@kya-os/create-mcpi-app 1.11.3 → 1.11.5

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @kya-os/create-mcpi-app@1.11.3 build /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app
+> @kya-os/create-mcpi-app@1.11.5 build /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app
 > tsc && chmod +x dist/index.js && node --import tsx scripts/build-bundles.ts
 
 🔨 Building template bundles...
@@ -7,23 +7,23 @@
 
 📦 Building template: blank
   ✅ Source files written to /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/.tmp-bundles/blank
-  ✅ Bundle built: 8170758 bytes, hash: sha256:72e778e39a337...
+  ✅ Bundle built: 8185156 bytes, hash: sha256:5355d615d55b1...
 
 📦 Building template: hardware-world
   ✅ Source files written to /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/.tmp-bundles/hardware-world
-  ✅ Bundle built: 8183177 bytes, hash: sha256:1edd8330eddd7...
+  ✅ Bundle built: 8197575 bytes, hash: sha256:9a767e0eb1c34...
 
 📦 Building template: ecommerce
   ✅ Source files written to /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/.tmp-bundles/ecommerce
-  ✅ Bundle built: 8172452 bytes, hash: sha256:09a58de753d02...
+  ✅ Bundle built: 8186850 bytes, hash: sha256:18b9a8622a500...
 
 📦 Building template: mix-station
   ✅ Source files written to /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/.tmp-bundles/mix-station
-  ✅ Bundle built: 8185802 bytes, hash: sha256:0c29ba4e04375...
+  ✅ Bundle built: 8200200 bytes, hash: sha256:a6fffe48032f7...
 
 ✅ All bundles built successfully!
    Output: /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/bundles
-   Version: 1.11.3
-   Framework: 1.14.3
+   Version: 1.11.5
+   Framework: 1.14.6
    Templates: blank, hardware-world, ecommerce, mix-station
    Manifest: /home/runner/work/xmcp-i/xmcp-i/packages/create-mcpi-app/dist/bundles/manifest.json

package/dist/bundles/blank.js

@@ -52578,12 +52578,12 @@ function parseAuditConsistencyProofResponse(input2) {
 function toAuditHeadResponse(head) {
   return { schema: AUDIT_HEAD_RESPONSE_SCHEMA_ID, head };
 }
-function toAuditListEntriesResponse(page2) {
+function toAuditListEntriesResponse(page) {
   return {
     schema: AUDIT_LIST_ENTRIES_RESPONSE_SCHEMA_ID,
-    entries: page2.entries,
-    head: page2.head,
-    nextAfterSequence: page2.nextAfterSequence
+    entries: page.entries,
+    head: page.head,
+    nextAfterSequence: page.nextAfterSequence
   };
 }
 function toAuditInclusionProofResponse(proof) {
@@ -79323,6 +79323,38 @@ var init_idp_scopes = __esm({
   }
 });
 
+// ../contracts/dist/consent/authorization-progress.js
+var require_authorization_progress = __commonJS({
+  "../contracts/dist/consent/authorization-progress.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ConsentPreparationStatusSchema = exports.AuthorizationProgressSchema = void 0;
+    var zod_1 = require_cjs();
+    exports.AuthorizationProgressSchema = zod_1.z.discriminatedUnion("state", [
+      zod_1.z.object({
+        state: zod_1.z.literal("preparation_required"),
+        approval_ready: zod_1.z.literal(false)
+      }).strict(),
+      zod_1.z.object({
+        state: zod_1.z.literal("approval_ready"),
+        approval_ready: zod_1.z.literal(true)
+      }).strict(),
+      zod_1.z.object({ state: zod_1.z.literal("completed"), approval_ready: zod_1.z.literal(false) }).strict(),
+      zod_1.z.object({ state: zod_1.z.literal("expired"), approval_ready: zod_1.z.literal(false) }).strict(),
+      zod_1.z.object({ state: zod_1.z.literal("not_found"), approval_ready: zod_1.z.literal(false) }).strict(),
+      zod_1.z.object({
+        state: zod_1.z.literal("unavailable"),
+        approval_ready: zod_1.z.literal(false)
+      }).strict()
+    ]);
+    exports.ConsentPreparationStatusSchema = zod_1.z.object({
+      authorization: exports.AuthorizationProgressSchema,
+      expires_in: zod_1.z.number().int().min(0).max(600),
+      poll_interval_s: zod_1.z.literal(3)
+    }).strict();
+  }
+});
+
 // ../consent/dist/cjs/types/config.types.js
 var require_config_types = __commonJS({
   "../consent/dist/cjs/types/config.types.js"(exports) {
@@ -83950,8 +83982,15 @@ var require_consent = __commonJS({
   "../contracts/dist/consent/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.AUTH_MODE_REGISTRY = exports.AUTH_MODES = exports.DEFAULT_COLORS = exports.DEFAULT_EXPIRATION_DAYS = exports.DEFAULT_METADATA = exports.DEFAULT_SUCCESS = exports.DEFAULT_TERMS = exports.DEFAULT_UI = exports.DEFAULT_BRANDING = exports.validateAgentMetadata = exports.validateCapabilityGroup = exports.validateCapability = exports.CedarTemplateContextSchema = exports.CedarPolicySchema = exports.RiskLevelSchema = exports.ConsentThemeSchema = exports.AgentMetadataSchema = exports.CapabilityIconSchema = exports.CapabilityGroupSchema = exports.CapabilitySchema = exports.validateCustomField = exports.validateConsentBranding = exports.validateConsentConfig = exports.validateConsentPageConfig = exports.validateOAuthIdentity = exports.validateConsentApprovalResponse = exports.validateConsentApprovalRequest = exports.CredentialAuthResponseSchema = exports.CredentialAuthRequestSchema = exports.ConsentPageConfigSchema = exports.ConsentApprovalResponseSchema = exports.ConsentApprovalRequestSchema = exports.OAuthIdentitySchema = exports.IDVConfigSchema = exports.PasskeyConfigSchema = exports.QRCodeConfigSchema = exports.OTPConfigSchema = exports.MagicLinkConfigSchema = exports.OAuthConfigSchema = exports.CredentialsConfigSchema = exports.AuthModeSchema = exports.ConsentBrandingSchema = exports.ConsentMetadataSchema = exports.ConsentSuccessSchema = exports.ConsentUISchema = exports.ConsentTermsSchema = exports.ConsentCustomFieldOptionSchema = exports.ConsentCustomFieldSchema = exports.ConsentConfigWithMetaSchema = exports.ConsentConfigSchema = void 0;
-    exports.oauthIdentitySchema = exports.consentApprovalResponseSchema = exports.consentApprovalRequestSchema = exports.consentPageConfigSchema = exports.consentCustomFieldOptionSchema = exports.consentCustomFieldSchema = exports.consentConfigSchema = exports.consentTermsSchema = exports.consentBrandingSchema = exports.collectsCredentials = exports.requiresExternalAuth = exports.isAuthModeImplemented = exports.getImplementedAuthModes = exports.getAuthModeMetadata = void 0;
+    exports.DEFAULT_COLORS = exports.DEFAULT_EXPIRATION_DAYS = exports.DEFAULT_METADATA = exports.DEFAULT_SUCCESS = exports.DEFAULT_TERMS = exports.DEFAULT_UI = exports.DEFAULT_BRANDING = exports.validateAgentMetadata = exports.validateCapabilityGroup = exports.validateCapability = exports.CedarTemplateContextSchema = exports.CedarPolicySchema = exports.RiskLevelSchema = exports.ConsentThemeSchema = exports.AgentMetadataSchema = exports.CapabilityIconSchema = exports.CapabilityGroupSchema = exports.CapabilitySchema = exports.validateCustomField = exports.validateConsentBranding = exports.validateConsentConfig = exports.validateConsentPageConfig = exports.validateOAuthIdentity = exports.validateConsentApprovalResponse = exports.validateConsentApprovalRequest = exports.CredentialAuthResponseSchema = exports.CredentialAuthRequestSchema = exports.ConsentPageConfigSchema = exports.ConsentApprovalResponseSchema = exports.ConsentApprovalRequestSchema = exports.OAuthIdentitySchema = exports.IDVConfigSchema = exports.PasskeyConfigSchema = exports.QRCodeConfigSchema = exports.OTPConfigSchema = exports.MagicLinkConfigSchema = exports.OAuthConfigSchema = exports.CredentialsConfigSchema = exports.AuthModeSchema = exports.ConsentBrandingSchema = exports.ConsentMetadataSchema = exports.ConsentSuccessSchema = exports.ConsentUISchema = exports.ConsentTermsSchema = exports.ConsentCustomFieldOptionSchema = exports.ConsentCustomFieldSchema = exports.ConsentConfigWithMetaSchema = exports.ConsentConfigSchema = exports.ConsentPreparationStatusSchema = exports.AuthorizationProgressSchema = void 0;
+    exports.oauthIdentitySchema = exports.consentApprovalResponseSchema = exports.consentApprovalRequestSchema = exports.consentPageConfigSchema = exports.consentCustomFieldOptionSchema = exports.consentCustomFieldSchema = exports.consentConfigSchema = exports.consentTermsSchema = exports.consentBrandingSchema = exports.collectsCredentials = exports.requiresExternalAuth = exports.isAuthModeImplemented = exports.getImplementedAuthModes = exports.getAuthModeMetadata = exports.AUTH_MODE_REGISTRY = exports.AUTH_MODES = void 0;
+    var authorization_progress_1 = require_authorization_progress();
+    Object.defineProperty(exports, "AuthorizationProgressSchema", { enumerable: true, get: function() {
+      return authorization_progress_1.AuthorizationProgressSchema;
+    } });
+    Object.defineProperty(exports, "ConsentPreparationStatusSchema", { enumerable: true, get: function() {
+      return authorization_progress_1.ConsentPreparationStatusSchema;
+    } });
     var consent_1 = require_cjs2();
     Object.defineProperty(exports, "ConsentConfigSchema", { enumerable: true, get: function() {
       return consent_1.ConsentConfigSchema;
@@ -159646,7 +159685,19 @@ function anchorSnapshot(rec) {
     nativePolicyRevision: rec.nativePolicyRevision
   };
 }
-var pendingBody = () => ({ status: "pending" });
+var pendingBody = (rec, now2) => ({
+  status: "pending",
+  // This is the remaining authorization-session lifetime, not the future VC's
+  // lifetime. Preserve the frozen legacy response and the original DO deadline.
+  ...rec.nativeHttp ? {
+    expires_in: Math.max(0, Math.floor((rec.expiresAt - now2) / 1e3)),
+    // Presentation only, emitted after the verified poll pins/matches its holder.
+    authorization: rec.expiresAt - now2 < 1e3 ? { state: "expired", approval_ready: false } : {
+      state: "approval_ready",
+      approval_ready: true
+    }
+  } : {}
+});
 var pinnedErr = () => ({ error: KYAOS_ERRORS.pickupPinned });
 var invalidSessionErr = () => ({ error: KYAOS_ERRORS.invalidSession });
 var pickupExpiredErr = () => ({ error: KYAOS_ERRORS.pickupExpired });
@@ -159750,7 +159801,7 @@ function reducePoll(rec, holder, now2) {
   }
   return {
     record: { ...working, lastPollAt: now2 },
-    response: { status: 202, body: pendingBody() }
+    response: { status: 202, body: pendingBody(working, now2) }
   };
 }
 function reduceApprove(rec, input2, now2) {
@@ -159900,7 +159951,7 @@ async function handlePickupInternal(ctx, request, now2) {
 // ../mcp-i-cloudflare/package.json
 var package_default = {
   name: "@kya-os/mcp-i-cloudflare",
-  version: "1.14.3",
+  version: "1.14.6",
   description: "Cloudflare Workers adapter for MCP-I framework",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -159918,6 +159969,7 @@ var package_default = {
     "test:workers": "vitest run --config vitest.workers.config.ts",
     "test:workers:watch": "vitest --config vitest.workers.config.ts",
     "test:e2e": "playwright test",
+    "test:preparation-browser": "playwright test --config playwright.preparation.config.ts",
     "test:e2e:headed": "playwright test --headed",
     "test:e2e:ui": "playwright test --ui",
     "test:e2e:debug": "playwright test --debug",
@@ -159930,7 +159982,7 @@ var package_default = {
   },
   dependencies: {
     "@kya-os/consent": "^0.1.47",
-    "@kya-os/contracts": "^1.12.1",
+    "@kya-os/contracts": "^1.12.3",
     "@kya-os/mcp": "1.15.0",
     "@kya-os/mcp-i-core": "^1.9.2",
     "@kya-os/mcp-i-runtime": "^1.2.4",
@@ -166104,6 +166156,166 @@ function nativeCapabilitiesForScopes(groups, scopes) {
   return result;
 }
 
+// ../mcp-i-cloudflare/dist/delegation-http/consent-preparation-page.js
+init_escape2();
+var RECOVERY_MESSAGES = {
+  expired: [
+    "Authorization link expired",
+    "Return to your chat and ask your agent to start a new authorization request. This page cannot renew the expired request."
+  ],
+  not_found: [
+    "Authorization request not found",
+    "Return to your chat and ask your agent for a new authorization request."
+  ],
+  completed: [
+    "This request has been approved",
+    "Return to your chat. Your agent can retrieve the delegation using the key it prepared."
+  ],
+  unavailable: [
+    "Unable to check this request",
+    "Automatic checks have stopped. Try Check again, or ask your agent to check the request. No access was granted by this page."
+  ]
+};
+function consentPreparationPage(options) {
+  const nonce = crypto.randomUUID();
+  const path = `/consent?sid=${encodeURIComponent(options.sid)}`;
+  const branding = options.branding;
+  const color = /^#[0-9a-f]{6}$/i.test(branding?.primaryColor ?? "") ? branding.primaryColor : "#6750a4";
+  let logo = "";
+  try {
+    const url3 = new URL(branding?.logoUrl ?? "");
+    if (url3.protocol === "https:" && !url3.username && !url3.password)
+      logo = `<img class="logo" src="${escapeHtml2(url3.href)}" alt="" referrerpolicy="no-referrer">`;
+  } catch {
+  }
+  const seconds = Number.isFinite(options.expiresIn) ? Math.max(0, Math.min(600, Math.floor(options.expiresIn))) : 0;
+  const terminal = options.terminalState ?? (seconds === 0 ? "expired" : void 0);
+  const title = terminal ? RECOVERY_MESSAGES[terminal][0] : "Preparing your authorization request";
+  const message3 = terminal ? RECOVERY_MESSAGES[terminal][1] : "Waiting for your agent. This page will continue automatically when the request is ready.";
+  const html = `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${escapeHtml2(title)}</title>
+<style nonce="${nonce}">
+:root { color-scheme: light; font-family: system-ui, -apple-system, sans-serif; color: #24212b; background: #f7f6fa; --brand: ${color}; }
+* { box-sizing: border-box; } [hidden] { display: none !important; } body { margin: 0; min-height: 100vh; display: grid; place-items: center; padding: 28px 16px; }
+main { width: 100%; max-width: 512px; background: white; border: 1px solid #e5e2eb; border-radius: 20px; padding: 32px; box-shadow: 0 16px 48px #24123b0b; }
+.brand { display: flex; align-items: center; gap: 12px; font-weight: 650; font-size: 15px; overflow-wrap: anywhere; } .logo { max-width: 112px; max-height: 36px; object-fit: contain; }
+.badge { color: #5f586d; font-size: 12px; text-transform: uppercase; letter-spacing: .07em; margin-top: 30px; }
+h1 { font-size: 27px; line-height: 1.2; letter-spacing: -.025em; margin: 12px 0; } p { font-size: 15px; line-height: 1.6; color: #625b6b; }
+ol { padding: 0; list-style: none; display: grid; gap: 16px; margin: 28px 0; } li { display: flex; align-items: center; gap: 12px; font-size: 14px; }
+.number { border: 1px solid #ded9e7; border-radius: 50%; display: grid; place-items: center; width: 28px; height: 28px; flex: none; color: #756b84; } li:first-child .number { border-color: var(--brand); color: var(--brand); }
+.status { padding: 16px; border-radius: 12px; background: #f7f6fa; border: 1px solid #eeebf3; } .status p { margin: 0; } #countdown { font-size: 13px; margin-top: 8px; }
+details { margin-top: 20px; font-size: 14px; } summary { cursor: pointer; font-weight: 600; } details p { font-size: 14px; } code { overflow-wrap: anywhere; }
+.reload { display: block; text-align: center; border: 1px solid #d4cede; padding: 12px; border-radius: 8px; margin-top: 24px; color: #393142; text-decoration: none; font-weight: 600; font-size: 14px; }
+a:focus-visible, summary:focus-visible { outline: 3px solid var(--brand); outline-offset: 4px; } .foot { font-size: 12px; margin: 20px 0 0; text-align: center; }
+@media(max-width: 420px) { main { padding: 24px; } h1 { font-size: 24px; } }
+</style></head><body><main>
+<div class="brand">${logo}<span>${escapeHtml2(branding?.companyName || "KYA-OS")}</span></div>
+<div class="badge">Secure authorization</div>
+<h1 id="title">${escapeHtml2(title)}</h1>
+<p id="intro" ${terminal ? "hidden" : ""}>Your agent needs to prepare its secure connection before you can sign in and approve access. No access has been granted.</p>
+<ol id="steps" aria-label="Authorization steps" ${terminal ? "hidden" : ""}><li><span class="number">1</span>Agent prepares the request</li><li><span class="number">2</span>You sign in and review permissions</li><li><span class="number">3</span>Agent receives your approved access</li></ol>
+<div class="status" role="status" aria-live="polite"><p id="status">${escapeHtml2(message3)}</p></div>
+<p id="countdown" aria-live="off" ${terminal ? "hidden" : ""}>This request expires in ${seconds} seconds.</p>
+<details><summary>Taking longer than expected?</summary>
+<p>Return to your chat and ask your agent to finish preparing this authorization request. This page cannot prepare it on the agent\u2019s behalf.</p>
+<p>If its tools cannot sign requests, this flow cannot be completed in that tool. Do not send your password or browser cookies to the agent.</p>
+<p>Requested permissions: ${options.scopes.map((scope) => `<code>${escapeHtml2(scope)}</code>`).join(", ")}</p></details>
+<a class="reload" id="reload" href="${escapeHtml2(path)}" ${terminal && terminal !== "unavailable" ? "hidden" : ""}>Check again</a>
+<noscript><p>Automatic updates need JavaScript. Once your agent has prepared the request, select Check again.</p></noscript>
+<p class="foot">Preparation does not approve access. You decide what to allow.</p>
+</main>${terminal ? "" : `<script nonce="${nonce}">
+(() => {
+  const consentPath = ${JSON.stringify(path)};
+  const statusPath = consentPath + '&view=preparation';
+  const deadline = performance.now() + ${seconds * 1e3};
+  const wallDeadline = Date.now() + ${seconds * 1e3};
+  const title = document.getElementById('title');
+  const intro = document.getElementById('intro');
+  const status = document.getElementById('status');
+  const countdown = document.getElementById('countdown');
+  const reload = document.getElementById('reload');
+  let stopped = false, suspended = false, generation = 0, timer, expiryTimer, requestTimer, controller, failures = 0;
+  function remaining() {
+    // The original lifetime must also elapse while browser timers are frozen.
+    return Math.min(deadline - performance.now(), wallDeadline - Date.now());
+  }
+  function cancelChecks() {
+    generation++;
+    clearTimeout(timer); clearTimeout(expiryTimer); clearTimeout(requestTimer);
+    if (controller) controller.abort();
+  }
+  function stop(kind) {
+    if (stopped) return;
+    stopped = true;
+    cancelChecks();
+    countdown.hidden = true;
+    if (kind === 'ready') { location.replace(consentPath); return; }
+    const messages = ${JSON.stringify(RECOVERY_MESSAGES)};
+    const message = messages[kind] || messages.unavailable;
+    title.textContent = message[0]; status.textContent = message[1];
+    intro.hidden = true;
+    document.getElementById('steps').hidden = true;
+    reload.hidden = kind !== 'unavailable';
+  }
+  async function poll() {
+    if (stopped || suspended) return;
+    if (remaining() <= 0) { stop('expired'); return; }
+    const requestGeneration = generation;
+    const isCurrent = () => !stopped && !suspended && requestGeneration === generation;
+    const requestController = new AbortController();
+    controller = requestController;
+    const timeout = setTimeout(() => requestController.abort(), 5000);
+    requestTimer = timeout;
+    try {
+      const response = await fetch(statusPath, { headers: { Accept: 'application/json' }, credentials: 'omit', cache: 'no-store', redirect: 'error', signal: requestController.signal });
+      if (!isCurrent()) return;
+      if (response.status === 410) { stop('expired'); return; }
+      if (response.status === 404) { stop('not_found'); return; }
+      if (!response.ok) throw new Error('Unavailable');
+      const body = await response.json();
+      if (!isCurrent()) return;
+      if (remaining() <= 0 || body.expires_in === 0) { stop('expired'); return; }
+      if (!Number.isInteger(body.expires_in) || body.expires_in < 0 || body.expires_in > 600 || body.poll_interval_s !== 3) throw new Error('Invalid lifetime');
+      const auth = body.authorization;
+      if (auth?.state === 'approval_ready' && auth.approval_ready === true) { stop('ready'); return; }
+      if (auth?.state === 'completed' && auth.approval_ready === false) { stop('completed'); return; }
+      if (auth?.state !== 'preparation_required' || auth.approval_ready !== false) throw new Error('Invalid state');
+      failures = 0;
+      status.textContent = 'Waiting for your agent. This page will continue automatically when the request is ready.';
+      countdown.textContent = 'Request expires in ' + Math.min(body.expires_in, Math.ceil(remaining() / 1000)) + ' seconds.';
+    } catch {
+      if (!isCurrent()) return;
+      failures++;
+      if (failures >= 3) { stop('unavailable'); return; }
+      status.textContent = 'Connection interrupted. Checking again shortly\u2026';
+    } finally { clearTimeout(timeout); }
+    if (isCurrent()) timer = setTimeout(poll, 3000);
+  }
+  window.addEventListener('pagehide', () => { suspended = true; cancelChecks(); });
+  window.addEventListener('pageshow', (event) => {
+    if (!event.persisted || !suspended || stopped) return;
+    suspended = false;
+    if (remaining() <= 0) { stop('expired'); return; }
+    expiryTimer = setTimeout(() => stop('expired'), remaining());
+    poll();
+  });
+  expiryTimer = setTimeout(() => stop('expired'), Math.max(0, remaining()));
+  timer = setTimeout(poll, 3000);
+})();
+<\/script>`}</body></html>`;
+  return new Response(html, {
+    status: options.status ?? (terminal === "expired" ? 410 : 409),
+    headers: {
+      "Content-Type": "text/html; charset=utf-8",
+      "Cache-Control": "no-store",
+      "Referrer-Policy": "no-referrer",
+      "X-Content-Type-Options": "nosniff",
+      "Content-Security-Policy": `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'nonce-${nonce}'; connect-src 'self'; img-src https:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`
+    }
+  });
+}
+
 // ../mcp-i-cloudflare/dist/delegation-http/consent-anchor-bridge.js
 init_crypto3();
 init_storage();
@@ -166359,36 +166571,34 @@ function jsonResponse(body, status) {
     }
   });
 }
-function page(title, bodyInner) {
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="UTF-8">
-<meta name="viewport" content="width=device-width, initial-scale=1.0">
-<title>${escapeHtml2(title)}</title>
-</head>
-<body>
-${bodyInner}
-</body>
-</html>`;
-}
-function expiredPage() {
-  return htmlResponse(page("Authorization link expired", `<main class="kya-consent-expired">
-<h1>Authorization link expired</h1>
-<p>This authorization request is no longer valid. Please start over to request a new one.</p>
-</main>`), 410);
-}
-function notFoundPage() {
-  return htmlResponse(page("Authorization request not found", `<main class="kya-consent-notfound">
-<h1>Authorization request not found</h1>
-<p>We could not find this authorization request. It may have already completed or been cancelled.</p>
-</main>`), 404);
+var REQUEST_NOT_PREPARED = {
+  title: "Your agent has not prepared this request yet",
+  body: "Before you can approve, your agent must establish the secure key that will receive your permission. No access has been granted.",
+  nextStep: "Return to your chat and ask your agent to finish preparing this authorization request before sharing the approval link.",
+  unsupported: "If the agent's tools cannot sign requests, this flow cannot be completed in that tool. Do not send your password or browser cookies to the agent."
+};
+function preparationStatus(state, status = 200, expiresAt = Date.now()) {
+  const body = {
+    authorization: state === "approval_ready" ? { state, approval_ready: true } : { state, approval_ready: false },
+    expires_in: Math.max(0, Math.min(600, Math.floor((expiresAt - Date.now()) / 1e3))),
+    poll_interval_s: 3
+  };
+  return jsonResponse(body, status);
 }
-function approvalFailedPage(message3, status = 410) {
-  return htmlResponse(page("Authorization failed", `<main class="kya-consent-failed">
-<h1>Authorization failed</h1>
-<p>${escapeHtml2(message3)}</p>
-</main>`), status);
+async function preparationBranding(env2) {
+  let timeout;
+  try {
+    return await Promise.race([
+      new ConsentConfigService(env2).getConsentConfig(env2.AGENTSHIELD_PROJECT_ID || "").then((config4) => config4.branding),
+      new Promise((resolve2) => {
+        timeout = setTimeout(() => resolve2(void 0), 1500);
+      })
+    ]);
+  } catch {
+    return void 0;
+  } finally {
+    clearTimeout(timeout);
+  }
 }
 function notFoundJson() {
   return jsonResponse({
@@ -166719,29 +166929,63 @@ async function mintDelegationVcJwt(env2, sid, info, expiresInS, authorizedUser,
   };
 }
 async function handleAnchorConsentGet(c, sid, env2, cfg) {
-  const infoResponse = await callAnchor2(env2, sid, INTERNAL_PICKUP_INFO, {
-    sid
+  const statusOnly = c.req.query("view") === "preparation";
+  const recovery = async (state, status) => statusOnly ? preparationStatus(state, status) : consentPreparationPage({
+    sid,
+    expiresIn: 0,
+    scopes: [],
+    terminalState: state,
+    status,
+    branding: await preparationBranding(env2)
   });
+  let infoResponse;
+  try {
+    infoResponse = await callAnchor2(env2, sid, INTERNAL_PICKUP_INFO, { sid });
+  } catch {
+    return recovery("unavailable", 502);
+  }
   if (infoResponse.status === 404)
-    return notFoundPage();
+    return recovery("not_found", 404);
   if (infoResponse.status === 410)
-    return expiredPage();
+    return recovery("expired", 410);
   if (!infoResponse.ok) {
-    return approvalFailedPage("This authorization request could not be loaded. Please start over.", 502);
+    return recovery("unavailable", 502);
   }
-  const info = await infoResponse.json();
-  if (info.nativeHttp && (!info.holderKeyId || info.status === "pending")) {
-    return approvalFailedPage("The agent must establish its pickup key before you approve.", 409);
+  let info;
+  try {
+    info = await infoResponse.json();
+  } catch {
+    return recovery("unavailable", 502);
   }
+  if (!info || !Number.isFinite(info.expiresAt) || !["pending", "pinned", "approved"].includes(info.status))
+    return recovery("unavailable", 502);
   if (info.nativeHttp && (!cfg.native || info.nativeIssuerDid !== cfg.native.issuerDid))
-    return nativeUnavailable();
+    return recovery("unavailable", 503);
+  if (info.nativeHttp && Date.now() >= info.expiresAt)
+    return recovery("expired", 410);
+  if (info.nativeHttp && (!info.holderKeyId || info.status === "pending")) {
+    if (statusOnly)
+      return preparationStatus("preparation_required", 200, info.expiresAt);
+    const branding = await preparationBranding(env2);
+    return consentPreparationPage({
+      sid,
+      branding,
+      scopes: info.requiredScopes,
+      expiresIn: Math.max(0, Math.floor((info.expiresAt - Date.now()) / 1e3))
+    });
+  }
   if (info.nativeHttp) {
     try {
       info.agentDid = (await nativeHolderBinding(info.holderKeyId)).did;
     } catch {
-      return nativeUnavailable();
+      return recovery("unavailable", 503);
     }
   }
+  if (statusOnly) {
+    if (!info.nativeHttp)
+      return preparationStatus("unavailable", 404);
+    return preparationStatus(info.status === "approved" ? "completed" : "approval_ready", 200, info.expiresAt);
+  }
   const csrfToken = await mintCsrfToken(env2, sid);
   const projectId = env2.AGENTSHIELD_PROJECT_ID || "";
   const consentConfig = await new ConsentConfigService(env2).getConsentConfig(projectId);
@@ -166809,7 +167053,7 @@ async function handleAnchorConsentApprove(c, sid, env2, cfg) {
   }
   const info = await infoResponse.json();
   if (info.nativeHttp && (!info.holderKeyId || info.status === "pending")) {
-    return approvalFailedJson("The agent must establish its pickup key before you approve.", 409);
+    return approvalFailedJson(`${REQUEST_NOT_PREPARED.title}. ${REQUEST_NOT_PREPARED.body} ${REQUEST_NOT_PREPARED.nextStep} ${REQUEST_NOT_PREPARED.unsupported}`, 409);
   }
   if (info.nativeHttp && (!cfg.native || info.nativeIssuerDid !== cfg.native.issuerDid))
     return nativeUnavailable();