@agentunion/fastaun-browser 0.5.18 → 0.5.20

package/dist/auth.js

@@ -6,6 +6,7 @@ import { AuthError, StateError, ValidationError, mapRemoteError } from './errors
 import { ROOT_CA_PEM } from './certs/root.js';
 import { VERSION as AUN_SDK_VERSION } from './version.js';
 import { createTransportWebSocket } from './transport.js';
+import { certFingerprint, isStrictBase64 } from './cert-utils.js';
 const _noopLog = { error: () => { }, warn: () => { }, info: () => { }, debug: () => { } };
 const AUN_SDK_LANG = 'javascript';
 const SENSITIVE_RPC_LOG_KEYS = new Set([
@@ -209,7 +210,7 @@ function parseCertDer(pem) {
     const serialBytes = der.slice(serialStart, serialStart + serialLen);
     const serialHex = Array.from(serialBytes)
         .map((b) => b.toString(16).padStart(2, '0'))
-        .join('');
+        .join('').replace(/^0+/, '') || '0';
     pos = serialStart + serialLen;
     // 签名算法（SEQUENCE）
     const [, sigAlgStart, sigAlgLen] = readTlv(der, pos);
@@ -237,24 +238,86 @@ function parseCertDer(pem) {
     const [spkiFullStart, spkiFullEnd] = getTlvFullRange(der, pos);
     const spkiBytes = der.slice(spkiFullStart, spkiFullEnd);
     pos = spkiFullEnd;
-    // 检查 BasicConstraints（在 extensions 中）
     let isCA = false;
-    // extensions 在 [3] EXPLICIT 中
-    const extensionsSearchStart = pos;
-    const extensionsSearchEnd = tbsEnd;
-    // 搜索 BasicConstraints OID: 2.5.29.19 → 55 1D 13
-    const bcOidBytes = new Uint8Array([0x55, 0x1d, 0x13]);
-    for (let i = extensionsSearchStart; i < extensionsSearchEnd - 3; i++) {
-        if (der[i] === bcOidBytes[0] && der[i + 1] === bcOidBytes[1] && der[i + 2] === bcOidBytes[2]) {
-            // 找到 BasicConstraints OID，在后续字节中搜索 BOOLEAN TRUE (01 01 FF)
-            const searchEnd = Math.min(i + 20, extensionsSearchEnd);
-            for (let j = i + 3; j < searchEnd - 2; j++) {
-                if (der[j] === 0x01 && der[j + 1] === 0x01 && der[j + 2] === 0xff) {
+    let pathLenConstraint;
+    let keyCertSign;
+    const extensionTlv = (offset, end, tag) => {
+        if (offset + 2 > end || der[offset + 1] === 0x80 || der[offset + 1] > 0x84)
+            throw new AuthError('invalid certificate extension DER');
+        const value = readTlv(der, offset);
+        if (value[1] + value[2] > end || value[2] < 0 || tag !== undefined && value[0] !== tag)
+            throw new AuthError('invalid certificate extension DER');
+        return value;
+    };
+    const seenExtensions = new Set();
+    while (pos < tbsEnd) {
+        const [tag, start, length] = extensionTlv(pos, tbsEnd);
+        pos = start + length;
+        if (tag === 0x81 || tag === 0x82)
+            continue;
+        if (tag !== 0xa3)
+            throw new AuthError('invalid certificate extensions');
+        const [, sequenceStart, sequenceLength] = extensionTlv(start, pos, 0x30);
+        if (sequenceStart + sequenceLength !== pos)
+            throw new AuthError('invalid certificate extensions');
+        let extensionPos = sequenceStart;
+        while (extensionPos < pos) {
+            const [, extensionStart, extensionLength] = extensionTlv(extensionPos, pos, 0x30);
+            const extensionEnd = extensionStart + extensionLength;
+            const [, oidStart, oidLength] = extensionTlv(extensionStart, extensionEnd, 0x06);
+            const oid = parseOid(der.slice(oidStart, oidStart + oidLength));
+            if (seenExtensions.has(oid))
+                throw new AuthError('duplicate certificate extension');
+            seenExtensions.add(oid);
+            let valuePos = oidStart + oidLength;
+            let critical = false;
+            if (der[valuePos] === 0x01) {
+                const [, boolStart, boolLength] = extensionTlv(valuePos, extensionEnd, 0x01);
+                if (boolLength !== 1 || der[boolStart] !== 0xff)
+                    throw new AuthError('invalid certificate extension critical flag');
+                critical = true;
+                valuePos = boolStart + boolLength;
+            }
+            const [, valueStart, valueLength] = extensionTlv(valuePos, extensionEnd, 0x04);
+            if (valueStart + valueLength !== extensionEnd)
+                throw new AuthError('invalid certificate extension value');
+            if (oid === '2.5.29.19') {
+                const [, constraintStart, constraintLength] = extensionTlv(valueStart, extensionEnd, 0x30);
+                const constraintEnd = constraintStart + constraintLength;
+                if (constraintEnd !== extensionEnd)
+                    throw new AuthError('invalid BasicConstraints');
+                let constraintPos = constraintStart;
+                if (der[constraintPos] === 0x01) {
+                    const [, boolStart, boolLength] = extensionTlv(constraintPos, constraintEnd, 0x01);
+                    if (boolLength !== 1 || der[boolStart] !== 0xff)
+                        throw new AuthError('invalid BasicConstraints CA flag');
                     isCA = true;
-                    break;
+                    constraintPos = boolStart + boolLength;
+                }
+                if (constraintPos < constraintEnd) {
+                    const [, integerStart, integerLength] = extensionTlv(constraintPos, constraintEnd, 0x02);
+                    if (!isCA || !integerLength || der[integerStart] & 0x80 || integerLength > 1 && der[integerStart] === 0 && !(der[integerStart + 1] & 0x80))
+                        throw new AuthError('invalid BasicConstraints path length');
+                    pathLenConstraint = 0;
+                    for (let index = integerStart; index < integerStart + integerLength; index++)
+                        pathLenConstraint = pathLenConstraint * 256 + der[index];
+                    if (!Number.isSafeInteger(pathLenConstraint))
+                        throw new AuthError('invalid BasicConstraints path length');
+                    constraintPos = integerStart + integerLength;
                 }
+                if (constraintPos !== constraintEnd)
+                    throw new AuthError('invalid BasicConstraints');
             }
-            break;
+            else if (oid === '2.5.29.15') {
+                const [, bitsStart, bitsLength] = extensionTlv(valueStart, extensionEnd, 0x03);
+                if (bitsStart + bitsLength !== extensionEnd || bitsLength < 2 || der[bitsStart] > 7 || der[bitsStart + bitsLength - 1] & ((1 << der[bitsStart]) - 1))
+                    throw new AuthError('invalid KeyUsage');
+                keyCertSign = Boolean(der[bitsStart + 1] & 0x04);
+            }
+            else if (critical) {
+                throw new AuthError(`unsupported critical certificate extension: ${oid}`);
+            }
+            extensionPos = extensionEnd;
         }
     }
     // 签名算法（第二个，在 TBS 之后）
@@ -277,6 +340,8 @@ function parseCertDer(pem) {
         notBefore,
         notAfter,
         isCA,
+        pathLenConstraint,
+        keyCertSign,
         spkiBytes,
     };
 }
@@ -333,6 +398,112 @@ async function verifyEcdsaSignature(spkiDer, signatureDer, data) {
     const p1363Sig = derToP1363(signatureDer, curveLen);
     return crypto.subtle.verify({ name: 'ECDSA', hash }, pubKey, toBufferSource(p1363Sig), toBufferSource(data));
 }
+function ownershipDerNode(data, offset, limit = data.length) {
+    if (offset + 2 > limit || data[offset + 1] === 0x80 || data[offset + 1] > 0x84)
+        throw new AuthError('invalid OCSP DER length');
+    const lengthBytes = data[offset + 1] & 0x80 ? data[offset + 1] & 0x7f : 0;
+    if (offset + 2 + lengthBytes > limit || lengthBytes && data[offset + 2] === 0)
+        throw new AuthError('invalid OCSP DER length');
+    const [tag, valueStart, length] = readTlv(data, offset);
+    if (length < 0 || valueStart + length > limit || lengthBytes && length < 128)
+        throw new AuthError('invalid OCSP DER bounds');
+    return { tag, start: offset, valueStart, end: valueStart + length };
+}
+function ownershipDerChildren(data, node) {
+    const children = [];
+    for (let offset = node.valueStart; offset < node.end;) {
+        const child = ownershipDerNode(data, offset, node.end);
+        children.push(child);
+        offset = child.end;
+    }
+    return children;
+}
+async function verifyOwnershipOcsp(raw, cert, issuer) {
+    const outer = ownershipDerNode(raw, 0);
+    if (outer.tag !== 0x30 || outer.end !== raw.length)
+        throw new AuthError('invalid OCSP response container');
+    const fields = ownershipDerChildren(raw, outer);
+    if (!fields[0])
+        throw new StateError('OCSP response status is missing', { stringCode: 'unavailable', retryable: true });
+    if (fields[0].tag !== 0x0a || fields[0].end - fields[0].valueStart !== 1)
+        throw new AuthError('invalid OCSP response status');
+    if (raw[fields[0].valueStart] !== 0 || !fields[1])
+        throw new StateError('OCSP current signed status unavailable', { stringCode: 'unavailable', retryable: true });
+    if (fields.length !== 2 || fields[1].tag !== 0xa0)
+        throw new AuthError('invalid OCSP response fields');
+    const response = ownershipDerChildren(raw, ownershipDerChildren(raw, fields[1])[0]);
+    if (response.length !== 2 || response[0].tag !== 0x06 || parseOid(raw.slice(response[0].valueStart, response[0].end)) !== '1.3.6.1.5.5.7.48.1.1' || response[1].tag !== 0x04)
+        throw new AuthError('invalid OCSP basic response');
+    const basic = raw.slice(response[1].valueStart, response[1].end);
+    const basicNode = ownershipDerNode(basic, 0);
+    const items = ownershipDerChildren(basic, basicNode);
+    if (basicNode.tag !== 0x30 || basicNode.end !== basic.length || (items.length !== 3 && items.length !== 4) || items[0].tag !== 0x30 || items[1].tag !== 0x30 || items[2].tag !== 0x03 || basic[items[2].valueStart] !== 0)
+        throw new AuthError('invalid OCSP signed response');
+    if (items[3]) {
+        if (items[3].tag !== 0xa0)
+            throw new AuthError('invalid OCSP embedded certificates');
+        const sequences = ownershipDerChildren(basic, items[3]);
+        if (sequences.length !== 1 || sequences[0].tag !== 0x30)
+            throw new AuthError('invalid OCSP embedded certificates');
+        const certificates = ownershipDerChildren(basic, sequences[0]);
+        const issuerDer = new Uint8Array(pemToArrayBuffer(issuer.pem));
+        if (certificates.length !== 1 || certificates[0].tag !== 0x30 || !arraysEqual(basic.slice(certificates[0].start, certificates[0].end), issuerDer))
+            throw new AuthError('OCSP embedded certificate is not the verified issuer');
+    }
+    const algorithm = ownershipDerChildren(basic, items[1])[0];
+    await verifyCertSignature(issuer.spkiBytes, { ...cert,
+        tbsBytes: basic.slice(items[0].start, items[0].end), signatureBytes: basic.slice(items[2].valueStart + 1, items[2].end),
+        signatureAlgorithmOid: parseOid(basic.slice(algorithm.valueStart, algorithm.end)),
+    });
+    const data = ownershipDerChildren(basic, items[0]);
+    if (data[0]?.tag === 0xa0)
+        data.shift();
+    if (data.length < 3 || ![0xa1, 0xa2, 0x82].includes(data[0].tag) || data[1].tag !== 0x18 || data[2].tag !== 0x30)
+        throw new AuthError('invalid OCSP response data');
+    const publicBits = ownershipDerChildren(issuer.spkiBytes, ownershipDerNode(issuer.spkiBytes, 0))[1];
+    const responder = data[0], keyHash = new Uint8Array(await crypto.subtle.digest('SHA-1', toBufferSource(issuer.spkiBytes.slice(publicBits.valueStart + 1, publicBits.end))));
+    const responderKey = responder.tag === 0xa2 ? ownershipDerChildren(basic, responder) : [];
+    const responderValid = responder.tag === 0xa1 ? arraysEqual(basic.slice(responder.valueStart, responder.end), issuer.subjectRaw)
+        : responder.tag === 0x82 ? arraysEqual(basic.slice(responder.valueStart, responder.end), keyHash)
+            : responderKey.length === 1 && responderKey[0].tag === 0x04 && arraysEqual(basic.slice(responderKey[0].valueStart, responderKey[0].end), keyHash);
+    if (!responderValid)
+        throw new AuthError('OCSP responder is not the verified issuer');
+    const responses = ownershipDerChildren(basic, data[2]);
+    if (responses.length !== 1)
+        throw new AuthError('OCSP response must identify one certificate');
+    const single = ownershipDerChildren(basic, responses[0]);
+    if (single.length < 4 || single[3].tag !== 0xa0)
+        throw new StateError('OCSP current time evidence unavailable', { stringCode: 'unavailable', retryable: true });
+    if (single[0].tag !== 0x30 || single[2].tag !== 0x18)
+        throw new AuthError('invalid OCSP current time evidence');
+    const certId = ownershipDerChildren(basic, single[0]);
+    if (certId.length !== 4 || certId[1].tag !== 0x04 || certId[2].tag !== 0x04 || certId[3].tag !== 0x02)
+        throw new AuthError('invalid OCSP certificate identity');
+    const hashAlgorithm = ownershipDerChildren(basic, certId[0])[0];
+    const hashOid = parseOid(basic.slice(hashAlgorithm.valueStart, hashAlgorithm.end));
+    const hashName = hashOid === '1.3.14.3.2.26' ? 'SHA-1' : hashOid === '2.16.840.1.101.3.4.2.1' ? 'SHA-256' : '';
+    if (!hashName)
+        throw new StateError('unsupported OCSP certificate identity hash', { stringCode: 'unavailable', retryable: true });
+    const digest = async (bytes) => new Uint8Array(await crypto.subtle.digest(hashName, toBufferSource(bytes)));
+    if (!arraysEqual(await digest(issuer.subjectRaw), basic.slice(certId[1].valueStart, certId[1].end)) || !arraysEqual(await digest(issuer.spkiBytes.slice(publicBits.valueStart + 1, publicBits.end)), basic.slice(certId[2].valueStart, certId[2].end)))
+        throw new AuthError('OCSP issuer identity mismatch');
+    const serial = Array.from(basic.slice(certId[3].valueStart, certId[3].end), (byte) => byte.toString(16).padStart(2, '0')).join('').replace(/^0+/, '') || '0';
+    if (serial !== (cert.serialHex.replace(/^0+/, '') || '0'))
+        throw new AuthError('OCSP certificate serial mismatch');
+    const status = single[1].tag === 0xa1 ? 'revoked' : single[1].tag === 0x80 && single[1].end === single[1].valueStart ? 'good' : single[1].tag === 0x82 && single[1].end === single[1].valueStart ? 'unknown' : '';
+    if (!status)
+        throw new AuthError('invalid OCSP certificate status');
+    const next = ownershipDerChildren(basic, single[3])[0];
+    const time = (node) => {
+        if (node.tag !== 0x18 || !/^\d{14}Z$/.test(new TextDecoder().decode(basic.slice(node.valueStart, node.end))))
+            throw new AuthError('invalid OCSP UTC time');
+        return parseAsn1Time(basic, node.start);
+    };
+    const now = Date.now() / 1000, producedAt = time(data[1]), thisUpdate = time(single[2]), nextUpdate = time(next);
+    if (producedAt > now + 5 || producedAt < now - 90 || thisUpdate > now + 5 || thisUpdate < now - 30 || nextUpdate <= now || nextUpdate <= thisUpdate)
+        throw new StateError('OCSP current status evidence is stale', { stringCode: 'unavailable', retryable: true });
+    return status;
+}
 // ── Gateway URL 工具 ────────────────────────────────────
 /** 将 WebSocket URL 转为对应的 HTTP URL */
 function gatewayHttpUrl(gatewayUrl, path) {
@@ -754,13 +925,136 @@ export class AuthFlow {
     /**
      * 统一的对端证书验证入口：时间有效性 + 链验证 + CRL + OCSP + AID 绑定。
      */
-    async verifyPeerCertificate(gatewayUrl, certPem, expectedAid) {
+    async resolveCurrentEntityCertificate(gatewayUrl, aid, type) {
+        const url = new URL(gatewayHttpUrl(gatewayUrl, `/pki/cert/${encodeURIComponent(aid)}`));
+        url.searchParams.set('consistency', 'authoritative');
+        if (type === 'group')
+            url.searchParams.set('key_purpose', 'group_identity');
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 5000);
+        try {
+            const response = await fetch(url.toString(), { signal: controller.signal, cache: 'no-store', redirect: 'error' });
+            if (!response.ok)
+                throw new StateError(`entity current certificate unavailable: HTTP ${response.status}`, { stringCode: 'unavailable', retryable: true });
+            const certPem = await response.text();
+            if (!certPem.trim())
+                throw new StateError('entity current certificate is unavailable', { stringCode: 'unavailable', retryable: true });
+            let fingerprint;
+            try {
+                parseCertDer(certPem);
+                fingerprint = await certFingerprint(certPem);
+            }
+            catch {
+                throw new ValidationError('entity current certificate is invalid', { stringCode: 'invalid' });
+            }
+            return await this.resolveOwnershipCertificate(gatewayUrl, aid, fingerprint, type === 'group' ? 'group_identity' : undefined);
+        }
+        catch (error) {
+            if (error instanceof StateError || error instanceof ValidationError)
+                throw error;
+            throw new StateError(`entity current certificate unavailable: ${String(error)}`, { stringCode: 'unavailable', retryable: true });
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    async resolveOwnershipCertificate(gatewayUrl, expectedAid, fingerprint, keyPurpose) {
+        if (!/^sha256:[0-9a-f]{64}$/.test(fingerprint))
+            throw new ValidationError('ownership certificate fingerprint is invalid', { stringCode: 'invalid' });
+        const began = Date.now();
+        const url = new URL(gatewayHttpUrl(gatewayUrl, `/pki/cert/${encodeURIComponent(expectedAid)}`));
+        url.searchParams.set('cert_fingerprint', fingerprint);
+        url.searchParams.set('consistency', 'authoritative');
+        if (keyPurpose)
+            url.searchParams.set('key_purpose', keyPurpose);
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 5000);
+        try {
+            const response = await fetch(url.toString(), { signal: controller.signal, cache: 'no-store', redirect: 'error' });
+            if (!response.ok)
+                throw new StateError(`ownership certificate unavailable: HTTP ${response.status}`, { stringCode: 'unavailable', retryable: true });
+            const state = response.headers.get('X-AUN-Cert-Lifecycle-State') ?? '';
+            const observed = response.headers.get('X-AUN-Cert-Observed-At') ?? '';
+            const observedAt = Math.trunc(Date.parse(observed) / 1000);
+            const now = Math.trunc(Date.now() / 1000);
+            if (response.headers.get('X-AUN-Cert-Consistency') !== 'authoritative' || !state || !response.headers.get('X-AUN-Cert-Fingerprint') || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/.test(observed) || !Number.isSafeInteger(observedAt) || observedAt < now - 30 || observedAt > now + 5)
+                throw new StateError('ownership current certificate metadata unavailable', { stringCode: 'unavailable', retryable: true });
+            if (state !== 'active_signing' || response.headers.get('X-AUN-Cert-Fingerprint') !== fingerprint)
+                throw new ValidationError('ownership certificate lifecycle or fingerprint is invalid', { stringCode: 'invalid' });
+            const certPem = await response.text();
+            if (!certPem.trim())
+                throw new StateError('ownership certificate is missing', { stringCode: 'unavailable', retryable: true });
+            let cert;
+            try {
+                cert = parseCertDer(certPem);
+            }
+            catch {
+                throw new ValidationError('ownership certificate PEM is invalid', { stringCode: 'invalid' });
+            }
+            if (cert.subjectCN !== expectedAid || await certFingerprint(certPem) !== fingerprint || cert.notBefore > now || cert.notAfter <= now)
+                throw new ValidationError('ownership current certificate identity or validity mismatch', { stringCode: 'invalid' });
+            const chainPems = await this._fetchGatewayCaChain(gatewayUrl, true);
+            let chain;
+            try {
+                chain = chainPems.map((pem) => parseCertDer(pem));
+            }
+            catch {
+                throw new ValidationError('ownership certificate chain PEM is invalid', { stringCode: 'invalid' });
+            }
+            if (!chain.length)
+                throw new StateError('ownership certificate chain unavailable', { stringCode: 'unavailable', retryable: true });
+            if (chain.some((ca) => ca.notBefore > now || ca.notAfter <= now))
+                throw new ValidationError('ownership current CA certificate validity mismatch', { stringCode: 'invalid' });
+            await this._verifyAuthCertChain(gatewayUrl, cert, expectedAid, undefined, true, chain);
+            await this._fetchGatewayOcspStatus(gatewayUrl, cert, chain[0], true);
+            const finalNow = Date.now();
+            if ([cert, ...chain].some((item) => finalNow / 1000 < item.notBefore || finalNow / 1000 >= item.notAfter))
+                throw new ValidationError('ownership current certificate chain validity mismatch', { stringCode: 'invalid' });
+            if (finalNow - began > 30_000 || finalNow / 1000 - observedAt > 30)
+                throw new StateError('ownership current certificate evidence became stale', { stringCode: 'unavailable', retryable: true });
+            return { cert_pem: certPem, chain_valid: true, state, revoked: false, revocation_checked: true, observed_at: observedAt };
+        }
+        catch (error) {
+            if (error instanceof StateError || error instanceof ValidationError)
+                throw error;
+            if (error instanceof AuthError)
+                throw new ValidationError(error.message, { stringCode: 'invalid' });
+            throw new StateError(`ownership certificate unavailable: ${error instanceof Error ? error.message : String(error)}`, { stringCode: 'unavailable', retryable: true });
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    async verifyPeerCertificate(gatewayUrl, certPem, expectedAid, signedAt, strictRevocation = false, agentMdRead = false) {
         const tStart = Date.now();
         this._log.debug(`verifyPeerCertificate enter: aid=${expectedAid} gateway=${gatewayUrl}`);
         try {
             const cert = parseCertDer(certPem);
+            if (signedAt !== undefined) {
+                ensureCertTimeValid(cert, 'peer certificate', signedAt);
+                await this._verifyAuthCertChain(gatewayUrl, cert, expectedAid, signedAt);
+                if (agentMdRead ? cert.subjectCN.trim().toLowerCase() !== expectedAid.trim().toLowerCase() : cert.subjectCN !== expectedAid)
+                    throw new AuthError(`peer cert CN mismatch: expected ${expectedAid}`);
+                return;
+            }
             const now = Date.now() / 1000;
             ensureCertTimeValid(cert, 'peer certificate', now);
+            if (strictRevocation) {
+                const chain = (await this._fetchGatewayCaChain(gatewayUrl, true)).map((pem) => parseCertDer(pem));
+                if (!chain.length)
+                    throw new AuthError('service event certificate chain is unavailable');
+                const current = Math.trunc(Date.now() / 1000);
+                if ([cert, ...chain].some((item) => current < item.notBefore || current > item.notAfter))
+                    throw new AuthError('service event certificate is outside its validity window');
+                await this._verifyAuthCertChain(gatewayUrl, cert, expectedAid, undefined, true, chain);
+                const crl = await this._fetchGatewayCrl(gatewayUrl, chain[0], true);
+                if (crl.revokedSerials.has(cert.serialHex.toLowerCase()))
+                    throw new AuthError('service event certificate has been revoked');
+                await this._fetchGatewayOcspStatus(gatewayUrl, cert, chain[0], true);
+                if (cert.subjectCN !== expectedAid)
+                    throw new AuthError(`peer cert CN mismatch: expected ${expectedAid}`);
+                return;
+            }
             await this._verifyAuthCertChain(gatewayUrl, cert, expectedAid);
             try {
                 await this._verifyAuthCertRevocation(gatewayUrl, cert, expectedAid);
@@ -902,17 +1196,19 @@ export class AuthFlow {
     }
     // ── 内部方法：HTTP 请求 ───────────────────────────
     /** fetch GET 返回文本 */
-    async _fetchText(url) {
+    async _fetchText(url, fresh = false) {
         // 兼容旧浏览器，不使用 AbortSignal.timeout（Chrome 103+ 才支持）
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), 5000);
         try {
-            const resp = await fetch(url, { signal: controller.signal });
+            const resp = await fetch(url, { signal: controller.signal, ...(fresh ? { cache: 'no-store', redirect: 'error' } : {}) });
             if (!resp.ok)
                 throw new Error(`HTTP ${resp.status}`);
             return await resp.text();
         }
         catch (e) {
+            if (fresh)
+                throw new StateError(`ownership certificate material unavailable: ${e}`, { stringCode: 'unavailable', retryable: true });
             throw new AuthError(`failed to fetch ${url}: ${e}`);
         }
         finally {
@@ -920,12 +1216,27 @@ export class AuthFlow {
         }
     }
     /** fetch GET 返回 JSON */
-    async _fetchJson(url) {
+    async _fetchJson(url, fresh = false) {
+        if (fresh) {
+            const text = await this._fetchText(url, true);
+            if (!text.trim())
+                throw new StateError('ownership certificate material is missing', { stringCode: 'unavailable', retryable: true });
+            let payload;
+            try {
+                payload = JSON.parse(text);
+            }
+            catch {
+                throw new ValidationError('ownership certificate JSON is invalid', { stringCode: 'invalid' });
+            }
+            if (!isJsonObject(payload))
+                throw new ValidationError('ownership certificate JSON is invalid', { stringCode: 'invalid' });
+            return payload;
+        }
         // 兼容旧浏览器，不使用 AbortSignal.timeout（Chrome 103+ 才支持）
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), 5000);
         try {
-            const resp = await fetch(url, { signal: controller.signal });
+            const resp = await fetch(url, { signal: controller.signal, ...(fresh ? { cache: 'no-store', redirect: 'error' } : {}) });
             if (!resp.ok)
                 throw new Error(`HTTP ${resp.status}`);
             const payload = await resp.json();
@@ -935,6 +1246,8 @@ export class AuthFlow {
             return payload;
         }
         catch (e) {
+            if (fresh)
+                throw new StateError(`ownership certificate material unavailable: ${e}`, { stringCode: 'unavailable', retryable: true });
             if (e instanceof AuthError)
                 throw e;
             throw new AuthError(`failed to fetch ${url}: ${e}`);
@@ -1165,29 +1478,30 @@ export class AuthFlow {
         }
     }
     // ── 内部方法：证书链验证 ──────────────────────────
-    async _verifyAuthCertChain(gatewayUrl, authCert, chainAid = '') {
+    async _verifyAuthCertChain(gatewayUrl, authCert, chainAid = '', signedAt, fresh = false, suppliedChain) {
         // 检查缓存
-        const cachedAt = this._chainVerifiedCache.get(authCert.serialHex);
-        const now = Date.now() / 1000;
-        if (cachedAt && now - cachedAt < this._chainCacheTtl)
+        const certKey = authCert.serialHex + (signedAt === undefined ? '' : `:signed:${signedAt}`);
+        const cachedAt = this._chainVerifiedCache.get(certKey);
+        const now = signedAt === undefined ? Date.now() / 1000 : signedAt;
+        if (!fresh && cachedAt && Date.now() / 1000 - cachedAt < this._chainCacheTtl)
             return;
         ensureCertTimeValid(authCert, 'auth certificate', now);
-        const chain = await this._loadGatewayCaChain(gatewayUrl, chainAid);
+        const chain = suppliedChain ?? await this._loadGatewayCaChain(gatewayUrl, chainAid);
         if (!chain.length) {
             throw new AuthError('unable to verify auth certificate chain: missing CA chain');
         }
-        const cacheKey = chainAid ? `${gatewayUrl}:${chainAid}` : gatewayUrl;
+        const cacheKey = (chainAid ? `${gatewayUrl}:${chainAid}` : gatewayUrl) + (signedAt === undefined ? '' : `:signed:${signedAt}`);
         // 快速路径：CA 链已预验证过
-        if (this._gatewayCaVerified.get(cacheKey)) {
+        if (!fresh && this._gatewayCaVerified.get(cacheKey)) {
             const issuer = chain[0];
             ensureCertTimeValid(issuer, 'Issuer CA', now);
-            if (!issuer.isCA)
+            if (!issuer.isCA || issuer.keyCertSign === false)
                 throw new AuthError('Issuer CA is not marked as CA (fast path)');
             if (!arraysEqual(authCert.issuerRaw, issuer.subjectRaw)) {
                 throw new AuthError('auth certificate issuer mismatch');
             }
             await verifyCertSignature(issuer.spkiBytes, authCert);
-            this._chainVerifiedCache.set(authCert.serialHex, Date.now() / 1000);
+            this._chainVerifiedCache.set(certKey, Date.now() / 1000);
             return;
         }
         // 完整验证路径
@@ -1198,9 +1512,12 @@ export class AuthFlow {
             if (!arraysEqual(current.issuerRaw, caCert.subjectRaw)) {
                 throw new AuthError(`auth certificate issuer mismatch at chain level ${i}`);
             }
-            if (!caCert.isCA) {
+            if (!caCert.isCA || caCert.keyCertSign === false) {
                 throw new AuthError(`CA certificate[${i}] is not marked as CA`);
             }
+            const subordinateCas = chain.slice(0, i).filter((cert) => cert.isCA).length;
+            if (caCert.pathLenConstraint !== undefined && subordinateCas > caCert.pathLenConstraint)
+                throw new AuthError(`CA certificate[${i}] path length constraint exceeded`);
             await verifyCertSignature(caCert.spkiBytes, current);
             current = caCert;
         }
@@ -1211,15 +1528,25 @@ export class AuthFlow {
         }
         await verifyCertSignature(root.spkiBytes, root);
         // 验证根证书在受信列表中
-        const trustedRoots = this._loadTrustedRoots();
+        let trustedRoots;
+        try {
+            trustedRoots = this._loadTrustedRoots();
+        }
+        catch (error) {
+            if (fresh)
+                throw new StateError('ownership trust anchors are unavailable', { stringCode: 'unavailable', retryable: true });
+            throw error;
+        }
         const rootSpkiB64 = uint8ToBase64(root.spkiBytes);
         const isTrusted = trustedRoots.some((trusted) => uint8ToBase64(trusted.spkiBytes) === rootSpkiB64
             && trusted.subjectCN === root.subjectCN);
         if (!isTrusted) {
             throw new AuthError('auth certificate chain is not anchored by a trusted root');
         }
-        this._chainVerifiedCache.set(authCert.serialHex, Date.now() / 1000);
-        this._gatewayCaVerified.set(cacheKey, true);
+        if (!fresh) {
+            this._chainVerifiedCache.set(certKey, Date.now() / 1000);
+            this._gatewayCaVerified.set(cacheKey, true);
+        }
     }
     /** 加载 Gateway CA 链（带缓存） */
     async _loadGatewayCaChain(gatewayUrl, chainAid = '') {
@@ -1232,9 +1559,9 @@ export class AuthFlow {
         return cached.map((pem) => parseCertDer(pem));
     }
     /** 从 Gateway PKI 端点下载 CA 链 */
-    async _fetchGatewayCaChain(gatewayUrl) {
+    async _fetchGatewayCaChain(gatewayUrl, fresh = false) {
         const url = gatewayHttpUrl(gatewayUrl, '/pki/chain');
-        const text = await this._fetchText(url);
+        const text = await this._fetchText(url, fresh);
         return splitPemBundle(text);
     }
     // ── 内部方法：CRL 验证 ────────────────────────────
@@ -1270,9 +1597,47 @@ export class AuthFlow {
         return fresh.revokedSerials;
     }
     /** 从 Gateway PKI 端点获取并验证 CRL */
-    async _fetchGatewayCrl(gatewayUrl, issuerCert) {
+    async _fetchGatewayCrl(gatewayUrl, issuerCert, fresh = false) {
         const url = gatewayHttpUrl(gatewayUrl, '/pki/crl.json');
-        const payload = await this._fetchJson(url);
+        const payload = await this._fetchJson(url, fresh);
+        if (fresh) {
+            const pem = payload.crl_pem;
+            if (typeof pem !== 'string' || !/^-----BEGIN X509 CRL-----\s+([A-Za-z0-9+/=\s]+)-----END X509 CRL-----\s*$/.test(pem))
+                throw new AuthError('signed current CRL is unavailable');
+            const encoded = pem.replace(/-----BEGIN X509 CRL-----|-----END X509 CRL-----|\s/g, '');
+            if (encoded.length % 4 !== 0 || btoa(atob(encoded)) !== encoded)
+                throw new AuthError('signed current CRL encoding is invalid');
+            const der = base64ToUint8(encoded);
+            const outer = ownershipDerNode(der, 0);
+            if (outer.tag !== 0x30 || outer.end !== der.length)
+                throw new AuthError('signed current CRL is invalid');
+            const fields = ownershipDerChildren(der, outer);
+            if (fields.length !== 3 || fields[0].tag !== 0x30 || fields[1].tag !== 0x30 || fields[2].tag !== 0x03 || der[fields[2].valueStart] !== 0)
+                throw new AuthError('signed current CRL is invalid');
+            const algorithm = ownershipDerChildren(der, fields[1]);
+            if (algorithm[0]?.tag !== 0x06)
+                throw new AuthError('signed current CRL algorithm is invalid');
+            await verifyCertSignature(issuerCert.spkiBytes, { ...issuerCert, tbsBytes: der.slice(fields[0].start, fields[0].end), signatureBytes: der.slice(fields[2].valueStart + 1, fields[2].end), signatureAlgorithmOid: parseOid(der.slice(algorithm[0].valueStart, algorithm[0].end)) });
+            const body = ownershipDerChildren(der, fields[0]);
+            let index = body[0]?.tag === 0x02 ? 1 : 0;
+            if (body[index++]?.tag !== 0x30 || body[index]?.tag !== 0x30 || !arraysEqual(der.slice(body[index].start, body[index].end), issuerCert.subjectRaw))
+                throw new AuthError('signed current CRL issuer is invalid');
+            index++;
+            const thisUpdate = body[index++], nextUpdate = body[index++];
+            const now = Date.now() / 1000;
+            if (!thisUpdate || !nextUpdate || ![0x17, 0x18].includes(thisUpdate.tag) || ![0x17, 0x18].includes(nextUpdate.tag) || !Number.isFinite(parseAsn1Time(der, thisUpdate.start)) || parseAsn1Time(der, thisUpdate.start) > now || !Number.isFinite(parseAsn1Time(der, nextUpdate.start)) || now >= parseAsn1Time(der, nextUpdate.start))
+                throw new AuthError('signed current CRL time window is invalid');
+            const revokedSerials = new Set();
+            const revoked = body[index];
+            if (revoked?.tag === 0x30)
+                for (const entry of ownershipDerChildren(der, revoked)) {
+                    const serial = ownershipDerChildren(der, entry)[0];
+                    if (entry.tag !== 0x30 || serial?.tag !== 0x02)
+                        throw new AuthError('signed current CRL revoked entry is invalid');
+                    revokedSerials.add(Array.from(der.slice(serial.valueStart, serial.end), (byte) => byte.toString(16).padStart(2, '0')).join('').replace(/^0+/, '') || '0');
+                }
+            return { revokedSerials, nextRefreshAt: parseAsn1Time(der, nextUpdate.start) };
+        }
         // 简化 CRL 验证：JSON 格式 CRL
         // payload 包含 revoked_serials 数组和签名
         const revokedList = payload.revoked_serials;
@@ -1335,12 +1700,34 @@ export class AuthFlow {
         return fresh.status;
     }
     /** 从 Gateway PKI 端点获取并验证 OCSP 状态 */
-    async _fetchGatewayOcspStatus(gatewayUrl, authCert, issuerCert) {
+    async _fetchGatewayOcspStatus(gatewayUrl, authCert, issuerCert, strictCurrent = false) {
         const serialHex = authCert.serialHex.toLowerCase();
         const url = gatewayHttpUrl(gatewayUrl, `/pki/ocsp/${serialHex}`);
-        const payload = await this._fetchJson(url);
+        const payload = await this._fetchJson(url, strictCurrent);
         const status = String(payload.status ?? '');
         const ocspB64 = String(payload.ocsp_response ?? '');
+        if (strictCurrent) {
+            if (payload.ocsp_response === undefined || payload.ocsp_response === '')
+                throw new StateError('OCSP signed current evidence unavailable', { stringCode: 'unavailable', retryable: true });
+            if (typeof payload.ocsp_response !== 'string' || !isStrictBase64(ocspB64))
+                throw new ValidationError('ownership OCSP Base64 is invalid', { stringCode: 'invalid' });
+            let verifiedStatus;
+            try {
+                verifiedStatus = await verifyOwnershipOcsp(base64ToUint8(ocspB64), authCert, issuerCert);
+            }
+            catch (error) {
+                if (error instanceof StateError || error instanceof ValidationError)
+                    throw error;
+                throw new ValidationError(error instanceof AuthError ? error.message : 'ownership OCSP evidence is invalid', { stringCode: 'invalid' });
+            }
+            if (payload.status !== undefined && payload.status !== verifiedStatus)
+                throw new ValidationError('ownership OCSP status mismatch', { stringCode: 'invalid' });
+            if (verifiedStatus === 'revoked')
+                throw new ValidationError('ownership certificate is revoked', { stringCode: 'invalid' });
+            if (verifiedStatus !== 'good')
+                throw new StateError('ownership certificate revocation status is unknown', { stringCode: 'unavailable', retryable: true });
+            return { status: verifiedStatus, nextRefreshAt: Date.now() / 1000 };
+        }
         if (!ocspB64)
             throw new AuthError('gateway OCSP endpoint returned no ocsp_response');
         // 简化 OCSP 验证：检查 JSON 响应中的签名