@kya-os/mcp-i-cloudflare 1.13.6 → 1.14.2

package/dist/delegation-http/credential-consent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-consent.d.ts","sourceRoot":"","sources":["../../src/delegation-http/credential-consent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAG9C,kFAAkF;AAClF,MAAM,WAAW,0BAA0B;IACzC,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,MAAM,EAAE,wBAAwB,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAClC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,0BAA0B,CAAA;CAAE,GAC9D;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC;AA8M9B;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,+BAA+B,CACnD,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,0BAA0B,CAAC,CAwFrC;AAED,oDAAoD;AACpD,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,+BAA+B,GACtC,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgCjD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAYvD;AAED,2CAA2C;AAC3C,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,CA+Cf"}
+{"version":3,"file":"credential-consent.d.ts","sourceRoot":"","sources":["../../src/delegation-http/credential-consent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAG9C,kFAAkF;AAClF,MAAM,WAAW,0BAA0B;IACzC,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,MAAM,EAAE,wBAAwB,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAClC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,0BAA0B,CAAA;CAAE,GAC9D;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC;AA8M9B;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,+BAA+B,CACnD,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE;IAAE,yBAAyB,CAAC,EAAE,OAAO,CAAA;CAAE,GAChD,OAAO,CAAC,0BAA0B,CAAC,CAkGrC;AAED,oDAAoD;AACpD,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,+BAA+B,GACtC,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgCjD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAYvD;AAED,2CAA2C;AAC3C,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,CA+Cf"}

package/dist/delegation-http/credential-consent.js

@@ -138,7 +138,7 @@ function buildCredentialConfig(entry) {
  * closed) rather than a silent anonymous mint — per-scope provider mapping is a
  * documented follow-up.
  */
-export async function resolveAnchorCredentialProvider(env, _scopes) {
+export async function resolveAnchorCredentialProvider(env, _scopes, options) {
     const apiKey = env.AGENTSHIELD_API_KEY;
     const projectId = env.AGENTSHIELD_PROJECT_ID;
     // No checkpoint link → nothing to authenticate against → legitimately
@@ -179,6 +179,16 @@ export async function resolveAnchorCredentialProvider(env, _scopes) {
         // Network/parse failure — same fail-closed reasoning as a non-2xx.
         return { status: "unavailable" };
     }
+    // Native HTTP has a separate authenticated OAuth continuation. An explicit
+    // default must not silently select a retained, unrelated credential provider.
+    // The OAuth path validates its selected provider before creating any grant.
+    if (options?.respectConfiguredProvider && configuredProvider) {
+        const selected = providersMap[configuredProvider];
+        if (!selected || typeof selected !== "object")
+            return { status: "unavailable" };
+        if (!isCredentialTyped(selected))
+            return { status: "none" };
+    }
     // Detect credential providers by their `type` discriminator (reliably present),
     // NOT by whether a camelCase authEndpoint parsed — a snake_case entry must not
     // silently look non-credential and drop to an anonymous mint.

package/dist/delegation-http/credential-consent.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-consent.js","sourceRoot":"","sources":["../../src/delegation-http/credential-consent.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAmCnC,SAAS,UAAU,CACjB,KAAuB,EACvB,KAAa,EACb,KAAa;IAEb,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CACjB,KAAuB,EACvB,KAAa,EACb,KAAa;IAEb,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB,CAAC,KAAmC;IAC5D,OAAO,CACL,CAAC,CAAC,KAAK;QACP,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;QAC1D,KAAK,CAAC,UAAU,KAAK,KAAK,CAC3B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CACxB,GAAiC;IAEjC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,MAAM,aAAa,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,cAAc,CAAC;IAC9D,IAAI,CAAC,IAAI,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3D,IACE,OAAO,aAAa,KAAK,QAAQ;QACjC,OAAO,aAAa,KAAK,SAAS;QAClC,OAAO,aAAa,KAAK,QAAQ,EACjC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAC5B,GAAiC;IAEjC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,QAAQ,GAAG,UAAU,CACzB,GAAG,EACH,UAAU,EACV,UAAU,CACX,CAAC;IACF,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,UAAU,CAChC,GAAG,EACH,iBAAiB,EACjB,kBAAkB,CACnB,CAAC;IACF,MAAM,kBAAkB,GAAG,UAAU,CACnC,GAAG,EACH,oBAAoB,EACpB,sBAAsB,CACvB,CAAC;IACF,MAAM,iBAAiB,GAAG,UAAU,CAClC,GAAG,EACH,mBAAmB,EACnB,qBAAqB,CACkB,CAAC;IAC1C,MAAM,kBAAkB,GAAG,UAAU,CACnC,GAAG,EACH,oBAAoB,EACpB,sBAAsB,CACvB,CAAC;IACF,MAAM,gBAAgB,GAAG,UAAU,CACjC,GAAG,EACH,kBAAkB,EAClB,oBAAoB,CACrB,CAAC;IACF,IACE,CAAC,QAAQ;QACT,CAAC,SAAS;QACV,CAAC,eAAe;QAChB,CAAC,kBAAkB;QACnB,CAAC,iBAAiB;QAClB,CAAC,kBAAkB;QACnB,CAAC,gBAAgB,EACjB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,KAAuB;IAEvB,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;IACxE,MAAM,mBAAmB,GAAG,UAAU,CACpC,KAAK,EACL,qBAAqB,EACrB,uBAAuB,CACxB,CAAC;IACF,MAAM,iBAAiB,GAAG,UAAU,CAClC,KAAK,EACL,gBAAgB,EAChB,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC,YAAY,IAAI,CAAC,mBAAmB,IAAI,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAE7E,MAAM,YAAY,GAAG,UAAU,CAC7B,iBAAiB,EACjB,cAAc,EACd,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAE/B,MAAM,cAAc,GAA+C;QACjE,YAAY;QACZ,MAAM,EAAE,UAAU,CAAC,iBAAiB,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC1D,SAAS,EAAE,UAAU,CAAC,iBAAiB,EAAE,WAAW,EAAE,YAAY,CAAC;QACnE,eAAe,EAAE,UAAU,CACzB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,CACpB;QACD,SAAS,EAAE,UAAU,CAAC,iBAAiB,EAAE,WAAW,EAAE,YAAY,CAAC;KACpE,CAAC;IAEF,kEAAkE;IAClE,6EAA6E;IAC7E,wEAAwE;IACxE,gFAAgF;IAChF,MAAM,YAAY,GAAG,iBAAiB,CACpC,UAAU,CAAmB,KAAK,EAAE,cAAc,EAAE,eAAe,CAAC,CACrE,CAAC;IACF,MAAM,OAAO,GAAG,UAAU,CACxB,KAAK,EACL,SAAS,EACT,SAAS,CACV,CAAC;IACF,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,aAAa,CAEnD,CAAC;IACd,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;IACxE,8EAA8E;IAC9E,6EAA6E;IAC7E,gEAAgE;IAChE,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,UAAU,CAAmB,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAC7E,CAAC;IAEF,OAAO;QACL,+EAA+E;QAC/E,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,cAAc,CAAC;QAC7D,YAAY;QACZ,mBAAmB;QACnB,cAAc;QACd,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,GAAkB,EAClB,OAAiB;IAEjB,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACvC,MAAM,SAAS,GAAG,GAAG,CAAC,sBAAsB,CAAC;IAC7C,sEAAsE;IACtE,iDAAiD;IACjD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAErD,MAAM,cAAc,GAAG,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;IAC1E,IAAI,YAA8C,CAAC;IACnD,IAAI,kBAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,cAAc,4BAA4B,kBAAkB,CAC7D,SAAS,CACV,YAAY,EACb;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,cAAc,EAAE,kBAAkB;aACnC;SACF,CACF,CAAC;QACF,2EAA2E;QAC3E,6DAA6D;QAC7D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAOlC,CAAC;QACF,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,gDAAgD;QAChD,IACE,IAAI,CAAC,OAAO,KAAK,IAAI;YACrB,CAAC,IAAI,CAAC,IAAI;YACV,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ;YACvC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,EAC5B,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACnC,CAAC;QACD,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAA6C,CAAC;QACvE,kBAAkB;YAChB,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;IAED,gFAAgF;IAChF,+EAA+E;IAC/E,8DAA8D;IAC9D,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAC5D,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CACpC,CAAC;IACF,6EAA6E;IAC7E,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE1D,iFAAiF;IACjF,+DAA+D;IAC/D,MAAM,QAAQ,GACZ,kBAAkB,IAAI,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;QACvE,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;YAC1B,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,IAAI,CAAC;IACb,4EAA4E;IAC5E,4CAA4C;IAC5C,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAEhD,MAAM,MAAM,GAAG,qBAAqB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,+EAA+E;IAC/E,0EAA0E;IAC1E,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAE9C,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE;YACR,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,QAAQ;YAC3C,MAAM;SACP;KACF,CAAC;AACJ,CAAC;AAaD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAkB,EAClB,MAAuC;IAEvC,MAAM,cAAc,GAAG,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;IAC1E,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,cAAc,kCAAkC,EACnD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,WAAW,EAAE,MAAM;gBACnB,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,MAAM,CAAC,SAAS;gBAC5B,iBAAiB,EAAE;oBACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,OAAO,EAAE,MAAM,CAAC,MAAM;oBACtB,KAAK,EAAE,MAAM,CAAC,SAAS;oBACvB,IAAI,EAAE,MAAM,CAAC,eAAe;iBAC7B;aACF,CAAC;SACH,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqC,CAAC;QACzE,MAAM,OAAO,GAAG,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;QACrC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,iEAAiE;IACjE,sDAAsD;IACtD,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,YAAY;IACzB,6EAA6E;IAC7E,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CACrE,EAAE,EACF,EAAE,CACH,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACzB,CAAC;AA0BD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAkB,EAClB,MAA8B;IAE9B,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACvC,MAAM,SAAS,GAAG,GAAG,CAAC,sBAAsB,CAAC;IAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;QAAE,OAAO;IAElC,MAAM,cAAc,GAAG,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,cAAc,oCAAoC,EACrD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,WAAW,EAAE,MAAM;gBACnB,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,aAAa,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC;gBAC9C,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;gBACzC,QAAQ,EAAE,MAAM,CAAC,OAAO;gBACxB,OAAO,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS;gBACnC,eAAe,EAAE,MAAM,CAAC,cAAc,IAAI,SAAS;gBACnD,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;gBACzC,QAAQ,EAAE;oBACR,MAAM,EAAE,sBAAsB;oBAC9B,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,GAAG,MAAM,CAAC,QAAQ;iBACnB;aACF,CAAC;SACH,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CACV,uDAAuD,QAAQ,CAAC,MAAM,QAAQ,MAAM,CAAC,GAAG,EAAE,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CACV,uDACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,QAAQ,MAAM,CAAC,GAAG,EAAE,CACrB,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"credential-consent.js","sourceRoot":"","sources":["../../src/delegation-http/credential-consent.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAmCnC,SAAS,UAAU,CACjB,KAAuB,EACvB,KAAa,EACb,KAAa;IAEb,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CACjB,KAAuB,EACvB,KAAa,EACb,KAAa;IAEb,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB,CAAC,KAAmC;IAC5D,OAAO,CACL,CAAC,CAAC,KAAK;QACP,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;QAC1D,KAAK,CAAC,UAAU,KAAK,KAAK,CAC3B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CACxB,GAAiC;IAEjC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,MAAM,aAAa,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,cAAc,CAAC;IAC9D,IAAI,CAAC,IAAI,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3D,IACE,OAAO,aAAa,KAAK,QAAQ;QACjC,OAAO,aAAa,KAAK,SAAS;QAClC,OAAO,aAAa,KAAK,QAAQ,EACjC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAC5B,GAAiC;IAEjC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,QAAQ,GAAG,UAAU,CACzB,GAAG,EACH,UAAU,EACV,UAAU,CACX,CAAC;IACF,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,UAAU,CAChC,GAAG,EACH,iBAAiB,EACjB,kBAAkB,CACnB,CAAC;IACF,MAAM,kBAAkB,GAAG,UAAU,CACnC,GAAG,EACH,oBAAoB,EACpB,sBAAsB,CACvB,CAAC;IACF,MAAM,iBAAiB,GAAG,UAAU,CAClC,GAAG,EACH,mBAAmB,EACnB,qBAAqB,CACkB,CAAC;IAC1C,MAAM,kBAAkB,GAAG,UAAU,CACnC,GAAG,EACH,oBAAoB,EACpB,sBAAsB,CACvB,CAAC;IACF,MAAM,gBAAgB,GAAG,UAAU,CACjC,GAAG,EACH,kBAAkB,EAClB,oBAAoB,CACrB,CAAC;IACF,IACE,CAAC,QAAQ;QACT,CAAC,SAAS;QACV,CAAC,eAAe;QAChB,CAAC,kBAAkB;QACnB,CAAC,iBAAiB;QAClB,CAAC,kBAAkB;QACnB,CAAC,gBAAgB,EACjB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,KAAuB;IAEvB,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;IACxE,MAAM,mBAAmB,GAAG,UAAU,CACpC,KAAK,EACL,qBAAqB,EACrB,uBAAuB,CACxB,CAAC;IACF,MAAM,iBAAiB,GAAG,UAAU,CAClC,KAAK,EACL,gBAAgB,EAChB,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC,YAAY,IAAI,CAAC,mBAAmB,IAAI,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAE7E,MAAM,YAAY,GAAG,UAAU,CAC7B,iBAAiB,EACjB,cAAc,EACd,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAE/B,MAAM,cAAc,GAA+C;QACjE,YAAY;QACZ,MAAM,EAAE,UAAU,CAAC,iBAAiB,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC1D,SAAS,EAAE,UAAU,CAAC,iBAAiB,EAAE,WAAW,EAAE,YAAY,CAAC;QACnE,eAAe,EAAE,UAAU,CACzB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,CACpB;QACD,SAAS,EAAE,UAAU,CAAC,iBAAiB,EAAE,WAAW,EAAE,YAAY,CAAC;KACpE,CAAC;IAEF,kEAAkE;IAClE,6EAA6E;IAC7E,wEAAwE;IACxE,gFAAgF;IAChF,MAAM,YAAY,GAAG,iBAAiB,CACpC,UAAU,CAAmB,KAAK,EAAE,cAAc,EAAE,eAAe,CAAC,CACrE,CAAC;IACF,MAAM,OAAO,GAAG,UAAU,CACxB,KAAK,EACL,SAAS,EACT,SAAS,CACV,CAAC;IACF,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,aAAa,CAEnD,CAAC;IACd,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;IACxE,8EAA8E;IAC9E,6EAA6E;IAC7E,gEAAgE;IAChE,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,UAAU,CAAmB,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAC7E,CAAC;IAEF,OAAO;QACL,+EAA+E;QAC/E,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,cAAc,CAAC;QAC7D,YAAY;QACZ,mBAAmB;QACnB,cAAc;QACd,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,GAAkB,EAClB,OAAiB,EACjB,OAAiD;IAEjD,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACvC,MAAM,SAAS,GAAG,GAAG,CAAC,sBAAsB,CAAC;IAC7C,sEAAsE;IACtE,iDAAiD;IACjD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAErD,MAAM,cAAc,GAAG,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;IAC1E,IAAI,YAA8C,CAAC;IACnD,IAAI,kBAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,cAAc,4BAA4B,kBAAkB,CAC7D,SAAS,CACV,YAAY,EACb;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,cAAc,EAAE,kBAAkB;aACnC;SACF,CACF,CAAC;QACF,2EAA2E;QAC3E,6DAA6D;QAC7D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAOlC,CAAC;QACF,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,gDAAgD;QAChD,IACE,IAAI,CAAC,OAAO,KAAK,IAAI;YACrB,CAAC,IAAI,CAAC,IAAI;YACV,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ;YACvC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,EAC5B,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACnC,CAAC;QACD,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAA6C,CAAC;QACvE,kBAAkB;YAChB,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;IAED,2EAA2E;IAC3E,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,OAAO,EAAE,yBAAyB,IAAI,kBAAkB,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAC3C,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACnC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9D,CAAC;IAED,gFAAgF;IAChF,+EAA+E;IAC/E,8DAA8D;IAC9D,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAC5D,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CACpC,CAAC;IACF,6EAA6E;IAC7E,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE1D,iFAAiF;IACjF,+DAA+D;IAC/D,MAAM,QAAQ,GACZ,kBAAkB,IAAI,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;QACvE,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;YAC1B,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,IAAI,CAAC;IACb,4EAA4E;IAC5E,4CAA4C;IAC5C,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAEhD,MAAM,MAAM,GAAG,qBAAqB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,+EAA+E;IAC/E,0EAA0E;IAC1E,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAE9C,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE;YACR,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,QAAQ;YAC3C,MAAM;SACP;KACF,CAAC;AACJ,CAAC;AAaD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAkB,EAClB,MAAuC;IAEvC,MAAM,cAAc,GAAG,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;IAC1E,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,cAAc,kCAAkC,EACnD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,WAAW,EAAE,MAAM;gBACnB,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,MAAM,CAAC,SAAS;gBAC5B,iBAAiB,EAAE;oBACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,OAAO,EAAE,MAAM,CAAC,MAAM;oBACtB,KAAK,EAAE,MAAM,CAAC,SAAS;oBACvB,IAAI,EAAE,MAAM,CAAC,eAAe;iBAC7B;aACF,CAAC;SACH,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqC,CAAC;QACzE,MAAM,OAAO,GAAG,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;QACrC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,iEAAiE;IACjE,sDAAsD;IACtD,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,YAAY;IACzB,6EAA6E;IAC7E,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CACrE,EAAE,EACF,EAAE,CACH,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACzB,CAAC;AA0BD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAkB,EAClB,MAA8B;IAE9B,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACvC,MAAM,SAAS,GAAG,GAAG,CAAC,sBAAsB,CAAC;IAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;QAAE,OAAO;IAElC,MAAM,cAAc,GAAG,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,cAAc,oCAAoC,EACrD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,WAAW,EAAE,MAAM;gBACnB,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,aAAa,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC;gBAC9C,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;gBACzC,QAAQ,EAAE,MAAM,CAAC,OAAO;gBACxB,OAAO,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS;gBACnC,eAAe,EAAE,MAAM,CAAC,cAAc,IAAI,SAAS;gBACnD,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;gBACzC,QAAQ,EAAE;oBACR,MAAM,EAAE,sBAAsB;oBAC9B,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,GAAG,MAAM,CAAC,QAAQ;iBACnB;aACF,CAAC;SACH,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CACV,uDAAuD,QAAQ,CAAC,MAAM,QAAQ,MAAM,CAAC,GAAG,EAAE,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CACV,uDACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,QAAQ,MAAM,CAAC,GAAG,EAAE,CACrB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/delegation-http/native-capabilities.d.ts

@@ -0,0 +1,4 @@
+import type { CapabilityGroup } from "@kya-os/consent";
+/** Project the operator's catalog onto the exact signed native request. */
+export declare function nativeCapabilitiesForScopes(groups: CapabilityGroup[] | undefined, scopes: string[]): CapabilityGroup[] | undefined;
+//# sourceMappingURL=native-capabilities.d.ts.map

package/dist/delegation-http/native-capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-capabilities.d.ts","sourceRoot":"","sources":["../../src/delegation-http/native-capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEnE,2EAA2E;AAC3E,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,eAAe,EAAE,GAAG,SAAS,EACrC,MAAM,EAAE,MAAM,EAAE,GACf,eAAe,EAAE,GAAG,SAAS,CAmD/B"}

package/dist/delegation-http/native-capabilities.js

@@ -0,0 +1,53 @@
+/** Project the operator's catalog onto the exact signed native request. */
+export function nativeCapabilitiesForScopes(groups, scopes) {
+    if (!scopes.length)
+        return undefined;
+    const requested = new Set(scopes), covered = new Set(), ids = new Set();
+    const result = [];
+    let serial = 0;
+    const uniqueId = (preferred) => {
+        let id = preferred || "";
+        while (!id || ids.has(id))
+            id = "kya-http-request-" + serial++;
+        ids.add(id);
+        return id;
+    };
+    for (const group of groups ?? []) {
+        const capabilities = [];
+        for (const item of group.capabilities) {
+            // Never trim a broader capability while keeping its original promise.
+            // Avoid overlapping rows: the component posts their scope lists directly.
+            if (!item.scopes.length ||
+                new Set(item.scopes).size !== item.scopes.length ||
+                item.scopes.some((scope) => !requested.has(scope) || covered.has(scope)))
+                continue;
+            capabilities.push({
+                ...item,
+                id: uniqueId(item.id),
+                scopes: [...item.scopes],
+            });
+            item.scopes.forEach((scope) => covered.add(scope));
+        }
+        if (capabilities.length)
+            result.push({ ...group, capabilities });
+    }
+    const missing = scopes.filter((scope) => !covered.has(scope));
+    if (missing.length)
+        result.push({
+            id: "kya-http-requested",
+            label: "Requested permissions",
+            capabilities: missing.map((scope) => ({
+                id: uniqueId(),
+                label: scope,
+                description: "Permission requested for this resource.",
+                icon: "neutral",
+                riskLevel: "medium",
+                defaultOn: false,
+                // Do not present invented Cedar as the resource's actual policy.
+                cedar: "",
+                scopes: [scope],
+            })),
+        });
+    return result;
+}
+//# sourceMappingURL=native-capabilities.js.map

package/dist/delegation-http/native-capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-capabilities.js","sourceRoot":"","sources":["../../src/delegation-http/native-capabilities.ts"],"names":[],"mappings":"AAEA,2EAA2E;AAC3E,MAAM,UAAU,2BAA2B,CACzC,MAAqC,EACrC,MAAgB;IAEhB,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,EAC/B,OAAO,GAAG,IAAI,GAAG,EAAU,EAC3B,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1B,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,QAAQ,GAAG,CAAC,SAAkB,EAAE,EAAE;QACtC,IAAI,EAAE,GAAG,SAAS,IAAI,EAAE,CAAC;QACzB,OAAO,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,EAAE,GAAG,mBAAmB,GAAG,MAAM,EAAE,CAAC;QAC/D,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;QACjC,MAAM,YAAY,GAAiB,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACtC,sEAAsE;YACtE,0EAA0E;YAC1E,IACE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;gBACnB,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM;gBAChD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAExE,SAAS;YACX,YAAY,CAAC,IAAI,CAAC;gBAChB,GAAG,IAAI;gBACP,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,YAAY,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM;QAChB,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,oBAAoB;YACxB,KAAK,EAAE,uBAAuB;YAC9B,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACpC,EAAE,EAAE,QAAQ,EAAE;gBACd,KAAK,EAAE,KAAK;gBACZ,WAAW,EAAE,yCAAyC;gBACtD,IAAI,EAAE,SAAS;gBACf,SAAS,EAAE,QAAQ;gBACnB,SAAS,EAAE,KAAK;gBAChB,iEAAiE;gBACjE,KAAK,EAAE,EAAE;gBACT,MAAM,EAAE,CAAC,KAAK,CAAC;aAChB,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/delegation-http/native-fetch.d.ts

@@ -0,0 +1,3 @@
+/** Native upstream calls never follow redirects carrying credentials or proofs. */
+export declare function fetchNativeNoRedirect(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+//# sourceMappingURL=native-fetch.d.ts.map

package/dist/delegation-http/native-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-fetch.d.ts","sourceRoot":"","sources":["../../src/delegation-http/native-fetch.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,QAAQ,CAAC,CAUnB"}

package/dist/delegation-http/native-fetch.js

@@ -0,0 +1,13 @@
+/** Native upstream calls never follow redirects carrying credentials or proofs. */
+export async function fetchNativeNoRedirect(input, init = {}) {
+    // workerd supports manual/follow but rejects redirect:"error" before making
+    // any request. Inspect the response ourselves without following Location.
+    const response = await fetch(input, { ...init, redirect: "manual" });
+    if (response.status >= 300 && response.status < 400) {
+        // Redirect refusal is immediate even if upstream body cleanup never settles.
+        void response.body?.cancel().catch(() => { });
+        throw new Error("Native upstream redirect refused");
+    }
+    return response;
+}
+//# sourceMappingURL=native-fetch.js.map

package/dist/delegation-http/native-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-fetch.js","sourceRoot":"","sources":["../../src/delegation-http/native-fetch.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAwB,EACxB,OAAoB,EAAE;IAEtB,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACpD,6EAA6E;QAC7E,KAAK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/delegation-http/native-http.d.ts

@@ -0,0 +1,102 @@
+import { type DetachedProof } from "../proof-generator";
+import type { CloudflareEnv } from "../types";
+export interface NativeHttpRegistration {
+    profile: "kya-http/2";
+    resource: string;
+    min_assurance: "key-bound" | "delegated" | "attested-bearer";
+    pickup_mode: "key" | "token";
+    poll_interval_s: number;
+}
+export interface NativeHttpChallenge {
+    resource: string;
+    sid: string;
+    consent_uri: string;
+    pickup_uri: string;
+    required_scopes: string[];
+    min_assurance: NativeHttpRegistration["min_assurance"];
+    poll_interval_s: number;
+    action: {
+        type: "delegation";
+        consent_uri: string;
+        pickup_uri: string;
+        poll_interval_s: number;
+        pin: {
+            mode: "key";
+            profile: "kya-http/2";
+        } | {
+            mode: "token";
+            header: "X-KYA-Pickup-Token";
+            encoding: "base64url";
+            bytes: 32;
+        };
+        retry: {
+            header: "Authorization";
+            scheme: "Bearer";
+            value_from: "delegation";
+        };
+    };
+}
+export interface NativeCredentialStatus {
+    id: string;
+    type: "BitstringStatusListEntry" | "StatusList2021Entry";
+    statusPurpose: "revocation";
+    statusListIndex: string;
+    statusListCredential: string;
+}
+export interface NativeReplayClaim {
+    resourceDid: string;
+    keyId: string;
+    nonce: string;
+    expiresUnix: number;
+    sourceIp: string;
+}
+export type NativeReplayResult = "claimed" | "replay" | "capacity" | "unavailable";
+/** Operator-provided native HTTP dependencies. Status allocation must be durable,
+ * idempotent per sid, issuer-owned and backed by the published revocation list.
+ * The replay callback must implement shared atomic, bounded admission per §5.2.
+ * Neither capability may fall back to process-local state.
+ */
+export interface NativeHttpHostConfig {
+    authorizationOrigin: string;
+    issuerDid: string;
+    /** Canonical project UUID from the persisted deployment role. */
+    projectId?: string;
+    /** Checkpoint owns the org signer and the atomic VC/status transaction. */
+    remoteIssuer?: import("./remote-issuer").NativeRemoteIssuer;
+    resourceAudiences?: Readonly<Record<string, string>>;
+    allowLoopbackHttp?: boolean;
+    issueCredentialStatus?(input: {
+        sid: string;
+        issuerDid: string;
+        audience: string;
+        holderDid: string;
+        expiresAtUnix: number;
+        userDid: string;
+        requiredScopes: string[];
+        policyRevision?: {
+            policyId?: string;
+            composedPolicyHash?: string;
+        };
+    }): Promise<NativeCredentialStatus>;
+    claimReplay?(claim: NativeReplayClaim): Promise<NativeReplayResult>;
+    /** Required outside Cloudflare. On Workers the CF-Connecting-IP field is read
+     * only when platform request.cf metadata is present. Never trust X-Forwarded-For. */
+    resolveSourceIp?(request: Request): string | null;
+}
+export declare const nativeUnavailable: () => Response;
+export declare function nativeError(error: string, status: number): Response;
+export declare function secureHttpUrl(value: unknown, allowLoopback?: boolean): value is string;
+export declare function isNativeHttpRegistration(value: unknown): value is NativeHttpRegistration;
+export declare function buildNativeChallenge(http: NativeHttpRegistration, sid: string, scopes: string[], origin: string): NativeHttpChallenge;
+export declare function signNativeChallenge(env: CloudflareEnv, issuerDid: string, payload: NativeHttpChallenge, audience: string): Promise<DetachedProof>;
+/** Canonical Ed25519/P-256 did:key holder. No form-supplied key is trusted.
+ * WebCrypto validates/decompresses the EC point, avoiding a second curve implementation. */
+export declare function nativeHolderBinding(keyId: string): Promise<{
+    did: string;
+    jkt: string;
+    key: CryptoKey;
+}>;
+export declare function validNativeStatus(status: NativeCredentialStatus): boolean;
+/** Shared Checkpoint replay service. Native requests never retry an uncertain claim. */
+export declare function claimNativeReplay(env: CloudflareEnv, cfg: NativeHttpHostConfig, claim: NativeReplayClaim): Promise<NativeReplayResult>;
+//# sourceMappingURL=native-http.d.ts.map

package/dist/delegation-http/native-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-http.d.ts","sourceRoot":"","sources":["../../src/delegation-http/native-http.ts"],"names":[],"mappings":"AAOA,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,YAAY,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,WAAW,GAAG,WAAW,GAAG,iBAAiB,CAAC;IAC7D,WAAW,EAAE,KAAK,GAAG,OAAO,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,EAAE,sBAAsB,CAAC,eAAe,CAAC,CAAC;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE;QACN,IAAI,EAAE,YAAY,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,eAAe,EAAE,MAAM,CAAC;QACxB,GAAG,EACC;YAAE,IAAI,EAAE,KAAK,CAAC;YAAC,OAAO,EAAE,YAAY,CAAA;SAAE,GACtC;YACE,IAAI,EAAE,OAAO,CAAC;YACd,MAAM,EAAE,oBAAoB,CAAC;YAC7B,QAAQ,EAAE,WAAW,CAAC;YACtB,KAAK,EAAE,EAAE,CAAC;SACX,CAAC;QACN,KAAK,EAAE;YACL,MAAM,EAAE,eAAe,CAAC;YACxB,MAAM,EAAE,QAAQ,CAAC;YACjB,UAAU,EAAE,YAAY,CAAC;SAC1B,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,0BAA0B,GAAG,qBAAqB,CAAC;IACzD,aAAa,EAAE,YAAY,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,QAAQ,GACR,UAAU,GACV,aAAa,CAAC;AAElB;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,YAAY,CAAC,EAAE,OAAO,iBAAiB,EAAE,kBAAkB,CAAC;IAC5D,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,qBAAqB,CAAC,CAAC,KAAK,EAAE;QAC5B,GAAG,EAAE,MAAM,CAAC;QACZ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,cAAc,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACrE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACpC,WAAW,CAAC,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpE;yFACqF;IACrF,eAAe,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC;CACnD;AAED,eAAO,MAAM,iBAAiB,gBAC4B,CAAC;AAC3D,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,CASnE;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EACd,aAAa,UAAQ,GACpB,KAAK,IAAI,MAAM,CAgBjB;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,sBAAsB,CAgBjC;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,sBAAsB,EAC5B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EAAE,EAChB,MAAM,EAAE,MAAM,GACb,mBAAmB,CAgCrB;AAED,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,aAAa,EAClB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC,CAUxB;AAED;4FAC4F;AAC5F,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,SAAS,CAAA;CAAE,CAAC,CAwDvD;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAWzE;AAED,wFAAwF;AACxF,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,oBAAoB,EACzB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAyD7B"}

package/dist/delegation-http/native-http.js

@@ -0,0 +1,191 @@
+import { canonicalize } from "json-canonicalize";
+import { fetchNativeNoRedirect } from "./native-fetch";
+import { base58Decode, base58Encode, base64urlEncodeFromBytes, } from "@kya-os/mcp";
+import { CloudflareProofGenerator, } from "../proof-generator";
+import { getConfiguredIdentity } from "../providers/storage";
+export const nativeUnavailable = () => nativeError("kyaos/authorization-host-unavailable", 503);
+export function nativeError(error, status) {
+    return new Response(JSON.stringify({ error }), {
+        status,
+        headers: {
+            "Content-Type": "application/json",
+            "Cache-Control": "no-store",
+            ...([429, 503].includes(status) ? { "Retry-After": "3" } : {}),
+        },
+    });
+}
+export function secureHttpUrl(value, allowLoopback = false) {
+    if (typeof value !== "string" || value.length > 2048)
+        return false;
+    try {
+        const url = new URL(value);
+        return (!url.username &&
+            !url.password &&
+            !url.hash &&
+            (url.protocol === "https:" ||
+                (allowLoopback &&
+                    url.protocol === "http:" &&
+                    ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))));
+    }
+    catch {
+        return false;
+    }
+}
+export function isNativeHttpRegistration(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const v = value;
+    return (Object.keys(v).length === 5 &&
+        v.profile === "kya-http/2" &&
+        typeof v.resource === "string" &&
+        ["key-bound", "delegated", "attested-bearer"].includes(String(v.min_assurance)) &&
+        ["key", "token"].includes(String(v.pickup_mode)) &&
+        Number.isInteger(v.poll_interval_s) &&
+        Number(v.poll_interval_s) >= 1 &&
+        Number(v.poll_interval_s) <= 300 &&
+        (v.pickup_mode !== "token" || v.min_assurance === "attested-bearer"));
+}
+export function buildNativeChallenge(http, sid, scopes, origin) {
+    const consent = origin + "/consent?sid=" + sid;
+    const pickup = origin + "/api/delegation/pickup/" + sid;
+    return {
+        resource: http.resource,
+        sid,
+        consent_uri: consent,
+        pickup_uri: pickup,
+        required_scopes: scopes,
+        min_assurance: http.min_assurance,
+        poll_interval_s: http.poll_interval_s,
+        action: {
+            type: "delegation",
+            consent_uri: consent,
+            pickup_uri: pickup,
+            poll_interval_s: http.poll_interval_s,
+            pin: http.pickup_mode === "key"
+                ? { mode: "key", profile: "kya-http/2" }
+                : {
+                    mode: "token",
+                    header: "X-KYA-Pickup-Token",
+                    encoding: "base64url",
+                    bytes: 32,
+                },
+            retry: {
+                header: "Authorization",
+                scheme: "Bearer",
+                value_from: "delegation",
+            },
+        },
+    };
+}
+export async function signNativeChallenge(env, issuerDid, payload, audience) {
+    const identity = await getConfiguredIdentity(env);
+    if (!identity || identity.did !== issuerDid)
+        throw new Error("Native HTTP issuer is not configured");
+    return new CloudflareProofGenerator(identity).generateProof({ method: "authorization/challenge_proof", params: { sid: payload.sid } }, { data: [{ type: "text", text: canonicalize(payload) }] }, { nonce: payload.sid, audience, sessionId: payload.sid }, { outcome: "needs_authorization" });
+}
+/** Canonical Ed25519/P-256 did:key holder. No form-supplied key is trusted.
+ * WebCrypto validates/decompresses the EC point, avoiding a second curve implementation. */
+export async function nativeHolderBinding(keyId) {
+    const [did, fragment, extra] = keyId.split("#");
+    if (!did.startsWith("did:key:z") ||
+        did.length - 9 > 64 ||
+        (fragment !== did.slice(8) && fragment !== "keys-1") ||
+        extra !== undefined)
+        throw new Error("Invalid holder key identifier");
+    const decoded = base58Decode(did.slice(9));
+    const ed25519 = decoded.length === 34 && decoded[0] === 0xed && decoded[1] === 1;
+    const p256 = decoded.length === 35 &&
+        decoded[0] === 0x80 &&
+        decoded[1] === 0x24 &&
+        (decoded[2] === 2 || decoded[2] === 3);
+    if ((!ed25519 && !p256) || "z" + base58Encode(decoded) !== did.slice(8))
+        throw new Error("Invalid holder key");
+    const bytes = decoded.slice(2);
+    let jwk;
+    let key;
+    if (ed25519) {
+        jwk = { crv: "Ed25519", kty: "OKP", x: base64urlEncodeFromBytes(bytes) };
+        key = await crypto.subtle.importKey("jwk", jwk, { name: "Ed25519" }, false, ["verify"]);
+    }
+    else {
+        // Only public material is extractable. The exported coordinates are
+        // validated by the same platform implementation used for verification.
+        key = await crypto.subtle.importKey("raw", new Uint8Array(bytes), { name: "ECDSA", namedCurve: "P-256" }, true, ["verify"]);
+        const publicJwk = await crypto.subtle.exportKey("jwk", key);
+        if (publicJwk.crv !== "P-256" ||
+            publicJwk.kty !== "EC" ||
+            !publicJwk.x ||
+            !publicJwk.y)
+            throw new Error("Invalid holder key");
+        jwk = { crv: "P-256", kty: "EC", x: publicJwk.x, y: publicJwk.y };
+    }
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonicalize(jwk)));
+    return { did, jkt: base64urlEncodeFromBytes(new Uint8Array(digest)), key };
+}
+export function validNativeStatus(status) {
+    return (!!status &&
+        ["BitstringStatusListEntry", "StatusList2021Entry"].includes(status.type) &&
+        status.statusPurpose === "revocation" &&
+        typeof status.statusListIndex === "string" &&
+        /^(0|[1-9][0-9]*)$/.test(status.statusListIndex) &&
+        Number.isSafeInteger(Number(status.statusListIndex)) &&
+        secureHttpUrl(status.statusListCredential) &&
+        status.id === status.statusListCredential + "#" + status.statusListIndex);
+}
+/** Shared Checkpoint replay service. Native requests never retry an uncertain claim. */
+export async function claimNativeReplay(env, cfg, claim) {
+    try {
+        if (cfg.claimReplay)
+            return await cfg.claimReplay(claim);
+        const base = env.AGENTSHIELD_API_URL;
+        if (!secureHttpUrl(base, cfg.allowLoopbackHttp) ||
+            !env.AGENTSHIELD_API_KEY ||
+            !env.AGENTSHIELD_PROJECT_ID)
+            return "unavailable";
+        const response = await fetchNativeNoRedirect(new URL("/api/v1/enforce/replay", base), {
+            method: "POST",
+            signal: AbortSignal.timeout(3000),
+            headers: {
+                Authorization: "Bearer " + env.AGENTSHIELD_API_KEY,
+                "Content-Type": "application/json",
+                "X-Project-Id": env.AGENTSHIELD_PROJECT_ID,
+            },
+            body: JSON.stringify(claim),
+        });
+        if (response.status === 409)
+            return "replay";
+        if (response.status === 429)
+            return "capacity";
+        if (response.status !== 200 ||
+            Number(response.headers.get("content-length")) > 4096)
+            return "unavailable";
+        const reader = response.body?.getReader();
+        if (!reader)
+            return "unavailable";
+        const chunks = [];
+        let length = 0;
+        while (true) {
+            const next = await reader.read();
+            if (next.done)
+                break;
+            length += next.value.length;
+            if (length > 4096) {
+                await reader.cancel();
+                return "unavailable";
+            }
+            chunks.push(next.value);
+        }
+        const bytes = new Uint8Array(length);
+        let offset = 0;
+        for (const chunk of chunks) {
+            bytes.set(chunk, offset);
+            offset += chunk.length;
+        }
+        const data = JSON.parse(new TextDecoder().decode(bytes));
+        return data.outcome === "claimed" ? "claimed" : "unavailable";
+    }
+    catch {
+        return "unavailable";
+    }
+}
+//# sourceMappingURL=native-http.js.map

package/dist/delegation-http/native-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-http.js","sourceRoot":"","sources":["../../src/delegation-http/native-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,wBAAwB,GAEzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AA2F7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,EAAE,CACpC,WAAW,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;AAC3D,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,MAAc;IACvD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;QAC7C,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;YAC3B,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAc,EACd,aAAa,GAAG,KAAK;IAErB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,CACL,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,IAAI;YACT,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBACxB,CAAC,aAAa;oBACZ,GAAG,CAAC,QAAQ,KAAK,OAAO;oBACxB,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CACjE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;QAC3B,CAAC,CAAC,OAAO,KAAK,YAAY;QAC1B,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAC9B,CAAC,WAAW,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CACpD,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CACxB;QACD,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC;QACnC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,GAAG;QAChC,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,IAAI,CAAC,CAAC,aAAa,KAAK,iBAAiB,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAA4B,EAC5B,GAAW,EACX,MAAgB,EAChB,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,GAAG,eAAe,GAAG,GAAG,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,GAAG,yBAAyB,GAAG,GAAG,CAAC;IACxD,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG;QACH,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,MAAM;QAClB,eAAe,EAAE,MAAM;QACvB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,MAAM,EAAE;YACN,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,OAAO;YACpB,UAAU,EAAE,MAAM;YAClB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,GAAG,EACD,IAAI,CAAC,WAAW,KAAK,KAAK;gBACxB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE;gBACxC,CAAC,CAAC;oBACE,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,oBAAoB;oBAC5B,QAAQ,EAAE,WAAW;oBACrB,KAAK,EAAE,EAAE;iBACV;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,YAAY;aACzB;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAkB,EAClB,SAAiB,EACjB,OAA4B,EAC5B,QAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS;QACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,OAAO,IAAI,wBAAwB,CAAC,QAAQ,CAAC,CAAC,aAAa,CACzD,EAAE,MAAM,EAAE,+BAA+B,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EACzE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EACzD,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,EACxD,EAAE,OAAO,EAAE,qBAAqB,EAAE,CACnC,CAAC;AACJ,CAAC;AAED;4FAC4F;AAC5F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAa;IAEb,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,IACE,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;QAC5B,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE;QACnB,CAAC,QAAQ,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ,KAAK,QAAQ,CAAC;QACpD,KAAK,KAAK,SAAS;QAEnB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,IAAI,GACR,OAAO,CAAC,MAAM,KAAK,EAAE;QACrB,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;QACnB,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;QACnB,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,GAAe,CAAC;IACpB,IAAI,GAAc,CAAC;IACnB,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACjC,KAAK,EACL,GAAG,EACH,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,oEAAoE;QACpE,uEAAuE;QACvE,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACjC,KAAK,EACL,IAAI,UAAU,CAAC,KAAK,CAAC,EACrB,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,IAAI,EACJ,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5D,IACE,SAAS,CAAC,GAAG,KAAK,OAAO;YACzB,SAAS,CAAC,GAAG,KAAK,IAAI;YACtB,CAAC,SAAS,CAAC,CAAC;YACZ,CAAC,SAAS,CAAC,CAAC;YAEZ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,GAAG,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAC5C,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAA8B;IAC9D,OAAO,CACL,CAAC,CAAC,MAAM;QACR,CAAC,0BAA0B,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QACzE,MAAM,CAAC,aAAa,KAAK,YAAY;QACrC,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ;QAC1C,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;QAChD,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACpD,aAAa,CAAC,MAAM,CAAC,oBAAoB,CAAC;QAC1C,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,oBAAoB,GAAG,GAAG,GAAG,MAAM,CAAC,eAAe,CACzE,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAkB,EAClB,GAAyB,EACzB,KAAwB;IAExB,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,WAAW;YAAE,OAAO,MAAM,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,GAAG,CAAC,mBAAmB,CAAC;QACrC,IACE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,iBAAiB,CAAC;YAC3C,CAAC,GAAG,CAAC,mBAAmB;YACxB,CAAC,GAAG,CAAC,sBAAsB;YAE3B,OAAO,aAAa,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAC1C,IAAI,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,EACvC;YACE,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,GAAG,GAAG,CAAC,mBAAmB;gBAClD,cAAc,EAAE,kBAAkB;gBAClC,cAAc,EAAE,GAAG,CAAC,sBAAsB;aAC3C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC5B,CACF,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,QAAQ,CAAC;QAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,UAAU,CAAC;QAC/C,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;YACvB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI;YAErD,OAAO,aAAa,CAAC;QACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO,aAAa,CAAC;QAClC,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM;YACrB,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAC5B,IAAI,MAAM,GAAG,IAAI,EAAE,CAAC;gBAClB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;QACzB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAEtD,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/delegation-http/native-oauth.d.ts

@@ -0,0 +1,26 @@
+import type { CloudflareEnv } from "../types";
+import { type NativeHttpHostConfig, type NativeHttpChallenge } from "./native-http";
+export interface NativeOAuthAnchor {
+    status: string;
+    expiresAt: number;
+    requiredScopes: string[];
+    holderKeyId?: string;
+    audience?: string;
+    nativeHttp?: NativeHttpChallenge;
+    nativeIssuerDid?: string;
+    nativePolicyRevision?: {
+        policyId?: string;
+        composedPolicyHash?: string;
+    };
+}
+export declare function beginNativeOAuth(env: CloudflareEnv, sid: string, info: NativeOAuthAnchor, cfg: NativeHttpHostConfig, initiate?: boolean): Promise<{
+    provider: string;
+    oauthUrl?: string;
+} | null>;
+/** Caller must have consumed cryptographically random server-stored OAuth state. */
+export declare function completeNativeOAuth(env: CloudflareEnv, state: Record<string, unknown>, code: string): Promise<Response>;
+export declare function verifyNativeOAuthIdentity(env: CloudflareEnv, sid: string, info: NativeOAuthAnchor, cfg: NativeHttpHostConfig, token: string): Promise<{
+    userDid: string;
+    amr: ["oauth"];
+} | null>;
+//# sourceMappingURL=native-oauth.d.ts.map

package/dist/delegation-http/native-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-oauth.d.ts","sourceRoot":"","sources":["../../src/delegation-http/native-oauth.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAY9C,OAAO,EAIL,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACzB,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,mBAAmB,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAsKD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,iBAAiB,EACvB,GAAG,EAAE,oBAAoB,EACzB,QAAQ,UAAO,GACd,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA0EzD;AAED,oFAAoF;AACpF,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,aAAa,EAClB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,QAAQ,CAAC,CAmKnB;AAED,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,iBAAiB,EACvB,GAAG,EAAE,oBAAoB,EACzB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAA;CAAE,GAAG,IAAI,CAAC,CA6BrD"}