@agentunion/fastaun-browser 0.5.18 → 0.5.20

package/dist/aid-store.js

@@ -1,17 +1,37 @@
 import { AID } from './aid.js';
-import { CryptoProvider, pemToArrayBuffer, importPrivateKeyEcdsa, importCertPublicKeyEcdsa, ecdsaSignDer, ecdsaVerifyDer } from './crypto.js';
+import { CryptoProvider, pemToArrayBuffer, importPrivateKeyEcdsa, importCertPublicKeyEcdsa, ecdsaSignDer, ecdsaVerifyDer, certificateSha256Fingerprint } from './crypto.js';
 import * as codes from './error-codes.js';
-import { certMatchesFingerprint, publicKeyDerB64 } from './cert-utils.js';
+import { certMatchesFingerprint, parseAgentMdTailSignatureForRead, publicKeyDerB64, signDocument, verifyDocument, parseCertMetadata } from './cert-utils.js';
 import { RegisterFlow } from './register-flow.js';
 import { GatewayDiscovery } from './discovery.js';
-import { ClientSignatureError, IdentityConflictError, NotFoundError, ValidationError } from './errors.js';
+import { AUNError, ClientSignatureError, IdentityConflictError, NotFoundError, StateError, ValidationError } from './errors.js';
 import { IndexedDBIdentityStore } from './keystore/indexeddb-identity-store.js';
 import { IndexedDBTokenStore } from './keystore/indexeddb-token-store.js';
 import { getDeviceId, normalizeSlotId } from './config.js';
 import { resultErr, resultOk } from './result.js';
 import { AgentMdManager, buildDefaultAgentMd } from './agent-md.js';
 import { AuthFlow } from './auth.js';
-import { OwnershipStatement, signOwnershipStatement } from './ownership-proof.js';
+import { parseOwnershipRegistrationIntent } from './ownership-workflow.js';
+import { validateAIDFormat } from './validators.js';
+import { validateAgentMdDocument } from './agent-md-schema.js';
+async function readSigningInput(input, inputType = 'text') {
+    if (inputType === 'text') {
+        if (typeof input === 'string' || input instanceof Uint8Array)
+            return input;
+        throw new Error('text input requires a string or Uint8Array');
+    }
+    if (typeof input === 'string' || input instanceof Uint8Array)
+        throw new Error('browser file input does not support filesystem paths');
+    const file = 'getFile' in input ? await input.getFile() : input;
+    if (typeof file.arrayBuffer === 'function')
+        return new Uint8Array(await file.arrayBuffer());
+    return await new Promise((resolve, reject) => {
+        const reader = new FileReader();
+        reader.onload = () => resolve(new Uint8Array(reader.result));
+        reader.onerror = () => reject(reader.error);
+        reader.readAsArrayBuffer(file);
+    });
+}
 // ── 证书 DER 解析工具 ────────────────────────────────────────────
 function _derReadLength(data, offset) {
     if (offset >= data.length)
@@ -266,6 +286,8 @@ function resultError(result) {
     return result.ok ? null : result.error;
 }
 function agentMdFailure(exc) {
+    if (exc instanceof AUNError && exc.stringCode)
+        return resultErr(exc.stringCode, exc.message, exc);
     if (exc instanceof ClientSignatureError) {
         return resultErr(codes.SIGNATURE_INVALID, exc.message, exc);
     }
@@ -277,19 +299,6 @@ function agentMdFailure(exc) {
     }
     return resultErr(codes.NETWORK_ERROR, exc instanceof Error ? exc.message : String(exc), exc);
 }
-function ownerAgentMd(content, ownerAid, proof) {
-    const marker = content.indexOf('<!-- AUN-SIGNATURE');
-    const payload = marker >= 0 ? content.slice(0, marker) : content;
-    const lines = payload.replace(/\r\n/g, '\n').replace(/\r/g, '\n').split('\n');
-    const end = lines.findIndex((line, index) => index > 0 && line.trim() === '---');
-    if (end < 0)
-        throw new ValidationError('agent.md frontmatter is required for ownership operation');
-    const filtered = lines.filter((line, index) => !(index > 0 && index < end && (/^\s*owner\s*:/.test(line) || /^\s*ownership_proof\s*:/.test(line))));
-    const closed = filtered.findIndex((line, index) => index > 0 && line.trim() === '---');
-    filtered.splice(closed, 0, `owner: ${JSON.stringify(ownerAid)}`, `ownership_proof: ${JSON.stringify(proof)}`);
-    const result = filtered.join('\n');
-    return result.endsWith('\n') ? result : `${result}\n`;
-}
 export class AIDStore {
     aunPath;
     deviceId;
@@ -337,10 +346,15 @@ export class AIDStore {
             tokenStore: this._tokenStore,
             aidValidator: (target) => this._registerFlow.validateAidName(target),
             gatewayResolver: (target) => this._resolveGateway(target),
-            peerResolver: async (target, certFingerprint) => {
+            entityOwnerResolver: (target, type) => this._resolveEntityAgentMdOwner(target, type),
+            entityIdentityGetter: (target, type) => this._currentEntityCertificate(target, type ?? 'group'),
+            entitySignerResolver: (target, fingerprint) => this._currentEntitySigner(target, fingerprint),
+            peerResolver: async (target, certFingerprint, signedAt) => {
                 const fp = String(certFingerprint ?? '').trim().toLowerCase();
                 const cachedCert = await this._keystore.loadCert(target, fp || undefined);
                 if (cachedCert) {
+                    const gatewayUrl = await this._resolveGateway(target);
+                    await this._verifyDownloadedPeerCertificate(gatewayUrl, target, cachedCert, fp, signedAt);
                     return await AID.create({ aid: target, aunPath: this.aunPath, certPem: cachedCert, privateKeyPem: null, certValid: true, privateKeyValid: false });
                 }
                 if (fp) {
@@ -349,7 +363,7 @@ export class AIDStore {
                     if (!response.ok)
                         throw new Error(`certificate not found for aid: ${target}`);
                     const certPem = await response.text();
-                    await this._verifyDownloadedPeerCertificate(gatewayUrl, target, certPem, fp);
+                    await this._verifyDownloadedPeerCertificate(gatewayUrl, target, certPem, fp, signedAt);
                     await this._keystore.saveCert(target, certPem, fp, { makeActive: false });
                     return await AID.create({ aid: target, aunPath: this.aunPath, certPem, privateKeyPem: null, certValid: true, privateKeyValid: false });
                 }
@@ -357,7 +371,7 @@ export class AIDStore {
                 const certPem = await this._registerFlow.fetchPeerCert(gatewayUrl, target);
                 if (!certPem)
                     throw new Error(`certificate not found for aid: ${target}`);
-                await this._verifyDownloadedPeerCertificate(gatewayUrl, target, certPem);
+                await this._verifyDownloadedPeerCertificate(gatewayUrl, target, certPem, undefined, signedAt);
                 await this._keystore.saveCert(target, certPem);
                 return await AID.create({ aid: target, aunPath: this.aunPath, certPem, privateKeyPem: null, certValid: true, privateKeyValid: false });
             },
@@ -371,6 +385,76 @@ export class AIDStore {
         if (typeof closeTokens === 'function')
             closeTokens.call(this._tokenStore);
     }
+    async sign(aid, input, options = {}) {
+        try {
+            if (options.inputType !== undefined && !['text', 'file'].includes(options.inputType) || options.format !== undefined && !['raw', 'document'].includes(options.format))
+                throw new Error('unsupported signing inputType or format');
+            if (options.append && options.format !== 'document')
+                throw new Error('append requires document format');
+            if (options.inPlace && (options.inputType !== 'file' || options.format !== 'document' || typeof input !== 'object' || !('createWritable' in input) || typeof input.createWritable !== 'function'))
+                throw new Error('inPlace document signing requires a writable file handle');
+            const loaded = options.identity ? resultOk({ aid: options.identity }) : await this.load(aid);
+            if (!loaded.ok)
+                return loaded;
+            if (loaded.data.aid.aid !== aid || parseCertMetadata(loaded.data.aid.certPem).subject.toLowerCase() !== aid.toLowerCase())
+                throw new Error('signing identity does not match AID');
+            const raw = await readSigningInput(input, options.inputType);
+            if (typeof raw === 'string' && new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(new TextEncoder().encode(raw)) !== raw)
+                throw new Error('signing input must be valid UTF-8');
+            if (options.format !== 'document')
+                return await loaded.data.aid.sign(raw);
+            const content = typeof raw === 'string' ? raw : new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(raw);
+            const result = await signDocument(loaded.data.aid, content, options);
+            if (options.inPlace) {
+                const writable = await input.createWritable();
+                await writable.write(result.signed);
+                await writable.close();
+            }
+            return resultOk(result);
+        }
+        catch (exc) {
+            return resultErr(codes.SIGNATURE_OPERATION_ERROR, String(exc), exc);
+        }
+    }
+    async verify(aid, input, signatureOrOptions = {}, options = {}) {
+        try {
+            const opts = typeof signatureOrOptions === 'string' ? options : signatureOrOptions;
+            if (opts.inputType !== undefined && !['text', 'file'].includes(opts.inputType) || opts.format !== undefined && !['raw', 'document'].includes(opts.format))
+                throw new Error('unsupported verification inputType or format');
+            if (opts.identity && (opts.identity.aid !== aid || parseCertMetadata(opts.identity.certPem).subject.toLowerCase() !== aid.toLowerCase()))
+                throw new Error('verification identity does not match AID');
+            const raw = await readSigningInput(input, opts.inputType);
+            if (typeof raw === 'string' && new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(new TextEncoder().encode(raw)) !== raw)
+                throw new Error('verification input must be valid UTF-8');
+            if (opts.format === 'document') {
+                const content = typeof raw === 'string' ? raw : new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(raw);
+                const resolver = opts.certificateResolver ?? (async (signer, fingerprint) => {
+                    if (opts.identity?.aid === signer)
+                        return opts.identity;
+                    const resolved = await this.load(signer);
+                    if (!resolved.ok)
+                        throw new Error(resolved.error.message);
+                    return resolved.data.aid;
+                });
+                return resultOk(await verifyDocument(content, resolver, { expectedAid: aid }));
+            }
+            if (typeof signatureOrOptions !== 'string')
+                throw new Error('raw verification requires a detached signature');
+            const supplied = !opts.identity && opts.certificateResolver ? await opts.certificateResolver(aid, '', 0) : undefined;
+            if (supplied && typeof supplied !== 'string' && 'aid' in supplied && supplied.aid !== aid)
+                throw new Error('verification certificate identity does not match AID');
+            const suppliedPem = typeof supplied === 'string' ? supplied : supplied?.certPem;
+            const loaded = opts.identity ? resultOk({ aid: opts.identity }) : suppliedPem ? resultOk({ aid: await AID.create({ aid, aunPath: this.aunPath, certPem: suppliedPem, privateKeyPem: null, certValid: true, privateKeyValid: false }) }) : await this.load(aid);
+            if (!loaded.ok)
+                return loaded;
+            if (loaded.data.aid.aid !== aid || parseCertMetadata(loaded.data.aid.certPem).subject.toLowerCase() !== aid.toLowerCase())
+                throw new Error('verification identity does not match AID');
+            return await loaded.data.aid.verify(raw, signatureOrOptions);
+        }
+        catch (exc) {
+            return resultErr(codes.VERIFICATION_OPERATION_ERROR, String(exc), exc);
+        }
+    }
     async load(aid) {
         const target = String(aid ?? '').trim();
         const certPem = await this._keystore.loadCert(target);
@@ -386,6 +470,9 @@ export class AIDStore {
         catch (exc) {
             return resultErr(codes.CERT_PARSE_ERROR, `certificate parse failed for aid: ${target}`, exc);
         }
+        if (await this._tokenStore.getMetadata?.(target, 'invalidated_entity_certificate') === await certificateSha256Fingerprint(certPem)) {
+            return resultErr(codes.CERT_NOT_VALID, `group/org identity has been invalidated: ${target}`);
+        }
         // 有效期检查（对齐 Python cert_time_error）
         const validity = parseCertValidity(certPem);
         if (!validity) {
@@ -492,12 +579,26 @@ export class AIDStore {
     listAsync() {
         return this.list();
     }
-    async registerIdentity(aid, uploadDefault = true) {
+    async register(aid, options) {
         const target = String(aid ?? '').trim();
         try {
             if (!target)
                 throw new ValidationError("AIDStore.register requires 'aid'");
             this._registerFlow.validateAidName(target);
+            const type = String(options?.type ?? '').trim(), owner = String(options?.owner ?? '').trim().toLowerCase();
+            const entity = ['group', 'org'].includes(type);
+            if (!type || type === 'human' && owner || entity && !owner)
+                throw new ValidationError('register requires type; human forbids owner; group/org requires owner');
+            if (owner)
+                validateAIDFormat(owner, 'owner');
+            const previousRaw = await this._tokenStore.getMetadata(target, 'registration_intent');
+            const previous = previousRaw ? parseOwnershipRegistrationIntent(previousRaw, target) : null;
+            const exttype = String(options?.exttype ?? '').trim();
+            if (previous && (previous.type !== type || previous.owner !== owner || previous.exttype !== exttype))
+                throw new StateError('ownership registration intent changed', { stringCode: 'conflict' });
+            const intent = previous ?? (entity ? { schema_version: 1, sub_aid: target, type, owner, exttype, protocol: 'entity', pending: false } : { schema_version: 1, sub_aid: target, type, owner, exttype, operation_id: crypto.randomUUID(), pending: Boolean(owner) });
+            if (type !== 'agent' || owner)
+                await this._tokenStore.setMetadata(target, 'registration_intent', JSON.stringify(intent));
             const gatewayUrl = await this._resolveGateway(target);
             const result = await this._registerFlow.registerAid(gatewayUrl, target);
             if (result.cert) {
@@ -511,11 +612,16 @@ export class AIDStore {
                 });
             }
             await this._persistGatewayUrl(target, gatewayUrl);
-            if (uploadDefault)
-                await this.uploadAgentMd(target, buildDefaultAgentMd(target));
+            if (!entity) {
+                const snapshot = await this._agentMdManager.readOwnershipFresh(target).catch(() => null);
+                if (snapshot && !snapshot.exists && snapshot.relation_version === 0 && snapshot.lock === 'unlocked')
+                    await this.uploadAgentMd(target, buildDefaultAgentMd(target, { type, exttype: intent.exttype }));
+            }
             return resultOk({ registered: true });
         }
         catch (exc) {
+            if (exc instanceof StateError && exc.stringCode)
+                return resultErr(exc.stringCode, exc.message, exc);
             if (exc instanceof IdentityConflictError) {
                 return resultErr(codes.IDENTITY_CONFLICT, String(exc), exc);
             }
@@ -529,218 +635,6 @@ export class AIDStore {
             return resultErr(codes.SERVER_ERROR, message, exc);
         }
     }
-    async register(aidOrParams) {
-        if (typeof aidOrParams === 'string')
-            return await this.registerIdentity(aidOrParams);
-        const params = aidOrParams;
-        const target = String(params?.aid ?? '').trim();
-        const aidType = String(params?.type ?? '').trim().toLowerCase();
-        const owner = String(params?.owner ?? params?.owner_aid ?? '').trim();
-        if (!target || !aidType)
-            return resultErr(codes.INVALID_AID_FORMAT, 'register requires aid and type');
-        try {
-            const identity = await this.registerIdentity(target, false);
-            if (!identity.ok)
-                return identity;
-            const gatewayUrl = await this._resolveGateway(target);
-            const prepareParams = { aid: target, type: aidType };
-            if (owner)
-                prepareParams.owner = owner;
-            const idempotencyKey = params.idempotencyKey ?? params.idempotency_key;
-            if (idempotencyKey)
-                prepareParams.idempotency_key = idempotencyKey;
-            const prepared = await this._registerFlow.shortRpc(gatewayUrl, 'auth.aid_register_prepare', prepareParams);
-            const operationId = String(prepared.operation_id ?? '').trim();
-            if (!operationId)
-                throw new ValidationError('aid_register_prepare response missing operation_id');
-            let subjectSignature = params.subjectSignature ?? params.subject_signature;
-            const ownerSignature = params.ownerSignature ?? params.owner_signature;
-            if (!subjectSignature && owner) {
-                const loaded = await this.load(target);
-                if (loaded.ok) {
-                    const statement = OwnershipStatement.create(String(prepared.proof_id ?? ''), target, owner);
-                    const signed = await signOwnershipStatement({ certFingerprint: loaded.data.aid.certFingerprint, sign: (payload) => loaded.data.aid.sign(payload) }, statement);
-                    subjectSignature = { cert_fingerprint: signed.cert_fingerprint, signature: signed.signature };
-                }
-            }
-            const signatures = {};
-            if (subjectSignature)
-                signatures.subject_signature = subjectSignature;
-            if (ownerSignature)
-                signatures.owner_signature = ownerSignature;
-            let response = prepared;
-            if (Object.keys(signatures).length > 0)
-                response = await this._registerFlow.shortRpc(gatewayUrl, 'auth.aid_register_submit', { operation_id: operationId, ...signatures });
-            const state = String(response.state ?? response.operation_state ?? '').toLowerCase();
-            const complete = !owner || owner === target || (!!ownerSignature && !!subjectSignature);
-            if (complete && state === 'agent_md_pending') {
-                let content = params.agentMd ?? params.agent_md ?? buildDefaultAgentMd(target, { type: aidType });
-                if (owner) {
-                    const proof = { proof_id: prepared.proof_id, subject_aid: target, owner_aid: owner, fact_hash: prepared.fact_hash, statement_hash: prepared.statement_hash, subject_signature: subjectSignature };
-                    if (owner !== target)
-                        proof.owner_signature = ownerSignature;
-                    content = ownerAgentMd(content, owner, proof);
-                }
-                const uploaded = await this.uploadAgentMd(target, content, { ownerOperationId: operationId });
-                if (!uploaded.ok)
-                    return uploaded;
-                response = await this._registerFlow.shortRpc(gatewayUrl, 'auth.aid_register_activate', { operation_id: operationId });
-            }
-            return resultOk(response);
-        }
-        catch (exc) {
-            if (exc instanceof ValidationError)
-                return resultErr(codes.INVALID_AID_FORMAT, exc.message, exc);
-            return resultErr(codes.NETWORK_ERROR, exc instanceof Error ? exc.message : String(exc), exc);
-        }
-    }
-    async create(params) { return await this.register(params); }
-    async bindAid(params) {
-        const target = String(params?.aid ?? '').trim();
-        const aidType = String(params?.type ?? '').trim().toLowerCase();
-        const owner = String(params?.owner ?? params?.owner_aid ?? '').trim();
-        if (!target || !aidType)
-            return resultErr(codes.INVALID_AID_FORMAT, 'bindAid requires aid and type');
-        try {
-            this._registerFlow.validateAidName(target);
-            const gatewayUrl = await this._resolveGateway(target);
-            const prepareParams = { aid: target, type: aidType };
-            if (owner)
-                prepareParams.owner = owner;
-            const idempotencyKey = params.idempotencyKey ?? params.idempotency_key;
-            if (idempotencyKey)
-                prepareParams.idempotency_key = idempotencyKey;
-            const prepared = await this._registerFlow.shortRpc(gatewayUrl, 'auth.aid_bind_prepare', prepareParams);
-            const operationId = String(prepared.operation_id ?? '').trim();
-            if (!operationId)
-                throw new ValidationError('aid_bind_prepare response missing operation_id');
-            const signatures = {};
-            let subjectSignature = params.subjectSignature ?? params.subject_signature;
-            if (!subjectSignature && owner) {
-                const loaded = await this.load(target);
-                if (loaded.ok) {
-                    const statement = OwnershipStatement.create(String(prepared.proof_id ?? ''), target, owner);
-                    const signed = await signOwnershipStatement(loaded.data.aid, statement);
-                    subjectSignature = { cert_fingerprint: signed.cert_fingerprint, signature: signed.signature };
-                }
-            }
-            if (subjectSignature)
-                signatures.subject_signature = subjectSignature;
-            const ownerSignature = params.ownerSignature ?? params.owner_signature;
-            if (ownerSignature)
-                signatures.owner_signature = ownerSignature;
-            let response = prepared;
-            if (Object.keys(signatures).length > 0) {
-                response = await this._registerFlow.shortRpc(gatewayUrl, 'auth.aid_bind_submit', { operation_id: operationId, ...signatures });
-            }
-            const agentMd = params.agentMd ?? params.agent_md;
-            if (agentMd !== undefined) {
-                const uploaded = await this.uploadAgentMd(target, agentMd, {
-                    ownerOperationId: operationId,
-                });
-                if (!uploaded.ok)
-                    return uploaded;
-            }
-            const state = String(response.state ?? response.operation_state ?? '').toLowerCase();
-            if (state === 'agent_md_pending' || (!Object.keys(signatures).length && !owner && String(prepared.state ?? '') === 'agent_md_pending')) {
-                response = await this._registerFlow.shortRpc(gatewayUrl, 'auth.aid_bind_activate', { operation_id: operationId });
-            }
-            return resultOk(response);
-        }
-        catch (exc) {
-            if (exc instanceof ValidationError)
-                return resultErr(codes.INVALID_AID_FORMAT, exc.message, exc);
-            return resultErr(codes.NETWORK_ERROR, exc instanceof Error ? exc.message : String(exc), exc);
-        }
-    }
-    async getAidBindingStatus(aid) {
-        const target = String(aid ?? '').trim();
-        if (!target)
-            return resultErr(codes.INVALID_AID_FORMAT, 'getAidBindingStatus requires aid');
-        try {
-            this._registerFlow.validateAidName(target);
-            const gatewayUrl = await this._resolveGateway(target);
-            return resultOk(await this._registerFlow.shortRpc(gatewayUrl, 'auth.aid_bind_status', { aid: target }));
-        }
-        catch (exc) {
-            return resultErr(codes.NETWORK_ERROR, exc instanceof Error ? exc.message : String(exc), exc);
-        }
-    }
-    async resumeAidBinding(operationId) {
-        const target = String(operationId ?? '').trim();
-        if (!target)
-            return resultErr(codes.INVALID_AID_FORMAT, 'resumeAidBinding requires operationId');
-        try {
-            const gatewayUrl = await this._resolveGateway(target);
-            let response = await this._registerFlow.shortRpc(gatewayUrl, 'auth.aid_operation_get', { operation_id: target });
-            if (String(response.state ?? response.operation_state ?? '').toLowerCase() === 'agent_md_pending') {
-                const method = String(response.kind ?? '').toLowerCase() === 'owner_change' ? 'auth.owner_change_activate' : 'auth.aid_bind_activate';
-                response = await this._registerFlow.shortRpc(gatewayUrl, method, { operation_id: target });
-            }
-            return resultOk(response);
-        }
-        catch (exc) {
-            return resultErr(codes.NETWORK_ERROR, exc instanceof Error ? exc.message : String(exc), exc);
-        }
-    }
-    async bind_aid(params) { return this.bindAid(params); }
-    async get_aid_binding_status(aid) { return this.getAidBindingStatus(aid); }
-    async resume_aid_binding(operationId) { return this.resumeAidBinding(operationId); }
-    async changeOwner(params) {
-        const subject = String(params?.subject_aid ?? params?.aid ?? '').trim();
-        const newOwner = String(params?.new_owner_aid ?? params?.new_owner ?? '').trim();
-        if (!subject || !newOwner)
-            return resultErr(codes.INVALID_AID_FORMAT, 'changeOwner requires subject_aid and new_owner_aid');
-        try {
-            this._registerFlow.validateAidName(subject);
-            const gatewayUrl = await this._resolveGateway(subject);
-            const prepare = { subject_aid: subject, new_owner_aid: newOwner };
-            if (params.current_owner_aid ?? params.owner_aid)
-                prepare.current_owner_aid = params.current_owner_aid ?? params.owner_aid;
-            if (params.expected_relation_version !== undefined)
-                prepare.expected_relation_version = params.expected_relation_version;
-            if (params.idempotencyKey ?? params.idempotency_key)
-                prepare.idempotency_key = params.idempotencyKey ?? params.idempotency_key;
-            const prepared = await this._registerFlow.shortRpc(gatewayUrl, 'auth.owner_change_prepare', prepare);
-            const operationId = String(prepared.operation_id ?? '').trim();
-            if (!operationId)
-                throw new ValidationError('owner_change_prepare response missing operation_id');
-            const signatures = {};
-            for (const key of ['old_owner_signature', 'subject_signature', 'new_owner_signature'])
-                if (params[key])
-                    signatures[key] = params[key];
-            let response = prepared;
-            if (Object.keys(signatures).length > 0)
-                response = await this._registerFlow.shortRpc(gatewayUrl, 'auth.owner_change_submit', { operation_id: operationId, ...signatures });
-            if (String(response.state ?? response.operation_state ?? '').toLowerCase() === 'agent_md_pending' && (params.agentMd ?? params.agent_md) !== undefined) {
-                const proof = { proof_id: prepared.proof_id, subject_aid: subject, owner_aid: newOwner, fact_hash: prepared.fact_hash, statement_hash: prepared.statement_hash, subject_signature: params.subject_signature, owner_signature: params.new_owner_signature };
-                const content = ownerAgentMd(String(params.agentMd ?? params.agent_md), newOwner, proof);
-                const uploaded = await this.uploadAgentMd(subject, content, { ownerOperationId: operationId });
-                if (!uploaded.ok)
-                    return uploaded;
-                response = await this._registerFlow.shortRpc(gatewayUrl, 'auth.owner_change_activate', { operation_id: operationId });
-            }
-            return resultOk(response);
-        }
-        catch (exc) {
-            return resultErr(codes.NETWORK_ERROR, exc instanceof Error ? exc.message : String(exc), exc);
-        }
-    }
-    async resumeOwnerChange(operationId, aid) {
-        const id = String(operationId ?? '').trim();
-        if (!id)
-            return resultErr(codes.INVALID_AID_FORMAT, 'resumeOwnerChange requires operationId');
-        try {
-            const gatewayUrl = await this._resolveGateway(String(aid ?? id));
-            let response = await this._registerFlow.shortRpc(gatewayUrl, 'auth.aid_operation_get', { operation_id: id });
-            if (String(response.state ?? response.operation_state ?? '').toLowerCase() === 'agent_md_pending')
-                response = await this._registerFlow.shortRpc(gatewayUrl, 'auth.owner_change_activate', { operation_id: id });
-            return resultOk(response);
-        }
-        catch (exc) {
-            return resultErr(codes.NETWORK_ERROR, exc instanceof Error ? exc.message : String(exc), exc);
-        }
-    }
     async exists(aid) {
         const target = String(aid ?? '').trim();
         try {
@@ -766,7 +660,12 @@ export class AIDStore {
             let peer;
             let certFromCache = false;
             const cached = await this.load(target);
-            if (cached.ok && !forceRefresh) {
+            const localIdentity = !cached.ok && cached.error.code === codes.CERT_EXPIRED && !forceRefresh && !skipAgentMd ? await this._expiredIdentityForAgentMdRead(target) : null;
+            if (localIdentity) {
+                peer = localIdentity;
+                certFromCache = true;
+            }
+            else if (cached.ok && !forceRefresh) {
                 peer = cached.data.aid;
                 certFromCache = true;
             }
@@ -786,6 +685,15 @@ export class AIDStore {
             const source = { cert_from_cache: certFromCache, agent_md_fetched: false };
             if (skipAgentMd)
                 return resultOk({ aid: peer, source });
+            if (!forceRefresh && (localIdentity || peer.isPrivateKeyValid() && peer.privateKeyPem)) {
+                const record = await this._agentMdManager.loadRecord(target, true);
+                const draft = String(record?.local_draft_content ?? '');
+                const local = draft || await this._agentMdManager.readContent(target);
+                if (local) {
+                    const etag = await AgentMdManager.contentEtag(local);
+                    return resultOk({ aid: peer, source, agent_md: { aid: target, content: local, verification: { status: 'unverified' }, signature: { status: 'unverified' }, cert_pem: peer.certPem, etag: draft ? '' : etag, last_modified: String(record?.last_modified ?? ''), status: 0, in_sync: draft ? false : etag === record?.remote_etag, saved_to: null, save_error: null } });
+                }
+            }
             const agentMd = await this.downloadAgentMd(target, opts?.timeout);
             if (!agentMd.ok)
                 return agentMd;
@@ -796,6 +704,25 @@ export class AIDStore {
             return resultErr(codes.NETWORK_ERROR, String(exc), exc);
         }
     }
+    async _expiredIdentityForAgentMdRead(target) {
+        const record = await this._agentMdManager.loadRecord(target, true);
+        if (!String(record?.local_draft_content ?? '') && !await this._agentMdManager.readContent(target))
+            return null;
+        const certPem = await this._keystore.loadCert(target);
+        const keyPair = await this._keystore.loadKeyPair(target);
+        if (!certPem || !keyPair?.private_key_pem || parseCertCN(certPem) !== target)
+            return null;
+        try {
+            const privateKey = await importPrivateKeyEcdsa(String(keyPair.private_key_pem));
+            const probe = new TextEncoder().encode('aun-aidstore-private-key-self-test');
+            if (!await ecdsaVerifyDer(await importCertPublicKeyEcdsa(certPem), await ecdsaSignDer(privateKey, probe), probe))
+                return null;
+            return await AID.create({ aid: target, aunPath: this.aunPath, certPem, privateKeyPem: null, certValid: false, privateKeyValid: false, deviceId: this.deviceId, slotId: this.slotId, verifySsl: this._verifySsl, aidStore: this });
+        }
+        catch {
+            return null;
+        }
+    }
     async downloadAgentMd(aid, timeoutMs = 30000) {
         try {
             return resultOk(await this._agentMdManager.download(aid, timeoutMs));
@@ -812,12 +739,30 @@ export class AIDStore {
             return agentMdFailure(exc);
         }
     }
-    async _verifyDownloadedPeerCertificate(gatewayUrl, aid, certPem, certFingerprint = '') {
+    async _verifyDownloadedPeerCertificate(gatewayUrl, aid, certPem, certFingerprint = '', signedAt) {
         const expectedFp = String(certFingerprint ?? '').trim().toLowerCase();
         if (expectedFp && !(await certMatchesFingerprint(certPem, expectedFp))) {
             throw new ValidationError(`certificate fingerprint mismatch for aid: ${aid}`);
         }
-        await this._peerAuth.verifyPeerCertificate(gatewayUrl, certPem, aid);
+        if (signedAt === undefined)
+            await this._peerAuth.verifyPeerCertificate(gatewayUrl, certPem, aid);
+        else
+            await this._peerAuth.verifyPeerCertificate(gatewayUrl, certPem, aid, signedAt, false, true);
+    }
+    async _resolveEntityAgentMdOwner(aid, type) {
+        const authority = await this._agentMdManager.readEntityAuthorityFresh(aid);
+        const certificate = await this._currentEntityCertificate(aid, type);
+        if (authority.entity_cert_fingerprint !== certificate.certFingerprint)
+            throw new StateError('entity certificate authority changed', { stringCode: 'conflict' });
+        return authority.owner_aid;
+    }
+    async _currentEntityCertificate(aid, type) {
+        const cert = await this._peerAuth.resolveCurrentEntityCertificate(await this._resolveGateway(aid), aid, type);
+        return AID.create({ aid, aunPath: this.aunPath, certPem: cert.cert_pem, certValid: true, privateKeyPem: null, privateKeyValid: false });
+    }
+    async _currentEntitySigner(aid, fingerprint) {
+        const cert = await this._peerAuth.resolveOwnershipCertificate(await this._resolveGateway(aid), aid, fingerprint);
+        return AID.create({ aid, aunPath: this.aunPath, certPem: cert.cert_pem, certValid: true, privateKeyPem: null, privateKeyValid: false });
     }
     _authIdentityFromAid(aid) {
         return {
@@ -853,10 +798,18 @@ export class AIDStore {
                 return resultErr(loaded.error.code, loaded.error.message);
             }
             const current = loaded.data.aid;
-            if (!current.isPrivateKeyValid() || !current.privateKeyPem) {
+            const raw = content ?? (String((await this._agentMdManager.loadRecord(target, true))?.local_draft_content ?? '') || await this._agentMdManager.readContent(target));
+            const tail = parseAgentMdTailSignatureForRead(String(raw ?? ''));
+            if (tail.parseError)
+                throw new ValidationError(tail.parseError);
+            const base = validateAgentMdDocument(tail.payload, { expectedAid: target, validateOwnership: false });
+            const entity = ['group', 'org'].includes(String(base.frontmatter.type));
+            const parsed = entity ? validateAgentMdDocument(String(raw ?? ''), { expectedAid: target }) : base;
+            const meta = parsed.frontmatter;
+            if ((!current.isPrivateKeyValid() || !current.privateKeyPem) && !(entity && parsed.signature)) {
                 return resultErr(codes.PRIVATE_KEY_NOT_VALID, `uploadAgentMd requires local AID with a valid private key: ${target}`);
             }
-            const uploaderTarget = String(options.uploaderAid ?? options.uploader_aid ?? target).trim();
+            const uploaderTarget = String(options.uploaderAid ?? options.uploader_aid ?? (entity ? meta.owner : target)).trim();
             this._registerFlow.validateAidName(uploaderTarget);
             let uploader = current;
             if (uploaderTarget.toLowerCase() !== target.toLowerCase()) {
@@ -865,22 +818,35 @@ export class AIDStore {
                     return resultErr(uploaderLoaded.error.code, uploaderLoaded.error.message);
                 }
                 uploader = uploaderLoaded.data.aid;
-                if (!uploader.isPrivateKeyValid() || !uploader.privateKeyPem) {
-                    return resultErr(codes.PRIVATE_KEY_NOT_VALID, `uploadAgentMd requires uploader AID with a valid private key: ${uploaderTarget}`);
-                }
+            }
+            if (!uploader.isPrivateKeyValid() || !uploader.privateKeyPem) {
+                return resultErr(codes.PRIVATE_KEY_NOT_VALID, `uploadAgentMd requires uploader AID with a valid private key: ${uploaderTarget}`);
             }
             const manager = new AgentMdManager({
                 aunPath: this.aunPath,
                 tokenStore: this._tokenStore,
                 uploadViaGatewayHost: true,
-                ownerAidGetter: () => target,
-                currentAidGetter: () => current,
+                ownerAidGetter: () => uploaderTarget,
+                currentAidGetter: () => uploader,
+                entityOwnerResolver: options.entityOwnerResolver ?? ((value, type) => this._resolveEntityAgentMdOwner(value, type)),
+                entityIdentityGetter: options.entityIdentityGetter ?? ((value, type) => this._currentEntityCertificate(value, type ?? 'group')),
+                entitySignerResolver: options.entitySignerResolver ?? ((value, fingerprint) => this._currentEntitySigner(value, fingerprint)),
                 gatewayResolver: (value) => this._resolveGateway(value),
                 accessTokenResolver: async () => this._uploadAgentMdToken(uploader, await this._resolveGateway(uploaderTarget)),
                 aidValidator: (value) => this._registerFlow.validateAidName(value),
             });
-            const ownerOperationId = options.ownerOperationId ?? options.owner_operation_id;
-            return resultOk(await manager.upload(content, ownerOperationId));
+            if (entity) {
+                let signed = String(raw);
+                if (!parsed.signature)
+                    signed = (await signDocument(current, signed, { signerAid: true })).signed;
+                if (options.coSignerAid) {
+                    if (options.coSignerAid !== meta.owner)
+                        throw new ValidationError('entity additional signer must be current owner');
+                    signed = (await signDocument(uploader, signed, { append: true })).signed;
+                }
+                return resultOk(await manager.uploadAs(target, signed, current));
+            }
+            return resultOk(await manager.upload(raw));
         }
         catch (exc) {
             return agentMdFailure(exc);
@@ -977,7 +943,45 @@ export class AIDStore {
                 return resultErr(codes.PRIVATE_KEY_REQUIRED, `private key required for aid: ${target}`);
             }
             const gatewayUrl = await this._resolveGateway(target);
-            const newIdentity = await this._registerFlow.generateIdentity();
+            const pendingStore = this._keystore;
+            let pendingDir = null;
+            let newIdentity = null;
+            for (const handle of await pendingStore.listPendingIdentityDirs(target)) {
+                const candidate = await pendingStore.loadPendingKeyPair(handle, target);
+                if (candidate?.rekey_pending === true) {
+                    pendingDir = handle;
+                    newIdentity = candidate;
+                    break;
+                }
+            }
+            if (newIdentity) {
+                const serverCert = await this._registerFlow.fetchPeerCert(gatewayUrl, target);
+                if (serverCert) {
+                    const validity = parseCertValidity(serverCert);
+                    const now = Date.now();
+                    if (publicKeyDerB64(serverCert) === newIdentity.public_key_der_b64
+                        && parseCertCN(serverCert) === target
+                        && validity && now >= validity.notBefore && now <= validity.notAfter) {
+                        await pendingStore.savePendingCert(pendingDir, serverCert);
+                        await this._keystore.saveIdentity(target, {
+                            aid: target, private_key_pem: newIdentity.private_key_pem,
+                            public_key_der_b64: newIdentity.public_key_der_b64, curve: newIdentity.curve, cert: serverCert,
+                        });
+                        await pendingStore.discardPendingIdentity(pendingDir);
+                        const refreshed = await this.load(target);
+                        if (!refreshed.ok || !refreshed.data)
+                            return resultErr(codes.REKEY_FAILED, 'rekeyed identity reload failed');
+                        return resultOk({ rekeyed: true, new_cert_not_after: refreshed.data.aid.certNotAfter, new_fingerprint: refreshed.data.aid.certFingerprint });
+                    }
+                }
+            }
+            else {
+                newIdentity = await this._registerFlow.generateIdentity();
+                pendingDir = await pendingStore.pendingIdentityDir(target);
+                await pendingStore.savePendingKeyPair(pendingDir, target, { ...newIdentity, aid: target, rekey_pending: true });
+            }
+            if (!pendingDir || !newIdentity)
+                return resultErr(codes.REKEY_FAILED, 'pending rekey identity is unavailable');
             const phase1 = await this._beginAidOperation(gatewayUrl, oldAid);
             const signPayload = `${String(phase1.nonce ?? '')}${newIdentity.public_key_der_b64}`;
             const signResult = await loaded.data.aid.sign(signPayload);
@@ -993,6 +997,7 @@ export class AIDStore {
             const certPem = String(response.cert ?? response.cert_pem ?? '').trim();
             if (!certPem)
                 return resultErr(codes.REKEY_FAILED, 'server response missing certificate');
+            await pendingStore.savePendingCert(pendingDir, certPem);
             const nextIdentity = {
                 aid: target,
                 private_key_pem: newIdentity.private_key_pem,
@@ -1001,6 +1006,7 @@ export class AIDStore {
                 cert: certPem,
             };
             await this._keystore.saveIdentity(target, nextIdentity);
+            await pendingStore.discardPendingIdentity(pendingDir);
             const refreshed = await this.load(target);
             if (!refreshed.ok)
                 return resultErr(codes.REKEY_FAILED, 'rekeyed identity reload failed');