@kya-os/mcp-i-cloudflare 1.15.1 → 1.17.0

package/dist/security/mcp-admission.js

@@ -1,5 +1,6 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { classifyAdmissionRefusal, isAdmissionRefusalCode, } from "./admission-refusal";
 import { InvalidDelegationPresentation, readPresentedMcpDelegation, } from "./presented-delegation";
 // Established only by trusted transport admission, never tool params or a
 // stored handshake DID label. Async scope isolates concurrent MCP requests.
@@ -16,7 +17,7 @@ export function getMcpPresentedDelegation() {
  * the public Transport contract, so it works with both DO and ordinary MCP
  * transports without patching private SDK handlers.
  */
-export function withMcpAdmission(transport, admit) {
+export function withMcpAdmission(transport, admit, reportRefusal) {
     let closed = false;
     const pending = new Map();
     const wrapped = {
@@ -80,33 +81,14 @@ export function withMcpAdmission(transport, admit) {
                     authInfo: extra?.authInfo,
                     requestInfo: extra?.requestInfo,
                 };
+                // Read before admission, which receives `context` and could rewrite it.
+                const sessionId = context.sessionId;
                 void (async () => {
-                    let verdict;
-                    let presentedDelegation;
-                    try {
-                        // Snapshot carriers before a callback can mutate context/headers.
-                        presentedDelegation = readPresentedMcpDelegation(original, context.requestInfo?.headers);
-                        verdict = await admit(structuredClone(original), context);
-                    }
-                    catch (error) {
-                        verdict = {
-                            allowed: false,
-                            result: {
-                                isError: true,
-                                content: [
-                                    {
-                                        type: "text",
-                                        text: JSON.stringify({
-                                            error: error instanceof InvalidDelegationPresentation
-                                                ? "invalid_request"
-                                                : "authorization_unavailable",
-                                            message: "Request authorization could not be verified. Retry with a fresh proof.",
-                                        }),
-                                    },
-                                ],
-                            },
-                        };
-                    }
+                    const { verdict, presentedDelegation } = await admitOriginal(original, context, admit);
+                    // Before the cancelled check: a refused call is still an attempt
+                    // worth recording, even when its caller has stopped waiting.
+                    if (reportRefusal)
+                        await reportAdmissionRefusal(reportRefusal, verdict, original.params?.name, sessionId);
                     if (closed || active.cancelled)
                         return;
                     if (verdict?.allowed === true) {
@@ -151,15 +133,133 @@ export function withMcpAdmission(transport, admit) {
     };
     return wrapped;
 }
+/** The reply when no admission verdict could be reached. */
+function unverifiableRequest(error) {
+    const gateCode = error instanceof InvalidDelegationPresentation
+        ? "invalid_request"
+        : "authorization_unavailable";
+    return {
+        gateCode,
+        result: {
+            isError: true,
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify({
+                        error: gateCode,
+                        message: "Request authorization could not be verified. Retry with a fresh proof.",
+                    }),
+                },
+            ],
+        },
+    };
+}
+/**
+ * Reads the delegation carriers, then runs admission, over the original
+ * request.
+ *
+ * A carrier the wrapper rejects is refused here before any admission runs,
+ * so that refusal is the wrapper's own and carries its classified code (S2
+ * item 10 reads invalid_request as authorization_unavailable). A thrown
+ * admission carries none: the wrapper cannot tell which admission threw or
+ * why, so it is not reported.
+ */
+async function admitOriginal(original, context, admit) {
+    let presentedDelegation;
+    try {
+        // Snapshot carriers before a callback can mutate context/headers.
+        presentedDelegation = readPresentedMcpDelegation(original, context.requestInfo?.headers);
+    }
+    catch (error) {
+        const { gateCode, result } = unverifiableRequest(error);
+        return {
+            verdict: {
+                allowed: false,
+                result,
+                refusal: { code: classifyAdmissionRefusal(gateCode) },
+            },
+        };
+    }
+    try {
+        return {
+            verdict: await admit(structuredClone(original), context),
+            presentedDelegation,
+        };
+    }
+    catch (error) {
+        return {
+            verdict: { allowed: false, result: unverifiableRequest(error).result },
+        };
+    }
+}
+/** How long a refused call waits for its Checkpoint report before replying. */
+export const ADMISSION_REFUSAL_REPORT_BUDGET_MS = 2_000;
+/**
+ * Reports a refusal only when trusted code classified it: the holder
+ * admission, or the wrapper's own carrier check. A thrown admission carries
+ * no refusal, so it is never reported.
+ */
+async function reportAdmissionRefusal(reportRefusal, verdict, toolName, sessionId) {
+    try {
+        // Custom admissions return arbitrary values, so read them defensively.
+        if (verdict?.allowed !== false)
+            return;
+        const code = verdict.refusal?.code;
+        if (!isAdmissionRefusalCode(code) || typeof toolName !== "string")
+            return;
+        // The events fetch has no timeout of its own, so a slow or hung
+        // Checkpoint must not hold the refusal: after the budget the caller gets
+        // its answer and the report finishes, or fails, on its own.
+        let timer;
+        const budget = new Promise((resolve) => {
+            timer = setTimeout(resolve, ADMISSION_REFUSAL_REPORT_BUDGET_MS);
+        });
+        try {
+            await Promise.race([
+                reportRefusal({ toolName, code, sessionId }),
+                budget,
+            ]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    catch {
+        // Telemetry must never change or withhold the refusal the caller gets;
+        // the reporter owns its own logging.
+    }
+}
+/**
+ * The SDK keeps its tool registry private and offers no lookup, so this is
+ * the minimal private read (precedent: utils/hidden-consent-tools.ts). An own
+ * property check keeps "__proto__" and other inherited names from counting.
+ */
+function isRegisteredTool(server, name) {
+    const registry = server
+        ._registeredTools;
+    return (typeof registry === "object" &&
+        registry !== null &&
+        Object.prototype.hasOwnProperty.call(registry, name));
+}
 /** McpAgent calls this public connect method when attaching its DO transport. */
 export class AdmissionMcpServer extends McpServer {
     admission;
-    constructor(info, admission) {
+    options;
+    constructor(info, admission, options = {}) {
         super(info);
         this.admission = admission;
+        this.options = options;
     }
     connect(transport) {
-        return super.connect(withMcpAdmission(transport, this.admission));
+        const report = this.options.reportRefusal;
+        // Only registered tools are reported, so a caller cannot write arbitrary
+        // tool names into Checkpoint by spraying signed calls at made-up tools.
+        const reportRegistered = report &&
+            (async (refusal) => {
+                if (isRegisteredTool(this, refusal.toolName))
+                    await report(refusal);
+            });
+        return super.connect(withMcpAdmission(transport, this.admission, reportRegistered));
     }
 }
 //# sourceMappingURL=mcp-admission.js.map

package/dist/security/mcp-admission.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-admission.js","sourceRoot":"","sources":["../../src/security/mcp-admission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAQpE,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAmBhC,0EAA0E;AAC1E,4EAA4E;AAC5E,MAAM,WAAW,GAAG,IAAI,iBAAiB,EAGrC,CAAC;AACL,MAAM,UAAU,mBAAmB;IACjC,OAAO,WAAW,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC;AACxC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,yBAAyB;IACvC,OAAO,WAAW,CAAC,QAAQ,EAAE,EAAE,mBAAmB,CAAC;AACrD,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAoB,EACpB,KAA0B;IAE1B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2C,CAAC;IACnE,MAAM,OAAO,GAAc;QACzB,IAAI,SAAS;YACX,OAAO,SAAS,CAAC,SAAS,CAAC;QAC7B,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;gBACvB,MAAM,GAAG,IAAI,CAAC;gBACd,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACtB,CAAC,CAAC;YACF,SAAS,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;YACxD,SAAS,CAAC,SAAS,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;gBACvC,oEAAoE;gBACpE,yEAAyE;gBACzE,IACE,QAAQ,IAAI,OAAO;oBACnB,OAAO,CAAC,MAAM,KAAK,yBAAyB,EAC5C,CAAC;oBACD,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;oBACrC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;wBACrD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAC/B,IAAI,MAAM;4BAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;oBACtC,CAAC;gBACH,CAAC;gBACD,IACE,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC;oBACtB,OAAO,CAAC,MAAM,KAAK,YAAY;oBAC/B,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,EAClB,CAAC;oBACD,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBACpC,OAAO;gBACT,CAAC;gBACD,uEAAuE;gBACvE,0EAA0E;gBAC1E,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAmB,CAAC;gBAC5D,sEAAsE;gBACtE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC3C,IAAI,SAAS,IAAI,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;oBACrC,gEAAgE;oBAChE,sEAAsE;oBACtE,IAAI,SAAS;wBAAE,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC;oBAC1C,KAAK,SAAS;yBACX,IAAI,CACH;wBACE,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,QAAQ,CAAC,EAAE;wBACf,KAAK,EAAE;4BACL,IAAI,EAAE,CAAC,KAAK;4BACZ,OAAO,EACL,qDAAqD;yBACxD;qBACF,EACD,EAAE,gBAAgB,EAAE,QAAQ,CAAC,EAAE,EAAE,CAClC;yBACA,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;wBACxB,OAAO,CAAC,OAAO,EAAE,CACf,KAAK,YAAY,KAAK;4BACpB,CAAC,CAAC,KAAK;4BACP,CAAC,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAC5C,CAAC;oBACJ,CAAC,CAAC,CAAC;oBACL,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBACjC,MAAM,OAAO,GAAwB;oBACnC,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,QAAQ,EAAE,KAAK,EAAE,QAAQ;oBACzB,WAAW,EAAE,KAAK,EAAE,WAAW;iBAChC,CAAC;gBACF,KAAK,CAAC,KAAK,IAAI,EAAE;oBACf,IAAI,OAA2B,CAAC;oBAChC,IAAI,mBAAuC,CAAC;oBAC5C,IAAI,CAAC;wBACH,kEAAkE;wBAClE,mBAAmB,GAAG,0BAA0B,CAC9C,QAAQ,EACR,OAAO,CAAC,WAAW,EAAE,OAAO,CAC7B,CAAC;wBACF,OAAO,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;oBAC5D,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,OAAO,GAAG;4BACR,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE;gCACN,OAAO,EAAE,IAAI;gCACb,OAAO,EAAE;oCACP;wCACE,IAAI,EAAE,MAAM;wCACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4CACnB,KAAK,EACH,KAAK,YAAY,6BAA6B;gDAC5C,CAAC,CAAC,iBAAiB;gDACnB,CAAC,CAAC,2BAA2B;4CACjC,OAAO,EACL,wEAAwE;yCAC3E,CAAC;qCACH;iCACF;6BACF;yBACF,CAAC;oBACJ,CAAC;oBACD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS;wBAAE,OAAO;oBACvC,IAAI,OAAO,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;wBAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM;4BAC3B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;4BACtC,CAAC,CAAC,SAAS,CAAC;wBACd,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,GAAG,EAAE,CACpD,OAAO,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CACrC,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,MAAM,SAAS,CAAC,IAAI,CAClB;4BACE,OAAO,EAAE,KAAK;4BACd,EAAE,EAAE,QAAQ,CAAC,EAAE;4BACf,MAAM,EACJ,OAAO,EAAE,OAAO,KAAK,KAAK;gCACxB,CAAC,CAAC,OAAO,CAAC,MAAM;gCAChB,CAAC,CAAC;oCACE,OAAO,EAAE,IAAI;oCACb,OAAO,EAAE;wCACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE;qCAC/C;iCACF;yBACR,EACD,EAAE,gBAAgB,EAAE,QAAQ,CAAC,EAAE,EAAE,CAClC,CAAC;oBACJ,CAAC;gBACH,CAAC,CAAC,EAAE;qBACD,OAAO,CAAC,GAAG,EAAE;oBACZ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,MAAM;wBACrC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAChC,CAAC,CAAC;qBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBACxB,OAAO,CAAC,OAAO,EAAE,CACf,KAAK,YAAY,KAAK;wBACpB,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAC5C,CAAC;gBACJ,CAAC,CAAC,CAAC;YACP,CAAC,CAAC;YACF,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;QAC5D,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,kBAAkB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC,OAAO,CAAC;KACzE,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AACjF,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAG5B;IAFnB,YACE,IAAgD,EAC/B,SAA8B;QAE/C,KAAK,CAAC,IAAI,CAAC,CAAC;QAFK,cAAS,GAAT,SAAS,CAAqB;IAGjD,CAAC;IAEQ,OAAO,CAAC,SAAoB;QACnC,OAAO,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACpE,CAAC;CACF"}
+{"version":3,"file":"mcp-admission.js","sourceRoot":"","sources":["../../src/security/mcp-admission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAQpE,OAAO,EAGL,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AA4ChC,0EAA0E;AAC1E,4EAA4E;AAC5E,MAAM,WAAW,GAAG,IAAI,iBAAiB,EAGrC,CAAC;AACL,MAAM,UAAU,mBAAmB;IACjC,OAAO,WAAW,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC;AACxC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,yBAAyB;IACvC,OAAO,WAAW,CAAC,QAAQ,EAAE,EAAE,mBAAmB,CAAC;AACrD,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAoB,EACpB,KAA0B,EAC1B,aAA2C;IAE3C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2C,CAAC;IACnE,MAAM,OAAO,GAAc;QACzB,IAAI,SAAS;YACX,OAAO,SAAS,CAAC,SAAS,CAAC;QAC7B,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;gBACvB,MAAM,GAAG,IAAI,CAAC;gBACd,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACtB,CAAC,CAAC;YACF,SAAS,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;YACxD,SAAS,CAAC,SAAS,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;gBACvC,oEAAoE;gBACpE,yEAAyE;gBACzE,IACE,QAAQ,IAAI,OAAO;oBACnB,OAAO,CAAC,MAAM,KAAK,yBAAyB,EAC5C,CAAC;oBACD,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;oBACrC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;wBACrD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAC/B,IAAI,MAAM;4BAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;oBACtC,CAAC;gBACH,CAAC;gBACD,IACE,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC;oBACtB,OAAO,CAAC,MAAM,KAAK,YAAY;oBAC/B,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,EAClB,CAAC;oBACD,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBACpC,OAAO;gBACT,CAAC;gBACD,uEAAuE;gBACvE,0EAA0E;gBAC1E,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAmB,CAAC;gBAC5D,sEAAsE;gBACtE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC3C,IAAI,SAAS,IAAI,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;oBACrC,gEAAgE;oBAChE,sEAAsE;oBACtE,IAAI,SAAS;wBAAE,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC;oBAC1C,KAAK,SAAS;yBACX,IAAI,CACH;wBACE,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,QAAQ,CAAC,EAAE;wBACf,KAAK,EAAE;4BACL,IAAI,EAAE,CAAC,KAAK;4BACZ,OAAO,EACL,qDAAqD;yBACxD;qBACF,EACD,EAAE,gBAAgB,EAAE,QAAQ,CAAC,EAAE,EAAE,CAClC;yBACA,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;wBACxB,OAAO,CAAC,OAAO,EAAE,CACf,KAAK,YAAY,KAAK;4BACpB,CAAC,CAAC,KAAK;4BACP,CAAC,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAC5C,CAAC;oBACJ,CAAC,CAAC,CAAC;oBACL,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBACjC,MAAM,OAAO,GAAwB;oBACnC,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,QAAQ,EAAE,KAAK,EAAE,QAAQ;oBACzB,WAAW,EAAE,KAAK,EAAE,WAAW;iBAChC,CAAC;gBACF,wEAAwE;gBACxE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;gBACpC,KAAK,CAAC,KAAK,IAAI,EAAE;oBACf,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,MAAM,aAAa,CAC1D,QAAQ,EACR,OAAO,EACP,KAAK,CACN,CAAC;oBACF,iEAAiE;oBACjE,6DAA6D;oBAC7D,IAAI,aAAa;wBACf,MAAM,sBAAsB,CAC1B,aAAa,EACb,OAAO,EACP,QAAQ,CAAC,MAAM,EAAE,IAAI,EACrB,SAAS,CACV,CAAC;oBACJ,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS;wBAAE,OAAO;oBACvC,IAAI,OAAO,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;wBAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM;4BAC3B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;4BACtC,CAAC,CAAC,SAAS,CAAC;wBACd,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,GAAG,EAAE,CACpD,OAAO,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CACrC,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,MAAM,SAAS,CAAC,IAAI,CAClB;4BACE,OAAO,EAAE,KAAK;4BACd,EAAE,EAAE,QAAQ,CAAC,EAAE;4BACf,MAAM,EACJ,OAAO,EAAE,OAAO,KAAK,KAAK;gCACxB,CAAC,CAAC,OAAO,CAAC,MAAM;gCAChB,CAAC,CAAC;oCACE,OAAO,EAAE,IAAI;oCACb,OAAO,EAAE;wCACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE;qCAC/C;iCACF;yBACR,EACD,EAAE,gBAAgB,EAAE,QAAQ,CAAC,EAAE,EAAE,CAClC,CAAC;oBACJ,CAAC;gBACH,CAAC,CAAC,EAAE;qBACD,OAAO,CAAC,GAAG,EAAE;oBACZ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,MAAM;wBACrC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAChC,CAAC,CAAC;qBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBACxB,OAAO,CAAC,OAAO,EAAE,CACf,KAAK,YAAY,KAAK;wBACpB,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAC5C,CAAC;gBACJ,CAAC,CAAC,CAAC;YACP,CAAC,CAAC;YACF,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;QAC5D,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,kBAAkB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC,OAAO,CAAC;KACzE,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,4DAA4D;AAC5D,SAAS,mBAAmB,CAAC,KAAc;IAIzC,MAAM,QAAQ,GACZ,KAAK,YAAY,6BAA6B;QAC5C,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,2BAA2B,CAAC;IAClC,OAAO;QACL,QAAQ;QACR,MAAM,EAAE;YACN,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,KAAK,EAAE,QAAQ;wBACf,OAAO,EACL,wEAAwE;qBAC3E,CAAC;iBACH;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,aAAa,CAC1B,QAAwB,EACxB,OAA4B,EAC5B,KAA0B;IAE1B,IAAI,mBAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,kEAAkE;QAClE,mBAAmB,GAAG,0BAA0B,CAC9C,QAAQ,EACR,OAAO,CAAC,WAAW,EAAE,OAAO,CAC7B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACxD,OAAO;YACL,OAAO,EAAE;gBACP,OAAO,EAAE,KAAK;gBACd,MAAM;gBACN,OAAO,EAAE,EAAE,IAAI,EAAE,wBAAwB,CAAC,QAAQ,CAAC,EAAE;aACtD;SACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO;YACL,OAAO,EAAE,MAAM,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;YACxD,mBAAmB;SACpB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE;SACvE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,kCAAkC,GAAG,KAAK,CAAC;AAExD;;;;GAIG;AACH,KAAK,UAAU,sBAAsB,CACnC,aAA0C,EAC1C,OAA2B,EAC3B,QAAiB,EACjB,SAA6B;IAE7B,IAAI,CAAC;QACH,uEAAuE;QACvE,IAAI,OAAO,EAAE,OAAO,KAAK,KAAK;YAAE,OAAO;QACvC,MAAM,IAAI,GAAY,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC;QAC5C,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO;QAC1E,gEAAgE;QAChE,yEAAyE;QACzE,4DAA4D;QAC5D,IAAI,KAAgD,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC3C,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,kCAAkC,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;gBAC5C,MAAM;aACP,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,qCAAqC;IACvC,CAAC;AACH,CAAC;AAOD;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,MAAiB,EAAE,IAAY;IACvD,MAAM,QAAQ,GAAI,MAAoD;SACnE,gBAAgB,CAAC;IACpB,OAAO,CACL,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,KAAK,IAAI;QACjB,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CACrD,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAG5B;IACA;IAHnB,YACE,IAAgD,EAC/B,SAA8B,EAC9B,UAAqC,EAAE;QAExD,KAAK,CAAC,IAAI,CAAC,CAAC;QAHK,cAAS,GAAT,SAAS,CAAqB;QAC9B,YAAO,GAAP,OAAO,CAAgC;IAG1D,CAAC;IAEQ,OAAO,CAAC,SAAoB;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QAC1C,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,gBAAgB,GACpB,MAAM;YACN,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBACjB,IAAI,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC;oBAAE,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;YACtE,CAAC,CAAC,CAAC;QACL,OAAO,KAAK,CAAC,OAAO,CAClB,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAC9D,CAAC;IACJ,CAAC;CACF"}

package/dist/security/mcp-holder-admission.d.ts

@@ -1,5 +1,6 @@
-import { type VerifyProofDeps } from "@kya-os/mcp/card";
+import type { VerifyProofDeps } from "@kya-os/mcp/card";
 import type { JSONRPCRequest } from "@modelcontextprotocol/sdk/types.js";
+import { type CardProofSupportGetter } from "./card-proof-support";
 import type { McpAdmissionContext, McpRequestAdmission } from "./mcp-admission";
 export interface McpHolderAdmissionOptions {
     /** Select from trusted resource/tool configuration, never incoming params. */
@@ -16,4 +17,14 @@ export interface McpHolderAdmissionOptions {
  * provider and scopes. Invalid native proofs never fall back to an executor.
  */
 export declare function createMcpHolderAdmission(options: McpHolderAdmissionOptions): McpRequestAdmission;
+/**
+ * `createMcpHolderAdmission` with the card proof support passed in, so tests
+ * can make it unavailable. The source of the card module decides which calls
+ * count as signed, so it is a separate typed argument and never read from
+ * the options object, where a spread tenant config could carry it in
+ * unnoticed. Not exported from the package entry.
+ *
+ * @internal
+ */
+export declare function createMcpHolderAdmissionWithSupport(options: McpHolderAdmissionOptions, getSupport: CardProofSupportGetter): McpRequestAdmission;
 //# sourceMappingURL=mcp-holder-admission.d.ts.map

package/dist/security/mcp-holder-admission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-holder-admission.d.ts","sourceRoot":"","sources":["../../src/security/mcp-holder-admission.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE,OAAO,KAAK,EACV,mBAAmB,EAEnB,mBAAmB,EACpB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,WAAW,yBAAyB;IACxC,8EAA8E;IAC9E,WAAW,CACT,IAAI,EAAE,MAAM,GAEV,OAAO,CAAC,QAAQ,GAAG,kBAAkB,GAAG,QAAQ,CAAC,GACjD,QAAQ,GACR,kBAAkB,GAClB,QAAQ,CAAC;IACb,+EAA+E;IAC/E,KAAK,CACH,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAC;IAC9C;0EACsE;IACtE,iBAAiB,CAAC,EAAE,CAClB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,mBAAmB,KACzB,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AAYD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,yBAAyB,GACjC,mBAAmB,CAsCrB"}
+{"version":3,"file":"mcp-holder-admission.d.ts","sourceRoot":"","sources":["../../src/security/mcp-holder-admission.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EACL,KAAK,sBAAsB,EAI5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,mBAAmB,EAEnB,mBAAmB,EACpB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,WAAW,yBAAyB;IACxC,8EAA8E;IAC9E,WAAW,CACT,IAAI,EAAE,MAAM,GAEV,OAAO,CAAC,QAAQ,GAAG,kBAAkB,GAAG,QAAQ,CAAC,GACjD,QAAQ,GACR,kBAAkB,GAClB,QAAQ,CAAC;IACb,+EAA+E;IAC/E,KAAK,CACH,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAC;IAC9C;0EACsE;IACtE,iBAAiB,CAAC,EAAE,CAClB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,mBAAmB,KACzB,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AA4BD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,yBAAyB,GACjC,mBAAmB,CAErB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,yBAAyB,EAClC,UAAU,EAAE,sBAAsB,GACjC,mBAAmB,CA+CrB"}

package/dist/security/mcp-holder-admission.js

@@ -1,20 +1,46 @@
-import { KYA_OS_CARD_PROOF_META_KEY, requireProof, } from "@kya-os/mcp/card";
-import { hasMcpRequestProof } from "./presented-delegation";
-function deny(code) {
+import { classifyAdmissionRefusal } from "./admission-refusal";
+import { getCardProofSupport, isProofShapedMeta, PROOF_SUPPORT_UNAVAILABLE, } from "./card-proof-support";
+import { hasCardProofCarrier } from "./presented-delegation";
+/**
+ * The caller sees only the gate code. The classified refusal rides beside
+ * the result for Checkpoint, so a tampered, replayed or stale call can be
+ * told apart there without telling the caller which check it failed.
+ */
+function deny(code, reasons) {
     return {
         allowed: false,
         result: {
             isError: true,
             content: [{ type: "text", text: JSON.stringify({ error: code }) }],
         },
+        refusal: { code: classifyAdmissionRefusal(code, reasons) },
     };
 }
+// The verifier widens its acceptance window by skewSec, so NaN or Infinity
+// would stop it rejecting stale proofs, and nonce retention derived from it
+// would stop catching replays.
+function hasValidSkew(deps) {
+    return (deps.skewSec === undefined ||
+        (Number.isFinite(deps.skewSec) && deps.skewSec >= 0));
+}
 /**
  * Authenticate the live invoker before the existing consent/delegation gate.
  * This grants no authority: the runtime must still verify the grant, account,
  * provider and scopes. Invalid native proofs never fall back to an executor.
  */
 export function createMcpHolderAdmission(options) {
+    return createMcpHolderAdmissionWithSupport(options, getCardProofSupport);
+}
+/**
+ * `createMcpHolderAdmission` with the card proof support passed in, so tests
+ * can make it unavailable. The source of the card module decides which calls
+ * count as signed, so it is a separate typed argument and never read from
+ * the options object, where a spread tenant config could carry it in
+ * unnoticed. Not exported from the package entry.
+ *
+ * @internal
+ */
+export function createMcpHolderAdmissionWithSupport(options, getSupport) {
     return async (request, context) => {
         try {
             const { _meta, ...params } = request.params ?? {};
@@ -23,19 +49,31 @@ export function createMcpHolderAdmission(options) {
             const mode = await options.modeForTool(params.name);
             if (!["native", "runtime-executor", "public"].includes(mode))
                 return deny("policy_unavailable");
-            if (mode === "native" || hasMcpRequestProof(_meta)) {
+            const cardSupport = await getSupport();
+            if (!cardSupport.ok) {
+                // Without the card module no proof can be checked, so anything that
+                // looks signed must not run as an unsigned (server DID) call.
+                if (mode === "native" || isProofShapedMeta(_meta))
+                    return deny(PROOF_SUPPORT_UNAVAILABLE);
+            }
+            else if (mode === "native" ||
+                hasCardProofCarrier(_meta, cardSupport.support)) {
+                const { metaKey, requireProof } = cardSupport.support;
                 // The canonical carrier wins even when null/malformed. Published core
                 // 1.15 uses nullish fallback; do not let a legacy proof replace an
                 // explicitly empty canonical proof on this required admission path.
                 if (_meta &&
-                    Object.prototype.hasOwnProperty.call(_meta, KYA_OS_CARD_PROOF_META_KEY) &&
-                    _meta[KYA_OS_CARD_PROOF_META_KEY] == null)
+                    Object.prototype.hasOwnProperty.call(_meta, metaKey) &&
+                    _meta[metaKey] == null)
                     return deny("proof_missing");
-                const guard = requireProof(await options.proof(context));
+                const deps = await options.proof(context);
+                if (!hasValidSkew(deps))
+                    return deny("authorization_unavailable");
+                const guard = requireProof(deps);
                 const proof = await guard({ method: request.method, params }, _meta);
                 return proof.ok
                     ? { allowed: true, holder: { did: proof.did, level: proof.level } }
-                    : deny(proof.error.code);
+                    : deny(proof.error.code, proof.error.reasons);
             }
             if (mode === "runtime-executor") {
                 return (await options.authorizeExecutor?.(request, context)) === true

package/dist/security/mcp-holder-admission.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-holder-admission.js","sourceRoot":"","sources":["../../src/security/mcp-holder-admission.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,YAAY,GAEb,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAuB5D,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE;YACN,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;SACnE;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAkC;IAElC,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAChC,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YAClD,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;gBACpE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,CAAC,CAAC,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC1D,OAAO,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACpC,IAAI,IAAI,KAAK,QAAQ,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnD,sEAAsE;gBACtE,mEAAmE;gBACnE,oEAAoE;gBACpE,IACE,KAAK;oBACL,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAClC,KAAK,EACL,0BAA0B,CAC3B;oBACD,KAAK,CAAC,0BAA0B,CAAC,IAAI,IAAI;oBAEzC,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBACzD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;gBACrE,OAAO,KAAK,CAAC,EAAE;oBACb,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE;oBACnE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YACD,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAChC,OAAO,CAAC,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI;oBACnE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;oBACnB,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"mcp-holder-admission.js","sourceRoot":"","sources":["../../src/security/mcp-holder-admission.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAEL,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAuB7D;;;;GAIG;AACH,SAAS,IAAI,CAAC,IAAY,EAAE,OAA2B;IACrD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE;YACN,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;SACnE;QACD,OAAO,EAAE,EAAE,IAAI,EAAE,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;KAC3D,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,4EAA4E;AAC5E,+BAA+B;AAC/B,SAAS,YAAY,CAAC,IAAqB;IACzC,OAAO,CACL,IAAI,CAAC,OAAO,KAAK,SAAS;QAC1B,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CACrD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAkC;IAElC,OAAO,mCAAmC,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CACjD,OAAkC,EAClC,UAAkC;IAElC,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAChC,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YAClD,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;gBACpE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,CAAC,CAAC,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC1D,OAAO,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACpC,MAAM,WAAW,GAAG,MAAM,UAAU,EAAE,CAAC;YACvC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;gBACpB,oEAAoE;gBACpE,8DAA8D;gBAC9D,IAAI,IAAI,KAAK,QAAQ,IAAI,iBAAiB,CAAC,KAAK,CAAC;oBAC/C,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;YAC3C,CAAC;iBAAM,IACL,IAAI,KAAK,QAAQ;gBACjB,mBAAmB,CAAC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAC/C,CAAC;gBACD,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC;gBACtD,sEAAsE;gBACtE,mEAAmE;gBACnE,oEAAoE;gBACpE,IACE,KAAK;oBACL,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC;oBACpD,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI;oBAEtB,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC/B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC1C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAC,2BAA2B,CAAC,CAAC;gBAClE,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;gBACjC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;gBACrE,OAAO,KAAK,CAAC,EAAE;oBACb,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE;oBACnE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAChC,OAAO,CAAC,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI;oBACnE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;oBACnB,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/security/presented-delegation.d.ts

@@ -1,4 +1,5 @@
 import type { JSONRPCRequest } from "@modelcontextprotocol/sdk/types.js";
+import { type CardProofSupport, type CardProofSupportGetter } from "./card-proof-support";
 /** Parsing identifies a credential carrier only. It establishes no authority. */
 export declare function decodeJwtPayload(jwt: string): Record<string, unknown> | null;
 export declare class InvalidDelegationPresentation extends Error {
@@ -6,7 +7,16 @@ export declare class InvalidDelegationPresentation extends Error {
 }
 export declare function readHeaderDelegation(getHeader: (name: string) => string | null): string | undefined;
 /** Presence, including malformed values, must never select an unsigned lane. */
+export declare function hasCardProofCarrier(meta: unknown, support: Pick<CardProofSupport, "metaKey" | "legacyMetaKey">): boolean;
+/**
+ * Sync check for callers that cannot await. Exact once card support has
+ * resolved in this isolate; until then (or if it failed) it errs towards
+ * "signed", which is the safe answer for every caller that must not rewrite
+ * or downgrade a signed request.
+ */
 export declare function hasMcpRequestProof(meta: unknown): boolean;
+/** Like {@link hasMcpRequestProof}, but waits for card support to resolve. */
+export declare function hasMcpRequestProofAsync(meta: unknown, getSupport?: CardProofSupportGetter): Promise<boolean>;
 /** Keep the original request intact; handlers consume this unverified token
  * out of band and still require the existing delegation verifier to accept it. */
 export declare function readPresentedMcpDelegation(request: JSONRPCRequest, headers?: Record<string, string | string[] | undefined>): string | undefined;

package/dist/security/presented-delegation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"presented-delegation.d.ts","sourceRoot":"","sources":["../../src/security/presented-delegation.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAIzE,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAc5E;AAED,qBAAa,6BAA8B,SAAQ,KAAK;;CAIvD;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GACzC,MAAM,GAAG,SAAS,CAiBpB;AAED,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAQzD;AAED;kFACkF;AAClF,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAM,GAC1D,MAAM,GAAG,SAAS,CA4BpB"}
+{"version":3,"file":"presented-delegation.d.ts","sourceRoot":"","sources":["../../src/security/presented-delegation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAGzE,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAK5B,MAAM,sBAAsB,CAAC;AAE9B,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAc5E;AAED,qBAAa,6BAA8B,SAAQ,KAAK;;CAIvD;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GACzC,MAAM,GAAG,SAAS,CAiBpB;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,eAAe,CAAC,GAC3D,OAAO,CAQT;AAaD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEzD;AAED,8EAA8E;AAC9E,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,OAAO,EACb,UAAU,GAAE,sBAA4C,GACvD,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;kFACkF;AAClF,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAM,GAC1D,MAAM,GAAG,SAAS,CA4BpB"}

package/dist/security/presented-delegation.js

@@ -1,5 +1,5 @@
-import { KYA_OS_CARD_PROOF_META_KEY, LEGACY_CARD_PROOF_META_KEY, } from "@kya-os/mcp/card";
 import { FALLBACK_DELEGATION_HEADER } from "../delegation-http/constants";
+import { getCardProofSupport, isProofShapedMeta, peekCardProofSupport, } from "./card-proof-support";
 /** Parsing identifies a credential carrier only. It establishes no authority. */
 export function decodeJwtPayload(jwt) {
     const parts = jwt.split(".");
@@ -39,10 +39,30 @@ export function readHeaderDelegation(getHeader) {
     return credential;
 }
 /** Presence, including malformed values, must never select an unsigned lane. */
-export function hasMcpRequestProof(meta) {
+export function hasCardProofCarrier(meta, support) {
     return (meta !== null &&
         typeof meta === "object" &&
-        [KYA_OS_CARD_PROOF_META_KEY, LEGACY_CARD_PROOF_META_KEY].some((key) => Object.prototype.hasOwnProperty.call(meta, key)));
+        [support.metaKey, support.legacyMetaKey].some((key) => Object.prototype.hasOwnProperty.call(meta, key)));
+}
+// Without validated card support, the card-independent superset decides, so a
+// bundle that never initialised the card constants still sees the proof.
+function hasProofFor(meta, result) {
+    return result?.ok
+        ? hasCardProofCarrier(meta, result.support)
+        : isProofShapedMeta(meta);
+}
+/**
+ * Sync check for callers that cannot await. Exact once card support has
+ * resolved in this isolate; until then (or if it failed) it errs towards
+ * "signed", which is the safe answer for every caller that must not rewrite
+ * or downgrade a signed request.
+ */
+export function hasMcpRequestProof(meta) {
+    return hasProofFor(meta, peekCardProofSupport());
+}
+/** Like {@link hasMcpRequestProof}, but waits for card support to resolve. */
+export async function hasMcpRequestProofAsync(meta, getSupport = getCardProofSupport) {
+    return hasProofFor(meta, await getSupport());
 }
 /** Keep the original request intact; handlers consume this unverified token
  * out of band and still require the existing delegation verifier to accept it. */

package/dist/security/presented-delegation.js.map

@@ -1 +1 @@
-{"version":3,"file":"presented-delegation.js","sourceRoot":"","sources":["../../src/security/presented-delegation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAE1E,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CACjC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CACnD,CAAC;QACF,OAAO,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACtE,CAAC,CAAE,OAAmC;YACtC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD;QACE,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACtD,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAClC,SAA0C;IAE1C,MAAM,IAAI,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI;QACjB,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAClD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,UAAU,GACd,aAAa,IAAI,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,MAAM,QAAQ,GAAG,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,KAAK,CAAC;YACxE,MAAM,IAAI,6BAA6B,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,OAAO,CACL,IAAI,KAAK,IAAI;QACb,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAC,0BAA0B,EAAE,0BAA0B,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACpE,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAChD,CACF,CAAC;AACJ,CAAC;AAED;kFACkF;AAClF,MAAM,UAAU,0BAA0B,CACxC,OAAuB,EACvB,UAAyD,EAAE;IAE3D,MAAM,WAAW,GAAG,oBAAoB,CAAC,CAAC,IAAI,EAAE,EAAE;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAC5C,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,IAAI,KAAK,KAAK,SAAS,CAClE,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,6BAA6B,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,6BAA6B,EAAE,CAAC;YAClE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,KAAK,IAAI,IAAI,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IACE,CAAC,MAAM;QACP,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC;QAEhE,OAAO,WAAW,CAAC;IACrB,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;IACzC,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,SAAS,CAAC,IAAI,EAAE;QACjB,CAAC,WAAW,KAAK,SAAS,IAAI,SAAS,KAAK,WAAW,CAAC;QAExD,MAAM,IAAI,6BAA6B,EAAE,CAAC;IAC5C,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"presented-delegation.js","sourceRoot":"","sources":["../../src/security/presented-delegation.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAIL,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CACjC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CACnD,CAAC;QACF,OAAO,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACtE,CAAC,CAAE,OAAmC;YACtC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD;QACE,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACtD,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAClC,SAA0C;IAE1C,MAAM,IAAI,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI;QACjB,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAClD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,UAAU,GACd,aAAa,IAAI,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,MAAM,QAAQ,GAAG,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,KAAK,CAAC;YACxE,MAAM,IAAI,6BAA6B,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CACjC,IAAa,EACb,OAA4D;IAE5D,OAAO,CACL,IAAI,KAAK,IAAI;QACb,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACpD,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAChD,CACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,SAAS,WAAW,CAClB,IAAa,EACb,MAA0C;IAE1C,OAAO,MAAM,EAAE,EAAE;QACf,CAAC,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,OAAO,WAAW,CAAC,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAa,EACb,aAAqC,mBAAmB;IAExD,OAAO,WAAW,CAAC,IAAI,EAAE,MAAM,UAAU,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED;kFACkF;AAClF,MAAM,UAAU,0BAA0B,CACxC,OAAuB,EACvB,UAAyD,EAAE;IAE3D,MAAM,WAAW,GAAG,oBAAoB,CAAC,CAAC,IAAI,EAAE,EAAE;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAC5C,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,IAAI,KAAK,KAAK,SAAS,CAClE,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,6BAA6B,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,6BAA6B,EAAE,CAAC;YAClE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,KAAK,IAAI,IAAI,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IACE,CAAC,MAAM;QACP,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC;QAEhE,OAAO,WAAW,CAAC;IACrB,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;IACzC,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,SAAS,CAAC,IAAI,EAAE;QACjB,CAAC,WAAW,KAAK,SAAS,IAAI,SAAS,KAAK,WAAW,CAAC;QAExD,MAAM,IAAI,6BAA6B,EAAE,CAAC;IAC5C,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/services/admin.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.service.d.ts","sourceRoot":"","sources":["../../src/services/admin.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAW9C,qBAAa,YAAY;IACvB,OAAO,CAAC,GAAG,CAAgB;gBAEf,GAAG,EAAE,aAAa;IAI9B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA8B3B;;;;OAIG;IACG,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAoDjD;;OAEG;YACW,gBAAgB;CA0hB/B"}
+{"version":3,"file":"admin.service.d.ts","sourceRoot":"","sources":["../../src/services/admin.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAkB9C,qBAAa,YAAY;IACvB,OAAO,CAAC,GAAG,CAAgB;gBAEf,GAAG,EAAE,aAAa;IAI9B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA8B3B;;;;OAIG;IACG,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAoDjD;;OAEG;YACW,gBAAgB;CA6iB/B"}

package/dist/services/admin.service.js

@@ -5,8 +5,9 @@
  * Only enabled when config.admin.enabled === true
  */
 import { DEFAULT_CHECKPOINT_URL } from "../constants";
-import { MCP_CORS_HEADERS, PREFLIGHT_CORS_HEADERS } from "@kya-os/mcp-i-runtime";
+import { MCP_CORS_HEADERS, PREFLIGHT_CORS_HEADERS, } from "@kya-os/mcp-i-runtime";
 import { clearCacheRequestSchema } from "@kya-os/contracts/checkpoint-api";
+import { ToolProtectionSchema, } from "@kya-os/contracts/tool-protection";
 export class AdminService {
     env;
     constructor(env) {
@@ -291,14 +292,26 @@ export class AdminService {
                             const toolProtections = {};
                             const rawProtections = freshData.data.toolProtections || freshData.data.tools || {};
                             for (const [toolName, toolConfig] of Object.entries(rawProtections)) {
+                                if (!toolConfig ||
+                                    typeof toolConfig !== "object" ||
+                                    Array.isArray(toolConfig)) {
+                                    throw new Error("Invalid tool protection in cache refresh");
+                                }
                                 const tc = toolConfig;
-                                const requiresDelegation = tc.requiresDelegation ?? tc.requires_delegation ?? false;
-                                const requiredScopes = tc.requiredScopes ?? tc.required_scopes ?? tc.scopes ?? [];
-                                toolProtections[toolName] = {
-                                    requiresDelegation,
-                                    requiredScopes,
-                                };
-                                if (requiresDelegation) {
+                                // Cache hits are used directly by ToolProtectionService. Keep
+                                // every enforcement field, particularly the identity method;
+                                // warming must not turn OAuth into consent-only authorization.
+                                // Reject malformed authorization instead of caching a weakened
+                                // subset. The existing catch leaves the normal API fetch path.
+                                const protection = ToolProtectionSchema.parse({
+                                    requiresDelegation: tc.requiresDelegation ?? tc.requires_delegation ?? false,
+                                    requiredScopes: tc.requiredScopes ?? tc.required_scopes ?? tc.scopes ?? [],
+                                    oauthProvider: tc.oauthProvider ?? tc.oauth_provider ?? undefined,
+                                    riskLevel: tc.riskLevel ?? tc.risk_level ?? undefined,
+                                    authorization: tc.authorization,
+                                });
+                                toolProtections[toolName] = protection;
+                                if (protection.requiresDelegation) {
                                     refreshedProtectedTools.push(toolName);
                                 }
                             }
@@ -325,7 +338,9 @@ export class AdminService {
                     }
                 }
                 catch (error) {
-                    console.warn("[Admin] Error warming cache with fresh config:", error);
+                    // Log the message only: Node 24.12's util.inspect throws on a zod
+                    // 3.25 ZodError, which would turn this warning into a failed clear.
+                    console.warn("[Admin] Error warming cache with fresh config:", error instanceof Error ? error.message : String(error));
                     // Continue without warming - cache clear still happened
                 }
             }

package/dist/services/admin.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.service.js","sourceRoot":"","sources":["../../src/services/admin.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAOjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAE3E,MAAM,OAAO,YAAY;IACf,GAAG,CAAgB;IAE3B,YAAY,GAAkB;QAC5B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,mBAAmB,CACzB,IAAY,EACZ,OAAe,EACf,MAAc,EACd,OAAiC;QAEjC,MAAM,SAAS,GAA+B;YAC5C,IAAI;YACJ,OAAO;YACP,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;SAC5B,CAAC;QAEF,MAAM,WAAW,GAAsD;YACrE,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE;gBACR,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE;gBAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC;SACF,CAAC;QAEF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;YAC/C,MAAM;YACN,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,gBAAgB;aACpB;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,OAAgB;QAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjC,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE;YAC7C,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QAEH,4CAA4C;QAC5C,IAAI,GAAG,CAAC,QAAQ,KAAK,oBAAoB,EAAE,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC/D,oCAAoC;YACpC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACxB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,GAAG,sBAAsB;qBAC1B;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,mBAAmB,CAC7B,oBAAoB,EACpB,+BAA+B,EAC/B,GAAG,EACH;oBACE,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,eAAe,EAAE,CAAC,MAAM,CAAC;iBAC1B,CACF,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,yDAAyD;QACzD,OAAO,IAAI,CAAC,mBAAmB,CAC7B,oBAAoB,EACpB,0BAA0B,EAC1B,GAAG,EACH;YACE,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,mBAAmB,EAAE,CAAC,oBAAoB,CAAC;YAC3C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,kGAAkG;SACzG,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAAC,OAAgB;QAC7C,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAExD,4EAA4E;QAC5E,IAAI,CAAC;YACH,kCAAkC;YAClC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC9C,OAAO,CAAC,IAAI,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;gBAClE,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE;gBACnD,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;aAClC,CAAC,CAAC;YACH,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAEjE,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,mBAAmB,CAC7B,kBAAkB,EAClB,0CAA0C,EAC1C,GAAG,EACH,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,CACrD,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC;YAEtD,4CAA4C;YAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACxD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrD,OAAO,IAAI,CAAC,mBAAmB,CAC7B,cAAc,EACd,wDAAwD,EACxD,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B;YAE9D,iEAAiE;YACjE,sFAAsF;YACtF,sDAAsD;YACtD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACjD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CACX,4DAA4D;oBAC1D,kEAAkE,CACrE,CAAC;gBACF,OAAO,IAAI,CAAC,mBAAmB,CAC7B,qBAAqB,EACrB,8DAA8D,EAC9D,GAAG,EACH;oBACE,IAAI,EAAE,+FAA+F;iBACtG,CACF,CAAC;YACJ,CAAC;YAED,mFAAmF;YACnF,MAAM,aAAa,GACjB,IAAI,CAAC,GAAG,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;YACxD,MAAM,aAAa,GAAG,GAAG,aAAa,4BAA4B,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC;YAEzG,IAAI,CAAC;gBACH,MAAM,kBAAkB,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;oBACpD,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;qBAClC;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC;oBAC3B,OAAO,CAAC,IAAI,CACV,oCAAoC,EACpC,kBAAkB,CAAC,MAAM,CAC1B,CAAC;oBACF,OAAO,IAAI,CAAC,mBAAmB,CAC7B,iBAAiB,EACjB,gCAAgC,EAChC,GAAG,CACJ,CAAC;gBACJ,CAAC;gBAED,2CAA2C;gBAC3C,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;gBAC1D,OAAO,IAAI,CAAC,mBAAmB,CAC7B,mBAAmB,EACnB,4CAA4C,EAC5C,GAAG,EACH;oBACE,aAAa,EACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBACzD,CACF,CAAC;YACJ,CAAC;YAED,qDAAqD;YACrD,uCAAuC;YACvC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAEhD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,+CAA+C;gBAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAC1C,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CACrE,CAAC;gBACF,OAAO,CAAC,KAAK,CAAC,qDAAqD,EAAE;oBACnE,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB;oBAClD,SAAS,EAAE,SAAS,IAAI,MAAM;oBAC9B,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;oBACvC,eAAe,EAAE,OAAO;oBACxB,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,8BAA8B;iBAC/E,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,mBAAmB,CAC7B,qBAAqB,EACrB,6CAA6C,EAC7C,GAAG,EACH;oBACE,IAAI,EAAE,8KAA8K;oBACpL,eAAe,EAAE,OAAO;iBACzB,CACF,CAAC;YACJ,CAAC;YAED,mEAAmE;YACnE,sEAAsE;YACtE,iDAAiD;YACjD,MAAM,YAAY,GAAG,SAAS;gBAC5B,CAAC,CAAC,2BAA2B,SAAS,EAAE;gBACxC,CAAC,CAAC,SAAS,QAAQ,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,mBAAmB,YAAY,EAAE,CAAC;YAEnD,8EAA8E;YAC9E,MAAM,WAAW,GAAG,SAAS;gBAC3B,CAAC,CAAC,yBAAyB,QAAQ,EAAE;gBACrC,CAAC,CAAC,IAAI,CAAC;YAET,qDAAqD;YACrD,MAAM,mBAAmB,GAAG,SAAS;gBACnC,CAAC,CAAC,gBAAgB,SAAS,EAAE;gBAC7B,CAAC,CAAC,IAAI,CAAC;YAET,uDAAuD;YACvD,MAAM,qBAAqB,GAAG,SAAS;gBACrC,CAAC,CAAC,kBAAkB,SAAS,EAAE;gBAC/B,CAAC,CAAC,IAAI,CAAC;YAET,qCAAqC;YACrC,IAAI,MAAM,GAAQ,IAAI,CAAC;YACvB,IAAI,SAAS,GAAQ,IAAI,CAAC;YAC1B,IAAI,WAAW,GAAQ,IAAI,CAAC;YAC5B,IAAI,aAAa,GAAQ,IAAI,CAAC;YAC9B,IAAI,YAAY,GAAa,EAAE,CAAC;YAEhC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CACV,oDAAoD,EACpD,KAAK,CACN,CAAC;YACJ,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACjD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,IAAI,CACV,wDAAwD,EACxD,KAAK,CACN,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,mBAAmB,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,WAAW,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAC3D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,IAAI,CACV,iEAAiE,EACjE,KAAK,CACN,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,aAAa,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;gBAC/D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,IAAI,CACV,mEAAmE,EACnE,KAAK,CACN,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,uCAAuC;YACvC,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACnC,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,QAAQ,CAAC,CAAC;YACrE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxE,YAAY,CAAC,IAAI,CAAC,oBAAoB,QAAQ,KAAK,QAAQ,EAAE,CAAC,CAAC;gBAC/D,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;oBACtC,OAAO,CAAC,KAAK,CACX,6CAA6C,EAC7C,WAAW,CACZ,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,QAAQ,GACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACzD,YAAY,CAAC,IAAI,CAAC,oBAAoB,WAAW,KAAK,QAAQ,EAAE,CAAC,CAAC;oBAClE,OAAO,CAAC,KAAK,CACX,yCAAyC,EACzC,WAAW,EACX,KAAK,CACN,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,qDAAqD;YACrD,IAAI,mBAAmB,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,WAAW,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;oBAC9C,OAAO,CAAC,KAAK,CACX,sDAAsD,EACtD,mBAAmB,CACpB,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,QAAQ,GACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACzD,YAAY,CAAC,IAAI,CACf,oBAAoB,mBAAmB,KAAK,QAAQ,EAAE,CACvD,CAAC;oBACF,OAAO,CAAC,KAAK,CACX,kDAAkD,EAClD,mBAAmB,EACnB,KAAK,CACN,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,uDAAuD;YACvD,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,MAAM,WAAW,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;oBAChD,OAAO,CAAC,KAAK,CACX,wDAAwD,EACxD,qBAAqB,CACtB,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,QAAQ,GACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACzD,YAAY,CAAC,IAAI,CACf,oBAAoB,qBAAqB,KAAK,QAAQ,EAAE,CACzD,CAAC;oBACF,OAAO,CAAC,KAAK,CACX,oDAAoD,EACpD,qBAAqB,EACrB,KAAK,CACN,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,8DAA8D;YAC9D,uEAAuE;YACvE,IAAI,kBAAkB,GAAG,KAAK,CAAC;YAC/B,IAAI,kBAAkB,GAAG,CAAC,CAAC;YAC3B,IAAI,uBAAuB,GAAa,EAAE,CAAC;YAE3C,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,OAAO,CAAC,KAAK,CACX,kEAAkE,CACnE,CAAC;oBACF,+EAA+E;oBAC/E,4EAA4E;oBAC5E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBACvC,MAAM,kBAAkB,GAAG,GAAG,aAAa,4BAA4B,kBAAkB,CAAC,SAAS,CAAC,qBAAqB,WAAW,EAAE,CAAC;oBAEvI,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,kBAAkB,EAAE;wBACpD,MAAM,EAAE,KAAK;wBACb,OAAO,EAAE;4BACP,cAAc,EAAE,kBAAkB;4BAClC,0DAA0D;4BAC1D,6DAA6D;4BAC7D,WAAW,EAAE,MAAM;4BACnB,cAAc,EAAE,SAAS;4BACzB,qCAAqC;4BACrC,eAAe,EAAE,qCAAqC;4BACtD,MAAM,EAAE,UAAU;yBACnB;qBACF,CAAC,CAAC;oBAEH,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;wBACrB,MAAM,SAAS,GAAQ,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;wBAElD,IAAI,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;4BACxC,uCAAuC;4BACvC,MAAM,eAAe,GAAwB,EAAE,CAAC;4BAChD,MAAM,cAAc,GAClB,SAAS,CAAC,IAAI,CAAC,eAAe,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;4BAE/D,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CACjD,cAAc,CACf,EAAE,CAAC;gCACF,MAAM,EAAE,GAAG,UAAiB,CAAC;gCAC7B,MAAM,kBAAkB,GACtB,EAAE,CAAC,kBAAkB,IAAI,EAAE,CAAC,mBAAmB,IAAI,KAAK,CAAC;gCAC3D,MAAM,cAAc,GAClB,EAAE,CAAC,cAAc,IAAI,EAAE,CAAC,eAAe,IAAI,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC;gCAE7D,eAAe,CAAC,QAAQ,CAAC,GAAG;oCAC1B,kBAAkB;oCAClB,cAAc;iCACf,CAAC;gCAEF,IAAI,kBAAkB,EAAE,CAAC;oCACvB,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gCACzC,CAAC;4BACH,CAAC;4BAED,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC;4BAEzD,uDAAuD;4BACvD,MAAM,WAAW,GAAG;gCAClB,eAAe;gCACf,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;gCACpB,MAAM,EAAE,aAAa;6BACtB,CAAC;4BAEF,MAAM,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;gCAC3D,aAAa,EAAE,GAAG,EAAE,uBAAuB;6BAC5C,CAAC,CAAC;4BAEH,kBAAkB,GAAG,IAAI,CAAC;4BAC1B,OAAO,CAAC,KAAK,CACX,sDAAsD,EACtD;gCACE,QAAQ;gCACR,SAAS,EAAE,kBAAkB;gCAC7B,cAAc,EAAE,uBAAuB;6BACxC,CACF,CAAC;wBACJ,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,IAAI,CACV,uCAAuC,EACvC,aAAa,CAAC,MAAM,CACrB,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,IAAI,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAC;oBACtE,wDAAwD;gBAC1D,CAAC;YACH,CAAC;YAED,kBAAkB;YAClB,mEAAmE;YACnE,uFAAuF;YACvF,IAAI,KAAK,GAAQ,IAAI,CAAC;YACtB,IAAI,qBAAqB,GAAG,KAAK,CAAC;YAClC,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACxC,qBAAqB,GAAG,IAAI,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;gBAChE,iEAAiE;gBACjE,kDAAkD;gBAClD,qBAAqB,GAAG,KAAK,CAAC;YAChC,CAAC;YAED,8CAA8C;YAC9C,gGAAgG;YAChG,6BAA6B;YAC7B,6EAA6E;YAC7E,yDAAyD;YACzD,MAAM,OAAO,GAAG,kBAAkB;gBAChC,CAAC,CAAC,IAAI,CAAC,4DAA4D;gBACnE,CAAC,CAAC,qBAAqB;oBACrB,CAAC,CAAC,CAAC,KAAK,CAAC,8DAA8D;oBACvE,CAAC,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,0DAA0D;YAE3F,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;YAC1B,MAAM,WAAW,GAAG,CAAC,CAAC,SAAS,CAAC;YAEhC,gEAAgE;YAChE,iDAAiD;YACjD,IAAI,qBAAqB,IAAI,KAAK,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC1D,OAAO,CAAC,KAAK,CACX,+EAA+E,EAC/E;oBACE,QAAQ;oBACR,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;oBACvC,UAAU,EAAE,QAAQ;oBACpB,YAAY,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM;iBAC9D,CACF,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE;gBACvD,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACvC,SAAS,EAAE,SAAS,IAAI,MAAM;gBAC9B,QAAQ;gBACR,WAAW,EAAE,WAAW,IAAI,MAAM;gBAClC,mBAAmB,EAAE,mBAAmB,IAAI,MAAM;gBAClD,qBAAqB,EAAE,qBAAqB,IAAI,MAAM;gBACtD,QAAQ;gBACR,WAAW;gBACX,aAAa,EAAE,CAAC,CAAC,WAAW;gBAC5B,eAAe,EAAE,CAAC,CAAC,aAAa;gBAChC,OAAO;gBACP,qBAAqB;gBACrB,YAAY,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aACjE,CAAC,CAAC;YAEH,+EAA+E;YAC/E,wFAAwF;YACxF,wEAAwE;YACxE,uEAAuE;YACvE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC,mBAAmB,CAC7B,iBAAiB,EACjB,6BAA6B,EAC7B,GAAG,EACH;oBACE,aAAa,EAAE,YAAY;oBAC3B,SAAS,EAAE,QAAQ;oBACnB,aAAa,EAAE,WAAW,IAAI,IAAI;oBAClC,SAAS,EAAE,QAAQ;oBACnB,aAAa,EAAE,WAAW;oBAC1B,OAAO,EAAE,OAAO;oBAChB,sBAAsB,EAAE,qBAAqB;iBAC9C,CACF,CAAC;YACJ,CAAC;YAED,yEAAyE;YACzE,mEAAmE;YACnE,IAAI,CAAC,qBAAqB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,CAAC,KAAK,CACX,qEAAqE,EACrE;oBACE,QAAQ;oBACR,QAAQ;iBACT,CACF,CAAC;YACJ,CAAC;YAED,4BAA4B;YAC5B,qFAAqF;YACrF,8EAA8E;YAC9E,MAAM,YAAY,GAQd;gBACF,OAAO,EAAE,kBAAkB;oBACzB,CAAC,CAAC,+CAA+C,uBAAuB,CAAC,MAAM,uBAAuB,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE;oBACpJ,CAAC,CAAC,OAAO;wBACP,CAAC,CAAC,qFAAqF;wBACvF,CAAC,CAAC,qFAAqF;gBAC3F,SAAS,EAAE,QAAQ;gBACnB,UAAU,EAAE,SAAS,IAAI,IAAI;gBAC7B,SAAS,EAAE,QAAQ;gBACnB,aAAa,EAAE,WAAW,IAAI,IAAI;gBAClC,SAAS,EAAE,CAAC,CAAC,MAAM;gBACnB,aAAa,EAAE,CAAC,CAAC,SAAS;gBAC1B,OAAO,EAAE,OAAO,EAAE,mCAAmC;gBACrD,YAAY,EAAE,kBAAkB;gBAChC,oBAAoB,EAAE,kBAAkB;oBACtC,CAAC,CAAC,kBAAkB;oBACpB,CAAC,CAAC,SAAS;gBACb,yBAAyB,EAAE,kBAAkB;oBAC3C,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,SAAS;gBACb,sBAAsB,EAAE,mBAAmB,IAAI,IAAI;gBACnD,wBAAwB,EAAE,qBAAqB,IAAI,IAAI;gBACvD,eAAe,EAAE,CAAC,CAAC,WAAW;gBAC9B,iBAAiB,EAAE,CAAC,CAAC,aAAa;aACnC,CAAC;YAEF,yCAAyC;YACzC,MAAM,WAAW,GAA8C;gBAC7D,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE;oBACR,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE;oBAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC;aACF,CAAC;YAEF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;gBAC/C,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,gBAAgB;iBACpB;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,+CAA+C;YAC/C,MAAM,YAAY,GAAG;gBACnB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC/D,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;gBACrD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBACvD,KAAK,EACH,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,KAAK;oBACnC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;oBACrB,CAAC,CAAC,SAAS;aAChB,CAAC;YAEF,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,YAAY,CAAC,CAAC;YAC9D,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,IAAI,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;YAE/D,OAAO,IAAI,CAAC,mBAAmB,CAC7B,gBAAgB,EAChB,+BAA+B,EAC/B,GAAG,EACH;gBACE,aAAa,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBACrE,UAAU,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;aAC5D,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"admin.service.js","sourceRoot":"","sources":["../../src/services/admin.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EACL,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EACL,oBAAoB,GAErB,MAAM,mCAAmC,CAAC;AAE3C,MAAM,OAAO,YAAY;IACf,GAAG,CAAgB;IAE3B,YAAY,GAAkB;QAC5B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,mBAAmB,CACzB,IAAY,EACZ,OAAe,EACf,MAAc,EACd,OAAiC;QAEjC,MAAM,SAAS,GAA+B;YAC5C,IAAI;YACJ,OAAO;YACP,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;SAC5B,CAAC;QAEF,MAAM,WAAW,GAAsD;YACrE,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE;gBACR,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE;gBAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC;SACF,CAAC;QAEF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;YAC/C,MAAM;YACN,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,gBAAgB;aACpB;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,OAAgB;QAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjC,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE;YAC7C,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QAEH,4CAA4C;QAC5C,IAAI,GAAG,CAAC,QAAQ,KAAK,oBAAoB,EAAE,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC/D,oCAAoC;YACpC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACxB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,GAAG,sBAAsB;qBAC1B;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,mBAAmB,CAC7B,oBAAoB,EACpB,+BAA+B,EAC/B,GAAG,EACH;oBACE,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,eAAe,EAAE,CAAC,MAAM,CAAC;iBAC1B,CACF,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,yDAAyD;QACzD,OAAO,IAAI,CAAC,mBAAmB,CAC7B,oBAAoB,EACpB,0BAA0B,EAC1B,GAAG,EACH;YACE,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,mBAAmB,EAAE,CAAC,oBAAoB,CAAC;YAC3C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,kGAAkG;SACzG,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAAC,OAAgB;QAC7C,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAExD,4EAA4E;QAC5E,IAAI,CAAC;YACH,kCAAkC;YAClC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC9C,OAAO,CAAC,IAAI,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;gBAClE,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE;gBACnD,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;aAClC,CAAC,CAAC;YACH,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAEjE,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,mBAAmB,CAC7B,kBAAkB,EAClB,0CAA0C,EAC1C,GAAG,EACH,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,CACrD,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC;YAEtD,4CAA4C;YAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACxD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrD,OAAO,IAAI,CAAC,mBAAmB,CAC7B,cAAc,EACd,wDAAwD,EACxD,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B;YAE9D,iEAAiE;YACjE,sFAAsF;YACtF,sDAAsD;YACtD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACjD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CACX,4DAA4D;oBAC1D,kEAAkE,CACrE,CAAC;gBACF,OAAO,IAAI,CAAC,mBAAmB,CAC7B,qBAAqB,EACrB,8DAA8D,EAC9D,GAAG,EACH;oBACE,IAAI,EAAE,+FAA+F;iBACtG,CACF,CAAC;YACJ,CAAC;YAED,mFAAmF;YACnF,MAAM,aAAa,GACjB,IAAI,CAAC,GAAG,CAAC,kBAAkB,IAAI,sBAAsB,CAAC;YACxD,MAAM,aAAa,GAAG,GAAG,aAAa,4BAA4B,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC;YAEzG,IAAI,CAAC;gBACH,MAAM,kBAAkB,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;oBACpD,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;qBAClC;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC;oBAC3B,OAAO,CAAC,IAAI,CACV,oCAAoC,EACpC,kBAAkB,CAAC,MAAM,CAC1B,CAAC;oBACF,OAAO,IAAI,CAAC,mBAAmB,CAC7B,iBAAiB,EACjB,gCAAgC,EAChC,GAAG,CACJ,CAAC;gBACJ,CAAC;gBAED,2CAA2C;gBAC3C,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;gBAC1D,OAAO,IAAI,CAAC,mBAAmB,CAC7B,mBAAmB,EACnB,4CAA4C,EAC5C,GAAG,EACH;oBACE,aAAa,EACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBACzD,CACF,CAAC;YACJ,CAAC;YAED,qDAAqD;YACrD,uCAAuC;YACvC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAEhD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,+CAA+C;gBAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAC1C,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CACrE,CAAC;gBACF,OAAO,CAAC,KAAK,CAAC,qDAAqD,EAAE;oBACnE,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB;oBAClD,SAAS,EAAE,SAAS,IAAI,MAAM;oBAC9B,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;oBACvC,eAAe,EAAE,OAAO;oBACxB,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,8BAA8B;iBAC/E,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,mBAAmB,CAC7B,qBAAqB,EACrB,6CAA6C,EAC7C,GAAG,EACH;oBACE,IAAI,EAAE,8KAA8K;oBACpL,eAAe,EAAE,OAAO;iBACzB,CACF,CAAC;YACJ,CAAC;YAED,mEAAmE;YACnE,sEAAsE;YACtE,iDAAiD;YACjD,MAAM,YAAY,GAAG,SAAS;gBAC5B,CAAC,CAAC,2BAA2B,SAAS,EAAE;gBACxC,CAAC,CAAC,SAAS,QAAQ,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,mBAAmB,YAAY,EAAE,CAAC;YAEnD,8EAA8E;YAC9E,MAAM,WAAW,GAAG,SAAS;gBAC3B,CAAC,CAAC,yBAAyB,QAAQ,EAAE;gBACrC,CAAC,CAAC,IAAI,CAAC;YAET,qDAAqD;YACrD,MAAM,mBAAmB,GAAG,SAAS;gBACnC,CAAC,CAAC,gBAAgB,SAAS,EAAE;gBAC7B,CAAC,CAAC,IAAI,CAAC;YAET,uDAAuD;YACvD,MAAM,qBAAqB,GAAG,SAAS;gBACrC,CAAC,CAAC,kBAAkB,SAAS,EAAE;gBAC/B,CAAC,CAAC,IAAI,CAAC;YAET,qCAAqC;YACrC,IAAI,MAAM,GAAQ,IAAI,CAAC;YACvB,IAAI,SAAS,GAAQ,IAAI,CAAC;YAC1B,IAAI,WAAW,GAAQ,IAAI,CAAC;YAC5B,IAAI,aAAa,GAAQ,IAAI,CAAC;YAC9B,IAAI,YAAY,GAAa,EAAE,CAAC;YAEhC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CACV,oDAAoD,EACpD,KAAK,CACN,CAAC;YACJ,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACjD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,IAAI,CACV,wDAAwD,EACxD,KAAK,CACN,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,mBAAmB,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,WAAW,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAC3D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,IAAI,CACV,iEAAiE,EACjE,KAAK,CACN,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,aAAa,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;gBAC/D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,IAAI,CACV,mEAAmE,EACnE,KAAK,CACN,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,uCAAuC;YACvC,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACnC,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,QAAQ,CAAC,CAAC;YACrE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxE,YAAY,CAAC,IAAI,CAAC,oBAAoB,QAAQ,KAAK,QAAQ,EAAE,CAAC,CAAC;gBAC/D,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;oBACtC,OAAO,CAAC,KAAK,CACX,6CAA6C,EAC7C,WAAW,CACZ,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,QAAQ,GACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACzD,YAAY,CAAC,IAAI,CAAC,oBAAoB,WAAW,KAAK,QAAQ,EAAE,CAAC,CAAC;oBAClE,OAAO,CAAC,KAAK,CACX,yCAAyC,EACzC,WAAW,EACX,KAAK,CACN,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,qDAAqD;YACrD,IAAI,mBAAmB,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,WAAW,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;oBAC9C,OAAO,CAAC,KAAK,CACX,sDAAsD,EACtD,mBAAmB,CACpB,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,QAAQ,GACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACzD,YAAY,CAAC,IAAI,CACf,oBAAoB,mBAAmB,KAAK,QAAQ,EAAE,CACvD,CAAC;oBACF,OAAO,CAAC,KAAK,CACX,kDAAkD,EAClD,mBAAmB,EACnB,KAAK,CACN,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,uDAAuD;YACvD,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,MAAM,WAAW,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;oBAChD,OAAO,CAAC,KAAK,CACX,wDAAwD,EACxD,qBAAqB,CACtB,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,QAAQ,GACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACzD,YAAY,CAAC,IAAI,CACf,oBAAoB,qBAAqB,KAAK,QAAQ,EAAE,CACzD,CAAC;oBACF,OAAO,CAAC,KAAK,CACX,oDAAoD,EACpD,qBAAqB,EACrB,KAAK,CACN,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,8DAA8D;YAC9D,uEAAuE;YACvE,IAAI,kBAAkB,GAAG,KAAK,CAAC;YAC/B,IAAI,kBAAkB,GAAG,CAAC,CAAC;YAC3B,IAAI,uBAAuB,GAAa,EAAE,CAAC;YAE3C,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,OAAO,CAAC,KAAK,CACX,kEAAkE,CACnE,CAAC;oBACF,+EAA+E;oBAC/E,4EAA4E;oBAC5E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBACvC,MAAM,kBAAkB,GAAG,GAAG,aAAa,4BAA4B,kBAAkB,CAAC,SAAS,CAAC,qBAAqB,WAAW,EAAE,CAAC;oBAEvI,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,kBAAkB,EAAE;wBACpD,MAAM,EAAE,KAAK;wBACb,OAAO,EAAE;4BACP,cAAc,EAAE,kBAAkB;4BAClC,0DAA0D;4BAC1D,6DAA6D;4BAC7D,WAAW,EAAE,MAAM;4BACnB,cAAc,EAAE,SAAS;4BACzB,qCAAqC;4BACrC,eAAe,EAAE,qCAAqC;4BACtD,MAAM,EAAE,UAAU;yBACnB;qBACF,CAAC,CAAC;oBAEH,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;wBACrB,MAAM,SAAS,GAAQ,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;wBAElD,IAAI,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;4BACxC,uCAAuC;4BACvC,MAAM,eAAe,GAAmC,EAAE,CAAC;4BAC3D,MAAM,cAAc,GAClB,SAAS,CAAC,IAAI,CAAC,eAAe,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;4BAE/D,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CACjD,cAAc,CACf,EAAE,CAAC;gCACF,IACE,CAAC,UAAU;oCACX,OAAO,UAAU,KAAK,QAAQ;oCAC9B,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EACzB,CAAC;oCACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gCAC9D,CAAC;gCACD,MAAM,EAAE,GAAG,UAAqC,CAAC;gCACjD,8DAA8D;gCAC9D,6DAA6D;gCAC7D,+DAA+D;gCAC/D,+DAA+D;gCAC/D,+DAA+D;gCAC/D,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC;oCAC5C,kBAAkB,EAChB,EAAE,CAAC,kBAAkB,IAAI,EAAE,CAAC,mBAAmB,IAAI,KAAK;oCAC1D,cAAc,EACZ,EAAE,CAAC,cAAc,IAAI,EAAE,CAAC,eAAe,IAAI,EAAE,CAAC,MAAM,IAAI,EAAE;oCAC5D,aAAa,EACX,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC,cAAc,IAAI,SAAS;oCACpD,SAAS,EAAE,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,UAAU,IAAI,SAAS;oCACrD,aAAa,EAAE,EAAE,CAAC,aAAa;iCAChC,CAAC,CAAC;gCACH,eAAe,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC;gCAEvC,IAAI,UAAU,CAAC,kBAAkB,EAAE,CAAC;oCAClC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gCACzC,CAAC;4BACH,CAAC;4BAED,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC;4BAEzD,uDAAuD;4BACvD,MAAM,WAAW,GAAG;gCAClB,eAAe;gCACf,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;gCACpB,MAAM,EAAE,aAAa;6BACtB,CAAC;4BAEF,MAAM,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;gCAC3D,aAAa,EAAE,GAAG,EAAE,uBAAuB;6BAC5C,CAAC,CAAC;4BAEH,kBAAkB,GAAG,IAAI,CAAC;4BAC1B,OAAO,CAAC,KAAK,CACX,sDAAsD,EACtD;gCACE,QAAQ;gCACR,SAAS,EAAE,kBAAkB;gCAC7B,cAAc,EAAE,uBAAuB;6BACxC,CACF,CAAC;wBACJ,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,IAAI,CACV,uCAAuC,EACvC,aAAa,CAAC,MAAM,CACrB,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,kEAAkE;oBAClE,oEAAoE;oBACpE,OAAO,CAAC,IAAI,CACV,gDAAgD,EAChD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;oBACF,wDAAwD;gBAC1D,CAAC;YACH,CAAC;YAED,kBAAkB;YAClB,mEAAmE;YACnE,uFAAuF;YACvF,IAAI,KAAK,GAAQ,IAAI,CAAC;YACtB,IAAI,qBAAqB,GAAG,KAAK,CAAC;YAClC,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACxC,qBAAqB,GAAG,IAAI,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;gBAChE,iEAAiE;gBACjE,kDAAkD;gBAClD,qBAAqB,GAAG,KAAK,CAAC;YAChC,CAAC;YAED,8CAA8C;YAC9C,gGAAgG;YAChG,6BAA6B;YAC7B,6EAA6E;YAC7E,yDAAyD;YACzD,MAAM,OAAO,GAAG,kBAAkB;gBAChC,CAAC,CAAC,IAAI,CAAC,4DAA4D;gBACnE,CAAC,CAAC,qBAAqB;oBACrB,CAAC,CAAC,CAAC,KAAK,CAAC,8DAA8D;oBACvE,CAAC,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,0DAA0D;YAE3F,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;YAC1B,MAAM,WAAW,GAAG,CAAC,CAAC,SAAS,CAAC;YAEhC,gEAAgE;YAChE,iDAAiD;YACjD,IAAI,qBAAqB,IAAI,KAAK,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC1D,OAAO,CAAC,KAAK,CACX,+EAA+E,EAC/E;oBACE,QAAQ;oBACR,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;oBACvC,UAAU,EAAE,QAAQ;oBACpB,YAAY,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM;iBAC9D,CACF,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE;gBACvD,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;gBACvC,SAAS,EAAE,SAAS,IAAI,MAAM;gBAC9B,QAAQ;gBACR,WAAW,EAAE,WAAW,IAAI,MAAM;gBAClC,mBAAmB,EAAE,mBAAmB,IAAI,MAAM;gBAClD,qBAAqB,EAAE,qBAAqB,IAAI,MAAM;gBACtD,QAAQ;gBACR,WAAW;gBACX,aAAa,EAAE,CAAC,CAAC,WAAW;gBAC5B,eAAe,EAAE,CAAC,CAAC,aAAa;gBAChC,OAAO;gBACP,qBAAqB;gBACrB,YAAY,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;aACjE,CAAC,CAAC;YAEH,+EAA+E;YAC/E,wFAAwF;YACxF,wEAAwE;YACxE,uEAAuE;YACvE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC,mBAAmB,CAC7B,iBAAiB,EACjB,6BAA6B,EAC7B,GAAG,EACH;oBACE,aAAa,EAAE,YAAY;oBAC3B,SAAS,EAAE,QAAQ;oBACnB,aAAa,EAAE,WAAW,IAAI,IAAI;oBAClC,SAAS,EAAE,QAAQ;oBACnB,aAAa,EAAE,WAAW;oBAC1B,OAAO,EAAE,OAAO;oBAChB,sBAAsB,EAAE,qBAAqB;iBAC9C,CACF,CAAC;YACJ,CAAC;YAED,yEAAyE;YACzE,mEAAmE;YACnE,IAAI,CAAC,qBAAqB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,CAAC,KAAK,CACX,qEAAqE,EACrE;oBACE,QAAQ;oBACR,QAAQ;iBACT,CACF,CAAC;YACJ,CAAC;YAED,4BAA4B;YAC5B,qFAAqF;YACrF,8EAA8E;YAC9E,MAAM,YAAY,GAQd;gBACF,OAAO,EAAE,kBAAkB;oBACzB,CAAC,CAAC,+CAA+C,uBAAuB,CAAC,MAAM,uBAAuB,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE;oBACpJ,CAAC,CAAC,OAAO;wBACP,CAAC,CAAC,qFAAqF;wBACvF,CAAC,CAAC,qFAAqF;gBAC3F,SAAS,EAAE,QAAQ;gBACnB,UAAU,EAAE,SAAS,IAAI,IAAI;gBAC7B,SAAS,EAAE,QAAQ;gBACnB,aAAa,EAAE,WAAW,IAAI,IAAI;gBAClC,SAAS,EAAE,CAAC,CAAC,MAAM;gBACnB,aAAa,EAAE,CAAC,CAAC,SAAS;gBAC1B,OAAO,EAAE,OAAO,EAAE,mCAAmC;gBACrD,YAAY,EAAE,kBAAkB;gBAChC,oBAAoB,EAAE,kBAAkB;oBACtC,CAAC,CAAC,kBAAkB;oBACpB,CAAC,CAAC,SAAS;gBACb,yBAAyB,EAAE,kBAAkB;oBAC3C,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,SAAS;gBACb,sBAAsB,EAAE,mBAAmB,IAAI,IAAI;gBACnD,wBAAwB,EAAE,qBAAqB,IAAI,IAAI;gBACvD,eAAe,EAAE,CAAC,CAAC,WAAW;gBAC9B,iBAAiB,EAAE,CAAC,CAAC,aAAa;aACnC,CAAC;YAEF,yCAAyC;YACzC,MAAM,WAAW,GAA8C;gBAC7D,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE;oBACR,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE;oBAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC;aACF,CAAC;YAEF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;gBAC/C,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,gBAAgB;iBACpB;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,+CAA+C;YAC/C,MAAM,YAAY,GAAG;gBACnB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC/D,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;gBACrD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBACvD,KAAK,EACH,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,KAAK;oBACnC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;oBACrB,CAAC,CAAC,SAAS;aAChB,CAAC;YAEF,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,YAAY,CAAC,CAAC;YAC9D,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,IAAI,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC;YAE/D,OAAO,IAAI,CAAC,mBAAmB,CAC7B,gBAAgB,EAChB,+BAA+B,EAC/B,GAAG,EACH;gBACE,aAAa,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBACrE,UAAU,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;aAC5D,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/services/approval-route.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Routing and input hygiene for `/consent/approve`.
+ *
+ * SECURITY: `provider_type` decides which identity check an approval goes
+ * through, so it is matched against an allowlist. A value outside it used to
+ * fall through to an unchecked path that minted under a DID looked up from the
+ * caller's own `oauth_identity`, and that labelled the grant with the caller's
+ * `customFields`. Everything that names who signed in, or how, is now set by
+ * the server; the caller only chooses the route.
+ *
+ * Pure functions, no I/O.
+ */
+/**
+ * The checks an approval can go through.
+ * - `credential`: real credential sign-in (`handleCredentialApproval`).
+ * - `clickwrap`: consent-only, or the clickwrap step after a credential or
+ *   OAuth sign-in (the latter two need a signed identity assertion).
+ * - `oauth`: the clickwrap step after OAuth; always needs a signed assertion.
+ */
+export type ApprovalRoute = "credential" | "clickwrap" | "oauth";
+/**
+ * Map a caller's `provider_type` to its route, or `null` when it is missing,
+ * not a string, or not one of the allowed values.
+ *
+ * @example
+ * resolveApprovalRoute(" OAuth2 "); // "oauth"
+ * resolveApprovalRoute("magic_link"); // null
+ */
+export declare function resolveApprovalRoute(raw: unknown): ApprovalRoute | null;
+/** True when `oauth_provider_type` marks a post-OAuth clickwrap. */
+export declare function isPostOAuthMarker(raw: unknown): boolean;
+/** True when `credential_provider_type` marks a post-credential clickwrap. */
+export declare function isPostCredentialMarker(raw: unknown): boolean;
+/**
+ * `customFields` keys the server owns. Checkpoint reads the delegation's
+ * authorization type and provider from these, and the dashboard shows the
+ * user fields, so a caller must never set them.
+ */
+export declare const SERVER_OWNED_CUSTOM_FIELDS: readonly string[];
+/**
+ * Copy a caller's `customFields` without the server-owned keys. Anything that
+ * is not a plain object becomes `{}`.
+ *
+ * @example
+ * stripServerOwnedFields({ note: "hi", provider_type: "oauth" }); // { note: "hi" }
+ */
+export declare function stripServerOwnedFields(customFields: unknown): Record<string, unknown>;
+//# sourceMappingURL=approval-route.d.ts.map