@kya-os/mcp 1.18.0 → 1.20.0

package/dist/middleware/with-kya-os.delegation-gate.d.ts

@@ -7,13 +7,14 @@
  * `./with-kya-os.ts`; verification plumbing lives in `./with-kya-os.delegation-verify.ts`.
  */
 import type { KyaOsDelegationGate } from "./with-kya-os.types.js";
-import type { MiddlewareDeps, AttachOutcomeProof } from "./with-kya-os.deps.js";
+import type { MiddlewareDeps, AttachOutcomeProof, RequireProofLayer } from "./with-kya-os.deps.js";
 import type { GrantResolution } from "./with-kya-os.grants.js";
 import { type DelegationVerification } from "./with-kya-os.delegation-verify.js";
 /** Collaborators the delegation gate borrows from its sibling sub-factories. */
 export interface DelegationGateWiring {
     delegationVerification: DelegationVerification;
     attachOutcomeProof: AttachOutcomeProof;
+    requireProofLayer: RequireProofLayer;
     resolveExistingGrant: GrantResolution["resolveExistingGrant"];
     bindGrantOnSuccess: GrantResolution["bindGrantOnSuccess"];
 }

package/dist/middleware/with-kya-os.delegation-gate.js

@@ -6,12 +6,12 @@
  * `_kyaos*` control namespace and runs the handler. Extracted from
  * `./with-kya-os.ts`; verification plumbing lives in `./with-kya-os.delegation-verify.ts`.
  */
-import { isHolderBindingApplicable, isKyaOsControlArg, assertHolderBinding, toHolderBindingRequest, } from "../delegation/holder-binding.js";
+import { isHolderBindingApplicable, assertHolderBinding, toHolderBindingRequest, } from "../delegation/holder-binding.js";
 import { scopeSatisfies } from "../delegation/scope-matcher.js";
 import { getDelegationScopes } from "../delegation/chain-enforcement.js";
 import { logger } from "../logging/index.js";
 import { KYA_OS_ERROR_CODES } from "../errors.js";
-import { sanitizeForMessage } from "./with-kya-os.helpers.js";
+import { sanitizeForMessage, withoutControlArgs } from "./with-kya-os.helpers.js";
 import { canonicalizeJsonBytes } from "../utils/canonical-json.js";
 const MAX_AUDIT_REFERENCE_LENGTH = 256;
 /** Extract only a bounded string from an untrusted credential-shaped value. */
@@ -51,10 +51,11 @@ function forwardedApprovals(args) {
 }
 export function createDelegationGate(deps, wiring) {
     const { identity, holderBindingMode, holderBindingVerifier, audit, cryptoProvider } = deps;
-    const { attachOutcomeProof, resolveExistingGrant, bindGrantOnSuccess } = wiring;
+    const { attachOutcomeProof, requireProofLayer, resolveExistingGrant, bindGrantOnSuccess } = wiring;
     const { verifyDelegation, buildDelegationErrorResponse, buildNeedsAuthorizationChallenge, } = wiring.delegationVerification;
     function wrapWithDelegation(toolName, config, handler) {
         return async (args, sessionId) => {
+            requireProofLayer();
             const delegationArg = args["_kyaos_delegation"];
             if (delegationArg === undefined || delegationArg === null) {
                 // No delegation pasted — a durable grant may already authorize this call
@@ -65,11 +66,7 @@ export function createDelegationGate(deps, wiring) {
                 const resolvedGrant = await resolveExistingGrant(toolName, args, sessionId, config.scopeId);
                 if (resolvedGrant) {
                     const existingGrant = resolvedGrant.grant;
-                    const grantArgs = {};
-                    for (const [k, v] of Object.entries(args)) {
-                        if (!isKyaOsControlArg(k))
-                            grantArgs[k] = v;
-                    }
+                    const grantArgs = withoutControlArgs(args);
                     logger.debug(`[kya-os] Grant resolved for "${toolName}" (scope "${config.scopeId}") — no re-paste required`);
                     const grantContext = {
                         scopeId: config.scopeId,
@@ -104,11 +101,12 @@ export function createDelegationGate(deps, wiring) {
                 }
                 // No delegation provided — sign & return the needs_authorization
                 // challenge. The proof binds a responseHash over the EMITTED challenge
-                // content (incl. the authorizationUrl), so a verifier that recomputes it
-                // over the content it received detects a tampered/MITM-swapped consent
-                // URL. Best-effort: attachOutcomeProof no-ops if no session resolves.
-                const { challengeContent, message } = await buildNeedsAuthorizationChallenge(toolName, config);
-                return attachOutcomeProof({ content: challengeContent }, toolName, args, sessionId, message, "needs_authorization", undefined, challengeContent);
+                // (incl. the authorizationUrl; the envelope under the envelope profile),
+                // so a verifier that recomputes it over what it received detects a
+                // tampered/MITM-swapped consent URL. Best-effort: attachOutcomeProof
+                // no-ops if no session resolves.
+                const { challenge, message } = await buildNeedsAuthorizationChallenge(toolName, config);
+                return attachOutcomeProof(challenge, toolName, args, sessionId, message, "needs_authorization");
             }
             // Authenticate the presented delegation (object embedded-proof OR VC-JWT
             // string) and normalize it to a verified credential. verifyDelegation owns
@@ -231,11 +229,7 @@ export function createDelegationGate(deps, wiring) {
             // Strip the reserved _kyaos* control namespace before passing to the
             // handler — same predicate the bound request hash uses, so the handler
             // receives exactly the call the subject signed (no smuggled control arg).
-            const cleanArgs = {};
-            for (const [k, v] of Object.entries(args)) {
-                if (!isKyaOsControlArg(k))
-                    cleanArgs[k] = v;
-            }
+            const cleanArgs = withoutControlArgs(args);
             // Mint a durable grant from this verified delegation so the next call —
             // on any instance — resolves via resolveExistingGrant with no re-paste.
             await bindGrantOnSuccess(vc, delegationArg, isJwt, sessionId, config.scopeId, check.expiresAt);

package/dist/middleware/with-kya-os.delegation-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.delegation-gate.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAEzE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAQlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAOnE,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC,+EAA+E;AAC/E,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAClE,MAAM,UAAU,GAAG,KAAgC,CAAC;QACpD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC;QAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACtE,MAAM,UAAU,GAAI,OAAmC,CAAC,UAAU,CAAC;QACnE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5E,MAAM,MAAM,GAAI,UAAsC,CAAC,EAAE,CAAC;QAC1D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YACpD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,IAA6B;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC3C,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;AACtD,CAAC;AAUD,MAAM,UAAU,oBAAoB,CAClC,IAAoB,EACpB,MAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAC3F,MAAM,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GACpE,MAAM,CAAC;IACT,MAAM,EACJ,gBAAgB,EAChB,4BAA4B,EAC5B,gCAAgC,GACjC,GAAG,MAAM,CAAC,sBAAsB,CAAC;IAElC,SAAS,kBAAkB,CACzB,QAAgB,EAChB,MAA4B,EAC5B,OAAyB;QAEzB,OAAO,KAAK,EAAE,IAA6B,EAAE,SAAkB,EAAE,EAAE;YACjE,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAEhD,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC1D,yEAAyE;gBACzE,oEAAoE;gBACpE,yEAAyE;gBACzE,uEAAuE;gBACvE,yEAAyE;gBACzE,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAC9C,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CAAC,OAAO,CACf,CAAC;gBACF,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC;oBAC1C,MAAM,SAAS,GAA4B,EAAE,CAAC;oBAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;4BAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBAC9C,CAAC;oBACD,MAAM,CAAC,KAAK,CACV,gCAAgC,QAAQ,aAAa,MAAM,CAAC,OAAO,2BAA2B,CAC/F,CAAC;oBACF,MAAM,YAAY,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,KAAK,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE;wBACrE,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;4BAC3C,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,EAAE;4BACrF,CAAC,CAAC,EAAE,CAAC;wBACP,aAAa,EAAE;4BACb,MAAM,EAAE,OAAgB;4BACxB,QAAQ,EAAE,SAAkB;4BAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;4BACvB,QAAQ,EAAE,aAAa,CAAC,EAAE;4BAC1B,gBAAgB,EAAE,wBAAwB;yBAC3C;qBACF,CAAC;oBACF,MAAM,KAAK,EAAE,aAAa,CAAC,YAAY,EAAE;wBACvC,OAAO,EAAE,WAAW;wBACpB,QAAQ,EAAE,aAAa,CAAC,EAAE;wBAC1B,OAAO,EAAE,YAAY;qBACtB,CAAC,CAAC;oBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE;wBACnC,GAAG,YAAY;wBACf,SAAS,EAAE;4BACT,QAAQ,EAAE,aAAa,CAAC,QAAQ;4BAChC,GAAG,CAAC,aAAa,CAAC,OAAO,KAAK,SAAS;gCACrC,CAAC,CAAC,EAAE,gBAAgB,EAAE,aAAa,CAAC,OAAO,EAAE;gCAC7C,CAAC,CAAC,EAAE,CAAC;4BACP,eAAe,EAAE,aAAa,CAAC,eAAe;yBAC/C;wBACD,GAAG,kBAAkB,CAAC,IAAI,CAAC;qBAC5B,CAAC,CAAC;gBACL,CAAC;gBAED,iEAAiE;gBACjE,uEAAuE;gBACvE,yEAAyE;gBACzE,uEAAuE;gBACvE,sEAAsE;gBACtE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,GACjC,MAAM,gCAAgC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC3D,OAAO,kBAAkB,CACvB,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAC7B,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,OAAO,EACP,qBAAqB,EACrB,SAAS,EACT,gBAAgB,CACjB,CAAC;YACJ,CAAC;YAED,yEAAyE;YACzE,2EAA2E;YAC3E,gEAAgE;YAChE,qEAAqE;YACrE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,aAAa,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE;wBAClC,aAAa,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC9C,OAAO,EAAE,QAAQ;wBACjB,UAAU,EAAE,gCAAgC;qBAC7C,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE;wBACxE,IAAI,EAAE,QAAQ;wBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,CAAC,IAAI,CACT,gDAAgD,QAAQ,MAAM,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CACjG,CAAC;gBACF,OAAO,kBAAkB,CACvB,4BAA4B,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,EACjF,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,KAAK,CAAC,MAAM,CACb,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;YAE5B,oEAAoE;YACpE,0EAA0E;YAC1E,2EAA2E;YAC3E,4EAA4E;YAC5E,4EAA4E;YAC5E,IAAI,iBAAiB,KAAK,KAAK,IAAI,qBAAqB,EAAE,CAAC;gBACzD,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBAC5C,IAAI,UAAU,IAAI,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;oBACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;oBACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAC3B,MAAM,MAAM,GACV,4EAA4E,CAAC;wBAC/E,MAAM,CAAC,IAAI,CACT,6BAA6B,QAAQ,+BAA+B,CACrE,CAAC;wBACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;4BACpC,OAAO,kBAAkB,CACvB,4BAA4B,CAC1B,kBAAkB,CAAC,qBAAqB,EACxC,MAAM,CACP,EACD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;wBACJ,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,IAAI,WAAW,GAAY,QAAQ,CAAC;wBACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;4BACjC,IAAI,CAAC;gCACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;4BACrC,CAAC;4BAAC,MAAM,CAAC;gCACP,WAAW,GAAG,EAAE,CAAC;4BACnB,CAAC;wBACH,CAAC;wBACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;4BACxC,KAAK,EAAE,WAA4B;4BACnC,UAAU;4BACV,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC;4BAC/C,gBAAgB,EAAE,QAAQ,CAAC,GAAG;4BAC9B,aAAa,EAAE,qBAAqB;yBACrC,CAAC,CAAC;wBACH,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;4BAC/B,MAAM,MAAM,GACV,OAAO,CAAC,MAAM;gCACd,yDAAyD,CAAC;4BAC5D,MAAM,CAAC,IAAI,CACT,2BAA2B,OAAO,CAAC,MAAM,SAAS,QAAQ,MAAM,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC7F,CAAC;4BACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gCACpC,OAAO,kBAAkB,CACvB,4BAA4B,CAC1B,kBAAkB,CAAC,qBAAqB,EACxC,MAAM,CACP,EACD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;4BACJ,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,UAAU,EAAE,CAAC;oBACtB,iEAAiE;oBACjE,2DAA2D;oBAC3D,MAAM,CAAC,IAAI,CACT,qCAAqC,UAAU,sDAAsD,CACtG,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,uEAAuE;YACvE,0DAA0D;YAC1D,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACvD,IAAI,WAAW,CAAC,mBAAmB,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CACT,mBAAmB,MAAM,CAAC,OAAO,UAAU,QAAQ,4BAA4B;oBAC7E,uFAAuF,CAC1F,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,mBAAmB,MAAM,CAAC,OAAO,4BAA4B,CAAC;gBAC7E,MAAM,CAAC,IAAI,CACT,+CAA+C,MAAM,CAAC,OAAO,UAAU,QAAQ,GAAG,CACnF,CAAC;gBACF,OAAO,kBAAkB,CACvB,4BAA4B,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAC3E,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,KAAK;gBAChC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAuB,CAAC;gBACnD,CAAC,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC9B,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,oBAAoB,CAAW,CAAC;YACnF,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YAClE,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC;YAC9E,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,UAAU,CAAC;YAC9D,MAAM,aAAa,GAAG;gBACpB,MAAM,EAAE,YAAqB;gBAC7B,QAAQ,EAAE,SAAkB;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,aAAa;gBACb,0BAA0B,EAAE,gBAAgB;gBAC5C,gBAAgB,EAAE,wBAAwB;aAC3C,CAAC;YACF,MAAM,WAAW,GAAG;gBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK;gBACL,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC;oBAChC,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;oBAC1E,CAAC,CAAC,EAAE,CAAC;gBACP,aAAa;aACd,CAAC;YAEF,MAAM,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE;gBAClC,aAAa;gBACb,OAAO,EAAE,WAAW;gBACpB,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,QAAQ;gBACnD,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;gBACrC,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YAEH,qEAAqE;YACrE,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;oBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YAED,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,kBAAkB,CACtB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CACrE,CAAC;YAEF,MAAM,CAAC,KAAK,CACV,qCAAqC,QAAQ,aAAa,MAAM,CAAC,OAAO,GAAG,CAC5E,CAAC;YACF,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE;gBACnC,GAAG,WAAW;gBACd,SAAS,EAAE;oBACT,QAAQ,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE;oBACjC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrE,eAAe,EAAE,mBAAmB,CAAC,EAAE,CAAC;iBACzC;gBACD,GAAG,kBAAkB,CAAC,IAAI,CAAC;aAC5B,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAChC,CAAC"}
+{"version":3,"file":"with-kya-os.delegation-gate.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAEzE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAQlD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAOnE,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC,+EAA+E;AAC/E,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAClE,MAAM,UAAU,GAAG,KAAgC,CAAC;QACpD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC;QAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACtE,MAAM,UAAU,GAAI,OAAmC,CAAC,UAAU,CAAC;QACnE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5E,MAAM,MAAM,GAAI,UAAsC,CAAC,EAAE,CAAC;QAC1D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YACpD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,IAA6B;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC3C,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;AACtD,CAAC;AAWD,MAAM,UAAU,oBAAoB,CAClC,IAAoB,EACpB,MAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAC3F,MAAM,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GACvF,MAAM,CAAC;IACT,MAAM,EACJ,gBAAgB,EAChB,4BAA4B,EAC5B,gCAAgC,GACjC,GAAG,MAAM,CAAC,sBAAsB,CAAC;IAElC,SAAS,kBAAkB,CACzB,QAAgB,EAChB,MAA4B,EAC5B,OAAyB;QAEzB,OAAO,KAAK,EAAE,IAA6B,EAAE,SAAkB,EAAE,EAAE;YACjE,iBAAiB,EAAE,CAAC;YACpB,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAEhD,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC1D,yEAAyE;gBACzE,oEAAoE;gBACpE,yEAAyE;gBACzE,uEAAuE;gBACvE,yEAAyE;gBACzE,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAC9C,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CAAC,OAAO,CACf,CAAC;gBACF,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC;oBAC1C,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;oBAC3C,MAAM,CAAC,KAAK,CACV,gCAAgC,QAAQ,aAAa,MAAM,CAAC,OAAO,2BAA2B,CAC/F,CAAC;oBACF,MAAM,YAAY,GAAG;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,KAAK,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE;wBACrE,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;4BAC3C,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,EAAE;4BACrF,CAAC,CAAC,EAAE,CAAC;wBACP,aAAa,EAAE;4BACb,MAAM,EAAE,OAAgB;4BACxB,QAAQ,EAAE,SAAkB;4BAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;4BACvB,QAAQ,EAAE,aAAa,CAAC,EAAE;4BAC1B,gBAAgB,EAAE,wBAAwB;yBAC3C;qBACF,CAAC;oBACF,MAAM,KAAK,EAAE,aAAa,CAAC,YAAY,EAAE;wBACvC,OAAO,EAAE,WAAW;wBACpB,QAAQ,EAAE,aAAa,CAAC,EAAE;wBAC1B,OAAO,EAAE,YAAY;qBACtB,CAAC,CAAC;oBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE;wBACnC,GAAG,YAAY;wBACf,SAAS,EAAE;4BACT,QAAQ,EAAE,aAAa,CAAC,QAAQ;4BAChC,GAAG,CAAC,aAAa,CAAC,OAAO,KAAK,SAAS;gCACrC,CAAC,CAAC,EAAE,gBAAgB,EAAE,aAAa,CAAC,OAAO,EAAE;gCAC7C,CAAC,CAAC,EAAE,CAAC;4BACP,eAAe,EAAE,aAAa,CAAC,eAAe;yBAC/C;wBACD,GAAG,kBAAkB,CAAC,IAAI,CAAC;qBAC5B,CAAC,CAAC;gBACL,CAAC;gBAED,iEAAiE;gBACjE,uEAAuE;gBACvE,yEAAyE;gBACzE,mEAAmE;gBACnE,qEAAqE;gBACrE,iCAAiC;gBACjC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAC1B,MAAM,gCAAgC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC3D,OAAO,kBAAkB,CACvB,SAAS,EACT,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,OAAO,EACP,qBAAqB,CACtB,CAAC;YACJ,CAAC;YAED,yEAAyE;YACzE,2EAA2E;YAC3E,gEAAgE;YAChE,qEAAqE;YACrE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,aAAa,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE;wBAClC,aAAa,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC9C,OAAO,EAAE,QAAQ;wBACjB,UAAU,EAAE,gCAAgC;qBAC7C,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE;wBACxE,IAAI,EAAE,QAAQ;wBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,CAAC,IAAI,CACT,gDAAgD,QAAQ,MAAM,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CACjG,CAAC;gBACF,OAAO,kBAAkB,CACvB,4BAA4B,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,EACjF,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,KAAK,CAAC,MAAM,CACb,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;YAE5B,oEAAoE;YACpE,0EAA0E;YAC1E,2EAA2E;YAC3E,4EAA4E;YAC5E,4EAA4E;YAC5E,IAAI,iBAAiB,KAAK,KAAK,IAAI,qBAAqB,EAAE,CAAC;gBACzD,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBAC5C,IAAI,UAAU,IAAI,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;oBACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;oBACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAC3B,MAAM,MAAM,GACV,4EAA4E,CAAC;wBAC/E,MAAM,CAAC,IAAI,CACT,6BAA6B,QAAQ,+BAA+B,CACrE,CAAC;wBACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;4BACpC,OAAO,kBAAkB,CACvB,4BAA4B,CAC1B,kBAAkB,CAAC,qBAAqB,EACxC,MAAM,CACP,EACD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;wBACJ,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,IAAI,WAAW,GAAY,QAAQ,CAAC;wBACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;4BACjC,IAAI,CAAC;gCACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;4BACrC,CAAC;4BAAC,MAAM,CAAC;gCACP,WAAW,GAAG,EAAE,CAAC;4BACnB,CAAC;wBACH,CAAC;wBACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;4BACxC,KAAK,EAAE,WAA4B;4BACnC,UAAU;4BACV,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC;4BAC/C,gBAAgB,EAAE,QAAQ,CAAC,GAAG;4BAC9B,aAAa,EAAE,qBAAqB;yBACrC,CAAC,CAAC;wBACH,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;4BAC/B,MAAM,MAAM,GACV,OAAO,CAAC,MAAM;gCACd,yDAAyD,CAAC;4BAC5D,MAAM,CAAC,IAAI,CACT,2BAA2B,OAAO,CAAC,MAAM,SAAS,QAAQ,MAAM,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC7F,CAAC;4BACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gCACpC,OAAO,kBAAkB,CACvB,4BAA4B,CAC1B,kBAAkB,CAAC,qBAAqB,EACxC,MAAM,CACP,EACD,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;4BACJ,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,UAAU,EAAE,CAAC;oBACtB,iEAAiE;oBACjE,2DAA2D;oBAC3D,MAAM,CAAC,IAAI,CACT,qCAAqC,UAAU,sDAAsD,CACtG,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,uEAAuE;YACvE,0DAA0D;YAC1D,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACvD,IAAI,WAAW,CAAC,mBAAmB,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CACT,mBAAmB,MAAM,CAAC,OAAO,UAAU,QAAQ,4BAA4B;oBAC7E,uFAAuF,CAC1F,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,mBAAmB,MAAM,CAAC,OAAO,4BAA4B,CAAC;gBAC7E,MAAM,CAAC,IAAI,CACT,+CAA+C,MAAM,CAAC,OAAO,UAAU,QAAQ,GAAG,CACnF,CAAC;gBACF,OAAO,kBAAkB,CACvB,4BAA4B,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAC3E,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,MAAM,CACP,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,KAAK;gBAChC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAuB,CAAC;gBACnD,CAAC,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC9B,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,oBAAoB,CAAW,CAAC;YACnF,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YAClE,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC;YAC9E,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,UAAU,CAAC;YAC9D,MAAM,aAAa,GAAG;gBACpB,MAAM,EAAE,YAAqB;gBAC7B,QAAQ,EAAE,SAAkB;gBAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,aAAa;gBACb,0BAA0B,EAAE,gBAAgB;gBAC5C,gBAAgB,EAAE,wBAAwB;aAC3C,CAAC;YACF,MAAM,WAAW,GAAG;gBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK;gBACL,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC;oBAChC,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAuB,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;oBAC1E,CAAC,CAAC,EAAE,CAAC;gBACP,aAAa;aACd,CAAC;YAEF,MAAM,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE;gBAClC,aAAa;gBACb,OAAO,EAAE,WAAW;gBACpB,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,QAAQ;gBACnD,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;gBACrC,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,WAAW;aACrB,CAAC,CAAC;YAEH,qEAAqE;YACrE,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAE3C,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,kBAAkB,CACtB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CACrE,CAAC;YAEF,MAAM,CAAC,KAAK,CACV,qCAAqC,QAAQ,aAAa,MAAM,CAAC,OAAO,GAAG,CAC5E,CAAC;YACF,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE;gBACnC,GAAG,WAAW;gBACd,SAAS,EAAE;oBACT,QAAQ,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE;oBACjC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrE,eAAe,EAAE,mBAAmB,CAAC,EAAE,CAAC;iBACzC;gBACD,GAAG,kBAAkB,CAAC,IAAI,CAAC;aAC5B,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAChC,CAAC"}

package/dist/middleware/with-kya-os.delegation-verify.d.ts

@@ -6,17 +6,14 @@
  * adapter (chain-enforcement.ts) once per middleware instance. Extracted from
  * `wrapWithDelegation` so the gate module holds only the request flow.
  */
-import { type DelegationCredential, type NeedsAuthorizationError } from "../types/protocol.js";
-import type { KyaOsToolHandler } from "./with-kya-os.types.js";
+import { type DelegationCredential } from "../types/protocol.js";
+import type { KyaOsChallengeFormatter, KyaOsToolHandler, KyaOsToolResult } from "./with-kya-os.types.js";
 import type { MiddlewareDeps } from "./with-kya-os.deps.js";
 /** Per-tool delegation-gate config shared by the gate + its challenge builder. */
 export interface DelegationGateConfig {
     scopeId: string;
     consentUrl: string;
-    formatChallenge?: (challenge: NeedsAuthorizationError) => Array<{
-        type: "text";
-        text: string;
-    }>;
+    formatChallenge?: KyaOsChallengeFormatter;
 }
 /**
  * Outcome of authenticating a presented delegation. On success the caller gets
@@ -50,14 +47,12 @@ export interface DelegationVerification {
     /**
      * Build the signed-later `needs_authorization` challenge for a call that
      * arrived without a delegation or resolvable grant: a fresh resume token, a
-     * 5-minute expiry, and the emitted content (respecting `config.formatChallenge`,
-     * which falls back to the default JSON challenge if it throws).
+     * 5-minute expiry, and the result to emit (respecting `config.formatChallenge`,
+     * which falls back to the default JSON challenge if it throws or returns
+     * neither content nor a challenge result).
      */
     buildNeedsAuthorizationChallenge(toolName: string, config: DelegationGateConfig): Promise<{
-        challengeContent: Array<{
-            type: "text";
-            text: string;
-        }>;
+        challenge: KyaOsToolResult;
         message: string;
     }>;
 }

package/dist/middleware/with-kya-os.delegation-verify.js

@@ -19,6 +19,28 @@ import { createNeedsAuthorizationError, readCredentialProofValue, } from "../typ
 import { logger } from "../logging/index.js";
 import { TtlCache } from "../utils/ttl-cache.js";
 import { sanitizeForMessage } from "./with-kya-os.helpers.js";
+import { withoutOutcomeMeta } from "./with-kya-os.session.js";
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+ * The challenge result a `formatChallenge` hook returned, in either form: its
+ * content alone (an array), or content with `structuredContent`, `isError` and
+ * `_meta`. All of it is set before the challenge is signed. The `_meta`
+ * members only the middleware may set are dropped, never trusted. Undefined
+ * for a value of neither form.
+ */
+function toChallengeResult(formatted) {
+    if (Array.isArray(formatted))
+        return { content: formatted };
+    if (!isRecord(formatted) || !Array.isArray(formatted.content))
+        return undefined;
+    const { content, structuredContent, isError, _meta } = formatted;
+    return withoutOutcomeMeta({
+        content,
+        ...(isRecord(structuredContent) ? { structuredContent } : {}),
+        ...(typeof isError === "boolean" ? { isError } : {}),
+        ...(isRecord(_meta) ? { _meta } : {}),
+    });
+}
 export function createDelegationVerification(deps) {
     const { identity, cryptoProvider, delegationConfig } = deps;
     const didKeyResolver = createDidKeyResolver();
@@ -247,25 +269,31 @@ export function createDelegationVerification(deps) {
             scopes: [config.scopeId],
         });
         // config.formatChallenge lets a server render the challenge (e.g. a markdown
-        // link for LLM clients) BEFORE it is signed, so the proof binds exactly what
-        // the client receives. A throwing hook falls back to the default challenge.
-        const defaultChallengeContent = [
-            { type: "text", text: JSON.stringify(authError) },
-        ];
-        let challengeContent = defaultChallengeContent;
+        // link for LLM clients, or an error result with structuredContent) BEFORE
+        // it is signed, so the proof binds exactly what the client receives. A
+        // throwing hook, or one returning neither form, gets the default challenge.
+        const defaultChallenge = () => ({
+            content: [{ type: "text", text: JSON.stringify(authError) }],
+        });
+        let challenge = defaultChallenge();
         if (config.formatChallenge) {
             try {
-                challengeContent = config.formatChallenge(authError);
+                const formatted = toChallengeResult(config.formatChallenge(authError));
+                if (formatted) {
+                    challenge = formatted;
+                }
+                else {
+                    logger.error("[kya-os] formatChallenge returned neither content nor a challenge result; using the default challenge", { tool: toolName });
+                }
             }
             catch (error) {
                 logger.error("[kya-os] formatChallenge threw; using the default challenge", {
                     tool: toolName,
                     error: error instanceof Error ? error.message : String(error),
                 });
-                challengeContent = defaultChallengeContent;
             }
         }
-        return { challengeContent, message: authError.message };
+        return { challenge, message: authError.message };
     }
     return {
         verifyDelegation,

package/dist/middleware/with-kya-os.delegation-verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.delegation-verify.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EACL,4BAA4B,GAG7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uBAAuB,IAAI,2BAA2B,GAEvD,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GAGzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAoD9D,MAAM,UAAU,4BAA4B,CAC1C,IAAoB;IAEpB,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAE5D,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;IAC9C,MAAM,aAAa,GACjB,gBAAgB,EAAE,aAAa;QAC/B,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;YACrC,CAAC,CAAC,IAAI,oBAAoB,EAAE;YAC5B,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,MAAM,cAAc,GAAG,aAAa;QAClC,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,sBAAsB,GAAG,wBAAwB,CACrD,gBAAgB,EAAE,YAAY,EAC9B,aAAa,CACd,CAAC;IACF,MAAM,WAAW,GAAgB;QAC/B,KAAK,CAAC,OAAO,CAAC,GAAW;YACvB,MAAM,cAAc,GAAG,gBAAgB,EAAE,WAAW,CAAC;YACrD,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,QAAQ,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,kBAAkB,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/E,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACvD,IAAI,QAAQ,EAAE,CAAC;wBACb,OAAO,QAAQ,CAAC;oBAClB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;YAC9C,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IAEF,MAAM,iBAAiB,GAAkC,KAAK,EAC5D,EAAwB,EACxB,YAAqB,EACyB,EAAE;QAChD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAgC,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACjE,CAAC;QAED,yEAAyE;QACzE,MAAM,QAAQ,GAAG,EAA6B,CAAC;QAC/C,MAAM,cAAc,GAA4B,EAAE,CAAC;QACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,OAAO;gBAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEjD,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEpD,iEAAiE;QACjE,MAAM,GAAG,GAAG,YAA8B,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAChE,CAAC;QAED,mEAAmE;QACnE,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAEhD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QACxE,OAAO;YACL,KAAK;YACL,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B;SAC5D,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAAC;QAChD,WAAW;QACX,iBAAiB;QACjB,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB;QACxD,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK;QACpD,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU;KAC9D,CAAC,CAAC;IAEH,MAAM,4BAA4B,GAAG,CACnC,KAAa,EACb,MAAc,EACyB,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;aACpE;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAAG,gBAAgB,EAAE,kBAAkB,CAAC;IAChE,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CACT,wFAAwF;YACtF,mGAAmG,CACtG,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,cAAc,GAAG,gBAAgB,EAAE,cAAc,CAAC;IACxD,IAAI,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,UAAU,CAClB,sEAAsE,MAAM,CAAC,cAAc,CAAC,GAAG,CAChG,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,0DAA0D;IAC1D,MAAM,qBAAqB,GAAG,IAAI,QAAQ,CAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7F,MAAM,mBAAmB,GAAG,CAAC,QAAuC,EAAQ,EAAE;QAC5E,KAAK,MAAM,OAAO,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YACjD,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,YAAY,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,uBAAuB,GAAG,KAAK,EACnC,cAAoC,EACpC,OAAqC,EACL,EAAE;QAClC,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAC9C,cAAc,EACd;YACE,SAAS,EAAE,QAAQ,CAAC,GAAG;YACvB,QAAQ;YACR,sBAAsB,EAAE,gBAAgB,EAAE,sBAAsB;YAChE,oBAAoB,EAAE,CAAC,CAAC,gBAAgB,EAAE,kBAAkB;YAC5D,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB;YACtD,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,EACD,OAAO,CACR,CAAC;QACF,IAAI,MAAM,CAAC,KAAK;YAAE,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,KAAK,UAAU,gBAAgB,CAC7B,aAAsB;QAEtB,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,IAAI,EAAwB,CAAC;QAC7B,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,YAAgC,CAAC;QAErC,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;YAC3D,CAAC;YACD,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,4DAA4D;YAC5D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,aAAa,EAAE;gBACjE,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACpB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,wCAAwC;oBACnE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAA0B;iBAC9C,CAAC;YACJ,CAAC;YACD,wEAAwE;YACxE,sEAAsE;YACtE,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAA0B,CAAC;YAC/C,yEAAyE;YACzE,wEAAwE;YACxE,iEAAiE;YACjE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACd,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC;YACtE,CAAC;YACD,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,aAAqC,CAAC;QAC7C,CAAC;QAED,0EAA0E;QAC1E,8EAA8E;QAC9E,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,KAA4B,CAAC;QACjC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;gBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;aACxD,CAAC,CAAC;YACH,KAAK,GAAG;gBACN,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,6CAA6C;aACtD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,qCAAqC;gBAC7D,EAAE;aACH,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,KAAK,SAAS;YAC1C,CAAC,CAAC,KAAK,CAAC,SAAS;YACjB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,IAAI,YAAY,CAAC,CAAC;QAC5D,OAAO;YACL,KAAK,EAAE,IAAI;YACX,EAAE;YACF,KAAK;YACL,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,gCAAgC,CAC7C,QAAgB,EAChB,MAA4B;QAK5B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,WAAW,GAAG;YAClB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;SACd,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;QAEtD,MAAM,SAAS,GAAG,6BAA6B,CAAC;YAC9C,OAAO,EAAE,SAAS,QAAQ,qCAAqC,MAAM,CAAC,OAAO,EAAE;YAC/E,gBAAgB,EAAE,MAAM,CAAC,UAAU;YACnC,WAAW;YACX,SAAS;YACT,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;QAEH,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,uBAAuB,GAAG;YAC9B,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;SAC3D,CAAC;QACF,IAAI,gBAAgB,GAAG,uBAAuB,CAAC;QAC/C,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,gBAAgB,GAAG,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE;oBAC1E,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,gBAAgB,GAAG,uBAAuB,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,gBAAgB;QAChB,4BAA4B;QAC5B,gCAAgC;KACjC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"with-kya-os.delegation-verify.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EACL,4BAA4B,GAG7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uBAAuB,IAAI,2BAA2B,GAEvD,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GAEzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAOjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAS9D,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvE;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,SAAkB;IAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAChF,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC;IACjE,OAAO,kBAAkB,CAAC;QACxB,OAAO;QACP,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;AACL,CAAC;AA4CD,MAAM,UAAU,4BAA4B,CAC1C,IAAoB;IAEpB,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAE5D,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;IAC9C,MAAM,aAAa,GACjB,gBAAgB,EAAE,aAAa;QAC/B,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;YACrC,CAAC,CAAC,IAAI,oBAAoB,EAAE;YAC5B,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,MAAM,cAAc,GAAG,aAAa;QAClC,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,sBAAsB,GAAG,wBAAwB,CACrD,gBAAgB,EAAE,YAAY,EAC9B,aAAa,CACd,CAAC;IACF,MAAM,WAAW,GAAgB;QAC/B,KAAK,CAAC,OAAO,CAAC,GAAW;YACvB,MAAM,cAAc,GAAG,gBAAgB,EAAE,WAAW,CAAC;YACrD,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,QAAQ,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,kBAAkB,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/E,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACvD,IAAI,QAAQ,EAAE,CAAC;wBACb,OAAO,QAAQ,CAAC;oBAClB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;YAC9C,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IAEF,MAAM,iBAAiB,GAAkC,KAAK,EAC5D,EAAwB,EACxB,YAAqB,EACyB,EAAE;QAChD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAgC,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACjE,CAAC;QAED,yEAAyE;QACzE,MAAM,QAAQ,GAAG,EAA6B,CAAC;QAC/C,MAAM,cAAc,GAA4B,EAAE,CAAC;QACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,OAAO;gBAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEjD,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEpD,iEAAiE;QACjE,MAAM,GAAG,GAAG,YAA8B,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAChE,CAAC;QAED,mEAAmE;QACnE,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAEhD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QACxE,OAAO;YACL,KAAK;YACL,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B;SAC5D,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAAC;QAChD,WAAW;QACX,iBAAiB;QACjB,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB;QACxD,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK;QACpD,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU;KAC9D,CAAC,CAAC;IAEH,MAAM,4BAA4B,GAAG,CACnC,KAAa,EACb,MAAc,EACyB,EAAE,CAAC,CAAC;QAC3C,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;aACpE;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAAG,gBAAgB,EAAE,kBAAkB,CAAC;IAChE,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CACT,wFAAwF;YACtF,mGAAmG,CACtG,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,cAAc,GAAG,gBAAgB,EAAE,cAAc,CAAC;IACxD,IAAI,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,UAAU,CAClB,sEAAsE,MAAM,CAAC,cAAc,CAAC,GAAG,CAChG,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,0DAA0D;IAC1D,MAAM,qBAAqB,GAAG,IAAI,QAAQ,CAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7F,MAAM,mBAAmB,GAAG,CAAC,QAAuC,EAAQ,EAAE;QAC5E,KAAK,MAAM,OAAO,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YACjD,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,YAAY,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,uBAAuB,GAAG,KAAK,EACnC,cAAoC,EACpC,OAAqC,EACL,EAAE;QAClC,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAC9C,cAAc,EACd;YACE,SAAS,EAAE,QAAQ,CAAC,GAAG;YACvB,QAAQ;YACR,sBAAsB,EAAE,gBAAgB,EAAE,sBAAsB;YAChE,oBAAoB,EAAE,CAAC,CAAC,gBAAgB,EAAE,kBAAkB;YAC5D,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB;YACtD,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,EACD,OAAO,CACR,CAAC;QACF,IAAI,MAAM,CAAC,KAAK;YAAE,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,KAAK,UAAU,gBAAgB,CAC7B,aAAsB;QAEtB,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,IAAI,EAAwB,CAAC;QAC7B,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,YAAgC,CAAC;QAErC,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;YAC3D,CAAC;YACD,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,4DAA4D;YAC5D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,aAAa,EAAE;gBACjE,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACpB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,wCAAwC;oBACnE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAA0B;iBAC9C,CAAC;YACJ,CAAC;YACD,wEAAwE;YACxE,sEAAsE;YACtE,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAA0B,CAAC;YAC/C,yEAAyE;YACzE,wEAAwE;YACxE,iEAAiE;YACjE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACd,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC;YACtE,CAAC;YACD,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,aAAqC,CAAC;QAC7C,CAAC;QAED,0EAA0E;QAC1E,8EAA8E;QAC9E,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,KAA4B,CAAC;QACjC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;gBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;aACxD,CAAC,CAAC;YACH,KAAK,GAAG;gBACN,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,6CAA6C;aACtD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,qCAAqC;gBAC7D,EAAE;aACH,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,KAAK,SAAS;YAC1C,CAAC,CAAC,KAAK,CAAC,SAAS;YACjB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,IAAI,YAAY,CAAC,CAAC;QAC5D,OAAO;YACL,KAAK,EAAE,IAAI;YACX,EAAE;YACF,KAAK;YACL,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,gCAAgC,CAC7C,QAAgB,EAChB,MAA4B;QAK5B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,WAAW,GAAG;YAClB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;SACd,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;QAEtD,MAAM,SAAS,GAAG,6BAA6B,CAAC;YAC9C,OAAO,EAAE,SAAS,QAAQ,qCAAqC,MAAM,CAAC,OAAO,EAAE;YAC/E,gBAAgB,EAAE,MAAM,CAAC,UAAU;YACnC,WAAW;YACX,SAAS;YACT,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;QAEH,6EAA6E;QAC7E,0EAA0E;QAC1E,uEAAuE;QACvE,4EAA4E;QAC5E,MAAM,gBAAgB,GAAG,GAAoB,EAAE,CAAC,CAAC;YAC/C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;QACH,IAAI,SAAS,GAAG,gBAAgB,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;gBACvE,IAAI,SAAS,EAAE,CAAC;oBACd,SAAS,GAAG,SAAS,CAAC;gBACxB,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,KAAK,CACV,uGAAuG,EACvG,EAAE,IAAI,EAAE,QAAQ,EAAE,CACnB,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE;oBAC1E,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC;IAED,OAAO;QACL,gBAAgB;QAChB,4BAA4B;QAC5B,gCAAgC;KACjC,CAAC;AACJ,CAAC"}

package/dist/middleware/with-kya-os.deps.d.ts

@@ -13,14 +13,25 @@ import type { ProofGenerator, ProofAgentIdentity } from "../proof/generator.js";
 import type { ProofVerifier } from "../proof/verifier.js";
 import type { ResponseProofProfile } from "../types/protocol.js";
 import type { McpAuditEventAdapter } from "../audit/adapters/mcp.js";
-import type { KyaOsConfig, KyaOsDelegationConfig, KyaOsToolHandler } from "./with-kya-os.types.js";
+import type { KyaOsAuthorizationOutcome, KyaOsConfig, KyaOsDelegationConfig, KyaOsToolResult } from "./with-kya-os.types.js";
 /**
  * Attach a signed proof recording an authorization OUTCOME (denied / step-up /
  * needs-authorization) to a response. Provided by the session/proof sub-factory
- * and consumed by the delegation- and policy-gate sub-factories, so it is typed
- * here as the shared internal contract between them.
+ * and consumed by the delegation- and policy-gate sub-factories and the public
+ * `proveOutcome`, so it is typed here as the shared internal contract between
+ * them. A `needs_authorization` proof binds the response (its content under
+ * the body profile, its envelope under the envelope profile); denial and
+ * step-up proofs bind none (SPEC §7.4).
  */
-export type AttachOutcomeProof = (response: Awaited<ReturnType<KyaOsToolHandler>>, toolName: string, args: Record<string, unknown>, sessionId: string | undefined, reason: string, outcome?: "denied" | "step_up_required" | "needs_authorization", paramsOverride?: Record<string, unknown>, responseData?: unknown) => Promise<Awaited<ReturnType<KyaOsToolHandler>>>;
+export type AttachOutcomeProof = (response: KyaOsToolResult, toolName: string, args: Record<string, unknown>, sessionId: string | undefined, reason: string, outcome?: KyaOsAuthorizationOutcome, paramsOverride?: Record<string, unknown>) => Promise<KyaOsToolResult>;
+/**
+ * Refuse, by throwing, a wrapped call whose proof could not be made. A proof
+ * is made where the result is sent, so every wrapper calls this on entry,
+ * before it records or runs anything, and it throws while no KYA-OS
+ * transport is open for the middleware. Provided by the session/proof
+ * sub-factory.
+ */
+export type RequireProofLayer = () => void;
 /** The constructed dependencies shared across the middleware sub-factories. */
 export interface MiddlewareDeps {
     /** Proof-generation identity (DID + key material). */

package/dist/middleware/with-kya-os.helpers.d.ts

@@ -5,6 +5,11 @@
  * of `./with-kya-os.ts` so the factory module stays focused on wiring. No shared
  * mutable state, no I/O — safe to unit test in isolation.
  */
+/**
+ * `args` without the reserved `_kyaos*` control arguments: the call as its
+ * handler sees it, and as a gate's request hash binds it.
+ */
+export declare function withoutControlArgs(args: Record<string, unknown>): Record<string, unknown>;
 /**
  * Strip control characters and cap length on caller-derived values before they
  * are interpolated into client-facing reasons or log lines. A hostile

package/dist/middleware/with-kya-os.helpers.js

@@ -6,6 +6,19 @@
  * mutable state, no I/O — safe to unit test in isolation.
  */
 import { getDelegationScopes } from "../delegation/chain-enforcement.js";
+import { isKyaOsControlArg } from "../proof/covered-request.js";
+/**
+ * `args` without the reserved `_kyaos*` control arguments: the call as its
+ * handler sees it, and as a gate's request hash binds it.
+ */
+export function withoutControlArgs(args) {
+    const clean = {};
+    for (const [key, value] of Object.entries(args)) {
+        if (!isKyaOsControlArg(key))
+            clean[key] = value;
+    }
+    return clean;
+}
 /**
  * Strip control characters and cap length on caller-derived values before they
  * are interpolated into client-facing reasons or log lines. A hostile

package/dist/middleware/with-kya-os.helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.helpers.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.helpers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAEzE;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,MAAM,GAAG,GAAG;IAC7D,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,6EAA6E;IAC7E,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,GAAG,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;AACrE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CAAC,GAAY;IAKjD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,GAA2B,CAAC;QACvC,MAAM,OAAO,GAAG,EAAE,CAAC,iBAGlB,CAAC;QACF,MAAM,QAAQ,GAAG,OAAO,EAAE,UAAU,EAAE,UAAU,IAAI,OAAO,EAAE,EAAE,IAAI,SAAS,CAAC;QAC7E,MAAM,gBAAgB,GAAG,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC;QACzD,IAAI,eAAe,GAAa,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,eAAe,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,eAAe,GAAG,EAAE,CAAC;QACvB,CAAC;QACD,OAAO;YACL,QAAQ;YACR,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,eAAe;SAChB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IACtD,CAAC;AACH,CAAC"}
+{"version":3,"file":"with-kya-os.helpers.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.helpers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAEhE;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAA6B;IAE7B,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,MAAM,GAAG,GAAG;IAC7D,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,6EAA6E;IAC7E,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,GAAG,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;AACrE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CAAC,GAAY;IAKjD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,GAA2B,CAAC;QACvC,MAAM,OAAO,GAAG,EAAE,CAAC,iBAGlB,CAAC;QACF,MAAM,QAAQ,GAAG,OAAO,EAAE,UAAU,EAAE,UAAU,IAAI,OAAO,EAAE,EAAE,IAAI,SAAS,CAAC;QAC7E,MAAM,gBAAgB,GAAG,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC;QACzD,IAAI,eAAe,GAAa,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,eAAe,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,eAAe,GAAG,EAAE,CAAC;QACvB,CAAC;QACD,OAAO;YACL,QAAQ;YACR,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,eAAe;SAChB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IACtD,CAAC;AACH,CAAC"}

package/dist/middleware/with-kya-os.js

@@ -29,8 +29,11 @@ import { createDelegationVerification } from "./with-kya-os.delegation-verify.js
 import { createGrantResolution } from "./with-kya-os.grants.js";
 import { createPolicyGate } from "./with-kya-os.policy-gate.js";
 import { createDelegationGate } from "./with-kya-os.delegation-gate.js";
+import { createOutcomeProver } from "./with-kya-os.outcome.js";
 import { createSessionProof } from "./with-kya-os.session.js";
 import { createProtocol } from "./with-kya-os.protocol.js";
+/** The longest timer a JavaScript runtime keeps (2^31 - 1 ms, about 24.8 days). */
+const MAX_PENDING_PROOF_TTL_MS = 2_147_483_647;
 // The public type surface lives in `./with-kya-os.types.ts`; re-export it here so
 // `import { KyaOsConfig, ... } from './with-kya-os'` continues to resolve unchanged.
 export * from "./with-kya-os.types.js";
@@ -46,6 +49,10 @@ export * from "./with-kya-os.types.js";
  * - You need custom request handler patterns
  * - You want per-tool control over proof/delegation wrapping
  *
+ * Connect such a server through `createKyaOsTransport`: proofs are made where
+ * that transport sends a result, and the wrappers refuse to run while no
+ * KYA-OS transport is open.
+ *
  * @param config - Agent identity and session configuration
  * @param cryptoProvider - Platform-specific crypto implementation
  * @returns Middleware components for session management and proof generation
@@ -60,6 +67,13 @@ export * from "./with-kya-os.types.js";
  * durable `SessionStore` via `config.session.sessionStore`.
  */
 export function createKyaOsMiddleware(config, cryptoProvider) {
+    if (config.pendingProofTtlMs !== undefined &&
+        !(Number.isFinite(config.pendingProofTtlMs) &&
+            config.pendingProofTtlMs > 0 &&
+            config.pendingProofTtlMs <= MAX_PENDING_PROOF_TTL_MS)) {
+        // A timer longer than this overflows, and Node and browsers fire it at once.
+        throw new TypeError(`pendingProofTtlMs must be a positive number of milliseconds, at most ${MAX_PENDING_PROOF_TTL_MS}`);
+    }
     if (config.audit && config.auditLog) {
         throw new TypeError('Configure either audit or legacy auditLog, not both');
     }
@@ -166,11 +180,19 @@ export function createKyaOsMiddleware(config, cryptoProvider) {
     const { wrapWithDelegation } = createDelegationGate(deps, {
         delegationVerification,
         attachOutcomeProof: session.attachOutcomeProof,
+        requireProofLayer: session.requireProofLayer,
         resolveExistingGrant,
         bindGrantOnSuccess,
     });
     const { withPolicyGate } = createPolicyGate(deps, {
         attachOutcomeProof: session.attachOutcomeProof,
+        requireProofLayer: session.requireProofLayer,
+    });
+    // Application code proves the outcomes it decides through the same
+    // attachOutcomeProof the gates use.
+    const { proveOutcome } = createOutcomeProver({
+        attachOutcomeProof: session.attachOutcomeProof,
+        requireProofLayer: session.requireProofLayer,
     });
     return {
         identity: config.identity,
@@ -183,6 +205,7 @@ export function createKyaOsMiddleware(config, cryptoProvider) {
         wrapWithProof: session.wrapWithProof,
         wrapWithDelegation,
         withPolicyGate,
+        proveOutcome,
     };
 }
 //# sourceMappingURL=with-kya-os.js.map

package/dist/middleware/with-kya-os.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,cAAc,EACd,2BAA2B,GAE5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAM7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,kFAAkF;AAClF,qFAAqF;AACrF,cAAc,wBAAwB,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,UAAU,qBAAqB,CACnC,MAAmB,EACnB,cAA8B;IAE9B,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5C,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS;gBACzC,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBAClE,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;YAC5F,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAuB;QACnC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QACxB,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QACxB,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU;QACtC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;KACrC,CAAC;IAEF,2EAA2E;IAC3E,mFAAmF;IACnF,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,wBAAwB,EAAE,CAAC;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAE9D,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,cAAc,EAAE;QACxD,GAAG,MAAM,CAAC,OAAO;QACjB,SAAS,EAAE,QAAQ,CAAC,GAAG;QACvB,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAChE,CAAC,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE;YACrC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK;SACzD,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,4EAA4E;IAC5E,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,IAAI,CAAC;IAE7D,kEAAkE;IAClE,oEAAoE;IACpE,gDAAgD;IAChD,MAAM,oBAAoB,GACxB,MAAM,CAAC,oBAAoB,IAAI,2BAA2B,CAAC;IAE7D,8EAA8E;IAC9E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,gBAAgB,EAAE,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CACT,uEAAuE;YACrE,uEAAuE;YACvE,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,iBAAiB,GAAG,gBAAgB,EAAE,aAAa,IAAI,KAAK,CAAC;IACnE,MAAM,qBAAqB,GACzB,iBAAiB,KAAK,KAAK;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,aAAa,CAAC;YAChB,cAAc;YACd,aAAa,EAAE,IAAI,mBAAmB,EAAE;YACxC,kBAAkB,EAAE,UAAU;YAC9B,kBAAkB;YAClB,aAAa,EACX,gBAAgB,EAAE,aAAa;gBAC/B,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;oBACrC,CAAC,CAAC,IAAI,oBAAoB,EAAE;oBAC5B,CAAC,CAAC,IAAI,iBAAiB,EAAE,CAAC;SAC/B,CAAC,CAAC;IAET,iEAAiE;IACjE,MAAM,IAAI,GAAmB;QAC3B,QAAQ;QACR,MAAM;QACN,cAAc;QACd,cAAc;QACd,cAAc;QACd,QAAQ;QACR,KAAK;QACL,UAAU;QACV,gBAAgB;QAChB,iBAAiB;QACjB,qBAAqB;QACrB,kBAAkB;QAClB,oBAAoB;KACrB,CAAC;IAEF,gFAAgF;IAChF,iEAAiE;IACjE,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE;QACpC,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,sEAAsE;IACtE,8EAA8E;IAC9E,wCAAwC;IACxC,MAAM,sBAAsB,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAChD,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAEvE,MAAM,EAAE,kBAAkB,EAAE,GAAG,oBAAoB,CAAC,IAAI,EAAE;QACxD,sBAAsB;QACtB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,oBAAoB;QACpB,kBAAkB;KACnB,CAAC,CAAC;IAEH,MAAM,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE;QAChD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;KAC/C,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc;QACd,cAAc;QACd,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,kBAAkB;QAClB,cAAc;KACf,CAAC;AACJ,CAAC"}
+{"version":3,"file":"with-kya-os.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,cAAc,EACd,2BAA2B,GAE5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAM7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,mFAAmF;AACnF,MAAM,wBAAwB,GAAG,aAAa,CAAC;AAE/C,kFAAkF;AAClF,qFAAqF;AACrF,cAAc,wBAAwB,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,MAAM,UAAU,qBAAqB,CACnC,MAAmB,EACnB,cAA8B;IAE9B,IACE,MAAM,CAAC,iBAAiB,KAAK,SAAS;QACtC,CAAC,CACC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACzC,MAAM,CAAC,iBAAiB,GAAG,CAAC;YAC5B,MAAM,CAAC,iBAAiB,IAAI,wBAAwB,CACrD,EACD,CAAC;QACD,6EAA6E;QAC7E,MAAM,IAAI,SAAS,CACjB,wEAAwE,wBAAwB,EAAE,CACnG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5C,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS;gBACzC,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBAClE,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;YAC5F,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAuB;QACnC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QACxB,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QACxB,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU;QACtC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;KACrC,CAAC;IAEF,2EAA2E;IAC3E,mFAAmF;IACnF,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,wBAAwB,EAAE,CAAC;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,KAAK,CAAC;IAE9D,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,cAAc,EAAE;QACxD,GAAG,MAAM,CAAC,OAAO;QACjB,SAAS,EAAE,QAAQ,CAAC,GAAG;QACvB,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAChE,CAAC,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE;YACrC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK;SACzD,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,4EAA4E;IAC5E,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,IAAI,CAAC;IAE7D,kEAAkE;IAClE,oEAAoE;IACpE,gDAAgD;IAChD,MAAM,oBAAoB,GACxB,MAAM,CAAC,oBAAoB,IAAI,2BAA2B,CAAC;IAE7D,8EAA8E;IAC9E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,gBAAgB,EAAE,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CACT,uEAAuE;YACrE,uEAAuE;YACvE,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,iBAAiB,GAAG,gBAAgB,EAAE,aAAa,IAAI,KAAK,CAAC;IACnE,MAAM,qBAAqB,GACzB,iBAAiB,KAAK,KAAK;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,aAAa,CAAC;YAChB,cAAc;YACd,aAAa,EAAE,IAAI,mBAAmB,EAAE;YACxC,kBAAkB,EAAE,UAAU;YAC9B,kBAAkB;YAClB,aAAa,EACX,gBAAgB,EAAE,aAAa;gBAC/B,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;oBACrC,CAAC,CAAC,IAAI,oBAAoB,EAAE;oBAC5B,CAAC,CAAC,IAAI,iBAAiB,EAAE,CAAC;SAC/B,CAAC,CAAC;IAET,iEAAiE;IACjE,MAAM,IAAI,GAAmB;QAC3B,QAAQ;QACR,MAAM;QACN,cAAc;QACd,cAAc;QACd,cAAc;QACd,QAAQ;QACR,KAAK;QACL,UAAU;QACV,gBAAgB;QAChB,iBAAiB;QACjB,qBAAqB;QACrB,kBAAkB;QAClB,oBAAoB;KACrB,CAAC;IAEF,gFAAgF;IAChF,iEAAiE;IACjE,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE;QACpC,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,sEAAsE;IACtE,8EAA8E;IAC9E,wCAAwC;IACxC,MAAM,sBAAsB,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAChD,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAEvE,MAAM,EAAE,kBAAkB,EAAE,GAAG,oBAAoB,CAAC,IAAI,EAAE;QACxD,sBAAsB;QACtB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,oBAAoB;QACpB,kBAAkB;KACnB,CAAC,CAAC;IAEH,MAAM,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE;QAChD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC;IAEH,mEAAmE;IACnE,oCAAoC;IACpC,MAAM,EAAE,YAAY,EAAE,GAAG,mBAAmB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc;QACd,cAAc;QACd,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,kBAAkB;QAClB,cAAc;QACd,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/middleware/with-kya-os.outcome.d.ts

@@ -0,0 +1,18 @@
+/**
+ * KYA-OS Middleware — `proveOutcome`, the public entry to outcome proofs.
+ *
+ * Application code that decides an authorization outcome itself (a provider
+ * enforcing OAuth scopes in-server, say) proves it here with the proof the
+ * gates attach to theirs. There is one implementation, `attachOutcomeProof`
+ * in `./with-kya-os.session.ts`; this module only adapts a request object to
+ * it, so the claims, `_meta` keys, profile handling, audit events and
+ * lifecycle stamp cannot drift between the gates and application code.
+ */
+import type { KyaOsOutcomeProver } from "./with-kya-os.types.js";
+import type { AttachOutcomeProof, RequireProofLayer } from "./with-kya-os.deps.js";
+/** Collaborators the outcome prover borrows from the session/proof sub-factory. */
+export interface OutcomeProverWiring {
+    attachOutcomeProof: AttachOutcomeProof;
+    requireProofLayer: RequireProofLayer;
+}
+export declare function createOutcomeProver(wiring: OutcomeProverWiring): KyaOsOutcomeProver;

package/dist/middleware/with-kya-os.outcome.js

@@ -0,0 +1,36 @@
+/**
+ * KYA-OS Middleware — `proveOutcome`, the public entry to outcome proofs.
+ *
+ * Application code that decides an authorization outcome itself (a provider
+ * enforcing OAuth scopes in-server, say) proves it here with the proof the
+ * gates attach to theirs. There is one implementation, `attachOutcomeProof`
+ * in `./with-kya-os.session.ts`; this module only adapts a request object to
+ * it, so the claims, `_meta` keys, profile handling, audit events and
+ * lifecycle stamp cannot drift between the gates and application code.
+ */
+import { withoutOutcomeMeta } from "./with-kya-os.session.js";
+import { withoutControlArgs } from "./with-kya-os.helpers.js";
+const OUTCOMES = new Set([
+    "needs_authorization",
+    "step_up_required",
+    "denied",
+]);
+export function createOutcomeProver(wiring) {
+    const { attachOutcomeProof, requireProofLayer } = wiring;
+    return {
+        async proveOutcome(request) {
+            requireProofLayer();
+            if (!OUTCOMES.has(request.outcome)) {
+                throw new TypeError(`proveOutcome: unknown outcome ${JSON.stringify(request.outcome)}; ` +
+                    `expected one of ${[...OUTCOMES].join(", ")}`);
+            }
+            const params = withoutControlArgs(request.args);
+            // A copy, so the caller's result is never changed, without the `_meta`
+            // members only the middleware may set.
+            const result = { ...withoutOutcomeMeta(request.result) };
+            // The same members, plus `_meta`: still an R.
+            return attachOutcomeProof(result, request.toolName, params, request.sessionId, request.reason, request.outcome, params);
+        },
+    };
+}
+//# sourceMappingURL=with-kya-os.outcome.js.map

package/dist/middleware/with-kya-os.outcome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-kya-os.outcome.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.outcome.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAA4B;IACvE,qBAAqB;IACrB,kBAAkB;IAClB,QAAQ;CACT,CAAC,CAAC;AAQH,MAAM,UAAU,mBAAmB,CAAC,MAA2B;IAC7D,MAAM,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC;IAEzD,OAAO;QACL,KAAK,CAAC,YAAY,CAA4B,OAAoC;YAChF,iBAAiB,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,SAAS,CACjB,iCAAiC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI;oBAClE,mBAAmB,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChD,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChD,uEAAuE;YACvE,uCAAuC;YACvC,MAAM,MAAM,GAAG,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,8CAA8C;YAC9C,OAAO,kBAAkB,CACvB,MAAM,EACN,OAAO,CAAC,QAAQ,EAChB,MAAM,EACN,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,OAAO,EACf,MAAM,CACO,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/middleware/with-kya-os.policy-gate.d.ts

@@ -7,9 +7,10 @@
  * human approval before the handler runs. Extracted from `./with-kya-os.ts`.
  */
 import type { KyaOsPolicyGate } from "./with-kya-os.types.js";
-import type { MiddlewareDeps, AttachOutcomeProof } from "./with-kya-os.deps.js";
+import type { MiddlewareDeps, AttachOutcomeProof, RequireProofLayer } from "./with-kya-os.deps.js";
 /** Collaborators the policy gate borrows from the session/proof sub-factory. */
 export interface PolicyGateWiring {
     attachOutcomeProof: AttachOutcomeProof;
+    requireProofLayer: RequireProofLayer;
 }
 export declare function createPolicyGate(deps: MiddlewareDeps, wiring: PolicyGateWiring): Pick<KyaOsPolicyGate, "withPolicyGate">;

package/dist/middleware/with-kya-os.policy-gate.js

@@ -17,7 +17,7 @@ import { KYA_OS_ERROR_CODES } from "../errors.js";
 import { sanitizeForMessage, extractPolicyPrincipal } from "./with-kya-os.helpers.js";
 export function createPolicyGate(deps, wiring) {
     const { proofGenerator, cryptoProvider, audit } = deps;
-    const { attachOutcomeProof } = wiring;
+    const { attachOutcomeProof, requireProofLayer } = wiring;
     const defaultRiskClassifier = new RiskClassifier();
     const defaultPolicyEngine = new DefaultPolicyEngine();
     function withPolicyGate(toolName, handler, opts = {}) {
@@ -26,6 +26,7 @@ export function createPolicyGate(deps, wiring) {
         const approvalsKey = opts.approvalsArgKey ?? "_kyaos_approvals";
         const isValidApprovalSignature = opts.isValidApprovalSignature ?? (async () => false);
         return async (callArgs, sessionId, context) => {
+            requireProofLayer();
             // Composed after wrapWithDelegation, the approvals argument has already
             // been stripped and arrives in the call context; restore it so a step-up
             // resume verifies the same grants either way.

package/dist/middleware/with-kya-os.policy-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.policy-gate.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.policy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAsB,MAAM,uBAAuB,CAAC;AAEjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAoB,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAQlD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAOtF,MAAM,UAAU,gBAAgB,CAC9B,IAAoB,EACpB,MAAwB;IAExB,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvD,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC;IAEtC,MAAM,qBAAqB,GAAG,IAAI,cAAc,EAAE,CAAC;IACnD,MAAM,mBAAmB,GAAiB,IAAI,mBAAmB,EAAE,CAAC;IAEpE,SAAS,cAAc,CACrB,QAAgB,EAChB,OAAyB,EACzB,OAA0B,EAAE;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,qBAAqB,CAAC;QAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,IAAI,kBAAkB,CAAC;QAChE,MAAM,wBAAwB,GAC5B,IAAI,CAAC,wBAAwB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;QAEvD,OAAO,KAAK,EACV,QAAiC,EACjC,SAAkB,EAClB,OAA0B,EAC1B,EAAE;YACF,wEAAwE;YACxE,yEAAyE;YACzE,8CAA8C;YAC9C,MAAM,IAAI,GACR,QAAQ,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS;gBACtE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE;gBACpD,CAAC,CAAC,QAAQ,CAAC;YAEf,2EAA2E;YAC3E,8CAA8C;YAC9C,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,YAAY;oBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;YAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,iEAAiE;YACjE,wEAAwE;YACxE,MAAM,SAAS,GACb,OAAO,EAAE,SAAS,IAAI,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAE1E,MAAM,aAAa,GAAG,kBAAkB,CAAC;gBACvC,SAAS,EAAE;oBACT,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,GAAG,CAAC,SAAS,CAAC,gBAAgB;wBAC5B,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE;wBAClD,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,MAAM,EAAE,EAAE,QAAQ,EAAE;gBACpB,QAAQ,EAAE,EAAE,SAAS,EAAE;gBACvB,eAAe,EAAE,CAAC,GAAG,SAAS,CAAC,eAAe,CAAC;gBAC/C,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,KAAK;gBACxC,IAAI;aACL,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YAEtD,MAAM,YAAY,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;gBACvD,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChE,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBACnD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;aAC9C,CAAC;YACF,MAAM,KAAK,EAAE,aAAa,CAAC,WAAW,EAAE;gBACtC,OAAO,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW;oBAClD,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;gBAC1D,UAAU,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO;oBACvC,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB;gBACrE,OAAO,EAAE,YAAY;aACtB,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAClC,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;oBACrC,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACjC,MAAM,MAAM,GAA0C;oBACpD,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACnB,KAAK,EAAE,kBAAkB,CAAC,aAAa;gCACvC,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC;6BAC5C,CAAC;yBACH;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;gBACF,OAAO,kBAAkB,CACvB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,QAAQ,EACR,SAAS,CACV,CAAC;YACJ,CAAC;YAED,4EAA4E;YAC5E,wEAAwE;YACxE,kEAAkE;YAClE,MAAM,MAAM,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACpE,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC9C,CAAC,CAAE,IAAI,CAAC,YAAY,CAAqB;gBACzC,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAC7C,MAAM,EACN,MAAM,qBAAqB,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC1E,QAAQ,CAAC,MAAM,EACf,wBAAwB,CACzB,CAAC;YACF,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;oBACrC,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,aAAa,GAAG,wBAAwB,CAAC;gBAC7C,OAAO,EAAE,SAAS,QAAQ,cAAc,QAAQ,CAAC,MAAM,CAAC,CAAC,yCAAyC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI;gBACzI,WAAW,EAAE,WAAW,WAAW,EAAE;gBACrC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;gBAC9C,WAAW;gBACX,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;YACH,MAAM,MAAM,GAA0C;gBACpD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;gBAChE,OAAO,EAAE,IAAI;aACd,CAAC;YACF,OAAO,kBAAkB,CACvB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,kBAAkB,EAClB,SAAS,CACV,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"with-kya-os.policy-gate.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.policy-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAsB,MAAM,uBAAuB,CAAC;AAEjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAoB,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAQlD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAQtF,MAAM,UAAU,gBAAgB,CAC9B,IAAoB,EACpB,MAAwB;IAExB,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvD,MAAM,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC;IAEzD,MAAM,qBAAqB,GAAG,IAAI,cAAc,EAAE,CAAC;IACnD,MAAM,mBAAmB,GAAiB,IAAI,mBAAmB,EAAE,CAAC;IAEpE,SAAS,cAAc,CACrB,QAAgB,EAChB,OAAyB,EACzB,OAA0B,EAAE;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,qBAAqB,CAAC;QAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,IAAI,kBAAkB,CAAC;QAChE,MAAM,wBAAwB,GAC5B,IAAI,CAAC,wBAAwB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;QAEvD,OAAO,KAAK,EACV,QAAiC,EACjC,SAAkB,EAClB,OAA0B,EAC1B,EAAE;YACF,iBAAiB,EAAE,CAAC;YACpB,wEAAwE;YACxE,yEAAyE;YACzE,8CAA8C;YAC9C,MAAM,IAAI,GACR,QAAQ,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS;gBACtE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE;gBACpD,CAAC,CAAC,QAAQ,CAAC;YAEf,2EAA2E;YAC3E,8CAA8C;YAC9C,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,YAAY;oBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;YAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,iEAAiE;YACjE,wEAAwE;YACxE,MAAM,SAAS,GACb,OAAO,EAAE,SAAS,IAAI,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAE1E,MAAM,aAAa,GAAG,kBAAkB,CAAC;gBACvC,SAAS,EAAE;oBACT,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,GAAG,CAAC,SAAS,CAAC,gBAAgB;wBAC5B,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE;wBAClD,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,MAAM,EAAE,EAAE,QAAQ,EAAE;gBACpB,QAAQ,EAAE,EAAE,SAAS,EAAE;gBACvB,eAAe,EAAE,CAAC,GAAG,SAAS,CAAC,eAAe,CAAC;gBAC/C,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,KAAK;gBACxC,IAAI;aACL,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YAEtD,MAAM,YAAY,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;gBACvD,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChE,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBACnD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;aAC9C,CAAC;YACF,MAAM,KAAK,EAAE,aAAa,CAAC,WAAW,EAAE;gBACtC,OAAO,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW;oBAClD,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;gBAC1D,UAAU,EAAE,QAAQ,CAAC,QAAQ,KAAK,OAAO;oBACvC,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB;gBACrE,OAAO,EAAE,YAAY;aACtB,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAClC,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;oBACrC,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACjC,MAAM,MAAM,GAA0C;oBACpD,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACnB,KAAK,EAAE,kBAAkB,CAAC,aAAa;gCACvC,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC;6BAC5C,CAAC;yBACH;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;gBACF,OAAO,kBAAkB,CACvB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,QAAQ,EACR,SAAS,CACV,CAAC;YACJ,CAAC;YAED,4EAA4E;YAC5E,wEAAwE;YACxE,kEAAkE;YAClE,MAAM,MAAM,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACpE,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC9C,CAAC,CAAE,IAAI,CAAC,YAAY,CAAqB;gBACzC,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAC7C,MAAM,EACN,MAAM,qBAAqB,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC1E,QAAQ,CAAC,MAAM,EACf,wBAAwB,CACzB,CAAC;YACF,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE;oBACrC,OAAO,EAAE,WAAW;oBACpB,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,aAAa,GAAG,wBAAwB,CAAC;gBAC7C,OAAO,EAAE,SAAS,QAAQ,cAAc,QAAQ,CAAC,MAAM,CAAC,CAAC,yCAAyC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI;gBACzI,WAAW,EAAE,WAAW,WAAW,EAAE;gBACrC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;gBAC9C,WAAW;gBACX,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;YACH,MAAM,MAAM,GAA0C;gBACpD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;gBAChE,OAAO,EAAE,IAAI;aACd,CAAC;YACF,OAAO,kBAAkB,CACvB,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,QAAQ,CAAC,MAAM,EACf,kBAAkB,EAClB,SAAS,CACV,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,CAAC;AAC5B,CAAC"}