@agent-network-protocol/dsh-anp-identity 0.1.6 → 0.1.8

package/lib/protocol-client.d.ts

@@ -0,0 +1,137 @@
+/** Host-only protocol identity leases. These objects never cross Remote or tool APIs. */
+import type { Context } from '@deepseek-ai/cordis';
+import type { IdentityReference } from '@agent-network-protocol/anp-identity';
+import type { PapCallbackManagementOperations } from './pap-callback.js';
+/** Installed PAP Host capability. Callback operations additionally require a current opaque C target. */
+export interface PapHostConsumer {
+    resolveBinding(identityRef: IdentityReference, policyRef: string, profile: 'pap_session' | 'pap_account'): Promise<{
+        binding: {
+            identityRef: IdentityReference;
+            ownerRef: string;
+            clientId: string;
+        };
+        redirectUri?: string;
+    }>;
+    callbackManagementFor(input: {
+        identityRef: IdentityReference;
+        policyRef: string;
+        targetRef: object;
+    }): Promise<PapCallbackManagementOperations & {
+        dispose(): void;
+    }>;
+    assertActive(): Promise<void>;
+    dispose(): void;
+}
+export interface ValidatedTargetEvidence {
+    profile: 'mcp_machine' | 'pap_session' | 'pap_account';
+    issuer: string;
+    resource: string;
+    tokenEndpoint?: string;
+    companyId?: string;
+    allowedEndpoints?: string[];
+    revocationEndpoint?: string;
+    metadataDigest: string;
+    expiresAt: number;
+    sources: {
+        resource: string;
+        authorizationServer: string;
+    };
+}
+/** Explicit Host configuration is the management approval; updates reload and revoke old leases. */
+export interface ProtocolUsePolicy {
+    id: string;
+    version: number;
+    consumer: string;
+    identity: IdentityReference;
+    owner: string;
+    profiles: ValidatedTargetEvidence['profile'][];
+    issuers: string[];
+    resources: string[];
+    publicTargets: boolean;
+    scopes: string[];
+    expiresAt: number;
+}
+export interface ProtocolKeyReference {
+    readonly handle: string;
+    readonly keyRef: object;
+    readonly purpose: 'pap_session' | 'pap_dpop';
+    readonly generation: number;
+    readonly publicJwk: {
+        kty: 'EC';
+        crv: 'P-256';
+        x: string;
+        y: string;
+    };
+    readonly thumbprint: string;
+}
+export interface PapSessionSigningInput {
+    keyRef: object;
+    delegation: string;
+    clientId: string;
+    sid: string;
+    sub: string;
+    agentId?: string;
+    httpMethod: string;
+    httpUri: string;
+    accessToken?: string;
+}
+export interface DpopSigningInput {
+    keyRef: object;
+    httpMethod: string;
+    httpUri: string;
+    accessToken?: string;
+    nonce?: string;
+}
+export interface ProtocolSignerLease {
+    readonly targetRef: object;
+    readonly policyGeneration: number;
+    getOAuthClientIdentity(): Promise<{
+        clientId: string;
+        keyId: string;
+        algorithm: 'ES256';
+        version: number;
+        signerMode: 'local';
+        publicJwk: {
+            kty: 'EC';
+            crv: 'P-256';
+            x: string;
+            y: string;
+        };
+        redirectUris: string[];
+    }>;
+    assertActive(): Promise<void>;
+    signOAuthClientAssertion(targetRef: object): Promise<string>;
+    bindPapScope(input: {
+        userId: string;
+        accountSlot?: string;
+    }): object;
+    restorePapKey(scopeRef: object, input: {
+        handle: string;
+        generation: number;
+        purpose: 'pap_session' | 'pap_dpop';
+    }): Promise<ProtocolKeyReference>;
+    createDelegatedKey(scopeRef: object, operationId: string): Promise<ProtocolKeyReference>;
+    createDpopKey(scopeRef: object, operationId: string): Promise<ProtocolKeyReference>;
+    issuePapDelegation(scopeRef: object, input: {
+        keyRef: object;
+        ttlSeconds: number;
+    }): Promise<string>;
+    signPapSessionRequest(scopeRef: object, input: PapSessionSigningInput): Promise<string>;
+    signDpopProof(scopeRef: object, input: DpopSigningInput): Promise<string>;
+    retireTemporaryKey(scopeRef: object, keyRef: object): Promise<void>;
+    dispose(): void;
+}
+export interface ProtocolIdentityClient {
+    registerValidatedTarget(input: {
+        identityRef: IdentityReference;
+        policyRef: string;
+        discovery: ValidatedTargetEvidence;
+        requestedScopes: string[];
+    }): Promise<ProtocolSignerLease>;
+}
+/** Bind only from the installed discovery adapter's Context. No consumer name is accepted.
+ * @param context - Installed trusted Host adapter context.
+ * @returns Caller-bound protocol client.
+ */
+export declare function bindProtocolIdentityClient(context: Context): ProtocolIdentityClient;
+//# sourceMappingURL=protocol-client.d.ts.map

package/lib/protocol-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-client.d.ts","sourceRoot":"","sources":["../src/protocol-client.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAA;AAC7E,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAA;AAExE,yGAAyG;AACzG,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,WAAW,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,aAAa,GAAG,OAAO,CAAC;QACjH,OAAO,EAAE;YAAE,WAAW,EAAE,iBAAiB,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAA;QAC/E,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,CAAC,CAAA;IACF,qBAAqB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,iBAAiB,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,+BAA+B,GAAG;QAAE,OAAO,IAAI,IAAI,CAAA;KAAE,CAAC,CAAA;IACtK,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7B,OAAO,IAAI,IAAI,CAAA;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,aAAa,GAAG,aAAa,GAAG,aAAa,CAAA;IACtD,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3D;AACD,oGAAoG;AACpG,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAA;IAC9C,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,aAAa,EAAE,OAAO,CAAA;IACtB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AACD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,UAAU,CAAA;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE;QAAE,GAAG,EAAE,IAAI,CAAC;QAAC,GAAG,EAAE,OAAO,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACrE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AACD,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChG,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC1D;AACD,MAAM,WAAW,gBAAgB;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE;AAC/H,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,sBAAsB,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE;YAAE,GAAG,EAAE,IAAI,CAAC;YAAC,GAAG,EAAE,OAAO,CAAC;YAAC,CAAC,EAAE,MAAM,CAAC;YAAC,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;IACtN,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7B,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5D,YAAY,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAA;IACrE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,aAAa,GAAG,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAClJ,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IACxF,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IACnF,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACpG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACvF,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACzE,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,OAAO,IAAI,IAAI,CAAA;CAChB;AACD,MAAM,WAAW,sBAAsB;IACrC,uBAAuB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,iBAAiB,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,uBAAuB,CAAC;QAAC,eAAe,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;CACnL;AACD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,sBAAsB,CAInF"}

package/lib/protocol-client.js

@@ -0,0 +1,11 @@
+/** Bind only from the installed discovery adapter's Context. No consumer name is accepted.
+ * @param context - Installed trusted Host adapter context.
+ * @returns Caller-bound protocol client.
+ */
+export function bindProtocolIdentityClient(context) {
+    const service = context.get('anpIdentity');
+    if (!service || typeof service.bindProtocolConsumer !== 'function')
+        throw new Error('provider_incompatible');
+    return service.bindProtocolConsumer(context);
+}
+//# sourceMappingURL=protocol-client.js.map

package/lib/protocol-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-client.js","sourceRoot":"","sources":["../src/protocol-client.ts"],"names":[],"mappings":"AA0EA;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAgB;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAA8F,CAAA;IACvI,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,oBAAoB,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAC5G,OAAO,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAA;AAC9C,CAAC"}

package/lib/provider-api.d.ts

@@ -1,6 +1,6 @@
 import type { Context } from '@deepseek-ai/cordis';
 import type { UserIdentityClient } from './user-client.js';
-import type { CreateIdentityRequest, IdentityDescriptor, IdentityReference, IdentityTransitionRequest, PublicIdentity, RecoveryReport, StoreInfo } from '@agent-network-protocol/anp-identity';
+import type { OAuthPublicJwk, OAuthClientAssertionRequest, CreateIdentityRequest, IdentityDescriptor, IdentityReference, IdentityTransitionRequest, PublicIdentity, RecoveryReport, StoreInfo } from '@agent-network-protocol/anp-identity';
 import type { DeviceEnrollmentRequest, DocumentProofRequest, ExactHttpSigningRequest, IdentityHostStatus, LegacyDidWbaRequest, ObjectProofRequest, PreparedHttpSignatureAttempt, PreparedIdentityMaterialImport, PreparedRootImport, ProviderCapability, ProviderDocumentChangeSession, ProviderEnrollmentSession, ProviderIdentityTransitionSession, ProviderLease, ProviderLeaseRequest, RequestSigningEnrollmentRequest, RootPromotionRequest, SealedIdentityImportPreparation, SealedKeyAgreementRequest, SealedRootExportRequest, SealedRootImportPreparation, SealedSecretDelivery, SealedSecretEnvelope, WrappedRootEnvelope } from '@agent-network-protocol/anp-identity/provider';
 import type { DocumentChangeOutcome, DocumentChangeRequest, OriginProofRequest, PublicationAttempt, PublicationResult, SignRequest, Signature, SignedOriginProof, VerifiedRemoteDocument, VerifyRequest } from './types.js';
 export type { DeviceEnrollmentRequest, DocumentProofRequest, ExactHttpSigningRequest, IdentityHostStatus, LegacyDidWbaRequest, ObjectProofRequest, PreparedHttpSignatureAttempt, PreparedIdentityMaterialImport, PreparedRootImport, ProviderCapability, ProviderDocumentChangeSession, ProviderEnrollmentSession, ProviderIdentityTransitionSession, ProviderLeaseRequest, RequestSigningEnrollmentRequest, RootPromotionRequest, SealedIdentityImportPreparation, SealedKeyAgreementRequest, SealedRootExportRequest, SealedRootImportPreparation, SealedSecretDelivery, SealedSecretEnvelope, WrappedRootEnvelope, };
@@ -25,7 +25,8 @@ export interface HostProviderLease {
     readonly consumer: string;
     readonly capabilities: readonly ProviderCapability[];
     dispose(): void;
-    info(): Promise<StoreInfo>;
+    /** Version-1 wire fields; backend availability is checked before this projection. */
+    info(): Promise<Pick<StoreInfo, 'storeId' | 'schemaCompatible' | 'identityCount' | 'health'>>;
     recover(): Promise<RecoveryReport>;
     list(): Promise<IdentityDescriptor[]>;
     publicIdentity(reference: IdentityReference): Promise<PublicIdentity>;
@@ -33,6 +34,8 @@ export interface HostProviderLease {
     recoverIdentity(reference: IdentityReference): Promise<void>;
     create(request: CreateIdentityRequest): Promise<PublicIdentity>;
     delete(reference: IdentityReference): Promise<void>;
+    oauthPublicJwk(reference: IdentityReference, kid?: string): Promise<OAuthPublicJwk>;
+    signOAuthClientAssertion(reference: IdentityReference, request: OAuthClientAssertionRequest): Promise<string>;
     sign(reference: IdentityReference, request: SignRequest): Promise<Signature>;
     verify(reference: IdentityReference, request: VerifyRequest): Promise<'valid' | 'invalid'>;
     signOriginProof(reference: IdentityReference, request: OriginProofRequest): Promise<SignedOriginProof>;
@@ -60,6 +63,7 @@ export interface HostProviderLease {
     revokeConsumer(reference: IdentityReference, consumer: string): Promise<void>;
 }
 export interface AnpIdentityService {
+    bindProtocolConsumer(context: Context): import('./protocol-client.js').ProtocolIdentityClient;
     bindUserConsumer(context: Context): UserIdentityClient;
     health(): Promise<import('./types.js').AnpIdentityHealth>;
     acquireClient(input: import('./types.js').ClientRequest): Promise<import('./types.js').IdentityClientLease>;

package/lib/provider-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-api.d.ts","sourceRoot":"","sources":["../src/provider-api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,KAAK,EACV,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,yBAAyB,EACzB,cAAc,EACd,cAAc,EACd,SAAS,EACV,MAAM,sCAAsC,CAAA;AAC7C,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,4BAA4B,EAC5B,8BAA8B,EAC9B,kBAAkB,EAClB,kBAAkB,EAClB,6BAA6B,EAC7B,yBAAyB,EACzB,iCAAiC,EACjC,aAAa,EACb,oBAAoB,EACpB,+BAA+B,EAC/B,oBAAoB,EACpB,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,+CAA+C,CAAA;AACtD,OAAO,KAAK,EACV,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,EACd,MAAM,YAAY,CAAA;AAEnB,YAAY,EACV,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,4BAA4B,EAC5B,8BAA8B,EAC9B,kBAAkB,EAClB,kBAAkB,EAClB,6BAA6B,EAC7B,yBAAyB,EACzB,iCAAiC,EACjC,oBAAoB,EACpB,+BAA+B,EAC/B,oBAAoB,EACpB,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,GACpB,CAAA;AAED,eAAO,MAAM,6BAA6B,EAAG,wBAAiC,CAAA;AAC9E,eAAO,MAAM,8BAA8B,EAAG,4BAAqC,CAAA;AACnF,eAAO,MAAM,qCAAqC,EAAG,8BAAuC,CAAA;AAE5F,MAAM,WAAW,sBAAsB;IACrC,YAAY,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CAAA;CAC3D;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,OAAO,qCAAqC,CAAA;IAC/D,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAA;CAC1C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,YAAY,EAAE,kBAAkB,EAAE,CAAA;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,8BAA8B,CAAA;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACpD,OAAO,IAAI,IAAI,CAAA;IACf,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,CAAA;IAC1B,OAAO,IAAI,OAAO,CAAC,cAAc,CAAC,CAAA;IAClC,IAAI,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAA;IACrC,cAAc,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IACrE,UAAU,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACrE,eAAe,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5D,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IAC/D,MAAM,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnD,IAAI,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IAC5E,MAAM,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;IAC1F,eAAe,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACtG,eAAe,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5F,iBAAiB,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAChG,oBAAoB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAA;IAC7F,mBAAmB,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAChG,qBAAqB,CACnB,SAAS,EAAE,iBAAiB,EAC5B,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,6BAA6B,CAAC,CAAA;IACzC,oBAAoB,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,6BAA6B,GAAG,SAAS,CAAC,CAAA;IACtG,yBAAyB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAAA;IACzG,wBAAwB,CAAC,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC,iCAAiC,GAAG,SAAS,CAAC,CAAA;IAC5G,qBAAqB,CACnB,SAAS,EAAE,iBAAiB,EAC5B,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,WAAW,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC,CAAA;IAC7D,4BAA4B,CAC1B,SAAS,EAAE,iBAAiB,EAC5B,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,WAAW,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC,CAAA;IAC7D,qBAAqB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;IAC3F,6BAA6B,CAAC,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;IAC3G,gBAAgB,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAAA;IAC9F,iBAAiB,CAAC,SAAS,EAAE,iBAAiB,EAAE,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC,CAAA;IAC7G,oBAAoB,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAChG,0BAA0B,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACvG,UAAU,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC7E,mBAAmB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IACpF,uBAAuB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC1F,6BAA6B,CAAC,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAA;IAChH,aAAa,CAAC,SAAS,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5E,cAAc,CAAC,SAAS,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9E;AAED,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,kBAAkB,CAAA;IACtD,MAAM,IAAI,OAAO,CAAC,OAAO,YAAY,EAAE,iBAAiB,CAAC,CAAA;IACzD,aAAa,CAAC,KAAK,EAAE,OAAO,YAAY,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,YAAY,EAAE,mBAAmB,CAAC,CAAA;IAC3G,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,iBAAiB,CAAA;CAC3D;AAED,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACrC,gBAAgB,CAAC,YAAY,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAAG,0BAA0B,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CACtH;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,IAAI,OAAO,CAAC,OAAO,YAAY,EAAE,sBAAsB,CAAC,CAAA;IACjE,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC/C,QAAQ,CAAC,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAA;IAChG,SAAS,CAAC,WAAW,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAA;CAC/E"}
+{"version":3,"file":"provider-api.d.ts","sourceRoot":"","sources":["../src/provider-api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,KAAK,EACV,cAAc,EACd,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,yBAAyB,EACzB,cAAc,EACd,cAAc,EACd,SAAS,EACV,MAAM,sCAAsC,CAAA;AAC7C,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,4BAA4B,EAC5B,8BAA8B,EAC9B,kBAAkB,EAClB,kBAAkB,EAClB,6BAA6B,EAC7B,yBAAyB,EACzB,iCAAiC,EACjC,aAAa,EACb,oBAAoB,EACpB,+BAA+B,EAC/B,oBAAoB,EACpB,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,+CAA+C,CAAA;AACtD,OAAO,KAAK,EACV,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,EACd,MAAM,YAAY,CAAA;AAEnB,YAAY,EACV,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,4BAA4B,EAC5B,8BAA8B,EAC9B,kBAAkB,EAClB,kBAAkB,EAClB,6BAA6B,EAC7B,yBAAyB,EACzB,iCAAiC,EACjC,oBAAoB,EACpB,+BAA+B,EAC/B,oBAAoB,EACpB,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,GACpB,CAAA;AAED,eAAO,MAAM,6BAA6B,EAAG,wBAAiC,CAAA;AAC9E,eAAO,MAAM,8BAA8B,EAAG,4BAAqC,CAAA;AACnF,eAAO,MAAM,qCAAqC,EAAG,8BAAuC,CAAA;AAE5F,MAAM,WAAW,sBAAsB;IACrC,YAAY,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CAAA;CAC3D;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,OAAO,qCAAqC,CAAA;IAC/D,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAA;CAC1C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,YAAY,EAAE,kBAAkB,EAAE,CAAA;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,8BAA8B,CAAA;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACpD,OAAO,IAAI,IAAI,CAAA;IACf,qFAAqF;IACrF,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,kBAAkB,GAAG,eAAe,GAAG,QAAQ,CAAC,CAAC,CAAA;IAC7F,OAAO,IAAI,OAAO,CAAC,cAAc,CAAC,CAAA;IAClC,IAAI,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAA;IACrC,cAAc,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IACrE,UAAU,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACrE,eAAe,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5D,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IAC/D,MAAM,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnD,cAAc,CAAC,SAAS,EAAE,iBAAiB,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IACnF,wBAAwB,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC7G,IAAI,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IAC5E,MAAM,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;IAC1F,eAAe,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACtG,eAAe,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5F,iBAAiB,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAChG,oBAAoB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAA;IAC7F,mBAAmB,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAChG,qBAAqB,CACnB,SAAS,EAAE,iBAAiB,EAC5B,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,6BAA6B,CAAC,CAAA;IACzC,oBAAoB,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,6BAA6B,GAAG,SAAS,CAAC,CAAA;IACtG,yBAAyB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAAA;IACzG,wBAAwB,CAAC,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC,iCAAiC,GAAG,SAAS,CAAC,CAAA;IAC5G,qBAAqB,CACnB,SAAS,EAAE,iBAAiB,EAC5B,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,WAAW,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC,CAAA;IAC7D,4BAA4B,CAC1B,SAAS,EAAE,iBAAiB,EAC5B,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,WAAW,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC,CAAA;IAC7D,qBAAqB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;IAC3F,6BAA6B,CAAC,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;IAC3G,gBAAgB,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAAA;IAC9F,iBAAiB,CAAC,SAAS,EAAE,iBAAiB,EAAE,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC,CAAA;IAC7G,oBAAoB,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAChG,0BAA0B,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACvG,UAAU,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC7E,mBAAmB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IACpF,uBAAuB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC1F,6BAA6B,CAAC,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAA;IAChH,aAAa,CAAC,SAAS,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5E,cAAc,CAAC,SAAS,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9E;AAED,MAAM,WAAW,kBAAkB;IACjC,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,sBAAsB,EAAE,sBAAsB,CAAA;IAC7F,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,kBAAkB,CAAA;IACtD,MAAM,IAAI,OAAO,CAAC,OAAO,YAAY,EAAE,iBAAiB,CAAC,CAAA;IACzD,aAAa,CAAC,KAAK,EAAE,OAAO,YAAY,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,YAAY,EAAE,mBAAmB,CAAC,CAAA;IAC3G,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,iBAAiB,CAAA;CAC3D;AAED,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACrC,gBAAgB,CAAC,YAAY,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAAG,0BAA0B,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CACtH;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,IAAI,OAAO,CAAC,OAAO,YAAY,EAAE,sBAAsB,CAAC,CAAA;IACjE,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC/C,QAAQ,CAAC,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAA;IAChG,SAAS,CAAC,WAAW,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAA;CAC/E"}

package/lib/provider-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-api.js","sourceRoot":"","sources":["../src/provider-api.ts"],"names":[],"mappings":"AA4EA,MAAM,CAAC,MAAM,6BAA6B,GAAG,wBAAiC,CAAA;AAC9E,MAAM,CAAC,MAAM,8BAA8B,GAAG,4BAAqC,CAAA;AACnF,MAAM,CAAC,MAAM,qCAAqC,GAAG,8BAAuC,CAAA"}
+{"version":3,"file":"provider-api.js","sourceRoot":"","sources":["../src/provider-api.ts"],"names":[],"mappings":"AA8EA,MAAM,CAAC,MAAM,6BAA6B,GAAG,wBAAiC,CAAA;AAC9E,MAAM,CAAC,MAAM,8BAA8B,GAAG,4BAAqC,CAAA;AACnF,MAAM,CAAC,MAAM,qCAAqC,GAAG,8BAAuC,CAAA"}

package/lib/publication-http.d.ts

@@ -0,0 +1,19 @@
+/** User Service transport. The Host supplies its existing authenticated management channel. */
+import type { PublicationBackend, PublicationCapabilities } from './publication-types.js';
+export declare function exactHttps(value: string, requirePath?: boolean): string;
+/** Validate a declared callback without changing its bytes. HTTP is restricted to V2 PAP account loopback.
+ * @param value - Exact configured callback URI.
+ * @param capabilities - V2 capabilities; omission preserves the HTTPS-only V1 rule.
+ * @returns The unchanged configured URI.
+ */
+export declare function publicationRedirectUri(value: string, capabilities?: PublicationCapabilities): string;
+export declare function createPublicationBackend(input: {
+    origin: string;
+    /** Credentials stay inside this Host function; outgoing redirects must not be followed. */
+    authenticatedFetch(request: Request): Promise<Response>;
+    publicFetch?: (request: Request) => Promise<Response>;
+    publishDocument: PublicationBackend['publishDocument'];
+}): PublicationBackend;
+/** Reject duplicate JSON members, including escaped aliases, before using metadata. */
+export declare function parsePublicJson(text: string): unknown;
+//# sourceMappingURL=publication-http.d.ts.map

package/lib/publication-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publication-http.d.ts","sourceRoot":"","sources":["../src/publication-http.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,OAAO,KAAK,EAAE,kBAAkB,EAA2B,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAGlH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,UAAQ,GAAG,MAAM,CAUrE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,uBAAuB,GAAG,MAAM,CAQpG;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAA;IACd,2FAA2F;IAC3F,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACvD,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACrD,eAAe,EAAE,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;CACvD,GAAG,kBAAkB,CAyDrB;AAGD,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CA2CrD"}

package/lib/publication-http.js

@@ -0,0 +1,183 @@
+import { pluginError } from './errors.js';
+export function exactHttps(value, requirePath = false) {
+    if (typeof value !== 'string' || !value.startsWith('https://') || value.length > 2048 || /[\s\\\u0000-\u001f\u007f-\uffff]/u.test(value)
+        || /%(?![a-f0-9]{2})/iu.test(value) || value.includes('?') || value.includes('#'))
+        throw pluginError('invalid_request');
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw pluginError('invalid_request');
+    }
+    const authority = value.slice(8).split('/')[0];
+    const path = value.slice(8).split('/').slice(1);
+    if (!authority || authority.includes('@') || !url.hostname || (requirePath && !value.slice(8).includes('/'))
+        || path.some(segment => ['.', '..'].includes(segment.replace(/%2e/giu, '.'))))
+        throw pluginError('invalid_request');
+    return value;
+}
+/** Validate a declared callback without changing its bytes. HTTP is restricted to V2 PAP account loopback.
+ * @param value - Exact configured callback URI.
+ * @param capabilities - V2 capabilities; omission preserves the HTTPS-only V1 rule.
+ * @returns The unchanged configured URI.
+ */
+export function publicationRedirectUri(value, capabilities) {
+    if (capabilities && !capabilities.papAccount)
+        throw pluginError('invalid_request');
+    if (!value.startsWith('http://'))
+        return exactHttps(value, true);
+    if (!capabilities?.papAccount)
+        throw pluginError('invalid_request');
+    exactHttps('https://' + value.slice(7), true);
+    const authority = /^http:\/\/(?:127\.0\.0\.1|\[::1\]):([1-9][0-9]{0,4})\//u.exec(value);
+    if (!authority?.[1] || Number(authority[1]) > 65535)
+        throw pluginError('invalid_request');
+    return value;
+}
+export function createPublicationBackend(input) {
+    const origin = exactHttps(input.origin);
+    if (new URL(origin).origin !== origin)
+        throw pluginError('invalid_request');
+    const base = (id) => {
+        if (!/^[A-Za-z0-9_-]{1,128}$/u.test(id))
+            throw pluginError('invalid_request');
+        return `${origin}/user-service/v1/agent-clients/${id}`;
+    };
+    const body = async (response) => {
+        if (response.status !== 200 || response.redirected
+            || !(response.headers.get('content-type') ?? '').toLowerCase().startsWith('application/json')) {
+            await response.body?.cancel().catch(() => { });
+            throw pluginError('provider_unavailable');
+        }
+        const reader = response.body?.getReader();
+        const chunks = [];
+        let length = 0;
+        try {
+            while (reader) {
+                const result = await reader.read();
+                if (result.done)
+                    break;
+                length += result.value.byteLength;
+                if (length > 32768)
+                    throw pluginError('provider_incompatible');
+                chunks.push(result.value);
+            }
+            return new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks));
+        }
+        finally {
+            await reader?.cancel().catch(() => { });
+            reader?.releaseLock();
+        }
+    };
+    const command = async (id, action, value) => {
+        try {
+            const response = await input.authenticatedFetch(new Request(`${base(id)}/${action}`, {
+                method: 'POST', headers: { 'content-type': 'application/json' },
+                body: JSON.stringify(value), redirect: 'manual', signal: AbortSignal.timeout(15000),
+            }));
+            return parsePublicJson(await body(response));
+        }
+        catch {
+            throw pluginError('provider_unavailable');
+        }
+    };
+    return Object.freeze({
+        origin, clientId: async (id) => {
+            const response = await input.authenticatedFetch(new Request(`${base(id)}/status`, {
+                redirect: 'manual', signal: AbortSignal.timeout(15000),
+            }));
+            const status = parsePublicJson(await body(response));
+            if (typeof status.client_id !== 'string' || new URL(exactHttps(status.client_id, true)).origin !== origin)
+                throw pluginError('provider_incompatible');
+            return status.client_id;
+        },
+        prepare: (id, value) => command(id, 'prepare', value),
+        activate: (id, operationId) => command(id, 'activate', { operation_id: operationId }),
+        readPublic: async (id, part, url) => {
+            try {
+                if (!url || new URL(exactHttps(url, true)).origin !== origin)
+                    throw pluginError('provider_incompatible');
+                return await body(await (input.publicFetch ?? fetch)(new Request(url, {
+                    redirect: 'manual', signal: AbortSignal.timeout(15000),
+                })));
+            }
+            catch {
+                throw pluginError('provider_unavailable');
+            }
+        },
+        publishDocument: input.publishDocument,
+    });
+}
+/** Reject duplicate JSON members, including escaped aliases, before using metadata. */
+export function parsePublicJson(text) {
+    if (text.length > 32768)
+        throw pluginError('provider_incompatible');
+    let result;
+    try {
+        result = JSON.parse(text);
+    }
+    catch {
+        throw pluginError('provider_incompatible');
+    }
+    let index = 0;
+    const whitespace = () => { while (/\s/u.test(text[index] ?? '') && index < text.length)
+        index++; };
+    const string = () => {
+        const start = index++;
+        while (index < text.length) {
+            const c = text[index++];
+            if (c === '\\')
+                index++;
+            else if (c === '"')
+                return JSON.parse(text.slice(start, index));
+        }
+        throw pluginError('provider_incompatible');
+    };
+    const visit = (depth) => {
+        if (depth > 32)
+            throw pluginError('provider_incompatible');
+        whitespace();
+        if (text[index] === '{') {
+            index++;
+            whitespace();
+            const keys = new Set();
+            while (text[index] !== '}') {
+                const key = string();
+                if (keys.has(key))
+                    throw pluginError('provider_incompatible');
+                keys.add(key);
+                whitespace();
+                index++;
+                visit(depth + 1);
+                whitespace();
+                if (text[index] !== ',')
+                    break;
+                index++;
+                whitespace();
+            }
+            index++;
+        }
+        else if (text[index] === '[') {
+            index++;
+            whitespace();
+            while (text[index] !== ']') {
+                visit(depth + 1);
+                whitespace();
+                if (text[index] !== ',')
+                    break;
+                index++;
+                whitespace();
+            }
+            index++;
+        }
+        else if (text[index] === '"')
+            string();
+        else
+            while (index < text.length && !/[\s,}\]]/u.test(text[index]))
+                index++;
+    };
+    visit(0);
+    return result;
+}
+//# sourceMappingURL=publication-http.js.map

package/lib/publication-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publication-http.js","sourceRoot":"","sources":["../src/publication-http.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,WAAW,GAAG,KAAK;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,IAAI,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC;WACnI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;IACzH,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;IAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC/C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;WACvG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAAE,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;IACrH,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,YAAsC;IAC1F,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,UAAU;QAAE,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;IAClF,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAChE,IAAI,CAAC,YAAY,EAAE,UAAU;QAAE,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;IACnE,UAAU,CAAC,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IAC7C,MAAM,SAAS,GAAG,yDAAyD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvF,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK;QAAE,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;IACzF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAMxC;IACC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACvC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;IAC3E,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,EAAE;QAC1B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;QAC7E,OAAO,GAAG,MAAM,kCAAkC,EAAE,EAAE,CAAA;IACxD,CAAC,CAAA;IACD,MAAM,IAAI,GAAG,KAAK,EAAE,QAAkB,EAAmB,EAAE;QACzD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,UAAU;eAC7C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAChG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAC7C,MAAM,WAAW,CAAC,sBAAsB,CAAC,CAAA;QAC3C,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAA;QACzC,MAAM,MAAM,GAAiB,EAAE,CAAA;QAC/B,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC;gBACd,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;gBAClC,IAAI,MAAM,CAAC,IAAI;oBAAE,MAAK;gBACtB,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAA;gBACjC,IAAI,MAAM,GAAG,KAAK;oBAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;gBAC9D,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAC3B,CAAC;YACD,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QAChF,CAAC;gBAAS,CAAC;YAAC,MAAM,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAAC,MAAM,EAAE,WAAW,EAAE,CAAA;QAAC,CAAC;IAC7E,CAAC,CAAA;IACD,MAAM,OAAO,GAAG,KAAK,EAAE,EAAU,EAAE,MAAc,EAAE,KAAc,EAAoC,EAAE;QACrG,IAAI,CAAC;YACL,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,EAAE;gBACnF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;aACpF,CAAC,CAAC,CAAA;YACH,OAAO,eAAe,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAA4B,CAAA;QACvE,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,WAAW,CAAC,sBAAsB,CAAC,CAAA;QAAC,CAAC;IACvD,CAAC,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAU,EAAE,EAAE;YACrC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE;gBAChF,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;aACvD,CAAC,CAAC,CAAA;YACH,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAA4B,CAAA;YAC/E,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM;gBAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;YACrJ,OAAO,MAAM,CAAC,SAAS,CAAA;QACzB,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC;QACrD,QAAQ,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;QACrF,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAClC,IAAI,CAAC;gBACH,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM;oBAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;gBACxG,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE;oBACpE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;iBACvD,CAAC,CAAC,CAAC,CAAA;YACN,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,WAAW,CAAC,sBAAsB,CAAC,CAAA;YAAC,CAAC;QACvD,CAAC;QACD,eAAe,EAAE,KAAK,CAAC,eAAe;KACV,CAAC,CAAA;AACjC,CAAC;AAGD,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK;QAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;IACnE,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;IAAC,CAAC;IACtF,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,MAAM,UAAU,GAAG,GAAG,EAAE,GAAG,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM;QAAE,KAAK,EAAE,CAAA,CAAC,CAAC,CAAA;IACjG,MAAM,MAAM,GAAG,GAAW,EAAE;QAC1B,MAAM,KAAK,GAAG,KAAK,EAAE,CAAA;QACrB,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;YACvB,IAAI,CAAC,KAAK,IAAI;gBAAE,KAAK,EAAE,CAAA;iBAClB,IAAI,CAAC,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAW,CAAA;QAC3E,CAAC;QACD,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;IAC5C,CAAC,CAAA;IACD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAQ,EAAE;QACpC,IAAI,KAAK,GAAG,EAAE;YAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;QAC1D,UAAU,EAAE,CAAA;QACZ,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACxB,KAAK,EAAE,CAAC;YAAC,UAAU,EAAE,CAAA;YACrB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;YAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;gBACpB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;gBAC7D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAAC,UAAU,EAAE,CAAC;gBAAC,KAAK,EAAE,CAAA;gBACpC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAAC,UAAU,EAAE,CAAA;gBAC9B,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG;oBAAE,MAAK;gBAC9B,KAAK,EAAE,CAAC;gBAAC,UAAU,EAAE,CAAA;YACvB,CAAC;YACD,KAAK,EAAE,CAAA;QACT,CAAC;aAAM,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YAC/B,KAAK,EAAE,CAAC;YAAC,UAAU,EAAE,CAAA;YACrB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC3B,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAAC,UAAU,EAAE,CAAA;gBAC9B,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG;oBAAE,MAAK;gBAC9B,KAAK,EAAE,CAAC;gBAAC,UAAU,EAAE,CAAA;YACvB,CAAC;YACD,KAAK,EAAE,CAAA;QACT,CAAC;aAAM,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG;YAAE,MAAM,EAAE,CAAA;;YACnC,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAE,CAAC;gBAAE,KAAK,EAAE,CAAA;IAC7E,CAAC,CAAA;IACD,KAAK,CAAC,CAAC,CAAC,CAAA;IACR,OAAO,MAAM,CAAA;AACf,CAAC"}

package/lib/publication-types.d.ts

@@ -0,0 +1,161 @@
+/** Public material state only. Credentials and assertions never enter the catalog. */
+import { z } from 'zod';
+import type { IdentityReference, OAuthPublicJwk } from '@agent-network-protocol/anp-identity';
+import type { ProviderDocumentChangeSession } from '@agent-network-protocol/anp-identity/provider';
+export declare const EcPublicJwkSchema: z.ZodObject<{
+    kty: z.ZodLiteral<"EC">;
+    crv: z.ZodLiteral<"P-256">;
+    x: z.ZodString;
+    y: z.ZodString;
+    kid: z.ZodString;
+    alg: z.ZodLiteral<"ES256">;
+    use: z.ZodLiteral<"sig">;
+}, z.core.$strict>;
+export declare const PublicJwkSchema: z.ZodUnion<readonly [z.ZodObject<{
+    kty: z.ZodLiteral<"OKP">;
+    crv: z.ZodLiteral<"Ed25519">;
+    x: z.ZodString;
+    kid: z.ZodString;
+    alg: z.ZodLiteral<"EdDSA">;
+    use: z.ZodLiteral<"sig">;
+}, z.core.$strict>, z.ZodObject<{
+    kty: z.ZodLiteral<"EC">;
+    crv: z.ZodLiteral<"P-256">;
+    x: z.ZodString;
+    y: z.ZodString;
+    kid: z.ZodString;
+    alg: z.ZodLiteral<"ES256">;
+    use: z.ZodLiteral<"sig">;
+}, z.core.$strict>]>;
+export type PublicationJwk = z.infer<typeof PublicJwkSchema>;
+export declare const PublicationCapabilitiesSchema: z.ZodObject<{
+    mcpMachine: z.ZodBoolean;
+    papSession: z.ZodBoolean;
+    papAccount: z.ZodBoolean;
+}, z.core.$strict>;
+export type PublicationCapabilities = z.infer<typeof PublicationCapabilitiesSchema>;
+/** Derive the server profile from actual enabled capabilities. */
+export declare function publicationProfile(v: PublicationCapabilities): string;
+/** The management wire representation is exclusively snake_case. */
+export interface PublicationIntentV2 {
+    schema_version: 2;
+    operation_id: string;
+    expected_version: number;
+    client_name: string;
+    capabilities: {
+        mcp_machine: boolean;
+        pap_session: boolean;
+        pap_account: boolean;
+    };
+    signing_keys: PublicationJwk[];
+    active_kid: string;
+    redirect_uris: string[];
+}
+export declare const PublicationConfigSchema: z.ZodObject<{
+    backend: z.ZodString;
+    documentId: z.ZodString;
+    clientName: z.ZodString;
+    redirectUris: z.ZodArray<z.ZodString>;
+    capabilities: z.ZodOptional<z.ZodObject<{
+        mcpMachine: z.ZodBoolean;
+        papSession: z.ZodBoolean;
+        papAccount: z.ZodBoolean;
+    }, z.core.$strict>>;
+    activeKid: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type PublicationConfig = z.infer<typeof PublicationConfigSchema>;
+export declare const PublicationRecordSchema: z.ZodObject<{
+    config: z.ZodObject<{
+        backend: z.ZodString;
+        documentId: z.ZodString;
+        clientName: z.ZodString;
+        redirectUris: z.ZodArray<z.ZodString>;
+        capabilities: z.ZodOptional<z.ZodObject<{
+            mcpMachine: z.ZodBoolean;
+            papSession: z.ZodBoolean;
+            papAccount: z.ZodBoolean;
+        }, z.core.$strict>>;
+        activeKid: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    operationId: z.ZodString;
+    expectedVersion: z.ZodNumber;
+    state: z.ZodEnum<{
+        failed: "failed";
+        awaiting_configuration: "awaiting_configuration";
+        publishing: "publishing";
+        published: "published";
+    }>;
+    clientId: z.ZodString;
+    version: z.ZodNumber;
+    key: z.ZodUnion<readonly [z.ZodObject<{
+        kty: z.ZodLiteral<"OKP">;
+        crv: z.ZodLiteral<"Ed25519">;
+        x: z.ZodString;
+        kid: z.ZodString;
+        alg: z.ZodLiteral<"EdDSA">;
+        use: z.ZodLiteral<"sig">;
+    }, z.core.$strict>, z.ZodObject<{
+        kty: z.ZodLiteral<"EC">;
+        crv: z.ZodLiteral<"P-256">;
+        x: z.ZodString;
+        y: z.ZodString;
+        kid: z.ZodString;
+        alg: z.ZodLiteral<"ES256">;
+        use: z.ZodLiteral<"sig">;
+    }, z.core.$strict>]>;
+    metadata: z.ZodOptional<z.ZodString>;
+    jwks: z.ZodOptional<z.ZodString>;
+    metadataSha256: z.ZodOptional<z.ZodString>;
+    failure: z.ZodOptional<z.ZodEnum<{
+        unavailable: "unavailable";
+        publication_failed: "publication_failed";
+        material_mismatch: "material_mismatch";
+    }>>;
+}, z.core.$strict>;
+export type PublicationRecord = z.infer<typeof PublicationRecordSchema>;
+export interface OAuthClientIdentity {
+    readonly state: 'local' | 'awaiting_configuration' | 'publishing' | 'published' | 'failed';
+    readonly did: string;
+    readonly clientId?: string;
+    readonly jwksUri?: string;
+    readonly keyId?: string;
+    readonly algorithm?: 'EdDSA' | 'ES256';
+    readonly signerMode?: 'local';
+    readonly capabilities?: PublicationCapabilities;
+    readonly version?: number;
+}
+export interface PreparedClientMaterials {
+    readonly schema_version?: 2;
+    readonly profile?: string;
+    readonly capabilities?: {
+        mcp_machine: boolean;
+        pap_session: boolean;
+        pap_account: boolean;
+    };
+    readonly active_kid?: string;
+    readonly key_set_digest?: string;
+    readonly state: 'awaiting_configuration' | 'prepared' | 'published';
+    readonly client_id: string;
+    readonly version: number;
+    readonly operation_id?: string;
+    readonly metadata_sha256?: string;
+    readonly metadata?: string;
+    readonly jwks?: string;
+}
+/** Installed by a trusted Host, not consumer request input. */
+export interface PublicationBackend {
+    readonly origin: string;
+    clientId(documentId: string): string | Promise<string>;
+    prepare(documentId: string, input: {
+        operation_id: string;
+        expected_version: number;
+        client_name: string;
+        key: OAuthPublicJwk;
+        redirect_uris: string[];
+    } | PublicationIntentV2): Promise<PreparedClientMaterials>;
+    activate(documentId: string, operationId: string): Promise<PreparedClientMaterials>;
+    readPublic(documentId: string, part: 'client.json' | 'jwks.json', url?: string): Promise<string>;
+    /** Drive the existing authorized document-update/reconcile workflow. No unchecked document PUT. */
+    publishDocument(reference: IdentityReference, session: ProviderDocumentChangeSession, assertActive: () => Promise<void>): Promise<void>;
+}
+//# sourceMappingURL=publication-types.d.ts.map

package/lib/publication-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publication-types.d.ts","sourceRoot":"","sources":["../src/publication-types.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAC7F,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAA;AAMlG,eAAO,MAAM,iBAAiB;;;;;;;;kBAInB,CAAA;AACX,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;oBAAsD,CAAA;AAClF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAC5D,eAAO,MAAM,6BAA6B;;;;kBAEkF,CAAA;AAC5H,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAA;AACnF,kEAAkE;AAClE,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,uBAAuB,GAAG,MAAM,CAErE;AACD,oEAAoE;AACpE,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,CAAC,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;IACtF,YAAY,EAAE;QAAE,WAAW,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAA;IAClF,YAAY,EAAE,cAAc,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,EAAE,CAAA;CAC5E;AACD,eAAO,MAAM,uBAAuB;;;;;;;;;;;kBAIzB,CAAA;AACX,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AACvE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBASkF,CAAA;AACtH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AACvE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,GAAG,YAAY,GAAG,WAAW,GAAG,QAAQ,CAAA;IAC1F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAA;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AACD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,WAAW,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAA;IAC5F,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,GAAG,UAAU,GAAG,WAAW,CAAA;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AACD,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACtD,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE;QACjC,YAAY,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,cAAc,CAAC;QAAC,aAAa,EAAE,MAAM,EAAE,CAAA;KAClH,GAAG,mBAAmB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;IAC1D,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;IACnF,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAChG,mGAAmG;IACnG,eAAe,CAAC,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,6BAA6B,EAClF,YAAY,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpD"}