@kya-os/mcp-i-cloudflare 1.12.0 → 1.12.2

package/dist/delegation-http/consent-anchor-bridge.js

@@ -24,8 +24,10 @@ import { wrapDelegationAsVC, createUnsignedVCJWT, completeVCJWT, base64urlEncode
 import { WebCryptoProvider } from "../providers/crypto";
 import { getConfiguredIdentity } from "../providers/storage";
 import { escapeHtml } from "../services/consent-templates/base/escape";
+import { createCredentialAuthHandler } from "../services/credential-auth.handler";
 import { getAnchorStub } from "./anchor-routing";
 import { INTERNAL_PICKUP_INFO, INTERNAL_PICKUP_APPROVE } from "./constants";
+import { resolveAnchorCredentialProvider, resolveCredentialIdentity, notifyDelegation, } from "./credential-consent";
 /** Internal origin for durable-object stub fetches — the DO routes by pathname only. */
 const DO_INTERNAL_ORIGIN = "https://do.internal";
 /**
@@ -114,6 +116,57 @@ function approveFormPage(sid, info, csrfToken) {
 </form>
 </main>`);
 }
+/**
+ * The form input names a credential provider expects, derived from the
+ * `{{placeholder}}` tokens in its `requestBodyTemplate` values. E.g.
+ * `{ email: "{{email}}", password: "{{password}}" }` → `["email", "password"]`.
+ * The credential auth handler reads the POSTed credentials by these same
+ * placeholder names (`resolveCredentialField`), so the form and the handler stay
+ * in lock-step off one source of truth.
+ */
+function credentialFieldNames(provider) {
+    const names = [];
+    for (const template of Object.values(provider.config.requestBodyTemplate)) {
+        const match = /\{\{(\w+)\}\}/.exec(template);
+        if (match && !names.includes(match[1]))
+            names.push(match[1]);
+    }
+    // Deterministic fallback so a misconfigured template still renders a usable form.
+    return names.length > 0 ? names : ["email", "password"];
+}
+/**
+ * Render the credential sign-in form for `GET /consent?sid=…` when the anchored
+ * scopes are protected by a credential provider. Same CSRF-protected POST target
+ * as {@link approveFormPage}; the extra inputs are the provider's own fields, so
+ * the shopper signs in on the deployment's OWN branded page before authorizing.
+ */
+function credentialFormPage(sid, info, provider, csrfToken) {
+    const scopeItems = info.requiredScopes.length > 0
+        ? info.requiredScopes
+            .map((s) => `<li class="kya-scope-item">${escapeHtml(s)}</li>`)
+            .join("")
+        : `<li class="kya-scope-item">No specific permissions required.</li>`;
+    const fieldInputs = credentialFieldNames(provider)
+        .map((name) => {
+        const isSecret = /pass|secret|token|pin/i.test(name);
+        const label = name.charAt(0).toUpperCase() + name.slice(1);
+        return `<label class="kya-field-label" for="kya-field-${escapeHtml(name)}">${escapeHtml(label)}</label>
+<input class="kya-field-input" id="kya-field-${escapeHtml(name)}" name="${escapeHtml(name)}" type="${isSecret ? "password" : "text"}" autocomplete="${isSecret ? "current-password" : "username"}" required>`;
+    })
+        .join("");
+    return page("Permission Request", `<main class="kya-consent">
+<h1>Sign in to authorize</h1>
+<p class="kya-provider-name">${escapeHtml(provider.displayName)}</p>
+<p class="kya-permissions-header">This request needs the following permissions:</p>
+<ul class="kya-permissions-list">${scopeItems}</ul>
+<form method="POST" action="/consent/approve?sid=${encodeURIComponent(sid)}">
+<input type="hidden" name="sid" value="${escapeHtml(sid)}">
+<input type="hidden" name="csrf_token" value="${escapeHtml(csrfToken)}">
+${fieldInputs}
+<button type="submit" class="kya-consent-allow">Sign in &amp; allow</button>
+</form>
+</main>`);
+}
 // ── CSRF (mirrors consent.service's HMAC token format, bound to the anchor sid) ──
 /** Base64url-encode bytes without padding. */
 function base64UrlEncodeBytes(bytes) {
@@ -296,6 +349,10 @@ async function mintDelegationVcJwt(env, sid, info, expiresInS) {
             scopes: info.requiredScopes,
             notBefore: nowS,
             notAfter: nowS + expiresInS,
+            // §11.7 outer===inner audience invariant (checkpoint's own mints bind the
+            // audience in BOTH the JWT aud and constraints.audience): set the inner
+            // half for cross-resource anchors so verifiers reading either slot agree.
+            ...(info.audience ? { audience: info.audience } : {}),
         },
         signature: "",
         status: "active",
@@ -312,7 +369,13 @@ async function mintDelegationVcJwt(env, sid, info, expiresInS) {
     const signingInput = withCrossResourceClaims(unsigned, info, sid);
     const signatureBytes = await cryptoProvider.sign(new TextEncoder().encode(signingInput), signingPrivateKey);
     const signature = base64urlEncodeFromBytes(signatureBytes);
-    return completeVCJWT(signingInput, signature);
+    // Return the resolved subject alongside the JWT so the notify report sends the
+    // SAME DID the VC carries (never an empty `agent_did`, which mismatches the VC
+    // and fails checkpoint's notify schema).
+    return {
+        vcJwt: completeVCJWT(signingInput, signature),
+        subjectDid: agentDid,
+    };
 }
 // ── Public handlers ──────────────────────────────────────────────────────────
 /**
@@ -331,6 +394,19 @@ export async function handleAnchorConsentGet(c, sid, env, _cfg) {
     }
     const info = (await infoResponse.json());
     const csrfToken = await mintCsrfToken(env, sid);
+    // When the project protects these scopes with a credential provider (merchant
+    // sign-in), render the branded sign-in form instead of the bare "Allow" form —
+    // so the shopper authenticates before authorizing and the minted delegation is
+    // bound to their identity. Falls back to consent-only when there is no such
+    // provider (resolution failed, or no checkpoint link), preserving today's
+    // behavior exactly.
+    const resolution = await resolveAnchorCredentialProvider(env, info.requiredScopes);
+    if (resolution.status === "credential") {
+        return htmlResponse(credentialFormPage(sid, info, resolution.provider, csrfToken), 200);
+    }
+    // "none" and "unavailable" both render the consent-only form. On "unavailable"
+    // the approve POST re-resolves and FAILS CLOSED, so a form shown during a
+    // transient error can never lead to an anonymous mint for a credential project.
     return htmlResponse(approveFormPage(sid, info, csrfToken), 200);
 }
 /**
@@ -338,10 +414,14 @@ export async function handleAnchorConsentGet(c, sid, env, _cfg) {
  * parks it on the anchor; an expired/unknown anchor makes the approval FAIL.
  */
 export async function handleAnchorConsentApprove(c, sid, env, cfg) {
+    // Read the POST body EXACTLY ONCE. The CSRF token and the credential fields
+    // both live in it; reading it twice (a second clone after CSRF) is unreliable
+    // across runtimes — the second read can throw and silently yield empty
+    // credentials, failing every sign-in. Extract everything from this one parse.
+    const bodyFields = await readBodyFields(c);
     // CSRF, unless test mode relaxes it for miniflare POSTs.
     if (!isTestConsentMode(env)) {
-        const csrfToken = await readCsrfTokenFromBody(c);
-        const valid = await validateCsrfToken(env, sid, csrfToken);
+        const valid = await validateCsrfToken(env, sid, bodyFields.csrf_token);
         if (!valid) {
             return htmlResponse(page("Authorization failed", `<main class="kya-consent-failed"><h1>Authorization failed</h1><p>Invalid or missing security token. Please reload and try again.</p></main>`), 403);
         }
@@ -359,9 +439,55 @@ export async function handleAnchorConsentApprove(c, sid, env, cfg) {
         return approvalFailedPage("This authorization request could not be loaded. Please start over.", 502);
     }
     const info = (await infoResponse.json());
+    // Credential path: when a credential provider protects these scopes, the
+    // shopper must sign in before we mint. Authenticate against the provider's own
+    // endpoint, then resolve the checkpoint user DID — both BEFORE minting, so a
+    // bad password parks nothing. `null` provider → consent-only (unchanged).
+    const resolution = await resolveAnchorCredentialProvider(env, info.requiredScopes);
+    // Fail CLOSED when the sign-in requirement could not be determined (a
+    // checkpoint /providers error or ambiguous config). Falling through to a
+    // consent-only mint here would skip merchant sign-in for a credential-
+    // protected project on a transient error — the exact bypass we must prevent.
+    if (resolution.status === "unavailable") {
+        return approvalFailedPage("We could not verify the sign-in requirement for this request. Please try again.", 503);
+    }
+    const provider = resolution.status === "credential" ? resolution.provider : null;
+    let authorizedUser = null;
+    if (provider) {
+        const credentials = {};
+        for (const name of credentialFieldNames(provider)) {
+            if (bodyFields[name] !== undefined)
+                credentials[name] = bodyFields[name];
+        }
+        const handler = createCredentialAuthHandler({
+            fetch: (...args) => globalThis.fetch(...args),
+            logger: (msg, data) => console.debug(`[kya-http] ${msg}`, data),
+        });
+        const authResult = await handler.authenticate(provider.config, credentials);
+        if (!authResult.success) {
+            return htmlResponse(page("Sign-in failed", `<main class="kya-consent-failed"><h1>Sign-in failed</h1><p>${escapeHtml(authResult.error ||
+                "Those credentials were not accepted. Please try again.")}</p></main>`), 401);
+        }
+        const identity = await resolveCredentialIdentity(env, {
+            projectId: env.AGENTSHIELD_PROJECT_ID || "",
+            provider: provider.providerId,
+            userId: authResult.userId || "unknown",
+            userEmail: authResult.userEmail,
+            userDisplayName: authResult.userDisplayName,
+        });
+        if (!identity.success || !identity.userDid) {
+            return approvalFailedPage("We signed you in but could not resolve your identity. Please start over.", 500);
+        }
+        authorizedUser = {
+            userDid: identity.userDid,
+            userId: authResult.userId,
+            userEmail: authResult.userEmail,
+        };
+    }
     let vcJwt;
+    let subjectDid;
     try {
-        vcJwt = await mintDelegationVcJwt(env, sid, info, cfg.delegationExpiresInS);
+        ({ vcJwt, subjectDid } = await mintDelegationVcJwt(env, sid, info, cfg.delegationExpiresInS));
     }
     catch (error) {
         // A mint failure (keygen/sign) must surface as a styled no-store error page, not
@@ -385,30 +511,63 @@ export async function handleAnchorConsentApprove(c, sid, env, cfg) {
     if (!approveResponse.ok) {
         return approvalFailedPage("We could not complete the authorization. Please start over.", 502);
     }
+    // Report the minted delegation to checkpoint so it appears in the dashboard,
+    // attributed to the signed-in customer. Only the credential path has a
+    // `user_did` (the notify schema requires one), so a consent-only anchor
+    // reports nothing — there is no user to attribute it to.
+    if (authorizedUser && provider) {
+        // FIRE-AND-FORGET: dispatch the report but NEVER await it — the VC is already
+        // parked and the shopper's approval must not hang on a slow/hung checkpoint.
+        // `waitUntil` (when the runtime provides it) lets the report finish after the
+        // success page is returned; `notifyDelegation` swallows its own errors.
+        const report = notifyDelegation(env, {
+            sid,
+            agentDid: subjectDid,
+            userDid: authorizedUser.userDid,
+            userId: authorizedUser.userId,
+            userIdentifier: authorizedUser.userEmail,
+            scopes: info.requiredScopes,
+            provider: provider.providerId,
+            // Record the same expiry the VC was minted with, matching the OAuth path.
+            expiresAt: new Date(Date.now() + cfg.delegationExpiresInS * 1000).toISOString(),
+        });
+        const execCtx = c.executionCtx;
+        execCtx?.waitUntil?.(report);
+    }
     return successPage();
 }
 /**
- * Read the `csrf_token` form field from the POST body via the underlying native
- * Request (`c.req.raw`). The sid travels in the query, so consuming the body here
- * never interferes with route-order interception. Returns undefined on parse failure.
+ * Read every string field from the POST body ONCE via the underlying native
+ * Request (`c.req.raw`), for both the CSRF token and the credential fields. Reads
+ * `raw` directly (no clone) because it is consumed a single time — a second read
+ * of the same body is unreliable across runtimes. The sid travels in the query,
+ * so consuming the body here never interferes with route-order interception.
+ * Returns an empty object on parse failure.
  */
-async function readCsrfTokenFromBody(c) {
+async function readBodyFields(c) {
+    const out = {};
     const raw = c.req?.raw;
     if (!raw)
-        return undefined;
+        return out;
     try {
         const contentType = raw.headers.get("Content-Type") || "";
         if (contentType.includes("application/json")) {
-            const body = (await raw.clone().json());
-            const token = body?.csrf_token;
-            return typeof token === "string" ? token : undefined;
+            const body = (await raw.json());
+            for (const [key, value] of Object.entries(body)) {
+                if (typeof value === "string")
+                    out[key] = value;
+            }
+            return out;
         }
-        const form = await raw.clone().formData();
-        const token = form.get("csrf_token");
-        return typeof token === "string" ? token : undefined;
+        const form = await raw.formData();
+        form.forEach((value, key) => {
+            if (typeof value === "string")
+                out[key] = value;
+        });
+        return out;
     }
     catch {
-        return undefined;
+        return out;
     }
 }
 //# sourceMappingURL=consent-anchor-bridge.js.map

package/dist/delegation-http/consent-anchor-bridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"consent-anchor-bridge.js","sourceRoot":"","sources":["../../src/delegation-http/consent-anchor-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,wBAAwB,EACxB,cAAc,GAEf,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,2CAA2C,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE5E,wFAAwF;AACxF,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AA2BjD;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,GAAkB,EAClB,GAAW,EACX,YAAoB,EACpB,IAAa;IAEb,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,IAAI,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,EACpD;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CACF,CAAC;IACF,OAAO,QAA0C,CAAC;AACpD,CAAC;AAED,oEAAoE;AACpE,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,IAAI,CAAC,KAAa,EAAE,SAAiB;IAC5C,OAAO;;;;;SAKA,UAAU,CAAC,KAAK,CAAC;;;EAGxB,SAAS;;QAEH,CAAC;AACT,CAAC;AAED,sDAAsD;AACtD,SAAS,WAAW;IAClB,OAAO,YAAY,CACjB,IAAI,CACF,4BAA4B,EAC5B;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,0CAA0C;AAC1C,SAAS,YAAY;IACnB,OAAO,YAAY,CACjB,IAAI,CACF,iCAAiC,EACjC;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,kBAAkB,CAAC,OAAe,EAAE,MAAM,GAAG,GAAG;IACvD,OAAO,YAAY,CACjB,IAAI,CACF,sBAAsB,EACtB;;KAED,UAAU,CAAC,OAAO,CAAC;QAChB,CACH,EACD,MAAM,CACP,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,SAAS,WAAW;IAClB,OAAO,YAAY,CACjB,IAAI,CACF,wBAAwB,EACxB;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,GAAW,EACX,IAAgB,EAChB,SAAiB;IAEjB,MAAM,UAAU,GACd,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QAC5B,CAAC,CAAC,IAAI,CAAC,cAAc;aAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;aAC9D,IAAI,CAAC,EAAE,CAAC;QACb,CAAC,CAAC,mEAAmE,CAAC;IAE1E,OAAO,IAAI,CACT,oBAAoB,EACpB;;;mCAG+B,UAAU;mDACM,kBAAkB,CAAC,GAAG,CAAC;yCACjC,UAAU,CAAC,GAAG,CAAC;gDACR,UAAU,CAAC,SAAS,CAAC;;;QAG7D,CACL,CAAC;AACJ,CAAC;AAED,oFAAoF;AAEpF,8CAA8C;AAC9C,SAAS,oBAAoB,CAAC,KAAiB;IAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACvC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,uDAAuD;AACvD,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,oBAAoB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,wFAAwF;AACxF,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,QAAQ,MAAM,EAAE,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,0EAA0E;AAC1E,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,GAAW;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;IAChD,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,oBAAoB,CAClC,IAAI,UAAU,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAC1D,CAAC;IACF,OAAO,GAAG,OAAO,IAAI,UAAU,EAAE,CAAC;AACpC,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,iBAAiB,CAC9B,GAAkB,EAClB,GAAW,EACX,KAAyB;IAEzB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,gFAAgF;QAChF,gFAAgF;QAChF,gFAAgF;QAChF,uEAAuE;QACvE,8EAA8E;QAC9E,OAAO,CAAC,IAAI,CACV,oFAAoF,GAAG,GAAG,CAC3F,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAG3D,CAAC;QACF,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACtC,IACE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC3C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,WAAW,GAAG,oBAAoB,CACtC,IAAI,UAAU,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAC1D,CAAC;QACF,OAAO,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAkB;IAC3C,+EAA+E;IAC/E,oFAAoF;IACpF,MAAM,GAAG,GAAG,GAAyC,CAAC;IACtD,IAAI,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC3D,oFAAoF;IACpF,oDAAoD;IACpD,MAAM,WAAW,GAAG,MAAM,CACxB,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CACtC,CAAC,WAAW,EAAE,CAAC;IAChB,OAAO,WAAW,KAAK,aAAa,CAAC;AACvC,CAAC;AAED,mFAAmF;AAEnF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,uBAAuB,CAC9B,QAAgD,EAChD,IAAgB,EAChB,GAAW;IAEX,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC,YAAY,CAAC;IACjD,MAAM,OAAO,GAA4B;QACvC,GAAG,QAAQ,CAAC,OAAO;QACnB,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,GAAG;QACH,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,OAAO,GAAG,QAAQ,CAAC,aAAa,IAAI,qBAAqB,CACvD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,EAAE,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,mBAAmB,CAChC,GAAkB,EAClB,GAAW,EACX,IAAgB,EAChB,UAAkB;IAElB,MAAM,cAAc,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAC/C,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAEtD,IAAI,SAAiB,CAAC;IACtB,IAAI,KAAa,CAAC;IAClB,IAAI,iBAAyB,CAAC;IAC9B,IAAI,kBAAkB,EAAE,CAAC;QACvB,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC;QACnC,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC;QAC/B,iBAAiB,GAAG,kBAAkB,CAAC,UAAU,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,eAAe,EAAE,CAAC;QAC1D,SAAS,GAAG,wBAAwB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3D,KAAK,GAAG,GAAG,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC;IAC5C,CAAC;IAED,6EAA6E;IAC7E,gFAAgF;IAChF,gFAAgF;IAChF,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,sBAAsB,IAAI,SAAS,CAAC;IAE1E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAqB;QACnC,EAAE,EAAE,YAAY,GAAG,EAAE;QACrB,SAAS;QACT,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,YAAY,GAAG,EAAE;QACvB,WAAW,EAAE;YACX,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,IAAI,GAAG,UAAU;SAC5B;QACD,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,EAAE;QAChD,EAAE,EAAE,YAAY,GAAG,EAAE;QACrB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACvC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAE1D,MAAM,QAAQ,GAAG,mBAAmB,CAClC,YAAuC,EACvC,EAAE,KAAK,EAAE,CACV,CAAC;IACF,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,YAAY,GAAG,uBAAuB,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,IAAI,CAC9C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,iBAAiB,CAClB,CAAC;IACF,MAAM,SAAS,GAAG,wBAAwB,CAAC,cAAc,CAAC,CAAC;IAE3D,OAAO,aAAa,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,CAAc,EACd,GAAW,EACX,GAAkB,EAClB,IAAmC;IAEnC,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE;QACpE,GAAG;KACJ,CAAC,CAAC;IAEH,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,EAAE,CAAC;IACtD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,kBAAkB,CACvB,oEAAoE,EACpE,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAe,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,YAAY,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,CAAc,EACd,GAAW,EACX,GAAkB,EAClB,GAAkC;IAElC,yDAAyD;IACzD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,YAAY,CACjB,IAAI,CACF,sBAAsB,EACtB,6IAA6I,CAC9I,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE;QACpE,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAChC,OAAO,kBAAkB,CACvB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,kBAAkB,CACvB,oEAAoE,EACpE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAe,CAAC;IAEvD,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iFAAiF;QACjF,iFAAiF;QACjF,kDAAkD;QAClD,OAAO,CAAC,IAAI,CACV,0CAA0C,GAAG,IAAI,EACjD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACF,OAAO,kBAAkB,CACvB,6DAA6D,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,EAAE;QAC1E,GAAG;QACH,KAAK;QACL,UAAU,EAAE,GAAG,CAAC,oBAAoB;KACrC,CAAC,CAAC;IAEH,iFAAiF;IACjF,2EAA2E;IAC3E,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACnC,OAAO,kBAAkB,CACvB,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IAC1D,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;QACxB,OAAO,kBAAkB,CACvB,6DAA6D,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAClC,CAAc;IAEd,MAAM,GAAG,GAAI,CAA4C,CAAC,GAAG,EAAE,GAAG,CAAC;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAA4B,CAAC;YACnE,MAAM,KAAK,GAAG,IAAI,EAAE,UAAU,CAAC;YAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACvD,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"consent-anchor-bridge.js","sourceRoot":"","sources":["../../src/delegation-http/consent-anchor-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,wBAAwB,EACxB,cAAc,GAEf,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,2CAA2C,CAAC;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,gBAAgB,GAEjB,MAAM,sBAAsB,CAAC;AAE9B,wFAAwF;AACxF,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AA2BjD;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,GAAkB,EAClB,GAAW,EACX,YAAoB,EACpB,IAAa;IAEb,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,IAAI,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,EACpD;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CACF,CAAC;IACF,OAAO,QAA0C,CAAC;AACpD,CAAC;AAED,oEAAoE;AACpE,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,IAAI,CAAC,KAAa,EAAE,SAAiB;IAC5C,OAAO;;;;;SAKA,UAAU,CAAC,KAAK,CAAC;;;EAGxB,SAAS;;QAEH,CAAC;AACT,CAAC;AAED,sDAAsD;AACtD,SAAS,WAAW;IAClB,OAAO,YAAY,CACjB,IAAI,CACF,4BAA4B,EAC5B;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,0CAA0C;AAC1C,SAAS,YAAY;IACnB,OAAO,YAAY,CACjB,IAAI,CACF,iCAAiC,EACjC;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,kBAAkB,CAAC,OAAe,EAAE,MAAM,GAAG,GAAG;IACvD,OAAO,YAAY,CACjB,IAAI,CACF,sBAAsB,EACtB;;KAED,UAAU,CAAC,OAAO,CAAC;QAChB,CACH,EACD,MAAM,CACP,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,SAAS,WAAW;IAClB,OAAO,YAAY,CACjB,IAAI,CACF,wBAAwB,EACxB;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,GAAW,EACX,IAAgB,EAChB,SAAiB;IAEjB,MAAM,UAAU,GACd,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QAC5B,CAAC,CAAC,IAAI,CAAC,cAAc;aAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;aAC9D,IAAI,CAAC,EAAE,CAAC;QACb,CAAC,CAAC,mEAAmE,CAAC;IAE1E,OAAO,IAAI,CACT,oBAAoB,EACpB;;;mCAG+B,UAAU;mDACM,kBAAkB,CAAC,GAAG,CAAC;yCACjC,UAAU,CAAC,GAAG,CAAC;gDACR,UAAU,CAAC,SAAS,CAAC;;;QAG7D,CACL,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,QAAoC;IAChE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,kFAAkF;IAClF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CACzB,GAAW,EACX,IAAgB,EAChB,QAAoC,EACpC,SAAiB;IAEjB,MAAM,UAAU,GACd,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QAC5B,CAAC,CAAC,IAAI,CAAC,cAAc;aAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;aAC9D,IAAI,CAAC,EAAE,CAAC;QACb,CAAC,CAAC,mEAAmE,CAAC;IAE1E,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC;SAC/C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,iDAAiD,UAAU,CAChE,IAAI,CACL,KAAK,UAAU,CAAC,KAAK,CAAC;+CACkB,UAAU,CACjD,IAAI,CACL,WAAW,UAAU,CAAC,IAAI,CAAC,WAC1B,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAC1B,mBAAmB,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,aAAa,CAAC;IAC7E,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,OAAO,IAAI,CACT,oBAAoB,EACpB;;+BAE2B,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;;mCAE5B,UAAU;mDACM,kBAAkB,CAAC,GAAG,CAAC;yCACjC,UAAU,CAAC,GAAG,CAAC;gDACR,UAAU,CAAC,SAAS,CAAC;EACnE,WAAW;;;QAGL,CACL,CAAC;AACJ,CAAC;AAED,oFAAoF;AAEpF,8CAA8C;AAC9C,SAAS,oBAAoB,CAAC,KAAiB;IAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACvC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,uDAAuD;AACvD,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,oBAAoB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,wFAAwF;AACxF,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,QAAQ,MAAM,EAAE,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,0EAA0E;AAC1E,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,GAAW;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;IAChD,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,oBAAoB,CAClC,IAAI,UAAU,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAC1D,CAAC;IACF,OAAO,GAAG,OAAO,IAAI,UAAU,EAAE,CAAC;AACpC,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,iBAAiB,CAC9B,GAAkB,EAClB,GAAW,EACX,KAAyB;IAEzB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,gFAAgF;QAChF,gFAAgF;QAChF,gFAAgF;QAChF,uEAAuE;QACvE,8EAA8E;QAC9E,OAAO,CAAC,IAAI,CACV,oFAAoF,GAAG,GAAG,CAC3F,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAG3D,CAAC;QACF,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACtC,IACE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC3C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,WAAW,GAAG,oBAAoB,CACtC,IAAI,UAAU,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAC1D,CAAC;QACF,OAAO,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAkB;IAC3C,+EAA+E;IAC/E,oFAAoF;IACpF,MAAM,GAAG,GAAG,GAAyC,CAAC;IACtD,IAAI,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC3D,oFAAoF;IACpF,oDAAoD;IACpD,MAAM,WAAW,GAAG,MAAM,CACxB,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CACtC,CAAC,WAAW,EAAE,CAAC;IAChB,OAAO,WAAW,KAAK,aAAa,CAAC;AACvC,CAAC;AAED,mFAAmF;AAEnF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,uBAAuB,CAC9B,QAAgD,EAChD,IAAgB,EAChB,GAAW;IAEX,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC,YAAY,CAAC;IACjD,MAAM,OAAO,GAA4B;QACvC,GAAG,QAAQ,CAAC,OAAO;QACnB,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,GAAG;QACH,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,OAAO,GAAG,QAAQ,CAAC,aAAa,IAAI,qBAAqB,CACvD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,EAAE,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,mBAAmB,CAChC,GAAkB,EAClB,GAAW,EACX,IAAgB,EAChB,UAAkB;IAElB,MAAM,cAAc,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAC/C,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAEtD,IAAI,SAAiB,CAAC;IACtB,IAAI,KAAa,CAAC;IAClB,IAAI,iBAAyB,CAAC;IAC9B,IAAI,kBAAkB,EAAE,CAAC;QACvB,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC;QACnC,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC;QAC/B,iBAAiB,GAAG,kBAAkB,CAAC,UAAU,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,eAAe,EAAE,CAAC;QAC1D,SAAS,GAAG,wBAAwB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3D,KAAK,GAAG,GAAG,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC;IAC5C,CAAC;IAED,6EAA6E;IAC7E,gFAAgF;IAChF,gFAAgF;IAChF,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,sBAAsB,IAAI,SAAS,CAAC;IAE1E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAqB;QACnC,EAAE,EAAE,YAAY,GAAG,EAAE;QACrB,SAAS;QACT,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,YAAY,GAAG,EAAE;QACvB,WAAW,EAAE;YACX,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,IAAI,GAAG,UAAU;YAC3B,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,EAAE;QAChD,EAAE,EAAE,YAAY,GAAG,EAAE;QACrB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACvC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAE1D,MAAM,QAAQ,GAAG,mBAAmB,CAClC,YAAuC,EACvC,EAAE,KAAK,EAAE,CACV,CAAC;IACF,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,YAAY,GAAG,uBAAuB,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,IAAI,CAC9C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,iBAAiB,CAClB,CAAC;IACF,MAAM,SAAS,GAAG,wBAAwB,CAAC,cAAc,CAAC,CAAC;IAE3D,+EAA+E;IAC/E,+EAA+E;IAC/E,yCAAyC;IACzC,OAAO;QACL,KAAK,EAAE,aAAa,CAAC,YAAY,EAAE,SAAS,CAAC;QAC7C,UAAU,EAAE,QAAQ;KACrB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,CAAc,EACd,GAAW,EACX,GAAkB,EAClB,IAAmC;IAEnC,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE;QACpE,GAAG;KACJ,CAAC,CAAC;IAEH,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,EAAE,CAAC;IACtD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,kBAAkB,CACvB,oEAAoE,EACpE,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAe,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAEhD,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,0EAA0E;IAC1E,oBAAoB;IACpB,MAAM,UAAU,GAAG,MAAM,+BAA+B,CACtD,GAAG,EACH,IAAI,CAAC,cAAc,CACpB,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QACvC,OAAO,YAAY,CACjB,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,+EAA+E;IAC/E,0EAA0E;IAC1E,gFAAgF;IAChF,OAAO,YAAY,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,CAAc,EACd,GAAW,EACX,GAAkB,EAClB,GAAkC;IAElC,4EAA4E;IAC5E,8EAA8E;IAC9E,uEAAuE;IACvE,8EAA8E;IAC9E,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAC;IAE3C,yDAAyD;IACzD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,YAAY,CACjB,IAAI,CACF,sBAAsB,EACtB,6IAA6I,CAC9I,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE;QACpE,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAChC,OAAO,kBAAkB,CACvB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,kBAAkB,CACvB,oEAAoE,EACpE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAe,CAAC;IAEvD,yEAAyE;IACzE,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,MAAM,+BAA+B,CACtD,GAAG,EACH,IAAI,CAAC,cAAc,CACpB,CAAC;IACF,sEAAsE;IACtE,yEAAyE;IACzE,uEAAuE;IACvE,6EAA6E;IAC7E,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACxC,OAAO,kBAAkB,CACvB,iFAAiF,EACjF,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GACZ,UAAU,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,cAAc,GAIP,IAAI,CAAC;IAChB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,WAAW,GAA2B,EAAE,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,SAAS;gBAAE,WAAW,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,OAAO,GAAG,2BAA2B,CAAC;YAC1C,KAAK,EAAE,CAAC,GAAG,IAA8B,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;YACvE,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,GAAG,EAAE,EAAE,IAAI,CAAC;SAChE,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5E,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,YAAY,CACjB,IAAI,CACF,gBAAgB,EAChB,8DAA8D,UAAU,CACtE,UAAU,CAAC,KAAK;gBACd,wDAAwD,CAC3D,aAAa,CACf,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE;YACpD,SAAS,EAAE,GAAG,CAAC,sBAAsB,IAAI,EAAE;YAC3C,QAAQ,EAAE,QAAQ,CAAC,UAAU;YAC7B,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,SAAS;YACtC,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,eAAe,EAAE,UAAU,CAAC,eAAe;SAC5C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC3C,OAAO,kBAAkB,CACvB,0EAA0E,EAC1E,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,cAAc,GAAG;YACf,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,KAAa,CAAC;IAClB,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,mBAAmB,CAChD,GAAG,EACH,GAAG,EACH,IAAI,EACJ,GAAG,CAAC,oBAAoB,CACzB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iFAAiF;QACjF,iFAAiF;QACjF,kDAAkD;QAClD,OAAO,CAAC,IAAI,CACV,0CAA0C,GAAG,IAAI,EACjD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACF,OAAO,kBAAkB,CACvB,6DAA6D,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,EAAE;QAC1E,GAAG;QACH,KAAK;QACL,UAAU,EAAE,GAAG,CAAC,oBAAoB;KACrC,CAAC,CAAC;IAEH,iFAAiF;IACjF,2EAA2E;IAC3E,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACnC,OAAO,kBAAkB,CACvB,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IAC1D,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;QACxB,OAAO,kBAAkB,CACvB,6DAA6D,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,uEAAuE;IACvE,wEAAwE;IACxE,yDAAyD;IACzD,IAAI,cAAc,IAAI,QAAQ,EAAE,CAAC;QAC/B,8EAA8E;QAC9E,6EAA6E;QAC7E,8EAA8E;QAC9E,wEAAwE;QACxE,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,EAAE;YACnC,GAAG;YACH,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,cAAc,CAAC,OAAO;YAC/B,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,cAAc,EAAE,cAAc,CAAC,SAAS;YACxC,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,QAAQ,EAAE,QAAQ,CAAC,UAAU;YAC7B,0EAA0E;YAC1E,SAAS,EAAE,IAAI,IAAI,CACjB,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,oBAAoB,GAAG,IAAI,CAC7C,CAAC,WAAW,EAAE;SAChB,CAAC,CAAC;QACH,MAAM,OAAO,GACX,CAGD,CAAC,YAAY,CAAC;QACf,OAAO,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAAC,CAAc;IAC1C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,GAAG,GAAI,CAA4C,CAAC,GAAG,EAAE,GAAG,CAAC;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAClD,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/delegation-http/credential-consent.d.ts

@@ -0,0 +1,147 @@
+/**
+ * Credential-backed consent for the §8.1 anchor path.
+ *
+ * The anchor consent bridge (`consent-anchor-bridge.ts`) was consent-only: it
+ * rendered an "Allow" form, minted an anonymous delegation, and reported
+ * nothing to checkpoint. When a project's tool protection requires a credential
+ * provider (merchant sign-in), the branded consent an agent is redirected to
+ * must instead authenticate the shopper and mint a delegation bound to their
+ * identity — the same outcome the NATIVE MCP consent (`consent.service.ts`)
+ * produces, reached here for the HTTP-challenge transport.
+ *
+ * This module holds the runtime-agnostic pieces that don't belong inline in the
+ * bridge:
+ *  - {@link resolveCredentialIdentity} — customer → `user_did` via checkpoint's
+ *    `/api/v1/bouncer/identity/resolve` (lifted verbatim from
+ *    `consent.service.ts`, which needs nothing but `env`).
+ *  - {@link notifyDelegation} — fire-and-forget report to checkpoint's
+ *    `/api/v1/bouncer/delegations/notify` so the minted delegation appears in
+ *    the dashboard, attributed to the signed-in customer. This call is the ONLY
+ *    path that populates dashboard visibility, and its schema REQUIRES a
+ *    `user_did` — which is exactly why the anchor path could never show up
+ *    while it was consent-only.
+ *  - {@link sidToDelegationUuid} — the anchor sid (`kya-…`) is not a UUID, but
+ *    the notify schema demands `delegation_id` be one; this maps a sid to a
+ *    stable UUID so repeated notifies for the same anchor stay idempotent.
+ *
+ * @module @kya-os/mcp-i-cloudflare/delegation-http/credential-consent
+ */
+import type { CredentialProviderConfig } from "@kya-os/contracts/config";
+import type { CloudflareEnv } from "../types";
+/** A resolved credential provider the anchor consent should authenticate with. */
+export interface ResolvedCredentialProvider {
+    /** The provider id (dashboard key), used for identity resolution + notify. */
+    providerId: string;
+    /** Human-readable name for the consent page heading. */
+    displayName: string;
+    /** The provider config the credential auth handler consumes. */
+    config: CredentialProviderConfig;
+}
+/**
+ * The result of resolving whether the anchored scopes need credential auth.
+ *
+ * `unavailable` is deliberately distinct from `none`: it means we could NOT
+ * determine the requirement (the checkpoint `/providers` fetch failed, or its
+ * answer was ambiguous/malformed). The approve handler MUST fail closed on
+ * `unavailable` rather than mint an anonymous delegation — otherwise a transient
+ * error would silently skip merchant sign-in for a credential-protected project.
+ */
+export type AnchorCredentialResolution = {
+    status: "credential";
+    provider: ResolvedCredentialProvider;
+} | {
+    status: "none";
+} | {
+    status: "unavailable";
+};
+/**
+ * Resolve whether the project has a credential (merchant sign-in) provider the
+ * anchor consent should authenticate against, by fetching checkpoint's
+ * `/api/v1/bouncer/projects/{projectId}/providers` (the CRED-001 endpoint that
+ * returns full credential configs — authEndpoint / requestBodyTemplate /
+ * responseFields / successCheck — the same source the native consent uses).
+ *
+ * Returns `none` (→ consent-only) when the deployment has no checkpoint link or
+ * the project has no credential provider; `unavailable` (→ fail closed on mint)
+ * when the requirement could not be determined (fetch error / ambiguous config);
+ * `credential` with the provider otherwise. NEVER throws.
+ *
+ * v1 selection: prefer the project's `configuredProvider` when it is a credential
+ * provider; otherwise the single configured credential provider. When several
+ * credential providers exist with no default, resolution is `unavailable` (fail
+ * closed) rather than a silent anonymous mint — per-scope provider mapping is a
+ * documented follow-up.
+ */
+export declare function resolveAnchorCredentialProvider(env: CloudflareEnv, _scopes: string[]): Promise<AnchorCredentialResolution>;
+/** Params for {@link resolveCredentialIdentity}. */
+export interface ResolveCredentialIdentityParams {
+    projectId: string;
+    /** Credential provider id (e.g. the merchant provider). */
+    provider: string;
+    /** The customer id the provider's login returned. */
+    userId: string;
+    userEmail?: string;
+    userDisplayName?: string;
+}
+/**
+ * Resolve a signed-in customer to a checkpoint `user_did` via
+ * `/api/v1/bouncer/identity/resolve`. Mirrors
+ * `ConsentService.resolveCredentialIdentity` — it depends only on `env`
+ * (`AGENTSHIELD_API_URL` + `AGENTSHIELD_API_KEY`), never session/audit state, so
+ * it lives here as a free function the bridge can call directly. Returns
+ * `{ success: false }` (never throws) on any failure so the caller fails closed.
+ */
+export declare function resolveCredentialIdentity(env: CloudflareEnv, params: ResolveCredentialIdentityParams): Promise<{
+    success: boolean;
+    userDid?: string;
+}>;
+/**
+ * Map an anchor sid (`kya-` + 16–64 hex) to a stable RFC-4122 v4-shaped UUID.
+ *
+ * The notify schema pins `delegation_id` to a UUID, but a sid is not one. We
+ * derive it from the SHA-256 of the WHOLE sid so a repeated notify for the same
+ * anchor is idempotent (same sid → same id) while distinct sids stay distinct —
+ * hashing the full value avoids the collisions that truncating/repeating the raw
+ * hex would cause (sids longer than 32 hex would drop entropy; padded short sids
+ * could alias). The version nibble is forced to `4` and the variant nibble into
+ * the `8–b` range so the result passes strict UUID validators. This id
+ * identifies the dashboard row; it is intentionally NOT the VC's own
+ * `urn:uuid:${sid}` id.
+ */
+export declare function sidToDelegationUuid(sid: string): string;
+/** Params for {@link notifyDelegation}. */
+export interface NotifyDelegationParams {
+    /** The anchor sid the delegation was minted for. */
+    sid: string;
+    /** Subject (agent) DID the delegation was granted to. */
+    agentDid: string;
+    /** Human-readable agent name for the dashboard, if known. */
+    agentName?: string;
+    /** REQUIRED by the notify schema: the authorizing customer's DID. */
+    userDid: string;
+    /** Provider-native customer id. */
+    userId?: string;
+    /** Human-readable customer identifier (email) for dashboard display. */
+    userIdentifier?: string;
+    /** Granted scopes (at least one). */
+    scopes: string[];
+    /** Credential provider id. */
+    provider: string;
+    /** ISO-8601 expiry, if the delegation expires. */
+    expiresAt?: string;
+    /** Extra audit metadata merged into the report. */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Report a minted delegation to checkpoint so it appears in the dashboard,
+ * attributed to the signed-in customer. Fire-and-forget and best-effort: it
+ * NEVER throws and never blocks the consent response — a checkpoint hiccup must
+ * not fail an approval the user already granted. Matches the payload the OAuth
+ * path sends (`oauth-handler.ts`) against checkpoint's `notifyDelegationSchema`.
+ *
+ * No-ops (returns without a request) when the deployment has no
+ * `AGENTSHIELD_API_KEY` or `AGENTSHIELD_PROJECT_ID` — a self-hosted anchor with
+ * no checkpoint link has nothing to report to.
+ */
+export declare function notifyDelegation(env: CloudflareEnv, params: NotifyDelegationParams): Promise<void>;
+//# sourceMappingURL=credential-consent.d.ts.map

package/dist/delegation-http/credential-consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-consent.d.ts","sourceRoot":"","sources":["../../src/delegation-http/credential-consent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAG9C,kFAAkF;AAClF,MAAM,WAAW,0BAA0B;IACzC,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,MAAM,EAAE,wBAAwB,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAClC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,0BAA0B,CAAA;CAAE,GAC9D;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC;AAuI9B;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,+BAA+B,CACnD,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,0BAA0B,CAAC,CAwFrC;AAED,oDAAoD;AACpD,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,+BAA+B,GACtC,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgCjD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAYvD;AAED,2CAA2C;AAC3C,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,CA+Cf"}