@kya-os/mcp-i-cloudflare 1.12.1 → 1.12.3

package/dist/delegation-http/consent-anchor-bridge.d.ts

@@ -9,8 +9,12 @@
  * consent service is untouched.
  *
  *  - `GET /consent?sid=kya-…` reads the anchor via `INTERNAL_PICKUP_INFO`. An unknown
- *    sid → 404 page; an expired sid → a "link expired" page; otherwise a minimal
- *    approve form (the consent-only scope list + a CSRF-protected POST).
+ *    sid → 404 page; an expired sid → a "link expired" page; otherwise the SAME
+ *    branded `@kya-os/consent` Lit shell `consent.service.ts` renders for the
+ *    OAuth path, driven by the project's own `consentConfig`. The anchor sid
+ *    travels to the approve POST as the shell's `session-id` attribute (see
+ *    `resolveApproveSid`), since the Lit component has no way to append a query
+ *    string to its hardcoded `/consent/approve` fetch target.
  *  - `POST /consent/approve?sid=kya-…` mints a delegation VC-JWT using the SAME
  *    `@kya-os/mcp` primitives `consent.service.ts` uses (`wrapDelegationAsVC` →
  *    `createUnsignedVCJWT` → sign → `completeVCJWT`) — calling them directly here, NOT
@@ -23,6 +27,23 @@
 import type { HonoContext } from "../runtime/oauth-handler";
 import type { CloudflareEnv } from "../types";
 import type { HttpChallengeConfig } from "../config";
+/**
+ * Resolve the anchor sid for `POST /consent/approve`. The `@kya-os/consent` Lit
+ * component (`mcp-consent.ts` `handleApprove()`) always fetches the hardcoded
+ * `${serverUrl}/consent/approve` — it has no way to append a query string — so
+ * the sid instead travels in the POST body as `session_id` (its own field name,
+ * populated from the `session-id` shell attribute {@link renderAnchorConsentShell}
+ * sets to the anchor sid). Falls back to the query for the legacy raw-HTML
+ * form's `action="/consent/approve?sid=…"` target, which some external PEPs may
+ * still construct directly.
+ *
+ * Peeks the body via `clone()` so the ORIGINAL request stream is never consumed
+ * here — `readBodyFields` still performs the one real body read, downstream in
+ * `handleAnchorConsentApprove`. `register.ts` calls this BEFORE routing so a
+ * flag-off or non-anchor `/consent/approve` POST falls through to `next()` with
+ * its body untouched (only a clone was ever read).
+ */
+export declare function resolveApproveSid(c: HonoContext): Promise<string | undefined>;
 /**
  * Render the anchor consent surface for `GET /consent?sid=kya-…`.
  */

package/dist/delegation-http/consent-anchor-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consent-anchor-bridge.d.ts","sourceRoot":"","sources":["../../src/delegation-http/consent-anchor-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAWH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AA6arD;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,CAAC,EAAE,WAAW,EACd,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GAClC,OAAO,CAAC,QAAQ,CAAC,CAiBnB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,CAAC,EAAE,WAAW,EACd,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GACjC,OAAO,CAAC,QAAQ,CAAC,CAyEnB"}
+{"version":3,"file":"consent-anchor-bridge.d.ts","sourceRoot":"","sources":["../../src/delegation-http/consent-anchor-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAkBH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAqVrD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,iBAAiB,CACrC,CAAC,EAAE,WAAW,GACb,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAyB7B;AA2QD;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,CAAC,EAAE,WAAW,EACd,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GAClC,OAAO,CAAC,QAAQ,CAAC,CA4DnB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,CAAC,EAAE,WAAW,EACd,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GACjC,OAAO,CAAC,QAAQ,CAAC,CAkNnB"}

package/dist/delegation-http/consent-anchor-bridge.js

@@ -9,8 +9,12 @@
  * consent service is untouched.
  *
  *  - `GET /consent?sid=kya-…` reads the anchor via `INTERNAL_PICKUP_INFO`. An unknown
- *    sid → 404 page; an expired sid → a "link expired" page; otherwise a minimal
- *    approve form (the consent-only scope list + a CSRF-protected POST).
+ *    sid → 404 page; an expired sid → a "link expired" page; otherwise the SAME
+ *    branded `@kya-os/consent` Lit shell `consent.service.ts` renders for the
+ *    OAuth path, driven by the project's own `consentConfig`. The anchor sid
+ *    travels to the approve POST as the shell's `session-id` attribute (see
+ *    `resolveApproveSid`), since the Lit component has no way to append a query
+ *    string to its hardcoded `/consent/approve` fetch target.
  *  - `POST /consent/approve?sid=kya-…` mints a delegation VC-JWT using the SAME
  *    `@kya-os/mcp` primitives `consent.service.ts` uses (`wrapDelegationAsVC` →
  *    `createUnsignedVCJWT` → sign → `completeVCJWT`) — calling them directly here, NOT
@@ -21,11 +25,16 @@
  * @module @kya-os/mcp-i-cloudflare/delegation-http/consent-anchor-bridge
  */
 import { wrapDelegationAsVC, createUnsignedVCJWT, completeVCJWT, base64urlEncodeFromBytes, generateDidKeyFromBase64, didKeyFragment, } from "@kya-os/mcp";
+import { generateConsentShell, resolveCapabilitiesForScopes, } from "@kya-os/consent";
 import { WebCryptoProvider } from "../providers/crypto";
 import { getConfiguredIdentity } from "../providers/storage";
 import { escapeHtml } from "../services/consent-templates/base/escape";
+import { createCredentialAuthHandler } from "../services/credential-auth.handler";
+import { ConsentConfigService, } from "../services/consent-config.service";
 import { getAnchorStub } from "./anchor-routing";
 import { INTERNAL_PICKUP_INFO, INTERNAL_PICKUP_APPROVE } from "./constants";
+import { isAnchorSid } from "./sid";
+import { resolveAnchorCredentialProvider, resolveCredentialIdentity, notifyDelegation, } from "./credential-consent";
 /** Internal origin for durable-object stub fetches — the DO routes by pathname only. */
 const DO_INTERNAL_ORIGIN = "https://do.internal";
 /**
@@ -51,6 +60,21 @@ function htmlResponse(html, status) {
         },
     });
 }
+/**
+ * A JSON response with the mandated `Cache-Control: no-store`. Mirrors
+ * {@link htmlResponse} — used by `POST /consent/approve` (a JSON API consumed
+ * by the `@kya-os/consent` Lit component's `fetch()`, never a browser
+ * navigation), unlike `GET /consent`, which still renders the HTML shell.
+ */
+function jsonResponse(body, status) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: {
+            "Content-Type": "application/json",
+            "Cache-Control": "no-store",
+        },
+    });
+}
 /** Minimal self-contained HTML page shell (no external bundle dependency). */
 function page(title, bodyInner) {
     return `<!DOCTYPE html>
@@ -86,33 +110,200 @@ function approvalFailedPage(message, status = 410) {
 <p>${escapeHtml(message)}</p>
 </main>`), status);
 }
-/** Success page after a delegation is parked on the anchor. */
-function successPage() {
-    return htmlResponse(page("Authorization complete", `<main class="kya-consent-success">
-<h1>Authorization complete</h1>
-<p>You have authorized the request. You can close this window and return to the application.</p>
-</main>`), 200);
+/**
+ * JSON 404 body for `POST /consent/approve` on an unknown anchor sid — the
+ * JSON-API twin of {@link notFoundPage} (which stays HTML-only for the `GET
+ * /consent` page render).
+ */
+function notFoundJson() {
+    return jsonResponse({
+        error: "We could not find this authorization request. It may have already completed or been cancelled.",
+    }, 404);
+}
+/**
+ * Generic JSON approval-failed body for `POST /consent/approve` (e.g. the
+ * anchor expired between GET and POST). The JSON-API twin of
+ * {@link approvalFailedPage}, which stays HTML-only for the `GET /consent`
+ * page render's own error cases.
+ */
+function approvalFailedJson(message, status = 410) {
+    return jsonResponse({ error: message }, status);
+}
+/**
+ * Success body after a delegation is parked on the anchor: `@kya-os/consent`'s
+ * `handleApprove()` reads `result.delegation_id` (and, absent a
+ * `redirectUrl`, renders its own success screen from it) — the anchor path
+ * mints in a single POST with no clickwrap redirect, so `redirectUrl` is
+ * deliberately omitted.
+ */
+function successJson(delegationId) {
+    return jsonResponse({ success: true, delegation_id: delegationId }, 200);
+}
+/**
+ * Resolve capability groups for the shell: prefer the operator-authored
+ * `consentConfig.capabilities`; otherwise derive from the anchor's required
+ * scopes via the `@kya-os/consent` default registry. Mirrors
+ * `consent.service.ts`'s own fallback so the humanized capability layout
+ * renders even when the dashboard hasn't pushed capability metadata yet.
+ */
+function resolveAnchorCapabilities(consentConfig, scopes) {
+    if (consentConfig.capabilities && consentConfig.capabilities.length > 0) {
+        return consentConfig.capabilities;
+    }
+    if (scopes.length === 0)
+        return undefined;
+    const derived = resolveCapabilitiesForScopes(scopes);
+    if (derived.length === 0)
+        return undefined;
+    return [{ id: "default", label: "Permissions", capabilities: derived }];
+}
+/**
+ * Render the branded `@kya-os/consent` Lit shell for the anchor path — the SAME
+ * screen `consent.service.ts` renders for the OAuth / consent-only flow
+ * (`TemplateRenderer.renderCSR` / `renderCredentialPageCSR`), driven by the
+ * project's own `consentConfig` (branding, terms, credentials copy, and
+ * capabilities) fetched via `ConsentConfigService`.
+ *
+ * `sessionId` carries the anchor `sid`: the Lit component's `handleApprove()`
+ * always POSTs to a hardcoded `${serverUrl}/consent/approve` with no way to
+ * append a query string, so the sid instead travels in the approve POST body as
+ * the component's own `session_id` field. `register.ts`'s approve route
+ * recovers it from there via `resolveApproveSid` when the query is empty.
+ */
+function renderAnchorConsentShell(params) {
+    const { consentConfig, info, sid, csrfToken, serverUrl, projectId, credential, } = params;
+    // Credential branch: source labels from the REAL merchant-configured fields —
+    // `provider.config.consentOverrides` (per-provider overrides:
+    // `identityFieldLabel` / `passwordFieldLabel`, populated by
+    // `credential-consent.ts`'s `buildCredentialConfig`) and the project's own
+    // `consentConfig.credentials` block (placeholders / remember-me / forgot-
+    // password, which have no per-provider equivalent at all) — falling back to
+    // the shell's hardcoded defaults last. `CredentialProviderConfig` has no
+    // top-level `usernameLabel`/`usernamePlaceholder`/etc fields (reading them was
+    // an `as any` bug that always silently fell to the hardcoded defaults); typing
+    // `cpc` for real lets the compiler catch that class of mistake again.
+    const cpc = credential?.provider.config;
+    const cpcOverrides = cpc?.consentOverrides;
+    const shellConfig = {
+        branding: consentConfig.branding,
+        terms: consentConfig.terms,
+        customFields: consentConfig.customFields,
+        ui: consentConfig.ui,
+        expirationDays: consentConfig.expirationDays,
+        credentials: credential
+            ? {
+                usernameLabel: cpcOverrides?.identityFieldLabel ||
+                    consentConfig.credentials?.usernameLabel ||
+                    "Username",
+                usernamePlaceholder: consentConfig.credentials?.usernamePlaceholder ||
+                    "Enter your username",
+                passwordLabel: cpcOverrides?.passwordFieldLabel ||
+                    consentConfig.credentials?.passwordLabel ||
+                    "Password",
+                passwordPlaceholder: consentConfig.credentials?.passwordPlaceholder ||
+                    "Enter your password",
+                showRememberMe: consentConfig.credentials?.showRememberMe ?? true,
+                showForgotPassword: consentConfig.credentials?.showForgotPassword ?? false,
+                forgotPasswordUrl: consentConfig.credentials?.forgotPasswordUrl,
+            }
+            : consentConfig.credentials,
+    };
+    const shellOptions = {
+        config: shellConfig,
+        tool: "",
+        scopes: info.requiredScopes,
+        agentDid: info.agentDid || "",
+        sessionId: sid,
+        projectId,
+        serverUrl,
+        // Browser-tab title only (the in-page heading is `shellConfig.ui.title`,
+        // shared across screens) — surface the provider's display name here for the
+        // credential branch instead of dropping it entirely.
+        pageTitle: credential
+            ? `Sign in to ${credential.provider.displayName}`
+            : "Permission Request",
+        csrfToken,
+        capabilities: resolveAnchorCapabilities(consentConfig, info.requiredScopes),
+        agentMetadata: consentConfig.agentMetadata,
+        consentTheme: consentConfig.theme,
+        headlineVerb: consentConfig.headlineVerb,
+        revocationPath: consentConfig.revocationPath,
+        inactivityDays: consentConfig.inactivityDays,
+        ...(credential
+            ? {
+                authMode: "credentials",
+                provider: credential.provider.providerId,
+                authorizationType: "password",
+            }
+            : {}),
+    };
+    return generateConsentShell(shellOptions);
+}
+/**
+ * Resolve the worker's own origin for the shell's `serverUrl` — the same-origin
+ * target the `@kya-os/consent` Lit component POSTs its approve request to.
+ * Prefers the explicit `MCP_SERVER_URL` env var (matches `consent.service.ts`'s
+ * own resolution), falling back to the incoming request's origin.
+ */
+function resolveServerUrl(env, c) {
+    const configured = env.MCP_SERVER_URL;
+    if (configured && configured !== "null" && configured.startsWith("http")) {
+        return configured;
+    }
+    const raw = c.req?.raw;
+    if (raw) {
+        try {
+            return new URL(raw.url).origin;
+        }
+        catch {
+            // Fall through to empty string (relative fetch — resolves against the
+            // page's own origin in a real browser).
+        }
+    }
+    return "";
 }
 /**
- * Render the minimal anchor approve form. Reuses the consent-only scope-list shape
- * (escaped scope items) and posts to `/consent/approve?sid=…` with a CSRF token.
+ * Resolve the anchor sid for `POST /consent/approve`. The `@kya-os/consent` Lit
+ * component (`mcp-consent.ts` `handleApprove()`) always fetches the hardcoded
+ * `${serverUrl}/consent/approve` — it has no way to append a query string — so
+ * the sid instead travels in the POST body as `session_id` (its own field name,
+ * populated from the `session-id` shell attribute {@link renderAnchorConsentShell}
+ * sets to the anchor sid). Falls back to the query for the legacy raw-HTML
+ * form's `action="/consent/approve?sid=…"` target, which some external PEPs may
+ * still construct directly.
+ *
+ * Peeks the body via `clone()` so the ORIGINAL request stream is never consumed
+ * here — `readBodyFields` still performs the one real body read, downstream in
+ * `handleAnchorConsentApprove`. `register.ts` calls this BEFORE routing so a
+ * flag-off or non-anchor `/consent/approve` POST falls through to `next()` with
+ * its body untouched (only a clone was ever read).
  */
-function approveFormPage(sid, info, csrfToken) {
-    const scopeItems = info.requiredScopes.length > 0
-        ? info.requiredScopes
-            .map((s) => `<li class="kya-scope-item">${escapeHtml(s)}</li>`)
-            .join("")
-        : `<li class="kya-scope-item">No specific permissions required.</li>`;
-    return page("Permission Request", `<main class="kya-consent">
-<h1>Authorize delegation</h1>
-<p class="kya-permissions-header">This request needs the following permissions:</p>
-<ul class="kya-permissions-list">${scopeItems}</ul>
-<form method="POST" action="/consent/approve?sid=${encodeURIComponent(sid)}">
-<input type="hidden" name="sid" value="${escapeHtml(sid)}">
-<input type="hidden" name="csrf_token" value="${escapeHtml(csrfToken)}">
-<button type="submit" class="kya-consent-allow">Allow</button>
-</form>
-</main>`);
+export async function resolveApproveSid(c) {
+    const query = c.req.query("sid");
+    if (isAnchorSid(query))
+        return query;
+    const raw = c.req?.raw;
+    if (!raw)
+        return undefined;
+    try {
+        const contentType = raw.headers.get("Content-Type") || "";
+        const clone = raw.clone();
+        let candidate;
+        if (contentType.includes("application/json")) {
+            const body = (await clone.json());
+            candidate = body.sid ?? body.session_id;
+        }
+        else {
+            const form = await clone.formData();
+            candidate = form.get("sid") ?? form.get("session_id");
+        }
+        return typeof candidate === "string" && isAnchorSid(candidate)
+            ? candidate
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
 }
 // ── CSRF (mirrors consent.service's HMAC token format, bound to the anchor sid) ──
 /** Base64url-encode bytes without padding. */
@@ -316,7 +507,13 @@ async function mintDelegationVcJwt(env, sid, info, expiresInS) {
     const signingInput = withCrossResourceClaims(unsigned, info, sid);
     const signatureBytes = await cryptoProvider.sign(new TextEncoder().encode(signingInput), signingPrivateKey);
     const signature = base64urlEncodeFromBytes(signatureBytes);
-    return completeVCJWT(signingInput, signature);
+    // Return the resolved subject alongside the JWT so the notify report sends the
+    // SAME DID the VC carries (never an empty `agent_did`, which mismatches the VC
+    // and fails checkpoint's notify schema).
+    return {
+        vcJwt: completeVCJWT(signingInput, signature),
+        subjectDid: agentDid,
+    };
 }
 // ── Public handlers ──────────────────────────────────────────────────────────
 /**
@@ -335,19 +532,56 @@ export async function handleAnchorConsentGet(c, sid, env, _cfg) {
     }
     const info = (await infoResponse.json());
     const csrfToken = await mintCsrfToken(env, sid);
-    return htmlResponse(approveFormPage(sid, info, csrfToken), 200);
+    const projectId = env.AGENTSHIELD_PROJECT_ID || "";
+    const consentConfig = await new ConsentConfigService(env).getConsentConfig(projectId);
+    const serverUrl = resolveServerUrl(env, c);
+    // When the project protects these scopes with a credential provider (merchant
+    // sign-in), render the branded sign-in form instead of the bare "Allow" form —
+    // so the shopper authenticates before authorizing and the minted delegation is
+    // bound to their identity. Falls back to consent-only when there is no such
+    // provider (resolution failed, or no checkpoint link), preserving today's
+    // behavior exactly.
+    const resolution = await resolveAnchorCredentialProvider(env, info.requiredScopes);
+    if (resolution.status === "credential") {
+        return htmlResponse(renderAnchorConsentShell({
+            consentConfig,
+            info,
+            sid,
+            csrfToken,
+            serverUrl,
+            projectId,
+            credential: { provider: resolution.provider },
+        }), 200);
+    }
+    // "none" and "unavailable" both render the consent-only form. On "unavailable"
+    // the approve POST re-resolves and FAILS CLOSED, so a form shown during a
+    // transient error can never lead to an anonymous mint for a credential project.
+    return htmlResponse(renderAnchorConsentShell({
+        consentConfig,
+        info,
+        sid,
+        csrfToken,
+        serverUrl,
+        projectId,
+    }), 200);
 }
 /**
  * Handle anchor approval for `POST /consent/approve?sid=kya-…`. Mints a VC-JWT and
  * parks it on the anchor; an expired/unknown anchor makes the approval FAIL.
  */
 export async function handleAnchorConsentApprove(c, sid, env, cfg) {
+    // Read the POST body EXACTLY ONCE. The CSRF token and the credential fields
+    // both live in it; reading it twice (a second clone after CSRF) is unreliable
+    // across runtimes — the second read can throw and silently yield empty
+    // credentials, failing every sign-in. Extract everything from this one parse.
+    const bodyFields = await readBodyFields(c);
     // CSRF, unless test mode relaxes it for miniflare POSTs.
     if (!isTestConsentMode(env)) {
-        const csrfToken = await readCsrfTokenFromBody(c);
-        const valid = await validateCsrfToken(env, sid, csrfToken);
+        const valid = await validateCsrfToken(env, sid, bodyFields.csrf_token);
         if (!valid) {
-            return htmlResponse(page("Authorization failed", `<main class="kya-consent-failed"><h1>Authorization failed</h1><p>Invalid or missing security token. Please reload and try again.</p></main>`), 403);
+            return jsonResponse({
+                error: "Invalid or missing security token. Please reload and try again.",
+            }, 403);
         }
     }
     // Read the anchor first: if it is already gone, fail BEFORE minting anything.
@@ -355,24 +589,83 @@ export async function handleAnchorConsentApprove(c, sid, env, cfg) {
         sid,
     });
     if (infoResponse.status === 404)
-        return notFoundPage();
+        return notFoundJson();
     if (infoResponse.status === 410) {
-        return approvalFailedPage("This authorization request has expired. Nothing was authorized.");
+        return approvalFailedJson("This authorization request has expired. Nothing was authorized.");
     }
     if (!infoResponse.ok) {
-        return approvalFailedPage("This authorization request could not be loaded. Please start over.", 502);
+        return approvalFailedJson("This authorization request could not be loaded. Please start over.", 502);
     }
     const info = (await infoResponse.json());
+    // Credential path: when a credential provider protects these scopes, the
+    // shopper must sign in before we mint. Authenticate against the provider's own
+    // endpoint, then resolve the checkpoint user DID — both BEFORE minting, so a
+    // bad password parks nothing. `null` provider → consent-only (unchanged).
+    const resolution = await resolveAnchorCredentialProvider(env, info.requiredScopes);
+    // Fail CLOSED when the sign-in requirement could not be determined (a
+    // checkpoint /providers error or ambiguous config). Falling through to a
+    // consent-only mint here would skip merchant sign-in for a credential-
+    // protected project on a transient error — the exact bypass we must prevent.
+    if (resolution.status === "unavailable") {
+        return approvalFailedJson("We could not verify the sign-in requirement for this request. Please try again.", 503);
+    }
+    const provider = resolution.status === "credential" ? resolution.provider : null;
+    let authorizedUser = null;
+    if (provider) {
+        // The @kya-os/consent Lit component always submits fixed `username` /
+        // `password` field names (see mcp-consent.ts `renderCredentials()`),
+        // regardless of the provider's own `requestBodyTemplate` placeholder names
+        // (e.g. `{{email}}`). Strip every meta field the shell's own
+        // `handleApprove()` can emit (session/routing metadata, never a credential)
+        // so a future provider `requestBodyTemplate` placeholder can never collide
+        // with it. This is NOT the same set `consent.service.ts`'s
+        // `handleCredentialApproval` destructures: that method also serves MCP
+        // inline-tool-call and OAuth-linked-clickwrap requests this anchor path
+        // never receives (`inline_mode`, `approved`), and has no `sid` (an
+        // anchor-only concept some external PEPs may still post in the body rather
+        // than the query). Pass everything else through as credentials;
+        // `credential-auth.handler.ts`'s own alias resolution
+        // (`resolveCredentialField`) maps `username`/`email`/`identifier`/… onto
+        // whatever the template actually needs.
+        const { sid: _sid, csrf_token: _csrfToken, tool: _tool, scopes: _scopes, agent_did: _agentDid, session_id: _sessionId, project_id: _projectId, provider: _providerField, provider_type: _providerType, auth_mode: _authMode, termsAccepted: _termsAccepted, credential_provider_type: _credentialProviderType, credential_provider: _credentialProvider, oauth_provider_type: _oauthProviderType, user_did: _userDid, credential_user_email: _credentialUserEmail, credential_provider_user_id: _credentialProviderUserId, ...credentials } = bodyFields;
+        const handler = createCredentialAuthHandler({
+            fetch: (...args) => globalThis.fetch(...args),
+            logger: (msg, data) => console.debug(`[kya-http] ${msg}`, data),
+        });
+        const authResult = await handler.authenticate(provider.config, credentials);
+        if (!authResult.success) {
+            return jsonResponse({
+                error: authResult.error ||
+                    "Those credentials were not accepted. Please try again.",
+            }, 401);
+        }
+        const identity = await resolveCredentialIdentity(env, {
+            projectId: env.AGENTSHIELD_PROJECT_ID || "",
+            provider: provider.providerId,
+            userId: authResult.userId || "unknown",
+            userEmail: authResult.userEmail,
+            userDisplayName: authResult.userDisplayName,
+        });
+        if (!identity.success || !identity.userDid) {
+            return approvalFailedJson("We signed you in but could not resolve your identity. Please start over.", 500);
+        }
+        authorizedUser = {
+            userDid: identity.userDid,
+            userId: authResult.userId,
+            userEmail: authResult.userEmail,
+        };
+    }
     let vcJwt;
+    let subjectDid;
     try {
-        vcJwt = await mintDelegationVcJwt(env, sid, info, cfg.delegationExpiresInS);
+        ({ vcJwt, subjectDid } = await mintDelegationVcJwt(env, sid, info, cfg.delegationExpiresInS));
     }
     catch (error) {
         // A mint failure (keygen/sign) must surface as a styled no-store error page, not
         // an unhandled throw that escapes to a bare 500 — and must park nothing (we fail
         // before the INTERNAL_PICKUP_APPROVE call below).
         console.warn(`[kya-http] delegation mint failed (sid=${sid}):`, error instanceof Error ? error.message : String(error));
-        return approvalFailedPage("We could not complete the authorization. Please start over.", 500);
+        return approvalFailedJson("We could not complete the authorization. Please start over.", 500);
     }
     const approveResponse = await callAnchor(env, sid, INTERNAL_PICKUP_APPROVE, {
         sid,
@@ -382,37 +675,70 @@ export async function handleAnchorConsentApprove(c, sid, env, cfg) {
     // Consent on an EXPIRED (410) or unknown (404) anchor MUST fail and mint nothing
     // reachable — the minted JWT is never returned to the caller in that case.
     if (approveResponse.status === 410) {
-        return approvalFailedPage("This authorization request expired before it could be completed. Nothing was authorized.");
+        return approvalFailedJson("This authorization request expired before it could be completed. Nothing was authorized.");
     }
     if (approveResponse.status === 404)
-        return notFoundPage();
+        return notFoundJson();
     if (!approveResponse.ok) {
-        return approvalFailedPage("We could not complete the authorization. Please start over.", 502);
+        return approvalFailedJson("We could not complete the authorization. Please start over.", 502);
     }
-    return successPage();
+    // Report the minted delegation to checkpoint so it appears in the dashboard,
+    // attributed to the signed-in customer. Only the credential path has a
+    // `user_did` (the notify schema requires one), so a consent-only anchor
+    // reports nothing — there is no user to attribute it to.
+    if (authorizedUser && provider) {
+        // FIRE-AND-FORGET: dispatch the report but NEVER await it — the VC is already
+        // parked and the shopper's approval must not hang on a slow/hung checkpoint.
+        // `waitUntil` (when the runtime provides it) lets the report finish after the
+        // success page is returned; `notifyDelegation` swallows its own errors.
+        const report = notifyDelegation(env, {
+            sid,
+            agentDid: subjectDid,
+            userDid: authorizedUser.userDid,
+            userId: authorizedUser.userId,
+            userIdentifier: authorizedUser.userEmail,
+            scopes: info.requiredScopes,
+            provider: provider.providerId,
+            // Record the same expiry the VC was minted with, matching the OAuth path.
+            expiresAt: new Date(Date.now() + cfg.delegationExpiresInS * 1000).toISOString(),
+        });
+        const execCtx = c.executionCtx;
+        execCtx?.waitUntil?.(report);
+    }
+    return successJson(`urn:uuid:${sid}`);
 }
 /**
- * Read the `csrf_token` form field from the POST body via the underlying native
- * Request (`c.req.raw`). The sid travels in the query, so consuming the body here
- * never interferes with route-order interception. Returns undefined on parse failure.
+ * Read every string field from the POST body ONCE via the underlying native
+ * Request (`c.req.raw`), for both the CSRF token and the credential fields. Reads
+ * `raw` directly (no clone) because it is consumed a single time — a second read
+ * of the same body is unreliable across runtimes. The sid travels in the query,
+ * so consuming the body here never interferes with route-order interception.
+ * Returns an empty object on parse failure.
  */
-async function readCsrfTokenFromBody(c) {
+async function readBodyFields(c) {
+    const out = {};
     const raw = c.req?.raw;
     if (!raw)
-        return undefined;
+        return out;
     try {
         const contentType = raw.headers.get("Content-Type") || "";
         if (contentType.includes("application/json")) {
-            const body = (await raw.clone().json());
-            const token = body?.csrf_token;
-            return typeof token === "string" ? token : undefined;
+            const body = (await raw.json());
+            for (const [key, value] of Object.entries(body)) {
+                if (typeof value === "string")
+                    out[key] = value;
+            }
+            return out;
         }
-        const form = await raw.clone().formData();
-        const token = form.get("csrf_token");
-        return typeof token === "string" ? token : undefined;
+        const form = await raw.formData();
+        form.forEach((value, key) => {
+            if (typeof value === "string")
+                out[key] = value;
+        });
+        return out;
     }
     catch {
-        return undefined;
+        return out;
     }
 }
 //# sourceMappingURL=consent-anchor-bridge.js.map

package/dist/delegation-http/consent-anchor-bridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"consent-anchor-bridge.js","sourceRoot":"","sources":["../../src/delegation-http/consent-anchor-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,wBAAwB,EACxB,cAAc,GAEf,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,2CAA2C,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE5E,wFAAwF;AACxF,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AA2BjD;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,GAAkB,EAClB,GAAW,EACX,YAAoB,EACpB,IAAa;IAEb,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,IAAI,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,EACpD;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CACF,CAAC;IACF,OAAO,QAA0C,CAAC;AACpD,CAAC;AAED,oEAAoE;AACpE,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,IAAI,CAAC,KAAa,EAAE,SAAiB;IAC5C,OAAO;;;;;SAKA,UAAU,CAAC,KAAK,CAAC;;;EAGxB,SAAS;;QAEH,CAAC;AACT,CAAC;AAED,sDAAsD;AACtD,SAAS,WAAW;IAClB,OAAO,YAAY,CACjB,IAAI,CACF,4BAA4B,EAC5B;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,0CAA0C;AAC1C,SAAS,YAAY;IACnB,OAAO,YAAY,CACjB,IAAI,CACF,iCAAiC,EACjC;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,kBAAkB,CAAC,OAAe,EAAE,MAAM,GAAG,GAAG;IACvD,OAAO,YAAY,CACjB,IAAI,CACF,sBAAsB,EACtB;;KAED,UAAU,CAAC,OAAO,CAAC;QAChB,CACH,EACD,MAAM,CACP,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,SAAS,WAAW;IAClB,OAAO,YAAY,CACjB,IAAI,CACF,wBAAwB,EACxB;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,GAAW,EACX,IAAgB,EAChB,SAAiB;IAEjB,MAAM,UAAU,GACd,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QAC5B,CAAC,CAAC,IAAI,CAAC,cAAc;aAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;aAC9D,IAAI,CAAC,EAAE,CAAC;QACb,CAAC,CAAC,mEAAmE,CAAC;IAE1E,OAAO,IAAI,CACT,oBAAoB,EACpB;;;mCAG+B,UAAU;mDACM,kBAAkB,CAAC,GAAG,CAAC;yCACjC,UAAU,CAAC,GAAG,CAAC;gDACR,UAAU,CAAC,SAAS,CAAC;;;QAG7D,CACL,CAAC;AACJ,CAAC;AAED,oFAAoF;AAEpF,8CAA8C;AAC9C,SAAS,oBAAoB,CAAC,KAAiB;IAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACvC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,uDAAuD;AACvD,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,oBAAoB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,wFAAwF;AACxF,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,QAAQ,MAAM,EAAE,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,0EAA0E;AAC1E,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,GAAW;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;IAChD,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,oBAAoB,CAClC,IAAI,UAAU,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAC1D,CAAC;IACF,OAAO,GAAG,OAAO,IAAI,UAAU,EAAE,CAAC;AACpC,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,iBAAiB,CAC9B,GAAkB,EAClB,GAAW,EACX,KAAyB;IAEzB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,gFAAgF;QAChF,gFAAgF;QAChF,gFAAgF;QAChF,uEAAuE;QACvE,8EAA8E;QAC9E,OAAO,CAAC,IAAI,CACV,oFAAoF,GAAG,GAAG,CAC3F,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAG3D,CAAC;QACF,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACtC,IACE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC3C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,WAAW,GAAG,oBAAoB,CACtC,IAAI,UAAU,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAC1D,CAAC;QACF,OAAO,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAkB;IAC3C,+EAA+E;IAC/E,oFAAoF;IACpF,MAAM,GAAG,GAAG,GAAyC,CAAC;IACtD,IAAI,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC3D,oFAAoF;IACpF,oDAAoD;IACpD,MAAM,WAAW,GAAG,MAAM,CACxB,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CACtC,CAAC,WAAW,EAAE,CAAC;IAChB,OAAO,WAAW,KAAK,aAAa,CAAC;AACvC,CAAC;AAED,mFAAmF;AAEnF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,uBAAuB,CAC9B,QAAgD,EAChD,IAAgB,EAChB,GAAW;IAEX,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC,YAAY,CAAC;IACjD,MAAM,OAAO,GAA4B;QACvC,GAAG,QAAQ,CAAC,OAAO;QACnB,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,GAAG;QACH,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,OAAO,GAAG,QAAQ,CAAC,aAAa,IAAI,qBAAqB,CACvD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,EAAE,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,mBAAmB,CAChC,GAAkB,EAClB,GAAW,EACX,IAAgB,EAChB,UAAkB;IAElB,MAAM,cAAc,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAC/C,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAEtD,IAAI,SAAiB,CAAC;IACtB,IAAI,KAAa,CAAC;IAClB,IAAI,iBAAyB,CAAC;IAC9B,IAAI,kBAAkB,EAAE,CAAC;QACvB,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC;QACnC,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC;QAC/B,iBAAiB,GAAG,kBAAkB,CAAC,UAAU,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,eAAe,EAAE,CAAC;QAC1D,SAAS,GAAG,wBAAwB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3D,KAAK,GAAG,GAAG,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC;IAC5C,CAAC;IAED,6EAA6E;IAC7E,gFAAgF;IAChF,gFAAgF;IAChF,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,sBAAsB,IAAI,SAAS,CAAC;IAE1E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAqB;QACnC,EAAE,EAAE,YAAY,GAAG,EAAE;QACrB,SAAS;QACT,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,YAAY,GAAG,EAAE;QACvB,WAAW,EAAE;YACX,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,IAAI,GAAG,UAAU;YAC3B,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,EAAE;QAChD,EAAE,EAAE,YAAY,GAAG,EAAE;QACrB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACvC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAE1D,MAAM,QAAQ,GAAG,mBAAmB,CAClC,YAAuC,EACvC,EAAE,KAAK,EAAE,CACV,CAAC;IACF,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,YAAY,GAAG,uBAAuB,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,IAAI,CAC9C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,iBAAiB,CAClB,CAAC;IACF,MAAM,SAAS,GAAG,wBAAwB,CAAC,cAAc,CAAC,CAAC;IAE3D,OAAO,aAAa,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,CAAc,EACd,GAAW,EACX,GAAkB,EAClB,IAAmC;IAEnC,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE;QACpE,GAAG;KACJ,CAAC,CAAC;IAEH,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,EAAE,CAAC;IACtD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,kBAAkB,CACvB,oEAAoE,EACpE,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAe,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,YAAY,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,CAAc,EACd,GAAW,EACX,GAAkB,EAClB,GAAkC;IAElC,yDAAyD;IACzD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,YAAY,CACjB,IAAI,CACF,sBAAsB,EACtB,6IAA6I,CAC9I,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE;QACpE,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAChC,OAAO,kBAAkB,CACvB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,kBAAkB,CACvB,oEAAoE,EACpE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAe,CAAC;IAEvD,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iFAAiF;QACjF,iFAAiF;QACjF,kDAAkD;QAClD,OAAO,CAAC,IAAI,CACV,0CAA0C,GAAG,IAAI,EACjD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACF,OAAO,kBAAkB,CACvB,6DAA6D,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,EAAE;QAC1E,GAAG;QACH,KAAK;QACL,UAAU,EAAE,GAAG,CAAC,oBAAoB;KACrC,CAAC,CAAC;IAEH,iFAAiF;IACjF,2EAA2E;IAC3E,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACnC,OAAO,kBAAkB,CACvB,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IAC1D,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;QACxB,OAAO,kBAAkB,CACvB,6DAA6D,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAClC,CAAc;IAEd,MAAM,GAAG,GAAI,CAA4C,CAAC,GAAG,EAAE,GAAG,CAAC;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAA4B,CAAC;YACnE,MAAM,KAAK,GAAG,IAAI,EAAE,UAAU,CAAC;YAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACvD,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"consent-anchor-bridge.js","sourceRoot":"","sources":["../../src/delegation-http/consent-anchor-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,wBAAwB,EACxB,cAAc,GAEf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oBAAoB,EACpB,4BAA4B,GAI7B,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,2CAA2C,CAAC;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EACL,oBAAoB,GAErB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AACpC,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,gBAAgB,GAEjB,MAAM,sBAAsB,CAAC;AAE9B,wFAAwF;AACxF,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AA2BjD;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,GAAkB,EAClB,GAAW,EACX,YAAoB,EACpB,IAAa;IAEb,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,IAAI,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,EACpD;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CACF,CAAC;IACF,OAAO,QAA0C,CAAC;AACpD,CAAC;AAED,oEAAoE;AACpE,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAa,EAAE,MAAc;IACjD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,IAAI,CAAC,KAAa,EAAE,SAAiB;IAC5C,OAAO;;;;;SAKA,UAAU,CAAC,KAAK,CAAC;;;EAGxB,SAAS;;QAEH,CAAC;AACT,CAAC;AAED,sDAAsD;AACtD,SAAS,WAAW;IAClB,OAAO,YAAY,CACjB,IAAI,CACF,4BAA4B,EAC5B;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,0CAA0C;AAC1C,SAAS,YAAY;IACnB,OAAO,YAAY,CACjB,IAAI,CACF,iCAAiC,EACjC;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,kBAAkB,CAAC,OAAe,EAAE,MAAM,GAAG,GAAG;IACvD,OAAO,YAAY,CACjB,IAAI,CACF,sBAAsB,EACtB;;KAED,UAAU,CAAC,OAAO,CAAC;QAChB,CACH,EACD,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY;IACnB,OAAO,YAAY,CACjB;QACE,KAAK,EACH,gGAAgG;KACnG,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,OAAe,EAAE,MAAM,GAAG,GAAG;IACvD,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,YAAoB;IACvC,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAChC,aAAgC,EAChC,MAAgB;IAEhB,IAAI,aAAa,CAAC,YAAY,IAAI,aAAa,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,OAAO,aAAa,CAAC,YAAY,CAAC;IACpC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,wBAAwB,CAAC,MAQjC;IACC,MAAM,EACJ,aAAa,EACb,IAAI,EACJ,GAAG,EACH,SAAS,EACT,SAAS,EACT,SAAS,EACT,UAAU,GACX,GAAG,MAAM,CAAC;IAEX,8EAA8E;IAC9E,8DAA8D;IAC9D,4DAA4D;IAC5D,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,+EAA+E;IAC/E,+EAA+E;IAC/E,sEAAsE;IACtE,MAAM,GAAG,GAAyC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC;IAC9E,MAAM,YAAY,GAAG,GAAG,EAAE,gBAAgB,CAAC;IAE3C,MAAM,WAAW,GAAkB;QACjC,QAAQ,EAAE,aAAa,CAAC,QAAQ;QAChC,KAAK,EAAE,aAAa,CAAC,KAAK;QAC1B,YAAY,EAAE,aAAa,CAAC,YAAY;QACxC,EAAE,EAAE,aAAa,CAAC,EAAE;QACpB,cAAc,EAAE,aAAa,CAAC,cAAc;QAC5C,WAAW,EAAE,UAAU;YACrB,CAAC,CAAC;gBACE,aAAa,EACX,YAAY,EAAE,kBAAkB;oBAChC,aAAa,CAAC,WAAW,EAAE,aAAa;oBACxC,UAAU;gBACZ,mBAAmB,EACjB,aAAa,CAAC,WAAW,EAAE,mBAAmB;oBAC9C,qBAAqB;gBACvB,aAAa,EACX,YAAY,EAAE,kBAAkB;oBAChC,aAAa,CAAC,WAAW,EAAE,aAAa;oBACxC,UAAU;gBACZ,mBAAmB,EACjB,aAAa,CAAC,WAAW,EAAE,mBAAmB;oBAC9C,qBAAqB;gBACvB,cAAc,EAAE,aAAa,CAAC,WAAW,EAAE,cAAc,IAAI,IAAI;gBACjE,kBAAkB,EAChB,aAAa,CAAC,WAAW,EAAE,kBAAkB,IAAI,KAAK;gBACxD,iBAAiB,EAAE,aAAa,CAAC,WAAW,EAAE,iBAAiB;aAChE;YACH,CAAC,CAAC,aAAa,CAAC,WAAW;KAC9B,CAAC;IAEF,MAAM,YAAY,GAAwB;QACxC,MAAM,EAAE,WAAW;QACnB,IAAI,EAAE,EAAE;QACR,MAAM,EAAE,IAAI,CAAC,cAAc;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;QAC7B,SAAS,EAAE,GAAG;QACd,SAAS;QACT,SAAS;QACT,yEAAyE;QACzE,4EAA4E;QAC5E,qDAAqD;QACrD,SAAS,EAAE,UAAU;YACnB,CAAC,CAAC,cAAc,UAAU,CAAC,QAAQ,CAAC,WAAW,EAAE;YACjD,CAAC,CAAC,oBAAoB;QACxB,SAAS;QACT,YAAY,EAAE,yBAAyB,CAAC,aAAa,EAAE,IAAI,CAAC,cAAc,CAAC;QAC3E,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,YAAY,EAAE,aAAa,CAAC,KAAK;QACjC,YAAY,EAAE,aAAa,CAAC,YAAY;QACxC,cAAc,EAAE,aAAa,CAAC,cAAc;QAC5C,cAAc,EAAE,aAAa,CAAC,cAAc;QAC5C,GAAG,CAAC,UAAU;YACZ,CAAC,CAAC;gBACE,QAAQ,EAAE,aAAa;gBACvB,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU;gBACxC,iBAAiB,EAAE,UAAU;aAC9B;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,OAAO,oBAAoB,CAAC,YAAY,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAkB,EAAE,CAAc;IAC1D,MAAM,UAAU,GAAG,GAAG,CAAC,cAAc,CAAC;IACtC,IAAI,UAAU,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,GAAG,GAAI,CAA4C,CAAC,GAAG,EAAE,GAAG,CAAC;IACnE,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,wCAAwC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,CAAc;IAEd,MAAM,KAAK,GACT,CACD,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnB,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAErC,MAAM,GAAG,GAAI,CAA4C,CAAC,GAAG,EAAE,GAAG,CAAC;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,SAAkB,CAAC;QACvB,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC7D,SAAS,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,WAAW,CAAC,SAAS,CAAC;YAC5D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,oFAAoF;AAEpF,8CAA8C;AAC9C,SAAS,oBAAoB,CAAC,KAAiB;IAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACvC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,uDAAuD;AACvD,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,oBAAoB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,wFAAwF;AACxF,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,QAAQ,MAAM,EAAE,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,0EAA0E;AAC1E,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,GAAW;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;IAChD,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,oBAAoB,CAClC,IAAI,UAAU,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAC1D,CAAC;IACF,OAAO,GAAG,OAAO,IAAI,UAAU,EAAE,CAAC;AACpC,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,iBAAiB,CAC9B,GAAkB,EAClB,GAAW,EACX,KAAyB;IAEzB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,gFAAgF;QAChF,gFAAgF;QAChF,gFAAgF;QAChF,uEAAuE;QACvE,8EAA8E;QAC9E,OAAO,CAAC,IAAI,CACV,oFAAoF,GAAG,GAAG,CAC3F,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAG3D,CAAC;QACF,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACtC,IACE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC3C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,WAAW,GAAG,oBAAoB,CACtC,IAAI,UAAU,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAC1D,CAAC;QACF,OAAO,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAkB;IAC3C,+EAA+E;IAC/E,oFAAoF;IACpF,MAAM,GAAG,GAAG,GAAyC,CAAC;IACtD,IAAI,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC3D,oFAAoF;IACpF,oDAAoD;IACpD,MAAM,WAAW,GAAG,MAAM,CACxB,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CACtC,CAAC,WAAW,EAAE,CAAC;IAChB,OAAO,WAAW,KAAK,aAAa,CAAC;AACvC,CAAC;AAED,mFAAmF;AAEnF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,uBAAuB,CAC9B,QAAgD,EAChD,IAAgB,EAChB,GAAW;IAEX,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC,YAAY,CAAC;IACjD,MAAM,OAAO,GAA4B;QACvC,GAAG,QAAQ,CAAC,OAAO;QACnB,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,GAAG;QACH,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,OAAO,GAAG,QAAQ,CAAC,aAAa,IAAI,qBAAqB,CACvD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,EAAE,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,mBAAmB,CAChC,GAAkB,EAClB,GAAW,EACX,IAAgB,EAChB,UAAkB;IAElB,MAAM,cAAc,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAC/C,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAEtD,IAAI,SAAiB,CAAC;IACtB,IAAI,KAAa,CAAC;IAClB,IAAI,iBAAyB,CAAC;IAC9B,IAAI,kBAAkB,EAAE,CAAC;QACvB,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC;QACnC,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC;QAC/B,iBAAiB,GAAG,kBAAkB,CAAC,UAAU,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,eAAe,EAAE,CAAC;QAC1D,SAAS,GAAG,wBAAwB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3D,KAAK,GAAG,GAAG,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC;IAC5C,CAAC;IAED,6EAA6E;IAC7E,gFAAgF;IAChF,gFAAgF;IAChF,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,sBAAsB,IAAI,SAAS,CAAC;IAE1E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAqB;QACnC,EAAE,EAAE,YAAY,GAAG,EAAE;QACrB,SAAS;QACT,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,YAAY,GAAG,EAAE;QACvB,WAAW,EAAE;YACX,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,IAAI,GAAG,UAAU;YAC3B,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,EAAE;QAChD,EAAE,EAAE,YAAY,GAAG,EAAE;QACrB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACvC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAE1D,MAAM,QAAQ,GAAG,mBAAmB,CAClC,YAAuC,EACvC,EAAE,KAAK,EAAE,CACV,CAAC;IACF,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,YAAY,GAAG,uBAAuB,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,IAAI,CAC9C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,iBAAiB,CAClB,CAAC;IACF,MAAM,SAAS,GAAG,wBAAwB,CAAC,cAAc,CAAC,CAAC;IAE3D,+EAA+E;IAC/E,+EAA+E;IAC/E,yCAAyC;IACzC,OAAO;QACL,KAAK,EAAE,aAAa,CAAC,YAAY,EAAE,SAAS,CAAC;QAC7C,UAAU,EAAE,QAAQ;KACrB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,CAAc,EACd,GAAW,EACX,GAAkB,EAClB,IAAmC;IAEnC,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE;QACpE,GAAG;KACJ,CAAC,CAAC;IAEH,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,EAAE,CAAC;IACtD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,kBAAkB,CACvB,oEAAoE,EACpE,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAe,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;IACnD,MAAM,aAAa,GAAG,MAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC,gBAAgB,CACxE,SAAS,CACV,CAAC;IACF,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAE3C,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,0EAA0E;IAC1E,oBAAoB;IACpB,MAAM,UAAU,GAAG,MAAM,+BAA+B,CACtD,GAAG,EACH,IAAI,CAAC,cAAc,CACpB,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QACvC,OAAO,YAAY,CACjB,wBAAwB,CAAC;YACvB,aAAa;YACb,IAAI;YACJ,GAAG;YACH,SAAS;YACT,SAAS;YACT,SAAS;YACT,UAAU,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE;SAC9C,CAAC,EACF,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,+EAA+E;IAC/E,0EAA0E;IAC1E,gFAAgF;IAChF,OAAO,YAAY,CACjB,wBAAwB,CAAC;QACvB,aAAa;QACb,IAAI;QACJ,GAAG;QACH,SAAS;QACT,SAAS;QACT,SAAS;KACV,CAAC,EACF,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,CAAc,EACd,GAAW,EACX,GAAkB,EAClB,GAAkC;IAElC,4EAA4E;IAC5E,8EAA8E;IAC9E,uEAAuE;IACvE,8EAA8E;IAC9E,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAC;IAE3C,yDAAyD;IACzD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,YAAY,CACjB;gBACE,KAAK,EACH,iEAAiE;aACpE,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE;QACpE,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAChC,OAAO,kBAAkB,CACvB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,kBAAkB,CACvB,oEAAoE,EACpE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAe,CAAC;IAEvD,yEAAyE;IACzE,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,MAAM,+BAA+B,CACtD,GAAG,EACH,IAAI,CAAC,cAAc,CACpB,CAAC;IACF,sEAAsE;IACtE,yEAAyE;IACzE,uEAAuE;IACvE,6EAA6E;IAC7E,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACxC,OAAO,kBAAkB,CACvB,iFAAiF,EACjF,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GACZ,UAAU,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,cAAc,GAIP,IAAI,CAAC;IAChB,IAAI,QAAQ,EAAE,CAAC;QACb,sEAAsE;QACtE,qEAAqE;QACrE,2EAA2E;QAC3E,6DAA6D;QAC7D,4EAA4E;QAC5E,2EAA2E;QAC3E,2DAA2D;QAC3D,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,2EAA2E;QAC3E,gEAAgE;QAChE,sDAAsD;QACtD,yEAAyE;QACzE,wCAAwC;QACxC,MAAM,EACJ,GAAG,EAAE,IAAI,EACT,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,KAAK,EACX,MAAM,EAAE,OAAO,EACf,SAAS,EAAE,SAAS,EACpB,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,cAAc,EACxB,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,SAAS,EACpB,aAAa,EAAE,cAAc,EAC7B,wBAAwB,EAAE,uBAAuB,EACjD,mBAAmB,EAAE,mBAAmB,EACxC,mBAAmB,EAAE,kBAAkB,EACvC,QAAQ,EAAE,QAAQ,EAClB,qBAAqB,EAAE,oBAAoB,EAC3C,2BAA2B,EAAE,yBAAyB,EACtD,GAAG,WAAW,EACf,GAAG,UAAU,CAAC;QACf,MAAM,OAAO,GAAG,2BAA2B,CAAC;YAC1C,KAAK,EAAE,CAAC,GAAG,IAA8B,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;YACvE,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,GAAG,EAAE,EAAE,IAAI,CAAC;SAChE,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5E,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,YAAY,CACjB;gBACE,KAAK,EACH,UAAU,CAAC,KAAK;oBAChB,wDAAwD;aAC3D,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE;YACpD,SAAS,EAAE,GAAG,CAAC,sBAAsB,IAAI,EAAE;YAC3C,QAAQ,EAAE,QAAQ,CAAC,UAAU;YAC7B,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,SAAS;YACtC,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,eAAe,EAAE,UAAU,CAAC,eAAe;SAC5C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC3C,OAAO,kBAAkB,CACvB,0EAA0E,EAC1E,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,cAAc,GAAG;YACf,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,KAAa,CAAC;IAClB,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,mBAAmB,CAChD,GAAG,EACH,GAAG,EACH,IAAI,EACJ,GAAG,CAAC,oBAAoB,CACzB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iFAAiF;QACjF,iFAAiF;QACjF,kDAAkD;QAClD,OAAO,CAAC,IAAI,CACV,0CAA0C,GAAG,IAAI,EACjD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACF,OAAO,kBAAkB,CACvB,6DAA6D,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,EAAE;QAC1E,GAAG;QACH,KAAK;QACL,UAAU,EAAE,GAAG,CAAC,oBAAoB;KACrC,CAAC,CAAC;IAEH,iFAAiF;IACjF,2EAA2E;IAC3E,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACnC,OAAO,kBAAkB,CACvB,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IAC1D,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;QACxB,OAAO,kBAAkB,CACvB,6DAA6D,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,uEAAuE;IACvE,wEAAwE;IACxE,yDAAyD;IACzD,IAAI,cAAc,IAAI,QAAQ,EAAE,CAAC;QAC/B,8EAA8E;QAC9E,6EAA6E;QAC7E,8EAA8E;QAC9E,wEAAwE;QACxE,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,EAAE;YACnC,GAAG;YACH,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,cAAc,CAAC,OAAO;YAC/B,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,cAAc,EAAE,cAAc,CAAC,SAAS;YACxC,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,QAAQ,EAAE,QAAQ,CAAC,UAAU;YAC7B,0EAA0E;YAC1E,SAAS,EAAE,IAAI,IAAI,CACjB,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,oBAAoB,GAAG,IAAI,CAC7C,CAAC,WAAW,EAAE;SAChB,CAAC,CAAC;QACH,MAAM,OAAO,GACX,CAGD,CAAC,YAAY,CAAC;QACf,OAAO,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,WAAW,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAAC,CAAc;IAC1C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,GAAG,GAAI,CAA4C,CAAC,GAAG,EAAE,GAAG,CAAC;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAClD,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/delegation-http/credential-consent.d.ts

@@ -0,0 +1,147 @@
+/**
+ * Credential-backed consent for the §8.1 anchor path.
+ *
+ * The anchor consent bridge (`consent-anchor-bridge.ts`) was consent-only: it
+ * rendered an "Allow" form, minted an anonymous delegation, and reported
+ * nothing to checkpoint. When a project's tool protection requires a credential
+ * provider (merchant sign-in), the branded consent an agent is redirected to
+ * must instead authenticate the shopper and mint a delegation bound to their
+ * identity — the same outcome the NATIVE MCP consent (`consent.service.ts`)
+ * produces, reached here for the HTTP-challenge transport.
+ *
+ * This module holds the runtime-agnostic pieces that don't belong inline in the
+ * bridge:
+ *  - {@link resolveCredentialIdentity} — customer → `user_did` via checkpoint's
+ *    `/api/v1/bouncer/identity/resolve` (lifted verbatim from
+ *    `consent.service.ts`, which needs nothing but `env`).
+ *  - {@link notifyDelegation} — fire-and-forget report to checkpoint's
+ *    `/api/v1/bouncer/delegations/notify` so the minted delegation appears in
+ *    the dashboard, attributed to the signed-in customer. This call is the ONLY
+ *    path that populates dashboard visibility, and its schema REQUIRES a
+ *    `user_did` — which is exactly why the anchor path could never show up
+ *    while it was consent-only.
+ *  - {@link sidToDelegationUuid} — the anchor sid (`kya-…`) is not a UUID, but
+ *    the notify schema demands `delegation_id` be one; this maps a sid to a
+ *    stable UUID so repeated notifies for the same anchor stay idempotent.
+ *
+ * @module @kya-os/mcp-i-cloudflare/delegation-http/credential-consent
+ */
+import type { CredentialProviderConfig } from "@kya-os/contracts/config";
+import type { CloudflareEnv } from "../types";
+/** A resolved credential provider the anchor consent should authenticate with. */
+export interface ResolvedCredentialProvider {
+    /** The provider id (dashboard key), used for identity resolution + notify. */
+    providerId: string;
+    /** Human-readable name for the consent page heading. */
+    displayName: string;
+    /** The provider config the credential auth handler consumes. */
+    config: CredentialProviderConfig;
+}
+/**
+ * The result of resolving whether the anchored scopes need credential auth.
+ *
+ * `unavailable` is deliberately distinct from `none`: it means we could NOT
+ * determine the requirement (the checkpoint `/providers` fetch failed, or its
+ * answer was ambiguous/malformed). The approve handler MUST fail closed on
+ * `unavailable` rather than mint an anonymous delegation — otherwise a transient
+ * error would silently skip merchant sign-in for a credential-protected project.
+ */
+export type AnchorCredentialResolution = {
+    status: "credential";
+    provider: ResolvedCredentialProvider;
+} | {
+    status: "none";
+} | {
+    status: "unavailable";
+};
+/**
+ * Resolve whether the project has a credential (merchant sign-in) provider the
+ * anchor consent should authenticate against, by fetching checkpoint's
+ * `/api/v1/bouncer/projects/{projectId}/providers` (the CRED-001 endpoint that
+ * returns full credential configs — authEndpoint / requestBodyTemplate /
+ * responseFields / successCheck — the same source the native consent uses).
+ *
+ * Returns `none` (→ consent-only) when the deployment has no checkpoint link or
+ * the project has no credential provider; `unavailable` (→ fail closed on mint)
+ * when the requirement could not be determined (fetch error / ambiguous config);
+ * `credential` with the provider otherwise. NEVER throws.
+ *
+ * v1 selection: prefer the project's `configuredProvider` when it is a credential
+ * provider; otherwise the single configured credential provider. When several
+ * credential providers exist with no default, resolution is `unavailable` (fail
+ * closed) rather than a silent anonymous mint — per-scope provider mapping is a
+ * documented follow-up.
+ */
+export declare function resolveAnchorCredentialProvider(env: CloudflareEnv, _scopes: string[]): Promise<AnchorCredentialResolution>;
+/** Params for {@link resolveCredentialIdentity}. */
+export interface ResolveCredentialIdentityParams {
+    projectId: string;
+    /** Credential provider id (e.g. the merchant provider). */
+    provider: string;
+    /** The customer id the provider's login returned. */
+    userId: string;
+    userEmail?: string;
+    userDisplayName?: string;
+}
+/**
+ * Resolve a signed-in customer to a checkpoint `user_did` via
+ * `/api/v1/bouncer/identity/resolve`. Mirrors
+ * `ConsentService.resolveCredentialIdentity` — it depends only on `env`
+ * (`AGENTSHIELD_API_URL` + `AGENTSHIELD_API_KEY`), never session/audit state, so
+ * it lives here as a free function the bridge can call directly. Returns
+ * `{ success: false }` (never throws) on any failure so the caller fails closed.
+ */
+export declare function resolveCredentialIdentity(env: CloudflareEnv, params: ResolveCredentialIdentityParams): Promise<{
+    success: boolean;
+    userDid?: string;
+}>;
+/**
+ * Map an anchor sid (`kya-` + 16–64 hex) to a stable RFC-4122 v4-shaped UUID.
+ *
+ * The notify schema pins `delegation_id` to a UUID, but a sid is not one. We
+ * derive it from the SHA-256 of the WHOLE sid so a repeated notify for the same
+ * anchor is idempotent (same sid → same id) while distinct sids stay distinct —
+ * hashing the full value avoids the collisions that truncating/repeating the raw
+ * hex would cause (sids longer than 32 hex would drop entropy; padded short sids
+ * could alias). The version nibble is forced to `4` and the variant nibble into
+ * the `8–b` range so the result passes strict UUID validators. This id
+ * identifies the dashboard row; it is intentionally NOT the VC's own
+ * `urn:uuid:${sid}` id.
+ */
+export declare function sidToDelegationUuid(sid: string): string;
+/** Params for {@link notifyDelegation}. */
+export interface NotifyDelegationParams {
+    /** The anchor sid the delegation was minted for. */
+    sid: string;
+    /** Subject (agent) DID the delegation was granted to. */
+    agentDid: string;
+    /** Human-readable agent name for the dashboard, if known. */
+    agentName?: string;
+    /** REQUIRED by the notify schema: the authorizing customer's DID. */
+    userDid: string;
+    /** Provider-native customer id. */
+    userId?: string;
+    /** Human-readable customer identifier (email) for dashboard display. */
+    userIdentifier?: string;
+    /** Granted scopes (at least one). */
+    scopes: string[];
+    /** Credential provider id. */
+    provider: string;
+    /** ISO-8601 expiry, if the delegation expires. */
+    expiresAt?: string;
+    /** Extra audit metadata merged into the report. */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Report a minted delegation to checkpoint so it appears in the dashboard,
+ * attributed to the signed-in customer. Fire-and-forget and best-effort: it
+ * NEVER throws and never blocks the consent response — a checkpoint hiccup must
+ * not fail an approval the user already granted. Matches the payload the OAuth
+ * path sends (`oauth-handler.ts`) against checkpoint's `notifyDelegationSchema`.
+ *
+ * No-ops (returns without a request) when the deployment has no
+ * `AGENTSHIELD_API_KEY` or `AGENTSHIELD_PROJECT_ID` — a self-hosted anchor with
+ * no checkpoint link has nothing to report to.
+ */
+export declare function notifyDelegation(env: CloudflareEnv, params: NotifyDelegationParams): Promise<void>;
+//# sourceMappingURL=credential-consent.d.ts.map

package/dist/delegation-http/credential-consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-consent.d.ts","sourceRoot":"","sources":["../../src/delegation-http/credential-consent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAG9C,kFAAkF;AAClF,MAAM,WAAW,0BAA0B;IACzC,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,MAAM,EAAE,wBAAwB,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAClC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,0BAA0B,CAAA;CAAE,GAC9D;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC;AA8M9B;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,+BAA+B,CACnD,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,0BAA0B,CAAC,CAwFrC;AAED,oDAAoD;AACpD,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,+BAA+B,GACtC,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgCjD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAYvD;AAED,2CAA2C;AAC3C,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,CA+Cf"}

package/dist/delegation-http/credential-consent.js

@@ -0,0 +1,328 @@
+import { DEFAULT_AGENTSHIELD_URL } from "../constants";
+import { sha256Hex } from "./hash";
+function readString(entry, camel, snake) {
+    const value = entry[camel] ?? entry[snake];
+    return typeof value === "string" ? value : undefined;
+}
+function readRecord(entry, camel, snake) {
+    const value = entry[camel] ?? entry[snake];
+    return value && typeof value === "object" ? value : undefined;
+}
+/** Whether an entry is a credential provider by its `type` discriminator. */
+function isCredentialTyped(entry) {
+    return (!!entry &&
+        (entry.type === "password" || entry.type === "credential") &&
+        entry.configured !== false);
+}
+/**
+ * Map a raw `successCheck` to the contract shape, reading `expectedValue` in
+ * either casing. Returns `undefined` for an absent, empty, or incomplete object
+ * (missing `path` or `expectedValue`) so a half-configured check is dropped
+ * rather than left to reject every successful login.
+ */
+function buildSuccessCheck(raw) {
+    if (!raw)
+        return undefined;
+    const path = typeof raw.path === "string" ? raw.path : undefined;
+    const expectedValue = raw.expectedValue ?? raw.expected_value;
+    if (!path || expectedValue === undefined)
+        return undefined;
+    if (typeof expectedValue !== "string" &&
+        typeof expectedValue !== "boolean" &&
+        typeof expectedValue !== "number") {
+        return undefined;
+    }
+    return { path, expectedValue };
+}
+/**
+ * Map a raw `consentOverrides` object to the contract shape (casing-tolerant,
+ * same reasoning as the rest of this file — the `/providers` source
+ * `consent.service.ts`'s own `mapCredentialProviderFields` reads can return
+ * either casing). Returns `undefined` when every override field is absent so
+ * an empty `{}` doesn't shadow the anchor bridge's own hardcoded defaults.
+ */
+function buildConsentOverrides(raw) {
+    if (!raw)
+        return undefined;
+    const branding = readRecord(raw, "branding", "branding");
+    const formTitle = readString(raw, "formTitle", "form_title");
+    const formDescription = readString(raw, "formDescription", "form_description");
+    const identityFieldLabel = readString(raw, "identityFieldLabel", "identity_field_label");
+    const identityFieldType = readString(raw, "identityFieldType", "identity_field_type");
+    const passwordFieldLabel = readString(raw, "passwordFieldLabel", "password_field_label");
+    const submitButtonText = readString(raw, "submitButtonText", "submit_button_text");
+    if (!branding &&
+        !formTitle &&
+        !formDescription &&
+        !identityFieldLabel &&
+        !identityFieldType &&
+        !passwordFieldLabel &&
+        !submitButtonText) {
+        return undefined;
+    }
+    return {
+        ...(branding ? { branding } : {}),
+        ...(formTitle ? { formTitle } : {}),
+        ...(formDescription ? { formDescription } : {}),
+        ...(identityFieldLabel ? { identityFieldLabel } : {}),
+        ...(identityFieldType ? { identityFieldType } : {}),
+        ...(passwordFieldLabel ? { passwordFieldLabel } : {}),
+        ...(submitButtonText ? { submitButtonText } : {}),
+    };
+}
+/**
+ * Build a {@link CredentialProviderConfig} from a raw entry, reading every field
+ * in either casing (including the nested `responseFields`). Returns `null` when a
+ * required field is absent — a credential-typed entry that yields `null` must
+ * fail CLOSED at the call site, never fall through to an anonymous mint.
+ */
+function buildCredentialConfig(entry) {
+    const authEndpoint = readString(entry, "authEndpoint", "auth_endpoint");
+    const requestBodyTemplate = readRecord(entry, "requestBodyTemplate", "request_body_template");
+    const rawResponseFields = readRecord(entry, "responseFields", "response_fields");
+    if (!authEndpoint || !requestBodyTemplate || !rawResponseFields)
+        return null;
+    const sessionToken = readString(rawResponseFields, "sessionToken", "session_token");
+    if (!sessionToken)
+        return null;
+    const responseFields = {
+        sessionToken,
+        userId: readString(rawResponseFields, "userId", "user_id"),
+        userEmail: readString(rawResponseFields, "userEmail", "user_email"),
+        userDisplayName: readString(rawResponseFields, "userDisplayName", "user_display_name"),
+        expiresIn: readString(rawResponseFields, "expiresIn", "expires_in"),
+    };
+    // Map the nested successCheck fields BOTH ways (`expectedValue` /
+    // `expected_value`) and drop an empty/incomplete object entirely — leaving a
+    // snake_case `expected_value` unmapped would make the auth handler read
+    // `expectedValue` as undefined and reject a successful login as a failed check.
+    const successCheck = buildSuccessCheck(readRecord(entry, "successCheck", "success_check"));
+    const headers = readRecord(entry, "headers", "headers");
+    const tokenUsage = readString(entry, "tokenUsage", "token_usage");
+    const tokenHeader = readString(entry, "tokenHeader", "token_header");
+    const cookieFormat = readString(entry, "cookieFormat", "cookie_format");
+    // Merchant-configured sign-in copy (identityFieldLabel / passwordFieldLabel /
+    // formTitle / submitButtonText / …) — the anchor consent shell reads this to
+    // show the merchant's own labels instead of hardcoded defaults.
+    const consentOverrides = buildConsentOverrides(readRecord(entry, "consentOverrides", "consent_overrides"));
+    return {
+        // The handler ignores `type`, but the contract's discriminant is "credential".
+        type: "credential",
+        displayName: readString(entry, "displayName", "display_name"),
+        authEndpoint,
+        requestBodyTemplate,
+        responseFields,
+        ...(successCheck ? { successCheck } : {}),
+        ...(headers ? { headers } : {}),
+        ...(tokenUsage ? { tokenUsage } : {}),
+        ...(tokenHeader ? { tokenHeader } : {}),
+        ...(cookieFormat ? { cookieFormat } : {}),
+        ...(consentOverrides ? { consentOverrides } : {}),
+    };
+}
+/**
+ * Resolve whether the project has a credential (merchant sign-in) provider the
+ * anchor consent should authenticate against, by fetching checkpoint's
+ * `/api/v1/bouncer/projects/{projectId}/providers` (the CRED-001 endpoint that
+ * returns full credential configs — authEndpoint / requestBodyTemplate /
+ * responseFields / successCheck — the same source the native consent uses).
+ *
+ * Returns `none` (→ consent-only) when the deployment has no checkpoint link or
+ * the project has no credential provider; `unavailable` (→ fail closed on mint)
+ * when the requirement could not be determined (fetch error / ambiguous config);
+ * `credential` with the provider otherwise. NEVER throws.
+ *
+ * v1 selection: prefer the project's `configuredProvider` when it is a credential
+ * provider; otherwise the single configured credential provider. When several
+ * credential providers exist with no default, resolution is `unavailable` (fail
+ * closed) rather than a silent anonymous mint — per-scope provider mapping is a
+ * documented follow-up.
+ */
+export async function resolveAnchorCredentialProvider(env, _scopes) {
+    const apiKey = env.AGENTSHIELD_API_KEY;
+    const projectId = env.AGENTSHIELD_PROJECT_ID;
+    // No checkpoint link → nothing to authenticate against → legitimately
+    // consent-only (this is not an error condition).
+    if (!apiKey || !projectId)
+        return { status: "none" };
+    const agentShieldUrl = env.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
+    let providersMap;
+    let configuredProvider;
+    try {
+        const response = await fetch(`${agentShieldUrl}/api/v1/bouncer/projects/${encodeURIComponent(projectId)}/providers`, {
+            method: "GET",
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                "Content-Type": "application/json",
+            },
+        });
+        // A non-2xx from checkpoint means we cannot confirm the auth requirement —
+        // fail closed rather than fall through to an anonymous mint.
+        if (!response.ok)
+            return { status: "unavailable" };
+        const body = (await response.json());
+        // A 200 with an UNEXPECTED shape (no `success`, or a missing/non-object
+        // `providers` map) is NOT the same as "no credential provider" — we cannot
+        // trust it to say the project is consent-only, so fail closed rather than
+        // read it as an empty map and mint anonymously.
+        if (body.success !== true ||
+            !body.data ||
+            typeof body.data.providers !== "object" ||
+            body.data.providers === null) {
+            return { status: "unavailable" };
+        }
+        providersMap = body.data.providers;
+        configuredProvider =
+            body.data.configuredProvider ?? body.data.configured_provider ?? null;
+    }
+    catch {
+        // Network/parse failure — same fail-closed reasoning as a non-2xx.
+        return { status: "unavailable" };
+    }
+    // Detect credential providers by their `type` discriminator (reliably present),
+    // NOT by whether a camelCase authEndpoint parsed — a snake_case entry must not
+    // silently look non-credential and drop to an anonymous mint.
+    const credentialIds = Object.keys(providersMap).filter((id) => isCredentialTyped(providersMap[id]));
+    // No credential provider configured → the project is genuinely consent-only.
+    if (credentialIds.length === 0)
+        return { status: "none" };
+    // Prefer the project's default provider when it is itself a credential provider;
+    // else fall back to the single configured credential provider.
+    const chosenId = configuredProvider && isCredentialTyped(providersMap[configuredProvider])
+        ? configuredProvider
+        : credentialIds.length === 1
+            ? credentialIds[0]
+            : null;
+    // Credential providers exist but we cannot pick one (several, no default) —
+    // fail closed rather than mint anonymously.
+    if (!chosenId)
+        return { status: "unavailable" };
+    const config = buildCredentialConfig(providersMap[chosenId]);
+    // A credential-TYPED provider we cannot fully parse (missing/odd-cased fields)
+    // must fail closed — never fall through to a consent-only anonymous mint.
+    if (!config)
+        return { status: "unavailable" };
+    return {
+        status: "credential",
+        provider: {
+            providerId: chosenId,
+            displayName: config.displayName || chosenId,
+            config,
+        },
+    };
+}
+/**
+ * Resolve a signed-in customer to a checkpoint `user_did` via
+ * `/api/v1/bouncer/identity/resolve`. Mirrors
+ * `ConsentService.resolveCredentialIdentity` — it depends only on `env`
+ * (`AGENTSHIELD_API_URL` + `AGENTSHIELD_API_KEY`), never session/audit state, so
+ * it lives here as a free function the bridge can call directly. Returns
+ * `{ success: false }` (never throws) on any failure so the caller fails closed.
+ */
+export async function resolveCredentialIdentity(env, params) {
+    const agentShieldUrl = env.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
+    const apiKey = env.AGENTSHIELD_API_KEY;
+    if (!apiKey)
+        return { success: false };
+    try {
+        const response = await fetch(`${agentShieldUrl}/api/v1/bouncer/identity/resolve`, {
+            method: "POST",
+            headers: {
+                "X-API-Key": apiKey,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                project_id: params.projectId,
+                credential_result: {
+                    provider: params.provider,
+                    user_id: params.userId,
+                    email: params.userEmail,
+                    name: params.userDisplayName,
+                },
+            }),
+        });
+        if (!response.ok)
+            return { success: false };
+        const data = (await response.json());
+        const userDid = data?.data?.user_did;
+        return userDid ? { success: true, userDid } : { success: false };
+    }
+    catch {
+        return { success: false };
+    }
+}
+/**
+ * Map an anchor sid (`kya-` + 16–64 hex) to a stable RFC-4122 v4-shaped UUID.
+ *
+ * The notify schema pins `delegation_id` to a UUID, but a sid is not one. We
+ * derive it from the SHA-256 of the WHOLE sid so a repeated notify for the same
+ * anchor is idempotent (same sid → same id) while distinct sids stay distinct —
+ * hashing the full value avoids the collisions that truncating/repeating the raw
+ * hex would cause (sids longer than 32 hex would drop entropy; padded short sids
+ * could alias). The version nibble is forced to `4` and the variant nibble into
+ * the `8–b` range so the result passes strict UUID validators. This id
+ * identifies the dashboard row; it is intentionally NOT the VC's own
+ * `urn:uuid:${sid}` id.
+ */
+export function sidToDelegationUuid(sid) {
+    // sha256Hex is a synchronous FIPS-180-4 digest (asserted against
+    // crypto.subtle) — lets this stay a pure sync helper.
+    const h = sha256Hex(sid).slice(0, 32).split("");
+    h[12] = "4"; // version 4
+    // Variant 10xx: keep entropy from the hash nibble, forcing the top two bits.
+    h[16] = ((parseInt(h[16], 16) & 0x3) | 0x8).toString(16);
+    const s = h.join("");
+    return `${s.slice(0, 8)}-${s.slice(8, 12)}-${s.slice(12, 16)}-${s.slice(16, 20)}-${s.slice(20, 32)}`;
+}
+/**
+ * Report a minted delegation to checkpoint so it appears in the dashboard,
+ * attributed to the signed-in customer. Fire-and-forget and best-effort: it
+ * NEVER throws and never blocks the consent response — a checkpoint hiccup must
+ * not fail an approval the user already granted. Matches the payload the OAuth
+ * path sends (`oauth-handler.ts`) against checkpoint's `notifyDelegationSchema`.
+ *
+ * No-ops (returns without a request) when the deployment has no
+ * `AGENTSHIELD_API_KEY` or `AGENTSHIELD_PROJECT_ID` — a self-hosted anchor with
+ * no checkpoint link has nothing to report to.
+ */
+export async function notifyDelegation(env, params) {
+    const apiKey = env.AGENTSHIELD_API_KEY;
+    const projectId = env.AGENTSHIELD_PROJECT_ID;
+    if (!apiKey || !projectId)
+        return;
+    const agentShieldUrl = env.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
+    try {
+        const response = await fetch(`${agentShieldUrl}/api/v1/bouncer/delegations/notify`, {
+            method: "POST",
+            headers: {
+                "X-API-Key": apiKey,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                delegation_id: sidToDelegationUuid(params.sid),
+                agent_did: params.agentDid,
+                agent_name: params.agentName || undefined,
+                user_did: params.userDid,
+                user_id: params.userId || undefined,
+                user_identifier: params.userIdentifier || undefined,
+                scopes: params.scopes,
+                provider: params.provider,
+                project_id: projectId,
+                created_at: new Date().toISOString(),
+                expires_at: params.expiresAt || undefined,
+                metadata: {
+                    source: "mcp-i-anchor-consent",
+                    sid: params.sid,
+                    ...params.metadata,
+                },
+            }),
+        });
+        if (!response.ok) {
+            console.warn(`[kya-http] delegation notify failed (non-blocking): ${response.status} sid=${params.sid}`);
+        }
+    }
+    catch (error) {
+        console.warn(`[kya-http] delegation notify failed (non-blocking): ${error instanceof Error ? error.message : String(error)} sid=${params.sid}`);
+    }
+}
+//# sourceMappingURL=credential-consent.js.map

package/dist/delegation-http/credential-consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-consent.js","sourceRoot":"","sources":["../../src/delegation-http/credential-consent.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAmCnC,SAAS,UAAU,CACjB,KAAuB,EACvB,KAAa,EACb,KAAa;IAEb,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CACjB,KAAuB,EACvB,KAAa,EACb,KAAa;IAEb,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB,CAAC,KAAmC;IAC5D,OAAO,CACL,CAAC,CAAC,KAAK;QACP,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;QAC1D,KAAK,CAAC,UAAU,KAAK,KAAK,CAC3B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CACxB,GAAiC;IAEjC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,MAAM,aAAa,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,cAAc,CAAC;IAC9D,IAAI,CAAC,IAAI,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3D,IACE,OAAO,aAAa,KAAK,QAAQ;QACjC,OAAO,aAAa,KAAK,SAAS;QAClC,OAAO,aAAa,KAAK,QAAQ,EACjC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAC5B,GAAiC;IAEjC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,QAAQ,GAAG,UAAU,CACzB,GAAG,EACH,UAAU,EACV,UAAU,CACX,CAAC;IACF,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,UAAU,CAChC,GAAG,EACH,iBAAiB,EACjB,kBAAkB,CACnB,CAAC;IACF,MAAM,kBAAkB,GAAG,UAAU,CACnC,GAAG,EACH,oBAAoB,EACpB,sBAAsB,CACvB,CAAC;IACF,MAAM,iBAAiB,GAAG,UAAU,CAClC,GAAG,EACH,mBAAmB,EACnB,qBAAqB,CACkB,CAAC;IAC1C,MAAM,kBAAkB,GAAG,UAAU,CACnC,GAAG,EACH,oBAAoB,EACpB,sBAAsB,CACvB,CAAC;IACF,MAAM,gBAAgB,GAAG,UAAU,CACjC,GAAG,EACH,kBAAkB,EAClB,oBAAoB,CACrB,CAAC;IACF,IACE,CAAC,QAAQ;QACT,CAAC,SAAS;QACV,CAAC,eAAe;QAChB,CAAC,kBAAkB;QACnB,CAAC,iBAAiB;QAClB,CAAC,kBAAkB;QACnB,CAAC,gBAAgB,EACjB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,KAAuB;IAEvB,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;IACxE,MAAM,mBAAmB,GAAG,UAAU,CACpC,KAAK,EACL,qBAAqB,EACrB,uBAAuB,CACxB,CAAC;IACF,MAAM,iBAAiB,GAAG,UAAU,CAClC,KAAK,EACL,gBAAgB,EAChB,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC,YAAY,IAAI,CAAC,mBAAmB,IAAI,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAE7E,MAAM,YAAY,GAAG,UAAU,CAC7B,iBAAiB,EACjB,cAAc,EACd,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAE/B,MAAM,cAAc,GAA+C;QACjE,YAAY;QACZ,MAAM,EAAE,UAAU,CAAC,iBAAiB,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC1D,SAAS,EAAE,UAAU,CAAC,iBAAiB,EAAE,WAAW,EAAE,YAAY,CAAC;QACnE,eAAe,EAAE,UAAU,CACzB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,CACpB;QACD,SAAS,EAAE,UAAU,CAAC,iBAAiB,EAAE,WAAW,EAAE,YAAY,CAAC;KACpE,CAAC;IAEF,kEAAkE;IAClE,6EAA6E;IAC7E,wEAAwE;IACxE,gFAAgF;IAChF,MAAM,YAAY,GAAG,iBAAiB,CACpC,UAAU,CAAmB,KAAK,EAAE,cAAc,EAAE,eAAe,CAAC,CACrE,CAAC;IACF,MAAM,OAAO,GAAG,UAAU,CACxB,KAAK,EACL,SAAS,EACT,SAAS,CACV,CAAC;IACF,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,aAAa,CAEnD,CAAC;IACd,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;IACxE,8EAA8E;IAC9E,6EAA6E;IAC7E,gEAAgE;IAChE,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,UAAU,CAAmB,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAC7E,CAAC;IAEF,OAAO;QACL,+EAA+E;QAC/E,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,cAAc,CAAC;QAC7D,YAAY;QACZ,mBAAmB;QACnB,cAAc;QACd,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,GAAkB,EAClB,OAAiB;IAEjB,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACvC,MAAM,SAAS,GAAG,GAAG,CAAC,sBAAsB,CAAC;IAC7C,sEAAsE;IACtE,iDAAiD;IACjD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAErD,MAAM,cAAc,GAAG,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;IAC1E,IAAI,YAA8C,CAAC;IACnD,IAAI,kBAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,cAAc,4BAA4B,kBAAkB,CAC7D,SAAS,CACV,YAAY,EACb;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,cAAc,EAAE,kBAAkB;aACnC;SACF,CACF,CAAC;QACF,2EAA2E;QAC3E,6DAA6D;QAC7D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAOlC,CAAC;QACF,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,gDAAgD;QAChD,IACE,IAAI,CAAC,OAAO,KAAK,IAAI;YACrB,CAAC,IAAI,CAAC,IAAI;YACV,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ;YACvC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,EAC5B,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACnC,CAAC;QACD,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAA6C,CAAC;QACvE,kBAAkB;YAChB,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;IAED,gFAAgF;IAChF,+EAA+E;IAC/E,8DAA8D;IAC9D,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAC5D,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CACpC,CAAC;IACF,6EAA6E;IAC7E,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE1D,iFAAiF;IACjF,+DAA+D;IAC/D,MAAM,QAAQ,GACZ,kBAAkB,IAAI,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;QACvE,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;YAC1B,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,IAAI,CAAC;IACb,4EAA4E;IAC5E,4CAA4C;IAC5C,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAEhD,MAAM,MAAM,GAAG,qBAAqB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,+EAA+E;IAC/E,0EAA0E;IAC1E,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAE9C,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE;YACR,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,QAAQ;YAC3C,MAAM;SACP;KACF,CAAC;AACJ,CAAC;AAaD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAkB,EAClB,MAAuC;IAEvC,MAAM,cAAc,GAAG,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;IAC1E,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,cAAc,kCAAkC,EACnD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,WAAW,EAAE,MAAM;gBACnB,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,MAAM,CAAC,SAAS;gBAC5B,iBAAiB,EAAE;oBACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,OAAO,EAAE,MAAM,CAAC,MAAM;oBACtB,KAAK,EAAE,MAAM,CAAC,SAAS;oBACvB,IAAI,EAAE,MAAM,CAAC,eAAe;iBAC7B;aACF,CAAC;SACH,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqC,CAAC;QACzE,MAAM,OAAO,GAAG,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;QACrC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,iEAAiE;IACjE,sDAAsD;IACtD,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,YAAY;IACzB,6EAA6E;IAC7E,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CACrE,EAAE,EACF,EAAE,CACH,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACzB,CAAC;AA0BD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAkB,EAClB,MAA8B;IAE9B,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACvC,MAAM,SAAS,GAAG,GAAG,CAAC,sBAAsB,CAAC;IAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;QAAE,OAAO;IAElC,MAAM,cAAc,GAAG,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,cAAc,oCAAoC,EACrD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,WAAW,EAAE,MAAM;gBACnB,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,aAAa,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC;gBAC9C,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;gBACzC,QAAQ,EAAE,MAAM,CAAC,OAAO;gBACxB,OAAO,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS;gBACnC,eAAe,EAAE,MAAM,CAAC,cAAc,IAAI,SAAS;gBACnD,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;gBACzC,QAAQ,EAAE;oBACR,MAAM,EAAE,sBAAsB;oBAC9B,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,GAAG,MAAM,CAAC,QAAQ;iBACnB;aACF,CAAC;SACH,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CACV,uDAAuD,QAAQ,CAAC,MAAM,QAAQ,MAAM,CAAC,GAAG,EAAE,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CACV,uDACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,QAAQ,MAAM,CAAC,GAAG,EAAE,CACrB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/delegation-http/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/delegation-http/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAQ,MAAM,MAAM,CAAC;AAMvC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAEnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAkBnE,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,cAAc,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACpE;AA2BD;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,EACT,OAAO,EAAE,oBAAoB,EAC7B,IAAI,CAAC,EAAE,uBAAuB,GAC7B,IAAI,CAmDN"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/delegation-http/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAQ,MAAM,MAAM,CAAC;AAMvC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAEnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAmBnE,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,cAAc,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACpE;AA2BD;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,EACT,OAAO,EAAE,oBAAoB,EAC7B,IAAI,CAAC,EAAE,uBAAuB,GAC7B,IAAI,CAwDN"}

package/dist/delegation-http/register.js

@@ -14,7 +14,7 @@ import { resolveHttpChallengeConfig } from "../config";
 import { PICKUP_ROUTE, CONSENT_ROUTE, ANCHOR_REGISTRATION_ROUTE, } from "./constants";
 import { isAnchorSid } from "./sid";
 import { handlePickupGet } from "./pickup-routes";
-import { handleAnchorConsentGet, handleAnchorConsentApprove, } from "./consent-anchor-bridge";
+import { handleAnchorConsentGet, handleAnchorConsentApprove, resolveApproveSid, } from "./consent-anchor-bridge";
 import { getAnchorStub } from "./anchor-routing";
 import { handleAnchorRegistration, isAnchorRegistrationEnabled, } from "./anchor-registration";
 /**
@@ -61,13 +61,19 @@ export function registerDelegationHttpRoutes(app, options, deps) {
             return next();
         return handleAnchorConsentGet(c, sid, env, cfg);
     });
-    // Anchor approval POST. The consent surface posts to `/consent/approve?sid=kya-…`
-    // (sid in the query, so interception never consumes the request body).
+    // Anchor approval POST. The legacy raw-HTML form posted to
+    // `/consent/approve?sid=kya-…` (sid in the query). The `@kya-os/consent` Lit
+    // component instead POSTs to a hardcoded `/consent/approve` with the sid
+    // carried in the body as `session_id` — `resolveApproveSid` checks the query
+    // FIRST and only peeks a *clone* of the body when it's absent, so a flag-off
+    // or non-anchor request's original body stream is never consumed here.
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     app.post(`${CONSENT_ROUTE}/approve`, async (c, next) => {
         const { env, cfg } = resolveRequest(c, options);
-        const sid = c.req.query("sid");
-        if (!cfg || !isAnchorSid(sid))
+        if (!cfg)
+            return next();
+        const sid = await resolveApproveSid(c);
+        if (!isAnchorSid(sid))
             return next();
         return handleAnchorConsentApprove(c, sid, env, cfg);
     });

package/dist/delegation-http/register.js.map

@@ -1 +1 @@
-{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/delegation-http/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AAOvD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAQ/B;;;;GAIG;AACH,SAAS,cAAc;AACrB,8DAA8D;AAC9D,CAAM,EACN,OAA6B;IAE7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS;YAC3B,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAA4B,EAAE,OAAO,CAAC,SAAS,CAAC;YACnE,CAAC,CAAE,CAAC,CAAC,GAAqB,CAAC;QAC7B,MAAM,GAAG,GAAG,0BAA0B,CACpC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAC7B,GAAyC,CAC1C,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;QAChF,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAoB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,GAAS,EACT,OAA6B,EAC7B,IAA8B;IAE9B,iFAAiF;IACjF,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QACjD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,EAAE,CAAC;QACxB,OAAO,eAAe,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,iFAAiF;IACjF,iEAAiE;IACjE,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAClD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC,CAA2B,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,kFAAkF;IAClF,uEAAuE;IACvE,8DAA8D;IAC9D,GAAG,CAAC,IAAI,CAAC,GAAG,aAAa,UAAU,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAChE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC7C,OAAO,0BAA0B,CAC/B,CAA2B,EAC3B,GAAG,EACH,GAAG,EACH,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,CAAC;IAC5C,8DAA8D;IAC9D,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAC/D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACtE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,OAAO,wBAAwB,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE;YAC3C,aAAa;YACb,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;SACxC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/delegation-http/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AAOvD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAQ/B;;;;GAIG;AACH,SAAS,cAAc;AACrB,8DAA8D;AAC9D,CAAM,EACN,OAA6B;IAE7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS;YAC3B,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAA4B,EAAE,OAAO,CAAC,SAAS,CAAC;YACnE,CAAC,CAAE,CAAC,CAAC,GAAqB,CAAC;QAC7B,MAAM,GAAG,GAAG,0BAA0B,CACpC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAC7B,GAAyC,CAC1C,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;QAChF,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAoB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,GAAS,EACT,OAA6B,EAC7B,IAA8B;IAE9B,iFAAiF;IACjF,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QACjD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,EAAE,CAAC;QACxB,OAAO,eAAe,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,iFAAiF;IACjF,iEAAiE;IACjE,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAClD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC,CAA2B,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,2DAA2D;IAC3D,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,uEAAuE;IACvE,8DAA8D;IAC9D,GAAG,CAAC,IAAI,CAAC,GAAG,aAAa,UAAU,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAChE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,CAA2B,CAAC,CAAC;QACjE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACrC,OAAO,0BAA0B,CAC/B,CAA2B,EAC3B,GAAG,EACH,GAAG,EACH,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,CAAC;IAC5C,8DAA8D;IAC9D,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAC/D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACtE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,OAAO,wBAAwB,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE;YAC3C,aAAa;YACb,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;SACxC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/mcp-i-cloudflare",
-  "version": "1.12.1",
+  "version": "1.12.3",
   "description": "Cloudflare Workers adapter for MCP-I framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -29,9 +29,9 @@
   },
   "dependencies": {
     "@kya-os/consent": "^0.1.41",
-    "@kya-os/contracts": "^1.9.0",
+    "@kya-os/contracts": "^1.9.2",
     "@kya-os/mcp": "^1.10.1",
-    "@kya-os/mcp-i-core": "^1.8.1",
+    "@kya-os/mcp-i-core": "^1.8.3",
     "@kya-os/mcp-i-runtime": "^1.0.0",
     "@kya-os/provider-registry": "^0.1.7",
     "@modelcontextprotocol/sdk": "^1.25.2",