@kya-os/mcp 1.16.2 → 1.18.0

package/dist/integrations/cheqd/registrar.d.ts

@@ -82,4 +82,3 @@ export declare class CheqdDidRegistrarClient {
     private resolveHeaders;
 }
 export declare function createLocalEd25519CheqdRegistrarSigner(options: LocalCheqdRegistrarSignerOptions): CheqdRegistrarSigner;
-//# sourceMappingURL=registrar.d.ts.map

package/dist/integrations/cheqd/resolver.d.ts

@@ -35,4 +35,3 @@ export declare class DidCheqdResolver implements DIDResolver {
 export declare function createDidCheqdResolver(fetchProvider: FetchProvider, options: DidCheqdResolverOptions): DIDResolver;
 export declare function cheqdResolver(options: DidCheqdResolverOptions): DIDResolverFactory;
 export declare function didCheqdToResolverUrl(did: string, resolverUrl: string): string;
-//# sourceMappingURL=resolver.d.ts.map

package/dist/integrations/cheqd/statuslist-resolver.d.ts

@@ -71,4 +71,3 @@ export declare class CheqdStatusListResolver implements StatusListResolver {
     private assertSignature;
 }
 export declare function createCheqdStatusListResolver(options: CheqdStatusListResolverOptions): CheqdStatusListResolver;
-//# sourceMappingURL=statuslist-resolver.d.ts.map

package/dist/logging/index.d.ts

@@ -1,2 +1 @@
 export { logger, createDefaultConsoleLogger, type Logger, type Level, } from './logger.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/logging/logger.d.ts

@@ -20,4 +20,3 @@ export interface Logger {
 }
 export declare function createDefaultConsoleLogger(): Logger;
 export declare const logger: Logger;
-//# sourceMappingURL=logger.d.ts.map

package/dist/middleware/index.d.ts

@@ -11,4 +11,3 @@ export { withKyaOs, generateIdentity, type WithKyaOsOptions, } from './with-kya-
 export { createKyaOsTransport, type Transport, type JSONRPCMessage, } from './kya-os-transport.js';
 export { card, CardBuilder, type CardBuilderInit, type AccountableToOptions, type VcInput, } from '../card/builder.js';
 export { withKyaOsCard, requireProof, readCardProof, type KyaOsCardMount, type ServerJsonLike, type DidDocumentLike, type ProofGuard, type ProofGateResult, type ProofGateError, type ProofGateCode, type RequireProofOptions, type MinProofLevel, } from '../card/middleware.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/middleware/kya-os-transport.d.ts

@@ -12,8 +12,11 @@
  * How it works:
  *   1. Incoming `tools/call` requests are captured (by id) to record tool
  *      name and arguments for proof generation.
- *   2. Outgoing responses for those ids get a proof injected into `_meta`.
- *   3. All other message types pass through unmodified.
+ *   2. Outgoing responses for those ids get a proof injected into `_meta`,
+ *      unless the middleware's own wrappers already proved or audited the
+ *      result, which they mark with a private per-middleware stamp.
+ *   3. All other message types pass through unmodified, except that the
+ *      stamp is removed from every result before it is sent.
  *
  * @module kya-os-transport
  */
@@ -37,4 +40,3 @@ export type JSONRPCMessage = Record<string, unknown>;
  * @param exclude - Tool names to skip proof generation for
  */
 export declare function createKyaOsTransport(inner: Transport, kyaos: KyaOsMiddleware, exclude?: string[]): Transport;
-//# sourceMappingURL=kya-os-transport.d.ts.map

package/dist/middleware/kya-os-transport.js

@@ -12,11 +12,15 @@
  * How it works:
  *   1. Incoming `tools/call` requests are captured (by id) to record tool
  *      name and arguments for proof generation.
- *   2. Outgoing responses for those ids get a proof injected into `_meta`.
- *   3. All other message types pass through unmodified.
+ *   2. Outgoing responses for those ids get a proof injected into `_meta`,
+ *      unless the middleware's own wrappers already proved or audited the
+ *      result, which they mark with a private per-middleware stamp.
+ *   3. All other message types pass through unmodified, except that the
+ *      stamp is removed from every result before it is sent.
  *
  * @module kya-os-transport
  */
+import { attachOuterProofLayer, withoutLifecycleStamp, withoutOutcomeMeta, } from "./with-kya-os.session.js";
 import { logger } from "../logging/index.js";
 /**
  * Creates a transport wrapper that injects KYA-OS proofs into `tools/call`
@@ -29,6 +33,10 @@ import { logger } from "../logging/index.js";
 export function createKyaOsTransport(inner, kyaos, exclude = ["_kyaos", "_kyaos_handshake"]) {
     // Request id → { toolName, args } for pending tool calls
     const pending = new Map();
+    // From here on the middleware's wrappers stamp what they return, and this
+    // tells a stamped result from one that only looks proven. Undefined for a
+    // custom middleware, whose results are all proved here.
+    const isOwnResult = attachOuterProofLayer(kyaos.wrapWithProof);
     const wrapper = {
         start: () => inner.start(),
         close: () => inner.close(),
@@ -55,45 +63,65 @@ export function createKyaOsTransport(inner, kyaos, exclude = ["_kyaos", "_kyaos_
         // McpServer calls send() for every outgoing message.
         // Intercept tools/call responses here to inject proofs.
         async send(message) {
+            // Only a response (result or error, no method) can answer a pending call:
+            // a server-initiated request such as elicitation/create numbers its ids
+            // in the server's own space, so its id can equal a pending client id.
+            const isResponse = message.method === undefined && ("result" in message || "error" in message);
             const id = message.id;
-            const call = id !== undefined ? pending.get(id) : undefined;
+            const call = isResponse && id !== undefined ? pending.get(id) : undefined;
             if (call) {
                 pending.delete(id);
-                try {
-                    const rawResult = message.result;
-                    if (rawResult) {
+                const rawResult = message.result;
+                // A result the middleware's wrappers already proved or audited (a
+                // delegated call's scope-bearing proof, a signed needs_authorization
+                // outcome, an audited error) passes through: proving it again would
+                // replace its proof and record its lifecycle twice. Only the stamp
+                // shows that; proof, proofError and audit members can come from any
+                // handler, including one relaying an upstream server's result.
+                if (rawResult && isOwnResult?.(rawResult) !== true) {
+                    // Those members are untrusted here, so they are removed and the
+                    // result is proved and audited as any other. Other members stay.
+                    const received = withoutOutcomeMeta(rawResult);
+                    try {
                         // Work on a shallow copy: middleware is allowed to decorate its
                         // result, and an error response must remain byte-for-byte free of
                         // a success proof even if a custom middleware implementation does
                         // not apply the core implementation's early error return.
-                        const handler = async () => ({ ...rawResult });
+                        const handler = async () => ({ ...received });
                         const addProof = kyaos.wrapWithProof(call.toolName, handler);
                         const proofed = await addProof(call.args);
                         // Error results still traverse the middleware so their terminal
                         // audit event is emitted, but they retain the established wire
                         // contract: no success proof is attached to an error response.
-                        if (!rawResult.isError && proofed._meta !== undefined) {
-                            message = {
-                                ...message,
-                                result: proofed,
-                            };
-                        }
+                        message = {
+                            ...message,
+                            result: !received.isError && proofed._meta !== undefined ? proofed : received,
+                        };
                     }
-                }
-                catch (error) {
-                    logger.error("[kya-os-transport] Proof injection failed", {
-                        tool: call.toolName,
-                        error: error instanceof Error ? error.message : String(error),
-                    });
-                    const rawResult = message.result;
-                    if (rawResult) {
-                        rawResult._meta = {
-                            proofError: "Proof generation failed — response is unproven",
+                    catch (error) {
+                        logger.error("[kya-os-transport] Proof injection failed", {
+                            tool: call.toolName,
+                            error: error instanceof Error ? error.message : String(error),
+                        });
+                        message = {
+                            ...message,
+                            result: {
+                                ...received,
+                                _meta: {
+                                    ...(received._meta ?? {}),
+                                    proofError: "Proof generation failed — response is unproven",
+                                },
+                            },
                         };
-                        message = { ...message, result: rawResult };
                     }
                 }
             }
+            // The stamp never leaves the process, whichever path the message took.
+            if (typeof message.result === "object" && message.result !== null) {
+                const sent = withoutLifecycleStamp(message.result);
+                if (sent !== message.result)
+                    message = { ...message, result: sent };
+            }
             return inner.send(message);
         },
     };
@@ -121,6 +149,12 @@ export function createKyaOsTransport(inner, kyaos, exclude = ["_kyaos", "_kyaos_
                     });
                 }
             }
+            else if (message.method === "notifications/cancelled") {
+                // A cancelled request gets no response, so its entry would never be
+                // consumed by send().
+                const params = message.params;
+                pending.delete(params?.requestId);
+            }
             downstream?.(message);
         };
     };

package/dist/middleware/kya-os-transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"kya-os-transport.js","sourceRoot":"","sources":["../../src/middleware/kya-os-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAyB7C;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAgB,EAChB,KAAsB,EACtB,UAAoB,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAElD,yDAAyD;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEhD,MAAM,OAAO,GAAc;QACzB,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;QAC1B,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;QAE1B,oEAAoE;QACpE,+BAA+B;QAC/B,IAAI,SAAS,CAAC,OAAoD;YAChE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC;QAC5B,CAAC;QACD,IAAI,SAAS;YACX,OAAO,KAAK,CAAC,SAAS,CAAC;QACzB,CAAC;QAED,IAAI,OAAO,CAAC,OAAiC;YAC3C,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO;YACT,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,IAAI,OAAO,CAAC,OAA2C;YACrD,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO;YACT,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,qDAAqD;QACrD,wDAAwD;QACxD,KAAK,CAAC,IAAI,CAAC,OAAuB;YAChC,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAE5D,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,OAAO,CAAC,MAAgC,CAAC;oBAC3D,IAAI,SAAS,EAAE,CAAC;wBACd,gEAAgE;wBAChE,kEAAkE;wBAClE,kEAAkE;wBAClE,0DAA0D;wBAC1D,MAAM,OAAO,GAAqB,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;wBACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;wBAC7D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBAC1C,gEAAgE;wBAChE,+DAA+D;wBAC/D,+DAA+D;wBAC/D,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;4BACtD,OAAO,GAAG;gCACR,GAAG,OAAO;gCACV,MAAM,EAAE,OAAO;6BAChB,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;wBACxD,IAAI,EAAE,IAAI,CAAC,QAAQ;wBACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;oBACH,MAAM,SAAS,GAAG,OAAO,CAAC,MAAgC,CAAC;oBAC3D,IAAI,SAAS,EAAE,CAAC;wBACd,SAAS,CAAC,KAAK,GAAG;4BAChB,UAAU,EAAE,gDAAgD;yBAC7D,CAAC;wBACF,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;oBAC9C,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;IAEF,iEAAiE;IACjE,uDAAuD;IACvD,6EAA6E;IAC7E,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,CAAC,KAAK,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,aAAa,EAAE,CAAC;QACtB,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QACnC,KAAK,CAAC,SAAS,GAAG,CAAC,OAAuB,EAAE,EAAE;YAC5C,IACE,OAAO,CAAC,MAAM,KAAK,YAAY;gBAC/B,OAAO,CAAC,EAAE,KAAK,SAAS,EACxB,CAAC;gBACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAEV,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAM,EAAE,IAAI,CAAC;gBAC9B,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC5C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE;wBACtB,QAAQ;wBACR,IAAI,EAAE,MAAM,EAAE,SAAS,IAAI,EAAE;qBAC9B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"kya-os-transport.js","sourceRoot":"","sources":["../../src/middleware/kya-os-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAyB7C;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAgB,EAChB,KAAsB,EACtB,UAAoB,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAElD,yDAAyD;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAChD,0EAA0E;IAC1E,0EAA0E;IAC1E,wDAAwD;IACxD,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAE/D,MAAM,OAAO,GAAc;QACzB,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;QAC1B,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;QAE1B,oEAAoE;QACpE,+BAA+B;QAC/B,IAAI,SAAS,CAAC,OAAoD;YAChE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC;QAC5B,CAAC;QACD,IAAI,SAAS;YACX,OAAO,KAAK,CAAC,SAAS,CAAC;QACzB,CAAC;QAED,IAAI,OAAO,CAAC,OAAiC;YAC3C,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO;YACT,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,IAAI,OAAO,CAAC,OAA2C;YACrD,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO;YACT,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,qDAAqD;QACrD,wDAAwD;QACxD,KAAK,CAAC,IAAI,CAAC,OAAuB;YAChC,0EAA0E;YAC1E,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,UAAU,GACd,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC;YAC9E,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,UAAU,IAAI,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAE1E,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACnB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAgC,CAAC;gBAC3D,kEAAkE;gBAClE,qEAAqE;gBACrE,oEAAoE;gBACpE,mEAAmE;gBACnE,oEAAoE;gBACpE,+DAA+D;gBAC/D,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;oBACnD,gEAAgE;oBAChE,iEAAiE;oBACjE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;oBAC/C,IAAI,CAAC;wBACH,gEAAgE;wBAChE,kEAAkE;wBAClE,kEAAkE;wBAClE,0DAA0D;wBAC1D,MAAM,OAAO,GAAqB,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;wBAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;wBAC7D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBAC1C,gEAAgE;wBAChE,+DAA+D;wBAC/D,+DAA+D;wBAC/D,OAAO,GAAG;4BACR,GAAG,OAAO;4BACV,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;yBAC9E,CAAC;oBACJ,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;4BACxD,IAAI,EAAE,IAAI,CAAC,QAAQ;4BACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;yBAC9D,CAAC,CAAC;wBACH,OAAO,GAAG;4BACR,GAAG,OAAO;4BACV,MAAM,EAAE;gCACN,GAAG,QAAQ;gCACX,KAAK,EAAE;oCACL,GAAG,CAAE,QAAQ,CAAC,KAA6C,IAAI,EAAE,CAAC;oCAClE,UAAU,EAAE,gDAAgD;iCAC7D;6BACF;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,uEAAuE;YACvE,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBAClE,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAoB,CAAC,CAAC;gBACjE,IAAI,IAAI,KAAK,OAAO,CAAC,MAAM;oBAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACtE,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;IAEF,iEAAiE;IACjE,uDAAuD;IACvD,6EAA6E;IAC7E,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,CAAC,KAAK,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,aAAa,EAAE,CAAC;QACtB,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QACnC,KAAK,CAAC,SAAS,GAAG,CAAC,OAAuB,EAAE,EAAE;YAC5C,IACE,OAAO,CAAC,MAAM,KAAK,YAAY;gBAC/B,OAAO,CAAC,EAAE,KAAK,SAAS,EACxB,CAAC;gBACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAEV,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAM,EAAE,IAAI,CAAC;gBAC9B,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC5C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE;wBACtB,QAAQ;wBACR,IAAI,EAAE,MAAM,EAAE,SAAS,IAAI,EAAE;qBAC9B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,KAAK,yBAAyB,EAAE,CAAC;gBACxD,oEAAoE;gBACpE,sBAAsB;gBACtB,MAAM,MAAM,GAAG,OAAO,CAAC,MAA6C,CAAC;gBACrE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACpC,CAAC;YACD,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/middleware/with-kya-os-server.d.ts

@@ -10,11 +10,12 @@
  *   // All tools registered on `server` now get proofs automatically.
  *   await server.connect(transport); // transport is transparently wrapped
  */
-import type { CryptoProvider } from "../providers/base.js";
+import type { CryptoProvider, NonceCacheProvider } from "../providers/base.js";
 import type { GrantStore } from "../providers/grant-store.js";
 import type { AuditLogProvider } from "../providers/audit-log.js";
 import type { KyaOsAuditTrail } from "./with-kya-os.config-types.js";
 import type { SessionConfig } from "../session/manager.js";
+import type { ResponseProofProfile } from "../types/protocol.js";
 import { type KyaOsIdentityConfig, type KyaOsDelegationConfig, type KyaOsMiddleware } from "./with-kya-os.js";
 import { type Transport } from "./kya-os-transport.js";
 export interface WithKyaOsOptions {
@@ -24,10 +25,30 @@ export interface WithKyaOsOptions {
     identity?: KyaOsIdentityConfig;
     /**
      * Session configuration. Accepts the full {@link SessionConfig} (minus the
-     * `nonceCache`, which is set at the top level), so an optional durable
-     * `sessionStore` can be injected for cross-instance session continuity.
+     * `nonceCache`, which is set by the top-level {@link nonceCache} option), so
+     * an optional durable `sessionStore` can be injected for cross-instance
+     * session continuity.
      */
     session?: Omit<SessionConfig, "nonceCache">;
+    /**
+     * Replay-protection store shared by the session handshake and holder
+     * binding. Defaults to an in-memory store, which protects one process only;
+     * a multi-replica deployment MUST inject a shared store with an atomic
+     * `consume()`. Passed through to the middleware (see `KyaOsConfig.nonceCache`).
+     */
+    nonceCache?: NonceCacheProvider;
+    /**
+     * Refuse a `nonceCache` without an atomic `consume()` instead of warning
+     * once. Passed through to the middleware (see `KyaOsConfig.requireAtomicNonce`).
+     */
+    requireAtomicNonce?: boolean;
+    /**
+     * Response-proof profile for every proof this server mints (SPEC §7.3).
+     * Defaults to the body profile; the envelope profile also binds
+     * `structuredContent` and `isError`. Passed through to the middleware (see
+     * `KyaOsConfig.responseProofProfile`).
+     */
+    responseProofProfile?: ResponseProofProfile;
     /** Auto-create sessions for non-KYA-OS clients (default: true) */
     autoSession?: boolean;
     /** Attach proofs to all tool responses (default: true) */
@@ -74,6 +95,12 @@ export declare function generateIdentity(crypto: CryptoProvider): Promise<KyaOsI
 interface McpServerLike {
     connect(transport: Transport): Promise<unknown>;
     registerTool(...args: unknown[]): void;
+    /** McpServer reports whether a transport is already connected (SDK 1.10+). */
+    isConnected?(): boolean;
+    /** The underlying Server, whose `transport` is set once connected (SDK 1.3+). */
+    server?: {
+        transport?: unknown;
+    };
 }
 /**
  * Add KYA-OS to a McpServer instance.
@@ -98,4 +125,3 @@ interface McpServerLike {
  */
 export declare function withKyaOs(server: McpServerLike, options: WithKyaOsOptions): Promise<KyaOsMiddleware>;
 export {};
-//# sourceMappingURL=with-kya-os-server.d.ts.map

package/dist/middleware/with-kya-os-server.js

@@ -13,6 +13,7 @@
 import { generateDidKeyFromBase64, didKeyFragment } from "../utils/did-helpers.js";
 import { KYA_OS_ACTIONS, createKyaOsMiddleware, } from "./with-kya-os.js";
 import { createKyaOsTransport } from "./kya-os-transport.js";
+import { logger } from "../logging/index.js";
 import { z } from "zod";
 /**
  * Generate a fresh Ed25519 identity for KYA-OS.
@@ -52,6 +53,17 @@ export async function generateIdentity(crypto) {
  * @returns The KyaOsMiddleware instance for advanced usage (wrapWithDelegation, etc.)
  */
 export async function withKyaOs(server, options) {
+    // withKyaOs() wraps transports by patching connect(), so it only reaches
+    // transports connected from now on. Said before anything is registered: if
+    // the server had no tools yet, the SDK refuses the _kyaos registration below
+    // with a generic error, and this explains it; if it had some, nothing else
+    // would, and the connected transport would serve tool results unproved.
+    const alreadyConnected = server.isConnected?.() ?? server.server?.transport !== undefined;
+    if (options.proofAllTools !== false && alreadyConnected) {
+        logger.warn("[kya-os] withKyaOs() ran after server.connect(): the transport that is already " +
+            "connected is not wrapped, so its tool results carry no KYA-OS proof and no " +
+            "transport audit record. Call withKyaOs() before server.connect().");
+    }
     const identity = options.identity ?? (await generateIdentity(options.crypto));
     const kyaos = createKyaOsMiddleware({
         identity,
@@ -64,6 +76,13 @@ export async function withKyaOs(server, options) {
         ...(options.emitLegacyProofKey !== undefined
             ? { emitLegacyProofKey: options.emitLegacyProofKey }
             : {}),
+        ...(options.nonceCache !== undefined ? { nonceCache: options.nonceCache } : {}),
+        ...(options.requireAtomicNonce !== undefined
+            ? { requireAtomicNonce: options.requireAtomicNonce }
+            : {}),
+        ...(options.responseProofProfile !== undefined
+            ? { responseProofProfile: options.responseProofProfile }
+            : {}),
     }, options.crypto);
     if ((options.handshakeExposure ?? "tool") === "tool") {
         // Register the unified _kyaos tool for protocol operations.

package/dist/middleware/with-kya-os-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os-server.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,EACL,cAAc,EACd,qBAAqB,GAItB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAkB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA8CxB;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO;QACL,GAAG;QACH,GAAG,EAAE,GAAG,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;QACpC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAWD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAqB,EACrB,OAAyB;IAEzB,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,IAAI,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/D,MAAM,KAAK,GAAG,qBAAqB,CACjC;QACE,QAAQ;QACR,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QACxC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;YACpD,CAAC,CAAC,EAAE,CAAC;KACR,EACD,OAAO,CAAC,MAAM,CACf,CAAC;IAEF,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QACrD,4DAA4D;QAC5D,MAAM,CAAC,YAAY,CACjB,QAAQ,EACR;YACE,WAAW,EACT,iFAAiF;YACnF,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,IAAI,EAAE;YAC7D,WAAW,EAAE;gBACX,MAAM,EAAE,CAAC;qBACN,IAAI,CAAC,cAAc,CAAC;qBACpB,QAAQ,CAAC,+BAA+B,CAAC;gBAC5C,KAAK,EAAE,CAAC;qBACL,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,2CAA2C,CAAC;gBACxD,QAAQ,EAAE,CAAC;qBACR,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,+BAA+B,CAAC;gBAC5C,SAAS,EAAE,CAAC;qBACT,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,gCAAgC,CAAC;gBAC7C,QAAQ,EAAE,CAAC;qBACR,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,wCAAwC,CAAC;aACtD;SACF,EACD,KAAK,EAAE,IAAa,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CACpC,IAA+B,CAChC,CAAC;YACF,OAAO;gBACL,GAAG,MAAM;gBACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC;aACtE,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,EAAE;IACF,yEAAyE;IACzE,oEAAoE;IACpE,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEpD,MAAM,CAAC,OAAO,GAAG,CAAC,SAAoB,EAAE,EAAE,CACxC,eAAe,CAAC,oBAAoB,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"with-kya-os-server.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,EACL,cAAc,EACd,qBAAqB,GAItB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAkB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkExB;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO;QACL,GAAG;QACH,GAAG,EAAE,GAAG,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;QACpC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAeD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAqB,EACrB,OAAyB;IAEzB,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,gBAAgB,GACpB,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,MAAM,CAAC,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC;IACnE,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CACT,iFAAiF;YAC/E,6EAA6E;YAC7E,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,IAAI,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/D,MAAM,KAAK,GAAG,qBAAqB,CACjC;QACE,QAAQ;QACR,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QACxC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;YACpD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;YACpD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,oBAAoB,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;KACR,EACD,OAAO,CAAC,MAAM,CACf,CAAC;IAEF,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QACrD,4DAA4D;QAC5D,MAAM,CAAC,YAAY,CACjB,QAAQ,EACR;YACE,WAAW,EACT,iFAAiF;YACnF,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,IAAI,EAAE;YAC7D,WAAW,EAAE;gBACX,MAAM,EAAE,CAAC;qBACN,IAAI,CAAC,cAAc,CAAC;qBACpB,QAAQ,CAAC,+BAA+B,CAAC;gBAC5C,KAAK,EAAE,CAAC;qBACL,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,2CAA2C,CAAC;gBACxD,QAAQ,EAAE,CAAC;qBACR,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,+BAA+B,CAAC;gBAC5C,SAAS,EAAE,CAAC;qBACT,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,gCAAgC,CAAC;gBAC7C,QAAQ,EAAE,CAAC;qBACR,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,wCAAwC,CAAC;aACtD;SACF,EACD,KAAK,EAAE,IAAa,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CACpC,IAA+B,CAChC,CAAC;YACF,OAAO;gBACL,GAAG,MAAM;gBACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC;aACtE,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,EAAE;IACF,yEAAyE;IACzE,oEAAoE;IACpE,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEpD,MAAM,CAAC,OAAO,GAAG,CAAC,SAAoB,EAAE,EAAE,CACxC,eAAe,CAAC,oBAAoB,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/middleware/with-kya-os.config-types.d.ts

@@ -74,6 +74,25 @@ export interface KyaOsDelegationConfig {
      * reference adapter. Omit to keep the prior per-credential-status behavior.
      */
     revocationChecker?: RevocationChecker;
+    /**
+     * DIDs allowed to issue root delegations, the chain's Responsible Party
+     * (SPEC §6). When set, a delegation whose root credential is signed by any
+     * other DID is rejected, both when presented and when a stored grant is
+     * reused. Compared as exact strings against the verified signer. An empty
+     * list trusts no issuer. When unset, any issuer is accepted and the
+     * middleware logs a warning at startup; set it for production.
+     */
+    trustedRootIssuers?: readonly string[];
+    /**
+     * Local cost limit: the most credentials this server will verify in one
+     * delegation chain, root to leaf inclusive, checked before any of them is
+     * verified. Each costs a signature check and possibly a DID resolution. It
+     * bounds the server's own work, not how far authority may be delegated.
+     * Unset verifies any length; a value that is not a positive integer is
+     * refused at startup. It does not bound `resolveDelegationChain` itself, so
+     * a resolver that fetches one parent at a time should apply its own limit.
+     */
+    maxChainLength?: number;
     /**
      * Holder-of-key enforcement for inbound calls (spec §11.8). A valid delegation
      * is a *bearer* credential; holder binding additionally requires the caller to
@@ -113,11 +132,21 @@ export interface KyaOsConfig {
     /**
      * Replay-protection store, shared by the session handshake AND inbound holder
      * binding so both draw on one nonce namespace. Defaults to an in-memory store
-     * (single-process only); inject a Redis / Durable Object / KV-backed
-     * {@link NonceCacheProvider} for multi-instance deployments. Set here, not on
-     * `session`, so there is exactly one cache and the two cannot diverge.
+     * (single-process only). For multi-instance deployments inject a shared
+     * {@link NonceCacheProvider} whose `consume()` is an atomic conditional insert
+     * with expiry (Redis `SET NX PX`, a DynamoDB conditional write, a Durable
+     * Object transaction). Eventually consistent stores such as Workers KV cannot
+     * make that claim atomic on their own. Set here, not on `session`, so there is
+     * exactly one cache and the two cannot diverge.
      */
     nonceCache?: NonceCacheProvider;
+    /**
+     * Refuse a `nonceCache` without an atomic `consume()`: middleware creation
+     * throws instead of falling back to `has()` then `add()`, which lets concurrent
+     * duplicates of one signed request through. Applies to the handshake and to
+     * holder binding. Default false, with a startup warning for such a cache.
+     */
+    requireAtomicNonce?: boolean;
     /**
      * Durable store for approved authorization grants, enabling the no-paste
      * retry: an agent that already obtained a grant can call again — even on a
@@ -192,4 +221,3 @@ export interface KyaOsConfig {
      */
     auditLog?: AuditLogProvider;
 }
-//# sourceMappingURL=with-kya-os.config-types.d.ts.map

package/dist/middleware/with-kya-os.d.ts

@@ -43,4 +43,3 @@ export * from "./with-kya-os.types.js";
  * durable `SessionStore` via `config.session.sessionStore`.
  */
 export declare function createKyaOsMiddleware(config: KyaOsConfig, cryptoProvider: CryptoProvider): KyaOsMiddleware;
-//# sourceMappingURL=with-kya-os.d.ts.map

package/dist/middleware/with-kya-os.delegation-gate.d.ts

@@ -9,11 +9,12 @@
 import type { KyaOsDelegationGate } from "./with-kya-os.types.js";
 import type { MiddlewareDeps, AttachOutcomeProof } from "./with-kya-os.deps.js";
 import type { GrantResolution } from "./with-kya-os.grants.js";
+import { type DelegationVerification } from "./with-kya-os.delegation-verify.js";
 /** Collaborators the delegation gate borrows from its sibling sub-factories. */
 export interface DelegationGateWiring {
+    delegationVerification: DelegationVerification;
     attachOutcomeProof: AttachOutcomeProof;
     resolveExistingGrant: GrantResolution["resolveExistingGrant"];
     bindGrantOnSuccess: GrantResolution["bindGrantOnSuccess"];
 }
 export declare function createDelegationGate(deps: MiddlewareDeps, wiring: DelegationGateWiring): Pick<KyaOsDelegationGate, "wrapWithDelegation">;
-//# sourceMappingURL=with-kya-os.delegation-gate.d.ts.map

package/dist/middleware/with-kya-os.delegation-gate.js

@@ -8,11 +8,11 @@
  */
 import { isHolderBindingApplicable, isKyaOsControlArg, assertHolderBinding, toHolderBindingRequest, } from "../delegation/holder-binding.js";
 import { scopeSatisfies } from "../delegation/scope-matcher.js";
+import { getDelegationScopes } from "../delegation/chain-enforcement.js";
 import { logger } from "../logging/index.js";
 import { KYA_OS_ERROR_CODES } from "../errors.js";
 import { sanitizeForMessage } from "./with-kya-os.helpers.js";
 import { canonicalizeJsonBytes } from "../utils/canonical-json.js";
-import { createDelegationVerification, } from "./with-kya-os.delegation-verify.js";
 const MAX_AUDIT_REFERENCE_LENGTH = 256;
 /** Extract only a bounded string from an untrusted credential-shaped value. */
 function rejectedDelegationRef(value) {
@@ -40,21 +40,31 @@ function rejectedDelegationRef(value) {
         return 'unknown';
     }
 }
+/**
+ * Approval grants for a composed policy gate. They ride the reserved
+ * `_kyaos_approvals` argument, which is withheld from the handler like every
+ * control argument, so they travel on in the call context instead.
+ */
+function forwardedApprovals(args) {
+    const approvals = args["_kyaos_approvals"];
+    return approvals === undefined ? {} : { approvals };
+}
 export function createDelegationGate(deps, wiring) {
     const { identity, holderBindingMode, holderBindingVerifier, audit, cryptoProvider } = deps;
     const { attachOutcomeProof, resolveExistingGrant, bindGrantOnSuccess } = wiring;
-    const { verifyDelegation, buildDelegationErrorResponse, buildNeedsAuthorizationChallenge, } = createDelegationVerification(deps);
+    const { verifyDelegation, buildDelegationErrorResponse, buildNeedsAuthorizationChallenge, } = wiring.delegationVerification;
     function wrapWithDelegation(toolName, config, handler) {
         return async (args, sessionId) => {
             const delegationArg = args["_kyaos_delegation"];
             if (delegationArg === undefined || delegationArg === null) {
                 // No delegation pasted — a durable grant may already authorize this call
                 // (the no-paste retry), even on a fresh instance with empty memory.
-                // Holder-of-key first (agent-anchored, proof-gated), then the session
-                // bearer capability. On a hit, skip the challenge and run the handler
+                // Holder-of-key first, then policy-permitted session reuse. The resolver
+                // revalidates signed evidence on both paths. On a hit, run the handler
                 // with exactly the call shape a verified delegation would have produced.
-                const existingGrant = await resolveExistingGrant(toolName, args, sessionId, config.scopeId);
-                if (existingGrant) {
+                const resolvedGrant = await resolveExistingGrant(toolName, args, sessionId, config.scopeId);
+                if (resolvedGrant) {
+                    const existingGrant = resolvedGrant.grant;
                     const grantArgs = {};
                     for (const [k, v] of Object.entries(args)) {
                         if (!isKyaOsControlArg(k))
@@ -80,7 +90,17 @@ export function createDelegationGate(deps, wiring) {
                         grantRef: existingGrant.id,
                         context: grantContext,
                     });
-                    return handler(grantArgs, sessionId, grantContext);
+                    return handler(grantArgs, sessionId, {
+                        ...grantContext,
+                        principal: {
+                            agentDid: existingGrant.agentDid,
+                            ...(existingGrant.userDid !== undefined
+                                ? { responsibleParty: existingGrant.userDid }
+                                : {}),
+                            delegatedScopes: resolvedGrant.delegatedScopes,
+                        },
+                        ...forwardedApprovals(args),
+                    });
                 }
                 // No delegation provided — sign & return the needs_authorization
                 // challenge. The proof binds a responseHash over the EMITTED challenge
@@ -218,9 +238,17 @@ export function createDelegationGate(deps, wiring) {
             }
             // Mint a durable grant from this verified delegation so the next call —
             // on any instance — resolves via resolveExistingGrant with no re-paste.
-            await bindGrantOnSuccess(vc, delegationArg, isJwt, sessionId, config.scopeId);
+            await bindGrantOnSuccess(vc, delegationArg, isJwt, sessionId, config.scopeId, check.expiresAt);
             logger.debug(`[kya-os] Delegation verified for "${toolName}", scope "${config.scopeId}"`);
-            return handler(cleanArgs, sessionId, callContext);
+            return handler(cleanArgs, sessionId, {
+                ...callContext,
+                principal: {
+                    agentDid: vc.credentialSubject.id,
+                    ...(controller !== undefined ? { responsibleParty: controller } : {}),
+                    delegatedScopes: getDelegationScopes(vc),
+                },
+                ...forwardedApprovals(args),
+            });
         };
     }
     return { wrapWithDelegation };

package/dist/middleware/with-kya-os.delegation-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.delegation-gate.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,4BAA4B,GAE7B,MAAM,oCAAoC,CAAC;AAE5C,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC,+EAA+E;AAC/E,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAClE,MAAM,UAAU,GAAG,KAAgC,CAAC;QACpD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC;QAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACtE,MAAM,UAAU,GAAI,OAAmC,CAAC,UAAU,CAAC;QACnE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5E,MAAM,MAAM,GAAI,UAAsC,CAAC,EAAE,CAAC;QAC1D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YACpD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AASD,MAAM,UAAU,oBAAoB,CAClC,IAAoB,EACpB,MAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAC3F,MAAM,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GACpE,MAAM,CAAC;IACT,MAAM,EACJ,gBAAgB,EAChB,4BAA4B,EAC5B,gCAAgC,GACjC,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAEvC,SAAS,kBAAkB,CACzB,QAAgB,EAChB,MAA4B,EAC5B,OAAyB;QAEzB,OAAO,KAAK,EAAE,IAA6B,EAAE,SAAkB,EAAE,EAAE;YACjE,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAEhD,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC1D,yEAAyE;gBACzE,oEAAoE;gBACpE,sEAAsE;gBACtE,sEAAsE;gBACtE,yEAAyE;gBACzE,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAC9C,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CAAC,OAAO,CACf,CAAC;gBACF,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,SAAS,GAA4B,EAAE,CAAC;oBAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;4BAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBAC9C,CAAC;oBACD,MAAM,CAAC,KAAK,CACV,gCAAgC,QAAQ,aAAa,MAAM,CAAC,OAAO,2BAA2B,CAC/F,CAAC;oBACF,MAAM,YAAY,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,KAAK,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE;wBACrE,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;4BAC3C,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,EAAE;4BACrF,CAAC,CAAC,EAAE,CAAC;wBACP,aAAa,EAAE;4BACb,MAAM,EAAE,OAAgB;4BACxB,QAAQ,EAAE,SAAkB;4BAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;4BACvB,QAAQ,EAAE,aAAa,CAAC,EAAE;4BAC1B,gBAAgB,EAAE,wBAAwB;yBAC3C;qBACF,CAAC;oBACF,MAAM,KAAK,EAAE,aAAa,CAAC,YAAY,EAAE;wBACvC,OAAO,EAAE,WAAW;wBACpB,QAAQ,EAAE,aAAa,CAAC,EAAE;wBAC1B,OAAO,EAAE,YAAY;qBACtB,CAAC,CAAC;oBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;gBACrD,CAAC;gBAED,iEAAiE;gBACjE,uEAAuE;gBACvE,yEAAyE;gBACzE,uEAAuE;gBACvE,sEAAsE;gBACtE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,GACjC,MAAM,gCAAgC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC3D,OAAO,kBAAkB,CACvB,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,OAAO,EACP,qBAAqB,EACrB,SAAS,EACT,gBAAgB,CACjB,CAAC;YACJ,CAAC;YAED,yEAAyE;YACzE,2EAA2E;YAC3E,gEAAgE;YAChE,qEAAqE;YACrE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,aAAa,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE;wBAClC,aAAa,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC9C,OAAO,EAAE,QAAQ;wBACjB,UAAU,EAAE,gCAAgC;qBAC7C,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE;wBACxE,IAAI,EAAE,QAAQ;wBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,CAAC,IAAI,CACT,gDAAgD,QAAQ,MAAM,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CACjG,CAAC;gBACF,OAAO,kBAAkB,CACvB,4BAA4B,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,EACjF,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,KAAK,CAAC,MAAM,CACb,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;YAE5B,oEAAoE;YACpE,0EAA0E;YAC1E,2EAA2E;YAC3E,4EAA4E;YAC5E,4EAA4E;YAC5E,IAAI,iBAAiB,KAAK,KAAK,IAAI,qBAAqB,EAAE,CAAC;gBACzD,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBAC5C,IAAI,UAAU,IAAI,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;oBACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;oBACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAC3B,MAAM,MAAM,GACV,4EAA4E,CAAC;wBAC/E,MAAM,CAAC,IAAI,CACT,6BAA6B,QAAQ,+BAA+B,CACrE,CAAC;wBACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;4BACpC,OAAO,kBAAkB,CACvB,4BAA4B,CAC1B,kBAAkB,CAAC,qBAAqB,EACxC,MAAM,CACP,EACD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;wBACJ,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,IAAI,WAAW,GAAY,QAAQ,CAAC;wBACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;4BACjC,IAAI,CAAC;gCACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;4BACrC,CAAC;4BAAC,MAAM,CAAC;gCACP,WAAW,GAAG,EAAE,CAAC;4BACnB,CAAC;wBACH,CAAC;wBACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;4BACxC,KAAK,EAAE,WAA4B;4BACnC,UAAU;4BACV,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC;4BAC/C,gBAAgB,EAAE,QAAQ,CAAC,GAAG;4BAC9B,aAAa,EAAE,qBAAqB;yBACrC,CAAC,CAAC;wBACH,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;4BAC/B,MAAM,MAAM,GACV,OAAO,CAAC,MAAM;gCACd,yDAAyD,CAAC;4BAC5D,MAAM,CAAC,IAAI,CACT,2BAA2B,OAAO,CAAC,MAAM,SAAS,QAAQ,MAAM,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC7F,CAAC;4BACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gCACpC,OAAO,kBAAkB,CACvB,4BAA4B,CAC1B,kBAAkB,CAAC,qBAAqB,EACxC,MAAM,CACP,EACD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;4BACJ,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,UAAU,EAAE,CAAC;oBACtB,iEAAiE;oBACjE,2DAA2D;oBAC3D,MAAM,CAAC,IAAI,CACT,qCAAqC,UAAU,sDAAsD,CACtG,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,uEAAuE;YACvE,0DAA0D;YAC1D,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACvD,IAAI,WAAW,CAAC,mBAAmB,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CACT,mBAAmB,MAAM,CAAC,OAAO,UAAU,QAAQ,4BAA4B;oBAC7E,uFAAuF,CAC1F,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,mBAAmB,MAAM,CAAC,OAAO,4BAA4B,CAAC;gBAC7E,MAAM,CAAC,IAAI,CACT,+CAA+C,MAAM,CAAC,OAAO,UAAU,QAAQ,GAAG,CACnF,CAAC;gBACF,OAAO,kBAAkB,CACvB,4BAA4B,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAC3E,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,KAAK;gBAChC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAuB,CAAC;gBACnD,CAAC,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC9B,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,oBAAoB,CAAW,CAAC;YACnF,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YAClE,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC;YAC9E,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,UAAU,CAAC;YAC9D,MAAM,aAAa,GAAG;gBACpB,MAAM,EAAE,YAAqB;gBAC7B,QAAQ,EAAE,SAAkB;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,aAAa;gBACb,0BAA0B,EAAE,gBAAgB;gBAC5C,gBAAgB,EAAE,wBAAwB;aAC3C,CAAC;YACF,MAAM,WAAW,GAAG;gBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK;gBACL,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC;oBAChC,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;oBAC1E,CAAC,CAAC,EAAE,CAAC;gBACP,aAAa;aACd,CAAC;YAEF,MAAM,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE;gBAClC,aAAa;gBACb,OAAO,EAAE,WAAW;gBACpB,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,QAAQ;gBACnD,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;gBACrC,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YAEH,qEAAqE;YACrE,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;oBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YAED,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,kBAAkB,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAE9E,MAAM,CAAC,KAAK,CACV,qCAAqC,QAAQ,aAAa,MAAM,CAAC,OAAO,GAAG,CAC5E,CAAC;YACF,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAChC,CAAC"}
+{"version":3,"file":"with-kya-os.delegation-gate.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAEzE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAQlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAOnE,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC,+EAA+E;AAC/E,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAClE,MAAM,UAAU,GAAG,KAAgC,CAAC;QACpD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC;QAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACtE,MAAM,UAAU,GAAI,OAAmC,CAAC,UAAU,CAAC;QACnE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5E,MAAM,MAAM,GAAI,UAAsC,CAAC,EAAE,CAAC;QAC1D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YACpD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,IAA6B;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC3C,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;AACtD,CAAC;AAUD,MAAM,UAAU,oBAAoB,CAClC,IAAoB,EACpB,MAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAC3F,MAAM,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GACpE,MAAM,CAAC;IACT,MAAM,EACJ,gBAAgB,EAChB,4BAA4B,EAC5B,gCAAgC,GACjC,GAAG,MAAM,CAAC,sBAAsB,CAAC;IAElC,SAAS,kBAAkB,CACzB,QAAgB,EAChB,MAA4B,EAC5B,OAAyB;QAEzB,OAAO,KAAK,EAAE,IAA6B,EAAE,SAAkB,EAAE,EAAE;YACjE,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAEhD,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC1D,yEAAyE;gBACzE,oEAAoE;gBACpE,yEAAyE;gBACzE,uEAAuE;gBACvE,yEAAyE;gBACzE,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAC9C,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CAAC,OAAO,CACf,CAAC;gBACF,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC;oBAC1C,MAAM,SAAS,GAA4B,EAAE,CAAC;oBAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;4BAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBAC9C,CAAC;oBACD,MAAM,CAAC,KAAK,CACV,gCAAgC,QAAQ,aAAa,MAAM,CAAC,OAAO,2BAA2B,CAC/F,CAAC;oBACF,MAAM,YAAY,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,KAAK,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE;wBACrE,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;4BAC3C,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,EAAE;4BACrF,CAAC,CAAC,EAAE,CAAC;wBACP,aAAa,EAAE;4BACb,MAAM,EAAE,OAAgB;4BACxB,QAAQ,EAAE,SAAkB;4BAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;4BACvB,QAAQ,EAAE,aAAa,CAAC,EAAE;4BAC1B,gBAAgB,EAAE,wBAAwB;yBAC3C;qBACF,CAAC;oBACF,MAAM,KAAK,EAAE,aAAa,CAAC,YAAY,EAAE;wBACvC,OAAO,EAAE,WAAW;wBACpB,QAAQ,EAAE,aAAa,CAAC,EAAE;wBAC1B,OAAO,EAAE,YAAY;qBACtB,CAAC,CAAC;oBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE;wBACnC,GAAG,YAAY;wBACf,SAAS,EAAE;4BACT,QAAQ,EAAE,aAAa,CAAC,QAAQ;4BAChC,GAAG,CAAC,aAAa,CAAC,OAAO,KAAK,SAAS;gCACrC,CAAC,CAAC,EAAE,gBAAgB,EAAE,aAAa,CAAC,OAAO,EAAE;gCAC7C,CAAC,CAAC,EAAE,CAAC;4BACP,eAAe,EAAE,aAAa,CAAC,eAAe;yBAC/C;wBACD,GAAG,kBAAkB,CAAC,IAAI,CAAC;qBAC5B,CAAC,CAAC;gBACL,CAAC;gBAED,iEAAiE;gBACjE,uEAAuE;gBACvE,yEAAyE;gBACzE,uEAAuE;gBACvE,sEAAsE;gBACtE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,GACjC,MAAM,gCAAgC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC3D,OAAO,kBAAkB,CACvB,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,OAAO,EACP,qBAAqB,EACrB,SAAS,EACT,gBAAgB,CACjB,CAAC;YACJ,CAAC;YAED,yEAAyE;YACzE,2EAA2E;YAC3E,gEAAgE;YAChE,qEAAqE;YACrE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,aAAa,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE;wBAClC,aAAa,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC9C,OAAO,EAAE,QAAQ;wBACjB,UAAU,EAAE,gCAAgC;qBAC7C,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE;wBACxE,IAAI,EAAE,QAAQ;wBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,CAAC,IAAI,CACT,gDAAgD,QAAQ,MAAM,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CACjG,CAAC;gBACF,OAAO,kBAAkB,CACvB,4BAA4B,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,EACjF,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,KAAK,CAAC,MAAM,CACb,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;YAE5B,oEAAoE;YACpE,0EAA0E;YAC1E,2EAA2E;YAC3E,4EAA4E;YAC5E,4EAA4E;YAC5E,IAAI,iBAAiB,KAAK,KAAK,IAAI,qBAAqB,EAAE,CAAC;gBACzD,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBAC5C,IAAI,UAAU,IAAI,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;oBACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;oBACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAC3B,MAAM,MAAM,GACV,4EAA4E,CAAC;wBAC/E,MAAM,CAAC,IAAI,CACT,6BAA6B,QAAQ,+BAA+B,CACrE,CAAC;wBACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;4BACpC,OAAO,kBAAkB,CACvB,4BAA4B,CAC1B,kBAAkB,CAAC,qBAAqB,EACxC,MAAM,CACP,EACD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;wBACJ,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,IAAI,WAAW,GAAY,QAAQ,CAAC;wBACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;4BACjC,IAAI,CAAC;gCACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;4BACrC,CAAC;4BAAC,MAAM,CAAC;gCACP,WAAW,GAAG,EAAE,CAAC;4BACnB,CAAC;wBACH,CAAC;wBACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;4BACxC,KAAK,EAAE,WAA4B;4BACnC,UAAU;4BACV,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC;4BAC/C,gBAAgB,EAAE,QAAQ,CAAC,GAAG;4BAC9B,aAAa,EAAE,qBAAqB;yBACrC,CAAC,CAAC;wBACH,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;4BAC/B,MAAM,MAAM,GACV,OAAO,CAAC,MAAM;gCACd,yDAAyD,CAAC;4BAC5D,MAAM,CAAC,IAAI,CACT,2BAA2B,OAAO,CAAC,MAAM,SAAS,QAAQ,MAAM,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC7F,CAAC;4BACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gCACpC,OAAO,kBAAkB,CACvB,4BAA4B,CAC1B,kBAAkB,CAAC,qBAAqB,EACxC,MAAM,CACP,EACD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;4BACJ,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,UAAU,EAAE,CAAC;oBACtB,iEAAiE;oBACjE,2DAA2D;oBAC3D,MAAM,CAAC,IAAI,CACT,qCAAqC,UAAU,sDAAsD,CACtG,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,uEAAuE;YACvE,0DAA0D;YAC1D,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACvD,IAAI,WAAW,CAAC,mBAAmB,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CACT,mBAAmB,MAAM,CAAC,OAAO,UAAU,QAAQ,4BAA4B;oBAC7E,uFAAuF,CAC1F,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,mBAAmB,MAAM,CAAC,OAAO,4BAA4B,CAAC;gBAC7E,MAAM,CAAC,IAAI,CACT,+CAA+C,MAAM,CAAC,OAAO,UAAU,QAAQ,GAAG,CACnF,CAAC;gBACF,OAAO,kBAAkB,CACvB,4BAA4B,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAC3E,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,KAAK;gBAChC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAuB,CAAC;gBACnD,CAAC,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC9B,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,oBAAoB,CAAW,CAAC;YACnF,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YAClE,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC;YAC9E,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,UAAU,CAAC;YAC9D,MAAM,aAAa,GAAG;gBACpB,MAAM,EAAE,YAAqB;gBAC7B,QAAQ,EAAE,SAAkB;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,aAAa;gBACb,0BAA0B,EAAE,gBAAgB;gBAC5C,gBAAgB,EAAE,wBAAwB;aAC3C,CAAC;YACF,MAAM,WAAW,GAAG;gBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK;gBACL,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC;oBAChC,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;oBAC1E,CAAC,CAAC,EAAE,CAAC;gBACP,aAAa;aACd,CAAC;YAEF,MAAM,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE;gBAClC,aAAa;gBACb,OAAO,EAAE,WAAW;gBACpB,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,QAAQ;gBACnD,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;gBACrC,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YAEH,qEAAqE;YACrE,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;oBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YAED,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,kBAAkB,CACtB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CACrE,CAAC;YAEF,MAAM,CAAC,KAAK,CACV,qCAAqC,QAAQ,aAAa,MAAM,CAAC,OAAO,GAAG,CAC5E,CAAC;YACF,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE;gBACnC,GAAG,WAAW;gBACd,SAAS,EAAE;oBACT,QAAQ,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE;oBACjC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrE,eAAe,EAAE,mBAAmB,CAAC,EAAE,CAAC;iBACzC;gBACD,GAAG,kBAAkB,CAAC,IAAI,CAAC;aAC5B,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAChC,CAAC"}

package/dist/middleware/with-kya-os.delegation-verify.d.ts

@@ -27,6 +27,7 @@ export type DelegationCheck = {
     valid: true;
     vc: DelegationCredential;
     isJwt: boolean;
+    expiresAt?: number;
 } | {
     valid: false;
     reason: string;
@@ -61,4 +62,3 @@ export interface DelegationVerification {
     }>;
 }
 export declare function createDelegationVerification(deps: MiddlewareDeps): DelegationVerification;
-//# sourceMappingURL=with-kya-os.delegation-verify.d.ts.map