@kya-os/mcp 1.5.0 → 1.6.1

package/dist/delegation/chain-enforcement.js

@@ -0,0 +1,224 @@
+/**
+ * Delegation chain enforcement — framework-agnostic core (E3 · #2888).
+ *
+ * The leaf→root chain walk, scope-attenuation, audience binding, confused-deputy
+ * guard (KYA-OS §11.6), and ancestor-revocation rules, lifted out of the
+ * `with-kya-os` middleware closure so the SAME logic runs in every host (MCP
+ * middleware, an HTTP PEP, the conformance harness) against one implementation
+ * rather than a per-transport fork.
+ *
+ * Dependencies are injected as ports (interface-first): a per-credential
+ * verifier, an optional ancestor resolver, and an optional graph-backed
+ * `RevocationChecker`. Nothing here imports a transport or framework.
+ */
+import { extractDelegationFromVC, } from "../types/protocol.js";
+import { verifyDelegationAudience } from "./audience-validator.js";
+/** Union of a credential's delegation scopes and its constraint scopes. */
+export function getDelegationScopes(credential) {
+    const scopes = new Set();
+    for (const scope of credential.credentialSubject.delegation.scopes ?? []) {
+        scopes.add(scope);
+    }
+    for (const scope of credential.credentialSubject.delegation.constraints?.scopes ?? []) {
+        scopes.add(scope);
+    }
+    return Array.from(scopes);
+}
+/**
+ * A child re-delegation may only narrow (attenuate) its parent's authority.
+ * Enforces flat-scope subset AND crisp-matcher subset (by matcher+resource),
+ * failing closed on any widening. Pure; never throws.
+ */
+export function validateScopeAttenuation(parentCredential, childCredential) {
+    const parentScopes = getDelegationScopes(parentCredential);
+    const childScopes = getDelegationScopes(childCredential);
+    const childDelegation = childCredential.credentialSubject.delegation;
+    // CRISP matcher attenuation: getDelegationScopes does NOT see constraints.crisp.scopes,
+    // so a re-delegation could otherwise widen authority by introducing a broad
+    // prefix/regex matcher (e.g. resource:"" matches every scope). Require the child's
+    // crisp matchers to be a subset of the parent's (by matcher+resource). Fail closed.
+    const crispKey = (s) => `${s.matcher}\u0000${s.resource}`;
+    const parentCrisp = new Set((parentCredential.credentialSubject.delegation.constraints.crisp?.scopes ?? []).map(crispKey));
+    const widenedCrisp = (childDelegation.constraints.crisp?.scopes ?? []).filter((s) => !parentCrisp.has(crispKey(s)));
+    if (widenedCrisp.length > 0) {
+        return {
+            valid: false,
+            reason: `Delegation ${childDelegation.id} introduces crisp scope matcher(s) absent from parent ${parentCredential.credentialSubject.delegation.id}: ${widenedCrisp
+                .map((s) => `${s.matcher}:${s.resource}`)
+                .join(", ")}`,
+        };
+    }
+    if (parentScopes.length === 0) {
+        return { valid: true };
+    }
+    if (childScopes.length === 0) {
+        return {
+            valid: false,
+            reason: `Delegation ${childDelegation.id} omits scopes required to prove attenuation from parent ${parentCredential.credentialSubject.delegation.id}`,
+        };
+    }
+    const parentScopeSet = new Set(parentScopes);
+    const widenedScopes = childScopes.filter((scope) => !parentScopeSet.has(scope));
+    if (widenedScopes.length > 0) {
+        return {
+            valid: false,
+            reason: `Delegation ${childDelegation.id} widens scopes beyond parent ${parentCredential.credentialSubject.delegation.id}: ${widenedScopes.join(", ")}`,
+        };
+    }
+    return { valid: true };
+}
+/**
+ * Validate a delegation credential and (if re-delegated) its full chain:
+ * structural shape, per-credential verification, audience binding to the server,
+ * the §11.6 re-delegation audience-constraint requirement, parent↔child linkage
+ * (parentId + issuerDid==parent.subjectDid), cycle detection, scope attenuation,
+ * and — when a {@link RevocationChecker} is supplied — graph-backed ancestor
+ * revocation. Never throws on a malformed input; returns `{ valid, reason }`.
+ */
+export async function validateDelegationChain(leafCredential, deps, options) {
+    // Shape guard (validate* never-throw contract): a structurally malformed leaf
+    // returns a { valid, reason } result rather than letting extractDelegationFromVC
+    // or the downstream scope check throw. Requires both
+    // credentialSubject.delegation AND .constraints (the verifier's own invariant).
+    const leafDelegationObj = leafCredential?.credentialSubject?.delegation;
+    if (!leafDelegationObj ||
+        typeof leafDelegationObj !== "object" ||
+        !leafDelegationObj.constraints ||
+        typeof leafDelegationObj.constraints !== "object") {
+        return {
+            valid: false,
+            reason: "Malformed delegation credential: missing credentialSubject.delegation or its constraints",
+        };
+    }
+    const leafDelegation = extractDelegationFromVC(leafCredential);
+    let chain = [leafCredential];
+    if (leafDelegation.parentId) {
+        if (!deps.resolveDelegationChain) {
+            return {
+                valid: false,
+                reason: `Delegation ${leafDelegation.id} references parent ${leafDelegation.parentId} but no resolveDelegationChain handler is configured`,
+            };
+        }
+        let resolvedChain;
+        try {
+            resolvedChain = await deps.resolveDelegationChain(leafCredential);
+        }
+        catch (error) {
+            return {
+                valid: false,
+                reason: `Failed to resolve delegation chain: ${error instanceof Error ? error.message : "Unknown error"}`,
+            };
+        }
+        if (resolvedChain.length === 0) {
+            return {
+                valid: false,
+                reason: `Delegation ${leafDelegation.id} references parent ${leafDelegation.parentId} but the resolved chain is empty`,
+            };
+        }
+        const leafIndex = resolvedChain.findIndex((credential) => credential.credentialSubject.delegation.id === leafDelegation.id);
+        if (leafIndex !== -1 && leafIndex !== resolvedChain.length - 1) {
+            return {
+                valid: false,
+                reason: `Resolved delegation chain for ${leafDelegation.id} must end with the leaf credential`,
+            };
+        }
+        chain = leafIndex === -1 ? [...resolvedChain, leafCredential] : resolvedChain;
+    }
+    const seenIds = new Set();
+    let previousDelegation;
+    let previousCredential;
+    for (const credential of chain) {
+        const delegation = extractDelegationFromVC(credential);
+        if (seenIds.has(delegation.id)) {
+            return {
+                valid: false,
+                reason: `Delegation chain contains a circular reference at ${delegation.id}`,
+            };
+        }
+        seenIds.add(delegation.id);
+        if (credential.credentialStatus && !deps.statusListConfigured) {
+            return {
+                valid: false,
+                reason: `Delegation ${delegation.id} has credentialStatus but no statusListResolver is configured`,
+            };
+        }
+        const credentialVerification = await deps.verifier.verifyDelegationCredential(credential, {
+            ...(options?.skipSignature ? { skipSignature: true } : {}),
+        });
+        if (!credentialVerification.valid) {
+            return {
+                valid: false,
+                reason: `Delegation ${delegation.id} invalid: ${credentialVerification.reason}`,
+            };
+        }
+        if (!verifyDelegationAudience(delegation, deps.serverDid)) {
+            return {
+                valid: false,
+                reason: `Delegation ${delegation.id} audience does not include server DID ${deps.serverDid}`,
+            };
+        }
+        // Every non-root credential in the chain MUST carry an `audience` constraint
+        // binding it to the verifying server. This closes the confused-deputy class
+        // where a re-delegated credential is forwarded to an unintended server
+        // (KYA-OS §11.6). Unconditional as of 1.4.0.
+        if (delegation.parentId && !delegation.constraints.audience) {
+            return {
+                valid: false,
+                reason: `Delegation ${delegation.id} is a re-delegation (parentId: ${delegation.parentId}) but has no audience constraint. Re-delegations MUST include an audience constraint (KYA-OS §11.6)`,
+            };
+        }
+        if (!previousDelegation || !previousCredential) {
+            if (delegation.parentId) {
+                return {
+                    valid: false,
+                    reason: `Resolved delegation chain is incomplete: root delegation ${delegation.id} still references parent ${delegation.parentId}`,
+                };
+            }
+            previousDelegation = delegation;
+            previousCredential = credential;
+            continue;
+        }
+        if (delegation.parentId !== previousDelegation.id) {
+            return {
+                valid: false,
+                reason: `Delegation ${delegation.id} references parent ${delegation.parentId} but expected ${previousDelegation.id}`,
+            };
+        }
+        if (delegation.issuerDid !== previousDelegation.subjectDid) {
+            return {
+                valid: false,
+                reason: `Delegation ${delegation.id} issued by ${delegation.issuerDid} but parent subject is ${previousDelegation.subjectDid}`,
+            };
+        }
+        const scopeValidation = validateScopeAttenuation(previousCredential, credential);
+        if (!scopeValidation.valid) {
+            return scopeValidation;
+        }
+        previousDelegation = delegation;
+        previousCredential = credential;
+    }
+    const finalDelegation = extractDelegationFromVC(chain[chain.length - 1]);
+    if (finalDelegation.id !== leafDelegation.id) {
+        return {
+            valid: false,
+            reason: `Resolved delegation chain ended at ${finalDelegation.id} instead of leaf ${leafDelegation.id}`,
+        };
+    }
+    // E3.1: graph-backed ancestor revocation. Independent of how the chain above
+    // was resolved — catches a cascade-revoked ANCESTOR even when the leaf's own
+    // credentialStatus bit was never flipped. Opt-in: only runs when a checker is
+    // wired, so existing callers are unaffected.
+    if (deps.revocationChecker) {
+        const revocation = await deps.revocationChecker.isRevoked(leafDelegation.id);
+        if (revocation.revoked) {
+            return {
+                valid: false,
+                reason: revocation.revokedAncestor
+                    ? `Delegation ${leafDelegation.id} is revoked via ancestor ${revocation.revokedAncestor}`
+                    : `Delegation ${leafDelegation.id} is revoked${revocation.reason ? `: ${revocation.reason}` : ""}`,
+            };
+        }
+    }
+    return { valid: true };
+}
+//# sourceMappingURL=chain-enforcement.js.map

package/dist/delegation/chain-enforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain-enforcement.js","sourceRoot":"","sources":["../../src/delegation/chain-enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,uBAAuB,GAGxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAEnE,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,UAAgC;IAClE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACzE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QACtF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,gBAAsC,EACtC,eAAqC;IAErC,MAAM,YAAY,GAAG,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,eAAe,CAAC,iBAAiB,CAAC,UAAU,CAAC;IAErE,wFAAwF;IACxF,4EAA4E;IAC5E,mFAAmF;IACnF,oFAAoF;IACpF,MAAM,QAAQ,GAAG,CAAC,CAAwC,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzG,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC9F,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,eAAe,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAC3E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CACrC,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,cAAc,eAAe,CAAC,EAAE,yDAAyD,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,YAAY;iBAC/J,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;iBACxC,IAAI,CAAC,IAAI,CAAC,EAAE;SAChB,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,cAAc,eAAe,CAAC,EAAE,2DAA2D,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,EAAE;SACtJ,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAChF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,cAAc,eAAe,CAAC,EAAE,gCAAgC,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACxJ,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAuDD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,cAAoC,EACpC,IAA0B,EAC1B,OAAqC;IAErC,8EAA8E;IAC9E,iFAAiF;IACjF,qDAAqD;IACrD,gFAAgF;IAChF,MAAM,iBAAiB,GACrB,cAAc,EAAE,iBAGjB,EAAE,UAAU,CAAC;IACd,IACE,CAAC,iBAAiB;QAClB,OAAO,iBAAiB,KAAK,QAAQ;QACrC,CAAC,iBAAiB,CAAC,WAAW;QAC9B,OAAO,iBAAiB,CAAC,WAAW,KAAK,QAAQ,EACjD,CAAC;QACD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EACJ,0FAA0F;SAC7F,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;IAC/D,IAAI,KAAK,GAA2B,CAAC,cAAc,CAAC,CAAC;IAErD,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,cAAc,CAAC,EAAE,sBAAsB,cAAc,CAAC,QAAQ,sDAAsD;aAC3I,CAAC;QACJ,CAAC;QAED,IAAI,aAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;aAC1G,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,cAAc,CAAC,EAAE,sBAAsB,cAAc,CAAC,QAAQ,kCAAkC;aACvH,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CACvC,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,CACnE,CAAC;QACF,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,KAAK,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,iCAAiC,cAAc,CAAC,EAAE,oCAAoC;aAC/F,CAAC;QACJ,CAAC;QAED,KAAK,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IAChF,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,kBAAgD,CAAC;IACrD,IAAI,kBAAoD,CAAC;IAEzD,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAEvD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,qDAAqD,UAAU,CAAC,EAAE,EAAE;aAC7E,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE3B,IAAI,UAAU,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,+DAA+D;aACnG,CAAC;QACJ,CAAC;QAED,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAC3E,UAAU,EACV;YACE,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CACF,CAAC;QACF,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,CAAC;YAClC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,aAAa,sBAAsB,CAAC,MAAM,EAAE;aAChF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,wBAAwB,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,yCAAyC,IAAI,CAAC,SAAS,EAAE;aAC7F,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,4EAA4E;QAC5E,uEAAuE;QACvE,6CAA6C;QAC7C,IAAI,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;YAC5D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,kCAAkC,UAAU,CAAC,QAAQ,qGAAqG;aAC9L,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,kBAAkB,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/C,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,4DAA4D,UAAU,CAAC,EAAE,4BAA4B,UAAU,CAAC,QAAQ,EAAE;iBACnI,CAAC;YACJ,CAAC;YAED,kBAAkB,GAAG,UAAU,CAAC;YAChC,kBAAkB,GAAG,UAAU,CAAC;YAChC,SAAS;QACX,CAAC;QAED,IAAI,UAAU,CAAC,QAAQ,KAAK,kBAAkB,CAAC,EAAE,EAAE,CAAC;YAClD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,sBAAsB,UAAU,CAAC,QAAQ,iBAAiB,kBAAkB,CAAC,EAAE,EAAE;aACrH,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAC,SAAS,KAAK,kBAAkB,CAAC,UAAU,EAAE,CAAC;YAC3D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,cAAc,UAAU,CAAC,EAAE,cAAc,UAAU,CAAC,SAAS,0BAA0B,kBAAkB,CAAC,UAAU,EAAE;aAC/H,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,wBAAwB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;QACjF,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,kBAAkB,GAAG,UAAU,CAAC;QAChC,kBAAkB,GAAG,UAAU,CAAC;IAClC,CAAC;IAED,MAAM,eAAe,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAC;IAC1E,IAAI,eAAe,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,EAAE,CAAC;QAC7C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,sCAAsC,eAAe,CAAC,EAAE,oBAAoB,cAAc,CAAC,EAAE,EAAE;SACxG,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,6CAA6C;IAC7C,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAC7E,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,UAAU,CAAC,eAAe;oBAChC,CAAC,CAAC,cAAc,cAAc,CAAC,EAAE,4BAA4B,UAAU,CAAC,eAAe,EAAE;oBACzF,CAAC,CAAC,cAAc,cAAc,CAAC,EAAE,cAAc,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACrG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC"}

package/dist/delegation/holder-binding.d.ts

@@ -0,0 +1,128 @@
+/**
+ * Holder binding — enforce that a request proof is bound to the delegation subject.
+ *
+ * A delegation credential names a subject DID and grants it authority. On its
+ * own that credential is a *bearer* token: anyone who obtains the string can
+ * present it. Holder binding closes that gap (spec §11.8 theft-replay residual)
+ * by requiring the caller to prove possession of the subject DID's key on the
+ * request itself.
+ *
+ * For a `did:key` subject the proof is exact and needs no new credential fields:
+ * the DID *is* the public key, so "the proof verifies against the subject DID's
+ * key" is equivalent to "the caller holds the subject's private key". This module
+ * derives the subject key straight from the DID and verifies the request proof
+ * against it. A proof signed by any other key — a thief replaying a stolen
+ * credential — cannot verify and is rejected.
+ *
+ * `did:web` (and other non-`did:key`) subjects do not encode their key in the
+ * DID and may rotate or hold several keys, so phase-1 cannot pin "the" key for
+ * them. They are reported {@link HolderBindingStatus | not_applicable} so the
+ * caller can defer them to cnf-based binding (phase 2) instead of rejecting
+ * legitimate traffic. Callers MUST surface that gap (e.g. log it) rather than
+ * treat `not_applicable` as success.
+ */
+import type { ProofVerifier } from '../proof/verifier.js';
+import type { ToolRequest, ToolResponse, ProofAgentIdentity } from '../proof/generator.js';
+import type { DetachedProof } from '../types/protocol.js';
+import type { CryptoProvider } from '../providers/base.js';
+/**
+ * Whether an argument key is reserved KYA-OS protocol envelope (`_kyaos*`:
+ * `_kyaos_delegation`, `_kyaos_proof`, `_kyaos_approvals`, …) rather than caller
+ * tool intent. The SINGLE predicate behind both the holder-binding request hash
+ * and the middleware's handler-arg stripping, so the set excluded from the bound
+ * hash and the set withheld from the handler cannot drift — a proof binds exactly
+ * the call the handler runs.
+ */
+export declare function isKyaOsControlArg(key: string): boolean;
+/**
+ * The canonical request a holder-binding proof binds: the tool name plus the
+ * caller's business arguments, with protocol control args stripped. SHARED by
+ * the client (when minting the proof) and the PEP (when verifying it) so the two
+ * cannot drift — the request hash is computed over the identical shape on both
+ * sides regardless of which control args rode along.
+ */
+export declare function toHolderBindingRequest(toolName: string, args: Record<string, unknown>): ToolRequest;
+export interface GenerateRequestProofInput {
+    /** The agent (delegation subject) identity holding the signing key. */
+    identity: ProofAgentIdentity;
+    /** Crypto provider used to sign and to mint the per-request nonce. */
+    crypto: CryptoProvider;
+    /** The tool being called. */
+    toolName: string;
+    /** The tool arguments (control args are stripped before binding). */
+    args: Record<string, unknown>;
+    /** The server DID the call is addressed to. */
+    audience: string;
+    /** The handshake session id, when one exists. */
+    sessionId?: string;
+}
+/**
+ * Mint the `_kyaos_proof` a key-bearing agent attaches to an outbound tool call
+ * — the client half of holder binding. It is a request-only detached proof (no
+ * response yet) signed by the agent's key over {@link toHolderBindingRequest}.
+ * A fresh nonce is generated per call so the PEP's replay cache rejects reuse.
+ */
+export declare function generateRequestProof(input: GenerateRequestProofInput): Promise<DetachedProof>;
+/**
+ * Stable, client-facing error code for a failed holder binding. Distinct from
+ * the verifier's granular codes (which are kept in {@link HolderBindingResult.cause}
+ * for server-side diagnosis) so a binding failure presents one reason to callers
+ * and never leaks why the proof was rejected.
+ */
+export declare const HOLDER_BINDING_ERROR = "holder_binding_failed";
+/**
+ * - `bound` — subject is a did:key and the proof verifies against its key: the
+ *   caller is the holder. Allow.
+ * - `unbound` — subject is a did:key but the proof failed (wrong key, tampered
+ *   request, stale, or replayed). Reject — this is the theft-replay closure.
+ * - `not_applicable` — subject is not a did:key, so phase-1 cannot bind it.
+ *   Defer to cnf-based binding (phase 2); the caller decides how to treat it.
+ */
+export type HolderBindingStatus = 'bound' | 'unbound' | 'not_applicable';
+/**
+ * Whether phase-1 holder binding can bind this subject. True only for did:key
+ * (the DID encodes the key). The PEP uses this to decide between *enforcing* a
+ * proof (did:key) and *deferring* to cnf binding (did:web and others), so it
+ * never rejects legitimate traffic it cannot yet bind.
+ */
+export declare function isHolderBindingApplicable(subjectDid: string): boolean;
+export interface AssertHolderBindingInput {
+    /** The per-request detached proof presented by the caller. */
+    proof: DetachedProof;
+    /** The delegation subject DID the proof must be bound to. */
+    subjectDid: string;
+    /** The request the proof must bind (content binding). */
+    request: ToolRequest;
+    /**
+     * The response the proof binds, when the proof carries one. Inbound request
+     * proofs are request-only and omit this.
+     */
+    response?: ToolResponse;
+    /**
+     * The audience the proof must be addressed to — the recipient server's DID
+     * (RFC 8707 "to-whom" binding). When set, `proof.meta.audience` must equal it
+     * (or be one of the array, for DID rotation / multi-DID servers); a proof
+     * minted for another server is rejected, closing confused-deputy replay across
+     * servers. Omit to skip the audience check (back-compatible).
+     */
+    expectedAudience?: string | string[];
+    /** The existing verifier — supplies signature, nonce, timestamp and content checks. */
+    proofVerifier: ProofVerifier;
+}
+export interface HolderBindingResult {
+    status: HolderBindingStatus;
+    /** Human-readable explanation (present whenever status is not `bound`). */
+    reason?: string;
+    /** {@link HOLDER_BINDING_ERROR} when status is `unbound`. */
+    errorCode?: typeof HOLDER_BINDING_ERROR;
+    /** Underlying verifier error code, for server-side diagnosis only. */
+    cause?: string;
+}
+/**
+ * Assert that `proof` is a holder-of-key proof for `subjectDid` over `request`.
+ *
+ * @see module documentation for the did:key / did:web split and the security
+ *   property each branch enforces.
+ */
+export declare function assertHolderBinding(input: AssertHolderBindingInput): Promise<HolderBindingResult>;
+//# sourceMappingURL=holder-binding.d.ts.map

package/dist/delegation/holder-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"holder-binding.d.ts","sourceRoot":"","sources":["../../src/delegation/holder-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAU3D;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,WAAW,CAMb;AAED,MAAM,WAAW,yBAAyB;IACxC,uEAAuE;IACvE,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,sEAAsE;IACtE,MAAM,EAAE,cAAc,CAAC;IACvB,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,aAAa,CAAC,CAgBxB;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAEzE;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAErE;AAED,MAAM,WAAW,wBAAwB;IACvC,8DAA8D;IAC9D,KAAK,EAAE,aAAa,CAAC;IACrB,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,OAAO,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACrC,uFAAuF;IACvF,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,OAAO,oBAAoB,CAAC;IACxC,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CA4E9B"}

package/dist/delegation/holder-binding.js

@@ -0,0 +1,175 @@
+/**
+ * Holder binding — enforce that a request proof is bound to the delegation subject.
+ *
+ * A delegation credential names a subject DID and grants it authority. On its
+ * own that credential is a *bearer* token: anyone who obtains the string can
+ * present it. Holder binding closes that gap (spec §11.8 theft-replay residual)
+ * by requiring the caller to prove possession of the subject DID's key on the
+ * request itself.
+ *
+ * For a `did:key` subject the proof is exact and needs no new credential fields:
+ * the DID *is* the public key, so "the proof verifies against the subject DID's
+ * key" is equivalent to "the caller holds the subject's private key". This module
+ * derives the subject key straight from the DID and verifies the request proof
+ * against it. A proof signed by any other key — a thief replaying a stolen
+ * credential — cannot verify and is rejected.
+ *
+ * `did:web` (and other non-`did:key`) subjects do not encode their key in the
+ * DID and may rotate or hold several keys, so phase-1 cannot pin "the" key for
+ * them. They are reported {@link HolderBindingStatus | not_applicable} so the
+ * caller can defer them to cnf-based binding (phase 2) instead of rejecting
+ * legitimate traffic. Callers MUST surface that gap (e.g. log it) rather than
+ * treat `not_applicable` as success.
+ */
+import { extractPublicKeyFromDidKey, publicKeyToJwk } from './did-key-resolver.js';
+import { getDidMethod, didKeyFragment } from '../utils/did-helpers.js';
+import { ProofGenerator } from '../proof/generator.js';
+import { base64urlEncodeFromBytes } from '../utils/base64.js';
+/**
+ * The control-arg key prefix. Args beginning with this are protocol envelope
+ * (`_kyaos_delegation`, `_kyaos_proof`, `_kyaos_approvals`), not the caller's
+ * tool intent, so they are excluded from the holder-binding request hash.
+ */
+const KYAOS_CONTROL_PREFIX = '_kyaos';
+/**
+ * Whether an argument key is reserved KYA-OS protocol envelope (`_kyaos*`:
+ * `_kyaos_delegation`, `_kyaos_proof`, `_kyaos_approvals`, …) rather than caller
+ * tool intent. The SINGLE predicate behind both the holder-binding request hash
+ * and the middleware's handler-arg stripping, so the set excluded from the bound
+ * hash and the set withheld from the handler cannot drift — a proof binds exactly
+ * the call the handler runs.
+ */
+export function isKyaOsControlArg(key) {
+    return key.startsWith(KYAOS_CONTROL_PREFIX);
+}
+/**
+ * The canonical request a holder-binding proof binds: the tool name plus the
+ * caller's business arguments, with protocol control args stripped. SHARED by
+ * the client (when minting the proof) and the PEP (when verifying it) so the two
+ * cannot drift — the request hash is computed over the identical shape on both
+ * sides regardless of which control args rode along.
+ */
+export function toHolderBindingRequest(toolName, args) {
+    const params = {};
+    for (const [k, v] of Object.entries(args)) {
+        if (!isKyaOsControlArg(k))
+            params[k] = v;
+    }
+    return { method: toolName, params };
+}
+/**
+ * Mint the `_kyaos_proof` a key-bearing agent attaches to an outbound tool call
+ * — the client half of holder binding. It is a request-only detached proof (no
+ * response yet) signed by the agent's key over {@link toHolderBindingRequest}.
+ * A fresh nonce is generated per call so the PEP's replay cache rejects reuse.
+ */
+export async function generateRequestProof(input) {
+    const { identity, crypto, toolName, args, audience, sessionId } = input;
+    const generator = new ProofGenerator(identity, crypto);
+    const request = toHolderBindingRequest(toolName, args);
+    const nonce = base64urlEncodeFromBytes(await crypto.randomBytes(16));
+    const now = Math.floor(Date.now() / 1000);
+    return generator.generateProof(request, undefined, {
+        sessionId: sessionId ?? '',
+        audience,
+        nonce,
+        timestamp: now,
+        createdAt: now,
+        lastActivity: now,
+        ttlMinutes: 30,
+        identityState: 'anonymous',
+    });
+}
+/**
+ * Stable, client-facing error code for a failed holder binding. Distinct from
+ * the verifier's granular codes (which are kept in {@link HolderBindingResult.cause}
+ * for server-side diagnosis) so a binding failure presents one reason to callers
+ * and never leaks why the proof was rejected.
+ */
+export const HOLDER_BINDING_ERROR = 'holder_binding_failed';
+/**
+ * Whether phase-1 holder binding can bind this subject. True only for did:key
+ * (the DID encodes the key). The PEP uses this to decide between *enforcing* a
+ * proof (did:key) and *deferring* to cnf binding (did:web and others), so it
+ * never rejects legitimate traffic it cannot yet bind.
+ */
+export function isHolderBindingApplicable(subjectDid) {
+    return extractPublicKeyFromDidKey(subjectDid) !== null;
+}
+/**
+ * Assert that `proof` is a holder-of-key proof for `subjectDid` over `request`.
+ *
+ * @see module documentation for the did:key / did:web split and the security
+ *   property each branch enforces.
+ */
+export async function assertHolderBinding(input) {
+    const { proof, subjectDid, request, response, expectedAudience, proofVerifier } = input;
+    // Phase-1 scope: did:key subjects only — the DID encodes the key, so holding
+    // the key is being the subject. Anything else is deferred to cnf binding.
+    const subjectKeyBytes = extractPublicKeyFromDidKey(subjectDid);
+    if (!subjectKeyBytes) {
+        return {
+            status: 'not_applicable',
+            reason: `Holder binding (phase 1) covers did:key subjects only; ` +
+                `"${getDidMethod(subjectDid) ?? 'unknown'}" is deferred to cnf-based binding`,
+        };
+    }
+    // Fail closed on a structurally malformed proof (e.g. the {} a caller
+    // substitutes when a string proof fails to parse) — never throw out of the
+    // gate, which would surface as an internal error instead of a binding failure.
+    if (typeof proof?.meta !== 'object' || proof.meta === null) {
+        return {
+            status: 'unbound',
+            errorCode: HOLDER_BINDING_ERROR,
+            reason: 'Malformed proof: missing meta',
+        };
+    }
+    // Pre-crypto consistency: the proof must self-declare the delegation subject.
+    // Cheap, and gives a precise reason before the signature check.
+    if (proof.meta.did !== subjectDid) {
+        return {
+            status: 'unbound',
+            errorCode: HOLDER_BINDING_ERROR,
+            reason: 'Proof subject does not match the delegation subject',
+        };
+    }
+    // Audience binding (RFC 8707): the proof must be addressed to THIS server. A
+    // proof minted for another server cannot be replayed here. Checked before the
+    // signature so a misdirected proof fails fast without burning its nonce.
+    if (expectedAudience !== undefined) {
+        const allowed = Array.isArray(expectedAudience) ? expectedAudience : [expectedAudience];
+        if (!allowed.includes(proof.meta.audience)) {
+            return {
+                status: 'unbound',
+                errorCode: HOLDER_BINDING_ERROR,
+                reason: 'Proof audience does not match this server',
+                cause: 'audience_mismatch',
+            };
+        }
+    }
+    // The binding itself: verify the proof against the SUBJECT DID's key. The
+    // verifier reconstructs the signed payload from proof.meta (sub/iss = subject),
+    // so a proof signed by any other key cannot verify here — defeating a
+    // stolen-credential replay — and a tampered request fails content binding.
+    // Tag the key with the subject's canonical did:key verification-method id.
+    // The verifier's kid check (publicKeyJwk.kid === proof.meta.kid) then enforces
+    // that the proof's kid is the subject's verification method — a proof citing
+    // any other kid is rejected before the signature is even checked. The key
+    // material (x) still comes from the DID, so the signature is the real binding.
+    const subjectKey = publicKeyToJwk(subjectKeyBytes);
+    subjectKey.kid = `${subjectDid}#${didKeyFragment(subjectDid)}`;
+    const verification = await proofVerifier.verifyProof(proof, subjectKey, {
+        request,
+        ...(response !== undefined ? { response } : {}),
+    });
+    if (!verification.valid) {
+        return {
+            status: 'unbound',
+            errorCode: HOLDER_BINDING_ERROR,
+            reason: 'Request proof is not bound to the delegation subject',
+            ...(verification.errorCode !== undefined ? { cause: verification.errorCode } : {}),
+        };
+    }
+    return { status: 'bound' };
+}
+//# sourceMappingURL=holder-binding.js.map

package/dist/delegation/holder-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"holder-binding.js","sourceRoot":"","sources":["../../src/delegation/holder-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,0BAA0B,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAO9D;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAEtC;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO,GAAG,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,IAA6B;IAE7B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAiBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAgC;IAEhC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,OAAO,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE;QACjD,SAAS,EAAE,SAAS,IAAI,EAAE;QAC1B,QAAQ;QACR,KAAK;QACL,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;QACd,YAAY,EAAE,GAAG;QACjB,UAAU,EAAE,EAAE;QACd,aAAa,EAAE,WAAW;KAC3B,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAY5D;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,OAAO,0BAA0B,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC;AACzD,CAAC;AAoCD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA+B;IAE/B,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAExF,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,eAAe,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,MAAM,EACJ,yDAAyD;gBACzD,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,SAAS,oCAAoC;SAChF,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,2EAA2E;IAC3E,+EAA+E;IAC/E,IAAI,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3D,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,oBAAoB;YAC/B,MAAM,EAAE,+BAA+B;SACxC,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,gEAAgE;IAChE,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,oBAAoB;YAC/B,MAAM,EAAE,qDAAqD;SAC9D,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,yEAAyE;IACzE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACxF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,oBAAoB;gBAC/B,MAAM,EAAE,2CAA2C;gBACnD,KAAK,EAAE,mBAAmB;aAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,gFAAgF;IAChF,sEAAsE;IACtE,2EAA2E;IAC3E,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,+EAA+E;IAC/E,MAAM,UAAU,GAAG,cAAc,CAAC,eAAe,CAAe,CAAC;IACjE,UAAU,CAAC,GAAG,GAAG,GAAG,UAAU,IAAI,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;IAC/D,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE;QACtE,OAAO;QACP,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,oBAAoB;YAC/B,MAAM,EAAE,sDAAsD;YAC9D,GAAG,CAAC,YAAY,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}

package/dist/delegation/index.d.ts

@@ -15,6 +15,8 @@ export * from './outbound-proof.js';
 export * from './outbound-headers.js';
 export * from './audience-validator.js';
 export * from './scope-matcher.js';
+export * from './holder-binding.js';
+export * from './chain-enforcement.js';
 export { createDidKeyResolver, resolveDidKeySync, isEd25519DidKey, extractPublicKeyFromDidKey, publicKeyToJwk, } from './did-key-resolver.js';
 export { DidWebResolver, createDidWebResolver, isDidWeb, parseDidWeb, didWebToUrl, buildDidWebDocument, } from './did-web-resolver.js';
 export { MemoryStatusListStorage } from './storage/memory-statuslist-storage.js';

package/dist/delegation/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC"}

package/dist/delegation/index.js

@@ -15,6 +15,8 @@ export * from './outbound-proof.js';
 export * from './outbound-headers.js';
 export * from './audience-validator.js';
 export * from './scope-matcher.js';
+export * from './holder-binding.js';
+export * from './chain-enforcement.js';
 export { createDidKeyResolver, resolveDidKeySync, isEd25519DidKey, extractPublicKeyFromDidKey, publicKeyToJwk, } from './did-key-resolver.js';
 export { DidWebResolver, createDidWebResolver, isDidWeb, parseDidWeb, didWebToUrl, buildDidWebDocument, } from './did-web-resolver.js';
 export { MemoryStatusListStorage } from './storage/memory-statuslist-storage.js';

package/dist/delegation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC"}

package/dist/errors.d.ts

@@ -24,6 +24,7 @@ export declare const KYA_OS_ERROR_CODES: {
     readonly delegation_not_yet_valid: "delegation_not_yet_valid";
     readonly delegation_revoked: "delegation_revoked";
     readonly delegation_invalid: "delegation_invalid";
+    readonly holder_binding_failed: "holder_binding_failed";
     readonly budget_exceeded: "budget_exceeded";
     readonly rate_limit_exceeded: "rate_limit_exceeded";
     readonly invalid_token: "invalid_token";

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;CAsCrB,CAAC;AAEX,MAAM,MAAM,cAAc,GACxB,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,kBAAkB,CAEpB"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;CAuCrB,CAAC;AAEX,MAAM,MAAM,cAAc,GACxB,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,kBAAkB,CAEpB"}

package/dist/errors.js

@@ -28,6 +28,7 @@ export const KYA_OS_ERROR_CODES = {
     delegation_not_yet_valid: "delegation_not_yet_valid",
     delegation_revoked: "delegation_revoked",
     delegation_invalid: "delegation_invalid",
+    holder_binding_failed: "holder_binding_failed",
     budget_exceeded: "budget_exceeded",
     rate_limit_exceeded: "rate_limit_exceeded",
     // Token errors

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,eAAe;IACf,aAAa,EAAE,eAAe;IAC9B,WAAW,EAAE,aAAa;IAC1B,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;IAEhC,wBAAwB;IACxB,aAAa,EAAE,eAAe;IAC9B,kBAAkB,EAAE,oBAAoB;IAExC,6BAA6B;IAC7B,gBAAgB,EAAE,kBAAkB;IACpC,eAAe,EAAE,iBAAiB;IAClC,eAAe,EAAE,iBAAiB;IAElC,oBAAoB;IACpB,mBAAmB,EAAE,qBAAqB;IAC1C,kBAAkB,EAAE,oBAAoB;IACxC,aAAa,EAAE,eAAe;IAC9B,kBAAkB,EAAE,oBAAoB;IACxC,wBAAwB,EAAE,0BAA0B;IACpD,kBAAkB,EAAE,oBAAoB;IACxC,kBAAkB,EAAE,oBAAoB;IACxC,eAAe,EAAE,iBAAiB;IAClC,mBAAmB,EAAE,qBAAqB;IAE1C,eAAe;IACf,aAAa,EAAE,eAAe;IAC9B,aAAa,EAAE,eAAe;IAE9B,kBAAkB;IAClB,cAAc,EAAE,gBAAgB;IAChC,YAAY,EAAE,cAAc;IAE5B,gBAAgB;IAChB,mBAAmB,EAAE,qBAAqB;IAC1C,aAAa,EAAE,eAAe;CACtB,CAAC;AAWX,MAAM,UAAU,gBAAgB,CAC9B,IAAoB,EACpB,OAAe,EACf,OAAiC;IAEjC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAClE,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,eAAe;IACf,aAAa,EAAE,eAAe;IAC9B,WAAW,EAAE,aAAa;IAC1B,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;IAEhC,wBAAwB;IACxB,aAAa,EAAE,eAAe;IAC9B,kBAAkB,EAAE,oBAAoB;IAExC,6BAA6B;IAC7B,gBAAgB,EAAE,kBAAkB;IACpC,eAAe,EAAE,iBAAiB;IAClC,eAAe,EAAE,iBAAiB;IAElC,oBAAoB;IACpB,mBAAmB,EAAE,qBAAqB;IAC1C,kBAAkB,EAAE,oBAAoB;IACxC,aAAa,EAAE,eAAe;IAC9B,kBAAkB,EAAE,oBAAoB;IACxC,wBAAwB,EAAE,0BAA0B;IACpD,kBAAkB,EAAE,oBAAoB;IACxC,kBAAkB,EAAE,oBAAoB;IACxC,qBAAqB,EAAE,uBAAuB;IAC9C,eAAe,EAAE,iBAAiB;IAClC,mBAAmB,EAAE,qBAAqB;IAE1C,eAAe;IACf,aAAa,EAAE,eAAe;IAC9B,aAAa,EAAE,eAAe;IAE9B,kBAAkB;IAClB,cAAc,EAAE,gBAAgB;IAChC,YAAY,EAAE,cAAc;IAE5B,gBAAgB;IAChB,mBAAmB,EAAE,qBAAqB;IAC1C,aAAa,EAAE,eAAe;CACtB,CAAC;AAWX,MAAM,UAAU,gBAAgB,CAC9B,IAAoB,EACpB,OAAe,EACf,OAAiC;IAEjC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAClE,CAAC"}

package/dist/index.d.ts

@@ -28,6 +28,7 @@ export { verifyDelegationAudience, } from './delegation/audience-validator.js';
 export { buildDelegationProofJWT, buildChainString, type DelegationProofOptions, type Ed25519PrivateJWK, } from './delegation/outbound-proof.js';
 export { buildOutboundDelegationHeaders, OUTBOUND_HEADER_NAMES, type OutboundDelegationContext, type OutboundDelegationHeaders, } from './delegation/outbound-headers.js';
 export { canonicalizeJSON, createUnsignedVCJWT, completeVCJWT, parseVCJWT, type VCJWTHeader, type VCJWTPayload, } from './delegation/utils.js';
+export { assertHolderBinding, generateRequestProof, toHolderBindingRequest, isHolderBindingApplicable, isKyaOsControlArg, HOLDER_BINDING_ERROR, type AssertHolderBindingInput, type GenerateRequestProofInput, type HolderBindingResult, type HolderBindingStatus, } from './delegation/holder-binding.js';
 export { MemoryStatusListStorage } from './delegation/storage/memory-statuslist-storage.js';
 export { MemoryDelegationGraphStorage } from './delegation/storage/memory-graph-storage.js';
 export { createDidKeyResolver, resolveDidKeySync, isEd25519DidKey, extractPublicKeyFromDidKey, publicKeyToJwk, } from './delegation/did-key-resolver.js';
@@ -43,7 +44,7 @@ export { CryptoProvider, ClockProvider, FetchProvider, StorageProvider, NonceCac
 export { MemoryStorageProvider, MemoryNonceCacheProvider, MemoryIdentityProvider, } from './providers/memory.js';
 export { NodeCryptoProvider } from './providers/node-crypto.js';
 export { SystemClockProvider } from './providers/system-clock.js';
-export { RuntimeFetchProvider } from './providers/runtime-fetch.js';
+export { RuntimeFetchProvider, NoopFetchProvider } from './providers/runtime-fetch.js';
 export { AuditLogProvider, MemoryAuditLogProvider, NoopAuditLogProvider, buildAuditRecord, } from './providers/audit-log.js';
 export { createKyaOsMiddleware, type KyaOsConfig, type KyaOsDelegationConfig, type KyaOsIdentityConfig, type KyaOsMiddleware, type KyaOsToolDefinition, type KyaOsToolHandler, type KyaOsServer, withKyaOs, generateIdentity, type WithKyaOsOptions, } from './middleware/index.js';
 export * from './policy/index.js';