@kya-os/mcp 1.6.1 → 1.9.0

package/dist/card/proof/http-sig.d.ts

@@ -0,0 +1,69 @@
+/**
+ * KYA-OS Entity Card proof — the RFC 9421 HTTP Message Signature sibling (DUAL carrier).
+ *
+ * The stateless proof carries TWO signatures by ONE DID key over ONE semantic set: the detached
+ * JWS in `_meta` (canonical, for JSON-RPC / stdio) and this RFC 9421 sibling for HTTP verifiers
+ * that already ship (SEP-1960, Cloudflare Web Bot Auth). A JWS signature also covers its protected
+ * header, so its bytes can NEVER satisfy a stock 9421 verifier reconstructing a bare signature
+ * base — the two carriers therefore require two signatures. `httpSig` (minted by the signer's
+ * `signRaw` seam) is a RAW EdDSA signature over exactly the base {@link httpSignatureBase} exposes,
+ * so a stock 9421 verifier reconstructs that base and verifies `httpSig` against the resolved DID
+ * key with zero new code. If a signer omits `signRaw`, the proof has no `httpSig` and the sibling
+ * simply degrades away (the JWS carrier still verifies).
+ *
+ * Covered set (the full semantic binding): `content-digest` (the `requestHash`, itself SHA-256 of
+ * `JCS({ method, params })` — so the request method+params are bound here), `kya-audience`,
+ * `kya-nonce`, `kya-cnf` when a `cnf` is present, plus `created`/`expires`/`keyid`/`alg` in
+ * `@signature-params`. Every covered value is reconstructable by a stock verifier from the message
+ * headers + `Signature-Input`, which is what keeps the sibling independently verifiable.
+ */
+import type { ProofPublicJwk } from '../schema.js';
+import type { CardProofMeta } from './types.js';
+/** The signature label under which the KYA-OS covered components are grouped. */
+export declare const HTTP_SIG_LABEL = "kyaos";
+/**
+ * The RFC 9421 headers projected from a proof (a co-normative carrier, not a re-sign). Beyond the
+ * `Signature-Input`/`Signature` pair, every NON-`@` covered component is emitted as its own HTTP
+ * field so a stock verifier can resolve it from the message alone: `Content-Digest` (`content-digest`),
+ * `Kya-Audience` (`kya-audience`), `Kya-Nonce` (`kya-nonce`), and `Kya-Cnf` (`kya-cnf`, only when the
+ * proof carries a `cnf`). Each field value is BYTE-IDENTICAL to the corresponding {@link httpSignatureBase}
+ * line so reconstruction from the wire yields the exact base `httpSig` was signed over.
+ */
+export interface HttpMessageSignature {
+    'Content-Digest': string;
+    'Kya-Audience': string;
+    'Kya-Nonce': string;
+    'Kya-Cnf'?: string;
+    'Signature-Input': string;
+    Signature: string;
+}
+/**
+ * The RFC 9421 signature base — the EXACT string a stock 9421 verifier reconstructs and the exact
+ * bytes `httpSig` signs. Deterministic and self-contained from the proof, so both the minter and a
+ * third-party verifier derive an identical base.
+ */
+export declare function httpSignatureBase(proof: CardProofMeta): string;
+/** The UTF-8 bytes of {@link httpSignatureBase} — the payload the `signRaw` seam signs at mint. */
+export declare function httpSignatureBaseBytes(proof: CardProofMeta): Uint8Array;
+/**
+ * Project a minted `org.kya-os/proof@1` into its RFC 9421 header set. Emits EVERY covered
+ * component as a real HTTP field — `Content-Digest`/`Kya-Audience`/`Kya-Nonce` (and `Kya-Cnf`
+ * when a `cnf` is present), each byte-identical to its {@link httpSignatureBase} line — plus
+ * `Signature-Input` (the covered-component list + params) and `Signature` (the RAW `httpSig` as a
+ * base64 byte sequence). Because the message now carries every field the base names, a stock 9421
+ * verifier resolves and reconstructs the base from the wire alone. Throws when the proof has no
+ * `httpSig` (minted without a `signRaw` seam): there is no cross-verifiable sibling to project, and
+ * emitting the JWS bytes here would be silently unverifiable.
+ */
+export declare function toHttpMessageSignature(proof: CardProofMeta): HttpMessageSignature;
+/**
+ * Verify the sibling exactly as a stock RFC 9421 verifier would: reconstruct {@link httpSignatureBase}
+ * and check the RAW `httpSig` against `key` (the resolved DID verification key). Fail-closed —
+ * returns `false` when the proof carries no `httpSig` or the signature does not verify.
+ *
+ * CONTRACT: dispatches on the KEY type (P-256 → `ecdsa-p256-sha256`, Ed25519 → `ed25519`), NOT on
+ * `proof.alg`. It ASSUMES the caller has already bound `proof.alg` to the key type (the
+ * `alg_key_mismatch` check in `verify.ts`); call it standalone only after that binding holds.
+ */
+export declare function verifyHttpSignature(proof: CardProofMeta, key: ProofPublicJwk): Promise<boolean>;
+//# sourceMappingURL=http-sig.d.ts.map

package/dist/card/proof/http-sig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-sig.d.ts","sourceRoot":"","sources":["../../../src/card/proof/http-sig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIhD,iFAAiF;AACjF,eAAO,MAAM,cAAc,UAAU,CAAC;AAEtC;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAgBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAS9D;AAED,mGAAmG;AACnG,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,aAAa,GAAG,UAAU,CAEvE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,aAAa,GAAG,oBAAoB,CAajF;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,aAAa,EACpB,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,OAAO,CAAC,CAOlB"}

package/dist/card/proof/http-sig.js

@@ -0,0 +1,101 @@
+/**
+ * KYA-OS Entity Card proof — the RFC 9421 HTTP Message Signature sibling (DUAL carrier).
+ *
+ * The stateless proof carries TWO signatures by ONE DID key over ONE semantic set: the detached
+ * JWS in `_meta` (canonical, for JSON-RPC / stdio) and this RFC 9421 sibling for HTTP verifiers
+ * that already ship (SEP-1960, Cloudflare Web Bot Auth). A JWS signature also covers its protected
+ * header, so its bytes can NEVER satisfy a stock 9421 verifier reconstructing a bare signature
+ * base — the two carriers therefore require two signatures. `httpSig` (minted by the signer's
+ * `signRaw` seam) is a RAW EdDSA signature over exactly the base {@link httpSignatureBase} exposes,
+ * so a stock 9421 verifier reconstructs that base and verifies `httpSig` against the resolved DID
+ * key with zero new code. If a signer omits `signRaw`, the proof has no `httpSig` and the sibling
+ * simply degrades away (the JWS carrier still verifies).
+ *
+ * Covered set (the full semantic binding): `content-digest` (the `requestHash`, itself SHA-256 of
+ * `JCS({ method, params })` — so the request method+params are bound here), `kya-audience`,
+ * `kya-nonce`, `kya-cnf` when a `cnf` is present, plus `created`/`expires`/`keyid`/`alg` in
+ * `@signature-params`. Every covered value is reconstructable by a stock verifier from the message
+ * headers + `Signature-Input`, which is what keeps the sibling independently verifiable.
+ */
+import { base64urlDecodeToBytes } from '../../utils/base64.js';
+import { base64urlToBase64, ed25519VerifyRaw, es256VerifyRaw } from './canonical.js';
+const encoder = new TextEncoder();
+/** The signature label under which the KYA-OS covered components are grouped. */
+export const HTTP_SIG_LABEL = 'kyaos';
+/** The RFC 9421 covered-component list — includes `kya-cnf` only when the proof carries a `cnf`. */
+function coveredComponents(proof) {
+    const comps = ['"content-digest"', '"kya-audience"', '"kya-nonce"'];
+    if (proof.cnf)
+        comps.push('"kya-cnf"');
+    return `(${comps.join(' ')})`;
+}
+/** The `;created=…;expires=…;keyid=…;alg=…` parameter tail shared by input + signature base. The
+ *  `alg` label is the RFC 9421 name for the proof's algorithm (`ed25519` or `ecdsa-p256-sha256`). */
+function sigParams(proof) {
+    const label = proof.alg === 'ES256' ? 'ecdsa-p256-sha256' : 'ed25519';
+    return `created=${proof.created};expires=${proof.expires};keyid="${proof.kid}";alg="${label}"`;
+}
+/**
+ * The RFC 9421 signature base — the EXACT string a stock 9421 verifier reconstructs and the exact
+ * bytes `httpSig` signs. Deterministic and self-contained from the proof, so both the minter and a
+ * third-party verifier derive an identical base.
+ */
+export function httpSignatureBase(proof) {
+    const lines = [
+        `"content-digest": ${proof.requestHash}`,
+        `"kya-audience": ${proof.audience}`,
+        `"kya-nonce": ${proof.nonce}`,
+    ];
+    if (proof.cnf)
+        lines.push(`"kya-cnf": ${proof.cnf.jkt}`);
+    lines.push(`"@signature-params": ${coveredComponents(proof)};${sigParams(proof)}`);
+    return lines.join('\n');
+}
+/** The UTF-8 bytes of {@link httpSignatureBase} — the payload the `signRaw` seam signs at mint. */
+export function httpSignatureBaseBytes(proof) {
+    return encoder.encode(httpSignatureBase(proof));
+}
+/**
+ * Project a minted `org.kya-os/proof@1` into its RFC 9421 header set. Emits EVERY covered
+ * component as a real HTTP field — `Content-Digest`/`Kya-Audience`/`Kya-Nonce` (and `Kya-Cnf`
+ * when a `cnf` is present), each byte-identical to its {@link httpSignatureBase} line — plus
+ * `Signature-Input` (the covered-component list + params) and `Signature` (the RAW `httpSig` as a
+ * base64 byte sequence). Because the message now carries every field the base names, a stock 9421
+ * verifier resolves and reconstructs the base from the wire alone. Throws when the proof has no
+ * `httpSig` (minted without a `signRaw` seam): there is no cross-verifiable sibling to project, and
+ * emitting the JWS bytes here would be silently unverifiable.
+ */
+export function toHttpMessageSignature(proof) {
+    if (!proof.httpSig) {
+        throw new Error('card/proof: proof carries no httpSig; mint with a signRaw-capable signer');
+    }
+    const headers = {
+        'Content-Digest': proof.requestHash,
+        'Kya-Audience': proof.audience,
+        'Kya-Nonce': proof.nonce,
+        'Signature-Input': `${HTTP_SIG_LABEL}=${coveredComponents(proof)};${sigParams(proof)}`,
+        Signature: `${HTTP_SIG_LABEL}=:${base64urlToBase64(proof.httpSig)}:`,
+    };
+    if (proof.cnf)
+        headers['Kya-Cnf'] = proof.cnf.jkt;
+    return headers;
+}
+/**
+ * Verify the sibling exactly as a stock RFC 9421 verifier would: reconstruct {@link httpSignatureBase}
+ * and check the RAW `httpSig` against `key` (the resolved DID verification key). Fail-closed —
+ * returns `false` when the proof carries no `httpSig` or the signature does not verify.
+ *
+ * CONTRACT: dispatches on the KEY type (P-256 → `ecdsa-p256-sha256`, Ed25519 → `ed25519`), NOT on
+ * `proof.alg`. It ASSUMES the caller has already bound `proof.alg` to the key type (the
+ * `alg_key_mismatch` check in `verify.ts`); call it standalone only after that binding holds.
+ */
+export async function verifyHttpSignature(proof, key) {
+    if (!proof.httpSig)
+        return false;
+    const sig = base64urlDecodeToBytes(proof.httpSig);
+    const base = httpSignatureBaseBytes(proof);
+    // Dispatch on the KEY type (authoritative): a P-256 key verifies the ecdsa-p256-sha256 sibling,
+    // an Ed25519 key the ed25519 sibling. verify.ts has already bound proof.alg to this key type.
+    return key.kty === 'EC' ? es256VerifyRaw(key, sig, base) : ed25519VerifyRaw(key, sig, base);
+}
+//# sourceMappingURL=http-sig.js.map

package/dist/card/proof/http-sig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-sig.js","sourceRoot":"","sources":["../../../src/card/proof/http-sig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAIrF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,iFAAiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAmBtC,oGAAoG;AACpG,SAAS,iBAAiB,CAAC,KAAoB;IAC7C,MAAM,KAAK,GAAG,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,GAAG;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACvC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAChC,CAAC;AAED;qGACqG;AACrG,SAAS,SAAS,CAAC,KAAoB;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,OAAO,WAAW,KAAK,CAAC,OAAO,YAAY,KAAK,CAAC,OAAO,WAAW,KAAK,CAAC,GAAG,UAAU,KAAK,GAAG,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAoB;IACpD,MAAM,KAAK,GAAG;QACZ,qBAAqB,KAAK,CAAC,WAAW,EAAE;QACxC,mBAAmB,KAAK,CAAC,QAAQ,EAAE;QACnC,gBAAgB,KAAK,CAAC,KAAK,EAAE;KAC9B,CAAC;IACF,IAAI,KAAK,CAAC,GAAG;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACzD,KAAK,CAAC,IAAI,CAAC,wBAAwB,iBAAiB,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,sBAAsB,CAAC,KAAoB;IACzD,OAAO,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAoB;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,OAAO,GAAyB;QACpC,gBAAgB,EAAE,KAAK,CAAC,WAAW;QACnC,cAAc,EAAE,KAAK,CAAC,QAAQ;QAC9B,WAAW,EAAE,KAAK,CAAC,KAAK;QACxB,iBAAiB,EAAE,GAAG,cAAc,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE;QACtF,SAAS,EAAE,GAAG,cAAc,KAAK,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG;KACrE,CAAC;IACF,IAAI,KAAK,CAAC,GAAG;QAAE,OAAO,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;IAClD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAoB,EACpB,GAAmB;IAEnB,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,GAAG,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC3C,gGAAgG;IAChG,8FAA8F;IAC9F,OAAO,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAC9F,CAAC"}

package/dist/card/proof/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * KYA-OS Entity Card — stateless per-request holder-of-key proof (`org.kya-os/proof@1`).
+ *
+ * The security-critical module, split into focused units re-exported here:
+ *   - types      (./types):    CardProofMeta + the minting/verifying seams and result shapes.
+ *   - signer     (./signer):   the default Ed25519 minting seam (jose, no mcp-i-core).
+ *   - build      (./build):    buildCardProof — mint one proof under the SHIPPED `_meta` key.
+ *   - verify     (./verify):   verifyCardProof — recompute every binding, fail-closed.
+ *   - http-sig   (./http-sig): toHttpMessageSignature — the RFC 9421 sibling carrier.
+ *   - canonical  (./canonical): computeRequestHash — JCS request binding (shared by both halves).
+ *   - nonce-cache (./nonce-cache): the batteries-included ATOMIC replay seams (InMemoryNonceCache
+ *                              + the NonceCacheProvider adapter) so the safe consume is the default.
+ *
+ * Distinct from — and orthogonal to — the legacy session-bound proof in `src/proof`: the card proof
+ * rides its OWN `_meta['org.kya-os/proof@1']` key, separate from the legacy `org.kya-os/proof`, so
+ * both regimes can run on one server without either guard seeing the other's proof.
+ */
+export * from './types.js';
+export * from './signer.js';
+export * from './build.js';
+export * from './verify.js';
+export * from './http-sig.js';
+export * from './nonce-cache.js';
+export { computeRequestHash, digestsEqual } from './canonical.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/card/proof/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/card/proof/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/card/proof/index.js

@@ -0,0 +1,25 @@
+/**
+ * KYA-OS Entity Card — stateless per-request holder-of-key proof (`org.kya-os/proof@1`).
+ *
+ * The security-critical module, split into focused units re-exported here:
+ *   - types      (./types):    CardProofMeta + the minting/verifying seams and result shapes.
+ *   - signer     (./signer):   the default Ed25519 minting seam (jose, no mcp-i-core).
+ *   - build      (./build):    buildCardProof — mint one proof under the SHIPPED `_meta` key.
+ *   - verify     (./verify):   verifyCardProof — recompute every binding, fail-closed.
+ *   - http-sig   (./http-sig): toHttpMessageSignature — the RFC 9421 sibling carrier.
+ *   - canonical  (./canonical): computeRequestHash — JCS request binding (shared by both halves).
+ *   - nonce-cache (./nonce-cache): the batteries-included ATOMIC replay seams (InMemoryNonceCache
+ *                              + the NonceCacheProvider adapter) so the safe consume is the default.
+ *
+ * Distinct from — and orthogonal to — the legacy session-bound proof in `src/proof`: the card proof
+ * rides its OWN `_meta['org.kya-os/proof@1']` key, separate from the legacy `org.kya-os/proof`, so
+ * both regimes can run on one server without either guard seeing the other's proof.
+ */
+export * from './types.js';
+export * from './signer.js';
+export * from './build.js';
+export * from './verify.js';
+export * from './http-sig.js';
+export * from './nonce-cache.js';
+export { computeRequestHash, digestsEqual } from './canonical.js';
+//# sourceMappingURL=index.js.map

package/dist/card/proof/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/card/proof/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/card/proof/nonce-cache.d.ts

@@ -0,0 +1,67 @@
+/**
+ * KYA-OS Entity Card — batteries-included replay defense for `org.kya-os/proof@1`.
+ *
+ * The {@link ConsumeNonceIfFresh} seam is security-critical: it MUST be an ATOMIC test-AND-set
+ * (record the nonce AND report whether it was already seen, in one step). Hand-rolling it is the
+ * documented footgun — so this module ships the two implementations a developer should reach for:
+ *
+ *   - {@link InMemoryNonceCache} — a single-process, race-free TTL cache. The check-and-set runs in
+ *     one synchronous critical section (no `await` between read and write), so it cannot interleave
+ *     with a concurrent replay within one process. Use it for a single instance / dev.
+ *   - {@link consumeFromNonceCacheProvider} — composes the two-method `NonceCacheProvider`
+ *     (`has()` + `add()`) into the atomic seam for a shared/distributed store (see the atomicity
+ *     note on the function).
+ *
+ * Type-only import of `NonceCacheProvider` — no runtime coupling to the legacy proof engine and no
+ * `mcp-i-core` dependency.
+ */
+import type { NonceCacheProvider } from '../../providers/base.js';
+import { type ConsumeNonceIfFresh } from './types.js';
+/** Construction options for {@link InMemoryNonceCache}. */
+export interface InMemoryNonceCacheOptions {
+    /** How long a consumed nonce is remembered, in seconds (default {@link NONCE_RETENTION_SEC} —
+     *  the full verifier acceptance window, so an evicted nonce can never outlive a valid proof). */
+    ttlSec?: number;
+    /** Injectable clock returning epoch MILLISECONDS (deterministic tests; default `Date.now`). */
+    now?: () => number;
+}
+/**
+ * A single-process, race-free replay cache implementing the {@link ConsumeNonceIfFresh} seam.
+ * Remembers each `(did, nonce)` for `ttlSec` — long enough to cover the proof's own lifetime — and
+ * rejects any repeat within that window.
+ */
+export declare class InMemoryNonceCache {
+    /** `did\0nonce` → expiry epoch ms. */
+    private readonly seen;
+    private readonly ttlMs;
+    private readonly clock;
+    /** Inserts since the last sweep — amortises {@link cleanup} so `seen` stays bounded. */
+    private insertsSinceSweep;
+    constructor(opts?: InMemoryNonceCacheOptions);
+    /**
+     * Atomic test-AND-set: record `nonce` for `did` and return `true` iff it was NOT already recorded
+     * (and unexpired); return `false` on a replay, leaving the prior record intact. One synchronous
+     * critical section — no `await` between the read and the write — so it is race-free within one
+     * process. Arrow field so it stays bound when passed directly as the seam.
+     */
+    readonly consume: ConsumeNonceIfFresh;
+    /** Drop expired entries — call periodically to bound memory in a long-running process. */
+    cleanup(): void;
+}
+/** Options for {@link consumeFromNonceCacheProvider}. */
+export interface NonceCacheProviderAdapterOptions {
+    /** TTL applied to each recorded nonce, in seconds (default {@link NONCE_RETENTION_SEC}). */
+    ttlSec?: number;
+}
+/**
+ * Adapt a two-method {@link NonceCacheProvider} (`has()` + `add()`) into the atomic
+ * {@link ConsumeNonceIfFresh} seam.
+ *
+ * ATOMICITY: `has()` then `add()` is only race-free when the provider serialises the pair — a
+ * single-process store, or a backend with a native compare-and-set. For a SHARED distributed cache,
+ * back it with a store that enforces atomic check-and-set (SPEC §12.2); otherwise two concurrent
+ * replays can both observe `has() === false` before either `add()`s. The bundled
+ * {@link InMemoryNonceCache} is race-free by construction and is the safer single-process default.
+ */
+export declare function consumeFromNonceCacheProvider(provider: NonceCacheProvider, opts?: NonceCacheProviderAdapterOptions): ConsumeNonceIfFresh;
+//# sourceMappingURL=nonce-cache.d.ts.map

package/dist/card/proof/nonce-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce-cache.d.ts","sourceRoot":"","sources":["../../../src/card/proof/nonce-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAuB,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAK3E,2DAA2D;AAC3D,MAAM,WAAW,yBAAyB;IACxC;qGACiG;IACjG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,qBAAa,kBAAkB;IAC7B,sCAAsC;IACtC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,wFAAwF;IACxF,OAAO,CAAC,iBAAiB,CAAK;gBAElB,IAAI,GAAE,yBAA8B;IAKhD;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAgBnC;IAEF,0FAA0F;IAC1F,OAAO,IAAI,IAAI;CAIhB;AAED,yDAAyD;AACzD,MAAM,WAAW,gCAAgC;IAC/C,4FAA4F;IAC5F,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,GAAE,gCAAqC,GAC1C,mBAAmB,CAOrB"}

package/dist/card/proof/nonce-cache.js

@@ -0,0 +1,88 @@
+/**
+ * KYA-OS Entity Card — batteries-included replay defense for `org.kya-os/proof@1`.
+ *
+ * The {@link ConsumeNonceIfFresh} seam is security-critical: it MUST be an ATOMIC test-AND-set
+ * (record the nonce AND report whether it was already seen, in one step). Hand-rolling it is the
+ * documented footgun — so this module ships the two implementations a developer should reach for:
+ *
+ *   - {@link InMemoryNonceCache} — a single-process, race-free TTL cache. The check-and-set runs in
+ *     one synchronous critical section (no `await` between read and write), so it cannot interleave
+ *     with a concurrent replay within one process. Use it for a single instance / dev.
+ *   - {@link consumeFromNonceCacheProvider} — composes the two-method `NonceCacheProvider`
+ *     (`has()` + `add()`) into the atomic seam for a shared/distributed store (see the atomicity
+ *     note on the function).
+ *
+ * Type-only import of `NonceCacheProvider` — no runtime coupling to the legacy proof engine and no
+ * `mcp-i-core` dependency.
+ */
+import { NONCE_RETENTION_SEC } from './types.js';
+/** Inserts between amortised expired-entry sweeps (bounds memory without a timer/lifecycle). */
+const SWEEP_EVERY = 1000;
+/**
+ * A single-process, race-free replay cache implementing the {@link ConsumeNonceIfFresh} seam.
+ * Remembers each `(did, nonce)` for `ttlSec` — long enough to cover the proof's own lifetime — and
+ * rejects any repeat within that window.
+ */
+export class InMemoryNonceCache {
+    /** `did\0nonce` → expiry epoch ms. */
+    seen = new Map();
+    ttlMs;
+    clock;
+    /** Inserts since the last sweep — amortises {@link cleanup} so `seen` stays bounded. */
+    insertsSinceSweep = 0;
+    constructor(opts = {}) {
+        this.ttlMs = (opts.ttlSec ?? NONCE_RETENTION_SEC) * 1000;
+        this.clock = opts.now ?? Date.now;
+    }
+    /**
+     * Atomic test-AND-set: record `nonce` for `did` and return `true` iff it was NOT already recorded
+     * (and unexpired); return `false` on a replay, leaving the prior record intact. One synchronous
+     * critical section — no `await` between the read and the write — so it is race-free within one
+     * process. Arrow field so it stays bound when passed directly as the seam.
+     */
+    consume = (nonce, did) => {
+        // NUL (`\0`) delimiter: `did` and `nonce` are opaque strings, so an ambiguous separator
+        // (e.g. a space) could let one (did, nonce) pair collide with another. `\0` cannot appear
+        // in a DID and is not a valid nonce byte, so the composite key stays unambiguous.
+        const key = `${did}\0${nonce}`;
+        const now = this.clock();
+        const expiry = this.seen.get(key);
+        if (expiry !== undefined && expiry > now)
+            return false;
+        this.seen.set(key, now + this.ttlMs);
+        // Amortised eviction: sweep expired entries every SWEEP_EVERY inserts so a long-running
+        // process cannot accumulate dead nonces unboundedly — no timer or lifecycle to manage.
+        if (++this.insertsSinceSweep >= SWEEP_EVERY) {
+            this.insertsSinceSweep = 0;
+            this.cleanup();
+        }
+        return true;
+    };
+    /** Drop expired entries — call periodically to bound memory in a long-running process. */
+    cleanup() {
+        const now = this.clock();
+        for (const [key, expiry] of this.seen)
+            if (expiry <= now)
+                this.seen.delete(key);
+    }
+}
+/**
+ * Adapt a two-method {@link NonceCacheProvider} (`has()` + `add()`) into the atomic
+ * {@link ConsumeNonceIfFresh} seam.
+ *
+ * ATOMICITY: `has()` then `add()` is only race-free when the provider serialises the pair — a
+ * single-process store, or a backend with a native compare-and-set. For a SHARED distributed cache,
+ * back it with a store that enforces atomic check-and-set (SPEC §12.2); otherwise two concurrent
+ * replays can both observe `has() === false` before either `add()`s. The bundled
+ * {@link InMemoryNonceCache} is race-free by construction and is the safer single-process default.
+ */
+export function consumeFromNonceCacheProvider(provider, opts = {}) {
+    const ttlSec = opts.ttlSec ?? NONCE_RETENTION_SEC;
+    return async (nonce, did) => {
+        if (await provider.has(nonce, did))
+            return false;
+        await provider.add(nonce, ttlSec, did);
+        return true;
+    };
+}
+//# sourceMappingURL=nonce-cache.js.map

package/dist/card/proof/nonce-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce-cache.js","sourceRoot":"","sources":["../../../src/card/proof/nonce-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,mBAAmB,EAA4B,MAAM,YAAY,CAAC;AAE3E,gGAAgG;AAChG,MAAM,WAAW,GAAG,IAAI,CAAC;AAWzB;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IAC7B,sCAAsC;IACrB,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjC,KAAK,CAAS;IACd,KAAK,CAAe;IACrC,wFAAwF;IAChF,iBAAiB,GAAG,CAAC,CAAC;IAE9B,YAAY,OAAkC,EAAE;QAC9C,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC,GAAG,IAAI,CAAC;QACzD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACM,OAAO,GAAwB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACrD,wFAAwF;QACxF,0FAA0F;QAC1F,kFAAkF;QAClF,MAAM,GAAG,GAAG,GAAG,GAAG,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,wFAAwF;QACxF,uFAAuF;QACvF,IAAI,EAAE,IAAI,CAAC,iBAAiB,IAAI,WAAW,EAAE,CAAC;YAC5C,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,0FAA0F;IAC1F,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,MAAM,IAAI,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClF,CAAC;CACF;AAQD;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAA4B,EAC5B,OAAyC,EAAE;IAE3C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC;IAClD,OAAO,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,IAAI,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACjD,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}

package/dist/card/proof/signer.d.ts

@@ -0,0 +1,32 @@
+/**
+ * KYA-OS Entity Card proof — the default Ed25519 minting seam.
+ *
+ * `ed25519SignerFromJwk` wraps an Ed25519 private JWK into a {@link ProofSigner}: it produces a
+ * DETACHED EdDSA JWS (`protectedHeader..signature`) over the JCS-canonical covered claims and
+ * pre-computes the RFC 7638 thumbprint (`jkt`) of the public half for the `cnf` fusion. Uses
+ * `jose` directly (already a dependency) — no `mcp-i-core` runtime dependency leaks in. Callers
+ * with a KMS / HSM key can implement {@link ProofSigner} themselves; this is the batteries-included
+ * path for in-process keys.
+ */
+import type { Ed25519PrivateJwk, P256PrivateJwk, ProofSigner } from './types.js';
+/**
+ * Build a {@link ProofSigner} from an Ed25519 private JWK. The raw key is imported ONCE and never
+ * serialized back out; `jkt` is the RFC 7638 thumbprint of the public half (`{kty,crv,x}`), which
+ * is what `cnf.jkt` and the sender-constraint fusion compare against.
+ */
+export declare function ed25519SignerFromJwk(opts: {
+    did: string;
+    kid: string;
+    privateJwk: Ed25519PrivateJwk;
+}): Promise<ProofSigner>;
+/**
+ * Build a {@link ProofSigner} from a P-256 private JWK — the ES256 (ECDSA, FIPS-eligible) path.
+ * Same shape as {@link ed25519SignerFromJwk}: RFC 7638 `jkt` over the public half `{kty,crv,x,y}`,
+ * a detached ES256 JWS, and the raw `ecdsa-p256-sha256` RFC 9421 sibling via {@link es256SignRaw}.
+ */
+export declare function es256SignerFromJwk(opts: {
+    did: string;
+    kid: string;
+    privateJwk: P256PrivateJwk;
+}): Promise<ProofSigner>;
+//# sourceMappingURL=signer.d.ts.map

package/dist/card/proof/signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../../src/card/proof/signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAcjF;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,iBAAiB,CAAC;CAC/B,GAAG,OAAO,CAAC,WAAW,CAAC,CAavB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,cAAc,CAAC;CAC5B,GAAG,OAAO,CAAC,WAAW,CAAC,CAavB"}

package/dist/card/proof/signer.js

@@ -0,0 +1,59 @@
+/**
+ * KYA-OS Entity Card proof — the default Ed25519 minting seam.
+ *
+ * `ed25519SignerFromJwk` wraps an Ed25519 private JWK into a {@link ProofSigner}: it produces a
+ * DETACHED EdDSA JWS (`protectedHeader..signature`) over the JCS-canonical covered claims and
+ * pre-computes the RFC 7638 thumbprint (`jkt`) of the public half for the `cnf` fusion. Uses
+ * `jose` directly (already a dependency) — no `mcp-i-core` runtime dependency leaks in. Callers
+ * with a KMS / HSM key can implement {@link ProofSigner} themselves; this is the batteries-included
+ * path for in-process keys.
+ */
+import { FlattenedSign, calculateJwkThumbprint, importJWK } from 'jose';
+import { base64urlEncodeFromBytes } from '../../utils/base64.js';
+import { ed25519SignRaw, es256SignRaw } from './canonical.js';
+/** Shared detached-JWS producer: `protectedHeader..signature` with the given `alg` + `kid` (DRY). */
+function detachedJwsSign(key, alg, kid) {
+    return async (payload) => {
+        const flattened = await new FlattenedSign(payload).setProtectedHeader({ alg, kid }).sign(key);
+        return `${flattened.protected ?? ''}..${flattened.signature}`;
+    };
+}
+/**
+ * Build a {@link ProofSigner} from an Ed25519 private JWK. The raw key is imported ONCE and never
+ * serialized back out; `jkt` is the RFC 7638 thumbprint of the public half (`{kty,crv,x}`), which
+ * is what `cnf.jkt` and the sender-constraint fusion compare against.
+ */
+export async function ed25519SignerFromJwk(opts) {
+    const key = await importJWK(opts.privateJwk, 'EdDSA');
+    const publicJwk = { kty: 'OKP', crv: 'Ed25519', x: opts.privateJwk.x };
+    const jkt = await calculateJwkThumbprint(publicJwk, 'sha256');
+    const rawJwk = { kty: 'OKP', crv: 'Ed25519', x: opts.privateJwk.x, d: opts.privateJwk.d };
+    return {
+        did: opts.did,
+        kid: opts.kid,
+        jkt,
+        alg: 'EdDSA',
+        sign: detachedJwsSign(key, 'EdDSA', opts.kid),
+        signRaw: (payload) => ed25519SignRaw(rawJwk, payload).then(base64urlEncodeFromBytes),
+    };
+}
+/**
+ * Build a {@link ProofSigner} from a P-256 private JWK — the ES256 (ECDSA, FIPS-eligible) path.
+ * Same shape as {@link ed25519SignerFromJwk}: RFC 7638 `jkt` over the public half `{kty,crv,x,y}`,
+ * a detached ES256 JWS, and the raw `ecdsa-p256-sha256` RFC 9421 sibling via {@link es256SignRaw}.
+ */
+export async function es256SignerFromJwk(opts) {
+    const key = await importJWK(opts.privateJwk, 'ES256');
+    const publicJwk = { kty: 'EC', crv: 'P-256', x: opts.privateJwk.x, y: opts.privateJwk.y };
+    const jkt = await calculateJwkThumbprint(publicJwk, 'sha256');
+    const rawJwk = { kty: 'EC', crv: 'P-256', x: opts.privateJwk.x, y: opts.privateJwk.y, d: opts.privateJwk.d };
+    return {
+        did: opts.did,
+        kid: opts.kid,
+        jkt,
+        alg: 'ES256',
+        sign: detachedJwsSign(key, 'ES256', opts.kid),
+        signRaw: (payload) => es256SignRaw(rawJwk, payload).then(base64urlEncodeFromBytes),
+    };
+}
+//# sourceMappingURL=signer.js.map

package/dist/card/proof/signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../../src/card/proof/signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAExE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9D,qGAAqG;AACrG,SAAS,eAAe,CACtB,GAA0C,EAC1C,GAAsB,EACtB,GAAW;IAEX,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9F,OAAO,GAAG,SAAS,CAAC,SAAS,IAAI,EAAE,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;IAChE,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAI1C;IACC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAiB,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;IAC1F,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG;QACH,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC;QAC7C,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;KACrF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAIxC;IACC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAiB,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;IAC/F,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;IAC7G,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG;QACH,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC;QAC7C,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;KACnF,CAAC;AACJ,CAAC"}