@agentunion/fastaun-browser 0.5.19 → 0.5.20

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (114) hide show
  1. package/CHANGELOG.md +129 -78
  2. package/_packed_docs/CHANGELOG.md +129 -78
  3. package/_packed_docs/INDEX.md +201 -195
  4. package/_packed_docs/KITE_DOCS_GUIDE.md +93 -90
  5. package/_packed_docs/agent.md/SCHEMA.md +7 -7
  6. package/_packed_docs/agent.md//350/277/234/347/250/213agent.md/347/274/223/345/255/230/344/270/216etag/351/200/217/344/274/240/346/226/271/346/241/210.md +11 -11
  7. package/_packed_docs/protocol/06-/346/234/215/345/212/241/345/215/217/350/256/256.md +1072 -1072
  8. package/_packed_docs/protocol/10-Group-/345/255/220/345/215/217/350/256/256.md +676 -676
  9. package/_packed_docs/protocol/11-Storage-/345/255/220/345/215/217/350/256/256.md +8 -12
  10. package/_packed_docs/protocol/Ownership/345/215/217/350/256/256/345/256/232/344/271/211.md +443 -0
  11. package/_packed_docs/protocol/Ownership/345/215/217/350/256/256/345/256/232/344/271/2112.0.md +161 -0
  12. package/_packed_docs/protocol/Ownership/345/215/217/350/256/256/345/256/232/344/271/2112.1.md +658 -0
  13. package/_packed_docs/protocol/Ownership/345/215/217/350/256/256/345/256/232/344/271/2113.0.md +233 -0
  14. package/_packed_docs/protocol/agent.md/SCHEMA.md +1 -1
  15. package/_packed_docs/sdk/03-/346/240/270/345/277/203/346/246/202/345/277/265.md +1 -1
  16. package/_packed_docs/sdk/04-/350/277/236/346/216/245/344/270/216/350/256/244/350/257/201.md +67 -63
  17. package/_packed_docs/sdk/05-E2EE/345/212/240/345/257/206/351/200/232/344/277/241.md +1 -1
  18. package/_packed_docs/sdk/06-API/346/211/213/345/206/214.md +35 -8
  19. package/_packed_docs/sdk/08-/346/234/200/344/275/263/345/256/236/350/267/265.md +3 -3
  20. package/_packed_docs/sdk/09-group-rpc-manual.md +258 -254
  21. package/_packed_docs/sdk/09-message-rpc-manual.md +7 -4
  22. package/_packed_docs/sdk/09-storage-rpc-manual.md +18 -26
  23. package/_packed_docs/sdk/AUN_DOCS_GUIDE.md +61 -52
  24. package/_packed_docs/sdk/INDEX.md +92 -80
  25. package/_packed_docs/sdk/Ownership-SDK/345/256/236/347/216/260/346/214/207/345/215/227.md +169 -0
  26. package/_packed_docs/sdk/Ownership-SDK/347/274/226/346/216/222/346/214/207/345/215/227.md +349 -0
  27. package/_packed_docs/sdk/Ownership-SDK/347/274/226/346/216/222/346/214/207/345/215/2272.1.md +922 -0
  28. package/_packed_docs/sdk/Ownership-SDK/351/233/206/346/210/220/346/214/207/345/215/227.md +270 -0
  29. package/_packed_docs/sdk/Ownership2.1-SDK/345/272/224/347/224/250/351/233/206/346/210/220/346/214/207/345/215/227.md +300 -0
  30. package/_packed_docs/sdk/Ownership2.1-SDK/345/274/200/345/217/221/344/270/216/347/247/273/346/244/215/346/214/207/345/215/227.md +382 -0
  31. package/_packed_docs/sdk/Ownership2.1-TDD/345/210/206/351/230/266/346/256/265/345/256/236/346/226/275/350/256/241/345/210/222.md +708 -0
  32. package/_packed_docs/sdk/Ownership2.1/350/257/246/347/273/206/350/256/276/350/256/241.md +476 -0
  33. package/_packed_docs/sdk/Ownership/347/256/241/347/220/206/344/270/223/351/242/230.md +559 -0
  34. package/_packed_docs/sdk/ProtectedHeaders/347/224/250/346/263/225/344/270/223/351/242/230.md +299 -0
  35. package/_packed_docs/sdk//345/207/255/350/257/201/344/270/216/347/273/204/347/273/207/346/234/215/345/212/241SDK/345/272/224/347/224/250/351/233/206/346/210/220/346/214/207/345/215/227.md +173 -0
  36. package/_packed_docs/sdk//345/207/255/350/257/201/344/270/216/347/273/204/347/273/207/346/234/215/345/212/241SDK/345/274/200/345/217/221/344/270/216/347/247/273/346/244/215/346/214/207/345/215/227.md +211 -0
  37. package/_packed_docs//350/267/250/350/256/276/345/244/207/345/267/262/350/257/273/346/234/252/350/257/273SDK/345/256/236/347/216/260/347/247/273/346/244/215/346/214/207/345/215/227.md +331 -0
  38. package/_packed_docs//350/267/250/350/256/276/345/244/207/345/267/262/350/257/273/346/234/252/350/257/273SDK/351/233/206/346/210/220/346/214/207/345/215/227.md +207 -0
  39. package/_packed_docs//350/267/250/350/256/276/345/244/207/345/267/262/350/257/273/346/234/252/350/257/273/344/273/243/347/240/201/345/256/241/346/237/245/346/212/245/345/221/212.md +252 -0
  40. package/_packed_docs//350/267/250/350/256/276/345/244/207/345/267/262/350/257/273/346/234/252/350/257/273/345/256/236/346/226/275/350/256/241/345/210/222.md +156 -0
  41. package/_packed_docs//350/267/250/350/256/276/345/244/207/345/267/262/350/257/273/346/234/252/350/257/273/346/226/271/346/241/210.md +273 -0
  42. package/_packed_docs//350/267/250/350/256/276/345/244/207/345/267/262/350/257/273/346/234/252/350/257/273/350/257/246/347/273/206/350/256/276/350/256/241.md +211 -0
  43. package/dist/agent-md-schema.d.ts +15 -4
  44. package/dist/agent-md-schema.d.ts.map +1 -1
  45. package/dist/agent-md-schema.js +64 -30
  46. package/dist/agent-md-schema.js.map +1 -1
  47. package/dist/agent-md.d.ts +10 -2
  48. package/dist/agent-md.d.ts.map +1 -1
  49. package/dist/agent-md.js +278 -121
  50. package/dist/agent-md.js.map +1 -1
  51. package/dist/aid-store.d.ts +46 -0
  52. package/dist/aid-store.d.ts.map +1 -1
  53. package/dist/aid-store.js +149 -10
  54. package/dist/aid-store.js.map +1 -1
  55. package/dist/aid.d.ts +4 -1
  56. package/dist/aid.d.ts.map +1 -1
  57. package/dist/aid.js +23 -42
  58. package/dist/aid.js.map +1 -1
  59. package/dist/auth.d.ts +1 -1
  60. package/dist/auth.d.ts.map +1 -1
  61. package/dist/auth.js +85 -18
  62. package/dist/auth.js.map +1 -1
  63. package/dist/bundle.js +1581 -781
  64. package/dist/cert-utils.d.ts +49 -1
  65. package/dist/cert-utils.d.ts.map +1 -1
  66. package/dist/cert-utils.js +102 -56
  67. package/dist/cert-utils.js.map +1 -1
  68. package/dist/client/delivery.d.ts +7 -0
  69. package/dist/client/delivery.d.ts.map +1 -1
  70. package/dist/client/delivery.js +243 -28
  71. package/dist/client/delivery.js.map +1 -1
  72. package/dist/client/rpc-pipeline.d.ts.map +1 -1
  73. package/dist/client/rpc-pipeline.js +89 -77
  74. package/dist/client/rpc-pipeline.js.map +1 -1
  75. package/dist/client/v2-e2ee.d.ts.map +1 -1
  76. package/dist/client/v2-e2ee.js +99 -80
  77. package/dist/client/v2-e2ee.js.map +1 -1
  78. package/dist/client.d.ts.map +1 -1
  79. package/dist/client.js +31 -17
  80. package/dist/client.js.map +1 -1
  81. package/dist/crypto.d.ts.map +1 -1
  82. package/dist/crypto.js +8 -6
  83. package/dist/crypto.js.map +1 -1
  84. package/dist/events.d.ts +5 -2
  85. package/dist/events.d.ts.map +1 -1
  86. package/dist/events.js +33 -14
  87. package/dist/events.js.map +1 -1
  88. package/dist/facades.js +5 -5
  89. package/dist/facades.js.map +1 -1
  90. package/dist/index.d.ts +1 -1
  91. package/dist/index.d.ts.map +1 -1
  92. package/dist/index.js.map +1 -1
  93. package/dist/org-protocol.d.ts.map +1 -1
  94. package/dist/org-protocol.js +72 -12
  95. package/dist/org-protocol.js.map +1 -1
  96. package/dist/ownership-v21.d.ts +25 -8
  97. package/dist/ownership-v21.d.ts.map +1 -1
  98. package/dist/ownership-v21.js +142 -73
  99. package/dist/ownership-v21.js.map +1 -1
  100. package/dist/ownership-workflow.d.ts +6 -1
  101. package/dist/ownership-workflow.d.ts.map +1 -1
  102. package/dist/ownership-workflow.js +221 -58
  103. package/dist/ownership-workflow.js.map +1 -1
  104. package/dist/tools/cross-sdk-agent.d.ts +2 -1
  105. package/dist/tools/cross-sdk-agent.d.ts.map +1 -1
  106. package/dist/tools/cross-sdk-agent.js +91 -8
  107. package/dist/tools/cross-sdk-agent.js.map +1 -1
  108. package/dist/transport.d.ts +1 -0
  109. package/dist/transport.d.ts.map +1 -1
  110. package/dist/transport.js +2 -0
  111. package/dist/transport.js.map +1 -1
  112. package/dist/version.d.ts +1 -1
  113. package/dist/version.js +1 -1
  114. package/package.json +1 -1
package/dist/org-protocol.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"org-protocol.d.ts","sourceRoot":"","sources":["../src/org-protocol.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA6B7C,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAEhB,IAAI,EAAE,MAAM,EAAE,OAAO,SAAO;CAMzC;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,SAAS,GAAG,iBAAiB,GAAG,MAAM,CAAC,CAAC;AACzF,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,UAAU,CAAC;AACtD,MAAM,MAAM,mBAAmB,GAAG,CAAC,WAAW,EAAE,MAAM,KAAK,mBAAmB,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAEpJ,MAAM,WAAW,6BAA6B;IAC5C,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,uBAAuB,CAAC,EAAE,mBAAmB,CAAC;IAC9C,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9F,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1H,uBAAuB,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtG,kBAAkB,EAAE,mBAAmB,CAAC;IACxC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACpJ,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACvI,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,4BAA4B;IAC3C,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,mBAAmB,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACxJ,wBAAwB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAC3G,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC;IAAE,eAAe,EAAE,IAAI,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAA;CAAE,CAAC,CA8BrL;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D;AA4GD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAQ3D;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAExD;AAwKD,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,OAAO,EAAE,UAAU,SAAI,EAAE,kBAAkB,CAAC,EAAE,OAAO,GAAG,IAAI,CAsD1G;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAoBzG;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,UAAU,CAAC;CAChC;AAKD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,GAAG,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,CASvI;AAWD,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAcrJ;AAED,wBAAsB,yBAAyB,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CASpL;AAED,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAKhH;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC,UAAU,CAAC,CAyJ5L;AAUD,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAUpI;AAED,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAiEzI;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,IAAI,CAUpH;AAED,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,OAAO,EACnB,kBAAkB,EAAE,mBAAmB,EACvC,GAAG,CAAC,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,OAAO,GACnB,OAAO,CAAC,IAAI,CAAC,CAwBf;AA+BD,wBAAsB,4BAA4B,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAS1M;AAuKD,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,OAAO,EACnB,kBAAkB,EAAE,mBAAmB,EACvC,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAC9F,GAAG,CAAC,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,OAAO,GACnB,OAAO,CAAC,IAAI,CAAC,CAUf;AAiBD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAEhE;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAOtG;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,kBAAkB,EAAE,mBAAmB,EACvC,GAAG,CAAC,EAAE,MAAM,EACZ,iBAAiB,CAAC,EAAE,MAAM,EAC1B,UAAU,UAAQ,GACjB,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EAAE,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAiBvL;AAED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,OAAO,EACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EACnD,kBAAkB,EAAE,mBAAmB,EACvC,kBAAkB,CAAC,EAAE,MAAM,EAC3B,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE7C;AAWD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzG;AASD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAI/M;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAMpM;AA8BD,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,OAAO,EACd,UAAU,EAAE,OAAO,EACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EACnD,kBAAkB,EAAE,mBAAmB,EACvC,GAAG,EAAE,MAAM,EACX,UAAU,CAAC,EAAE,OAAO,GACnB,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CAE9E;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAE9G;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEpH;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE7G;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEnF;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEnH;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,UAAO,GAAG,OAAO,CAY3E"}
1
+ {"version":3,"file":"org-protocol.d.ts","sourceRoot":"","sources":["../src/org-protocol.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAmC7C,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAEhB,IAAI,EAAE,MAAM,EAAE,OAAO,SAAO;CAMzC;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,SAAS,GAAG,iBAAiB,GAAG,MAAM,CAAC,CAAC;AACzF,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,UAAU,CAAC;AACtD,MAAM,MAAM,mBAAmB,GAAG,CAAC,WAAW,EAAE,MAAM,KAAK,mBAAmB,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAEpJ,MAAM,WAAW,6BAA6B;IAC5C,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,uBAAuB,CAAC,EAAE,mBAAmB,CAAC;IAC9C,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9F,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1H,uBAAuB,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtG,kBAAkB,EAAE,mBAAmB,CAAC;IACxC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACpJ,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACvI,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,4BAA4B;IAC3C,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,mBAAmB,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACxJ,wBAAwB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAC3G,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC;IAAE,eAAe,EAAE,IAAI,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAA;CAAE,CAAC,CAkCrL;AAMD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D;AA4GD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAQ3D;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAExD;AAwKD,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,OAAO,EAAE,UAAU,SAAI,EAAE,kBAAkB,CAAC,EAAE,OAAO,GAAG,IAAI,CAuD1G;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAoBzG;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,UAAU,CAAC;CAChC;AAKD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,GAAG,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,CASvI;AAWD,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAcrJ;AAED,wBAAsB,yBAAyB,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CASpL;AAED,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAKhH;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC,UAAU,CAAC,CA0J5L;AAUD,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAUpI;AAED,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAqGzI;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,IAAI,CAUpH;AAED,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,OAAO,EACnB,kBAAkB,EAAE,mBAAmB,EACvC,GAAG,CAAC,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,OAAO,GACnB,OAAO,CAAC,IAAI,CAAC,CAwBf;AA+BD,wBAAsB,4BAA4B,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAS1M;AAuKD,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,OAAO,EACnB,kBAAkB,EAAE,mBAAmB,EACvC,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAC9F,GAAG,CAAC,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,OAAO,GACnB,OAAO,CAAC,IAAI,CAAC,CAUf;AAiBD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAEhE;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAOtG;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,kBAAkB,EAAE,mBAAmB,EACvC,GAAG,CAAC,EAAE,MAAM,EACZ,iBAAiB,CAAC,EAAE,MAAM,EAC1B,UAAU,UAAQ,GACjB,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EAAE,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAiBvL;AAED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,OAAO,EACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EACnD,kBAAkB,EAAE,mBAAmB,EACvC,kBAAkB,CAAC,EAAE,MAAM,EAC3B,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE7C;AAWD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzG;AASD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAI/M;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAMpM;AA8BD,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,OAAO,EACd,UAAU,EAAE,OAAO,EACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EACnD,kBAAkB,EAAE,mBAAmB,EACvC,GAAG,EAAE,MAAM,EACX,UAAU,CAAC,EAAE,OAAO,GACnB,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CAE9E;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAE9G;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEpH;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE7G;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEnF;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEnH;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,UAAO,GAAG,OAAO,CAY3E"}
package/dist/org-protocol.js CHANGED
@@ -27,6 +27,12 @@ const REPRESENTATION_FIELDS = new Set([
27
27
  ]);
28
28
  const REPRESENTATION_SIGNATURE_FIELDS = new Set(['cert_fingerprint', 'public_key_fingerprint', 'timestamp', 'signature']);
29
29
  const FINGERPRINT_RE = /^sha256:[0-9a-f]{64}$/i;
30
+ const SERVICE_EVENTS = new Set([
31
+ 'org.member.join_requested', 'org.member.join_approved', 'org.member.join_rejected',
32
+ 'org.member.invite_created', 'org.member.invite_accepted', 'org.member.invite_rejected',
33
+ 'org.member.changed', 'org.lifecycle.created', 'org.lifecycle.dissolving',
34
+ 'org.lifecycle.dissolved', 'credential.revoked',
35
+ ]);
30
36
  export class ProtocolError extends Error {
31
37
  code;
32
38
  retryable;
@@ -39,25 +45,30 @@ export class ProtocolError extends Error {
39
45
  }
40
46
  export async function verifyServiceEvent(eventName, payload, context) {
41
47
  const event = eventName.startsWith('event/') ? eventName.slice(6) : eventName;
42
- if (!isRecord(payload) || !context || !['type', 'event', 'event_id', 'responder', 'target_aids', 'as_of', 'expires_at', 'signature'].every((field) => field in payload) || payload.type !== event || payload.event !== event || typeof payload.event_id !== 'string' || !payload.event_id || ['_route', '_federation', '_trace', 'member_aids', 'inline_message'].some((field) => field in payload))
48
+ if (!SERVICE_EVENTS.has(event) || !isRecord(payload) || !context || !['type', 'event', 'event_id', 'responder', 'target_aids', 'as_of', 'expires_at', 'signature'].every((field) => field in payload) || payload.type !== event || payload.event !== event || typeof payload.event_id !== 'string' || !payload.event_id || ['_route', '_federation', '_trace', 'member_aids', 'inline_message'].some((field) => field in payload))
43
49
  throw invalid('service event payload is invalid');
44
50
  normalizeNfc(payload);
45
51
  aid(context.targetAid, 'event target');
46
52
  aid(payload.responder, 'event responder');
47
- if (!Array.isArray(payload.target_aids) || !payload.target_aids.length || payload.target_aids.some((target) => typeof target !== 'string' || !AID_RE.test(target)) || new Set(payload.target_aids).size !== payload.target_aids.length || !payload.target_aids.includes(context.targetAid))
53
+ if (!Array.isArray(payload.target_aids) || !payload.target_aids.length || payload.target_aids.some((target) => typeof target !== 'string' || !AID_RE.test(target)))
54
+ throw invalid('service event audience is invalid');
55
+ const targetAids = new Set(payload.target_aids.map((target) => aidKey(target)));
56
+ if (targetAids.size !== payload.target_aids.length || !targetAids.has(aidKey(context.targetAid)))
48
57
  throw invalid('service event audience is invalid');
58
+ const responder = payload.responder;
59
+ const responderKey = aidKey(responder);
49
60
  const now = context.now ?? Math.trunc(Date.now() / 1000);
50
61
  if (!isInt(now) || !isInt(payload.as_of) || !isInt(payload.expires_at) || payload.as_of <= 0 || payload.expires_at <= payload.as_of || payload.expires_at > payload.as_of + 300 || payload.as_of > now + 300 || now >= payload.expires_at)
51
62
  throw invalid('service event time window is invalid');
52
63
  let known = true;
53
64
  if (event.startsWith('org.')) {
54
65
  aid(payload.org_id, 'event organization');
55
- if (payload.responder !== 'org.' + String(payload.org_id).slice(String(payload.org_id).indexOf('.') + 1))
66
+ if (responderKey !== aidKey('org.' + String(payload.org_id).slice(String(payload.org_id).indexOf('.') + 1)))
56
67
  throw invalid('organization event authority is invalid');
57
68
  }
58
69
  else if (event.startsWith('credential.')) {
59
70
  const cid = payload.credentialCid ?? payload.credential_cid;
60
- if (!String(payload.responder).startsWith('credential.') || typeof payload.target !== 'string' || !payload.target_aids.includes(payload.target) || typeof cid !== 'string' || !cid || payload.credentialCid !== undefined && payload.credential_cid !== undefined && payload.credentialCid !== payload.credential_cid)
71
+ if (!responderKey.startsWith('credential.') || typeof payload.target !== 'string' || !targetAids.has(aidKey(payload.target)) || typeof cid !== 'string' || !cid || payload.credentialCid !== undefined && payload.credential_cid !== undefined && payload.credentialCid !== payload.credential_cid)
61
72
  throw invalid('credential event authority or target is invalid');
62
73
  let service;
63
74
  try {
@@ -67,7 +78,7 @@ export async function verifyServiceEvent(eventName, payload, context) {
67
78
  throw invalid('trusted credential authority is unavailable');
68
79
  }
69
80
  known = service != null;
70
- if (known && (typeof service !== 'string' || !service.startsWith('credential.') || service !== payload.responder))
81
+ if (known && (typeof service !== 'string' || !AID_RE.test(service) || !aidKey(service).startsWith('credential.') || aidKey(service) !== responderKey))
71
82
  throw invalid('credential event authority differs from the trusted provider');
72
83
  }
73
84
  else
@@ -79,8 +90,8 @@ export async function verifyServiceEvent(eventName, payload, context) {
79
90
  throw new Error('service event signature context is invalid');
80
91
  const body = { ...payload };
81
92
  delete body.signature;
82
- const certificate = await context.resolveEventCertificate(payload.responder, signed.cert_fingerprint);
83
- await verifyAgentSignature(signed, body, payload.responder, () => certificate, context.now ?? Math.trunc(Date.now() / 1000), false);
93
+ const certificate = await context.resolveEventCertificate(responderKey, signed.cert_fingerprint);
94
+ await verifyAgentSignature(signed, body, responder, () => certificate, context.now ?? Math.trunc(Date.now() / 1000), false);
84
95
  }
85
96
  catch {
86
97
  throw new ProtocolError('CREDENTIAL_SIGNATURE_INVALID', 'service event signature verification failed');
@@ -89,6 +100,9 @@ export async function verifyServiceEvent(eventName, payload, context) {
89
100
  throw invalid('service event time window is invalid');
90
101
  return { signature_valid: true, credential_known: known };
91
102
  }
103
+ function aidKey(value) {
104
+ return value.trim().toLowerCase();
105
+ }
92
106
  export function protocolErrorRetryable(code) {
93
107
  return ERROR_RETRYABLE[String(code)] === true;
94
108
  }
@@ -535,6 +549,8 @@ export function validateCredential(credential, chainDepth = 0, externalProofChai
535
549
  if (!isInt(delegationDepth) || delegationDepth < 0)
536
550
  throw invalid('delegation_depth is invalid');
537
551
  const parent = credential.parent;
552
+ if (credential.proof_chain !== undefined && externalProofChain !== undefined && canonicalText(credential.proof_chain) !== canonicalText(externalProofChain))
553
+ throw new ProtocolError('CREDENTIAL_CHAIN_INVALID', 'embedded proof_chain conflicts with external proof_chain');
538
554
  if (parent == null && delegationDepth !== 0)
539
555
  throw invalid('root credential must have delegation_depth 0');
540
556
  if (parent != null) {
@@ -857,6 +873,8 @@ export async function prepareOrganizationRequest(method, params, target, signer,
857
873
  throw representationBindingInvalid('admission target must match the signed membership binding');
858
874
  value.credentials = credentials;
859
875
  const now = Math.trunc(Date.now() / 1000);
876
+ if (now >= Number(binding.exp))
877
+ throw representationBindingInvalid('membership binding has expired');
860
878
  let maximum = Math.min(now + 300, Number(binding.exp));
861
879
  for (const field of ['credential_template', 'registration_authorization'])
862
880
  if (field in value) {
@@ -933,6 +951,22 @@ export async function verifyCredential(credential, context) {
933
951
  throw invalid('credential subject does not match holder');
934
952
  const now = context.now ?? Math.trunc(Date.now() / 1000);
935
953
  const documents = credentialChainDocuments(credential, context.proofChain);
954
+ const resolvedCertificates = [];
955
+ const resolveCertificate = async (fingerprint) => {
956
+ const material = await context.resolveCertificate(fingerprint);
957
+ if (material != null)
958
+ resolvedCertificates.push(material);
959
+ return material;
960
+ };
961
+ const resolveActorCertificate = context.resolveActorCertificate
962
+ ? async (fingerprint) => {
963
+ const material = await context.resolveActorCertificate(fingerprint);
964
+ if (material != null)
965
+ resolvedCertificates.push(material);
966
+ return material;
967
+ }
968
+ : resolveCertificate;
969
+ const statusProofs = [];
936
970
  const status = async (cid) => {
937
971
  const document = documents.find((item) => item.cid === cid);
938
972
  let proof;
@@ -945,6 +979,7 @@ export async function verifyCredential(credential, context) {
945
979
  throw new ProtocolError('CREDENTIAL_STATUS_UNKNOWN', 'trusted credential status is unavailable');
946
980
  }
947
981
  if (isRecord(proof)) {
982
+ statusProofs.push(proof);
948
983
  if (typeof proof.credentialCid === 'string' && proof.credentialCid !== cid)
949
984
  throw new ProtocolError('CREDENTIAL_CHAIN_INVALID', 'registered credential cid differs from the signed document');
950
985
  if (proof.ver !== 'aun-credential-status/1' || proof.credentialCid !== cid || typeof proof.credential_hash !== 'string' || !DIGEST_RE.test(proof.credential_hash) || !isInt(proof.asOf) || !isInt(proof.proofExpiresAt) || proof.asOf > now + 300 || proof.proofExpiresAt <= proof.asOf || proof.proofExpiresAt > proof.asOf + 300 || now >= proof.proofExpiresAt || typeof proof.responder !== 'string' || !proof.responder.startsWith('credential.') || !AID_RE.test(proof.responder.slice(11)) || typeof proof.request_id !== 'string' || !proof.request_id || typeof proof.nonce !== 'string' || !proof.nonce || typeof proof.target !== 'string' || !AID_RE.test(proof.target))
@@ -965,7 +1000,7 @@ export async function verifyCredential(credential, context) {
965
1000
  throw new ProtocolError('CREDENTIAL_STATUS_UNKNOWN', 'parent credential status proof is required');
966
1001
  return typeof proof === 'string' ? proof : undefined;
967
1002
  };
968
- await verifyCredentialChain(credential, context.resolveCertificate, status, now, context.audience, context.proofChain);
1003
+ await verifyCredentialChain(credential, resolveCertificate, status, now, context.audience, context.proofChain);
969
1004
  if (credentialChainDocuments(credential, context.proofChain).at(-1).iss !== (context.rootIssuer ?? context.audience))
970
1005
  throw invalid('credential root issuer is not trusted for this resource');
971
1006
  const rate = context.checkRateLimit ? (field, unit, limit) => context.checkRateLimit(String(value.cid), String(value.sub), field, unit, limit) : undefined;
@@ -985,7 +1020,7 @@ export async function verifyCredential(credential, context) {
985
1020
  if (value.iss !== binding.org_id || !value.aud.includes(binding.org_id) || caps.length !== 1 || caps[0].ns !== 'org' || caps[0].action !== 'role.' + String(binding.role) || caps[0].resource !== binding.org_id)
986
1021
  throw invalid('member credential capability does not match binding role');
987
1022
  }
988
- await verifyMembershipBinding(binding, context.resolveCertificate, now, context.orgSigner, true);
1023
+ await verifyMembershipBinding(binding, resolveCertificate, now, context.orgSigner, true);
989
1024
  if (!context.resolveMembershipStatus || await context.resolveMembershipStatus(binding, value) !== true)
990
1025
  throw new ProtocolError('MEMBERSHIP_STATE_INVALID', 'trusted current membership status does not permit this operation');
991
1026
  }
@@ -993,6 +1028,7 @@ export async function verifyCredential(credential, context) {
993
1028
  const params = context.params ?? {};
994
1029
  const target = context.for ?? params.for;
995
1030
  const actor = context.actor ?? context.subject;
1031
+ let verifiedRepresentation;
996
1032
  if (typeof actor !== 'string' || !AID_RE.test(actor))
997
1033
  throw new ProtocolError('CREDENTIAL_REQUEST_BINDING_INVALID', 'authenticated actor is invalid');
998
1034
  if (target !== undefined && (typeof target !== 'string' || !target || !context.actor || Object.hasOwn(params, 'for') && params.for !== target))
@@ -1004,7 +1040,9 @@ export async function verifyCredential(credential, context) {
1004
1040
  const proof = context.representationProof ?? packaged;
1005
1041
  if (packaged !== undefined && canonicalText(packaged) !== canonicalText(proof))
1006
1042
  throw new ProtocolError('CREDENTIAL_REQUEST_BINDING_INVALID', 'representation proof differs from the request');
1007
- await verifyRepresentationProof(proof, credential, { from: actor, for: target, audience: context.target, resource: target, params, binding: context.requestBinding }, context.resolveActorCertificate ?? context.resolveCertificate, now, context.proofChain);
1043
+ const representationRequest = { from: actor, for: target, audience: context.target, resource: target, params, binding: context.requestBinding };
1044
+ await verifyRepresentationProof(proof, credential, representationRequest, resolveActorCertificate, now, context.proofChain);
1045
+ verifiedRepresentation = { proof: proof, request: representationRequest };
1008
1046
  const subjects = [String(target), ...(context.subject !== actor && context.subject !== target ? [context.subject] : [])];
1009
1047
  let allowed = Boolean(context.resolveOwnership);
1010
1048
  try {
@@ -1021,6 +1059,28 @@ export async function verifyCredential(credential, context) {
1021
1059
  throw new ProtocolError('ROLE_ACCESS_DENIED', 'trusted current ownership does not permit representation');
1022
1060
  result.representation_checked = true;
1023
1061
  }
1062
+ if (context.now === undefined) {
1063
+ const completedAt = Math.trunc(Date.now() / 1000);
1064
+ for (const document of documents)
1065
+ validateCredentialAt(document, completedAt, context.audience);
1066
+ await validateCredentialCapability(credential, { ns: context.ns, action: context.action, resource: context.resource, params: context.params, units: context.units, now: completedAt, client_ip: context.clientIp, proof_chain: context.proofChain }, () => true);
1067
+ validateRequestBinding(context.requestBinding, context.method, context.target, context.params ?? {}, String(value.cid), context.nonce ?? '', context.requestId ?? '', completedAt);
1068
+ for (const proof of statusProofs) {
1069
+ if (proof.asOf > completedAt + 300 || completedAt >= proof.proofExpiresAt)
1070
+ throw new ProtocolError('CREDENTIAL_STATUS_UNKNOWN', 'trusted credential status proof is unavailable');
1071
+ }
1072
+ for (const material of resolvedCertificates) {
1073
+ const metadata = parseCertMetadata(certificatePem(material));
1074
+ if (completedAt < metadata.notBefore.getTime() / 1000 || completedAt > metadata.notAfter.getTime() / 1000)
1075
+ throw new ProtocolError('CREDENTIAL_SIGNATURE_INVALID', 'certificate is not valid');
1076
+ }
1077
+ if (verifiedRepresentation) {
1078
+ const { proof, request } = verifiedRepresentation;
1079
+ if (completedAt < proof.iat || completedAt >= proof.exp)
1080
+ throw representationBindingInvalid('representation time window is invalid');
1081
+ validateRepresentationContext(proof, value, request, completedAt);
1082
+ }
1083
+ }
1024
1084
  return result;
1025
1085
  }
1026
1086
  export function validateCredentialAt(credential, now, audience, proofChain) {
@@ -1507,7 +1567,7 @@ function orgRequestBindingParams(method, params) {
1507
1567
  export function buildRequestBinding(method, target, params, credentialCid, nonce, requestId, iat, exp) {
1508
1568
  if (![method, target, nonce, requestId].every((value) => typeof value === 'string' && value.length > 0) || typeof credentialCid !== 'string' || (!credentialCid !== (method === 'credential.revocationList')))
1509
1569
  throw invalid('request binding identity is invalid');
1510
- if (!isInt(iat) || !isInt(exp) || exp <= iat)
1570
+ if (!isInt(iat) || !isInt(exp) || exp <= iat || exp > iat + 300)
1511
1571
  throw invalid('request binding time window is invalid');
1512
1572
  return { request_id: requestId, nonce, target, method, params_hash: digest(orgRequestBindingParams(method, params)), iat, exp, credential_cid: credentialCid };
1513
1573
  }
@@ -1519,7 +1579,7 @@ export function validateRequestBinding(binding, method, target, params, credenti
1519
1579
  throw new ProtocolError('CREDENTIAL_REQUEST_BINDING_INVALID', 'request binding is invalid');
1520
1580
  if (binding.request_id !== requestId || binding.nonce !== nonce || binding.target !== target || binding.method !== method || binding.credential_cid !== credentialCid || binding.params_hash !== digest(orgRequestBindingParams(method, params)))
1521
1581
  throw new ProtocolError('CREDENTIAL_REQUEST_BINDING_INVALID', 'request binding does not match request');
1522
- if (!isInt(binding.iat) || !isInt(binding.exp) || binding.exp <= binding.iat || !isInt(now) || now < binding.iat || now >= binding.exp)
1582
+ if (!isInt(binding.iat) || !isInt(binding.exp) || binding.exp <= binding.iat || binding.exp > binding.iat + 300 || !isInt(now) || now < binding.iat || now >= binding.exp)
1523
1583
  throw new ProtocolError('CREDENTIAL_REQUEST_BINDING_INVALID', 'request binding is outside its validity window');
1524
1584
  }
1525
1585
  function representationBindingInvalid(message) {