@kya-os/mcp 1.16.2 → 1.18.0

package/dist/providers/memory.js

@@ -5,6 +5,10 @@
  */
 import { StorageProvider, NonceCacheProvider, IdentityProvider, } from './base.js';
 import { generateDidKeyFromBase64, didKeyFragment } from '../utils/did-helpers.js';
+/** Writes between amortised expired-entry sweeps (bounds memory without a timer). */
+const SWEEP_EVERY = 1000;
+/** Longest a cache goes between sweeps while written to, so low traffic also frees memory. */
+const SWEEP_INTERVAL_MS = 60_000;
 export class MemoryStorageProvider extends StorageProvider {
     store = new Map();
     async get(key) {
@@ -27,28 +31,70 @@ export class MemoryStorageProvider extends StorageProvider {
         return keys;
     }
 }
+/**
+ * In-memory replay store, and the default one for `withKyaOs` and
+ * `SessionManager`. Single process only. Expired entries are swept as the
+ * cache is written to (every {@link SWEEP_EVERY} writes, or after
+ * {@link SWEEP_INTERVAL_MS}), so a long-running server stays bounded by its
+ * live nonces without anyone scheduling {@link cleanup}.
+ */
 export class MemoryNonceCacheProvider extends NonceCacheProvider {
     nonces = new Map();
+    writesSinceSweep = 0;
+    lastSweepAt = Date.now();
+    /** Atomic within this cache instance: no await separates the read and write. */
+    async consume(nonce, ttlSeconds, agentDid) {
+        if (!Number.isFinite(ttlSeconds) || ttlSeconds <= 0) {
+            throw new RangeError('Nonce TTL must be a positive finite number');
+        }
+        const key = this.key(nonce, agentDid);
+        const now = Date.now();
+        const expiry = this.nonces.get(key);
+        if (expiry !== undefined && expiry > now)
+            return false;
+        this.nonces.set(key, now + ttlSeconds * 1000);
+        this.sweepIfDue(now);
+        return true;
+    }
+    key(nonce, agentDid) {
+        return JSON.stringify([agentDid ?? null, nonce]);
+    }
     async has(nonce, agentDid) {
-        const key = agentDid ? `nonce:${agentDid}:${nonce}` : `nonce:${nonce}`;
+        const key = this.key(nonce, agentDid);
         const expiry = this.nonces.get(key);
         if (!expiry)
             return false;
-        if (Date.now() > expiry) {
+        if (Date.now() >= expiry) {
             this.nonces.delete(key);
             return false;
         }
         return true;
     }
     async add(nonce, ttlSeconds, agentDid) {
-        const key = agentDid ? `nonce:${agentDid}:${nonce}` : `nonce:${nonce}`;
-        const expiresAt = Date.now() + ttlSeconds * 1000;
-        this.nonces.set(key, expiresAt);
+        const key = this.key(nonce, agentDid);
+        const now = Date.now();
+        this.nonces.set(key, now + ttlSeconds * 1000);
+        this.sweepIfDue(now);
     }
     async cleanup() {
-        const now = Date.now();
+        this.evictExpired(Date.now());
+    }
+    /**
+     * Amortised eviction: every admitted nonce is a write, so sweeping on writes
+     * keeps the map bounded by live entries. The count trigger bounds a busy
+     * cache; the interval trigger releases a quiet one's dead entries too.
+     */
+    sweepIfDue(now) {
+        if (++this.writesSinceSweep < SWEEP_EVERY && now - this.lastSweepAt < SWEEP_INTERVAL_MS) {
+            return;
+        }
+        this.writesSinceSweep = 0;
+        this.lastSweepAt = now;
+        this.evictExpired(now);
+    }
+    evictExpired(now) {
         for (const [nonce, expiry] of this.nonces) {
-            if (now > expiry) {
+            if (now >= expiry) {
                 this.nonces.delete(nonce);
             }
         }

package/dist/providers/memory.js.map

@@ -1 +1 @@
-{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/providers/memory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAEL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEnF,MAAM,OAAO,qBAAsB,SAAQ,eAAe;IAChD,KAAK,GAAwB,IAAI,GAAG,EAAE,CAAC;IAE/C,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAe;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,kBAAkB;IACtD,MAAM,GAAwB,IAAI,GAAG,EAAE,CAAC;IAEhD,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,QAAiB;QACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAE1B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,UAAkB,EAAE,QAAiB;QAC5D,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1C,IAAI,GAAG,GAAG,MAAM,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,gBAAgB;IAClD,QAAQ,CAAiB;IACzB,cAAc,CAA6B;IAEnD,YAAY,cAA+B;QACzC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAuB;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAE7D,OAAO;YACL,GAAG;YACH,GAAG,EAAE,GAAG,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;YACpC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI,EAAE,aAAa;SACpB,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAAC,SAAiB;QAChD,OAAO,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;CACF"}
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/providers/memory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAEL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEnF,qFAAqF;AACrF,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,8FAA8F;AAC9F,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,MAAM,OAAO,qBAAsB,SAAQ,eAAe;IAChD,KAAK,GAAwB,IAAI,GAAG,EAAE,CAAC;IAE/C,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAe;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,kBAAkB;IACtD,MAAM,GAAwB,IAAI,GAAG,EAAE,CAAC;IACxC,gBAAgB,GAAG,CAAC,CAAC;IACrB,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEjC,gFAAgF;IAChF,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,UAAkB,EAAE,QAAiB;QAChE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,UAAU,CAAC,4CAA4C,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,GAAG,CAAC,KAAa,EAAE,QAAiB;QAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,IAAI,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,QAAiB;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAE1B,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,UAAkB,EAAE,QAAiB;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACK,UAAU,CAAC,GAAW;QAC5B,IAAI,EAAE,IAAI,CAAC,gBAAgB,GAAG,WAAW,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,GAAG,iBAAiB,EAAE,CAAC;YACxF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;QACvB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1C,IAAI,GAAG,IAAI,MAAM,EAAE,CAAC;gBAClB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,gBAAgB;IAClD,QAAQ,CAAiB;IACzB,cAAc,CAA6B;IAEnD,YAAY,cAA+B;QACzC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAuB;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAE7D,OAAO;YACL,GAAG;YACH,GAAG,EAAE,GAAG,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;YACpC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI,EAAE,aAAa;SACpB,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAAC,SAAiB;QAChD,OAAO,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;CACF"}

package/dist/providers/node-crypto.d.ts

@@ -4,6 +4,10 @@
  * Ed25519 crypto backed by Node.js built-in `node:crypto`.
  * Use this on any Node.js 20+ server.
  *
+ * `node:crypto` is loaded on first use, never at module load: the
+ * `@kya-os/mcp/providers` entry also serves `WebCryptoProvider` to browsers and
+ * Workers, and a top-level import of a node built-in would break their bundles.
+ *
  * @example
  * ```typescript
  * import { NodeCryptoProvider } from '@kya-os/mcp/providers';
@@ -23,4 +27,3 @@ export declare class NodeCryptoProvider extends CryptoProvider {
     hash(data: Uint8Array): Promise<string>;
     randomBytes(length: number): Promise<Uint8Array>;
 }
-//# sourceMappingURL=node-crypto.d.ts.map

package/dist/providers/node-crypto.js

@@ -4,6 +4,10 @@
  * Ed25519 crypto backed by Node.js built-in `node:crypto`.
  * Use this on any Node.js 20+ server.
  *
+ * `node:crypto` is loaded on first use, never at module load: the
+ * `@kya-os/mcp/providers` entry also serves `WebCryptoProvider` to browsers and
+ * Workers, and a top-level import of a node built-in would break their bundles.
+ *
  * @example
  * ```typescript
  * import { NodeCryptoProvider } from '@kya-os/mcp/providers';
@@ -12,31 +16,47 @@
  * await withKyaOs(server, { crypto: new NodeCryptoProvider() });
  * ```
  */
-import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify, randomBytes, } from "node:crypto";
 import { CryptoProvider } from "./base.js";
-/** PKCS8 DER header for Ed25519 private keys (16 bytes) */
-const ED25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+import { ED25519_PKCS8_DER_HEADER } from "../utils/ed25519-constants.js";
+import { decodeEd25519PublicKey } from "../utils/ed25519-public-key.js";
 /** SPKI DER header for Ed25519 public keys (12 bytes) */
-const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+const ED25519_SPKI_PREFIX = Uint8Array.from([
+    0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,
+]);
+let nodeCryptoPromise;
+/**
+ * Load (and cache) `node:crypto`. Where it is absent, fail with a pointer to
+ * the provider that works there rather than a module-resolution error.
+ */
+function loadNodeCrypto() {
+    return (nodeCryptoPromise ??= import("node:crypto").catch((cause) => {
+        throw new Error("NodeCryptoProvider: node:crypto is unavailable in this runtime; use WebCryptoProvider", { cause });
+    }));
+}
 export class NodeCryptoProvider extends CryptoProvider {
     async sign(data, privateKeyBase64) {
+        const { createPrivateKey, sign } = await loadNodeCrypto();
         const privateKey = Buffer.from(privateKeyBase64, "base64");
         // Handle both raw 32-byte and full 64-byte Ed25519 keys
         const keyBytes = privateKey.length === 64 ? privateKey.subarray(0, 32) : privateKey;
         const keyObject = createPrivateKey({
-            key: Buffer.concat([ED25519_PKCS8_PREFIX, keyBytes]),
+            key: Buffer.concat([ED25519_PKCS8_DER_HEADER, keyBytes]),
             format: "der",
             type: "pkcs8",
         });
         return new Uint8Array(sign(null, Buffer.from(data), keyObject));
     }
     async verify(data, signature, publicKeyBase64) {
+        const { createPublicKey, verify } = await loadNodeCrypto();
+        // Exactly 32 bytes, decoded strictly: Node's base64 decoder would skip
+        // junk and the SPKI wrap would accept extra bytes after the key.
+        const publicKey = decodeEd25519PublicKey(publicKeyBase64);
+        if (!publicKey) {
+            return false;
+        }
         try {
             const keyObject = createPublicKey({
-                key: Buffer.concat([
-                    ED25519_SPKI_PREFIX,
-                    Buffer.from(publicKeyBase64, "base64"),
-                ]),
+                key: Buffer.concat([ED25519_SPKI_PREFIX, publicKey]),
                 format: "der",
                 type: "spki",
             });
@@ -47,6 +67,7 @@ export class NodeCryptoProvider extends CryptoProvider {
         }
     }
     async generateKeyPair() {
+        const { generateKeyPairSync } = await loadNodeCrypto();
         const { publicKey, privateKey } = generateKeyPairSync("ed25519", {
             publicKeyEncoding: { type: "spki", format: "der" },
             privateKeyEncoding: { type: "pkcs8", format: "der" },
@@ -57,12 +78,14 @@ export class NodeCryptoProvider extends CryptoProvider {
         };
     }
     async hash(data) {
+        const { createHash } = await loadNodeCrypto();
         const hex = createHash("sha256")
             .update(Buffer.from(data))
             .digest("hex");
         return `sha256:${hex}`;
     }
     async randomBytes(length) {
+        const { randomBytes } = await loadNodeCrypto();
         return new Uint8Array(randomBytes(length));
     }
 }

package/dist/providers/node-crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"node-crypto.js","sourceRoot":"","sources":["../../src/providers/node-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,IAAI,EACJ,MAAM,EACN,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C,2DAA2D;AAC3D,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CACtC,kCAAkC,EAClC,KAAK,CACN,CAAC;AAEF,yDAAyD;AACzD,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAE3E,MAAM,OAAO,kBAAmB,SAAQ,cAAc;IACpD,KAAK,CAAC,IAAI,CACR,IAAgB,EAChB,gBAAwB;QAExB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAE3D,wDAAwD;QACxD,MAAM,QAAQ,GACZ,UAAU,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QAErE,MAAM,SAAS,GAAG,gBAAgB,CAAC;YACjC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;YACpD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QAEH,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAgB,EAChB,SAAqB,EACrB,eAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,eAAe,CAAC;gBAChC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;oBACjB,mBAAmB;oBACnB,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC;iBACvC,CAAC;gBACF,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YAEH,OAAO,MAAM,CACX,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EACjB,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CACvB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QAInB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,EAAE;YAC/D,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;YAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;SACrD,CAAC,CAAC;QAEH,OAAO;YACL,UAAU,EAAG,UAAqB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtE,SAAS,EAAG,SAAoB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACrE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC;aAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aACzB,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,UAAU,GAAG,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;CACF"}
+{"version":3,"file":"node-crypto.js","sourceRoot":"","sources":["../../src/providers/node-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE,yDAAyD;AACzD,MAAM,mBAAmB,GAAG,UAAU,CAAC,IAAI,CAAC;IAC1C,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACvE,CAAC,CAAC;AAGH,IAAI,iBAAkD,CAAC;AAEvD;;;GAGG;AACH,SAAS,cAAc;IACrB,OAAO,CAAC,iBAAiB,KAAK,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC3E,MAAM,IAAI,KAAK,CACb,uFAAuF,EACvF,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,OAAO,kBAAmB,SAAQ,cAAc;IACpD,KAAK,CAAC,IAAI,CACR,IAAgB,EAChB,gBAAwB;QAExB,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAE3D,wDAAwD;QACxD,MAAM,QAAQ,GACZ,UAAU,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QAErE,MAAM,SAAS,GAAG,gBAAgB,CAAC;YACjC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAC;YACxD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QAEH,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAgB,EAChB,SAAqB,EACrB,eAAuB;QAEvB,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAC3D,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,SAAS,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;QAC1D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,eAAe,CAAC;gBAChC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;gBACpD,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YAEH,OAAO,MAAM,CACX,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EACjB,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CACvB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QAInB,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QACvD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,EAAE;YAC/D,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;YAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;SACrD,CAAC,CAAC;QAEH,OAAO;YACL,UAAU,EAAG,UAAqB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtE,SAAS,EAAG,SAAoB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACrE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC;aAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aACzB,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,UAAU,GAAG,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAC/C,OAAO,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;CACF"}

package/dist/providers/nonce-admission.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Replay admission shared by detached proofs, handshakes and card proofs.
+ *
+ * A provider's atomic `consume()` decides admission when it exists. Providers
+ * written before `consume()` existed fall back to `has()` then `add()`, which
+ * works for sequential requests but lets concurrent duplicates of one proof
+ * through. The fallback keeps those providers working and warns once per
+ * provider; `requireAtomicNonce` refuses it instead.
+ */
+/** The replay-store surface admission needs; both nonce cache contracts satisfy it. */
+export interface NonceAdmissionStore {
+    consume?(nonce: string, ttlSeconds: number, agentDid?: string): Promise<boolean>;
+    has(nonce: string, agentDid?: string): Promise<boolean>;
+    add(nonce: string, ttlSeconds: number, agentDid?: string): Promise<void>;
+}
+export interface NonceAdmissionOptions {
+    /** Deny rather than fall back when the store has no atomic consume(). */
+    requireAtomicNonce?: boolean;
+}
+/**
+ * Check a store when a verifier is built: accept an atomic store, refuse a
+ * non-atomic one under `requireAtomicNonce`, and otherwise warn once per store
+ * about the has()/add() fallback. Repeat calls stay silent.
+ */
+export declare function checkNonceStore(store: NonceAdmissionStore, options?: NonceAdmissionOptions): void;
+/**
+ * Admit a nonce that has already passed every other check. Returns true only
+ * for the call that admits it. Storage failures, and a missing consume() under
+ * `requireAtomicNonce`, reject so callers deny the request.
+ */
+export declare function admitNonce(store: NonceAdmissionStore, nonce: string, ttlSeconds: number, agentDid?: string, options?: NonceAdmissionOptions): Promise<boolean>;

package/dist/providers/nonce-admission.js

@@ -0,0 +1,47 @@
+/**
+ * Replay admission shared by detached proofs, handshakes and card proofs.
+ *
+ * A provider's atomic `consume()` decides admission when it exists. Providers
+ * written before `consume()` existed fall back to `has()` then `add()`, which
+ * works for sequential requests but lets concurrent duplicates of one proof
+ * through. The fallback keeps those providers working and warns once per
+ * provider; `requireAtomicNonce` refuses it instead.
+ */
+import { logger } from '../logging/index.js';
+const warnedStores = new WeakSet();
+/**
+ * Check a store when a verifier is built: accept an atomic store, refuse a
+ * non-atomic one under `requireAtomicNonce`, and otherwise warn once per store
+ * about the has()/add() fallback. Repeat calls stay silent.
+ */
+export function checkNonceStore(store, options = {}) {
+    if (typeof store.consume === 'function')
+        return;
+    if (options.requireAtomicNonce) {
+        throw new TypeError('requireAtomicNonce is set but the nonce cache has no consume()');
+    }
+    if (warnedStores.has(store))
+        return;
+    warnedStores.add(store);
+    logger.warn('[kya-os] Nonce cache has no atomic consume(); falling back to has() then add(). ' +
+        'Concurrent duplicates of one signed request can both be admitted. ' +
+        'Implement consume() with a conditional insert in the shared store, and set ' +
+        'requireAtomicNonce to refuse this fallback.');
+}
+/**
+ * Admit a nonce that has already passed every other check. Returns true only
+ * for the call that admits it. Storage failures, and a missing consume() under
+ * `requireAtomicNonce`, reject so callers deny the request.
+ */
+export async function admitNonce(store, nonce, ttlSeconds, agentDid, options = {}) {
+    const consume = store.consume;
+    if (typeof consume === 'function') {
+        return (await consume.call(store, nonce, ttlSeconds, agentDid)) === true;
+    }
+    checkNonceStore(store, options);
+    if (await store.has(nonce, agentDid))
+        return false;
+    await store.add(nonce, ttlSeconds, agentDid);
+    return true;
+}
+//# sourceMappingURL=nonce-admission.js.map

package/dist/providers/nonce-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce-admission.js","sourceRoot":"","sources":["../../src/providers/nonce-admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAc7C,MAAM,YAAY,GAAG,IAAI,OAAO,EAAU,CAAC;AAE3C;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,KAA0B,EAC1B,UAAiC,EAAE;IAEnC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU;QAAE,OAAO;IAChD,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO;IACpC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,MAAM,CAAC,IAAI,CACT,kFAAkF;QAChF,oEAAoE;QACpE,6EAA6E;QAC7E,6CAA6C,CAChD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAA0B,EAC1B,KAAa,EACb,UAAkB,EAClB,QAAiB,EACjB,UAAiC,EAAE;IAEnC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC;IAC3E,CAAC;IACD,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/providers/nonce-retention.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Retain admission state through the entire final accepted second. The extra
+ * second covers inclusive, second-granularity verifiers; rounding up also
+ * covers subsecond cache clocks. A longer configured retention always wins;
+ * a configured TTL of 0 keeps the record for the acceptance window only. The
+ * result is at least one second, so stores never receive a zero TTL.
+ */
+export declare function nonceRetentionSeconds(configuredTtlSeconds: number, validUntilSeconds: number, nowMs: number): number;

package/dist/providers/nonce-retention.js

@@ -0,0 +1,15 @@
+/**
+ * Retain admission state through the entire final accepted second. The extra
+ * second covers inclusive, second-granularity verifiers; rounding up also
+ * covers subsecond cache clocks. A longer configured retention always wins;
+ * a configured TTL of 0 keeps the record for the acceptance window only. The
+ * result is at least one second, so stores never receive a zero TTL.
+ */
+export function nonceRetentionSeconds(configuredTtlSeconds, validUntilSeconds, nowMs) {
+    if (!Number.isFinite(configuredTtlSeconds) || configuredTtlSeconds < 0 ||
+        !Number.isFinite(validUntilSeconds) || !Number.isFinite(nowMs)) {
+        throw new RangeError('Nonce retention requires a non-negative TTL and a bounded acceptance window');
+    }
+    return Math.max(1, configuredTtlSeconds, Math.ceil(validUntilSeconds + 1 - nowMs / 1000));
+}
+//# sourceMappingURL=nonce-retention.js.map

package/dist/providers/nonce-retention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce-retention.js","sourceRoot":"","sources":["../../src/providers/nonce-retention.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,oBAA4B,EAC5B,iBAAyB,EACzB,KAAa;IAEb,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,oBAAoB,GAAG,CAAC;QAClE,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,UAAU,CAAC,6EAA6E,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC;AAC5F,CAAC"}

package/dist/providers/runtime-fetch.d.ts

@@ -92,4 +92,3 @@ export declare class NoopFetchProvider extends FetchProvider {
     fetchDelegationChain(_id: string): Promise<DelegationRecord[]>;
     fetch(_url: string, _options?: unknown): Promise<Response>;
 }
-//# sourceMappingURL=runtime-fetch.d.ts.map

package/dist/providers/system-clock.d.ts

@@ -36,4 +36,3 @@ export declare class SystemClockProvider extends ClockProvider {
     /** ISO-8601 rendering of a ms-epoch timestamp. */
     format(timestamp: number): string;
 }
-//# sourceMappingURL=system-clock.d.ts.map

package/dist/providers/web-crypto.d.ts

@@ -32,4 +32,3 @@ export declare class WebCryptoProvider extends CryptoProvider {
     hash(data: Uint8Array): Promise<string>;
     randomBytes(length: number): Promise<Uint8Array>;
 }
-//# sourceMappingURL=web-crypto.d.ts.map

package/dist/providers/web-crypto.js

@@ -23,6 +23,7 @@
  */
 import { CryptoProvider } from "./base.js";
 import { base64ToBytes, bytesToBase64 } from "../utils/base64.js";
+import { decodeEd25519PublicKey } from "../utils/ed25519-public-key.js";
 const ALG = "Ed25519";
 /** PKCS8 DER header for Ed25519 private keys (16 bytes) — matches NodeCryptoProvider. */
 const ED25519_PKCS8_PREFIX = Uint8Array.from([
@@ -66,8 +67,13 @@ export class WebCryptoProvider extends CryptoProvider {
         return new Uint8Array(sig);
     }
     async verify(data, signature, publicKeyBase64) {
+        // Same strict decode as NodeCryptoProvider: exactly 32 bytes, and never a
+        // small-order key (WebCrypto accepts those, and they verify a forgery).
+        const raw = decodeEd25519PublicKey(publicKeyBase64);
+        if (!raw) {
+            return false;
+        }
         try {
-            const raw = base64ToBytes(publicKeyBase64);
             const key = await getCrypto().subtle.importKey("raw", toBufferSource(raw), { name: ALG }, false, ["verify"]);
             return await getCrypto().subtle.verify({ name: ALG }, key, toBufferSource(signature), toBufferSource(data));
         }

package/dist/providers/web-crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"web-crypto.js","sourceRoot":"","sources":["../../src/providers/web-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElE,MAAM,GAAG,GAAG,SAAkB,CAAC;AAE/B,yFAAyF;AACzF,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,CAAC;IAC3C,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CAC/F,CAAC,CAAC;AAEH,SAAS,SAAS;IAChB,wEAAwE;IACxE,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sEAAsE;AACtE,sEAAsE;AACtE,0EAA0E;AAC1E,+BAA+B;AAC/B,SAAS,cAAc,CAAC,KAAiB;IACvC,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAQD,SAAS,SAAS,CAAC,GAAiB;IAClC,OAAO,YAAY,IAAI,GAAG,IAAI,WAAW,IAAI,GAAG,CAAC;AACnD,CAAC;AAED,MAAM,OAAO,iBAAkB,SAAQ,cAAc;IACnD,KAAK,CAAC,IAAI,CAAC,IAAgB,EAAE,gBAAwB;QACnD,MAAM,GAAG,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC5C,wEAAwE;QACxE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,oBAAoB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;QACnC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QACpF,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAgB,EAChB,SAAqB,EACrB,eAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAC5C,KAAK,EACL,cAAc,CAAC,GAAG,CAAC,EACnB,EAAE,IAAI,EAAE,GAAG,EAAE,EACb,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,OAAO,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CACpC,EAAE,IAAI,EAAE,GAAG,EAAE,EACb,GAAG,EACH,cAAc,CAAC,SAAS,CAAC,EACzB,cAAc,CAAC,IAAI,CAAC,CACrB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACzF,0EAA0E;QAC1E,wDAAwD;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAC3F,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChG,OAAO,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,SAAS,EAAE,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;CACF"}
+{"version":3,"file":"web-crypto.js","sourceRoot":"","sources":["../../src/providers/web-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE,MAAM,GAAG,GAAG,SAAkB,CAAC;AAE/B,yFAAyF;AACzF,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,CAAC;IAC3C,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CAC/F,CAAC,CAAC;AAEH,SAAS,SAAS;IAChB,wEAAwE;IACxE,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sEAAsE;AACtE,sEAAsE;AACtE,0EAA0E;AAC1E,+BAA+B;AAC/B,SAAS,cAAc,CAAC,KAAiB;IACvC,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAQD,SAAS,SAAS,CAAC,GAAiB;IAClC,OAAO,YAAY,IAAI,GAAG,IAAI,WAAW,IAAI,GAAG,CAAC;AACnD,CAAC;AAED,MAAM,OAAO,iBAAkB,SAAQ,cAAc;IACnD,KAAK,CAAC,IAAI,CAAC,IAAgB,EAAE,gBAAwB;QACnD,MAAM,GAAG,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC5C,wEAAwE;QACxE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,oBAAoB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,KAAK,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;QACnC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QACpF,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAgB,EAChB,SAAqB,EACrB,eAAuB;QAEvB,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,GAAG,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAC5C,KAAK,EACL,cAAc,CAAC,GAAG,CAAC,EACnB,EAAE,IAAI,EAAE,GAAG,EAAE,EACb,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,OAAO,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CACpC,EAAE,IAAI,EAAE,GAAG,EAAE,EACb,GAAG,EACH,cAAc,CAAC,SAAS,CAAC,EACzB,cAAc,CAAC,IAAI,CAAC,CACrB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACzF,0EAA0E;QAC1E,wDAAwD;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAC3F,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChG,OAAO,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,SAAS,EAAE,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;CACF"}

package/dist/session/index.d.ts

@@ -1,3 +1,2 @@
 export { SessionManager, createHandshakeRequest, validateHandshakeFormat, type SessionConfig, type HandshakeResult, } from './manager.js';
 export { SessionStore, MemorySessionStore, type MemorySessionStoreOptions, } from './session-store.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/session/manager.d.ts

@@ -17,6 +17,11 @@ export interface SessionConfig {
     sessionTtlMinutes?: number;
     absoluteSessionLifetime?: number;
     nonceCache?: NonceCache;
+    /**
+     * Refuse a nonce cache without an atomic `consume()` instead of falling back
+     * to `has()` then `add()`. The constructor throws for such a cache.
+     */
+    requireAtomicNonce?: boolean;
     serverDid?: string;
     /** Maximum number of concurrent sessions. Oldest sessions are evicted when exceeded. Default: 10000 */
     maxSessions?: number;
@@ -79,6 +84,14 @@ export declare class SessionManager {
     private normalizeClientInfoString;
     private buildClientInfo;
     static generateNonce(): string;
+    /**
+     * Sweep expired sessions from the session store, then run the store's and
+     * the nonce cache's own `cleanup()`. Nothing in the library schedules this:
+     * `getSession` already drops an expired session when it is read, and the
+     * default session store is capped by `maxSessions`. Call it from your own
+     * scheduler to reclaim records eagerly, or when a store relies on it to
+     * expire entries.
+     */
     cleanup(): Promise<void>;
     getStats(): {
         activeSessions: number;
@@ -93,4 +106,3 @@ export declare class SessionManager {
 }
 export declare function createHandshakeRequest(audience: string): HandshakeRequest;
 export declare function validateHandshakeFormat(request: unknown): request is HandshakeRequest;
-//# sourceMappingURL=manager.d.ts.map

package/dist/session/manager.js

@@ -11,6 +11,8 @@
 import { KYA_OS_ERROR_CODES } from "../errors.js";
 import { AUTH_NONCE_TTL_MS, ANON_NONCE_TTL_MS, } from '../types/protocol.js';
 import { MemoryNonceCacheProvider } from '../providers/memory.js';
+import { nonceRetentionSeconds } from '../providers/nonce-retention.js';
+import { admitNonce, checkNonceStore } from '../providers/nonce-admission.js';
 import { MemorySessionStore } from './session-store.js';
 import { logger } from '../logging/index.js';
 export class SessionManager {
@@ -26,16 +28,20 @@ export class SessionManager {
             timestampSkewSeconds: config.timestampSkewSeconds ?? 120,
             sessionTtlMinutes: config.sessionTtlMinutes ?? 30,
             nonceCache: config.nonceCache ?? new MemoryNonceCacheProvider(),
+            requireAtomicNonce: config.requireAtomicNonce ?? false,
             metaPolicy: config.metaPolicy ?? 'strict',
             ...(config.absoluteSessionLifetime !== undefined && {
                 absoluteSessionLifetime: config.absoluteSessionLifetime,
             }),
             ...(config.serverDid !== undefined && { serverDid: config.serverDid }),
         };
+        checkNonceStore(this.config.nonceCache, {
+            requireAtomicNonce: this.config.requireAtomicNonce,
+        });
         if (this.config.nonceCache instanceof MemoryNonceCacheProvider) {
             logger.warn('[SessionManager] Using MemoryNonceCacheProvider — not suitable for ' +
-                'multi-instance deployments. Use Redis, DynamoDB, or Cloudflare KV ' +
-                'for production.');
+                'multi-instance deployments. Use a shared provider with an atomic ' +
+                'consume operation for production.');
         }
     }
     setServerDid(serverDid) {
@@ -76,8 +82,15 @@ export class SessionManager {
                     },
                 };
             }
-            const nonceExists = await this.config.nonceCache.has(request.nonce, request.agentDid);
-            if (nonceExists) {
+            // Retain the nonce until its timestamp leaves the acceptance window
+            // (SPEC.md §5.5): a replay after that already fails the skew check above,
+            // so a longer retention adds memory and no protection. Anonymous and
+            // authenticated handshakes keep separate minimum TTLs (SPEC.md §5.2).
+            const isAnonymous = !request.agentDid;
+            const nonceTtlMs = isAnonymous ? ANON_NONCE_TTL_MS : AUTH_NONCE_TTL_MS;
+            const nonceTtlSeconds = nonceRetentionSeconds(Math.ceil(nonceTtlMs / 1000), request.timestamp + this.config.timestampSkewSeconds, Date.now());
+            const consumed = await admitNonce(this.config.nonceCache, request.nonce, nonceTtlSeconds, request.agentDid, { requireAtomicNonce: this.config.requireAtomicNonce });
+            if (!consumed) {
                 return {
                     success: false,
                     error: {
@@ -87,11 +100,6 @@ export class SessionManager {
                     },
                 };
             }
-            // Use different TTLs for anonymous vs authenticated nonces (SPEC.md §5.2)
-            const isAnonymous = !request.agentDid;
-            const nonceTtlMs = isAnonymous ? ANON_NONCE_TTL_MS : AUTH_NONCE_TTL_MS;
-            const nonceTtlSeconds = Math.ceil(nonceTtlMs / 1000);
-            await this.config.nonceCache.add(request.nonce, nonceTtlSeconds, request.agentDid);
             const sessionId = await this.generateSessionId();
             const clientInfo = await this.buildClientInfo(request);
             const session = {
@@ -209,6 +217,14 @@ export class SessionManager {
             .replace(/\//g, '_')
             .replace(/=/g, '');
     }
+    /**
+     * Sweep expired sessions from the session store, then run the store's and
+     * the nonce cache's own `cleanup()`. Nothing in the library schedules this:
+     * `getSession` already drops an expired session when it is read, and the
+     * default session store is capped by `maxSessions`. Call it from your own
+     * scheduler to reclaim records eagerly, or when a store relies on it to
+     * expire entries.
+     */
     async cleanup() {
         const now = Math.floor(Date.now() / 1000);
         for (const [sessionId, session] of await this.sessionStore.entries()) {

package/dist/session/manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/session/manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAuB,MAAM,cAAc,CAAC;AAOvE,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAgB,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAqC7C,MAAM,OAAO,cAAc;IACjB,MAAM,CAIZ;IACM,cAAc,CAAiB;IAC/B,YAAY,CAAe;IAEnC,YAAY,cAA8B,EAAE,SAAwB,EAAE;QACpE,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,YAAY;YACf,MAAM,CAAC,YAAY;gBACnB,IAAI,kBAAkB,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG;YACZ,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,IAAI,GAAG;YACxD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,EAAE;YACjD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,wBAAwB,EAAE;YAC/D,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,QAAQ;YACzC,GAAG,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,IAAI;gBAClD,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;aACxD,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;SACvE,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,YAAY,wBAAwB,EAAE,CAAC;YAC/D,MAAM,CAAC,IAAI,CACT,qEAAqE;gBACnE,oEAAoE;gBACpE,iBAAiB,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IACpC,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAyB;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YAEnD,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;gBAChD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;wBACzC,OAAO,EAAE,wCAAwC,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI;wBACrF,WAAW,EAAE,6DAA6D,GAAG,eAAe,OAAO,CAAC,SAAS,WAAW,QAAQ,2CAA2C;qBAC5K;iBACF,CAAC;YACJ,CAAC;YAED,gEAAgE;YAChE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;wBACzC,OAAO,EAAE,+BAA+B,IAAI,CAAC,MAAM,CAAC,SAAS,SAAS,OAAO,CAAC,QAAQ,EAAE;qBACzF;iBACF,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAClD,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,QAAQ,CACjB,CAAC;YACF,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB,CAAC,YAAY;wBACrC,OAAO,EAAE,+CAA+C;wBACxD,WAAW,EAAE,8CAA8C;qBAC5D;iBACF,CAAC;YACJ,CAAC;YAED,0EAA0E;YAC1E,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;YACtC,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC;YACvE,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;YACrD,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAC9B,OAAO,CAAC,KAAK,EACb,eAAe,EACf,OAAO,CAAC,QAAQ,CACjB,CAAC;YAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAEvD,MAAM,OAAO,GAAmB;gBAC9B,SAAS;gBACT,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,GAAG;gBACd,YAAY,EAAE,GAAG;gBACjB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;gBACzC,aAAa,EAAE,WAAW;gBAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;gBAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBAClE,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,CAAC;aAClC,CAAC;YAEF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAEhD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;oBACzC,OAAO,EAAE,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;iBACpG;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,eAAe,GAAG,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC;QACnD,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC;QAE/C,IAAI,eAAe,GAAG,cAAc,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,iBAAiB,GAAG,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;YAClD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,GAAG,EAAE,CAAC;YAC/D,IAAI,iBAAiB,GAAG,aAAa,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,CAAC,YAAY,GAAG,GAAG,CAAC;QAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QACrC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QACrC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;QACrH,OAAO,SAAS,IAAI,EAAE,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,UAAU,GAAG,EAAE,CAAC;IACzB,CAAC;IAEO,yBAAyB,CAAC,KAAc;QAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,OAAyB;QAEzB,MAAM,WAAW,GACf,CAAC,CAAC,OAAO,CAAC,UAAU;YACpB,OAAO,OAAO,CAAC,qBAAqB,KAAK,QAAQ;YACjD,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC;QAE3C,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAEnC,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;QAElC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,SAAS;YAC/D,KAAK,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,KAAK,CAAC;YACpD,OAAO,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,OAAO,CAAC;YACxD,QAAQ,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC1D,MAAM,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC;YACtD,YAAY,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,YAAY,CAAC;YAClE,QAAQ,EACN,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,QAAQ,CAAC;gBAChD,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACjC,eAAe,EAAE,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,qBAAqB,CAAC;YAC9E,YAAY,EAAE,OAAO,CAAC,kBAAkB;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,aAAa;QAClB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAClC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,SAAS,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;YACrE,MAAM,eAAe,GAAG,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC;YACnD,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC;YAC/C,IAAI,OAAO,GAAG,eAAe,GAAG,cAAc,CAAC;YAE/C,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;gBAClE,MAAM,iBAAiB,GAAG,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;gBAClD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,GAAG,EAAE,CAAC;gBAC/D,OAAO,GAAG,iBAAiB,GAAG,aAAa,CAAC;YAC9C,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;IACzC,CAAC;IAED,QAAQ;QASN,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;YACxC,MAAM,EAAE;gBACN,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;gBACtD,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;gBAChD,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,uBAAuB;gBAC5D,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI;aACnD;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,OAAO;QACL,KAAK,EAAE,cAAc,CAAC,aAAa,EAAE;QACrC,QAAQ;QACR,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,OAAO,CACL,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,OAAQ,OAAmC,CAAC,OAAO,CAAC,KAAK,QAAQ;QAC/D,OAAmC,CAAC,OAAO,CAAY,CAAC,MAAM,GAAG,CAAC;QACpE,OAAQ,OAAmC,CAAC,UAAU,CAAC,KAAK,QAAQ;QAClE,OAAmC,CAAC,UAAU,CAAY,CAAC,MAAM,GAAG,CAAC;QACvE,OAAQ,OAAmC,CAAC,WAAW,CAAC,KAAK,QAAQ;QACnE,OAAmC,CAAC,WAAW,CAAY,GAAG,CAAC;QACjE,MAAM,CAAC,SAAS,CAAE,OAAmC,CAAC,WAAW,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/session/manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAuB,MAAM,cAAc,CAAC;AAOvE,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAgB,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AA0C7C,MAAM,OAAO,cAAc;IACjB,MAAM,CAIZ;IACM,cAAc,CAAiB;IAC/B,YAAY,CAAe;IAEnC,YAAY,cAA8B,EAAE,SAAwB,EAAE;QACpE,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,YAAY;YACf,MAAM,CAAC,YAAY;gBACnB,IAAI,kBAAkB,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG;YACZ,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,IAAI,GAAG;YACxD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,EAAE;YACjD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,wBAAwB,EAAE;YAC/D,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,KAAK;YACtD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,QAAQ;YACzC,GAAG,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,IAAI;gBAClD,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;aACxD,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;SACvE,CAAC;QAEF,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE;YACtC,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;SACnD,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,YAAY,wBAAwB,EAAE,CAAC;YAC/D,MAAM,CAAC,IAAI,CACT,qEAAqE;gBACnE,mEAAmE;gBACnE,mCAAmC,CACtC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IACpC,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAyB;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YAEnD,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;gBAChD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;wBACzC,OAAO,EAAE,wCAAwC,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI;wBACrF,WAAW,EAAE,6DAA6D,GAAG,eAAe,OAAO,CAAC,SAAS,WAAW,QAAQ,2CAA2C;qBAC5K;iBACF,CAAC;YACJ,CAAC;YAED,gEAAgE;YAChE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;wBACzC,OAAO,EAAE,+BAA+B,IAAI,CAAC,MAAM,CAAC,SAAS,SAAS,OAAO,CAAC,QAAQ,EAAE;qBACzF;iBACF,CAAC;YACJ,CAAC;YAED,oEAAoE;YACpE,0EAA0E;YAC1E,qEAAqE;YACrE,sEAAsE;YACtE,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;YACtC,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC;YACvE,MAAM,eAAe,GAAG,qBAAqB,CAC3C,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,EAC5B,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,EACpD,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAC/B,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,OAAO,CAAC,KAAK,EACb,eAAe,EACf,OAAO,CAAC,QAAQ,EAChB,EAAE,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CACvD,CAAC;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB,CAAC,YAAY;wBACrC,OAAO,EAAE,+CAA+C;wBACxD,WAAW,EAAE,8CAA8C;qBAC5D;iBACF,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAEvD,MAAM,OAAO,GAAmB;gBAC9B,SAAS;gBACT,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,GAAG;gBACd,YAAY,EAAE,GAAG;gBACjB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;gBACzC,aAAa,EAAE,WAAW;gBAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;gBAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBAClE,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,CAAC;aAClC,CAAC;YAEF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAEhD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;oBACzC,OAAO,EAAE,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;iBACpG;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,eAAe,GAAG,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC;QACnD,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC;QAE/C,IAAI,eAAe,GAAG,cAAc,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,iBAAiB,GAAG,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;YAClD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,GAAG,EAAE,CAAC;YAC/D,IAAI,iBAAiB,GAAG,aAAa,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,CAAC,YAAY,GAAG,GAAG,CAAC;QAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QACrC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QACrC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;QACrH,OAAO,SAAS,IAAI,EAAE,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,UAAU,GAAG,EAAE,CAAC;IACzB,CAAC;IAEO,yBAAyB,CAAC,KAAc;QAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,OAAyB;QAEzB,MAAM,WAAW,GACf,CAAC,CAAC,OAAO,CAAC,UAAU;YACpB,OAAO,OAAO,CAAC,qBAAqB,KAAK,QAAQ;YACjD,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC;QAE3C,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAEnC,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;QAElC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,SAAS;YAC/D,KAAK,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,KAAK,CAAC;YACpD,OAAO,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,OAAO,CAAC;YACxD,QAAQ,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC1D,MAAM,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC;YACtD,YAAY,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,YAAY,CAAC;YAClE,QAAQ,EACN,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,QAAQ,CAAC;gBAChD,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACjC,eAAe,EAAE,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,qBAAqB,CAAC;YAC9E,YAAY,EAAE,OAAO,CAAC,kBAAkB;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,aAAa;QAClB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAClC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,SAAS,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;YACrE,MAAM,eAAe,GAAG,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC;YACnD,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC;YAC/C,IAAI,OAAO,GAAG,eAAe,GAAG,cAAc,CAAC;YAE/C,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;gBAClE,MAAM,iBAAiB,GAAG,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;gBAClD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,GAAG,EAAE,CAAC;gBAC/D,OAAO,GAAG,iBAAiB,GAAG,aAAa,CAAC;YAC9C,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;IACzC,CAAC;IAED,QAAQ;QASN,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;YACxC,MAAM,EAAE;gBACN,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;gBACtD,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;gBAChD,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,uBAAuB;gBAC5D,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI;aACnD;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,OAAO;QACL,KAAK,EAAE,cAAc,CAAC,aAAa,EAAE;QACrC,QAAQ;QACR,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,OAAO,CACL,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,OAAQ,OAAmC,CAAC,OAAO,CAAC,KAAK,QAAQ;QAC/D,OAAmC,CAAC,OAAO,CAAY,CAAC,MAAM,GAAG,CAAC;QACpE,OAAQ,OAAmC,CAAC,UAAU,CAAC,KAAK,QAAQ;QAClE,OAAmC,CAAC,UAAU,CAAY,CAAC,MAAM,GAAG,CAAC;QACvE,OAAQ,OAAmC,CAAC,WAAW,CAAC,KAAK,QAAQ;QACnE,OAAmC,CAAC,WAAW,CAAY,GAAG,CAAC;QACjE,MAAM,CAAC,SAAS,CAAE,OAAmC,CAAC,WAAW,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC"}

package/dist/session/session-store.d.ts

@@ -75,4 +75,3 @@ export declare class MemorySessionStore extends SessionStore {
     /** Evict oldest sessions (insertion order) until below capacity. */
     private evictIfNeeded;
 }
-//# sourceMappingURL=session-store.d.ts.map

package/dist/types/protocol.d.ts

@@ -165,11 +165,15 @@ export declare function isSupportedCredentialProofType(type: unknown): type is s
  */
 export declare function extractDelegationFromVC(vc: DelegationCredential): DelegationRecord;
 /**
- * Check if a DelegationCredential is expired.
+ * Check if a DelegationCredential is expired. A present `expirationDate` or
+ * `constraints.notAfter` that cannot be read (an impossible date, a
+ * non-numeric bound) counts as expired: it is a bound, just an unreadable
+ * one, and must not read as "no expiry".
  */
 export declare function isDelegationCredentialExpired(vc: DelegationCredential): boolean;
 /**
- * Check if a DelegationCredential is not yet valid.
+ * Check if a DelegationCredential is not yet valid. A present
+ * `constraints.notBefore` that is not a finite number counts as not yet valid.
  */
 export declare function isDelegationCredentialNotYetValid(vc: DelegationCredential): boolean;
 /**
@@ -239,6 +243,11 @@ export interface SessionContext {
  * Nonce cache interface for replay prevention.
  */
 export interface NonceCache {
+    /**
+     * Optional atomic test-and-set; see NonceCacheProvider.consume. When absent,
+     * handshakes fall back to has() then add() unless requireAtomicNonce is set.
+     */
+    consume?(nonce: string, ttlSeconds: number, agentDid?: string): Promise<boolean>;
     has(nonce: string, agentDid?: string): Promise<boolean>;
     add(nonce: string, ttl: number, agentDid?: string): Promise<void>;
     cleanup(): Promise<void>;
@@ -428,4 +437,3 @@ export declare function validateDetachedProof(proof: unknown): {
     };
     data?: DetachedProof;
 };
-//# sourceMappingURL=protocol.d.ts.map