[donmasakayan]

Stacked on #2323 — review only the top commit (18dd050)

Summary

Wire Better Auth, WorkOS, and Cloudflare Access verification into account management and MCP session restoration. Require fresh human management authentication, keep issuance disabled by default, and reject known revoked credentials before any legacy-session fallback.

This targets v2 following the backlog invitation to resubmit, after the prior closed #1610/#1948.

Verification

All verification below was run locally from the final frozen stack; no public CI run is claimed.

• bun run format:check — 2,226 files, exit 0.
• bun run lint — 1,933 files, zero warnings or errors, including the changeset stub check.
• bun run typecheck — 45/45 tasks, exit 0.
• bun run test — 39/39 workspace tasks; 4,633 tests passed, 45 conditional skips, zero failures.
• e2e — local self-host scenarios delegated-credentials-a-member-key-keeps-an-approved-emulator-connection-scoped- and delegated-credentials-selfhost-issues-masks-and-revokes-a-local-key passed 2 applicable cases with issuance enabled; the default issuance-disabled case also passed. Local trace-redaction coverage passed 3/3. Recordings and traces are retained locally and are not publicly linked.

Live IdP and Cloudflare Access login flows were not exercised; coverage for those flows is limited to unit/integration tests.

Checklist

• Added a changeset, or this change needs none.
• Added or updated tests for the new behaviour.
• No secrets, credentials, or private data in the diff.

Stack

• #2322 — delegated credential lifecycle and private storage.
• #2323 — delegated scope enforcement across execution and sessions.
• #2324 — delegated credentials across hosted adapters.
• #2325 — delegated credential account controls.
• #2326 — delegated credential documentation and local rollout verification.