@kya-os/create-mcpi-app 1.11.2 → 1.11.4

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @kya-os/create-mcpi-app@1.11.2 build /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app
+> @kya-os/create-mcpi-app@1.11.4 build /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app
 > tsc && chmod +x dist/index.js && node --import tsx scripts/build-bundles.ts
 
 🔨 Building template bundles...
@@ -7,23 +7,23 @@
 
 📦 Building template: blank
   ✅ Source files written to /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/.tmp-bundles/blank
-  ✅ Bundle built: 8169879 bytes, hash: sha256:a41e8aaff5b47...
+  ✅ Bundle built: 8172141 bytes, hash: sha256:964b549d9b27c...
 
 📦 Building template: hardware-world
   ✅ Source files written to /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/.tmp-bundles/hardware-world
-  ✅ Bundle built: 8182298 bytes, hash: sha256:53b53d9d5fbec...
+  ✅ Bundle built: 8184560 bytes, hash: sha256:613ed3ca8a593...
 
 📦 Building template: ecommerce
   ✅ Source files written to /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/.tmp-bundles/ecommerce
-  ✅ Bundle built: 8171573 bytes, hash: sha256:409344a00bc6b...
+  ✅ Bundle built: 8173835 bytes, hash: sha256:e1de25fb7a73e...
 
 📦 Building template: mix-station
   ✅ Source files written to /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/.tmp-bundles/mix-station
-  ✅ Bundle built: 8184923 bytes, hash: sha256:1caa1051b3d6c...
+  ✅ Bundle built: 8187185 bytes, hash: sha256:b5acc100ef55c...
 
 ✅ All bundles built successfully!
    Output: /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/bundles
-   Version: 1.11.2
-   Framework: 1.14.2
+   Version: 1.11.4
+   Framework: 1.14.5
    Templates: blank, hardware-world, ecommerce, mix-station
    Manifest: /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/bundles/manifest.json

package/dist/bundles/blank.js

@@ -159215,9 +159215,11 @@ var import_config = __toESM(require_config2());
 
 // ../mcp-i-cloudflare/dist/delegation-http/remote-issuer.js
 var import_json_canonicalize7 = __toESM(require_index_umd());
+init_esm2();
 init_native_fetch();
 init_native_http();
 var encoder8 = new TextEncoder();
+var sourceIpSchema = external_exports2.string().max(45).ip();
 var fail = () => {
   throw new Error("Native issuer capability unavailable");
 };
@@ -159249,12 +159251,22 @@ function resolveManagedNativeIssuer(env2) {
     return null;
   try {
     const binding = JSON.parse(env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG);
-    if (!binding || Object.keys(binding).length !== 6 || binding.version !== 1 || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(binding.projectId) || !/^did:web:[^/?#]+:orgs:[a-z0-9][a-z0-9-]*$/.test(binding.issuerDid) || bytes(binding.issuerPublicKey).length !== 32 || !isOrigin(binding.authorizationOrigin) || !isOrigin(binding.controlPlaneOrigin) || !env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY || env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY !== env2.AGENTSHIELD_API_KEY || env2.CHECKPOINT_API_KEY !== void 0 && env2.CHECKPOINT_API_KEY !== env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
+    if (!binding || env2.MCPI_NATIVE_HTTP_INGRESS !== void 0 && env2.MCPI_NATIVE_HTTP_INGRESS !== "cloudflare-dispatch" || Object.keys(binding).length !== 6 || binding.version !== 1 || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(binding.projectId) || !/^did:web:[^/?#]+:orgs:[a-z0-9][a-z0-9-]*$/.test(binding.issuerDid) || bytes(binding.issuerPublicKey).length !== 32 || !isOrigin(binding.authorizationOrigin) || !isOrigin(binding.controlPlaneOrigin) || !env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY || env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY !== env2.AGENTSHIELD_API_KEY || env2.CHECKPOINT_API_KEY !== void 0 && env2.CHECKPOINT_API_KEY !== env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
       return null;
     return {
       authorizationOrigin: binding.authorizationOrigin,
       issuerDid: binding.issuerDid,
       projectId: binding.projectId,
+      // Isolated WfP workers cannot access request.cf. This deployment-owned
+      // opt-in is valid only behind a Cloudflare dispatch ingress that passes
+      // Cloudflare's CF-Connecting-IP unchanged. Never infer trust from a header
+      // supplied by the caller, or fall back to X-Forwarded-For / X-Real-IP.
+      ...env2.MCPI_NATIVE_HTTP_INGRESS === "cloudflare-dispatch" ? {
+        resolveSourceIp: (request) => {
+          const ip = request.headers.get("CF-Connecting-IP");
+          return sourceIpSchema.safeParse(ip).success ? ip : null;
+        }
+      } : {},
       remoteIssuer: createRemoteIssuer(binding, env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
     };
   } catch {
@@ -159561,6 +159573,7 @@ function mapPrefixedEnv(env2, prefix) {
     MCP_IDENTITY_PUBLIC_KEY: typeof env2.MCP_IDENTITY_PUBLIC_KEY === "string" ? env2.MCP_IDENTITY_PUBLIC_KEY : void 0,
     MCP_IDENTITY_AGENT_DID: typeof env2.MCP_IDENTITY_AGENT_DID === "string" ? env2.MCP_IDENTITY_AGENT_DID : void 0,
     MCPI_NATIVE_HTTP_ISSUER_CONFIG: typeof env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG === "string" ? env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG : void 0,
+    MCPI_NATIVE_HTTP_INGRESS: typeof env2.MCPI_NATIVE_HTTP_INGRESS === "string" ? env2.MCPI_NATIVE_HTTP_INGRESS : void 0,
     MCPI_NATIVE_HTTP_ISSUER_API_KEY: typeof env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY === "string" ? env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY : void 0,
     AGENTSHIELD_API_URL: typeof env2.AGENTSHIELD_API_URL === "string" ? env2.AGENTSHIELD_API_URL : void 0,
     AGENTSHIELD_API_KEY: typeof env2.AGENTSHIELD_API_KEY === "string" ? env2.AGENTSHIELD_API_KEY : void 0,
@@ -159633,7 +159646,12 @@ function anchorSnapshot(rec) {
     nativePolicyRevision: rec.nativePolicyRevision
   };
 }
-var pendingBody = () => ({ status: "pending" });
+var pendingBody = (rec, now2) => ({
+  status: "pending",
+  // This is the remaining authorization-session lifetime, not the future VC's
+  // lifetime. Preserve the frozen legacy response and the original DO deadline.
+  ...rec.nativeHttp ? { expires_in: Math.max(0, Math.floor((rec.expiresAt - now2) / 1e3)) } : {}
+});
 var pinnedErr = () => ({ error: KYAOS_ERRORS.pickupPinned });
 var invalidSessionErr = () => ({ error: KYAOS_ERRORS.invalidSession });
 var pickupExpiredErr = () => ({ error: KYAOS_ERRORS.pickupExpired });
@@ -159737,7 +159755,7 @@ function reducePoll(rec, holder, now2) {
   }
   return {
     record: { ...working, lastPollAt: now2 },
-    response: { status: 202, body: pendingBody() }
+    response: { status: 202, body: pendingBody(working, now2) }
   };
 }
 function reduceApprove(rec, input2, now2) {
@@ -159887,7 +159905,7 @@ async function handlePickupInternal(ctx, request, now2) {
 // ../mcp-i-cloudflare/package.json
 var package_default = {
   name: "@kya-os/mcp-i-cloudflare",
-  version: "1.14.2",
+  version: "1.14.5",
   description: "Cloudflare Workers adapter for MCP-I framework",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -166377,6 +166395,22 @@ function approvalFailedPage(message3, status = 410) {
 <p>${escapeHtml2(message3)}</p>
 </main>`), status);
 }
+var REQUEST_NOT_PREPARED = {
+  title: "Your agent has not prepared this request yet",
+  body: "Before you can approve, your agent must establish the secure key that will receive your permission. No access has been granted.",
+  nextStep: "Return to your chat and ask your agent to finish preparing this authorization request before sharing the approval link.",
+  unsupported: "If the agent's tools cannot sign requests, this flow cannot be completed in that tool. Do not send your password or browser cookies to the agent."
+};
+function requestNotPreparedPage(sid) {
+  return htmlResponse(page(REQUEST_NOT_PREPARED.title, `<main class="kya-consent-not-prepared">
+<h1>${escapeHtml2(REQUEST_NOT_PREPARED.title)}</h1>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.body)}</p>
+<h2>What to do next</h2>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.nextStep)}</p>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.unsupported)}</p>
+<p>Once your agent confirms it is ready, <a href="?sid=${encodeURIComponent(sid)}">Reload this page</a>. If the request has expired, ask your agent to start a new request.</p>
+</main>`), 409);
+}
 function notFoundJson() {
   return jsonResponse({
     error: "We could not find this authorization request. It may have already completed or been cancelled."
@@ -166718,7 +166752,7 @@ async function handleAnchorConsentGet(c, sid, env2, cfg) {
   }
   const info = await infoResponse.json();
   if (info.nativeHttp && (!info.holderKeyId || info.status === "pending")) {
-    return approvalFailedPage("The agent must establish its pickup key before you approve.", 409);
+    return requestNotPreparedPage(sid);
   }
   if (info.nativeHttp && (!cfg.native || info.nativeIssuerDid !== cfg.native.issuerDid))
     return nativeUnavailable();
@@ -166796,7 +166830,7 @@ async function handleAnchorConsentApprove(c, sid, env2, cfg) {
   }
   const info = await infoResponse.json();
   if (info.nativeHttp && (!info.holderKeyId || info.status === "pending")) {
-    return approvalFailedJson("The agent must establish its pickup key before you approve.", 409);
+    return approvalFailedJson(`${REQUEST_NOT_PREPARED.title}. ${REQUEST_NOT_PREPARED.body} ${REQUEST_NOT_PREPARED.nextStep} ${REQUEST_NOT_PREPARED.unsupported}`, 409);
   }
   if (info.nativeHttp && (!cfg.native || info.nativeIssuerDid !== cfg.native.issuerDid))
     return nativeUnavailable();

package/dist/bundles/ecommerce.js

@@ -159215,9 +159215,11 @@ var import_config = __toESM(require_config2());
 
 // ../mcp-i-cloudflare/dist/delegation-http/remote-issuer.js
 var import_json_canonicalize7 = __toESM(require_index_umd());
+init_esm2();
 init_native_fetch();
 init_native_http();
 var encoder8 = new TextEncoder();
+var sourceIpSchema = external_exports2.string().max(45).ip();
 var fail = () => {
   throw new Error("Native issuer capability unavailable");
 };
@@ -159249,12 +159251,22 @@ function resolveManagedNativeIssuer(env2) {
     return null;
   try {
     const binding = JSON.parse(env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG);
-    if (!binding || Object.keys(binding).length !== 6 || binding.version !== 1 || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(binding.projectId) || !/^did:web:[^/?#]+:orgs:[a-z0-9][a-z0-9-]*$/.test(binding.issuerDid) || bytes(binding.issuerPublicKey).length !== 32 || !isOrigin(binding.authorizationOrigin) || !isOrigin(binding.controlPlaneOrigin) || !env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY || env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY !== env2.AGENTSHIELD_API_KEY || env2.CHECKPOINT_API_KEY !== void 0 && env2.CHECKPOINT_API_KEY !== env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
+    if (!binding || env2.MCPI_NATIVE_HTTP_INGRESS !== void 0 && env2.MCPI_NATIVE_HTTP_INGRESS !== "cloudflare-dispatch" || Object.keys(binding).length !== 6 || binding.version !== 1 || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(binding.projectId) || !/^did:web:[^/?#]+:orgs:[a-z0-9][a-z0-9-]*$/.test(binding.issuerDid) || bytes(binding.issuerPublicKey).length !== 32 || !isOrigin(binding.authorizationOrigin) || !isOrigin(binding.controlPlaneOrigin) || !env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY || env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY !== env2.AGENTSHIELD_API_KEY || env2.CHECKPOINT_API_KEY !== void 0 && env2.CHECKPOINT_API_KEY !== env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
       return null;
     return {
       authorizationOrigin: binding.authorizationOrigin,
       issuerDid: binding.issuerDid,
       projectId: binding.projectId,
+      // Isolated WfP workers cannot access request.cf. This deployment-owned
+      // opt-in is valid only behind a Cloudflare dispatch ingress that passes
+      // Cloudflare's CF-Connecting-IP unchanged. Never infer trust from a header
+      // supplied by the caller, or fall back to X-Forwarded-For / X-Real-IP.
+      ...env2.MCPI_NATIVE_HTTP_INGRESS === "cloudflare-dispatch" ? {
+        resolveSourceIp: (request) => {
+          const ip = request.headers.get("CF-Connecting-IP");
+          return sourceIpSchema.safeParse(ip).success ? ip : null;
+        }
+      } : {},
       remoteIssuer: createRemoteIssuer(binding, env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
     };
   } catch {
@@ -159561,6 +159573,7 @@ function mapPrefixedEnv(env2, prefix) {
     MCP_IDENTITY_PUBLIC_KEY: typeof env2.MCP_IDENTITY_PUBLIC_KEY === "string" ? env2.MCP_IDENTITY_PUBLIC_KEY : void 0,
     MCP_IDENTITY_AGENT_DID: typeof env2.MCP_IDENTITY_AGENT_DID === "string" ? env2.MCP_IDENTITY_AGENT_DID : void 0,
     MCPI_NATIVE_HTTP_ISSUER_CONFIG: typeof env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG === "string" ? env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG : void 0,
+    MCPI_NATIVE_HTTP_INGRESS: typeof env2.MCPI_NATIVE_HTTP_INGRESS === "string" ? env2.MCPI_NATIVE_HTTP_INGRESS : void 0,
     MCPI_NATIVE_HTTP_ISSUER_API_KEY: typeof env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY === "string" ? env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY : void 0,
     AGENTSHIELD_API_URL: typeof env2.AGENTSHIELD_API_URL === "string" ? env2.AGENTSHIELD_API_URL : void 0,
     AGENTSHIELD_API_KEY: typeof env2.AGENTSHIELD_API_KEY === "string" ? env2.AGENTSHIELD_API_KEY : void 0,
@@ -159633,7 +159646,12 @@ function anchorSnapshot(rec) {
     nativePolicyRevision: rec.nativePolicyRevision
   };
 }
-var pendingBody = () => ({ status: "pending" });
+var pendingBody = (rec, now2) => ({
+  status: "pending",
+  // This is the remaining authorization-session lifetime, not the future VC's
+  // lifetime. Preserve the frozen legacy response and the original DO deadline.
+  ...rec.nativeHttp ? { expires_in: Math.max(0, Math.floor((rec.expiresAt - now2) / 1e3)) } : {}
+});
 var pinnedErr = () => ({ error: KYAOS_ERRORS.pickupPinned });
 var invalidSessionErr = () => ({ error: KYAOS_ERRORS.invalidSession });
 var pickupExpiredErr = () => ({ error: KYAOS_ERRORS.pickupExpired });
@@ -159737,7 +159755,7 @@ function reducePoll(rec, holder, now2) {
   }
   return {
     record: { ...working, lastPollAt: now2 },
-    response: { status: 202, body: pendingBody() }
+    response: { status: 202, body: pendingBody(working, now2) }
   };
 }
 function reduceApprove(rec, input2, now2) {
@@ -159887,7 +159905,7 @@ async function handlePickupInternal(ctx, request, now2) {
 // ../mcp-i-cloudflare/package.json
 var package_default = {
   name: "@kya-os/mcp-i-cloudflare",
-  version: "1.14.2",
+  version: "1.14.5",
   description: "Cloudflare Workers adapter for MCP-I framework",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -166377,6 +166395,22 @@ function approvalFailedPage(message3, status = 410) {
 <p>${escapeHtml2(message3)}</p>
 </main>`), status);
 }
+var REQUEST_NOT_PREPARED = {
+  title: "Your agent has not prepared this request yet",
+  body: "Before you can approve, your agent must establish the secure key that will receive your permission. No access has been granted.",
+  nextStep: "Return to your chat and ask your agent to finish preparing this authorization request before sharing the approval link.",
+  unsupported: "If the agent's tools cannot sign requests, this flow cannot be completed in that tool. Do not send your password or browser cookies to the agent."
+};
+function requestNotPreparedPage(sid) {
+  return htmlResponse(page(REQUEST_NOT_PREPARED.title, `<main class="kya-consent-not-prepared">
+<h1>${escapeHtml2(REQUEST_NOT_PREPARED.title)}</h1>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.body)}</p>
+<h2>What to do next</h2>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.nextStep)}</p>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.unsupported)}</p>
+<p>Once your agent confirms it is ready, <a href="?sid=${encodeURIComponent(sid)}">Reload this page</a>. If the request has expired, ask your agent to start a new request.</p>
+</main>`), 409);
+}
 function notFoundJson() {
   return jsonResponse({
     error: "We could not find this authorization request. It may have already completed or been cancelled."
@@ -166718,7 +166752,7 @@ async function handleAnchorConsentGet(c, sid, env2, cfg) {
   }
   const info = await infoResponse.json();
   if (info.nativeHttp && (!info.holderKeyId || info.status === "pending")) {
-    return approvalFailedPage("The agent must establish its pickup key before you approve.", 409);
+    return requestNotPreparedPage(sid);
   }
   if (info.nativeHttp && (!cfg.native || info.nativeIssuerDid !== cfg.native.issuerDid))
     return nativeUnavailable();
@@ -166796,7 +166830,7 @@ async function handleAnchorConsentApprove(c, sid, env2, cfg) {
   }
   const info = await infoResponse.json();
   if (info.nativeHttp && (!info.holderKeyId || info.status === "pending")) {
-    return approvalFailedJson("The agent must establish its pickup key before you approve.", 409);
+    return approvalFailedJson(`${REQUEST_NOT_PREPARED.title}. ${REQUEST_NOT_PREPARED.body} ${REQUEST_NOT_PREPARED.nextStep} ${REQUEST_NOT_PREPARED.unsupported}`, 409);
   }
   if (info.nativeHttp && (!cfg.native || info.nativeIssuerDid !== cfg.native.issuerDid))
     return nativeUnavailable();

package/dist/bundles/hardware-world.js

@@ -159215,9 +159215,11 @@ var import_config = __toESM(require_config2());
 
 // ../mcp-i-cloudflare/dist/delegation-http/remote-issuer.js
 var import_json_canonicalize7 = __toESM(require_index_umd());
+init_esm2();
 init_native_fetch();
 init_native_http();
 var encoder8 = new TextEncoder();
+var sourceIpSchema = external_exports2.string().max(45).ip();
 var fail = () => {
   throw new Error("Native issuer capability unavailable");
 };
@@ -159249,12 +159251,22 @@ function resolveManagedNativeIssuer(env2) {
     return null;
   try {
     const binding = JSON.parse(env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG);
-    if (!binding || Object.keys(binding).length !== 6 || binding.version !== 1 || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(binding.projectId) || !/^did:web:[^/?#]+:orgs:[a-z0-9][a-z0-9-]*$/.test(binding.issuerDid) || bytes(binding.issuerPublicKey).length !== 32 || !isOrigin(binding.authorizationOrigin) || !isOrigin(binding.controlPlaneOrigin) || !env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY || env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY !== env2.AGENTSHIELD_API_KEY || env2.CHECKPOINT_API_KEY !== void 0 && env2.CHECKPOINT_API_KEY !== env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
+    if (!binding || env2.MCPI_NATIVE_HTTP_INGRESS !== void 0 && env2.MCPI_NATIVE_HTTP_INGRESS !== "cloudflare-dispatch" || Object.keys(binding).length !== 6 || binding.version !== 1 || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(binding.projectId) || !/^did:web:[^/?#]+:orgs:[a-z0-9][a-z0-9-]*$/.test(binding.issuerDid) || bytes(binding.issuerPublicKey).length !== 32 || !isOrigin(binding.authorizationOrigin) || !isOrigin(binding.controlPlaneOrigin) || !env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY || env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY !== env2.AGENTSHIELD_API_KEY || env2.CHECKPOINT_API_KEY !== void 0 && env2.CHECKPOINT_API_KEY !== env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
       return null;
     return {
       authorizationOrigin: binding.authorizationOrigin,
       issuerDid: binding.issuerDid,
       projectId: binding.projectId,
+      // Isolated WfP workers cannot access request.cf. This deployment-owned
+      // opt-in is valid only behind a Cloudflare dispatch ingress that passes
+      // Cloudflare's CF-Connecting-IP unchanged. Never infer trust from a header
+      // supplied by the caller, or fall back to X-Forwarded-For / X-Real-IP.
+      ...env2.MCPI_NATIVE_HTTP_INGRESS === "cloudflare-dispatch" ? {
+        resolveSourceIp: (request) => {
+          const ip = request.headers.get("CF-Connecting-IP");
+          return sourceIpSchema.safeParse(ip).success ? ip : null;
+        }
+      } : {},
       remoteIssuer: createRemoteIssuer(binding, env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
     };
   } catch {
@@ -159561,6 +159573,7 @@ function mapPrefixedEnv(env2, prefix) {
     MCP_IDENTITY_PUBLIC_KEY: typeof env2.MCP_IDENTITY_PUBLIC_KEY === "string" ? env2.MCP_IDENTITY_PUBLIC_KEY : void 0,
     MCP_IDENTITY_AGENT_DID: typeof env2.MCP_IDENTITY_AGENT_DID === "string" ? env2.MCP_IDENTITY_AGENT_DID : void 0,
     MCPI_NATIVE_HTTP_ISSUER_CONFIG: typeof env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG === "string" ? env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG : void 0,
+    MCPI_NATIVE_HTTP_INGRESS: typeof env2.MCPI_NATIVE_HTTP_INGRESS === "string" ? env2.MCPI_NATIVE_HTTP_INGRESS : void 0,
     MCPI_NATIVE_HTTP_ISSUER_API_KEY: typeof env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY === "string" ? env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY : void 0,
     AGENTSHIELD_API_URL: typeof env2.AGENTSHIELD_API_URL === "string" ? env2.AGENTSHIELD_API_URL : void 0,
     AGENTSHIELD_API_KEY: typeof env2.AGENTSHIELD_API_KEY === "string" ? env2.AGENTSHIELD_API_KEY : void 0,
@@ -159633,7 +159646,12 @@ function anchorSnapshot(rec) {
     nativePolicyRevision: rec.nativePolicyRevision
   };
 }
-var pendingBody = () => ({ status: "pending" });
+var pendingBody = (rec, now2) => ({
+  status: "pending",
+  // This is the remaining authorization-session lifetime, not the future VC's
+  // lifetime. Preserve the frozen legacy response and the original DO deadline.
+  ...rec.nativeHttp ? { expires_in: Math.max(0, Math.floor((rec.expiresAt - now2) / 1e3)) } : {}
+});
 var pinnedErr = () => ({ error: KYAOS_ERRORS.pickupPinned });
 var invalidSessionErr = () => ({ error: KYAOS_ERRORS.invalidSession });
 var pickupExpiredErr = () => ({ error: KYAOS_ERRORS.pickupExpired });
@@ -159737,7 +159755,7 @@ function reducePoll(rec, holder, now2) {
   }
   return {
     record: { ...working, lastPollAt: now2 },
-    response: { status: 202, body: pendingBody() }
+    response: { status: 202, body: pendingBody(working, now2) }
   };
 }
 function reduceApprove(rec, input2, now2) {
@@ -159887,7 +159905,7 @@ async function handlePickupInternal(ctx, request, now2) {
 // ../mcp-i-cloudflare/package.json
 var package_default = {
   name: "@kya-os/mcp-i-cloudflare",
-  version: "1.14.2",
+  version: "1.14.5",
   description: "Cloudflare Workers adapter for MCP-I framework",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -166377,6 +166395,22 @@ function approvalFailedPage(message3, status = 410) {
 <p>${escapeHtml2(message3)}</p>
 </main>`), status);
 }
+var REQUEST_NOT_PREPARED = {
+  title: "Your agent has not prepared this request yet",
+  body: "Before you can approve, your agent must establish the secure key that will receive your permission. No access has been granted.",
+  nextStep: "Return to your chat and ask your agent to finish preparing this authorization request before sharing the approval link.",
+  unsupported: "If the agent's tools cannot sign requests, this flow cannot be completed in that tool. Do not send your password or browser cookies to the agent."
+};
+function requestNotPreparedPage(sid) {
+  return htmlResponse(page(REQUEST_NOT_PREPARED.title, `<main class="kya-consent-not-prepared">
+<h1>${escapeHtml2(REQUEST_NOT_PREPARED.title)}</h1>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.body)}</p>
+<h2>What to do next</h2>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.nextStep)}</p>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.unsupported)}</p>
+<p>Once your agent confirms it is ready, <a href="?sid=${encodeURIComponent(sid)}">Reload this page</a>. If the request has expired, ask your agent to start a new request.</p>
+</main>`), 409);
+}
 function notFoundJson() {
   return jsonResponse({
     error: "We could not find this authorization request. It may have already completed or been cancelled."
@@ -166718,7 +166752,7 @@ async function handleAnchorConsentGet(c, sid, env2, cfg) {
   }
   const info = await infoResponse.json();
   if (info.nativeHttp && (!info.holderKeyId || info.status === "pending")) {
-    return approvalFailedPage("The agent must establish its pickup key before you approve.", 409);
+    return requestNotPreparedPage(sid);
   }
   if (info.nativeHttp && (!cfg.native || info.nativeIssuerDid !== cfg.native.issuerDid))
     return nativeUnavailable();
@@ -166796,7 +166830,7 @@ async function handleAnchorConsentApprove(c, sid, env2, cfg) {
   }
   const info = await infoResponse.json();
   if (info.nativeHttp && (!info.holderKeyId || info.status === "pending")) {
-    return approvalFailedJson("The agent must establish its pickup key before you approve.", 409);
+    return approvalFailedJson(`${REQUEST_NOT_PREPARED.title}. ${REQUEST_NOT_PREPARED.body} ${REQUEST_NOT_PREPARED.nextStep} ${REQUEST_NOT_PREPARED.unsupported}`, 409);
   }
   if (info.nativeHttp && (!cfg.native || info.nativeIssuerDid !== cfg.native.issuerDid))
     return nativeUnavailable();

package/dist/bundles/manifest.json

@@ -1,29 +1,29 @@
 {
-  "version": "1.11.2",
-  "frameworkVersion": "1.14.2",
+  "version": "1.11.4",
+  "frameworkVersion": "1.14.5",
   "doClassName": "MCPIAgent",
   "auditDoClassName": "AuditProducer",
-  "buildDate": "2026-09-15T20:52:10.037Z",
+  "buildDate": "2026-09-17T17:15:27.894Z",
   "templates": {
     "blank": {
       "file": "blank.js",
-      "size": 8169879,
-      "hash": "sha256:a41e8aaff5b47df24cd40fda14f1b82250145fc770e13d691690bd62719462bb"
+      "size": 8172141,
+      "hash": "sha256:964b549d9b27cc744b75232f5315c8a2a88edd4e34da4e8d6cede681be910191"
     },
     "hardware-world": {
       "file": "hardware-world.js",
-      "size": 8182298,
-      "hash": "sha256:53b53d9d5fbec2def7855d5075f31ce6a3b3bae476cd2bb6c2b778a114741c68"
+      "size": 8184560,
+      "hash": "sha256:613ed3ca8a5936fa063137a257fd95183b8db7fbb28f557909fd1976c5187e1b"
     },
     "ecommerce": {
       "file": "ecommerce.js",
-      "size": 8171573,
-      "hash": "sha256:409344a00bc6b6637442ded50c562eb45f312e7e109a65dcc22cad318e3a1ec8"
+      "size": 8173835,
+      "hash": "sha256:e1de25fb7a73eb3d73b0d9d1c6dff89d82605b263cfe01d5ccc245238a354b28"
     },
     "mix-station": {
       "file": "mix-station.js",
-      "size": 8184923,
-      "hash": "sha256:1caa1051b3d6cd9959ef99f60af821c28cb420d6359fe535ec33824824f0efde"
+      "size": 8187185,
+      "hash": "sha256:b5acc100ef55c725c25eff966d5739203cb112ecded3c9430c6d1acf366136b6"
     }
   }
 }

package/dist/bundles/mix-station.js

@@ -159215,9 +159215,11 @@ var import_config = __toESM(require_config2());
 
 // ../mcp-i-cloudflare/dist/delegation-http/remote-issuer.js
 var import_json_canonicalize7 = __toESM(require_index_umd());
+init_esm2();
 init_native_fetch();
 init_native_http();
 var encoder8 = new TextEncoder();
+var sourceIpSchema = external_exports2.string().max(45).ip();
 var fail = () => {
   throw new Error("Native issuer capability unavailable");
 };
@@ -159249,12 +159251,22 @@ function resolveManagedNativeIssuer(env2) {
     return null;
   try {
     const binding = JSON.parse(env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG);
-    if (!binding || Object.keys(binding).length !== 6 || binding.version !== 1 || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(binding.projectId) || !/^did:web:[^/?#]+:orgs:[a-z0-9][a-z0-9-]*$/.test(binding.issuerDid) || bytes(binding.issuerPublicKey).length !== 32 || !isOrigin(binding.authorizationOrigin) || !isOrigin(binding.controlPlaneOrigin) || !env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY || env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY !== env2.AGENTSHIELD_API_KEY || env2.CHECKPOINT_API_KEY !== void 0 && env2.CHECKPOINT_API_KEY !== env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
+    if (!binding || env2.MCPI_NATIVE_HTTP_INGRESS !== void 0 && env2.MCPI_NATIVE_HTTP_INGRESS !== "cloudflare-dispatch" || Object.keys(binding).length !== 6 || binding.version !== 1 || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(binding.projectId) || !/^did:web:[^/?#]+:orgs:[a-z0-9][a-z0-9-]*$/.test(binding.issuerDid) || bytes(binding.issuerPublicKey).length !== 32 || !isOrigin(binding.authorizationOrigin) || !isOrigin(binding.controlPlaneOrigin) || !env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY || env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY !== env2.AGENTSHIELD_API_KEY || env2.CHECKPOINT_API_KEY !== void 0 && env2.CHECKPOINT_API_KEY !== env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
       return null;
     return {
       authorizationOrigin: binding.authorizationOrigin,
       issuerDid: binding.issuerDid,
       projectId: binding.projectId,
+      // Isolated WfP workers cannot access request.cf. This deployment-owned
+      // opt-in is valid only behind a Cloudflare dispatch ingress that passes
+      // Cloudflare's CF-Connecting-IP unchanged. Never infer trust from a header
+      // supplied by the caller, or fall back to X-Forwarded-For / X-Real-IP.
+      ...env2.MCPI_NATIVE_HTTP_INGRESS === "cloudflare-dispatch" ? {
+        resolveSourceIp: (request) => {
+          const ip = request.headers.get("CF-Connecting-IP");
+          return sourceIpSchema.safeParse(ip).success ? ip : null;
+        }
+      } : {},
       remoteIssuer: createRemoteIssuer(binding, env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY)
     };
   } catch {
@@ -159561,6 +159573,7 @@ function mapPrefixedEnv(env2, prefix) {
     MCP_IDENTITY_PUBLIC_KEY: typeof env2.MCP_IDENTITY_PUBLIC_KEY === "string" ? env2.MCP_IDENTITY_PUBLIC_KEY : void 0,
     MCP_IDENTITY_AGENT_DID: typeof env2.MCP_IDENTITY_AGENT_DID === "string" ? env2.MCP_IDENTITY_AGENT_DID : void 0,
     MCPI_NATIVE_HTTP_ISSUER_CONFIG: typeof env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG === "string" ? env2.MCPI_NATIVE_HTTP_ISSUER_CONFIG : void 0,
+    MCPI_NATIVE_HTTP_INGRESS: typeof env2.MCPI_NATIVE_HTTP_INGRESS === "string" ? env2.MCPI_NATIVE_HTTP_INGRESS : void 0,
     MCPI_NATIVE_HTTP_ISSUER_API_KEY: typeof env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY === "string" ? env2.MCPI_NATIVE_HTTP_ISSUER_API_KEY : void 0,
     AGENTSHIELD_API_URL: typeof env2.AGENTSHIELD_API_URL === "string" ? env2.AGENTSHIELD_API_URL : void 0,
     AGENTSHIELD_API_KEY: typeof env2.AGENTSHIELD_API_KEY === "string" ? env2.AGENTSHIELD_API_KEY : void 0,
@@ -159633,7 +159646,12 @@ function anchorSnapshot(rec) {
     nativePolicyRevision: rec.nativePolicyRevision
   };
 }
-var pendingBody = () => ({ status: "pending" });
+var pendingBody = (rec, now2) => ({
+  status: "pending",
+  // This is the remaining authorization-session lifetime, not the future VC's
+  // lifetime. Preserve the frozen legacy response and the original DO deadline.
+  ...rec.nativeHttp ? { expires_in: Math.max(0, Math.floor((rec.expiresAt - now2) / 1e3)) } : {}
+});
 var pinnedErr = () => ({ error: KYAOS_ERRORS.pickupPinned });
 var invalidSessionErr = () => ({ error: KYAOS_ERRORS.invalidSession });
 var pickupExpiredErr = () => ({ error: KYAOS_ERRORS.pickupExpired });
@@ -159737,7 +159755,7 @@ function reducePoll(rec, holder, now2) {
   }
   return {
     record: { ...working, lastPollAt: now2 },
-    response: { status: 202, body: pendingBody() }
+    response: { status: 202, body: pendingBody(working, now2) }
   };
 }
 function reduceApprove(rec, input2, now2) {
@@ -159887,7 +159905,7 @@ async function handlePickupInternal(ctx, request, now2) {
 // ../mcp-i-cloudflare/package.json
 var package_default = {
   name: "@kya-os/mcp-i-cloudflare",
-  version: "1.14.2",
+  version: "1.14.5",
   description: "Cloudflare Workers adapter for MCP-I framework",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -166377,6 +166395,22 @@ function approvalFailedPage(message3, status = 410) {
 <p>${escapeHtml2(message3)}</p>
 </main>`), status);
 }
+var REQUEST_NOT_PREPARED = {
+  title: "Your agent has not prepared this request yet",
+  body: "Before you can approve, your agent must establish the secure key that will receive your permission. No access has been granted.",
+  nextStep: "Return to your chat and ask your agent to finish preparing this authorization request before sharing the approval link.",
+  unsupported: "If the agent's tools cannot sign requests, this flow cannot be completed in that tool. Do not send your password or browser cookies to the agent."
+};
+function requestNotPreparedPage(sid) {
+  return htmlResponse(page(REQUEST_NOT_PREPARED.title, `<main class="kya-consent-not-prepared">
+<h1>${escapeHtml2(REQUEST_NOT_PREPARED.title)}</h1>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.body)}</p>
+<h2>What to do next</h2>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.nextStep)}</p>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.unsupported)}</p>
+<p>Once your agent confirms it is ready, <a href="?sid=${encodeURIComponent(sid)}">Reload this page</a>. If the request has expired, ask your agent to start a new request.</p>
+</main>`), 409);
+}
 function notFoundJson() {
   return jsonResponse({
     error: "We could not find this authorization request. It may have already completed or been cancelled."
@@ -166718,7 +166752,7 @@ async function handleAnchorConsentGet(c, sid, env2, cfg) {
   }
   const info = await infoResponse.json();
   if (info.nativeHttp && (!info.holderKeyId || info.status === "pending")) {
-    return approvalFailedPage("The agent must establish its pickup key before you approve.", 409);
+    return requestNotPreparedPage(sid);
   }
   if (info.nativeHttp && (!cfg.native || info.nativeIssuerDid !== cfg.native.issuerDid))
     return nativeUnavailable();
@@ -166796,7 +166830,7 @@ async function handleAnchorConsentApprove(c, sid, env2, cfg) {
   }
   const info = await infoResponse.json();
   if (info.nativeHttp && (!info.holderKeyId || info.status === "pending")) {
-    return approvalFailedJson("The agent must establish its pickup key before you approve.", 409);
+    return approvalFailedJson(`${REQUEST_NOT_PREPARED.title}. ${REQUEST_NOT_PREPARED.body} ${REQUEST_NOT_PREPARED.nextStep} ${REQUEST_NOT_PREPARED.unsupported}`, 409);
   }
   if (info.nativeHttp && (!cfg.native || info.nativeIssuerDid !== cfg.native.issuerDid))
     return nativeUnavailable();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/create-mcpi-app",
-  "version": "1.11.2",
+  "version": "1.11.4",
   "description": "Scaffold a new MCP-I application",
   "type": "module",
   "main": "./dist/helpers/index.js",
@@ -51,7 +51,7 @@
     "@kya-os/cli-effects": "^1.0.19",
     "@kya-os/contracts": "^1.12.1",
     "@kya-os/mcp-i": "^1.12.2",
-    "@kya-os/mcp-i-cloudflare": "^1.14.2",
+    "@kya-os/mcp-i-cloudflare": "^1.14.5",
     "base-x": "^5.0.0",
     "chalk": "^4.1.2",
     "commander": "^12.1.0",