@kya-os/create-mcpi-app 1.10.3 → 1.10.5

package/dist/bundles/mix-station.js

@@ -45834,6 +45834,18 @@ var require_oauth_config_service = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.OAuthConfigService = void 0;
     var oauth_config_cache_js_1 = require_oauth_config_cache();
+    function mapProviderSecretMetadata(raw2) {
+      if (!raw2 || typeof raw2 !== "object")
+        return void 0;
+      const m3 = raw2;
+      const metadata = {
+        clientSecretName: m3.clientSecretName ?? m3.client_secret_name,
+        clientIdSecretName: m3.clientIdSecretName ?? m3.client_id_secret_name,
+        apiKeySecretName: m3.apiKeySecretName ?? m3.api_key_secret_name,
+        clientSecretVersion: m3.clientSecretVersion ?? m3.client_secret_version
+      };
+      return metadata;
+    }
     var OAuthConfigService2 = class {
       config;
       constructor(config4) {
@@ -45907,7 +45919,16 @@ var require_oauth_config_service = __commonJS({
               customParams: p3.customParams ?? p3.custom_params,
               tokenEndpointAuthMethod: p3.tokenEndpointAuthMethod ?? p3.token_endpoint_auth_method,
               responseType: p3.responseType ?? p3.response_type,
-              grantType: p3.grantType ?? p3.grant_type
+              grantType: p3.grantType ?? p3.grant_type,
+              // Provider-registry secret metadata (clientSecretName etc.). REQUIRED:
+              // OAuthService.resolveClientSecret resolves a confidential provider's
+              // client secret from secure storage via `metadata.clientSecretName`
+              // (the AgentShield /providers response intentionally omits the plaintext
+              // `clientSecret`). Without mapping this field here, `metadata` is
+              // undefined, resolveClientSecret falls back to the (absent) inline
+              // clientSecret, and the worker sends an empty secret — token exchange
+              // then fails with "client_id and/or client_secret incorrect".
+              metadata: mapProviderSecretMetadata(p3.metadata)
             };
           }
           const configuredProvider = result.data.configuredProvider ?? result.data.configured_provider ?? null;
@@ -141691,7 +141712,7 @@ async function handlePickupInternal(ctx, request, now2) {
 // ../mcp-i-cloudflare/package.json
 var package_default = {
   name: "@kya-os/mcp-i-cloudflare",
-  version: "1.12.1",
+  version: "1.12.3",
   description: "Cloudflare Workers adapter for MCP-I framework",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -141720,9 +141741,9 @@ var package_default = {
   },
   dependencies: {
     "@kya-os/consent": "^0.1.41",
-    "@kya-os/contracts": "^1.9.0",
+    "@kya-os/contracts": "^1.9.2",
     "@kya-os/mcp": "^1.10.1",
-    "@kya-os/mcp-i-core": "^1.8.1",
+    "@kya-os/mcp-i-core": "^1.8.3",
     "@kya-os/mcp-i-runtime": "^1.0.0",
     "@kya-os/provider-registry": "^0.1.7",
     "@modelcontextprotocol/sdk": "^1.25.2",
@@ -147427,6 +147448,215 @@ async function handlePickupGet(c, env2, cfg) {
 init_dist2();
 init_crypto();
 init_storage();
+
+// ../mcp-i-cloudflare/dist/delegation-http/credential-consent.js
+function readString(entry, camel, snake) {
+  const value = entry[camel] ?? entry[snake];
+  return typeof value === "string" ? value : void 0;
+}
+function readRecord(entry, camel, snake) {
+  const value = entry[camel] ?? entry[snake];
+  return value && typeof value === "object" ? value : void 0;
+}
+function isCredentialTyped(entry) {
+  return !!entry && (entry.type === "password" || entry.type === "credential") && entry.configured !== false;
+}
+function buildSuccessCheck(raw2) {
+  if (!raw2)
+    return void 0;
+  const path = typeof raw2.path === "string" ? raw2.path : void 0;
+  const expectedValue = raw2.expectedValue ?? raw2.expected_value;
+  if (!path || expectedValue === void 0)
+    return void 0;
+  if (typeof expectedValue !== "string" && typeof expectedValue !== "boolean" && typeof expectedValue !== "number") {
+    return void 0;
+  }
+  return { path, expectedValue };
+}
+function buildConsentOverrides(raw2) {
+  if (!raw2)
+    return void 0;
+  const branding = readRecord(raw2, "branding", "branding");
+  const formTitle = readString(raw2, "formTitle", "form_title");
+  const formDescription = readString(raw2, "formDescription", "form_description");
+  const identityFieldLabel = readString(raw2, "identityFieldLabel", "identity_field_label");
+  const identityFieldType = readString(raw2, "identityFieldType", "identity_field_type");
+  const passwordFieldLabel = readString(raw2, "passwordFieldLabel", "password_field_label");
+  const submitButtonText = readString(raw2, "submitButtonText", "submit_button_text");
+  if (!branding && !formTitle && !formDescription && !identityFieldLabel && !identityFieldType && !passwordFieldLabel && !submitButtonText) {
+    return void 0;
+  }
+  return {
+    ...branding ? { branding } : {},
+    ...formTitle ? { formTitle } : {},
+    ...formDescription ? { formDescription } : {},
+    ...identityFieldLabel ? { identityFieldLabel } : {},
+    ...identityFieldType ? { identityFieldType } : {},
+    ...passwordFieldLabel ? { passwordFieldLabel } : {},
+    ...submitButtonText ? { submitButtonText } : {}
+  };
+}
+function buildCredentialConfig(entry) {
+  const authEndpoint = readString(entry, "authEndpoint", "auth_endpoint");
+  const requestBodyTemplate = readRecord(entry, "requestBodyTemplate", "request_body_template");
+  const rawResponseFields = readRecord(entry, "responseFields", "response_fields");
+  if (!authEndpoint || !requestBodyTemplate || !rawResponseFields)
+    return null;
+  const sessionToken = readString(rawResponseFields, "sessionToken", "session_token");
+  if (!sessionToken)
+    return null;
+  const responseFields = {
+    sessionToken,
+    userId: readString(rawResponseFields, "userId", "user_id"),
+    userEmail: readString(rawResponseFields, "userEmail", "user_email"),
+    userDisplayName: readString(rawResponseFields, "userDisplayName", "user_display_name"),
+    expiresIn: readString(rawResponseFields, "expiresIn", "expires_in")
+  };
+  const successCheck = buildSuccessCheck(readRecord(entry, "successCheck", "success_check"));
+  const headers = readRecord(entry, "headers", "headers");
+  const tokenUsage = readString(entry, "tokenUsage", "token_usage");
+  const tokenHeader = readString(entry, "tokenHeader", "token_header");
+  const cookieFormat = readString(entry, "cookieFormat", "cookie_format");
+  const consentOverrides = buildConsentOverrides(readRecord(entry, "consentOverrides", "consent_overrides"));
+  return {
+    // The handler ignores `type`, but the contract's discriminant is "credential".
+    type: "credential",
+    displayName: readString(entry, "displayName", "display_name"),
+    authEndpoint,
+    requestBodyTemplate,
+    responseFields,
+    ...successCheck ? { successCheck } : {},
+    ...headers ? { headers } : {},
+    ...tokenUsage ? { tokenUsage } : {},
+    ...tokenHeader ? { tokenHeader } : {},
+    ...cookieFormat ? { cookieFormat } : {},
+    ...consentOverrides ? { consentOverrides } : {}
+  };
+}
+async function resolveAnchorCredentialProvider(env2, _scopes) {
+  const apiKey = env2.AGENTSHIELD_API_KEY;
+  const projectId = env2.AGENTSHIELD_PROJECT_ID;
+  if (!apiKey || !projectId)
+    return { status: "none" };
+  const agentShieldUrl = env2.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
+  let providersMap;
+  let configuredProvider;
+  try {
+    const response = await fetch(`${agentShieldUrl}/api/v1/bouncer/projects/${encodeURIComponent(projectId)}/providers`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        "Content-Type": "application/json"
+      }
+    });
+    if (!response.ok)
+      return { status: "unavailable" };
+    const body = await response.json();
+    if (body.success !== true || !body.data || typeof body.data.providers !== "object" || body.data.providers === null) {
+      return { status: "unavailable" };
+    }
+    providersMap = body.data.providers;
+    configuredProvider = body.data.configuredProvider ?? body.data.configured_provider ?? null;
+  } catch {
+    return { status: "unavailable" };
+  }
+  const credentialIds = Object.keys(providersMap).filter((id) => isCredentialTyped(providersMap[id]));
+  if (credentialIds.length === 0)
+    return { status: "none" };
+  const chosenId = configuredProvider && isCredentialTyped(providersMap[configuredProvider]) ? configuredProvider : credentialIds.length === 1 ? credentialIds[0] : null;
+  if (!chosenId)
+    return { status: "unavailable" };
+  const config4 = buildCredentialConfig(providersMap[chosenId]);
+  if (!config4)
+    return { status: "unavailable" };
+  return {
+    status: "credential",
+    provider: {
+      providerId: chosenId,
+      displayName: config4.displayName || chosenId,
+      config: config4
+    }
+  };
+}
+async function resolveCredentialIdentity(env2, params) {
+  const agentShieldUrl = env2.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
+  const apiKey = env2.AGENTSHIELD_API_KEY;
+  if (!apiKey)
+    return { success: false };
+  try {
+    const response = await fetch(`${agentShieldUrl}/api/v1/bouncer/identity/resolve`, {
+      method: "POST",
+      headers: {
+        "X-API-Key": apiKey,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        project_id: params.projectId,
+        credential_result: {
+          provider: params.provider,
+          user_id: params.userId,
+          email: params.userEmail,
+          name: params.userDisplayName
+        }
+      })
+    });
+    if (!response.ok)
+      return { success: false };
+    const data = await response.json();
+    const userDid = data?.data?.user_did;
+    return userDid ? { success: true, userDid } : { success: false };
+  } catch {
+    return { success: false };
+  }
+}
+function sidToDelegationUuid(sid) {
+  const h5 = sha256Hex(sid).slice(0, 32).split("");
+  h5[12] = "4";
+  h5[16] = (parseInt(h5[16], 16) & 3 | 8).toString(16);
+  const s5 = h5.join("");
+  return `${s5.slice(0, 8)}-${s5.slice(8, 12)}-${s5.slice(12, 16)}-${s5.slice(16, 20)}-${s5.slice(20, 32)}`;
+}
+async function notifyDelegation(env2, params) {
+  const apiKey = env2.AGENTSHIELD_API_KEY;
+  const projectId = env2.AGENTSHIELD_PROJECT_ID;
+  if (!apiKey || !projectId)
+    return;
+  const agentShieldUrl = env2.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
+  try {
+    const response = await fetch(`${agentShieldUrl}/api/v1/bouncer/delegations/notify`, {
+      method: "POST",
+      headers: {
+        "X-API-Key": apiKey,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        delegation_id: sidToDelegationUuid(params.sid),
+        agent_did: params.agentDid,
+        agent_name: params.agentName || void 0,
+        user_did: params.userDid,
+        user_id: params.userId || void 0,
+        user_identifier: params.userIdentifier || void 0,
+        scopes: params.scopes,
+        provider: params.provider,
+        project_id: projectId,
+        created_at: (/* @__PURE__ */ new Date()).toISOString(),
+        expires_at: params.expiresAt || void 0,
+        metadata: {
+          source: "mcp-i-anchor-consent",
+          sid: params.sid,
+          ...params.metadata
+        }
+      })
+    });
+    if (!response.ok) {
+      console.warn(`[kya-http] delegation notify failed (non-blocking): ${response.status} sid=${params.sid}`);
+    }
+  } catch (error87) {
+    console.warn(`[kya-http] delegation notify failed (non-blocking): ${error87 instanceof Error ? error87.message : String(error87)} sid=${params.sid}`);
+  }
+}
+
+// ../mcp-i-cloudflare/dist/delegation-http/consent-anchor-bridge.js
 var DO_INTERNAL_ORIGIN2 = "https://do.internal";
 async function callAnchor2(env2, sid, internalPath, body) {
   const stub = getAnchorStub(env2, sid);
@@ -147446,6 +147676,15 @@ function htmlResponse(html, status) {
     }
   });
 }
+function jsonResponse(body, status) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "Content-Type": "application/json",
+      "Cache-Control": "no-store"
+    }
+  });
+}
 function page(title, bodyInner) {
   return `<!DOCTYPE html>
 <html lang="en">
@@ -147477,24 +147716,111 @@ function approvalFailedPage(message3, status = 410) {
 <p>${escapeHtml2(message3)}</p>
 </main>`), status);
 }
-function successPage() {
-  return htmlResponse(page("Authorization complete", `<main class="kya-consent-success">
-<h1>Authorization complete</h1>
-<p>You have authorized the request. You can close this window and return to the application.</p>
-</main>`), 200);
-}
-function approveFormPage(sid, info, csrfToken) {
-  const scopeItems = info.requiredScopes.length > 0 ? info.requiredScopes.map((s5) => `<li class="kya-scope-item">${escapeHtml2(s5)}</li>`).join("") : `<li class="kya-scope-item">No specific permissions required.</li>`;
-  return page("Permission Request", `<main class="kya-consent">
-<h1>Authorize delegation</h1>
-<p class="kya-permissions-header">This request needs the following permissions:</p>
-<ul class="kya-permissions-list">${scopeItems}</ul>
-<form method="POST" action="/consent/approve?sid=${encodeURIComponent(sid)}">
-<input type="hidden" name="sid" value="${escapeHtml2(sid)}">
-<input type="hidden" name="csrf_token" value="${escapeHtml2(csrfToken)}">
-<button type="submit" class="kya-consent-allow">Allow</button>
-</form>
-</main>`);
+function notFoundJson() {
+  return jsonResponse({
+    error: "We could not find this authorization request. It may have already completed or been cancelled."
+  }, 404);
+}
+function approvalFailedJson(message3, status = 410) {
+  return jsonResponse({ error: message3 }, status);
+}
+function successJson(delegationId) {
+  return jsonResponse({ success: true, delegation_id: delegationId }, 200);
+}
+function resolveAnchorCapabilities(consentConfig, scopes) {
+  if (consentConfig.capabilities && consentConfig.capabilities.length > 0) {
+    return consentConfig.capabilities;
+  }
+  if (scopes.length === 0)
+    return void 0;
+  const derived = resolveCapabilitiesForScopes(scopes);
+  if (derived.length === 0)
+    return void 0;
+  return [{ id: "default", label: "Permissions", capabilities: derived }];
+}
+function renderAnchorConsentShell(params) {
+  const { consentConfig, info, sid, csrfToken, serverUrl, projectId, credential } = params;
+  const cpc = credential?.provider.config;
+  const cpcOverrides = cpc?.consentOverrides;
+  const shellConfig = {
+    branding: consentConfig.branding,
+    terms: consentConfig.terms,
+    customFields: consentConfig.customFields,
+    ui: consentConfig.ui,
+    expirationDays: consentConfig.expirationDays,
+    credentials: credential ? {
+      usernameLabel: cpcOverrides?.identityFieldLabel || consentConfig.credentials?.usernameLabel || "Username",
+      usernamePlaceholder: consentConfig.credentials?.usernamePlaceholder || "Enter your username",
+      passwordLabel: cpcOverrides?.passwordFieldLabel || consentConfig.credentials?.passwordLabel || "Password",
+      passwordPlaceholder: consentConfig.credentials?.passwordPlaceholder || "Enter your password",
+      showRememberMe: consentConfig.credentials?.showRememberMe ?? true,
+      showForgotPassword: consentConfig.credentials?.showForgotPassword ?? false,
+      forgotPasswordUrl: consentConfig.credentials?.forgotPasswordUrl
+    } : consentConfig.credentials
+  };
+  const shellOptions = {
+    config: shellConfig,
+    tool: "",
+    scopes: info.requiredScopes,
+    agentDid: info.agentDid || "",
+    sessionId: sid,
+    projectId,
+    serverUrl,
+    // Browser-tab title only (the in-page heading is `shellConfig.ui.title`,
+    // shared across screens) — surface the provider's display name here for the
+    // credential branch instead of dropping it entirely.
+    pageTitle: credential ? `Sign in to ${credential.provider.displayName}` : "Permission Request",
+    csrfToken,
+    capabilities: resolveAnchorCapabilities(consentConfig, info.requiredScopes),
+    agentMetadata: consentConfig.agentMetadata,
+    consentTheme: consentConfig.theme,
+    headlineVerb: consentConfig.headlineVerb,
+    revocationPath: consentConfig.revocationPath,
+    inactivityDays: consentConfig.inactivityDays,
+    ...credential ? {
+      authMode: "credentials",
+      provider: credential.provider.providerId,
+      authorizationType: "password"
+    } : {}
+  };
+  return generateConsentShell(shellOptions);
+}
+function resolveServerUrl(env2, c) {
+  const configured = env2.MCP_SERVER_URL;
+  if (configured && configured !== "null" && configured.startsWith("http")) {
+    return configured;
+  }
+  const raw2 = c.req?.raw;
+  if (raw2) {
+    try {
+      return new URL(raw2.url).origin;
+    } catch {
+    }
+  }
+  return "";
+}
+async function resolveApproveSid(c) {
+  const query = c.req.query("sid");
+  if (isAnchorSid(query))
+    return query;
+  const raw2 = c.req?.raw;
+  if (!raw2)
+    return void 0;
+  try {
+    const contentType2 = raw2.headers.get("Content-Type") || "";
+    const clone5 = raw2.clone();
+    let candidate;
+    if (contentType2.includes("application/json")) {
+      const body = await clone5.json();
+      candidate = body.sid ?? body.session_id;
+    } else {
+      const form = await clone5.formData();
+      candidate = form.get("sid") ?? form.get("session_id");
+    }
+    return typeof candidate === "string" && isAnchorSid(candidate) ? candidate : void 0;
+  } catch {
+    return void 0;
+  }
 }
 function base64UrlEncodeBytes(bytes) {
   return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
@@ -147619,7 +147945,10 @@ async function mintDelegationVcJwt(env2, sid, info, expiresInS) {
   const signingInput = withCrossResourceClaims(unsigned, info, sid);
   const signatureBytes = await cryptoProvider.sign(new TextEncoder().encode(signingInput), signingPrivateKey);
   const signature = base64urlEncodeFromBytes2(signatureBytes);
-  return completeVCJWT2(signingInput, signature);
+  return {
+    vcJwt: completeVCJWT2(signingInput, signature),
+    subjectDid: agentDid
+  };
 }
 async function handleAnchorConsentGet(c, sid, env2, _cfg) {
   const infoResponse = await callAnchor2(env2, sid, INTERNAL_PICKUP_INFO, {
@@ -147634,34 +147963,93 @@ async function handleAnchorConsentGet(c, sid, env2, _cfg) {
   }
   const info = await infoResponse.json();
   const csrfToken = await mintCsrfToken(env2, sid);
-  return htmlResponse(approveFormPage(sid, info, csrfToken), 200);
+  const projectId = env2.AGENTSHIELD_PROJECT_ID || "";
+  const consentConfig = await new ConsentConfigService(env2).getConsentConfig(projectId);
+  const serverUrl = resolveServerUrl(env2, c);
+  const resolution = await resolveAnchorCredentialProvider(env2, info.requiredScopes);
+  if (resolution.status === "credential") {
+    return htmlResponse(renderAnchorConsentShell({
+      consentConfig,
+      info,
+      sid,
+      csrfToken,
+      serverUrl,
+      projectId,
+      credential: { provider: resolution.provider }
+    }), 200);
+  }
+  return htmlResponse(renderAnchorConsentShell({
+    consentConfig,
+    info,
+    sid,
+    csrfToken,
+    serverUrl,
+    projectId
+  }), 200);
 }
 async function handleAnchorConsentApprove(c, sid, env2, cfg) {
+  const bodyFields = await readBodyFields(c);
   if (!isTestConsentMode(env2)) {
-    const csrfToken = await readCsrfTokenFromBody(c);
-    const valid = await validateCsrfToken(env2, sid, csrfToken);
+    const valid = await validateCsrfToken(env2, sid, bodyFields.csrf_token);
     if (!valid) {
-      return htmlResponse(page("Authorization failed", `<main class="kya-consent-failed"><h1>Authorization failed</h1><p>Invalid or missing security token. Please reload and try again.</p></main>`), 403);
+      return jsonResponse({
+        error: "Invalid or missing security token. Please reload and try again."
+      }, 403);
     }
   }
   const infoResponse = await callAnchor2(env2, sid, INTERNAL_PICKUP_INFO, {
     sid
   });
   if (infoResponse.status === 404)
-    return notFoundPage();
+    return notFoundJson();
   if (infoResponse.status === 410) {
-    return approvalFailedPage("This authorization request has expired. Nothing was authorized.");
+    return approvalFailedJson("This authorization request has expired. Nothing was authorized.");
   }
   if (!infoResponse.ok) {
-    return approvalFailedPage("This authorization request could not be loaded. Please start over.", 502);
+    return approvalFailedJson("This authorization request could not be loaded. Please start over.", 502);
   }
   const info = await infoResponse.json();
+  const resolution = await resolveAnchorCredentialProvider(env2, info.requiredScopes);
+  if (resolution.status === "unavailable") {
+    return approvalFailedJson("We could not verify the sign-in requirement for this request. Please try again.", 503);
+  }
+  const provider = resolution.status === "credential" ? resolution.provider : null;
+  let authorizedUser = null;
+  if (provider) {
+    const { sid: _sid, csrf_token: _csrfToken, tool: _tool, scopes: _scopes, agent_did: _agentDid, session_id: _sessionId, project_id: _projectId, provider: _providerField, provider_type: _providerType, auth_mode: _authMode, termsAccepted: _termsAccepted, credential_provider_type: _credentialProviderType, credential_provider: _credentialProvider, oauth_provider_type: _oauthProviderType, user_did: _userDid, credential_user_email: _credentialUserEmail, credential_provider_user_id: _credentialProviderUserId, ...credentials } = bodyFields;
+    const handler = createCredentialAuthHandler({
+      fetch: (...args) => globalThis.fetch(...args),
+      logger: (msg, data) => console.debug(`[kya-http] ${msg}`, data)
+    });
+    const authResult = await handler.authenticate(provider.config, credentials);
+    if (!authResult.success) {
+      return jsonResponse({
+        error: authResult.error || "Those credentials were not accepted. Please try again."
+      }, 401);
+    }
+    const identity = await resolveCredentialIdentity(env2, {
+      projectId: env2.AGENTSHIELD_PROJECT_ID || "",
+      provider: provider.providerId,
+      userId: authResult.userId || "unknown",
+      userEmail: authResult.userEmail,
+      userDisplayName: authResult.userDisplayName
+    });
+    if (!identity.success || !identity.userDid) {
+      return approvalFailedJson("We signed you in but could not resolve your identity. Please start over.", 500);
+    }
+    authorizedUser = {
+      userDid: identity.userDid,
+      userId: authResult.userId,
+      userEmail: authResult.userEmail
+    };
+  }
   let vcJwt;
+  let subjectDid;
   try {
-    vcJwt = await mintDelegationVcJwt(env2, sid, info, cfg.delegationExpiresInS);
+    ({ vcJwt, subjectDid } = await mintDelegationVcJwt(env2, sid, info, cfg.delegationExpiresInS));
   } catch (error87) {
     console.warn(`[kya-http] delegation mint failed (sid=${sid}):`, error87 instanceof Error ? error87.message : String(error87));
-    return approvalFailedPage("We could not complete the authorization. Please start over.", 500);
+    return approvalFailedJson("We could not complete the authorization. Please start over.", 500);
   }
   const approveResponse = await callAnchor2(env2, sid, INTERNAL_PICKUP_APPROVE, {
     sid,
@@ -147669,31 +148057,53 @@ async function handleAnchorConsentApprove(c, sid, env2, cfg) {
     expiresInS: cfg.delegationExpiresInS
   });
   if (approveResponse.status === 410) {
-    return approvalFailedPage("This authorization request expired before it could be completed. Nothing was authorized.");
+    return approvalFailedJson("This authorization request expired before it could be completed. Nothing was authorized.");
   }
   if (approveResponse.status === 404)
-    return notFoundPage();
+    return notFoundJson();
   if (!approveResponse.ok) {
-    return approvalFailedPage("We could not complete the authorization. Please start over.", 502);
+    return approvalFailedJson("We could not complete the authorization. Please start over.", 502);
   }
-  return successPage();
+  if (authorizedUser && provider) {
+    const report = notifyDelegation(env2, {
+      sid,
+      agentDid: subjectDid,
+      userDid: authorizedUser.userDid,
+      userId: authorizedUser.userId,
+      userIdentifier: authorizedUser.userEmail,
+      scopes: info.requiredScopes,
+      provider: provider.providerId,
+      // Record the same expiry the VC was minted with, matching the OAuth path.
+      expiresAt: new Date(Date.now() + cfg.delegationExpiresInS * 1e3).toISOString()
+    });
+    const execCtx = c.executionCtx;
+    execCtx?.waitUntil?.(report);
+  }
+  return successJson(`urn:uuid:${sid}`);
 }
-async function readCsrfTokenFromBody(c) {
+async function readBodyFields(c) {
+  const out = {};
   const raw2 = c.req?.raw;
   if (!raw2)
-    return void 0;
+    return out;
   try {
     const contentType2 = raw2.headers.get("Content-Type") || "";
     if (contentType2.includes("application/json")) {
-      const body = await raw2.clone().json();
-      const token2 = body?.csrf_token;
-      return typeof token2 === "string" ? token2 : void 0;
+      const body = await raw2.json();
+      for (const [key, value] of Object.entries(body)) {
+        if (typeof value === "string")
+          out[key] = value;
+      }
+      return out;
     }
-    const form = await raw2.clone().formData();
-    const token = form.get("csrf_token");
-    return typeof token === "string" ? token : void 0;
+    const form = await raw2.formData();
+    form.forEach((value, key) => {
+      if (typeof value === "string")
+        out[key] = value;
+    });
+    return out;
   } catch {
-    return void 0;
+    return out;
   }
 }
 
@@ -147723,8 +148133,10 @@ function registerDelegationHttpRoutes(app, options, deps) {
   });
   app.post(`${CONSENT_ROUTE}/approve`, async (c, next) => {
     const { env: env2, cfg } = resolveRequest(c, options);
-    const sid = c.req.query("sid");
-    if (!cfg || !isAnchorSid(sid))
+    if (!cfg)
+      return next();
+    const sid = await resolveApproveSid(c);
+    if (!isAnchorSid(sid))
       return next();
     return handleAnchorConsentApprove(c, sid, env2, cfg);
   });

package/dist/helpers/get-package-versions.js

@@ -78,8 +78,8 @@ export async function getPackageVersions() {
         return {
             "@kya-os/mcp-i": "^1.7.13",
             "@kya-os/cli": "^1.5.9",
-            "@kya-os/mcp-i-cloudflare": "^1.12.1",
-            "@kya-os/contracts": "^1.9.0",
+            "@kya-os/mcp-i-cloudflare": "^1.12.3",
+            "@kya-os/contracts": "^1.9.2",
         };
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/create-mcpi-app",
-  "version": "1.10.3",
+  "version": "1.10.5",
   "description": "Scaffold a new MCP-I application",
   "type": "module",
   "main": "./dist/helpers/index.js",
@@ -55,11 +55,11 @@
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "^10.1.1",
-    "@kya-os/cli": "^1.6.1",
+    "@kya-os/cli": "^1.6.3",
     "@kya-os/cli-effects": "^1.0.19",
-    "@kya-os/contracts": "^1.9.0",
+    "@kya-os/contracts": "^1.9.2",
     "@kya-os/mcp-i": "^1.7.13",
-    "@kya-os/mcp-i-cloudflare": "^1.12.1",
+    "@kya-os/mcp-i-cloudflare": "^1.12.3",
     "base-x": "^5.0.0",
     "chalk": "^4.1.2",
     "commander": "^12.1.0",