@kya-os/mcp-i-cloudflare 1.14.1 → 1.14.2

package/dist/delegation-http/native-http.js

@@ -0,0 +1,191 @@
+import { canonicalize } from "json-canonicalize";
+import { fetchNativeNoRedirect } from "./native-fetch";
+import { base58Decode, base58Encode, base64urlEncodeFromBytes, } from "@kya-os/mcp";
+import { CloudflareProofGenerator, } from "../proof-generator";
+import { getConfiguredIdentity } from "../providers/storage";
+export const nativeUnavailable = () => nativeError("kyaos/authorization-host-unavailable", 503);
+export function nativeError(error, status) {
+    return new Response(JSON.stringify({ error }), {
+        status,
+        headers: {
+            "Content-Type": "application/json",
+            "Cache-Control": "no-store",
+            ...([429, 503].includes(status) ? { "Retry-After": "3" } : {}),
+        },
+    });
+}
+export function secureHttpUrl(value, allowLoopback = false) {
+    if (typeof value !== "string" || value.length > 2048)
+        return false;
+    try {
+        const url = new URL(value);
+        return (!url.username &&
+            !url.password &&
+            !url.hash &&
+            (url.protocol === "https:" ||
+                (allowLoopback &&
+                    url.protocol === "http:" &&
+                    ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))));
+    }
+    catch {
+        return false;
+    }
+}
+export function isNativeHttpRegistration(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const v = value;
+    return (Object.keys(v).length === 5 &&
+        v.profile === "kya-http/2" &&
+        typeof v.resource === "string" &&
+        ["key-bound", "delegated", "attested-bearer"].includes(String(v.min_assurance)) &&
+        ["key", "token"].includes(String(v.pickup_mode)) &&
+        Number.isInteger(v.poll_interval_s) &&
+        Number(v.poll_interval_s) >= 1 &&
+        Number(v.poll_interval_s) <= 300 &&
+        (v.pickup_mode !== "token" || v.min_assurance === "attested-bearer"));
+}
+export function buildNativeChallenge(http, sid, scopes, origin) {
+    const consent = origin + "/consent?sid=" + sid;
+    const pickup = origin + "/api/delegation/pickup/" + sid;
+    return {
+        resource: http.resource,
+        sid,
+        consent_uri: consent,
+        pickup_uri: pickup,
+        required_scopes: scopes,
+        min_assurance: http.min_assurance,
+        poll_interval_s: http.poll_interval_s,
+        action: {
+            type: "delegation",
+            consent_uri: consent,
+            pickup_uri: pickup,
+            poll_interval_s: http.poll_interval_s,
+            pin: http.pickup_mode === "key"
+                ? { mode: "key", profile: "kya-http/2" }
+                : {
+                    mode: "token",
+                    header: "X-KYA-Pickup-Token",
+                    encoding: "base64url",
+                    bytes: 32,
+                },
+            retry: {
+                header: "Authorization",
+                scheme: "Bearer",
+                value_from: "delegation",
+            },
+        },
+    };
+}
+export async function signNativeChallenge(env, issuerDid, payload, audience) {
+    const identity = await getConfiguredIdentity(env);
+    if (!identity || identity.did !== issuerDid)
+        throw new Error("Native HTTP issuer is not configured");
+    return new CloudflareProofGenerator(identity).generateProof({ method: "authorization/challenge_proof", params: { sid: payload.sid } }, { data: [{ type: "text", text: canonicalize(payload) }] }, { nonce: payload.sid, audience, sessionId: payload.sid }, { outcome: "needs_authorization" });
+}
+/** Canonical Ed25519/P-256 did:key holder. No form-supplied key is trusted.
+ * WebCrypto validates/decompresses the EC point, avoiding a second curve implementation. */
+export async function nativeHolderBinding(keyId) {
+    const [did, fragment, extra] = keyId.split("#");
+    if (!did.startsWith("did:key:z") ||
+        did.length - 9 > 64 ||
+        (fragment !== did.slice(8) && fragment !== "keys-1") ||
+        extra !== undefined)
+        throw new Error("Invalid holder key identifier");
+    const decoded = base58Decode(did.slice(9));
+    const ed25519 = decoded.length === 34 && decoded[0] === 0xed && decoded[1] === 1;
+    const p256 = decoded.length === 35 &&
+        decoded[0] === 0x80 &&
+        decoded[1] === 0x24 &&
+        (decoded[2] === 2 || decoded[2] === 3);
+    if ((!ed25519 && !p256) || "z" + base58Encode(decoded) !== did.slice(8))
+        throw new Error("Invalid holder key");
+    const bytes = decoded.slice(2);
+    let jwk;
+    let key;
+    if (ed25519) {
+        jwk = { crv: "Ed25519", kty: "OKP", x: base64urlEncodeFromBytes(bytes) };
+        key = await crypto.subtle.importKey("jwk", jwk, { name: "Ed25519" }, false, ["verify"]);
+    }
+    else {
+        // Only public material is extractable. The exported coordinates are
+        // validated by the same platform implementation used for verification.
+        key = await crypto.subtle.importKey("raw", new Uint8Array(bytes), { name: "ECDSA", namedCurve: "P-256" }, true, ["verify"]);
+        const publicJwk = await crypto.subtle.exportKey("jwk", key);
+        if (publicJwk.crv !== "P-256" ||
+            publicJwk.kty !== "EC" ||
+            !publicJwk.x ||
+            !publicJwk.y)
+            throw new Error("Invalid holder key");
+        jwk = { crv: "P-256", kty: "EC", x: publicJwk.x, y: publicJwk.y };
+    }
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonicalize(jwk)));
+    return { did, jkt: base64urlEncodeFromBytes(new Uint8Array(digest)), key };
+}
+export function validNativeStatus(status) {
+    return (!!status &&
+        ["BitstringStatusListEntry", "StatusList2021Entry"].includes(status.type) &&
+        status.statusPurpose === "revocation" &&
+        typeof status.statusListIndex === "string" &&
+        /^(0|[1-9][0-9]*)$/.test(status.statusListIndex) &&
+        Number.isSafeInteger(Number(status.statusListIndex)) &&
+        secureHttpUrl(status.statusListCredential) &&
+        status.id === status.statusListCredential + "#" + status.statusListIndex);
+}
+/** Shared Checkpoint replay service. Native requests never retry an uncertain claim. */
+export async function claimNativeReplay(env, cfg, claim) {
+    try {
+        if (cfg.claimReplay)
+            return await cfg.claimReplay(claim);
+        const base = env.AGENTSHIELD_API_URL;
+        if (!secureHttpUrl(base, cfg.allowLoopbackHttp) ||
+            !env.AGENTSHIELD_API_KEY ||
+            !env.AGENTSHIELD_PROJECT_ID)
+            return "unavailable";
+        const response = await fetchNativeNoRedirect(new URL("/api/v1/enforce/replay", base), {
+            method: "POST",
+            signal: AbortSignal.timeout(3000),
+            headers: {
+                Authorization: "Bearer " + env.AGENTSHIELD_API_KEY,
+                "Content-Type": "application/json",
+                "X-Project-Id": env.AGENTSHIELD_PROJECT_ID,
+            },
+            body: JSON.stringify(claim),
+        });
+        if (response.status === 409)
+            return "replay";
+        if (response.status === 429)
+            return "capacity";
+        if (response.status !== 200 ||
+            Number(response.headers.get("content-length")) > 4096)
+            return "unavailable";
+        const reader = response.body?.getReader();
+        if (!reader)
+            return "unavailable";
+        const chunks = [];
+        let length = 0;
+        while (true) {
+            const next = await reader.read();
+            if (next.done)
+                break;
+            length += next.value.length;
+            if (length > 4096) {
+                await reader.cancel();
+                return "unavailable";
+            }
+            chunks.push(next.value);
+        }
+        const bytes = new Uint8Array(length);
+        let offset = 0;
+        for (const chunk of chunks) {
+            bytes.set(chunk, offset);
+            offset += chunk.length;
+        }
+        const data = JSON.parse(new TextDecoder().decode(bytes));
+        return data.outcome === "claimed" ? "claimed" : "unavailable";
+    }
+    catch {
+        return "unavailable";
+    }
+}
+//# sourceMappingURL=native-http.js.map

package/dist/delegation-http/native-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-http.js","sourceRoot":"","sources":["../../src/delegation-http/native-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,wBAAwB,GAEzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AA2F7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,EAAE,CACpC,WAAW,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;AAC3D,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,MAAc;IACvD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;QAC7C,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;YAC3B,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAc,EACd,aAAa,GAAG,KAAK;IAErB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,CACL,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,IAAI;YACT,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBACxB,CAAC,aAAa;oBACZ,GAAG,CAAC,QAAQ,KAAK,OAAO;oBACxB,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CACjE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;QAC3B,CAAC,CAAC,OAAO,KAAK,YAAY;QAC1B,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAC9B,CAAC,WAAW,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CACpD,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CACxB;QACD,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC;QACnC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,GAAG;QAChC,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,IAAI,CAAC,CAAC,aAAa,KAAK,iBAAiB,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAA4B,EAC5B,GAAW,EACX,MAAgB,EAChB,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,GAAG,eAAe,GAAG,GAAG,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,GAAG,yBAAyB,GAAG,GAAG,CAAC;IACxD,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG;QACH,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,MAAM;QAClB,eAAe,EAAE,MAAM;QACvB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,MAAM,EAAE;YACN,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,OAAO;YACpB,UAAU,EAAE,MAAM;YAClB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,GAAG,EACD,IAAI,CAAC,WAAW,KAAK,KAAK;gBACxB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE;gBACxC,CAAC,CAAC;oBACE,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,oBAAoB;oBAC5B,QAAQ,EAAE,WAAW;oBACrB,KAAK,EAAE,EAAE;iBACV;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,YAAY;aACzB;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAkB,EAClB,SAAiB,EACjB,OAA4B,EAC5B,QAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS;QACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,OAAO,IAAI,wBAAwB,CAAC,QAAQ,CAAC,CAAC,aAAa,CACzD,EAAE,MAAM,EAAE,+BAA+B,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EACzE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EACzD,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,EACxD,EAAE,OAAO,EAAE,qBAAqB,EAAE,CACnC,CAAC;AACJ,CAAC;AAED;4FAC4F;AAC5F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAa;IAEb,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,IACE,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;QAC5B,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE;QACnB,CAAC,QAAQ,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ,KAAK,QAAQ,CAAC;QACpD,KAAK,KAAK,SAAS;QAEnB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,IAAI,GACR,OAAO,CAAC,MAAM,KAAK,EAAE;QACrB,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;QACnB,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;QACnB,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,GAAe,CAAC;IACpB,IAAI,GAAc,CAAC;IACnB,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACjC,KAAK,EACL,GAAG,EACH,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,oEAAoE;QACpE,uEAAuE;QACvE,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACjC,KAAK,EACL,IAAI,UAAU,CAAC,KAAK,CAAC,EACrB,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,IAAI,EACJ,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5D,IACE,SAAS,CAAC,GAAG,KAAK,OAAO;YACzB,SAAS,CAAC,GAAG,KAAK,IAAI;YACtB,CAAC,SAAS,CAAC,CAAC;YACZ,CAAC,SAAS,CAAC,CAAC;YAEZ,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,GAAG,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAC5C,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAA8B;IAC9D,OAAO,CACL,CAAC,CAAC,MAAM;QACR,CAAC,0BAA0B,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QACzE,MAAM,CAAC,aAAa,KAAK,YAAY;QACrC,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ;QAC1C,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;QAChD,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACpD,aAAa,CAAC,MAAM,CAAC,oBAAoB,CAAC;QAC1C,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,oBAAoB,GAAG,GAAG,GAAG,MAAM,CAAC,eAAe,CACzE,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAkB,EAClB,GAAyB,EACzB,KAAwB;IAExB,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,WAAW;YAAE,OAAO,MAAM,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,GAAG,CAAC,mBAAmB,CAAC;QACrC,IACE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,iBAAiB,CAAC;YAC3C,CAAC,GAAG,CAAC,mBAAmB;YACxB,CAAC,GAAG,CAAC,sBAAsB;YAE3B,OAAO,aAAa,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAC1C,IAAI,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,EACvC;YACE,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,GAAG,GAAG,CAAC,mBAAmB;gBAClD,cAAc,EAAE,kBAAkB;gBAClC,cAAc,EAAE,GAAG,CAAC,sBAAsB;aAC3C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC5B,CACF,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,QAAQ,CAAC;QAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,UAAU,CAAC;QAC/C,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;YACvB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI;YAErD,OAAO,aAAa,CAAC;QACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO,aAAa,CAAC;QAClC,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM;YACrB,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAC5B,IAAI,MAAM,GAAG,IAAI,EAAE,CAAC;gBAClB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;QACzB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAEtD,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/delegation-http/native-oauth.d.ts

@@ -0,0 +1,26 @@
+import type { CloudflareEnv } from "../types";
+import { type NativeHttpHostConfig, type NativeHttpChallenge } from "./native-http";
+export interface NativeOAuthAnchor {
+    status: string;
+    expiresAt: number;
+    requiredScopes: string[];
+    holderKeyId?: string;
+    audience?: string;
+    nativeHttp?: NativeHttpChallenge;
+    nativeIssuerDid?: string;
+    nativePolicyRevision?: {
+        policyId?: string;
+        composedPolicyHash?: string;
+    };
+}
+export declare function beginNativeOAuth(env: CloudflareEnv, sid: string, info: NativeOAuthAnchor, cfg: NativeHttpHostConfig, initiate?: boolean): Promise<{
+    provider: string;
+    oauthUrl?: string;
+} | null>;
+/** Caller must have consumed cryptographically random server-stored OAuth state. */
+export declare function completeNativeOAuth(env: CloudflareEnv, state: Record<string, unknown>, code: string): Promise<Response>;
+export declare function verifyNativeOAuthIdentity(env: CloudflareEnv, sid: string, info: NativeOAuthAnchor, cfg: NativeHttpHostConfig, token: string): Promise<{
+    userDid: string;
+    amr: ["oauth"];
+} | null>;
+//# sourceMappingURL=native-oauth.d.ts.map

package/dist/delegation-http/native-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-oauth.d.ts","sourceRoot":"","sources":["../../src/delegation-http/native-oauth.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAY9C,OAAO,EAIL,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACzB,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,mBAAmB,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAsKD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,iBAAiB,EACvB,GAAG,EAAE,oBAAoB,EACzB,QAAQ,UAAO,GACd,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA0EzD;AAED,oFAAoF;AACpF,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,aAAa,EAClB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,QAAQ,CAAC,CAmKnB;AAED,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,iBAAiB,EACvB,GAAG,EAAE,oBAAoB,EACzB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAA;CAAE,GAAG,IAAI,CAAC,CA6BrD"}

package/dist/delegation-http/native-oauth.js

@@ -0,0 +1,369 @@
+/** Identity-only OAuth continuation for a registered, key-pinned HTTP anchor.
+ * No delegation, IdP token sidecar, or legacy session is written here. The human
+ * still must explicitly approve the signed assertion against the same anchor.
+ */
+import { canonicalize } from "json-canonicalize";
+import { fetchNativeNoRedirect } from "./native-fetch";
+import { OAuthSecurityService } from "../services/oauth-security.service";
+import { ConsentService } from "../services/consent.service";
+import { exchangeAuthorizationCode, toIdpTokens, } from "../runtime/oidc/token-exchange";
+import { resolveIdpScopes } from "../runtime/oidc/idp-scopes";
+import { makeEnvSecretResolver } from "../utils/env-secret-resolver";
+import { getAnchorStub } from "./anchor-routing";
+import { INTERNAL_PICKUP_INFO, NATIVE_OAUTH_STATE_PREFIX } from "./constants";
+import { sha256Hex } from "./hash";
+import { nativeHolderBinding, nativeError, secureHttpUrl, } from "./native-http";
+const failure = () => nativeError("kyaos/session-mismatch", 403);
+const boundedFetch = (input, init) => fetchNativeNoRedirect(input, {
+    ...init,
+    signal: AbortSignal.timeout(10000),
+});
+async function services(env) {
+    const { OAuthConfigService, OAuthService } = await import("@kya-os/mcp-i-runtime");
+    if (!env.AGENTSHIELD_API_URL ||
+        !env.AGENTSHIELD_API_KEY ||
+        !env.AGENTSHIELD_PROJECT_ID)
+        throw new Error("Native OAuth deployment configuration unavailable");
+    const fetchProvider = {
+        fetch: boundedFetch,
+        resolveDID: async () => {
+            throw new Error("Unused");
+        },
+        fetchStatusList: async () => {
+            throw new Error("Unused");
+        },
+        fetchDelegationChain: async () => {
+            throw new Error("Unused");
+        },
+    };
+    const configService = new OAuthConfigService({
+        baseUrl: env.AGENTSHIELD_API_URL,
+        apiKey: env.AGENTSHIELD_API_KEY,
+        fetchProvider,
+        logger: () => { },
+    });
+    return {
+        configService,
+        oauthService: new OAuthService({
+            configService,
+            fetchProvider,
+            agentShieldApiUrl: env.AGENTSHIELD_API_URL,
+            agentShieldApiKey: env.AGENTSHIELD_API_KEY,
+            projectId: env.AGENTSHIELD_PROJECT_ID,
+            secretResolver: makeEnvSecretResolver(env),
+            logger: () => { },
+        }),
+    };
+}
+async function selectedProvider(env) {
+    const svc = await services(env);
+    const config = await svc.configService.getOAuthConfig(env.AGENTSHIELD_PROJECT_ID);
+    const candidates = Object.entries(config.providers).filter(([, p]) => !!p.authorizationUrl);
+    const id = config.configuredProvider ||
+        (candidates.length === 1 ? candidates[0][0] : undefined);
+    const provider = id ? config.providers[id] : undefined;
+    if (!provider?.authorizationUrl)
+        return null;
+    return { ...svc, id: id, provider };
+}
+function validateProvider(provider, allowLoopback) {
+    if (provider.supportsPKCE !== true ||
+        provider.proxyMode ||
+        !provider.clientId ||
+        !secureHttpUrl(provider.authorizationUrl, allowLoopback) ||
+        !secureHttpUrl(provider.tokenUrl, allowLoopback) ||
+        !secureHttpUrl(provider.userInfoUrl, allowLoopback) ||
+        (provider.tokenEndpointAuthMethod &&
+            provider.tokenEndpointAuthMethod !== "client_secret_post"))
+        throw new Error("Native OAuth requires a configured direct PKCE provider with userinfo");
+}
+async function providerBinding(id, provider) {
+    // Changes to the IdP/client/endpoints invalidate the authentication in flight.
+    return sha256Hex(canonicalize({
+        id,
+        clientId: provider.clientId,
+        authorizationUrl: provider.authorizationUrl,
+        tokenUrl: provider.tokenUrl,
+        userInfoUrl: provider.userInfoUrl,
+        scopes: resolveIdpScopes(provider),
+        customParams: provider.customParams || {},
+        tokenEndpointAuthMethod: provider.tokenEndpointAuthMethod || "client_secret_post",
+        requiresClientSecret: provider.requiresClientSecret,
+        metadata: provider.metadata || {},
+    }));
+}
+async function anchorBinding(env, sid, info, cfg) {
+    const http = info.nativeHttp;
+    const origin = new URL(cfg.authorizationOrigin);
+    if (!env.AGENTSHIELD_PROJECT_ID ||
+        !cfg.projectId ||
+        !secureHttpUrl(cfg.authorizationOrigin, cfg.allowLoopbackHttp) ||
+        origin.origin !== cfg.authorizationOrigin ||
+        info.status !== "pinned" ||
+        !Number.isFinite(info.expiresAt) ||
+        info.expiresAt <= Date.now() ||
+        !info.holderKeyId ||
+        !info.audience ||
+        info.nativeIssuerDid !== cfg.issuerDid ||
+        !http ||
+        http.sid !== sid ||
+        http.action?.pin?.mode !== "key" ||
+        !secureHttpUrl(http.consent_uri, cfg.allowLoopbackHttp) ||
+        new URL(http.consent_uri).origin !== origin.origin ||
+        !info.requiredScopes.length ||
+        new Set(info.requiredScopes).size !== info.requiredScopes.length ||
+        canonicalize(info.requiredScopes) !== canonicalize(http.required_scopes) ||
+        !info.nativePolicyRevision?.policyId ||
+        !/^[a-f0-9]{64}$/.test(info.nativePolicyRevision.composedPolicyHash ?? ""))
+        throw new Error("Native OAuth anchor unavailable");
+    const holder = await nativeHolderBinding(info.holderKeyId);
+    const binding = await sha256Hex(canonicalize({
+        sid,
+        projectId: cfg.projectId,
+        holderKeyId: info.holderKeyId,
+        audience: info.audience,
+        issuerDid: cfg.issuerDid,
+        http,
+        revision: info.nativePolicyRevision,
+        expiresAt: info.expiresAt,
+    }));
+    return { binding, holderDid: holder.did };
+}
+function hostContext(env, cfg) {
+    return {
+        projectId: cfg.projectId || env.AGENTSHIELD_PROJECT_ID || "",
+        issuerDid: cfg.issuerDid,
+        authorizationOrigin: cfg.authorizationOrigin,
+        allowLoopbackHttp: cfg.allowLoopbackHttp === true,
+    };
+}
+export async function beginNativeOAuth(env, sid, info, cfg, initiate = true) {
+    if (!env.DELEGATION_STORAGE || !env.OAUTH_ENCRYPTION_SECRET)
+        throw new Error("Native OAuth secure state unavailable");
+    const host = hostContext(env, cfg);
+    const anchor = await anchorBinding(env, sid, info, host);
+    const selected = await selectedProvider(env);
+    if (!selected)
+        return null;
+    validateProvider(selected.provider, host.allowLoopbackHttp);
+    if (!initiate)
+        return { provider: selected.id };
+    const security = new OAuthSecurityService(env.DELEGATION_STORAGE, env.OAUTH_ENCRYPTION_SECRET);
+    const { verifier: codeVerifier, challenge: codeChallenge } = await security.generatePKCEChallenge();
+    const random = crypto.getRandomValues(new Uint8Array(32));
+    const state = NATIVE_OAUTH_STATE_PREFIX +
+        btoa(String.fromCharCode(...random))
+            .replace(/\+/g, "-")
+            .replace(/\//g, "_")
+            .replace(/=+$/, "");
+    const redirectUri = host.authorizationOrigin + "/oauth/callback";
+    const native = {
+        ...host,
+        binding: anchor.binding,
+        provider: selected.id,
+        providerBinding: await providerBinding(selected.id, selected.provider),
+        expiresAt: Math.min(info.expiresAt, Date.now() + 600000),
+    };
+    await security.storeOAuthState(state, {
+        native_http_anchor: true,
+        native,
+        project_id: host.projectId,
+        agent_did: anchor.holderDid,
+        session_id: sid,
+        scopes: info.requiredScopes,
+        tool: "",
+        provider: selected.id,
+        direct_pkce: true,
+        encryptedVerifier: await security.encryptToken(codeVerifier),
+        redirect_uri: redirectUri,
+    }, Math.max(1, Math.floor((native.expiresAt - Date.now()) / 1000)));
+    const url = new URL(selected.provider.authorizationUrl);
+    const reserved = new Set([
+        "response_type",
+        "client_id",
+        "redirect_uri",
+        "scope",
+        "state",
+        "code_challenge",
+        "code_challenge_method",
+    ]);
+    for (const [key, value] of Object.entries(selected.provider.customParams || {})) {
+        if (reserved.has(key.toLowerCase()) || typeof value !== "string")
+            throw new Error("Reserved native OAuth parameter");
+        url.searchParams.set(key, value);
+    }
+    Object.entries({
+        response_type: "code",
+        client_id: selected.provider.clientId,
+        redirect_uri: redirectUri,
+        scope: resolveIdpScopes(selected.provider).join(" "),
+        state,
+        code_challenge: codeChallenge,
+        code_challenge_method: "S256",
+    }).forEach(([key, value]) => url.searchParams.set(key, value));
+    return { provider: selected.id, oauthUrl: url.toString() };
+}
+/** Caller must have consumed cryptographically random server-stored OAuth state. */
+export async function completeNativeOAuth(env, state, code) {
+    try {
+        const native = state.native;
+        const sid = state.session_id;
+        if (state.native_http_anchor !== true ||
+            !native ||
+            typeof sid !== "string" ||
+            !code ||
+            native.expiresAt <= Date.now() ||
+            state.project_id !== native.projectId ||
+            state.provider !== native.provider ||
+            state.tool !== "" ||
+            state.direct_pkce !== true ||
+            typeof state.pkceVerifier !== "string" ||
+            !state.pkceVerifier ||
+            state.redirect_uri !== native.authorizationOrigin + "/oauth/callback")
+            return failure();
+        const response = await getAnchorStub(env, sid).fetch("https://do.internal" + INTERNAL_PICKUP_INFO, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ sid }),
+        });
+        if (!response.ok)
+            return failure();
+        const info = (await response.json());
+        const anchor = await anchorBinding(env, sid, info, native);
+        if (anchor.binding !== native.binding ||
+            state.agent_did !== anchor.holderDid ||
+            canonicalize(state.scopes) !== canonicalize(info.requiredScopes))
+            return failure();
+        const selected = await selectedProvider(env);
+        if (!selected || selected.id !== native.provider)
+            return failure();
+        validateProvider(selected.provider, native.allowLoopbackHttp);
+        if ((await providerBinding(selected.id, selected.provider)) !==
+            native.providerBinding)
+            return failure();
+        const clientSecret = await selected.oauthService.resolveClientSecret(selected.provider);
+        if (selected.provider.requiresClientSecret && !clientSecret)
+            return failure();
+        const tokens = await toIdpTokens(await exchangeAuthorizationCode({
+            tokenEndpoint: selected.provider.tokenUrl,
+            code,
+            redirectUri: state.redirect_uri,
+            clientId: selected.provider.clientId,
+            codeVerifier: state.pkceVerifier,
+            clientSecret,
+            fetchImpl: boundedFetch,
+        }));
+        const userResponse = await boundedFetch(selected.provider.userInfoUrl, {
+            headers: {
+                Authorization: "Bearer " + tokens.access_token,
+                Accept: "application/json",
+                ...(selected.id === "github"
+                    ? { "User-Agent": "KYA-OS-Authorization-Host" }
+                    : {}),
+            },
+        });
+        if (!userResponse.ok)
+            return failure();
+        const user = (await userResponse.json());
+        const subject = typeof user.sub === "string"
+            ? user.sub
+            : typeof user.id === "number" || typeof user.id === "string"
+                ? String(user.id)
+                : typeof user.login === "string"
+                    ? user.login
+                    : undefined;
+        if (!subject)
+            return failure();
+        const identityResponse = await boundedFetch(env.AGENTSHIELD_API_URL + "/api/v1/bouncer/identity/resolve", {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "X-API-Key": env.AGENTSHIELD_API_KEY,
+            },
+            body: JSON.stringify({
+                project_id: native.projectId,
+                oauth_result: {
+                    provider: selected.id,
+                    sub: subject,
+                    email: typeof user.email === "string" ? user.email : undefined,
+                    emailVerified: user.email_verified === true,
+                    name: typeof user.name === "string" ? user.name : undefined,
+                },
+            }),
+        });
+        if (!identityResponse.ok)
+            return failure();
+        const identity = (await identityResponse.json());
+        if (identity.success !== true ||
+            !identity.data?.user_did?.startsWith("did:key:"))
+            return failure();
+        // Re-read after network operations: a revoked/expired/changed anchor cannot
+        // acquire a usable authenticated continuation during the exchange.
+        const currentResponse = await getAnchorStub(env, sid).fetch("https://do.internal" + INTERNAL_PICKUP_INFO, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ sid }),
+        });
+        if (!currentResponse.ok ||
+            (await anchorBinding(env, sid, (await currentResponse.json()), native)).binding !== anchor.binding)
+            return failure();
+        const assertion = await new ConsentService(env).mintIdentityAssertion({
+            sid,
+            userDid: identity.data.user_did,
+            provider: selected.id,
+            agentDid: anchor.holderDid,
+            tool: "",
+            scopes: info.requiredScopes,
+            projectId: native.projectId,
+            binding: await sha256Hex(canonicalize({
+                anchor: anchor.binding,
+                provider: native.providerBinding,
+            })),
+        });
+        const location = new URL(info.nativeHttp.consent_uri);
+        location.searchParams.set("mode", "consent-only");
+        location.hash = new URLSearchParams({
+            identity_assertion: assertion,
+        }).toString();
+        return new Response(null, {
+            status: 302,
+            headers: {
+                Location: location.toString(),
+                "Cache-Control": "no-store",
+                "Referrer-Policy": "no-referrer",
+            },
+        });
+    }
+    catch {
+        return failure();
+    }
+}
+export async function verifyNativeOAuthIdentity(env, sid, info, cfg, token) {
+    try {
+        if (!token || token.length > 16384)
+            return null;
+        const host = hostContext(env, cfg);
+        const anchor = await anchorBinding(env, sid, info, host);
+        const selected = await selectedProvider(env);
+        if (!selected)
+            return null;
+        validateProvider(selected.provider, host.allowLoopbackHttp);
+        const userDid = await new ConsentService(env).verifyNativeIdentityAssertion(token, {
+            sid,
+            agentDid: anchor.holderDid,
+            tool: "",
+            scopes: info.requiredScopes,
+            projectId: host.projectId,
+            provider: selected.id,
+            binding: await sha256Hex(canonicalize({
+                anchor: anchor.binding,
+                provider: await providerBinding(selected.id, selected.provider),
+            })),
+        });
+        return userDid ? { userDid, amr: ["oauth"] } : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=native-oauth.js.map

package/dist/delegation-http/native-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-oauth.js","sourceRoot":"","sources":["../../src/delegation-http/native-oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAGvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EACL,yBAAyB,EACzB,WAAW,GACZ,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,aAAa,GAGd,MAAM,eAAe,CAAC;AAsBvB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;AACjE,MAAM,YAAY,GAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACjD,qBAAqB,CAAC,KAAK,EAAE;IAC3B,GAAG,IAAI;IACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;CACnC,CAAC,CAAC;AAEL,KAAK,UAAU,QAAQ,CAAC,GAAkB;IACxC,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CACvD,uBAAuB,CACxB,CAAC;IACF,IACE,CAAC,GAAG,CAAC,mBAAmB;QACxB,CAAC,GAAG,CAAC,mBAAmB;QACxB,CAAC,GAAG,CAAC,sBAAsB;QAE3B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG;QACpB,KAAK,EAAE,YAAY;QACnB,UAAU,EAAE,KAAK,IAAI,EAAE;YACrB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QACD,eAAe,EAAE,KAAK,IAAI,EAAE;YAC1B,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QACD,oBAAoB,EAAE,KAAK,IAAI,EAAE;YAC/B,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC;IACF,MAAM,aAAa,GAAG,IAAI,kBAAkB,CAAC;QAC3C,OAAO,EAAE,GAAG,CAAC,mBAAmB;QAChC,MAAM,EAAE,GAAG,CAAC,mBAAmB;QAC/B,aAAa;QACb,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC;KACjB,CAAC,CAAC;IACH,OAAO;QACL,aAAa;QACb,YAAY,EAAE,IAAI,YAAY,CAAC;YAC7B,aAAa;YACb,aAAa;YACb,iBAAiB,EAAE,GAAG,CAAC,mBAAmB;YAC1C,iBAAiB,EAAE,GAAG,CAAC,mBAAmB;YAC1C,SAAS,EAAE,GAAG,CAAC,sBAAsB;YACrC,cAAc,EAAE,qBAAqB,CAAC,GAAG,CAAC;YAC1C,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC;SACjB,CAAC;KACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAkB;IAChD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,cAAc,CACnD,GAAG,CAAC,sBAAuB,CAC5B,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CACxD,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAChC,CAAC;IACF,MAAM,EAAE,GACN,MAAM,CAAC,kBAAkB;QACzB,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,IAAI,CAAC,QAAQ,EAAE,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,EAAG,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AACD,SAAS,gBAAgB,CAAC,QAAuB,EAAE,aAAsB;IACvE,IACE,QAAQ,CAAC,YAAY,KAAK,IAAI;QAC9B,QAAQ,CAAC,SAAS;QAClB,CAAC,QAAQ,CAAC,QAAQ;QAClB,CAAC,aAAa,CAAC,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC;QACxD,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QAChD,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC;QACnD,CAAC,QAAQ,CAAC,uBAAuB;YAC/B,QAAQ,CAAC,uBAAuB,KAAK,oBAAoB,CAAC;QAE5D,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;AACN,CAAC;AACD,KAAK,UAAU,eAAe,CAAC,EAAU,EAAE,QAAuB;IAChE,+EAA+E;IAC/E,OAAO,SAAS,CACd,YAAY,CAAC;QACX,EAAE;QACF,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QAClC,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,EAAE;QACzC,uBAAuB,EACrB,QAAQ,CAAC,uBAAuB,IAAI,oBAAoB;QAC1D,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;QACnD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,EAAE;KAClC,CAAC,CACH,CAAC;AACJ,CAAC;AACD,KAAK,UAAU,aAAa,CAC1B,GAAkB,EAClB,GAAW,EACX,IAAuB,EACvB,GAGC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAChD,IACE,CAAC,GAAG,CAAC,sBAAsB;QAC3B,CAAC,GAAG,CAAC,SAAS;QACd,CAAC,aAAa,CAAC,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,iBAAiB,CAAC;QAC9D,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,mBAAmB;QACzC,IAAI,CAAC,MAAM,KAAK,QAAQ;QACxB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAC5B,CAAC,IAAI,CAAC,WAAW;QACjB,CAAC,IAAI,CAAC,QAAQ;QACd,IAAI,CAAC,eAAe,KAAK,GAAG,CAAC,SAAS;QACtC,CAAC,IAAI;QACL,IAAI,CAAC,GAAG,KAAK,GAAG;QAChB,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,KAAK,KAAK;QAChC,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,iBAAiB,CAAC;QACvD,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAClD,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM;QAC3B,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,cAAc,CAAC,MAAM;QAChE,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC;QACxE,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ;QACpC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAE1E,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,SAAS,CAC7B,YAAY,CAAC;QACX,GAAG;QACH,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,IAAI;QACJ,QAAQ,EAAE,IAAI,CAAC,oBAAoB;QACnC,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CACH,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;AAC5C,CAAC;AACD,SAAS,WAAW,CAAC,GAAkB,EAAE,GAAyB;IAChE,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,sBAAsB,IAAI,EAAE;QAC5D,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;QAC5C,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,KAAK,IAAI;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAkB,EAClB,GAAW,EACX,IAAuB,EACvB,GAAyB,EACzB,QAAQ,GAAG,IAAI;IAEf,IAAI,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,GAAG,CAAC,uBAAuB;QACzD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CACvC,GAAG,CAAC,kBAAyB,EAC7B,GAAG,CAAC,uBAAuB,CAC5B,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,GACxD,MAAM,QAAQ,CAAC,qBAAqB,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1D,MAAM,KAAK,GACT,yBAAyB;QACzB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,CAAC;aACjC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxB,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,GAAG,iBAAiB,CAAC;IACjE,MAAM,MAAM,GAAkB;QAC5B,GAAG,IAAI;QACP,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,eAAe,EAAE,MAAM,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;QACtE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;KACzD,CAAC;IACF,MAAM,QAAQ,CAAC,eAAe,CAC5B,KAAK,EACL;QACE,kBAAkB,EAAE,IAAI;QACxB,MAAM;QACN,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,GAAG;QACf,MAAM,EAAE,IAAI,CAAC,cAAc;QAC3B,IAAI,EAAE,EAAE;QACR,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,WAAW,EAAE,IAAI;QACjB,iBAAiB,EAAE,MAAM,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC;QAC5D,YAAY,EAAE,WAAW;KAC1B,EACD,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAChE,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,eAAe;QACf,WAAW;QACX,cAAc;QACd,OAAO;QACP,OAAO;QACP,gBAAgB;QAChB,uBAAuB;KACxB,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CACvC,QAAQ,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CACrC,EAAE,CAAC;QACF,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAC9D,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,CAAC,OAAO,CAAC;QACb,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ;QACrC,YAAY,EAAE,WAAW;QACzB,KAAK,EAAE,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACpD,KAAK;QACL,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;KAC9B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/D,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAkB,EAClB,KAA8B,EAC9B,IAAY;IAEZ,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,MAAuB,CAAC;QAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC;QAC7B,IACE,KAAK,CAAC,kBAAkB,KAAK,IAAI;YACjC,CAAC,MAAM;YACP,OAAO,GAAG,KAAK,QAAQ;YACvB,CAAC,IAAI;YACL,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAC9B,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,SAAS;YACrC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;YAClC,KAAK,CAAC,IAAI,KAAK,EAAE;YACjB,KAAK,CAAC,WAAW,KAAK,IAAI;YAC1B,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;YACtC,CAAC,KAAK,CAAC,YAAY;YACnB,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,mBAAmB,GAAG,iBAAiB;YAErE,OAAO,OAAO,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAClD,qBAAqB,GAAG,oBAAoB,EAC5C;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC;SAC9B,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsB,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3D,IACE,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YACjC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;YACpC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC;YAEhE,OAAO,OAAO,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ;YAAE,OAAO,OAAO,EAAE,CAAC;QACnE,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC9D,IACE,CAAC,MAAM,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvD,MAAM,CAAC,eAAe;YAEtB,OAAO,OAAO,EAAE,CAAC;QACnB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAClE,QAAQ,CAAC,QAAQ,CAClB,CAAC;QACF,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,IAAI,CAAC,YAAY;YACzD,OAAO,OAAO,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,MAAM,yBAAyB,CAAC;YAC9B,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ;YACzC,IAAI;YACJ,WAAW,EAAE,KAAK,CAAC,YAAsB;YACzC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,YAAY;YACZ,SAAS,EAAE,YAAY;SACxB,CAAC,CACH,CAAC;QACF,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAY,EAAE;YACtE,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,GAAG,MAAM,CAAC,YAAY;gBAC9C,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ;oBAC1B,CAAC,CAAC,EAAE,YAAY,EAAE,2BAA2B,EAAE;oBAC/C,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,EAAE;YAAE,OAAO,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAA4B,CAAC;QACpE,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;YAC1B,CAAC,CAAC,IAAI,CAAC,GAAG;YACV,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ;gBAC1D,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjB,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;oBAC9B,CAAC,CAAC,IAAI,CAAC,KAAK;oBACZ,CAAC,CAAC,SAAS,CAAC;QACpB,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,EAAE,CAAC;QAC/B,MAAM,gBAAgB,GAAG,MAAM,YAAY,CACzC,GAAG,CAAC,mBAAmB,GAAG,kCAAkC,EAC5D;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,WAAW,EAAE,GAAG,CAAC,mBAAoB;aACtC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,MAAM,CAAC,SAAS;gBAC5B,YAAY,EAAE;oBACZ,QAAQ,EAAE,QAAQ,CAAC,EAAE;oBACrB,GAAG,EAAE,OAAO;oBACZ,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;oBAC9D,aAAa,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;oBAC3C,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;iBAC5D;aACF,CAAC;SACH,CACF,CAAC;QACF,IAAI,CAAC,gBAAgB,CAAC,EAAE;YAAE,OAAO,OAAO,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAG9C,CAAC;QACF,IACE,QAAQ,CAAC,OAAO,KAAK,IAAI;YACzB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC;YAEhD,OAAO,OAAO,EAAE,CAAC;QACnB,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CACzD,qBAAqB,GAAG,oBAAoB,EAC5C;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC;SAC9B,CACF,CAAC;QACF,IACE,CAAC,eAAe,CAAC,EAAE;YACnB,CACE,MAAM,aAAa,CACjB,GAAG,EACH,GAAG,EACH,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,CAAsB,EACnD,MAAM,CACP,CACF,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YAE5B,OAAO,OAAO,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,qBAAqB,CAAC;YACpE,GAAG;YACH,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ;YAC/B,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,SAAS,CACtB,YAAY,CAAC;gBACX,MAAM,EAAE,MAAM,CAAC,OAAO;gBACtB,QAAQ,EAAE,MAAM,CAAC,eAAe;aACjC,CAAC,CACH;SACF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAW,CAAC,WAAW,CAAC,CAAC;QACvD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAClD,QAAQ,CAAC,IAAI,GAAG,IAAI,eAAe,CAAC;YAClC,kBAAkB,EAAE,SAAS;SAC9B,CAAC,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;gBAC7B,eAAe,EAAE,UAAU;gBAC3B,iBAAiB,EAAE,aAAa;aACjC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAkB,EAClB,GAAW,EACX,IAAuB,EACvB,GAAyB,EACzB,KAAa;IAEb,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,6BAA6B,CACzE,KAAK,EACL;YACE,GAAG;YACH,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,OAAO,EAAE,MAAM,SAAS,CACtB,YAAY,CAAC;gBACX,MAAM,EAAE,MAAM,CAAC,OAAO;gBACtB,QAAQ,EAAE,MAAM,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;aAChE,CAAC,CACH;SACF,CACF,CAAC;QACF,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/delegation-http/native-pickup.d.ts

@@ -0,0 +1,20 @@
+type Identity = {
+    keyId: string;
+    nonce: string;
+    expiresUnix: number;
+};
+export type NativePollIdentity = {
+    ok: true;
+    proof: Identity;
+} | {
+    ok: false;
+    error: string;
+    status: number;
+};
+/** Complete bodyless Ed25519/P-256 did:key pickup profile. A keyid alone is never
+ * an identity. The caller must claim the returned nonce in the shared replay
+ * service before performing pin CAS or delivering a parked credential.
+ */
+export declare function verifyNativePoll(req: Request, expectedOrigin: string, now?: number): Promise<NativePollIdentity>;
+export {};
+//# sourceMappingURL=native-pickup.d.ts.map

package/dist/delegation-http/native-pickup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-pickup.d.ts","sourceRoot":"","sources":["../../src/delegation-http/native-pickup.ts"],"names":[],"mappings":"AAGA,KAAK,QAAQ,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAYjD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,OAAO,EACZ,cAAc,EAAE,MAAM,EACtB,GAAG,SAAgC,GAClC,OAAO,CAAC,kBAAkB,CAAC,CA8G7B"}