@kya-os/mcp 1.16.2 → 1.18.0

package/dist/proof/covered-request.js

@@ -0,0 +1,107 @@
+/**
+ * The request a proof's `requestHash` covers (SPEC §7.3), and the shapes of
+ * one tool call a verifier accepts it for.
+ *
+ * SPEC §7.3 covers the JSON-RPC request the client actually sends, so anyone
+ * holding the wire message can recompute the hash: the `tools/call` message's
+ * `{ method, params }` with the members that cannot be signed taken out.
+ * `params._meta` is intermediary-mutable transport metadata, and the
+ * `_kyaos`-prefixed control arguments carry the credentials that authorize the
+ * call (a delegation, the holder-binding proof, approval grants); two of those
+ * are themselves bound to this hash, so covering them would make the hash
+ * depend on its own output.
+ *
+ * Producers in 1.x still hash the legacy shape `{ method: <tool name>, params:
+ * <arguments> }`, so verifiers already deployed keep accepting their proofs.
+ * Verifiers accept a hash of either shape of the same call (see
+ * {@link alternateRequestShapes}); producers switch to the §7.3 shape in 2.0.0.
+ */
+/** JSON-RPC method of an MCP tool invocation. */
+const TOOLS_CALL_METHOD = 'tools/call';
+/**
+ * The control-arg key prefix. Args beginning with this are protocol envelope
+ * (`_kyaos_delegation`, `_kyaos_proof`, `_kyaos_approvals`), not the caller's
+ * tool intent.
+ */
+const KYAOS_CONTROL_PREFIX = '_kyaos';
+/**
+ * Whether an argument key is reserved KYA-OS protocol envelope (`_kyaos*`:
+ * `_kyaos_delegation`, `_kyaos_proof`, `_kyaos_approvals`, …) rather than caller
+ * tool intent. The SINGLE predicate behind both the request hash and the
+ * middleware's handler-arg stripping, so the set excluded from the bound hash
+ * and the set withheld from the handler cannot drift — a proof binds exactly the
+ * call the handler runs.
+ */
+export function isKyaOsControlArg(key) {
+    return key.startsWith(KYAOS_CONTROL_PREFIX);
+}
+/**
+ * The other shapes of the call `request` describes, whose `requestHash` a
+ * verifier accepts as well as the hash of `request` itself. A caller may hold
+ * the call in either shape: the legacy shape `{ method: <tool name>, params:
+ * <arguments> }` that 1.x producers sign, or the `tools/call` request as sent.
+ * From either, this yields the SPEC §7.3 covered request and the legacy shape
+ * with the arguments as given and with the control args removed: 1.x
+ * producers differ in whether control args stay in the legacy shape (the
+ * holder-binding request, the step-up hash and wrapped handlers drop them, a
+ * proof added at the transport keeps them).
+ *
+ * Every shape describes the same tool name and business arguments, so
+ * accepting any of them binds the same call. The legacy shape keeps its known
+ * ambiguities for the 1.x line: a tool named after a JSON-RPC method hashes
+ * like that method's request, and `params` members other than the arguments
+ * are not covered.
+ */
+export function alternateRequestShapes(request) {
+    const call = asToolCall(request);
+    if (call === undefined)
+        return [];
+    const legacy = (args) => ({
+        method: call.name,
+        params: args,
+    });
+    return [
+        coveredToolCall(call),
+        legacy(call.args),
+        legacy(withoutKeys(call.args, isKyaOsControlArg)),
+    ];
+}
+/**
+ * Read a tool call's name and arguments from either shape. A `tools/call`
+ * whose params carry a string `name` is the wire shape; any other request is
+ * read as the legacy shape, its method being the tool name. Arguments that are
+ * not an object describe no tool call, so they yield no alternate shapes. An
+ * absent `arguments` is read as `{}`: MCP clients may omit it for a call
+ * without arguments, and a server cannot tell the two apart.
+ */
+function asToolCall(request) {
+    const { method, params } = request;
+    if (method === TOOLS_CALL_METHOD && isJsonObject(params) && typeof params['name'] === 'string') {
+        const args = params['arguments'] ?? {};
+        return isJsonObject(args) ? { name: params['name'], args, params } : undefined;
+    }
+    const args = params ?? {};
+    return isJsonObject(args)
+        ? { name: method, args, params: { name: method, arguments: args } }
+        : undefined;
+}
+/**
+ * The SPEC §7.3 covered request for a tool call: its `tools/call` params
+ * without the top-level `_meta` member, and its arguments without the control
+ * args. Every other params member stays covered, and nothing nested deeper is
+ * touched, so signer and verifier derive the same request.
+ */
+function coveredToolCall(call) {
+    const params = withoutKeys(call.params, (key) => key === '_meta');
+    params['arguments'] = withoutKeys(call.args, isKyaOsControlArg);
+    return { method: TOOLS_CALL_METHOD, params };
+}
+function isJsonObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+// Object.fromEntries defines own properties, so a received `__proto__` member
+// stays a member instead of becoming the copy's prototype.
+function withoutKeys(value, drop) {
+    return Object.fromEntries(Object.entries(value).filter(([key]) => !drop(key)));
+}
+//# sourceMappingURL=covered-request.js.map

package/dist/proof/covered-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"covered-request.js","sourceRoot":"","sources":["../../src/proof/covered-request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,iDAAiD;AACjD,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAEvC;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAEtC;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO,GAAG,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AAC9C,CAAC;AAWD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAoB;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,IAA6B,EAAe,EAAE,CAAC,CAAC;QAC9D,MAAM,EAAE,IAAI,CAAC,IAAI;QACjB,MAAM,EAAE,IAAI;KACb,CAAC,CAAC;IACH,OAAO;QACL,eAAe,CAAC,IAAI,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QACjB,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;KAClD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,OAAoB;IACtC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACnC,IAAI,MAAM,KAAK,iBAAiB,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/F,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACvC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;IAC1B,OAAO,YAAY,CAAC,IAAI,CAAC;QACvB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;QACnE,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAc;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;IAClE,MAAM,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAChE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,8EAA8E;AAC9E,2DAA2D;AAC3D,SAAS,WAAW,CAClB,KAA8B,EAC9B,IAA8B;IAE9B,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC"}

package/dist/proof/errors.d.ts

@@ -14,6 +14,9 @@ export declare const PROOF_VERIFICATION_ERROR_CODES: {
     readonly TIMESTAMP_SKEW_EXCEEDED: "TIMESTAMP_SKEW_EXCEEDED";
     readonly TIMESTAMP_INVALID: "TIMESTAMP_INVALID";
     readonly CONTENT_BINDING_MISMATCH: "CONTENT_BINDING_MISMATCH";
+    readonly KID_DID_MISMATCH: "KID_DID_MISMATCH";
+    readonly DID_MISMATCH: "DID_MISMATCH";
+    readonly AUDIENCE_MISMATCH: "AUDIENCE_MISMATCH";
     readonly INVALID_JWS_SIGNATURE: "INVALID_JWS_SIGNATURE";
     readonly INVALID_JWS_FORMAT: "INVALID_JWS_FORMAT";
     readonly INVALID_JWS_HEADER: "INVALID_JWS_HEADER";
@@ -48,4 +51,3 @@ export declare class ProofVerificationError extends Error {
  * Create a proof verification error
  */
 export declare function createProofVerificationError(code: ProofVerificationErrorCode, message: string, details?: Record<string, unknown>): ProofVerificationError;
-//# sourceMappingURL=errors.d.ts.map

package/dist/proof/errors.js

@@ -19,6 +19,11 @@ export const PROOF_VERIFICATION_ERROR_CODES = {
     // the request/response the verifier actually received does not match the hash
     // bound in the (authentic) proof — i.e. the content was substituted in transit.
     CONTENT_BINDING_MISMATCH: "CONTENT_BINDING_MISMATCH",
+    // Signer binding: `kid` names a key of a DID other than the claimed `did`,
+    // or the proof's `did` / `audience` is not the one the caller expected.
+    KID_DID_MISMATCH: "KID_DID_MISMATCH",
+    DID_MISMATCH: "DID_MISMATCH",
+    AUDIENCE_MISMATCH: "AUDIENCE_MISMATCH",
     // Signature errors
     INVALID_JWS_SIGNATURE: "INVALID_JWS_SIGNATURE",
     INVALID_JWS_FORMAT: "INVALID_JWS_FORMAT",

package/dist/proof/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/proof/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,yBAAyB;IACzB,uBAAuB,EAAE,yBAAyB;IAClD,sBAAsB,EAAE,wBAAwB;IAEhD,kBAAkB;IAClB,qBAAqB,EAAE,uBAAuB;IAC9C,uBAAuB,EAAE,yBAAyB;IAClD,iBAAiB,EAAE,mBAAmB;IACtC,8EAA8E;IAC9E,8EAA8E;IAC9E,gFAAgF;IAChF,wBAAwB,EAAE,0BAA0B;IAEpD,mBAAmB;IACnB,qBAAqB,EAAE,uBAAuB;IAC9C,kBAAkB,EAAE,oBAAoB;IACxC,kBAAkB,EAAE,oBAAoB;IACxC,mBAAmB,EAAE,qBAAqB;IAC1C,4BAA4B,EAAE,8BAA8B;IAC5D,qBAAqB,EAAE,uBAAuB;IAE9C,aAAa;IACb,kBAAkB,EAAE,oBAAoB;IACxC,eAAe,EAAE,iBAAiB;IAClC,eAAe,EAAE,iBAAiB;IAClC,mBAAmB,EAAE,qBAAqB;IAC1C,sBAAsB,EAAE,wBAAwB;IAChD,gBAAgB,EAAE,kBAAkB;IAEpC,wBAAwB;IACxB,qBAAqB,EAAE,uBAAuB;IAC9C,sBAAsB,EAAE,wBAAwB;IAChD,6BAA6B,EAAE,+BAA+B;IAC9D,oBAAoB,EAAE,sBAAsB;IAC5C,sBAAsB,EAAE,wBAAwB;IAEhD,qBAAqB;IACrB,qBAAqB,EAAE,uBAAuB;IAE9C,iBAAiB;IACjB,kBAAkB,EAAE,oBAAoB;IACxC,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAKX;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAE7B;IAEA;IAHlB,YACkB,IAAgC,EAChD,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAA4B;QAEhC,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAAgC,EAChC,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/proof/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,yBAAyB;IACzB,uBAAuB,EAAE,yBAAyB;IAClD,sBAAsB,EAAE,wBAAwB;IAEhD,kBAAkB;IAClB,qBAAqB,EAAE,uBAAuB;IAC9C,uBAAuB,EAAE,yBAAyB;IAClD,iBAAiB,EAAE,mBAAmB;IACtC,8EAA8E;IAC9E,8EAA8E;IAC9E,gFAAgF;IAChF,wBAAwB,EAAE,0BAA0B;IACpD,2EAA2E;IAC3E,wEAAwE;IACxE,gBAAgB,EAAE,kBAAkB;IACpC,YAAY,EAAE,cAAc;IAC5B,iBAAiB,EAAE,mBAAmB;IAEtC,mBAAmB;IACnB,qBAAqB,EAAE,uBAAuB;IAC9C,kBAAkB,EAAE,oBAAoB;IACxC,kBAAkB,EAAE,oBAAoB;IACxC,mBAAmB,EAAE,qBAAqB;IAC1C,4BAA4B,EAAE,8BAA8B;IAC5D,qBAAqB,EAAE,uBAAuB;IAE9C,aAAa;IACb,kBAAkB,EAAE,oBAAoB;IACxC,eAAe,EAAE,iBAAiB;IAClC,eAAe,EAAE,iBAAiB;IAClC,mBAAmB,EAAE,qBAAqB;IAC1C,sBAAsB,EAAE,wBAAwB;IAChD,gBAAgB,EAAE,kBAAkB;IAEpC,wBAAwB;IACxB,qBAAqB,EAAE,uBAAuB;IAC9C,sBAAsB,EAAE,wBAAwB;IAChD,6BAA6B,EAAE,+BAA+B;IAC9D,oBAAoB,EAAE,sBAAsB;IAC5C,sBAAsB,EAAE,wBAAwB;IAEhD,qBAAqB;IACrB,qBAAqB,EAAE,uBAAuB;IAE9C,iBAAiB;IACjB,kBAAkB,EAAE,oBAAoB;IACxC,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAKX;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAE7B;IAEA;IAHlB,YACkB,IAAgC,EAChD,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAA4B;QAEhC,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAAgC,EAChC,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC"}

package/dist/proof/generator.d.ts

@@ -57,6 +57,12 @@ export interface ProofAgentIdentity {
     privateKey: string | CryptoKey;
     publicKey: string;
 }
+/**
+ * A request as a proof binds it: `method` and `params`. 1.x producers pass a
+ * tool call as `{ method: <tool name>, params: <arguments> }`; verifiers also
+ * take the `tools/call` request as sent (SPEC §7.3, see
+ * {@link acceptedRequestHashes}).
+ */
 export interface ToolRequest {
     method: string;
     params?: unknown;
@@ -118,6 +124,40 @@ export declare function computeCanonicalHashes(request: ToolRequest, response: T
     requestHash: string;
     responseHash?: string;
 }>;
+/**
+ * Every `requestHash` a verifier accepts for `request`: the hash of `request`
+ * as given (the {@link computeCanonicalHashes} rule producers sign with), then
+ * the hashes of the same call's other shapes, so that a caller holding either
+ * the legacy `{ method: <tool name>, params: <arguments> }` shape or the
+ * `tools/call` request as sent can verify a proof minted over either (SPEC
+ * §7.3). Each candidate describes the same tool name and business arguments,
+ * so none admits a proof over a different call.
+ */
+export declare function acceptedRequestHashes(request: ToolRequest, hash: (bytes: Uint8Array) => Promise<string>): Promise<string[]>;
+/** How received content fails to match the hashes a proof binds. */
+export type ContentBindingMismatch = 'request' | 'response' | 'response-missing' | 'response-unexpected';
+/**
+ * Compare the request (and response) a verifier actually received with the
+ * hashes a proof binds; `undefined` means they match. Shared by `ProofVerifier`
+ * and `ProofGenerator.verifyProof` so both apply one fail-closed rule.
+ *
+ * The request matches when `meta.requestHash` is any of
+ * {@link acceptedRequestHashes}; the hash of the request as given is tried
+ * first, and the other shapes only when it differs.
+ *
+ * `meta.responseHash` is the ONLY thing that binds the response body —
+ * including a needs_authorization challenge's `authorizationUrl` — so it is
+ * checked whenever the proof carries one. Gating the comparison on a response
+ * being supplied would pass a caller who supplies only the request while a
+ * swapped URL went unverified (the `requestHash` is identical for a genuine and
+ * a MITM'd challenge). So: a proof that binds a response must be given one, and
+ * a proof that binds none must not be. The response profile comes from the
+ * proof's own signature-covered `prf` claim, never from configuration.
+ */
+export declare function findContentBindingMismatch(meta: Pick<ProofMeta, 'requestHash' | 'responseHash' | 'prf'>, expected: {
+    request: ToolRequest;
+    response?: ToolResponse;
+}, hash: (bytes: Uint8Array) => Promise<string>): Promise<ContentBindingMismatch | undefined>;
 /**
  * Build the exact JWS payload object a proof signs over, from its `ProofMeta`.
  * SINGLE source of truth for the payload SHAPE — the signer
@@ -161,6 +201,17 @@ export declare class ProofGenerator {
     private resolveSigningKey;
     private generateJWS;
     private formatPrivateKeyAsPEM;
+    /**
+     * Check that a proof was signed by this generator's identity over `request`
+     * and, when the proof binds one, `response`. Every `meta` member is checked
+     * through the signature: the JWS is verified against the payload rebuilt from
+     * `meta`, and a payload it embeds must be that one. A proof that binds a
+     * response fails without one, and a proof that binds none fails with one.
+     * `request` may be given in either shape (see {@link acceptedRequestHashes}).
+     *
+     * This checks the artifact only, with no freshness or replay state; verify
+     * proofs received over the wire with `ProofVerifier.verifyProof`.
+     */
     verifyProof(proof: DetachedProof, request: ToolRequest, response?: ToolResponse): Promise<boolean>;
     private base64PublicKeyToJWK;
 }
@@ -169,4 +220,3 @@ export declare function extractCanonicalData(request: ToolRequest, response: Too
     request: unknown;
     response: unknown;
 };
-//# sourceMappingURL=generator.d.ts.map

package/dist/proof/generator.js

@@ -9,8 +9,9 @@
  */
 import { CompactSign, importPKCS8 } from 'jose';
 import { canonicalizeJson, canonicalizeJsonBytes } from '../utils/canonical-json.js';
-import { RESPONSE_PROOF_PROFILE_BODY, RESPONSE_PROOF_PROFILE_ENVELOPE, } from '../types/protocol.js';
+import { RESPONSE_PROOF_PROFILE_BODY, RESPONSE_PROOF_PROFILE_ENVELOPE, validateDetachedProof, } from '../types/protocol.js';
 import { CryptoService } from '../utils/crypto-service.js';
+import { alternateRequestShapes } from './covered-request.js';
 import { base64ToBytes, base64urlEncodeFromBytes, bytesToBase64 } from '../utils/base64.js';
 import { ED25519_PKCS8_DER_HEADER, ED25519_KEY_SIZE } from '../utils/ed25519-constants.js';
 /**
@@ -108,6 +109,54 @@ function canonicalResponseBody(data, profile) {
     }
     return envelope;
 }
+/**
+ * Every `requestHash` a verifier accepts for `request`: the hash of `request`
+ * as given (the {@link computeCanonicalHashes} rule producers sign with), then
+ * the hashes of the same call's other shapes, so that a caller holding either
+ * the legacy `{ method: <tool name>, params: <arguments> }` shape or the
+ * `tools/call` request as sent can verify a proof minted over either (SPEC
+ * §7.3). Each candidate describes the same tool name and business arguments,
+ * so none admits a proof over a different call.
+ */
+export async function acceptedRequestHashes(request, hash) {
+    const hashes = new Set();
+    for (const shape of [request, ...alternateRequestShapes(request)]) {
+        hashes.add((await computeCanonicalHashes(shape, undefined, hash)).requestHash);
+    }
+    return [...hashes];
+}
+/**
+ * Compare the request (and response) a verifier actually received with the
+ * hashes a proof binds; `undefined` means they match. Shared by `ProofVerifier`
+ * and `ProofGenerator.verifyProof` so both apply one fail-closed rule.
+ *
+ * The request matches when `meta.requestHash` is any of
+ * {@link acceptedRequestHashes}; the hash of the request as given is tried
+ * first, and the other shapes only when it differs.
+ *
+ * `meta.responseHash` is the ONLY thing that binds the response body —
+ * including a needs_authorization challenge's `authorizationUrl` — so it is
+ * checked whenever the proof carries one. Gating the comparison on a response
+ * being supplied would pass a caller who supplies only the request while a
+ * swapped URL went unverified (the `requestHash` is identical for a genuine and
+ * a MITM'd challenge). So: a proof that binds a response must be given one, and
+ * a proof that binds none must not be. The response profile comes from the
+ * proof's own signature-covered `prf` claim, never from configuration.
+ */
+export async function findContentBindingMismatch(meta, expected, hash) {
+    const { requestHash, responseHash } = await computeCanonicalHashes(expected.request, expected.response, hash, meta.prf ?? RESPONSE_PROOF_PROFILE_BODY);
+    if (meta.requestHash !== requestHash &&
+        !(await acceptedRequestHashes(expected.request, hash)).includes(meta.requestHash)) {
+        return 'request';
+    }
+    const bindsResponse = meta.responseHash !== undefined;
+    if (bindsResponse !== (expected.response !== undefined)) {
+        return bindsResponse ? 'response-missing' : 'response-unexpected';
+    }
+    if (bindsResponse && meta.responseHash !== responseHash)
+        return 'response';
+    return undefined;
+}
 /**
  * Build the exact JWS payload object a proof signs over, from its `ProofMeta`.
  * SINGLE source of truth for the payload SHAPE — the signer
@@ -252,24 +301,33 @@ export class ProofGenerator {
             formattedKey +
             '\n-----END PRIVATE KEY-----');
     }
+    /**
+     * Check that a proof was signed by this generator's identity over `request`
+     * and, when the proof binds one, `response`. Every `meta` member is checked
+     * through the signature: the JWS is verified against the payload rebuilt from
+     * `meta`, and a payload it embeds must be that one. A proof that binds a
+     * response fails without one, and a proof that binds none fails with one.
+     * `request` may be given in either shape (see {@link acceptedRequestHashes}).
+     *
+     * This checks the artifact only, with no freshness or replay state; verify
+     * proofs received over the wire with `ProofVerifier.verifyProof`.
+     */
     async verifyProof(proof, request, response) {
         try {
-            // The profile is always derived from the proof's own signature-covered
-            // `prf` claim — never from generator configuration — so an envelope-profile proof is
-            // checked with envelope hashing and a body-profile proof with body hashing.
-            const expectedHashes = await this.generateCanonicalHashes(request, response, proof.meta.prf ?? RESPONSE_PROOF_PROFILE_BODY);
-            if (proof.meta.requestHash !== expectedHashes.requestHash) {
+            if (!validateDetachedProof(proof).success)
+                return false;
+            const { meta } = proof;
+            // iss/sub cover meta.did; the protected header's kid is pinned below.
+            if (meta.did !== this.identity.did || meta.kid !== this.identity.kid) {
                 return false;
             }
-            if (proof.meta.responseHash !== undefined) {
-                if (expectedHashes.responseHash === undefined ||
-                    proof.meta.responseHash !== expectedHashes.responseHash) {
-                    return false;
-                }
-            }
+            const mismatch = await findContentBindingMismatch(meta, { request, ...(response !== undefined ? { response } : {}) }, (bytes) => this.cryptoProvider.hash(bytes));
+            if (mismatch !== undefined)
+                return false;
             const publicKeyJwk = this.base64PublicKeyToJWK(this.identity.publicKey);
             const cryptoService = new CryptoService(this.cryptoProvider);
-            return cryptoService.verifyJWS(proof.jws, publicKeyJwk, {
+            return await cryptoService.verifyJWS(proof.jws, publicKeyJwk, {
+                detachedPayload: canonicalizeJson(buildProofJwsPayload(meta)),
                 expectedKid: this.identity.kid,
                 alg: 'EdDSA',
             });

package/dist/proof/generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../src/proof/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EACL,2BAA2B,EAC3B,+BAA+B,GAKhC,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,aAAa,EAAmB,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAE3F;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,kBAAkB,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAiD7C,4EAA4E;AAC5E,6EAA6E;AAC7E,OAAO,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,CAAC;AAGxE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAoB,EACpB,QAAkC,EAClC,IAA4C,EAC5C,UAAgC,2BAA2B;IAE3D,MAAM,gBAAgB,GAAG;QACvB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAC5B,qBAAqB,CAAC,gBAAgB,CAAC,CACxC,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,WAAW,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAC7B,qBAAqB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CACrE,CAAC;IACF,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,IAAa,EACb,OAA6B;IAE7B,IACE,OAAO,KAAK,+BAA+B;QAC3C,IAAI,KAAK,IAAI;QACb,OAAO,IAAI,KAAK,QAAQ;QACxB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EACnB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,GAAG,KAAK,OAAO;YAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC7C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAe;IAClD,OAAO;QACL,iCAAiC;QACjC,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QAEb,sBAAsB;QACtB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mEAAmE;QACnE,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3E,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS;QAEzB,4CAA4C;QAC5C,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3C,wFAAwF;QACxF,oEAAoE;QACpE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,cAAc;IACjB,QAAQ,CAAqB;IAC7B,cAAc,CAAiB;IAEvC,YAAY,QAA4B,EAAE,cAA8B;QACtE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,aAAa,CACjB,OAAoB,EACpB,QAAkC,EAClC,OAAuB,EACvB,UAAwB,EAAE;QAE1B,2EAA2E;QAC3E,4EAA4E;QAC5E,8GAA8G;QAC9G,MAAM,EAAE,OAAO,GAAG,2BAA2B,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,CAAC;QAC1E,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,OAAO,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,wBAAwB,CACzC,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAC1C,CAAC;QAEF,MAAM,IAAI,GAAc;YACtB,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;YACtB,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;YACtB,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACjC,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;gBACvC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,KAAK,+BAA+B;gBAC7C,CAAC,CAAC,EAAE,GAAG,EAAE,+BAA+B,EAAE;gBAC1C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,WAAW;SACf,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAEzC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,OAAoB;QACpC,OAAO,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;IACnE,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,OAAoB,EACpB,QAAuB,EACvB,OAA8B;QAE9B,OAAO,sBAAsB,CAC3B,OAAO,EACP,QAAQ,EACR,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAC1C,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,iBAAiB;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACrC,OAAO,OAAO,GAAG,KAAK,QAAQ;YAC5B,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;YACvD,CAAC,CAAC,GAAG,CAAC;IACV,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAAe;QACvC,IAAI,CAAC;YACH,iEAAiE;YACjE,yEAAyE;YACzE,uDAAuD;YACvD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAElD,0EAA0E;YAC1E,iEAAiE;YACjE,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAE3C,6EAA6E;YAC7E,gFAAgF;YAChF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAEhE,MAAM,GAAG,GAAG,MAAM,IAAI,WAAW,CAAC,YAAY,CAAC;iBAC5C,kBAAkB,CAAC;gBAClB,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;aACvB,CAAC;iBACD,IAAI,CAAC,UAAU,CAAC,CAAC;YAEpB,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,qBAAqB,CAAC,gBAAwB;QACpD,MAAM,OAAO,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAEhD,2BAA2B;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAErD,0CAA0C;QAC1C,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,wBAAwB,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAErD,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;QAE1E,OAAO,CACL,+BAA+B;YAC/B,YAAY;YACZ,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CACf,KAAoB,EACpB,OAAoB,EACpB,QAAuB;QAEvB,IAAI,CAAC;YACH,uEAAuE;YACvE,qFAAqF;YACrF,4EAA4E;YAC5E,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,uBAAuB,CACvD,OAAO,EACP,QAAQ,EACR,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,2BAA2B,CAC9C,CAAC;YAEF,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,cAAc,CAAC,WAAW,EAAE,CAAC;gBAC1D,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC1C,IACE,cAAc,CAAC,YAAY,KAAK,SAAS;oBACzC,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,cAAc,CAAC,YAAY,EACvD,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAE7D,OAAO,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE;gBACtD,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;gBAC9B,GAAG,EAAE,OAAO;aACb,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,eAAuB;QAClD,MAAM,cAAc,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;QAEtD,IAAI,cAAc,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,sCAAsC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,OAAO;YACL,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,SAAS;YACd,CAAC,EAAE,wBAAwB,CAAC,cAAc,CAAC;YAC3C,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;SACvB,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAoB,EACpB,IAAa,EACb,QAA4B,EAC5B,OAAuB,EACvB,cAA8B,EAC9B,UAAwB,EAAE;IAE1B,MAAM,QAAQ,GAAiB,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACtF,QAAQ,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC;IAC1B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAoB,EACpB,QAAsB;IAKtB,OAAO;QACL,OAAO,EAAE;YACP,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,QAAQ,EAAE,QAAQ,CAAC,IAAI;KACxB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../src/proof/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EACL,2BAA2B,EAC3B,+BAA+B,EAC/B,qBAAqB,GAKtB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,aAAa,EAAmB,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAE3F;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,kBAAkB,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAuD7C,4EAA4E;AAC5E,6EAA6E;AAC7E,OAAO,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,CAAC;AAGxE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAoB,EACpB,QAAkC,EAClC,IAA4C,EAC5C,UAAgC,2BAA2B;IAE3D,MAAM,gBAAgB,GAAG;QACvB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAC5B,qBAAqB,CAAC,gBAAgB,CAAC,CACxC,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,WAAW,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAC7B,qBAAqB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CACrE,CAAC;IACF,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,IAAa,EACb,OAA6B;IAE7B,IACE,OAAO,KAAK,+BAA+B;QAC3C,IAAI,KAAK,IAAI;QACb,OAAO,IAAI,KAAK,QAAQ;QACxB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EACnB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,GAAG,KAAK,OAAO;YAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC7C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAoB,EACpB,IAA4C;IAE5C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC;AASD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAA6D,EAC7D,QAA2D,EAC3D,IAA4C;IAE5C,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,sBAAsB,CAChE,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,QAAQ,EACjB,IAAI,EACJ,IAAI,CAAC,GAAG,IAAI,2BAA2B,CACxC,CAAC;IACF,IACE,IAAI,CAAC,WAAW,KAAK,WAAW;QAChC,CAAC,CAAC,MAAM,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EACjF,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC;IACtD,IAAI,aAAa,KAAK,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,EAAE,CAAC;QACxD,OAAO,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACpE,CAAC;IACD,IAAI,aAAa,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY;QAAE,OAAO,UAAU,CAAC;IAC3E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAe;IAClD,OAAO;QACL,iCAAiC;QACjC,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QAEb,sBAAsB;QACtB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mEAAmE;QACnE,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3E,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS;QAEzB,4CAA4C;QAC5C,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3C,wFAAwF;QACxF,oEAAoE;QACpE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,cAAc;IACjB,QAAQ,CAAqB;IAC7B,cAAc,CAAiB;IAEvC,YAAY,QAA4B,EAAE,cAA8B;QACtE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,aAAa,CACjB,OAAoB,EACpB,QAAkC,EAClC,OAAuB,EACvB,UAAwB,EAAE;QAE1B,2EAA2E;QAC3E,4EAA4E;QAC5E,8GAA8G;QAC9G,MAAM,EAAE,OAAO,GAAG,2BAA2B,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,CAAC;QAC1E,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,OAAO,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,wBAAwB,CACzC,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAC1C,CAAC;QAEF,MAAM,IAAI,GAAc;YACtB,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;YACtB,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;YACtB,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACjC,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;gBACvC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,KAAK,+BAA+B;gBAC7C,CAAC,CAAC,EAAE,GAAG,EAAE,+BAA+B,EAAE;gBAC1C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,WAAW;SACf,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAEzC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,OAAoB;QACpC,OAAO,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;IACnE,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,OAAoB,EACpB,QAAuB,EACvB,OAA8B;QAE9B,OAAO,sBAAsB,CAC3B,OAAO,EACP,QAAQ,EACR,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAC1C,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,iBAAiB;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACrC,OAAO,OAAO,GAAG,KAAK,QAAQ;YAC5B,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;YACvD,CAAC,CAAC,GAAG,CAAC;IACV,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAAe;QACvC,IAAI,CAAC;YACH,iEAAiE;YACjE,yEAAyE;YACzE,uDAAuD;YACvD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAElD,0EAA0E;YAC1E,iEAAiE;YACjE,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAE3C,6EAA6E;YAC7E,gFAAgF;YAChF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAEhE,MAAM,GAAG,GAAG,MAAM,IAAI,WAAW,CAAC,YAAY,CAAC;iBAC5C,kBAAkB,CAAC;gBAClB,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;aACvB,CAAC;iBACD,IAAI,CAAC,UAAU,CAAC,CAAC;YAEpB,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,qBAAqB,CAAC,gBAAwB;QACpD,MAAM,OAAO,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAEhD,2BAA2B;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAErD,0CAA0C;QAC1C,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,wBAAwB,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAErD,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;QAE1E,OAAO,CACL,+BAA+B;YAC/B,YAAY;YACZ,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,WAAW,CACf,KAAoB,EACpB,OAAoB,EACpB,QAAuB;QAEvB,IAAI,CAAC;YACH,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC;YACxD,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;YACvB,sEAAsE;YACtE,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACrE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAC/C,IAAI,EACJ,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAC5D,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAC3C,CAAC;YACF,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YAEzC,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAE7D,OAAO,MAAM,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE;gBAC5D,eAAe,EAAE,gBAAgB,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;gBAC7D,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;gBAC9B,GAAG,EAAE,OAAO;aACb,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,eAAuB;QAClD,MAAM,cAAc,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;QAEtD,IAAI,cAAc,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,sCAAsC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,OAAO;YACL,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,SAAS;YACd,CAAC,EAAE,wBAAwB,CAAC,cAAc,CAAC;YAC3C,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;SACvB,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAoB,EACpB,IAAa,EACb,QAA4B,EAC5B,OAAuB,EACvB,cAA8B,EAC9B,UAAwB,EAAE;IAE1B,MAAM,QAAQ,GAAiB,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACtF,QAAQ,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC;IAC1B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAoB,EACpB,QAAsB;IAKtB,OAAO;QACL,OAAO,EAAE;YACP,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,QAAQ,EAAE,QAAQ,CAAC,IAAI;KACxB,CAAC;AACJ,CAAC"}

package/dist/proof/index.d.ts

@@ -1,4 +1,3 @@
 export { ProofGenerator, createProofResponse, extractCanonicalData, computeCanonicalHashes, buildProofJwsPayload, KYA_OS_PROOF_META_KEY, LEGACY_NAMESPACED_PROOF_META_KEY, LEGACY_PROOF_META_KEY, RESPONSE_PROOF_PROFILE_BODY, RESPONSE_PROOF_PROFILE_ENVELOPE, type ProofAgentIdentity, type ToolRequest, type ToolResponse, type ProofOptions, type ResponseProofProfile, } from './generator.js';
-export { ProofVerifier, validateMetaStructure, extractProofFromMeta, DEFAULT_CLOCK_SKEW_SECONDS, MIN_CLOCK_SKEW_SECONDS, MAX_CLOCK_SKEW_SECONDS, type ProofVerifierConfig, type ProofVerificationResult, } from './verifier.js';
+export { ProofVerifier, validateMetaStructure, extractProofFromMeta, DEFAULT_CLOCK_SKEW_SECONDS, MIN_CLOCK_SKEW_SECONDS, MAX_CLOCK_SKEW_SECONDS, type ProofVerifierConfig, type ProofVerificationOptions, type ProofVerificationResult, } from './verifier.js';
 export { ProofVerificationError, PROOF_VERIFICATION_ERROR_CODES, createProofVerificationError, type ProofVerificationErrorCode, } from './errors.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/proof/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/proof/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,gCAAgC,EAChC,qBAAqB,EACrB,2BAA2B,EAC3B,+BAA+B,GAMhC,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,GAGvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/proof/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,gCAAgC,EAChC,qBAAqB,EACrB,2BAA2B,EAC3B,+BAA+B,GAMhC,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,GAIvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,aAAa,CAAC"}

package/dist/proof/verifier.d.ts

@@ -19,13 +19,29 @@ export interface ProofVerificationResult {
     errorCode?: ProofVerificationErrorCode;
     details?: Record<string, unknown>;
 }
+/** Who a verified proof must come from and be addressed to. */
+export interface ProofVerificationOptions {
+    /** `meta.did` must equal this: the signer the caller expects (e.g. the server it called). */
+    expectedDid?: string;
+    /** `meta.audience` must equal this, or be one of the array (DID rotation, multi-DID servers). */
+    expectedAudience?: string | string[];
+}
 export interface ProofVerifierConfig {
     cryptoProvider: CryptoProvider;
     clockProvider: ClockProvider;
     nonceCacheProvider: NonceCacheProvider;
     fetchProvider: FetchProvider;
     timestampSkewSeconds?: number;
+    /**
+     * Minimum retention in seconds; raised to cover the proof's accepted lifetime
+     * and supported skew updates. 0 keeps each nonce for that window only.
+     */
     nonceTtlSeconds?: number;
+    /**
+     * Refuse nonce caches without an atomic `consume()` instead of falling back
+     * to `has()` then `add()`. The constructor throws for such a cache.
+     */
+    requireAtomicNonce?: boolean;
 }
 /** Default timestamp skew for proof verification (seconds) */
 export declare const DEFAULT_CLOCK_SKEW_SECONDS = 120;
@@ -40,6 +56,7 @@ export declare class ProofVerifier {
     private fetch;
     private timestampSkewSeconds;
     private nonceTtlSeconds;
+    private requireAtomicNonce;
     private cryptoProvider;
     constructor(config: ProofVerifierConfig);
     /**
@@ -79,13 +96,20 @@ export declare class ProofVerifier {
      *   `content` array); for an envelope-profile proof (`prf: "org.kya-os/response-proof.envelope"`)
      *   pass the ENTIRE received result object — the verifier removes the
      *   top-level `_meta` member itself, so passing the result as received (proof
-     *   attachment included) is correct.
+     *   attachment included) is correct. Pass the `request` either as the
+     *   `tools/call` request you sent (`{method: "tools/call", params: {name,
+     *   arguments}}`) or in the legacy `{method: <tool name>, params: <arguments>}`
+     *   shape: a `requestHash` over either shape of that call is accepted (SPEC
+     *   §7.3; 1.x producers sign the legacy shape).
+     * @param options - Optional signer binding: the `did` the proof must come
+     *   from and the `audience` it must be addressed to. Independently of these,
+     *   a `kid` naming a key of a DID other than `meta.did` always fails.
      * @returns Verification result
      */
     verifyProof(proof: DetachedProof, publicKeyJwk: Ed25519JWK, expected?: {
         request: ToolRequest;
         response?: ToolResponse;
-    }): Promise<ProofVerificationResult>;
+    }, options?: ProofVerificationOptions): Promise<ProofVerificationResult>;
     /**
      * Verify a retained proof as historical evidence.
      *
@@ -99,7 +123,16 @@ export declare class ProofVerifier {
         response?: ToolResponse;
     }): Promise<ProofVerificationResult>;
     /**
-     * Verify proof with detached payload (for CLI/verifier compatibility)
+     * Verify proof with detached payload (for CLI/verifier compatibility).
+     *
+     * The timestamp and replay checks read `proof.meta`, so the payload the
+     * signature is checked over must be the one rebuilt from that meta: a
+     * supplied payload that differs from it byte for byte is rejected. Otherwise
+     * an accepted proof could be replayed with a fresh `meta.nonce` and the old
+     * payload.
+     *
+     * @deprecated Use {@link verifyProof}. It rebuilds the payload from
+     *   `proof.meta` itself, so supplying the payload adds nothing.
      * @param proof - The proof to verify
      * @param canonicalPayload - Canonical JSON payload (for detached JWS) as string or Uint8Array
      * @param publicKeyJwk - Ed25519 public key in JWK format
@@ -107,10 +140,19 @@ export declare class ProofVerifier {
      */
     verifyProofDetached(proof: DetachedProof, canonicalPayload: string | Uint8Array, publicKeyJwk: Ed25519JWK): Promise<ProofVerificationResult>;
     /**
-     * Shared verification pipeline for proof verification
+     * Shared verification pipeline for a structurally valid proof.
      * @private
      */
     private runVerificationPipeline;
+    /**
+     * Bind the signing key to the principal. `kid` names the signing key; when
+     * it is an absolute DID URL its DID part must be `meta.did`, or a proof could
+     * claim a victim's DID while being signed by a key another DID publishes. A
+     * relative `kid` is resolved against `meta.did`. Then apply the caller's
+     * expected signer and audience, if given.
+     * @private
+     */
+    private validateSigner;
     /**
      * Recompute the canonical hashes of the request/response the verifier actually
      * received (via the same hashing the signer used) and compare to the proof's
@@ -130,10 +172,11 @@ export declare class ProofVerifier {
      */
     private validateProofStructure;
     /**
-     * Validate nonce replay protection
+     * Admit the nonce once every other proof check has passed: atomically through
+     * the cache's consume(), or through the has()/add() fallback without it.
      * @private
      */
-    private validateNonce;
+    private consumeNonce;
     /**
      * Validate timestamp skew
      * @private
@@ -144,11 +187,6 @@ export declare class ProofVerifier {
      * @private
      */
     private verifySignature;
-    /**
-     * Add nonce to cache to prevent replay (scoped to agent DID)
-     * @private
-     */
-    private addNonceToCache;
     /**
      * Fetch public key from DID document
      * @param did - DID to resolve
@@ -168,6 +206,7 @@ export declare class ProofVerifier {
      * @returns Canonical JSON string matching the original JWS payload structure
      */
     buildCanonicalPayload(meta: DetachedProof["meta"]): string;
+    private encodeCanonicalPayload;
 }
 /**
  * Whether `key` is an MCP-reserved / standard `_meta` key (SEP-414) that KYA-OS
@@ -223,4 +262,3 @@ export declare function extractProofFromMeta(meta: Record<string, unknown>, poli
     reason: string;
     errorCode: string;
 };
-//# sourceMappingURL=verifier.d.ts.map