@kya-os/create-mcpi-app 1.10.3 → 1.10.4

package/dist/bundles/mix-station.js

@@ -45834,6 +45834,18 @@ var require_oauth_config_service = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.OAuthConfigService = void 0;
     var oauth_config_cache_js_1 = require_oauth_config_cache();
+    function mapProviderSecretMetadata(raw2) {
+      if (!raw2 || typeof raw2 !== "object")
+        return void 0;
+      const m3 = raw2;
+      const metadata = {
+        clientSecretName: m3.clientSecretName ?? m3.client_secret_name,
+        clientIdSecretName: m3.clientIdSecretName ?? m3.client_id_secret_name,
+        apiKeySecretName: m3.apiKeySecretName ?? m3.api_key_secret_name,
+        clientSecretVersion: m3.clientSecretVersion ?? m3.client_secret_version
+      };
+      return metadata;
+    }
     var OAuthConfigService2 = class {
       config;
       constructor(config4) {
@@ -45907,7 +45919,16 @@ var require_oauth_config_service = __commonJS({
               customParams: p3.customParams ?? p3.custom_params,
               tokenEndpointAuthMethod: p3.tokenEndpointAuthMethod ?? p3.token_endpoint_auth_method,
               responseType: p3.responseType ?? p3.response_type,
-              grantType: p3.grantType ?? p3.grant_type
+              grantType: p3.grantType ?? p3.grant_type,
+              // Provider-registry secret metadata (clientSecretName etc.). REQUIRED:
+              // OAuthService.resolveClientSecret resolves a confidential provider's
+              // client secret from secure storage via `metadata.clientSecretName`
+              // (the AgentShield /providers response intentionally omits the plaintext
+              // `clientSecret`). Without mapping this field here, `metadata` is
+              // undefined, resolveClientSecret falls back to the (absent) inline
+              // clientSecret, and the worker sends an empty secret — token exchange
+              // then fails with "client_id and/or client_secret incorrect".
+              metadata: mapProviderSecretMetadata(p3.metadata)
             };
           }
           const configuredProvider = result.data.configuredProvider ?? result.data.configured_provider ?? null;
@@ -141691,7 +141712,7 @@ async function handlePickupInternal(ctx, request, now2) {
 // ../mcp-i-cloudflare/package.json
 var package_default = {
   name: "@kya-os/mcp-i-cloudflare",
-  version: "1.12.1",
+  version: "1.12.2",
   description: "Cloudflare Workers adapter for MCP-I framework",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -141720,9 +141741,9 @@ var package_default = {
   },
   dependencies: {
     "@kya-os/consent": "^0.1.41",
-    "@kya-os/contracts": "^1.9.0",
+    "@kya-os/contracts": "^1.9.1",
     "@kya-os/mcp": "^1.10.1",
-    "@kya-os/mcp-i-core": "^1.8.1",
+    "@kya-os/mcp-i-core": "^1.8.2",
     "@kya-os/mcp-i-runtime": "^1.0.0",
     "@kya-os/provider-registry": "^0.1.7",
     "@modelcontextprotocol/sdk": "^1.25.2",
@@ -147427,6 +147448,190 @@ async function handlePickupGet(c, env2, cfg) {
 init_dist2();
 init_crypto();
 init_storage();
+
+// ../mcp-i-cloudflare/dist/delegation-http/credential-consent.js
+function readString(entry, camel, snake) {
+  const value = entry[camel] ?? entry[snake];
+  return typeof value === "string" ? value : void 0;
+}
+function readRecord(entry, camel, snake) {
+  const value = entry[camel] ?? entry[snake];
+  return value && typeof value === "object" ? value : void 0;
+}
+function isCredentialTyped(entry) {
+  return !!entry && (entry.type === "password" || entry.type === "credential") && entry.configured !== false;
+}
+function buildSuccessCheck(raw2) {
+  if (!raw2)
+    return void 0;
+  const path = typeof raw2.path === "string" ? raw2.path : void 0;
+  const expectedValue = raw2.expectedValue ?? raw2.expected_value;
+  if (!path || expectedValue === void 0)
+    return void 0;
+  if (typeof expectedValue !== "string" && typeof expectedValue !== "boolean" && typeof expectedValue !== "number") {
+    return void 0;
+  }
+  return { path, expectedValue };
+}
+function buildCredentialConfig(entry) {
+  const authEndpoint = readString(entry, "authEndpoint", "auth_endpoint");
+  const requestBodyTemplate = readRecord(entry, "requestBodyTemplate", "request_body_template");
+  const rawResponseFields = readRecord(entry, "responseFields", "response_fields");
+  if (!authEndpoint || !requestBodyTemplate || !rawResponseFields)
+    return null;
+  const sessionToken = readString(rawResponseFields, "sessionToken", "session_token");
+  if (!sessionToken)
+    return null;
+  const responseFields = {
+    sessionToken,
+    userId: readString(rawResponseFields, "userId", "user_id"),
+    userEmail: readString(rawResponseFields, "userEmail", "user_email"),
+    userDisplayName: readString(rawResponseFields, "userDisplayName", "user_display_name"),
+    expiresIn: readString(rawResponseFields, "expiresIn", "expires_in")
+  };
+  const successCheck = buildSuccessCheck(readRecord(entry, "successCheck", "success_check"));
+  const headers = readRecord(entry, "headers", "headers");
+  const tokenUsage = readString(entry, "tokenUsage", "token_usage");
+  const tokenHeader = readString(entry, "tokenHeader", "token_header");
+  const cookieFormat = readString(entry, "cookieFormat", "cookie_format");
+  return {
+    // The handler ignores `type`, but the contract's discriminant is "credential".
+    type: "credential",
+    displayName: readString(entry, "displayName", "display_name"),
+    authEndpoint,
+    requestBodyTemplate,
+    responseFields,
+    ...successCheck ? { successCheck } : {},
+    ...headers ? { headers } : {},
+    ...tokenUsage ? { tokenUsage } : {},
+    ...tokenHeader ? { tokenHeader } : {},
+    ...cookieFormat ? { cookieFormat } : {}
+  };
+}
+async function resolveAnchorCredentialProvider(env2, _scopes) {
+  const apiKey = env2.AGENTSHIELD_API_KEY;
+  const projectId = env2.AGENTSHIELD_PROJECT_ID;
+  if (!apiKey || !projectId)
+    return { status: "none" };
+  const agentShieldUrl = env2.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
+  let providersMap;
+  let configuredProvider;
+  try {
+    const response = await fetch(`${agentShieldUrl}/api/v1/bouncer/projects/${encodeURIComponent(projectId)}/providers`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        "Content-Type": "application/json"
+      }
+    });
+    if (!response.ok)
+      return { status: "unavailable" };
+    const body = await response.json();
+    if (body.success !== true || !body.data || typeof body.data.providers !== "object" || body.data.providers === null) {
+      return { status: "unavailable" };
+    }
+    providersMap = body.data.providers;
+    configuredProvider = body.data.configuredProvider ?? body.data.configured_provider ?? null;
+  } catch {
+    return { status: "unavailable" };
+  }
+  const credentialIds = Object.keys(providersMap).filter((id) => isCredentialTyped(providersMap[id]));
+  if (credentialIds.length === 0)
+    return { status: "none" };
+  const chosenId = configuredProvider && isCredentialTyped(providersMap[configuredProvider]) ? configuredProvider : credentialIds.length === 1 ? credentialIds[0] : null;
+  if (!chosenId)
+    return { status: "unavailable" };
+  const config4 = buildCredentialConfig(providersMap[chosenId]);
+  if (!config4)
+    return { status: "unavailable" };
+  return {
+    status: "credential",
+    provider: {
+      providerId: chosenId,
+      displayName: config4.displayName || chosenId,
+      config: config4
+    }
+  };
+}
+async function resolveCredentialIdentity(env2, params) {
+  const agentShieldUrl = env2.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
+  const apiKey = env2.AGENTSHIELD_API_KEY;
+  if (!apiKey)
+    return { success: false };
+  try {
+    const response = await fetch(`${agentShieldUrl}/api/v1/bouncer/identity/resolve`, {
+      method: "POST",
+      headers: {
+        "X-API-Key": apiKey,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        project_id: params.projectId,
+        credential_result: {
+          provider: params.provider,
+          user_id: params.userId,
+          email: params.userEmail,
+          name: params.userDisplayName
+        }
+      })
+    });
+    if (!response.ok)
+      return { success: false };
+    const data = await response.json();
+    const userDid = data?.data?.user_did;
+    return userDid ? { success: true, userDid } : { success: false };
+  } catch {
+    return { success: false };
+  }
+}
+function sidToDelegationUuid(sid) {
+  const h5 = sha256Hex(sid).slice(0, 32).split("");
+  h5[12] = "4";
+  h5[16] = (parseInt(h5[16], 16) & 3 | 8).toString(16);
+  const s5 = h5.join("");
+  return `${s5.slice(0, 8)}-${s5.slice(8, 12)}-${s5.slice(12, 16)}-${s5.slice(16, 20)}-${s5.slice(20, 32)}`;
+}
+async function notifyDelegation(env2, params) {
+  const apiKey = env2.AGENTSHIELD_API_KEY;
+  const projectId = env2.AGENTSHIELD_PROJECT_ID;
+  if (!apiKey || !projectId)
+    return;
+  const agentShieldUrl = env2.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
+  try {
+    const response = await fetch(`${agentShieldUrl}/api/v1/bouncer/delegations/notify`, {
+      method: "POST",
+      headers: {
+        "X-API-Key": apiKey,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        delegation_id: sidToDelegationUuid(params.sid),
+        agent_did: params.agentDid,
+        agent_name: params.agentName || void 0,
+        user_did: params.userDid,
+        user_id: params.userId || void 0,
+        user_identifier: params.userIdentifier || void 0,
+        scopes: params.scopes,
+        provider: params.provider,
+        project_id: projectId,
+        created_at: (/* @__PURE__ */ new Date()).toISOString(),
+        expires_at: params.expiresAt || void 0,
+        metadata: {
+          source: "mcp-i-anchor-consent",
+          sid: params.sid,
+          ...params.metadata
+        }
+      })
+    });
+    if (!response.ok) {
+      console.warn(`[kya-http] delegation notify failed (non-blocking): ${response.status} sid=${params.sid}`);
+    }
+  } catch (error87) {
+    console.warn(`[kya-http] delegation notify failed (non-blocking): ${error87 instanceof Error ? error87.message : String(error87)} sid=${params.sid}`);
+  }
+}
+
+// ../mcp-i-cloudflare/dist/delegation-http/consent-anchor-bridge.js
 var DO_INTERNAL_ORIGIN2 = "https://do.internal";
 async function callAnchor2(env2, sid, internalPath, body) {
   const stub = getAnchorStub(env2, sid);
@@ -147496,6 +147701,36 @@ function approveFormPage(sid, info, csrfToken) {
 </form>
 </main>`);
 }
+function credentialFieldNames(provider) {
+  const names = [];
+  for (const template of Object.values(provider.config.requestBodyTemplate)) {
+    const match2 = /\{\{(\w+)\}\}/.exec(template);
+    if (match2 && !names.includes(match2[1]))
+      names.push(match2[1]);
+  }
+  return names.length > 0 ? names : ["email", "password"];
+}
+function credentialFormPage(sid, info, provider, csrfToken) {
+  const scopeItems = info.requiredScopes.length > 0 ? info.requiredScopes.map((s5) => `<li class="kya-scope-item">${escapeHtml2(s5)}</li>`).join("") : `<li class="kya-scope-item">No specific permissions required.</li>`;
+  const fieldInputs = credentialFieldNames(provider).map((name16) => {
+    const isSecret = /pass|secret|token|pin/i.test(name16);
+    const label = name16.charAt(0).toUpperCase() + name16.slice(1);
+    return `<label class="kya-field-label" for="kya-field-${escapeHtml2(name16)}">${escapeHtml2(label)}</label>
+<input class="kya-field-input" id="kya-field-${escapeHtml2(name16)}" name="${escapeHtml2(name16)}" type="${isSecret ? "password" : "text"}" autocomplete="${isSecret ? "current-password" : "username"}" required>`;
+  }).join("");
+  return page("Permission Request", `<main class="kya-consent">
+<h1>Sign in to authorize</h1>
+<p class="kya-provider-name">${escapeHtml2(provider.displayName)}</p>
+<p class="kya-permissions-header">This request needs the following permissions:</p>
+<ul class="kya-permissions-list">${scopeItems}</ul>
+<form method="POST" action="/consent/approve?sid=${encodeURIComponent(sid)}">
+<input type="hidden" name="sid" value="${escapeHtml2(sid)}">
+<input type="hidden" name="csrf_token" value="${escapeHtml2(csrfToken)}">
+${fieldInputs}
+<button type="submit" class="kya-consent-allow">Sign in &amp; allow</button>
+</form>
+</main>`);
+}
 function base64UrlEncodeBytes(bytes) {
   return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
@@ -147619,7 +147854,10 @@ async function mintDelegationVcJwt(env2, sid, info, expiresInS) {
   const signingInput = withCrossResourceClaims(unsigned, info, sid);
   const signatureBytes = await cryptoProvider.sign(new TextEncoder().encode(signingInput), signingPrivateKey);
   const signature = base64urlEncodeFromBytes2(signatureBytes);
-  return completeVCJWT2(signingInput, signature);
+  return {
+    vcJwt: completeVCJWT2(signingInput, signature),
+    subjectDid: agentDid
+  };
 }
 async function handleAnchorConsentGet(c, sid, env2, _cfg) {
   const infoResponse = await callAnchor2(env2, sid, INTERNAL_PICKUP_INFO, {
@@ -147634,12 +147872,16 @@ async function handleAnchorConsentGet(c, sid, env2, _cfg) {
   }
   const info = await infoResponse.json();
   const csrfToken = await mintCsrfToken(env2, sid);
+  const resolution = await resolveAnchorCredentialProvider(env2, info.requiredScopes);
+  if (resolution.status === "credential") {
+    return htmlResponse(credentialFormPage(sid, info, resolution.provider, csrfToken), 200);
+  }
   return htmlResponse(approveFormPage(sid, info, csrfToken), 200);
 }
 async function handleAnchorConsentApprove(c, sid, env2, cfg) {
+  const bodyFields = await readBodyFields(c);
   if (!isTestConsentMode(env2)) {
-    const csrfToken = await readCsrfTokenFromBody(c);
-    const valid = await validateCsrfToken(env2, sid, csrfToken);
+    const valid = await validateCsrfToken(env2, sid, bodyFields.csrf_token);
     if (!valid) {
       return htmlResponse(page("Authorization failed", `<main class="kya-consent-failed"><h1>Authorization failed</h1><p>Invalid or missing security token. Please reload and try again.</p></main>`), 403);
     }
@@ -147656,9 +147898,46 @@ async function handleAnchorConsentApprove(c, sid, env2, cfg) {
     return approvalFailedPage("This authorization request could not be loaded. Please start over.", 502);
   }
   const info = await infoResponse.json();
+  const resolution = await resolveAnchorCredentialProvider(env2, info.requiredScopes);
+  if (resolution.status === "unavailable") {
+    return approvalFailedPage("We could not verify the sign-in requirement for this request. Please try again.", 503);
+  }
+  const provider = resolution.status === "credential" ? resolution.provider : null;
+  let authorizedUser = null;
+  if (provider) {
+    const credentials = {};
+    for (const name16 of credentialFieldNames(provider)) {
+      if (bodyFields[name16] !== void 0)
+        credentials[name16] = bodyFields[name16];
+    }
+    const handler = createCredentialAuthHandler({
+      fetch: (...args) => globalThis.fetch(...args),
+      logger: (msg, data) => console.debug(`[kya-http] ${msg}`, data)
+    });
+    const authResult = await handler.authenticate(provider.config, credentials);
+    if (!authResult.success) {
+      return htmlResponse(page("Sign-in failed", `<main class="kya-consent-failed"><h1>Sign-in failed</h1><p>${escapeHtml2(authResult.error || "Those credentials were not accepted. Please try again.")}</p></main>`), 401);
+    }
+    const identity = await resolveCredentialIdentity(env2, {
+      projectId: env2.AGENTSHIELD_PROJECT_ID || "",
+      provider: provider.providerId,
+      userId: authResult.userId || "unknown",
+      userEmail: authResult.userEmail,
+      userDisplayName: authResult.userDisplayName
+    });
+    if (!identity.success || !identity.userDid) {
+      return approvalFailedPage("We signed you in but could not resolve your identity. Please start over.", 500);
+    }
+    authorizedUser = {
+      userDid: identity.userDid,
+      userId: authResult.userId,
+      userEmail: authResult.userEmail
+    };
+  }
   let vcJwt;
+  let subjectDid;
   try {
-    vcJwt = await mintDelegationVcJwt(env2, sid, info, cfg.delegationExpiresInS);
+    ({ vcJwt, subjectDid } = await mintDelegationVcJwt(env2, sid, info, cfg.delegationExpiresInS));
   } catch (error87) {
     console.warn(`[kya-http] delegation mint failed (sid=${sid}):`, error87 instanceof Error ? error87.message : String(error87));
     return approvalFailedPage("We could not complete the authorization. Please start over.", 500);
@@ -147676,24 +147955,46 @@ async function handleAnchorConsentApprove(c, sid, env2, cfg) {
   if (!approveResponse.ok) {
     return approvalFailedPage("We could not complete the authorization. Please start over.", 502);
   }
+  if (authorizedUser && provider) {
+    const report = notifyDelegation(env2, {
+      sid,
+      agentDid: subjectDid,
+      userDid: authorizedUser.userDid,
+      userId: authorizedUser.userId,
+      userIdentifier: authorizedUser.userEmail,
+      scopes: info.requiredScopes,
+      provider: provider.providerId,
+      // Record the same expiry the VC was minted with, matching the OAuth path.
+      expiresAt: new Date(Date.now() + cfg.delegationExpiresInS * 1e3).toISOString()
+    });
+    const execCtx = c.executionCtx;
+    execCtx?.waitUntil?.(report);
+  }
   return successPage();
 }
-async function readCsrfTokenFromBody(c) {
+async function readBodyFields(c) {
+  const out = {};
   const raw2 = c.req?.raw;
   if (!raw2)
-    return void 0;
+    return out;
   try {
     const contentType2 = raw2.headers.get("Content-Type") || "";
     if (contentType2.includes("application/json")) {
-      const body = await raw2.clone().json();
-      const token2 = body?.csrf_token;
-      return typeof token2 === "string" ? token2 : void 0;
+      const body = await raw2.json();
+      for (const [key, value] of Object.entries(body)) {
+        if (typeof value === "string")
+          out[key] = value;
+      }
+      return out;
     }
-    const form = await raw2.clone().formData();
-    const token = form.get("csrf_token");
-    return typeof token === "string" ? token : void 0;
+    const form = await raw2.formData();
+    form.forEach((value, key) => {
+      if (typeof value === "string")
+        out[key] = value;
+    });
+    return out;
   } catch {
-    return void 0;
+    return out;
   }
 }
 

package/dist/helpers/get-package-versions.js

@@ -78,8 +78,8 @@ export async function getPackageVersions() {
         return {
             "@kya-os/mcp-i": "^1.7.13",
             "@kya-os/cli": "^1.5.9",
-            "@kya-os/mcp-i-cloudflare": "^1.12.1",
-            "@kya-os/contracts": "^1.9.0",
+            "@kya-os/mcp-i-cloudflare": "^1.12.2",
+            "@kya-os/contracts": "^1.9.1",
         };
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/create-mcpi-app",
-  "version": "1.10.3",
+  "version": "1.10.4",
   "description": "Scaffold a new MCP-I application",
   "type": "module",
   "main": "./dist/helpers/index.js",
@@ -55,11 +55,11 @@
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "^10.1.1",
-    "@kya-os/cli": "^1.6.1",
+    "@kya-os/cli": "^1.6.2",
     "@kya-os/cli-effects": "^1.0.19",
-    "@kya-os/contracts": "^1.9.0",
+    "@kya-os/contracts": "^1.9.1",
     "@kya-os/mcp-i": "^1.7.13",
-    "@kya-os/mcp-i-cloudflare": "^1.12.1",
+    "@kya-os/mcp-i-cloudflare": "^1.12.2",
     "base-x": "^5.0.0",
     "chalk": "^4.1.2",
     "commander": "^12.1.0",