@kya-os/mcp 1.16.1 → 1.17.0

package/dist/providers/grant-store.d.ts

@@ -20,6 +20,7 @@
  * possession is still proven per request by the agent's detached-JWS signature
  * over the request (holder-of-key). Storing a grant never substitutes for that.
  */
+import type { DelegationCredential } from '../types/protocol.js';
 export interface Grant {
     /** Stable id for this grant (used for revocation). */
     id: string;
@@ -42,6 +43,12 @@ export interface Grant {
     };
     /** The delegation credential (VC-JWT), when one was minted. */
     credentialJwt?: string;
+    /**
+     * Original signed object credential. Delegation gates reverify this evidence
+     * (or credentialJwt) on every reuse; opaque legacy grants re-challenge.
+     * Durable providers must preserve the full credential, including its proof.
+     */
+    delegationCredential?: DelegationCredential;
     /** When the grant was issued (ms epoch). */
     issuedAt: number;
     /** When the grant expires (ms epoch); omitted means no expiry. */
@@ -100,8 +107,7 @@ export declare class MemoryGrantStore extends GrantStore {
     getById(id: string): Promise<Grant | undefined>;
     revoke(id: string, reason?: string): Promise<void>;
     cleanup(): Promise<void>;
-    /** Active = not revoked and not past expiry. */
+    /** Active = explicitly active and not past expiry. */
     private activeGrants;
     private coversScopes;
 }
-//# sourceMappingURL=grant-store.d.ts.map

package/dist/providers/grant-store.js

@@ -42,7 +42,7 @@ export class MemoryGrantStore extends GrantStore {
         this.now = options.now ?? (() => Date.now());
     }
     async bind(grant) {
-        this.grants.set(grant.id, { ...grant });
+        this.grants.set(grant.id, structuredClone(grant));
     }
     async getByAgent(agentDid, requiredScopes) {
         return this.activeGrants().filter((g) => g.agentDid === agentDid && this.coversScopes(g, requiredScopes));
@@ -52,7 +52,7 @@ export class MemoryGrantStore extends GrantStore {
     }
     async getById(id) {
         const grant = this.grants.get(id);
-        return grant ? { ...grant } : undefined;
+        return grant ? structuredClone(grant) : undefined;
     }
     async revoke(id, reason) {
         const grant = this.grants.get(id);
@@ -70,16 +70,16 @@ export class MemoryGrantStore extends GrantStore {
             }
         }
     }
-    /** Active = not revoked and not past expiry. */
+    /** Active = explicitly active and not past expiry. */
     activeGrants() {
         const now = this.now();
         const out = [];
         for (const grant of this.grants.values()) {
-            if (grant.status === 'revoked')
+            if (grant.status !== 'active')
                 continue;
             if (grant.expiresAt !== undefined && grant.expiresAt <= now)
                 continue;
-            out.push({ ...grant });
+            out.push(structuredClone(grant));
         }
         return out;
     }

package/dist/providers/grant-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"grant-store.js","sourceRoot":"","sources":["../../src/providers/grant-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA+BH;;;GAGG;AACH,MAAM,OAAgB,UAAU;CAsB/B;AAOD;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC7B,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IAClC,GAAG,CAAe;IAEnC,YAAY,UAAmC,EAAE;QAC/C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAY;QACrB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,cAAyB;QAC1D,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC,CACvE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,cAAyB;QAC7D,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC,CACzE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAe;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;QACzB,IAAI,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,gBAAgB,GAAG,MAAM,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC5D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,gDAAgD;IACxC,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAY,EAAE,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAS;YACzC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,SAAS;YACtE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,YAAY,CAAC,KAAY,EAAE,cAAyB;QAC1D,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;CACF"}
+{"version":3,"file":"grant-store.js","sourceRoot":"","sources":["../../src/providers/grant-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAuCH;;;GAGG;AACH,MAAM,OAAgB,UAAU;CAsB/B;AAOD;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC7B,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IAClC,GAAG,CAAe;IAEnC,YAAY,UAAmC,EAAE;QAC/C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAY;QACrB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,cAAyB;QAC1D,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC,CACvE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,cAAyB;QAC7D,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC,CACzE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAe;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;QACzB,IAAI,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,gBAAgB,GAAG,MAAM,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC5D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,sDAAsD;IAC9C,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAY,EAAE,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ;gBAAE,SAAS;YACxC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,SAAS;YACtE,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,YAAY,CAAC,KAAY,EAAE,cAAyB;QAC1D,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;CACF"}

package/dist/providers/index.d.ts

@@ -6,4 +6,3 @@ export { SystemClockProvider } from './system-clock.js';
 export { RuntimeFetchProvider } from './runtime-fetch.js';
 export { AuditLogProvider, MemoryAuditLogProvider, NoopAuditLogProvider, buildAuditRecord, } from './audit-log.js';
 export { GrantStore, MemoryGrantStore, type Grant, type MemoryGrantStoreOptions } from './grant-store.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/providers/memory.d.ts

@@ -12,11 +12,30 @@ export declare class MemoryStorageProvider extends StorageProvider {
     exists(key: string): Promise<boolean>;
     list(prefix?: string): Promise<string[]>;
 }
+/**
+ * In-memory replay store, and the default one for `withKyaOs` and
+ * `SessionManager`. Single process only. Expired entries are swept as the
+ * cache is written to (every {@link SWEEP_EVERY} writes, or after
+ * {@link SWEEP_INTERVAL_MS}), so a long-running server stays bounded by its
+ * live nonces without anyone scheduling {@link cleanup}.
+ */
 export declare class MemoryNonceCacheProvider extends NonceCacheProvider {
     private nonces;
+    private writesSinceSweep;
+    private lastSweepAt;
+    /** Atomic within this cache instance: no await separates the read and write. */
+    consume(nonce: string, ttlSeconds: number, agentDid?: string): Promise<boolean>;
+    private key;
     has(nonce: string, agentDid?: string): Promise<boolean>;
     add(nonce: string, ttlSeconds: number, agentDid?: string): Promise<void>;
     cleanup(): Promise<void>;
+    /**
+     * Amortised eviction: every admitted nonce is a write, so sweeping on writes
+     * keeps the map bounded by live entries. The count trigger bounds a busy
+     * cache; the interval trigger releases a quiet one's dead entries too.
+     */
+    private sweepIfDue;
+    private evictExpired;
     destroy(): Promise<void>;
 }
 export declare class MemoryIdentityProvider extends IdentityProvider {
@@ -30,4 +49,3 @@ export declare class MemoryIdentityProvider extends IdentityProvider {
     private generateIdentity;
     private generateDIDFromPublicKey;
 }
-//# sourceMappingURL=memory.d.ts.map

package/dist/providers/memory.js

@@ -5,6 +5,10 @@
  */
 import { StorageProvider, NonceCacheProvider, IdentityProvider, } from './base.js';
 import { generateDidKeyFromBase64, didKeyFragment } from '../utils/did-helpers.js';
+/** Writes between amortised expired-entry sweeps (bounds memory without a timer). */
+const SWEEP_EVERY = 1000;
+/** Longest a cache goes between sweeps while written to, so low traffic also frees memory. */
+const SWEEP_INTERVAL_MS = 60_000;
 export class MemoryStorageProvider extends StorageProvider {
     store = new Map();
     async get(key) {
@@ -27,28 +31,70 @@ export class MemoryStorageProvider extends StorageProvider {
         return keys;
     }
 }
+/**
+ * In-memory replay store, and the default one for `withKyaOs` and
+ * `SessionManager`. Single process only. Expired entries are swept as the
+ * cache is written to (every {@link SWEEP_EVERY} writes, or after
+ * {@link SWEEP_INTERVAL_MS}), so a long-running server stays bounded by its
+ * live nonces without anyone scheduling {@link cleanup}.
+ */
 export class MemoryNonceCacheProvider extends NonceCacheProvider {
     nonces = new Map();
+    writesSinceSweep = 0;
+    lastSweepAt = Date.now();
+    /** Atomic within this cache instance: no await separates the read and write. */
+    async consume(nonce, ttlSeconds, agentDid) {
+        if (!Number.isFinite(ttlSeconds) || ttlSeconds <= 0) {
+            throw new RangeError('Nonce TTL must be a positive finite number');
+        }
+        const key = this.key(nonce, agentDid);
+        const now = Date.now();
+        const expiry = this.nonces.get(key);
+        if (expiry !== undefined && expiry > now)
+            return false;
+        this.nonces.set(key, now + ttlSeconds * 1000);
+        this.sweepIfDue(now);
+        return true;
+    }
+    key(nonce, agentDid) {
+        return JSON.stringify([agentDid ?? null, nonce]);
+    }
     async has(nonce, agentDid) {
-        const key = agentDid ? `nonce:${agentDid}:${nonce}` : `nonce:${nonce}`;
+        const key = this.key(nonce, agentDid);
         const expiry = this.nonces.get(key);
         if (!expiry)
             return false;
-        if (Date.now() > expiry) {
+        if (Date.now() >= expiry) {
             this.nonces.delete(key);
             return false;
         }
         return true;
     }
     async add(nonce, ttlSeconds, agentDid) {
-        const key = agentDid ? `nonce:${agentDid}:${nonce}` : `nonce:${nonce}`;
-        const expiresAt = Date.now() + ttlSeconds * 1000;
-        this.nonces.set(key, expiresAt);
+        const key = this.key(nonce, agentDid);
+        const now = Date.now();
+        this.nonces.set(key, now + ttlSeconds * 1000);
+        this.sweepIfDue(now);
     }
     async cleanup() {
-        const now = Date.now();
+        this.evictExpired(Date.now());
+    }
+    /**
+     * Amortised eviction: every admitted nonce is a write, so sweeping on writes
+     * keeps the map bounded by live entries. The count trigger bounds a busy
+     * cache; the interval trigger releases a quiet one's dead entries too.
+     */
+    sweepIfDue(now) {
+        if (++this.writesSinceSweep < SWEEP_EVERY && now - this.lastSweepAt < SWEEP_INTERVAL_MS) {
+            return;
+        }
+        this.writesSinceSweep = 0;
+        this.lastSweepAt = now;
+        this.evictExpired(now);
+    }
+    evictExpired(now) {
         for (const [nonce, expiry] of this.nonces) {
-            if (now > expiry) {
+            if (now >= expiry) {
                 this.nonces.delete(nonce);
             }
         }

package/dist/providers/memory.js.map

@@ -1 +1 @@
-{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/providers/memory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAEL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEnF,MAAM,OAAO,qBAAsB,SAAQ,eAAe;IAChD,KAAK,GAAwB,IAAI,GAAG,EAAE,CAAC;IAE/C,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAe;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,kBAAkB;IACtD,MAAM,GAAwB,IAAI,GAAG,EAAE,CAAC;IAEhD,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,QAAiB;QACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAE1B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,UAAkB,EAAE,QAAiB;QAC5D,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1C,IAAI,GAAG,GAAG,MAAM,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,gBAAgB;IAClD,QAAQ,CAAiB;IACzB,cAAc,CAA6B;IAEnD,YAAY,cAA+B;QACzC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAuB;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAE7D,OAAO;YACL,GAAG;YACH,GAAG,EAAE,GAAG,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;YACpC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI,EAAE,aAAa;SACpB,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAAC,SAAiB;QAChD,OAAO,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;CACF"}
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/providers/memory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAEL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEnF,qFAAqF;AACrF,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,8FAA8F;AAC9F,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,MAAM,OAAO,qBAAsB,SAAQ,eAAe;IAChD,KAAK,GAAwB,IAAI,GAAG,EAAE,CAAC;IAE/C,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAe;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,kBAAkB;IACtD,MAAM,GAAwB,IAAI,GAAG,EAAE,CAAC;IACxC,gBAAgB,GAAG,CAAC,CAAC;IACrB,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEjC,gFAAgF;IAChF,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,UAAkB,EAAE,QAAiB;QAChE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,UAAU,CAAC,4CAA4C,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,GAAG,CAAC,KAAa,EAAE,QAAiB;QAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,IAAI,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,QAAiB;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAE1B,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,UAAkB,EAAE,QAAiB;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACK,UAAU,CAAC,GAAW;QAC5B,IAAI,EAAE,IAAI,CAAC,gBAAgB,GAAG,WAAW,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,GAAG,iBAAiB,EAAE,CAAC;YACxF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;QACvB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1C,IAAI,GAAG,IAAI,MAAM,EAAE,CAAC;gBAClB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,gBAAgB;IAClD,QAAQ,CAAiB;IACzB,cAAc,CAA6B;IAEnD,YAAY,cAA+B;QACzC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAuB;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAE7D,OAAO;YACL,GAAG;YACH,GAAG,EAAE,GAAG,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;YACpC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI,EAAE,aAAa;SACpB,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAAC,SAAiB;QAChD,OAAO,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;CACF"}

package/dist/providers/node-crypto.d.ts

@@ -4,6 +4,10 @@
  * Ed25519 crypto backed by Node.js built-in `node:crypto`.
  * Use this on any Node.js 20+ server.
  *
+ * `node:crypto` is loaded on first use, never at module load: the
+ * `@kya-os/mcp/providers` entry also serves `WebCryptoProvider` to browsers and
+ * Workers, and a top-level import of a node built-in would break their bundles.
+ *
  * @example
  * ```typescript
  * import { NodeCryptoProvider } from '@kya-os/mcp/providers';
@@ -23,4 +27,3 @@ export declare class NodeCryptoProvider extends CryptoProvider {
     hash(data: Uint8Array): Promise<string>;
     randomBytes(length: number): Promise<Uint8Array>;
 }
-//# sourceMappingURL=node-crypto.d.ts.map

package/dist/providers/node-crypto.js

@@ -4,6 +4,10 @@
  * Ed25519 crypto backed by Node.js built-in `node:crypto`.
  * Use this on any Node.js 20+ server.
  *
+ * `node:crypto` is loaded on first use, never at module load: the
+ * `@kya-os/mcp/providers` entry also serves `WebCryptoProvider` to browsers and
+ * Workers, and a top-level import of a node built-in would break their bundles.
+ *
  * @example
  * ```typescript
  * import { NodeCryptoProvider } from '@kya-os/mcp/providers';
@@ -12,31 +16,47 @@
  * await withKyaOs(server, { crypto: new NodeCryptoProvider() });
  * ```
  */
-import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify, randomBytes, } from "node:crypto";
 import { CryptoProvider } from "./base.js";
-/** PKCS8 DER header for Ed25519 private keys (16 bytes) */
-const ED25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+import { ED25519_PKCS8_DER_HEADER } from "../utils/ed25519-constants.js";
+import { decodeEd25519PublicKey } from "../utils/ed25519-public-key.js";
 /** SPKI DER header for Ed25519 public keys (12 bytes) */
-const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+const ED25519_SPKI_PREFIX = Uint8Array.from([
+    0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,
+]);
+let nodeCryptoPromise;
+/**
+ * Load (and cache) `node:crypto`. Where it is absent, fail with a pointer to
+ * the provider that works there rather than a module-resolution error.
+ */
+function loadNodeCrypto() {
+    return (nodeCryptoPromise ??= import("node:crypto").catch((cause) => {
+        throw new Error("NodeCryptoProvider: node:crypto is unavailable in this runtime; use WebCryptoProvider", { cause });
+    }));
+}
 export class NodeCryptoProvider extends CryptoProvider {
     async sign(data, privateKeyBase64) {
+        const { createPrivateKey, sign } = await loadNodeCrypto();
         const privateKey = Buffer.from(privateKeyBase64, "base64");
         // Handle both raw 32-byte and full 64-byte Ed25519 keys
         const keyBytes = privateKey.length === 64 ? privateKey.subarray(0, 32) : privateKey;
         const keyObject = createPrivateKey({
-            key: Buffer.concat([ED25519_PKCS8_PREFIX, keyBytes]),
+            key: Buffer.concat([ED25519_PKCS8_DER_HEADER, keyBytes]),
             format: "der",
             type: "pkcs8",
         });
         return new Uint8Array(sign(null, Buffer.from(data), keyObject));
     }
     async verify(data, signature, publicKeyBase64) {
+        const { createPublicKey, verify } = await loadNodeCrypto();
+        // Exactly 32 bytes, decoded strictly: Node's base64 decoder would skip
+        // junk and the SPKI wrap would accept extra bytes after the key.
+        const publicKey = decodeEd25519PublicKey(publicKeyBase64);
+        if (!publicKey) {
+            return false;
+        }
         try {
             const keyObject = createPublicKey({
-                key: Buffer.concat([
-                    ED25519_SPKI_PREFIX,
-                    Buffer.from(publicKeyBase64, "base64"),
-                ]),
+                key: Buffer.concat([ED25519_SPKI_PREFIX, publicKey]),
                 format: "der",
                 type: "spki",
             });
@@ -47,6 +67,7 @@ export class NodeCryptoProvider extends CryptoProvider {
         }
     }
     async generateKeyPair() {
+        const { generateKeyPairSync } = await loadNodeCrypto();
         const { publicKey, privateKey } = generateKeyPairSync("ed25519", {
             publicKeyEncoding: { type: "spki", format: "der" },
             privateKeyEncoding: { type: "pkcs8", format: "der" },
@@ -57,12 +78,14 @@ export class NodeCryptoProvider extends CryptoProvider {
         };
     }
     async hash(data) {
+        const { createHash } = await loadNodeCrypto();
         const hex = createHash("sha256")
             .update(Buffer.from(data))
             .digest("hex");
         return `sha256:${hex}`;
     }
     async randomBytes(length) {
+        const { randomBytes } = await loadNodeCrypto();
         return new Uint8Array(randomBytes(length));
     }
 }

package/dist/providers/node-crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"node-crypto.js","sourceRoot":"","sources":["../../src/providers/node-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,IAAI,EACJ,MAAM,EACN,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C,2DAA2D;AAC3D,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CACtC,kCAAkC,EAClC,KAAK,CACN,CAAC;AAEF,yDAAyD;AACzD,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAE3E,MAAM,OAAO,kBAAmB,SAAQ,cAAc;IACpD,KAAK,CAAC,IAAI,CACR,IAAgB,EAChB,gBAAwB;QAExB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAE3D,wDAAwD;QACxD,MAAM,QAAQ,GACZ,UAAU,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QAErE,MAAM,SAAS,GAAG,gBAAgB,CAAC;YACjC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;YACpD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QAEH,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAgB,EAChB,SAAqB,EACrB,eAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,eAAe,CAAC;gBAChC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;oBACjB,mBAAmB;oBACnB,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC;iBACvC,CAAC;gBACF,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YAEH,OAAO,MAAM,CACX,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EACjB,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CACvB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QAInB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,EAAE;YAC/D,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;YAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;SACrD,CAAC,CAAC;QAEH,OAAO;YACL,UAAU,EAAG,UAAqB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtE,SAAS,EAAG,SAAoB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACrE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC;aAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aACzB,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,UAAU,GAAG,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;CACF"}
+{"version":3,"file":"node-crypto.js","sourceRoot":"","sources":["../../src/providers/node-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE,yDAAyD;AACzD,MAAM,mBAAmB,GAAG,UAAU,CAAC,IAAI,CAAC;IAC1C,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACvE,CAAC,CAAC;AAGH,IAAI,iBAAkD,CAAC;AAEvD;;;GAGG;AACH,SAAS,cAAc;IACrB,OAAO,CAAC,iBAAiB,KAAK,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC3E,MAAM,IAAI,KAAK,CACb,uFAAuF,EACvF,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,OAAO,kBAAmB,SAAQ,cAAc;IACpD,KAAK,CAAC,IAAI,CACR,IAAgB,EAChB,gBAAwB;QAExB,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAE3D,wDAAwD;QACxD,MAAM,QAAQ,GACZ,UAAU,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QAErE,MAAM,SAAS,GAAG,gBAAgB,CAAC;YACjC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAC;YACxD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QAEH,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAgB,EAChB,SAAqB,EACrB,eAAuB;QAEvB,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAC3D,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,SAAS,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;QAC1D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,eAAe,CAAC;gBAChC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;gBACpD,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YAEH,OAAO,MAAM,CACX,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EACjB,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CACvB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QAInB,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QACvD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,EAAE;YAC/D,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;YAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;SACrD,CAAC,CAAC;QAEH,OAAO;YACL,UAAU,EAAG,UAAqB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtE,SAAS,EAAG,SAAoB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACrE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC;aAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aACzB,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,UAAU,GAAG,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAC/C,OAAO,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;CACF"}

package/dist/providers/nonce-admission.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Replay admission shared by detached proofs, handshakes and card proofs.
+ *
+ * A provider's atomic `consume()` decides admission when it exists. Providers
+ * written before `consume()` existed fall back to `has()` then `add()`, which
+ * works for sequential requests but lets concurrent duplicates of one proof
+ * through. The fallback keeps those providers working and warns once per
+ * provider; `requireAtomicNonce` refuses it instead.
+ */
+/** The replay-store surface admission needs; both nonce cache contracts satisfy it. */
+export interface NonceAdmissionStore {
+    consume?(nonce: string, ttlSeconds: number, agentDid?: string): Promise<boolean>;
+    has(nonce: string, agentDid?: string): Promise<boolean>;
+    add(nonce: string, ttlSeconds: number, agentDid?: string): Promise<void>;
+}
+export interface NonceAdmissionOptions {
+    /** Deny rather than fall back when the store has no atomic consume(). */
+    requireAtomicNonce?: boolean;
+}
+/**
+ * Check a store when a verifier is built: accept an atomic store, refuse a
+ * non-atomic one under `requireAtomicNonce`, and otherwise warn once per store
+ * about the has()/add() fallback. Repeat calls stay silent.
+ */
+export declare function checkNonceStore(store: NonceAdmissionStore, options?: NonceAdmissionOptions): void;
+/**
+ * Admit a nonce that has already passed every other check. Returns true only
+ * for the call that admits it. Storage failures, and a missing consume() under
+ * `requireAtomicNonce`, reject so callers deny the request.
+ */
+export declare function admitNonce(store: NonceAdmissionStore, nonce: string, ttlSeconds: number, agentDid?: string, options?: NonceAdmissionOptions): Promise<boolean>;

package/dist/providers/nonce-admission.js

@@ -0,0 +1,47 @@
+/**
+ * Replay admission shared by detached proofs, handshakes and card proofs.
+ *
+ * A provider's atomic `consume()` decides admission when it exists. Providers
+ * written before `consume()` existed fall back to `has()` then `add()`, which
+ * works for sequential requests but lets concurrent duplicates of one proof
+ * through. The fallback keeps those providers working and warns once per
+ * provider; `requireAtomicNonce` refuses it instead.
+ */
+import { logger } from '../logging/index.js';
+const warnedStores = new WeakSet();
+/**
+ * Check a store when a verifier is built: accept an atomic store, refuse a
+ * non-atomic one under `requireAtomicNonce`, and otherwise warn once per store
+ * about the has()/add() fallback. Repeat calls stay silent.
+ */
+export function checkNonceStore(store, options = {}) {
+    if (typeof store.consume === 'function')
+        return;
+    if (options.requireAtomicNonce) {
+        throw new TypeError('requireAtomicNonce is set but the nonce cache has no consume()');
+    }
+    if (warnedStores.has(store))
+        return;
+    warnedStores.add(store);
+    logger.warn('[kya-os] Nonce cache has no atomic consume(); falling back to has() then add(). ' +
+        'Concurrent duplicates of one signed request can both be admitted. ' +
+        'Implement consume() with a conditional insert in the shared store, and set ' +
+        'requireAtomicNonce to refuse this fallback.');
+}
+/**
+ * Admit a nonce that has already passed every other check. Returns true only
+ * for the call that admits it. Storage failures, and a missing consume() under
+ * `requireAtomicNonce`, reject so callers deny the request.
+ */
+export async function admitNonce(store, nonce, ttlSeconds, agentDid, options = {}) {
+    const consume = store.consume;
+    if (typeof consume === 'function') {
+        return (await consume.call(store, nonce, ttlSeconds, agentDid)) === true;
+    }
+    checkNonceStore(store, options);
+    if (await store.has(nonce, agentDid))
+        return false;
+    await store.add(nonce, ttlSeconds, agentDid);
+    return true;
+}
+//# sourceMappingURL=nonce-admission.js.map

package/dist/providers/nonce-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce-admission.js","sourceRoot":"","sources":["../../src/providers/nonce-admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAc7C,MAAM,YAAY,GAAG,IAAI,OAAO,EAAU,CAAC;AAE3C;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,KAA0B,EAC1B,UAAiC,EAAE;IAEnC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU;QAAE,OAAO;IAChD,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO;IACpC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,MAAM,CAAC,IAAI,CACT,kFAAkF;QAChF,oEAAoE;QACpE,6EAA6E;QAC7E,6CAA6C,CAChD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAA0B,EAC1B,KAAa,EACb,UAAkB,EAClB,QAAiB,EACjB,UAAiC,EAAE;IAEnC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC;IAC3E,CAAC;IACD,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/providers/nonce-retention.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Retain admission state through the entire final accepted second. The extra
+ * second covers inclusive, second-granularity verifiers; rounding up also
+ * covers subsecond cache clocks. A longer configured retention always wins;
+ * a configured TTL of 0 keeps the record for the acceptance window only. The
+ * result is at least one second, so stores never receive a zero TTL.
+ */
+export declare function nonceRetentionSeconds(configuredTtlSeconds: number, validUntilSeconds: number, nowMs: number): number;

package/dist/providers/nonce-retention.js

@@ -0,0 +1,15 @@
+/**
+ * Retain admission state through the entire final accepted second. The extra
+ * second covers inclusive, second-granularity verifiers; rounding up also
+ * covers subsecond cache clocks. A longer configured retention always wins;
+ * a configured TTL of 0 keeps the record for the acceptance window only. The
+ * result is at least one second, so stores never receive a zero TTL.
+ */
+export function nonceRetentionSeconds(configuredTtlSeconds, validUntilSeconds, nowMs) {
+    if (!Number.isFinite(configuredTtlSeconds) || configuredTtlSeconds < 0 ||
+        !Number.isFinite(validUntilSeconds) || !Number.isFinite(nowMs)) {
+        throw new RangeError('Nonce retention requires a non-negative TTL and a bounded acceptance window');
+    }
+    return Math.max(1, configuredTtlSeconds, Math.ceil(validUntilSeconds + 1 - nowMs / 1000));
+}
+//# sourceMappingURL=nonce-retention.js.map

package/dist/providers/nonce-retention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce-retention.js","sourceRoot":"","sources":["../../src/providers/nonce-retention.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,oBAA4B,EAC5B,iBAAyB,EACzB,KAAa;IAEb,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,oBAAoB,GAAG,CAAC;QAClE,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,UAAU,CAAC,6EAA6E,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC;AAC5F,CAAC"}

package/dist/providers/runtime-fetch.d.ts

@@ -92,4 +92,3 @@ export declare class NoopFetchProvider extends FetchProvider {
     fetchDelegationChain(_id: string): Promise<DelegationRecord[]>;
     fetch(_url: string, _options?: unknown): Promise<Response>;
 }
-//# sourceMappingURL=runtime-fetch.d.ts.map

package/dist/providers/system-clock.d.ts

@@ -36,4 +36,3 @@ export declare class SystemClockProvider extends ClockProvider {
     /** ISO-8601 rendering of a ms-epoch timestamp. */
     format(timestamp: number): string;
 }
-//# sourceMappingURL=system-clock.d.ts.map

package/dist/providers/web-crypto.d.ts

@@ -32,4 +32,3 @@ export declare class WebCryptoProvider extends CryptoProvider {
     hash(data: Uint8Array): Promise<string>;
     randomBytes(length: number): Promise<Uint8Array>;
 }
-//# sourceMappingURL=web-crypto.d.ts.map

package/dist/providers/web-crypto.js

@@ -23,6 +23,7 @@
  */
 import { CryptoProvider } from "./base.js";
 import { base64ToBytes, bytesToBase64 } from "../utils/base64.js";
+import { decodeEd25519PublicKey } from "../utils/ed25519-public-key.js";
 const ALG = "Ed25519";
 /** PKCS8 DER header for Ed25519 private keys (16 bytes) — matches NodeCryptoProvider. */
 const ED25519_PKCS8_PREFIX = Uint8Array.from([
@@ -66,8 +67,13 @@ export class WebCryptoProvider extends CryptoProvider {
         return new Uint8Array(sig);
     }
     async verify(data, signature, publicKeyBase64) {
+        // Same strict decode as NodeCryptoProvider: exactly 32 bytes, and never a
+        // small-order key (WebCrypto accepts those, and they verify a forgery).
+        const raw = decodeEd25519PublicKey(publicKeyBase64);
+        if (!raw) {
+            return false;
+        }
         try {
-            const raw = base64ToBytes(publicKeyBase64);
             const key = await getCrypto().subtle.importKey("raw", toBufferSource(raw), { name: ALG }, false, ["verify"]);
             return await getCrypto().subtle.verify({ name: ALG }, key, toBufferSource(signature), toBufferSource(data));
         }

package/dist/providers/web-crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"web-crypto.js","sourceRoot":"","sources":["../../src/providers/web-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElE,MAAM,GAAG,GAAG,SAAkB,CAAC;AAE/B,yFAAyF;AACzF,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,CAAC;IAC3C,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CAC/F,CAAC,CAAC;AAEH,SAAS,SAAS;IAChB,wEAAwE;IACxE,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sEAAsE;AACtE,sEAAsE;AACtE,0EAA0E;AAC1E,+BAA+B;AAC/B,SAAS,cAAc,CAAC,KAAiB;IACvC,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAQD,SAAS,SAAS,CAAC,GAAiB;IAClC,OAAO,YAAY,IAAI,GAAG,IAAI,WAAW,IAAI,GAAG,CAAC;AACnD,CAAC;AAED,MAAM,OAAO,iBAAkB,SAAQ,cAAc;IACnD,KAAK,CAAC,IAAI,CAAC,IAAgB,EAAE,gBAAwB;QACnD,MAAM,GAAG,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC5C,wEAAwE;QACxE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,oBAAoB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;QACnC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QACpF,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAgB,EAChB,SAAqB,EACrB,eAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAC5C,KAAK,EACL,cAAc,CAAC,GAAG,CAAC,EACnB,EAAE,IAAI,EAAE,GAAG,EAAE,EACb,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,OAAO,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CACpC,EAAE,IAAI,EAAE,GAAG,EAAE,EACb,GAAG,EACH,cAAc,CAAC,SAAS,CAAC,EACzB,cAAc,CAAC,IAAI,CAAC,CACrB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACzF,0EAA0E;QAC1E,wDAAwD;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAC3F,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChG,OAAO,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,SAAS,EAAE,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;CACF"}
+{"version":3,"file":"web-crypto.js","sourceRoot":"","sources":["../../src/providers/web-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE,MAAM,GAAG,GAAG,SAAkB,CAAC;AAE/B,yFAAyF;AACzF,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,CAAC;IAC3C,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CAC/F,CAAC,CAAC;AAEH,SAAS,SAAS;IAChB,wEAAwE;IACxE,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sEAAsE;AACtE,sEAAsE;AACtE,0EAA0E;AAC1E,+BAA+B;AAC/B,SAAS,cAAc,CAAC,KAAiB;IACvC,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAQD,SAAS,SAAS,CAAC,GAAiB;IAClC,OAAO,YAAY,IAAI,GAAG,IAAI,WAAW,IAAI,GAAG,CAAC;AACnD,CAAC;AAED,MAAM,OAAO,iBAAkB,SAAQ,cAAc;IACnD,KAAK,CAAC,IAAI,CAAC,IAAgB,EAAE,gBAAwB;QACnD,MAAM,GAAG,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC5C,wEAAwE;QACxE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,oBAAoB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;QACnC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QACpF,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAgB,EAChB,SAAqB,EACrB,eAAuB;QAEvB,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,GAAG,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAC5C,KAAK,EACL,cAAc,CAAC,GAAG,CAAC,EACnB,EAAE,IAAI,EAAE,GAAG,EAAE,EACb,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,OAAO,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CACpC,EAAE,IAAI,EAAE,GAAG,EAAE,EACb,GAAG,EACH,cAAc,CAAC,SAAS,CAAC,EACzB,cAAc,CAAC,IAAI,CAAC,CACrB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACzF,0EAA0E;QAC1E,wDAAwD;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAC3F,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChG,OAAO,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,SAAS,EAAE,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;CACF"}

package/dist/session/index.d.ts

@@ -1,3 +1,2 @@
 export { SessionManager, createHandshakeRequest, validateHandshakeFormat, type SessionConfig, type HandshakeResult, } from './manager.js';
 export { SessionStore, MemorySessionStore, type MemorySessionStoreOptions, } from './session-store.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/session/manager.d.ts

@@ -17,6 +17,11 @@ export interface SessionConfig {
     sessionTtlMinutes?: number;
     absoluteSessionLifetime?: number;
     nonceCache?: NonceCache;
+    /**
+     * Refuse a nonce cache without an atomic `consume()` instead of falling back
+     * to `has()` then `add()`. The constructor throws for such a cache.
+     */
+    requireAtomicNonce?: boolean;
     serverDid?: string;
     /** Maximum number of concurrent sessions. Oldest sessions are evicted when exceeded. Default: 10000 */
     maxSessions?: number;
@@ -79,6 +84,14 @@ export declare class SessionManager {
     private normalizeClientInfoString;
     private buildClientInfo;
     static generateNonce(): string;
+    /**
+     * Sweep expired sessions from the session store, then run the store's and
+     * the nonce cache's own `cleanup()`. Nothing in the library schedules this:
+     * `getSession` already drops an expired session when it is read, and the
+     * default session store is capped by `maxSessions`. Call it from your own
+     * scheduler to reclaim records eagerly, or when a store relies on it to
+     * expire entries.
+     */
     cleanup(): Promise<void>;
     getStats(): {
         activeSessions: number;
@@ -93,4 +106,3 @@ export declare class SessionManager {
 }
 export declare function createHandshakeRequest(audience: string): HandshakeRequest;
 export declare function validateHandshakeFormat(request: unknown): request is HandshakeRequest;
-//# sourceMappingURL=manager.d.ts.map