npm - @agentunion/fastaun-browser - Versions diffs - 0.5.4 → 0.5.6 - Mend

@agentunion/fastaun-browser 0.5.4 → 0.5.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (151) hide show

package/CHANGELOG.md +130 -94
package/_packed_docs/AUN/347/246/273/347/272/277/346/216/250/351/200/201/346/216/245/345/205/245/344/270/216/346/274/224/347/244/272/346/214/207/345/215/227.md +290 -0
package/_packed_docs/AUN/347/246/273/347/272/277/346/216/250/351/200/201/346/234/215/345/212/241/346/236/266/346/236/204/344/270/216/350/257/246/347/273/206/345/256/236/347/216/260/350/256/241/345/210/222-codex.md +994 -0
package/_packed_docs/AUN/347/246/273/347/272/277/346/216/250/351/200/201/346/234/215/345/212/241/350/277/220/347/273/264/344/270/216/345/217/221/345/270/203/346/214/207/345/215/227.md +144 -0
package/_packed_docs/CHANGELOG.md +130 -94
package/_packed_docs/INDEX.md +127 -69
package/_packed_docs/KITE_DOCS_GUIDE.md +63 -29
package/_packed_docs/audit/AUN/346/234/215/345/212/241Go/345/214/226/351/207/215/346/236/204/347/262/276/347/273/206/345/214/226/346/272/220/347/240/201/345/256/241/346/237/245-20260718.md +366 -0
package/_packed_docs/aun/345/205/254/347/275/221/346/265/213/350/257/225/350/277/220/350/241/214/346/214/207/345/215/227.md +227 -0
package/_packed_docs/aun/345/210/206/345/270/203/345/274/217/346/265/213/350/257/225/350/277/220/350/241/214/346/214/207/345/215/227.md +1004 -0
package/_packed_docs/aun/346/265/213/350/257/225/350/277/220/350/241/214/346/214/207/345/215/227.md +999 -0
package/_packed_docs/cli/CLI/346/211/213/345/206/214.md +6 -4
package/_packed_docs/protocol/06-/346/234/215/345/212/241/345/215/217/350/256/256.md +58 -20
package/_packed_docs/protocol/10-Group-/345/255/220/345/215/217/350/256/256.md +219 -247
package/_packed_docs/protocol/12-Stream-/345/255/220/345/215/217/350/256/256.md +14 -14
package/_packed_docs/protocol/13-Agent/350/241/214/344/270/272/350/247/204/350/214/203.md +3 -3
package/_packed_docs/protocol/15-/347/246/273/347/272/277/346/216/250/351/200/201/351/200/232/347/237/245/345/215/217/350/256/256.md +165 -421
package/_packed_docs/protocol/README.md +1 -0
package/_packed_docs/protocol/aun-docs-guide.md +7 -4
package/_packed_docs/protocol/index.md +25 -19
package/_packed_docs/sdk/02-WebSocket/345/215/217/350/256/256.md +62 -17
package/_packed_docs/sdk/03-/346/240/270/345/277/203/346/246/202/345/277/265.md +22 -0
package/_packed_docs/sdk/04-/350/277/236/346/216/245/344/270/216/350/256/244/350/257/201.md +67 -78
package/_packed_docs/sdk/05-E2EE/345/212/240/345/257/206/351/200/232/344/277/241.md +6 -2
package/_packed_docs/sdk/06-API/346/211/213/345/206/214.md +50 -14
package/_packed_docs/sdk/08-/346/234/200/344/275/263/345/256/236/350/267/265.md +18 -5
package/_packed_docs/sdk/09-group-rpc-manual.md +312 -282
package/_packed_docs/sdk/09-message-rpc-manual.md +142 -103
package/_packed_docs/sdk/09-payload-reference.md +1 -1
package/_packed_docs/sdk/09-stream-rpc-manual.md +8 -8
package/_packed_docs/sdk/AUN_DOCS_GUIDE.md +26 -17
package/_packed_docs/sdk/INDEX.md +42 -34
package/_packed_docs/sdk/README.md +7 -6
package/_packed_docs//346/266/210/346/201/257/345/220/214/346/255/245/344/270/216/345/216/206/345/217/262/346/213/211/345/217/226/344/273/243/347/240/201/345/256/241/346/237/245/351/227/256/351/242/230/346/270/205/345/215/225.md +229 -0
package/_packed_docs//346/266/210/346/201/257/345/220/214/346/255/245/344/270/216/345/216/206/345/217/262/346/213/211/345/217/226/346/224/271/351/200/240/346/226/271/346/241/210.md +750 -0
package/dist/agent-md.d.ts +4 -5
package/dist/agent-md.d.ts.map +1 -1
package/dist/agent-md.js +66 -43
package/dist/agent-md.js.map +1 -1
package/dist/aid-store.d.ts +2 -6
package/dist/aid-store.d.ts.map +1 -1
package/dist/aid-store.js +20 -14
package/dist/aid-store.js.map +1 -1
package/dist/auth.d.ts.map +1 -1
package/dist/auth.js +30 -11
package/dist/auth.js.map +1 -1
package/dist/bundle.js +3297 -1023
package/dist/client/delivery.d.ts +75 -8
package/dist/client/delivery.d.ts.map +1 -1
package/dist/client/delivery.js +1419 -245
package/dist/client/delivery.js.map +1 -1
package/dist/client/group-state.d.ts.map +1 -1
package/dist/client/group-state.js +27 -24
package/dist/client/group-state.js.map +1 -1
package/dist/client/lifecycle.d.ts.map +1 -1
package/dist/client/lifecycle.js +48 -4
package/dist/client/lifecycle.js.map +1 -1
package/dist/client/mention-mode.d.ts +7 -0
package/dist/client/mention-mode.d.ts.map +1 -0
package/dist/client/mention-mode.js +184 -0
package/dist/client/mention-mode.js.map +1 -0
package/dist/client/peers.d.ts +1 -1
package/dist/client/peers.d.ts.map +1 -1
package/dist/client/peers.js +26 -3
package/dist/client/peers.js.map +1 -1
package/dist/client/rpc-pipeline.d.ts +22 -1
package/dist/client/rpc-pipeline.d.ts.map +1 -1
package/dist/client/rpc-pipeline.js +309 -74
package/dist/client/rpc-pipeline.js.map +1 -1
package/dist/client/v2-e2ee.d.ts +25 -2
package/dist/client/v2-e2ee.d.ts.map +1 -1
package/dist/client/v2-e2ee.js +606 -97
package/dist/client/v2-e2ee.js.map +1 -1
package/dist/client.d.ts +24 -5
package/dist/client.d.ts.map +1 -1
package/dist/client.js +404 -215
package/dist/client.js.map +1 -1
package/dist/errors.d.ts.map +1 -1
package/dist/errors.js +4 -1
package/dist/errors.js.map +1 -1
package/dist/facades.d.ts +3 -0
package/dist/facades.d.ts.map +1 -1
package/dist/facades.js +91 -53
package/dist/facades.js.map +1 -1
package/dist/group-index.d.ts +6 -1
package/dist/group-index.d.ts.map +1 -1
package/dist/group-index.js +44 -25
package/dist/group-index.js.map +1 -1
package/dist/index.d.ts +1 -1
package/dist/index.d.ts.map +1 -1
package/dist/index.js +1 -1
package/dist/index.js.map +1 -1
package/dist/keystore/index.d.ts +10 -5
package/dist/keystore/index.d.ts.map +1 -1
package/dist/keystore/indexeddb-identity-store.d.ts +0 -12
package/dist/keystore/indexeddb-identity-store.d.ts.map +1 -1
package/dist/keystore/indexeddb-identity-store.js +0 -60
package/dist/keystore/indexeddb-identity-store.js.map +1 -1
package/dist/keystore/indexeddb-shared.d.ts.map +1 -1
package/dist/keystore/indexeddb-shared.js +9 -5
package/dist/keystore/indexeddb-shared.js.map +1 -1
package/dist/keystore/indexeddb-token-store.d.ts +3 -1
package/dist/keystore/indexeddb-token-store.d.ts.map +1 -1
package/dist/keystore/indexeddb-token-store.js +47 -2
package/dist/keystore/indexeddb-token-store.js.map +1 -1
package/dist/register-flow.d.ts.map +1 -1
package/dist/register-flow.js +28 -3
package/dist/register-flow.js.map +1 -1
package/dist/seq-tracker.d.ts +28 -8
package/dist/seq-tracker.d.ts.map +1 -1
package/dist/seq-tracker.js +218 -61
package/dist/seq-tracker.js.map +1 -1
package/dist/storage/vfs.d.ts +1 -0
package/dist/storage/vfs.d.ts.map +1 -1
package/dist/storage/vfs.js +26 -2
package/dist/storage/vfs.js.map +1 -1
package/dist/tools/cross-sdk-agent.js +376 -10
package/dist/tools/cross-sdk-agent.js.map +1 -1
package/dist/transport.d.ts +12 -0
package/dist/transport.d.ts.map +1 -1
package/dist/transport.js +218 -101
package/dist/transport.js.map +1 -1
package/dist/v2/session/session.d.ts.map +1 -1
package/dist/v2/session/session.js +3 -4
package/dist/v2/session/session.js.map +1 -1
package/dist/v2/state/commitment.d.ts.map +1 -1
package/dist/v2/state/commitment.js +1 -2
package/dist/v2/state/commitment.js.map +1 -1
package/dist/version.d.ts +1 -1
package/dist/version.js +1 -1
package/package.json +6 -5
package/dist/group-resources.d.ts +0 -98
package/dist/group-resources.d.ts.map +0 -1
package/dist/group-resources.js +0 -635
package/dist/group-resources.js.map +0 -1
package/dist/keystore/indexeddb.d.ts +0 -179
package/dist/keystore/indexeddb.d.ts.map +0 -1
package/dist/keystore/indexeddb.js +0 -2031
package/dist/keystore/indexeddb.js.map +0 -1
package/dist/namespaces/auth.d.ts +0 -98
package/dist/namespaces/auth.d.ts.map +0 -1
package/dist/namespaces/auth.js +0 -992
package/dist/namespaces/auth.js.map +0 -1
package/dist/namespaces/custody.d.ts +0 -51
package/dist/namespaces/custody.d.ts.map +0 -1
package/dist/namespaces/custody.js +0 -302
package/dist/namespaces/custody.js.map +0 -1
package/dist/namespaces/meta.d.ts +0 -109
package/dist/namespaces/meta.d.ts.map +0 -1
package/dist/namespaces/meta.js +0 -549
package/dist/namespaces/meta.js.map +0 -1

package/dist/namespaces/auth.js DELETED Viewed

@@ -1,992 +0,0 @@
-// ── AuthNamespace（认证命名空间 — 完整实现）──────────────────
-import { AUNError, NotFoundError, StateError, ValidationError } from '../errors.js';
-import { isJsonObject } from '../types.js';
-import { base64ToUint8, pemToArrayBuffer, uint8ToBase64, certificateSha256Fingerprint, ecdsaSignDer, ecdsaVerifyDer, importCertPublicKeyEcdsa, importPrivateKeyEcdsa, } from '../crypto.js';
-const _noopLog = { error: () => { }, warn: () => { }, info: () => { }, debug: () => { } };
-const AGENT_MD_HTTP_TIMEOUT_MS = 30_000;
-const AGENT_MD_SIGNATURE_MARKER = '<!-- AUN-SIGNATURE';
-const AGENT_MD_SIGNATURE_RE = /^<!-- AUN-SIGNATURE\r?\n(?<body>[\s\S]*?)\r?\n-->\s*$/;
-const AGENT_MD_FINGERPRINT_RE = /^sha256:[0-9a-f]{64}$/;
-function agentMdHttpScheme(gatewayUrl) {
-    const raw = String(gatewayUrl ?? '').trim().toLowerCase();
-    return raw.startsWith('ws://') ? 'http' : 'https';
-}
-function agentMdAuthority(aid, discoveryPort) {
-    const host = String(aid ?? '').trim();
-    if (!host)
-        return '';
-    if (discoveryPort && !host.includes(':')) {
-        return `${host}:${discoveryPort}`;
-    }
-    return host;
-}
-function parseAgentMdTailSignature(content) {
-    const idx = content.lastIndexOf(AGENT_MD_SIGNATURE_MARKER);
-    if (idx < 0) {
-        return { payload: content, fields: null };
-    }
-    if (idx > 0 && content[idx - 1] !== '\n' && content[idx - 1] !== '\r') {
-        return { payload: content, fields: null };
-    }
-    const tail = content.slice(idx);
-    const match = tail.match(AGENT_MD_SIGNATURE_RE);
-    if (!match) {
-        return { payload: content.slice(0, idx), fields: null, parseError: 'malformed signature block' };
-    }
-    const fields = {};
-    for (const rawLine of match.groups?.body?.split(/\r?\n/) ?? []) {
-        const line = rawLine.trim();
-        if (!line)
-            continue;
-        const colon = line.indexOf(':');
-        if (colon < 0) {
-            return { payload: content.slice(0, idx), fields: null, parseError: `malformed signature field: ${line}` };
-        }
-        const key = line.slice(0, colon).trim().toLowerCase();
-        const value = line.slice(colon + 1).trim();
-        fields[key] = value;
-    }
-    for (const required of ['cert_fingerprint', 'timestamp', 'signature']) {
-        if (!fields[required]) {
-            return { payload: content.slice(0, idx), fields: null, parseError: `signature block missing ${required}` };
-        }
-    }
-    if (!AGENT_MD_FINGERPRINT_RE.test(fields.cert_fingerprint.toLowerCase())) {
-        return { payload: content.slice(0, idx), fields: null, parseError: 'invalid cert_fingerprint' };
-    }
-    if (!Number.isFinite(Number(fields.timestamp))) {
-        return { payload: content.slice(0, idx), fields: null, parseError: 'invalid timestamp' };
-    }
-    return { payload: content.slice(0, idx), fields, parseError: undefined };
-}
-function extractAgentMDAid(payload) {
-    const lines = payload.replace(/^\ufeff/, '').split(/\r?\n/);
-    if (!lines.length || lines[0].trim() !== '---') {
-        return '';
-    }
-    for (const line of lines.slice(1)) {
-        const trimmed = line.trim();
-        if (trimmed === '---')
-            break;
-        if (trimmed.startsWith('aid:')) {
-            let value = trimmed.slice(4).trim();
-            if (value.length >= 2 && value[0] === value[value.length - 1] && (value[0] === '"' || value[0] === '\'')) {
-                value = value.slice(1, -1);
-            }
-            return value.trim();
-        }
-    }
-    return '';
-}
-function agentMdResult(status, payload, reason = '', aid = '', certFingerprint = '', timestamp) {
-    const result = {
-        status,
-        verified: status === 'verified',
-        payload,
-    };
-    if (reason)
-        result.reason = reason;
-    if (aid)
-        result.aid = aid;
-    if (certFingerprint)
-        result.cert_fingerprint = certFingerprint;
-    if (timestamp !== undefined)
-        result.timestamp = timestamp;
-    return result;
-}
-function normalizeIdentityCertPem(identity) {
-    if (!identity)
-        return '';
-    return String(identity.cert ?? identity.cert_pem ?? '').trim();
-}
-function parseAgentMdTimestamp(value) {
-    const parsed = Number(value.trim());
-    return Number.isFinite(parsed) ? Math.trunc(parsed) : undefined;
-}
-function readDerLength(bytes, offset) {
-    const first = bytes[offset];
-    if (first === undefined)
-        return null;
-    if (first < 0x80) {
-        return { length: first, lengthBytes: 1 };
-    }
-    const count = first & 0x7f;
-    if (count === 0 || count > 4 || offset + count >= bytes.length) {
-        return null;
-    }
-    let length = 0;
-    for (let i = 0; i < count; i++) {
-        length = (length << 8) | bytes[offset + 1 + i];
-    }
-    return { length, lengthBytes: 1 + count };
-}
-function extractCommonNameFromCertPem(certPem) {
-    try {
-        const bytes = new Uint8Array(pemToArrayBuffer(certPem));
-        const oid = [0x06, 0x03, 0x55, 0x04, 0x03];
-        const decoder = new TextDecoder();
-        let commonName = '';
-        for (let i = 0; i <= bytes.length - oid.length - 2; i++) {
-            let matched = true;
-            for (let j = 0; j < oid.length; j++) {
-                if (bytes[i + j] !== oid[j]) {
-                    matched = false;
-                    break;
-                }
-            }
-            if (!matched)
-                continue;
-            const tag = bytes[i + oid.length];
-            const lengthInfo = readDerLength(bytes, i + oid.length + 1);
-            if (!lengthInfo)
-                continue;
-            const start = i + oid.length + 1 + lengthInfo.lengthBytes;
-            const end = start + lengthInfo.length;
-            if (end > bytes.length)
-                continue;
-            const valueBytes = bytes.slice(start, end);
-            if (tag === 0x0c || tag === 0x13 || tag === 0x16 || tag === 0x14 || tag === 0x1e) {
-                commonName = decoder.decode(valueBytes).trim();
-            }
-            else {
-                commonName = decoder.decode(valueBytes).trim();
-            }
-        }
-        return commonName;
-    }
-    catch {
-        return '';
-    }
-}
-/** 从 PEM 证书 DER 中解析 validity（notBefore / notAfter）时间戳 */
-function parseCertValidity(certPem) {
-    try {
-        const der = new Uint8Array(pemToArrayBuffer(certPem));
-        // ASN.1 X.509 结构：SEQUENCE { tbsCertificate SEQUENCE { version, serial, sigAlg, issuer, validity, ... } }
-        // validity 是 tbsCertificate 中第 5 个字段（0-indexed: 4）
-        // 简化方法：搜索连续两个 UTCTime 或 GeneralizedTime 标签
-        const dates = [];
-        for (let i = 0; i < der.length - 2 && dates.length < 2; i++) {
-            const tag = der[i];
-            if (tag !== 0x17 && tag !== 0x18)
-                continue; // UTCTime=0x17, GeneralizedTime=0x18
-            const len = der[i + 1];
-            if (len === 0 || len > 20 || i + 2 + len > der.length)
-                continue;
-            const str = new TextDecoder().decode(der.slice(i + 2, i + 2 + len));
-            const ts = parseAsn1Time(tag, str);
-            if (ts !== null) {
-                dates.push(ts);
-                i += 1 + len; // 跳过已解析的时间
-            }
-        }
-        if (dates.length >= 2) {
-            return { notBefore: dates[0], notAfter: dates[1] };
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-function parseAsn1Time(tag, str) {
-    try {
-        if (tag === 0x17) {
-            // UTCTime: YYMMDDHHMMSSZ
-            const cleaned = str.replace(/Z$/i, '');
-            if (cleaned.length < 12)
-                return null;
-            let year = parseInt(cleaned.slice(0, 2), 10);
-            year += year >= 50 ? 1900 : 2000;
-            const month = parseInt(cleaned.slice(2, 4), 10) - 1;
-            const day = parseInt(cleaned.slice(4, 6), 10);
-            const hour = parseInt(cleaned.slice(6, 8), 10);
-            const min = parseInt(cleaned.slice(8, 10), 10);
-            const sec = parseInt(cleaned.slice(10, 12), 10);
-            return Date.UTC(year, month, day, hour, min, sec);
-        }
-        else if (tag === 0x18) {
-            // GeneralizedTime: YYYYMMDDHHMMSSZ
-            const cleaned = str.replace(/Z$/i, '');
-            if (cleaned.length < 14)
-                return null;
-            const year = parseInt(cleaned.slice(0, 4), 10);
-            const month = parseInt(cleaned.slice(4, 6), 10) - 1;
-            const day = parseInt(cleaned.slice(6, 8), 10);
-            const hour = parseInt(cleaned.slice(8, 10), 10);
-            const min = parseInt(cleaned.slice(10, 12), 10);
-            const sec = parseInt(cleaned.slice(12, 14), 10);
-            return Date.UTC(year, month, day, hour, min, sec);
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-async function fetchWithTimeout(input, init, timeoutMs = AGENT_MD_HTTP_TIMEOUT_MS) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
-    try {
-        return await fetch(input, { ...init, signal: controller.signal });
-    }
-    catch (error) {
-        if (controller.signal.aborted) {
-            throw new AUNError(`agent.md request timed out after ${timeoutMs}ms`);
-        }
-        throw error;
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
-/**
- * 认证命名空间 — 提供 AID 注册、登录认证等高级操作。
- * 通过 AUNClient 内部的 AuthFlow 完成完整的 PKI 注册和两阶段认证。
- */
-export class AuthNamespace {
-    _client;
-    _log = _noopLog;
-    _agentMdCache = new Map();
-    setLogger(log) { this._log = log; }
-    constructor(client) {
-        this._client = client;
-    }
-    get _internal() {
-        return this._client;
-    }
-    /**
-     * 解析 gateway URL。
-     * 优先使用已预置的 gatewayUrl，否则基于 AID 自动发现。
-     *
-     * 发现流程：
-     * 1. 若 gatewayUrl 已预置（内存），直接返回
-     * 2. 从 keystore metadata 读 cached gateway_url（跨进程/会话复用）
-     * 3. https://{aid}/.well-known/aun-gateway（泛域名 nameservice）
-     * 4. https://gateway.{issuer}/.well-known/aun-gateway（Gateway 直连）
-     * 发现成功后写入 keystore metadata，避免每次都做 well-known discovery。
-     */
-    async _resolveGateway(aid) {
-        if (this._client.gatewayUrl) {
-            return this._client.gatewayUrl;
-        }
-        const resolvedAid = aid ?? this._client.aid;
-        if (resolvedAid) {
-            // 从 keystore metadata 读持久化的 gateway_url
-            try {
-                const cached = await this._loadCachedGatewayUrl(resolvedAid);
-                if (cached) {
-                    this._log.debug(`_resolveGateway from keystore cache aid=${resolvedAid} gateway=${cached}`);
-                    this._client.gatewayUrl = cached;
-                    return cached;
-                }
-            }
-            catch (exc) {
-                this._log.debug(`_resolveGateway load cache failed: ${exc instanceof Error ? exc.message : String(exc)}`);
-            }
-            const parts = resolvedAid.split('.');
-            const issuerDomain = parts.length > 1 ? parts.slice(1).join('.') : resolvedAid;
-            const port = this._client.configModel.discoveryPort;
-            const portSuffix = port ? `:${port}` : '';
-            // 尝试 nameservice 发现
-            const primaryUrl = `https://${resolvedAid}${portSuffix}/.well-known/aun-gateway`;
-            try {
-                const discovered = await this._client.discovery.discover(primaryUrl);
-                await this._persistGatewayUrl(resolvedAid, discovered);
-                return discovered;
-            }
-            catch {
-                // 降级到 Gateway 直连
-            }
-            const fallbackUrl = `https://gateway.${issuerDomain}${portSuffix}/.well-known/aun-gateway`;
-            const discovered = await this._client.discovery.discover(fallbackUrl);
-            await this._persistGatewayUrl(resolvedAid, discovered);
-            return discovered;
-        }
-        throw new ValidationError("unable to resolve gateway: set client.gatewayUrl or provide 'aid' for auto-discovery");
-    }
-    /** 从 keystore metadata 读取 cached gateway_url（跨进程/会话复用） */
-    async _loadCachedGatewayUrl(aid) {
-        if (!aid)
-            return '';
-        const ks = this._internal._keystore;
-        if (!ks || typeof ks.getMetadata !== 'function')
-            return '';
-        try {
-            const value = await ks.getMetadata(aid, 'gateway_url');
-            const raw = String(value ?? '').trim();
-            if (!raw)
-                return '';
-            // 兼容 JSON 编码（Python SDK 通过 save_identity 走 json.dumps）
-            // 与裸字符串两种格式：先尝试 JSON.parse，失败则当裸字符串使用
-            if (raw.startsWith('"') && raw.endsWith('"')) {
-                try {
-                    const parsed = JSON.parse(raw);
-                    if (typeof parsed === 'string')
-                        return parsed.trim();
-                }
-                catch {
-                    // JSON 解析失败，按裸字符串处理
-                }
-            }
-            return raw;
-        }
-        catch {
-            return '';
-        }
-    }
-    /** 持久化 gateway_url 到 keystore metadata，供跨进程复用 */
-    async _persistGatewayUrl(aid, gatewayUrl) {
-        if (!gatewayUrl || !aid)
-            return;
-        const ks = this._internal._keystore;
-        if (!ks || typeof ks.setMetadata !== 'function')
-            return;
-        try {
-            // JS IndexedDB keystore 的 saveIdentity 把 metadata 字段以原值存储（不 JSON.stringify），
-            // setMetadata 也用原值；所以 _persistGatewayUrl 保持原值写入与读取兼容。
-            // _loadCachedGatewayUrl 兼容裸字符串和 JSON 编码两种格式。
-            await ks.setMetadata(aid, 'gateway_url', gatewayUrl);
-        }
-        catch (exc) {
-            this._log.debug(`persist gateway_url failed aid=${aid} err=${exc instanceof Error ? exc.message : String(exc)}`);
-        }
-    }
-    /** 内部访问 client 私有属性 */
-    /**
-     * 严格注册新 AID（对齐 TS registerAid）。
-     * 通过 well-known 发现 gateway → 调用 AuthFlow.registerAid 注册。
-     */
-    async registerAid(params) {
-        const tStart = Date.now();
-        const aid = String(params?.aid ?? '');
-        this._log.debug(`registerAid enter: aid=${aid}`);
-        try {
-            if (!aid)
-                throw new ValidationError("auth.registerAid requires 'aid'");
-            const gatewayUrl = await this._resolveGateway(aid);
-            this._client.gatewayUrl = gatewayUrl;
-            const auth = this._internal._auth;
-            const result = await auth.registerAid(gatewayUrl, aid);
-            this._internal._aid = aid;
-            this._internal._identity = await auth.loadIdentityOrNone(aid);
-            this._log.debug(`registerAid exit: elapsed=${Date.now() - tStart}ms aid=${aid}`);
-            return {
-                aid: aid,
-                cert_pem: result.cert,
-                gateway: gatewayUrl,
-            };
-        }
-        catch (err) {
-            this._log.debug(`registerAid exit (error): elapsed=${Date.now() - tStart}ms aid=${aid} err=${err instanceof Error ? err.message : String(err)}`);
-            throw err;
-        }
-    }
-    /**
-     * 认证已有 AID（login1 + login2 两阶段认证）。
-     * 通过 well-known 发现 gateway → 调用 AuthFlow.authenticate。
-     */
-    async authenticate(params) {
-        const tStart = Date.now();
-        const aid = (params?.aid ?? '');
-        this._log.debug(`authenticate enter: aid=${aid || '<current>'}`);
-        try {
-            const request = { ...(params ?? {}) };
-            const requestAid = request.aid;
-            const gatewayUrl = await this._resolveGateway(requestAid);
-            this._client.gatewayUrl = gatewayUrl;
-            const auth = this._internal._auth;
-            const result = await auth.authenticate(gatewayUrl, requestAid);
-            this._internal._aid = result.aid ?? null;
-            this._internal._identity = await auth.loadIdentityOrNone(String(result.aid));
-            this._log.debug(`authenticate exit: elapsed=${Date.now() - tStart}ms aid=${result.aid}`);
-            return result; // 包含 aid, access_token, refresh_token, expires_at, gateway
-        }
-        catch (err) {
-            this._log.debug(`authenticate exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
-            throw err;
-        }
-    }
-    /** 只读加载本地已注册身份（密钥对 + 证书 + 实例状态）。无副作用，不触发网络请求。 */
-    async loadIdentity(params) {
-        const aid = String((params ?? {})?.aid ?? '').trim() || undefined;
-        const identity = await this._internal._auth.loadIdentityOrNone(aid);
-        if (!identity) {
-            throw new StateError(`identity not found for aid: ${aid ?? '<default>'}`);
-        }
-        return identity;
-    }
-    /** 只读加载本地已注册身份，不存在时返回 null。 */
-    async loadIdentityOrNull(params) {
-        const aid = String((params ?? {})?.aid ?? '').trim() || undefined;
-        return await this._internal._auth.loadIdentityOrNone(aid);
-    }
-    /** 获取对端 AID 的证书 PEM（本地缓存优先，未命中走 PKI HTTP + 链验证）。 */
-    async fetchPeerCert(params) {
-        const aid = String(params?.aid ?? '').trim();
-        if (!aid)
-            throw new Error("auth.fetchPeerCert requires 'aid'");
-        const fp = String(params?.cert_fingerprint ?? '').trim() || undefined;
-        if (typeof this._internal._fetchPeerCert !== 'function') {
-            throw new Error('client does not support _fetchPeerCert');
-        }
-        return String(await this._internal._fetchPeerCert(aid, fp)).trim();
-    }
-    async signAgentMd(content, opts) {
-        const tStart = Date.now();
-        this._log.debug(`signAgentMd enter: aid=${opts?.aid ?? '<current>'} content_len=${String(content ?? '').length}`);
-        try {
-            const client = this._internal;
-            const targetAid = String(opts?.aid ?? client._aid ?? '').trim();
-            const identity = await client._auth.loadIdentityOrNone(targetAid || undefined);
-            if (!identity) {
-                throw new StateError('no local identity found, call auth.registerAid() first');
-            }
-            const privateKeyPem = String(identity.private_key_pem ?? '').trim();
-            const certPem = normalizeIdentityCertPem(identity);
-            if (!privateKeyPem || !certPem) {
-                throw new StateError('local identity missing private key or certificate');
-            }
-            let payload = parseAgentMdTailSignature(String(content ?? '')).payload;
-            if (payload && !payload.endsWith('\n') && !payload.endsWith('\r')) {
-                payload += '\n';
-            }
-            const privateKey = await importPrivateKeyEcdsa(privateKeyPem);
-            const signatureDer = await ecdsaSignDer(privateKey, new TextEncoder().encode(payload));
-            const fingerprint = await certificateSha256Fingerprint(certPem);
-            if (!fingerprint) {
-                throw new StateError('agent.md cert fingerprint failed');
-            }
-            const signedBlock = [
-                AGENT_MD_SIGNATURE_MARKER,
-                `cert_fingerprint: ${fingerprint}`,
-                `timestamp: ${Math.floor(Date.now() / 1000)}`,
-                `signature: ${uint8ToBase64(signatureDer)}`,
-                '-->',
-            ].join('\n');
-            this._log.debug(`signAgentMd exit: elapsed=${Date.now() - tStart}ms aid=${targetAid}`);
-            return payload + signedBlock;
-        }
-        catch (err) {
-            this._log.debug(`signAgentMd exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
-            throw err;
-        }
-    }
-    async verifyAgentMd(content, opts) {
-        const tStart = Date.now();
-        this._log.debug(`verifyAgentMd enter: aid=${opts?.aid ?? '<infer>'} content_len=${String(content ?? '').length}`);
-        try {
-            const result = await this._verifyAgentMdImpl(content, opts);
-            this._log.debug(`verifyAgentMd exit: elapsed=${Date.now() - tStart}ms status=${result.status} verified=${!!result.verified}`);
-            return result;
-        }
-        catch (err) {
-            this._log.debug(`verifyAgentMd exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
-            throw err;
-        }
-    }
-    async _verifyAgentMdImpl(content, opts) {
-        const { payload, fields, parseError } = parseAgentMdTailSignature(String(content ?? ''));
-        if (!fields) {
-            if (!parseError) {
-                return agentMdResult('unsigned', payload);
-            }
-            return agentMdResult('invalid', payload, parseError);
-        }
-        let expectedAid = String(opts?.aid ?? '').trim();
-        const payloadAid = extractAgentMDAid(payload);
-        if (expectedAid && payloadAid && expectedAid !== payloadAid) {
-            return agentMdResult('invalid', payload, 'aid mismatch', payloadAid);
-        }
-        if (!expectedAid) {
-            expectedAid = payloadAid;
-        }
-        let certPem = String(opts?.certPem ?? opts?.cert_pem ?? '').trim();
-        if (!certPem) {
-            if (!expectedAid) {
-                return agentMdResult('invalid', payload, 'aid required to verify agent.md');
-            }
-            // 通过 _internal 直接调用，保留 this 绑定（解构后调用会丢失 this，导致 _clientLog 等成员访问失败）
-            if (typeof this._internal._fetchPeerCert !== 'function') {
-                return agentMdResult('invalid', payload, 'aid required to verify agent.md', expectedAid);
-            }
-            try {
-                certPem = String(await this._internal._fetchPeerCert(expectedAid, fields.cert_fingerprint)).trim();
-            }
-            catch (error) {
-                return agentMdResult('invalid', payload, String(error), expectedAid, fields.cert_fingerprint);
-            }
-        }
-        let publicKey;
-        try {
-            publicKey = await importCertPublicKeyEcdsa(certPem);
-        }
-        catch (error) {
-            return agentMdResult('invalid', payload, `invalid certificate: ${String(error)}`, expectedAid, fields.cert_fingerprint);
-        }
-        const actualFingerprint = await certificateSha256Fingerprint(certPem);
-        if (!actualFingerprint || actualFingerprint.toLowerCase() !== fields.cert_fingerprint.toLowerCase()) {
-            return agentMdResult('invalid', payload, 'certificate fingerprint mismatch', expectedAid, fields.cert_fingerprint);
-        }
-        const cn = extractCommonNameFromCertPem(certPem);
-        if (expectedAid && cn && cn !== expectedAid) {
-            return agentMdResult('invalid', payload, 'certificate aid mismatch', expectedAid, fields.cert_fingerprint);
-        }
-        let signature;
-        try {
-            signature = base64ToUint8(fields.signature);
-        }
-        catch {
-            return agentMdResult('invalid', payload, 'invalid signature', expectedAid, fields.cert_fingerprint);
-        }
-        if (!signature.length) {
-            return agentMdResult('invalid', payload, 'invalid signature', expectedAid, fields.cert_fingerprint);
-        }
-        const ok = await ecdsaVerifyDer(publicKey, signature, new TextEncoder().encode(payload));
-        if (!ok) {
-            return agentMdResult('invalid', payload, 'signature verification failed', expectedAid, fields.cert_fingerprint, parseAgentMdTimestamp(fields.timestamp));
-        }
-        return agentMdResult('verified', payload, '', expectedAid || payloadAid, fields.cert_fingerprint, parseAgentMdTimestamp(fields.timestamp));
-    }
-    async _resolveAgentMdUrl(aid) {
-        const resolvedAid = String(aid ?? '').trim();
-        if (!resolvedAid) {
-            throw new ValidationError('agent.md requires non-empty aid');
-        }
-        let gatewayUrl = this._client.gatewayUrl ?? '';
-        if (!gatewayUrl) {
-            try {
-                gatewayUrl = await this._resolveGateway(resolvedAid);
-            }
-            catch {
-                gatewayUrl = '';
-            }
-        }
-        const authority = agentMdAuthority(resolvedAid, this._client.configModel.discoveryPort);
-        return `${agentMdHttpScheme(gatewayUrl)}://${authority}/agent.md`;
-    }
-    async _ensureAgentMdUploadToken(aid, gatewayUrl) {
-        const auth = this._internal._auth;
-        let identity = await auth.loadIdentityOrNone(aid);
-        if (!identity) {
-            throw new StateError('no local identity found, call auth.registerAid() first');
-        }
-        const cachedToken = String(identity.access_token ?? '');
-        const expiresAt = auth.getAccessTokenExpiry(identity);
-        if (cachedToken && (expiresAt === null || expiresAt > Date.now() / 1000 + 30)) {
-            return cachedToken;
-        }
-        if (typeof auth.refreshCachedTokens === 'function' && identity.refresh_token) {
-            try {
-                identity = await auth.refreshCachedTokens(gatewayUrl, identity);
-                const refreshedToken = String(identity.access_token ?? '');
-                const refreshedExpiry = auth.getAccessTokenExpiry(identity);
-                if (refreshedToken && (refreshedExpiry === null || refreshedExpiry > Date.now() / 1000 + 30)) {
-                    return refreshedToken;
-                }
-            }
-            catch {
-                // refresh 失败时回退到完整 authenticate
-            }
-        }
-        const result = await this.authenticate({ aid });
-        const token = String(result.access_token ?? '');
-        if (!token) {
-            throw new StateError('authenticate did not return access_token');
-        }
-        return token;
-    }
-    async uploadAgentMd(content) {
-        const tStart = Date.now();
-        this._log.debug(`uploadAgentMd enter: content_len=${String(content ?? '').length}`);
-        try {
-            const auth = this._internal._auth;
-            const identity = await auth.loadIdentityOrNone(this._client.aid ?? undefined);
-            if (!identity) {
-                throw new StateError('no local identity found, call auth.registerAid() first');
-            }
-            const aid = String(identity.aid ?? this._client.aid ?? '').trim();
-            if (!aid) {
-                throw new StateError('no local identity found, call auth.registerAid() first');
-            }
-            const gatewayUrl = await this._resolveGateway(aid);
-            this._client.gatewayUrl = gatewayUrl;
-            const token = await this._ensureAgentMdUploadToken(aid, gatewayUrl);
-            const response = await fetchWithTimeout(await this._resolveAgentMdUrl(aid), {
-                method: 'PUT',
-                headers: {
-                    Authorization: `Bearer ${token}`,
-                    'Content-Type': 'text/markdown; charset=utf-8',
-                },
-                body: content,
-            });
-            if (response.status === 404) {
-                throw new NotFoundError(`agent.md endpoint not found for aid: ${aid}`);
-            }
-            if (!response.ok) {
-                const message = (await response.text()).trim();
-                throw new AUNError(`upload agent.md failed: HTTP ${response.status}${message ? ` - ${message}` : ''}`);
-            }
-            const payload = await response.json();
-            if (!isJsonObject(payload)) {
-                throw new AUNError('upload agent.md returned invalid JSON payload');
-            }
-            this._log.debug(`uploadAgentMd exit: elapsed=${Date.now() - tStart}ms aid=${aid}`);
-            return payload;
-        }
-        catch (err) {
-            this._log.debug(`uploadAgentMd exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
-            throw err;
-        }
-    }
-    async headAgentMd(aid) {
-        const tStart = Date.now();
-        const targetAid = String(aid ?? '').trim();
-        if (!targetAid) {
-            throw new ValidationError('headAgentMd requires non-empty aid');
-        }
-        this._log.debug(`headAgentMd enter: aid=${targetAid}`);
-        try {
-            const response = await fetchWithTimeout(await this._resolveAgentMdUrl(targetAid), {
-                method: 'HEAD',
-                headers: { Accept: 'text/markdown' },
-            });
-            const respHeaders = response.headers;
-            const etag = respHeaders ? String(respHeaders.get('ETag') ?? '').trim() : '';
-            const lastModified = respHeaders ? String(respHeaders.get('Last-Modified') ?? '').trim() : '';
-            if (response.status === 404) {
-                this._log.debug(`headAgentMd exit (not_found): elapsed=${Date.now() - tStart}ms aid=${targetAid}`);
-                return { aid: targetAid, found: false, etag: '', last_modified: '', status: 404 };
-            }
-            if (response.status < 200 || response.status >= 300) {
-                throw new AUNError(`head agent.md failed: HTTP ${response.status}`);
-            }
-            if (etag || lastModified) {
-                const cached = this._agentMdCache.get(targetAid) ?? { text: '', etag: '', lastModified: '' };
-                this._agentMdCache.set(targetAid, {
-                    text: cached.text ?? '',
-                    etag,
-                    lastModified,
-                });
-            }
-            this._log.debug(`headAgentMd exit: elapsed=${Date.now() - tStart}ms aid=${targetAid} status=${response.status} etag=${etag || '-'}`);
-            return { aid: targetAid, found: true, etag, last_modified: lastModified, status: response.status };
-        }
-        catch (err) {
-            this._log.debug(`headAgentMd exit (error): elapsed=${Date.now() - tStart}ms aid=${targetAid} err=${err instanceof Error ? err.message : String(err)}`);
-            throw err;
-        }
-    }
-    async downloadAgentMd(aid) {
-        const tStart = Date.now();
-        this._log.debug(`downloadAgentMd enter: aid=${aid}`);
-        try {
-            const targetAid = String(aid ?? '').trim();
-            if (!targetAid) {
-                throw new ValidationError('downloadAgentMd requires non-empty aid');
-            }
-            const cached = this._agentMdCache.get(targetAid);
-            const requestHeaders = { Accept: 'text/markdown' };
-            // 不发送条件请求头，始终做无条件 GET（302 由 fetch 自动跟随）
-            const agentMdUrl = await this._resolveAgentMdUrl(targetAid);
-            const response = await fetchWithTimeout(agentMdUrl, {
-                method: 'GET',
-                headers: requestHeaders,
-                redirect: 'follow',
-            });
-            if (response.status === 304) {
-                // 304 不应出现（我们不发条件头），但防御性处理
-                if (cached?.text) {
-                    this._log.debug(`downloadAgentMd exit (not_modified): elapsed=${Date.now() - tStart}ms aid=${targetAid}`);
-                    return cached.text;
-                }
-                // 本地缓存为空却收到 304，警告并重试无条件 GET
-                this._log.warn(`downloadAgentMd got 304 but no local cache, retrying unconditional GET: aid=${targetAid}`);
-                const retryResp = await fetchWithTimeout(agentMdUrl, {
-                    method: 'GET',
-                    headers: { Accept: 'text/markdown' },
-                    redirect: 'follow',
-                });
-                if (retryResp.status === 404) {
-                    throw new NotFoundError(`agent.md not found for aid: ${targetAid}`);
-                }
-                if (!retryResp.ok) {
-                    const message = (await retryResp.text()).trim();
-                    throw new AUNError(`download agent.md failed (retry): HTTP ${retryResp.status}${message ? ` - ${message}` : ''}`);
-                }
-                const retryText = await retryResp.text();
-                this._log.debug(`downloadAgentMd exit (retry): elapsed=${Date.now() - tStart}ms aid=${targetAid} bytes=${retryText.length}`);
-                return retryText;
-            }
-            if (response.status === 404) {
-                throw new NotFoundError(`agent.md not found for aid: ${targetAid}`);
-            }
-            if (!response.ok) {
-                const message = (await response.text()).trim();
-                throw new AUNError(`download agent.md failed: HTTP ${response.status}${message ? ` - ${message}` : ''}`);
-            }
-            const text = await response.text();
-            // headers 在某些 fake response（测试 mock）下可能缺失，做一次容错处理。
-            const respHeaders = response.headers;
-            const etag = respHeaders ? String(respHeaders.get('ETag') ?? '').trim() : '';
-            const lastModified = respHeaders ? String(respHeaders.get('Last-Modified') ?? '').trim() : '';
-            if (etag || lastModified) {
-                this._agentMdCache.set(targetAid, { text, etag, lastModified });
-            }
-            this._log.debug(`downloadAgentMd exit: elapsed=${Date.now() - tStart}ms aid=${targetAid} bytes=${text.length}`);
-            return text;
-        }
-        catch (err) {
-            this._log.debug(`downloadAgentMd exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
-            throw err;
-        }
-    }
-    /** 下载证书（透传 RPC） */
-    async downloadCert(params) {
-        const tStart = Date.now();
-        this._log.debug('downloadCert enter');
-        try {
-            const r = await this._client.call('auth.download_cert', params ?? {});
-            this._log.debug(`downloadCert exit: elapsed=${Date.now() - tStart}ms`);
-            return r;
-        }
-        catch (err) {
-            this._log.debug(`downloadCert exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
-            throw err;
-        }
-    }
-    /** 请求签发证书（透传 RPC） */
-    async requestCert(params) {
-        const tStart = Date.now();
-        this._log.debug('requestCert enter');
-        try {
-            const r = await this._client.call('auth.request_cert', params);
-            this._log.debug(`requestCert exit: elapsed=${Date.now() - tStart}ms`);
-            return r;
-        }
-        catch (err) {
-            this._log.debug(`requestCert exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
-            throw err;
-        }
-    }
-    /** 续期证书（透传 RPC） */
-    async renewCert(params) {
-        const tStart = Date.now();
-        this._log.debug('renewCert enter');
-        try {
-            const r = await this._client.call('auth.renew_cert', params ?? {});
-            this._log.debug(`renewCert exit: elapsed=${Date.now() - tStart}ms`);
-            return r;
-        }
-        catch (err) {
-            this._log.debug(`renewCert exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
-            throw err;
-        }
-    }
-    /** 密钥轮换（透传 RPC） */
-    async rekey(params) {
-        const tStart = Date.now();
-        this._log.debug('rekey enter');
-        try {
-            const r = await this._client.call('auth.rekey', params ?? {});
-            this._log.debug(`rekey exit: elapsed=${Date.now() - tStart}ms`);
-            return r;
-        }
-        catch (err) {
-            this._log.debug(`rekey exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
-            throw err;
-        }
-    }
-    /** 获取信任根（透传 RPC） */
-    async trustRoots(params) {
-        const tStart = Date.now();
-        this._log.debug('trustRoots enter');
-        try {
-            const r = await this._client.call('meta.trust_roots', params ?? {});
-            this._log.debug(`trustRoots exit: elapsed=${Date.now() - tStart}ms`);
-            return r;
-        }
-        catch (err) {
-            this._log.debug(`trustRoots exit (error): elapsed=${Date.now() - tStart}ms err=${err instanceof Error ? err.message : String(err)}`);
-            throw err;
-        }
-    }
-    /**
-     * 检查指定 AID 的本地和远程状态。
-     * 与 Python SDK namespaces/auth_namespace.py:check_aid 对应。
-     */
-    async checkAid(params) {
-        const tStart = Date.now();
-        const aid = String(params?.aid ?? '').trim();
-        if (!aid)
-            throw new ValidationError("auth.check_aid requires 'aid'");
-        this._log.debug(`checkAid enter: aid=${aid}`);
-        try {
-            const result = await this._checkLocalAid(aid);
-            const local = result.local;
-            if (!local?.complete) {
-                const remote = await this._checkRemoteAidRegistration(aid);
-                result.remote = remote;
-                const remoteStatus = remote?.status;
-                if (remoteStatus === 'available') {
-                    result.status = 'available';
-                    result.can_register = true;
-                }
-                else if (remoteStatus === 'registered') {
-                    result.status = 'registered_remote';
-                    result.can_register = false;
-                }
-                else {
-                    result.status = 'unknown';
-                    result.can_register = false;
-                }
-            }
-            this._log.debug(`checkAid exit: elapsed=${Date.now() - tStart}ms aid=${aid} status=${String(result.status)}`);
-            return result;
-        }
-        catch (err) {
-            this._log.debug(`checkAid exit (error): elapsed=${Date.now() - tStart}ms aid=${aid} err=${err instanceof Error ? err.message : String(err)}`);
-            throw err;
-        }
-    }
-    async _checkLocalAid(aid) {
-        const client = this._internal;
-        const ks = client._keystore;
-        const identity = await client._auth.loadIdentityOrNone(aid);
-        let keyPair = null;
-        let keyError = '';
-        try {
-            if (ks && typeof ks.loadKeyPair === 'function') {
-                keyPair = await ks.loadKeyPair(aid);
-            }
-        }
-        catch (e) {
-            keyError = e instanceof Error ? e.message : String(e);
-        }
-        let certPem = null;
-        let certError = '';
-        try {
-            if (ks && typeof ks.loadCert === 'function') {
-                certPem = await ks.loadCert(aid);
-            }
-        }
-        catch (e) {
-            certError = e instanceof Error ? e.message : String(e);
-        }
-        const privateKeyPresent = !!(keyPair && keyPair.private_key_pem);
-        const publicKeyPresent = !!(keyPair && keyPair.public_key_der_b64);
-        const certPresent = !!certPem;
-        const certInfo = certPresent
-            ? await this._inspectCertBrowser(aid, certPem)
-            : { present: false, valid: false, expired: false };
-        const certValid = !!certInfo.valid;
-        const localComplete = privateKeyPresent && publicKeyPresent && certPresent && certValid;
-        const issues = [];
-        if (!identity)
-            issues.push('local identity not found');
-        if (!privateKeyPresent)
-            issues.push('private key missing');
-        if (!publicKeyPresent)
-            issues.push('public key missing');
-        if (!certPresent) {
-            issues.push('certificate missing');
-        }
-        else if (certInfo.parse_error) {
-            issues.push(`certificate invalid: ${certInfo.parse_error}`);
-        }
-        else if (certInfo.expired) {
-            issues.push('certificate expired');
-        }
-        else if (!certValid) {
-            issues.push('certificate not currently valid');
-        }
-        if (keyError)
-            issues.push(`key load error: ${keyError}`);
-        if (certError)
-            issues.push(`certificate load error: ${certError}`);
-        return {
-            aid,
-            status: localComplete ? 'local_ready' : 'local_incomplete',
-            can_register: localComplete ? false : null,
-            local: {
-                exists: identity !== null,
-                complete: localComplete,
-                private_key: privateKeyPresent,
-                public_key: publicKeyPresent,
-                certificate: certInfo,
-                issues,
-            },
-            remote: {
-                status: localComplete ? 'not_checked' : 'pending',
-            },
-        };
-    }
-    /** 浏览器环境证书检查（无 node:crypto X509Certificate） */
-    async _inspectCertBrowser(aid, certPem) {
-        const result = { present: true, valid: false, expired: false };
-        try {
-            const fingerprint = await certificateSha256Fingerprint(certPem);
-            const cn = extractCommonNameFromCertPem(certPem);
-            const aidMatches = !cn || cn === aid;
-            // 从 DER 解析有效期
-            const validity = parseCertValidity(certPem);
-            if (validity) {
-                const now = Date.now();
-                const valid = now >= validity.notBefore && now <= validity.notAfter && aidMatches;
-                const expired = now > validity.notAfter;
-                result.valid = valid;
-                result.expired = expired;
-                result.not_before = new Date(validity.notBefore).toISOString();
-                result.not_after = new Date(validity.notAfter).toISOString();
-                result.expires_at = Math.floor(validity.notAfter / 1000);
-                result.seconds_until_expiry = Math.floor((validity.notAfter - now) / 1000);
-            }
-            else {
-                // 无法解析有效期，仅检查 CN
-                result.valid = aidMatches;
-            }
-            result.fingerprint = fingerprint;
-            result.subject_cn = cn;
-            result.aid_matches = aidMatches;
-            if (cn && cn !== aid) {
-                result.valid = false;
-                result.parse_error = `certificate CN mismatch: ${cn}`;
-            }
-        }
-        catch (e) {
-            result.parse_error = e instanceof Error ? e.message : String(e);
-        }
-        return result;
-    }
-    async _checkRemoteAidRegistration(aid) {
-        try {
-            const content = await this.downloadAgentMd(aid);
-            return {
-                status: 'registered',
-                registered: true,
-                available: false,
-                source: 'agent.md',
-                agent_md_bytes: new TextEncoder().encode(content).length,
-                agent_md_aid: extractAgentMDAid(content),
-            };
-        }
-        catch (err) {
-            if (err instanceof NotFoundError) {
-                return {
-                    status: 'available',
-                    registered: false,
-                    available: true,
-                    source: 'agent.md',
-                };
-            }
-            return {
-                status: 'unknown',
-                registered: null,
-                available: null,
-                source: 'agent.md',
-                error: err instanceof Error ? err.message : String(err),
-            };
-        }
-    }
-}
-//# sourceMappingURL=auth.js.map