{"_id":"@agenticprimitives/key-authorization","_rev":"7-85032aff88f8f3ceafe1e6880d36400b","name":"@agenticprimitives/key-authorization","dist-tags":{"latest":"0.0.0-alpha.8"},"versions":{"0.0.0-alpha.2":{"name":"@agenticprimitives/key-authorization","version":"0.0.0-alpha.2","keywords":["agentic","primitives","key-authorization","decrypt-grant","kas","vault"],"license":"MIT","_id":"@agenticprimitives/key-authorization@0.0.0-alpha.2","maintainers":[{"name":"richcanvas","email":"richardpedersen3@gmail.com"}],"homepage":"https://github.com/agentictrustlabs/agenticprimitives/tree/master/packages/key-authorization","bugs":{"url":"https://github.com/agentictrustlabs/agenticprimitives/issues"},"dist":{"shasum":"8f8c52ae81609bf734b2cac09ba86f238b0082d3","tarball":"https://registry.npmjs.org/@agenticprimitives/key-authorization/-/key-authorization-0.0.0-alpha.2.tgz","fileCount":20,"integrity":"sha512-y6W/bJ1Iyx6b42hPPKHMIu1e1lqqsdDZTijatvlERiKW0uduAnhul676WtA50umspkDjEzZbg8KMzuizlSeAQQ==","signatures":[{"sig":"MEQCIH5nraTSyA4UT+zMfx8QQXawqgsou/n8sRfdw8s4GaNFAiAwFGHMOTGH1EY+g+eCopiDCEh7euajLThUOxhL9Langg==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":44100},"main":"./dist/index.js","type":"module","_from":"file:agenticprimitives-key-authorization-0.0.0-alpha.2.tgz","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"scripts":{"test":"vitest run","build":"tsc -p tsconfig.build.json","clean":"rm -rf dist","test:unit":"vitest run test/unit --passWithNoTests","typecheck":"tsc -p tsconfig.json --noEmit","test:watch":"vitest"},"_npmUser":{"name":"richcanvas","email":"richardpedersen3@gmail.com"},"_resolved":"/tmp/bb8f6fb231192ca19c1796158e9e4f19/agenticprimitives-key-authorization-0.0.0-alpha.2.tgz","_integrity":"sha512-y6W/bJ1Iyx6b42hPPKHMIu1e1lqqsdDZTijatvlERiKW0uduAnhul676WtA50umspkDjEzZbg8KMzuizlSeAQQ==","repository":{"url":"git+https://github.com/agentictrustlabs/agenticprimitives.git","type":"git","directory":"packages/key-authorization"},"_npmVersion":"11.16.0","description":"Policy-bound one-time key release (spec 277 §14): DecryptGrant construction + KAS verification + one-time replay store. Authority stays delegation/entitlement/policy; key-custody does the DEK unwrap.","directories":{},"_nodeVersion":"24.12.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^4.1.8"},"_npmOperationalInternal":{"tmp":"tmp/key-authorization_0.0.0-alpha.2_1781712139975_0.6552047915410599","host":"s3://npm-registry-packages-npm-production"}},"0.0.0-alpha.3":{"name":"@agenticprimitives/key-authorization","version":"0.0.0-alpha.3","keywords":["agentic","primitives","key-authorization","decrypt-grant","kas","vault"],"license":"MIT","_id":"@agenticprimitives/key-authorization@0.0.0-alpha.3","maintainers":[{"name":"richcanvas","email":"richardpedersen3@gmail.com"}],"homepage":"https://github.com/agentictrustlabs/agenticprimitives/tree/master/packages/key-authorization","bugs":{"url":"https://github.com/agentictrustlabs/agenticprimitives/issues"},"dist":{"shasum":"d83571294a958a78f25c49f1470aaedfc0d9d8d6","tarball":"https://registry.npmjs.org/@agenticprimitives/key-authorization/-/key-authorization-0.0.0-alpha.3.tgz","fileCount":20,"integrity":"sha512-R2KNFaQGBtHOL3vHM7ecDbUyqa8//YqIUZ4s+OIWXVCsMIjLv/8KLfUoFkVkrfvuxr9DvZD5SzVF9BmXAG58QQ==","signatures":[{"sig":"MEUCIQCeJGLI/GHcMPCq5l7K30humcDhxpv2kfyESO0hGf3RPwIgLLqUXowWQX52pCXWin2BLySDjFvfrwWv3ZURoKJIxvI=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":50345},"main":"./dist/index.js","type":"module","_from":"file:agenticprimitives-key-authorization-0.0.0-alpha.3.tgz","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"scripts":{"test":"vitest run","build":"tsc -p tsconfig.build.json","clean":"rm -rf dist","test:unit":"vitest run test/unit --passWithNoTests","typecheck":"tsc -p tsconfig.json --noEmit","test:watch":"vitest"},"_npmUser":{"name":"richcanvas","email":"richardpedersen3@gmail.com"},"_resolved":"/tmp/af85bb5c90aedf5ae6dbfbe3de8c463e/agenticprimitives-key-authorization-0.0.0-alpha.3.tgz","_integrity":"sha512-R2KNFaQGBtHOL3vHM7ecDbUyqa8//YqIUZ4s+OIWXVCsMIjLv/8KLfUoFkVkrfvuxr9DvZD5SzVF9BmXAG58QQ==","repository":{"url":"git+https://github.com/agentictrustlabs/agenticprimitives.git","type":"git","directory":"packages/key-authorization"},"_npmVersion":"11.16.0","description":"Policy-bound one-time key release (spec 277 §14): DecryptGrant construction + KAS verification + one-time replay store. Authority stays delegation/entitlement/policy; key-custody does the DEK unwrap.","directories":{},"_nodeVersion":"24.12.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^4.1.8"},"_npmOperationalInternal":{"tmp":"tmp/key-authorization_0.0.0-alpha.3_1781837971743_0.9425383903510762","host":"s3://npm-registry-packages-npm-production"}},"0.0.0-alpha.4":{"name":"@agenticprimitives/key-authorization","version":"0.0.0-alpha.4","keywords":["agentic","primitives","key-authorization","decrypt-grant","kas","vault"],"license":"MIT","_id":"@agenticprimitives/key-authorization@0.0.0-alpha.4","maintainers":[{"name":"richcanvas","email":"richardpedersen3@gmail.com"}],"homepage":"https://github.com/agentictrustlabs/agenticprimitives/tree/master/packages/key-authorization","bugs":{"url":"https://github.com/agentictrustlabs/agenticprimitives/issues"},"dist":{"shasum":"a0330d91f328e2de6cf0d422cf18bb2d2e01870a","tarball":"https://registry.npmjs.org/@agenticprimitives/key-authorization/-/key-authorization-0.0.0-alpha.4.tgz","fileCount":20,"integrity":"sha512-3e1vgsgUPbSHocLHF0NNbYC2L8nDG8+sd7NdMgnoTclQPYHG1G/ISR4MBmbcqZTfgWAwlZcp983d/GSO4C/uMQ==","signatures":[{"sig":"MEQCIBktJCBLr+SEh+V3tr0xn7dap/3AFuSLlwTf04U9vw1YAiBMZY0wS07hjNxuP2lCKQtoCbZIdoqiRoF4dcU2W4jQ0g==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":55911},"main":"./dist/index.js","type":"module","_from":"file:agenticprimitives-key-authorization-0.0.0-alpha.4.tgz","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"scripts":{"test":"vitest run","build":"tsc -p tsconfig.build.json","clean":"rm -rf dist","test:unit":"vitest run test/unit --passWithNoTests","typecheck":"tsc -p tsconfig.json --noEmit","test:watch":"vitest"},"_npmUser":{"name":"richcanvas","email":"richardpedersen3@gmail.com"},"_resolved":"/tmp/f34b59b41129b61d6be140fbe19d9ab5/agenticprimitives-key-authorization-0.0.0-alpha.4.tgz","_integrity":"sha512-3e1vgsgUPbSHocLHF0NNbYC2L8nDG8+sd7NdMgnoTclQPYHG1G/ISR4MBmbcqZTfgWAwlZcp983d/GSO4C/uMQ==","repository":{"url":"git+https://github.com/agentictrustlabs/agenticprimitives.git","type":"git","directory":"packages/key-authorization"},"_npmVersion":"11.16.0","description":"Policy-bound one-time key release (spec 277 §14): DecryptGrant construction + KAS verification + one-time replay store. Authority stays delegation/entitlement/policy; key-custody does the DEK unwrap.","directories":{},"_nodeVersion":"24.12.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^4.1.8"},"_npmOperationalInternal":{"tmp":"tmp/key-authorization_0.0.0-alpha.4_1784044306378_0.7196931182034838","host":"s3://npm-registry-packages-npm-production"}},"0.0.0-alpha.5":{"name":"@agenticprimitives/key-authorization","version":"0.0.0-alpha.5","keywords":["agentic","primitives","key-authorization","decrypt-grant","kas","vault"],"license":"MIT","_id":"@agenticprimitives/key-authorization@0.0.0-alpha.5","maintainers":[{"name":"richcanvas","email":"richardpedersen3@gmail.com"}],"homepage":"https://github.com/agentictrustlabs/agenticprimitives/tree/master/packages/key-authorization","bugs":{"url":"https://github.com/agentictrustlabs/agenticprimitives/issues"},"dist":{"shasum":"a1f89ec1323aa000ad5bfac0a9316626924ff4e3","tarball":"https://registry.npmjs.org/@agenticprimitives/key-authorization/-/key-authorization-0.0.0-alpha.5.tgz","fileCount":20,"integrity":"sha512-+f232VfjgS6dJEEaWcuZiQKu3sv/1z+HYUJtAFNeF/Tw292ZUVM/ziu1IsHL8Az9X6j6k0PEXSmwvMsyvWHKlQ==","signatures":[{"sig":"MEUCIQDLc302XJNy/5veYVRdfSzXOWvlJ5A/yogft7jPDNh6mwIgQnB80DLZDFO4cfeZxoDbX0jYwLhrwFtWKRQel4X80z4=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":55407},"main":"./dist/index.js","type":"module","_from":"file:agenticprimitives-key-authorization-0.0.0-alpha.5.tgz","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"scripts":{"test":"vitest run","build":"tsc -p tsconfig.build.json","clean":"rm -rf dist","test:unit":"vitest run test/unit --passWithNoTests","typecheck":"tsc -p tsconfig.json --noEmit","test:watch":"vitest"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:7a195b31-2819-49a6-962f-82b568fafd3c"}},"_resolved":"/tmp/6e494d722548420c288d7b6ea1007f14/agenticprimitives-key-authorization-0.0.0-alpha.5.tgz","_integrity":"sha512-+f232VfjgS6dJEEaWcuZiQKu3sv/1z+HYUJtAFNeF/Tw292ZUVM/ziu1IsHL8Az9X6j6k0PEXSmwvMsyvWHKlQ==","repository":{"url":"git+https://github.com/agentictrustlabs/agenticprimitives.git","type":"git","directory":"packages/key-authorization"},"_npmVersion":"11.16.0","description":"Policy-bound one-time key release (spec 277 §14): DecryptGrant construction + KAS verification + one-time replay store. Authority stays delegation/entitlement/policy; key-custody does the DEK unwrap.","directories":{},"_nodeVersion":"24.18.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^4.1.8","@agenticprimitives/types":"1.0.0-alpha.21"},"peerDependencies":{"@agenticprimitives/types":"1.0.0-alpha.21"},"_npmOperationalInternal":{"tmp":"tmp/key-authorization_0.0.0-alpha.5_1785727520643_0.3979733251446962","host":"s3://npm-registry-packages-npm-production"}},"0.0.0-alpha.6":{"name":"@agenticprimitives/key-authorization","version":"0.0.0-alpha.6","keywords":["agentic","primitives","key-authorization","decrypt-grant","kas","vault"],"license":"MIT","_id":"@agenticprimitives/key-authorization@0.0.0-alpha.6","maintainers":[{"name":"richcanvas","email":"richardpedersen3@gmail.com"}],"homepage":"https://github.com/agentictrustlabs/agenticprimitives/tree/master/packages/key-authorization","bugs":{"url":"https://github.com/agentictrustlabs/agenticprimitives/issues"},"dist":{"shasum":"f93ca445d1b579380370888f7af15d24b53b20a4","tarball":"https://registry.npmjs.org/@agenticprimitives/key-authorization/-/key-authorization-0.0.0-alpha.6.tgz","fileCount":20,"integrity":"sha512-zpLM4OGH6BGENxDCx2n3sXA87iz4wOh1N+HFedfcC5X7BnhO/VXVrTYhrZaeXeZrL4/LzqcjNwu6DBt2icQjAg==","signatures":[{"sig":"MEUCIB/QKPuutPArYtsd6c4QAsSKEwp/EP9kRpS9+nzHUqDnAiEA6hysSJEgGw67kmQC4Rx9hGlY0B4rcB69z19ckh8OAoA=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":55407},"main":"./dist/index.js","type":"module","_from":"file:agenticprimitives-key-authorization-0.0.0-alpha.6.tgz","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"scripts":{"test":"vitest run","build":"tsc -p tsconfig.build.json","clean":"rm -rf dist","test:unit":"vitest run test/unit --passWithNoTests","typecheck":"tsc -p tsconfig.json --noEmit","test:watch":"vitest"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:7a195b31-2819-49a6-962f-82b568fafd3c"}},"_resolved":"/tmp/acdd8289f6133d7bf04a694e020a3d6b/agenticprimitives-key-authorization-0.0.0-alpha.6.tgz","_integrity":"sha512-zpLM4OGH6BGENxDCx2n3sXA87iz4wOh1N+HFedfcC5X7BnhO/VXVrTYhrZaeXeZrL4/LzqcjNwu6DBt2icQjAg==","repository":{"url":"git+https://github.com/agentictrustlabs/agenticprimitives.git","type":"git","directory":"packages/key-authorization"},"_npmVersion":"11.17.0","description":"Policy-bound one-time key release (spec 277 §14): DecryptGrant construction + KAS verification + one-time replay store. Authority stays delegation/entitlement/policy; key-custody does the DEK unwrap.","directories":{},"_nodeVersion":"24.19.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^4.1.8","@agenticprimitives/types":"1.0.0-alpha.22"},"peerDependencies":{"@agenticprimitives/types":"1.0.0-alpha.22"},"_npmOperationalInternal":{"tmp":"tmp/key-authorization_0.0.0-alpha.6_1787775715150_0.6734502632390531","host":"s3://npm-registry-packages-npm-production"}},"0.0.0-alpha.7":{"name":"@agenticprimitives/key-authorization","version":"0.0.0-alpha.7","keywords":["agentic","primitives","key-authorization","decrypt-grant","kas","vault"],"license":"MIT","_id":"@agenticprimitives/key-authorization@0.0.0-alpha.7","maintainers":[{"name":"richcanvas","email":"richardpedersen3@gmail.com"}],"homepage":"https://github.com/agentictrustlabs/agenticprimitives/tree/master/packages/key-authorization","bugs":{"url":"https://github.com/agentictrustlabs/agenticprimitives/issues"},"dist":{"shasum":"4e4f7f0cc1fc311e7dbf9c0f83509d131e923e2b","tarball":"https://registry.npmjs.org/@agenticprimitives/key-authorization/-/key-authorization-0.0.0-alpha.7.tgz","fileCount":20,"integrity":"sha512-Aflc8vUaAo+Y0QDrQYVSSQ1916SjQ541ggPxglDBOPU661pR/qAyl2yMVuPntI21dtY5dqPcdbWeb7VsikaLpw==","signatures":[{"sig":"MEUCIQCnKyAwV+goQBzvoy4mp2e1/5PEc4klZX59dH2MfA4UIwIgPjc6JQumAtMT/rNNfDU9W6SVQknkgYU6dxhylkxKbrE=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":55407},"main":"./dist/index.js","type":"module","_from":"file:agenticprimitives-key-authorization-0.0.0-alpha.7.tgz","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"scripts":{"test":"vitest run","build":"tsc -p tsconfig.build.json","clean":"rm -rf dist","test:unit":"vitest run test/unit --passWithNoTests","typecheck":"tsc -p tsconfig.json --noEmit","test:watch":"vitest"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:7a195b31-2819-49a6-962f-82b568fafd3c"}},"_resolved":"/tmp/cce16eb8c0e7f1bd5b0e533ab11b147d/agenticprimitives-key-authorization-0.0.0-alpha.7.tgz","_integrity":"sha512-Aflc8vUaAo+Y0QDrQYVSSQ1916SjQ541ggPxglDBOPU661pR/qAyl2yMVuPntI21dtY5dqPcdbWeb7VsikaLpw==","repository":{"url":"git+https://github.com/agentictrustlabs/agenticprimitives.git","type":"git","directory":"packages/key-authorization"},"_npmVersion":"11.19.0","description":"Policy-bound one-time key release (spec 277 §14): DecryptGrant construction + KAS verification + one-time replay store. Authority stays delegation/entitlement/policy; key-custody does the DEK unwrap.","directories":{},"_nodeVersion":"24.20.0","publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^4.1.8","@agenticprimitives/types":"1.0.0-alpha.23"},"peerDependencies":{"@agenticprimitives/types":"1.0.0-alpha.23"},"_npmOperationalInternal":{"tmp":"tmp/key-authorization_0.0.0-alpha.7_1789164126633_0.5951155690517393","host":"s3://npm-registry-packages-npm-production"}},"0.0.0-alpha.8":{"name":"@agenticprimitives/key-authorization","version":"0.0.0-alpha.8","description":"Policy-bound one-time key release (spec 277 §14): DecryptGrant construction + KAS verification + one-time replay store. Authority stays delegation/entitlement/policy; key-custody does the DEK unwrap.","license":"MIT","repository":{"type":"git","url":"git+https://github.com/agentictrustlabs/agenticprimitives.git","directory":"packages/key-authorization"},"homepage":"https://github.com/agentictrustlabs/agenticprimitives/tree/master/packages/key-authorization","bugs":{"url":"https://github.com/agentictrustlabs/agenticprimitives/issues"},"type":"module","main":"./dist/index.js","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"publishConfig":{"access":"public"},"devDependencies":{"vitest":"^4.1.8","@agenticprimitives/types":"1.0.0-alpha.24"},"keywords":["agentic","primitives","key-authorization","decrypt-grant","kas","vault"],"peerDependencies":{"@agenticprimitives/types":"1.0.0-alpha.24"},"scripts":{"build":"tsc -p tsconfig.build.json","typecheck":"tsc -p tsconfig.json --noEmit","test":"vitest run","test:unit":"vitest run test/unit --passWithNoTests","test:watch":"vitest","clean":"rm -rf dist"},"_id":"@agenticprimitives/key-authorization@0.0.0-alpha.8","_integrity":"sha512-tluVrJU4sYhZ0IMGwvM4z/fERQVC5VgMogEdvcxM9Zf1K269ksyxbdE+hErHcztePkCnTTREwPAOsWTX978u9w==","_resolved":"/tmp/fba51d8541e73eaf7799c090bb591146/agenticprimitives-key-authorization-0.0.0-alpha.8.tgz","_from":"file:agenticprimitives-key-authorization-0.0.0-alpha.8.tgz","_nodeVersion":"24.20.0","_npmVersion":"11.19.0","dist":{"integrity":"sha512-tluVrJU4sYhZ0IMGwvM4z/fERQVC5VgMogEdvcxM9Zf1K269ksyxbdE+hErHcztePkCnTTREwPAOsWTX978u9w==","shasum":"729f08e49912ffe2ed1135411c8d5c7eda58a668","tarball":"https://registry.npmjs.org/@agenticprimitives/key-authorization/-/key-authorization-0.0.0-alpha.8.tgz","fileCount":20,"unpackedSize":55407,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQCzZHVgE86yB3Exa7TynUfKGBdYQmfQMFYQARf2yDI13gIhAIe9RhI2q3m4R50n4b0k8cd6sd8kIB2X/N5XMqd6LVgV"}]},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:7a195b31-2819-49a6-962f-82b568fafd3c"}},"directories":{},"maintainers":[{"name":"richcanvas","email":"richardpedersen3@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/key-authorization_0.0.0-alpha.8_1789230545251_0.6513771344983845"},"_hasShrinkwrap":false}},"time":{"created":"2026-06-17T16:02:19.605Z","modified":"2026-09-12T16:29:05.500Z","0.0.0-alpha.2":"2026-06-17T16:02:20.135Z","0.0.0-alpha.3":"2026-06-19T02:59:31.871Z","0.0.0-alpha.4":"2026-07-14T15:51:46.627Z","0.0.0-alpha.5":"2026-08-03T03:25:20.810Z","0.0.0-alpha.6":"2026-08-26T20:21:55.310Z","0.0.0-alpha.7":"2026-09-11T22:02:06.797Z","0.0.0-alpha.8":"2026-09-12T16:29:05.380Z"},"bugs":{"url":"https://github.com/agentictrustlabs/agenticprimitives/issues"},"license":"MIT","homepage":"https://github.com/agentictrustlabs/agenticprimitives/tree/master/packages/key-authorization","keywords":["agentic","primitives","key-authorization","decrypt-grant","kas","vault"],"repository":{"type":"git","url":"git+https://github.com/agentictrustlabs/agenticprimitives.git","directory":"packages/key-authorization"},"description":"Policy-bound one-time key release (spec 277 §14): DecryptGrant construction + KAS verification + one-time replay store. Authority stays delegation/entitlement/policy; key-custody does the DEK unwrap.","maintainers":[{"name":"richcanvas","email":"richardpedersen3@gmail.com"}],"readme":"# @agenticprimitives/key-authorization\n\nPolicy-bound **one-time key release** (spec 277 §14). A `DecryptGrant` binds *who / which tool /\nwhich args / which vault fields / which purpose / which classification* by hash; the KAS\nindependently re-verifies it before any field is decrypted.\n\n```ts\nimport { createDecryptGrant, createLocalDevKeyAuthorizationService } from '@agenticprimitives/key-authorization';\n\nconst grant = await createDecryptGrant({\n  id: 'urn:ap:decrypt-grant:abc', issuer, audience, principal,\n  mcp: { resourceUri, serverId, toolName: 'get_pii', argsHash },\n  authorization: { delegationHash, entitlementHashes, policyHash },\n  vault: { vaultId, objectIds, resource: 'person-pii', fields: ['email'], purpose: 'support', classificationCeiling: 'pii.sensitive' },\n  constraints: { ttlSeconds: 120, notBefore, expiresAt, oneTimeUse: true },\n  replay: { jti },\n});\n\nconst kas = createLocalDevKeyAuthorizationService();\nconst decision = await kas.authorize(grant, { audience, principal, toolName: 'get_pii', argsHash, resource: 'person-pii', requestedFields: ['email'], classification: 'pii.sensitive' });\n// decision.decision === 'allow' | 'deny'; releasedFields scope the decrypt. JTI is one-time.\n```\n\nFail-closed; the one-time JTI is consumed only after every other check passes (a denied grant never\nburns its JTI). The DEK unwrap itself is `key-custody`'s job once `authorize()` returns allow —\n*custody is not authority*. Signed proofs, durable replay ledgers, and remote-KMS KAS are additive\n(see [spec 277 §14](../../specs/277-mcp-delegated-vault-authorization.md)).\n","readmeFilename":"README.md"}