@kya-os/mcp 1.17.0 → 1.20.0

package/dist/middleware/with-kya-os.deps.d.ts

@@ -13,14 +13,25 @@ import type { ProofGenerator, ProofAgentIdentity } from "../proof/generator.js";
 import type { ProofVerifier } from "../proof/verifier.js";
 import type { ResponseProofProfile } from "../types/protocol.js";
 import type { McpAuditEventAdapter } from "../audit/adapters/mcp.js";
-import type { KyaOsConfig, KyaOsDelegationConfig, KyaOsToolHandler } from "./with-kya-os.types.js";
+import type { KyaOsAuthorizationOutcome, KyaOsConfig, KyaOsDelegationConfig, KyaOsToolResult } from "./with-kya-os.types.js";
 /**
  * Attach a signed proof recording an authorization OUTCOME (denied / step-up /
  * needs-authorization) to a response. Provided by the session/proof sub-factory
- * and consumed by the delegation- and policy-gate sub-factories, so it is typed
- * here as the shared internal contract between them.
+ * and consumed by the delegation- and policy-gate sub-factories and the public
+ * `proveOutcome`, so it is typed here as the shared internal contract between
+ * them. A `needs_authorization` proof binds the response (its content under
+ * the body profile, its envelope under the envelope profile); denial and
+ * step-up proofs bind none (SPEC §7.4).
  */
-export type AttachOutcomeProof = (response: Awaited<ReturnType<KyaOsToolHandler>>, toolName: string, args: Record<string, unknown>, sessionId: string | undefined, reason: string, outcome?: "denied" | "step_up_required" | "needs_authorization", paramsOverride?: Record<string, unknown>, responseData?: unknown) => Promise<Awaited<ReturnType<KyaOsToolHandler>>>;
+export type AttachOutcomeProof = (response: KyaOsToolResult, toolName: string, args: Record<string, unknown>, sessionId: string | undefined, reason: string, outcome?: KyaOsAuthorizationOutcome, paramsOverride?: Record<string, unknown>) => Promise<KyaOsToolResult>;
+/**
+ * Refuse, by throwing, a wrapped call whose proof could not be made. A proof
+ * is made where the result is sent, so every wrapper calls this on entry,
+ * before it records or runs anything, and it throws while no KYA-OS
+ * transport is open for the middleware. Provided by the session/proof
+ * sub-factory.
+ */
+export type RequireProofLayer = () => void;
 /** The constructed dependencies shared across the middleware sub-factories. */
 export interface MiddlewareDeps {
     /** Proof-generation identity (DID + key material). */

package/dist/middleware/with-kya-os.helpers.d.ts

@@ -5,6 +5,11 @@
  * of `./with-kya-os.ts` so the factory module stays focused on wiring. No shared
  * mutable state, no I/O — safe to unit test in isolation.
  */
+/**
+ * `args` without the reserved `_kyaos*` control arguments: the call as its
+ * handler sees it, and as a gate's request hash binds it.
+ */
+export declare function withoutControlArgs(args: Record<string, unknown>): Record<string, unknown>;
 /**
  * Strip control characters and cap length on caller-derived values before they
  * are interpolated into client-facing reasons or log lines. A hostile

package/dist/middleware/with-kya-os.helpers.js

@@ -6,6 +6,19 @@
  * mutable state, no I/O — safe to unit test in isolation.
  */
 import { getDelegationScopes } from "../delegation/chain-enforcement.js";
+import { isKyaOsControlArg } from "../proof/covered-request.js";
+/**
+ * `args` without the reserved `_kyaos*` control arguments: the call as its
+ * handler sees it, and as a gate's request hash binds it.
+ */
+export function withoutControlArgs(args) {
+    const clean = {};
+    for (const [key, value] of Object.entries(args)) {
+        if (!isKyaOsControlArg(key))
+            clean[key] = value;
+    }
+    return clean;
+}
 /**
  * Strip control characters and cap length on caller-derived values before they
  * are interpolated into client-facing reasons or log lines. A hostile

package/dist/middleware/with-kya-os.helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.helpers.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.helpers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAEzE;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,MAAM,GAAG,GAAG;IAC7D,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,6EAA6E;IAC7E,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,GAAG,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;AACrE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CAAC,GAAY;IAKjD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,GAA2B,CAAC;QACvC,MAAM,OAAO,GAAG,EAAE,CAAC,iBAGlB,CAAC;QACF,MAAM,QAAQ,GAAG,OAAO,EAAE,UAAU,EAAE,UAAU,IAAI,OAAO,EAAE,EAAE,IAAI,SAAS,CAAC;QAC7E,MAAM,gBAAgB,GAAG,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC;QACzD,IAAI,eAAe,GAAa,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,eAAe,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,eAAe,GAAG,EAAE,CAAC;QACvB,CAAC;QACD,OAAO;YACL,QAAQ;YACR,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,eAAe;SAChB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IACtD,CAAC;AACH,CAAC"}
+{"version":3,"file":"with-kya-os.helpers.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.helpers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAEhE;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAA6B;IAE7B,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,MAAM,GAAG,GAAG;IAC7D,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,6EAA6E;IAC7E,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,GAAG,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;AACrE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CAAC,GAAY;IAKjD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,GAA2B,CAAC;QACvC,MAAM,OAAO,GAAG,EAAE,CAAC,iBAGlB,CAAC;QACF,MAAM,QAAQ,GAAG,OAAO,EAAE,UAAU,EAAE,UAAU,IAAI,OAAO,EAAE,EAAE,IAAI,SAAS,CAAC;QAC7E,MAAM,gBAAgB,GAAG,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC;QACzD,IAAI,eAAe,GAAa,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,eAAe,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,eAAe,GAAG,EAAE,CAAC;QACvB,CAAC;QACD,OAAO;YACL,QAAQ;YACR,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,eAAe;SAChB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IACtD,CAAC;AACH,CAAC"}

package/dist/middleware/with-kya-os.js

@@ -29,8 +29,11 @@ import { createDelegationVerification } from "./with-kya-os.delegation-verify.js
 import { createGrantResolution } from "./with-kya-os.grants.js";
 import { createPolicyGate } from "./with-kya-os.policy-gate.js";
 import { createDelegationGate } from "./with-kya-os.delegation-gate.js";
+import { createOutcomeProver } from "./with-kya-os.outcome.js";
 import { createSessionProof } from "./with-kya-os.session.js";
 import { createProtocol } from "./with-kya-os.protocol.js";
+/** The longest timer a JavaScript runtime keeps (2^31 - 1 ms, about 24.8 days). */
+const MAX_PENDING_PROOF_TTL_MS = 2_147_483_647;
 // The public type surface lives in `./with-kya-os.types.ts`; re-export it here so
 // `import { KyaOsConfig, ... } from './with-kya-os'` continues to resolve unchanged.
 export * from "./with-kya-os.types.js";
@@ -46,6 +49,10 @@ export * from "./with-kya-os.types.js";
  * - You need custom request handler patterns
  * - You want per-tool control over proof/delegation wrapping
  *
+ * Connect such a server through `createKyaOsTransport`: proofs are made where
+ * that transport sends a result, and the wrappers refuse to run while no
+ * KYA-OS transport is open.
+ *
  * @param config - Agent identity and session configuration
  * @param cryptoProvider - Platform-specific crypto implementation
  * @returns Middleware components for session management and proof generation
@@ -60,6 +67,13 @@ export * from "./with-kya-os.types.js";
  * durable `SessionStore` via `config.session.sessionStore`.
  */
 export function createKyaOsMiddleware(config, cryptoProvider) {
+    if (config.pendingProofTtlMs !== undefined &&
+        !(Number.isFinite(config.pendingProofTtlMs) &&
+            config.pendingProofTtlMs > 0 &&
+            config.pendingProofTtlMs <= MAX_PENDING_PROOF_TTL_MS)) {
+        // A timer longer than this overflows, and Node and browsers fire it at once.
+        throw new TypeError(`pendingProofTtlMs must be a positive number of milliseconds, at most ${MAX_PENDING_PROOF_TTL_MS}`);
+    }
     if (config.audit && config.auditLog) {
         throw new TypeError('Configure either audit or legacy auditLog, not both');
     }
@@ -166,11 +180,19 @@ export function createKyaOsMiddleware(config, cryptoProvider) {
     const { wrapWithDelegation } = createDelegationGate(deps, {
         delegationVerification,
         attachOutcomeProof: session.attachOutcomeProof,
+        requireProofLayer: session.requireProofLayer,
         resolveExistingGrant,
         bindGrantOnSuccess,
     });
     const { withPolicyGate } = createPolicyGate(deps, {
         attachOutcomeProof: session.attachOutcomeProof,
+        requireProofLayer: session.requireProofLayer,
+    });
+    // Application code proves the outcomes it decides through the same
+    // attachOutcomeProof the gates use.
+    const { proveOutcome } = createOutcomeProver({
+        attachOutcomeProof: session.attachOutcomeProof,
+        requireProofLayer: session.requireProofLayer,
     });
     return {
         identity: config.identity,
@@ -183,6 +205,7 @@ export function createKyaOsMiddleware(config, cryptoProvider) {
         wrapWithProof: session.wrapWithProof,
         wrapWithDelegation,
         withPolicyGate,
+        proveOutcome,
     };
 }
 //# sourceMappingURL=with-kya-os.js.map

package/dist/middleware/with-kya-os.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,cAAc,EACd,2BAA2B,GAE5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAM7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,kFAAkF;AAClF,qFAAqF;AACrF,cAAc,wBAAwB,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,UAAU,qBAAqB,CACnC,MAAmB,EACnB,cAA8B;IAE9B,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5C,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS;gBACzC,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBAClE,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;YAC5F,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAuB;QACnC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QACxB,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QACxB,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU;QACtC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;KACrC,CAAC;IAEF,2EAA2E;IAC3E,mFAAmF;IACnF,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,wBAAwB,EAAE,CAAC;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAE9D,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,cAAc,EAAE;QACxD,GAAG,MAAM,CAAC,OAAO;QACjB,SAAS,EAAE,QAAQ,CAAC,GAAG;QACvB,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAChE,CAAC,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE;YACrC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK;SACzD,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,4EAA4E;IAC5E,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,IAAI,CAAC;IAE7D,kEAAkE;IAClE,oEAAoE;IACpE,gDAAgD;IAChD,MAAM,oBAAoB,GACxB,MAAM,CAAC,oBAAoB,IAAI,2BAA2B,CAAC;IAE7D,8EAA8E;IAC9E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,gBAAgB,EAAE,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CACT,uEAAuE;YACrE,uEAAuE;YACvE,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,iBAAiB,GAAG,gBAAgB,EAAE,aAAa,IAAI,KAAK,CAAC;IACnE,MAAM,qBAAqB,GACzB,iBAAiB,KAAK,KAAK;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,aAAa,CAAC;YAChB,cAAc;YACd,aAAa,EAAE,IAAI,mBAAmB,EAAE;YACxC,kBAAkB,EAAE,UAAU;YAC9B,kBAAkB;YAClB,aAAa,EACX,gBAAgB,EAAE,aAAa;gBAC/B,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;oBACrC,CAAC,CAAC,IAAI,oBAAoB,EAAE;oBAC5B,CAAC,CAAC,IAAI,iBAAiB,EAAE,CAAC;SAC/B,CAAC,CAAC;IAET,iEAAiE;IACjE,MAAM,IAAI,GAAmB;QAC3B,QAAQ;QACR,MAAM;QACN,cAAc;QACd,cAAc;QACd,cAAc;QACd,QAAQ;QACR,KAAK;QACL,UAAU;QACV,gBAAgB;QAChB,iBAAiB;QACjB,qBAAqB;QACrB,kBAAkB;QAClB,oBAAoB;KACrB,CAAC;IAEF,gFAAgF;IAChF,iEAAiE;IACjE,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE;QACpC,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,sEAAsE;IACtE,8EAA8E;IAC9E,wCAAwC;IACxC,MAAM,sBAAsB,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAChD,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAEvE,MAAM,EAAE,kBAAkB,EAAE,GAAG,oBAAoB,CAAC,IAAI,EAAE;QACxD,sBAAsB;QACtB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,oBAAoB;QACpB,kBAAkB;KACnB,CAAC,CAAC;IAEH,MAAM,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE;QAChD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;KAC/C,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc;QACd,cAAc;QACd,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,kBAAkB;QAClB,cAAc;KACf,CAAC;AACJ,CAAC"}
+{"version":3,"file":"with-kya-os.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,cAAc,EACd,2BAA2B,GAE5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAM7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,mFAAmF;AACnF,MAAM,wBAAwB,GAAG,aAAa,CAAC;AAE/C,kFAAkF;AAClF,qFAAqF;AACrF,cAAc,wBAAwB,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,MAAM,UAAU,qBAAqB,CACnC,MAAmB,EACnB,cAA8B;IAE9B,IACE,MAAM,CAAC,iBAAiB,KAAK,SAAS;QACtC,CAAC,CACC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACzC,MAAM,CAAC,iBAAiB,GAAG,CAAC;YAC5B,MAAM,CAAC,iBAAiB,IAAI,wBAAwB,CACrD,EACD,CAAC;QACD,6EAA6E;QAC7E,MAAM,IAAI,SAAS,CACjB,wEAAwE,wBAAwB,EAAE,CACnG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5C,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS;gBACzC,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBAClE,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;YAC5F,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAuB;QACnC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QACxB,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QACxB,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU;QACtC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;KACrC,CAAC;IAEF,2EAA2E;IAC3E,mFAAmF;IACnF,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,wBAAwB,EAAE,CAAC;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAE9D,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,cAAc,EAAE;QACxD,GAAG,MAAM,CAAC,OAAO;QACjB,SAAS,EAAE,QAAQ,CAAC,GAAG;QACvB,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAChE,CAAC,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE;YACrC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK;SACzD,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,4EAA4E;IAC5E,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,IAAI,CAAC;IAE7D,kEAAkE;IAClE,oEAAoE;IACpE,gDAAgD;IAChD,MAAM,oBAAoB,GACxB,MAAM,CAAC,oBAAoB,IAAI,2BAA2B,CAAC;IAE7D,8EAA8E;IAC9E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,gBAAgB,EAAE,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CACT,uEAAuE;YACrE,uEAAuE;YACvE,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,iBAAiB,GAAG,gBAAgB,EAAE,aAAa,IAAI,KAAK,CAAC;IACnE,MAAM,qBAAqB,GACzB,iBAAiB,KAAK,KAAK;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,aAAa,CAAC;YAChB,cAAc;YACd,aAAa,EAAE,IAAI,mBAAmB,EAAE;YACxC,kBAAkB,EAAE,UAAU;YAC9B,kBAAkB;YAClB,aAAa,EACX,gBAAgB,EAAE,aAAa;gBAC/B,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;oBACrC,CAAC,CAAC,IAAI,oBAAoB,EAAE;oBAC5B,CAAC,CAAC,IAAI,iBAAiB,EAAE,CAAC;SAC/B,CAAC,CAAC;IAET,iEAAiE;IACjE,MAAM,IAAI,GAAmB;QAC3B,QAAQ;QACR,MAAM;QACN,cAAc;QACd,cAAc;QACd,cAAc;QACd,QAAQ;QACR,KAAK;QACL,UAAU;QACV,gBAAgB;QAChB,iBAAiB;QACjB,qBAAqB;QACrB,kBAAkB;QAClB,oBAAoB;KACrB,CAAC;IAEF,gFAAgF;IAChF,iEAAiE;IACjE,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE;QACpC,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,sEAAsE;IACtE,8EAA8E;IAC9E,wCAAwC;IACxC,MAAM,sBAAsB,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAChD,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAEvE,MAAM,EAAE,kBAAkB,EAAE,GAAG,oBAAoB,CAAC,IAAI,EAAE;QACxD,sBAAsB;QACtB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,oBAAoB;QACpB,kBAAkB;KACnB,CAAC,CAAC;IAEH,MAAM,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE;QAChD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC;IAEH,mEAAmE;IACnE,oCAAoC;IACpC,MAAM,EAAE,YAAY,EAAE,GAAG,mBAAmB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc;QACd,cAAc;QACd,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,kBAAkB;QAClB,cAAc;QACd,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/middleware/with-kya-os.outcome.d.ts

@@ -0,0 +1,18 @@
+/**
+ * KYA-OS Middleware — `proveOutcome`, the public entry to outcome proofs.
+ *
+ * Application code that decides an authorization outcome itself (a provider
+ * enforcing OAuth scopes in-server, say) proves it here with the proof the
+ * gates attach to theirs. There is one implementation, `attachOutcomeProof`
+ * in `./with-kya-os.session.ts`; this module only adapts a request object to
+ * it, so the claims, `_meta` keys, profile handling, audit events and
+ * lifecycle stamp cannot drift between the gates and application code.
+ */
+import type { KyaOsOutcomeProver } from "./with-kya-os.types.js";
+import type { AttachOutcomeProof, RequireProofLayer } from "./with-kya-os.deps.js";
+/** Collaborators the outcome prover borrows from the session/proof sub-factory. */
+export interface OutcomeProverWiring {
+    attachOutcomeProof: AttachOutcomeProof;
+    requireProofLayer: RequireProofLayer;
+}
+export declare function createOutcomeProver(wiring: OutcomeProverWiring): KyaOsOutcomeProver;

package/dist/middleware/with-kya-os.outcome.js

@@ -0,0 +1,36 @@
+/**
+ * KYA-OS Middleware — `proveOutcome`, the public entry to outcome proofs.
+ *
+ * Application code that decides an authorization outcome itself (a provider
+ * enforcing OAuth scopes in-server, say) proves it here with the proof the
+ * gates attach to theirs. There is one implementation, `attachOutcomeProof`
+ * in `./with-kya-os.session.ts`; this module only adapts a request object to
+ * it, so the claims, `_meta` keys, profile handling, audit events and
+ * lifecycle stamp cannot drift between the gates and application code.
+ */
+import { withoutOutcomeMeta } from "./with-kya-os.session.js";
+import { withoutControlArgs } from "./with-kya-os.helpers.js";
+const OUTCOMES = new Set([
+    "needs_authorization",
+    "step_up_required",
+    "denied",
+]);
+export function createOutcomeProver(wiring) {
+    const { attachOutcomeProof, requireProofLayer } = wiring;
+    return {
+        async proveOutcome(request) {
+            requireProofLayer();
+            if (!OUTCOMES.has(request.outcome)) {
+                throw new TypeError(`proveOutcome: unknown outcome ${JSON.stringify(request.outcome)}; ` +
+                    `expected one of ${[...OUTCOMES].join(", ")}`);
+            }
+            const params = withoutControlArgs(request.args);
+            // A copy, so the caller's result is never changed, without the `_meta`
+            // members only the middleware may set.
+            const result = { ...withoutOutcomeMeta(request.result) };
+            // The same members, plus `_meta`: still an R.
+            return attachOutcomeProof(result, request.toolName, params, request.sessionId, request.reason, request.outcome, params);
+        },
+    };
+}
+//# sourceMappingURL=with-kya-os.outcome.js.map

package/dist/middleware/with-kya-os.outcome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-kya-os.outcome.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.outcome.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAA4B;IACvE,qBAAqB;IACrB,kBAAkB;IAClB,QAAQ;CACT,CAAC,CAAC;AAQH,MAAM,UAAU,mBAAmB,CAAC,MAA2B;IAC7D,MAAM,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC;IAEzD,OAAO;QACL,KAAK,CAAC,YAAY,CAA4B,OAAoC;YAChF,iBAAiB,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,SAAS,CACjB,iCAAiC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI;oBAClE,mBAAmB,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChD,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChD,uEAAuE;YACvE,uCAAuC;YACvC,MAAM,MAAM,GAAG,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,8CAA8C;YAC9C,OAAO,kBAAkB,CACvB,MAAM,EACN,OAAO,CAAC,QAAQ,EAChB,MAAM,EACN,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,OAAO,EACf,MAAM,CACO,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/middleware/with-kya-os.policy-gate.d.ts

@@ -7,9 +7,10 @@
  * human approval before the handler runs. Extracted from `./with-kya-os.ts`.
  */
 import type { KyaOsPolicyGate } from "./with-kya-os.types.js";
-import type { MiddlewareDeps, AttachOutcomeProof } from "./with-kya-os.deps.js";
+import type { MiddlewareDeps, AttachOutcomeProof, RequireProofLayer } from "./with-kya-os.deps.js";
 /** Collaborators the policy gate borrows from the session/proof sub-factory. */
 export interface PolicyGateWiring {
     attachOutcomeProof: AttachOutcomeProof;
+    requireProofLayer: RequireProofLayer;
 }
 export declare function createPolicyGate(deps: MiddlewareDeps, wiring: PolicyGateWiring): Pick<KyaOsPolicyGate, "withPolicyGate">;

package/dist/middleware/with-kya-os.policy-gate.js

@@ -17,7 +17,7 @@ import { KYA_OS_ERROR_CODES } from "../errors.js";
 import { sanitizeForMessage, extractPolicyPrincipal } from "./with-kya-os.helpers.js";
 export function createPolicyGate(deps, wiring) {
     const { proofGenerator, cryptoProvider, audit } = deps;
-    const { attachOutcomeProof } = wiring;
+    const { attachOutcomeProof, requireProofLayer } = wiring;
     const defaultRiskClassifier = new RiskClassifier();
     const defaultPolicyEngine = new DefaultPolicyEngine();
     function withPolicyGate(toolName, handler, opts = {}) {
@@ -26,6 +26,7 @@ export function createPolicyGate(deps, wiring) {
         const approvalsKey = opts.approvalsArgKey ?? "_kyaos_approvals";
         const isValidApprovalSignature = opts.isValidApprovalSignature ?? (async () => false);
         return async (callArgs, sessionId, context) => {
+            requireProofLayer();
             // Composed after wrapWithDelegation, the approvals argument has already
             // been stripped and arrives in the call context; restore it so a step-up
             // resume verifies the same grants either way.

package/dist/middleware/with-kya-os.policy-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.policy-gate.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.policy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAsB,MAAM,uBAAuB,CAAC;AAEjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAoB,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAQlD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAOtF,MAAM,UAAU,gBAAgB,CAC9B,IAAoB,EACpB,MAAwB;IAExB,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvD,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC;IAEtC,MAAM,qBAAqB,GAAG,IAAI,cAAc,EAAE,CAAC;IACnD,MAAM,mBAAmB,GAAiB,IAAI,mBAAmB,EAAE,CAAC;IAEpE,SAAS,cAAc,CACrB,QAAgB,EAChB,OAAyB,EACzB,OAA0B,EAAE;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,qBAAqB,CAAC;QAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,IAAI,kBAAkB,CAAC;QAChE,MAAM,wBAAwB,GAC5B,IAAI,CAAC,wBAAwB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;QAEvD,OAAO,KAAK,EACV,QAAiC,EACjC,SAAkB,EAClB,OAA0B,EAC1B,EAAE;YACF,wEAAwE;YACxE,yEAAyE;YACzE,8CAA8C;YAC9C,MAAM,IAAI,GACR,QAAQ,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS;gBACtE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE;gBACpD,CAAC,CAAC,QAAQ,CAAC;YAEf,2EAA2E;YAC3E,8CAA8C;YAC9C,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,YAAY;oBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;YAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,iEAAiE;YACjE,wEAAwE;YACxE,MAAM,SAAS,GACb,OAAO,EAAE,SAAS,IAAI,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAE1E,MAAM,aAAa,GAAG,kBAAkB,CAAC;gBACvC,SAAS,EAAE;oBACT,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,GAAG,CAAC,SAAS,CAAC,gBAAgB;wBAC5B,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE;wBAClD,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,MAAM,EAAE,EAAE,QAAQ,EAAE;gBACpB,QAAQ,EAAE,EAAE,SAAS,EAAE;gBACvB,eAAe,EAAE,CAAC,GAAG,SAAS,CAAC,eAAe,CAAC;gBAC/C,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,KAAK;gBACxC,IAAI;aACL,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YAEtD,MAAM,YAAY,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;gBACvD,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChE,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBACnD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;aAC9C,CAAC;YACF,MAAM,KAAK,EAAE,aAAa,CAAC,WAAW,EAAE;gBACtC,OAAO,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW;oBAClD,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;gBAC1D,UAAU,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO;oBACvC,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB;gBACrE,OAAO,EAAE,YAAY;aACtB,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAClC,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;oBACrC,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACjC,MAAM,MAAM,GAA0C;oBACpD,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACnB,KAAK,EAAE,kBAAkB,CAAC,aAAa;gCACvC,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC;6BAC5C,CAAC;yBACH;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;gBACF,OAAO,kBAAkB,CACvB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,QAAQ,EACR,SAAS,CACV,CAAC;YACJ,CAAC;YAED,4EAA4E;YAC5E,wEAAwE;YACxE,kEAAkE;YAClE,MAAM,MAAM,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACpE,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC9C,CAAC,CAAE,IAAI,CAAC,YAAY,CAAqB;gBACzC,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAC7C,MAAM,EACN,MAAM,qBAAqB,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC1E,QAAQ,CAAC,MAAM,EACf,wBAAwB,CACzB,CAAC;YACF,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;oBACrC,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,aAAa,GAAG,wBAAwB,CAAC;gBAC7C,OAAO,EAAE,SAAS,QAAQ,cAAc,QAAQ,CAAC,MAAM,CAAC,CAAC,yCAAyC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI;gBACzI,WAAW,EAAE,WAAW,WAAW,EAAE;gBACrC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;gBAC9C,WAAW;gBACX,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;YACH,MAAM,MAAM,GAA0C;gBACpD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;gBAChE,OAAO,EAAE,IAAI;aACd,CAAC;YACF,OAAO,kBAAkB,CACvB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,kBAAkB,EAClB,SAAS,CACV,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"with-kya-os.policy-gate.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.policy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAsB,MAAM,uBAAuB,CAAC;AAEjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAoB,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAQlD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAQtF,MAAM,UAAU,gBAAgB,CAC9B,IAAoB,EACpB,MAAwB;IAExB,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvD,MAAM,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC;IAEzD,MAAM,qBAAqB,GAAG,IAAI,cAAc,EAAE,CAAC;IACnD,MAAM,mBAAmB,GAAiB,IAAI,mBAAmB,EAAE,CAAC;IAEpE,SAAS,cAAc,CACrB,QAAgB,EAChB,OAAyB,EACzB,OAA0B,EAAE;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,qBAAqB,CAAC;QAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,IAAI,kBAAkB,CAAC;QAChE,MAAM,wBAAwB,GAC5B,IAAI,CAAC,wBAAwB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;QAEvD,OAAO,KAAK,EACV,QAAiC,EACjC,SAAkB,EAClB,OAA0B,EAC1B,EAAE;YACF,iBAAiB,EAAE,CAAC;YACpB,wEAAwE;YACxE,yEAAyE;YACzE,8CAA8C;YAC9C,MAAM,IAAI,GACR,QAAQ,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS;gBACtE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE;gBACpD,CAAC,CAAC,QAAQ,CAAC;YAEf,2EAA2E;YAC3E,8CAA8C;YAC9C,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,YAAY;oBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;YAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,iEAAiE;YACjE,wEAAwE;YACxE,MAAM,SAAS,GACb,OAAO,EAAE,SAAS,IAAI,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAE1E,MAAM,aAAa,GAAG,kBAAkB,CAAC;gBACvC,SAAS,EAAE;oBACT,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,GAAG,CAAC,SAAS,CAAC,gBAAgB;wBAC5B,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE;wBAClD,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,MAAM,EAAE,EAAE,QAAQ,EAAE;gBACpB,QAAQ,EAAE,EAAE,SAAS,EAAE;gBACvB,eAAe,EAAE,CAAC,GAAG,SAAS,CAAC,eAAe,CAAC;gBAC/C,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,KAAK;gBACxC,IAAI;aACL,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YAEtD,MAAM,YAAY,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;gBACvD,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChE,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBACnD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;aAC9C,CAAC;YACF,MAAM,KAAK,EAAE,aAAa,CAAC,WAAW,EAAE;gBACtC,OAAO,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW;oBAClD,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;gBAC1D,UAAU,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO;oBACvC,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB;gBACrE,OAAO,EAAE,YAAY;aACtB,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAClC,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;oBACrC,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACjC,MAAM,MAAM,GAA0C;oBACpD,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACnB,KAAK,EAAE,kBAAkB,CAAC,aAAa;gCACvC,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC;6BAC5C,CAAC;yBACH;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;gBACF,OAAO,kBAAkB,CACvB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,QAAQ,EACR,SAAS,CACV,CAAC;YACJ,CAAC;YAED,4EAA4E;YAC5E,wEAAwE;YACxE,kEAAkE;YAClE,MAAM,MAAM,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACpE,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC9C,CAAC,CAAE,IAAI,CAAC,YAAY,CAAqB;gBACzC,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAC7C,MAAM,EACN,MAAM,qBAAqB,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC1E,QAAQ,CAAC,MAAM,EACf,wBAAwB,CACzB,CAAC;YACF,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;oBACrC,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,aAAa,GAAG,wBAAwB,CAAC;gBAC7C,OAAO,EAAE,SAAS,QAAQ,cAAc,QAAQ,CAAC,MAAM,CAAC,CAAC,yCAAyC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI;gBACzI,WAAW,EAAE,WAAW,WAAW,EAAE;gBACrC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;gBAC9C,WAAW;gBACX,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;YACH,MAAM,MAAM,GAA0C;gBACpD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;gBAChE,OAAO,EAAE,IAAI;aACd,CAAC;YACF,OAAO,kBAAkB,CACvB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,kBAAkB,EAClB,SAAS,CACV,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,CAAC;AAC5B,CAAC"}

package/dist/middleware/with-kya-os.session.d.ts

@@ -5,9 +5,17 @@
  * live here, so the borrowing semantics are preserved exactly) and the two proof
  * paths: `wrapWithProof` (success responses) and `attachOutcomeProof` (denied /
  * step-up / needs-authorization outcomes). Extracted from `./with-kya-os.ts`.
+ *
+ * Neither path signs in the handler. The MCP SDK changes a result after the
+ * handler returns: SDK 2 adds `resultType` on the 2026-07-28 revision, which
+ * the envelope profile covers; both SDKs fill in a missing `content`, and SDK
+ * 2 appends a text item to `content` when `structuredContent` is not an
+ * object, which the body profile covers. Both paths therefore leave the proof
+ * to the outer layer, the withKyaOs transport, which makes it over the result
+ * it sends, under either profile.
  */
-import type { KyaOsToolHandler } from "./with-kya-os.types.js";
-import type { MiddlewareDeps, AttachOutcomeProof } from "./with-kya-os.deps.js";
+import type { KyaOsToolHandler, KyaOsToolResult } from "./with-kya-os.types.js";
+import type { MiddlewareDeps, AttachOutcomeProof, RequireProofLayer } from "./with-kya-os.deps.js";
 /**
  * The private `_meta` member a middleware's wrappers stamp their results with
  * while an outer layer (the withKyaOs transport) reads them. It holds a random
@@ -17,7 +25,16 @@ import type { MiddlewareDeps, AttachOutcomeProof } from "./with-kya-os.deps.js";
  * that.
  */
 export declare const LIFECYCLE_STAMP_META_KEY = "org.kya-os/lifecycle-stamp";
-type ToolResult = Awaited<ReturnType<KyaOsToolHandler>>;
+/**
+ * The private `_meta` member that names the proof a wrapper left for the
+ * transport to make: a one-time id. What the proof
+ * claims stays in the middleware, keyed by that id, so code that can write a
+ * result cannot choose the claims. The transport redeems the id only on a
+ * result that also carries the middleware's stamp, and strips it as it strips
+ * the stamp. A string, so a copy of the result carries it too.
+ */
+export declare const PENDING_PROOF_META_KEY = "org.kya-os/pending-proof";
+type ToolResult = KyaOsToolResult;
 /**
  * Remove the `_meta` members only the middleware may set (proofs, proof error,
  * audit marker, lifecycle stamp) from a result it did not produce, keeping
@@ -25,16 +42,62 @@ type ToolResult = Awaited<ReturnType<KyaOsToolHandler>>;
  * is removed.
  */
 export declare function withoutOutcomeMeta<T extends ToolResult>(result: T): T;
-/** Remove the lifecycle stamp, which must never leave the process. */
-export declare function withoutLifecycleStamp<T extends ToolResult>(result: T): T;
+/**
+ * Remove the middleware's private members, which must never leave the
+ * process, from `result` and from everything nested in it, at any depth.
+ */
+export declare function withoutPrivateMeta<T extends ToolResult>(result: T): T;
+/** Any value without the middleware's private `_meta` members, at any depth. */
+export declare function withoutPrivateMembers(value: unknown): unknown;
+/** What the outer layer (the withKyaOs transport) does with a middleware's results. */
+export interface OuterProofLayer {
+    /**
+     * Count one more open transport, until the returned function is called.
+     * The wrappers refuse to run while none is open.
+     * Calling the returned function again does nothing.
+     */
+    open(): () => void;
+    /** Whether the middleware's wrappers returned `result`: it carries their stamp. */
+    owns(result: ToolResult): boolean;
+    /**
+     * `result` as it may leave the process: without the private members, and,
+     * when a wrapper left its proof to the transport, carrying that proof, made
+     * over `result` as it is now. Never throws: a proof that cannot be made is
+     * reported on the result, as one that fails in a wrapper is. A pending
+     * proof is redeemed once, and, when the result answers a `tools/call` the
+     * transport tracked, only by a proof left for that tool (`answering`).
+     */
+    send(result: ToolResult, answering?: {
+        toolName: string;
+    }): Promise<ToolResult>;
+    /**
+     * Any other part of an outgoing message (a notification's or request's
+     * `params`, an error's `data`) as it may leave the process: without the
+     * private members at any depth. A waiting proof whose id is found there
+     * is closed, so nothing can redeem it. Never throws.
+     */
+    scrub(value: unknown): unknown;
+}
 /**
  * Tell the middleware behind `wrapWithProof` that an outer layer (the withKyaOs
  * transport) reads its results. From then on its wrappers stamp what they
- * return with the middleware's token. Returns the check for that stamp, or
+ * return with the middleware's token and leave their proofs to the layer.
+ * Returns the layer's view of those results, or
  * undefined for a middleware this module did not create, whose results are
  * then never treated as its own.
  */
-export declare function attachOuterProofLayer(wrapWithProof: object): ((result: ToolResult) => boolean) | undefined;
+export declare function attachOuterProofLayer(wrapWithProof: object): OuterProofLayer | undefined;
+/**
+ * The fallback session for a call that threaded none, or why there is none:
+ * `ambiguous` when several sessions are live and the middleware refuses to
+ * pick one, which might be another client's.
+ */
+export type FallbackSession = {
+    sessionId: string;
+} | {
+    sessionId: undefined;
+    ambiguous: boolean;
+};
 export interface SessionProof {
     /** Establish a session from a handshake and cache it as the fallback. */
     handleHandshake(args: Record<string, unknown>): Promise<{
@@ -46,14 +109,17 @@ export interface SessionProof {
     }>;
     /**
      * Resolve the single-process fallback session for a call that threaded none —
-     * or auto-create one when `config.autoSession` is set. Returns undefined (skip
-     * the proof) when attribution would be ambiguous (multiple live sessions).
+     * or auto-create one when `config.autoSession` is set. Returns no session
+     * (skip the proof) when there is none, or, marked `ambiguous`, when
+     * attribution would be ambiguous (multiple live sessions).
      */
-    ensureSession(): Promise<string | undefined>;
+    ensureSession(): Promise<FallbackSession>;
     /** Wrap a tool handler to attach a holder-of-key proof to success responses. */
     wrapWithProof<T extends Record<string, unknown> = Record<string, unknown>>(toolName: string, handler: KyaOsToolHandler<T>): KyaOsToolHandler;
     /** Attach a signed proof recording an authorization outcome to a response. */
     attachOutcomeProof: AttachOutcomeProof;
+    /** Refuse a wrapped call whose proof could not be made where it is sent. */
+    requireProofLayer: RequireProofLayer;
 }
 export declare function createSessionProof(deps: MiddlewareDeps): SessionProof;
 export {};