@kya-os/mcp 1.2.0 → 1.3.1

package/dist/middleware/{with-mcpi.js → with-kya-os.js}

@@ -1,17 +1,17 @@
 /**
- * MCP-I Middleware — Core Implementation
+ * KYA-OS Middleware — Core Implementation
  *
  * Adds identity, session management, and proof generation to MCP servers.
  *
- * For most use cases, prefer the high-level `withMCPI()` adapter from
- * `./with-mcpi-server.ts` which (by default) auto-registers the handshake
+ * For most use cases, prefer the high-level `withKyaOs()` adapter from
+ * `./with-kya-os-server.ts` which (by default) auto-registers the handshake
  * tool and auto-attaches proofs to all tool responses:
  *
- *   import { withMCPI } from '@kya-os/mcp';
- *   await withMCPI(server, { crypto: new NodeCryptoProvider() });
+ *   import { withKyaOs } from '@kya-os/mcp';
+ *   await withKyaOs(server, { crypto: new NodeCryptoProvider() });
  *
- * `createMCPIMiddleware()` in this file is the lower-level API used
- * internally by `withMCPI()` and for advanced use cases like the
+ * `createKyaOsMiddleware()` in this file is the lower-level API used
+ * internally by `withKyaOs()` and for advanced use cases like the
  * low-level `Server` API or custom request handler patterns.
  */
 import { FetchProvider, } from "../providers/base.js";
@@ -24,10 +24,10 @@ import { createDidWebResolver } from "../delegation/did-web-resolver.js";
 import { verifyDelegationAudience } from "../delegation/audience-validator.js";
 import { createNeedsAuthorizationError, extractDelegationFromVC, } from "../types/protocol.js";
 import { logger } from "../logging/index.js";
-import { MCPI_ERROR_CODES } from "../errors.js";
+import { KYA_OS_ERROR_CODES } from "../errors.js";
 import { canonicalizeJSON, parseVCJWT } from "../delegation/utils.js";
 import { base64urlDecodeToBytes, base64urlEncodeFromBytes, bytesToBase64 } from "../utils/base64.js";
-export const MCPI_ACTIONS = ["handshake", "identity", "reputation"];
+export const KYA_OS_ACTIONS = ["handshake", "identity", "reputation"];
 class RuntimeFetchProvider extends FetchProvider {
     async resolveDID() {
         return null;
@@ -79,13 +79,13 @@ function validateScopeAttenuation(parentCredential, childCredential) {
     return { valid: true };
 }
 /**
- * Create MCP-I middleware for a standard MCP SDK Server.
+ * Create KYA-OS middleware for a standard MCP SDK Server.
  *
- * For most use cases, prefer {@link withMCPI} from `./with-mcpi-server.ts`
+ * For most use cases, prefer {@link withKyaOs} from `./with-kya-os-server.ts`
  * which wraps this function and (by default) auto-registers handshake +
  * auto-attaches proofs.
  *
- * Use `createMCPIMiddleware` directly when:
+ * Use `createKyaOsMiddleware` directly when:
  * - You use the low-level `Server` API (not `McpServer`)
  * - You need custom request handler patterns
  * - You want per-tool control over proof/delegation wrapping
@@ -100,7 +100,12 @@ function validateScopeAttenuation(parentCredential, childCredential) {
  * deployments behind a load balancer. For distributed deployments, implement a custom
  * `SessionStore` backed by Redis, DynamoDB, or similar and pass it via `config.session`.
  */
-export function createMCPIMiddleware(config, cryptoProvider) {
+// Module-level warn-once flags for unsafe configuration. Per-process,
+// not per-session, so long-running servers don't spam logs on every new
+// session.
+let warnedAudienceOptOut = false;
+let warnedLegacyUnsafeDelegation = false;
+export function createKyaOsMiddleware(config, cryptoProvider) {
     const identity = {
         did: config.identity.did,
         kid: config.identity.kid,
@@ -118,8 +123,8 @@ export function createMCPIMiddleware(config, cryptoProvider) {
     // Active session tracking — set after handshake (manual or auto)
     let activeSessionId;
     const handshakeTool = {
-        name: "_mcpi_handshake",
-        description: "MCP-I identity handshake — establishes a cryptographic session",
+        name: "_kyaos_handshake",
+        description: "KYA-OS identity handshake — establishes a cryptographic session",
         inputSchema: {
             type: "object",
             properties: {
@@ -137,15 +142,15 @@ export function createMCPIMiddleware(config, cryptoProvider) {
             required: ["nonce", "audience", "timestamp"],
         },
     };
-    const mcpiTool = {
-        name: "_mcpi",
-        description: "MCP-I protocol — identity verification, session handshake, and server metadata",
+    const kyaOsTool = {
+        name: "_kyaos",
+        description: "KYA-OS protocol — identity verification, session handshake, and server metadata",
         inputSchema: {
             type: "object",
             properties: {
                 action: {
                     type: "string",
-                    enum: [...MCPI_ACTIONS],
+                    enum: [...KYA_OS_ACTIONS],
                     description: "Protocol operation to perform",
                 },
                 nonce: { type: "string", description: "Client-generated unique nonce" },
@@ -171,7 +176,7 @@ export function createMCPIMiddleware(config, cryptoProvider) {
                         text: JSON.stringify({
                             success: false,
                             error: {
-                                code: MCPI_ERROR_CODES.handshake_failed,
+                                code: KYA_OS_ERROR_CODES.handshake_failed,
                                 message: "Invalid handshake format: requires nonce (string), audience (string), and timestamp (positive integer)",
                             },
                         }),
@@ -214,12 +219,13 @@ export function createMCPIMiddleware(config, cryptoProvider) {
                         name: config.identity.agentName ?? identity.did,
                         capabilities: ["handshake", "signing", "verification"],
                         protocolVersion: "1.0.0",
+                        clockSkewSeconds: sessionManager.getStats().config.timestampSkewSeconds,
                     }),
                 },
             ],
         };
     }
-    async function handleMCPI(args) {
+    async function handleKyaOs(args) {
         const action = typeof args.action === "string"
             ? args.action
             : undefined;
@@ -236,7 +242,7 @@ export function createMCPIMiddleware(config, cryptoProvider) {
                             text: JSON.stringify({
                                 success: false,
                                 error: {
-                                    code: MCPI_ERROR_CODES.runtime_error,
+                                    code: KYA_OS_ERROR_CODES.runtime_error,
                                     message: 'action: "reputation" is not yet implemented.',
                                 },
                             }),
@@ -252,8 +258,8 @@ export function createMCPIMiddleware(config, cryptoProvider) {
                             text: JSON.stringify({
                                 success: false,
                                 error: {
-                                    code: MCPI_ERROR_CODES.invalid_request,
-                                    message: `Unknown _mcpi action: "${action ?? "(missing)"}". Valid actions: ${MCPI_ACTIONS.join(", ")}`,
+                                    code: KYA_OS_ERROR_CODES.invalid_request,
+                                    message: `Unknown _kyaos action: "${action ?? "(missing)"}". Valid actions: ${KYA_OS_ACTIONS.join(", ")}`,
                                 },
                             }),
                         },
@@ -264,8 +270,8 @@ export function createMCPIMiddleware(config, cryptoProvider) {
     }
     /**
      * Auto-create a session for proof generation when no handshake has occurred.
-     * In production, MCP-I-aware runtimes should execute handshake before tool calls.
-     * This convenience mode allows non-MCP-I clients (like MCP Inspector) to
+     * In production, KYA-OS-aware runtimes should execute handshake before tool calls.
+     * This convenience mode allows non-KYA-OS clients (like MCP Inspector) to
      * still see proofs without manual handshake.
      */
     async function ensureSession() {
@@ -315,7 +321,7 @@ export function createMCPIMiddleware(config, cryptoProvider) {
                 result._meta = { proof };
             }
             catch (error) {
-                logger.error("[mcpi] Proof generation failed", {
+                logger.error("[kya-os] Proof generation failed", {
                     tool: toolName,
                     error: error instanceof Error ? error.message : String(error),
                 });
@@ -328,6 +334,19 @@ export function createMCPIMiddleware(config, cryptoProvider) {
     }
     function wrapWithDelegation(toolName, config, handler) {
         const legacyUnsafeDelegationEnabled = delegationConfig?.allowLegacyUnsafeDelegation === true;
+        if (legacyUnsafeDelegationEnabled && !warnedLegacyUnsafeDelegation) {
+            warnedLegacyUnsafeDelegation = true;
+            console.warn("⚠️  KYA-OS: allowLegacyUnsafeDelegation=true disables delegation-chain " +
+                "resolution and StatusList revocation checks. This is unsafe for production. " +
+                "See SECURITY.md (Unsafe Delegation Modes).");
+        }
+        if (delegationConfig?.requireAudienceOnRedelegation === false &&
+            !warnedAudienceOptOut) {
+            warnedAudienceOptOut = true;
+            console.warn("⚠️  KYA-OS: requireAudienceOnRedelegation=false disables confused-deputy " +
+                "protection on re-delegations. The default is true as of 1.3.x. " +
+                "See SECURITY.md (Unsafe Delegation Modes).");
+        }
         const didKeyResolver = createDidKeyResolver();
         const fetchProvider = delegationConfig?.fetchProvider ??
             (typeof globalThis.fetch === "function"
@@ -408,7 +427,7 @@ export function createMCPIMiddleware(config, cryptoProvider) {
             if (leafDelegation.parentId) {
                 if (!delegationConfig?.resolveDelegationChain) {
                     if (legacyUnsafeDelegationEnabled) {
-                        logger.warn(`[mcpi] Legacy delegation mode enabled: accepting parent-linked credential ${leafDelegation.id} without resolveDelegationChain`);
+                        logger.warn(`[kya-os] Legacy delegation mode enabled: accepting parent-linked credential ${leafDelegation.id} without resolveDelegationChain`);
                         return { valid: true };
                     }
                     return {
@@ -457,7 +476,7 @@ export function createMCPIMiddleware(config, cryptoProvider) {
                 seenIds.add(delegation.id);
                 if (credential.credentialStatus && !delegationConfig?.statusListResolver) {
                     if (legacyUnsafeDelegationEnabled) {
-                        logger.warn(`[mcpi] Legacy delegation mode enabled: skipping status-list verification for ${delegation.id}`);
+                        logger.warn(`[kya-os] Legacy delegation mode enabled: skipping status-list verification for ${delegation.id}`);
                     }
                     else {
                         return {
@@ -489,7 +508,12 @@ export function createMCPIMiddleware(config, cryptoProvider) {
                 // credential in the chain MUST have an audience constraint.
                 // This prevents confused-deputy attacks where re-delegated
                 // credentials are forwarded to unintended servers.
-                if (delegationConfig?.requireAudienceOnRedelegation &&
+                //
+                // Defaults to `true`. Set explicitly to `false` to preserve
+                // legacy behavior (logged once per process — see opt-out warning
+                // below).
+                const requireAudienceOnRedelegation = delegationConfig?.requireAudienceOnRedelegation !== false;
+                if (requireAudienceOnRedelegation &&
                     delegation.parentId &&
                     !delegation.constraints.audience) {
                     return {
@@ -537,7 +561,7 @@ export function createMCPIMiddleware(config, cryptoProvider) {
             return { valid: true };
         };
         return async (args, sessionId) => {
-            const delegationArg = args["_mcpi_delegation"];
+            const delegationArg = args["_kyaos_delegation"];
             if (delegationArg === undefined || delegationArg === null) {
                 // No delegation provided — return needs_authorization response
                 const tokenBytes = await cryptoProvider.randomBytes(16);
@@ -571,7 +595,7 @@ export function createMCPIMiddleware(config, cryptoProvider) {
             if (typeof delegationArg === "string") {
                 const parsed = parseVCJWT(delegationArg);
                 if (!parsed || !parsed.payload.vc) {
-                    return buildDelegationErrorResponse(MCPI_ERROR_CODES.delegation_invalid, "Invalid VC-JWT format");
+                    return buildDelegationErrorResponse(KYA_OS_ERROR_CODES.delegation_invalid, "Invalid VC-JWT format");
                 }
                 vc = parsed.payload.vc;
                 // VC-JWTs don't have an embedded proof — the JWT signature is the
@@ -592,21 +616,21 @@ export function createMCPIMiddleware(config, cryptoProvider) {
                 skipSignature: isVCJWT,
             });
             if (!verificationResult.valid) {
-                logger.warn(`[mcpi] Delegation verification failed for "${toolName}": ${verificationResult.reason}`);
-                return buildDelegationErrorResponse(MCPI_ERROR_CODES.delegation_invalid, verificationResult.reason ?? "Unknown delegation validation error");
+                logger.warn(`[kya-os] Delegation verification failed for "${toolName}": ${verificationResult.reason}`);
+                return buildDelegationErrorResponse(KYA_OS_ERROR_CODES.delegation_invalid, verificationResult.reason ?? "Unknown delegation validation error");
             }
             const scopes = getDelegationScopes(vc);
             if (!scopes.includes(config.scopeId)) {
-                logger.warn(`[mcpi] Delegation missing required scope "${config.scopeId}" for "${toolName}"`);
-                return buildDelegationErrorResponse(MCPI_ERROR_CODES.insufficient_scope, `Required scope "${config.scopeId}" not in delegation scopes`);
+                logger.warn(`[kya-os] Delegation missing required scope "${config.scopeId}" for "${toolName}"`);
+                return buildDelegationErrorResponse(KYA_OS_ERROR_CODES.insufficient_scope, `Required scope "${config.scopeId}" not in delegation scopes`);
             }
-            // Strip _mcpi_delegation from args before passing to handler
+            // Strip _kyaos_delegation from args before passing to handler
             const cleanArgs = {};
             for (const [k, v] of Object.entries(args)) {
-                if (k !== "_mcpi_delegation")
+                if (k !== "_kyaos_delegation")
                     cleanArgs[k] = v;
             }
-            logger.debug(`[mcpi] Delegation verified for "${toolName}", scope "${config.scopeId}"`);
+            logger.debug(`[kya-os] Delegation verified for "${toolName}", scope "${config.scopeId}"`);
             return handler(cleanArgs, sessionId);
         };
     }
@@ -614,12 +638,12 @@ export function createMCPIMiddleware(config, cryptoProvider) {
         identity: config.identity,
         sessionManager,
         proofGenerator,
-        mcpiTool,
+        kyaOsTool,
         handshakeTool,
-        handleMCPI,
+        handleKyaOs,
         handleHandshake,
         wrapWithProof,
         wrapWithDelegation,
     };
 }
-//# sourceMappingURL=with-mcpi.js.map
+//# sourceMappingURL=with-kya-os.js.map

package/dist/middleware/with-kya-os.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-kya-os.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAEL,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,cAAc,GAGf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,GAIf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EACL,4BAA4B,GAI7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,GAGxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAUrG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,YAAY,CAAU,CAAC;AAgL/E,MAAM,oBAAqB,SAAQ,aAAa;IAC9C,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,oBAAoB;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAiB;QACxC,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,OAAsB,CAAC,CAAC;IACvD,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,UAAgC;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACzE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACrF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,wBAAwB,CAC/B,gBAAsC,EACtC,eAAqC;IAErC,MAAM,YAAY,GAAG,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,eAAe,CAAC,iBAAiB,CAAC,UAAU,CAAC;IAErE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,cAAc,eAAe,CAAC,EAAE,2DAA2D,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,EAAE;SACtJ,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAChF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,cAAc,eAAe,CAAC,EAAE,gCAAgC,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACxJ,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,sEAAsE;AACtE,wEAAwE;AACxE,WAAW;AACX,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,IAAI,4BAA4B,GAAG,KAAK,CAAC;AAEzC,MAAM,UAAU,qBAAqB,CACnC,MAAmB,EACnB,cAA8B;IAE9B,MAAM,QAAQ,GAAuB;QACnC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QACxB,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QACxB,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU;QACtC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;KACrC,CAAC;IAEF,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,cAAc,EAAE;QACxD,GAAG,MAAM,CAAC,OAAO;QACjB,SAAS,EAAE,QAAQ,CAAC,GAAG;KACxB,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC;IAE3C,6DAA6D;IAC7D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEhD,iEAAiE;IACjE,IAAI,eAAmC,CAAC;IAExC,MAAM,aAAa,GAAwB;QACzC,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,iEAAiE;QACnE,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,+BAA+B,EAAE;gBACvE,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,uCAAuC;iBACrD;gBACD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE;gBAChE,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,6BAA6B;iBAC3C;aACF;YACD,QAAQ,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC;SAC7C;KACF,CAAC;IAEF,MAAM,SAAS,GAAwB;QACrC,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,iFAAiF;QACnF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,cAAc,CAAC;oBACzB,WAAW,EAAE,+BAA+B;iBAC7C;gBACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,+BAA+B,EAAE;gBACvE,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,uCAAuC;iBACrD;gBACD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE;gBAChE,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,6BAA6B;iBAC3C;aACF;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB;KACF,CAAC;IAEF,KAAK,UAAU,eAAe,CAAC,IAA6B;QAI1D,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,OAAO,EAAE,KAAK;4BACd,KAAK,EAAE;gCACL,IAAI,EAAE,kBAAkB,CAAC,gBAAgB;gCACzC,OAAO,EACL,wGAAwG;6BAC3G;yBACF,CAAC;qBACH;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GACV,MAAM,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAE/C,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAClE,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7C,CAAC;QAED,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI;4BACpB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;4BACnC,SAAS,EAAE,QAAQ,CAAC,GAAG;4BACvB,SAAS,EAAE,QAAQ,CAAC,GAAG;yBACxB,CAAC;wBACF,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;qBAC7C,CAAC;iBACH;aACF;YACD,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACvC,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,cAAc;QAI3B,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,GAAG,EAAE,QAAQ,CAAC,GAAG;wBACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;wBACjB,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,GAAG;wBAC/C,YAAY,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,cAAc,CAAC;wBACtD,eAAe,EAAE,OAAO;wBACxB,gBAAgB,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,oBAAoB;qBACxE,CAAC;iBACH;aACF;SACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,IAA6B;QAItD,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;YAC7B,CAAC,CAAE,IAAI,CAAC,MAAsB;YAC9B,CAAC,CAAC,SAAS,CAAC;QAEhB,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,WAAW;gBACd,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;YAE/B,KAAK,UAAU;gBACb,OAAO,cAAc,EAAE,CAAC;YAE1B,KAAK,YAAY;gBACf,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACnB,OAAO,EAAE,KAAK;gCACd,KAAK,EAAE;oCACL,IAAI,EAAE,kBAAkB,CAAC,aAAa;oCACtC,OAAO,EACL,8CAA8C;iCACjD;6BACF,CAAC;yBACH;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;YAEJ;gBACE,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gCACnB,OAAO,EAAE,KAAK;gCACd,KAAK,EAAE;oCACL,IAAI,EAAE,kBAAkB,CAAC,eAAe;oCACxC,OAAO,EAAE,2BAA2B,MAAM,IAAI,WAAW,qBAAqB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iCAC1G;6BACF,CAAC;yBACH;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;QACN,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,aAAa;QAC1B,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAClE,IAAI,QAAQ;gBAAE,OAAO,eAAe,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAE1C,kFAAkF;QAClF,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,iBAAiB,CAAC;YACpD,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,GAAG;YACtB,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;YAC3C,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAClE,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,SAAS,aAAa,CACpB,QAAgB,EAChB,OAA4B;QAE5B,OAAO,KAAK,EAAE,IAA6B,EAAE,SAAkB,EAAE,EAAE;YACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAS,EAAE,SAAS,CAAC,CAAC;YAEnD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,iEAAiE;YACjE,MAAM,iBAAiB,GAAG,SAAS,IAAI,MAAM,aAAa,EAAE,CAAC;YAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YACnE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBAChE,MAAM,QAAQ,GAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;gBAExD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,aAAa,CAC9C,OAAO,EACP,QAAQ,EACR,OAAO,CACR,CAAC;gBAEF,uEAAuE;gBACvE,MAAM,CAAC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;oBAC/C,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;gBACH,MAAM,CAAC,KAAK,GAAG;oBACb,UAAU,EAAE,gDAAgD;iBAC7D,CAAC;YACJ,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;IAED,SAAS,kBAAkB,CACzB,QAAgB,EAChB,MAA+C,EAC/C,OAAyB;QAEzB,MAAM,6BAA6B,GACjC,gBAAgB,EAAE,2BAA2B,KAAK,IAAI,CAAC;QACzD,IAAI,6BAA6B,IAAI,CAAC,4BAA4B,EAAE,CAAC;YACnE,4BAA4B,GAAG,IAAI,CAAC;YACpC,OAAO,CAAC,IAAI,CACV,yEAAyE;gBACvE,8EAA8E;gBAC9E,4CAA4C,CAC/C,CAAC;QACJ,CAAC;QACD,IACE,gBAAgB,EAAE,6BAA6B,KAAK,KAAK;YACzD,CAAC,oBAAoB,EACrB,CAAC;YACD,oBAAoB,GAAG,IAAI,CAAC;YAC5B,OAAO,CAAC,IAAI,CACV,2EAA2E;gBACzE,iEAAiE;gBACjE,4CAA4C,CAC/C,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;QAC9C,MAAM,aAAa,GACjB,gBAAgB,EAAE,aAAa;YAC/B,CAAC,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;gBACrC,CAAC,CAAC,IAAI,oBAAoB,EAAE;gBAC5B,CAAC,CAAC,SAAS,CAAC,CAAC;QACjB,MAAM,cAAc,GAAG,aAAa;YAClC,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC;YACrC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,WAAW,GAAgB;YAC/B,KAAK,CAAC,OAAO,CAAC,GAAW;gBACvB,MAAM,cAAc,GAAG,gBAAgB,EAAE,WAAW,CAAC;gBACrD,IAAI,cAAc,EAAE,CAAC;oBACnB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACnD,IAAI,QAAQ,EAAE,CAAC;wBACb,OAAO,QAAQ,CAAC;oBAClB,CAAC;gBACH,CAAC;gBAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC/B,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACrC,CAAC;gBAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC/B,OAAO,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;gBAC9C,CAAC;gBAED,OAAO,IAAI,CAAC;YACd,CAAC;SACF,CAAC;QAEF,MAAM,iBAAiB,GAAkC,KAAK,EAC5D,EAAwB,EACxB,YAAqB,EACyB,EAAE;YAChD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;YACvB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YACnD,CAAC;YAED,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAuB,CAAC;YAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;YACjE,CAAC;YAED,yEAAyE;YACzE,MAAM,QAAQ,GAAG,EAA6B,CAAC;YAC/C,MAAM,cAAc,GAA4B,EAAE,CAAC;YACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9C,IAAI,CAAC,KAAK,OAAO;oBAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAEjD,8CAA8C;YAC9C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;YAEpD,iEAAiE;YACjE,MAAM,GAAG,GAAG,YAA8B,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;YAChE,CAAC;YAED,mEAAmE;YACnE,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClD,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAEhD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;YACxE,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B;aAC5D,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAAC;YAChD,WAAW;YACX,iBAAiB;YACjB,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB;SACzD,CAAC,CAAC;QAEH,MAAM,4BAA4B,GAAG,CACnC,KAAa,EACb,MAAc,EACyB,EAAE,CAAC,CAAC;YAC3C,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;iBACxC;aACF;YACD,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,uBAAuB,GAAG,KAAK,EACnC,cAAoC,EACpC,OAAqC,EACS,EAAE;YAChD,MAAM,cAAc,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;YAC/D,IAAI,KAAK,GAA2B,CAAC,cAAc,CAAC,CAAC;YAErD,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;gBAC5B,IAAI,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,CAAC;oBAC9C,IAAI,6BAA6B,EAAE,CAAC;wBAClC,MAAM,CAAC,IAAI,CACT,+EAA+E,cAAc,CAAC,EAAE,iCAAiC,CAClI,CAAC;wBACF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;oBACzB,CAAC;oBACD,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,cAAc,cAAc,CAAC,EAAE,sBAAsB,cAAc,CAAC,QAAQ,sDAAsD;qBAC3I,CAAC;gBACJ,CAAC;gBAED,IAAI,aAAqC,CAAC;gBAC1C,IAAI,CAAC;oBACH,aAAa;wBACX,MAAM,gBAAgB,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;gBAClE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;qBAC1G,CAAC;gBACJ,CAAC;gBAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC/B,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,cAAc,cAAc,CAAC,EAAE,sBAAsB,cAAc,CAAC,QAAQ,kCAAkC;qBACvH,CAAC;gBACJ,CAAC;gBAED,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CACvC,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,CACnE,CAAC;gBACF,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,KAAK,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC/D,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,iCAAiC,cAAc,CAAC,EAAE,oCAAoC;qBAC/F,CAAC;gBACJ,CAAC;gBAED,KAAK;oBACH,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAC1E,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;YAClC,IAAI,kBAAgD,CAAC;YACrD,IAAI,kBAAoD,CAAC;YAEzD,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;gBAC/B,MAAM,UAAU,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;gBAEvD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC/B,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,qDAAqD,UAAU,CAAC,EAAE,EAAE;qBAC7E,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;gBAE3B,IAAI,UAAU,CAAC,gBAAgB,IAAI,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;oBACzE,IAAI,6BAA6B,EAAE,CAAC;wBAClC,MAAM,CAAC,IAAI,CACT,kFAAkF,UAAU,CAAC,EAAE,EAAE,CAClG,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACR,OAAO;4BACL,KAAK,EAAE,KAAK;4BACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,+DAA+D;yBACnG,CAAC;oBACF,CAAC;gBACH,CAAC;gBAED,MAAM,mBAAmB,GACvB,6BAA6B;oBAC7B,CAAC,CAAC,UAAU,CAAC,gBAAgB;oBAC7B,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;gBACxC,MAAM,sBAAsB,GAAG,MAAM,QAAQ,CAAC,0BAA0B,CACtE,UAAU,EACV;oBACE,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpD,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D,CACF,CAAC;gBACF,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,CAAC;oBAClC,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,aAAa,sBAAsB,CAAC,MAAM,EAAE;qBAChF,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,wBAAwB,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxD,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,yCAAyC,QAAQ,CAAC,GAAG,EAAE;qBAC3F,CAAC;gBACJ,CAAC;gBAED,gEAAgE;gBAChE,4DAA4D;gBAC5D,2DAA2D;gBAC3D,mDAAmD;gBACnD,EAAE;gBACF,4DAA4D;gBAC5D,iEAAiE;gBACjE,UAAU;gBACV,MAAM,6BAA6B,GACjC,gBAAgB,EAAE,6BAA6B,KAAK,KAAK,CAAC;gBAC5D,IACE,6BAA6B;oBAC7B,UAAU,CAAC,QAAQ;oBACnB,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,EAChC,CAAC;oBACD,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,kCAAkC,UAAU,CAAC,QAAQ,yHAAyH;qBAClN,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,kBAAkB,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBAC/C,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;wBACxB,OAAO;4BACL,KAAK,EAAE,KAAK;4BACZ,MAAM,EAAE,4DAA4D,UAAU,CAAC,EAAE,4BAA4B,UAAU,CAAC,QAAQ,EAAE;yBACnI,CAAC;oBACJ,CAAC;oBAED,kBAAkB,GAAG,UAAU,CAAC;oBAChC,kBAAkB,GAAG,UAAU,CAAC;oBAChC,SAAS;gBACX,CAAC;gBAED,IAAI,UAAU,CAAC,QAAQ,KAAK,kBAAkB,CAAC,EAAE,EAAE,CAAC;oBAClD,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,sBAAsB,UAAU,CAAC,QAAQ,iBAAiB,kBAAkB,CAAC,EAAE,EAAE;qBACrH,CAAC;gBACJ,CAAC;gBAED,IAAI,UAAU,CAAC,SAAS,KAAK,kBAAkB,CAAC,UAAU,EAAE,CAAC;oBAC3D,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,cAAc,UAAU,CAAC,SAAS,0BAA0B,kBAAkB,CAAC,UAAU,EAAE;qBAC/H,CAAC;gBACJ,CAAC;gBAED,MAAM,eAAe,GAAG,wBAAwB,CAC9C,kBAAkB,EAClB,UAAU,CACX,CAAC;gBACF,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;oBAC3B,OAAO,eAAe,CAAC;gBACzB,CAAC;gBAED,kBAAkB,GAAG,UAAU,CAAC;gBAChC,kBAAkB,GAAG,UAAU,CAAC;YAClC,CAAC;YAED,MAAM,eAAe,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAC;YAC1E,IAAI,eAAe,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,EAAE,CAAC;gBAC7C,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,sCAAsC,eAAe,CAAC,EAAE,oBAAoB,cAAc,CAAC,EAAE,EAAE;iBACxG,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC,CAAC;QAEF,OAAO,KAAK,EACV,IAA6B,EAC7B,SAAkB,EAClB,EAAE;YACF,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAEhD,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC1D,+DAA+D;gBAC/D,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBACxD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;qBAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;qBAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;gBACZ,MAAM,WAAW,GAAG;oBAClB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;oBACf,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBAChB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;oBACjB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;oBACjB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;iBACd,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACZ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;gBAEtD,MAAM,SAAS,GAAG,6BAA6B,CAAC;oBAC9C,OAAO,EAAE,SAAS,QAAQ,qCAAqC,MAAM,CAAC,OAAO,EAAE;oBAC/E,gBAAgB,EAAE,MAAM,CAAC,UAAU;oBACnC,WAAW;oBACX,SAAS;oBACT,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;iBACzB,CAAC,CAAC;gBAEH,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;iBAC7D,CAAC;YACJ,CAAC;YAED,kEAAkE;YAClE,qEAAqE;YACrE,qEAAqE;YACrE,IAAI,EAAwB,CAAC;YAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;gBACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;oBAClC,OAAO,4BAA4B,CACjC,kBAAkB,CAAC,kBAAkB,EACrC,uBAAuB,CACxB,CAAC;gBACJ,CAAC;gBACD,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAA0B,CAAC;gBAC/C,kEAAkE;gBAClE,kEAAkE;gBAClE,iEAAiE;gBACjE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;oBACd,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC;gBACtE,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACN,EAAE,GAAG,aAAqC,CAAC;YAC7C,CAAC;YAED,iEAAiE;YACjE,iEAAiE;YACjE,+BAA+B;YAC/B,MAAM,kBAAkB,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE;gBAC3D,aAAa,EAAE,OAAO;aACvB,CAAC,CAAC;YAEH,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CACT,gDAAgD,QAAQ,MAAM,kBAAkB,CAAC,MAAM,EAAE,CAC1F,CAAC;gBACF,OAAO,4BAA4B,CACjC,kBAAkB,CAAC,kBAAkB,EACrC,kBAAkB,CAAC,MAAM,IAAI,qCAAqC,CACnE,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,MAAM,CAAC,IAAI,CACT,+CAA+C,MAAM,CAAC,OAAO,UAAU,QAAQ,GAAG,CACnF,CAAC;gBACF,OAAO,4BAA4B,CACjC,kBAAkB,CAAC,kBAAkB,EACrC,mBAAmB,MAAM,CAAC,OAAO,4BAA4B,CAC9D,CAAC;YACJ,CAAC;YAED,8DAA8D;YAC9D,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,KAAK,mBAAmB;oBAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAClD,CAAC;YAED,MAAM,CAAC,KAAK,CACV,qCAAqC,QAAQ,aAAa,MAAM,CAAC,OAAO,GAAG,CAC5E,CAAC;YACF,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvC,CAAC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc;QACd,cAAc;QACd,SAAS;QACT,aAAa;QACb,WAAW;QACX,eAAe;QACf,aAAa;QACb,kBAAkB;KACnB,CAAC;AACJ,CAAC"}

package/dist/proof/errors.d.ts

@@ -30,6 +30,7 @@ export declare const PROOF_VERIFICATION_ERROR_CODES: {
     readonly VERIFICATION_METHOD_NOT_FOUND: "VERIFICATION_METHOD_NOT_FOUND";
     readonly PUBLIC_KEY_NOT_FOUND: "PUBLIC_KEY_NOT_FOUND";
     readonly UNSUPPORTED_DID_METHOD: "UNSUPPORTED_DID_METHOD";
+    readonly META_POLICY_VIOLATION: "META_POLICY_VIOLATION";
     readonly VERIFICATION_ERROR: "VERIFICATION_ERROR";
     readonly INTERNAL_ERROR: "INTERNAL_ERROR";
 };

package/dist/proof/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/proof/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;CAoCjC,CAAC;AAEX,MAAM,MAAM,0BAA0B,GACpC,OAAO,8BAA8B,CAAC,MAAM,OAAO,8BAA8B,CAAC,CAAC;AAErF;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;aAE7B,IAAI,EAAE,0BAA0B;aAEhC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAFjC,IAAI,EAAE,0BAA0B,EAChD,OAAO,EAAE,MAAM,EACC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAKpD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,0BAA0B,EAChC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,sBAAsB,CAExB"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/proof/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;CAuCjC,CAAC;AAEX,MAAM,MAAM,0BAA0B,GACpC,OAAO,8BAA8B,CAAC,MAAM,OAAO,8BAA8B,CAAC,CAAC;AAErF;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;aAE7B,IAAI,EAAE,0BAA0B;aAEhC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAFjC,IAAI,EAAE,0BAA0B,EAChD,OAAO,EAAE,MAAM,EACC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAKpD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,0BAA0B,EAChC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,sBAAsB,CAExB"}

package/dist/proof/errors.js

@@ -35,6 +35,8 @@ export const PROOF_VERIFICATION_ERROR_CODES = {
     VERIFICATION_METHOD_NOT_FOUND: "VERIFICATION_METHOD_NOT_FOUND",
     PUBLIC_KEY_NOT_FOUND: "PUBLIC_KEY_NOT_FOUND",
     UNSUPPORTED_DID_METHOD: "UNSUPPORTED_DID_METHOD",
+    // Meta policy errors
+    META_POLICY_VIOLATION: "META_POLICY_VIOLATION",
     // Generic errors
     VERIFICATION_ERROR: "VERIFICATION_ERROR",
     INTERNAL_ERROR: "INTERNAL_ERROR",

package/dist/proof/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/proof/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,yBAAyB;IACzB,uBAAuB,EAAE,yBAAyB;IAClD,sBAAsB,EAAE,wBAAwB;IAEhD,kBAAkB;IAClB,qBAAqB,EAAE,uBAAuB;IAC9C,uBAAuB,EAAE,yBAAyB;IAClD,iBAAiB,EAAE,mBAAmB;IAEtC,mBAAmB;IACnB,qBAAqB,EAAE,uBAAuB;IAC9C,kBAAkB,EAAE,oBAAoB;IACxC,kBAAkB,EAAE,oBAAoB;IACxC,mBAAmB,EAAE,qBAAqB;IAC1C,4BAA4B,EAAE,8BAA8B;IAC5D,qBAAqB,EAAE,uBAAuB;IAE9C,aAAa;IACb,kBAAkB,EAAE,oBAAoB;IACxC,eAAe,EAAE,iBAAiB;IAClC,eAAe,EAAE,iBAAiB;IAClC,mBAAmB,EAAE,qBAAqB;IAC1C,sBAAsB,EAAE,wBAAwB;IAChD,gBAAgB,EAAE,kBAAkB;IAEpC,wBAAwB;IACxB,qBAAqB,EAAE,uBAAuB;IAC9C,sBAAsB,EAAE,wBAAwB;IAChD,6BAA6B,EAAE,+BAA+B;IAC9D,oBAAoB,EAAE,sBAAsB;IAC5C,sBAAsB,EAAE,wBAAwB;IAEhD,iBAAiB;IACjB,kBAAkB,EAAE,oBAAoB;IACxC,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAKX;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAE7B;IAEA;IAHlB,YACkB,IAAgC,EAChD,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAA4B;QAEhC,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAAgC,EAChC,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/proof/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,yBAAyB;IACzB,uBAAuB,EAAE,yBAAyB;IAClD,sBAAsB,EAAE,wBAAwB;IAEhD,kBAAkB;IAClB,qBAAqB,EAAE,uBAAuB;IAC9C,uBAAuB,EAAE,yBAAyB;IAClD,iBAAiB,EAAE,mBAAmB;IAEtC,mBAAmB;IACnB,qBAAqB,EAAE,uBAAuB;IAC9C,kBAAkB,EAAE,oBAAoB;IACxC,kBAAkB,EAAE,oBAAoB;IACxC,mBAAmB,EAAE,qBAAqB;IAC1C,4BAA4B,EAAE,8BAA8B;IAC5D,qBAAqB,EAAE,uBAAuB;IAE9C,aAAa;IACb,kBAAkB,EAAE,oBAAoB;IACxC,eAAe,EAAE,iBAAiB;IAClC,eAAe,EAAE,iBAAiB;IAClC,mBAAmB,EAAE,qBAAqB;IAC1C,sBAAsB,EAAE,wBAAwB;IAChD,gBAAgB,EAAE,kBAAkB;IAEpC,wBAAwB;IACxB,qBAAqB,EAAE,uBAAuB;IAC9C,sBAAsB,EAAE,wBAAwB;IAChD,6BAA6B,EAAE,+BAA+B;IAC9D,oBAAoB,EAAE,sBAAsB;IAC5C,sBAAsB,EAAE,wBAAwB;IAEhD,qBAAqB;IACrB,qBAAqB,EAAE,uBAAuB;IAE9C,iBAAiB;IACjB,kBAAkB,EAAE,oBAAoB;IACxC,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAKX;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAE7B;IAEA;IAHlB,YACkB,IAAgC,EAChD,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAA4B;QAEhC,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAAgC,EAChC,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC"}

package/dist/proof/generator.d.ts

@@ -2,7 +2,7 @@
  * Proof Generation — Platform-agnostic Protocol Reference
  *
  * Handles JCS canonicalization, SHA-256 digest generation, and Ed25519 JWS
- * signing (compact format) according to MCP-I requirements 5.1, 5.2, 5.3, 5.6.
+ * signing (compact format) according to KYA-OS requirements 5.1, 5.2, 5.3, 5.6.
  *
  * This module is the authoritative proof implementation. All platform adapters
  * (Node.js, Cloudflare Workers) inject a CryptoProvider and delegate here.

package/dist/proof/generator.js

@@ -2,7 +2,7 @@
  * Proof Generation — Platform-agnostic Protocol Reference
  *
  * Handles JCS canonicalization, SHA-256 digest generation, and Ed25519 JWS
- * signing (compact format) according to MCP-I requirements 5.1, 5.2, 5.3, 5.6.
+ * signing (compact format) according to KYA-OS requirements 5.1, 5.2, 5.3, 5.6.
  *
  * This module is the authoritative proof implementation. All platform adapters
  * (Node.js, Cloudflare Workers) inject a CryptoProvider and delegate here.

package/dist/proof/index.d.ts

@@ -1,4 +1,4 @@
 export { ProofGenerator, createProofResponse, extractCanonicalData, type ProofAgentIdentity, type ToolRequest, type ToolResponse, type ProofOptions, } from './generator.js';
-export { ProofVerifier, type ProofVerifierConfig, type ProofVerificationResult, } from './verifier.js';
+export { ProofVerifier, validateMetaStructure, extractProofFromMeta, DEFAULT_CLOCK_SKEW_SECONDS, MIN_CLOCK_SKEW_SECONDS, MAX_CLOCK_SKEW_SECONDS, type ProofVerifierConfig, type ProofVerificationResult, } from './verifier.js';
 export { ProofVerificationError, PROOF_VERIFICATION_ERROR_CODES, createProofVerificationError, type ProofVerificationErrorCode, } from './errors.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/proof/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/proof/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,EAC5B,KAAK,0BAA0B,GAChC,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/proof/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,EAC5B,KAAK,0BAA0B,GAChC,MAAM,aAAa,CAAC"}

package/dist/proof/index.js

@@ -1,4 +1,4 @@
 export { ProofGenerator, createProofResponse, extractCanonicalData, } from './generator.js';
-export { ProofVerifier, } from './verifier.js';
+export { ProofVerifier, validateMetaStructure, extractProofFromMeta, DEFAULT_CLOCK_SKEW_SECONDS, MIN_CLOCK_SKEW_SECONDS, MAX_CLOCK_SKEW_SECONDS, } from './verifier.js';
 export { ProofVerificationError, PROOF_VERIFICATION_ERROR_CODES, createProofVerificationError, } from './errors.js';
 //# sourceMappingURL=index.js.map

package/dist/proof/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/proof/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,GAKrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,aAAa,GAGd,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/proof/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,GAKrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,GAGvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,aAAa,CAAC"}

package/dist/proof/verifier.d.ts

@@ -9,7 +9,7 @@ import { CryptoProvider } from "../providers/base.js";
 import { ClockProvider } from "../providers/base.js";
 import { NonceCacheProvider } from "../providers/base.js";
 import { FetchProvider } from "../providers/base.js";
-import { type DetachedProof } from "../types/protocol.js";
+import { type DetachedProof, type MetaPolicy } from "../types/protocol.js";
 import { type ProofVerificationErrorCode } from "./errors.js";
 export interface ProofVerificationResult {
     valid: boolean;
@@ -26,6 +26,12 @@ export interface ProofVerifierConfig {
     timestampSkewSeconds?: number;
     nonceTtlSeconds?: number;
 }
+/** Default timestamp skew for proof verification (seconds) */
+export declare const DEFAULT_CLOCK_SKEW_SECONDS = 120;
+/** Minimum allowed clock skew (seconds) */
+export declare const MIN_CLOCK_SKEW_SECONDS = 30;
+/** Maximum allowed clock skew (seconds) */
+export declare const MAX_CLOCK_SKEW_SECONDS = 600;
 export declare class ProofVerifier {
     private cryptoService;
     private clock;
@@ -34,6 +40,18 @@ export declare class ProofVerifier {
     private timestampSkewSeconds;
     private nonceTtlSeconds;
     constructor(config: ProofVerifierConfig);
+    /**
+     * Update the timestamp skew from a server-advertised value.
+     * Clients SHOULD call this with the server's clockSkewSeconds from /.well-known/mcp.
+     * The value is clamped to [30, 600] seconds.
+     *
+     * @param skewSeconds - Server-advertised clock skew in seconds
+     */
+    setTimestampSkew(skewSeconds: number): void;
+    /**
+     * Get the current timestamp skew setting.
+     */
+    getTimestampSkew(): number;
     /**
      * Verify a DetachedProof
      * Automatically reconstructs canonical payload from proof.meta for signature verification
@@ -105,4 +123,34 @@ export declare class ProofVerifier {
      */
     buildCanonicalPayload(meta: DetachedProof["meta"]): string;
 }
+/**
+ * Validate _meta structure according to meta policy.
+ *
+ * In 'strict' mode, _meta must contain only 'proof'.
+ * In 'allow-extensions' mode, additional keys are permitted.
+ *
+ * @param meta - The _meta object from a response
+ * @param policy - Meta policy ('strict' or 'allow-extensions')
+ * @returns Validation result with valid flag and optional reason
+ */
+export declare function validateMetaStructure(meta: Record<string, unknown>, policy?: MetaPolicy): {
+    valid: boolean;
+    reason?: string;
+    extraKeys?: string[];
+};
+/**
+ * Extract proof from _meta with policy validation.
+ *
+ * @param meta - The _meta object from a response
+ * @param policy - Meta policy ('strict' or 'allow-extensions')
+ * @returns Extracted proof or error result
+ */
+export declare function extractProofFromMeta(meta: Record<string, unknown>, policy?: MetaPolicy): {
+    success: true;
+    proof: DetachedProof;
+} | {
+    success: false;
+    reason: string;
+    errorCode: string;
+};
 //# sourceMappingURL=verifier.d.ts.map

package/dist/proof/verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../src/proof/verifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAGL,KAAK,0BAA0B,EAChC,MAAM,aAAa,CAAC;AAGrB,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,SAAS,CAAC,EAAE,0BAA0B,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,cAAc,CAAC;IAC/B,aAAa,EAAE,aAAa,CAAC;IAC7B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,aAAa,EAAE,aAAa,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,KAAK,CAAgB;IAC7B,OAAO,CAAC,UAAU,CAAqB;IACvC,OAAO,CAAC,KAAK,CAAgB;IAC7B,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,eAAe,CAAS;gBAEpB,MAAM,EAAE,mBAAmB;IASvC;;;;;;OAMG;IACG,WAAW,CACf,KAAK,EAAE,aAAa,EACpB,YAAY,EAAE,UAAU,GACvB,OAAO,CAAC,uBAAuB,CAAC;IAcnC;;;;;;OAMG;IACG,mBAAmB,CACvB,KAAK,EAAE,aAAa,EACpB,gBAAgB,EAAE,MAAM,GAAG,UAAU,EACrC,YAAY,EAAE,UAAU,GACvB,OAAO,CAAC,uBAAuB,CAAC;IAcnC;;;OAGG;YACW,uBAAuB;IAiDrC;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAY/B;;;OAGG;YACW,sBAAsB;IAuBpC;;;OAGG;YACW,aAAa;IAmB3B;;;OAGG;YACW,iBAAiB;IAqB/B;;;OAGG;YACW,eAAe;IAgC7B;;;OAGG;YACW,eAAe;IAQ7B;;;;;;OAMG;IACG,qBAAqB,CACzB,GAAG,EAAE,MAAM,EACX,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAuG7B;;;;;;;;;OASG;IACH,qBAAqB,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,MAAM;CA0B3D"}
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../src/proof/verifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,UAAU,EAChB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAGL,KAAK,0BAA0B,EAChC,MAAM,aAAa,CAAC;AAGrB,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,SAAS,CAAC,EAAE,0BAA0B,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,cAAc,CAAC;IAC/B,aAAa,EAAE,aAAa,CAAC;IAC7B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,aAAa,EAAE,aAAa,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,2CAA2C;AAC3C,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,2CAA2C;AAC3C,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C,qBAAa,aAAa;IACxB,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,KAAK,CAAgB;IAC7B,OAAO,CAAC,UAAU,CAAqB;IACvC,OAAO,CAAC,KAAK,CAAgB;IAC7B,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,eAAe,CAAS;gBAEpB,MAAM,EAAE,mBAAmB;IASvC;;;;;;OAMG;IACH,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAU3C;;OAEG;IACH,gBAAgB,IAAI,MAAM;IAI1B;;;;;;OAMG;IACG,WAAW,CACf,KAAK,EAAE,aAAa,EACpB,YAAY,EAAE,UAAU,GACvB,OAAO,CAAC,uBAAuB,CAAC;IAcnC;;;;;;OAMG;IACG,mBAAmB,CACvB,KAAK,EAAE,aAAa,EACpB,gBAAgB,EAAE,MAAM,GAAG,UAAU,EACrC,YAAY,EAAE,UAAU,GACvB,OAAO,CAAC,uBAAuB,CAAC;IAcnC;;;OAGG;YACW,uBAAuB;IAiDrC;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAY/B;;;OAGG;YACW,sBAAsB;IAuBpC;;;OAGG;YACW,aAAa;IAmB3B;;;OAGG;YACW,iBAAiB;IAqB/B;;;OAGG;YACW,eAAe;IAgC7B;;;OAGG;YACW,eAAe;IAQ7B;;;;;;OAMG;IACG,qBAAqB,CACzB,GAAG,EAAE,MAAM,EACX,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAuG7B;;;;;;;;;OASG;IACH,qBAAqB,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,MAAM;CA0B3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,GAAE,UAAqB,GAC5B;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAa3D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,GAAE,UAAqB,GAC5B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CA+BjG"}

package/dist/proof/verifier.js

@@ -9,6 +9,12 @@ import { validateDetachedProof, } from "../types/protocol.js";
 import { canonicalize } from "json-canonicalize";
 import { ProofVerificationError, PROOF_VERIFICATION_ERROR_CODES, } from "./errors.js";
 import { logger } from "../logging/index.js";
+/** Default timestamp skew for proof verification (seconds) */
+export const DEFAULT_CLOCK_SKEW_SECONDS = 120;
+/** Minimum allowed clock skew (seconds) */
+export const MIN_CLOCK_SKEW_SECONDS = 30;
+/** Maximum allowed clock skew (seconds) */
+export const MAX_CLOCK_SKEW_SECONDS = 600;
 export class ProofVerifier {
     cryptoService;
     clock;
@@ -21,9 +27,28 @@ export class ProofVerifier {
         this.clock = config.clockProvider;
         this.nonceCache = config.nonceCacheProvider;
         this.fetch = config.fetchProvider;
-        this.timestampSkewSeconds = config.timestampSkewSeconds ?? 300; // Default 5 minutes
+        this.timestampSkewSeconds = config.timestampSkewSeconds ?? DEFAULT_CLOCK_SKEW_SECONDS;
         this.nonceTtlSeconds = config.nonceTtlSeconds ?? 300; // Default 5 minutes
     }
+    /**
+     * Update the timestamp skew from a server-advertised value.
+     * Clients SHOULD call this with the server's clockSkewSeconds from /.well-known/mcp.
+     * The value is clamped to [30, 600] seconds.
+     *
+     * @param skewSeconds - Server-advertised clock skew in seconds
+     */
+    setTimestampSkew(skewSeconds) {
+        if (typeof skewSeconds !== 'number' || !Number.isFinite(skewSeconds)) {
+            return;
+        }
+        this.timestampSkewSeconds = Math.max(MIN_CLOCK_SKEW_SECONDS, Math.min(MAX_CLOCK_SKEW_SECONDS, Math.floor(skewSeconds)));
+    }
+    /**
+     * Get the current timestamp skew setting.
+     */
+    getTimestampSkew() {
+        return this.timestampSkewSeconds;
+    }
     /**
      * Verify a DetachedProof
      * Automatically reconstructs canonical payload from proof.meta for signature verification
@@ -280,7 +305,7 @@ export class ProofVerifier {
             aud: meta.audience, // Audience (who the token is for)
             sub: meta.did, // Subject (agent DID)
             iss: meta.did, // Issuer (agent DID - self-issued)
-            // Custom MCP-I proof claims
+            // Custom KYA-OS proof claims
             requestHash: meta.requestHash,
             responseHash: meta.responseHash,
             ts: meta.ts,
@@ -296,4 +321,62 @@ export class ProofVerifier {
         return canonicalize(payload);
     }
 }
+/**
+ * Validate _meta structure according to meta policy.
+ *
+ * In 'strict' mode, _meta must contain only 'proof'.
+ * In 'allow-extensions' mode, additional keys are permitted.
+ *
+ * @param meta - The _meta object from a response
+ * @param policy - Meta policy ('strict' or 'allow-extensions')
+ * @returns Validation result with valid flag and optional reason
+ */
+export function validateMetaStructure(meta, policy = 'strict') {
+    const keys = Object.keys(meta);
+    const extraKeys = keys.filter(k => k !== 'proof');
+    if (policy === 'strict' && extraKeys.length > 0) {
+        return {
+            valid: false,
+            reason: `_meta contains keys other than 'proof' in strict mode: ${extraKeys.join(', ')}`,
+            extraKeys,
+        };
+    }
+    return { valid: true };
+}
+/**
+ * Extract proof from _meta with policy validation.
+ *
+ * @param meta - The _meta object from a response
+ * @param policy - Meta policy ('strict' or 'allow-extensions')
+ * @returns Extracted proof or error result
+ */
+export function extractProofFromMeta(meta, policy = 'strict') {
+    // Check for required proof field first
+    const proof = meta.proof;
+    if (!proof) {
+        return {
+            success: false,
+            reason: '_meta does not contain proof',
+            errorCode: PROOF_VERIFICATION_ERROR_CODES.MISSING_REQUIRED_FIELD,
+        };
+    }
+    // Validate meta structure according to policy
+    const validation = validateMetaStructure(meta, policy);
+    if (!validation.valid) {
+        return {
+            success: false,
+            reason: validation.reason,
+            errorCode: PROOF_VERIFICATION_ERROR_CODES.META_POLICY_VIOLATION,
+        };
+    }
+    const proofValidation = validateDetachedProof(proof);
+    if (!proofValidation.success) {
+        return {
+            success: false,
+            reason: proofValidation.error?.message ?? 'Invalid proof structure',
+            errorCode: PROOF_VERIFICATION_ERROR_CODES.INVALID_PROOF_STRUCTURE,
+        };
+    }
+    return { success: true, proof: proofValidation.data };
+}
 //# sourceMappingURL=verifier.js.map