@kya-os/mcp 1.7.0 → 1.9.0

package/dist/integrations/cheqd/resolver.d.ts

@@ -0,0 +1,38 @@
+/**
+ * DID:cheqd Resolver
+ *
+ * Resolves did:cheqd DIDs through an explicitly configured resolver endpoint.
+ * The resolver accepts both Universal Resolver-style DID Resolution Results
+ * (`{ didDocument: ... }`) and raw DID Documents.
+ */
+import type { FetchProvider } from '../../providers/base.js';
+import type { DIDResolverFactory } from '../../delegation/did-resolver-registry.js';
+import type { DIDDocument, DIDResolver } from '../../delegation/vc-verifier.js';
+export type DidCheqdNetwork = 'mainnet' | 'testnet';
+export interface ParsedDidCheqd {
+    network: DidCheqdNetwork;
+    uniqueId: string;
+}
+export interface DidCheqdResolverOptions {
+    resolverUrl: string;
+    cacheTtl?: number;
+    headers?: Record<string, string> | (() => Promise<Record<string, string>>);
+}
+export declare function isDidCheqd(did: string): boolean;
+export declare function parseDidCheqd(did: string): ParsedDidCheqd | null;
+export declare class DidCheqdResolver implements DIDResolver {
+    private readonly fetchProvider;
+    private readonly resolverUrl;
+    private readonly cache;
+    private readonly cacheTtl;
+    private readonly headers?;
+    constructor(fetchProvider: FetchProvider, options: DidCheqdResolverOptions);
+    resolve(did: string): Promise<DIDDocument | null>;
+    clearCache(): void;
+    clearCacheEntry(did: string): void;
+    private resolveHeaders;
+}
+export declare function createDidCheqdResolver(fetchProvider: FetchProvider, options: DidCheqdResolverOptions): DIDResolver;
+export declare function cheqdResolver(options: DidCheqdResolverOptions): DIDResolverFactory;
+export declare function didCheqdToResolverUrl(did: string, resolverUrl: string): string;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/integrations/cheqd/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/integrations/cheqd/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAsB,MAAM,iCAAiC,CAAC;AAIpG,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,CAAC;AAEpD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,eAAe,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;CAC5E;AAMD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAehE;AAED,qBAAa,gBAAiB,YAAW,WAAW;IAClD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4D;IAClF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAmE;gBAEhF,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,uBAAuB;IAQpE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAyDvD,UAAU,IAAI,IAAI;IAIlB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;YAIpB,cAAc;CAM7B;AAED,wBAAgB,sBAAsB,CACpC,aAAa,EAAE,aAAa,EAC5B,OAAO,EAAE,uBAAuB,GAC/B,WAAW,CAEb;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,uBAAuB,GAAG,kBAAkB,CAElF;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAS9E"}

package/dist/integrations/cheqd/resolver.js

@@ -0,0 +1,156 @@
+/**
+ * DID:cheqd Resolver
+ *
+ * Resolves did:cheqd DIDs through an explicitly configured resolver endpoint.
+ * The resolver accepts both Universal Resolver-style DID Resolution Results
+ * (`{ didDocument: ... }`) and raw DID Documents.
+ */
+import { logger } from '../../logging/index.js';
+import { isRecord, stripTrailingSlashes } from '../../utils/index.js';
+export function isDidCheqd(did) {
+    return did.startsWith('did:cheqd:');
+}
+export function parseDidCheqd(did) {
+    const match = /^did:cheqd:(mainnet|testnet):([^/?#]+)$/.exec(did);
+    if (!match) {
+        return null;
+    }
+    const uniqueId = match[2] ?? '';
+    if (uniqueId.length === 0) {
+        return null;
+    }
+    return {
+        network: match[1],
+        uniqueId,
+    };
+}
+export class DidCheqdResolver {
+    fetchProvider;
+    resolverUrl;
+    cache;
+    cacheTtl;
+    headers;
+    constructor(fetchProvider, options) {
+        this.fetchProvider = fetchProvider;
+        this.resolverUrl = options.resolverUrl;
+        this.cacheTtl = options.cacheTtl ?? 300_000;
+        this.headers = options.headers;
+        this.cache = new Map();
+    }
+    async resolve(did) {
+        if (!parseDidCheqd(did)) {
+            return null;
+        }
+        const cached = this.cache.get(did);
+        if (cached && Date.now() < cached.expiresAt) {
+            return cached.document;
+        }
+        try {
+            const response = await this.fetchProvider.fetch(didCheqdToResolverUrl(did, this.resolverUrl), {
+                method: 'GET',
+                headers: await this.resolveHeaders(),
+            });
+            if (!response.ok) {
+                logger.warn(`[DidCheqdResolver] HTTP ${response.status} resolving ${did}`);
+                return null;
+            }
+            let json;
+            try {
+                json = await response.json();
+            }
+            catch {
+                logger.warn(`[DidCheqdResolver] Invalid JSON resolving ${did}`);
+                return null;
+            }
+            const document = extractDidDocument(json);
+            if (!document || !isValidDIDDocument(document)) {
+                logger.warn(`[DidCheqdResolver] Invalid DID Document resolving ${did}`);
+                return null;
+            }
+            if (document.id !== did) {
+                logger.warn(`[DidCheqdResolver] DID Document id mismatch: expected ${did}, got ${document.id}`);
+                return null;
+            }
+            this.cache.set(did, {
+                document,
+                expiresAt: Date.now() + this.cacheTtl,
+            });
+            return document;
+        }
+        catch (error) {
+            logger.warn(`[DidCheqdResolver] Error resolving ${did}: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            return null;
+        }
+    }
+    clearCache() {
+        this.cache.clear();
+    }
+    clearCacheEntry(did) {
+        this.cache.delete(did);
+    }
+    async resolveHeaders() {
+        if (!this.headers) {
+            return undefined;
+        }
+        return typeof this.headers === 'function' ? this.headers() : this.headers;
+    }
+}
+export function createDidCheqdResolver(fetchProvider, options) {
+    return new DidCheqdResolver(fetchProvider, options);
+}
+export function cheqdResolver(options) {
+    return (fetchProvider) => createDidCheqdResolver(fetchProvider, options);
+}
+export function didCheqdToResolverUrl(did, resolverUrl) {
+    const base = stripTrailingSlashes(resolverUrl);
+    if (base.includes('{did}')) {
+        return base.replace('{did}', did);
+    }
+    if (base.endsWith('/1.0/identifiers')) {
+        return `${base}/${did}`;
+    }
+    return `${base}/1.0/identifiers/${did}`;
+}
+function extractDidDocument(value) {
+    if (isRecord(value) && value['didDocument'] !== undefined) {
+        return value.didDocument;
+    }
+    return value;
+}
+function isValidDIDDocument(value) {
+    if (!isRecord(value)) {
+        return false;
+    }
+    if (typeof value['id'] !== 'string' || value['id'].length === 0) {
+        return false;
+    }
+    if (value['alsoKnownAs'] !== undefined && !isStringArray(value['alsoKnownAs'])) {
+        return false;
+    }
+    if (value['verificationMethod'] !== undefined) {
+        if (!Array.isArray(value['verificationMethod'])) {
+            return false;
+        }
+        for (const method of value['verificationMethod']) {
+            if (!isValidVerificationMethod(method)) {
+                return false;
+            }
+        }
+    }
+    return true;
+}
+function isValidVerificationMethod(value) {
+    if (!isRecord(value)) {
+        return false;
+    }
+    return (typeof value['id'] === 'string' &&
+        value['id'].length > 0 &&
+        typeof value['type'] === 'string' &&
+        value['type'].length > 0 &&
+        typeof value['controller'] === 'string' &&
+        value['controller'].length > 0);
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((entry) => typeof entry === 'string');
+}
+//# sourceMappingURL=resolver.js.map

package/dist/integrations/cheqd/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../src/integrations/cheqd/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAmBtE,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,KAAK,GAAG,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,CAAC,CAAoB;QACpC,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,gBAAgB;IACV,aAAa,CAAgB;IAC7B,WAAW,CAAS;IACpB,KAAK,CAA4D;IACjE,QAAQ,CAAS;IACjB,OAAO,CAAoE;IAE5F,YAAY,aAA4B,EAAE,OAAgC;QACxE,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAC7C,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,EAC5C;gBACE,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,MAAM,IAAI,CAAC,cAAc,EAAE;aACrC,CACF,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,2BAA2B,QAAQ,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC,CAAC;gBAC3E,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,6CAA6C,GAAG,EAAE,CAAC,CAAC;gBAChE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,CAAC,QAAQ,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC,qDAAqD,GAAG,EAAE,CAAC,CAAC;gBACxE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,QAAQ,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,yDAAyD,GAAG,SAAS,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChG,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;gBAClB,QAAQ;gBACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ;aACtC,CAAC,CAAC;YAEH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,sCAAsC,GAAG,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACzG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,eAAe,CAAC,GAAW;QACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,OAAO,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IAC5E,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CACpC,aAA4B,EAC5B,OAAgC;IAEhC,OAAO,IAAI,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAgC;IAC5D,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,sBAAsB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,WAAmB;IACpE,MAAM,IAAI,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACtC,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,IAAI,oBAAoB,GAAG,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAQ,KAA6B,CAAC,WAAW,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,aAAa,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,oBAAoB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ;QAC/B,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QACtB,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ;QACjC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;QACxB,OAAO,KAAK,CAAC,YAAY,CAAC,KAAK,QAAQ;QACvC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;AACnF,CAAC"}

package/dist/middleware/index.d.ts

@@ -9,4 +9,6 @@
 export { createKyaOsMiddleware, type KyaOsConfig, type KyaOsDelegationConfig, type KyaOsIdentityConfig, type KyaOsMiddleware, type KyaOsToolDefinition, type KyaOsToolHandler, type KyaOsServer, } from './with-kya-os.js';
 export { withKyaOs, generateIdentity, type WithKyaOsOptions, } from './with-kya-os-server.js';
 export { createKyaOsTransport, type Transport, type JSONRPCMessage, } from './kya-os-transport.js';
+export { card, CardBuilder, type CardBuilderInit, type AccountableToOptions, type VcInput, } from '../card/builder.js';
+export { withKyaOsCard, requireProof, readCardProof, type KyaOsCardMount, type ServerJsonLike, type DidDocumentLike, type ProofGuard, type ProofGateResult, type ProofGateError, type ProofGateCode, type RequireProofOptions, type MinProofLevel, } from '../card/middleware.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/middleware/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,qBAAqB,EACrB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,WAAW,GACjB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,KAAK,gBAAgB,GACtB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,qBAAqB,EACrB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,WAAW,GACjB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,KAAK,gBAAgB,GACtB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,IAAI,EACJ,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,OAAO,GACb,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,aAAa,EACb,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACnB,MAAM,uBAAuB,CAAC"}

package/dist/middleware/index.js

@@ -9,4 +9,9 @@
 export { createKyaOsMiddleware, } from './with-kya-os.js';
 export { withKyaOs, generateIdentity, } from './with-kya-os-server.js';
 export { createKyaOsTransport, } from './kya-os-transport.js';
+// Entity Card DevX surface — the 10-minute adoption path. The fluent `card()` builder and the
+// `withKyaOsCard` / `requireProof` wrappers hide the RFC 9421/9449/8785 machinery behind
+// ergonomics (see `src/card/builder.ts` + `src/card/middleware.ts`).
+export { card, CardBuilder, } from '../card/builder.js';
+export { withKyaOsCard, requireProof, readCardProof, } from '../card/middleware.js';
 //# sourceMappingURL=index.js.map

package/dist/middleware/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,qBAAqB,GAQtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,SAAS,EACT,gBAAgB,GAEjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,oBAAoB,GAGrB,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,qBAAqB,GAQtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,SAAS,EACT,gBAAgB,GAEjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,oBAAoB,GAGrB,MAAM,uBAAuB,CAAC;AAE/B,8FAA8F;AAC9F,yFAAyF;AACzF,qEAAqE;AACrE,OAAO,EACL,IAAI,EACJ,WAAW,GAIZ,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,aAAa,GAUd,MAAM,uBAAuB,CAAC"}

package/dist/middleware/with-kya-os.config-types.d.ts

@@ -0,0 +1,139 @@
+/**
+ * KYA-OS Middleware — configuration input types.
+ *
+ * The identity / session / delegation configuration a caller passes to
+ * `withKyaOs` / `createKyaOsMiddleware`. Split from the API-surface types
+ * (`./with-kya-os.types.ts`), which re-exports these so importers are unchanged.
+ */
+import type { FetchProvider, NonceCacheProvider } from "../providers/base.js";
+import type { AuditLogProvider } from "../providers/audit-log.js";
+import type { GrantStore } from "../providers/grant-store.js";
+import type { SessionConfig } from "../session/manager.js";
+import type { DIDResolver, StatusListResolver } from "../delegation/vc-verifier.js";
+import type { DIDResolverRegistry } from "../delegation/did-resolver-registry.js";
+import type { RevocationChecker } from "../delegation/chain-enforcement.js";
+import type { DelegationCredential } from "../types/protocol.js";
+export interface KyaOsIdentityConfig {
+    did: string;
+    kid: string;
+    privateKey: string;
+    publicKey: string;
+    agentName?: string;
+}
+export declare const KYA_OS_ACTIONS: readonly ["handshake", "identity", "reputation"];
+export type KyaOsAction = (typeof KYA_OS_ACTIONS)[number];
+export interface KyaOsDelegationConfig {
+    /**
+     * Optional custom DID resolver. If it returns null, middleware falls back to
+     * built-in did:key resolution and fetch-backed did:web resolution.
+     */
+    didResolver?: DIDResolver;
+    /**
+     * Optional fetch provider used for did:web resolution.
+     * If omitted, middleware falls back to the runtime global fetch when available.
+     */
+    fetchProvider?: FetchProvider;
+    /**
+     * Optional DID method resolver registry. Entries are keyed by DID method
+     * (for example, "cheqd") and are checked before the built-in did:key and
+     * did:web fallback. Factory entries receive the active fetch provider.
+     */
+    didResolvers?: DIDResolverRegistry;
+    /**
+     * Resolver for StatusList2021 checks. Credentials with credentialStatus are
+     * rejected when no resolver is configured.
+     */
+    statusListResolver?: StatusListResolver;
+    /**
+     * Resolve ancestor credentials for a delegated chain. The returned array may
+     * contain only ancestors (root -> parent) or the full chain (root -> leaf).
+     */
+    resolveDelegationChain?: (leafCredential: DelegationCredential) => Promise<DelegationCredential[]>;
+    /**
+     * Graph-backed ancestor-revocation check. When provided, the chain walk also
+     * verifies the leaf is not revoked via a cascade-revoked ANCESTOR — caught
+     * independently of how `resolveDelegationChain` hydrated the chain (it walks
+     * the delegation graph + StatusList). `CascadingRevocationManager` is the
+     * reference adapter. Omit to keep the prior per-credential-status behavior.
+     */
+    revocationChecker?: RevocationChecker;
+    /**
+     * Holder-of-key enforcement for inbound calls (spec §11.8). A valid delegation
+     * is a *bearer* credential; holder binding additionally requires the caller to
+     * present a per-request proof (`_kyaos_proof`) signed by the delegation
+     * SUBJECT's key, closing theft-replay for the key-bearing population.
+     *
+     * - `'off'` (default): no holder-binding check — current behavior, unchanged.
+     * - `'warn'`: check and log failures (missing/unbound proof), but still allow.
+     * - `'enforce'`: reject calls whose proof is missing or does not bind the
+     *   subject. **Breaking for callers that don't yet send `_kyaos_proof`** — opt
+     *   in only once your agents mint request proofs.
+     *
+     * Scope is did:key subjects (the DID encodes the key). did:web and other
+     * subjects are deferred to cnf-based binding (phase 2) and logged, never
+     * rejected — so enabling `'enforce'` never breaks did:web traffic.
+     */
+    holderBinding?: "off" | "warn" | "enforce";
+}
+export interface KyaOsConfig {
+    /** Agent identity (DID + key material) */
+    identity: KyaOsIdentityConfig;
+    /** Session configuration overrides */
+    session?: Omit<SessionConfig, "nonceCache">;
+    /**
+     * Replay-protection store, shared by the session handshake AND inbound holder
+     * binding so both draw on one nonce namespace. Defaults to an in-memory store
+     * (single-process only); inject a Redis / Durable Object / KV-backed
+     * {@link NonceCacheProvider} for multi-instance deployments. Set here, not on
+     * `session`, so there is exactly one cache and the two cannot diverge.
+     */
+    nonceCache?: NonceCacheProvider;
+    /**
+     * Durable store for approved authorization grants, enabling the no-paste
+     * retry: an agent that already obtained a grant can call again — even on a
+     * fresh instance with empty memory, or after a restart — without re-pasting
+     * the delegation. Defaults to an in-memory {@link MemoryGrantStore}
+     * (single-process only); inject a Redis / Durable Object / DB-backed
+     * {@link GrantStore} for multi-instance deployments. Mirrors `nonceCache?`.
+     *
+     * For the no-paste retry to actually RESOLVE a bound grant, the call must be
+     * resolvable: either holder binding is `'enforce'` and the agent presents a
+     * per-request `_kyaos_proof` (agent-anchored `getByAgent`), or the client
+     * threads its `sessionId` (session-bearer `getBySession`). A grant that would
+     * be unresolvable — holder binding `'off'` with no threaded `sessionId` — is
+     * NOT bound (it would only orphan a store row); such flows achieve durability
+     * by re-presenting the delegation instead.
+     */
+    grantStore?: GrantStore;
+    /**
+     * Whether to ALSO emit the detached proof under the legacy bare `_meta.proof`
+     * key (in addition to the namespaced `org.kya-os/proof`). The value is
+     * identical under both keys and `_meta` is excluded from the response hash
+     * (§7.6), so the mirror never affects signatures or verification.
+     *
+     * Default `true` — a transition aid so pre-1.1 clients that still read bare
+     * `proof` keep working. Set `false` once your clients read the namespaced key
+     * (the examples do this for a clean single-key Inspector view).
+     *
+     * Stays ON by default for the whole 1.x line (a pre-1.1 reader of bare
+     * `_meta.proof` would otherwise silently get no proof); the legacy mirror is
+     * dropped at 2.0.
+     */
+    emitLegacyProofKey?: boolean;
+    /** Delegation verification overrides */
+    delegation?: KyaOsDelegationConfig;
+    /**
+     * When true, automatically creates a session on the first tool call
+     * if no session exists. Useful for demos and development where
+     * MCP clients don't support the `_kyaos` handshake flow.
+     * In production, KYA-OS-aware runtimes should execute handshake before tool calls.
+     */
+    autoSession?: boolean;
+    /**
+     * Sink for retaining audit records of verified tool calls. Defaults to a
+     * no-op; supply an {@link AuditLogProvider} (e.g. a durable, append-only
+     * implementation) to capture an audit trail.
+     */
+    auditLog?: AuditLogProvider;
+}
+//# sourceMappingURL=with-kya-os.config-types.d.ts.map

package/dist/middleware/with-kya-os.config-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-kya-os.config-types.d.ts","sourceRoot":"","sources":["../../src/middleware/with-kya-os.config-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,cAAc,kDAAmD,CAAC;AAC/E,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CACvB,cAAc,EAAE,oBAAoB,KACjC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACrC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,WAAW;IAC1B,0CAA0C;IAC1C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,sCAAsC;IACtC,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC5C;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC;;;;;;;;;;;;;;;OAeG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,wCAAwC;IACxC,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B"}

package/dist/middleware/with-kya-os.config-types.js

@@ -0,0 +1,9 @@
+/**
+ * KYA-OS Middleware — configuration input types.
+ *
+ * The identity / session / delegation configuration a caller passes to
+ * `withKyaOs` / `createKyaOsMiddleware`. Split from the API-surface types
+ * (`./with-kya-os.types.ts`), which re-exports these so importers are unchanged.
+ */
+export const KYA_OS_ACTIONS = ["handshake", "identity", "reputation"];
+//# sourceMappingURL=with-kya-os.config-types.js.map

package/dist/middleware/with-kya-os.config-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-kya-os.config-types.js","sourceRoot":"","sources":["../../src/middleware/with-kya-os.config-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAsBH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,YAAY,CAAU,CAAC"}