@kya-os/mcp-i-cloudflare 1.11.1 → 1.12.0

package/dist/delegation-http/anchor-registration.js

@@ -0,0 +1,225 @@
+/**
+ * draft-kya-http-02 delegation layer — external anchor registration
+ * (`POST /api/v1/bouncer/sessions`).
+ *
+ * The cross-resource authorization-host surface: an external PEP in the same
+ * project (checkpoint's gateway `registration-client.ts`, the .NET
+ * `DelegationAnchorRegistrar`) provisions a pickup anchor on THIS worker for a
+ * challenge the worker didn't issue, so the §8.1 challenge that PEP emits can
+ * point `consent_uri`/`pickup_uri` at this deployment — no reverse proxy. Path
+ * and request/response shapes are the EXACT contract checkpoint's own bouncer
+ * sessions route serves (frozen by the vendored `registration.request.json` /
+ * `registration.response.json` fixtures), so pointing an existing registrar at
+ * a different base URL is the whole integration. Auth lives in
+ * `registrar-auth.ts` (the deployment's own `AGENTSHIELD_API_KEY` as Bearer).
+ *
+ * Semantics mirror checkpoint's route: idempotent first-write-wins per sid
+ * (re-registering a live sid returns 200 echoing the ORIGINAL anchor's scopes;
+ * a fresh sid returns 201). A non-`kya-` session_id maps to a deterministic
+ * `kya-` sid returned in `data.session_id` — the .NET client adopts the
+ * response sid; the gateway client already generates `kya-` sids.
+ *
+ * @module @kya-os/mcp-i-cloudflare/delegation-http/anchor-registration
+ */
+import { INTERNAL_PICKUP_CREATE, INTERNAL_PICKUP_INFO } from "./constants";
+import { isAnchorSid } from "./sid";
+import { sha256Hex } from "./hash";
+import { buildConsentUri, signChallengeProof } from "./challenge";
+import { registrarAuthorized, registrationRateLimited } from "./registrar-auth";
+import { validateRegistrationBody, } from "./anchor-registration-validate";
+/** Internal origin for durable-object stub fetches — the DO routes by pathname only. */
+const DO_INTERNAL_ORIGIN = "https://do.internal";
+/**
+ * Whether this deployment serves the anchor-registration route: the layer is ON,
+ * the ops kill switch hasn't disabled it, and the registrar bearer
+ * (`AGENTSHIELD_API_KEY`) is configured. Single source of truth for the route
+ * gate AND the well-known capability advertisement.
+ */
+export function isAnchorRegistrationEnabled(cfg, env) {
+    return (cfg !== null &&
+        cfg.remoteAnchorRegistration &&
+        typeof env.AGENTSHIELD_API_KEY === "string" &&
+        env.AGENTSHIELD_API_KEY.length > 0);
+}
+/**
+ * Map a registrar-chosen session_id to the worker's anchor-sid namespace. A
+ * conforming `kya-` sid (what the gateway and this package both generate) is
+ * used verbatim; anything else derives a deterministic `kya-` sid so repeated
+ * registrations of the same session still reuse one anchor. The response's
+ * `data.session_id` carries the result — the authoritative sid for callers.
+ */
+export function deriveRegistrationSid(sessionId) {
+    if (isAnchorSid(sessionId))
+        return sessionId;
+    return `kya-${sha256Hex(sessionId).slice(0, 32)}`;
+}
+/** JSON error envelope matching checkpoint's `{ success: false, error: {…} }`. */
+function errorResponse(status, code, message, details) {
+    return new Response(JSON.stringify({
+        success: false,
+        error: { code, message, ...(details ? { details } : {}) },
+    }), {
+        status,
+        headers: {
+            "Content-Type": "application/json",
+            "Cache-Control": "no-store",
+        },
+    });
+}
+/** POST a JSON body to one of the anchor's `/_internal/pickup/*` routes. */
+async function callAnchor(env, deps, sid, internalPath, body) {
+    const stub = deps.getAnchorStub(env, sid);
+    const response = await stub.fetch(new URL(internalPath, DO_INTERNAL_ORIGIN).toString(), {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+    });
+    return response;
+}
+/**
+ * Ensure a live anchor exists for `sid`, first-write-wins: a live anchor is
+ * reused as-is (its stored scopes are authoritative, mirroring checkpoint's
+ * COALESCE-on-conflict); otherwise create one from this registration, honoring
+ * a `challenge_pin` ONLY when unverified keyid holders are enabled — a pinned
+ * keyid the pickup surface would reject (W2) must not brick the anchor.
+ *
+ * Fresh-vs-existing (`isNew`) comes from the create response's `reused`
+ * discriminator, NOT a separate look-then-create: the DO input gate serializes
+ * creates, so two racing registrations get exactly one fresh and one reused —
+ * one 201 and one 200, checkpoint status parity under concurrency. The
+ * follow-up INFO read makes the echoed values the STORED ones in either case.
+ */
+async function ensureAnchor(env, cfg, deps, sid, challenge, session) {
+    const pin = challenge.challengePin && cfg.allowUnverifiedKeyidHolders
+        ? { type: "keyid", valueSha256: sha256Hex(challenge.challengePin) }
+        : undefined;
+    const created = await callAnchor(env, deps, sid, INTERNAL_PICKUP_CREATE, {
+        sid,
+        requiredScopes: challenge.requiredScopes,
+        pollIntervalS: cfg.pollIntervalS,
+        anchorTtlS: cfg.anchorTtlS,
+        delegationExpiresInS: cfg.delegationExpiresInS,
+        agentDid: challenge.detectedAgentDid ?? session.agentDid,
+        // Cross-resource claim inputs (drive the minted VC's aud / server_did —
+        // see consent-anchor-bridge's withCrossResourceClaims).
+        ...(challenge.audience ? { audience: challenge.audience } : {}),
+        ...(session.serverDid ? { serverDid: session.serverDid } : {}),
+        ...(pin ? { pin } : {}),
+    });
+    if (created.status !== 201) {
+        return {
+            error: errorResponse(502, "anchor_unavailable", "The anchor store did not accept the registration"),
+        };
+    }
+    let reused = false;
+    try {
+        reused =
+            (await created.json()).reused === true;
+    }
+    catch {
+        // A missing/malformed create body reads as fresh — status already proved
+        // the anchor exists, and 201-for-fresh is the safe default.
+    }
+    const readBack = await callAnchor(env, deps, sid, INTERNAL_PICKUP_INFO, {
+        sid,
+    });
+    if (readBack.status !== 200) {
+        return {
+            error: errorResponse(502, "anchor_unavailable", "The registered anchor could not be read back"),
+        };
+    }
+    return {
+        isNew: !reused,
+        snapshot: (await readBack.json()),
+    };
+}
+/**
+ * Handle `POST /api/v1/bouncer/sessions`. The route gate
+ * (`isAnchorRegistrationEnabled` + layer flag) lives in `register.ts`; by the
+ * time this runs the layer is ON and a registrar bearer is configured.
+ */
+export async function handleAnchorRegistration(c, env, cfg, deps) {
+    // AuthN first, reading only the header — never the body (checkpoint parity).
+    if (!registrarAuthorized(env, c.req.header("Authorization"))) {
+        return errorResponse(401, "unauthorized", "Invalid or missing API key");
+    }
+    if (registrationRateLimited(Date.now())) {
+        return errorResponse(429, "rate_limited", "Too many anchor registrations; retry shortly");
+    }
+    let raw;
+    try {
+        raw = await c.req.raw.clone().json();
+    }
+    catch {
+        return errorResponse(400, "invalid_request", "Invalid request body", [
+            { path: "", message: "body must be JSON" },
+        ]);
+    }
+    const validated = validateRegistrationBody(raw);
+    if (!validated.ok) {
+        return errorResponse(400, "invalid_request", "Invalid request body", validated.issues);
+    }
+    // This surface exists ONLY to anchor challenges (mirrors checkpoint's
+    // gateway-service branch): a non-challenge session registration belongs to
+    // checkpoint's own route, which owns the sessions table this worker lacks.
+    const { challenge } = validated.input;
+    if (!challenge) {
+        return errorResponse(401, "unauthorized", "This endpoint only accepts challenge registration");
+    }
+    const sid = deriveRegistrationSid(validated.input.sessionId);
+    const anchor = await ensureAnchor(env, cfg, deps, sid, challenge, {
+        agentDid: validated.input.agentDid,
+        serverDid: validated.input.serverDid,
+    });
+    if ("error" in anchor)
+        return anchor.error;
+    // W4: pin the advertised host to the configured realm when set, so a
+    // Host-header-reflecting request cannot mint consent/pickup URIs (and a
+    // signed proof over them) pointing at an attacker host.
+    const host = cfg.realm || new URL(c.req.url).host;
+    const verdict = {
+        requiredScopes: anchor.snapshot.requiredScopes,
+        authorizationHost: host,
+        realm: host,
+        sid,
+        pollIntervalS: cfg.pollIntervalS,
+    };
+    const consentUri = buildConsentUri(verdict);
+    let challengeProof;
+    try {
+        challengeProof = await signChallengeProof(await deps.proofGenerator(), {
+            sid,
+            consent_uri: consentUri,
+            required_scopes: anchor.snapshot.requiredScopes,
+        });
+    }
+    catch (error) {
+        // The anchor persisted but is unreachable without a proof-bearing response;
+        // it expires via its ≤600s TTL (same orphan rationale as the challenge
+        // emitter's signing-failure path).
+        console.warn(`[kya-http] registration challenge_proof signing failed (sid=${sid}):`, error instanceof Error ? error.message : String(error));
+        return errorResponse(502, "proof_unavailable", "The challenge proof could not be signed");
+    }
+    return new Response(JSON.stringify({
+        success: true,
+        data: {
+            session_id: sid,
+            registered: true,
+            created_at: new Date(validated.input.createdAt).toISOString(),
+            challenge: {
+                consent_uri: consentUri,
+                challenge_proof: challengeProof,
+                required_scopes: anchor.snapshot.requiredScopes,
+                issued_at: Date.now(),
+            },
+        },
+    }), {
+        status: anchor.isNew ? 201 : 200,
+        headers: {
+            "Content-Type": "application/json",
+            // Checkpoint's route parity (its success responses are private/no-cache).
+            "Cache-Control": "private, no-cache",
+        },
+    });
+}
+//# sourceMappingURL=anchor-registration.js.map

package/dist/delegation-http/anchor-registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchor-registration.js","sourceRoot":"","sources":["../../src/delegation-http/anchor-registration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EACL,wBAAwB,GAGzB,MAAM,gCAAgC,CAAC;AA6BxC,wFAAwF;AACxF,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,GAAyC,EACzC,GAAkB;IAElB,OAAO,CACL,GAAG,KAAK,IAAI;QACZ,GAAG,CAAC,wBAAwB;QAC5B,OAAO,GAAG,CAAC,mBAAmB,KAAK,QAAQ;QAC3C,GAAG,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CACnC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,IAAI,WAAW,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,kFAAkF;AAClF,SAAS,aAAa,CACpB,MAAc,EACd,IAAY,EACZ,OAAe,EACf,OAA2B;IAE3B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KAC1D,CAAC,EACF;QACE,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;SAC5B;KACF,CACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,UAAU,CACvB,GAAkB,EAClB,IAAsB,EACtB,GAAW,EACX,YAAoB,EACpB,IAAa;IAEb,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,IAAI,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,EACpD;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CACF,CAAC;IACF,OAAO,QAA0C,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,YAAY,CACzB,GAAkB,EAClB,GAAkC,EAClC,IAAsB,EACtB,GAAW,EACX,SAAgC,EAChC,OAAiD;IAEjD,MAAM,GAAG,GACP,SAAS,CAAC,YAAY,IAAI,GAAG,CAAC,2BAA2B;QACvD,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE;QACnE,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,sBAAsB,EAAE;QACvE,GAAG;QACH,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;QAC9C,QAAQ,EAAE,SAAS,CAAC,gBAAgB,IAAI,OAAO,CAAC,QAAQ;QACxD,wEAAwE;QACxE,wDAAwD;QACxD,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxB,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC3B,OAAO;YACL,KAAK,EAAE,aAAa,CAClB,GAAG,EACH,oBAAoB,EACpB,kDAAkD,CACnD;SACF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM;YACH,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA0B,CAAC,MAAM,KAAK,IAAI,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,4DAA4D;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,oBAAoB,EAAE;QACtE,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO;YACL,KAAK,EAAE,aAAa,CAClB,GAAG,EACH,oBAAoB,EACpB,8CAA8C,CAC/C;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,CAAC,MAAM;QACd,QAAQ,EAAE,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmB;KACpD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,CAA6B,EAC7B,GAAkB,EAClB,GAAkC,EAClC,IAAsB;IAEtB,6EAA6E;IAC7E,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QAC7D,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,4BAA4B,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACxC,OAAO,aAAa,CAClB,GAAG,EACH,cAAc,EACd,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IAED,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC,GAAG,EAAE,iBAAiB,EAAE,sBAAsB,EAAE;YACnE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,aAAa,CAClB,GAAG,EACH,iBAAiB,EACjB,sBAAsB,EACtB,SAAS,CAAC,MAAM,CACjB,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC;IACtC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,aAAa,CAClB,GAAG,EACH,cAAc,EACd,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE;QAChE,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ;QAClC,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,SAAS;KACrC,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IAE3C,qEAAqE;IACrE,wEAAwE;IACxE,wDAAwD;IACxD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAClD,MAAM,OAAO,GAA0B;QACrC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc;QAC9C,iBAAiB,EAAE,IAAI;QACvB,KAAK,EAAE,IAAI;QACX,GAAG;QACH,aAAa,EAAE,GAAG,CAAC,aAAa;KACjC,CAAC;IACF,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAE5C,IAAI,cAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,kBAAkB,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,EAAE;YACrE,GAAG;YACH,WAAW,EAAE,UAAU;YACvB,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc;SAChD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4EAA4E;QAC5E,uEAAuE;QACvE,mCAAmC;QACnC,OAAO,CAAC,IAAI,CACV,+DAA+D,GAAG,IAAI,EACtE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACF,OAAO,aAAa,CAClB,GAAG,EACH,mBAAmB,EACnB,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,IAAI;QACb,IAAI,EAAE;YACJ,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YAC7D,SAAS,EAAE;gBACT,WAAW,EAAE,UAAU;gBACvB,eAAe,EAAE,cAAc;gBAC/B,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc;gBAC/C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB;SACF;KACF,CAAC,EACF;QACE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;QAChC,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,0EAA0E;YAC1E,eAAe,EAAE,mBAAmB;SACrC;KACF,CACF,CAAC;AACJ,CAAC"}

package/dist/delegation-http/consent-anchor-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consent-anchor-bridge.d.ts","sourceRoot":"","sources":["../../src/delegation-http/consent-anchor-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAWH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAyXrD;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,CAAC,EAAE,WAAW,EACd,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GAClC,OAAO,CAAC,QAAQ,CAAC,CAiBnB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,CAAC,EAAE,WAAW,EACd,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GACjC,OAAO,CAAC,QAAQ,CAAC,CAyEnB"}
+{"version":3,"file":"consent-anchor-bridge.d.ts","sourceRoot":"","sources":["../../src/delegation-http/consent-anchor-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAWH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAyarD;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,CAAC,EAAE,WAAW,EACd,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GAClC,OAAO,CAAC,QAAQ,CAAC,CAiBnB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,CAAC,EAAE,WAAW,EACd,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GACjC,OAAO,CAAC,QAAQ,CAAC,CAyEnB"}

package/dist/delegation-http/consent-anchor-bridge.js

@@ -216,6 +216,37 @@ function isTestConsentMode(env) {
     return environment === "development";
 }
 // ── VC-JWT minting (same primitive chain as consent.service.issueDelegationVC) ──
+/**
+ * draft-kya-http-02 §4.3 claims for a CROSS-RESOURCE delegation. An anchor
+ * registered by an external PEP carries the resource org's DID; the minted
+ * VC-JWT must then present exactly what checkpoint's claim gate
+ * (`delegation-claims.ts` `checkDelegationClaims`) pins:
+ *  - `aud` === the resource org's DID (`kyaos/audience-mismatch` otherwise) —
+ *    the ORG, not the resource URL: scope remains the per-resource boundary,
+ *    and per-resource audience would require rewriting the verifier's
+ *    audience/trust model;
+ *  - `sid` — the anchor sid, required non-empty (`kyaos/session-mismatch`);
+ *  - `server_did` — the challenged resource's DID, attribution only (nothing
+ *    verifies it today; it gives audit trails a per-resource record and a
+ *    re-mint-free path to tighten audience later).
+ *
+ * A SELF-ISSUED anchor has no `audience`, so this returns the unsigned parts'
+ * original `signingInput` untouched — the self-gating VC-JWT stays
+ * byte-identical (the regression guard). `encodedHeader` is reused verbatim so
+ * the only re-encoded segment is the payload actually being extended (via this
+ * module's own base64url helper — the CSRF token codec below).
+ */
+function withCrossResourceClaims(unsigned, info, sid) {
+    if (!info.audience)
+        return unsigned.signingInput;
+    const payload = {
+        ...unsigned.payload,
+        aud: info.audience,
+        sid,
+        ...(info.serverDid ? { server_did: info.serverDid } : {}),
+    };
+    return `${unsigned.encodedHeader}.${base64UrlEncodeString(JSON.stringify(payload))}`;
+}
 /**
  * Mint a delegation VC-JWT for an approved anchor, wrap it as a VC, and sign it —
  * the primitive chain `consent.service.ts` uses, called here directly (the service
@@ -247,12 +278,14 @@ async function mintDelegationVcJwt(env, sid, info, expiresInS) {
         keyId = `${issuerDid}#${didKeyFragment(issuerDid)}`;
         signingPrivateKey = rawKeyPair.privateKey;
     }
-    // Subject (the agent the delegation is granted to). The anchor does not carry the
-    // agent DID, so fall back to the worker's configured agent DID when present (this
-    // is now the same value as the issuer when an identity is configured, and an
-    // independent ephemeral holder DID when it isn't — both were already true of the
-    // subject's own fallback before this change).
-    const agentDid = env.MCP_IDENTITY_AGENT_DID || issuerDid;
+    // Subject (the agent the delegation is granted to). An externally-registered
+    // anchor carries the registering PEP's agent DID (verified `detected_agent_did`
+    // when present, else the session `agent_did` — possibly the anonymous-principal
+    // sentinel); a self-issued anchor does not, so fall back to the worker's
+    // configured agent DID when present (the same value as the issuer when an
+    // identity is configured, and an independent ephemeral holder DID when it
+    // isn't — both were already true of the subject's own fallback before this).
+    const agentDid = info.agentDid || env.MCP_IDENTITY_AGENT_DID || issuerDid;
     const nowS = Math.floor(Date.now() / 1000);
     const delegation = {
         id: `urn:uuid:${sid}`,
@@ -273,7 +306,10 @@ async function mintDelegationVcJwt(env, sid, info, expiresInS) {
         issuanceDate: new Date().toISOString(),
     });
     const vcWithIssuer = { ...unsignedVC, issuer: issuerDid };
-    const { signingInput } = createUnsignedVCJWT(vcWithIssuer, { keyId });
+    const unsigned = createUnsignedVCJWT(vcWithIssuer, { keyId });
+    // Cross-resource anchors extend the payload (aud/sid/server_did) BEFORE
+    // signing; self-issued anchors sign the original input, byte-identical.
+    const signingInput = withCrossResourceClaims(unsigned, info, sid);
     const signatureBytes = await cryptoProvider.sign(new TextEncoder().encode(signingInput), signingPrivateKey);
     const signature = base64urlEncodeFromBytes(signatureBytes);
     return completeVCJWT(signingInput, signature);

package/dist/delegation-http/consent-anchor-bridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"consent-anchor-bridge.js","sourceRoot":"","sources":["../../src/delegation-http/consent-anchor-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,wBAAwB,EACxB,cAAc,GAEf,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,2CAA2C,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE5E,wFAAwF;AACxF,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAqBjD;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,GAAkB,EAClB,GAAW,EACX,YAAoB,EACpB,IAAa;IAEb,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,IAAI,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,EACpD;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CACF,CAAC;IACF,OAAO,QAA0C,CAAC;AACpD,CAAC;AAED,oEAAoE;AACpE,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,IAAI,CAAC,KAAa,EAAE,SAAiB;IAC5C,OAAO;;;;;SAKA,UAAU,CAAC,KAAK,CAAC;;;EAGxB,SAAS;;QAEH,CAAC;AACT,CAAC;AAED,sDAAsD;AACtD,SAAS,WAAW;IAClB,OAAO,YAAY,CACjB,IAAI,CACF,4BAA4B,EAC5B;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,0CAA0C;AAC1C,SAAS,YAAY;IACnB,OAAO,YAAY,CACjB,IAAI,CACF,iCAAiC,EACjC;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,kBAAkB,CAAC,OAAe,EAAE,MAAM,GAAG,GAAG;IACvD,OAAO,YAAY,CACjB,IAAI,CACF,sBAAsB,EACtB;;KAED,UAAU,CAAC,OAAO,CAAC;QAChB,CACH,EACD,MAAM,CACP,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,SAAS,WAAW;IAClB,OAAO,YAAY,CACjB,IAAI,CACF,wBAAwB,EACxB;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,GAAW,EACX,IAAgB,EAChB,SAAiB;IAEjB,MAAM,UAAU,GACd,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QAC5B,CAAC,CAAC,IAAI,CAAC,cAAc;aAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;aAC9D,IAAI,CAAC,EAAE,CAAC;QACb,CAAC,CAAC,mEAAmE,CAAC;IAE1E,OAAO,IAAI,CACT,oBAAoB,EACpB;;;mCAG+B,UAAU;mDACM,kBAAkB,CAAC,GAAG,CAAC;yCACjC,UAAU,CAAC,GAAG,CAAC;gDACR,UAAU,CAAC,SAAS,CAAC;;;QAG7D,CACL,CAAC;AACJ,CAAC;AAED,oFAAoF;AAEpF,8CAA8C;AAC9C,SAAS,oBAAoB,CAAC,KAAiB;IAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACvC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,uDAAuD;AACvD,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,oBAAoB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,wFAAwF;AACxF,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,QAAQ,MAAM,EAAE,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,0EAA0E;AAC1E,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,GAAW;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;IAChD,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,oBAAoB,CAClC,IAAI,UAAU,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAC1D,CAAC;IACF,OAAO,GAAG,OAAO,IAAI,UAAU,EAAE,CAAC;AACpC,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,iBAAiB,CAC9B,GAAkB,EAClB,GAAW,EACX,KAAyB;IAEzB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,gFAAgF;QAChF,gFAAgF;QAChF,gFAAgF;QAChF,uEAAuE;QACvE,8EAA8E;QAC9E,OAAO,CAAC,IAAI,CACV,oFAAoF,GAAG,GAAG,CAC3F,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAG3D,CAAC;QACF,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACtC,IACE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC3C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,WAAW,GAAG,oBAAoB,CACtC,IAAI,UAAU,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAC1D,CAAC;QACF,OAAO,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAkB;IAC3C,+EAA+E;IAC/E,oFAAoF;IACpF,MAAM,GAAG,GAAG,GAAyC,CAAC;IACtD,IAAI,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC3D,oFAAoF;IACpF,oDAAoD;IACpD,MAAM,WAAW,GAAG,MAAM,CACxB,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CACtC,CAAC,WAAW,EAAE,CAAC;IAChB,OAAO,WAAW,KAAK,aAAa,CAAC;AACvC,CAAC;AAED,mFAAmF;AAEnF;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,mBAAmB,CAChC,GAAkB,EAClB,GAAW,EACX,IAAgB,EAChB,UAAkB;IAElB,MAAM,cAAc,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAC/C,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAEtD,IAAI,SAAiB,CAAC;IACtB,IAAI,KAAa,CAAC;IAClB,IAAI,iBAAyB,CAAC;IAC9B,IAAI,kBAAkB,EAAE,CAAC;QACvB,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC;QACnC,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC;QAC/B,iBAAiB,GAAG,kBAAkB,CAAC,UAAU,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,eAAe,EAAE,CAAC;QAC1D,SAAS,GAAG,wBAAwB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3D,KAAK,GAAG,GAAG,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC;IAC5C,CAAC;IAED,kFAAkF;IAClF,kFAAkF;IAClF,6EAA6E;IAC7E,iFAAiF;IACjF,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,GAAG,CAAC,sBAAsB,IAAI,SAAS,CAAC;IAEzD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAqB;QACnC,EAAE,EAAE,YAAY,GAAG,EAAE;QACrB,SAAS;QACT,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,YAAY,GAAG,EAAE;QACvB,WAAW,EAAE;YACX,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,IAAI,GAAG,UAAU;SAC5B;QACD,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,EAAE;QAChD,EAAE,EAAE,YAAY,GAAG,EAAE;QACrB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACvC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAE1D,MAAM,EAAE,YAAY,EAAE,GAAG,mBAAmB,CAC1C,YAAuC,EACvC,EAAE,KAAK,EAAE,CACV,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,IAAI,CAC9C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,iBAAiB,CAClB,CAAC;IACF,MAAM,SAAS,GAAG,wBAAwB,CAAC,cAAc,CAAC,CAAC;IAE3D,OAAO,aAAa,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,CAAc,EACd,GAAW,EACX,GAAkB,EAClB,IAAmC;IAEnC,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE;QACpE,GAAG;KACJ,CAAC,CAAC;IAEH,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,EAAE,CAAC;IACtD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,kBAAkB,CACvB,oEAAoE,EACpE,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAe,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,YAAY,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,CAAc,EACd,GAAW,EACX,GAAkB,EAClB,GAAkC;IAElC,yDAAyD;IACzD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,YAAY,CACjB,IAAI,CACF,sBAAsB,EACtB,6IAA6I,CAC9I,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE;QACpE,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAChC,OAAO,kBAAkB,CACvB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,kBAAkB,CACvB,oEAAoE,EACpE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAe,CAAC;IAEvD,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iFAAiF;QACjF,iFAAiF;QACjF,kDAAkD;QAClD,OAAO,CAAC,IAAI,CACV,0CAA0C,GAAG,IAAI,EACjD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACF,OAAO,kBAAkB,CACvB,6DAA6D,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,EAAE;QAC1E,GAAG;QACH,KAAK;QACL,UAAU,EAAE,GAAG,CAAC,oBAAoB;KACrC,CAAC,CAAC;IAEH,iFAAiF;IACjF,2EAA2E;IAC3E,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACnC,OAAO,kBAAkB,CACvB,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IAC1D,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;QACxB,OAAO,kBAAkB,CACvB,6DAA6D,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAClC,CAAc;IAEd,MAAM,GAAG,GAAI,CAA4C,CAAC,GAAG,EAAE,GAAG,CAAC;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAA4B,CAAC;YACnE,MAAM,KAAK,GAAG,IAAI,EAAE,UAAU,CAAC;YAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACvD,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"consent-anchor-bridge.js","sourceRoot":"","sources":["../../src/delegation-http/consent-anchor-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,wBAAwB,EACxB,cAAc,GAEf,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,2CAA2C,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE5E,wFAAwF;AACxF,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AA2BjD;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,GAAkB,EAClB,GAAW,EACX,YAAoB,EACpB,IAAa;IAEb,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,IAAI,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,EACpD;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CACF,CAAC;IACF,OAAO,QAA0C,CAAC;AACpD,CAAC;AAED,oEAAoE;AACpE,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,IAAI,CAAC,KAAa,EAAE,SAAiB;IAC5C,OAAO;;;;;SAKA,UAAU,CAAC,KAAK,CAAC;;;EAGxB,SAAS;;QAEH,CAAC;AACT,CAAC;AAED,sDAAsD;AACtD,SAAS,WAAW;IAClB,OAAO,YAAY,CACjB,IAAI,CACF,4BAA4B,EAC5B;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,0CAA0C;AAC1C,SAAS,YAAY;IACnB,OAAO,YAAY,CACjB,IAAI,CACF,iCAAiC,EACjC;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,kBAAkB,CAAC,OAAe,EAAE,MAAM,GAAG,GAAG;IACvD,OAAO,YAAY,CACjB,IAAI,CACF,sBAAsB,EACtB;;KAED,UAAU,CAAC,OAAO,CAAC;QAChB,CACH,EACD,MAAM,CACP,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,SAAS,WAAW;IAClB,OAAO,YAAY,CACjB,IAAI,CACF,wBAAwB,EACxB;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,GAAW,EACX,IAAgB,EAChB,SAAiB;IAEjB,MAAM,UAAU,GACd,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QAC5B,CAAC,CAAC,IAAI,CAAC,cAAc;aAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;aAC9D,IAAI,CAAC,EAAE,CAAC;QACb,CAAC,CAAC,mEAAmE,CAAC;IAE1E,OAAO,IAAI,CACT,oBAAoB,EACpB;;;mCAG+B,UAAU;mDACM,kBAAkB,CAAC,GAAG,CAAC;yCACjC,UAAU,CAAC,GAAG,CAAC;gDACR,UAAU,CAAC,SAAS,CAAC;;;QAG7D,CACL,CAAC;AACJ,CAAC;AAED,oFAAoF;AAEpF,8CAA8C;AAC9C,SAAS,oBAAoB,CAAC,KAAiB;IAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACvC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,uDAAuD;AACvD,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,oBAAoB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,wFAAwF;AACxF,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,QAAQ,MAAM,EAAE,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,0EAA0E;AAC1E,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,GAAW;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;IAChD,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,oBAAoB,CAClC,IAAI,UAAU,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAC1D,CAAC;IACF,OAAO,GAAG,OAAO,IAAI,UAAU,EAAE,CAAC;AACpC,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,iBAAiB,CAC9B,GAAkB,EAClB,GAAW,EACX,KAAyB;IAEzB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,gFAAgF;QAChF,gFAAgF;QAChF,gFAAgF;QAChF,uEAAuE;QACvE,8EAA8E;QAC9E,OAAO,CAAC,IAAI,CACV,oFAAoF,GAAG,GAAG,CAC3F,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAG3D,CAAC;QACF,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACtC,IACE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC3C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,WAAW,GAAG,oBAAoB,CACtC,IAAI,UAAU,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAC1D,CAAC;QACF,OAAO,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAkB;IAC3C,+EAA+E;IAC/E,oFAAoF;IACpF,MAAM,GAAG,GAAG,GAAyC,CAAC;IACtD,IAAI,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC3D,oFAAoF;IACpF,oDAAoD;IACpD,MAAM,WAAW,GAAG,MAAM,CACxB,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CACtC,CAAC,WAAW,EAAE,CAAC;IAChB,OAAO,WAAW,KAAK,aAAa,CAAC;AACvC,CAAC;AAED,mFAAmF;AAEnF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,uBAAuB,CAC9B,QAAgD,EAChD,IAAgB,EAChB,GAAW;IAEX,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC,YAAY,CAAC;IACjD,MAAM,OAAO,GAA4B;QACvC,GAAG,QAAQ,CAAC,OAAO;QACnB,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,GAAG;QACH,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,OAAO,GAAG,QAAQ,CAAC,aAAa,IAAI,qBAAqB,CACvD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,EAAE,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,mBAAmB,CAChC,GAAkB,EAClB,GAAW,EACX,IAAgB,EAChB,UAAkB;IAElB,MAAM,cAAc,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAC/C,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAEtD,IAAI,SAAiB,CAAC;IACtB,IAAI,KAAa,CAAC;IAClB,IAAI,iBAAyB,CAAC;IAC9B,IAAI,kBAAkB,EAAE,CAAC;QACvB,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC;QACnC,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC;QAC/B,iBAAiB,GAAG,kBAAkB,CAAC,UAAU,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,eAAe,EAAE,CAAC;QAC1D,SAAS,GAAG,wBAAwB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3D,KAAK,GAAG,GAAG,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC;IAC5C,CAAC;IAED,6EAA6E;IAC7E,gFAAgF;IAChF,gFAAgF;IAChF,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,sBAAsB,IAAI,SAAS,CAAC;IAE1E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAqB;QACnC,EAAE,EAAE,YAAY,GAAG,EAAE;QACrB,SAAS;QACT,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,YAAY,GAAG,EAAE;QACvB,WAAW,EAAE;YACX,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,IAAI,GAAG,UAAU;SAC5B;QACD,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,EAAE;QAChD,EAAE,EAAE,YAAY,GAAG,EAAE;QACrB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACvC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAE1D,MAAM,QAAQ,GAAG,mBAAmB,CAClC,YAAuC,EACvC,EAAE,KAAK,EAAE,CACV,CAAC;IACF,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,YAAY,GAAG,uBAAuB,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,IAAI,CAC9C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,iBAAiB,CAClB,CAAC;IACF,MAAM,SAAS,GAAG,wBAAwB,CAAC,cAAc,CAAC,CAAC;IAE3D,OAAO,aAAa,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,CAAc,EACd,GAAW,EACX,GAAkB,EAClB,IAAmC;IAEnC,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE;QACpE,GAAG;KACJ,CAAC,CAAC;IAEH,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,EAAE,CAAC;IACtD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,kBAAkB,CACvB,oEAAoE,EACpE,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAe,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,YAAY,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,CAAc,EACd,GAAW,EACX,GAAkB,EAClB,GAAkC;IAElC,yDAAyD;IACzD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,YAAY,CACjB,IAAI,CACF,sBAAsB,EACtB,6IAA6I,CAC9I,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE;QACpE,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAChC,OAAO,kBAAkB,CACvB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,kBAAkB,CACvB,oEAAoE,EACpE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAe,CAAC;IAEvD,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iFAAiF;QACjF,iFAAiF;QACjF,kDAAkD;QAClD,OAAO,CAAC,IAAI,CACV,0CAA0C,GAAG,IAAI,EACjD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACF,OAAO,kBAAkB,CACvB,6DAA6D,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,EAAE;QAC1E,GAAG;QACH,KAAK;QACL,UAAU,EAAE,GAAG,CAAC,oBAAoB;KACrC,CAAC,CAAC;IAEH,iFAAiF;IACjF,2EAA2E;IAC3E,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACnC,OAAO,kBAAkB,CACvB,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IAC1D,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;QACxB,OAAO,kBAAkB,CACvB,6DAA6D,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAClC,CAAc;IAEd,MAAM,GAAG,GAAI,CAA4C,CAAC,GAAG,EAAE,GAAG,CAAC;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAA4B,CAAC;YACnE,MAAM,KAAK,GAAG,IAAI,EAAE,UAAU,CAAC;YAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACvD,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/delegation-http/constants.d.ts

@@ -16,6 +16,14 @@ export declare const PICKUP_ROUTE = "/api/delegation/pickup/:sid";
  * falls through with `next()`.
  */
 export declare const CONSENT_ROUTE = "/consent";
+/**
+ * Anchor-registration endpoint — the SAME path and wire contract as checkpoint's
+ * bouncer sessions route, so an external PEP that already registers challenge
+ * anchors against checkpoint (gateway `registration-client.ts`, .NET
+ * `DelegationAnchorRegistrar`) can be pointed at this worker unmodified. Shape is
+ * frozen by the vendored `registration.request.json` / `registration.response.json`.
+ */
+export declare const ANCHOR_REGISTRATION_ROUTE = "/api/v1/bouncer/sessions";
 /** Raw pickup-token header for token-path holders (hashed before storage). */
 export declare const PICKUP_TOKEN_HEADER = "X-KYA-Pickup-Token";
 /** Fallback delegation header used when `Authorization` is occupied by an OAuth bearer. */

package/dist/delegation-http/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/delegation-http/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,oFAAoF;AACpF,eAAO,MAAM,YAAY,gCAAgC,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,aAAa,aAAa,CAAC;AAExC,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,uBAAuB,CAAC;AAExD,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,mBAAmB,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,qBAAqB,sGASxB,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,YAAY;;;;;;;;CAQf,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AACjE,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AACnE,eAAO,MAAM,oBAAoB,2BAA2B,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/delegation-http/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,oFAAoF;AACpF,eAAO,MAAM,YAAY,gCAAgC,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,aAAa,aAAa,CAAC;AAExC;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,6BAA6B,CAAC;AAEpE,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,uBAAuB,CAAC;AAExD,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,mBAAmB,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,qBAAqB,sGASxB,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,YAAY;;;;;;;;CAQf,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AACjE,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AACnE,eAAO,MAAM,oBAAoB,2BAA2B,CAAC"}

package/dist/delegation-http/constants.js

@@ -16,6 +16,14 @@ export const PICKUP_ROUTE = "/api/delegation/pickup/:sid";
  * falls through with `next()`.
  */
 export const CONSENT_ROUTE = "/consent";
+/**
+ * Anchor-registration endpoint — the SAME path and wire contract as checkpoint's
+ * bouncer sessions route, so an external PEP that already registers challenge
+ * anchors against checkpoint (gateway `registration-client.ts`, .NET
+ * `DelegationAnchorRegistrar`) can be pointed at this worker unmodified. Shape is
+ * frozen by the vendored `registration.request.json` / `registration.response.json`.
+ */
+export const ANCHOR_REGISTRATION_ROUTE = "/api/v1/bouncer/sessions";
 /** Raw pickup-token header for token-path holders (hashed before storage). */
 export const PICKUP_TOKEN_HEADER = "X-KYA-Pickup-Token";
 /** Fallback delegation header used when `Authorization` is occupied by an OAuth bearer. */

package/dist/delegation-http/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/delegation-http/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,oFAAoF;AACpF,MAAM,CAAC,MAAM,YAAY,GAAG,6BAA6B,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AAExC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AAExD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,0BAA0B,GAAG,gBAAgB,CAAC;AAE3D;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,OAAO;IACP,KAAK;IACL,aAAa;IACb,YAAY;IACZ,OAAO;IACP,eAAe;IACf,UAAU;IACV,MAAM;CACE,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,qBAAqB,EAAE,8BAA8B;IACrD,YAAY,EAAE,qBAAqB;IACnC,cAAc,EAAE,uBAAuB;IACvC,aAAa,EAAE,sBAAsB;IACrC,OAAO,EAAE,eAAe;IACxB,WAAW,EAAE,oBAAoB;IACjC,iBAAiB,EAAE,0BAA0B;CACrC,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AACjE,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAC7D,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AACnE,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/delegation-http/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,oFAAoF;AACpF,MAAM,CAAC,MAAM,YAAY,GAAG,6BAA6B,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAEpE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AAExD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,0BAA0B,GAAG,gBAAgB,CAAC;AAE3D;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,OAAO;IACP,KAAK;IACL,aAAa;IACb,YAAY;IACZ,OAAO;IACP,eAAe;IACf,UAAU;IACV,MAAM;CACE,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,qBAAqB,EAAE,8BAA8B;IACrD,YAAY,EAAE,qBAAqB;IACnC,cAAc,EAAE,uBAAuB;IACvC,aAAa,EAAE,sBAAsB;IACrC,OAAO,EAAE,eAAe;IACxB,WAAW,EAAE,oBAAoB;IACjC,iBAAiB,EAAE,0BAA0B;CACrC,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AACjE,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAC7D,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AACnE,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC"}

package/dist/delegation-http/register.d.ts

@@ -11,9 +11,16 @@
  */
 import type { Hono } from "hono";
 import type { CreateMCPIAppOptions } from "../app";
+import type { CloudflareProofGenerator } from "../proof-generator";
+/** App-provided dependencies for routes that must sign (anchor registration). */
+export interface DelegationHttpRouteDeps {
+    /** Lazily build a proof generator bound to the request's env (see app.ts). */
+    proofGenerator?: (c: unknown) => Promise<CloudflareProofGenerator>;
+}
 /**
  * Register the kya-http delegation routes (worker-served pickup, anchor consent
- * interception). Call this BEFORE the legacy `/consent` registrations.
+ * interception, external anchor registration). Call this BEFORE the legacy
+ * `/consent` registrations.
  */
-export declare function registerDelegationHttpRoutes(app: Hono, options: CreateMCPIAppOptions): void;
+export declare function registerDelegationHttpRoutes(app: Hono, options: CreateMCPIAppOptions, deps?: DelegationHttpRouteDeps): void;
 //# sourceMappingURL=register.d.ts.map

package/dist/delegation-http/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/delegation-http/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAQ,MAAM,MAAM,CAAC;AAMvC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAmCnD;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,EACT,OAAO,EAAE,oBAAoB,GAC5B,IAAI,CAiCN"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/delegation-http/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAQ,MAAM,MAAM,CAAC;AAMvC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAEnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAkBnE,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,cAAc,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACpE;AA2BD;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,EACT,OAAO,EAAE,oBAAoB,EAC7B,IAAI,CAAC,EAAE,uBAAuB,GAC7B,IAAI,CAmDN"}

package/dist/delegation-http/register.js

@@ -11,10 +11,12 @@
  */
 import { mapPrefixedEnv } from "../helpers/env-mapper";
 import { resolveHttpChallengeConfig } from "../config";
-import { PICKUP_ROUTE, CONSENT_ROUTE } from "./constants";
+import { PICKUP_ROUTE, CONSENT_ROUTE, ANCHOR_REGISTRATION_ROUTE, } from "./constants";
 import { isAnchorSid } from "./sid";
 import { handlePickupGet } from "./pickup-routes";
 import { handleAnchorConsentGet, handleAnchorConsentApprove, } from "./consent-anchor-bridge";
+import { getAnchorStub } from "./anchor-routing";
+import { handleAnchorRegistration, isAnchorRegistrationEnabled, } from "./anchor-registration";
 /**
  * Resolve the request's mapped env and the (flag-gated) http-challenge config.
  * Never throws — a config failure resolves to `cfg: null` (layer OFF) so the legacy
@@ -37,9 +39,10 @@ c, options) {
 }
 /**
  * Register the kya-http delegation routes (worker-served pickup, anchor consent
- * interception). Call this BEFORE the legacy `/consent` registrations.
+ * interception, external anchor registration). Call this BEFORE the legacy
+ * `/consent` registrations.
  */
-export function registerDelegationHttpRoutes(app, options) {
+export function registerDelegationHttpRoutes(app, options, deps) {
     // §8.2 worker-served pickup. New path — when OFF, `next()` yields the app's 404.
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     app.get(PICKUP_ROUTE, async (c, next) => {
@@ -68,5 +71,22 @@ export function registerDelegationHttpRoutes(app, options) {
             return next();
         return handleAnchorConsentApprove(c, sid, env, cfg);
     });
+    // External anchor registration (checkpoint's bouncer-sessions wire contract).
+    // Serves only when the layer is ON, the ops kill switch hasn't disabled it,
+    // the registrar bearer (AGENTSHIELD_API_KEY) is configured, AND the app wired
+    // a proof generator; otherwise next() yields the app's 404 — byte-identical
+    // to a deployment that predates this surface.
+    const proofGenerator = deps?.proofGenerator;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    app.post(ANCHOR_REGISTRATION_ROUTE, async (c, next) => {
+        const { env, cfg } = resolveRequest(c, options);
+        if (!cfg || !isAnchorRegistrationEnabled(cfg, env) || !proofGenerator) {
+            return next();
+        }
+        return handleAnchorRegistration(c, env, cfg, {
+            getAnchorStub,
+            proofGenerator: () => proofGenerator(c),
+        });
+    });
 }
 //# sourceMappingURL=register.js.map

package/dist/delegation-http/register.js.map

@@ -1 +1 @@
-{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/delegation-http/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AAMvD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,SAAS,cAAc;AACrB,8DAA8D;AAC9D,CAAM,EACN,OAA6B;IAE7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS;YAC3B,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAA4B,EAAE,OAAO,CAAC,SAAS,CAAC;YACnE,CAAC,CAAE,CAAC,CAAC,GAAqB,CAAC;QAC7B,MAAM,GAAG,GAAG,0BAA0B,CACpC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAC7B,GAAyC,CAC1C,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;QAChF,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAoB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC1C,GAAS,EACT,OAA6B;IAE7B,iFAAiF;IACjF,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QACjD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,EAAE,CAAC;QACxB,OAAO,eAAe,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,iFAAiF;IACjF,iEAAiE;IACjE,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAClD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC,CAA2B,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,kFAAkF;IAClF,uEAAuE;IACvE,8DAA8D;IAC9D,GAAG,CAAC,IAAI,CAAC,GAAG,aAAa,UAAU,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAChE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC7C,OAAO,0BAA0B,CAC/B,CAA2B,EAC3B,GAAG,EACH,GAAG,EACH,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/delegation-http/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AAOvD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAQ/B;;;;GAIG;AACH,SAAS,cAAc;AACrB,8DAA8D;AAC9D,CAAM,EACN,OAA6B;IAE7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS;YAC3B,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAA4B,EAAE,OAAO,CAAC,SAAS,CAAC;YACnE,CAAC,CAAE,CAAC,CAAC,GAAqB,CAAC;QAC7B,MAAM,GAAG,GAAG,0BAA0B,CACpC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAC7B,GAAyC,CAC1C,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;QAChF,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAoB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,GAAS,EACT,OAA6B,EAC7B,IAA8B;IAE9B,iFAAiF;IACjF,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QACjD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,EAAE,CAAC;QACxB,OAAO,eAAe,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,iFAAiF;IACjF,iEAAiE;IACjE,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAClD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC,CAA2B,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,kFAAkF;IAClF,uEAAuE;IACvE,8DAA8D;IAC9D,GAAG,CAAC,IAAI,CAAC,GAAG,aAAa,UAAU,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAChE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC7C,OAAO,0BAA0B,CAC/B,CAA2B,EAC3B,GAAG,EACH,GAAG,EACH,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,CAAC;IAC5C,8DAA8D;IAC9D,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAC/D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACtE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,OAAO,wBAAwB,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE;YAC3C,aAAa;YACb,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;SACxC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/delegation-http/registrar-auth.d.ts

@@ -0,0 +1,24 @@
+/**
+ * draft-kya-http-02 delegation layer — anchor-registration registrar auth.
+ *
+ * The registration surface authenticates external PEPs with the deployment's
+ * own per-project dashboard API key (`AGENTSHIELD_API_KEY`) presented as
+ * `Authorization: Bearer …` — the same credential (and header) the .NET
+ * `DelegationAnchorRegistrar` already sends to checkpoint's bouncer sessions
+ * route, so no new secret is provisioned and no caller changes shape. The raw
+ * key is never logged; comparison is constant-time over SHA-256 digests.
+ *
+ * @module @kya-os/mcp-i-cloudflare/delegation-http/registrar-auth
+ */
+import type { CloudflareEnv } from "../types";
+/**
+ * Validate the presented registrar bearer against the deployment's own
+ * per-project API key. Digest-then-compare keeps the comparison constant-time
+ * and length-independent.
+ */
+export declare function registrarAuthorized(env: CloudflareEnv, authorizationHeader: string | undefined): boolean;
+/** Count one registration attempt; true when the isolate's window is exhausted. */
+export declare function registrationRateLimited(now: number): boolean;
+/** Test seam: reset the per-isolate rate window. */
+export declare function resetRegistrationRateLimiterForTests(): void;
+//# sourceMappingURL=registrar-auth.d.ts.map

package/dist/delegation-http/registrar-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registrar-auth.d.ts","sourceRoot":"","sources":["../../src/delegation-http/registrar-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAa9C;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,aAAa,EAClB,mBAAmB,EAAE,MAAM,GAAG,SAAS,GACtC,OAAO,CAMT;AAYD,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAO5D;AAED,oDAAoD;AACpD,wBAAgB,oCAAoC,IAAI,IAAI,CAG3D"}

package/dist/delegation-http/registrar-auth.js

@@ -0,0 +1,61 @@
+/**
+ * draft-kya-http-02 delegation layer — anchor-registration registrar auth.
+ *
+ * The registration surface authenticates external PEPs with the deployment's
+ * own per-project dashboard API key (`AGENTSHIELD_API_KEY`) presented as
+ * `Authorization: Bearer …` — the same credential (and header) the .NET
+ * `DelegationAnchorRegistrar` already sends to checkpoint's bouncer sessions
+ * route, so no new secret is provisioned and no caller changes shape. The raw
+ * key is never logged; comparison is constant-time over SHA-256 digests.
+ *
+ * @module @kya-os/mcp-i-cloudflare/delegation-http/registrar-auth
+ */
+import { sha256Hex } from "./hash";
+/** Constant-time comparison of two equal-length hex digests. */
+function constantTimeEqualHex(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return diff === 0;
+}
+/**
+ * Validate the presented registrar bearer against the deployment's own
+ * per-project API key. Digest-then-compare keeps the comparison constant-time
+ * and length-independent.
+ */
+export function registrarAuthorized(env, authorizationHeader) {
+    const expected = env.AGENTSHIELD_API_KEY;
+    if (!expected || !authorizationHeader)
+        return false;
+    const match = /^Bearer\s+(.+)$/i.exec(authorizationHeader.trim());
+    if (!match)
+        return false;
+    return constantTimeEqualHex(sha256Hex(match[1]), sha256Hex(expected));
+}
+// ── Rate backstop ─────────────────────────────────────────────────────────────
+// Per-isolate fixed window. Registrars are already authenticated project peers,
+// so this only bounds a runaway/buggy registrar (a retry loop minting anchors),
+// not an adversary holding the project key; an isolate restart resets it by
+// design. Anchors are additionally TTL-bounded (≤600s) and sid-idempotent.
+const RATE_WINDOW_MS = 60_000;
+const RATE_MAX_PER_WINDOW = 60;
+let rateWindowStart = 0;
+let rateCount = 0;
+/** Count one registration attempt; true when the isolate's window is exhausted. */
+export function registrationRateLimited(now) {
+    if (now - rateWindowStart >= RATE_WINDOW_MS) {
+        rateWindowStart = now;
+        rateCount = 0;
+    }
+    rateCount += 1;
+    return rateCount > RATE_MAX_PER_WINDOW;
+}
+/** Test seam: reset the per-isolate rate window. */
+export function resetRegistrationRateLimiterForTests() {
+    rateWindowStart = 0;
+    rateCount = 0;
+}
+//# sourceMappingURL=registrar-auth.js.map

package/dist/delegation-http/registrar-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registrar-auth.js","sourceRoot":"","sources":["../../src/delegation-http/registrar-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAEnC,gEAAgE;AAChE,SAAS,oBAAoB,CAAC,CAAS,EAAE,CAAS;IAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAkB,EAClB,mBAAuC;IAEvC,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACzC,IAAI,CAAC,QAAQ,IAAI,CAAC,mBAAmB;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,IAAI,eAAe,GAAG,CAAC,CAAC;AACxB,IAAI,SAAS,GAAG,CAAC,CAAC;AAElB,mFAAmF;AACnF,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,IAAI,GAAG,GAAG,eAAe,IAAI,cAAc,EAAE,CAAC;QAC5C,eAAe,GAAG,GAAG,CAAC;QACtB,SAAS,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,SAAS,IAAI,CAAC,CAAC;IACf,OAAO,SAAS,GAAG,mBAAmB,CAAC;AACzC,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,oCAAoC;IAClD,eAAe,GAAG,CAAC,CAAC;IACpB,SAAS,GAAG,CAAC,CAAC;AAChB,CAAC"}

package/dist/delegation-http/types.d.ts

@@ -24,6 +24,20 @@ export interface AnchorPin {
 }
 /**
  * The full anchor record persisted in `ctx.storage`. All timestamps are epoch ms.
+ *
+ * `agentDid`, `audience`, and `serverDid` are set only for externally-registered
+ * anchors (the `POST /api/v1/bouncer/sessions` surface):
+ *  - `agentDid` — the registering PEP's `detected_agent_did ?? agent_did`;
+ *    becomes the minted delegation's SUBJECT.
+ *  - `audience` — the resource org's DID (`challenge.audience`); becomes the
+ *    minted VC-JWT's `aud`, the value checkpoint's §4.3 claim gate pins
+ *    (`aud === resource org DID`). Its presence is what switches the mint into
+ *    cross-resource claim mode.
+ *  - `serverDid` — the challenged resource server's DID (`server_did`); carried
+ *    as a `server_did` claim for audit attribution only (aud stays the ORG —
+ *    scope is the per-resource boundary).
+ * Anchors created by the worker's own challenge emitter carry none of these
+ * (the mint's env fallback and byte-exact self-gating VC are unchanged).
  */
 export interface PickupAnchorRecord {
     sid: string;
@@ -33,6 +47,9 @@ export interface PickupAnchorRecord {
     pollIntervalS: number;
     createdAt: number;
     expiresAt: number;
+    agentDid?: string;
+    audience?: string;
+    serverDid?: string;
     pin?: AnchorPin;
     delegation?: {
         vcJwt: string;