@kya-os/create-mcpi-app 1.11.2 → 1.11.3

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @kya-os/create-mcpi-app@1.11.2 build /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app
+> @kya-os/create-mcpi-app@1.11.3 build /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app
 > tsc && chmod +x dist/index.js && node --import tsx scripts/build-bundles.ts
 
 🔨 Building template bundles...
@@ -7,23 +7,23 @@
 
 📦 Building template: blank
   ✅ Source files written to /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/.tmp-bundles/blank
-  ✅ Bundle built: 8169879 bytes, hash: sha256:a41e8aaff5b47...
+  ✅ Bundle built: 8170758 bytes, hash: sha256:72e778e39a337...
 
 📦 Building template: hardware-world
   ✅ Source files written to /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/.tmp-bundles/hardware-world
-  ✅ Bundle built: 8182298 bytes, hash: sha256:53b53d9d5fbec...
+  ✅ Bundle built: 8183177 bytes, hash: sha256:1edd8330eddd7...
 
 📦 Building template: ecommerce
   ✅ Source files written to /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/.tmp-bundles/ecommerce
-  ✅ Bundle built: 8171573 bytes, hash: sha256:409344a00bc6b...
+  ✅ Bundle built: 8172452 bytes, hash: sha256:09a58de753d02...
 
 📦 Building template: mix-station
   ✅ Source files written to /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/.tmp-bundles/mix-station
-  ✅ Bundle built: 8184923 bytes, hash: sha256:1caa1051b3d6c...
+  ✅ Bundle built: 8185802 bytes, hash: sha256:0c29ba4e04375...
 
 ✅ All bundles built successfully!
    Output: /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/bundles
-   Version: 1.11.2
-   Framework: 1.14.2
+   Version: 1.11.3
+   Framework: 1.14.3
    Templates: blank, hardware-world, ecommerce, mix-station
    Manifest: /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/bundles/manifest.json

package/dist/bundles/blank.js

@@ -159215,9 +159215,11 @@ var import_config = __toESM(require_config2());
 
 // ../mcp-i-cloudflare/dist/delegation-http/remote-issuer.js
 var import_json_canonicalize7 = __toESM(require_index_umd());
+init_esm2();
 init_native_fetch();
 init_native_http();
 var encoder8 = new TextEncoder();
+var sourceIpSchema = external_exports2.string().max(45).ip();
 var fail = () => {
   throw new Error("Native issuer capability unavailable");
 };
@@ -159249,12 +159251,22 @@ function resolveManagedNativeIssuer(env2) {
     return null;
   try {
     const binding = JSON.parse(env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG);
-    if (!binding || Object.keys(binding).length !== 6 || binding.version !== 1 || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(binding.projectId) || !/^did:web:[^/?#]+:orgs:[a-z0-9][a-z0-9-]*$/.test(binding.issuerDid) || bytes(binding.issuerPublicKey).length !== 32 || !isOrigin(binding.authorizationOrigin) || !isOrigin(binding.controlPlaneOrigin) || !env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY || env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY !== env2.AGENTSHIELD_API_KEY || env2.CHECKPOINT_API_KEY !== void 0 && env2.CHECKPOINT_API_KEY !== env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
+    if (!binding || env2.MCPI_NATIVE_HTTP_INGRESS !== void 0 && env2.MCPI_NATIVE_HTTP_INGRESS !== "cloudflare-dispatch" || Object.keys(binding).length !== 6 || binding.version !== 1 || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(binding.projectId) || !/^did:web:[^/?#]+:orgs:[a-z0-9][a-z0-9-]*$/.test(binding.issuerDid) || bytes(binding.issuerPublicKey).length !== 32 || !isOrigin(binding.authorizationOrigin) || !isOrigin(binding.controlPlaneOrigin) || !env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY || env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY !== env2.AGENTSHIELD_API_KEY || env2.CHECKPOINT_API_KEY !== void 0 && env2.CHECKPOINT_API_KEY !== env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
       return null;
     return {
       authorizationOrigin: binding.authorizationOrigin,
       issuerDid: binding.issuerDid,
       projectId: binding.projectId,
+      // Isolated WfP workers cannot access request.cf. This deployment-owned
+      // opt-in is valid only behind a Cloudflare dispatch ingress that passes
+      // Cloudflare's CF-Connecting-IP unchanged. Never infer trust from a header
+      // supplied by the caller, or fall back to X-Forwarded-For / X-Real-IP.
+      ...env2.MCPI_NATIVE_HTTP_INGRESS === "cloudflare-dispatch" ? {
+        resolveSourceIp: (request) => {
+          const ip = request.headers.get("CF-Connecting-IP");
+          return sourceIpSchema.safeParse(ip).success ? ip : null;
+        }
+      } : {},
       remoteIssuer: createRemoteIssuer(binding, env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
     };
   } catch {
@@ -159561,6 +159573,7 @@ function mapPrefixedEnv(env2, prefix) {
     MCP_IDENTITY_PUBLIC_KEY: typeof env2.MCP_IDENTITY_PUBLIC_KEY === "string" ? env2.MCP_IDENTITY_PUBLIC_KEY : void 0,
     MCP_IDENTITY_AGENT_DID: typeof env2.MCP_IDENTITY_AGENT_DID === "string" ? env2.MCP_IDENTITY_AGENT_DID : void 0,
     MCPI_NATIVE_HTTP_ISSUER_CONFIG: typeof env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG === "string" ? env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG : void 0,
+    MCPI_NATIVE_HTTP_INGRESS: typeof env2.MCPI_NATIVE_HTTP_INGRESS === "string" ? env2.MCPI_NATIVE_HTTP_INGRESS : void 0,
     MCPI_NATIVE_HTTP_ISSUER_API_KEY: typeof env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY === "string" ? env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY : void 0,
     AGENTSHIELD_API_URL: typeof env2.AGENTSHIELD_API_URL === "string" ? env2.AGENTSHIELD_API_URL : void 0,
     AGENTSHIELD_API_KEY: typeof env2.AGENTSHIELD_API_KEY === "string" ? env2.AGENTSHIELD_API_KEY : void 0,
@@ -159887,7 +159900,7 @@ async function handlePickupInternal(ctx, request, now2) {
 // ../mcp-i-cloudflare/package.json
 var package_default = {
   name: "@kya-os/mcp-i-cloudflare",
-  version: "1.14.2",
+  version: "1.14.3",
   description: "Cloudflare Workers adapter for MCP-I framework",
   main: "dist/index.js",
   types: "dist/index.d.ts",

package/dist/bundles/ecommerce.js

@@ -159215,9 +159215,11 @@ var import_config = __toESM(require_config2());
 
 // ../mcp-i-cloudflare/dist/delegation-http/remote-issuer.js
 var import_json_canonicalize7 = __toESM(require_index_umd());
+init_esm2();
 init_native_fetch();
 init_native_http();
 var encoder8 = new TextEncoder();
+var sourceIpSchema = external_exports2.string().max(45).ip();
 var fail = () => {
   throw new Error("Native issuer capability unavailable");
 };
@@ -159249,12 +159251,22 @@ function resolveManagedNativeIssuer(env2) {
     return null;
   try {
     const binding = JSON.parse(env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG);
-    if (!binding || Object.keys(binding).length !== 6 || binding.version !== 1 || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(binding.projectId) || !/^did:web:[^/?#]+:orgs:[a-z0-9][a-z0-9-]*$/.test(binding.issuerDid) || bytes(binding.issuerPublicKey).length !== 32 || !isOrigin(binding.authorizationOrigin) || !isOrigin(binding.controlPlaneOrigin) || !env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY || env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY !== env2.AGENTSHIELD_API_KEY || env2.CHECKPOINT_API_KEY !== void 0 && env2.CHECKPOINT_API_KEY !== env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
+    if (!binding || env2.MCPI_NATIVE_HTTP_INGRESS !== void 0 && env2.MCPI_NATIVE_HTTP_INGRESS !== "cloudflare-dispatch" || Object.keys(binding).length !== 6 || binding.version !== 1 || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(binding.projectId) || !/^did:web:[^/?#]+:orgs:[a-z0-9][a-z0-9-]*$/.test(binding.issuerDid) || bytes(binding.issuerPublicKey).length !== 32 || !isOrigin(binding.authorizationOrigin) || !isOrigin(binding.controlPlaneOrigin) || !env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY || env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY !== env2.AGENTSHIELD_API_KEY || env2.CHECKPOINT_API_KEY !== void 0 && env2.CHECKPOINT_API_KEY !== env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
       return null;
     return {
       authorizationOrigin: binding.authorizationOrigin,
       issuerDid: binding.issuerDid,
       projectId: binding.projectId,
+      // Isolated WfP workers cannot access request.cf. This deployment-owned
+      // opt-in is valid only behind a Cloudflare dispatch ingress that passes
+      // Cloudflare's CF-Connecting-IP unchanged. Never infer trust from a header
+      // supplied by the caller, or fall back to X-Forwarded-For / X-Real-IP.
+      ...env2.MCPI_NATIVE_HTTP_INGRESS === "cloudflare-dispatch" ? {
+        resolveSourceIp: (request) => {
+          const ip = request.headers.get("CF-Connecting-IP");
+          return sourceIpSchema.safeParse(ip).success ? ip : null;
+        }
+      } : {},
       remoteIssuer: createRemoteIssuer(binding, env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
     };
   } catch {
@@ -159561,6 +159573,7 @@ function mapPrefixedEnv(env2, prefix) {
     MCP_IDENTITY_PUBLIC_KEY: typeof env2.MCP_IDENTITY_PUBLIC_KEY === "string" ? env2.MCP_IDENTITY_PUBLIC_KEY : void 0,
     MCP_IDENTITY_AGENT_DID: typeof env2.MCP_IDENTITY_AGENT_DID === "string" ? env2.MCP_IDENTITY_AGENT_DID : void 0,
     MCPI_NATIVE_HTTP_ISSUER_CONFIG: typeof env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG === "string" ? env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG : void 0,
+    MCPI_NATIVE_HTTP_INGRESS: typeof env2.MCPI_NATIVE_HTTP_INGRESS === "string" ? env2.MCPI_NATIVE_HTTP_INGRESS : void 0,
     MCPI_NATIVE_HTTP_ISSUER_API_KEY: typeof env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY === "string" ? env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY : void 0,
     AGENTSHIELD_API_URL: typeof env2.AGENTSHIELD_API_URL === "string" ? env2.AGENTSHIELD_API_URL : void 0,
     AGENTSHIELD_API_KEY: typeof env2.AGENTSHIELD_API_KEY === "string" ? env2.AGENTSHIELD_API_KEY : void 0,
@@ -159887,7 +159900,7 @@ async function handlePickupInternal(ctx, request, now2) {
 // ../mcp-i-cloudflare/package.json
 var package_default = {
   name: "@kya-os/mcp-i-cloudflare",
-  version: "1.14.2",
+  version: "1.14.3",
   description: "Cloudflare Workers adapter for MCP-I framework",
   main: "dist/index.js",
   types: "dist/index.d.ts",

package/dist/bundles/hardware-world.js

@@ -159215,9 +159215,11 @@ var import_config = __toESM(require_config2());
 
 // ../mcp-i-cloudflare/dist/delegation-http/remote-issuer.js
 var import_json_canonicalize7 = __toESM(require_index_umd());
+init_esm2();
 init_native_fetch();
 init_native_http();
 var encoder8 = new TextEncoder();
+var sourceIpSchema = external_exports2.string().max(45).ip();
 var fail = () => {
   throw new Error("Native issuer capability unavailable");
 };
@@ -159249,12 +159251,22 @@ function resolveManagedNativeIssuer(env2) {
     return null;
   try {
     const binding = JSON.parse(env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG);
-    if (!binding || Object.keys(binding).length !== 6 || binding.version !== 1 || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(binding.projectId) || !/^did:web:[^/?#]+:orgs:[a-z0-9][a-z0-9-]*$/.test(binding.issuerDid) || bytes(binding.issuerPublicKey).length !== 32 || !isOrigin(binding.authorizationOrigin) || !isOrigin(binding.controlPlaneOrigin) || !env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY || env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY !== env2.AGENTSHIELD_API_KEY || env2.CHECKPOINT_API_KEY !== void 0 && env2.CHECKPOINT_API_KEY !== env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
+    if (!binding || env2.MCPI_NATIVE_HTTP_INGRESS !== void 0 && env2.MCPI_NATIVE_HTTP_INGRESS !== "cloudflare-dispatch" || Object.keys(binding).length !== 6 || binding.version !== 1 || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(binding.projectId) || !/^did:web:[^/?#]+:orgs:[a-z0-9][a-z0-9-]*$/.test(binding.issuerDid) || bytes(binding.issuerPublicKey).length !== 32 || !isOrigin(binding.authorizationOrigin) || !isOrigin(binding.controlPlaneOrigin) || !env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY || env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY !== env2.AGENTSHIELD_API_KEY || env2.CHECKPOINT_API_KEY !== void 0 && env2.CHECKPOINT_API_KEY !== env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
       return null;
     return {
       authorizationOrigin: binding.authorizationOrigin,
       issuerDid: binding.issuerDid,
       projectId: binding.projectId,
+      // Isolated WfP workers cannot access request.cf. This deployment-owned
+      // opt-in is valid only behind a Cloudflare dispatch ingress that passes
+      // Cloudflare's CF-Connecting-IP unchanged. Never infer trust from a header
+      // supplied by the caller, or fall back to X-Forwarded-For / X-Real-IP.
+      ...env2.MCPI_NATIVE_HTTP_INGRESS === "cloudflare-dispatch" ? {
+        resolveSourceIp: (request) => {
+          const ip = request.headers.get("CF-Connecting-IP");
+          return sourceIpSchema.safeParse(ip).success ? ip : null;
+        }
+      } : {},
       remoteIssuer: createRemoteIssuer(binding, env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
     };
   } catch {
@@ -159561,6 +159573,7 @@ function mapPrefixedEnv(env2, prefix) {
     MCP_IDENTITY_PUBLIC_KEY: typeof env2.MCP_IDENTITY_PUBLIC_KEY === "string" ? env2.MCP_IDENTITY_PUBLIC_KEY : void 0,
     MCP_IDENTITY_AGENT_DID: typeof env2.MCP_IDENTITY_AGENT_DID === "string" ? env2.MCP_IDENTITY_AGENT_DID : void 0,
     MCPI_NATIVE_HTTP_ISSUER_CONFIG: typeof env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG === "string" ? env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG : void 0,
+    MCPI_NATIVE_HTTP_INGRESS: typeof env2.MCPI_NATIVE_HTTP_INGRESS === "string" ? env2.MCPI_NATIVE_HTTP_INGRESS : void 0,
     MCPI_NATIVE_HTTP_ISSUER_API_KEY: typeof env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY === "string" ? env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY : void 0,
     AGENTSHIELD_API_URL: typeof env2.AGENTSHIELD_API_URL === "string" ? env2.AGENTSHIELD_API_URL : void 0,
     AGENTSHIELD_API_KEY: typeof env2.AGENTSHIELD_API_KEY === "string" ? env2.AGENTSHIELD_API_KEY : void 0,
@@ -159887,7 +159900,7 @@ async function handlePickupInternal(ctx, request, now2) {
 // ../mcp-i-cloudflare/package.json
 var package_default = {
   name: "@kya-os/mcp-i-cloudflare",
-  version: "1.14.2",
+  version: "1.14.3",
   description: "Cloudflare Workers adapter for MCP-I framework",
   main: "dist/index.js",
   types: "dist/index.d.ts",

package/dist/bundles/manifest.json

@@ -1,29 +1,29 @@
 {
-  "version": "1.11.2",
-  "frameworkVersion": "1.14.2",
+  "version": "1.11.3",
+  "frameworkVersion": "1.14.3",
   "doClassName": "MCPIAgent",
   "auditDoClassName": "AuditProducer",
-  "buildDate": "2026-09-15T20:52:10.037Z",
+  "buildDate": "2026-09-16T00:51:29.426Z",
   "templates": {
     "blank": {
       "file": "blank.js",
-      "size": 8169879,
-      "hash": "sha256:a41e8aaff5b47df24cd40fda14f1b82250145fc770e13d691690bd62719462bb"
+      "size": 8170758,
+      "hash": "sha256:72e778e39a3371b5c554e40416412040b0d73ad621aff3f61a7576475ebd7b5c"
     },
     "hardware-world": {
       "file": "hardware-world.js",
-      "size": 8182298,
-      "hash": "sha256:53b53d9d5fbec2def7855d5075f31ce6a3b3bae476cd2bb6c2b778a114741c68"
+      "size": 8183177,
+      "hash": "sha256:1edd8330eddd7af048c972cdc00a76c7c58a01b30d9a740648b74e7710a6635b"
     },
     "ecommerce": {
       "file": "ecommerce.js",
-      "size": 8171573,
-      "hash": "sha256:409344a00bc6b6637442ded50c562eb45f312e7e109a65dcc22cad318e3a1ec8"
+      "size": 8172452,
+      "hash": "sha256:09a58de753d02f25f3a9cb59edf9f2696f876352beebf4cc4d74f04c20ac4527"
     },
     "mix-station": {
       "file": "mix-station.js",
-      "size": 8184923,
-      "hash": "sha256:1caa1051b3d6cd9959ef99f60af821c28cb420d6359fe535ec33824824f0efde"
+      "size": 8185802,
+      "hash": "sha256:0c29ba4e04375e595401be3916cc35d49400861287f4c8c4ccfa69c999612396"
     }
   }
 }

package/dist/bundles/mix-station.js

@@ -159215,9 +159215,11 @@ var import_config = __toESM(require_config2());
 
 // ../mcp-i-cloudflare/dist/delegation-http/remote-issuer.js
 var import_json_canonicalize7 = __toESM(require_index_umd());
+init_esm2();
 init_native_fetch();
 init_native_http();
 var encoder8 = new TextEncoder();
+var sourceIpSchema = external_exports2.string().max(45).ip();
 var fail = () => {
   throw new Error("Native issuer capability unavailable");
 };
@@ -159249,12 +159251,22 @@ function resolveManagedNativeIssuer(env2) {
     return null;
   try {
     const binding = JSON.parse(env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG);
-    if (!binding || Object.keys(binding).length !== 6 || binding.version !== 1 || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(binding.projectId) || !/^did:web:[^/?#]+:orgs:[a-z0-9][a-z0-9-]*$/.test(binding.issuerDid) || bytes(binding.issuerPublicKey).length !== 32 || !isOrigin(binding.authorizationOrigin) || !isOrigin(binding.controlPlaneOrigin) || !env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY || env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY !== env2.AGENTSHIELD_API_KEY || env2.CHECKPOINT_API_KEY !== void 0 && env2.CHECKPOINT_API_KEY !== env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
+    if (!binding || env2.MCPI_NATIVE_HTTP_INGRESS !== void 0 && env2.MCPI_NATIVE_HTTP_INGRESS !== "cloudflare-dispatch" || Object.keys(binding).length !== 6 || binding.version !== 1 || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(binding.projectId) || !/^did:web:[^/?#]+:orgs:[a-z0-9][a-z0-9-]*$/.test(binding.issuerDid) || bytes(binding.issuerPublicKey).length !== 32 || !isOrigin(binding.authorizationOrigin) || !isOrigin(binding.controlPlaneOrigin) || !env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY || env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY !== env2.AGENTSHIELD_API_KEY || env2.CHECKPOINT_API_KEY !== void 0 && env2.CHECKPOINT_API_KEY !== env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
       return null;
     return {
       authorizationOrigin: binding.authorizationOrigin,
       issuerDid: binding.issuerDid,
       projectId: binding.projectId,
+      // Isolated WfP workers cannot access request.cf. This deployment-owned
+      // opt-in is valid only behind a Cloudflare dispatch ingress that passes
+      // Cloudflare's CF-Connecting-IP unchanged. Never infer trust from a header
+      // supplied by the caller, or fall back to X-Forwarded-For / X-Real-IP.
+      ...env2.MCPI_NATIVE_HTTP_INGRESS === "cloudflare-dispatch" ? {
+        resolveSourceIp: (request) => {
+          const ip = request.headers.get("CF-Connecting-IP");
+          return sourceIpSchema.safeParse(ip).success ? ip : null;
+        }
+      } : {},
       remoteIssuer: createRemoteIssuer(binding, env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
     };
   } catch {
@@ -159561,6 +159573,7 @@ function mapPrefixedEnv(env2, prefix) {
     MCP_IDENTITY_PUBLIC_KEY: typeof env2.MCP_IDENTITY_PUBLIC_KEY === "string" ? env2.MCP_IDENTITY_PUBLIC_KEY : void 0,
     MCP_IDENTITY_AGENT_DID: typeof env2.MCP_IDENTITY_AGENT_DID === "string" ? env2.MCP_IDENTITY_AGENT_DID : void 0,
     MCPI_NATIVE_HTTP_ISSUER_CONFIG: typeof env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG === "string" ? env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG : void 0,
+    MCPI_NATIVE_HTTP_INGRESS: typeof env2.MCPI_NATIVE_HTTP_INGRESS === "string" ? env2.MCPI_NATIVE_HTTP_INGRESS : void 0,
     MCPI_NATIVE_HTTP_ISSUER_API_KEY: typeof env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY === "string" ? env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY : void 0,
     AGENTSHIELD_API_URL: typeof env2.AGENTSHIELD_API_URL === "string" ? env2.AGENTSHIELD_API_URL : void 0,
     AGENTSHIELD_API_KEY: typeof env2.AGENTSHIELD_API_KEY === "string" ? env2.AGENTSHIELD_API_KEY : void 0,
@@ -159887,7 +159900,7 @@ async function handlePickupInternal(ctx, request, now2) {
 // ../mcp-i-cloudflare/package.json
 var package_default = {
   name: "@kya-os/mcp-i-cloudflare",
-  version: "1.14.2",
+  version: "1.14.3",
   description: "Cloudflare Workers adapter for MCP-I framework",
   main: "dist/index.js",
   types: "dist/index.d.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/create-mcpi-app",
-  "version": "1.11.2",
+  "version": "1.11.3",
   "description": "Scaffold a new MCP-I application",
   "type": "module",
   "main": "./dist/helpers/index.js",
@@ -51,7 +51,7 @@
     "@kya-os/cli-effects": "^1.0.19",
     "@kya-os/contracts": "^1.12.1",
     "@kya-os/mcp-i": "^1.12.2",
-    "@kya-os/mcp-i-cloudflare": "^1.14.2",
+    "@kya-os/mcp-i-cloudflare": "^1.14.3",
     "base-x": "^5.0.0",
     "chalk": "^4.1.2",
     "commander": "^12.1.0",