@kya-os/mcp 1.7.0 → 1.9.0

package/dist/card/delegation.js

@@ -0,0 +1,293 @@
+/**
+ * KYA-OS Entity Card — DELEGATION (W3C VC 2.0 + ZCAP-LD profile, CRISP attenuation).
+ *
+ * A DelegationCredential is a W3C VC 2.0 whose `credentialSubject` IS an attenuated ZCAP-LD
+ * capability (`@context` carries `w3id.org/security/zcap/v1` + the KYA-OS delegation namespace).
+ * One credential per HOP; a delegation CHAIN runs `root → … → leaf`. We PROFILE, not fork.
+ *
+ * CRISP attenuation is enforced structurally on resolve and is FAIL-CLOSED — any broadening hop
+ * invalidates the whole chain: child `allowedAction` ⊆ parent; caveats monotone-narrowing (child
+ * `MaxAmount`/`ValidUntil` ≤ parent, no parent caveat silently dropped, unknown caveats replicated
+ * verbatim); top-level `validUntil` narrowing; CONTINUITY (the parent's delegate `invoker` MUST be
+ * the child's `issuer` — you only re-delegate what was delegated to YOUR key — and
+ * `child.parentCapability` references the parent `id`); a constant `invocationTarget`; depth ≤
+ * {@link MAX_DELEGATION_DEPTH}; ROOT `parentCapability` = the resource, `issuer`/`invocationTarget`
+ * = (optional) resource owner / resource. THE JOIN (recomputed, asserted nowhere):
+ * {@link responsiblePartyOf} = `issuer(rootVC)`, {@link leafInvokerOf} = the leaf delegate a verifier
+ * asserts equals `proof.did`. Revocation reuses the injected {@link RevocationChecker} seam from
+ * `./revocation` (no status-list churn reaches callers; NO `mcp-i-core` runtime dep). Per-hop
+ * signature verification is a SEPARATE injected concern; this module owns the CRISP + continuity recompute.
+ */
+import { z } from 'zod';
+import { Did } from './schema.js';
+import { evaluateRevocationChain, } from './revocation.js';
+export const DELEGATION_CONTEXT_V2 = 'https://www.w3.org/ns/credentials/v2'; // VC 2.0 base `@context`
+export const ZCAP_CONTEXT = 'https://w3id.org/security/zcap/v1'; // ZCAP-LD capability context
+export const KYA_OS_DELEGATION_CONTEXT = 'https://kya-os.org/ns/delegation/v1'; // KYA-OS ns
+export const DELEGATION_CREDENTIAL_TYPE = 'DelegationCredential'; // 2nd `type` after VerifiableCredential
+export const MAX_DELEGATION_DEPTH = 10; // fail-closed beyond this
+/** A monotone-narrowing constraint: `{type:'ValidUntil',date}` or `{type:'MaxAmount',limit,currency}`.
+ *  The flat shape keeps typing clean; unknown caveat types are compared verbatim (fail-closed). */
+export const CaveatSchema = z
+    .object({
+    type: z.string().min(1),
+    date: z.string().optional(),
+    limit: z.string().optional(),
+    currency: z.string().optional(),
+})
+    .passthrough();
+/** The attenuated ZCAP capability carried as the VC `credentialSubject`. */
+export const ZcapCapabilitySchema = z
+    .object({
+    id: z.string().min(1),
+    controller: Did.optional(),
+    invoker: Did.optional(),
+    parentCapability: z.string().min(1),
+    invocationTarget: z.string().min(1),
+    allowedAction: z.array(z.string().min(1)),
+    caveats: z.array(CaveatSchema).optional(),
+})
+    .passthrough()
+    .refine((s) => Boolean(s.controller ?? s.invoker), {
+    message: 'ZCAP capability MUST name a controller or invoker (the delegate)',
+});
+/** W3C Bitstring Status List v1.0 `credentialStatus` entry (the StatusList2021 successor). */
+export const DelegationCredentialStatusSchema = z.object({
+    id: z.string().optional(),
+    type: z.literal('BitstringStatusListEntry'),
+    statusPurpose: z.string().optional(),
+    statusListIndex: z.string().min(1),
+    statusListCredential: z.string().min(1),
+});
+/** Data Integrity proof, `eddsa-jcs-2022` cryptosuite (verified by a separate injected seam). */
+export const DataIntegrityProofSchema = z
+    .object({ type: z.literal('DataIntegrityProof'), cryptosuite: z.literal('eddsa-jcs-2022') })
+    .passthrough();
+const IssuerSchema = z.union([Did, z.object({ id: Did }).passthrough()]);
+export const DelegationCredentialSchema = z
+    .object({
+    // >= 2 to match the published JSON Schema (VC 2.0 base + the ZCAP/KYA-OS delegation contexts).
+    '@context': z.array(z.union([z.string(), z.record(z.string(), z.unknown())])).min(2),
+    id: z.string().optional(),
+    type: z.array(z.string()),
+    issuer: IssuerSchema,
+    validFrom: z.string().optional(),
+    validUntil: z.string().optional(),
+    credentialSubject: ZcapCapabilitySchema,
+    credentialStatus: DelegationCredentialStatusSchema.optional(),
+    proof: DataIntegrityProofSchema.optional(),
+})
+    .passthrough();
+/** The issuer (delegator) DID, whether `issuer` is a bare string or an `{id}` object. */
+export function issuerDid(vc) {
+    return typeof vc.issuer === 'string' ? vc.issuer : vc.issuer.id;
+}
+/** The delegate DID granted this capability (`invoker`, falling back to `controller`). */
+export function invokerDid(vc) {
+    return vc.credentialSubject.invoker ?? vc.credentialSubject.controller;
+}
+/** `responsibleParty` = the issuer of the ROOT VC (ultimately accountable). */
+export function responsiblePartyOf(chain) {
+    const root = chain[0];
+    return root ? issuerDid(root) : undefined;
+}
+/** The LEAF invoker — a verifier asserts this equals `proof.did`. */
+export function leafInvokerOf(chain) {
+    const leaf = chain[chain.length - 1];
+    return leaf ? invokerDid(leaf) : undefined;
+}
+/** Project a hop's `credentialStatus` onto the revocation-seam entry shape (if present). */
+export function statusEntryOf(vc) {
+    const status = vc.credentialStatus;
+    if (!status)
+        return undefined;
+    return { statusListCredential: status.statusListCredential, statusListIndex: status.statusListIndex };
+}
+function toScaled(dec) {
+    const match = /^(\d+)(?:\.(\d+))?$/.exec(dec.trim());
+    if (!match?.[1])
+        return undefined;
+    const frac = (match[2] ?? '').padEnd(6, '0').slice(0, 6);
+    try {
+        return BigInt(match[1]) * 1000000n + BigInt(frac);
+    }
+    catch {
+        return undefined;
+    }
+}
+// `child ≤ parent`, fail-closed (any unparseable value ⇒ false).
+function decimalLte(child, parent) {
+    const c = toScaled(child);
+    const p = toScaled(parent);
+    return c !== undefined && p !== undefined && c <= p;
+}
+function dateLte(child, parent) {
+    const c = Date.parse(child);
+    const p = Date.parse(parent);
+    return !Number.isNaN(c) && !Number.isNaN(p) && c <= p;
+}
+// Stable structural equality (sorted-key JSON) for verbatim unknown-caveat comparison.
+function deepEqual(a, b) {
+    return JSON.stringify(sortKeys(a)) === JSON.stringify(sortKeys(b));
+}
+function sortKeys(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeys);
+    if (value && typeof value === 'object') {
+        const record = value;
+        return Object.fromEntries(Object.keys(record).sort().map((k) => [k, sortKeys(record[k])]));
+    }
+    return value;
+}
+/** True iff `child` is at least as narrow as `parent` for the same caveat. */
+function caveatNarrows(parent, child) {
+    if (parent.type !== child.type)
+        return false;
+    if (parent.type === 'ValidUntil') {
+        return typeof parent.date === 'string' && typeof child.date === 'string' && dateLte(child.date, parent.date);
+    }
+    if (parent.type === 'MaxAmount') {
+        // Currency is monotone, not strict-equal: a currency-LESS parent (any currency, per the optional
+        // schema) may be narrowed by a child that pins one; a parent that already pins a currency requires
+        // the SAME one (dropping/switching it broadens). Never fail-open — the amount must still narrow.
+        const currencyNarrows = parent.currency === undefined || parent.currency === child.currency;
+        return (currencyNarrows &&
+            typeof parent.limit === 'string' &&
+            typeof child.limit === 'string' &&
+            decimalLte(child.limit, parent.limit));
+    }
+    return deepEqual(parent, child); // unknown caveat type — must be replicated verbatim
+}
+function actionReasons(parent, child) {
+    const parentSet = new Set(parent);
+    const escalated = child.filter((action) => !parentSet.has(action));
+    return escalated.length === 0 ? [] : [`allowedAction escalation: [${escalated.join(', ')}] ⊄ parent`];
+}
+function caveatReasons(parent, child) {
+    return parent
+        .filter((pc) => !child.some((cc) => caveatNarrows(pc, cc)))
+        .map((pc) => `caveat "${pc.type}" broadened or dropped by child (monotone-narrowing violated)`);
+}
+/** Reasons the `child` FAILS to attenuate its `parent` (empty ⇒ valid hop): action subset, caveat
+ *  monotonicity, `validUntil` narrowing, invoker→issuer continuity, `parentCapability` linkage,
+ *  constant `invocationTarget`. */
+export function attenuates(parent, child) {
+    const p = parent.credentialSubject;
+    const c = child.credentialSubject;
+    const reasons = [
+        ...actionReasons(p.allowedAction, c.allowedAction),
+        ...caveatReasons(p.caveats ?? [], c.caveats ?? []),
+    ];
+    if (parent.validUntil !== undefined && (child.validUntil === undefined || !dateLte(child.validUntil, parent.validUntil))) {
+        reasons.push('validUntil broadened: child must expire no later than its parent');
+    }
+    const delegate = invokerDid(parent);
+    if (delegate === undefined || delegate !== issuerDid(child)) {
+        reasons.push('broken continuity: parent invoker ≠ child issuer (only the delegate may re-delegate)');
+    }
+    if (c.parentCapability !== p.id) {
+        reasons.push('broken continuity: child.parentCapability ≠ parent capability id');
+    }
+    if (c.invocationTarget !== p.invocationTarget) {
+        reasons.push('invocationTarget drift: the resource must be constant along the chain');
+    }
+    return reasons;
+}
+/**
+ * Reasons any hop is temporally INVALID at `nowMs`: an expired top-level `validUntil` or `ValidUntil`
+ * caveat, or a not-yet-valid `validFrom`. Fail-closed on a present-but-unparseable timestamp. Empty ⇒
+ * every hop is inside its validity window. This is the wall-clock gate — CRISP narrowing only proves a
+ * child expires no later than its parent, which a FULLY-expired-but-well-attenuated chain still satisfies.
+ */
+function expiryReasons(chain, nowMs) {
+    const reasons = [];
+    chain.forEach((vc, i) => {
+        if (vc.validUntil !== undefined) {
+            const t = Date.parse(vc.validUntil);
+            if (Number.isNaN(t))
+                reasons.push(`hop ${i}: unparseable validUntil "${vc.validUntil}"`);
+            else if (t < nowMs)
+                reasons.push(`hop ${i}: expired (validUntil ${vc.validUntil} is in the past)`);
+        }
+        if (vc.validFrom !== undefined) {
+            const t = Date.parse(vc.validFrom);
+            if (Number.isNaN(t))
+                reasons.push(`hop ${i}: unparseable validFrom "${vc.validFrom}"`);
+            else if (t > nowMs)
+                reasons.push(`hop ${i}: not yet valid (validFrom ${vc.validFrom} is in the future)`);
+        }
+        for (const caveat of vc.credentialSubject.caveats ?? []) {
+            if (caveat.type === 'ValidUntil' && typeof caveat.date === 'string') {
+                const t = Date.parse(caveat.date);
+                if (Number.isNaN(t))
+                    reasons.push(`hop ${i}: unparseable ValidUntil caveat "${caveat.date}"`);
+                else if (t < nowMs)
+                    reasons.push(`hop ${i}: expired caveat (ValidUntil ${caveat.date} is in the past)`);
+            }
+        }
+    });
+    return reasons;
+}
+function rootReasons(root, ctx) {
+    const subject = root.credentialSubject;
+    const reasons = [];
+    if (subject.parentCapability !== subject.invocationTarget) {
+        reasons.push('root delegation: parentCapability MUST equal invocationTarget (the resource)');
+    }
+    if (ctx.resource !== undefined && subject.invocationTarget !== ctx.resource) {
+        reasons.push('root invocationTarget ≠ the expected resource');
+    }
+    if (ctx.resourceOwner !== undefined && issuerDid(root) !== ctx.resourceOwner) {
+        reasons.push('root issuer ≠ the resource owner (responsibleParty mismatch)');
+    }
+    return reasons;
+}
+/** Structurally validate a chain (CRISP + continuity), fail-closed. Signature + revocation
+ *  are separate injected concerns (see {@link evaluateDelegationChain}). */
+export function validateDelegationChain(chain, ctx = {}) {
+    const depth = chain.length;
+    const maxDepth = ctx.maxDepth ?? MAX_DELEGATION_DEPTH;
+    if (depth === 0) {
+        return { ok: false, reasons: ['empty delegation chain'], allowedAction: [], depth };
+    }
+    const root = chain[0];
+    const leaf = chain[depth - 1];
+    const reasons = [];
+    if (depth > maxDepth)
+        reasons.push(`delegation chain depth ${depth} exceeds the maximum of ${maxDepth}`);
+    reasons.push(...rootReasons(root, ctx));
+    for (let i = 1; i < depth; i += 1) {
+        reasons.push(...attenuates(chain[i - 1], chain[i]));
+    }
+    // Wall-clock gate: a chain can attenuate perfectly and still be fully EXPIRED. Default to real
+    // time so the gate is never silently skipped; deterministic callers inject `ctx.now`.
+    reasons.push(...expiryReasons(chain, (ctx.now ?? Date.now)()));
+    return {
+        ok: reasons.length === 0,
+        reasons,
+        responsibleParty: responsiblePartyOf(chain),
+        leafInvoker: leafInvokerOf(chain),
+        invocationTarget: leaf.credentialSubject.invocationTarget,
+        allowedAction: leaf.credentialSubject.allowedAction,
+        depth,
+    };
+}
+/** Validate structure AND revocation: run {@link validateDelegationChain}, then (only if it passes —
+ *  fail-closed) cascade the injected {@link RevocationChecker} root→leaf via
+ *  {@link evaluateRevocationChain}. A revoked ancestor invalidates the subtree. */
+export async function evaluateDelegationChain(chain, check, ctx = {}) {
+    const structural = validateDelegationChain(chain, ctx);
+    if (!structural.ok)
+        return { ...structural, fresh: false };
+    const entries = chain
+        .map(statusEntryOf)
+        .filter((entry) => entry !== undefined);
+    const revocation = await evaluateRevocationChain(entries, check);
+    return {
+        ...structural,
+        ok: structural.ok && revocation.ok,
+        reasons: [...structural.reasons, ...revocation.reasons],
+        fresh: revocation.fresh,
+    };
+}
+//# sourceMappingURL=delegation.js.map

package/dist/card/delegation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.js","sourceRoot":"","sources":["../../src/card/delegation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,GAAG,EAAiC,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,uBAAuB,GAGxB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,CAAC,MAAM,qBAAqB,GAAG,sCAAsC,CAAC,CAAC,yBAAyB;AACtG,MAAM,CAAC,MAAM,YAAY,GAAG,mCAAmC,CAAC,CAAC,6BAA6B;AAC9F,MAAM,CAAC,MAAM,yBAAyB,GAAG,qCAAqC,CAAC,CAAC,YAAY;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC,CAAC,wCAAwC;AAC1G,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC,CAAC,0BAA0B;AAElE;mGACmG;AACnG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE;IAC1B,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE;IACvB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,WAAW,EAAE;KACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE;IACjD,OAAO,EAAE,kEAAkE;CAC5E,CAAC,CAAC;AAEL,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxC,CAAC,CAAC;AAEH,iGAAiG;AACjG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;KAC3F,WAAW,EAAE,CAAC;AACjB,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAEzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,+FAA+F;IAC/F,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,iBAAiB,EAAE,oBAAoB;IACvC,gBAAgB,EAAE,gCAAgC,CAAC,QAAQ,EAAE;IAC7D,KAAK,EAAE,wBAAwB,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,WAAW,EAAE,CAAC;AAQjB,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,EAAwB;IAChD,OAAO,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;AAClE,CAAC;AACD,0FAA0F;AAC1F,MAAM,UAAU,UAAU,CAAC,EAAwB;IACjD,OAAO,EAAE,CAAC,iBAAiB,CAAC,OAAO,IAAI,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC;AACzE,CAAC;AACD,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,KAAsB;IACvD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AACD,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAAC,KAAsB;IAClD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AACD,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,EAAwB;IACpD,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;AACxG,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,QAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,SAAS,UAAU,CAAC,KAAa,EAAE,MAAc;IAC/C,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AACD,SAAS,OAAO,CAAC,KAAa,EAAE,MAAc;IAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,uFAAuF;AACvF,SAAS,SAAS,CAAC,CAAU,EAAE,CAAU;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AACD,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,MAAc,EAAE,KAAa;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,OAAO,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,iGAAiG;QACjG,mGAAmG;QACnG,iGAAiG;QACjG,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC;QAC5F,OAAO,CACL,eAAe;YACf,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAChC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAC/B,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,oDAAoD;AACvF,CAAC;AACD,SAAS,aAAa,CAAC,MAAyB,EAAE,KAAwB;IACxE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,8BAA8B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AACxG,CAAC;AACD,SAAS,aAAa,CAAC,MAAyB,EAAE,KAAwB;IACxE,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;SAC1D,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,+DAA+D,CAAC,CAAC;AACpG,CAAC;AAED;;mCAEmC;AACnC,MAAM,UAAU,UAAU,CAAC,MAA4B,EAAE,KAA2B;IAClF,MAAM,CAAC,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACnC,MAAM,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAClC,MAAM,OAAO,GAAa;QACxB,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC;QAClD,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;KACnD,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACzH,OAAO,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAUD;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAsB,EAAE,KAAa;IAC1D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;QACtB,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;YACpC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,6BAA6B,EAAE,CAAC,UAAU,GAAG,CAAC,CAAC;iBACpF,IAAI,CAAC,GAAG,KAAK;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,UAAU,kBAAkB,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,EAAE,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;iBAClF,IAAI,CAAC,GAAG,KAAK;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,8BAA8B,EAAE,CAAC,SAAS,oBAAoB,CAAC,CAAC;QAC3G,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,iBAAiB,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACxD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,oCAAoC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;qBACzF,IAAI,CAAC,GAAG,KAAK;oBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gCAAgC,MAAM,CAAC,IAAI,kBAAkB,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAYD,SAAS,WAAW,CAAC,IAA0B,EAAE,GAA2B;IAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,gBAAgB,KAAK,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,gBAAgB,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,aAAa,EAAE,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,uBAAuB,CACrC,KAAsB,EACtB,MAA8B,EAAE;IAEhC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;IAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,oBAAoB,CAAC;IACtD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,wBAAwB,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAG,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,KAAK,2BAA2B,QAAQ,EAAE,CAAC,CAAC;IACzG,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,+FAA+F;IAC/F,sFAAsF;IACtF,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;QACxB,OAAO;QACP,gBAAgB,EAAE,kBAAkB,CAAC,KAAK,CAAC;QAC3C,WAAW,EAAE,aAAa,CAAC,KAAK,CAAC;QACjC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB,CAAC,gBAAgB;QACzD,aAAa,EAAE,IAAI,CAAC,iBAAiB,CAAC,aAAa;QACnD,KAAK;KACN,CAAC;AACJ,CAAC;AAMD;;mFAEmF;AACnF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAsB,EACtB,KAAwB,EACxB,MAA8B,EAAE;IAEhC,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC3D,MAAM,OAAO,GAAG,KAAK;SAClB,GAAG,CAAC,aAAa,CAAC;SAClB,MAAM,CAAC,CAAC,KAAK,EAAqC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC7E,MAAM,UAAU,GAA0B,MAAM,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxF,OAAO;QACL,GAAG,UAAU;QACb,EAAE,EAAE,UAAU,CAAC,EAAE,IAAI,UAAU,CAAC,EAAE;QAClC,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC;QACvD,KAAK,EAAE,UAAU,CAAC,KAAK;KACxB,CAAC;AACJ,CAAC"}

package/dist/card/emit.d.ts

@@ -0,0 +1,133 @@
+/**
+ * KYA-OS Entity Card — EMIT discovery surfaces.
+ *
+ * "Discover like everyone": one canonical `EntityCard` PROJECTED onto every rail the
+ * ecosystem already indexes. These are pure, deterministic projections (no I/O, no crypto)
+ * of a single card — each one references the SAME canonical `card.json` endpoint on the
+ * entity's `did:web` DID document, so a verifier always lands back on one source of truth:
+ *
+ *   - `toDidServiceEntry`  — the `KyaOsEntityCard` service entry that ANCHORS the card on
+ *     the DID document (the canonical home);
+ *   - `toServerCardMeta`   — MCP `server.json` / catalog `_meta['org.kya-os/card']` (inline
+ *     summary, or `{ byRef }` → a lazy-fetch `cardRef`);
+ *   - `toCatalogEntry`     — a `/.well-known/mcp/catalog.json` INDEX row (always by-ref);
+ *   - `toA2AExtension`     — an A2A `AgentCard.capabilities.extensions[]` entry (agents only,
+ *     `required:false` IS the graceful-degradation contract);
+ *   - `toAgentFacts`       — a NANDA AgentFacts JSON-LD projection (we POPULATE `owner` from
+ *     `responsibleParty`, never re-claim it; our axes live under the `kya:` context).
+ *
+ * The per-request holder-of-key proof is NEVER projected here — it rides per-request `_meta`.
+ * A stripped `_meta` degrades to a fetch, never a failure.
+ */
+import { KYA_OS_CARD_META_KEY } from './resolve.js';
+import { type BitstringStatusListEntry, type EntityCard, type EntityType } from './schema.js';
+/**
+ * Shared emit option: override the card.json URL the web-anchored projections point at. Lets a
+ * BARE `did:web` org root (which has no path-derived card path) publish via the shipped helpers,
+ * or point at a non-conventional home. Defaults to `didWebToCardUrl(card.id)` — the well-known
+ * path for a bare root, `/…/card.json` for a path-form DID.
+ */
+export interface CardUrlOverride {
+    serviceEndpoint?: string;
+}
+/** A2A extension URI for the entity-card surface (version pinned IN the URI). */
+export declare const A2A_ENTITY_CARD_EXT_URI = "https://kya-os.org/a2a/ext/entity-card/v1";
+/** Human-readable description carried on the A2A extension entry. */
+export declare const A2A_ENTITY_CARD_EXT_DESCRIPTION = "KYA-OS typed DID-anchored holder-of-key identity";
+/** JSON-LD `@context` namespace for the uniquely-ours AgentFacts axes. */
+export declare const AGENTFACTS_KYA_CONTEXT = "https://kya-os.org/ns/agentfacts/v1#";
+/** The per-request holder-of-key proof profile a card advertises (named, never inlined). */
+export declare const PROOF_PROFILE = "org.kya-os/proof@1";
+/** A W3C DID-document `service[]` entry anchoring the card. */
+export interface DidServiceEntry {
+    id: string;
+    type: string;
+    serviceEndpoint: string;
+}
+/**
+ * Inline projection of a card for `_meta` indexing. Carries the identity axes AND the
+ * trust-bearing POINTERS — `delegationRef` (the proof for the `responsibleParty` claim) and
+ * `revocation` (the post-issuance kill switch) — so the projection stays self-verifiable and can
+ * never be mistaken for a clean card once a trust field is stripped. `resolveCard` DEREFERENCES
+ * the summary to the canonical `card.json` (the summary is an index, not the authority), but
+ * carrying these pointers keeps the index honest for any consumer that reads it directly:
+ * emitting the `responsibleParty` claim WITHOUT its `delegationRef` proof, or dropping
+ * `revocation`, is exactly the asymmetry that would let a revoked card look live.
+ */
+export interface EntityCardSummary {
+    id: string;
+    entityType: EntityType;
+    name: string;
+    capabilities?: string[];
+    responsibleParty?: string;
+    delegationRef?: string;
+    proofProfile?: string;
+    revocation?: BitstringStatusListEntry;
+}
+/** The lazy-fetch alternative to an inline summary inside `org.kya-os/card`. */
+export type CardRefValue = {
+    'org.kya-os/cardRef': string;
+};
+/** The `_meta` fragment carrying the card on an MCP server.json / catalog surface. */
+export type ServerCardMeta = Record<typeof KYA_OS_CARD_META_KEY, EntityCardSummary | CardRefValue>;
+/** A catalog.json INDEX row (always by-ref for lazy fetch). */
+export interface CatalogEntry {
+    name: string;
+    _meta: ServerCardMeta;
+}
+/** An A2A `AgentCard.capabilities.extensions[]` entry. */
+export interface A2AExtension {
+    uri: string;
+    description: string;
+    required: boolean;
+    params: {
+        id: string;
+        entityType: 'agent';
+        cardUrl: string;
+        /** Emitted only when the card DECLARES a proof profile — consistent with the other rails. */
+        proofProfile?: typeof PROOF_PROFILE;
+    };
+}
+/** A NANDA AgentFacts JSON-LD projection. */
+export interface AgentFacts {
+    '@context': {
+        kya: string;
+    };
+    id: string;
+    agent_name: string;
+    'kya:entityType': EntityType;
+    owner?: string;
+    capabilities?: string[];
+    'kya:conformanceLevel'?: string;
+    'kya:proofProfile'?: string;
+    'kya:delegationRef'?: string;
+}
+/**
+ * The `KyaOsEntityCard` DID-document service entry — the card's canonical home. `opts.serviceEndpoint`
+ * overrides the derived URL so a bare `did:web` org root (or a non-conventional home) can anchor its
+ * entry explicitly; otherwise it defaults to `didWebToCardUrl(card.id)`.
+ */
+export declare function toDidServiceEntry(card: EntityCard, opts?: CardUrlOverride): DidServiceEntry;
+/** The MCP `server.json` / catalog `_meta['org.kya-os/card']` fragment (inline, or by-ref). */
+export declare function toServerCardMeta(card: EntityCard, opts?: CardUrlOverride & {
+    byRef?: boolean;
+}): ServerCardMeta;
+/** A catalog.json INDEX row — by-ref so the index stays cheap and the card lazy-fetches. */
+export declare function toCatalogEntry(card: EntityCard): CatalogEntry;
+/**
+ * An A2A AgentExtension entry. Scoped to `entityType:'agent'` (the only A2A principal) and
+ * fail-closed otherwise. `required:false` (the default) IS the graceful-degradation contract:
+ * an unaware peer ignores the extension instead of rejecting the AgentCard. `proofProfile` is
+ * emitted ONLY when the card declares one — the same gate as `_meta` and AgentFacts, so all four
+ * projections advertise the proof posture consistently (never A2A-only).
+ */
+export declare function toA2AExtension(card: EntityCard, opts?: CardUrlOverride & {
+    required?: boolean;
+}): A2AExtension;
+/**
+ * A NANDA AgentFacts JSON-LD projection. We POPULATE NANDA's shipped `owner` slot from
+ * `responsibleParty` (we do not re-claim it); the uniquely-ours axes live under the `kya:`
+ * context. Optional fields are omitted when absent (claim-minimalism, deterministic output).
+ */
+export declare function toAgentFacts(card: EntityCard): AgentFacts;
+//# sourceMappingURL=emit.d.ts.map

package/dist/card/emit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../src/card/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAEL,oBAAoB,EAIrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,UAAU,EACf,KAAK,UAAU,EAChB,MAAM,aAAa,CAAC;AAErB;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,8CAA8C,CAAC;AACnF,qEAAqE;AACrE,eAAO,MAAM,+BAA+B,qDAAqD,CAAC;AAClG,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB,yCAAyC,CAAC;AAC7E,4FAA4F;AAC5F,eAAO,MAAM,aAAa,uBAAmB,CAAC;AAI9C,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,wBAAwB,CAAC;CACvC;AAED,gFAAgF;AAChF,MAAM,MAAM,YAAY,GAAG;IAAE,oBAAoB,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,sFAAsF;AACtF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,oBAAoB,EAAE,iBAAiB,GAAG,YAAY,CAAC,CAAC;AAEnG,+DAA+D;AAC/D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,cAAc,CAAC;CACvB;AAED,0DAA0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE;QACN,EAAE,EAAE,MAAM,CAAC;QACX,UAAU,EAAE,OAAO,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,6FAA6F;QAC7F,YAAY,CAAC,EAAE,OAAO,aAAa,CAAC;KACrC,CAAC;CACH;AAED,6CAA6C;AAC7C,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,UAAU,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAID;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,GAAE,eAAoB,GAAG,eAAe,CAM/F;AAED,+FAA+F;AAC/F,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,eAAe,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/C,cAAc,CAKhB;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,CAE7D;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,eAAe,GAAG;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAClD,YAAY,CAkBd;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAazD"}

package/dist/card/emit.js

@@ -0,0 +1,127 @@
+/**
+ * KYA-OS Entity Card — EMIT discovery surfaces.
+ *
+ * "Discover like everyone": one canonical `EntityCard` PROJECTED onto every rail the
+ * ecosystem already indexes. These are pure, deterministic projections (no I/O, no crypto)
+ * of a single card — each one references the SAME canonical `card.json` endpoint on the
+ * entity's `did:web` DID document, so a verifier always lands back on one source of truth:
+ *
+ *   - `toDidServiceEntry`  — the `KyaOsEntityCard` service entry that ANCHORS the card on
+ *     the DID document (the canonical home);
+ *   - `toServerCardMeta`   — MCP `server.json` / catalog `_meta['org.kya-os/card']` (inline
+ *     summary, or `{ byRef }` → a lazy-fetch `cardRef`);
+ *   - `toCatalogEntry`     — a `/.well-known/mcp/catalog.json` INDEX row (always by-ref);
+ *   - `toA2AExtension`     — an A2A `AgentCard.capabilities.extensions[]` entry (agents only,
+ *     `required:false` IS the graceful-degradation contract);
+ *   - `toAgentFacts`       — a NANDA AgentFacts JSON-LD projection (we POPULATE `owner` from
+ *     `responsibleParty`, never re-claim it; our axes live under the `kya:` context).
+ *
+ * The per-request holder-of-key proof is NEVER projected here — it rides per-request `_meta`.
+ * A stripped `_meta` degrades to a fetch, never a failure.
+ */
+import { didWebToCardUrl, KYA_OS_CARD_META_KEY, KYA_OS_CARD_REF_KEY, KYA_OS_CARD_SERVICE_ID, KYA_OS_CARD_SERVICE_TYPE, } from './resolve.js';
+import { capabilityNames, PROOF_PROFILE_ID, } from './schema.js';
+/** A2A extension URI for the entity-card surface (version pinned IN the URI). */
+export const A2A_ENTITY_CARD_EXT_URI = 'https://kya-os.org/a2a/ext/entity-card/v1';
+/** Human-readable description carried on the A2A extension entry. */
+export const A2A_ENTITY_CARD_EXT_DESCRIPTION = 'KYA-OS typed DID-anchored holder-of-key identity';
+/** JSON-LD `@context` namespace for the uniquely-ours AgentFacts axes. */
+export const AGENTFACTS_KYA_CONTEXT = 'https://kya-os.org/ns/agentfacts/v1#';
+/** The per-request holder-of-key proof profile a card advertises (named, never inlined). */
+export const PROOF_PROFILE = PROOF_PROFILE_ID;
+// ── Projections ─────────────────────────────────────────────────────────────
+/**
+ * The `KyaOsEntityCard` DID-document service entry — the card's canonical home. `opts.serviceEndpoint`
+ * overrides the derived URL so a bare `did:web` org root (or a non-conventional home) can anchor its
+ * entry explicitly; otherwise it defaults to `didWebToCardUrl(card.id)`.
+ */
+export function toDidServiceEntry(card, opts = {}) {
+    return {
+        id: KYA_OS_CARD_SERVICE_ID,
+        type: KYA_OS_CARD_SERVICE_TYPE,
+        serviceEndpoint: opts.serviceEndpoint ?? didWebToCardUrl(card.id),
+    };
+}
+/** The MCP `server.json` / catalog `_meta['org.kya-os/card']` fragment (inline, or by-ref). */
+export function toServerCardMeta(card, opts = {}) {
+    const value = opts.byRef
+        ? { [KYA_OS_CARD_REF_KEY]: opts.serviceEndpoint ?? didWebToCardUrl(card.id) }
+        : cardSummary(card);
+    return { [KYA_OS_CARD_META_KEY]: value };
+}
+/** A catalog.json INDEX row — by-ref so the index stays cheap and the card lazy-fetches. */
+export function toCatalogEntry(card) {
+    return { name: card.name, _meta: toServerCardMeta(card, { byRef: true }) };
+}
+/**
+ * An A2A AgentExtension entry. Scoped to `entityType:'agent'` (the only A2A principal) and
+ * fail-closed otherwise. `required:false` (the default) IS the graceful-degradation contract:
+ * an unaware peer ignores the extension instead of rejecting the AgentCard. `proofProfile` is
+ * emitted ONLY when the card declares one — the same gate as `_meta` and AgentFacts, so all four
+ * projections advertise the proof posture consistently (never A2A-only).
+ */
+export function toA2AExtension(card, opts = {}) {
+    if (card.entityType !== 'agent') {
+        throw new Error(`toA2AExtension: the A2A AgentExtension is scoped to entityType "agent" (got "${card.entityType}")`);
+    }
+    const params = {
+        id: card.id,
+        entityType: 'agent',
+        cardUrl: opts.serviceEndpoint ?? didWebToCardUrl(card.id),
+    };
+    if (card.proofProfile !== undefined)
+        params.proofProfile = card.proofProfile;
+    return {
+        uri: A2A_ENTITY_CARD_EXT_URI,
+        description: A2A_ENTITY_CARD_EXT_DESCRIPTION,
+        required: opts.required ?? false,
+        params,
+    };
+}
+/**
+ * A NANDA AgentFacts JSON-LD projection. We POPULATE NANDA's shipped `owner` slot from
+ * `responsibleParty` (we do not re-claim it); the uniquely-ours axes live under the `kya:`
+ * context. Optional fields are omitted when absent (claim-minimalism, deterministic output).
+ */
+export function toAgentFacts(card) {
+    const facts = {
+        '@context': { kya: AGENTFACTS_KYA_CONTEXT },
+        id: card.id,
+        agent_name: card.name,
+        'kya:entityType': card.entityType,
+    };
+    if (card.responsibleParty !== undefined)
+        facts.owner = card.responsibleParty;
+    if (card.capabilities !== undefined)
+        facts.capabilities = capabilityNames(card.capabilities);
+    if (card.conformanceLevel !== undefined)
+        facts['kya:conformanceLevel'] = card.conformanceLevel;
+    if (card.proofProfile !== undefined)
+        facts['kya:proofProfile'] = card.proofProfile;
+    if (card.delegationRef !== undefined)
+        facts['kya:delegationRef'] = card.delegationRef;
+    return facts;
+}
+// ── Internals ───────────────────────────────────────────────────────────────
+/**
+ * Inline summary: identity + type + capability names, PLUS the trust-bearing pointers
+ * (`delegationRef` proves the `responsibleParty` claim; `revocation` is the kill switch). Carrying
+ * both closes the claim-without-proof asymmetry so the projection is self-verifiable and never
+ * fails open on a revoked card. Still a valid card (all fields optional), but `resolveCard`
+ * dereferences it to the canonical `card.json` rather than trusting it.
+ */
+function cardSummary(card) {
+    const summary = { id: card.id, entityType: card.entityType, name: card.name };
+    if (card.capabilities !== undefined)
+        summary.capabilities = capabilityNames(card.capabilities);
+    if (card.responsibleParty !== undefined)
+        summary.responsibleParty = card.responsibleParty;
+    if (card.delegationRef !== undefined)
+        summary.delegationRef = card.delegationRef;
+    if (card.proofProfile !== undefined)
+        summary.proofProfile = card.proofProfile;
+    if (card.revocation !== undefined)
+        summary.revocation = card.revocation;
+    return summary;
+}
+//# sourceMappingURL=emit.js.map

package/dist/card/emit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit.js","sourceRoot":"","sources":["../../src/card/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,gBAAgB,GAIjB,MAAM,aAAa,CAAC;AAYrB,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,2CAA2C,CAAC;AACnF,qEAAqE;AACrE,MAAM,CAAC,MAAM,+BAA+B,GAAG,kDAAkD,CAAC;AAClG,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,sCAAsC,CAAC;AAC7E,4FAA4F;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAuE9C,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAgB,EAAE,OAAwB,EAAE;IAC5E,OAAO;QACL,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,wBAAwB;QAC9B,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,gBAAgB,CAC9B,IAAgB,EAChB,OAA8C,EAAE;IAEhD,MAAM,KAAK,GAAqC,IAAI,CAAC,KAAK;QACxD,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAC7E,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,IAAgB;IAC7C,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAgB,EAChB,OAAiD,EAAE;IAEnD,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,gFAAgF,IAAI,CAAC,UAAU,IAAI,CACpG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAA2B;QACrC,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,UAAU,EAAE,OAAO;QACnB,OAAO,EAAE,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IAC7E,OAAO;QACL,GAAG,EAAE,uBAAuB;QAC5B,WAAW,EAAE,+BAA+B;QAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;QAChC,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAgB;IAC3C,MAAM,KAAK,GAAe;QACxB,UAAU,EAAE,EAAE,GAAG,EAAE,sBAAsB,EAAE;QAC3C,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,UAAU,EAAE,IAAI,CAAC,IAAI;QACrB,gBAAgB,EAAE,IAAI,CAAC,UAAU;KAClC,CAAC;IACF,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS;QAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC7E,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,KAAK,CAAC,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7F,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS;QAAE,KAAK,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC/F,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,KAAK,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;IACnF,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;QAAE,KAAK,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC;IACtF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAE/E;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,IAAgB;IACnC,MAAM,OAAO,GAAsB,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACjG,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,CAAC,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/F,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS;QAAE,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC1F,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IACjF,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9E,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACxE,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/card/index.d.ts

@@ -0,0 +1,43 @@
+/**
+ * KYA-OS Entity Card — v1.1 profile helpers
+ *
+ * Reference helpers for the typed, DID-anchored entity card. See
+ * `SPEC-ENTITY-CARD.md` and `schemas/kya-os-card.schema.json`. Three moves, each in a
+ * focused submodule re-exported here:
+ *   - buildCard   (./build):   EMIT this entity's card from its identity + declared facts.
+ *   - emit        (./emit):    PROJECT the card onto every discovery rail (DID service entry,
+ *                              MCP `_meta`, catalog, A2A extension, NANDA AgentFacts).
+ *   - resolveCard (./resolve): DISCOVER another entity's card (multi-surface, via SafeFetch).
+ *   - verifyCard  (./verify):  VERIFY the card's claims — RECOMPUTING the conformance
+ *                              level rather than trusting whatever the card declares.
+ *   - cimd        (./cimd):    BIND the L1 CIMD on-ramp — `client_id` ⇄ `did:web`, DID-keyed
+ *                              JWKS, and the fail-closed origin/`alsoKnownAs` substitution graft.
+ *   - proof       (./proof):   MINT + VERIFY the stateless per-request holder-of-key proof
+ *                              (`org.kya-os/proof@1`) — sender-constrained, fail-closed.
+ *   - delegation  (./delegation): VALIDATE the W3C VC 2.0 + ZCAP-LD delegation chain — CRISP
+ *                              attenuation + continuity, `responsibleParty`/leaf-invoker, fail-closed.
+ *   - builder     (./builder):  the fluent `card()` chain — the 10-minute path to a valid card.
+ *   - middleware  (./middleware): `withKyaOsCard` (mount the discovery artifacts) + `requireProof`
+ *                              (the per-request holder-of-key guard, 401-shaped on fail).
+ *
+ * All cryptographic verification is injected via pluggable seams (the same pattern
+ * `validateLevel2` already uses for its `signatureVerifier`), so `@kya-os/mcp` stays
+ * free of any runtime (mcp-i-core) dependency. The conformance LEVEL is derived in
+ * `./verify`, never baked into a function name.
+ *
+ * The card shape is defined once as a zod schema in `./schema` (mirroring the
+ * published `schemas/kya-os-card.schema.json`); types are `z.infer`-derived.
+ */
+export * from './schema.js';
+export * from './build.js';
+export * from './emit.js';
+export * from './resolve.js';
+export * from './verify.js';
+export * from './cimd.js';
+export * from './proof/index.js';
+export * from './delegation.js';
+export * from './builder.js';
+export * from './middleware.js';
+export * from './revocation.js';
+export { createSafeFetch, fetchTransport, isBlockedAddress, type SafeFetch, type SafeFetchOptions, type SafeFetchResponse, type SafeFetchTransport, type TransportInit, type DnsLookup, type DnsAddress, } from '../utils/safe-fetch.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/card/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/card/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAKhC,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,wBAAwB,CAAC"}