@kya-os/mcp 1.16.2 → 1.18.0

package/dist/middleware/with-kya-os.session.js

@@ -6,17 +6,90 @@
  * paths: `wrapWithProof` (success responses) and `attachOutcomeProof` (denied /
  * step-up / needs-authorization outcomes). Extracted from `./with-kya-os.ts`.
  */
-import { KYA_OS_PROOF_META_KEY, LEGACY_PROOF_META_KEY, RESPONSE_PROOF_PROFILE_ENVELOPE, } from "../proof/generator.js";
+import { KYA_OS_PROOF_META_KEY, LEGACY_NAMESPACED_PROOF_META_KEY, LEGACY_PROOF_META_KEY, RESPONSE_PROOF_PROFILE_ENVELOPE, } from "../proof/generator.js";
 import { validateHandshakeFormat, } from "../session/manager.js";
 import { base64urlEncodeFromBytes } from "../utils/base64.js";
 import { logger } from "../logging/index.js";
 import { KYA_OS_ERROR_CODES } from "../errors.js";
 import { sanitizeForMessage } from "./with-kya-os.helpers.js";
+/** The `_meta` member carrying this middleware's audit-lifecycle marker. */
+const auditMetaKey = 'org.kya-os/audit';
+/**
+ * The private `_meta` member a middleware's wrappers stamp their results with
+ * while an outer layer (the withKyaOs transport) reads them. It holds a random
+ * per-middleware token, and the transport strips it before a message leaves,
+ * so it never reaches the wire. It lives in `_meta` because the MCP SDK
+ * re-creates the result object when it validates it, and `_meta` survives
+ * that.
+ */
+export const LIFECYCLE_STAMP_META_KEY = 'org.kya-os/lifecycle-stamp';
+/**
+ * `_meta` members only the middleware itself may set: proofs, a proof error,
+ * the audit marker and the lifecycle stamp. A tool result carrying them that
+ * the middleware did not produce (content relayed from an upstream server, or
+ * set by the handler) cannot be told apart from a forgery.
+ */
+const outcomeMetaKeys = [
+    KYA_OS_PROOF_META_KEY,
+    LEGACY_NAMESPACED_PROOF_META_KEY,
+    LEGACY_PROOF_META_KEY,
+    'proofError',
+    auditMetaKey,
+    LIFECYCLE_STAMP_META_KEY,
+];
+/** `result` without the `_meta` members in `keys`, dropping `_meta` if nothing else is left. */
+function withoutMetaKeys(result, keys) {
+    const metadata = result._meta;
+    if (metadata === undefined || !keys.some((key) => Object.hasOwn(metadata, key))) {
+        return result;
+    }
+    const kept = Object.fromEntries(Object.entries(metadata).filter(([key]) => !keys.includes(key)));
+    const copy = { ...result };
+    if (Object.keys(kept).length > 0)
+        copy._meta = kept;
+    else
+        delete copy._meta;
+    return copy;
+}
+/**
+ * Remove the `_meta` members only the middleware may set (proofs, proof error,
+ * audit marker, lifecycle stamp) from a result it did not produce, keeping
+ * every other member (traceparent and the like). Returns a copy when anything
+ * is removed.
+ */
+export function withoutOutcomeMeta(result) {
+    return withoutMetaKeys(result, outcomeMetaKeys);
+}
+/** Remove the lifecycle stamp, which must never leave the process. */
+export function withoutLifecycleStamp(result) {
+    return withoutMetaKeys(result, [LIFECYCLE_STAMP_META_KEY]);
+}
+/**
+ * Each middleware's hook for an outer auto-proof layer, keyed by its
+ * `wrapWithProof` so the transport can reach it from whatever
+ * `KyaOsMiddleware` it is handed without widening the public interface; a
+ * custom implementation simply has no entry.
+ */
+const outerProofLayerHooks = new WeakMap();
+/**
+ * Tell the middleware behind `wrapWithProof` that an outer layer (the withKyaOs
+ * transport) reads its results. From then on its wrappers stamp what they
+ * return with the middleware's token. Returns the check for that stamp, or
+ * undefined for a middleware this module did not create, whose results are
+ * then never treated as its own.
+ */
+export function attachOuterProofLayer(wrapWithProof) {
+    return outerProofLayerHooks.get(wrapWithProof)?.();
+}
 export function createSessionProof(deps) {
     const { identity, config, cryptoProvider, sessionManager, proofGenerator, auditLog, audit, emitLegacyProofKey, responseProofProfile, } = deps;
     const bindsEnvelope = responseProofProfile === RESPONSE_PROOF_PROFILE_ENVELOPE;
     const auditedTerminalResponses = new WeakSet();
-    const auditMetaKey = 'org.kya-os/audit';
+    // This middleware's lifecycle token, minted once an outer layer reads its
+    // results. Only wrappers holding it can stamp a result as their own.
+    let lifecycleStamp;
+    const hasOwnStamp = (response) => lifecycleStamp !== undefined &&
+        response._meta?.[LIFECYCLE_STAMP_META_KEY] === lifecycleStamp;
     const emitAudit = async (label, operation, toolName) => {
         try {
             await operation();
@@ -73,6 +146,27 @@ export function createSessionProof(deps) {
         return typeof auditMetadata === 'object' && auditMetadata !== null &&
             auditMetadata.terminal === true;
     };
+    /**
+     * The handler's `_meta` members a proof or proof error is merged into: every
+     * member except the proofs, proof error, audit marker and stamp, which only
+     * the middleware sets. A handler relaying an upstream result could
+     * otherwise ship them next to this middleware's proof.
+     */
+    const handlerMeta = (response) => withoutOutcomeMeta(response)._meta ?? {};
+    /**
+     * Stamp a result whose lifecycle a wrapper has run, so the outer layer
+     * neither re-proves nor re-audits it. Without an outer layer there is no
+     * token, nothing would strip the stamp, and the result is returned as it was.
+     */
+    const stampLifecycle = (response) => {
+        if (lifecycleStamp === undefined)
+            return response;
+        response._meta = {
+            ...(response._meta ?? {}),
+            [LIFECYCLE_STAMP_META_KEY]: lifecycleStamp,
+        };
+        return response;
+    };
     const auditContext = (context) => context === undefined
         ? undefined
         : {
@@ -163,11 +257,40 @@ export function createSessionProof(deps) {
             ...(result.error && { isError: true }),
         };
     }
+    // The store keeps an expired session until something deletes it, so its raw
+    // size overcounts live sessions: one stale session would leave the fallback
+    // ambiguous for good. A count above one triggers a sweep first, at most once
+    // per interval so a genuinely multi-client deployment does not scan the
+    // whole store on every unthreaded call.
+    const sessionSweepIntervalMs = 60_000;
+    let lastSessionSweepAt;
+    async function liveSessionCount() {
+        const count = sessionManager.getStats().activeSessions;
+        const now = Date.now();
+        if (count <= 1 ||
+            (lastSessionSweepAt !== undefined && now - lastSessionSweepAt < sessionSweepIntervalMs)) {
+            return count;
+        }
+        lastSessionSweepAt = now;
+        try {
+            await sessionManager.cleanup();
+        }
+        catch (error) {
+            logger.error("[kya-os] Session sweep failed", {
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return count;
+        }
+        return sessionManager.getStats().activeSessions;
+    }
+    // Concurrent first calls share one in-flight auto session: one per caller
+    // would leave several live sessions, and every later call ambiguous.
+    let autoSessionInFlight;
     async function ensureSession() {
         if (activeSessionId) {
             const existing = await sessionManager.getSession(activeSessionId);
             if (existing) {
-                if (sessionManager.getStats().activeSessions <= 1) {
+                if ((await liveSessionCount()) <= 1) {
                     return activeSessionId;
                 }
                 // Ambiguous: more than one session and none threaded — do NOT borrow.
@@ -179,6 +302,12 @@ export function createSessionProof(deps) {
         }
         if (!config.autoSession)
             return undefined;
+        autoSessionInFlight ??= createAutoSession().finally(() => {
+            autoSessionInFlight = undefined;
+        });
+        return autoSessionInFlight;
+    }
+    async function createAutoSession() {
         // Generate a server-side session with cryptographically random nonce (SPEC.md §4)
         const nonceBytes = await cryptoProvider.randomBytes(16);
         const nonce = base64urlEncodeFromBytes(nonceBytes);
@@ -195,7 +324,7 @@ export function createSessionProof(deps) {
         return undefined;
     }
     function wrapWithProof(toolName, handler) {
-        return async (args, sessionId, context) => {
+        const run = async (args, sessionId, context) => {
             const intentDelivered = await emitAudit('Required tool intent audit delivery failed', () => audit?.tool('started', {
                 toolName,
                 outcome: 'unknown',
@@ -277,8 +406,9 @@ export function createSessionProof(deps) {
                 const proof = await proofGenerator.generateProof(request, response, session, { scopeId: context?.scopeId, profile: responseProofProfile });
                 // Attach proof under the namespaced _meta key (rendered by MCP
                 // Inspector, invisible to LLMs), plus the legacy bare key when enabled.
-                // Other _meta keys may coexist (SEP-414).
-                result._meta = withProofMeta({}, proof);
+                // Keys the handler set (traceparent, related-task, ...) are kept: the
+                // middleware does not own `_meta` (SPEC §7.6).
+                result._meta = withProofMeta(handlerMeta(result), proof);
                 const proofAuditDelivered = await emitAudit('Required generated-proof audit delivery failed', () => audit?.proof('generated', {
                     outcome: 'succeeded',
                     context: auditContext(context),
@@ -318,6 +448,7 @@ export function createSessionProof(deps) {
                     error: error instanceof Error ? error.message : String(error),
                 });
                 result._meta = {
+                    ...handlerMeta(result),
                     proofError: "Proof generation failed — response is unproven",
                 };
                 const rejectionAuditDelivered = await emitAudit('Failed to record proof-generation rejection', () => audit?.proof('rejected', {
@@ -331,8 +462,13 @@ export function createSessionProof(deps) {
             }
             return result;
         };
+        return async (args, sessionId, context) => stampLifecycle(await run(args, sessionId, context));
     }
-    const attachOutcomeProof = async (response, toolName, args, sessionId, reason, outcome = "denied", paramsOverride, responseData) => {
+    outerProofLayerHooks.set(wrapWithProof, () => {
+        lifecycleStamp ??= base64urlEncodeFromBytes(globalThis.crypto.getRandomValues(new Uint8Array(16)));
+        return hasOwnStamp;
+    });
+    const outcomeProof = async (response, toolName, args, sessionId, reason, outcome = "denied", paramsOverride, responseData) => {
         const phase = outcome === 'denied' ? 'denied' : 'step_up_required';
         const reasonCode = outcome === 'needs_authorization'
             ? 'NEEDS_AUTHORIZATION'
@@ -424,6 +560,9 @@ export function createSessionProof(deps) {
         }
         return response;
     };
+    // Outcome results are stamped like wrapper results, so the outer layer
+    // passes a signed denial or challenge through instead of re-proving it.
+    const attachOutcomeProof = async (...outcome) => stampLifecycle(await outcomeProof(...outcome));
     return { handleHandshake, ensureSession, wrapWithProof, attachOutcomeProof };
 }
 //# sourceMappingURL=with-kya-os.session.js.map

package/dist/middleware/with-kya-os.session.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.session.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.session.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,+BAA+B,GAGhC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,GAExB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAwB9D,MAAM,UAAU,kBAAkB,CAAC,IAAoB;IACrD,MAAM,EACJ,QAAQ,EACR,MAAM,EACN,cAAc,EACd,cAAc,EACd,cAAc,EACd,QAAQ,EACR,KAAK,EACL,kBAAkB,EAClB,oBAAoB,GACrB,GAAG,IAAI,CAAC;IACT,MAAM,aAAa,GAAG,oBAAoB,KAAK,+BAA+B,CAAC;IAC/E,MAAM,wBAAwB,GAAG,IAAI,OAAO,EAAU,CAAC;IACvD,MAAM,YAAY,GAAG,kBAAkB,CAAC;IAIxC,MAAM,SAAS,GAAG,KAAK,EACrB,KAAa,EACb,SAA0C,EAC1C,QAAiB,EACC,EAAE;QACpB,IAAI,CAAC;YACH,MAAM,SAAS,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,EAAE,EAAE;gBAChC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;gBACrD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,CACxB,QAA6B,EAC7B,MAAc,EACd,iBAA0B,EACL,EAAE;QACvB,MAAM,QAAQ,GAAG;YACf,GAAG,CAAE,QAAQ,CAAC,KAA6C,IAAI,EAAE,CAAC;SACnE,CAAC;QACF,IAAI,iBAAiB,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC,qBAAqB,CAAC,CAAC;YACvC,OAAO,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,QAAQ,CAAC,YAAY,CAAC,GAAG;YACvB,GAAG,CAAC,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,IAAI;gBAC/E,CAAC,CAAC,QAAQ,CAAC,YAAY,CAA4B;gBACnD,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,UAAU;YAClB,MAAM;SACP,CAAC;QACF,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC;QAC1B,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,wBAAwB,GAAG,CAAC,MAAc,EAAuB,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,EAAE;iBAC1D,CAAC;aACH,CAAC;QACF,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE;KAC1D,CAAC,CAAC;IAEH,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,6BAA6B;IAC7B,MAAM,sBAAsB,GAAG,CAAC,QAA6B,EAAW,EAAE;QACxE,IAAI,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAA4C,CAAC;QACvE,MAAM,aAAa,GAAG,QAAQ,EAAE,CAAC,YAAY,CAAC,CAAC;QAC/C,OAAO,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI;YAC/D,aAAyC,CAAC,QAAQ,KAAK,IAAI,CAAC;IACjE,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CACnB,OAAqC,EACR,EAAE,CAAC,OAAO,KAAK,SAAS;QACrD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC;YACE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAChE,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACnD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;SACnF,CAAC;IAEN;;;;OAIG;IACH,MAAM,aAAa,GAAG,CACpB,IAA6B,EAC7B,KAAoB,EACK,EAAE,CAAC,CAAC;QAC7B,GAAG,IAAI;QACP,CAAC,qBAAqB,CAAC,EAAE,KAAK;QAC9B,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC,CAAC;IAEH,gFAAgF;IAChF,iFAAiF;IACjF,iFAAiF;IACjF,iFAAiF;IACjF,kCAAkC;IAClC,IAAI,eAAmC,CAAC;IAExC,KAAK,UAAU,eAAe,CAAC,IAA6B;QAI1D,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,SAAS,CACb,+CAA+C,EAC/C,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE;gBAC/B,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,kBAAkB,CAAC,gBAAgB;aAChD,CAAC,CACH,CAAC;YACF,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,OAAO,EAAE,KAAK;4BACd,KAAK,EAAE;gCACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;gCACzC,OAAO,EACL,wGAAwG;6BAC3G;yBACF,CAAC;qBACH;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GACV,MAAM,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAE/C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO;YAC/B,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,KAAK,kBAAkB,CAAC,YAAY;gBACtD,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,UAAU,CAAC;QACjB,MAAM,qBAAqB,GAAG,MAAM,SAAS,CAC3C,oBAAoB,UAAU,sBAAsB,EACpD,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE;YAC/B,SAAS,EAAE,MAAM,CAAC,OAAO;YACzB,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SACzE,CAAC,CACH,CAAC;QAEF,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,wBAAwB,CACrC,mEAAmE,CACpE,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACpD,CAAC;QAED,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7C,CAAC;QAED,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI;4BACpB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;4BACnC,SAAS,EAAE,QAAQ,CAAC,GAAG;4BACvB,SAAS,EAAE,QAAQ,CAAC,GAAG;yBACxB,CAAC;wBACF,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;qBAC7C,CAAC;iBACH;aACF;YACD,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACvC,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,aAAa;QAC1B,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAClE,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC,cAAc,IAAI,CAAC,EAAE,CAAC;oBAClD,OAAO,eAAe,CAAC;gBACzB,CAAC;gBACD,sEAAsE;gBACtE,MAAM,CAAC,IAAI,CACT,wEAAwE;oBACtE,oEAAoE;oBACpE,oEAAoE,CACvE,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAE1C,kFAAkF;QAClF,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,iBAAiB,CAAC;YACpD,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,GAAG;YACtB,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;YAC3C,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,SAAS,aAAa,CACpB,QAAgB,EAChB,OAA4B;QAE5B,OAAO,KAAK,EACV,IAA6B,EAC7B,SAAkB,EAClB,OAA0B,EAC1B,EAAE;YACF,MAAM,eAAe,GAAG,MAAM,SAAS,CACrC,4CAA4C,EAC5C,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;gBAC3B,QAAQ;gBACR,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;aAC/B,CAAC,EACF,QAAQ,CACT,CAAC;YACF,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,OAAO,wBAAwB,CAC7B,6DAA6D,CAC9D,CAAC;YACJ,CAAC;YACD,IAAI,MAA6C,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,OAAO,CAAC,IAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,SAAS,CACb,yEAAyE,EACzE,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;oBAC1B,QAAQ;oBACR,OAAO,EAAE,QAAQ;oBACjB,UAAU,EAAE,gBAAgB;oBAC5B,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,MAAM,KAAK,CAAC;YACd,CAAC;YAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpC,MAAM,SAAS,GAAG,MAAM,SAAS,CAC/B,qCAAqC,EACrC,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;wBAC1B,QAAQ;wBACR,OAAO,EAAE,QAAQ;wBACjB,UAAU,EAAE,sBAAsB;wBAClC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;qBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;oBACF,IAAI,CAAC,SAAS,EAAE,CAAC;wBACf,iBAAiB,CACf,MAAM,EACN,+DAA+D,EAC/D,KAAK,CACN,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,iEAAiE;YACjE,MAAM,iBAAiB,GAAG,SAAS,IAAI,MAAM,aAAa,EAAE,CAAC;YAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,mBAAmB,GAAG,MAAM,SAAS,CACzC,4CAA4C,EAC5C,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,QAAQ;oBACjB,gBAAgB,EAAE,2BAA2B;oBAC7C,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,MAAM,sBAAsB,GAAG,mBAAmB,IAAI,MAAM,SAAS,CACnE,yCAAyC,EACzC,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC7B,QAAQ;oBACR,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;oBAC5B,OAAO,iBAAiB,CACtB,MAAM,EACN,+DAA+D,EAC/D,IAAI,CACL,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,mBAAmB,GAAG,MAAM,SAAS,CACzC,wCAAwC,EACxC,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,QAAQ;oBACjB,gBAAgB,EAAE,yBAAyB;oBAC3C,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,MAAM,sBAAsB,GAAG,mBAAmB,IAAI,MAAM,SAAS,CACnE,yCAAyC,EACzC,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC7B,QAAQ;oBACR,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;oBAC5B,OAAO,iBAAiB,CACtB,MAAM,EACN,+DAA+D,EAC/D,IAAI,CACL,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBAChE,oFAAoF;gBACpF,iFAAiF;gBACjF,mDAAmD;gBACnD,MAAM,QAAQ,GAAiB;oBAC7B,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO;iBAC9C,CAAC;gBAEF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,aAAa,CAC9C,OAAO,EACP,QAAQ,EACR,OAAO,EACP,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAC7D,CAAC;gBAEF,+DAA+D;gBAC/D,wEAAwE;gBACxE,0CAA0C;gBAC1C,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBAExC,MAAM,mBAAmB,GAAG,MAAM,SAAS,CACzC,gDAAgD,EAChD,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;oBAC9B,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,MAAM,sBAAsB,GAAG,mBAAmB,IAAI,MAAM,SAAS,CACnE,+CAA+C,EAC/C,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC7B,QAAQ;oBACR,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;oBAC5B,OAAO,iBAAiB,CACtB,MAAM,EACN,+DAA+D,EAC/D,IAAI,CACL,CAAC;gBACJ,CAAC;gBAED,oEAAoE;gBACpE,0DAA0D;gBAC1D,IAAI,CAAC;oBACH,MAAM,QAAQ,CAAC,cAAc,CAAC;wBAC5B,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE;wBAClD,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;wBACrE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;wBACnC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;wBACrC,QAAQ,EAAE,KAAK;wBACf,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;qBAC5B,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;wBACxC,IAAI,EAAE,QAAQ;wBACd,KAAK,EACH,UAAU,YAAY,KAAK;4BACzB,CAAC,CAAC,UAAU,CAAC,OAAO;4BACpB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;oBAC/C,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,MAAM,CAAC,KAAK,GAAG;oBACb,UAAU,EAAE,gDAAgD;iBAC7D,CAAC;gBACF,MAAM,uBAAuB,GAAG,MAAM,SAAS,CAC7C,6CAA6C,EAC7C,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,QAAQ;oBACjB,gBAAgB,EAAE,yBAAyB;oBAC3C,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,uBAAuB,EAAE,CAAC;oBAC7B,iBAAiB,CACf,MAAM,EACN,oEAAoE,EACpE,IAAI,CACL,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GAAuB,KAAK,EAClD,QAAQ,EACR,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,EACN,OAAO,GAAG,QAAQ,EAClB,cAAc,EACd,YAAY,EACZ,EAAE;QACF,MAAM,KAAK,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACnE,MAAM,UAAU,GAAG,OAAO,KAAK,qBAAqB;YAClD,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,OAAO,KAAK,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,sBAAsB,CAAC;QACjF,MAAM,2BAA2B,GAAG,MAAM,SAAS,CACjD,wCAAwC,EACxC,GAAG,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE;YAChC,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;YACvD,UAAU;SACX,CAAC,EACF,QAAQ,CACT,CAAC;QACF,MAAM,sBAAsB,GAAG,2BAA2B,IAAI,MAAM,SAAS,CAC3E,sDAAsD,EACtD,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE;YAChE,QAAQ;YACR,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;YACvD,UAAU;SACX,CAAC,EACF,QAAQ,CACT,CAAC;QACF,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,QAAQ,CAAC,KAAK,GAAG;YACf,GAAG,CAAE,QAAQ,CAAC,KAA6C,IAAI,EAAE,CAAC;YAClE,CAAC,YAAY,CAAC,EAAE;gBACd,QAAQ,EAAE,IAAI;gBACd,OAAO;gBACP,GAAG,CAAC,CAAC,sBAAsB;oBACzB,CAAC,CAAC;wBACE,MAAM,EAAE,UAAU;wBAClB,MAAM,EAAE,mEAAmE;qBAC5E;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAC;QACF,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,SAAS,IAAI,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,iBAAiB;gBAAE,OAAO,QAAQ,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,CAAC,OAAO;gBAAE,OAAO,QAAQ,CAAC;YAE9B,sEAAsE;YACtE,gEAAgE;YAChE,IAAI,SAAkC,CAAC;YACvC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,SAAS,GAAG,cAAc,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,EAAE,CAAC;gBACf,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,IAAI,CAAC,KAAK,mBAAmB;wBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACrE,uEAAuE;YACvE,oEAAoE;YACpE,sEAAsE;YACtE,qFAAqF;YACrF,oFAAoF;YACpF,wCAAwC;YACxC,MAAM,aAAa,GACjB,YAAY,KAAK,SAAS;gBACxB,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE;gBACnD,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE;gBAChF,OAAO;gBACP,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC;gBAClC,OAAO,EAAE,oBAAoB;aAC9B,CAAC,CAAC;YACH,QAAQ,CAAC,KAAK,GAAG,aAAa,CAC3B,QAAQ,CAAC,KAA6C,IAAI,EAAE,EAC7D,KAAK,CACN,CAAC;YACF,IAAI,sBAAsB,EAAE,CAAC;gBAC3B,MAAM,mBAAmB,GAAG,MAAM,SAAS,CACzC,0CAA0C,EAC1C,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EACzD,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzB,+EAA+E;oBAC/E,8DAA8D;oBAC9D,+EAA+E;oBAC/E,mEAAmE;oBACnE,gEAAgE;oBAChE,iEAAiE;oBACjE,gFAAgF;oBAChF,iBAAiB,CACf,QAAQ,EACR,gEAAgE,EAChE,aAAa,CACd,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE;gBACvD,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,IAAI,sBAAsB,EAAE,CAAC;gBAC3B,MAAM,SAAS,CACb,0CAA0C,EAC1C,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,QAAQ;oBACjB,gBAAgB,EAAE,iCAAiC;iBACpD,CAAC,EACF,QAAQ,CACT,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC;AAC/E,CAAC"}
+{"version":3,"file":"with-kya-os.session.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.session.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,qBAAqB,EACrB,gCAAgC,EAChC,qBAAqB,EACrB,+BAA+B,GAGhC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,GAExB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAG9D,4EAA4E;AAC5E,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;AAErE;;;;;GAKG;AACH,MAAM,eAAe,GAAsB;IACzC,qBAAqB;IACrB,gCAAgC;IAChC,qBAAqB;IACrB,YAAY;IACZ,YAAY;IACZ,wBAAwB;CACzB,CAAC;AAIF,gGAAgG;AAChG,SAAS,eAAe,CAAuB,MAAS,EAAE,IAAuB;IAC/E,MAAM,QAAQ,GAAG,MAAM,CAAC,KAA4C,CAAC;IACrE,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAC7B,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAChE,CAAC;IACF,MAAM,IAAI,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IACpD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC;IACvB,OAAO,IAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAuB,MAAS;IAChE,OAAO,eAAe,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAClD,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,qBAAqB,CAAuB,MAAS;IACnE,OAAO,eAAe,CAAC,MAAM,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,IAAI,OAAO,EAAiD,CAAC;AAE1F;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAAqB;IAErB,OAAO,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;AACrD,CAAC;AAuBD,MAAM,UAAU,kBAAkB,CAAC,IAAoB;IACrD,MAAM,EACJ,QAAQ,EACR,MAAM,EACN,cAAc,EACd,cAAc,EACd,cAAc,EACd,QAAQ,EACR,KAAK,EACL,kBAAkB,EAClB,oBAAoB,GACrB,GAAG,IAAI,CAAC;IACT,MAAM,aAAa,GAAG,oBAAoB,KAAK,+BAA+B,CAAC;IAC/E,MAAM,wBAAwB,GAAG,IAAI,OAAO,EAAU,CAAC;IACvD,0EAA0E;IAC1E,qEAAqE;IACrE,IAAI,cAAkC,CAAC;IAEvC,MAAM,WAAW,GAAG,CAAC,QAAoB,EAAW,EAAE,CACpD,cAAc,KAAK,SAAS;QAC3B,QAAQ,CAAC,KAA6C,EAAE,CAAC,wBAAwB,CAAC,KAAK,cAAc,CAAC;IAIzG,MAAM,SAAS,GAAG,KAAK,EACrB,KAAa,EACb,SAA0C,EAC1C,QAAiB,EACC,EAAE;QACpB,IAAI,CAAC;YACH,MAAM,SAAS,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,EAAE,EAAE;gBAChC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;gBACrD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,CACxB,QAA6B,EAC7B,MAAc,EACd,iBAA0B,EACL,EAAE;QACvB,MAAM,QAAQ,GAAG;YACf,GAAG,CAAE,QAAQ,CAAC,KAA6C,IAAI,EAAE,CAAC;SACnE,CAAC;QACF,IAAI,iBAAiB,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC,qBAAqB,CAAC,CAAC;YACvC,OAAO,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,QAAQ,CAAC,YAAY,CAAC,GAAG;YACvB,GAAG,CAAC,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,IAAI;gBAC/E,CAAC,CAAC,QAAQ,CAAC,YAAY,CAA4B;gBACnD,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,UAAU;YAClB,MAAM;SACP,CAAC;QACF,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC;QAC1B,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,wBAAwB,GAAG,CAAC,MAAc,EAAuB,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,EAAE;iBAC1D,CAAC;aACH,CAAC;QACF,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE;KAC1D,CAAC,CAAC;IAEH,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,6BAA6B;IAC7B,MAAM,sBAAsB,GAAG,CAAC,QAA6B,EAAW,EAAE;QACxE,IAAI,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAA4C,CAAC;QACvE,MAAM,aAAa,GAAG,QAAQ,EAAE,CAAC,YAAY,CAAC,CAAC;QAC/C,OAAO,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI;YAC/D,aAAyC,CAAC,QAAQ,KAAK,IAAI,CAAC;IACjE,CAAC,CAAC;IAEF;;;;;OAKG;IACH,MAAM,WAAW,GAAG,CAAC,QAA6B,EAA2B,EAAE,CAC5E,kBAAkB,CAAC,QAAQ,CAAC,CAAC,KAA6C,IAAI,EAAE,CAAC;IAEpF;;;;OAIG;IACH,MAAM,cAAc,GAAG,CAAC,QAA6B,EAAuB,EAAE;QAC5E,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAClD,QAAQ,CAAC,KAAK,GAAG;YACf,GAAG,CAAE,QAAQ,CAAC,KAA6C,IAAI,EAAE,CAAC;YAClE,CAAC,wBAAwB,CAAC,EAAE,cAAc;SAC3C,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CACnB,OAAqC,EACR,EAAE,CAAC,OAAO,KAAK,SAAS;QACrD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC;YACE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAChE,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACnD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;SACnF,CAAC;IAEN;;;;OAIG;IACH,MAAM,aAAa,GAAG,CACpB,IAA6B,EAC7B,KAAoB,EACK,EAAE,CAAC,CAAC;QAC7B,GAAG,IAAI;QACP,CAAC,qBAAqB,CAAC,EAAE,KAAK;QAC9B,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC,CAAC;IAEH,gFAAgF;IAChF,iFAAiF;IACjF,iFAAiF;IACjF,iFAAiF;IACjF,kCAAkC;IAClC,IAAI,eAAmC,CAAC;IAExC,KAAK,UAAU,eAAe,CAAC,IAA6B;QAI1D,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,SAAS,CACb,+CAA+C,EAC/C,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE;gBAC/B,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,kBAAkB,CAAC,gBAAgB;aAChD,CAAC,CACH,CAAC;YACF,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,OAAO,EAAE,KAAK;4BACd,KAAK,EAAE;gCACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;gCACzC,OAAO,EACL,wGAAwG;6BAC3G;yBACF,CAAC;qBACH;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GACV,MAAM,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAE/C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO;YAC/B,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,KAAK,kBAAkB,CAAC,YAAY;gBACtD,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,UAAU,CAAC;QACjB,MAAM,qBAAqB,GAAG,MAAM,SAAS,CAC3C,oBAAoB,UAAU,sBAAsB,EACpD,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE;YAC/B,SAAS,EAAE,MAAM,CAAC,OAAO;YACzB,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SACzE,CAAC,CACH,CAAC;QAEF,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,wBAAwB,CACrC,mEAAmE,CACpE,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACpD,CAAC;QAED,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7C,CAAC;QAED,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI;4BACpB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;4BACnC,SAAS,EAAE,QAAQ,CAAC,GAAG;4BACvB,SAAS,EAAE,QAAQ,CAAC,GAAG;yBACxB,CAAC;wBACF,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;qBAC7C,CAAC;iBACH;aACF;YACD,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACvC,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,wCAAwC;IACxC,MAAM,sBAAsB,GAAG,MAAM,CAAC;IACtC,IAAI,kBAAsC,CAAC;IAE3C,KAAK,UAAU,gBAAgB;QAC7B,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IACE,KAAK,IAAI,CAAC;YACV,CAAC,kBAAkB,KAAK,SAAS,IAAI,GAAG,GAAG,kBAAkB,GAAG,sBAAsB,CAAC,EACvF,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,kBAAkB,GAAG,GAAG,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,OAAO,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;gBAC5C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,cAAc,CAAC,QAAQ,EAAE,CAAC,cAAc,CAAC;IAClD,CAAC;IAED,0EAA0E;IAC1E,qEAAqE;IACrE,IAAI,mBAA4D,CAAC;IAEjE,KAAK,UAAU,aAAa;QAC1B,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAClE,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,gBAAgB,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpC,OAAO,eAAe,CAAC;gBACzB,CAAC;gBACD,sEAAsE;gBACtE,MAAM,CAAC,IAAI,CACT,wEAAwE;oBACtE,oEAAoE;oBACpE,oEAAoE,CACvE,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAE1C,mBAAmB,KAAK,iBAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACvD,mBAAmB,GAAG,SAAS,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,KAAK,UAAU,iBAAiB;QAC9B,kFAAkF;QAClF,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,iBAAiB,CAAC;YACpD,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,GAAG;YACtB,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;YAC3C,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,SAAS,aAAa,CACpB,QAAgB,EAChB,OAA4B;QAE5B,MAAM,GAAG,GAAG,KAAK,EACf,IAA6B,EAC7B,SAAkB,EAClB,OAA0B,EACI,EAAE;YAChC,MAAM,eAAe,GAAG,MAAM,SAAS,CACrC,4CAA4C,EAC5C,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;gBAC3B,QAAQ;gBACR,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;aAC/B,CAAC,EACF,QAAQ,CACT,CAAC;YACF,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,OAAO,wBAAwB,CAC7B,6DAA6D,CAC9D,CAAC;YACJ,CAAC;YACD,IAAI,MAA6C,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,OAAO,CAAC,IAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,SAAS,CACb,yEAAyE,EACzE,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;oBAC1B,QAAQ;oBACR,OAAO,EAAE,QAAQ;oBACjB,UAAU,EAAE,gBAAgB;oBAC5B,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,MAAM,KAAK,CAAC;YACd,CAAC;YAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpC,MAAM,SAAS,GAAG,MAAM,SAAS,CAC/B,qCAAqC,EACrC,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;wBAC1B,QAAQ;wBACR,OAAO,EAAE,QAAQ;wBACjB,UAAU,EAAE,sBAAsB;wBAClC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;qBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;oBACF,IAAI,CAAC,SAAS,EAAE,CAAC;wBACf,iBAAiB,CACf,MAAM,EACN,+DAA+D,EAC/D,KAAK,CACN,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,iEAAiE;YACjE,MAAM,iBAAiB,GAAG,SAAS,IAAI,MAAM,aAAa,EAAE,CAAC;YAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,MAAM,mBAAmB,GAAG,MAAM,SAAS,CACzC,4CAA4C,EAC5C,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,QAAQ;oBACjB,gBAAgB,EAAE,2BAA2B;oBAC7C,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,MAAM,sBAAsB,GAAG,mBAAmB,IAAI,MAAM,SAAS,CACnE,yCAAyC,EACzC,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC7B,QAAQ;oBACR,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;oBAC5B,OAAO,iBAAiB,CACtB,MAAM,EACN,+DAA+D,EAC/D,IAAI,CACL,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,mBAAmB,GAAG,MAAM,SAAS,CACzC,wCAAwC,EACxC,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,QAAQ;oBACjB,gBAAgB,EAAE,yBAAyB;oBAC3C,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,MAAM,sBAAsB,GAAG,mBAAmB,IAAI,MAAM,SAAS,CACnE,yCAAyC,EACzC,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC7B,QAAQ;oBACR,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;oBAC5B,OAAO,iBAAiB,CACtB,MAAM,EACN,+DAA+D,EAC/D,IAAI,CACL,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBAChE,oFAAoF;gBACpF,iFAAiF;gBACjF,mDAAmD;gBACnD,MAAM,QAAQ,GAAiB;oBAC7B,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO;iBAC9C,CAAC;gBAEF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,aAAa,CAC9C,OAAO,EACP,QAAQ,EACR,OAAO,EACP,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAC7D,CAAC;gBAEF,+DAA+D;gBAC/D,wEAAwE;gBACxE,sEAAsE;gBACtE,+CAA+C;gBAC/C,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;gBAEzD,MAAM,mBAAmB,GAAG,MAAM,SAAS,CACzC,gDAAgD,EAChD,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;oBAC9B,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,MAAM,sBAAsB,GAAG,mBAAmB,IAAI,MAAM,SAAS,CACnE,+CAA+C,EAC/C,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC7B,QAAQ;oBACR,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;oBAC5B,OAAO,iBAAiB,CACtB,MAAM,EACN,+DAA+D,EAC/D,IAAI,CACL,CAAC;gBACJ,CAAC;gBAED,oEAAoE;gBACpE,0DAA0D;gBAC1D,IAAI,CAAC;oBACH,MAAM,QAAQ,CAAC,cAAc,CAAC;wBAC5B,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE;wBAClD,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;wBACrE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;wBACnC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;wBACrC,QAAQ,EAAE,KAAK;wBACf,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;qBAC5B,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;wBACxC,IAAI,EAAE,QAAQ;wBACd,KAAK,EACH,UAAU,YAAY,KAAK;4BACzB,CAAC,CAAC,UAAU,CAAC,OAAO;4BACpB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;oBAC/C,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,MAAM,CAAC,KAAK,GAAG;oBACb,GAAG,WAAW,CAAC,MAAM,CAAC;oBACtB,UAAU,EAAE,gDAAgD;iBAC7D,CAAC;gBACF,MAAM,uBAAuB,GAAG,MAAM,SAAS,CAC7C,6CAA6C,EAC7C,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,QAAQ;oBACjB,gBAAgB,EAAE,yBAAyB;oBAC3C,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,EACF,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,uBAAuB,EAAE,CAAC;oBAC7B,iBAAiB,CACf,MAAM,EACN,oEAAoE,EACpE,IAAI,CACL,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QACF,OAAO,KAAK,EACV,IAA6B,EAC7B,SAAkB,EAClB,OAA0B,EAC1B,EAAE,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,oBAAoB,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3C,cAAc,KAAK,wBAAwB,CACzC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CACtD,CAAC;QACF,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAuB,KAAK,EAC5C,QAAQ,EACR,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,EACN,OAAO,GAAG,QAAQ,EAClB,cAAc,EACd,YAAY,EACZ,EAAE;QACF,MAAM,KAAK,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACnE,MAAM,UAAU,GAAG,OAAO,KAAK,qBAAqB;YAClD,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,OAAO,KAAK,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,sBAAsB,CAAC;QACjF,MAAM,2BAA2B,GAAG,MAAM,SAAS,CACjD,wCAAwC,EACxC,GAAG,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE;YAChC,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;YACvD,UAAU;SACX,CAAC,EACF,QAAQ,CACT,CAAC;QACF,MAAM,sBAAsB,GAAG,2BAA2B,IAAI,MAAM,SAAS,CAC3E,sDAAsD,EACtD,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE;YAChE,QAAQ;YACR,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;YACvD,UAAU;SACX,CAAC,EACF,QAAQ,CACT,CAAC;QACF,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,QAAQ,CAAC,KAAK,GAAG;YACf,GAAG,CAAE,QAAQ,CAAC,KAA6C,IAAI,EAAE,CAAC;YAClE,CAAC,YAAY,CAAC,EAAE;gBACd,QAAQ,EAAE,IAAI;gBACd,OAAO;gBACP,GAAG,CAAC,CAAC,sBAAsB;oBACzB,CAAC,CAAC;wBACE,MAAM,EAAE,UAAU;wBAClB,MAAM,EAAE,mEAAmE;qBAC5E;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAC;QACF,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,SAAS,IAAI,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,iBAAiB;gBAAE,OAAO,QAAQ,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,CAAC,OAAO;gBAAE,OAAO,QAAQ,CAAC;YAE9B,sEAAsE;YACtE,gEAAgE;YAChE,IAAI,SAAkC,CAAC;YACvC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,SAAS,GAAG,cAAc,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,EAAE,CAAC;gBACf,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,IAAI,CAAC,KAAK,mBAAmB;wBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACrE,uEAAuE;YACvE,oEAAoE;YACpE,sEAAsE;YACtE,qFAAqF;YACrF,oFAAoF;YACpF,wCAAwC;YACxC,MAAM,aAAa,GACjB,YAAY,KAAK,SAAS;gBACxB,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE;gBACnD,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE;gBAChF,OAAO;gBACP,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC;gBAClC,OAAO,EAAE,oBAAoB;aAC9B,CAAC,CAAC;YACH,QAAQ,CAAC,KAAK,GAAG,aAAa,CAC3B,QAAQ,CAAC,KAA6C,IAAI,EAAE,EAC7D,KAAK,CACN,CAAC;YACF,IAAI,sBAAsB,EAAE,CAAC;gBAC3B,MAAM,mBAAmB,GAAG,MAAM,SAAS,CACzC,0CAA0C,EAC1C,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EACzD,QAAQ,CACT,CAAC;gBACF,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzB,+EAA+E;oBAC/E,8DAA8D;oBAC9D,+EAA+E;oBAC/E,mEAAmE;oBACnE,gEAAgE;oBAChE,iEAAiE;oBACjE,gFAAgF;oBAChF,iBAAiB,CACf,QAAQ,EACR,gEAAgE,EAChE,aAAa,CACd,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE;gBACvD,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,IAAI,sBAAsB,EAAE,CAAC;gBAC3B,MAAM,SAAS,CACb,0CAA0C,EAC1C,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,QAAQ;oBACjB,gBAAgB,EAAE,iCAAiC;iBACpD,CAAC,EACF,QAAQ,CACT,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,kBAAkB,GAAuB,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,CAClE,cAAc,CAAC,MAAM,YAAY,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAEjD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC;AAC/E,CAAC"}

package/dist/middleware/with-kya-os.types.d.ts

@@ -38,6 +38,24 @@ export interface KyaOsCallContext {
     authorization?: AuthorizationEvidence;
     correlationId?: string;
     causationId?: string;
+    /**
+     * The principal `wrapWithDelegation` authenticated: the delegation subject,
+     * its controller, and the scopes the verified credential (or durable grant)
+     * carries. A composed `withPolicyGate` evaluates these instead of re-reading
+     * `_kyaos_delegation`, which the delegation gate has already stripped.
+     */
+    principal?: {
+        agentDid: string;
+        responsibleParty?: string;
+        delegatedScopes: readonly string[];
+    };
+    /**
+     * Approval grants the caller supplied as `_kyaos_approvals`. The delegation
+     * gate withholds every `_kyaos*` argument from the handler (and from the
+     * holder-binding hash), so it forwards these here for a composed
+     * `withPolicyGate` to verify on a step-up resume.
+     */
+    approvals?: unknown;
 }
 export interface KyaOsToolHandler<T extends Record<string, unknown> = Record<string, unknown>> {
     (args: T, sessionId?: string, context?: KyaOsCallContext): Promise<{
@@ -164,7 +182,12 @@ export interface PolicyGateOptions {
     classifier?: RiskClassifier;
     /** Derive the resource namespace from the tool args (defaults to the tool name). */
     resolveNamespace?: (args: Record<string, unknown>) => string;
-    /** Tool-arg key carrying approval grants on resume. Default "_kyaos_approvals". */
+    /**
+     * Tool-arg key carrying approval grants on resume. Default "_kyaos_approvals".
+     * Composed after `wrapWithDelegation`, the default key arrives through the
+     * call context (the outer gate strips `_kyaos*` arguments); a custom key
+     * outside that prefix passes through as an ordinary argument.
+     */
     approvalsArgKey?: string;
     /** Verifier for approval-grant signatures (identity-layer). Default: reject all. */
     isValidApprovalSignature?: (grant: ApprovalGrant) => Promise<boolean>;
@@ -175,10 +198,10 @@ export interface PolicyGateOptions {
      * scope or identity, so it must NOT be trusted to allow on its own. When you
      * compose it AFTER wrapWithDelegation (the expected usage), pass
      * `scopeMatched: true` to signal that the delegated scope was already verified.
-     * Note: principal facts are projected from the (unverified) `_kyaos_delegation`
-     * arg on a best-effort basis and must not be treated as authenticated unless
-     * wrapWithDelegation ran first.
+     * Composed that way, the engine sees the principal and scopes the delegation
+     * gate authenticated (via the call context). Used standalone, principal facts
+     * are projected from the (unverified) `_kyaos_delegation` arg on a best-effort
+     * basis and must not be treated as authenticated.
      */
     scopeMatched?: boolean;
 }
-//# sourceMappingURL=with-kya-os.types.d.ts.map

package/dist/policy/approval.d.ts

@@ -19,6 +19,14 @@ export interface ApprovalGrant {
 export interface QuorumResult {
     satisfied: boolean;
     reason?: string;
+    /**
+     * The distinct approver DIDs whose grants verified (allowlisted, bound to the
+     * request, signature accepted), whether or not they reached the quorum. The
+     * only set a policy engine's `humanApprovals` should be built from.
+     * `verifyApprovalQuorum` always sets it; it is optional so that code
+     * building its own `QuorumResult` keeps compiling.
+     */
+    approvers?: string[];
 }
 export interface Quorum {
     n: number;
@@ -29,6 +37,9 @@ export interface Quorum {
  * Quorum is satisfied iff at least `quorum.n` DISTINCT approvers each signed an
  * `approve` grant over EXACTLY `requestHash`, drawn from `quorum.approvers`
  * (empty = any), with a signature accepted by `isValidSignature`.
+ *
+ * `requestHash` may list several hashes when they all identify the one
+ * suspended action, as the hashes of its legacy and SPEC §7.3 request shapes
+ * do; a grant over any of them counts.
  */
-export declare function verifyApprovalQuorum(grants: ApprovalGrant[], requestHash: string, quorum: Quorum, isValidSignature: (g: ApprovalGrant) => Promise<boolean>): Promise<QuorumResult>;
-//# sourceMappingURL=approval.d.ts.map
+export declare function verifyApprovalQuorum(grants: ApprovalGrant[], requestHash: string | readonly string[], quorum: Quorum, isValidSignature: (g: ApprovalGrant) => Promise<boolean>): Promise<QuorumResult>;

package/dist/policy/approval.js

@@ -2,18 +2,25 @@
  * Quorum is satisfied iff at least `quorum.n` DISTINCT approvers each signed an
  * `approve` grant over EXACTLY `requestHash`, drawn from `quorum.approvers`
  * (empty = any), with a signature accepted by `isValidSignature`.
+ *
+ * `requestHash` may list several hashes when they all identify the one
+ * suspended action, as the hashes of its legacy and SPEC §7.3 request shapes
+ * do; a grant over any of them counts.
  */
 export async function verifyApprovalQuorum(grants, requestHash, quorum, isValidSignature) {
+    const actionHashes = typeof requestHash === 'string'
+        ? [requestHash]
+        : requestHash;
     // A non-positive quorum is a misconfiguration (e.g. a third-party engine
     // returning {n:0}); treat it as never-satisfiable rather than auto-passing.
     if (quorum.n <= 0) {
-        return { satisfied: false, reason: 'invalid_quorum:n<=0' };
+        return { satisfied: false, reason: 'invalid_quorum:n<=0', approvers: [] };
     }
     const approvers = new Set();
     for (const g of grants) {
         if (g.decision !== 'approve')
             continue;
-        if (g.requestHash !== requestHash)
+        if (!actionHashes.includes(g.requestHash))
             continue; // TOCTOU guard
         if (quorum.approvers.length > 0 && !quorum.approvers.includes(g.approverDid))
             continue;
@@ -22,8 +29,12 @@ export async function verifyApprovalQuorum(grants, requestHash, quorum, isValidS
         approvers.add(g.approverDid);
     }
     if (approvers.size >= quorum.n) {
-        return { satisfied: true };
+        return { satisfied: true, approvers: [...approvers] };
     }
-    return { satisfied: false, reason: `quorum_not_met:${approvers.size}/${quorum.n}` };
+    return {
+        satisfied: false,
+        reason: `quorum_not_met:${approvers.size}/${quorum.n}`,
+        approvers: [...approvers],
+    };
 }
 //# sourceMappingURL=approval.js.map

package/dist/policy/approval.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../src/policy/approval.ts"],"names":[],"mappings":"AA8BA;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAuB,EACvB,WAAmB,EACnB,MAAc,EACd,gBAAwD;IAExD,yEAAyE;IACzE,4EAA4E;IAC5E,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;YAAE,SAAS;QACvC,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW;YAAE,SAAS,CAAC,eAAe;QAC5D,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;YAAE,SAAS;QACvF,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAC3C,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC;AACtF,CAAC"}
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../src/policy/approval.ts"],"names":[],"mappings":"AAsCA;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAuB,EACvB,WAAuC,EACvC,MAAc,EACd,gBAAwD;IAExD,MAAM,YAAY,GAAsB,OAAO,WAAW,KAAK,QAAQ;QACrE,CAAC,CAAC,CAAC,WAAW,CAAC;QACf,CAAC,CAAC,WAAW,CAAC;IAChB,yEAAyE;IACzE,4EAA4E;IAC5E,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC5E,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;YAAE,SAAS;QACvC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;YAAE,SAAS,CAAC,eAAe;QACpE,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;YAAE,SAAS;QACvF,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAC3C,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kBAAkB,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,EAAE;QACtD,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;KAC1B,CAAC;AACJ,CAAC"}

package/dist/policy/classifier.d.ts

@@ -35,4 +35,3 @@ export declare class RiskClassifier {
     constructor(options?: RiskClassifierOptions);
     classify(invocation: Invocation): RiskAssessment;
 }
-//# sourceMappingURL=classifier.d.ts.map

package/dist/policy/default-engine.d.ts

@@ -1,7 +1,7 @@
 import type { PolicyEngine } from './engine.js';
 import type { PolicyRequest, PolicyDecision } from './types.js';
 export interface DefaultPolicyConfig {
-    /** Approvals required for a step-up. Default 1. */
+    /** Distinct approvals required for a step-up. Default 1. */
     stepUpQuorum?: number;
     /** Allowed approver DIDs; empty/undefined = any identity may approve. */
     stepUpApprovers?: string[];
@@ -13,6 +13,10 @@ export interface DefaultPolicyConfig {
  *  - irreversible/high/catastrophic → step_up (or allow once quorum met)
  *  - otherwise                  → allow
  *
+ * The quorum counts DISTINCT approver DIDs from `context.humanApprovals`, and
+ * only those on `stepUpApprovers` when it is set. Feed `humanApprovals` from
+ * `verifyApprovalQuorum(...).approvers`, never from unverified input.
+ *
  * Production deployments are expected to swap in an OPA/Rego or Cedar adapter;
  * this engine encodes the same fail-closed posture as a sensible default.
  */
@@ -21,4 +25,3 @@ export declare class DefaultPolicyEngine implements PolicyEngine {
     constructor(cfg?: DefaultPolicyConfig);
     evaluate(req: PolicyRequest): Promise<PolicyDecision>;
 }
-//# sourceMappingURL=default-engine.d.ts.map

package/dist/policy/default-engine.js

@@ -5,6 +5,10 @@
  *  - irreversible/high/catastrophic → step_up (or allow once quorum met)
  *  - otherwise                  → allow
  *
+ * The quorum counts DISTINCT approver DIDs from `context.humanApprovals`, and
+ * only those on `stepUpApprovers` when it is set. Feed `humanApprovals` from
+ * `verifyApprovalQuorum(...).approvers`, never from unverified input.
+ *
  * Production deployments are expected to swap in an OPA/Rego or Cedar adapter;
  * this engine encodes the same fail-closed posture as a sensible default.
  */
@@ -26,12 +30,16 @@ export class DefaultPolicyEngine {
             severity === 'high';
         if (dangerous) {
             const n = this.cfg.stepUpQuorum ?? 1;
-            if (humanApprovals.length >= n) {
+            // Distinct DIDs only, and only allowlisted ones when an allowlist is set:
+            // one approver named twice is not two approvals.
+            const allowed = this.cfg.stepUpApprovers ?? [];
+            const approvers = new Set(humanApprovals.filter((did) => allowed.length === 0 || allowed.includes(did)));
+            if (approvers.size >= n) {
                 return { decision: 'allow' };
             }
             return {
                 decision: 'step_up',
-                quorum: { n, approvers: this.cfg.stepUpApprovers ?? [] },
+                quorum: { n, approvers: allowed },
                 reason: 'destructive_action_requires_approval',
             };
         }

package/dist/policy/default-engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"default-engine.js","sourceRoot":"","sources":["../../src/policy/default-engine.ts"],"names":[],"mappings":"AAUA;;;;;;;;;GASG;AACH,MAAM,OAAO,mBAAmB;IACD;IAA7B,YAA6B,MAA2B,EAAE;QAA7B,QAAG,GAAH,GAAG,CAA0B;IAAG,CAAC;IAE9D,KAAK,CAAC,QAAQ,CAAC,GAAkB;QAC/B,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;QAE9E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QAC3D,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QAChE,CAAC;QAED,MAAM,SAAS,GACb,aAAa,KAAK,cAAc;YAChC,QAAQ,KAAK,cAAc;YAC3B,QAAQ,KAAK,MAAM,CAAC;QAEtB,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC;YACrC,IAAI,cAAc,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBAC/B,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YAC/B,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,EAAE;gBACxD,MAAM,EAAE,sCAAsC;aAC/C,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;CACF"}
+{"version":3,"file":"default-engine.js","sourceRoot":"","sources":["../../src/policy/default-engine.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,mBAAmB;IACD;IAA7B,YAA6B,MAA2B,EAAE;QAA7B,QAAG,GAAH,GAAG,CAA0B;IAAG,CAAC;IAE9D,KAAK,CAAC,QAAQ,CAAC,GAAkB;QAC/B,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;QAE9E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QAC3D,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QAChE,CAAC;QAED,MAAM,SAAS,GACb,aAAa,KAAK,cAAc;YAChC,QAAQ,KAAK,cAAc;YAC3B,QAAQ,KAAK,MAAM,CAAC;QAEtB,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC;YACrC,0EAA0E;YAC1E,iDAAiD;YACjD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;YAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAC9E,CAAC;YACF,IAAI,SAAS,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;gBACxB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YAC/B,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE;gBACjC,MAAM,EAAE,sCAAsC;aAC/C,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;CACF"}

package/dist/policy/engine.d.ts

@@ -9,4 +9,3 @@ import type { PolicyRequest, PolicyDecision } from './types.js';
 export interface PolicyEngine {
     evaluate(req: PolicyRequest): Promise<PolicyDecision>;
 }
-//# sourceMappingURL=engine.d.ts.map

package/dist/policy/index.d.ts

@@ -4,4 +4,3 @@ export * from './classifier.js';
 export * from './default-engine.js';
 export * from './projection.js';
 export * from './approval.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/policy/projection.d.ts

@@ -44,4 +44,3 @@ export interface PolicyRequestInput {
  * to an empty list (the first-pass, pre-approval state).
  */
 export declare function buildPolicyRequest(input: PolicyRequestInput): PolicyRequest;
-//# sourceMappingURL=projection.d.ts.map

package/dist/policy/types.d.ts

@@ -49,4 +49,3 @@ export type PolicyDecision = {
     };
     reason: string;
 };
-//# sourceMappingURL=types.d.ts.map

package/dist/proof/covered-request.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The request a proof's `requestHash` covers (SPEC §7.3), and the shapes of
+ * one tool call a verifier accepts it for.
+ *
+ * SPEC §7.3 covers the JSON-RPC request the client actually sends, so anyone
+ * holding the wire message can recompute the hash: the `tools/call` message's
+ * `{ method, params }` with the members that cannot be signed taken out.
+ * `params._meta` is intermediary-mutable transport metadata, and the
+ * `_kyaos`-prefixed control arguments carry the credentials that authorize the
+ * call (a delegation, the holder-binding proof, approval grants); two of those
+ * are themselves bound to this hash, so covering them would make the hash
+ * depend on its own output.
+ *
+ * Producers in 1.x still hash the legacy shape `{ method: <tool name>, params:
+ * <arguments> }`, so verifiers already deployed keep accepting their proofs.
+ * Verifiers accept a hash of either shape of the same call (see
+ * {@link alternateRequestShapes}); producers switch to the §7.3 shape in 2.0.0.
+ */
+import type { ToolRequest } from './generator.js';
+/**
+ * Whether an argument key is reserved KYA-OS protocol envelope (`_kyaos*`:
+ * `_kyaos_delegation`, `_kyaos_proof`, `_kyaos_approvals`, …) rather than caller
+ * tool intent. The SINGLE predicate behind both the request hash and the
+ * middleware's handler-arg stripping, so the set excluded from the bound hash
+ * and the set withheld from the handler cannot drift — a proof binds exactly the
+ * call the handler runs.
+ */
+export declare function isKyaOsControlArg(key: string): boolean;
+/**
+ * The other shapes of the call `request` describes, whose `requestHash` a
+ * verifier accepts as well as the hash of `request` itself. A caller may hold
+ * the call in either shape: the legacy shape `{ method: <tool name>, params:
+ * <arguments> }` that 1.x producers sign, or the `tools/call` request as sent.
+ * From either, this yields the SPEC §7.3 covered request and the legacy shape
+ * with the arguments as given and with the control args removed: 1.x
+ * producers differ in whether control args stay in the legacy shape (the
+ * holder-binding request, the step-up hash and wrapped handlers drop them, a
+ * proof added at the transport keeps them).
+ *
+ * Every shape describes the same tool name and business arguments, so
+ * accepting any of them binds the same call. The legacy shape keeps its known
+ * ambiguities for the 1.x line: a tool named after a JSON-RPC method hashes
+ * like that method's request, and `params` members other than the arguments
+ * are not covered.
+ */
+export declare function alternateRequestShapes(request: ToolRequest): ToolRequest[];