@kya-os/mcp-i 1.9.0 → 1.11.0

package/dist/runtime/identity.d.ts

@@ -113,16 +113,16 @@ export declare class IdentityManager {
 export declare const defaultIdentityManager: IdentityManager;
 /**
  * Extract agent ID from DID
- * @deprecated Use extractAgentId from @kya-os/mcp-i-core/utils/did-helpers instead
+ * @deprecated Use extractAgentId from @kya-os/mcp-i-runtime/utils/did-helpers instead
  * This re-export is maintained for backward compatibility
  */
-export { extractAgentId } from '@kya-os/mcp-i-core/utils/did-helpers';
+export { extractAgentId } from '@kya-os/mcp-i-runtime/utils/did-helpers';
 /**
  * Extract agent slug from DID
- * @deprecated Use extractAgentSlug from @kya-os/mcp-i-core/utils/did-helpers instead
+ * @deprecated Use extractAgentSlug from @kya-os/mcp-i-runtime/utils/did-helpers instead
  * This re-export is maintained for backward compatibility
  */
-export { extractAgentSlug } from '@kya-os/mcp-i-core/utils/did-helpers';
+export { extractAgentSlug } from '@kya-os/mcp-i-runtime/utils/did-helpers';
 /**
  * Convenience function to ensure identity
  */

package/dist/runtime/identity.js

@@ -293,17 +293,17 @@ exports.IdentityManager = IdentityManager;
 exports.defaultIdentityManager = new IdentityManager();
 /**
  * Extract agent ID from DID
- * @deprecated Use extractAgentId from @kya-os/mcp-i-core/utils/did-helpers instead
+ * @deprecated Use extractAgentId from @kya-os/mcp-i-runtime/utils/did-helpers instead
  * This re-export is maintained for backward compatibility
  */
-var did_helpers_1 = require("@kya-os/mcp-i-core/utils/did-helpers");
+var did_helpers_1 = require("@kya-os/mcp-i-runtime/utils/did-helpers");
 Object.defineProperty(exports, "extractAgentId", { enumerable: true, get: function () { return did_helpers_1.extractAgentId; } });
 /**
  * Extract agent slug from DID
- * @deprecated Use extractAgentSlug from @kya-os/mcp-i-core/utils/did-helpers instead
+ * @deprecated Use extractAgentSlug from @kya-os/mcp-i-runtime/utils/did-helpers instead
  * This re-export is maintained for backward compatibility
  */
-var did_helpers_2 = require("@kya-os/mcp-i-core/utils/did-helpers");
+var did_helpers_2 = require("@kya-os/mcp-i-runtime/utils/did-helpers");
 Object.defineProperty(exports, "extractAgentSlug", { enumerable: true, get: function () { return did_helpers_2.extractAgentSlug; } });
 /**
  * Convenience function to ensure identity

package/dist/runtime/index.d.ts

@@ -16,6 +16,9 @@ export { DebugManager, createDebugEndpoint, type DebugVerificationResult, type D
 export { DemoManager, createDemoManager, DemoConsole, formatVerifyLink, type DemoConfig, } from "./demo";
 export { type DelegationVerifier, type DelegationVerifierConfig, type VerifyDelegationResult, type VerifyDelegationOptions, createDelegationVerifier, checkScopes, validateDelegation, extractScopes, } from "./delegation-verifier";
 export { type AuthHandshakeConfig, type VerifyOrHintsResult, type AgentReputation, type ResumeTokenStore, verifyOrHints, hasSensitiveScopes, MemoryResumeTokenStore, } from "./auth-handshake";
+export { createResumeTokenStore, type ResumeTokenStoreConfig, } from "./resume-token-store";
+export { CloudflareKVResumeTokenStore, type ResumeTokenKVNamespace, } from "./resume-token-store-kv";
+export { ensureOutboundIdentityBridge } from "./outbound-identity-bridge";
 export { type ProofDestination, type ProofBatchQueueConfig, ProofBatchQueue, KTAProofDestination, AgentShieldProofDestination, createProofBatchQueue, } from "./proof-batch-queue";
 export { CloudflareKVDelegationVerifier, } from "./delegation-verifier-kv";
 export { AgentShieldAPIDelegationVerifier, } from "./delegation-verifier-agentshield";
@@ -23,5 +26,6 @@ export { MemoryDelegationVerifier, } from "./delegation-verifier-memory";
 export { type ToolProtectionConfig, type ToolProtectionMap, type ToolProtectionConfigSource, ToolProtectionResolver, createToolProtectionResolver, InlineToolProtectionSource, FileToolProtectionSource, AgentShieldToolProtectionSource, } from "./tool-protection";
 export { toolProtectionRegistry, isToolProtected, getToolProtection, } from "./tool-protection-registry";
 export type { HandshakeRequest, SessionContext, NonceCache, NonceCacheEntry, NonceCacheConfig, } from "@kya-os/contracts/handshake";
-export type { ProofMeta, DetachedProof, CanonicalHashes, AuditRecord, } from "@kya-os/contracts/proof";
-export type { DelegationRecord, DelegationStatus, DelegationChain, DelegationConstraints, } from "@kya-os/contracts/delegation";
+export type { ProofMeta, DetachedProof, CanonicalHashes, AuditRecord, } from "@kya-os/mcp/types" with { "resolution-mode": "import" };
+export type { DelegationRecord, DelegationStatus, DelegationConstraints, } from "@kya-os/mcp/types" with { "resolution-mode": "import" };
+export type { DelegationChain } from "@kya-os/contracts/delegation";

package/dist/runtime/index.js

@@ -6,8 +6,8 @@
  * audit logging, and well-known endpoints.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FileToolProtectionSource = exports.InlineToolProtectionSource = exports.createToolProtectionResolver = exports.ToolProtectionResolver = exports.MemoryDelegationVerifier = exports.AgentShieldAPIDelegationVerifier = exports.CloudflareKVDelegationVerifier = exports.createProofBatchQueue = exports.AgentShieldProofDestination = exports.KTAProofDestination = exports.ProofBatchQueue = exports.MemoryResumeTokenStore = exports.hasSensitiveScopes = exports.verifyOrHints = exports.extractScopes = exports.validateDelegation = exports.checkScopes = exports.createDelegationVerifier = exports.formatVerifyLink = exports.DemoConsole = exports.createDemoManager = exports.DemoManager = exports.createDebugEndpoint = exports.DebugManager = exports.extractDIDFromPath = exports.validateAgentDocument = exports.validateDIDDocument = exports.createWellKnownHandler = exports.WellKnownManager = exports.validateAuditRecord = exports.parseAuditLine = exports.logKeyRotationAudit = exports.defaultAuditLogger = exports.AuditLogger = exports.extractCanonicalData = exports.createProofResponse = exports.ProofGenerator = exports.validateHandshakeFormat = exports.createHandshakeRequest = exports.defaultSessionManager = exports.SessionManager = exports.IDENTITY_ERRORS = exports.ensureIdentity = exports.defaultIdentityManager = exports.IdentityManager = exports.RUNTIME_ERRORS = exports.RuntimeFactory = exports.createMCPIRuntime = exports.MCPIRuntime = exports.MCPINodeRuntimeWrapper = void 0;
-exports.getToolProtection = exports.isToolProtected = exports.toolProtectionRegistry = exports.AgentShieldToolProtectionSource = void 0;
+exports.ToolProtectionResolver = exports.MemoryDelegationVerifier = exports.AgentShieldAPIDelegationVerifier = exports.CloudflareKVDelegationVerifier = exports.createProofBatchQueue = exports.AgentShieldProofDestination = exports.KTAProofDestination = exports.ProofBatchQueue = exports.ensureOutboundIdentityBridge = exports.CloudflareKVResumeTokenStore = exports.createResumeTokenStore = exports.MemoryResumeTokenStore = exports.hasSensitiveScopes = exports.verifyOrHints = exports.extractScopes = exports.validateDelegation = exports.checkScopes = exports.createDelegationVerifier = exports.formatVerifyLink = exports.DemoConsole = exports.createDemoManager = exports.DemoManager = exports.createDebugEndpoint = exports.DebugManager = exports.extractDIDFromPath = exports.validateAgentDocument = exports.validateDIDDocument = exports.createWellKnownHandler = exports.WellKnownManager = exports.validateAuditRecord = exports.parseAuditLine = exports.logKeyRotationAudit = exports.defaultAuditLogger = exports.AuditLogger = exports.extractCanonicalData = exports.createProofResponse = exports.ProofGenerator = exports.validateHandshakeFormat = exports.createHandshakeRequest = exports.defaultSessionManager = exports.SessionManager = exports.IDENTITY_ERRORS = exports.ensureIdentity = exports.defaultIdentityManager = exports.IdentityManager = exports.RUNTIME_ERRORS = exports.RuntimeFactory = exports.createMCPIRuntime = exports.MCPIRuntime = exports.MCPINodeRuntimeWrapper = void 0;
+exports.getToolProtection = exports.isToolProtected = exports.toolProtectionRegistry = exports.AgentShieldToolProtectionSource = exports.FileToolProtectionSource = exports.InlineToolProtectionSource = exports.createToolProtectionResolver = void 0;
 // Main runtime - Node.js implementation with providers
 var mcpi_runtime_wrapper_1 = require("./mcpi-runtime-wrapper");
 Object.defineProperty(exports, "MCPINodeRuntimeWrapper", { enumerable: true, get: function () { return mcpi_runtime_wrapper_1.MCPINodeRuntimeWrapper; } });
@@ -69,6 +69,14 @@ var auth_handshake_1 = require("./auth-handshake");
 Object.defineProperty(exports, "verifyOrHints", { enumerable: true, get: function () { return auth_handshake_1.verifyOrHints; } });
 Object.defineProperty(exports, "hasSensitiveScopes", { enumerable: true, get: function () { return auth_handshake_1.hasSensitiveScopes; } });
 Object.defineProperty(exports, "MemoryResumeTokenStore", { enumerable: true, get: function () { return auth_handshake_1.MemoryResumeTokenStore; } });
+// Durable resume-token store factory (pluggable persistence)
+var resume_token_store_1 = require("./resume-token-store");
+Object.defineProperty(exports, "createResumeTokenStore", { enumerable: true, get: function () { return resume_token_store_1.createResumeTokenStore; } });
+var resume_token_store_kv_1 = require("./resume-token-store-kv");
+Object.defineProperty(exports, "CloudflareKVResumeTokenStore", { enumerable: true, get: function () { return resume_token_store_kv_1.CloudflareKVResumeTokenStore; } });
+// Outbound identity bridge (mcp-i → compute interceptor)
+var outbound_identity_bridge_1 = require("./outbound-identity-bridge");
+Object.defineProperty(exports, "ensureOutboundIdentityBridge", { enumerable: true, get: function () { return outbound_identity_bridge_1.ensureOutboundIdentityBridge; } });
 // Proof batching (NEW - Phase 1)
 var proof_batch_queue_1 = require("./proof-batch-queue");
 Object.defineProperty(exports, "ProofBatchQueue", { enumerable: true, get: function () { return proof_batch_queue_1.ProofBatchQueue; } });

package/dist/runtime/mcpi-runtime.d.ts

@@ -9,7 +9,8 @@ import { ToolRequest, ToolResponse } from "./proof";
 import { WellKnownConfig } from "./well-known";
 import { DemoManager } from "./demo";
 import { DelegationVerifierConfig } from "./delegation-verifier";
-import { NeedsAuthorizationError } from "@kya-os/contracts/runtime";
+import { ResumeTokenStoreConfig } from "./resume-token-store";
+import type { NeedsAuthorizationError } from "@kya-os/mcp/types" with { "resolution-mode": "import" };
 import { ToolProtectionMap, ToolProtectionResolver } from "./tool-protection";
 /**
  * Runtime environment check
@@ -89,6 +90,13 @@ export interface MCPIRuntimeConfig {
             minReputationScore?: number;
             /** Resume token TTL in milliseconds */
             resumeTokenTtl?: number;
+            /**
+             * Resume-token store selection. Omit for the in-memory single-process
+             * dev default (tokens lost on restart, not shared across instances).
+             * Set `{ type: 'cloudflare-kv', kvNamespace }` for durable consent→reuse
+             * on multi-instance / serverless deployments.
+             */
+            resumeTokenStore?: ResumeTokenStoreConfig;
             /** Require authorization for unknown agents */
             requireAuthForUnknown?: boolean;
         };

package/dist/runtime/mcpi-runtime.js

@@ -17,7 +17,9 @@ const debug_1 = require("./debug");
 const demo_1 = require("./demo");
 const delegation_verifier_1 = require("./delegation-verifier");
 const auth_handshake_1 = require("./auth-handshake");
+const resume_token_store_1 = require("./resume-token-store");
 const request_context_1 = require("./request-context");
+const outbound_identity_bridge_1 = require("./outbound-identity-bridge");
 const tool_protection_1 = require("./tool-protection");
 const tool_protection_registry_1 = require("./tool-protection-registry");
 const mcp_i_core_1 = require("@kya-os/mcp-i-core");
@@ -51,9 +53,16 @@ class MCPIRuntime {
         this.sessionManager = new session_1.SessionManager(config.session);
         // Initialize audit logger
         this.auditLogger = new audit_1.AuditLogger(config.audit);
-        // Initialize resume token store (NEW - Phase 1)
-        // Use in-memory store by default (sufficient for most use cases)
-        this.resumeTokenStore = new auth_handshake_1.MemoryResumeTokenStore(config.delegation?.authorization?.resumeTokenTtl || 600_000);
+        // Initialize resume token store (NEW - Phase 1).
+        // Durable stores (e.g. Cloudflare KV) are selected from config so a token
+        // minted at consent time survives cold starts / restarts / multi-instance
+        // — otherwise the user is re-prompted. Memory is the EXPLICIT single-process
+        // dev default. Mirrors the delegation-verifier factory pattern.
+        const resumeTtl = config.delegation?.authorization?.resumeTokenTtl || 600_000;
+        const resumeStoreConfig = config.delegation?.authorization?.resumeTokenStore;
+        this.resumeTokenStore = resumeStoreConfig
+            ? (0, resume_token_store_1.createResumeTokenStore)({ ttlMs: resumeTtl, ...resumeStoreConfig })
+            : new auth_handshake_1.MemoryResumeTokenStore(resumeTtl);
         // Initialize delegation verifier (NEW - Phase 1)
         if (config.delegation?.enabled && config.delegation?.verifier) {
             this.delegationVerifier = (0, delegation_verifier_1.createDelegationVerifier)(config.delegation.verifier);
@@ -99,6 +108,10 @@ class MCPIRuntime {
             identityBadge: this.config.demo?.identityBadge || false,
             environment: this.config.identity?.environment || "development",
         });
+        // Bridge AsyncLocalStorage delegation/session context into the compute
+        // outbound-identity interceptor when it is preloaded in this process.
+        // Best-effort + idempotent — a no-op when compute is not present.
+        (0, outbound_identity_bridge_1.ensureOutboundIdentityBridge)();
         console.error(`✅ XMCP-I Runtime initialized`);
         console.error(`   DID: ${this.cachedIdentity.did}`);
         console.error(`   Key ID: ${this.cachedIdentity.kid}`);
@@ -207,6 +220,10 @@ class MCPIRuntime {
                     delegationId: options.delegationRef,
                     delegationChain: options.delegationChain,
                     delegationScopes: options.delegationScopes,
+                    // JWS-compact DelegationCredential VC from the verified result —
+                    // emitted on KYA-OS-Delegation-Credential when the verifier
+                    // returned a presentable credential.
+                    delegationCredential: verifyResult.credential?.credential_jwt,
                     identity,
                 });
             }

package/dist/runtime/outbound-delegation.d.ts

@@ -5,15 +5,17 @@
  * HTTP requests made during delegated tool handler execution.
  *
  * Reads delegation context from AsyncLocalStorage (via getContext()),
- * builds a signed Ed25519 JWT, and injects:
- *   X-Delegation-Id, X-Delegation-Chain, X-Delegation-Proof, X-Scopes
+ * builds a signed Ed25519 JWT, and injects the canonical KYA-OS-* Layer 2
+ * delegation headers:
+ *   KYA-OS-Delegation-Chain, KYA-OS-Delegation-Proof, KYA-OS-Granted-Scopes,
+ *   and KYA-OS-Delegation-Credential when a DelegationCredential VC is present.
  *
  * Behavior:
  * - Skips injection for internal hostnames (localhost, *.vouched.id, Fly IPs)
  * - On signing failure: logs warning, continues WITHOUT delegation headers
  * - Anonymous/non-delegated calls: no headers injected
  *
- * Related Spec: MCP-I §2 — Outbound Delegation Propagation
+ * Related Spec: DIF MCP-I §8 — Outbound Delegation Propagation
  */
 interface Logger {
     debug: (msg: string, meta?: Record<string, unknown>) => void;

package/dist/runtime/outbound-delegation.js

@@ -6,20 +6,23 @@
  * HTTP requests made during delegated tool handler execution.
  *
  * Reads delegation context from AsyncLocalStorage (via getContext()),
- * builds a signed Ed25519 JWT, and injects:
- *   X-Delegation-Id, X-Delegation-Chain, X-Delegation-Proof, X-Scopes
+ * builds a signed Ed25519 JWT, and injects the canonical KYA-OS-* Layer 2
+ * delegation headers:
+ *   KYA-OS-Delegation-Chain, KYA-OS-Delegation-Proof, KYA-OS-Granted-Scopes,
+ *   and KYA-OS-Delegation-Credential when a DelegationCredential VC is present.
  *
  * Behavior:
  * - Skips injection for internal hostnames (localhost, *.vouched.id, Fly IPs)
  * - On signing failure: logs warning, continues WITHOUT delegation headers
  * - Anonymous/non-delegated calls: no headers injected
  *
- * Related Spec: MCP-I §2 — Outbound Delegation Propagation
+ * Related Spec: DIF MCP-I §8 — Outbound Delegation Propagation
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isInternalDelegationTarget = isInternalDelegationTarget;
 exports.installDelegationInterceptor = installDelegationInterceptor;
 const mcp_i_core_1 = require("@kya-os/mcp-i-core");
+// C2/C3: @kya-os/mcp-i is CJS; @kya-os/mcp is ESM-only (TS1479 blocks static import).
 const request_context_js_1 = require("./request-context.js");
 // Flag to avoid double-installing
 const DELEGATION_INTERCEPTED_FLAG = "__kyaDelegationIntercepted";
@@ -85,7 +88,7 @@ function installDelegationInterceptor(logger) {
         const baseHeaders = input instanceof Request ? input.headers : undefined;
         const headers = new Headers(init?.headers ?? baseHeaders);
         // Only inject if we have a delegation context and haven't already injected
-        if (!headers.has("X-Delegation-Proof")) {
+        if (!headers.has("KYA-OS-Delegation-Proof")) {
             const ctx = (0, request_context_js_1.getContext)();
             if (ctx?.delegationRef &&
                 ctx.delegationPrivateKeyJwk &&
@@ -108,10 +111,13 @@ function installDelegationInterceptor(logger) {
                         kid: ctx.delegationAgentKid,
                         targetHostname,
                     });
-                    headers.set("X-Delegation-Id", ctx.delegationRef);
-                    headers.set("X-Delegation-Chain", ctx.delegationChain ?? ctx.delegationRef);
-                    headers.set("X-Delegation-Proof", proof);
-                    headers.set("X-Scopes", (ctx.delegationScopes ?? []).join(","));
+                    headers.set("KYA-OS-Delegation-Chain", ctx.delegationChain ?? ctx.delegationRef);
+                    headers.set("KYA-OS-Delegation-Proof", proof);
+                    headers.set("KYA-OS-Granted-Scopes", (ctx.delegationScopes ?? []).join(","));
+                    // Emit the JWS-compact DelegationCredential VC when the context carries one.
+                    if (ctx.delegationCredential) {
+                        headers.set("KYA-OS-Delegation-Credential", ctx.delegationCredential);
+                    }
                     logger?.debug("Delegation headers injected", {
                         delegationRef: ctx.delegationRef,
                         targetHostname,

package/dist/runtime/outbound-identity-bridge.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Outbound Identity Bridge (mcp-i → @kya-os/compute interceptor)
+ *
+ * Bridges this package's AsyncLocalStorage request context into the compute
+ * outbound-identity interceptor so the Layer-2 delegation headers and the
+ * `KYA-OS-Session-Id` anchor are emitted on the compute (OpenClaw sidecar)
+ * path — resolving the long-standing `interceptor.ts:183-188` TODO.
+ *
+ * Why a global rendezvous (not a direct import): neither package depends on
+ * the other (compute must not import the SDK; the SDK must not pull in the
+ * Fly.io sidecar). When the compute interceptor installs it publishes a
+ * registrar on `Symbol.for("kya-os.outbound-identity.registry")`; this module
+ * reads that registrar and registers providers backed by `getContext()`. When
+ * compute is absent (pure-Node / Cloudflare deployments) the registrar is
+ * missing and this is a clean no-op — those paths inject delegation headers via
+ * their own fetch wrap (`outbound-delegation.ts`).
+ *
+ * Authority model follows ADR-001: the DelegationCredential VC is
+ * authoritative; `-Chain` / `-Granted-Scopes` are advisory hints.
+ *
+ * Related Spec: DIF MCP-I §8 — Outbound Delegation Propagation
+ */
+interface Logger {
+    debug: (msg: string, meta?: Record<string, unknown>) => void;
+    warn: (msg: string, meta?: Record<string, unknown>) => void;
+}
+/**
+ * Register the AsyncLocalStorage-backed delegation / session providers with the
+ * compute outbound-identity interceptor, if it is installed in this process.
+ *
+ * Idempotent and best-effort: safe to call from multiple init sites. Returns
+ * true when the registrar was found and providers were wired, false otherwise.
+ */
+export declare function ensureOutboundIdentityBridge(logger?: Logger): boolean;
+/**
+ * Test-only reset of the idempotency guard. Not part of the public runtime API.
+ * @internal
+ */
+export declare function __resetOutboundIdentityBridgeForTests(): void;
+export {};

package/dist/runtime/outbound-identity-bridge.js

@@ -0,0 +1,114 @@
+"use strict";
+/**
+ * Outbound Identity Bridge (mcp-i → @kya-os/compute interceptor)
+ *
+ * Bridges this package's AsyncLocalStorage request context into the compute
+ * outbound-identity interceptor so the Layer-2 delegation headers and the
+ * `KYA-OS-Session-Id` anchor are emitted on the compute (OpenClaw sidecar)
+ * path — resolving the long-standing `interceptor.ts:183-188` TODO.
+ *
+ * Why a global rendezvous (not a direct import): neither package depends on
+ * the other (compute must not import the SDK; the SDK must not pull in the
+ * Fly.io sidecar). When the compute interceptor installs it publishes a
+ * registrar on `Symbol.for("kya-os.outbound-identity.registry")`; this module
+ * reads that registrar and registers providers backed by `getContext()`. When
+ * compute is absent (pure-Node / Cloudflare deployments) the registrar is
+ * missing and this is a clean no-op — those paths inject delegation headers via
+ * their own fetch wrap (`outbound-delegation.ts`).
+ *
+ * Authority model follows ADR-001: the DelegationCredential VC is
+ * authoritative; `-Chain` / `-Granted-Scopes` are advisory hints.
+ *
+ * Related Spec: DIF MCP-I §8 — Outbound Delegation Propagation
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureOutboundIdentityBridge = ensureOutboundIdentityBridge;
+exports.__resetOutboundIdentityBridgeForTests = __resetOutboundIdentityBridgeForTests;
+const mcp_i_core_1 = require("@kya-os/mcp-i-core");
+const request_context_1 = require("./request-context");
+/**
+ * Must match `OUTBOUND_IDENTITY_REGISTRY_KEY` in
+ * `@kya-os/compute`'s `outbound-identity/interceptor.ts`. `Symbol.for` resolves
+ * the same registry symbol in both packages within one process.
+ */
+const OUTBOUND_IDENTITY_REGISTRY_KEY = Symbol.for("kya-os.outbound-identity.registry");
+// Idempotency guard — the registered providers are closures over getContext(),
+// so a single registration covers all subsequent requests in this process.
+let bridged = false;
+function readRegistry() {
+    // REASON: globalThis has no index signature for our Symbol key; one localized
+    // cast reads the typed cross-package slot compute published at install.
+    return globalThis[OUTBOUND_IDENTITY_REGISTRY_KEY];
+}
+/**
+ * Build a compute-compatible delegation provider from the request context.
+ * Returns undefined per-call when the active context carries no delegation (or
+ * lacks the signing material), so anonymous / non-delegated calls inject no
+ * delegation headers.
+ */
+function delegationProvider() {
+    const ctx = (0, request_context_1.getContext)();
+    if (!ctx?.delegationRef ||
+        !ctx.delegationPrivateKeyJwk ||
+        !ctx.delegationAgentKid) {
+        return undefined;
+    }
+    const delegationChain = ctx.delegationChain ?? ctx.delegationRef;
+    const delegationScopes = ctx.delegationScopes ?? [];
+    const agentDid = ctx.session?.serverDid ?? "";
+    const userDid = ctx.session?.userDid ?? "";
+    const privateKeyJwk = ctx.delegationPrivateKeyJwk;
+    const kid = ctx.delegationAgentKid;
+    const delegationRef = ctx.delegationRef;
+    return {
+        delegationRef,
+        delegationChain,
+        delegationScopes,
+        agentDid,
+        userDid,
+        kid,
+        delegationCredential: ctx.delegationCredential,
+        buildProof: (targetHostname) => (0, mcp_i_core_1.buildDelegationProofJWT)({
+            agentDid,
+            userDid,
+            delegationId: delegationRef,
+            delegationChain,
+            scopes: delegationScopes,
+            privateKeyJwk,
+            kid,
+            targetHostname,
+        }),
+    };
+}
+/** Resolve the stable MCP session id from the active request context. */
+function sessionIdProvider() {
+    return (0, request_context_1.getContext)()?.session?.sessionId;
+}
+/**
+ * Register the AsyncLocalStorage-backed delegation / session providers with the
+ * compute outbound-identity interceptor, if it is installed in this process.
+ *
+ * Idempotent and best-effort: safe to call from multiple init sites. Returns
+ * true when the registrar was found and providers were wired, false otherwise.
+ */
+function ensureOutboundIdentityBridge(logger) {
+    if (bridged)
+        return true;
+    const registry = readRegistry();
+    if (!registry?.setDelegationProvider) {
+        logger?.debug("Outbound identity bridge: compute interceptor not present — skipping");
+        return false;
+    }
+    registry.setDelegationProvider(delegationProvider);
+    registry.setSessionIdProvider?.(sessionIdProvider);
+    bridged = true;
+    logger?.debug("Outbound identity bridge: delegation + session providers registered");
+    return true;
+}
+/**
+ * Test-only reset of the idempotency guard. Not part of the public runtime API.
+ * @internal
+ */
+function __resetOutboundIdentityBridgeForTests() {
+    bridged = false;
+}

package/dist/runtime/proof-batch-queue.d.ts

@@ -16,7 +16,7 @@
  *
  * Related: PHASE_1_XMCP_I_SERVER.md Epic 3 (Proof Batching)
  */
-import { DetachedProof } from "@kya-os/contracts/proof";
+import type { DetachedProof } from "@kya-os/mcp/types" with { "resolution-mode": "import" };
 /**
  * Proof submission destination
  */

package/dist/runtime/request-context.d.ts

@@ -19,6 +19,8 @@ export interface RequestContext {
     delegationChain?: string;
     /** Scopes granted by the active delegation */
     delegationScopes?: string[];
+    /** JWS-compact DelegationCredential VC for the active delegation (emitted on KYA-OS-Delegation-Credential when present) */
+    delegationCredential?: string;
     /** Agent Ed25519 private key JWK for delegation proof signing */
     delegationPrivateKeyJwk?: Ed25519PrivateJWK;
     /** Key ID used in delegation proof JWT header */
@@ -56,6 +58,7 @@ export declare function setDelegationContext(fields: {
     delegationRef: string;
     delegationChain: string;
     delegationScopes: string[];
+    delegationCredential?: string;
     delegationPrivateKeyJwk?: Ed25519PrivateJWK;
     delegationAgentKid?: string;
 }): void;
@@ -70,6 +73,13 @@ export declare function setDelegationContextFromIdentity(params: {
     delegationId: string;
     delegationChain: string;
     delegationScopes: string[];
+    /**
+     * JWS-compact DelegationCredential VC for the active delegation. Threaded
+     * through to KYA-OS-Delegation-Credential on outbound requests. Sourced
+     * from the verified delegation result (e.g. credential.credential_jwt).
+     * Omit when the verifier did not return a presentable VC.
+     */
+    delegationCredential?: string;
     identity: {
         privateKey: string;
         publicKey: string;

package/dist/runtime/request-context.js

@@ -71,6 +71,9 @@ function setDelegationContext(fields) {
     context.delegationRef = fields.delegationRef;
     context.delegationChain = fields.delegationChain;
     context.delegationScopes = fields.delegationScopes;
+    if (fields.delegationCredential !== undefined) {
+        context.delegationCredential = fields.delegationCredential;
+    }
     if (fields.delegationPrivateKeyJwk !== undefined) {
         context.delegationPrivateKeyJwk = fields.delegationPrivateKeyJwk;
     }
@@ -90,6 +93,7 @@ function setDelegationContextFromIdentity(params) {
         delegationRef: params.delegationId,
         delegationChain: params.delegationChain,
         delegationScopes: params.delegationScopes,
+        delegationCredential: params.delegationCredential,
         delegationPrivateKeyJwk: params.identity?.privateKey
             ? {
                 kty: "OKP",

package/dist/runtime/resume-token-store-kv.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Cloudflare KV Resume Token Store
+ *
+ * Durable resume-token store backed by a Cloudflare Workers KV namespace, so a
+ * resume token minted at consent time survives cold starts, process restarts,
+ * and multi-instance deployments (the failure mode the in-memory store causes —
+ * the user gets re-prompted because the token vanished). Mirrors the
+ * delegation-verifier-kv.ts adapter shape.
+ *
+ * Key structure:
+ * - `resume:{token}` — JSON-encoded {@link StoredResumeToken}
+ *
+ * Tokens are minted with CSPRNG entropy (see generateResumeToken in
+ * @kya-os/mcp-i-core), never time+Math.random.
+ */
+import { type ResumeTokenStore } from "@kya-os/mcp-i-core";
+/**
+ * Minimal Cloudflare KV surface needed by the store. `put` accepts the standard
+ * KV `{ expirationTtl }` (seconds) so the namespace also evicts expired tokens
+ * natively; logical expiry via `expiresAt` is enforced regardless.
+ */
+export interface ResumeTokenKVNamespace {
+    get(key: string): Promise<string | null>;
+    put(key: string, value: string, options?: {
+        expirationTtl?: number;
+    }): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+export declare class CloudflareKVResumeTokenStore implements ResumeTokenStore {
+    private kv;
+    private ttlMs;
+    constructor(kv: ResumeTokenKVNamespace, ttlMs?: number);
+    private key;
+    private read;
+    create(agentDid: string, scopes: string[], metadata?: Record<string, unknown>): Promise<string>;
+    get(token: string): Promise<{
+        agentDid: string;
+        scopes: string[];
+        createdAt: number;
+        expiresAt: number;
+        metadata?: Record<string, unknown>;
+    } | null>;
+    fulfill(token: string): Promise<void>;
+}

package/dist/runtime/resume-token-store-kv.js

@@ -0,0 +1,93 @@
+"use strict";
+/**
+ * Cloudflare KV Resume Token Store
+ *
+ * Durable resume-token store backed by a Cloudflare Workers KV namespace, so a
+ * resume token minted at consent time survives cold starts, process restarts,
+ * and multi-instance deployments (the failure mode the in-memory store causes —
+ * the user gets re-prompted because the token vanished). Mirrors the
+ * delegation-verifier-kv.ts adapter shape.
+ *
+ * Key structure:
+ * - `resume:{token}` — JSON-encoded {@link StoredResumeToken}
+ *
+ * Tokens are minted with CSPRNG entropy (see generateResumeToken in
+ * @kya-os/mcp-i-core), never time+Math.random.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CloudflareKVResumeTokenStore = void 0;
+const mcp_i_core_1 = require("@kya-os/mcp-i-core");
+// Cloudflare KV requires expirationTtl >= 60 seconds.
+const MIN_KV_TTL_SECONDS = 60;
+function toTtlSeconds(ms) {
+    return Math.max(MIN_KV_TTL_SECONDS, Math.ceil(ms / 1000));
+}
+class CloudflareKVResumeTokenStore {
+    kv;
+    ttlMs;
+    constructor(kv, ttlMs = 600_000) {
+        this.kv = kv;
+        this.ttlMs = ttlMs;
+    }
+    key(token) {
+        return `resume:${token}`;
+    }
+    async read(token) {
+        const raw = await this.kv.get(this.key(token));
+        if (!raw)
+            return null;
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            return null;
+        }
+    }
+    async create(agentDid, scopes, metadata) {
+        const token = (0, mcp_i_core_1.generateResumeToken)("rt");
+        const now = Date.now();
+        const record = {
+            agentDid,
+            scopes,
+            createdAt: now,
+            expiresAt: now + this.ttlMs,
+            metadata,
+            fulfilled: false,
+        };
+        await this.kv.put(this.key(token), JSON.stringify(record), {
+            expirationTtl: toTtlSeconds(this.ttlMs),
+        });
+        return token;
+    }
+    async get(token) {
+        const record = await this.read(token);
+        if (!record)
+            return null;
+        if (Date.now() > record.expiresAt) {
+            await this.kv.delete(this.key(token));
+            return null;
+        }
+        if (record.fulfilled)
+            return null;
+        return {
+            agentDid: record.agentDid,
+            scopes: record.scopes,
+            createdAt: record.createdAt,
+            expiresAt: record.expiresAt,
+            metadata: record.metadata,
+        };
+    }
+    async fulfill(token) {
+        const record = await this.read(token);
+        if (!record)
+            return;
+        record.fulfilled = true;
+        // Preserve the original expiry window so a fulfilled token can't outlive
+        // its TTL; floor at the KV minimum.
+        const remainingMs = Math.max(0, record.expiresAt - Date.now());
+        await this.kv.put(this.key(token), JSON.stringify(record), {
+            expirationTtl: toTtlSeconds(remainingMs),
+        });
+    }
+}
+exports.CloudflareKVResumeTokenStore = CloudflareKVResumeTokenStore;

package/dist/runtime/resume-token-store.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Resume Token Store Factory
+ *
+ * Selects a {@link ResumeTokenStore} implementation from config, mirroring the
+ * delegation-verifier factory (`createDelegationVerifier`). This replaces the
+ * hardcoded in-memory store in the runtime so consent→reuse can be made durable
+ * (Cloudflare KV) on multi-instance / serverless deployments, while keeping the
+ * in-memory store as an EXPLICIT single-process dev default.
+ */
+import { type ResumeTokenStore } from "@kya-os/mcp-i-core";
+import { type ResumeTokenKVNamespace } from "./resume-token-store-kv";
+/**
+ * Configuration for resume-token stores.
+ *
+ * - `memory` — in-memory TTL map. Single-process dev only; tokens are lost on
+ *   restart and not shared across instances.
+ * - `cloudflare-kv` — durable, edge-replicated. Survives cold starts/restarts.
+ */
+export interface ResumeTokenStoreConfig {
+    type: "memory" | "cloudflare-kv";
+    /** Token TTL in milliseconds (default: 600_000 = 10 minutes). */
+    ttlMs?: number;
+    /** Cloudflare KV namespace (required for `cloudflare-kv`). */
+    kvNamespace?: ResumeTokenKVNamespace;
+}
+/**
+ * Create a resume-token store from config. Memory is an explicit opt-in for
+ * single-process development; durable stores must be selected deliberately.
+ */
+export declare function createResumeTokenStore(config: ResumeTokenStoreConfig): ResumeTokenStore;