@kya-os/mcp-i-cloudflare 1.14.1 → 1.14.2

package/dist/security/mcp-holder-admission.js

@@ -0,0 +1,52 @@
+import { KYA_OS_CARD_PROOF_META_KEY, requireProof, } from "@kya-os/mcp/card";
+import { hasMcpRequestProof } from "./presented-delegation";
+function deny(code) {
+    return {
+        allowed: false,
+        result: {
+            isError: true,
+            content: [{ type: "text", text: JSON.stringify({ error: code }) }],
+        },
+    };
+}
+/**
+ * Authenticate the live invoker before the existing consent/delegation gate.
+ * This grants no authority: the runtime must still verify the grant, account,
+ * provider and scopes. Invalid native proofs never fall back to an executor.
+ */
+export function createMcpHolderAdmission(options) {
+    return async (request, context) => {
+        try {
+            const { _meta, ...params } = request.params ?? {};
+            if (request.method !== "tools/call" || typeof params.name !== "string")
+                return deny("invalid_request");
+            const mode = await options.modeForTool(params.name);
+            if (!["native", "runtime-executor", "public"].includes(mode))
+                return deny("policy_unavailable");
+            if (mode === "native" || hasMcpRequestProof(_meta)) {
+                // The canonical carrier wins even when null/malformed. Published core
+                // 1.15 uses nullish fallback; do not let a legacy proof replace an
+                // explicitly empty canonical proof on this required admission path.
+                if (_meta &&
+                    Object.prototype.hasOwnProperty.call(_meta, KYA_OS_CARD_PROOF_META_KEY) &&
+                    _meta[KYA_OS_CARD_PROOF_META_KEY] == null)
+                    return deny("proof_missing");
+                const guard = requireProof(await options.proof(context));
+                const proof = await guard({ method: request.method, params }, _meta);
+                return proof.ok
+                    ? { allowed: true, holder: { did: proof.did, level: proof.level } }
+                    : deny(proof.error.code);
+            }
+            if (mode === "runtime-executor") {
+                return (await options.authorizeExecutor?.(request, context)) === true
+                    ? { allowed: true }
+                    : deny("executor_not_authorized");
+            }
+            return { allowed: true };
+        }
+        catch {
+            return deny("authorization_unavailable");
+        }
+    };
+}
+//# sourceMappingURL=mcp-holder-admission.js.map

package/dist/security/mcp-holder-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-holder-admission.js","sourceRoot":"","sources":["../../src/security/mcp-holder-admission.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,YAAY,GAEb,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAuB5D,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE;YACN,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;SACnE;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAkC;IAElC,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAChC,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YAClD,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;gBACpE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,CAAC,CAAC,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC1D,OAAO,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACpC,IAAI,IAAI,KAAK,QAAQ,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnD,sEAAsE;gBACtE,mEAAmE;gBACnE,oEAAoE;gBACpE,IACE,KAAK;oBACL,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAClC,KAAK,EACL,0BAA0B,CAC3B;oBACD,KAAK,CAAC,0BAA0B,CAAC,IAAI,IAAI;oBAEzC,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBACzD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;gBACrE,OAAO,KAAK,CAAC,EAAE;oBACb,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE;oBACnE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YACD,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAChC,OAAO,CAAC,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI;oBACnE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;oBACnB,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/security/presented-delegation.d.ts

@@ -0,0 +1,13 @@
+import type { JSONRPCRequest } from "@modelcontextprotocol/sdk/types.js";
+/** Parsing identifies a credential carrier only. It establishes no authority. */
+export declare function decodeJwtPayload(jwt: string): Record<string, unknown> | null;
+export declare class InvalidDelegationPresentation extends Error {
+    constructor();
+}
+export declare function readHeaderDelegation(getHeader: (name: string) => string | null): string | undefined;
+/** Presence, including malformed values, must never select an unsigned lane. */
+export declare function hasMcpRequestProof(meta: unknown): boolean;
+/** Keep the original request intact; handlers consume this unverified token
+ * out of band and still require the existing delegation verifier to accept it. */
+export declare function readPresentedMcpDelegation(request: JSONRPCRequest, headers?: Record<string, string | string[] | undefined>): string | undefined;
+//# sourceMappingURL=presented-delegation.d.ts.map

package/dist/security/presented-delegation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presented-delegation.d.ts","sourceRoot":"","sources":["../../src/security/presented-delegation.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAIzE,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAc5E;AAED,qBAAa,6BAA8B,SAAQ,KAAK;;CAIvD;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GACzC,MAAM,GAAG,SAAS,CAiBpB;AAED,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAQzD;AAED;kFACkF;AAClF,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAM,GAC1D,MAAM,GAAG,SAAS,CA4BpB"}

package/dist/security/presented-delegation.js

@@ -0,0 +1,73 @@
+import { KYA_OS_CARD_PROOF_META_KEY, LEGACY_CARD_PROOF_META_KEY, } from "@kya-os/mcp/card";
+import { FALLBACK_DELEGATION_HEADER } from "../delegation-http/constants";
+/** Parsing identifies a credential carrier only. It establishes no authority. */
+export function decodeJwtPayload(jwt) {
+    const parts = jwt.split(".");
+    if (parts.length !== 3)
+        return null;
+    try {
+        const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+        const payload = JSON.parse(atob(b64 + "=".repeat((4 - (b64.length % 4)) % 4)));
+        return payload && typeof payload === "object" && !Array.isArray(payload)
+            ? payload
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+export class InvalidDelegationPresentation extends Error {
+    constructor() {
+        super("Invalid or conflicting delegation carriers");
+    }
+}
+export function readHeaderDelegation(getHeader) {
+    const auth = getHeader("Authorization");
+    const bearer = auth
+        ? /^Bearer\s+(.+)$/i.exec(auth.trim())?.[1].trim()
+        : undefined;
+    const bearerPayload = bearer ? decodeJwtPayload(bearer) : null;
+    const credential = bearerPayload && "vc" in bearerPayload ? bearer : undefined;
+    const fallback = getHeader(FALLBACK_DELEGATION_HEADER);
+    if (fallback !== null) {
+        const token = fallback.trim();
+        const payload = decodeJwtPayload(token);
+        if (!payload || !("vc" in payload) || (credential && credential !== token))
+            throw new InvalidDelegationPresentation();
+        return token;
+    }
+    return credential;
+}
+/** Presence, including malformed values, must never select an unsigned lane. */
+export function hasMcpRequestProof(meta) {
+    return (meta !== null &&
+        typeof meta === "object" &&
+        [KYA_OS_CARD_PROOF_META_KEY, LEGACY_CARD_PROOF_META_KEY].some((key) => Object.prototype.hasOwnProperty.call(meta, key)));
+}
+/** Keep the original request intact; handlers consume this unverified token
+ * out of band and still require the existing delegation verifier to accept it. */
+export function readPresentedMcpDelegation(request, headers = {}) {
+    const headerToken = readHeaderDelegation((name) => {
+        const matches = Object.entries(headers).filter(([key, value]) => key.toLowerCase() === name.toLowerCase() && value !== undefined);
+        if (matches.length > 1)
+            throw new InvalidDelegationPresentation();
+        const value = matches[0]?.[1];
+        if (Array.isArray(value)) {
+            if (value.length !== 1)
+                throw new InvalidDelegationPresentation();
+            return value[0];
+        }
+        return value ?? null;
+    });
+    const params = request.params;
+    if (!params ||
+        !Object.prototype.hasOwnProperty.call(params, "delegationToken"))
+        return headerToken;
+    const bodyToken = params.delegationToken;
+    if (typeof bodyToken !== "string" ||
+        !bodyToken.trim() ||
+        (headerToken !== undefined && bodyToken !== headerToken))
+        throw new InvalidDelegationPresentation();
+    return bodyToken;
+}
+//# sourceMappingURL=presented-delegation.js.map

package/dist/security/presented-delegation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presented-delegation.js","sourceRoot":"","sources":["../../src/security/presented-delegation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAE1E,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CACjC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CACnD,CAAC;QACF,OAAO,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACtE,CAAC,CAAE,OAAmC;YACtC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD;QACE,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACtD,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAClC,SAA0C;IAE1C,MAAM,IAAI,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI;QACjB,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAClD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,UAAU,GACd,aAAa,IAAI,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,MAAM,QAAQ,GAAG,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,KAAK,CAAC;YACxE,MAAM,IAAI,6BAA6B,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,OAAO,CACL,IAAI,KAAK,IAAI;QACb,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAC,0BAA0B,EAAE,0BAA0B,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACpE,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAChD,CACF,CAAC;AACJ,CAAC;AAED;kFACkF;AAClF,MAAM,UAAU,0BAA0B,CACxC,OAAuB,EACvB,UAAyD,EAAE;IAE3D,MAAM,WAAW,GAAG,oBAAoB,CAAC,CAAC,IAAI,EAAE,EAAE;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAC5C,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,IAAI,KAAK,KAAK,SAAS,CAClE,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,6BAA6B,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,6BAA6B,EAAE,CAAC;YAClE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,KAAK,IAAI,IAAI,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IACE,CAAC,MAAM;QACP,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC;QAEhE,OAAO,WAAW,CAAC;IACrB,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;IACzC,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,SAAS,CAAC,IAAI,EAAE;QACjB,CAAC,WAAW,KAAK,SAAS,IAAI,SAAS,KAAK,WAAW,CAAC;QAExD,MAAM,IAAI,6BAA6B,EAAE,CAAC;IAC5C,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/services/consent.service.d.ts

@@ -650,6 +650,7 @@ export declare class ConsentService {
         tool: string;
         scopes: string[];
         projectId: string;
+        binding?: string;
     }): Promise<string>;
     /**
      * Verify a grant-bound identity assertion minted by `mintIdentityAssertion`.
@@ -669,6 +670,15 @@ export declare class ConsentService {
      * bypass belongs at the call site (see `isDevConsentTestMode`'s
      * docstring), never as a predictable/empty signing key inside this helper.
      */
+    verifyNativeIdentityAssertion(token: string, expected: {
+        sid: string;
+        agentDid: string;
+        tool: string;
+        scopes: string[];
+        projectId: string;
+        provider: string;
+        binding: string;
+    }): Promise<string | null>;
     private verifyIdentityAssertion;
     /**
      * Build full DelegationRecord format request (future format)

package/dist/services/consent.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consent.service.d.ts","sourceRoot":"","sources":["../../src/services/consent.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAkBpD,OAAO,KAAK,EAIV,aAAa,EACd,MAAM,2BAA2B,CAAC;AAYnC,OAAO,EAYL,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;AA6D/B,qBAAa,cAAc;IACzB,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,GAAG,CAAgB;IAC3B,OAAO,CAAC,OAAO,CAAC,CAAoB;IACpC,OAAO,CAAC,cAAc,CAAC,CAAiB;IAGxC,OAAO,CAAC,YAAY,CAAC,CAAsB;IAC3C,OAAO,CAAC,gBAAgB,CAAC,CAAgB;IAGzC,OAAO,CAAC,gBAAgB,CAAC,CAAmD;IAC5E,OAAO,CAAC,gBAAgB,CAAC,CAAwD;IAEjF;;;OAGG;gBAED,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,iBAAiB,EAC3B,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,EAAE,gBAAgB,EACnE,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,EAAE,qBAAqB;IAW1E;;;;;;;OAOG;YACW,eAAe;IAmC7B;;;;;;;OAOG;IACG,mBAAmB,CAAC,KAAK,EAAE;QAC/B,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KACzD,GAAG,OAAO,CAAC,IAAI,CAAC;IAMX,kBAAkB,CAAC,KAAK,EAAE;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjB;;;;;;;;;;;;OAYG;IACG,uBAAuB,CAC3B,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QAEjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,EACD,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC;IAYnB;;;;;OAKG;YACW,sBAAsB;IAwCpC;;;;;;;;;;OAUG;YACW,sBAAsB;IAqEpC;;;;;;;;;;;;;;OAcG;IACU,oBAAoB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkFzB;;;;;;;;;;;OAWG;YACW,iCAAiC;IA0D/C;;;;;;;;;OASG;IACU,yBAAyB,CACpC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,IAAI,CAAC;IAuIhB;;;;;;;;;OASG;IACU,oBAAoB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAsE9B;;;;;;;;;;;;;;OAcG;IACU,yBAAyB,CACpC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IA0F9B;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IAInC;;;;;;;;;;;;;OAaG;IACU,kCAAkC,CAC7C,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAmGzB;;;;;;;;;;;;;OAaG;IACU,iBAAiB,CAC5B,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,EACpC,eAAe,CAAC,EAAE,WAAW,GAAG,IAAI,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA4DzB;;;;;;;;;;;;;;;;OAgBG;IACU,kBAAkB,CAC7B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QACR,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GACA,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC;IAwJjD;;;;;;;;;;;;OAYG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,EAC7B,iBAAiB,CAAC,EAAE,MAAM,EAC1B,cAAc,CAAC,EAAE,OAAO,mCAAmC,EAAE,cAAc,GAC1E,OAAO,CAAC,OAAO,CAAC;IA+HnB;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EAAE,EAChB,SAAS,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,6DAA6D;IAChF,oBAAoB,CAAC,EAAE,OAAO,0BAA0B,EAAE,oBAAoB,EAC9E,SAAS,CAAC,EAAE,MAAM,EAAE,sDAAsD;IAC1E,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC;IA6QlB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IAuB3B;;;;;;;;;;;OAWG;IACG,kBAAkB,CACtB,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC;IAyElB;;;;;;;;;;OAUG;IACG,oBAAoB,CACxB,aAAa,EAAE,aAAa,EAC5B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAgFhB;;;;;;;;;;OAUG;IACG,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAqCjD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kBAAkB;IAkB1B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,8BAA8B;IAYtC;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAetB;;;;;;;;;;;;;OAaG;YACW,iBAAiB;IA01B/B;;;;;;;;OAQG;YACW,gBAAgB;IA2lC9B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAO1B;;;;;;OAMG;IACH,OAAO,CAAC,iCAAiC;IAczC;;;;;;;;OAQG;YACW,cAAc;IA+kB5B;;;;;OAKG;YACW,gBAAgB;IA+T9B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAQ7B;;;;;;;;;OASG;YACW,oBAAoB;IAqElC;;;;;;;;;;;;;;;;;OAiBG;YACW,oBAAoB;IAiLlC;;;;;OAKG;YACW,iBAAiB;IAmC/B;;;;OAIG;YACW,sBAAsB;IA4FpC;;;;;;;;;OASG;YACW,wBAAwB;IAgiBtC;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IA2BnB;;;;;;;OAOG;YACW,2BAA2B;IAkGzC;;;;;;;;;OASG;IACH,OAAO,CAAC,2BAA2B;IA4GnC;;OAEG;YACW,yBAAyB;IAsDvC;;OAEG;YACW,oBAAoB;IAmDlC;;;;;;;;;;;OAWG;YACW,2BAA2B;IAyDzC;;;;;;;;;OASG;IACU,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkCzE;;;;;OAKG;YACW,eAAe;IAgB7B;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAI7B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAK7B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;;;;;;;;;;;;;;;;;;OAmBG;IACI,oBAAoB,IAAI,OAAO;IAYtC;;;;;;;;;;;;OAYG;YACW,UAAU;IAWxB;;;;;;;;OAQG;YACW,mBAAmB;IAgBjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACU,qBAAqB,CAAC,MAAM,EAAE;QACzC,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,MAAM,CAAC;IA6BnB;;;;;;;;;;;;;;;;;OAiBG;YACW,uBAAuB;IAoGrC;;OAEG;YACW,sBAAsB;IAmJpC;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IAMnB;;;;;;;;;OASG;IACH,OAAO,CAAC,4BAA4B;IAqLpC;;OAEG;YACW,UAAU;IAqDxB;;;;;OAKG;YACW,WAAW;IA0GzB;;OAEG;YACW,qBAAqB;CAsBpC"}
+{"version":3,"file":"consent.service.d.ts","sourceRoot":"","sources":["../../src/services/consent.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAepD,OAAO,KAAK,EAIV,aAAa,EACd,MAAM,2BAA2B,CAAC;AAYnC,OAAO,EAYL,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;AA6D/B,qBAAa,cAAc;IACzB,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,GAAG,CAAgB;IAC3B,OAAO,CAAC,OAAO,CAAC,CAAoB;IACpC,OAAO,CAAC,cAAc,CAAC,CAAiB;IAGxC,OAAO,CAAC,YAAY,CAAC,CAAsB;IAC3C,OAAO,CAAC,gBAAgB,CAAC,CAAgB;IAGzC,OAAO,CAAC,gBAAgB,CAAC,CAAmD;IAC5E,OAAO,CAAC,gBAAgB,CAAC,CAAwD;IAEjF;;;OAGG;gBAED,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,iBAAiB,EAC3B,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,EAAE,gBAAgB,EACnE,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,EAAE,qBAAqB;IAW1E;;;;;;;OAOG;YACW,eAAe;IAmC7B;;;;;;;OAOG;IACG,mBAAmB,CAAC,KAAK,EAAE;QAC/B,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KACzD,GAAG,OAAO,CAAC,IAAI,CAAC;IAMX,kBAAkB,CAAC,KAAK,EAAE;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjB;;;;;;;;;;;;OAYG;IACG,uBAAuB,CAC3B,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QAEjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,EACD,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC;IAYnB;;;;;OAKG;YACW,sBAAsB;IAwCpC;;;;;;;;;;OAUG;YACW,sBAAsB;IAqEpC;;;;;;;;;;;;;;OAcG;IACU,oBAAoB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkFzB;;;;;;;;;;;OAWG;YACW,iCAAiC;IA0D/C;;;;;;;;;OASG;IACU,yBAAyB,CACpC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,IAAI,CAAC;IAuIhB;;;;;;;;;OASG;IACU,oBAAoB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAsE9B;;;;;;;;;;;;;;OAcG;IACU,yBAAyB,CACpC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IA0F9B;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IAInC;;;;;;;;;;;;;OAaG;IACU,kCAAkC,CAC7C,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAmGzB;;;;;;;;;;;;;OAaG;IACU,iBAAiB,CAC5B,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,EACpC,eAAe,CAAC,EAAE,WAAW,GAAG,IAAI,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA4DzB;;;;;;;;;;;;;;;;OAgBG;IACU,kBAAkB,CAC7B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QACR,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GACA,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC;IAwJjD;;;;;;;;;;;;OAYG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,EAC7B,iBAAiB,CAAC,EAAE,MAAM,EAC1B,cAAc,CAAC,EAAE,OAAO,mCAAmC,EAAE,cAAc,GAC1E,OAAO,CAAC,OAAO,CAAC;IA+HnB;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EAAE,EAChB,SAAS,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,6DAA6D;IAChF,oBAAoB,CAAC,EAAE,OAAO,0BAA0B,EAAE,oBAAoB,EAC9E,SAAS,CAAC,EAAE,MAAM,EAAE,sDAAsD;IAC1E,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC;IA6QlB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IAuB3B;;;;;;;;;;;OAWG;IACG,kBAAkB,CACtB,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC;IAyElB;;;;;;;;;;OAUG;IACG,oBAAoB,CACxB,aAAa,EAAE,aAAa,EAC5B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAgFhB;;;;;;;;;;OAUG;IACG,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAqCjD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kBAAkB;IAkB1B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,8BAA8B;IAYtC;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAetB;;;;;;;;;;;;;OAaG;YACW,iBAAiB;IA01B/B;;;;;;;;OAQG;YACW,gBAAgB;IA2lC9B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAO1B;;;;;;OAMG;IACH,OAAO,CAAC,iCAAiC;IAczC;;;;;;;;OAQG;YACW,cAAc;IA+kB5B;;;;;OAKG;YACW,gBAAgB;IA+T9B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAQ7B;;;;;;;;;OASG;YACW,oBAAoB;IAqElC;;;;;;;;;;;;;;;;;OAiBG;YACW,oBAAoB;IAiLlC;;;;;OAKG;YACW,iBAAiB;IAmC/B;;;;OAIG;YACW,sBAAsB;IA4FpC;;;;;;;;;OASG;YACW,wBAAwB;IAgiBtC;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IA2BnB;;;;;;;OAOG;YACW,2BAA2B;IAkGzC;;;;;;;;;OASG;IACH,OAAO,CAAC,2BAA2B;IA4GnC;;OAEG;YACW,yBAAyB;IAsDvC;;OAEG;YACW,oBAAoB;IAmDlC;;;;;;;;;;;OAWG;YACW,2BAA2B;IAyDzC;;;;;;;;;OASG;IACU,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkCzE;;;;;OAKG;YACW,eAAe;IAgB7B;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAI7B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAK7B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;;;;;;;;;;;;;;;;;;OAmBG;IACI,oBAAoB,IAAI,OAAO;IAYtC;;;;;;;;;;;;OAYG;YACW,UAAU;IAWxB;;;;;;;;OAQG;YACW,mBAAmB;IAgBjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACU,qBAAqB,CAAC,MAAM,EAAE;QACzC,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,MAAM,CAAC;IA8BnB;;;;;;;;;;;;;;;;;OAiBG;IACU,6BAA6B,CACxC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE;QACR,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;KACjB,GACA,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YAMX,uBAAuB;IAgHrC;;OAEG;YACW,sBAAsB;IAmJpC;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IAMnB;;;;;;;;;OASG;IACH,OAAO,CAAC,4BAA4B;IAqLpC;;OAEG;YACW,UAAU;IAqDxB;;;;;OAKG;YACW,WAAW;IA0GzB;;OAEG;YACW,qBAAqB;CAsBpC"}

package/dist/services/consent.service.js

@@ -9,7 +9,7 @@
 import { ConsentConfigService } from "./consent-config.service";
 import { TemplateRenderer } from "./consent-templates/template-renderer";
 import { DEFAULT_AGENTSHIELD_URL, DEFAULT_SESSION_CACHE_TTL, KEY_PAIR_TTL_SECONDS, CONSENT_PROVIDER_TYPES, } from "../constants";
-import { STORAGE_KEYS, isPendingDelegationId, } from "../constants/storage-keys";
+import { STORAGE_KEYS, isPendingDelegationId } from "../constants/storage-keys";
 import { loadDay0Config, getDelegationFieldName } from "../utils/day0-config";
 import { buildProviderAuthorizeUrl } from "../runtime/oidc/authorize-url.js";
 import { resolveIdpScopes } from "../runtime/oidc/idp-scopes.js";
@@ -5162,6 +5162,7 @@ export class ConsentService {
             tool: params.tool,
             scopesHash,
             projectId: params.projectId,
+            ...(params.binding ? { binding: params.binding } : {}),
             exp,
         });
         const payloadB64 = this.base64UrlEncodeString(payload);
@@ -5187,6 +5188,11 @@ export class ConsentService {
      * bypass belongs at the call site (see `isDevConsentTestMode`'s
      * docstring), never as a predictable/empty signing key inside this helper.
      */
+    async verifyNativeIdentityAssertion(token, expected) {
+        if (!expected.provider || !expected.binding || token.length > 16384)
+            return null;
+        return this.verifyIdentityAssertion(token, expected);
+    }
     async verifyIdentityAssertion(token, expected) {
         const secret = this.env.OAUTH_ENCRYPTION_SECRET;
         if (!secret) {
@@ -5203,6 +5209,10 @@ export class ConsentService {
             const payloadB64 = token.substring(dotIndex + 1);
             const payloadJson = this.base64UrlDecodeString(payloadB64);
             const payload = JSON.parse(payloadJson);
+            if ((expected.provider !== undefined &&
+                payload.provider !== expected.provider) ||
+                (expected.binding !== undefined && payload.binding !== expected.binding))
+                return null;
             if (payload.sid !== expected.sid) {
                 logger.warn("[ConsentService] Identity assertion sid mismatch");
                 return null;
@@ -5225,7 +5235,7 @@ export class ConsentService {
                 return null;
             }
             if (typeof payload.exp !== "number" ||
-                payload.exp < Math.floor(Date.now() / 1000)) {
+                payload.exp <= Math.floor(Date.now() / 1000)) {
                 logger.warn("[ConsentService] Identity assertion expired");
                 return null;
             }
@@ -5244,7 +5254,9 @@ export class ConsentService {
             return payload.userDid;
         }
         catch (error) {
-            logger.error("[ConsentService] Identity assertion verification error:", error);
+            if (expected.binding === undefined) {
+                logger.error("[ConsentService] Identity assertion verification error:", error);
+            }
             return null;
         }
     }