@agent-network-protocol/dsh-anp-identity 0.1.6 → 0.1.8

package/lib/management-credentials.js

@@ -0,0 +1,126 @@
+/** Encrypted Host-only management credentials, partitioned by service origin and identity. */
+import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from 'node:crypto';
+import { mkdir, open, readFile, rename, stat, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
+import lockfile from 'proper-lockfile';
+import { exactHttps } from './publication-http.js';
+import { pluginError } from './errors.js';
+import { syncDirectory } from './sync-directory.js';
+/** Each key resolver invocation must return a fresh, owner-controlled 32-byte encryption key. */
+export class EncryptedManagementCredentialBroker {
+    root;
+    encryptionKey;
+    constructor(root, encryptionKey) {
+        this.root = root;
+        this.encryptionKey = encryptionKey;
+    }
+    partition(reference, origin) {
+        exactHttps(origin);
+        if (new URL(origin).origin !== origin)
+            throw pluginError('invalid_request');
+        return createHash('sha256').update(JSON.stringify([origin, reference.storeId, reference.identityId, reference.did])).digest('hex');
+    }
+    async get(reference, origin) {
+        const partition = this.partition(reference, origin);
+        let bytes;
+        try {
+            const path = join(this.root, partition + '.json');
+            const info = await stat(path);
+            if ((info.mode & 0o077) !== 0 || info.size > 4 * 1024 * 1024)
+                throw pluginError('provider_unavailable');
+            bytes = await readFile(path, 'utf8');
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw pluginError('provider_unavailable');
+        }
+        const key = await this.encryptionKey();
+        try {
+            const row = JSON.parse(bytes);
+            if (row.schema !== 1 || row.partition !== partition)
+                throw pluginError('provider_unavailable');
+            const decipher = createDecipheriv('aes-256-gcm', key, Buffer.from(row.iv, 'base64url'));
+            decipher.setAAD(Buffer.from(partition));
+            decipher.setAuthTag(Buffer.from(row.tag, 'base64url'));
+            const credential = JSON.parse(Buffer.concat([decipher.update(Buffer.from(row.ciphertext, 'base64url')), decipher.final()]).toString('utf8'));
+            if (!credential.accessToken || !credential.deviceId || !credential.signingKeyId)
+                throw pluginError('provider_unavailable');
+            return credential;
+        }
+        catch {
+            throw pluginError('provider_unavailable');
+        }
+        finally {
+            key.fill(0);
+        }
+    }
+    async writeUnlocked(reference, origin, credential) {
+        const partition = this.partition(reference, origin);
+        await mkdir(this.root, { recursive: true, mode: 0o700 });
+        const path = join(this.root, partition + '.json');
+        const key = await this.encryptionKey();
+        try {
+            const iv = randomBytes(12);
+            const cipher = createCipheriv('aes-256-gcm', key, iv);
+            cipher.setAAD(Buffer.from(partition));
+            const ciphertext = Buffer.concat([cipher.update(JSON.stringify(credential)), cipher.final()]);
+            const row = { schema: 1, partition, iv: iv.toString('base64url'), tag: cipher.getAuthTag().toString('base64url'), ciphertext: ciphertext.toString('base64url') };
+            const temporary = path + '.' + randomUUID();
+            const file = await open(temporary, 'wx', 0o600);
+            try {
+                await file.writeFile(JSON.stringify(row));
+                await file.sync();
+            }
+            finally {
+                await file.close();
+            }
+            try {
+                await rename(temporary, path);
+                await syncDirectory(this.root);
+            }
+            finally {
+                await unlink(temporary).catch(() => { });
+            }
+        }
+        finally {
+            key.fill(0);
+        }
+    }
+    async set(reference, origin, credential) {
+        await this.transaction(reference, origin, async () => {
+            const previous = await this.get(reference, origin);
+            await this.writeUnlocked(reference, origin, { ...credential, operationBindings: previous?.operationBindings ?? {} });
+        });
+    }
+    async reserveOperation(reference, origin, operationId, body) {
+        return this.transaction(reference, origin, async () => {
+            const credential = await this.get(reference, origin);
+            if (!credential)
+                throw pluginError('provider_unavailable');
+            const operations = credential.operationBindings ?? {};
+            const previous = operations[operationId];
+            if (previous)
+                return structuredClone(previous);
+            if (Object.keys(operations).length >= 1024)
+                throw pluginError('provider_unavailable');
+            operations[operationId] = structuredClone(body);
+            if (Buffer.byteLength(JSON.stringify(operations)) > 2 * 1024 * 1024)
+                throw pluginError('provider_unavailable');
+            await this.writeUnlocked(reference, origin, { ...credential, operationBindings: operations });
+            return structuredClone(body);
+        });
+    }
+    async transaction(reference, origin, run) {
+        await mkdir(this.root, { recursive: true, mode: 0o700 });
+        const path = join(this.root, this.partition(reference, origin) + '.json');
+        const release = await lockfile.lock(this.root, { lockfilePath: path + '.lock', realpath: false, retries: { retries: 100, minTimeout: 20, maxTimeout: 100 } });
+        try {
+            return await run();
+        }
+        finally {
+            await release();
+        }
+    }
+}
+//# sourceMappingURL=management-credentials.js.map

package/lib/management-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"management-credentials.js","sourceRoot":"","sources":["../src/management-credentials.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACnG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,QAAQ,MAAM,iBAAiB,CAAA;AAGtC,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,iGAAiG;AACjG,MAAM,OAAO,mCAAmC;IACjB;IAA+B;IAA5D,YAA6B,IAAY,EAAmB,aAAoC;QAAnE,SAAI,GAAJ,IAAI,CAAQ;QAAmB,kBAAa,GAAb,aAAa,CAAuB;IAAG,CAAC;IAC5F,SAAS,CAAC,SAA4B,EAAE,MAAc;QAC5D,UAAU,CAAC,MAAM,CAAC,CAAA;QAClB,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAA;QAC3E,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACpI,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,SAA4B,EAAE,MAAc;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACnD,IAAI,KAAa,CAAA;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC;YAAC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAA;YAChF,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;gBAAE,MAAM,WAAW,CAAC,sBAAsB,CAAC,CAAA;YACvG,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAAC,MAAM,WAAW,CAAC,sBAAsB,CAAC,CAAA;QAAC,CAAC;QACvI,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;gBAAE,MAAM,WAAW,CAAC,sBAAsB,CAAC,CAAA;YAC9F,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAA;YACvF,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAA;YAC/F,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA+B,CAAA;YAC1K,IAAI,CAAC,UAAU,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,YAAY;gBAAE,MAAM,WAAW,CAAC,sBAAsB,CAAC,CAAA;YAC1H,OAAO,UAAU,CAAA;QACnB,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,WAAW,CAAC,sBAAsB,CAAC,CAAA;QAAC,CAAC;gBAAS,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAAC,CAAC;IAC/E,CAAC;IACO,KAAK,CAAC,aAAa,CAAC,SAA4B,EAAE,MAAc,EAAE,UAAsC;QAC9G,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACnD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,CAAA;QACjD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;QACtC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAAC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;YACjF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;YACrC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YAC7F,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAA;YAChK,MAAM,SAAS,GAAG,IAAI,GAAG,GAAG,GAAG,UAAU,EAAE,CAAA;YAC3C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;YAC/C,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAAC,CAAC;oBAAS,CAAC;gBAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;YAAC,CAAC;YACnG,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;gBAAC,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAAC,CAAC;oBAAS,CAAC;gBAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAAC,CAAC;QAC3H,CAAC;gBAAS,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAAC,CAAC;IAC3B,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,SAA4B,EAAE,MAAc,EAAE,UAAsC;QAC5F,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;YAClD,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,UAAU,EAAE,iBAAiB,EAAE,QAAQ,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC,CAAA;QACtH,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,KAAK,CAAC,gBAAgB,CAAC,SAA4B,EAAE,MAAc,EAAE,WAAmB,EAAE,IAA6B;QACrH,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;YACpD,IAAI,CAAC,UAAU;gBAAE,MAAM,WAAW,CAAC,sBAAsB,CAAC,CAAA;YAC1D,MAAM,UAAU,GAAG,UAAU,CAAC,iBAAiB,IAAI,EAAE,CAAA;YACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAA;YACxC,IAAI,QAAQ;gBAAE,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAA;YAC9C,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,IAAI;gBAAE,MAAM,WAAW,CAAC,sBAAsB,CAAC,CAAA;YACrF,UAAU,CAAC,WAAW,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;YAC/C,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;gBAAE,MAAM,WAAW,CAAC,sBAAsB,CAAC,CAAA;YAC9G,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,UAAU,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAA;YAC7F,OAAO,eAAe,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC,CAAC,CAAA;IACJ,CAAC;IACO,KAAK,CAAC,WAAW,CAAI,SAA4B,EAAE,MAAc,EAAE,GAAqB;QAC9F,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAA;QACzE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,GAAG,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;QAC7J,IAAI,CAAC;YAAC,OAAO,MAAM,GAAG,EAAE,CAAA;QAAC,CAAC;gBAAS,CAAC;YAAC,MAAM,OAAO,EAAE,CAAA;QAAC,CAAC;IACxD,CAAC;CAEF"}

package/lib/management-driver.d.ts

@@ -0,0 +1,83 @@
+import type { IdentityReference, JsonValue, VerifiedRemoteDocument } from '@agent-network-protocol/anp-identity';
+import type { ProviderLease } from '@agent-network-protocol/anp-identity/provider';
+import type { PublicationBackend } from './publication-types.js';
+import type { PapCallbackManagementOperations } from './pap-callback.js';
+export interface DeviceManagementCredential {
+    accessToken: string;
+    deviceId: string;
+    signingKeyId: string;
+    audience?: string;
+    operationBindings?: Record<string, Record<string, unknown>>;
+}
+/** The implementation must encrypt secrets at rest and partition by exact identity and service origin. */
+export interface ManagementCredentialBroker {
+    get(reference: IdentityReference, origin: string): Promise<DeviceManagementCredential | undefined>;
+    set(reference: IdentityReference, origin: string, credential: DeviceManagementCredential): Promise<void>;
+    reserveOperation(reference: IdentityReference, origin: string, operationId: string, body: Record<string, unknown>): Promise<Record<string, unknown>>;
+}
+export interface ManagedPublicationDriver extends PapCallbackManagementOperations {
+    readonly documentId: string;
+    readonly backend: PublicationBackend;
+    readonly reference: IdentityReference;
+    readVerifiedDocument(): Promise<VerifiedRemoteDocument>;
+}
+/** Create a device-authorized publication driver from a live Registry and an authenticated resolve.
+ * @param input - Host custody, protected credentials and the fixed User Service origin.
+ * @returns A driver bound to the server-resolved document id, never a user-supplied id.
+ */
+export declare function createManagedPublicationDriver(input: {
+    reference: IdentityReference;
+    origin: string;
+    credentials: ManagementCredentialBroker;
+    withNative<T>(operation: (native: ProviderLease) => Promise<T>): Promise<T>;
+    fetch?: typeof fetch;
+    /** Supplied by the Host installer to revoke this driver with its management Context and provider generation. */
+    assertActive?: () => Promise<void>;
+    /** Synchronous final epoch check immediately before physical sends and after body/native awaits. */
+    assertCurrent?: () => void;
+}): Promise<ManagedPublicationDriver>;
+/** Registration fields supplied through the trusted Host management flow, never persisted in the catalog. */
+export interface LocalRegistrationInput {
+    handle: string;
+    phone?: string;
+    otp_code?: string;
+    email?: string;
+    invite_code?: string;
+    name?: string;
+    registration_operation_id?: string;
+}
+/** Register a locally held E1 Manifest and retain only a live, server-verified device credential.
+ * @param input - Local identity, registration confirmation and protected broker.
+ * @returns Public registration facts. No Access Token is returned.
+ */
+export declare function registerLocalIdentity(input: {
+    reference: IdentityReference;
+    origin: string;
+    registration: LocalRegistrationInput;
+    credentials: ManagementCredentialBroker;
+    withNative<T>(operation: (native: ProviderLease) => Promise<T>): Promise<T>;
+    fetch?: typeof fetch;
+    managementAudience?: string;
+    handleDomain?: string;
+    assertActive?: () => void;
+}): Promise<{
+    did: string;
+    deviceId: string;
+    state: 'registered';
+}>;
+/** RFC 8785 serialization for native-produced JSON values.
+ * @param value - Finite JSON data, with keys ordered by UTF-16 code units.
+ * @returns Canonical UTF-8 text.
+ */
+export declare function canonicalManagementJson(value: JsonValue): string;
+/** Construct the exact Web registration business projection; OTP and proof freshness are excluded.
+ * @param input - Public local document and the explicit registration account/profile fields.
+ * @returns Projection checked by the local native signer and User Service.
+ */
+export declare function webRegistrationProjection(input: {
+    document: JsonValue;
+    registration: LocalRegistrationInput;
+    audience: string;
+    handleDomain: string;
+}): JsonValue;
+//# sourceMappingURL=management-driver.d.ts.map

package/lib/management-driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"management-driver.d.ts","sourceRoot":"","sources":["../src/management-driver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAA;AAChH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,+CAA+C,CAAA;AACjH,OAAO,KAAK,EAAE,kBAAkB,EAAgD,MAAM,wBAAwB,CAAA;AAO9G,OAAO,KAAK,EAAE,+BAA+B,EACkC,MAAM,mBAAmB,CAAA;AAExG,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAC5D;AACD,0GAA0G;AAC1G,MAAM,WAAW,0BAA0B;IACzC,GAAG,CAAC,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAAA;IAClG,GAAG,CAAC,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxG,gBAAgB,CAAC,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CACrJ;AAcD,MAAM,WAAW,wBAAyB,SAAQ,+BAA+B;IAC/E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;IACrC,oBAAoB,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAA;CACxD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAC1D,SAAS,EAAE,iBAAiB,CAAA;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,0BAA0B,CAAA;IACvC,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAC3E,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IACpB,gHAAgH;IAChH,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,oGAAoG;IACpG,aAAa,CAAC,EAAE,MAAM,IAAI,CAAA;CAC3B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAoMpC;AAED,6GAA6G;AAC7G,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,yBAAyB,CAAC,EAAE,MAAM,CAAA;CACnC;AACD;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,SAAS,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,sBAAsB,CAAC;IAAC,WAAW,EAAE,0BAA0B,CAAA;IAC3H,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAC3E,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,MAAM,IAAI,CAAA;CAC1B,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,CAAC,CAwElE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAOhE;AACD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,SAAS,CAAC;IAAC,YAAY,EAAE,sBAAsB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAejK"}

package/lib/management-driver.js

@@ -0,0 +1,405 @@
+/** Real User Service device-management transport. Credentials stay in the Host broker. */
+import { randomUUID, createHash } from 'node:crypto';
+import { exactHttps, parsePublicJson } from './publication-http.js';
+import { AnpIdentityPluginError, pluginError } from './errors.js';
+import { prepareInitialRegistrationProof } from './initial-registration-proof.js';
+import { createAuthenticatedHttp } from './http-auth.js';
+import { PapCallbackOperationSchema, PapCallbackRegistrationResultSchema, PapCallbackClaimResultSchema, PapCallbackManagementError, papCallbackManagementError } from './pap-callback.js';
+/** Sign the exact User Service request with the existing ANP HTTP signing port. */
+async function signedRequest(request, input) {
+    return input.withNative(native => createAuthenticatedHttp(input.reference, native, new Set([input.origin]), input.assertActive, async () => input.signingKeyId).dispatch(request, input.transport));
+}
+/** Create a device-authorized publication driver from a live Registry and an authenticated resolve.
+ * @param input - Host custody, protected credentials and the fixed User Service origin.
+ * @returns A driver bound to the server-resolved document id, never a user-supplied id.
+ */
+export async function createManagedPublicationDriver(input) {
+    const origin = exactHttps(input.origin);
+    if (new URL(origin).origin !== origin)
+        throw pluginError('invalid_request');
+    const transport = input.fetch ?? fetch;
+    const send = async (request, init) => {
+        await input.assertActive?.();
+        input.assertCurrent?.();
+        const auth = await credential();
+        const response = await signedRequest(new Request(request, init), {
+            reference, origin, signingKeyId: auth.signingKeyId, withNative: input.withNative,
+            transport: (request, init) => { input.assertCurrent?.(); return transport(request, init); },
+            assertActive: async () => { await input.assertActive?.(); input.assertCurrent?.(); },
+        });
+        try {
+            await input.assertActive?.();
+            input.assertCurrent?.();
+            return response;
+        }
+        catch (error) {
+            await response.body?.cancel();
+            throw error;
+        }
+    };
+    const reference = Object.freeze(structuredClone(input.reference));
+    const credential = async () => {
+        const value = await input.credentials.get(reference, origin);
+        if (!value || !value.deviceId || !value.signingKeyId)
+            throw pluginError('provider_unavailable');
+        return value;
+    };
+    const read = async (request, callbackErrors = false) => {
+        const response = await send(request);
+        if ((!callbackErrors && response.status !== 200) || response.redirected || !(response.headers.get('content-type') ?? '').startsWith('application/json')) {
+            await response.body?.cancel();
+            throw pluginError('provider_unavailable');
+        }
+        const reader = response.body?.getReader();
+        const parts = [];
+        let size = 0;
+        try {
+            while (reader) {
+                const part = await reader.read();
+                if (part.done)
+                    break;
+                size += part.value.length;
+                if (size > 131072)
+                    throw pluginError('provider_incompatible');
+                parts.push(part.value);
+            }
+            const result = parsePublicJson(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(parts)));
+            if (!result || typeof result !== 'object' || Array.isArray(result))
+                throw pluginError('provider_incompatible');
+            const object = result;
+            input.assertCurrent?.();
+            if (response.status !== 200)
+                throw papCallbackManagementError(object) ?? pluginError('provider_unavailable');
+            return object;
+        }
+        finally {
+            await reader?.cancel();
+            reader?.releaseLock();
+        }
+    };
+    const rpc = async (method, params) => {
+        const result = await read(new Request(origin + '/user-service/v1/did-auth/rpc', { method: 'POST', redirect: 'manual', signal: AbortSignal.timeout(15000),
+            headers: { 'content-type': 'application/json' }, body: JSON.stringify({ jsonrpc: '2.0', id: randomUUID(), method, params }) }));
+        if (result.error || !result.result || typeof result.result !== 'object' || Array.isArray(result.result))
+            throw pluginError('provider_unavailable');
+        return result.result;
+    };
+    const registry = async () => {
+        const current = await rpc('device_registry_get', {});
+        const auth = await credential();
+        const device = current.devices?.find(device => device.device_id === auth.deviceId);
+        if (current.did !== reference.did || !device || device.signing_key_id !== auth.signingKeyId
+            || device.status !== 'active' || device.role !== 'admin' || !device.management_ready
+            || !Number.isSafeInteger(current.checkpoint?.document_version) || !Number.isSafeInteger(current.checkpoint.registry_version)
+            || !/^sha256:[A-Za-z0-9_-]{43}$/u.test(current.checkpoint.document_hash))
+            throw pluginError('provider_incompatible');
+        return current;
+    };
+    const proof = async (method, params) => {
+        const auth = await credential();
+        return input.withNative(async (native) => {
+            const signer = native.signManagementProof;
+            if (typeof signer !== 'function')
+                throw pluginError('provider_incompatible');
+            return signer.call(native, reference, { key: { kid: auth.signingKeyId }, method, params,
+                ...(auth.audience === undefined ? {} : { audience: auth.audience }) });
+        });
+    };
+    const methods = { prepare: 'agent_client_prepare', activate: 'agent_client_activate',
+        status: 'agent_client_status', resolve: 'agent_client_resolve',
+        'pap-callback-register': 'agent_client_pap_callback_register', 'pap-callback-claim': 'agent_client_pap_callback_claim' };
+    const deviceResponse = async (action, operationId, extra = {}) => {
+        await input.assertActive?.();
+        const [current, auth] = await Promise.all([registry(), credential()]);
+        const httpPath = '/user-service/v1/agent-clients/device/' + action;
+        const proposed = { operation_id: operationId, expected_document_version: current.checkpoint.document_version,
+            expected_document_hash: current.checkpoint.document_hash, expected_registry_version: current.checkpoint.registry_version,
+            authorizing_device_id: auth.deviceId, ...extra };
+        const body = action === 'prepare' || action === 'activate' || action === 'pap-callback-register'
+            ? await input.credentials.reserveOperation(reference, origin, methods[action] + ':' + operationId, proposed) : proposed;
+        if (action === 'pap-callback-register' && JSON.stringify(body.callback) !== JSON.stringify(extra.callback))
+            throw pluginError('catalog_conflict');
+        const signed = await proof(methods[action], { ...body, http_path: httpPath, target_did: reference.did });
+        await input.assertActive?.();
+        const result = await read(new Request(origin + httpPath, { method: 'POST', redirect: 'manual', signal: AbortSignal.timeout(15000),
+            headers: { 'content-type': 'application/json' }, body: JSON.stringify({ ...body, authorizing_device_proof: signed }) }), action === 'pap-callback-register' || action === 'pap-callback-claim');
+        await input.assertActive?.();
+        return result;
+    };
+    const deviceCommand = async (action, operationId, extra = {}) => {
+        const result = await deviceResponse(action, operationId, extra);
+        if (result.did !== reference.did || typeof result.document_id !== 'string')
+            throw pluginError('provider_incompatible');
+        return result;
+    };
+    const resolved = await deviceCommand('resolve', randomUUID());
+    const documentId = resolved.document_id;
+    if (!/^[A-Za-z0-9_-]{1,128}$/u.test(documentId))
+        throw pluginError('provider_incompatible');
+    if (typeof resolved.client_id !== 'string' || typeof resolved.jwks_uri !== 'string')
+        throw pluginError('provider_incompatible');
+    const clientId = exactHttps(resolved.client_id, true);
+    const jwksUri = exactHttps(resolved.jwks_uri, true);
+    if (new URL(clientId).origin !== origin || new URL(jwksUri).origin !== origin)
+        throw pluginError('provider_incompatible');
+    const checkpointObservation = async () => {
+        const result = await deviceCommand('resolve', randomUUID());
+        const checkpoint = result.checkpoint;
+        if (!checkpoint || !Number.isSafeInteger(checkpoint.document_version) || !Number.isSafeInteger(checkpoint.registry_version)
+            || !/^sha256:[A-Za-z0-9_-]{43}$/u.test(checkpoint.document_hash) || !result.document || typeof result.document !== 'object')
+            throw pluginError('provider_incompatible');
+        return { document: result.document, evidence: { documentVersion: checkpoint.document_version,
+                registryVersion: checkpoint.registry_version, documentDigest: checkpoint.document_hash } };
+    };
+    const backend = {
+        origin, clientId: id => { if (id !== documentId)
+            throw pluginError('invalid_request'); return clientId; },
+        prepare: async (id, publication) => {
+            if (id !== documentId || !('schema_version' in publication))
+                throw pluginError('invalid_request');
+            return await deviceCommand('prepare', publication.operation_id, { publication: publication });
+        },
+        activate: async (id, operationId) => {
+            if (id !== documentId)
+                throw pluginError('invalid_request');
+            return await deviceCommand('activate', randomUUID(), { publication_operation_id: operationId });
+        },
+        readPublic: async (id, part, url) => {
+            if (id !== documentId)
+                throw pluginError('invalid_request');
+            const target = url ?? (part === 'client.json' ? clientId : jwksUri);
+            if (new URL(exactHttps(target, true)).origin !== origin)
+                throw pluginError('provider_incompatible');
+            const response = await send(new Request(target, { redirect: 'manual', signal: AbortSignal.timeout(15000) }));
+            if (response.status !== 200 || response.redirected) {
+                await response.body?.cancel();
+                throw pluginError('provider_unavailable');
+            }
+            const text = await response.text();
+            input.assertCurrent?.();
+            if (Buffer.byteLength(text) > 32768)
+                throw pluginError('provider_incompatible');
+            parsePublicJson(text);
+            return text;
+        },
+        publishDocument: async (requestedReference, session, assertActive) => {
+            if (JSON.stringify(requestedReference) !== JSON.stringify(reference))
+                throw pluginError('invalid_request');
+            await assertActive();
+            if (await session.hostPhase() === 'publication_uncertain') {
+                await session.reconcile(await checkpointObservation());
+                return;
+            }
+            const candidate = await session.candidate();
+            const previous = await input.withNative(native => native.publicIdentity(reference));
+            const oldDocument = previous.document;
+            const nextDocument = candidate.candidateDocument;
+            const methods = (document) => (document.authentication ?? []);
+            const oldKeys = methods(oldDocument);
+            const nextKeys = methods(nextDocument);
+            const add = nextKeys.filter(key => !oldKeys.includes(key));
+            const remove = oldKeys.filter(key => !nextKeys.includes(key));
+            const [current, auth] = await Promise.all([registry(), credential()]);
+            const base = candidate.baseEvidence;
+            if (!base || current.checkpoint.document_version !== base.documentVersion || current.checkpoint.registry_version !== base.registryVersion
+                || current.checkpoint.document_hash !== base.documentDigest && current.checkpoint.document_hash !== 'sha256:' + base.documentDigest)
+                throw pluginError('catalog_conflict');
+            const method = add.length || remove.length ? 'device_oauth_keys_update' : 'device_document_update';
+            const params = { operation_id: candidate.operationId, expected_document_version: base.documentVersion,
+                expected_document_hash: base.documentDigest.startsWith('sha256:') ? base.documentDigest : 'sha256:' + base.documentDigest, expected_registry_version: base.registryVersion,
+                authorizing_device_id: auth.deviceId, new_document: candidate.candidateDocument,
+                ...(method === 'device_oauth_keys_update' ? { add_key_ids: add, remove_key_ids: remove } : {}) };
+            const bound = await input.credentials.reserveOperation(reference, origin, method + ':' + candidate.operationId, params);
+            bound.authorizing_device_proof = await proof(method, bound);
+            const attempt = await session.beginPublication();
+            try {
+                await assertActive();
+                await rpc(method, bound);
+            }
+            catch {
+                await session.complete(attempt, { result: 'unknown' });
+                throw pluginError('provider_unavailable');
+            }
+            const observation = await checkpointObservation();
+            await assertActive();
+            // Reconcile compares the authoritative remote digest/document with the native pending candidate.
+            await session.complete(attempt, { result: 'unknown' });
+            await session.reconcile(observation);
+        },
+    };
+    async function execute(command) {
+        try {
+            await input.assertActive?.();
+            const parsed = PapCallbackOperationSchema.safeParse(command);
+            if (!parsed.success)
+                throw pluginError('invalid_request');
+            const value = parsed.data;
+            if (value.action === 'pap-callback-register') {
+                exactHttps(value.callback.issuer);
+                const expiry = Date.parse(value.callback.expires_at);
+                if (expiry <= Date.now() || expiry > Date.now() + 600000)
+                    throw pluginError('invalid_request');
+                if (value.callback.client_id !== clientId || value.callback.redirect_uri !== origin + '/user-service/v1/pap-callback')
+                    throw pluginError('invalid_request');
+                const result = await deviceResponse(value.action, value.operationId, { callback: value.callback });
+                const registered = PapCallbackRegistrationResultSchema.safeParse(result);
+                if (!registered.success || result.did !== reference.did || result.document_id !== documentId
+                    || registered.data.transaction_id !== value.callback.transaction_id || registered.data.callback_uri !== value.callback.redirect_uri
+                    || registered.data.expires_at !== value.callback.expires_at)
+                    throw pluginError('provider_incompatible');
+                return { transaction_id: registered.data.transaction_id, callback_uri: registered.data.callback_uri, expires_at: registered.data.expires_at };
+            }
+            // Claim results contain private business data and never use the publisher response or replay ledger.
+            const result = await deviceResponse(value.action, value.operationId, { callback: value.callback });
+            const claimed = PapCallbackClaimResultSchema.safeParse(result);
+            if (!claimed.success)
+                throw pluginError('provider_incompatible');
+            exactHttps(claimed.data.iss);
+            return claimed.data;
+        }
+        catch (error) {
+            if (error instanceof PapCallbackManagementError || error instanceof AnpIdentityPluginError)
+                throw error;
+            throw pluginError('provider_unavailable');
+        }
+    }
+    return { reference: structuredClone(reference), documentId, backend, readVerifiedDocument: checkpointObservation, execute };
+}
+/** Register a locally held E1 Manifest and retain only a live, server-verified device credential.
+ * @param input - Local identity, registration confirmation and protected broker.
+ * @returns Public registration facts. No Access Token is returned.
+ */
+export async function registerLocalIdentity(input) {
+    input.assertActive?.();
+    const origin = exactHttps(input.origin);
+    if (new URL(origin).origin !== origin || !input.reference.did.startsWith('did:wba:') && !input.reference.did.startsWith('did:web:'))
+        throw pluginError('provider_incompatible');
+    const identity = await input.withNative(native => native.publicIdentity(input.reference));
+    input.assertActive?.();
+    let registrationDocument = identity.document;
+    const document = identity.document;
+    // The live Registry below is authoritative; this list only identifies the locally held candidate key.
+    const candidates = identity.activeKeys.filter(key => key.purposes.includes('device_assertion'));
+    const web = input.reference.did.startsWith('did:web:');
+    if (candidates.length !== 1 || !web && !document.proof)
+        throw pluginError('provider_incompatible');
+    const registration = structuredClone(input.registration);
+    let bootstrap;
+    let initialProof;
+    if (web) {
+        if (!registration.registration_operation_id || !input.managementAudience)
+            throw pluginError('invalid_request');
+        const projection = webRegistrationProjection({ document: identity.document, registration, audience: input.managementAudience, handleDomain: input.handleDomain ?? new URL(origin).hostname });
+        bootstrap = await input.withNative(async (native) => {
+            const signer = native.signWebRegistrationProof;
+            if (typeof signer !== 'function')
+                throw pluginError('provider_incompatible');
+            return signer.call(native, input.reference, { key: { kid: candidates[0].kid }, business_projection: projection });
+        });
+    }
+    else {
+        if (registration.registration_operation_id)
+            throw pluginError('invalid_request');
+        if (await input.credentials.get(input.reference, origin))
+            throw pluginError('catalog_conflict');
+        input.assertActive?.();
+        initialProof = await input.withNative(native => prepareInitialRegistrationProof(native, identity, origin));
+        registrationDocument = initialProof.document;
+        input.assertActive?.();
+    }
+    const transport = input.fetch ?? fetch;
+    const send = async (request, init) => {
+        input.assertActive?.();
+        const response = await transport(request, init);
+        try {
+            input.assertActive?.();
+            return response;
+        }
+        catch (error) {
+            await response.body?.cancel();
+            throw error;
+        }
+    };
+    const request = new Request(origin + '/user-service/v1/did-auth/rpc', { method: 'POST', redirect: 'manual', signal: AbortSignal.timeout(15000),
+        headers: { 'content-type': 'application/json' }, body: JSON.stringify({ jsonrpc: '2.0', id: randomUUID(), method: 'register',
+            params: { ...registration, did_document: registrationDocument, is_agent: true, ...(bootstrap ? { bootstrap_proof: bootstrap } : {}) } }) });
+    if (initialProof)
+        await input.withNative(native => initialProof.assertCurrent(native));
+    input.assertActive?.();
+    const response = await send(request);
+    if (response.status !== 200 || response.redirected) {
+        await response.body?.cancel();
+        throw pluginError('provider_unavailable');
+    }
+    const bytes = await response.text();
+    input.assertActive?.();
+    if (Buffer.byteLength(bytes) > 32768)
+        throw pluginError('provider_incompatible');
+    const envelope = parsePublicJson(bytes);
+    const result = envelope.result;
+    if (envelope.error || result?.state !== 'registered' || result.did !== input.reference.did || typeof result.access_token !== 'string')
+        throw pluginError('provider_unavailable');
+    const token = result.access_token;
+    const registryResponse = await signedRequest(new Request(origin + '/user-service/v1/did-auth/rpc', { method: 'POST', redirect: 'manual', signal: AbortSignal.timeout(15000),
+        headers: { 'content-type': 'application/json' }, body: JSON.stringify({ jsonrpc: '2.0', id: randomUUID(), method: 'device_registry_get', params: {} }) }), {
+        reference: input.reference, origin, signingKeyId: candidates[0].kid, withNative: input.withNative,
+        transport: send, assertActive: async () => { input.assertActive?.(); },
+    });
+    if (registryResponse.status !== 200 || registryResponse.redirected) {
+        await registryResponse.body?.cancel();
+        throw pluginError('provider_unavailable');
+    }
+    const registryBytes = await registryResponse.text();
+    input.assertActive?.();
+    if (Buffer.byteLength(registryBytes) > 32768)
+        throw pluginError('provider_incompatible');
+    const registryEnvelope = parsePublicJson(registryBytes);
+    const registry = registryEnvelope.result;
+    const device = registry?.devices.find(device => device.signing_key_id === candidates[0].kid);
+    if (registryEnvelope.error || registry?.did !== input.reference.did || !device || device.status !== 'active'
+        || device.role !== 'admin' || !device.management_ready)
+        throw pluginError('provider_unavailable');
+    await input.credentials.set(input.reference, origin, { accessToken: token, deviceId: device.device_id, signingKeyId: device.signing_key_id, ...(web ? { audience: input.managementAudience } : {}) });
+    input.assertActive?.();
+    await input.withNative(native => native.adoptVerifiedDocument(input.reference, { document: registrationDocument,
+        evidence: { documentVersion: registry.checkpoint.document_version, registryVersion: registry.checkpoint.registry_version, documentDigest: registry.checkpoint.document_hash } }));
+    input.assertActive?.();
+    return { did: input.reference.did, deviceId: device.device_id, state: 'registered' };
+}
+/** RFC 8785 serialization for native-produced JSON values.
+ * @param value - Finite JSON data, with keys ordered by UTF-16 code units.
+ * @returns Canonical UTF-8 text.
+ */
+export function canonicalManagementJson(value) {
+    if (value === null || typeof value !== 'object') {
+        if (typeof value === 'number' && !Number.isFinite(value))
+            throw pluginError('invalid_request');
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value))
+        return '[' + value.map(canonicalManagementJson).join(',') + ']';
+    return '{' + Object.keys(value).sort().map(key => JSON.stringify(key) + ':' + canonicalManagementJson(value[key])).join(',') + '}';
+}
+/** Construct the exact Web registration business projection; OTP and proof freshness are excluded.
+ * @param input - Public local document and the explicit registration account/profile fields.
+ * @returns Projection checked by the local native signer and User Service.
+ */
+export function webRegistrationProjection(input) {
+    const document = input.document;
+    const manifest = document.deviceManifest;
+    const device = manifest?.devices?.[0];
+    if (manifest?.devices?.length !== 1 || !device || !input.registration.registration_operation_id)
+        throw pluginError('invalid_request');
+    const digest = (value) => 'sha256:' + createHash('sha256').update(value).digest('base64url');
+    const phone = input.registration.phone;
+    if (phone && !/^\+[1-9][0-9]{6,14}$/u.test(phone))
+        throw pluginError('invalid_request');
+    const handle = input.registration.handle.trim().toLowerCase();
+    return { contract: 'awiki.register.web.v1', audience: input.audience, registration_operation_id: input.registration.registration_operation_id,
+        full_handle: handle + '.' + input.handleDomain, did: document.id,
+        bootstrap_device: { device_id: device.device_id, signing_key_id: device.signing_key_id, e2ee_key_id: device.e2ee_key_id },
+        document_hash: digest(canonicalManagementJson(input.document)), account: { phone: phone ?? null, email: input.registration.email?.trim().toLowerCase() ?? null },
+        profile: { name: input.registration.name ?? null, avatar: null, role: null, endpoint_url: null, description: null, is_public: false, is_agent: true },
+        invite_code_hash: input.registration.invite_code ? digest(input.registration.invite_code.trim()) : null };
+}
+//# sourceMappingURL=management-driver.js.map