@kya-os/mcp 1.6.1 → 1.9.0

package/dist/authz/oidc/pending-flow-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-flow-store.d.ts","sourceRoot":"","sources":["../../../src/authz/oidc/pending-flow-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,8BAAsB,gBAAgB;IACpC,iFAAiF;IACjF,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC5E,oEAAoE;IACpE,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAC7D;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IACjE,gDAAgD;IAChD,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC7C,4BAA4B;IAC5B,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,6BAA6B;IAC5C,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,gBAAgB;IAC1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+D;IACvF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,OAAO,GAAE,6BAAkC;IAKjD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAUpD,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAUxD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAM/B"}

package/dist/authz/oidc/pending-flow-store.js

@@ -0,0 +1,82 @@
+/**
+ * PendingFlowStore — the provider seam for in-flight OAuth/OIDC PKCE state.
+ *
+ * Between {@link GenericOidcAdapter.initiateFlow} (which mints a resume token and
+ * the PKCE `codeVerifier`) and the authorization callback (which exchanges the
+ * code), the verifier must be held server-side keyed by the resume token — it is
+ * never placed on the wire. Holding it in a per-process `Map` breaks the moment a
+ * second instance or a restart enters the picture: if the callback lands on
+ * another instance the verifier is gone, the token exchange fails closed, and no
+ * grant is ever minted.
+ *
+ * This seam mirrors {@link GrantStore} / `NonceCacheProvider`: the in-memory
+ * implementation here is the dev/reference impl; production injects a Redis /
+ * Durable Object / database-backed store behind the same interface so
+ * `initiateFlow` on instance A and the callback on instance B share one verifier.
+ *
+ * `get` (non-consuming read) and `delete` (consume) are kept separate so the
+ * adapter can preserve its one-time-use ordering: it reads the pending flow,
+ * validates `state`, performs the token exchange, and deletes ONLY after the
+ * exchange succeeds — so a transient IdP error does not burn the resume token.
+ *
+ * Production note: a durable backing SHOULD make `delete`-after-exchange atomic
+ * (e.g. Redis `GETDEL`, or a compare-and-set) to close the one-time-use replay
+ * window across instances.
+ */
+/**
+ * Store for pending (awaiting-callback) OAuth/OIDC PKCE flows. Implementations
+ * persist a flow under a resume token with a TTL, read it back (non-consuming),
+ * consume it after a successful exchange, and sweep expired entries.
+ */
+export class PendingFlowStore {
+}
+/**
+ * In-memory {@link PendingFlowStore} — the dev/reference implementation.
+ *
+ * NOT for production: pending flows are lost on restart and are invisible to a
+ * sibling instance, so a callback that lands elsewhere cannot complete. Inject a
+ * Redis / Durable Object / database-backed store for multi-instance deployments.
+ */
+export class MemoryPendingFlowStore extends PendingFlowStore {
+    pending = new Map();
+    now;
+    constructor(options = {}) {
+        super();
+        this.now = options.now ?? (() => Date.now());
+    }
+    async put(token, flow, ttlMs) {
+        this.pending.set(token, { flow: { ...flow }, expiresAt: this.now() + ttlMs });
+    }
+    async get(token) {
+        const entry = this.pending.get(token);
+        if (!entry)
+            return undefined;
+        if (entry.expiresAt <= this.now()) {
+            this.pending.delete(token);
+            return undefined;
+        }
+        return { ...entry.flow };
+    }
+    async consume(token) {
+        // get + delete with NO await in between → atomic in single-threaded JS:
+        // a second consume() for the same token sees nothing.
+        const entry = this.pending.get(token);
+        if (!entry)
+            return undefined;
+        this.pending.delete(token);
+        if (entry.expiresAt <= this.now())
+            return undefined;
+        return { ...entry.flow };
+    }
+    async delete(token) {
+        this.pending.delete(token);
+    }
+    async cleanup() {
+        const now = this.now();
+        for (const [token, entry] of this.pending) {
+            if (entry.expiresAt <= now)
+                this.pending.delete(token);
+        }
+    }
+}
+//# sourceMappingURL=pending-flow-store.js.map

package/dist/authz/oidc/pending-flow-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-flow-store.js","sourceRoot":"","sources":["../../../src/authz/oidc/pending-flow-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAWH;;;;GAIG;AACH,MAAM,OAAgB,gBAAgB;CAmBrC;AAOD;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,gBAAgB;IACzC,OAAO,GAAG,IAAI,GAAG,EAAoD,CAAC;IACtE,GAAG,CAAe;IAEnC,YAAY,UAAyC,EAAE;QACrD,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,IAAiB,EAAE,KAAa;QACvD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,wEAAwE;QACxE,sDAAsD;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,SAAS,CAAC;QACpD,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;CACF"}

package/dist/card/build.d.ts

@@ -0,0 +1,41 @@
+/**
+ * KYA-OS Entity Card — EMIT.
+ *
+ * `buildCard` projects this entity's identity + declared facts into a card. Pure,
+ * claim-minimal: it asserts only identity + type + declared capabilities (trust-bearing
+ * claims are proven by the referenced credentials, not minted here). `conformanceLevel`
+ * is intentionally omitted — it is a derived value a verifier recomputes.
+ */
+import type { Attestation, BitstringStatusListEntry, Capability, CimdBinding, Ed25519PublicJwk, EntityCard, EntityType, ProofProfile } from './schema.js';
+export interface BuildCardFacts {
+    entityType: EntityType;
+    name: string;
+    capabilities?: Capability[];
+    responsibleParty?: string;
+    principal?: string;
+    delegationRef?: string;
+    attestations?: Attestation[];
+    didDocument?: string;
+    /** Card's Ed25519 public JWK (for a card that inlines its verification key). */
+    publicKeyJwk?: Ed25519PublicJwk;
+    /** Names the per-request holder-of-key proof profile this entity's requests carry. */
+    proofProfile?: ProofProfile;
+    /** L1 CIMD on-ramp coordinates (client_id ⇄ did:web, jwks_uri ⇄ DID keys). */
+    cimd?: CimdBinding;
+    /** W3C Bitstring Status List revocation entry (the post-issuance kill switch). */
+    revocation?: BitstringStatusListEntry;
+}
+/** Minimal identity shape this helper needs (structurally compatible with `Identity`). */
+export interface CardIdentity {
+    did: string;
+    kid?: string;
+    createdAt?: string;
+}
+/**
+ * Build this entity's card from its identity + declared facts. Pure. Asserts only
+ * identity + type + declared capabilities (claim-minimalism — trust-bearing claims are
+ * proven by the referenced credentials, not minted here). `conformanceLevel` is
+ * intentionally omitted on emit: it is a derived value a verifier recomputes.
+ */
+export declare function buildCard(identity: CardIdentity, facts: BuildCardFacts): EntityCard;
+//# sourceMappingURL=build.d.ts.map

package/dist/card/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/card/build.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,wBAAwB,EACxB,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,YAAY,EACb,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,sFAAsF;IACtF,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,8EAA8E;IAC9E,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,kFAAkF;IAClF,UAAU,CAAC,EAAE,wBAAwB,CAAC;CACvC;AAED,0FAA0F;AAC1F,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,GAAG,UAAU,CAmBnF"}

package/dist/card/build.js

@@ -0,0 +1,47 @@
+/**
+ * KYA-OS Entity Card — EMIT.
+ *
+ * `buildCard` projects this entity's identity + declared facts into a card. Pure,
+ * claim-minimal: it asserts only identity + type + declared capabilities (trust-bearing
+ * claims are proven by the referenced credentials, not minted here). `conformanceLevel`
+ * is intentionally omitted — it is a derived value a verifier recomputes.
+ */
+/**
+ * Build this entity's card from its identity + declared facts. Pure. Asserts only
+ * identity + type + declared capabilities (claim-minimalism — trust-bearing claims are
+ * proven by the referenced credentials, not minted here). `conformanceLevel` is
+ * intentionally omitted on emit: it is a derived value a verifier recomputes.
+ */
+export function buildCard(identity, facts) {
+    const card = {
+        id: identity.did,
+        entityType: facts.entityType,
+        name: facts.name,
+    };
+    if (identity.kid !== undefined)
+        card.kid = identity.kid;
+    if (identity.createdAt !== undefined)
+        card.createdAt = identity.createdAt;
+    if (facts.capabilities !== undefined)
+        card.capabilities = facts.capabilities;
+    if (facts.responsibleParty !== undefined)
+        card.responsibleParty = facts.responsibleParty;
+    if (facts.principal !== undefined)
+        card.principal = facts.principal;
+    if (facts.delegationRef !== undefined)
+        card.delegationRef = facts.delegationRef;
+    if (facts.attestations !== undefined)
+        card.attestations = facts.attestations;
+    if (facts.didDocument !== undefined)
+        card.didDocument = facts.didDocument;
+    if (facts.publicKeyJwk !== undefined)
+        card.publicKeyJwk = facts.publicKeyJwk;
+    if (facts.proofProfile !== undefined)
+        card.proofProfile = facts.proofProfile;
+    if (facts.cimd !== undefined)
+        card.cimd = facts.cimd;
+    if (facts.revocation !== undefined)
+        card.revocation = facts.revocation;
+    return card;
+}
+//# sourceMappingURL=build.js.map

package/dist/card/build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../src/card/build.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAuCH;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,QAAsB,EAAE,KAAqB;IACrE,MAAM,IAAI,GAAe;QACvB,EAAE,EAAE,QAAQ,CAAC,GAAG;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC;IACF,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS;QAAE,IAAI,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;IACxD,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;QAAE,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IAC1E,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IAC7E,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;QAAE,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACzF,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACpE,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAChF,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IAC7E,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IAC1E,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IAC7E,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IAC7E,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACrD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/card/builder.d.ts

@@ -0,0 +1,99 @@
+/**
+ * KYA-OS Entity Card — fluent BUILDER (the 10-minute adoption path).
+ *
+ * `card({ did, entityType, name })` opens a fluent chain that accumulates declared facts and
+ * `.build()`s them into an `EntityCard` — a thin, ergonomic front over {@link buildCard} that
+ * hides the card shape behind readable, self-documenting calls:
+ *
+ *   card({ did, entityType: 'agent', name: 'Acme Pay' })
+ *     .capability('search')                              // L1 bare-string capability
+ *     .attestedCapability('payments.transfer', vc)       // L2 attested capability (VC-backed)
+ *     .accountableTo('did:web:acme.example', { via: 'vc_root>del_123' })
+ *     .build();
+ *
+ * Claim-minimal like `buildCard`: it asserts only identity + type + declared capabilities +
+ * accountability locators; trust-bearing claims are PROVEN by the referenced credentials, not
+ * minted here. The infrastructure coordinates it can ALSO carry — `.usesProof()` (proof profile),
+ * `.cimd()`, `.revocation()`, `.didDocument()`, `.publicKey()` — are self-descriptive pointers, not
+ * credential-proven claims, so the ergonomic path can emit a card that plugs into the proof / CIMD /
+ * revocation machinery. `conformanceLevel` is intentionally never set — a verifier RECOMPUTES it.
+ * Pure, no I/O, no crypto: no runtime (`mcp-i-core`) dependency leaks in.
+ */
+import type { Attestation, BitstringStatusListEntry, CapabilityAttestation, CimdBinding, Ed25519PublicJwk, EntityCard, EntityType } from './schema.js';
+/** A Verifiable Credential value (a compact VC-JWT string or a pre-parsed object). */
+export type VcInput = CapabilityAttestation['vc'];
+/** The identity + type coordinates a card chain opens with. */
+export interface CardBuilderInit {
+    did: string;
+    entityType: EntityType;
+    name: string;
+    kid?: string;
+    createdAt?: string;
+}
+/** Accountability locators for `accountableTo`: the delegation chain (`via`) + human `principal`. */
+export interface AccountableToOptions {
+    /** Compact delegation-chain locator (`delegationRef`, e.g. `vc_root>del_123`) — resolved, not inlined. */
+    via?: string;
+    /** The immediate human delegator DID (`principal`), when distinct from the responsible party. */
+    principal?: string;
+}
+/**
+ * A fluent accumulator over one card's declared facts. Mutable + chainable (each method returns
+ * `this`); `.build()` projects the accumulated facts through {@link buildCard}. Prefer the `card()`
+ * factory over `new CardBuilder(...)`.
+ */
+export declare class CardBuilder {
+    private readonly identity;
+    private readonly entityType;
+    private readonly name;
+    private readonly capabilities;
+    private readonly attestations;
+    private responsibleParty?;
+    private principal?;
+    private delegationRef?;
+    private proofProfile?;
+    private cimdBinding?;
+    private revocationEntry?;
+    private didDocumentUrl?;
+    private publicKeyJwk?;
+    constructor(init: CardBuilderInit);
+    /** Declare an L1 bare-string capability (self-asserted; a verifier floors it at L1). */
+    capability(name: string): this;
+    /**
+     * Declare an L2 capability backed by an attestation VC. Repeated calls for the SAME capability
+     * name accumulate onto its `attestations[]` (one capability, several proofs) rather than
+     * duplicating the entry.
+     */
+    attestedCapability(name: string, vc: VcInput): this;
+    /**
+     * Attach a standalone attestation (e.g. a KYC/KYB `IdentityVerification` VC on the responsible
+     * party) that is not tied to a single capability.
+     */
+    attestation(attestation: Attestation): this;
+    /**
+     * Declare the accountability edge: `responsibleParty` is the ultimately-accountable root (a
+     * KYC-able org), `opts.via` the compact `delegationRef` chain locator, and `opts.principal` the
+     * immediate human delegator. A verifier RECOMPUTES this edge (delegationRef → responsibleParty).
+     */
+    accountableTo(responsibleParty: string, opts?: AccountableToOptions): this;
+    /**
+     * Advertise the per-request holder-of-key proof profile (`org.kya-os/proof@1`). This only NAMES
+     * the profile — the proof itself is never on the static card; it rides per-request `_meta`.
+     */
+    usesProof(): this;
+    /** Bind the L1 CIMD on-ramp coordinates (`client_id` ⇄ `did:web`, `jwks_uri` ⇄ DID keys). */
+    cimd(binding: CimdBinding): this;
+    /** Attach the W3C Bitstring Status List revocation entry (the post-issuance kill switch). */
+    revocation(entry: BitstringStatusListEntry): this;
+    /** Record the entity's DID document URL (where the `KyaOsEntityCard` service entry lives). */
+    didDocument(url: string): this;
+    /** Inline the entity's Ed25519 public JWK (the card's self-contained verification key). */
+    publicKey(jwk: Ed25519PublicJwk): this;
+    /** Project the accumulated facts into an `EntityCard` (via {@link buildCard}). */
+    build(): EntityCard;
+    /** Find an already-declared attested capability by name (for attestation accumulation). */
+    private findAttested;
+}
+/** Open a fluent card-building chain (the ergonomic entry point). */
+export declare function card(init: CardBuilderInit): CardBuilder;
+//# sourceMappingURL=builder.d.ts.map

package/dist/card/builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../src/card/builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,KAAK,EACV,WAAW,EACX,wBAAwB,EAExB,qBAAqB,EACrB,WAAW,EACX,gBAAgB,EAChB,UAAU,EACV,UAAU,EAGX,MAAM,aAAa,CAAC;AAKrB,sFAAsF;AACtF,MAAM,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;AAElD,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qGAAqG;AACrG,MAAM,WAAW,oBAAoB;IACnC,0GAA0G;IAC1G,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iGAAiG;IACjG,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoB;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAClC,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,YAAY,CAAC,CAAe;IACpC,OAAO,CAAC,WAAW,CAAC,CAAc;IAClC,OAAO,CAAC,eAAe,CAAC,CAA2B;IACnD,OAAO,CAAC,cAAc,CAAC,CAAS;IAChC,OAAO,CAAC,YAAY,CAAC,CAAmB;gBAE5B,IAAI,EAAE,eAAe;IAQjC,wFAAwF;IACxF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAK9B;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,GAAG,IAAI;IAOnD;;;OAGG;IACH,WAAW,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI;IAK3C;;;;OAIG;IACH,aAAa,CAAC,gBAAgB,EAAE,MAAM,EAAE,IAAI,GAAE,oBAAyB,GAAG,IAAI;IAO9E;;;OAGG;IACH,SAAS,IAAI,IAAI;IAKjB,6FAA6F;IAC7F,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAKhC,6FAA6F;IAC7F,UAAU,CAAC,KAAK,EAAE,wBAAwB,GAAG,IAAI;IAKjD,8FAA8F;IAC9F,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAK9B,2FAA2F;IAC3F,SAAS,CAAC,GAAG,EAAE,gBAAgB,GAAG,IAAI;IAKtC,kFAAkF;IAClF,KAAK,IAAI,UAAU;IAiBnB,2FAA2F;IAC3F,OAAO,CAAC,YAAY;CAKrB;AAED,qEAAqE;AACrE,wBAAgB,IAAI,CAAC,IAAI,EAAE,eAAe,GAAG,WAAW,CAEvD"}

package/dist/card/builder.js

@@ -0,0 +1,147 @@
+/**
+ * KYA-OS Entity Card — fluent BUILDER (the 10-minute adoption path).
+ *
+ * `card({ did, entityType, name })` opens a fluent chain that accumulates declared facts and
+ * `.build()`s them into an `EntityCard` — a thin, ergonomic front over {@link buildCard} that
+ * hides the card shape behind readable, self-documenting calls:
+ *
+ *   card({ did, entityType: 'agent', name: 'Acme Pay' })
+ *     .capability('search')                              // L1 bare-string capability
+ *     .attestedCapability('payments.transfer', vc)       // L2 attested capability (VC-backed)
+ *     .accountableTo('did:web:acme.example', { via: 'vc_root>del_123' })
+ *     .build();
+ *
+ * Claim-minimal like `buildCard`: it asserts only identity + type + declared capabilities +
+ * accountability locators; trust-bearing claims are PROVEN by the referenced credentials, not
+ * minted here. The infrastructure coordinates it can ALSO carry — `.usesProof()` (proof profile),
+ * `.cimd()`, `.revocation()`, `.didDocument()`, `.publicKey()` — are self-descriptive pointers, not
+ * credential-proven claims, so the ergonomic path can emit a card that plugs into the proof / CIMD /
+ * revocation machinery. `conformanceLevel` is intentionally never set — a verifier RECOMPUTES it.
+ * Pure, no I/O, no crypto: no runtime (`mcp-i-core`) dependency leaks in.
+ */
+import { buildCard } from './build.js';
+import { PROOF_PROFILE_ID } from './schema.js';
+/** The single proof profile a KYA-OS card advertises (holder-of-key, per-request `_meta`). */
+const KYA_OS_PROOF_PROFILE = PROOF_PROFILE_ID;
+/**
+ * A fluent accumulator over one card's declared facts. Mutable + chainable (each method returns
+ * `this`); `.build()` projects the accumulated facts through {@link buildCard}. Prefer the `card()`
+ * factory over `new CardBuilder(...)`.
+ */
+export class CardBuilder {
+    identity;
+    entityType;
+    name;
+    capabilities = [];
+    attestations = [];
+    responsibleParty;
+    principal;
+    delegationRef;
+    proofProfile;
+    cimdBinding;
+    revocationEntry;
+    didDocumentUrl;
+    publicKeyJwk;
+    constructor(init) {
+        this.identity = { did: init.did };
+        if (init.kid !== undefined)
+            this.identity.kid = init.kid;
+        if (init.createdAt !== undefined)
+            this.identity.createdAt = init.createdAt;
+        this.entityType = init.entityType;
+        this.name = init.name;
+    }
+    /** Declare an L1 bare-string capability (self-asserted; a verifier floors it at L1). */
+    capability(name) {
+        this.capabilities.push(name);
+        return this;
+    }
+    /**
+     * Declare an L2 capability backed by an attestation VC. Repeated calls for the SAME capability
+     * name accumulate onto its `attestations[]` (one capability, several proofs) rather than
+     * duplicating the entry.
+     */
+    attestedCapability(name, vc) {
+        const existing = this.findAttested(name);
+        if (existing)
+            existing.attestations.push({ vc });
+        else
+            this.capabilities.push({ name, attestations: [{ vc }] });
+        return this;
+    }
+    /**
+     * Attach a standalone attestation (e.g. a KYC/KYB `IdentityVerification` VC on the responsible
+     * party) that is not tied to a single capability.
+     */
+    attestation(attestation) {
+        this.attestations.push(attestation);
+        return this;
+    }
+    /**
+     * Declare the accountability edge: `responsibleParty` is the ultimately-accountable root (a
+     * KYC-able org), `opts.via` the compact `delegationRef` chain locator, and `opts.principal` the
+     * immediate human delegator. A verifier RECOMPUTES this edge (delegationRef → responsibleParty).
+     */
+    accountableTo(responsibleParty, opts = {}) {
+        this.responsibleParty = responsibleParty;
+        if (opts.via !== undefined)
+            this.delegationRef = opts.via;
+        if (opts.principal !== undefined)
+            this.principal = opts.principal;
+        return this;
+    }
+    /**
+     * Advertise the per-request holder-of-key proof profile (`org.kya-os/proof@1`). This only NAMES
+     * the profile — the proof itself is never on the static card; it rides per-request `_meta`.
+     */
+    usesProof() {
+        this.proofProfile = KYA_OS_PROOF_PROFILE;
+        return this;
+    }
+    /** Bind the L1 CIMD on-ramp coordinates (`client_id` ⇄ `did:web`, `jwks_uri` ⇄ DID keys). */
+    cimd(binding) {
+        this.cimdBinding = binding;
+        return this;
+    }
+    /** Attach the W3C Bitstring Status List revocation entry (the post-issuance kill switch). */
+    revocation(entry) {
+        this.revocationEntry = entry;
+        return this;
+    }
+    /** Record the entity's DID document URL (where the `KyaOsEntityCard` service entry lives). */
+    didDocument(url) {
+        this.didDocumentUrl = url;
+        return this;
+    }
+    /** Inline the entity's Ed25519 public JWK (the card's self-contained verification key). */
+    publicKey(jwk) {
+        this.publicKeyJwk = jwk;
+        return this;
+    }
+    /** Project the accumulated facts into an `EntityCard` (via {@link buildCard}). */
+    build() {
+        return buildCard(this.identity, {
+            entityType: this.entityType,
+            name: this.name,
+            ...(this.capabilities.length > 0 ? { capabilities: this.capabilities } : {}),
+            ...(this.attestations.length > 0 ? { attestations: this.attestations } : {}),
+            ...(this.responsibleParty !== undefined ? { responsibleParty: this.responsibleParty } : {}),
+            ...(this.principal !== undefined ? { principal: this.principal } : {}),
+            ...(this.delegationRef !== undefined ? { delegationRef: this.delegationRef } : {}),
+            ...(this.proofProfile !== undefined ? { proofProfile: this.proofProfile } : {}),
+            ...(this.cimdBinding !== undefined ? { cimd: this.cimdBinding } : {}),
+            ...(this.revocationEntry !== undefined ? { revocation: this.revocationEntry } : {}),
+            ...(this.didDocumentUrl !== undefined ? { didDocument: this.didDocumentUrl } : {}),
+            ...(this.publicKeyJwk !== undefined ? { publicKeyJwk: this.publicKeyJwk } : {}),
+        });
+    }
+    /** Find an already-declared attested capability by name (for attestation accumulation). */
+    findAttested(name) {
+        return this.capabilities.find((c) => typeof c !== 'string' && c.name === name);
+    }
+}
+/** Open a fluent card-building chain (the ergonomic entry point). */
+export function card(init) {
+    return new CardBuilder(init);
+}
+//# sourceMappingURL=builder.js.map

package/dist/card/builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder.js","sourceRoot":"","sources":["../../src/card/builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,SAAS,EAAqB,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAc/C,8FAA8F;AAC9F,MAAM,oBAAoB,GAAiB,gBAAgB,CAAC;AAsB5D;;;;GAIG;AACH,MAAM,OAAO,WAAW;IACL,QAAQ,CAAe;IACvB,UAAU,CAAa;IACvB,IAAI,CAAS;IACb,YAAY,GAAiB,EAAE,CAAC;IAChC,YAAY,GAAkB,EAAE,CAAC;IAC1C,gBAAgB,CAAU;IAC1B,SAAS,CAAU;IACnB,aAAa,CAAU;IACvB,YAAY,CAAgB;IAC5B,WAAW,CAAe;IAC1B,eAAe,CAA4B;IAC3C,cAAc,CAAU;IACxB,YAAY,CAAoB;IAExC,YAAY,IAAqB;QAC/B,IAAI,CAAC,QAAQ,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACzD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3E,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;IAED,wFAAwF;IACxF,UAAU,CAAC,IAAY;QACrB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,IAAY,EAAE,EAAW;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ;YAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;;YAC5C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,WAAwB;QAClC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,gBAAwB,EAAE,OAA6B,EAAE;QACrE,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;YAAE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC;QAC1D,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,SAAS;QACP,IAAI,CAAC,YAAY,GAAG,oBAAoB,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6FAA6F;IAC7F,IAAI,CAAC,OAAoB;QACvB,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6FAA6F;IAC7F,UAAU,CAAC,KAA+B;QACxC,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8FAA8F;IAC9F,WAAW,CAAC,GAAW;QACrB,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2FAA2F;IAC3F,SAAS,CAAC,GAAqB;QAC7B,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kFAAkF;IAClF,KAAK;QACH,OAAO,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE;YAC9B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF,CAAC,CAAC;IACL,CAAC;IAED,2FAA2F;IACnF,YAAY,CAAC,IAAY;QAC/B,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAyB,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CACvE,CAAC;IACJ,CAAC;CACF;AAED,qEAAqE;AACrE,MAAM,UAAU,IAAI,CAAC,IAAqB;IACxC,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC"}

package/dist/card/cimd.d.ts

@@ -0,0 +1,92 @@
+/**
+ * KYA-OS Entity Card — CIMD L1 on-ramp bind.
+ *
+ * CIMD (draft-ietf-oauth-client-id-metadata-document, the MCP default since 2025-11-25) is
+ * the L1 on-ramp with zero new infra: the OAuth `client_id` IS the entity's `did:web` in its
+ * HTTPS form, and the `jwks_uri` the AS validates `private_key_jwt` against IS a mechanical
+ * projection of the DID document's keys — so OAuth client-authentication becomes a DID-key
+ * proof, and the access token the AS mints can be sender-constrained (RFC 9449 `cnf.jkt`) to
+ * the exact key the per-request holder-of-key proof later carries (closing L1 → L3).
+ *
+ *   - `bindClientId` / `didFromClientId` — the W3C `did:web` ⇄ HTTPS bijection
+ *     (`did:web:host:a:b` ⇄ `https://host/a/b`, the authority colon percent-encoded for ports).
+ *   - `didKeyedJwks`        — DID-document `verificationMethod[]` Ed25519 → an OKP JWK set
+ *     (`kid` preserved), stripping any private `d` and skipping non-Ed25519 methods.
+ *   - `toClientMetadata`    — PROJECT the card into the CIMD doc served at the `client_id` URL
+ *     (`token_endpoint_auth_method: private_key_jwt`, `_meta['org.kya-os/did']` = the DID).
+ *   - `cardFromClientMetadata` — DERIVE the L1 card from a CIMD doc (a pure-CIMD client with
+ *     no DID still onboards: a `did:web` is minted from its `client_id`).
+ *   - `verifyCimdBind`      — the anti-substitution graft, FAIL-CLOSED: origin-equality
+ *     (`did:web` host === `client_id` origin === `jwks_uri` origin) AND a reciprocal
+ *     `alsoKnownAs` bind, so a hostile CIMD pointing `jwks_uri` at someone else's keys (or
+ *     claiming a victim's DID) fails closed.
+ *
+ * Pure + deterministic — no I/O, no crypto. All key material is projected, never minted, so
+ * no runtime (mcp-i-core) dependency leaks into `@kya-os/mcp`.
+ */
+import type { CimdBinding, Ed25519PublicJwk, EntityCard } from './schema.js';
+/** CIMD `token_endpoint_auth_method` — `private_key_jwt` IS the DID-key proof. */
+export declare const PRIVATE_KEY_JWT = "private_key_jwt";
+/** Reverse-DNS `_meta` key carrying the entity's DID inside a CIMD document. */
+export declare const KYA_OS_DID_META_KEY = "org.kya-os/did";
+/** A CIMD (client_id metadata document) projected from / parsed into an EntityCard. */
+export interface ClientMetadata {
+    client_id: string;
+    client_name: string;
+    token_endpoint_auth_method: typeof PRIVATE_KEY_JWT;
+    jwks_uri: string;
+    _meta: Record<typeof KYA_OS_DID_META_KEY, string>;
+}
+/** A JSON Web Key Set — the DID-keyed JWKS served at a CIMD `jwks_uri`. */
+export interface Jwks {
+    keys: Ed25519PublicJwk[];
+}
+/** The fail-closed result of `verifyCimdBind` — `ok` iff there are no `reasons`. */
+export interface CimdBindResult {
+    ok: boolean;
+    reasons: string[];
+}
+/**
+ * Bind a `did:web` to its OAuth `client_id` (the W3C HTTPS form):
+ *   `did:web:host:a:b`        → `https://host/a/b`
+ *   `did:web:host%3A3000:a`   → `https://host:3000/a`   (authority colon percent-decoded)
+ *   `did:web:host`            → `https://host`
+ */
+export declare function bindClientId(did: string): string;
+/**
+ * The inverse of `bindClientId`: an HTTPS `client_id` → its `did:web` (authority colon
+ * percent-encoded for ports). `https://host/a/b` → `did:web:host:a:b`. https-only,
+ * fail-closed.
+ */
+export declare function didFromClientId(clientId: string): string;
+/**
+ * Project a DID document's `verificationMethod[]` into the JWKS the AS validates
+ * `private_key_jwt` against. Only Ed25519 (`OKP`) keys are projected; `kid` is preserved
+ * (the JWK's own `kid`, else the verification method `id`); any private `d` is stripped.
+ */
+export declare function didKeyedJwks(didDoc: unknown): Jwks;
+/**
+ * Project a card into the CIMD document served at its `client_id` URL. The
+ * `token_endpoint_auth_method` is `private_key_jwt` — so the AS validating it against
+ * `jwks_uri` is verifying a DID-key signature.
+ */
+export declare function toClientMetadata(card: EntityCard, opts: {
+    jwksUri: string;
+}): ClientMetadata;
+/**
+ * Derive the L1 card from a CIMD document. The DID is read from `_meta['org.kya-os/did']`
+ * when present, else MINTED from the `client_id` (a pure-CIMD client still onboards). The
+ * card is `entityType: 'client'` and carries the CIMD coordinates when a `jwks_uri` is given.
+ * Fail-closed: the result is validated through `parseCard`.
+ */
+export declare function cardFromClientMetadata(meta: unknown): EntityCard;
+/**
+ * Verify a CIMD binding against the entity's DID document, FAIL-CLOSED. Enforces:
+ *   1. origin-equality — `did:web` host === `client_id` origin === `jwks_uri` origin
+ *      (a hostile CIMD pointing `jwks_uri` at another origin's keys fails here);
+ *   2. a reciprocal `alsoKnownAs` bind — the DID document lists the `client_id` URL, so a
+ *      CIMD cannot unilaterally claim a DID it does not control.
+ * `ok` is true iff there are no `reasons`.
+ */
+export declare function verifyCimdBind(cimd: CimdBinding, didDoc: unknown): CimdBindResult;
+//# sourceMappingURL=cimd.d.ts.map

package/dist/card/cimd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd.d.ts","sourceRoot":"","sources":["../../src/card/cimd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAK7E,kFAAkF;AAClF,eAAO,MAAM,eAAe,oBAAoB,CAAC;AAEjD,gFAAgF;AAChF,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAIpD,uFAAuF;AACvF,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,0BAA0B,EAAE,OAAO,eAAe,CAAC;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,OAAO,mBAAmB,EAAE,MAAM,CAAC,CAAC;CACnD;AAED,2EAA2E;AAC3E,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,gBAAgB,EAAE,CAAC;CAC1B;AAED,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAID;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQhD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAaxD;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CASlD;AAID;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAQ5F;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAiBhE;AAID;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,GAAG,cAAc,CAqBjF"}