@kya-os/mcp-i-cloudflare 1.15.0 → 1.16.0

package/dist/services/credential-auth.handler.d.ts

@@ -26,6 +26,8 @@ export interface CredentialAuthResult {
     expiresIn?: number;
     /** Error message on failure */
     error?: string;
+    /** Provider explicitly rejected credentials, before any identity or mint. */
+    authenticationRejected?: true;
 }
 /**
  * Credential authentication handler interface

package/dist/services/credential-auth.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-auth.handler.d.ts","sourceRoot":"","sources":["../../src/services/credential-auth.handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,YAAY,CACV,QAAQ,EAAE,wBAAwB,EAClC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,8CAA8C;IAC9C,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC/B,+CAA+C;IAC/C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACpD;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,2BAA2B,GAClC,sBAAsB,CAmRxB;AAED;;;;;;;;;;GAUG;AACH,iBAAS,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAiBtE;AAGD,OAAO,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"credential-auth.handler.d.ts","sourceRoot":"","sources":["../../src/services/credential-auth.handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,sBAAsB,CAAC,EAAE,IAAI,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,YAAY,CACV,QAAQ,EAAE,wBAAwB,EAClC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,8CAA8C;IAC9C,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC/B,+CAA+C;IAC/C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACpD;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,2BAA2B,GAClC,sBAAsB,CA0SxB;AAED;;;;;;;;;;GAUG;AACH,iBAAS,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAiBtE;AAGD,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/dist/services/credential-auth.handler.js

@@ -139,7 +139,15 @@ export function createCredentialAuthHandler(config) {
                             actual: checkValue,
                             error: errorMsg,
                         });
-                        return { success: false, error: String(errorMsg) };
+                        return {
+                            success: false,
+                            error: String(errorMsg),
+                            ...((response.ok && checkValue !== undefined) ||
+                                response.status === 401 ||
+                                response.status === 403
+                                ? { authenticationRejected: true }
+                                : {}),
+                        };
                     }
                 }
                 else if (!response.ok) {
@@ -147,7 +155,13 @@ export function createCredentialAuthHandler(config) {
                     logger("[CredentialAuthHandler] HTTP error", {
                         status: response.status,
                     });
-                    return { success: false, error: `HTTP ${response.status}` };
+                    return {
+                        success: false,
+                        error: `HTTP ${response.status}`,
+                        ...(response.status === 401 || response.status === 403
+                            ? { authenticationRejected: true }
+                            : {}),
+                    };
                 }
                 // 5. Extract session token - handle "cookie" special case
                 let sessionToken;
@@ -167,7 +181,9 @@ export function createCredentialAuthHandler(config) {
                             const firstCookie = setCookie.split(";")[0];
                             const valueIndex = firstCookie.indexOf("=");
                             sessionToken =
-                                valueIndex > 0 ? firstCookie.substring(valueIndex + 1) : undefined;
+                                valueIndex > 0
+                                    ? firstCookie.substring(valueIndex + 1)
+                                    : undefined;
                         }
                         logger("[CredentialAuthHandler] Extracted token from Set-Cookie", {
                             hasMatch: !!cookieMatch,

package/dist/services/credential-auth.handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-auth.handler.js","sourceRoot":"","sources":["../../src/services/credential-auth.handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAmDH;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAmC;IAEnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAE3C;;;;;;OAMG;IACH,SAAS,sBAAsB,CAC7B,WAAmC,EACnC,SAAiB;QAEjB,oBAAoB;QACpB,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;QAExE,MAAM,UAAU,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QAE3C,wBAAwB;QACxB,MAAM,eAAe,GAAG;YACtB,UAAU;YACV,OAAO;YACP,YAAY;YACZ,UAAU;YACV,OAAO;YACP,MAAM;YACN,QAAQ;SACA,CAAC;QAEX,wBAAwB;QACxB,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAU,CAAC;QAEvE,IAAI,eAAe,CAAC,QAAQ,CAAC,UAA8C,CAAC,EAAE,CAAC;YAC7E,4CAA4C;YAC5C,OAAO,CACL,WAAW,CAAC,QAAQ;gBACpB,WAAW,CAAC,KAAK;gBACjB,WAAW,CAAC,UAAU;gBACtB,WAAW,CAAC,QAAQ;gBACpB,WAAW,CAAC,KAAK;gBACjB,WAAW,CAAC,IAAI;gBAChB,WAAW,CAAC,MAAM,CACnB,CAAC;QACJ,CAAC;QAED,IAAI,eAAe,CAAC,QAAQ,CAAC,UAA8C,CAAC,EAAE,CAAC;YAC7E,OAAO,CACL,WAAW,CAAC,QAAQ;gBACpB,WAAW,CAAC,IAAI;gBAChB,WAAW,CAAC,MAAM;gBAClB,WAAW,CAAC,GAAG,CAChB,CAAC;QACJ,CAAC;QAED,sCAAsC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,YAAY,CAChB,QAAkC,EAClC,WAAmC;YAEnC,MAAM,CAAC,iDAAiD,EAAE;gBACxD,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,eAAe,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY;aACzC,CAAC,CAAC;YAEH,sCAAsC;YACtC,MAAM,WAAW,GAA2B,EAAE,CAAC;YAC/C,KAAK,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CACnD,QAAQ,CAAC,mBAAmB,CAC7B,EAAE,CAAC;gBACF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gBAC9C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC/B,MAAM,aAAa,GAAG,sBAAsB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;oBACzE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;wBAChC,MAAM,CAAC,gDAAgD,EAAE;4BACvD,KAAK,EAAE,aAAa;4BACpB,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;yBAC1C,CAAC,CAAC;wBACH,OAAO;4BACL,OAAO,EAAE,KAAK;4BACd,KAAK,EAAE,2BAA2B,aAAa,EAAE;yBAClD,CAAC;oBACJ,CAAC;oBACD,WAAW,CAAC,YAAY,CAAC,GAAG,aAAa,CAAC;gBAC5C,CAAC;qBAAM,CAAC;oBACN,gCAAgC;oBAChC,WAAW,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC;gBACvC,CAAC;YACH,CAAC;YAED,wBAAwB;YACxB,IAAI,CAAC;gBACH,uDAAuD;gBACvD,MAAM,SAAS,GAA2B,EAAE,CAAC;gBAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;oBACvD,SAAS,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;wBACrD,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,WAAW;wBAC/B,CAAC,CAAC,KAAK,CAAC;gBACZ,CAAC;gBACD,MAAM,CAAC,+CAA+C,EAAE;oBACtD,QAAQ,EAAE,QAAQ,CAAC,YAAY;oBAC/B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;oBAClC,IAAI,EAAE,SAAS;iBAChB,CAAC,CAAC;gBAEH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE;oBACzD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,GAAG,QAAQ,CAAC,OAAO;qBACpB;oBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;iBAClC,CAAC,CAAC;gBAEH,yBAAyB;gBACzB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;gBAEhE,uEAAuE;gBACvE,kEAAkE;gBAClE,MAAM,CAAC,2CAA2C,EAAE;oBAClD,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;oBAClD,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;oBAChE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC/B,SAAS,EAAE,QAAQ,IAAI,IAAI;oBAC3B,iBAAiB,EAAE,gBAAgB,IAAI,IAAI;iBAC5C,CAAC,CAAC;gBAEH,oCAAoC;gBACpC,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;oBAC1B,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;oBACpE,MAAM,aAAa,GAAG,QAAQ,CAAC,YAAY,CAAC,aAAa,CAAC;oBAE1D,uDAAuD;oBACvD,MAAM,OAAO,GACX,MAAM,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,aAAa,CAAC;wBAC5C,UAAU,KAAK,aAAa,CAAC;oBAE/B,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,MAAM,QAAQ,GACZ,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC;4BAC7B,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC;4BAC/B,uBAAuB,CAAC;wBAE1B,MAAM,CAAC,8CAA8C,EAAE;4BACrD,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI;4BAChC,QAAQ,EAAE,aAAa;4BACvB,MAAM,EAAE,UAAU;4BAClB,KAAK,EAAE,QAAQ;yBAChB,CAAC,CAAC;wBAEH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACrD,CAAC;gBACH,CAAC;qBAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACxB,yDAAyD;oBACzD,MAAM,CAAC,oCAAoC,EAAE;wBAC3C,MAAM,EAAE,QAAQ,CAAC,MAAM;qBACxB,CAAC,CAAC;oBACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC9D,CAAC;gBAED,0DAA0D;gBAC1D,IAAI,YAAgC,CAAC;gBAErC,IAAI,QAAQ,CAAC,cAAc,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;oBACtD,8BAA8B;oBAC9B,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;oBACrD,IAAI,SAAS,EAAE,CAAC;wBACd,kCAAkC;wBAClC,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CACjC,yCAAyC,CAC1C,CAAC;wBAEF,IAAI,WAAW,EAAE,CAAC;4BAChB,4CAA4C;4BAC5C,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;wBAChC,CAAC;6BAAM,CAAC;4BACN,yEAAyE;4BACzE,8EAA8E;4BAC9E,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAC5C,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;4BAC5C,YAAY;gCACV,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;wBACvE,CAAC;wBAED,MAAM,CAAC,yDAAyD,EAAE;4BAChE,QAAQ,EAAE,CAAC,CAAC,WAAW;yBACxB,CAAC,CAAC;oBACL,CAAC;oBAED,8CAA8C;oBAC9C,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,YAAY,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;wBAC9C,IAAI,YAAY,EAAE,CAAC;4BACjB,MAAM,CACJ,8DAA8D,CAC/D,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,yBAAyB;oBACzB,YAAY,GAAG,cAAc,CAC3B,IAAI,EACJ,QAAQ,CAAC,cAAc,CAAC,YAAY,CACrC,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,CAAC,iDAAiD,EAAE;wBACxD,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,YAAY;qBAC3C,CAAC,CAAC;oBACH,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,oCAAoC,QAAQ,CAAC,cAAc,CAAC,YAAY,EAAE;qBAClF,CAAC;gBACJ,CAAC;gBAED,gCAAgC;gBAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,CAAC,MAAM;oBAC3C,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC;oBACtD,CAAC,CAAC,SAAS,CAAC;gBAEd,+DAA+D;gBAC/D,yEAAyE;gBACzE,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC,SAAS;oBACtD,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC;oBACzD,CAAC,CAAC,SAAS,CAAC;gBACd,0DAA0D;gBAC1D,gFAAgF;gBAChF,MAAM,SAAS,GACb,cAAc;oBACd,WAAW,CAAC,KAAK;oBACjB,WAAW,CAAC,QAAQ;oBACpB,WAAW,CAAC,QAAQ,CAAC,CAAC,oCAAoC;gBAE5D,MAAM,eAAe,GAAG,QAAQ,CAAC,cAAc,CAAC,eAAe;oBAC7D,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,eAAe,CAAC;oBAC/D,CAAC,CAAC,SAAS,CAAC;gBAEd,MAAM,YAAY,GAAG,QAAQ,CAAC,cAAc,CAAC,SAAS;oBACpD,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC;oBACzD,CAAC,CAAC,SAAS,CAAC;gBACd,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAExE,MAAM,CAAC,mDAAmD,EAAE;oBAC1D,SAAS,EAAE,CAAC,CAAC,MAAM;oBACnB,YAAY,EAAE,CAAC,CAAC,SAAS;oBACzB,cAAc,EAAE,CAAC,CAAC,eAAe;oBACjC,SAAS;iBACV,CAAC,CAAC;gBAEH,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,YAAY;oBACZ,MAAM;oBACN,SAAS;oBACT,eAAe;oBACf,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;iBAC3D,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,QAAQ,GACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBAC3D,MAAM,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACrE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,kBAAkB,QAAQ,EAAE;iBACpC,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CAAC,GAAY,EAAE,IAAY;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAY,GAAG,CAAC;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;YAC9D,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,oCAAoC;AACpC,OAAO,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"credential-auth.handler.js","sourceRoot":"","sources":["../../src/services/credential-auth.handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAqDH;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAmC;IAEnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAE3C;;;;;;OAMG;IACH,SAAS,sBAAsB,CAC7B,WAAmC,EACnC,SAAiB;QAEjB,oBAAoB;QACpB,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;QAExE,MAAM,UAAU,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QAE3C,wBAAwB;QACxB,MAAM,eAAe,GAAG;YACtB,UAAU;YACV,OAAO;YACP,YAAY;YACZ,UAAU;YACV,OAAO;YACP,MAAM;YACN,QAAQ;SACA,CAAC;QAEX,wBAAwB;QACxB,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAU,CAAC;QAEvE,IACE,eAAe,CAAC,QAAQ,CAAC,UAA8C,CAAC,EACxE,CAAC;YACD,4CAA4C;YAC5C,OAAO,CACL,WAAW,CAAC,QAAQ;gBACpB,WAAW,CAAC,KAAK;gBACjB,WAAW,CAAC,UAAU;gBACtB,WAAW,CAAC,QAAQ;gBACpB,WAAW,CAAC,KAAK;gBACjB,WAAW,CAAC,IAAI;gBAChB,WAAW,CAAC,MAAM,CACnB,CAAC;QACJ,CAAC;QAED,IACE,eAAe,CAAC,QAAQ,CAAC,UAA8C,CAAC,EACxE,CAAC;YACD,OAAO,CACL,WAAW,CAAC,QAAQ;gBACpB,WAAW,CAAC,IAAI;gBAChB,WAAW,CAAC,MAAM;gBAClB,WAAW,CAAC,GAAG,CAChB,CAAC;QACJ,CAAC;QAED,sCAAsC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,YAAY,CAChB,QAAkC,EAClC,WAAmC;YAEnC,MAAM,CAAC,iDAAiD,EAAE;gBACxD,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,eAAe,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY;aACzC,CAAC,CAAC;YAEH,sCAAsC;YACtC,MAAM,WAAW,GAA2B,EAAE,CAAC;YAC/C,KAAK,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CACnD,QAAQ,CAAC,mBAAmB,CAC7B,EAAE,CAAC;gBACF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gBAC9C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC/B,MAAM,aAAa,GAAG,sBAAsB,CAC1C,WAAW,EACX,aAAa,CACd,CAAC;oBACF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;wBAChC,MAAM,CAAC,gDAAgD,EAAE;4BACvD,KAAK,EAAE,aAAa;4BACpB,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;yBAC1C,CAAC,CAAC;wBACH,OAAO;4BACL,OAAO,EAAE,KAAK;4BACd,KAAK,EAAE,2BAA2B,aAAa,EAAE;yBAClD,CAAC;oBACJ,CAAC;oBACD,WAAW,CAAC,YAAY,CAAC,GAAG,aAAa,CAAC;gBAC5C,CAAC;qBAAM,CAAC;oBACN,gCAAgC;oBAChC,WAAW,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC;gBACvC,CAAC;YACH,CAAC;YAED,wBAAwB;YACxB,IAAI,CAAC;gBACH,uDAAuD;gBACvD,MAAM,SAAS,GAA2B,EAAE,CAAC;gBAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;oBACvD,SAAS,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;wBACrD,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,WAAW;wBAC/B,CAAC,CAAC,KAAK,CAAC;gBACZ,CAAC;gBACD,MAAM,CAAC,+CAA+C,EAAE;oBACtD,QAAQ,EAAE,QAAQ,CAAC,YAAY;oBAC/B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;oBAClC,IAAI,EAAE,SAAS;iBAChB,CAAC,CAAC;gBAEH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE;oBACzD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,GAAG,QAAQ,CAAC,OAAO;qBACpB;oBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;iBAClC,CAAC,CAAC;gBAEH,yBAAyB;gBACzB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;gBAEhE,uEAAuE;gBACvE,kEAAkE;gBAClE,MAAM,CAAC,2CAA2C,EAAE;oBAClD,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;oBAClD,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;oBAChE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC/B,SAAS,EAAE,QAAQ,IAAI,IAAI;oBAC3B,iBAAiB,EAAE,gBAAgB,IAAI,IAAI;iBAC5C,CAAC,CAAC;gBAEH,oCAAoC;gBACpC,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;oBAC1B,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;oBACpE,MAAM,aAAa,GAAG,QAAQ,CAAC,YAAY,CAAC,aAAa,CAAC;oBAE1D,uDAAuD;oBACvD,MAAM,OAAO,GACX,MAAM,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,aAAa,CAAC;wBAC5C,UAAU,KAAK,aAAa,CAAC;oBAE/B,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,MAAM,QAAQ,GACZ,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC;4BAC7B,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC;4BAC/B,uBAAuB,CAAC;wBAE1B,MAAM,CAAC,8CAA8C,EAAE;4BACrD,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI;4BAChC,QAAQ,EAAE,aAAa;4BACvB,MAAM,EAAE,UAAU;4BAClB,KAAK,EAAE,QAAQ;yBAChB,CAAC,CAAC;wBAEH,OAAO;4BACL,OAAO,EAAE,KAAK;4BACd,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC;4BACvB,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,UAAU,KAAK,SAAS,CAAC;gCAC7C,QAAQ,CAAC,MAAM,KAAK,GAAG;gCACvB,QAAQ,CAAC,MAAM,KAAK,GAAG;gCACrB,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAa,EAAE;gCAC3C,CAAC,CAAC,EAAE,CAAC;yBACR,CAAC;oBACJ,CAAC;gBACH,CAAC;qBAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACxB,yDAAyD;oBACzD,MAAM,CAAC,oCAAoC,EAAE;wBAC3C,MAAM,EAAE,QAAQ,CAAC,MAAM;qBACxB,CAAC,CAAC;oBACH,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE;wBAChC,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;4BACpD,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAa,EAAE;4BAC3C,CAAC,CAAC,EAAE,CAAC;qBACR,CAAC;gBACJ,CAAC;gBAED,0DAA0D;gBAC1D,IAAI,YAAgC,CAAC;gBAErC,IAAI,QAAQ,CAAC,cAAc,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;oBACtD,8BAA8B;oBAC9B,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;oBACrD,IAAI,SAAS,EAAE,CAAC;wBACd,kCAAkC;wBAClC,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CACjC,yCAAyC,CAC1C,CAAC;wBAEF,IAAI,WAAW,EAAE,CAAC;4BAChB,4CAA4C;4BAC5C,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;wBAChC,CAAC;6BAAM,CAAC;4BACN,yEAAyE;4BACzE,8EAA8E;4BAC9E,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;4BAC5C,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;4BAC5C,YAAY;gCACV,UAAU,GAAG,CAAC;oCACZ,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,UAAU,GAAG,CAAC,CAAC;oCACvC,CAAC,CAAC,SAAS,CAAC;wBAClB,CAAC;wBAED,MAAM,CAAC,yDAAyD,EAAE;4BAChE,QAAQ,EAAE,CAAC,CAAC,WAAW;yBACxB,CAAC,CAAC;oBACL,CAAC;oBAED,8CAA8C;oBAC9C,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,YAAY,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;wBAC9C,IAAI,YAAY,EAAE,CAAC;4BACjB,MAAM,CACJ,8DAA8D,CAC/D,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,yBAAyB;oBACzB,YAAY,GAAG,cAAc,CAC3B,IAAI,EACJ,QAAQ,CAAC,cAAc,CAAC,YAAY,CACrC,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,CAAC,iDAAiD,EAAE;wBACxD,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,YAAY;qBAC3C,CAAC,CAAC;oBACH,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,oCAAoC,QAAQ,CAAC,cAAc,CAAC,YAAY,EAAE;qBAClF,CAAC;gBACJ,CAAC;gBAED,gCAAgC;gBAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,CAAC,MAAM;oBAC3C,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC;oBACtD,CAAC,CAAC,SAAS,CAAC;gBAEd,+DAA+D;gBAC/D,yEAAyE;gBACzE,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC,SAAS;oBACtD,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC;oBACzD,CAAC,CAAC,SAAS,CAAC;gBACd,0DAA0D;gBAC1D,gFAAgF;gBAChF,MAAM,SAAS,GACb,cAAc;oBACd,WAAW,CAAC,KAAK;oBACjB,WAAW,CAAC,QAAQ;oBACpB,WAAW,CAAC,QAAQ,CAAC,CAAC,oCAAoC;gBAE5D,MAAM,eAAe,GAAG,QAAQ,CAAC,cAAc,CAAC,eAAe;oBAC7D,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,eAAe,CAAC;oBAC/D,CAAC,CAAC,SAAS,CAAC;gBAEd,MAAM,YAAY,GAAG,QAAQ,CAAC,cAAc,CAAC,SAAS;oBACpD,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC;oBACzD,CAAC,CAAC,SAAS,CAAC;gBACd,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAExE,MAAM,CAAC,mDAAmD,EAAE;oBAC1D,SAAS,EAAE,CAAC,CAAC,MAAM;oBACnB,YAAY,EAAE,CAAC,CAAC,SAAS;oBACzB,cAAc,EAAE,CAAC,CAAC,eAAe;oBACjC,SAAS;iBACV,CAAC,CAAC;gBAEH,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,YAAY;oBACZ,MAAM;oBACN,SAAS;oBACT,eAAe;oBACf,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;iBAC3D,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,QAAQ,GACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBAC3D,MAAM,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACrE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,kBAAkB,QAAQ,EAAE;iBACpC,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CAAC,GAAY,EAAE,IAAY;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAY,GAAG,CAAC;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;YAC9D,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,oCAAoC;AACpC,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/dist/services/delegation-trust.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Delegation credential trust policy.
+ *
+ * Decides which issuers this worker accepts delegation VC-JWTs from, which
+ * audience they must name, which key verifies them, and whether their status
+ * entry is clear. `DelegationService` applies it before any verdict is reached
+ * or cached, with or without a Checkpoint API key.
+ *
+ * Pinned issuers:
+ *  - the worker's own identity (`MCP_IDENTITY_AGENT_DID`), which signs the
+ *    anchor flow's self-issued delegations;
+ *  - the native issuer binding's org DID (`MCPI_NATIVE_HTTP_ISSUER_CONFIG`), and
+ *    any native issuer the caller configured in code;
+ *  - `KYA_OS_TRUSTED_DELEGATION_ISSUERS`;
+ *  - the Checkpoint platform signer, found through the configured Checkpoint
+ *    origin's own DID document (`CHECKPOINT_API_URL`, default kya.vouched.id),
+ *    which names that did:key in `alsoKnownAs` under the same key.
+ *
+ * Nothing is hard-coded, and nothing named only by a token is fetched: an
+ * issuer is pinned before its DID document is resolved, and a status list is
+ * fetched only from a credential a pinned issuer signed.
+ *
+ * Accepted audiences: the worker's DID, `CHECKPOINT_PROJECT_ID`, the binding's
+ * org DID and project, any native issuer the caller configured in code, and
+ * `KYA_OS_DELEGATION_AUDIENCES`.
+ */
+import { type DIDDocument, type DIDResolver } from "@kya-os/mcp";
+import type { CloudflareEnv } from "../types";
+/** Trust inputs a caller holds beyond the environment (e.g. a native issuer). */
+export interface DelegationTrustOptions {
+    /** Issuer DIDs to pin in addition to the environment-derived set. */
+    trustedIssuers?: readonly (string | undefined)[];
+    /** Audiences to accept in addition to the environment-derived set. */
+    audiences?: readonly (string | undefined)[];
+}
+export interface DelegationTrust {
+    readonly issuers: ReadonlySet<string>;
+    readonly audiences: ReadonlySet<string>;
+    /** The worker's own DID: the only issuer allowed to omit `aud`. */
+    readonly ownDid?: string;
+    /** Origin whose `/.well-known/did.json` names the Checkpoint platform signer. */
+    readonly checkpointOrigin?: string;
+}
+/** DID resolution plus the configured Checkpoint origin's own DID document. */
+export interface DelegationDidResolver extends DIDResolver {
+    checkpointIdentity(origin: string): Promise<DIDDocument | null>;
+}
+export type AudienceVerdict = "accepted" | "unmatched" | "missing";
+export type StatusVerdict = "clear" | "revoked" | "unresolvable";
+/** Build the trust policy from deployment configuration. */
+export declare function resolveDelegationTrust(env: CloudflareEnv, options?: DelegationTrustOptions): DelegationTrust;
+/**
+ * A credential's handle: `vc.id`, else the `jti` claim. The same rule as
+ * Checkpoint's reporter, so both name a credential alike. Org-issued
+ * delegations carry their per-delegation credential id as `vc.id` and no `jti`.
+ */
+export declare function credentialHandle(payload: Record<string, unknown>): string | undefined;
+/** RFC 7519 §4.1.3: `aud` is a string or an array; one accepted value is enough. */
+export declare function audienceVerdict(aud: unknown, trust: DelegationTrust): AudienceVerdict;
+/**
+ * did:key resolves locally and did:web through `@kya-os/mcp`'s resolver; every
+ * fetch refuses redirects, times out and is size-capped. Successful documents
+ * are cached for five minutes per resolver; a failed Checkpoint discovery for
+ * thirty seconds, so a degraded origin is not refetched for every token.
+ */
+export declare function createDelegationDidResolver(fetchUpstream?: (url: string) => Promise<Response>): DelegationDidResolver;
+/** One resolver per isolate, so DID documents stay cached across requests. */
+export declare function sharedDelegationDidResolver(): DelegationDidResolver;
+/**
+ * Ed25519 keys the document authorizes for assertions (`assertionMethod`),
+ * narrowed to `kid` when the token names one. A did:key has exactly one key,
+ * so only its DID part has to match.
+ */
+export declare function assertionKeys(doc: DIDDocument, kid?: string): Uint8Array[];
+/** Ed25519 signature check against any of `keys`. */
+export declare function verifiesWithAnyKey(signingInput: string, signature: string, keys: readonly Uint8Array[]): Promise<boolean>;
+/**
+ * Whether `issuerDid` is the Checkpoint platform signer: the did:key the
+ * configured Checkpoint origin's DID document lists in `alsoKnownAs` AND
+ * publishes as one of its own assertion keys.
+ */
+export declare function isCheckpointPlatformIssuer(issuerDid: string, trust: DelegationTrust, resolver: DelegationDidResolver): Promise<boolean>;
+/**
+ * The status entries a VC-JWT carries: the W3C `vc.credentialStatus` and the
+ * draft-kya-http-02 top-level `credentialStatus`. Returns null when either is
+ * malformed or the two disagree.
+ */
+export declare function credentialStatusEntries(payload: Record<string, unknown>): unknown[] | null;
+/**
+ * Read one revocation entry, fail closed: an entry the native profile would not
+ * issue (`validNativeStatus`), an unreachable or malformed list, a purpose
+ * mismatch, or an out-of-range index is "unresolvable", never "clear".
+ */
+export declare function checkCredentialStatusEntry(entry: unknown, fetchUpstream?: (url: string) => Promise<Response>): Promise<StatusVerdict>;
+/** "1"/"true" opts a development worker into unchecked legacy tokens. */
+export declare function insecureDevTokensEnabled(env: CloudflareEnv): boolean;
+//# sourceMappingURL=delegation-trust.d.ts.map

package/dist/services/delegation-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-trust.d.ts","sourceRoot":"","sources":["../../src/services/delegation-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EASL,KAAK,WAAW,EAChB,KAAK,WAAW,EAGjB,MAAM,aAAa,CAAC;AAUrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,cAAc,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;IACjD,sEAAsE;IACtE,SAAS,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,+EAA+E;AAC/E,MAAM,WAAW,qBAAsB,SAAQ,WAAW;IACxD,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACjE;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;AACnE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,GAAG,cAAc,CAAC;AAqBjE,4DAA4D;AAC5D,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,aAAa,EAClB,OAAO,GAAE,sBAA2B,GACnC,eAAe,CAuCjB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,MAAM,GAAG,SAAS,CASpB;AAED,oFAAoF;AACpF,wBAAgB,eAAe,CAC7B,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,eAAe,GACrB,eAAe,CAMjB;AAiED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,aAAa,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAiB,GAChE,qBAAqB,CAmEvB;AAID,8EAA8E;AAC9E,wBAAgB,2BAA2B,IAAI,qBAAqB,CAEnE;AAsBD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,CA2B1E;AAED,qDAAqD;AACrD,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,SAAS,UAAU,EAAE,GAC1B,OAAO,CAAC,OAAO,CAAC,CAalB;AAMD;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,qBAAqB,GAC9B,OAAO,CAAC,OAAO,CAAC,CASlB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,EAAE,GAAG,IAAI,CAclB;AAWD;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,OAAO,EACd,aAAa,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAiB,GAChE,OAAO,CAAC,aAAa,CAAC,CA6BxB;AAED,yEAAyE;AACzE,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAKpE"}

package/dist/services/delegation-trust.js

@@ -0,0 +1,378 @@
+/**
+ * Delegation credential trust policy.
+ *
+ * Decides which issuers this worker accepts delegation VC-JWTs from, which
+ * audience they must name, which key verifies them, and whether their status
+ * entry is clear. `DelegationService` applies it before any verdict is reached
+ * or cached, with or without a Checkpoint API key.
+ *
+ * Pinned issuers:
+ *  - the worker's own identity (`MCP_IDENTITY_AGENT_DID`), which signs the
+ *    anchor flow's self-issued delegations;
+ *  - the native issuer binding's org DID (`MCPI_NATIVE_HTTP_ISSUER_CONFIG`), and
+ *    any native issuer the caller configured in code;
+ *  - `KYA_OS_TRUSTED_DELEGATION_ISSUERS`;
+ *  - the Checkpoint platform signer, found through the configured Checkpoint
+ *    origin's own DID document (`CHECKPOINT_API_URL`, default kya.vouched.id),
+ *    which names that did:key in `alsoKnownAs` under the same key.
+ *
+ * Nothing is hard-coded, and nothing named only by a token is fetched: an
+ * issuer is pinned before its DID document is resolved, and a status list is
+ * fetched only from a credential a pinned issuer signed.
+ *
+ * Accepted audiences: the worker's DID, `CHECKPOINT_PROJECT_ID`, the binding's
+ * org DID and project, any native issuer the caller configured in code, and
+ * `KYA_OS_DELEGATION_AUDIENCES`.
+ */
+import { canonicalize } from "json-canonicalize";
+import { base58Decode, base64urlDecodeToBytes, buildDidResolverRegistry, bytesToBase64, createDidKeyResolver, createDidWebResolver, extractPublicKeyFromDidKey, isIndexSet, } from "@kya-os/mcp";
+import { DEFAULT_CHECKPOINT_URL } from "../constants";
+import { fetchNativeNoRedirect } from "../delegation-http/native-fetch";
+import { secureHttpUrl, validNativeStatus, } from "../delegation-http/native-http";
+import { parseNativeIssuerBinding } from "../delegation-http/remote-issuer";
+import { WebCryptoProvider } from "../providers/crypto";
+const DID_PATTERN = /^did:[a-z0-9]+:[^\s#?]+$/;
+const UPSTREAM_TIMEOUT_MS = 3_000;
+const DID_DOCUMENT_TTL_MS = 5 * 60_000;
+/** A failed Checkpoint discovery is retried at most this often per isolate. */
+const DISCOVERY_RETRY_MS = 30_000;
+const DID_DOCUMENT_MAX_BYTES = 64 * 1024;
+const STATUS_RESPONSE_MAX_BYTES = 1024 * 1024;
+/** Same ceiling as `@kya-os/mcp`'s MAX_STATUS_LIST_BYTES (16 MiB inflated). */
+const STATUS_LIST_MAX_BYTES = 16 * 1024 * 1024;
+function listFrom(value) {
+    return typeof value === "string" ? value.split(/[\s,]+/).filter(Boolean) : [];
+}
+function checkpointOriginFor(url) {
+    if (!secureHttpUrl(url, true))
+        return undefined;
+    return new URL(url).origin;
+}
+/** Build the trust policy from deployment configuration. */
+export function resolveDelegationTrust(env, options = {}) {
+    const issuers = new Set();
+    const audiences = new Set();
+    const ownDid = typeof env.MCP_IDENTITY_AGENT_DID === "string" &&
+        DID_PATTERN.test(env.MCP_IDENTITY_AGENT_DID)
+        ? env.MCP_IDENTITY_AGENT_DID
+        : undefined;
+    if (ownDid) {
+        issuers.add(ownDid);
+        audiences.add(ownDid);
+    }
+    const binding = parseNativeIssuerBinding(env.MCPI_NATIVE_HTTP_ISSUER_CONFIG);
+    if (binding) {
+        issuers.add(binding.issuerDid);
+        audiences.add(binding.issuerDid);
+        audiences.add(binding.projectId);
+    }
+    for (const did of [
+        ...listFrom(env.KYA_OS_TRUSTED_DELEGATION_ISSUERS),
+        ...(options.trustedIssuers ?? []),
+    ])
+        if (did && DID_PATTERN.test(did))
+            issuers.add(did);
+    for (const aud of [
+        ...listFrom(env.CHECKPOINT_PROJECT_ID),
+        ...listFrom(env.KYA_OS_DELEGATION_AUDIENCES),
+        ...(options.audiences ?? []),
+    ])
+        if (aud)
+            audiences.add(aud);
+    const checkpointUrl = env.CHECKPOINT_API_URL || DEFAULT_CHECKPOINT_URL;
+    return {
+        issuers,
+        audiences,
+        ownDid,
+        checkpointOrigin: typeof checkpointUrl === "string"
+            ? checkpointOriginFor(checkpointUrl)
+            : undefined,
+    };
+}
+/**
+ * A credential's handle: `vc.id`, else the `jti` claim. The same rule as
+ * Checkpoint's reporter, so both name a credential alike. Org-issued
+ * delegations carry their per-delegation credential id as `vc.id` and no `jti`.
+ */
+export function credentialHandle(payload) {
+    const vc = payload.vc;
+    const vcId = typeof vc === "object" && vc !== null
+        ? vc.id
+        : undefined;
+    if (typeof vcId === "string" && vcId.length > 0)
+        return vcId;
+    const jti = payload.jti;
+    return typeof jti === "string" && jti.length > 0 ? jti : undefined;
+}
+/** RFC 7519 §4.1.3: `aud` is a string or an array; one accepted value is enough. */
+export function audienceVerdict(aud, trust) {
+    if (aud === undefined)
+        return "missing";
+    const values = Array.isArray(aud) ? aud : [aud];
+    return values.some((v) => typeof v === "string" && trust.audiences.has(v))
+        ? "accepted"
+        : "unmatched";
+}
+async function readBounded(stream, maxBytes) {
+    if (!stream)
+        throw new Error("Empty body");
+    const reader = stream.getReader();
+    const chunks = [];
+    let length = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            length += value.length;
+            if (length > maxBytes) {
+                void reader.cancel().catch(() => { });
+                throw new Error("Body exceeds limit");
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(length);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.length;
+    }
+    return bytes;
+}
+async function readBoundedJson(response, maxBytes) {
+    if (response.status !== 200) {
+        void response.body?.cancel().catch(() => { });
+        throw new Error(`Unexpected status ${response.status}`);
+    }
+    return JSON.parse(new TextDecoder().decode(await readBounded(response.body, maxBytes)));
+}
+function upstreamFetch(url) {
+    return fetchNativeNoRedirect(url, {
+        signal: AbortSignal.timeout(UPSTREAM_TIMEOUT_MS),
+        headers: { Accept: "application/did+ld+json, application/json" },
+    });
+}
+function isDidDocument(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const doc = value;
+    return (typeof doc.id === "string" &&
+        (doc.verificationMethod === undefined ||
+            Array.isArray(doc.verificationMethod)) &&
+        (doc.assertionMethod === undefined || Array.isArray(doc.assertionMethod)) &&
+        (doc.alsoKnownAs === undefined || Array.isArray(doc.alsoKnownAs)));
+}
+/**
+ * did:key resolves locally and did:web through `@kya-os/mcp`'s resolver; every
+ * fetch refuses redirects, times out and is size-capped. Successful documents
+ * are cached for five minutes per resolver; a failed Checkpoint discovery for
+ * thirty seconds, so a degraded origin is not refetched for every token.
+ */
+export function createDelegationDidResolver(fetchUpstream = upstreamFetch) {
+    const provider = {
+        // DidWebResolver reads the body unbounded, so hand it a capped copy.
+        async fetch(url) {
+            const response = await fetchUpstream(url);
+            if (!response.ok) {
+                void response.body?.cancel().catch(() => { });
+                return new Response(null, { status: response.status });
+            }
+            return new Response((await readBounded(response.body, DID_DOCUMENT_MAX_BYTES)), { status: response.status });
+        },
+        resolveDID: async () => null,
+        fetchStatusList: async () => null,
+        fetchDelegationChain: async () => [],
+    };
+    const resolvers = buildDidResolverRegistry({
+        key: createDidKeyResolver(),
+        web: (fp) => createDidWebResolver(fp, { cacheTtl: DID_DOCUMENT_TTL_MS }),
+    }, provider);
+    const checkpointDocs = new Map();
+    const remember = (origin, doc) => {
+        checkpointDocs.set(origin, {
+            doc,
+            expiresAt: Date.now() + (doc ? DID_DOCUMENT_TTL_MS : DISCOVERY_RETRY_MS),
+        });
+        return doc;
+    };
+    return {
+        async resolve(did) {
+            const method = /^did:([a-z0-9]+):/.exec(did)?.[1];
+            const resolver = method ? resolvers[method] : undefined;
+            if (!resolver)
+                return null;
+            try {
+                return await resolver.resolve(did);
+            }
+            catch {
+                return null;
+            }
+        },
+        // Checkpoint serves its server identity at /.well-known/did.json with the
+        // production did:web id on every host, so this is fetched by origin rather
+        // than resolved as did:web (a staging host would fail the id check).
+        async checkpointIdentity(origin) {
+            const cached = checkpointDocs.get(origin);
+            if (cached && cached.expiresAt > Date.now())
+                return cached.doc;
+            try {
+                const doc = await readBoundedJson(await fetchUpstream(origin + "/.well-known/did.json"), DID_DOCUMENT_MAX_BYTES);
+                return remember(origin, isDidDocument(doc) ? doc : null);
+            }
+            catch {
+                return remember(origin, null);
+            }
+        },
+    };
+}
+let sharedResolver;
+/** One resolver per isolate, so DID documents stay cached across requests. */
+export function sharedDelegationDidResolver() {
+    return (sharedResolver ??= createDelegationDidResolver());
+}
+function methodKey(vm) {
+    try {
+        const jwk = vm.publicKeyJwk;
+        if (jwk && jwk.kty === "OKP" && jwk.crv === "Ed25519") {
+            const key = typeof jwk.x === "string" ? base64urlDecodeToBytes(jwk.x) : null;
+            return key?.length === 32 ? key : null;
+        }
+        if (vm.publicKeyMultibase?.startsWith("z")) {
+            const decoded = base58Decode(vm.publicKeyMultibase.slice(1));
+            return decoded.length === 34 && decoded[0] === 0xed && decoded[1] === 1
+                ? decoded.slice(2)
+                : null;
+        }
+    }
+    catch {
+        // Malformed key material is simply not a usable key.
+    }
+    return null;
+}
+/**
+ * Ed25519 keys the document authorizes for assertions (`assertionMethod`),
+ * narrowed to `kid` when the token names one. A did:key has exactly one key,
+ * so only its DID part has to match.
+ */
+export function assertionKeys(doc, kid) {
+    const absolute = (id) => (id.startsWith("#") ? doc.id + id : id);
+    const byId = new Map();
+    for (const vm of doc.verificationMethod ?? [])
+        if (typeof vm?.id === "string")
+            byId.set(absolute(vm.id), vm);
+    const methods = [];
+    for (const entry of doc.assertionMethod ?? []) {
+        const vm = typeof entry === "string"
+            ? byId.get(absolute(entry))
+            : (entry ?? undefined);
+        if (typeof vm?.id === "string")
+            methods.push(vm);
+    }
+    let selected = methods;
+    if (kid !== undefined) {
+        const wanted = absolute(kid);
+        selected = methods.filter((vm) => absolute(vm.id) === wanted);
+        if (!selected.length &&
+            doc.id.startsWith("did:key:") &&
+            wanted.split("#")[0] === doc.id)
+            selected = methods;
+    }
+    return selected
+        .map(methodKey)
+        .filter((key) => key !== null);
+}
+/** Ed25519 signature check against any of `keys`. */
+export async function verifiesWithAnyKey(signingInput, signature, keys) {
+    let signatureBytes;
+    try {
+        signatureBytes = base64urlDecodeToBytes(signature);
+    }
+    catch {
+        return false;
+    }
+    const data = new TextEncoder().encode(signingInput);
+    const crypto = new WebCryptoProvider();
+    for (const key of keys)
+        if (await crypto.verify(data, signatureBytes, bytesToBase64(key)))
+            return true;
+    return false;
+}
+function sameBytes(a, b) {
+    return a.length === b.length && a.every((byte, i) => byte === b[i]);
+}
+/**
+ * Whether `issuerDid` is the Checkpoint platform signer: the did:key the
+ * configured Checkpoint origin's DID document lists in `alsoKnownAs` AND
+ * publishes as one of its own assertion keys.
+ */
+export async function isCheckpointPlatformIssuer(issuerDid, trust, resolver) {
+    if (!trust.checkpointOrigin || !issuerDid.startsWith("did:key:"))
+        return false;
+    const doc = await resolver.checkpointIdentity(trust.checkpointOrigin);
+    if (!doc?.alsoKnownAs?.includes(issuerDid))
+        return false;
+    const aliasKey = extractPublicKeyFromDidKey(issuerDid);
+    return (!!aliasKey && assertionKeys(doc).some((key) => sameBytes(key, aliasKey)));
+}
+/**
+ * The status entries a VC-JWT carries: the W3C `vc.credentialStatus` and the
+ * draft-kya-http-02 top-level `credentialStatus`. Returns null when either is
+ * malformed or the two disagree.
+ */
+export function credentialStatusEntries(payload) {
+    const vc = payload.vc;
+    const inner = vc?.credentialStatus;
+    const outer = payload.credentialStatus;
+    if (inner !== undefined &&
+        outer !== undefined &&
+        canonicalize(inner) !== canonicalize(outer))
+        return null;
+    const status = inner ?? outer;
+    if (status === undefined)
+        return [];
+    const entries = Array.isArray(status) ? status : [status];
+    return entries.length ? entries : null;
+}
+function gunzipBounded(bytes) {
+    const body = new Response(bytes).body;
+    if (!body)
+        throw new Error("Empty status list");
+    return readBounded(body.pipeThrough(new DecompressionStream("gzip")), STATUS_LIST_MAX_BYTES);
+}
+/**
+ * Read one revocation entry, fail closed: an entry the native profile would not
+ * issue (`validNativeStatus`), an unreachable or malformed list, a purpose
+ * mismatch, or an out-of-range index is "unresolvable", never "clear".
+ */
+export async function checkCredentialStatusEntry(entry, fetchUpstream = upstreamFetch) {
+    if (!entry ||
+        typeof entry !== "object" ||
+        !validNativeStatus(entry))
+        return "unresolvable";
+    const status = entry;
+    try {
+        const list = (await readBoundedJson(await fetchUpstream(status.statusListCredential), STATUS_RESPONSE_MAX_BYTES));
+        const subject = list?.credentialSubject;
+        if (!subject ||
+            subject.statusPurpose !== status.statusPurpose ||
+            typeof subject.encodedList !== "string")
+            return "unresolvable";
+        const revoked = await isIndexSet(subject.encodedList, Number(status.statusListIndex), { decompress: gunzipBounded });
+        return revoked ? "revoked" : "clear";
+    }
+    catch {
+        return "unresolvable";
+    }
+}
+/** "1"/"true" opts a development worker into unchecked legacy tokens. */
+export function insecureDevTokensEnabled(env) {
+    const flag = String(env.KYA_OS_INSECURE_DEV_TOKENS ?? "")
+        .trim()
+        .toLowerCase();
+    return flag === "1" || flag === "true";
+}
+//# sourceMappingURL=delegation-trust.js.map

package/dist/services/delegation-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-trust.js","sourceRoot":"","sources":["../../src/services/delegation-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,wBAAwB,EACxB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,UAAU,GAKX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EACL,aAAa,EACb,iBAAiB,GAElB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AA4BxD,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAC/C,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,mBAAmB,GAAG,CAAC,GAAG,MAAM,CAAC;AACvC,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,MAAM,yBAAyB,GAAG,IAAI,GAAG,IAAI,CAAC;AAC9C,+EAA+E;AAC/E,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE/C,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AAC7B,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,sBAAsB,CACpC,GAAkB,EAClB,UAAkC,EAAE;IAEpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,MAAM,GACV,OAAO,GAAG,CAAC,sBAAsB,KAAK,QAAQ;QAC9C,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC;QAC1C,CAAC,CAAC,GAAG,CAAC,sBAAsB;QAC5B,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GAAG,wBAAwB,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC7E,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/B,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IACD,KAAK,MAAM,GAAG,IAAI;QAChB,GAAG,QAAQ,CAAC,GAAG,CAAC,iCAAiC,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;KAClC;QACC,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI;QAChB,GAAG,QAAQ,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACtC,GAAG,QAAQ,CAAC,GAAG,CAAC,2BAA2B,CAAC;QAC5C,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;KAC7B;QACC,IAAI,GAAG;YAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,aAAa,GAAG,GAAG,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;IACvE,OAAO;QACL,OAAO;QACP,SAAS;QACT,MAAM;QACN,gBAAgB,EACd,OAAO,aAAa,KAAK,QAAQ;YAC/B,CAAC,CAAC,mBAAmB,CAAC,aAAa,CAAC;YACpC,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAgC;IAEhC,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;IACtB,MAAM,IAAI,GACR,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,IAAI;QACnC,CAAC,CAAE,EAA8B,CAAC,EAAE;QACpC,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAC7B,GAAY,EACZ,KAAsB;IAEtB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,WAAW,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,MAAyC,EACzC,QAAgB;IAEhB,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAClC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;YACvB,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;gBACtB,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,QAAkB,EAClB,QAAgB;IAEhB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,KAAK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CACf,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,qBAAqB,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC;QAChD,OAAO,EAAE,EAAE,MAAM,EAAE,2CAA2C,EAAE;KACjE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;QAC1B,CAAC,GAAG,CAAC,kBAAkB,KAAK,SAAS;YACnC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACxC,CAAC,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACzE,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAClE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,gBAAoD,aAAa;IAEjE,MAAM,QAAQ,GAAkB;QAC9B,qEAAqE;QACrE,KAAK,CAAC,KAAK,CAAC,GAAW;YACrB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,KAAK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC7C,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,IAAI,QAAQ,CACjB,CAAC,MAAM,WAAW,CAChB,QAAQ,CAAC,IAAI,EACb,sBAAsB,CACvB,CAAiB,EAClB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAC5B,CAAC;QACJ,CAAC;QACD,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;QAC5B,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;QACjC,oBAAoB,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;KACrC,CAAC;IACF,MAAM,SAAS,GAAG,wBAAwB,CACxC;QACE,GAAG,EAAE,oBAAoB,EAAE;QAC3B,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,mBAAmB,EAAE,CAAC;KACzE,EACD,QAAQ,CACT,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,EAG3B,CAAC;IACJ,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,GAAuB,EAAE,EAAE;QAC3D,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE;YACzB,GAAG;YACH,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,kBAAkB,CAAC;SACzE,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxD,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3B,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,qEAAqE;QACrE,KAAK,CAAC,kBAAkB,CAAC,MAAM;YAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC;YAC/D,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,eAAe,CAC/B,MAAM,aAAa,CAAC,MAAM,GAAG,uBAAuB,CAAC,EACrD,sBAAsB,CACvB,CAAC;gBACF,OAAO,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,IAAI,cAAiD,CAAC;AAEtD,8EAA8E;AAC9E,MAAM,UAAU,2BAA2B;IACzC,OAAO,CAAC,cAAc,KAAK,2BAA2B,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,SAAS,CAAC,EAAsB;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAmD,CAAC;QACnE,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,GAAG,GACP,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACnE,OAAO,GAAG,EAAE,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACzC,CAAC;QACD,IAAI,EAAE,CAAC,kBAAkB,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,OAAO,OAAO,CAAC,MAAM,KAAK,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;gBACrE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClB,CAAC,CAAC,IAAI,CAAC;QACX,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAgB,EAAE,GAAY;IAC1D,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8B,CAAC;IACnD,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,kBAAkB,IAAI,EAAE;QAC3C,IAAI,OAAO,EAAE,EAAE,EAAE,KAAK,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,EAAE,GACN,OAAO,KAAK,KAAK,QAAQ;YACvB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;QAC3B,IAAI,OAAO,EAAE,EAAE,EAAE,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,QAAQ,GAAG,OAAO,CAAC;IACvB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,CAAC;QAC9D,IACE,CAAC,QAAQ,CAAC,MAAM;YAChB,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAC7B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE;YAE/B,QAAQ,GAAG,OAAO,CAAC;IACvB,CAAC;IACD,OAAO,QAAQ;SACZ,GAAG,CAAC,SAAS,CAAC;SACd,MAAM,CAAC,CAAC,GAAG,EAAqB,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,qDAAqD;AACrD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,YAAoB,EACpB,SAAiB,EACjB,IAA2B;IAE3B,IAAI,cAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,cAAc,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,IAAI;QACpB,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;IAChB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,CAAa,EAAE,CAAa;IAC7C,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,SAAiB,EACjB,KAAsB,EACtB,QAA+B;IAE/B,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtE,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;IACvD,OAAO,CACL,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CACzE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAgC;IAEhC,MAAM,EAAE,GAAG,OAAO,CAAC,EAAyC,CAAC;IAC7D,MAAM,KAAK,GAAG,EAAE,EAAE,gBAAgB,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACvC,IACE,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,SAAS;QACnB,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC;QAE3C,OAAO,IAAI,CAAC;IACd,MAAM,MAAM,GAAG,KAAK,IAAI,KAAK,CAAC;IAC9B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,KAAqB,CAAC,CAAC,IAAI,CAAC;IACtD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAChD,OAAO,WAAW,CAChB,IAAI,CAAC,WAAW,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC,EACjD,qBAAqB,CACtB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAc,EACd,gBAAoD,aAAa;IAEjE,IACE,CAAC,KAAK;QACN,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,iBAAiB,CAAC,KAA+B,CAAC;QAEnD,OAAO,cAAc,CAAC;IACxB,MAAM,MAAM,GAAG,KAA+B,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,eAAe,CACjC,MAAM,aAAa,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAChD,yBAAyB,CAC1B,CAA2D,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,EAAE,iBAAiB,CAAC;QACxC,IACE,CAAC,OAAO;YACR,OAAO,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;YAC9C,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ;YAEvC,OAAO,cAAc,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,UAAU,CAC9B,OAAO,CAAC,WAAW,EACnB,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,EAC9B,EAAE,UAAU,EAAE,aAAa,EAAE,CAC9B,CAAC;QACF,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC;IACxB,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,wBAAwB,CAAC,GAAkB;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC;SACtD,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IACjB,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,MAAM,CAAC;AACzC,CAAC"}