@kya-os/create-mcpi-app 1.10.2 → 1.10.4

package/dist/bundles/mix-station.js

@@ -45834,6 +45834,18 @@ var require_oauth_config_service = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.OAuthConfigService = void 0;
     var oauth_config_cache_js_1 = require_oauth_config_cache();
+    function mapProviderSecretMetadata(raw2) {
+      if (!raw2 || typeof raw2 !== "object")
+        return void 0;
+      const m3 = raw2;
+      const metadata = {
+        clientSecretName: m3.clientSecretName ?? m3.client_secret_name,
+        clientIdSecretName: m3.clientIdSecretName ?? m3.client_id_secret_name,
+        apiKeySecretName: m3.apiKeySecretName ?? m3.api_key_secret_name,
+        clientSecretVersion: m3.clientSecretVersion ?? m3.client_secret_version
+      };
+      return metadata;
+    }
     var OAuthConfigService2 = class {
       config;
       constructor(config4) {
@@ -45907,7 +45919,16 @@ var require_oauth_config_service = __commonJS({
               customParams: p3.customParams ?? p3.custom_params,
               tokenEndpointAuthMethod: p3.tokenEndpointAuthMethod ?? p3.token_endpoint_auth_method,
               responseType: p3.responseType ?? p3.response_type,
-              grantType: p3.grantType ?? p3.grant_type
+              grantType: p3.grantType ?? p3.grant_type,
+              // Provider-registry secret metadata (clientSecretName etc.). REQUIRED:
+              // OAuthService.resolveClientSecret resolves a confidential provider's
+              // client secret from secure storage via `metadata.clientSecretName`
+              // (the AgentShield /providers response intentionally omits the plaintext
+              // `clientSecret`). Without mapping this field here, `metadata` is
+              // undefined, resolveClientSecret falls back to the (absent) inline
+              // clientSecret, and the worker sends an empty secret — token exchange
+              // then fails with "client_id and/or client_secret incorrect".
+              metadata: mapProviderSecretMetadata(p3.metadata)
             };
           }
           const configuredProvider = result.data.configuredProvider ?? result.data.configured_provider ?? null;
@@ -141492,6 +141513,21 @@ var INTERNAL_PICKUP_INFO = "/_internal/pickup/info";
 
 // ../mcp-i-cloudflare/dist/delegation-http/anchor-do.js
 init_storage_keys();
+function anchorSnapshot(rec) {
+  return {
+    sid: rec.sid,
+    status: rec.status,
+    requiredScopes: rec.requiredScopes,
+    minAssurance: rec.minAssurance,
+    expiresAt: rec.expiresAt,
+    createdAt: rec.createdAt,
+    registeredAtMs: rec.registeredAtMs,
+    issuedAtMs: rec.issuedAtMs,
+    agentDid: rec.agentDid,
+    audience: rec.audience,
+    serverDid: rec.serverDid
+  };
+}
 var pendingBody = () => ({ status: "pending" });
 var pinnedErr = () => ({ error: KYAOS_ERRORS.pickupPinned });
 var invalidSessionErr = () => ({ error: KYAOS_ERRORS.invalidSession });
@@ -141499,7 +141535,12 @@ var pickupExpiredErr = () => ({ error: KYAOS_ERRORS.pickupExpired });
 function reduceCreate(rec, input, now2) {
   const i2 = input;
   if (rec && now2 <= rec.expiresAt) {
-    return { response: { status: 201, body: { success: true, reused: true } } };
+    return {
+      response: {
+        status: 201,
+        body: { success: true, reused: true, anchor: anchorSnapshot(rec) }
+      }
+    };
   }
   const record4 = {
     sid: i2.sid,
@@ -141512,6 +141553,8 @@ function reduceCreate(rec, input, now2) {
     agentDid: typeof i2.agentDid === "string" ? i2.agentDid : void 0,
     audience: typeof i2.audience === "string" ? i2.audience : void 0,
     serverDid: typeof i2.serverDid === "string" ? i2.serverDid : void 0,
+    registeredAtMs: typeof i2.registeredAtMs === "number" ? i2.registeredAtMs : void 0,
+    issuedAtMs: now2,
     pin: i2.pin ? {
       type: i2.pin.type,
       valueSha256: i2.pin.valueSha256,
@@ -141519,7 +141562,13 @@ function reduceCreate(rec, input, now2) {
       source: "challenge"
     } : void 0
   };
-  return { record: record4, response: { status: 201, body: { success: true } } };
+  return {
+    record: record4,
+    response: {
+      status: 201,
+      body: { success: true, anchor: anchorSnapshot(record4) }
+    }
+  };
 }
 function reducePoll(rec, holder, now2) {
   if (!rec) {
@@ -141663,7 +141712,7 @@ async function handlePickupInternal(ctx, request, now2) {
 // ../mcp-i-cloudflare/package.json
 var package_default = {
   name: "@kya-os/mcp-i-cloudflare",
-  version: "1.12.0",
+  version: "1.12.2",
   description: "Cloudflare Workers adapter for MCP-I framework",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -141692,9 +141741,9 @@ var package_default = {
   },
   dependencies: {
     "@kya-os/consent": "^0.1.41",
-    "@kya-os/contracts": "^1.9.0",
+    "@kya-os/contracts": "^1.9.1",
     "@kya-os/mcp": "^1.10.1",
-    "@kya-os/mcp-i-core": "^1.8.1",
+    "@kya-os/mcp-i-core": "^1.8.2",
     "@kya-os/mcp-i-runtime": "^1.0.0",
     "@kya-os/provider-registry": "^0.1.7",
     "@modelcontextprotocol/sdk": "^1.25.2",
@@ -141881,6 +141930,16 @@ function registrationRateLimited(now2) {
 
 // ../mcp-i-cloudflare/dist/delegation-http/anchor-registration-validate.js
 var DID_RE = /^did:(key|web):.+$/;
+var SYNTHETIC_DETECTED_DID_PREFIX = "did:web:detected:";
+function didIssueMessage(value) {
+  if (typeof value !== "string" || !DID_RE.test(value)) {
+    return "Invalid DID format. Must be did:key: or did:web:";
+  }
+  if (value.startsWith(SYNTHETIC_DETECTED_DID_PREFIX)) {
+    return "Synthetic detected DIDs are not valid KYA-OS identities";
+  }
+  return null;
+}
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -141914,17 +141973,17 @@ function validateChallenge(issues, raw2) {
   checkOptionalString(issues, "challenge.pep_surface", raw2.pep_surface, 64);
   checkOptionalString(issues, "challenge.verdict", raw2.verdict, 64);
   checkOptionalString(issues, "challenge.challenge_pin", raw2.challenge_pin, 512);
-  if (raw2.detected_agent_did !== void 0 && (typeof raw2.detected_agent_did !== "string" || !DID_RE.test(raw2.detected_agent_did))) {
-    issues.push({
-      path: "challenge.detected_agent_did",
-      message: "Invalid DID format. Must be did:key: or did:web:"
-    });
+  if (raw2.detected_agent_did !== void 0) {
+    const issue4 = didIssueMessage(raw2.detected_agent_did);
+    if (issue4) {
+      issues.push({ path: "challenge.detected_agent_did", message: issue4 });
+    }
   }
-  if (raw2.audience !== void 0 && (typeof raw2.audience !== "string" || !DID_RE.test(raw2.audience))) {
-    issues.push({
-      path: "challenge.audience",
-      message: "Invalid DID format. Must be did:key: or did:web:"
-    });
+  if (raw2.audience !== void 0) {
+    const issue4 = didIssueMessage(raw2.audience);
+    if (issue4) {
+      issues.push({ path: "challenge.audience", message: issue4 });
+    }
   }
   if (issues.length > issuesBefore)
     return void 0;
@@ -141946,17 +142005,21 @@ function validateRegistrationBody(raw2) {
   }
   const issues = [];
   checkString(issues, "session_id", raw2.session_id, 255);
-  if (typeof raw2.agent_did !== "string" || !DID_RE.test(raw2.agent_did)) {
+  {
+    const issue4 = didIssueMessage(raw2.agent_did);
+    if (issue4)
+      issues.push({ path: "agent_did", message: issue4 });
+  }
+  if (typeof raw2.project_id !== "string" || raw2.project_id.length < 1) {
     issues.push({
-      path: "agent_did",
-      message: "Invalid DID format. Must be did:key: or did:web:"
+      path: "project_id",
+      message: "project_id must be a non-empty string"
     });
   }
-  checkString(issues, "project_id", raw2.project_id, 255);
-  if (typeof raw2.created_at !== "number" || !Number.isInteger(raw2.created_at) || raw2.created_at <= 0) {
+  if (typeof raw2.created_at !== "number" || !Number.isInteger(raw2.created_at) || raw2.created_at <= 0 || raw2.created_at > 864e13) {
     issues.push({
       path: "created_at",
-      message: "created_at must be a positive unix-ms integer"
+      message: "created_at must be a valid positive unix-ms integer"
     });
   }
   const clientInfo = raw2.client_info;
@@ -141969,11 +142032,10 @@ function validateRegistrationBody(raw2) {
     checkString(issues, "client_info.name", clientInfo.name, 255);
     checkOptionalString(issues, "client_info.version", clientInfo.version, 50);
   }
-  if (raw2.server_did !== void 0 && (typeof raw2.server_did !== "string" || !DID_RE.test(raw2.server_did))) {
-    issues.push({
-      path: "server_did",
-      message: "Invalid DID format. Must be did:key: or did:web:"
-    });
+  if (raw2.server_did !== void 0) {
+    const issue4 = didIssueMessage(raw2.server_did);
+    if (issue4)
+      issues.push({ path: "server_did", message: issue4 });
   }
   const challenge = validateChallenge(issues, raw2.challenge);
   if (raw2.challenge !== void 0 && typeof raw2.session_id === "string" && raw2.session_id.length < 22) {
@@ -142002,7 +142064,10 @@ function validateRegistrationBody(raw2) {
 // ../mcp-i-cloudflare/dist/delegation-http/anchor-registration.js
 var DO_INTERNAL_ORIGIN = "https://do.internal";
 function isAnchorRegistrationEnabled(cfg, env2) {
-  return cfg !== null && cfg.remoteAnchorRegistration && typeof env2.AGENTSHIELD_API_KEY === "string" && env2.AGENTSHIELD_API_KEY.length > 0;
+  return cfg !== null && cfg.remoteAnchorRegistration && typeof env2.AGENTSHIELD_API_KEY === "string" && env2.AGENTSHIELD_API_KEY.length > 0 && // No anchor store, no registration surface: getAnchorStub throws on an
+  // unbound MCP_OBJECT, so an unbound deployment must 404 like every other
+  // unprovisioned state instead of 500ing per request.
+  env2.MCP_OBJECT !== void 0;
 }
 function deriveRegistrationSid(sessionId) {
   if (isAnchorSid(sessionId))
@@ -142032,41 +142097,37 @@ async function callAnchor(env2, deps, sid, internalPath, body) {
 }
 async function ensureAnchor(env2, cfg, deps, sid, challenge, session) {
   const pin = challenge.challengePin && cfg.allowUnverifiedKeyidHolders ? { type: "keyid", valueSha256: sha256Hex(challenge.challengePin) } : void 0;
-  const created = await callAnchor(env2, deps, sid, INTERNAL_PICKUP_CREATE, {
-    sid,
-    requiredScopes: challenge.requiredScopes,
-    pollIntervalS: cfg.pollIntervalS,
-    anchorTtlS: cfg.anchorTtlS,
-    delegationExpiresInS: cfg.delegationExpiresInS,
-    agentDid: challenge.detectedAgentDid ?? session.agentDid,
-    // Cross-resource claim inputs (drive the minted VC's aud / server_did —
-    // see consent-anchor-bridge's withCrossResourceClaims).
-    ...challenge.audience ? { audience: challenge.audience } : {},
-    ...session.serverDid ? { serverDid: session.serverDid } : {},
-    ...pin ? { pin } : {}
-  });
-  if (created.status !== 201) {
-    return {
-      error: errorResponse(502, "anchor_unavailable", "The anchor store did not accept the registration")
-    };
-  }
-  let reused = false;
+  const anchorUnavailable = {
+    error: errorResponse(502, "anchor_unavailable", "The anchor store did not accept the registration")
+  };
+  let created;
+  let body;
   try {
-    reused = (await created.json()).reused === true;
-  } catch {
+    created = await callAnchor(env2, deps, sid, INTERNAL_PICKUP_CREATE, {
+      sid,
+      requiredScopes: challenge.requiredScopes,
+      pollIntervalS: cfg.pollIntervalS,
+      anchorTtlS: cfg.anchorTtlS,
+      delegationExpiresInS: cfg.delegationExpiresInS,
+      agentDid: challenge.detectedAgentDid ?? session.agentDid,
+      registeredAtMs: session.registeredAtMs,
+      // Cross-resource claim inputs (drive the minted VC's aud / server_did —
+      // see consent-anchor-bridge's withCrossResourceClaims).
+      ...challenge.audience ? { audience: challenge.audience } : {},
+      ...session.serverDid ? { serverDid: session.serverDid } : {},
+      ...pin ? { pin } : {}
+    });
+    if (created.status !== 201)
+      return anchorUnavailable;
+    body = await created.json();
+  } catch (error87) {
+    console.warn(`[kya-http] anchor create failed (sid=${sid}):`, error87 instanceof Error ? error87.message : String(error87));
+    return anchorUnavailable;
   }
-  const readBack = await callAnchor(env2, deps, sid, INTERNAL_PICKUP_INFO, {
-    sid
-  });
-  if (readBack.status !== 200) {
-    return {
-      error: errorResponse(502, "anchor_unavailable", "The registered anchor could not be read back")
-    };
+  if (!body.anchor || !Array.isArray(body.anchor.requiredScopes)) {
+    return anchorUnavailable;
   }
-  return {
-    isNew: !reused,
-    snapshot: await readBack.json()
-  };
+  return { isNew: body.reused !== true, snapshot: body.anchor };
 }
 async function handleAnchorRegistration(c, env2, cfg, deps) {
   if (!registrarAuthorized(env2, c.req.header("Authorization"))) {
@@ -142092,9 +142153,13 @@ async function handleAnchorRegistration(c, env2, cfg, deps) {
     return errorResponse(401, "unauthorized", "This endpoint only accepts challenge registration");
   }
   const sid = deriveRegistrationSid(validated.input.sessionId);
+  if (!challenge.audience) {
+    console.warn(`[kya-http] external registration without challenge.audience (sid=${sid}): the minted credential will FAIL an org-pinned \xA74.3 audience gate; cross-resource use requires the registrar to send challenge.audience`);
+  }
   const anchor = await ensureAnchor(env2, cfg, deps, sid, challenge, {
     agentDid: validated.input.agentDid,
-    serverDid: validated.input.serverDid
+    serverDid: validated.input.serverDid,
+    registeredAtMs: validated.input.createdAt
   });
   if ("error" in anchor)
     return anchor.error;
@@ -142118,17 +142183,24 @@ async function handleAnchorRegistration(c, env2, cfg, deps) {
     console.warn(`[kya-http] registration challenge_proof signing failed (sid=${sid}):`, error87 instanceof Error ? error87.message : String(error87));
     return errorResponse(502, "proof_unavailable", "The challenge proof could not be signed");
   }
+  const createdAtMs = anchor.snapshot.registeredAtMs ?? validated.input.createdAt;
+  const issuedAtMs = anchor.snapshot.issuedAtMs ?? Date.now();
   return new Response(JSON.stringify({
     success: true,
     data: {
       session_id: sid,
       registered: true,
-      created_at: new Date(validated.input.createdAt).toISOString(),
+      created_at: new Date(createdAtMs).toISOString(),
       challenge: {
         consent_uri: consentUri,
         challenge_proof: challengeProof,
         required_scopes: anchor.snapshot.requiredScopes,
-        issued_at: Date.now()
+        issued_at: issuedAtMs,
+        // ADDITIVE diagnostic (not in the frozen conformance key set, ignored
+        // by both existing parsers): whether the minted credential will carry
+        // the §4.3 cross-resource claims. False means no audience was
+        // registered — the credential only self-verifies at this worker.
+        cross_resource: typeof anchor.snapshot.audience === "string"
       }
     }
   }), {
@@ -147376,6 +147448,190 @@ async function handlePickupGet(c, env2, cfg) {
 init_dist2();
 init_crypto();
 init_storage();
+
+// ../mcp-i-cloudflare/dist/delegation-http/credential-consent.js
+function readString(entry, camel, snake) {
+  const value = entry[camel] ?? entry[snake];
+  return typeof value === "string" ? value : void 0;
+}
+function readRecord(entry, camel, snake) {
+  const value = entry[camel] ?? entry[snake];
+  return value && typeof value === "object" ? value : void 0;
+}
+function isCredentialTyped(entry) {
+  return !!entry && (entry.type === "password" || entry.type === "credential") && entry.configured !== false;
+}
+function buildSuccessCheck(raw2) {
+  if (!raw2)
+    return void 0;
+  const path = typeof raw2.path === "string" ? raw2.path : void 0;
+  const expectedValue = raw2.expectedValue ?? raw2.expected_value;
+  if (!path || expectedValue === void 0)
+    return void 0;
+  if (typeof expectedValue !== "string" && typeof expectedValue !== "boolean" && typeof expectedValue !== "number") {
+    return void 0;
+  }
+  return { path, expectedValue };
+}
+function buildCredentialConfig(entry) {
+  const authEndpoint = readString(entry, "authEndpoint", "auth_endpoint");
+  const requestBodyTemplate = readRecord(entry, "requestBodyTemplate", "request_body_template");
+  const rawResponseFields = readRecord(entry, "responseFields", "response_fields");
+  if (!authEndpoint || !requestBodyTemplate || !rawResponseFields)
+    return null;
+  const sessionToken = readString(rawResponseFields, "sessionToken", "session_token");
+  if (!sessionToken)
+    return null;
+  const responseFields = {
+    sessionToken,
+    userId: readString(rawResponseFields, "userId", "user_id"),
+    userEmail: readString(rawResponseFields, "userEmail", "user_email"),
+    userDisplayName: readString(rawResponseFields, "userDisplayName", "user_display_name"),
+    expiresIn: readString(rawResponseFields, "expiresIn", "expires_in")
+  };
+  const successCheck = buildSuccessCheck(readRecord(entry, "successCheck", "success_check"));
+  const headers = readRecord(entry, "headers", "headers");
+  const tokenUsage = readString(entry, "tokenUsage", "token_usage");
+  const tokenHeader = readString(entry, "tokenHeader", "token_header");
+  const cookieFormat = readString(entry, "cookieFormat", "cookie_format");
+  return {
+    // The handler ignores `type`, but the contract's discriminant is "credential".
+    type: "credential",
+    displayName: readString(entry, "displayName", "display_name"),
+    authEndpoint,
+    requestBodyTemplate,
+    responseFields,
+    ...successCheck ? { successCheck } : {},
+    ...headers ? { headers } : {},
+    ...tokenUsage ? { tokenUsage } : {},
+    ...tokenHeader ? { tokenHeader } : {},
+    ...cookieFormat ? { cookieFormat } : {}
+  };
+}
+async function resolveAnchorCredentialProvider(env2, _scopes) {
+  const apiKey = env2.AGENTSHIELD_API_KEY;
+  const projectId = env2.AGENTSHIELD_PROJECT_ID;
+  if (!apiKey || !projectId)
+    return { status: "none" };
+  const agentShieldUrl = env2.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
+  let providersMap;
+  let configuredProvider;
+  try {
+    const response = await fetch(`${agentShieldUrl}/api/v1/bouncer/projects/${encodeURIComponent(projectId)}/providers`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        "Content-Type": "application/json"
+      }
+    });
+    if (!response.ok)
+      return { status: "unavailable" };
+    const body = await response.json();
+    if (body.success !== true || !body.data || typeof body.data.providers !== "object" || body.data.providers === null) {
+      return { status: "unavailable" };
+    }
+    providersMap = body.data.providers;
+    configuredProvider = body.data.configuredProvider ?? body.data.configured_provider ?? null;
+  } catch {
+    return { status: "unavailable" };
+  }
+  const credentialIds = Object.keys(providersMap).filter((id) => isCredentialTyped(providersMap[id]));
+  if (credentialIds.length === 0)
+    return { status: "none" };
+  const chosenId = configuredProvider && isCredentialTyped(providersMap[configuredProvider]) ? configuredProvider : credentialIds.length === 1 ? credentialIds[0] : null;
+  if (!chosenId)
+    return { status: "unavailable" };
+  const config4 = buildCredentialConfig(providersMap[chosenId]);
+  if (!config4)
+    return { status: "unavailable" };
+  return {
+    status: "credential",
+    provider: {
+      providerId: chosenId,
+      displayName: config4.displayName || chosenId,
+      config: config4
+    }
+  };
+}
+async function resolveCredentialIdentity(env2, params) {
+  const agentShieldUrl = env2.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
+  const apiKey = env2.AGENTSHIELD_API_KEY;
+  if (!apiKey)
+    return { success: false };
+  try {
+    const response = await fetch(`${agentShieldUrl}/api/v1/bouncer/identity/resolve`, {
+      method: "POST",
+      headers: {
+        "X-API-Key": apiKey,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        project_id: params.projectId,
+        credential_result: {
+          provider: params.provider,
+          user_id: params.userId,
+          email: params.userEmail,
+          name: params.userDisplayName
+        }
+      })
+    });
+    if (!response.ok)
+      return { success: false };
+    const data = await response.json();
+    const userDid = data?.data?.user_did;
+    return userDid ? { success: true, userDid } : { success: false };
+  } catch {
+    return { success: false };
+  }
+}
+function sidToDelegationUuid(sid) {
+  const h5 = sha256Hex(sid).slice(0, 32).split("");
+  h5[12] = "4";
+  h5[16] = (parseInt(h5[16], 16) & 3 | 8).toString(16);
+  const s5 = h5.join("");
+  return `${s5.slice(0, 8)}-${s5.slice(8, 12)}-${s5.slice(12, 16)}-${s5.slice(16, 20)}-${s5.slice(20, 32)}`;
+}
+async function notifyDelegation(env2, params) {
+  const apiKey = env2.AGENTSHIELD_API_KEY;
+  const projectId = env2.AGENTSHIELD_PROJECT_ID;
+  if (!apiKey || !projectId)
+    return;
+  const agentShieldUrl = env2.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
+  try {
+    const response = await fetch(`${agentShieldUrl}/api/v1/bouncer/delegations/notify`, {
+      method: "POST",
+      headers: {
+        "X-API-Key": apiKey,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        delegation_id: sidToDelegationUuid(params.sid),
+        agent_did: params.agentDid,
+        agent_name: params.agentName || void 0,
+        user_did: params.userDid,
+        user_id: params.userId || void 0,
+        user_identifier: params.userIdentifier || void 0,
+        scopes: params.scopes,
+        provider: params.provider,
+        project_id: projectId,
+        created_at: (/* @__PURE__ */ new Date()).toISOString(),
+        expires_at: params.expiresAt || void 0,
+        metadata: {
+          source: "mcp-i-anchor-consent",
+          sid: params.sid,
+          ...params.metadata
+        }
+      })
+    });
+    if (!response.ok) {
+      console.warn(`[kya-http] delegation notify failed (non-blocking): ${response.status} sid=${params.sid}`);
+    }
+  } catch (error87) {
+    console.warn(`[kya-http] delegation notify failed (non-blocking): ${error87 instanceof Error ? error87.message : String(error87)} sid=${params.sid}`);
+  }
+}
+
+// ../mcp-i-cloudflare/dist/delegation-http/consent-anchor-bridge.js
 var DO_INTERNAL_ORIGIN2 = "https://do.internal";
 async function callAnchor2(env2, sid, internalPath, body) {
   const stub = getAnchorStub(env2, sid);
@@ -147445,6 +147701,36 @@ function approveFormPage(sid, info, csrfToken) {
 </form>
 </main>`);
 }
+function credentialFieldNames(provider) {
+  const names = [];
+  for (const template of Object.values(provider.config.requestBodyTemplate)) {
+    const match2 = /\{\{(\w+)\}\}/.exec(template);
+    if (match2 && !names.includes(match2[1]))
+      names.push(match2[1]);
+  }
+  return names.length > 0 ? names : ["email", "password"];
+}
+function credentialFormPage(sid, info, provider, csrfToken) {
+  const scopeItems = info.requiredScopes.length > 0 ? info.requiredScopes.map((s5) => `<li class="kya-scope-item">${escapeHtml2(s5)}</li>`).join("") : `<li class="kya-scope-item">No specific permissions required.</li>`;
+  const fieldInputs = credentialFieldNames(provider).map((name16) => {
+    const isSecret = /pass|secret|token|pin/i.test(name16);
+    const label = name16.charAt(0).toUpperCase() + name16.slice(1);
+    return `<label class="kya-field-label" for="kya-field-${escapeHtml2(name16)}">${escapeHtml2(label)}</label>
+<input class="kya-field-input" id="kya-field-${escapeHtml2(name16)}" name="${escapeHtml2(name16)}" type="${isSecret ? "password" : "text"}" autocomplete="${isSecret ? "current-password" : "username"}" required>`;
+  }).join("");
+  return page("Permission Request", `<main class="kya-consent">
+<h1>Sign in to authorize</h1>
+<p class="kya-provider-name">${escapeHtml2(provider.displayName)}</p>
+<p class="kya-permissions-header">This request needs the following permissions:</p>
+<ul class="kya-permissions-list">${scopeItems}</ul>
+<form method="POST" action="/consent/approve?sid=${encodeURIComponent(sid)}">
+<input type="hidden" name="sid" value="${escapeHtml2(sid)}">
+<input type="hidden" name="csrf_token" value="${escapeHtml2(csrfToken)}">
+${fieldInputs}
+<button type="submit" class="kya-consent-allow">Sign in &amp; allow</button>
+</form>
+</main>`);
+}
 function base64UrlEncodeBytes(bytes) {
   return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
@@ -147549,7 +147835,11 @@ async function mintDelegationVcJwt(env2, sid, info, expiresInS) {
     constraints: {
       scopes: info.requiredScopes,
       notBefore: nowS,
-      notAfter: nowS + expiresInS
+      notAfter: nowS + expiresInS,
+      // §11.7 outer===inner audience invariant (checkpoint's own mints bind the
+      // audience in BOTH the JWT aud and constraints.audience): set the inner
+      // half for cross-resource anchors so verifiers reading either slot agree.
+      ...info.audience ? { audience: info.audience } : {}
     },
     signature: "",
     status: "active",
@@ -147564,7 +147854,10 @@ async function mintDelegationVcJwt(env2, sid, info, expiresInS) {
   const signingInput = withCrossResourceClaims(unsigned, info, sid);
   const signatureBytes = await cryptoProvider.sign(new TextEncoder().encode(signingInput), signingPrivateKey);
   const signature = base64urlEncodeFromBytes2(signatureBytes);
-  return completeVCJWT2(signingInput, signature);
+  return {
+    vcJwt: completeVCJWT2(signingInput, signature),
+    subjectDid: agentDid
+  };
 }
 async function handleAnchorConsentGet(c, sid, env2, _cfg) {
   const infoResponse = await callAnchor2(env2, sid, INTERNAL_PICKUP_INFO, {
@@ -147579,12 +147872,16 @@ async function handleAnchorConsentGet(c, sid, env2, _cfg) {
   }
   const info = await infoResponse.json();
   const csrfToken = await mintCsrfToken(env2, sid);
+  const resolution = await resolveAnchorCredentialProvider(env2, info.requiredScopes);
+  if (resolution.status === "credential") {
+    return htmlResponse(credentialFormPage(sid, info, resolution.provider, csrfToken), 200);
+  }
   return htmlResponse(approveFormPage(sid, info, csrfToken), 200);
 }
 async function handleAnchorConsentApprove(c, sid, env2, cfg) {
+  const bodyFields = await readBodyFields(c);
   if (!isTestConsentMode(env2)) {
-    const csrfToken = await readCsrfTokenFromBody(c);
-    const valid = await validateCsrfToken(env2, sid, csrfToken);
+    const valid = await validateCsrfToken(env2, sid, bodyFields.csrf_token);
     if (!valid) {
       return htmlResponse(page("Authorization failed", `<main class="kya-consent-failed"><h1>Authorization failed</h1><p>Invalid or missing security token. Please reload and try again.</p></main>`), 403);
     }
@@ -147601,9 +147898,46 @@ async function handleAnchorConsentApprove(c, sid, env2, cfg) {
     return approvalFailedPage("This authorization request could not be loaded. Please start over.", 502);
   }
   const info = await infoResponse.json();
+  const resolution = await resolveAnchorCredentialProvider(env2, info.requiredScopes);
+  if (resolution.status === "unavailable") {
+    return approvalFailedPage("We could not verify the sign-in requirement for this request. Please try again.", 503);
+  }
+  const provider = resolution.status === "credential" ? resolution.provider : null;
+  let authorizedUser = null;
+  if (provider) {
+    const credentials = {};
+    for (const name16 of credentialFieldNames(provider)) {
+      if (bodyFields[name16] !== void 0)
+        credentials[name16] = bodyFields[name16];
+    }
+    const handler = createCredentialAuthHandler({
+      fetch: (...args) => globalThis.fetch(...args),
+      logger: (msg, data) => console.debug(`[kya-http] ${msg}`, data)
+    });
+    const authResult = await handler.authenticate(provider.config, credentials);
+    if (!authResult.success) {
+      return htmlResponse(page("Sign-in failed", `<main class="kya-consent-failed"><h1>Sign-in failed</h1><p>${escapeHtml2(authResult.error || "Those credentials were not accepted. Please try again.")}</p></main>`), 401);
+    }
+    const identity = await resolveCredentialIdentity(env2, {
+      projectId: env2.AGENTSHIELD_PROJECT_ID || "",
+      provider: provider.providerId,
+      userId: authResult.userId || "unknown",
+      userEmail: authResult.userEmail,
+      userDisplayName: authResult.userDisplayName
+    });
+    if (!identity.success || !identity.userDid) {
+      return approvalFailedPage("We signed you in but could not resolve your identity. Please start over.", 500);
+    }
+    authorizedUser = {
+      userDid: identity.userDid,
+      userId: authResult.userId,
+      userEmail: authResult.userEmail
+    };
+  }
   let vcJwt;
+  let subjectDid;
   try {
-    vcJwt = await mintDelegationVcJwt(env2, sid, info, cfg.delegationExpiresInS);
+    ({ vcJwt, subjectDid } = await mintDelegationVcJwt(env2, sid, info, cfg.delegationExpiresInS));
   } catch (error87) {
     console.warn(`[kya-http] delegation mint failed (sid=${sid}):`, error87 instanceof Error ? error87.message : String(error87));
     return approvalFailedPage("We could not complete the authorization. Please start over.", 500);
@@ -147621,24 +147955,46 @@ async function handleAnchorConsentApprove(c, sid, env2, cfg) {
   if (!approveResponse.ok) {
     return approvalFailedPage("We could not complete the authorization. Please start over.", 502);
   }
+  if (authorizedUser && provider) {
+    const report = notifyDelegation(env2, {
+      sid,
+      agentDid: subjectDid,
+      userDid: authorizedUser.userDid,
+      userId: authorizedUser.userId,
+      userIdentifier: authorizedUser.userEmail,
+      scopes: info.requiredScopes,
+      provider: provider.providerId,
+      // Record the same expiry the VC was minted with, matching the OAuth path.
+      expiresAt: new Date(Date.now() + cfg.delegationExpiresInS * 1e3).toISOString()
+    });
+    const execCtx = c.executionCtx;
+    execCtx?.waitUntil?.(report);
+  }
   return successPage();
 }
-async function readCsrfTokenFromBody(c) {
+async function readBodyFields(c) {
+  const out = {};
   const raw2 = c.req?.raw;
   if (!raw2)
-    return void 0;
+    return out;
   try {
     const contentType2 = raw2.headers.get("Content-Type") || "";
     if (contentType2.includes("application/json")) {
-      const body = await raw2.clone().json();
-      const token2 = body?.csrf_token;
-      return typeof token2 === "string" ? token2 : void 0;
+      const body = await raw2.json();
+      for (const [key, value] of Object.entries(body)) {
+        if (typeof value === "string")
+          out[key] = value;
+      }
+      return out;
     }
-    const form = await raw2.clone().formData();
-    const token = form.get("csrf_token");
-    return typeof token === "string" ? token : void 0;
+    const form = await raw2.formData();
+    form.forEach((value, key) => {
+      if (typeof value === "string")
+        out[key] = value;
+    });
+    return out;
   } catch {
-    return void 0;
+    return out;
   }
 }