@kya-os/mcp 1.2.0 → 1.3.0

package/CHANGELOG.md

@@ -7,14 +7,36 @@ Versioning: https://semver.org/spec/v2.0.0.html
 
 ## [Unreleased]
 
+### Added
+
+- **Generic `Identity` interface** exported from the root entry point.
+  Captures the shape shared by every subject the protocol speaks about
+  (DID + verification-method id + key material). `AgentIdentity` now
+  extends `Identity`; the agent-flavoured shape is unchanged for
+  existing consumers.
+- **`buildDidWebDocument(identity, options?)`** in
+  `delegation/did-web-resolver`. Produces the DID Document a `did:web`
+  controller serves at its resolution URL (see `didWebToUrl`),
+  completing the producer/consumer round-trip with `DidWebResolver`.
+  Emits both `publicKeyJwk` and `publicKeyMultibase` for cross-format
+  interop, matching the `Ed25519VerificationKey2020` form used by the
+  did:key resolver.
+- Optional `@context` field on `DIDDocument` so produced documents can
+  declare the JSON-LD contexts they reference.
+
 ### Changed
 
-- **Package renamed from `@mcp-i/core` to `@kya-os/mcp`.** Reframed under
-  the KYA-OS taxonomy: MCP-I is the identity surface of KYA-OS (Know
-  Your Agent Operating System), the umbrella protocol for agent
-  identity, authorization, and observability. Version stays at 1.2.0 —
-  the wire format, exports (`MCPI*`), and behavior are unchanged. The
-  old `@mcp-i/core` package is deprecated and points at this one.
+- **Package renamed from `@mcp-i/core` to `@kya-os/mcp`.** Renamed
+  under the KYA-OS protocol (Know Your Agent Operating System), the
+  agent identity, authorization, and observability protocol donated
+  to DIF TAAWG. Version stays at 1.2.0 — the wire format, public
+  exports, and behavior are unchanged. The old `@mcp-i/core` package
+  is deprecated and points at this one.
+- **Spec renamed from KYA-OS to KYA-OS** across `SPEC.md`,
+  `CONFORMANCE.md`, `GOVERNANCE.md`, and example READMEs. Wire-format
+  identifiers (`_kyaos` tool name, well-known path, JSON Schema
+  files, JSON-LD context URLs) are deferred to a later cutover so
+  this doc-only rename doesn't break running implementations.
 - **Spec cut to `1.0.0`** (was `0.1.0-draft` in `SPEC.md`, `1.0.0-draft`
   in `CONFORMANCE.md`). The wire format was already pinned at `1.0.0`
   in the handshake protocol-version field; the spec docs now match.
@@ -22,14 +44,14 @@ Versioning: https://semver.org/spec/v2.0.0.html
   semver is independent of package semver: the spec describes the wire
   protocol, the package describes the implementation shipping it.
 - Delegation middleware remains strict by default for chain and status-list validation.
-- Added `delegation.allowLegacyUnsafeDelegation` to `createMCPIMiddleware` as a temporary migration escape hatch for legacy integrations.
+- Added `delegation.allowLegacyUnsafeDelegation` to `createKyaOsMiddleware` as a temporary migration escape hatch for legacy integrations.
 - Added middleware tests covering legacy-compatibility behavior for parent-linked and status-list credentials.
 
 ## [1.0.0-draft] - 2026-03-12
 
 ### Added
 
-- SPEC.md protocol specification defining MCP-I extension for cryptographic identity
+- SPEC.md protocol specification defining KYA-OS extension for cryptographic identity
 - Supported DID methods: `did:key` (ephemeral/dev) and `did:web` (production)
 - Ed25519/EdDSA cryptography for signing and verification
 - Delegation module with W3C Verifiable Credential issuance and verification
@@ -46,14 +68,14 @@ Versioning: https://semver.org/spec/v2.0.0.html
 - Auth module with `verifyOrHints` orchestration and sensitive scope detection
 - Resume token storage for authorization flows
 - `needs_authorization` hint response pattern
-- MCP SDK middleware wrapper (`createMCPIMiddleware`)
+- MCP SDK middleware wrapper (`createKyaOsMiddleware`)
 - Tool wrapping with automatic proof generation
 - Handshake tool registration and handling
 - Provider abstractions: CryptoProvider, ClockProvider, FetchProvider, StorageProvider, NonceCacheProvider, IdentityProvider
 - In-memory implementations for all providers (testing)
 - Configurable logging with debug, info, warn, error levels
 - Pure TypeScript protocol type definitions (zero runtime dependencies)
-- Well-known endpoint (`/.well-known/mcpi`) for server discovery
+- Well-known endpoint (`/.well-known/kyaos-os-os`) for server discovery
 - Outbound delegation proof JWT builder for downstream API calls
 - Three-tier conformance levels:
   - Level 1: Core Crypto (key generation, signing, hashing, DID resolution)

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 MCP-Identity
+Copyright (c) 2026 KYA-OS
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -2,7 +2,7 @@
   <a href="https://modelcontextprotocol-identity.io">
     <picture>
       <source media="(prefers-color-scheme: dark)" srcset="https://modelcontextprotocol-identity.io/images/logo-mark_white.svg">
-      <img alt="MCP-I" src="https://modelcontextprotocol-identity.io/images/logo-mark_black.svg" width="64">
+      <img alt="" src="https://modelcontextprotocol-identity.io/images/logo-mark_black.svg" width="64">
     </picture>
   </a>
 </p>
@@ -15,16 +15,16 @@
   <a href="https://www.npmjs.com/package/@kya-os/mcp"><img src="https://img.shields.io/npm/v/@kya-os/mcp" alt="npm"></a>
   <a href="https://modelcontextprotocol-identity.io"><img src="https://img.shields.io/badge/spec-modelcontextprotocol--identity.io-blue" alt="spec"></a>
   <a href="https://identity.foundation/working-groups/agent-and-authorization.html"><img src="https://img.shields.io/badge/DIF-TAAWG-purple" alt="DIF TAAWG"></a>
-  <a href="./LICENSE"><img src="https://img.shields.io/github/license/modelcontextprotocol-identity/mcp-i-core" alt="license"></a>
+  <a href="./LICENSE"><img src="https://img.shields.io/github/license/decentralized-identity/kya-os-mcp" alt="license"></a>
 </p>
 
 <p align="center">
-  <em><code>@kya-os/mcp</code> is the reference implementation of <strong>MCP-I</strong>, the identity surface of <strong>KYA-OS</strong> (Know Your Agent Operating System). KYA-OS is the umbrella protocol for agent identity, authorization, and observability; MCP-I is its first surface, binding those primitives to Model Context Protocol servers.</em>
+  <em><code>@kya-os/mcp</code> is the reference implementation of the <strong>KYA-OS</strong> (Know Your Agent Operating System) protocol for Model Context Protocol servers — binding KYA-OS's identity, delegation, and proof primitives into MCP. KYA-OS is the agent identity, authorization, and observability protocol.</em>
 </p>
 
 ---
 
-AI agents call tools on your behalf. But today, there's no way to know *who* called, *whether they were allowed to*, or *what actually happened*. MCP-I fixes that for Model Context Protocol servers.
+AI agents call tools on your behalf. But today, there's no way to know *who* called, *whether they were allowed to*, or *what actually happened*. `@kya-os/mcp` fixes that for Model Context Protocol servers.
 
 - **Every server gets a cryptographic identity** (DID) — no accounts, no API keys, no central registry
 - **Every tool call gets a signed proof** — a tamper-evident receipt the agent can't forge or deny
@@ -55,31 +55,31 @@ server.registerTool('greet', { description: 'Say hello' }, async (args) => ({
 
 ```typescript
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { withMCPI, NodeCryptoProvider } from '@kya-os/mcp';  // +1 line
+import { withKyaOs, NodeCryptoProvider } from '@kya-os/mcp';  // +1 line
 
 const server = new McpServer({ name: 'my-server', version: '1.0.0' });
-await withMCPI(server, { crypto: new NodeCryptoProvider() }); // +1 line
+await withKyaOs(server, { crypto: new NodeCryptoProvider() }); // +1 line
 
 server.registerTool('greet', { description: 'Say hello' }, async (args) => ({
   content: [{ type: 'text', text: `Hello, ${args.name}!` }],
 }));
 ```
 
-That's it. `withMCPI` auto-generates an Ed25519 identity, registers the `_mcpi` protocol tool, and wraps the transport so every tool response includes a detached JWS proof in `_meta` — invisible to the LLM, verifiable by anyone.
+That's it. `withKyaOs` auto-generates an Ed25519 identity, registers the `_kyaos` protocol tool, and wraps the transport so every tool response includes a detached JWS proof in `_meta` — invisible to the LLM, verifiable by anyone.
 
-> See the full working example: [examples/context7-with-mcpi](./examples/context7-with-mcpi/) — a real MCP server (Context7) migrated with exactly 2 lines of code.
+> See the full working example: [examples/context7-with-kya-os](./examples/context7-with-kya-os/) — a real MCP server (Context7) migrated with exactly 2 lines of code.
 
 ---
 
 ## Protect Tools with Human Consent
 
-Some tools shouldn't run without a human saying "yes." MCP-I adds per-tool authorization using W3C Verifiable Credentials:
+Some tools shouldn't run without a human saying "yes." KYA-OS MCP adds per-tool authorization using W3C Verifiable Credentials:
 
 ```typescript
-const checkout = mcpi.wrapWithDelegation(
+const checkout = kyaos.wrapWithDelegation(
   'checkout',
   { scopeId: 'cart:write', consentUrl: 'https://example.com/consent' },
-  mcpi.wrapWithProof('checkout', async (args) => ({
+  kyaos.wrapWithProof('checkout', async (args) => ({
     content: [{ type: 'text', text: `Order placed: ${args.item}` }],
   })),
 );
@@ -94,8 +94,8 @@ When an agent calls `checkout` without a delegation credential, it gets back a `
 ## See It in Action
 
 ```bash
-git clone https://github.com/modelcontextprotocol-identity/mcp-i-core.git
-cd mcp-i-core && npm install
+git clone https://github.com/decentralized-identity/kya-os-mcp.git
+cd kya-os-mcp && npm install
 bash scripts/demo.sh
 ```
 
@@ -106,7 +106,7 @@ This starts all example servers and opens [MCP Inspector](https://github.com/mod
 | 3001 | [node-server](./examples/node-server/) | Proofs + restricted tools (low-level API) |
 | 3002 | [consent-basic](./examples/consent-basic/) | Human consent flow with built-in UI |
 | 3003 | [consent-full](./examples/consent-full/) | Production consent UI ([@kya-os/consent](https://www.npmjs.com/package/@kya-os/consent)) |
-| 3004 | [context7-with-mcpi](./examples/context7-with-mcpi/) | 2-line migration of a real MCP server |
+| 3004 | [context7-with-kya-os](./examples/context7-with-kya-os/) | 2-line migration of a real MCP server |
 
 Also available: [outbound-delegation](./examples/outbound-delegation/) (gateway pattern), [verify-proof](./examples/verify-proof/) (standalone verification), [statuslist](./examples/statuslist/) (revocation lifecycle).
 

package/dist/auth/handshake.d.ts

@@ -1,7 +1,7 @@
 /**
  * Authorization Handshake — Platform-agnostic Protocol Reference
  *
- * Orchestrates the MCP-I authorization flow:
+ * Orchestrates the KYA-OS authorization flow:
  * 1. Check agent reputation (optional)
  * 2. Verify delegation exists
  * 3. Return needs_authorization error if missing

package/dist/auth/handshake.js

@@ -1,7 +1,7 @@
 /**
  * Authorization Handshake — Platform-agnostic Protocol Reference
  *
- * Orchestrates the MCP-I authorization flow:
+ * Orchestrates the KYA-OS authorization flow:
  * 1. Check agent reputation (optional)
  * 2. Verify delegation exists
  * 3. Return needs_authorization error if missing

package/dist/delegation/cascading-revocation.d.ts

@@ -4,7 +4,7 @@
  * Implements cascading revocation per Python POC design.
  * When a parent delegation is revoked, all children are automatically revoked.
  *
- * Related Spec: MCP-I §4.4, Delegation Chains
+ * Related Spec: KYA-OS §4.4, Delegation Chains
  */
 import { DelegationGraphManager } from './delegation-graph.js';
 import { StatusList2021Manager } from './statuslist-manager.js';

package/dist/delegation/cascading-revocation.js

@@ -4,7 +4,7 @@
  * Implements cascading revocation per Python POC design.
  * When a parent delegation is revoked, all children are automatically revoked.
  *
- * Related Spec: MCP-I §4.4, Delegation Chains
+ * Related Spec: KYA-OS §4.4, Delegation Chains
  */
 export class CascadingRevocationManager {
     graph;

package/dist/delegation/delegation-graph.d.ts

@@ -4,7 +4,7 @@
  * Tracks parent-child relationships between delegation credentials.
  * Critical for cascading revocation per Delegation-Revocation.md.
  *
- * Related Spec: MCP-I §4.4, Delegation Chains
+ * Related Spec: KYA-OS §4.4, Delegation Chains
  */
 export interface DelegationNode {
     id: string;

package/dist/delegation/delegation-graph.js

@@ -4,7 +4,7 @@
  * Tracks parent-child relationships between delegation credentials.
  * Critical for cascading revocation per Delegation-Revocation.md.
  *
- * Related Spec: MCP-I §4.4, Delegation Chains
+ * Related Spec: KYA-OS §4.4, Delegation Chains
  */
 export class DelegationGraphManager {
     storage;

package/dist/delegation/did-web-resolver.d.ts

@@ -10,7 +10,7 @@
  *
  * @see https://w3c-ccg.github.io/did-method-web/
  */
-import type { FetchProvider } from '../providers/base.js';
+import type { FetchProvider, Identity } from '../providers/base.js';
 import type { DIDResolver, DIDDocument } from './vc-verifier.js';
 /**
  * Parsed components of a did:web DID
@@ -79,5 +79,55 @@ export declare class DidWebResolver implements DIDResolver {
 export declare function createDidWebResolver(fetchProvider: FetchProvider, options?: {
     cacheTtl?: number;
 }): DIDResolver;
+/**
+ * Options for {@link buildDidWebDocument}.
+ */
+export interface BuildDidWebDocumentOptions {
+    /**
+     * Additional JSON-LD contexts appended after the defaults
+     * (`did/v1`, `ed25519-2020/v1`). Use to declare credential or
+     * service contexts the controller publishes alongside its keys.
+     */
+    additionalContexts?: readonly string[];
+}
+/**
+ * Build the DID Document a did:web controller serves at its
+ * resolution URL (see {@link didWebToUrl}).
+ *
+ * Emits a single Ed25519 verification method derived from
+ * `identity.publicKey` (base64-encoded raw bytes — the
+ * {@link Identity} convention). Both `publicKeyJwk` and
+ * `publicKeyMultibase` are included for cross-format interop with
+ * verifiers that prefer one over the other.
+ *
+ * The verification method is published in both `authentication` and
+ * `assertionMethod`, matching the {@link createDidKeyResolver} output
+ * and the most common verifier expectations.
+ *
+ * The function is purely synchronous and performs no I/O. Hosts
+ * publish the returned object verbatim (e.g. as the body of a
+ * `/.well-known/did.json` route).
+ *
+ * @param identity - Subject identity. `did` must be a `did:web:` DID;
+ *   `kid` must reference the same DID (`<did>#<fragment>`).
+ * @param options - Optional context extensions.
+ * @returns DID Document satisfying the W3C DID Core data model.
+ * @throws Error when `identity.did` is not a `did:web:` DID, when
+ *   `identity.kid` does not reference `identity.did`, or when
+ *   `identity.publicKey` is not a valid base64 string of the
+ *   expected length.
+ *
+ * @example
+ * ```typescript
+ * const document = buildDidWebDocument({
+ *   did: 'did:web:example.com:agents:bot1',
+ *   kid: 'did:web:example.com:agents:bot1#keys-1',
+ *   publicKey: agent.publicKey, // base64-encoded Ed25519
+ *   createdAt: new Date().toISOString(),
+ * });
+ * // Serve `document` at https://example.com/agents/bot1/did.json
+ * ```
+ */
+export declare function buildDidWebDocument(identity: Identity, options?: BuildDidWebDocumentOptions): DIDDocument;
 export {};
 //# sourceMappingURL=did-web-resolver.d.ts.map

package/dist/delegation/did-web-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"did-web-resolver.d.ts","sourceRoot":"","sources":["../../src/delegation/did-web-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAsB,MAAM,kBAAkB,CAAC;AAGrF;;GAEG;AACH,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AA0DD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7C;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CA0B5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsBtD;AAED;;GAEG;AACH,qBAAa,cAAe,YAAW,WAAW;IAChD,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,KAAK,CAA4D;IACzE,OAAO,CAAC,QAAQ,CAAS;gBAEb,aAAa,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;IAMzE;;;;;OAKG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAgEvD;;OAEG;IACH,UAAU,IAAI,IAAI;IAIlB;;OAEG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAGnC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,EAAE,aAAa,EAC5B,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9B,WAAW,CAEb"}
+{"version":3,"file":"did-web-resolver.d.ts","sourceRoot":"","sources":["../../src/delegation/did-web-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAsB,MAAM,kBAAkB,CAAC;AAMrF;;GAEG;AACH,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AA0DD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7C;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CA0B5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsBtD;AAED;;GAEG;AACH,qBAAa,cAAe,YAAW,WAAW;IAChD,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,KAAK,CAA4D;IACzE,OAAO,CAAC,QAAQ,CAAS;gBAEb,aAAa,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;IAMzE;;;;;OAKG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAgEvD;;OAEG;IACH,UAAU,IAAI,IAAI;IAIlB;;OAEG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAGnC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,EAAE,aAAa,EAC5B,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9B,WAAW,CAEb;AAeD;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,0BAA0B,GACnC,WAAW,CAoCb"}

package/dist/delegation/did-web-resolver.js

@@ -11,6 +11,9 @@
  * @see https://w3c-ccg.github.io/did-method-web/
  */
 import { logger } from '../logging/index.js';
+import { base58Encode } from '../utils/base58.js';
+import { base64ToBytes } from '../utils/base64.js';
+import { publicKeyToJwk } from './did-key-resolver.js';
 /**
  * Type guard for checking if value is a valid DID Document structure
  */
@@ -215,4 +218,109 @@ export class DidWebResolver {
 export function createDidWebResolver(fetchProvider, options) {
     return new DidWebResolver(fetchProvider, options);
 }
+/** Ed25519 multicodec prefix (0xed 0x01) used for `publicKeyMultibase`. */
+const ED25519_MULTICODEC_PREFIX = new Uint8Array([0xed, 0x01]);
+/**
+ * Default JSON-LD contexts for an Ed25519-keyed did:web Document.
+ * `did/v1` is required by DID Core; `ed25519-2020/v1` defines the
+ * `Ed25519VerificationKey2020` type emitted below.
+ */
+const DEFAULT_DID_WEB_CONTEXTS = [
+    'https://www.w3.org/ns/did/v1',
+    'https://w3id.org/security/suites/ed25519-2020/v1',
+];
+/**
+ * Build the DID Document a did:web controller serves at its
+ * resolution URL (see {@link didWebToUrl}).
+ *
+ * Emits a single Ed25519 verification method derived from
+ * `identity.publicKey` (base64-encoded raw bytes — the
+ * {@link Identity} convention). Both `publicKeyJwk` and
+ * `publicKeyMultibase` are included for cross-format interop with
+ * verifiers that prefer one over the other.
+ *
+ * The verification method is published in both `authentication` and
+ * `assertionMethod`, matching the {@link createDidKeyResolver} output
+ * and the most common verifier expectations.
+ *
+ * The function is purely synchronous and performs no I/O. Hosts
+ * publish the returned object verbatim (e.g. as the body of a
+ * `/.well-known/did.json` route).
+ *
+ * @param identity - Subject identity. `did` must be a `did:web:` DID;
+ *   `kid` must reference the same DID (`<did>#<fragment>`).
+ * @param options - Optional context extensions.
+ * @returns DID Document satisfying the W3C DID Core data model.
+ * @throws Error when `identity.did` is not a `did:web:` DID, when
+ *   `identity.kid` does not reference `identity.did`, or when
+ *   `identity.publicKey` is not a valid base64 string of the
+ *   expected length.
+ *
+ * @example
+ * ```typescript
+ * const document = buildDidWebDocument({
+ *   did: 'did:web:example.com:agents:bot1',
+ *   kid: 'did:web:example.com:agents:bot1#keys-1',
+ *   publicKey: agent.publicKey, // base64-encoded Ed25519
+ *   createdAt: new Date().toISOString(),
+ * });
+ * // Serve `document` at https://example.com/agents/bot1/did.json
+ * ```
+ */
+export function buildDidWebDocument(identity, options) {
+    if (!isDidWeb(identity.did)) {
+        throw new Error(`buildDidWebDocument: identity.did must be a did:web DID (got "${identity.did}")`);
+    }
+    if (!identity.kid.startsWith(`${identity.did}#`)) {
+        throw new Error(`buildDidWebDocument: identity.kid "${identity.kid}" does not reference identity.did "${identity.did}"`);
+    }
+    const publicKeyBytes = decodePublicKey(identity.publicKey);
+    const publicKeyJwk = publicKeyToJwk(publicKeyBytes);
+    const publicKeyMultibase = encodeEd25519Multibase(publicKeyBytes);
+    const verificationMethod = {
+        id: identity.kid,
+        type: 'Ed25519VerificationKey2020',
+        controller: identity.did,
+        publicKeyJwk,
+        publicKeyMultibase,
+    };
+    const contexts = options?.additionalContexts?.length
+        ? [...DEFAULT_DID_WEB_CONTEXTS, ...options.additionalContexts]
+        : [...DEFAULT_DID_WEB_CONTEXTS];
+    return {
+        '@context': contexts,
+        id: identity.did,
+        verificationMethod: [verificationMethod],
+        authentication: [identity.kid],
+        assertionMethod: [identity.kid],
+    };
+}
+/**
+ * Decode a base64-encoded Ed25519 public key to raw bytes.
+ *
+ * The {@link Identity} contract documents `publicKey` as base64 of the
+ * 32-byte Ed25519 public key. We accept that length only — anything
+ * else is a programming error and surfaces as a thrown construction
+ * exception (per the repository error contract: construction throws,
+ * verification/resolution returns).
+ */
+function decodePublicKey(publicKeyBase64) {
+    const bytes = base64ToBytes(publicKeyBase64);
+    if (bytes.length !== 32) {
+        throw new Error(`buildDidWebDocument: expected 32-byte Ed25519 public key, got ${bytes.length} bytes after base64 decode`);
+    }
+    return bytes;
+}
+/**
+ * Encode raw Ed25519 public key bytes as `publicKeyMultibase`
+ * (multicodec-tagged, base58btc-encoded, `z`-prefixed). Matches the
+ * encoding used by {@link createDidKeyResolver} for the equivalent
+ * field on did:key documents.
+ */
+function encodeEd25519Multibase(publicKeyBytes) {
+    const multicodec = new Uint8Array(ED25519_MULTICODEC_PREFIX.length + publicKeyBytes.length);
+    multicodec.set(ED25519_MULTICODEC_PREFIX);
+    multicodec.set(publicKeyBytes, ED25519_MULTICODEC_PREFIX.length);
+    return `z${base58Encode(multicodec)}`;
+}
 //# sourceMappingURL=did-web-resolver.js.map

package/dist/delegation/did-web-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"did-web-resolver.js","sourceRoot":"","sources":["../../src/delegation/did-web-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAU7C;;GAEG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,KAAgC,CAAC;IAE7C,sCAAsC;IACtC,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iEAAiE;IACjE,IAAI,GAAG,CAAC,oBAAoB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qDAAqD;QACrD,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,yBAAyB,CAAC,EAAE,CAAC,EAAE,CAAC;gBACnC,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,GAAG,KAAgC,CAAC;IAE5C,gDAAgD;IAChD,IAAI,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,OAAO,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+BAA+B;IAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iDAAiD;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEnC,yCAAyC;IACzC,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAE7C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAEhC,gBAAgB;IAChB,6CAA6C;IAC7C,IAAI,GAAG,GAAG,WAAW,MAAM,EAAE,CAAC;IAE9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,yCAAyC;QACzC,GAAG,IAAI,uBAAuB,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,6CAA6C;QAC7C,GAAG,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC;IAC5C,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,cAAc;IACjB,aAAa,CAAgB;IAC7B,KAAK,CAA4D;IACjE,QAAQ,CAAS;IAEzB,YAAY,aAA4B,EAAE,OAA+B;QACvE,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,CAAC,oBAAoB;IACpE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,0BAA0B;QAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,cAAc;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QAED,iBAAiB;QACjB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,4CAA4C,GAAG,EAAE,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,yBAAyB;YACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAErD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,yBAAyB,QAAQ,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,CAAC;gBACxE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,aAAa;YACb,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;gBACzD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,qBAAqB;YACrB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,wDAAwD,GAAG,EAAE,CAAC,CAAC;gBAC3E,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gCAAgC;YAChC,IAAI,IAAI,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,uDAAuD,GAAG,SAAS,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1F,OAAO,IAAI,CAAC;YACd,CAAC;YAED,mBAAmB;YACnB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;gBAClB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ;aACtC,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,oCAAoC,GAAG,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACvG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,GAAW;QACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,aAA4B,EAC5B,OAA+B;IAE/B,OAAO,IAAI,cAAc,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"did-web-resolver.js","sourceRoot":"","sources":["../../src/delegation/did-web-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAUvD;;GAEG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,KAAgC,CAAC;IAE7C,sCAAsC;IACtC,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iEAAiE;IACjE,IAAI,GAAG,CAAC,oBAAoB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qDAAqD;QACrD,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,yBAAyB,CAAC,EAAE,CAAC,EAAE,CAAC;gBACnC,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,GAAG,KAAgC,CAAC;IAE5C,gDAAgD;IAChD,IAAI,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,OAAO,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+BAA+B;IAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE/B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iDAAiD;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEnC,yCAAyC;IACzC,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAE7C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAEhC,gBAAgB;IAChB,6CAA6C;IAC7C,IAAI,GAAG,GAAG,WAAW,MAAM,EAAE,CAAC;IAE9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,yCAAyC;QACzC,GAAG,IAAI,uBAAuB,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,6CAA6C;QAC7C,GAAG,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC;IAC5C,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,cAAc;IACjB,aAAa,CAAgB;IAC7B,KAAK,CAA4D;IACjE,QAAQ,CAAS;IAEzB,YAAY,aAA4B,EAAE,OAA+B;QACvE,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,CAAC,oBAAoB;IACpE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,0BAA0B;QAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,cAAc;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QAED,iBAAiB;QACjB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,4CAA4C,GAAG,EAAE,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,yBAAyB;YACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAErD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,yBAAyB,QAAQ,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,CAAC;gBACxE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,aAAa;YACb,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;gBACzD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,qBAAqB;YACrB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,wDAAwD,GAAG,EAAE,CAAC,CAAC;gBAC3E,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gCAAgC;YAChC,IAAI,IAAI,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,uDAAuD,GAAG,SAAS,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1F,OAAO,IAAI,CAAC;YACd,CAAC;YAED,mBAAmB;YACnB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;gBAClB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ;aACtC,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,oCAAoC,GAAG,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACvG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,GAAW;QACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,aAA4B,EAC5B,OAA+B;IAE/B,OAAO,IAAI,cAAc,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,2EAA2E;AAC3E,MAAM,yBAAyB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE/D;;;;GAIG;AACH,MAAM,wBAAwB,GAAsB;IAClD,8BAA8B;IAC9B,kDAAkD;CACnD,CAAC;AAcF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAkB,EAClB,OAAoC;IAEpC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,iEAAiE,QAAQ,CAAC,GAAG,IAAI,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,sCAAsC,QAAQ,CAAC,GAAG,sCAAsC,QAAQ,CAAC,GAAG,GAAG,CACxG,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;IACpD,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAElE,MAAM,kBAAkB,GAAuB;QAC7C,EAAE,EAAE,QAAQ,CAAC,GAAG;QAChB,IAAI,EAAE,4BAA4B;QAClC,UAAU,EAAE,QAAQ,CAAC,GAAG;QACxB,YAAY;QACZ,kBAAkB;KACnB,CAAC;IAEF,MAAM,QAAQ,GAAG,OAAO,EAAE,kBAAkB,EAAE,MAAM;QAClD,CAAC,CAAC,CAAC,GAAG,wBAAwB,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAC9D,CAAC,CAAC,CAAC,GAAG,wBAAwB,CAAC,CAAC;IAElC,OAAO;QACL,UAAU,EAAE,QAAQ;QACpB,EAAE,EAAE,QAAQ,CAAC,GAAG;QAChB,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;QACxC,cAAc,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC9B,eAAe,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,eAAuB;IAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,iEAAiE,KAAK,CAAC,MAAM,4BAA4B,CAC1G,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,cAA0B;IACxD,MAAM,UAAU,GAAG,IAAI,UAAU,CAC/B,yBAAyB,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM,CACzD,CAAC;IACF,UAAU,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC1C,UAAU,CAAC,GAAG,CAAC,cAAc,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACjE,OAAO,IAAI,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;AACxC,CAAC"}

package/dist/delegation/outbound-headers.d.ts

@@ -4,23 +4,23 @@
  * Builds the full set of outbound delegation headers for forwarding
  * delegation context to downstream services.
  *
- * Headers (MCP-I §7):
- * - KYA-Agent-DID: the original agent's DID
- * - KYA-Delegation-Chain: the delegation chain ID (vcId of the root delegation)
- * - KYA-Session-Id: the current session ID
- * - KYA-Delegation-Proof: a signed JWT proving the delegation is being forwarded
+ * Headers (KYA-OS §7):
+ * - KYA-OS-Agent-DID: the original agent's DID
+ * - KYA-OS-Delegation-Chain: the delegation chain ID (vcId of the root delegation)
+ * - KYA-OS-Session-Id: the current session ID
+ * - KYA-OS-Delegation-Proof: a signed JWT proving the delegation is being forwarded
  *
- * Related Spec: MCP-I §7 — Outbound Delegation Propagation
+ * Related Spec: KYA-OS §7 — Outbound Delegation Propagation
  */
 import type { SessionContext, DelegationRecord } from '../types/protocol.js';
 /**
  * Header names for outbound delegation propagation
  */
 export declare const OUTBOUND_HEADER_NAMES: {
-    readonly AGENT_DID: "KYA-Agent-DID";
-    readonly DELEGATION_CHAIN: "KYA-Delegation-Chain";
-    readonly SESSION_ID: "KYA-Session-Id";
-    readonly DELEGATION_PROOF: "KYA-Delegation-Proof";
+    readonly AGENT_DID: "KYA-OS-Agent-DID";
+    readonly DELEGATION_CHAIN: "KYA-OS-Delegation-Chain";
+    readonly SESSION_ID: "KYA-OS-Session-Id";
+    readonly DELEGATION_PROOF: "KYA-OS-Delegation-Proof";
 };
 /**
  * Context required to build outbound delegation headers
@@ -43,10 +43,10 @@ export interface OutboundDelegationContext {
  * Outbound delegation headers to attach to downstream requests
  */
 export interface OutboundDelegationHeaders {
-    'KYA-Agent-DID': string;
-    'KYA-Delegation-Chain': string;
-    'KYA-Session-Id': string;
-    'KYA-Delegation-Proof': string;
+    'KYA-OS-Agent-DID': string;
+    'KYA-OS-Delegation-Chain': string;
+    'KYA-OS-Session-Id': string;
+    'KYA-OS-Delegation-Proof': string;
 }
 /**
  * Build outbound delegation headers for forwarding to downstream services.

package/dist/delegation/outbound-headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"outbound-headers.d.ts","sourceRoot":"","sources":["../../src/delegation/outbound-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAM7E;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;CAKxB,CAAC;AAEX;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,kCAAkC;IAClC,OAAO,EAAE,cAAc,CAAC;IACxB,4CAA4C;IAC5C,UAAU,EAAE,gBAAgB,CAAC;IAC7B,sDAAsD;IACtD,cAAc,EAAE;QACd,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,eAAe,EAAE,MAAM,CAAC;IACxB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAgDD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,yBAAyB,CAAC,CAuDpC"}
+{"version":3,"file":"outbound-headers.d.ts","sourceRoot":"","sources":["../../src/delegation/outbound-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAM7E;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;CAKxB,CAAC;AAEX;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,kCAAkC;IAClC,OAAO,EAAE,cAAc,CAAC;IACxB,4CAA4C;IAC5C,UAAU,EAAE,gBAAgB,CAAC;IAC7B,sDAAsD;IACtD,cAAc,EAAE;QACd,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,yBAAyB,EAAE,MAAM,CAAC;IAClC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;CACnC;AAgDD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,yBAAyB,CAAC,CAuDpC"}

package/dist/delegation/outbound-headers.js

@@ -4,13 +4,13 @@
  * Builds the full set of outbound delegation headers for forwarding
  * delegation context to downstream services.
  *
- * Headers (MCP-I §7):
- * - KYA-Agent-DID: the original agent's DID
- * - KYA-Delegation-Chain: the delegation chain ID (vcId of the root delegation)
- * - KYA-Session-Id: the current session ID
- * - KYA-Delegation-Proof: a signed JWT proving the delegation is being forwarded
+ * Headers (KYA-OS §7):
+ * - KYA-OS-Agent-DID: the original agent's DID
+ * - KYA-OS-Delegation-Chain: the delegation chain ID (vcId of the root delegation)
+ * - KYA-OS-Session-Id: the current session ID
+ * - KYA-OS-Delegation-Proof: a signed JWT proving the delegation is being forwarded
  *
- * Related Spec: MCP-I §7 — Outbound Delegation Propagation
+ * Related Spec: KYA-OS §7 — Outbound Delegation Propagation
  */
 import { buildDelegationProofJWT } from './outbound-proof.js';
 import { extractPublicKeyFromDidKey, isEd25519DidKey } from './did-key-resolver.js';
@@ -20,10 +20,10 @@ import { logger } from '../logging/index.js';
  * Header names for outbound delegation propagation
  */
 export const OUTBOUND_HEADER_NAMES = {
-    AGENT_DID: 'KYA-Agent-DID',
-    DELEGATION_CHAIN: 'KYA-Delegation-Chain',
-    SESSION_ID: 'KYA-Session-Id',
-    DELEGATION_PROOF: 'KYA-Delegation-Proof',
+    AGENT_DID: 'KYA-OS-Agent-DID',
+    DELEGATION_CHAIN: 'KYA-OS-Delegation-Chain',
+    SESSION_ID: 'KYA-OS-Session-Id',
+    DELEGATION_PROOF: 'KYA-OS-Delegation-Proof',
 };
 /**
  * Extract hostname from a URL
@@ -107,7 +107,7 @@ export async function buildOutboundDelegationHeaders(context) {
     // Build the private key JWK from the server identity
     const privateKeyJwk = buildPrivateKeyJwk(serverIdentity.privateKey, serverIdentity.did);
     // Build the delegation proof JWT
-    // Per MCP-I §7, the JWT has:
+    // Per KYA-OS §7, the JWT has:
     // - iss: serverDid (the MCP server forwarding the request)
     // - sub: agentDid (the original agent)
     // - aud: targetHostname (the downstream service)
@@ -129,10 +129,10 @@ export async function buildOutboundDelegationHeaders(context) {
         targetHostname,
     });
     return {
-        'KYA-Agent-DID': session.agentDid,
-        'KYA-Delegation-Chain': delegation.vcId,
-        'KYA-Session-Id': session.sessionId,
-        'KYA-Delegation-Proof': jwt,
+        'KYA-OS-Agent-DID': session.agentDid,
+        'KYA-OS-Delegation-Chain': delegation.vcId,
+        'KYA-OS-Session-Id': session.sessionId,
+        'KYA-OS-Delegation-Proof': jwt,
     };
 }
 //# sourceMappingURL=outbound-headers.js.map

package/dist/delegation/outbound-headers.js.map

@@ -1 +1 @@
-{"version":3,"file":"outbound-headers.js","sourceRoot":"","sources":["../../src/delegation/outbound-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,uBAAuB,EAA0B,MAAM,qBAAqB,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,SAAS,EAAE,eAAe;IAC1B,gBAAgB,EAAE,sBAAsB;IACxC,UAAU,EAAE,gBAAgB;IAC5B,gBAAgB,EAAE,sBAAsB;CAChC,CAAC;AA8BX;;GAEG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CACzB,gBAAwB,EACxB,SAAiB;IAEjB,qCAAqC;IACrC,MAAM,eAAe,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAExD,qEAAqE;IACrE,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,KAAK,EAAE;QACxC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;QACjC,CAAC,CAAC,eAAe,CAAC;IAEpB,kCAAkC;IAClC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,4CAA4C,SAAS,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,cAAc,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,0CAA0C,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,OAAO;QACL,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,SAAS;QACd,CAAC,EAAE,wBAAwB,CAAC,cAAc,CAAC;QAC3C,CAAC,EAAE,wBAAwB,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAkC;IAElC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAEnE,2BAA2B;IAC3B,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,oCAAoC;IACpC,MAAM,cAAc,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAElD,qDAAqD;IACrD,MAAM,aAAa,GAAG,kBAAkB,CACtC,cAAc,CAAC,UAAU,EACzB,cAAc,CAAC,GAAG,CACnB,CAAC;IAEF,iCAAiC;IACjC,6BAA6B;IAC7B,2DAA2D;IAC3D,uCAAuC;IACvC,iDAAiD;IACjD,kCAAkC;IAClC,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC;QACxC,QAAQ,EAAE,cAAc,CAAC,GAAG,EAAM,kCAAkC;QACpE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAS,+BAA+B;QACjE,YAAY,EAAE,UAAU,CAAC,EAAE;QAC3B,eAAe,EAAE,UAAU,CAAC,IAAI;QAChC,MAAM,EAAE,CAAC,sBAAsB,CAAC;QAChC,aAAa;QACb,GAAG,EAAE,cAAc,CAAC,GAAG;QACvB,cAAc;KACf,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;QAChD,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,eAAe,EAAE,UAAU,CAAC,IAAI;QAChC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc;KACf,CAAC,CAAC;IAEH,OAAO;QACL,eAAe,EAAE,OAAO,CAAC,QAAQ;QACjC,sBAAsB,EAAE,UAAU,CAAC,IAAI;QACvC,gBAAgB,EAAE,OAAO,CAAC,SAAS;QACnC,sBAAsB,EAAE,GAAG;KAC5B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"outbound-headers.js","sourceRoot":"","sources":["../../src/delegation/outbound-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,uBAAuB,EAA0B,MAAM,qBAAqB,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,SAAS,EAAE,kBAAkB;IAC7B,gBAAgB,EAAE,yBAAyB;IAC3C,UAAU,EAAE,mBAAmB;IAC/B,gBAAgB,EAAE,yBAAyB;CACnC,CAAC;AA8BX;;GAEG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CACzB,gBAAwB,EACxB,SAAiB;IAEjB,qCAAqC;IACrC,MAAM,eAAe,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAExD,qEAAqE;IACrE,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,KAAK,EAAE;QACxC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;QACjC,CAAC,CAAC,eAAe,CAAC;IAEpB,kCAAkC;IAClC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,4CAA4C,SAAS,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,cAAc,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,0CAA0C,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,OAAO;QACL,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,SAAS;QACd,CAAC,EAAE,wBAAwB,CAAC,cAAc,CAAC;QAC3C,CAAC,EAAE,wBAAwB,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAkC;IAElC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAEnE,2BAA2B;IAC3B,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,oCAAoC;IACpC,MAAM,cAAc,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAElD,qDAAqD;IACrD,MAAM,aAAa,GAAG,kBAAkB,CACtC,cAAc,CAAC,UAAU,EACzB,cAAc,CAAC,GAAG,CACnB,CAAC;IAEF,iCAAiC;IACjC,8BAA8B;IAC9B,2DAA2D;IAC3D,uCAAuC;IACvC,iDAAiD;IACjD,kCAAkC;IAClC,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC;QACxC,QAAQ,EAAE,cAAc,CAAC,GAAG,EAAM,kCAAkC;QACpE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAS,+BAA+B;QACjE,YAAY,EAAE,UAAU,CAAC,EAAE;QAC3B,eAAe,EAAE,UAAU,CAAC,IAAI;QAChC,MAAM,EAAE,CAAC,sBAAsB,CAAC;QAChC,aAAa;QACb,GAAG,EAAE,cAAc,CAAC,GAAG;QACvB,cAAc;KACf,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;QAChD,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,eAAe,EAAE,UAAU,CAAC,IAAI;QAChC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc;KACf,CAAC,CAAC;IAEH,OAAO;QACL,kBAAkB,EAAE,OAAO,CAAC,QAAQ;QACpC,yBAAyB,EAAE,UAAU,CAAC,IAAI;QAC1C,mBAAmB,EAAE,OAAO,CAAC,SAAS;QACtC,yBAAyB,EAAE,GAAG;KAC/B,CAAC;AACJ,CAAC"}

package/dist/delegation/outbound-proof.d.ts

@@ -5,9 +5,9 @@
  * Enables downstream services to independently verify the delegation chain.
  *
  * Wire format: signed compact EdDSA JWT (60s TTL, per-call jti)
- * Header injection: KYA-Delegation-Id, KYA-Delegation-Chain, KYA-Delegation-Proof, KYA-Granted-Scopes
+ * Header injection: KYA-OS-Delegation-Id, KYA-OS-Delegation-Chain, KYA-OS-Delegation-Proof, KYA-OS-Granted-Scopes
  *
- * Related Spec: MCP-I §2 — Outbound Delegation Propagation
+ * Related Spec: KYA-OS §2 — Outbound Delegation Propagation
  */
 import type { DelegationRecord } from '../types/protocol.js';
 export interface Ed25519PrivateJWK {

package/dist/delegation/outbound-proof.js

@@ -5,9 +5,9 @@
  * Enables downstream services to independently verify the delegation chain.
  *
  * Wire format: signed compact EdDSA JWT (60s TTL, per-call jti)
- * Header injection: KYA-Delegation-Id, KYA-Delegation-Chain, KYA-Delegation-Proof, KYA-Granted-Scopes
+ * Header injection: KYA-OS-Delegation-Id, KYA-OS-Delegation-Chain, KYA-OS-Delegation-Proof, KYA-OS-Granted-Scopes
  *
- * Related Spec: MCP-I §2 — Outbound Delegation Propagation
+ * Related Spec: KYA-OS §2 — Outbound Delegation Propagation
  */
 import { SignJWT, importJWK } from 'jose';
 /**

package/dist/delegation/vc-issuer.d.ts

@@ -5,7 +5,7 @@
  * Follows the Python POC design (Delegation-Service.md:136-163) where
  * delegations are issued AS W3C VCs.
  *
- * Related Spec: MCP-I §4.1, §4.2, W3C VC Data Model 1.1
+ * Related Spec: KYA-OS §4.1, §4.2, W3C VC Data Model 1.1
  */
 import type { DelegationCredential, DelegationRecord, CredentialStatus, Proof } from '../types/protocol.js';
 export interface IssueDelegationOptions {