@kya-os/mcp 1.3.1 → 1.4.0

package/CHANGELOG.md

@@ -5,7 +5,234 @@ All notable changes to @kya-os/mcp will be documented here.
 Format: https://keepachangelog.com/en/1.0.0/
 Versioning: https://semver.org/spec/v2.0.0.html
 
-## [Unreleased]
+## [1.4.0] - 2026-05-31
+
+Ports the KYA-OS authorization primitives developed upstream (xmcp-i) into
+`@kya-os/mcp`: a per-action policy / step-up gate, scope-matcher enforcement,
+signed `needs_authorization` challenges with verifier content binding, and
+shipped runtime providers. Additive over 1.3.x except where noted under
+**Changed** and **Removed**.
+
+### Added
+
+- **Signed `needs_authorization` challenge.** The delegation challenge returned
+  when a protected tool is invoked without a credential now carries a signed
+  detached-JWS proof in `_meta` (`outcome: 'needs_authorization'`). The proof
+  binds a `responseHash` over the challenge content — including the
+  `authorizationUrl`. A verifier that recomputes the response hash over the
+  content it received — via the new `ProofVerifier` content binding (below) —
+  detects a tampered / MITM-swapped consent URL; the signature alone proves
+  authenticity, not content-match. The challenge content/shape is unchanged; attachment
+  is best-effort (no-ops when no session can be resolved). The proof `outcome`
+  enum widened to include `'needs_authorization'` across `ProofMeta`,
+  `ProofOptions`, `validateDetachedProof`, and the `detached-proof` JSON Schema.
+  Success proofs are byte-identical (unaffected).
+- **`wrapWithDelegation` `formatChallenge` hook.** An optional config callback
+  that renders the `needs_authorization` challenge content (e.g. a clickable
+  markdown consent link for LLM / chat-style MCP clients) **before** the proof is
+  signed — so the challenge `responseHash` binds exactly what the client
+  receives, keeping the `authorizationUrl` tamper-evident regardless of
+  presentation. Defaults to the structured JSON challenge. The consent-basic /
+  consent-full examples now render their consent link via this hook instead of
+  rewriting the response after signing (which had left the proof bound to stale
+  content).
+- **`ProofVerifier` content binding.** `verifyProof(proof, jwk, { request, response })`
+  recomputes `requestHash`/`responseHash` over the request/response the verifier
+  actually received — via a shared `computeCanonicalHashes` (single source of
+  truth with the signer, so they can't drift) — and fails `CONTENT_BINDING_MISMATCH`
+  on divergence. This is what realizes substitution detection (the signed
+  challenge's anti-MITM, and content-binding for any proof); the signature alone
+  proves only authenticity. New `CONTENT_BINDING_MISMATCH` proof-verification
+  error code.
+- **Concrete `SystemClockProvider` + `RuntimeFetchProvider`.** The package now
+  ships a wall-clock `ClockProvider` and a network-capable `FetchProvider`
+  (did:key resolved locally, did:web over HTTPS, StatusList2021 fetch) so a
+  consumer no longer hand-rolls them to drive `ProofVerifier`. `RuntimeFetchProvider`
+  is the default the middleware uses and replaces the prior internal stub (whose
+  `resolveDID` returned `null`); it refuses private-network targets by default
+  (see **Security**). The verify-proof / anti-MITM examples now consume both.
+- **Per-action policy / step-up gate (`withPolicyGate`).** A new opt-in
+  middleware wrapper that classifies an action's risk (reversibility, blast
+  radius, severity) and consults a pluggable Policy-as-Code `PolicyEngine`:
+  `allow` runs the handler, `deny` returns a `policy_denied` error, and
+  `step_up` returns a `needs_approval` error until N-of-M signed `ApprovalGrant`s
+  — each bound to the request hash (TOCTOU-safe) — are supplied. Ships a
+  fail-closed `DefaultPolicyEngine` and a built-in `RiskClassifier`; OPA/Rego and
+  Cedar adapters are intended follow-ups. Composes after `wrapWithDelegation`;
+  no behavior change unless adopted.
+- **`PolicyEngine` PaC port + `policy/` subsystem** (`PolicyRequest`,
+  `PolicyDecision`, `RiskClassifier`, `DefaultPolicyEngine`, `ApprovalGrant`,
+  `verifyApprovalQuorum`), exported from the package root.
+- **`needs_approval` error** (`NeedsApprovalError`, `createNeedsApprovalError`,
+  `isNeedsApprovalError`) and the `policy_denied` error code.
+- **`bytesToBase64` / `base64ToBytes`** are now re-exported from the package root
+  (standard-base64 byte helpers, alongside the existing base64url variants).
+- **`AuditLogProvider` — pluggable sink for audit-record retention.** A new
+  provider (abstract base + `MemoryAuditLogProvider` / `NoopAuditLogProvider`
+  defaults, exported from the root and `./providers`) for persisting the frozen
+  `audit.v1` record of each verified tool call. Wire it via `KyaOsConfig.auditLog`
+  (default: no-op); `createKyaOsMiddleware` emits a record after each proofed
+  call, and a sink failure never breaks the tool response. `buildAuditRecord(ctx)`
+  exposes the context→record mapping. Records carry only DID/key id, session,
+  audience, scope, request/response hashes, and the verification result — never
+  key material or nonces. The storage backend is operator-provided (durable,
+  append-only); the package stays storage-agnostic, like the other providers.
+- **Delegation scope on audit records.** Delegation-protected tools record the
+  scope they were authorized under: `wrapWithDelegation` threads its `scopeId`
+  through a new optional `KyaOsCallContext` (3rd handler argument) into the proof
+  meta, so the audit record's `scope` reflects it (was `'-'`). The argument is
+  optional and backward-compatible; tool handlers that ignore it are unaffected.
+
+### Changed
+
+- **`ProofMeta.responseHash` is now optional** (`string | undefined`). Denial /
+  step-up proofs carry no response, so code reading `responseHash` must treat it
+  as possibly-absent. `validateDetachedProof` and the `detached-proof` JSON
+  Schema no longer require it (and now permit `outcome`/`reason`).
+- **`CrispScope` `prefix`/`regex` matchers are now enforced** (previously inert —
+  only exact membership in the flat `scopes[]` was checked). A credential
+  declaring a non-exact matcher now grants its pattern set, with ReDoS-safe regex
+  evaluation; flat `scopes[]` remain exact-match (unchanged). **Behavioral
+  change** for any credential that declared a `prefix`/`regex` matcher: it now
+  grants where it previously granted nothing, and a one-time warning is logged on
+  first non-exact use. Re-delegations may not introduce crisp matchers absent
+  from the parent.
+- **`withPolicyGate`'s `scopeMatched` defaults to `false`** (fail-closed): compose
+  it after `wrapWithDelegation` and pass `scopeMatched: true`, or it denies.
+  `withPolicyGate` is an optional member of the `KyaOsMiddleware` interface
+  (additive; structural implementers/mocks are not broken). New in this release,
+  so no prior consumer is affected.
+- **Bundled examples now consume the built `@kya-os/mcp` package** rather than
+  reaching into `src/` via relative paths. Nested example packages (consent-basic,
+  consent-full, context7, brave-search) link the local build via `file:../..`;
+  root-tree examples (node-server, verify-proof, outbound-delegation, statuslist)
+  resolve it by package self-reference. Fixes the context7 example, which had
+  pinned a stale published `@kya-os/mcp@^1.3.0` (pre-`withKyaOs` rename).
+
+### Spec
+
+- **§4.2 — normative MUST on key generation.** An agent's key pair MUST be
+  generated by the agent or its designated custodian; the secret key MUST NOT be
+  generated by, transmitted to, or escrowed with any registration, DID,
+  directory, or reputation service (which receive only the public key). Carves
+  out agent-side proxy/HSM custody (§11.0). Closes the key-escrow / IBE-style
+  concern where a directory service implicitly holds agents' secret keys.
+- **§6.6 — revocation needs no global list.** Clarified that a verifier checks
+  revocation only for the resources it gates and MAY hold revocation state
+  locally; `StatusList2021` is the interoperable publish format, not a required
+  public certificate-revocation list.
+- **§11.0 — "L2+ is not OAuth-style client registration."** Direct (Level 2+)
+  verification still gates on the presented delegation chain, not the agent's
+  identity alone — inverting the OAuth Dynamic Client Registration pattern.
+- **§12.5 — per-delegation keys (delegate unlinkability).** Non-normative
+  pattern: delegate to a fresh one-off public key per delegation to prevent
+  cross-delegation correlation through a shared subject DID.
+- **§2 — reputation scope.** The Responsible Party definition now states that
+  reputation and accountability signals are scoped primarily to the Responsible
+  Party, not an agent's ephemeral identity.
+- **Terminology.** Standardized on _secret key_ (synonymous with _private key_,
+  retained in PKCS#8 / JWK references); fixed the one residual _private key_
+  usage in §7.
+
+### Security
+
+- **Malformed delegation input no longer crashes.** A malformed `_kyaos_delegation`
+  (non-object, missing `credentialSubject.delegation`, or even a throwing
+  getter/Proxy accessor) previously surfaced as a JSON-RPC internal error (`-32603`);
+  it now returns a clean, signed `delegation_invalid` denial. `validateDelegationChain`
+  shape-checks the leaf and returns `{ valid, reason }` (honouring the
+  `verify*`/`validate*` never-throw contract); `extractDelegationFromVC` fails
+  with a clear error instead of a cryptic `TypeError`; the middleware try/catch is
+  now a pure backstop that logs the detail server-side and returns a generic
+  reason (no internal/stack detail leaks to the client). The invalid-VC-JWT path
+  is now signed as well.
+- **Log-injection / reflection hardening.** Caller-derived values (credential
+  ids, scopes) interpolated into delegation-failure reasons and logs are now
+  stripped of control characters and length-capped before emission, so a hostile
+  credential cannot forge log lines, corrupt a terminal, or reflect raw control
+  bytes into a client response.
+- **`RuntimeFetchProvider` refuses private-network targets by default (SSRF).**
+  did:web resolution and StatusList2021 fetches reject loopback / link-local /
+  RFC-1918 IP-literal hosts (e.g. `did:web:169.254.169.254`, the cloud-metadata
+  endpoint) unless constructed with `{ allowPrivateNetworkHosts: true }`. This
+  is best-effort defense-in-depth for IP literals — not DNS rebinding; run
+  verifiers behind an egress allowlist (`SECURITY.md`).
+- **Signed proofs are now emitted on denial and step-up.** Delegation/scope
+  denials and policy step-ups previously produced no proof; they now attach a
+  signed detached-JWS proof (`outcome: 'denied' | 'step_up_required'`, no
+  `responseHash`), so rejected privileged attempts are non-repudiably auditable.
+- **Fail-closed policy default.** Unclassified ("unknown") high-risk actions are
+  denied by the `DefaultPolicyEngine` rather than forwarded.
+- **Denial/step-up proofs are verifiable end-to-end.** `validateDetachedProof`
+  and `ProofVerifier` accept response-less proofs (the earlier fix only corrected
+  canonical-payload reconstruction); added a real-crypto end-to-end test.
+- **Crisp-scope attenuation.** Re-delegations cannot widen authority via crisp
+  matchers absent from the parent — closes a privilege-escalation path that
+  enforcing the matcher would otherwise have opened.
+- **ReDoS hardening.** The `regex` matcher rejects nested-quantifier patterns and
+  bounds input length. This is a conservative guard, **not** a guarantee — prefer
+  `exact`/`prefix` for untrusted issuers, or evaluate via a linear-time engine.
+  The `prefix` matcher refuses an empty/`*`-only base (no universal grant).
+
+### Removed
+
+- **BREAKING: removed the three unsafe delegation opt-outs.** The
+  secure-by-default behavior they bypassed is now unconditional and cannot be
+  disabled:
+  - `delegation.requireAudienceOnRedelegation` — audience binding on every
+    non-root credential in a chain is now mandatory (`SPEC.md` §11.6).
+  - `delegation.allowLegacyUnsafeDelegation` — full delegation-chain resolution
+    and `credentialStatus` / StatusList revocation checks are always enforced;
+    parent-linked credentials without a `resolveDelegationChain` handler, and
+    `credentialStatus` without a `statusListResolver`, are rejected.
+  - `VerifyDelegationVCOptions.allowNonDelegationSubjectFields` — the
+    `credentialSubject` shape check (only `id` + `delegation`) is always
+    enforced (`SPEC.md` §6.2; conformance L3.5a).
+
+  The associated one-time `console.warn` notices are removed along with the
+  flags. Migration guidance: `SECURITY.md` → Mandatory Delegation Protections.
+  Consumers that did not set these flags are unaffected — the reference issuer
+  and all bundled examples already emit conformant credentials.
+
+### Known limitations (policy gate — experimental, non-normative)
+
+- Step-up approval grants are **not yet single-use or expiry-bound** (replayable
+  for the same action); a server-issued single-use challenge is a planned follow-up.
+- The default approval-signature verifier **rejects all** — integrators must supply
+  a real verifier; `isValidApprovalSignature: async () => true` is test-only.
+- `policy_denied` / `needs_approval`, the step-up flow, and the now-normative
+  `CrispScope` matcher semantics are **not yet documented in `SPEC.md` /
+  `CONFORMANCE.md`** (tracked as follow-ups).
+
+## [1.3.2] - 2026-05-26
+
+### Security
+
+- **Verifier rejects claim-contaminated delegation credentials.** A
+  `DelegationCredential` whose `credentialSubject` carries properties beyond
+  `id` and `delegation` is now rejected by default — claim-bearing fields in a
+  permission credential separate designation from authorization (the
+  confused-deputy class, `SPEC.md` §6.2 / §11.6). The reference verifier exposes
+  `allowNonDelegationSubjectFields` (default `false`) as an audited opt-out that
+  logs a one-time per-process warning. Spec-conformant issuers are unaffected;
+  the reference issuer already emits `{ id, delegation }` subjects. New
+  conformance requirement L3.5a. (#67)
+
+### Changed
+
+- **Schema `$id` and JSON-LD `@context` hosts migrated** off the
+  `modelcontextprotocol-identity.io` trademark domain to the foundation-owned
+  `schema.kya-os.ai`. All five shipped JSON Schemas (`schemas/*.json`), the
+  spec's context references, and the `DELEGATION_CREDENTIAL_CONTEXT` constant
+  now resolve under `schema.kya-os.ai`; schemas are served identically at both
+  hosts during the migration window (no `$id` is 301-redirected). (#65)
+
+## [1.3.1] - 2026-05-26
+
+> These entries accreted across the 1.2.0 → 1.3.1 donation cutover and were
+> published without strict per-version sectioning. They are grouped here for
+> completeness; see `npm view @kya-os/mcp time` and git history for exact ship
+> points. A clean per-version backfill is tracked separately.
 
 ### Added
 

package/README.md

@@ -1,8 +1,8 @@
 <p align="center">
   <a href="https://kya-os.ai">
     <picture>
-      <source media="(prefers-color-scheme: dark)" srcset="https://modelcontextprotocol-identity.io/images/logo-mark_white.svg">
-      <img alt="" src="https://modelcontextprotocol-identity.io/images/logo-mark_black.svg" width="64">
+      <source media="(prefers-color-scheme: dark)" srcset="https://kya-os.ai/mcp/images/logo-mark_white.svg">
+      <img alt="" src="https://kya-os.ai/mcp/images/logo-mark_black.svg" width="64">
     </picture>
   </a>
 </p>
@@ -13,7 +13,7 @@
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@kya-os/mcp"><img src="https://img.shields.io/npm/v/@kya-os/mcp" alt="npm"></a>
-  <a href="https://modelcontextprotocol-identity.io"><img src="https://img.shields.io/badge/spec-KYA--OS-blue" alt="spec"></a>
+  <a href="https://kya-os.ai/mcp"><img src="https://img.shields.io/badge/spec-KYA--OS-blue" alt="spec"></a>
   <a href="https://identity.foundation/working-groups/agent-and-authorization.html"><img src="https://img.shields.io/badge/DIF-TAAWG-purple" alt="DIF TAAWG"></a>
   <a href="./LICENSE"><img src="https://img.shields.io/github/license/decentralized-identity/kya-os-mcp" alt="license"></a>
 </p>

package/dist/delegation/index.d.ts

@@ -14,8 +14,9 @@ export * from './utils.js';
 export * from './outbound-proof.js';
 export * from './outbound-headers.js';
 export * from './audience-validator.js';
+export * from './scope-matcher.js';
 export { createDidKeyResolver, resolveDidKeySync, isEd25519DidKey, extractPublicKeyFromDidKey, publicKeyToJwk, } from './did-key-resolver.js';
-export { DidWebResolver, createDidWebResolver, isDidWeb, parseDidWeb, didWebToUrl, } from './did-web-resolver.js';
+export { DidWebResolver, createDidWebResolver, isDidWeb, parseDidWeb, didWebToUrl, buildDidWebDocument, } from './did-web-resolver.js';
 export { MemoryStatusListStorage } from './storage/memory-statuslist-storage.js';
 export { MemoryDelegationGraphStorage } from './storage/memory-graph-storage.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/delegation/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC"}

package/dist/delegation/index.js

@@ -14,8 +14,9 @@ export * from './utils.js';
 export * from './outbound-proof.js';
 export * from './outbound-headers.js';
 export * from './audience-validator.js';
+export * from './scope-matcher.js';
 export { createDidKeyResolver, resolveDidKeySync, isEd25519DidKey, extractPublicKeyFromDidKey, publicKeyToJwk, } from './did-key-resolver.js';
-export { DidWebResolver, createDidWebResolver, isDidWeb, parseDidWeb, didWebToUrl, } from './did-web-resolver.js';
+export { DidWebResolver, createDidWebResolver, isDidWeb, parseDidWeb, didWebToUrl, buildDidWebDocument, } from './did-web-resolver.js';
 export { MemoryStatusListStorage } from './storage/memory-statuslist-storage.js';
 export { MemoryDelegationGraphStorage } from './storage/memory-graph-storage.js';
 //# sourceMappingURL=index.js.map

package/dist/delegation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC"}

package/dist/delegation/scope-matcher.d.ts

@@ -0,0 +1,35 @@
+import type { DelegationCredential } from '../types/protocol.js';
+export type ScopeMatcher = 'exact' | 'prefix' | 'regex';
+/**
+ * Match a single requested scope/resource value against a pattern by matcher kind.
+ *
+ * - `exact`  : strict string equality.
+ * - `prefix` : value starts with the pattern (a single trailing `*` is optional sugar).
+ *              An empty base ('' or lone '*') matches nothing — it will NOT grant
+ *              universal scope.
+ * - `regex`  : anchored full-string match; never throws (invalid patterns → false).
+ *
+ * SECURITY: the regex pattern is supplied by the credential ISSUER. JS `RegExp`
+ * is not linear-time, so this guards against the common catastrophic-backtracking
+ * shapes (nested quantifiers) and bounds input length — but it is a conservative
+ * mitigation, not a guarantee. Deployments accepting `regex` matchers from
+ * untrusted issuers should prefer `exact`/`prefix` or evaluate via a linear-time
+ * engine (e.g. RE2).
+ */
+export declare function matchScope(pattern: string, matcher: ScopeMatcher, value: string): boolean;
+export interface ScopeSatisfaction {
+    satisfied: boolean;
+    /**
+     * True when satisfaction came via a non-exact (prefix|regex) CrispScope matcher.
+     * Callers should surface a warning — non-exact matchers widen effective authority.
+     */
+    usedNonExactMatcher: boolean;
+}
+/**
+ * Decide whether a required scope id is satisfied by a credential.
+ *
+ * Flat `scopes[]` are matched EXACTLY (backwards-compatible). The opt-in
+ * `constraints.crisp.scopes[]` entries are honored per their declared matcher.
+ */
+export declare function scopeSatisfies(requiredScopeId: string, credential: DelegationCredential): ScopeSatisfaction;
+//# sourceMappingURL=scope-matcher.d.ts.map

package/dist/delegation/scope-matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-matcher.d.ts","sourceRoot":"","sources":["../../src/delegation/scope-matcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAc,MAAM,sBAAsB,CAAC;AAY7E,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAExD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAsBzF;AAkBD,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,oBAAoB,GAC/B,iBAAiB,CAUnB"}

package/dist/delegation/scope-matcher.js

@@ -0,0 +1,83 @@
+const MAX_REGEX_LEN = 256;
+const MAX_VALUE_LEN = 256;
+/**
+ * Conservative detector for the classic catastrophic-backtracking shape — a
+ * quantified group whose body also contains a quantifier, e.g. `(a+)+`, `(a*)*`,
+ * `(.{1,9})+`. This is a heuristic reject, NOT a proof of safety.
+ */
+const NESTED_QUANTIFIER = /\([^()]*[+*?{][^()]*\)\s*[+*{]/;
+/**
+ * Match a single requested scope/resource value against a pattern by matcher kind.
+ *
+ * - `exact`  : strict string equality.
+ * - `prefix` : value starts with the pattern (a single trailing `*` is optional sugar).
+ *              An empty base ('' or lone '*') matches nothing — it will NOT grant
+ *              universal scope.
+ * - `regex`  : anchored full-string match; never throws (invalid patterns → false).
+ *
+ * SECURITY: the regex pattern is supplied by the credential ISSUER. JS `RegExp`
+ * is not linear-time, so this guards against the common catastrophic-backtracking
+ * shapes (nested quantifiers) and bounds input length — but it is a conservative
+ * mitigation, not a guarantee. Deployments accepting `regex` matchers from
+ * untrusted issuers should prefer `exact`/`prefix` or evaluate via a linear-time
+ * engine (e.g. RE2).
+ */
+export function matchScope(pattern, matcher, value) {
+    switch (matcher) {
+        case 'exact':
+            return pattern === value;
+        case 'prefix': {
+            const base = pattern.endsWith('*') ? pattern.slice(0, -1) : pattern;
+            // Refuse to grant universal scope via an empty/`*`-only prefix.
+            if (base.length === 0)
+                return false;
+            return value.startsWith(base);
+        }
+        case 'regex': {
+            if (pattern.length > MAX_REGEX_LEN || value.length > MAX_VALUE_LEN)
+                return false;
+            if (NESTED_QUANTIFIER.test(pattern))
+                return false;
+            try {
+                return new RegExp(`^(?:${pattern})$`).test(value);
+            }
+            catch {
+                return false;
+            }
+        }
+        default:
+            return false;
+    }
+}
+/**
+ * Flat exact-match scope set: delegation.scopes ∪ constraints.scopes.
+ * Null-safe by design: scopeSatisfies is a public, never-throw predicate, so a
+ * structurally malformed credential (missing constraints) yields an empty set
+ * rather than a TypeError.
+ */
+function flatScopes(credential) {
+    const d = credential?.credentialSubject?.delegation;
+    return [...(d?.scopes ?? []), ...(d?.constraints?.scopes ?? [])];
+}
+/** Opt-in CrispScope[] entries (constraints.crisp.scopes), if any. Null-safe. */
+function crispScopes(credential) {
+    return credential?.credentialSubject?.delegation?.constraints?.crisp?.scopes ?? [];
+}
+/**
+ * Decide whether a required scope id is satisfied by a credential.
+ *
+ * Flat `scopes[]` are matched EXACTLY (backwards-compatible). The opt-in
+ * `constraints.crisp.scopes[]` entries are honored per their declared matcher.
+ */
+export function scopeSatisfies(requiredScopeId, credential) {
+    if (flatScopes(credential).includes(requiredScopeId)) {
+        return { satisfied: true, usedNonExactMatcher: false };
+    }
+    for (const cs of crispScopes(credential)) {
+        if (matchScope(cs.resource, cs.matcher, requiredScopeId)) {
+            return { satisfied: true, usedNonExactMatcher: cs.matcher !== 'exact' };
+        }
+    }
+    return { satisfied: false, usedNonExactMatcher: false };
+}
+//# sourceMappingURL=scope-matcher.js.map

package/dist/delegation/scope-matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-matcher.js","sourceRoot":"","sources":["../../src/delegation/scope-matcher.ts"],"names":[],"mappings":"AAEA,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAI3D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,OAAqB,EAAE,KAAa;IAC9E,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,OAAO,OAAO,KAAK,KAAK,CAAC;QAC3B,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACpE,gEAAgE;YAChE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACpC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa;gBAAE,OAAO,KAAK,CAAC;YACjF,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAC;YAClD,IAAI,CAAC;gBACH,OAAO,IAAI,MAAM,CAAC,OAAO,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,UAAgC;IAClD,MAAM,CAAC,GAAG,UAAU,EAAE,iBAAiB,EAAE,UAAU,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,iFAAiF;AACjF,SAAS,WAAW,CAAC,UAAgC;IACnD,OAAO,UAAU,EAAE,iBAAiB,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC;AACrF,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,eAAuB,EACvB,UAAgC;IAEhC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC"}

package/dist/delegation/vc-verifier.d.ts

@@ -96,6 +96,13 @@ export declare class DelegationCredentialVerifier {
      */
     verifyDelegationCredential(vc: DelegationCredential, options?: VerifyDelegationVCOptions): Promise<DelegationVCVerificationResult>;
     private validateBasicProperties;
+    /**
+     * Reject a delegation credential whose `credentialSubject` carries properties
+     * other than `id` and `delegation`. Claim-bearing fields in a permission
+     * credential separate designation from authorization — the confused-deputy
+     * class (KYA-OS §11.6). Unconditional as of 1.4.0.
+     */
+    private validateSubjectShape;
     private verifySignature;
     private checkCredentialStatus;
     private findVerificationMethod;

package/dist/delegation/vc-verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vc-verifier.d.ts","sourceRoot":"","sources":["../../src/delegation/vc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAO9B,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAC;IACrD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE;QACR,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,kBAAkB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC1C,cAAc,CAAC,EAAE,CAAC,MAAM,GAAG,kBAAkB,CAAC,EAAE,CAAC;IACjD,eAAe,CAAC,EAAE,CAAC,MAAM,GAAG,kBAAkB,CAAC,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,6BAA6B;IAC5C,CACE,EAAE,EAAE,oBAAoB,EACxB,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC;QACT,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAED,qBAAa,4BAA4B;IACvC,OAAO,CAAC,WAAW,CAAC,CAAc;IAClC,OAAO,CAAC,kBAAkB,CAAC,CAAqB;IAChD,OAAO,CAAC,iBAAiB,CAAC,CAAgC;IAC1D,OAAO,CAAC,KAAK,CAGT;IACJ,OAAO,CAAC,mBAAmB,CAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAS;IACzB;;;;OAIG;IACH,OAAO,CAAC,YAAY,CAAS;gBAEjB,OAAO,CAAC,EAAE;QACpB,WAAW,CAAC,EAAE,WAAW,CAAC;QAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;QACxC,iBAAiB,CAAC,EAAE,6BAA6B,CAAC;QAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,2CAA2C;QAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB;IAQD;;;;;;;;;;OAUG;IACG,0BAA0B,CAC9B,EAAE,EAAE,oBAAoB,EACxB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,8BAA8B,CAAC;IA6F1C,OAAO,CAAC,uBAAuB;YAuCjB,eAAe;YAkFf,qBAAqB;IAuCnC,OAAO,CAAC,sBAAsB;IAS9B,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,UAAU;IAgBlB,UAAU,IAAI,IAAI;IAKlB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;CAOlC;AAED,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE;IACjD,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,iBAAiB,CAAC,EAAE,6BAA6B,CAAC;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,4BAA4B,CAE/B"}
+{"version":3,"file":"vc-verifier.d.ts","sourceRoot":"","sources":["../../src/delegation/vc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAc9B,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAC;IACrD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE;QACR,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,kBAAkB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC1C,cAAc,CAAC,EAAE,CAAC,MAAM,GAAG,kBAAkB,CAAC,EAAE,CAAC;IACjD,eAAe,CAAC,EAAE,CAAC,MAAM,GAAG,kBAAkB,CAAC,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,6BAA6B;IAC5C,CACE,EAAE,EAAE,oBAAoB,EACxB,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC;QACT,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAED,qBAAa,4BAA4B;IACvC,OAAO,CAAC,WAAW,CAAC,CAAc;IAClC,OAAO,CAAC,kBAAkB,CAAC,CAAqB;IAChD,OAAO,CAAC,iBAAiB,CAAC,CAAgC;IAC1D,OAAO,CAAC,KAAK,CAGT;IACJ,OAAO,CAAC,mBAAmB,CAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAS;IACzB;;;;OAIG;IACH,OAAO,CAAC,YAAY,CAAS;gBAEjB,OAAO,CAAC,EAAE;QACpB,WAAW,CAAC,EAAE,WAAW,CAAC;QAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;QACxC,iBAAiB,CAAC,EAAE,6BAA6B,CAAC;QAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,2CAA2C;QAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB;IAQD;;;;;;;;;;OAUG;IACG,0BAA0B,CAC9B,EAAE,EAAE,oBAAoB,EACxB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,8BAA8B,CAAC;IA6F1C,OAAO,CAAC,uBAAuB;IA4C/B;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;YAoBd,eAAe;YAkFf,qBAAqB;IAuCnC,OAAO,CAAC,sBAAsB;IAS9B,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,UAAU;IAgBlB,UAAU,IAAI,IAAI;IAKlB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;CAOlC;AAED,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE;IACjD,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,iBAAiB,CAAC,EAAE,6BAA6B,CAAC;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,4BAA4B,CAE/B"}

package/dist/delegation/vc-verifier.js

@@ -11,6 +11,12 @@
  * Related Spec: KYA-OS §4.3, W3C VC Data Model 1.1
  */
 import { isDelegationCredentialExpired, isDelegationCredentialNotYetValid, validateDelegationCredential, } from "../types/protocol.js";
+/**
+ * Properties a DelegationCredential `credentialSubject` may carry. Anything
+ * else is treated as a claim-intended field and rejected by default — a
+ * permission credential must not smuggle claims (KYA-OS §11.6).
+ */
+const DELEGATION_SUBJECT_KEYS = ["id", "delegation"];
 export class DelegationCredentialVerifier {
     didResolver;
     statusListResolver;
@@ -137,8 +143,29 @@ export class DelegationCredentialVerifier {
         if (!vc.proof) {
             return { valid: false, reason: "Missing proof" };
         }
+        const subjectShape = this.validateSubjectShape(vc);
+        if (!subjectShape.valid) {
+            return subjectShape;
+        }
         return { valid: true };
     }
+    /**
+     * Reject a delegation credential whose `credentialSubject` carries properties
+     * other than `id` and `delegation`. Claim-bearing fields in a permission
+     * credential separate designation from authorization — the confused-deputy
+     * class (KYA-OS §11.6). Unconditional as of 1.4.0.
+     */
+    validateSubjectShape(vc) {
+        const extraneous = Object.keys(vc.credentialSubject).filter((key) => !DELEGATION_SUBJECT_KEYS.includes(key));
+        if (extraneous.length === 0) {
+            return { valid: true };
+        }
+        return {
+            valid: false,
+            reason: `credentialSubject contains non-delegation field(s): ${extraneous.join(", ")}. ` +
+                `A DelegationCredential subject MUST carry only 'id' and 'delegation' (KYA-OS §11.6).`,
+        };
+    }
     async verifySignature(vc, didResolver) {
         const startTime = Date.now();
         try {

package/dist/delegation/vc-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"vc-verifier.js","sourceRoot":"","sources":["../../src/delegation/vc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AA+D9B,MAAM,OAAO,4BAA4B;IAC/B,WAAW,CAAe;IAC1B,kBAAkB,CAAsB;IACxC,iBAAiB,CAAiC;IAClD,KAAK,GAAG,IAAI,GAAG,EAGpB,CAAC;IACI,mBAAmB,GAAa,EAAE,CAAC;IACnC,QAAQ,CAAS;IACzB;;;;OAIG;IACK,YAAY,CAAS;IAE7B,YAAY,OAOX;QACC,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,WAAW,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,OAAO,EAAE,kBAAkB,CAAC;QACtD,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,CAAC;QACpD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,MAAM,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC;IACpD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,0BAA0B,CAC9B,EAAwB,EACxB,UAAqC,EAAE;QAEvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;QAElD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAmC;gBAC7C,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,eAAe,CAAC,MAAM;gBAC9B,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE;oBACP,YAAY;oBACZ,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBAChC;gBACD,MAAM,EAAE;oBACN,UAAU,EAAE,KAAK;iBAClB;aACF,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,aAAa;YAC7C,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC;YACnE,CAAC,CAAC,OAAO,CAAC,OAAO,CAIZ;gBACD,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;QAEP,MAAM,aAAa,GACjB,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,gBAAgB;YACxC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CACxB,EAAE,CAAC,gBAAgB,EACnB,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,kBAAkB,CACtD;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAIZ;gBACD,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;QAET,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxD,gBAAgB;YAChB,aAAa;SACd,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAG,eAAe,CAAC,UAAU,IAAI,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,YAAY,CAAC,UAAU,IAAI,CAAC,CAAC;QAEnD,MAAM,QAAQ,GACZ,eAAe,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC;QAEvE,MAAM,MAAM,GAAmC;YAC7C,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,CAAC,QAAQ;gBACf,CAAC,CAAC,eAAe,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,IAAI,iBAAiB;gBACpE,CAAC,CAAC,SAAS;YACb,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE;gBACP,YAAY;gBACZ,gBAAgB;gBAChB,aAAa;gBACb,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aAChC;YACD,MAAM,EAAE;gBACN,UAAU,EAAE,eAAe,CAAC,KAAK;gBACjC,cAAc,EAAE,eAAe,CAAC,KAAK;gBACrC,WAAW,EAAE,YAAY,CAAC,KAAK;aAChC;SACF,CAAC;QAEF,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,uBAAuB,CAAC,EAAwB;QAItD,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,6BAA6B,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE;aACvE,CAAC;QACJ,CAAC;QAED,IAAI,6BAA6B,CAAC,EAAE,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;QACnE,CAAC;QAED,IAAI,iCAAiC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;QACzE,CAAC;QAED,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC;QACnD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;YACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,EAAwB,EACxB,WAAyB;QAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,SAAS,GACb,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;YAE3D,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC5C,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EACJ,iFAAiF;oBACnF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,iCAAiC,SAAS,EAAE;oBACpD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACd,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,kBAAkB;oBAC1B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAC5D,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC1B,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,kCAAkC;oBAC1C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,sBAAsB,CACpD,MAAM,EACN,oBAA8B,CAC/B,CAAC;YACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,uBAAuB,oBAAoB,YAAY;oBAC/D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAG,kBAAkB,CAAC,YAAY,CAAC;YACrD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,0CAA0C;oBAClD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;YAE1E,OAAO;gBACL,KAAK,EAAE,kBAAkB,CAAC,KAAK;gBAC/B,MAAM,EAAE,kBAAkB,CAAC,MAAM;gBACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;gBACnG,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,MAAwB,EACxB,kBAAuC;QAEvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EACJ,6GAA6G;oBAC/G,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAE/D,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,0CAA0C,MAAM,CAAC,aAAa,GAAG;oBACzE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;gBACzF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,sBAAsB,CAC5B,MAAmB,EACnB,oBAA4B;QAE5B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,CACpC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,oBAAoB,CACvC,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,EAAU;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IAEO,UAAU,CAAC,EAAU,EAAE,MAAsC;QACnE,iEAAiE;QACjE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAClD,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE;YACjB,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,mBAAmB,GAAG,EAAE,CAAC;IAChC,CAAC;IAED,eAAe,CAAC,EAAU;QACxB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjD,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CAAC,OAKxC;IACC,OAAO,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"vc-verifier.js","sourceRoot":"","sources":["../../src/delegation/vc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EACL,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAE9B;;;;GAIG;AACH,MAAM,uBAAuB,GAAsB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AA+DxE,MAAM,OAAO,4BAA4B;IAC/B,WAAW,CAAe;IAC1B,kBAAkB,CAAsB;IACxC,iBAAiB,CAAiC;IAClD,KAAK,GAAG,IAAI,GAAG,EAGpB,CAAC;IACI,mBAAmB,GAAa,EAAE,CAAC;IACnC,QAAQ,CAAS;IACzB;;;;OAIG;IACK,YAAY,CAAS;IAE7B,YAAY,OAOX;QACC,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,WAAW,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,OAAO,EAAE,kBAAkB,CAAC;QACtD,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,CAAC;QACpD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,MAAM,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC;IACpD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,0BAA0B,CAC9B,EAAwB,EACxB,UAAqC,EAAE;QAEvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;QAElD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAmC;gBAC7C,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,eAAe,CAAC,MAAM;gBAC9B,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE;oBACP,YAAY;oBACZ,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBAChC;gBACD,MAAM,EAAE;oBACN,UAAU,EAAE,KAAK;iBAClB;aACF,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,aAAa;YAC7C,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC;YACnE,CAAC,CAAC,OAAO,CAAC,OAAO,CAIZ;gBACD,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;QAEP,MAAM,aAAa,GACjB,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,gBAAgB;YACxC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CACxB,EAAE,CAAC,gBAAgB,EACnB,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,kBAAkB,CACtD;YACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAIZ;gBACD,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;QAET,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxD,gBAAgB;YAChB,aAAa;SACd,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAG,eAAe,CAAC,UAAU,IAAI,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,YAAY,CAAC,UAAU,IAAI,CAAC,CAAC;QAEnD,MAAM,QAAQ,GACZ,eAAe,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC;QAEvE,MAAM,MAAM,GAAmC;YAC7C,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,CAAC,QAAQ;gBACf,CAAC,CAAC,eAAe,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,IAAI,iBAAiB;gBACpE,CAAC,CAAC,SAAS;YACb,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE;gBACP,YAAY;gBACZ,gBAAgB;gBAChB,aAAa;gBACb,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aAChC;YACD,MAAM,EAAE;gBACN,UAAU,EAAE,eAAe,CAAC,KAAK;gBACjC,cAAc,EAAE,eAAe,CAAC,KAAK;gBACrC,WAAW,EAAE,YAAY,CAAC,KAAK;aAChC;SACF,CAAC;QAEF,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,uBAAuB,CAAC,EAAwB;QAItD,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,6BAA6B,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE;aACvE,CAAC;QACJ,CAAC;QAED,IAAI,6BAA6B,CAAC,EAAE,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;QACnE,CAAC;QAED,IAAI,iCAAiC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;QACzE,CAAC;QAED,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC;QACnD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;YACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YACxB,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACK,oBAAoB,CAAC,EAAwB;QAInD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,MAAM,CACzD,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAChD,CAAC;QAEF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QAED,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EACJ,uDAAuD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAChF,sFAAsF;SACzF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,EAAwB,EACxB,WAAyB;QAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,SAAS,GACb,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;YAE3D,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC5C,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EACJ,iFAAiF;oBACnF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,iCAAiC,SAAS,EAAE;oBACpD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACd,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,kBAAkB;oBAC1B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAC5D,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC1B,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,kCAAkC;oBAC1C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,sBAAsB,CACpD,MAAM,EACN,oBAA8B,CAC/B,CAAC;YACF,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,uBAAuB,oBAAoB,YAAY;oBAC/D,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAG,kBAAkB,CAAC,YAAY,CAAC;YACrD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,0CAA0C;oBAClD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;YAE1E,OAAO;gBACL,KAAK,EAAE,kBAAkB,CAAC,KAAK;gBAC/B,MAAM,EAAE,kBAAkB,CAAC,MAAM;gBACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;gBACnG,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,MAAwB,EACxB,kBAAuC;QAEvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EACJ,6GAA6G;oBAC/G,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAE/D,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,0CAA0C,MAAM,CAAC,aAAa,GAAG;oBACzE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;gBACzF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,sBAAsB,CAC5B,MAAmB,EACnB,oBAA4B;QAE5B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,CACpC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,oBAAoB,CACvC,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,EAAU;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IAEO,UAAU,CAAC,EAAU,EAAE,MAAsC;QACnE,iEAAiE;QACjE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAClD,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE;YACjB,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,mBAAmB,GAAG,EAAE,CAAC;IAChC,CAAC;IAED,eAAe,CAAC,EAAU;QACxB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjD,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CAAC,OAKxC;IACC,OAAO,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC"}

package/dist/errors.d.ts

@@ -2,7 +2,7 @@
  * KYA-OS Canonical Error Codes
  *
  * Single source of truth for all wire-format error codes.
- * Aligned with the error catalog at modelcontextprotocol-identity.io.
+ * Aligned with the error catalog at kya-os.ai/mcp.
  *
  * Naming convention: snake_case, no protocol prefix.
  * Follows OAuth 2.0 / Stripe conventions for readability and portability.
@@ -19,6 +19,7 @@ export declare const KYA_OS_ERROR_CODES: {
     readonly invalid_request: "invalid_request";
     readonly needs_authorization: "needs_authorization";
     readonly insufficient_scope: "insufficient_scope";
+    readonly policy_denied: "policy_denied";
     readonly delegation_expired: "delegation_expired";
     readonly delegation_not_yet_valid: "delegation_not_yet_valid";
     readonly delegation_revoked: "delegation_revoked";

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;CAqCrB,CAAC;AAEX,MAAM,MAAM,cAAc,GACxB,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,kBAAkB,CAEpB"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;CAsCrB,CAAC;AAEX,MAAM,MAAM,cAAc,GACxB,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,kBAAkB,CAEpB"}

package/dist/errors.js

@@ -2,7 +2,7 @@
  * KYA-OS Canonical Error Codes
  *
  * Single source of truth for all wire-format error codes.
- * Aligned with the error catalog at modelcontextprotocol-identity.io.
+ * Aligned with the error catalog at kya-os.ai/mcp.
  *
  * Naming convention: snake_case, no protocol prefix.
  * Follows OAuth 2.0 / Stripe conventions for readability and portability.
@@ -23,6 +23,7 @@ export const KYA_OS_ERROR_CODES = {
     // Delegation errors
     needs_authorization: "needs_authorization",
     insufficient_scope: "insufficient_scope",
+    policy_denied: "policy_denied",
     delegation_expired: "delegation_expired",
     delegation_not_yet_valid: "delegation_not_yet_valid",
     delegation_revoked: "delegation_revoked",

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,eAAe;IACf,aAAa,EAAE,eAAe;IAC9B,WAAW,EAAE,aAAa;IAC1B,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;IAEhC,wBAAwB;IACxB,aAAa,EAAE,eAAe;IAC9B,kBAAkB,EAAE,oBAAoB;IAExC,6BAA6B;IAC7B,gBAAgB,EAAE,kBAAkB;IACpC,eAAe,EAAE,iBAAiB;IAClC,eAAe,EAAE,iBAAiB;IAElC,oBAAoB;IACpB,mBAAmB,EAAE,qBAAqB;IAC1C,kBAAkB,EAAE,oBAAoB;IACxC,kBAAkB,EAAE,oBAAoB;IACxC,wBAAwB,EAAE,0BAA0B;IACpD,kBAAkB,EAAE,oBAAoB;IACxC,kBAAkB,EAAE,oBAAoB;IACxC,eAAe,EAAE,iBAAiB;IAClC,mBAAmB,EAAE,qBAAqB;IAE1C,eAAe;IACf,aAAa,EAAE,eAAe;IAC9B,aAAa,EAAE,eAAe;IAE9B,kBAAkB;IAClB,cAAc,EAAE,gBAAgB;IAChC,YAAY,EAAE,cAAc;IAE5B,gBAAgB;IAChB,mBAAmB,EAAE,qBAAqB;IAC1C,aAAa,EAAE,eAAe;CACtB,CAAC;AAWX,MAAM,UAAU,gBAAgB,CAC9B,IAAoB,EACpB,OAAe,EACf,OAAiC;IAEjC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAClE,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,eAAe;IACf,aAAa,EAAE,eAAe;IAC9B,WAAW,EAAE,aAAa;IAC1B,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;IAEhC,wBAAwB;IACxB,aAAa,EAAE,eAAe;IAC9B,kBAAkB,EAAE,oBAAoB;IAExC,6BAA6B;IAC7B,gBAAgB,EAAE,kBAAkB;IACpC,eAAe,EAAE,iBAAiB;IAClC,eAAe,EAAE,iBAAiB;IAElC,oBAAoB;IACpB,mBAAmB,EAAE,qBAAqB;IAC1C,kBAAkB,EAAE,oBAAoB;IACxC,aAAa,EAAE,eAAe;IAC9B,kBAAkB,EAAE,oBAAoB;IACxC,wBAAwB,EAAE,0BAA0B;IACpD,kBAAkB,EAAE,oBAAoB;IACxC,kBAAkB,EAAE,oBAAoB;IACxC,eAAe,EAAE,iBAAiB;IAClC,mBAAmB,EAAE,qBAAqB;IAE1C,eAAe;IACf,aAAa,EAAE,eAAe;IAC9B,aAAa,EAAE,eAAe;IAE9B,kBAAkB;IAClB,cAAc,EAAE,gBAAgB;IAChC,YAAY,EAAE,cAAc;IAE5B,gBAAgB;IAChB,mBAAmB,EAAE,qBAAqB;IAC1C,aAAa,EAAE,eAAe;CACtB,CAAC;AAWX,MAAM,UAAU,gBAAgB,CAC9B,IAAoB,EACpB,OAAe,EACf,OAAiC;IAEjC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAClE,CAAC"}

package/dist/index.d.ts

@@ -4,7 +4,7 @@
  * Delegation, proof, and session for Model Context Protocol Identity.
  * This package is a DIF TAAWG protocol reference implementation.
  *
- * Related Spec: https://modelcontextprotocol-identity.io
+ * Related Spec: https://kya-os.ai/mcp
  *
  * ## Error handling strategy
  *
@@ -15,9 +15,9 @@
  * This ensures callers can always handle failures without try/catch on validation paths.
  */
 export { KYA_OS_ERROR_CODES, createKyaOsError, type KyaOsErrorCode, type KyaOsErrorResponse, } from './errors.js';
-export { base64urlEncodeFromBytes, base64urlDecodeToBytes, } from './utils/base64.js';
-export type { DelegationConstraints, DelegationRecord, DelegationCredential, DelegationStatus, CredentialStatus, StatusList2021Credential, Proof, HandshakeRequest, SessionContext, NonceCache, MCPClientInfo, MCPClientSessionInfo, SessionIdentityState, DetachedProof, ProofMeta, CanonicalHashes, AuditRecord, AuditContext, AuditEventContext, NeedsAuthorizationError, AuthorizationDisplay, CrispBudget, CrispScope, } from './types/protocol.js';
-export { wrapDelegationAsVC, extractDelegationFromVC, isDelegationCredentialExpired, isDelegationCredentialNotYetValid, validateDelegationCredential, validateDetachedProof, createNeedsAuthorizationError, isNeedsAuthorizationError, DELEGATION_CREDENTIAL_CONTEXT, DEFAULT_SESSION_TTL_MINUTES, DEFAULT_TIMESTAMP_SKEW_SECONDS, NONCE_LENGTH_BYTES, AUTH_NONCE_TTL_MS, ANON_NONCE_TTL_MS, type MetaPolicy, } from './types/protocol.js';
+export { base64urlEncodeFromBytes, base64urlDecodeToBytes, bytesToBase64, base64ToBytes, } from './utils/base64.js';
+export type { DelegationConstraints, DelegationRecord, DelegationCredential, DelegationStatus, CredentialStatus, StatusList2021Credential, Proof, HandshakeRequest, SessionContext, NonceCache, MCPClientInfo, MCPClientSessionInfo, SessionIdentityState, DetachedProof, ProofMeta, CanonicalHashes, AuditRecord, AuditContext, AuditEventContext, NeedsAuthorizationError, NeedsApprovalError, AuthorizationDisplay, CrispBudget, CrispScope, } from './types/protocol.js';
+export { wrapDelegationAsVC, extractDelegationFromVC, isDelegationCredentialExpired, isDelegationCredentialNotYetValid, validateDelegationCredential, validateDetachedProof, createNeedsAuthorizationError, isNeedsAuthorizationError, createNeedsApprovalError, isNeedsApprovalError, DELEGATION_CREDENTIAL_CONTEXT, DEFAULT_SESSION_TTL_MINUTES, DEFAULT_TIMESTAMP_SKEW_SECONDS, NONCE_LENGTH_BYTES, AUTH_NONCE_TTL_MS, ANON_NONCE_TTL_MS, type MetaPolicy, } from './types/protocol.js';
 export { DelegationCredentialIssuer, createDelegationIssuer, type IssueDelegationOptions, type VCSigningFunction, type IdentityProvider as DelegationIdentityProvider, } from './delegation/vc-issuer.js';
 export { DelegationCredentialVerifier, createDelegationVerifier, type DelegationVCVerificationResult, type VerifyDelegationVCOptions, type DIDResolver, type DIDDocument, type VerificationMethod, type StatusListResolver, type SignatureVerificationFunction, } from './delegation/vc-verifier.js';
 export { DelegationGraphManager, createDelegationGraph, type DelegationNode, type DelegationGraphStorageProvider, } from './delegation/delegation-graph.js';
@@ -42,7 +42,12 @@ export { SessionManager, createHandshakeRequest, validateHandshakeFormat, type S
 export { CryptoProvider, ClockProvider, FetchProvider, StorageProvider, NonceCacheProvider, IdentityProvider, type Identity, type AgentIdentity, } from './providers/base.js';
 export { MemoryStorageProvider, MemoryNonceCacheProvider, MemoryIdentityProvider, } from './providers/memory.js';
 export { NodeCryptoProvider } from './providers/node-crypto.js';
+export { SystemClockProvider } from './providers/system-clock.js';
+export { RuntimeFetchProvider } from './providers/runtime-fetch.js';
+export { AuditLogProvider, MemoryAuditLogProvider, NoopAuditLogProvider, buildAuditRecord, } from './providers/audit-log.js';
 export { createKyaOsMiddleware, type KyaOsConfig, type KyaOsDelegationConfig, type KyaOsIdentityConfig, type KyaOsMiddleware, type KyaOsToolDefinition, type KyaOsToolHandler, type KyaOsServer, withKyaOs, generateIdentity, type WithKyaOsOptions, } from './middleware/index.js';
+export * from './policy/index.js';
+export { matchScope, scopeSatisfies, type ScopeMatcher, type ScopeSatisfaction, } from './delegation/scope-matcher.js';
 export { logger, createDefaultConsoleLogger, type Logger, type Level, } from './logging/index.js';
 export { ED25519_PKCS8_DER_HEADER, ED25519_SPKI_DER_HEADER_LENGTH, ED25519_KEY_SIZE, } from './utils/index.js';
 //# sourceMappingURL=index.d.ts.map