@kya-os/mcp-i-cloudflare 1.14.1 → 1.14.2

package/dist/audit/deployment-binding.d.ts

@@ -82,13 +82,13 @@ declare const deploymentBindingSchema: z.ZodObject<{
         value: z.ZodString;
         keyId: z.ZodString;
     }, "strict", z.ZodTypeAny, {
+        kind: "keyed_commitment";
         value: string;
         keyId: string;
-        kind: "keyed_commitment";
     }, {
+        kind: "keyed_commitment";
         value: string;
         keyId: string;
-        kind: "keyed_commitment";
     }>, z.ZodObject<{
         kind: z.ZodLiteral<"evidence_ref">;
         ref: z.ZodObject<{
@@ -103,14 +103,14 @@ declare const deploymentBindingSchema: z.ZodObject<{
                 nonce: z.ZodString;
                 aadDigest: z.ZodString;
             }, "strict", z.ZodTypeAny, {
+                nonce: string;
                 suite: "A256GCM";
                 keyId: string;
-                nonce: string;
                 aadDigest: string;
             }, {
+                nonce: string;
                 suite: "A256GCM";
                 keyId: string;
-                nonce: string;
                 aadDigest: string;
             }>;
         }, "strict", z.ZodTypeAny, {
@@ -119,9 +119,9 @@ declare const deploymentBindingSchema: z.ZodObject<{
             mediaType: string;
             size: string;
             encryption: {
+                nonce: string;
                 suite: "A256GCM";
                 keyId: string;
-                nonce: string;
                 aadDigest: string;
             };
             plaintextCommitment?: string | undefined;
@@ -131,43 +131,43 @@ declare const deploymentBindingSchema: z.ZodObject<{
             mediaType: string;
             size: string;
             encryption: {
+                nonce: string;
                 suite: "A256GCM";
                 keyId: string;
-                nonce: string;
                 aadDigest: string;
             };
             plaintextCommitment?: string | undefined;
         }>;
     }, "strict", z.ZodTypeAny, {
+        kind: "evidence_ref";
         ref: {
             objectId: string;
             ciphertextDigest: string;
             mediaType: string;
             size: string;
             encryption: {
+                nonce: string;
                 suite: "A256GCM";
                 keyId: string;
-                nonce: string;
                 aadDigest: string;
             };
             plaintextCommitment?: string | undefined;
         };
-        kind: "evidence_ref";
     }, {
+        kind: "evidence_ref";
         ref: {
             objectId: string;
             ciphertextDigest: string;
             mediaType: string;
             size: string;
             encryption: {
+                nonce: string;
                 suite: "A256GCM";
                 keyId: string;
-                nonce: string;
                 aadDigest: string;
             };
             plaintextCommitment?: string | undefined;
         };
-        kind: "evidence_ref";
     }>]>;
     producerRef: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
         kind: z.ZodLiteral<"public_did">;
@@ -192,13 +192,13 @@ declare const deploymentBindingSchema: z.ZodObject<{
         value: z.ZodString;
         keyId: z.ZodString;
     }, "strict", z.ZodTypeAny, {
+        kind: "keyed_commitment";
         value: string;
         keyId: string;
-        kind: "keyed_commitment";
     }, {
+        kind: "keyed_commitment";
         value: string;
         keyId: string;
-        kind: "keyed_commitment";
     }>, z.ZodObject<{
         kind: z.ZodLiteral<"evidence_ref">;
         ref: z.ZodObject<{
@@ -213,14 +213,14 @@ declare const deploymentBindingSchema: z.ZodObject<{
                 nonce: z.ZodString;
                 aadDigest: z.ZodString;
             }, "strict", z.ZodTypeAny, {
+                nonce: string;
                 suite: "A256GCM";
                 keyId: string;
-                nonce: string;
                 aadDigest: string;
             }, {
+                nonce: string;
                 suite: "A256GCM";
                 keyId: string;
-                nonce: string;
                 aadDigest: string;
             }>;
         }, "strict", z.ZodTypeAny, {
@@ -229,9 +229,9 @@ declare const deploymentBindingSchema: z.ZodObject<{
             mediaType: string;
             size: string;
             encryption: {
+                nonce: string;
                 suite: "A256GCM";
                 keyId: string;
-                nonce: string;
                 aadDigest: string;
             };
             plaintextCommitment?: string | undefined;
@@ -241,43 +241,43 @@ declare const deploymentBindingSchema: z.ZodObject<{
             mediaType: string;
             size: string;
             encryption: {
+                nonce: string;
                 suite: "A256GCM";
                 keyId: string;
-                nonce: string;
                 aadDigest: string;
             };
             plaintextCommitment?: string | undefined;
         }>;
     }, "strict", z.ZodTypeAny, {
+        kind: "evidence_ref";
         ref: {
             objectId: string;
             ciphertextDigest: string;
             mediaType: string;
             size: string;
             encryption: {
+                nonce: string;
                 suite: "A256GCM";
                 keyId: string;
-                nonce: string;
                 aadDigest: string;
             };
             plaintextCommitment?: string | undefined;
         };
-        kind: "evidence_ref";
     }, {
+        kind: "evidence_ref";
         ref: {
             objectId: string;
             ciphertextDigest: string;
             mediaType: string;
             size: string;
             encryption: {
+                nonce: string;
                 suite: "A256GCM";
                 keyId: string;
-                nonce: string;
                 aadDigest: string;
             };
             plaintextCommitment?: string | undefined;
         };
-        kind: "evidence_ref";
     }>]>;
     recorderSigner: z.ZodObject<{
         did: z.ZodString;
@@ -307,6 +307,17 @@ declare const deploymentBindingSchema: z.ZodObject<{
         evidenceKey?: "KYA_OS_AUDIT_EVIDENCE_KEY" | undefined;
     }>;
 }, "strict", z.ZodTypeAny, {
+    config: {
+        enabled: boolean;
+        delivery: "best-effort" | "buffered" | "required";
+        requestedProfile: "AAP-0" | "AAP-1" | "AAP-2" | "AAP-3" | "AAP-4";
+        evidenceMode: "none" | "encrypted-separate" | "encrypted-inline";
+        retentionClass: string;
+        retentionDays: number;
+        residency: "global" | "eu" | "inherit-project" | "us";
+        keyCustody: "none" | "checkpoint-managed" | "customer-managed-kms";
+        recorderTopology: "none" | "self-hosted" | "managed" | "verified-mirror";
+    };
     schema: "https://schema.kya-os.org/v1/protocol/audit/deployment-binding/v1.0.0";
     recorderSigner: {
         did: string;
@@ -321,35 +332,24 @@ declare const deploymentBindingSchema: z.ZodObject<{
         did: string;
         kind: "pairwise_did";
     } | {
+        kind: "keyed_commitment";
         value: string;
         keyId: string;
-        kind: "keyed_commitment";
     } | {
+        kind: "evidence_ref";
         ref: {
             objectId: string;
             ciphertextDigest: string;
             mediaType: string;
             size: string;
             encryption: {
+                nonce: string;
                 suite: "A256GCM";
                 keyId: string;
-                nonce: string;
                 aadDigest: string;
             };
             plaintextCommitment?: string | undefined;
         };
-        kind: "evidence_ref";
-    };
-    config: {
-        enabled: boolean;
-        delivery: "best-effort" | "buffered" | "required";
-        requestedProfile: "AAP-0" | "AAP-1" | "AAP-2" | "AAP-3" | "AAP-4";
-        evidenceMode: "none" | "encrypted-separate" | "encrypted-inline";
-        retentionClass: string;
-        retentionDays: number;
-        residency: "global" | "eu" | "inherit-project" | "us";
-        keyCustody: "none" | "checkpoint-managed" | "customer-managed-kms";
-        recorderTopology: "none" | "self-hosted" | "managed" | "verified-mirror";
     };
     readiness: {
         status: "disabled" | "ready" | "degraded";
@@ -366,24 +366,24 @@ declare const deploymentBindingSchema: z.ZodObject<{
         did: string;
         kind: "pairwise_did";
     } | {
+        kind: "keyed_commitment";
         value: string;
         keyId: string;
-        kind: "keyed_commitment";
     } | {
+        kind: "evidence_ref";
         ref: {
             objectId: string;
             ciphertextDigest: string;
             mediaType: string;
             size: string;
             encryption: {
+                nonce: string;
                 suite: "A256GCM";
                 keyId: string;
-                nonce: string;
                 aadDigest: string;
             };
             plaintextCommitment?: string | undefined;
         };
-        kind: "evidence_ref";
     };
     secretReferences: {
         producerInternalToken: "KYA_OS_AUDIT_PRODUCER_INTERNAL_TOKEN";
@@ -391,6 +391,17 @@ declare const deploymentBindingSchema: z.ZodObject<{
         evidenceKey?: "KYA_OS_AUDIT_EVIDENCE_KEY" | undefined;
     };
 }, {
+    config: {
+        enabled: boolean;
+        delivery: "best-effort" | "buffered" | "required";
+        requestedProfile: "AAP-0" | "AAP-1" | "AAP-2" | "AAP-3" | "AAP-4";
+        evidenceMode: "none" | "encrypted-separate" | "encrypted-inline";
+        retentionClass: string;
+        retentionDays: number;
+        residency: "global" | "eu" | "inherit-project" | "us";
+        keyCustody: "none" | "checkpoint-managed" | "customer-managed-kms";
+        recorderTopology: "none" | "self-hosted" | "managed" | "verified-mirror";
+    };
     schema: "https://schema.kya-os.org/v1/protocol/audit/deployment-binding/v1.0.0";
     recorderSigner: {
         did: string;
@@ -405,35 +416,24 @@ declare const deploymentBindingSchema: z.ZodObject<{
         did: string;
         kind: "pairwise_did";
     } | {
+        kind: "keyed_commitment";
         value: string;
         keyId: string;
-        kind: "keyed_commitment";
     } | {
+        kind: "evidence_ref";
         ref: {
             objectId: string;
             ciphertextDigest: string;
             mediaType: string;
             size: string;
             encryption: {
+                nonce: string;
                 suite: "A256GCM";
                 keyId: string;
-                nonce: string;
                 aadDigest: string;
             };
             plaintextCommitment?: string | undefined;
         };
-        kind: "evidence_ref";
-    };
-    config: {
-        enabled: boolean;
-        delivery: "best-effort" | "buffered" | "required";
-        requestedProfile: "AAP-0" | "AAP-1" | "AAP-2" | "AAP-3" | "AAP-4";
-        evidenceMode: "none" | "encrypted-separate" | "encrypted-inline";
-        retentionClass: string;
-        retentionDays: number;
-        residency: "global" | "eu" | "inherit-project" | "us";
-        keyCustody: "none" | "checkpoint-managed" | "customer-managed-kms";
-        recorderTopology: "none" | "self-hosted" | "managed" | "verified-mirror";
     };
     readiness: {
         status: "disabled" | "ready" | "degraded";
@@ -450,24 +450,24 @@ declare const deploymentBindingSchema: z.ZodObject<{
         did: string;
         kind: "pairwise_did";
     } | {
+        kind: "keyed_commitment";
         value: string;
         keyId: string;
-        kind: "keyed_commitment";
     } | {
+        kind: "evidence_ref";
         ref: {
             objectId: string;
             ciphertextDigest: string;
             mediaType: string;
             size: string;
             encryption: {
+                nonce: string;
                 suite: "A256GCM";
                 keyId: string;
-                nonce: string;
                 aadDigest: string;
             };
             plaintextCommitment?: string | undefined;
         };
-        kind: "evidence_ref";
     };
     secretReferences: {
         producerInternalToken: "KYA_OS_AUDIT_PRODUCER_INTERNAL_TOKEN";

package/dist/config.d.ts

@@ -63,6 +63,8 @@ export interface CloudflareR2Binding {
  * lazy-expiry garbage window stays bounded.
  */
 export interface HttpChallengeConfig {
+    /** Explicit native HTTP issuer/status capabilities. Legacy MCP consent does not use this. */
+    native?: import("./delegation-http/native-http").NativeHttpHostConfig | null;
     /** Master switch. Default false — the layer is flag-gated. */
     enabled: boolean;
     /**
@@ -103,6 +105,8 @@ export interface HttpChallengeConfig {
  * Note: session and environment are inherited from MCPIBaseConfig.
  */
 export interface CloudflareRuntimeConfig extends MCPIConfig {
+    /** Resource admission before MCP tool input transformation. Throws fail closed. */
+    requestAdmission?: import('./security/mcp-admission').McpRequestAdmission;
     /** Canonical KYA-OS audit trail configuration. */
     auditTrail?: RuntimeAuditConfig;
     /**

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,UAAU,EAIV,gBAAgB,EAChB,0BAA0B,EAC3B,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,OAAO,EAAE,UAAU,GAAG,aAAa,GAAG,OAAO,GAAG,SAAS,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,OAAO,EAAE,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;CACrD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,IAAI,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAC;IAC/B,yFAAyF;IACzF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;OAMG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;;;;OAQG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAwB,SAAQ,UAAU;IACzD,kDAAkD;IAClD,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAEhC;;OAEG;IACH,OAAO,CAAC,EAAE;QACR;;;WAGG;QACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAE3B;;;WAGG;QACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;QAE9B;;;WAGG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC;QAEf;;;WAGG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAEF;;OAEG;IACH,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAE3B;;OAEG;IACH,cAAc,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAEvC;;OAEG;IACH,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAE3B;;OAEG;IACH,IAAI,CAAC,EAAE;QACL;;WAEG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB;;WAEG;QACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAE7B;;WAEG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB;;;WAGG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAE1B;;;;;WAKG;QACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAE5B;;WAEG;QACH,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KACnC,CAAC;IAEF;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB;;OAEG;IACH,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf;;WAEG;QACH,IAAI,EAAE,MAAM,CAAC;QAEb;;WAEG;QACH,OAAO,EAAE,MAAM,CAAC;QAEhB;;WAEG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC,CAAC;IAEH;;;OAGG;IACH,cAAc,CAAC,EAAE,0BAA0B,CAAC;IAE5C;;;OAGG;IACH,KAAK,CAAC,EAAE;QACN;;;WAGG;QACH,OAAO,EAAE,OAAO,CAAC;QAEjB;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAEF;;OAEG;IACH,UAAU,CAAC,EAAE,gBAAgB,GAAG;QAC9B;;;WAGG;QACH,QAAQ,CAAC,EAAE;YACT,IAAI,EAAE,eAAe,GAAG,aAAa,GAAG,KAAK,GAAG,QAAQ,CAAC;YACzD;;;eAGG;YACH,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB;;eAEG;YACH,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;SACnB,CAAC;QAEF;;;WAGG;QACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;KACrC,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;OAEG;IACH,WAAW,CAAC,EAAE;QACZ;;WAEG;QACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAEpB;;WAEG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAE/B;;WAEG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,CAAC;IAEF;;OAEG;IACH,YAAY,CAAC,EAAE;QACb;;;WAGG;QACH,OAAO,CAAC,EAAE,OAAO,CAAC;QAElB;;;WAGG;QACH,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAClC,KAAK,CAAC,EAAE,qBAAqB,CAAC;CAC/B;AAED;;GAEG;AACH,YAAY,EACV,UAAU,EACV,cAAc,EACd,qBAAqB,IAAI,kBAAkB,EAC3C,cAAc,EACd,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AAElC;;GAEG;AACH,eAAO,MAAM,8BAA8B,EAAE,OAAO,CAAC,uBAAuB,CAezE,CAAC;AAEJ;;GAEG;AACH,eAAO,MAAM,4BAA4B,EAAE,qBAW1C,CAAC;AAEF;;GAEG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC,GACxC,uBAAuB,CA2BzB;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,GACtC,qBAAqB,CAYvB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,uBAAuB,CAAC,CAsBlC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,OAAO,CAAC,uBAAuB,CAAC,GACvC,uBAAuB,CAiGzB;AAwBD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,uBAAuB,GAAG,SAAS,EAC3C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,QAAQ,CAAC,mBAAmB,CAAC,GAAG,IAAI,CA6CtC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,UAAU,EAIV,gBAAgB,EAChB,0BAA0B,EAC3B,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,OAAO,EAAE,UAAU,GAAG,aAAa,GAAG,OAAO,GAAG,SAAS,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,OAAO,EAAE,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;CACrD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,6FAA6F;IAC7F,MAAM,CAAC,EAAE,OAAO,+BAA+B,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC7E,8DAA8D;IAC9D,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,IAAI,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAC;IAC/B,yFAAyF;IACzF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;OAMG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;;;;OAQG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAwB,SAAQ,UAAU;IACzD,mFAAmF;IACnF,gBAAgB,CAAC,EAAE,OAAO,0BAA0B,EAAE,mBAAmB,CAAC;IAC1E,kDAAkD;IAClD,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAEhC;;OAEG;IACH,OAAO,CAAC,EAAE;QACR;;;WAGG;QACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAE3B;;;WAGG;QACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;QAE9B;;;WAGG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC;QAEf;;;WAGG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAEF;;OAEG;IACH,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAE3B;;OAEG;IACH,cAAc,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAEvC;;OAEG;IACH,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAE3B;;OAEG;IACH,IAAI,CAAC,EAAE;QACL;;WAEG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB;;WAEG;QACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAE7B;;WAEG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB;;;WAGG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAE1B;;;;;WAKG;QACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAE5B;;WAEG;QACH,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;KACnC,CAAC;IAEF;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB;;OAEG;IACH,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf;;WAEG;QACH,IAAI,EAAE,MAAM,CAAC;QAEb;;WAEG;QACH,OAAO,EAAE,MAAM,CAAC;QAEhB;;WAEG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC,CAAC;IAEH;;;OAGG;IACH,cAAc,CAAC,EAAE,0BAA0B,CAAC;IAE5C;;;OAGG;IACH,KAAK,CAAC,EAAE;QACN;;;WAGG;QACH,OAAO,EAAE,OAAO,CAAC;QAEjB;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAEF;;OAEG;IACH,UAAU,CAAC,EAAE,gBAAgB,GAAG;QAC9B;;;WAGG;QACH,QAAQ,CAAC,EAAE;YACT,IAAI,EAAE,eAAe,GAAG,aAAa,GAAG,KAAK,GAAG,QAAQ,CAAC;YACzD;;;eAGG;YACH,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB;;eAEG;YACH,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;SACnB,CAAC;QAEF;;;WAGG;QACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;KACrC,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;OAEG;IACH,WAAW,CAAC,EAAE;QACZ;;WAEG;QACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAEpB;;WAEG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAE/B;;WAEG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,CAAC;IAEF;;OAEG;IACH,YAAY,CAAC,EAAE;QACb;;;WAGG;QACH,OAAO,CAAC,EAAE,OAAO,CAAC;QAElB;;;WAGG;QACH,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAClC,KAAK,CAAC,EAAE,qBAAqB,CAAC;CAC/B;AAED;;GAEG;AACH,YAAY,EACV,UAAU,EACV,cAAc,EACd,qBAAqB,IAAI,kBAAkB,EAC3C,cAAc,EACd,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AAElC;;GAEG;AACH,eAAO,MAAM,8BAA8B,EAAE,OAAO,CAAC,uBAAuB,CAezE,CAAC;AAEJ;;GAEG;AACH,eAAO,MAAM,4BAA4B,EAAE,qBAW1C,CAAC;AAEF;;GAEG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC,GACxC,uBAAuB,CA2BzB;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,GACtC,qBAAqB,CAYvB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,uBAAuB,CAAC,CAsBlC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,OAAO,CAAC,uBAAuB,CAAC,GACvC,uBAAuB,CAiGzB;AAwBD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,uBAAuB,GAAG,SAAS,EAC3C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,QAAQ,CAAC,mBAAmB,CAAC,GAAG,IAAI,CA8CtC"}

package/dist/config.js

@@ -7,6 +7,7 @@
  * @module @kya-os/mcp-i-cloudflare/config
  */
 import { buildBaseConfig } from "@kya-os/contracts/config";
+import { resolveManagedNativeIssuer } from "./delegation-http/remote-issuer";
 /**
  * Default Cloudflare runtime configuration
  */
@@ -280,6 +281,7 @@ export function resolveHttpChallengeConfig(config, env) {
     const realm = realmEnv || httpChallenge?.realm || "";
     return {
         enabled: true,
+        native: httpChallenge?.native ?? resolveManagedNativeIssuer(env),
         mode: httpChallenge?.mode ?? "negotiated",
         realm,
         pollIntervalS: positiveOrDefault(httpChallenge?.pollIntervalS, 3),

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAoX3D;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GACzC;IACE,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE;QACP,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,GAAG;KACd;IACD,EAAE,EAAE,EAAE;IACN,cAAc,EAAE,EAAE;IAClB,EAAE,EAAE,EAAE;IACN,IAAI,EAAE;QACJ,WAAW,EAAE,aAAa;KAC3B;IACD,OAAO,EAAE,EAAE;IACX,QAAQ,EAAE,EAAE;CACb,CAAC;AAEJ;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAA0B;IACjE,IAAI,EAAE,cAAc;IACpB,YAAY,EAAE,eAAe;IAC7B,SAAS,EAAE,MAAM;IACjB,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,KAAK;IACb,UAAU,EAAE,KAAK;IACjB,YAAY,EAAE;QACZ,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,sBAAsB;KAC7B;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAyC;IAEzC,OAAO;QACL,GAAG,8BAA8B;QACjC,GAAG,MAAM;QACT,OAAO,EAAE;YACP,GAAG,8BAA8B,CAAC,OAAO;YACzC,GAAG,MAAM,EAAE,OAAO;SACnB;QACD,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,8BAA8B,CAAC,EAAG;QACpD,cAAc,EACZ,MAAM,EAAE,cAAc,IAAI,8BAA8B,CAAC,cAAe;QAC1E,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,8BAA8B,CAAC,EAAG;QACpD,IAAI,EAAE;YACJ,GAAG,8BAA8B,CAAC,IAAI;YACtC,GAAG,MAAM,EAAE,IAAI;SAChB;QACD,UAAU,EAAE,MAAM,EAAE,UAAU;YAC5B,CAAC,CAAC;gBACE,GAAG,MAAM,CAAC,UAAU;gBACpB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,IAAI;oBACtC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ;oBACpD,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,KAAK,aAAa,CAAC;wBAChE,EAAE,IAAI;iBACT;aACF;YACH,CAAC,CAAC,SAAS;KACa,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAuC;IAEvC,OAAO;QACL,GAAG,4BAA4B;QAC/B,GAAG,MAAM;QACT,WAAW,EAAE;YACX,GAAG,MAAM,EAAE,WAAW;SACvB;QACD,YAAY,EAAE;YACZ,GAAG,4BAA4B,CAAC,YAAY;YAC5C,GAAG,MAAM,EAAE,YAAY;SACxB;KACF,CAAC;AACJ,CAAC;AASD;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAkB;IAElB,MAAM,MAAM,GAAqC;QAC/C,IAAI,EAAE,EAAE;QACR,EAAE,EAAE,EAAE;QACN,cAAc,EAAE,EAAE;QAClB,EAAE,EAAE,EAAE;QACN,QAAQ,EAAE,EAAE;KACb,CAAC;IAEF,gCAAgC;IAChC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC,WAA2C,CAAC;IACvE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAwC;IAExC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAE9B,0EAA0E;IAC1E,4EAA4E;IAC5E,uFAAuF;IACvF,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAExC,4EAA4E;IAC5E,MAAM,8BAA8B,GAClC,CAAC,MAAM,CAAC,cAAc,IAAI,4BAA4B;QACtD,GAAG,CAAC,mBAAmB,CAAC,CAAC,kBAAkB;IAE7C,yEAAyE;IACzE,OAAO;QACL,GAAG,UAAU;QACb,GAAG,MAAM;QACT,4CAA4C;QAC5C,OAAO,EAAE;YACP,KAAK,EAAE,EAAE;YACT,QAAQ,EAAE,GAAG;YACb,GAAG,MAAM,CAAC,OAAO;SAClB;QACD,wBAAwB;QACxB,EAAE,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE;QACnB,gCAAgC;QAChC,IAAI,EAAE;YACJ,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;YAC5C,GAAG,MAAM,CAAC,IAAI;SACf;QACD,uFAAuF;QACvF,mEAAmE;QACnE,cAAc,EACZ,MAAM,CAAC,cAAc;YACrB,CAAC,8BAA8B;gBAC7B,CAAC,CAAC;oBACE,MAAM,EAAE,aAAsB;oBAC9B,WAAW,EAAE;wBACX,MAAM,EAAE,GAAG,CAAC,mBAAmB,IAAI,wBAAwB;wBAC3D,MAAM,EAAE,GAAG,CAAC,mBAAmB;wBAC/B,SAAS,EAAE,GAAG,CAAC,sBAAsB;wBACrC;;;;;;;;;;;;;;;;;;2BAkBG;wBACH,QAAQ,EAAE,CAAC,GAAG,EAAE;4BACd,MAAM,GAAG,GAAG,GAAG,CAAC,yBAAyB;gCACvC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,yBAAyB,EAAE,EAAE,CAAC;gCAC7C,CAAC,CAAC,MAAM,CAAC,CAAC,oBAAoB;4BAEhC,8BAA8B;4BAC9B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,OAAO,EAAE,CAAC;gCAC3C,OAAO,CAAC,IAAI,CACV,sCAAsC,GAAG,CAAC,yBAAyB,IAAI;oCACrE,yEAAyE,CAC5E,CAAC;gCACF,OAAO,MAAM,CAAC;4BAChB,CAAC;4BAED,OAAO,GAAG,CAAC;wBACb,CAAC,CAAC,EAAE;qBACL;oBACD,kEAAkE;oBAClE,0EAA0E;oBAC1E,WAAW,EAAE,EAAE;oBACf,sDAAsD;oBACtD,qBAAqB,EAAE,SAAS;oBAChC,KAAK,EAAE,UAAU,CAAC,WAAW,KAAK,aAAa;iBAChD;gBACH,CAAC,CAAC,SAAS,CAAC;QAChB,0BAA0B;QAC1B,iGAAiG;QACjG,KAAK,EACH,MAAM,CAAC,KAAK;YACZ,CAAC,GAAG,CAAC,mBAAmB;gBACtB,CAAC,CAAC;oBACE,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,mBAAmB;iBACrD;gBACH,CAAC,CAAC,SAAS,CAAC;KACU,CAAC;AAC/B,CAAC;AAED,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;GAGG;AACH,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oEAAoE;AACpE,SAAS,iBAAiB,CAAC,KAAc,EAAE,QAAgB;IACzD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QACrE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAA2C,EAC3C,GAA4B;IAE5B,MAAM,aAAa,GAAG,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC;IACxD,MAAM,OAAO,GAAG,wBAAwB,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAEnE,IAAI,OAAO,GAAG,aAAa,EAAE,OAAO,IAAI,IAAI,CAAC;IAC7C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,GAAG,IAAI,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,GAAG,KAAK,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CACzB,iBAAiB,CAAC,aAAa,EAAE,UAAU,EAAE,gBAAgB,CAAC,EAC9D,gBAAgB,CACjB,CAAC;IAEF,8EAA8E;IAC9E,+EAA+E;IAC/E,MAAM,yBAAyB,GAAG,wBAAwB,CACxD,GAAG,EAAE,wBAAwB,CAC9B,CAAC;IACF,IAAI,wBAAwB,GAC1B,aAAa,EAAE,wBAAwB,IAAI,IAAI,CAAC;IAClD,IAAI,yBAAyB,KAAK,SAAS,EAAE,CAAC;QAC5C,wBAAwB,GAAG,yBAAyB,CAAC;IACvD,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,QAAQ,GACZ,OAAO,GAAG,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,QAAQ,IAAI,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC;IAErD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,aAAa,EAAE,IAAI,IAAI,YAAY;QACzC,KAAK;QACL,aAAa,EAAE,iBAAiB,CAAC,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC;QACjE,UAAU;QACV,oBAAoB,EAAE,iBAAiB,CACrC,aAAa,EAAE,oBAAoB,EACnC,GAAG,CACJ;QACD,2BAA2B,EACzB,aAAa,EAAE,2BAA2B,IAAI,KAAK;QACrD,wBAAwB;KACzB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAwX7E;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GACzC;IACE,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE;QACP,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,GAAG;KACd;IACD,EAAE,EAAE,EAAE;IACN,cAAc,EAAE,EAAE;IAClB,EAAE,EAAE,EAAE;IACN,IAAI,EAAE;QACJ,WAAW,EAAE,aAAa;KAC3B;IACD,OAAO,EAAE,EAAE;IACX,QAAQ,EAAE,EAAE;CACb,CAAC;AAEJ;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAA0B;IACjE,IAAI,EAAE,cAAc;IACpB,YAAY,EAAE,eAAe;IAC7B,SAAS,EAAE,MAAM;IACjB,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,KAAK;IACb,UAAU,EAAE,KAAK;IACjB,YAAY,EAAE;QACZ,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,sBAAsB;KAC7B;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAyC;IAEzC,OAAO;QACL,GAAG,8BAA8B;QACjC,GAAG,MAAM;QACT,OAAO,EAAE;YACP,GAAG,8BAA8B,CAAC,OAAO;YACzC,GAAG,MAAM,EAAE,OAAO;SACnB;QACD,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,8BAA8B,CAAC,EAAG;QACpD,cAAc,EACZ,MAAM,EAAE,cAAc,IAAI,8BAA8B,CAAC,cAAe;QAC1E,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,8BAA8B,CAAC,EAAG;QACpD,IAAI,EAAE;YACJ,GAAG,8BAA8B,CAAC,IAAI;YACtC,GAAG,MAAM,EAAE,IAAI;SAChB;QACD,UAAU,EAAE,MAAM,EAAE,UAAU;YAC5B,CAAC,CAAC;gBACE,GAAG,MAAM,CAAC,UAAU;gBACpB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,IAAI;oBACtC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ;oBACpD,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,KAAK,aAAa,CAAC;wBAChE,EAAE,IAAI;iBACT;aACF;YACH,CAAC,CAAC,SAAS;KACa,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAuC;IAEvC,OAAO;QACL,GAAG,4BAA4B;QAC/B,GAAG,MAAM;QACT,WAAW,EAAE;YACX,GAAG,MAAM,EAAE,WAAW;SACvB;QACD,YAAY,EAAE;YACZ,GAAG,4BAA4B,CAAC,YAAY;YAC5C,GAAG,MAAM,EAAE,YAAY;SACxB;KACF,CAAC;AACJ,CAAC;AASD;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAkB;IAElB,MAAM,MAAM,GAAqC;QAC/C,IAAI,EAAE,EAAE;QACR,EAAE,EAAE,EAAE;QACN,cAAc,EAAE,EAAE;QAClB,EAAE,EAAE,EAAE;QACN,QAAQ,EAAE,EAAE;KACb,CAAC;IAEF,gCAAgC;IAChC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC,WAA2C,CAAC;IACvE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAwC;IAExC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAE9B,0EAA0E;IAC1E,4EAA4E;IAC5E,uFAAuF;IACvF,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAExC,4EAA4E;IAC5E,MAAM,8BAA8B,GAClC,CAAC,MAAM,CAAC,cAAc,IAAI,4BAA4B;QACtD,GAAG,CAAC,mBAAmB,CAAC,CAAC,kBAAkB;IAE7C,yEAAyE;IACzE,OAAO;QACL,GAAG,UAAU;QACb,GAAG,MAAM;QACT,4CAA4C;QAC5C,OAAO,EAAE;YACP,KAAK,EAAE,EAAE;YACT,QAAQ,EAAE,GAAG;YACb,GAAG,MAAM,CAAC,OAAO;SAClB;QACD,wBAAwB;QACxB,EAAE,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE;QACnB,gCAAgC;QAChC,IAAI,EAAE;YACJ,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;YAC5C,GAAG,MAAM,CAAC,IAAI;SACf;QACD,uFAAuF;QACvF,mEAAmE;QACnE,cAAc,EACZ,MAAM,CAAC,cAAc;YACrB,CAAC,8BAA8B;gBAC7B,CAAC,CAAC;oBACE,MAAM,EAAE,aAAsB;oBAC9B,WAAW,EAAE;wBACX,MAAM,EAAE,GAAG,CAAC,mBAAmB,IAAI,wBAAwB;wBAC3D,MAAM,EAAE,GAAG,CAAC,mBAAmB;wBAC/B,SAAS,EAAE,GAAG,CAAC,sBAAsB;wBACrC;;;;;;;;;;;;;;;;;;2BAkBG;wBACH,QAAQ,EAAE,CAAC,GAAG,EAAE;4BACd,MAAM,GAAG,GAAG,GAAG,CAAC,yBAAyB;gCACvC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,yBAAyB,EAAE,EAAE,CAAC;gCAC7C,CAAC,CAAC,MAAM,CAAC,CAAC,oBAAoB;4BAEhC,8BAA8B;4BAC9B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,OAAO,EAAE,CAAC;gCAC3C,OAAO,CAAC,IAAI,CACV,sCAAsC,GAAG,CAAC,yBAAyB,IAAI;oCACrE,yEAAyE,CAC5E,CAAC;gCACF,OAAO,MAAM,CAAC;4BAChB,CAAC;4BAED,OAAO,GAAG,CAAC;wBACb,CAAC,CAAC,EAAE;qBACL;oBACD,kEAAkE;oBAClE,0EAA0E;oBAC1E,WAAW,EAAE,EAAE;oBACf,sDAAsD;oBACtD,qBAAqB,EAAE,SAAS;oBAChC,KAAK,EAAE,UAAU,CAAC,WAAW,KAAK,aAAa;iBAChD;gBACH,CAAC,CAAC,SAAS,CAAC;QAChB,0BAA0B;QAC1B,iGAAiG;QACjG,KAAK,EACH,MAAM,CAAC,KAAK;YACZ,CAAC,GAAG,CAAC,mBAAmB;gBACtB,CAAC,CAAC;oBACE,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,mBAAmB;iBACrD;gBACH,CAAC,CAAC,SAAS,CAAC;KACU,CAAC;AAC/B,CAAC;AAED,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;GAGG;AACH,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oEAAoE;AACpE,SAAS,iBAAiB,CAAC,KAAc,EAAE,QAAgB;IACzD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QACrE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAA2C,EAC3C,GAA4B;IAE5B,MAAM,aAAa,GAAG,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC;IACxD,MAAM,OAAO,GAAG,wBAAwB,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAEnE,IAAI,OAAO,GAAG,aAAa,EAAE,OAAO,IAAI,IAAI,CAAC;IAC7C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,GAAG,IAAI,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,GAAG,KAAK,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CACzB,iBAAiB,CAAC,aAAa,EAAE,UAAU,EAAE,gBAAgB,CAAC,EAC9D,gBAAgB,CACjB,CAAC;IAEF,8EAA8E;IAC9E,+EAA+E;IAC/E,MAAM,yBAAyB,GAAG,wBAAwB,CACxD,GAAG,EAAE,wBAAwB,CAC9B,CAAC;IACF,IAAI,wBAAwB,GAC1B,aAAa,EAAE,wBAAwB,IAAI,IAAI,CAAC;IAClD,IAAI,yBAAyB,KAAK,SAAS,EAAE,CAAC;QAC5C,wBAAwB,GAAG,yBAAyB,CAAC;IACvD,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,QAAQ,GACZ,OAAO,GAAG,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,QAAQ,IAAI,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC;IAErD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,aAAa,EAAE,MAAM,IAAI,0BAA0B,CAAC,GAAG,CAAC;QAChE,IAAI,EAAE,aAAa,EAAE,IAAI,IAAI,YAAY;QACzC,KAAK;QACL,aAAa,EAAE,iBAAiB,CAAC,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC;QACjE,UAAU;QACV,oBAAoB,EAAE,iBAAiB,CACrC,aAAa,EAAE,oBAAoB,EACnC,GAAG,CACJ;QACD,2BAA2B,EACzB,aAAa,EAAE,2BAA2B,IAAI,KAAK;QACrD,wBAAwB;KACzB,CAAC;AACJ,CAAC"}

package/dist/delegation-http/anchor-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anchor-do.d.ts","sourceRoot":"","sources":["../../src/delegation-http/anchor-do.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAiEhE;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,KAAK,EAAE,OAAO,EACd,GAAG,EAAE,MAAM,GACV;IACD,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9C,CAiDA;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,MAAM,GACV;IACD,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,QAAQ,EAAE;QACR,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;QAC1C,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH,CA8DA;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,KAAK,EAAE,OAAO,EACd,GAAG,EAAE,MAAM,GACV;IACD,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9C,CAqBA;AAuBD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,kBAAkB,EACvB,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,QAAQ,CAAC,CAoEnB"}
+{"version":3,"file":"anchor-do.d.ts","sourceRoot":"","sources":["../../src/delegation-http/anchor-do.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAuFhE;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,KAAK,EAAE,OAAO,EACd,GAAG,EAAE,MAAM,GACV;IACD,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9C,CAmEA;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,MAAM,GACV;IACD,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,QAAQ,EAAE;QACR,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;QAC1C,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH,CA+EA;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,kBAAkB,GAAG,SAAS,EACnC,KAAK,EAAE,OAAO,EACd,GAAG,EAAE,MAAM,GACV;IACD,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9C,CAyEA;AAuBD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,kBAAkB,EACvB,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,QAAQ,CAAC,CA+EnB"}

package/dist/delegation-http/anchor-do.js

@@ -49,12 +49,26 @@ function anchorSnapshot(rec) {
         agentDid: rec.agentDid,
         audience: rec.audience,
         serverDid: rec.serverDid,
+        nativeHttp: rec.nativeHttp,
+        nativeRegistration: rec.nativeRegistration,
+        nativeIssuerDid: rec.nativeIssuerDid,
+        nativePolicyRevision: rec.nativePolicyRevision,
     };
 }
 const pendingBody = () => ({ status: "pending" });
 const pinnedErr = () => ({ error: KYAOS_ERRORS.pickupPinned });
 const invalidSessionErr = () => ({ error: KYAOS_ERRORS.invalidSession });
 const pickupExpiredErr = () => ({ error: KYAOS_ERRORS.pickupExpired });
+/** Native records predating persisted signed expiry cannot safely be delivered. */
+function nativeGrantExpired(rec, now) {
+    if (!rec.nativeHttp || rec.status !== "approved")
+        return false;
+    const exp = rec.delegation?.expiresAtUnix;
+    return (!Number.isSafeInteger(exp) ||
+        exp <= 0 ||
+        !Number.isSafeInteger(exp * 1000) ||
+        now >= exp * 1000);
+}
 /**
  * Pure reducer for `create`. Writes a fresh anchor record (PENDING, or PINNED when a
  * challenge-time keyid pin is supplied). Idempotent by construction: a `pickup:<sid>`
@@ -79,6 +93,15 @@ export function reduceCreate(rec, input, now) {
             },
         };
     }
+    if (i.nativeHttp &&
+        i.nativeIssuedAtMs !== undefined &&
+        (!Number.isSafeInteger(i.nativeIssuedAtMs) ||
+            i.nativeIssuedAtMs > now + 30_000 ||
+            i.nativeIssuedAtMs + 600_000 <= now))
+        return {
+            response: { status: 410, body: { error: "kyaos/pickup-expired" } },
+        };
+    const issuedAt = i.nativeHttp && i.nativeIssuedAtMs !== undefined ? i.nativeIssuedAtMs : now;
     const record = {
         sid: i.sid,
         status: i.pin ? "pinned" : "pending",
@@ -86,12 +109,17 @@ export function reduceCreate(rec, input, now) {
         minAssurance: i.minAssurance,
         pollIntervalS: i.pollIntervalS,
         createdAt: now,
-        expiresAt: now + i.anchorTtlS * 1000,
+        expiresAt: issuedAt +
+            Math.min(i.nativeHttp ? 600 : i.anchorTtlS, i.anchorTtlS) * 1000,
         agentDid: typeof i.agentDid === "string" ? i.agentDid : undefined,
         audience: typeof i.audience === "string" ? i.audience : undefined,
         serverDid: typeof i.serverDid === "string" ? i.serverDid : undefined,
         registeredAtMs: typeof i.registeredAtMs === "number" ? i.registeredAtMs : undefined,
-        issuedAtMs: now,
+        issuedAtMs: issuedAt,
+        nativeHttp: i.nativeHttp,
+        nativeRegistration: i.nativeRegistration,
+        nativeIssuerDid: i.nativeIssuerDid,
+        nativePolicyRevision: i.nativePolicyRevision,
         pin: i.pin
             ? {
                 type: i.pin.type,
@@ -123,10 +151,18 @@ export function reducePoll(rec, holder, now) {
     if (!rec) {
         return { response: { status: 404, body: invalidSessionErr() } };
     }
-    if (now > rec.expiresAt) {
+    if (now > rec.expiresAt || nativeGrantExpired(rec, now)) {
         // delete-on-expired-read: a 410 outcome tells the dispatcher to drop the key.
         return { response: { status: 410, body: pickupExpiredErr() } };
     }
+    if (rec.nativeHttp &&
+        (!holder.nativeVerified ||
+            holder.type !== "keyid" ||
+            rec.nativeHttp.action.pin.mode !== "key")) {
+        return {
+            response: { status: 403, body: { error: "kyaos/profile-violation" } },
+        };
+    }
     const holderSha = sha256Hex(holder.value);
     let working = rec;
     let pinnedJustNow = false;
@@ -148,6 +184,7 @@ export function reducePoll(rec, holder, now) {
                 valueSha256: holderSha,
                 pinnedAt: now,
                 source: "first-poll",
+                ...(rec.nativeHttp ? { keyId: holder.value } : {}),
             },
         };
         pinnedJustNow = true;
@@ -158,7 +195,9 @@ export function reducePoll(rec, holder, now) {
             status: "ready",
             token_type: "Bearer",
             delegation: working.delegation.vcJwt,
-            expires_in: working.delegation.expiresInS,
+            expires_in: working.nativeHttp
+                ? Math.max(0, Math.floor((working.delegation.expiresAtUnix * 1000 - now) / 1000))
+                : working.delegation.expiresInS,
         };
         return pinnedJustNow
             ? { record: working, response: { status: 200, body } }
@@ -186,22 +225,70 @@ export function reduceApprove(rec, input, now) {
     if (!rec) {
         return { response: { status: 404, body: invalidSessionErr() } };
     }
-    if (now > rec.expiresAt) {
+    if (now > rec.expiresAt || nativeGrantExpired(rec, now)) {
         return { response: { status: 410, body: pickupExpiredErr() } };
     }
+    if (rec.nativeHttp && (!rec.pin?.keyId || rec.pin.type !== "keyid")) {
+        return {
+            response: { status: 409, body: { error: "kyaos/pickup-unpinned" } },
+        };
+    }
     // Idempotent approve: once a credential is parked, a duplicate approval (a
     // double-submit, two consent tabs) must NOT replace it. Each approve mints a fresh
     // VC-JWT, so a blind upsert would swap a live delegation the pinned holder may
     // already be picking up. Return the existing success without re-parking.
     if (rec.status === "approved" && rec.delegation) {
-        return { response: { status: 200, body: { success: true } } };
+        if (rec.nativeHttp &&
+            (rec.delegation.vcJwt !== i.vcJwt ||
+                rec.delegation.expiresAtUnix !== i.expiresAtUnix)) {
+            return {
+                response: { status: 409, body: { error: "kyaos/session-mismatch" } },
+            };
+        }
+        return {
+            response: {
+                status: 200,
+                body: {
+                    success: true,
+                    ...(rec.nativeHttp
+                        ? { expiresAtUnix: rec.delegation.expiresAtUnix }
+                        : {}),
+                },
+            },
+        };
+    }
+    if (rec.nativeHttp &&
+        (!Number.isSafeInteger(i.expiresAtUnix) ||
+            i.expiresAtUnix <= 0 ||
+            !Number.isSafeInteger(i.expiresAtUnix * 1000) ||
+            i.expiresAtUnix > Math.floor(now / 1000) + 3630)) {
+        return {
+            response: { status: 400, body: { error: "kyaos/profile-violation" } },
+        };
+    }
+    if (rec.nativeHttp && now >= i.expiresAtUnix * 1000) {
+        return { response: { status: 410, body: pickupExpiredErr() } };
     }
     const record = {
         ...rec,
         status: "approved",
-        delegation: { vcJwt: i.vcJwt, expiresInS: i.expiresInS, approvedAt: now },
+        delegation: {
+            vcJwt: i.vcJwt,
+            expiresInS: i.expiresInS,
+            approvedAt: now,
+            ...(rec.nativeHttp ? { expiresAtUnix: i.expiresAtUnix } : {}),
+        },
+    };
+    return {
+        record,
+        response: {
+            status: 200,
+            body: {
+                success: true,
+                ...(rec.nativeHttp ? { expiresAtUnix: i.expiresAtUnix } : {}),
+            },
+        },
     };
-    return { record, response: { status: 200, body: { success: true } } };
 }
 /** Reducer outcome → wire `Response`, applying the frozen header rules. */
 function wireResponse(r) {
@@ -253,7 +340,10 @@ export async function handlePickupInternal(ctx, request, now) {
             (h.type !== "token" && h.type !== "keyid")) {
             return wireResponse({
                 status: 400,
-                body: { error: "kyaos/invalid-request", message: "missing or malformed holder" },
+                body: {
+                    error: "kyaos/invalid-request",
+                    message: "missing or malformed holder",
+                },
             });
         }
         const { record, response } = reducePoll(rec, h, t);
@@ -275,7 +365,7 @@ export async function handlePickupInternal(ctx, request, now) {
         if (!rec) {
             return wireResponse({ status: 404, body: invalidSessionErr() });
         }
-        if (t > rec.expiresAt) {
+        if (t > rec.expiresAt || nativeGrantExpired(rec, t)) {
             await ctx.storage.delete(key);
             return wireResponse({ status: 410, body: pickupExpiredErr() });
         }
@@ -290,6 +380,14 @@ export async function handlePickupInternal(ctx, request, now) {
                 agentDid: rec.agentDid,
                 audience: rec.audience,
                 serverDid: rec.serverDid,
+                nativeHttp: rec.nativeHttp,
+                nativeRegistration: rec.nativeRegistration,
+                nativeIssuerDid: rec.nativeIssuerDid,
+                nativePolicyRevision: rec.nativePolicyRevision,
+                // This internal-only projection carries public key material for issuance.
+                ...(rec.nativeHttp && rec.pin?.type === "keyid"
+                    ? { holderKeyId: rec.pin.keyId }
+                    : {}),
             },
         });
     }