@agentunion/fastaun 0.5.18 → 0.5.20

package/dist/auth.js

@@ -16,10 +16,12 @@ import * as http from 'node:http';
 import * as https from 'node:https';
 import * as path from 'node:path';
 import { URL, fileURLToPath } from 'node:url';
-import { AuthError, StateError, ValidationError, mapRemoteError } from './errors.js';
+import { AuthError, StateError, ValidationError, AUNError, mapRemoteError } from './errors.js';
 import { shortRpcViaNetworkActor } from './transport.js';
 import { isJsonObject, } from './types.js';
 import { VERSION as AUN_SDK_VERSION } from './version.js';
+import { certFingerprint, isStrictBase64 } from './cert-utils.js';
+import { validateAgentMdCertificate } from './agent-md-schema.js';
 const _noopLogger = {
     error: () => { },
     warn: () => { },
@@ -182,6 +184,262 @@ function _certSubjectCN(cert) {
 function _certDer(cert) {
     return Buffer.from(cert.raw);
 }
+function _ownershipDer(buffer, offset = 0) {
+    let cursor = offset + 2;
+    if (cursor > buffer.length || (buffer[offset] & 31) === 31)
+        throw new ValidationError('invalid OCSP DER', { stringCode: 'invalid' });
+    let length = buffer[offset + 1];
+    if (length & 128) {
+        const count = length & 127;
+        length = 0;
+        if (!count || count > 4 || cursor + count > buffer.length || buffer[cursor] === 0)
+            throw new ValidationError('invalid OCSP DER length', { stringCode: 'invalid' });
+        for (let i = 0; i < count; i++)
+            length = length * 256 + buffer[cursor++];
+        if (length < 128)
+            throw new ValidationError('non-canonical OCSP DER length', { stringCode: 'invalid' });
+    }
+    if (cursor + length > buffer.length)
+        throw new ValidationError('truncated OCSP DER', { stringCode: 'invalid' });
+    return { tag: buffer[offset], raw: buffer.subarray(offset, cursor + length), content: buffer.subarray(cursor, cursor + length) };
+}
+function _ownershipDerChildren(value, tag) {
+    if (!value)
+        throw new StateError('OCSP field is missing', { stringCode: 'unavailable', retryable: true });
+    if (tag !== undefined && value.tag !== tag)
+        throw new ValidationError('unexpected OCSP DER field', { stringCode: 'invalid' });
+    const children = [];
+    for (let offset = 0; offset < value.content.length;) {
+        const child = _ownershipDer(value.content, offset);
+        children.push(child);
+        offset += child.raw.length;
+    }
+    return children;
+}
+function _ownershipCertParts(cert) {
+    const tbs = _ownershipDerChildren(_ownershipDerChildren(_ownershipDer(cert.raw), 0x30)[0], 0x30);
+    const version = tbs[0]?.tag === 0xa0 ? 1 : 0;
+    const spki = _ownershipDerChildren(tbs[version + 5], 0x30);
+    if (spki[1]?.tag !== 3 || spki[1].content[0] !== 0)
+        throw new ValidationError('invalid issuer public key', { stringCode: 'invalid' });
+    return { subject: tbs[version + 4].raw, key: spki[1].content.subarray(1) };
+}
+function _ownershipCertConstraints(cert) {
+    const tbs = _ownershipDerChildren(_ownershipDerChildren(_ownershipDer(cert.raw), 0x30)[0], 0x30);
+    const extensions = tbs.find((node) => node.tag === 0xa3);
+    if (!extensions)
+        return { basicPresent: false, ca: false, keyUsagePresent: false, keyCertSign: false, nameConstraints: false };
+    const extensionSequence = _ownershipDerChildren(extensions)[0];
+    if (!extensionSequence || extensionSequence.tag !== 0x30)
+        throw new ValidationError('ownership certificate extensions are invalid', { stringCode: 'invalid' });
+    const values = _ownershipDerChildren(extensionSequence, 0x30);
+    let ca = false;
+    let basicPresent = false;
+    let keyCertSign = false;
+    let keyUsagePresent = false;
+    let pathLen;
+    let nameConstraints = false;
+    const seen = new Set();
+    for (const extension of values) {
+        const fields = _ownershipDerChildren(extension, 0x30);
+        const oid = fields[0]?.tag === 6 ? fields[0].content.toString('hex') : '';
+        if (!oid || seen.has(oid) || ![2, 3].includes(fields.length) || fields[fields.length - 1].tag !== 4)
+            throw new ValidationError('ownership certificate extension is invalid', { stringCode: 'invalid' });
+        seen.add(oid);
+        const critical = fields.length === 3 && fields[1].tag === 1 && fields[1].content.equals(Buffer.from([0xff]));
+        if (fields.length === 3 && (fields[1].tag !== 1 || fields[1].content.length !== 1 || ![0, 0xff].includes(fields[1].content[0])))
+            throw new ValidationError('ownership certificate extension critical flag is invalid', { stringCode: 'invalid' });
+        const value = _ownershipDer(fields[fields.length - 1].content);
+        if (value.raw.length !== fields[fields.length - 1].content.length)
+            throw new ValidationError('ownership certificate extension value has trailing data', { stringCode: 'invalid' });
+        if (oid === '551d13') {
+            basicPresent = true;
+            const basic = _ownershipDerChildren(value, 0x30);
+            if (basic.length > 2)
+                throw new ValidationError('ownership BasicConstraints is invalid', { stringCode: 'invalid' });
+            let offset = 0;
+            if (basic[offset]?.tag === 1) {
+                if (basic[offset].content.length !== 1)
+                    throw new ValidationError('ownership BasicConstraints is invalid', { stringCode: 'invalid' });
+                ca = basic[offset].content[0] === 0xff;
+                offset++;
+            }
+            if (basic[offset]) {
+                const bytes = basic[offset].content;
+                if (basic[offset].tag !== 2 || !bytes.length || bytes[0] & 0x80 || bytes.length > 1 && bytes[0] === 0 && !(bytes[1] & 0x80))
+                    throw new ValidationError('ownership BasicConstraints pathLen is invalid', { stringCode: 'invalid' });
+                const parsed = BigInt(`0x${bytes.toString('hex')}`);
+                if (parsed > BigInt(Number.MAX_SAFE_INTEGER) || !ca)
+                    throw new ValidationError('ownership BasicConstraints pathLen is invalid', { stringCode: 'invalid' });
+                pathLen = Number(parsed);
+            }
+        }
+        else if (oid === '551d0f') {
+            keyUsagePresent = true;
+            if (value.tag !== 3 || value.content.length < 2 || value.content[0] > 7)
+                throw new ValidationError('ownership keyUsage is invalid', { stringCode: 'invalid' });
+            keyCertSign = Boolean(value.content[1] & 0x04);
+        }
+        else if (oid === '551d1e') {
+            nameConstraints = true;
+        }
+        else if (critical) {
+            throw new ValidationError('ownership certificate has an unsupported critical extension', { stringCode: 'invalid' });
+        }
+    }
+    if (nameConstraints)
+        throw new ValidationError('ownership certificate NameConstraints are unsupported', { stringCode: 'invalid' });
+    return { basicPresent, ca, pathLen, keyUsagePresent, keyCertSign, nameConstraints };
+}
+function _ownershipOcspTime(node) {
+    if (!node)
+        throw new StateError('OCSP time is missing', { stringCode: 'unavailable', retryable: true });
+    const text = node.content.toString('ascii');
+    const match = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/.exec(text);
+    if (node.tag !== 24 || !match)
+        throw new ValidationError('invalid OCSP time', { stringCode: 'invalid' });
+    const date = new Date(Date.UTC(Number(match[1]), Number(match[2]) - 1, Number(match[3]), Number(match[4]), Number(match[5]), Number(match[6])));
+    if (date.toISOString().replace(/[-:T]/g, '').replace('.000', '') !== text)
+        throw new ValidationError('invalid OCSP calendar time', { stringCode: 'invalid' });
+    return date.getTime() / 1000;
+}
+function _strictCrlRevokedSerials(pem, issuer, now) {
+    const match = /^-----BEGIN X509 CRL-----\s+([A-Za-z0-9+/=\s]+)-----END X509 CRL-----\s*$/.exec(pem);
+    if (!match || !isStrictBase64(match[1].replace(/\s/g, '')))
+        throw new AuthError('service event signed CRL is invalid');
+    const der = Buffer.from(match[1].replace(/\s/g, ''), 'base64');
+    const outer = _ownershipDer(der);
+    if (outer.raw.length !== der.length)
+        throw new AuthError('service event signed CRL has trailing data');
+    const fields = _ownershipDerChildren(outer, 0x30);
+    if (fields.length !== 3 || fields[2].tag !== 3 || fields[2].content[0] !== 0)
+        throw new AuthError('service event signed CRL is incomplete');
+    const tbs = _ownershipDerChildren(fields[0], 0x30);
+    const offset = tbs[0]?.tag === 2 ? 1 : 0;
+    const algorithm = _ownershipDerChildren(fields[1], 0x30)[0];
+    const oid = algorithm?.tag === 6 ? algorithm.content.toString('hex') : '';
+    const hash = { '2a8648ce3d040302': 'sha256', '2a8648ce3d040303': 'sha384', '2a864886f70d01010b': 'sha256', '2a864886f70d01010c': 'sha384', '2b6570': null }[oid];
+    if (hash === undefined || !tbs[offset]?.raw.equals(fields[1].raw) || !crypto.verify(hash, fields[0].raw, issuer.publicKey, fields[2].content.subarray(1)))
+        throw new AuthError('service event CRL signature is invalid');
+    if (!tbs[offset + 1]?.raw.equals(_ownershipCertParts(issuer).subject))
+        throw new AuthError('service event CRL issuer is invalid');
+    const crlTime = (node) => {
+        if (!node || ![23, 24].includes(node.tag))
+            throw new AuthError('service event CRL time is invalid');
+        const value = node.content.toString('ascii');
+        const digits = node.tag === 23 ? /^(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/.exec(value) : /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/.exec(value);
+        if (!digits)
+            throw new AuthError('service event CRL time is invalid');
+        const year = node.tag === 23 ? (Number(digits[1]) >= 50 ? 1900 : 2000) + Number(digits[1]) : Number(digits[1]);
+        const date = new Date(Date.UTC(year, Number(digits[2]) - 1, Number(digits[3]), Number(digits[4]), Number(digits[5]), Number(digits[6])));
+        if (date.getUTCFullYear() !== year || date.getUTCMonth() + 1 !== Number(digits[2]) || date.getUTCDate() !== Number(digits[3]) || date.getUTCHours() !== Number(digits[4]) || date.getUTCMinutes() !== Number(digits[5]) || date.getUTCSeconds() !== Number(digits[6]))
+            throw new AuthError('service event CRL time is invalid');
+        return date.getTime() / 1000;
+    };
+    const thisUpdate = crlTime(tbs[offset + 2]);
+    const nextUpdate = crlTime(tbs[offset + 3]);
+    if (thisUpdate > now + 5 || nextUpdate <= now || nextUpdate <= thisUpdate)
+        throw new AuthError('service event CRL is not current');
+    const revoked = new Set();
+    if (tbs[offset + 4]?.tag === 0x30)
+        for (const entry of _ownershipDerChildren(tbs[offset + 4], 0x30)) {
+            const serial = _ownershipDerChildren(entry, 0x30)[0];
+            if (!serial || serial.tag !== 2)
+                throw new AuthError('service event CRL entry is invalid');
+            revoked.add(serial.content.toString('hex').replace(/^0+/, '') || '0');
+        }
+    return revoked;
+}
+function _verifyOwnershipOcsp(der, certificate, issuer, now) {
+    const outer = _ownershipDer(der);
+    if (outer.raw.length !== der.length)
+        throw new ValidationError('trailing OCSP data', { stringCode: 'invalid' });
+    const fields = _ownershipDerChildren(outer, 0x30);
+    if (!fields[0])
+        throw new StateError('OCSP response status is missing', { stringCode: 'unavailable', retryable: true });
+    if (fields[0].tag !== 10 || fields[0].content.length !== 1)
+        throw new ValidationError('invalid OCSP response status', { stringCode: 'invalid' });
+    if (!fields[0].content.equals(Buffer.from([0])) || !fields[1])
+        throw new StateError('OCSP response is not successful', { stringCode: 'unavailable', retryable: true });
+    if (fields.length !== 2 || fields[1].tag !== 0xa0)
+        throw new ValidationError('invalid OCSP response fields', { stringCode: 'invalid' });
+    const response = _ownershipDerChildren(_ownershipDerChildren(fields[1])[0], 0x30);
+    if (response.length < 2)
+        throw new StateError('OCSP Basic response is unavailable', { stringCode: 'unavailable', retryable: true });
+    if (response.length !== 2 || response[0].tag !== 6 || response[1].tag !== 4)
+        throw new ValidationError('invalid OCSP Basic response', { stringCode: 'invalid' });
+    if (response[0].content.toString('hex') !== '2b0601050507300101')
+        throw new StateError('unsupported OCSP response type', { stringCode: 'unavailable', retryable: true });
+    const basicRoot = _ownershipDer(response[1].content);
+    if (basicRoot.raw.length !== response[1].content.length)
+        throw new ValidationError('invalid OCSP Basic response length', { stringCode: 'invalid' });
+    const basic = _ownershipDerChildren(basicRoot, 0x30);
+    if (basic.length < 3 || basic[2].content.length <= 1)
+        throw new StateError('OCSP signature is missing', { stringCode: 'unavailable', retryable: true });
+    if (basic.length > 4 || basic[2].tag !== 3 || basic[2].content[0] !== 0)
+        throw new ValidationError('invalid OCSP signature field', { stringCode: 'invalid' });
+    if (basic.length === 4) {
+        const certs = _ownershipDerChildren(basic[3], 0xa0);
+        if (certs.length !== 1 || certs[0].tag !== 0x30)
+            throw new ValidationError('invalid OCSP embedded certificates', { stringCode: 'invalid' });
+        const embedded = _ownershipDerChildren(certs[0], 0x30);
+        if (embedded.length !== 1 || !embedded[0].raw.equals(issuer.raw))
+            throw new ValidationError('OCSP embedded certificate is not the verified issuer', { stringCode: 'invalid' });
+    }
+    const algorithms = { '2a8648ce3d040302': 'sha256', '2a8648ce3d040303': 'sha384', '2a864886f70d01010b': 'sha256', '2a864886f70d01010c': 'sha384', '2b6570': null };
+    const algorithm = _ownershipDerChildren(basic[1], 0x30)[0];
+    const oid = algorithm?.tag === 6 ? algorithm.content.toString('hex') : '';
+    if (!(oid in algorithms))
+        throw new StateError('unsupported OCSP signature algorithm', { stringCode: 'unavailable', retryable: true });
+    if (!crypto.verify(algorithms[oid], basic[0].raw, issuer.publicKey, basic[2].content.subarray(1)))
+        throw new ValidationError('OCSP signature verification failed', { stringCode: 'invalid' });
+    const tbs = _ownershipDerChildren(basic[0], 0x30);
+    let offset = tbs[0]?.tag === 0xa0 ? 1 : 0;
+    const responder = tbs[offset++];
+    const issuerParts = _ownershipCertParts(issuer);
+    const responderValid = responder?.tag === 0xa1 ? responder.content.equals(issuerParts.subject) : responder?.tag === 0xa2 && _ownershipDerChildren(responder)[0]?.tag === 4 && _ownershipDerChildren(responder)[0].content.equals(crypto.createHash('sha1').update(issuerParts.key).digest());
+    if (!responderValid)
+        throw new ValidationError('OCSP responder is not the verified issuer', { stringCode: 'invalid' });
+    const producedAt = _ownershipOcspTime(tbs[offset++]);
+    if (producedAt > now + 5 || producedAt < now - 90)
+        throw new StateError('OCSP response is not current', { stringCode: 'unavailable', retryable: true });
+    const responses = _ownershipDerChildren(tbs[offset++], 0x30);
+    let status;
+    for (const entry of responses) {
+        const single = _ownershipDerChildren(entry, 0x30);
+        if (single.length < 4)
+            throw new StateError('OCSP update bounds are missing', { stringCode: 'unavailable', retryable: true });
+        const id = _ownershipDerChildren(single[0], 0x30);
+        if (id.length !== 4 || id[1].tag !== 4 || id[2].tag !== 4 || id[3].tag !== 2)
+            throw new ValidationError('invalid OCSP CertID', { stringCode: 'invalid' });
+        const hashOid = _ownershipDerChildren(id[0], 0x30)[0];
+        const hashName = hashOid?.tag === 6 ? { '2b0e03021a': 'sha1', '608648016503040201': 'sha256' }[hashOid.content.toString('hex')] : undefined;
+        if (!hashName)
+            throw new StateError('unsupported OCSP issuer hash', { stringCode: 'unavailable', retryable: true });
+        const serial = id[3].content.toString('hex').replace(/^0+/, '') || '0';
+        if (serial !== certificate.serialNumber.toLowerCase().replace(/^0+/, ''))
+            continue;
+        if (status !== undefined || !id[1].content.equals(crypto.createHash(hashName).update(issuerParts.subject).digest()) || !id[2].content.equals(crypto.createHash(hashName).update(issuerParts.key).digest()))
+            throw new ValidationError('OCSP CertID issuer mismatch', { stringCode: 'invalid' });
+        const thisUpdate = _ownershipOcspTime(single[2]);
+        if (single[3].tag !== 0xa0)
+            throw new StateError('OCSP nextUpdate is missing', { stringCode: 'unavailable', retryable: true });
+        const nextUpdate = _ownershipOcspTime(_ownershipDerChildren(single[3])[0]);
+        if (thisUpdate > now + 5 || thisUpdate < now - 30 || nextUpdate <= now || nextUpdate <= thisUpdate)
+            throw new StateError('OCSP validity window is not current', { stringCode: 'unavailable', retryable: true });
+        if (single[1].tag === 0x80 && single[1].content.length === 0)
+            status = 'good';
+        else if (single[1].tag === 0xa1)
+            status = 'revoked';
+        else if (single[1].tag === 0x82 && single[1].content.length === 0)
+            status = 'unknown';
+        else
+            throw new ValidationError('invalid OCSP certificate status', { stringCode: 'invalid' });
+    }
+    if (!status)
+        throw new ValidationError('OCSP does not match the requested certificate', { stringCode: 'invalid' });
+    return status;
+}
 // ── HTTP 辅助 ─────────────────────────────────────────────────
 /** 将 WebSocket URL 转换为 HTTP URL + 路径 */
 function _gatewayHttpUrl(gatewayUrl, urlPath) {
@@ -663,13 +921,36 @@ export class AuthFlow {
      * 验证对端证书：时间有效性 + 链验证 + CRL + OCSP + AID 绑定。
      * 用于 E2EE 握手中验证通信对端的身份证书。
      */
-    async verifyPeerCertificate(gatewayUrl, certPem, expectedAid) {
+    async verifyPeerCertificate(gatewayUrl, certPem, expectedAid, signedAt, strictRevocation = false) {
         const tStart = Date.now();
         this._logger.debug(`verifyPeerCertificate enter: aid=${expectedAid}, gateway=${gatewayUrl}`);
         try {
             const cert = _loadX509(certPem);
+            if (signedAt !== undefined) {
+                _ensureCertTimeValid(cert, 'peer certificate', signedAt * 1000);
+                await this._verifyAuthCertChain(gatewayUrl, cert, expectedAid, signedAt);
+                if (_certSubjectCN(cert) !== expectedAid)
+                    throw new AuthError(`peer cert CN mismatch: expected ${expectedAid}`);
+                return;
+            }
             const nowMs = Date.now();
             _ensureCertTimeValid(cert, 'peer certificate', nowMs);
+            if (strictRevocation) {
+                const chain = (await this._fetchGatewayCaChain(gatewayUrl, expectedAid, true)).map(_loadX509);
+                if (!chain.length)
+                    throw new AuthError('service event certificate chain is unavailable');
+                const current = Math.trunc(Date.now() / 1000);
+                if ([cert, ...chain].some((item) => current < Math.trunc(Date.parse(item.validFrom) / 1000) || current > Math.trunc(Date.parse(item.validTo) / 1000)))
+                    throw new AuthError('service event certificate is outside its validity window');
+                await this._verifyAuthCertChain(gatewayUrl, cert, expectedAid, undefined, true, chain);
+                const crl = await this._fetchGatewayCrl(gatewayUrl, chain[0], true);
+                if (crl.revokedSerials.has(_certSerialHex(cert)))
+                    throw new AuthError('service event certificate has been revoked');
+                await this._fetchGatewayOcspStatus(gatewayUrl, cert, chain[0], true);
+                if (_certSubjectCN(cert) !== expectedAid)
+                    throw new AuthError(`peer cert CN mismatch: expected ${expectedAid}`);
+                return;
+            }
             await this._verifyAuthCertChain(gatewayUrl, cert, expectedAid);
             try {
                 await this._verifyAuthCertRevocation(gatewayUrl, cert, expectedAid);
@@ -701,6 +982,186 @@ export class AuthFlow {
             throw err;
         }
     }
+    async resolveCurrentEntityCertificate(gatewayUrl, aid, type) {
+        try {
+            const query = new URLSearchParams({ consistency: 'authoritative', ...(type === 'group' ? { key_purpose: 'group_identity' } : {}) });
+            const response = await this._fetchOwnershipPki(_gatewayHttpUrl(gatewayUrl, `/pki/cert/${encodeURIComponent(aid)}?${query}`));
+            if (response.status !== 200 || !response.body.trim())
+                throw new StateError('entity current certificate is unavailable', { stringCode: 'unavailable', retryable: true });
+            let fingerprint;
+            try {
+                new crypto.X509Certificate(response.body);
+                fingerprint = certFingerprint(response.body);
+            }
+            catch {
+                throw new ValidationError('entity current certificate is invalid', { stringCode: 'invalid' });
+            }
+            return this.resolveOwnershipCertificate(gatewayUrl, aid, fingerprint, type === 'group' ? 'group_identity' : 'signing');
+        }
+        catch (error) {
+            if (error instanceof AUNError && error.stringCode)
+                throw error;
+            throw new StateError(error instanceof Error ? error.message : String(error), { stringCode: 'unavailable', retryable: true });
+        }
+    }
+    async resolveOwnershipCertificate(gatewayUrl, aid, fingerprint, purpose) {
+        const began = Date.now();
+        const unavailable = (reason) => new StateError(reason, { stringCode: 'unavailable', retryable: true });
+        try {
+            if (!/^[a-z0-9_][a-z0-9_-]*(?:\.[a-z0-9_][a-z0-9_-]*)+$/.test(aid) || !/^sha256:[0-9a-f]{64}$/.test(fingerprint))
+                throw new ValidationError('ownership certificate query requires exact AID and full fingerprint', { stringCode: 'invalid' });
+            const query = new URLSearchParams({ cert_fingerprint: fingerprint, consistency: 'authoritative' });
+            if (purpose === 'group_identity')
+                query.set('key_purpose', purpose);
+            const response = await this._fetchOwnershipPki(_gatewayHttpUrl(gatewayUrl, `/pki/cert/${encodeURIComponent(aid)}?${query}`));
+            if (response.status !== 200)
+                throw unavailable(`ownership certificate HTTP ${response.status}`);
+            const headers = response.headers;
+            const state = headers['x-aun-cert-lifecycle-state'];
+            const observedText = headers['x-aun-cert-observed-at'] ?? '';
+            const observed = Date.parse(observedText) / 1000;
+            const now = Date.now() / 1000;
+            if (headers['x-aun-cert-consistency'] !== 'authoritative' || typeof state !== 'string' || !state || !headers['x-aun-cert-fingerprint'] || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/.test(observedText) || !Number.isFinite(observed) || observed > now + 5 || observed < now - 30)
+                throw unavailable('ownership certificate authoritative current metadata is unavailable');
+            if (state !== 'active_signing' || headers['x-aun-cert-fingerprint'] !== fingerprint)
+                throw new ValidationError('ownership certificate lifecycle or fingerprint is invalid', { stringCode: 'invalid' });
+            if (!response.body.trim())
+                throw unavailable('ownership certificate is missing');
+            let cert;
+            try {
+                cert = new crypto.X509Certificate(response.body);
+            }
+            catch {
+                throw new ValidationError('ownership certificate PEM is invalid', { stringCode: 'invalid' });
+            }
+            if (cert.subject.match(/(?:^|\n)CN=([^\n]+)/)?.[1] !== aid)
+                throw new ValidationError('ownership certificate AID mismatch', { stringCode: 'invalid' });
+            _ownershipCertConstraints(cert);
+            validateAgentMdCertificate(response.body, aid, Math.trunc(now), { now: Math.trunc(now), requireCurrentValidity: true });
+            if (certFingerprint(response.body) !== fingerprint)
+                throw new ValidationError('ownership certificate DER fingerprint mismatch', { stringCode: 'invalid' });
+            const chainResponse = await this._fetchOwnershipPki(_gatewayHttpUrl(gatewayUrl, `/pki/chain/${encodeURIComponent(aid)}`));
+            if (chainResponse.status !== 200 || !chainResponse.body.trim())
+                throw unavailable('ownership certificate chain is unavailable');
+            let chain;
+            try {
+                chain = _splitPemBundle(chainResponse.body).map(_loadX509);
+            }
+            catch {
+                throw new ValidationError('ownership certificate chain PEM is invalid', { stringCode: 'invalid' });
+            }
+            if (chain[0] && !chain[0].ca && _certSubjectCN(chain[0]) === aid)
+                chain.shift();
+            if (!chain.length)
+                throw unavailable('ownership issuer chain is unavailable');
+            let current = cert;
+            for (let index = 0; index < chain.length; index++) {
+                const issuer = chain[index];
+                const constraints = _ownershipCertConstraints(issuer);
+                if (constraints.pathLen !== undefined && index > constraints.pathLen)
+                    throw new ValidationError('ownership certificate path length is invalid', { stringCode: 'invalid' });
+                if (!constraints.basicPresent || !issuer.ca || !constraints.keyUsagePresent || !constraints.keyCertSign || Date.now() < Date.parse(issuer.validFrom) || Date.now() > Date.parse(issuer.validTo) || !current.checkIssued(issuer) || !current.verify(issuer.publicKey))
+                    throw new ValidationError('ownership certificate chain is invalid', { stringCode: 'invalid' });
+                current = issuer;
+            }
+            let roots;
+            try {
+                roots = this._loadTrustedRoots();
+            }
+            catch {
+                throw unavailable('ownership trust anchors are unavailable');
+            }
+            if (!current.checkIssued(current) || !current.verify(current.publicKey) || !roots.some((root) => root.raw.equals(current.raw)))
+                throw new ValidationError('ownership certificate chain is not anchored by a trusted root', { stringCode: 'invalid' });
+            const ocspResponse = await this._fetchOwnershipPki(_gatewayHttpUrl(gatewayUrl, `/pki/ocsp/${cert.serialNumber.toLowerCase()}`));
+            if (ocspResponse.status !== 200)
+                throw unavailable('ownership OCSP is unavailable');
+            let ocsp;
+            if (!ocspResponse.body.trim())
+                throw unavailable('ownership OCSP response is missing');
+            try {
+                ocsp = JSON.parse(ocspResponse.body);
+            }
+            catch {
+                throw new ValidationError('ownership OCSP response is invalid', { stringCode: 'invalid' });
+            }
+            if (!ocsp || typeof ocsp !== 'object' || Array.isArray(ocsp))
+                throw new ValidationError('ownership OCSP response must be an object', { stringCode: 'invalid' });
+            if (ocsp.ocsp_response === undefined || ocsp.ocsp_response === '')
+                throw unavailable('signed ownership OCSP is missing');
+            if (typeof ocsp.ocsp_response !== 'string' || !isStrictBase64(ocsp.ocsp_response))
+                throw new ValidationError('ownership OCSP Base64 is invalid', { stringCode: 'invalid' });
+            let status;
+            try {
+                status = _verifyOwnershipOcsp(Buffer.from(ocsp.ocsp_response, 'base64'), cert, chain[0], Date.now() / 1000);
+            }
+            catch (error) {
+                if (error instanceof ValidationError || error instanceof StateError)
+                    throw error;
+                throw new ValidationError('ownership OCSP evidence is invalid', { stringCode: 'invalid' });
+            }
+            if (ocsp.status !== undefined && ocsp.status !== status)
+                throw new ValidationError('ownership OCSP status mismatch', { stringCode: 'invalid' });
+            if (status === 'revoked')
+                throw new ValidationError('ownership certificate is revoked', { stringCode: 'invalid' });
+            if (status !== 'good')
+                throw unavailable('ownership certificate revocation status is unknown');
+            const finalNow = Date.now();
+            if ([cert, ...chain].some((item) => finalNow < Date.parse(item.validFrom) || finalNow > Date.parse(item.validTo)))
+                throw new ValidationError('ownership certificate chain is invalid', { stringCode: 'invalid' });
+            if (finalNow - began > 30_000 || finalNow / 1000 - observed > 30)
+                throw unavailable('ownership certificate verification window elapsed');
+            return { cert_pem: response.body, chain_valid: true, state, revoked: false, revocation_checked: true, observed_at: Math.trunc(observed) };
+        }
+        catch (error) {
+            if (error instanceof ValidationError)
+                throw new ValidationError(error.message, { stringCode: 'invalid' });
+            if (error instanceof StateError && error.stringCode)
+                throw error;
+            throw unavailable(error instanceof Error ? error.message : String(error));
+        }
+    }
+    async _fetchOwnershipPki(url) {
+        const fetch = (target, originalHost) => new Promise((resolve, reject) => {
+            const parsed = new URL(target);
+            const module = parsed.protocol === 'https:' ? https : http;
+            const request = module.get(target, { timeout: 5_000, rejectUnauthorized: this._verifySsl,
+                servername: originalHost, headers: { 'Cache-Control': 'no-cache, no-store', ...(originalHost ? { Host: new URL(url).host } : {}) } }, (response) => {
+                const chunks = [];
+                response.on('data', (chunk) => chunks.push(chunk));
+                response.on('error', reject);
+                response.on('end', () => {
+                    try {
+                        const headers = {};
+                        for (const [key, value] of Object.entries(response.headers))
+                            if (typeof value === 'string')
+                                headers[key] = value;
+                        resolve({ status: response.statusCode ?? 0, headers, body: new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(Buffer.concat(chunks)) });
+                    }
+                    catch (error) {
+                        reject(error);
+                    }
+                });
+            });
+            request.on('error', reject);
+            request.on('timeout', () => request.destroy(new Error('ownership PKI request timed out')));
+        });
+        try {
+            const result = await fetch(url);
+            if (this._net)
+                void this._net.refreshDnsCacheAfterSuccess(url);
+            return result;
+        }
+        catch (error) {
+            if (!this._net?.isDnsError(error))
+                throw error;
+            const original = new URL(url);
+            const cached = this._net.loadDnsCache(original.hostname);
+            if (!cached)
+                throw error;
+            return fetch(this._net.replaceHostWithIP(url, cached.ip), original.hostname);
+        }
+    }
     /** 预置 Gateway CA 链材料，但不标记为已验证。 */
     cacheGatewayCaChain(gatewayUrl, caChainPems, chainAid = '') {
         const normalized = caChainPems
@@ -1076,22 +1537,22 @@ export class AuthFlow {
      * 4. BasicConstraints 检查
      * 5. 根证书自签 + 受信根锚定
      */
-    async _verifyAuthCertChain(gatewayUrl, authCert, chainAid = '') {
-        const certSerial = _certSerialHex(authCert);
+    async _verifyAuthCertChain(gatewayUrl, authCert, chainAid = '', signedAt, fresh = false, suppliedChain) {
+        const certSerial = _certSerialHex(authCert) + (signedAt === undefined ? '' : `:signed:${signedAt}`);
         // 检查缓存
         const cachedAt = this._chainVerifiedCache.get(certSerial);
-        if (cachedAt && Date.now() - cachedAt < this._chainCacheTtl) {
+        if (!fresh && cachedAt && Date.now() - cachedAt < this._chainCacheTtl) {
             return;
         }
-        const nowMs = Date.now();
+        const nowMs = signedAt === undefined ? Date.now() : signedAt * 1000;
         _ensureCertTimeValid(authCert, 'auth certificate', nowMs);
-        const chain = await this._loadGatewayCaChain(gatewayUrl, chainAid);
+        const chain = suppliedChain ?? await this._loadGatewayCaChain(gatewayUrl, chainAid);
         if (!chain.length) {
             throw new AuthError('unable to verify auth certificate chain: missing CA chain');
         }
-        const cacheKey = chainAid ? `${gatewayUrl}:${chainAid}` : gatewayUrl;
+        const cacheKey = (chainAid ? `${gatewayUrl}:${chainAid}` : gatewayUrl) + (signedAt === undefined ? '' : `:signed:${signedAt}`);
         // 快速路径：CA 链已通过完整验证
-        if (this._gatewayCaVerified.get(cacheKey)) {
+        if (!fresh && this._gatewayCaVerified.get(cacheKey)) {
             const issuer = chain[0];
             _ensureCertTimeValid(issuer, 'Issuer CA', nowMs);
             if (!_isCaCert(issuer)) {
@@ -1152,9 +1613,21 @@ export class AuthFlow {
         return cached.map((pem) => _loadX509(pem));
     }
     /** 从 Gateway PKI 端点获取 CA 链 */
-    async _fetchGatewayCaChain(gatewayUrl, _chainAid = '') {
+    async _fetchFreshPkiJson(url) {
+        const response = await this._fetchOwnershipPki(url);
+        if (response.status !== 200)
+            throw new AuthError('service event current PKI is unavailable');
+        const payload = JSON.parse(response.body);
+        if (!isJsonObject(payload))
+            throw new AuthError('service event current PKI response is invalid');
+        return payload;
+    }
+    async _fetchGatewayCaChain(gatewayUrl, _chainAid = '', fresh = false) {
         const url = _gatewayHttpUrl(gatewayUrl, '/pki/chain');
-        const text = await _fetchText(url, this._verifySsl, this._net);
+        const response = fresh ? await this._fetchOwnershipPki(url) : undefined;
+        if (response && response.status !== 200)
+            throw new AuthError('service event certificate chain is unavailable');
+        const text = response ? response.body : await _fetchText(url, this._verifySsl, this._net);
         return _splitPemBundle(text);
     }
     /**
@@ -1205,13 +1678,15 @@ export class AuthFlow {
      * 并验证 crl_pem 存在性。完整的 CRL 签名验证需要依赖
      * @peculiar/x509 或手动 ASN.1 解析。
      */
-    async _fetchGatewayCrl(gatewayUrl, _issuerCert) {
+    async _fetchGatewayCrl(gatewayUrl, _issuerCert, fresh = false) {
         const url = _gatewayHttpUrl(gatewayUrl, '/pki/crl.json');
-        const payload = await _fetchJson(url, this._verifySsl, this._net);
+        const payload = fresh ? await this._fetchFreshPkiJson(url) : await _fetchJson(url, this._verifySsl, this._net);
         const crlPem = String(payload.crl_pem || '');
         if (!crlPem) {
             throw new AuthError('gateway CRL endpoint returned no signed CRL');
         }
+        if (fresh)
+            return { revokedSerials: _strictCrlRevokedSerials(crlPem, _issuerCert, Date.now() / 1000), nextRefreshAt: Date.now() };
         // 从 JSON 响应中提取吊销序列号列表
         // Gateway 的 crl.json 同时包含 crl_pem（签名 CRL）和 revoked_serials（方便客户端解析）
         let revokedSerials = new Set();
@@ -1381,12 +1856,22 @@ export class AuthFlow {
      * 这里从 JSON 响应中提取 status 字段，并验证 ocsp_response 存在性。
      * 对于 ocsp_response 的签名验证，实现简化的 DER 解析以提取关键字段。
      */
-    async _fetchGatewayOcspStatus(gatewayUrl, authCert, issuerCert) {
+    async _fetchGatewayOcspStatus(gatewayUrl, authCert, issuerCert, strictCurrent = false) {
         const serialHex = _certSerialHex(authCert);
         const url = _gatewayHttpUrl(gatewayUrl, `/pki/ocsp/${serialHex}`);
-        const payload = await _fetchJson(url, this._verifySsl, this._net);
+        const payload = strictCurrent ? await this._fetchFreshPkiJson(url) : await _fetchJson(url, this._verifySsl, this._net);
         const status = String(payload.status || '');
         const ocspB64 = String(payload.ocsp_response || '');
+        if (strictCurrent) {
+            if (typeof payload.ocsp_response !== 'string' || !isStrictBase64(ocspB64))
+                throw new AuthError('service event signed current OCSP is unavailable or invalid');
+            const verified = _verifyOwnershipOcsp(Buffer.from(ocspB64, 'base64'), authCert, issuerCert, Date.now() / 1000);
+            if (payload.status !== undefined && payload.status !== verified)
+                throw new AuthError('service event OCSP status mismatch');
+            if (verified !== 'good')
+                throw new AuthError(`service event certificate OCSP status is ${verified}`);
+            return { status: verified, nextRefreshAt: Date.now() };
+        }
         if (!ocspB64) {
             throw new AuthError('gateway OCSP endpoint returned no ocsp_response');
         }