@kya-os/mcp 1.16.2 → 1.18.0

package/dist/middleware/with-kya-os.delegation-verify.js

@@ -11,12 +11,13 @@ import { createDidWebResolver } from "../delegation/did-web-resolver.js";
 import { buildDidResolverRegistry, } from "../delegation/did-resolver-registry.js";
 import { getDidMethod } from "../utils/did-helpers.js";
 import { DelegationCredentialVerifier, } from "../delegation/vc-verifier.js";
-import { validateDelegationChain as validateDelegationChainCore } from "../delegation/chain-enforcement.js";
+import { validateDelegationChain as validateDelegationChainCore, } from "../delegation/chain-enforcement.js";
 import { RuntimeFetchProvider } from "../providers/runtime-fetch.js";
 import { canonicalizeJSON, parseVCJWT } from "../delegation/utils.js";
 import { base64urlDecodeToBytes, bytesToBase64 } from "../utils/base64.js";
 import { createNeedsAuthorizationError, readCredentialProofValue, } from "../types/protocol.js";
 import { logger } from "../logging/index.js";
+import { TtlCache } from "../utils/ttl-cache.js";
 import { sanitizeForMessage } from "./with-kya-os.helpers.js";
 export function createDelegationVerification(deps) {
     const { identity, cryptoProvider, delegationConfig } = deps;
@@ -110,19 +111,50 @@ export function createDelegationVerification(deps) {
         ],
         isError: true,
     });
-    const validateDelegationChain = (leafCredential, options) => validateDelegationChainCore(leafCredential, {
-        serverDid: identity.did,
-        verifier,
-        resolveDelegationChain: delegationConfig?.resolveDelegationChain,
-        statusListConfigured: !!delegationConfig?.statusListResolver,
-        revocationChecker: delegationConfig?.revocationChecker,
-    }, options);
+    const trustedRootIssuers = delegationConfig?.trustedRootIssuers;
+    if (trustedRootIssuers === undefined) {
+        logger.warn("[kya-os] delegation.trustedRootIssuers is not set, so a delegation from any issuer is " +
+            "accepted, including one an agent signs for itself. Set it to the DIDs allowed to grant authority.");
+    }
+    // Refused at startup: a bad value would otherwise boot cleanly and then deny
+    // every delegated call, echoing the config detail back to the caller.
+    const maxChainLength = delegationConfig?.maxChainLength;
+    if (maxChainLength !== undefined && (!Number.isInteger(maxChainLength) || maxChainLength < 1)) {
+        throw new RangeError(`[kya-os] delegation.maxChainLength must be a positive integer (got ${String(maxChainLength)})`);
+    }
+    // Root credentials whose claimed issuerDid is not their signer are accepted
+    // for compatibility but reported: each distinct message at most once an hour,
+    // with the oldest evicted first so the set stays bounded.
+    const reportedChainWarnings = new TtlCache({ ttlMs: 60 * 60 * 1000, maxEntries: 256 });
+    const reportChainWarnings = (warnings) => {
+        for (const warning of warnings ?? []) {
+            if (reportedChainWarnings.get(warning))
+                continue;
+            reportedChainWarnings.set(warning, true);
+            logger.warn(`[kya-os] ${sanitizeForMessage(warning)}`);
+        }
+    };
+    const validateDelegationChain = async (leafCredential, options) => {
+        const result = await validateDelegationChainCore(leafCredential, {
+            serverDid: identity.did,
+            verifier,
+            resolveDelegationChain: delegationConfig?.resolveDelegationChain,
+            statusListConfigured: !!delegationConfig?.statusListResolver,
+            revocationChecker: delegationConfig?.revocationChecker,
+            ...(trustedRootIssuers !== undefined ? { trustedRootIssuers } : {}),
+            ...(maxChainLength !== undefined ? { maxChainLength } : {}),
+        }, options);
+        if (result.valid)
+            reportChainWarnings(result.warnings);
+        return result;
+    };
     async function verifyDelegation(delegationArg) {
         // Normalize to a DelegationCredential, authenticating by wire form. A VC-JWT
         // string carries its signature in the compact-JWS ENVELOPE; an object carries
         // an embedded Data-Integrity proof (verified inside validateDelegationChain).
         let vc;
         let isJwt = false;
+        let jwtExpiresAt;
         if (typeof delegationArg === "string") {
             const parsed = parseVCJWT(delegationArg);
             if (!parsed || !parsed.payload.vc) {
@@ -142,6 +174,9 @@ export function createDelegationVerification(deps) {
                     vc: parsed.payload.vc,
                 };
             }
+            // This exact JWT's optional exp has passed the envelope verifier's live
+            // time checks. Preserve its narrower deadline when caching the grant.
+            jwtExpiresAt = parsed.payload.exp !== undefined ? parsed.payload.exp * 1000 : undefined;
             vc = parsed.payload.vc;
             // A JWT has no embedded `proof`; add a marker so basic validation (which
             // requires proof presence) passes. The already-verified envelope is the
@@ -181,7 +216,15 @@ export function createDelegationVerification(deps) {
                 vc,
             };
         }
-        return { valid: true, vc, isJwt };
+        const expiresAt = jwtExpiresAt === undefined
+            ? chain.expiresAt
+            : Math.min(jwtExpiresAt, chain.expiresAt ?? jwtExpiresAt);
+        return {
+            valid: true,
+            vc,
+            isJwt,
+            ...(expiresAt !== undefined ? { expiresAt } : {}),
+        };
     }
     async function buildNeedsAuthorizationChallenge(toolName, config) {
         const tokenBytes = await cryptoProvider.randomBytes(16);

package/dist/middleware/with-kya-os.delegation-verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.delegation-verify.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EACL,4BAA4B,GAG7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,IAAI,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GAGzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAoD9D,MAAM,UAAU,4BAA4B,CAC1C,IAAoB;IAEpB,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAE5D,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;IAC9C,MAAM,aAAa,GACjB,gBAAgB,EAAE,aAAa;QAC/B,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;YACrC,CAAC,CAAC,IAAI,oBAAoB,EAAE;YAC5B,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,MAAM,cAAc,GAAG,aAAa;QAClC,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,sBAAsB,GAAG,wBAAwB,CACrD,gBAAgB,EAAE,YAAY,EAC9B,aAAa,CACd,CAAC;IACF,MAAM,WAAW,GAAgB;QAC/B,KAAK,CAAC,OAAO,CAAC,GAAW;YACvB,MAAM,cAAc,GAAG,gBAAgB,EAAE,WAAW,CAAC;YACrD,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,QAAQ,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,kBAAkB,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/E,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACvD,IAAI,QAAQ,EAAE,CAAC;wBACb,OAAO,QAAQ,CAAC;oBAClB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;YAC9C,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IAEF,MAAM,iBAAiB,GAAkC,KAAK,EAC5D,EAAwB,EACxB,YAAqB,EACyB,EAAE;QAChD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAgC,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACjE,CAAC;QAED,yEAAyE;QACzE,MAAM,QAAQ,GAAG,EAA6B,CAAC;QAC/C,MAAM,cAAc,GAA4B,EAAE,CAAC;QACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,OAAO;gBAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEjD,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEpD,iEAAiE;QACjE,MAAM,GAAG,GAAG,YAA8B,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAChE,CAAC;QAED,mEAAmE;QACnE,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAEhD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QACxE,OAAO;YACL,KAAK;YACL,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B;SAC5D,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAAC;QAChD,WAAW;QACX,iBAAiB;QACjB,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB;QACxD,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK;QACpD,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU;KAC9D,CAAC,CAAC;IAEH,MAAM,4BAA4B,GAAG,CACnC,KAAa,EACb,MAAc,EACyB,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;aACpE;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,MAAM,uBAAuB,GAAG,CAC9B,cAAoC,EACpC,OAAqC,EACS,EAAE,CAChD,2BAA2B,CACzB,cAAc,EACd;QACE,SAAS,EAAE,QAAQ,CAAC,GAAG;QACvB,QAAQ;QACR,sBAAsB,EAAE,gBAAgB,EAAE,sBAAsB;QAChE,oBAAoB,EAAE,CAAC,CAAC,gBAAgB,EAAE,kBAAkB;QAC5D,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB;KACvD,EACD,OAAO,CACR,CAAC;IAEJ,KAAK,UAAU,gBAAgB,CAC7B,aAAsB;QAEtB,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,IAAI,EAAwB,CAAC;QAC7B,IAAI,KAAK,GAAG,KAAK,CAAC;QAElB,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;YAC3D,CAAC;YACD,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,4DAA4D;YAC5D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,aAAa,EAAE;gBACjE,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACpB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,wCAAwC;oBACnE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAA0B;iBAC9C,CAAC;YACJ,CAAC;YACD,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAA0B,CAAC;YAC/C,yEAAyE;YACzE,wEAAwE;YACxE,iEAAiE;YACjE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACd,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC;YACtE,CAAC;YACD,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,aAAqC,CAAC;QAC7C,CAAC;QAED,0EAA0E;QAC1E,8EAA8E;QAC9E,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,KAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;gBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;aACxD,CAAC,CAAC;YACH,KAAK,GAAG;gBACN,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,6CAA6C;aACtD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,qCAAqC;gBAC7D,EAAE;aACH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,UAAU,gCAAgC,CAC7C,QAAgB,EAChB,MAA4B;QAK5B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,WAAW,GAAG;YAClB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;SACd,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;QAEtD,MAAM,SAAS,GAAG,6BAA6B,CAAC;YAC9C,OAAO,EAAE,SAAS,QAAQ,qCAAqC,MAAM,CAAC,OAAO,EAAE;YAC/E,gBAAgB,EAAE,MAAM,CAAC,UAAU;YACnC,WAAW;YACX,SAAS;YACT,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;QAEH,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,uBAAuB,GAAG;YAC9B,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;SAC3D,CAAC;QACF,IAAI,gBAAgB,GAAG,uBAAuB,CAAC;QAC/C,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,gBAAgB,GAAG,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE;oBAC1E,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,gBAAgB,GAAG,uBAAuB,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,gBAAgB;QAChB,4BAA4B;QAC5B,gCAAgC;KACjC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"with-kya-os.delegation-verify.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EACL,4BAA4B,GAG7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uBAAuB,IAAI,2BAA2B,GAEvD,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GAGzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAoD9D,MAAM,UAAU,4BAA4B,CAC1C,IAAoB;IAEpB,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAE5D,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;IAC9C,MAAM,aAAa,GACjB,gBAAgB,EAAE,aAAa;QAC/B,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;YACrC,CAAC,CAAC,IAAI,oBAAoB,EAAE;YAC5B,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,MAAM,cAAc,GAAG,aAAa;QAClC,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,sBAAsB,GAAG,wBAAwB,CACrD,gBAAgB,EAAE,YAAY,EAC9B,aAAa,CACd,CAAC;IACF,MAAM,WAAW,GAAgB;QAC/B,KAAK,CAAC,OAAO,CAAC,GAAW;YACvB,MAAM,cAAc,GAAG,gBAAgB,EAAE,WAAW,CAAC;YACrD,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,QAAQ,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,kBAAkB,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/E,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACvD,IAAI,QAAQ,EAAE,CAAC;wBACb,OAAO,QAAQ,CAAC;oBAClB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;YAC9C,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IAEF,MAAM,iBAAiB,GAAkC,KAAK,EAC5D,EAAwB,EACxB,YAAqB,EACyB,EAAE;QAChD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAgC,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACjE,CAAC;QAED,yEAAyE;QACzE,MAAM,QAAQ,GAAG,EAA6B,CAAC;QAC/C,MAAM,cAAc,GAA4B,EAAE,CAAC;QACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,OAAO;gBAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEjD,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEpD,iEAAiE;QACjE,MAAM,GAAG,GAAG,YAA8B,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAChE,CAAC;QAED,mEAAmE;QACnE,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAEhD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QACxE,OAAO;YACL,KAAK;YACL,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B;SAC5D,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAAC;QAChD,WAAW;QACX,iBAAiB;QACjB,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB;QACxD,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK;QACpD,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU;KAC9D,CAAC,CAAC;IAEH,MAAM,4BAA4B,GAAG,CACnC,KAAa,EACb,MAAc,EACyB,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;aACpE;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAAG,gBAAgB,EAAE,kBAAkB,CAAC;IAChE,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CACT,wFAAwF;YACtF,mGAAmG,CACtG,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,cAAc,GAAG,gBAAgB,EAAE,cAAc,CAAC;IACxD,IAAI,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,UAAU,CAClB,sEAAsE,MAAM,CAAC,cAAc,CAAC,GAAG,CAChG,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,0DAA0D;IAC1D,MAAM,qBAAqB,GAAG,IAAI,QAAQ,CAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7F,MAAM,mBAAmB,GAAG,CAAC,QAAuC,EAAQ,EAAE;QAC5E,KAAK,MAAM,OAAO,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YACjD,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,YAAY,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,uBAAuB,GAAG,KAAK,EACnC,cAAoC,EACpC,OAAqC,EACL,EAAE;QAClC,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAC9C,cAAc,EACd;YACE,SAAS,EAAE,QAAQ,CAAC,GAAG;YACvB,QAAQ;YACR,sBAAsB,EAAE,gBAAgB,EAAE,sBAAsB;YAChE,oBAAoB,EAAE,CAAC,CAAC,gBAAgB,EAAE,kBAAkB;YAC5D,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB;YACtD,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,EACD,OAAO,CACR,CAAC;QACF,IAAI,MAAM,CAAC,KAAK;YAAE,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,KAAK,UAAU,gBAAgB,CAC7B,aAAsB;QAEtB,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,IAAI,EAAwB,CAAC;QAC7B,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,YAAgC,CAAC;QAErC,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;YAC3D,CAAC;YACD,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,4DAA4D;YAC5D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,aAAa,EAAE;gBACjE,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACpB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,wCAAwC;oBACnE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAA0B;iBAC9C,CAAC;YACJ,CAAC;YACD,wEAAwE;YACxE,sEAAsE;YACtE,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAA0B,CAAC;YAC/C,yEAAyE;YACzE,wEAAwE;YACxE,iEAAiE;YACjE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACd,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC;YACtE,CAAC;YACD,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,aAAqC,CAAC;QAC7C,CAAC;QAED,0EAA0E;QAC1E,8EAA8E;QAC9E,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,KAA4B,CAAC;QACjC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;gBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;aACxD,CAAC,CAAC;YACH,KAAK,GAAG;gBACN,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,6CAA6C;aACtD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,qCAAqC;gBAC7D,EAAE;aACH,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,KAAK,SAAS;YAC1C,CAAC,CAAC,KAAK,CAAC,SAAS;YACjB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,IAAI,YAAY,CAAC,CAAC;QAC5D,OAAO;YACL,KAAK,EAAE,IAAI;YACX,EAAE;YACF,KAAK;YACL,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,gCAAgC,CAC7C,QAAgB,EAChB,MAA4B;QAK5B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,WAAW,GAAG;YAClB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;SACd,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;QAEtD,MAAM,SAAS,GAAG,6BAA6B,CAAC;YAC9C,OAAO,EAAE,SAAS,QAAQ,qCAAqC,MAAM,CAAC,OAAO,EAAE;YAC/E,gBAAgB,EAAE,MAAM,CAAC,UAAU;YACnC,WAAW;YACX,SAAS;YACT,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;QAEH,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,uBAAuB,GAAG;YAC9B,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;SAC3D,CAAC;QACF,IAAI,gBAAgB,GAAG,uBAAuB,CAAC;QAC/C,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,gBAAgB,GAAG,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE;oBAC1E,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,gBAAgB,GAAG,uBAAuB,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,gBAAgB;QAChB,4BAA4B;QAC5B,gCAAgC;KACjC,CAAC;AACJ,CAAC"}

package/dist/middleware/with-kya-os.deps.d.ts

@@ -46,4 +46,3 @@ export interface MiddlewareDeps {
      */
     responseProofProfile: ResponseProofProfile;
 }
-//# sourceMappingURL=with-kya-os.deps.d.ts.map

package/dist/middleware/with-kya-os.grants.d.ts

@@ -8,23 +8,30 @@
  */
 import type { Grant } from "../providers/grant-store.js";
 import type { DelegationCredential } from "../types/protocol.js";
+import type { DelegationVerification } from "./with-kya-os.delegation-verify.js";
 import type { MiddlewareDeps } from "./with-kya-os.deps.js";
+/** A durable grant whose retained delegation re-verified for this call. */
+export interface ResolvedGrant {
+    grant: Grant;
+    /** The scopes the re-verified credential grants (not the store's copy). */
+    delegatedScopes: string[];
+}
 export interface GrantResolution {
     /**
      * Resolve an existing durable grant for a no-delegation (retry) call, so a
      * fresh instance with empty memory authorizes the retry from the shared store.
-     * Fail-closed, holder-of-key first (agent-anchored, portable), then the
-     * session bearer capability. Returns undefined to fall through to the
+     * Fail-closed, holder-of-key first (agent-anchored, portable), then session
+     * reuse only where the configured binding policy permits it. Every path
+     * revalidates the retained delegation. Returns undefined to fall through to the
      * needs_authorization challenge.
      */
-    resolveExistingGrant(toolName: string, args: Record<string, unknown>, sessionId: string | undefined, scopeId: string): Promise<Grant | undefined>;
+    resolveExistingGrant(toolName: string, args: Record<string, unknown>, sessionId: string | undefined, scopeId: string): Promise<ResolvedGrant | undefined>;
     /**
      * Mint a durable grant from a freshly-verified delegation so the NEXT call —
      * on any instance — resolves via {@link resolveExistingGrant} without
      * re-pasting the VC. Best-effort: a store failure must not break the
      * already-authorized response.
      */
-    bindGrantOnSuccess(vc: DelegationCredential, delegationArg: unknown, isVCJWT: boolean, sessionId: string | undefined, scopeId: string): Promise<void>;
+    bindGrantOnSuccess(vc: DelegationCredential, delegationArg: unknown, isVCJWT: boolean, sessionId: string | undefined, scopeId: string, expiresAt?: number): Promise<void>;
 }
-export declare function createGrantResolution(deps: MiddlewareDeps): GrantResolution;
-//# sourceMappingURL=with-kya-os.grants.d.ts.map
+export declare function createGrantResolution(deps: MiddlewareDeps, verifyDelegation: DelegationVerification["verifyDelegation"]): GrantResolution;

package/dist/middleware/with-kya-os.grants.js

@@ -6,10 +6,11 @@
  * instance with empty memory. Extracted from `./with-kya-os.ts`; depends only on
  * the immutable {@link MiddlewareDeps} (no shared session state).
  */
+import { scopeSatisfies } from "../delegation/scope-matcher.js";
 import { getDelegationScopes } from "../delegation/chain-enforcement.js";
 import { assertHolderBinding, isHolderBindingApplicable, toHolderBindingRequest, } from "../delegation/holder-binding.js";
 import { logger } from "../logging/index.js";
-export function createGrantResolution(deps) {
+export function createGrantResolution(deps, verifyDelegation) {
     const { identity, cryptoProvider, grantStore, holderBindingMode, holderBindingVerifier, } = deps;
     /**
      * Deterministic grant id from (agentDid, sessionId, sorted scopes). Stable for
@@ -21,17 +22,37 @@ export function createGrantResolution(deps) {
         const digest = await cryptoProvider.hash(new TextEncoder().encode(key));
         return `grant_${digest.replace(/^sha256:/, "")}`;
     }
-    /** Grant expiry (ms epoch) derived from the VC, or undefined for no expiry. */
-    function delegationExpiryMs(vc) {
-        if (vc.expirationDate) {
-            const parsed = Date.parse(vc.expirationDate);
-            if (!Number.isNaN(parsed))
-                return parsed;
+    /**
+     * A grant caches evidence, never a permanent authorization decision. Returns
+     * the grant with the scopes of its re-verified credential, or undefined when
+     * the grant does not authorize `scopeId` now.
+     */
+    async function authorizeGrant(grant, scopeId) {
+        if (grant.status !== "active" || !grant.scopes.includes(scopeId))
+            return undefined;
+        if (grant.expiresAt !== undefined &&
+            (!Number.isFinite(grant.expiresAt) || grant.expiresAt <= Date.now()))
+            return undefined;
+        // Prefer the original JWT wire form when present: its envelope is the proof.
+        // Legacy rows without signed evidence intentionally require authorization again.
+        const evidence = grant.credentialJwt ?? grant.delegationCredential;
+        if (evidence === undefined)
+            return undefined;
+        try {
+            const check = await verifyDelegation(evidence);
+            if (!check.valid)
+                return undefined;
+            const subject = check.vc.credentialSubject;
+            if (subject.id !== grant.agentDid ||
+                subject.delegation.controller !== grant.userDid ||
+                !scopeSatisfies(scopeId, check.vc).satisfied)
+                return undefined;
+            return { grant, delegatedScopes: getDelegationScopes(check.vc) };
+        }
+        catch {
+            // Resolver/provider failures must not turn cached authority into a bypass.
+            return undefined;
         }
-        const notAfter = vc.credentialSubject?.delegation?.constraints?.notAfter;
-        if (typeof notAfter === "number")
-            return notAfter * 1000;
-        return undefined;
     }
     /**
      * Resolve a durable, agent-anchored grant for a no-delegation call — BUT ONLY
@@ -74,20 +95,38 @@ export function createGrantResolution(deps) {
         const grants = await grantStore.getByAgent(agentDid, [scopeId]);
         // A session-bound grant is usable only from its own session; an
         // agent-anchored (session-less) grant is portable across transports.
-        return grants.find((g) => g.sessionId === undefined || g.sessionId === sessionId);
+        for (const grant of grants) {
+            if (grant.agentDid !== agentDid ||
+                (grant.sessionId !== undefined && grant.sessionId !== sessionId))
+                continue;
+            const resolved = await authorizeGrant(grant, scopeId);
+            if (resolved)
+                return resolved;
+        }
+        return undefined;
     }
     async function resolveExistingGrant(toolName, args, sessionId, scopeId) {
         const agentGrant = await resolveAgentGrant(toolName, args, sessionId, scopeId);
         if (agentGrant)
             return agentGrant;
         if (sessionId) {
-            const [sessionGrant] = await grantStore.getBySession(sessionId, [scopeId]);
-            if (sessionGrant)
-                return sessionGrant;
+            const grants = await grantStore.getBySession(sessionId, [scopeId]);
+            for (const grant of grants) {
+                if (grant.sessionId !== sessionId)
+                    continue;
+                // Enforce applies to every did:key retry, even with a session bearer.
+                // A verified proof would already have resolved it through the agent path.
+                if (holderBindingMode === "enforce" &&
+                    isHolderBindingApplicable(grant.agentDid))
+                    continue;
+                const resolved = await authorizeGrant(grant, scopeId);
+                if (resolved)
+                    return resolved;
+            }
         }
         return undefined;
     }
-    async function bindGrantOnSuccess(vc, delegationArg, isVCJWT, sessionId, scopeId) {
+    async function bindGrantOnSuccess(vc, delegationArg, isVCJWT, sessionId, scopeId, expiresAt) {
         try {
             const agentDid = vc.credentialSubject?.id;
             if (!agentDid)
@@ -116,7 +155,6 @@ export function createGrantResolution(deps) {
             // re-challenge. Including scopeId makes the grant resolvable.
             const scopes = Array.from(new Set([scopeId, ...delegatedScopes]));
             const userDid = vc.credentialSubject?.delegation?.controller;
-            const expiresAt = delegationExpiryMs(vc);
             const grant = {
                 id: await grantId(agentDid, sessionId, scopes),
                 agentDid,
@@ -126,7 +164,7 @@ export function createGrantResolution(deps) {
                 authorization: { type: "delegation" },
                 ...(isVCJWT && typeof delegationArg === "string"
                     ? { credentialJwt: delegationArg }
-                    : {}),
+                    : { delegationCredential: structuredClone(vc) }),
                 issuedAt: Date.now(),
                 ...(expiresAt !== undefined ? { expiresAt } : {}),
                 status: "active",

package/dist/middleware/with-kya-os.grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.grants.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.grants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAgC7C,MAAM,UAAU,qBAAqB,CAAC,IAAoB;IACxD,MAAM,EACJ,QAAQ,EACR,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,qBAAqB,GACtB,GAAG,IAAI,CAAC;IAET;;;;OAIG;IACH,KAAK,UAAU,OAAO,CACpB,QAAgB,EAChB,SAA6B,EAC7B,MAAgB;QAEhB,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,SAAS,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,OAAO,SAAS,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;IACnD,CAAC;IAED,+EAA+E;IAC/E,SAAS,kBAAkB,CAAC,EAAwB;QAClD,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;QAC3C,CAAC;QACD,MAAM,QAAQ,GAAG,EAAE,CAAC,iBAAiB,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC;QACzE,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,QAAQ,GAAG,IAAI,CAAC;QACzD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,iBAAiB,CAC9B,QAAgB,EAChB,IAA6B,EAC7B,SAA6B,EAC7B,OAAe;QAEf,IAAI,CAAC,qBAAqB;YAAE,OAAO,SAAS,CAAC,CAAC,oCAAoC;QAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,IAAI,WAAW,GAAY,QAAQ,CAAC;QACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,WAA4B,CAAC;QAC3C,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC;QAClC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;YACxC,KAAK;YACL,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC;YAC/C,gBAAgB,EAAE,QAAQ,CAAC,GAAG;YAC9B,aAAa,EAAE,qBAAqB;SACrC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,gEAAgE;QAChE,qEAAqE;QACrE,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAC9D,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,oBAAoB,CACjC,QAAgB,EAChB,IAA6B,EAC7B,SAA6B,EAC7B,OAAe;QAEf,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/E,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAElC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3E,IAAI,YAAY;gBAAE,OAAO,YAAY,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,UAAU,kBAAkB,CAC/B,EAAwB,EACxB,aAAsB,EACtB,OAAgB,EAChB,SAA6B,EAC7B,OAAe;QAEf,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAEtB,yEAAyE;YACzE,sEAAsE;YACtE,2EAA2E;YAC3E,4EAA4E;YAC5E,4EAA4E;YAC5E,uCAAuC;YACvC,IAAI,iBAAiB,KAAK,KAAK,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC3D,MAAM,CAAC,KAAK,CACV,mEAAmE,OAAO,wCAAwC,CACnH,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,eAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,eAAe,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,2EAA2E;YAC3E,2EAA2E;YAC3E,yEAAyE;YACzE,uEAAuE;YACvE,8DAA8D;YAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,EAAE,CAAC,iBAAiB,EAAE,UAAU,EAAE,UAAU,CAAC;YAC7D,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;YAEzC,MAAM,KAAK,GAAU;gBACnB,EAAE,EAAE,MAAM,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;gBAC9C,QAAQ;gBACR,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,MAAM;gBACN,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,aAAa,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;gBACrC,GAAG,CAAC,OAAO,IAAI,OAAO,aAAa,KAAK,QAAQ;oBAC9C,CAAC,CAAC,EAAE,aAAa,EAAE,aAAa,EAAE;oBAClC,CAAC,CAAC,EAAE,CAAC;gBACP,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;gBACpB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,MAAM,EAAE,QAAQ;aACjB,CAAC;YACF,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;gBACzC,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,CAAC;AACtD,CAAC"}
+{"version":3,"file":"with-kya-os.grants.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.grants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAyC7C,MAAM,UAAU,qBAAqB,CACnC,IAAoB,EACpB,gBAA4D;IAE5D,MAAM,EACJ,QAAQ,EACR,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,qBAAqB,GACtB,GAAG,IAAI,CAAC;IAET;;;;OAIG;IACH,KAAK,UAAU,OAAO,CACpB,QAAgB,EAChB,SAA6B,EAC7B,MAAgB;QAEhB,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,SAAS,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,OAAO,SAAS,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,cAAc,CAC3B,KAAY,EACZ,OAAe;QAEf,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QACnF,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;YAC7B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACpE,OAAO,SAAS,CAAC;QAEnB,6EAA6E;QAC7E,iFAAiF;QACjF,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,oBAAoB,CAAC;QACnE,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YACnC,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC;YAC3C,IACE,OAAO,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ;gBAC7B,OAAO,CAAC,UAAU,CAAC,UAAU,KAAK,KAAK,CAAC,OAAO;gBAC/C,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS;gBAC5C,OAAO,SAAS,CAAC;YACnB,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;YAC3E,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,iBAAiB,CAC9B,QAAgB,EAChB,IAA6B,EAC7B,SAA6B,EAC7B,OAAe;QAEf,IAAI,CAAC,qBAAqB;YAAE,OAAO,SAAS,CAAC,CAAC,oCAAoC;QAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,IAAI,WAAW,GAAY,QAAQ,CAAC;QACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,WAA4B,CAAC;QAC3C,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC;QAClC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;YACxC,KAAK;YACL,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC;YAC/C,gBAAgB,EAAE,QAAQ,CAAC,GAAG;YAC9B,aAAa,EAAE,qBAAqB;SACrC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,gEAAgE;QAChE,qEAAqE;QACrE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IACE,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAC3B,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC;gBAChE,SAAS;YACX,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACtD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;QAChC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,UAAU,oBAAoB,CACjC,QAAgB,EAChB,IAA6B,EAC7B,SAA6B,EAC7B,OAAe;QAEf,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/E,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAElC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YACnE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;oBAAE,SAAS;gBAC5C,sEAAsE;gBACtE,0EAA0E;gBAC1E,IACE,iBAAiB,KAAK,SAAS;oBAC/B,yBAAyB,CAAC,KAAK,CAAC,QAAQ,CAAC;oBACzC,SAAS;gBACX,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACtD,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;YAChC,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,UAAU,kBAAkB,CAC/B,EAAwB,EACxB,aAAsB,EACtB,OAAgB,EAChB,SAA6B,EAC7B,OAAe,EACf,SAAkB;QAElB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAEtB,yEAAyE;YACzE,sEAAsE;YACtE,2EAA2E;YAC3E,4EAA4E;YAC5E,4EAA4E;YAC5E,uCAAuC;YACvC,IAAI,iBAAiB,KAAK,KAAK,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC3D,MAAM,CAAC,KAAK,CACV,mEAAmE,OAAO,wCAAwC,CACnH,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,eAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,eAAe,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,2EAA2E;YAC3E,2EAA2E;YAC3E,yEAAyE;YACzE,uEAAuE;YACvE,8DAA8D;YAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,EAAE,CAAC,iBAAiB,EAAE,UAAU,EAAE,UAAU,CAAC;YAE7D,MAAM,KAAK,GAAU;gBACnB,EAAE,EAAE,MAAM,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;gBAC9C,QAAQ;gBACR,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,MAAM;gBACN,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,aAAa,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;gBACrC,GAAG,CAAC,OAAO,IAAI,OAAO,aAAa,KAAK,QAAQ;oBAC9C,CAAC,CAAC,EAAE,aAAa,EAAE,aAAa,EAAE;oBAClC,CAAC,CAAC,EAAE,oBAAoB,EAAE,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClD,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;gBACpB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,MAAM,EAAE,QAAQ;aACjB,CAAC;YACF,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;gBACzC,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,CAAC;AACtD,CAAC"}

package/dist/middleware/with-kya-os.helpers.d.ts

@@ -21,4 +21,3 @@ export declare function extractPolicyPrincipal(del: unknown): {
     responsibleParty?: string;
     delegatedScopes: string[];
 };
-//# sourceMappingURL=with-kya-os.helpers.d.ts.map

package/dist/middleware/with-kya-os.js

@@ -25,6 +25,7 @@ import { ProofVerifier } from "../proof/verifier.js";
 import { SystemClockProvider } from "../providers/system-clock.js";
 import { MemoryNonceCacheProvider } from "../providers/memory.js";
 import { logger } from "../logging/index.js";
+import { createDelegationVerification } from "./with-kya-os.delegation-verify.js";
 import { createGrantResolution } from "./with-kya-os.grants.js";
 import { createPolicyGate } from "./with-kya-os.policy-gate.js";
 import { createDelegationGate } from "./with-kya-os.delegation-gate.js";
@@ -81,12 +82,16 @@ export function createKyaOsMiddleware(config, cryptoProvider) {
         publicKey: config.identity.publicKey,
     };
     // One replay-protection store, shared by the handshake and holder binding.
-    // Defaults to in-memory; SessionManager.cleanup() drives its expiry sweep.
+    // Defaults to in-memory, which sweeps its own expired entries as it is written to.
     const nonceCache = config.nonceCache ?? new MemoryNonceCacheProvider();
+    // SessionManager and ProofVerifier each check the cache at construction:
+    // refused under requireAtomicNonce, otherwise one warning if not atomic.
+    const requireAtomicNonce = config.requireAtomicNonce ?? false;
     const sessionManager = new SessionManager(cryptoProvider, {
         ...config.session,
         serverDid: identity.did,
         nonceCache,
+        requireAtomicNonce,
     });
     const proofGenerator = new ProofGenerator(identity, cryptoProvider);
     const delegationConfig = config.delegation;
@@ -124,6 +129,7 @@ export function createKyaOsMiddleware(config, cryptoProvider) {
             cryptoProvider,
             clockProvider: new SystemClockProvider(),
             nonceCacheProvider: nonceCache,
+            requireAtomicNonce,
             fetchProvider: delegationConfig?.fetchProvider ??
                 (typeof globalThis.fetch === "function"
                     ? new RuntimeFetchProvider()
@@ -151,10 +157,14 @@ export function createKyaOsMiddleware(config, cryptoProvider) {
     const protocol = createProtocol(deps, {
         handleHandshake: session.handleHandshake,
     });
-    // Durable-grant resolution (the no-paste retry). Depends only on the immutable
-    // deps above, so it lifts out cleanly with no shared session state.
-    const { resolveExistingGrant, bindGrantOnSuccess } = createGrantResolution(deps);
+    // Durable-grant resolution (the no-paste retry) re-verifies stored evidence
+    // with the same delegation verification the gate applies to presented
+    // credentials. Both depend only on the immutable deps above, so they lift out
+    // cleanly with no shared session state.
+    const delegationVerification = createDelegationVerification(deps);
+    const { resolveExistingGrant, bindGrantOnSuccess } = createGrantResolution(deps, delegationVerification.verifyDelegation);
     const { wrapWithDelegation } = createDelegationGate(deps, {
+        delegationVerification,
         attachOutcomeProof: session.attachOutcomeProof,
         resolveExistingGrant,
         bindGrantOnSuccess,

package/dist/middleware/with-kya-os.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,cAAc,EACd,2BAA2B,GAE5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAM7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,kFAAkF;AAClF,qFAAqF;AACrF,cAAc,wBAAwB,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,UAAU,qBAAqB,CACnC,MAAmB,EACnB,cAA8B;IAE9B,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5C,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS;gBACzC,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBAClE,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;YAC5F,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAuB;QACnC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QACxB,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QACxB,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU;QACtC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;KACrC,CAAC;IAEF,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,wBAAwB,EAAE,CAAC;IAEvE,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,cAAc,EAAE;QACxD,GAAG,MAAM,CAAC,OAAO;QACjB,SAAS,EAAE,QAAQ,CAAC,GAAG;QACvB,UAAU;KACX,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAChE,CAAC,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE;YACrC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK;SACzD,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,4EAA4E;IAC5E,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,IAAI,CAAC;IAE7D,kEAAkE;IAClE,oEAAoE;IACpE,gDAAgD;IAChD,MAAM,oBAAoB,GACxB,MAAM,CAAC,oBAAoB,IAAI,2BAA2B,CAAC;IAE7D,8EAA8E;IAC9E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,gBAAgB,EAAE,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CACT,uEAAuE;YACrE,uEAAuE;YACvE,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,iBAAiB,GAAG,gBAAgB,EAAE,aAAa,IAAI,KAAK,CAAC;IACnE,MAAM,qBAAqB,GACzB,iBAAiB,KAAK,KAAK;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,aAAa,CAAC;YAChB,cAAc;YACd,aAAa,EAAE,IAAI,mBAAmB,EAAE;YACxC,kBAAkB,EAAE,UAAU;YAC9B,aAAa,EACX,gBAAgB,EAAE,aAAa;gBAC/B,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;oBACrC,CAAC,CAAC,IAAI,oBAAoB,EAAE;oBAC5B,CAAC,CAAC,IAAI,iBAAiB,EAAE,CAAC;SAC/B,CAAC,CAAC;IAET,iEAAiE;IACjE,MAAM,IAAI,GAAmB;QAC3B,QAAQ;QACR,MAAM;QACN,cAAc;QACd,cAAc;QACd,cAAc;QACd,QAAQ;QACR,KAAK;QACL,UAAU;QACV,gBAAgB;QAChB,iBAAiB;QACjB,qBAAqB;QACrB,kBAAkB;QAClB,oBAAoB;KACrB,CAAC;IAEF,gFAAgF;IAChF,iEAAiE;IACjE,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE;QACpC,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,oEAAoE;IACpE,MAAM,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAChD,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAE9B,MAAM,EAAE,kBAAkB,EAAE,GAAG,oBAAoB,CAAC,IAAI,EAAE;QACxD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,oBAAoB;QACpB,kBAAkB;KACnB,CAAC,CAAC;IAEH,MAAM,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE;QAChD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;KAC/C,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc;QACd,cAAc;QACd,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,kBAAkB;QAClB,cAAc;KACf,CAAC;AACJ,CAAC"}
+{"version":3,"file":"with-kya-os.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,cAAc,EACd,2BAA2B,GAE5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAM7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,kFAAkF;AAClF,qFAAqF;AACrF,cAAc,wBAAwB,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,UAAU,qBAAqB,CACnC,MAAmB,EACnB,cAA8B;IAE9B,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5C,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS;gBACzC,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBAClE,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;YAC5F,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAuB;QACnC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QACxB,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QACxB,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU;QACtC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;KACrC,CAAC;IAEF,2EAA2E;IAC3E,mFAAmF;IACnF,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,wBAAwB,EAAE,CAAC;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAE9D,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,cAAc,EAAE;QACxD,GAAG,MAAM,CAAC,OAAO;QACjB,SAAS,EAAE,QAAQ,CAAC,GAAG;QACvB,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAChE,CAAC,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE;YACrC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK;SACzD,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,4EAA4E;IAC5E,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,IAAI,CAAC;IAE7D,kEAAkE;IAClE,oEAAoE;IACpE,gDAAgD;IAChD,MAAM,oBAAoB,GACxB,MAAM,CAAC,oBAAoB,IAAI,2BAA2B,CAAC;IAE7D,8EAA8E;IAC9E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,gBAAgB,EAAE,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CACT,uEAAuE;YACrE,uEAAuE;YACvE,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,iBAAiB,GAAG,gBAAgB,EAAE,aAAa,IAAI,KAAK,CAAC;IACnE,MAAM,qBAAqB,GACzB,iBAAiB,KAAK,KAAK;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,aAAa,CAAC;YAChB,cAAc;YACd,aAAa,EAAE,IAAI,mBAAmB,EAAE;YACxC,kBAAkB,EAAE,UAAU;YAC9B,kBAAkB;YAClB,aAAa,EACX,gBAAgB,EAAE,aAAa;gBAC/B,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;oBACrC,CAAC,CAAC,IAAI,oBAAoB,EAAE;oBAC5B,CAAC,CAAC,IAAI,iBAAiB,EAAE,CAAC;SAC/B,CAAC,CAAC;IAET,iEAAiE;IACjE,MAAM,IAAI,GAAmB;QAC3B,QAAQ;QACR,MAAM;QACN,cAAc;QACd,cAAc;QACd,cAAc;QACd,QAAQ;QACR,KAAK;QACL,UAAU;QACV,gBAAgB;QAChB,iBAAiB;QACjB,qBAAqB;QACrB,kBAAkB;QAClB,oBAAoB;KACrB,CAAC;IAEF,gFAAgF;IAChF,iEAAiE;IACjE,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE;QACpC,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,sEAAsE;IACtE,8EAA8E;IAC9E,wCAAwC;IACxC,MAAM,sBAAsB,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAChD,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAEvE,MAAM,EAAE,kBAAkB,EAAE,GAAG,oBAAoB,CAAC,IAAI,EAAE;QACxD,sBAAsB;QACtB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,oBAAoB;QACpB,kBAAkB;KACnB,CAAC,CAAC;IAEH,MAAM,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE;QAChD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;KAC/C,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc;QACd,cAAc;QACd,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,kBAAkB;QAClB,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/middleware/with-kya-os.policy-gate.d.ts

@@ -13,4 +13,3 @@ export interface PolicyGateWiring {
     attachOutcomeProof: AttachOutcomeProof;
 }
 export declare function createPolicyGate(deps: MiddlewareDeps, wiring: PolicyGateWiring): Pick<KyaOsPolicyGate, "withPolicyGate">;
-//# sourceMappingURL=with-kya-os.policy-gate.d.ts.map

package/dist/middleware/with-kya-os.policy-gate.js

@@ -12,10 +12,11 @@ import { verifyApprovalQuorum } from "../policy/approval.js";
 import { buildPolicyRequest } from "../policy/projection.js";
 import { createNeedsApprovalError } from "../types/protocol.js";
 import { isKyaOsControlArg } from "../delegation/holder-binding.js";
+import { acceptedRequestHashes } from "../proof/generator.js";
 import { KYA_OS_ERROR_CODES } from "../errors.js";
 import { sanitizeForMessage, extractPolicyPrincipal } from "./with-kya-os.helpers.js";
 export function createPolicyGate(deps, wiring) {
-    const { proofGenerator, audit } = deps;
+    const { proofGenerator, cryptoProvider, audit } = deps;
     const { attachOutcomeProof } = wiring;
     const defaultRiskClassifier = new RiskClassifier();
     const defaultPolicyEngine = new DefaultPolicyEngine();
@@ -24,7 +25,13 @@ export function createPolicyGate(deps, wiring) {
         const classifier = opts.classifier ?? defaultRiskClassifier;
         const approvalsKey = opts.approvalsArgKey ?? "_kyaos_approvals";
         const isValidApprovalSignature = opts.isValidApprovalSignature ?? (async () => false);
-        return async (args, sessionId, context) => {
+        return async (callArgs, sessionId, context) => {
+            // Composed after wrapWithDelegation, the approvals argument has already
+            // been stripped and arrives in the call context; restore it so a step-up
+            // resume verifies the same grants either way.
+            const args = callArgs[approvalsKey] === undefined && context?.approvals !== undefined
+                ? { ...callArgs, [approvalsKey]: context.approvals }
+                : callArgs;
             // Drop the reserved _kyaos* namespace plus the (possibly custom) approvals
             // key, so no control arg reaches the handler.
             const cleanArgs = {};
@@ -34,7 +41,9 @@ export function createPolicyGate(deps, wiring) {
             }
             const namespace = opts.resolveNamespace?.(args) ?? toolName;
             const risk = classifier.classify({ toolName, namespace });
-            const principal = extractPolicyPrincipal(args["_kyaos_delegation"]);
+            // Prefer the principal wrapWithDelegation authenticated; the raw
+            // `_kyaos_delegation` projection is the unverified standalone fallback.
+            const principal = context?.principal ?? extractPolicyPrincipal(args["_kyaos_delegation"]);
             const policyRequest = buildPolicyRequest({
                 principal: {
                     agentDid: principal.agentDid,
@@ -44,7 +53,7 @@ export function createPolicyGate(deps, wiring) {
                 },
                 action: { toolName },
                 resource: { namespace },
-                delegatedScopes: principal.delegatedScopes,
+                delegatedScopes: [...principal.delegatedScopes],
                 scopeMatched: opts.scopeMatched ?? false,
                 risk,
             });
@@ -89,14 +98,14 @@ export function createPolicyGate(deps, wiring) {
                 return attachOutcomeProof(denied, toolName, args, sessionId, decision.reason, "denied", cleanArgs);
             }
             // step_up: verify any supplied approval grants, bound to this exact action.
-            const requestHash = await proofGenerator.hashRequest({
-                method: toolName,
-                params: cleanArgs,
-            });
+            // The challenge advertises the legacy-shape hash; a grant over the SPEC
+            // §7.3 `tools/call` shape of the same action is accepted as well.
+            const action = { method: toolName, params: cleanArgs };
+            const requestHash = await proofGenerator.hashRequest(action);
             const grants = Array.isArray(args[approvalsKey])
                 ? args[approvalsKey]
                 : [];
-            const quorumResult = await verifyApprovalQuorum(grants, requestHash, decision.quorum, isValidApprovalSignature);
+            const quorumResult = await verifyApprovalQuorum(grants, await acceptedRequestHashes(action, (bytes) => cryptoProvider.hash(bytes)), decision.quorum, isValidApprovalSignature);
             if (quorumResult.satisfied) {
                 await audit?.authorization('approved', {
                     outcome: 'succeeded',

package/dist/middleware/with-kya-os.policy-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.policy-gate.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.policy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAsB,MAAM,uBAAuB,CAAC;AAEjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAQlD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAOtF,MAAM,UAAU,gBAAgB,CAC9B,IAAoB,EACpB,MAAwB;IAExB,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC;IAEtC,MAAM,qBAAqB,GAAG,IAAI,cAAc,EAAE,CAAC;IACnD,MAAM,mBAAmB,GAAiB,IAAI,mBAAmB,EAAE,CAAC;IAEpE,SAAS,cAAc,CACrB,QAAgB,EAChB,OAAyB,EACzB,OAA0B,EAAE;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,qBAAqB,CAAC;QAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,IAAI,kBAAkB,CAAC;QAChE,MAAM,wBAAwB,GAC5B,IAAI,CAAC,wBAAwB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;QAEvD,OAAO,KAAK,EACV,IAA6B,EAC7B,SAAkB,EAClB,OAA0B,EAC1B,EAAE;YACF,2EAA2E;YAC3E,8CAA8C;YAC9C,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,YAAY;oBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;YAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAEpE,MAAM,aAAa,GAAG,kBAAkB,CAAC;gBACvC,SAAS,EAAE;oBACT,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,GAAG,CAAC,SAAS,CAAC,gBAAgB;wBAC5B,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE;wBAClD,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,MAAM,EAAE,EAAE,QAAQ,EAAE;gBACpB,QAAQ,EAAE,EAAE,SAAS,EAAE;gBACvB,eAAe,EAAE,SAAS,CAAC,eAAe;gBAC1C,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,KAAK;gBACxC,IAAI;aACL,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YAEtD,MAAM,YAAY,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;gBACvD,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChE,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBACnD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;aAC9C,CAAC;YACF,MAAM,KAAK,EAAE,aAAa,CAAC,WAAW,EAAE;gBACtC,OAAO,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW;oBAClD,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;gBAC1D,UAAU,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO;oBACvC,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB;gBACrE,OAAO,EAAE,YAAY;aACtB,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAClC,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;oBACrC,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACjC,MAAM,MAAM,GAA0C;oBACpD,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACnB,KAAK,EAAE,kBAAkB,CAAC,aAAa;gCACvC,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC;6BAC5C,CAAC;yBACH;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;gBACF,OAAO,kBAAkB,CACvB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,QAAQ,EACR,SAAS,CACV,CAAC;YACJ,CAAC;YAED,4EAA4E;YAC5E,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC;gBACnD,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC9C,CAAC,CAAE,IAAI,CAAC,YAAY,CAAqB;gBACzC,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAC7C,MAAM,EACN,WAAW,EACX,QAAQ,CAAC,MAAM,EACf,wBAAwB,CACzB,CAAC;YACF,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;oBACrC,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,aAAa,GAAG,wBAAwB,CAAC;gBAC7C,OAAO,EAAE,SAAS,QAAQ,cAAc,QAAQ,CAAC,MAAM,CAAC,CAAC,yCAAyC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI;gBACzI,WAAW,EAAE,WAAW,WAAW,EAAE;gBACrC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;gBAC9C,WAAW;gBACX,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;YACH,MAAM,MAAM,GAA0C;gBACpD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;gBAChE,OAAO,EAAE,IAAI;aACd,CAAC;YACF,OAAO,kBAAkB,CACvB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,kBAAkB,EAClB,SAAS,CACV,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"with-kya-os.policy-gate.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.policy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAsB,MAAM,uBAAuB,CAAC;AAEjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAoB,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAQlD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAOtF,MAAM,UAAU,gBAAgB,CAC9B,IAAoB,EACpB,MAAwB;IAExB,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvD,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC;IAEtC,MAAM,qBAAqB,GAAG,IAAI,cAAc,EAAE,CAAC;IACnD,MAAM,mBAAmB,GAAiB,IAAI,mBAAmB,EAAE,CAAC;IAEpE,SAAS,cAAc,CACrB,QAAgB,EAChB,OAAyB,EACzB,OAA0B,EAAE;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,qBAAqB,CAAC;QAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,IAAI,kBAAkB,CAAC;QAChE,MAAM,wBAAwB,GAC5B,IAAI,CAAC,wBAAwB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;QAEvD,OAAO,KAAK,EACV,QAAiC,EACjC,SAAkB,EAClB,OAA0B,EAC1B,EAAE;YACF,wEAAwE;YACxE,yEAAyE;YACzE,8CAA8C;YAC9C,MAAM,IAAI,GACR,QAAQ,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS;gBACtE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE;gBACpD,CAAC,CAAC,QAAQ,CAAC;YAEf,2EAA2E;YAC3E,8CAA8C;YAC9C,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,YAAY;oBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;YAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,iEAAiE;YACjE,wEAAwE;YACxE,MAAM,SAAS,GACb,OAAO,EAAE,SAAS,IAAI,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAE1E,MAAM,aAAa,GAAG,kBAAkB,CAAC;gBACvC,SAAS,EAAE;oBACT,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,GAAG,CAAC,SAAS,CAAC,gBAAgB;wBAC5B,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE;wBAClD,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,MAAM,EAAE,EAAE,QAAQ,EAAE;gBACpB,QAAQ,EAAE,EAAE,SAAS,EAAE;gBACvB,eAAe,EAAE,CAAC,GAAG,SAAS,CAAC,eAAe,CAAC;gBAC/C,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,KAAK;gBACxC,IAAI;aACL,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YAEtD,MAAM,YAAY,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;gBACvD,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChE,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBACnD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;aAC9C,CAAC;YACF,MAAM,KAAK,EAAE,aAAa,CAAC,WAAW,EAAE;gBACtC,OAAO,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW;oBAClD,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;gBAC1D,UAAU,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO;oBACvC,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB;gBACrE,OAAO,EAAE,YAAY;aACtB,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAClC,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;oBACrC,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACjC,MAAM,MAAM,GAA0C;oBACpD,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACnB,KAAK,EAAE,kBAAkB,CAAC,aAAa;gCACvC,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC;6BAC5C,CAAC;yBACH;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;gBACF,OAAO,kBAAkB,CACvB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,QAAQ,EACR,SAAS,CACV,CAAC;YACJ,CAAC;YAED,4EAA4E;YAC5E,wEAAwE;YACxE,kEAAkE;YAClE,MAAM,MAAM,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACpE,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC9C,CAAC,CAAE,IAAI,CAAC,YAAY,CAAqB;gBACzC,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAC7C,MAAM,EACN,MAAM,qBAAqB,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC1E,QAAQ,CAAC,MAAM,EACf,wBAAwB,CACzB,CAAC;YACF,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;oBACrC,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,aAAa,GAAG,wBAAwB,CAAC;gBAC7C,OAAO,EAAE,SAAS,QAAQ,cAAc,QAAQ,CAAC,MAAM,CAAC,CAAC,yCAAyC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI;gBACzI,WAAW,EAAE,WAAW,WAAW,EAAE;gBACrC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;gBAC9C,WAAW;gBACX,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;YACH,MAAM,MAAM,GAA0C;gBACpD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;gBAChE,OAAO,EAAE,IAAI;aACd,CAAC;YACF,OAAO,kBAAkB,CACvB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,kBAAkB,EAClB,SAAS,CACV,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,CAAC;AAC5B,CAAC"}

package/dist/middleware/with-kya-os.protocol.d.ts

@@ -26,4 +26,3 @@ export interface Protocol {
 }
 export declare function createProtocol(deps: MiddlewareDeps, wiring: ProtocolWiring): Protocol;
 export {};
-//# sourceMappingURL=with-kya-os.protocol.d.ts.map

package/dist/middleware/with-kya-os.session.d.ts

@@ -8,6 +8,33 @@
  */
 import type { KyaOsToolHandler } from "./with-kya-os.types.js";
 import type { MiddlewareDeps, AttachOutcomeProof } from "./with-kya-os.deps.js";
+/**
+ * The private `_meta` member a middleware's wrappers stamp their results with
+ * while an outer layer (the withKyaOs transport) reads them. It holds a random
+ * per-middleware token, and the transport strips it before a message leaves,
+ * so it never reaches the wire. It lives in `_meta` because the MCP SDK
+ * re-creates the result object when it validates it, and `_meta` survives
+ * that.
+ */
+export declare const LIFECYCLE_STAMP_META_KEY = "org.kya-os/lifecycle-stamp";
+type ToolResult = Awaited<ReturnType<KyaOsToolHandler>>;
+/**
+ * Remove the `_meta` members only the middleware may set (proofs, proof error,
+ * audit marker, lifecycle stamp) from a result it did not produce, keeping
+ * every other member (traceparent and the like). Returns a copy when anything
+ * is removed.
+ */
+export declare function withoutOutcomeMeta<T extends ToolResult>(result: T): T;
+/** Remove the lifecycle stamp, which must never leave the process. */
+export declare function withoutLifecycleStamp<T extends ToolResult>(result: T): T;
+/**
+ * Tell the middleware behind `wrapWithProof` that an outer layer (the withKyaOs
+ * transport) reads its results. From then on its wrappers stamp what they
+ * return with the middleware's token. Returns the check for that stamp, or
+ * undefined for a middleware this module did not create, whose results are
+ * then never treated as its own.
+ */
+export declare function attachOuterProofLayer(wrapWithProof: object): ((result: ToolResult) => boolean) | undefined;
 export interface SessionProof {
     /** Establish a session from a handshake and cache it as the fallback. */
     handleHandshake(args: Record<string, unknown>): Promise<{
@@ -29,4 +56,4 @@ export interface SessionProof {
     attachOutcomeProof: AttachOutcomeProof;
 }
 export declare function createSessionProof(deps: MiddlewareDeps): SessionProof;
-//# sourceMappingURL=with-kya-os.session.d.ts.map
+export {};