta` itself, so supplying the payload adds nothing.
      * @param proof - The proof to verify
      * @param canonicalPayload - Canonical JSON payload (for detached JWS) as string or Uint8Array
      * @param publicKeyJwk - Ed25519 public key in JWK format
@@ -131,43 +158,49 @@ export class ProofVerifier {
      */
     async verifyProofDetached(proof, canonicalPayload, publicKeyJwk) {
         try {
-            // Convert canonical payload to Uint8Array if needed
-            const canonicalPayloadBytes = canonicalPayload instanceof Uint8Array
+            const structureValidation = await this.validateProofStructure(proof);
+            if (!structureValidation.valid)
+                return structureValidation;
+            const validatedProof = structureValidation.proof;
+            const suppliedPayload = canonicalPayload instanceof Uint8Array
                 ? canonicalPayload
                 : new TextEncoder().encode(canonicalPayload);
-            return await this.runVerificationPipeline(proof, publicKeyJwk, canonicalPayloadBytes);
+            const metaPayload = this.encodeCanonicalPayload(validatedProof.meta);
+            if (!bytesEqual(suppliedPayload, metaPayload)) {
+                return {
+                    valid: false,
+                    reason: "Detached payload does not match the payload rebuilt from proof.meta",
+                    errorCode: PROOF_VERIFICATION_ERROR_CODES.INVALID_JWS_PAYLOAD,
+                };
+            }
+            return await this.runVerificationPipeline(validatedProof, publicKeyJwk, metaPayload);
         }
         catch (error) {
             return this.handleVerificationError(error);
         }
     }
     /**
-     * Shared verification pipeline for proof verification
+     * Shared verification pipeline for a structurally valid proof.
      * @private
      */
-    async runVerificationPipeline(proof, publicKeyJwk, canonicalPayloadBytes, expected) {
-        // 1. Validate proof structure
-        const structureValidation = await this.validateProofStructure(proof);
-        if (!structureValidation.valid) {
-            return structureValidation;
+    async runVerificationPipeline(validatedProof, publicKeyJwk, canonicalPayloadBytes, expected, options = {}) {
+        // 1. Signer binding: kid belongs to the claimed did, and did and audience
+        // are the ones the caller expects.
+        const signerValidation = this.validateSigner(validatedProof.meta, options);
+        if (!signerValidation.valid) {
+            return signerValidation;
         }
-        const validatedProof = structureValidation.proof;
-        // 2. Check nonce replay protection (scoped to agent DID to prevent cross-agent replay attacks)
-        const nonceValidation = await this.validateNonce(validatedProof.meta.nonce, validatedProof.meta.did);
-        if (!nonceValidation.valid) {
-            return nonceValidation;
-        }
-        // 3. Check timestamp skew
+        // 2. Check timestamp skew
         const timestampValidation = await this.validateTimestamp(validatedProof.meta.ts);
         if (!timestampValidation.valid) {
             return timestampValidation;
         }
-        // 4. Verify JWS signature with canonical payload
+        // 3. Verify JWS signature with canonical payload
         const signatureValidation = await this.verifySignature(validatedProof.jws, publicKeyJwk, canonicalPayloadBytes, validatedProof.meta.kid);
         if (!signatureValidation.valid) {
             return signatureValidation;
         }
-        // 4b. Content binding (optional): the signature proves the proof is
+        // 4. Content binding (optional): the signature proves the proof is
         // AUTHENTIC, but not that the request/response WE received matches what was
         // signed. When the caller supplies what it actually saw, recompute the
         // canonical hashes and confirm they match the bound hashes — this is what
@@ -180,60 +213,71 @@ export class ProofVerifier {
                 return bindingValidation;
             }
         }
-        // 5. Add nonce to cache to prevent replay (scoped to agent DID)
-        await this.addNonceToCache(validatedProof.meta.nonce, validatedProof.meta.did);
-        return { valid: true };
+        // 5. Atomically admit the validated proof (scoped to agent DID). Invalid
+        // signatures/bindings must not consume state, and has/add cannot serialize
+        // admission across concurrent verifications or distributed instances.
+        return this.consumeNonce(validatedProof.meta.nonce, validatedProof.meta.did, validatedProof.meta.ts);
     }
     /**
-     * Recompute the canonical hashes of the request/response the verifier actually
-     * received (via the same hashing the signer used) and compare to the proof's
-     * bound hashes. Fails CONTENT_BINDING_MISMATCH on any divergence — the check
-     * that makes a signed proof tamper-evident against content substitution.
+     * Bind the signing key to the principal. `kid` names the signing key; when
+     * it is an absolute DID URL its DID part must be `meta.did`, or a proof could
+     * claim a victim's DID while being signed by a key another DID publishes. A
+     * relative `kid` is resolved against `meta.did`. Then apply the caller's
+     * expected signer and audience, if given.
      * @private
      */
-    async validateContentBinding(proof, expected) {
-        // The response-hash profile comes from the proof's own signature-covered
-        // `prf` claim (validated fail-closed in validateProofStructure): an envelope-profile proof
-        // is checked with envelope hashing (result minus top-level `_meta`), a body-profile
-        // proof (no `prf`) with body hashing. Deriving from the proof — never from
-        // verifier configuration — is what lets one verifier accept both profiles
-        // without a downgrade path.
-        const { requestHash, responseHash } = await computeCanonicalHashes(expected.request, expected.response, (bytes) => this.cryptoProvider.hash(bytes), proof.meta.prf ?? RESPONSE_PROOF_PROFILE_BODY);
-        if (proof.meta.requestHash !== requestHash) {
+    validateSigner(meta, options = {}) {
+        const kidOwner = didOfKid(meta.kid);
+        if (kidOwner !== undefined && kidOwner !== meta.did) {
             return {
                 valid: false,
-                reason: "Request hash mismatch: the proof does not bind the request you supplied",
-                errorCode: PROOF_VERIFICATION_ERROR_CODES.CONTENT_BINDING_MISMATCH,
+                reason: "Proof kid names a key of a different DID than meta.did",
+                errorCode: PROOF_VERIFICATION_ERROR_CODES.KID_DID_MISMATCH,
+                details: { did: meta.did, kid: meta.kid },
             };
         }
-        // Response binding (FAIL-CLOSED): proof.meta.responseHash is the ONLY thing
-        // that binds the response body — including a needs_authorization challenge's
-        // authorizationUrl. It MUST be checked whenever the proof carries one.
-        // Gating the comparison on `expected.response !== undefined` would let a
-        // caller who supplies only `request` get { valid: true } while the swapped
-        // URL went unverified (the requestHash is identical for a genuine and a
-        // MITM'd challenge). So: if the proof binds a responseHash the caller MUST
-        // supply the response; if it binds none, the caller must not supply one.
-        const proofBindsResponse = proof.meta.responseHash !== undefined;
-        const callerSuppliedResponse = expected.response !== undefined;
-        if (proofBindsResponse !== callerSuppliedResponse) {
+        if (options.expectedDid !== undefined && meta.did !== options.expectedDid) {
             return {
                 valid: false,
-                reason: proofBindsResponse
-                    ? "Proof binds a response (responseHash present) but no response was supplied to verify against — pass expected.response"
-                    : "A response was supplied but the proof binds none — content/proof mismatch",
-                errorCode: PROOF_VERIFICATION_ERROR_CODES.CONTENT_BINDING_MISMATCH,
+                reason: "Proof was not issued by the expected DID",
+                errorCode: PROOF_VERIFICATION_ERROR_CODES.DID_MISMATCH,
+                details: { did: meta.did, expectedDid: options.expectedDid },
             };
         }
-        if (proofBindsResponse && proof.meta.responseHash !== responseHash) {
-            return {
-                valid: false,
-                reason: "Response hash mismatch: received content differs from what the server signed (possible substitution / MITM)",
-                errorCode: PROOF_VERIFICATION_ERROR_CODES.CONTENT_BINDING_MISMATCH,
-            };
+        if (options.expectedAudience !== undefined) {
+            const allowed = Array.isArray(options.expectedAudience)
+                ? options.expectedAudience
+                : [options.expectedAudience];
+            if (!allowed.includes(meta.audience)) {
+                return {
+                    valid: false,
+                    reason: "Proof is addressed to a different audience",
+                    errorCode: PROOF_VERIFICATION_ERROR_CODES.AUDIENCE_MISMATCH,
+                    details: { audience: meta.audience, expectedAudience: options.expectedAudience },
+                };
+            }
         }
         return { valid: true };
     }
+    /**
+     * Recompute the canonical hashes of the request/response the verifier actually
+     * received (via the same hashing the signer used) and compare to the proof's
+     * bound hashes. Fails CONTENT_BINDING_MISMATCH on any divergence — the check
+     * that makes a signed proof tamper-evident against content substitution.
+     * @private
+     */
+    async validateContentBinding(proof, expected) {
+        // The rule (fail-closed response binding, response profile from the
+        // proof's own `prf`) is shared with ProofGenerator.verifyProof.
+        const mismatch = await findContentBindingMismatch(proof.meta, expected, (bytes) => this.cryptoProvider.hash(bytes));
+        if (mismatch === undefined)
+            return { valid: true };
+        return {
+            valid: false,
+            reason: CONTENT_BINDING_REASONS[mismatch],
+            errorCode: PROOF_VERIFICATION_ERROR_CODES.CONTENT_BINDING_MISMATCH,
+        };
+    }
     /**
      * Handle verification errors consistently
      * @private
@@ -272,12 +316,17 @@ export class ProofVerifier {
         };
     }
     /**
-     * Validate nonce replay protection
+     * Admit the nonce once every other proof check has passed: atomically through
+     * the cache's consume(), or through the has()/add() fallback without it.
      * @private
      */
-    async validateNonce(nonce, agentDid) {
-        const nonceUsed = await this.nonceCache.has(nonce, agentDid);
-        if (nonceUsed) {
+    async consumeNonce(nonce, agentDid, timestamp) {
+        // Cover later setTimestampSkew increases too: its supported ceiling is 600s.
+        const ttl = nonceRetentionSeconds(this.nonceTtlSeconds, timestamp + Math.max(this.timestampSkewSeconds, MAX_CLOCK_SKEW_SECONDS), this.clock.now());
+        const consumed = await admitNonce(this.nonceCache, nonce, ttl, agentDid, {
+            requireAtomicNonce: this.requireAtomicNonce,
+        });
+        if (!consumed) {
             return {
                 valid: false,
                 reason: "Nonce already used (replay attack detected)",
@@ -336,14 +385,6 @@ export class ProofVerifier {
         }
         return { valid: true };
     }
-    /**
-     * Add nonce to cache to prevent replay (scoped to agent DID)
-     * @private
-     */
-    async addNonceToCache(nonce, agentDid) {
-        // Pass TTL in seconds, not absolute timestamp
-        await this.nonceCache.add(nonce, this.nonceTtlSeconds, agentDid);
-    }
     /**
      * Fetch public key from DID document
      * @param did - DID to resolve
@@ -353,6 +394,8 @@ export class ProofVerifier {
      */
     async fetchPublicKeyFromDID(did, kid) {
         try {
+            // Built before resolving, so a kid naming another DID fails without a fetch.
+            const matchesKid = kid ? verificationMethodMatcher(did, kid) : undefined;
             const didDoc = await this.fetch.resolveDID(did);
             if (!didDoc) {
                 throw new ProofVerificationError(PROOF_VERIFICATION_ERROR_CODES.DID_DOCUMENT_NOT_FOUND, `DID document not found: ${did}`, { did });
@@ -364,9 +407,8 @@ export class ProofVerifier {
             }
             // Find verification method by kid or use first one
             let verificationMethod;
-            if (kid) {
-                const kidWithHash = kid.startsWith("#") ? kid : `#${kid}`;
-                verificationMethod = doc.verificationMethod.find((vm) => vm.id === kidWithHash || vm.id === `${did}${kidWithHash}`);
+            if (matchesKid) {
+                verificationMethod = doc.verificationMethod.find(matchesKid);
                 if (!verificationMethod) {
                     throw new ProofVerificationError(PROOF_VERIFICATION_ERROR_CODES.VERIFICATION_METHOD_NOT_FOUND, `Verification method not found for kid: ${kid}`, {
                         did,
@@ -423,6 +465,44 @@ export class ProofVerifier {
         // the same RFC 8785 canonicalization the signer used.
         return canonicalizeJson(buildProofJwsPayload(meta));
     }
+    encodeCanonicalPayload(meta) {
+        return new TextEncoder().encode(this.buildCanonicalPayload(meta));
+    }
+}
+const CONTENT_BINDING_REASONS = {
+    request: "Request hash mismatch: the proof does not bind the request you supplied",
+    "response-missing": "Proof binds a response (responseHash present) but no response was supplied to verify against — pass expected.response",
+    "response-unexpected": "A response was supplied but the proof binds none — content/proof mismatch",
+    response: "Response hash mismatch: received content differs from what the server signed (possible substitution / MITM)",
+};
+/**
+ * The DID an absolute DID URL `kid` (`did:…#frag`, the form proofs carry)
+ * names, or undefined for a relative `kid` (`frag` or `#frag`), which is
+ * resolved against the proof's `did`.
+ */
+function didOfKid(kid) {
+    return kid.startsWith("did:") ? kid.split("#")[0] : undefined;
+}
+/**
+ * Match a verification method of `did`'s document against `kid`. An absolute
+ * DID URL must name `did` itself and match the method id exactly; a document
+ * may list that id relative to the DID. A relative `kid` is resolved against
+ * `did`.
+ */
+function verificationMethodMatcher(did, kid) {
+    const kidOwner = didOfKid(kid);
+    if (kidOwner !== undefined) {
+        if (kidOwner !== did) {
+            throw new ProofVerificationError(PROOF_VERIFICATION_ERROR_CODES.KID_DID_MISMATCH, `kid ${kid} names a key of a different DID than ${did}`, { did, kid });
+        }
+        const fragment = kid.slice(kidOwner.length);
+        return (vm) => vm.id === kid || (fragment !== "" && vm.id === fragment);
+    }
+    const kidWithHash = kid.startsWith("#") ? kid : `#${kid}`;
+    return (vm) => vm.id === kidWithHash || vm.id === `${did}${kidWithHash}`;
+}
+function bytesEqual(a, b) {
+    return a.length === b.length && a.every((byte, index) => byte === b[index]);
 }
 /**
  * MCP-reserved / standard `_meta` keys a KYA-OS verifier MUST tolerate but

package/dist/proof/verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../src/proof/verifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAmB,MAAM,4BAA4B,CAAC;AAK5E,OAAO,EACL,qBAAqB,GAGtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAE/B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,gCAAgC,EAChC,qBAAqB,EACrB,2BAA2B,GAG5B,MAAM,gBAAgB,CAAC;AAmBxB,8DAA8D;AAC9D,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,2CAA2C;AAC3C,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,2CAA2C;AAC3C,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAE1C,MAAM,OAAO,aAAa;IAChB,aAAa,CAAgB;IAC7B,KAAK,CAAgB;IACrB,UAAU,CAAqB;IAC/B,KAAK,CAAgB;IACrB,oBAAoB,CAAS;IAC7B,eAAe,CAAS;IACxB,cAAc,CAAiB;IAEvC,YAAY,MAA2B;QACrC,IAAI,CAAC,aAAa,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;QAClC,IAAI,CAAC,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,IAAI,0BAA0B,CAAC;QACtF,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,GAAG,CAAC,CAAC,oBAAoB;IAC5E,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,WAAmB;QAClC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACrE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAClC,sBAAsB,EACtB,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAC1D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,WAAW,CACf,KAAoB,EACpB,YAAwB,EACxB,QAA4D;QAE5D,IAAI,CAAC;YACH,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACrE,IAAI,CAAC,mBAAmB,CAAC,KAAK;gBAAE,OAAO,mBAAmB,CAAC;YAC3D,MAAM,cAAc,GAAG,mBAAmB,CAAC,KAAM,CAAC;YAElD,gDAAgD;YAChD,MAAM,sBAAsB,GAAG,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC/E,MAAM,qBAAqB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACpD,sBAAsB,CACvB,CAAC;YAEF,OAAO,MAAM,IAAI,CAAC,uBAAuB,CACvC,cAAc,EACd,YAAY,EACZ,qBAAqB,EACrB,QAAQ,CACT,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,mBAAmB,CACvB,KAAoB,EACpB,YAAwB,EACxB,QAA4D;QAE5D,IAAI,CAAC;YACH,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACrE,IAAI,CAAC,mBAAmB,CAAC,KAAK;gBAAE,OAAO,mBAAmB,CAAC;YAC3D,MAAM,cAAc,GAAG,mBAAmB,CAAC,KAAM,CAAC;YAClD,MAAM,qBAAqB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACpD,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,IAAI,CAAC,CAChD,CAAC;YAEF,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,eAAe,CACpD,cAAc,CAAC,GAAG,EAClB,YAAY,EACZ,qBAAqB,EACrB,cAAc,CAAC,IAAI,CAAC,GAAG,CACxB,CAAC;YACF,IAAI,CAAC,mBAAmB,CAAC,KAAK;gBAAE,OAAO,mBAAmB,CAAC;YAE3D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,sBAAsB,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CACvB,KAAoB,EACpB,gBAAqC,EACrC,YAAwB;QAExB,IAAI,CAAC;YACH,oDAAoD;YACpD,MAAM,qBAAqB,GACzB,gBAAgB,YAAY,UAAU;gBACpC,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAEjD,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,uBAAuB,CACnC,KAAoB,EACpB,YAAwB,EACxB,qBAAiC,EACjC,QAA4D;QAE5D,8BAA8B;QAC9B,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC/B,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,MAAM,cAAc,GAAG,mBAAmB,CAAC,KAAM,CAAC;QAElD,+FAA+F;QAC/F,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,aAAa,CAC9C,cAAc,CAAC,IAAI,CAAC,KAAK,EACzB,cAAc,CAAC,IAAI,CAAC,GAAG,CACxB,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,0BAA0B;QAC1B,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CACtD,cAAc,CAAC,IAAI,CAAC,EAAE,CACvB,CAAC;QACF,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC/B,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,iDAAiD;QACjD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,eAAe,CACpD,cAAc,CAAC,GAAG,EAClB,YAAY,EACZ,qBAAqB,EACrB,cAAc,CAAC,IAAI,CAAC,GAAG,CACxB,CAAC;QACF,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC/B,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,oEAAoE;QACpE,4EAA4E;QAC5E,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,6EAA6E;QAC7E,oCAAoC;QACpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CACzD,cAAc,EACd,QAAQ,CACT,CAAC;YACF,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;gBAC7B,OAAO,iBAAiB,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,MAAM,IAAI,CAAC,eAAe,CACxB,cAAc,CAAC,IAAI,CAAC,KAAK,EACzB,cAAc,CAAC,IAAI,CAAC,GAAG,CACxB,CAAC;QAEF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,sBAAsB,CAClC,KAAoB,EACpB,QAA2D;QAE3D,yEAAyE;QACzE,2FAA2F;QAC3F,oFAAoF;QACpF,2EAA2E;QAC3E,0EAA0E;QAC1E,4BAA4B;QAC5B,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,sBAAsB,CAChE,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,QAAQ,EACjB,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,2BAA2B,CAC9C,CAAC;QACF,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YAC3C,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EACJ,yEAAyE;gBAC3E,SAAS,EAAE,8BAA8B,CAAC,wBAAwB;aACnE,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,6EAA6E;QAC7E,uEAAuE;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC;QACjE,MAAM,sBAAsB,GAAG,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC;QAC/D,IAAI,kBAAkB,KAAK,sBAAsB,EAAE,CAAC;YAClD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,kBAAkB;oBACxB,CAAC,CAAC,uHAAuH;oBACzH,CAAC,CAAC,2EAA2E;gBAC/E,SAAS,EAAE,8BAA8B,CAAC,wBAAwB;aACnE,CAAC;QACJ,CAAC;QACD,IAAI,kBAAkB,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;YACnE,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EACJ,6GAA6G;gBAC/G,SAAS,EAAE,8BAA8B,CAAC,wBAAwB;aACnE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,uBAAuB,CAAC,KAAc;QAC5C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,0BAA0B;YAClC,SAAS,EAAE,8BAA8B,CAAC,kBAAkB;YAC5D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChE,OAAO,EAAE;gBACP,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aACrE;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,sBAAsB,CAClC,KAAoB;QAEpB,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,yBAAyB;gBACjC,SAAS,EAAE,8BAA8B,CAAC,uBAAuB;gBACjE,KAAK,EAAE,IAAI,KAAK,CACd,4BAA4B,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,CAC9D;gBACD,OAAO,EAAE;oBACP,eAAe,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO;iBACjD;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,gBAAgB,CAAC,IAAI;SAC7B,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa,CACzB,KAAa,EACb,QAAiB;QAEjB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,6CAA6C;gBACrD,SAAS,EAAE,8BAA8B,CAAC,qBAAqB;gBAC/D,OAAO,EAAE;oBACP,KAAK;oBACL,QAAQ;iBACT;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,iBAAiB,CAC7B,SAAiB;QAEjB,6EAA6E;QAC7E,MAAM,WAAW,GAAG,SAAS,GAAG,IAAI,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACrE,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uCAAuC,IAAI,CAAC,oBAAoB,IAAI;gBAC5E,SAAS,EAAE,8BAA8B,CAAC,uBAAuB;gBACjE,OAAO,EAAE;oBACP,SAAS;oBACT,WAAW;oBACX,WAAW,EAAE,IAAI,CAAC,oBAAoB;oBACtC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;iBAC9B;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAC3B,GAAW,EACX,YAAwB,EACxB,qBAAiC,EACjC,WAAoB;QAEpB,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CACvD,GAAG,EACH,YAAY,EACZ;YACE,eAAe,EAAE,qBAAqB;YACtC,WAAW;YACX,GAAG,EAAE,OAAO;SACb,CACF,CAAC;QAEF,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uBAAuB;gBAC/B,SAAS,EAAE,8BAA8B,CAAC,qBAAqB;gBAC/D,OAAO,EAAE;oBACP,SAAS,EAAE,GAAG,CAAC,MAAM;oBACrB,WAAW;oBACX,SAAS,EAAE,YAAY,CAAC,GAAG;iBAC5B;aACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAC3B,KAAa,EACb,QAAgB;QAEhB,8CAA8C;QAC9C,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,qBAAqB,CACzB,GAAW,EACX,GAAY;QAEZ,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAEhD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,sBAAsB,EACrD,2BAA2B,GAAG,EAAE,EAChC,EAAE,GAAG,EAAE,CACR,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,MAEX,CAAC;YAEF,IACE,CAAC,GAAG,CAAC,kBAAkB;gBACvB,GAAG,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,EACnC,CAAC;gBACD,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,6BAA6B,EAC5D,kDAAkD,GAAG,EAAE,EACvD,EAAE,GAAG,EAAE,CACR,CAAC;YACJ,CAAC;YAED,mDAAmD;YACnD,IAAI,kBAES,CAAC;YACd,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC1D,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAC9C,CAAC,EAAkB,EAAE,EAAE,CACrB,EAAE,CAAC,EAAE,KAAK,WAAW,IAAI,EAAE,CAAC,EAAE,KAAK,GAAG,GAAG,GAAG,WAAW,EAAE,CAC5D,CAAC;gBAEF,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBACxB,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,6BAA6B,EAC5D,0CAA0C,GAAG,EAAE,EAC/C;wBACE,GAAG;wBACH,GAAG;wBACH,aAAa,EAAE,GAAG,CAAC,kBAAkB,CAAC,GAAG,CACvC,CAAC,EAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAC9B;qBACF,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,CAAC,kBAAkB,EAAE,YAAY,EAAE,CAAC;gBACtC,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,oBAAoB,EACnD,iDAAiD,EACjD,EAAE,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAC3D,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAK9B,CAAC;YAEF,+BAA+B;YAC/B,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,kBAAkB,EACjD,sCAAsC,GAAG,CAAC,GAAG,SAAS,GAAG,CAAC,GAAG,EAAE,EAC/D,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAClD,CAAC;YACJ,CAAC;YAED,uEAAuE;YACvE,MAAM,MAAM,GAAG,GAAiB,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,kBAAkB,CAAC,EAAE,EAAE,CAAC;gBACzC,MAAM,CAAC,GAAG,GAAG,kBAAkB,CAAC,EAAE,CAAC;YACrC,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,qBAAqB,EACpD,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAClF;gBACE,GAAG;gBACH,GAAG;gBACH,aAAa,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aACtE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,qBAAqB,CAAC,IAA2B;QAC/C,2EAA2E;QAC3E,wEAAwE;QACxE,yFAAyF;QACzF,0EAA0E;QAC1E,sDAAsD;QACtD,OAAO,gBAAgB,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,0BAA0B,GAAG,CAAC,0BAA0B,CAAU,CAAC;AACzE,MAAM,sBAAsB,GAAG,CAAC,aAAa,EAAE,YAAY,EAAE,SAAS,CAAU,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,OAAO,CACJ,sBAA4C,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC3D,0BAA0B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAA6B,EAC7B,SAAqB,QAAQ;IAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CACxC,CAAC,CAAC,EAAE,CACF,CAAC,KAAK,qBAAqB;QAC3B,CAAC,KAAK,gCAAgC;QACtC,CAAC,KAAK,qBAAqB,CAC9B,CAAC;IAEF,2EAA2E;IAC3E,8EAA8E;IAC9E,8CAA8C;IAC9C,IAAI,MAAM,KAAK,kBAAkB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACpC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAA6B,EAC7B,SAAqB,QAAQ;IAE7B,wEAAwE;IACxE,uEAAuE;IACvE,4DAA4D;IAC5D,MAAM,KAAK,GACT,IAAI,CAAC,qBAAqB,CAAC;QAC3B,IAAI,CAAC,gCAAgC,CAAC;QACtC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gCAAgC;YACxC,SAAS,EAAE,8BAA8B,CAAC,sBAAsB;SACjE,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEpC,MAAM,eAAe,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,eAAe,CAAC,KAAK,EAAE,OAAO,IAAI,yBAAyB;YACnE,SAAS,EAAE,8BAA8B,CAAC,uBAAuB;SAClE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,IAAK,EAAE,CAAC;AACzD,CAAC"}
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../src/proof/verifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAmB,MAAM,4BAA4B,CAAC;AAI5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAE9E,OAAO,EACL,qBAAqB,GAGtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAE/B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,gCAAgC,EAChC,qBAAqB,GAItB,MAAM,gBAAgB,CAAC;AAoCxB,8DAA8D;AAC9D,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,2CAA2C;AAC3C,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,2CAA2C;AAC3C,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAE1C,sFAAsF;AACtF,SAAS,yBAAyB,CAAC,IAAY,EAAE,KAAa;IAC5D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,mDAAmD,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,aAAa;IAChB,aAAa,CAAgB;IAC7B,KAAK,CAAgB;IACrB,UAAU,CAAqB;IAC/B,KAAK,CAAgB;IACrB,oBAAoB,CAAS;IAC7B,eAAe,CAAS;IACxB,kBAAkB,CAAU;IAC5B,cAAc,CAAiB;IAEvC,YAAY,MAA2B;QACrC,IAAI,CAAC,aAAa,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;QAClC,IAAI,CAAC,oBAAoB,GAAG,yBAAyB,CACnD,sBAAsB,EACtB,MAAM,CAAC,oBAAoB,IAAI,0BAA0B,CAC1D,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,yBAAyB,CAC9C,iBAAiB,EACjB,MAAM,CAAC,eAAe,IAAI,GAAG,CAC9B,CAAC;QACF,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,KAAK,CAAC;QAC7D,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACpF,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,WAAmB;QAClC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACrE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAClC,sBAAsB,EACtB,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAC1D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,KAAK,CAAC,WAAW,CACf,KAAoB,EACpB,YAAwB,EACxB,QAA4D,EAC5D,UAAoC,EAAE;QAEtC,IAAI,CAAC;YACH,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACrE,IAAI,CAAC,mBAAmB,CAAC,KAAK;gBAAE,OAAO,mBAAmB,CAAC;YAC3D,MAAM,cAAc,GAAG,mBAAmB,CAAC,KAAM,CAAC;YAElD,OAAO,MAAM,IAAI,CAAC,uBAAuB,CACvC,cAAc,EACd,YAAY,EACZ,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,IAAI,CAAC,EAChD,QAAQ,EACR,OAAO,CACR,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,mBAAmB,CACvB,KAAoB,EACpB,YAAwB,EACxB,QAA4D;QAE5D,IAAI,CAAC;YACH,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACrE,IAAI,CAAC,mBAAmB,CAAC,KAAK;gBAAE,OAAO,mBAAmB,CAAC;YAC3D,MAAM,cAAc,GAAG,mBAAmB,CAAC,KAAM,CAAC;YAClD,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAClE,IAAI,CAAC,gBAAgB,CAAC,KAAK;gBAAE,OAAO,gBAAgB,CAAC;YAErD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,eAAe,CACpD,cAAc,CAAC,GAAG,EAClB,YAAY,EACZ,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,IAAI,CAAC,EAChD,cAAc,CAAC,IAAI,CAAC,GAAG,CACxB,CAAC;YACF,IAAI,CAAC,mBAAmB,CAAC,KAAK;gBAAE,OAAO,mBAAmB,CAAC;YAE3D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,sBAAsB,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,mBAAmB,CACvB,KAAoB,EACpB,gBAAqC,EACrC,YAAwB;QAExB,IAAI,CAAC;YACH,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACrE,IAAI,CAAC,mBAAmB,CAAC,KAAK;gBAAE,OAAO,mBAAmB,CAAC;YAC3D,MAAM,cAAc,GAAG,mBAAmB,CAAC,KAAM,CAAC;YAElD,MAAM,eAAe,GACnB,gBAAgB,YAAY,UAAU;gBACpC,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACjD,MAAM,WAAW,GAAG,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YACrE,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC9C,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,qEAAqE;oBAC7E,SAAS,EAAE,8BAA8B,CAAC,mBAAmB;iBAC9D,CAAC;YACJ,CAAC;YAED,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QACvF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,uBAAuB,CACnC,cAA6B,EAC7B,YAAwB,EACxB,qBAAiC,EACjC,QAA4D,EAC5D,UAAoC,EAAE;QAEtC,0EAA0E;QAC1E,mCAAmC;QACnC,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3E,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;YAC5B,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,0BAA0B;QAC1B,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CACtD,cAAc,CAAC,IAAI,CAAC,EAAE,CACvB,CAAC;QACF,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC/B,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,iDAAiD;QACjD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,eAAe,CACpD,cAAc,CAAC,GAAG,EAClB,YAAY,EACZ,qBAAqB,EACrB,cAAc,CAAC,IAAI,CAAC,GAAG,CACxB,CAAC;QACF,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC/B,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,mEAAmE;QACnE,4EAA4E;QAC5E,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,6EAA6E;QAC7E,oCAAoC;QACpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CACzD,cAAc,EACd,QAAQ,CACT,CAAC;YACF,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;gBAC7B,OAAO,iBAAiB,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,sEAAsE;QACtE,OAAO,IAAI,CAAC,YAAY,CACtB,cAAc,CAAC,IAAI,CAAC,KAAK,EACzB,cAAc,CAAC,IAAI,CAAC,GAAG,EACvB,cAAc,CAAC,IAAI,CAAC,EAAE,CACvB,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,cAAc,CACpB,IAA2B,EAC3B,UAAoC,EAAE;QAEtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACpD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,wDAAwD;gBAChE,SAAS,EAAE,8BAA8B,CAAC,gBAAgB;gBAC1D,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;aAC1C,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;YAC1E,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,0CAA0C;gBAClD,SAAS,EAAE,8BAA8B,CAAC,YAAY;gBACtD,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;aAC7D,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC;gBACrD,CAAC,CAAC,OAAO,CAAC,gBAAgB;gBAC1B,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrC,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,4CAA4C;oBACpD,SAAS,EAAE,8BAA8B,CAAC,iBAAiB;oBAC3D,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;iBACjF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,sBAAsB,CAClC,KAAoB,EACpB,QAA2D;QAE3D,oEAAoE;QACpE,gEAAgE;QAChE,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAC/C,KAAK,CAAC,IAAI,EACV,QAAQ,EACR,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAC3C,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACnD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC;YACzC,SAAS,EAAE,8BAA8B,CAAC,wBAAwB;SACnE,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,uBAAuB,CAAC,KAAc;QAC5C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,0BAA0B;YAClC,SAAS,EAAE,8BAA8B,CAAC,kBAAkB;YAC5D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChE,OAAO,EAAE;gBACP,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aACrE;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,sBAAsB,CAClC,KAAoB;QAEpB,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,yBAAyB;gBACjC,SAAS,EAAE,8BAA8B,CAAC,uBAAuB;gBACjE,KAAK,EAAE,IAAI,KAAK,CACd,4BAA4B,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,CAC9D;gBACD,OAAO,EAAE;oBACP,eAAe,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO;iBACjD;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,gBAAgB,CAAC,IAAI;SAC7B,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,YAAY,CACxB,KAAa,EACb,QAAgB,EAChB,SAAiB;QAEjB,6EAA6E;QAC7E,MAAM,GAAG,GAAG,qBAAqB,CAC/B,IAAI,CAAC,eAAe,EACpB,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,EACvE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CACjB,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE;YACvE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC5C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,6CAA6C;gBACrD,SAAS,EAAE,8BAA8B,CAAC,qBAAqB;gBAC/D,OAAO,EAAE;oBACP,KAAK;oBACL,QAAQ;iBACT;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,iBAAiB,CAC7B,SAAiB;QAEjB,6EAA6E;QAC7E,MAAM,WAAW,GAAG,SAAS,GAAG,IAAI,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACrE,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uCAAuC,IAAI,CAAC,oBAAoB,IAAI;gBAC5E,SAAS,EAAE,8BAA8B,CAAC,uBAAuB;gBACjE,OAAO,EAAE;oBACP,SAAS;oBACT,WAAW;oBACX,WAAW,EAAE,IAAI,CAAC,oBAAoB;oBACtC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;iBAC9B;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAC3B,GAAW,EACX,YAAwB,EACxB,qBAAiC,EACjC,WAAoB;QAEpB,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CACvD,GAAG,EACH,YAAY,EACZ;YACE,eAAe,EAAE,qBAAqB;YACtC,WAAW;YACX,GAAG,EAAE,OAAO;SACb,CACF,CAAC;QAEF,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uBAAuB;gBAC/B,SAAS,EAAE,8BAA8B,CAAC,qBAAqB;gBAC/D,OAAO,EAAE;oBACP,SAAS,EAAE,GAAG,CAAC,MAAM;oBACrB,WAAW;oBACX,SAAS,EAAE,YAAY,CAAC,GAAG;iBAC5B;aACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,qBAAqB,CACzB,GAAW,EACX,GAAY;QAEZ,IAAI,CAAC;YACH,6EAA6E;YAC7E,MAAM,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAEhD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,sBAAsB,EACrD,2BAA2B,GAAG,EAAE,EAChC,EAAE,GAAG,EAAE,CACR,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,MAEX,CAAC;YAEF,IACE,CAAC,GAAG,CAAC,kBAAkB;gBACvB,GAAG,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,EACnC,CAAC;gBACD,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,6BAA6B,EAC5D,kDAAkD,GAAG,EAAE,EACvD,EAAE,GAAG,EAAE,CACR,CAAC;YACJ,CAAC;YAED,mDAAmD;YACnD,IAAI,kBAES,CAAC;YACd,IAAI,UAAU,EAAE,CAAC;gBACf,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAE7D,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBACxB,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,6BAA6B,EAC5D,0CAA0C,GAAG,EAAE,EAC/C;wBACE,GAAG;wBACH,GAAG;wBACH,aAAa,EAAE,GAAG,CAAC,kBAAkB,CAAC,GAAG,CACvC,CAAC,EAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAC9B;qBACF,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,CAAC,kBAAkB,EAAE,YAAY,EAAE,CAAC;gBACtC,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,oBAAoB,EACnD,iDAAiD,EACjD,EAAE,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAC3D,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAK9B,CAAC;YAEF,+BAA+B;YAC/B,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,kBAAkB,EACjD,sCAAsC,GAAG,CAAC,GAAG,SAAS,GAAG,CAAC,GAAG,EAAE,EAC/D,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAClD,CAAC;YACJ,CAAC;YAED,uEAAuE;YACvE,MAAM,MAAM,GAAG,GAAiB,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,kBAAkB,CAAC,EAAE,EAAE,CAAC;gBACzC,MAAM,CAAC,GAAG,GAAG,kBAAkB,CAAC,EAAE,CAAC;YACrC,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,qBAAqB,EACpD,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAClF;gBACE,GAAG;gBACH,GAAG;gBACH,aAAa,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aACtE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,qBAAqB,CAAC,IAA2B;QAC/C,2EAA2E;QAC3E,wEAAwE;QACxE,yFAAyF;QACzF,0EAA0E;QAC1E,sDAAsD;QACtD,OAAO,gBAAgB,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IAEO,sBAAsB,CAAC,IAA2B;QACxD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,CAAC;CACF;AAED,MAAM,uBAAuB,GAA2C;IACtE,OAAO,EAAE,yEAAyE;IAClF,kBAAkB,EAChB,uHAAuH;IACzH,qBAAqB,EACnB,2EAA2E;IAC7E,QAAQ,EACN,6GAA6G;CAChH,CAAC;AAEF;;;;GAIG;AACH,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAChC,GAAW,EACX,GAAW;IAEX,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACrB,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,gBAAgB,EAC/C,OAAO,GAAG,wCAAwC,GAAG,EAAE,EACvD,EAAE,GAAG,EAAE,GAAG,EAAE,CACb,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5C,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;IAC1D,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,WAAW,IAAI,EAAE,CAAC,EAAE,KAAK,GAAG,GAAG,GAAG,WAAW,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,0BAA0B,GAAG,CAAC,0BAA0B,CAAU,CAAC;AACzE,MAAM,sBAAsB,GAAG,CAAC,aAAa,EAAE,YAAY,EAAE,SAAS,CAAU,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,OAAO,CACJ,sBAA4C,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC3D,0BAA0B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAA6B,EAC7B,SAAqB,QAAQ;IAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CACxC,CAAC,CAAC,EAAE,CACF,CAAC,KAAK,qBAAqB;QAC3B,CAAC,KAAK,gCAAgC;QACtC,CAAC,KAAK,qBAAqB,CAC9B,CAAC;IAEF,2EAA2E;IAC3E,8EAA8E;IAC9E,8CAA8C;IAC9C,IAAI,MAAM,KAAK,kBAAkB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACpC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAA6B,EAC7B,SAAqB,QAAQ;IAE7B,wEAAwE;IACxE,uEAAuE;IACvE,4DAA4D;IAC5D,MAAM,KAAK,GACT,IAAI,CAAC,qBAAqB,CAAC;QAC3B,IAAI,CAAC,gCAAgC,CAAC;QACtC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gCAAgC;YACxC,SAAS,EAAE,8BAA8B,CAAC,sBAAsB;SACjE,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEpC,MAAM,eAAe,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,eAAe,CAAC,KAAK,EAAE,OAAO,IAAI,yBAAyB;YACnE,SAAS,EAAE,8BAA8B,CAAC,uBAAuB;SAClE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,IAAK,EAAE,CAAC;AACzD,CAAC"}

package/dist/providers/audit-log.d.ts

@@ -59,4 +59,3 @@ export declare class NoopAuditLogProvider extends AuditLogProvider {
     logAuditRecord(_context: AuditContext): Promise<void>;
     logEvent(_context: AuditEventContext): Promise<void>;
 }
-//# sourceMappingURL=audit-log.d.ts.map

package/dist/providers/base.d.ts

@@ -41,7 +41,26 @@ export declare abstract class StorageProvider {
     abstract list(prefix?: string): Promise<string[]>;
 }
 export declare abstract class NonceCacheProvider {
+    /**
+     * Atomically record an unseen (agentDid, nonce) for ttlSeconds. Return true only
+     * when this call records it, false when an unexpired record already exists.
+     * Reject on storage failure; never implement this as separate has/add calls.
+     * Shared deployments must implement the operation atomically in their shared
+     * backend (for example, a conditional insert with expiry), not a local mutex.
+     * Retain a successful claim for at least ttlSeconds. Verifiers sharing this
+     * cache must agree on acceptance windows; changing them requires a rollout
+     * that also preserves previously admitted records for the new window.
+     *
+     * Optional for compatibility. Verifiers use it when present. Without it they
+     * fall back to has() then add(), which cannot stop concurrent duplicates of
+     * one proof, and log a warning once per provider. Set `requireAtomicNonce`
+     * on the verifier or middleware to refuse that fallback. Implement this for
+     * any deployment that serves concurrent requests.
+     */
+    consume?(nonce: string, ttlSeconds: number, agentDid?: string): Promise<boolean>;
+    /** Inspection, and the non-atomic fallback when consume is absent. */
     abstract has(nonce: string, agentDid?: string): Promise<boolean>;
+    /** Unconditional write, and the non-atomic fallback when consume is absent. */
     abstract add(nonce: string, ttlSeconds: number, agentDid?: string): Promise<void>;
     abstract cleanup(): Promise<void>;
     abstract destroy(): Promise<void>;
@@ -90,4 +109,3 @@ export declare abstract class IdentityProvider {
     abstract rotateKeys(): Promise<AgentIdentity>;
     abstract deleteIdentity(): Promise<void>;
 }
-//# sourceMappingURL=base.d.ts.map

package/dist/providers/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","sourceRoot":"","sources":["../../src/providers/base.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,OAAgB,cAAc;CAUnC;AAED,MAAM,OAAgB,aAAa;CAMlC;AAED,MAAM,OAAgB,aAAa;CAKlC;AAED,MAAM,OAAgB,eAAe;CAMpC;AAED,MAAM,OAAgB,kBAAkB;CAKvC;AA0CD,MAAM,OAAgB,gBAAgB;CAKrC"}
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../src/providers/base.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,OAAgB,cAAc;CAUnC;AAED,MAAM,OAAgB,aAAa;CAMlC;AAED,MAAM,OAAgB,aAAa;CAKlC;AAED,MAAM,OAAgB,eAAe;CAMpC;AAED,MAAM,OAAgB,kBAAkB;CAwBvC;AA0CD,MAAM,OAAgB,gBAAgB;CAKrC"}