@kya-os/mcp 1.6.0 → 1.7.0

package/CHANGELOG.md

@@ -7,6 +7,69 @@ Versioning: https://semver.org/spec/v2.0.0.html
 
 ## [Unreleased]
 
+## [1.7.0] - 2026-06-17
+
+Durable consent persistence. Pluggable `GrantStore` / `PendingFlowStore` /
+`SessionStore` seams so consent, grant, and PKCE state survive restarts and
+resolve across load-balanced instances — the holder-of-key (`getByAgent`)
+no-paste retry, with session-bearer (`getBySession`) as a fallback. The detached
+proof is namespaced under `_meta["org.kya-os/proof"]` and still dual-emitted
+under the legacy bare key (ON for all of 1.x, dropped at 2.0). Additive over
+1.6.x, with one documented behavioral change: a `strict` verifier now ignores
+MCP-reserved foreign `_meta` keys instead of rejecting them.
+
+### Added
+
+- **Durable consent persistence (optional, in-memory defaults — no breaking
+  change).** New pluggable seams so consent / grant / PKCE state survives
+  restarts and resolves across load-balanced instances: `grantStore` (the
+  no-paste retry — holder-of-key `getByAgent` first, then session-bearer
+  `getBySession`), `PendingFlowStore` (durable OAuth/OIDC PKCE state with an
+  atomic `consume()`), and an optional `SessionStore`. The detached proof is now
+  namespaced under `_meta["org.kya-os/proof"]`; the legacy bare `proof` key is
+  still accepted on verify and (by default) still emitted — toggle with
+  `emitLegacyProofKey`. The legacy mirror stays **ON by default for the entire
+  1.x line** (a pre-1.1 reader of bare `_meta.proof` would otherwise silently get
+  no proof; the cost is ~1.5 KB of `_meta`, which is outside the response hash)
+  and will be **dropped at 2.0**.
+
+### Changed
+
+- **BEHAVIORAL — `strict` `metaPolicy` now IGNORES foreign `_meta` keys instead
+  of rejecting them.** Previously a `strict` verifier rejected any `_meta` key
+  other than the proof. Under MCP 2026-07-28 (SEP-414) `_meta` legitimately
+  carries reserved `io.modelcontextprotocol/*` and W3C trace-context keys
+  (`traceparent`/`tracestate`/`baggage`), so `strict` now ignores every
+  non-KYA-OS key (never hashed, trusted, or rejected) and `allow-extensions`
+  additionally surfaces them. The zero-trust boundary is unchanged — only the
+  KYA-OS proof key is ever hashed or trusted. **Migration:** anyone relying on
+  `strict` to REJECT foreign `_meta` keys must now enforce that themselves; the
+  verifier no longer fails on them.
+
+### Fixed
+
+- **Appendix A error codes corrected** to match `src/errors.ts`, the single
+  source of truth. The table listed prefixed codes (`KYA_OS_EHANDSHAKE`,
+  `KYA_OS_EPROOF`, ...) that no part of the codebase emits; the runtime,
+  middleware, and session manager all return bare snake_case codes
+  (`handshake_failed`, `invalid_proof`, ...). Documentation only — no behaviour
+  change.
+
+## [1.6.1] - 2026-06-10
+
+Releases the schema-host migration already merged on `main` (it was unshipped:
+`1.6.0` still carried the prior host). Schema-only; no code or API changes.
+
+### Changed
+
+- **Schema `$id` and JSON-LD `@context` hosts migrated** to the DIF-registered
+  `schema.kya-os.org` — now live. All five shipped JSON Schemas
+  (`schemas/*.json`), the spec's context references, and the
+  `DELEGATION_CREDENTIAL_CONTEXT` constant resolve under `schema.kya-os.org`.
+  The prior `schema.kya-os.ai` host served the same documents during the
+  migration window; no `$id` is 301-redirected. Consumers that pinned a
+  `schema.kya-os.ai` `$id` should update to `schema.kya-os.org`.
+
 ## [1.6.0] - 2026-06-03
 
 Advances the E3 verifier-consolidation groundwork and hardens the delegation

package/README.md

@@ -140,6 +140,15 @@ Also available: [outbound-delegation](./examples/outbound-delegation/) (gateway
 | **Replay prevention** | Nonce-based handshake with timestamp skew validation |
 | **Extensible** | Bring your own KMS, HSM, nonce cache (Redis, DynamoDB, KV), or DID method |
 
+### Multi-instance deployments
+
+The in-memory defaults are **single-process only**. For a load-balanced /
+multi-instance deployment, inject a durable Redis / Durable Object / DB-backed
+implementation for **every** runtime-state seam — the nonce cache
+(`NonceCacheProvider`) together with the consent stores (`GrantStore`,
+`PendingFlowStore`, `SessionStore`) — so replay protection, grants, pending OAuth
+flows, and sessions are shared across instances and survive restarts.
+
 ---
 
 ## Links

package/dist/authz/index.d.ts

@@ -14,6 +14,7 @@ export { buildAuthorizeUrl, type AuthorizeUrlParams } from './oidc/authorize.js'
 export { buildAuthorizationServerMetadata, buildProtectedResourceMetadata, type AuthorizationServerMetadata, type AuthorizationServerMetadataInput, type ProtectedResourceMetadata, type ProtectedResourceMetadataInput, } from './oidc/metadata.js';
 export { isS256ChallengeMethod, computeS256Challenge, verifyS256Challenge, type S256, } from './oidc/pkce.js';
 export { GenericOidcAdapter, type GenericOidcAdapterConfig, type FetchImpl, } from './oidc/oidc-adapter.js';
+export { PendingFlowStore, MemoryPendingFlowStore, type PendingFlow, type MemoryPendingFlowStoreOptions, } from './oidc/pending-flow-store.js';
 export { AuthorizationServerRegistry } from './registry.js';
 export { projectAccountability, accountabilityToPolicyPrincipal, type AccountabilityContext, } from './accountability.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/authz/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authz/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,KAAK,wBAAwB,EAC7B,KAAK,cAAc,GACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,UAAU,GAChB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEjF,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,EACrC,KAAK,yBAAyB,EAC9B,KAAK,8BAA8B,GACpC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,IAAI,GACV,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,KAAK,SAAS,GACf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAE5D,OAAO,EACL,qBAAqB,EACrB,+BAA+B,EAC/B,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authz/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,KAAK,wBAAwB,EAC7B,KAAK,cAAc,GACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,UAAU,GAChB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEjF,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,EACrC,KAAK,yBAAyB,EAC9B,KAAK,8BAA8B,GACpC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,IAAI,GACV,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,KAAK,SAAS,GACf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,KAAK,WAAW,EAChB,KAAK,6BAA6B,GACnC,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAE5D,OAAO,EACL,qBAAqB,EACrB,+BAA+B,EAC/B,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC"}

package/dist/authz/index.js

@@ -14,6 +14,7 @@ export { buildAuthorizeUrl } from './oidc/authorize.js';
 export { buildAuthorizationServerMetadata, buildProtectedResourceMetadata, } from './oidc/metadata.js';
 export { isS256ChallengeMethod, computeS256Challenge, verifyS256Challenge, } from './oidc/pkce.js';
 export { GenericOidcAdapter, } from './oidc/oidc-adapter.js';
+export { PendingFlowStore, MemoryPendingFlowStore, } from './oidc/pending-flow-store.js';
 export { AuthorizationServerRegistry } from './registry.js';
 export { projectAccountability, accountabilityToPolicyPrincipal, } from './accountability.js';
 //# sourceMappingURL=index.js.map

package/dist/authz/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authz/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,GAGrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,yBAAyB,GAG1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAC;AAEjF,OAAO,EACL,gCAAgC,EAChC,8BAA8B,GAK/B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,kBAAkB,GAGnB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAE5D,OAAO,EACL,qBAAqB,EACrB,+BAA+B,GAEhC,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authz/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,GAGrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,yBAAyB,GAG1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAC;AAEjF,OAAO,EACL,gCAAgC,EAChC,8BAA8B,GAK/B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,kBAAkB,GAGnB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,gBAAgB,EAChB,sBAAsB,GAGvB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAE5D,OAAO,EACL,qBAAqB,EACrB,+BAA+B,GAEhC,MAAM,qBAAqB,CAAC"}

package/dist/authz/oidc/oidc-adapter.d.ts

@@ -2,6 +2,7 @@ import { type NeedsAuthorizationError } from '../../types/protocol.js';
 import type { VerifyDelegationResult } from '../../auth/types.js';
 import type { AuthorizationServerAdapter, FlowParams } from '../adapter.js';
 import type { ToolProtection } from '../requirement.js';
+import { type PendingFlowStore } from './pending-flow-store.js';
 /** A minimal fetch signature — the injectable seam for IdP HTTP calls. */
 export type FetchImpl = (url: string, init?: {
     method?: string;
@@ -22,6 +23,13 @@ export interface GenericOidcAdapterConfig {
     resumeTokenTtlMs?: number;
     /** Injected fetch seam; defaults to the runtime global fetch. */
     fetchImpl?: FetchImpl;
+    /**
+     * Pluggable store for in-flight PKCE state. Defaults to an in-memory store
+     * (single-process only). Inject a durable {@link PendingFlowStore} (Redis /
+     * Durable Object / DB) so an authorization callback that lands on another
+     * instance — or after a restart — can still complete the token exchange.
+     */
+    pendingFlowStore?: PendingFlowStore;
 }
 /**
  * Reference generic-OIDC authorization-server adapter.
@@ -40,13 +48,13 @@ export interface GenericOidcAdapterConfig {
 export declare class GenericOidcAdapter implements AuthorizationServerAdapter {
     private readonly config;
     readonly type: "oauth";
-    private readonly pending;
+    private readonly pendingFlowStore;
     private readonly fetchImpl;
     constructor(config: GenericOidcAdapterConfig);
     isRequired(protection: ToolProtection): boolean;
     initiateFlow(params: FlowParams): Promise<NeedsAuthorizationError>;
     verifyAuthorization(flowState: string, result: unknown): Promise<VerifyDelegationResult>;
     /** Test/inspection seam: the pending code verifier for a resume token, if any. */
-    pendingVerifierFor(resumeToken: string): string | undefined;
+    pendingVerifierFor(resumeToken: string): Promise<string | undefined>;
 }
 //# sourceMappingURL=oidc-adapter.d.ts.map

package/dist/authz/oidc/oidc-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-adapter.d.ts","sourceRoot":"","sources":["../../../src/authz/oidc/oidc-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAI5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,0EAA0E;AAC1E,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,KACxE,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAUD;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAmB,YAAW,0BAA0B;IAKvD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAC1D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;gBAET,MAAM,EAAE,wBAAwB;IAI7D,UAAU,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO;IAIzC,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAsClE,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAqD9F,kFAAkF;IAClF,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAG5D"}
+{"version":3,"file":"oidc-adapter.d.ts","sourceRoot":"","sources":["../../../src/authz/oidc/oidc-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAI5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AAEjC,0EAA0E;AAC1E,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,KACxE,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAKD;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAmB,YAAW,0BAA0B;IAKvD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;gBAET,MAAM,EAAE,wBAAwB;IAK7D,UAAU,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO;IAIzC,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA2ClE,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAwD9F,kFAAkF;IAC5E,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAG3E"}

package/dist/authz/oidc/oidc-adapter.js

@@ -3,6 +3,9 @@ import { createNeedsAuthorizationError, } from '../../types/protocol.js';
 import { requirementMatchesAdapter } from '../adapter.js';
 import { buildAuthorizeUrl } from './authorize.js';
 import { computeS256Challenge } from './pkce.js';
+import { MemoryPendingFlowStore, } from './pending-flow-store.js';
+/** Default resume-token / pending-flow lifetime (10 minutes). */
+const DEFAULT_RESUME_TOKEN_TTL_MS = 600_000;
 /**
  * Reference generic-OIDC authorization-server adapter.
  *
@@ -20,11 +23,12 @@ import { computeS256Challenge } from './pkce.js';
 export class GenericOidcAdapter {
     config;
     type = 'oauth';
-    pending = new Map();
+    pendingFlowStore;
     fetchImpl;
     constructor(config) {
         this.config = config;
         this.fetchImpl = config.fetchImpl ?? ((url, init) => fetch(url, init));
+        this.pendingFlowStore = config.pendingFlowStore ?? new MemoryPendingFlowStore();
     }
     isRequired(protection) {
         return requirementMatchesAdapter(this.type, protection);
@@ -37,13 +41,14 @@ export class GenericOidcAdapter {
         const codeVerifier = randomToken(32);
         const codeChallenge = await computeS256Challenge(codeVerifier);
         const resumeToken = randomToken(24);
-        this.pending.set(resumeToken, {
+        const ttlMs = this.config.resumeTokenTtlMs ?? DEFAULT_RESUME_TOKEN_TTL_MS;
+        await this.pendingFlowStore.put(resumeToken, {
             agentDid: params.agentDid,
             scopes,
             state: params.state,
             codeVerifier,
             redirectUri: params.redirectUri,
-        });
+        }, ttlMs);
         const authorizationUrl = buildAuthorizeUrl({
             authorizationEndpoint: this.config.authorizationEndpoint,
             clientId: this.config.clientId,
@@ -57,12 +62,17 @@ export class GenericOidcAdapter {
             message: `Authorization required for "${params.protection.toolName}".`,
             authorizationUrl,
             resumeToken,
-            expiresAt: nowMs() + (this.config.resumeTokenTtlMs ?? 600_000),
+            expiresAt: nowMs() + ttlMs,
             scopes,
         });
     }
     async verifyAuthorization(flowState, result) {
-        const pending = this.pending.get(flowState);
+        // Atomically consume the pending flow up front: one-time use, so two
+        // concurrent callbacks for the same resume token can't both reach the token
+        // exchange (closes the replay window). The trade-off is that a transient IdP
+        // failure burns the token and the user re-initiates — acceptable, and the
+        // authorization code is itself one-time-use at the IdP.
+        const pending = await this.pendingFlowStore.consume(flowState);
         if (!pending) {
             return { valid: false, reason: 'unknown or expired resume token' };
         }
@@ -99,8 +109,7 @@ export class GenericOidcAdapter {
         catch (error) {
             return { valid: false, reason: `token exchange failed: ${error.message}` };
         }
-        // One-time use: a resume token is consumed on verification.
-        this.pending.delete(flowState);
+        // The flow was already atomically consumed above (one-time use).
         const grantedScopes = token.scope ? token.scope.split(' ') : pending.scopes;
         return {
             valid: true,
@@ -113,8 +122,8 @@ export class GenericOidcAdapter {
         };
     }
     /** Test/inspection seam: the pending code verifier for a resume token, if any. */
-    pendingVerifierFor(resumeToken) {
-        return this.pending.get(resumeToken)?.codeVerifier;
+    async pendingVerifierFor(resumeToken) {
+        return (await this.pendingFlowStore.get(resumeToken))?.codeVerifier;
     }
 }
 function randomToken(byteLength) {

package/dist/authz/oidc/oidc-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-adapter.js","sourceRoot":"","sources":["../../../src/authz/oidc/oidc-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EACL,6BAA6B,GAE9B,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAiCjD;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,kBAAkB;IAKA;IAJpB,IAAI,GAAG,OAAgB,CAAC;IAChB,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IACzC,SAAS,CAAY;IAEtC,YAA6B,MAAgC;QAAhC,WAAM,GAAN,MAAM,CAA0B;QAC3D,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,UAAU,CAAC,UAA0B;QACnC,OAAO,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAkB;QACnC,MAAM,cAAc,GAClB,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO;YAC5C,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACtE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;QAElE,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAC/D,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAEpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE;YAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM;YACN,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY;YACZ,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;YACzC,qBAAqB,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB;YACxD,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM;YACN,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,aAAa;YACb,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;SAC/B,CAAC,CAAC;QAEH,OAAO,6BAA6B,CAAC;YACnC,OAAO,EAAE,+BAA+B,MAAM,CAAC,UAAU,CAAC,QAAQ,IAAI;YACtE,gBAAgB;YAChB,WAAW;YACX,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC;YAC9D,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,SAAiB,EAAE,MAAe;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QACrE,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAsC,CAAC;QAC5E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,OAAO,CAAC,YAAY;SACpC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAElF,IAAI,KAAgD,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE;gBAC/D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAChF,CAAC;YACD,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8C,CAAC;QAC/E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA2B,KAAe,CAAC,OAAO,EAAE,EAAE,CAAC;QACxF,CAAC;QAED,4DAA4D;QAC5D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE/B,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5E,OAAO;YACL,KAAK,EAAE,IAAI;YACX,UAAU,EAAE;gBACV,SAAS,EAAE,OAAO,CAAC,QAAQ;gBAC3B,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,aAAa;gBACrB,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE;aAC3D;SACF,CAAC;IACJ,CAAC;IAED,kFAAkF;IAClF,kBAAkB,CAAC,WAAmB;QACpC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;IACrD,CAAC;CACF;AAED,SAAS,WAAW,CAAC,UAAkB;IACrC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;AACpB,CAAC"}
+{"version":3,"file":"oidc-adapter.js","sourceRoot":"","sources":["../../../src/authz/oidc/oidc-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EACL,6BAA6B,GAE9B,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EACL,sBAAsB,GAEvB,MAAM,yBAAyB,CAAC;AA+BjC,iEAAiE;AACjE,MAAM,2BAA2B,GAAG,OAAO,CAAC;AAE5C;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,kBAAkB;IAKA;IAJpB,IAAI,GAAG,OAAgB,CAAC;IAChB,gBAAgB,CAAmB;IACnC,SAAS,CAAY;IAEtC,YAA6B,MAAgC;QAAhC,WAAM,GAAN,MAAM,CAA0B;QAC3D,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,IAAI,sBAAsB,EAAE,CAAC;IAClF,CAAC;IAED,UAAU,CAAC,UAA0B;QACnC,OAAO,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAkB;QACnC,MAAM,cAAc,GAClB,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO;YAC5C,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACtE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;QAElE,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAC/D,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,2BAA2B,CAAC;QAE1E,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAC7B,WAAW,EACX;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM;YACN,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY;YACZ,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,EACD,KAAK,CACN,CAAC;QAEF,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;YACzC,qBAAqB,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB;YACxD,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM;YACN,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,aAAa;YACb,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;SAC/B,CAAC,CAAC;QAEH,OAAO,6BAA6B,CAAC;YACnC,OAAO,EAAE,+BAA+B,MAAM,CAAC,UAAU,CAAC,QAAQ,IAAI;YACtE,gBAAgB;YAChB,WAAW;YACX,SAAS,EAAE,KAAK,EAAE,GAAG,KAAK;YAC1B,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,SAAiB,EAAE,MAAe;QAC1D,qEAAqE;QACrE,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,wDAAwD;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QACrE,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAsC,CAAC;QAC5E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,OAAO,CAAC,YAAY;SACpC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAElF,IAAI,KAAgD,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE;gBAC/D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAChF,CAAC;YACD,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8C,CAAC;QAC/E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA2B,KAAe,CAAC,OAAO,EAAE,EAAE,CAAC;QACxF,CAAC;QAED,iEAAiE;QACjE,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5E,OAAO;YACL,KAAK,EAAE,IAAI;YACX,UAAU,EAAE;gBACV,SAAS,EAAE,OAAO,CAAC,QAAQ;gBAC3B,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,aAAa;gBACrB,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE;aAC3D;SACF,CAAC;IACJ,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,kBAAkB,CAAC,WAAmB;QAC1C,OAAO,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,YAAY,CAAC;IACtE,CAAC;CACF;AAED,SAAS,WAAW,CAAC,UAAkB;IACrC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;AACpB,CAAC"}

package/dist/authz/oidc/pending-flow-store.d.ts

@@ -0,0 +1,80 @@
+/**
+ * PendingFlowStore — the provider seam for in-flight OAuth/OIDC PKCE state.
+ *
+ * Between {@link GenericOidcAdapter.initiateFlow} (which mints a resume token and
+ * the PKCE `codeVerifier`) and the authorization callback (which exchanges the
+ * code), the verifier must be held server-side keyed by the resume token — it is
+ * never placed on the wire. Holding it in a per-process `Map` breaks the moment a
+ * second instance or a restart enters the picture: if the callback lands on
+ * another instance the verifier is gone, the token exchange fails closed, and no
+ * grant is ever minted.
+ *
+ * This seam mirrors {@link GrantStore} / `NonceCacheProvider`: the in-memory
+ * implementation here is the dev/reference impl; production injects a Redis /
+ * Durable Object / database-backed store behind the same interface so
+ * `initiateFlow` on instance A and the callback on instance B share one verifier.
+ *
+ * `get` (non-consuming read) and `delete` (consume) are kept separate so the
+ * adapter can preserve its one-time-use ordering: it reads the pending flow,
+ * validates `state`, performs the token exchange, and deletes ONLY after the
+ * exchange succeeds — so a transient IdP error does not burn the resume token.
+ *
+ * Production note: a durable backing SHOULD make `delete`-after-exchange atomic
+ * (e.g. Redis `GETDEL`, or a compare-and-set) to close the one-time-use replay
+ * window across instances.
+ */
+/** In-flight authorization state held between initiateFlow and the callback. */
+export interface PendingFlow {
+    agentDid: string;
+    scopes: string[];
+    state: string;
+    codeVerifier: string;
+    redirectUri: string;
+}
+/**
+ * Store for pending (awaiting-callback) OAuth/OIDC PKCE flows. Implementations
+ * persist a flow under a resume token with a TTL, read it back (non-consuming),
+ * consume it after a successful exchange, and sweep expired entries.
+ */
+export declare abstract class PendingFlowStore {
+    /** Persist (or replace) a pending flow under `token`, expiring after `ttlMs`. */
+    abstract put(token: string, flow: PendingFlow, ttlMs: number): Promise<void>;
+    /** Read the pending flow without consuming it (e.g. inspection). */
+    abstract get(token: string): Promise<PendingFlow | undefined>;
+    /**
+     * Atomically read AND remove the pending flow — the one-time-use gate for the
+     * token exchange. Returns the flow if it existed and was not expired, else
+     * undefined; either way the token is gone afterward, so two concurrent
+     * callbacks for the same token can never both proceed (closes the replay
+     * window). Durable backings (Redis / Durable Object / DB) MUST implement this
+     * atomically (e.g. Redis `GETDEL`, or a compare-and-set) — a non-atomic
+     * read-then-delete reopens the window across instances.
+     */
+    abstract consume(token: string): Promise<PendingFlow | undefined>;
+    /** Remove a pending flow without reading it. */
+    abstract delete(token: string): Promise<void>;
+    /** Drop expired entries. */
+    abstract cleanup(): Promise<void>;
+}
+export interface MemoryPendingFlowStoreOptions {
+    /** Clock injection for tests; defaults to Date.now. */
+    now?: () => number;
+}
+/**
+ * In-memory {@link PendingFlowStore} — the dev/reference implementation.
+ *
+ * NOT for production: pending flows are lost on restart and are invisible to a
+ * sibling instance, so a callback that lands elsewhere cannot complete. Inject a
+ * Redis / Durable Object / database-backed store for multi-instance deployments.
+ */
+export declare class MemoryPendingFlowStore extends PendingFlowStore {
+    private readonly pending;
+    private readonly now;
+    constructor(options?: MemoryPendingFlowStoreOptions);
+    put(token: string, flow: PendingFlow, ttlMs: number): Promise<void>;
+    get(token: string): Promise<PendingFlow | undefined>;
+    consume(token: string): Promise<PendingFlow | undefined>;
+    delete(token: string): Promise<void>;
+    cleanup(): Promise<void>;
+}
+//# sourceMappingURL=pending-flow-store.d.ts.map

package/dist/authz/oidc/pending-flow-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-flow-store.d.ts","sourceRoot":"","sources":["../../../src/authz/oidc/pending-flow-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,8BAAsB,gBAAgB;IACpC,iFAAiF;IACjF,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC5E,oEAAoE;IACpE,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAC7D;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IACjE,gDAAgD;IAChD,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC7C,4BAA4B;IAC5B,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,6BAA6B;IAC5C,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,gBAAgB;IAC1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+D;IACvF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,OAAO,GAAE,6BAAkC;IAKjD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAUpD,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAUxD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAM/B"}

package/dist/authz/oidc/pending-flow-store.js

@@ -0,0 +1,82 @@
+/**
+ * PendingFlowStore — the provider seam for in-flight OAuth/OIDC PKCE state.
+ *
+ * Between {@link GenericOidcAdapter.initiateFlow} (which mints a resume token and
+ * the PKCE `codeVerifier`) and the authorization callback (which exchanges the
+ * code), the verifier must be held server-side keyed by the resume token — it is
+ * never placed on the wire. Holding it in a per-process `Map` breaks the moment a
+ * second instance or a restart enters the picture: if the callback lands on
+ * another instance the verifier is gone, the token exchange fails closed, and no
+ * grant is ever minted.
+ *
+ * This seam mirrors {@link GrantStore} / `NonceCacheProvider`: the in-memory
+ * implementation here is the dev/reference impl; production injects a Redis /
+ * Durable Object / database-backed store behind the same interface so
+ * `initiateFlow` on instance A and the callback on instance B share one verifier.
+ *
+ * `get` (non-consuming read) and `delete` (consume) are kept separate so the
+ * adapter can preserve its one-time-use ordering: it reads the pending flow,
+ * validates `state`, performs the token exchange, and deletes ONLY after the
+ * exchange succeeds — so a transient IdP error does not burn the resume token.
+ *
+ * Production note: a durable backing SHOULD make `delete`-after-exchange atomic
+ * (e.g. Redis `GETDEL`, or a compare-and-set) to close the one-time-use replay
+ * window across instances.
+ */
+/**
+ * Store for pending (awaiting-callback) OAuth/OIDC PKCE flows. Implementations
+ * persist a flow under a resume token with a TTL, read it back (non-consuming),
+ * consume it after a successful exchange, and sweep expired entries.
+ */
+export class PendingFlowStore {
+}
+/**
+ * In-memory {@link PendingFlowStore} — the dev/reference implementation.
+ *
+ * NOT for production: pending flows are lost on restart and are invisible to a
+ * sibling instance, so a callback that lands elsewhere cannot complete. Inject a
+ * Redis / Durable Object / database-backed store for multi-instance deployments.
+ */
+export class MemoryPendingFlowStore extends PendingFlowStore {
+    pending = new Map();
+    now;
+    constructor(options = {}) {
+        super();
+        this.now = options.now ?? (() => Date.now());
+    }
+    async put(token, flow, ttlMs) {
+        this.pending.set(token, { flow: { ...flow }, expiresAt: this.now() + ttlMs });
+    }
+    async get(token) {
+        const entry = this.pending.get(token);
+        if (!entry)
+            return undefined;
+        if (entry.expiresAt <= this.now()) {
+            this.pending.delete(token);
+            return undefined;
+        }
+        return { ...entry.flow };
+    }
+    async consume(token) {
+        // get + delete with NO await in between → atomic in single-threaded JS:
+        // a second consume() for the same token sees nothing.
+        const entry = this.pending.get(token);
+        if (!entry)
+            return undefined;
+        this.pending.delete(token);
+        if (entry.expiresAt <= this.now())
+            return undefined;
+        return { ...entry.flow };
+    }
+    async delete(token) {
+        this.pending.delete(token);
+    }
+    async cleanup() {
+        const now = this.now();
+        for (const [token, entry] of this.pending) {
+            if (entry.expiresAt <= now)
+                this.pending.delete(token);
+        }
+    }
+}
+//# sourceMappingURL=pending-flow-store.js.map

package/dist/authz/oidc/pending-flow-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-flow-store.js","sourceRoot":"","sources":["../../../src/authz/oidc/pending-flow-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAWH;;;;GAIG;AACH,MAAM,OAAgB,gBAAgB;CAmBrC;AAOD;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,gBAAgB;IACzC,OAAO,GAAG,IAAI,GAAG,EAAoD,CAAC;IACtE,GAAG,CAAe;IAEnC,YAAY,UAAyC,EAAE;QACrD,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,IAAiB,EAAE,KAAa;QACvD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,wEAAwE;QACxE,sDAAsD;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,SAAS,CAAC;QACpD,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;CACF"}

package/dist/index.d.ts

@@ -36,16 +36,18 @@ export { DidWebResolver, createDidWebResolver, isDidWeb, parseDidWeb, didWebToUr
 export { base58Encode, base58Decode, isValidBase58, } from './utils/base58.js';
 export { isValidDid, getDidMethod, normalizeDid, compareDids, getServerDid, extractAgentId, extractAgentSlug, generateDidKeyFromBytes, generateDidKeyFromBase64, didKeyFragment, } from './utils/did-helpers.js';
 export { verifyOrHints, hasSensitiveScopes, MemoryResumeTokenStore, type AuthHandshakeConfig, type VerifyOrHintsResult, type AgentReputation, type ResumeTokenStore, type UnknownAgentPolicy, type DelegationVerifier, type VerifyDelegationResult, } from './auth/index.js';
-export { ProofGenerator, createProofResponse, extractCanonicalData, type ProofAgentIdentity, type ToolRequest, type ToolResponse, type ProofOptions, } from './proof/index.js';
-export { ProofVerifier, validateMetaStructure, extractProofFromMeta, DEFAULT_CLOCK_SKEW_SECONDS, MIN_CLOCK_SKEW_SECONDS, MAX_CLOCK_SKEW_SECONDS, type ProofVerifierConfig, type ProofVerificationResult, } from './proof/verifier.js';
+export { ProofGenerator, createProofResponse, extractCanonicalData, KYA_OS_PROOF_META_KEY, LEGACY_PROOF_META_KEY, type ProofAgentIdentity, type ToolRequest, type ToolResponse, type ProofOptions, } from './proof/index.js';
+export { ProofVerifier, validateMetaStructure, extractProofFromMeta, isReservedMcpMetaKey, DEFAULT_CLOCK_SKEW_SECONDS, MIN_CLOCK_SKEW_SECONDS, MAX_CLOCK_SKEW_SECONDS, type ProofVerifierConfig, type ProofVerificationResult, } from './proof/verifier.js';
 export { ProofVerificationError, PROOF_VERIFICATION_ERROR_CODES, createProofVerificationError, type ProofVerificationErrorCode, } from './proof/errors.js';
-export { SessionManager, createHandshakeRequest, validateHandshakeFormat, type SessionConfig, type HandshakeResult, } from './session/index.js';
+export { SessionManager, createHandshakeRequest, validateHandshakeFormat, SessionStore, MemorySessionStore, type SessionConfig, type HandshakeResult, type MemorySessionStoreOptions, } from './session/index.js';
 export { CryptoProvider, ClockProvider, FetchProvider, StorageProvider, NonceCacheProvider, IdentityProvider, type Identity, type AgentIdentity, } from './providers/base.js';
 export { MemoryStorageProvider, MemoryNonceCacheProvider, MemoryIdentityProvider, } from './providers/memory.js';
 export { NodeCryptoProvider } from './providers/node-crypto.js';
 export { SystemClockProvider } from './providers/system-clock.js';
 export { RuntimeFetchProvider, NoopFetchProvider } from './providers/runtime-fetch.js';
 export { AuditLogProvider, MemoryAuditLogProvider, NoopAuditLogProvider, buildAuditRecord, } from './providers/audit-log.js';
+export { GrantStore, MemoryGrantStore, type Grant, type MemoryGrantStoreOptions, } from './providers/grant-store.js';
+export { PendingFlowStore, MemoryPendingFlowStore, type PendingFlow, type MemoryPendingFlowStoreOptions, } from './authz/oidc/pending-flow-store.js';
 export { createKyaOsMiddleware, type KyaOsConfig, type KyaOsDelegationConfig, type KyaOsIdentityConfig, type KyaOsMiddleware, type KyaOsToolDefinition, type KyaOsToolHandler, type KyaOsServer, withKyaOs, generateIdentity, type WithKyaOsOptions, } from './middleware/index.js';
 export * from './policy/index.js';
 export { matchScope, scopeSatisfies, type ScopeMatcher, type ScopeSatisfaction, } from './delegation/scope-matcher.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAC;AAG3B,YAAY,EACV,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,EACL,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,SAAS,EACT,eAAe,EACf,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,UAAU,GACX,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,UAAU,GAChB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,IAAI,0BAA0B,GACpD,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,GACnC,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,cAAc,EACnB,KAAK,8BAA8B,GACpC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,GAChC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,EAChC,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,0BAA0B,GAChC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,GAC/B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAE5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAE5F,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,EAC5B,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,eAAe,GACrB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,qBAAqB,EACrB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,SAAS,EACT,gBAAgB,EAChB,KAAK,gBAAgB,GACtB,MAAM,uBAAuB,CAAC;AAG/B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,iBAAiB,GACvB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,MAAM,EACN,0BAA0B,EAC1B,KAAK,MAAM,EACX,KAAK,KAAK,GACX,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAC;AAG3B,YAAY,EACV,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,EACL,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,SAAS,EACT,eAAe,EACf,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,UAAU,GACX,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,UAAU,GAChB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,IAAI,0BAA0B,GACpD,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,GACnC,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,cAAc,EACnB,KAAK,8BAA8B,GACpC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,GAChC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,EAChC,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,0BAA0B,GAChC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,GAC/B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAE5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAE5F,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,EAC5B,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,yBAAyB,GAC/B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,KAAK,KAAK,EACV,KAAK,uBAAuB,GAC7B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,KAAK,WAAW,EAChB,KAAK,6BAA6B,GACnC,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EACL,qBAAqB,EACrB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,SAAS,EACT,gBAAgB,EAChB,KAAK,gBAAgB,GACtB,MAAM,uBAAuB,CAAC;AAG/B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,iBAAiB,GACvB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,MAAM,EACN,0BAA0B,EAC1B,KAAK,MAAM,EACX,KAAK,KAAK,GACX,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -41,11 +41,11 @@ export { isValidDid, getDidMethod, normalizeDid, compareDids, getServerDid, extr
 // Auth module
 export { verifyOrHints, hasSensitiveScopes, MemoryResumeTokenStore, } from './auth/index.js';
 // Proof module
-export { ProofGenerator, createProofResponse, extractCanonicalData, } from './proof/index.js';
-export { ProofVerifier, validateMetaStructure, extractProofFromMeta, DEFAULT_CLOCK_SKEW_SECONDS, MIN_CLOCK_SKEW_SECONDS, MAX_CLOCK_SKEW_SECONDS, } from './proof/verifier.js';
+export { ProofGenerator, createProofResponse, extractCanonicalData, KYA_OS_PROOF_META_KEY, LEGACY_PROOF_META_KEY, } from './proof/index.js';
+export { ProofVerifier, validateMetaStructure, extractProofFromMeta, isReservedMcpMetaKey, DEFAULT_CLOCK_SKEW_SECONDS, MIN_CLOCK_SKEW_SECONDS, MAX_CLOCK_SKEW_SECONDS, } from './proof/verifier.js';
 export { ProofVerificationError, PROOF_VERIFICATION_ERROR_CODES, createProofVerificationError, } from './proof/errors.js';
 // Session module
-export { SessionManager, createHandshakeRequest, validateHandshakeFormat, } from './session/index.js';
+export { SessionManager, createHandshakeRequest, validateHandshakeFormat, SessionStore, MemorySessionStore, } from './session/index.js';
 // Providers
 export { CryptoProvider, ClockProvider, FetchProvider, StorageProvider, NonceCacheProvider, IdentityProvider, } from './providers/base.js';
 export { MemoryStorageProvider, MemoryNonceCacheProvider, MemoryIdentityProvider, } from './providers/memory.js';
@@ -53,6 +53,11 @@ export { NodeCryptoProvider } from './providers/node-crypto.js';
 export { SystemClockProvider } from './providers/system-clock.js';
 export { RuntimeFetchProvider, NoopFetchProvider } from './providers/runtime-fetch.js';
 export { AuditLogProvider, MemoryAuditLogProvider, NoopAuditLogProvider, buildAuditRecord, } from './providers/audit-log.js';
+// Durable grant store (the no-paste retry authority) — also reachable via the
+// ./providers subpath; re-exported here at the top level for discoverability.
+export { GrantStore, MemoryGrantStore, } from './providers/grant-store.js';
+// Pending OAuth/OIDC PKCE-flow store (durable resume across instances/restarts).
+export { PendingFlowStore, MemoryPendingFlowStore, } from './authz/oidc/pending-flow-store.js';
 // Middleware
 export { createKyaOsMiddleware, withKyaOs, generateIdentity, } from './middleware/index.js';
 // Policy-as-Code subsystem + step-up gate

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,iBAAiB;AACjB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GAGjB,MAAM,aAAa,CAAC;AAErB,2EAA2E;AAC3E,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAC;AA8B3B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,qBAAqB,CAAC;AAE7B,oBAAoB;AACpB,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GAIvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,GAQzB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GAGtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAGxB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GAIjC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,gBAAgB,EAChB,UAAU,GAGX,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GAGjB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,GAGtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,UAAU,GAGX,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,GAKrB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAE5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAE5F,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,GAEpB,MAAM,kCAAkC,CAAC;AAE1C,QAAQ;AACR,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAEhC,cAAc;AACd,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,GAQvB,MAAM,iBAAiB,CAAC;AAEzB,eAAe;AACf,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,GAKrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,GAGvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,mBAAmB,CAAC;AAE3B,iBAAiB;AACjB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,GAGxB,MAAM,oBAAoB,CAAC;AAE5B,YAAY;AACZ,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GAGjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAElC,aAAa;AACb,OAAO,EACL,qBAAqB,EAQrB,SAAS,EACT,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAE/B,0CAA0C;AAC1C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,UAAU,EACV,cAAc,GAGf,MAAM,+BAA+B,CAAC;AAEvC,UAAU;AACV,OAAO,EACL,MAAM,EACN,0BAA0B,GAG3B,MAAM,oBAAoB,CAAC;AAE5B,oBAAoB;AACpB,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,iBAAiB;AACjB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GAGjB,MAAM,aAAa,CAAC;AAErB,2EAA2E;AAC3E,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAC;AA8B3B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,qBAAqB,CAAC;AAE7B,oBAAoB;AACpB,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GAIvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,GAQzB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GAGtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAGxB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GAIjC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,gBAAgB,EAChB,UAAU,GAGX,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GAGjB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,GAGtB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,UAAU,GAGX,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,GAKrB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAE5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAE5F,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,cAAc,GACf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,GAEpB,MAAM,kCAAkC,CAAC;AAE1C,QAAQ;AACR,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAEhC,cAAc;AACd,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,GAQvB,MAAM,iBAAiB,CAAC;AAEzB,eAAe;AACf,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GAKtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,GAGvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,mBAAmB,CAAC;AAE3B,iBAAiB;AACjB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,kBAAkB,GAInB,MAAM,oBAAoB,CAAC;AAE5B,YAAY;AACZ,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GAGjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAElC,8EAA8E;AAC9E,8EAA8E;AAC9E,OAAO,EACL,UAAU,EACV,gBAAgB,GAGjB,MAAM,4BAA4B,CAAC;AAEpC,iFAAiF;AACjF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,GAGvB,MAAM,oCAAoC,CAAC;AAE5C,aAAa;AACb,OAAO,EACL,qBAAqB,EAQrB,SAAS,EACT,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAE/B,0CAA0C;AAC1C,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,UAAU,EACV,cAAc,GAGf,MAAM,+BAA+B,CAAC;AAEvC,UAAU;AACV,OAAO,EACL,MAAM,EACN,0BAA0B,GAG3B,MAAM,oBAAoB,CAAC;AAE5B,oBAAoB;AACpB,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}

package/dist/middleware/kya-os-transport.d.ts

@@ -6,7 +6,8 @@
  * private SDK internals accessed.
  *
  * The McpServer never knows this wrapper exists. It sees a normal transport.
- * The connected client sees normal MCP responses with an added `_meta.proof`.
+ * The connected client sees normal MCP responses with the detached proof added
+ * under the namespaced `_meta` key `org.kya-os/proof` (see KYA_OS_PROOF_META_KEY).
  *
  * How it works:
  *   1. Incoming `tools/call` requests are captured (by id) to record tool

package/dist/middleware/kya-os-transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kya-os-transport.d.ts","sourceRoot":"","sources":["../../src/middleware/kya-os-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAoB,MAAM,kBAAkB,CAAC;AAG1E,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,CAAC;IAC9C,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAarD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE,eAAe,EACtB,OAAO,GAAE,MAAM,EAAmC,GACjD,SAAS,CAwGX"}
+{"version":3,"file":"kya-os-transport.d.ts","sourceRoot":"","sources":["../../src/middleware/kya-os-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAoB,MAAM,kBAAkB,CAAC;AAG1E,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,CAAC;IAC9C,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAarD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE,eAAe,EACtB,OAAO,GAAE,MAAM,EAAmC,GACjD,SAAS,CAwGX"}

package/dist/middleware/kya-os-transport.js

@@ -6,7 +6,8 @@
  * private SDK internals accessed.
  *
  * The McpServer never knows this wrapper exists. It sees a normal transport.
- * The connected client sees normal MCP responses with an added `_meta.proof`.
+ * The connected client sees normal MCP responses with the detached proof added
+ * under the namespaced `_meta` key `org.kya-os/proof` (see KYA_OS_PROOF_META_KEY).
  *
  * How it works:
  *   1. Incoming `tools/call` requests are captured (by id) to record tool

package/dist/middleware/kya-os-transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"kya-os-transport.js","sourceRoot":"","sources":["../../src/middleware/kya-os-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAyB7C;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAgB,EAChB,KAAsB,EACtB,UAAoB,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAElD,yDAAyD;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEhD,MAAM,OAAO,GAAc;QACzB,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;QAC1B,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;QAE1B,oEAAoE;QACpE,+BAA+B;QAC/B,IAAI,SAAS,CAAC,OAAoD;YAChE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC;QAC5B,CAAC;QACD,IAAI,SAAS;YACX,OAAO,KAAK,CAAC,SAAS,CAAC;QACzB,CAAC;QAED,IAAI,OAAO,CAAC,OAAiC;YAC3C,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO;YACT,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,IAAI,OAAO,CAAC,OAA2C;YACrD,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO;YACT,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,qDAAqD;QACrD,wDAAwD;QACxD,KAAK,CAAC,IAAI,CAAC,OAAuB;YAChC,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAE5D,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,OAAO,CAAC,MAAgC,CAAC;oBAC3D,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;wBACpC,MAAM,OAAO,GAAqB,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;wBACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;wBAC7D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBAC1C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;4BAChC,OAAO,GAAG;gCACR,GAAG,OAAO;gCACV,MAAM,EAAE,OAAO;6BAChB,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;wBACxD,IAAI,EAAE,IAAI,CAAC,QAAQ;wBACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;oBACH,MAAM,SAAS,GAAG,OAAO,CAAC,MAAgC,CAAC;oBAC3D,IAAI,SAAS,EAAE,CAAC;wBACd,SAAS,CAAC,KAAK,GAAG;4BAChB,UAAU,EAAE,gDAAgD;yBAC7D,CAAC;wBACF,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;oBAC9C,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;IAEF,iEAAiE;IACjE,uDAAuD;IACvD,6EAA6E;IAC7E,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,CAAC,KAAK,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,aAAa,EAAE,CAAC;QACtB,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QACnC,KAAK,CAAC,SAAS,GAAG,CAAC,OAAuB,EAAE,EAAE;YAC5C,IACE,OAAO,CAAC,MAAM,KAAK,YAAY;gBAC/B,OAAO,CAAC,EAAE,KAAK,SAAS,EACxB,CAAC;gBACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAEV,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAM,EAAE,IAAI,CAAC;gBAC9B,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC5C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE;wBACtB,QAAQ;wBACR,IAAI,EAAE,MAAM,EAAE,SAAS,IAAI,EAAE;qBAC9B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"kya-os-transport.js","sourceRoot":"","sources":["../../src/middleware/kya-os-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAyB7C;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAgB,EAChB,KAAsB,EACtB,UAAoB,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAElD,yDAAyD;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEhD,MAAM,OAAO,GAAc;QACzB,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;QAC1B,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;QAE1B,oEAAoE;QACpE,+BAA+B;QAC/B,IAAI,SAAS,CAAC,OAAoD;YAChE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC;QAC5B,CAAC;QACD,IAAI,SAAS;YACX,OAAO,KAAK,CAAC,SAAS,CAAC;QACzB,CAAC;QAED,IAAI,OAAO,CAAC,OAAiC;YAC3C,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO;YACT,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,IAAI,OAAO,CAAC,OAA2C;YACrD,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO;YACT,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,qDAAqD;QACrD,wDAAwD;QACxD,KAAK,CAAC,IAAI,CAAC,OAAuB;YAChC,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAE5D,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,OAAO,CAAC,MAAgC,CAAC;oBAC3D,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;wBACpC,MAAM,OAAO,GAAqB,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;wBACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;wBAC7D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBAC1C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;4BAChC,OAAO,GAAG;gCACR,GAAG,OAAO;gCACV,MAAM,EAAE,OAAO;6BAChB,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;wBACxD,IAAI,EAAE,IAAI,CAAC,QAAQ;wBACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;oBACH,MAAM,SAAS,GAAG,OAAO,CAAC,MAAgC,CAAC;oBAC3D,IAAI,SAAS,EAAE,CAAC;wBACd,SAAS,CAAC,KAAK,GAAG;4BAChB,UAAU,EAAE,gDAAgD;yBAC7D,CAAC;wBACF,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;oBAC9C,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;IAEF,iEAAiE;IACjE,uDAAuD;IACvD,6EAA6E;IAC7E,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,CAAC,KAAK,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,aAAa,EAAE,CAAC;QACtB,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QACnC,KAAK,CAAC,SAAS,GAAG,CAAC,OAAuB,EAAE,EAAE;YAC5C,IACE,OAAO,CAAC,MAAM,KAAK,YAAY;gBAC/B,OAAO,CAAC,EAAE,KAAK,SAAS,EACxB,CAAC;gBACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAEV,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAM,EAAE,IAAI,CAAC;gBAC9B,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC5C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE;wBACtB,QAAQ;wBACR,IAAI,EAAE,MAAM,EAAE,SAAS,IAAI,EAAE;qBAC9B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC"}