@kya-os/mcp-i-cloudflare 1.15.0 → 1.16.0

package/dist/runtime.d.ts

@@ -15,6 +15,7 @@ import { type KVNamespace } from "./cache/kv-tool-protection-cache";
 import type { CloudflareRuntimeConfig } from "./config";
 import type { AgentIdentity } from "@kya-os/mcp-i-runtime";
 import type { VerifiedDelegation } from "@kya-os/contracts/config";
+import type { AdmissionRefusalCode } from "./security/admission-refusal";
 /**
  * CloudflareRuntime extends MCPIRuntimeBase with CloudflareProofGenerator
  */
@@ -33,6 +34,14 @@ export declare class CloudflareRuntime extends MCPIRuntimeBase {
     private lastDetachedProof?;
     private lastToolCallContext?;
     private readonly proofByInvocation;
+    /**
+     * The delegation id THIS call's verify returned, keyed by the session object
+     * processToolCall builds for that call. Keyed by object, not by
+     * auditInvocationId, because a caller may reuse one invocation id across
+     * concurrent calls. Only processToolCall holds the key, so a caller can
+     * never plant a value here that createProof would sign.
+     */
+    private readonly verifiedDelegationIdBySession;
     private serverUrl?;
     private proofService?;
     /**
@@ -100,6 +109,28 @@ export declare class CloudflareRuntime extends MCPIRuntimeBase {
      * so a telemetry failure never replaces the refusal the caller rethrows.
      */
     private reportDeniedToolCall;
+    /**
+     * Send the activity event for a tools/call that request admission refused,
+     * so a tampered, replayed or stale signed call still leaves one record in
+     * Checkpoint. The proof service decides whether to send anything
+     * (structured mode only). Awaited for the same reason as a denial, and
+     * guarded so a telemetry failure never replaces the refusal the client is
+     * about to receive.
+     *
+     * @example
+     * ```typescript
+     * await runtime.reportAdmissionRefusal({
+     *   toolName: "place_order",
+     *   code: "nonce_replayed",
+     *   sessionId,
+     * });
+     * ```
+     */
+    reportAdmissionRefusal(refusal: {
+        toolName: string;
+        code: AdmissionRefusalCode;
+        sessionId?: string;
+    }): Promise<void>;
     /**
      * Get the CloudflareProofGenerator instance (for advanced usage)
      */

package/dist/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,KAAK,2BAA2B,EAChC,uBAAuB,EACvB,aAAa,EACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAEL,KAAK,WAAW,EACjB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAMnE;;GAEG;AACH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,iBAAkB,SAAQ,eAAe;IACpD,OAAO,CAAC,cAAc,CAAC,CAA2B;IAClD,OAAO,CAAC,iBAAiB,CAAC,CAAgB;IAC1C,OAAO,CAAC,mBAAmB,CAAC,CAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoC;IACtE,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,YAAY,CAAC,CAAe;IAIpC;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB,CAAiC;gBAG9D,MAAM,EAAE,qBAAqB,EAC7B,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,uBAAuB;IAY5C;;OAEG;IACH,uBAAuB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAM/D;;;;;;;OAOG;IACH,uBAAuB,IAAI,uBAAuB,GAAG,SAAS;IAI9D;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAM/C;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAI3C;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAejC;;;;;;;;OAQG;IACG,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC;IAwGnE;;;;;;;;;;OAUG;IACG,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,GAAG,EACT,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,kBAAkB,KAAK,OAAO,CAAC,GAAG,CAAC,EACnE,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,GAAG,CAAC;IA+Hf;;;;;OAKG;YACW,oBAAoB;IAyBlC;;OAEG;IACH,iBAAiB,IAAI,wBAAwB,GAAG,SAAS;IAIzD;;;;;;;;;;;;;;;;;OAiBG;IACH,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE;IAI7C;;;;;;;;;;;;OAYG;IACH,4BAA4B,IAAI,IAAI;IAIpC;;;;;OAKG;IACH,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS;IAKtD;;;OAGG;IACH,2BAA2B,IAAI,IAAI;IAInC;;;;OAIG;IACH,YAAY,IAAI,aAAa,GAAG,SAAS;IAIzC;;;;;OAKG;IACH,sBAAsB,IAAI,eAAe,GAAG,SAAS;IAIrD;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,CAAC,eAAe,CACvB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,CAAC,EAAE,GAAG,EACb,WAAW,CAAC,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,MAAM,EAAE,iDAAiD;IACtE,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM;IA6DT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,MAAM,CAAC,2BAA2B,CAChC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,2BAA2B,GAClC,qBAAqB;CAIzB"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,KAAK,2BAA2B,EAChC,uBAAuB,EACvB,aAAa,EACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAEL,KAAK,WAAW,EACjB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAKnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEzE;;GAEG;AACH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAiBD,qBAAa,iBAAkB,SAAQ,eAAe;IACpD,OAAO,CAAC,cAAc,CAAC,CAA2B;IAClD,OAAO,CAAC,iBAAiB,CAAC,CAAgB;IAC1C,OAAO,CAAC,mBAAmB,CAAC,CAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoC;IACtE;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAiC;IAC/E,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,YAAY,CAAC,CAAe;IAIpC;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB,CAAiC;gBAG9D,MAAM,EAAE,qBAAqB,EAC7B,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,uBAAuB;IAY5C;;OAEG;IACH,uBAAuB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAM/D;;;;;;;OAOG;IACH,uBAAuB,IAAI,uBAAuB,GAAG,SAAS;IAI9D;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAM/C;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAI3C;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAejC;;;;;;;;OAQG;IACG,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC;IA+GnE;;;;;;;;;;OAUG;IACG,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,GAAG,EACT,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,kBAAkB,KAAK,OAAO,CAAC,GAAG,CAAC,EACnE,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,GAAG,CAAC;IAmIf;;;;;OAKG;YACW,oBAAoB;IA8BlC;;;;;;;;;;;;;;;;OAgBG;IACG,sBAAsB,CAAC,OAAO,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,oBAAoB,CAAC;QAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBjB;;OAEG;IACH,iBAAiB,IAAI,wBAAwB,GAAG,SAAS;IAIzD;;;;;;;;;;;;;;;;;OAiBG;IACH,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE;IAI7C;;;;;;;;;;;;OAYG;IACH,4BAA4B,IAAI,IAAI;IAIpC;;;;;OAKG;IACH,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS;IAKtD;;;OAGG;IACH,2BAA2B,IAAI,IAAI;IAInC;;;;OAIG;IACH,YAAY,IAAI,aAAa,GAAG,SAAS;IAIzC;;;;;OAKG;IACH,sBAAsB,IAAI,eAAe,GAAG,SAAS;IAIrD;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,CAAC,eAAe,CACvB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,CAAC,EAAE,GAAG,EACb,WAAW,CAAC,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,MAAM,EAAE,iDAAiD;IACtE,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM;IA6DT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,MAAM,CAAC,2BAA2B,CAChC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,2BAA2B,GAClC,qBAAqB;CAIzB"}

package/dist/runtime.js

@@ -13,11 +13,31 @@ import { CloudflareProofGenerator } from "./proof-generator";
 import { KVToolProtectionCache, } from "./cache/kv-tool-protection-cache";
 import { ProofService } from "./services/proof.service";
 import { activityForResult, isDelegationRequiredError, } from "./runtime/tool-activity";
+/**
+ * The DID request admission proved for this call, or undefined.
+ *
+ * Only admission sets verifiedInvokerDid, after checking the request's
+ * signature. session.agentDid and clientDid are never read: the first can
+ * fall back to the server's own DID and the second is caller-asserted.
+ */
+function provedHolderDid(session) {
+    return typeof session?.verifiedInvokerDid === "string"
+        ? session.verifiedInvokerDid
+        : undefined;
+}
 export class CloudflareRuntime extends MCPIRuntimeBase {
     proofGenerator;
     lastDetachedProof;
     lastToolCallContext;
     proofByInvocation = new Map();
+    /**
+     * The delegation id THIS call's verify returned, keyed by the session object
+     * processToolCall builds for that call. Keyed by object, not by
+     * auditInvocationId, because a caller may reuse one invocation id across
+     * concurrent calls. Only processToolCall holds the key, so a caller can
+     * never plant a value here that createProof would sign.
+     */
+    verifiedDelegationIdBySession = new WeakMap();
     serverUrl; // Store server URL for consent URL building
     proofService; // Proof submission service
     // accessControlService is inherited from MCPIRuntimeBase (protected), no need to redeclare
@@ -137,10 +157,16 @@ export class CloudflareRuntime extends MCPIRuntimeBase {
         if (this.config.environment === "development" && scopeId) {
             console.error(`[MCP-I] Proof scopeId for tool "${session.toolName}": ${scopeId}`);
         }
+        // Checkpoint links a deployment-signed proof to a grant only when the
+        // signed delegationRef equals the posted delegation_id. Session fields
+        // like delegationRef or delegationId are stored or caller-supplied, so
+        // they are never signed.
+        const delegationRef = this.verifiedDelegationIdBySession.get(session);
         // ✅ Generate full JWS proof WITH scopeId using CloudflareProofGenerator
         const detachedProof = await this.proofGenerator.generateProof(request, response, sessionContext, {
             scopeId, // ← ADDED: Pass scopeId for tool auto-discovery
             clientDid: session.clientDid, // ← ADDED: Pass clientDid from session
+            ...(delegationRef ? { delegationRef } : {}),
         });
         // Keep the legacy latest-value accessor for compatibility, but route the
         // active request through an invocation-keyed map so concurrent calls never
@@ -204,6 +230,9 @@ export class CloudflareRuntime extends MCPIRuntimeBase {
         let verifiedDelegationId;
         const handlerRecordingVerified = (handlerArgs, verified) => {
             verifiedDelegationId = verified?.id;
+            if (enhancedSession && verified?.id) {
+                this.verifiedDelegationIdBySession.set(enhancedSession, verified.id);
+            }
             // Keep the exact arity: an unverified call still receives only (args).
             return verified ? handler(handlerArgs, verified) : handler(handlerArgs);
         };
@@ -249,6 +278,7 @@ export class CloudflareRuntime extends MCPIRuntimeBase {
                         mcpServerUrl,
                         activity: activityForResult(result),
                         verifiedDelegationId,
+                        holderDid: provedHolderDid(enhancedSession),
                     });
                     console.error("[CloudflareRuntime] ✅ Proof submission completed");
                 }
@@ -312,12 +342,47 @@ export class CloudflareRuntime extends MCPIRuntimeBase {
                 toolName,
                 error,
                 delegationId: session?.delegationId,
+                holderDid: provedHolderDid(session),
             });
         }
         catch (reportError) {
             console.error("[CloudflareRuntime] Failed to report denied tool call:", reportError);
         }
     }
+    /**
+     * Send the activity event for a tools/call that request admission refused,
+     * so a tampered, replayed or stale signed call still leaves one record in
+     * Checkpoint. The proof service decides whether to send anything
+     * (structured mode only). Awaited for the same reason as a denial, and
+     * guarded so a telemetry failure never replaces the refusal the client is
+     * about to receive.
+     *
+     * @example
+     * ```typescript
+     * await runtime.reportAdmissionRefusal({
+     *   toolName: "place_order",
+     *   code: "nonce_replayed",
+     *   sessionId,
+     * });
+     * ```
+     */
+    async reportAdmissionRefusal(refusal) {
+        if (!this.proofService) {
+            return;
+        }
+        try {
+            const identity = await this.getIdentity();
+            await this.proofService.reportAdmissionRefused({
+                serverDid: identity.did,
+                sessionId: refusal.sessionId,
+                toolName: refusal.toolName,
+                code: refusal.code,
+            });
+        }
+        catch (reportError) {
+            console.error("[CloudflareRuntime] Failed to report admission refusal:", reportError);
+        }
+    }
     /**
      * Get the CloudflareProofGenerator instance (for advanced usage)
      */

package/dist/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,eAAe,EAEf,qBAAqB,GAItB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,EACL,qBAAqB,GAEtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAIxD,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AAgBjC,MAAM,OAAO,iBAAkB,SAAQ,eAAe;IAC5C,cAAc,CAA4B;IAC1C,iBAAiB,CAAiB;IAClC,mBAAmB,CAAmB;IAC7B,iBAAiB,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC9D,SAAS,CAAU,CAAC,4CAA4C;IAChE,YAAY,CAAgB,CAAC,2BAA2B;IAChE,2FAA2F;IAC3F,oFAAoF;IAEpF;;;;;;;OAOG;IACK,uBAAuB,GAAuB,IAAI,GAAG,EAAE,CAAC;IAEhE,YACE,MAA6B,EAC7B,SAAkB,EAClB,gBAA0C;QAE1C,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,yDAAyD;QACzD,wFAAwF;QACxF,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,gBAAgB,IAAK,MAAkC,EACvD,IAAI,CACL,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,OAAgC;QACtD,8DAA8D;QAC9D,iEAAiE;QACjE,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,uBAAuB;QACrB,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,QAAuB;QACtC,8DAA8D;QAC9D,iEAAiE;QACjE,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW;QACf,OAAO,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;QAEzB,oDAAoD;QACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,cAAc,GAAG,IAAI,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAE7D,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YAC9C,OAAO,CAAC,KAAK,CACX,qEAAqE,CACtE,CAAC;YACF,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,IAAS,EAAE,OAAa;QACxC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,wDAAwD;QACxD,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC1C,8CAA8C;YAC9C,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;QACxB,CAAC;QAED,sCAAsC;QACtC,iEAAiE;QACjE,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS;YACrC,MAAM,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE;SACjD,CAAC;QAEF,qBAAqB;QACrB,MAAM,QAAQ,GAAG;YACf,IAAI;SACL,CAAC;QAEF,oDAAoD;QACpD,MAAM,cAAc,GAAG;YACrB,KAAK;YACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,YAAY;YAC1C,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB,CAAC;QAEF,0DAA0D;QAC1D,IAAI,OAA2B,CAAC;QAEhC,oDAAoD;QACpD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC5B,CAAC;QACD,4CAA4C;aACvC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YAC3B,OAAO,GAAG,GAAG,OAAO,CAAC,QAAQ,UAAU,CAAC;QAC1C,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,aAAa,IAAI,OAAO,EAAE,CAAC;YACzD,OAAO,CAAC,KAAK,CACX,mCAAmC,OAAO,CAAC,QAAQ,MAAM,OAAO,EAAE,CACnE,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAC3D,OAAO,EACP,QAAQ,EACR,cAAc,EACd;YACE,OAAO,EAAE,gDAAgD;YACzD,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,uCAAuC;SACtE,CACF,CAAC;QAEF,yEAAyE;QACzE,2EAA2E;QAC3E,4CAA4C;QAC5C,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC;QACvC,MAAM,iBAAiB,GAAG,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ;YACrE,CAAC,CAAC,OAAO,CAAC,iBAAiB;YAC3B,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,iBAAiB,EAAE,CAAC;YACtB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAC/D,CAAC;QAED,qDAAqD;QACrD,IAAI,CAAC,mBAAmB,GAAG;YACzB,IAAI,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS;YACnC,IAAI,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE;YAC9C,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,OAAO,IAAI,SAAS;YAC7B,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,2BAA2B;SACpD,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YAC9C,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE;gBACxC,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG;gBAC3B,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS;gBACvC,WAAW,EAAE,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACpE,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACtE,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB;gBAC5D,SAAS,EACP,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;oBACvC,CAAC,CAAC,iBAAiB;oBACnB,CAAC,CAAC,SAAS;aAChB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,eAAe,CACnB,QAAgB,EAChB,IAAS,EACT,OAAmE,EACnE,OAAa;QAEb,MAAM,YAAY,GAAG,OAAO,OAAO,EAAE,iBAAiB,KAAK,QAAQ;YACjE,CAAC,CAAC,OAAO,CAAC,iBAAiB;YAC3B,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACxB,0DAA0D;QAC1D,kFAAkF;QAClF,MAAM,eAAe,GAAG,OAAO;YAC7B,CAAC,CAAC;gBACE,GAAG,OAAO;gBACV,QAAQ;gBACR,UAAU,EAAE,IAAI;gBAChB,iBAAiB,EAAE,YAAY;aAChC;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,4EAA4E;QAC5E,6EAA6E;QAC7E,IAAI,oBAAwC,CAAC;QAC7C,MAAM,wBAAwB,GAAG,CAC/B,WAAgB,EAChB,QAA6B,EACf,EAAE;YAChB,oBAAoB,GAAG,QAAQ,EAAE,EAAE,CAAC;YACpC,uEAAuE;YACvE,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1E,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,qEAAqE;YACrE,IAAI,MAAW,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,CAClC,QAAQ,EACR,IAAI,EACJ,wBAAwB,EACxB,eAAe,CAChB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;gBAClE,MAAM,KAAK,CAAC;YACd,CAAC;YAED,0EAA0E;YAC1E,yDAAyD;YACzD,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAEzD,wDAAwD;YACxD,qFAAqF;YACrF,mFAAmF;YACnF,+DAA+D;YAC/D,IAAI,KAAK,IAAI,IAAI,CAAC,YAAY,IAAI,eAAe,EAAE,CAAC;gBAClD,IAAI,CAAC;oBACH,4DAA4D;oBAC5D,mEAAmE;oBACnE,IAAI,YAAY,GAAG,eAAe,CAAC,YAAY,IAAI,IAAI,CAAC,SAAS,CAAC;oBAClE,IACE,YAAY;wBACZ,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC;wBACnC,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,EACpC,CAAC;wBACD,wCAAwC;wBACxC,YAAY,GAAG,WAAW,YAAY,EAAE,CAAC;oBAC3C,CAAC;oBAED,0DAA0D;oBAC1D,+DAA+D;oBAC/D,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;oBACvE,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;wBACzC,OAAO,EAAE;4BACP,EAAE,EAAE,eAAe,CAAC,EAAE,IAAI,SAAS;4BACnC,YAAY,EAAE,eAAe,CAAC,YAAY;yBAC3C;wBACD,QAAQ;wBACR,IAAI;wBACJ,MAAM;wBACN,YAAY;wBACZ,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC;wBACnC,oBAAoB;qBACrB,CAAC,CAAC;oBACH,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACpE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,8CAA8C;oBAC9C,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;gBACtE,CAAC;wBAAS,CAAC;oBACT,0EAA0E;oBAC1E,4EAA4E;oBAC5E,wEAAwE;oBACxE,yEAAyE;oBACzE,sEAAsE;oBACtE,2EAA2E;oBAC3E,yEAAyE;oBACzE,2EAA2E;oBAC3E,qCAAqC;oBACrC,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;oBAClC,CAAC;oBAAC,OAAO,UAAU,EAAE,CAAC;wBACpB,OAAO,CAAC,KAAK,CACX,sDAAsD,EACtD,UAAU,CACX,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,oEAAoE;YACpE,IACE,KAAK;gBACL,MAAM;gBACN,OAAO,MAAM,KAAK,QAAQ;gBAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACtB,CAAC;gBACD,8DAA8D;gBAC9D,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;gBACpB,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG;oBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,IAAI,EAAE,KAAK,CAAC,IAAI;iBACjB,CAAC;YACJ,CAAC;YAED,OAAO,MAAM,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,oBAAoB,CAChC,KAAc,EACd,QAAgB,EAChB,OAAgD;QAEhD,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;gBACnC,SAAS,EAAE,QAAQ,CAAC,GAAG;gBACvB,SAAS,EAAE,OAAO,EAAE,EAAE;gBACtB,QAAQ;gBACR,KAAK;gBACL,YAAY,EAAE,OAAO,EAAE,YAAY;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CACX,wDAAwD,EACxD,WAAW,CACZ,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,0BAA0B;QACxB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,4BAA4B;QAC1B,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,yBAAyB;QACvB,MAAM,WAAW,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACtD,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACH,2BAA2B;QACzB,IAAI,CAAC,4BAA4B,EAAE,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,sBAAsB;QACpB,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACO,eAAe,CACvB,QAAgB,EAChB,MAAgB,EAChB,OAAa,EACb,WAAoB,EACpB,UAAmB,EAAE,iDAAiD;IACtE,QAAiB;QAEjB,2DAA2D;QAC3D,MAAM,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAChE,MAAM,SAAS,GAAG,qBAAqB,EAAE,YAAY,EAAE,EAAE,CAAC;QAE1D,+DAA+D;QAC/D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACxB,UAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE;YAC7B,SAAS,EAAE,OAAO,EAAE,QAAQ,IAAI,EAAE;SACnC,CAAC,CAAC;QAEH,kDAAkD;QAClD,gDAAgD;QAChD,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,CAAC;QACrC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QAED,6DAA6D;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QAED,+BAA+B;QAC/B,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC1C,CAAC;QAED,mGAAmG;QACnG,wEAAwE;QACxE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,sCAAsC;QACtC,8DAA8D;QAC9D,mCAAmC;QACnC,sCAAsC;QACtC,IAAI,SAA6B,CAAC;QAElC,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;YAC1B,wCAAwC;YACxC,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC;QACnC,CAAC;aAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1B,yBAAyB;YACzB,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC;QAED,4DAA4D;QAC5D,IAAI,SAAS,EAAE,CAAC;YACd,gDAAgD;YAChD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC7C,OAAO,GAAG,OAAO,YAAY,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QACnD,CAAC;QAED,iGAAiG;QACjG,OAAO,0CAA0C,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,MAAM,CAAC,2BAA2B,CAChC,EAAe,EACf,MAAmC;QAEnC,MAAM,KAAK,GAAG,IAAI,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAC5C,OAAO,IAAI,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;CACF"}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,eAAe,EAEf,qBAAqB,GAItB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,EACL,qBAAqB,GAEtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAIxD,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AAiBjC;;;;;;GAMG;AACH,SAAS,eAAe,CACtB,OAA0C;IAE1C,OAAO,OAAO,OAAO,EAAE,kBAAkB,KAAK,QAAQ;QACpD,CAAC,CAAC,OAAO,CAAC,kBAAkB;QAC5B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,iBAAkB,SAAQ,eAAe;IAC5C,cAAc,CAA4B;IAC1C,iBAAiB,CAAiB;IAClC,mBAAmB,CAAmB;IAC7B,iBAAiB,GAAG,IAAI,GAAG,EAAyB,CAAC;IACtE;;;;;;OAMG;IACc,6BAA6B,GAAG,IAAI,OAAO,EAAkB,CAAC;IACvE,SAAS,CAAU,CAAC,4CAA4C;IAChE,YAAY,CAAgB,CAAC,2BAA2B;IAChE,2FAA2F;IAC3F,oFAAoF;IAEpF;;;;;;;OAOG;IACK,uBAAuB,GAAuB,IAAI,GAAG,EAAE,CAAC;IAEhE,YACE,MAA6B,EAC7B,SAAkB,EAClB,gBAA0C;QAE1C,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,yDAAyD;QACzD,wFAAwF;QACxF,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,gBAAgB,IAAK,MAAkC,EACvD,IAAI,CACL,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,OAAgC;QACtD,8DAA8D;QAC9D,iEAAiE;QACjE,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,uBAAuB;QACrB,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,QAAuB;QACtC,8DAA8D;QAC9D,iEAAiE;QACjE,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW;QACf,OAAO,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;QAEzB,oDAAoD;QACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,cAAc,GAAG,IAAI,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAE7D,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YAC9C,OAAO,CAAC,KAAK,CACX,qEAAqE,CACtE,CAAC;YACF,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,IAAS,EAAE,OAAa;QACxC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,wDAAwD;QACxD,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC1C,8CAA8C;YAC9C,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;QACxB,CAAC;QAED,sCAAsC;QACtC,iEAAiE;QACjE,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS;YACrC,MAAM,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE;SACjD,CAAC;QAEF,qBAAqB;QACrB,MAAM,QAAQ,GAAG;YACf,IAAI;SACL,CAAC;QAEF,oDAAoD;QACpD,MAAM,cAAc,GAAG;YACrB,KAAK;YACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,YAAY;YAC1C,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB,CAAC;QAEF,0DAA0D;QAC1D,IAAI,OAA2B,CAAC;QAEhC,oDAAoD;QACpD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC5B,CAAC;QACD,4CAA4C;aACvC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YAC3B,OAAO,GAAG,GAAG,OAAO,CAAC,QAAQ,UAAU,CAAC;QAC1C,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,aAAa,IAAI,OAAO,EAAE,CAAC;YACzD,OAAO,CAAC,KAAK,CACX,mCAAmC,OAAO,CAAC,QAAQ,MAAM,OAAO,EAAE,CACnE,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,yBAAyB;QACzB,MAAM,aAAa,GAAG,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEtE,wEAAwE;QACxE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAC3D,OAAO,EACP,QAAQ,EACR,cAAc,EACd;YACE,OAAO,EAAE,gDAAgD;YACzD,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,uCAAuC;YACrE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CACF,CAAC;QAEF,yEAAyE;QACzE,2EAA2E;QAC3E,4CAA4C;QAC5C,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC;QACvC,MAAM,iBAAiB,GAAG,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ;YACrE,CAAC,CAAC,OAAO,CAAC,iBAAiB;YAC3B,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,iBAAiB,EAAE,CAAC;YACtB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAC/D,CAAC;QAED,qDAAqD;QACrD,IAAI,CAAC,mBAAmB,GAAG;YACzB,IAAI,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS;YACnC,IAAI,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE;YAC9C,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,OAAO,IAAI,SAAS;YAC7B,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,2BAA2B;SACpD,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YAC9C,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE;gBACxC,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG;gBAC3B,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS;gBACvC,WAAW,EAAE,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACpE,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACtE,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB;gBAC5D,SAAS,EACP,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;oBACvC,CAAC,CAAC,iBAAiB;oBACnB,CAAC,CAAC,SAAS;aAChB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,eAAe,CACnB,QAAgB,EAChB,IAAS,EACT,OAAmE,EACnE,OAAa;QAEb,MAAM,YAAY,GAAG,OAAO,OAAO,EAAE,iBAAiB,KAAK,QAAQ;YACjE,CAAC,CAAC,OAAO,CAAC,iBAAiB;YAC3B,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACxB,0DAA0D;QAC1D,kFAAkF;QAClF,MAAM,eAAe,GAAG,OAAO;YAC7B,CAAC,CAAC;gBACE,GAAG,OAAO;gBACV,QAAQ;gBACR,UAAU,EAAE,IAAI;gBAChB,iBAAiB,EAAE,YAAY;aAChC;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,4EAA4E;QAC5E,6EAA6E;QAC7E,IAAI,oBAAwC,CAAC;QAC7C,MAAM,wBAAwB,GAAG,CAC/B,WAAgB,EAChB,QAA6B,EACf,EAAE;YAChB,oBAAoB,GAAG,QAAQ,EAAE,EAAE,CAAC;YACpC,IAAI,eAAe,IAAI,QAAQ,EAAE,EAAE,EAAE,CAAC;gBACpC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,uEAAuE;YACvE,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1E,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,qEAAqE;YACrE,IAAI,MAAW,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,CAClC,QAAQ,EACR,IAAI,EACJ,wBAAwB,EACxB,eAAe,CAChB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;gBAClE,MAAM,KAAK,CAAC;YACd,CAAC;YAED,0EAA0E;YAC1E,yDAAyD;YACzD,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAEzD,wDAAwD;YACxD,qFAAqF;YACrF,mFAAmF;YACnF,+DAA+D;YAC/D,IAAI,KAAK,IAAI,IAAI,CAAC,YAAY,IAAI,eAAe,EAAE,CAAC;gBAClD,IAAI,CAAC;oBACH,4DAA4D;oBAC5D,mEAAmE;oBACnE,IAAI,YAAY,GAAG,eAAe,CAAC,YAAY,IAAI,IAAI,CAAC,SAAS,CAAC;oBAClE,IACE,YAAY;wBACZ,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC;wBACnC,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,EACpC,CAAC;wBACD,wCAAwC;wBACxC,YAAY,GAAG,WAAW,YAAY,EAAE,CAAC;oBAC3C,CAAC;oBAED,0DAA0D;oBAC1D,+DAA+D;oBAC/D,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;oBACvE,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;wBACzC,OAAO,EAAE;4BACP,EAAE,EAAE,eAAe,CAAC,EAAE,IAAI,SAAS;4BACnC,YAAY,EAAE,eAAe,CAAC,YAAY;yBAC3C;wBACD,QAAQ;wBACR,IAAI;wBACJ,MAAM;wBACN,YAAY;wBACZ,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC;wBACnC,oBAAoB;wBACpB,SAAS,EAAE,eAAe,CAAC,eAAe,CAAC;qBAC5C,CAAC,CAAC;oBACH,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACpE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,8CAA8C;oBAC9C,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;gBACtE,CAAC;wBAAS,CAAC;oBACT,0EAA0E;oBAC1E,4EAA4E;oBAC5E,wEAAwE;oBACxE,yEAAyE;oBACzE,sEAAsE;oBACtE,2EAA2E;oBAC3E,yEAAyE;oBACzE,2EAA2E;oBAC3E,qCAAqC;oBACrC,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;oBAClC,CAAC;oBAAC,OAAO,UAAU,EAAE,CAAC;wBACpB,OAAO,CAAC,KAAK,CACX,sDAAsD,EACtD,UAAU,CACX,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,oEAAoE;YACpE,IACE,KAAK;gBACL,MAAM;gBACN,OAAO,MAAM,KAAK,QAAQ;gBAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACtB,CAAC;gBACD,8DAA8D;gBAC9D,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;gBACpB,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG;oBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,IAAI,EAAE,KAAK,CAAC,IAAI;iBACjB,CAAC;YACJ,CAAC;YAED,OAAO,MAAM,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,oBAAoB,CAChC,KAAc,EACd,QAAgB,EAChB,OAIC;QAED,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;gBACnC,SAAS,EAAE,QAAQ,CAAC,GAAG;gBACvB,SAAS,EAAE,OAAO,EAAE,EAAE;gBACtB,QAAQ;gBACR,KAAK;gBACL,YAAY,EAAE,OAAO,EAAE,YAAY;gBACnC,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CACX,wDAAwD,EACxD,WAAW,CACZ,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,sBAAsB,CAAC,OAI5B;QACC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC;gBAC7C,SAAS,EAAE,QAAQ,CAAC,GAAG;gBACvB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CACX,yDAAyD,EACzD,WAAW,CACZ,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,0BAA0B;QACxB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,4BAA4B;QAC1B,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,yBAAyB;QACvB,MAAM,WAAW,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACtD,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACH,2BAA2B;QACzB,IAAI,CAAC,4BAA4B,EAAE,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,sBAAsB;QACpB,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACO,eAAe,CACvB,QAAgB,EAChB,MAAgB,EAChB,OAAa,EACb,WAAoB,EACpB,UAAmB,EAAE,iDAAiD;IACtE,QAAiB;QAEjB,2DAA2D;QAC3D,MAAM,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAChE,MAAM,SAAS,GAAG,qBAAqB,EAAE,YAAY,EAAE,EAAE,CAAC;QAE1D,+DAA+D;QAC/D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACxB,UAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE;YAC7B,SAAS,EAAE,OAAO,EAAE,QAAQ,IAAI,EAAE;SACnC,CAAC,CAAC;QAEH,kDAAkD;QAClD,gDAAgD;QAChD,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,CAAC;QACrC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QAED,6DAA6D;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QAED,+BAA+B;QAC/B,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC1C,CAAC;QAED,mGAAmG;QACnG,wEAAwE;QACxE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,sCAAsC;QACtC,8DAA8D;QAC9D,mCAAmC;QACnC,sCAAsC;QACtC,IAAI,SAA6B,CAAC;QAElC,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;YAC1B,wCAAwC;YACxC,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC;QACnC,CAAC;aAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1B,yBAAyB;YACzB,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC;QAED,4DAA4D;QAC5D,IAAI,SAAS,EAAE,CAAC;YACd,gDAAgD;YAChD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC7C,OAAO,GAAG,OAAO,YAAY,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QACnD,CAAC;QAED,iGAAiG;QACjG,OAAO,0CAA0C,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,MAAM,CAAC,2BAA2B,CAChC,EAAe,EACf,MAAmC;QAEnC,MAAM,KAAK,GAAG,IAAI,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAC5C,OAAO,IAAI,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;CACF"}

package/dist/security/admission-refusal.d.ts

@@ -0,0 +1,32 @@
+/** The S2 item 10 codes, in its table order. */
+export declare const ADMISSION_REFUSAL_CODES: readonly ["malformed_proof", "invalid_signature", "kid_not_in_did_document", "request_hash_mismatch", "audience_mismatch", "nonce_replayed", "expired", "created_in_future", "authorization_unavailable", "proof_missing", "proof_invalid"];
+export type AdmissionRefusalCode = (typeof ADMISSION_REFUSAL_CODES)[number];
+/** Why admission refused a call. Set only by trusted admission code. */
+export interface AdmissionRefusal {
+    readonly code: AdmissionRefusalCode;
+}
+/** True only for one of the 11 S2 item 10 codes, exactly as written. */
+export declare function isAdmissionRefusalCode(value: unknown): value is AdmissionRefusalCode;
+/**
+ * Turn an admission denial into exactly one S2 item 10 code.
+ *
+ * The first priority reason present wins, whatever the gate code. Without
+ * one, `proof_missing` stays itself, a gate code meaning the call could not
+ * be checked gives `authorization_unavailable`, and everything else,
+ * including a reason or gate code upstream adds later, gives
+ * `proof_invalid` until item 10 names it.
+ *
+ * @param gateCode The code the admission denied with, as sent on the wire.
+ * @param reasons The verifier's recompute reasons, in any order.
+ *
+ * @example
+ * // A tampered replay reads as tampering.
+ * classifyAdmissionRefusal("proof_invalid", ["nonce_replayed", "request_hash_mismatch"]);
+ * // => "request_hash_mismatch"
+ *
+ * // A replay of a proof that has also expired reads as a replay.
+ * classifyAdmissionRefusal("proof_invalid", ["expired", "nonce_replayed"]);
+ * // => "nonce_replayed"
+ */
+export declare function classifyAdmissionRefusal(gateCode: string, reasons?: readonly string[]): AdmissionRefusalCode;
+//# sourceMappingURL=admission-refusal.d.ts.map

package/dist/security/admission-refusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission-refusal.d.ts","sourceRoot":"","sources":["../../src/security/admission-refusal.ts"],"names":[],"mappings":"AAeA,gDAAgD;AAChD,eAAO,MAAM,uBAAuB,6OAY1B,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;CACrC;AAsCD,wEAAwE;AACxE,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,oBAAoB,CAE/B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAC1B,oBAAoB,CAUtB"}

package/dist/security/admission-refusal.js

@@ -0,0 +1,97 @@
+/**
+ * Why an admission refused a call, reduced to one code Checkpoint can show.
+ *
+ * The wire result stays the gate code (`proof_invalid` for every recompute
+ * failure) so a caller learns nothing extra. The recompute reasons that
+ * `@kya-os/mcp` 1.16.0's `requireProof` returns are what tells a tampered,
+ * replayed or stale call apart, so they are classified here before they are
+ * dropped.
+ *
+ * Pure and value-free apart from one constant: `@kya-os/mcp/card` must only
+ * be reached through `card-proof-support` (see its header), and nothing here
+ * needs the runtime.
+ */
+import { PROOF_SUPPORT_UNAVAILABLE } from "./card-proof-support";
+/** The S2 item 10 codes, in its table order. */
+export const ADMISSION_REFUSAL_CODES = [
+    "malformed_proof",
+    "invalid_signature",
+    "kid_not_in_did_document",
+    "request_hash_mismatch",
+    "audience_mismatch",
+    "nonce_replayed",
+    "expired",
+    "created_in_future",
+    "authorization_unavailable",
+    "proof_missing",
+    "proof_invalid",
+];
+// Sets, not object lookups, so "__proto__" or "constructor" can never match.
+const REFUSAL_CODES = new Set(ADMISSION_REFUSAL_CODES);
+/**
+ * S2 item 10's priority: who signed, then what was signed, then where it was
+ * sent, then single use, then freshness. The reason strings are the ones the
+ * installed `@kya-os/mcp` 1.16.0 card verifier emits: `proof/verify.js`
+ * pushes all but two, returns `malformed_proof` directly, and
+ * `middleware.js` returns `proof_verifier_threw`.
+ */
+const REASON_PRIORITY = [
+    ["malformed_proof", "malformed_proof"],
+    // Both mean the proof could not be checked at all, not that it was bad.
+    ["proof_verifier_threw", "authorization_unavailable"],
+    ["nonce_seam_missing", "authorization_unavailable"],
+    ["invalid_signature", "invalid_signature"],
+    ["kid_not_in_did_document", "kid_not_in_did_document"],
+    ["request_hash_mismatch", "request_hash_mismatch"],
+    ["audience_mismatch", "audience_mismatch"],
+    ["nonce_replayed", "nonce_replayed"],
+    ["expired", "expired"],
+    ["created_in_future", "created_in_future"],
+];
+// Gate codes that say the call could not be checked, rather than that its
+// proof failed: the non-proof admission codes and missing card support.
+const UNCHECKABLE_GATE_CODES = new Set([
+    "invalid_request",
+    "policy_unavailable",
+    "executor_not_authorized",
+    "authorization_unavailable",
+    PROOF_SUPPORT_UNAVAILABLE,
+]);
+/** True only for one of the 11 S2 item 10 codes, exactly as written. */
+export function isAdmissionRefusalCode(value) {
+    return REFUSAL_CODES.has(value);
+}
+/**
+ * Turn an admission denial into exactly one S2 item 10 code.
+ *
+ * The first priority reason present wins, whatever the gate code. Without
+ * one, `proof_missing` stays itself, a gate code meaning the call could not
+ * be checked gives `authorization_unavailable`, and everything else,
+ * including a reason or gate code upstream adds later, gives
+ * `proof_invalid` until item 10 names it.
+ *
+ * @param gateCode The code the admission denied with, as sent on the wire.
+ * @param reasons The verifier's recompute reasons, in any order.
+ *
+ * @example
+ * // A tampered replay reads as tampering.
+ * classifyAdmissionRefusal("proof_invalid", ["nonce_replayed", "request_hash_mismatch"]);
+ * // => "request_hash_mismatch"
+ *
+ * // A replay of a proof that has also expired reads as a replay.
+ * classifyAdmissionRefusal("proof_invalid", ["expired", "nonce_replayed"]);
+ * // => "nonce_replayed"
+ */
+export function classifyAdmissionRefusal(gateCode, reasons) {
+    // Reasons come from another package, so do not trust their runtime shape.
+    const present = new Set(Array.isArray(reasons) ? reasons : []);
+    const winner = REASON_PRIORITY.find(([reason]) => present.has(reason));
+    if (winner)
+        return winner[1];
+    if (gateCode === "proof_missing")
+        return "proof_missing";
+    if (UNCHECKABLE_GATE_CODES.has(gateCode))
+        return "authorization_unavailable";
+    return "proof_invalid";
+}
+//# sourceMappingURL=admission-refusal.js.map

package/dist/security/admission-refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission-refusal.js","sourceRoot":"","sources":["../../src/security/admission-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,gDAAgD;AAChD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,iBAAiB;IACjB,mBAAmB;IACnB,yBAAyB;IACzB,uBAAuB;IACvB,mBAAmB;IACnB,gBAAgB;IAChB,SAAS;IACT,mBAAmB;IACnB,2BAA2B;IAC3B,eAAe;IACf,eAAe;CACP,CAAC;AASX,6EAA6E;AAC7E,MAAM,aAAa,GAAyB,IAAI,GAAG,CAAC,uBAAuB,CAAC,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,eAAe,GAEjB;IACF,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IACtC,wEAAwE;IACxE,CAAC,sBAAsB,EAAE,2BAA2B,CAAC;IACrD,CAAC,oBAAoB,EAAE,2BAA2B,CAAC;IACnD,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAC1C,CAAC,yBAAyB,EAAE,yBAAyB,CAAC;IACtD,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;IAClD,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAC1C,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IACpC,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;CAC3C,CAAC;AAEF,0EAA0E;AAC1E,wEAAwE;AACxE,MAAM,sBAAsB,GAAyB,IAAI,GAAG,CAAC;IAC3D,iBAAiB;IACjB,oBAAoB;IACpB,yBAAyB;IACzB,2BAA2B;IAC3B,yBAAyB;CAC1B,CAAC,CAAC;AAEH,wEAAwE;AACxE,MAAM,UAAU,sBAAsB,CACpC,KAAc;IAEd,OAAO,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,OAA2B;IAE3B,0EAA0E;IAC1E,MAAM,OAAO,GAAyB,IAAI,GAAG,CAC3C,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CACtC,CAAC;IACF,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,QAAQ,KAAK,eAAe;QAAE,OAAO,eAAe,CAAC;IACzD,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,2BAA2B,CAAC;IAC7E,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/security/card-proof-support.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The only way the admission path reaches `@kya-os/mcp/card` values.
+ *
+ * Why this exists: in an esbuild bundle of `MCPICloudflareAgent` the agent
+ * reaches the card modules through dynamic imports, so esbuild wraps them in
+ * lazy initialisers. `@kya-os/mcp` declares `"sideEffects": false` and the
+ * card entry only re-exports, so esbuild drops the call that initialises
+ * `card/proof/types.js`. A static import then reads `undefined` for the meta
+ * key and `NaN` for anything computed from `MAX_TTL_SEC`, and admission fails
+ * OPEN. An awaited dynamic import of the entry runs the initialisers, and
+ * validating the result turns any remaining breakage into a refusal instead.
+ *
+ * Only type imports from the card module are allowed in this file: a value
+ * import would reintroduce the lazily initialised binding.
+ */
+import type { requireProof } from "@kya-os/mcp/card";
+/** Admission refusal code when proof support cannot be validated. */
+export declare const PROOF_SUPPORT_UNAVAILABLE = "proof_support_unavailable";
+export interface CardProofSupport {
+    readonly metaKey: string;
+    readonly legacyMetaKey: string;
+    readonly maxTtlSec: number;
+    readonly defaultSkewSec: number;
+    readonly requireProof: typeof requireProof;
+}
+export type CardProofSupportResult = {
+    readonly ok: true;
+    readonly support: CardProofSupport;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/** Resolves the card module namespace. Injectable so tests can force failure. */
+export type CardModuleLoader = () => Promise<unknown>;
+/** Never rejects: every failure is an `ok: false` result. */
+export type CardProofSupportGetter = () => Promise<CardProofSupportResult>;
+export interface CardProofSupportAccessor {
+    readonly get: CardProofSupportGetter;
+    /** The settled result, or undefined while the first load is in flight. */
+    readonly peek: () => CardProofSupportResult | undefined;
+}
+/**
+ * Build an accessor that loads the card module once. Concurrent callers share
+ * one load, and a failure is cached and logged once, because a bundled module
+ * that failed to initialise will not recover within the same isolate.
+ */
+export declare function createCardProofSupport(load?: CardModuleLoader): CardProofSupportAccessor;
+export declare const getCardProofSupport: CardProofSupportGetter;
+export declare const peekCardProofSupport: CardProofSupportAccessor["peek"];
+/**
+ * Card-independent superset of "this `_meta` carries a request proof": the
+ * pinned canonical and legacy keys (present with any value, including null),
+ * any keys a resolved support names, and any value shaped like a proof under
+ * an unknown key. It must not depend on the card module, because it decides
+ * which calls to refuse when that module is unavailable.
+ */
+export declare function isProofShapedMeta(meta: unknown, support?: Pick<CardProofSupport, "metaKey" | "legacyMetaKey">): boolean;
+/**
+ * How long a consumed nonce must be kept: the verifier's full acceptance
+ * window (TTL plus skew on both sides) plus one second, matching the card
+ * module's NONCE_RETENTION_SEC for a caller-chosen skew. Throws rather than
+ * return NaN, because a NaN retention makes every nonce expire at once and
+ * lets replays through.
+ */
+export declare function requestProofNonceRetentionSec(support: Pick<CardProofSupport, "maxTtlSec" | "defaultSkewSec">, skewSec?: number): number;
+//# sourceMappingURL=card-proof-support.d.ts.map

package/dist/security/card-proof-support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-proof-support.d.ts","sourceRoot":"","sources":["../../src/security/card-proof-support.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,qEAAqE;AACrE,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AASrE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,OAAO,YAAY,CAAC;CAC5C;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtD,6DAA6D;AAC7D,MAAM,MAAM,sBAAsB,GAAG,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAE3E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,GAAG,EAAE,sBAAsB,CAAC;IACrC,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,sBAAsB,GAAG,SAAS,CAAC;CACzD;AAkED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAGpC,IAAI,GAAE,gBAAmD,GACxD,wBAAwB,CAe1B;AAID,eAAO,MAAM,mBAAmB,EAAE,sBACL,CAAC;AAE9B,eAAO,MAAM,oBAAoB,EAAE,wBAAwB,CAAC,MAAM,CACpC,CAAC;AAM/B;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,eAAe,CAAC,GAC5D,OAAO,CAMT;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,GAAG,gBAAgB,CAAC,EAC/D,OAAO,GAAE,MAA+B,GACvC,MAAM,CAUR"}

package/dist/security/card-proof-support.js

@@ -0,0 +1,121 @@
+/** Admission refusal code when proof support cannot be validated. */
+export const PROOF_SUPPORT_UNAVAILABLE = "proof_support_unavailable";
+const LOG_PREFIX = "[mcp-i-cloudflare] card proof support unavailable";
+// Pinned here, not read from the card module, so the fail-closed check still
+// sees a proof when that module is the thing that failed to load.
+const CANONICAL_PROOF_META_KEY = "org.kya-os/request-proof";
+const LEGACY_PROOF_META_KEY = "org.kya-os/proof@1";
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function hasOwn(target, key) {
+    return Object.prototype.hasOwnProperty.call(target, key);
+}
+function isPositiveFinite(value) {
+    return typeof value === "number" && Number.isFinite(value) && value > 0;
+}
+function unavailable(reason) {
+    return { ok: false, reason };
+}
+function validateCardModule(card) {
+    // Module namespace objects are plain objects here, so a non-record means
+    // the loader resolved something other than the card entry.
+    if (!isRecord(card))
+        return unavailable("card module is not an object");
+    const metaKey = card.KYA_OS_CARD_PROOF_META_KEY;
+    if (typeof metaKey !== "string" || metaKey === "")
+        return unavailable("KYA_OS_CARD_PROOF_META_KEY is not a non-empty string");
+    const legacyMetaKey = card.LEGACY_CARD_PROOF_META_KEY;
+    if (typeof legacyMetaKey !== "string" || legacyMetaKey === "")
+        return unavailable("LEGACY_CARD_PROOF_META_KEY is not a non-empty string");
+    // Equal keys would let a legacy carrier satisfy a canonical-key check.
+    if (legacyMetaKey === metaKey)
+        return unavailable("LEGACY_CARD_PROOF_META_KEY equals KYA_OS_CARD_PROOF_META_KEY");
+    const maxTtlSec = card.MAX_TTL_SEC;
+    if (!isPositiveFinite(maxTtlSec))
+        return unavailable("MAX_TTL_SEC is not a finite positive number");
+    const defaultSkewSec = card.DEFAULT_SKEW_SEC;
+    if (!isPositiveFinite(defaultSkewSec))
+        return unavailable("DEFAULT_SKEW_SEC is not a finite positive number");
+    if (typeof card.requireProof !== "function")
+        return unavailable("requireProof is not a function");
+    return {
+        ok: true,
+        support: Object.freeze({
+            metaKey,
+            legacyMetaKey,
+            maxTtlSec,
+            defaultSkewSec,
+            requireProof: card.requireProof,
+        }),
+    };
+}
+async function loadAndValidate(load) {
+    try {
+        return validateCardModule(await load());
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        return unavailable(`card module failed to load: ${detail}`);
+    }
+}
+/**
+ * Build an accessor that loads the card module once. Concurrent callers share
+ * one load, and a failure is cached and logged once, because a bundled module
+ * that failed to initialise will not recover within the same isolate.
+ */
+export function createCardProofSupport(
+// The specifier must stay a string literal inside this arrow so esbuild
+// sees the dynamic import and bundles the card entry with it.
+load = () => import("@kya-os/mcp/card")) {
+    let pending;
+    let settled;
+    const get = () => {
+        pending ??= loadAndValidate(load).then((result) => {
+            settled = result;
+            if (!result.ok)
+                console.error(`${LOG_PREFIX}; refusing proof-bearing calls: ${result.reason}`);
+            return result;
+        });
+        return pending;
+    };
+    return { get, peek: () => settled };
+}
+const defaultCardProofSupport = createCardProofSupport();
+export const getCardProofSupport = defaultCardProofSupport.get;
+export const peekCardProofSupport = defaultCardProofSupport.peek;
+function isProofShapedValue(value) {
+    return isRecord(value) && hasOwn(value, "prf") && hasOwn(value, "jws");
+}
+/**
+ * Card-independent superset of "this `_meta` carries a request proof": the
+ * pinned canonical and legacy keys (present with any value, including null),
+ * any keys a resolved support names, and any value shaped like a proof under
+ * an unknown key. It must not depend on the card module, because it decides
+ * which calls to refuse when that module is unavailable.
+ */
+export function isProofShapedMeta(meta, support) {
+    if (!isRecord(meta))
+        return false;
+    const keys = [CANONICAL_PROOF_META_KEY, LEGACY_PROOF_META_KEY];
+    if (support)
+        keys.push(support.metaKey, support.legacyMetaKey);
+    if (keys.some((key) => hasOwn(meta, key)))
+        return true;
+    return Object.values(meta).some(isProofShapedValue);
+}
+/**
+ * How long a consumed nonce must be kept: the verifier's full acceptance
+ * window (TTL plus skew on both sides) plus one second, matching the card
+ * module's NONCE_RETENTION_SEC for a caller-chosen skew. Throws rather than
+ * return NaN, because a NaN retention makes every nonce expire at once and
+ * lets replays through.
+ */
+export function requestProofNonceRetentionSec(support, skewSec = support.defaultSkewSec) {
+    if (!isPositiveFinite(support.maxTtlSec))
+        throw new RangeError(`request proof maxTtlSec must be a finite positive number, got ${support.maxTtlSec}`);
+    if (!Number.isFinite(skewSec) || skewSec < 0)
+        throw new RangeError(`request proof skewSec must be a finite non-negative number, got ${skewSec}`);
+    return support.maxTtlSec + 2 * skewSec + 1;
+}
+//# sourceMappingURL=card-proof-support.js.map

package/dist/security/card-proof-support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-proof-support.js","sourceRoot":"","sources":["../../src/security/card-proof-support.ts"],"names":[],"mappings":"AAiBA,qEAAqE;AACrE,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAC;AAErE,MAAM,UAAU,GAAG,mDAAmD,CAAC;AAEvE,6EAA6E;AAC7E,kEAAkE;AAClE,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAC5D,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;AA4BnD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,GAAW;IACzC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa;IACvC,yEAAyE;IACzE,2DAA2D;IAC3D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC,8BAA8B,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,IAAI,CAAC,0BAA0B,CAAC;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE;QAC/C,OAAO,WAAW,CAAC,sDAAsD,CAAC,CAAC;IAC7E,MAAM,aAAa,GAAG,IAAI,CAAC,0BAA0B,CAAC;IACtD,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,EAAE;QAC3D,OAAO,WAAW,CAAC,sDAAsD,CAAC,CAAC;IAC7E,uEAAuE;IACvE,IAAI,aAAa,KAAK,OAAO;QAC3B,OAAO,WAAW,CAChB,8DAA8D,CAC/D,CAAC;IACJ,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC;IACnC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;QAC9B,OAAO,WAAW,CAAC,6CAA6C,CAAC,CAAC;IACpE,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC7C,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC;QACnC,OAAO,WAAW,CAAC,kDAAkD,CAAC,CAAC;IACzE,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,UAAU;QACzC,OAAO,WAAW,CAAC,gCAAgC,CAAC,CAAC;IACvD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,OAAO;YACP,aAAa;YACb,SAAS;YACT,cAAc;YACd,YAAY,EAAE,IAAI,CAAC,YAAmC;SACvD,CAAC;KACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAAsB;IAEtB,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,WAAW,CAAC,+BAA+B,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;AACpC,wEAAwE;AACxE,8DAA8D;AAC9D,OAAyB,GAAG,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC;IAEzD,IAAI,OAAoD,CAAC;IACzD,IAAI,OAA2C,CAAC;IAChD,MAAM,GAAG,GAA2B,GAAG,EAAE;QACvC,OAAO,KAAK,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YAChD,OAAO,GAAG,MAAM,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,EAAE;gBACZ,OAAO,CAAC,KAAK,CACX,GAAG,UAAU,mCAAmC,MAAM,CAAC,MAAM,EAAE,CAChE,CAAC;YACJ,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,uBAAuB,GAAG,sBAAsB,EAAE,CAAC;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAC9B,uBAAuB,CAAC,GAAG,CAAC;AAE9B,MAAM,CAAC,MAAM,oBAAoB,GAC/B,uBAAuB,CAAC,IAAI,CAAC;AAE/B,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAa,EACb,OAA6D;IAE7D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,wBAAwB,EAAE,qBAAqB,CAAC,CAAC;IAC/D,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAA+D,EAC/D,UAAkB,OAAO,CAAC,cAAc;IAExC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC;QACtC,MAAM,IAAI,UAAU,CAClB,iEAAiE,OAAO,CAAC,SAAS,EAAE,CACrF,CAAC;IACJ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;QAC1C,MAAM,IAAI,UAAU,CAClB,mEAAmE,OAAO,EAAE,CAC7E,CAAC;IACJ,OAAO,OAAO,CAAC,SAAS,GAAG,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;AAC7C,CAAC"}

package/dist/security/mcp-admission.d.ts

@@ -1,6 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import type { CallToolResult, JSONRPCRequest, MessageExtraInfo } from "@modelcontextprotocol/sdk/types.js";
+import { type AdmissionRefusal, type AdmissionRefusalCode } from "./admission-refusal";
 export interface McpAdmissionContext {
     /** Transport-issued session, not a parameter supplied by the tool caller. */
     sessionId?: string;
@@ -14,7 +15,25 @@ export type McpAdmissionResult = {
 } | {
     allowed: false;
     result: CallToolResult;
+    /**
+     * Why the call was refused, for Checkpoint only; never sent to the
+     * caller. Set by `createMcpHolderAdmission`, and by `withMcpAdmission`
+     * when it rejects the delegation carriers before admission runs. A
+     * custom admission that leaves it unset is reported as nothing.
+     */
+    refusal?: AdmissionRefusal;
 };
+/** One refused tools/call, as reported to Checkpoint. Carries no proof or params. */
+export type McpAdmissionRefusalReport = {
+    toolName: string;
+    code: AdmissionRefusalCode;
+    sessionId?: string;
+};
+/**
+ * Awaited before the refusal is sent, for at most
+ * ADMISSION_REFUSAL_REPORT_BUDGET_MS; its failures never reach the caller.
+ */
+export type McpAdmissionRefusalReporter = (report: McpAdmissionRefusalReport) => Promise<void>;
 export interface McpRequestHolder {
     readonly did: string;
     readonly level: "L3" | "L3-minus";
@@ -33,11 +52,18 @@ export type McpRequestAdmission = (request: JSONRPCRequest, context: McpAdmissio
  * the public Transport contract, so it works with both DO and ordinary MCP
  * transports without patching private SDK handlers.
  */
-export declare function withMcpAdmission(transport: Transport, admit: McpRequestAdmission): Transport;
+export declare function withMcpAdmission(transport: Transport, admit: McpRequestAdmission, reportRefusal?: McpAdmissionRefusalReporter): Transport;
+/** How long a refused call waits for its Checkpoint report before replying. */
+export declare const ADMISSION_REFUSAL_REPORT_BUDGET_MS = 2000;
+export interface AdmissionMcpServerOptions {
+    /** Called once per refused tools/call of a registered tool, before the reply. */
+    reportRefusal?: McpAdmissionRefusalReporter;
+}
 /** McpAgent calls this public connect method when attaching its DO transport. */
 export declare class AdmissionMcpServer extends McpServer {
     private readonly admission;
-    constructor(info: ConstructorParameters<typeof McpServer>[0], admission: McpRequestAdmission);
+    private readonly options;
+    constructor(info: ConstructorParameters<typeof McpServer>[0], admission: McpRequestAdmission, options?: AdmissionMcpServerOptions);
     connect(transport: Transport): Promise<void>;
 }
 //# sourceMappingURL=mcp-admission.d.ts.map

package/dist/security/mcp-admission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-admission.d.ts","sourceRoot":"","sources":["../../src/security/mcp-admission.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAC/E,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACd,gBAAgB,EACjB,MAAM,oCAAoC,CAAC;AAO5C,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACxC,WAAW,CAAC,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC;CAC/C;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;CAAE,GAC5C;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAE/C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,IAAI,GAAG,UAAU,CAAC;CACnC;AAQD,wBAAgB,mBAAmB,IAAI,gBAAgB,GAAG,SAAS,CAElE;AAED,kFAAkF;AAClF,wBAAgB,yBAAyB,IAAI,MAAM,GAAG,SAAS,CAE9D;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,mBAAmB,KACzB,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEjC;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,mBAAmB,GACzB,SAAS,CAwJX;AAED,iFAAiF;AACjF,qBAAa,kBAAmB,SAAQ,SAAS;IAG7C,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAD1B,IAAI,EAAE,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,EAC/B,SAAS,EAAE,mBAAmB;IAKxC,OAAO,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;CAGtD"}
+{"version":3,"file":"mcp-admission.d.ts","sourceRoot":"","sources":["../../src/security/mcp-admission.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAC/E,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACd,gBAAgB,EACjB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAG1B,MAAM,qBAAqB,CAAC;AAM7B,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACxC,WAAW,CAAC,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC;CAC/C;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;CAAE,GAC5C;IACE,OAAO,EAAE,KAAK,CAAC;IACf,MAAM,EAAE,cAAc,CAAC;IACvB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B,CAAC;AAEN,qFAAqF;AACrF,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,oBAAoB,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,2BAA2B,GAAG,CACxC,MAAM,EAAE,yBAAyB,KAC9B,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,IAAI,GAAG,UAAU,CAAC;CACnC;AAQD,wBAAgB,mBAAmB,IAAI,gBAAgB,GAAG,SAAS,CAElE;AAED,kFAAkF;AAClF,wBAAgB,yBAAyB,IAAI,MAAM,GAAG,SAAS,CAE9D;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,mBAAmB,KACzB,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEjC;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,mBAAmB,EAC1B,aAAa,CAAC,EAAE,2BAA2B,GAC1C,SAAS,CA0IX;AAyED,+EAA+E;AAC/E,eAAO,MAAM,kCAAkC,OAAQ,CAAC;AAuCxD,MAAM,WAAW,yBAAyB;IACxC,iFAAiF;IACjF,aAAa,CAAC,EAAE,2BAA2B,CAAC;CAC7C;AAiBD,iFAAiF;AACjF,qBAAa,kBAAmB,SAAQ,SAAS;IAG7C,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAFxB,IAAI,EAAE,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,EAC/B,SAAS,EAAE,mBAAmB,EAC9B,OAAO,GAAE,yBAA8B;IAKjD,OAAO,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;CAatD"}