@kya-os/mcp-i-cloudflare 1.13.0 → 1.13.3

package/dist/services/batch-queue.js

@@ -0,0 +1,180 @@
+/**
+ * Generic Batch Queue (Cloudflare Workers Implementation)
+ *
+ * Platform-agnostic, type-generic batching for Cloudflare Workers. Collects
+ * items in memory and submits them in batches to one or more destinations,
+ * without blocking request handling.
+ *
+ * This is the shared engine behind both the proof batch queue
+ * (`proof-batch-queue.ts`) and the KYA-OS activity events emitter
+ * (`kya-os-events.service.ts`) so the batching, retry, and flush semantics
+ * live in exactly one place.
+ *
+ * Performance:
+ * - Batch size: 10 items (configurable)
+ * - Fire-and-forget submission (does not block the caller)
+ *
+ * Retry Strategy:
+ * - Exponential backoff: 1s, 2s, 4s, 8s, 16s
+ * - Max retries: 5 (configurable)
+ * - Failed items logged and dropped after max retries
+ *
+ * Note: In Cloudflare Workers, timers do not persist across requests, so
+ * automatic flush timers are disabled. Flush is driven by two triggers:
+ * within a request when the batch size is reached, and across requests via
+ * a scheduled (cron) `flush()` call.
+ */
+/**
+ * Generic Batch Queue.
+ *
+ * Collects items and submits them in batches to multiple destinations.
+ *
+ * Note: In Cloudflare Workers, timers don't persist across requests, so
+ * automatic flush timers are disabled. Use manual `flush()` calls via cron.
+ */
+export class BatchQueue {
+    queue = [];
+    pendingBatches = [];
+    config;
+    closed = false;
+    // Stats
+    stats = {
+        queued: 0,
+        submitted: 0,
+        failed: 0,
+        batchesSubmitted: 0,
+    };
+    constructor(config) {
+        this.config = {
+            destinations: config.destinations,
+            maxBatchSize: config.maxBatchSize || 10,
+            flushIntervalMs: config.flushIntervalMs || 5000,
+            maxRetries: config.maxRetries || 5,
+            debug: config.debug || false,
+            logPrefix: config.logPrefix || "BatchQueue",
+            noun: config.noun || "item",
+        };
+        // Note: Timers are disabled in Cloudflare Workers.
+        // Flush must be called manually via cron jobs.
+    }
+    /** The log prefix, e.g. "[ProofBatchQueue]". */
+    get tag() {
+        return `[${this.config.logPrefix}]`;
+    }
+    /**
+     * Add an item to the queue.
+     */
+    enqueue(item) {
+        if (this.closed) {
+            console.warn(`${this.tag} Queue is closed, dropping ${this.config.noun}`);
+            return;
+        }
+        this.queue.push(item);
+        this.stats.queued++;
+        if (this.config.debug) {
+            console.error(`${this.tag} Enqueued ${this.config.noun} (queue size: ${this.queue.length})`);
+        }
+        // Flush immediately if batch size reached (Cloudflare Workers compatible)
+        if (this.queue.length >= this.config.maxBatchSize) {
+            this.flush();
+        }
+    }
+    /**
+     * Flush queue immediately (submit all queued items).
+     */
+    async flush() {
+        if (this.queue.length === 0) {
+            return;
+        }
+        const items = this.queue.splice(0, this.config.maxBatchSize);
+        if (this.config.debug) {
+            console.error(`${this.tag} Flushing ${items.length} ${this.config.noun}s to ${this.config.destinations.length} destinations`);
+        }
+        // Submit to all destinations
+        for (const destination of this.config.destinations) {
+            const batch = {
+                items: [...items], // Copy items for each destination
+                destination,
+                retryCount: 0,
+            };
+            this.submitBatch(batch); // Fire-and-forget
+        }
+    }
+    /**
+     * Submit a batch to a destination (with retries).
+     */
+    async submitBatch(batch) {
+        try {
+            await batch.destination.submit(batch.items);
+            this.stats.submitted += batch.items.length;
+            this.stats.batchesSubmitted++;
+            if (this.config.debug) {
+                console.error(`${this.tag} Successfully submitted ${batch.items.length} ${this.config.noun}s to ${batch.destination.name}`);
+            }
+        }
+        catch (error) {
+            console.error(`${this.tag} Failed to submit to ${batch.destination.name}:`, error);
+            // Retry with exponential backoff
+            if (batch.retryCount < this.config.maxRetries) {
+                batch.retryCount++;
+                const backoffMs = Math.min(1000 * Math.pow(2, batch.retryCount - 1), 16000);
+                batch.nextRetryAt = Date.now() + backoffMs;
+                this.pendingBatches.push(batch);
+                if (this.config.debug) {
+                    console.error(`${this.tag} Scheduling retry ${batch.retryCount}/${this.config.maxRetries} in ${backoffMs}ms`);
+                }
+            }
+            else {
+                // Max retries exceeded, drop batch
+                this.stats.failed += batch.items.length;
+                console.error(`${this.tag} Max retries exceeded for ${batch.destination.name}, dropping ${batch.items.length} ${this.config.noun}s`);
+            }
+        }
+    }
+    /**
+     * Retry pending batches that are ready.
+     * Called by cron job or manually.
+     */
+    async retryPending() {
+        const now = Date.now();
+        const retryBatches = this.pendingBatches.filter((batch) => batch.nextRetryAt && batch.nextRetryAt <= now);
+        if (retryBatches.length > 0) {
+            // Remove from pending
+            this.pendingBatches = this.pendingBatches.filter((batch) => !retryBatches.includes(batch));
+            // Retry each batch
+            for (const batch of retryBatches) {
+                this.submitBatch(batch); // Fire-and-forget
+            }
+        }
+    }
+    /**
+     * Close queue and flush remaining items.
+     */
+    async close() {
+        if (this.closed) {
+            return;
+        }
+        this.closed = true;
+        // Flush remaining items
+        if (this.queue.length > 0) {
+            await this.flush();
+        }
+        // Wait for pending batches (with timeout)
+        const timeout = 5000; // 5 seconds
+        const startTime = Date.now();
+        while (this.pendingBatches.length > 0 && Date.now() - startTime < timeout) {
+            await this.retryPending();
+            await new Promise((resolve) => setTimeout(resolve, 100));
+        }
+        if (this.pendingBatches.length > 0) {
+            console.warn(`${this.tag} Closing with ${this.pendingBatches.length} pending batches (timed out)`);
+        }
+    }
+    /**
+     * Get queue statistics.
+     */
+    getStats() {
+        return { ...this.stats };
+    }
+}
+//# sourceMappingURL=batch-queue.js.map

package/dist/services/batch-queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch-queue.js","sourceRoot":"","sources":["../../src/services/batch-queue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAwCH;;;;;;;GAOG;AACH,MAAM,OAAO,UAAU;IACb,KAAK,GAAQ,EAAE,CAAC;IAChB,cAAc,GAAe,EAAE,CAAC;IAChC,MAAM,CAAgC;IACtC,MAAM,GAAG,KAAK,CAAC;IAEvB,QAAQ;IACA,KAAK,GAAG;QACd,MAAM,EAAE,CAAC;QACT,SAAS,EAAE,CAAC;QACZ,MAAM,EAAE,CAAC;QACT,gBAAgB,EAAE,CAAC;KACpB,CAAC;IAEF,YAAY,MAA2B;QACrC,IAAI,CAAC,MAAM,GAAG;YACZ,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YACvC,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI;YAC/C,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;YAClC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,KAAK;YAC5B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,YAAY;YAC3C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM;SAC5B,CAAC;QAEF,mDAAmD;QACnD,+CAA+C;IACjD,CAAC;IAED,gDAAgD;IAChD,IAAY,GAAG;QACb,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAO;QACb,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,8BAA8B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAEpB,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CACX,GAAG,IAAI,CAAC,GAAG,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,iBAAiB,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAC9E,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAE7D,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CACX,GAAG,IAAI,CAAC,GAAG,aAAa,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,QAAQ,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,eAAe,CAC/G,CAAC;QACJ,CAAC;QAED,6BAA6B;QAC7B,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACnD,MAAM,KAAK,GAAa;gBACtB,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,kCAAkC;gBACrD,WAAW;gBACX,UAAU,EAAE,CAAC;aACd,CAAC;YAEF,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB;QAC7C,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW,CAAC,KAAe;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAE5C,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;YAC3C,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAE9B,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAK,CACX,GAAG,IAAI,CAAC,GAAG,2BAA2B,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,QAAQ,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAC7G,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,GAAG,IAAI,CAAC,GAAG,wBAAwB,KAAK,CAAC,WAAW,CAAC,IAAI,GAAG,EAC5D,KAAK,CACN,CAAC;YAEF,iCAAiC;YACjC,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC9C,KAAK,CAAC,UAAU,EAAE,CAAC;gBACnB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,EACxC,KAAK,CACN,CAAC;gBACF,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBAE3C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAEhC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBACtB,OAAO,CAAC,KAAK,CACX,GAAG,IAAI,CAAC,GAAG,qBAAqB,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,OAAO,SAAS,IAAI,CAC/F,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,mCAAmC;gBACnC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;gBACxC,OAAO,CAAC,KAAK,CACX,GAAG,IAAI,CAAC,GAAG,6BAA6B,KAAK,CAAC,WAAW,CAAC,IAAI,cAAc,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CACtH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAC7C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,IAAI,GAAG,CACzD,CAAC;QAEF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,sBAAsB;YACtB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAC9C,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CACzC,CAAC;YAEF,mBAAmB;YACnB,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;gBACjC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,wBAAwB;QACxB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,0CAA0C;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,YAAY;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,OAAO,EAAE,CAAC;YAC1E,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1B,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CACV,GAAG,IAAI,CAAC,GAAG,iBAAiB,IAAI,CAAC,cAAc,CAAC,MAAM,8BAA8B,CACrF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;CACF"}

package/dist/services/consent.service.d.ts

@@ -83,6 +83,7 @@ export declare class ConsentService {
         delegationToken: string;
         delegationId: string;
         userDid?: string;
+        authorizationType?: string;
     }, serverOrigin?: string): Promise<boolean>;
     /**
      * Initialize audit service - fetches config from remote API
@@ -384,6 +385,21 @@ export declare class ConsentService {
      * @returns Parsed body object
      */
     private parseRequestBody;
+    /**
+     * Interpret the `CONSENT_REQUIRE_IDENTITY` env override that gates the
+     * identity-required refusal in `handleApproval`. Defaults to enabled - only
+     * an explicit `"false"`/`"0"` disables it, mirroring the escape-hatch
+     * convention used for `MCPI_HTTP_CHALLENGE` in config.ts.
+     */
+    private isIdentityRequired;
+    /**
+     * 403 returned by `handleApproval` when a credential/OAuth clickwrap mint is
+     * attempted without a valid, grant-bound identity assertion (A3, spec §3.2).
+     * A distinct `error_code` from the plain `identity_required` gate so callers
+     * and tests can tell "no server-signed proof of authentication" apart from
+     * "no identity resolved at all".
+     */
+    private identityAssertionRequiredResponse;
     /**
      * Handle consent approval
      *
@@ -434,6 +450,11 @@ export declare class ConsentService {
      * @param delegationId - Delegation ID
      * @param providedUserDid - Optional userDid passed directly (bypasses KV read for consistency)
      * @param serverOrigin - Server origin for DO URL construction
+     * @param authorizationType - The delegation's authorization type as recorded
+     *   at mint (raw provider_type / authorization.type). Normalized here before
+     *   persisting so the call-time enforcement gate (Task B2/B3) reads a
+     *   consistent value ("password" | "oauth2" | "none" | …). Undefined → the
+     *   field is omitted and the gate fails safe (never satisfies a typed tool).
      */
     private storeDelegationToken;
     /**
@@ -546,6 +567,109 @@ export declare class ConsentService {
      * Constant-time string comparison to prevent timing attacks
      */
     private constantTimeCompare;
+    /**
+     * Whether local/miniflare testing may relax consent security checks.
+     *
+     * Mirrors `consent-anchor-bridge.ts`'s `isTestConsentMode` verbatim: requires
+     * BOTH `MCPI_TEST_CONSENT === "true"` AND an explicit `development`
+     * environment. The flag alone must NEVER relax a check on a
+     * production/staging/unset deployment.
+     *
+     * NOT used by `mintIdentityAssertion`/`verifyIdentityAssertion` — those are
+     * strictly fail-closed with no dev relaxation of any kind (a review found
+     * that signing/verifying under an attacker-known empty key when this flag
+     * is active was a latent total-forgery bypass if the two dev flags ever
+     * co-occurred in production). If a dev bypass for the identity-assertion
+     * requirement is ever needed, it belongs at the CALL SITE (mirroring how
+     * the anchor bridge bypasses CSRF via this flag at the handler, before
+     * `validateCsrfToken` is even invoked — never inside the crypto itself).
+     * Public so the OAuth callback path (runtime/oauth-handler.ts) can gate its
+     * own redirect mint on the identical dev/test relaxation used by the
+     * credential redirect above, rather than re-deriving the two-flag check.
+     */
+    isDevConsentTestMode(): boolean;
+    /**
+     * SHA-256 hex digest of the given scopes, sorted ascending and
+     * JSON-array-encoded. Used as the identity assertion's `scopesHash` so the
+     * signed grant binds to the scope *set* regardless of the order scopes
+     * arrive in the request body. Mirrors the digest-to-hex shape already used
+     * elsewhere in this codebase (e.g. `DelegationService.hashToken`).
+     *
+     * `JSON.stringify` (not a `\n`-joined string) is required for injectivity:
+     * a plain join collides distinct scope sets that share the same joined
+     * bytes — e.g. `["a\nb"]` and `["a", "b"]` both join to `"a\nb"`. JSON
+     * array encoding preserves each element's boundary (quoting + `,`
+     * separators), so distinct scope sets can never hash identically.
+     */
+    private hashScopes;
+    /**
+     * Compute HMAC-SHA256 for identity-assertion generation/validation.
+     *
+     * Structurally identical to `computeCsrfHmac`, but `computeCsrfHmac`
+     * hardcodes the `csrf:` key prefix internally so it cannot be reused for a
+     * different domain — this mirrors its shape with an `identity:` prefix
+     * instead, so a CSRF token and an identity assertion are signed under
+     * disjoint keys and can never validate as one another.
+     */
+    private computeIdentityHmac;
+    /**
+     * Mint a grant-bound, domain-separated HMAC identity assertion.
+     *
+     * Carries the `userDid` resolved by a completed authentication step
+     * (credential or OAuth) across the consent redirect, replacing the
+     * caller-forgeable `user_did` body field (see
+     * docs/superpowers/specs/2026-07-29-consent-approve-auth-gate-design.md
+     * §3.1). Format mirrors `storeCredentialCsrfToken`:
+     * `${hmacB64url}.${payloadB64url}`.
+     *
+     * Binds the grant, not just the identity: `agentDid`, `tool`, `scopesHash`
+     * (SHA-256 of the sorted scope set), and `projectId` are signed in and must
+     * be re-checked against the request body at mint time by the caller — a
+     * leaked assertion must not be replayable to mint an arbitrary grant under
+     * the victim's `userDid` within the 10-minute window.
+     *
+     * FAIL-CLOSED, ALWAYS: throws if `OAUTH_ENCRYPTION_SECRET` is unset or
+     * empty. There is deliberately NO dev/test relaxation inside this helper —
+     * signing under a predictable key (e.g. an empty-string fallback) would be
+     * an attacker-known key and a latent total-forgery bypass if a dev flag
+     * were ever misconfigured in production. A mint must never silently
+     * produce an unsigned/unverifiable token — unlike
+     * `storeCredentialCsrfToken`'s legacy "graceful degradation," which this
+     * assertion deliberately does not inherit. Any future dev/test bypass
+     * belongs at the call site (see `isDevConsentTestMode`'s docstring).
+     *
+     * Public so both authenticated redirect sites can mint under this service's
+     * `identity:`-keyed secret: the credential redirect (in-class) and the OAuth
+     * callback redirect (runtime/oauth-handler.ts, a separate module).
+     */
+    mintIdentityAssertion(params: {
+        sid: string;
+        userDid: string;
+        provider: string;
+        agentDid: string;
+        tool: string;
+        scopes: string[];
+        projectId: string;
+    }): Promise<string>;
+    /**
+     * Verify a grant-bound identity assertion minted by `mintIdentityAssertion`.
+     *
+     * Returns the payload's `userDid` iff: the HMAC matches (constant-time),
+     * the assertion has not expired, and every bound field (`sid`, `agentDid`,
+     * `tool`, `projectId`, and `scopesHash` recomputed from `expected.scopes`)
+     * equals the caller-supplied `expected` values. Any mismatch, tamper, or
+     * expiry returns `null` — never throws, so callers can treat `null`
+     * uniformly as "no verified identity."
+     *
+     * FAIL-CLOSED, ALWAYS: returns `null` if `OAUTH_ENCRYPTION_SECRET` is unset
+     * or empty. There is deliberately NO dev/test relaxation inside this
+     * helper — mirrors `consent-anchor-bridge.ts`'s `validateCsrfToken`, NOT
+     * `validateCredentialCsrfToken`'s legacy "return true to allow flow to
+     * continue" behavior (the fail-open this PR closes). Any future dev/test
+     * bypass belongs at the call site (see `isDevConsentTestMode`'s
+     * docstring), never as a predictable/empty signing key inside this helper.
+     */
+    private verifyIdentityAssertion;
     /**
      * Build full DelegationRecord format request (future format)
      */

package/dist/services/consent.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consent.service.d.ts","sourceRoot":"","sources":["../../src/services/consent.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAcpD,OAAO,KAAK,EAIV,aAAa,EACd,MAAM,2BAA2B,CAAC;AAYnC,OAAO,EAYL,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;AA6D/B,qBAAa,cAAc;IACzB,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,GAAG,CAAgB;IAC3B,OAAO,CAAC,OAAO,CAAC,CAAoB;IACpC,OAAO,CAAC,cAAc,CAAC,CAAiB;IAGxC,OAAO,CAAC,YAAY,CAAC,CAAsB;IAC3C,OAAO,CAAC,gBAAgB,CAAC,CAAgB;IAGzC,OAAO,CAAC,gBAAgB,CAAC,CAAmD;IAC5E,OAAO,CAAC,gBAAgB,CAAC,CAAwD;IAEjF;;;OAGG;gBAED,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,iBAAiB,EAC3B,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,EAAE,gBAAgB,EACnE,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,EAAE,qBAAqB;IAW1E;;;;;;;OAOG;YACW,eAAe;IAmC7B;;;;;;;OAOG;IACG,mBAAmB,CAAC,KAAK,EAAE;QAC/B,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KACzD,GAAG,OAAO,CAAC,IAAI,CAAC;IAMX,kBAAkB,CAAC,KAAK,EAAE;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjB;;;;;;;;;;;;OAYG;IACG,uBAAuB,CAC3B,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,EACD,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC;IAWnB;;;;;OAKG;YACW,sBAAsB;IAwCpC;;;;;;;;;;OAUG;YACW,sBAAsB;IAqEpC;;;;;;;;;;;;;;OAcG;IACU,oBAAoB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkFzB;;;;;;;;;;;OAWG;YACW,iCAAiC;IA0D/C;;;;;;;;;OASG;IACU,yBAAyB,CACpC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,IAAI,CAAC;IAuIhB;;;;;;;;;OASG;IACU,oBAAoB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAsE9B;;;;;;;;;;;;;;OAcG;IACU,yBAAyB,CACpC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IA0F9B;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IAInC;;;;;;;;;;;;;OAaG;IACU,kCAAkC,CAC7C,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAmGzB;;;;;;;;;;;;;OAaG;IACU,iBAAiB,CAC5B,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,EACpC,eAAe,CAAC,EAAE,WAAW,GAAG,IAAI,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA4DzB;;;;;;;;;;;;;;;;OAgBG;IACU,kBAAkB,CAC7B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QACR,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GACA,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC;IAwJjD;;;;;;;;;;;;OAYG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,EAC7B,iBAAiB,CAAC,EAAE,MAAM,EAC1B,cAAc,CAAC,EAAE,OAAO,mCAAmC,EAAE,cAAc,GAC1E,OAAO,CAAC,OAAO,CAAC;IA+HnB;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EAAE,EAChB,SAAS,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,6DAA6D;IAChF,oBAAoB,CAAC,EAAE,OAAO,0BAA0B,EAAE,oBAAoB,EAC9E,SAAS,CAAC,EAAE,MAAM,EAAE,sDAAsD;IAC1E,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC;IAkQlB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IAuB3B;;;;;;;;;;;OAWG;IACG,kBAAkB,CACtB,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC;IAyElB;;;;;;;;;;OAUG;IACG,oBAAoB,CACxB,aAAa,EAAE,aAAa,EAC5B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAgFhB;;;;;;;;;;OAUG;IACG,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAqCjD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kBAAkB;IAkB1B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,8BAA8B;IAYtC;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAetB;;;;;;;;;;;;;OAaG;YACW,iBAAiB;IAk1B/B;;;;;;;;OAQG;YACW,gBAAgB;IA2lC9B;;;;;;;;OAQG;YACW,cAAc;IAwd5B;;;;;OAKG;YACW,gBAAgB;IA+S9B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAQ7B;;;;;;;;;OASG;YACW,oBAAoB;IAkElC;;;;;;;;;;;;OAYG;YACW,oBAAoB;IA4FlC;;;;;OAKG;YACW,iBAAiB;IAmC/B;;;;OAIG;YACW,sBAAsB;IA4FpC;;;;;;;;;OASG;YACW,wBAAwB;IAoftC;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IA2BnB;;;;;;;OAOG;YACW,2BAA2B;IAkGzC;;;;;;;;;OASG;IACH,OAAO,CAAC,2BAA2B;IA4GnC;;OAEG;YACW,yBAAyB;IAsDvC;;OAEG;YACW,oBAAoB;IAmDlC;;;;;;;;;;;OAWG;YACW,2BAA2B;IAmDzC;;;;;;;;;OASG;IACU,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuBzE;;;;;OAKG;YACW,eAAe;IAgB7B;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAI7B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAK7B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;OAEG;YACW,sBAAsB;IAmJpC;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IAMnB;;;;;;;;;OASG;IACH,OAAO,CAAC,4BAA4B;IAqLpC;;OAEG;YACW,UAAU;IAqDxB;;;;;OAKG;YACW,WAAW;IA0GzB;;OAEG;YACW,qBAAqB;CAsBpC"}
+{"version":3,"file":"consent.service.d.ts","sourceRoot":"","sources":["../../src/services/consent.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAepD,OAAO,KAAK,EAIV,aAAa,EACd,MAAM,2BAA2B,CAAC;AAYnC,OAAO,EAYL,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;AA6D/B,qBAAa,cAAc;IACzB,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,GAAG,CAAgB;IAC3B,OAAO,CAAC,OAAO,CAAC,CAAoB;IACpC,OAAO,CAAC,cAAc,CAAC,CAAiB;IAGxC,OAAO,CAAC,YAAY,CAAC,CAAsB;IAC3C,OAAO,CAAC,gBAAgB,CAAC,CAAgB;IAGzC,OAAO,CAAC,gBAAgB,CAAC,CAAmD;IAC5E,OAAO,CAAC,gBAAgB,CAAC,CAAwD;IAEjF;;;OAGG;gBAED,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,iBAAiB,EAC3B,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,EAAE,gBAAgB,EACnE,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,EAAE,qBAAqB;IAW1E;;;;;;;OAOG;YACW,eAAe;IAmC7B;;;;;;;OAOG;IACG,mBAAmB,CAAC,KAAK,EAAE;QAC/B,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KACzD,GAAG,OAAO,CAAC,IAAI,CAAC;IAMX,kBAAkB,CAAC,KAAK,EAAE;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjB;;;;;;;;;;;;OAYG;IACG,uBAAuB,CAC3B,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QAEjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,EACD,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC;IAYnB;;;;;OAKG;YACW,sBAAsB;IAwCpC;;;;;;;;;;OAUG;YACW,sBAAsB;IAqEpC;;;;;;;;;;;;;;OAcG;IACU,oBAAoB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkFzB;;;;;;;;;;;OAWG;YACW,iCAAiC;IA0D/C;;;;;;;;;OASG;IACU,yBAAyB,CACpC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,IAAI,CAAC;IAuIhB;;;;;;;;;OASG;IACU,oBAAoB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAsE9B;;;;;;;;;;;;;;OAcG;IACU,yBAAyB,CACpC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IA0F9B;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IAInC;;;;;;;;;;;;;OAaG;IACU,kCAAkC,CAC7C,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAmGzB;;;;;;;;;;;;;OAaG;IACU,iBAAiB,CAC5B,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,EACpC,eAAe,CAAC,EAAE,WAAW,GAAG,IAAI,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA4DzB;;;;;;;;;;;;;;;;OAgBG;IACU,kBAAkB,CAC7B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QACR,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GACA,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC;IAwJjD;;;;;;;;;;;;OAYG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,EAC7B,iBAAiB,CAAC,EAAE,MAAM,EAC1B,cAAc,CAAC,EAAE,OAAO,mCAAmC,EAAE,cAAc,GAC1E,OAAO,CAAC,OAAO,CAAC;IA+HnB;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EAAE,EAChB,SAAS,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,6DAA6D;IAChF,oBAAoB,CAAC,EAAE,OAAO,0BAA0B,EAAE,oBAAoB,EAC9E,SAAS,CAAC,EAAE,MAAM,EAAE,sDAAsD;IAC1E,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC;IA6QlB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IAuB3B;;;;;;;;;;;OAWG;IACG,kBAAkB,CACtB,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC;IAyElB;;;;;;;;;;OAUG;IACG,oBAAoB,CACxB,aAAa,EAAE,aAAa,EAC5B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAgFhB;;;;;;;;;;OAUG;IACG,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAqCjD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kBAAkB;IAkB1B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,8BAA8B;IAYtC;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAetB;;;;;;;;;;;;;OAaG;YACW,iBAAiB;IA01B/B;;;;;;;;OAQG;YACW,gBAAgB;IA2lC9B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAO1B;;;;;;OAMG;IACH,OAAO,CAAC,iCAAiC;IAczC;;;;;;;;OAQG;YACW,cAAc;IA+kB5B;;;;;OAKG;YACW,gBAAgB;IA+T9B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAQ7B;;;;;;;;;OASG;YACW,oBAAoB;IAqElC;;;;;;;;;;;;;;;;;OAiBG;YACW,oBAAoB;IA4GlC;;;;;OAKG;YACW,iBAAiB;IAmC/B;;;;OAIG;YACW,sBAAsB;IA4FpC;;;;;;;;;OASG;YACW,wBAAwB;IAgiBtC;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IA2BnB;;;;;;;OAOG;YACW,2BAA2B;IAkGzC;;;;;;;;;OASG;IACH,OAAO,CAAC,2BAA2B;IA4GnC;;OAEG;YACW,yBAAyB;IAsDvC;;OAEG;YACW,oBAAoB;IAmDlC;;;;;;;;;;;OAWG;YACW,2BAA2B;IAyDzC;;;;;;;;;OASG;IACU,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkCzE;;;;;OAKG;YACW,eAAe;IAgB7B;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAI7B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAK7B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;;;;;;;;;;;;;;;;;;OAmBG;IACI,oBAAoB,IAAI,OAAO;IAYtC;;;;;;;;;;;;OAYG;YACW,UAAU;IAWxB;;;;;;;;OAQG;YACW,mBAAmB;IAgBjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACU,qBAAqB,CAAC,MAAM,EAAE;QACzC,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,MAAM,CAAC;IA6BnB;;;;;;;;;;;;;;;;;OAiBG;YACW,uBAAuB;IAoGrC;;OAEG;YACW,sBAAsB;IAmJpC;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IAMnB;;;;;;;;;OASG;IACH,OAAO,CAAC,4BAA4B;IAqLpC;;OAEG;YACW,UAAU;IAqDxB;;;;;OAKG;YACW,WAAW;IA0GzB;;OAEG;YACW,qBAAqB;CAsBpC"}