@kya-os/mcp-i-cloudflare 1.12.1 → 1.12.2

package/dist/delegation-http/consent-anchor-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consent-anchor-bridge.d.ts","sourceRoot":"","sources":["../../src/delegation-http/consent-anchor-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAWH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AA6arD;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,CAAC,EAAE,WAAW,EACd,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GAClC,OAAO,CAAC,QAAQ,CAAC,CAiBnB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,CAAC,EAAE,WAAW,EACd,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GACjC,OAAO,CAAC,QAAQ,CAAC,CAyEnB"}
+{"version":3,"file":"consent-anchor-bridge.d.ts","sourceRoot":"","sources":["../../src/delegation-http/consent-anchor-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAWH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AA+frD;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,CAAC,EAAE,WAAW,EACd,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GAClC,OAAO,CAAC,QAAQ,CAAC,CAqCnB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,CAAC,EAAE,WAAW,EACd,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GACjC,OAAO,CAAC,QAAQ,CAAC,CAqLnB"}

package/dist/delegation-http/consent-anchor-bridge.js

@@ -24,8 +24,10 @@ import { wrapDelegationAsVC, createUnsignedVCJWT, completeVCJWT, base64urlEncode
 import { WebCryptoProvider } from "../providers/crypto";
 import { getConfiguredIdentity } from "../providers/storage";
 import { escapeHtml } from "../services/consent-templates/base/escape";
+import { createCredentialAuthHandler } from "../services/credential-auth.handler";
 import { getAnchorStub } from "./anchor-routing";
 import { INTERNAL_PICKUP_INFO, INTERNAL_PICKUP_APPROVE } from "./constants";
+import { resolveAnchorCredentialProvider, resolveCredentialIdentity, notifyDelegation, } from "./credential-consent";
 /** Internal origin for durable-object stub fetches — the DO routes by pathname only. */
 const DO_INTERNAL_ORIGIN = "https://do.internal";
 /**
@@ -114,6 +116,57 @@ function approveFormPage(sid, info, csrfToken) {
 </form>
 </main>`);
 }
+/**
+ * The form input names a credential provider expects, derived from the
+ * `{{placeholder}}` tokens in its `requestBodyTemplate` values. E.g.
+ * `{ email: "{{email}}", password: "{{password}}" }` → `["email", "password"]`.
+ * The credential auth handler reads the POSTed credentials by these same
+ * placeholder names (`resolveCredentialField`), so the form and the handler stay
+ * in lock-step off one source of truth.
+ */
+function credentialFieldNames(provider) {
+    const names = [];
+    for (const template of Object.values(provider.config.requestBodyTemplate)) {
+        const match = /\{\{(\w+)\}\}/.exec(template);
+        if (match && !names.includes(match[1]))
+            names.push(match[1]);
+    }
+    // Deterministic fallback so a misconfigured template still renders a usable form.
+    return names.length > 0 ? names : ["email", "password"];
+}
+/**
+ * Render the credential sign-in form for `GET /consent?sid=…` when the anchored
+ * scopes are protected by a credential provider. Same CSRF-protected POST target
+ * as {@link approveFormPage}; the extra inputs are the provider's own fields, so
+ * the shopper signs in on the deployment's OWN branded page before authorizing.
+ */
+function credentialFormPage(sid, info, provider, csrfToken) {
+    const scopeItems = info.requiredScopes.length > 0
+        ? info.requiredScopes
+            .map((s) => `<li class="kya-scope-item">${escapeHtml(s)}</li>`)
+            .join("")
+        : `<li class="kya-scope-item">No specific permissions required.</li>`;
+    const fieldInputs = credentialFieldNames(provider)
+        .map((name) => {
+        const isSecret = /pass|secret|token|pin/i.test(name);
+        const label = name.charAt(0).toUpperCase() + name.slice(1);
+        return `<label class="kya-field-label" for="kya-field-${escapeHtml(name)}">${escapeHtml(label)}</label>
+<input class="kya-field-input" id="kya-field-${escapeHtml(name)}" name="${escapeHtml(name)}" type="${isSecret ? "password" : "text"}" autocomplete="${isSecret ? "current-password" : "username"}" required>`;
+    })
+        .join("");
+    return page("Permission Request", `<main class="kya-consent">
+<h1>Sign in to authorize</h1>
+<p class="kya-provider-name">${escapeHtml(provider.displayName)}</p>
+<p class="kya-permissions-header">This request needs the following permissions:</p>
+<ul class="kya-permissions-list">${scopeItems}</ul>
+<form method="POST" action="/consent/approve?sid=${encodeURIComponent(sid)}">
+<input type="hidden" name="sid" value="${escapeHtml(sid)}">
+<input type="hidden" name="csrf_token" value="${escapeHtml(csrfToken)}">
+${fieldInputs}
+<button type="submit" class="kya-consent-allow">Sign in &amp; allow</button>
+</form>
+</main>`);
+}
 // ── CSRF (mirrors consent.service's HMAC token format, bound to the anchor sid) ──
 /** Base64url-encode bytes without padding. */
 function base64UrlEncodeBytes(bytes) {
@@ -316,7 +369,13 @@ async function mintDelegationVcJwt(env, sid, info, expiresInS) {
     const signingInput = withCrossResourceClaims(unsigned, info, sid);
     const signatureBytes = await cryptoProvider.sign(new TextEncoder().encode(signingInput), signingPrivateKey);
     const signature = base64urlEncodeFromBytes(signatureBytes);
-    return completeVCJWT(signingInput, signature);
+    // Return the resolved subject alongside the JWT so the notify report sends the
+    // SAME DID the VC carries (never an empty `agent_did`, which mismatches the VC
+    // and fails checkpoint's notify schema).
+    return {
+        vcJwt: completeVCJWT(signingInput, signature),
+        subjectDid: agentDid,
+    };
 }
 // ── Public handlers ──────────────────────────────────────────────────────────
 /**
@@ -335,6 +394,19 @@ export async function handleAnchorConsentGet(c, sid, env, _cfg) {
     }
     const info = (await infoResponse.json());
     const csrfToken = await mintCsrfToken(env, sid);
+    // When the project protects these scopes with a credential provider (merchant
+    // sign-in), render the branded sign-in form instead of the bare "Allow" form —
+    // so the shopper authenticates before authorizing and the minted delegation is
+    // bound to their identity. Falls back to consent-only when there is no such
+    // provider (resolution failed, or no checkpoint link), preserving today's
+    // behavior exactly.
+    const resolution = await resolveAnchorCredentialProvider(env, info.requiredScopes);
+    if (resolution.status === "credential") {
+        return htmlResponse(credentialFormPage(sid, info, resolution.provider, csrfToken), 200);
+    }
+    // "none" and "unavailable" both render the consent-only form. On "unavailable"
+    // the approve POST re-resolves and FAILS CLOSED, so a form shown during a
+    // transient error can never lead to an anonymous mint for a credential project.
     return htmlResponse(approveFormPage(sid, info, csrfToken), 200);
 }
 /**
@@ -342,10 +414,14 @@ export async function handleAnchorConsentGet(c, sid, env, _cfg) {
  * parks it on the anchor; an expired/unknown anchor makes the approval FAIL.
  */
 export async function handleAnchorConsentApprove(c, sid, env, cfg) {
+    // Read the POST body EXACTLY ONCE. The CSRF token and the credential fields
+    // both live in it; reading it twice (a second clone after CSRF) is unreliable
+    // across runtimes — the second read can throw and silently yield empty
+    // credentials, failing every sign-in. Extract everything from this one parse.
+    const bodyFields = await readBodyFields(c);
     // CSRF, unless test mode relaxes it for miniflare POSTs.
     if (!isTestConsentMode(env)) {
-        const csrfToken = await readCsrfTokenFromBody(c);
-        const valid = await validateCsrfToken(env, sid, csrfToken);
+        const valid = await validateCsrfToken(env, sid, bodyFields.csrf_token);
         if (!valid) {
             return htmlResponse(page("Authorization failed", `<main class="kya-consent-failed"><h1>Authorization failed</h1><p>Invalid or missing security token. Please reload and try again.</p></main>`), 403);
         }
@@ -363,9 +439,55 @@ export async function handleAnchorConsentApprove(c, sid, env, cfg) {
         return approvalFailedPage("This authorization request could not be loaded. Please start over.", 502);
     }
     const info = (await infoResponse.json());
+    // Credential path: when a credential provider protects these scopes, the
+    // shopper must sign in before we mint. Authenticate against the provider's own
+    // endpoint, then resolve the checkpoint user DID — both BEFORE minting, so a
+    // bad password parks nothing. `null` provider → consent-only (unchanged).
+    const resolution = await resolveAnchorCredentialProvider(env, info.requiredScopes);
+    // Fail CLOSED when the sign-in requirement could not be determined (a
+    // checkpoint /providers error or ambiguous config). Falling through to a
+    // consent-only mint here would skip merchant sign-in for a credential-
+    // protected project on a transient error — the exact bypass we must prevent.
+    if (resolution.status === "unavailable") {
+        return approvalFailedPage("We could not verify the sign-in requirement for this request. Please try again.", 503);
+    }
+    const provider = resolution.status === "credential" ? resolution.provider : null;
+    let authorizedUser = null;
+    if (provider) {
+        const credentials = {};
+        for (const name of credentialFieldNames(provider)) {
+            if (bodyFields[name] !== undefined)
+                credentials[name] = bodyFields[name];
+        }
+        const handler = createCredentialAuthHandler({
+            fetch: (...args) => globalThis.fetch(...args),
+            logger: (msg, data) => console.debug(`[kya-http] ${msg}`, data),
+        });
+        const authResult = await handler.authenticate(provider.config, credentials);
+        if (!authResult.success) {
+            return htmlResponse(page("Sign-in failed", `<main class="kya-consent-failed"><h1>Sign-in failed</h1><p>${escapeHtml(authResult.error ||
+                "Those credentials were not accepted. Please try again.")}</p></main>`), 401);
+        }
+        const identity = await resolveCredentialIdentity(env, {
+            projectId: env.AGENTSHIELD_PROJECT_ID || "",
+            provider: provider.providerId,
+            userId: authResult.userId || "unknown",
+            userEmail: authResult.userEmail,
+            userDisplayName: authResult.userDisplayName,
+        });
+        if (!identity.success || !identity.userDid) {
+            return approvalFailedPage("We signed you in but could not resolve your identity. Please start over.", 500);
+        }
+        authorizedUser = {
+            userDid: identity.userDid,
+            userId: authResult.userId,
+            userEmail: authResult.userEmail,
+        };
+    }
     let vcJwt;
+    let subjectDid;
     try {
-        vcJwt = await mintDelegationVcJwt(env, sid, info, cfg.delegationExpiresInS);
+        ({ vcJwt, subjectDid } = await mintDelegationVcJwt(env, sid, info, cfg.delegationExpiresInS));
     }
     catch (error) {
         // A mint failure (keygen/sign) must surface as a styled no-store error page, not
@@ -389,30 +511,63 @@ export async function handleAnchorConsentApprove(c, sid, env, cfg) {
     if (!approveResponse.ok) {
         return approvalFailedPage("We could not complete the authorization. Please start over.", 502);
     }
+    // Report the minted delegation to checkpoint so it appears in the dashboard,
+    // attributed to the signed-in customer. Only the credential path has a
+    // `user_did` (the notify schema requires one), so a consent-only anchor
+    // reports nothing — there is no user to attribute it to.
+    if (authorizedUser && provider) {
+        // FIRE-AND-FORGET: dispatch the report but NEVER await it — the VC is already
+        // parked and the shopper's approval must not hang on a slow/hung checkpoint.
+        // `waitUntil` (when the runtime provides it) lets the report finish after the
+        // success page is returned; `notifyDelegation` swallows its own errors.
+        const report = notifyDelegation(env, {
+            sid,
+            agentDid: subjectDid,
+            userDid: authorizedUser.userDid,
+            userId: authorizedUser.userId,
+            userIdentifier: authorizedUser.userEmail,
+            scopes: info.requiredScopes,
+            provider: provider.providerId,
+            // Record the same expiry the VC was minted with, matching the OAuth path.
+            expiresAt: new Date(Date.now() + cfg.delegationExpiresInS * 1000).toISOString(),
+        });
+        const execCtx = c.executionCtx;
+        execCtx?.waitUntil?.(report);
+    }
     return successPage();
 }
 /**
- * Read the `csrf_token` form field from the POST body via the underlying native
- * Request (`c.req.raw`). The sid travels in the query, so consuming the body here
- * never interferes with route-order interception. Returns undefined on parse failure.
+ * Read every string field from the POST body ONCE via the underlying native
+ * Request (`c.req.raw`), for both the CSRF token and the credential fields. Reads
+ * `raw` directly (no clone) because it is consumed a single time — a second read
+ * of the same body is unreliable across runtimes. The sid travels in the query,
+ * so consuming the body here never interferes with route-order interception.
+ * Returns an empty object on parse failure.
  */
-async function readCsrfTokenFromBody(c) {
+async function readBodyFields(c) {
+    const out = {};
     const raw = c.req?.raw;
     if (!raw)
-        return undefined;
+        return out;
     try {
         const contentType = raw.headers.get("Content-Type") || "";
         if (contentType.includes("application/json")) {
-            const body = (await raw.clone().json());
-            const token = body?.csrf_token;
-            return typeof token === "string" ? token : undefined;
+            const body = (await raw.json());
+            for (const [key, value] of Object.entries(body)) {
+                if (typeof value === "string")
+                    out[key] = value;
+            }
+            return out;
         }
-        const form = await raw.clone().formData();
-        const token = form.get("csrf_token");
-        return typeof token === "string" ? token : undefined;
+        const form = await raw.formData();
+        form.forEach((value, key) => {
+            if (typeof value === "string")
+                out[key] = value;
+        });
+        return out;
     }
     catch {
-        return undefined;
+        return out;
     }
 }
 //# sourceMappingURL=consent-anchor-bridge.js.map

package/dist/delegation-http/consent-anchor-bridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"consent-anchor-bridge.js","sourceRoot":"","sources":["../../src/delegation-http/consent-anchor-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,wBAAwB,EACxB,cAAc,GAEf,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,2CAA2C,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE5E,wFAAwF;AACxF,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AA2BjD;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,GAAkB,EAClB,GAAW,EACX,YAAoB,EACpB,IAAa;IAEb,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,IAAI,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,EACpD;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CACF,CAAC;IACF,OAAO,QAA0C,CAAC;AACpD,CAAC;AAED,oEAAoE;AACpE,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,IAAI,CAAC,KAAa,EAAE,SAAiB;IAC5C,OAAO;;;;;SAKA,UAAU,CAAC,KAAK,CAAC;;;EAGxB,SAAS;;QAEH,CAAC;AACT,CAAC;AAED,sDAAsD;AACtD,SAAS,WAAW;IAClB,OAAO,YAAY,CACjB,IAAI,CACF,4BAA4B,EAC5B;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,0CAA0C;AAC1C,SAAS,YAAY;IACnB,OAAO,YAAY,CACjB,IAAI,CACF,iCAAiC,EACjC;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,kBAAkB,CAAC,OAAe,EAAE,MAAM,GAAG,GAAG;IACvD,OAAO,YAAY,CACjB,IAAI,CACF,sBAAsB,EACtB;;KAED,UAAU,CAAC,OAAO,CAAC;QAChB,CACH,EACD,MAAM,CACP,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,SAAS,WAAW;IAClB,OAAO,YAAY,CACjB,IAAI,CACF,wBAAwB,EACxB;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,GAAW,EACX,IAAgB,EAChB,SAAiB;IAEjB,MAAM,UAAU,GACd,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QAC5B,CAAC,CAAC,IAAI,CAAC,cAAc;aAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;aAC9D,IAAI,CAAC,EAAE,CAAC;QACb,CAAC,CAAC,mEAAmE,CAAC;IAE1E,OAAO,IAAI,CACT,oBAAoB,EACpB;;;mCAG+B,UAAU;mDACM,kBAAkB,CAAC,GAAG,CAAC;yCACjC,UAAU,CAAC,GAAG,CAAC;gDACR,UAAU,CAAC,SAAS,CAAC;;;QAG7D,CACL,CAAC;AACJ,CAAC;AAED,oFAAoF;AAEpF,8CAA8C;AAC9C,SAAS,oBAAoB,CAAC,KAAiB;IAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACvC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,uDAAuD;AACvD,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,oBAAoB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,wFAAwF;AACxF,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,QAAQ,MAAM,EAAE,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,0EAA0E;AAC1E,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,GAAW;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;IAChD,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,oBAAoB,CAClC,IAAI,UAAU,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAC1D,CAAC;IACF,OAAO,GAAG,OAAO,IAAI,UAAU,EAAE,CAAC;AACpC,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,iBAAiB,CAC9B,GAAkB,EAClB,GAAW,EACX,KAAyB;IAEzB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,gFAAgF;QAChF,gFAAgF;QAChF,gFAAgF;QAChF,uEAAuE;QACvE,8EAA8E;QAC9E,OAAO,CAAC,IAAI,CACV,oFAAoF,GAAG,GAAG,CAC3F,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAG3D,CAAC;QACF,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACtC,IACE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC3C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,WAAW,GAAG,oBAAoB,CACtC,IAAI,UAAU,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAC1D,CAAC;QACF,OAAO,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAkB;IAC3C,+EAA+E;IAC/E,oFAAoF;IACpF,MAAM,GAAG,GAAG,GAAyC,CAAC;IACtD,IAAI,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC3D,oFAAoF;IACpF,oDAAoD;IACpD,MAAM,WAAW,GAAG,MAAM,CACxB,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CACtC,CAAC,WAAW,EAAE,CAAC;IAChB,OAAO,WAAW,KAAK,aAAa,CAAC;AACvC,CAAC;AAED,mFAAmF;AAEnF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,uBAAuB,CAC9B,QAAgD,EAChD,IAAgB,EAChB,GAAW;IAEX,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC,YAAY,CAAC;IACjD,MAAM,OAAO,GAA4B;QACvC,GAAG,QAAQ,CAAC,OAAO;QACnB,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,GAAG;QACH,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,OAAO,GAAG,QAAQ,CAAC,aAAa,IAAI,qBAAqB,CACvD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,EAAE,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,mBAAmB,CAChC,GAAkB,EAClB,GAAW,EACX,IAAgB,EAChB,UAAkB;IAElB,MAAM,cAAc,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAC/C,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAEtD,IAAI,SAAiB,CAAC;IACtB,IAAI,KAAa,CAAC;IAClB,IAAI,iBAAyB,CAAC;IAC9B,IAAI,kBAAkB,EAAE,CAAC;QACvB,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC;QACnC,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC;QAC/B,iBAAiB,GAAG,kBAAkB,CAAC,UAAU,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,eAAe,EAAE,CAAC;QAC1D,SAAS,GAAG,wBAAwB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3D,KAAK,GAAG,GAAG,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC;IAC5C,CAAC;IAED,6EAA6E;IAC7E,gFAAgF;IAChF,gFAAgF;IAChF,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,sBAAsB,IAAI,SAAS,CAAC;IAE1E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAqB;QACnC,EAAE,EAAE,YAAY,GAAG,EAAE;QACrB,SAAS;QACT,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,YAAY,GAAG,EAAE;QACvB,WAAW,EAAE;YACX,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,IAAI,GAAG,UAAU;YAC3B,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,EAAE;QAChD,EAAE,EAAE,YAAY,GAAG,EAAE;QACrB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACvC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAE1D,MAAM,QAAQ,GAAG,mBAAmB,CAClC,YAAuC,EACvC,EAAE,KAAK,EAAE,CACV,CAAC;IACF,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,YAAY,GAAG,uBAAuB,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,IAAI,CAC9C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,iBAAiB,CAClB,CAAC;IACF,MAAM,SAAS,GAAG,wBAAwB,CAAC,cAAc,CAAC,CAAC;IAE3D,OAAO,aAAa,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,CAAc,EACd,GAAW,EACX,GAAkB,EAClB,IAAmC;IAEnC,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE;QACpE,GAAG;KACJ,CAAC,CAAC;IAEH,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,EAAE,CAAC;IACtD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,kBAAkB,CACvB,oEAAoE,EACpE,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAe,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,YAAY,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,CAAc,EACd,GAAW,EACX,GAAkB,EAClB,GAAkC;IAElC,yDAAyD;IACzD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,YAAY,CACjB,IAAI,CACF,sBAAsB,EACtB,6IAA6I,CAC9I,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE;QACpE,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAChC,OAAO,kBAAkB,CACvB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,kBAAkB,CACvB,oEAAoE,EACpE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAe,CAAC;IAEvD,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iFAAiF;QACjF,iFAAiF;QACjF,kDAAkD;QAClD,OAAO,CAAC,IAAI,CACV,0CAA0C,GAAG,IAAI,EACjD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACF,OAAO,kBAAkB,CACvB,6DAA6D,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,EAAE;QAC1E,GAAG;QACH,KAAK;QACL,UAAU,EAAE,GAAG,CAAC,oBAAoB;KACrC,CAAC,CAAC;IAEH,iFAAiF;IACjF,2EAA2E;IAC3E,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACnC,OAAO,kBAAkB,CACvB,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IAC1D,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;QACxB,OAAO,kBAAkB,CACvB,6DAA6D,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAClC,CAAc;IAEd,MAAM,GAAG,GAAI,CAA4C,CAAC,GAAG,EAAE,GAAG,CAAC;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAA4B,CAAC;YACnE,MAAM,KAAK,GAAG,IAAI,EAAE,UAAU,CAAC;YAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACvD,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"consent-anchor-bridge.js","sourceRoot":"","sources":["../../src/delegation-http/consent-anchor-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,wBAAwB,EACxB,cAAc,GAEf,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,2CAA2C,CAAC;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,gBAAgB,GAEjB,MAAM,sBAAsB,CAAC;AAE9B,wFAAwF;AACxF,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AA2BjD;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,GAAkB,EAClB,GAAW,EACX,YAAoB,EACpB,IAAa;IAEb,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,IAAI,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,EACpD;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CACF,CAAC;IACF,OAAO,QAA0C,CAAC;AACpD,CAAC;AAED,oEAAoE;AACpE,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,IAAI,CAAC,KAAa,EAAE,SAAiB;IAC5C,OAAO;;;;;SAKA,UAAU,CAAC,KAAK,CAAC;;;EAGxB,SAAS;;QAEH,CAAC;AACT,CAAC;AAED,sDAAsD;AACtD,SAAS,WAAW;IAClB,OAAO,YAAY,CACjB,IAAI,CACF,4BAA4B,EAC5B;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,0CAA0C;AAC1C,SAAS,YAAY;IACnB,OAAO,YAAY,CACjB,IAAI,CACF,iCAAiC,EACjC;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,kBAAkB,CAAC,OAAe,EAAE,MAAM,GAAG,GAAG;IACvD,OAAO,YAAY,CACjB,IAAI,CACF,sBAAsB,EACtB;;KAED,UAAU,CAAC,OAAO,CAAC;QAChB,CACH,EACD,MAAM,CACP,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,SAAS,WAAW;IAClB,OAAO,YAAY,CACjB,IAAI,CACF,wBAAwB,EACxB;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,GAAW,EACX,IAAgB,EAChB,SAAiB;IAEjB,MAAM,UAAU,GACd,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QAC5B,CAAC,CAAC,IAAI,CAAC,cAAc;aAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;aAC9D,IAAI,CAAC,EAAE,CAAC;QACb,CAAC,CAAC,mEAAmE,CAAC;IAE1E,OAAO,IAAI,CACT,oBAAoB,EACpB;;;mCAG+B,UAAU;mDACM,kBAAkB,CAAC,GAAG,CAAC;yCACjC,UAAU,CAAC,GAAG,CAAC;gDACR,UAAU,CAAC,SAAS,CAAC;;;QAG7D,CACL,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,QAAoC;IAChE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,kFAAkF;IAClF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CACzB,GAAW,EACX,IAAgB,EAChB,QAAoC,EACpC,SAAiB;IAEjB,MAAM,UAAU,GACd,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QAC5B,CAAC,CAAC,IAAI,CAAC,cAAc;aAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;aAC9D,IAAI,CAAC,EAAE,CAAC;QACb,CAAC,CAAC,mEAAmE,CAAC;IAE1E,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC;SAC/C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,iDAAiD,UAAU,CAChE,IAAI,CACL,KAAK,UAAU,CAAC,KAAK,CAAC;+CACkB,UAAU,CACjD,IAAI,CACL,WAAW,UAAU,CAAC,IAAI,CAAC,WAC1B,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAC1B,mBAAmB,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,aAAa,CAAC;IAC7E,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,OAAO,IAAI,CACT,oBAAoB,EACpB;;+BAE2B,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;;mCAE5B,UAAU;mDACM,kBAAkB,CAAC,GAAG,CAAC;yCACjC,UAAU,CAAC,GAAG,CAAC;gDACR,UAAU,CAAC,SAAS,CAAC;EACnE,WAAW;;;QAGL,CACL,CAAC;AACJ,CAAC;AAED,oFAAoF;AAEpF,8CAA8C;AAC9C,SAAS,oBAAoB,CAAC,KAAiB;IAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACvC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,uDAAuD;AACvD,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,oBAAoB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,wFAAwF;AACxF,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,QAAQ,MAAM,EAAE,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,0EAA0E;AAC1E,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,GAAW;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;IAChD,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,oBAAoB,CAClC,IAAI,UAAU,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAC1D,CAAC;IACF,OAAO,GAAG,OAAO,IAAI,UAAU,EAAE,CAAC;AACpC,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,iBAAiB,CAC9B,GAAkB,EAClB,GAAW,EACX,KAAyB;IAEzB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,gFAAgF;QAChF,gFAAgF;QAChF,gFAAgF;QAChF,uEAAuE;QACvE,8EAA8E;QAC9E,OAAO,CAAC,IAAI,CACV,oFAAoF,GAAG,GAAG,CAC3F,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAG3D,CAAC;QACF,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACtC,IACE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC3C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,WAAW,GAAG,oBAAoB,CACtC,IAAI,UAAU,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAC1D,CAAC;QACF,OAAO,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAkB;IAC3C,+EAA+E;IAC/E,oFAAoF;IACpF,MAAM,GAAG,GAAG,GAAyC,CAAC;IACtD,IAAI,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC3D,oFAAoF;IACpF,oDAAoD;IACpD,MAAM,WAAW,GAAG,MAAM,CACxB,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CACtC,CAAC,WAAW,EAAE,CAAC;IAChB,OAAO,WAAW,KAAK,aAAa,CAAC;AACvC,CAAC;AAED,mFAAmF;AAEnF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,uBAAuB,CAC9B,QAAgD,EAChD,IAAgB,EAChB,GAAW;IAEX,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC,YAAY,CAAC;IACjD,MAAM,OAAO,GAA4B;QACvC,GAAG,QAAQ,CAAC,OAAO;QACnB,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,GAAG;QACH,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,OAAO,GAAG,QAAQ,CAAC,aAAa,IAAI,qBAAqB,CACvD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,EAAE,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,mBAAmB,CAChC,GAAkB,EAClB,GAAW,EACX,IAAgB,EAChB,UAAkB;IAElB,MAAM,cAAc,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAC/C,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAEtD,IAAI,SAAiB,CAAC;IACtB,IAAI,KAAa,CAAC;IAClB,IAAI,iBAAyB,CAAC;IAC9B,IAAI,kBAAkB,EAAE,CAAC;QACvB,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC;QACnC,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC;QAC/B,iBAAiB,GAAG,kBAAkB,CAAC,UAAU,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,eAAe,EAAE,CAAC;QAC1D,SAAS,GAAG,wBAAwB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3D,KAAK,GAAG,GAAG,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC;IAC5C,CAAC;IAED,6EAA6E;IAC7E,gFAAgF;IAChF,gFAAgF;IAChF,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,sBAAsB,IAAI,SAAS,CAAC;IAE1E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAqB;QACnC,EAAE,EAAE,YAAY,GAAG,EAAE;QACrB,SAAS;QACT,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,YAAY,GAAG,EAAE;QACvB,WAAW,EAAE;YACX,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,IAAI,GAAG,UAAU;YAC3B,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,EAAE;QAChD,EAAE,EAAE,YAAY,GAAG,EAAE;QACrB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACvC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAE1D,MAAM,QAAQ,GAAG,mBAAmB,CAClC,YAAuC,EACvC,EAAE,KAAK,EAAE,CACV,CAAC;IACF,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,YAAY,GAAG,uBAAuB,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,IAAI,CAC9C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,iBAAiB,CAClB,CAAC;IACF,MAAM,SAAS,GAAG,wBAAwB,CAAC,cAAc,CAAC,CAAC;IAE3D,+EAA+E;IAC/E,+EAA+E;IAC/E,yCAAyC;IACzC,OAAO;QACL,KAAK,EAAE,aAAa,CAAC,YAAY,EAAE,SAAS,CAAC;QAC7C,UAAU,EAAE,QAAQ;KACrB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,CAAc,EACd,GAAW,EACX,GAAkB,EAClB,IAAmC;IAEnC,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE;QACpE,GAAG;KACJ,CAAC,CAAC;IAEH,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,EAAE,CAAC;IACtD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,kBAAkB,CACvB,oEAAoE,EACpE,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAe,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAEhD,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,0EAA0E;IAC1E,oBAAoB;IACpB,MAAM,UAAU,GAAG,MAAM,+BAA+B,CACtD,GAAG,EACH,IAAI,CAAC,cAAc,CACpB,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QACvC,OAAO,YAAY,CACjB,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,+EAA+E;IAC/E,0EAA0E;IAC1E,gFAAgF;IAChF,OAAO,YAAY,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,CAAc,EACd,GAAW,EACX,GAAkB,EAClB,GAAkC;IAElC,4EAA4E;IAC5E,8EAA8E;IAC9E,uEAAuE;IACvE,8EAA8E;IAC9E,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAC;IAE3C,yDAAyD;IACzD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,YAAY,CACjB,IAAI,CACF,sBAAsB,EACtB,6IAA6I,CAC9I,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE;QACpE,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAChC,OAAO,kBAAkB,CACvB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,kBAAkB,CACvB,oEAAoE,EACpE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAe,CAAC;IAEvD,yEAAyE;IACzE,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,MAAM,+BAA+B,CACtD,GAAG,EACH,IAAI,CAAC,cAAc,CACpB,CAAC;IACF,sEAAsE;IACtE,yEAAyE;IACzE,uEAAuE;IACvE,6EAA6E;IAC7E,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACxC,OAAO,kBAAkB,CACvB,iFAAiF,EACjF,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GACZ,UAAU,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,cAAc,GAIP,IAAI,CAAC;IAChB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,WAAW,GAA2B,EAAE,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,SAAS;gBAAE,WAAW,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,OAAO,GAAG,2BAA2B,CAAC;YAC1C,KAAK,EAAE,CAAC,GAAG,IAA8B,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;YACvE,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,GAAG,EAAE,EAAE,IAAI,CAAC;SAChE,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5E,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,YAAY,CACjB,IAAI,CACF,gBAAgB,EAChB,8DAA8D,UAAU,CACtE,UAAU,CAAC,KAAK;gBACd,wDAAwD,CAC3D,aAAa,CACf,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE;YACpD,SAAS,EAAE,GAAG,CAAC,sBAAsB,IAAI,EAAE;YAC3C,QAAQ,EAAE,QAAQ,CAAC,UAAU;YAC7B,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,SAAS;YACtC,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,eAAe,EAAE,UAAU,CAAC,eAAe;SAC5C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC3C,OAAO,kBAAkB,CACvB,0EAA0E,EAC1E,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,cAAc,GAAG;YACf,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,KAAa,CAAC;IAClB,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,mBAAmB,CAChD,GAAG,EACH,GAAG,EACH,IAAI,EACJ,GAAG,CAAC,oBAAoB,CACzB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iFAAiF;QACjF,iFAAiF;QACjF,kDAAkD;QAClD,OAAO,CAAC,IAAI,CACV,0CAA0C,GAAG,IAAI,EACjD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACF,OAAO,kBAAkB,CACvB,6DAA6D,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,EAAE;QAC1E,GAAG;QACH,KAAK;QACL,UAAU,EAAE,GAAG,CAAC,oBAAoB;KACrC,CAAC,CAAC;IAEH,iFAAiF;IACjF,2EAA2E;IAC3E,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACnC,OAAO,kBAAkB,CACvB,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IAC1D,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;QACxB,OAAO,kBAAkB,CACvB,6DAA6D,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,uEAAuE;IACvE,wEAAwE;IACxE,yDAAyD;IACzD,IAAI,cAAc,IAAI,QAAQ,EAAE,CAAC;QAC/B,8EAA8E;QAC9E,6EAA6E;QAC7E,8EAA8E;QAC9E,wEAAwE;QACxE,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,EAAE;YACnC,GAAG;YACH,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,cAAc,CAAC,OAAO;YAC/B,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,cAAc,EAAE,cAAc,CAAC,SAAS;YACxC,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,QAAQ,EAAE,QAAQ,CAAC,UAAU;YAC7B,0EAA0E;YAC1E,SAAS,EAAE,IAAI,IAAI,CACjB,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,oBAAoB,GAAG,IAAI,CAC7C,CAAC,WAAW,EAAE;SAChB,CAAC,CAAC;QACH,MAAM,OAAO,GACX,CAGD,CAAC,YAAY,CAAC;QACf,OAAO,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAAC,CAAc;IAC1C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,GAAG,GAAI,CAA4C,CAAC,GAAG,EAAE,GAAG,CAAC;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAClD,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/delegation-http/credential-consent.d.ts

@@ -0,0 +1,147 @@
+/**
+ * Credential-backed consent for the §8.1 anchor path.
+ *
+ * The anchor consent bridge (`consent-anchor-bridge.ts`) was consent-only: it
+ * rendered an "Allow" form, minted an anonymous delegation, and reported
+ * nothing to checkpoint. When a project's tool protection requires a credential
+ * provider (merchant sign-in), the branded consent an agent is redirected to
+ * must instead authenticate the shopper and mint a delegation bound to their
+ * identity — the same outcome the NATIVE MCP consent (`consent.service.ts`)
+ * produces, reached here for the HTTP-challenge transport.
+ *
+ * This module holds the runtime-agnostic pieces that don't belong inline in the
+ * bridge:
+ *  - {@link resolveCredentialIdentity} — customer → `user_did` via checkpoint's
+ *    `/api/v1/bouncer/identity/resolve` (lifted verbatim from
+ *    `consent.service.ts`, which needs nothing but `env`).
+ *  - {@link notifyDelegation} — fire-and-forget report to checkpoint's
+ *    `/api/v1/bouncer/delegations/notify` so the minted delegation appears in
+ *    the dashboard, attributed to the signed-in customer. This call is the ONLY
+ *    path that populates dashboard visibility, and its schema REQUIRES a
+ *    `user_did` — which is exactly why the anchor path could never show up
+ *    while it was consent-only.
+ *  - {@link sidToDelegationUuid} — the anchor sid (`kya-…`) is not a UUID, but
+ *    the notify schema demands `delegation_id` be one; this maps a sid to a
+ *    stable UUID so repeated notifies for the same anchor stay idempotent.
+ *
+ * @module @kya-os/mcp-i-cloudflare/delegation-http/credential-consent
+ */
+import type { CredentialProviderConfig } from "@kya-os/contracts/config";
+import type { CloudflareEnv } from "../types";
+/** A resolved credential provider the anchor consent should authenticate with. */
+export interface ResolvedCredentialProvider {
+    /** The provider id (dashboard key), used for identity resolution + notify. */
+    providerId: string;
+    /** Human-readable name for the consent page heading. */
+    displayName: string;
+    /** The provider config the credential auth handler consumes. */
+    config: CredentialProviderConfig;
+}
+/**
+ * The result of resolving whether the anchored scopes need credential auth.
+ *
+ * `unavailable` is deliberately distinct from `none`: it means we could NOT
+ * determine the requirement (the checkpoint `/providers` fetch failed, or its
+ * answer was ambiguous/malformed). The approve handler MUST fail closed on
+ * `unavailable` rather than mint an anonymous delegation — otherwise a transient
+ * error would silently skip merchant sign-in for a credential-protected project.
+ */
+export type AnchorCredentialResolution = {
+    status: "credential";
+    provider: ResolvedCredentialProvider;
+} | {
+    status: "none";
+} | {
+    status: "unavailable";
+};
+/**
+ * Resolve whether the project has a credential (merchant sign-in) provider the
+ * anchor consent should authenticate against, by fetching checkpoint's
+ * `/api/v1/bouncer/projects/{projectId}/providers` (the CRED-001 endpoint that
+ * returns full credential configs — authEndpoint / requestBodyTemplate /
+ * responseFields / successCheck — the same source the native consent uses).
+ *
+ * Returns `none` (→ consent-only) when the deployment has no checkpoint link or
+ * the project has no credential provider; `unavailable` (→ fail closed on mint)
+ * when the requirement could not be determined (fetch error / ambiguous config);
+ * `credential` with the provider otherwise. NEVER throws.
+ *
+ * v1 selection: prefer the project's `configuredProvider` when it is a credential
+ * provider; otherwise the single configured credential provider. When several
+ * credential providers exist with no default, resolution is `unavailable` (fail
+ * closed) rather than a silent anonymous mint — per-scope provider mapping is a
+ * documented follow-up.
+ */
+export declare function resolveAnchorCredentialProvider(env: CloudflareEnv, _scopes: string[]): Promise<AnchorCredentialResolution>;
+/** Params for {@link resolveCredentialIdentity}. */
+export interface ResolveCredentialIdentityParams {
+    projectId: string;
+    /** Credential provider id (e.g. the merchant provider). */
+    provider: string;
+    /** The customer id the provider's login returned. */
+    userId: string;
+    userEmail?: string;
+    userDisplayName?: string;
+}
+/**
+ * Resolve a signed-in customer to a checkpoint `user_did` via
+ * `/api/v1/bouncer/identity/resolve`. Mirrors
+ * `ConsentService.resolveCredentialIdentity` — it depends only on `env`
+ * (`AGENTSHIELD_API_URL` + `AGENTSHIELD_API_KEY`), never session/audit state, so
+ * it lives here as a free function the bridge can call directly. Returns
+ * `{ success: false }` (never throws) on any failure so the caller fails closed.
+ */
+export declare function resolveCredentialIdentity(env: CloudflareEnv, params: ResolveCredentialIdentityParams): Promise<{
+    success: boolean;
+    userDid?: string;
+}>;
+/**
+ * Map an anchor sid (`kya-` + 16–64 hex) to a stable RFC-4122 v4-shaped UUID.
+ *
+ * The notify schema pins `delegation_id` to a UUID, but a sid is not one. We
+ * derive it from the SHA-256 of the WHOLE sid so a repeated notify for the same
+ * anchor is idempotent (same sid → same id) while distinct sids stay distinct —
+ * hashing the full value avoids the collisions that truncating/repeating the raw
+ * hex would cause (sids longer than 32 hex would drop entropy; padded short sids
+ * could alias). The version nibble is forced to `4` and the variant nibble into
+ * the `8–b` range so the result passes strict UUID validators. This id
+ * identifies the dashboard row; it is intentionally NOT the VC's own
+ * `urn:uuid:${sid}` id.
+ */
+export declare function sidToDelegationUuid(sid: string): string;
+/** Params for {@link notifyDelegation}. */
+export interface NotifyDelegationParams {
+    /** The anchor sid the delegation was minted for. */
+    sid: string;
+    /** Subject (agent) DID the delegation was granted to. */
+    agentDid: string;
+    /** Human-readable agent name for the dashboard, if known. */
+    agentName?: string;
+    /** REQUIRED by the notify schema: the authorizing customer's DID. */
+    userDid: string;
+    /** Provider-native customer id. */
+    userId?: string;
+    /** Human-readable customer identifier (email) for dashboard display. */
+    userIdentifier?: string;
+    /** Granted scopes (at least one). */
+    scopes: string[];
+    /** Credential provider id. */
+    provider: string;
+    /** ISO-8601 expiry, if the delegation expires. */
+    expiresAt?: string;
+    /** Extra audit metadata merged into the report. */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Report a minted delegation to checkpoint so it appears in the dashboard,
+ * attributed to the signed-in customer. Fire-and-forget and best-effort: it
+ * NEVER throws and never blocks the consent response — a checkpoint hiccup must
+ * not fail an approval the user already granted. Matches the payload the OAuth
+ * path sends (`oauth-handler.ts`) against checkpoint's `notifyDelegationSchema`.
+ *
+ * No-ops (returns without a request) when the deployment has no
+ * `AGENTSHIELD_API_KEY` or `AGENTSHIELD_PROJECT_ID` — a self-hosted anchor with
+ * no checkpoint link has nothing to report to.
+ */
+export declare function notifyDelegation(env: CloudflareEnv, params: NotifyDelegationParams): Promise<void>;
+//# sourceMappingURL=credential-consent.d.ts.map

package/dist/delegation-http/credential-consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-consent.d.ts","sourceRoot":"","sources":["../../src/delegation-http/credential-consent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAG9C,kFAAkF;AAClF,MAAM,WAAW,0BAA0B;IACzC,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,MAAM,EAAE,wBAAwB,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAClC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,0BAA0B,CAAA;CAAE,GAC9D;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC;AAuI9B;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,+BAA+B,CACnD,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,0BAA0B,CAAC,CAwFrC;AAED,oDAAoD;AACpD,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,+BAA+B,GACtC,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgCjD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAYvD;AAED,2CAA2C;AAC3C,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,CA+Cf"}

package/dist/delegation-http/credential-consent.js

@@ -0,0 +1,287 @@
+import { DEFAULT_AGENTSHIELD_URL } from "../constants";
+import { sha256Hex } from "./hash";
+function readString(entry, camel, snake) {
+    const value = entry[camel] ?? entry[snake];
+    return typeof value === "string" ? value : undefined;
+}
+function readRecord(entry, camel, snake) {
+    const value = entry[camel] ?? entry[snake];
+    return value && typeof value === "object" ? value : undefined;
+}
+/** Whether an entry is a credential provider by its `type` discriminator. */
+function isCredentialTyped(entry) {
+    return (!!entry &&
+        (entry.type === "password" || entry.type === "credential") &&
+        entry.configured !== false);
+}
+/**
+ * Map a raw `successCheck` to the contract shape, reading `expectedValue` in
+ * either casing. Returns `undefined` for an absent, empty, or incomplete object
+ * (missing `path` or `expectedValue`) so a half-configured check is dropped
+ * rather than left to reject every successful login.
+ */
+function buildSuccessCheck(raw) {
+    if (!raw)
+        return undefined;
+    const path = typeof raw.path === "string" ? raw.path : undefined;
+    const expectedValue = raw.expectedValue ?? raw.expected_value;
+    if (!path || expectedValue === undefined)
+        return undefined;
+    if (typeof expectedValue !== "string" &&
+        typeof expectedValue !== "boolean" &&
+        typeof expectedValue !== "number") {
+        return undefined;
+    }
+    return { path, expectedValue };
+}
+/**
+ * Build a {@link CredentialProviderConfig} from a raw entry, reading every field
+ * in either casing (including the nested `responseFields`). Returns `null` when a
+ * required field is absent — a credential-typed entry that yields `null` must
+ * fail CLOSED at the call site, never fall through to an anonymous mint.
+ */
+function buildCredentialConfig(entry) {
+    const authEndpoint = readString(entry, "authEndpoint", "auth_endpoint");
+    const requestBodyTemplate = readRecord(entry, "requestBodyTemplate", "request_body_template");
+    const rawResponseFields = readRecord(entry, "responseFields", "response_fields");
+    if (!authEndpoint || !requestBodyTemplate || !rawResponseFields)
+        return null;
+    const sessionToken = readString(rawResponseFields, "sessionToken", "session_token");
+    if (!sessionToken)
+        return null;
+    const responseFields = {
+        sessionToken,
+        userId: readString(rawResponseFields, "userId", "user_id"),
+        userEmail: readString(rawResponseFields, "userEmail", "user_email"),
+        userDisplayName: readString(rawResponseFields, "userDisplayName", "user_display_name"),
+        expiresIn: readString(rawResponseFields, "expiresIn", "expires_in"),
+    };
+    // Map the nested successCheck fields BOTH ways (`expectedValue` /
+    // `expected_value`) and drop an empty/incomplete object entirely — leaving a
+    // snake_case `expected_value` unmapped would make the auth handler read
+    // `expectedValue` as undefined and reject a successful login as a failed check.
+    const successCheck = buildSuccessCheck(readRecord(entry, "successCheck", "success_check"));
+    const headers = readRecord(entry, "headers", "headers");
+    const tokenUsage = readString(entry, "tokenUsage", "token_usage");
+    const tokenHeader = readString(entry, "tokenHeader", "token_header");
+    const cookieFormat = readString(entry, "cookieFormat", "cookie_format");
+    return {
+        // The handler ignores `type`, but the contract's discriminant is "credential".
+        type: "credential",
+        displayName: readString(entry, "displayName", "display_name"),
+        authEndpoint,
+        requestBodyTemplate,
+        responseFields,
+        ...(successCheck ? { successCheck } : {}),
+        ...(headers ? { headers } : {}),
+        ...(tokenUsage ? { tokenUsage } : {}),
+        ...(tokenHeader ? { tokenHeader } : {}),
+        ...(cookieFormat ? { cookieFormat } : {}),
+    };
+}
+/**
+ * Resolve whether the project has a credential (merchant sign-in) provider the
+ * anchor consent should authenticate against, by fetching checkpoint's
+ * `/api/v1/bouncer/projects/{projectId}/providers` (the CRED-001 endpoint that
+ * returns full credential configs — authEndpoint / requestBodyTemplate /
+ * responseFields / successCheck — the same source the native consent uses).
+ *
+ * Returns `none` (→ consent-only) when the deployment has no checkpoint link or
+ * the project has no credential provider; `unavailable` (→ fail closed on mint)
+ * when the requirement could not be determined (fetch error / ambiguous config);
+ * `credential` with the provider otherwise. NEVER throws.
+ *
+ * v1 selection: prefer the project's `configuredProvider` when it is a credential
+ * provider; otherwise the single configured credential provider. When several
+ * credential providers exist with no default, resolution is `unavailable` (fail
+ * closed) rather than a silent anonymous mint — per-scope provider mapping is a
+ * documented follow-up.
+ */
+export async function resolveAnchorCredentialProvider(env, _scopes) {
+    const apiKey = env.AGENTSHIELD_API_KEY;
+    const projectId = env.AGENTSHIELD_PROJECT_ID;
+    // No checkpoint link → nothing to authenticate against → legitimately
+    // consent-only (this is not an error condition).
+    if (!apiKey || !projectId)
+        return { status: "none" };
+    const agentShieldUrl = env.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
+    let providersMap;
+    let configuredProvider;
+    try {
+        const response = await fetch(`${agentShieldUrl}/api/v1/bouncer/projects/${encodeURIComponent(projectId)}/providers`, {
+            method: "GET",
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                "Content-Type": "application/json",
+            },
+        });
+        // A non-2xx from checkpoint means we cannot confirm the auth requirement —
+        // fail closed rather than fall through to an anonymous mint.
+        if (!response.ok)
+            return { status: "unavailable" };
+        const body = (await response.json());
+        // A 200 with an UNEXPECTED shape (no `success`, or a missing/non-object
+        // `providers` map) is NOT the same as "no credential provider" — we cannot
+        // trust it to say the project is consent-only, so fail closed rather than
+        // read it as an empty map and mint anonymously.
+        if (body.success !== true ||
+            !body.data ||
+            typeof body.data.providers !== "object" ||
+            body.data.providers === null) {
+            return { status: "unavailable" };
+        }
+        providersMap = body.data.providers;
+        configuredProvider =
+            body.data.configuredProvider ?? body.data.configured_provider ?? null;
+    }
+    catch {
+        // Network/parse failure — same fail-closed reasoning as a non-2xx.
+        return { status: "unavailable" };
+    }
+    // Detect credential providers by their `type` discriminator (reliably present),
+    // NOT by whether a camelCase authEndpoint parsed — a snake_case entry must not
+    // silently look non-credential and drop to an anonymous mint.
+    const credentialIds = Object.keys(providersMap).filter((id) => isCredentialTyped(providersMap[id]));
+    // No credential provider configured → the project is genuinely consent-only.
+    if (credentialIds.length === 0)
+        return { status: "none" };
+    // Prefer the project's default provider when it is itself a credential provider;
+    // else fall back to the single configured credential provider.
+    const chosenId = configuredProvider && isCredentialTyped(providersMap[configuredProvider])
+        ? configuredProvider
+        : credentialIds.length === 1
+            ? credentialIds[0]
+            : null;
+    // Credential providers exist but we cannot pick one (several, no default) —
+    // fail closed rather than mint anonymously.
+    if (!chosenId)
+        return { status: "unavailable" };
+    const config = buildCredentialConfig(providersMap[chosenId]);
+    // A credential-TYPED provider we cannot fully parse (missing/odd-cased fields)
+    // must fail closed — never fall through to a consent-only anonymous mint.
+    if (!config)
+        return { status: "unavailable" };
+    return {
+        status: "credential",
+        provider: {
+            providerId: chosenId,
+            displayName: config.displayName || chosenId,
+            config,
+        },
+    };
+}
+/**
+ * Resolve a signed-in customer to a checkpoint `user_did` via
+ * `/api/v1/bouncer/identity/resolve`. Mirrors
+ * `ConsentService.resolveCredentialIdentity` — it depends only on `env`
+ * (`AGENTSHIELD_API_URL` + `AGENTSHIELD_API_KEY`), never session/audit state, so
+ * it lives here as a free function the bridge can call directly. Returns
+ * `{ success: false }` (never throws) on any failure so the caller fails closed.
+ */
+export async function resolveCredentialIdentity(env, params) {
+    const agentShieldUrl = env.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
+    const apiKey = env.AGENTSHIELD_API_KEY;
+    if (!apiKey)
+        return { success: false };
+    try {
+        const response = await fetch(`${agentShieldUrl}/api/v1/bouncer/identity/resolve`, {
+            method: "POST",
+            headers: {
+                "X-API-Key": apiKey,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                project_id: params.projectId,
+                credential_result: {
+                    provider: params.provider,
+                    user_id: params.userId,
+                    email: params.userEmail,
+                    name: params.userDisplayName,
+                },
+            }),
+        });
+        if (!response.ok)
+            return { success: false };
+        const data = (await response.json());
+        const userDid = data?.data?.user_did;
+        return userDid ? { success: true, userDid } : { success: false };
+    }
+    catch {
+        return { success: false };
+    }
+}
+/**
+ * Map an anchor sid (`kya-` + 16–64 hex) to a stable RFC-4122 v4-shaped UUID.
+ *
+ * The notify schema pins `delegation_id` to a UUID, but a sid is not one. We
+ * derive it from the SHA-256 of the WHOLE sid so a repeated notify for the same
+ * anchor is idempotent (same sid → same id) while distinct sids stay distinct —
+ * hashing the full value avoids the collisions that truncating/repeating the raw
+ * hex would cause (sids longer than 32 hex would drop entropy; padded short sids
+ * could alias). The version nibble is forced to `4` and the variant nibble into
+ * the `8–b` range so the result passes strict UUID validators. This id
+ * identifies the dashboard row; it is intentionally NOT the VC's own
+ * `urn:uuid:${sid}` id.
+ */
+export function sidToDelegationUuid(sid) {
+    // sha256Hex is a synchronous FIPS-180-4 digest (asserted against
+    // crypto.subtle) — lets this stay a pure sync helper.
+    const h = sha256Hex(sid).slice(0, 32).split("");
+    h[12] = "4"; // version 4
+    // Variant 10xx: keep entropy from the hash nibble, forcing the top two bits.
+    h[16] = ((parseInt(h[16], 16) & 0x3) | 0x8).toString(16);
+    const s = h.join("");
+    return `${s.slice(0, 8)}-${s.slice(8, 12)}-${s.slice(12, 16)}-${s.slice(16, 20)}-${s.slice(20, 32)}`;
+}
+/**
+ * Report a minted delegation to checkpoint so it appears in the dashboard,
+ * attributed to the signed-in customer. Fire-and-forget and best-effort: it
+ * NEVER throws and never blocks the consent response — a checkpoint hiccup must
+ * not fail an approval the user already granted. Matches the payload the OAuth
+ * path sends (`oauth-handler.ts`) against checkpoint's `notifyDelegationSchema`.
+ *
+ * No-ops (returns without a request) when the deployment has no
+ * `AGENTSHIELD_API_KEY` or `AGENTSHIELD_PROJECT_ID` — a self-hosted anchor with
+ * no checkpoint link has nothing to report to.
+ */
+export async function notifyDelegation(env, params) {
+    const apiKey = env.AGENTSHIELD_API_KEY;
+    const projectId = env.AGENTSHIELD_PROJECT_ID;
+    if (!apiKey || !projectId)
+        return;
+    const agentShieldUrl = env.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
+    try {
+        const response = await fetch(`${agentShieldUrl}/api/v1/bouncer/delegations/notify`, {
+            method: "POST",
+            headers: {
+                "X-API-Key": apiKey,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                delegation_id: sidToDelegationUuid(params.sid),
+                agent_did: params.agentDid,
+                agent_name: params.agentName || undefined,
+                user_did: params.userDid,
+                user_id: params.userId || undefined,
+                user_identifier: params.userIdentifier || undefined,
+                scopes: params.scopes,
+                provider: params.provider,
+                project_id: projectId,
+                created_at: new Date().toISOString(),
+                expires_at: params.expiresAt || undefined,
+                metadata: {
+                    source: "mcp-i-anchor-consent",
+                    sid: params.sid,
+                    ...params.metadata,
+                },
+            }),
+        });
+        if (!response.ok) {
+            console.warn(`[kya-http] delegation notify failed (non-blocking): ${response.status} sid=${params.sid}`);
+        }
+    }
+    catch (error) {
+        console.warn(`[kya-http] delegation notify failed (non-blocking): ${error instanceof Error ? error.message : String(error)} sid=${params.sid}`);
+    }
+}
+//# sourceMappingURL=credential-consent.js.map

package/dist/delegation-http/credential-consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-consent.js","sourceRoot":"","sources":["../../src/delegation-http/credential-consent.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAmCnC,SAAS,UAAU,CACjB,KAAuB,EACvB,KAAa,EACb,KAAa;IAEb,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CACjB,KAAuB,EACvB,KAAa,EACb,KAAa;IAEb,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB,CAAC,KAAmC;IAC5D,OAAO,CACL,CAAC,CAAC,KAAK;QACP,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;QAC1D,KAAK,CAAC,UAAU,KAAK,KAAK,CAC3B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CACxB,GAAiC;IAEjC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,MAAM,aAAa,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,cAAc,CAAC;IAC9D,IAAI,CAAC,IAAI,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3D,IACE,OAAO,aAAa,KAAK,QAAQ;QACjC,OAAO,aAAa,KAAK,SAAS;QAClC,OAAO,aAAa,KAAK,QAAQ,EACjC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,KAAuB;IAEvB,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;IACxE,MAAM,mBAAmB,GAAG,UAAU,CACpC,KAAK,EACL,qBAAqB,EACrB,uBAAuB,CACxB,CAAC;IACF,MAAM,iBAAiB,GAAG,UAAU,CAClC,KAAK,EACL,gBAAgB,EAChB,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC,YAAY,IAAI,CAAC,mBAAmB,IAAI,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAE7E,MAAM,YAAY,GAAG,UAAU,CAC7B,iBAAiB,EACjB,cAAc,EACd,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAE/B,MAAM,cAAc,GAA+C;QACjE,YAAY;QACZ,MAAM,EAAE,UAAU,CAAC,iBAAiB,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC1D,SAAS,EAAE,UAAU,CAAC,iBAAiB,EAAE,WAAW,EAAE,YAAY,CAAC;QACnE,eAAe,EAAE,UAAU,CACzB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,CACpB;QACD,SAAS,EAAE,UAAU,CAAC,iBAAiB,EAAE,WAAW,EAAE,YAAY,CAAC;KACpE,CAAC;IAEF,kEAAkE;IAClE,6EAA6E;IAC7E,wEAAwE;IACxE,gFAAgF;IAChF,MAAM,YAAY,GAAG,iBAAiB,CACpC,UAAU,CAAmB,KAAK,EAAE,cAAc,EAAE,eAAe,CAAC,CACrE,CAAC;IACF,MAAM,OAAO,GAAG,UAAU,CACxB,KAAK,EACL,SAAS,EACT,SAAS,CACV,CAAC;IACF,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,aAAa,CAEnD,CAAC;IACd,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;IAExE,OAAO;QACL,+EAA+E;QAC/E,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,cAAc,CAAC;QAC7D,YAAY;QACZ,mBAAmB;QACnB,cAAc;QACd,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,GAAkB,EAClB,OAAiB;IAEjB,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACvC,MAAM,SAAS,GAAG,GAAG,CAAC,sBAAsB,CAAC;IAC7C,sEAAsE;IACtE,iDAAiD;IACjD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAErD,MAAM,cAAc,GAAG,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;IAC1E,IAAI,YAA8C,CAAC;IACnD,IAAI,kBAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,cAAc,4BAA4B,kBAAkB,CAC7D,SAAS,CACV,YAAY,EACb;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,cAAc,EAAE,kBAAkB;aACnC;SACF,CACF,CAAC;QACF,2EAA2E;QAC3E,6DAA6D;QAC7D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAOlC,CAAC;QACF,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,gDAAgD;QAChD,IACE,IAAI,CAAC,OAAO,KAAK,IAAI;YACrB,CAAC,IAAI,CAAC,IAAI;YACV,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ;YACvC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,EAC5B,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACnC,CAAC;QACD,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAA6C,CAAC;QACvE,kBAAkB;YAChB,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;IAED,gFAAgF;IAChF,+EAA+E;IAC/E,8DAA8D;IAC9D,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAC5D,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CACpC,CAAC;IACF,6EAA6E;IAC7E,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE1D,iFAAiF;IACjF,+DAA+D;IAC/D,MAAM,QAAQ,GACZ,kBAAkB,IAAI,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;QACvE,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;YAC1B,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,IAAI,CAAC;IACb,4EAA4E;IAC5E,4CAA4C;IAC5C,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAEhD,MAAM,MAAM,GAAG,qBAAqB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,+EAA+E;IAC/E,0EAA0E;IAC1E,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAE9C,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE;YACR,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,QAAQ;YAC3C,MAAM;SACP;KACF,CAAC;AACJ,CAAC;AAaD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAkB,EAClB,MAAuC;IAEvC,MAAM,cAAc,GAAG,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;IAC1E,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,cAAc,kCAAkC,EACnD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,WAAW,EAAE,MAAM;gBACnB,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,MAAM,CAAC,SAAS;gBAC5B,iBAAiB,EAAE;oBACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,OAAO,EAAE,MAAM,CAAC,MAAM;oBACtB,KAAK,EAAE,MAAM,CAAC,SAAS;oBACvB,IAAI,EAAE,MAAM,CAAC,eAAe;iBAC7B;aACF,CAAC;SACH,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqC,CAAC;QACzE,MAAM,OAAO,GAAG,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;QACrC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,iEAAiE;IACjE,sDAAsD;IACtD,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,YAAY;IACzB,6EAA6E;IAC7E,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CACrE,EAAE,EACF,EAAE,CACH,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACzB,CAAC;AA0BD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAkB,EAClB,MAA8B;IAE9B,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACvC,MAAM,SAAS,GAAG,GAAG,CAAC,sBAAsB,CAAC;IAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;QAAE,OAAO;IAElC,MAAM,cAAc,GAAG,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,cAAc,oCAAoC,EACrD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,WAAW,EAAE,MAAM;gBACnB,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,aAAa,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC;gBAC9C,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;gBACzC,QAAQ,EAAE,MAAM,CAAC,OAAO;gBACxB,OAAO,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS;gBACnC,eAAe,EAAE,MAAM,CAAC,cAAc,IAAI,SAAS;gBACnD,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;gBACzC,QAAQ,EAAE;oBACR,MAAM,EAAE,sBAAsB;oBAC9B,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,GAAG,MAAM,CAAC,QAAQ;iBACnB;aACF,CAAC;SACH,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CACV,uDAAuD,QAAQ,CAAC,MAAM,QAAQ,MAAM,CAAC,GAAG,EAAE,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CACV,uDACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,QAAQ,MAAM,CAAC,GAAG,EAAE,CACrB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp-i-cloudflare",
-  "version": "1.12.1",
+  "version": "1.12.2",
   "description": "Cloudflare Workers adapter for MCP-I framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -29,9 +29,9 @@
   },
   "dependencies": {
     "@kya-os/consent": "^0.1.41",
-    "@kya-os/contracts": "^1.9.0",
+    "@kya-os/contracts": "^1.9.1",
     "@kya-os/mcp": "^1.10.1",
-    "@kya-os/mcp-i-core": "^1.8.1",
+    "@kya-os/mcp-i-core": "^1.8.2",
     "@kya-os/mcp-i-runtime": "^1.0.0",
     "@kya-os/provider-registry": "^0.1.7",
     "@modelcontextprotocol/sdk": "^1.25.2",