@agent-network-protocol/dsh-anp-identity 0.1.6 → 0.1.8

package/lib/registration-service-settings.js

@@ -0,0 +1,124 @@
+import { mkdir, lstat, readFile, open, rename, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import lockfile from 'proper-lockfile';
+import { z } from 'zod';
+import { syncDirectory } from './sync-directory.js';
+import { DEFAULT_REGISTRATION_ORIGIN } from './registration-service-types.js';
+export function registrationOrigin(value) {
+    try {
+        if (value.length > 2048)
+            throw new Error();
+        const url = new URL(value.trim());
+        if (url.hostname.length > 253 || url.protocol !== 'https:' || url.username || url.password || url.search || url.hash || url.pathname !== '/')
+            throw new Error();
+        return url.origin;
+    }
+    catch {
+        throw new Error('registration_service_invalid_origin');
+    }
+}
+const document = z.object({
+    schema: z.literal(1), version: z.number().int().nonnegative(),
+    origin: z.string().refine(value => { try {
+        return registrationOrigin(value) === value;
+    }
+    catch {
+        return false;
+    } }),
+    flows: z.record(z.string().regex(/^[a-f0-9]{64}$/u), z.object({
+        fingerprint: z.string().regex(/^[a-f0-9]{64}$/u), origin: z.string(),
+    }).strict()),
+}).strict();
+const initial = () => ({ schema: 1, version: 0, origin: DEFAULT_REGISTRATION_ORIGIN, flows: {} });
+/** Host-owned preferences and immutable per-flow origin pins, never credentials. */
+export class RegistrationServiceSettingsStore {
+    root;
+    constructor(stateRoot) { this.root = join(stateRoot, 'manager-settings'); }
+    async transaction(assertActive, operation) {
+        assertActive();
+        await mkdir(this.root, { recursive: true, mode: 0o700 });
+        const info = await lstat(this.root);
+        if (!info.isDirectory() || info.isSymbolicLink() || (process.platform !== 'win32' && Boolean(info.mode & 0o077)) ||
+            typeof process.getuid === 'function' && info.uid !== process.getuid())
+            throw new Error('registration_service_settings_unavailable');
+        const release = await lockfile.lock(this.root, { realpath: true, retries: { retries: 80, minTimeout: 10, maxTimeout: 100 } });
+        try {
+            assertActive();
+            const path = join(this.root, 'registration.json');
+            let state = initial();
+            try {
+                const stat = await lstat(path);
+                if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 131072 || (process.platform !== 'win32' && Boolean(stat.mode & 0o077)) ||
+                    typeof process.getuid === 'function' && stat.uid !== process.getuid())
+                    throw new Error('registration_service_settings_unavailable');
+                state = document.parse(JSON.parse(await readFile(path, 'utf8')));
+                for (const pin of Object.values(state.flows))
+                    if (registrationOrigin(pin.origin) !== pin.origin)
+                        throw new Error();
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw new Error('registration_service_settings_unavailable');
+            }
+            assertActive();
+            const result = operation(state);
+            if (result.changed) {
+                state.version++;
+                const temp = join(this.root, '.' + randomUUID() + '.tmp');
+                try {
+                    const file = await open(temp, 'wx', 0o600);
+                    try {
+                        await file.writeFile(JSON.stringify(state) + '\n');
+                        await file.sync();
+                    }
+                    finally {
+                        await file.close();
+                    }
+                    assertActive();
+                    await rename(temp, path);
+                    await syncDirectory(this.root);
+                }
+                finally {
+                    await rm(temp, { force: true });
+                }
+            }
+            assertActive();
+            return structuredClone(result.value);
+        }
+        finally {
+            await release();
+        }
+    }
+    read(assertActive) {
+        return this.transaction(assertActive, state => ({ value: { origin: state.origin, version: state.version }, changed: false }));
+    }
+    update(input, assertActive) {
+        const origin = registrationOrigin(input.origin);
+        if (!Number.isSafeInteger(input.expectedVersion) || input.expectedVersion < 0)
+            throw new Error('registration_service_invalid_version');
+        return this.transaction(assertActive, state => {
+            if (state.version !== input.expectedVersion)
+                throw new Error('registration_service_conflict');
+            state.origin = origin;
+            return { value: { origin, version: state.version + 1 }, changed: true };
+        });
+    }
+    pin(key, fingerprint, assertActive) {
+        if (![key, fingerprint].every(value => /^[a-f0-9]{64}$/u.test(value)))
+            throw new Error('registration_service_invalid_flow');
+        return this.transaction(assertActive, state => {
+            const pin = state.flows[key];
+            if (pin) {
+                if (pin.fingerprint !== fingerprint)
+                    throw new Error('registration_service_flow_conflict');
+                return { value: pin.origin, changed: false };
+            }
+            if (Object.keys(state.flows).length >= 256)
+                throw new Error('registration_service_settings_unavailable');
+            state.flows[key] = { origin: state.origin, fingerprint };
+            return { value: state.origin, changed: true };
+        });
+    }
+}
+//# sourceMappingURL=registration-service-settings.js.map

package/lib/registration-service-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration-service-settings.js","sourceRoot":"","sources":["../src/registration-service-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,QAAQ,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAA4E,MAAM,iCAAiC,CAAC;AAExJ,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAClC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAChK,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAAC,CAAC;AACrE,CAAC;AACD,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,kBAAkB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC;IACnH,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;QAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACrE,CAAC,CAAC,MAAM,EAAE,CAAC;CACb,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,OAAO,GAAG,GAAa,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;AAE5G,oFAAoF;AACpF,MAAM,OAAO,gCAAgC;IAC1B,IAAI,CAAS;IAC9B,YAAY,SAAiB,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAC3E,KAAK,CAAC,WAAW,CAAI,YAAwB,EAAE,SAA8D;QACnH,YAAY,EAAE,CAAC;QACf,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;YAC9G,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACtI,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC9H,IAAI,CAAC;YACH,YAAY,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAClD,IAAI,KAAK,GAAG,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;oBAC/H,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;gBACtI,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;gBACjE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;oBAAE,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,MAAM;wBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACrH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACvH,CAAC;YACD,YAAY,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,KAAK,CAAC,OAAO,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC,CAAC;gBAC1D,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;oBAC3C,IAAI,CAAC;wBAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;wBAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;oBAAC,CAAC;4BAAS,CAAC;wBAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;oBAAC,CAAC;oBAC9G,YAAY,EAAE,CAAC;oBAAC,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBAAC,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3E,CAAC;wBAAS,CAAC;oBAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAAC,CAAC;YAChD,CAAC;YACD,YAAY,EAAE,CAAC;YACf,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;gBAAS,CAAC;YAAC,MAAM,OAAO,EAAE,CAAC;QAAC,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,YAAwB;QAC3B,OAAO,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAChI,CAAC;IACD,MAAM,CAAC,KAAwC,EAAE,YAAwB;QACvE,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,eAAe,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACvI,OAAO,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE;YAC5C,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,eAAe;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAC9F,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;YACtB,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC;IACD,GAAG,CAAC,GAAW,EAAE,WAAmB,EAAE,YAAwB;QAC5D,IAAI,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC5H,OAAO,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE;YAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBAC3F,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC/C,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACzG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;YACzD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/lib/registration-service-types.d.ts

@@ -0,0 +1,11 @@
+/** Default for new registrations only; existing identities retain their own origin. */
+export declare const DEFAULT_REGISTRATION_ORIGIN = "https://awiki.me";
+export interface RegistrationServiceSettings {
+    readonly origin: string;
+    readonly version: number;
+}
+export interface UpdateRegistrationServiceSettings {
+    readonly origin: string;
+    readonly expectedVersion: number;
+}
+//# sourceMappingURL=registration-service-types.d.ts.map

package/lib/registration-service-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration-service-types.d.ts","sourceRoot":"","sources":["../src/registration-service-types.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,eAAO,MAAM,2BAA2B,qBAAqB,CAAC;AAC9D,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AACD,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC"}

package/lib/registration-service-types.js

@@ -0,0 +1,3 @@
+/** Default for new registrations only; existing identities retain their own origin. */
+export const DEFAULT_REGISTRATION_ORIGIN = 'https://awiki.me';
+//# sourceMappingURL=registration-service-types.js.map

package/lib/registration-service-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration-service-types.js","sourceRoot":"","sources":["../src/registration-service-types.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,MAAM,CAAC,MAAM,2BAA2B,GAAG,kBAAkB,CAAC"}

package/lib/remote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../src/remote.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAyDjF,QAAA,MAAM,YAAY,EAAE,wBA8BnB,CAAC;AACF,eAAe,YAAY,CAAC"}
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../src/remote.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAiEjF,QAAA,MAAM,YAAY,EAAE,wBA8BnB,CAAC;AACF,eAAe,YAAY,CAAC"}

package/lib/remote.js

@@ -1,3 +1,4 @@
+import { PublicationConfigSchema } from './publication-types.js';
 /** Explicit browser-safe Typert method contract for the optional manager. */
 import { z } from "zod";
 const reference = z
@@ -24,12 +25,17 @@ const decision = version
         capabilities: z.array(z.enum(["identity:read", "identity:sign", "identity:http-auth"])),
         signingPurposes: z.array(z.string()),
         httpOrigins: z.array(z.string()),
+        oauthAudiences: z.array(z.string()).optional(),
     })
         .strict()
         .optional(),
 })
     .strict();
 const methods = [
+    ["registrationBootstrapStatus", undefined],
+    ["registrationServiceSettings", undefined],
+    ["configureRegistrationService", z.object({ origin: z.string().min(1).max(2048), expectedVersion: z.number().int().nonnegative() }).strict()],
+    ["submitRegistrationOtp", z.object({ code: z.string().regex(/^[0-9]{6}$/u) }).strict()],
     ["listIdentities", undefined],
     ["listRequests", z.boolean().optional()],
     ["getRequest", z.string().min(1)],
@@ -45,6 +51,9 @@ const methods = [
             .strict(),
     ],
     ["publicDocument", reference],
+    ["publicationStatus", reference],
+    ["retryPublication", reference],
+    ["publishIdentity", z.object({ reference, config: PublicationConfigSchema }).strict()],
     [
         "deleteIdentity",
         z.object({ reference, confirmationName: z.string().min(1) }).strict(),
@@ -71,14 +80,14 @@ const contribution = {
                     codec: {
                         mode: "strict",
                         typeSymbol: `anp-identity/manager#${method}Input`,
-                        schema,
+                        create: () => schema,
                     },
                 },
             ],
         result: {
             mode: "strict",
             typeSymbol: `anp-identity/manager#${method}Result`,
-            schema: z.json().nullable(),
+            create: () => z.json().nullable(),
         },
     })),
 };

package/lib/remote.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote.js","sourceRoot":"","sources":["../src/remote.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,OAAO,GAAG,CAAC;KACd,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,QAAQ,GAAG,OAAO;KACrB,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACrC,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC9B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,gBAAgB,EAAE,CAAC;SAChB,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,YAAY,EAAE,CAAC,CAAC,KAAK,CACnB,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC,CACjE;QACD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACpC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,OAAO,GAAG;IACd,CAAC,gBAAgB,EAAE,SAAS,CAAC;IAC7B,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;IACxC,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,QAAQ,EAAE,SAAS,CAAC;IACrB;QACE,QAAQ;QACR,CAAC;aACE,MAAM,CAAC;YACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;SAC7C,CAAC;aACD,MAAM,EAAE;KACZ;IACD,CAAC,gBAAgB,EAAE,SAAS,CAAC;IAC7B;QACE,gBAAgB;QAChB,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;KACtE;IACD,CAAC,cAAc,EAAE,OAAO,CAAC;IACzB,CAAC,aAAa,EAAE,OAAO,CAAC;CAChB,CAAC;AAEX,MAAM,YAAY,GAA6B;IAC7C,OAAO,EAAE,0CAA0C;IACnD,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9C,EAAE,EAAE,+DAA+D,MAAM,EAAE;QAC3E,OAAO,EAAE,oBAAoB;QAC7B,SAAS,EAAE,oBAAoB;QAC/B,MAAM;QACN,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC9B,UAAU,EACR,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE;oBACE,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,MAAM;oBACd,GAAG,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChE,KAAK,EAAE;wBACL,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE,wBAAwB,MAAM,OAAO;wBACjD,MAAM;qBACP;iBACF;aACF;QACP,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,wBAAwB,MAAM,QAAQ;YAClD,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;SAC5B;KACF,CAAC,CAAC;CACJ,CAAC;AACF,eAAe,YAAY,CAAC"}
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../src/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,6EAA6E;AAC7E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,OAAO,GAAG,CAAC;KACd,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,QAAQ,GAAG,OAAO;KACrB,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACrC,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC9B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,gBAAgB,EAAE,CAAC;SAChB,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,YAAY,EAAE,CAAC,CAAC,KAAK,CACnB,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC,CACjE;QACD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACpC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAChC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC/C,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,OAAO,GAAG;IACd,CAAC,6BAA6B,EAAE,SAAS,CAAC;IAC1C,CAAC,6BAA6B,EAAE,SAAS,CAAC;IAC1C,CAAC,8BAA8B,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7I,CAAC,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACvF,CAAC,gBAAgB,EAAE,SAAS,CAAC;IAC7B,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;IACxC,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,QAAQ,EAAE,SAAS,CAAC;IACrB;QACE,QAAQ;QACR,CAAC;aACE,MAAM,CAAC;YACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;SAC7C,CAAC;aACD,MAAM,EAAE;KACZ;IACD,CAAC,gBAAgB,EAAE,SAAS,CAAC;IAC7B,CAAC,mBAAmB,EAAE,SAAS,CAAC;IAChC,CAAC,kBAAkB,EAAE,SAAS,CAAC;IAC/B,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACtF;QACE,gBAAgB;QAChB,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;KACtE;IACD,CAAC,cAAc,EAAE,OAAO,CAAC;IACzB,CAAC,aAAa,EAAE,OAAO,CAAC;CAChB,CAAC;AAEX,MAAM,YAAY,GAA6B;IAC7C,OAAO,EAAE,0CAA0C;IACnD,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9C,EAAE,EAAE,+DAA+D,MAAM,EAAE;QAC3E,OAAO,EAAE,oBAAoB;QAC7B,SAAS,EAAE,oBAAoB;QAC/B,MAAM;QACN,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC9B,UAAU,EACR,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE;oBACE,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,MAAM;oBACd,GAAG,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChE,KAAK,EAAE;wBACL,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE,wBAAwB,MAAM,OAAO;wBACjD,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM;qBACrB;iBACF;aACF;QACP,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,wBAAwB,MAAM,QAAQ;YAClD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;SAClC;KACF,CAAC,CAAC;CACJ,CAAC;AACF,eAAe,YAAY,CAAC"}

package/lib/target-policy.d.ts

@@ -0,0 +1,35 @@
+/** Context-bound protocol authorization with opaque target, scope and temporary-key references. */
+import type { Context } from '@deepseek-ai/cordis';
+import type { IdentityReference } from '@agent-network-protocol/anp-identity';
+import type { ProviderLease } from '@agent-network-protocol/anp-identity/provider';
+import type { VerifiedCaller } from './authorization-types.js';
+import type { PublicationCoordinator } from './publication.js';
+import type { ProtocolUsePolicy, ProtocolIdentityClient, PapHostConsumer } from './protocol-client.js';
+import type { PapCallbackManagementOperations } from './pap-callback.js';
+export interface ProtocolAuthorityHost {
+    resolveCaller(context: Context): VerifiedCaller;
+    assertCaller(caller: VerifiedCaller): void;
+    providerGeneration(): unknown;
+    withNative<T>(operation: (native: ProviderLease) => Promise<T>): Promise<T>;
+}
+/** Private manager-owned driver and encrypted public transaction bindings. No credential value is returned. */
+export interface PapCallbackHostAuthority {
+    assertActive(): Promise<void>;
+    operations: PapCallbackManagementOperations;
+    reserve(transactionId: string, binding: Record<string, unknown>): Promise<Record<string, unknown>>;
+    read(transactionId: string): Promise<Record<string, unknown> | undefined>;
+}
+/** The trusted adapter validates public discovery; this authority enforces identity and permission policy. */
+export declare class ProtocolIdentityAuthority {
+    private readonly policies;
+    private readonly host;
+    private readonly publications;
+    private readonly targets;
+    constructor(policies: readonly ProtocolUsePolicy[], host: ProtocolAuthorityHost, publications: PublicationCoordinator);
+    bind(context: Context): ProtocolIdentityClient;
+    /** Bind the exact installed PAP plugin; publication and callback data never replace its Host policy. */
+    bindPapHost(context: Context, callbackAuthority: (identity: IdentityReference, backend: string) => Promise<PapCallbackHostAuthority>): PapHostConsumer;
+    private validateEvidence;
+    private validateRequest;
+}
+//# sourceMappingURL=target-policy.d.ts.map

package/lib/target-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"target-policy.d.ts","sourceRoot":"","sources":["../src/target-policy.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAA;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAA;AAClF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAE9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,EAAsE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE1K,OAAO,KAAK,EAAE,+BAA+B,EACY,MAAM,mBAAmB,CAAA;AAclF,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,cAAc,CAAA;IAC/C,YAAY,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAA;IAC1C,kBAAkB,IAAI,OAAO,CAAA;IAC7B,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;CAC5E;AACD,+GAA+G;AAC/G,MAAM,WAAW,wBAAwB;IACvC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7B,UAAU,EAAE,+BAA+B,CAAA;IAC3C,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAClG,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAA;CAC1E;AAKD,8GAA8G;AAC9G,qBAAa,yBAAyB;IAExB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAAgC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACxF,OAAO,CAAC,QAAQ,CAAC,YAAY;IAF/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;gBAC9B,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EAAmB,IAAI,EAAE,qBAAqB,EAC9F,YAAY,EAAE,sBAAsB;IAYvD,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,sBAAsB;IAwI9C,wGAAwG;IACxG,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,wBAAwB,CAAC,GAAG,eAAe;IA4FtJ,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,eAAe;CAKxB"}

package/lib/target-policy.js

@@ -0,0 +1,319 @@
+import { PapCallbackManagementError, PapCallbackOperationSchema } from './pap-callback.js';
+import { exactHttps } from './publication-http.js';
+import { pluginError } from './errors.js';
+/** Runtime capability checks precede every optional native method. A missing implementation is incompatible. */
+async function invoke(native, name, reference, request) {
+    const method = native[name];
+    if (typeof method !== 'function')
+        throw pluginError('provider_incompatible');
+    return Reflect.apply(method, native, [reference, request]);
+}
+const same = (a, b) => a.storeId === b.storeId && a.identityId === b.identityId && a.did === b.did;
+/** The trusted adapter validates public discovery; this authority enforces identity and permission policy. */
+export class ProtocolIdentityAuthority {
+    policies;
+    host;
+    publications;
+    targets = new WeakMap();
+    constructor(policies, host, publications) {
+        this.policies = policies;
+        this.host = host;
+        this.publications = publications;
+        this.policies = structuredClone(policies);
+        const ids = new Set();
+        for (const policy of this.policies) {
+            if (ids.has(policy.id) || !policy.id || !Number.isSafeInteger(policy.version) || policy.version < 1
+                || !policy.consumer || policy.owner !== '@agent-network-protocol/dsh-anp-identity' || !policy.profiles.length || !Number.isSafeInteger(policy.expiresAt)
+                || !policy.scopes.length && !policy.profiles.every(profile => profile === 'pap_session')
+                || !policy.publicTargets && (!policy.issuers.length || !policy.resources.length))
+                throw pluginError('invalid_request');
+            ids.add(policy.id);
+            policy.issuers.forEach(value => exactHttps(value));
+            policy.resources.forEach(value => exactHttps(value));
+        }
+    }
+    bind(context) {
+        const caller = this.host.resolveCaller(context);
+        if (!this.policies.some(policy => policy.consumer === caller.consumer))
+            throw pluginError('consumer_forbidden');
+        const contextGeneration = this.host.providerGeneration();
+        return Object.freeze({ registerValidatedTarget: async (input) => {
+                const evidence = structuredClone(input.discovery);
+                const policy = this.policies.find(value => value.id === input.policyRef && value.consumer === caller.consumer && same(value.identity, input.identityRef));
+                const checkCaller = () => {
+                    const current = this.host.resolveCaller(context);
+                    if (current.consumer !== caller.consumer || this.host.providerGeneration() !== contextGeneration)
+                        throw pluginError('provider_disposed');
+                    this.host.assertCaller(current);
+                };
+                checkCaller();
+                this.validateEvidence(evidence);
+                if (!policy || Date.now() >= policy.expiresAt || !policy.profiles.includes(evidence.profile)
+                    || (!policy.publicTargets && (!policy.issuers.includes(evidence.issuer) || !policy.resources.includes(evidence.resource)))
+                    || input.requestedScopes.some(scope => !policy.scopes.includes(scope)))
+                    throw pluginError('capability_forbidden');
+                let disposed = false;
+                let publicationVersion;
+                let publicationKid;
+                const targetRef = Object.freeze({});
+                const scopes = new WeakMap();
+                const keys = new WeakMap();
+                const checkCurrent = () => {
+                    checkCaller();
+                    if (disposed || Date.now() >= policy.expiresAt || Date.now() >= evidence.expiresAt)
+                        throw pluginError('capability_forbidden');
+                };
+                const check = async () => {
+                    checkCurrent();
+                    const record = await this.publications.requirePublished(input.identityRef);
+                    checkCurrent();
+                    if (publicationVersion !== undefined && (record.version !== publicationVersion || record.key.kid !== publicationKid))
+                        throw pluginError('capability_forbidden');
+                    if (record.key.alg !== 'ES256' || !record.config.capabilities
+                        || evidence.profile === 'mcp_machine' && !record.config.capabilities.mcpMachine
+                        || evidence.profile === 'pap_session' && !record.config.capabilities.papSession
+                        || evidence.profile === 'pap_account' && !record.config.capabilities.papAccount)
+                        throw pluginError('provider_incompatible');
+                    // Keep the live custody observation after metadata awaits; cached OAuth tokens still require it.
+                    await this.host.withNative(async (native) => {
+                        checkCurrent();
+                        const info = await native.info();
+                        checkCurrent();
+                        if (typeof info.backendAvailable !== 'boolean')
+                            throw pluginError('provider_incompatible');
+                        if (!info.backendAvailable || info.storeId !== input.identityRef.storeId || !info.schemaCompatible
+                            || info.health !== 'ready')
+                            throw pluginError('provider_unavailable');
+                    });
+                    checkCurrent();
+                    return record;
+                };
+                const scope = (ref) => {
+                    const value = scopes.get(ref);
+                    if (!value)
+                        throw pluginError('capability_forbidden');
+                    return value;
+                };
+                const key = (scopeRef, keyRef, purpose) => {
+                    scope(scopeRef);
+                    const value = keys.get(keyRef);
+                    if (!value || value.scopeRef !== scopeRef || purpose && value.native.purpose !== purpose)
+                        throw pluginError('capability_forbidden');
+                    return value.native;
+                };
+                const run = async (method, request) => {
+                    await check();
+                    const result = await this.host.withNative(async (native) => {
+                        await check();
+                        const value = await invoke(native, method, input.identityRef, request);
+                        await check();
+                        return value;
+                    });
+                    await check();
+                    return result;
+                };
+                const create = async (scopeRef, operationId, purpose) => {
+                    const result = await run(purpose === 'pap_session' ? 'createDelegatedKey' : 'createDpopKey', { scope: scope(scopeRef), operation_id: operationId });
+                    if (result.purpose !== purpose || typeof result.handle !== 'string' || !Number.isSafeInteger(result.generation)
+                        || result.public_jwk?.kty !== 'EC' || result.public_jwk.crv !== 'P-256' || typeof result.thumbprint !== 'string')
+                        throw pluginError('provider_incompatible');
+                    const keyRef = Object.freeze({});
+                    keys.set(keyRef, { scopeRef, native: result });
+                    return Object.freeze({ handle: result.handle, keyRef, purpose, generation: result.generation, publicJwk: structuredClone(result.public_jwk), thumbprint: result.thumbprint });
+                };
+                const lease = Object.freeze({
+                    targetRef, policyGeneration: policy.version,
+                    assertActive: async () => { await check(); },
+                    getOAuthClientIdentity: async () => { const record = await check(); return { clientId: record.clientId, keyId: record.key.kid, algorithm: 'ES256', version: record.version, signerMode: 'local', publicJwk: { kty: 'EC', crv: 'P-256', x: record.key.x, y: 'y' in record.key ? record.key.y : '' }, redirectUris: [...record.config.redirectUris] }; },
+                    signOAuthClientAssertion: async (ref) => {
+                        if (ref !== targetRef || !evidence.tokenEndpoint)
+                            throw pluginError('capability_forbidden');
+                        const record = await check();
+                        return await run('signOAuthClientAssertion', { client_id: record.clientId, audience: evidence.issuer, key: { kid: record.key.kid } });
+                    },
+                    bindPapScope: input => {
+                        checkCaller();
+                        if (disposed || evidence.profile === 'mcp_machine' || !evidence.companyId || !input.userId
+                            || input.accountSlot !== undefined && evidence.profile !== 'pap_account')
+                            throw pluginError('capability_forbidden');
+                        const ref = Object.freeze({});
+                        scopes.set(ref, { owner: policy.owner, company_id: evidence.companyId, user_id: input.userId,
+                            ...(input.accountSlot === undefined ? {} : { account_slot: input.accountSlot }) });
+                        return ref;
+                    },
+                    restorePapKey: async (ref, request) => {
+                        const result = await run('describeTemporaryKey', { ...request, scope: scope(ref) });
+                        if (result.handle !== request.handle || result.generation !== request.generation || result.purpose !== request.purpose
+                            || result.public_jwk?.kty !== 'EC' || result.public_jwk.crv !== 'P-256')
+                            throw pluginError('provider_incompatible');
+                        const keyRef = Object.freeze({});
+                        keys.set(keyRef, { scopeRef: ref, native: result });
+                        return { handle: result.handle, keyRef, purpose: result.purpose, generation: result.generation, publicJwk: structuredClone(result.public_jwk), thumbprint: result.thumbprint };
+                    },
+                    createDelegatedKey: (ref, id) => create(ref, id, 'pap_session'),
+                    createDpopKey: (ref, id) => create(ref, id, 'pap_dpop'),
+                    issuePapDelegation: async (ref, request) => {
+                        const selected = key(ref, request.keyRef, 'pap_session');
+                        const record = await check();
+                        return await run('issuePapDelegation', { client_id: record.clientId, key: { kid: record.key.kid },
+                            delegated_key: { handle: selected.handle, generation: selected.generation }, scope: scope(ref), ttl_seconds: request.ttlSeconds });
+                    },
+                    signPapSessionRequest: async (ref, request) => {
+                        const selected = key(ref, request.keyRef, 'pap_session');
+                        const record = await check();
+                        this.validateRequest(evidence, request.httpUri);
+                        if (request.clientId !== record.clientId || request.sub !== scope(ref).user_id)
+                            throw pluginError('capability_forbidden');
+                        return await run('signPapSessionRequest', { handle: selected.handle, generation: selected.generation, scope: scope(ref),
+                            delegation: request.delegation, client_id: record.clientId, sid: request.sid, sub: request.sub,
+                            ...(request.agentId === undefined ? {} : { agent_id: request.agentId }), http_method: request.httpMethod, http_uri: request.httpUri,
+                            ...(request.accessToken === undefined ? {} : { access_token: request.accessToken }) });
+                    },
+                    signDpopProof: async (ref, request) => {
+                        const selected = key(ref, request.keyRef, 'pap_dpop');
+                        if (evidence.profile !== 'pap_account')
+                            throw pluginError('capability_forbidden');
+                        this.validateRequest(evidence, request.httpUri);
+                        return await run('signDpopProof', { handle: selected.handle, generation: selected.generation, scope: scope(ref),
+                            http_method: request.httpMethod, http_uri: request.httpUri,
+                            ...(request.accessToken === undefined ? {} : { access_token: request.accessToken }), ...(request.nonce === undefined ? {} : { nonce: request.nonce }) });
+                    },
+                    retireTemporaryKey: async (ref, keyRef) => { const selected = key(ref, keyRef); await run('retireTemporaryKey', { handle: selected.handle, generation: selected.generation, scope: scope(ref) }); keys.delete(keyRef); },
+                    dispose: () => { disposed = true; },
+                });
+                const initial = await check();
+                publicationVersion = initial.version;
+                publicationKid = initial.key.kid;
+                this.targets.set(targetRef, { fiber: context.fiber, identity: structuredClone(input.identityRef), policy,
+                    evidence, scopes: [...new Set(input.requestedScopes)].sort(), check });
+                return lease;
+            } });
+    }
+    /** Bind the exact installed PAP plugin; publication and callback data never replace its Host policy. */
+    bindPapHost(context, callbackAuthority) {
+        const caller = this.host.resolveCaller(context);
+        if (caller.consumer !== '@agentconnect/dsh-pap/plugin')
+            throw pluginError('consumer_forbidden');
+        const generation = this.host.providerGeneration();
+        const selectedPolicies = new Set();
+        let disposed = false;
+        const checkActive = () => {
+            const current = this.host.resolveCaller(context);
+            if (disposed || current.consumer !== caller.consumer || this.host.providerGeneration() !== generation)
+                throw pluginError('provider_disposed');
+            this.host.assertCaller(current);
+            if ([...selectedPolicies].some(policy => Date.now() >= policy.expiresAt))
+                throw pluginError('capability_forbidden');
+        };
+        const assertActive = async () => { checkActive(); };
+        const policyFor = (identity, policyRef, profile) => {
+            const policy = this.policies.find(value => value.id === policyRef && value.consumer === caller.consumer && same(value.identity, identity));
+            if (!policy || !policy.profiles.includes(profile) || Date.now() >= policy.expiresAt)
+                throw pluginError('capability_forbidden');
+            selectedPolicies.add(policy);
+            return policy;
+        };
+        const publishedFor = async (identity, profile) => {
+            const record = await this.publications.requirePublished(identity);
+            if (record.key.alg !== 'ES256' || !record.config.capabilities?.papSession
+                || profile === 'pap_account' && !record.config.capabilities.papAccount)
+                throw pluginError('provider_incompatible');
+            return record;
+        };
+        const relay = (record) => {
+            const uri = new URL(record.clientId).origin + '/user-service/v1/pap-callback';
+            return record.config.redirectUris.includes(uri) ? uri : undefined;
+        };
+        return Object.freeze({
+            assertActive,
+            dispose: () => { disposed = true; },
+            resolveBinding: async (identity, policyRef, profile) => {
+                checkActive();
+                const policy = policyFor(identity, policyRef, profile);
+                const record = await publishedFor(identity, profile);
+                checkActive();
+                await this.host.withNative(async (native) => { checkActive(); await native.publicIdentity(identity); checkActive(); });
+                checkActive();
+                const current = await publishedFor(identity, profile);
+                checkActive();
+                if (record.version !== current.version || record.key.kid !== current.key.kid)
+                    throw pluginError('capability_forbidden');
+                const redirectUri = profile === 'pap_account' ? relay(current) : undefined;
+                return { binding: { identityRef: structuredClone(identity), ownerRef: policy.owner, clientId: current.clientId },
+                    ...(redirectUri ? { redirectUri } : {}) };
+            },
+            callbackManagementFor: async (input) => {
+                await assertActive();
+                const policy = policyFor(input.identityRef, input.policyRef, 'pap_account');
+                const target = this.targets.get(input.targetRef);
+                if (!target || target.fiber !== context.fiber || !same(target.identity, input.identityRef)
+                    || target.policy !== policy || target.evidence.profile !== 'pap_account')
+                    throw pluginError('capability_forbidden');
+                const record = await target.check();
+                const redirectUri = relay(record);
+                if (!redirectUri)
+                    throw new PapCallbackManagementError('callback_redirect_mismatch');
+                const authority = await callbackAuthority(input.identityRef, record.config.backend);
+                let released = false;
+                const check = async () => {
+                    await assertActive();
+                    if (released)
+                        throw pluginError('provider_disposed');
+                    await target.check();
+                    await authority.assertActive();
+                    checkActive();
+                };
+                await check();
+                const binding = { schema: 'pap-host-target/1', consumer: caller.consumer, policyRef: policy.id,
+                    issuer: target.evidence.issuer, resource: target.evidence.resource, scopes: target.scopes,
+                    clientId: record.clientId, redirectUri };
+                async function execute(command) {
+                    const parsed = PapCallbackOperationSchema.safeParse(command);
+                    if (!parsed.success)
+                        throw pluginError('invalid_request');
+                    const operation = parsed.data;
+                    await check();
+                    if (operation.action === 'pap-callback-register') {
+                        if (operation.callback.client_id !== record.clientId || operation.callback.issuer !== target.evidence.issuer
+                            || operation.callback.redirect_uri !== redirectUri)
+                            throw pluginError('capability_forbidden');
+                        const saved = await authority.reserve(operation.callback.transaction_id, binding);
+                        if (JSON.stringify(saved) !== JSON.stringify(binding))
+                            throw pluginError('capability_forbidden');
+                        await check();
+                        const result = await authority.operations.execute(operation);
+                        await check();
+                        checkActive();
+                        return result;
+                    }
+                    const saved = await authority.read(operation.callback.transaction_id);
+                    if (!saved || JSON.stringify(saved) !== JSON.stringify(binding))
+                        throw pluginError('capability_forbidden');
+                    await check();
+                    checkActive();
+                    const result = await authority.operations.execute(operation);
+                    await check();
+                    if (result.iss !== target.evidence.issuer)
+                        throw pluginError('capability_forbidden');
+                    return result;
+                }
+                return Object.freeze({ execute, dispose: () => { released = true; } });
+            },
+        });
+    }
+    validateEvidence(evidence) {
+        for (const value of [evidence.issuer, evidence.resource, evidence.sources.resource, evidence.sources.authorizationServer,
+            ...(evidence.tokenEndpoint ? [evidence.tokenEndpoint] : []), ...(evidence.allowedEndpoints ?? [])])
+            exactHttps(value);
+        if (!/^[a-f0-9]{64}$/u.test(evidence.metadataDigest) || !Number.isSafeInteger(evidence.expiresAt)
+            || evidence.expiresAt <= Date.now() || evidence.expiresAt > Date.now() + 3600000)
+            throw pluginError('invalid_request');
+    }
+    validateRequest(evidence, uri) {
+        const request = new URL(uri);
+        if (request.username || request.password || request.hash || request.protocol !== 'https:'
+            || ![evidence.resource, evidence.tokenEndpoint, ...(evidence.allowedEndpoints ?? [])].includes(`${request.origin}${request.pathname}`))
+            throw pluginError('capability_forbidden');
+    }
+}
+//# sourceMappingURL=target-policy.js.map