@agentunion/fastaun-browser 0.5.18 → 0.5.19

package/dist/aid-store.js

@@ -1,17 +1,19 @@
 import { AID } from './aid.js';
-import { CryptoProvider, pemToArrayBuffer, importPrivateKeyEcdsa, importCertPublicKeyEcdsa, ecdsaSignDer, ecdsaVerifyDer } from './crypto.js';
+import { CryptoProvider, pemToArrayBuffer, importPrivateKeyEcdsa, importCertPublicKeyEcdsa, ecdsaSignDer, ecdsaVerifyDer, certificateSha256Fingerprint } from './crypto.js';
 import * as codes from './error-codes.js';
 import { certMatchesFingerprint, publicKeyDerB64 } from './cert-utils.js';
 import { RegisterFlow } from './register-flow.js';
 import { GatewayDiscovery } from './discovery.js';
-import { ClientSignatureError, IdentityConflictError, NotFoundError, ValidationError } from './errors.js';
+import { AUNError, ClientSignatureError, IdentityConflictError, NotFoundError, StateError, ValidationError } from './errors.js';
 import { IndexedDBIdentityStore } from './keystore/indexeddb-identity-store.js';
 import { IndexedDBTokenStore } from './keystore/indexeddb-token-store.js';
 import { getDeviceId, normalizeSlotId } from './config.js';
 import { resultErr, resultOk } from './result.js';
 import { AgentMdManager, buildDefaultAgentMd } from './agent-md.js';
 import { AuthFlow } from './auth.js';
-import { OwnershipStatement, signOwnershipStatement } from './ownership-proof.js';
+import { parseOwnershipRegistrationIntent } from './ownership-workflow.js';
+import { validateAIDFormat } from './validators.js';
+import { validateAgentMdDocument } from './agent-md-schema.js';
 // ── 证书 DER 解析工具 ────────────────────────────────────────────
 function _derReadLength(data, offset) {
     if (offset >= data.length)
@@ -266,6 +268,8 @@ function resultError(result) {
     return result.ok ? null : result.error;
 }
 function agentMdFailure(exc) {
+    if (exc instanceof AUNError && exc.stringCode)
+        return resultErr(exc.stringCode, exc.message, exc);
     if (exc instanceof ClientSignatureError) {
         return resultErr(codes.SIGNATURE_INVALID, exc.message, exc);
     }
@@ -277,19 +281,6 @@ function agentMdFailure(exc) {
     }
     return resultErr(codes.NETWORK_ERROR, exc instanceof Error ? exc.message : String(exc), exc);
 }
-function ownerAgentMd(content, ownerAid, proof) {
-    const marker = content.indexOf('<!-- AUN-SIGNATURE');
-    const payload = marker >= 0 ? content.slice(0, marker) : content;
-    const lines = payload.replace(/\r\n/g, '\n').replace(/\r/g, '\n').split('\n');
-    const end = lines.findIndex((line, index) => index > 0 && line.trim() === '---');
-    if (end < 0)
-        throw new ValidationError('agent.md frontmatter is required for ownership operation');
-    const filtered = lines.filter((line, index) => !(index > 0 && index < end && (/^\s*owner\s*:/.test(line) || /^\s*ownership_proof\s*:/.test(line))));
-    const closed = filtered.findIndex((line, index) => index > 0 && line.trim() === '---');
-    filtered.splice(closed, 0, `owner: ${JSON.stringify(ownerAid)}`, `ownership_proof: ${JSON.stringify(proof)}`);
-    const result = filtered.join('\n');
-    return result.endsWith('\n') ? result : `${result}\n`;
-}
 export class AIDStore {
     aunPath;
     deviceId;
@@ -337,7 +328,10 @@ export class AIDStore {
             tokenStore: this._tokenStore,
             aidValidator: (target) => this._registerFlow.validateAidName(target),
             gatewayResolver: (target) => this._resolveGateway(target),
-            peerResolver: async (target, certFingerprint) => {
+            entityOwnerResolver: (target, type) => this._resolveEntityAgentMdOwner(target, type),
+            entityIdentityGetter: (target, type) => this._currentEntityCertificate(target, type ?? 'group'),
+            entitySignerResolver: (target, fingerprint) => this._currentEntitySigner(target, fingerprint),
+            peerResolver: async (target, certFingerprint, signedAt) => {
                 const fp = String(certFingerprint ?? '').trim().toLowerCase();
                 const cachedCert = await this._keystore.loadCert(target, fp || undefined);
                 if (cachedCert) {
@@ -349,7 +343,7 @@ export class AIDStore {
                     if (!response.ok)
                         throw new Error(`certificate not found for aid: ${target}`);
                     const certPem = await response.text();
-                    await this._verifyDownloadedPeerCertificate(gatewayUrl, target, certPem, fp);
+                    await this._verifyDownloadedPeerCertificate(gatewayUrl, target, certPem, fp, signedAt);
                     await this._keystore.saveCert(target, certPem, fp, { makeActive: false });
                     return await AID.create({ aid: target, aunPath: this.aunPath, certPem, privateKeyPem: null, certValid: true, privateKeyValid: false });
                 }
@@ -357,7 +351,7 @@ export class AIDStore {
                 const certPem = await this._registerFlow.fetchPeerCert(gatewayUrl, target);
                 if (!certPem)
                     throw new Error(`certificate not found for aid: ${target}`);
-                await this._verifyDownloadedPeerCertificate(gatewayUrl, target, certPem);
+                await this._verifyDownloadedPeerCertificate(gatewayUrl, target, certPem, undefined, signedAt);
                 await this._keystore.saveCert(target, certPem);
                 return await AID.create({ aid: target, aunPath: this.aunPath, certPem, privateKeyPem: null, certValid: true, privateKeyValid: false });
             },
@@ -386,6 +380,9 @@ export class AIDStore {
         catch (exc) {
             return resultErr(codes.CERT_PARSE_ERROR, `certificate parse failed for aid: ${target}`, exc);
         }
+        if (await this._tokenStore.getMetadata?.(target, 'invalidated_entity_certificate') === await certificateSha256Fingerprint(certPem)) {
+            return resultErr(codes.CERT_NOT_VALID, `group/org identity has been invalidated: ${target}`);
+        }
         // 有效期检查（对齐 Python cert_time_error）
         const validity = parseCertValidity(certPem);
         if (!validity) {
@@ -492,12 +489,25 @@ export class AIDStore {
     listAsync() {
         return this.list();
     }
-    async registerIdentity(aid, uploadDefault = true) {
+    async register(aid, options) {
         const target = String(aid ?? '').trim();
         try {
             if (!target)
                 throw new ValidationError("AIDStore.register requires 'aid'");
             this._registerFlow.validateAidName(target);
+            const type = String(options?.type ?? '').trim(), owner = String(options?.owner ?? '').trim().toLowerCase();
+            const entity = ['group', 'org'].includes(type);
+            if (!type || type === 'human' && owner || (type === 'agent' || entity) && !owner)
+                throw new ValidationError('register requires type; human forbids owner; agent/group/org requires owner');
+            if (owner)
+                validateAIDFormat(owner, 'owner');
+            const previousRaw = await this._tokenStore.getMetadata(target, 'registration_intent');
+            const previous = previousRaw ? parseOwnershipRegistrationIntent(previousRaw, target) : null;
+            const exttype = String(options?.exttype ?? '').trim();
+            if (previous && (previous.type !== type || previous.owner !== owner || previous.exttype !== exttype))
+                throw new StateError('ownership registration intent changed', { stringCode: 'conflict' });
+            const intent = previous ?? (entity ? { schema_version: 1, sub_aid: target, type, owner, exttype, protocol: 'entity', pending: false } : { schema_version: 1, sub_aid: target, type, owner, exttype, operation_id: crypto.randomUUID(), pending: Boolean(owner) });
+            await this._tokenStore.setMetadata(target, 'registration_intent', JSON.stringify(intent));
             const gatewayUrl = await this._resolveGateway(target);
             const result = await this._registerFlow.registerAid(gatewayUrl, target);
             if (result.cert) {
@@ -511,11 +521,16 @@ export class AIDStore {
                 });
             }
             await this._persistGatewayUrl(target, gatewayUrl);
-            if (uploadDefault)
-                await this.uploadAgentMd(target, buildDefaultAgentMd(target));
+            if (!entity) {
+                const snapshot = await this._agentMdManager.readOwnershipFresh(target).catch(() => null);
+                if (snapshot && !snapshot.exists && snapshot.relation_version === 0 && snapshot.lock === 'unlocked')
+                    await this.uploadAgentMd(target, buildDefaultAgentMd(target, { type, exttype: intent.exttype }));
+            }
             return resultOk({ registered: true });
         }
         catch (exc) {
+            if (exc instanceof StateError && exc.stringCode)
+                return resultErr(exc.stringCode, exc.message, exc);
             if (exc instanceof IdentityConflictError) {
                 return resultErr(codes.IDENTITY_CONFLICT, String(exc), exc);
             }
@@ -529,218 +544,6 @@ export class AIDStore {
             return resultErr(codes.SERVER_ERROR, message, exc);
         }
     }
-    async register(aidOrParams) {
-        if (typeof aidOrParams === 'string')
-            return await this.registerIdentity(aidOrParams);
-        const params = aidOrParams;
-        const target = String(params?.aid ?? '').trim();
-        const aidType = String(params?.type ?? '').trim().toLowerCase();
-        const owner = String(params?.owner ?? params?.owner_aid ?? '').trim();
-        if (!target || !aidType)
-            return resultErr(codes.INVALID_AID_FORMAT, 'register requires aid and type');
-        try {
-            const identity = await this.registerIdentity(target, false);
-            if (!identity.ok)
-                return identity;
-            const gatewayUrl = await this._resolveGateway(target);
-            const prepareParams = { aid: target, type: aidType };
-            if (owner)
-                prepareParams.owner = owner;
-            const idempotencyKey = params.idempotencyKey ?? params.idempotency_key;
-            if (idempotencyKey)
-                prepareParams.idempotency_key = idempotencyKey;
-            const prepared = await this._registerFlow.shortRpc(gatewayUrl, 'auth.aid_register_prepare', prepareParams);
-            const operationId = String(prepared.operation_id ?? '').trim();
-            if (!operationId)
-                throw new ValidationError('aid_register_prepare response missing operation_id');
-            let subjectSignature = params.subjectSignature ?? params.subject_signature;
-            const ownerSignature = params.ownerSignature ?? params.owner_signature;
-            if (!subjectSignature && owner) {
-                const loaded = await this.load(target);
-                if (loaded.ok) {
-                    const statement = OwnershipStatement.create(String(prepared.proof_id ?? ''), target, owner);
-                    const signed = await signOwnershipStatement({ certFingerprint: loaded.data.aid.certFingerprint, sign: (payload) => loaded.data.aid.sign(payload) }, statement);
-                    subjectSignature = { cert_fingerprint: signed.cert_fingerprint, signature: signed.signature };
-                }
-            }
-            const signatures = {};
-            if (subjectSignature)
-                signatures.subject_signature = subjectSignature;
-            if (ownerSignature)
-                signatures.owner_signature = ownerSignature;
-            let response = prepared;
-            if (Object.keys(signatures).length > 0)
-                response = await this._registerFlow.shortRpc(gatewayUrl, 'auth.aid_register_submit', { operation_id: operationId, ...signatures });
-            const state = String(response.state ?? response.operation_state ?? '').toLowerCase();
-            const complete = !owner || owner === target || (!!ownerSignature && !!subjectSignature);
-            if (complete && state === 'agent_md_pending') {
-                let content = params.agentMd ?? params.agent_md ?? buildDefaultAgentMd(target, { type: aidType });
-                if (owner) {
-                    const proof = { proof_id: prepared.proof_id, subject_aid: target, owner_aid: owner, fact_hash: prepared.fact_hash, statement_hash: prepared.statement_hash, subject_signature: subjectSignature };
-                    if (owner !== target)
-                        proof.owner_signature = ownerSignature;
-                    content = ownerAgentMd(content, owner, proof);
-                }
-                const uploaded = await this.uploadAgentMd(target, content, { ownerOperationId: operationId });
-                if (!uploaded.ok)
-                    return uploaded;
-                response = await this._registerFlow.shortRpc(gatewayUrl, 'auth.aid_register_activate', { operation_id: operationId });
-            }
-            return resultOk(response);
-        }
-        catch (exc) {
-            if (exc instanceof ValidationError)
-                return resultErr(codes.INVALID_AID_FORMAT, exc.message, exc);
-            return resultErr(codes.NETWORK_ERROR, exc instanceof Error ? exc.message : String(exc), exc);
-        }
-    }
-    async create(params) { return await this.register(params); }
-    async bindAid(params) {
-        const target = String(params?.aid ?? '').trim();
-        const aidType = String(params?.type ?? '').trim().toLowerCase();
-        const owner = String(params?.owner ?? params?.owner_aid ?? '').trim();
-        if (!target || !aidType)
-            return resultErr(codes.INVALID_AID_FORMAT, 'bindAid requires aid and type');
-        try {
-            this._registerFlow.validateAidName(target);
-            const gatewayUrl = await this._resolveGateway(target);
-            const prepareParams = { aid: target, type: aidType };
-            if (owner)
-                prepareParams.owner = owner;
-            const idempotencyKey = params.idempotencyKey ?? params.idempotency_key;
-            if (idempotencyKey)
-                prepareParams.idempotency_key = idempotencyKey;
-            const prepared = await this._registerFlow.shortRpc(gatewayUrl, 'auth.aid_bind_prepare', prepareParams);
-            const operationId = String(prepared.operation_id ?? '').trim();
-            if (!operationId)
-                throw new ValidationError('aid_bind_prepare response missing operation_id');
-            const signatures = {};
-            let subjectSignature = params.subjectSignature ?? params.subject_signature;
-            if (!subjectSignature && owner) {
-                const loaded = await this.load(target);
-                if (loaded.ok) {
-                    const statement = OwnershipStatement.create(String(prepared.proof_id ?? ''), target, owner);
-                    const signed = await signOwnershipStatement(loaded.data.aid, statement);
-                    subjectSignature = { cert_fingerprint: signed.cert_fingerprint, signature: signed.signature };
-                }
-            }
-            if (subjectSignature)
-                signatures.subject_signature = subjectSignature;
-            const ownerSignature = params.ownerSignature ?? params.owner_signature;
-            if (ownerSignature)
-                signatures.owner_signature = ownerSignature;
-            let response = prepared;
-            if (Object.keys(signatures).length > 0) {
-                response = await this._registerFlow.shortRpc(gatewayUrl, 'auth.aid_bind_submit', { operation_id: operationId, ...signatures });
-            }
-            const agentMd = params.agentMd ?? params.agent_md;
-            if (agentMd !== undefined) {
-                const uploaded = await this.uploadAgentMd(target, agentMd, {
-                    ownerOperationId: operationId,
-                });
-                if (!uploaded.ok)
-                    return uploaded;
-            }
-            const state = String(response.state ?? response.operation_state ?? '').toLowerCase();
-            if (state === 'agent_md_pending' || (!Object.keys(signatures).length && !owner && String(prepared.state ?? '') === 'agent_md_pending')) {
-                response = await this._registerFlow.shortRpc(gatewayUrl, 'auth.aid_bind_activate', { operation_id: operationId });
-            }
-            return resultOk(response);
-        }
-        catch (exc) {
-            if (exc instanceof ValidationError)
-                return resultErr(codes.INVALID_AID_FORMAT, exc.message, exc);
-            return resultErr(codes.NETWORK_ERROR, exc instanceof Error ? exc.message : String(exc), exc);
-        }
-    }
-    async getAidBindingStatus(aid) {
-        const target = String(aid ?? '').trim();
-        if (!target)
-            return resultErr(codes.INVALID_AID_FORMAT, 'getAidBindingStatus requires aid');
-        try {
-            this._registerFlow.validateAidName(target);
-            const gatewayUrl = await this._resolveGateway(target);
-            return resultOk(await this._registerFlow.shortRpc(gatewayUrl, 'auth.aid_bind_status', { aid: target }));
-        }
-        catch (exc) {
-            return resultErr(codes.NETWORK_ERROR, exc instanceof Error ? exc.message : String(exc), exc);
-        }
-    }
-    async resumeAidBinding(operationId) {
-        const target = String(operationId ?? '').trim();
-        if (!target)
-            return resultErr(codes.INVALID_AID_FORMAT, 'resumeAidBinding requires operationId');
-        try {
-            const gatewayUrl = await this._resolveGateway(target);
-            let response = await this._registerFlow.shortRpc(gatewayUrl, 'auth.aid_operation_get', { operation_id: target });
-            if (String(response.state ?? response.operation_state ?? '').toLowerCase() === 'agent_md_pending') {
-                const method = String(response.kind ?? '').toLowerCase() === 'owner_change' ? 'auth.owner_change_activate' : 'auth.aid_bind_activate';
-                response = await this._registerFlow.shortRpc(gatewayUrl, method, { operation_id: target });
-            }
-            return resultOk(response);
-        }
-        catch (exc) {
-            return resultErr(codes.NETWORK_ERROR, exc instanceof Error ? exc.message : String(exc), exc);
-        }
-    }
-    async bind_aid(params) { return this.bindAid(params); }
-    async get_aid_binding_status(aid) { return this.getAidBindingStatus(aid); }
-    async resume_aid_binding(operationId) { return this.resumeAidBinding(operationId); }
-    async changeOwner(params) {
-        const subject = String(params?.subject_aid ?? params?.aid ?? '').trim();
-        const newOwner = String(params?.new_owner_aid ?? params?.new_owner ?? '').trim();
-        if (!subject || !newOwner)
-            return resultErr(codes.INVALID_AID_FORMAT, 'changeOwner requires subject_aid and new_owner_aid');
-        try {
-            this._registerFlow.validateAidName(subject);
-            const gatewayUrl = await this._resolveGateway(subject);
-            const prepare = { subject_aid: subject, new_owner_aid: newOwner };
-            if (params.current_owner_aid ?? params.owner_aid)
-                prepare.current_owner_aid = params.current_owner_aid ?? params.owner_aid;
-            if (params.expected_relation_version !== undefined)
-                prepare.expected_relation_version = params.expected_relation_version;
-            if (params.idempotencyKey ?? params.idempotency_key)
-                prepare.idempotency_key = params.idempotencyKey ?? params.idempotency_key;
-            const prepared = await this._registerFlow.shortRpc(gatewayUrl, 'auth.owner_change_prepare', prepare);
-            const operationId = String(prepared.operation_id ?? '').trim();
-            if (!operationId)
-                throw new ValidationError('owner_change_prepare response missing operation_id');
-            const signatures = {};
-            for (const key of ['old_owner_signature', 'subject_signature', 'new_owner_signature'])
-                if (params[key])
-                    signatures[key] = params[key];
-            let response = prepared;
-            if (Object.keys(signatures).length > 0)
-                response = await this._registerFlow.shortRpc(gatewayUrl, 'auth.owner_change_submit', { operation_id: operationId, ...signatures });
-            if (String(response.state ?? response.operation_state ?? '').toLowerCase() === 'agent_md_pending' && (params.agentMd ?? params.agent_md) !== undefined) {
-                const proof = { proof_id: prepared.proof_id, subject_aid: subject, owner_aid: newOwner, fact_hash: prepared.fact_hash, statement_hash: prepared.statement_hash, subject_signature: params.subject_signature, owner_signature: params.new_owner_signature };
-                const content = ownerAgentMd(String(params.agentMd ?? params.agent_md), newOwner, proof);
-                const uploaded = await this.uploadAgentMd(subject, content, { ownerOperationId: operationId });
-                if (!uploaded.ok)
-                    return uploaded;
-                response = await this._registerFlow.shortRpc(gatewayUrl, 'auth.owner_change_activate', { operation_id: operationId });
-            }
-            return resultOk(response);
-        }
-        catch (exc) {
-            return resultErr(codes.NETWORK_ERROR, exc instanceof Error ? exc.message : String(exc), exc);
-        }
-    }
-    async resumeOwnerChange(operationId, aid) {
-        const id = String(operationId ?? '').trim();
-        if (!id)
-            return resultErr(codes.INVALID_AID_FORMAT, 'resumeOwnerChange requires operationId');
-        try {
-            const gatewayUrl = await this._resolveGateway(String(aid ?? id));
-            let response = await this._registerFlow.shortRpc(gatewayUrl, 'auth.aid_operation_get', { operation_id: id });
-            if (String(response.state ?? response.operation_state ?? '').toLowerCase() === 'agent_md_pending')
-                response = await this._registerFlow.shortRpc(gatewayUrl, 'auth.owner_change_activate', { operation_id: id });
-            return resultOk(response);
-        }
-        catch (exc) {
-            return resultErr(codes.NETWORK_ERROR, exc instanceof Error ? exc.message : String(exc), exc);
-        }
-    }
     async exists(aid) {
         const target = String(aid ?? '').trim();
         try {
@@ -812,12 +615,30 @@ export class AIDStore {
             return agentMdFailure(exc);
         }
     }
-    async _verifyDownloadedPeerCertificate(gatewayUrl, aid, certPem, certFingerprint = '') {
+    async _verifyDownloadedPeerCertificate(gatewayUrl, aid, certPem, certFingerprint = '', signedAt) {
         const expectedFp = String(certFingerprint ?? '').trim().toLowerCase();
         if (expectedFp && !(await certMatchesFingerprint(certPem, expectedFp))) {
             throw new ValidationError(`certificate fingerprint mismatch for aid: ${aid}`);
         }
-        await this._peerAuth.verifyPeerCertificate(gatewayUrl, certPem, aid);
+        if (signedAt === undefined)
+            await this._peerAuth.verifyPeerCertificate(gatewayUrl, certPem, aid);
+        else
+            await this._peerAuth.verifyPeerCertificate(gatewayUrl, certPem, aid, signedAt);
+    }
+    async _resolveEntityAgentMdOwner(aid, type) {
+        const authority = await this._agentMdManager.readEntityAuthorityFresh(aid);
+        const certificate = await this._currentEntityCertificate(aid, type);
+        if (authority.entity_cert_fingerprint !== certificate.certFingerprint)
+            throw new StateError('entity certificate authority changed', { stringCode: 'conflict' });
+        return authority.owner_aid;
+    }
+    async _currentEntityCertificate(aid, type) {
+        const cert = await this._peerAuth.resolveCurrentEntityCertificate(await this._resolveGateway(aid), aid, type);
+        return AID.create({ aid, aunPath: this.aunPath, certPem: cert.cert_pem, certValid: true, privateKeyPem: null, privateKeyValid: false });
+    }
+    async _currentEntitySigner(aid, fingerprint) {
+        const cert = await this._peerAuth.resolveOwnershipCertificate(await this._resolveGateway(aid), aid, fingerprint);
+        return AID.create({ aid, aunPath: this.aunPath, certPem: cert.cert_pem, certValid: true, privateKeyPem: null, privateKeyValid: false });
     }
     _authIdentityFromAid(aid) {
         return {
@@ -853,10 +674,14 @@ export class AIDStore {
                 return resultErr(loaded.error.code, loaded.error.message);
             }
             const current = loaded.data.aid;
-            if (!current.isPrivateKeyValid() || !current.privateKeyPem) {
+            const raw = content ?? await this._agentMdManager.readContent(target);
+            const parsed = validateAgentMdDocument(String(raw ?? ''), { expectedAid: target });
+            const meta = parsed.frontmatter;
+            const entity = ['group', 'org'].includes(String(meta.type));
+            if ((!current.isPrivateKeyValid() || !current.privateKeyPem) && !(entity && parsed.signature)) {
                 return resultErr(codes.PRIVATE_KEY_NOT_VALID, `uploadAgentMd requires local AID with a valid private key: ${target}`);
             }
-            const uploaderTarget = String(options.uploaderAid ?? options.uploader_aid ?? target).trim();
+            const uploaderTarget = String(options.uploaderAid ?? options.uploader_aid ?? (entity ? meta.owner : target)).trim();
             this._registerFlow.validateAidName(uploaderTarget);
             let uploader = current;
             if (uploaderTarget.toLowerCase() !== target.toLowerCase()) {
@@ -865,22 +690,24 @@ export class AIDStore {
                     return resultErr(uploaderLoaded.error.code, uploaderLoaded.error.message);
                 }
                 uploader = uploaderLoaded.data.aid;
-                if (!uploader.isPrivateKeyValid() || !uploader.privateKeyPem) {
-                    return resultErr(codes.PRIVATE_KEY_NOT_VALID, `uploadAgentMd requires uploader AID with a valid private key: ${uploaderTarget}`);
-                }
+            }
+            if (!uploader.isPrivateKeyValid() || !uploader.privateKeyPem) {
+                return resultErr(codes.PRIVATE_KEY_NOT_VALID, `uploadAgentMd requires uploader AID with a valid private key: ${uploaderTarget}`);
             }
             const manager = new AgentMdManager({
                 aunPath: this.aunPath,
                 tokenStore: this._tokenStore,
                 uploadViaGatewayHost: true,
-                ownerAidGetter: () => target,
-                currentAidGetter: () => current,
+                ownerAidGetter: () => uploaderTarget,
+                currentAidGetter: () => uploader,
+                entityOwnerResolver: options.entityOwnerResolver ?? ((value, type) => this._resolveEntityAgentMdOwner(value, type)),
+                entityIdentityGetter: options.entityIdentityGetter ?? ((value, type) => this._currentEntityCertificate(value, type ?? 'group')),
+                entitySignerResolver: options.entitySignerResolver ?? ((value, fingerprint) => this._currentEntitySigner(value, fingerprint)),
                 gatewayResolver: (value) => this._resolveGateway(value),
                 accessTokenResolver: async () => this._uploadAgentMdToken(uploader, await this._resolveGateway(uploaderTarget)),
                 aidValidator: (value) => this._registerFlow.validateAidName(value),
             });
-            const ownerOperationId = options.ownerOperationId ?? options.owner_operation_id;
-            return resultOk(await manager.upload(content, ownerOperationId));
+            return resultOk(entity ? await manager.uploadAs(target, String(raw), current) : await manager.upload(raw));
         }
         catch (exc) {
             return agentMdFailure(exc);
@@ -977,7 +804,45 @@ export class AIDStore {
                 return resultErr(codes.PRIVATE_KEY_REQUIRED, `private key required for aid: ${target}`);
             }
             const gatewayUrl = await this._resolveGateway(target);
-            const newIdentity = await this._registerFlow.generateIdentity();
+            const pendingStore = this._keystore;
+            let pendingDir = null;
+            let newIdentity = null;
+            for (const handle of await pendingStore.listPendingIdentityDirs(target)) {
+                const candidate = await pendingStore.loadPendingKeyPair(handle, target);
+                if (candidate?.rekey_pending === true) {
+                    pendingDir = handle;
+                    newIdentity = candidate;
+                    break;
+                }
+            }
+            if (newIdentity) {
+                const serverCert = await this._registerFlow.fetchPeerCert(gatewayUrl, target);
+                if (serverCert) {
+                    const validity = parseCertValidity(serverCert);
+                    const now = Date.now();
+                    if (publicKeyDerB64(serverCert) === newIdentity.public_key_der_b64
+                        && parseCertCN(serverCert) === target
+                        && validity && now >= validity.notBefore && now <= validity.notAfter) {
+                        await pendingStore.savePendingCert(pendingDir, serverCert);
+                        await this._keystore.saveIdentity(target, {
+                            aid: target, private_key_pem: newIdentity.private_key_pem,
+                            public_key_der_b64: newIdentity.public_key_der_b64, curve: newIdentity.curve, cert: serverCert,
+                        });
+                        await pendingStore.discardPendingIdentity(pendingDir);
+                        const refreshed = await this.load(target);
+                        if (!refreshed.ok || !refreshed.data)
+                            return resultErr(codes.REKEY_FAILED, 'rekeyed identity reload failed');
+                        return resultOk({ rekeyed: true, new_cert_not_after: refreshed.data.aid.certNotAfter, new_fingerprint: refreshed.data.aid.certFingerprint });
+                    }
+                }
+            }
+            else {
+                newIdentity = await this._registerFlow.generateIdentity();
+                pendingDir = await pendingStore.pendingIdentityDir(target);
+                await pendingStore.savePendingKeyPair(pendingDir, target, { ...newIdentity, aid: target, rekey_pending: true });
+            }
+            if (!pendingDir || !newIdentity)
+                return resultErr(codes.REKEY_FAILED, 'pending rekey identity is unavailable');
             const phase1 = await this._beginAidOperation(gatewayUrl, oldAid);
             const signPayload = `${String(phase1.nonce ?? '')}${newIdentity.public_key_der_b64}`;
             const signResult = await loaded.data.aid.sign(signPayload);
@@ -993,6 +858,7 @@ export class AIDStore {
             const certPem = String(response.cert ?? response.cert_pem ?? '').trim();
             if (!certPem)
                 return resultErr(codes.REKEY_FAILED, 'server response missing certificate');
+            await pendingStore.savePendingCert(pendingDir, certPem);
             const nextIdentity = {
                 aid: target,
                 private_key_pem: newIdentity.private_key_pem,
@@ -1001,6 +867,7 @@ export class AIDStore {
                 cert: certPem,
             };
             await this._keystore.saveIdentity(target, nextIdentity);
+            await pendingStore.discardPendingIdentity(pendingDir);
             const refreshed = await this.load(target);
             if (!refreshed.ok)
                 return resultErr(codes.REKEY_FAILED, 'rekeyed identity reload failed');