@kya-os/mcp 1.6.0 → 1.7.0

package/dist/proof/generator.d.ts

@@ -9,6 +9,27 @@
  */
 import type { DetachedProof, SessionContext } from '../types/protocol.js';
 import type { CryptoProvider } from '../providers/base.js';
+/**
+ * Canonical reverse-DNS `_meta` key under which KYA-OS attaches its detached
+ * proof. MCP 2026-07-28 (SEP-414) makes `_meta` shared, reverse-DNS–namespaced
+ * real estate — it also carries `io.modelcontextprotocol/*` and W3C trace
+ * context keys — so KYA-OS namespaces its own payload rather than owning bare
+ * `proof`.
+ *
+ * SINGLE SOURCE OF TRUTH: every emit site (middleware) and verify site
+ * (`extractProofFromMeta` / `validateMetaStructure`) references this constant,
+ * so renaming the namespace — e.g. once KYA-OS registers as an MCP Extension
+ * under SEP-2133 — is a one-line change. See SPEC §7.6.
+ */
+export declare const KYA_OS_PROOF_META_KEY = "org.kya-os/proof";
+/**
+ * Legacy bare `_meta.proof` key — the legacy `_meta.proof` mirror; drop at 2.0.
+ * For one major version verifiers MUST keep accepting a proof published here
+ * (back-compat); producers SHOULD emit under {@link KYA_OS_PROOF_META_KEY}. When
+ * both keys are present the namespaced key wins. The mirror is emitted by default
+ * for the whole 1.x line (see `emitLegacyProofKey`) and removed at 2.0. SPEC §7.6.
+ */
+export declare const LEGACY_PROOF_META_KEY = "proof";
 export interface ProofAgentIdentity {
     did: string;
     kid: string;

package/dist/proof/generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/proof/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EACV,aAAa,EAEb,cAAc,EACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,aAAa,CAAC;QACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,kBAAkB,GAAG,qBAAqB,CAAC;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,GAC3C,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBzD;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,cAAc,CAAiB;gBAE3B,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,cAAc;IAKxE;;;;;;;;;;;;OAYG;IACG,aAAa,CACjB,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,aAAa,CAAC;IAsBzB;;;OAGG;IACG,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;YAI1C,uBAAuB;YASvB,WAAW;IAyCzB,OAAO,CAAC,qBAAqB;IAqBvB,WAAW,CACf,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,YAAY,GACtB,OAAO,CAAC,OAAO,CAAC;IA4BnB,OAAO,CAAC,oBAAoB;CAc7B;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,cAAc,EACvB,cAAc,EAAE,cAAc,EAC9B,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,YAAY,CAAC,CAMvB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GACrB;IACD,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAQA"}
+{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/proof/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EACV,aAAa,EAEb,cAAc,EACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,UAAU,CAAC;AAE7C,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,aAAa,CAAC;QACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,kBAAkB,GAAG,qBAAqB,CAAC;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,GAC3C,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBzD;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,cAAc,CAAiB;gBAE3B,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,cAAc;IAKxE;;;;;;;;;;;;OAYG;IACG,aAAa,CACjB,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,aAAa,CAAC;IAsBzB;;;OAGG;IACG,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;YAI1C,uBAAuB;YASvB,WAAW;IAyCzB,OAAO,CAAC,qBAAqB;IAqBvB,WAAW,CACf,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,YAAY,GACtB,OAAO,CAAC,OAAO,CAAC;IA4BnB,OAAO,CAAC,oBAAoB;CAc7B;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,cAAc,EACvB,cAAc,EAAE,cAAc,EAC9B,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,YAAY,CAAC,CAMvB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GACrB;IACD,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAQA"}

package/dist/proof/generator.js

@@ -12,6 +12,27 @@ import { canonicalize } from 'json-canonicalize';
 import { CryptoService } from '../utils/crypto-service.js';
 import { base64ToBytes, base64urlEncodeFromBytes, bytesToBase64 } from '../utils/base64.js';
 import { ED25519_PKCS8_DER_HEADER, ED25519_KEY_SIZE } from '../utils/ed25519-constants.js';
+/**
+ * Canonical reverse-DNS `_meta` key under which KYA-OS attaches its detached
+ * proof. MCP 2026-07-28 (SEP-414) makes `_meta` shared, reverse-DNS–namespaced
+ * real estate — it also carries `io.modelcontextprotocol/*` and W3C trace
+ * context keys — so KYA-OS namespaces its own payload rather than owning bare
+ * `proof`.
+ *
+ * SINGLE SOURCE OF TRUTH: every emit site (middleware) and verify site
+ * (`extractProofFromMeta` / `validateMetaStructure`) references this constant,
+ * so renaming the namespace — e.g. once KYA-OS registers as an MCP Extension
+ * under SEP-2133 — is a one-line change. See SPEC §7.6.
+ */
+export const KYA_OS_PROOF_META_KEY = 'org.kya-os/proof';
+/**
+ * Legacy bare `_meta.proof` key — the legacy `_meta.proof` mirror; drop at 2.0.
+ * For one major version verifiers MUST keep accepting a proof published here
+ * (back-compat); producers SHOULD emit under {@link KYA_OS_PROOF_META_KEY}. When
+ * both keys are present the namespaced key wins. The mirror is emitted by default
+ * for the whole 1.x line (see `emitLegacyProofKey`) and removed at 2.0. SPEC §7.6.
+ */
+export const LEGACY_PROOF_META_KEY = 'proof';
 /**
  * Compute the canonical request/response hashes that bind a proof to a specific
  * invocation. This is the SINGLE source of truth for that hashing — used by both

package/dist/proof/generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../src/proof/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAOjD,OAAO,EAAE,aAAa,EAAmB,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AA8B3F;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAoB,EACpB,QAAkC,EAClC,IAA4C;IAE5C,MAAM,gBAAgB,GAAG;QACvB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAC5B,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,YAAY,CAAC,gBAAsD,CAAC,CACrE,CACF,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,WAAW,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAC7B,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,YAAY,CAAC,QAAQ,CAAC,IAA0C,CAAC,CAClE,CACF,CAAC;IACF,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,OAAO,cAAc;IACjB,QAAQ,CAAqB;IAC7B,cAAc,CAAiB;IAEvC,YAAY,QAA4B,EAAE,cAA8B;QACtE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,aAAa,CACjB,OAAoB,EACpB,QAAkC,EAClC,OAAuB,EACvB,UAAwB,EAAE;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAErE,MAAM,IAAI,GAAc;YACtB,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;YACtB,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;YACtB,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACjC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;gBACvC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,OAAO;SACX,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAEzC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,OAAoB;QACpC,OAAO,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;IACnE,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,OAAoB,EACpB,QAAuB;QAEvB,OAAO,sBAAsB,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CACzD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAChC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAAe;QACvC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC3E,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YAE7D,MAAM,OAAO,GAAG;gBACd,GAAG,EAAE,IAAI,CAAC,QAAQ;gBAClB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC3E,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9C,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;gBAChE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpD,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9C,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;aAC5C,CAAC;YAEF,6EAA6E;YAC7E,gFAAgF;YAChF,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAA6C,CAAC,CAAC;YACrF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAEhE,MAAM,GAAG,GAAG,MAAM,IAAI,WAAW,CAAC,YAAY,CAAC;iBAC5C,kBAAkB,CAAC;gBAClB,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;aACvB,CAAC;iBACD,IAAI,CAAC,UAAU,CAAC,CAAC;YAEpB,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,qBAAqB,CAAC,gBAAwB;QACpD,MAAM,OAAO,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAEhD,2BAA2B;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAErD,0CAA0C;QAC1C,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,wBAAwB,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAErD,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;QAE1E,OAAO,CACL,+BAA+B;YAC/B,YAAY;YACZ,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CACf,KAAoB,EACpB,OAAoB,EACpB,QAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAE7E,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,cAAc,CAAC,WAAW,EAAE,CAAC;gBAC1D,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC1C,IACE,cAAc,CAAC,YAAY,KAAK,SAAS;oBACzC,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,cAAc,CAAC,YAAY,EACvD,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAE7D,OAAO,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE;gBACtD,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;gBAC9B,GAAG,EAAE,OAAO;aACb,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,eAAuB;QAClD,MAAM,cAAc,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;QAEtD,IAAI,cAAc,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,sCAAsC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,OAAO;YACL,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,SAAS;YACd,CAAC,EAAE,wBAAwB,CAAC,cAAc,CAAC;YAC3C,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;SACvB,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAoB,EACpB,IAAa,EACb,QAA4B,EAC5B,OAAuB,EACvB,cAA8B,EAC9B,UAAwB,EAAE;IAE1B,MAAM,QAAQ,GAAiB,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACtF,QAAQ,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC;IAC1B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAoB,EACpB,QAAsB;IAKtB,OAAO;QACL,OAAO,EAAE;YACP,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,QAAQ,EAAE,QAAQ,CAAC,IAAI;KACxB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../src/proof/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAOjD,OAAO,EAAE,aAAa,EAAmB,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAE3F;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AA8B7C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAoB,EACpB,QAAkC,EAClC,IAA4C;IAE5C,MAAM,gBAAgB,GAAG;QACvB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAC5B,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,YAAY,CAAC,gBAAsD,CAAC,CACrE,CACF,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,WAAW,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAC7B,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,YAAY,CAAC,QAAQ,CAAC,IAA0C,CAAC,CAClE,CACF,CAAC;IACF,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,OAAO,cAAc;IACjB,QAAQ,CAAqB;IAC7B,cAAc,CAAiB;IAEvC,YAAY,QAA4B,EAAE,cAA8B;QACtE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,aAAa,CACjB,OAAoB,EACpB,QAAkC,EAClC,OAAuB,EACvB,UAAwB,EAAE;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAErE,MAAM,IAAI,GAAc;YACtB,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;YACtB,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;YACtB,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACjC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;gBACvC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,OAAO;SACX,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAEzC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,OAAoB;QACpC,OAAO,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;IACnE,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,OAAoB,EACpB,QAAuB;QAEvB,OAAO,sBAAsB,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CACzD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAChC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAAe;QACvC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC3E,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YAE7D,MAAM,OAAO,GAAG;gBACd,GAAG,EAAE,IAAI,CAAC,QAAQ;gBAClB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC3E,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9C,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;gBAChE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpD,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9C,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;aAC5C,CAAC;YAEF,6EAA6E;YAC7E,gFAAgF;YAChF,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAA6C,CAAC,CAAC;YACrF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAEhE,MAAM,GAAG,GAAG,MAAM,IAAI,WAAW,CAAC,YAAY,CAAC;iBAC5C,kBAAkB,CAAC;gBAClB,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;aACvB,CAAC;iBACD,IAAI,CAAC,UAAU,CAAC,CAAC;YAEpB,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,qBAAqB,CAAC,gBAAwB;QACpD,MAAM,OAAO,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAEhD,2BAA2B;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAErD,0CAA0C;QAC1C,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,wBAAwB,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAErD,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;QAE1E,OAAO,CACL,+BAA+B;YAC/B,YAAY;YACZ,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CACf,KAAoB,EACpB,OAAoB,EACpB,QAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAE7E,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,cAAc,CAAC,WAAW,EAAE,CAAC;gBAC1D,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC1C,IACE,cAAc,CAAC,YAAY,KAAK,SAAS;oBACzC,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,cAAc,CAAC,YAAY,EACvD,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAE7D,OAAO,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE;gBACtD,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;gBAC9B,GAAG,EAAE,OAAO;aACb,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,eAAuB;QAClD,MAAM,cAAc,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;QAEtD,IAAI,cAAc,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,sCAAsC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,OAAO;YACL,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,SAAS;YACd,CAAC,EAAE,wBAAwB,CAAC,cAAc,CAAC;YAC3C,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;SACvB,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAoB,EACpB,IAAa,EACb,QAA4B,EAC5B,OAAuB,EACvB,cAA8B,EAC9B,UAAwB,EAAE;IAE1B,MAAM,QAAQ,GAAiB,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACtF,QAAQ,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC;IAC1B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAoB,EACpB,QAAsB;IAKtB,OAAO;QACL,OAAO,EAAE;YACP,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,QAAQ,EAAE,QAAQ,CAAC,IAAI;KACxB,CAAC;AACJ,CAAC"}

package/dist/proof/index.d.ts

@@ -1,4 +1,4 @@
-export { ProofGenerator, createProofResponse, extractCanonicalData, type ProofAgentIdentity, type ToolRequest, type ToolResponse, type ProofOptions, } from './generator.js';
+export { ProofGenerator, createProofResponse, extractCanonicalData, KYA_OS_PROOF_META_KEY, LEGACY_PROOF_META_KEY, type ProofAgentIdentity, type ToolRequest, type ToolResponse, type ProofOptions, } from './generator.js';
 export { ProofVerifier, validateMetaStructure, extractProofFromMeta, DEFAULT_CLOCK_SKEW_SECONDS, MIN_CLOCK_SKEW_SECONDS, MAX_CLOCK_SKEW_SECONDS, type ProofVerifierConfig, type ProofVerificationResult, } from './verifier.js';
 export { ProofVerificationError, PROOF_VERIFICATION_ERROR_CODES, createProofVerificationError, type ProofVerificationErrorCode, } from './errors.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/proof/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/proof/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,EAC5B,KAAK,0BAA0B,GAChC,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/proof/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,EAC5B,KAAK,0BAA0B,GAChC,MAAM,aAAa,CAAC"}

package/dist/proof/index.js

@@ -1,4 +1,4 @@
-export { ProofGenerator, createProofResponse, extractCanonicalData, } from './generator.js';
+export { ProofGenerator, createProofResponse, extractCanonicalData, KYA_OS_PROOF_META_KEY, LEGACY_PROOF_META_KEY, } from './generator.js';
 export { ProofVerifier, validateMetaStructure, extractProofFromMeta, DEFAULT_CLOCK_SKEW_SECONDS, MIN_CLOCK_SKEW_SECONDS, MAX_CLOCK_SKEW_SECONDS, } from './verifier.js';
 export { ProofVerificationError, PROOF_VERIFICATION_ERROR_CODES, createProofVerificationError, } from './errors.js';
 //# sourceMappingURL=index.js.map

package/dist/proof/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/proof/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,GAKrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,GAGvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/proof/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GAKtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,GAGvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,aAAa,CAAC"}

package/dist/proof/verifier.d.ts

@@ -152,15 +152,38 @@ export declare class ProofVerifier {
      */
     buildCanonicalPayload(meta: DetachedProof["meta"]): string;
 }
+/**
+ * Whether `key` is an MCP-reserved / standard `_meta` key (SEP-414) that KYA-OS
+ * tolerates: never hashed, never trusted, never a cause for rejection. Exposed
+ * so adopters can classify coexisting `_meta` keys with the same allowlist the
+ * verifier uses. See {@link validateMetaStructure}.
+ */
+export declare function isReservedMcpMetaKey(key: string): boolean;
 /**
  * Validate _meta structure according to meta policy.
  *
- * In 'strict' mode, _meta must contain only 'proof'.
- * In 'allow-extensions' mode, additional keys are permitted.
+ * The KYA-OS proof rides under {@link KYA_OS_PROOF_META_KEY} (reverse-DNS,
+ * SEP-414); the legacy bare {@link LEGACY_PROOF_META_KEY} is still accepted for
+ * back-compat. Both are treated as the proof key. Every other key is a
+ * non-KYA-OS `_meta` key.
+ *
+ * Under MCP 2026-07-28 `_meta` is shared real estate (it also carries
+ * `io.modelcontextprotocol/*` and W3C trace-context keys), so NEITHER policy
+ * rejects foreign keys — the prior `strict` reject-extras behavior would have
+ * made a conformant KYA-OS verifier reject conformant RC traffic. Both policies
+ * carry the identical zero-trust boundary: only the proof key is ever hashed or
+ * trusted; reserved/foreign keys ({@link isReservedMcpMetaKey} and any other)
+ * pass through untouched.
+ *
+ * - `strict` (default): non-KYA-OS keys are IGNORED (discarded) — never hashed,
+ *   trusted, or rejected.
+ * - `allow-extensions`: identical trust boundary, but the non-KYA-OS keys are
+ *   surfaced back to the caller (`extraKeys`) instead of discarded.
  *
  * @param meta - The _meta object from a response
  * @param policy - Meta policy ('strict' or 'allow-extensions')
- * @returns Validation result with valid flag and optional reason
+ * @returns Validation result; always valid. Under 'allow-extensions' any
+ *   non-KYA-OS keys are surfaced in `extraKeys`.
  */
 export declare function validateMetaStructure(meta: Record<string, unknown>, policy?: MetaPolicy): {
     valid: boolean;

package/dist/proof/verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../src/proof/verifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,UAAU,EAChB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAGL,KAAK,0BAA0B,EAChC,MAAM,aAAa,CAAC;AAErB,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,SAAS,CAAC,EAAE,0BAA0B,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,cAAc,CAAC;IAC/B,aAAa,EAAE,aAAa,CAAC;IAC7B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,aAAa,EAAE,aAAa,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,2CAA2C;AAC3C,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,2CAA2C;AAC3C,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C,qBAAa,aAAa;IACxB,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,KAAK,CAAgB;IAC7B,OAAO,CAAC,UAAU,CAAqB;IACvC,OAAO,CAAC,KAAK,CAAgB;IAC7B,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,cAAc,CAAiB;gBAE3B,MAAM,EAAE,mBAAmB;IAUvC;;;;;;OAMG;IACH,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAU3C;;OAEG;IACH,gBAAgB,IAAI,MAAM;IAI1B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,WAAW,CACf,KAAK,EAAE,aAAa,EACpB,YAAY,EAAE,UAAU,EACxB,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;KAAE,GAC3D,OAAO,CAAC,uBAAuB,CAAC;IAcnC;;;;;;OAMG;IACG,mBAAmB,CACvB,KAAK,EAAE,aAAa,EACpB,gBAAgB,EAAE,MAAM,GAAG,UAAU,EACrC,YAAY,EAAE,UAAU,GACvB,OAAO,CAAC,uBAAuB,CAAC;IAcnC;;;OAGG;YACW,uBAAuB;IAmErC;;;;;;OAMG;YACW,sBAAsB;IA+CpC;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAY/B;;;OAGG;YACW,sBAAsB;IAuBpC;;;OAGG;YACW,aAAa;IAmB3B;;;OAGG;YACW,iBAAiB;IAqB/B;;;OAGG;YACW,eAAe;IAgC7B;;;OAGG;YACW,eAAe;IAQ7B;;;;;;OAMG;IACG,qBAAqB,CACzB,GAAG,EAAE,MAAM,EACX,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAuG7B;;;;;;;;;OASG;IACH,qBAAqB,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,MAAM;CA6B3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,GAAE,UAAqB,GAC5B;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAa3D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,GAAE,UAAqB,GAC5B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CA+BjG"}
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../src/proof/verifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,UAAU,EAChB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAGL,KAAK,0BAA0B,EAChC,MAAM,aAAa,CAAC;AAErB,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,SAAS,CAAC,EAAE,0BAA0B,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,cAAc,CAAC;IAC/B,aAAa,EAAE,aAAa,CAAC;IAC7B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,aAAa,EAAE,aAAa,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,2CAA2C;AAC3C,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,2CAA2C;AAC3C,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C,qBAAa,aAAa;IACxB,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,KAAK,CAAgB;IAC7B,OAAO,CAAC,UAAU,CAAqB;IACvC,OAAO,CAAC,KAAK,CAAgB;IAC7B,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,cAAc,CAAiB;gBAE3B,MAAM,EAAE,mBAAmB;IAUvC;;;;;;OAMG;IACH,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAU3C;;OAEG;IACH,gBAAgB,IAAI,MAAM;IAI1B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,WAAW,CACf,KAAK,EAAE,aAAa,EACpB,YAAY,EAAE,UAAU,EACxB,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;KAAE,GAC3D,OAAO,CAAC,uBAAuB,CAAC;IAcnC;;;;;;OAMG;IACG,mBAAmB,CACvB,KAAK,EAAE,aAAa,EACpB,gBAAgB,EAAE,MAAM,GAAG,UAAU,EACrC,YAAY,EAAE,UAAU,GACvB,OAAO,CAAC,uBAAuB,CAAC;IAcnC;;;OAGG;YACW,uBAAuB;IAmErC;;;;;;OAMG;YACW,sBAAsB;IA+CpC;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAY/B;;;OAGG;YACW,sBAAsB;IAuBpC;;;OAGG;YACW,aAAa;IAmB3B;;;OAGG;YACW,iBAAiB;IAqB/B;;;OAGG;YACW,eAAe;IAgC7B;;;OAGG;YACW,eAAe;IAQ7B;;;;;;OAMG;IACG,qBAAqB,CACzB,GAAG,EAAE,MAAM,EACX,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAuG7B;;;;;;;;;OASG;IACH,qBAAqB,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,MAAM;CA6B3D;AAYD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAKzD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,GAAE,UAAqB,GAC5B;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAa3D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,GAAE,UAAqB,GAC5B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CA4BjG"}

package/dist/proof/verifier.js

@@ -9,7 +9,7 @@ import { validateDetachedProof, } from "../types/protocol.js";
 import { canonicalize } from "json-canonicalize";
 import { ProofVerificationError, PROOF_VERIFICATION_ERROR_CODES, } from "./errors.js";
 import { logger } from "../logging/index.js";
-import { computeCanonicalHashes, } from "./generator.js";
+import { computeCanonicalHashes, KYA_OS_PROOF_META_KEY, LEGACY_PROOF_META_KEY, } from "./generator.js";
 /** Default timestamp skew for proof verification (seconds) */
 export const DEFAULT_CLOCK_SKEW_SECONDS = 120;
 /** Minimum allowed clock skew (seconds) */
@@ -400,25 +400,58 @@ export class ProofVerifier {
         return canonicalize(payload);
     }
 }
+/**
+ * MCP-reserved / standard `_meta` keys a KYA-OS verifier MUST tolerate but
+ * never hash or trust (MCP 2026-07-28 / SEP-414): the `io.modelcontextprotocol/*`
+ * reverse-DNS namespace reserved by the MCP maintainers, and the W3C Trace
+ * Context propagation keys. Allowlisted so their presence is unambiguously not a
+ * cause for rejection under any policy.
+ */
+const RESERVED_MCP_META_PREFIXES = ['io.modelcontextprotocol/'];
+const RESERVED_MCP_META_KEYS = ['traceparent', 'tracestate', 'baggage'];
+/**
+ * Whether `key` is an MCP-reserved / standard `_meta` key (SEP-414) that KYA-OS
+ * tolerates: never hashed, never trusted, never a cause for rejection. Exposed
+ * so adopters can classify coexisting `_meta` keys with the same allowlist the
+ * verifier uses. See {@link validateMetaStructure}.
+ */
+export function isReservedMcpMetaKey(key) {
+    return (RESERVED_MCP_META_KEYS.includes(key) ||
+        RESERVED_MCP_META_PREFIXES.some((prefix) => key.startsWith(prefix)));
+}
 /**
  * Validate _meta structure according to meta policy.
  *
- * In 'strict' mode, _meta must contain only 'proof'.
- * In 'allow-extensions' mode, additional keys are permitted.
+ * The KYA-OS proof rides under {@link KYA_OS_PROOF_META_KEY} (reverse-DNS,
+ * SEP-414); the legacy bare {@link LEGACY_PROOF_META_KEY} is still accepted for
+ * back-compat. Both are treated as the proof key. Every other key is a
+ * non-KYA-OS `_meta` key.
+ *
+ * Under MCP 2026-07-28 `_meta` is shared real estate (it also carries
+ * `io.modelcontextprotocol/*` and W3C trace-context keys), so NEITHER policy
+ * rejects foreign keys — the prior `strict` reject-extras behavior would have
+ * made a conformant KYA-OS verifier reject conformant RC traffic. Both policies
+ * carry the identical zero-trust boundary: only the proof key is ever hashed or
+ * trusted; reserved/foreign keys ({@link isReservedMcpMetaKey} and any other)
+ * pass through untouched.
+ *
+ * - `strict` (default): non-KYA-OS keys are IGNORED (discarded) — never hashed,
+ *   trusted, or rejected.
+ * - `allow-extensions`: identical trust boundary, but the non-KYA-OS keys are
+ *   surfaced back to the caller (`extraKeys`) instead of discarded.
  *
  * @param meta - The _meta object from a response
  * @param policy - Meta policy ('strict' or 'allow-extensions')
- * @returns Validation result with valid flag and optional reason
+ * @returns Validation result; always valid. Under 'allow-extensions' any
+ *   non-KYA-OS keys are surfaced in `extraKeys`.
  */
 export function validateMetaStructure(meta, policy = 'strict') {
-    const keys = Object.keys(meta);
-    const extraKeys = keys.filter(k => k !== 'proof');
-    if (policy === 'strict' && extraKeys.length > 0) {
-        return {
-            valid: false,
-            reason: `_meta contains keys other than 'proof' in strict mode: ${extraKeys.join(', ')}`,
-            extraKeys,
-        };
+    const extraKeys = Object.keys(meta).filter(k => k !== KYA_OS_PROOF_META_KEY && k !== LEGACY_PROOF_META_KEY);
+    // allow-extensions surfaces coexisting keys; strict discards them. Neither
+    // rejects — a reserved key (io.modelcontextprotocol/*, traceparent, …) or any
+    // other foreign key never fails verification.
+    if (policy === 'allow-extensions' && extraKeys.length > 0) {
+        return { valid: true, extraKeys };
     }
     return { valid: true };
 }
@@ -430,24 +463,21 @@ export function validateMetaStructure(meta, policy = 'strict') {
  * @returns Extracted proof or error result
  */
 export function extractProofFromMeta(meta, policy = 'strict') {
-    // Check for required proof field first
-    const proof = meta.proof;
+    // Check for the proof field first. Prefer the namespaced key; fall back to
+    // the legacy bare key for back-compat. When both are present the namespaced
+    // key wins (SPEC §7.6).
+    const proof = meta[KYA_OS_PROOF_META_KEY] ?? meta[LEGACY_PROOF_META_KEY];
     if (!proof) {
         return {
             success: false,
-            reason: '_meta does not contain proof',
+            reason: '_meta does not contain a proof',
             errorCode: PROOF_VERIFICATION_ERROR_CODES.MISSING_REQUIRED_FIELD,
         };
     }
-    // Validate meta structure according to policy
-    const validation = validateMetaStructure(meta, policy);
-    if (!validation.valid) {
-        return {
-            success: false,
-            reason: validation.reason,
-            errorCode: PROOF_VERIFICATION_ERROR_CODES.META_POLICY_VIOLATION,
-        };
-    }
+    // Run the policy check for its semantics (strict ignores / allow-extensions
+    // surfaces coexisting keys). Under MCP 2026-07-28 (SEP-414) it never rejects,
+    // so it cannot block extraction — there is no policy-violation path here.
+    validateMetaStructure(meta, policy);
     const proofValidation = validateDetachedProof(proof);
     if (!proofValidation.success) {
         return {

package/dist/proof/verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../src/proof/verifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAmB,MAAM,4BAA4B,CAAC;AAK5E,OAAO,EACL,qBAAqB,GAGtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAE/B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EACL,sBAAsB,GAGvB,MAAM,gBAAgB,CAAC;AAmBxB,8DAA8D;AAC9D,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,2CAA2C;AAC3C,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,2CAA2C;AAC3C,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAE1C,MAAM,OAAO,aAAa;IAChB,aAAa,CAAgB;IAC7B,KAAK,CAAgB;IACrB,UAAU,CAAqB;IAC/B,KAAK,CAAgB;IACrB,oBAAoB,CAAS;IAC7B,eAAe,CAAS;IACxB,cAAc,CAAiB;IAEvC,YAAY,MAA2B;QACrC,IAAI,CAAC,aAAa,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;QAClC,IAAI,CAAC,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,IAAI,0BAA0B,CAAC;QACtF,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,GAAG,CAAC,CAAC,oBAAoB;IAC5E,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,WAAmB;QAClC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACrE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAClC,sBAAsB,EACtB,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAC1D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,WAAW,CACf,KAAoB,EACpB,YAAwB,EACxB,QAA4D;QAE5D,IAAI,CAAC;YACH,gDAAgD;YAChD,MAAM,sBAAsB,GAAG,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtE,MAAM,qBAAqB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACpD,sBAAsB,CACvB,CAAC;YAEF,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,YAAY,EAAE,qBAAqB,EAAE,QAAQ,CAAC,CAAC;QAClG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CACvB,KAAoB,EACpB,gBAAqC,EACrC,YAAwB;QAExB,IAAI,CAAC;YACH,oDAAoD;YACpD,MAAM,qBAAqB,GACzB,gBAAgB,YAAY,UAAU;gBACpC,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAEjD,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,uBAAuB,CACnC,KAAoB,EACpB,YAAwB,EACxB,qBAAiC,EACjC,QAA4D;QAE5D,8BAA8B;QAC9B,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC/B,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,MAAM,cAAc,GAAG,mBAAmB,CAAC,KAAM,CAAC;QAElD,+FAA+F;QAC/F,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,aAAa,CAC9C,cAAc,CAAC,IAAI,CAAC,KAAK,EACzB,cAAc,CAAC,IAAI,CAAC,GAAG,CACxB,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,0BAA0B;QAC1B,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CACtD,cAAc,CAAC,IAAI,CAAC,EAAE,CACvB,CAAC;QACF,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC/B,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,iDAAiD;QACjD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,eAAe,CACpD,cAAc,CAAC,GAAG,EAClB,YAAY,EACZ,qBAAqB,EACrB,cAAc,CAAC,IAAI,CAAC,GAAG,CACxB,CAAC;QACF,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC/B,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,oEAAoE;QACpE,4EAA4E;QAC5E,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,6EAA6E;QAC7E,oCAAoC;QACpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CACzD,cAAc,EACd,QAAQ,CACT,CAAC;YACF,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;gBAC7B,OAAO,iBAAiB,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,MAAM,IAAI,CAAC,eAAe,CACxB,cAAc,CAAC,IAAI,CAAC,KAAK,EACzB,cAAc,CAAC,IAAI,CAAC,GAAG,CACxB,CAAC;QAEF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,sBAAsB,CAClC,KAAoB,EACpB,QAA2D;QAE3D,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,sBAAsB,CAChE,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,QAAQ,EACjB,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAC3C,CAAC;QACF,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YAC3C,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EACJ,yEAAyE;gBAC3E,SAAS,EAAE,8BAA8B,CAAC,wBAAwB;aACnE,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,6EAA6E;QAC7E,uEAAuE;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC;QACjE,MAAM,sBAAsB,GAAG,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC;QAC/D,IAAI,kBAAkB,KAAK,sBAAsB,EAAE,CAAC;YAClD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,kBAAkB;oBACxB,CAAC,CAAC,uHAAuH;oBACzH,CAAC,CAAC,2EAA2E;gBAC/E,SAAS,EAAE,8BAA8B,CAAC,wBAAwB;aACnE,CAAC;QACJ,CAAC;QACD,IAAI,kBAAkB,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;YACnE,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EACJ,6GAA6G;gBAC/G,SAAS,EAAE,8BAA8B,CAAC,wBAAwB;aACnE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,uBAAuB,CAAC,KAAc;QAC5C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,0BAA0B;YAClC,SAAS,EAAE,8BAA8B,CAAC,kBAAkB;YAC5D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChE,OAAO,EAAE;gBACP,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aACrE;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,sBAAsB,CAClC,KAAoB;QAEpB,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,yBAAyB;gBACjC,SAAS,EAAE,8BAA8B,CAAC,uBAAuB;gBACjE,KAAK,EAAE,IAAI,KAAK,CACd,4BAA4B,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,CAC9D;gBACD,OAAO,EAAE;oBACP,eAAe,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO;iBACjD;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,gBAAgB,CAAC,IAAI;SAC7B,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa,CACzB,KAAa,EACb,QAAiB;QAEjB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,6CAA6C;gBACrD,SAAS,EAAE,8BAA8B,CAAC,qBAAqB;gBAC/D,OAAO,EAAE;oBACP,KAAK;oBACL,QAAQ;iBACT;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,iBAAiB,CAC7B,SAAiB;QAEjB,6EAA6E;QAC7E,MAAM,WAAW,GAAG,SAAS,GAAG,IAAI,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACrE,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uCAAuC,IAAI,CAAC,oBAAoB,IAAI;gBAC5E,SAAS,EAAE,8BAA8B,CAAC,uBAAuB;gBACjE,OAAO,EAAE;oBACP,SAAS;oBACT,WAAW;oBACX,WAAW,EAAE,IAAI,CAAC,oBAAoB;oBACtC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;iBAC9B;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAC3B,GAAW,EACX,YAAwB,EACxB,qBAAiC,EACjC,WAAoB;QAEpB,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CACvD,GAAG,EACH,YAAY,EACZ;YACE,eAAe,EAAE,qBAAqB;YACtC,WAAW;YACX,GAAG,EAAE,OAAO;SACb,CACF,CAAC;QAEF,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uBAAuB;gBAC/B,SAAS,EAAE,8BAA8B,CAAC,qBAAqB;gBAC/D,OAAO,EAAE;oBACP,SAAS,EAAE,GAAG,CAAC,MAAM;oBACrB,WAAW;oBACX,SAAS,EAAE,YAAY,CAAC,GAAG;iBAC5B;aACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAC3B,KAAa,EACb,QAAgB;QAEhB,8CAA8C;QAC9C,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,qBAAqB,CACzB,GAAW,EACX,GAAY;QAEZ,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAEhD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,sBAAsB,EACrD,2BAA2B,GAAG,EAAE,EAChC,EAAE,GAAG,EAAE,CACR,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,MAEX,CAAC;YAEF,IACE,CAAC,GAAG,CAAC,kBAAkB;gBACvB,GAAG,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,EACnC,CAAC;gBACD,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,6BAA6B,EAC5D,kDAAkD,GAAG,EAAE,EACvD,EAAE,GAAG,EAAE,CACR,CAAC;YACJ,CAAC;YAED,mDAAmD;YACnD,IAAI,kBAES,CAAC;YACd,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC1D,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAC9C,CAAC,EAAkB,EAAE,EAAE,CACrB,EAAE,CAAC,EAAE,KAAK,WAAW,IAAI,EAAE,CAAC,EAAE,KAAK,GAAG,GAAG,GAAG,WAAW,EAAE,CAC5D,CAAC;gBAEF,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBACxB,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,6BAA6B,EAC5D,0CAA0C,GAAG,EAAE,EAC/C;wBACE,GAAG;wBACH,GAAG;wBACH,aAAa,EAAE,GAAG,CAAC,kBAAkB,CAAC,GAAG,CACvC,CAAC,EAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAC9B;qBACF,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,CAAC,kBAAkB,EAAE,YAAY,EAAE,CAAC;gBACtC,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,oBAAoB,EACnD,iDAAiD,EACjD,EAAE,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAC3D,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAK9B,CAAC;YAEF,+BAA+B;YAC/B,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,kBAAkB,EACjD,sCAAsC,GAAG,CAAC,GAAG,SAAS,GAAG,CAAC,GAAG,EAAE,EAC/D,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAClD,CAAC;YACJ,CAAC;YAED,uEAAuE;YACvE,MAAM,MAAM,GAAG,GAAiB,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,kBAAkB,CAAC,EAAE,EAAE,CAAC;gBACzC,MAAM,CAAC,GAAG,GAAG,kBAAkB,CAAC,EAAE,CAAC;YACrC,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,qBAAqB,EACpD,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAClF;gBACE,GAAG;gBACH,GAAG;gBACH,aAAa,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aACtE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,qBAAqB,CAAC,IAA2B;QAC/C,iEAAiE;QACjE,qFAAqF;QACrF,MAAM,OAAO,GAAG;YACd,sEAAsE;YACtE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,kCAAkC;YACtD,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,sBAAsB;YACrC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,mCAAmC;YAElD,6BAA6B;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,mEAAmE;YACnE,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3E,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YAEzB,4CAA4C;YAC5C,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YACpD,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;SAC5C,CAAC;QAEF,qFAAqF;QACrF,gFAAgF;QAChF,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAA6B,EAC7B,SAAqB,QAAQ;IAE7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;IAElD,IAAI,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,0DAA0D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACxF,SAAS;SACV,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAA6B,EAC7B,SAAqB,QAAQ;IAE7B,uCAAuC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,8BAA8B;YACtC,SAAS,EAAE,8BAA8B,CAAC,sBAAsB;SACjE,CAAC;IACJ,CAAC;IAED,8CAA8C;IAC9C,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,UAAU,CAAC,MAAO;YAC1B,SAAS,EAAE,8BAA8B,CAAC,qBAAqB;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,eAAe,CAAC,KAAK,EAAE,OAAO,IAAI,yBAAyB;YACnE,SAAS,EAAE,8BAA8B,CAAC,uBAAuB;SAClE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,IAAK,EAAE,CAAC;AACzD,CAAC"}
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../src/proof/verifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAmB,MAAM,4BAA4B,CAAC;AAK5E,OAAO,EACL,qBAAqB,GAGtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAE/B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,GAGtB,MAAM,gBAAgB,CAAC;AAmBxB,8DAA8D;AAC9D,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,2CAA2C;AAC3C,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,2CAA2C;AAC3C,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAE1C,MAAM,OAAO,aAAa;IAChB,aAAa,CAAgB;IAC7B,KAAK,CAAgB;IACrB,UAAU,CAAqB;IAC/B,KAAK,CAAgB;IACrB,oBAAoB,CAAS;IAC7B,eAAe,CAAS;IACxB,cAAc,CAAiB;IAEvC,YAAY,MAA2B;QACrC,IAAI,CAAC,aAAa,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;QAClC,IAAI,CAAC,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,IAAI,0BAA0B,CAAC;QACtF,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,GAAG,CAAC,CAAC,oBAAoB;IAC5E,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,WAAmB;QAClC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACrE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAClC,sBAAsB,EACtB,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAC1D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,WAAW,CACf,KAAoB,EACpB,YAAwB,EACxB,QAA4D;QAE5D,IAAI,CAAC;YACH,gDAAgD;YAChD,MAAM,sBAAsB,GAAG,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtE,MAAM,qBAAqB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACpD,sBAAsB,CACvB,CAAC;YAEF,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,YAAY,EAAE,qBAAqB,EAAE,QAAQ,CAAC,CAAC;QAClG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CACvB,KAAoB,EACpB,gBAAqC,EACrC,YAAwB;QAExB,IAAI,CAAC;YACH,oDAAoD;YACpD,MAAM,qBAAqB,GACzB,gBAAgB,YAAY,UAAU;gBACpC,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAEjD,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,uBAAuB,CACnC,KAAoB,EACpB,YAAwB,EACxB,qBAAiC,EACjC,QAA4D;QAE5D,8BAA8B;QAC9B,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC/B,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,MAAM,cAAc,GAAG,mBAAmB,CAAC,KAAM,CAAC;QAElD,+FAA+F;QAC/F,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,aAAa,CAC9C,cAAc,CAAC,IAAI,CAAC,KAAK,EACzB,cAAc,CAAC,IAAI,CAAC,GAAG,CACxB,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,0BAA0B;QAC1B,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CACtD,cAAc,CAAC,IAAI,CAAC,EAAE,CACvB,CAAC;QACF,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC/B,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,iDAAiD;QACjD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,eAAe,CACpD,cAAc,CAAC,GAAG,EAClB,YAAY,EACZ,qBAAqB,EACrB,cAAc,CAAC,IAAI,CAAC,GAAG,CACxB,CAAC;QACF,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC/B,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,oEAAoE;QACpE,4EAA4E;QAC5E,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,6EAA6E;QAC7E,oCAAoC;QACpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CACzD,cAAc,EACd,QAAQ,CACT,CAAC;YACF,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;gBAC7B,OAAO,iBAAiB,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,MAAM,IAAI,CAAC,eAAe,CACxB,cAAc,CAAC,IAAI,CAAC,KAAK,EACzB,cAAc,CAAC,IAAI,CAAC,GAAG,CACxB,CAAC;QAEF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,sBAAsB,CAClC,KAAoB,EACpB,QAA2D;QAE3D,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,sBAAsB,CAChE,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,QAAQ,EACjB,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAC3C,CAAC;QACF,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YAC3C,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EACJ,yEAAyE;gBAC3E,SAAS,EAAE,8BAA8B,CAAC,wBAAwB;aACnE,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,6EAA6E;QAC7E,uEAAuE;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC;QACjE,MAAM,sBAAsB,GAAG,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC;QAC/D,IAAI,kBAAkB,KAAK,sBAAsB,EAAE,CAAC;YAClD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,kBAAkB;oBACxB,CAAC,CAAC,uHAAuH;oBACzH,CAAC,CAAC,2EAA2E;gBAC/E,SAAS,EAAE,8BAA8B,CAAC,wBAAwB;aACnE,CAAC;QACJ,CAAC;QACD,IAAI,kBAAkB,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;YACnE,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EACJ,6GAA6G;gBAC/G,SAAS,EAAE,8BAA8B,CAAC,wBAAwB;aACnE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,uBAAuB,CAAC,KAAc;QAC5C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,0BAA0B;YAClC,SAAS,EAAE,8BAA8B,CAAC,kBAAkB;YAC5D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChE,OAAO,EAAE;gBACP,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aACrE;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,sBAAsB,CAClC,KAAoB;QAEpB,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,yBAAyB;gBACjC,SAAS,EAAE,8BAA8B,CAAC,uBAAuB;gBACjE,KAAK,EAAE,IAAI,KAAK,CACd,4BAA4B,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,CAC9D;gBACD,OAAO,EAAE;oBACP,eAAe,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO;iBACjD;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,gBAAgB,CAAC,IAAI;SAC7B,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa,CACzB,KAAa,EACb,QAAiB;QAEjB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,6CAA6C;gBACrD,SAAS,EAAE,8BAA8B,CAAC,qBAAqB;gBAC/D,OAAO,EAAE;oBACP,KAAK;oBACL,QAAQ;iBACT;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,iBAAiB,CAC7B,SAAiB;QAEjB,6EAA6E;QAC7E,MAAM,WAAW,GAAG,SAAS,GAAG,IAAI,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACrE,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uCAAuC,IAAI,CAAC,oBAAoB,IAAI;gBAC5E,SAAS,EAAE,8BAA8B,CAAC,uBAAuB;gBACjE,OAAO,EAAE;oBACP,SAAS;oBACT,WAAW;oBACX,WAAW,EAAE,IAAI,CAAC,oBAAoB;oBACtC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;iBAC9B;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAC3B,GAAW,EACX,YAAwB,EACxB,qBAAiC,EACjC,WAAoB;QAEpB,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CACvD,GAAG,EACH,YAAY,EACZ;YACE,eAAe,EAAE,qBAAqB;YACtC,WAAW;YACX,GAAG,EAAE,OAAO;SACb,CACF,CAAC;QAEF,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uBAAuB;gBAC/B,SAAS,EAAE,8BAA8B,CAAC,qBAAqB;gBAC/D,OAAO,EAAE;oBACP,SAAS,EAAE,GAAG,CAAC,MAAM;oBACrB,WAAW;oBACX,SAAS,EAAE,YAAY,CAAC,GAAG;iBAC5B;aACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAC3B,KAAa,EACb,QAAgB;QAEhB,8CAA8C;QAC9C,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,qBAAqB,CACzB,GAAW,EACX,GAAY;QAEZ,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAEhD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,sBAAsB,EACrD,2BAA2B,GAAG,EAAE,EAChC,EAAE,GAAG,EAAE,CACR,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,MAEX,CAAC;YAEF,IACE,CAAC,GAAG,CAAC,kBAAkB;gBACvB,GAAG,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,EACnC,CAAC;gBACD,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,6BAA6B,EAC5D,kDAAkD,GAAG,EAAE,EACvD,EAAE,GAAG,EAAE,CACR,CAAC;YACJ,CAAC;YAED,mDAAmD;YACnD,IAAI,kBAES,CAAC;YACd,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC1D,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAC9C,CAAC,EAAkB,EAAE,EAAE,CACrB,EAAE,CAAC,EAAE,KAAK,WAAW,IAAI,EAAE,CAAC,EAAE,KAAK,GAAG,GAAG,GAAG,WAAW,EAAE,CAC5D,CAAC;gBAEF,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBACxB,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,6BAA6B,EAC5D,0CAA0C,GAAG,EAAE,EAC/C;wBACE,GAAG;wBACH,GAAG;wBACH,aAAa,EAAE,GAAG,CAAC,kBAAkB,CAAC,GAAG,CACvC,CAAC,EAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAC9B;qBACF,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,CAAC,kBAAkB,EAAE,YAAY,EAAE,CAAC;gBACtC,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,oBAAoB,EACnD,iDAAiD,EACjD,EAAE,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAC3D,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAK9B,CAAC;YAEF,+BAA+B;YAC/B,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,kBAAkB,EACjD,sCAAsC,GAAG,CAAC,GAAG,SAAS,GAAG,CAAC,GAAG,EAAE,EAC/D,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAClD,CAAC;YACJ,CAAC;YAED,uEAAuE;YACvE,MAAM,MAAM,GAAG,GAAiB,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,kBAAkB,CAAC,EAAE,EAAE,CAAC;gBACzC,MAAM,CAAC,GAAG,GAAG,kBAAkB,CAAC,EAAE,CAAC;YACrC,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,qBAAqB,EACpD,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAClF;gBACE,GAAG;gBACH,GAAG;gBACH,aAAa,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aACtE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,qBAAqB,CAAC,IAA2B;QAC/C,iEAAiE;QACjE,qFAAqF;QACrF,MAAM,OAAO,GAAG;YACd,sEAAsE;YACtE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,kCAAkC;YACtD,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,sBAAsB;YACrC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,mCAAmC;YAElD,6BAA6B;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,mEAAmE;YACnE,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3E,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YAEzB,4CAA4C;YAC5C,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YACpD,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;SAC5C,CAAC;QAEF,qFAAqF;QACrF,gFAAgF;QAChF,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,0BAA0B,GAAG,CAAC,0BAA0B,CAAU,CAAC;AACzE,MAAM,sBAAsB,GAAG,CAAC,aAAa,EAAE,YAAY,EAAE,SAAS,CAAU,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,OAAO,CACJ,sBAA4C,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC3D,0BAA0B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAA6B,EAC7B,SAAqB,QAAQ;IAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CACxC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,qBAAqB,IAAI,CAAC,KAAK,qBAAqB,CAChE,CAAC;IAEF,2EAA2E;IAC3E,8EAA8E;IAC9E,8CAA8C;IAC9C,IAAI,MAAM,KAAK,kBAAkB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACpC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAA6B,EAC7B,SAAqB,QAAQ;IAE7B,2EAA2E;IAC3E,4EAA4E;IAC5E,wBAAwB;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gCAAgC;YACxC,SAAS,EAAE,8BAA8B,CAAC,sBAAsB;SACjE,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEpC,MAAM,eAAe,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,eAAe,CAAC,KAAK,EAAE,OAAO,IAAI,yBAAyB;YACnE,SAAS,EAAE,8BAA8B,CAAC,uBAAuB;SAClE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,IAAK,EAAE,CAAC;AACzD,CAAC"}

package/dist/providers/grant-store.d.ts

@@ -60,7 +60,16 @@ export declare abstract class GrantStore {
     abstract bind(grant: Grant): Promise<void>;
     /** Active grants for an agent DID, optionally narrowed to required scopes. */
     abstract getByAgent(agentDid: string, requiredScopes?: string[]): Promise<Grant[]>;
-    /** Active grants bound to a session, optionally narrowed to required scopes. */
+    /**
+     * Active grants bound to a session, optionally narrowed to required scopes.
+     *
+     * SECURITY: this path resolves on possession of the `sessionId` ALONE — there
+     * is no per-request proof here — so the session id is a bearer capability and
+     * its confidentiality is load-bearing (treat it like a secret; never log or
+     * expose it). For privileged scopes prefer holder-of-key (`holderBinding:
+     * 'enforce'` + {@link GrantStore.getByAgent}), which re-proves possession of
+     * the agent's key on every request and does not rely on session secrecy.
+     */
     abstract getBySession(sessionId: string, requiredScopes?: string[]): Promise<Grant[]>;
     /** A grant by id regardless of status (returns revoked/expired records too). */
     abstract getById(id: string): Promise<Grant | undefined>;

package/dist/providers/grant-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-store.d.ts","sourceRoot":"","sources":["../../src/providers/grant-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,WAAW,KAAK;IACpB,sDAAsD;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,aAAa,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACzC,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,8BAAsB,UAAU;IAC9B,oCAAoC;IACpC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1C,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAClF,gFAAgF;IAChF,QAAQ,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IACrF,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;IACxD,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC3D,4BAA4B;IAC5B,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAiB,SAAQ,UAAU;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IACnD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,OAAO,GAAE,uBAA4B;IAK3C,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjC,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAMzE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAM5E,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;IAK/C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOlD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAS9B,gDAAgD;IAChD,OAAO,CAAC,YAAY;IAWpB,OAAO,CAAC,YAAY;CAIrB"}
+{"version":3,"file":"grant-store.d.ts","sourceRoot":"","sources":["../../src/providers/grant-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,WAAW,KAAK;IACpB,sDAAsD;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,aAAa,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACzC,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,8BAAsB,UAAU;IAC9B,oCAAoC;IACpC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1C,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAClF;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IACrF,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;IACxD,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC3D,4BAA4B;IAC5B,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAiB,SAAQ,UAAU;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IACnD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,OAAO,GAAE,uBAA4B;IAK3C,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjC,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAMzE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAM5E,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;IAK/C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOlD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAS9B,gDAAgD;IAChD,OAAO,CAAC,YAAY;IAWpB,OAAO,CAAC,YAAY;CAIrB"}

package/dist/providers/grant-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"grant-store.js","sourceRoot":"","sources":["../../src/providers/grant-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA+BH;;;GAGG;AACH,MAAM,OAAgB,UAAU;CAa/B;AAOD;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC7B,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IAClC,GAAG,CAAe;IAEnC,YAAY,UAAmC,EAAE;QAC/C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAY;QACrB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,cAAyB;QAC1D,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC,CACvE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,cAAyB;QAC7D,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC,CACzE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAe;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;QACzB,IAAI,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,gBAAgB,GAAG,MAAM,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC5D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,gDAAgD;IACxC,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAY,EAAE,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAS;YACzC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,SAAS;YACtE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,YAAY,CAAC,KAAY,EAAE,cAAyB;QAC1D,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;CACF"}
+{"version":3,"file":"grant-store.js","sourceRoot":"","sources":["../../src/providers/grant-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA+BH;;;GAGG;AACH,MAAM,OAAgB,UAAU;CAsB/B;AAOD;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC7B,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IAClC,GAAG,CAAe;IAEnC,YAAY,UAAmC,EAAE;QAC/C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAY;QACrB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,cAAyB;QAC1D,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC,CACvE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,cAAyB;QAC7D,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC,CACzE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAe;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;QACzB,IAAI,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,gBAAgB,GAAG,MAAM,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC5D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,gDAAgD;IACxC,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAY,EAAE,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAS;YACzC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,SAAS;YACtE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,YAAY,CAAC,KAAY,EAAE,cAAyB;QAC1D,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;CACF"}

package/dist/session/index.d.ts

@@ -1,2 +1,3 @@
 export { SessionManager, createHandshakeRequest, validateHandshakeFormat, type SessionConfig, type HandshakeResult, } from './manager.js';
+export { SessionStore, MemorySessionStore, type MemorySessionStoreOptions, } from './session-store.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/session/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,oBAAoB,CAAC"}

package/dist/session/index.js

@@ -1,2 +1,3 @@
 export { SessionManager, createHandshakeRequest, validateHandshakeFormat, } from './manager.js';
+export { SessionStore, MemorySessionStore, } from './session-store.js';
 //# sourceMappingURL=index.js.map

package/dist/session/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,GAGxB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,GAGxB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,YAAY,EACZ,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC"}

package/dist/session/manager.d.ts

@@ -11,6 +11,7 @@
 import { type KyaOsErrorCode } from "../errors.js";
 import type { HandshakeRequest, SessionContext, NonceCache, MetaPolicy } from '../types/protocol.js';
 import type { CryptoProvider } from '../providers/base.js';
+import { SessionStore } from './session-store.js';
 export interface SessionConfig {
     timestampSkewSeconds?: number;
     sessionTtlMinutes?: number;
@@ -19,7 +20,20 @@ export interface SessionConfig {
     serverDid?: string;
     /** Maximum number of concurrent sessions. Oldest sessions are evicted when exceeded. Default: 10000 */
     maxSessions?: number;
-    /** Policy for _meta field validation in proof verification. Default: 'strict' */
+    /**
+     * Optional pluggable session store. Defaults to an in-memory
+     * {@link MemorySessionStore} that reproduces the prior single-process
+     * behavior. Inject a durable {@link SessionStore} (Redis / Durable Object /
+     * DB) to make sessions survive restarts and resolve across instances (enables
+     * the wallet-less cross-instance retry + proof-nonce continuity).
+     */
+    sessionStore?: SessionStore;
+    /**
+     * Policy for non-KYA-OS `_meta` keys during proof verification (SEP-414).
+     * Default 'strict' IGNORES foreign keys (never hashed, trusted, or rejected);
+     * 'allow-extensions' surfaces them. Neither rejects coexisting reserved keys
+     * such as `io.modelcontextprotocol/*` or `traceparent`. See {@link MetaPolicy}.
+     */
     metaPolicy?: MetaPolicy;
 }
 export interface HandshakeResult {
@@ -34,9 +48,7 @@ export interface HandshakeResult {
 export declare class SessionManager {
     private config;
     private cryptoProvider;
-    private sessions;
-    private sessionInsertionOrder;
-    private maxSessions;
+    private sessionStore;
     constructor(cryptoProvider: CryptoProvider, config?: SessionConfig);
     setServerDid(serverDid: string): void;
     /**
@@ -67,7 +79,6 @@ export declare class SessionManager {
     private normalizeClientInfoString;
     private buildClientInfo;
     static generateNonce(): string;
-    private evictIfNeeded;
     cleanup(): Promise<void>;
     getStats(): {
         activeSessions: number;
@@ -78,7 +89,7 @@ export declare class SessionManager {
             cacheType: string;
         };
     };
-    clearSessions(): void;
+    clearSessions(): Promise<void>;
 }
 export declare function createHandshakeRequest(audience: string): HandshakeRequest;
 export declare function validateHandshakeFormat(request: unknown): request is HandshakeRequest;

package/dist/session/manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/session/manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,UAAU,EACX,MAAM,sBAAsB,CAAC;AAK9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAI3D,MAAM,WAAW,aAAa;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uGAAuG;IACvG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,cAAc,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAIZ;IACF,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,QAAQ,CAAqC;IACrD,OAAO,CAAC,qBAAqB,CAAgB;IAC7C,OAAO,CAAC,WAAW,CAAS;gBAEhB,cAAc,EAAE,cAAc,EAAE,MAAM,GAAE,aAAkB;IAuBtE,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIrC;;;;;;;;;;OAUG;IACG,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAsF5E;;;;;;;;;OASG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;YA2BrD,iBAAiB;YAWjB,gBAAgB;IAQ9B,OAAO,CAAC,yBAAyB;YAMnB,eAAe;IA2B7B,MAAM,CAAC,aAAa,IAAI,MAAM;IAa9B,OAAO,CAAC,aAAa;IASf,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA0B9B,QAAQ,IAAI;QACV,cAAc,EAAE,MAAM,CAAC;QACvB,MAAM,EAAE;YACN,oBAAoB,EAAE,MAAM,CAAC;YAC7B,iBAAiB,EAAE,MAAM,CAAC;YAC1B,uBAAuB,CAAC,EAAE,MAAM,CAAC;YACjC,SAAS,EAAE,MAAM,CAAC;SACnB,CAAC;KACH;IAYD,aAAa,IAAI,IAAI;CAItB;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CAMzE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,gBAAgB,CAYrF"}
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/session/manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,UAAU,EACX,MAAM,sBAAsB,CAAC;AAK9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAsB,MAAM,oBAAoB,CAAC;AAGtE,MAAM,WAAW,aAAa;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uGAAuG;IACvG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,cAAc,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAIZ;IACF,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,YAAY,CAAe;gBAEvB,cAAc,EAAE,cAAc,EAAE,MAAM,GAAE,aAAkB;IAyBtE,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIrC;;;;;;;;;;OAUG;IACG,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAoF5E;;;;;;;;;OASG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;YA2BrD,iBAAiB;YAWjB,gBAAgB;IAQ9B,OAAO,CAAC,yBAAyB;YAMnB,eAAe;IA2B7B,MAAM,CAAC,aAAa,IAAI,MAAM;IAaxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAuB9B,QAAQ,IAAI;QACV,cAAc,EAAE,MAAM,CAAC;QACvB,MAAM,EAAE;YACN,oBAAoB,EAAE,MAAM,CAAC;YAC7B,iBAAiB,EAAE,MAAM,CAAC;YAC1B,uBAAuB,CAAC,EAAE,MAAM,CAAC;YACjC,SAAS,EAAE,MAAM,CAAC;SACnB,CAAC;KACH;IAYK,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;CAGrC;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CAMzE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,gBAAgB,CAYrF"}

package/dist/session/manager.js

@@ -11,16 +11,17 @@
 import { KYA_OS_ERROR_CODES } from "../errors.js";
 import { AUTH_NONCE_TTL_MS, ANON_NONCE_TTL_MS, } from '../types/protocol.js';
 import { MemoryNonceCacheProvider } from '../providers/memory.js';
+import { MemorySessionStore } from './session-store.js';
 import { logger } from '../logging/index.js';
 export class SessionManager {
     config;
     cryptoProvider;
-    sessions = new Map();
-    sessionInsertionOrder = [];
-    maxSessions;
+    sessionStore;
     constructor(cryptoProvider, config = {}) {
         this.cryptoProvider = cryptoProvider;
-        this.maxSessions = config.maxSessions ?? 10_000;
+        this.sessionStore =
+            config.sessionStore ??
+                new MemorySessionStore({ maxSessions: config.maxSessions ?? 10_000 });
         this.config = {
             timestampSkewSeconds: config.timestampSkewSeconds ?? 120,
             sessionTtlMinutes: config.sessionTtlMinutes ?? 30,
@@ -107,9 +108,7 @@ export class SessionManager {
                 ...(this.config.serverDid && { serverDid: this.config.serverDid }),
                 ...(clientInfo && { clientInfo }),
             };
-            this.evictIfNeeded();
-            this.sessions.set(sessionId, session);
-            this.sessionInsertionOrder.push(sessionId);
+            await this.sessionStore.set(sessionId, session);
             return { success: true, session };
         }
         catch (error) {
@@ -133,26 +132,26 @@ export class SessionManager {
      * @returns Session context if valid, null if expired or not found
      */
     async getSession(sessionId) {
-        const session = this.sessions.get(sessionId);
+        const session = await this.sessionStore.get(sessionId);
         if (!session)
             return null;
         const now = Math.floor(Date.now() / 1000);
         const idleTimeSeconds = now - session.lastActivity;
         const maxIdleSeconds = session.ttlMinutes * 60;
         if (idleTimeSeconds > maxIdleSeconds) {
-            this.sessions.delete(sessionId);
+            await this.sessionStore.delete(sessionId);
             return null;
         }
         if (this.config.absoluteSessionLifetime !== undefined) {
             const sessionAgeSeconds = now - session.createdAt;
             const maxAgeSeconds = this.config.absoluteSessionLifetime * 60;
             if (sessionAgeSeconds > maxAgeSeconds) {
-                this.sessions.delete(sessionId);
+                await this.sessionStore.delete(sessionId);
                 return null;
             }
         }
         session.lastActivity = now;
-        this.sessions.set(sessionId, session);
+        await this.sessionStore.set(sessionId, session);
         return session;
     }
     async generateSessionId() {
@@ -210,17 +209,9 @@ export class SessionManager {
             .replace(/\//g, '_')
             .replace(/=/g, '');
     }
-    evictIfNeeded() {
-        while (this.sessions.size >= this.maxSessions && this.sessionInsertionOrder.length > 0) {
-            const oldest = this.sessionInsertionOrder.shift();
-            if (oldest) {
-                this.sessions.delete(oldest);
-            }
-        }
-    }
     async cleanup() {
         const now = Math.floor(Date.now() / 1000);
-        for (const [sessionId, session] of this.sessions.entries()) {
+        for (const [sessionId, session] of await this.sessionStore.entries()) {
             const idleTimeSeconds = now - session.lastActivity;
             const maxIdleSeconds = session.ttlMinutes * 60;
             let expired = idleTimeSeconds > maxIdleSeconds;
@@ -230,15 +221,15 @@ export class SessionManager {
                 expired = sessionAgeSeconds > maxAgeSeconds;
             }
             if (expired) {
-                this.sessions.delete(sessionId);
+                await this.sessionStore.delete(sessionId);
             }
         }
-        this.sessionInsertionOrder = this.sessionInsertionOrder.filter(id => this.sessions.has(id));
+        await this.sessionStore.cleanup();
         await this.config.nonceCache.cleanup();
     }
     getStats() {
         return {
-            activeSessions: this.sessions.size,
+            activeSessions: this.sessionStore.size(),
             config: {
                 timestampSkewSeconds: this.config.timestampSkewSeconds,
                 sessionTtlMinutes: this.config.sessionTtlMinutes,
@@ -247,9 +238,8 @@ export class SessionManager {
             },
         };
     }
-    clearSessions() {
-        this.sessions.clear();
-        this.sessionInsertionOrder = [];
+    async clearSessions() {
+        await this.sessionStore.clear();
     }
 }
 export function createHandshakeRequest(audience) {