@kya-os/mcp-i-cloudflare 1.13.6 → 1.14.2

package/dist/delegation-http/native-oauth.js

@@ -0,0 +1,369 @@
+/** Identity-only OAuth continuation for a registered, key-pinned HTTP anchor.
+ * No delegation, IdP token sidecar, or legacy session is written here. The human
+ * still must explicitly approve the signed assertion against the same anchor.
+ */
+import { canonicalize } from "json-canonicalize";
+import { fetchNativeNoRedirect } from "./native-fetch";
+import { OAuthSecurityService } from "../services/oauth-security.service";
+import { ConsentService } from "../services/consent.service";
+import { exchangeAuthorizationCode, toIdpTokens, } from "../runtime/oidc/token-exchange";
+import { resolveIdpScopes } from "../runtime/oidc/idp-scopes";
+import { makeEnvSecretResolver } from "../utils/env-secret-resolver";
+import { getAnchorStub } from "./anchor-routing";
+import { INTERNAL_PICKUP_INFO, NATIVE_OAUTH_STATE_PREFIX } from "./constants";
+import { sha256Hex } from "./hash";
+import { nativeHolderBinding, nativeError, secureHttpUrl, } from "./native-http";
+const failure = () => nativeError("kyaos/session-mismatch", 403);
+const boundedFetch = (input, init) => fetchNativeNoRedirect(input, {
+    ...init,
+    signal: AbortSignal.timeout(10000),
+});
+async function services(env) {
+    const { OAuthConfigService, OAuthService } = await import("@kya-os/mcp-i-runtime");
+    if (!env.AGENTSHIELD_API_URL ||
+        !env.AGENTSHIELD_API_KEY ||
+        !env.AGENTSHIELD_PROJECT_ID)
+        throw new Error("Native OAuth deployment configuration unavailable");
+    const fetchProvider = {
+        fetch: boundedFetch,
+        resolveDID: async () => {
+            throw new Error("Unused");
+        },
+        fetchStatusList: async () => {
+            throw new Error("Unused");
+        },
+        fetchDelegationChain: async () => {
+            throw new Error("Unused");
+        },
+    };
+    const configService = new OAuthConfigService({
+        baseUrl: env.AGENTSHIELD_API_URL,
+        apiKey: env.AGENTSHIELD_API_KEY,
+        fetchProvider,
+        logger: () => { },
+    });
+    return {
+        configService,
+        oauthService: new OAuthService({
+            configService,
+            fetchProvider,
+            agentShieldApiUrl: env.AGENTSHIELD_API_URL,
+            agentShieldApiKey: env.AGENTSHIELD_API_KEY,
+            projectId: env.AGENTSHIELD_PROJECT_ID,
+            secretResolver: makeEnvSecretResolver(env),
+            logger: () => { },
+        }),
+    };
+}
+async function selectedProvider(env) {
+    const svc = await services(env);
+    const config = await svc.configService.getOAuthConfig(env.AGENTSHIELD_PROJECT_ID);
+    const candidates = Object.entries(config.providers).filter(([, p]) => !!p.authorizationUrl);
+    const id = config.configuredProvider ||
+        (candidates.length === 1 ? candidates[0][0] : undefined);
+    const provider = id ? config.providers[id] : undefined;
+    if (!provider?.authorizationUrl)
+        return null;
+    return { ...svc, id: id, provider };
+}
+function validateProvider(provider, allowLoopback) {
+    if (provider.supportsPKCE !== true ||
+        provider.proxyMode ||
+        !provider.clientId ||
+        !secureHttpUrl(provider.authorizationUrl, allowLoopback) ||
+        !secureHttpUrl(provider.tokenUrl, allowLoopback) ||
+        !secureHttpUrl(provider.userInfoUrl, allowLoopback) ||
+        (provider.tokenEndpointAuthMethod &&
+            provider.tokenEndpointAuthMethod !== "client_secret_post"))
+        throw new Error("Native OAuth requires a configured direct PKCE provider with userinfo");
+}
+async function providerBinding(id, provider) {
+    // Changes to the IdP/client/endpoints invalidate the authentication in flight.
+    return sha256Hex(canonicalize({
+        id,
+        clientId: provider.clientId,
+        authorizationUrl: provider.authorizationUrl,
+        tokenUrl: provider.tokenUrl,
+        userInfoUrl: provider.userInfoUrl,
+        scopes: resolveIdpScopes(provider),
+        customParams: provider.customParams || {},
+        tokenEndpointAuthMethod: provider.tokenEndpointAuthMethod || "client_secret_post",
+        requiresClientSecret: provider.requiresClientSecret,
+        metadata: provider.metadata || {},
+    }));
+}
+async function anchorBinding(env, sid, info, cfg) {
+    const http = info.nativeHttp;
+    const origin = new URL(cfg.authorizationOrigin);
+    if (!env.AGENTSHIELD_PROJECT_ID ||
+        !cfg.projectId ||
+        !secureHttpUrl(cfg.authorizationOrigin, cfg.allowLoopbackHttp) ||
+        origin.origin !== cfg.authorizationOrigin ||
+        info.status !== "pinned" ||
+        !Number.isFinite(info.expiresAt) ||
+        info.expiresAt <= Date.now() ||
+        !info.holderKeyId ||
+        !info.audience ||
+        info.nativeIssuerDid !== cfg.issuerDid ||
+        !http ||
+        http.sid !== sid ||
+        http.action?.pin?.mode !== "key" ||
+        !secureHttpUrl(http.consent_uri, cfg.allowLoopbackHttp) ||
+        new URL(http.consent_uri).origin !== origin.origin ||
+        !info.requiredScopes.length ||
+        new Set(info.requiredScopes).size !== info.requiredScopes.length ||
+        canonicalize(info.requiredScopes) !== canonicalize(http.required_scopes) ||
+        !info.nativePolicyRevision?.policyId ||
+        !/^[a-f0-9]{64}$/.test(info.nativePolicyRevision.composedPolicyHash ?? ""))
+        throw new Error("Native OAuth anchor unavailable");
+    const holder = await nativeHolderBinding(info.holderKeyId);
+    const binding = await sha256Hex(canonicalize({
+        sid,
+        projectId: cfg.projectId,
+        holderKeyId: info.holderKeyId,
+        audience: info.audience,
+        issuerDid: cfg.issuerDid,
+        http,
+        revision: info.nativePolicyRevision,
+        expiresAt: info.expiresAt,
+    }));
+    return { binding, holderDid: holder.did };
+}
+function hostContext(env, cfg) {
+    return {
+        projectId: cfg.projectId || env.AGENTSHIELD_PROJECT_ID || "",
+        issuerDid: cfg.issuerDid,
+        authorizationOrigin: cfg.authorizationOrigin,
+        allowLoopbackHttp: cfg.allowLoopbackHttp === true,
+    };
+}
+export async function beginNativeOAuth(env, sid, info, cfg, initiate = true) {
+    if (!env.DELEGATION_STORAGE || !env.OAUTH_ENCRYPTION_SECRET)
+        throw new Error("Native OAuth secure state unavailable");
+    const host = hostContext(env, cfg);
+    const anchor = await anchorBinding(env, sid, info, host);
+    const selected = await selectedProvider(env);
+    if (!selected)
+        return null;
+    validateProvider(selected.provider, host.allowLoopbackHttp);
+    if (!initiate)
+        return { provider: selected.id };
+    const security = new OAuthSecurityService(env.DELEGATION_STORAGE, env.OAUTH_ENCRYPTION_SECRET);
+    const { verifier: codeVerifier, challenge: codeChallenge } = await security.generatePKCEChallenge();
+    const random = crypto.getRandomValues(new Uint8Array(32));
+    const state = NATIVE_OAUTH_STATE_PREFIX +
+        btoa(String.fromCharCode(...random))
+            .replace(/\+/g, "-")
+            .replace(/\//g, "_")
+            .replace(/=+$/, "");
+    const redirectUri = host.authorizationOrigin + "/oauth/callback";
+    const native = {
+        ...host,
+        binding: anchor.binding,
+        provider: selected.id,
+        providerBinding: await providerBinding(selected.id, selected.provider),
+        expiresAt: Math.min(info.expiresAt, Date.now() + 600000),
+    };
+    await security.storeOAuthState(state, {
+        native_http_anchor: true,
+        native,
+        project_id: host.projectId,
+        agent_did: anchor.holderDid,
+        session_id: sid,
+        scopes: info.requiredScopes,
+        tool: "",
+        provider: selected.id,
+        direct_pkce: true,
+        encryptedVerifier: await security.encryptToken(codeVerifier),
+        redirect_uri: redirectUri,
+    }, Math.max(1, Math.floor((native.expiresAt - Date.now()) / 1000)));
+    const url = new URL(selected.provider.authorizationUrl);
+    const reserved = new Set([
+        "response_type",
+        "client_id",
+        "redirect_uri",
+        "scope",
+        "state",
+        "code_challenge",
+        "code_challenge_method",
+    ]);
+    for (const [key, value] of Object.entries(selected.provider.customParams || {})) {
+        if (reserved.has(key.toLowerCase()) || typeof value !== "string")
+            throw new Error("Reserved native OAuth parameter");
+        url.searchParams.set(key, value);
+    }
+    Object.entries({
+        response_type: "code",
+        client_id: selected.provider.clientId,
+        redirect_uri: redirectUri,
+        scope: resolveIdpScopes(selected.provider).join(" "),
+        state,
+        code_challenge: codeChallenge,
+        code_challenge_method: "S256",
+    }).forEach(([key, value]) => url.searchParams.set(key, value));
+    return { provider: selected.id, oauthUrl: url.toString() };
+}
+/** Caller must have consumed cryptographically random server-stored OAuth state. */
+export async function completeNativeOAuth(env, state, code) {
+    try {
+        const native = state.native;
+        const sid = state.session_id;
+        if (state.native_http_anchor !== true ||
+            !native ||
+            typeof sid !== "string" ||
+            !code ||
+            native.expiresAt <= Date.now() ||
+            state.project_id !== native.projectId ||
+            state.provider !== native.provider ||
+            state.tool !== "" ||
+            state.direct_pkce !== true ||
+            typeof state.pkceVerifier !== "string" ||
+            !state.pkceVerifier ||
+            state.redirect_uri !== native.authorizationOrigin + "/oauth/callback")
+            return failure();
+        const response = await getAnchorStub(env, sid).fetch("https://do.internal" + INTERNAL_PICKUP_INFO, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ sid }),
+        });
+        if (!response.ok)
+            return failure();
+        const info = (await response.json());
+        const anchor = await anchorBinding(env, sid, info, native);
+        if (anchor.binding !== native.binding ||
+            state.agent_did !== anchor.holderDid ||
+            canonicalize(state.scopes) !== canonicalize(info.requiredScopes))
+            return failure();
+        const selected = await selectedProvider(env);
+        if (!selected || selected.id !== native.provider)
+            return failure();
+        validateProvider(selected.provider, native.allowLoopbackHttp);
+        if ((await providerBinding(selected.id, selected.provider)) !==
+            native.providerBinding)
+            return failure();
+        const clientSecret = await selected.oauthService.resolveClientSecret(selected.provider);
+        if (selected.provider.requiresClientSecret && !clientSecret)
+            return failure();
+        const tokens = await toIdpTokens(await exchangeAuthorizationCode({
+            tokenEndpoint: selected.provider.tokenUrl,
+            code,
+            redirectUri: state.redirect_uri,
+            clientId: selected.provider.clientId,
+            codeVerifier: state.pkceVerifier,
+            clientSecret,
+            fetchImpl: boundedFetch,
+        }));
+        const userResponse = await boundedFetch(selected.provider.userInfoUrl, {
+            headers: {
+                Authorization: "Bearer " + tokens.access_token,
+                Accept: "application/json",
+                ...(selected.id === "github"
+                    ? { "User-Agent": "KYA-OS-Authorization-Host" }
+                    : {}),
+            },
+        });
+        if (!userResponse.ok)
+            return failure();
+        const user = (await userResponse.json());
+        const subject = typeof user.sub === "string"
+            ? user.sub
+            : typeof user.id === "number" || typeof user.id === "string"
+                ? String(user.id)
+                : typeof user.login === "string"
+                    ? user.login
+                    : undefined;
+        if (!subject)
+            return failure();
+        const identityResponse = await boundedFetch(env.AGENTSHIELD_API_URL + "/api/v1/bouncer/identity/resolve", {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "X-API-Key": env.AGENTSHIELD_API_KEY,
+            },
+            body: JSON.stringify({
+                project_id: native.projectId,
+                oauth_result: {
+                    provider: selected.id,
+                    sub: subject,
+                    email: typeof user.email === "string" ? user.email : undefined,
+                    emailVerified: user.email_verified === true,
+                    name: typeof user.name === "string" ? user.name : undefined,
+                },
+            }),
+        });
+        if (!identityResponse.ok)
+            return failure();
+        const identity = (await identityResponse.json());
+        if (identity.success !== true ||
+            !identity.data?.user_did?.startsWith("did:key:"))
+            return failure();
+        // Re-read after network operations: a revoked/expired/changed anchor cannot
+        // acquire a usable authenticated continuation during the exchange.
+        const currentResponse = await getAnchorStub(env, sid).fetch("https://do.internal" + INTERNAL_PICKUP_INFO, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ sid }),
+        });
+        if (!currentResponse.ok ||
+            (await anchorBinding(env, sid, (await currentResponse.json()), native)).binding !== anchor.binding)
+            return failure();
+        const assertion = await new ConsentService(env).mintIdentityAssertion({
+            sid,
+            userDid: identity.data.user_did,
+            provider: selected.id,
+            agentDid: anchor.holderDid,
+            tool: "",
+            scopes: info.requiredScopes,
+            projectId: native.projectId,
+            binding: await sha256Hex(canonicalize({
+                anchor: anchor.binding,
+                provider: native.providerBinding,
+            })),
+        });
+        const location = new URL(info.nativeHttp.consent_uri);
+        location.searchParams.set("mode", "consent-only");
+        location.hash = new URLSearchParams({
+            identity_assertion: assertion,
+        }).toString();
+        return new Response(null, {
+            status: 302,
+            headers: {
+                Location: location.toString(),
+                "Cache-Control": "no-store",
+                "Referrer-Policy": "no-referrer",
+            },
+        });
+    }
+    catch {
+        return failure();
+    }
+}
+export async function verifyNativeOAuthIdentity(env, sid, info, cfg, token) {
+    try {
+        if (!token || token.length > 16384)
+            return null;
+        const host = hostContext(env, cfg);
+        const anchor = await anchorBinding(env, sid, info, host);
+        const selected = await selectedProvider(env);
+        if (!selected)
+            return null;
+        validateProvider(selected.provider, host.allowLoopbackHttp);
+        const userDid = await new ConsentService(env).verifyNativeIdentityAssertion(token, {
+            sid,
+            agentDid: anchor.holderDid,
+            tool: "",
+            scopes: info.requiredScopes,
+            projectId: host.projectId,
+            provider: selected.id,
+            binding: await sha256Hex(canonicalize({
+                anchor: anchor.binding,
+                provider: await providerBinding(selected.id, selected.provider),
+            })),
+        });
+        return userDid ? { userDid, amr: ["oauth"] } : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=native-oauth.js.map

package/dist/delegation-http/native-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-oauth.js","sourceRoot":"","sources":["../../src/delegation-http/native-oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAGvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EACL,yBAAyB,EACzB,WAAW,GACZ,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,aAAa,GAGd,MAAM,eAAe,CAAC;AAsBvB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;AACjE,MAAM,YAAY,GAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACjD,qBAAqB,CAAC,KAAK,EAAE;IAC3B,GAAG,IAAI;IACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;CACnC,CAAC,CAAC;AAEL,KAAK,UAAU,QAAQ,CAAC,GAAkB;IACxC,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CACvD,uBAAuB,CACxB,CAAC;IACF,IACE,CAAC,GAAG,CAAC,mBAAmB;QACxB,CAAC,GAAG,CAAC,mBAAmB;QACxB,CAAC,GAAG,CAAC,sBAAsB;QAE3B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG;QACpB,KAAK,EAAE,YAAY;QACnB,UAAU,EAAE,KAAK,IAAI,EAAE;YACrB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QACD,eAAe,EAAE,KAAK,IAAI,EAAE;YAC1B,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QACD,oBAAoB,EAAE,KAAK,IAAI,EAAE;YAC/B,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC;IACF,MAAM,aAAa,GAAG,IAAI,kBAAkB,CAAC;QAC3C,OAAO,EAAE,GAAG,CAAC,mBAAmB;QAChC,MAAM,EAAE,GAAG,CAAC,mBAAmB;QAC/B,aAAa;QACb,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC;KACjB,CAAC,CAAC;IACH,OAAO;QACL,aAAa;QACb,YAAY,EAAE,IAAI,YAAY,CAAC;YAC7B,aAAa;YACb,aAAa;YACb,iBAAiB,EAAE,GAAG,CAAC,mBAAmB;YAC1C,iBAAiB,EAAE,GAAG,CAAC,mBAAmB;YAC1C,SAAS,EAAE,GAAG,CAAC,sBAAsB;YACrC,cAAc,EAAE,qBAAqB,CAAC,GAAG,CAAC;YAC1C,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC;SACjB,CAAC;KACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAkB;IAChD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,cAAc,CACnD,GAAG,CAAC,sBAAuB,CAC5B,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CACxD,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAChC,CAAC;IACF,MAAM,EAAE,GACN,MAAM,CAAC,kBAAkB;QACzB,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,IAAI,CAAC,QAAQ,EAAE,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,EAAG,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AACD,SAAS,gBAAgB,CAAC,QAAuB,EAAE,aAAsB;IACvE,IACE,QAAQ,CAAC,YAAY,KAAK,IAAI;QAC9B,QAAQ,CAAC,SAAS;QAClB,CAAC,QAAQ,CAAC,QAAQ;QAClB,CAAC,aAAa,CAAC,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC;QACxD,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QAChD,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC;QACnD,CAAC,QAAQ,CAAC,uBAAuB;YAC/B,QAAQ,CAAC,uBAAuB,KAAK,oBAAoB,CAAC;QAE5D,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;AACN,CAAC;AACD,KAAK,UAAU,eAAe,CAAC,EAAU,EAAE,QAAuB;IAChE,+EAA+E;IAC/E,OAAO,SAAS,CACd,YAAY,CAAC;QACX,EAAE;QACF,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QAClC,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,EAAE;QACzC,uBAAuB,EACrB,QAAQ,CAAC,uBAAuB,IAAI,oBAAoB;QAC1D,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;QACnD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,EAAE;KAClC,CAAC,CACH,CAAC;AACJ,CAAC;AACD,KAAK,UAAU,aAAa,CAC1B,GAAkB,EAClB,GAAW,EACX,IAAuB,EACvB,GAGC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAChD,IACE,CAAC,GAAG,CAAC,sBAAsB;QAC3B,CAAC,GAAG,CAAC,SAAS;QACd,CAAC,aAAa,CAAC,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,iBAAiB,CAAC;QAC9D,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,mBAAmB;QACzC,IAAI,CAAC,MAAM,KAAK,QAAQ;QACxB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAC5B,CAAC,IAAI,CAAC,WAAW;QACjB,CAAC,IAAI,CAAC,QAAQ;QACd,IAAI,CAAC,eAAe,KAAK,GAAG,CAAC,SAAS;QACtC,CAAC,IAAI;QACL,IAAI,CAAC,GAAG,KAAK,GAAG;QAChB,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,KAAK,KAAK;QAChC,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,iBAAiB,CAAC;QACvD,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAClD,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM;QAC3B,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,cAAc,CAAC,MAAM;QAChE,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC;QACxE,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ;QACpC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAE1E,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,SAAS,CAC7B,YAAY,CAAC;QACX,GAAG;QACH,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,IAAI;QACJ,QAAQ,EAAE,IAAI,CAAC,oBAAoB;QACnC,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CACH,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;AAC5C,CAAC;AACD,SAAS,WAAW,CAAC,GAAkB,EAAE,GAAyB;IAChE,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,sBAAsB,IAAI,EAAE;QAC5D,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;QAC5C,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,KAAK,IAAI;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAkB,EAClB,GAAW,EACX,IAAuB,EACvB,GAAyB,EACzB,QAAQ,GAAG,IAAI;IAEf,IAAI,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,GAAG,CAAC,uBAAuB;QACzD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CACvC,GAAG,CAAC,kBAAyB,EAC7B,GAAG,CAAC,uBAAuB,CAC5B,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,GACxD,MAAM,QAAQ,CAAC,qBAAqB,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1D,MAAM,KAAK,GACT,yBAAyB;QACzB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,CAAC;aACjC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxB,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,GAAG,iBAAiB,CAAC;IACjE,MAAM,MAAM,GAAkB;QAC5B,GAAG,IAAI;QACP,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,eAAe,EAAE,MAAM,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;QACtE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;KACzD,CAAC;IACF,MAAM,QAAQ,CAAC,eAAe,CAC5B,KAAK,EACL;QACE,kBAAkB,EAAE,IAAI;QACxB,MAAM;QACN,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,GAAG;QACf,MAAM,EAAE,IAAI,CAAC,cAAc;QAC3B,IAAI,EAAE,EAAE;QACR,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,WAAW,EAAE,IAAI;QACjB,iBAAiB,EAAE,MAAM,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC;QAC5D,YAAY,EAAE,WAAW;KAC1B,EACD,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAChE,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,eAAe;QACf,WAAW;QACX,cAAc;QACd,OAAO;QACP,OAAO;QACP,gBAAgB;QAChB,uBAAuB;KACxB,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CACvC,QAAQ,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CACrC,EAAE,CAAC;QACF,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAC9D,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,CAAC,OAAO,CAAC;QACb,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ;QACrC,YAAY,EAAE,WAAW;QACzB,KAAK,EAAE,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACpD,KAAK;QACL,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;KAC9B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/D,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAkB,EAClB,KAA8B,EAC9B,IAAY;IAEZ,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,MAAuB,CAAC;QAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC;QAC7B,IACE,KAAK,CAAC,kBAAkB,KAAK,IAAI;YACjC,CAAC,MAAM;YACP,OAAO,GAAG,KAAK,QAAQ;YACvB,CAAC,IAAI;YACL,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAC9B,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,SAAS;YACrC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;YAClC,KAAK,CAAC,IAAI,KAAK,EAAE;YACjB,KAAK,CAAC,WAAW,KAAK,IAAI;YAC1B,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;YACtC,CAAC,KAAK,CAAC,YAAY;YACnB,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,mBAAmB,GAAG,iBAAiB;YAErE,OAAO,OAAO,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAClD,qBAAqB,GAAG,oBAAoB,EAC5C;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC;SAC9B,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsB,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3D,IACE,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YACjC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;YACpC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC;YAEhE,OAAO,OAAO,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ;YAAE,OAAO,OAAO,EAAE,CAAC;QACnE,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC9D,IACE,CAAC,MAAM,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvD,MAAM,CAAC,eAAe;YAEtB,OAAO,OAAO,EAAE,CAAC;QACnB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAClE,QAAQ,CAAC,QAAQ,CAClB,CAAC;QACF,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,IAAI,CAAC,YAAY;YACzD,OAAO,OAAO,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,MAAM,yBAAyB,CAAC;YAC9B,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ;YACzC,IAAI;YACJ,WAAW,EAAE,KAAK,CAAC,YAAsB;YACzC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,YAAY;YACZ,SAAS,EAAE,YAAY;SACxB,CAAC,CACH,CAAC;QACF,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAY,EAAE;YACtE,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,GAAG,MAAM,CAAC,YAAY;gBAC9C,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ;oBAC1B,CAAC,CAAC,EAAE,YAAY,EAAE,2BAA2B,EAAE;oBAC/C,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,EAAE;YAAE,OAAO,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAA4B,CAAC;QACpE,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;YAC1B,CAAC,CAAC,IAAI,CAAC,GAAG;YACV,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ;gBAC1D,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjB,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;oBAC9B,CAAC,CAAC,IAAI,CAAC,KAAK;oBACZ,CAAC,CAAC,SAAS,CAAC;QACpB,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,EAAE,CAAC;QAC/B,MAAM,gBAAgB,GAAG,MAAM,YAAY,CACzC,GAAG,CAAC,mBAAmB,GAAG,kCAAkC,EAC5D;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,WAAW,EAAE,GAAG,CAAC,mBAAoB;aACtC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,MAAM,CAAC,SAAS;gBAC5B,YAAY,EAAE;oBACZ,QAAQ,EAAE,QAAQ,CAAC,EAAE;oBACrB,GAAG,EAAE,OAAO;oBACZ,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;oBAC9D,aAAa,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;oBAC3C,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;iBAC5D;aACF,CAAC;SACH,CACF,CAAC;QACF,IAAI,CAAC,gBAAgB,CAAC,EAAE;YAAE,OAAO,OAAO,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAG9C,CAAC;QACF,IACE,QAAQ,CAAC,OAAO,KAAK,IAAI;YACzB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;YAEhD,OAAO,OAAO,EAAE,CAAC;QACnB,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CACzD,qBAAqB,GAAG,oBAAoB,EAC5C;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC;SAC9B,CACF,CAAC;QACF,IACE,CAAC,eAAe,CAAC,EAAE;YACnB,CACE,MAAM,aAAa,CACjB,GAAG,EACH,GAAG,EACH,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,CAAsB,EACnD,MAAM,CACP,CACF,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YAE5B,OAAO,OAAO,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,qBAAqB,CAAC;YACpE,GAAG;YACH,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ;YAC/B,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,SAAS,CACtB,YAAY,CAAC;gBACX,MAAM,EAAE,MAAM,CAAC,OAAO;gBACtB,QAAQ,EAAE,MAAM,CAAC,eAAe;aACjC,CAAC,CACH;SACF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAW,CAAC,WAAW,CAAC,CAAC;QACvD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAClD,QAAQ,CAAC,IAAI,GAAG,IAAI,eAAe,CAAC;YAClC,kBAAkB,EAAE,SAAS;SAC9B,CAAC,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;gBAC7B,eAAe,EAAE,UAAU;gBAC3B,iBAAiB,EAAE,aAAa;aACjC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAkB,EAClB,GAAW,EACX,IAAuB,EACvB,GAAyB,EACzB,KAAa;IAEb,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,6BAA6B,CACzE,KAAK,EACL;YACE,GAAG;YACH,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,OAAO,EAAE,MAAM,SAAS,CACtB,YAAY,CAAC;gBACX,MAAM,EAAE,MAAM,CAAC,OAAO;gBACtB,QAAQ,EAAE,MAAM,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;aAChE,CAAC,CACH;SACF,CACF,CAAC;QACF,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/delegation-http/native-pickup.d.ts

@@ -0,0 +1,20 @@
+type Identity = {
+    keyId: string;
+    nonce: string;
+    expiresUnix: number;
+};
+export type NativePollIdentity = {
+    ok: true;
+    proof: Identity;
+} | {
+    ok: false;
+    error: string;
+    status: number;
+};
+/** Complete bodyless Ed25519/P-256 did:key pickup profile. A keyid alone is never
+ * an identity. The caller must claim the returned nonce in the shared replay
+ * service before performing pin CAS or delivering a parked credential.
+ */
+export declare function verifyNativePoll(req: Request, expectedOrigin: string, now?: number): Promise<NativePollIdentity>;
+export {};
+//# sourceMappingURL=native-pickup.d.ts.map

package/dist/delegation-http/native-pickup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-pickup.d.ts","sourceRoot":"","sources":["../../src/delegation-http/native-pickup.ts"],"names":[],"mappings":"AAGA,KAAK,QAAQ,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAYjD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,OAAO,EACZ,cAAc,EAAE,MAAM,EACtB,GAAG,SAAgC,GAClC,OAAO,CAAC,kBAAkB,CAAC,CA8G7B"}

package/dist/delegation-http/native-pickup.js

@@ -0,0 +1,227 @@
+import { base64urlDecodeToBytes } from "@kya-os/mcp";
+import { nativeHolderBinding } from "./native-http";
+const fail = (error = "kyaos/profile-violation", status = 403) => ({ ok: false, error, status });
+const fields = [
+    "content-digest",
+    "content-type",
+    "content-encoding",
+    "idempotency-key",
+];
+/** Complete bodyless Ed25519/P-256 did:key pickup profile. A keyid alone is never
+ * an identity. The caller must claim the returned nonce in the shared replay
+ * service before performing pin CAS or delivering a parked credential.
+ */
+export async function verifyNativePoll(req, expectedOrigin, now = Math.floor(Date.now() / 1000)) {
+    const input = req.headers.get("signature-input");
+    const signature = req.headers.get("signature");
+    if (req.headers.has("x-kya-pickup-token"))
+        return fail();
+    if (input === null || signature === null)
+        return fail("kyaos/missing-signature", 401);
+    if (input.length > 4096 ||
+        signature.length > 2048 ||
+        !["GET", "HEAD"].includes(req.method) ||
+        req.body !== null ||
+        new URL(req.url).origin !== expectedOrigin)
+        return fail();
+    if ([
+        "authorization",
+        "kya-delegation",
+        "x-mcpi-proof",
+        "x-mcpi-delegation",
+        "kya-os-delegation-credential",
+        "kya-os-delegation-proof",
+        "kya-os-delegation",
+    ].some((name) => req.headers.has(name)))
+        return fail();
+    const raw = member(input);
+    const encoded = member(signature);
+    if (!raw || !encoded)
+        return fail();
+    const close = raw.indexOf(")");
+    const components = pickupComponents(raw.slice(0, close + 1), req.headers);
+    if (!components)
+        return fail();
+    const params = parameters(raw.slice(close + 1));
+    if (!params ||
+        params.tag !== "kya-http/2" ||
+        !["ed25519", "ecdsa-p256", "ecdsa-p256-sha256"].includes(String(params.alg)) ||
+        typeof params.keyid !== "string" ||
+        typeof params.nonce !== "string" ||
+        !/^[\x21-\x7e]{1,128}$/.test(params.nonce) ||
+        typeof params.created !== "number" ||
+        typeof params.expires !== "number")
+        return fail();
+    if (params.expires < params.created ||
+        params.expires - params.created > 300 ||
+        params.created > now + 30)
+        return fail();
+    if (params.expires <= now)
+        return fail("kyaos/expired", 401);
+    for (const field of fields) {
+        const value = req.headers.get(field);
+        if (value !== null && (!value || value.includes(",")))
+            return fail();
+    }
+    const digest = req.headers.get("content-digest");
+    if (digest !== null &&
+        digest !== "sha-256=:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=:")
+        return fail("kyaos/invalid-signature", 401);
+    if (!/^:[A-Za-z0-9+/]{86}==:$/.test(encoded))
+        return fail();
+    const sigText = encoded.slice(1, -1);
+    const bytes = base64urlDecodeToBytes(sigText.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""));
+    if (btoa(String.fromCharCode(...bytes)) !== sigText)
+        return fail();
+    let binding;
+    try {
+        binding = await nativeHolderBinding(params.keyid);
+    }
+    catch {
+        return fail("kyaos/did-unresolvable", 401);
+    }
+    const ed25519 = binding.key.algorithm.name === "Ed25519";
+    if ((params.alg === "ed25519") !== ed25519)
+        return fail();
+    const values = {
+        "@method": req.method,
+        "@authority": new URL(req.url).host.toLowerCase(),
+        "@target-uri": req.url,
+    };
+    const base = [
+        ...components.map((name) => `"${name}": ${Object.hasOwn(values, name) ? values[name] : req.headers.get(name)}`),
+        `"@signature-params": ${raw}`,
+    ].join("\n");
+    try {
+        if (!(await crypto.subtle.verify(ed25519 ? "Ed25519" : { name: "ECDSA", hash: "SHA-256" }, binding.key, new Uint8Array(bytes), new TextEncoder().encode(base))))
+            return fail("kyaos/invalid-signature", 401);
+    }
+    catch {
+        return fail("kyaos/invalid-signature", 401);
+    }
+    return {
+        ok: true,
+        proof: {
+            keyId: params.keyid,
+            nonce: params.nonce,
+            expiresUnix: params.expires,
+        },
+    };
+}
+/** Rev13 §5.1/§5.3 canonical required/conditional phases, followed by optional
+ * signed ordinary fields in lowercase lexical order. Additional fields remain
+ * opaque signed values; they do not become authorization or policy facts. */
+function pickupComponents(list, headers) {
+    if (!/^\( *"@?[!#$%&'*+.^_`|~a-z0-9-]+"(?: +"@?[!#$%&'*+.^_`|~a-z0-9-]+")* *\)$/.test(list))
+        return null;
+    const covered = list
+        .slice(1, -1)
+        .trim()
+        .split(/ +/)
+        .map((item) => item.slice(1, -1));
+    if (new Set(covered).size !== covered.length)
+        return null;
+    const required = [
+        "@method",
+        "@authority",
+        "@target-uri",
+        ...fields.filter((name) => headers.has(name)),
+    ];
+    const extra = covered.filter((name) => !required.includes(name));
+    if (extra.some((name) => name.startsWith("@") ||
+        name === "signature" ||
+        name === "signature-input" ||
+        !headers.has(name)))
+        return null;
+    const expected = [...required, ...extra.sort()];
+    return expected.length === covered.length &&
+        expected.every((name, i) => covered[i] === name)
+        ? covered
+        : null;
+}
+/** Bounded SF dictionary scanner: escaped quotes/commas never become labels. */
+function member(value) {
+    const parts = [];
+    let start = 0, quoted = false, escaped = false;
+    for (let i = 0; i < value.length; i++) {
+        const c = value[i];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (quoted && c === "\\") {
+            escaped = true;
+            continue;
+        }
+        if (c === '"')
+            quoted = !quoted;
+        else if (c === "," && !quoted) {
+            parts.push(value.slice(start, i).trim());
+            start = i + 1;
+        }
+    }
+    if (quoted || escaped)
+        return null;
+    parts.push(value.slice(start).trim());
+    const labels = new Set();
+    let selected = null;
+    for (const part of parts) {
+        const eq = part.indexOf("=");
+        const label = part.slice(0, eq);
+        if (eq < 1 || !/^[a-z*][a-z0-9_.*-]*$/.test(label) || labels.has(label))
+            return null;
+        labels.add(label);
+        if (label === "kya")
+            selected = part.slice(eq + 1);
+    }
+    return selected;
+}
+function parameters(value) {
+    const result = Object.create(null);
+    let i = 0;
+    while (i < value.length) {
+        if (value[i++] !== ";")
+            return null;
+        const start = i;
+        while (i < value.length && /[a-z0-9_.*-]/.test(value[i]))
+            i++;
+        const key = value.slice(start, i);
+        if (!key || Object.hasOwn(result, key) || value[i++] !== "=")
+            return null;
+        if (value[i] === '"') {
+            i++;
+            let text = "", closed = false;
+            while (i < value.length) {
+                let c = value[i++];
+                if (c === '"') {
+                    closed = true;
+                    break;
+                }
+                if (c === "\\") {
+                    c = value[i++];
+                    if (c !== "\\" && c !== '"')
+                        return null;
+                }
+                if (!c || c.charCodeAt(0) < 32 || c.charCodeAt(0) > 126)
+                    return null;
+                text += c;
+            }
+            if (!closed)
+                return null;
+            result[key] = text;
+        }
+        else {
+            const startNumber = i;
+            if (value[i] === "-")
+                i++;
+            while (i < value.length && /[0-9]/.test(value[i]))
+                i++;
+            const number = value.slice(startNumber, i);
+            if (!/^-?\d{1,15}$/.test(number))
+                return null;
+            result[key] = Number(number);
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=native-pickup.js.map

package/dist/delegation-http/native-pickup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-pickup.js","sourceRoot":"","sources":["../../src/delegation-http/native-pickup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAMpD,MAAM,IAAI,GAAG,CACX,KAAK,GAAG,yBAAyB,EACjC,MAAM,GAAG,GAAG,EACQ,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AACxD,MAAM,MAAM,GAAG;IACb,gBAAgB;IAChB,cAAc;IACd,kBAAkB;IAClB,iBAAiB;CAClB,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAY,EACZ,cAAsB,EACtB,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAEnC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IACzD,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI;QACtC,OAAO,IAAI,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAC9C,IACE,KAAK,CAAC,MAAM,GAAG,IAAI;QACnB,SAAS,CAAC,MAAM,GAAG,IAAI;QACvB,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QACrC,GAAG,CAAC,IAAI,KAAK,IAAI;QACjB,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,cAAc;QAE1C,OAAO,IAAI,EAAE,CAAC;IAChB,IACE;QACE,eAAe;QACf,gBAAgB;QAChB,cAAc;QACd,mBAAmB;QACnB,8BAA8B;QAC9B,yBAAyB;QACzB,mBAAmB;KACpB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEvC,OAAO,IAAI,EAAE,CAAC;IAChB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,IACE,CAAC,MAAM;QACP,MAAM,CAAC,GAAG,KAAK,YAAY;QAC3B,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CACtD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CACnB;QACD,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAChC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAChC,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAC1C,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAClC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAElC,OAAO,IAAI,EAAE,CAAC;IAChB,IACE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;QAC/B,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,GAAG,GAAG;QACrC,MAAM,CAAC,OAAO,GAAG,GAAG,GAAG,EAAE;QAEzB,OAAO,IAAI,EAAE,CAAC;IAChB,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACjD,IACE,MAAM,KAAK,IAAI;QACf,MAAM,KAAK,wDAAwD;QAEnE,OAAO,IAAI,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,sBAAsB,CAClC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACnE,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,EAAE,CAAC;IACnE,IAAI,OAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,EAAE,CAAC;IAC1D,MAAM,MAAM,GAA2B;QACrC,SAAS,EAAE,GAAG,CAAC,MAAM;QACrB,YAAY,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE;QACjD,aAAa,EAAE,GAAG,CAAC,GAAG;KACvB,CAAC;IACF,MAAM,IAAI,GAAG;QACX,GAAG,UAAU,CAAC,GAAG,CACf,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACrF;QACD,wBAAwB,GAAG,EAAE;KAC9B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,IAAI,CAAC;QACH,IACE,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC1B,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EACxD,OAAO,CAAC,GAAG,EACX,IAAI,UAAU,CAAC,KAAK,CAAC,EACrB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/B,CAAC;YAEF,OAAO,IAAI,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,OAAO;SAC5B;KACF,CAAC;AACJ,CAAC;AAED;;6EAE6E;AAC7E,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAgB;IACtD,IACE,CAAC,2EAA2E,CAAC,IAAI,CAC/E,IAAI,CACL;QAED,OAAO,IAAI,CAAC;IACd,MAAM,OAAO,GAAG,IAAI;SACjB,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;SACZ,IAAI,EAAE;SACN,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,QAAQ,GAAG;QACf,SAAS;QACT,YAAY;QACZ,aAAa;QACb,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;KAC9C,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,IACE,KAAK,CAAC,IAAI,CACR,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACpB,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,iBAAiB;QAC1B,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CACrB;QAED,OAAO,IAAI,CAAC;IACd,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,OAAO,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QACvC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;QAChD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,gFAAgF;AAChF,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,EACX,MAAM,GAAG,KAAK,EACd,OAAO,GAAG,KAAK,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG;YAAE,MAAM,GAAG,CAAC,MAAM,CAAC;aAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACzC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,IAAI,MAAM,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,IAAI,KAAK,KAAK,KAAK;YAAE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,MAAM,GAAoC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,KAAK,GAAG,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1E,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,CAAC,EAAE,CAAC;YACJ,IAAI,IAAI,GAAG,EAAE,EACX,MAAM,GAAG,KAAK,CAAC;YACjB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxB,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACnB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;oBACd,MAAM,GAAG,IAAI,CAAC;oBACd,MAAM;gBACR,CAAC;gBACD,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBACf,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;oBACf,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG;wBAAE,OAAO,IAAI,CAAC;gBAC3C,CAAC;gBACD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACrE,IAAI,IAAI,CAAC,CAAC;YACZ,CAAC;YACD,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,CAAC,CAAC;YACtB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}