@agentunion/fastaun-browser 0.5.19 → 0.5.20

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (114) hide show
  1. package/CHANGELOG.md +129 -78
  2. package/_packed_docs/CHANGELOG.md +129 -78
  3. package/_packed_docs/INDEX.md +201 -195
  4. package/_packed_docs/KITE_DOCS_GUIDE.md +93 -90
  5. package/_packed_docs/agent.md/SCHEMA.md +7 -7
  6. package/_packed_docs/agent.md//350/277/234/347/250/213agent.md/347/274/223/345/255/230/344/270/216etag/351/200/217/344/274/240/346/226/271/346/241/210.md +11 -11
  7. package/_packed_docs/protocol/06-/346/234/215/345/212/241/345/215/217/350/256/256.md +1072 -1072
  8. package/_packed_docs/protocol/10-Group-/345/255/220/345/215/217/350/256/256.md +676 -676
  9. package/_packed_docs/protocol/11-Storage-/345/255/220/345/215/217/350/256/256.md +8 -12
  10. package/_packed_docs/protocol/Ownership/345/215/217/350/256/256/345/256/232/344/271/211.md +443 -0
  11. package/_packed_docs/protocol/Ownership/345/215/217/350/256/256/345/256/232/344/271/2112.0.md +161 -0
  12. package/_packed_docs/protocol/Ownership/345/215/217/350/256/256/345/256/232/344/271/2112.1.md +658 -0
  13. package/_packed_docs/protocol/Ownership/345/215/217/350/256/256/345/256/232/344/271/2113.0.md +233 -0
  14. package/_packed_docs/protocol/agent.md/SCHEMA.md +1 -1
  15. package/_packed_docs/sdk/03-/346/240/270/345/277/203/346/246/202/345/277/265.md +1 -1
  16. package/_packed_docs/sdk/04-/350/277/236/346/216/245/344/270/216/350/256/244/350/257/201.md +67 -63
  17. package/_packed_docs/sdk/05-E2EE/345/212/240/345/257/206/351/200/232/344/277/241.md +1 -1
  18. package/_packed_docs/sdk/06-API/346/211/213/345/206/214.md +35 -8
  19. package/_packed_docs/sdk/08-/346/234/200/344/275/263/345/256/236/350/267/265.md +3 -3
  20. package/_packed_docs/sdk/09-group-rpc-manual.md +258 -254
  21. package/_packed_docs/sdk/09-message-rpc-manual.md +7 -4
  22. package/_packed_docs/sdk/09-storage-rpc-manual.md +18 -26
  23. package/_packed_docs/sdk/AUN_DOCS_GUIDE.md +61 -52
  24. package/_packed_docs/sdk/INDEX.md +92 -80
  25. package/_packed_docs/sdk/Ownership-SDK/345/256/236/347/216/260/346/214/207/345/215/227.md +169 -0
  26. package/_packed_docs/sdk/Ownership-SDK/347/274/226/346/216/222/346/214/207/345/215/227.md +349 -0
  27. package/_packed_docs/sdk/Ownership-SDK/347/274/226/346/216/222/346/214/207/345/215/2272.1.md +922 -0
  28. package/_packed_docs/sdk/Ownership-SDK/351/233/206/346/210/220/346/214/207/345/215/227.md +270 -0
  29. package/_packed_docs/sdk/Ownership2.1-SDK/345/272/224/347/224/250/351/233/206/346/210/220/346/214/207/345/215/227.md +300 -0
  30. package/_packed_docs/sdk/Ownership2.1-SDK/345/274/200/345/217/221/344/270/216/347/247/273/346/244/215/346/214/207/345/215/227.md +382 -0
  31. package/_packed_docs/sdk/Ownership2.1-TDD/345/210/206/351/230/266/346/256/265/345/256/236/346/226/275/350/256/241/345/210/222.md +708 -0
  32. package/_packed_docs/sdk/Ownership2.1/350/257/246/347/273/206/350/256/276/350/256/241.md +476 -0
  33. package/_packed_docs/sdk/Ownership/347/256/241/347/220/206/344/270/223/351/242/230.md +559 -0
  34. package/_packed_docs/sdk/ProtectedHeaders/347/224/250/346/263/225/344/270/223/351/242/230.md +299 -0
  35. package/_packed_docs/sdk//345/207/255/350/257/201/344/270/216/347/273/204/347/273/207/346/234/215/345/212/241SDK/345/272/224/347/224/250/351/233/206/346/210/220/346/214/207/345/215/227.md +173 -0
  36. package/_packed_docs/sdk//345/207/255/350/257/201/344/270/216/347/273/204/347/273/207/346/234/215/345/212/241SDK/345/274/200/345/217/221/344/270/216/347/247/273/346/244/215/346/214/207/345/215/227.md +211 -0
  37. package/_packed_docs//350/267/250/350/256/276/345/244/207/345/267/262/350/257/273/346/234/252/350/257/273SDK/345/256/236/347/216/260/347/247/273/346/244/215/346/214/207/345/215/227.md +331 -0
  38. package/_packed_docs//350/267/250/350/256/276/345/244/207/345/267/262/350/257/273/346/234/252/350/257/273SDK/351/233/206/346/210/220/346/214/207/345/215/227.md +207 -0
  39. package/_packed_docs//350/267/250/350/256/276/345/244/207/345/267/262/350/257/273/346/234/252/350/257/273/344/273/243/347/240/201/345/256/241/346/237/245/346/212/245/345/221/212.md +252 -0
  40. package/_packed_docs//350/267/250/350/256/276/345/244/207/345/267/262/350/257/273/346/234/252/350/257/273/345/256/236/346/226/275/350/256/241/345/210/222.md +156 -0
  41. package/_packed_docs//350/267/250/350/256/276/345/244/207/345/267/262/350/257/273/346/234/252/350/257/273/346/226/271/346/241/210.md +273 -0
  42. package/_packed_docs//350/267/250/350/256/276/345/244/207/345/267/262/350/257/273/346/234/252/350/257/273/350/257/246/347/273/206/350/256/276/350/256/241.md +211 -0
  43. package/dist/agent-md-schema.d.ts +15 -4
  44. package/dist/agent-md-schema.d.ts.map +1 -1
  45. package/dist/agent-md-schema.js +64 -30
  46. package/dist/agent-md-schema.js.map +1 -1
  47. package/dist/agent-md.d.ts +10 -2
  48. package/dist/agent-md.d.ts.map +1 -1
  49. package/dist/agent-md.js +278 -121
  50. package/dist/agent-md.js.map +1 -1
  51. package/dist/aid-store.d.ts +46 -0
  52. package/dist/aid-store.d.ts.map +1 -1
  53. package/dist/aid-store.js +149 -10
  54. package/dist/aid-store.js.map +1 -1
  55. package/dist/aid.d.ts +4 -1
  56. package/dist/aid.d.ts.map +1 -1
  57. package/dist/aid.js +23 -42
  58. package/dist/aid.js.map +1 -1
  59. package/dist/auth.d.ts +1 -1
  60. package/dist/auth.d.ts.map +1 -1
  61. package/dist/auth.js +85 -18
  62. package/dist/auth.js.map +1 -1
  63. package/dist/bundle.js +1581 -781
  64. package/dist/cert-utils.d.ts +49 -1
  65. package/dist/cert-utils.d.ts.map +1 -1
  66. package/dist/cert-utils.js +102 -56
  67. package/dist/cert-utils.js.map +1 -1
  68. package/dist/client/delivery.d.ts +7 -0
  69. package/dist/client/delivery.d.ts.map +1 -1
  70. package/dist/client/delivery.js +243 -28
  71. package/dist/client/delivery.js.map +1 -1
  72. package/dist/client/rpc-pipeline.d.ts.map +1 -1
  73. package/dist/client/rpc-pipeline.js +89 -77
  74. package/dist/client/rpc-pipeline.js.map +1 -1
  75. package/dist/client/v2-e2ee.d.ts.map +1 -1
  76. package/dist/client/v2-e2ee.js +99 -80
  77. package/dist/client/v2-e2ee.js.map +1 -1
  78. package/dist/client.d.ts.map +1 -1
  79. package/dist/client.js +31 -17
  80. package/dist/client.js.map +1 -1
  81. package/dist/crypto.d.ts.map +1 -1
  82. package/dist/crypto.js +8 -6
  83. package/dist/crypto.js.map +1 -1
  84. package/dist/events.d.ts +5 -2
  85. package/dist/events.d.ts.map +1 -1
  86. package/dist/events.js +33 -14
  87. package/dist/events.js.map +1 -1
  88. package/dist/facades.js +5 -5
  89. package/dist/facades.js.map +1 -1
  90. package/dist/index.d.ts +1 -1
  91. package/dist/index.d.ts.map +1 -1
  92. package/dist/index.js.map +1 -1
  93. package/dist/org-protocol.d.ts.map +1 -1
  94. package/dist/org-protocol.js +72 -12
  95. package/dist/org-protocol.js.map +1 -1
  96. package/dist/ownership-v21.d.ts +25 -8
  97. package/dist/ownership-v21.d.ts.map +1 -1
  98. package/dist/ownership-v21.js +142 -73
  99. package/dist/ownership-v21.js.map +1 -1
  100. package/dist/ownership-workflow.d.ts +6 -1
  101. package/dist/ownership-workflow.d.ts.map +1 -1
  102. package/dist/ownership-workflow.js +221 -58
  103. package/dist/ownership-workflow.js.map +1 -1
  104. package/dist/tools/cross-sdk-agent.d.ts +2 -1
  105. package/dist/tools/cross-sdk-agent.d.ts.map +1 -1
  106. package/dist/tools/cross-sdk-agent.js +91 -8
  107. package/dist/tools/cross-sdk-agent.js.map +1 -1
  108. package/dist/transport.d.ts +1 -0
  109. package/dist/transport.d.ts.map +1 -1
  110. package/dist/transport.js +2 -0
  111. package/dist/transport.js.map +1 -1
  112. package/dist/version.d.ts +1 -1
  113. package/dist/version.js +1 -1
  114. package/package.json +1 -1
package/dist/ownership-v21.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"ownership-v21.d.ts","sourceRoot":"","sources":["../src/ownership-v21.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAOpC,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,OAAO,CAAC;AAClD,MAAM,MAAM,wBAAwB,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,cAAc,GAAG,SAAS,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAE5I,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,CAAC,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,UAAU,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACzC,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,gBAAgB,CAAC;IAClD,QAAQ,CAAC,EAAE,oBAAoB,CAAC;CACjC;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,wBAAwB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAGD,eAAO,MAAM,oBAAoB,QAA0E,CAAC;AAG5G,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGlE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAI,GAAG,MAAM,CAG/E;AAWD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,CAUhF;AAED,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAiBxI;AA2BD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,GAAE,oBAAyB,GAAG,aAAa,CA2C3I;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,oBAAoB,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,aAAa,CAAC,CAgB9L;AAED,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,MAAM,CAAC,CAWjK;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAInF;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAE7G;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,yBAAyB,EAAE,MAAM,CAAC;IAClC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,GAAG,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,uBAAuB,EAAE,MAAM,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,IAAI,GAAG,CAAC;IAClB,cAAc,CAAC,IAAI,MAAM,CAAC;IAC1B,GAAG,CAAC,IAAI,MAAM,CAAC;IACf,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAClE,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,qBAAqB,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC9H,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/E,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACvH,aAAa,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACpH;AAED,MAAM,WAAW,4BAA4B;IAC3C,UAAU,IAAI,MAAM,CAAC;IACrB,GAAG,CAAC,IAAI,MAAM,CAAC;IACf,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzE;AAED,qBAAa,uBAAuB;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,4BAA4B;IAE/D,OAAO,CAAC,KAAK;YAEC,OAAO;IAYrB,OAAO,CAAC,QAAQ;IAYV,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAuBzE,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAI9E,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAUtH,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAQ/F;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAE9D;AAED,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,yBAAyB;IAE5D,OAAO,CAAC,GAAG;IAEX,OAAO,CAAC,KAAK;IAKb,qBAAqB,CAAC,QAAQ,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAOvE,qBAAqB,CAAC,QAAQ,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxG,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAQ1D,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAM5E,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAY3G,cAAc,CAAC,MAAM,SAA6B,EAAE,aAAa,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,wBAAwB,CAAC;IA6C7J,OAAO,CAAC,KAAK;IAMb,OAAO,CAAC,SAAS;IAIX,WAAW,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAYrE,cAAc,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC;YAcvD,YAAY;IAsCpB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAMtE,YAAY,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAIrE,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;YAKjE,YAAY;IAkDpB,eAAe,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAExE,cAAc,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAEvE,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;CAkB/D"}
1
+ {"version":3,"file":"ownership-v21.d.ts","sourceRoot":"","sources":["../src/ownership-v21.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAEpC,OAAO,EAAgC,KAAK,iBAAiB,EAA6C,MAAM,iBAAiB,CAAC;AAKlI,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,OAAO,CAAC;AAClD,MAAM,MAAM,wBAAwB,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,cAAc,GAAG,SAAS,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAE5I,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,CAAC,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,CAAC,GAAG,oBAAoB,CAAC;CAClH;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,UAAU,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACzC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,gBAAgB,CAAC;IAClD,QAAQ,CAAC,EAAE,oBAAoB,CAAC;CACjC;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,wBAAwB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAGD,eAAO,MAAM,oBAAoB,QAA0E,CAAC;AAG5G,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGlE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAI,GAAG,MAAM,CAG/E;AAWD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,CAUhF;AAED,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAiBxI;AA2BD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,GAAE,oBAAyB,GAAG,aAAa,CA4C3I;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,oBAAoB,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,aAAa,CAAC,CAoB9L;AAED,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,MAAM,CAAC,CAUjK;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAInF;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAE7G;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,yBAAyB,EAAE,MAAM,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IAAG,MAAM,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,qBAAqB,GAAG,IAAI,CAAC;CAAE;AAC9I,MAAM,WAAW,oBAAoB;IAAG,MAAM,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;CAAE;AAEvF,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,GAAG,CAAA;KAAE,CAAC;IACtD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,uBAAuB,EAAE,MAAM,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wBAAwB,CAAC,EAAE,qBAAqB,CAAC;IACjD,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,IAAI,GAAG,CAAC;IAClB,cAAc,CAAC,IAAI,MAAM,CAAC;IAC1B,GAAG,CAAC,IAAI,MAAM,CAAC;IACf,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAClE,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,qBAAqB,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC9H,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/E,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC7F,aAAa,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACpH;AAED,MAAM,WAAW,4BAA4B;IAC3C,UAAU,IAAI,MAAM,CAAC;IACrB,GAAG,CAAC,IAAI,MAAM,CAAC;IACf,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE,OAAO,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1F;AAED,qBAAa,uBAAuB;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,4BAA4B;IAE/D,OAAO,CAAC,KAAK;YAEC,OAAO;IAYrB,OAAO,CAAC,QAAQ;IAYV,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAuBzE,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAI9E,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAwB5F,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAOrE;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAE9D;AAED,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,yBAAyB;IAE5D,OAAO,CAAC,GAAG;IAEX,OAAO,CAAC,KAAK;IAKb,qBAAqB,CAAC,QAAQ,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAOvE,qBAAqB,CAAC,QAAQ,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxG,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAQ1D,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAM5E,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAY3G,cAAc,CAAC,MAAM,SAA6B,EAAE,aAAa,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAgD7J,OAAO,CAAC,KAAK;IAMb,OAAO,CAAC,SAAS;IAIX,WAAW,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAqBrE,cAAc,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC;YAkBvD,YAAY;IA4CpB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAMtE,YAAY,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAIrE,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;YAKjE,YAAY;IAmDpB,eAAe,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAExE,cAAc,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAEvE,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;CAyB/D"}
package/dist/ownership-v21.js CHANGED
@@ -1,5 +1,5 @@
1
1
  import { parseFileFrontmatter, validateAgentMdCertificate, validateAgentMdDocument } from './agent-md-schema.js';
2
- import { buildAgentMdSignatureBlock, certFingerprint, isStrictBase64, parseAgentMdTailSignature, publicKeyFingerprint, publicKeyMatchesFingerprint, signBytes, verifySignatureWithCert } from './cert-utils.js';
2
+ import { signDocument, verifyDocument, isStrictBase64, parseAgentMdTailSignature } from './cert-utils.js';
3
3
  import { base64ToUint8 } from './crypto.js';
4
4
  import { StateError, ValidationError } from './errors.js';
5
5
  import { buildDefaultAgentMd, buildOwnershipAgentMdV21 } from './agent-md.js';
@@ -108,7 +108,9 @@ export function parseOwnershipFile(content, role, context = {}) {
108
108
  if (raw.length - new TextEncoder().encode(parsed.payload).length > 2048)
109
109
  throw new ValidationError('ownership file signature exceeds 2048 bytes');
110
110
  const fields = parsed.fields;
111
- if (fields) {
111
+ if (fields?.signer_aid !== undefined)
112
+ throw new ValidationError('ownership main signature contains unknown signer_aid');
113
+ for (const { fields } of parsed.signatures) {
112
114
  if (!/^sha256:[0-9a-f]{64}$/.test(fields.cert_fingerprint) || fields.public_key_fingerprint !== undefined && !/^sha256:[0-9a-f]{64}$/.test(fields.public_key_fingerprint))
113
115
  throw new ValidationError('ownership file fingerprint is invalid');
114
116
  if (!/^[1-9][0-9]*$/.test(fields.timestamp) || !Number.isSafeInteger(Number(fields.timestamp)))
@@ -154,7 +156,7 @@ export function parseOwnershipFile(content, role, context = {}) {
154
156
  }
155
157
  else
156
158
  throw new ValidationError('ownership file role is invalid');
157
- return { raw, payload: parsed.payload, frontmatter, signature: fields, statement, action, transfer };
159
+ return { raw, payload: parsed.payload, frontmatter, signature: fields, signatures: parsed.signatures, statement, action, transfer };
158
160
  }
159
161
  export async function verifyOwnershipFile(content, role, certificate, context = {}) {
160
162
  const parsed = parseOwnershipFile(content, role, { ...context, requireSignature: true });
@@ -165,19 +167,20 @@ export async function verifyOwnershipFile(content, role, certificate, context =
165
167
  if (context.expectedTargetAid && context.expectedTargetAid !== sub || context.authenticatedAid && context.authenticatedAid !== signer || context.certificateAid && context.certificateAid !== signer || context.resourcePath && context.resourcePath !== `${signer}:/${storagePath}` || context.storagePath && context.storagePath !== storagePath)
166
168
  throw new ValidationError('ownership file resource or authenticated identity mismatch');
167
169
  const now = Math.trunc(context.now ?? Date.now() / 1000);
168
- if (Number(fields.timestamp) > now + 300)
169
- throw new ValidationError('ownership file timestamp is too far in the future');
170
- if (certificate.chain_valid === false || certificate.revoked === true || typeof certificate.state === 'string' && certificate.state !== 'active_signing')
171
- throw new ValidationError('ownership signing certificate is not currently verified and active_signing', { stringCode: 'invalid' });
172
- if (certificate.chain_valid !== true || certificate.state !== 'active_signing' || certificate.revoked !== false || certificate.revocation_checked !== true || !Number.isSafeInteger(certificate.observed_at) || certificate.observed_at <= 0 || certificate.observed_at > now + 5 || certificate.observed_at < now - 30)
173
- throw new StateError('ownership certificate current status is unavailable', { stringCode: 'unavailable', retryable: true });
174
- validateAgentMdCertificate(certificate.cert_pem, signer, Number(fields.timestamp), now);
175
- if (await certFingerprint(certificate.cert_pem) !== fields.cert_fingerprint)
176
- throw new ValidationError('ownership certificate fingerprint mismatch');
177
- if (fields.public_key_fingerprint && !await publicKeyMatchesFingerprint(certificate.cert_pem, fields.public_key_fingerprint))
178
- throw new ValidationError('ownership public key fingerprint mismatch');
179
- if (!await verifySignatureWithCert(certificate.cert_pem, fields.signature, new TextEncoder().encode(parsed.payload)))
180
- throw new ValidationError('ownership file signature verification failed');
170
+ const verified = await verifyDocument(new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(parsed.raw), async (blockSigner, fingerprint, timestamp) => {
171
+ const material = blockSigner === signer && fingerprint === fields.cert_fingerprint ? certificate : context.certificateResolver ? await context.certificateResolver(blockSigner, fingerprint) : null;
172
+ if (!material)
173
+ throw new StateError('ownership additional signing certificate is unavailable', { stringCode: 'unavailable', retryable: true });
174
+ if (material.chain_valid === false || material.revoked === true || typeof material.state === 'string' && material.state !== 'active_signing')
175
+ throw new ValidationError('ownership signing certificate is not currently verified and active_signing', { stringCode: 'invalid' });
176
+ if (material.chain_valid !== true || material.state !== 'active_signing' || material.revoked !== false || material.revocation_checked !== true || !Number.isSafeInteger(material.observed_at) || material.observed_at <= 0 || material.observed_at > now + 5 || material.observed_at < now - 30)
177
+ throw new StateError('ownership certificate current status is unavailable', { stringCode: 'unavailable', retryable: true });
178
+ validateAgentMdCertificate(material.cert_pem, blockSigner, timestamp, now);
179
+ return material.cert_pem;
180
+ }, { expectedAid: signer, now, requireCurrentValidity: true });
181
+ if (!verified.valid) {
182
+ throw new ValidationError(verified.reason || 'ownership file signature verification failed');
183
+ }
181
184
  return parsed;
182
185
  }
183
186
  export async function signOwnershipFile(identity, content, role, context = {}) {
@@ -193,8 +196,7 @@ export async function signOwnershipFile(identity, content, role, context = {}) {
193
196
  throw new ValidationError('ownership payload must end with a newline before signature');
194
197
  const now = Math.trunc(context.now ?? Date.now() / 1000);
195
198
  validateAgentMdCertificate(identity.certPem, identity.aid, now, now);
196
- const signature = await signBytes(identity.privateKeyPem, new TextEncoder().encode(parsed.payload));
197
- return parsed.payload + buildAgentMdSignatureBlock(identity.certFingerprint, now, signature, await publicKeyFingerprint(identity.certPem), role === 'agent' ? 'AUN-SIGNATURE-AGENTMD-V2' : 'AUN-SIGNATURE-OWNERSHIP-V2');
199
+ return (await signDocument(identity, parsed.payload, { now, tag: role === 'agent' ? 'AGENTMD-V2' : 'OWNERSHIP-V2' })).signed;
198
200
  }
199
201
  export async function ownershipSha256(content) {
200
202
  const bytes = typeof content === 'string' ? new TextEncoder().encode(content) : content;
@@ -219,9 +221,9 @@ export class OwnershipStorageAdapter {
219
221
  }
220
222
  catch (error) {
221
223
  if (error instanceof StateError && error.stringCode)
222
- throw error;
224
+ throw error.stringCode === 'forbidden' && (method === 'storage.head_object' || method === 'storage.get_object') ? this.error('unavailable', error.message) : error;
223
225
  const code = error?.code;
224
- throw this.error(code === -32009 ? 'conflict' : code === -32004 ? 'forbidden' : code === -32601 || code === -32602 ? 'unsupported_protocol' : 'unavailable', `Storage ownership request failed: ${String(error)}`);
226
+ throw this.error(code === -32009 ? 'conflict' : code === -32004 ? method === 'storage.head_object' || method === 'storage.get_object' ? 'unavailable' : 'forbidden' : code === -32601 ? 'unsupported_protocol' : code === -32602 ? 'invalid' : 'unavailable', `Storage ownership request failed: ${String(error)}`);
225
227
  }
226
228
  }
227
229
  metadata(value, ownerAid, path) {
@@ -230,13 +232,13 @@ export class OwnershipStorageAdapter {
230
232
  const service = `st.${ownerAid.slice(ownerAid.indexOf('.') + 1)}`;
231
233
  if (Object.hasOwn(value, 'service_aid') && value.service_aid !== service || Object.hasOwn(value, 'authenticated_service_aid') && value.authenticated_service_aid !== service)
232
234
  throw this.error('unavailable', 'Storage authoritative service identity unavailable');
233
- if (value.consistency !== 'authoritative' || Object.hasOwn(value, 'recovery_ready') && value.recovery_ready !== true || value.owner_aid !== ownerAid || value.bucket !== 'default' || value.path !== path || typeof value.exists !== 'boolean' || typeof value.revision !== 'string' || !value.revision || !Number.isSafeInteger(observed) || observed < now - 30 || observed > now + 5 || observed <= 0)
234
- throw this.error('unavailable', 'Storage authoritative namespace, revision or freshness unavailable');
235
- if (value.exists && (typeof value.sha256 !== 'string' || !/^[0-9a-f]{64}$/.test(value.sha256) || typeof value.object_id !== 'string' || !value.object_id || !Number.isSafeInteger(value.version) || Number(value.version) <= 0))
235
+ if (value.consistency !== 'authoritative' || Object.hasOwn(value, 'recovery_ready') && value.recovery_ready !== true || value.owner_aid !== ownerAid || value.bucket !== 'default' || value.path !== path || typeof value.exists !== 'boolean' || !Number.isSafeInteger(observed) || observed < now - 30 || observed > now + 5 || observed <= 0)
236
+ throw this.error('unavailable', 'Storage authoritative namespace or freshness unavailable');
237
+ if (value.exists && (typeof value.sha256 !== 'string' || !/^[0-9a-f]{64}$/.test(value.sha256)))
236
238
  throw this.error('unavailable', 'Storage authoritative object metadata unavailable');
237
- return { owner_aid: ownerAid, bucket: 'default', path, exists: value.exists, revision: value.revision,
239
+ return { owner_aid: ownerAid, bucket: 'default', path, exists: value.exists,
238
240
  observed_at: observed, sha256: value.exists ? String(value.sha256) : '', content: '', authoritative: true,
239
- service_aid: service, authenticated_service_aid: service };
241
+ service_aid: service, authenticated_service_aid: service, version: value.exists && Number.isSafeInteger(value.version) && Number(value.version) > 0 ? Number(value.version) : undefined };
240
242
  }
241
243
  async readFile(ownerAid, path) {
242
244
  ownershipAid(ownerAid, 'owner_aid');
@@ -246,10 +248,10 @@ export class OwnershipStorageAdapter {
246
248
  const before = this.metadata(beforeRaw, ownerAid, path);
247
249
  if (!before.exists)
248
250
  return before;
249
- const body = await this.request('storage.get_object', { ...params, expected_revision: before.revision });
251
+ const body = await this.request('storage.get_object', params);
250
252
  const current = this.metadata(body, ownerAid, path);
251
- if (!current.exists || current.revision !== before.revision || current.sha256 !== before.sha256 || body.object_id !== beforeRaw.object_id || body.version !== beforeRaw.version)
252
- throw this.error('unavailable', 'Storage ownership body revision changed');
253
+ if (!current.exists || current.sha256 !== before.sha256)
254
+ throw this.error('unavailable', 'Storage ownership body changed');
253
255
  if (typeof body.content !== 'string')
254
256
  throw this.error('unavailable', 'Storage ownership body is unavailable');
255
257
  if (body.content !== '' && !isStrictBase64(body.content))
@@ -266,34 +268,51 @@ export class OwnershipStorageAdapter {
266
268
  }
267
269
  const afterRaw = await this.request('storage.head_object', params);
268
270
  const after = this.metadata(afterRaw, ownerAid, path);
269
- if (!after.exists || after.revision !== before.revision || after.sha256 !== before.sha256 || afterRaw.object_id !== beforeRaw.object_id || afterRaw.version !== beforeRaw.version || Math.trunc(this.deps.now?.() ?? Date.now() / 1000) - began > 30)
271
+ if (!after.exists || after.sha256 !== before.sha256 || Math.trunc(this.deps.now?.() ?? Date.now() / 1000) - began > 30)
270
272
  throw this.error('unavailable', 'Storage ownership changed during authoritative read');
271
273
  return { ...after, content };
272
274
  }
273
275
  async readOwnerMd(ownerAid, subAid) {
274
276
  return await this.readFile(ownerAid, `sub_aids/${ownershipAid(subAid, 'sub_aid')}/owner.md`);
275
277
  }
276
- async writeOwnerMd(ownerAid, subAid, raw, expectedRevision) {
278
+ async writeOwnerMd(ownerAid, subAid, raw) {
277
279
  if (ownerAid !== this.deps.currentAid())
278
280
  throw this.error('forbidden', 'only the authenticated owner may publish owner.md');
279
- if (typeof expectedRevision !== 'string' || !expectedRevision)
280
- throw this.error('invalid', 'ownership expected_revision is required');
281
+ const path = `sub_aids/${ownershipAid(subAid, 'sub_aid')}/owner.md`;
282
+ const before = await this.readOwnerMd(ownerAid, subAid);
281
283
  const bytes = new TextEncoder().encode(raw);
282
- let binary = '';
283
- for (const byte of bytes)
284
- binary += String.fromCharCode(byte);
285
- await this.request('storage.put_object', { owner_aid: ownershipAid(ownerAid, 'owner_aid'), bucket: 'default', object_key: `sub_aids/${ownershipAid(subAid, 'sub_aid')}/owner.md`, content: btoa(binary), content_type: 'text/markdown', is_private: false, overwrite: true, expected_revision: expectedRevision });
284
+ const expectedVersion = before.exists ? before.version : 0;
285
+ if (typeof expectedVersion !== 'number' || !Number.isSafeInteger(expectedVersion) || expectedVersion < (before.exists ? 1 : 0))
286
+ throw this.error('unavailable', 'Storage owner.md version is unavailable');
287
+ const session = await this.request('storage.create_upload_session', { owner_aid: ownershipAid(ownerAid, 'owner_aid'), bucket: 'default', object_key: path, size_bytes: bytes.length, content_type: 'text/markdown; charset=utf-8', expected_version: expectedVersion, overwrite: true });
288
+ const uploadURL = String(session.upload_url ?? ''), sessionID = String(session.session_id ?? '');
289
+ if (!uploadURL || !sessionID)
290
+ throw this.error('unavailable', 'Storage owner.md upload session is incomplete');
291
+ const headers = {};
292
+ if (session.headers && typeof session.headers === 'object')
293
+ for (const [key, value] of Object.entries(session.headers))
294
+ if (value !== undefined && value !== null && key.toLowerCase() !== 'content-type')
295
+ headers[key] = String(value);
296
+ headers['Content-Type'] = 'text/markdown; charset=utf-8';
297
+ if (this.deps.httpPut)
298
+ await this.deps.httpPut(uploadURL, bytes, headers);
299
+ else {
300
+ const response = await fetch(uploadURL, { method: 'PUT', body: bytes, headers });
301
+ if (!response.ok)
302
+ throw this.error('unavailable', `Storage owner.md HTTP PUT failed: ${response.status}`);
303
+ }
304
+ const complete = { owner_aid: ownerAid, bucket: 'default', object_key: path, session_id: sessionID, size_bytes: bytes.length, sha256: await ownershipSha256(bytes), content_type: 'text/markdown; charset=utf-8', is_private: false, overwrite: true };
305
+ complete.expected_version = expectedVersion;
306
+ await this.request('storage.complete_upload', complete);
286
307
  return await this.readOwnerMd(ownerAid, subAid);
287
308
  }
288
- async deleteOwnerMd(ownerAid, subAid, expectedRevision) {
309
+ async deleteOwnerMd(ownerAid, subAid) {
289
310
  if (ownerAid !== this.deps.currentAid())
290
311
  throw this.error('forbidden', 'only the authenticated owner may delete owner.md');
291
- if (typeof expectedRevision !== 'string' || !expectedRevision)
292
- throw this.error('invalid', 'ownership expected_revision is required');
293
312
  const path = `sub_aids/${ownershipAid(subAid, 'sub_aid')}/owner.md`;
294
- await this.request('storage.delete_object', { owner_aid: ownershipAid(ownerAid, 'owner_aid'), bucket: 'default', object_key: path, expected_revision: expectedRevision });
313
+ await this.request('storage.delete_object', { owner_aid: ownershipAid(ownerAid, 'owner_aid'), bucket: 'default', object_key: path });
295
314
  const after = this.metadata(await this.request('storage.head_object', { owner_aid: ownerAid, bucket: 'default', object_key: path, consistency: 'authoritative' }), ownerAid, path);
296
- if (after.exists || after.revision === expectedRevision)
315
+ if (after.exists)
297
316
  throw this.error('conflict', 'Storage ownership deletion could not be confirmed');
298
317
  }
299
318
  }
@@ -318,12 +337,12 @@ export class OwnershipFiles {
318
337
  if (snapshot.sub_aid !== subAid || Object.hasOwn(snapshot, 'recovery_ready') && snapshot.recovery_ready !== true || !['locked', 'unlocked'].includes(snapshot.lock) || typeof snapshot.exists !== 'boolean' || !Number.isSafeInteger(snapshot.relation_version) || snapshot.relation_version < 0)
319
338
  throw new StateError('NS ownership 2.1 authoritative metadata is unavailable', { stringCode: 'unavailable', retryable: true });
320
339
  if (snapshot.exists && !snapshot.etag || !snapshot.exists && (snapshot.lock !== 'unlocked' || snapshot.relation_version !== 0))
321
- throw new StateError('NS ownership document or ledger is unavailable');
340
+ throw new StateError('NS ownership document metadata is unavailable');
322
341
  this.fresh(snapshot.observed_at);
323
342
  }
324
343
  async validateOwnerSnapshot(snapshot, ownerAid, subAid) {
325
344
  const expectedService = `st.${ownerAid.slice(ownerAid.indexOf('.') + 1)}`;
326
- if (snapshot.error || snapshot.authoritative !== true || Object.hasOwn(snapshot, 'recovery_ready') && snapshot.recovery_ready !== true || snapshot.owner_aid !== ownerAid || snapshot.bucket !== 'default' || snapshot.path !== `sub_aids/${subAid}/owner.md` || snapshot.service_aid !== expectedService || snapshot.authenticated_service_aid !== expectedService || typeof snapshot.revision !== 'string' || !snapshot.revision || typeof snapshot.exists !== 'boolean')
345
+ if (snapshot.error || snapshot.authoritative !== true || Object.hasOwn(snapshot, 'recovery_ready') && snapshot.recovery_ready !== true || snapshot.owner_aid !== ownerAid || snapshot.bucket !== 'default' || snapshot.path !== `sub_aids/${subAid}/owner.md` || snapshot.service_aid !== expectedService || snapshot.authenticated_service_aid !== expectedService || typeof snapshot.exists !== 'boolean')
327
346
  throw new StateError('Storage authoritative ownership object is unavailable');
328
347
  this.fresh(snapshot.observed_at);
329
348
  if (snapshot.exists && (!/^[0-9a-f]{64}$/.test(snapshot.sha256) || await ownershipSha256(snapshot.content) !== snapshot.sha256))
@@ -353,24 +372,22 @@ export class OwnershipFiles {
353
372
  const file = parseOwnershipFile(content, role, { expectedSubAid: subAid, expectedOwnerAid: role === 'owner' ? ownerAid : undefined, now: this.now() });
354
373
  const signer = role === 'agent' ? subAid : ownerAid;
355
374
  const certificate = await this.deps.resolveCertificate(signer, file.signature.cert_fingerprint, role === 'agent' && file.frontmatter.type === 'group' ? 'group_identity' : undefined);
356
- return await verifyOwnershipFile(content, role, certificate, { expectedSubAid: subAid, expectedOwnerAid: role === 'owner' ? ownerAid : undefined, certificateAid: signer, now: this.now() });
375
+ return await verifyOwnershipFile(content, role, certificate, { expectedSubAid: subAid, expectedOwnerAid: role === 'owner' ? ownerAid : undefined, certificateAid: signer, certificateResolver: (aid, fingerprint) => this.deps.resolveCertificate(aid, fingerprint), now: this.now() });
357
376
  }
358
377
  async checkConsensus(subAid = this.deps.currentAid().aid, pendingTarget) {
359
378
  const began = this.now();
360
- const result = { status: 'unavailable', sub_aid: subAid, owner_aid: null, relation_version: 0, lock: 'unlocked', agent_md_etag: '', agent_md_sha256: '', owner_md_revision: '', owner_md_sha256: '' };
379
+ const result = { status: 'unavailable', sub_aid: subAid, owner_aid: null, relation_version: 0, lock: 'unlocked', agent_md_etag: '', agent_md_sha256: '', owner_md_sha256: '' };
361
380
  try {
362
381
  const first = await this.readAgent(subAid);
363
382
  Object.assign(result, { relation_version: first.relation_version, lock: first.lock, agent_md_etag: first.etag, agent_md_sha256: first.exists ? await ownershipSha256(first.content) : '' });
364
- const released = first.lock === 'unlocked' && first.relation_version > 0;
365
- const agent = !released && first.exists ? await this.verify(first.content, 'agent', subAid) : null;
366
- if (first.lock === 'unlocked' && first.relation_version === 0 && agent?.statement)
383
+ const agent = first.exists ? await this.verify(first.content, 'agent', subAid) : null;
384
+ if ((agent?.statement?.relation_version ?? 0) !== first.relation_version)
367
385
  throw new StateError('NS relation metadata does not match agent.md', { stringCode: 'unavailable', retryable: true });
368
- const ownerAid = released ? undefined : agent?.statement?.owner_aid ?? pendingTarget?.owner_aid;
386
+ const ownerAid = agent?.statement?.owner_aid ?? pendingTarget?.owner_aid;
369
387
  let owner = null;
370
388
  let object = null;
371
389
  if (ownerAid) {
372
390
  object = await this.readOwner(ownerAid, subAid);
373
- result.owner_md_revision = object.revision;
374
391
  result.owner_md_sha256 = object.exists ? object.sha256 : '';
375
392
  if (object.exists)
376
393
  owner = await this.verify(object.content, 'owner', subAid, ownerAid);
@@ -378,11 +395,18 @@ export class OwnershipFiles {
378
395
  const last = await this.readAgent(subAid);
379
396
  if (last.relation_version !== first.relation_version || last.etag !== first.etag || last.lock !== first.lock || last.exists !== first.exists || last.owner_aid !== first.owner_aid || first.exists && await ownershipSha256(last.content) !== result.agent_md_sha256)
380
397
  throw new StateError('NS ownership changed during verification');
398
+ if (object && ownerAid) {
399
+ const current = await this.readOwner(ownerAid, subAid);
400
+ if (current.exists !== object.exists || current.sha256 !== object.sha256 || current.content !== object.content)
401
+ throw new StateError('Storage ownership changed during verification', { stringCode: 'unavailable', retryable: true });
402
+ }
381
403
  this.fresh(began);
382
404
  this.fresh(first.observed_at);
383
405
  if (object)
384
406
  this.fresh(object.observed_at);
385
- if (released) {
407
+ if (first.lock === 'unlocked' && agent?.statement) {
408
+ if (!object || object.exists && (!owner?.statement || owner.action !== 'release' || !ownershipStatementsMatch(agent.statement, owner.statement)))
409
+ throw new StateError('current ownership files do not confirm release', { stringCode: 'unavailable', retryable: true });
386
410
  result.status = 'released';
387
411
  }
388
412
  else if (first.lock === 'locked') {
@@ -428,11 +452,27 @@ export class OwnershipFiles {
428
452
  if (!snapshot.exists)
429
453
  throw new StateError('initial agent.md is not published', { stringCode: 'unavailable', retryable: true });
430
454
  if (snapshot.exists) {
431
- const file = task.operation === 'bind' && snapshot.relation_version > 0 ? parseOwnershipFile(snapshot.content, 'agent', { expectedSubAid: task.sub_aid }) : await this.verify(snapshot.content, 'agent', task.sub_aid);
455
+ const file = await this.verify(snapshot.content, 'agent', task.sub_aid);
456
+ const base = task.base_agent_md;
457
+ if (base && (base.exists !== snapshot.exists || (base.statement ? !file.statement || !['version', 'declaration_id', 'owner_aid', 'sub_aid', 'relation_version', 'declared_at'].every((key) => base.statement[key] === file.statement[key]) : file.statement || base.raw !== snapshot.content || base.etag !== snapshot.etag || base.sha256 !== await ownershipSha256(snapshot.content))))
458
+ throw new StateError('ownership original relation was replaced', { stringCode: 'conflict', retryable: false });
459
+ if (!base) {
460
+ task.base_agent_md = { exists: true, raw: snapshot.content, sha256: await ownershipSha256(snapshot.content), etag: snapshot.etag, statement: file.statement ?? null };
461
+ await task.persist();
462
+ }
432
463
  if (snapshot.lock === 'unlocked' && snapshot.relation_version === 0 && file.statement)
433
464
  throw new StateError('NS relation metadata does not match agent.md', { stringCode: 'unavailable', retryable: true });
434
- if (task.operation !== 'bind' && file.statement?.owner_aid !== task.owner_aid || task.operation === 'bind' && file.statement && file.statement.relation_version >= snapshot.relation_version)
465
+ if ((file.statement?.relation_version ?? 0) !== snapshot.relation_version || task.operation !== 'bind' && file.statement?.owner_aid !== task.owner_aid)
435
466
  throw new StateError('ownership current owner mismatch', { stringCode: 'conflict', retryable: false });
467
+ if (task.operation === 'bind' && file.statement?.owner_aid === task.owner_aid)
468
+ throw new StateError('current owner release requires sub cleanup before binding again', { stringCode: 'conflict', retryable: false });
469
+ if (task.operation === 'bind' && base?.statement && task.base_owner_md) {
470
+ const original = await this.readOwner(base.statement.owner_aid, task.sub_aid), expected = task.base_owner_md;
471
+ if (original.exists !== expected.exists || original.content !== expected.raw || original.sha256 !== expected.sha256)
472
+ throw new StateError('ownership original released owner file was replaced', { stringCode: 'conflict', retryable: false });
473
+ }
474
+ if (task.operation === 'bind' && file.statement && (await this.checkConsensus(task.sub_aid)).status !== 'released')
475
+ throw new StateError('current ownership files do not confirm release', { stringCode: 'unavailable', retryable: true });
436
476
  }
437
477
  return snapshot;
438
478
  }
@@ -444,6 +484,11 @@ export class OwnershipFiles {
444
484
  const file = await this.verify(object.content, 'owner', task.sub_aid, task.owner_aid);
445
485
  if (file.action !== 'transfer_owner' || file.statement?.relation_version !== task.base_relation_version || !file.transfer || file.transfer.new_owner_aid !== task.new_owner_aid || file.transfer.target_relation_version !== task.target_relation_version)
446
486
  throw new StateError('ownership transfer authorization target changed', { stringCode: 'conflict', retryable: false });
487
+ if (task.base_owner_md?.exists) {
488
+ const original = parseOwnershipFile(task.base_owner_md.raw, 'owner', { expectedSubAid: task.sub_aid, expectedOwnerAid: task.owner_aid }).statement;
489
+ if (!original || !['version', 'declaration_id', 'owner_aid', 'sub_aid', 'relation_version', 'declared_at'].every((key) => original[key] === file.statement[key]))
490
+ throw new StateError('ownership original transfer relation changed', { stringCode: 'conflict', retryable: false });
491
+ }
447
492
  if (file.transfer.expires_at <= this.now())
448
493
  throw new StateError('ownership transfer authorization expired', { stringCode: 'conflict', retryable: false });
449
494
  if (task.authorization_sha256 !== undefined && task.authorization_sha256 !== object.sha256 || task.expires_at !== undefined && task.expires_at !== file.transfer.expires_at)
@@ -460,42 +505,51 @@ export class OwnershipFiles {
460
505
  await this.readAgent(task.sub_aid);
461
506
  const current = await this.readOwner(ownerAid, task.sub_aid);
462
507
  let prepared = task.files[key];
508
+ if (!prepared && action !== 'declare' && !current.exists)
509
+ throw new StateError('ownership original owner file is unavailable', { stringCode: 'unavailable', retryable: true });
510
+ if (!prepared && !task.base_owner_md && action !== 'declare') {
511
+ const snapshot = current;
512
+ task.base_owner_md = { exists: snapshot.exists, raw: snapshot.content, sha256: snapshot.sha256 };
513
+ await task.persist();
514
+ }
463
515
  if (!prepared) {
464
516
  await this.requireBase(task);
517
+ const base = task.base_owner_md;
518
+ if (ownerAid === task.base_agent_md?.statement?.owner_aid && base && (current.exists !== base.exists || current.content !== base.raw || current.sha256 !== base.sha256))
519
+ throw new StateError('ownership original owner file was replaced', { stringCode: 'conflict', retryable: false });
465
520
  if (action === 'transfer_owner')
466
521
  task.expires_at = this.now() + 3600;
467
- const ownership = { statement: this.statement(ownerAid, task.sub_aid, version), action,
522
+ const original = action === 'declare' || !current.exists ? null : await this.verify(current.content, 'owner', task.sub_aid, ownerAid);
523
+ if (original && (!original.statement || original.statement.relation_version !== task.base_relation_version))
524
+ throw new StateError('ownership original owner relation changed', { stringCode: 'conflict', retryable: false });
525
+ const ownership = { statement: original?.statement ?? this.statement(ownerAid, task.sub_aid, version), action,
468
526
  ...(action === 'transfer_owner' ? { transfer: { new_owner_aid: task.new_owner_aid, target_relation_version: task.target_relation_version, expires_at: task.expires_at } } : {}) };
469
527
  const payload = `---\nowner_aid: ${ownerAid}\nsub_aid: ${task.sub_aid}\nownership: ${JSON.stringify(ownership)}\n---\n`;
470
528
  const raw = await signOwnershipFile(identity, payload, 'owner', { now: this.now() });
471
529
  await this.verify(raw, 'owner', task.sub_aid, ownerAid);
472
- prepared = { raw, sha256: await ownershipSha256(raw), condition: { expected_revision: current.revision } };
530
+ prepared = { raw, sha256: await ownershipSha256(raw), condition: {}, original_owner: { exists: current.exists, raw: current.content, sha256: current.sha256 } };
473
531
  if (action === 'transfer_owner')
474
532
  prepared.expires_at = task.expires_at;
475
533
  task.files[key] = prepared;
476
534
  await task.persist();
477
535
  }
478
- if (!prepared.condition || typeof prepared.condition.expected_revision !== 'string' || !prepared.condition.expected_revision)
479
- throw new StateError('ownership original Storage revision is unavailable', { stringCode: 'ownership_conflict' });
536
+ if (!prepared.condition || Object.keys(prepared.condition).length !== 0 || !prepared.original_owner)
537
+ throw new StateError('ownership original owner.md context is unavailable', { stringCode: 'ownership_conflict' });
480
538
  if (current.exists && current.sha256 === prepared.sha256 && current.content === prepared.raw) {
481
- if (prepared.published_revision !== undefined && prepared.published_revision !== current.revision)
482
- throw new StateError('ownership published file revision changed', { stringCode: 'ownership_conflict' });
483
- prepared.published_revision = current.revision;
484
- await task.persist();
485
539
  return prepared;
486
540
  }
487
541
  await this.requireBase(task);
488
- if (current.revision !== prepared.condition.expected_revision)
489
- throw new StateError('ownership Storage revision conflict', { stringCode: 'ownership_conflict' });
490
542
  if (action === 'transfer_owner' && (!task.expires_at || task.expires_at <= this.now()))
491
543
  throw new StateError('ownership transfer authorization expired', { stringCode: 'conflict', retryable: false });
492
544
  await this.verify(prepared.raw, 'owner', task.sub_aid, ownerAid);
493
545
  await task.guard?.();
494
- await this.deps.writeOwnerMd(ownerAid, task.sub_aid, prepared.raw, prepared.condition.expected_revision);
546
+ const latest = await this.readOwner(ownerAid, task.sub_aid), base = prepared.original_owner;
547
+ if (latest.exists !== base.exists || latest.content !== base.raw || latest.sha256 !== base.sha256)
548
+ throw new StateError('ownership original owner file was replaced', { stringCode: 'conflict', retryable: false });
549
+ await this.deps.writeOwnerMd(ownerAid, task.sub_aid, prepared.raw);
495
550
  const saved = await this.readOwner(ownerAid, task.sub_aid);
496
551
  if (!saved.exists || saved.sha256 !== prepared.sha256 || saved.content !== prepared.raw)
497
552
  throw new StateError('ownership published file could not be confirmed');
498
- prepared.published_revision = saved.revision;
499
553
  await task.persist();
500
554
  return prepared;
501
555
  }
@@ -522,6 +576,8 @@ export class OwnershipFiles {
522
576
  if (current.lock !== 'unlocked' || current.relation_version !== task.target_relation_version)
523
577
  throw new StateError('owner_locked or ownership cleanup version conflict');
524
578
  const prior = current.exists ? parseOwnershipFile(current.content, 'agent', { expectedSubAid: task.sub_aid, now: this.now() }) : null;
579
+ if (task.expected_agent_statement && (!prior?.statement || !['version', 'declaration_id', 'owner_aid', 'sub_aid', 'relation_version', 'declared_at'].every((field) => prior.statement[field] === task.expected_agent_statement[field])))
580
+ throw new StateError('ownership cleanup historical declaration changed', { stringCode: 'conflict', retryable: false });
525
581
  if (prior?.statement && (prior.statement.owner_aid !== task.owner_aid || prior.statement.relation_version !== task.base_relation_version))
526
582
  throw new StateError('ownership cleanup historical authorization mismatch', { stringCode: 'conflict', retryable: false });
527
583
  }
@@ -547,7 +603,7 @@ export class OwnershipFiles {
547
603
  }
548
604
  if (!prepared.condition || !(typeof prepared.condition.if_match === 'string' && prepared.condition.if_match || prepared.condition.if_none_match === '*'))
549
605
  throw new StateError('ownership original agent.md condition is unavailable', { stringCode: 'ownership_conflict' });
550
- if (current.exists && await ownershipSha256(current.content) === prepared.sha256 && current.content === prepared.raw && current.relation_version === task.target_relation_version) {
606
+ if (current.exists && await ownershipSha256(current.content) === prepared.sha256 && current.content === prepared.raw && current.relation_version === (cleanup ? 0 : task.target_relation_version)) {
551
607
  if (prepared.published_etag !== undefined && prepared.published_etag !== current.etag)
552
608
  throw new StateError('ownership published agent ETag changed', { stringCode: 'ownership_conflict' });
553
609
  prepared.published_etag = current.etag;
@@ -569,7 +625,7 @@ export class OwnershipFiles {
569
625
  await task.guard?.();
570
626
  const saved = await this.deps.submitAgentMdRaw(task.sub_aid, prepared.raw, prepared.condition);
571
627
  this.validateAgentSnapshot(saved, task.sub_aid);
572
- if (!saved.exists || await ownershipSha256(saved.content) !== prepared.sha256 || saved.relation_version !== task.target_relation_version)
628
+ if (!saved.exists || await ownershipSha256(saved.content) !== prepared.sha256 || saved.relation_version !== (cleanup ? 0 : task.target_relation_version))
573
629
  throw new StateError('NS ownership submitted file could not be confirmed');
574
630
  prepared.published_etag = saved.etag;
575
631
  await task.persist();
@@ -581,14 +637,15 @@ export class OwnershipFiles {
581
637
  this.local(task.owner_aid);
582
638
  await this.readAgent(task.sub_aid);
583
639
  const prepared = task.files[task.operation === 'release' ? 'release' : 'transfer'];
584
- if (!prepared?.published_revision || prepared.cleaned)
640
+ if (!prepared || prepared.cleaned)
585
641
  return;
642
+ const began = this.now();
586
643
  const consensus = await this.checkConsensus(task.sub_aid);
587
644
  if (consensus.status === 'not_applicable')
588
645
  throw new StateError(consensus.reason || 'group/org use their dedicated lifecycle ownership', { stringCode: 'not_applicable', retryable: false });
589
646
  if (consensus.status === 'invalid' || consensus.status === 'unavailable')
590
647
  throw new StateError(consensus.reason || 'ownership cleanup verification failed', { stringCode: consensus.status, retryable: consensus.status === 'unavailable' });
591
- if (consensus.relation_version !== task.target_relation_version || (task.operation === 'release' ? consensus.status !== 'released' : consensus.status !== 'consensus' || consensus.owner_aid !== task.new_owner_aid))
648
+ if (task.operation === 'release' ? !(consensus.status === 'unbound' && consensus.relation_version === 0 || consensus.status === 'consensus') : consensus.relation_version !== task.target_relation_version || consensus.status !== 'consensus' || consensus.owner_aid !== task.new_owner_aid)
592
649
  throw new StateError('ownership cleanup relation is not confirmed', { stringCode: 'conflict', retryable: false });
593
650
  const object = await this.readOwner(task.owner_aid, task.sub_aid);
594
651
  if (!object.exists) {
@@ -596,12 +653,24 @@ export class OwnershipFiles {
596
653
  await task.persist();
597
654
  return;
598
655
  }
599
- if (object.revision !== prepared.published_revision || object.sha256 !== prepared.sha256)
600
- throw new StateError('ownership cleanup revision conflict');
656
+ if (object.content !== prepared.raw || object.sha256 !== prepared.sha256)
657
+ throw new StateError('ownership cleanup original owner file was replaced', { stringCode: 'conflict', retryable: false });
658
+ const agent = await this.readAgent(task.sub_aid);
659
+ if (this.now() - began > 30 || agent.etag !== consensus.agent_md_etag || await ownershipSha256(agent.content) !== consensus.agent_md_sha256 || agent.lock !== consensus.lock || agent.relation_version !== consensus.relation_version)
660
+ throw new StateError('ownership cleanup current files changed', { stringCode: 'unavailable', retryable: true });
601
661
  if (!this.deps.deleteOwnerMd)
602
- throw new StateError('ownership conditional delete unsupported');
662
+ throw new StateError('ownership owner file delete unsupported');
603
663
  await task.guard?.();
604
- await this.deps.deleteOwnerMd(task.owner_aid, task.sub_aid, prepared.published_revision);
664
+ const latest = await this.readOwner(task.owner_aid, task.sub_aid);
665
+ if (!latest.exists) {
666
+ prepared.cleaned = true;
667
+ await task.persist();
668
+ return;
669
+ }
670
+ if (latest.content !== prepared.raw || latest.sha256 !== prepared.sha256)
671
+ throw new StateError('ownership cleanup original owner file was replaced', { stringCode: 'conflict', retryable: false });
672
+ this.fresh(began);
673
+ await this.deps.deleteOwnerMd(task.owner_aid, task.sub_aid);
605
674
  prepared.cleaned = true;
606
675
  await task.persist();
607
676
  }