@kya-os/mcp-i-cloudflare 1.13.6 → 1.14.2

package/dist/delegation-http/pickup-routes.d.ts

@@ -24,6 +24,7 @@ interface PickupRequestContext {
         param(name: string): string | undefined;
         header(name: string): string | undefined;
         url: string;
+        raw?: Request;
     };
 }
 /**

package/dist/delegation-http/pickup-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pickup-routes.d.ts","sourceRoot":"","sources":["../../src/delegation-http/pickup-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAS5C,wFAAwF;AACxF,UAAU,oBAAoB;IAC5B,GAAG,EAAE;QACH,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;QACxC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;QACzC,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;CACH;AA+CD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,EACtD,iBAAiB,EAAE,OAAO,GACzB,YAAY,GAAG,IAAI,CAerB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,CAAC,EAAE,oBAAoB,EACvB,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GACjC,OAAO,CAAC,QAAQ,CAAC,CA4BnB"}
+{"version":3,"file":"pickup-routes.d.ts","sourceRoot":"","sources":["../../src/delegation-http/pickup-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAY5C,wFAAwF;AACxF,UAAU,oBAAoB;IAC5B,GAAG,EAAE;QACH,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;QACxC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;QACzC,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,CAAC,EAAE,OAAO,CAAC;KACf,CAAC;CACH;AA+CD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,EACtD,iBAAiB,EAAE,OAAO,GACzB,YAAY,GAAG,IAAI,CAerB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,CAAC,EAAE,oBAAoB,EACvB,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GACjC,OAAO,CAAC,QAAQ,CAAC,CAiEnB"}

package/dist/delegation-http/pickup-routes.js

@@ -17,7 +17,9 @@
  */
 import { getAnchorStub } from "./anchor-routing";
 import { isAnchorSid } from "./sid";
-import { PICKUP_TOKEN_HEADER, INTERNAL_PICKUP_POLL, KYAOS_ERRORS, } from "./constants";
+import { claimNativeReplay, nativeError, nativeUnavailable } from "./native-http";
+import { verifyNativePoll } from "./native-pickup";
+import { PICKUP_TOKEN_HEADER, INTERNAL_PICKUP_POLL, INTERNAL_PICKUP_INFO, KYAOS_ERRORS, } from "./constants";
 /** A 404 invalid-session response (no-store JSON), used for a malformed/unknown sid. */
 function invalidSession() {
     return new Response(JSON.stringify({ error: KYAOS_ERRORS.invalidSession }), {
@@ -91,6 +93,58 @@ export async function handlePickupGet(c, env, cfg) {
         // Malformed sid — never routes to a durable object.
         return invalidSession();
     }
+    if (![PICKUP_TOKEN_HEADER, "Signature", "Signature-Input"].some((name) => c.req.header(name) !== undefined)) {
+        return cfg.native ? nativeError("kyaos/missing-signature", 401) : missingPickupHolder();
+    }
+    // Anchor metadata is read only through the internal DO seam. Native mode is
+    // immutable registration state; it is never selected by the poller's headers.
+    if (!env.MCP_OBJECT)
+        return nativeUnavailable();
+    const stub = getAnchorStub(env, sid);
+    let info;
+    try {
+        const response = await stub.fetch("https://do.internal" + INTERNAL_PICKUP_INFO, {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ sid }),
+        });
+        if (response.status === 404 || response.status === 410)
+            return response;
+        if (!response.ok)
+            return nativeUnavailable();
+        info = await response.json();
+    }
+    catch {
+        return nativeUnavailable();
+    }
+    if (info.nativeHttp) {
+        if (!cfg.native || !c.req.raw || info.nativeIssuerDid !== cfg.native.issuerDid || !info.audience)
+            return nativeUnavailable();
+        const request = c.req.raw;
+        const identity = await verifyNativePoll(request, cfg.native.authorizationOrigin);
+        if (!identity.ok)
+            return nativeError(identity.error, identity.status);
+        let sourceIp;
+        try {
+            sourceIp = cfg.native.resolveSourceIp ? cfg.native.resolveSourceIp(request) :
+                ("cf" in request && request.cf ? request.headers.get("CF-Connecting-IP") : null);
+        }
+        catch {
+            return nativeError("kyaos/replay-state-unavailable", 503);
+        }
+        if (!sourceIp)
+            return nativeError("kyaos/replay-state-unavailable", 503);
+        const result = await claimNativeReplay(env, cfg.native, { resourceDid: info.audience, ...identity.proof, sourceIp });
+        if (result !== "claimed")
+            return nativeError(result === "replay" ? "kyaos/replay" : result === "capacity" ? "kyaos/replay-capacity" : "kyaos/replay-state-unavailable", result === "replay" ? 401 : result === "capacity" ? 429 : 503);
+        try {
+            return await stub.fetch("https://do.internal" + INTERNAL_PICKUP_POLL, {
+                method: "POST", headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ sid, holder: { type: "keyid", value: identity.proof.keyId, nativeVerified: true } }),
+            });
+        }
+        catch {
+            return nativeUnavailable();
+        }
+    }
     const holder = extractPickupHolder((name) => c.req.header(name), cfg.allowUnverifiedKeyidHolders);
     if (!holder) {
         // A poll with no pickup credential is a MISSING-credential case, not a dead

package/dist/delegation-http/pickup-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"pickup-routes.js","sourceRoot":"","sources":["../../src/delegation-http/pickup-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AACpC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,GACb,MAAM,aAAa,CAAC;AAWrB,wFAAwF;AACxF,SAAS,cAAc;IACrB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,cAAc,EAAE,CAAC,EAAE;QAC1E,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB;IAC1B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,YAAY,CAAC,qBAAqB;QACzC,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,qEAAqE;QACrE,gCAAgC;QAChC,GAAG,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;KACrC,CAAC,EACF;QACE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;YAC3B,kBAAkB,EAAE,wBAAwB,mBAAmB,GAAG;SACnE;KACF,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAsD,EACtD,iBAA0B;IAE1B,MAAM,KAAK,GAAG,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC7C,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAElD,gFAAgF;IAChF,mFAAmF;IACnF,oFAAoF;IACpF,IAAI,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,QAAQ,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,QAAQ,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,CAAuB,EACvB,GAAkB,EAClB,GAAkC;IAElC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,oDAAoD;QACpD,OAAO,cAAc,EAAE,CAAC;IAC1B,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAChC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAC5B,GAAG,CAAC,2BAA2B,CAChC,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,4EAA4E;QAC5E,kFAAkF;QAClF,mFAAmF;QACnF,gDAAgD;QAChD,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE;QAClE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;KACtC,CAAC,CAAC;IACH,kFAAkF;IAClF,sFAAsF;IACtF,OAAO,UAAiC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"pickup-routes.js","sourceRoot":"","sources":["../../src/delegation-http/pickup-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,iBAAiB,EAA4B,MAAM,eAAe,CAAC;AAC5G,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,GACb,MAAM,aAAa,CAAC;AAYrB,wFAAwF;AACxF,SAAS,cAAc;IACrB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,cAAc,EAAE,CAAC,EAAE;QAC1E,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB;IAC1B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,YAAY,CAAC,qBAAqB;QACzC,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,qEAAqE;QACrE,gCAAgC;QAChC,GAAG,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;KACrC,CAAC,EACF;QACE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;YAC3B,kBAAkB,EAAE,wBAAwB,mBAAmB,GAAG;SACnE;KACF,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAsD,EACtD,iBAA0B;IAE1B,MAAM,KAAK,GAAG,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC7C,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAElD,gFAAgF;IAChF,mFAAmF;IACnF,oFAAoF;IACpF,IAAI,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,QAAQ,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,QAAQ,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,CAAuB,EACvB,GAAkB,EAClB,GAAkC;IAElC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,oDAAoD;QACpD,OAAO,cAAc,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,CAAC,mBAAmB,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;QAC5G,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;IAC1F,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,IAAI,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO,iBAAiB,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,IAAuF,CAAC;IAC5F,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,GAAG,oBAAoB,EAAE;YAC9E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC;SAC/F,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,QAA+B,CAAC;QAC/F,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,iBAAiB,EAAE,CAAC;QAC7C,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAiB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,iBAAiB,EAAE,CAAC;IAAC,CAAC;IACvC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,eAAe,KAAK,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,iBAAiB,EAAE,CAAC;QAC7H,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtE,IAAI,QAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC3E,CAAC,IAAI,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,WAAW,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;QACtE,IAAI,CAAC,QAAQ;YAAE,OAAO,WAAW,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrH,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gCAAgC,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvO,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,GAAG,oBAAoB,EAAE;gBACpE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;aAC5G,CAAwB,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,iBAAiB,EAAE,CAAC;QAAC,CAAC;IACzC,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAChC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAC5B,GAAG,CAAC,2BAA2B,CAChC,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,4EAA4E;QAC5E,kFAAkF;QAClF,mFAAmF;QACnF,gDAAgD;QAChD,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE;QAClE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;KACtC,CAAC,CAAC;IACH,kFAAkF;IAClF,sFAAsF;IACtF,OAAO,UAAiC,CAAC;AAC3C,CAAC"}

package/dist/delegation-http/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/delegation-http/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAQ,MAAM,MAAM,CAAC;AAMvC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAEnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAmBnE,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,cAAc,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACpE;AA2BD;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,EACT,OAAO,EAAE,oBAAoB,EAC7B,IAAI,CAAC,EAAE,uBAAuB,GAC7B,IAAI,CAwDN"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/delegation-http/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAQ,MAAM,MAAM,CAAC;AAMvC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAEnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAmBnE,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,cAAc,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACpE;AA2BD;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,EACT,OAAO,EAAE,oBAAoB,EAC7B,IAAI,CAAC,EAAE,uBAAuB,GAC7B,IAAI,CAqDN"}

package/dist/delegation-http/register.js

@@ -51,7 +51,7 @@ export function registerDelegationHttpRoutes(app, options, deps) {
             return next();
         return handlePickupGet(c, env, cfg);
     });
-    // Anchor consent surface. Only intercepts `?sid=kya-…`; everything else (and any
+    // Anchor consent surface. Only intercepts an explicit valid `?sid=…`; everything else (and any
     // flag-off request) falls through to the legacy consent service.
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     app.all(CONSENT_ROUTE, async (c, next) => {
@@ -61,12 +61,9 @@ export function registerDelegationHttpRoutes(app, options, deps) {
             return next();
         return handleAnchorConsentGet(c, sid, env, cfg);
     });
-    // Anchor approval POST. The legacy raw-HTML form posted to
-    // `/consent/approve?sid=kya-…` (sid in the query). The `@kya-os/consent` Lit
-    // component instead POSTs to a hardcoded `/consent/approve` with the sid
-    // carried in the body as `session_id` — `resolveApproveSid` checks the query
-    // FIRST and only peeks a *clone* of the body when it's absent, so a flag-off
-    // or non-anchor request's original body stream is never consumed here.
+    // Anchor approval POST. Explicit `sid` selects anchors; generic `session_id`
+    // selects them only for older kya-prefixed forms. The resolver peeks a clone,
+    // leaving ordinary legacy submissions and their body intact for next().
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     app.post(`${CONSENT_ROUTE}/approve`, async (c, next) => {
         const { env, cfg } = resolveRequest(c, options);

package/dist/delegation-http/register.js.map

@@ -1 +1 @@
-{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/delegation-http/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AAOvD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAQ/B;;;;GAIG;AACH,SAAS,cAAc;AACrB,8DAA8D;AAC9D,CAAM,EACN,OAA6B;IAE7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS;YAC3B,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAA4B,EAAE,OAAO,CAAC,SAAS,CAAC;YACnE,CAAC,CAAE,CAAC,CAAC,GAAqB,CAAC;QAC7B,MAAM,GAAG,GAAG,0BAA0B,CACpC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAC7B,GAAyC,CAC1C,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;QAChF,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAoB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,GAAS,EACT,OAA6B,EAC7B,IAA8B;IAE9B,iFAAiF;IACjF,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QACjD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,EAAE,CAAC;QACxB,OAAO,eAAe,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,iFAAiF;IACjF,iEAAiE;IACjE,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAClD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC,CAA2B,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,2DAA2D;IAC3D,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,uEAAuE;IACvE,8DAA8D;IAC9D,GAAG,CAAC,IAAI,CAAC,GAAG,aAAa,UAAU,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAChE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,CAA2B,CAAC,CAAC;QACjE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACrC,OAAO,0BAA0B,CAC/B,CAA2B,EAC3B,GAAG,EACH,GAAG,EACH,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,CAAC;IAC5C,8DAA8D;IAC9D,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAC/D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACtE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,OAAO,wBAAwB,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE;YAC3C,aAAa;YACb,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;SACxC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/delegation-http/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AAOvD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAQ/B;;;;GAIG;AACH,SAAS,cAAc;AACrB,8DAA8D;AAC9D,CAAM,EACN,OAA6B;IAE7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS;YAC3B,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAA4B,EAAE,OAAO,CAAC,SAAS,CAAC;YACnE,CAAC,CAAE,CAAC,CAAC,GAAqB,CAAC;QAC7B,MAAM,GAAG,GAAG,0BAA0B,CACpC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAC7B,GAAyC,CAC1C,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;QAChF,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAoB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,GAAS,EACT,OAA6B,EAC7B,IAA8B;IAE9B,iFAAiF;IACjF,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QACjD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,EAAE,CAAC;QACxB,OAAO,eAAe,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,+FAA+F;IAC/F,iEAAiE;IACjE,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAClD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC,CAA2B,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,8DAA8D;IAC9D,GAAG,CAAC,IAAI,CAAC,GAAG,aAAa,UAAU,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAChE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,CAA2B,CAAC,CAAC;QACjE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACrC,OAAO,0BAA0B,CAC/B,CAA2B,EAC3B,GAAG,EACH,GAAG,EACH,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,CAAC;IAC5C,8DAA8D;IAC9D,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAC/D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACtE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,OAAO,wBAAwB,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE;YAC3C,aAAa;YACb,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;SACxC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/delegation-http/remote-issuer.d.ts

@@ -0,0 +1,37 @@
+import { type NativeHttpChallenge, type NativeHttpHostConfig } from "./native-http";
+import type { DetachedProof } from "../proof-generator";
+export interface NativeRemoteMint {
+    session_id: string;
+    holder_keyid: string;
+    user_did: string;
+    required_scopes: string[];
+    audience: string;
+    policy_id: string;
+    composed_blob_hash: string;
+    terms_accepted: boolean;
+    amr: string[];
+}
+export interface NativeRemoteIssuer {
+    /** Renew the org assertion for an existing native grant. The outbound
+     * consumer must still join the returned proof to its exact VC, holder and
+     * configured resource before signing/transmitting the request. */
+    propagationProof(delegationId: string): Promise<{
+        proof: string;
+        expires_at: number;
+    }>;
+    registerChallenge(registration: unknown, expected: NativeHttpChallenge, audience: string): Promise<{
+        proof: DetachedProof;
+        issuedAtMs: number;
+    }>;
+    issueDelegation(input: NativeRemoteMint): Promise<{
+        vcJwt: string;
+        subjectDid: string;
+        expiresAtUnix: number;
+    }>;
+}
+/** The deployment binding contains the org's PUBLIC assertion key only. It is
+ * provisioned by Checkpoint alongside the exact API-key role. The request path
+ * cannot supply a signer, control-plane URL, authorization origin or trust key.
+ */
+export declare function resolveManagedNativeIssuer(env: Record<string, unknown>): NativeHttpHostConfig | null;
+//# sourceMappingURL=remote-issuer.d.ts.map

package/dist/delegation-http/remote-issuer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-issuer.d.ts","sourceRoot":"","sources":["../../src/delegation-http/remote-issuer.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AACD,MAAM,WAAW,kBAAkB;IACjC;;sEAEkE;IAClE,gBAAgB,CACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,iBAAiB,CACf,YAAY,EAAE,OAAO,EACrB,QAAQ,EAAE,mBAAmB,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QACT,KAAK,EAAE,aAAa,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,eAAe,CACb,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1E;AAgDD;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,oBAAoB,GAAG,IAAI,CAuC7B"}

package/dist/delegation-http/remote-issuer.js

@@ -0,0 +1,289 @@
+import { canonicalize } from "json-canonicalize";
+import { fetchNativeNoRedirect } from "./native-fetch";
+import { nativeHolderBinding, } from "./native-http";
+const encoder = new TextEncoder();
+const fail = () => {
+    throw new Error("Native issuer capability unavailable");
+};
+function equal(a, b) {
+    return canonicalize(a) === canonicalize(b);
+}
+function bytes(encoded) {
+    if (typeof encoded !== "string" || !/^[A-Za-z0-9_-]+$/.test(encoded))
+        return fail();
+    const raw = atob(encoded.replace(/-/g, "+").replace(/_/g, "/"));
+    return Uint8Array.from(raw, (c) => c.charCodeAt(0));
+}
+async function digest(value) {
+    const hash = new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(canonicalize(value))));
+    return ("sha256:" +
+        [...hash].map((byte) => byte.toString(16).padStart(2, "0")).join(""));
+}
+function isOrigin(value) {
+    if (typeof value !== "string")
+        return false;
+    try {
+        const url = new URL(value);
+        return (url.protocol === "https:" &&
+            !url.port &&
+            !url.username &&
+            !url.password &&
+            url.origin === value);
+    }
+    catch {
+        return false;
+    }
+}
+/** The deployment binding contains the org's PUBLIC assertion key only. It is
+ * provisioned by Checkpoint alongside the exact API-key role. The request path
+ * cannot supply a signer, control-plane URL, authorization origin or trust key.
+ */
+export function resolveManagedNativeIssuer(env) {
+    if (typeof env.MCPI_NATIVE_HTTP_ISSUER_CONFIG !== "string" ||
+        typeof env.MCPI_NATIVE_HTTP_ISSUER_API_KEY !== "string")
+        return null;
+    try {
+        const binding = JSON.parse(env.MCPI_NATIVE_HTTP_ISSUER_CONFIG);
+        if (!binding ||
+            Object.keys(binding).length !== 6 ||
+            binding.version !== 1 ||
+            !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(binding.projectId) ||
+            !/^did:web:[^/?#]+:orgs:[a-z0-9][a-z0-9-]*$/.test(binding.issuerDid) ||
+            bytes(binding.issuerPublicKey).length !== 32 ||
+            !isOrigin(binding.authorizationOrigin) ||
+            !isOrigin(binding.controlPlaneOrigin) ||
+            !env.MCPI_NATIVE_HTTP_ISSUER_API_KEY ||
+            env.MCPI_NATIVE_HTTP_ISSUER_API_KEY !== env.AGENTSHIELD_API_KEY ||
+            (env.CHECKPOINT_API_KEY !== undefined &&
+                env.CHECKPOINT_API_KEY !== env.MCPI_NATIVE_HTTP_ISSUER_API_KEY))
+            return null;
+        return {
+            authorizationOrigin: binding.authorizationOrigin,
+            issuerDid: binding.issuerDid,
+            projectId: binding.projectId,
+            remoteIssuer: createRemoteIssuer(binding, env.MCPI_NATIVE_HTTP_ISSUER_API_KEY),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function createRemoteIssuer(binding, apiKey) {
+    async function post(path, body) {
+        const response = await fetchNativeNoRedirect(binding.controlPlaneOrigin + "/api/v1/bouncer/native-http/" + path, {
+            method: "POST",
+            signal: AbortSignal.timeout(5000),
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: "Bearer " + apiKey,
+            },
+            body: JSON.stringify(body),
+        });
+        if (![200, 201].includes(response.status) ||
+            !response.headers.get("content-type")?.startsWith("application/json") ||
+            !/\bno-store\b/.test(response.headers.get("cache-control") ?? ""))
+            return fail();
+        const reader = response.body?.getReader();
+        if (!reader)
+            return fail();
+        const chunks = [];
+        let length = 0;
+        try {
+            for (;;) {
+                const item = await reader.read();
+                if (item.done)
+                    break;
+                length += item.value.length;
+                if (length > 128 * 1024) {
+                    // Cleanup must not postpone rejection if the upstream cancel hook stalls.
+                    void reader.cancel().catch(() => { });
+                    return fail();
+                }
+                chunks.push(item.value);
+            }
+        }
+        finally {
+            reader.releaseLock();
+        }
+        const data = new Uint8Array(length);
+        let offset = 0;
+        for (const chunk of chunks) {
+            data.set(chunk, offset);
+            offset += chunk.length;
+        }
+        const result = JSON.parse(new TextDecoder().decode(data));
+        if (result?.success !== true || !result.data)
+            return fail();
+        return result.data;
+    }
+    async function verifySignedClaims(compact, profile = "credential") {
+        if (typeof compact !== "string" || compact.length > 128 * 1024)
+            return fail();
+        const [headerPart, payloadPart, signaturePart, extra] = compact.split(".");
+        if (!headerPart || !payloadPart || !signaturePart || extra !== undefined)
+            return fail();
+        const header = JSON.parse(new TextDecoder().decode(bytes(headerPart)));
+        if (header.alg !== "EdDSA" ||
+            (profile === "propagation"
+                ? header.typ !== "kya-http-propagation+jwt"
+                : header.typ !== "JWT" &&
+                    !(profile === "challenge" && header.typ === undefined)) ||
+            header.crit ||
+            header.b64 !== undefined ||
+            ![
+                binding.issuerDid + "#key-1",
+                binding.issuerDid + "#key-1-jwk",
+            ].includes(header.kid))
+            return fail();
+        const key = await crypto.subtle.importKey("raw", bytes(binding.issuerPublicKey), "Ed25519", false, ["verify"]);
+        if (!(await crypto.subtle.verify("Ed25519", key, bytes(signaturePart), encoder.encode(headerPart + "." + payloadPart))))
+            return fail();
+        const payload = JSON.parse(new TextDecoder().decode(bytes(payloadPart)));
+        if (payload.iss !== binding.issuerDid)
+            return fail();
+        return { ...payload, protectedKid: header.kid };
+    }
+    return {
+        async propagationProof(delegationId) {
+            if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(delegationId))
+                return fail();
+            const data = await post("propagation-proof", {
+                delegation_id: delegationId,
+            });
+            const claims = await verifySignedClaims(data.proof, "propagation");
+            const now = Math.floor(Date.now() / 1000);
+            let authority;
+            try {
+                authority = new URL("https://" + claims.aud);
+            }
+            catch {
+                return fail();
+            }
+            if (claims.profile !== "kya-http-propagation/1" ||
+                claims.delegation_id !== delegationId ||
+                typeof claims.sub !== "string" ||
+                !/^did:[^\s#]+$/.test(claims.sub) ||
+                typeof claims.aud !== "string" ||
+                authority.host !== claims.aud ||
+                authority.pathname !== "/" ||
+                authority.username ||
+                authority.password ||
+                authority.search ||
+                authority.hash ||
+                !Number.isSafeInteger(claims.iat) ||
+                !Number.isSafeInteger(claims.exp) ||
+                claims.iat > now + 30 ||
+                claims.exp <= now ||
+                claims.exp < claims.iat ||
+                claims.exp - claims.iat > 60 ||
+                data.expires_at !== claims.exp)
+                return fail();
+            return { proof: data.proof, expires_at: claims.exp };
+        },
+        async registerChallenge(registration, expected, audience) {
+            const data = await post("challenge", { registration });
+            const challenge = data.challenge;
+            if (data.session_id !== expected.sid ||
+                data.registered !== true ||
+                !challenge ||
+                !equal(challenge.http, expected) ||
+                challenge.consent_uri !== expected.consent_uri ||
+                !equal(challenge.required_scopes, expected.required_scopes) ||
+                !Number.isSafeInteger(challenge.issued_at) ||
+                challenge.issued_at > Date.now() + 30_000 ||
+                challenge.issued_at < Date.now() - 600_000)
+                return fail();
+            const proof = challenge.challenge_proof;
+            const claims = await verifySignedClaims(proof?.jws, "challenge");
+            const meta = proof.meta;
+            if (!meta ||
+                meta.did !== binding.issuerDid ||
+                meta.kid !== claims.protectedKid ||
+                meta.audience !== audience ||
+                meta.sessionId !== expected.sid ||
+                meta.outcome !== "needs_authorization" ||
+                !Number.isSafeInteger(meta.ts) ||
+                meta.ts * 1000 > Date.now() + 30_000 ||
+                meta.ts * 1000 < Date.now() - 600_000 ||
+                typeof meta.nonce !== "string" ||
+                meta.nonce.length < 16 ||
+                claims.aud !== audience ||
+                claims.sub !== binding.issuerDid ||
+                meta.responseHash !==
+                    (await digest([{ type: "text", text: canonicalize(expected) }])) ||
+                meta.requestHash !==
+                    (await digest({
+                        method: "authorization/challenge_proof",
+                        params: { sid: expected.sid },
+                    })))
+                return fail();
+            for (const name of [
+                "requestHash",
+                "responseHash",
+                "ts",
+                "nonce",
+                "sessionId",
+                "outcome",
+            ])
+                if (claims[name] !== meta[name])
+                    return fail();
+            for (const name of ["did", "kid", "audience"])
+                if (claims[name] !== undefined &&
+                    claims[name] !== meta[name])
+                    return fail();
+            return { proof, issuedAtMs: challenge.issued_at };
+        },
+        async issueDelegation(input) {
+            const data = await post("delegation", input);
+            if (data.status !== "ready" || data.token_type !== "Bearer")
+                return fail();
+            const claims = await verifySignedClaims(data.delegation);
+            const holder = await nativeHolderBinding(input.holder_keyid);
+            const delegation = claims.vc?.credentialSubject?.delegation;
+            const status = claims.vc?.credentialStatus;
+            const now = Math.floor(Date.now() / 1000);
+            const [, , host, , slug] = binding.issuerDid.split(":");
+            const statusUrl = "https://" + host + "/orgs/" + slug + "/delegation-status-list";
+            if (claims.sub !== holder.did ||
+                claims.vc?.credentialSubject?.id !== holder.did ||
+                claims.cnf?.jkt !== holder.jkt ||
+                claims.vc?.issuer !== binding.issuerDid ||
+                claims.aud !== input.audience ||
+                delegation?.constraints?.audience !== input.audience ||
+                delegation?.userDid !== input.user_did ||
+                claims.sid !== input.session_id ||
+                claims.assurance !== "key-bound" ||
+                !equal(claims.policy_revision, {
+                    policy_id: input.policy_id,
+                    composed_blob_hash: input.composed_blob_hash,
+                }) ||
+                !equal(claims.scope, input.required_scopes) ||
+                !equal(delegation.scopes, input.required_scopes) ||
+                !equal(delegation.constraints.scopes, input.required_scopes) ||
+                !equal(claims.amr, input.amr) ||
+                !Number.isSafeInteger(claims.exp) ||
+                !Number.isSafeInteger(claims.iat) ||
+                claims.exp <= now ||
+                claims.iat > now + 30 ||
+                claims.exp - claims.iat > 3600 ||
+                claims.exp <= claims.iat ||
+                (claims.nbf !== undefined &&
+                    (!Number.isSafeInteger(claims.nbf) || claims.nbf > now + 30)) ||
+                !status ||
+                status.type !== "StatusList2021Entry" ||
+                status.statusPurpose !== "revocation" ||
+                status.statusListCredential !== statusUrl ||
+                !/^(0|[1-9][0-9]*)$/.test(status.statusListIndex) ||
+                Number(status.statusListIndex) >= 131072 ||
+                status.id !== statusUrl + "#" + status.statusListIndex ||
+                !equal(claims.credentialStatus, status))
+                return fail();
+            return {
+                vcJwt: data.delegation,
+                subjectDid: holder.did,
+                expiresAtUnix: claims.exp,
+            };
+        },
+    };
+}
+//# sourceMappingURL=remote-issuer.js.map

package/dist/delegation-http/remote-issuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-issuer.js","sourceRoot":"","sources":["../../src/delegation-http/remote-issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EACL,mBAAmB,GAGpB,MAAM,eAAe,CAAC;AA0CvB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,IAAI,GAAG,GAAG,EAAE;IAChB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;AAC1D,CAAC,CAAC;AACF,SAAS,KAAK,CAAC,CAAU,EAAE,CAAU;IACnC,OAAO,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AACD,SAAS,KAAK,CAAC,OAAe;IAC5B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAClE,OAAO,IAAI,EAAE,CAAC;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAChE,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AACD,KAAK,UAAU,MAAM,CAAC,KAAc;IAClC,MAAM,IAAI,GAAG,IAAI,UAAU,CACzB,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAC3E,CAAC;IACF,OAAO,CACL,SAAS;QACT,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CACrE,CAAC;AACJ,CAAC;AACD,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,GAAG,CAAC,IAAI;YACT,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,QAAQ;YACb,GAAG,CAAC,MAAM,KAAK,KAAK,CACrB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAA4B;IAE5B,IACE,OAAO,GAAG,CAAC,8BAA8B,KAAK,QAAQ;QACtD,OAAO,GAAG,CAAC,+BAA+B,KAAK,QAAQ;QAEvD,OAAO,IAAI,CAAC;IACd,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,GAAG,CAAC,8BAA8B,CACjB,CAAC;QACpB,IACE,CAAC,OAAO;YACR,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;YACjC,OAAO,CAAC,OAAO,KAAK,CAAC;YACrB,CAAC,iEAAiE,CAAC,IAAI,CACrE,OAAO,CAAC,SAAS,CAClB;YACD,CAAC,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YACpE,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,EAAE;YAC5C,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC;YACtC,CAAC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACrC,CAAC,GAAG,CAAC,+BAA+B;YACpC,GAAG,CAAC,+BAA+B,KAAK,GAAG,CAAC,mBAAmB;YAC/D,CAAC,GAAG,CAAC,kBAAkB,KAAK,SAAS;gBACnC,GAAG,CAAC,kBAAkB,KAAK,GAAG,CAAC,+BAA+B,CAAC;YAEjE,OAAO,IAAI,CAAC;QACd,OAAO;YACL,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,YAAY,EAAE,kBAAkB,CAC9B,OAAO,EACP,GAAG,CAAC,+BAA+B,CACpC;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAuB,EACvB,MAAc;IAEd,KAAK,UAAU,IAAI,CACjB,IAAsD,EACtD,IAAa;QAEb,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAC1C,OAAO,CAAC,kBAAkB,GAAG,8BAA8B,GAAG,IAAI,EAClE;YACE,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,SAAS,GAAG,MAAM;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CACF,CAAC;QACF,IACE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YACrC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC,kBAAkB,CAAC;YACrE,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YAEjE,OAAO,IAAI,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,CAAC;YACH,SAAS,CAAC;gBACR,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjC,IAAI,IAAI,CAAC,IAAI;oBAAE,MAAM;gBACrB,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC5B,IAAI,MAAM,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;oBACxB,0EAA0E;oBAC1E,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBACrC,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;QACzB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1D,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,OAAO,IAAI,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,kBAAkB,CAC/B,OAAe,EACf,UAAsD,YAAY;QAElE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI;YAC5D,OAAO,IAAI,EAAE,CAAC;QAChB,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3E,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,IAAI,KAAK,KAAK,SAAS;YACtE,OAAO,IAAI,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACvE,IACE,MAAM,CAAC,GAAG,KAAK,OAAO;YACtB,CAAC,OAAO,KAAK,aAAa;gBACxB,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,0BAA0B;gBAC3C,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK;oBACpB,CAAC,CAAC,OAAO,KAAK,WAAW,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;YAC3D,MAAM,CAAC,IAAI;YACX,MAAM,CAAC,GAAG,KAAK,SAAS;YACxB,CAAC;gBACC,OAAO,CAAC,SAAS,GAAG,QAAQ;gBAC5B,OAAO,CAAC,SAAS,GAAG,YAAY;aACjC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;YAEtB,OAAO,IAAI,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,KAAK,CAAC,OAAO,CAAC,eAAe,CAAiB,EAC9C,SAAS,EACT,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IACE,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC1B,SAAS,EACT,GAAG,EACH,KAAK,CAAC,aAAa,CAAiB,EACpC,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG,GAAG,GAAG,WAAW,CAAC,CAC/C,CAAC;YAEF,OAAO,IAAI,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,SAAS;YAAE,OAAO,IAAI,EAAE,CAAC;QACrD,OAAO,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IAClD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,gBAAgB,CAAC,YAAY;YACjC,IACE,CAAC,iEAAiE,CAAC,IAAI,CACrE,YAAY,CACb;gBAED,OAAO,IAAI,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE;gBAC3C,aAAa,EAAE,YAAY;aAC5B,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YACnE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,IAAI,SAAc,CAAC;YACnB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,IACE,MAAM,CAAC,OAAO,KAAK,wBAAwB;gBAC3C,MAAM,CAAC,aAAa,KAAK,YAAY;gBACrC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;gBAC9B,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBACjC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;gBAC9B,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,GAAG;gBAC7B,SAAS,CAAC,QAAQ,KAAK,GAAG;gBAC1B,SAAS,CAAC,QAAQ;gBAClB,SAAS,CAAC,QAAQ;gBAClB,SAAS,CAAC,MAAM;gBAChB,SAAS,CAAC,IAAI;gBACd,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC;gBACjC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC;gBACjC,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE;gBACrB,MAAM,CAAC,GAAG,IAAI,GAAG;gBACjB,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG;gBACvB,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,EAAE;gBAC5B,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,GAAG;gBAE9B,OAAO,IAAI,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QACvD,CAAC;QACD,KAAK,CAAC,iBAAiB,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ;YACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,IACE,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,GAAG;gBAChC,IAAI,CAAC,UAAU,KAAK,IAAI;gBACxB,CAAC,SAAS;gBACV,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAChC,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;gBAC9C,CAAC,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,QAAQ,CAAC,eAAe,CAAC;gBAC3D,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC;gBAC1C,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;gBACzC,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAE1C,OAAO,IAAI,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,SAAS,CAAC,eAAgC,CAAC;YACzD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;YACjE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YACxB,IACE,CAAC,IAAI;gBACL,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,SAAS;gBAC9B,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,YAAY;gBAChC,IAAI,CAAC,QAAQ,KAAK,QAAQ;gBAC1B,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,GAAG;gBAC/B,IAAI,CAAC,OAAO,KAAK,qBAAqB;gBACtC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,IAAI,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;gBACpC,IAAI,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBACrC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAC9B,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE;gBACtB,MAAM,CAAC,GAAG,KAAK,QAAQ;gBACvB,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,SAAS;gBAChC,IAAI,CAAC,YAAY;oBACf,CAAC,MAAM,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;gBAClE,IAAI,CAAC,WAAW;oBACd,CAAC,MAAM,MAAM,CAAC;wBACZ,MAAM,EAAE,+BAA+B;wBACvC,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE;qBAC9B,CAAC,CAAC;gBAEL,OAAO,IAAI,EAAE,CAAC;YAChB,KAAK,MAAM,IAAI,IAAI;gBACjB,aAAa;gBACb,cAAc;gBACd,IAAI;gBACJ,OAAO;gBACP,WAAW;gBACX,SAAS;aACV;gBACC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAM,IAA2C,CAAC,IAAI,CAAC;oBACrE,OAAO,IAAI,EAAE,CAAC;YAClB,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC;gBAC3C,IACE,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS;oBAC1B,MAAM,CAAC,IAAI,CAAC,KAAM,IAA2C,CAAC,IAAI,CAAC;oBAEnE,OAAO,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC;QACpD,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,KAAK;YACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ;gBACzD,OAAO,IAAI,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,EAAE,iBAAiB,EAAE,UAAU,CAAC;YAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,EAAE,gBAAgB,CAAC;YAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,MAAM,CAAC,EAAE,AAAD,EAAG,IAAI,EAAE,AAAD,EAAG,IAAI,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxD,MAAM,SAAS,GACb,UAAU,GAAG,IAAI,GAAG,QAAQ,GAAG,IAAI,GAAG,yBAAyB,CAAC;YAClE,IACE,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;gBACzB,MAAM,CAAC,EAAE,EAAE,iBAAiB,EAAE,EAAE,KAAK,MAAM,CAAC,GAAG;gBAC/C,MAAM,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,GAAG;gBAC9B,MAAM,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS;gBACvC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,QAAQ;gBAC7B,UAAU,EAAE,WAAW,EAAE,QAAQ,KAAK,KAAK,CAAC,QAAQ;gBACpD,UAAU,EAAE,OAAO,KAAK,KAAK,CAAC,QAAQ;gBACtC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,UAAU;gBAC/B,MAAM,CAAC,SAAS,KAAK,WAAW;gBAChC,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE;oBAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;iBAC7C,CAAC;gBACF,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,eAAe,CAAC;gBAC3C,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,eAAe,CAAC;gBAChD,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,eAAe,CAAC;gBAC5D,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;gBAC7B,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC;gBACjC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC;gBACjC,MAAM,CAAC,GAAG,IAAI,GAAG;gBACjB,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE;gBACrB,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI;gBAC9B,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG;gBACxB,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS;oBACvB,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC;gBAC/D,CAAC,MAAM;gBACP,MAAM,CAAC,IAAI,KAAK,qBAAqB;gBACrC,MAAM,CAAC,aAAa,KAAK,YAAY;gBACrC,MAAM,CAAC,oBAAoB,KAAK,SAAS;gBACzC,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;gBACjD,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,MAAM;gBACxC,MAAM,CAAC,EAAE,KAAK,SAAS,GAAG,GAAG,GAAG,MAAM,CAAC,eAAe;gBACtD,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC;gBAEvC,OAAO,IAAI,EAAE,CAAC;YAChB,OAAO;gBACL,KAAK,EAAE,IAAI,CAAC,UAAU;gBACtB,UAAU,EAAE,MAAM,CAAC,GAAG;gBACtB,aAAa,EAAE,MAAM,CAAC,GAAG;aAC1B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/delegation-http/sid.d.ts

@@ -13,8 +13,11 @@
  */
 export declare function generateSid(): string;
 /**
- * Type guard for anchor sids. Accepts the generated 32-hex form and the 16–64 hex
- * range used by the golden fixtures.
+ * Validate anchor ID syntax, including externally registered opaque HTTP IDs.
+ * Syntax alone cannot select the anchor route: legacy UUID session IDs also
+ * pass this guard. Use it only for an explicit anchor field or dedicated route.
  */
 export declare function isAnchorSid(s: string | null | undefined): s is string;
+/** Recognize the original anchor namespace in a generic legacy session_id. */
+export declare function isNamespacedAnchorSid(s: unknown): s is string;
 //# sourceMappingURL=sid.d.ts.map

package/dist/delegation-http/sid.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sid.d.ts","sourceRoot":"","sources":["../../src/delegation-http/sid.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH;;;GAGG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAQpC;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,IAAI,MAAM,CAErE"}
+{"version":3,"file":"sid.d.ts","sourceRoot":"","sources":["../../src/delegation-http/sid.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH;;;GAGG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAQpC;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,IAAI,MAAM,CAKrE;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAE7D"}

package/dist/delegation-http/sid.js

@@ -23,10 +23,16 @@ export function generateSid() {
     return `kya-${hex}`;
 }
 /**
- * Type guard for anchor sids. Accepts the generated 32-hex form and the 16–64 hex
- * range used by the golden fixtures.
+ * Validate anchor ID syntax, including externally registered opaque HTTP IDs.
+ * Syntax alone cannot select the anchor route: legacy UUID session IDs also
+ * pass this guard. Use it only for an explicit anchor field or dedicated route.
  */
 export function isAnchorSid(s) {
+    return (isNamespacedAnchorSid(s) ||
+        (typeof s === "string" && /^[A-Za-z0-9._~-]{22,255}$/.test(s)));
+}
+/** Recognize the original anchor namespace in a generic legacy session_id. */
+export function isNamespacedAnchorSid(s) {
     return typeof s === "string" && ANCHOR_SID_RE.test(s);
 }
 //# sourceMappingURL=sid.js.map

package/dist/delegation-http/sid.js.map

@@ -1 +1 @@
-{"version":3,"file":"sid.js","sourceRoot":"","sources":["../../src/delegation-http/sid.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,sFAAsF;AACtF,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAE9C;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,GAAG,EAAE,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,CAA4B;IACtD,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"sid.js","sourceRoot":"","sources":["../../src/delegation-http/sid.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,sFAAsF;AACtF,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAE9C;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,GAAG,EAAE,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,CAA4B;IACtD,OAAO,CACL,qBAAqB,CAAC,CAAC,CAAC;QACxB,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,CAAU;IAC9C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/delegation-http/types.d.ts

@@ -21,6 +21,8 @@ export interface AnchorPin {
     valueSha256: string;
     pinnedAt: number;
     source: "challenge" | "first-poll";
+    /** Verified public key identifier for native issuance, never a bearer token. */
+    keyId?: string;
 }
 /**
  * The full anchor record persisted in `ctx.storage`. All timestamps are epoch ms.
@@ -59,8 +61,17 @@ export interface PickupAnchorRecord {
         vcJwt: string;
         expiresInS: number;
         approvedAt: number;
+        /** Exact signed JWT exp for native grants; absent on legacy records. */
+        expiresAtUnix?: number;
     };
     lastPollAt?: number;
+    nativeHttp?: import("./native-http").NativeHttpChallenge;
+    nativeRegistration?: import("./native-http").NativeHttpRegistration;
+    nativeIssuerDid?: string;
+    nativePolicyRevision?: {
+        policyId?: string;
+        composedPolicyHash?: string;
+    };
 }
 /**
  * Inputs for building a §8.1 delegation challenge. Camel-case mirror of the golden
@@ -73,6 +84,24 @@ export interface ChallengeVerdictInput {
     realm: string;
     sid: string;
     pollIntervalS: number;
+    /**
+     * The pickup profile the AUTHORIZATION HOST actually supports, which gates
+     * the `instructions` choreography:
+     *
+     *  - absent (default): token-first instructions only. This runtime's pickup
+     *    surface treats a Signature-Input-only poll as a no-identity poll
+     *    (pickup-poll-identity: the token path stands), and its consent mint
+     *    does not `cnf`-bind the delegation to a pickup key — so directing an
+     *    agent to sign polls or to sign retries with the pickup key dead-ends:
+     *    the signed poll never establishes a binding, and a signed retry of a
+     *    non-holder-bound VC is refused (`kyaos/holder-mismatch`).
+     *  - `"kya-http/2"`: retained compatibility opt-in for the reviewed
+     *    binding-first legacy envelope on a host with signed pickup support.
+     *    This hint neither registers a native anchor nor makes a credential
+     *    holder-bound. Strict native emission uses NativeHttpChallenge and
+     *    native-http.ts, including the full signed action and bound-key retry.
+     */
+    pickupProfile?: "kya-http/2";
 }
 /**
  * A pickup poll holder, as presented on the wire. The raw `value` is hashed inside
@@ -81,5 +110,7 @@ export interface ChallengeVerdictInput {
 export interface PickupHolder {
     type: "token" | "keyid";
     value: string;
+    /** Set only by the verified native request/replay admission path. */
+    nativeVerified?: true;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/delegation-http/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/delegation-http/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE7D;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,GAAG,YAAY,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kHAAkH;IAClH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACf"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/delegation-http/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE7D;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,GAAG,YAAY,CAAC;IACnC,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kHAAkH;IAClH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,wEAAwE;QACxE,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,eAAe,EAAE,mBAAmB,CAAC;IACzD,kBAAkB,CAAC,EAAE,OAAO,eAAe,EAAE,sBAAsB,CAAC;IACpE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,cAAc,CAAC,EAAE,IAAI,CAAC;CACvB"}

package/dist/delegation-http/well-known-capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"well-known-capability.d.ts","sourceRoot":"","sources":["../../src/delegation-http/well-known-capability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAOlE;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EAClD,GAAG,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GAAG,IAAI,EACzC,kBAAkB,EAAE,OAAO,EAC3B,cAAc,CAAC,EAAE,uBAAuB,GACvC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,CAc5C"}
+{"version":3,"file":"well-known-capability.d.ts","sourceRoot":"","sources":["../../src/delegation-http/well-known-capability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAOlE;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EAClD,GAAG,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GAAG,IAAI,EACzC,kBAAkB,EAAE,OAAO,EAC3B,cAAc,CAAC,EAAE,uBAAuB,GACvC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,CAmB5C"}