@kya-os/mcp-i-cloudflare 1.14.1 → 1.14.3

package/dist/delegation-http/native-pickup.js

@@ -0,0 +1,227 @@
+import { base64urlDecodeToBytes } from "@kya-os/mcp";
+import { nativeHolderBinding } from "./native-http";
+const fail = (error = "kyaos/profile-violation", status = 403) => ({ ok: false, error, status });
+const fields = [
+    "content-digest",
+    "content-type",
+    "content-encoding",
+    "idempotency-key",
+];
+/** Complete bodyless Ed25519/P-256 did:key pickup profile. A keyid alone is never
+ * an identity. The caller must claim the returned nonce in the shared replay
+ * service before performing pin CAS or delivering a parked credential.
+ */
+export async function verifyNativePoll(req, expectedOrigin, now = Math.floor(Date.now() / 1000)) {
+    const input = req.headers.get("signature-input");
+    const signature = req.headers.get("signature");
+    if (req.headers.has("x-kya-pickup-token"))
+        return fail();
+    if (input === null || signature === null)
+        return fail("kyaos/missing-signature", 401);
+    if (input.length > 4096 ||
+        signature.length > 2048 ||
+        !["GET", "HEAD"].includes(req.method) ||
+        req.body !== null ||
+        new URL(req.url).origin !== expectedOrigin)
+        return fail();
+    if ([
+        "authorization",
+        "kya-delegation",
+        "x-mcpi-proof",
+        "x-mcpi-delegation",
+        "kya-os-delegation-credential",
+        "kya-os-delegation-proof",
+        "kya-os-delegation",
+    ].some((name) => req.headers.has(name)))
+        return fail();
+    const raw = member(input);
+    const encoded = member(signature);
+    if (!raw || !encoded)
+        return fail();
+    const close = raw.indexOf(")");
+    const components = pickupComponents(raw.slice(0, close + 1), req.headers);
+    if (!components)
+        return fail();
+    const params = parameters(raw.slice(close + 1));
+    if (!params ||
+        params.tag !== "kya-http/2" ||
+        !["ed25519", "ecdsa-p256", "ecdsa-p256-sha256"].includes(String(params.alg)) ||
+        typeof params.keyid !== "string" ||
+        typeof params.nonce !== "string" ||
+        !/^[\x21-\x7e]{1,128}$/.test(params.nonce) ||
+        typeof params.created !== "number" ||
+        typeof params.expires !== "number")
+        return fail();
+    if (params.expires < params.created ||
+        params.expires - params.created > 300 ||
+        params.created > now + 30)
+        return fail();
+    if (params.expires <= now)
+        return fail("kyaos/expired", 401);
+    for (const field of fields) {
+        const value = req.headers.get(field);
+        if (value !== null && (!value || value.includes(",")))
+            return fail();
+    }
+    const digest = req.headers.get("content-digest");
+    if (digest !== null &&
+        digest !== "sha-256=:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=:")
+        return fail("kyaos/invalid-signature", 401);
+    if (!/^:[A-Za-z0-9+/]{86}==:$/.test(encoded))
+        return fail();
+    const sigText = encoded.slice(1, -1);
+    const bytes = base64urlDecodeToBytes(sigText.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""));
+    if (btoa(String.fromCharCode(...bytes)) !== sigText)
+        return fail();
+    let binding;
+    try {
+        binding = await nativeHolderBinding(params.keyid);
+    }
+    catch {
+        return fail("kyaos/did-unresolvable", 401);
+    }
+    const ed25519 = binding.key.algorithm.name === "Ed25519";
+    if ((params.alg === "ed25519") !== ed25519)
+        return fail();
+    const values = {
+        "@method": req.method,
+        "@authority": new URL(req.url).host.toLowerCase(),
+        "@target-uri": req.url,
+    };
+    const base = [
+        ...components.map((name) => `"${name}": ${Object.hasOwn(values, name) ? values[name] : req.headers.get(name)}`),
+        `"@signature-params": ${raw}`,
+    ].join("\n");
+    try {
+        if (!(await crypto.subtle.verify(ed25519 ? "Ed25519" : { name: "ECDSA", hash: "SHA-256" }, binding.key, new Uint8Array(bytes), new TextEncoder().encode(base))))
+            return fail("kyaos/invalid-signature", 401);
+    }
+    catch {
+        return fail("kyaos/invalid-signature", 401);
+    }
+    return {
+        ok: true,
+        proof: {
+            keyId: params.keyid,
+            nonce: params.nonce,
+            expiresUnix: params.expires,
+        },
+    };
+}
+/** Rev13 §5.1/§5.3 canonical required/conditional phases, followed by optional
+ * signed ordinary fields in lowercase lexical order. Additional fields remain
+ * opaque signed values; they do not become authorization or policy facts. */
+function pickupComponents(list, headers) {
+    if (!/^\( *"@?[!#$%&'*+.^_`|~a-z0-9-]+"(?: +"@?[!#$%&'*+.^_`|~a-z0-9-]+")* *\)$/.test(list))
+        return null;
+    const covered = list
+        .slice(1, -1)
+        .trim()
+        .split(/ +/)
+        .map((item) => item.slice(1, -1));
+    if (new Set(covered).size !== covered.length)
+        return null;
+    const required = [
+        "@method",
+        "@authority",
+        "@target-uri",
+        ...fields.filter((name) => headers.has(name)),
+    ];
+    const extra = covered.filter((name) => !required.includes(name));
+    if (extra.some((name) => name.startsWith("@") ||
+        name === "signature" ||
+        name === "signature-input" ||
+        !headers.has(name)))
+        return null;
+    const expected = [...required, ...extra.sort()];
+    return expected.length === covered.length &&
+        expected.every((name, i) => covered[i] === name)
+        ? covered
+        : null;
+}
+/** Bounded SF dictionary scanner: escaped quotes/commas never become labels. */
+function member(value) {
+    const parts = [];
+    let start = 0, quoted = false, escaped = false;
+    for (let i = 0; i < value.length; i++) {
+        const c = value[i];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (quoted && c === "\\") {
+            escaped = true;
+            continue;
+        }
+        if (c === '"')
+            quoted = !quoted;
+        else if (c === "," && !quoted) {
+            parts.push(value.slice(start, i).trim());
+            start = i + 1;
+        }
+    }
+    if (quoted || escaped)
+        return null;
+    parts.push(value.slice(start).trim());
+    const labels = new Set();
+    let selected = null;
+    for (const part of parts) {
+        const eq = part.indexOf("=");
+        const label = part.slice(0, eq);
+        if (eq < 1 || !/^[a-z*][a-z0-9_.*-]*$/.test(label) || labels.has(label))
+            return null;
+        labels.add(label);
+        if (label === "kya")
+            selected = part.slice(eq + 1);
+    }
+    return selected;
+}
+function parameters(value) {
+    const result = Object.create(null);
+    let i = 0;
+    while (i < value.length) {
+        if (value[i++] !== ";")
+            return null;
+        const start = i;
+        while (i < value.length && /[a-z0-9_.*-]/.test(value[i]))
+            i++;
+        const key = value.slice(start, i);
+        if (!key || Object.hasOwn(result, key) || value[i++] !== "=")
+            return null;
+        if (value[i] === '"') {
+            i++;
+            let text = "", closed = false;
+            while (i < value.length) {
+                let c = value[i++];
+                if (c === '"') {
+                    closed = true;
+                    break;
+                }
+                if (c === "\\") {
+                    c = value[i++];
+                    if (c !== "\\" && c !== '"')
+                        return null;
+                }
+                if (!c || c.charCodeAt(0) < 32 || c.charCodeAt(0) > 126)
+                    return null;
+                text += c;
+            }
+            if (!closed)
+                return null;
+            result[key] = text;
+        }
+        else {
+            const startNumber = i;
+            if (value[i] === "-")
+                i++;
+            while (i < value.length && /[0-9]/.test(value[i]))
+                i++;
+            const number = value.slice(startNumber, i);
+            if (!/^-?\d{1,15}$/.test(number))
+                return null;
+            result[key] = Number(number);
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=native-pickup.js.map

package/dist/delegation-http/native-pickup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-pickup.js","sourceRoot":"","sources":["../../src/delegation-http/native-pickup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAMpD,MAAM,IAAI,GAAG,CACX,KAAK,GAAG,yBAAyB,EACjC,MAAM,GAAG,GAAG,EACQ,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AACxD,MAAM,MAAM,GAAG;IACb,gBAAgB;IAChB,cAAc;IACd,kBAAkB;IAClB,iBAAiB;CAClB,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAY,EACZ,cAAsB,EACtB,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAEnC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IACzD,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI;QACtC,OAAO,IAAI,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAC9C,IACE,KAAK,CAAC,MAAM,GAAG,IAAI;QACnB,SAAS,CAAC,MAAM,GAAG,IAAI;QACvB,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QACrC,GAAG,CAAC,IAAI,KAAK,IAAI;QACjB,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,cAAc;QAE1C,OAAO,IAAI,EAAE,CAAC;IAChB,IACE;QACE,eAAe;QACf,gBAAgB;QAChB,cAAc;QACd,mBAAmB;QACnB,8BAA8B;QAC9B,yBAAyB;QACzB,mBAAmB;KACpB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEvC,OAAO,IAAI,EAAE,CAAC;IAChB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,IACE,CAAC,MAAM;QACP,MAAM,CAAC,GAAG,KAAK,YAAY;QAC3B,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CACtD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CACnB;QACD,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAChC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAChC,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAC1C,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAClC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAElC,OAAO,IAAI,EAAE,CAAC;IAChB,IACE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO;QAC/B,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,GAAG,GAAG;QACrC,MAAM,CAAC,OAAO,GAAG,GAAG,GAAG,EAAE;QAEzB,OAAO,IAAI,EAAE,CAAC;IAChB,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACjD,IACE,MAAM,KAAK,IAAI;QACf,MAAM,KAAK,wDAAwD;QAEnE,OAAO,IAAI,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,sBAAsB,CAClC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACnE,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,EAAE,CAAC;IACnE,IAAI,OAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,EAAE,CAAC;IAC1D,MAAM,MAAM,GAA2B;QACrC,SAAS,EAAE,GAAG,CAAC,MAAM;QACrB,YAAY,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE;QACjD,aAAa,EAAE,GAAG,CAAC,GAAG;KACvB,CAAC;IACF,MAAM,IAAI,GAAG;QACX,GAAG,UAAU,CAAC,GAAG,CACf,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACrF;QACD,wBAAwB,GAAG,EAAE;KAC9B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,IAAI,CAAC;QACH,IACE,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC1B,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EACxD,OAAO,CAAC,GAAG,EACX,IAAI,UAAU,CAAC,KAAK,CAAC,EACrB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/B,CAAC;YAEF,OAAO,IAAI,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,OAAO;SAC5B;KACF,CAAC;AACJ,CAAC;AAED;;6EAE6E;AAC7E,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAgB;IACtD,IACE,CAAC,2EAA2E,CAAC,IAAI,CAC/E,IAAI,CACL;QAED,OAAO,IAAI,CAAC;IACd,MAAM,OAAO,GAAG,IAAI;SACjB,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;SACZ,IAAI,EAAE;SACN,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,QAAQ,GAAG;QACf,SAAS;QACT,YAAY;QACZ,aAAa;QACb,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;KAC9C,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,IACE,KAAK,CAAC,IAAI,CACR,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACpB,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,iBAAiB;QAC1B,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CACrB;QAED,OAAO,IAAI,CAAC;IACd,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,OAAO,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QACvC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;QAChD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,gFAAgF;AAChF,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,EACX,MAAM,GAAG,KAAK,EACd,OAAO,GAAG,KAAK,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG;YAAE,MAAM,GAAG,CAAC,MAAM,CAAC;aAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACzC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,IAAI,MAAM,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,IAAI,KAAK,KAAK,KAAK;YAAE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,MAAM,GAAoC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,KAAK,GAAG,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1E,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,CAAC,EAAE,CAAC;YACJ,IAAI,IAAI,GAAG,EAAE,EACX,MAAM,GAAG,KAAK,CAAC;YACjB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxB,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACnB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;oBACd,MAAM,GAAG,IAAI,CAAC;oBACd,MAAM;gBACR,CAAC;gBACD,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBACf,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;oBACf,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG;wBAAE,OAAO,IAAI,CAAC;gBAC3C,CAAC;gBACD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACrE,IAAI,IAAI,CAAC,CAAC;YACZ,CAAC;YACD,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,CAAC,CAAC;YACtB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/delegation-http/pickup-routes.d.ts

@@ -24,6 +24,7 @@ interface PickupRequestContext {
         param(name: string): string | undefined;
         header(name: string): string | undefined;
         url: string;
+        raw?: Request;
     };
 }
 /**

package/dist/delegation-http/pickup-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pickup-routes.d.ts","sourceRoot":"","sources":["../../src/delegation-http/pickup-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAS5C,wFAAwF;AACxF,UAAU,oBAAoB;IAC5B,GAAG,EAAE;QACH,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;QACxC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;QACzC,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;CACH;AA+CD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,EACtD,iBAAiB,EAAE,OAAO,GACzB,YAAY,GAAG,IAAI,CAerB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,CAAC,EAAE,oBAAoB,EACvB,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GACjC,OAAO,CAAC,QAAQ,CAAC,CA4BnB"}
+{"version":3,"file":"pickup-routes.d.ts","sourceRoot":"","sources":["../../src/delegation-http/pickup-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAY5C,wFAAwF;AACxF,UAAU,oBAAoB;IAC5B,GAAG,EAAE;QACH,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;QACxC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;QACzC,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,CAAC,EAAE,OAAO,CAAC;KACf,CAAC;CACH;AA+CD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,EACtD,iBAAiB,EAAE,OAAO,GACzB,YAAY,GAAG,IAAI,CAerB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,CAAC,EAAE,oBAAoB,EACvB,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GACjC,OAAO,CAAC,QAAQ,CAAC,CAiEnB"}

package/dist/delegation-http/pickup-routes.js

@@ -17,7 +17,9 @@
  */
 import { getAnchorStub } from "./anchor-routing";
 import { isAnchorSid } from "./sid";
-import { PICKUP_TOKEN_HEADER, INTERNAL_PICKUP_POLL, KYAOS_ERRORS, } from "./constants";
+import { claimNativeReplay, nativeError, nativeUnavailable } from "./native-http";
+import { verifyNativePoll } from "./native-pickup";
+import { PICKUP_TOKEN_HEADER, INTERNAL_PICKUP_POLL, INTERNAL_PICKUP_INFO, KYAOS_ERRORS, } from "./constants";
 /** A 404 invalid-session response (no-store JSON), used for a malformed/unknown sid. */
 function invalidSession() {
     return new Response(JSON.stringify({ error: KYAOS_ERRORS.invalidSession }), {
@@ -91,6 +93,58 @@ export async function handlePickupGet(c, env, cfg) {
         // Malformed sid — never routes to a durable object.
         return invalidSession();
     }
+    if (![PICKUP_TOKEN_HEADER, "Signature", "Signature-Input"].some((name) => c.req.header(name) !== undefined)) {
+        return cfg.native ? nativeError("kyaos/missing-signature", 401) : missingPickupHolder();
+    }
+    // Anchor metadata is read only through the internal DO seam. Native mode is
+    // immutable registration state; it is never selected by the poller's headers.
+    if (!env.MCP_OBJECT)
+        return nativeUnavailable();
+    const stub = getAnchorStub(env, sid);
+    let info;
+    try {
+        const response = await stub.fetch("https://do.internal" + INTERNAL_PICKUP_INFO, {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ sid }),
+        });
+        if (response.status === 404 || response.status === 410)
+            return response;
+        if (!response.ok)
+            return nativeUnavailable();
+        info = await response.json();
+    }
+    catch {
+        return nativeUnavailable();
+    }
+    if (info.nativeHttp) {
+        if (!cfg.native || !c.req.raw || info.nativeIssuerDid !== cfg.native.issuerDid || !info.audience)
+            return nativeUnavailable();
+        const request = c.req.raw;
+        const identity = await verifyNativePoll(request, cfg.native.authorizationOrigin);
+        if (!identity.ok)
+            return nativeError(identity.error, identity.status);
+        let sourceIp;
+        try {
+            sourceIp = cfg.native.resolveSourceIp ? cfg.native.resolveSourceIp(request) :
+                ("cf" in request && request.cf ? request.headers.get("CF-Connecting-IP") : null);
+        }
+        catch {
+            return nativeError("kyaos/replay-state-unavailable", 503);
+        }
+        if (!sourceIp)
+            return nativeError("kyaos/replay-state-unavailable", 503);
+        const result = await claimNativeReplay(env, cfg.native, { resourceDid: info.audience, ...identity.proof, sourceIp });
+        if (result !== "claimed")
+            return nativeError(result === "replay" ? "kyaos/replay" : result === "capacity" ? "kyaos/replay-capacity" : "kyaos/replay-state-unavailable", result === "replay" ? 401 : result === "capacity" ? 429 : 503);
+        try {
+            return await stub.fetch("https://do.internal" + INTERNAL_PICKUP_POLL, {
+                method: "POST", headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ sid, holder: { type: "keyid", value: identity.proof.keyId, nativeVerified: true } }),
+            });
+        }
+        catch {
+            return nativeUnavailable();
+        }
+    }
     const holder = extractPickupHolder((name) => c.req.header(name), cfg.allowUnverifiedKeyidHolders);
     if (!holder) {
         // A poll with no pickup credential is a MISSING-credential case, not a dead

package/dist/delegation-http/pickup-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"pickup-routes.js","sourceRoot":"","sources":["../../src/delegation-http/pickup-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AACpC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,GACb,MAAM,aAAa,CAAC;AAWrB,wFAAwF;AACxF,SAAS,cAAc;IACrB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,cAAc,EAAE,CAAC,EAAE;QAC1E,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB;IAC1B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,YAAY,CAAC,qBAAqB;QACzC,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,qEAAqE;QACrE,gCAAgC;QAChC,GAAG,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;KACrC,CAAC,EACF;QACE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;YAC3B,kBAAkB,EAAE,wBAAwB,mBAAmB,GAAG;SACnE;KACF,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAsD,EACtD,iBAA0B;IAE1B,MAAM,KAAK,GAAG,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC7C,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAElD,gFAAgF;IAChF,mFAAmF;IACnF,oFAAoF;IACpF,IAAI,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,QAAQ,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,QAAQ,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,CAAuB,EACvB,GAAkB,EAClB,GAAkC;IAElC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,oDAAoD;QACpD,OAAO,cAAc,EAAE,CAAC;IAC1B,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAChC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAC5B,GAAG,CAAC,2BAA2B,CAChC,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,4EAA4E;QAC5E,kFAAkF;QAClF,mFAAmF;QACnF,gDAAgD;QAChD,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE;QAClE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;KACtC,CAAC,CAAC;IACH,kFAAkF;IAClF,sFAAsF;IACtF,OAAO,UAAiC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"pickup-routes.js","sourceRoot":"","sources":["../../src/delegation-http/pickup-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,iBAAiB,EAA4B,MAAM,eAAe,CAAC;AAC5G,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,GACb,MAAM,aAAa,CAAC;AAYrB,wFAAwF;AACxF,SAAS,cAAc;IACrB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,cAAc,EAAE,CAAC,EAAE;QAC1E,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB;IAC1B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,YAAY,CAAC,qBAAqB;QACzC,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,qEAAqE;QACrE,gCAAgC;QAChC,GAAG,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;KACrC,CAAC,EACF;QACE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;YAC3B,kBAAkB,EAAE,wBAAwB,mBAAmB,GAAG;SACnE;KACF,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAsD,EACtD,iBAA0B;IAE1B,MAAM,KAAK,GAAG,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC7C,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAElD,gFAAgF;IAChF,mFAAmF;IACnF,oFAAoF;IACpF,IAAI,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,QAAQ,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,QAAQ,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,CAAuB,EACvB,GAAkB,EAClB,GAAkC;IAElC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,oDAAoD;QACpD,OAAO,cAAc,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,CAAC,mBAAmB,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;QAC5G,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;IAC1F,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,IAAI,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO,iBAAiB,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,IAAuF,CAAC;IAC5F,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,GAAG,oBAAoB,EAAE;YAC9E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC;SAC/F,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,QAA+B,CAAC;QAC/F,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,iBAAiB,EAAE,CAAC;QAC7C,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAiB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,iBAAiB,EAAE,CAAC;IAAC,CAAC;IACvC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,eAAe,KAAK,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,iBAAiB,EAAE,CAAC;QAC7H,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtE,IAAI,QAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC3E,CAAC,IAAI,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,WAAW,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;QACtE,IAAI,CAAC,QAAQ;YAAE,OAAO,WAAW,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrH,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gCAAgC,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvO,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,GAAG,oBAAoB,EAAE;gBACpE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;aAC5G,CAAwB,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,iBAAiB,EAAE,CAAC;QAAC,CAAC;IACzC,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAChC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAC5B,GAAG,CAAC,2BAA2B,CAChC,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,4EAA4E;QAC5E,kFAAkF;QAClF,mFAAmF;QACnF,gDAAgD;QAChD,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE;QAClE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;KACtC,CAAC,CAAC;IACH,kFAAkF;IAClF,sFAAsF;IACtF,OAAO,UAAiC,CAAC;AAC3C,CAAC"}

package/dist/delegation-http/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/delegation-http/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAQ,MAAM,MAAM,CAAC;AAMvC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAEnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAmBnE,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,cAAc,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACpE;AA2BD;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,EACT,OAAO,EAAE,oBAAoB,EAC7B,IAAI,CAAC,EAAE,uBAAuB,GAC7B,IAAI,CAwDN"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/delegation-http/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAQ,MAAM,MAAM,CAAC;AAMvC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAEnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAmBnE,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,cAAc,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACpE;AA2BD;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,EACT,OAAO,EAAE,oBAAoB,EAC7B,IAAI,CAAC,EAAE,uBAAuB,GAC7B,IAAI,CAqDN"}

package/dist/delegation-http/register.js

@@ -51,7 +51,7 @@ export function registerDelegationHttpRoutes(app, options, deps) {
             return next();
         return handlePickupGet(c, env, cfg);
     });
-    // Anchor consent surface. Only intercepts `?sid=kya-…`; everything else (and any
+    // Anchor consent surface. Only intercepts an explicit valid `?sid=…`; everything else (and any
     // flag-off request) falls through to the legacy consent service.
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     app.all(CONSENT_ROUTE, async (c, next) => {
@@ -61,12 +61,9 @@ export function registerDelegationHttpRoutes(app, options, deps) {
             return next();
         return handleAnchorConsentGet(c, sid, env, cfg);
     });
-    // Anchor approval POST. The legacy raw-HTML form posted to
-    // `/consent/approve?sid=kya-…` (sid in the query). The `@kya-os/consent` Lit
-    // component instead POSTs to a hardcoded `/consent/approve` with the sid
-    // carried in the body as `session_id` — `resolveApproveSid` checks the query
-    // FIRST and only peeks a *clone* of the body when it's absent, so a flag-off
-    // or non-anchor request's original body stream is never consumed here.
+    // Anchor approval POST. Explicit `sid` selects anchors; generic `session_id`
+    // selects them only for older kya-prefixed forms. The resolver peeks a clone,
+    // leaving ordinary legacy submissions and their body intact for next().
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     app.post(`${CONSENT_ROUTE}/approve`, async (c, next) => {
         const { env, cfg } = resolveRequest(c, options);

package/dist/delegation-http/register.js.map

@@ -1 +1 @@
-{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/delegation-http/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AAOvD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAQ/B;;;;GAIG;AACH,SAAS,cAAc;AACrB,8DAA8D;AAC9D,CAAM,EACN,OAA6B;IAE7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS;YAC3B,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAA4B,EAAE,OAAO,CAAC,SAAS,CAAC;YACnE,CAAC,CAAE,CAAC,CAAC,GAAqB,CAAC;QAC7B,MAAM,GAAG,GAAG,0BAA0B,CACpC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAC7B,GAAyC,CAC1C,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;QAChF,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAoB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,GAAS,EACT,OAA6B,EAC7B,IAA8B;IAE9B,iFAAiF;IACjF,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QACjD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,EAAE,CAAC;QACxB,OAAO,eAAe,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,iFAAiF;IACjF,iEAAiE;IACjE,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAClD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC,CAA2B,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,2DAA2D;IAC3D,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,uEAAuE;IACvE,8DAA8D;IAC9D,GAAG,CAAC,IAAI,CAAC,GAAG,aAAa,UAAU,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAChE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,CAA2B,CAAC,CAAC;QACjE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACrC,OAAO,0BAA0B,CAC/B,CAA2B,EAC3B,GAAG,EACH,GAAG,EACH,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,CAAC;IAC5C,8DAA8D;IAC9D,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAC/D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACtE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,OAAO,wBAAwB,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE;YAC3C,aAAa;YACb,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;SACxC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/delegation-http/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AAOvD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAQ/B;;;;GAIG;AACH,SAAS,cAAc;AACrB,8DAA8D;AAC9D,CAAM,EACN,OAA6B;IAE7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS;YAC3B,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAA4B,EAAE,OAAO,CAAC,SAAS,CAAC;YACnE,CAAC,CAAE,CAAC,CAAC,GAAqB,CAAC;QAC7B,MAAM,GAAG,GAAG,0BAA0B,CACpC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAC7B,GAAyC,CAC1C,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;QAChF,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAoB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,GAAS,EACT,OAA6B,EAC7B,IAA8B;IAE9B,iFAAiF;IACjF,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QACjD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,EAAE,CAAC;QACxB,OAAO,eAAe,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,+FAA+F;IAC/F,iEAAiE;IACjE,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAClD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC,CAA2B,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,8DAA8D;IAC9D,GAAG,CAAC,IAAI,CAAC,GAAG,aAAa,UAAU,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAChE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,CAA2B,CAAC,CAAC;QACjE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACrC,OAAO,0BAA0B,CAC/B,CAA2B,EAC3B,GAAG,EACH,GAAG,EACH,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,CAAC;IAC5C,8DAA8D;IAC9D,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAM,EAAE,IAAU,EAAE,EAAE;QAC/D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,IAAI,CAAC,2BAA2B,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACtE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,OAAO,wBAAwB,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE;YAC3C,aAAa;YACb,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;SACxC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/delegation-http/remote-issuer.d.ts

@@ -0,0 +1,37 @@
+import { type NativeHttpChallenge, type NativeHttpHostConfig } from "./native-http";
+import type { DetachedProof } from "../proof-generator";
+export interface NativeRemoteMint {
+    session_id: string;
+    holder_keyid: string;
+    user_did: string;
+    required_scopes: string[];
+    audience: string;
+    policy_id: string;
+    composed_blob_hash: string;
+    terms_accepted: boolean;
+    amr: string[];
+}
+export interface NativeRemoteIssuer {
+    /** Renew the org assertion for an existing native grant. The outbound
+     * consumer must still join the returned proof to its exact VC, holder and
+     * configured resource before signing/transmitting the request. */
+    propagationProof(delegationId: string): Promise<{
+        proof: string;
+        expires_at: number;
+    }>;
+    registerChallenge(registration: unknown, expected: NativeHttpChallenge, audience: string): Promise<{
+        proof: DetachedProof;
+        issuedAtMs: number;
+    }>;
+    issueDelegation(input: NativeRemoteMint): Promise<{
+        vcJwt: string;
+        subjectDid: string;
+        expiresAtUnix: number;
+    }>;
+}
+/** The deployment binding contains the org's PUBLIC assertion key only. It is
+ * provisioned by Checkpoint alongside the exact API-key role. The request path
+ * cannot supply a signer, control-plane URL, authorization origin or trust key.
+ */
+export declare function resolveManagedNativeIssuer(env: Record<string, unknown>): NativeHttpHostConfig | null;
+//# sourceMappingURL=remote-issuer.d.ts.map

package/dist/delegation-http/remote-issuer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-issuer.d.ts","sourceRoot":"","sources":["../../src/delegation-http/remote-issuer.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AACD,MAAM,WAAW,kBAAkB;IACjC;;sEAEkE;IAClE,gBAAgB,CACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,iBAAiB,CACf,YAAY,EAAE,OAAO,EACrB,QAAQ,EAAE,mBAAmB,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QACT,KAAK,EAAE,aAAa,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,eAAe,CACb,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1E;AAiDD;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,oBAAoB,GAAG,IAAI,CAqD7B"}