@kya-os/mcp 1.18.0 → 1.20.0

package/dist/middleware/with-kya-os.session.js

@@ -5,8 +5,16 @@
  * live here, so the borrowing semantics are preserved exactly) and the two proof
  * paths: `wrapWithProof` (success responses) and `attachOutcomeProof` (denied /
  * step-up / needs-authorization outcomes). Extracted from `./with-kya-os.ts`.
+ *
+ * Neither path signs in the handler. The MCP SDK changes a result after the
+ * handler returns: SDK 2 adds `resultType` on the 2026-07-28 revision, which
+ * the envelope profile covers; both SDKs fill in a missing `content`, and SDK
+ * 2 appends a text item to `content` when `structuredContent` is not an
+ * object, which the body profile covers. Both paths therefore leave the proof
+ * to the outer layer, the withKyaOs transport, which makes it over the result
+ * it sends, under either profile.
  */
-import { KYA_OS_PROOF_META_KEY, LEGACY_NAMESPACED_PROOF_META_KEY, LEGACY_PROOF_META_KEY, RESPONSE_PROOF_PROFILE_ENVELOPE, } from "../proof/generator.js";
+import { KYA_OS_PROOF_META_KEY, LEGACY_NAMESPACED_PROOF_META_KEY, LEGACY_PROOF_META_KEY, PRECOMPUTED_REQUEST_HASH, RESPONSE_PROOF_PROFILE_ENVELOPE, } from "../proof/generator.js";
 import { validateHandshakeFormat, } from "../session/manager.js";
 import { base64urlEncodeFromBytes } from "../utils/base64.js";
 import { logger } from "../logging/index.js";
@@ -23,29 +31,98 @@ const auditMetaKey = 'org.kya-os/audit';
  * that.
  */
 export const LIFECYCLE_STAMP_META_KEY = 'org.kya-os/lifecycle-stamp';
+/**
+ * The private `_meta` member that names the proof a wrapper left for the
+ * transport to make: a one-time id. What the proof
+ * claims stays in the middleware, keyed by that id, so code that can write a
+ * result cannot choose the claims. The transport redeems the id only on a
+ * result that also carries the middleware's stamp, and strips it as it strips
+ * the stamp. A string, so a copy of the result carries it too.
+ */
+export const PENDING_PROOF_META_KEY = 'org.kya-os/pending-proof';
+/**
+ * How long a proof left for the transport waits to be sent, unless
+ * `pendingProofTtlMs` says otherwise. A result that the SDK never sends (a
+ * cancelled call, or one the SDK replaced) is closed in the audit trail after
+ * this, with `PROOF_NOT_SENT`; one sent later goes out unproven, recorded as
+ * `PROOF_EXPIRED`.
+ */
+const PENDING_PROOF_TTL_MS = 5 * 60_000;
+/** The largest audit context, in UTF-16 code units of JSON, kept for a proof no longer waiting. */
+const CLOSED_PROOF_CONTEXT_LIMIT = 16 * 1024;
+/** Roughly how much the record of proofs no longer waiting may hold, in UTF-16 code units of JSON. */
+const CLOSED_PROOF_BYTE_BUDGET = 4 * 1024 * 1024;
+/** How many proofs may wait at once; past this, the oldest is closed as not sent. */
+const PENDING_PROOF_LIMIT = 10_000;
+/**
+ * Roughly how much the waiting proofs may hold, in UTF-16 code units of their
+ * JSON. An entry holds a request hash, never the arguments, but its audit
+ * context can carry strings a client influenced; past this, the oldest are
+ * closed as not sent.
+ */
+const PENDING_PROOF_BYTE_BUDGET = 16 * 1024 * 1024;
+/** The members only the middleware sets on a result for itself, never sent. */
+const privateMetaKeys = [LIFECYCLE_STAMP_META_KEY, PENDING_PROOF_META_KEY];
+/** The `_meta` members a response proof is placed under. */
+const proofMetaKeys = [
+    KYA_OS_PROOF_META_KEY,
+    LEGACY_NAMESPACED_PROOF_META_KEY,
+    LEGACY_PROOF_META_KEY,
+];
 /**
  * `_meta` members only the middleware itself may set: proofs, a proof error,
- * the audit marker and the lifecycle stamp. A tool result carrying them that
+ * the audit marker and its private members. A tool result carrying them that
  * the middleware did not produce (content relayed from an upstream server, or
  * set by the handler) cannot be told apart from a forgery.
  */
 const outcomeMetaKeys = [
-    KYA_OS_PROOF_META_KEY,
-    LEGACY_NAMESPACED_PROOF_META_KEY,
-    LEGACY_PROOF_META_KEY,
+    ...proofMetaKeys,
     'proofError',
     auditMetaKey,
-    LIFECYCLE_STAMP_META_KEY,
+    ...privateMetaKeys,
 ];
-/** `result` without the `_meta` members in `keys`, dropping `_meta` if nothing else is left. */
-function withoutMetaKeys(result, keys) {
+/** `proofError` on a result whose proof was left to the transport and could not be made. */
+const UNPROVEN_PROOF_ERROR = "Proof generation failed — response is unproven";
+/**
+ * A copy of `value` that later changes to the original cannot reach; the
+ * value itself if it cannot be copied (audit context is plain data).
+ */
+function snapshotOf(value) {
+    try {
+        return structuredClone(value);
+    }
+    catch {
+        return value;
+    }
+}
+/** Options that sign over `requestHash` instead of a request the caller still holds. */
+function signedOver(requestHash, options) {
+    return { ...options, [PRECOMPUTED_REQUEST_HASH]: requestHash };
+}
+/** The request a proof names when its hash was computed earlier: the hash is what is signed. */
+const hashedRequest = (toolName) => ({ method: toolName });
+/**
+ * Thrown by a wrapper, on entry, while no KYA-OS transport is open for this
+ * middleware.
+ */
+const PROOF_NEEDS_TRANSPORT = '[kya-os] A response proof is made where the KYA-OS transport sends the result, ' +
+    'after the MCP SDK has finished it, and no KYA-OS transport is open. Connect the ' +
+    'server with withKyaOs() (with proofAllTools left on; excludeTools leaves an ' +
+    'unwrapped tool unproven), or wrap the transport you connect with ' +
+    'createKyaOsTransport().';
+/**
+ * `result` without the `_meta` members in `keys`, dropping `_meta` if nothing
+ * else is left, unless `keepEmptyMeta`: then an empty `_meta` stays where it
+ * was among the result's members, for members about to be added to it.
+ */
+function withoutMetaKeys(result, keys, keepEmptyMeta = false) {
     const metadata = result._meta;
     if (metadata === undefined || !keys.some((key) => Object.hasOwn(metadata, key))) {
         return result;
     }
     const kept = Object.fromEntries(Object.entries(metadata).filter(([key]) => !keys.includes(key)));
     const copy = { ...result };
-    if (Object.keys(kept).length > 0)
+    if (keepEmptyMeta || Object.keys(kept).length > 0)
         copy._meta = kept;
     else
         delete copy._meta;
@@ -60,9 +137,149 @@ function withoutMetaKeys(result, keys) {
 export function withoutOutcomeMeta(result) {
     return withoutMetaKeys(result, outcomeMetaKeys);
 }
-/** Remove the lifecycle stamp, which must never leave the process. */
-export function withoutLifecycleStamp(result) {
-    return withoutMetaKeys(result, [LIFECYCLE_STAMP_META_KEY]);
+const isRecord = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+/**
+ * The fast path of {@link scrubPrivateMeta}: when nothing below the root's
+ * own `_meta` names a private member or holds the stamp, which one native
+ * serialization shows, only the root's private members need removing. Returns
+ * undefined when the full walk is needed, or the value cannot be serialized.
+ */
+function scrubShallow(root, stamp, keepEmptyRootMeta) {
+    if (!isRecord(root))
+        return undefined;
+    let rest;
+    try {
+        // The root's own private members are the only ones expected; they are
+        // left out of the check, and removed below. No replacer, so the whole
+        // check runs at native speed.
+        const rootMeta = root._meta;
+        const shallow = isRecord(rootMeta)
+            ? {
+                ...root,
+                _meta: Object.fromEntries(Object.entries(rootMeta).filter(([name]) => !privateMetaKeys.includes(name))),
+            }
+            : root;
+        rest = JSON.stringify(shallow);
+    }
+    catch {
+        return undefined;
+    }
+    if (rest === undefined ||
+        rest.includes(LIFECYCLE_STAMP_META_KEY) ||
+        rest.includes(PENDING_PROOF_META_KEY) ||
+        (stamp !== undefined && rest.includes(stamp))) {
+        return undefined;
+    }
+    const rootMeta = root._meta;
+    const ids = stamp !== undefined && isRecord(rootMeta) && rootMeta[LIFECYCLE_STAMP_META_KEY] === stamp &&
+        typeof rootMeta[PENDING_PROOF_META_KEY] === 'string'
+        ? [rootMeta[PENDING_PROOF_META_KEY]]
+        : [];
+    return {
+        value: withoutMetaKeys(root, privateMetaKeys, keepEmptyRootMeta),
+        leaked: [],
+        ids,
+    };
+}
+/**
+ * Remove the middleware's private `_meta` members from `root` and everything
+ * nested in it, at any depth, such as a wrapped result a handler placed in
+ * its own result. The walk is iterative, so depth costs no stack. Shared
+ * objects are rewritten once; a cyclic one is left as it is where the cycle
+ * closes. Only what changes is copied. A `_meta` left empty is dropped,
+ * except the root's when `keepEmptyRootMeta`, which keeps its place among
+ * the result's members for the proof members about to go into it. With a
+ * `stamp`, every string holding it, a wrapped result serialized into a text
+ * item for example, is reported.
+ */
+function scrubPrivateMeta(root, stamp, keepEmptyRootMeta) {
+    const fast = scrubShallow(root, stamp, keepEmptyRootMeta);
+    if (fast !== undefined)
+        return fast;
+    const leaked = [];
+    const ids = [];
+    const checkString = (value) => {
+        if (stamp !== undefined && typeof value === 'string' && value.includes(stamp))
+            leaked.push(value);
+    };
+    checkString(root);
+    if (root === null || typeof root !== 'object')
+        return { value: root, leaked, ids };
+    // The members to walk of a node: a `_meta`'s private members are skipped,
+    // since they are removed, and the stamp there is the stamp itself.
+    const membersOf = (node, key) => key === '_meta' && isRecord(node)
+        ? Object.entries(node).filter(([name]) => !privateMetaKeys.includes(name))
+        : Object.entries(node);
+    const done = new Map();
+    const inProgress = new Set();
+    const stack = [
+        { node: root, key: undefined, expanded: false },
+    ];
+    while (stack.length > 0) {
+        const top = stack[stack.length - 1];
+        if (!top.expanded) {
+            if (done.has(top.node) || inProgress.has(top.node)) {
+                stack.pop();
+                continue;
+            }
+            top.expanded = true;
+            inProgress.add(top.node);
+            if (stamp !== undefined && top.key === '_meta' && isRecord(top.node) &&
+                top.node[LIFECYCLE_STAMP_META_KEY] === stamp && typeof top.node[PENDING_PROOF_META_KEY] === 'string') {
+                ids.push(top.node[PENDING_PROOF_META_KEY]);
+            }
+            for (const [name, member] of membersOf(top.node, top.key)) {
+                checkString(member);
+                if (member !== null && typeof member === 'object' && !done.has(member) && !inProgress.has(member)) {
+                    stack.push({ node: member, key: name, expanded: false });
+                }
+            }
+            continue;
+        }
+        stack.pop();
+        inProgress.delete(top.node);
+        const node = top.node;
+        const scrubbedOf = (member) => member !== null && typeof member === 'object' ? done.get(member) ?? member : member;
+        if (Array.isArray(node)) {
+            let items;
+            node.forEach((item, index) => {
+                const scrubbed = scrubbedOf(item);
+                if (scrubbed !== item)
+                    (items ??= [...node])[index] = scrubbed;
+            });
+            done.set(node, items ?? node);
+            continue;
+        }
+        const record = node;
+        let members;
+        for (const [name, member] of Object.entries(record)) {
+            let scrubbed = scrubbedOf(member);
+            if (name === '_meta' && isRecord(scrubbed) && privateMetaKeys.some((key) => Object.hasOwn(scrubbed, key))) {
+                scrubbed = Object.fromEntries(Object.entries(scrubbed).filter(([key]) => !privateMetaKeys.includes(key)));
+                if (Object.keys(scrubbed).length === 0 && !(keepEmptyRootMeta && node === root)) {
+                    delete (members ??= { ...record })[name];
+                    continue;
+                }
+            }
+            if (scrubbed !== member)
+                (members ??= { ...record })[name] = scrubbed;
+        }
+        done.set(node, members ?? node);
+    }
+    // The root is the walk's first node and is always finished, as a copy or
+    // as itself.
+    return { value: done.get(root), leaked, ids };
+}
+/**
+ * Remove the middleware's private members, which must never leave the
+ * process, from `result` and from everything nested in it, at any depth.
+ */
+export function withoutPrivateMeta(result) {
+    return scrubPrivateMeta(result, undefined, false).value;
+}
+/** Any value without the middleware's private `_meta` members, at any depth. */
+export function withoutPrivateMembers(value) {
+    return scrubPrivateMeta(value, undefined, false).value;
 }
 /**
  * Each middleware's hook for an outer auto-proof layer, keyed by its
@@ -74,22 +291,52 @@ const outerProofLayerHooks = new WeakMap();
 /**
  * Tell the middleware behind `wrapWithProof` that an outer layer (the withKyaOs
  * transport) reads its results. From then on its wrappers stamp what they
- * return with the middleware's token. Returns the check for that stamp, or
+ * return with the middleware's token and leave their proofs to the layer.
+ * Returns the layer's view of those results, or
  * undefined for a middleware this module did not create, whose results are
  * then never treated as its own.
  */
 export function attachOuterProofLayer(wrapWithProof) {
     return outerProofLayerHooks.get(wrapWithProof)?.();
 }
+/** `proofError` on an allow result the fallback could not attribute. */
+const AMBIGUOUS_SESSION_PROOF_ERROR = "Proof session is ambiguous (several live sessions, none threaded) — response is unproven";
 export function createSessionProof(deps) {
     const { identity, config, cryptoProvider, sessionManager, proofGenerator, auditLog, audit, emitLegacyProofKey, responseProofProfile, } = deps;
+    const pendingProofTtlMs = config.pendingProofTtlMs ?? PENDING_PROOF_TTL_MS;
     const bindsEnvelope = responseProofProfile === RESPONSE_PROOF_PROFILE_ENVELOPE;
     const auditedTerminalResponses = new WeakSet();
     // This middleware's lifecycle token, minted once an outer layer reads its
     // results. Only wrappers holding it can stamp a result as their own.
     let lifecycleStamp;
+    // KYA-OS transports open for this middleware. The wrappers refuse to run
+    // while there are none.
+    let openTransports = 0;
+    // Proofs left for the transport, by one-time id, each with the timer that
+    // closes it as not sent. The claims never leave the middleware.
+    const pendingProofs = new Map();
+    let pendingProofBytes = 0;
+    // What a proof no longer waiting was about, by its id, so a result sent
+    // after it closed can be recorded against its tool and call. Bounded:
+    // the oldest are forgotten, and a large audit context is not kept.
+    const closedProofs = new Map();
+    let closedProofBytes = 0;
     const hasOwnStamp = (response) => lifecycleStamp !== undefined &&
         response._meta?.[LIFECYCLE_STAMP_META_KEY] === lifecycleStamp;
+    /**
+     * A copy of `response` with `members` set. Every member the middleware
+     * attaches goes on a copy: a handler may return one object from every call
+     * (a module-level constant, a cached result) or freeze it, and a member set
+     * on that object would reach the next call. Each `_meta` passed here is a
+     * new object, so the handler's `_meta` is never changed either. A copy of
+     * an outcome this middleware audited counts as that outcome.
+     */
+    const withMembers = (response, members) => {
+        const copy = { ...response, ...members };
+        if (auditedTerminalResponses.has(response))
+            auditedTerminalResponses.add(copy);
+        return copy;
+    };
     const emitAudit = async (label, operation, toolName) => {
         try {
             await operation();
@@ -103,6 +350,7 @@ export function createSessionProof(deps) {
             return false;
         }
     };
+    /** A copy of `response` marked as an error whose audit delivery failed. */
     const markAuditDegraded = (response, reason, stripSuccessProof) => {
         const metadata = {
             ...(response._meta ?? {}),
@@ -118,9 +366,7 @@ export function createSessionProof(deps) {
             status: 'degraded',
             reason,
         };
-        response._meta = metadata;
-        response.isError = true;
-        return response;
+        return withMembers(response, { _meta: metadata, isError: true });
     };
     const auditUnavailableResponse = (reason) => ({
         content: [{
@@ -154,19 +400,17 @@ export function createSessionProof(deps) {
      */
     const handlerMeta = (response) => withoutOutcomeMeta(response)._meta ?? {};
     /**
-     * Stamp a result whose lifecycle a wrapper has run, so the outer layer
-     * neither re-proves nor re-audits it. Without an outer layer there is no
-     * token, nothing would strip the stamp, and the result is returned as it was.
+     * A copy of a result whose lifecycle a wrapper has run, stamped so the
+     * outer layer neither re-proves nor re-audits it. A wrapper runs only while a KYA-OS
+     * transport is open (see `requireProofLayer`), and a transport makes the
+     * token when it attaches, so there always is one here.
      */
-    const stampLifecycle = (response) => {
-        if (lifecycleStamp === undefined)
-            return response;
-        response._meta = {
+    const stampLifecycle = (response) => withMembers(response, {
+        _meta: {
             ...(response._meta ?? {}),
             [LIFECYCLE_STAMP_META_KEY]: lifecycleStamp,
-        };
-        return response;
-    };
+        },
+    });
     const auditContext = (context) => context === undefined
         ? undefined
         : {
@@ -192,6 +436,101 @@ export function createSessionProof(deps) {
         [KYA_OS_PROOF_META_KEY]: proof,
         ...(emitLegacyProofKey ? { [LEGACY_PROOF_META_KEY]: proof } : {}),
     });
+    /**
+     * A proof can only be made where the result is sent, so a wrapper with no
+     * open KYA-OS transport to send it refuses before it does anything, rather
+     * than send a result it cannot prove.
+     */
+    const requireProofLayer = () => {
+        if (openTransports === 0) {
+            throw new Error(PROOF_NEEDS_TRANSPORT);
+        }
+    };
+    /** Remove and return the proof waiting under `id`, if one is, remembering what it was about. */
+    const takePendingProof = (id) => {
+        const entry = pendingProofs.get(id);
+        if (entry === undefined)
+            return undefined;
+        pendingProofs.delete(id);
+        pendingProofBytes -= entry.size;
+        clearTimeout(entry.timer);
+        const { toolName } = entry.pending;
+        const context = entry.pending.kind === 'allowed' ? entry.pending.context : undefined;
+        const contextSize = context === undefined ? 0 : JSON.stringify(context).length;
+        const keepContext = context !== undefined && contextSize <= CLOSED_PROOF_CONTEXT_LIMIT;
+        const size = toolName.length + (keepContext ? contextSize : 0);
+        closedProofs.set(id, { toolName, ...(keepContext ? { context } : {}), size });
+        closedProofBytes += size;
+        // Oldest first, as the waiting proofs are evicted.
+        while (closedProofs.size > PENDING_PROOF_LIMIT || closedProofBytes > CLOSED_PROOF_BYTE_BUDGET) {
+            const oldest = closedProofs.keys().next().value;
+            closedProofBytes -= closedProofs.get(oldest).size;
+            closedProofs.delete(oldest);
+        }
+        return entry.pending;
+    };
+    /**
+     * Close, in the audit trail, a proof that was never sent: the SDK dropped
+     * its result (a cancelled call, or one the SDK replaced), or no transport
+     * is left to send it. Both record the proof rejected with `PROOF_NOT_SENT`.
+     * An allowed call, whose result the client never saw, then records the
+     * call failed with `RESULT_NOT_SENT`, never completed. An outcome's terminal
+     * events were recorded in the handler.
+     */
+    const closeUnsentProof = async (id) => {
+        const pending = takePendingProof(id);
+        if (pending !== undefined)
+            await closeTaken(pending);
+    };
+    async function closeTaken(pending, verificationCode = 'PROOF_NOT_SENT') {
+        if (pending.kind === 'outcome') {
+            if (pending.terminalAuditDelivered) {
+                await emitAudit('Failed to record unsent outcome proof', () => audit?.proof('rejected', { outcome: 'failed', verificationCode }), pending.toolName);
+            }
+            return;
+        }
+        const { toolName, context } = pending;
+        const proofAuditDelivered = await emitAudit('Failed to record unsent proof', () => audit?.proof('rejected', { outcome: 'failed', verificationCode, context }), toolName);
+        if (proofAuditDelivered) {
+            await emitAudit('Failed to record unsent tool outcome', () => audit?.tool('failed', { toolName, outcome: 'failed', reasonCode: 'RESULT_NOT_SENT', context }), toolName);
+        }
+    }
+    /** Close every waiting proof as not sent: no KYA-OS transport is left to send it. */
+    const closeAllUnsentProofs = () => {
+        for (const id of [...pendingProofs.keys()])
+            void closeUnsentProof(id);
+    };
+    /**
+     * Leave `pending` for the outer layer to prove over the result it sends:
+     * the MCP SDK changes members after the handler returns, so a proof made
+     * here would not cover what the client receives.
+     * The copy returned carries only a one-time id; the claims stay here, by
+     * request hash. Past the count or the size budget, the oldest waiting proofs are
+     * closed as not sent.
+     */
+    const leaveToOuterLayer = (response, pending) => {
+        const size = JSON.stringify(pending).length;
+        while (pendingProofs.size > 0 &&
+            (pendingProofs.size >= PENDING_PROOF_LIMIT || pendingProofBytes + size > PENDING_PROOF_BYTE_BUDGET)) {
+            const oldest = pendingProofs.keys().next().value;
+            // Taken now, so the loop sees it gone; recorded in the background.
+            const evicted = takePendingProof(oldest);
+            if (evicted !== undefined)
+                void closeTaken(evicted);
+        }
+        const id = base64urlEncodeFromBytes(globalThis.crypto.getRandomValues(new Uint8Array(16)));
+        const timer = setTimeout(() => void closeUnsentProof(id), pendingProofTtlMs);
+        // Do not hold a process open for an audit close-out.
+        timer.unref?.();
+        pendingProofs.set(id, { pending, timer, size });
+        pendingProofBytes += size;
+        return withMembers(response, {
+            _meta: {
+                ...(response._meta ?? {}),
+                [PENDING_PROOF_META_KEY]: id,
+            },
+        });
+    };
     // Single-process fallback for the established (handshake or auto) session, used
     // ONLY when no sessionId was threaded into the wrapper — e.g. non-KYA-OS clients
     // (MCP Inspector) and the transport auto-proof path, which never thread one. The
@@ -291,21 +630,24 @@ export function createSessionProof(deps) {
             const existing = await sessionManager.getSession(activeSessionId);
             if (existing) {
                 if ((await liveSessionCount()) <= 1) {
-                    return activeSessionId;
+                    return { sessionId: activeSessionId };
                 }
                 // Ambiguous: more than one session and none threaded — do NOT borrow.
                 logger.warn("[kya-os] Multiple sessions active and no sessionId threaded; skipping " +
                     "proof attribution to avoid signing with another client's session. " +
                     "Thread the sessionId (the auto-proof path is single-session only).");
-                return undefined;
+                return { sessionId: undefined, ambiguous: true };
             }
         }
         if (!config.autoSession)
-            return undefined;
+            return { sessionId: undefined, ambiguous: false };
         autoSessionInFlight ??= createAutoSession().finally(() => {
             autoSessionInFlight = undefined;
         });
-        return autoSessionInFlight;
+        const sessionId = await autoSessionInFlight;
+        return sessionId === undefined
+            ? { sessionId: undefined, ambiguous: false }
+            : { sessionId };
     }
     async function createAutoSession() {
         // Generate a server-side session with cryptographically random nonce (SPEC.md §4)
@@ -325,10 +667,15 @@ export function createSessionProof(deps) {
     }
     function wrapWithProof(toolName, handler) {
         const run = async (args, sessionId, context) => {
+            // What the proof and the audit trail record of the call is read before
+            // the handler runs: the handler is handed the same context object and
+            // could change it, choosing the scope the proof would claim.
+            const callAudit = snapshotOf(auditContext(context));
+            const scopeId = context?.scopeId;
             const intentDelivered = await emitAudit('Required tool intent audit delivery failed', () => audit?.tool('started', {
                 toolName,
                 outcome: 'unknown',
-                context: auditContext(context),
+                context: callAudit,
             }), toolName);
             if (!intentDelivered) {
                 return auditUnavailableResponse('Required intent audit delivery failed before tool execution');
@@ -342,36 +689,52 @@ export function createSessionProof(deps) {
                     toolName,
                     outcome: 'failed',
                     reasonCode: 'HANDLER_THROWN',
-                    context: auditContext(context),
+                    context: callAudit,
                 }), toolName);
                 throw error;
             }
+            // An outcome the gates or proveOutcome already proved and audited (a
+            // challenge need not be an error result): signing it again would replace
+            // its outcome proof with one that records the call as allowed. Matched by
+            // identity, so a relayed result's own markers never qualify.
+            if (auditedTerminalResponses.has(result))
+                return result;
             if (result.isError) {
                 if (!hasTerminalAuditMarker(result)) {
                     const delivered = await emitAudit('Failed to record error tool outcome', () => audit?.tool('failed', {
                         toolName,
                         outcome: 'failed',
                         reasonCode: 'HANDLER_ERROR_RESULT',
-                        context: auditContext(context),
+                        context: callAudit,
                     }), toolName);
                     if (!delivered) {
-                        markAuditDegraded(result, 'Required terminal audit delivery failed for an error response', false);
+                        return markAuditDegraded(result, 'Required terminal audit delivery failed for an error response', false);
                     }
                 }
                 return result;
             }
             // Resolve session: explicit param → active session → auto-create
-            const resolvedSessionId = sessionId ?? await ensureSession();
+            // `== null`, as `??` below: a plain-JS caller may thread null.
+            const fallback = sessionId == null ? await ensureSession() : undefined;
+            const resolvedSessionId = sessionId ?? fallback?.sessionId;
             if (!resolvedSessionId) {
+                // Refusing to borrow another client's session must not look like a
+                // server that never proves: the result says it is unproven, as it
+                // does when proof generation fails.
+                if (fallback !== undefined && fallback.sessionId === undefined && fallback.ambiguous) {
+                    result = withMembers(result, {
+                        _meta: { ...handlerMeta(result), proofError: AMBIGUOUS_SESSION_PROOF_ERROR },
+                    });
+                }
                 const proofAuditDelivered = await emitAudit('Failed to record unavailable proof session', () => audit?.proof('rejected', {
                     outcome: 'failed',
                     verificationCode: 'PROOF_SESSION_UNAVAILABLE',
-                    context: auditContext(context),
+                    context: callAudit,
                 }), toolName);
                 const terminalAuditDelivered = proofAuditDelivered && await emitAudit('Failed to record completed tool outcome', () => audit?.tool('completed', {
                     toolName,
                     outcome: 'succeeded',
-                    context: auditContext(context),
+                    context: callAudit,
                 }), toolName);
                 if (!terminalAuditDelivered) {
                     return markAuditDegraded(result, 'Required terminal audit delivery failed after tool completion', true);
@@ -383,92 +746,124 @@ export function createSessionProof(deps) {
                 const proofAuditDelivered = await emitAudit('Failed to record missing proof session', () => audit?.proof('rejected', {
                     outcome: 'failed',
                     verificationCode: 'PROOF_SESSION_NOT_FOUND',
-                    context: auditContext(context),
+                    context: callAudit,
                 }), toolName);
                 const terminalAuditDelivered = proofAuditDelivered && await emitAudit('Failed to record completed tool outcome', () => audit?.tool('completed', {
                     toolName,
                     outcome: 'succeeded',
-                    context: auditContext(context),
+                    context: callAudit,
                 }), toolName);
                 if (!terminalAuditDelivered) {
                     return markAuditDegraded(result, 'Required terminal audit delivery failed after tool completion', true);
                 }
                 return result;
             }
+            // The request is hashed now, as the wrapper saw it; the arguments are
+            // not kept. Arguments that cannot be hashed fail the proof here.
+            let requestHash;
             try {
-                const request = { method: toolName, params: args };
-                // The envelope profile binds the FULL result envelope (hashing strips the top-level
-                // `_meta`, where the proof itself is attached below); the body profile binds the
-                // content array only — the original wire contract.
-                const response = {
-                    data: bindsEnvelope ? result : result.content,
-                };
-                const proof = await proofGenerator.generateProof(request, response, session, { scopeId: context?.scopeId, profile: responseProofProfile });
-                // Attach proof under the namespaced _meta key (rendered by MCP
-                // Inspector, invisible to LLMs), plus the legacy bare key when enabled.
-                // Keys the handler set (traceparent, related-task, ...) are kept: the
-                // middleware does not own `_meta` (SPEC §7.6).
-                result._meta = withProofMeta(handlerMeta(result), proof);
-                const proofAuditDelivered = await emitAudit('Required generated-proof audit delivery failed', () => audit?.proof('generated', {
-                    outcome: 'succeeded',
-                    context: auditContext(context),
-                }), toolName);
-                const terminalAuditDelivered = proofAuditDelivered && await emitAudit('Required completed-tool audit delivery failed', () => audit?.tool('completed', {
-                    toolName,
-                    outcome: 'succeeded',
-                    context: auditContext(context),
-                }), toolName);
-                if (!terminalAuditDelivered) {
-                    return markAuditDegraded(result, 'Required terminal audit delivery failed after tool completion', true);
-                }
-                // Hand the verified call to the audit sink. A sink failure MUST NOT
-                // break the tool response, so it is logged and swallowed.
-                try {
-                    await auditLog.logAuditRecord({
-                        identity: { did: identity.did, kid: identity.kid },
-                        session: { sessionId: session.sessionId, audience: session.audience },
-                        requestHash: proof.meta.requestHash,
-                        responseHash: proof.meta.responseHash,
-                        verified: "yes",
-                        scopeId: proof.meta.scopeId,
-                    });
-                }
-                catch (auditError) {
-                    logger.error("[kya-os] Audit log failed", {
-                        tool: toolName,
-                        error: auditError instanceof Error
-                            ? auditError.message
-                            : String(auditError),
-                    });
-                }
+                requestHash = await proofGenerator.hashRequest({ method: toolName, params: args });
             }
             catch (error) {
-                logger.error("[kya-os] Proof generation failed", {
+                return allowedProofFailed(result, toolName, callAudit, error);
+            }
+            const pending = {
+                kind: 'allowed',
+                toolName,
+                requestHash,
+                sessionId: session.sessionId,
+                ...(scopeId === undefined ? {} : { scopeId }),
+                ...(callAudit === undefined ? {} : { context: callAudit }),
+            };
+            return leaveToOuterLayer(result, pending);
+        };
+        return async (args, sessionId, context) => {
+            requireProofLayer();
+            return stampLifecycle(await run(args, sessionId, context));
+        };
+    }
+    /**
+     * Sign an allowed call's result, record the proof and the call's
+     * completion, and hand the call to the audit sink. Run by the outer layer,
+     * over the result it sends.
+     */
+    async function proveAllowedCall(result, pending, session) {
+        const { toolName, requestHash, scopeId, context } = pending;
+        let proved;
+        try {
+            // The envelope profile binds the FULL result envelope (hashing strips the top-level
+            // `_meta`, where the proof itself is attached below); the body profile binds the
+            // content array only — the original wire contract.
+            const response = {
+                data: bindsEnvelope ? result : result.content,
+            };
+            const proof = await proofGenerator.generateProof(hashedRequest(toolName), response, session, signedOver(requestHash, { scopeId, profile: responseProofProfile }));
+            // Attach proof under the namespaced _meta key (rendered by MCP
+            // Inspector, invisible to LLMs), plus the legacy bare key when enabled.
+            // Keys the handler set (traceparent, related-task, ...) are kept: the
+            // middleware does not own `_meta` (SPEC §7.6).
+            proved = withMembers(result, { _meta: withProofMeta(handlerMeta(result), proof) });
+            const proofAuditDelivered = await emitAudit('Required generated-proof audit delivery failed', () => audit?.proof('generated', {
+                outcome: 'succeeded',
+                context,
+            }), toolName);
+            const terminalAuditDelivered = proofAuditDelivered && await emitAudit('Required completed-tool audit delivery failed', () => audit?.tool('completed', {
+                toolName,
+                outcome: 'succeeded',
+                context,
+            }), toolName);
+            if (!terminalAuditDelivered) {
+                return markAuditDegraded(proved, 'Required terminal audit delivery failed after tool completion', true);
+            }
+            // Hand the verified call to the audit sink. A sink failure MUST NOT
+            // break the tool response, so it is logged and swallowed.
+            try {
+                await auditLog.logAuditRecord({
+                    identity: { did: identity.did, kid: identity.kid },
+                    session: { sessionId: session.sessionId, audience: session.audience },
+                    requestHash: proof.meta.requestHash,
+                    responseHash: proof.meta.responseHash,
+                    verified: "yes",
+                    scopeId: proof.meta.scopeId,
+                });
+            }
+            catch (auditError) {
+                logger.error("[kya-os] Audit log failed", {
                     tool: toolName,
-                    error: error instanceof Error ? error.message : String(error),
+                    error: auditError instanceof Error
+                        ? auditError.message
+                        : String(auditError),
                 });
-                result._meta = {
-                    ...handlerMeta(result),
-                    proofError: "Proof generation failed — response is unproven",
-                };
-                const rejectionAuditDelivered = await emitAudit('Failed to record proof-generation rejection', () => audit?.proof('rejected', {
-                    outcome: 'failed',
-                    verificationCode: 'PROOF_GENERATION_FAILED',
-                    context: auditContext(context),
-                }), toolName);
-                if (!rejectionAuditDelivered) {
-                    markAuditDegraded(result, 'Required proof-failure audit delivery failed after tool completion', true);
-                }
             }
-            return result;
-        };
-        return async (args, sessionId, context) => stampLifecycle(await run(args, sessionId, context));
+        }
+        catch (error) {
+            return allowedProofFailed(result, toolName, context, error);
+        }
+        return proved;
     }
-    outerProofLayerHooks.set(wrapWithProof, () => {
-        lifecycleStamp ??= base64urlEncodeFromBytes(globalThis.crypto.getRandomValues(new Uint8Array(16)));
-        return hasOwnStamp;
-    });
-    const outcomeProof = async (response, toolName, args, sessionId, reason, outcome = "denied", paramsOverride, responseData) => {
+    /**
+     * An allowed call whose proof could not be made: the result goes out with
+     * `proofError`, and the audit trail records the rejection.
+     */
+    async function allowedProofFailed(result, toolName, context, error) {
+        logger.error("[kya-os] Proof generation failed", {
+            tool: toolName,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        const unproven = withMembers(result, {
+            _meta: { ...handlerMeta(result), proofError: UNPROVEN_PROOF_ERROR },
+        });
+        const rejectionAuditDelivered = await emitAudit('Failed to record proof-generation rejection', () => audit?.proof('rejected', {
+            outcome: 'failed',
+            verificationCode: 'PROOF_GENERATION_FAILED',
+            context,
+        }), toolName);
+        if (!rejectionAuditDelivered) {
+            return markAuditDegraded(unproven, 'Required proof-failure audit delivery failed after tool completion', true);
+        }
+        return unproven;
+    }
+    const outcomeProof = async (response, toolName, args, sessionId, reason, outcome = "denied", paramsOverride) => {
         const phase = outcome === 'denied' ? 'denied' : 'step_up_required';
         const reasonCode = outcome === 'needs_authorization'
             ? 'NEEDS_AUTHORIZATION'
@@ -482,87 +877,267 @@ export function createSessionProof(deps) {
             outcome: outcome === 'denied' ? 'denied' : 'challenged',
             reasonCode,
         }), toolName);
-        auditedTerminalResponses.add(response);
-        response._meta = {
-            ...(response._meta ?? {}),
-            [auditMetaKey]: {
-                terminal: true,
-                outcome,
-                ...(!terminalAuditDelivered
-                    ? {
-                        status: 'degraded',
-                        reason: 'Required terminal audit delivery failed for authorization outcome',
-                    }
-                    : {}),
+        // The copy is the outcome, not the response it was made from: a gate or
+        // a caller may hand in one object for many calls.
+        const audited = withMembers(response, {
+            _meta: {
+                ...(response._meta ?? {}),
+                [auditMetaKey]: {
+                    terminal: true,
+                    outcome,
+                    ...(!terminalAuditDelivered
+                        ? {
+                            status: 'degraded',
+                            reason: 'Required terminal audit delivery failed for authorization outcome',
+                        }
+                        : {}),
+                },
             },
-        };
+        });
+        auditedTerminalResponses.add(audited);
+        let session;
         try {
-            const resolvedSessionId = sessionId ?? (await ensureSession());
-            if (!resolvedSessionId)
-                return response;
-            const session = await sessionManager.getSession(resolvedSessionId);
-            if (!session)
-                return response;
-            // Prefer the caller's already-stripped args so the signed requestHash
-            // matches the needs_approval / resumeToken requestHash exactly.
-            let cleanArgs;
-            if (paramsOverride !== undefined) {
-                cleanArgs = paramsOverride;
-            }
-            else {
-                cleanArgs = {};
-                for (const [k, v] of Object.entries(args)) {
-                    if (k !== "_kyaos_delegation")
-                        cleanArgs[k] = v;
-                }
+            const resolvedSessionId = sessionId ?? (await ensureSession()).sessionId;
+            session = resolvedSessionId ? await sessionManager.getSession(resolvedSessionId) : undefined;
+        }
+        catch (error) {
+            await outcomeProofFailed(toolName, error, terminalAuditDelivered);
+            return audited;
+        }
+        if (!session)
+            return audited;
+        // Prefer the caller's already-stripped args so the signed requestHash
+        // matches the needs_approval / resumeToken requestHash exactly.
+        let cleanArgs;
+        if (paramsOverride !== undefined) {
+            cleanArgs = paramsOverride;
+        }
+        else {
+            cleanArgs = {};
+            for (const [k, v] of Object.entries(args)) {
+                if (k !== "_kyaos_delegation")
+                    cleanArgs[k] = v;
             }
-            const request = { method: toolName, params: cleanArgs };
-            // `responseData !== undefined` signals this outcome has a body to bind
-            // (the needs_authorization challenge); denial / step-up proofs stay
-            // body-free under every profile. WHAT gets bound is profile-selected:
-            // the envelope profile binds the full response envelope the client receives (hashing
-            // strips `_meta`, where the proof lands below), the body profile the bare challenge
-            // content — the original wire contract.
-            const proofResponse = responseData !== undefined
-                ? { data: bindsEnvelope ? response : responseData }
+        }
+        // Hashed now, as with an allowed call; the arguments are not kept.
+        let requestHash;
+        try {
+            requestHash = await proofGenerator.hashRequest({ method: toolName, params: cleanArgs });
+        }
+        catch (error) {
+            await outcomeProofFailed(toolName, error, terminalAuditDelivered);
+            return markUnproven(audited);
+        }
+        const pending = {
+            kind: 'outcome',
+            toolName,
+            requestHash,
+            sessionId: session.sessionId,
+            outcome,
+            reason: sanitizeForMessage(reason),
+            terminalAuditDelivered,
+        };
+        return leaveToOuterLayer(audited, pending);
+    };
+    /**
+     * Sign an authorization outcome and record the proof. Run by the outer
+     * layer, over the result it sends; a proof that fails is reported on the
+     * result, as an allowed call's is.
+     */
+    async function proveAuthorizationOutcome(response, pending, session) {
+        const { toolName, requestHash, outcome, reason, terminalAuditDelivered } = pending;
+        let proved = response;
+        try {
+            // A needs_authorization challenge has a body to bind; denial / step-up
+            // proofs stay body-free under every profile (SPEC §7.4). WHAT gets bound
+            // is profile-selected: the envelope profile binds the full response
+            // envelope the client receives (hashing strips `_meta`, where the proof
+            // lands below), the body profile the bare challenge content — the
+            // original wire contract.
+            const proofResponse = outcome === "needs_authorization"
+                ? { data: bindsEnvelope ? response : response.content }
                 : undefined;
-            const proof = await proofGenerator.generateProof(request, proofResponse, session, {
+            const proof = await proofGenerator.generateProof(hashedRequest(toolName), proofResponse, session, signedOver(requestHash, {
                 outcome,
                 reason: sanitizeForMessage(reason),
                 profile: responseProofProfile,
+            }));
+            proved = withMembers(response, {
+                _meta: withProofMeta(response._meta ?? {}, proof),
             });
-            response._meta = withProofMeta(response._meta ?? {}, proof);
             if (terminalAuditDelivered) {
                 const proofAuditDelivered = await emitAudit('Failed to record generated outcome proof', () => audit?.proof('generated', { outcome: 'succeeded' }), toolName);
                 if (!proofAuditDelivered) {
-                    // markAuditDegraded flips isError on the response. Under the body profile that
-                    // mutation is outside proof coverage, so the already-attached
+                    // markAuditDegraded sets isError on the copy it returns. Under the body profile that
+                    // member is outside proof coverage, so the already-attached
                     // challenge proof stays verifiable and is kept. Under the envelope profile the
                     // envelope binding COVERS isError — keeping the proof would ship a
                     // binding the client must reject as tampering — so the degraded
                     // path strips it (mirroring wrapWithProof's degraded semantics):
                     // a degraded envelope-profile challenge ships unproven, never falsely "MITM'd".
-                    markAuditDegraded(response, 'Required proof audit delivery failed for authorization outcome', bindsEnvelope);
+                    proved = markAuditDegraded(proved, 'Required proof audit delivery failed for authorization outcome', bindsEnvelope);
                 }
             }
         }
         catch (error) {
-            logger.error("[kya-os] Outcome proof generation failed", {
-                tool: toolName,
-                error: error instanceof Error ? error.message : String(error),
-            });
-            if (terminalAuditDelivered) {
-                await emitAudit('Failed to record outcome-proof rejection', () => audit?.proof('rejected', {
-                    outcome: 'failed',
-                    verificationCode: 'OUTCOME_PROOF_GENERATION_FAILED',
-                }), toolName);
-            }
+            await outcomeProofFailed(toolName, error, terminalAuditDelivered);
+            return markUnproven(proved);
         }
-        return response;
-    };
+        return proved;
+    }
+    async function outcomeProofFailed(toolName, error, terminalAuditDelivered) {
+        logger.error("[kya-os] Outcome proof generation failed", {
+            tool: toolName,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        if (terminalAuditDelivered) {
+            await emitAudit('Failed to record outcome-proof rejection', () => audit?.proof('rejected', {
+                outcome: 'failed',
+                verificationCode: 'OUTCOME_PROOF_GENERATION_FAILED',
+            }), toolName);
+        }
+    }
     // Outcome results are stamped like wrapper results, so the outer layer
     // passes a signed denial or challenge through instead of re-proving it.
     const attachOutcomeProof = async (...outcome) => stampLifecycle(await outcomeProof(...outcome));
-    return { handleHandshake, ensureSession, wrapWithProof, attachOutcomeProof };
+    /** A copy of `response` that says it goes out without the proof it was meant to carry. */
+    const markUnproven = (response) => withMembers(response, {
+        _meta: {
+            ...(withoutMetaKeys(response, proofMetaKeys)._meta ?? {}),
+            proofError: UNPROVEN_PROOF_ERROR,
+        },
+    });
+    /**
+     * A result sent without the proof left for it: its session is gone
+     * (`PROOF_SESSION_NOT_FOUND`), or it carries the middleware's private
+     * members where they cannot be removed (`PRIVATE_MEMBER_IN_RESULT`). The
+     * result goes out unproven and says so, and the audit trail records why,
+     * closing an allowed call as a wrapper does when its session is missing.
+     */
+    async function unprovenAtSend(response, pending, verificationCode) {
+        const unproven = markUnproven(response);
+        const { toolName } = pending;
+        const context = pending.kind === 'allowed' ? pending.context : undefined;
+        if (pending.kind === 'outcome' && !pending.terminalAuditDelivered)
+            return unproven;
+        const proofAuditDelivered = await emitAudit('Failed to record unproven result', () => audit?.proof('rejected', { outcome: 'failed', verificationCode, context }), toolName);
+        if (pending.kind === 'allowed' && proofAuditDelivered) {
+            await emitAudit('Failed to record completed tool outcome', () => audit?.tool('completed', { toolName, outcome: 'succeeded', context }), toolName);
+        }
+        return unproven;
+    }
+    /**
+     * The outer layer's last step before a result leaves the process: a result
+     * whose wrapper left its proof here gets it now, over the members the MCP
+     * SDK has set since the handler returned, and every result loses the
+     * private members. Only a result with this middleware's stamp redeems a
+     * pending id, each id once; the claims and the session are the
+     * middleware's own, never the result's. A stamped result naming no waiting
+     * proof goes out unproven and says so.
+     */
+    /**
+     * Close every waiting proof other than `except` that `found` names: ids
+     * found in a nested stamped `_meta`, or inside strings that hold the stamp.
+     * Such a proof's result was not sent as itself, so nothing may redeem it.
+     */
+    const closeFoundProofs = (found, except) => {
+        for (const waiting of found.ids)
+            if (waiting !== except)
+                void closeUnsentProof(waiting);
+        if (found.leaked.length === 0)
+            return;
+        for (const waiting of [...pendingProofs.keys()]) {
+            if (waiting !== except && found.leaked.some((text) => text.includes(waiting)))
+                void closeUnsentProof(waiting);
+        }
+    };
+    function scrubOutgoing(value) {
+        const found = scrubPrivateMeta(value, lifecycleStamp, false);
+        closeFoundProofs(found);
+        if (found.leaked.length > 0) {
+            logger.error("[kya-os] An outgoing message carries the middleware's private members inside a string");
+        }
+        return found.value;
+    }
+    async function sendResult(result, answering) {
+        const id = hasOwnStamp(result)
+            ? result._meta[PENDING_PROOF_META_KEY]
+            : undefined;
+        // The result gets its proof members (or a proofError) in the `_meta` its
+        // private members leave, at the same place among its members.
+        const found = scrubPrivateMeta(result, lifecycleStamp, id !== undefined);
+        const { value: sent, leaked } = found;
+        // A wrapped result nested in this one was not sent as itself.
+        closeFoundProofs(found, id);
+        if (leaked.length > 0) {
+            // The stamp is inside a string, a wrapped result serialized into a
+            // text item say, where it cannot be removed. Every waiting proof whose
+            // id is there with it is closed above, so nothing can redeem it, and
+            // this result is not signed.
+            logger.error("[kya-os] A result carries the middleware's private members inside a string; it is sent unproven");
+            const own = typeof id === 'string' ? takePendingProof(id) : undefined;
+            if (own !== undefined)
+                return unprovenAtSend(sent, own, 'PRIVATE_MEMBER_IN_RESULT');
+            return id === undefined ? sent : markUnproven(sent);
+        }
+        if (id === undefined)
+            return sent;
+        const pending = typeof id === 'string' ? takePendingProof(id) : undefined;
+        if (pending !== undefined && answering !== undefined && pending.toolName !== answering.toolName) {
+            // A proof left for one tool, named by the answer to a call of another:
+            // a copied stamp and id. The proof is closed unmade, and the answer is
+            // sent unproven.
+            logger.error("[kya-os] A result names a proof left for another tool; it is sent unproven", {
+                tool: answering.toolName,
+            });
+            await closeTaken(pending, 'PROOF_TOOL_MISMATCH');
+            return markUnproven(sent);
+        }
+        if (pending === undefined) {
+            // The proof this result named is no longer waiting: its window passed,
+            // it was evicted, or it was already sent (a task result fetched again).
+            const closed = typeof id === 'string' ? closedProofs.get(id) : undefined;
+            await emitAudit('Failed to record expired proof', () => audit?.proof('rejected', {
+                outcome: 'failed',
+                verificationCode: 'PROOF_EXPIRED',
+                ...(closed?.context === undefined ? {} : { context: closed.context }),
+            }), closed?.toolName);
+            return markUnproven(sent);
+        }
+        let session;
+        try {
+            session = await sessionManager.getSession(pending.sessionId);
+        }
+        catch (error) {
+            logger.error("[kya-os] Proof session lookup failed", {
+                tool: pending.toolName,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            session = null;
+        }
+        if (!session)
+            return unprovenAtSend(sent, pending, 'PROOF_SESSION_NOT_FOUND');
+        return pending.kind === 'allowed'
+            ? proveAllowedCall(sent, pending, session)
+            : proveAuthorizationOutcome(sent, pending, session);
+    }
+    outerProofLayerHooks.set(wrapWithProof, () => {
+        lifecycleStamp ??= base64urlEncodeFromBytes(globalThis.crypto.getRandomValues(new Uint8Array(16)));
+        const open = () => {
+            openTransports += 1;
+            let released = false;
+            return () => {
+                if (released)
+                    return;
+                released = true;
+                openTransports -= 1;
+                // No transport is left to send what is waiting.
+                if (openTransports === 0)
+                    closeAllUnsentProofs();
+            };
+        };
+        return { open, owns: hasOwnStamp, send: sendResult, scrub: scrubOutgoing };
+    });
+    return { handleHandshake, ensureSession, wrapWithProof, attachOutcomeProof, requireProofLayer };
 }
 //# sourceMappingURL=with-kya-os.session.js.map