@kya-os/mcp-i-cloudflare 1.15.0 → 1.16.0

package/dist/services/delegation.service.d.ts

@@ -5,11 +5,17 @@
  * for MCP-I Cloudflare servers.
  *
  * Supports both:
- * - Local VC-JWT verification (offline, cryptographic)
+ * - Local VC-JWT verification (offline, cryptographic), restricted to pinned
+ *   issuers and accepted audiences (see ./delegation-trust)
  * - Checkpoint API verification (online, centralized)
  */
 import type { CloudflareEnv } from "../types";
 import type { CloudflareRuntime } from "../runtime";
+import { type DelegationDidResolver, type DelegationTrustOptions } from "./delegation-trust";
+export interface DelegationServiceOptions extends DelegationTrustOptions {
+    /** DID resolution seam. Defaults to one shared did:key + did:web resolver. */
+    didResolver?: DelegationDidResolver;
+}
 /**
  * Result of VC-JWT verification with extracted delegation data
  */
@@ -18,7 +24,7 @@ export interface VCJWTVerificationResult {
     valid: boolean;
     /** Error message if invalid */
     error?: string;
-    /** Delegation ID (from jti claim) */
+    /** The credential's handle: `vc.id`, else the `jti` claim */
     delegationId?: string;
     /** Agent DID (from sub claim) */
     agentDid?: string;
@@ -36,11 +42,15 @@ export interface VCJWTVerificationResult {
     issuerDid?: string;
     /** Expiration timestamp (seconds since epoch) */
     expiresAt?: number;
+    /** Whether a credentialStatus entry was read and found clear */
+    hasCredentialStatus?: boolean;
 }
 export declare class DelegationService {
     private env;
     private runtime?;
-    constructor(env: CloudflareEnv, runtime?: CloudflareRuntime);
+    private trust;
+    private didResolver;
+    constructor(env: CloudflareEnv, runtime?: CloudflareRuntime, options?: DelegationServiceOptions);
     /**
      * Get delegation token from cache or storage
      * @param sessionId - Optional session ID for session-based lookup
@@ -52,15 +62,42 @@ export declare class DelegationService {
      *
      * VC-JWTs are distinguished from legacy delegation tokens by:
      * - alg: 'EdDSA' (Ed25519 signing) vs legacy HS256
-     * - typ: 'vc+jwt' or 'JWT' (both are valid VC-JWT type indicators)
+     * - typ: 'vc+jwt' or 'JWT' (both are valid VC-JWT type indicators), or any
+     *   typ when the payload carries a `vc` object (Checkpoint's own rule), so a
+     *   nonstandard typ cannot route a credential around local verification
      *
      * This allows legacy HS256 tokens to fall through to API verification
      * while VC-JWTs are verified locally using cryptographic verification.
      */
     private isVCJWT;
     /**
-     * Verify a VC-JWT locally using cryptographic verification
-     * This enables offline/local verification without calling Checkpoint API
+     * Whether a cached development verdict still holds under THIS deployment's
+     * trust: the token's issuer is the one the verdict was granted to, it is
+     * still pinned, and the token's `aud` is still accepted (a KV namespace may
+     * be shared by deployments with different audiences). Development only, so
+     * no audience is deferred to Checkpoint here.
+     */
+    private servesCachedVerdict;
+    /** Whether `issuerDid` is pinned: statically, or as the Checkpoint platform signer. */
+    private isPinnedIssuer;
+    /**
+     * Verify a VC-JWT locally: audience, issuer pin, signature, content and
+     * credential status, in that order. The cheap checks come first, and the
+     * only fetch an unpinned issuer can cause is the configured Checkpoint's own
+     * DID document (cached).
+     *
+     * Audience: `aud` must name this worker (see ./delegation-trust). Only a
+     * self-issued credential (issuer = this worker's own DID) may omit it: the
+     * anchor flow mints self-issued delegations without `aud`, while the
+     * Checkpoint platform mint, the hosted-consent org mint and the native
+     * issuer always set it. One exception: with a Checkpoint API key, a
+     * platform-signed credential may carry an `aud` this worker cannot name
+     * (its project UUID, while CHECKPOINT_PROJECT_ID is often the friendly id).
+     * Checkpoint's confirm pins that `aud` to the API key's project, so the
+     * check is left to it.
+     *
+     * Issuer: only pinned issuers are resolved and verified. An untrusted or
+     * unresolvable issuer fails closed.
      *
      * @param vcJwt - The VC-JWT string to verify
      * @returns Verification result with extracted delegation data
@@ -88,18 +125,23 @@ export declare class DelegationService {
      *
      * Verification strategy:
      * 1. Early expiration check (cheap, before any crypto)
-     * 2. Check cache
-     * 3. If token is a VC-JWT, verify its signature locally, which refuses a
-     *    forged or malformed credential without a network call
+     * 2. Check cache (development only, VC-JWTs only)
+     * 3. If token is a VC-JWT, verify it locally: accepted audience, pinned
+     *    issuer, signature, content and any credentialStatus entry. This refuses
+     *    a forged, foreign or revoked credential with or without Checkpoint.
      * 4. Confirm with Checkpoint that the delegation is still in force. A valid
      *    signature proves who issued the credential, not that it was never
-     *    revoked; revocation lives at Checkpoint. Only a deployment with no
-     *    Checkpoint API key (development) skips this and cannot see revocation.
+     *    revoked; revocation of status-less credentials lives at Checkpoint.
+     *    Only a deployment with no Checkpoint API key (development) skips this.
+     *
+     * Legacy (non VC-JWT) tokens can only be checked by Checkpoint. Without an
+     * API key they are refused unless KYA_OS_INSECURE_DEV_TOKENS opts in.
      *
      * With a Checkpoint API key no verdict is cached: every verification asks
-     * Checkpoint, so a revocation refuses the very next call. Only the
-     * development path, which cannot see revocation anyway, caches a VC-JWT's
-     * verified signature for DEFAULT_VERIFICATION_CACHE_TTL seconds.
+     * Checkpoint, so a revocation refuses the very next call. Development caches
+     * only a pinned issuer's status-less VC-JWT, for
+     * DEFAULT_VERIFICATION_CACHE_TTL seconds, and a hit counts only while that
+     * issuer is still pinned.
      *
      * @param token - Delegation token to verify
      * @returns True if token is valid, false otherwise

package/dist/services/delegation.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delegation.service.d.ts","sourceRoot":"","sources":["../../src/services/delegation.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAO9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AASpD;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,iCAAiC;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,GAAG,CAAgB;IAC3B,OAAO,CAAC,OAAO,CAAC,CAAoB;gBAExB,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,iBAAiB;IAK3D;;;;OAIG;IACG,kBAAkB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAoIpE;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;IAuBf;;;;;;OAMG;YACW,kBAAkB;IAgKhC;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IA8BtB;;;;;;;OAOG;YACW,SAAS;IAUvB;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA6DvD;;;;;OAKG;YACW,qBAAqB;IAsDnC;;;;;OAKG;IACG,eAAe,CACnB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;CAoDjB"}
+{"version":3,"file":"delegation.service.d.ts","sourceRoot":"","sources":["../../src/services/delegation.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAO9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,OAAO,EAWL,KAAK,qBAAqB,EAE1B,KAAK,sBAAsB,EAC5B,MAAM,oBAAoB,CAAC;AAc5B,MAAM,WAAW,wBAAyB,SAAQ,sBAAsB;IACtE,8EAA8E;IAC9E,WAAW,CAAC,EAAE,qBAAqB,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,iCAAiC;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,GAAG,CAAgB;IAC3B,OAAO,CAAC,OAAO,CAAC,CAAoB;IACpC,OAAO,CAAC,KAAK,CAAkB;IAC/B,OAAO,CAAC,WAAW,CAAwB;gBAGzC,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,iBAAiB,EAC3B,OAAO,GAAE,wBAA6B;IAQxC;;;;OAIG;IACG,kBAAkB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAoIpE;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,OAAO;IAyBf;;;;;;OAMG;YACW,mBAAmB;IAejC,uFAAuF;YACzE,cAAc;IAW5B;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,kBAAkB;IAuLhC;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IA8BtB;;;;;;;OAOG;YACW,SAAS;IAUvB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA+FvD;;;;;OAKG;YACW,qBAAqB;IAoEnC;;;;;OAKG;IACG,eAAe,CACnB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;CAsDjB"}

package/dist/services/delegation.service.js

@@ -5,19 +5,34 @@
  * for MCP-I Cloudflare servers.
  *
  * Supports both:
- * - Local VC-JWT verification (offline, cryptographic)
+ * - Local VC-JWT verification (offline, cryptographic), restricted to pinned
+ *   issuers and accepted audiences (see ./delegation-trust)
  * - Checkpoint API verification (online, centralized)
  */
 import { DEFAULT_CHECKPOINT_URL, DEFAULT_VERIFICATION_CACHE_TTL, DEFAULT_SESSION_CACHE_TTL, } from "../constants";
 import { STORAGE_KEYS } from "../constants/storage-keys";
-import { parseVCJWT, createDidKeyResolver, base64urlDecodeToBytes, bytesToBase64, } from "@kya-os/mcp";
-import { WebCryptoProvider } from "../providers/crypto";
+import { parseVCJWT } from "@kya-os/mcp";
+import { assertionKeys, audienceVerdict, checkCredentialStatusEntry, credentialHandle, credentialStatusEntries, insecureDevTokensEnabled, isCheckpointPlatformIssuer, resolveDelegationTrust, sharedDelegationDidResolver, verifiesWithAnyKey, } from "./delegation-trust";
+/**
+ * Prefix of a cached development verdict. The rest is the pinned issuer the
+ * verdict was granted to, re-checked on every hit. Earlier releases cached "1"
+ * for any self-signed did:key token; those entries never match.
+ */
+const PINNED_VERDICT_PREFIX = "pinned:";
+/** A token-supplied value, quoted and truncated so it cannot forge log lines. */
+function logSafe(value) {
+    return JSON.stringify(value.slice(0, 200));
+}
 export class DelegationService {
     env;
     runtime;
-    constructor(env, runtime) {
+    trust;
+    didResolver;
+    constructor(env, runtime, options = {}) {
         this.env = env;
         this.runtime = runtime;
+        this.trust = resolveDelegationTrust(env, options);
+        this.didResolver = options.didResolver ?? sharedDelegationDidResolver();
     }
     /**
      * Get delegation token from cache or storage
@@ -118,7 +133,9 @@ export class DelegationService {
      *
      * VC-JWTs are distinguished from legacy delegation tokens by:
      * - alg: 'EdDSA' (Ed25519 signing) vs legacy HS256
-     * - typ: 'vc+jwt' or 'JWT' (both are valid VC-JWT type indicators)
+     * - typ: 'vc+jwt' or 'JWT' (both are valid VC-JWT type indicators), or any
+     *   typ when the payload carries a `vc` object (Checkpoint's own rule), so a
+     *   nonstandard typ cannot route a credential around local verification
      *
      * This allows legacy HS256 tokens to fall through to API verification
      * while VC-JWTs are verified locally using cryptographic verification.
@@ -138,60 +155,97 @@ export class DelegationService {
             // Accept both 'JWT' and 'vc+jwt' as valid type indicators
             // W3C VC-JWT spec uses 'vc+jwt', but some implementations use 'JWT'
             const validTypes = ["JWT", "vc+jwt"];
-            if (!validTypes.includes(parsed.header.typ))
-                return false;
-            return true;
+            const vc = parsed.payload.vc;
+            return (validTypes.includes(parsed.header.typ) ||
+                (typeof vc === "object" && vc !== null));
         }
         catch {
             return false;
         }
     }
     /**
-     * Verify a VC-JWT locally using cryptographic verification
-     * This enables offline/local verification without calling Checkpoint API
+     * Whether a cached development verdict still holds under THIS deployment's
+     * trust: the token's issuer is the one the verdict was granted to, it is
+     * still pinned, and the token's `aud` is still accepted (a KV namespace may
+     * be shared by deployments with different audiences). Development only, so
+     * no audience is deferred to Checkpoint here.
+     */
+    async servesCachedVerdict(token, grantedIssuer) {
+        const payload = parseVCJWT(token)?.payload;
+        if (!payload || payload.iss !== grantedIssuer)
+            return false;
+        const audience = audienceVerdict(payload.aud, this.trust);
+        if (audience !== "accepted" &&
+            !(audience === "missing" && grantedIssuer === this.trust.ownDid))
+            return false;
+        return this.isPinnedIssuer(grantedIssuer);
+    }
+    /** Whether `issuerDid` is pinned: statically, or as the Checkpoint platform signer. */
+    async isPinnedIssuer(issuerDid) {
+        return (this.trust.issuers.has(issuerDid) ||
+            (await isCheckpointPlatformIssuer(issuerDid, this.trust, this.didResolver)));
+    }
+    /**
+     * Verify a VC-JWT locally: audience, issuer pin, signature, content and
+     * credential status, in that order. The cheap checks come first, and the
+     * only fetch an unpinned issuer can cause is the configured Checkpoint's own
+     * DID document (cached).
+     *
+     * Audience: `aud` must name this worker (see ./delegation-trust). Only a
+     * self-issued credential (issuer = this worker's own DID) may omit it: the
+     * anchor flow mints self-issued delegations without `aud`, while the
+     * Checkpoint platform mint, the hosted-consent org mint and the native
+     * issuer always set it. One exception: with a Checkpoint API key, a
+     * platform-signed credential may carry an `aud` this worker cannot name
+     * (its project UUID, while CHECKPOINT_PROJECT_ID is often the friendly id).
+     * Checkpoint's confirm pins that `aud` to the API key's project, so the
+     * check is left to it.
+     *
+     * Issuer: only pinned issuers are resolved and verified. An untrusted or
+     * unresolvable issuer fails closed.
      *
      * @param vcJwt - The VC-JWT string to verify
      * @returns Verification result with extracted delegation data
      */
     async verifyVCJWTLocally(vcJwt) {
+        const reject = (error) => {
+            console.error("[Delegation] VC-JWT rejected:", error);
+            return { valid: false, error };
+        };
         try {
             // 1. Parse the JWT
             const parsed = parseVCJWT(vcJwt);
-            if (!parsed) {
-                console.error("[Delegation] VC-JWT parsing failed");
-                return { valid: false, error: "VC-JWT parsing failed" };
-            }
-            // 2. Extract issuer DID from payload
+            if (!parsed)
+                return reject("VC-JWT parsing failed");
+            // 2. Issuer DID
             const issuerDid = parsed.payload.iss;
-            if (!issuerDid || typeof issuerDid !== "string") {
-                console.error("[Delegation] VC-JWT missing issuer (iss)");
-                return { valid: false, error: "Missing issuer (iss)" };
-            }
-            // 3. Resolve issuer DID to get public key
-            const resolver = createDidKeyResolver();
-            const didDoc = await resolver.resolve(issuerDid);
-            if (!didDoc?.verificationMethod?.[0]?.publicKeyJwk) {
-                console.error("[Delegation] Cannot resolve issuer DID or missing public key:", issuerDid);
-                return { valid: false, error: `Cannot resolve issuer DID: ${issuerDid}` };
+            if (!issuerDid || typeof issuerDid !== "string")
+                return reject("Missing issuer (iss)");
+            // 3. Audience, before anything touches the network
+            const audience = audienceVerdict(parsed.payload.aud, this.trust);
+            if (audience === "missing" && issuerDid !== this.trust.ownDid)
+                return reject("Missing audience (aud)");
+            if (audience === "unmatched" && !this.env.CHECKPOINT_API_KEY)
+                return reject("Audience not accepted");
+            // 4. Issuer pin, before the issuer's DID document is resolved
+            if (this.trust.issuers.has(issuerDid)) {
+                if (audience === "unmatched")
+                    return reject("Audience not accepted");
             }
-            // 4. Extract public key from DID Document
-            const jwk = didDoc.verificationMethod[0].publicKeyJwk;
-            if (!jwk?.x) {
-                console.error("[Delegation] DID Document missing public key x value");
-                return { valid: false, error: "DID Document missing public key" };
-            }
-            // 5. Convert to format expected by WebCryptoProvider
-            const publicKeyBytes = base64urlDecodeToBytes(jwk.x);
-            const publicKeyBase64 = bytesToBase64(publicKeyBytes);
-            // 6. Verify JWT signature
-            const signingInputBytes = new TextEncoder().encode(parsed.signingInput);
-            const signatureBytes = base64urlDecodeToBytes(parsed.signature);
-            const crypto = new WebCryptoProvider();
-            const isSignatureValid = await crypto.verify(signingInputBytes, signatureBytes, publicKeyBase64);
-            if (!isSignatureValid) {
-                console.error("[Delegation] VC-JWT signature verification failed");
-                return { valid: false, error: "Signature verification failed" };
+            else if (!(await isCheckpointPlatformIssuer(issuerDid, this.trust, this.didResolver))) {
+                return reject(`Untrusted issuer: ${logSafe(issuerDid)}`);
             }
+            // 5. Issuer key, selected by the protected `kid` when present
+            const kid = parsed.header.kid;
+            if (kid !== undefined && typeof kid !== "string")
+                return reject("Malformed key id (kid)");
+            const didDoc = await this.didResolver.resolve(issuerDid);
+            const keys = didDoc ? assertionKeys(didDoc, kid) : [];
+            if (!keys.length)
+                return reject(`Cannot resolve issuer key: ${logSafe(issuerDid)}`);
+            // 6. Signature
+            if (!(await verifiesWithAnyKey(parsed.signingInput, parsed.signature, keys)))
+                return reject("Signature verification failed");
             // 7. Run basic VC content validation (type, expiration, required fields)
             const vc = parsed.payload.vc;
             if (!vc) {
@@ -232,21 +286,24 @@ export class DelegationService {
             const credentialSubject = vc.credentialSubject;
             if (!credentialSubject.delegation) {
                 console.error("[Delegation] VC-JWT missing delegation in credentialSubject");
-                return { valid: false, error: "Missing delegation in credentialSubject" };
+                return {
+                    valid: false,
+                    error: "Missing delegation in credentialSubject",
+                };
             }
             // 8. Extract delegation data from VC payload
             const delegation = credentialSubject.delegation;
             // Extract standard JWT claims
-            const delegationId = parsed.payload.jti || delegation.id;
+            const delegationId = credentialHandle(parsed.payload);
             const agentDid = parsed.payload.sub || delegation.subjectDid;
             // Per RFC 7519, aud can be string or string[] - normalize to string (first element if array)
             // CLAIM-SLOT CAVEAT: historically this codebase minted project-scoped
             // delegations with aud = project id, which is what "projectId" assumes.
             // Cross-resource delegations (delegation-http anchor registration) mint
             // aud = the resource ORG's DID instead — for those credentials this value
-            // is an org DID, not a project id. It is logged/attributed only, never
-            // compared, so both meanings are safe here; do not start matching it
-            // against project ids without discriminating the credential's origin.
+            // is an org DID, not a project id. The audience gate above compares the
+            // whole claim against every accepted audience; this field is
+            // attribution only.
             const rawAud = parsed.payload.aud;
             const projectId = Array.isArray(rawAud) ? rawAud[0] : rawAud;
             // Extract delegation-specific fields (Phase 7: userDid, userIdentifier, sessionId, scopes)
@@ -256,6 +313,18 @@ export class DelegationService {
             const scopes = Array.isArray(delegation.scopes)
                 ? delegation.scopes.filter((s) => typeof s === "string")
                 : undefined;
+            // 9. Credential status, fail closed. Status-less credentials rely on the
+            // Checkpoint confirm for revocation.
+            const statusEntries = credentialStatusEntries(parsed.payload);
+            if (!statusEntries)
+                return reject("Malformed credentialStatus");
+            for (const entry of statusEntries) {
+                const verdict = await checkCredentialStatusEntry(entry);
+                if (verdict === "revoked")
+                    return reject("Credential revoked");
+                if (verdict !== "clear")
+                    return reject("Credential status unresolvable");
+            }
             console.error("[Delegation] ✅ VC-JWT verified locally (cryptographic)", {
                 delegationId,
                 agentDid: agentDid ? agentDid.slice(0, 20) + "..." : undefined,
@@ -274,6 +343,7 @@ export class DelegationService {
                 projectId,
                 issuerDid,
                 expiresAt: expClaim,
+                hasCredentialStatus: statusEntries.length > 0,
             };
         }
         catch (error) {
@@ -336,18 +406,23 @@ export class DelegationService {
      *
      * Verification strategy:
      * 1. Early expiration check (cheap, before any crypto)
-     * 2. Check cache
-     * 3. If token is a VC-JWT, verify its signature locally, which refuses a
-     *    forged or malformed credential without a network call
+     * 2. Check cache (development only, VC-JWTs only)
+     * 3. If token is a VC-JWT, verify it locally: accepted audience, pinned
+     *    issuer, signature, content and any credentialStatus entry. This refuses
+     *    a forged, foreign or revoked credential with or without Checkpoint.
      * 4. Confirm with Checkpoint that the delegation is still in force. A valid
      *    signature proves who issued the credential, not that it was never
-     *    revoked; revocation lives at Checkpoint. Only a deployment with no
-     *    Checkpoint API key (development) skips this and cannot see revocation.
+     *    revoked; revocation of status-less credentials lives at Checkpoint.
+     *    Only a deployment with no Checkpoint API key (development) skips this.
+     *
+     * Legacy (non VC-JWT) tokens can only be checked by Checkpoint. Without an
+     * API key they are refused unless KYA_OS_INSECURE_DEV_TOKENS opts in.
      *
      * With a Checkpoint API key no verdict is cached: every verification asks
-     * Checkpoint, so a revocation refuses the very next call. Only the
-     * development path, which cannot see revocation anyway, caches a VC-JWT's
-     * verified signature for DEFAULT_VERIFICATION_CACHE_TTL seconds.
+     * Checkpoint, so a revocation refuses the very next call. Development caches
+     * only a pinned issuer's status-less VC-JWT, for
+     * DEFAULT_VERIFICATION_CACHE_TTL seconds, and a hit counts only while that
+     * issuer is still pinned.
      *
      * @param token - Delegation token to verify
      * @returns True if token is valid, false otherwise
@@ -364,44 +439,58 @@ export class DelegationService {
         const verificationCache = this.env.CHECKPOINT_API_KEY
             ? undefined
             : this.env.TOOL_PROTECTION_KV;
-        if (verificationCache) {
+        const isVCJWT = this.isVCJWT(token);
+        if (verificationCache && isVCJWT) {
             const cacheKey = STORAGE_KEYS.verificationCache(await this.hashToken(token));
             const cached = await verificationCache.get(cacheKey);
-            if (cached === "1") {
+            if (typeof cached === "string" &&
+                cached.startsWith(PINNED_VERDICT_PREFIX) &&
+                (await this.servesCachedVerdict(token, cached.slice(PINNED_VERDICT_PREFIX.length)))) {
                 console.error("[Delegation] Token verification cached as valid");
                 return true;
             }
         }
         let agentDid;
         let scopes = [];
-        const isVCJWT = this.isVCJWT(token);
+        let pinnedIssuer;
         if (isVCJWT) {
             console.error("[Delegation] Detected VC-JWT format, attempting local verification");
             const vcResult = await this.verifyVCJWTLocally(token);
             if (!vcResult.valid) {
-                // If the cryptographic signature is invalid, the token is invalid
                 console.error("[Delegation] Local VC-JWT verification failed:", vcResult.error);
                 return false;
             }
             agentDid = vcResult.agentDid ?? "";
             scopes = vcResult.scopes ?? [];
+            // A status-bearing credential is re-read every time, so a revocation
+            // refuses the very next call; only status-less verdicts are cacheable.
+            pinnedIssuer = vcResult.hasCredentialStatus
+                ? undefined
+                : vcResult.issuerDid;
+        }
+        else if (!this.env.CHECKPOINT_API_KEY) {
+            // Nothing local can check a legacy token: it is a bearer string.
+            if (!insecureDevTokensEnabled(this.env)) {
+                console.error("[Delegation] Legacy (non VC-JWT) token refused: no CHECKPOINT_API_KEY to verify it. " +
+                    "Set KYA_OS_INSECURE_DEV_TOKENS=1 for local development only.");
+                return false;
+            }
+            console.warn("[Delegation] ⚠️ INSECURE: KYA_OS_INSECURE_DEV_TOKENS is set, so a legacy delegation token " +
+                "is accepted WITHOUT ANY VERIFICATION. Anyone can forge one. Never enable this outside local development.");
+            return true; // never cached
         }
         else {
             agentDid = this.runtime ? (await this.runtime.getIdentity()).did : "";
         }
         if (!this.env.CHECKPOINT_API_KEY) {
-            console.warn("[Delegation] No Checkpoint API key configured: accepting without Checkpoint, which cannot see revocation");
-            // Development: a legacy token is allowed unchecked and never cached; a
-            // VC-JWT's verified signature is cached as before.
-            if (!isVCJWT)
-                return true;
+            console.warn("[Delegation] No Checkpoint API key configured: accepting a pinned, locally verified VC-JWT without Checkpoint, which cannot see revocation of status-less credentials");
         }
         else if (!(await this.confirmWithCheckpoint(token, agentDid, scopes))) {
             return false;
         }
-        if (verificationCache) {
+        if (verificationCache && pinnedIssuer) {
             const cacheKey = STORAGE_KEYS.verificationCache(await this.hashToken(token));
-            await verificationCache.put(cacheKey, "1", {
+            await verificationCache.put(cacheKey, PINNED_VERDICT_PREFIX + pinnedIssuer, {
                 expirationTtl: DEFAULT_VERIFICATION_CACHE_TTL,
             });
         }
@@ -419,10 +508,13 @@ export class DelegationService {
         try {
             // Use AccessControlApiService if available from runtime
             if (this.runtime && "accessControlService" in this.runtime) {
-                const accessControlService = this.runtime.accessControlService;
+                const accessControlService = this
+                    .runtime.accessControlService;
                 if (accessControlService) {
                     const response = await accessControlService.verifyDelegation(request);
-                    if (response.data.valid)
+                    // The runtime client validates its response, but this seam accepts
+                    // any client: only an explicit `true` admits, as on the fetch path.
+                    if (response.data.valid === true)
                         return true;
                     console.error("[Delegation] Token verification failed:", response.data.reason || "Invalid token");
                     return false;

package/dist/services/delegation.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"delegation.service.js","sourceRoot":"","sources":["../../src/services/delegation.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,sBAAsB,EACtB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AA8BxD,MAAM,OAAO,iBAAiB;IACpB,GAAG,CAAgB;IACnB,OAAO,CAAqB;IAEpC,YAAY,GAAkB,EAAE,OAA2B;QACzD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,SAAkB;QACzC,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAEtD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,qEAAqE;YACrE,wCAAwC;YACxC,IAAI,OAA2B,CAAC;YAChC,IAAI,QAA4B,CAAC;YACjC,IAAI,WAAW,GAIJ,IAAI,CAAC;YAEhB,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACnD,WAAW,GAAG,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAItD,CAAC;gBACT,OAAO,GAAG,WAAW,EAAE,OAAO,CAAC;gBAC/B,QAAQ,GAAG,WAAW,EAAE,QAAQ,CAAC;YACnC,CAAC;YAED,8CAA8C;YAC9C,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBAClD,QAAQ,GAAG,QAAQ,EAAE,GAAG,CAAC;YAC3B,CAAC;YAED,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;gBACxB,MAAM,YAAY,GAAG,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAChE,OAAO,CAAC,KAAK,CACX,6DAA6D,EAC7D;oBACE,GAAG,EAAE,YAAY;oBACjB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;oBACrC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;iBACxC,CACF,CAAC;gBACF,MAAM,cAAc,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAChD,YAAY,EACZ,MAAM,CACP,CAAC;gBAEF,IAAI,cAAc,EAAE,CAAC;oBACnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;oBAC5D,IAAI,OAAO,EAAE,CAAC;wBACZ,OAAO,CAAC,KAAK,CACX,8EAA8E,CAC/E,CAAC;wBAEF,+BAA+B;wBAC/B,IAAI,SAAS,EAAE,CAAC;4BACd,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;4BACnD,MAAM,iBAAiB,CAAC,GAAG,CACzB,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;gCACb,GAAG,WAAW;gCACd,eAAe,EAAE,cAAc;gCAC/B,OAAO;gCACP,QAAQ;6BACT,CAAC,EACF;gCACE,aAAa,EAAE,yBAAyB;6BACzC,CACF,CAAC;wBACJ,CAAC;wBAED,OAAO,cAAc,CAAC;oBACxB,CAAC;yBAAM,CAAC;wBACN,mCAAmC;wBACnC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;wBAChE,OAAO,CAAC,KAAK,CACX,kEAAkE,CACnE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,qEAAqE;YACrE,IAAI,SAAS,IAAI,WAAW,EAAE,eAAe,EAAE,CAAC;gBAC9C,OAAO,CAAC,KAAK,CACX,4DAA4D,EAC5D;oBACE,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;iBAC1C,CACF,CAAC;gBACF,+CAA+C;gBAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CACzC,WAAW,CAAC,eAAe,CAC5B,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,KAAK,CACX,4EAA4E,CAC7E,CAAC;oBACF,OAAO,WAAW,CAAC,eAAe,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACN,mCAAmC;oBACnC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,eAAe,CAAC,CAAC;oBACnE,OAAO,CAAC,KAAK,CACX,8DAA8D,CAC/D,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,uDAAuD;YACvD,gFAAgF;YAChF,oEAAoE;YACpE,8DAA8D;YAE9D,OAAO,CAAC,KAAK,CACX,2EAA2E,EAC3E;gBACE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM;gBAC9D,UAAU,EAAE,CAAC,CAAC,OAAO;gBACrB,IAAI,EAAE,+EAA+E;aACtF,CACF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,OAAO,CAAC,KAAa;QAC3B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAEtD,IAAI,CAAC;YACH,mDAAmD;YACnD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAE1B,6CAA6C;YAC7C,4DAA4D;YAC5D,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC;YAEhD,0DAA0D;YAC1D,oEAAoE;YACpE,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAE1D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,kBAAkB,CAAC,KAAa;QAC5C,IAAI,CAAC;YACH,mBAAmB;YACnB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YAC1D,CAAC;YAED,qCAAqC;YACrC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAyB,CAAC;YAC3D,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAChD,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC1D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;YACzD,CAAC;YAED,0CAA0C;YAC1C,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;gBACnD,OAAO,CAAC,KAAK,CACX,+DAA+D,EAC/D,SAAS,CACV,CAAC;gBACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,SAAS,EAAE,EAAE,CAAC;YAC5E,CAAC;YAED,0CAA0C;YAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,YAAmD,CAAC;YAC7F,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBACtE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;YACpE,CAAC;YAED,qDAAqD;YACrD,MAAM,cAAc,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAW,CAAC,CAAC;YAC/D,MAAM,eAAe,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;YAEtD,0BAA0B;YAC1B,MAAM,iBAAiB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACxE,MAAM,cAAc,GAAG,sBAAsB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAEhE,MAAM,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;YACvC,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,MAAM,CAC1C,iBAAiB,EACjB,cAAc,EACd,eAAe,CAChB,CAAC;YAEF,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBACnE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;YAClE,CAAC;YAED,yEAAyE;YACzE,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAA6B,CAAC;YACxD,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;YACrD,CAAC;YAED,gBAAgB;YAChB,MAAM,KAAK,GAAG,EAAE,CAAC,IAA4B,CAAC;YAC9C,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBACxD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACvD,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;gBACvE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;YACtE,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;gBACvE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;YACtE,CAAC;YAED,gEAAgE;YAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAyB,CAAC;YAC1D,MAAM,cAAc,GAAG,EAAE,CAAC,cAAoC,CAAC;YAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,IAAI,QAAQ,IAAI,QAAQ,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;gBACtC,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBACzD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;YAC9D,CAAC;YACD,IAAI,cAAc,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;gBAC/D,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;YACnE,CAAC;YAED,2BAA2B;YAC3B,IAAI,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBAC/D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;YAC9D,CAAC;YACD,MAAM,iBAAiB,GAAG,EAAE,CAAC,iBAA4C,CAAC;YAC1E,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,CAAC;gBAClC,OAAO,CAAC,KAAK,CACX,6DAA6D,CAC9D,CAAC;gBACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;YAC5E,CAAC;YAED,6CAA6C;YAC7C,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAqC,CAAC;YAE3E,8BAA8B;YAC9B,MAAM,YAAY,GAAI,MAAM,CAAC,OAAO,CAAC,GAAc,IAAK,UAAU,CAAC,EAAa,CAAC;YACjF,MAAM,QAAQ,GAAI,MAAM,CAAC,OAAO,CAAC,GAAc,IAAK,UAAU,CAAC,UAAqB,CAAC;YACrF,6FAA6F;YAC7F,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,0EAA0E;YAC1E,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAClC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAE7D,2FAA2F;YAC3F,MAAM,OAAO,GAAG,UAAU,CAAC,OAA6B,CAAC;YACzD,MAAM,cAAc,GAAG,UAAU,CAAC,cAAoC,CAAC;YACvE,MAAM,SAAS,GAAG,UAAU,CAAC,SAA+B,CAAC;YAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC7C,CAAC,CAAE,UAAU,CAAC,MAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBACnF,CAAC,CAAC,SAAS,CAAC;YAEd,OAAO,CAAC,KAAK,CAAC,wDAAwD,EAAE;gBACtE,YAAY;gBACZ,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC9D,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC3D,YAAY,EAAE,CAAC,CAAC,SAAS;gBACzB,UAAU,EAAE,MAAM,EAAE,MAAM;aAC3B,CAAC,CAAC;YAEH,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,YAAY;gBACZ,QAAQ;gBACR,OAAO;gBACP,cAAc;gBACd,SAAS;gBACT,MAAM;gBACN,SAAS;gBACT,SAAS;gBACT,SAAS,EAAE,QAAQ;aACpB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,sDAAsD,EACtD,KAAK,CACN,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;aAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,cAAc,CAAC,KAAa;QAClC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAEtD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAErC,+BAA+B;YAC/B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,yBAAyB;YACzB,MAAM,WAAW,GAAG,IAAI,CACtB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CACjD,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAExC,wCAAwC;YACxC,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACnD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;gBACjD,IAAI,OAAO,CAAC,GAAG,GAAG,UAAU,EAAE,CAAC;oBAC7B,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,SAAS,CAAC,KAAa;QACnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAChC,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,6EAA6E;QAC7E,iEAAiE;QACjE,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,2EAA2E;QAC3E,8BAA8B;QAC9B,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB;YACnD,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAChC,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,YAAY,CAAC,iBAAiB,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBACjE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,QAAgB,CAAC;QACrB,IAAI,MAAM,GAAa,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CACX,oEAAoE,CACrE,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACpB,kEAAkE;gBAClE,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAChF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC;YACnC,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CACV,0GAA0G,CAC3G,CAAC;YACF,uEAAuE;YACvE,mDAAmD;YACnD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;QAC5B,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,YAAY,CAAC,iBAAiB,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7E,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE;gBACzC,aAAa,EAAE,8BAA8B;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,qBAAqB,CAAC,KAAa,EAAE,QAAgB,EAAE,MAAgB;QACnF,MAAM,OAAO,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACzE,IAAI,CAAC;YACH,wDAAwD;YACxD,IAAI,IAAI,CAAC,OAAO,IAAI,sBAAsB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC3D,MAAM,oBAAoB,GACxB,IAAI,CAAC,OACN,CAAC,oBAAoB,CAAC;gBACvB,IAAI,oBAAoB,EAAE,CAAC;oBACzB,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;oBACtE,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK;wBAAE,OAAO,IAAI,CAAC;oBACrC,OAAO,CAAC,KAAK,CACX,yCAAyC,EACzC,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CACxC,CAAC;oBACF,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;YAC5E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,aAAa,oCAAoC,EAAE;gBACjF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE;oBACtD,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC9B,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvD,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBACtE,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,CACV,6DAA6D,EAC7D,QAAQ,CAAC,MAAM,CAChB,CAAC;gBACF,OAAO,KAAK,CAAC,CAAC,2BAA2B;YAC3C,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAE7C,CAAC;YACT,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC5C,OAAO,CAAC,KAAK,CACX,yCAAyC,EACzC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,kBAAkB,CAC9C,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,qDAAqD,EAAE,KAAK,CAAC,CAAC;YAC5E,OAAO,KAAK,CAAC,CAAC,wBAAwB;QACxC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CACnB,SAAkB,EAClB,KAAc,EACd,QAAiB;QAEjB,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACtD,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAEtD,IAAI,CAAC,iBAAiB;YAAE,OAAO;QAE/B,MAAM,SAAS,GAAoB,EAAE,CAAC;QAEtC,uEAAuE;QACvE,IAAI,WAAW,GAAgC,IAAI,CAAC;QACpD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACnD,qDAAqD;YACrD,WAAW,GAAG,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAEtD,CAAC;YACT,wBAAwB;YACxB,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACvD,CAAC;QAED,6BAA6B;QAC7B,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,YAAY,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC1D,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YAEpD,uDAAuD;YACvD,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;gBACzB,MAAM,YAAY,GAAG,YAAY,CAAC,UAAU,CAC1C,WAAW,CAAC,OAAO,EACnB,QAAQ,CACT,CAAC;gBACF,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;gBACvD,qEAAqE;gBACrE,iEAAiE;gBACjE,qBAAqB;gBACrB,SAAS,CAAC,IAAI,CACZ,iBAAiB,CAAC,MAAM,CACtB,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAC/D,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,IAAI,KAAK,IAAI,iBAAiB,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC,iBAAiB,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7E,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC5E,CAAC;CACF"}
+{"version":3,"file":"delegation.service.js","sourceRoot":"","sources":["../../src/services/delegation.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,aAAa,EACb,eAAe,EACf,0BAA0B,EAC1B,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,kBAAkB,GAInB,MAAM,oBAAoB,CAAC;AAE5B;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAExC,iFAAiF;AACjF,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAqCD,MAAM,OAAO,iBAAiB;IACpB,GAAG,CAAgB;IACnB,OAAO,CAAqB;IAC5B,KAAK,CAAkB;IACvB,WAAW,CAAwB;IAE3C,YACE,GAAkB,EAClB,OAA2B,EAC3B,UAAoC,EAAE;QAEtC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,2BAA2B,EAAE,CAAC;IAC1E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,SAAkB;QACzC,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAEtD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,qEAAqE;YACrE,wCAAwC;YACxC,IAAI,OAA2B,CAAC;YAChC,IAAI,QAA4B,CAAC;YACjC,IAAI,WAAW,GAIJ,IAAI,CAAC;YAEhB,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACnD,WAAW,GAAG,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAItD,CAAC;gBACT,OAAO,GAAG,WAAW,EAAE,OAAO,CAAC;gBAC/B,QAAQ,GAAG,WAAW,EAAE,QAAQ,CAAC;YACnC,CAAC;YAED,8CAA8C;YAC9C,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBAClD,QAAQ,GAAG,QAAQ,EAAE,GAAG,CAAC;YAC3B,CAAC;YAED,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;gBACxB,MAAM,YAAY,GAAG,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAChE,OAAO,CAAC,KAAK,CACX,6DAA6D,EAC7D;oBACE,GAAG,EAAE,YAAY;oBACjB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;oBACrC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;iBACxC,CACF,CAAC;gBACF,MAAM,cAAc,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAChD,YAAY,EACZ,MAAM,CACP,CAAC;gBAEF,IAAI,cAAc,EAAE,CAAC;oBACnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;oBAC5D,IAAI,OAAO,EAAE,CAAC;wBACZ,OAAO,CAAC,KAAK,CACX,8EAA8E,CAC/E,CAAC;wBAEF,+BAA+B;wBAC/B,IAAI,SAAS,EAAE,CAAC;4BACd,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;4BACnD,MAAM,iBAAiB,CAAC,GAAG,CACzB,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;gCACb,GAAG,WAAW;gCACd,eAAe,EAAE,cAAc;gCAC/B,OAAO;gCACP,QAAQ;6BACT,CAAC,EACF;gCACE,aAAa,EAAE,yBAAyB;6BACzC,CACF,CAAC;wBACJ,CAAC;wBAED,OAAO,cAAc,CAAC;oBACxB,CAAC;yBAAM,CAAC;wBACN,mCAAmC;wBACnC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;wBAChE,OAAO,CAAC,KAAK,CACX,kEAAkE,CACnE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,qEAAqE;YACrE,IAAI,SAAS,IAAI,WAAW,EAAE,eAAe,EAAE,CAAC;gBAC9C,OAAO,CAAC,KAAK,CACX,4DAA4D,EAC5D;oBACE,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;iBAC1C,CACF,CAAC;gBACF,+CAA+C;gBAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CACzC,WAAW,CAAC,eAAe,CAC5B,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,KAAK,CACX,4EAA4E,CAC7E,CAAC;oBACF,OAAO,WAAW,CAAC,eAAe,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACN,mCAAmC;oBACnC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,eAAe,CAAC,CAAC;oBACnE,OAAO,CAAC,KAAK,CACX,8DAA8D,CAC/D,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,uDAAuD;YACvD,gFAAgF;YAChF,oEAAoE;YACpE,8DAA8D;YAE9D,OAAO,CAAC,KAAK,CACX,2EAA2E,EAC3E;gBACE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM;gBAC9D,UAAU,EAAE,CAAC,CAAC,OAAO;gBACrB,IAAI,EAAE,+EAA+E;aACtF,CACF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,OAAO,CAAC,KAAa;QAC3B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAEtD,IAAI,CAAC;YACH,mDAAmD;YACnD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAE1B,6CAA6C;YAC7C,4DAA4D;YAC5D,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC;YAEhD,0DAA0D;YAC1D,oEAAoE;YACpE,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACrC,MAAM,EAAE,GAAI,MAAM,CAAC,OAA4B,CAAC,EAAE,CAAC;YACnD,OAAO,CACL,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;gBACtC,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,IAAI,CAAC,CACxC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,mBAAmB,CAC/B,KAAa,EACb,aAAqB;QAErB,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,KAAK,aAAa;YAAE,OAAO,KAAK,CAAC;QAC5D,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,IACE,QAAQ,KAAK,UAAU;YACvB,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAEhE,OAAO,KAAK,CAAC;QACf,OAAO,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;IAC5C,CAAC;IAED,uFAAuF;IAC/E,KAAK,CAAC,cAAc,CAAC,SAAiB;QAC5C,OAAO,CACL,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;YACjC,CAAC,MAAM,0BAA0B,CAC/B,SAAS,EACT,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,WAAW,CACjB,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,KAAK,CAAC,kBAAkB,CAC9B,KAAa;QAEb,MAAM,MAAM,GAAG,CAAC,KAAa,EAA2B,EAAE;YACxD,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;YACtD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACjC,CAAC,CAAC;QACF,IAAI,CAAC;YACH,mBAAmB;YACnB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM;gBAAE,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAEpD,gBAAgB;YAChB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAc,CAAC;YAChD,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;gBAC7C,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAExC,mDAAmD;YACnD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACjE,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM;gBAC3D,OAAO,MAAM,CAAC,wBAAwB,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB;gBAC1D,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAEzC,8DAA8D;YAC9D,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtC,IAAI,QAAQ,KAAK,WAAW;oBAAE,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;YACvE,CAAC;iBAAM,IACL,CAAC,CAAC,MAAM,0BAA0B,CAChC,SAAS,EACT,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,WAAW,CACjB,CAAC,EACF,CAAC;gBACD,OAAO,MAAM,CAAC,qBAAqB,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3D,CAAC;YAED,8DAA8D;YAC9D,MAAM,GAAG,GAAI,MAAM,CAAC,MAA4B,CAAC,GAAG,CAAC;YACrD,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAC9C,OAAO,MAAM,CAAC,wBAAwB,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,CAAC,MAAM;gBACd,OAAO,MAAM,CAAC,8BAA8B,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAEpE,eAAe;YACf,IACE,CAAC,CAAC,MAAM,kBAAkB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;gBAExE,OAAO,MAAM,CAAC,+BAA+B,CAAC,CAAC;YAEjD,yEAAyE;YACzE,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAA6B,CAAC;YACxD,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;YACrD,CAAC;YAED,gBAAgB;YAChB,MAAM,KAAK,GAAG,EAAE,CAAC,IAA4B,CAAC;YAC9C,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBACxD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACvD,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;gBACvE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;YACtE,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;gBACvE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;YACtE,CAAC;YAED,gEAAgE;YAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAyB,CAAC;YAC1D,MAAM,cAAc,GAAG,EAAE,CAAC,cAAoC,CAAC;YAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,IAAI,QAAQ,IAAI,QAAQ,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;gBACtC,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBACzD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;YAC9D,CAAC;YACD,IAAI,cAAc,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;gBAC/D,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;YACnE,CAAC;YAED,2BAA2B;YAC3B,IAAI,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBAC/D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;YAC9D,CAAC;YACD,MAAM,iBAAiB,GAAG,EAAE,CAAC,iBAA4C,CAAC;YAC1E,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,CAAC;gBAClC,OAAO,CAAC,KAAK,CACX,6DAA6D,CAC9D,CAAC;gBACF,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,yCAAyC;iBACjD,CAAC;YACJ,CAAC;YAED,6CAA6C;YAC7C,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAGpC,CAAC;YAEF,8BAA8B;YAC9B,MAAM,YAAY,GAAG,gBAAgB,CACnC,MAAM,CAAC,OAA6C,CACrD,CAAC;YACF,MAAM,QAAQ,GACX,MAAM,CAAC,OAAO,CAAC,GAAc,IAAK,UAAU,CAAC,UAAqB,CAAC;YACtE,6FAA6F;YAC7F,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,0EAA0E;YAC1E,wEAAwE;YACxE,6DAA6D;YAC7D,oBAAoB;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAClC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAE7D,2FAA2F;YAC3F,MAAM,OAAO,GAAG,UAAU,CAAC,OAA6B,CAAC;YACzD,MAAM,cAAc,GAAG,UAAU,CAAC,cAAoC,CAAC;YACvE,MAAM,SAAS,GAAG,UAAU,CAAC,SAA+B,CAAC;YAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC7C,CAAC,CAAE,UAAU,CAAC,MAAmB,CAAC,MAAM,CACpC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C;gBACH,CAAC,CAAC,SAAS,CAAC;YAEd,yEAAyE;YACzE,qCAAqC;YACrC,MAAM,aAAa,GAAG,uBAAuB,CAC3C,MAAM,CAAC,OAA6C,CACrD,CAAC;YACF,IAAI,CAAC,aAAa;gBAAE,OAAO,MAAM,CAAC,4BAA4B,CAAC,CAAC;YAChE,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;gBACxD,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBAC/D,IAAI,OAAO,KAAK,OAAO;oBACrB,OAAO,MAAM,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,OAAO,CAAC,KAAK,CAAC,wDAAwD,EAAE;gBACtE,YAAY;gBACZ,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC9D,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC3D,YAAY,EAAE,CAAC,CAAC,SAAS;gBACzB,UAAU,EAAE,MAAM,EAAE,MAAM;aAC3B,CAAC,CAAC;YAEH,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,YAAY;gBACZ,QAAQ;gBACR,OAAO;gBACP,cAAc;gBACd,SAAS;gBACT,MAAM;gBACN,SAAS;gBACT,SAAS;gBACT,SAAS,EAAE,QAAQ;gBACnB,mBAAmB,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC;aAC9C,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,sDAAsD,EACtD,KAAK,CACN,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;aAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,cAAc,CAAC,KAAa;QAClC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAEtD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAErC,+BAA+B;YAC/B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,yBAAyB;YACzB,MAAM,WAAW,GAAG,IAAI,CACtB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CACjD,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAExC,wCAAwC;YACxC,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACnD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;gBACjD,IAAI,OAAO,CAAC,GAAG,GAAG,UAAU,EAAE,CAAC;oBAC7B,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,SAAS,CAAC,KAAa;QACnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAChC,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,6EAA6E;QAC7E,iEAAiE;QACjE,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,2EAA2E;QAC3E,8BAA8B;QAC9B,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB;YACnD,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,iBAAiB,IAAI,OAAO,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,YAAY,CAAC,iBAAiB,CAC7C,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAC5B,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrD,IACE,OAAO,MAAM,KAAK,QAAQ;gBAC1B,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC;gBACxC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAC7B,KAAK,EACL,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAC3C,CAAC,EACF,CAAC;gBACD,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBACjE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,QAAgB,CAAC;QACrB,IAAI,MAAM,GAAa,EAAE,CAAC;QAC1B,IAAI,YAAgC,CAAC;QACrC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CACX,oEAAoE,CACrE,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CACX,gDAAgD,EAChD,QAAQ,CAAC,KAAK,CACf,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC;YACnC,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;YAC/B,qEAAqE;YACrE,uEAAuE;YACvE,YAAY,GAAG,QAAQ,CAAC,mBAAmB;gBACzC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QACzB,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;YACxC,iEAAiE;YACjE,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,CAAC,KAAK,CACX,sFAAsF;oBACpF,8DAA8D,CACjE,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,CAAC,IAAI,CACV,4FAA4F;gBAC1F,0GAA0G,CAC7G,CAAC;YACF,OAAO,IAAI,CAAC,CAAC,eAAe;QAC9B,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CACV,uKAAuK,CACxK,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,iBAAiB,IAAI,YAAY,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,iBAAiB,CAC7C,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAC5B,CAAC;YACF,MAAM,iBAAiB,CAAC,GAAG,CACzB,QAAQ,EACR,qBAAqB,GAAG,YAAY,EACpC;gBACE,aAAa,EAAE,8BAA8B;aAC9C,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,qBAAqB,CACjC,KAAa,EACb,QAAgB,EAChB,MAAgB;QAEhB,MAAM,OAAO,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACzE,IAAI,CAAC;YACH,wDAAwD;YACxD,IAAI,IAAI,CAAC,OAAO,IAAI,sBAAsB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC3D,MAAM,oBAAoB,GACxB,IAAI;qBACD,OACJ,CAAC,oBAAoB,CAAC;gBACvB,IAAI,oBAAoB,EAAE,CAAC;oBACzB,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;oBACtE,mEAAmE;oBACnE,oEAAoE;oBACpE,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI;wBAAE,OAAO,IAAI,CAAC;oBAC9C,OAAO,CAAC,KAAK,CACX,yCAAyC,EACzC,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CACxC,CAAC;oBACF,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAED,MAAM,aAAa,GACjB,IAAI,CAAC,GAAG,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;YACxD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,aAAa,oCAAoC,EACpD;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE;oBACtD,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC9B,CACF,CAAC;YACF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvD,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBACtE,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,CACV,6DAA6D,EAC7D,QAAQ,CAAC,MAAM,CAChB,CAAC;gBACF,OAAO,KAAK,CAAC,CAAC,2BAA2B;YAC3C,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAE7C,CAAC;YACT,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC5C,OAAO,CAAC,KAAK,CACX,yCAAyC,EACzC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,kBAAkB,CAC9C,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,qDAAqD,EACrD,KAAK,CACN,CAAC;YACF,OAAO,KAAK,CAAC,CAAC,wBAAwB;QACxC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CACnB,SAAkB,EAClB,KAAc,EACd,QAAiB;QAEjB,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACtD,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAEtD,IAAI,CAAC,iBAAiB;YAAE,OAAO;QAE/B,MAAM,SAAS,GAAoB,EAAE,CAAC;QAEtC,uEAAuE;QACvE,IAAI,WAAW,GAAgC,IAAI,CAAC;QACpD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACnD,qDAAqD;YACrD,WAAW,GAAG,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAEtD,CAAC;YACT,wBAAwB;YACxB,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACvD,CAAC;QAED,6BAA6B;QAC7B,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,YAAY,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC1D,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YAEpD,uDAAuD;YACvD,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;gBACzB,MAAM,YAAY,GAAG,YAAY,CAAC,UAAU,CAC1C,WAAW,CAAC,OAAO,EACnB,QAAQ,CACT,CAAC;gBACF,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;gBACvD,qEAAqE;gBACrE,iEAAiE;gBACjE,qBAAqB;gBACrB,SAAS,CAAC,IAAI,CACZ,iBAAiB,CAAC,MAAM,CACtB,YAAY,CAAC,kBAAkB,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAC/D,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,IAAI,KAAK,IAAI,iBAAiB,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC,iBAAiB,CAC7C,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAC5B,CAAC;YACF,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC5E,CAAC;CACF"}

package/dist/services/multipart-parser.d.ts

@@ -0,0 +1,73 @@
+/**
+ * multipart-parser.ts
+ *
+ * Hand-rolled multipart/form-data field extractor.
+ *
+ * Cloudflare Workers' `Request.formData()` is the primary path for parsing
+ * form submissions, but it can fail or misbehave in two ways that we observe
+ * in the wild on the consent-approval endpoint:
+ *
+ *   1. The Content-Type header is `multipart/form-data` but is missing the
+ *      `boundary=` parameter, so `formData()` throws.
+ *   2. `formData()` "succeeds" but returns the entire raw multipart body as a
+ *      single malformed `[key, value]` entry (the boundary/Content-Disposition
+ *      preamble ends up in the key).
+ *
+ * In both cases we fall back to parsing the raw body text ourselves. This
+ * module isolates that boundary-detection logic behind a single, testable
+ * interface so it is not duplicated across every fallback branch in
+ * ConsentService.
+ *
+ * This is intentionally a *permissive* parser for trusted same-origin form
+ * posts, not a general-purpose RFC 7578 implementation. Its behavior is
+ * pinned by multipart-parser.test.ts and must remain byte-for-byte compatible
+ * with the original inline logic.
+ */
+/** A single extracted multipart field (raw, uncoerced). */
+export interface MultipartField {
+    /** The `name="..."` attribute from the Content-Disposition header. */
+    name: string;
+    /** The field body, with trailing whitespace/newlines trimmed. */
+    value: string;
+}
+/**
+ * Extract all form fields from a raw multipart body string.
+ *
+ * @param rawBody - The raw multipart/form-data body text.
+ * @returns The extracted fields in document order. Empty if nothing matched.
+ */
+export declare function parseMultipartFields(rawBody: string): MultipartField[];
+/**
+ * Reconstruct a parseable multipart body from a malformed single-entry
+ * `[key, value]` pair produced by `formData()` when it fails to split the
+ * body correctly.
+ *
+ * When the split lands between the `...name` token and the `"field"...`
+ * value, the `=` separator is lost; we re-insert it so the field regex can
+ * match. Otherwise the two halves are concatenated as-is.
+ *
+ * @param keyPart - The malformed entry key.
+ * @param valuePart - The malformed entry value.
+ * @returns A single string suitable for {@link parseMultipartFields}.
+ */
+export declare function reconstructMalformedMultipart(keyPart: string, valuePart: string): string;
+/**
+ * Detect whether a `formData()` result is the "single malformed entry" case
+ * where the entire multipart body leaked into one `[key, value]` pair.
+ *
+ * @param entries - The materialized entries from `formData().entries()`.
+ */
+export declare function isMalformedSingleEntry(entries: Array<[string, unknown]>): entries is [[string, string]];
+/**
+ * Extract a clean field name from a (possibly malformed) FormData entry key.
+ *
+ * Returns the original key for normal entries, the parsed `name="..."` value
+ * when the key contains a Content-Disposition preamble, or `null` for keys
+ * that are pure boundary noise / unparseable and should be skipped: a
+ * preamble with no name, a boundary line, or undici's `formdata-undici`
+ * boundary.
+ *
+ * @param key - A raw FormData entry key.
+ */
+export declare function extractFieldNameFromKey(key: string): string | null;
+//# sourceMappingURL=multipart-parser.d.ts.map