@agent-network-protocol/dsh-anp-identity 0.1.6 → 0.1.8

package/lib/index.js

@@ -1,5 +1,12 @@
+import { RegistrationServiceSettingsStore } from './registration-service-settings.js';
+import { createManagedPublicationDriver, registerLocalIdentity } from './management-driver.js';
+import { installedConsumerEntries, resolveInstalledConsumer } from './installed-consumer.js';
+import { ProtocolIdentityAuthority } from './target-policy.js';
+import { PapCallbackManagementError } from './pap-callback.js';
+import { PublicationCoordinator } from './publication.js';
+import { exactHttps } from './publication-http.js';
 /** Host-only ANP Identity service for DeepSeek Harness. */
-import { randomUUID } from 'node:crypto';
+import { randomUUID, createHash } from 'node:crypto';
 import { homedir } from 'node:os';
 import { isAbsolute, join } from 'node:path';
 import { Service } from '@deepseek-ai/cordis';
@@ -7,18 +14,21 @@ import z from '@deepseek-ai/schemastery';
 import { CatalogStore, CATALOG_SCHEMA, CREATE_INTENT_SCHEMA, emptyCatalog, entryReference, findEntry, normalizeHandle, } from './catalog.js';
 import { pluginError, AnpIdentityPluginError } from './errors.js';
 import { createAuthenticatedHttp } from './http-auth.js';
-import { UserIdentityService, requestSigningKid } from './user-service.js';
+import { UserIdentityService, httpSigningKey } from './user-service.js';
 import { ANP_IDENTITY_NATIVE_PROVIDER_PROTOCOL, ANP_IDENTITY_PROVIDER_PROTOCOL, ANP_IDENTITY_SERVICE_PROTOCOL, } from './provider-api.js';
 export { AnpIdentityPluginError } from './errors.js';
 export { ANP_IDENTITY_HTTP_MAX_BODY_BYTES, } from './http-auth.js';
 export { ANP_IDENTITY_PROVIDER_PROTOCOL, ANP_IDENTITY_SERVICE_PROTOCOL, } from './provider-api.js';
 export const Config = z.object({
+    signerMode: z.const('local').default('local'),
+    protocolPolicies: z.array(z.any()).default([]),
     stateRoot: z.string(),
     allowConsumers: z.array(z.string()).default([]),
     allowProviderConsumers: z.array(z.string()).default([]),
     httpAllowedOrigins: z.dict(z.array(z.string())).default({}),
     recoveryOnOpen: z.boolean().default(true),
     userConsumers: z.array(z.string()).default([]),
+    oauthAllowedAudiences: z.dict(z.array(z.string())).default({}),
 });
 /** The Loader retains Registry.plugin's awaitable wrapper, not its raw fiber. */
 function sameFiber(left, right) {
@@ -54,8 +64,13 @@ const HOST_LEASE_RENEWAL_SKEW_MS = 60_000;
 export class AnpIdentityService extends Service {
     static Config = Config;
     resolvedConfig;
+    registrationSettings;
     catalogStore;
     providerSlot;
+    publications;
+    publicationBackends = new Map();
+    papCallbackAuthorities = new Map();
+    protocols;
     users;
     hostContext;
     disabledFences = new Set();
@@ -63,8 +78,10 @@ export class AnpIdentityService extends Service {
     constructor(ctx, config) {
         super(ctx, 'anpIdentity');
         this.resolvedConfig = resolveConfig(config);
+        this.registrationSettings = new RegistrationServiceSettingsStore(this.resolvedConfig.stateRoot);
         this.catalogStore = new CatalogStore(this.resolvedConfig.stateRoot);
         this.hostContext = ctx;
+        this.publications = new PublicationCoordinator(this.catalogStore, { withNative: operation => this.withPublicationNative(operation) });
         this.users = new UserIdentityService(this.resolvedConfig.stateRoot, {
             ensureReady: async () => { await this.awaitProvider(this.requireSlot()); },
             resolveCaller: context => this.resolveInstalledCaller(context),
@@ -73,7 +90,11 @@ export class AnpIdentityService extends Service {
             createIdentity: (id, caller, parameters) => this.createConfirmed(id, caller, parameters),
             reconcileCreation: (id, caller, parameters) => this.reconcileConfirmed(id, caller, parameters),
             withNative: operation => this.withUserNative(operation),
-        });
+        }, this.publications);
+        this.protocols = new ProtocolIdentityAuthority(structuredClone(config.protocolPolicies ?? []), {
+            resolveCaller: context => this.resolveInstalledCaller(context), assertCaller: caller => this.assertInstalledCaller(caller),
+            providerGeneration: () => this.requireSlot().id, withNative: operation => this.withProtocolNative(operation),
+        }, this.publications);
         const observe = ctx.on.bind(ctx);
         observe('loader/partial-dispose', (rawEntry, rawPrevious, active) => {
             if (ctx.fiber.state > 2)
@@ -83,7 +104,7 @@ export class AnpIdentityService extends Service {
             if (active === false || entry?.disabled)
                 this.cancelDisabledRequests(previous?.name ?? entry?.options?.name);
             try {
-                for (const candidate of this.installedEntries()) {
+                for (const candidate of installedConsumerEntries(this.hostContext)) {
                     if (candidate.disabled)
                         this.cancelDisabledRequests(candidate.options.name);
                 }
@@ -94,7 +115,7 @@ export class AnpIdentityService extends Service {
             if (ctx.fiber.state > 2)
                 return;
             try {
-                for (const entry of this.installedEntries()) {
+                for (const entry of installedConsumerEntries(this.hostContext)) {
                     if (sameFiber(entry.fiber, fiber) && entry.disabled)
                         this.cancelDisabledRequests(entry.options.name);
                 }
@@ -111,7 +132,7 @@ export class AnpIdentityService extends Service {
     }
     async health() {
         const slot = this.providerSlot;
-        if (slot === undefined || slot.disposed) {
+        if (slot === undefined || slot.disposed || this.hostContext.fiber.state > 2) {
             return {
                 status: 'unavailable',
                 protocol: ANP_IDENTITY_SERVICE_PROTOCOL,
@@ -119,7 +140,25 @@ export class AnpIdentityService extends Service {
             };
         }
         try {
-            await slot.ready;
+            const assertCurrent = () => {
+                this.assertSlot(slot);
+                if (this.hostContext.fiber.state > 2)
+                    throw pluginError('provider_disposed');
+            };
+            const provider = await slot.ready;
+            assertCurrent();
+            const native = provider.acquireLease({ consumer: '@agent-network-protocol/dsh-anp-identity',
+                capabilities: ['IDENTITY_READ'], ttlSeconds: 15 });
+            try {
+                const info = await native.info();
+                assertCurrent();
+                // Legacy general health remains compatible; protocol leases require the availability handshake.
+                if (info.backendAvailable === false || !info.schemaCompatible || info.health !== 'ready')
+                    throw pluginError('provider_unavailable');
+            }
+            finally {
+                native.dispose();
+            }
         }
         catch {
             return {
@@ -631,13 +670,202 @@ export class AnpIdentityService extends Service {
     bindUserConsumer(context) {
         return this.users.bind(context);
     }
+    bindProtocolConsumer(context) { return this.protocols.bind(context); }
+    /** Bind the actual installed PAP Host. Private callback access additionally requires its current opaque target.
+     * @param context - Original Loader-installed PAP plugin Context.
+     * @returns Public identity selection and target-bound, closed callback operations.
+     */
+    bindPapHostConsumer(context) {
+        return this.protocols.bindPapHost(context, async (reference, backend) => {
+            const entry = this.papCallbackAuthorities.get(backend);
+            if (!entry || entry.reference.storeId !== reference.storeId || entry.reference.identityId !== reference.identityId
+                || entry.reference.did !== reference.did)
+                throw new PapCallbackManagementError('management_auth_required');
+            await entry.authority.assertActive();
+            return entry.authority;
+        });
+    }
+    /** Install a real device-authorized backend; the document id comes from authenticated resolve. */
+    async configureManagedPublicationBackend(context, name, input) {
+        this.assertManagementContext(context);
+        const slot = this.requireSlot();
+        let disposed = false;
+        const assertCurrent = () => {
+            if (disposed)
+                throw pluginError('provider_disposed');
+            // Preserve the original installed manager Context even when a different service consumer invokes a capability.
+            const managerService = context.get('anpIdentity');
+            managerService.assertManagementContext(context);
+            managerService.assertSlot(slot);
+        };
+        const assertActive = async () => { assertCurrent(); };
+        const driver = await createManagedPublicationDriver({ ...input,
+            withNative: async (operation) => {
+                assertCurrent();
+                const result = await context.get('anpIdentity').withPublicationNative(async (native) => {
+                    assertCurrent();
+                    const value = await operation(native);
+                    assertCurrent();
+                    return value;
+                });
+                assertCurrent();
+                return result;
+            }, assertActive, assertCurrent });
+        this.assertManagementContext(context);
+        const dispose = this.registerPublicationBackend(context, name, driver.backend);
+        const generation = Symbol('pap-callback-manager');
+        const reference = Object.freeze(structuredClone(input.reference));
+        const origin = input.origin;
+        const prefix = 'pap-host-target:';
+        const assertAuthority = async () => {
+            await assertActive();
+            const managerService = context.get('anpIdentity');
+            if (managerService.publicationBackends.get(name) !== driver.backend
+                || managerService.papCallbackAuthorities.get(name)?.generation !== generation)
+                throw pluginError('provider_disposed');
+            assertCurrent();
+        };
+        const authority = {
+            assertActive: assertAuthority,
+            operations: Object.freeze({ execute: driver.execute }),
+            reserve: async (transactionId, binding) => {
+                await assertAuthority();
+                const result = await input.credentials.reserveOperation(reference, origin, prefix + transactionId, binding);
+                await assertAuthority();
+                return result;
+            },
+            read: async (transactionId) => {
+                await assertAuthority();
+                const credential = await input.credentials.get(reference, origin);
+                await assertAuthority();
+                return credential?.operationBindings?.[prefix + transactionId];
+            },
+        };
+        this.papCallbackAuthorities.set(name, { reference, generation, authority });
+        return { backend: name, documentId: driver.documentId, callbackManagement: Object.freeze({ execute: driver.execute }),
+            dispose: () => {
+                disposed = true;
+                dispose();
+                if (this.papCallbackAuthorities.get(name)?.generation === generation)
+                    this.papCallbackAuthorities.delete(name);
+            } };
+    }
+    /** Register the public local Manifest through User Service and persist its verified management credential. */
+    async registerLocalIdentity(context, input) {
+        const assertActive = await this.pinManagementContext(context, input.reference, input.assertActive);
+        const result = await registerLocalIdentity({ ...input, assertActive, withNative: async (operation) => {
+                assertActive();
+                const value = await context.get('anpIdentity').withPublicationNative(async (native) => {
+                    assertActive();
+                    const output = await operation(native);
+                    assertActive();
+                    return output;
+                }, true);
+                assertActive();
+                return value;
+            } });
+        assertActive();
+        return result;
+    }
+    /** Manager-only registration preferences; ordinary consumer capabilities never expose these methods. */
+    registrationServiceSettings(context) {
+        return this.registrationSettings.read(() => this.assertManagementContext(context));
+    }
+    configureRegistrationService(context, input) {
+        return this.registrationSettings.update(input, () => this.assertManagementContext(context));
+    }
+    resolveRegistrationServiceOrigin(context, key, fingerprint) {
+        return this.registrationSettings.pin(key, fingerprint, () => this.assertManagementContext(context));
+    }
+    /** Pin the actual ready provider for an approved local identity and the original manager Context.
+     * @param context - Original root-installed manager Context.
+     * @param reference - Local identity whose current provider is being pinned.
+     * @param additionalCheck - Optional stricter Host lifecycle check.
+     * @returns A synchronous fence that never switches to a replacement provider.
+     */
+    async pinManagementContext(context, reference, additionalCheck) {
+        additionalCheck?.();
+        this.assertManagementContext(context);
+        const slot = this.requireSlot();
+        const assertActive = () => {
+            additionalCheck?.();
+            const manager = context.get('anpIdentity');
+            manager.assertManagementContext(context);
+            manager.assertSlot(slot);
+        };
+        await this.awaitProvider(slot);
+        assertActive();
+        await context.get('anpIdentity').withPublicationNative(async (native) => {
+            assertActive();
+            await native.publicIdentity(reference);
+            assertActive();
+        });
+        assertActive();
+        return assertActive;
+    }
     /** Host-only manager; the ordinary consumer facade never exposes this object. */
-    acquireManagement() {
-        if (!sameFiber(this.ctx.fiber, this.hostContext.fiber) && !sameFiber(this.ctx.fiber, this.hostContext.root.fiber)) {
+    registerPublicationBackend(context, name, backend) {
+        this.assertManagementContext(context);
+        if (!/^[A-Za-z0-9_-]{1,128}$/u.test(name) || this.publicationBackends.has(name))
+            throw pluginError('invalid_request');
+        exactHttps(backend.origin);
+        this.publicationBackends.set(name, backend);
+        return () => { if (this.publicationBackends.get(name) === backend)
+            this.publicationBackends.delete(name); };
+    }
+    assertManagementContext(context) {
+        if (!context || !sameFiber(this.ctx.fiber, context.fiber))
             throw pluginError('consumer_forbidden');
-        }
-        const ready = async () => { await this.users.ready; await this.awaitProvider(this.requireSlot()); };
+        const manager = this.installedEntries().find(entry => sameFiber(entry.fiber, context.fiber));
+        if (!manager || manager.options.name !== '@agent-network-protocol/dsh-anp-identity/management-remote'
+            || manager.disabled || !manager.fiber || ![1, 2].includes(manager.fiber.state))
+            throw pluginError('consumer_forbidden');
+    }
+    acquireManagement(context, additionalCheck) {
+        additionalCheck?.();
+        this.assertManagementContext(context);
+        const ready = async () => {
+            additionalCheck?.();
+            this.assertManagementContext(context);
+            await this.users.ready;
+            additionalCheck?.();
+            this.assertManagementContext(context);
+            const slot = this.requireSlot();
+            await this.awaitProvider(slot);
+            additionalCheck?.();
+            this.assertManagementContext(context);
+            this.assertSlot(slot);
+        };
         return Object.freeze({
+            retryPublication: async (reference) => {
+                await ready();
+                const entry = findEntry(await this.loadCatalog(this.requireSlot()), reference);
+                if (!entry?.publication)
+                    throw pluginError('provider_unavailable');
+                return this.acquireManagement(context, additionalCheck).publishIdentity({ reference, config: entry.publication.config });
+            },
+            publicationStatus: async (reference) => { await ready(); return this.publications.status(reference); },
+            publishIdentity: async (input) => {
+                await ready();
+                const backend = this.publicationBackends.get(input.config.backend);
+                if (!backend)
+                    throw pluginError('provider_unavailable');
+                try {
+                    return await this.publications.publish(input.reference, input.config, backend, async () => {
+                        await ready();
+                        if (this.publicationBackends.get(input.config.backend) !== backend)
+                            throw pluginError('provider_unavailable');
+                        const entry = findEntry(await this.loadCatalog(this.requireSlot()), input.reference);
+                        if (!entry || entry.state !== 'active')
+                            throw pluginError('identity_not_found');
+                    });
+                }
+                catch (error) {
+                    if (error instanceof AnpIdentityPluginError)
+                        throw error;
+                    throw pluginError('provider_unavailable');
+                }
+            },
             listIdentities: async () => { await ready(); return this.managementIdentities(); },
             listRequests: async (history = false) => {
                 await ready();
@@ -770,7 +998,7 @@ export class AnpIdentityService extends Service {
         return [...loader.entries()];
     }
     resolveInstalledCaller(context) {
-        const entry = this.installedEntries().find(value => sameFiber(value.fiber, context.fiber));
+        const entry = resolveInstalledConsumer(this.hostContext, context);
         if (!entry || entry.disabled || !this.resolvedConfig.userConsumers.has(entry.options.name)
             || ![1, 2].includes(entry.fiber.state))
             throw pluginError('consumer_forbidden');
@@ -779,7 +1007,7 @@ export class AnpIdentityService extends Service {
     assertInstalledCaller(caller) {
         if (this.disabledFences.has(caller.consumer))
             throw pluginError('consumer_forbidden');
-        const entry = this.installedEntries().find(value => value.options.name === caller.consumer
+        const entry = installedConsumerEntries(this.hostContext).find(value => value.options.name === caller.consumer
             && !value.disabled && value.fiber !== undefined && [1, 2].includes(value.fiber.state));
         if (!entry || !this.resolvedConfig.userConsumers.has(caller.consumer))
             throw pluginError('consumer_forbidden');
@@ -802,11 +1030,12 @@ export class AnpIdentityService extends Service {
             throw pluginError('capability_forbidden');
     }
     assertLegacyCallerContext(consumer) {
-        if (this.resolvedConfig.userConsumers.size === 0
-            || sameFiber(this.ctx.fiber, this.hostContext.fiber) || sameFiber(this.ctx.fiber, this.hostContext.root.fiber))
+        if (this.resolvedConfig.userConsumers.size === 0)
             return;
         const installed = this.installedEntries().find(entry => sameFiber(entry.fiber, this.ctx.fiber));
-        if (!installed || installed.disabled || installed.options.name !== consumer
+        if (!installed || installed.disabled
+            || (installed.options.name !== consumer
+                && !(this.resolvedConfig.allowProviderConsumers.has(consumer) && installed.options.name === consumer + '/provider'))
             || !installed.fiber || ![1, 2].includes(installed.fiber.state)
             || this.resolvedConfig.userConsumers.has(installed.options.name))
             throw pluginError('consumer_forbidden');
@@ -824,6 +1053,42 @@ export class AnpIdentityService extends Service {
             native.dispose();
         }
     }
+    async withProtocolNative(operation) {
+        const slot = this.requireSlot();
+        const provider = await this.awaitProvider(slot);
+        const native = provider.acquireLease({ consumer: '@agent-network-protocol/dsh-anp-identity',
+            capabilities: ['IDENTITY_READ', 'IDENTITY_SIGN', 'IDENTITY_PAP_SESSION', 'IDENTITY_PAP_DPOP', 'IDENTITY_KEY_LIFECYCLE'], ttlSeconds: 300 });
+        try {
+            this.assertSlot(slot);
+            const capability = native.providerCapabilities;
+            if (typeof capability !== 'function')
+                throw pluginError('provider_incompatible');
+            const supported = await capability.call(native);
+            if (supported.api_version !== 2 || !supported.algorithms.includes('ES256'))
+                throw pluginError('provider_incompatible');
+            const result = await operation(native);
+            this.assertSlot(slot);
+            return result;
+        }
+        finally {
+            native.dispose();
+        }
+    }
+    async withPublicationNative(operation, registrationSigning = false) {
+        const slot = this.requireSlot();
+        const provider = await this.awaitProvider(slot);
+        const native = provider.acquireLease({ consumer: '@agent-network-protocol/dsh-anp-identity',
+            capabilities: ['IDENTITY_READ', 'IDENTITY_DOCUMENT_UPDATE', 'IDENTITY_HTTP_SIGNATURE', ...(registrationSigning ? ['IDENTITY_SIGN'] : [])], ttlSeconds: 300 });
+        try {
+            this.assertSlot(slot);
+            if (typeof native.oauthPublicJwk !== 'function')
+                throw pluginError('provider_incompatible');
+            return await operation(native);
+        }
+        finally {
+            native.dispose();
+        }
+    }
     async userSnapshot(caller, reference) {
         this.assertInstalledCaller(caller);
         const catalog = await this.loadCatalog(this.requireSlot());
@@ -836,14 +1101,22 @@ export class AnpIdentityService extends Service {
         const identity = await this.withUserNative(native => native.publicIdentity(reference));
         if (identity.state !== 'active' || !identity.capabilities.didWba)
             throw pluginError('provider_incompatible');
-        requestSigningKid(identity);
+        const http = httpSigningKey(identity);
+        if (http.httpOnly)
+            return { version: 'ordinary-http/1', capabilities: ['identity:read', 'identity:http-auth'],
+                signingPurposes: [], httpOrigins: [...(this.resolvedConfig.httpAllowedOrigins.get(caller.consumer) ?? [])].sort() };
         return { version: 'ordinary-use/1', capabilities: ['identity:read', 'identity:sign', 'identity:http-auth'],
-            signingPurposes: ['authentication', 'application_assertion'],
+            signingPurposes: this.resolvedConfig.oauthAllowedAudiences.has(caller.consumer)
+                ? ['application_assertion', 'oauth_client_assertion'] : ['authentication', 'application_assertion'],
+            ...(this.resolvedConfig.oauthAllowedAudiences.has(caller.consumer)
+                ? { oauthAudiences: [...this.resolvedConfig.oauthAllowedAudiences.get(caller.consumer)].sort() } : {}),
             httpOrigins: [...(this.resolvedConfig.httpAllowedOrigins.get(caller.consumer) ?? [])].sort() };
     }
     async createConfirmed(operationId, caller, parameters) {
         this.assertInstalledCaller(caller);
         return this.catalogStore.withNativeCreateLock(async () => this.withUserNative(async (native) => {
+            // Refresh the namespace generation after document/key operations performed through identity handles.
+            await native.recover();
             const catalog = await this.loadCatalog(this.requireSlot());
             const existing = catalog.entries.find(entry => entry.creationOperationId === operationId);
             if (existing)
@@ -863,9 +1136,21 @@ export class AnpIdentityService extends Service {
                 consumer: caller.consumer, label: parameters.label, createdAt: new Date().toISOString(),
                 ...(parameters.handle === undefined ? {} : { handle: parameters.handle }),
                 authorizationMode: 'user', baselineIdentityIds: baseline.map(item => item.reference.identityId) });
-            const identity = await native.create({ profile: 'e1', domain: parameters.domain,
+            const profile = parameters.profile ?? 'e1';
+            const protocol = parameters.usage === 'protocol';
+            const identity = await native.create({ profile, domain: parameters.domain,
                 pathSegments: parameters.path.split('/').filter(Boolean), capabilities: { didWba: true },
-                managedKeys: [{ fragment: 'root', role: 'root_control' }, { fragment: 'request', role: 'request_signing' }] });
+                managedKeys: protocol ? [
+                    ...(profile === 'e1' ? [{ fragment: 'root', role: 'root_control' }] : []),
+                    { fragment: 'device', role: 'device_signing' }, { fragment: 'agreement', role: 'e2ee_agreement' },
+                ] : [{ fragment: 'root', role: 'root_control' }, { fragment: 'request', role: 'request_signing' }],
+                ...(protocol ? { extensions: [{ type: 'device_manifest', value: { devices: [{ deviceId: 'dsh-' + createHash('sha256').update(operationId).digest('hex').slice(0, 24),
+                                        signingKeyId: '#device', e2eeKeyId: '#agreement', profiles: parameters.identityOnly ? [
+                                            'anp.core.binding.v1', 'anp.identity.discovery.v1',
+                                        ] : [
+                                            'anp.core.binding.v1', 'anp.identity.discovery.v1', 'anp.direct.base.v1',
+                                            'anp.direct.e2ee.v2', 'anp.group.base.v2', 'anp.group.e2ee.v2',
+                                        ] }] } }] } : {}) });
             await this.catalogStore.updateIntent(operationId, intent => ({ ...intent, reference: identity.reference }));
             const entry = await this.catalogStore.commitIntent(operationId);
             await this.catalogStore.deleteIntent(operationId);
@@ -1108,7 +1393,13 @@ class HostLease {
         this.#retired.clear();
         this.service.removeLease(this.slot, this);
     }
-    info = () => this.call('IDENTITY_READ', () => this.native.info());
+    info = () => this.call('IDENTITY_READ', async () => {
+        const info = await this.native.info();
+        if (info.backendAvailable === false)
+            throw pluginError('provider_unavailable');
+        return { storeId: info.storeId, schemaCompatible: info.schemaCompatible,
+            identityCount: info.identityCount, health: info.health };
+    });
     recover = () => this.call('IDENTITY_READ', () => this.native.recover());
     list = () => this.call('IDENTITY_READ', () => this.native.list());
     publicIdentity = (reference) => this.call('IDENTITY_READ', () => this.native.publicIdentity(reference));
@@ -1116,6 +1407,8 @@ class HostLease {
     recoverIdentity = (reference) => this.call('IDENTITY_READ', () => this.native.recoverIdentity(reference));
     create = (request) => this.call('IDENTITY_CREATE', () => this.service.createForHost(this.slot, this.native, this.consumer, request));
     delete = (reference) => this.call('IDENTITY_DELETE', () => this.service.deleteForHost(this.slot, this.native, this.consumer, reference));
+    oauthPublicJwk = (reference, kid) => this.call('IDENTITY_READ', () => this.native.oauthPublicJwk(reference, kid));
+    signOAuthClientAssertion = (reference, request) => this.call('IDENTITY_SIGN', () => this.native.signOAuthClientAssertion(reference, request));
     sign = (reference, request) => this.call('IDENTITY_SIGN', () => this.native.sign(reference, request));
     verify = (reference, request) => this.call('IDENTITY_READ', () => this.native.verify(reference, request));
     signOriginProof = (reference, request) => this.call('IDENTITY_SIGN', () => this.native.signOriginProof(reference, request));
@@ -1225,6 +1518,8 @@ function renewalAt(issuedAt, ttlSeconds) {
 }
 export default AnpIdentityService;
 function resolveConfig(config) {
+    if (config.signerMode !== undefined && config.signerMode !== 'local')
+        throw new TypeError('Remote signers are unsupported');
     const configured = config.stateRoot?.trim();
     const dshHome = process.env.DSH_HOME?.trim() || join(homedir(), '.dsh');
     const stateRoot = configured === undefined || configured.length === 0
@@ -1250,14 +1545,24 @@ function resolveConfig(config) {
         validateConsumer(consumer);
         if (!allowConsumers.has(consumer))
             throw new TypeError('anp-identity: HTTP consumer must be allowed');
-        const normalized = origins.map(normalizeHttpsOrigin);
+        if (origins.includes('*') && !userConsumers.has(consumer)) {
+            throw new TypeError('anp-identity: wildcard HTTP origins require an explicit User consumer');
+        }
+        const normalized = origins.map(value => value === '*' ? value : normalizeHttpsOrigin(value));
         if (new Set(normalized).size !== normalized.length) {
             throw new TypeError('anp-identity: HTTP origins must be unique');
         }
         httpAllowedOrigins.set(consumer, new Set(normalized));
     }
+    const oauthAllowedAudiences = new Map();
+    for (const [consumer, audiences] of Object.entries(config.oauthAllowedAudiences ?? {})) {
+        if (!userConsumers.has(consumer) || !audiences.length)
+            throw new TypeError('OAuth consumers must be approved User consumers');
+        oauthAllowedAudiences.set(consumer, new Set(audiences.map(value => exactHttps(value))));
+    }
     return {
         stateRoot,
+        oauthAllowedAudiences,
         allowConsumers,
         allowProviderConsumers,
         httpAllowedOrigins,
@@ -1469,4 +1774,8 @@ function readErrorCode(error) {
 function isPluginCode(error, code) {
     return error instanceof AnpIdentityPluginError && error.code === code;
 }
+export { createPublicationBackend } from './publication-http.js';
+export { EncryptedManagementCredentialBroker } from './management-credentials.js';
+export { createManagedPublicationDriver, registerLocalIdentity } from './management-driver.js';
+export { PapCallbackManagementError } from './pap-callback.js';
 //# sourceMappingURL=index.js.map