@agent-network-protocol/dsh-anp-identity 0.1.2 → 0.1.3-rc.2

package/lib/remote.js

@@ -0,0 +1,86 @@
+/** Explicit browser-safe Typert method contract for the optional manager. */
+import { z } from "zod";
+const reference = z
+    .object({
+    storeId: z.string().min(1),
+    identityId: z.string().min(1),
+    did: z.string().min(1),
+})
+    .strict();
+const version = z
+    .object({
+    requestId: z.string().min(1),
+    expectedVersion: z.number().int().positive(),
+})
+    .strict();
+const decision = version
+    .extend({
+    decision: z.enum(["approve", "deny"]),
+    identity: reference.optional(),
+    mode: z.enum(["once", "permanent"]).optional(),
+    reviewedSnapshot: z
+        .object({
+        version: z.string().min(1),
+        capabilities: z.array(z.enum(["identity:read", "identity:sign", "identity:http-auth"])),
+        signingPurposes: z.array(z.string()),
+        httpOrigins: z.array(z.string()),
+    })
+        .strict()
+        .optional(),
+})
+    .strict();
+const methods = [
+    ["listIdentities", undefined],
+    ["listRequests", z.boolean().optional()],
+    ["getRequest", z.string().min(1)],
+    ["decide", decision],
+    ["grants", reference],
+    [
+        "revoke",
+        z
+            .object({
+            grantId: z.string().min(1),
+            expectedVersion: z.number().int().positive(),
+        })
+            .strict(),
+    ],
+    ["publicDocument", reference],
+    [
+        "deleteIdentity",
+        z.object({ reference, confirmationName: z.string().min(1) }).strict(),
+    ],
+    ["markPrompted", version],
+    ["reauthorize", version],
+];
+const contribution = {
+    package: "@agent-network-protocol/dsh-anp-identity",
+    descriptors: methods.map(([method, schema]) => ({
+        id: `@agent-network-protocol/dsh-anp-identity#anpIdentityManager/${method}`,
+        service: "anpIdentityManager",
+        namespace: "anpIdentityManager",
+        method,
+        invocation: { kind: "direct" },
+        parameters: schema === undefined
+            ? []
+            : [
+                {
+                    name: "input",
+                    wire: "input",
+                    source: "json",
+                    ...(method === "listRequests" ? { acceptsUndefined: true } : {}),
+                    codec: {
+                        mode: "strict",
+                        typeSymbol: `anp-identity/manager#${method}Input`,
+                        schema,
+                    },
+                },
+            ],
+        result: {
+            mode: "strict",
+            typeSymbol: `anp-identity/manager#${method}Result`,
+            schema: z.json().nullable(),
+        },
+    })),
+};
+export default contribution;
+//# sourceMappingURL=remote.js.map

package/lib/remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../src/remote.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,OAAO,GAAG,CAAC;KACd,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,QAAQ,GAAG,OAAO;KACrB,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACrC,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC9B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,gBAAgB,EAAE,CAAC;SAChB,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,YAAY,EAAE,CAAC,CAAC,KAAK,CACnB,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC,CACjE;QACD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACpC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,OAAO,GAAG;IACd,CAAC,gBAAgB,EAAE,SAAS,CAAC;IAC7B,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;IACxC,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,QAAQ,EAAE,SAAS,CAAC;IACrB;QACE,QAAQ;QACR,CAAC;aACE,MAAM,CAAC;YACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;SAC7C,CAAC;aACD,MAAM,EAAE;KACZ;IACD,CAAC,gBAAgB,EAAE,SAAS,CAAC;IAC7B;QACE,gBAAgB;QAChB,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;KACtE;IACD,CAAC,cAAc,EAAE,OAAO,CAAC;IACzB,CAAC,aAAa,EAAE,OAAO,CAAC;CAChB,CAAC;AAEX,MAAM,YAAY,GAA6B;IAC7C,OAAO,EAAE,0CAA0C;IACnD,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9C,EAAE,EAAE,+DAA+D,MAAM,EAAE;QAC3E,OAAO,EAAE,oBAAoB;QAC7B,SAAS,EAAE,oBAAoB;QAC/B,MAAM;QACN,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC9B,UAAU,EACR,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE;oBACE,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,MAAM;oBACd,GAAG,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChE,KAAK,EAAE;wBACL,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE,wBAAwB,MAAM,OAAO;wBACjD,MAAM;qBACP;iBACF;aACF;QACP,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,wBAAwB,MAAM,QAAQ;YAClD,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;SAC5B;KACF,CAAC,CAAC;CACJ,CAAC;AACF,eAAe,YAAY,CAAC"}

package/lib/user-client.d.ts

@@ -0,0 +1,41 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { PublicIdentity, SignRequest, Signature, IdentityReference } from './types.js';
+import type { AuthorizationRequest, AuthorizationExecution, RequestCreateInput } from './authorization-types.js';
+/** Raw operation input. The Host computes the fingerprint; consumers cannot supply one. */
+export type UserOperation = {
+    readonly action: 'read';
+} | {
+    readonly action: 'sign';
+    readonly request: SignRequest;
+} | {
+    readonly action: 'http';
+    readonly request: Request;
+};
+export interface UserAccessRequest {
+    readonly requestId: string;
+    readonly purpose: string;
+    readonly identity?: IdentityReference;
+    readonly operation?: UserOperation;
+}
+/** A caller- and identity-bound object with no management or Provider methods. */
+export interface AuthorizedIdentity {
+    publicIdentity(executionId?: string): Promise<PublicIdentity>;
+    sign(request: SignRequest, executionId?: string): Promise<Signature>;
+    readonly authenticatedHttp: {
+        dispatch(request: Request, executionId?: string): Promise<Response>;
+    };
+}
+export interface UserIdentityClient {
+    requestCreateIdentity(input: RequestCreateInput): Promise<AuthorizationRequest>;
+    getCreateRequest(requestId: string): Promise<AuthorizationRequest>;
+    cancelCreateRequest(requestId: string, expectedVersion: number): Promise<AuthorizationRequest>;
+    requestAccess(input: UserAccessRequest): Promise<AuthorizationRequest>;
+    getAccessRequest(requestId: string): Promise<AuthorizationRequest>;
+    cancelAccessRequest(requestId: string, expectedVersion: number): Promise<AuthorizationRequest>;
+    openAuthorizedIdentity(grantId: string): Promise<AuthorizedIdentity>;
+    getExecution(executionId: string): Promise<AuthorizationExecution>;
+    subscribeRequestChanges(listener: () => void): () => void;
+}
+/** Bind using the installed Cordis context, never a consumer string from a request. */
+export declare function bindIdentityClient(ctx: Context): UserIdentityClient;
+//# sourceMappingURL=user-client.d.ts.map

package/lib/user-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-client.d.ts","sourceRoot":"","sources":["../src/user-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC3F,OAAO,KAAK,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAEhH,2FAA2F;AAC3F,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAA;AAE1D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAA;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAA;CACnC;AAED,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IAC7D,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACpE,QAAQ,CAAC,iBAAiB,EAAE;QAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KACpE,CAAA;CACF;AAED,MAAM,WAAW,kBAAkB;IACjC,qBAAqB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC/E,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAClE,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC9F,aAAa,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IACtE,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAClE,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC9F,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACpE,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAClE,uBAAuB,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAA;CAC1D;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAGnE"}

package/lib/user-client.js

@@ -0,0 +1,6 @@
+/** Bind using the installed Cordis context, never a consumer string from a request. */
+export function bindIdentityClient(ctx) {
+    const service = ctx.anpIdentity;
+    return service.bindUserConsumer(ctx);
+}
+//# sourceMappingURL=user-client.js.map

package/lib/user-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-client.js","sourceRoot":"","sources":["../src/user-client.ts"],"names":[],"mappings":"AAsCA,uFAAuF;AACvF,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,WAAoF,CAAA;IACxG,OAAO,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;AACtC,CAAC"}

package/lib/user-operation.d.ts

@@ -0,0 +1,7 @@
+import type { ControlledOperation } from './authorization-types.js';
+import type { UserOperation } from './user-client.js';
+export declare function normalizeOperation(operation: UserOperation): Promise<{
+    readonly frozen: ControlledOperation;
+    readonly input: UserOperation;
+}>;
+//# sourceMappingURL=user-operation.d.ts.map

package/lib/user-operation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-operation.d.ts","sourceRoot":"","sources":["../src/user-operation.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAIrD,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,aAAa,GAAG,OAAO,CAAC;IAC1E,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAC9B,CAAC,CAwED"}

package/lib/user-operation.js

@@ -0,0 +1,87 @@
+import { createHash } from 'node:crypto';
+import { pluginError } from './errors.js';
+import { ANP_IDENTITY_HTTP_MAX_BODY_BYTES } from './http-auth.js';
+export async function normalizeOperation(operation) {
+    if (operation?.action === 'read')
+        return {
+            frozen: fingerprint('identity:read', 'Read public identity', { action: 'read' }),
+            input: { action: 'read' },
+        };
+    if (operation?.action === 'sign') {
+        const original = operation.request;
+        if (!original || !Buffer.isBuffer(original.payload)
+            || original.payload.length > ANP_IDENTITY_HTTP_MAX_BODY_BYTES
+            || !['authentication', 'application_assertion'].includes(original.purpose)
+            || (original.kid !== undefined && typeof original.kid !== 'string')
+            || (original.purpose === 'application_assertion' && (typeof original.domain !== 'string' || !original.domain))) {
+            throw pluginError('invalid_request');
+        }
+        const request = original.purpose === 'application_assertion'
+            ? { purpose: original.purpose, domain: original.domain, payload: Buffer.from(original.payload), ...(original.kid === undefined ? {} : { kid: original.kid }) }
+            : { purpose: 'authentication', payload: Buffer.from(original.payload), ...(original.kid === undefined ? {} : { kid: original.kid }) };
+        return {
+            frozen: { ...fingerprint('identity:sign', `Sign: ${request.purpose}`, {
+                    action: 'sign', purpose: request.purpose, kid: request.kid ?? null,
+                    domain: request.purpose === 'application_assertion' ? request.domain : null,
+                    payload: request.payload.toString('base64'),
+                }), signingPurpose: request.purpose },
+            input: { action: 'sign', request },
+        };
+    }
+    if (operation?.action !== 'http' || !(operation.request instanceof Request) || operation.request.bodyUsed) {
+        throw pluginError('invalid_request');
+    }
+    const original = operation.request;
+    const url = new URL(original.url);
+    if (url.protocol !== 'https:' || url.username || url.password || url.hash)
+        throw pluginError('http_origin_forbidden');
+    for (const header of ['authorization', 'signature', 'signature-input', 'content-digest']) {
+        if (original.headers.has(header))
+            throw pluginError('invalid_request');
+    }
+    const clone = original.clone();
+    const reader = clone.body?.getReader();
+    let body;
+    if (reader) {
+        const chunks = [];
+        let size = 0;
+        try {
+            for (;;) {
+                const result = await reader.read();
+                if (result.done)
+                    break;
+                size += result.value.length;
+                if (size > ANP_IDENTITY_HTTP_MAX_BODY_BYTES) {
+                    void reader.cancel().catch(() => { });
+                    throw pluginError('http_body_too_large');
+                }
+                chunks.push(Uint8Array.from(result.value));
+            }
+            body = Buffer.concat(chunks);
+        }
+        finally {
+            reader.releaseLock();
+        }
+    }
+    const request = new Request(original.url, {
+        method: original.method, headers: new Headers(original.headers), redirect: 'manual',
+        signal: original.signal, credentials: original.credentials, cache: original.cache,
+        mode: original.mode, referrer: original.referrer, referrerPolicy: original.referrerPolicy,
+        integrity: original.integrity, keepalive: original.keepalive,
+        ...(body === undefined ? {} : { body: Uint8Array.from(body) }),
+    });
+    return {
+        frozen: { ...fingerprint('identity:http-auth', `${request.method} ${url.origin}${url.pathname}${url.href.includes('?') ? '（包含查询参数，内容未展示）' : ''}`, {
+                action: 'http', url: request.url, method: request.method, headers: [...request.headers],
+                body: body === undefined ? null : Buffer.from(body).toString('base64'),
+                credentials: request.credentials, cache: request.cache, mode: request.mode,
+                referrer: request.referrer, referrerPolicy: request.referrerPolicy,
+                integrity: request.integrity, keepalive: request.keepalive,
+            }), httpOrigin: url.origin },
+        input: { action: 'http', request },
+    };
+}
+function fingerprint(capability, summary, payload) {
+    return { capability, summary, fingerprint: createHash('sha256').update(JSON.stringify(payload)).digest('hex') };
+}
+//# sourceMappingURL=user-operation.js.map

package/lib/user-operation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-operation.js","sourceRoot":"","sources":["../src/user-operation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAIxC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAA;AAEjE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,SAAwB;IAI/D,IAAI,SAAS,EAAE,MAAM,KAAK,MAAM;QAAE,OAAO;YACvC,MAAM,EAAE,WAAW,CAAC,eAAe,EAAE,sBAAsB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAChF,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;SAC1B,CAAA;IACD,IAAI,SAAS,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAA;QAClC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;eAC9C,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,gCAAgC;eAC1D,CAAC,CAAC,gBAAgB,EAAE,uBAAuB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;eACvE,CAAC,QAAQ,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC;eAChE,CAAC,QAAQ,CAAC,OAAO,KAAK,uBAAuB,IAAI,CAAC,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACjH,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;QACtC,CAAC;QACD,MAAM,OAAO,GAAgB,QAAQ,CAAC,OAAO,KAAK,uBAAuB;YACvE,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE;YAC9J,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,CAAA;QACvI,OAAO;YACL,MAAM,EAAE,EAAE,GAAG,WAAW,CAAC,eAAe,EAAE,SAAS,OAAO,CAAC,OAAO,EAAE,EAAE;oBACpE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI;oBAClE,MAAM,EAAE,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;oBAC3E,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBAC5C,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO,EAAE;YACrC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;SACnC,CAAA;IACH,CAAC;IACD,IAAI,SAAS,EAAE,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,YAAY,OAAO,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC1G,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;IACtC,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAA;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI;QAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;IACrH,KAAK,MAAM,MAAM,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACzF,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;IACxE,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,CAAA;IACtC,IAAI,IAA4B,CAAA;IAChC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAiB,EAAE,CAAA;QAC/B,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,IAAI,CAAC;YACH,SAAS,CAAC;gBACR,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;gBAClC,IAAI,MAAM,CAAC,IAAI;oBAAE,MAAK;gBACtB,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAA;gBAC3B,IAAI,IAAI,GAAG,gCAAgC,EAAE,CAAC;oBAC5C,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;oBACpC,MAAM,WAAW,CAAC,qBAAqB,CAAC,CAAA;gBAC1C,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;YAC5C,CAAC;YACD,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC9B,CAAC;gBAAS,CAAC;YAAC,MAAM,CAAC,WAAW,EAAE,CAAA;QAAC,CAAC;IACpC,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE;QACxC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ;QACnF,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK;QACjF,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc;QACzF,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC5D,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAA;IACF,OAAO;QACL,MAAM,EAAE,EAAE,GAAG,WAAW,CAAC,oBAAoB,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;gBAChJ,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;gBACvF,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACtE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI;gBAC1E,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc;gBAClE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;aAC3D,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE;QAC5B,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;KACnC,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,UAA6C,EAAE,OAAe,EAAE,OAAgB;IACnG,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AACjH,CAAC"}

package/lib/user-service.d.ts

@@ -0,0 +1,26 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { ProviderLease } from '@agent-network-protocol/anp-identity/provider';
+import type { IdentityReference, PublicIdentity } from './types.js';
+import { AuthorizationEngine } from './authorization.js';
+import type { CapabilitySnapshot, CreateParameters, CreateResult, VerifiedCaller } from './authorization-types.js';
+import type { UserIdentityClient } from './user-client.js';
+export interface UserServiceHost {
+    ensureReady(): Promise<void>;
+    resolveCaller(context: Context): VerifiedCaller;
+    validateCaller(caller: VerifiedCaller): Promise<void>;
+    resolveSnapshot(caller: VerifiedCaller, identity: IdentityReference): Promise<CapabilitySnapshot>;
+    createIdentity(operationId: string, caller: VerifiedCaller, parameters: CreateParameters): Promise<CreateResult>;
+    reconcileCreation(operationId: string, caller: VerifiedCaller, parameters: CreateParameters): Promise<CreateResult | undefined>;
+    withNative<T>(operation: (lease: ProviderLease) => Promise<T>): Promise<T>;
+}
+/** Host boundary. The engine is never exposed on the ordinary client or management Remote. */
+export declare class UserIdentityService {
+    readonly host: UserServiceHost;
+    readonly engine: AuthorizationEngine;
+    readonly ready: Promise<void>;
+    constructor(stateRoot: string, host: UserServiceHost);
+    bind(context: Context): UserIdentityClient;
+    private managed;
+}
+export declare function requestSigningKid(identity: PublicIdentity): string;
+//# sourceMappingURL=user-service.d.ts.map

package/lib/user-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-service.d.ts","sourceRoot":"","sources":["../src/user-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAA;AAClF,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAmB,kBAAkB,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AACnI,OAAO,KAAK,EAAsB,kBAAkB,EAAiB,MAAM,kBAAkB,CAAA;AAK7F,MAAM,WAAW,eAAe;IAC9B,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5B,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,cAAc,CAAA;IAC/C,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrD,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACjG,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAChH,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;IAC/H,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;CAC3E;AAED,8FAA8F;AAC9F,qBAAa,mBAAmB;IAGC,QAAQ,CAAC,IAAI,EAAE,eAAe;IAF7D,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;gBACjB,SAAS,EAAE,MAAM,EAAW,IAAI,EAAE,eAAe;IAM7D,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,kBAAkB;IAuD1C,OAAO,CAAC,OAAO;CAwDhB;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAKlE"}

package/lib/user-service.js

@@ -0,0 +1,140 @@
+import { randomUUID } from 'node:crypto';
+import { AuthorizationEngine } from './authorization.js';
+import { normalizeOperation } from './user-operation.js';
+import { createAuthenticatedHttp } from './http-auth.js';
+import { pluginError } from './errors.js';
+/** Host boundary. The engine is never exposed on the ordinary client or management Remote. */
+export class UserIdentityService {
+    host;
+    engine;
+    ready;
+    constructor(stateRoot, host) {
+        this.host = host;
+        this.engine = new AuthorizationEngine(stateRoot, host);
+        this.ready = this.engine.initialize();
+        void this.ready.catch(() => { });
+    }
+    bind(context) {
+        const source = this.host.resolveCaller(context);
+        const check = async () => {
+            await this.ready;
+            // Provider startup may need the ledger lock; never wait for it inside a transaction.
+            await this.host.ensureReady();
+            const current = this.host.resolveCaller(context);
+            if (current.consumer !== source.consumer)
+                throw pluginError('consumer_forbidden');
+            await this.host.validateCaller(current);
+        };
+        const get = async (id, kind) => {
+            await check();
+            let request = await this.engine.getRequest(source, id);
+            if (request.kind !== kind)
+                throw pluginError('invalid_request');
+            if (request.kind === 'create' && request.status === 'approved'
+                && (request.executionStatus === 'running' || request.executionStatus === 'unknown')) {
+                request = await this.engine.reconcileCreation(id);
+            }
+            return request;
+        };
+        const cancel = async (id, version, kind) => {
+            await get(id, kind);
+            return this.engine.cancel(source, id, version);
+        };
+        return Object.freeze({
+            requestCreateIdentity: async (input) => { await check(); return this.engine.requestCreate(source, input); },
+            getCreateRequest: (id) => get(id, 'create'),
+            cancelCreateRequest: (id, version) => cancel(id, version, 'create'),
+            requestAccess: async (input) => {
+                await check();
+                const normalized = input.operation === undefined ? undefined : await normalizeOperation(input.operation);
+                return this.engine.requestAccess(source, {
+                    requestId: input.requestId, purpose: input.purpose,
+                    ...(input.identity === undefined ? {} : { identity: structuredClone(input.identity) }),
+                    ...(normalized === undefined ? {} : { operation: normalized.frozen }),
+                });
+            },
+            getAccessRequest: (id) => get(id, 'access'),
+            cancelAccessRequest: (id, version) => cancel(id, version, 'access'),
+            openAuthorizedIdentity: async (id) => {
+                await check();
+                return this.managed(source, await this.engine.open(source, id), check);
+            },
+            getExecution: async (id) => { await check(); return this.engine.getExecution(source, id); },
+            subscribeRequestChanges: (listener) => {
+                if (typeof listener !== 'function')
+                    throw pluginError('invalid_request');
+                const dispose = this.engine.subscribeRequestChanges(() => {
+                    void check().then(() => { listener(); }).catch(() => { });
+                });
+                context.effect(() => dispose, 'anp-identity: request notifications');
+                return dispose;
+            },
+        });
+    }
+    managed(source, lease, checkCaller) {
+        const run = async (raw, id, execute) => {
+            await checkCaller();
+            const { frozen, input } = await normalizeOperation(raw);
+            if (id !== undefined && (typeof id !== 'string' || !id || id.length > 256))
+                throw pluginError('invalid_request');
+            if (input.action === 'sign') {
+                await this.host.withNative(async (native) => {
+                    const identity = await native.publicIdentity(lease.identity);
+                    const keys = identity.activeKeys.filter(key => key.algorithm === 'ed25519'
+                        && key.purposes.includes(input.request.purpose)
+                        && (input.request.kid === undefined || key.kid === input.request.kid));
+                    if (keys.length !== 1)
+                        throw pluginError('invalid_request');
+                });
+            }
+            const executionId = id ?? randomUUID();
+            await this.engine.admit(source, lease, frozen, executionId);
+            const assertActive = async () => {
+                await checkCaller();
+                await this.engine.assertExecutionActive(source, lease, executionId);
+            };
+            try {
+                const result = await this.host.withNative(async (native) => {
+                    await assertActive();
+                    return execute(native, input, assertActive);
+                });
+                await this.engine.recordExecution(source, executionId, 'succeeded');
+                return result;
+            }
+            catch (error) {
+                // Once admission is durable; neither transport errors nor lost results refund it.
+                await this.engine.recordExecution(source, executionId, 'unknown').catch(() => { });
+                throw error;
+            }
+        };
+        return Object.freeze({
+            publicIdentity: (executionId) => run({ action: 'read' }, executionId, native => native.publicIdentity(lease.identity)),
+            sign: (request, executionId) => run({ action: 'sign', request }, executionId, (native, operation) => {
+                if (operation.action !== 'sign')
+                    throw pluginError('invalid_request');
+                return native.sign(lease.identity, operation.request);
+            }),
+            authenticatedHttp: Object.freeze({
+                dispatch: async (request, executionId) => {
+                    return run({ action: 'http', request }, executionId, async (native, operation, assertActive) => {
+                        if (operation.action !== 'http')
+                            throw pluginError('invalid_request');
+                        const origins = new Set([new URL(operation.request.url).origin]);
+                        return createAuthenticatedHttp(lease.identity, native, origins, assertActive, async () => {
+                            const identity = await native.publicIdentity(lease.identity);
+                            return requestSigningKid(identity);
+                        }).dispatch(operation.request, outgoing => fetch(outgoing));
+                    });
+                },
+            }),
+        });
+    }
+}
+export function requestSigningKid(identity) {
+    const keys = identity.activeKeys.filter(key => key.algorithm === 'ed25519'
+        && key.purposes.includes('authentication') && key.purposes.includes('application_assertion'));
+    if (keys.length !== 1)
+        throw pluginError('provider_incompatible');
+    return keys[0].kid;
+}
+//# sourceMappingURL=user-service.js.map

package/lib/user-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-service.js","sourceRoot":"","sources":["../src/user-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAIxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAGxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAYzC,8FAA8F;AAC9F,MAAM,OAAO,mBAAmB;IAGU;IAF/B,MAAM,CAAqB;IAC3B,KAAK,CAAe;IAC7B,YAAY,SAAiB,EAAW,IAAqB;QAArB,SAAI,GAAJ,IAAI,CAAiB;QAC3D,IAAI,CAAC,MAAM,GAAG,IAAI,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QACtD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAA;QACrC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACjC,CAAC;IAED,IAAI,CAAC,OAAgB;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;YACvB,MAAM,IAAI,CAAC,KAAK,CAAA;YAChB,qFAAqF;YACrF,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;YAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;YAChD,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;gBAAE,MAAM,WAAW,CAAC,oBAAoB,CAAC,CAAA;YACjF,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;QACzC,CAAC,CAAA;QACD,MAAM,GAAG,GAAG,KAAK,EAAE,EAAU,EAAE,IAAyB,EAAE,EAAE;YAC1D,MAAM,KAAK,EAAE,CAAA;YACb,IAAI,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;YACtD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;gBAAE,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;YAC/D,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;mBACzD,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,EAAE,CAAC;gBACtF,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAA;YACnD,CAAC;YACD,OAAO,OAAO,CAAA;QAChB,CAAC,CAAA;QACD,MAAM,MAAM,GAAG,KAAK,EAAE,EAAU,EAAE,OAAe,EAAE,IAAyB,EAAE,EAAE;YAC9E,MAAM,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;YACnB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;QAChD,CAAC,CAAA;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,qBAAqB,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC;YACxG,gBAAgB,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC;YACnD,mBAAmB,EAAE,CAAC,EAAU,EAAE,OAAe,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC;YACnF,aAAa,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;gBAC3B,MAAM,KAAK,EAAE,CAAA;gBACb,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;gBACxG,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE;oBACvC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;oBAClD,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACtF,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;iBACtE,CAAC,CAAA;YACJ,CAAC;YACD,gBAAgB,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC;YACnD,mBAAmB,EAAE,CAAC,EAAU,EAAE,OAAe,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC;YACnF,sBAAsB,EAAE,KAAK,EAAE,EAAU,EAAE,EAAE;gBAC3C,MAAM,KAAK,EAAE,CAAA;gBACb,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;YACxE,CAAC;YACD,YAAY,EAAE,KAAK,EAAE,EAAU,EAAE,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA,CAAC,CAAC;YAClG,uBAAuB,EAAE,CAAC,QAAoB,EAAE,EAAE;gBAChD,IAAI,OAAO,QAAQ,KAAK,UAAU;oBAAE,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;gBACxE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,GAAG,EAAE;oBACvD,KAAK,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAA,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBACzD,CAAC,CAAC,CAAA;gBACF,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,qCAAqC,CAAC,CAAA;gBACpE,OAAO,OAAO,CAAA;YAChB,CAAC;SAC2B,CAAC,CAAA;IACjC,CAAC;IAEO,OAAO,CAAC,MAAsB,EAAE,KAAsB,EAAE,WAAgC;QAC9F,MAAM,GAAG,GAAG,KAAK,EAAK,GAAkB,EAAE,EAAsB,EAC9D,OAAwG,EAAc,EAAE;YACxH,MAAM,WAAW,EAAE,CAAA;YACnB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAA;YACvD,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,GAAG,CAAC;gBAAE,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;YAChH,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAC,MAAM,EAAC,EAAE;oBACxC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;oBAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS;2BACrE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;2BAC5C,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;oBACxE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;wBAAE,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;gBAC7D,CAAC,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,WAAW,GAAG,EAAE,IAAI,UAAU,EAAE,CAAA;YACtC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,CAAA;YAC3D,MAAM,YAAY,GAAG,KAAK,IAAI,EAAE;gBAC9B,MAAM,WAAW,EAAE,CAAA;gBACnB,MAAM,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,CAAA;YACrE,CAAC,CAAA;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAC,MAAM,EAAC,EAAE;oBACvD,MAAM,YAAY,EAAE,CAAA;oBACpB,OAAO,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;gBAC7C,CAAC,CAAC,CAAA;gBACF,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,CAAA;gBACnE,OAAO,MAAM,CAAA;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,kFAAkF;gBAClF,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBACjF,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC,CAAA;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,cAAc,EAAE,CAAC,WAAoB,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,WAAW,EAC3E,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,EAAE,CAAC,OAAO,EAAE,WAAoB,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,WAAW,EACnF,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE;gBACpB,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM;oBAAE,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;gBACrE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,CAAA;YACvD,CAAC,CAAC;YACJ,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC;gBAC/B,QAAQ,EAAE,KAAK,EAAE,OAAgB,EAAE,WAAoB,EAAE,EAAE;oBACzD,OAAO,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE;wBAC7F,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM;4BAAE,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;wBACrE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;wBAChE,OAAO,uBAAuB,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,IAAI,EAAE;4BACvF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;4BAC5D,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAA;wBACpC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;oBAC7D,CAAC,CAAC,CAAA;gBACJ,CAAC;aACF,CAAC;SAC0B,CAAC,CAAA;IACjC,CAAC;CACF;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAwB;IACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS;WACrE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAA;IAC/F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;IACjE,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC,GAAG,CAAA;AACrB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-network-protocol/dsh-anp-identity",
-  "version": "0.1.2",
+  "version": "0.1.3-rc.2",
   "description": "ANP Identity management plugin for DeepSeek Harness",
   "type": "module",
   "main": "lib/index.js",
@@ -18,6 +18,22 @@
       "types": "./lib/provider-api.d.ts",
       "default": "./lib/provider-api.js"
     },
+    "./user-client": {
+      "types": "./lib/user-client.d.ts",
+      "default": "./lib/user-client.js"
+    },
+    "./client": {
+      "types": "./lib/client/index.d.ts",
+      "default": "./lib/client.js"
+    },
+    "./remote": {
+      "types": "./lib/remote.d.ts",
+      "default": "./lib/remote.js"
+    },
+    "./management-remote": {
+      "types": "./lib/management-remote.d.ts",
+      "default": "./lib/management-remote.js"
+    },
     "./cordis.patch.yml": "./cordis.patch.yml",
     "./package.json": "./package.json"
   },
@@ -27,19 +43,20 @@
     "README.md",
     "README.zh.md",
     "BOUNDARY.md",
+    "V7-MANAGEMENT.md",
     "examples/**",
     "LICENSE"
   ],
   "scripts": {
-    "build": "tsc -p tsconfig.json",
+    "build": "tsc -p tsconfig.json && node scripts/build-client.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json --noEmit",
     "test": "npm run build && vitest run",
-    "test:functional": "node scripts/run-functional-e2e.mjs",
     "update:public": "node scripts/public-snapshot.mjs --update",
     "check:public": "npm run build && node scripts/public-snapshot.mjs",
     "check:generated": "node scripts/check-generated.mjs",
-    "verify": "npm run typecheck && npm run check:public && npm run check:generated && npm test",
-    "prepack": "npm run verify"
+    "verify": "npm run check:public && npm run typecheck && npm run check:generated && npm test",
+    "prepack": "npm run verify",
+    "test:functional": "node scripts/run-functional-e2e.mjs"
   },
   "keywords": [
     "anp",
@@ -61,23 +78,109 @@
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-renderer",
+        "@deepseek-ai/dsh-api-remotes",
+        "@deepseek-ai/dsh-client-connection",
+        "@deepseek-ai/dsh-client-ui-layout",
+        "@deepseek-ai/dsh-client-ui-settings"
+      ],
+      "platform": "web"
     }
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1"
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-api-remotes": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-connection": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-layout": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": "^0.1.5-rc.1",
+    "react": "^18.3.1"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/dsh-typert-protocol": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-renderer": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-api-remotes": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-connection": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-layout": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-settings": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-slots": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-primitives": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    }
   },
   "dependencies": {
-    "@agent-network-protocol/anp-identity": "0.2.2",
     "@deepseek-ai/schemastery": "^3.18.1",
-    "proper-lockfile": "^4.1.2"
+    "proper-lockfile": "^4.1.2",
+    "zod": "^4.6.2",
+    "@agent-network-protocol/anp-identity": "0.2.2"
   },
   "devDependencies": {
     "@agent-network-protocol/anp-identity": "file:../../bindings/node",
-    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/cordis": "4.0.2",
+    "@deepseek-ai/cordis-plugin-loader": "1.0.3",
+    "@deepseek-ai/dsh-api-gateway": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-api-remotes": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-connection": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-store": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-layout": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-typert-registry": "0.1.5-rc.1",
+    "@shikijs/langs": "^4.3.1",
+    "@testing-library/dom": "^10.4.1",
+    "@testing-library/react": "^16.3.3",
     "@types/node": "^24.0.0",
     "@types/proper-lockfile": "^4.1.4",
+    "@types/react": "^18.3.31",
+    "@types/react-dom": "^18.3.7",
+    "anser": "^2.3.5",
+    "clsx": "^2.0.0",
+    "esbuild": "^0.25.12",
+    "jsdom": "^26.1.0",
+    "katex": "^0.16.47",
+    "mdast-util-from-markdown": "^2.0.3",
+    "mdast-util-gfm": "^3.1.0",
+    "mdast-util-math": "^3.0.0",
+    "micromark-core-commonmark": "^2.0.3",
+    "micromark-extension-gfm": "^3.0.0",
+    "micromark-extension-math": "^3.1.0",
+    "micromark-factory-space": "^2.0.1",
+    "micromark-util-character": "^2.1.1",
+    "micromark-util-classify-character": "^2.0.1",
+    "micromark-util-sanitize-uri": "^2.0.1",
+    "micromark-util-symbol": "^2.0.1",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
+    "shiki": "^4.3.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.10",
+    "zod": "^4.6.2"
   },
   "engines": {
     "node": "^22.19.0 || >=24.0.0"