@kya-os/mcp 1.6.1 → 1.9.0

package/dist/middleware/with-kya-os-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os-server.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAwB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAG7E,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,MAAM,EAAE,cAAc,CAAC;IACvB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,4BAA4B;IAC5B,OAAO,CAAC,EAAE;QAAE,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,kEAAkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,0DAA0D;IAC1D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,qCAAqC;IACrC,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACrC;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,mBAAmB,CAAC,CAS9B;AAED;;;GAGG;AACH,UAAU,aAAa;IACrB,OAAO,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,YAAY,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CACxC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,eAAe,CAAC,CAuE1B"}
+{"version":3,"file":"with-kya-os-server.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAwB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAG7E,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,MAAM,EAAE,cAAc,CAAC;IACvB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B;;;;OAIG;IACH,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC5C,kEAAkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,0DAA0D;IAC1D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,qCAAqC;IACrC,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC;;;;OAIG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACrC;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,mBAAmB,CAAC,CAS9B;AAED;;;GAGG;AACH,UAAU,aAAa;IACrB,OAAO,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,YAAY,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CACxC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,eAAe,CAAC,CA2E1B"}

package/dist/middleware/with-kya-os-server.js

@@ -58,6 +58,10 @@ export async function withKyaOs(server, options) {
         session: options.session,
         delegation: options.delegation,
         autoSession: options.autoSession ?? true,
+        ...(options.grantStore ? { grantStore: options.grantStore } : {}),
+        ...(options.emitLegacyProofKey !== undefined
+            ? { emitLegacyProofKey: options.emitLegacyProofKey }
+            : {}),
     }, options.crypto);
     if ((options.handshakeExposure ?? "tool") === "tool") {
         // Register the unified _kyaos tool for protocol operations.

package/dist/middleware/with-kya-os-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os-server.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,EACL,cAAc,EACd,qBAAqB,GAItB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAkB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyBxB;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO;QACL,GAAG;QACH,GAAG,EAAE,GAAG,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;QACpC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAWD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAqB,EACrB,OAAyB;IAEzB,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,IAAI,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/D,MAAM,KAAK,GAAG,qBAAqB,CACjC;QACE,QAAQ;QACR,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;KACzC,EACD,OAAO,CAAC,MAAM,CACf,CAAC;IAEF,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QACrD,4DAA4D;QAC5D,MAAM,CAAC,YAAY,CACjB,QAAQ,EACR;YACE,WAAW,EACT,iFAAiF;YACnF,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,IAAI,EAAE;YAC7D,WAAW,EAAE;gBACX,MAAM,EAAE,CAAC;qBACN,IAAI,CAAC,cAAc,CAAC;qBACpB,QAAQ,CAAC,+BAA+B,CAAC;gBAC5C,KAAK,EAAE,CAAC;qBACL,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,2CAA2C,CAAC;gBACxD,QAAQ,EAAE,CAAC;qBACR,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,+BAA+B,CAAC;gBAC5C,SAAS,EAAE,CAAC;qBACT,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,gCAAgC,CAAC;gBAC7C,QAAQ,EAAE,CAAC;qBACR,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,wCAAwC,CAAC;aACtD;SACF,EACD,KAAK,EAAE,IAAa,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CACpC,IAA+B,CAChC,CAAC;YACF,OAAO;gBACL,GAAG,MAAM;gBACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC;aACtE,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,EAAE;IACF,yEAAyE;IACzE,oEAAoE;IACpE,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEpD,MAAM,CAAC,OAAO,GAAG,CAAC,SAAoB,EAAE,EAAE,CACxC,eAAe,CAAC,oBAAoB,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"with-kya-os-server.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,EACL,cAAc,EACd,qBAAqB,GAItB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAkB,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA0CxB;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO;QACL,GAAG;QACH,GAAG,EAAE,GAAG,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;QACpC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAWD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAqB,EACrB,OAAyB;IAEzB,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,IAAI,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/D,MAAM,KAAK,GAAG,qBAAqB,CACjC;QACE,QAAQ;QACR,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QACxC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;YACpD,CAAC,CAAC,EAAE,CAAC;KACR,EACD,OAAO,CAAC,MAAM,CACf,CAAC;IAEF,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QACrD,4DAA4D;QAC5D,MAAM,CAAC,YAAY,CACjB,QAAQ,EACR;YACE,WAAW,EACT,iFAAiF;YACnF,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,IAAI,EAAE;YAC7D,WAAW,EAAE;gBACX,MAAM,EAAE,CAAC;qBACN,IAAI,CAAC,cAAc,CAAC;qBACpB,QAAQ,CAAC,+BAA+B,CAAC;gBAC5C,KAAK,EAAE,CAAC;qBACL,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,2CAA2C,CAAC;gBACxD,QAAQ,EAAE,CAAC;qBACR,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,+BAA+B,CAAC;gBAC5C,SAAS,EAAE,CAAC;qBACT,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,gCAAgC,CAAC;gBAC7C,QAAQ,EAAE,CAAC;qBACR,MAAM,EAAE;qBACR,QAAQ,EAAE;qBACV,QAAQ,CAAC,wCAAwC,CAAC;aACtD;SACF,EACD,KAAK,EAAE,IAAa,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CACpC,IAA+B,CAChC,CAAC;YACF,OAAO;gBACL,GAAG,MAAM;gBACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC;aACtE,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,EAAE;IACF,yEAAyE;IACzE,oEAAoE;IACpE,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEpD,MAAM,CAAC,OAAO,GAAG,CAAC,SAAoB,EAAE,EAAE,CACxC,eAAe,CAAC,oBAAoB,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/middleware/with-kya-os.config-types.d.ts

@@ -0,0 +1,139 @@
+/**
+ * KYA-OS Middleware — configuration input types.
+ *
+ * The identity / session / delegation configuration a caller passes to
+ * `withKyaOs` / `createKyaOsMiddleware`. Split from the API-surface types
+ * (`./with-kya-os.types.ts`), which re-exports these so importers are unchanged.
+ */
+import type { FetchProvider, NonceCacheProvider } from "../providers/base.js";
+import type { AuditLogProvider } from "../providers/audit-log.js";
+import type { GrantStore } from "../providers/grant-store.js";
+import type { SessionConfig } from "../session/manager.js";
+import type { DIDResolver, StatusListResolver } from "../delegation/vc-verifier.js";
+import type { DIDResolverRegistry } from "../delegation/did-resolver-registry.js";
+import type { RevocationChecker } from "../delegation/chain-enforcement.js";
+import type { DelegationCredential } from "../types/protocol.js";
+export interface KyaOsIdentityConfig {
+    did: string;
+    kid: string;
+    privateKey: string;
+    publicKey: string;
+    agentName?: string;
+}
+export declare const KYA_OS_ACTIONS: readonly ["handshake", "identity", "reputation"];
+export type KyaOsAction = (typeof KYA_OS_ACTIONS)[number];
+export interface KyaOsDelegationConfig {
+    /**
+     * Optional custom DID resolver. If it returns null, middleware falls back to
+     * built-in did:key resolution and fetch-backed did:web resolution.
+     */
+    didResolver?: DIDResolver;
+    /**
+     * Optional fetch provider used for did:web resolution.
+     * If omitted, middleware falls back to the runtime global fetch when available.
+     */
+    fetchProvider?: FetchProvider;
+    /**
+     * Optional DID method resolver registry. Entries are keyed by DID method
+     * (for example, "cheqd") and are checked before the built-in did:key and
+     * did:web fallback. Factory entries receive the active fetch provider.
+     */
+    didResolvers?: DIDResolverRegistry;
+    /**
+     * Resolver for StatusList2021 checks. Credentials with credentialStatus are
+     * rejected when no resolver is configured.
+     */
+    statusListResolver?: StatusListResolver;
+    /**
+     * Resolve ancestor credentials for a delegated chain. The returned array may
+     * contain only ancestors (root -> parent) or the full chain (root -> leaf).
+     */
+    resolveDelegationChain?: (leafCredential: DelegationCredential) => Promise<DelegationCredential[]>;
+    /**
+     * Graph-backed ancestor-revocation check. When provided, the chain walk also
+     * verifies the leaf is not revoked via a cascade-revoked ANCESTOR — caught
+     * independently of how `resolveDelegationChain` hydrated the chain (it walks
+     * the delegation graph + StatusList). `CascadingRevocationManager` is the
+     * reference adapter. Omit to keep the prior per-credential-status behavior.
+     */
+    revocationChecker?: RevocationChecker;
+    /**
+     * Holder-of-key enforcement for inbound calls (spec §11.8). A valid delegation
+     * is a *bearer* credential; holder binding additionally requires the caller to
+     * present a per-request proof (`_kyaos_proof`) signed by the delegation
+     * SUBJECT's key, closing theft-replay for the key-bearing population.
+     *
+     * - `'off'` (default): no holder-binding check — current behavior, unchanged.
+     * - `'warn'`: check and log failures (missing/unbound proof), but still allow.
+     * - `'enforce'`: reject calls whose proof is missing or does not bind the
+     *   subject. **Breaking for callers that don't yet send `_kyaos_proof`** — opt
+     *   in only once your agents mint request proofs.
+     *
+     * Scope is did:key subjects (the DID encodes the key). did:web and other
+     * subjects are deferred to cnf-based binding (phase 2) and logged, never
+     * rejected — so enabling `'enforce'` never breaks did:web traffic.
+     */
+    holderBinding?: "off" | "warn" | "enforce";
+}
+export interface KyaOsConfig {
+    /** Agent identity (DID + key material) */
+    identity: KyaOsIdentityConfig;
+    /** Session configuration overrides */
+    session?: Omit<SessionConfig, "nonceCache">;
+    /**
+     * Replay-protection store, shared by the session handshake AND inbound holder
+     * binding so both draw on one nonce namespace. Defaults to an in-memory store
+     * (single-process only); inject a Redis / Durable Object / KV-backed
+     * {@link NonceCacheProvider} for multi-instance deployments. Set here, not on
+     * `session`, so there is exactly one cache and the two cannot diverge.
+     */
+    nonceCache?: NonceCacheProvider;
+    /**
+     * Durable store for approved authorization grants, enabling the no-paste
+     * retry: an agent that already obtained a grant can call again — even on a
+     * fresh instance with empty memory, or after a restart — without re-pasting
+     * the delegation. Defaults to an in-memory {@link MemoryGrantStore}
+     * (single-process only); inject a Redis / Durable Object / DB-backed
+     * {@link GrantStore} for multi-instance deployments. Mirrors `nonceCache?`.
+     *
+     * For the no-paste retry to actually RESOLVE a bound grant, the call must be
+     * resolvable: either holder binding is `'enforce'` and the agent presents a
+     * per-request `_kyaos_proof` (agent-anchored `getByAgent`), or the client
+     * threads its `sessionId` (session-bearer `getBySession`). A grant that would
+     * be unresolvable — holder binding `'off'` with no threaded `sessionId` — is
+     * NOT bound (it would only orphan a store row); such flows achieve durability
+     * by re-presenting the delegation instead.
+     */
+    grantStore?: GrantStore;
+    /**
+     * Whether to ALSO emit the detached proof under the legacy bare `_meta.proof`
+     * key (in addition to the namespaced `org.kya-os/proof`). The value is
+     * identical under both keys and `_meta` is excluded from the response hash
+     * (§7.6), so the mirror never affects signatures or verification.
+     *
+     * Default `true` — a transition aid so pre-1.1 clients that still read bare
+     * `proof` keep working. Set `false` once your clients read the namespaced key
+     * (the examples do this for a clean single-key Inspector view).
+     *
+     * Stays ON by default for the whole 1.x line (a pre-1.1 reader of bare
+     * `_meta.proof` would otherwise silently get no proof); the legacy mirror is
+     * dropped at 2.0.
+     */
+    emitLegacyProofKey?: boolean;
+    /** Delegation verification overrides */
+    delegation?: KyaOsDelegationConfig;
+    /**
+     * When true, automatically creates a session on the first tool call
+     * if no session exists. Useful for demos and development where
+     * MCP clients don't support the `_kyaos` handshake flow.
+     * In production, KYA-OS-aware runtimes should execute handshake before tool calls.
+     */
+    autoSession?: boolean;
+    /**
+     * Sink for retaining audit records of verified tool calls. Defaults to a
+     * no-op; supply an {@link AuditLogProvider} (e.g. a durable, append-only
+     * implementation) to capture an audit trail.
+     */
+    auditLog?: AuditLogProvider;
+}
+//# sourceMappingURL=with-kya-os.config-types.d.ts.map

package/dist/middleware/with-kya-os.config-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-kya-os.config-types.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.config-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,cAAc,kDAAmD,CAAC;AAC/E,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CACvB,cAAc,EAAE,oBAAoB,KACjC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACrC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,WAAW;IAC1B,0CAA0C;IAC1C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,sCAAsC;IACtC,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC5C;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC;;;;;;;;;;;;;;;OAeG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,wCAAwC;IACxC,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B"}

package/dist/middleware/with-kya-os.config-types.js

@@ -0,0 +1,9 @@
+/**
+ * KYA-OS Middleware — configuration input types.
+ *
+ * The identity / session / delegation configuration a caller passes to
+ * `withKyaOs` / `createKyaOsMiddleware`. Split from the API-surface types
+ * (`./with-kya-os.types.ts`), which re-exports these so importers are unchanged.
+ */
+export const KYA_OS_ACTIONS = ["handshake", "identity", "reputation"];
+//# sourceMappingURL=with-kya-os.config-types.js.map

package/dist/middleware/with-kya-os.config-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-kya-os.config-types.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.config-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAsBH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,YAAY,CAAU,CAAC"}

package/dist/middleware/with-kya-os.d.ts

@@ -14,240 +14,9 @@
  * internally by `withKyaOs()` and for advanced use cases like the
  * low-level `Server` API or custom request handler patterns.
  */
-import { type CryptoProvider, type FetchProvider, type NonceCacheProvider } from "../providers/base.js";
-import { AuditLogProvider } from "../providers/audit-log.js";
-import { SessionManager, type SessionConfig } from "../session/manager.js";
-import { ProofGenerator } from "../proof/generator.js";
-import { type DIDResolver, type StatusListResolver } from "../delegation/vc-verifier.js";
-import { type RevocationChecker } from "../delegation/chain-enforcement.js";
-import { type DelegationCredential, type NeedsAuthorizationError } from "../types/protocol.js";
-import { RiskClassifier } from "../policy/classifier.js";
-import { type ApprovalGrant } from "../policy/approval.js";
-import type { PolicyEngine } from "../policy/engine.js";
-export interface KyaOsIdentityConfig {
-    did: string;
-    kid: string;
-    privateKey: string;
-    publicKey: string;
-    agentName?: string;
-}
-export declare const KYA_OS_ACTIONS: readonly ["handshake", "identity", "reputation"];
-export interface KyaOsDelegationConfig {
-    /**
-     * Optional custom DID resolver. If it returns null, middleware falls back to
-     * built-in did:key resolution and fetch-backed did:web resolution.
-     */
-    didResolver?: DIDResolver;
-    /**
-     * Optional fetch provider used for did:web resolution.
-     * If omitted, middleware falls back to the runtime global fetch when available.
-     */
-    fetchProvider?: FetchProvider;
-    /**
-     * Resolver for StatusList2021 checks. Credentials with credentialStatus are
-     * rejected when no resolver is configured.
-     */
-    statusListResolver?: StatusListResolver;
-    /**
-     * Resolve ancestor credentials for a delegated chain. The returned array may
-     * contain only ancestors (root -> parent) or the full chain (root -> leaf).
-     */
-    resolveDelegationChain?: (leafCredential: DelegationCredential) => Promise<DelegationCredential[]>;
-    /**
-     * Graph-backed ancestor-revocation check. When provided, the chain walk also
-     * verifies the leaf is not revoked via a cascade-revoked ANCESTOR — caught
-     * independently of how `resolveDelegationChain` hydrated the chain (it walks
-     * the delegation graph + StatusList). `CascadingRevocationManager` is the
-     * reference adapter. Omit to keep the prior per-credential-status behavior.
-     */
-    revocationChecker?: RevocationChecker;
-    /**
-     * Holder-of-key enforcement for inbound calls (spec §11.8). A valid delegation
-     * is a *bearer* credential; holder binding additionally requires the caller to
-     * present a per-request proof (`_kyaos_proof`) signed by the delegation
-     * SUBJECT's key, closing theft-replay for the key-bearing population.
-     *
-     * - `'off'` (default): no holder-binding check — current behavior, unchanged.
-     * - `'warn'`: check and log failures (missing/unbound proof), but still allow.
-     * - `'enforce'`: reject calls whose proof is missing or does not bind the
-     *   subject. **Breaking for callers that don't yet send `_kyaos_proof`** — opt
-     *   in only once your agents mint request proofs.
-     *
-     * Scope is did:key subjects (the DID encodes the key). did:web and other
-     * subjects are deferred to cnf-based binding (phase 2) and logged, never
-     * rejected — so enabling `'enforce'` never breaks did:web traffic.
-     */
-    holderBinding?: "off" | "warn" | "enforce";
-}
-export interface KyaOsConfig {
-    /** Agent identity (DID + key material) */
-    identity: KyaOsIdentityConfig;
-    /** Session configuration overrides */
-    session?: Omit<SessionConfig, "nonceCache">;
-    /**
-     * Replay-protection store, shared by the session handshake AND inbound holder
-     * binding so both draw on one nonce namespace. Defaults to an in-memory store
-     * (single-process only); inject a Redis / Durable Object / KV-backed
-     * {@link NonceCacheProvider} for multi-instance deployments. Set here, not on
-     * `session`, so there is exactly one cache and the two cannot diverge.
-     */
-    nonceCache?: NonceCacheProvider;
-    /** Delegation verification overrides */
-    delegation?: KyaOsDelegationConfig;
-    /**
-     * When true, automatically creates a session on the first tool call
-     * if no session exists. Useful for demos and development where
-     * MCP clients don't support the `_kyaos` handshake flow.
-     * In production, KYA-OS-aware runtimes should execute handshake before tool calls.
-     */
-    autoSession?: boolean;
-    /**
-     * Sink for retaining audit records of verified tool calls. Defaults to a
-     * no-op; supply an {@link AuditLogProvider} (e.g. a durable, append-only
-     * implementation) to capture an audit trail.
-     */
-    auditLog?: AuditLogProvider;
-}
-export interface KyaOsToolDefinition {
-    name: string;
-    description?: string;
-    inputSchema: {
-        type: "object";
-        properties?: Record<string, unknown>;
-        required?: string[];
-        [key: string]: unknown;
-    };
-}
-/**
- * Per-call context threaded through the middleware wrappers (not part of the
- * tool's public arguments). `wrapWithDelegation` populates `scopeId` so the
- * proof and audit record reflect the scope the call was authorized under.
- */
-export interface KyaOsCallContext {
-    scopeId?: string;
-}
-export interface KyaOsToolHandler<T extends Record<string, unknown> = Record<string, unknown>> {
-    (args: T, sessionId?: string, context?: KyaOsCallContext): Promise<{
-        content: Array<{
-            type: string;
-            text: string;
-            [key: string]: unknown;
-        }>;
-        isError?: boolean;
-        [key: string]: unknown;
-    }>;
-}
-/**
- * Server interface — minimal subset of @modelcontextprotocol/sdk Server.
- * This avoids a hard dependency on the SDK at the type level.
- */
-export interface KyaOsServer {
-    setRequestHandler(schema: unknown, handler: (...args: unknown[]) => unknown): void;
-}
-export interface KyaOsMiddleware {
-    /** The identity config used by this middleware instance */
-    identity: KyaOsIdentityConfig;
-    /** The SessionManager instance for manual session operations */
-    sessionManager: SessionManager;
-    /** The ProofGenerator instance for manual proof operations */
-    proofGenerator: ProofGenerator;
-    /**
-     * Unified tool definition for `_kyaos`.
-     * Include this in your ListToolsRequest handler's tool list.
-     */
-    kyaOsTool: KyaOsToolDefinition;
-    /**
-     * @deprecated Use `kyaOsTool` (`_kyaos` with `action: "handshake"`).
-     * Tool definition for `_kyaos_handshake`.
-     * Include this in your ListToolsRequest handler's tool list.
-     */
-    handshakeTool: KyaOsToolDefinition;
-    /**
-     * Handle a unified `_kyaos` action. Use this in your CallToolRequest handler
-     * when `request.params.name === '_kyaos'`.
-     */
-    handleKyaOs(args: Record<string, unknown>): Promise<{
-        content: Array<{
-            type: string;
-            text: string;
-        }>;
-        isError?: boolean;
-    }>;
-    /**
-     * @deprecated Use `handleKyaOs` with `action: "handshake"`.
-     * Handle a handshake call. Use this in your CallToolRequest handler
-     * when `request.params.name === '_kyaos_handshake'`.
-     */
-    handleHandshake(args: Record<string, unknown>): Promise<{
-        content: Array<{
-            type: string;
-            text: string;
-        }>;
-        isError?: boolean;
-    }>;
-    /**
-     * Wrap a tool handler to automatically generate proofs.
-     * Returns a new handler that appends proof metadata to the response.
-     */
-    wrapWithProof<T extends Record<string, unknown> = Record<string, unknown>>(toolName: string, handler: KyaOsToolHandler<T>): KyaOsToolHandler;
-    /**
-     * Wrap a tool handler to require a valid W3C Delegation Credential.
-     *
-     * Caller must pass the VC as `_kyaos_delegation` in the tool args.
-     * - If absent: returns a `needs_authorization` response with the consentUrl.
-     * - If present but invalid: returns a structured error with reason.
-     * - If valid with correct scope: strips `_kyaos_delegation` and calls the handler.
-     */
-    wrapWithDelegation(toolName: string, config: {
-        scopeId: string;
-        consentUrl: string;
-        /**
-         * Optional presentation hook for the `needs_authorization` challenge.
-         * Given the structured challenge, return the tool-response content to emit
-         * (e.g. a markdown "Authorize" link for LLM / chat-style MCP clients that
-         * won't parse raw JSON). The signed challenge proof binds a `responseHash`
-         * over WHATEVER this returns, so the `authorizationUrl` stays tamper-evident
-         * regardless of presentation. Defaults to the structured challenge as JSON.
-         */
-        formatChallenge?: (challenge: NeedsAuthorizationError) => Array<{
-            type: "text";
-            text: string;
-        }>;
-    }, handler: KyaOsToolHandler): KyaOsToolHandler;
-    /**
-     * Wrap a tool handler with a per-action policy / step-up gate.
-     *
-     * Compose after `wrapWithDelegation`. Classifies the action's risk and asks a
-     * pluggable PolicyEngine: allow → run handler; deny → signed denial proof;
-     * step_up → `needs_approval` until N-of-M signed approval grants (bound to the
-     * request hash) are supplied.
-     */
-    withPolicyGate?(toolName: string, handler: KyaOsToolHandler, opts?: PolicyGateOptions): KyaOsToolHandler;
-}
-export interface PolicyGateOptions {
-    /** Policy decision engine. Defaults to a fail-closed DefaultPolicyEngine. */
-    engine?: PolicyEngine;
-    /** Risk classifier. Defaults to the built-in RiskClassifier. */
-    classifier?: RiskClassifier;
-    /** Derive the resource namespace from the tool args (defaults to the tool name). */
-    resolveNamespace?: (args: Record<string, unknown>) => string;
-    /** Tool-arg key carrying approval grants on resume. Default "_kyaos_approvals". */
-    approvalsArgKey?: string;
-    /** Verifier for approval-grant signatures (identity-layer). Default: reject all. */
-    isValidApprovalSignature?: (grant: ApprovalGrant) => Promise<boolean>;
-    /**
-     * Whether a prior step already authorized this action's scope/identity.
-     *
-     * Defaults to FALSE (fail-closed): used standalone, withPolicyGate enforces no
-     * scope or identity, so it must NOT be trusted to allow on its own. When you
-     * compose it AFTER wrapWithDelegation (the expected usage), pass
-     * `scopeMatched: true` to signal that the delegated scope was already verified.
-     * Note: principal facts are projected from the (unverified) `_kyaos_delegation`
-     * arg on a best-effort basis and must not be treated as authenticated unless
-     * wrapWithDelegation ran first.
-     */
-    scopeMatched?: boolean;
-}
+import { type CryptoProvider } from "../providers/base.js";
+import { type KyaOsConfig, type KyaOsMiddleware } from "./with-kya-os.types.js";
+export * from "./with-kya-os.types.js";
 /**
  * Create KYA-OS middleware for a standard MCP SDK Server.
  *
@@ -265,10 +34,13 @@ export interface PolicyGateOptions {
  * @returns Middleware components for session management and proof generation
  *
  * @remarks
- * **Single-process only**: This middleware stores session state in memory using closure
- * variables (`activeSessionId`, `sessionNonces`). It is NOT suitable for multi-instance
- * deployments behind a load balancer. For distributed deployments, implement a custom
- * `SessionStore` backed by Redis, DynamoDB, or similar and pass it via `config.session`.
+ * **Session resolution**: proof generation resolves the session from the explicit
+ * `sessionId` threaded into each wrapper. A single-process `activeSessionId`
+ * fallback (the established handshake/auto session) is consulted ONLY when no
+ * sessionId was threaded — e.g. non-KYA-OS clients (MCP Inspector) and the
+ * transport auto-proof path; a KYA-OS-aware call never depends on it. By default
+ * sessions live in an in-memory Map; for multi-instance deployments inject a
+ * durable `SessionStore` via `config.session.sessionStore`.
  */
 export declare function createKyaOsMiddleware(config: KyaOsConfig, cryptoProvider: CryptoProvider): KyaOsMiddleware;
 //# sourceMappingURL=with-kya-os.d.ts.map

package/dist/middleware/with-kya-os.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-kya-os.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACxB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAwB,MAAM,2BAA2B,CAAC;AACnF,OAAO,EACL,cAAc,EACd,KAAK,aAAa,EAEnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,EAIf,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAEL,KAAK,WAAW,EAEhB,KAAK,kBAAkB,EACxB,MAAM,8BAA8B,CAAC;AAatC,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAGL,KAAK,oBAAoB,EAEzB,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAMxD,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,cAAc,kDAAmD,CAAC;AAG/E,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CACvB,cAAc,EAAE,oBAAoB,KACjC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACrC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,WAAW;IAC1B,0CAA0C;IAC1C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,sCAAsC;IACtC,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC5C;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,wCAAwC;IACxC,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB,CAC/B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAE3D,CACE,IAAI,EAAE,CAAC,EACP,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC;QACT,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC,CAAC;QACvE,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC,CAAC;CACJ;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,iBAAiB,CACf,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,GACvC,IAAI,CAAC;CACT;AAED,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,QAAQ,EAAE,mBAAmB,CAAC;IAE9B,gEAAgE;IAChE,cAAc,EAAE,cAAc,CAAC;IAE/B,8DAA8D;IAC9D,cAAc,EAAE,cAAc,CAAC;IAE/B;;;OAGG;IACH,SAAS,EAAE,mBAAmB,CAAC;IAE/B;;;;OAIG;IACH,aAAa,EAAE,mBAAmB,CAAC;IAEnC;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QAClD,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;IAEH;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;IAEH;;;OAGG;IACH,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvE,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAC3B,gBAAgB,CAAC;IAEpB;;;;;;;OAOG;IACH,kBAAkB,CAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB;;;;;;;WAOG;QACH,eAAe,CAAC,EAAE,CAChB,SAAS,EAAE,uBAAuB,KAC/B,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC5C,EACD,OAAO,EAAE,gBAAgB,GACxB,gBAAgB,CAAC;IAEpB;;;;;;;OAOG;IAGH,cAAc,CAAC,CACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,EACzB,IAAI,CAAC,EAAE,iBAAiB,GACvB,gBAAgB,CAAC;CACrB;AAwBD,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,gEAAgE;IAChE,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC;IAC7D,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,wBAAwB,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAmCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,WAAW,EACnB,cAAc,EAAE,cAAc,GAC7B,eAAe,CA23BjB"}
+{"version":3,"file":"with-kya-os.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAa3D,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAC;AAUhC,cAAc,wBAAwB,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,WAAW,EACnB,cAAc,EAAE,cAAc,GAC7B,eAAe,CA2GjB"}

package/dist/middleware/with-kya-os.delegation-gate.d.ts

@@ -0,0 +1,19 @@
+/**
+ * KYA-OS Middleware — the delegation gate (`wrapWithDelegation`).
+ *
+ * Requires a valid W3C Delegation Credential (or a durable grant / no-paste
+ * retry), enforces holder-of-key binding (spec §11.8) and scope, then strips the
+ * `_kyaos*` control namespace and runs the handler. Extracted from
+ * `./with-kya-os.ts`; verification plumbing lives in `./with-kya-os.delegation-verify.ts`.
+ */
+import type { KyaOsDelegationGate } from "./with-kya-os.types.js";
+import type { MiddlewareDeps, AttachOutcomeProof } from "./with-kya-os.deps.js";
+import type { GrantResolution } from "./with-kya-os.grants.js";
+/** Collaborators the delegation gate borrows from its sibling sub-factories. */
+export interface DelegationGateWiring {
+    attachOutcomeProof: AttachOutcomeProof;
+    resolveExistingGrant: GrantResolution["resolveExistingGrant"];
+    bindGrantOnSuccess: GrantResolution["bindGrantOnSuccess"];
+}
+export declare function createDelegationGate(deps: MiddlewareDeps, wiring: DelegationGateWiring): Pick<KyaOsDelegationGate, "wrapWithDelegation">;
+//# sourceMappingURL=with-kya-os.delegation-gate.d.ts.map

package/dist/middleware/with-kya-os.delegation-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-kya-os.delegation-gate.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.delegation-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgBH,OAAO,KAAK,EAEV,mBAAmB,EACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAO/D,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,oBAAoB,EAAE,eAAe,CAAC,sBAAsB,CAAC,CAAC;IAC9D,kBAAkB,EAAE,eAAe,CAAC,oBAAoB,CAAC,CAAC;CAC3D;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,oBAAoB,GAC3B,IAAI,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAuPjD"}