@kya-os/mcp 1.2.0

package/dist/delegation/vc-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vc-verifier.d.ts","sourceRoot":"","sources":["../../src/delegation/vc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAO9B,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAC;IACrD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE;QACR,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,kBAAkB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC1C,cAAc,CAAC,EAAE,CAAC,MAAM,GAAG,kBAAkB,CAAC,EAAE,CAAC;IACjD,eAAe,CAAC,EAAE,CAAC,MAAM,GAAG,kBAAkB,CAAC,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,6BAA6B;IAC5C,CACE,EAAE,EAAE,oBAAoB,EACxB,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC;QACT,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAED,qBAAa,4BAA4B;IACvC,OAAO,CAAC,WAAW,CAAC,CAAc;IAClC,OAAO,CAAC,kBAAkB,CAAC,CAAqB;IAChD,OAAO,CAAC,iBAAiB,CAAC,CAAgC;IAC1D,OAAO,CAAC,KAAK,CAGT;IACJ,OAAO,CAAC,mBAAmB,CAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAS;IACzB;;;;OAIG;IACH,OAAO,CAAC,YAAY,CAAS;gBAEjB,OAAO,CAAC,EAAE;QACpB,WAAW,CAAC,EAAE,WAAW,CAAC;QAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;QACxC,iBAAiB,CAAC,EAAE,6BAA6B,CAAC;QAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,2CAA2C;QAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB;IAQD;;;;;;;;;;OAUG;IACG,0BAA0B,CAC9B,EAAE,EAAE,oBAAoB,EACxB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,8BAA8B,CAAC;IA6F1C,OAAO,CAAC,uBAAuB;YAuCjB,eAAe;YAkFf,qBAAqB;IAuCnC,OAAO,CAAC,sBAAsB;IAS9B,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,UAAU;IAgBlB,UAAU,IAAI,IAAI;IAKlB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;CAOlC;AAED,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE;IACjD,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,iBAAiB,CAAC,EAAE,6BAA6B,CAAC;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,4BAA4B,CAE/B"}

package/dist/delegation/vc-verifier.js

@@ -0,0 +1,280 @@
+/**
+ * Dylan Hobbs
+ * Delegation Credential Verifier (Platform-Agnostic)
+ *
+ * Progressive enhancement verification for W3C Delegation Credentials.
+ *
+ * Stage 1: Fast basic checks (no network, early rejection)
+ * Stage 2: Parallel advanced checks (signature, status)
+ * Stage 3: Combined results
+ *
+ * Related Spec: MCP-I §4.3, W3C VC Data Model 1.1
+ */
+import { isDelegationCredentialExpired, isDelegationCredentialNotYetValid, validateDelegationCredential, } from "../types/protocol.js";
+export class DelegationCredentialVerifier {
+    didResolver;
+    statusListResolver;
+    signatureVerifier;
+    cache = new Map();
+    cacheInsertionOrder = [];
+    cacheTtl;
+    /**
+     * Maximum number of entries in the verification cache.
+     * In production deployments, configure maxCacheSize based on expected concurrent delegations.
+     * Default of 1000 is suitable for most use cases.
+     */
+    maxCacheSize;
+    constructor(options) {
+        this.didResolver = options?.didResolver;
+        this.statusListResolver = options?.statusListResolver;
+        this.signatureVerifier = options?.signatureVerifier;
+        this.cacheTtl = options?.cacheTtl || 60_000;
+        this.maxCacheSize = options?.maxCacheSize ?? 1000;
+    }
+    /**
+     * Verify a delegation credential through progressive enhancement.
+     *
+     * Stage 1: Fast basic checks (schema, expiry, status field)
+     * Stage 2: Parallel signature and status list checks (if resolvers configured)
+     * Stage 3: Combined result with timing metrics
+     *
+     * @param vc - The W3C Delegation Credential to verify
+     * @param options - Verification options (skip cache/signature/status, custom resolvers)
+     * @returns Verification result with validity, reason, stage reached, and metrics
+     */
+    async verifyDelegationCredential(vc, options = {}) {
+        const startTime = Date.now();
+        if (!options.skipCache) {
+            const cached = this.getFromCache(vc.id || "");
+            if (cached) {
+                return { ...cached, cached: true };
+            }
+        }
+        const basicCheckStart = Date.now();
+        const basicValidation = this.validateBasicProperties(vc);
+        const basicCheckMs = Date.now() - basicCheckStart;
+        if (!basicValidation.valid) {
+            const result = {
+                valid: false,
+                reason: basicValidation.reason,
+                stage: "basic",
+                metrics: {
+                    basicCheckMs,
+                    totalMs: Date.now() - startTime,
+                },
+                checks: {
+                    basicValid: false,
+                },
+            };
+            return result;
+        }
+        const signaturePromise = !options.skipSignature
+            ? this.verifySignature(vc, options.didResolver || this.didResolver)
+            : Promise.resolve({
+                valid: true,
+                durationMs: 0,
+            });
+        const statusPromise = !options.skipStatus && vc.credentialStatus
+            ? this.checkCredentialStatus(vc.credentialStatus, options.statusListResolver || this.statusListResolver)
+            : Promise.resolve({
+                valid: true,
+                durationMs: 0,
+            });
+        const [signatureResult, statusResult] = await Promise.all([
+            signaturePromise,
+            statusPromise,
+        ]);
+        const signatureCheckMs = signatureResult.durationMs || 0;
+        const statusCheckMs = statusResult.durationMs || 0;
+        const allValid = basicValidation.valid && signatureResult.valid && statusResult.valid;
+        const result = {
+            valid: allValid,
+            reason: !allValid
+                ? signatureResult.reason || statusResult.reason || "Unknown failure"
+                : undefined,
+            stage: "complete",
+            metrics: {
+                basicCheckMs,
+                signatureCheckMs,
+                statusCheckMs,
+                totalMs: Date.now() - startTime,
+            },
+            checks: {
+                basicValid: basicValidation.valid,
+                signatureValid: signatureResult.valid,
+                statusValid: statusResult.valid,
+            },
+        };
+        if (result.valid && vc.id) {
+            this.setInCache(vc.id, result);
+        }
+        return result;
+    }
+    validateBasicProperties(vc) {
+        const schemaValidation = validateDelegationCredential(vc);
+        if (!schemaValidation.success) {
+            return {
+                valid: false,
+                reason: `Schema validation failed: ${schemaValidation.error?.message}`,
+            };
+        }
+        if (isDelegationCredentialExpired(vc)) {
+            return { valid: false, reason: "Delegation credential expired" };
+        }
+        if (isDelegationCredentialNotYetValid(vc)) {
+            return { valid: false, reason: "Delegation credential not yet valid" };
+        }
+        const delegation = vc.credentialSubject.delegation;
+        if (delegation.status === "revoked") {
+            return { valid: false, reason: "Delegation status is revoked" };
+        }
+        if (delegation.status === "expired") {
+            return { valid: false, reason: "Delegation status is expired" };
+        }
+        if (!delegation.issuerDid || !delegation.subjectDid) {
+            return { valid: false, reason: "Missing issuer or subject DID" };
+        }
+        if (!vc.proof) {
+            return { valid: false, reason: "Missing proof" };
+        }
+        return { valid: true };
+    }
+    async verifySignature(vc, didResolver) {
+        const startTime = Date.now();
+        try {
+            const issuerDid = typeof vc.issuer === "string" ? vc.issuer : vc.issuer.id;
+            if (!didResolver || !this.signatureVerifier) {
+                return {
+                    valid: false,
+                    reason: "No DID resolver or signature verifier configured — signature cannot be verified",
+                    durationMs: Date.now() - startTime,
+                };
+            }
+            const didDoc = await didResolver.resolve(issuerDid);
+            if (!didDoc) {
+                return {
+                    valid: false,
+                    reason: `Could not resolve issuer DID: ${issuerDid}`,
+                    durationMs: Date.now() - startTime,
+                };
+            }
+            if (!vc.proof) {
+                return {
+                    valid: false,
+                    reason: "Proof is missing",
+                    durationMs: Date.now() - startTime,
+                };
+            }
+            const verificationMethodId = vc.proof["verificationMethod"];
+            if (!verificationMethodId) {
+                return {
+                    valid: false,
+                    reason: "Proof missing verificationMethod",
+                    durationMs: Date.now() - startTime,
+                };
+            }
+            const verificationMethod = this.findVerificationMethod(didDoc, verificationMethodId);
+            if (!verificationMethod) {
+                return {
+                    valid: false,
+                    reason: `Verification method ${verificationMethodId} not found`,
+                    durationMs: Date.now() - startTime,
+                };
+            }
+            const publicKeyJwk = verificationMethod.publicKeyJwk;
+            if (!publicKeyJwk) {
+                return {
+                    valid: false,
+                    reason: "Verification method missing publicKeyJwk",
+                    durationMs: Date.now() - startTime,
+                };
+            }
+            const verificationResult = await this.signatureVerifier(vc, publicKeyJwk);
+            return {
+                valid: verificationResult.valid,
+                reason: verificationResult.reason,
+                durationMs: Date.now() - startTime,
+            };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                reason: `Signature verification error: ${error instanceof Error ? error.message : "Unknown error"}`,
+                durationMs: Date.now() - startTime,
+            };
+        }
+    }
+    async checkCredentialStatus(status, statusListResolver) {
+        const startTime = Date.now();
+        try {
+            if (!statusListResolver) {
+                return {
+                    valid: false,
+                    reason: "Credential has credentialStatus but no status list resolver is configured — cannot verify revocation status",
+                    durationMs: Date.now() - startTime,
+                };
+            }
+            const isRevoked = await statusListResolver.checkStatus(status);
+            if (isRevoked) {
+                return {
+                    valid: false,
+                    reason: `Credential revoked via StatusList2021 (${status.statusPurpose})`,
+                    durationMs: Date.now() - startTime,
+                };
+            }
+            return {
+                valid: true,
+                durationMs: Date.now() - startTime,
+            };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                reason: `Status check error: ${error instanceof Error ? error.message : "Unknown error"}`,
+                durationMs: Date.now() - startTime,
+            };
+        }
+    }
+    findVerificationMethod(didDoc, verificationMethodId) {
+        return didDoc.verificationMethod?.find((vm) => vm.id === verificationMethodId);
+    }
+    getFromCache(id) {
+        const entry = this.cache.get(id);
+        if (!entry)
+            return null;
+        if (Date.now() > entry.expiresAt) {
+            this.cache.delete(id);
+            return null;
+        }
+        return entry.result;
+    }
+    setInCache(id, result) {
+        // Evict oldest entry if cache exceeds maxCacheSize (simple FIFO)
+        while (this.cache.size >= this.maxCacheSize && this.cacheInsertionOrder.length > 0) {
+            const oldestId = this.cacheInsertionOrder.shift();
+            if (oldestId) {
+                this.cache.delete(oldestId);
+            }
+        }
+        this.cache.set(id, {
+            result,
+            expiresAt: Date.now() + this.cacheTtl,
+        });
+        this.cacheInsertionOrder.push(id);
+    }
+    clearCache() {
+        this.cache.clear();
+        this.cacheInsertionOrder = [];
+    }
+    clearCacheEntry(id) {
+        this.cache.delete(id);
+        const idx = this.cacheInsertionOrder.indexOf(id);
+        if (idx !== -1) {
+            this.cacheInsertionOrder.splice(idx, 1);
+        }
+    }
+}
+export function createDelegationVerifier(options) {
+    return new DelegationCredentialVerifier(options);
+}
+//# sourceMappingURL=vc-verifier.js.map

package/dist/delegation/vc-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vc-verifier.js","sourceRoot":"","sources":["../../src/delegation/vc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AA8D9B,MAAM,OAAO,4BAA4B;IAC/B,WAAW,CAAe;IAC1B,kBAAkB,CAAsB;IACxC,iBAAiB,CAAiC;IAClD,KAAK,GAAG,IAAI,GAAG,EAGpB,CAAC;IACI,mBAAmB,GAAa,EAAE,CAAC;IACnC,QAAQ,CAAS;IACzB;;;;OAIG;IACK,YAAY,CAAS;IAE7B,YAAY,OAOX;QACC,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,WAAW,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,OAAO,EAAE,kBAAkB,CAAC;QACtD,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,CAAC;QACpD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,MAAM,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC;IACpD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,0BAA0B,CAC9B,EAAwB,EACxB,UAAqC,EAAE;QAEvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;QAElD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAmC;gBAC7C,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,eAAe,CAAC,MAAM;gBAC9B,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE;oBACP,YAAY;oBACZ,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBAChC;gBACD,MAAM,EAAE;oBACN,UAAU,EAAE,KAAK;iBAClB;aACF,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,aAAa;YAC7C,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC;YACnE,CAAC,CAAC,OAAO,CAAC,OAAO,CAIZ;gBACD,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;QAEP,MAAM,aAAa,GACjB,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,gBAAgB;YACxC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CACxB,EAAE,CAAC,gBAAgB,EACnB,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,kBAAkB,CACtD;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAIZ;gBACD,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;QAET,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxD,gBAAgB;YAChB,aAAa;SACd,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAG,eAAe,CAAC,UAAU,IAAI,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,YAAY,CAAC,UAAU,IAAI,CAAC,CAAC;QAEnD,MAAM,QAAQ,GACZ,eAAe,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC;QAEvE,MAAM,MAAM,GAAmC;YAC7C,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,CAAC,QAAQ;gBACf,CAAC,CAAC,eAAe,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,IAAI,iBAAiB;gBACpE,CAAC,CAAC,SAAS;YACb,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE;gBACP,YAAY;gBACZ,gBAAgB;gBAChB,aAAa;gBACb,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aAChC;YACD,MAAM,EAAE;gBACN,UAAU,EAAE,eAAe,CAAC,KAAK;gBACjC,cAAc,EAAE,eAAe,CAAC,KAAK;gBACrC,WAAW,EAAE,YAAY,CAAC,KAAK;aAChC;SACF,CAAC;QAEF,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,uBAAuB,CAAC,EAAwB;QAItD,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,6BAA6B,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE;aACvE,CAAC;QACJ,CAAC;QAED,IAAI,6BAA6B,CAAC,EAAE,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;QACnE,CAAC;QAED,IAAI,iCAAiC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;QACzE,CAAC;QAED,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC;QACnD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;YACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,EAAwB,EACxB,WAAyB;QAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,SAAS,GACb,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;YAE3D,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC5C,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EACJ,iFAAiF;oBACnF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,iCAAiC,SAAS,EAAE;oBACpD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACd,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,kBAAkB;oBAC1B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAC5D,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC1B,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,kCAAkC;oBAC1C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,sBAAsB,CACpD,MAAM,EACN,oBAA8B,CAC/B,CAAC;YACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,uBAAuB,oBAAoB,YAAY;oBAC/D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAG,kBAAkB,CAAC,YAAY,CAAC;YACrD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,0CAA0C;oBAClD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;YAE1E,OAAO;gBACL,KAAK,EAAE,kBAAkB,CAAC,KAAK;gBAC/B,MAAM,EAAE,kBAAkB,CAAC,MAAM;gBACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;gBACnG,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,MAAwB,EACxB,kBAAuC;QAEvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EACJ,6GAA6G;oBAC/G,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAE/D,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,0CAA0C,MAAM,CAAC,aAAa,GAAG;oBACzE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;gBACzF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,sBAAsB,CAC5B,MAAmB,EACnB,oBAA4B;QAE5B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,CACpC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,oBAAoB,CACvC,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,EAAU;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IAEO,UAAU,CAAC,EAAU,EAAE,MAAsC;QACnE,iEAAiE;QACjE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAClD,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE;YACjB,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,mBAAmB,GAAG,EAAE,CAAC;IAChC,CAAC;IAED,eAAe,CAAC,EAAU;QACxB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjD,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CAAC,OAKxC;IACC,OAAO,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,42 @@
+/**
+ * MCP-I Canonical Error Codes
+ *
+ * Single source of truth for all wire-format error codes.
+ * Aligned with the error catalog at modelcontextprotocol-identity.io.
+ *
+ * Naming convention: snake_case, no protocol prefix.
+ * Follows OAuth 2.0 / Stripe conventions for readability and portability.
+ */
+export declare const MCPI_ERROR_CODES: {
+    readonly invalid_proof: "invalid_proof";
+    readonly invalid_jws: "invalid_jws";
+    readonly nonce_replay: "nonce_replay";
+    readonly timestamp_skew: "timestamp_skew";
+    readonly did_not_found: "did_not_found";
+    readonly invalid_public_key: "invalid_public_key";
+    readonly handshake_failed: "handshake_failed";
+    readonly session_expired: "session_expired";
+    readonly invalid_request: "invalid_request";
+    readonly needs_authorization: "needs_authorization";
+    readonly insufficient_scope: "insufficient_scope";
+    readonly delegation_expired: "delegation_expired";
+    readonly delegation_not_yet_valid: "delegation_not_yet_valid";
+    readonly delegation_revoked: "delegation_revoked";
+    readonly delegation_invalid: "delegation_invalid";
+    readonly budget_exceeded: "budget_exceeded";
+    readonly rate_limit_exceeded: "rate_limit_exceeded";
+    readonly invalid_token: "invalid_token";
+    readonly token_expired: "token_expired";
+    readonly mirror_pending: "mirror_pending";
+    readonly claim_failed: "claim_failed";
+    readonly configuration_error: "configuration_error";
+    readonly runtime_error: "runtime_error";
+};
+export type MCPIErrorCode = (typeof MCPI_ERROR_CODES)[keyof typeof MCPI_ERROR_CODES];
+export interface MCPIErrorResponse {
+    code: MCPIErrorCode;
+    message: string;
+    details?: Record<string, unknown>;
+}
+export declare function createMCPIError(code: MCPIErrorCode, message: string, details?: Record<string, unknown>): MCPIErrorResponse;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;CAqCnB,CAAC;AAEX,MAAM,MAAM,aAAa,GACvB,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAE3D,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,iBAAiB,CAEnB"}

package/dist/errors.js

@@ -0,0 +1,45 @@
+/**
+ * MCP-I Canonical Error Codes
+ *
+ * Single source of truth for all wire-format error codes.
+ * Aligned with the error catalog at modelcontextprotocol-identity.io.
+ *
+ * Naming convention: snake_case, no protocol prefix.
+ * Follows OAuth 2.0 / Stripe conventions for readability and portability.
+ */
+export const MCPI_ERROR_CODES = {
+    // Proof errors
+    invalid_proof: "invalid_proof",
+    invalid_jws: "invalid_jws",
+    nonce_replay: "nonce_replay",
+    timestamp_skew: "timestamp_skew",
+    // Identity / DID errors
+    did_not_found: "did_not_found",
+    invalid_public_key: "invalid_public_key",
+    // Session / Handshake errors
+    handshake_failed: "handshake_failed",
+    session_expired: "session_expired",
+    invalid_request: "invalid_request",
+    // Delegation errors
+    needs_authorization: "needs_authorization",
+    insufficient_scope: "insufficient_scope",
+    delegation_expired: "delegation_expired",
+    delegation_not_yet_valid: "delegation_not_yet_valid",
+    delegation_revoked: "delegation_revoked",
+    delegation_invalid: "delegation_invalid",
+    budget_exceeded: "budget_exceeded",
+    rate_limit_exceeded: "rate_limit_exceeded",
+    // Token errors
+    invalid_token: "invalid_token",
+    token_expired: "token_expired",
+    // Registry errors
+    mirror_pending: "mirror_pending",
+    claim_failed: "claim_failed",
+    // System errors
+    configuration_error: "configuration_error",
+    runtime_error: "runtime_error",
+};
+export function createMCPIError(code, message, details) {
+    return details ? { code, message, details } : { code, message };
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,eAAe;IACf,aAAa,EAAE,eAAe;IAC9B,WAAW,EAAE,aAAa;IAC1B,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;IAEhC,wBAAwB;IACxB,aAAa,EAAE,eAAe;IAC9B,kBAAkB,EAAE,oBAAoB;IAExC,6BAA6B;IAC7B,gBAAgB,EAAE,kBAAkB;IACpC,eAAe,EAAE,iBAAiB;IAClC,eAAe,EAAE,iBAAiB;IAElC,oBAAoB;IACpB,mBAAmB,EAAE,qBAAqB;IAC1C,kBAAkB,EAAE,oBAAoB;IACxC,kBAAkB,EAAE,oBAAoB;IACxC,wBAAwB,EAAE,0BAA0B;IACpD,kBAAkB,EAAE,oBAAoB;IACxC,kBAAkB,EAAE,oBAAoB;IACxC,eAAe,EAAE,iBAAiB;IAClC,mBAAmB,EAAE,qBAAqB;IAE1C,eAAe;IACf,aAAa,EAAE,eAAe;IAC9B,aAAa,EAAE,eAAe;IAE9B,kBAAkB;IAClB,cAAc,EAAE,gBAAgB;IAChC,YAAY,EAAE,cAAc;IAE5B,gBAAgB;IAChB,mBAAmB,EAAE,qBAAqB;IAC1C,aAAa,EAAE,eAAe;CACtB,CAAC;AAWX,MAAM,UAAU,eAAe,CAC7B,IAAmB,EACnB,OAAe,EACf,OAAiC;IAEjC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAClE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,47 @@
+/**
+ * @kya-os/mcp — MCP-I Protocol Reference Implementation
+ *
+ * Delegation, proof, and session for Model Context Protocol Identity.
+ * This package is a DIF TAAWG protocol reference implementation.
+ *
+ * Related Spec: https://modelcontextprotocol-identity.io
+ *
+ * ## Error handling strategy
+ *
+ * - **Validation functions** (`verify*`, `validate*`) return result objects `{ valid, reason }` — never throw
+ * - **Construction/setup functions** throw `Error` on invalid configuration
+ * - **Resolution functions** (`resolve*`, `fetch*`) return `null` on failure — never throw
+ *
+ * This ensures callers can always handle failures without try/catch on validation paths.
+ */
+export { MCPI_ERROR_CODES, createMCPIError, type MCPIErrorCode, type MCPIErrorResponse, } from './errors.js';
+export type { DelegationConstraints, DelegationRecord, DelegationCredential, DelegationStatus, CredentialStatus, StatusList2021Credential, Proof, HandshakeRequest, SessionContext, NonceCache, MCPClientInfo, MCPClientSessionInfo, SessionIdentityState, DetachedProof, ProofMeta, CanonicalHashes, AuditRecord, AuditContext, AuditEventContext, NeedsAuthorizationError, AuthorizationDisplay, CrispBudget, CrispScope, } from './types/protocol.js';
+export { wrapDelegationAsVC, extractDelegationFromVC, isDelegationCredentialExpired, isDelegationCredentialNotYetValid, validateDelegationCredential, validateDetachedProof, createNeedsAuthorizationError, isNeedsAuthorizationError, DELEGATION_CREDENTIAL_CONTEXT, DEFAULT_SESSION_TTL_MINUTES, DEFAULT_TIMESTAMP_SKEW_SECONDS, NONCE_LENGTH_BYTES, } from './types/protocol.js';
+export { DelegationCredentialIssuer, createDelegationIssuer, type IssueDelegationOptions, type VCSigningFunction, type IdentityProvider as DelegationIdentityProvider, } from './delegation/vc-issuer.js';
+export { DelegationCredentialVerifier, createDelegationVerifier, type DelegationVCVerificationResult, type VerifyDelegationVCOptions, type DIDResolver, type DIDDocument, type VerificationMethod, type StatusListResolver, type SignatureVerificationFunction, } from './delegation/vc-verifier.js';
+export { DelegationGraphManager, createDelegationGraph, type DelegationNode, type DelegationGraphStorageProvider, } from './delegation/delegation-graph.js';
+export { StatusList2021Manager, createStatusListManager, type StatusListStorageProvider, type StatusListIdentityProvider, } from './delegation/statuslist-manager.js';
+export { CascadingRevocationManager, createCascadingRevocationManager, type RevocationEvent, type RevocationHook, type CascadingRevocationOptions, } from './delegation/cascading-revocation.js';
+export { BitstringManager, isIndexSet, type CompressionFunction, type DecompressionFunction, } from './delegation/bitstring.js';
+export { verifyDelegationAudience, } from './delegation/audience-validator.js';
+export { buildDelegationProofJWT, buildChainString, type DelegationProofOptions, type Ed25519PrivateJWK, } from './delegation/outbound-proof.js';
+export { buildOutboundDelegationHeaders, OUTBOUND_HEADER_NAMES, type OutboundDelegationContext, type OutboundDelegationHeaders, } from './delegation/outbound-headers.js';
+export { canonicalizeJSON, createUnsignedVCJWT, completeVCJWT, parseVCJWT, type VCJWTHeader, type VCJWTPayload, } from './delegation/utils.js';
+export { MemoryStatusListStorage } from './delegation/storage/memory-statuslist-storage.js';
+export { MemoryDelegationGraphStorage } from './delegation/storage/memory-graph-storage.js';
+export { createDidKeyResolver, resolveDidKeySync, isEd25519DidKey, extractPublicKeyFromDidKey, publicKeyToJwk, } from './delegation/did-key-resolver.js';
+export { DidWebResolver, createDidWebResolver, isDidWeb, parseDidWeb, didWebToUrl, } from './delegation/did-web-resolver.js';
+export { base58Encode, base58Decode, isValidBase58, } from './utils/base58.js';
+export { isValidDid, getDidMethod, normalizeDid, compareDids, getServerDid, extractAgentId, extractAgentSlug, generateDidKeyFromBytes, generateDidKeyFromBase64, didKeyFragment, } from './utils/did-helpers.js';
+export { verifyOrHints, hasSensitiveScopes, MemoryResumeTokenStore, type AuthHandshakeConfig, type VerifyOrHintsResult, type AgentReputation, type ResumeTokenStore, type UnknownAgentPolicy, type DelegationVerifier, type VerifyDelegationResult, } from './auth/index.js';
+export { ProofGenerator, createProofResponse, extractCanonicalData, type ProofAgentIdentity, type ToolRequest, type ToolResponse, type ProofOptions, } from './proof/index.js';
+export { ProofVerifier, type ProofVerifierConfig, type ProofVerificationResult, } from './proof/verifier.js';
+export { ProofVerificationError, PROOF_VERIFICATION_ERROR_CODES, createProofVerificationError, type ProofVerificationErrorCode, } from './proof/errors.js';
+export { SessionManager, createHandshakeRequest, validateHandshakeFormat, type SessionConfig, type HandshakeResult, } from './session/index.js';
+export { CryptoProvider, ClockProvider, FetchProvider, StorageProvider, NonceCacheProvider, IdentityProvider, type AgentIdentity, } from './providers/base.js';
+export { MemoryStorageProvider, MemoryNonceCacheProvider, MemoryIdentityProvider, } from './providers/memory.js';
+export { NodeCryptoProvider } from './providers/node-crypto.js';
+export { createMCPIMiddleware, type MCPIConfig, type MCPIDelegationConfig, type MCPIIdentityConfig, type MCPIMiddleware, type MCPIToolDefinition, type MCPIToolHandler, type MCPIServer, withMCPI, generateIdentity, type WithMCPIOptions, } from './middleware/index.js';
+export { logger, createDefaultConsoleLogger, type Logger, type Level, } from './logging/index.js';
+export { ED25519_PKCS8_DER_HEADER, ED25519_SPKI_DER_HEADER_LENGTH, ED25519_KEY_SIZE, } from './utils/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,EACL,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,SAAS,EACT,eAAe,EACf,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,EACpB,WAAW,EACX,UAAU,GACX,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,IAAI,0BAA0B,GACpD,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,GACnC,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,cAAc,EACnB,KAAK,8BAA8B,GACpC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,GAChC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,EAChC,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,0BAA0B,GAChC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,GAC/B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAE5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAE5F,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,GACZ,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,EAC5B,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,eAAe,GACrB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGhE,OAAO,EACL,oBAAoB,EACpB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,QAAQ,EACR,gBAAgB,EAChB,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,MAAM,EACN,0BAA0B,EAC1B,KAAK,MAAM,EACX,KAAK,KAAK,GACX,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,56 @@
+/**
+ * @kya-os/mcp — MCP-I Protocol Reference Implementation
+ *
+ * Delegation, proof, and session for Model Context Protocol Identity.
+ * This package is a DIF TAAWG protocol reference implementation.
+ *
+ * Related Spec: https://modelcontextprotocol-identity.io
+ *
+ * ## Error handling strategy
+ *
+ * - **Validation functions** (`verify*`, `validate*`) return result objects `{ valid, reason }` — never throw
+ * - **Construction/setup functions** throw `Error` on invalid configuration
+ * - **Resolution functions** (`resolve*`, `fetch*`) return `null` on failure — never throw
+ *
+ * This ensures callers can always handle failures without try/catch on validation paths.
+ */
+// Error contract
+export { MCPI_ERROR_CODES, createMCPIError, } from './errors.js';
+export { wrapDelegationAsVC, extractDelegationFromVC, isDelegationCredentialExpired, isDelegationCredentialNotYetValid, validateDelegationCredential, validateDetachedProof, createNeedsAuthorizationError, isNeedsAuthorizationError, DELEGATION_CREDENTIAL_CONTEXT, DEFAULT_SESSION_TTL_MINUTES, DEFAULT_TIMESTAMP_SKEW_SECONDS, NONCE_LENGTH_BYTES, } from './types/protocol.js';
+// Delegation module
+export { DelegationCredentialIssuer, createDelegationIssuer, } from './delegation/vc-issuer.js';
+export { DelegationCredentialVerifier, createDelegationVerifier, } from './delegation/vc-verifier.js';
+export { DelegationGraphManager, createDelegationGraph, } from './delegation/delegation-graph.js';
+export { StatusList2021Manager, createStatusListManager, } from './delegation/statuslist-manager.js';
+export { CascadingRevocationManager, createCascadingRevocationManager, } from './delegation/cascading-revocation.js';
+export { BitstringManager, isIndexSet, } from './delegation/bitstring.js';
+export { verifyDelegationAudience, } from './delegation/audience-validator.js';
+export { buildDelegationProofJWT, buildChainString, } from './delegation/outbound-proof.js';
+export { buildOutboundDelegationHeaders, OUTBOUND_HEADER_NAMES, } from './delegation/outbound-headers.js';
+export { canonicalizeJSON, createUnsignedVCJWT, completeVCJWT, parseVCJWT, } from './delegation/utils.js';
+export { MemoryStatusListStorage } from './delegation/storage/memory-statuslist-storage.js';
+export { MemoryDelegationGraphStorage } from './delegation/storage/memory-graph-storage.js';
+export { createDidKeyResolver, resolveDidKeySync, isEd25519DidKey, extractPublicKeyFromDidKey, publicKeyToJwk, } from './delegation/did-key-resolver.js';
+export { DidWebResolver, createDidWebResolver, isDidWeb, parseDidWeb, didWebToUrl, } from './delegation/did-web-resolver.js';
+// Utils
+export { base58Encode, base58Decode, isValidBase58, } from './utils/base58.js';
+export { isValidDid, getDidMethod, normalizeDid, compareDids, getServerDid, extractAgentId, extractAgentSlug, generateDidKeyFromBytes, generateDidKeyFromBase64, didKeyFragment, } from './utils/did-helpers.js';
+// Auth module
+export { verifyOrHints, hasSensitiveScopes, MemoryResumeTokenStore, } from './auth/index.js';
+// Proof module
+export { ProofGenerator, createProofResponse, extractCanonicalData, } from './proof/index.js';
+export { ProofVerifier, } from './proof/verifier.js';
+export { ProofVerificationError, PROOF_VERIFICATION_ERROR_CODES, createProofVerificationError, } from './proof/errors.js';
+// Session module
+export { SessionManager, createHandshakeRequest, validateHandshakeFormat, } from './session/index.js';
+// Providers
+export { CryptoProvider, ClockProvider, FetchProvider, StorageProvider, NonceCacheProvider, IdentityProvider, } from './providers/base.js';
+export { MemoryStorageProvider, MemoryNonceCacheProvider, MemoryIdentityProvider, } from './providers/memory.js';
+export { NodeCryptoProvider } from './providers/node-crypto.js';
+// Middleware
+export { createMCPIMiddleware, withMCPI, generateIdentity, } from './middleware/index.js';
+// Logging
+export { logger, createDefaultConsoleLogger, } from './logging/index.js';
+// Ed25519 Constants
+export { ED25519_PKCS8_DER_HEADER, ED25519_SPKI_DER_HEADER_LENGTH, ED25519_KEY_SIZE, } from './utils/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,iBAAiB;AACjB,OAAO,EACL,gBAAgB,EAChB,eAAe,GAGhB,MAAM,aAAa,CAAC;AA6BrB,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAE7B,oBAAoB;AACpB,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GAIvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,GAQzB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GAGtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAGxB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GAIjC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,gBAAgB,EAChB,UAAU,GAGX,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GAGjB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,GAGtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,UAAU,GAGX,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAE5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAE5F,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,GACZ,MAAM,kCAAkC,CAAC;AAE1C,QAAQ;AACR,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAEhC,cAAc;AACd,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,GAQvB,MAAM,iBAAiB,CAAC;AAEzB,eAAe;AACf,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,GAKrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,GAGd,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,mBAAmB,CAAC;AAE3B,iBAAiB;AACjB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,GAGxB,MAAM,oBAAoB,CAAC;AAE5B,YAAY;AACZ,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,aAAa;AACb,OAAO,EACL,oBAAoB,EAQpB,QAAQ,EACR,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAE/B,UAAU;AACV,OAAO,EACL,MAAM,EACN,0BAA0B,GAG3B,MAAM,oBAAoB,CAAC;AAE5B,oBAAoB;AACpB,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}

package/dist/logging/index.d.ts

@@ -0,0 +1,2 @@
+export { logger, createDefaultConsoleLogger, type Logger, type Level, } from './logger.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/logging/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/logging/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,0BAA0B,EAC1B,KAAK,MAAM,EACX,KAAK,KAAK,GACX,MAAM,aAAa,CAAC"}

package/dist/logging/index.js

@@ -0,0 +1,2 @@
+export { logger, createDefaultConsoleLogger, } from './logger.js';
+//# sourceMappingURL=index.js.map

package/dist/logging/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/logging/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,0BAA0B,GAG3B,MAAM,aAAa,CAAC"}

package/dist/logging/logger.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Transport-aware Logger for MCP-I
+ *
+ * Provides a lightweight, dependency-free logging interface that:
+ * - Maps log levels correctly for Cloudflare Workers
+ * - Routes all logs to stderr for stdio transport (so stdout remains protocol-only)
+ * - Supports runtime configuration of log level and transport mode
+ */
+export type Level = 'debug' | 'info' | 'warn' | 'error';
+export interface Logger {
+    configure: (opts?: {
+        level?: Level;
+        transport?: string;
+        forceStderr?: boolean;
+    }) => void;
+    debug: (...args: unknown[]) => void;
+    info: (...args: unknown[]) => void;
+    warn: (...args: unknown[]) => void;
+    error: (...args: unknown[]) => void;
+}
+export declare function createDefaultConsoleLogger(): Logger;
+export declare const logger: Logger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/logging/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/logging/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AASxD,MAAM,WAAW,MAAM;IACrB,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,KAAK,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;IACzF,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACpC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACnC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACnC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACrC;AAED,wBAAgB,0BAA0B,IAAI,MAAM,CA8DnD;AAED,eAAO,MAAM,MAAM,QAA+B,CAAC"}