@kya-os/mcp 1.3.2 → 1.4.0

package/dist/providers/runtime-fetch.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Runtime FetchProvider
+ *
+ * Network-capable `FetchProvider` for any runtime that exposes a global
+ * `fetch` (Node 18+, Deno, Bun, Cloudflare Workers, browsers). It resolves
+ * DIDs (did:key locally, did:web over HTTPS), fetches StatusList2021 credentials,
+ * and exposes the raw `fetch` escape hatch the delegation resolvers build on.
+ *
+ * Security (SSRF): `resolveDID` (did:web) and `fetchStatusList` issue outbound
+ * HTTPS GETs to hosts named by counterparty-controlled data — the DID or
+ * status-list URL embedded in a proof or credential. To blunt SSRF, requests to
+ * private / loopback / link-local IP-literal hosts (e.g. did:web:169.254.169.254,
+ * the cloud-metadata endpoint) are refused by default. This is best-effort
+ * defense-in-depth for IP literals only: it does NOT stop a public domain that
+ * resolves to an internal address (DNS rebinding). Run verifiers behind an egress
+ * allowlist. Pass `{ allowPrivateNetworkHosts: true }` for trusted internal use.
+ * The raw `fetch()` escape hatch is intentionally unguarded — it is the caller's
+ * responsibility.
+ *
+ * @example
+ * ```typescript
+ * import { ProofVerifier, RuntimeFetchProvider, SystemClockProvider, NodeCryptoProvider, MemoryNonceCacheProvider } from '@kya-os/mcp';
+ *
+ * const verifier = new ProofVerifier({
+ *   cryptoProvider: new NodeCryptoProvider(),
+ *   clockProvider: new SystemClockProvider(),
+ *   nonceCacheProvider: new MemoryNonceCacheProvider(),
+ *   fetchProvider: new RuntimeFetchProvider(), // resolves the signer's did:key / did:web
+ * });
+ * ```
+ */
+import { FetchProvider } from "./base.js";
+import type { DIDDocument } from "../delegation/vc-verifier.js";
+import type { StatusList2021Credential, DelegationRecord } from "../types/protocol.js";
+export interface RuntimeFetchProviderOptions {
+    /**
+     * Allow outbound requests to private / loopback / link-local IP-literal hosts.
+     * Default `false` (such hosts are refused to blunt SSRF). Enable only for
+     * trusted internal deployments.
+     */
+    allowPrivateNetworkHosts?: boolean;
+}
+export declare class RuntimeFetchProvider extends FetchProvider {
+    private readonly didKeyResolver;
+    private didWebResolver;
+    private readonly allowPrivateNetworkHosts;
+    constructor(options?: RuntimeFetchProviderOptions);
+    /**
+     * Resolve a DID to its DID Document. did:key is decoded locally (no network);
+     * did:web is fetched from its HTTPS `/.well-known/did.json`. Returns null for
+     * unsupported methods, a blocked (private-network) did:web host, or any
+     * resolution failure (never throws).
+     */
+    resolveDID(did: string): Promise<DIDDocument | null>;
+    /**
+     * Fetch and validate a StatusList2021 credential by URL. Returns null on a
+     * blocked (private-network) host, non-ok response, malformed payload, or
+     * transport error (never throws). Bit decoding is the verifier's job — this
+     * only retrieves the credential.
+     */
+    fetchStatusList(url: string): Promise<StatusList2021Credential | null>;
+    /**
+     * No remote delegation-chain wire format is defined: chains are assembled from
+     * a populated delegation graph, not fetched by id. Returns [] so consumers
+     * treat the chain as locally supplied.
+     */
+    fetchDelegationChain(_id: string): Promise<DelegationRecord[]>;
+    /** Raw HTTP escape hatch — delegates to the runtime's global `fetch`. */
+    fetch(url: string, options?: unknown): Promise<Response>;
+    /** True when SSRF protection should refuse `url` (a private IP-literal host). */
+    private isBlockedTarget;
+}
+//# sourceMappingURL=runtime-fetch.d.ts.map

package/dist/providers/runtime-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-fetch.d.ts","sourceRoot":"","sources":["../../src/providers/runtime-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAO1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,KAAK,EACV,wBAAwB,EACxB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,qBAAa,oBAAqB,SAAQ,aAAa;IACrD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA0B;IACzD,OAAO,CAAC,cAAc,CAAsD;IAC5E,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAU;gBAEvC,OAAO,CAAC,EAAE,2BAA2B;IAMjD;;;;;OAKG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAkB1D;;;;;OAKG;IACG,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAgB5E;;;;OAIG;IACG,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAIpE,yEAAyE;IACnE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAO9D,iFAAiF;IACjF,OAAO,CAAC,eAAe;CAYxB"}

package/dist/providers/runtime-fetch.js

@@ -0,0 +1,169 @@
+/**
+ * Runtime FetchProvider
+ *
+ * Network-capable `FetchProvider` for any runtime that exposes a global
+ * `fetch` (Node 18+, Deno, Bun, Cloudflare Workers, browsers). It resolves
+ * DIDs (did:key locally, did:web over HTTPS), fetches StatusList2021 credentials,
+ * and exposes the raw `fetch` escape hatch the delegation resolvers build on.
+ *
+ * Security (SSRF): `resolveDID` (did:web) and `fetchStatusList` issue outbound
+ * HTTPS GETs to hosts named by counterparty-controlled data — the DID or
+ * status-list URL embedded in a proof or credential. To blunt SSRF, requests to
+ * private / loopback / link-local IP-literal hosts (e.g. did:web:169.254.169.254,
+ * the cloud-metadata endpoint) are refused by default. This is best-effort
+ * defense-in-depth for IP literals only: it does NOT stop a public domain that
+ * resolves to an internal address (DNS rebinding). Run verifiers behind an egress
+ * allowlist. Pass `{ allowPrivateNetworkHosts: true }` for trusted internal use.
+ * The raw `fetch()` escape hatch is intentionally unguarded — it is the caller's
+ * responsibility.
+ *
+ * @example
+ * ```typescript
+ * import { ProofVerifier, RuntimeFetchProvider, SystemClockProvider, NodeCryptoProvider, MemoryNonceCacheProvider } from '@kya-os/mcp';
+ *
+ * const verifier = new ProofVerifier({
+ *   cryptoProvider: new NodeCryptoProvider(),
+ *   clockProvider: new SystemClockProvider(),
+ *   nonceCacheProvider: new MemoryNonceCacheProvider(),
+ *   fetchProvider: new RuntimeFetchProvider(), // resolves the signer's did:key / did:web
+ * });
+ * ```
+ */
+import { FetchProvider } from "./base.js";
+import { createDidKeyResolver } from "../delegation/did-key-resolver.js";
+import { createDidWebResolver, isDidWeb, didWebToUrl, } from "../delegation/did-web-resolver.js";
+export class RuntimeFetchProvider extends FetchProvider {
+    didKeyResolver = createDidKeyResolver();
+    didWebResolver;
+    allowPrivateNetworkHosts;
+    constructor(options) {
+        super();
+        this.allowPrivateNetworkHosts =
+            options?.allowPrivateNetworkHosts ?? false;
+    }
+    /**
+     * Resolve a DID to its DID Document. did:key is decoded locally (no network);
+     * did:web is fetched from its HTTPS `/.well-known/did.json`. Returns null for
+     * unsupported methods, a blocked (private-network) did:web host, or any
+     * resolution failure (never throws).
+     */
+    async resolveDID(did) {
+        if (did.startsWith("did:key:")) {
+            return this.didKeyResolver.resolve(did);
+        }
+        if (isDidWeb(did)) {
+            if (this.isBlockedTarget(didWebToUrl(did))) {
+                return null;
+            }
+            // createDidWebResolver(this) only calls this.fetch() — never resolveDID —
+            // so passing `this` does not recurse. Cache it to reuse its doc cache.
+            if (!this.didWebResolver) {
+                this.didWebResolver = createDidWebResolver(this);
+            }
+            return this.didWebResolver.resolve(did);
+        }
+        return null;
+    }
+    /**
+     * Fetch and validate a StatusList2021 credential by URL. Returns null on a
+     * blocked (private-network) host, non-ok response, malformed payload, or
+     * transport error (never throws). Bit decoding is the verifier's job — this
+     * only retrieves the credential.
+     */
+    async fetchStatusList(url) {
+        if (this.isBlockedTarget(url)) {
+            return null;
+        }
+        try {
+            const res = await this.fetch(url);
+            if (!res.ok) {
+                return null;
+            }
+            const json = await res.json();
+            return isStatusList2021Credential(json) ? json : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * No remote delegation-chain wire format is defined: chains are assembled from
+     * a populated delegation graph, not fetched by id. Returns [] so consumers
+     * treat the chain as locally supplied.
+     */
+    async fetchDelegationChain(_id) {
+        return [];
+    }
+    /** Raw HTTP escape hatch — delegates to the runtime's global `fetch`. */
+    async fetch(url, options) {
+        if (typeof globalThis.fetch !== "function") {
+            throw new Error("Global fetch is not available in this runtime");
+        }
+        return globalThis.fetch(url, options);
+    }
+    /** True when SSRF protection should refuse `url` (a private IP-literal host). */
+    isBlockedTarget(url) {
+        if (this.allowPrivateNetworkHosts || url === null) {
+            return false;
+        }
+        let hostname;
+        try {
+            hostname = new URL(url).hostname;
+        }
+        catch {
+            return false;
+        }
+        return isPrivateOrLoopbackHost(hostname);
+    }
+}
+/** Structural guard: a JSON payload is a StatusList2021 credential. */
+function isStatusList2021Credential(value) {
+    if (typeof value !== "object" || value === null) {
+        return false;
+    }
+    const cred = value;
+    if (!Array.isArray(cred["type"]) ||
+        !cred["type"].includes("StatusList2021Credential")) {
+        return false;
+    }
+    const subject = cred["credentialSubject"];
+    if (typeof subject !== "object" || subject === null) {
+        return false;
+    }
+    const s = subject;
+    return s["type"] === "StatusList2021" && typeof s["encodedList"] === "string";
+}
+/**
+ * True if `hostname` is a private / loopback / link-local IP LITERAL. Domain
+ * names return false (DNS-resolution-based SSRF is out of scope here — use an
+ * egress allowlist). Covers the common IPv4 ranges plus IPv6 loopback /
+ * link-local / unique-local literals.
+ */
+function isPrivateOrLoopbackHost(hostname) {
+    let h = hostname.toLowerCase();
+    if (h.startsWith("[") && h.endsWith("]")) {
+        h = h.slice(1, -1); // URL.hostname brackets IPv6 literals
+    }
+    if (h.includes(":")) {
+        // IPv6 literal
+        return (h === "::1" || // loopback
+            h === "::" || // unspecified
+            h.startsWith("fe80:") || // link-local
+            h.startsWith("fc") || // unique-local fc00::/7
+            h.startsWith("fd"));
+    }
+    const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(h);
+    if (!m) {
+        return false; // domain name, not an IP literal
+    }
+    const a = Number(m[1]);
+    const b = Number(m[2]);
+    return (a === 127 || // loopback 127.0.0.0/8
+        a === 10 || // private 10.0.0.0/8
+        a === 0 || // 0.0.0.0/8 (unspecified / this-host)
+        (a === 169 && b === 254) || // link-local 169.254.0.0/16 (cloud metadata)
+        (a === 192 && b === 168) || // private 192.168.0.0/16
+        (a === 172 && b >= 16 && b <= 31) // private 172.16.0.0/12
+    );
+}
+//# sourceMappingURL=runtime-fetch.js.map

package/dist/providers/runtime-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-fetch.js","sourceRoot":"","sources":["../../src/providers/runtime-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,QAAQ,EACR,WAAW,GACZ,MAAM,mCAAmC,CAAC;AAgB3C,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IACpC,cAAc,GAAG,oBAAoB,EAAE,CAAC;IACjD,cAAc,CAAsD;IAC3D,wBAAwB,CAAU;IAEnD,YAAY,OAAqC;QAC/C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,wBAAwB;YAC3B,OAAO,EAAE,wBAAwB,IAAI,KAAK,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,GAAW;QAC1B,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,IAAI,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,0EAA0E;YAC1E,uEAAuE;YACvE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBACzB,IAAI,CAAC,cAAc,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACnD,CAAC;YACD,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,GAAW;QAC/B,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACvC,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CAAC,GAAW;QACpC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAiB;QACxC,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,OAAsB,CAAC,CAAC;IACvD,CAAC;IAED,iFAAiF;IACzE,eAAe,CAAC,GAAkB;QACxC,IAAI,IAAI,CAAC,wBAAwB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;CACF;AAED,uEAAuE;AACvE,SAAS,0BAA0B,CACjC,KAAc;IAEd,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,KAAgC,CAAC;IAC9C,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAClD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,gBAAgB,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,IAAI,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC/B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,sCAAsC;IAC5D,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,eAAe;QACf,OAAO,CACL,CAAC,KAAK,KAAK,IAAI,WAAW;YAC1B,CAAC,KAAK,IAAI,IAAI,cAAc;YAC5B,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,aAAa;YACtC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,wBAAwB;YAC9C,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CACnB,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,8CAA8C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,iCAAiC;IACjD,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,CACL,CAAC,KAAK,GAAG,IAAI,uBAAuB;QACpC,CAAC,KAAK,EAAE,IAAI,qBAAqB;QACjC,CAAC,KAAK,CAAC,IAAI,sCAAsC;QACjD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,6CAA6C;QACzE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,yBAAyB;QACrD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,wBAAwB;KAC3D,CAAC;AACJ,CAAC"}

package/dist/providers/system-clock.d.ts

@@ -0,0 +1,39 @@
+/**
+ * System ClockProvider
+ *
+ * Wall-clock `ClockProvider` backed by `Date.now()`. The default clock for any
+ * runtime with a trustworthy system time — pair it with `ProofVerifier`,
+ * `SessionManager`, or anything else that needs a clock.
+ *
+ * For deterministic tests, supply your own controllable `ClockProvider` instead.
+ *
+ * @example
+ * ```typescript
+ * import { ProofVerifier, SystemClockProvider, NodeCryptoProvider } from '@kya-os/mcp';
+ *
+ * const verifier = new ProofVerifier({
+ *   cryptoProvider: new NodeCryptoProvider(),
+ *   clockProvider: new SystemClockProvider(),
+ *   // ...nonceCacheProvider, fetchProvider
+ * });
+ * ```
+ */
+import { ClockProvider } from "./base.js";
+export declare class SystemClockProvider extends ClockProvider {
+    /** Current time as a millisecond epoch timestamp. */
+    now(): number;
+    /**
+     * True if `timestamp` is within ±`skewSeconds` of now.
+     *
+     * Note: `timestamp` is MILLISECONDS — `ProofVerifier` calls this with
+     * `proof.meta.ts * 1000` (proof timestamps are in seconds).
+     */
+    isWithinSkew(timestamp: number, skewSeconds: number): boolean;
+    /** True once now is strictly past `expiresAt` (ms epoch). */
+    hasExpired(expiresAt: number): boolean;
+    /** Absolute ms-epoch expiry for a relative TTL in seconds. */
+    calculateExpiry(ttlSeconds: number): number;
+    /** ISO-8601 rendering of a ms-epoch timestamp. */
+    format(timestamp: number): string;
+}
+//# sourceMappingURL=system-clock.d.ts.map

package/dist/providers/system-clock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-clock.d.ts","sourceRoot":"","sources":["../../src/providers/system-clock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,qBAAa,mBAAoB,SAAQ,aAAa;IACpD,qDAAqD;IACrD,GAAG,IAAI,MAAM;IAIb;;;;;OAKG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO;IAI7D,6DAA6D;IAC7D,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAItC,8DAA8D;IAC9D,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAI3C,kDAAkD;IAClD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;CAGlC"}

package/dist/providers/system-clock.js

@@ -0,0 +1,49 @@
+/**
+ * System ClockProvider
+ *
+ * Wall-clock `ClockProvider` backed by `Date.now()`. The default clock for any
+ * runtime with a trustworthy system time — pair it with `ProofVerifier`,
+ * `SessionManager`, or anything else that needs a clock.
+ *
+ * For deterministic tests, supply your own controllable `ClockProvider` instead.
+ *
+ * @example
+ * ```typescript
+ * import { ProofVerifier, SystemClockProvider, NodeCryptoProvider } from '@kya-os/mcp';
+ *
+ * const verifier = new ProofVerifier({
+ *   cryptoProvider: new NodeCryptoProvider(),
+ *   clockProvider: new SystemClockProvider(),
+ *   // ...nonceCacheProvider, fetchProvider
+ * });
+ * ```
+ */
+import { ClockProvider } from "./base.js";
+export class SystemClockProvider extends ClockProvider {
+    /** Current time as a millisecond epoch timestamp. */
+    now() {
+        return Date.now();
+    }
+    /**
+     * True if `timestamp` is within ±`skewSeconds` of now.
+     *
+     * Note: `timestamp` is MILLISECONDS — `ProofVerifier` calls this with
+     * `proof.meta.ts * 1000` (proof timestamps are in seconds).
+     */
+    isWithinSkew(timestamp, skewSeconds) {
+        return Math.abs(Date.now() - timestamp) <= skewSeconds * 1000;
+    }
+    /** True once now is strictly past `expiresAt` (ms epoch). */
+    hasExpired(expiresAt) {
+        return Date.now() > expiresAt;
+    }
+    /** Absolute ms-epoch expiry for a relative TTL in seconds. */
+    calculateExpiry(ttlSeconds) {
+        return Date.now() + ttlSeconds * 1000;
+    }
+    /** ISO-8601 rendering of a ms-epoch timestamp. */
+    format(timestamp) {
+        return new Date(timestamp).toISOString();
+    }
+}
+//# sourceMappingURL=system-clock.js.map

package/dist/providers/system-clock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-clock.js","sourceRoot":"","sources":["../../src/providers/system-clock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,OAAO,mBAAoB,SAAQ,aAAa;IACpD,qDAAqD;IACrD,GAAG;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,SAAiB,EAAE,WAAmB;QACjD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,IAAI,WAAW,GAAG,IAAI,CAAC;IAChE,CAAC;IAED,6DAA6D;IAC7D,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAChC,CAAC;IAED,8DAA8D;IAC9D,eAAe,CAAC,UAAkB;QAChC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;IACxC,CAAC;IAED,kDAAkD;IAClD,MAAM,CAAC,SAAiB;QACtB,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3C,CAAC;CACF"}

package/dist/types/protocol.d.ts

@@ -98,7 +98,7 @@ export interface DelegationCredential {
     proof?: Proof;
     [key: string]: unknown;
 }
-export declare const DELEGATION_CREDENTIAL_CONTEXT: "https://schema.kya-os.ai/xmcp-i/credentials/delegation.v1.0.0.json";
+export declare const DELEGATION_CREDENTIAL_CONTEXT: "https://schema.kya-os.ai/v1/protocol/delegation/context/v1.0.0";
 export interface StatusList2021Credential {
     '@context': (string | Record<string, unknown>)[];
     id: string;
@@ -233,10 +233,12 @@ export interface ProofMeta {
     audience: string;
     sessionId: string;
     requestHash: string;
-    responseHash: string;
+    responseHash?: string;
     scopeId?: string;
     delegationRef?: string;
     clientDid?: string;
+    outcome?: 'allowed' | 'denied' | 'step_up_required' | 'needs_authorization';
+    reason?: string;
 }
 export interface DetachedProof {
     jws: string;
@@ -270,7 +272,7 @@ export interface AuditContext {
         [key: string]: unknown;
     };
     requestHash: string;
-    responseHash: string;
+    responseHash?: string;
     verified: 'yes' | 'no';
     scopeId?: string;
 }
@@ -315,6 +317,39 @@ export declare function createNeedsAuthorizationError(config: {
     display?: AuthorizationDisplay;
 }): NeedsAuthorizationError;
 export declare function isNeedsAuthorizationError(error: unknown): error is NeedsAuthorizationError;
+/**
+ * Returned when an in-scope action is high-risk and requires per-action,
+ * N-of-M human (or second-identity) approval before it may proceed. The
+ * client collects approval grants bound to `requestHash` and resumes via
+ * `resumeToken`. Mirrors NeedsAuthorizationError, but gates a specific
+ * destructive action rather than session-level authorization.
+ */
+export interface NeedsApprovalError {
+    error: 'needs_approval';
+    message: string;
+    resumeToken: string;
+    expiresAt: number;
+    /** Approval grants MUST be bound to this requestHash (TOCTOU guard). */
+    requestHash: string;
+    quorum: {
+        n: number;
+        approvers: string[];
+    };
+    context?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+export declare function createNeedsApprovalError(config: {
+    message: string;
+    resumeToken: string;
+    expiresAt: number;
+    requestHash: string;
+    quorum: {
+        n: number;
+        approvers: string[];
+    };
+    context?: Record<string, unknown>;
+}): NeedsApprovalError;
+export declare function isNeedsApprovalError(error: unknown): error is NeedsApprovalError;
 /**
  * Validate a DetachedProof structure.
  * Returns a Zod-compatible result shape.

package/dist/types/protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/types/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;QAC1B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,MAAM,EAAE,UAAU,EAAE,CAAC;QACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAMD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,qBAAqB,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,gBAAgB,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAMD,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,qBAAqB,CAAC;IAC5B,aAAa,EAAE,YAAY,GAAG,YAAY,CAAC;IAC3C,eAAe,EAAE,MAAM,CAAC;IACxB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE;QACV,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,qBAAqB,CAAC;QACnC,MAAM,EAAE,gBAAgB,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IACjD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,eAAO,MAAM,6BAA6B,EACxC,oEAA6E,CAAC;AAMhF,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE;QACjB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,gBAAgB,CAAC;QACvB,aAAa,EAAE,YAAY,GAAG,YAAY,CAAC;QAC3C,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAMD;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,gBAAgB,EAC5B,OAAO,CAAC,EAAE;IACR,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB,GACA,IAAI,CAAC,oBAAoB,EAAE,OAAO,CAAC,CA2CrC;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,oBAAoB,GAAG,gBAAgB,CAwBlF;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,EAAE,EAAE,oBAAoB,GAAG,OAAO,CAgB/E;AAED;;GAEG;AACH,wBAAgB,iCAAiC,CAAC,EAAE,EAAE,oBAAoB,GAAG,OAAO,CAWnF;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,OAAO,GAAG;IACzD,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5B,IAAI,CAAC,EAAE,oBAAoB,CAAC;CAC7B,CAqDA;AAMD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,aAAa,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9C;AAED,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,eAAe,CAAC;AAEjE,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,aAAa,EAAE,oBAAoB,CAAC;IACpC,4DAA4D;IAC5D,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,aAAa,CAAC,EAAE;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAC9C,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAClD,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,SAAU,CAAC;AACzC,4DAA4D;AAC5D,eAAO,MAAM,iBAAiB,QAAS,CAAC;AAExC;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,kBAAkB,CAAC;AAMvD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,SAAS,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,UAAU,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,KAAK,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;CACf;AAMD,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE;QACR,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,KAAK,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE;QACR,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAMD,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,qBAAqB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,oBAAoB,CAAC;CAChC,GAAG,uBAAuB,CAK1B;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,uBAAuB,CAM1F;AAQD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG;IACrD,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IACjE,IAAI,CAAC,EAAE,aAAa,CAAC;CACtB,CAqDA"}
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/types/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;QAC1B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,MAAM,EAAE,UAAU,EAAE,CAAC;QACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAMD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,qBAAqB,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,gBAAgB,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAMD,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,qBAAqB,CAAC;IAC5B,aAAa,EAAE,YAAY,GAAG,YAAY,CAAC;IAC3C,eAAe,EAAE,MAAM,CAAC;IACxB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE;QACV,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,qBAAqB,CAAC;QACnC,MAAM,EAAE,gBAAgB,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IACjD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,eAAO,MAAM,6BAA6B,EACxC,gEAAyE,CAAC;AAM5E,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE;QACjB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,gBAAgB,CAAC;QACvB,aAAa,EAAE,YAAY,GAAG,YAAY,CAAC;QAC3C,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAMD;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,gBAAgB,EAC5B,OAAO,CAAC,EAAE;IACR,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB,GACA,IAAI,CAAC,oBAAoB,EAAE,OAAO,CAAC,CA2CrC;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,oBAAoB,GAAG,gBAAgB,CAmClF;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,EAAE,EAAE,oBAAoB,GAAG,OAAO,CAgB/E;AAED;;GAEG;AACH,wBAAgB,iCAAiC,CAAC,EAAE,EAAE,oBAAoB,GAAG,OAAO,CAWnF;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,OAAO,GAAG;IACzD,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5B,IAAI,CAAC,EAAE,oBAAoB,CAAC;CAC7B,CAqDA;AAMD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,aAAa,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9C;AAED,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,eAAe,CAAC;AAEjE,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,aAAa,EAAE,oBAAoB,CAAC;IACpC,4DAA4D;IAC5D,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,aAAa,CAAC,EAAE;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAC9C,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAClD,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,SAAU,CAAC;AACzC,4DAA4D;AAC5D,eAAO,MAAM,iBAAiB,QAAS,CAAC;AAExC;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,kBAAkB,CAAC;AAMvD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,kBAAkB,GAAG,qBAAqB,CAAC;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,SAAS,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,UAAU,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,KAAK,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;CACf;AAMD,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE;QACR,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,KAAK,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE;QACR,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAMD,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,qBAAqB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,oBAAoB,CAAC;CAChC,GAAG,uBAAuB,CAK1B;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,uBAAuB,CAM1F;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,gBAAgB,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,GAAG,kBAAkB,CAKrB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kBAAkB,CAMhF;AAQD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG;IACrD,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IACjE,IAAI,CAAC,EAAE,aAAa,CAAC;CACtB,CA0EA"}

package/dist/types/protocol.js

@@ -6,7 +6,7 @@
  *
  * Related Spec: KYA-OS §3, §4, §5, §6
  */
-export const DELEGATION_CREDENTIAL_CONTEXT = 'https://schema.kya-os.ai/xmcp-i/credentials/delegation.v1.0.0.json';
+export const DELEGATION_CREDENTIAL_CONTEXT = 'https://schema.kya-os.ai/v1/protocol/delegation/context/v1.0.0';
 // ============================================================================
 // Delegation VC utility functions
 // ============================================================================
@@ -58,7 +58,16 @@ export function wrapDelegationAsVC(delegation, options) {
  * Extract a DelegationRecord from a DelegationCredential.
  */
 export function extractDelegationFromVC(vc) {
-    const delegation = vc.credentialSubject.delegation;
+    // Defensive: callers may pass an untrusted/loosely-typed value. Fail with a
+    // clear, controlled error instead of a cryptic "Cannot read properties of
+    // undefined (reading 'delegation')" when the credential is structurally
+    // malformed. validate*-style callers should shape-check first and return
+    // { valid, reason } rather than relying on this throw — see
+    // validateDelegationChain, which never throws on a malformed leaf.
+    const delegation = vc?.credentialSubject?.delegation;
+    if (!delegation || typeof delegation !== 'object') {
+        throw new Error('extractDelegationFromVC: credential is missing credentialSubject.delegation');
+    }
     let signature = '';
     if (vc.proof) {
         const proof = vc.proof;
@@ -177,6 +186,17 @@ export function isNeedsAuthorizationError(error) {
         error !== null &&
         error['error'] === 'needs_authorization');
 }
+export function createNeedsApprovalError(config) {
+    return {
+        error: 'needs_approval',
+        ...config,
+    };
+}
+export function isNeedsApprovalError(error) {
+    return (typeof error === 'object' &&
+        error !== null &&
+        error['error'] === 'needs_approval');
+}
 // ============================================================================
 // DetachedProof validation
 // ============================================================================
@@ -211,20 +231,35 @@ export function validateDetachedProof(proof) {
     if (typeof m['ts'] !== 'number' || !Number.isInteger(m['ts']) || m['ts'] <= 0) {
         return { success: false, error: { message: 'meta.ts must be a positive integer' } };
     }
-    // Validate hash fields
-    const hashFields = ['requestHash', 'responseHash'];
-    for (const field of hashFields) {
-        if (typeof m[field] !== 'string' || !HASH_REGEX.test(m[field])) {
-            return { success: false, error: { message: `meta.${field} must match sha256:<64 hex chars>` } };
-        }
+    // Validate hash fields: requestHash is always required. responseHash is
+    // absent on denial / step-up proofs (no response) and validated only when present.
+    if (typeof m['requestHash'] !== 'string' || !HASH_REGEX.test(m['requestHash'])) {
+        return { success: false, error: { message: 'meta.requestHash must match sha256:<64 hex chars>' } };
+    }
+    if (m['responseHash'] !== undefined &&
+        (typeof m['responseHash'] !== 'string' || !HASH_REGEX.test(m['responseHash']))) {
+        return {
+            success: false,
+            error: { message: 'meta.responseHash must match sha256:<64 hex chars> when present' },
+        };
     }
     // Optional string fields
-    const optionalStrings = ['scopeId', 'delegationRef', 'clientDid'];
+    const optionalStrings = ['scopeId', 'delegationRef', 'clientDid', 'reason'];
     for (const field of optionalStrings) {
         if (m[field] !== undefined && typeof m[field] !== 'string') {
             return { success: false, error: { message: `meta.${field} must be a string if present` } };
         }
     }
+    // Optional outcome enum (present on denial / step-up / needs-authorization proofs)
+    if (m['outcome'] !== undefined &&
+        !['allowed', 'denied', 'step_up_required', 'needs_authorization'].includes(m['outcome'])) {
+        return {
+            success: false,
+            error: {
+                message: 'meta.outcome must be one of allowed | denied | step_up_required | needs_authorization',
+            },
+        };
+    }
     return {
         success: true,
         data: proof,

package/dist/types/protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../src/types/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgHH,MAAM,CAAC,MAAM,6BAA6B,GACxC,oEAA6E,CAAC;AAsBhF,+EAA+E;AAC/E,kCAAkC;AAClC,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAA4B,EAC5B,OASC;IAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,cAAc,GAAG,UAAU,CAAC,WAAW,CAAC,QAAQ;QACpD,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAChE,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC;IAE5B,IAAI,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACnD,YAAY,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC;IAEhE,OAAO;QACL,UAAU,EAAE;YACV,wCAAwC;YACxC,6BAA6B;SAC9B;QACD,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,UAAU,CAAC,IAAI,IAAI,YAAY,UAAU,CAAC,EAAE,EAAE;QACjE,IAAI,EAAE,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;QACtD,MAAM,EAAE,UAAU,CAAC,SAAS;QAC5B,YAAY;QACZ,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,CAAC;QACvD,iBAAiB,EAAE;YACjB,EAAE,EAAE,UAAU,CAAC,UAAU;YACzB,UAAU,EAAE;gBACV,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrD,GAAG,CAAC,OAAO,EAAE,cAAc,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC1E,GAAG,CAAC,OAAO,EAAE,SAAS,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC3D,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC9C,GAAG,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC;gBACjF,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;gBAC3E,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,GAAG,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;gBAC9E,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;aAC5E;SACF;QACD,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;KAC/F,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,EAAwB;IAC9D,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC;IAEnD,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,EAAE,CAAC,KAAgC,CAAC;QAClD,SAAS,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAW,CAAC;IAC/F,CAAC;IAED,OAAO;QACL,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,IAAI,EAAE,EAAE,CAAC,EAAE,IAAI,MAAM,UAAU,CAAC,EAAE,EAAE;QACpC,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,SAAS;QACT,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,SAAS,EAAE,SAAS;QACpB,aAAa,EAAE,SAAS;QACxB,QAAQ,EAAE,UAAU,CAAC,QAAQ;KAC9B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAAwB;IACpE,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC;IACnD,IAAI,UAAU,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,IAAI,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iCAAiC,CAAC,EAAwB;IACxE,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC;IAEnD,IAAI,UAAU,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,IAAI,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAAW;IAKtD,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,CAAC,GAAG,EAA6B,CAAC;IAExC,iBAAiB;IACjB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,6BAA6B,EAAE,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,wCAAwC,EAAE,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,EAAE,CAAC;IACzF,CAAC;IAED,aAAa;IACb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC/F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,iEAAiE,EAAE,EAAE,CAAC;IACnH,CAAC;IAED,eAAe;IACf,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACzF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,qBAAqB;IACrB,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC;IACxE,CAAC;IAED,0BAA0B;IAC1B,MAAM,EAAE,GAAG,CAAC,CAAC,mBAAmB,CAAwC,CAAC;IACzE,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAwC,CAAC;IACpE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,CAAC;IACxF,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAA0B,EAAE,CAAC;AAC7D,CAAC;AAsED,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAC9C,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAClD,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC,6DAA6D;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AACzC,4DAA4D;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AA8GxC,MAAM,UAAU,6BAA6B,CAAC,MAO7C;IACC,OAAO;QACL,KAAK,EAAE,qBAAqB;QAC5B,GAAG,MAAM;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAAiC,CAAC,OAAO,CAAC,KAAK,qBAAqB,CACtE,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,2BAA2B;AAC3B,+EAA+E;AAE/E,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAE3C;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAKlD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,CAAC,GAAG,KAAgC,CAAC;IAE3C,eAAe;IACf,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,CAAC;IAClF,CAAC;IAED,gBAAgB;IAChB,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,EAAE,CAAC;IAC1E,CAAC;IAED,MAAM,CAAC,GAAG,IAA+B,CAAC;IAE1C,yBAAyB;IACzB,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,CAAU,CAAC;IAClF,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,KAAK,CAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,KAAK,6BAA6B,EAAE,EAAE,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,EAAE,CAAC;IACtF,CAAC;IAED,uBAAuB;IACvB,MAAM,UAAU,GAAG,CAAC,aAAa,EAAE,cAAc,CAAU,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAW,CAAC,EAAE,CAAC;YACzE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,KAAK,mCAAmC,EAAE,EAAE,CAAC;QAClG,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,WAAW,CAAU,CAAC;IAC3E,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC3D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,KAAK,8BAA8B,EAAE,EAAE,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,KAAsB;KAC7B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../src/types/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgHH,MAAM,CAAC,MAAM,6BAA6B,GACxC,gEAAyE,CAAC;AAsB5E,+EAA+E;AAC/E,kCAAkC;AAClC,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAA4B,EAC5B,OASC;IAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,cAAc,GAAG,UAAU,CAAC,WAAW,CAAC,QAAQ;QACpD,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAChE,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC;IAE5B,IAAI,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACnD,YAAY,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC;IAEhE,OAAO;QACL,UAAU,EAAE;YACV,wCAAwC;YACxC,6BAA6B;SAC9B;QACD,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,UAAU,CAAC,IAAI,IAAI,YAAY,UAAU,CAAC,EAAE,EAAE;QACjE,IAAI,EAAE,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;QACtD,MAAM,EAAE,UAAU,CAAC,SAAS;QAC5B,YAAY;QACZ,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,CAAC;QACvD,iBAAiB,EAAE;YACjB,EAAE,EAAE,UAAU,CAAC,UAAU;YACzB,UAAU,EAAE;gBACV,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrD,GAAG,CAAC,OAAO,EAAE,cAAc,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC1E,GAAG,CAAC,OAAO,EAAE,SAAS,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC3D,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC9C,GAAG,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC;gBACjF,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;gBAC3E,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,GAAG,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;gBAC9E,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;aAC5E;SACF;QACD,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;KAC/F,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,EAAwB;IAC9D,4EAA4E;IAC5E,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,4DAA4D;IAC5D,mEAAmE;IACnE,MAAM,UAAU,GAAG,EAAE,EAAE,iBAAiB,EAAE,UAAU,CAAC;IACrD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,EAAE,CAAC,KAAgC,CAAC;QAClD,SAAS,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAW,CAAC;IAC/F,CAAC;IAED,OAAO;QACL,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,IAAI,EAAE,EAAE,CAAC,EAAE,IAAI,MAAM,UAAU,CAAC,EAAE,EAAE;QACpC,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,SAAS;QACT,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,SAAS,EAAE,SAAS;QACpB,aAAa,EAAE,SAAS;QACxB,QAAQ,EAAE,UAAU,CAAC,QAAQ;KAC9B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAAwB;IACpE,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC;IACnD,IAAI,UAAU,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,IAAI,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iCAAiC,CAAC,EAAwB;IACxE,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC;IAEnD,IAAI,UAAU,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,IAAI,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAAW;IAKtD,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,CAAC,GAAG,EAA6B,CAAC;IAExC,iBAAiB;IACjB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,6BAA6B,EAAE,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,wCAAwC,EAAE,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,EAAE,CAAC;IACzF,CAAC;IAED,aAAa;IACb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC/F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,iEAAiE,EAAE,EAAE,CAAC;IACnH,CAAC;IAED,eAAe;IACf,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACzF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,qBAAqB;IACrB,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC;IACxE,CAAC;IAED,0BAA0B;IAC1B,MAAM,EAAE,GAAG,CAAC,CAAC,mBAAmB,CAAwC,CAAC;IACzE,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAwC,CAAC;IACpE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,CAAC;IACxF,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAA0B,EAAE,CAAC;AAC7D,CAAC;AAsED,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAC9C,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAClD,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC,6DAA6D;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AACzC,4DAA4D;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAgHxC,MAAM,UAAU,6BAA6B,CAAC,MAO7C;IACC,OAAO;QACL,KAAK,EAAE,qBAAqB;QAC5B,GAAG,MAAM;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAAiC,CAAC,OAAO,CAAC,KAAK,qBAAqB,CACtE,CAAC;AACJ,CAAC;AAqBD,MAAM,UAAU,wBAAwB,CAAC,MAOxC;IACC,OAAO;QACL,KAAK,EAAE,gBAAgB;QACvB,GAAG,MAAM;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAAiC,CAAC,OAAO,CAAC,KAAK,gBAAgB,CACjE,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,2BAA2B;AAC3B,+EAA+E;AAE/E,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAE3C;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAKlD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,CAAC,GAAG,KAAgC,CAAC;IAE3C,eAAe;IACf,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,CAAC;IAClF,CAAC;IAED,gBAAgB;IAChB,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,EAAE,CAAC;IAC1E,CAAC;IAED,MAAM,CAAC,GAAG,IAA+B,CAAC;IAE1C,yBAAyB;IACzB,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,CAAU,CAAC;IAClF,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,KAAK,CAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,KAAK,6BAA6B,EAAE,EAAE,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,EAAE,CAAC;IACtF,CAAC;IAED,wEAAwE;IACxE,mFAAmF;IACnF,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAW,CAAC,EAAE,CAAC;QACzF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE,EAAE,CAAC;IACrG,CAAC;IACD,IACE,CAAC,CAAC,cAAc,CAAC,KAAK,SAAS;QAC/B,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAW,CAAC,CAAC,EACxF,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,EAAE,OAAO,EAAE,iEAAiE,EAAE;SACtF,CAAC;IACJ,CAAC;IAED,yBAAyB;IACzB,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAC;IACrF,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC3D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,KAAK,8BAA8B,EAAE,EAAE,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,IACE,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS;QAC1B,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAW,CAAC,EAClG,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE;gBACL,OAAO,EACL,uFAAuF;aAC1F;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,KAAsB;KAC7B,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp",
-  "version": "1.3.2",
+  "version": "1.4.0",
   "description": "Reference implementation of the KYA-OS protocol for Model Context Protocol servers: delegation, proof, and session primitives",
   "license": "MIT",
   "type": "module",
@@ -64,7 +64,9 @@
     "prepublishOnly": "npm run clean && npm run build && npm run test",
     "demo": "bash scripts/demo.sh",
     "example:server": "npx tsx examples/node-server/server.ts",
-    "example:inspector": "npx @modelcontextprotocol/inspector npx tsx examples/node-server/server.ts --stdio"
+    "example:inspector": "npx @modelcontextprotocol/inspector npx tsx examples/node-server/server.ts --stdio",
+    "example:verify-proof": "npx tsx examples/verify-proof/verify.ts",
+    "example:anti-mitm": "npx tsx examples/verify-proof/anti-mitm-demo.ts"
   },
   "dependencies": {
     "jose": "^5.6.3",

package/schemas/README.md

@@ -67,7 +67,7 @@ except ValidationError as e:
 All schemas use JSON Schema draft 2020-12 and are published at:
 
 ```
-https://schema.kya-os.ai/xmcp-i/{category}/{schema-name}.v1.0.0.json
+https://schema.kya-os.ai/v1/protocol/{family}/{resource}/v1.0.0
 ```
 
 Schemas can reference each other using `$ref`. For example, the delegation credential schema references shared definitions for constraints and proof structures.