npm - @kya-os/mcp-i-cloudflare - Versions diffs - 1.9.6 → 1.10.0 - Mend

@kya-os/mcp-i-cloudflare 1.9.6 → 1.10.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (122) hide show

package/dist/adapter.d.ts.map +1 -1
package/dist/adapter.js +47 -16
package/dist/adapter.js.map +1 -1
package/dist/agent.d.ts +9 -0
package/dist/agent.d.ts.map +1 -1
package/dist/agent.js +203 -53
package/dist/agent.js.map +1 -1
package/dist/app.d.ts.map +1 -1
package/dist/app.js +86 -3
package/dist/app.js.map +1 -1
package/dist/config.d.ts +54 -0
package/dist/config.d.ts.map +1 -1
package/dist/config.js +58 -0
package/dist/config.js.map +1 -1
package/dist/constants/storage-keys.d.ts +6 -0
package/dist/constants/storage-keys.d.ts.map +1 -1
package/dist/constants/storage-keys.js +6 -0
package/dist/constants/storage-keys.js.map +1 -1
package/dist/delegation-http/anchor-do.d.ts +84 -0
package/dist/delegation-http/anchor-do.d.ts.map +1 -0
package/dist/delegation-http/anchor-do.js +253 -0
package/dist/delegation-http/anchor-do.js.map +1 -0
package/dist/delegation-http/anchor-routing.d.ts +20 -0
package/dist/delegation-http/anchor-routing.d.ts.map +1 -0
package/dist/delegation-http/anchor-routing.js +27 -0
package/dist/delegation-http/anchor-routing.js.map +1 -0
package/dist/delegation-http/bearer-retry.d.ts +54 -0
package/dist/delegation-http/bearer-retry.d.ts.map +1 -0
package/dist/delegation-http/bearer-retry.js +195 -0
package/dist/delegation-http/bearer-retry.js.map +1 -0
package/dist/delegation-http/challenge-middleware.d.ts +28 -0
package/dist/delegation-http/challenge-middleware.d.ts.map +1 -0
package/dist/delegation-http/challenge-middleware.js +190 -0
package/dist/delegation-http/challenge-middleware.js.map +1 -0
package/dist/delegation-http/challenge.d.ts +86 -0
package/dist/delegation-http/challenge.d.ts.map +1 -0
package/dist/delegation-http/challenge.js +173 -0
package/dist/delegation-http/challenge.js.map +1 -0
package/dist/delegation-http/consent-anchor-bridge.d.ts +35 -0
package/dist/delegation-http/consent-anchor-bridge.d.ts.map +1 -0
package/dist/delegation-http/consent-anchor-bridge.js +355 -0
package/dist/delegation-http/consent-anchor-bridge.js.map +1 -0
package/dist/delegation-http/constants.d.ts +51 -0
package/dist/delegation-http/constants.d.ts.map +1 -0
package/dist/delegation-http/constants.js +60 -0
package/dist/delegation-http/constants.js.map +1 -0
package/dist/delegation-http/hash.d.ts +21 -0
package/dist/delegation-http/hash.d.ts.map +1 -0
package/dist/delegation-http/hash.js +92 -0
package/dist/delegation-http/hash.js.map +1 -0
package/dist/delegation-http/pickup-routes.d.ts +42 -0
package/dist/delegation-http/pickup-routes.d.ts.map +1 -0
package/dist/delegation-http/pickup-routes.js +79 -0
package/dist/delegation-http/pickup-routes.js.map +1 -0
package/dist/delegation-http/register.d.ts +19 -0
package/dist/delegation-http/register.d.ts.map +1 -0
package/dist/delegation-http/register.js +72 -0
package/dist/delegation-http/register.js.map +1 -0
package/dist/delegation-http/sid.d.ts +20 -0
package/dist/delegation-http/sid.d.ts.map +1 -0
package/dist/delegation-http/sid.js +32 -0
package/dist/delegation-http/sid.js.map +1 -0
package/dist/delegation-http/types.d.ts +64 -0
package/dist/delegation-http/types.d.ts.map +1 -0
package/dist/delegation-http/types.js +11 -0
package/dist/delegation-http/types.js.map +1 -0
package/dist/helpers/env-mapper.d.ts.map +1 -1
package/dist/helpers/env-mapper.js +24 -0
package/dist/helpers/env-mapper.js.map +1 -1
package/dist/index.d.ts +5 -2
package/dist/index.d.ts.map +1 -1
package/dist/index.js +10 -2
package/dist/index.js.map +1 -1
package/dist/providers/crypto.d.ts +1 -1
package/dist/providers/crypto.d.ts.map +1 -1
package/dist/providers/crypto.js +1 -1
package/dist/providers/crypto.js.map +1 -1
package/dist/providers/kv-identity.d.ts +2 -2
package/dist/providers/kv-identity.d.ts.map +1 -1
package/dist/providers/kv-identity.js +1 -1
package/dist/providers/kv-identity.js.map +1 -1
package/dist/providers/storage.d.ts +1 -1
package/dist/providers/storage.d.ts.map +1 -1
package/dist/providers/storage.js +1 -1
package/dist/providers/storage.js.map +1 -1
package/dist/runtime/audit-logger.d.ts +1 -1
package/dist/runtime/audit-logger.d.ts.map +1 -1
package/dist/runtime/oauth-handler.d.ts.map +1 -1
package/dist/runtime/oauth-handler.js +31 -3
package/dist/runtime/oauth-handler.js.map +1 -1
package/dist/runtime/oidc/authorize-url.d.ts +19 -0
package/dist/runtime/oidc/authorize-url.d.ts.map +1 -0
package/dist/runtime/oidc/authorize-url.js +94 -0
package/dist/runtime/oidc/authorize-url.js.map +1 -0
package/dist/runtime/oidc/token-exchange.d.ts +62 -0
package/dist/runtime/oidc/token-exchange.d.ts.map +1 -0
package/dist/runtime/oidc/token-exchange.js +75 -0
package/dist/runtime/oidc/token-exchange.js.map +1 -0
package/dist/runtime.d.ts +1 -1
package/dist/runtime.d.ts.map +1 -1
package/dist/services/consent-audit.service.d.ts +1 -1
package/dist/services/consent-audit.service.d.ts.map +1 -1
package/dist/services/consent-audit.service.js.map +1 -1
package/dist/services/consent.service.d.ts +2 -2
package/dist/services/consent.service.d.ts.map +1 -1
package/dist/services/consent.service.js +48 -59
package/dist/services/consent.service.js.map +1 -1
package/dist/services/delegation.service.d.ts +9 -0
package/dist/services/delegation.service.d.ts.map +1 -1
package/dist/services/delegation.service.js +21 -7
package/dist/services/delegation.service.js.map +1 -1
package/dist/services/oauth-security.service.d.ts.map +1 -1
package/dist/services/oauth-security.service.js +6 -10
package/dist/services/oauth-security.service.js.map +1 -1
package/dist/services/provider-loader.service.js +1 -1
package/dist/services/provider-loader.service.js.map +1 -1
package/dist/types.d.ts +5 -1
package/dist/types.d.ts.map +1 -1
package/dist/utils/known-clients.d.ts.map +1 -1
package/dist/utils/known-clients.js +19 -10
package/dist/utils/known-clients.js.map +1 -1
package/package.json +3 -1

package/dist/delegation-http/consent-anchor-bridge.js ADDED Viewed

@@ -0,0 +1,355 @@
+/**
+ * draft-kya-http-02 delegation layer — consent → pickup bridge.
+ *
+ * The worker is its own Tier-2 authorization host: the §8.1 challenge points the
+ * caller's user at `consent_uri = /consent?sid=kya-…`, served here. This module is
+ * the route-order interception that `register.ts` wires BEFORE the legacy `/consent`
+ * routes; it only ever handles requests whose query carries an anchor sid (the
+ * `next()` fall-through for everything else lives in `register.ts`), so the legacy
+ * consent service is untouched.
+ *
+ *  - `GET /consent?sid=kya-…` reads the anchor via `INTERNAL_PICKUP_INFO`. An unknown
+ *    sid → 404 page; an expired sid → a "link expired" page; otherwise a minimal
+ *    approve form (the consent-only scope list + a CSRF-protected POST).
+ *  - `POST /consent/approve?sid=kya-…` mints a delegation VC-JWT using the SAME
+ *    `@kya-os/mcp` primitives `consent.service.ts` uses (`wrapDelegationAsVC` →
+ *    `createUnsignedVCJWT` → sign → `completeVCJWT`) — calling them directly here, NOT
+ *    editing the service — then parks it on the anchor via `INTERNAL_PICKUP_APPROVE`.
+ *    If the anchor is gone (DO 410/404) the approval FAILS with an error page and
+ *    mints nothing reachable: consent on an EXPIRED anchor MUST fail.
+ *
+ * @module @kya-os/mcp-i-cloudflare/delegation-http/consent-anchor-bridge
+ */
+import { wrapDelegationAsVC, createUnsignedVCJWT, completeVCJWT, base64urlEncodeFromBytes, generateDidKeyFromBase64, didKeyFragment, } from "@kya-os/mcp";
+import { WebCryptoProvider } from "../providers/crypto";
+import { escapeHtml } from "../services/consent-templates/base/escape";
+import { getAnchorStub } from "./anchor-routing";
+import { INTERNAL_PICKUP_INFO, INTERNAL_PICKUP_APPROVE } from "./constants";
+/** Internal origin for durable-object stub fetches — the DO routes by pathname only. */
+const DO_INTERNAL_ORIGIN = "https://do.internal";
+/**
+ * POST a JSON body to one of the anchor's `/_internal/pickup/*` routes. Returns the
+ * durable-object response so callers can branch on its status.
+ */
+async function callAnchor(env, sid, internalPath, body) {
+    const stub = getAnchorStub(env, sid);
+    const response = await stub.fetch(new URL(internalPath, DO_INTERNAL_ORIGIN).toString(), {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+    });
+    return response;
+}
+/** An HTML response with the mandated `Cache-Control: no-store`. */
+function htmlResponse(html, status) {
+    return new Response(html, {
+        status,
+        headers: {
+            "Content-Type": "text/html; charset=utf-8",
+            "Cache-Control": "no-store",
+        },
+    });
+}
+/** Minimal self-contained HTML page shell (no external bundle dependency). */
+function page(title, bodyInner) {
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>${escapeHtml(title)}</title>
+</head>
+<body>
+${bodyInner}
+</body>
+</html>`;
+}
+/** "Link expired" page for an anchor past its TTL. */
+function expiredPage() {
+    return htmlResponse(page("Authorization link expired", `<main class="kya-consent-expired">
+<h1>Authorization link expired</h1>
+<p>This authorization request is no longer valid. Please start over to request a new one.</p>
+</main>`), 410);
+}
+/** 404 page for an unknown anchor sid. */
+function notFoundPage() {
+    return htmlResponse(page("Authorization request not found", `<main class="kya-consent-notfound">
+<h1>Authorization request not found</h1>
+<p>We could not find this authorization request. It may have already completed or been cancelled.</p>
+</main>`), 404);
+}
+/** Generic approval-failed page (e.g. the anchor expired between GET and POST). */
+function approvalFailedPage(message, status = 410) {
+    return htmlResponse(page("Authorization failed", `<main class="kya-consent-failed">
+<h1>Authorization failed</h1>
+<p>${escapeHtml(message)}</p>
+</main>`), status);
+}
+/** Success page after a delegation is parked on the anchor. */
+function successPage() {
+    return htmlResponse(page("Authorization complete", `<main class="kya-consent-success">
+<h1>Authorization complete</h1>
+<p>You have authorized the request. You can close this window and return to the application.</p>
+</main>`), 200);
+}
+/**
+ * Render the minimal anchor approve form. Reuses the consent-only scope-list shape
+ * (escaped scope items) and posts to `/consent/approve?sid=…` with a CSRF token.
+ */
+function approveFormPage(sid, info, csrfToken) {
+    const scopeItems = info.requiredScopes.length > 0
+        ? info.requiredScopes
+            .map((s) => `<li class="kya-scope-item">${escapeHtml(s)}</li>`)
+            .join("")
+        : `<li class="kya-scope-item">No specific permissions required.</li>`;
+    return page("Permission Request", `<main class="kya-consent">
+<h1>Authorize delegation</h1>
+<p class="kya-permissions-header">This request needs the following permissions:</p>
+<ul class="kya-permissions-list">${scopeItems}</ul>
+<form method="POST" action="/consent/approve?sid=${encodeURIComponent(sid)}">
+<input type="hidden" name="sid" value="${escapeHtml(sid)}">
+<input type="hidden" name="csrf_token" value="${escapeHtml(csrfToken)}">
+<button type="submit" class="kya-consent-allow">Allow</button>
+</form>
+</main>`);
+}
+// ── CSRF (mirrors consent.service's HMAC token format, bound to the anchor sid) ──
+/** Base64url-encode bytes without padding. */
+function base64UrlEncodeBytes(bytes) {
+    return btoa(String.fromCharCode(...bytes))
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=/g, "");
+}
+/** Base64url-encode a UTF-8 string without padding. */
+function base64UrlEncodeString(value) {
+    return base64UrlEncodeBytes(new TextEncoder().encode(value));
+}
+/** Base64url-decode to a UTF-8 string (re-adding the stripped `=` padding for atob). */
+function base64UrlDecodeString(value) {
+    const b64 = value.replace(/-/g, "+").replace(/_/g, "/");
+    return atob(b64 + "=".repeat((4 - (b64.length % 4)) % 4));
+}
+/**
+ * Compute the domain-separated CSRF HMAC (`csrf:<secret>` key material), matching
+ * `consent.service.ts` so the two never collide on the same secret.
+ */
+async function computeCsrfHmac(secret, data) {
+    const encoder = new TextEncoder();
+    const key = await crypto.subtle.importKey("raw", encoder.encode(`csrf:${secret}`), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    return crypto.subtle.sign("HMAC", key, encoder.encode(data));
+}
+/** Constant-time string comparison to avoid CSRF token timing oracles. */
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return diff === 0;
+}
+/**
+ * Mint a CSRF token bound to the anchor `sid`: `${hmacB64}.${payloadB64}` over
+ * `{ sid, exp }`. Returns a non-validating random token when no secret is configured
+ * (graceful degradation — the form still renders).
+ */
+async function mintCsrfToken(env, sid) {
+    const secret = env.OAUTH_ENCRYPTION_SECRET;
+    if (!secret) {
+        return base64UrlEncodeBytes(crypto.getRandomValues(new Uint8Array(32)));
+    }
+    const exp = Math.floor(Date.now() / 1000) + 600;
+    const payloadB64 = base64UrlEncodeString(JSON.stringify({ sid, exp }));
+    const hmacB64 = base64UrlEncodeBytes(new Uint8Array(await computeCsrfHmac(secret, payloadB64)));
+    return `${hmacB64}.${payloadB64}`;
+}
+/** Validate a CSRF token against the anchor `sid` (HMAC + `sid` binding + expiry). */
+async function validateCsrfToken(env, sid, token) {
+    if (!token)
+        return false;
+    const secret = env.OAUTH_ENCRYPTION_SECRET;
+    if (!secret) {
+        // Fail CLOSED: with no secret we cannot validate the double-submit token, so an
+        // anchor consent-approve POST on this state-changing endpoint must be rejected.
+        // (Inheriting consent.service's legacy "graceful degradation to no-CSRF" is not
+        // acceptable on this new surface.) Set OAUTH_ENCRYPTION_SECRET, or use
+        // MCPI_TEST_CONSENT in an explicit development environment for local testing.
+        console.warn(`[kya-http] OAUTH_ENCRYPTION_SECRET unset; rejecting anchor consent approval (sid=${sid})`);
+        return false;
+    }
+    const dot = token.indexOf(".");
+    if (dot === -1)
+        return false;
+    const hmacB64 = token.substring(0, dot);
+    const payloadB64 = token.substring(dot + 1);
+    try {
+        const payload = JSON.parse(base64UrlDecodeString(payloadB64));
+        if (payload.sid !== sid)
+            return false;
+        if (typeof payload.exp === "number" &&
+            payload.exp < Math.floor(Date.now() / 1000)) {
+            return false;
+        }
+        const expectedB64 = base64UrlEncodeBytes(new Uint8Array(await computeCsrfHmac(secret, payloadB64)));
+        return constantTimeEqual(hmacB64, expectedB64);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether CSRF is relaxed for local/miniflare testing. Requires BOTH
+ * `MCPI_TEST_CONSENT === "true"` AND an explicit development environment (W3): the
+ * flag alone must NEVER disable CSRF on a production/default deployment.
+ */
+function isTestConsentMode(env) {
+    // `MCPI_TEST_CONSENT` / `ENVIRONMENT` are deploy-time vars not declared on the
+    // strict CloudflareEnv interface (mirrors config.ts reading `MCPI_HTTP_CHALLENGE`).
+    const bag = env;
+    if (String(bag.MCPI_TEST_CONSENT) !== "true")
+        return false;
+    // Fail closed: only an explicit development environment may relax CSRF. Production,
+    // staging, unset, and empty all keep CSRF enforced.
+    const environment = String(bag.ENVIRONMENT ?? bag.MCPI_ENV ?? "").toLowerCase();
+    return environment === "development";
+}
+// ── VC-JWT minting (same primitive chain as consent.service.issueDelegationVC) ──
+/**
+ * Mint a delegation VC-JWT for an approved anchor. Generates an ephemeral did:key
+ * holder, wraps a delegation record as a VC, and signs it — exactly the primitive
+ * chain `consent.service.ts` uses, called here directly (the service is a hot file
+ * and is never edited).
+ */
+async function mintDelegationVcJwt(env, sid, info, expiresInS) {
+    const cryptoProvider = new WebCryptoProvider();
+    const rawKeyPair = await cryptoProvider.generateKeyPair();
+    const userDid = generateDidKeyFromBase64(rawKeyPair.publicKey);
+    const keyId = `${userDid}#${didKeyFragment(userDid)}`;
+    // Subject (the agent the delegation is granted to). The anchor does not carry the
+    // agent DID, so fall back to the worker's configured agent DID when present; the
+    // holder did is the issuer either way.
+    const agentDid = env.MCP_IDENTITY_AGENT_DID || userDid;
+    const nowS = Math.floor(Date.now() / 1000);
+    const delegation = {
+        id: `urn:uuid:${sid}`,
+        issuerDid: userDid,
+        subjectDid: agentDid,
+        vcId: `urn:uuid:${sid}`,
+        constraints: {
+            scopes: info.requiredScopes,
+            notBefore: nowS,
+            notAfter: nowS + expiresInS,
+        },
+        signature: "",
+        status: "active",
+        createdAt: nowS,
+    };
+    const unsignedVC = wrapDelegationAsVC(delegation, {
+        id: `urn:uuid:${sid}`,
+        issuanceDate: new Date().toISOString(),
+    });
+    const vcWithIssuer = { ...unsignedVC, issuer: userDid };
+    const { signingInput } = createUnsignedVCJWT(vcWithIssuer, { keyId });
+    const signatureBytes = await cryptoProvider.sign(new TextEncoder().encode(signingInput), rawKeyPair.privateKey);
+    const signature = base64urlEncodeFromBytes(signatureBytes);
+    return completeVCJWT(signingInput, signature);
+}
+// ── Public handlers ──────────────────────────────────────────────────────────
+/**
+ * Render the anchor consent surface for `GET /consent?sid=kya-…`.
+ */
+export async function handleAnchorConsentGet(c, sid, env, _cfg) {
+    const infoResponse = await callAnchor(env, sid, INTERNAL_PICKUP_INFO, {
+        sid,
+    });
+    if (infoResponse.status === 404)
+        return notFoundPage();
+    if (infoResponse.status === 410)
+        return expiredPage();
+    if (!infoResponse.ok) {
+        return approvalFailedPage("This authorization request could not be loaded. Please start over.", 502);
+    }
+    const info = (await infoResponse.json());
+    const csrfToken = await mintCsrfToken(env, sid);
+    return htmlResponse(approveFormPage(sid, info, csrfToken), 200);
+}
+/**
+ * Handle anchor approval for `POST /consent/approve?sid=kya-…`. Mints a VC-JWT and
+ * parks it on the anchor; an expired/unknown anchor makes the approval FAIL.
+ */
+export async function handleAnchorConsentApprove(c, sid, env, cfg) {
+    // CSRF, unless test mode relaxes it for miniflare POSTs.
+    if (!isTestConsentMode(env)) {
+        const csrfToken = await readCsrfTokenFromBody(c);
+        const valid = await validateCsrfToken(env, sid, csrfToken);
+        if (!valid) {
+            return htmlResponse(page("Authorization failed", `<main class="kya-consent-failed"><h1>Authorization failed</h1><p>Invalid or missing security token. Please reload and try again.</p></main>`), 403);
+        }
+    }
+    // Read the anchor first: if it is already gone, fail BEFORE minting anything.
+    const infoResponse = await callAnchor(env, sid, INTERNAL_PICKUP_INFO, {
+        sid,
+    });
+    if (infoResponse.status === 404)
+        return notFoundPage();
+    if (infoResponse.status === 410) {
+        return approvalFailedPage("This authorization request has expired. Nothing was authorized.");
+    }
+    if (!infoResponse.ok) {
+        return approvalFailedPage("This authorization request could not be loaded. Please start over.", 502);
+    }
+    const info = (await infoResponse.json());
+    let vcJwt;
+    try {
+        vcJwt = await mintDelegationVcJwt(env, sid, info, cfg.delegationExpiresInS);
+    }
+    catch (error) {
+        // A mint failure (keygen/sign) must surface as a styled no-store error page, not
+        // an unhandled throw that escapes to a bare 500 — and must park nothing (we fail
+        // before the INTERNAL_PICKUP_APPROVE call below).
+        console.warn(`[kya-http] delegation mint failed (sid=${sid}):`, error instanceof Error ? error.message : String(error));
+        return approvalFailedPage("We could not complete the authorization. Please start over.", 500);
+    }
+    const approveResponse = await callAnchor(env, sid, INTERNAL_PICKUP_APPROVE, {
+        sid,
+        vcJwt,
+        expiresInS: cfg.delegationExpiresInS,
+    });
+    // Consent on an EXPIRED (410) or unknown (404) anchor MUST fail and mint nothing
+    // reachable — the minted JWT is never returned to the caller in that case.
+    if (approveResponse.status === 410) {
+        return approvalFailedPage("This authorization request expired before it could be completed. Nothing was authorized.");
+    }
+    if (approveResponse.status === 404)
+        return notFoundPage();
+    if (!approveResponse.ok) {
+        return approvalFailedPage("We could not complete the authorization. Please start over.", 502);
+    }
+    return successPage();
+}
+/**
+ * Read the `csrf_token` form field from the POST body via the underlying native
+ * Request (`c.req.raw`). The sid travels in the query, so consuming the body here
+ * never interferes with route-order interception. Returns undefined on parse failure.
+ */
+async function readCsrfTokenFromBody(c) {
+    const raw = c.req?.raw;
+    if (!raw)
+        return undefined;
+    try {
+        const contentType = raw.headers.get("Content-Type") || "";
+        if (contentType.includes("application/json")) {
+            const body = (await raw.clone().json());
+            const token = body?.csrf_token;
+            return typeof token === "string" ? token : undefined;
+        }
+        const form = await raw.clone().formData();
+        const token = form.get("csrf_token");
+        return typeof token === "string" ? token : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=consent-anchor-bridge.js.map

package/dist/delegation-http/consent-anchor-bridge.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"consent-anchor-bridge.js","sourceRoot":"","sources":["../../src/delegation-http/consent-anchor-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,wBAAwB,EACxB,cAAc,GAEf,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,2CAA2C,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE5E,wFAAwF;AACxF,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAqBjD;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,GAAkB,EAClB,GAAW,EACX,YAAoB,EACpB,IAAa;IAEb,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,IAAI,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,EACpD;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CACF,CAAC;IACF,OAAO,QAA0C,CAAC;AACpD,CAAC;AAED,oEAAoE;AACpE,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,IAAI,CAAC,KAAa,EAAE,SAAiB;IAC5C,OAAO;;;;;SAKA,UAAU,CAAC,KAAK,CAAC;;;EAGxB,SAAS;;QAEH,CAAC;AACT,CAAC;AAED,sDAAsD;AACtD,SAAS,WAAW;IAClB,OAAO,YAAY,CACjB,IAAI,CACF,4BAA4B,EAC5B;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,0CAA0C;AAC1C,SAAS,YAAY;IACnB,OAAO,YAAY,CACjB,IAAI,CACF,iCAAiC,EACjC;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,kBAAkB,CAAC,OAAe,EAAE,MAAM,GAAG,GAAG;IACvD,OAAO,YAAY,CACjB,IAAI,CACF,sBAAsB,EACtB;;KAED,UAAU,CAAC,OAAO,CAAC;QAChB,CACH,EACD,MAAM,CACP,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,SAAS,WAAW;IAClB,OAAO,YAAY,CACjB,IAAI,CACF,wBAAwB,EACxB;;;QAGE,CACH,EACD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,GAAW,EACX,IAAgB,EAChB,SAAiB;IAEjB,MAAM,UAAU,GACd,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QAC5B,CAAC,CAAC,IAAI,CAAC,cAAc;aAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;aAC9D,IAAI,CAAC,EAAE,CAAC;QACb,CAAC,CAAC,mEAAmE,CAAC;IAE1E,OAAO,IAAI,CACT,oBAAoB,EACpB;;;mCAG+B,UAAU;mDACM,kBAAkB,CAAC,GAAG,CAAC;yCACjC,UAAU,CAAC,GAAG,CAAC;gDACR,UAAU,CAAC,SAAS,CAAC;;;QAG7D,CACL,CAAC;AACJ,CAAC;AAED,oFAAoF;AAEpF,8CAA8C;AAC9C,SAAS,oBAAoB,CAAC,KAAiB;IAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACvC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,uDAAuD;AACvD,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,oBAAoB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,wFAAwF;AACxF,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,QAAQ,MAAM,EAAE,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,0EAA0E;AAC1E,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,GAAW;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;IAChD,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,oBAAoB,CAClC,IAAI,UAAU,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAC1D,CAAC;IACF,OAAO,GAAG,OAAO,IAAI,UAAU,EAAE,CAAC;AACpC,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,iBAAiB,CAC9B,GAAkB,EAClB,GAAW,EACX,KAAyB;IAEzB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,gFAAgF;QAChF,gFAAgF;QAChF,gFAAgF;QAChF,uEAAuE;QACvE,8EAA8E;QAC9E,OAAO,CAAC,IAAI,CACV,oFAAoF,GAAG,GAAG,CAC3F,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAG3D,CAAC;QACF,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACtC,IACE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC3C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,WAAW,GAAG,oBAAoB,CACtC,IAAI,UAAU,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAC1D,CAAC;QACF,OAAO,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAkB;IAC3C,+EAA+E;IAC/E,oFAAoF;IACpF,MAAM,GAAG,GAAG,GAAyC,CAAC;IACtD,IAAI,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC3D,oFAAoF;IACpF,oDAAoD;IACpD,MAAM,WAAW,GAAG,MAAM,CACxB,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CACtC,CAAC,WAAW,EAAE,CAAC;IAChB,OAAO,WAAW,KAAK,aAAa,CAAC;AACvC,CAAC;AAED,mFAAmF;AAEnF;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAChC,GAAkB,EAClB,GAAW,EACX,IAAgB,EAChB,UAAkB;IAElB,MAAM,cAAc,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,eAAe,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,wBAAwB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,GAAG,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;IAEtD,kFAAkF;IAClF,iFAAiF;IACjF,uCAAuC;IACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC;IAEvD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAqB;QACnC,EAAE,EAAE,YAAY,GAAG,EAAE;QACrB,SAAS,EAAE,OAAO;QAClB,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,YAAY,GAAG,EAAE;QACvB,WAAW,EAAE;YACX,MAAM,EAAE,IAAI,CAAC,cAAc;YAC3B,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,IAAI,GAAG,UAAU;SAC5B;QACD,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,EAAE;QAChD,EAAE,EAAE,YAAY,GAAG,EAAE;QACrB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACvC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAExD,MAAM,EAAE,YAAY,EAAE,GAAG,mBAAmB,CAC1C,YAAuC,EACvC,EAAE,KAAK,EAAE,CACV,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,IAAI,CAC9C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EACtC,UAAU,CAAC,UAAU,CACtB,CAAC;IACF,MAAM,SAAS,GAAG,wBAAwB,CAAC,cAAc,CAAC,CAAC;IAE3D,OAAO,aAAa,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,CAAc,EACd,GAAW,EACX,GAAkB,EAClB,IAAmC;IAEnC,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE;QACpE,GAAG;KACJ,CAAC,CAAC;IAEH,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,EAAE,CAAC;IACtD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,kBAAkB,CACvB,oEAAoE,EACpE,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAe,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,YAAY,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,CAAc,EACd,GAAW,EACX,GAAkB,EAClB,GAAkC;IAElC,yDAAyD;IACzD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,YAAY,CACjB,IAAI,CACF,sBAAsB,EACtB,6IAA6I,CAC9I,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE;QACpE,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAChC,OAAO,kBAAkB,CACvB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,kBAAkB,CACvB,oEAAoE,EACpE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAe,CAAC;IAEvD,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iFAAiF;QACjF,iFAAiF;QACjF,kDAAkD;QAClD,OAAO,CAAC,IAAI,CACV,0CAA0C,GAAG,IAAI,EACjD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACF,OAAO,kBAAkB,CACvB,6DAA6D,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,EAAE;QAC1E,GAAG;QACH,KAAK;QACL,UAAU,EAAE,GAAG,CAAC,oBAAoB;KACrC,CAAC,CAAC;IAEH,iFAAiF;IACjF,2EAA2E;IAC3E,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACnC,OAAO,kBAAkB,CACvB,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,YAAY,EAAE,CAAC;IAC1D,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;QACxB,OAAO,kBAAkB,CACvB,6DAA6D,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAClC,CAAc;IAEd,MAAM,GAAG,GAAI,CAA4C,CAAC,GAAG,EAAE,GAAG,CAAC;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAA4B,CAAC;YACnE,MAAM,KAAK,GAAG,IAAI,EAAE,UAAU,CAAC;YAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACvD,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/delegation-http/constants.d.ts ADDED Viewed

@@ -0,0 +1,51 @@
+/**
+ * draft-kya-http-02 delegation layer — frozen constants.
+ *
+ * Wire contract source of truth: the vendored golden fixtures under
+ * `src/__tests__/fixtures/kya-http/`. These values are byte-significant for §8.1
+ * challenges, §8.2 worker-served pickup, and the §9 error registry. Do not edit
+ * without re-vendoring the fixtures from checkpoint.
+ *
+ * @module @kya-os/mcp-i-cloudflare/delegation-http/constants
+ */
+/** Worker-served pickup endpoint (§8.2). Hono route pattern with a `:sid` param. */
+export declare const PICKUP_ROUTE = "/api/delegation/pickup/:sid";
+/**
+ * Consent surface. The legacy consent service owns this path; the kya-http bridge
+ * only intercepts requests carrying an anchor sid (`?sid=kya-…`) and otherwise
+ * falls through with `next()`.
+ */
+export declare const CONSENT_ROUTE = "/consent";
+/** Raw pickup-token header for token-path holders (hashed before storage). */
+export declare const PICKUP_TOKEN_HEADER = "X-KYA-Pickup-Token";
+/** Fallback delegation header used when `Authorization` is occupied by an OAuth bearer. */
+export declare const FALLBACK_DELEGATION_HEADER = "KYA-Delegation";
+/**
+ * Param order for the `WWW-Authenticate: Delegation` challenge (§8.1), byte-exact.
+ * Mirrors `challenge.delegation.full.json` → `conformance.param_order`.
+ */
+export declare const CHALLENGE_PARAM_ORDER: readonly ["realm", "sid", "consent_uri", "pickup_uri", "scope", "min_assurance", "interval", "kind"];
+/**
+ * The `kyaos/*` error registry (§9). Every value MUST be present in the vendored
+ * `error-codes.json` (asserted by the contract test). Emitters MUST use these exact
+ * strings.
+ */
+export declare const KYAOS_ERRORS: {
+    readonly authorizationRequired: "kyaos/authorization-required";
+    readonly pickupPinned: "kyaos/pickup-pinned";
+    readonly invalidSession: "kyaos/invalid-session";
+    readonly pickupExpired: "kyaos/pickup-expired";
+    readonly expired: "kyaos/expired";
+    readonly chainBroken: "kyaos/chain-broken";
+    readonly scopeInsufficient: "kyaos/scope-insufficient";
+};
+/**
+ * Internal DO route paths for the pickup-anchor durable object. Dispatched at the
+ * top of `MCPICloudflareAgent.fetch` (see `agent.ts`) and proxied to via
+ * `getAnchorStub(env, sid)`.
+ */
+export declare const INTERNAL_PICKUP_CREATE = "/_internal/pickup/create";
+export declare const INTERNAL_PICKUP_POLL = "/_internal/pickup/poll";
+export declare const INTERNAL_PICKUP_APPROVE = "/_internal/pickup/approve";
+export declare const INTERNAL_PICKUP_INFO = "/_internal/pickup/info";
+//# sourceMappingURL=constants.d.ts.map

package/dist/delegation-http/constants.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/delegation-http/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,oFAAoF;AACpF,eAAO,MAAM,YAAY,gCAAgC,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,aAAa,aAAa,CAAC;AAExC,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,uBAAuB,CAAC;AAExD,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,mBAAmB,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,qBAAqB,sGASxB,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,YAAY;;;;;;;;CAQf,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AACjE,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AACnE,eAAO,MAAM,oBAAoB,2BAA2B,CAAC"}

package/dist/delegation-http/constants.js ADDED Viewed

@@ -0,0 +1,60 @@
+/**
+ * draft-kya-http-02 delegation layer — frozen constants.
+ *
+ * Wire contract source of truth: the vendored golden fixtures under
+ * `src/__tests__/fixtures/kya-http/`. These values are byte-significant for §8.1
+ * challenges, §8.2 worker-served pickup, and the §9 error registry. Do not edit
+ * without re-vendoring the fixtures from checkpoint.
+ *
+ * @module @kya-os/mcp-i-cloudflare/delegation-http/constants
+ */
+/** Worker-served pickup endpoint (§8.2). Hono route pattern with a `:sid` param. */
+export const PICKUP_ROUTE = "/api/delegation/pickup/:sid";
+/**
+ * Consent surface. The legacy consent service owns this path; the kya-http bridge
+ * only intercepts requests carrying an anchor sid (`?sid=kya-…`) and otherwise
+ * falls through with `next()`.
+ */
+export const CONSENT_ROUTE = "/consent";
+/** Raw pickup-token header for token-path holders (hashed before storage). */
+export const PICKUP_TOKEN_HEADER = "X-KYA-Pickup-Token";
+/** Fallback delegation header used when `Authorization` is occupied by an OAuth bearer. */
+export const FALLBACK_DELEGATION_HEADER = "KYA-Delegation";
+/**
+ * Param order for the `WWW-Authenticate: Delegation` challenge (§8.1), byte-exact.
+ * Mirrors `challenge.delegation.full.json` → `conformance.param_order`.
+ */
+export const CHALLENGE_PARAM_ORDER = [
+    "realm",
+    "sid",
+    "consent_uri",
+    "pickup_uri",
+    "scope",
+    "min_assurance",
+    "interval",
+    "kind",
+];
+/**
+ * The `kyaos/*` error registry (§9). Every value MUST be present in the vendored
+ * `error-codes.json` (asserted by the contract test). Emitters MUST use these exact
+ * strings.
+ */
+export const KYAOS_ERRORS = {
+    authorizationRequired: "kyaos/authorization-required",
+    pickupPinned: "kyaos/pickup-pinned",
+    invalidSession: "kyaos/invalid-session",
+    pickupExpired: "kyaos/pickup-expired",
+    expired: "kyaos/expired",
+    chainBroken: "kyaos/chain-broken",
+    scopeInsufficient: "kyaos/scope-insufficient",
+};
+/**
+ * Internal DO route paths for the pickup-anchor durable object. Dispatched at the
+ * top of `MCPICloudflareAgent.fetch` (see `agent.ts`) and proxied to via
+ * `getAnchorStub(env, sid)`.
+ */
+export const INTERNAL_PICKUP_CREATE = "/_internal/pickup/create";
+export const INTERNAL_PICKUP_POLL = "/_internal/pickup/poll";
+export const INTERNAL_PICKUP_APPROVE = "/_internal/pickup/approve";
+export const INTERNAL_PICKUP_INFO = "/_internal/pickup/info";
+//# sourceMappingURL=constants.js.map

package/dist/delegation-http/constants.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/delegation-http/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,oFAAoF;AACpF,MAAM,CAAC,MAAM,YAAY,GAAG,6BAA6B,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AAExC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AAExD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,0BAA0B,GAAG,gBAAgB,CAAC;AAE3D;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,OAAO;IACP,KAAK;IACL,aAAa;IACb,YAAY;IACZ,OAAO;IACP,eAAe;IACf,UAAU;IACV,MAAM;CACE,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,qBAAqB,EAAE,8BAA8B;IACrD,YAAY,EAAE,qBAAqB;IACnC,cAAc,EAAE,uBAAuB;IACvC,aAAa,EAAE,sBAAsB;IACrC,OAAO,EAAE,eAAe;IACxB,WAAW,EAAE,oBAAoB;IACjC,iBAAiB,EAAE,0BAA0B;CACrC,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AACjE,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAC7D,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AACnE,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC"}

package/dist/delegation-http/hash.d.ts ADDED Viewed

@@ -0,0 +1,21 @@
+/**
+ * draft-kya-http-02 delegation layer — synchronous SHA-256.
+ *
+ * The §13 pickup-anchor reducers are pure and synchronous (frozen contract:
+ * `reducePoll(...)` returns a plain object, not a `Promise`), yet they must hash the
+ * holder secret so that only its digest — never the raw token/keyid — is ever stored
+ * or compared. The Workers runtime exposes SHA-256 only through the *async*
+ * `crypto.subtle` API, so a synchronous, dependency-free implementation is required
+ * to keep the reducers pure. This is a verbatim FIPS 180-4 SHA-256 over the UTF-8
+ * bytes of the input; it is asserted against the canonical vectors and against
+ * `crypto.subtle.digest` in `anchor-reducer.test.ts`.
+ *
+ * @module @kya-os/mcp-i-cloudflare/delegation-http/hash
+ */
+/**
+ * Compute the lowercase hex SHA-256 digest of a string's UTF-8 bytes.
+ *
+ * Synchronous and pure — safe to call inside the anchor reducers.
+ */
+export declare function sha256Hex(input: string): string;
+//# sourceMappingURL=hash.d.ts.map

package/dist/delegation-http/hash.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../src/delegation-http/hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAsBH;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA2E/C"}

package/dist/delegation-http/hash.js ADDED Viewed

@@ -0,0 +1,92 @@
+/**
+ * draft-kya-http-02 delegation layer — synchronous SHA-256.
+ *
+ * The §13 pickup-anchor reducers are pure and synchronous (frozen contract:
+ * `reducePoll(...)` returns a plain object, not a `Promise`), yet they must hash the
+ * holder secret so that only its digest — never the raw token/keyid — is ever stored
+ * or compared. The Workers runtime exposes SHA-256 only through the *async*
+ * `crypto.subtle` API, so a synchronous, dependency-free implementation is required
+ * to keep the reducers pure. This is a verbatim FIPS 180-4 SHA-256 over the UTF-8
+ * bytes of the input; it is asserted against the canonical vectors and against
+ * `crypto.subtle.digest` in `anchor-reducer.test.ts`.
+ *
+ * @module @kya-os/mcp-i-cloudflare/delegation-http/hash
+ */
+/** FIPS 180-4 §4.2.2 round constants (first 32 bits of the cube roots of the first 64 primes). */
+const K = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
+    0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+    0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
+    0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
+    0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+    0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
+    0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
+    0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+    0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+/** Right-rotate a 32-bit word (`>>> 0` because the left shift can set the sign bit). */
+function ror(x, n) {
+    return ((x >>> n) | (x << (32 - n))) >>> 0;
+}
+/**
+ * Compute the lowercase hex SHA-256 digest of a string's UTF-8 bytes.
+ *
+ * Synchronous and pure — safe to call inside the anchor reducers.
+ */
+export function sha256Hex(input) {
+    const bytes = new TextEncoder().encode(input);
+    const bitLen = bytes.length * 8;
+    // Pad: 0x80, then zeros to 56 mod 64, then the 64-bit big-endian bit length.
+    const withPad = ((bytes.length + 8) >> 6) + 1; // number of 64-byte blocks
+    const padded = new Uint8Array(withPad * 64);
+    padded.set(bytes);
+    padded[bytes.length] = 0x80;
+    // Bit length as 64-bit big-endian (high word is 0 for any realistic input).
+    const dv = new DataView(padded.buffer);
+    dv.setUint32(padded.length - 8, Math.floor(bitLen / 0x100000000));
+    dv.setUint32(padded.length - 4, bitLen >>> 0);
+    // FIPS 180-4 §5.3.3 initial hash value.
+    let h0 = 0x6a09e667, h1 = 0xbb67ae85, h2 = 0x3c6ef372, h3 = 0xa54ff53a, h4 = 0x510e527f, h5 = 0x9b05688c, h6 = 0x1f83d9ab, h7 = 0x5be0cd19;
+    const w = new Uint32Array(64);
+    for (let block = 0; block < padded.length; block += 64) {
+        for (let t = 0; t < 16; t++) {
+            w[t] = dv.getUint32(block + t * 4);
+        }
+        for (let t = 16; t < 64; t++) {
+            const s0 = ror(w[t - 15], 7) ^ ror(w[t - 15], 18) ^ (w[t - 15] >>> 3);
+            const s1 = ror(w[t - 2], 17) ^ ror(w[t - 2], 19) ^ (w[t - 2] >>> 10);
+            w[t] = (w[t - 16] + s0 + w[t - 7] + s1) >>> 0;
+        }
+        let a = h0, b = h1, c = h2, d = h3, e = h4, f = h5, g = h6, h = h7;
+        for (let t = 0; t < 64; t++) {
+            const S1 = ror(e, 6) ^ ror(e, 11) ^ ror(e, 25);
+            const ch = (e & f) ^ (~e & g);
+            const t1 = (h + S1 + ch + K[t] + w[t]) >>> 0;
+            const S0 = ror(a, 2) ^ ror(a, 13) ^ ror(a, 22);
+            const maj = (a & b) ^ (a & c) ^ (b & c);
+            const t2 = (S0 + maj) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = (d + t1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) >>> 0;
+        }
+        h0 = (h0 + a) >>> 0;
+        h1 = (h1 + b) >>> 0;
+        h2 = (h2 + c) >>> 0;
+        h3 = (h3 + d) >>> 0;
+        h4 = (h4 + e) >>> 0;
+        h5 = (h5 + f) >>> 0;
+        h6 = (h6 + g) >>> 0;
+        h7 = (h7 + h) >>> 0;
+    }
+    return [h0, h1, h2, h3, h4, h5, h6, h7]
+        .map((x) => x.toString(16).padStart(8, "0"))
+        .join("");
+}
+//# sourceMappingURL=hash.js.map

package/dist/delegation-http/hash.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"hash.js","sourceRoot":"","sources":["../../src/delegation-http/hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,kGAAkG;AAClG,MAAM,CAAC,GAAG,IAAI,WAAW,CAAC;IACxB,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACtE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;CAC/C,CAAC,CAAC;AAEH,wFAAwF;AACxF,SAAS,GAAG,CAAC,CAAS,EAAE,CAAS;IAC/B,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhC,6EAA6E;IAC7E,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,2BAA2B;IAC1E,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC5B,4EAA4E;IAC5E,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC;IAClE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC;IAE9C,wCAAwC;IACxC,IAAI,EAAE,GAAG,UAAU,EACjB,EAAE,GAAG,UAAU,EACf,EAAE,GAAG,UAAU,EACf,EAAE,GAAG,UAAU,EACf,EAAE,GAAG,UAAU,EACf,EAAE,GAAG,UAAU,EACf,EAAE,GAAG,UAAU,EACf,EAAE,GAAG,UAAU,CAAC;IAElB,MAAM,CAAC,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;IAE9B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QACvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YACtE,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACrE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,EACR,CAAC,GAAG,EAAE,EACN,CAAC,GAAG,EAAE,EACN,CAAC,GAAG,EAAE,EACN,CAAC,GAAG,EAAE,EACN,CAAC,GAAG,EAAE,EACN,CAAC,GAAG,EAAE,EACN,CAAC,GAAG,EAAE,CAAC;QAET,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/C,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9B,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACxC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACpB,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACpB,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACpB,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACpB,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACpB,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACpB,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACpB,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC"}