@kya-os/mcp-i-cloudflare 1.13.6 → 1.14.2

package/dist/delegation-http/challenge.d.ts

@@ -33,9 +33,22 @@ export declare function buildConsentUri(i: ChallengeVerdictInput): string;
 /** The pickup endpoint URL on the worker's authorization host: `…/api/delegation/pickup/<sid>`. */
 export declare function buildPickupUri(i: ChallengeVerdictInput): string;
 /**
- * Build the human-facing `instructions` string (§8.1). Carries the four REQUIRED
- * elements: (1) consent-uri relay, (2) pickup-uri + interval, (3) pinning
- * requirement, (4) retry presentation. Byte-exact vs the fixture given its inputs.
+ * Build the human-facing `instructions` string (§8.1), gated on the host's
+ * declared pickup profile (`ChallengeVerdictInput.pickupProfile`).
+ *
+ * DEFAULT (no profile): the reviewed token-first choreography — generate an
+ * unpadded-base64url 32-byte token, establish the binding with it, relay the
+ * consent link after 202 pending, poll with the SAME token, retry as plain
+ * Bearer. No did:key polls and no signed retries: this runtime's pickup
+ * surface treats signature-only polls as no-identity polls, and its mint
+ * does not `cnf`-bind the delegation to a pickup key, so those directives
+ * would dead-end a compliant agent (signed poll never binds; signed retry of
+ * a non-holder-bound VC is refused as `kyaos/holder-mismatch`).
+ *
+ * The explicit pickupProfile opt-in retains the reviewed binding-first legacy
+ * envelope for hosts that support signed pickup. It does not make that legacy
+ * credential holder-bound. Strict native challenges and their mandatory fresh
+ * retry proofs are emitted by native-http.ts from the registered native contract.
  */
 export declare function buildInstructions(i: ChallengeVerdictInput): string;
 /**
@@ -46,7 +59,10 @@ export declare function buildChallengeBody(i: ChallengeVerdictInput, challengePr
 /**
  * Build the full §8.1 401 `Response`: dual `WWW-Authenticate` challenges (Delegation
  * first, then Bearer), `Retry-After`, JSON content type, and `Cache-Control:
- * no-store`.
+ * no-store`. Under the native profile the unsigned consent hint headers
+ * (`KYA-Auth-Required`/`KYA-Auth-Url`/`Link`/`KYA-Action`) are mirrored from the
+ * fetcher-200 envelope so header-only surfaces see the consent target on the 401
+ * too; the default legacy envelope stays 1.13.6-shaped.
  */
 export declare function buildChallengeResponse(i: ChallengeVerdictInput, challengeProof: string): Response;
 /**

package/dist/delegation-http/challenge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../src/delegation-http/challenge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAUnE;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,CAAC,EAAE,qBAAqB,GACvB,MAAM,CAqBR;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAEhE;AAED,mGAAmG;AACnG,wBAAgB,cAAc,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAE/D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAUlE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,CAAC,EAAE,qBAAqB,EACxB,cAAc,EAAE,MAAM,GACrB,MAAM,CAkBR;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,CAAC,EAAE,qBAAqB,EACxB,cAAc,EAAE,MAAM,GACrB,QAAQ,CAYV;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,6BAA6B,CAC3C,CAAC,EAAE,qBAAqB,EACxB,cAAc,EAAE,MAAM,GACrB,QAAQ,CAcV;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,wBAAwB,EAC7B,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAE,GACvE,OAAO,CAAC,MAAM,CAAC,CAmBjB"}
+{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../src/delegation-http/challenge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAUnE;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,CAAC,EAAE,qBAAqB,GACvB,MAAM,CAqBR;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAEhE;AAED,mGAAmG;AACnG,wBAAgB,cAAc,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAE/D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAmBlE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,CAAC,EAAE,qBAAqB,EACxB,cAAc,EAAE,MAAM,GACrB,MAAM,CAsCR;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,CAAC,EAAE,qBAAqB,EACxB,cAAc,EAAE,MAAM,GACrB,QAAQ,CAmBV;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,6BAA6B,CAC3C,CAAC,EAAE,qBAAqB,EACxB,cAAc,EAAE,MAAM,GACrB,QAAQ,CAcV;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,wBAAwB,EAC7B,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAE,GACvE,OAAO,CAAC,MAAM,CAAC,CAmBjB"}

package/dist/delegation-http/challenge.js

@@ -60,17 +60,37 @@ export function buildPickupUri(i) {
     return `https://${i.authorizationHost}/api/delegation/pickup/${i.sid}`;
 }
 /**
- * Build the human-facing `instructions` string (§8.1). Carries the four REQUIRED
- * elements: (1) consent-uri relay, (2) pickup-uri + interval, (3) pinning
- * requirement, (4) retry presentation. Byte-exact vs the fixture given its inputs.
+ * Build the human-facing `instructions` string (§8.1), gated on the host's
+ * declared pickup profile (`ChallengeVerdictInput.pickupProfile`).
+ *
+ * DEFAULT (no profile): the reviewed token-first choreography — generate an
+ * unpadded-base64url 32-byte token, establish the binding with it, relay the
+ * consent link after 202 pending, poll with the SAME token, retry as plain
+ * Bearer. No did:key polls and no signed retries: this runtime's pickup
+ * surface treats signature-only polls as no-identity polls, and its mint
+ * does not `cnf`-bind the delegation to a pickup key, so those directives
+ * would dead-end a compliant agent (signed poll never binds; signed retry of
+ * a non-holder-bound VC is refused as `kyaos/holder-mismatch`).
+ *
+ * The explicit pickupProfile opt-in retains the reviewed binding-first legacy
+ * envelope for hosts that support signed pickup. It does not make that legacy
+ * credential holder-bound. Strict native challenges and their mandatory fresh
+ * retry proofs are emitted by native-http.ts from the registered native contract.
  */
 export function buildInstructions(i) {
     const consentUri = buildConsentUri(i);
     const pickupUri = buildPickupUri(i);
-    return (`This action requires human authorization. Show your user this link and ask them to approve: ${consentUri}. ` +
-        `Then poll ${pickupUri} every ${i.pollIntervalS} seconds. ` +
-        `If you can sign HTTP requests, sign each poll with an ephemeral did:key; ` +
-        `otherwise generate one random 32-byte token and send it as X-KYA-Pickup-Token on EVERY poll. ` +
+    if (i.pickupProfile === "kya-http/2") {
+        return (`This action requires human authorization. First establish your pickup binding at ${pickupUri}. ` +
+            `If you can sign HTTP requests, sign each poll with an ephemeral did:key; otherwise generate one random 32-byte token encoded as unpadded base64url and send it as X-KYA-Pickup-Token on EVERY poll. ` +
+            `After receiving 202 pending, show your user this link and ask them to approve: ${consentUri}. ` +
+            `Continue polling ${pickupUri} every ${i.pollIntervalS} seconds with the same binding. ` +
+            `When the response status is 200, take the 'delegation' value and retry your original request with header 'Authorization: Bearer <delegation>'.`);
+    }
+    return (`This action requires human authorization. Generate one random 32-byte token encoded as unpadded base64url and keep it for this authorization request. ` +
+        `First establish your pickup binding at ${pickupUri} by sending that token as X-KYA-Pickup-Token. ` +
+        `After receiving 202 pending, show your user this link and ask them to approve: ${consentUri}. ` +
+        `Continue polling ${pickupUri} every ${i.pollIntervalS} seconds with the same X-KYA-Pickup-Token on EVERY poll. ` +
         `When the response status is 200, take the 'delegation' value and retry your original request with header 'Authorization: Bearer <delegation>'.`);
 }
 /**
@@ -89,6 +109,26 @@ export function buildChallengeBody(i, challengeProof) {
     }
     kyaos.poll_interval_s = i.pollIntervalS;
     kyaos.challenge_proof = challengeProof;
+    if (i.pickupProfile === "kya-http/2") {
+        // Machine-readable choreography descriptor: agents that parse structure
+        // instead of prose read the pin header and retry presentation from here.
+        // Key order mirrors the golden fixture's `kyaos.action`. NATIVE PROFILE
+        // ONLY: checkpoint's legacy-drift boundary treats this block's presence
+        // as a reviewed signal of native pickup support, so the default legacy
+        // body stays 1.13.6-shaped (no action block).
+        kyaos.action = {
+            type: "delegation",
+            consent_uri: buildConsentUri(i),
+            pickup_uri: buildPickupUri(i),
+            poll_interval_s: i.pollIntervalS,
+            pin: { header: "X-KYA-Pickup-Token" },
+            retry: {
+                header: "Authorization",
+                scheme: "Bearer",
+                value_from: "delegation",
+            },
+        };
+    }
     return {
         error: KYAOS_ERRORS.authorizationRequired,
         kyaos,
@@ -98,15 +138,25 @@ export function buildChallengeBody(i, challengeProof) {
 /**
  * Build the full §8.1 401 `Response`: dual `WWW-Authenticate` challenges (Delegation
  * first, then Bearer), `Retry-After`, JSON content type, and `Cache-Control:
- * no-store`.
+ * no-store`. Under the native profile the unsigned consent hint headers
+ * (`KYA-Auth-Required`/`KYA-Auth-Url`/`Link`/`KYA-Action`) are mirrored from the
+ * fetcher-200 envelope so header-only surfaces see the consent target on the 401
+ * too; the default legacy envelope stays 1.13.6-shaped.
  */
 export function buildChallengeResponse(i, challengeProof) {
+    const consentUri = buildConsentUri(i);
     const headers = new Headers();
     headers.append("WWW-Authenticate", buildWWWAuthenticateDelegation(i));
     headers.append("WWW-Authenticate", buildWWWAuthenticateBearer(i.realm));
     headers.set("Retry-After", String(i.pollIntervalS));
     headers.set("Content-Type", "application/json");
     headers.set("Cache-Control", "no-store");
+    if (i.pickupProfile === "kya-http/2") {
+        headers.set("KYA-Auth-Required", "true");
+        headers.set("KYA-Auth-Url", consentUri);
+        headers.set("Link", `<${consentUri}>; rel="kya-authorize"`);
+        headers.set("KYA-Action", "challenge");
+    }
     return new Response(JSON.stringify(buildChallengeBody(i, challengeProof)), {
         status: 401,
         headers,

package/dist/delegation-http/challenge.js.map

@@ -1 +1 @@
-{"version":3,"file":"challenge.js","sourceRoot":"","sources":["../../src/delegation-http/challenge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIlE;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,CAAwB;IAExB,MAAM,MAAM,GAGR;QACF,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;QAC/B,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7B,KAAK,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QACjC,aAAa,EAAE,CAAC,CAAC,YAAY;QAC7B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;QACjC,IAAI,EAAE,YAAY;KACnB,CAAC;IAEF,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM;IACzC,8EAA8E;IAC9E,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CACnC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAE1C,OAAO,cAAc,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,OAAO,qCAAqC,KAAK,wCAAwC,CAAC;AAC5F,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAAC,CAAwB;IACtD,OAAO,WAAW,CAAC,CAAC,iBAAiB,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC;AAC/D,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,cAAc,CAAC,CAAwB;IACrD,OAAO,WAAW,CAAC,CAAC,iBAAiB,0BAA0B,CAAC,CAAC,GAAG,EAAE,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAwB;IACxD,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IACpC,OAAO,CACL,+FAA+F,UAAU,IAAI;QAC7G,aAAa,SAAS,UAAU,CAAC,CAAC,aAAa,YAAY;QAC3D,2EAA2E;QAC3E,+FAA+F;QAC/F,gJAAgJ,CACjJ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,CAAwB,EACxB,cAAsB;IAEtB,MAAM,KAAK,GAA4B;QACrC,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;QAC/B,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7B,eAAe,EAAE,CAAC,CAAC,cAAc;KAClC,CAAC;IACF,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACjC,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IACvC,CAAC;IACD,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,aAAa,CAAC;IACxC,KAAK,CAAC,eAAe,GAAG,cAAc,CAAC;IAEvC,OAAO;QACL,KAAK,EAAE,YAAY,CAAC,qBAAqB;QACzC,KAAK;QACL,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,CAAwB,EACxB,cAAsB;IAEtB,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAEzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,EAAE;QACzE,MAAM,EAAE,GAAG;QACX,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,CAAwB,EACxB,cAAsB;IAEtB,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,UAAU,wBAAwB,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAEvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,EAAE;QACzE,MAAM,EAAE,GAAG;QACX,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAA6B,EAC7B,OAAwE;IAExE,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,aAAa,CACnC;QACE,MAAM,EAAE,sBAAsB;QAC9B,MAAM,EAAE;YACN,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC;KACF,EACD,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAC9B;QACE,wEAAwE;QACxE,KAAK,EAAE,OAAO,CAAC,GAAG;QAClB,QAAQ,EAAE,OAAO,CAAC,WAAW;QAC7B,SAAS,EAAE,OAAO,CAAC,GAAG;KACvB,CACF,CAAC;IACF,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC"}
+{"version":3,"file":"challenge.js","sourceRoot":"","sources":["../../src/delegation-http/challenge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIlE;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,CAAwB;IAExB,MAAM,MAAM,GAGR;QACF,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;QAC/B,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7B,KAAK,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QACjC,aAAa,EAAE,CAAC,CAAC,YAAY;QAC7B,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;QACjC,IAAI,EAAE,YAAY;KACnB,CAAC;IAEF,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM;IACzC,8EAA8E;IAC9E,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CACnC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAE1C,OAAO,cAAc,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,OAAO,qCAAqC,KAAK,wCAAwC,CAAC;AAC5F,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAAC,CAAwB;IACtD,OAAO,WAAW,CAAC,CAAC,iBAAiB,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC;AAC/D,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,cAAc,CAAC,CAAwB;IACrD,OAAO,WAAW,CAAC,CAAC,iBAAiB,0BAA0B,CAAC,CAAC,GAAG,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAwB;IACxD,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;QACrC,OAAO,CACL,oFAAoF,SAAS,IAAI;YACjG,sMAAsM;YACtM,kFAAkF,UAAU,IAAI;YAChG,oBAAoB,SAAS,UAAU,CAAC,CAAC,aAAa,kCAAkC;YACxF,gJAAgJ,CACjJ,CAAC;IACJ,CAAC;IACD,OAAO,CACL,wJAAwJ;QACxJ,0CAA0C,SAAS,gDAAgD;QACnG,kFAAkF,UAAU,IAAI;QAChG,oBAAoB,SAAS,UAAU,CAAC,CAAC,aAAa,2DAA2D;QACjH,gJAAgJ,CACjJ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,CAAwB,EACxB,cAAsB;IAEtB,MAAM,KAAK,GAA4B;QACrC,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;QAC/B,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7B,eAAe,EAAE,CAAC,CAAC,cAAc;KAClC,CAAC;IACF,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACjC,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IACvC,CAAC;IACD,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,aAAa,CAAC;IACxC,KAAK,CAAC,eAAe,GAAG,cAAc,CAAC;IACvC,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;QACrC,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,uEAAuE;QACvE,8CAA8C;QAC9C,KAAK,CAAC,MAAM,GAAG;YACb,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;YAC/B,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;YAC7B,eAAe,EAAE,CAAC,CAAC,aAAa;YAChC,GAAG,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE;YACrC,KAAK,EAAE;gBACL,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,YAAY;aACzB;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,YAAY,CAAC,qBAAqB;QACzC,KAAK;QACL,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,CAAwB,EACxB,cAAsB;IAEtB,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,UAAU,wBAAwB,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,EAAE;QACzE,MAAM,EAAE,GAAG;QACX,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,CAAwB,EACxB,cAAsB;IAEtB,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,UAAU,wBAAwB,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAEvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,EAAE;QACzE,MAAM,EAAE,GAAG;QACX,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAA6B,EAC7B,OAAwE;IAExE,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,aAAa,CACnC;QACE,MAAM,EAAE,sBAAsB;QAC9B,MAAM,EAAE;YACN,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC;KACF,EACD,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAC9B;QACE,wEAAwE;QACxE,KAAK,EAAE,OAAO,CAAC,GAAG;QAClB,QAAQ,EAAE,OAAO,CAAC,WAAW;QAC7B,SAAS,EAAE,OAAO,CAAC,GAAG;KACvB,CACF,CAAC;IACF,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC"}

package/dist/delegation-http/consent-anchor-bridge.d.ts

@@ -45,14 +45,11 @@ import type { HttpChallengeConfig } from "../config";
  */
 export declare function resolveServerUrl(env: CloudflareEnv, c: HonoContext, realm?: string): string;
 /**
- * Resolve the anchor sid for `POST /consent/approve`. The `@kya-os/consent` Lit
- * component (`mcp-consent.ts` `handleApprove()`) always fetches the hardcoded
- * `${serverUrl}/consent/approve` — it has no way to append a query string — so
- * the sid instead travels in the POST body as `session_id` (its own field name,
- * populated from the `session-id` shell attribute {@link renderAnchorConsentShell}
- * sets to the anchor sid). Falls back to the query for the legacy raw-HTML
- * form's `action="/consent/approve?sid=…"` target, which some external PEPs may
- * still construct directly.
+ * Resolve an explicit anchor `sid` from the query or body. Older anchor forms
+ * submit only `session_id`; recognize those only by the original kya namespace.
+ * An ordinary legacy UUID must not select the HTTP handler merely because it
+ * also meets the opaque HTTP ID syntax. The selected handler still validates
+ * CSRF and persisted anchor state before granting any authority.
  *
  * Peeks the body via `clone()` so the ORIGINAL request stream is never consumed
  * here — `readBodyFields` still performs the one real body read, downstream in

package/dist/delegation-http/consent-anchor-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consent-anchor-bridge.d.ts","sourceRoot":"","sources":["../../src/delegation-http/consent-anchor-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAkBH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AA8TrD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,aAAa,EAClB,CAAC,EAAE,WAAW,EACd,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAiBR;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,iBAAiB,CACrC,CAAC,EAAE,WAAW,GACb,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAyB7B;AA8SD;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,CAAC,EAAE,WAAW,EACd,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GACjC,OAAO,CAAC,QAAQ,CAAC,CA4DnB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,CAAC,EAAE,WAAW,EACd,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GACjC,OAAO,CAAC,QAAQ,CAAC,CAsNnB"}
+{"version":3,"file":"consent-anchor-bridge.d.ts","sourceRoot":"","sources":["../../src/delegation-http/consent-anchor-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAoBH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAmWrD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,aAAa,EAClB,CAAC,EAAE,WAAW,EACd,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAiBR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,CAAC,EAAE,WAAW,GACb,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA+B7B;AAqYD;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,CAAC,EAAE,WAAW,EACd,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GACjC,OAAO,CAAC,QAAQ,CAAC,CA+GnB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,CAAC,EAAE,WAAW,EACd,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GACjC,OAAO,CAAC,QAAQ,CAAC,CAySnB"}