@kya-os/mcp-i-cloudflare 1.14.7 → 1.15.0

package/dist/services/delegation-mandate.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Delegation mandate: request shaping
+ *
+ * A server-bound mandate (CloudflareRuntimeConfig.delegationMandate) must
+ * reach Checkpoint on whichever delegation-create body is actually POSTed.
+ * buildDelegationRequest returns either one body (a cached format) or a
+ * try-both wrapper with a full and a simplified body; both bodies need the
+ * same top-level `constraints`, or a fallback would create an unconstrained
+ * grant.
+ *
+ * @module @kya-os/mcp-i-cloudflare/services/delegation-mandate
+ */
+import type { DelegationMandate } from "../config";
+/**
+ * A delegation-create body, or the try-both wrapper that
+ * buildDelegationRequest returns when no request format is cached.
+ */
+export type DelegationCreateRequest = Record<string, unknown> & {
+    _tryFormats?: boolean;
+    fullFormat?: Record<string, unknown>;
+    simplifiedFormat?: Record<string, unknown>;
+};
+/**
+ * Add the mandate's constraints as top-level `constraints` on every body the
+ * request may POST. Never mutates the input.
+ *
+ * Constraints come only from the server's mandate, never from client-supplied
+ * fields such as `customFields`.
+ *
+ * @example
+ * ```typescript
+ * withMandateConstraints({ agent_did, scopes }, { crisp });
+ * // { agent_did, scopes, constraints: { crisp } }
+ *
+ * withMandateConstraints({ _tryFormats: true, fullFormat, simplifiedFormat }, { crisp });
+ * // both fullFormat and simplifiedFormat gain constraints: { crisp }
+ * ```
+ */
+export declare function withMandateConstraints(request: DelegationCreateRequest, constraints: DelegationMandate["constraints"]): DelegationCreateRequest;
+//# sourceMappingURL=delegation-mandate.d.ts.map

package/dist/services/delegation-mandate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-mandate.d.ts","sourceRoot":"","sources":["../../src/services/delegation-mandate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnD;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAC9D,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C,CAAC;AASF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,EAChC,WAAW,EAAE,iBAAiB,CAAC,aAAa,CAAC,GAC5C,uBAAuB,CAczB"}

package/dist/services/delegation-mandate.js

@@ -0,0 +1,46 @@
+/**
+ * Delegation mandate: request shaping
+ *
+ * A server-bound mandate (CloudflareRuntimeConfig.delegationMandate) must
+ * reach Checkpoint on whichever delegation-create body is actually POSTed.
+ * buildDelegationRequest returns either one body (a cached format) or a
+ * try-both wrapper with a full and a simplified body; both bodies need the
+ * same top-level `constraints`, or a fallback would create an unconstrained
+ * grant.
+ *
+ * @module @kya-os/mcp-i-cloudflare/services/delegation-mandate
+ */
+function withConstraints(body, constraints) {
+    return { ...body, constraints };
+}
+/**
+ * Add the mandate's constraints as top-level `constraints` on every body the
+ * request may POST. Never mutates the input.
+ *
+ * Constraints come only from the server's mandate, never from client-supplied
+ * fields such as `customFields`.
+ *
+ * @example
+ * ```typescript
+ * withMandateConstraints({ agent_did, scopes }, { crisp });
+ * // { agent_did, scopes, constraints: { crisp } }
+ *
+ * withMandateConstraints({ _tryFormats: true, fullFormat, simplifiedFormat }, { crisp });
+ * // both fullFormat and simplifiedFormat gain constraints: { crisp }
+ * ```
+ */
+export function withMandateConstraints(request, constraints) {
+    if (!request._tryFormats) {
+        return withConstraints(request, constraints);
+    }
+    return {
+        ...request,
+        fullFormat: request.fullFormat
+            ? withConstraints(request.fullFormat, constraints)
+            : undefined,
+        simplifiedFormat: request.simplifiedFormat
+            ? withConstraints(request.simplifiedFormat, constraints)
+            : undefined,
+    };
+}
+//# sourceMappingURL=delegation-mandate.js.map

package/dist/services/delegation-mandate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-mandate.js","sourceRoot":"","sources":["../../src/services/delegation-mandate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAcH,SAAS,eAAe,CACtB,IAA6B,EAC7B,WAA6C;IAE7C,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAgC,EAChC,WAA6C;IAE7C,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO;QACL,GAAG,OAAO;QACV,UAAU,EAAE,OAAO,CAAC,UAAU;YAC5B,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC;YAClD,CAAC,CAAC,SAAS;QACb,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YACxC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,gBAAgB,EAAE,WAAW,CAAC;YACxD,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC"}

package/dist/services/delegation.service.d.ts

@@ -6,7 +6,7 @@
  *
  * Supports both:
  * - Local VC-JWT verification (offline, cryptographic)
- * - AgentShield API verification (online, centralized)
+ * - Checkpoint API verification (online, centralized)
  */
 import type { CloudflareEnv } from "../types";
 import type { CloudflareRuntime } from "../runtime";
@@ -60,7 +60,7 @@ export declare class DelegationService {
     private isVCJWT;
     /**
      * Verify a VC-JWT locally using cryptographic verification
-     * This enables offline/local verification without calling AgentShield API
+     * This enables offline/local verification without calling Checkpoint API
      *
      * @param vcJwt - The VC-JWT string to verify
      * @returns Verification result with extracted delegation data
@@ -74,28 +74,44 @@ export declare class DelegationService {
      * @returns true if token is expired, false otherwise
      */
     private isTokenExpired;
+    /**
+     * Collision-resistant cache-key input for a token: SHA-256 hex of the FULL
+     * token. NOT a prefix — the first 16 chars of every EdDSA JWT are the
+     * identical base64url header (`eyJhbGciOiJFZERT` = `{"alg":"EdDSA"`), so a
+     * prefixed key collides across all EdDSA tokens; one cached positive would
+     * then admit any forged token. Keying on the full-token digest gives each
+     * distinct token a distinct cache entry.
+     */
+    private hashToken;
     /**
      * Verify delegation token - supports both VC-JWT and legacy tokens
      *
      * Verification strategy:
      * 1. Early expiration check (cheap, before any crypto)
      * 2. Check cache
-     * 3. If token is a VC-JWT, try local cryptographic verification
-     * 4. Fall back to AgentShield API if needed
+     * 3. If token is a VC-JWT, verify its signature locally, which refuses a
+     *    forged or malformed credential without a network call
+     * 4. Confirm with Checkpoint that the delegation is still in force. A valid
+     *    signature proves who issued the credential, not that it was never
+     *    revoked; revocation lives at Checkpoint. Only a deployment with no
+     *    Checkpoint API key (development) skips this and cannot see revocation.
+     *
+     * With a Checkpoint API key no verdict is cached: every verification asks
+     * Checkpoint, so a revocation refuses the very next call. Only the
+     * development path, which cannot see revocation anyway, caches a VC-JWT's
+     * verified signature for DEFAULT_VERIFICATION_CACHE_TTL seconds.
      *
      * @param token - Delegation token to verify
      * @returns True if token is valid, false otherwise
      */
+    verifyDelegation(token: string): Promise<boolean>;
     /**
-     * Collision-resistant cache-key input for a token: SHA-256 hex of the FULL
-     * token. NOT a prefix — the first 16 chars of every EdDSA JWT are the
-     * identical base64url header (`eyJhbGciOiJFZERT` = `{"alg":"EdDSA"`), so a
-     * prefixed key collides across all EdDSA tokens; one cached positive would
-     * then admit any forged token. Keying on the full-token digest gives each
-     * distinct token a distinct cache entry.
+     * Asks Checkpoint whether the delegation behind `token` is in force.
+     * Checkpoint answers every verification with HTTP 200 and the verdict in
+     * `data.valid` (a revoked delegation is `valid: false`), so only an explicit
+     * `valid: true` counts; any other answer or error fails closed.
      */
-    private hashToken;
-    verifyDelegation(token: string): Promise<boolean>;
+    private confirmWithCheckpoint;
     /**
      * Invalidate delegation token in all caches
      * @param sessionId - Session ID to clear

package/dist/services/delegation.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delegation.service.d.ts","sourceRoot":"","sources":["../../src/services/delegation.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAO9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AASpD;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,iCAAiC;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,GAAG,CAAgB;IAC3B,OAAO,CAAC,OAAO,CAAC,CAAoB;gBAExB,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,iBAAiB;IAK3D;;;;OAIG;IACG,kBAAkB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAoIpE;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;IAuBf;;;;;;OAMG;YACW,kBAAkB;IAgKhC;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IA8BtB;;;;;;;;;;;OAWG;IACH;;;;;;;OAOG;YACW,SAAS;IAUjB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA0KvD;;;;;OAKG;IACG,eAAe,CACnB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;CAoDjB"}
+{"version":3,"file":"delegation.service.d.ts","sourceRoot":"","sources":["../../src/services/delegation.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAO9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AASpD;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,iCAAiC;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,GAAG,CAAgB;IAC3B,OAAO,CAAC,OAAO,CAAC,CAAoB;gBAExB,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,iBAAiB;IAK3D;;;;OAIG;IACG,kBAAkB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAoIpE;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;IAuBf;;;;;;OAMG;YACW,kBAAkB;IAgKhC;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IA8BtB;;;;;;;OAOG;YACW,SAAS;IAUvB;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA6DvD;;;;;OAKG;YACW,qBAAqB;IAsDnC;;;;;OAKG;IACG,eAAe,CACnB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;CAoDjB"}

package/dist/services/delegation.service.js

@@ -6,9 +6,9 @@
  *
  * Supports both:
  * - Local VC-JWT verification (offline, cryptographic)
- * - AgentShield API verification (online, centralized)
+ * - Checkpoint API verification (online, centralized)
  */
-import { DEFAULT_AGENTSHIELD_URL, DEFAULT_VERIFICATION_CACHE_TTL, DEFAULT_SESSION_CACHE_TTL, } from "../constants";
+import { DEFAULT_CHECKPOINT_URL, DEFAULT_VERIFICATION_CACHE_TTL, DEFAULT_SESSION_CACHE_TTL, } from "../constants";
 import { STORAGE_KEYS } from "../constants/storage-keys";
 import { parseVCJWT, createDidKeyResolver, base64urlDecodeToBytes, bytesToBase64, } from "@kya-os/mcp";
 import { WebCryptoProvider } from "../providers/crypto";
@@ -148,7 +148,7 @@ export class DelegationService {
     }
     /**
      * Verify a VC-JWT locally using cryptographic verification
-     * This enables offline/local verification without calling AgentShield API
+     * This enables offline/local verification without calling Checkpoint API
      *
      * @param vcJwt - The VC-JWT string to verify
      * @returns Verification result with extracted delegation data
@@ -317,18 +317,6 @@ export class DelegationService {
             return false;
         }
     }
-    /**
-     * Verify delegation token - supports both VC-JWT and legacy tokens
-     *
-     * Verification strategy:
-     * 1. Early expiration check (cheap, before any crypto)
-     * 2. Check cache
-     * 3. If token is a VC-JWT, try local cryptographic verification
-     * 4. Fall back to AgentShield API if needed
-     *
-     * @param token - Delegation token to verify
-     * @returns True if token is valid, false otherwise
-     */
     /**
      * Collision-resistant cache-key input for a token: SHA-256 hex of the FULL
      * token. NOT a prefix — the first 16 chars of every EdDSA JWT are the
@@ -343,6 +331,27 @@ export class DelegationService {
             .map((b) => b.toString(16).padStart(2, "0"))
             .join("");
     }
+    /**
+     * Verify delegation token - supports both VC-JWT and legacy tokens
+     *
+     * Verification strategy:
+     * 1. Early expiration check (cheap, before any crypto)
+     * 2. Check cache
+     * 3. If token is a VC-JWT, verify its signature locally, which refuses a
+     *    forged or malformed credential without a network call
+     * 4. Confirm with Checkpoint that the delegation is still in force. A valid
+     *    signature proves who issued the credential, not that it was never
+     *    revoked; revocation lives at Checkpoint. Only a deployment with no
+     *    Checkpoint API key (development) skips this and cannot see revocation.
+     *
+     * With a Checkpoint API key no verdict is cached: every verification asks
+     * Checkpoint, so a revocation refuses the very next call. Only the
+     * development path, which cannot see revocation anyway, caches a VC-JWT's
+     * verified signature for DEFAULT_VERIFICATION_CACHE_TTL seconds.
+     *
+     * @param token - Delegation token to verify
+     * @returns True if token is valid, false otherwise
+     */
     async verifyDelegation(token) {
         // Early expiration check - reject expired tokens before any other processing
         // This is a cheap check that doesn't require crypto or API calls
@@ -350,8 +359,11 @@ export class DelegationService {
             console.error("[Delegation] Token rejected: expired (exp claim)");
             return false;
         }
-        // Check verification cache first
-        const verificationCache = this.env.TOOL_PROTECTION_KV;
+        // Only development (no Checkpoint) caches: a cached positive would outlive
+        // a revocation at Checkpoint.
+        const verificationCache = this.env.CHECKPOINT_API_KEY
+            ? undefined
+            : this.env.TOOL_PROTECTION_KV;
         if (verificationCache) {
             const cacheKey = STORAGE_KEYS.verificationCache(await this.hashToken(token));
             const cached = await verificationCache.get(cacheKey);
@@ -360,110 +372,87 @@ export class DelegationService {
                 return true;
             }
         }
-        // Try local VC-JWT verification first (offline, cryptographic)
-        if (this.isVCJWT(token)) {
+        let agentDid;
+        let scopes = [];
+        const isVCJWT = this.isVCJWT(token);
+        if (isVCJWT) {
             console.error("[Delegation] Detected VC-JWT format, attempting local verification");
             const vcResult = await this.verifyVCJWTLocally(token);
-            if (vcResult.valid) {
-                // Cache successful local verification
-                if (verificationCache) {
-                    const cacheKey = STORAGE_KEYS.verificationCache(await this.hashToken(token));
-                    await verificationCache.put(cacheKey, "1", {
-                        expirationTtl: DEFAULT_VERIFICATION_CACHE_TTL,
-                    });
-                }
-                return true;
+            if (!vcResult.valid) {
+                // If the cryptographic signature is invalid, the token is invalid
+                console.error("[Delegation] Local VC-JWT verification failed:", vcResult.error);
+                return false;
             }
-            // Local verification failed - don't fall back to API for VC-JWTs
-            // If the cryptographic signature is invalid, the token is invalid
-            console.error("[Delegation] Local VC-JWT verification failed:", vcResult.error);
+            agentDid = vcResult.agentDid ?? "";
+            scopes = vcResult.scopes ?? [];
+        }
+        else {
+            agentDid = this.runtime ? (await this.runtime.getIdentity()).did : "";
+        }
+        if (!this.env.CHECKPOINT_API_KEY) {
+            console.warn("[Delegation] No Checkpoint API key configured: accepting without Checkpoint, which cannot see revocation");
+            // Development: a legacy token is allowed unchecked and never cached; a
+            // VC-JWT's verified signature is cached as before.
+            if (!isVCJWT)
+                return true;
+        }
+        else if (!(await this.confirmWithCheckpoint(token, agentDid, scopes))) {
             return false;
         }
-        // Not a VC-JWT - use AgentShield API verification
+        if (verificationCache) {
+            const cacheKey = STORAGE_KEYS.verificationCache(await this.hashToken(token));
+            await verificationCache.put(cacheKey, "1", {
+                expirationTtl: DEFAULT_VERIFICATION_CACHE_TTL,
+            });
+        }
+        console.error("[Delegation] Token verified");
+        return true;
+    }
+    /**
+     * Asks Checkpoint whether the delegation behind `token` is in force.
+     * Checkpoint answers every verification with HTTP 200 and the verdict in
+     * `data.valid` (a revoked delegation is `valid: false`), so only an explicit
+     * `valid: true` counts; any other answer or error fails closed.
+     */
+    async confirmWithCheckpoint(token, agentDid, scopes) {
+        const request = { agent_did: agentDid, delegation_token: token, scopes };
         try {
-            const agentShieldUrl = this.env.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
-            const apiKey = this.env.AGENTSHIELD_API_KEY;
-            if (!apiKey) {
-                console.warn("[Delegation] No AgentShield API key configured, skipping verification");
-                return true; // Allow in development without API key
-            }
             // Use AccessControlApiService if available from runtime
             if (this.runtime && "accessControlService" in this.runtime) {
-                const runtimeWithAccessControl = this
-                    .runtime;
-                const accessControlService = runtimeWithAccessControl.accessControlService;
+                const accessControlService = this.runtime.accessControlService;
                 if (accessControlService) {
-                    try {
-                        // Get agent DID from runtime if available
-                        const agentDid = this.runtime
-                            ? (await this.runtime.getIdentity()).did
-                            : undefined;
-                        // Build request with delegation_token
-                        const request = {
-                            agent_did: agentDid || "", // Required field, but token verification may not need it
-                            delegation_token: token,
-                            scopes: [], // Empty scopes for token verification
-                        };
-                        const response = await accessControlService.verifyDelegation(request);
-                        const isValid = response.data.valid;
-                        if (isValid) {
-                            // Cache successful verification
-                            if (verificationCache) {
-                                const cacheKey = STORAGE_KEYS.verificationCache(await this.hashToken(token));
-                                await verificationCache.put(cacheKey, "1", {
-                                    expirationTtl: DEFAULT_VERIFICATION_CACHE_TTL,
-                                });
-                            }
-                            console.error("[Delegation] Token verified successfully with AgentShield");
-                            return true;
-                        }
-                        else {
-                            console.error("[Delegation] Token verification failed:", response.data.reason || "Invalid token");
-                            return false;
-                        }
-                    }
-                    catch (error) {
-                        console.error("[Delegation] Error verifying token via AccessControlApiService:", error);
-                        return false; // Fail closed on errors
-                    }
+                    const response = await accessControlService.verifyDelegation(request);
+                    if (response.data.valid)
+                        return true;
+                    console.error("[Delegation] Token verification failed:", response.data.reason || "Invalid token");
+                    return false;
                 }
             }
-            // Fallback to direct fetch if AccessControlApiService not available
-            // Note: This uses the old API format - should be updated to match new API
-            const response = await fetch(`${agentShieldUrl}/api/v1/bouncer/delegations/verify`, {
+            const checkpointUrl = this.env.CHECKPOINT_API_URL || DEFAULT_CHECKPOINT_URL;
+            const response = await fetch(`${checkpointUrl}/api/v1/bouncer/delegations/verify`, {
                 method: "POST",
                 headers: {
-                    Authorization: `Bearer ${apiKey}`,
+                    Authorization: `Bearer ${this.env.CHECKPOINT_API_KEY}`,
                     "Content-Type": "application/json",
                 },
-                body: JSON.stringify({
-                    agent_did: this.runtime
-                        ? (await this.runtime.getIdentity()).did
-                        : "",
-                    delegation_token: token,
-                    scopes: [],
-                }),
+                body: JSON.stringify(request),
             });
-            if (response.ok) {
-                // Cache successful verification
-                if (verificationCache) {
-                    const cacheKey = STORAGE_KEYS.verificationCache(await this.hashToken(token));
-                    await verificationCache.put(cacheKey, "1", {
-                        expirationTtl: DEFAULT_VERIFICATION_CACHE_TTL,
-                    });
-                }
-                console.error("[Delegation] Token verified successfully with AgentShield");
-                return true;
-            }
             if (response.status === 401 || response.status === 403) {
                 console.error("[Delegation] Token verification failed: unauthorized");
                 return false;
             }
-            console.warn("[Delegation] Token verification returned unexpected status:", response.status);
-            return false; // Fail closed for security
+            if (!response.ok) {
+                console.warn("[Delegation] Token verification returned unexpected status:", response.status);
+                return false; // Fail closed for security
+            }
+            const body = (await response.json().catch(() => null));
+            if (body?.data?.valid === true)
+                return true;
+            console.error("[Delegation] Token verification failed:", body?.data?.error?.code || "no valid verdict");
+            return false;
         }
         catch (error) {
-            console.error("[Delegation] Error verifying token with AgentShield:", error);
+            console.error("[Delegation] Error verifying token with Checkpoint:", error);
             return false; // Fail closed on errors
         }
     }

package/dist/services/delegation.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"delegation.service.js","sourceRoot":"","sources":["../../src/services/delegation.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,sBAAsB,EACtB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AA8BxD,MAAM,OAAO,iBAAiB;IACpB,GAAG,CAAgB;IACnB,OAAO,CAAqB;IAEpC,YAAY,GAAkB,EAAE,OAA2B;QACzD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,SAAkB;QACzC,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAEtD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,qEAAqE;YACrE,wCAAwC;YACxC,IAAI,OAA2B,CAAC;YAChC,IAAI,QAA4B,CAAC;YACjC,IAAI,WAAW,GAIJ,IAAI,CAAC;YAEhB,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACnD,WAAW,GAAG,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAItD,CAAC;gBACT,OAAO,GAAG,WAAW,EAAE,OAAO,CAAC;gBAC/B,QAAQ,GAAG,WAAW,EAAE,QAAQ,CAAC;YACnC,CAAC;YAED,8CAA8C;YAC9C,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBAClD,QAAQ,GAAG,QAAQ,EAAE,GAAG,CAAC;YAC3B,CAAC;YAED,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;gBACxB,MAAM,YAAY,GAAG,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAChE,OAAO,CAAC,KAAK,CACX,6DAA6D,EAC7D;oBACE,GAAG,EAAE,YAAY;oBACjB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;oBACrC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;iBACxC,CACF,CAAC;gBACF,MAAM,cAAc,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAChD,YAAY,EACZ,MAAM,CACP,CAAC;gBAEF,IAAI,cAAc,EAAE,CAAC;oBACnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;oBAC5D,IAAI,OAAO,EAAE,CAAC;wBACZ,OAAO,CAAC,KAAK,CACX,8EAA8E,CAC/E,CAAC;wBAEF,+BAA+B;wBAC/B,IAAI,SAAS,EAAE,CAAC;4BACd,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;4BACnD,MAAM,iBAAiB,CAAC,GAAG,CACzB,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;gCACb,GAAG,WAAW;gCACd,eAAe,EAAE,cAAc;gCAC/B,OAAO;gCACP,QAAQ;6BACT,CAAC,EACF;gCACE,aAAa,EAAE,yBAAyB;6BACzC,CACF,CAAC;wBACJ,CAAC;wBAED,OAAO,cAAc,CAAC;oBACxB,CAAC;yBAAM,CAAC;wBACN,mCAAmC;wBACnC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;wBAChE,OAAO,CAAC,KAAK,CACX,kEAAkE,CACnE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,qEAAqE;YACrE,IAAI,SAAS,IAAI,WAAW,EAAE,eAAe,EAAE,CAAC;gBAC9C,OAAO,CAAC,KAAK,CACX,4DAA4D,EAC5D;oBACE,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;iBAC1C,CACF,CAAC;gBACF,+CAA+C;gBAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CACzC,WAAW,CAAC,eAAe,CAC5B,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,KAAK,CACX,4EAA4E,CAC7E,CAAC;oBACF,OAAO,WAAW,CAAC,eAAe,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACN,mCAAmC;oBACnC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,eAAe,CAAC,CAAC;oBACnE,OAAO,CAAC,KAAK,CACX,8DAA8D,CAC/D,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,uDAAuD;YACvD,gFAAgF;YAChF,oEAAoE;YACpE,8DAA8D;YAE9D,OAAO,CAAC,KAAK,CACX,2EAA2E,EAC3E;gBACE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM;gBAC9D,UAAU,EAAE,CAAC,CAAC,OAAO;gBACrB,IAAI,EAAE,+EAA+E;aACtF,CACF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,OAAO,CAAC,KAAa;QAC3B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAEtD,IAAI,CAAC;YACH,mDAAmD;YACnD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAE1B,6CAA6C;YAC7C,4DAA4D;YAC5D,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC;YAEhD,0DAA0D;YAC1D,oEAAoE;YACpE,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAE1D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,kBAAkB,CAAC,KAAa;QAC5C,IAAI,CAAC;YACH,mBAAmB;YACnB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YAC1D,CAAC;YAED,qCAAqC;YACrC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAyB,CAAC;YAC3D,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAChD,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC1D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;YACzD,CAAC;YAED,0CAA0C;YAC1C,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;gBACnD,OAAO,CAAC,KAAK,CACX,+DAA+D,EAC/D,SAAS,CACV,CAAC;gBACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,SAAS,EAAE,EAAE,CAAC;YAC5E,CAAC;YAED,0CAA0C;YAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,YAAmD,CAAC;YAC7F,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBACtE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;YACpE,CAAC;YAED,qDAAqD;YACrD,MAAM,cAAc,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAW,CAAC,CAAC;YAC/D,MAAM,eAAe,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;YAEtD,0BAA0B;YAC1B,MAAM,iBAAiB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACxE,MAAM,cAAc,GAAG,sBAAsB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAEhE,MAAM,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;YACvC,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,MAAM,CAC1C,iBAAiB,EACjB,cAAc,EACd,eAAe,CAChB,CAAC;YAEF,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBACnE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;YAClE,CAAC;YAED,yEAAyE;YACzE,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAA6B,CAAC;YACxD,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;YACrD,CAAC;YAED,gBAAgB;YAChB,MAAM,KAAK,GAAG,EAAE,CAAC,IAA4B,CAAC;YAC9C,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBACxD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACvD,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;gBACvE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;YACtE,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;gBACvE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;YACtE,CAAC;YAED,gEAAgE;YAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAyB,CAAC;YAC1D,MAAM,cAAc,GAAG,EAAE,CAAC,cAAoC,CAAC;YAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,IAAI,QAAQ,IAAI,QAAQ,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;gBACtC,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBACzD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;YAC9D,CAAC;YACD,IAAI,cAAc,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;gBAC/D,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;YACnE,CAAC;YAED,2BAA2B;YAC3B,IAAI,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBAC/D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;YAC9D,CAAC;YACD,MAAM,iBAAiB,GAAG,EAAE,CAAC,iBAA4C,CAAC;YAC1E,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,CAAC;gBAClC,OAAO,CAAC,KAAK,CACX,6DAA6D,CAC9D,CAAC;gBACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;YAC5E,CAAC;YAED,6CAA6C;YAC7C,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAqC,CAAC;YAE3E,8BAA8B;YAC9B,MAAM,YAAY,GAAI,MAAM,CAAC,OAAO,CAAC,GAAc,IAAK,UAAU,CAAC,EAAa,CAAC;YACjF,MAAM,QAAQ,GAAI,MAAM,CAAC,OAAO,CAAC,GAAc,IAAK,UAAU,CAAC,UAAqB,CAAC;YACrF,6FAA6F;YAC7F,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,0EAA0E;YAC1E,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAClC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAE7D,2FAA2F;YAC3F,MAAM,OAAO,GAAG,UAAU,CAAC,OAA6B,CAAC;YACzD,MAAM,cAAc,GAAG,UAAU,CAAC,cAAoC,CAAC;YACvE,MAAM,SAAS,GAAG,UAAU,CAAC,SAA+B,CAAC;YAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC7C,CAAC,CAAE,UAAU,CAAC,MAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBACnF,CAAC,CAAC,SAAS,CAAC;YAEd,OAAO,CAAC,KAAK,CAAC,wDAAwD,EAAE;gBACtE,YAAY;gBACZ,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC9D,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC3D,YAAY,EAAE,CAAC,CAAC,SAAS;gBACzB,UAAU,EAAE,MAAM,EAAE,MAAM;aAC3B,CAAC,CAAC;YAEH,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,YAAY;gBACZ,QAAQ;gBACR,OAAO;gBACP,cAAc;gBACd,SAAS;gBACT,MAAM;gBACN,SAAS;gBACT,SAAS;gBACT,SAAS,EAAE,QAAQ;aACpB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,sDAAsD,EACtD,KAAK,CACN,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;aAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,cAAc,CAAC,KAAa;QAClC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAEtD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAErC,+BAA+B;YAC/B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,yBAAyB;YACzB,MAAM,WAAW,GAAG,IAAI,CACtB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CACjD,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAExC,wCAAwC;YACxC,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACnD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;gBACjD,IAAI,OAAO,CAAC,GAAG,GAAG,UAAU,EAAE,CAAC;oBAC7B,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH;;;;;;;OAOG;IACK,KAAK,CAAC,SAAS,CAAC,KAAa;QACnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAChC,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,6EAA6E;QAC7E,iEAAiE;QACjE,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,iCAAiC;QACjC,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACtD,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,YAAY,CAAC,iBAAiB,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBACjE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CACX,oEAAoE,CACrE,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAEtD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnB,sCAAsC;gBACtC,IAAI,iBAAiB,EAAE,CAAC;oBACtB,MAAM,QAAQ,GAAG,YAAY,CAAC,iBAAiB,CAC7C,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAC5B,CAAC;oBACF,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE;wBACzC,aAAa,EAAE,8BAA8B;qBAC9C,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,iEAAiE;YACjE,kEAAkE;YAClE,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,kDAAkD;QAClD,IAAI,CAAC;YACH,MAAM,cAAc,GAClB,IAAI,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;YAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;YAE5C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CACV,uEAAuE,CACxE,CAAC;gBACF,OAAO,IAAI,CAAC,CAAC,uCAAuC;YACtD,CAAC;YAED,wDAAwD;YACxD,IAAI,IAAI,CAAC,OAAO,IAAI,sBAAsB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC3D,MAAM,wBAAwB,GAAG,IAAI;qBAClC,OAA8E,CAAC;gBAClF,MAAM,oBAAoB,GACxB,wBAAwB,CAAC,oBAAoB,CAAC;gBAEhD,IAAI,oBAAoB,EAAE,CAAC;oBACzB,IAAI,CAAC;wBACH,0CAA0C;wBAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO;4BAC3B,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG;4BACxC,CAAC,CAAC,SAAS,CAAC;wBAEd,sCAAsC;wBACtC,MAAM,OAAO,GAAG;4BACd,SAAS,EAAE,QAAQ,IAAI,EAAE,EAAE,yDAAyD;4BACpF,gBAAgB,EAAE,KAAK;4BACvB,MAAM,EAAE,EAAE,EAAE,sCAAsC;yBACnD,CAAC;wBAEF,MAAM,QAAQ,GACZ,MAAM,oBAAoB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;wBAEvD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;wBAEpC,IAAI,OAAO,EAAE,CAAC;4BACZ,gCAAgC;4BAChC,IAAI,iBAAiB,EAAE,CAAC;gCACtB,MAAM,QAAQ,GAAG,YAAY,CAAC,iBAAiB,CAC7C,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAC5B,CAAC;gCACF,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE;oCACzC,aAAa,EAAE,8BAA8B;iCAC9C,CAAC,CAAC;4BACL,CAAC;4BACD,OAAO,CAAC,KAAK,CACX,2DAA2D,CAC5D,CAAC;4BACF,OAAO,IAAI,CAAC;wBACd,CAAC;6BAAM,CAAC;4BACN,OAAO,CAAC,KAAK,CACX,yCAAyC,EACzC,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CACxC,CAAC;4BACF,OAAO,KAAK,CAAC;wBACf,CAAC;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,OAAO,CAAC,KAAK,CACX,iEAAiE,EACjE,KAAK,CACN,CAAC;wBACF,OAAO,KAAK,CAAC,CAAC,wBAAwB;oBACxC,CAAC;gBACH,CAAC;YACH,CAAC;YAED,oEAAoE;YACpE,0EAA0E;YAC1E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,cAAc,oCAAoC,EACrD;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,MAAM,EAAE;oBACjC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,IAAI,CAAC,OAAO;wBACrB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG;wBACxC,CAAC,CAAC,EAAE;oBACN,gBAAgB,EAAE,KAAK;oBACvB,MAAM,EAAE,EAAE;iBACX,CAAC;aACH,CACF,CAAC;YAEF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,gCAAgC;gBAChC,IAAI,iBAAiB,EAAE,CAAC;oBACtB,MAAM,QAAQ,GAAG,YAAY,CAAC,iBAAiB,CAC7C,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAC5B,CAAC;oBACF,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE;wBACzC,aAAa,EAAE,8BAA8B;qBAC9C,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,CAAC,KAAK,CACX,2DAA2D,CAC5D,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvD,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBACtE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,CAAC,IAAI,CACV,6DAA6D,EAC7D,QAAQ,CAAC,MAAM,CAChB,CAAC;YACF,OAAO,KAAK,CAAC,CAAC,2BAA2B;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,sDAAsD,EACtD,KAAK,CACN,CAAC;YACF,OAAO,KAAK,CAAC,CAAC,wBAAwB;QACxC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CACnB,SAAkB,EAClB,KAAc,EACd,QAAiB;QAEjB,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACtD,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAEtD,IAAI,CAAC,iBAAiB;YAAE,OAAO;QAE/B,MAAM,SAAS,GAAoB,EAAE,CAAC;QAEtC,uEAAuE;QACvE,IAAI,WAAW,GAAgC,IAAI,CAAC;QACpD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACnD,qDAAqD;YACrD,WAAW,GAAG,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAEtD,CAAC;YACT,wBAAwB;YACxB,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACvD,CAAC;QAED,6BAA6B;QAC7B,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,YAAY,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC1D,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YAEpD,uDAAuD;YACvD,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;gBACzB,MAAM,YAAY,GAAG,YAAY,CAAC,UAAU,CAC1C,WAAW,CAAC,OAAO,EACnB,QAAQ,CACT,CAAC;gBACF,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;gBACvD,qEAAqE;gBACrE,iEAAiE;gBACjE,qBAAqB;gBACrB,SAAS,CAAC,IAAI,CACZ,iBAAiB,CAAC,MAAM,CACtB,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAC/D,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,IAAI,KAAK,IAAI,iBAAiB,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC,iBAAiB,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7E,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC5E,CAAC;CACF"}
+{"version":3,"file":"delegation.service.js","sourceRoot":"","sources":["../../src/services/delegation.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,sBAAsB,EACtB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AA8BxD,MAAM,OAAO,iBAAiB;IACpB,GAAG,CAAgB;IACnB,OAAO,CAAqB;IAEpC,YAAY,GAAkB,EAAE,OAA2B;QACzD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,SAAkB;QACzC,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAEtD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,qEAAqE;YACrE,wCAAwC;YACxC,IAAI,OAA2B,CAAC;YAChC,IAAI,QAA4B,CAAC;YACjC,IAAI,WAAW,GAIJ,IAAI,CAAC;YAEhB,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACnD,WAAW,GAAG,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAItD,CAAC;gBACT,OAAO,GAAG,WAAW,EAAE,OAAO,CAAC;gBAC/B,QAAQ,GAAG,WAAW,EAAE,QAAQ,CAAC;YACnC,CAAC;YAED,8CAA8C;YAC9C,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBAClD,QAAQ,GAAG,QAAQ,EAAE,GAAG,CAAC;YAC3B,CAAC;YAED,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;gBACxB,MAAM,YAAY,GAAG,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAChE,OAAO,CAAC,KAAK,CACX,6DAA6D,EAC7D;oBACE,GAAG,EAAE,YAAY;oBACjB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;oBACrC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;iBACxC,CACF,CAAC;gBACF,MAAM,cAAc,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAChD,YAAY,EACZ,MAAM,CACP,CAAC;gBAEF,IAAI,cAAc,EAAE,CAAC;oBACnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;oBAC5D,IAAI,OAAO,EAAE,CAAC;wBACZ,OAAO,CAAC,KAAK,CACX,8EAA8E,CAC/E,CAAC;wBAEF,+BAA+B;wBAC/B,IAAI,SAAS,EAAE,CAAC;4BACd,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;4BACnD,MAAM,iBAAiB,CAAC,GAAG,CACzB,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;gCACb,GAAG,WAAW;gCACd,eAAe,EAAE,cAAc;gCAC/B,OAAO;gCACP,QAAQ;6BACT,CAAC,EACF;gCACE,aAAa,EAAE,yBAAyB;6BACzC,CACF,CAAC;wBACJ,CAAC;wBAED,OAAO,cAAc,CAAC;oBACxB,CAAC;yBAAM,CAAC;wBACN,mCAAmC;wBACnC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;wBAChE,OAAO,CAAC,KAAK,CACX,kEAAkE,CACnE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,qEAAqE;YACrE,IAAI,SAAS,IAAI,WAAW,EAAE,eAAe,EAAE,CAAC;gBAC9C,OAAO,CAAC,KAAK,CACX,4DAA4D,EAC5D;oBACE,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;iBAC1C,CACF,CAAC;gBACF,+CAA+C;gBAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CACzC,WAAW,CAAC,eAAe,CAC5B,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,KAAK,CACX,4EAA4E,CAC7E,CAAC;oBACF,OAAO,WAAW,CAAC,eAAe,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACN,mCAAmC;oBACnC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,eAAe,CAAC,CAAC;oBACnE,OAAO,CAAC,KAAK,CACX,8DAA8D,CAC/D,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,uDAAuD;YACvD,gFAAgF;YAChF,oEAAoE;YACpE,8DAA8D;YAE9D,OAAO,CAAC,KAAK,CACX,2EAA2E,EAC3E;gBACE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM;gBAC9D,UAAU,EAAE,CAAC,CAAC,OAAO;gBACrB,IAAI,EAAE,+EAA+E;aACtF,CACF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,OAAO,CAAC,KAAa;QAC3B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAEtD,IAAI,CAAC;YACH,mDAAmD;YACnD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAE1B,6CAA6C;YAC7C,4DAA4D;YAC5D,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC;YAEhD,0DAA0D;YAC1D,oEAAoE;YACpE,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAE1D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,kBAAkB,CAAC,KAAa;QAC5C,IAAI,CAAC;YACH,mBAAmB;YACnB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YAC1D,CAAC;YAED,qCAAqC;YACrC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAyB,CAAC;YAC3D,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAChD,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC1D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;YACzD,CAAC;YAED,0CAA0C;YAC1C,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;gBACnD,OAAO,CAAC,KAAK,CACX,+DAA+D,EAC/D,SAAS,CACV,CAAC;gBACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,SAAS,EAAE,EAAE,CAAC;YAC5E,CAAC;YAED,0CAA0C;YAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,YAAmD,CAAC;YAC7F,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBACtE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;YACpE,CAAC;YAED,qDAAqD;YACrD,MAAM,cAAc,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAW,CAAC,CAAC;YAC/D,MAAM,eAAe,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;YAEtD,0BAA0B;YAC1B,MAAM,iBAAiB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACxE,MAAM,cAAc,GAAG,sBAAsB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAEhE,MAAM,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;YACvC,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,MAAM,CAC1C,iBAAiB,EACjB,cAAc,EACd,eAAe,CAChB,CAAC;YAEF,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBACnE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;YAClE,CAAC;YAED,yEAAyE;YACzE,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAA6B,CAAC;YACxD,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;YACrD,CAAC;YAED,gBAAgB;YAChB,MAAM,KAAK,GAAG,EAAE,CAAC,IAA4B,CAAC;YAC9C,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBACxD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACvD,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;gBACvE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;YACtE,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;gBACvE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;YACtE,CAAC;YAED,gEAAgE;YAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAyB,CAAC;YAC1D,MAAM,cAAc,GAAG,EAAE,CAAC,cAAoC,CAAC;YAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,IAAI,QAAQ,IAAI,QAAQ,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;gBACtC,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBACzD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;YAC9D,CAAC;YACD,IAAI,cAAc,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;gBAC/D,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;YACnE,CAAC;YAED,2BAA2B;YAC3B,IAAI,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBAC/D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;YAC9D,CAAC;YACD,MAAM,iBAAiB,GAAG,EAAE,CAAC,iBAA4C,CAAC;YAC1E,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,CAAC;gBAClC,OAAO,CAAC,KAAK,CACX,6DAA6D,CAC9D,CAAC;gBACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;YAC5E,CAAC;YAED,6CAA6C;YAC7C,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAqC,CAAC;YAE3E,8BAA8B;YAC9B,MAAM,YAAY,GAAI,MAAM,CAAC,OAAO,CAAC,GAAc,IAAK,UAAU,CAAC,EAAa,CAAC;YACjF,MAAM,QAAQ,GAAI,MAAM,CAAC,OAAO,CAAC,GAAc,IAAK,UAAU,CAAC,UAAqB,CAAC;YACrF,6FAA6F;YAC7F,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,0EAA0E;YAC1E,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAClC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAE7D,2FAA2F;YAC3F,MAAM,OAAO,GAAG,UAAU,CAAC,OAA6B,CAAC;YACzD,MAAM,cAAc,GAAG,UAAU,CAAC,cAAoC,CAAC;YACvE,MAAM,SAAS,GAAG,UAAU,CAAC,SAA+B,CAAC;YAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC7C,CAAC,CAAE,UAAU,CAAC,MAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBACnF,CAAC,CAAC,SAAS,CAAC;YAEd,OAAO,CAAC,KAAK,CAAC,wDAAwD,EAAE;gBACtE,YAAY;gBACZ,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC9D,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC3D,YAAY,EAAE,CAAC,CAAC,SAAS;gBACzB,UAAU,EAAE,MAAM,EAAE,MAAM;aAC3B,CAAC,CAAC;YAEH,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,YAAY;gBACZ,QAAQ;gBACR,OAAO;gBACP,cAAc;gBACd,SAAS;gBACT,MAAM;gBACN,SAAS;gBACT,SAAS;gBACT,SAAS,EAAE,QAAQ;aACpB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,sDAAsD,EACtD,KAAK,CACN,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;aAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,cAAc,CAAC,KAAa;QAClC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAEtD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAErC,+BAA+B;YAC/B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,yBAAyB;YACzB,MAAM,WAAW,GAAG,IAAI,CACtB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CACjD,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAExC,wCAAwC;YACxC,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACnD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;gBACjD,IAAI,OAAO,CAAC,GAAG,GAAG,UAAU,EAAE,CAAC;oBAC7B,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,SAAS,CAAC,KAAa;QACnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAChC,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,6EAA6E;QAC7E,iEAAiE;QACjE,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,2EAA2E;QAC3E,8BAA8B;QAC9B,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB;YACnD,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAChC,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,YAAY,CAAC,iBAAiB,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBACjE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,QAAgB,CAAC;QACrB,IAAI,MAAM,GAAa,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CACX,oEAAoE,CACrE,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACpB,kEAAkE;gBAClE,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAChF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC;YACnC,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CACV,0GAA0G,CAC3G,CAAC;YACF,uEAAuE;YACvE,mDAAmD;YACnD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;QAC5B,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,YAAY,CAAC,iBAAiB,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7E,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE;gBACzC,aAAa,EAAE,8BAA8B;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,qBAAqB,CAAC,KAAa,EAAE,QAAgB,EAAE,MAAgB;QACnF,MAAM,OAAO,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACzE,IAAI,CAAC;YACH,wDAAwD;YACxD,IAAI,IAAI,CAAC,OAAO,IAAI,sBAAsB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC3D,MAAM,oBAAoB,GACxB,IAAI,CAAC,OACN,CAAC,oBAAoB,CAAC;gBACvB,IAAI,oBAAoB,EAAE,CAAC;oBACzB,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;oBACtE,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK;wBAAE,OAAO,IAAI,CAAC;oBACrC,OAAO,CAAC,KAAK,CACX,yCAAyC,EACzC,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CACxC,CAAC;oBACF,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;YAC5E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,aAAa,oCAAoC,EAAE;gBACjF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE;oBACtD,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC9B,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvD,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBACtE,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,CACV,6DAA6D,EAC7D,QAAQ,CAAC,MAAM,CAChB,CAAC;gBACF,OAAO,KAAK,CAAC,CAAC,2BAA2B;YAC3C,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAE7C,CAAC;YACT,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC5C,OAAO,CAAC,KAAK,CACX,yCAAyC,EACzC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,kBAAkB,CAC9C,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,qDAAqD,EAAE,KAAK,CAAC,CAAC;YAC5E,OAAO,KAAK,CAAC,CAAC,wBAAwB;QACxC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CACnB,SAAkB,EAClB,KAAc,EACd,QAAiB;QAEjB,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACtD,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAEtD,IAAI,CAAC,iBAAiB;YAAE,OAAO;QAE/B,MAAM,SAAS,GAAoB,EAAE,CAAC;QAEtC,uEAAuE;QACvE,IAAI,WAAW,GAAgC,IAAI,CAAC;QACpD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACnD,qDAAqD;YACrD,WAAW,GAAG,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAEtD,CAAC;YACT,wBAAwB;YACxB,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACvD,CAAC;QAED,6BAA6B;QAC7B,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,YAAY,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC1D,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YAEpD,uDAAuD;YACvD,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;gBACzB,MAAM,YAAY,GAAG,YAAY,CAAC,UAAU,CAC1C,WAAW,CAAC,OAAO,EACnB,QAAQ,CACT,CAAC;gBACF,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;gBACvD,qEAAqE;gBACrE,iEAAiE;gBACjE,qBAAqB;gBACrB,SAAS,CAAC,IAAI,CACZ,iBAAiB,CAAC,MAAM,CACtB,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAC/D,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,IAAI,KAAK,IAAI,iBAAiB,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC,iBAAiB,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7E,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC5E,CAAC;CACF"}

package/dist/services/kya-os-events.service.d.ts

@@ -10,11 +10,13 @@
  * - Activity events (`/api/v1/kya-os/events`) are the human-readable feed that
  *   powers the dashboard `/activity` view and per-deployment activity.
  *
- * Both share the same AgentShield credentials (`AGENTSHIELD_API_URL` +
- * `AGENTSHIELD_API_KEY`) and the same generic {@link BatchQueue} engine:
+ * Both share the same Checkpoint credentials (`CHECKPOINT_API_URL` +
+ * `CHECKPOINT_API_KEY`) and the same generic {@link BatchQueue} engine:
  * fire-and-forget, auto-flush at batch size, cron-driven flush across requests.
  *
- * Tool arguments and results NEVER appear in an event.
+ * Tool arguments and results NEVER appear in an event. A dispatch made under a
+ * grant can carry `delegation.jti` (the grant id), which the sink uses to link
+ * the call to that delegation and, on a pass, to stamp its last use.
  */
 import { type BatchDestination } from "./batch-queue";
 /** The SPEC-EVENTS schema version this emitter produces. */
@@ -52,6 +54,10 @@ export interface ToolInvokedEvent {
     error?: {
         excerpt: string;
     };
+    /** Links the dispatch to the grant it ran under (the delegation id). */
+    delegation?: {
+        jti: string;
+    };
 }
 /** Union of the event types this emitter can produce (extensible). */
 export type KyaOsEvent = ToolInvokedEvent;
@@ -86,6 +92,12 @@ export interface ToolInvokedInput {
     success?: boolean;
     /** Short failure excerpt (only forwarded when `success === false`). */
     errorExcerpt?: string;
+    /**
+     * Id of the grant this dispatch ran under, sent as `delegation.jti`. The
+     * caller decides when a dispatch is attributable to a grant; the sink maps
+     * a fail verdict with a jti to a failed delegation result.
+     */
+    delegationJti?: string;
     /** Injectable timestamp for deterministic tests; defaults to now. */
     ts?: string;
 }

package/dist/services/kya-os-events.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kya-os-events.service.d.ts","sourceRoot":"","sources":["../../src/services/kya-os-events.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAElE,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,QAAQ,CAAC;AAEzC,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAQzD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,mEAAmE;IACnE,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC1C,CAAC;IACF,OAAO,CAAC,EAAE;QACR,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC1B,CAAC;IACF,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,8BAA8B;IAC9B,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7B;AAED,sEAAsE;AACtE,MAAM,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAE1C;;;;GAIG;AACH,qBAAa,sBAAuB,YAAW,gBAAgB,CAAC,UAAU,CAAC;IACzE,IAAI,SAAiB;IACrB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAS;gBAEX,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAKpC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAuBlD;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,UAAU,CAAC,CAAS;gBAG1B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,yBAA8B;IAazC,2EAA2E;IAC3E,OAAO,CAAC,GAAG;IAMX;;;;;OAKG;IACH,eAAe,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI;IAiC9C,mEAAmE;IAC7D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5B,0DAA0D;IACpD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,gDAAgD;IAChD,QAAQ;;;;;;CAGT"}
+{"version":3,"file":"kya-os-events.service.d.ts","sourceRoot":"","sources":["../../src/services/kya-os-events.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAElE,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,QAAQ,CAAC;AAEzC,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAWzD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,mEAAmE;IACnE,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC1C,CAAC;IACF,OAAO,CAAC,EAAE;QACR,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC1B,CAAC;IACF,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,8BAA8B;IAC9B,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5B,wEAAwE;IACxE,UAAU,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9B;AAED,sEAAsE;AACtE,MAAM,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAE1C;;;;GAIG;AACH,qBAAa,sBAAuB,YAAW,gBAAgB,CAAC,UAAU,CAAC;IACzE,IAAI,SAAiB;IACrB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAS;gBAEX,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAKpC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAuBlD;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,UAAU,CAAC,CAAS;gBAG1B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,yBAA8B;IAazC,2EAA2E;IAC3E,OAAO,CAAC,GAAG;IAMX;;;;;OAKG;IACH,eAAe,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI;IA0C9C,mEAAmE;IAC7D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5B,0DAA0D;IACpD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,gDAAgD;IAChD,QAAQ;;;;;;CAGT"}

package/dist/services/kya-os-events.service.js

@@ -10,21 +10,25 @@
  * - Activity events (`/api/v1/kya-os/events`) are the human-readable feed that
  *   powers the dashboard `/activity` view and per-deployment activity.
  *
- * Both share the same AgentShield credentials (`AGENTSHIELD_API_URL` +
- * `AGENTSHIELD_API_KEY`) and the same generic {@link BatchQueue} engine:
+ * Both share the same Checkpoint credentials (`CHECKPOINT_API_URL` +
+ * `CHECKPOINT_API_KEY`) and the same generic {@link BatchQueue} engine:
  * fire-and-forget, auto-flush at batch size, cron-driven flush across requests.
  *
- * Tool arguments and results NEVER appear in an event.
+ * Tool arguments and results NEVER appear in an event. A dispatch made under a
+ * grant can carry `delegation.jti` (the grant id), which the sink uses to link
+ * the call to that delegation and, on a pass, to stamp its last use.
  */
 import { BatchQueue } from "./batch-queue";
 /** The SPEC-EVENTS schema version this emitter produces. */
 export const SPEC_EVENTS_VERSION = "0.1";
 /** Self-identification forwarded to the sink's `source.sdk` block. */
 export const KYA_OS_EVENTS_SDK_NAME = "mcp-i-cloudflare";
-/** The sink path appended to the AgentShield API base URL. */
+/** The sink path appended to the Checkpoint API base URL. */
 const EVENTS_PATH = "/api/v1/kya-os/events";
 /** Max characters retained from a failure excerpt (sink caps at 200). */
 const MAX_ERROR_EXCERPT = 200;
+/** Max delegation jti length the sink accepts. */
+const MAX_DELEGATION_JTI = 500;
 /**
  * KYA-OS events sink destination.
  *
@@ -116,6 +120,12 @@ export class KyaOsEventsEmitter {
         if (failed && input.errorExcerpt) {
             event.error = { excerpt: input.errorExcerpt.slice(0, MAX_ERROR_EXCERPT) };
         }
+        // An out-of-range jti would fail the sink's schema and reject the whole
+        // batch, so it is dropped here. Truncating would link to the wrong grant.
+        if (input.delegationJti &&
+            input.delegationJti.length <= MAX_DELEGATION_JTI) {
+            event.delegation = { jti: input.delegationJti };
+        }
         this.queue.enqueue(event);
     }
     /** Drain the queue and retry any pending batches (cron-driven). */

package/dist/services/kya-os-events.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"kya-os-events.service.js","sourceRoot":"","sources":["../../src/services/kya-os-events.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAyB,MAAM,eAAe,CAAC;AAElE,4DAA4D;AAC5D,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAEzC,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AAEzD,8DAA8D;AAC9D,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAE5C,yEAAyE;AACzE,MAAM,iBAAiB,GAAG,GAAG,CAAC;AA4B9B;;;;GAIG;AACH,MAAM,OAAO,sBAAsB;IACjC,IAAI,GAAG,aAAa,CAAC;IACb,MAAM,CAAS;IACf,MAAM,CAAS;IAEvB,YAAY,MAAc,EAAE,MAAc;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAoB;QAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,WAAW,EAAE,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;aACvC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;SACjC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ;iBAC7B,IAAI,EAAE;iBACN,KAAK,CAAC,GAAG,EAAE,CAAC,2BAA2B,CAAC,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,oCAAoC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,EAAE,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAiCD;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IACrB,KAAK,CAAyB;IAC9B,UAAU,CAAU;IAE5B,YACE,MAAc,EACd,MAAc,EACd,UAAqC,EAAE;QAEvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG,IAAI,UAAU,CAAa;YACtC,YAAY,EAAE,CAAC,IAAI,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1D,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE;YACxC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC;YACnC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK;YAC7B,SAAS,EAAE,oBAAoB;YAC/B,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IACnE,GAAG;QACT,OAAO,IAAI,CAAC,UAAU;YACpB,CAAC,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE;YAC5D,CAAC,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,KAAuB;QACrC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACxC,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC;QAEvC,MAAM,KAAK,GAAqB;YAC9B,WAAW,EAAE,mBAAmB;YAChC,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACxC,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;YACvD,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE;gBACJ,IAAI,EAAE,KAAK,CAAC,QAAQ;gBACpB,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D;YACD,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;SAClC,CAAC;QAEF,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,KAAK,CAAC,OAAO,GAAG;gBACd,EAAE,EAAE,KAAK,CAAC,SAAS;gBACnB,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACjC,KAAK,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC5E,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;IAClC,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,gDAAgD;IAChD,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC/B,CAAC;CACF"}
+{"version":3,"file":"kya-os-events.service.js","sourceRoot":"","sources":["../../src/services/kya-os-events.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAyB,MAAM,eAAe,CAAC;AAElE,4DAA4D;AAC5D,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAEzC,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AAEzD,6DAA6D;AAC7D,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAE5C,yEAAyE;AACzE,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,kDAAkD;AAClD,MAAM,kBAAkB,GAAG,GAAG,CAAC;AA8B/B;;;;GAIG;AACH,MAAM,OAAO,sBAAsB;IACjC,IAAI,GAAG,aAAa,CAAC;IACb,MAAM,CAAS;IACf,MAAM,CAAS;IAEvB,YAAY,MAAc,EAAE,MAAc;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAoB;QAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,WAAW,EAAE,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;aACvC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;SACjC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ;iBAC7B,IAAI,EAAE;iBACN,KAAK,CAAC,GAAG,EAAE,CAAC,2BAA2B,CAAC,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,oCAAoC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,EAAE,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAuCD;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IACrB,KAAK,CAAyB;IAC9B,UAAU,CAAU;IAE5B,YACE,MAAc,EACd,MAAc,EACd,UAAqC,EAAE;QAEvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG,IAAI,UAAU,CAAa;YACtC,YAAY,EAAE,CAAC,IAAI,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1D,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE;YACxC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC;YACnC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK;YAC7B,SAAS,EAAE,oBAAoB;YAC/B,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IACnE,GAAG;QACT,OAAO,IAAI,CAAC,UAAU;YACpB,CAAC,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE;YAC5D,CAAC,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,KAAuB;QACrC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACxC,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC;QAEvC,MAAM,KAAK,GAAqB;YAC9B,WAAW,EAAE,mBAAmB;YAChC,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACxC,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;YACvD,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE;gBACJ,IAAI,EAAE,KAAK,CAAC,QAAQ;gBACpB,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D;YACD,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;SAClC,CAAC;QAEF,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,KAAK,CAAC,OAAO,GAAG;gBACd,EAAE,EAAE,KAAK,CAAC,SAAS;gBACnB,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACjC,KAAK,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC5E,CAAC;QAED,wEAAwE;QACxE,0EAA0E;QAC1E,IACE,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,aAAa,CAAC,MAAM,IAAI,kBAAkB,EAChD,CAAC;YACD,KAAK,CAAC,UAAU,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;QAClD,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;IAClC,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,gDAAgD;IAChD,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC/B,CAAC;CACF"}