@agent-network-protocol/dsh-anp-identity 0.1.6 → 0.1.8

package/lib/publication-types.js

@@ -0,0 +1,35 @@
+/** Public material state only. Credentials and assertions never enter the catalog. */
+import { z } from 'zod';
+const LegacyPublicJwkSchema = z.object({
+    kty: z.literal('OKP'), crv: z.literal('Ed25519'), x: z.string().regex(/^[A-Za-z0-9_-]{43}$/u),
+    kid: z.string().min(1).max(1024), alg: z.literal('EdDSA'), use: z.literal('sig'),
+}).strict();
+export const EcPublicJwkSchema = z.object({
+    kty: z.literal('EC'), crv: z.literal('P-256'), x: z.string().regex(/^[A-Za-z0-9_-]{43}$/u),
+    y: z.string().regex(/^[A-Za-z0-9_-]{43}$/u), kid: z.string().min(1).max(1024),
+    alg: z.literal('ES256'), use: z.literal('sig'),
+}).strict();
+export const PublicJwkSchema = z.union([LegacyPublicJwkSchema, EcPublicJwkSchema]);
+export const PublicationCapabilitiesSchema = z.object({
+    mcpMachine: z.boolean(), papSession: z.boolean(), papAccount: z.boolean(),
+}).strict().refine(v => (v.mcpMachine || v.papSession) && (!v.papAccount || v.papSession), 'Invalid capability combination');
+/** Derive the server profile from actual enabled capabilities. */
+export function publicationProfile(v) {
+    return [v.mcpMachine ? 'mcp_machine' : '', v.papAccount ? 'pap_account' : v.papSession ? 'pap_session' : ''].filter(Boolean).join('_');
+}
+export const PublicationConfigSchema = z.object({
+    backend: z.string().min(1).max(128), documentId: z.string().regex(/^[A-Za-z0-9_-]{1,128}$/u),
+    clientName: z.string().trim().min(1).max(128), redirectUris: z.array(z.string().max(2048)).max(8),
+    capabilities: PublicationCapabilitiesSchema.optional(), activeKid: z.string().min(1).max(1024).optional(),
+}).strict();
+export const PublicationRecordSchema = z.object({
+    config: PublicationConfigSchema, operationId: z.string().regex(/^[A-Za-z0-9_-]{1,128}$/u),
+    expectedVersion: z.number().int().nonnegative(), state: z.enum(['awaiting_configuration', 'publishing', 'published', 'failed']),
+    clientId: z.string().max(2048), version: z.number().int().nonnegative(),
+    key: PublicJwkSchema,
+    metadata: z.string().max(16384).optional(), jwks: z.string().max(16384).optional(),
+    metadataSha256: z.string().regex(/^[a-f0-9]{64}$/u).optional(),
+    failure: z.enum(['unavailable', 'publication_failed', 'material_mismatch']).optional(),
+}).strict().refine(value => value.state !== 'published' ||
+    (!!value.metadata && !!value.jwks && !!value.metadataSha256 && value.version > 0), 'Incomplete published materials');
+//# sourceMappingURL=publication-types.js.map

package/lib/publication-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publication-types.js","sourceRoot":"","sources":["../src/publication-types.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC;IAC7F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;CACjF,CAAC,CAAC,MAAM,EAAE,CAAA;AACX,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC;IAC1F,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAC7E,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;CAC/C,CAAC,CAAC,MAAM,EAAE,CAAA;AACX,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC,CAAA;AAElF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CAC1E,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,gCAAgC,CAAC,CAAA;AAE5H,kEAAkE;AAClE,MAAM,UAAU,kBAAkB,CAAC,CAA0B;IAC3D,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACxI,CAAC;AAOD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC;IAC5F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjG,YAAY,EAAE,6BAA6B,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC1G,CAAC,CAAC,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,EAAE,uBAAuB,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC;IACzF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,wBAAwB,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC/H,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvE,GAAG,EAAE,eAAe;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IAClF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IAC9D,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvF,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,WAAW;IACrD,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAA"}

package/lib/publication.d.ts

@@ -0,0 +1,21 @@
+import type { IdentityReference } from '@agent-network-protocol/anp-identity';
+import type { ProviderLease } from '@agent-network-protocol/anp-identity/provider';
+import { CatalogStore } from './catalog.js';
+import { type PublicationBackend, type PublicationConfig, type PublicationRecord, type OAuthClientIdentity } from './publication-types.js';
+export declare class PublicationCoordinator {
+    readonly store: CatalogStore;
+    readonly host: {
+        withNative<T>(operation: (native: ProviderLease) => Promise<T>): Promise<T>;
+    };
+    constructor(store: CatalogStore, host: {
+        withNative<T>(operation: (native: ProviderLease) => Promise<T>): Promise<T>;
+    });
+    status(reference: IdentityReference): Promise<OAuthClientIdentity>;
+    requirePublished(reference: IdentityReference): Promise<PublicationRecord>;
+    publish(reference: IdentityReference, raw: PublicationConfig, backend: PublicationBackend, assertActive: () => Promise<void>): Promise<OAuthClientIdentity>;
+    private materials;
+    private readBack;
+    private entry;
+    private save;
+}
+//# sourceMappingURL=publication.d.ts.map

package/lib/publication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publication.d.ts","sourceRoot":"","sources":["../src/publication.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAkB,MAAM,sCAAsC,CAAA;AAC7F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAA;AAClF,OAAO,EAAE,YAAY,EAAgC,MAAM,cAAc,CAAA;AAGzE,OAAO,EACL,KAAK,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,KAAK,mBAAmB,EAC9C,MAAM,wBAAwB,CAAA;AAgBnF,qBAAa,sBAAsB;IACrB,QAAQ,CAAC,KAAK,EAAE,YAAY;IAAE,QAAQ,CAAC,IAAI,EAAE;QACvD,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;KAC5E;gBAFoB,KAAK,EAAE,YAAY,EAAW,IAAI,EAAE;QACvD,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;KAC5E;IAEK,MAAM,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAWlE,gBAAgB,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAY1E,OAAO,CAAC,SAAS,EAAE,iBAAiB,EAAE,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,EAC7F,YAAY,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA0GlE,OAAO,CAAC,SAAS;YAwBH,QAAQ;YAOR,KAAK;YAML,IAAI;CAOnB"}

package/lib/publication.js

@@ -0,0 +1,235 @@
+/** Recoverable Host publication coordinator, sharing the existing identity and catalog. */
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import lockfile from 'proper-lockfile';
+import { CatalogStore, findEntry } from './catalog.js';
+import { pluginError } from './errors.js';
+import { exactHttps, parsePublicJson, publicationRedirectUri } from './publication-http.js';
+import { PublicationConfigSchema, PublicJwkSchema, publicationProfile } from './publication-types.js';
+const sha = (value) => createHash('sha256').update(value).digest('hex');
+function sameKey(left, right) {
+    const result = PublicJwkSchema.safeParse(left);
+    return result.success && Object.keys(result.data).every(key => result.data[key] === right[key]);
+}
+function binding(identity, record) {
+    const services = identity.document.service ?? [];
+    const matches = services.filter(service => service.type === 'ANPCIMD');
+    const service = matches[0];
+    if (matches.length !== 1 || !service || service.serviceEndpoint !== record.clientId
+        || service.anp_metadata_sha256 !== record.metadataSha256
+        || JSON.stringify(service.anp_oauth_keys) !== JSON.stringify([record.key.kid]))
+        throw pluginError('provider_incompatible');
+}
+export class PublicationCoordinator {
+    store;
+    host;
+    constructor(store, host) {
+        this.store = store;
+        this.host = host;
+    }
+    async status(reference) {
+        const entry = await this.entry(reference);
+        const record = entry.publication;
+        if (!record)
+            return { state: 'local', did: reference.did };
+        if (record.state === 'published')
+            await this.requirePublished(reference);
+        return { state: record.state, did: reference.did, clientId: record.clientId,
+            ...(record.metadata ? { jwksUri: parsePublicJson(record.metadata).jwks_uri } : {}),
+            keyId: record.key.kid, algorithm: record.key.alg, version: record.version, signerMode: 'local',
+            ...(record.config.capabilities ? { capabilities: record.config.capabilities } : {}) };
+    }
+    async requirePublished(reference) {
+        const record = (await this.entry(reference)).publication;
+        if (!record || record.state !== 'published' || !record.metadata || sha(record.metadata) !== record.metadataSha256)
+            throw pluginError('provider_unavailable');
+        await this.host.withNative(async (native) => {
+            const identity = await native.publicIdentity(reference);
+            const key = await native.oauthPublicJwk(reference, record.key.kid);
+            if (!sameKey(key, record.key))
+                throw pluginError('provider_incompatible');
+            binding(identity, record);
+        });
+        return structuredClone(record);
+    }
+    async publish(reference, raw, backend, assertActive) {
+        const parsed = PublicationConfigSchema.safeParse(raw);
+        if (!parsed.success)
+            throw pluginError('invalid_request');
+        const config = parsed.data;
+        exactHttps(backend.origin);
+        config.redirectUris.forEach(uri => publicationRedirectUri(uri, config.capabilities));
+        if (new Set(config.redirectUris).size !== config.redirectUris.length)
+            throw pluginError('invalid_request');
+        const clientId = exactHttps(await backend.clientId(config.documentId), true);
+        if (new URL(clientId).origin !== backend.origin)
+            throw pluginError('invalid_request');
+        const lockRoot = join(this.store.stateRoot, 'journal', 'publication', sha(JSON.stringify(reference)));
+        await mkdir(lockRoot, { recursive: true, mode: 0o700 });
+        const release = await lockfile.lock(lockRoot, { realpath: false, stale: 60000, update: 10000,
+            retries: { retries: 50, minTimeout: 20, maxTimeout: 100 } });
+        try {
+            await assertActive();
+            const previous = (await this.entry(reference)).publication;
+            const key = PublicJwkSchema.parse(await this.host.withNative(async (native) => {
+                if (!config.capabilities) {
+                    const identity = await native.publicIdentity(reference);
+                    const candidates = identity.activeKeys.filter(key => key.algorithm === 'ed25519' && key.purposes.includes('authentication') && !key.purposes.includes('device_assertion'));
+                    const selected = config.activeKid ?? previous?.key.kid ?? (candidates.length === 1 ? candidates[0].kid : undefined);
+                    if (!selected)
+                        throw pluginError('provider_incompatible');
+                    return native.oauthPublicJwk(reference, selected);
+                }
+                if (!config.activeKid || !config.activeKid.startsWith(reference.did + '#'))
+                    throw pluginError('invalid_request');
+                try {
+                    return await native.oauthPublicJwk(reference, config.activeKid);
+                }
+                catch { /* An unenrolled selected key must first pass the authorized DID update. */ }
+                const provider = native;
+                if (typeof provider.prepareOAuthKeyChange !== 'function' || typeof provider.exportCandidateOAuthPublicJwk !== 'function')
+                    throw pluginError('provider_incompatible');
+                const identity = await native.publicIdentity(reference);
+                const session = await native.resumeDocumentChange(reference) ?? await provider.prepareOAuthKeyChange(reference, {
+                    fragment: config.activeKid.slice(reference.did.length + 1), operation_id: 'oauth-key-' + sha(config.activeKid).slice(0, 48), expected_revision: identity.revision,
+                });
+                const selected = PublicJwkSchema.parse(await provider.exportCandidateOAuthPublicJwk(reference, config.activeKid));
+                if (selected.alg !== 'ES256' || selected.kid !== config.activeKid)
+                    throw pluginError('provider_incompatible');
+                await assertActive();
+                await backend.publishDocument(reference, session, assertActive);
+                if (await native.resumeDocumentChange(reference))
+                    throw pluginError('provider_unavailable');
+                return native.oauthPublicJwk(reference, config.activeKid);
+            }));
+            if (config.capabilities && (key.alg !== 'ES256' || !config.activeKid || key.kid !== config.activeKid))
+                throw pluginError('provider_incompatible');
+            if (previous && previous.clientId !== clientId)
+                throw pluginError('invalid_request');
+            const same = previous && JSON.stringify(previous.config) === JSON.stringify(config) && sameKey(previous.key, key);
+            if (previous && previous.state !== 'published' && previous.state !== 'awaiting_configuration' && !same)
+                throw pluginError('catalog_conflict');
+            let record = same ? structuredClone(previous) : {
+                config, clientId, key, state: 'publishing', operationId: randomUUID(),
+                expectedVersion: previous?.version ?? 0, version: previous?.version ?? 0,
+            };
+            if (same && record.state === 'published') {
+                try {
+                    await this.readBack(backend, record);
+                }
+                catch {
+                    await this.save(reference, { ...record, state: 'failed', failure: 'material_mismatch' });
+                    throw pluginError('provider_unavailable');
+                }
+                return this.status(reference);
+            }
+            record = { ...record, state: (config.capabilities ? !config.capabilities.papAccount || config.redirectUris.length > 0 : config.redirectUris.length > 0) ? 'publishing' : 'awaiting_configuration' };
+            await this.save(reference, record);
+            if (record.state === 'awaiting_configuration')
+                return this.status(reference);
+            try {
+                await assertActive();
+                const prepared = await backend.prepare(config.documentId, {
+                    operation_id: record.operationId, expected_version: record.expectedVersion,
+                    client_name: config.clientName, redirect_uris: config.redirectUris,
+                    ...(config.capabilities ? { schema_version: 2,
+                        capabilities: { mcp_machine: config.capabilities.mcpMachine, pap_session: config.capabilities.papSession, pap_account: config.capabilities.papAccount },
+                        signing_keys: [key], active_kid: key.kid } : { key: key }),
+                });
+                record = this.materials(record, prepared);
+                await this.save(reference, record);
+                await this.host.withNative(async (native) => {
+                    await assertActive();
+                    const identity = await native.publicIdentity(reference);
+                    let current = false;
+                    try {
+                        binding(identity, record);
+                        current = true;
+                    }
+                    catch { /* Prepare/reconcile below. */ }
+                    const pending = await native.resumeDocumentChange(reference);
+                    if (pending || !current) {
+                        const session = pending ?? await native.prepareDocumentChange(reference, { changes: [{
+                                    change: 'bind_oauth_client', clientId, kid: key.kid, metadataSha256: record.metadataSha256,
+                                }] });
+                        const candidate = await session.candidate();
+                        binding({ ...identity, document: candidate.candidateDocument }, record);
+                        await backend.publishDocument(reference, session, assertActive);
+                        if (await native.resumeDocumentChange(reference))
+                            throw pluginError('provider_unavailable');
+                        binding(await native.publicIdentity(reference), record);
+                    }
+                });
+                await assertActive();
+                const activated = await backend.activate(config.documentId, record.operationId);
+                const accepted = this.materials(record, activated);
+                if (activated.state !== 'published' || accepted.version !== record.version
+                    || accepted.metadata !== record.metadata || accepted.jwks !== record.jwks)
+                    throw pluginError('provider_incompatible');
+                await this.readBack(backend, record);
+                await assertActive();
+                await this.save(reference, { ...record, state: 'published' });
+                return this.status(reference);
+            }
+            catch (error) {
+                await this.save(reference, { ...record, state: 'failed', failure: 'publication_failed' }).catch(() => { });
+                throw pluginError('provider_unavailable');
+            }
+        }
+        finally {
+            await release();
+        }
+    }
+    materials(record, result) {
+        if (!['prepared', 'published'].includes(result.state) || result.client_id !== record.clientId
+            || result.operation_id !== record.operationId || !Number.isSafeInteger(result.version) || result.version <= record.expectedVersion
+            || typeof result.metadata !== 'string' || typeof result.jwks !== 'string'
+            || result.metadata.length > 16384 || result.jwks.length > 16384 || sha(result.metadata) !== result.metadata_sha256)
+            throw pluginError('provider_incompatible');
+        if (record.config.capabilities && (result.schema_version !== 2 || result.profile !== publicationProfile(record.config.capabilities)
+            || result.active_kid !== record.key.kid || result.key_set_digest !== sha(result.jwks)
+            || !result.capabilities || result.capabilities.mcp_machine !== record.config.capabilities.mcpMachine
+            || result.capabilities.pap_session !== record.config.capabilities.papSession || result.capabilities.pap_account !== record.config.capabilities.papAccount))
+            throw pluginError('provider_incompatible');
+        const metadata = parsePublicJson(result.metadata);
+        const jwks = parsePublicJson(result.jwks);
+        if (metadata.client_id !== record.clientId || typeof metadata.jwks_uri !== 'string' || new URL(exactHttps(metadata.jwks_uri, true)).origin !== new URL(record.clientId).origin
+            || metadata.token_endpoint_auth_method !== 'private_key_jwt' || metadata.token_endpoint_auth_signing_alg !== record.key.alg
+            || metadata.client_name !== record.config.clientName || JSON.stringify(metadata.redirect_uris) !== JSON.stringify(record.config.redirectUris)
+            || JSON.stringify(metadata.grant_types) !== JSON.stringify(record.config.capabilities ? [
+                ...(record.config.capabilities.mcpMachine ? ['client_credentials'] : []),
+                ...(record.config.capabilities.papAccount ? ['authorization_code', 'refresh_token'] : []),
+            ] : ['authorization_code']) || JSON.stringify(metadata.response_types) !== JSON.stringify(record.config.capabilities ? (record.config.capabilities.papAccount ? ['code'] : []) : ['code'])
+            || !Array.isArray(jwks.keys) || jwks.keys.length !== 1 || !sameKey(jwks.keys[0], record.key))
+            throw pluginError('provider_incompatible');
+        const allowed = new Set(['client_id', 'jwks_uri', 'client_name', 'redirect_uris', 'grant_types', 'response_types', 'token_endpoint_auth_method', 'token_endpoint_auth_signing_alg']);
+        if (Object.keys(metadata).some(key => !allowed.has(key)) || Object.keys(jwks).some(key => key !== 'keys'))
+            throw pluginError('provider_incompatible');
+        return { ...record, version: result.version, metadata: result.metadata, jwks: result.jwks, metadataSha256: result.metadata_sha256 };
+    }
+    async readBack(backend, record) {
+        const [metadata, jwks] = await Promise.all([
+            backend.readPublic(record.config.documentId, 'client.json', record.clientId),
+            backend.readPublic(record.config.documentId, 'jwks.json', parsePublicJson(record.metadata).jwks_uri),
+        ]);
+        if (metadata !== record.metadata || jwks !== record.jwks || sha(metadata) !== record.metadataSha256)
+            throw pluginError('provider_incompatible');
+    }
+    async entry(reference) {
+        const catalog = await this.store.load().catch(() => { throw pluginError('catalog_corrupt'); });
+        const entry = findEntry(catalog, reference);
+        if (!entry || entry.state !== 'active')
+            throw pluginError('identity_not_found');
+        return entry;
+    }
+    async save(reference, record) {
+        await this.store.mutate(catalog => {
+            const entry = findEntry(catalog, reference);
+            if (!entry || entry.state !== 'active')
+                throw pluginError('identity_not_found');
+            return { ...catalog, entries: catalog.entries.map(item => item === entry ? { ...item, publication: structuredClone(record) } : item) };
+        });
+    }
+}
+//# sourceMappingURL=publication.js.map

package/lib/publication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publication.js","sourceRoot":"","sources":["../src/publication.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,QAAQ,MAAM,iBAAiB,CAAA;AAGtC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAqB,MAAM,cAAc,CAAA;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAC3F,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,kBAAkB,EAEhB,MAAM,wBAAwB,CAAA;AAEnF,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC/E,SAAS,OAAO,CAAC,IAAa,EAAE,KAAqB;IACnD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAC9C,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAA+B,CAAC,KAAM,KAA4C,CAAC,GAAG,CAAC,CAAC,CAAA;AACrK,CAAC;AACD,SAAS,OAAO,CAAC,QAAwB,EAAE,MAAyB;IAClE,MAAM,QAAQ,GAAI,QAAQ,CAAC,QAAyD,CAAC,OAAO,IAAI,EAAE,CAAA;IAClG,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;IACtE,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,QAAQ;WAC9E,OAAO,CAAC,mBAAmB,KAAK,MAAM,CAAC,cAAc;WACrD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;AAC9H,CAAC;AAED,MAAM,OAAO,sBAAsB;IACZ;IAA8B;IAAnD,YAAqB,KAAmB,EAAW,IAElD;QAFoB,UAAK,GAAL,KAAK,CAAc;QAAW,SAAI,GAAJ,IAAI,CAEtD;IAAG,CAAC;IAEL,KAAK,CAAC,MAAM,CAAC,SAA4B;QACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QACzC,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAA;QAChC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAA;QAC1D,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW;YAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAA;QACxE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAA0B,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5G,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO;YAC9F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;IACzF,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,SAA4B;QACjD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAA;QACxD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,cAAc;YAAE,MAAM,WAAW,CAAC,sBAAsB,CAAC,CAAA;QAC5J,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAC,MAAM,EAAC,EAAE;YACxC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAA;YACvD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAClE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC;gBAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;YACzE,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC3B,CAAC,CAAC,CAAA;QACF,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;IAChC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAA4B,EAAE,GAAsB,EAAE,OAA2B,EAC7F,YAAiC;QACjC,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QACrD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;QACzD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAA;QAC1B,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC1B,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAA;QACpF,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,YAAY,CAAC,MAAM;YAAE,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;QAC1G,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAA;QAC5E,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAAE,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;QACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;QACrG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACvD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK;YAC1F,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;QAC9D,IAAI,CAAC;YACH,MAAM,YAAY,EAAE,CAAA;YACpB,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAA;YAC1D,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAC,MAAM,EAAC,EAAE;gBAC1E,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;oBACzB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAA;oBACvD,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAA;oBAC1K,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,IAAI,QAAQ,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;oBACpH,IAAI,CAAC,QAAQ;wBAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;oBACzD,OAAO,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;gBACnD,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,GAAG,GAAG,CAAC;oBAAE,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;gBAChH,IAAI,CAAC;oBAAC,OAAO,MAAM,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;gBAAC,CAAC;gBACvE,MAAM,CAAC,CAAC,2EAA2E,CAAC,CAAC;gBACrF,MAAM,QAAQ,GAAG,MAGhB,CAAA;gBACD,IAAI,OAAO,QAAQ,CAAC,qBAAqB,KAAK,UAAU,IAAI,OAAO,QAAQ,CAAC,6BAA6B,KAAK,UAAU;oBAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;gBACpK,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAA;gBACvD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,IAAI,MAAM,QAAQ,CAAC,qBAAqB,CAAC,SAAS,EAAE;oBAC9G,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,QAAQ;iBAClK,CAAC,CAAA;gBACF,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,6BAA6B,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;gBACjH,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,IAAI,QAAQ,CAAC,GAAG,KAAK,MAAM,CAAC,SAAS;oBAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;gBAC7G,MAAM,YAAY,EAAE,CAAA;gBACpB,MAAM,OAAO,CAAC,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;gBAC/D,IAAI,MAAM,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC;oBAAE,MAAM,WAAW,CAAC,sBAAsB,CAAC,CAAA;gBAC3F,OAAO,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;YAC3D,CAAC,CAAC,CAAC,CAAA;YACH,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,SAAS,CAAC;gBAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;YACjJ,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ;gBAAE,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;YACpF,MAAM,IAAI,GAAG,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YACjH,IAAI,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,WAAW,IAAI,QAAQ,CAAC,KAAK,KAAK,wBAAwB,IAAI,CAAC,IAAI;gBAAE,MAAM,WAAW,CAAC,kBAAkB,CAAC,CAAA;YAC7I,IAAI,MAAM,GAAsB,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACjE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE;gBACrE,eAAe,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC;aACzE,CAAA;YACD,IAAI,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBACzC,IAAI,CAAC;oBAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAAC,CAAC;gBAC5C,MAAM,CAAC;oBACL,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAA;oBACxF,MAAM,WAAW,CAAC,sBAAsB,CAAC,CAAA;gBAC3C,CAAC;gBACD,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC/B,CAAC;YACD,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAA;YACnM,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;YAClC,IAAI,MAAM,CAAC,KAAK,KAAK,wBAAwB;gBAAE,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC5E,IAAI,CAAC;gBACH,MAAM,YAAY,EAAE,CAAA;gBACpB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE;oBACxD,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,MAAM,CAAC,eAAe;oBAC1E,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY;oBAClE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAU;wBACpD,YAAY,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE;wBACvJ,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAoE,EAAE,CAAC;iBAC9H,CAAC,CAAA;gBACF,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;gBACzC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;gBAClC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAC,MAAM,EAAC,EAAE;oBACxC,MAAM,YAAY,EAAE,CAAA;oBACpB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAA;oBACvD,IAAI,OAAO,GAAG,KAAK,CAAA;oBACnB,IAAI,CAAC;wBAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;wBAAC,OAAO,GAAG,IAAI,CAAA;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,8BAA8B,CAAC,CAAC;oBAC1F,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAA;oBAC5D,IAAI,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;wBACxB,MAAM,OAAO,GAAG,OAAO,IAAI,MAAM,MAAM,CAAC,qBAAqB,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC;oCACnF,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,CAAC,cAAe;iCAC5F,CAAC,EAAE,CAAC,CAAA;wBACL,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,CAAA;wBAC3C,OAAO,CAAC,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,iBAAiB,EAAE,EAAE,MAAM,CAAC,CAAA;wBACvE,MAAM,OAAO,CAAC,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;wBAC/D,IAAI,MAAM,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC;4BAAE,MAAM,WAAW,CAAC,sBAAsB,CAAC,CAAA;wBAC3F,OAAO,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAA;oBACzD,CAAC;gBACH,CAAC,CAAC,CAAA;gBACF,MAAM,YAAY,EAAE,CAAA;gBACpB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;gBAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;gBAClD,IAAI,SAAS,CAAC,KAAK,KAAK,WAAW,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;uBACrE,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;oBAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;gBACvH,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBACpC,MAAM,YAAY,EAAE,CAAA;gBACpB,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;gBAC7D,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBACzG,MAAM,WAAW,CAAC,sBAAsB,CAAC,CAAA;YAC3C,CAAC;QACH,CAAC;gBAAS,CAAC;YAAC,MAAM,OAAO,EAAE,CAAA;QAAC,CAAC;IAC/B,CAAC;IAEO,SAAS,CAAC,MAAyB,EAAE,MAA+B;QAC1E,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,QAAQ;eACxF,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,eAAe;eAC/H,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;eACtE,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,eAAe;YAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;QAChK,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;eAC9H,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,cAAc,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;eAClF,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU;eACjG,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,IAAI,MAAM,CAAC,YAAY,CAAC,WAAW,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC;YAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;QACxM,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAA4B,CAAA;QAC5E,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAyB,CAAA;QACjE,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM;eACzK,QAAQ,CAAC,0BAA0B,KAAK,iBAAiB,IAAI,QAAQ,CAAC,+BAA+B,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG;eACxH,QAAQ,CAAC,WAAW,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;eAC1I,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;gBACtF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1F,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;eACvL,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC;YAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;QAC1I,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,iCAAiC,CAAC,CAAC,CAAA;QACpL,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC;YAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;QACrJ,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,eAAgB,EAAE,CAAA;IACtI,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,OAA2B,EAAE,MAAyB;QAC3E,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACzC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC;YAC5E,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,EAAG,eAAe,CAAC,MAAM,CAAC,QAAS,CAA0B,CAAC,QAAQ,CAAC;SAChI,CAAC,CAAA;QACF,IAAI,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,cAAc;YAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,CAAA;IACjJ,CAAC;IACO,KAAK,CAAC,KAAK,CAAC,SAA4B;QAC9C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QAC7F,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAC3C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ;YAAE,MAAM,WAAW,CAAC,oBAAoB,CAAC,CAAA;QAC/E,OAAO,KAAK,CAAA;IACd,CAAC;IACO,KAAK,CAAC,IAAI,CAAC,SAA4B,EAAE,MAAyB;QACxE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;YAChC,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;YAC3C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ;gBAAE,MAAM,WAAW,CAAC,oBAAoB,CAAC,CAAA;YAC/E,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAA;QACxI,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}

package/lib/registration-bootstrap.d.ts

@@ -0,0 +1,56 @@
+/** Private Host orchestration from a real creation approval to verified device publication. */
+import type { Context } from '@deepseek-ai/cordis';
+import type { IdentityReference } from '@agent-network-protocol/anp-identity';
+import type AnpIdentityService from './index.js';
+import type { IdentityManagement } from './management-types.js';
+import { z } from 'zod';
+export declare const RegistrationBootstrapConfigSchema: z.ZodObject<{
+    id: z.ZodString;
+    requestId: z.ZodString;
+    stateRoot: z.ZodString;
+    origin: z.ZodDefault<z.ZodString>;
+    email: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+    phone: z.ZodOptional<z.ZodString>;
+    clientName: z.ZodString;
+    capabilities: z.ZodDefault<z.ZodObject<{
+        mcpMachine: z.ZodBoolean;
+        papSession: z.ZodBoolean;
+        papAccount: z.ZodBoolean;
+    }, z.core.$strict>>;
+    redirectUris: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    managementAudience: z.ZodDefault<z.ZodString>;
+    pollIntervalMs: z.ZodDefault<z.ZodNumber>;
+    providerReadyTimeoutMs: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
+export type RegistrationBootstrapConfig = z.infer<typeof RegistrationBootstrapConfigSchema>;
+export type RegistrationBootstrapInput = z.input<typeof RegistrationBootstrapConfigSchema>;
+export type RegistrationBootstrapPhase = 'awaiting_approval' | 'awaiting_email_verification' | 'awaiting_phone_verification' | 'registering' | 'publishing' | 'published' | 'registration_uncertain' | 'blocked' | 'disposed';
+export type RegistrationBootstrapReason = 'approval_unavailable' | 'approval_denied' | 'invalid_configuration' | 'credential_unavailable' | 'email_unavailable' | 'phone_unavailable' | 'provider_unavailable' | 'publication_failed' | 'client_upgrade_required';
+/** Safe manager/UI projection; no factor, credential, key or remote response is returned. */
+export interface RegistrationBootstrapStatus {
+    id: string;
+    requestId: string;
+    phase: RegistrationBootstrapPhase;
+    origin?: string;
+    clientVersion?: string;
+    reason?: RegistrationBootstrapReason;
+    reference?: IdentityReference;
+    clientId?: string;
+}
+export interface RegistrationBootstrapController {
+    submitOtp(code: string): void;
+    status(): RegistrationBootstrapStatus;
+    dispose(): Promise<void>;
+}
+/** Install the configured manager-owned flow. Its caller supplies the actual management facade and Context.
+ * @param options - Non-secret configuration, actual Host management authority and optional HTTP transport.
+ * @returns A safe status projection and quiescent disposer.
+ */
+export declare function startRegistrationBootstrap(options: {
+    context: Context;
+    service: AnpIdentityService;
+    manager: IdentityManagement;
+    config: RegistrationBootstrapConfig;
+    fetch?: typeof fetch;
+}): RegistrationBootstrapController;
+//# sourceMappingURL=registration-bootstrap.d.ts.map

package/lib/registration-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration-bootstrap.d.ts","sourceRoot":"","sources":["../src/registration-bootstrap.ts"],"names":[],"mappings":"AACA,+FAA+F;AAC/F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAA;AAC7E,OAAO,KAAK,kBAAkB,MAAM,YAAY,CAAA;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAQ/D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAQvB,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;kBAyB5C,CAAA;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAA;AAC3F,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAA;AAC1F,MAAM,MAAM,0BAA0B,GAAG,mBAAmB,GAAG,6BAA6B,GAAG,6BAA6B,GAAG,aAAa,GACxI,YAAY,GAAG,WAAW,GAAG,wBAAwB,GAAG,SAAS,GAAG,UAAU,CAAA;AAClF,MAAM,MAAM,2BAA2B,GAAG,sBAAsB,GAAG,iBAAiB,GAAG,uBAAuB,GAC1G,wBAAwB,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,sBAAsB,GAAG,oBAAoB,GAAG,yBAAyB,CAAA;AACpJ,6FAA6F;AAC7F,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,0BAA0B,CAAA;IACjC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,MAAM,CAAC,EAAE,2BAA2B,CAAA;IACpC,SAAS,CAAC,EAAE,iBAAiB,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AACD,MAAM,WAAW,+BAA+B;IAC9C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,MAAM,IAAI,2BAA2B,CAAA;IACrC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB;AAkCD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAClD,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,kBAAkB,CAAA;IAC3B,OAAO,EAAE,kBAAkB,CAAA;IAC3B,MAAM,EAAE,2BAA2B,CAAA;IACnC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CACrB,GAAG,+BAA+B,CA8RlC"}