@kya-os/mcp 1.18.0 → 1.20.0

package/dist/card/revocation.d.ts

@@ -10,11 +10,13 @@
  *
  * `createRevocationChecker` is the DEFAULT implementation over W3C Bitstring Status List v1.0
  * (`BitstringStatusListEntry` — the StatusList2021 SUCCESSOR). It resolves the entry's
- * `statusListCredential` through the injected, SSRF-hardened {@link SafeFetch} seam, inflates
- * the multibase / GZIP `encodedList` bitstring, and reads the bit at `statusListIndex`.
+ * `statusListCredential` through the injected, SSRF-hardened {@link SafeFetch} seam, checks the
+ * list's proof through the injected `verifyStatusList` seam when one is given, inflates the
+ * multibase / GZIP `encodedList` bitstring, and reads the bit at `statusListIndex`.
  *
- * FAIL-CLOSED is the invariant: an unreachable status list, a malformed credential, a
- * mismatched `statusPurpose`, or an out-of-range index all resolve to `{ revoked: true }` —
+ * FAIL-CLOSED is the invariant: an unreachable status list, a malformed credential, a list whose
+ * proof is rejected, a mismatched `statusPurpose`, or an out-of-range index all resolve to
+ * `{ revoked: true }` —
  * the absence of proof-of-liveness is treated as revoked, never as "probably fine".
  *
  * Each verdict also reports `fresh`: `true` only when read from a LIVE, in-validity-window
@@ -27,6 +29,7 @@
  */
 import type { SafeFetch } from '../utils/safe-fetch.js';
 import type { BitstringStatusListEntry } from './schema.js';
+import type { StatusListProofVerifier } from './status-list-proof.js';
 /** The `statusPurpose` this checker evaluates by default (revocation, not suspension). */
 export declare const STATUS_PURPOSE_REVOCATION = "revocation";
 /**
@@ -72,6 +75,14 @@ export interface RevocationCheckerDeps {
     now?: () => number;
     /** `statusPurpose` to honour; default {@link STATUS_PURPOSE_REVOCATION}. */
     statusPurpose?: string;
+    /**
+     * Checks the fetched status-list credential's proof before any bit is read, as W3C Bitstring
+     * Status List v1.0 requires (SPEC.md §6.10). A list it rejects (`false` or a throw) resolves
+     * {@link FAIL_CLOSED}. {@link createStatusListProofVerifier} covers `eddsa-jcs-2022` lists.
+     * Without it the bits are read unchecked, so whoever serves the list can clear a revocation;
+     * it stays optional until 2.0 only so existing callers keep working.
+     */
+    verifyStatusList?: StatusListProofVerifier;
     /**
      * Injectable GZIP inflation seam ({@link Decompress}). DEFAULT = `node:zlib` `gunzipSync` bounded
      * to the 16 MiB {@link MAX_STATUS_LIST_BYTES} `maxOutputLength` cap (so a decompression bomb

package/dist/card/revocation.js

@@ -10,11 +10,13 @@
  *
  * `createRevocationChecker` is the DEFAULT implementation over W3C Bitstring Status List v1.0
  * (`BitstringStatusListEntry` — the StatusList2021 SUCCESSOR). It resolves the entry's
- * `statusListCredential` through the injected, SSRF-hardened {@link SafeFetch} seam, inflates
- * the multibase / GZIP `encodedList` bitstring, and reads the bit at `statusListIndex`.
+ * `statusListCredential` through the injected, SSRF-hardened {@link SafeFetch} seam, checks the
+ * list's proof through the injected `verifyStatusList` seam when one is given, inflates the
+ * multibase / GZIP `encodedList` bitstring, and reads the bit at `statusListIndex`.
  *
- * FAIL-CLOSED is the invariant: an unreachable status list, a malformed credential, a
- * mismatched `statusPurpose`, or an out-of-range index all resolve to `{ revoked: true }` —
+ * FAIL-CLOSED is the invariant: an unreachable status list, a malformed credential, a list whose
+ * proof is rejected, a mismatched `statusPurpose`, or an out-of-range index all resolve to
+ * `{ revoked: true }` —
  * the absence of proof-of-liveness is treated as revoked, never as "probably fine".
  *
  * Each verdict also reports `fresh`: `true` only when read from a LIVE, in-validity-window
@@ -44,6 +46,9 @@ export function createRevocationChecker(deps) {
     return async function check(entry) {
         try {
             const credential = await fetchStatusList(entry.statusListCredential, deps.fetch);
+            if (deps.verifyStatusList && (await deps.verifyStatusList(credential)) !== true) {
+                throw new Error('revocation: status-list proof rejected');
+            }
             assertStatusPurpose(statusListSubject(credential).statusPurpose, wantedPurpose);
             const bits = await decodeStatusList(credential, decompress);
             const revoked = readStatusBit(bits, parseStatusListIndex(entry.statusListIndex));

package/dist/card/revocation.js.map

@@ -1 +1 @@
-{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/card/revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,aAAa,GACd,MAAM,6BAA6B,CAAC;AAIrC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,yBAAyB,GAAG,YAAY,CAAC;AAsEtD,kFAAkF;AAClF,MAAM,WAAW,GAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAEtE;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAA2B;IAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,yBAAyB,CAAC;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,OAAO,KAAK,UAAU,KAAK,CAAC,KAA+B;QACzD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACjF,mBAAmB,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;YAChF,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;YACjF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAA4C,EAC5C,KAAiC;IAEjC,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,+DAA+D;IAC/F,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QAClC,KAAK,GAAG,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC;QAC9B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE;oBACP,mBAAmB,GAAG,KAAK,KAAK,CAAC,oBAAoB,IAAI,KAAK,CAAC,eAAe,IAAI;wBAChF,+DAA+D;iBAClE;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAC1C,CAAC;AAED,kFAAkF;AAElF,8FAA8F;AAC9F,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,KAAgB;IAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAC5F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,SAAS,iBAAiB,CAAC,UAAmC;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC5F,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAAC,KAAiB;IAChD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,UAAmC,EACnC,UAAsB;IAEtB,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC;IAC1D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,UAAmC,EAAE,KAAa;IAChE,MAAM,UAAU,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IACzF,IAAI,UAAU,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,CAAC,qCAAqC;IAClG,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,+BAA+B;IACjG,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,GAAG,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,gBAAgB;IAChF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sFAAsF;AACtF,SAAS,YAAY,CAAC,OAAgB,EAAE,MAAe;IACrD,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAClD,CAAC;AAED,wGAAwG;AACxG,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC"}
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/card/revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,aAAa,GACd,MAAM,6BAA6B,CAAC;AAKrC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,yBAAyB,GAAG,YAAY,CAAC;AA8EtD,kFAAkF;AAClF,MAAM,WAAW,GAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAEtE;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAA2B;IAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,yBAAyB,CAAC;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,OAAO,KAAK,UAAU,KAAK,CAAC,KAA+B;QACzD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACjF,IAAI,IAAI,CAAC,gBAAgB,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAChF,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;YACD,mBAAmB,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;YAChF,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;YACjF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAA4C,EAC5C,KAAiC;IAEjC,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,+DAA+D;IAC/F,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QAClC,KAAK,GAAG,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC;QAC9B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE;oBACP,mBAAmB,GAAG,KAAK,KAAK,CAAC,oBAAoB,IAAI,KAAK,CAAC,eAAe,IAAI;wBAChF,+DAA+D;iBAClE;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAC1C,CAAC;AAED,kFAAkF;AAElF,8FAA8F;AAC9F,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,KAAgB;IAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAC5F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,SAAS,iBAAiB,CAAC,UAAmC;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC5F,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAAC,KAAiB;IAChD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,UAAmC,EACnC,UAAsB;IAEtB,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC;IAC1D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,UAAmC,EAAE,KAAa;IAChE,MAAM,UAAU,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IACzF,IAAI,UAAU,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,CAAC,qCAAqC;IAClG,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,+BAA+B;IACjG,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,GAAG,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,gBAAgB;IAChF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sFAAsF;AACtF,SAAS,YAAY,CAAC,OAAgB,EAAE,MAAe;IACrD,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAClD,CAAC;AAED,wGAAwG;AACxG,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC"}

package/dist/card/status-list-proof.d.ts

@@ -0,0 +1,32 @@
+/**
+ * KYA-OS Entity Card — status-list PROOF check (W3C Data Integrity, `eddsa-jcs-2022`).
+ *
+ * W3C Bitstring Status List v1.0 has a verifier check every proof on the status-list credential
+ * before it reads a bit: the list is what says a credential is revoked, so a list nobody verified
+ * lets whoever serves it clear a revocation. {@link createRevocationChecker} takes that check as
+ * its `verifyStatusList` seam, the way the rest of the card layer takes credential proofs, and
+ * {@link createStatusListProofVerifier} is a ready implementation for lists signed with
+ * `DataIntegrityProof` / `eddsa-jcs-2022` by an Ed25519 key in the list issuer's DID document.
+ *
+ * The construction is the cryptosuite's, step for step: the proof options without `proofValue`,
+ * carrying the document's `@context`, and the document without `proof`, each RFC 8785-canonicalized
+ * and SHA-256 hashed; the signature is Ed25519 over the two hashes concatenated, `proofValue` is
+ * base58btc multibase. The key is the issuer's verification method `proof.verificationMethod`
+ * names, and that method must belong to the list's `issuer`. Every failure returns `false`.
+ */
+import type { DIDResolver } from '../delegation/vc-verifier.types.js';
+/**
+ * Checks a fetched status-list credential's proof. Resolves `true` only when the proof verifies;
+ * `false` or a throw rejects the list, and the revocation checker then fails closed.
+ */
+export type StatusListProofVerifier = (credential: Record<string, unknown>) => boolean | Promise<boolean>;
+/** Dependencies for {@link createStatusListProofVerifier}. */
+export interface StatusListProofVerifierDeps {
+    /** Resolves the list issuer's DID document, e.g. `createDidWebResolver` or `createDidKeyResolver`. */
+    didResolver: DIDResolver;
+}
+/**
+ * Build a {@link StatusListProofVerifier} for `DataIntegrityProof` / `eddsa-jcs-2022` status lists.
+ * Pass it to {@link createRevocationChecker} as `verifyStatusList`.
+ */
+export declare function createStatusListProofVerifier(deps: StatusListProofVerifierDeps): StatusListProofVerifier;

package/dist/card/status-list-proof.js

@@ -0,0 +1,102 @@
+/**
+ * KYA-OS Entity Card — status-list PROOF check (W3C Data Integrity, `eddsa-jcs-2022`).
+ *
+ * W3C Bitstring Status List v1.0 has a verifier check every proof on the status-list credential
+ * before it reads a bit: the list is what says a credential is revoked, so a list nobody verified
+ * lets whoever serves it clear a revocation. {@link createRevocationChecker} takes that check as
+ * its `verifyStatusList` seam, the way the rest of the card layer takes credential proofs, and
+ * {@link createStatusListProofVerifier} is a ready implementation for lists signed with
+ * `DataIntegrityProof` / `eddsa-jcs-2022` by an Ed25519 key in the list issuer's DID document.
+ *
+ * The construction is the cryptosuite's, step for step: the proof options without `proofValue`,
+ * carrying the document's `@context`, and the document without `proof`, each RFC 8785-canonicalized
+ * and SHA-256 hashed; the signature is Ed25519 over the two hashes concatenated, `proofValue` is
+ * base58btc multibase. The key is the issuer's verification method `proof.verificationMethod`
+ * names, and that method must belong to the list's `issuer`. Every failure returns `false`.
+ */
+import { canonicalize } from 'json-canonicalize';
+import { isRecord } from '../utils/guards.js';
+import { base58Decode } from '../utils/base58.js';
+import { verificationMethodJwk } from '../delegation/verification-method-key.js';
+import { ed25519VerifyRaw, sha256 } from './proof/canonical.js';
+const ED25519_SIGNATURE_LENGTH = 64;
+/** A 64-byte signature is at most 88 base58 characters; bound the decode before it runs. */
+const MAX_PROOF_VALUE_BASE58 = 100;
+/**
+ * Build a {@link StatusListProofVerifier} for `DataIntegrityProof` / `eddsa-jcs-2022` status lists.
+ * Pass it to {@link createRevocationChecker} as `verifyStatusList`.
+ */
+export function createStatusListProofVerifier(deps) {
+    return async function verifyStatusList(credential) {
+        try {
+            return await verifyEddsaJcs2022(credential, deps.didResolver);
+        }
+        catch {
+            return false;
+        }
+    };
+}
+async function verifyEddsaJcs2022(document, didResolver) {
+    const proof = document.proof;
+    // One proof object: a proof set or chain is not a shape this check reads.
+    if (!isRecord(proof))
+        return false;
+    if (proof.type !== 'DataIntegrityProof' || proof.cryptosuite !== 'eddsa-jcs-2022')
+        return false;
+    if (proof.proofPurpose !== 'assertionMethod')
+        return false;
+    const { proofValue, verificationMethod } = proof;
+    if (typeof proofValue !== 'string' || !proofValue.startsWith('z'))
+        return false;
+    if (typeof verificationMethod !== 'string')
+        return false;
+    const issuer = issuerOf(document);
+    const did = verificationMethod.split('#')[0];
+    if (issuer === undefined || did !== issuer)
+        return false;
+    const signature = base58Decode(proofValue.slice(1), MAX_PROOF_VALUE_BASE58);
+    if (signature.length !== ED25519_SIGNATURE_LENGTH)
+        return false;
+    const didDocument = await didResolver.resolve(did);
+    const method = didDocument?.verificationMethod?.find((vm) => methodId(vm, did) === verificationMethod);
+    const jwk = method ? verificationMethodJwk(method) : undefined;
+    if (!jwk || jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519')
+        return false;
+    const unsecured = { ...document };
+    delete unsecured.proof;
+    const options = { ...proof };
+    delete options.proofValue;
+    if (options['@context'] !== undefined) {
+        // The proof may name its own @context only as a prefix of the document's.
+        if (!startsWith(contexts(document['@context']), contexts(options['@context'])))
+            return false;
+        unsecured['@context'] = options['@context'];
+    }
+    if (unsecured['@context'] !== undefined)
+        options['@context'] = unsecured['@context'];
+    const encoder = new TextEncoder();
+    const proofHash = await sha256(encoder.encode(canonicalize(options)));
+    const documentHash = await sha256(encoder.encode(canonicalize(unsecured)));
+    const hashData = new Uint8Array(proofHash.length + documentHash.length);
+    hashData.set(proofHash, 0);
+    hashData.set(documentHash, proofHash.length);
+    return ed25519VerifyRaw(jwk, signature, hashData);
+}
+/** The credential's `issuer` DID, whether a bare string or an `{ id }` object. */
+function issuerOf(document) {
+    const issuer = document.issuer;
+    if (typeof issuer === 'string')
+        return issuer;
+    return isRecord(issuer) && typeof issuer.id === 'string' ? issuer.id : undefined;
+}
+/** A verification method's absolute id: DID documents may write it relative (`#key-1`). */
+function methodId(method, did) {
+    return method.id.startsWith('#') ? `${did}${method.id}` : method.id;
+}
+function contexts(value) {
+    return Array.isArray(value) ? value : value === undefined ? [] : [value];
+}
+function startsWith(whole, prefix) {
+    return prefix.length <= whole.length && prefix.every((entry, i) => canonicalize(entry) === canonicalize(whole[i]));
+}
+//# sourceMappingURL=status-list-proof.js.map

package/dist/card/status-list-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-list-proof.js","sourceRoot":"","sources":["../../src/card/status-list-proof.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAchE,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,4FAA4F;AAC5F,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAiC;IAC7E,OAAO,KAAK,UAAU,gBAAgB,CAAC,UAAmC;QACxE,IAAI,CAAC;YACH,OAAO,MAAM,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,QAAiC,EAAE,WAAwB;IAC3F,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,0EAA0E;IAC1E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,IAAI,KAAK,CAAC,WAAW,KAAK,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAChG,IAAI,KAAK,CAAC,YAAY,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC;IACjD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,IAAI,OAAO,kBAAkB,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEzD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAEzD,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC5E,IAAI,SAAS,CAAC,MAAM,KAAK,wBAAwB;QAAE,OAAO,KAAK,CAAC;IAEhE,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,WAAW,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,kBAAkB,CAAC,CAAC;IACvG,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAErE,MAAM,SAAS,GAA4B,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC3D,OAAO,SAAS,CAAC,KAAK,CAAC;IACvB,MAAM,OAAO,GAA4B,EAAE,GAAG,KAAK,EAAE,CAAC;IACtD,OAAO,OAAO,CAAC,UAAU,CAAC;IAC1B,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;QACtC,0EAA0E;QAC1E,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7F,SAAS,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAErF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACxE,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,QAAiC;IACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACnF,CAAC;AAED,2FAA2F;AAC3F,SAAS,QAAQ,CAAC,MAA0B,EAAE,GAAW;IACvD,OAAO,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,UAAU,CAAC,KAAgB,EAAE,MAAiB;IACrD,OAAO,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrH,CAAC"}

package/dist/delegation/verification-method-key.d.ts

@@ -1,4 +1,6 @@
 import type { VerificationMethod } from './vc-verifier.types.js';
+/** The verification-method fields that can carry an Ed25519 public key. */
+type VerificationMethodKeyMaterial = Pick<VerificationMethod, 'publicKeyJwk' | 'publicKeyMultibase' | 'publicKeyBase58'>;
 /**
  * The verification method's public key as an Ed25519 OKP JWK: an existing
  * `publicKeyJwk` is returned untouched (byte-for-byte — zero behavior change
@@ -7,8 +9,9 @@ import type { VerificationMethod } from './vc-verifier.types.js';
  * prefix) or legacy `publicKeyBase58`. `undefined` when no usable Ed25519 key
  * is present (fail-closed).
  */
-export declare function verificationMethodJwk(method: VerificationMethod): {
+export declare function verificationMethodJwk(method: VerificationMethodKeyMaterial): {
     kty: string;
     crv: string;
     x: string;
 } | undefined;
+export {};

package/dist/delegation/verification-method-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"verification-method-key.js","sourceRoot":"","sources":["../../src/delegation/verification-method-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAG/B,sCAAsC;AACtC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA0B;IAE1B,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,YAAuD,CAAC;IACxE,CAAC;IAED,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,iHAAiH;AACjH,SAAS,aAAa,CAAC,MAA0B;IAC/C,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,kBAAkB,EAAE,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC/D,wEAAwE;YACxE,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;YAC3F,MAAM,QAAQ,GACZ,OAAO,CAAC,MAAM,KAAK,yBAAyB,GAAG,yBAAyB,CAAC,MAAM;gBAC/E,OAAO,CAAC,CAAC,CAAC,KAAK,yBAAyB,CAAC,CAAC,CAAC;gBAC3C,OAAO,CAAC,CAAC,CAAC,KAAK,yBAAyB,CAAC,CAAC,CAAC;gBACzC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,MAAM,CAAC;gBACjD,CAAC,CAAC,OAAO,CAAC;YACd,OAAO,QAAQ,CAAC,MAAM,KAAK,yBAAyB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,CAAC;QACD,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;YAC/E,OAAO,OAAO,CAAC,MAAM,KAAK,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,iCAAiC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"verification-method-key.js","sourceRoot":"","sources":["../../src/delegation/verification-method-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAG/B,sCAAsC;AACtC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAQhC;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAqC;IAErC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,YAAuD,CAAC;IACxE,CAAC;IAED,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,iHAAiH;AACjH,SAAS,aAAa,CAAC,MAAqC;IAC1D,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,kBAAkB,EAAE,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC/D,wEAAwE;YACxE,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;YAC3F,MAAM,QAAQ,GACZ,OAAO,CAAC,MAAM,KAAK,yBAAyB,GAAG,yBAAyB,CAAC,MAAM;gBAC/E,OAAO,CAAC,CAAC,CAAC,KAAK,yBAAyB,CAAC,CAAC,CAAC;gBAC3C,OAAO,CAAC,CAAC,CAAC,KAAK,yBAAyB,CAAC,CAAC,CAAC;gBACzC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,MAAM,CAAC;gBACjD,CAAC,CAAC,OAAO,CAAC;YACd,OAAO,QAAQ,CAAC,MAAM,KAAK,yBAAyB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,CAAC;QACD,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;YAC/E,OAAO,OAAO,CAAC,MAAM,KAAK,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,iCAAiC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/index.d.ts

@@ -51,7 +51,7 @@ export { AuditLogProvider, MemoryAuditLogProvider, NoopAuditLogProvider, buildAu
 export * from './audit/index.js';
 export { GrantStore, MemoryGrantStore, type Grant, type MemoryGrantStoreOptions, } from './providers/grant-store.js';
 export { PendingFlowStore, MemoryPendingFlowStore, type PendingFlow, type MemoryPendingFlowStoreOptions, } from './authz/oidc/pending-flow-store.js';
-export { createKyaOsMiddleware, type KyaOsConfig, type KyaOsDelegationConfig, type KyaOsIdentityConfig, type KyaOsMiddleware, type KyaOsToolDefinition, type KyaOsToolHandler, type KyaOsServer, withKyaOs, generateIdentity, type WithKyaOsOptions, } from './middleware/index.js';
+export { createKyaOsMiddleware, type KyaOsConfig, type KyaOsDelegationConfig, type KyaOsIdentityConfig, type KyaOsMiddleware, type KyaOsToolDefinition, type KyaOsToolHandler, type KyaOsToolResult, type KyaOsServer, type KyaOsAuthorizationOutcome, type KyaOsOutcomeProofRequest, type KyaOsOutcomeProver, type KyaOsChallengeResult, type KyaOsChallengeFormatter, withKyaOs, generateIdentity, type WithKyaOsOptions, toMcpToolCallback, type McpToolCallback, type McpToolCallbackResult, createKyaOsTransport, serveInProcess, type InProcessServer, } from './middleware/index.js';
 export * from './policy/index.js';
 export { matchScope, scopeSatisfies, type ScopeMatcher, type ScopeSatisfaction, } from './delegation/scope-matcher.js';
 export { logger, createDefaultConsoleLogger, type Logger, type Level, } from './logging/index.js';

package/dist/index.js

@@ -63,7 +63,7 @@ export { GrantStore, MemoryGrantStore, } from './providers/grant-store.js';
 // Pending OAuth/OIDC PKCE-flow store (durable resume across instances/restarts).
 export { PendingFlowStore, MemoryPendingFlowStore, } from './authz/oidc/pending-flow-store.js';
 // Middleware
-export { createKyaOsMiddleware, withKyaOs, generateIdentity, } from './middleware/index.js';
+export { createKyaOsMiddleware, withKyaOs, generateIdentity, toMcpToolCallback, createKyaOsTransport, serveInProcess, } from './middleware/index.js';
 // Policy-as-Code subsystem + step-up gate
 export * from './policy/index.js';
 export { matchScope, scopeSatisfies, } from './delegation/scope-matcher.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,iBAAiB;AACjB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GAGjB,MAAM,aAAa,CAAC;AAErB,2EAA2E;AAC3E,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAC;AA+B3B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,+BAA+B,GAEhC,MAAM,qBAAqB,CAAC;AAE7B,oBAAoB;AACpB,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GAIvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,GASzB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GAGtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAGxB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GAIjC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,gBAAgB,EAChB,UAAU,GAGX,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GAGjB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,GAGtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,UAAU,GAGX,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,GAKrB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAE5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAE5F,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,GAEpB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,GAGjB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,wBAAwB,GAIzB,MAAM,uCAAuC,CAAC;AAE/C,QAAQ;AACR,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAEhC,cAAc;AACd,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,GAQvB,MAAM,iBAAiB,CAAC;AAEzB,eAAe;AACf,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,gCAAgC,EAChC,qBAAqB,GAKtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,GAIvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,mBAAmB,CAAC;AAE3B,iBAAiB;AACjB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,kBAAkB,GAInB,MAAM,oBAAoB,CAAC;AAE5B,YAAY;AACZ,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GAGjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAElC,8CAA8C;AAC9C,cAAc,kBAAkB,CAAC;AAEjC,8EAA8E;AAC9E,8EAA8E;AAC9E,OAAO,EACL,UAAU,EACV,gBAAgB,GAGjB,MAAM,4BAA4B,CAAC;AAEpC,iFAAiF;AACjF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,GAGvB,MAAM,oCAAoC,CAAC;AAE5C,aAAa;AACb,OAAO,EACL,qBAAqB,EAQrB,SAAS,EACT,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAE/B,0CAA0C;AAC1C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,UAAU,EACV,cAAc,GAGf,MAAM,+BAA+B,CAAC;AAEvC,UAAU;AACV,OAAO,EACL,MAAM,EACN,0BAA0B,GAG3B,MAAM,oBAAoB,CAAC;AAE5B,oBAAoB;AACpB,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAE1B,yFAAyF;AACzF,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,uCAAuC,EACvC,6BAA6B,EAC7B,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,gBAAgB,EAChB,8BAA8B,EAC9B,uBAAuB,GAUxB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,iBAAiB;AACjB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GAGjB,MAAM,aAAa,CAAC;AAErB,2EAA2E;AAC3E,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAC;AA+B3B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,+BAA+B,GAEhC,MAAM,qBAAqB,CAAC;AAE7B,oBAAoB;AACpB,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GAIvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,GASzB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GAGtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAGxB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GAIjC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,gBAAgB,EAChB,UAAU,GAGX,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GAGjB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,GAGtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,UAAU,GAGX,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,GAKrB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAE5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAE5F,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,GAEpB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,GAGjB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,wBAAwB,GAIzB,MAAM,uCAAuC,CAAC;AAE/C,QAAQ;AACR,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAEhC,cAAc;AACd,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,GAQvB,MAAM,iBAAiB,CAAC;AAEzB,eAAe;AACf,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,gCAAgC,EAChC,qBAAqB,GAKtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,GAIvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,mBAAmB,CAAC;AAE3B,iBAAiB;AACjB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,kBAAkB,GAInB,MAAM,oBAAoB,CAAC;AAE5B,YAAY;AACZ,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GAGjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAElC,8CAA8C;AAC9C,cAAc,kBAAkB,CAAC;AAEjC,8EAA8E;AAC9E,8EAA8E;AAC9E,OAAO,EACL,UAAU,EACV,gBAAgB,GAGjB,MAAM,4BAA4B,CAAC;AAEpC,iFAAiF;AACjF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,GAGvB,MAAM,oCAAoC,CAAC;AAE5C,aAAa;AACb,OAAO,EACL,qBAAqB,EAcrB,SAAS,EACT,gBAAgB,EAEhB,iBAAiB,EAGjB,oBAAoB,EACpB,cAAc,GAEf,MAAM,uBAAuB,CAAC;AAE/B,0CAA0C;AAC1C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,UAAU,EACV,cAAc,GAGf,MAAM,+BAA+B,CAAC;AAEvC,UAAU;AACV,OAAO,EACL,MAAM,EACN,0BAA0B,GAG3B,MAAM,oBAAoB,CAAC;AAE5B,oBAAoB;AACpB,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAE1B,yFAAyF;AACzF,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,uCAAuC,EACvC,6BAA6B,EAC7B,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,gBAAgB,EAChB,8BAA8B,EAC9B,uBAAuB,GAUxB,MAAM,sBAAsB,CAAC"}

package/dist/middleware/index.d.ts

@@ -6,8 +6,10 @@
  *
  * For the low-level `Server` API or custom patterns, use `createKyaOsMiddleware` directly.
  */
-export { createKyaOsMiddleware, type KyaOsConfig, type KyaOsDelegationConfig, type KyaOsIdentityConfig, type KyaOsMiddleware, type KyaOsToolDefinition, type KyaOsToolHandler, type KyaOsServer, } from './with-kya-os.js';
+export { createKyaOsMiddleware, type KyaOsConfig, type KyaOsDelegationConfig, type KyaOsIdentityConfig, type KyaOsMiddleware, type KyaOsToolDefinition, type KyaOsToolHandler, type KyaOsToolResult, type KyaOsServer, type KyaOsAuthorizationOutcome, type KyaOsOutcomeProofRequest, type KyaOsOutcomeProver, type KyaOsChallengeResult, type KyaOsChallengeFormatter, } from './with-kya-os.js';
 export { withKyaOs, generateIdentity, type WithKyaOsOptions, } from './with-kya-os-server.js';
+export { toMcpToolCallback, type McpToolCallback, type McpToolCallbackResult, } from './mcp-tool-callback.js';
 export { createKyaOsTransport, type Transport, type JSONRPCMessage, } from './kya-os-transport.js';
+export { serveInProcess, type InProcessServer } from './serve-in-process.js';
 export { card, CardBuilder, type CardBuilderInit, type AccountableToOptions, type VcInput, } from '../card/builder.js';
 export { withKyaOsCard, requireProof, readCardProof, type KyaOsCardMount, type ServerJsonLike, type DidDocumentLike, type ProofGuard, type ProofGateResult, type ProofGateError, type ProofGateCode, type RequireProofOptions, type MinProofLevel, } from '../card/middleware.js';

package/dist/middleware/index.js

@@ -8,7 +8,9 @@
  */
 export { createKyaOsMiddleware, } from './with-kya-os.js';
 export { withKyaOs, generateIdentity, } from './with-kya-os-server.js';
+export { toMcpToolCallback, } from './mcp-tool-callback.js';
 export { createKyaOsTransport, } from './kya-os-transport.js';
+export { serveInProcess } from './serve-in-process.js';
 // Entity Card DevX surface — the 10-minute adoption path. The fluent `card()` builder and the
 // `withKyaOsCard` / `requireProof` wrappers hide the RFC 9421/9449/8785 machinery behind
 // ergonomics (see `src/card/builder.ts` + `src/card/middleware.ts`).

package/dist/middleware/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,qBAAqB,GAQtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,SAAS,EACT,gBAAgB,GAEjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,oBAAoB,GAGrB,MAAM,uBAAuB,CAAC;AAE/B,8FAA8F;AAC9F,yFAAyF;AACzF,qEAAqE;AACrE,OAAO,EACL,IAAI,EACJ,WAAW,GAIZ,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,aAAa,GAUd,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,qBAAqB,GActB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,SAAS,EACT,gBAAgB,GAEjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,GAGlB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,oBAAoB,GAGrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,cAAc,EAAwB,MAAM,uBAAuB,CAAC;AAE7E,8FAA8F;AAC9F,yFAAyF;AACzF,qEAAqE;AACrE,OAAO,EACL,IAAI,EACJ,WAAW,GAIZ,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,aAAa,GAUd,MAAM,uBAAuB,CAAC"}

package/dist/middleware/kya-os-transport.d.ts

@@ -13,30 +13,61 @@
  *   1. Incoming `tools/call` requests are captured (by id) to record tool
  *      name and arguments for proof generation.
  *   2. Outgoing responses for those ids get a proof injected into `_meta`,
- *      unless the middleware's own wrappers already proved or audited the
- *      result, which they mark with a private per-middleware stamp.
- *   3. All other message types pass through unmodified, except that the
- *      stamp is removed from every result before it is sent.
+ *      unless the middleware's own wrappers produced the result, which they
+ *      mark with a private per-middleware stamp.
+ *   3. The wrappers leave their proofs here, and every proof is made in
+ *      `send()`, over the result as the MCP SDK finished it: the SDK changes
+ *      a result after the handler returns (`resultType` on the 2026-07-28
+ *      revision, a filled-in or appended `content`), and the proof covers
+ *      what it covers of the result the client receives.
+ *   4. All other message types pass through unmodified, except that the
+ *      middleware's private members are removed from every result before it
+ *      is sent.
  *
  * @module kya-os-transport
  */
 import type { KyaOsMiddleware } from "./with-kya-os.js";
-/** Minimal Transport interface — matches @modelcontextprotocol/sdk Transport */
+/**
+ * Minimal Transport interface — matches @modelcontextprotocol/sdk Transport.
+ * The callbacks are declared as methods, so an SDK transport, whose callbacks
+ * take the SDK's own message type, is accepted as it is (SDK 1 and SDK 2).
+ * The SDK's send options and message context (`extra`: the session id,
+ * `authInfo`, `requestInfo`) are opaque here and passed through unchanged.
+ */
 export interface Transport {
     start(): Promise<void>;
-    send(message: JSONRPCMessage): Promise<void>;
+    send(message: JSONRPCMessage, options?: unknown): Promise<void>;
     close(): Promise<void>;
-    onmessage?: (message: JSONRPCMessage) => void;
-    onclose?: () => void;
-    onerror?: (error: Error) => void;
+    onmessage?(message: JSONRPCMessage, extra?: unknown): void;
+    onclose?(): void;
+    onerror?(error: Error): void;
+    sessionId?: string;
+    setProtocolVersion?(version: string): void;
+    setSupportedProtocolVersions?(versions: string[]): void;
+    /** SDK 2: installs per-tool OAuth `scopeChallenge` enforcement on an HTTP transport. */
+    setScopeChallengeResolver?(resolver: unknown): void;
+    readonly hasPerRequestStream?: boolean;
 }
 export type JSONRPCMessage = Record<string, unknown>;
 /**
  * Creates a transport wrapper that injects KYA-OS proofs into `tools/call`
- * responses.
+ * responses, and makes the proofs the middleware's wrappers and
+ * `proveOutcome` leave to it, over each result as it is sent. A server on the
+ * low-level `Server` API connects through it:
+ * `server.connect(createKyaOsTransport(transport, kyaos))`.
+ *
+ * It proves and audits the result of every tool it is not told to exclude,
+ * including tools registered without a wrapper, as `withKyaOs` does. A
+ * low-level server that used only the wrappers on an unwrapped transport,
+ * which 1.19.0 allowed, sent its unwrapped tools' results unproven; through
+ * this transport they carry a proof too.
  *
  * @param inner   - The real transport (Stdio, HTTP, etc.)
  * @param kyaos    - Configured KyaOsMiddleware instance
- * @param exclude - Tool names to skip proof generation for
+ * @param exclude - More tool names whose results are not proved by the
+ *   transport itself, in addition to the protocol tools `_kyaos` and
+ *   `_kyaos_handshake`, which are always excluded (as `excludeTools` adds
+ *   to them in `withKyaOs`). A wrapper's own proof is made whatever this
+ *   says.
  */
-export declare function createKyaOsTransport(inner: Transport, kyaos: KyaOsMiddleware, exclude?: string[]): Transport;
+export declare function createKyaOsTransport(inner: Transport, kyaos: KyaOsMiddleware, exclude?: readonly string[]): Transport;