@kya-os/create-mcpi-app 1.10.2 → 1.10.3

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @kya-os/create-mcpi-app@1.10.2 build /Users/dylanhobbs/Documents/@kya-os/xmcp-i/.claude/worktrees/kya-os-http/packages/create-mcpi-app
+> @kya-os/create-mcpi-app@1.10.3 build /Users/dylanhobbs/Documents/@kya-os/xmcp-i/.claude/worktrees/kya-os-http/packages/create-mcpi-app
 > tsc && chmod +x dist/index.js && node --import tsx scripts/build-bundles.ts
 
 🔨 Building template bundles...
@@ -7,23 +7,23 @@
 
 📦 Building template: blank
   ✅ Source files written to /Users/dylanhobbs/Documents/@kya-os/xmcp-i/.claude/worktrees/kya-os-http/packages/create-mcpi-app/dist/.tmp-bundles/blank
-  ✅ Bundle built: 7223684 bytes, hash: sha256:eace4d156f2b1...
+  ✅ Bundle built: 7226042 bytes, hash: sha256:85d714b4d55d6...
 
 📦 Building template: hardware-world
   ✅ Source files written to /Users/dylanhobbs/Documents/@kya-os/xmcp-i/.claude/worktrees/kya-os-http/packages/create-mcpi-app/dist/.tmp-bundles/hardware-world
-  ✅ Bundle built: 7236087 bytes, hash: sha256:0658ee9a42b90...
+  ✅ Bundle built: 7238445 bytes, hash: sha256:57df00cb178cc...
 
 📦 Building template: ecommerce
   ✅ Source files written to /Users/dylanhobbs/Documents/@kya-os/xmcp-i/.claude/worktrees/kya-os-http/packages/create-mcpi-app/dist/.tmp-bundles/ecommerce
-  ✅ Bundle built: 7225378 bytes, hash: sha256:6c207f2035add...
+  ✅ Bundle built: 7227736 bytes, hash: sha256:e31ace48f2753...
 
 📦 Building template: mix-station
   ✅ Source files written to /Users/dylanhobbs/Documents/@kya-os/xmcp-i/.claude/worktrees/kya-os-http/packages/create-mcpi-app/dist/.tmp-bundles/mix-station
-  ✅ Bundle built: 7238471 bytes, hash: sha256:bfc525cbc17ad...
+  ✅ Bundle built: 7240829 bytes, hash: sha256:873a503de7a07...
 
 ✅ All bundles built successfully!
    Output: /Users/dylanhobbs/Documents/@kya-os/xmcp-i/.claude/worktrees/kya-os-http/packages/create-mcpi-app/dist/bundles
-   Version: 1.10.2
-   Framework: 1.12.0
+   Version: 1.10.3
+   Framework: 1.12.1
    Templates: blank, hardware-world, ecommerce, mix-station
    Manifest: /Users/dylanhobbs/Documents/@kya-os/xmcp-i/.claude/worktrees/kya-os-http/packages/create-mcpi-app/dist/bundles/manifest.json

package/dist/bundles/blank.js

@@ -141492,6 +141492,21 @@ var INTERNAL_PICKUP_INFO = "/_internal/pickup/info";
 
 // ../mcp-i-cloudflare/dist/delegation-http/anchor-do.js
 init_storage_keys();
+function anchorSnapshot(rec) {
+  return {
+    sid: rec.sid,
+    status: rec.status,
+    requiredScopes: rec.requiredScopes,
+    minAssurance: rec.minAssurance,
+    expiresAt: rec.expiresAt,
+    createdAt: rec.createdAt,
+    registeredAtMs: rec.registeredAtMs,
+    issuedAtMs: rec.issuedAtMs,
+    agentDid: rec.agentDid,
+    audience: rec.audience,
+    serverDid: rec.serverDid
+  };
+}
 var pendingBody = () => ({ status: "pending" });
 var pinnedErr = () => ({ error: KYAOS_ERRORS.pickupPinned });
 var invalidSessionErr = () => ({ error: KYAOS_ERRORS.invalidSession });
@@ -141499,7 +141514,12 @@ var pickupExpiredErr = () => ({ error: KYAOS_ERRORS.pickupExpired });
 function reduceCreate(rec, input, now2) {
   const i2 = input;
   if (rec && now2 <= rec.expiresAt) {
-    return { response: { status: 201, body: { success: true, reused: true } } };
+    return {
+      response: {
+        status: 201,
+        body: { success: true, reused: true, anchor: anchorSnapshot(rec) }
+      }
+    };
   }
   const record4 = {
     sid: i2.sid,
@@ -141512,6 +141532,8 @@ function reduceCreate(rec, input, now2) {
     agentDid: typeof i2.agentDid === "string" ? i2.agentDid : void 0,
     audience: typeof i2.audience === "string" ? i2.audience : void 0,
     serverDid: typeof i2.serverDid === "string" ? i2.serverDid : void 0,
+    registeredAtMs: typeof i2.registeredAtMs === "number" ? i2.registeredAtMs : void 0,
+    issuedAtMs: now2,
     pin: i2.pin ? {
       type: i2.pin.type,
       valueSha256: i2.pin.valueSha256,
@@ -141519,7 +141541,13 @@ function reduceCreate(rec, input, now2) {
       source: "challenge"
     } : void 0
   };
-  return { record: record4, response: { status: 201, body: { success: true } } };
+  return {
+    record: record4,
+    response: {
+      status: 201,
+      body: { success: true, anchor: anchorSnapshot(record4) }
+    }
+  };
 }
 function reducePoll(rec, holder, now2) {
   if (!rec) {
@@ -141663,7 +141691,7 @@ async function handlePickupInternal(ctx, request, now2) {
 // ../mcp-i-cloudflare/package.json
 var package_default = {
   name: "@kya-os/mcp-i-cloudflare",
-  version: "1.12.0",
+  version: "1.12.1",
   description: "Cloudflare Workers adapter for MCP-I framework",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -141881,6 +141909,16 @@ function registrationRateLimited(now2) {
 
 // ../mcp-i-cloudflare/dist/delegation-http/anchor-registration-validate.js
 var DID_RE = /^did:(key|web):.+$/;
+var SYNTHETIC_DETECTED_DID_PREFIX = "did:web:detected:";
+function didIssueMessage(value) {
+  if (typeof value !== "string" || !DID_RE.test(value)) {
+    return "Invalid DID format. Must be did:key: or did:web:";
+  }
+  if (value.startsWith(SYNTHETIC_DETECTED_DID_PREFIX)) {
+    return "Synthetic detected DIDs are not valid KYA-OS identities";
+  }
+  return null;
+}
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -141914,17 +141952,17 @@ function validateChallenge(issues, raw2) {
   checkOptionalString(issues, "challenge.pep_surface", raw2.pep_surface, 64);
   checkOptionalString(issues, "challenge.verdict", raw2.verdict, 64);
   checkOptionalString(issues, "challenge.challenge_pin", raw2.challenge_pin, 512);
-  if (raw2.detected_agent_did !== void 0 && (typeof raw2.detected_agent_did !== "string" || !DID_RE.test(raw2.detected_agent_did))) {
-    issues.push({
-      path: "challenge.detected_agent_did",
-      message: "Invalid DID format. Must be did:key: or did:web:"
-    });
+  if (raw2.detected_agent_did !== void 0) {
+    const issue4 = didIssueMessage(raw2.detected_agent_did);
+    if (issue4) {
+      issues.push({ path: "challenge.detected_agent_did", message: issue4 });
+    }
   }
-  if (raw2.audience !== void 0 && (typeof raw2.audience !== "string" || !DID_RE.test(raw2.audience))) {
-    issues.push({
-      path: "challenge.audience",
-      message: "Invalid DID format. Must be did:key: or did:web:"
-    });
+  if (raw2.audience !== void 0) {
+    const issue4 = didIssueMessage(raw2.audience);
+    if (issue4) {
+      issues.push({ path: "challenge.audience", message: issue4 });
+    }
   }
   if (issues.length > issuesBefore)
     return void 0;
@@ -141946,17 +141984,21 @@ function validateRegistrationBody(raw2) {
   }
   const issues = [];
   checkString(issues, "session_id", raw2.session_id, 255);
-  if (typeof raw2.agent_did !== "string" || !DID_RE.test(raw2.agent_did)) {
+  {
+    const issue4 = didIssueMessage(raw2.agent_did);
+    if (issue4)
+      issues.push({ path: "agent_did", message: issue4 });
+  }
+  if (typeof raw2.project_id !== "string" || raw2.project_id.length < 1) {
     issues.push({
-      path: "agent_did",
-      message: "Invalid DID format. Must be did:key: or did:web:"
+      path: "project_id",
+      message: "project_id must be a non-empty string"
     });
   }
-  checkString(issues, "project_id", raw2.project_id, 255);
-  if (typeof raw2.created_at !== "number" || !Number.isInteger(raw2.created_at) || raw2.created_at <= 0) {
+  if (typeof raw2.created_at !== "number" || !Number.isInteger(raw2.created_at) || raw2.created_at <= 0 || raw2.created_at > 864e13) {
     issues.push({
       path: "created_at",
-      message: "created_at must be a positive unix-ms integer"
+      message: "created_at must be a valid positive unix-ms integer"
     });
   }
   const clientInfo = raw2.client_info;
@@ -141969,11 +142011,10 @@ function validateRegistrationBody(raw2) {
     checkString(issues, "client_info.name", clientInfo.name, 255);
     checkOptionalString(issues, "client_info.version", clientInfo.version, 50);
   }
-  if (raw2.server_did !== void 0 && (typeof raw2.server_did !== "string" || !DID_RE.test(raw2.server_did))) {
-    issues.push({
-      path: "server_did",
-      message: "Invalid DID format. Must be did:key: or did:web:"
-    });
+  if (raw2.server_did !== void 0) {
+    const issue4 = didIssueMessage(raw2.server_did);
+    if (issue4)
+      issues.push({ path: "server_did", message: issue4 });
   }
   const challenge = validateChallenge(issues, raw2.challenge);
   if (raw2.challenge !== void 0 && typeof raw2.session_id === "string" && raw2.session_id.length < 22) {
@@ -142002,7 +142043,10 @@ function validateRegistrationBody(raw2) {
 // ../mcp-i-cloudflare/dist/delegation-http/anchor-registration.js
 var DO_INTERNAL_ORIGIN = "https://do.internal";
 function isAnchorRegistrationEnabled(cfg, env2) {
-  return cfg !== null && cfg.remoteAnchorRegistration && typeof env2.AGENTSHIELD_API_KEY === "string" && env2.AGENTSHIELD_API_KEY.length > 0;
+  return cfg !== null && cfg.remoteAnchorRegistration && typeof env2.AGENTSHIELD_API_KEY === "string" && env2.AGENTSHIELD_API_KEY.length > 0 && // No anchor store, no registration surface: getAnchorStub throws on an
+  // unbound MCP_OBJECT, so an unbound deployment must 404 like every other
+  // unprovisioned state instead of 500ing per request.
+  env2.MCP_OBJECT !== void 0;
 }
 function deriveRegistrationSid(sessionId) {
   if (isAnchorSid(sessionId))
@@ -142032,41 +142076,37 @@ async function callAnchor(env2, deps, sid, internalPath, body) {
 }
 async function ensureAnchor(env2, cfg, deps, sid, challenge, session) {
   const pin = challenge.challengePin && cfg.allowUnverifiedKeyidHolders ? { type: "keyid", valueSha256: sha256Hex(challenge.challengePin) } : void 0;
-  const created = await callAnchor(env2, deps, sid, INTERNAL_PICKUP_CREATE, {
-    sid,
-    requiredScopes: challenge.requiredScopes,
-    pollIntervalS: cfg.pollIntervalS,
-    anchorTtlS: cfg.anchorTtlS,
-    delegationExpiresInS: cfg.delegationExpiresInS,
-    agentDid: challenge.detectedAgentDid ?? session.agentDid,
-    // Cross-resource claim inputs (drive the minted VC's aud / server_did —
-    // see consent-anchor-bridge's withCrossResourceClaims).
-    ...challenge.audience ? { audience: challenge.audience } : {},
-    ...session.serverDid ? { serverDid: session.serverDid } : {},
-    ...pin ? { pin } : {}
-  });
-  if (created.status !== 201) {
-    return {
-      error: errorResponse(502, "anchor_unavailable", "The anchor store did not accept the registration")
-    };
-  }
-  let reused = false;
+  const anchorUnavailable = {
+    error: errorResponse(502, "anchor_unavailable", "The anchor store did not accept the registration")
+  };
+  let created;
+  let body;
   try {
-    reused = (await created.json()).reused === true;
-  } catch {
+    created = await callAnchor(env2, deps, sid, INTERNAL_PICKUP_CREATE, {
+      sid,
+      requiredScopes: challenge.requiredScopes,
+      pollIntervalS: cfg.pollIntervalS,
+      anchorTtlS: cfg.anchorTtlS,
+      delegationExpiresInS: cfg.delegationExpiresInS,
+      agentDid: challenge.detectedAgentDid ?? session.agentDid,
+      registeredAtMs: session.registeredAtMs,
+      // Cross-resource claim inputs (drive the minted VC's aud / server_did —
+      // see consent-anchor-bridge's withCrossResourceClaims).
+      ...challenge.audience ? { audience: challenge.audience } : {},
+      ...session.serverDid ? { serverDid: session.serverDid } : {},
+      ...pin ? { pin } : {}
+    });
+    if (created.status !== 201)
+      return anchorUnavailable;
+    body = await created.json();
+  } catch (error87) {
+    console.warn(`[kya-http] anchor create failed (sid=${sid}):`, error87 instanceof Error ? error87.message : String(error87));
+    return anchorUnavailable;
   }
-  const readBack = await callAnchor(env2, deps, sid, INTERNAL_PICKUP_INFO, {
-    sid
-  });
-  if (readBack.status !== 200) {
-    return {
-      error: errorResponse(502, "anchor_unavailable", "The registered anchor could not be read back")
-    };
+  if (!body.anchor || !Array.isArray(body.anchor.requiredScopes)) {
+    return anchorUnavailable;
   }
-  return {
-    isNew: !reused,
-    snapshot: await readBack.json()
-  };
+  return { isNew: body.reused !== true, snapshot: body.anchor };
 }
 async function handleAnchorRegistration(c, env2, cfg, deps) {
   if (!registrarAuthorized(env2, c.req.header("Authorization"))) {
@@ -142092,9 +142132,13 @@ async function handleAnchorRegistration(c, env2, cfg, deps) {
     return errorResponse(401, "unauthorized", "This endpoint only accepts challenge registration");
   }
   const sid = deriveRegistrationSid(validated.input.sessionId);
+  if (!challenge.audience) {
+    console.warn(`[kya-http] external registration without challenge.audience (sid=${sid}): the minted credential will FAIL an org-pinned \xA74.3 audience gate; cross-resource use requires the registrar to send challenge.audience`);
+  }
   const anchor = await ensureAnchor(env2, cfg, deps, sid, challenge, {
     agentDid: validated.input.agentDid,
-    serverDid: validated.input.serverDid
+    serverDid: validated.input.serverDid,
+    registeredAtMs: validated.input.createdAt
   });
   if ("error" in anchor)
     return anchor.error;
@@ -142118,17 +142162,24 @@ async function handleAnchorRegistration(c, env2, cfg, deps) {
     console.warn(`[kya-http] registration challenge_proof signing failed (sid=${sid}):`, error87 instanceof Error ? error87.message : String(error87));
     return errorResponse(502, "proof_unavailable", "The challenge proof could not be signed");
   }
+  const createdAtMs = anchor.snapshot.registeredAtMs ?? validated.input.createdAt;
+  const issuedAtMs = anchor.snapshot.issuedAtMs ?? Date.now();
   return new Response(JSON.stringify({
     success: true,
     data: {
       session_id: sid,
       registered: true,
-      created_at: new Date(validated.input.createdAt).toISOString(),
+      created_at: new Date(createdAtMs).toISOString(),
       challenge: {
         consent_uri: consentUri,
         challenge_proof: challengeProof,
         required_scopes: anchor.snapshot.requiredScopes,
-        issued_at: Date.now()
+        issued_at: issuedAtMs,
+        // ADDITIVE diagnostic (not in the frozen conformance key set, ignored
+        // by both existing parsers): whether the minted credential will carry
+        // the §4.3 cross-resource claims. False means no audience was
+        // registered — the credential only self-verifies at this worker.
+        cross_resource: typeof anchor.snapshot.audience === "string"
       }
     }
   }), {
@@ -147549,7 +147600,11 @@ async function mintDelegationVcJwt(env2, sid, info, expiresInS) {
     constraints: {
       scopes: info.requiredScopes,
       notBefore: nowS,
-      notAfter: nowS + expiresInS
+      notAfter: nowS + expiresInS,
+      // §11.7 outer===inner audience invariant (checkpoint's own mints bind the
+      // audience in BOTH the JWT aud and constraints.audience): set the inner
+      // half for cross-resource anchors so verifiers reading either slot agree.
+      ...info.audience ? { audience: info.audience } : {}
     },
     signature: "",
     status: "active",

package/dist/bundles/ecommerce.js

@@ -141492,6 +141492,21 @@ var INTERNAL_PICKUP_INFO = "/_internal/pickup/info";
 
 // ../mcp-i-cloudflare/dist/delegation-http/anchor-do.js
 init_storage_keys();
+function anchorSnapshot(rec) {
+  return {
+    sid: rec.sid,
+    status: rec.status,
+    requiredScopes: rec.requiredScopes,
+    minAssurance: rec.minAssurance,
+    expiresAt: rec.expiresAt,
+    createdAt: rec.createdAt,
+    registeredAtMs: rec.registeredAtMs,
+    issuedAtMs: rec.issuedAtMs,
+    agentDid: rec.agentDid,
+    audience: rec.audience,
+    serverDid: rec.serverDid
+  };
+}
 var pendingBody = () => ({ status: "pending" });
 var pinnedErr = () => ({ error: KYAOS_ERRORS.pickupPinned });
 var invalidSessionErr = () => ({ error: KYAOS_ERRORS.invalidSession });
@@ -141499,7 +141514,12 @@ var pickupExpiredErr = () => ({ error: KYAOS_ERRORS.pickupExpired });
 function reduceCreate(rec, input, now2) {
   const i2 = input;
   if (rec && now2 <= rec.expiresAt) {
-    return { response: { status: 201, body: { success: true, reused: true } } };
+    return {
+      response: {
+        status: 201,
+        body: { success: true, reused: true, anchor: anchorSnapshot(rec) }
+      }
+    };
   }
   const record4 = {
     sid: i2.sid,
@@ -141512,6 +141532,8 @@ function reduceCreate(rec, input, now2) {
     agentDid: typeof i2.agentDid === "string" ? i2.agentDid : void 0,
     audience: typeof i2.audience === "string" ? i2.audience : void 0,
     serverDid: typeof i2.serverDid === "string" ? i2.serverDid : void 0,
+    registeredAtMs: typeof i2.registeredAtMs === "number" ? i2.registeredAtMs : void 0,
+    issuedAtMs: now2,
     pin: i2.pin ? {
       type: i2.pin.type,
       valueSha256: i2.pin.valueSha256,
@@ -141519,7 +141541,13 @@ function reduceCreate(rec, input, now2) {
       source: "challenge"
     } : void 0
   };
-  return { record: record4, response: { status: 201, body: { success: true } } };
+  return {
+    record: record4,
+    response: {
+      status: 201,
+      body: { success: true, anchor: anchorSnapshot(record4) }
+    }
+  };
 }
 function reducePoll(rec, holder, now2) {
   if (!rec) {
@@ -141663,7 +141691,7 @@ async function handlePickupInternal(ctx, request, now2) {
 // ../mcp-i-cloudflare/package.json
 var package_default = {
   name: "@kya-os/mcp-i-cloudflare",
-  version: "1.12.0",
+  version: "1.12.1",
   description: "Cloudflare Workers adapter for MCP-I framework",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -141881,6 +141909,16 @@ function registrationRateLimited(now2) {
 
 // ../mcp-i-cloudflare/dist/delegation-http/anchor-registration-validate.js
 var DID_RE = /^did:(key|web):.+$/;
+var SYNTHETIC_DETECTED_DID_PREFIX = "did:web:detected:";
+function didIssueMessage(value) {
+  if (typeof value !== "string" || !DID_RE.test(value)) {
+    return "Invalid DID format. Must be did:key: or did:web:";
+  }
+  if (value.startsWith(SYNTHETIC_DETECTED_DID_PREFIX)) {
+    return "Synthetic detected DIDs are not valid KYA-OS identities";
+  }
+  return null;
+}
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -141914,17 +141952,17 @@ function validateChallenge(issues, raw2) {
   checkOptionalString(issues, "challenge.pep_surface", raw2.pep_surface, 64);
   checkOptionalString(issues, "challenge.verdict", raw2.verdict, 64);
   checkOptionalString(issues, "challenge.challenge_pin", raw2.challenge_pin, 512);
-  if (raw2.detected_agent_did !== void 0 && (typeof raw2.detected_agent_did !== "string" || !DID_RE.test(raw2.detected_agent_did))) {
-    issues.push({
-      path: "challenge.detected_agent_did",
-      message: "Invalid DID format. Must be did:key: or did:web:"
-    });
+  if (raw2.detected_agent_did !== void 0) {
+    const issue4 = didIssueMessage(raw2.detected_agent_did);
+    if (issue4) {
+      issues.push({ path: "challenge.detected_agent_did", message: issue4 });
+    }
   }
-  if (raw2.audience !== void 0 && (typeof raw2.audience !== "string" || !DID_RE.test(raw2.audience))) {
-    issues.push({
-      path: "challenge.audience",
-      message: "Invalid DID format. Must be did:key: or did:web:"
-    });
+  if (raw2.audience !== void 0) {
+    const issue4 = didIssueMessage(raw2.audience);
+    if (issue4) {
+      issues.push({ path: "challenge.audience", message: issue4 });
+    }
   }
   if (issues.length > issuesBefore)
     return void 0;
@@ -141946,17 +141984,21 @@ function validateRegistrationBody(raw2) {
   }
   const issues = [];
   checkString(issues, "session_id", raw2.session_id, 255);
-  if (typeof raw2.agent_did !== "string" || !DID_RE.test(raw2.agent_did)) {
+  {
+    const issue4 = didIssueMessage(raw2.agent_did);
+    if (issue4)
+      issues.push({ path: "agent_did", message: issue4 });
+  }
+  if (typeof raw2.project_id !== "string" || raw2.project_id.length < 1) {
     issues.push({
-      path: "agent_did",
-      message: "Invalid DID format. Must be did:key: or did:web:"
+      path: "project_id",
+      message: "project_id must be a non-empty string"
     });
   }
-  checkString(issues, "project_id", raw2.project_id, 255);
-  if (typeof raw2.created_at !== "number" || !Number.isInteger(raw2.created_at) || raw2.created_at <= 0) {
+  if (typeof raw2.created_at !== "number" || !Number.isInteger(raw2.created_at) || raw2.created_at <= 0 || raw2.created_at > 864e13) {
     issues.push({
       path: "created_at",
-      message: "created_at must be a positive unix-ms integer"
+      message: "created_at must be a valid positive unix-ms integer"
     });
   }
   const clientInfo = raw2.client_info;
@@ -141969,11 +142011,10 @@ function validateRegistrationBody(raw2) {
     checkString(issues, "client_info.name", clientInfo.name, 255);
     checkOptionalString(issues, "client_info.version", clientInfo.version, 50);
   }
-  if (raw2.server_did !== void 0 && (typeof raw2.server_did !== "string" || !DID_RE.test(raw2.server_did))) {
-    issues.push({
-      path: "server_did",
-      message: "Invalid DID format. Must be did:key: or did:web:"
-    });
+  if (raw2.server_did !== void 0) {
+    const issue4 = didIssueMessage(raw2.server_did);
+    if (issue4)
+      issues.push({ path: "server_did", message: issue4 });
   }
   const challenge = validateChallenge(issues, raw2.challenge);
   if (raw2.challenge !== void 0 && typeof raw2.session_id === "string" && raw2.session_id.length < 22) {
@@ -142002,7 +142043,10 @@ function validateRegistrationBody(raw2) {
 // ../mcp-i-cloudflare/dist/delegation-http/anchor-registration.js
 var DO_INTERNAL_ORIGIN = "https://do.internal";
 function isAnchorRegistrationEnabled(cfg, env2) {
-  return cfg !== null && cfg.remoteAnchorRegistration && typeof env2.AGENTSHIELD_API_KEY === "string" && env2.AGENTSHIELD_API_KEY.length > 0;
+  return cfg !== null && cfg.remoteAnchorRegistration && typeof env2.AGENTSHIELD_API_KEY === "string" && env2.AGENTSHIELD_API_KEY.length > 0 && // No anchor store, no registration surface: getAnchorStub throws on an
+  // unbound MCP_OBJECT, so an unbound deployment must 404 like every other
+  // unprovisioned state instead of 500ing per request.
+  env2.MCP_OBJECT !== void 0;
 }
 function deriveRegistrationSid(sessionId) {
   if (isAnchorSid(sessionId))
@@ -142032,41 +142076,37 @@ async function callAnchor(env2, deps, sid, internalPath, body) {
 }
 async function ensureAnchor(env2, cfg, deps, sid, challenge, session) {
   const pin = challenge.challengePin && cfg.allowUnverifiedKeyidHolders ? { type: "keyid", valueSha256: sha256Hex(challenge.challengePin) } : void 0;
-  const created = await callAnchor(env2, deps, sid, INTERNAL_PICKUP_CREATE, {
-    sid,
-    requiredScopes: challenge.requiredScopes,
-    pollIntervalS: cfg.pollIntervalS,
-    anchorTtlS: cfg.anchorTtlS,
-    delegationExpiresInS: cfg.delegationExpiresInS,
-    agentDid: challenge.detectedAgentDid ?? session.agentDid,
-    // Cross-resource claim inputs (drive the minted VC's aud / server_did —
-    // see consent-anchor-bridge's withCrossResourceClaims).
-    ...challenge.audience ? { audience: challenge.audience } : {},
-    ...session.serverDid ? { serverDid: session.serverDid } : {},
-    ...pin ? { pin } : {}
-  });
-  if (created.status !== 201) {
-    return {
-      error: errorResponse(502, "anchor_unavailable", "The anchor store did not accept the registration")
-    };
-  }
-  let reused = false;
+  const anchorUnavailable = {
+    error: errorResponse(502, "anchor_unavailable", "The anchor store did not accept the registration")
+  };
+  let created;
+  let body;
   try {
-    reused = (await created.json()).reused === true;
-  } catch {
+    created = await callAnchor(env2, deps, sid, INTERNAL_PICKUP_CREATE, {
+      sid,
+      requiredScopes: challenge.requiredScopes,
+      pollIntervalS: cfg.pollIntervalS,
+      anchorTtlS: cfg.anchorTtlS,
+      delegationExpiresInS: cfg.delegationExpiresInS,
+      agentDid: challenge.detectedAgentDid ?? session.agentDid,
+      registeredAtMs: session.registeredAtMs,
+      // Cross-resource claim inputs (drive the minted VC's aud / server_did —
+      // see consent-anchor-bridge's withCrossResourceClaims).
+      ...challenge.audience ? { audience: challenge.audience } : {},
+      ...session.serverDid ? { serverDid: session.serverDid } : {},
+      ...pin ? { pin } : {}
+    });
+    if (created.status !== 201)
+      return anchorUnavailable;
+    body = await created.json();
+  } catch (error87) {
+    console.warn(`[kya-http] anchor create failed (sid=${sid}):`, error87 instanceof Error ? error87.message : String(error87));
+    return anchorUnavailable;
   }
-  const readBack = await callAnchor(env2, deps, sid, INTERNAL_PICKUP_INFO, {
-    sid
-  });
-  if (readBack.status !== 200) {
-    return {
-      error: errorResponse(502, "anchor_unavailable", "The registered anchor could not be read back")
-    };
+  if (!body.anchor || !Array.isArray(body.anchor.requiredScopes)) {
+    return anchorUnavailable;
   }
-  return {
-    isNew: !reused,
-    snapshot: await readBack.json()
-  };
+  return { isNew: body.reused !== true, snapshot: body.anchor };
 }
 async function handleAnchorRegistration(c, env2, cfg, deps) {
   if (!registrarAuthorized(env2, c.req.header("Authorization"))) {
@@ -142092,9 +142132,13 @@ async function handleAnchorRegistration(c, env2, cfg, deps) {
     return errorResponse(401, "unauthorized", "This endpoint only accepts challenge registration");
   }
   const sid = deriveRegistrationSid(validated.input.sessionId);
+  if (!challenge.audience) {
+    console.warn(`[kya-http] external registration without challenge.audience (sid=${sid}): the minted credential will FAIL an org-pinned \xA74.3 audience gate; cross-resource use requires the registrar to send challenge.audience`);
+  }
   const anchor = await ensureAnchor(env2, cfg, deps, sid, challenge, {
     agentDid: validated.input.agentDid,
-    serverDid: validated.input.serverDid
+    serverDid: validated.input.serverDid,
+    registeredAtMs: validated.input.createdAt
   });
   if ("error" in anchor)
     return anchor.error;
@@ -142118,17 +142162,24 @@ async function handleAnchorRegistration(c, env2, cfg, deps) {
     console.warn(`[kya-http] registration challenge_proof signing failed (sid=${sid}):`, error87 instanceof Error ? error87.message : String(error87));
     return errorResponse(502, "proof_unavailable", "The challenge proof could not be signed");
   }
+  const createdAtMs = anchor.snapshot.registeredAtMs ?? validated.input.createdAt;
+  const issuedAtMs = anchor.snapshot.issuedAtMs ?? Date.now();
   return new Response(JSON.stringify({
     success: true,
     data: {
       session_id: sid,
       registered: true,
-      created_at: new Date(validated.input.createdAt).toISOString(),
+      created_at: new Date(createdAtMs).toISOString(),
       challenge: {
         consent_uri: consentUri,
         challenge_proof: challengeProof,
         required_scopes: anchor.snapshot.requiredScopes,
-        issued_at: Date.now()
+        issued_at: issuedAtMs,
+        // ADDITIVE diagnostic (not in the frozen conformance key set, ignored
+        // by both existing parsers): whether the minted credential will carry
+        // the §4.3 cross-resource claims. False means no audience was
+        // registered — the credential only self-verifies at this worker.
+        cross_resource: typeof anchor.snapshot.audience === "string"
       }
     }
   }), {
@@ -147549,7 +147600,11 @@ async function mintDelegationVcJwt(env2, sid, info, expiresInS) {
     constraints: {
       scopes: info.requiredScopes,
       notBefore: nowS,
-      notAfter: nowS + expiresInS
+      notAfter: nowS + expiresInS,
+      // §11.7 outer===inner audience invariant (checkpoint's own mints bind the
+      // audience in BOTH the JWT aud and constraints.audience): set the inner
+      // half for cross-resource anchors so verifiers reading either slot agree.
+      ...info.audience ? { audience: info.audience } : {}
     },
     signature: "",
     status: "active",

package/dist/bundles/hardware-world.js

@@ -141492,6 +141492,21 @@ var INTERNAL_PICKUP_INFO = "/_internal/pickup/info";
 
 // ../mcp-i-cloudflare/dist/delegation-http/anchor-do.js
 init_storage_keys();
+function anchorSnapshot(rec) {
+  return {
+    sid: rec.sid,
+    status: rec.status,
+    requiredScopes: rec.requiredScopes,
+    minAssurance: rec.minAssurance,
+    expiresAt: rec.expiresAt,
+    createdAt: rec.createdAt,
+    registeredAtMs: rec.registeredAtMs,
+    issuedAtMs: rec.issuedAtMs,
+    agentDid: rec.agentDid,
+    audience: rec.audience,
+    serverDid: rec.serverDid
+  };
+}
 var pendingBody = () => ({ status: "pending" });
 var pinnedErr = () => ({ error: KYAOS_ERRORS.pickupPinned });
 var invalidSessionErr = () => ({ error: KYAOS_ERRORS.invalidSession });
@@ -141499,7 +141514,12 @@ var pickupExpiredErr = () => ({ error: KYAOS_ERRORS.pickupExpired });
 function reduceCreate(rec, input, now2) {
   const i2 = input;
   if (rec && now2 <= rec.expiresAt) {
-    return { response: { status: 201, body: { success: true, reused: true } } };
+    return {
+      response: {
+        status: 201,
+        body: { success: true, reused: true, anchor: anchorSnapshot(rec) }
+      }
+    };
   }
   const record4 = {
     sid: i2.sid,
@@ -141512,6 +141532,8 @@ function reduceCreate(rec, input, now2) {
     agentDid: typeof i2.agentDid === "string" ? i2.agentDid : void 0,
     audience: typeof i2.audience === "string" ? i2.audience : void 0,
     serverDid: typeof i2.serverDid === "string" ? i2.serverDid : void 0,
+    registeredAtMs: typeof i2.registeredAtMs === "number" ? i2.registeredAtMs : void 0,
+    issuedAtMs: now2,
     pin: i2.pin ? {
       type: i2.pin.type,
       valueSha256: i2.pin.valueSha256,
@@ -141519,7 +141541,13 @@ function reduceCreate(rec, input, now2) {
       source: "challenge"
     } : void 0
   };
-  return { record: record4, response: { status: 201, body: { success: true } } };
+  return {
+    record: record4,
+    response: {
+      status: 201,
+      body: { success: true, anchor: anchorSnapshot(record4) }
+    }
+  };
 }
 function reducePoll(rec, holder, now2) {
   if (!rec) {
@@ -141663,7 +141691,7 @@ async function handlePickupInternal(ctx, request, now2) {
 // ../mcp-i-cloudflare/package.json
 var package_default = {
   name: "@kya-os/mcp-i-cloudflare",
-  version: "1.12.0",
+  version: "1.12.1",
   description: "Cloudflare Workers adapter for MCP-I framework",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -141881,6 +141909,16 @@ function registrationRateLimited(now2) {
 
 // ../mcp-i-cloudflare/dist/delegation-http/anchor-registration-validate.js
 var DID_RE = /^did:(key|web):.+$/;
+var SYNTHETIC_DETECTED_DID_PREFIX = "did:web:detected:";
+function didIssueMessage(value) {
+  if (typeof value !== "string" || !DID_RE.test(value)) {
+    return "Invalid DID format. Must be did:key: or did:web:";
+  }
+  if (value.startsWith(SYNTHETIC_DETECTED_DID_PREFIX)) {
+    return "Synthetic detected DIDs are not valid KYA-OS identities";
+  }
+  return null;
+}
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -141914,17 +141952,17 @@ function validateChallenge(issues, raw2) {
   checkOptionalString(issues, "challenge.pep_surface", raw2.pep_surface, 64);
   checkOptionalString(issues, "challenge.verdict", raw2.verdict, 64);
   checkOptionalString(issues, "challenge.challenge_pin", raw2.challenge_pin, 512);
-  if (raw2.detected_agent_did !== void 0 && (typeof raw2.detected_agent_did !== "string" || !DID_RE.test(raw2.detected_agent_did))) {
-    issues.push({
-      path: "challenge.detected_agent_did",
-      message: "Invalid DID format. Must be did:key: or did:web:"
-    });
+  if (raw2.detected_agent_did !== void 0) {
+    const issue4 = didIssueMessage(raw2.detected_agent_did);
+    if (issue4) {
+      issues.push({ path: "challenge.detected_agent_did", message: issue4 });
+    }
   }
-  if (raw2.audience !== void 0 && (typeof raw2.audience !== "string" || !DID_RE.test(raw2.audience))) {
-    issues.push({
-      path: "challenge.audience",
-      message: "Invalid DID format. Must be did:key: or did:web:"
-    });
+  if (raw2.audience !== void 0) {
+    const issue4 = didIssueMessage(raw2.audience);
+    if (issue4) {
+      issues.push({ path: "challenge.audience", message: issue4 });
+    }
   }
   if (issues.length > issuesBefore)
     return void 0;
@@ -141946,17 +141984,21 @@ function validateRegistrationBody(raw2) {
   }
   const issues = [];
   checkString(issues, "session_id", raw2.session_id, 255);
-  if (typeof raw2.agent_did !== "string" || !DID_RE.test(raw2.agent_did)) {
+  {
+    const issue4 = didIssueMessage(raw2.agent_did);
+    if (issue4)
+      issues.push({ path: "agent_did", message: issue4 });
+  }
+  if (typeof raw2.project_id !== "string" || raw2.project_id.length < 1) {
     issues.push({
-      path: "agent_did",
-      message: "Invalid DID format. Must be did:key: or did:web:"
+      path: "project_id",
+      message: "project_id must be a non-empty string"
     });
   }
-  checkString(issues, "project_id", raw2.project_id, 255);
-  if (typeof raw2.created_at !== "number" || !Number.isInteger(raw2.created_at) || raw2.created_at <= 0) {
+  if (typeof raw2.created_at !== "number" || !Number.isInteger(raw2.created_at) || raw2.created_at <= 0 || raw2.created_at > 864e13) {
     issues.push({
       path: "created_at",
-      message: "created_at must be a positive unix-ms integer"
+      message: "created_at must be a valid positive unix-ms integer"
     });
   }
   const clientInfo = raw2.client_info;
@@ -141969,11 +142011,10 @@ function validateRegistrationBody(raw2) {
     checkString(issues, "client_info.name", clientInfo.name, 255);
     checkOptionalString(issues, "client_info.version", clientInfo.version, 50);
   }
-  if (raw2.server_did !== void 0 && (typeof raw2.server_did !== "string" || !DID_RE.test(raw2.server_did))) {
-    issues.push({
-      path: "server_did",
-      message: "Invalid DID format. Must be did:key: or did:web:"
-    });
+  if (raw2.server_did !== void 0) {
+    const issue4 = didIssueMessage(raw2.server_did);
+    if (issue4)
+      issues.push({ path: "server_did", message: issue4 });
   }
   const challenge = validateChallenge(issues, raw2.challenge);
   if (raw2.challenge !== void 0 && typeof raw2.session_id === "string" && raw2.session_id.length < 22) {
@@ -142002,7 +142043,10 @@ function validateRegistrationBody(raw2) {
 // ../mcp-i-cloudflare/dist/delegation-http/anchor-registration.js
 var DO_INTERNAL_ORIGIN = "https://do.internal";
 function isAnchorRegistrationEnabled(cfg, env2) {
-  return cfg !== null && cfg.remoteAnchorRegistration && typeof env2.AGENTSHIELD_API_KEY === "string" && env2.AGENTSHIELD_API_KEY.length > 0;
+  return cfg !== null && cfg.remoteAnchorRegistration && typeof env2.AGENTSHIELD_API_KEY === "string" && env2.AGENTSHIELD_API_KEY.length > 0 && // No anchor store, no registration surface: getAnchorStub throws on an
+  // unbound MCP_OBJECT, so an unbound deployment must 404 like every other
+  // unprovisioned state instead of 500ing per request.
+  env2.MCP_OBJECT !== void 0;
 }
 function deriveRegistrationSid(sessionId) {
   if (isAnchorSid(sessionId))
@@ -142032,41 +142076,37 @@ async function callAnchor(env2, deps, sid, internalPath, body) {
 }
 async function ensureAnchor(env2, cfg, deps, sid, challenge, session) {
   const pin = challenge.challengePin && cfg.allowUnverifiedKeyidHolders ? { type: "keyid", valueSha256: sha256Hex(challenge.challengePin) } : void 0;
-  const created = await callAnchor(env2, deps, sid, INTERNAL_PICKUP_CREATE, {
-    sid,
-    requiredScopes: challenge.requiredScopes,
-    pollIntervalS: cfg.pollIntervalS,
-    anchorTtlS: cfg.anchorTtlS,
-    delegationExpiresInS: cfg.delegationExpiresInS,
-    agentDid: challenge.detectedAgentDid ?? session.agentDid,
-    // Cross-resource claim inputs (drive the minted VC's aud / server_did —
-    // see consent-anchor-bridge's withCrossResourceClaims).
-    ...challenge.audience ? { audience: challenge.audience } : {},
-    ...session.serverDid ? { serverDid: session.serverDid } : {},
-    ...pin ? { pin } : {}
-  });
-  if (created.status !== 201) {
-    return {
-      error: errorResponse(502, "anchor_unavailable", "The anchor store did not accept the registration")
-    };
-  }
-  let reused = false;
+  const anchorUnavailable = {
+    error: errorResponse(502, "anchor_unavailable", "The anchor store did not accept the registration")
+  };
+  let created;
+  let body;
   try {
-    reused = (await created.json()).reused === true;
-  } catch {
+    created = await callAnchor(env2, deps, sid, INTERNAL_PICKUP_CREATE, {
+      sid,
+      requiredScopes: challenge.requiredScopes,
+      pollIntervalS: cfg.pollIntervalS,
+      anchorTtlS: cfg.anchorTtlS,
+      delegationExpiresInS: cfg.delegationExpiresInS,
+      agentDid: challenge.detectedAgentDid ?? session.agentDid,
+      registeredAtMs: session.registeredAtMs,
+      // Cross-resource claim inputs (drive the minted VC's aud / server_did —
+      // see consent-anchor-bridge's withCrossResourceClaims).
+      ...challenge.audience ? { audience: challenge.audience } : {},
+      ...session.serverDid ? { serverDid: session.serverDid } : {},
+      ...pin ? { pin } : {}
+    });
+    if (created.status !== 201)
+      return anchorUnavailable;
+    body = await created.json();
+  } catch (error87) {
+    console.warn(`[kya-http] anchor create failed (sid=${sid}):`, error87 instanceof Error ? error87.message : String(error87));
+    return anchorUnavailable;
   }
-  const readBack = await callAnchor(env2, deps, sid, INTERNAL_PICKUP_INFO, {
-    sid
-  });
-  if (readBack.status !== 200) {
-    return {
-      error: errorResponse(502, "anchor_unavailable", "The registered anchor could not be read back")
-    };
+  if (!body.anchor || !Array.isArray(body.anchor.requiredScopes)) {
+    return anchorUnavailable;
   }
-  return {
-    isNew: !reused,
-    snapshot: await readBack.json()
-  };
+  return { isNew: body.reused !== true, snapshot: body.anchor };
 }
 async function handleAnchorRegistration(c, env2, cfg, deps) {
   if (!registrarAuthorized(env2, c.req.header("Authorization"))) {
@@ -142092,9 +142132,13 @@ async function handleAnchorRegistration(c, env2, cfg, deps) {
     return errorResponse(401, "unauthorized", "This endpoint only accepts challenge registration");
   }
   const sid = deriveRegistrationSid(validated.input.sessionId);
+  if (!challenge.audience) {
+    console.warn(`[kya-http] external registration without challenge.audience (sid=${sid}): the minted credential will FAIL an org-pinned \xA74.3 audience gate; cross-resource use requires the registrar to send challenge.audience`);
+  }
   const anchor = await ensureAnchor(env2, cfg, deps, sid, challenge, {
     agentDid: validated.input.agentDid,
-    serverDid: validated.input.serverDid
+    serverDid: validated.input.serverDid,
+    registeredAtMs: validated.input.createdAt
   });
   if ("error" in anchor)
     return anchor.error;
@@ -142118,17 +142162,24 @@ async function handleAnchorRegistration(c, env2, cfg, deps) {
     console.warn(`[kya-http] registration challenge_proof signing failed (sid=${sid}):`, error87 instanceof Error ? error87.message : String(error87));
     return errorResponse(502, "proof_unavailable", "The challenge proof could not be signed");
   }
+  const createdAtMs = anchor.snapshot.registeredAtMs ?? validated.input.createdAt;
+  const issuedAtMs = anchor.snapshot.issuedAtMs ?? Date.now();
   return new Response(JSON.stringify({
     success: true,
     data: {
       session_id: sid,
       registered: true,
-      created_at: new Date(validated.input.createdAt).toISOString(),
+      created_at: new Date(createdAtMs).toISOString(),
       challenge: {
         consent_uri: consentUri,
         challenge_proof: challengeProof,
         required_scopes: anchor.snapshot.requiredScopes,
-        issued_at: Date.now()
+        issued_at: issuedAtMs,
+        // ADDITIVE diagnostic (not in the frozen conformance key set, ignored
+        // by both existing parsers): whether the minted credential will carry
+        // the §4.3 cross-resource claims. False means no audience was
+        // registered — the credential only self-verifies at this worker.
+        cross_resource: typeof anchor.snapshot.audience === "string"
       }
     }
   }), {
@@ -147549,7 +147600,11 @@ async function mintDelegationVcJwt(env2, sid, info, expiresInS) {
     constraints: {
       scopes: info.requiredScopes,
       notBefore: nowS,
-      notAfter: nowS + expiresInS
+      notAfter: nowS + expiresInS,
+      // §11.7 outer===inner audience invariant (checkpoint's own mints bind the
+      // audience in BOTH the JWT aud and constraints.audience): set the inner
+      // half for cross-resource anchors so verifiers reading either slot agree.
+      ...info.audience ? { audience: info.audience } : {}
     },
     signature: "",
     status: "active",

package/dist/bundles/manifest.json

@@ -1,28 +1,28 @@
 {
-  "version": "1.10.2",
-  "frameworkVersion": "1.12.0",
+  "version": "1.10.3",
+  "frameworkVersion": "1.12.1",
   "doClassName": "MCPIAgent",
-  "buildDate": "2026-07-08T21:55:34.701Z",
+  "buildDate": "2026-07-08T22:33:37.213Z",
   "templates": {
     "blank": {
       "file": "blank.js",
-      "size": 7223684,
-      "hash": "sha256:eace4d156f2b121cd54f82fa9e4afd3f184c5ab0ce939f195882e3849c50ea77"
+      "size": 7226042,
+      "hash": "sha256:85d714b4d55d63216b6da7622a06ccbde4c117ae78d968b1a7f5e45384b5bb86"
     },
     "hardware-world": {
       "file": "hardware-world.js",
-      "size": 7236087,
-      "hash": "sha256:0658ee9a42b90f60a149ce71f00934558bc43af07f5dcfeccec1668aff54fd70"
+      "size": 7238445,
+      "hash": "sha256:57df00cb178ccff53fe1d1da664d3873b0ddc8f2506461f3896a4917cde0c70a"
     },
     "ecommerce": {
       "file": "ecommerce.js",
-      "size": 7225378,
-      "hash": "sha256:6c207f2035adda4a33c8529221710afd9bc672cb354e9132cbb4a405aee72f24"
+      "size": 7227736,
+      "hash": "sha256:e31ace48f27532c3894e6cd71389c68adb404c96da3d96c6912e61b5288d3964"
     },
     "mix-station": {
       "file": "mix-station.js",
-      "size": 7238471,
-      "hash": "sha256:bfc525cbc17ad3dee9f6fdc43a65b72f7a8374d5689135a09ebde49fd6b0a145"
+      "size": 7240829,
+      "hash": "sha256:873a503de7a07ae2e62cde4d4c93e4a3872bad1b34bb1df64903f8fe40bd23d8"
     }
   }
 }

package/dist/bundles/mix-station.js

@@ -141492,6 +141492,21 @@ var INTERNAL_PICKUP_INFO = "/_internal/pickup/info";
 
 // ../mcp-i-cloudflare/dist/delegation-http/anchor-do.js
 init_storage_keys();
+function anchorSnapshot(rec) {
+  return {
+    sid: rec.sid,
+    status: rec.status,
+    requiredScopes: rec.requiredScopes,
+    minAssurance: rec.minAssurance,
+    expiresAt: rec.expiresAt,
+    createdAt: rec.createdAt,
+    registeredAtMs: rec.registeredAtMs,
+    issuedAtMs: rec.issuedAtMs,
+    agentDid: rec.agentDid,
+    audience: rec.audience,
+    serverDid: rec.serverDid
+  };
+}
 var pendingBody = () => ({ status: "pending" });
 var pinnedErr = () => ({ error: KYAOS_ERRORS.pickupPinned });
 var invalidSessionErr = () => ({ error: KYAOS_ERRORS.invalidSession });
@@ -141499,7 +141514,12 @@ var pickupExpiredErr = () => ({ error: KYAOS_ERRORS.pickupExpired });
 function reduceCreate(rec, input, now2) {
   const i2 = input;
   if (rec && now2 <= rec.expiresAt) {
-    return { response: { status: 201, body: { success: true, reused: true } } };
+    return {
+      response: {
+        status: 201,
+        body: { success: true, reused: true, anchor: anchorSnapshot(rec) }
+      }
+    };
   }
   const record4 = {
     sid: i2.sid,
@@ -141512,6 +141532,8 @@ function reduceCreate(rec, input, now2) {
     agentDid: typeof i2.agentDid === "string" ? i2.agentDid : void 0,
     audience: typeof i2.audience === "string" ? i2.audience : void 0,
     serverDid: typeof i2.serverDid === "string" ? i2.serverDid : void 0,
+    registeredAtMs: typeof i2.registeredAtMs === "number" ? i2.registeredAtMs : void 0,
+    issuedAtMs: now2,
     pin: i2.pin ? {
       type: i2.pin.type,
       valueSha256: i2.pin.valueSha256,
@@ -141519,7 +141541,13 @@ function reduceCreate(rec, input, now2) {
       source: "challenge"
     } : void 0
   };
-  return { record: record4, response: { status: 201, body: { success: true } } };
+  return {
+    record: record4,
+    response: {
+      status: 201,
+      body: { success: true, anchor: anchorSnapshot(record4) }
+    }
+  };
 }
 function reducePoll(rec, holder, now2) {
   if (!rec) {
@@ -141663,7 +141691,7 @@ async function handlePickupInternal(ctx, request, now2) {
 // ../mcp-i-cloudflare/package.json
 var package_default = {
   name: "@kya-os/mcp-i-cloudflare",
-  version: "1.12.0",
+  version: "1.12.1",
   description: "Cloudflare Workers adapter for MCP-I framework",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -141881,6 +141909,16 @@ function registrationRateLimited(now2) {
 
 // ../mcp-i-cloudflare/dist/delegation-http/anchor-registration-validate.js
 var DID_RE = /^did:(key|web):.+$/;
+var SYNTHETIC_DETECTED_DID_PREFIX = "did:web:detected:";
+function didIssueMessage(value) {
+  if (typeof value !== "string" || !DID_RE.test(value)) {
+    return "Invalid DID format. Must be did:key: or did:web:";
+  }
+  if (value.startsWith(SYNTHETIC_DETECTED_DID_PREFIX)) {
+    return "Synthetic detected DIDs are not valid KYA-OS identities";
+  }
+  return null;
+}
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -141914,17 +141952,17 @@ function validateChallenge(issues, raw2) {
   checkOptionalString(issues, "challenge.pep_surface", raw2.pep_surface, 64);
   checkOptionalString(issues, "challenge.verdict", raw2.verdict, 64);
   checkOptionalString(issues, "challenge.challenge_pin", raw2.challenge_pin, 512);
-  if (raw2.detected_agent_did !== void 0 && (typeof raw2.detected_agent_did !== "string" || !DID_RE.test(raw2.detected_agent_did))) {
-    issues.push({
-      path: "challenge.detected_agent_did",
-      message: "Invalid DID format. Must be did:key: or did:web:"
-    });
+  if (raw2.detected_agent_did !== void 0) {
+    const issue4 = didIssueMessage(raw2.detected_agent_did);
+    if (issue4) {
+      issues.push({ path: "challenge.detected_agent_did", message: issue4 });
+    }
   }
-  if (raw2.audience !== void 0 && (typeof raw2.audience !== "string" || !DID_RE.test(raw2.audience))) {
-    issues.push({
-      path: "challenge.audience",
-      message: "Invalid DID format. Must be did:key: or did:web:"
-    });
+  if (raw2.audience !== void 0) {
+    const issue4 = didIssueMessage(raw2.audience);
+    if (issue4) {
+      issues.push({ path: "challenge.audience", message: issue4 });
+    }
   }
   if (issues.length > issuesBefore)
     return void 0;
@@ -141946,17 +141984,21 @@ function validateRegistrationBody(raw2) {
   }
   const issues = [];
   checkString(issues, "session_id", raw2.session_id, 255);
-  if (typeof raw2.agent_did !== "string" || !DID_RE.test(raw2.agent_did)) {
+  {
+    const issue4 = didIssueMessage(raw2.agent_did);
+    if (issue4)
+      issues.push({ path: "agent_did", message: issue4 });
+  }
+  if (typeof raw2.project_id !== "string" || raw2.project_id.length < 1) {
     issues.push({
-      path: "agent_did",
-      message: "Invalid DID format. Must be did:key: or did:web:"
+      path: "project_id",
+      message: "project_id must be a non-empty string"
     });
   }
-  checkString(issues, "project_id", raw2.project_id, 255);
-  if (typeof raw2.created_at !== "number" || !Number.isInteger(raw2.created_at) || raw2.created_at <= 0) {
+  if (typeof raw2.created_at !== "number" || !Number.isInteger(raw2.created_at) || raw2.created_at <= 0 || raw2.created_at > 864e13) {
     issues.push({
       path: "created_at",
-      message: "created_at must be a positive unix-ms integer"
+      message: "created_at must be a valid positive unix-ms integer"
     });
   }
   const clientInfo = raw2.client_info;
@@ -141969,11 +142011,10 @@ function validateRegistrationBody(raw2) {
     checkString(issues, "client_info.name", clientInfo.name, 255);
     checkOptionalString(issues, "client_info.version", clientInfo.version, 50);
   }
-  if (raw2.server_did !== void 0 && (typeof raw2.server_did !== "string" || !DID_RE.test(raw2.server_did))) {
-    issues.push({
-      path: "server_did",
-      message: "Invalid DID format. Must be did:key: or did:web:"
-    });
+  if (raw2.server_did !== void 0) {
+    const issue4 = didIssueMessage(raw2.server_did);
+    if (issue4)
+      issues.push({ path: "server_did", message: issue4 });
   }
   const challenge = validateChallenge(issues, raw2.challenge);
   if (raw2.challenge !== void 0 && typeof raw2.session_id === "string" && raw2.session_id.length < 22) {
@@ -142002,7 +142043,10 @@ function validateRegistrationBody(raw2) {
 // ../mcp-i-cloudflare/dist/delegation-http/anchor-registration.js
 var DO_INTERNAL_ORIGIN = "https://do.internal";
 function isAnchorRegistrationEnabled(cfg, env2) {
-  return cfg !== null && cfg.remoteAnchorRegistration && typeof env2.AGENTSHIELD_API_KEY === "string" && env2.AGENTSHIELD_API_KEY.length > 0;
+  return cfg !== null && cfg.remoteAnchorRegistration && typeof env2.AGENTSHIELD_API_KEY === "string" && env2.AGENTSHIELD_API_KEY.length > 0 && // No anchor store, no registration surface: getAnchorStub throws on an
+  // unbound MCP_OBJECT, so an unbound deployment must 404 like every other
+  // unprovisioned state instead of 500ing per request.
+  env2.MCP_OBJECT !== void 0;
 }
 function deriveRegistrationSid(sessionId) {
   if (isAnchorSid(sessionId))
@@ -142032,41 +142076,37 @@ async function callAnchor(env2, deps, sid, internalPath, body) {
 }
 async function ensureAnchor(env2, cfg, deps, sid, challenge, session) {
   const pin = challenge.challengePin && cfg.allowUnverifiedKeyidHolders ? { type: "keyid", valueSha256: sha256Hex(challenge.challengePin) } : void 0;
-  const created = await callAnchor(env2, deps, sid, INTERNAL_PICKUP_CREATE, {
-    sid,
-    requiredScopes: challenge.requiredScopes,
-    pollIntervalS: cfg.pollIntervalS,
-    anchorTtlS: cfg.anchorTtlS,
-    delegationExpiresInS: cfg.delegationExpiresInS,
-    agentDid: challenge.detectedAgentDid ?? session.agentDid,
-    // Cross-resource claim inputs (drive the minted VC's aud / server_did —
-    // see consent-anchor-bridge's withCrossResourceClaims).
-    ...challenge.audience ? { audience: challenge.audience } : {},
-    ...session.serverDid ? { serverDid: session.serverDid } : {},
-    ...pin ? { pin } : {}
-  });
-  if (created.status !== 201) {
-    return {
-      error: errorResponse(502, "anchor_unavailable", "The anchor store did not accept the registration")
-    };
-  }
-  let reused = false;
+  const anchorUnavailable = {
+    error: errorResponse(502, "anchor_unavailable", "The anchor store did not accept the registration")
+  };
+  let created;
+  let body;
   try {
-    reused = (await created.json()).reused === true;
-  } catch {
+    created = await callAnchor(env2, deps, sid, INTERNAL_PICKUP_CREATE, {
+      sid,
+      requiredScopes: challenge.requiredScopes,
+      pollIntervalS: cfg.pollIntervalS,
+      anchorTtlS: cfg.anchorTtlS,
+      delegationExpiresInS: cfg.delegationExpiresInS,
+      agentDid: challenge.detectedAgentDid ?? session.agentDid,
+      registeredAtMs: session.registeredAtMs,
+      // Cross-resource claim inputs (drive the minted VC's aud / server_did —
+      // see consent-anchor-bridge's withCrossResourceClaims).
+      ...challenge.audience ? { audience: challenge.audience } : {},
+      ...session.serverDid ? { serverDid: session.serverDid } : {},
+      ...pin ? { pin } : {}
+    });
+    if (created.status !== 201)
+      return anchorUnavailable;
+    body = await created.json();
+  } catch (error87) {
+    console.warn(`[kya-http] anchor create failed (sid=${sid}):`, error87 instanceof Error ? error87.message : String(error87));
+    return anchorUnavailable;
   }
-  const readBack = await callAnchor(env2, deps, sid, INTERNAL_PICKUP_INFO, {
-    sid
-  });
-  if (readBack.status !== 200) {
-    return {
-      error: errorResponse(502, "anchor_unavailable", "The registered anchor could not be read back")
-    };
+  if (!body.anchor || !Array.isArray(body.anchor.requiredScopes)) {
+    return anchorUnavailable;
   }
-  return {
-    isNew: !reused,
-    snapshot: await readBack.json()
-  };
+  return { isNew: body.reused !== true, snapshot: body.anchor };
 }
 async function handleAnchorRegistration(c, env2, cfg, deps) {
   if (!registrarAuthorized(env2, c.req.header("Authorization"))) {
@@ -142092,9 +142132,13 @@ async function handleAnchorRegistration(c, env2, cfg, deps) {
     return errorResponse(401, "unauthorized", "This endpoint only accepts challenge registration");
   }
   const sid = deriveRegistrationSid(validated.input.sessionId);
+  if (!challenge.audience) {
+    console.warn(`[kya-http] external registration without challenge.audience (sid=${sid}): the minted credential will FAIL an org-pinned \xA74.3 audience gate; cross-resource use requires the registrar to send challenge.audience`);
+  }
   const anchor = await ensureAnchor(env2, cfg, deps, sid, challenge, {
     agentDid: validated.input.agentDid,
-    serverDid: validated.input.serverDid
+    serverDid: validated.input.serverDid,
+    registeredAtMs: validated.input.createdAt
   });
   if ("error" in anchor)
     return anchor.error;
@@ -142118,17 +142162,24 @@ async function handleAnchorRegistration(c, env2, cfg, deps) {
     console.warn(`[kya-http] registration challenge_proof signing failed (sid=${sid}):`, error87 instanceof Error ? error87.message : String(error87));
     return errorResponse(502, "proof_unavailable", "The challenge proof could not be signed");
   }
+  const createdAtMs = anchor.snapshot.registeredAtMs ?? validated.input.createdAt;
+  const issuedAtMs = anchor.snapshot.issuedAtMs ?? Date.now();
   return new Response(JSON.stringify({
     success: true,
     data: {
       session_id: sid,
       registered: true,
-      created_at: new Date(validated.input.createdAt).toISOString(),
+      created_at: new Date(createdAtMs).toISOString(),
       challenge: {
         consent_uri: consentUri,
         challenge_proof: challengeProof,
         required_scopes: anchor.snapshot.requiredScopes,
-        issued_at: Date.now()
+        issued_at: issuedAtMs,
+        // ADDITIVE diagnostic (not in the frozen conformance key set, ignored
+        // by both existing parsers): whether the minted credential will carry
+        // the §4.3 cross-resource claims. False means no audience was
+        // registered — the credential only self-verifies at this worker.
+        cross_resource: typeof anchor.snapshot.audience === "string"
       }
     }
   }), {
@@ -147549,7 +147600,11 @@ async function mintDelegationVcJwt(env2, sid, info, expiresInS) {
     constraints: {
       scopes: info.requiredScopes,
       notBefore: nowS,
-      notAfter: nowS + expiresInS
+      notAfter: nowS + expiresInS,
+      // §11.7 outer===inner audience invariant (checkpoint's own mints bind the
+      // audience in BOTH the JWT aud and constraints.audience): set the inner
+      // half for cross-resource anchors so verifiers reading either slot agree.
+      ...info.audience ? { audience: info.audience } : {}
     },
     signature: "",
     status: "active",

package/dist/helpers/get-package-versions.js

@@ -78,7 +78,7 @@ export async function getPackageVersions() {
         return {
             "@kya-os/mcp-i": "^1.7.13",
             "@kya-os/cli": "^1.5.9",
-            "@kya-os/mcp-i-cloudflare": "^1.12.0",
+            "@kya-os/mcp-i-cloudflare": "^1.12.1",
             "@kya-os/contracts": "^1.9.0",
         };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/create-mcpi-app",
-  "version": "1.10.2",
+  "version": "1.10.3",
   "description": "Scaffold a new MCP-I application",
   "type": "module",
   "main": "./dist/helpers/index.js",
@@ -59,7 +59,7 @@
     "@kya-os/cli-effects": "^1.0.19",
     "@kya-os/contracts": "^1.9.0",
     "@kya-os/mcp-i": "^1.7.13",
-    "@kya-os/mcp-i-cloudflare": "^1.12.0",
+    "@kya-os/mcp-i-cloudflare": "^1.12.1",
     "base-x": "^5.0.0",
     "chalk": "^4.1.2",
     "commander": "^12.1.0",