@kya-os/mcp-i-cloudflare 1.9.7 → 1.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/adapter.d.ts.map +1 -1
- package/dist/adapter.js +47 -16
- package/dist/adapter.js.map +1 -1
- package/dist/agent.d.ts.map +1 -1
- package/dist/agent.js +181 -50
- package/dist/agent.js.map +1 -1
- package/dist/app.d.ts.map +1 -1
- package/dist/app.js +86 -3
- package/dist/app.js.map +1 -1
- package/dist/config.d.ts +54 -0
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js +58 -0
- package/dist/config.js.map +1 -1
- package/dist/constants/storage-keys.d.ts +6 -0
- package/dist/constants/storage-keys.d.ts.map +1 -1
- package/dist/constants/storage-keys.js +6 -0
- package/dist/constants/storage-keys.js.map +1 -1
- package/dist/delegation-http/anchor-do.d.ts +84 -0
- package/dist/delegation-http/anchor-do.d.ts.map +1 -0
- package/dist/delegation-http/anchor-do.js +253 -0
- package/dist/delegation-http/anchor-do.js.map +1 -0
- package/dist/delegation-http/anchor-routing.d.ts +20 -0
- package/dist/delegation-http/anchor-routing.d.ts.map +1 -0
- package/dist/delegation-http/anchor-routing.js +27 -0
- package/dist/delegation-http/anchor-routing.js.map +1 -0
- package/dist/delegation-http/bearer-retry.d.ts +54 -0
- package/dist/delegation-http/bearer-retry.d.ts.map +1 -0
- package/dist/delegation-http/bearer-retry.js +195 -0
- package/dist/delegation-http/bearer-retry.js.map +1 -0
- package/dist/delegation-http/challenge-middleware.d.ts +28 -0
- package/dist/delegation-http/challenge-middleware.d.ts.map +1 -0
- package/dist/delegation-http/challenge-middleware.js +190 -0
- package/dist/delegation-http/challenge-middleware.js.map +1 -0
- package/dist/delegation-http/challenge.d.ts +86 -0
- package/dist/delegation-http/challenge.d.ts.map +1 -0
- package/dist/delegation-http/challenge.js +173 -0
- package/dist/delegation-http/challenge.js.map +1 -0
- package/dist/delegation-http/consent-anchor-bridge.d.ts +35 -0
- package/dist/delegation-http/consent-anchor-bridge.d.ts.map +1 -0
- package/dist/delegation-http/consent-anchor-bridge.js +355 -0
- package/dist/delegation-http/consent-anchor-bridge.js.map +1 -0
- package/dist/delegation-http/constants.d.ts +51 -0
- package/dist/delegation-http/constants.d.ts.map +1 -0
- package/dist/delegation-http/constants.js +60 -0
- package/dist/delegation-http/constants.js.map +1 -0
- package/dist/delegation-http/hash.d.ts +21 -0
- package/dist/delegation-http/hash.d.ts.map +1 -0
- package/dist/delegation-http/hash.js +92 -0
- package/dist/delegation-http/hash.js.map +1 -0
- package/dist/delegation-http/pickup-routes.d.ts +42 -0
- package/dist/delegation-http/pickup-routes.d.ts.map +1 -0
- package/dist/delegation-http/pickup-routes.js +79 -0
- package/dist/delegation-http/pickup-routes.js.map +1 -0
- package/dist/delegation-http/register.d.ts +19 -0
- package/dist/delegation-http/register.d.ts.map +1 -0
- package/dist/delegation-http/register.js +72 -0
- package/dist/delegation-http/register.js.map +1 -0
- package/dist/delegation-http/sid.d.ts +20 -0
- package/dist/delegation-http/sid.d.ts.map +1 -0
- package/dist/delegation-http/sid.js +32 -0
- package/dist/delegation-http/sid.js.map +1 -0
- package/dist/delegation-http/types.d.ts +64 -0
- package/dist/delegation-http/types.d.ts.map +1 -0
- package/dist/delegation-http/types.js +11 -0
- package/dist/delegation-http/types.js.map +1 -0
- package/dist/helpers/env-mapper.d.ts.map +1 -1
- package/dist/helpers/env-mapper.js +24 -0
- package/dist/helpers/env-mapper.js.map +1 -1
- package/dist/index.d.ts +5 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +10 -2
- package/dist/index.js.map +1 -1
- package/dist/providers/crypto.d.ts +1 -1
- package/dist/providers/crypto.d.ts.map +1 -1
- package/dist/providers/crypto.js +1 -1
- package/dist/providers/crypto.js.map +1 -1
- package/dist/providers/kv-identity.d.ts +2 -2
- package/dist/providers/kv-identity.d.ts.map +1 -1
- package/dist/providers/kv-identity.js +1 -1
- package/dist/providers/kv-identity.js.map +1 -1
- package/dist/providers/storage.d.ts +1 -1
- package/dist/providers/storage.d.ts.map +1 -1
- package/dist/providers/storage.js +1 -1
- package/dist/providers/storage.js.map +1 -1
- package/dist/runtime/audit-logger.d.ts +1 -1
- package/dist/runtime/audit-logger.d.ts.map +1 -1
- package/dist/runtime/oauth-handler.d.ts.map +1 -1
- package/dist/runtime/oauth-handler.js +31 -3
- package/dist/runtime/oauth-handler.js.map +1 -1
- package/dist/runtime/oidc/authorize-url.d.ts +19 -0
- package/dist/runtime/oidc/authorize-url.d.ts.map +1 -0
- package/dist/runtime/oidc/authorize-url.js +94 -0
- package/dist/runtime/oidc/authorize-url.js.map +1 -0
- package/dist/runtime/oidc/token-exchange.d.ts +62 -0
- package/dist/runtime/oidc/token-exchange.d.ts.map +1 -0
- package/dist/runtime/oidc/token-exchange.js +75 -0
- package/dist/runtime/oidc/token-exchange.js.map +1 -0
- package/dist/runtime.d.ts +1 -1
- package/dist/runtime.d.ts.map +1 -1
- package/dist/services/consent-audit.service.d.ts +1 -1
- package/dist/services/consent-audit.service.d.ts.map +1 -1
- package/dist/services/consent-audit.service.js.map +1 -1
- package/dist/services/consent.service.d.ts +2 -2
- package/dist/services/consent.service.d.ts.map +1 -1
- package/dist/services/consent.service.js +39 -50
- package/dist/services/consent.service.js.map +1 -1
- package/dist/services/delegation.service.d.ts +9 -0
- package/dist/services/delegation.service.d.ts.map +1 -1
- package/dist/services/delegation.service.js +21 -7
- package/dist/services/delegation.service.js.map +1 -1
- package/dist/services/oauth-security.service.d.ts.map +1 -1
- package/dist/services/oauth-security.service.js +6 -10
- package/dist/services/oauth-security.service.js.map +1 -1
- package/dist/services/provider-loader.service.js +1 -1
- package/dist/services/provider-loader.service.js.map +1 -1
- package/dist/types.d.ts +5 -1
- package/dist/types.d.ts.map +1 -1
- package/dist/utils/known-clients.d.ts.map +1 -1
- package/dist/utils/known-clients.js +19 -10
- package/dist/utils/known-clients.js.map +1 -1
- package/package.json +3 -1
|
@@ -0,0 +1,62 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Provider-direct OIDC token exchange (C2 PR-4, #2916).
|
|
3
|
+
*
|
|
4
|
+
* Re-homes the direct-PKCE authorization-code → token exchange out of the OLD
|
|
5
|
+
* @kya-os/mcp-i-core OAuthService and into the product layer, composing the DIF
|
|
6
|
+
* request shape.
|
|
7
|
+
*
|
|
8
|
+
* DIF (`@kya-os/mcp@1.6.1`) performs this exchange inside
|
|
9
|
+
* `GenericOidcAdapter.verifyAuthorization`, where the PKCE verifier is held in an
|
|
10
|
+
* in-memory Map — unusable across stateless Cloudflare Worker requests, where the
|
|
11
|
+
* verifier is persisted in the OAuth `state` / KV instead. There is no standalone
|
|
12
|
+
* pure export to call, so `buildTokenExchangeBody` / `exchangeAuthorizationCode`
|
|
13
|
+
* mirror `verifyAuthorization`'s request byte-for-byte (asserted against the REAL
|
|
14
|
+
* adapter in `__tests__/parity/oidc-token-exchange-parity.test.ts`). When DIF
|
|
15
|
+
* ships a pure `exchangeAuthorizationCode`, this becomes a mechanical re-export.
|
|
16
|
+
*
|
|
17
|
+
* DIF FOLLOW-UP (deferred, not in PR-4): extract a pure
|
|
18
|
+
* `exchangeAuthorizationCode()` in decentralized-identity/kya-os-mcp so this file
|
|
19
|
+
* can delegate instead of mirror. Tracked in the PR description.
|
|
20
|
+
*
|
|
21
|
+
* `toIdpTokens` is the product-side IDP-token-lifecycle projection (it owns the
|
|
22
|
+
* GitHub "200 with error body" quirk and expiry computation, which DIF does not
|
|
23
|
+
* model) and is preserved byte-for-byte from the OLD OAuthService mapping.
|
|
24
|
+
*/
|
|
25
|
+
import type { FetchImpl } from "@kya-os/mcp/authz";
|
|
26
|
+
import type { IdpTokens } from "@kya-os/contracts/config";
|
|
27
|
+
/** The authorization-code exchange request (RFC 6749 §4.1.3, PKCE RFC 7636). */
|
|
28
|
+
export interface TokenExchangeRequest {
|
|
29
|
+
code: string;
|
|
30
|
+
redirectUri: string;
|
|
31
|
+
clientId: string;
|
|
32
|
+
codeVerifier: string;
|
|
33
|
+
/** RFC 8707 resource indicator (optional; absent on the AgentShield path). */
|
|
34
|
+
resource?: string;
|
|
35
|
+
/** Present for confidential clients (e.g. GitHub OAuth Apps). */
|
|
36
|
+
clientSecret?: string;
|
|
37
|
+
}
|
|
38
|
+
/**
|
|
39
|
+
* Build the token-exchange request body. Mirrors
|
|
40
|
+
* `GenericOidcAdapter.verifyAuthorization` byte-for-byte: same keys, same order,
|
|
41
|
+
* same conditional `resource` / `client_secret` placement.
|
|
42
|
+
*/
|
|
43
|
+
export declare function buildTokenExchangeBody(request: TokenExchangeRequest): URLSearchParams;
|
|
44
|
+
/**
|
|
45
|
+
* POST the authorization-code exchange to the IdP token endpoint. Mirrors DIF's
|
|
46
|
+
* transport (method, lowercase headers, form-encoded body) and uses the same
|
|
47
|
+
* injectable fetch seam, so the call is fully deterministic under test.
|
|
48
|
+
*/
|
|
49
|
+
export declare function exchangeAuthorizationCode(request: TokenExchangeRequest & {
|
|
50
|
+
tokenEndpoint: string;
|
|
51
|
+
fetchImpl?: FetchImpl;
|
|
52
|
+
}): Promise<Response>;
|
|
53
|
+
/**
|
|
54
|
+
* Project a token-endpoint response into IdpTokens. Product-side IDP-token
|
|
55
|
+
* lifecycle (preserved verbatim from OAuthService.exchangeTokenPKCE):
|
|
56
|
+
* - non-2xx → throw `Token exchange failed: <reason> (<status>)`
|
|
57
|
+
* - GitHub returns OAuth errors with HTTP 200 and an `error` field → throw
|
|
58
|
+
* - missing access_token → throw
|
|
59
|
+
* - default expires_in (3600s) and token_type ("Bearer")
|
|
60
|
+
*/
|
|
61
|
+
export declare function toIdpTokens(response: Response): Promise<IdpTokens>;
|
|
62
|
+
//# sourceMappingURL=token-exchange.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"token-exchange.d.ts","sourceRoot":"","sources":["../../../src/runtime/oidc/token-exchange.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,oBAAoB,GAC5B,eAAe,CAWjB;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,oBAAoB,GAAG;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,GACA,OAAO,CAAC,QAAQ,CAAC,CAWnB;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CA8CxE"}
|
|
@@ -0,0 +1,75 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Build the token-exchange request body. Mirrors
|
|
3
|
+
* `GenericOidcAdapter.verifyAuthorization` byte-for-byte: same keys, same order,
|
|
4
|
+
* same conditional `resource` / `client_secret` placement.
|
|
5
|
+
*/
|
|
6
|
+
export function buildTokenExchangeBody(request) {
|
|
7
|
+
const body = new URLSearchParams({
|
|
8
|
+
grant_type: "authorization_code",
|
|
9
|
+
code: request.code,
|
|
10
|
+
redirect_uri: request.redirectUri,
|
|
11
|
+
client_id: request.clientId,
|
|
12
|
+
code_verifier: request.codeVerifier,
|
|
13
|
+
});
|
|
14
|
+
if (request.resource)
|
|
15
|
+
body.set("resource", request.resource);
|
|
16
|
+
if (request.clientSecret)
|
|
17
|
+
body.set("client_secret", request.clientSecret);
|
|
18
|
+
return body;
|
|
19
|
+
}
|
|
20
|
+
/**
|
|
21
|
+
* POST the authorization-code exchange to the IdP token endpoint. Mirrors DIF's
|
|
22
|
+
* transport (method, lowercase headers, form-encoded body) and uses the same
|
|
23
|
+
* injectable fetch seam, so the call is fully deterministic under test.
|
|
24
|
+
*/
|
|
25
|
+
export async function exchangeAuthorizationCode(request) {
|
|
26
|
+
const fetchImpl = request.fetchImpl ?? ((url, init) => fetch(url, init));
|
|
27
|
+
return fetchImpl(request.tokenEndpoint, {
|
|
28
|
+
method: "POST",
|
|
29
|
+
headers: {
|
|
30
|
+
"content-type": "application/x-www-form-urlencoded",
|
|
31
|
+
accept: "application/json",
|
|
32
|
+
},
|
|
33
|
+
body: buildTokenExchangeBody(request).toString(),
|
|
34
|
+
});
|
|
35
|
+
}
|
|
36
|
+
/**
|
|
37
|
+
* Project a token-endpoint response into IdpTokens. Product-side IDP-token
|
|
38
|
+
* lifecycle (preserved verbatim from OAuthService.exchangeTokenPKCE):
|
|
39
|
+
* - non-2xx → throw `Token exchange failed: <reason> (<status>)`
|
|
40
|
+
* - GitHub returns OAuth errors with HTTP 200 and an `error` field → throw
|
|
41
|
+
* - missing access_token → throw
|
|
42
|
+
* - default expires_in (3600s) and token_type ("Bearer")
|
|
43
|
+
*/
|
|
44
|
+
export async function toIdpTokens(response) {
|
|
45
|
+
if (!response.ok) {
|
|
46
|
+
const errorText = await response.text().catch(() => "Unknown error");
|
|
47
|
+
let errorData;
|
|
48
|
+
try {
|
|
49
|
+
errorData = JSON.parse(errorText);
|
|
50
|
+
}
|
|
51
|
+
catch {
|
|
52
|
+
errorData = { error: errorText };
|
|
53
|
+
}
|
|
54
|
+
const errorMessage = errorData.error_description || errorData.error || errorText;
|
|
55
|
+
throw new Error(`Token exchange failed: ${errorMessage} (${response.status})`);
|
|
56
|
+
}
|
|
57
|
+
const tokens = (await response.json());
|
|
58
|
+
if (tokens.error) {
|
|
59
|
+
throw new Error(`Token exchange failed: ${tokens.error_description || tokens.error}`);
|
|
60
|
+
}
|
|
61
|
+
if (!tokens.access_token) {
|
|
62
|
+
throw new Error("Token response missing access_token");
|
|
63
|
+
}
|
|
64
|
+
const expiresIn = tokens.expires_in || 3600;
|
|
65
|
+
const expiresAt = Date.now() + expiresIn * 1000;
|
|
66
|
+
return {
|
|
67
|
+
access_token: tokens.access_token,
|
|
68
|
+
refresh_token: tokens.refresh_token,
|
|
69
|
+
expires_in: expiresIn,
|
|
70
|
+
expires_at: expiresAt,
|
|
71
|
+
token_type: tokens.token_type || "Bearer",
|
|
72
|
+
scope: tokens.scope,
|
|
73
|
+
};
|
|
74
|
+
}
|
|
75
|
+
//# sourceMappingURL=token-exchange.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"token-exchange.js","sourceRoot":"","sources":["../../../src/runtime/oidc/token-exchange.ts"],"names":[],"mappings":"AAuCA;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA6B;IAE7B,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;KACpC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAGC;IAED,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE;QACtC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;KACjD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAkB;IAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;QACrE,IAAI,SAAyD,CAAC;QAC9D,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,YAAY,GAChB,SAAS,CAAC,iBAAiB,IAAI,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,0BAA0B,YAAY,KAAK,QAAQ,CAAC,MAAM,GAAG,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CASpC,CAAC;IAEF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,0BAA0B,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,KAAK,EAAE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;IAChD,OAAO;QACL,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,QAAQ;QACzC,KAAK,EAAE,MAAM,CAAC,KAAK;KACP,CAAC;AACjB,CAAC"}
|
package/dist/runtime.d.ts
CHANGED
|
@@ -13,7 +13,7 @@ import { CloudflareProofGenerator } from "./proof-generator";
|
|
|
13
13
|
import type { DetachedProof } from "@kya-os/contracts/proof";
|
|
14
14
|
import { type KVNamespace } from "./cache/kv-tool-protection-cache";
|
|
15
15
|
import type { CloudflareRuntimeConfig } from "./config";
|
|
16
|
-
import type { IAuditLogger } from "@kya-os/mcp-i-
|
|
16
|
+
import type { IAuditLogger } from "@kya-os/mcp-i-runtime/runtime/audit-logger";
|
|
17
17
|
import type { AgentIdentity } from "@kya-os/mcp-i-core";
|
|
18
18
|
/**
|
|
19
19
|
* CloudflareRuntime extends MCPIRuntimeBase with CloudflareProofGenerator
|
package/dist/runtime.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,KAAK,2BAA2B,EAChC,uBAAuB,EACvB,aAAa,EACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAEL,KAAK,WAAW,EACjB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,KAAK,2BAA2B,EAChC,uBAAuB,EACvB,aAAa,EACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAEL,KAAK,WAAW,EACjB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAE/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;GAEG;AACH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,iBAAkB,SAAQ,eAAe;IACpD,OAAO,CAAC,cAAc,CAAC,CAA2B;IAClD,OAAO,CAAC,iBAAiB,CAAC,CAAgB;IAC1C,OAAO,CAAC,mBAAmB,CAAC,CAAkB;IAC9C,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,YAAY,CAAC,CAAe;IAEpC,OAAO,CAAC,WAAW,CAAC,CAAe;IAGnC;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB,CAAiC;gBAG9D,MAAM,EAAE,qBAAqB,EAC7B,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,uBAAuB;IAY5C;;OAEG;IACH,uBAAuB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAM/D;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAM/C;;OAEG;IACH,cAAc,IAAI,YAAY,GAAG,SAAS;IAI1C;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAI3C;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA2BjC;;;;;;;;OAQG;IACG,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC;IAgGnE;;;;;;;;;;OAUG;IACG,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,GAAG,EACT,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,EACpC,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,GAAG,CAAC;IAgFf;;OAEG;IACH,iBAAiB,IAAI,wBAAwB,GAAG,SAAS;IAIzD;;;;;;;;;;;;;;;;;OAiBG;IACH,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE;IAI7C;;;;;;;;;;;;OAYG;IACH,4BAA4B,IAAI,IAAI;IAIpC;;;;;OAKG;IACH,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS;IAKtD;;;OAGG;IACH,2BAA2B,IAAI,IAAI;IAInC;;;;OAIG;IACH,YAAY,IAAI,aAAa,GAAG,SAAS;IAIzC;;;;;OAKG;IACH,sBAAsB,IAAI,eAAe,GAAG,SAAS;IAIrD;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,CAAC,eAAe,CACvB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,CAAC,EAAE,GAAG,EACb,WAAW,CAAC,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,MAAM,EAAE,iDAAiD;IACtE,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM;IA6DT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,MAAM,CAAC,2BAA2B,CAChC,EAAE,EAAE,WAAW,EACf,MAAM,EAAE,2BAA2B,GAClC,qBAAqB;CAIzB"}
|
|
@@ -5,7 +5,7 @@
|
|
|
5
5
|
* These events bypass session deduplication to allow multiple events per session.
|
|
6
6
|
*/
|
|
7
7
|
import type { ProofService } from "./proof.service";
|
|
8
|
-
import type { IAuditLogger } from "@kya-os/mcp-i-
|
|
8
|
+
import type { IAuditLogger } from "@kya-os/mcp-i-runtime/runtime/audit-logger";
|
|
9
9
|
import { CloudflareProofGenerator } from "../proof-generator";
|
|
10
10
|
import type { CloudflareRuntimeConfig } from "../config";
|
|
11
11
|
import type { CloudflareRuntime } from "../runtime";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"consent-audit.service.d.ts","sourceRoot":"","sources":["../../src/services/consent-audit.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"consent-audit.service.d.ts","sourceRoot":"","sources":["../../src/services/consent-audit.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAG9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAGpD,qBAAa,mBAAmB;IAS5B,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,OAAO;IAZjB,OAAO,CAAC,MAAM,CAKZ;gBAGQ,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,YAAY,EACzB,cAAc,EAAE,wBAAwB,EACxC,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,iBAAiB;IAGpC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAgB5B;;OAEG;IACG,kBAAkB,CAAC,KAAK,EAAE;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiCjB;;OAEG;IACG,kBAAkB,CAAC,KAAK,EAAE;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,OAAO,CAAC;QACvB,aAAa,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KAC1D,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCjB;;OAEG;IACG,qBAAqB,CAAC,KAAK,EAAE;QACjC,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,IAAI,CAAC;IAwCjB;;OAEG;IACG,oBAAoB,CAAC,KAAK,EAAE;QAChC,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmCjB;;;OAGG;IACG,wBAAwB,CAAC,KAAK,EAAE;QACpC,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiCjB;;;OAGG;IACG,uBAAuB,CAAC,KAAK,EAAE;QACnC,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BjB;;;OAGG;IACG,eAAe,CAAC,KAAK,EAAE;QAC3B,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KACzD,GAAG,OAAO,CAAC,IAAI,CAAC;IAiCjB;;;OAGG;IACG,cAAc,CAAC,KAAK,EAAE;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmCjB;;;;;;;;;OASG;YACW,oBAAoB;IAwDlC;;OAEG;YACW,iBAAiB;CAoBhC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"consent-audit.service.js","sourceRoot":"","sources":["../../src/services/consent-audit.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;
|
|
1
|
+
{"version":3,"file":"consent-audit.service.js","sourceRoot":"","sources":["../../src/services/consent-audit.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH,MAAM,OAAO,mBAAmB;IASpB;IACA;IACA;IACA;IACA;IAZF,MAAM,GAAG;QACf,KAAK,EAAE,CAAC,OAAe,EAAE,IAAyB,EAAE,EAAE;YACpD,OAAO,CAAC,KAAK,CAAC,yBAAyB,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;YACxD,uCAAuC;QACzC,CAAC;KACF,CAAC;IAEF,YACU,YAA0B,EAC1B,WAAyB,EACzB,cAAwC,EACxC,MAA+B,EAC/B,OAA0B,CAAC,wBAAwB;;QAJnD,iBAAY,GAAZ,YAAY,CAAc;QAC1B,gBAAW,GAAX,WAAW,CAAc;QACzB,mBAAc,GAAd,cAAc,CAA0B;QACxC,WAAM,GAAN,MAAM,CAAyB;QAC/B,YAAO,GAAP,OAAO,CAAmB;IACjC,CAAC;IAEJ;;;OAGG;IACK,oBAAoB,CAAC,SAAiB;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,oFAAoF;QACpF,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QAC1C,OAAO;YACL,SAAS;YACT,QAAQ;YACR,KAAK,EAAE,EAAE,EAAE,6CAA6C;YACxD,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,YAAY,EAAE,GAAG;YACjB,UAAU,EAAE,EAAE;YACd,aAAa,EAAE,WAAoB,EAAE,gCAAgC;SACtE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAMxB;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,4BAA4B;QAC7E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,uDAAuD;QACvD,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC9B,SAAS,EAAE,qBAAqB;YAChC,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QAEH,+BAA+B;QAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,qBAAqB,EACrB,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,qBAAqB;gBAChC,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAUxB;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,4BAA4B;QAC7E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,sBAAsB;QACtB,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC9B,SAAS,EAAE,kBAAkB;YAC7B,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QAEH,iBAAiB;QACjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,kBAAkB,EAClB,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,kBAAkB;gBAC7B,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,KAO3B;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,4BAA4B;QAC7E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,sBAAsB;QACtB,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC9B,SAAS,EAAE,6BAA6B;YACxC,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QAEH,iBAAiB;QACjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,6BAA6B,EAC7B,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,6BAA6B;gBACxC,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,gBAAgB,EAAE,UAAU;gBAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;oBAChC,CAAC,CAAC;wBACE,QAAQ,EAAE,KAAK,CAAC,aAAa;wBAC7B,UAAU,EAAE,EAAE;qBACf;oBACH,CAAC,CAAC,SAAS;aACd;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CAAC,KAQ1B;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,4BAA4B;QAC7E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,sBAAsB;QACtB,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC9B,SAAS,EAAE,4BAA4B;YACvC,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QAEH,iBAAiB;QACjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,4BAA4B,EAC5B,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,4BAA4B;gBACvC,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,wBAAwB,CAAC,KAQ9B;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC9B,SAAS,EAAE,yBAAyB;YACpC,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,yBAAyB,EACzB,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,yBAAyB;gBACpC,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,gBAAgB,EAAE,UAAU;aAC7B;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,uBAAuB,CAAC,KAQ7B;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC9B,SAAS,EAAE,wBAAwB;YACnC,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,wBAAwB,EACxB,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,wBAAwB;gBACnC,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,KAQrB;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC9B,SAAS,EAAE,oBAAoB;YAC/B,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,oBAAoB,EACpB,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,oBAAoB;gBAC/B,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,KAQpB;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC9B,SAAS,EAAE,mBAAmB;YAC9B,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC3C,mBAAmB,EACnB,KAAK,EACL,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE;YACzC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,SAAS,EAAE,mBAAmB;gBAC9B,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE;oBACb,QAAQ,EAAE,KAAK,CAAC,aAAa;oBAC7B,UAAU,EAAE,EAAE;iBACf;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,oBAAoB,CAChC,SAAiB,EACjB,KAAU,EACV,SAAiB;QAEjB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEhD,2EAA2E;QAC3E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAE7D,+CAA+C;QAC/C,2EAA2E;QAC3E,MAAM,gBAAgB,GAAG;YACvB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE;gBACN,SAAS;gBACT,SAAS;gBACT,GAAG,KAAK;aACT;SACF,CAAC;QAEF,MAAM,iBAAiB,GAAG;YACxB,IAAI,EAAE;gBACJ,OAAO,EAAE,IAAI;gBACb,SAAS;gBACT,SAAS;gBACT,SAAS,EAAE,QAAQ,CAAC,GAAG;aACxB;SACF,CAAC;QAEF,yDAAyD;QACzD,gFAAgF;QAChF,0CAA0C;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,cAAc,GAAmB;YACrC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,4BAA4B;YACnC,QAAQ,EAAE,wBAAwB;YAClC,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,YAAY,EAAE,GAAG;YACjB,UAAU,EAAE,EAAE;YACd,aAAa,EAAE,WAAoB,EAAE,gCAAgC;SACtE,CAAC;QAEF,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAC5C,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EAAE,kCAAkC;QAClD;YACE,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,8CAA8C;SACzE,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,iBAAiB;QAC7B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;gBACjD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;CACF"}
|
|
@@ -9,8 +9,8 @@
|
|
|
9
9
|
import type { CloudflareEnv } from "../types";
|
|
10
10
|
import type { CloudflareRuntime } from "../runtime";
|
|
11
11
|
import type { OAuthIdentity } from "@kya-os/contracts/consent";
|
|
12
|
-
import { type
|
|
13
|
-
import { type
|
|
12
|
+
import { type DelegationVCVerificationResult, type DelegationRecord } from "@kya-os/mcp";
|
|
13
|
+
import { type UserKeyPair } from "@kya-os/mcp-i-core";
|
|
14
14
|
export declare class ConsentService {
|
|
15
15
|
private configService;
|
|
16
16
|
private renderer;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"consent.service.d.ts","sourceRoot":"","sources":["../../src/services/consent.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"consent.service.d.ts","sourceRoot":"","sources":["../../src/services/consent.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAcpD,OAAO,KAAK,EAIV,aAAa,EACd,MAAM,2BAA2B,CAAC;AAYnC,OAAO,EAYL,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAC;AA2D5B,qBAAa,cAAc;IACzB,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,GAAG,CAAgB;IAC3B,OAAO,CAAC,OAAO,CAAC,CAAoB;IACpC,OAAO,CAAC,cAAc,CAAC,CAAiB;IAGxC,OAAO,CAAC,YAAY,CAAC,CAAsB;IAC3C,OAAO,CAAC,gBAAgB,CAAC,CAAgB;IAGzC,OAAO,CAAC,gBAAgB,CAAC,CAAgD;IACzE,OAAO,CAAC,gBAAgB,CAAC,CAAqD;IAE9E;;;OAGG;gBAED,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,iBAAiB,EAC3B,gBAAgB,CAAC,EAAE,OAAO,oBAAoB,EAAE,gBAAgB,EAChE,gBAAgB,CAAC,EAAE,OAAO,oBAAoB,EAAE,qBAAqB;IAWvE;;;;;;;OAOG;YACW,eAAe;IAmC7B;;;;;;;OAOG;IACG,mBAAmB,CAAC,KAAK,EAAE;QAC/B,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KACzD,GAAG,OAAO,CAAC,IAAI,CAAC;IAMX,kBAAkB,CAAC,KAAK,EAAE;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjB;;;;;;;;;;;;OAYG;IACG,uBAAuB,CAAC,MAAM,EAAE;QACpC,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAW3C;;;;;OAKG;YACW,sBAAsB;IA8CpC;;;;;;;;;;OAUG;YACW,sBAAsB;IAqEpC;;;;;;;;;;;;;;OAcG;IACU,oBAAoB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkFzB;;;;;;;;;;;OAWG;YACW,iCAAiC;IA0D/C;;;;;;;;;OASG;IACU,yBAAyB,CACpC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,IAAI,CAAC;IAuIhB;;;;;;;;;OASG;IACU,oBAAoB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAsE9B;;;;;;;;;;;;;;OAcG;IACU,yBAAyB,CACpC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IA0F9B;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IAInC;;;;;;;;;;;;;OAaG;IACU,kCAAkC,CAC7C,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAmGzB;;;;;;;;;;;;;OAaG;IACU,iBAAiB,CAC5B,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,EACpC,eAAe,CAAC,EAAE,WAAW,GAAG,IAAI,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA4DzB;;;;;;;;;;;;;;;;OAgBG;IACU,kBAAkB,CAC7B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QACR,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GACA,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC;IAsJjD;;;;;;;;;;;;OAYG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,EAC7B,iBAAiB,CAAC,EAAE,MAAM,EAC1B,cAAc,CAAC,EAAE,OAAO,mCAAmC,EAAE,cAAc,GAC1E,OAAO,CAAC,OAAO,CAAC;IA+HnB;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EAAE,EAChB,SAAS,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,6DAA6D;IAChF,oBAAoB,CAAC,EAAE,OAAO,0BAA0B,EAAE,oBAAoB,EAC9E,SAAS,CAAC,EAAE,MAAM,EAAE,sDAAsD;IAC1E,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC;IAkQlB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IAuB3B;;;;;;;;;;;OAWG;IACG,kBAAkB,CACtB,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC;IAyElB;;;;;;;;;;OAUG;IACG,oBAAoB,CACxB,aAAa,EAAE,aAAa,EAC5B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAgFhB;;;;;;;;;;OAUG;IACG,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAgCjD;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IAe1B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,8BAA8B;IAYtC;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAetB;;;;;;;;;;;;;OAaG;YACW,iBAAiB;IAu0B/B;;;;;;;;OAQG;YACW,gBAAgB;IA2lC9B;;;;;;;;OAQG;YACW,cAAc;IAqd5B;;;;;OAKG;YACW,gBAAgB;IA4S9B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAQ7B;;;;;;;;;OASG;YACW,oBAAoB;IA+DlC;;;;;;;;;;;;OAYG;YACW,oBAAoB;IA2ElC;;;;;OAKG;YACW,iBAAiB;IAmC/B;;;;OAIG;YACW,sBAAsB;IA4FpC;;;;;;;;;OASG;YACW,wBAAwB;IA8etC;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IA2BnB;;;;;;;OAOG;YACW,2BAA2B;IAkGzC;;;;;;;;;OASG;IACH,OAAO,CAAC,2BAA2B;IA4GnC;;OAEG;YACW,yBAAyB;IAsDvC;;OAEG;YACW,oBAAoB;IAmDlC;;;;;;;;;;;OAWG;YACW,2BAA2B;IAmDzC;;;;;;;;;OASG;IACU,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuBzE;;;;;OAKG;YACW,eAAe;IAgB7B;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAO7B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAK7B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;OAEG;YACW,sBAAsB;IAmJpC;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IAMnB;;;;;;;;;OASG;IACH,OAAO,CAAC,4BAA4B;IAqLpC;;OAEG;YACW,UAAU;IAqDxB;;;;;OAKG;YACW,WAAW;IA0GzB;;OAEG;YACW,qBAAqB;CAsBpC"}
|
|
@@ -11,10 +11,11 @@ import { TemplateRenderer } from "./consent-templates/template-renderer";
|
|
|
11
11
|
import { DEFAULT_AGENTSHIELD_URL, DEFAULT_SESSION_CACHE_TTL, KEY_PAIR_TTL_SECONDS, CONSENT_PROVIDER_TYPES, } from "../constants";
|
|
12
12
|
import { STORAGE_KEYS } from "../constants/storage-keys";
|
|
13
13
|
import { loadDay0Config, getDelegationFieldName } from "../utils/day0-config";
|
|
14
|
+
import { buildProviderAuthorizeUrl } from "../runtime/oidc/authorize-url.js";
|
|
14
15
|
import { validateConsentApprovalRequest, } from "@kya-os/contracts/consent";
|
|
15
16
|
import { AGENTSHIELD_ENDPOINTS, createDelegationAPIResponseSchema, createDelegationResponseSchema, } from "@kya-os/contracts/agentshield-api";
|
|
16
|
-
import {
|
|
17
|
-
import {
|
|
17
|
+
import { createUnsignedVCJWT, completeVCJWT, parseVCJWT, generateDidKeyFromBase64, createDelegationVerifier, createDidKeyResolver, logger, base64urlEncodeFromBytes, base64urlDecodeToBytes, bytesToBase64, wrapDelegationAsVC, } from "@kya-os/mcp";
|
|
18
|
+
import { fetchRemoteConfig, } from "@kya-os/mcp-i-core"; // product-layer symbols stay on OLD (C2 #2918)
|
|
18
19
|
import { WebCryptoProvider } from "../providers/crypto";
|
|
19
20
|
import { ConsentAuditService } from "./consent-audit.service";
|
|
20
21
|
import { CloudflareProofGenerator } from "../proof-generator";
|
|
@@ -22,7 +23,7 @@ import { ProofService } from "./proof.service";
|
|
|
22
23
|
import { createCredentialAuthHandler } from "./credential-auth.handler";
|
|
23
24
|
import { IdpTokenStorage } from "./idp-token-storage";
|
|
24
25
|
import { OAuthSecurityService } from "./oauth-security.service";
|
|
25
|
-
import { didKeyFragment } from "@kya-os/mcp
|
|
26
|
+
import { didKeyFragment } from "@kya-os/mcp";
|
|
26
27
|
import { CONSENT_BUNDLE, CONSENT_BUNDLE_SIZE, resolveExpirationDays, DEFAULT_EXPIRATION_DAYS, resolveCapabilitiesForScopes, } from "@kya-os/consent";
|
|
27
28
|
import { calculateDOInstanceId, parseDORoutingStrategy, parseDOShardCount, } from "../utils/do-routing";
|
|
28
29
|
import { defaultProviders } from "@kya-os/provider-registry";
|
|
@@ -819,8 +820,18 @@ export class ConsentService {
|
|
|
819
820
|
metrics: { totalMs: Date.now() - startTime },
|
|
820
821
|
};
|
|
821
822
|
}
|
|
822
|
-
// Get public key bytes from JWK
|
|
823
|
+
// Get public key bytes from JWK. DIF types publicKeyJwk as `unknown`, so
|
|
824
|
+
// narrow and guard the `x` field explicitly — mirrors delegation.service.ts
|
|
825
|
+
// so both VC-JWT verification paths fail closed with the same precise reason.
|
|
823
826
|
const jwk = didDoc.verificationMethod[0].publicKeyJwk;
|
|
827
|
+
if (!jwk?.x) {
|
|
828
|
+
return {
|
|
829
|
+
valid: false,
|
|
830
|
+
reason: `Issuer DID document missing public key (x): ${issuerDid}`,
|
|
831
|
+
stage: "signature",
|
|
832
|
+
metrics: { totalMs: Date.now() - startTime },
|
|
833
|
+
};
|
|
834
|
+
}
|
|
824
835
|
const publicKeyBytes = base64urlDecodeToBytes(jwk.x);
|
|
825
836
|
const publicKeyBase64 = bytesToBase64(publicKeyBytes);
|
|
826
837
|
// Verify signature
|
|
@@ -844,7 +855,17 @@ export class ConsentService {
|
|
|
844
855
|
const verifier = createDelegationVerifier({
|
|
845
856
|
didResolver: createDidKeyResolver(),
|
|
846
857
|
});
|
|
847
|
-
|
|
858
|
+
// VC-JWT payloads carry no embedded proof — the JWS verified in Step 3 IS the
|
|
859
|
+
// signature. Synthesize the JwtProof2020 marker the core verifier's
|
|
860
|
+
// proof-presence check expects (the check is intentional; DIF's own
|
|
861
|
+
// with-kya-os.ts:1016 and gateway mcpi-auth-resolver.ts:425 do the same),
|
|
862
|
+
// then skip the core's signature stage. DIF owns the marker shape.
|
|
863
|
+
// DORMANT: verifyDelegationVC has no live caller — synthesis added per #559
|
|
864
|
+
// so the method is correct whenever it is wired.
|
|
865
|
+
const vcForVerifier = vc.proof
|
|
866
|
+
? vc
|
|
867
|
+
: { ...vc, proof: { type: "JwtProof2020", jwt: vcJwt } };
|
|
868
|
+
const result = await verifier.verifyDelegationCredential(vcForVerifier, {
|
|
848
869
|
skipSignature: true, // Already verified above
|
|
849
870
|
skipStatus: options?.skipStatus,
|
|
850
871
|
});
|
|
@@ -1220,51 +1241,19 @@ export class ConsentService {
|
|
|
1220
1241
|
* @returns Direct OAuth authorization URL
|
|
1221
1242
|
*/
|
|
1222
1243
|
buildDirectOAuthUrl(providerConfig, clientId, redirectUri, scopes, state, codeChallenge) {
|
|
1223
|
-
//
|
|
1224
|
-
|
|
1225
|
-
|
|
1226
|
-
|
|
1227
|
-
|
|
1228
|
-
|
|
1229
|
-
|
|
1230
|
-
|
|
1231
|
-
|
|
1232
|
-
|
|
1233
|
-
|
|
1234
|
-
|
|
1235
|
-
|
|
1236
|
-
if (RESERVED_PARAMS.includes(normalizedKey)) {
|
|
1237
|
-
throw new Error(`Custom parameter "${key}" conflicts with reserved OAuth parameter. Reserved parameters: ${RESERVED_PARAMS.join(", ")}`);
|
|
1238
|
-
}
|
|
1239
|
-
// Validate value is a string before calling string methods
|
|
1240
|
-
if (typeof value !== "string") {
|
|
1241
|
-
throw new Error(`Custom parameter "${key}" must be a string, got ${typeof value}`);
|
|
1242
|
-
}
|
|
1243
|
-
if (!value || value.trim().length === 0) {
|
|
1244
|
-
throw new Error(`Custom parameter "${key}" has empty value`);
|
|
1245
|
-
}
|
|
1246
|
-
}
|
|
1247
|
-
}
|
|
1248
|
-
// Build OAuth URL directly to provider's authorization endpoint
|
|
1249
|
-
const oauthUrl = new URL(providerConfig.authorizationUrl);
|
|
1250
|
-
// Include standard OAuth params
|
|
1251
|
-
oauthUrl.searchParams.set("response_type", providerConfig.responseType || "code");
|
|
1252
|
-
oauthUrl.searchParams.set("client_id", clientId);
|
|
1253
|
-
oauthUrl.searchParams.set("redirect_uri", redirectUri);
|
|
1254
|
-
oauthUrl.searchParams.set("scope", scopes.join(" "));
|
|
1255
|
-
oauthUrl.searchParams.set("state", state);
|
|
1256
|
-
// Include PKCE params if supported and challenge provided
|
|
1257
|
-
if (providerConfig.supportsPKCE && codeChallenge) {
|
|
1258
|
-
oauthUrl.searchParams.set("code_challenge", codeChallenge);
|
|
1259
|
-
oauthUrl.searchParams.set("code_challenge_method", "S256");
|
|
1260
|
-
}
|
|
1261
|
-
// Include custom parameters (after standard params, before PKCE params)
|
|
1262
|
-
if (providerConfig.customParams) {
|
|
1263
|
-
for (const [key, value] of Object.entries(providerConfig.customParams)) {
|
|
1264
|
-
oauthUrl.searchParams.set(key, value);
|
|
1265
|
-
}
|
|
1266
|
-
}
|
|
1267
|
-
return oauthUrl.toString();
|
|
1244
|
+
// C2 PR-4 (#2916): the provider-direct authorization URL is assembled by the
|
|
1245
|
+
// DIF-composed helper (buildAuthorizeUrl from @kya-os/mcp/authz), with the
|
|
1246
|
+
// customParams / responseType envelope layered product-side. Byte-for-byte
|
|
1247
|
+
// parity with the prior in-line assembly is asserted in
|
|
1248
|
+
// __tests__/parity/oidc-authorize-url-parity.test.ts.
|
|
1249
|
+
return buildProviderAuthorizeUrl({
|
|
1250
|
+
providerConfig,
|
|
1251
|
+
clientId,
|
|
1252
|
+
redirectUri,
|
|
1253
|
+
scopes,
|
|
1254
|
+
state,
|
|
1255
|
+
codeChallenge,
|
|
1256
|
+
});
|
|
1268
1257
|
}
|
|
1269
1258
|
/**
|
|
1270
1259
|
* Link OAuth identity to User DID
|