@kya-os/create-mcpi-app 1.11.3 → 1.11.4

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @kya-os/create-mcpi-app@1.11.3 build /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app
+> @kya-os/create-mcpi-app@1.11.4 build /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app
 > tsc && chmod +x dist/index.js && node --import tsx scripts/build-bundles.ts
 
 🔨 Building template bundles...
@@ -7,23 +7,23 @@
 
 📦 Building template: blank
   ✅ Source files written to /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/.tmp-bundles/blank
-  ✅ Bundle built: 8170758 bytes, hash: sha256:72e778e39a337...
+  ✅ Bundle built: 8172141 bytes, hash: sha256:964b549d9b27c...
 
 📦 Building template: hardware-world
   ✅ Source files written to /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/.tmp-bundles/hardware-world
-  ✅ Bundle built: 8183177 bytes, hash: sha256:1edd8330eddd7...
+  ✅ Bundle built: 8184560 bytes, hash: sha256:613ed3ca8a593...
 
 📦 Building template: ecommerce
   ✅ Source files written to /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/.tmp-bundles/ecommerce
-  ✅ Bundle built: 8172452 bytes, hash: sha256:09a58de753d02...
+  ✅ Bundle built: 8173835 bytes, hash: sha256:e1de25fb7a73e...
 
 📦 Building template: mix-station
   ✅ Source files written to /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/.tmp-bundles/mix-station
-  ✅ Bundle built: 8185802 bytes, hash: sha256:0c29ba4e04375...
+  ✅ Bundle built: 8187185 bytes, hash: sha256:b5acc100ef55c...
 
 ✅ All bundles built successfully!
    Output: /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/bundles
-   Version: 1.11.3
-   Framework: 1.14.3
+   Version: 1.11.4
+   Framework: 1.14.5
    Templates: blank, hardware-world, ecommerce, mix-station
    Manifest: /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/bundles/manifest.json

package/dist/bundles/blank.js

@@ -159646,7 +159646,12 @@ function anchorSnapshot(rec) {
     nativePolicyRevision: rec.nativePolicyRevision
   };
 }
-var pendingBody = () => ({ status: "pending" });
+var pendingBody = (rec, now2) => ({
+  status: "pending",
+  // This is the remaining authorization-session lifetime, not the future VC's
+  // lifetime. Preserve the frozen legacy response and the original DO deadline.
+  ...rec.nativeHttp ? { expires_in: Math.max(0, Math.floor((rec.expiresAt - now2) / 1e3)) } : {}
+});
 var pinnedErr = () => ({ error: KYAOS_ERRORS.pickupPinned });
 var invalidSessionErr = () => ({ error: KYAOS_ERRORS.invalidSession });
 var pickupExpiredErr = () => ({ error: KYAOS_ERRORS.pickupExpired });
@@ -159750,7 +159755,7 @@ function reducePoll(rec, holder, now2) {
   }
   return {
     record: { ...working, lastPollAt: now2 },
-    response: { status: 202, body: pendingBody() }
+    response: { status: 202, body: pendingBody(working, now2) }
   };
 }
 function reduceApprove(rec, input2, now2) {
@@ -159900,7 +159905,7 @@ async function handlePickupInternal(ctx, request, now2) {
 // ../mcp-i-cloudflare/package.json
 var package_default = {
   name: "@kya-os/mcp-i-cloudflare",
-  version: "1.14.3",
+  version: "1.14.5",
   description: "Cloudflare Workers adapter for MCP-I framework",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -166390,6 +166395,22 @@ function approvalFailedPage(message3, status = 410) {
 <p>${escapeHtml2(message3)}</p>
 </main>`), status);
 }
+var REQUEST_NOT_PREPARED = {
+  title: "Your agent has not prepared this request yet",
+  body: "Before you can approve, your agent must establish the secure key that will receive your permission. No access has been granted.",
+  nextStep: "Return to your chat and ask your agent to finish preparing this authorization request before sharing the approval link.",
+  unsupported: "If the agent's tools cannot sign requests, this flow cannot be completed in that tool. Do not send your password or browser cookies to the agent."
+};
+function requestNotPreparedPage(sid) {
+  return htmlResponse(page(REQUEST_NOT_PREPARED.title, `<main class="kya-consent-not-prepared">
+<h1>${escapeHtml2(REQUEST_NOT_PREPARED.title)}</h1>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.body)}</p>
+<h2>What to do next</h2>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.nextStep)}</p>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.unsupported)}</p>
+<p>Once your agent confirms it is ready, <a href="?sid=${encodeURIComponent(sid)}">Reload this page</a>. If the request has expired, ask your agent to start a new request.</p>
+</main>`), 409);
+}
 function notFoundJson() {
   return jsonResponse({
     error: "We could not find this authorization request. It may have already completed or been cancelled."
@@ -166731,7 +166752,7 @@ async function handleAnchorConsentGet(c, sid, env2, cfg) {
   }
   const info = await infoResponse.json();
   if (info.nativeHttp && (!info.holderKeyId || info.status === "pending")) {
-    return approvalFailedPage("The agent must establish its pickup key before you approve.", 409);
+    return requestNotPreparedPage(sid);
   }
   if (info.nativeHttp && (!cfg.native || info.nativeIssuerDid !== cfg.native.issuerDid))
     return nativeUnavailable();
@@ -166809,7 +166830,7 @@ async function handleAnchorConsentApprove(c, sid, env2, cfg) {
   }
   const info = await infoResponse.json();
   if (info.nativeHttp && (!info.holderKeyId || info.status === "pending")) {
-    return approvalFailedJson("The agent must establish its pickup key before you approve.", 409);
+    return approvalFailedJson(`${REQUEST_NOT_PREPARED.title}. ${REQUEST_NOT_PREPARED.body} ${REQUEST_NOT_PREPARED.nextStep} ${REQUEST_NOT_PREPARED.unsupported}`, 409);
   }
   if (info.nativeHttp && (!cfg.native || info.nativeIssuerDid !== cfg.native.issuerDid))
     return nativeUnavailable();

package/dist/bundles/ecommerce.js

@@ -159646,7 +159646,12 @@ function anchorSnapshot(rec) {
     nativePolicyRevision: rec.nativePolicyRevision
   };
 }
-var pendingBody = () => ({ status: "pending" });
+var pendingBody = (rec, now2) => ({
+  status: "pending",
+  // This is the remaining authorization-session lifetime, not the future VC's
+  // lifetime. Preserve the frozen legacy response and the original DO deadline.
+  ...rec.nativeHttp ? { expires_in: Math.max(0, Math.floor((rec.expiresAt - now2) / 1e3)) } : {}
+});
 var pinnedErr = () => ({ error: KYAOS_ERRORS.pickupPinned });
 var invalidSessionErr = () => ({ error: KYAOS_ERRORS.invalidSession });
 var pickupExpiredErr = () => ({ error: KYAOS_ERRORS.pickupExpired });
@@ -159750,7 +159755,7 @@ function reducePoll(rec, holder, now2) {
   }
   return {
     record: { ...working, lastPollAt: now2 },
-    response: { status: 202, body: pendingBody() }
+    response: { status: 202, body: pendingBody(working, now2) }
   };
 }
 function reduceApprove(rec, input2, now2) {
@@ -159900,7 +159905,7 @@ async function handlePickupInternal(ctx, request, now2) {
 // ../mcp-i-cloudflare/package.json
 var package_default = {
   name: "@kya-os/mcp-i-cloudflare",
-  version: "1.14.3",
+  version: "1.14.5",
   description: "Cloudflare Workers adapter for MCP-I framework",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -166390,6 +166395,22 @@ function approvalFailedPage(message3, status = 410) {
 <p>${escapeHtml2(message3)}</p>
 </main>`), status);
 }
+var REQUEST_NOT_PREPARED = {
+  title: "Your agent has not prepared this request yet",
+  body: "Before you can approve, your agent must establish the secure key that will receive your permission. No access has been granted.",
+  nextStep: "Return to your chat and ask your agent to finish preparing this authorization request before sharing the approval link.",
+  unsupported: "If the agent's tools cannot sign requests, this flow cannot be completed in that tool. Do not send your password or browser cookies to the agent."
+};
+function requestNotPreparedPage(sid) {
+  return htmlResponse(page(REQUEST_NOT_PREPARED.title, `<main class="kya-consent-not-prepared">
+<h1>${escapeHtml2(REQUEST_NOT_PREPARED.title)}</h1>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.body)}</p>
+<h2>What to do next</h2>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.nextStep)}</p>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.unsupported)}</p>
+<p>Once your agent confirms it is ready, <a href="?sid=${encodeURIComponent(sid)}">Reload this page</a>. If the request has expired, ask your agent to start a new request.</p>
+</main>`), 409);
+}
 function notFoundJson() {
   return jsonResponse({
     error: "We could not find this authorization request. It may have already completed or been cancelled."
@@ -166731,7 +166752,7 @@ async function handleAnchorConsentGet(c, sid, env2, cfg) {
   }
   const info = await infoResponse.json();
   if (info.nativeHttp && (!info.holderKeyId || info.status === "pending")) {
-    return approvalFailedPage("The agent must establish its pickup key before you approve.", 409);
+    return requestNotPreparedPage(sid);
   }
   if (info.nativeHttp && (!cfg.native || info.nativeIssuerDid !== cfg.native.issuerDid))
     return nativeUnavailable();
@@ -166809,7 +166830,7 @@ async function handleAnchorConsentApprove(c, sid, env2, cfg) {
   }
   const info = await infoResponse.json();
   if (info.nativeHttp && (!info.holderKeyId || info.status === "pending")) {
-    return approvalFailedJson("The agent must establish its pickup key before you approve.", 409);
+    return approvalFailedJson(`${REQUEST_NOT_PREPARED.title}. ${REQUEST_NOT_PREPARED.body} ${REQUEST_NOT_PREPARED.nextStep} ${REQUEST_NOT_PREPARED.unsupported}`, 409);
   }
   if (info.nativeHttp && (!cfg.native || info.nativeIssuerDid !== cfg.native.issuerDid))
     return nativeUnavailable();

package/dist/bundles/hardware-world.js

@@ -159646,7 +159646,12 @@ function anchorSnapshot(rec) {
     nativePolicyRevision: rec.nativePolicyRevision
   };
 }
-var pendingBody = () => ({ status: "pending" });
+var pendingBody = (rec, now2) => ({
+  status: "pending",
+  // This is the remaining authorization-session lifetime, not the future VC's
+  // lifetime. Preserve the frozen legacy response and the original DO deadline.
+  ...rec.nativeHttp ? { expires_in: Math.max(0, Math.floor((rec.expiresAt - now2) / 1e3)) } : {}
+});
 var pinnedErr = () => ({ error: KYAOS_ERRORS.pickupPinned });
 var invalidSessionErr = () => ({ error: KYAOS_ERRORS.invalidSession });
 var pickupExpiredErr = () => ({ error: KYAOS_ERRORS.pickupExpired });
@@ -159750,7 +159755,7 @@ function reducePoll(rec, holder, now2) {
   }
   return {
     record: { ...working, lastPollAt: now2 },
-    response: { status: 202, body: pendingBody() }
+    response: { status: 202, body: pendingBody(working, now2) }
   };
 }
 function reduceApprove(rec, input2, now2) {
@@ -159900,7 +159905,7 @@ async function handlePickupInternal(ctx, request, now2) {
 // ../mcp-i-cloudflare/package.json
 var package_default = {
   name: "@kya-os/mcp-i-cloudflare",
-  version: "1.14.3",
+  version: "1.14.5",
   description: "Cloudflare Workers adapter for MCP-I framework",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -166390,6 +166395,22 @@ function approvalFailedPage(message3, status = 410) {
 <p>${escapeHtml2(message3)}</p>
 </main>`), status);
 }
+var REQUEST_NOT_PREPARED = {
+  title: "Your agent has not prepared this request yet",
+  body: "Before you can approve, your agent must establish the secure key that will receive your permission. No access has been granted.",
+  nextStep: "Return to your chat and ask your agent to finish preparing this authorization request before sharing the approval link.",
+  unsupported: "If the agent's tools cannot sign requests, this flow cannot be completed in that tool. Do not send your password or browser cookies to the agent."
+};
+function requestNotPreparedPage(sid) {
+  return htmlResponse(page(REQUEST_NOT_PREPARED.title, `<main class="kya-consent-not-prepared">
+<h1>${escapeHtml2(REQUEST_NOT_PREPARED.title)}</h1>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.body)}</p>
+<h2>What to do next</h2>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.nextStep)}</p>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.unsupported)}</p>
+<p>Once your agent confirms it is ready, <a href="?sid=${encodeURIComponent(sid)}">Reload this page</a>. If the request has expired, ask your agent to start a new request.</p>
+</main>`), 409);
+}
 function notFoundJson() {
   return jsonResponse({
     error: "We could not find this authorization request. It may have already completed or been cancelled."
@@ -166731,7 +166752,7 @@ async function handleAnchorConsentGet(c, sid, env2, cfg) {
   }
   const info = await infoResponse.json();
   if (info.nativeHttp && (!info.holderKeyId || info.status === "pending")) {
-    return approvalFailedPage("The agent must establish its pickup key before you approve.", 409);
+    return requestNotPreparedPage(sid);
   }
   if (info.nativeHttp && (!cfg.native || info.nativeIssuerDid !== cfg.native.issuerDid))
     return nativeUnavailable();
@@ -166809,7 +166830,7 @@ async function handleAnchorConsentApprove(c, sid, env2, cfg) {
   }
   const info = await infoResponse.json();
   if (info.nativeHttp && (!info.holderKeyId || info.status === "pending")) {
-    return approvalFailedJson("The agent must establish its pickup key before you approve.", 409);
+    return approvalFailedJson(`${REQUEST_NOT_PREPARED.title}. ${REQUEST_NOT_PREPARED.body} ${REQUEST_NOT_PREPARED.nextStep} ${REQUEST_NOT_PREPARED.unsupported}`, 409);
   }
   if (info.nativeHttp && (!cfg.native || info.nativeIssuerDid !== cfg.native.issuerDid))
     return nativeUnavailable();

package/dist/bundles/manifest.json

@@ -1,29 +1,29 @@
 {
-  "version": "1.11.3",
-  "frameworkVersion": "1.14.3",
+  "version": "1.11.4",
+  "frameworkVersion": "1.14.5",
   "doClassName": "MCPIAgent",
   "auditDoClassName": "AuditProducer",
-  "buildDate": "2026-09-16T00:51:29.426Z",
+  "buildDate": "2026-09-17T17:15:27.894Z",
   "templates": {
     "blank": {
       "file": "blank.js",
-      "size": 8170758,
-      "hash": "sha256:72e778e39a3371b5c554e40416412040b0d73ad621aff3f61a7576475ebd7b5c"
+      "size": 8172141,
+      "hash": "sha256:964b549d9b27cc744b75232f5315c8a2a88edd4e34da4e8d6cede681be910191"
     },
     "hardware-world": {
       "file": "hardware-world.js",
-      "size": 8183177,
-      "hash": "sha256:1edd8330eddd7af048c972cdc00a76c7c58a01b30d9a740648b74e7710a6635b"
+      "size": 8184560,
+      "hash": "sha256:613ed3ca8a5936fa063137a257fd95183b8db7fbb28f557909fd1976c5187e1b"
     },
     "ecommerce": {
       "file": "ecommerce.js",
-      "size": 8172452,
-      "hash": "sha256:09a58de753d02f25f3a9cb59edf9f2696f876352beebf4cc4d74f04c20ac4527"
+      "size": 8173835,
+      "hash": "sha256:e1de25fb7a73eb3d73b0d9d1c6dff89d82605b263cfe01d5ccc245238a354b28"
     },
     "mix-station": {
       "file": "mix-station.js",
-      "size": 8185802,
-      "hash": "sha256:0c29ba4e04375e595401be3916cc35d49400861287f4c8c4ccfa69c999612396"
+      "size": 8187185,
+      "hash": "sha256:b5acc100ef55c725c25eff966d5739203cb112ecded3c9430c6d1acf366136b6"
     }
   }
 }

package/dist/bundles/mix-station.js

@@ -159646,7 +159646,12 @@ function anchorSnapshot(rec) {
     nativePolicyRevision: rec.nativePolicyRevision
   };
 }
-var pendingBody = () => ({ status: "pending" });
+var pendingBody = (rec, now2) => ({
+  status: "pending",
+  // This is the remaining authorization-session lifetime, not the future VC's
+  // lifetime. Preserve the frozen legacy response and the original DO deadline.
+  ...rec.nativeHttp ? { expires_in: Math.max(0, Math.floor((rec.expiresAt - now2) / 1e3)) } : {}
+});
 var pinnedErr = () => ({ error: KYAOS_ERRORS.pickupPinned });
 var invalidSessionErr = () => ({ error: KYAOS_ERRORS.invalidSession });
 var pickupExpiredErr = () => ({ error: KYAOS_ERRORS.pickupExpired });
@@ -159750,7 +159755,7 @@ function reducePoll(rec, holder, now2) {
   }
   return {
     record: { ...working, lastPollAt: now2 },
-    response: { status: 202, body: pendingBody() }
+    response: { status: 202, body: pendingBody(working, now2) }
   };
 }
 function reduceApprove(rec, input2, now2) {
@@ -159900,7 +159905,7 @@ async function handlePickupInternal(ctx, request, now2) {
 // ../mcp-i-cloudflare/package.json
 var package_default = {
   name: "@kya-os/mcp-i-cloudflare",
-  version: "1.14.3",
+  version: "1.14.5",
   description: "Cloudflare Workers adapter for MCP-I framework",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -166390,6 +166395,22 @@ function approvalFailedPage(message3, status = 410) {
 <p>${escapeHtml2(message3)}</p>
 </main>`), status);
 }
+var REQUEST_NOT_PREPARED = {
+  title: "Your agent has not prepared this request yet",
+  body: "Before you can approve, your agent must establish the secure key that will receive your permission. No access has been granted.",
+  nextStep: "Return to your chat and ask your agent to finish preparing this authorization request before sharing the approval link.",
+  unsupported: "If the agent's tools cannot sign requests, this flow cannot be completed in that tool. Do not send your password or browser cookies to the agent."
+};
+function requestNotPreparedPage(sid) {
+  return htmlResponse(page(REQUEST_NOT_PREPARED.title, `<main class="kya-consent-not-prepared">
+<h1>${escapeHtml2(REQUEST_NOT_PREPARED.title)}</h1>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.body)}</p>
+<h2>What to do next</h2>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.nextStep)}</p>
+<p>${escapeHtml2(REQUEST_NOT_PREPARED.unsupported)}</p>
+<p>Once your agent confirms it is ready, <a href="?sid=${encodeURIComponent(sid)}">Reload this page</a>. If the request has expired, ask your agent to start a new request.</p>
+</main>`), 409);
+}
 function notFoundJson() {
   return jsonResponse({
     error: "We could not find this authorization request. It may have already completed or been cancelled."
@@ -166731,7 +166752,7 @@ async function handleAnchorConsentGet(c, sid, env2, cfg) {
   }
   const info = await infoResponse.json();
   if (info.nativeHttp && (!info.holderKeyId || info.status === "pending")) {
-    return approvalFailedPage("The agent must establish its pickup key before you approve.", 409);
+    return requestNotPreparedPage(sid);
   }
   if (info.nativeHttp && (!cfg.native || info.nativeIssuerDid !== cfg.native.issuerDid))
     return nativeUnavailable();
@@ -166809,7 +166830,7 @@ async function handleAnchorConsentApprove(c, sid, env2, cfg) {
   }
   const info = await infoResponse.json();
   if (info.nativeHttp && (!info.holderKeyId || info.status === "pending")) {
-    return approvalFailedJson("The agent must establish its pickup key before you approve.", 409);
+    return approvalFailedJson(`${REQUEST_NOT_PREPARED.title}. ${REQUEST_NOT_PREPARED.body} ${REQUEST_NOT_PREPARED.nextStep} ${REQUEST_NOT_PREPARED.unsupported}`, 409);
   }
   if (info.nativeHttp && (!cfg.native || info.nativeIssuerDid !== cfg.native.issuerDid))
     return nativeUnavailable();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/create-mcpi-app",
-  "version": "1.11.3",
+  "version": "1.11.4",
   "description": "Scaffold a new MCP-I application",
   "type": "module",
   "main": "./dist/helpers/index.js",
@@ -51,7 +51,7 @@
     "@kya-os/cli-effects": "^1.0.19",
     "@kya-os/contracts": "^1.12.1",
     "@kya-os/mcp-i": "^1.12.2",
-    "@kya-os/mcp-i-cloudflare": "^1.14.3",
+    "@kya-os/mcp-i-cloudflare": "^1.14.5",
     "base-x": "^5.0.0",
     "chalk": "^4.1.2",
     "commander": "^12.1.0",