@kya-os/mcp-i-cloudflare 1.13.6 → 1.14.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/delegation-http/challenge.d.ts +22 -4
- package/dist/delegation-http/challenge.d.ts.map +1 -1
- package/dist/delegation-http/challenge.js +56 -8
- package/dist/delegation-http/challenge.js.map +1 -1
- package/dist/delegation-http/types.d.ts +18 -0
- package/dist/delegation-http/types.d.ts.map +1 -1
- package/package.json +1 -1
|
@@ -33,9 +33,24 @@ export declare function buildConsentUri(i: ChallengeVerdictInput): string;
|
|
|
33
33
|
/** The pickup endpoint URL on the worker's authorization host: `…/api/delegation/pickup/<sid>`. */
|
|
34
34
|
export declare function buildPickupUri(i: ChallengeVerdictInput): string;
|
|
35
35
|
/**
|
|
36
|
-
* Build the human-facing `instructions` string (§8.1)
|
|
37
|
-
*
|
|
38
|
-
*
|
|
36
|
+
* Build the human-facing `instructions` string (§8.1), gated on the host's
|
|
37
|
+
* declared pickup profile (`ChallengeVerdictInput.pickupProfile`).
|
|
38
|
+
*
|
|
39
|
+
* DEFAULT (no profile): the reviewed token-first choreography — generate an
|
|
40
|
+
* unpadded-base64url 32-byte token, establish the binding with it, relay the
|
|
41
|
+
* consent link after 202 pending, poll with the SAME token, retry as plain
|
|
42
|
+
* Bearer. No did:key polls and no signed retries: this runtime's pickup
|
|
43
|
+
* surface treats signature-only polls as no-identity polls, and its mint
|
|
44
|
+
* does not `cnf`-bind the delegation to a pickup key, so those directives
|
|
45
|
+
* would dead-end a compliant agent (signed poll never binds; signed retry of
|
|
46
|
+
* a non-holder-bound VC is refused as `kyaos/holder-mismatch`).
|
|
47
|
+
*
|
|
48
|
+
* NATIVE (`pickupProfile: "kya-http/2"`): the binding-first native
|
|
49
|
+
* choreography from the checkpoint-shared golden fixture — ephemeral did:key
|
|
50
|
+
* polls for capable agents, same-key + fresh-nonce retries. Byte-exact vs
|
|
51
|
+
* the fixture given its inputs. Only for hosts whose issuer mints
|
|
52
|
+
* holder-bound delegations and whose resource verifier speaks the native
|
|
53
|
+
* profile.
|
|
39
54
|
*/
|
|
40
55
|
export declare function buildInstructions(i: ChallengeVerdictInput): string;
|
|
41
56
|
/**
|
|
@@ -46,7 +61,10 @@ export declare function buildChallengeBody(i: ChallengeVerdictInput, challengePr
|
|
|
46
61
|
/**
|
|
47
62
|
* Build the full §8.1 401 `Response`: dual `WWW-Authenticate` challenges (Delegation
|
|
48
63
|
* first, then Bearer), `Retry-After`, JSON content type, and `Cache-Control:
|
|
49
|
-
* no-store`.
|
|
64
|
+
* no-store`. Under the native profile the unsigned consent hint headers
|
|
65
|
+
* (`KYA-Auth-Required`/`KYA-Auth-Url`/`Link`/`KYA-Action`) are mirrored from the
|
|
66
|
+
* fetcher-200 envelope so header-only surfaces see the consent target on the 401
|
|
67
|
+
* too; the default legacy envelope stays 1.13.6-shaped.
|
|
50
68
|
*/
|
|
51
69
|
export declare function buildChallengeResponse(i: ChallengeVerdictInput, challengeProof: string): Response;
|
|
52
70
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../src/delegation-http/challenge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAUnE;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,CAAC,EAAE,qBAAqB,GACvB,MAAM,CAqBR;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAEhE;AAED,mGAAmG;AACnG,wBAAgB,cAAc,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAE/D;AAED
|
|
1
|
+
{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../src/delegation-http/challenge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAUnE;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,CAAC,EAAE,qBAAqB,GACvB,MAAM,CAqBR;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAEhE;AAED,mGAAmG;AACnG,wBAAgB,cAAc,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAE/D;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAmBlE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,CAAC,EAAE,qBAAqB,EACxB,cAAc,EAAE,MAAM,GACrB,MAAM,CAkCR;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,CAAC,EAAE,qBAAqB,EACxB,cAAc,EAAE,MAAM,GACrB,QAAQ,CAmBV;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,6BAA6B,CAC3C,CAAC,EAAE,qBAAqB,EACxB,cAAc,EAAE,MAAM,GACrB,QAAQ,CAcV;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,wBAAwB,EAC7B,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAE,GACvE,OAAO,CAAC,MAAM,CAAC,CAmBjB"}
|
|
@@ -60,17 +60,39 @@ export function buildPickupUri(i) {
|
|
|
60
60
|
return `https://${i.authorizationHost}/api/delegation/pickup/${i.sid}`;
|
|
61
61
|
}
|
|
62
62
|
/**
|
|
63
|
-
* Build the human-facing `instructions` string (§8.1)
|
|
64
|
-
*
|
|
65
|
-
*
|
|
63
|
+
* Build the human-facing `instructions` string (§8.1), gated on the host's
|
|
64
|
+
* declared pickup profile (`ChallengeVerdictInput.pickupProfile`).
|
|
65
|
+
*
|
|
66
|
+
* DEFAULT (no profile): the reviewed token-first choreography — generate an
|
|
67
|
+
* unpadded-base64url 32-byte token, establish the binding with it, relay the
|
|
68
|
+
* consent link after 202 pending, poll with the SAME token, retry as plain
|
|
69
|
+
* Bearer. No did:key polls and no signed retries: this runtime's pickup
|
|
70
|
+
* surface treats signature-only polls as no-identity polls, and its mint
|
|
71
|
+
* does not `cnf`-bind the delegation to a pickup key, so those directives
|
|
72
|
+
* would dead-end a compliant agent (signed poll never binds; signed retry of
|
|
73
|
+
* a non-holder-bound VC is refused as `kyaos/holder-mismatch`).
|
|
74
|
+
*
|
|
75
|
+
* NATIVE (`pickupProfile: "kya-http/2"`): the binding-first native
|
|
76
|
+
* choreography from the checkpoint-shared golden fixture — ephemeral did:key
|
|
77
|
+
* polls for capable agents, same-key + fresh-nonce retries. Byte-exact vs
|
|
78
|
+
* the fixture given its inputs. Only for hosts whose issuer mints
|
|
79
|
+
* holder-bound delegations and whose resource verifier speaks the native
|
|
80
|
+
* profile.
|
|
66
81
|
*/
|
|
67
82
|
export function buildInstructions(i) {
|
|
68
83
|
const consentUri = buildConsentUri(i);
|
|
69
84
|
const pickupUri = buildPickupUri(i);
|
|
70
|
-
|
|
71
|
-
`
|
|
72
|
-
|
|
73
|
-
|
|
85
|
+
if (i.pickupProfile === "kya-http/2") {
|
|
86
|
+
return (`This action requires human authorization. First establish your pickup binding at ${pickupUri}. ` +
|
|
87
|
+
`If you can sign HTTP requests, sign each poll with an ephemeral did:key; otherwise generate one random 32-byte token encoded as unpadded base64url and send it as X-KYA-Pickup-Token on EVERY poll. ` +
|
|
88
|
+
`After receiving 202 pending, show your user this link and ask them to approve: ${consentUri}. ` +
|
|
89
|
+
`Continue polling ${pickupUri} every ${i.pollIntervalS} seconds with the same binding. ` +
|
|
90
|
+
`When the response status is 200, take the 'delegation' value and retry your original request with header 'Authorization: Bearer <delegation>'. If pickup used a key, sign every retry with that same key and a fresh nonce.`);
|
|
91
|
+
}
|
|
92
|
+
return (`This action requires human authorization. Generate one random 32-byte token encoded as unpadded base64url and keep it for this authorization request. ` +
|
|
93
|
+
`First establish your pickup binding at ${pickupUri} by sending that token as X-KYA-Pickup-Token. ` +
|
|
94
|
+
`After receiving 202 pending, show your user this link and ask them to approve: ${consentUri}. ` +
|
|
95
|
+
`Continue polling ${pickupUri} every ${i.pollIntervalS} seconds with the same X-KYA-Pickup-Token on EVERY poll. ` +
|
|
74
96
|
`When the response status is 200, take the 'delegation' value and retry your original request with header 'Authorization: Bearer <delegation>'.`);
|
|
75
97
|
}
|
|
76
98
|
/**
|
|
@@ -89,6 +111,22 @@ export function buildChallengeBody(i, challengeProof) {
|
|
|
89
111
|
}
|
|
90
112
|
kyaos.poll_interval_s = i.pollIntervalS;
|
|
91
113
|
kyaos.challenge_proof = challengeProof;
|
|
114
|
+
if (i.pickupProfile === "kya-http/2") {
|
|
115
|
+
// Machine-readable choreography descriptor: agents that parse structure
|
|
116
|
+
// instead of prose read the pin header and retry presentation from here.
|
|
117
|
+
// Key order mirrors the golden fixture's `kyaos.action`. NATIVE PROFILE
|
|
118
|
+
// ONLY: checkpoint's legacy-drift boundary treats this block's presence
|
|
119
|
+
// as a reviewed signal of native pickup support, so the default legacy
|
|
120
|
+
// body stays 1.13.6-shaped (no action block).
|
|
121
|
+
kyaos.action = {
|
|
122
|
+
type: "delegation",
|
|
123
|
+
consent_uri: buildConsentUri(i),
|
|
124
|
+
pickup_uri: buildPickupUri(i),
|
|
125
|
+
poll_interval_s: i.pollIntervalS,
|
|
126
|
+
pin: { header: "X-KYA-Pickup-Token" },
|
|
127
|
+
retry: { header: "Authorization", scheme: "Bearer", value_from: "delegation" },
|
|
128
|
+
};
|
|
129
|
+
}
|
|
92
130
|
return {
|
|
93
131
|
error: KYAOS_ERRORS.authorizationRequired,
|
|
94
132
|
kyaos,
|
|
@@ -98,15 +136,25 @@ export function buildChallengeBody(i, challengeProof) {
|
|
|
98
136
|
/**
|
|
99
137
|
* Build the full §8.1 401 `Response`: dual `WWW-Authenticate` challenges (Delegation
|
|
100
138
|
* first, then Bearer), `Retry-After`, JSON content type, and `Cache-Control:
|
|
101
|
-
* no-store`.
|
|
139
|
+
* no-store`. Under the native profile the unsigned consent hint headers
|
|
140
|
+
* (`KYA-Auth-Required`/`KYA-Auth-Url`/`Link`/`KYA-Action`) are mirrored from the
|
|
141
|
+
* fetcher-200 envelope so header-only surfaces see the consent target on the 401
|
|
142
|
+
* too; the default legacy envelope stays 1.13.6-shaped.
|
|
102
143
|
*/
|
|
103
144
|
export function buildChallengeResponse(i, challengeProof) {
|
|
145
|
+
const consentUri = buildConsentUri(i);
|
|
104
146
|
const headers = new Headers();
|
|
105
147
|
headers.append("WWW-Authenticate", buildWWWAuthenticateDelegation(i));
|
|
106
148
|
headers.append("WWW-Authenticate", buildWWWAuthenticateBearer(i.realm));
|
|
107
149
|
headers.set("Retry-After", String(i.pollIntervalS));
|
|
108
150
|
headers.set("Content-Type", "application/json");
|
|
109
151
|
headers.set("Cache-Control", "no-store");
|
|
152
|
+
if (i.pickupProfile === "kya-http/2") {
|
|
153
|
+
headers.set("KYA-Auth-Required", "true");
|
|
154
|
+
headers.set("KYA-Auth-Url", consentUri);
|
|
155
|
+
headers.set("Link", `<${consentUri}>; rel="kya-authorize"`);
|
|
156
|
+
headers.set("KYA-Action", "challenge");
|
|
157
|
+
}
|
|
110
158
|
return new Response(JSON.stringify(buildChallengeBody(i, challengeProof)), {
|
|
111
159
|
status: 401,
|
|
112
160
|
headers,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"challenge.js","sourceRoot":"","sources":["../../src/delegation-http/challenge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIlE;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,CAAwB;IAExB,MAAM,MAAM,GAGR;QACF,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;QAC/B,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7B,KAAK,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QACjC,aAAa,EAAE,CAAC,CAAC,YAAY;QAC7B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;QACjC,IAAI,EAAE,YAAY;KACnB,CAAC;IAEF,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM;IACzC,8EAA8E;IAC9E,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CACnC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAE1C,OAAO,cAAc,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,OAAO,qCAAqC,KAAK,wCAAwC,CAAC;AAC5F,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAAC,CAAwB;IACtD,OAAO,WAAW,CAAC,CAAC,iBAAiB,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC;AAC/D,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,cAAc,CAAC,CAAwB;IACrD,OAAO,WAAW,CAAC,CAAC,iBAAiB,0BAA0B,CAAC,CAAC,GAAG,EAAE,CAAC;AACzE,CAAC;AAED
|
|
1
|
+
{"version":3,"file":"challenge.js","sourceRoot":"","sources":["../../src/delegation-http/challenge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIlE;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,CAAwB;IAExB,MAAM,MAAM,GAGR;QACF,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;QAC/B,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7B,KAAK,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QACjC,aAAa,EAAE,CAAC,CAAC,YAAY;QAC7B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;QACjC,IAAI,EAAE,YAAY;KACnB,CAAC;IAEF,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM;IACzC,8EAA8E;IAC9E,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CACnC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAE1C,OAAO,cAAc,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,OAAO,qCAAqC,KAAK,wCAAwC,CAAC;AAC5F,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAAC,CAAwB;IACtD,OAAO,WAAW,CAAC,CAAC,iBAAiB,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC;AAC/D,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,cAAc,CAAC,CAAwB;IACrD,OAAO,WAAW,CAAC,CAAC,iBAAiB,0BAA0B,CAAC,CAAC,GAAG,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAwB;IACxD,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;QACrC,OAAO,CACL,oFAAoF,SAAS,IAAI;YACjG,sMAAsM;YACtM,kFAAkF,UAAU,IAAI;YAChG,oBAAoB,SAAS,UAAU,CAAC,CAAC,aAAa,kCAAkC;YACxF,6NAA6N,CAC9N,CAAC;IACJ,CAAC;IACD,OAAO,CACL,wJAAwJ;QACxJ,0CAA0C,SAAS,gDAAgD;QACnG,kFAAkF,UAAU,IAAI;QAChG,oBAAoB,SAAS,UAAU,CAAC,CAAC,aAAa,2DAA2D;QACjH,gJAAgJ,CACjJ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,CAAwB,EACxB,cAAsB;IAEtB,MAAM,KAAK,GAA4B;QACrC,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;QAC/B,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7B,eAAe,EAAE,CAAC,CAAC,cAAc;KAClC,CAAC;IACF,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACjC,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IACvC,CAAC;IACD,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,aAAa,CAAC;IACxC,KAAK,CAAC,eAAe,GAAG,cAAc,CAAC;IACvC,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;QACrC,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,uEAAuE;QACvE,8CAA8C;QAC9C,KAAK,CAAC,MAAM,GAAG;YACb,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;YAC/B,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;YAC7B,eAAe,EAAE,CAAC,CAAC,aAAa;YAChC,GAAG,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE;YACrC,KAAK,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE;SAC/E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,YAAY,CAAC,qBAAqB;QACzC,KAAK;QACL,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,CAAwB,EACxB,cAAsB;IAEtB,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,UAAU,wBAAwB,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,EAAE;QACzE,MAAM,EAAE,GAAG;QACX,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,CAAwB,EACxB,cAAsB;IAEtB,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,UAAU,wBAAwB,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAEvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,EAAE;QACzE,MAAM,EAAE,GAAG;QACX,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAA6B,EAC7B,OAAwE;IAExE,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,aAAa,CACnC;QACE,MAAM,EAAE,sBAAsB;QAC9B,MAAM,EAAE;YACN,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC;KACF,EACD,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAC9B;QACE,wEAAwE;QACxE,KAAK,EAAE,OAAO,CAAC,GAAG;QAClB,QAAQ,EAAE,OAAO,CAAC,WAAW;QAC7B,SAAS,EAAE,OAAO,CAAC,GAAG;KACvB,CACF,CAAC;IACF,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC"}
|
|
@@ -73,6 +73,24 @@ export interface ChallengeVerdictInput {
|
|
|
73
73
|
realm: string;
|
|
74
74
|
sid: string;
|
|
75
75
|
pollIntervalS: number;
|
|
76
|
+
/**
|
|
77
|
+
* The pickup profile the AUTHORIZATION HOST actually supports, which gates
|
|
78
|
+
* the `instructions` choreography:
|
|
79
|
+
*
|
|
80
|
+
* - absent (default): token-first instructions only. This runtime's pickup
|
|
81
|
+
* surface treats a Signature-Input-only poll as a no-identity poll
|
|
82
|
+
* (pickup-poll-identity: the token path stands), and its consent mint
|
|
83
|
+
* does not `cnf`-bind the delegation to a pickup key — so directing an
|
|
84
|
+
* agent to sign polls or to sign retries with the pickup key dead-ends:
|
|
85
|
+
* the signed poll never establishes a binding, and a signed retry of a
|
|
86
|
+
* non-holder-bound VC is refused (`kyaos/holder-mismatch`).
|
|
87
|
+
* - `"kya-http/2"`: the native binding-first choreography (ephemeral
|
|
88
|
+
* did:key polls, same-key + fresh-nonce retries). Set this ONLY for a
|
|
89
|
+
* host whose issuer mints holder-bound (`cnf`) delegations for the
|
|
90
|
+
* pickup key and whose resource verifier is configured for the native
|
|
91
|
+
* profile — the checkpoint-shared golden fixture describes this mode.
|
|
92
|
+
*/
|
|
93
|
+
pickupProfile?: "kya-http/2";
|
|
76
94
|
}
|
|
77
95
|
/**
|
|
78
96
|
* A pickup poll holder, as presented on the wire. The raw `value` is hashed inside
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/delegation-http/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE7D;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,GAAG,YAAY,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kHAAkH;IAClH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/delegation-http/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE7D;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,GAAG,YAAY,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kHAAkH;IAClH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACf"}
|