@kya-os/mcp-i-cloudflare 1.15.1 → 1.17.0

package/README.md

@@ -314,6 +314,48 @@ OAuth callback handler for delegation flow.
 
 ## Security Features
 
+### Delegation Credential Trust
+
+`DelegationService` (stored delegations and the `Authorization: Bearer` retry)
+accepts a delegation VC-JWT only if all of these hold, with or without
+`CHECKPOINT_API_KEY`:
+
+- **Pinned issuer.** `iss` is one of: the worker's own identity
+  (`MCP_IDENTITY_AGENT_DID`), the org DID in the native issuer binding
+  (`MCPI_NATIVE_HTTP_ISSUER_CONFIG`), a DID listed in
+  `KYA_OS_TRUSTED_DELEGATION_ISSUERS`, or the Checkpoint platform signer. The
+  platform signer is the did:key that the configured Checkpoint origin's
+  `/.well-known/did.json` (`CHECKPOINT_API_URL`, default `https://kya.vouched.id`)
+  lists in `alsoKnownAs` under its own assertion key. did:web issuers are
+  resolved with `@kya-os/mcp`'s did:web resolver, and the key is picked by the
+  JWT `kid` from the document's `assertionMethod`. An issuer is pinned before
+  its document is fetched. An untrusted or unresolvable issuer is refused.
+- **Audience.** `aud` is exactly `did:web:<the request's Host>`, and that DID
+  is one of this worker's resources, listed in `KYA_OS_RESOURCE_DIDS` (a JSON
+  array, one `did:web:<host>` per host the worker is routed under, provisioned
+  by Checkpoint). A token for one host is refused at another, and a
+  multi-valued `aud` is refused. The host is the request URL the edge
+  delivered (Workers for Platforms dispatch forwards the original request), never
+  `X-Forwarded-Host`. Nothing else is accepted: not the org DID, the worker's
+  own DID or a project id, whoever the issuer and with or without an API key.
+  With `KYA_OS_RESOURCE_DIDS` unset, empty or malformed, every delegation is
+  refused.
+- **Credential status.** A `credentialStatus` entry (Bitstring or StatusList2021,
+  revocation purpose) is read from its status list on every verification. A
+  revoked, unreachable or malformed entry is refused.
+
+With `CHECKPOINT_API_KEY` set, every accepted credential is still confirmed with
+Checkpoint and nothing is cached. Without it, legacy (non VC-JWT) tokens are
+refused unless `KYA_OS_INSECURE_DEV_TOKENS=1` is set. That flag is for local
+development only, logs a warning on every use, and is never cached. Only a
+pinned issuer's status-less verdict is cached, for 60 seconds.
+
+| Variable                            | Format                       | Purpose                                                                           |
+| ----------------------------------- | ---------------------------- | --------------------------------------------------------------------------------- |
+| `KYA_OS_TRUSTED_DELEGATION_ISSUERS` | comma/space-separated DIDs   | Extra pinned issuers (e.g. an org `did:web` on a worker without a native binding) |
+| `KYA_OS_RESOURCE_DIDS`              | JSON array of `did:web` DIDs | The worker's resources, one per routed host (required)                            |
+| `KYA_OS_INSECURE_DEV_TOKENS`        | `1` / `true`                 | Accept unchecked legacy tokens without an API key (development only)              |
+
 ### CSRF Protection for OAuth Flows
 
 The framework includes built-in CSRF (Cross-Site Request Forgery) protection for OAuth authorization flows. This prevents attackers from tricking users into authorizing unintended actions.

package/dist/agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,OAAO,KAAK,EACV,kBAAkB,EAClB,sBAAsB,EACtB,WAAW,EACZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAM7C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAa9C,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAeL,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,uBAAuB,CAAC;AAa/B,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAC;AAStC,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AAwBnC;;GAEG;AACH,MAAM,WAAW,qBACf,SAAQ,IAAI,CACV,aAAa,EACX,aAAa,GACb,eAAe,GACf,kBAAkB,GAClB,oBAAoB,GACpB,oBAAoB,GACpB,YAAY,CACf;IACD,CAAC,GAAG,EAAE,MAAM,GACR,WAAW,GACX,MAAM,GACN,kBAAkB,GAClB,sBAAsB,GACtB,SAAS,CAAC;IACd,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,gBAAgB,CAAC,EAAE,WAAW,CAAC;IAC/B,kBAAkB,CAAC,EAAE,WAAW,CAAC;IACjC,kBAAkB,CAAC,EAAE,WAAW,CAAC;IACjC,UAAU,CAAC,EAAE,sBAAsB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;GAeG;AACH,8BAAsB,mBAAoB,SAAQ,QAAQ;IAGxD,MAAM,EAGA,GAAG,CAAC;IAEV,SAAS,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAC1C,SAAS,CAAC,GAAG,EAAE,qBAAqB,CAAC;IACrC,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAC9C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA0B;IACzD,OAAO,CAAC,YAAY,CAA8C;IAClE,OAAO,CAAC,mBAAmB,CAAC,CAAS;IACrC,OAAO,CAAC,qBAAqB,CAAC,CAAuB;IACrD,OAAO,CAAC,wBAAwB,CAAC,CAAS;IAC1C,OAAO,CAAC,qBAAqB,CAAC,CAAS;IACvC,OAAO,CAAC,cAAc,CAAC,CAAgB;gBAGrC,KAAK,EAAE,kBAAkB,EACzB,GAAG,EAAE,qBAAqB,EAC1B,gBAAgB,GAAE,iBAA2C;IA8H/D;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAkB9B;;;OAGG;YACW,uBAAuB;IA8GrC;;;;;;;;;OASG;YACW,wBAAwB;IA0BtC;;;;;;;;;;;;OAYG;YACW,wBAAwB;IA6GtC;;;OAGG;YACW,6BAA6B;IAmG3C;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAC7B;QACE,UAAU,CAAC,EAAE;YACX,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,MAAM,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvC,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACD,SAAS,CACZ;IAID;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAI9D;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,YAAY,IAAI,MAAM;IAEzC;;;OAGG;IACH,SAAS,CAAC,eAAe,IAAI,MAAM;IAInC;;;OAGG;IACH,SAAS,CAAC,YAAY,IAAI,MAAM,GAAG,SAAS;IAI5C;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,CAAC,uBAAuB,IAAI,oBAAoB,GAAG,SAAS;IAIrE;;;OAGG;IACH,SAAS,CAAC,uBAAuB,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI;IAIrE;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,qBAAqB,IAAI,uBAAuB,GAAG,SAAS;IAItE;;;;;;;OAOG;IACH,SAAS,KAAK,qBAAqB,IAAI,OAAO,CAE7C;IAED;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,wBAAwB,CACzC,GAAG,EAAE,aAAa,GACjB,uBAAuB;IAE1B;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAyB3B;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAExD;;;;;;;;;;OAUG;YACW,yBAAyB;IAylBvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,SAAS,CAAC,qBAAqB,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7D,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,GAAG,EAAE,gDAAgD;IAC7D,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,GAAG,CAAC,GACrE,IAAI;IAkHP;;;;;;;;;;OAUG;cACa,oBAAoB,CAClC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,GAAG,OAAO,EAEjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,KAAK,EACX,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,EAC1E,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,OAAO,CAAC;IAg6BnB;;;;;;;;;OASG;YACW,gBAAgB;IA6iB9B;;;;;;;;;;;;;;;;;OAiBG;YACW,qBAAqB;IA+GnC;;;;;;;OAOG;YACW,6BAA6B;IA4D3C;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAQ7B,aAAa,IAAI,MAAM;IAUvB;;;;;;;;;;;;OAYG;IACG,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAuvBhD;;;;;;;;;;;;;;;;OAgBG;IACG,wBAAwB,IAAI,OAAO,CAAC;QACxC,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,EAAE,OAAO,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IA2HF;;;;;;;;OAQG;cACa,wBAAwB,CAAC,IAAI,EAAE;QAC7C,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QAMjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC,IAAI,CAAC;IAmCjB;;;;;;;;;;;;;;;;OAgBG;cACa,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CACN;QACE,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QAEjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAC;KAClB,GACD,SAAS,CACZ;IA2HD;;;;;;;;;;;;OAYG;YACW,sBAAsB;IA0FpC;;;;;;;;;;;;;OAaG;YACW,wBAAwB;IAqEtC;;;;;;OAMG;YACW,qBAAqB;CA+DpC"}
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,OAAO,KAAK,EACV,kBAAkB,EAClB,sBAAsB,EACtB,WAAW,EACZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAM7C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAKxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAa9C,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAeL,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,uBAAuB,CAAC;AAa/B,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAC;AAStC,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AAwBnC;;GAEG;AACH,MAAM,WAAW,qBACf,SAAQ,IAAI,CACV,aAAa,EACX,aAAa,GACb,eAAe,GACf,kBAAkB,GAClB,oBAAoB,GACpB,oBAAoB,GACpB,YAAY,CACf;IACD,CAAC,GAAG,EAAE,MAAM,GACR,WAAW,GACX,MAAM,GACN,kBAAkB,GAClB,sBAAsB,GACtB,SAAS,CAAC;IACd,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,gBAAgB,CAAC,EAAE,WAAW,CAAC;IAC/B,kBAAkB,CAAC,EAAE,WAAW,CAAC;IACjC,kBAAkB,CAAC,EAAE,WAAW,CAAC;IACjC,UAAU,CAAC,EAAE,sBAAsB,CAAC;CACrC;AAmBD;;;;;;;;;;;;;;;GAeG;AACH,8BAAsB,mBAAoB,SAAQ,QAAQ;IAGxD,MAAM,EAGA,GAAG,CAAC;IAEV,SAAS,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAC1C,SAAS,CAAC,GAAG,EAAE,qBAAqB,CAAC;IACrC,SAAS,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAC9C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA0B;IACzD,OAAO,CAAC,YAAY,CAA8C;IAClE,OAAO,CAAC,mBAAmB,CAAC,CAAS;IACrC,OAAO,CAAC,qBAAqB,CAAC,CAAuB;IACrD,OAAO,CAAC,wBAAwB,CAAC,CAAS;IAC1C,OAAO,CAAC,qBAAqB,CAAC,CAAS;IACvC,OAAO,CAAC,cAAc,CAAC,CAAgB;gBAGrC,KAAK,EAAE,kBAAkB,EACzB,GAAG,EAAE,qBAAqB,EAC1B,gBAAgB,GAAE,iBAA2C;IAkI/D;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAkB9B;;;OAGG;YACW,uBAAuB;IA8GrC;;;;;;;;;OASG;YACW,wBAAwB;IA0BtC;;;;;;;;;;;;OAYG;YACW,wBAAwB;IA6GtC;;;OAGG;YACW,6BAA6B;IAmG3C;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAC7B;QACE,UAAU,CAAC,EAAE;YACX,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,MAAM,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvC,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACD,SAAS,CACZ;IAID;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAI9D;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,YAAY,IAAI,MAAM;IAEzC;;;OAGG;IACH,SAAS,CAAC,eAAe,IAAI,MAAM;IAInC;;;OAGG;IACH,SAAS,CAAC,YAAY,IAAI,MAAM,GAAG,SAAS;IAI5C;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,CAAC,uBAAuB,IAAI,oBAAoB,GAAG,SAAS;IAIrE;;;OAGG;IACH,SAAS,CAAC,uBAAuB,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI;IAIrE;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,qBAAqB,IAAI,uBAAuB,GAAG,SAAS;IAItE;;;;;;;OAOG;IACH,SAAS,KAAK,qBAAqB,IAAI,OAAO,CAE7C;IAED;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,wBAAwB,CACzC,GAAG,EAAE,aAAa,GACjB,uBAAuB;IAE1B;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAyB3B;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAExD;;;;;;;;;;OAUG;YACW,yBAAyB;IA4lBvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,SAAS,CAAC,qBAAqB,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7D,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,GAAG,EAAE,gDAAgD;IAC7D,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,GAAG,CAAC,GACrE,IAAI;IAkIP;;;;;;;;;;OAUG;cACa,oBAAoB,CAClC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,GAAG,OAAO,EAEjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,KAAK,EACX,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,EAC1E,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,OAAO,CAAC;IAk6BnB;;;;;;;;;OASG;YACW,gBAAgB;IA0jB9B;;;;;;;;;;;;;;;;;OAiBG;YACW,qBAAqB;IA8GnC;;;;;;;OAOG;YACW,6BAA6B;IA4D3C;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAQ7B,aAAa,IAAI,MAAM;IAUvB;;;;;;;;;;;;OAYG;IACG,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAuvBhD;;;;;;;;;;;;;;;;OAgBG;IACG,wBAAwB,IAAI,OAAO,CAAC;QACxC,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,EAAE,OAAO,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IA2HF;;;;;;;;OAQG;cACa,wBAAwB,CAAC,IAAI,EAAE;QAC7C,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QAMjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC,IAAI,CAAC;IAmCjB;;;;;;;;;;;;;;;;OAgBG;cACa,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CACN;QACE,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QAEjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAC;KAClB,GACD,SAAS,CACZ;IA2HD;;;;;;;;;;;;OAYG;YACW,sBAAsB;IA0FpC;;;;;;;;;;;;;OAaG;YACW,wBAAwB;IAqEtC;;;;;;OAMG;YACW,qBAAqB;CA+DpC"}

package/dist/agent.js

@@ -8,7 +8,7 @@
 import { McpAgent } from "agents/mcp";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { AdmissionMcpServer, getMcpRequestHolder, getMcpPresentedDelegation, } from "./security/mcp-admission";
-import { resolveHttpChallengeConfig } from "./config";
+import { localToolProtectionConfig, resolveHttpChallengeConfig, } from "./config";
 import { CloudflareRuntime } from "./runtime";
 import { createCloudflareRuntime } from "./index";
 import { mapPrefixedEnv } from "./helpers/env-mapper";
@@ -53,6 +53,20 @@ if (!_oauthRegistryLoaded) {
     // Logger not yet configured at module init, use console.warn as fallback
     console.warn("[MCPICloudflareAgent] OAuth service registry not loaded at module init - services may be unavailable");
 }
+function jsonSchemaPropertyToZod(prop) {
+    switch (prop.type) {
+        case "string":
+            return z.string();
+        case "number":
+            return z.number();
+        case "boolean":
+            return z.boolean();
+        case "array":
+            return z.array(z.any());
+        default:
+            return undefined;
+    }
+}
 /**
  * Base class for MCP agents with MCP-I features
  *
@@ -117,7 +131,12 @@ export class MCPICloudflareAgent extends McpAgent {
         // Load runtime configuration from subclass
         const runtimeConfig = this.getRuntimeConfigInternal(mappedEnv);
         if (runtimeConfig.requestAdmission) {
-            this.server = new AdmissionMcpServer({ name: agentName, version: agentVersion || "1.0.0" }, runtimeConfig.requestAdmission);
+            this.server = new AdmissionMcpServer({ name: agentName, version: agentVersion || "1.0.0" }, runtimeConfig.requestAdmission, {
+                // Read at report time: mcpiRuntime is created further down.
+                reportRefusal: async (report) => {
+                    await this.mcpiRuntime?.reportAdmissionRefusal(report);
+                },
+            });
         }
         const managedAudit = createCloudflareAuditRuntimeFromEnv(mappedEnv);
         if (managedAudit !== undefined) {
@@ -148,17 +167,13 @@ export class MCPICloudflareAgent extends McpAgent {
                     "https://kya.vouched.id",
                 apiKey: mappedEnv.CHECKPOINT_API_KEY,
                 projectId: (runtimeConfig.toolProtection.checkpoint ??
-                    runtimeConfig.toolProtection.agentShield)?.projectId ||
-                    mappedEnv.CHECKPOINT_PROJECT_ID,
+                    runtimeConfig.toolProtection.agentShield)?.projectId || mappedEnv.CHECKPOINT_PROJECT_ID,
                 cacheTtl: (runtimeConfig.toolProtection.checkpoint ??
                     runtimeConfig.toolProtection.agentShield)?.cacheTtl || 300000,
                 debug: runtimeConfig.environment === "development",
-                // Wrap localConfig ToolProtectionMap into ToolProtectionConfig format
-                // The ToolProtectionSourceConfig.localConfig is a BaseToolProtectionMap (Record<string, ToolProtection>)
-                // The service expects ToolProtectionConfig ({ toolProtections: ToolProtectionMap })
-                localConfig: runtimeConfig.toolProtection.localConfig
-                    ? { toolProtections: runtimeConfig.toolProtection.localConfig }
-                    : undefined,
+                // The local maps, `localConfig` and `inline`, in the service's
+                // ToolProtectionConfig shape ({ toolProtections: ToolProtectionMap }).
+                localConfig: localToolProtectionConfig(runtimeConfig.toolProtection),
                 // Wrap offlineFallbackConfig the same way
                 offlineFallbackConfig: runtimeConfig.toolProtection
                     .offlineFallbackConfig
@@ -1018,6 +1033,9 @@ export class MCPICloudflareAgent extends McpAgent {
                             resume_token: args.resume_token,
                             termsAccepted: true,
                             approved: true,
+                            // The iframe's consent-only approval. /consent/approve refuses
+                            // a missing provider_type.
+                            provider_type: "none",
                         }),
                     });
                     if (!resp.ok) {
@@ -1202,45 +1220,43 @@ export class MCPICloudflareAgent extends McpAgent {
             // MCP SDK expects Zod schema shape (Record<string, ZodType>), not JSON Schema
             // Convert JSON Schema to Zod schema shape if needed
             let zodSchemaShape = {};
+            let acceptsExtraArguments = false;
+            let extraArgumentsSchema;
             if (schema && typeof schema === "object") {
-                // Check if it's already a Zod schema shape (has ZodType instances)
-                if (schema.type === "object" && schema.properties) {
-                    // It's a JSON Schema object - convert to Zod schema shape
+                const isZodInstance = "_def" in schema ||
+                    "_zod" in schema ||
+                    typeof schema.parse === "function";
+                const isRawShape = isZodInstance ||
+                    Object.keys(schema).length === 0 ||
+                    Object.values(schema).some((value) => typeof value?.parse === "function");
+                if (!isRawShape) {
                     const jsonSchema = schema;
-                    const requiredFields = new Set(jsonSchema.required || []);
-                    zodSchemaShape = Object.fromEntries(Object.entries(jsonSchema.properties).map(([key, prop]) => {
-                        // Convert JSON Schema property to Zod type
-                        let zodType;
-                        if (prop.type === "string") {
-                            zodType = z.string();
-                            if (prop.description) {
-                                zodType = zodType.describe(prop.description);
-                            }
-                        }
-                        else if (prop.type === "number") {
-                            zodType = z.number();
-                            if (prop.description) {
-                                zodType = zodType.describe(prop.description);
-                            }
-                        }
-                        else if (prop.type === "boolean") {
-                            zodType = z.boolean();
-                            if (prop.description) {
-                                zodType = zodType.describe(prop.description);
-                            }
-                        }
-                        else if (prop.type === "array") {
-                            zodType = z.array(z.any());
-                            if (prop.description) {
-                                zodType = zodType.describe(prop.description);
-                            }
+                    const declaredType = [jsonSchema.type ?? "object"].flat();
+                    if (!declaredType.includes("object")) {
+                        throw new Error(`Tool "${name}" input schema must describe an object, received type ${declaredType.join(", ")}`);
+                    }
+                    const additional = jsonSchema.additionalProperties;
+                    const additionalSchema = additional !== null &&
+                        typeof additional === "object" &&
+                        Object.keys(additional).length > 0
+                        ? additional
+                        : undefined;
+                    if (additionalSchema) {
+                        const converted = jsonSchemaPropertyToZod(additionalSchema);
+                        if (!converted) {
+                            throw new Error(`Tool "${name}" input schema declares additionalProperties that cannot be converted to a validator: ${JSON.stringify(additionalSchema)}`);
                         }
-                        else {
-                            // Fallback to any for unknown types
-                            zodType = z.any();
-                            if (prop.description) {
-                                zodType = zodType.describe(prop.description);
-                            }
+                        extraArgumentsSchema = converted;
+                    }
+                    acceptsExtraArguments =
+                        !additionalSchema &&
+                            additional !== false &&
+                            (additional != null || jsonSchema.properties == null);
+                    const requiredFields = new Set(jsonSchema.required || []);
+                    zodSchemaShape = Object.fromEntries(Object.entries(jsonSchema.properties ?? {}).map(([key, prop]) => {
+                        let zodType = jsonSchemaPropertyToZod(prop) ?? z.any();
+                        if (prop.description) {
+                            zodType = zodType.describe(prop.description);
                         }
                         // Make optional if not in required array
                         if (!requiredFields.has(key)) {
@@ -1268,7 +1284,11 @@ export class MCPICloudflareAgent extends McpAgent {
             // so clients know this tool can render inline consent UI
             const toolConfig = {
                 description,
-                inputSchema: zodSchemaShape,
+                inputSchema: extraArgumentsSchema
+                    ? z.object(zodSchemaShape).catchall(extraArgumentsSchema)
+                    : acceptsExtraArguments
+                        ? z.object(zodSchemaShape).passthrough()
+                        : zodSchemaShape,
             };
             if (this._consentUIResourceUri) {
                 // Include BOTH new nested format AND legacy flat format for maximum client compatibility
@@ -1453,7 +1473,8 @@ export class MCPICloudflareAgent extends McpAgent {
         // stored type) → fail-safe re-challenge on typed tools.
         let delegationAuthorizationType;
         try {
-            const agentDid = getMcpRequestHolder()?.did ?? (await this.mcpiRuntime.getIdentity()).did;
+            const agentDid = getMcpRequestHolder()?.did ??
+                (await this.mcpiRuntime.getIdentity()).did;
             logger.debug("[MCPICloudflareAgent] 🔍 Starting delegation lookup (DO storage):", {
                 sessionId: sessionId.slice(0, 20) + "...",
                 agentDid: agentDid.slice(0, 20) + "...",
@@ -1566,7 +1587,8 @@ export class MCPICloudflareAgent extends McpAgent {
         const session = {
             id: sessionId,
             audience: "https://kya.vouched.id",
-            agentDid: getMcpRequestHolder()?.did ?? (await this.mcpiRuntime.getIdentity()).did,
+            agentDid: getMcpRequestHolder()?.did ??
+                (await this.mcpiRuntime.getIdentity()).did,
             // Trusted per-request proof result; never a client-supplied DID label.
             verifiedInvokerDid: getMcpRequestHolder()?.did,
             agentName: this.getAgentName() || mappedEnv.MCP_SERVER_NAME || "Unknown Agent", // Human-readable agent name for Checkpoint dashboard
@@ -2028,7 +2050,15 @@ export class MCPICloudflareAgent extends McpAgent {
                 try {
                     // Retrieve password auth token - getToken handles scope hashing internally
                     const storedToken = await idpTokenStorage.getToken(userDid, provider, protection.requiredScopes || []);
-                    if (storedToken) {
+                    // SECURITY (defence in depth): a presented delegation must satisfy
+                    // the tool's required type before the user's stored credential token
+                    // is handed to the tool, the same rule as the delegation-only path
+                    // below. Otherwise a delegation minted under the user's DID without
+                    // their sign-in would unlock their token. Not presenting a
+                    // delegation keeps the existing behaviour.
+                    const presentedDelegationAllowed = !delegationToken ||
+                        authTypeSatisfies(delegationAuthorizationType, protection.authorization?.type ?? "password");
+                    if (storedToken && presentedDelegationAllowed) {
                         // Build headers based on token usage metadata
                         const tokenWithMeta = storedToken;
                         const idpHeaders = {};
@@ -2068,7 +2098,7 @@ export class MCPICloudflareAgent extends McpAgent {
                         return context;
                     }
                     else {
-                        // No password auth token found - check if delegation exists
+                        // No usable password auth token - check if delegation exists
                         // If delegation exists, tool can still execute without credential token
                         //
                         // SECURITY (consent-approve auth-gate, Task B3): the delegation only