@agentunion/fastaun 0.5.19 → 0.5.20

package/dist/client.js

@@ -47,7 +47,7 @@ import { decryptedOwnershipJsonText } from './v2/e2ee/decrypt.js';
 import { isJsonObject, ConnectionState, STATE_TO_PUBLIC, } from './types.js';
 import { AID } from './aid.js';
 import { certFingerprint, certMatchesFingerprint, normalizeFingerprintHex, publicKeyMatchesFingerprint } from './cert-utils.js';
-import { validateAgentMdDocument } from './agent-md-schema.js';
+import { validateAgentMdCertificate, validateAgentMdDocument } from './agent-md-schema.js';
 import { OwnershipFiles, OwnershipStorageAdapter, ownershipFailure, signOwnershipFile } from './ownership-v21.js';
 import { OwnershipWorkflow } from './ownership-workflow.js';
 import { canonicalJson, createCredential, createMemberCredential, signMembershipBinding, verifyServiceEvent } from './org-protocol.js';
@@ -440,7 +440,7 @@ function createAgentMdManagerForRuntime(opts) {
             const target = String(aid ?? '').trim();
             const expectedFp = String(certFingerprint ?? '').trim().toLowerCase();
             const current = opts.currentAid();
-            if (current?.aid === target) {
+            if (signedAt === undefined && current?.aid === target) {
                 if (!expectedFp || certMatchesFingerprint(current.certPem, expectedFp))
                     return current;
             }
@@ -485,7 +485,7 @@ export class AUNClient {
     _ownershipFiles = null;
     _ownershipWorkflow = null;
     _getOwnershipStorage() {
-        return this._ownershipStorage ??= new OwnershipStorageAdapter({ currentAid: () => this._aid, call: (method, params) => this.call(method, params) });
+        return this._ownershipStorage ??= new OwnershipStorageAdapter({ currentAid: () => this._aid, call: (method, params) => this.call(method, params), httpPut: (url, data, headers) => this.storage.lowlevel.httpPut(url, data, headers) });
     }
     _getOwnershipFiles() {
         return this._ownershipFiles ??= new OwnershipFiles({
@@ -496,8 +496,8 @@ export class AUNClient {
             readAgentMdFresh: (subAid) => this._agentMdManager.readOwnershipFresh(subAid),
             submitAgentMdRaw: (subAid, raw, condition) => this._agentMdManager.submitOwnershipRaw(subAid, raw, condition),
             readOwnerMd: (ownerAid, subAid) => this._getOwnershipStorage().readOwnerMd(ownerAid, subAid),
-            writeOwnerMd: (ownerAid, subAid, raw, revision) => this._getOwnershipStorage().writeOwnerMd(ownerAid, subAid, raw, revision),
-            deleteOwnerMd: (ownerAid, subAid, revision) => this._getOwnershipStorage().deleteOwnerMd(ownerAid, subAid, revision),
+            writeOwnerMd: (ownerAid, subAid, raw) => this._getOwnershipStorage().writeOwnerMd(ownerAid, subAid, raw),
+            deleteOwnerMd: (ownerAid, subAid) => this._getOwnershipStorage().deleteOwnerMd(ownerAid, subAid),
             resolveCertificate: async (aid, fingerprint, purpose) => this._auth.resolveOwnershipCertificate(await this._resolveOwnershipCertificateGateway(aid), aid, fingerprint, purpose),
         });
     }
@@ -725,7 +725,7 @@ export class AUNClient {
         if (debugFlag) {
             this._clientLog.info(`AUNClient initialized (debug=true, aunPath=${this._configModel.aunPath})`);
         }
-        this._dispatcher = new EventDispatcher(this._logger.for('aun_core.events'), () => this._identity?.aid ?? '');
+        this._dispatcher = new EventDispatcher(this._logger.for('aun_core.events'), () => this._identity?.aid ?? '', () => this._ensureReadStateIdentity());
         const dnsNet = new DnsResilientNet({
             verifySsl: this._configModel.verifySsl,
             logger: this._clientLog,
@@ -771,7 +771,7 @@ export class AUNClient {
             },
             auth: () => this._auth,
             tokenStore: () => this._tokenStore,
-            fetchPeerCert: (target, certFingerprint, signedAt) => this._fetchPeerCert(target, certFingerprint || undefined, undefined, signedAt),
+            fetchPeerCert: (target, certFingerprint, signedAt) => this._fetchPeerCert(target, certFingerprint || undefined, undefined, signedAt, true),
             resolveEntityOwner: (target, type) => this._resolveEntityAgentMdOwner(target, type),
             fetchEntityIdentity: (target, type) => this._freshEntityCertificate(target, type),
             fetchEntitySigner: (target, fingerprint) => this._freshEntitySigner(target, fingerprint),
@@ -787,6 +787,7 @@ export class AUNClient {
         this._transport.setServiceEventVerifier((event, payload) => verifyServiceEvent(event, payload, { targetAid: this._identity?.aid ?? '', resolveEventCertificate: (aid, fingerprint) => this._fetchServiceEventCertificate(aid, fingerprint), resolveCredentialService: this.resolveCredentialService }), () => this._identity?.aid ?? '', () => this._serviceEventIdentityVersion);
         this._transport.setProtocolDisconnectCallback((err, closeCode) => this._handleTransportDisconnect(err, closeCode));
         this._transport._onForegroundDrained = () => this._delivery.onForegroundPullsDrained();
+        this._transport._onRpcResponse = () => this._delivery.requestBackgroundPullRecovery();
         this._runtime = new ClientRuntime(this);
         this._identityRuntime = new IdentityRuntimeManager(this._runtime);
         this._peerDirectory = new PeerDirectory(this._runtime);
@@ -1159,7 +1160,7 @@ export class AUNClient {
             },
             auth: () => this._auth,
             tokenStore: () => this._tokenStore,
-            fetchPeerCert: (target, certFingerprint, signedAt) => this._fetchPeerCert(target, certFingerprint || undefined, undefined, signedAt),
+            fetchPeerCert: (target, certFingerprint, signedAt) => this._fetchPeerCert(target, certFingerprint || undefined, undefined, signedAt, true),
             resolveEntityOwner: (target, type) => this._resolveEntityAgentMdOwner(target, type),
             fetchEntityIdentity: (target, type) => this._freshEntityCertificate(target, type),
             fetchEntitySigner: (target, fingerprint) => this._freshEntitySigner(target, fingerprint),
@@ -1175,6 +1176,7 @@ export class AUNClient {
         this._transport.setServiceEventVerifier((event, payload) => verifyServiceEvent(event, payload, { targetAid: this._identity?.aid ?? '', resolveEventCertificate: (aid, fingerprint) => this._fetchServiceEventCertificate(aid, fingerprint), resolveCredentialService: this.resolveCredentialService }), () => this._identity?.aid ?? '', () => this._serviceEventIdentityVersion);
         this._transport.setProtocolDisconnectCallback((err, closeCode) => this._handleTransportDisconnect(err, closeCode));
         this._transport._onForegroundDrained = () => this._delivery.onForegroundPullsDrained();
+        this._transport._onRpcResponse = () => this._delivery.requestBackgroundPullRecovery();
     }
     loadIdentity(aid) {
         const previousAid = this._aid;
@@ -1333,6 +1335,9 @@ export class AUNClient {
             const loaded = store.load(groupAid);
             if (!loaded.ok || !loaded.data?.aid?.isPrivateKeyValid())
                 return false;
+            const groupManager = store._agentMdManager ?? this._agentMdManager;
+            if (String((groupManager._loadRecord?.(groupAid, true) ?? groupManager.loadRecord(groupAid))?.local_draft_content ?? ''))
+                return false;
             await this._runGroupIdentityOperation(groupAid, () => this._uploadGroupAgentMd(store, groupAid, {}, {}));
             return true;
         }
@@ -1349,7 +1354,7 @@ export class AUNClient {
         if (!aid || !this._currentAid)
             return false;
         const observed = await this._getOwnershipFiles().readAgent(aid);
-        if (observed.exists)
+        if (observed.exists || String(this._agentMdManager._loadRecord?.(aid, true)?.local_draft_content ?? this._agentMdManager.loadRecord(aid)?.local_draft_content ?? ''))
             return false;
         let agentMd = buildDefaultAgentMd(aid, { type: this.getType() });
         try {
@@ -1412,6 +1417,11 @@ export class AUNClient {
                         await this.completeGroupTransfer({ group_id: groupId, group_aid: groupAid }, { aidStore: store });
                         return;
                     }
+                    const groupManager = store._agentMdManager ?? this._agentMdManager;
+                    if (String((groupManager._loadRecord?.(groupAid, true) ?? groupManager.loadRecord(groupAid))?.local_draft_content ?? '')) {
+                        await this._agentMdManager.check(groupAid);
+                        return;
+                    }
                     const loaded = store.load(groupAid);
                     if (!loaded.ok || !loaded.data?.aid?.isPrivateKeyValid()) {
                         await this.bindGroupAid({ group_id: groupId, group_aid: groupAid }, { aidStore: store });
@@ -1503,6 +1513,9 @@ export class AUNClient {
                     await this.completeOrgTransfer(transfer.source_params, { aidStore: store });
                     continue;
                 }
+                const orgManager = store._agentMdManager;
+                if (String((orgManager?._loadRecord?.(aid, true) ?? orgManager?.loadRecord?.(aid))?.local_draft_content ?? ''))
+                    continue;
                 const pending = store._agentMdManager.pendingUpload(aid);
                 if (!pending)
                     continue;
@@ -1522,20 +1535,29 @@ export class AUNClient {
         const transferId = String(params.transfer_id ?? '').trim();
         if (!store || !owner?.isPrivateKeyValid() || !orgAid || !transferId)
             throw new ValidationError('completeOrgTransfer requires aidStore, org_id, transfer_id and current accepting owner');
+        for (const field of ['previous_owner', 'new_owner']) {
+            const material = params[field];
+            if (!isJsonObject(material) || !isJsonObject(material.membership_binding) || !isJsonObject(material.terms) || field === 'previous_owner' && !isJsonObject(material.credential_template))
+                throw ownershipFailure('invalid', 'Org transfer requires both replacement membership bindings, terms and previous-owner credential');
+        }
         this._aidStore = store;
         const localStore = store._keystore;
         const tokenStore = store._tokenStore;
         const pendingKey = `org-transfer:${orgAid}:${transferId}`;
         const inputHash = crypto.createHash('sha256').update(canonicalJson(params)).digest('hex');
+        let pending = tokenStore.loadMetadata(orgAid)?.org_identity_transfer;
+        if (pending && (pending.transfer_id !== transferId || pending.owner_aid !== owner.aid || pending.input_hash !== inputHash))
+            throw ownershipFailure('conflict', 'pending Org transfer context changed');
         let keyPair = localStore.loadPendingGroupBind(pendingKey);
         if (!keyPair) {
+            if (pending)
+                throw ownershipFailure('persistence_unavailable', 'Org transfer private key checkpoint is unavailable');
             keyPair = new CryptoProvider().generateIdentity();
             localStore.savePendingGroupBind(pendingKey, keyPair);
         }
         const target = options.serviceAid ?? `org.${orgAid.slice(orgAid.indexOf('.') + 1)}`;
         const publicKey = crypto.createPublicKey({ key: Buffer.from(keyPair.public_key_der_b64, 'base64'), format: 'der', type: 'spki' }).export({ format: 'pem', type: 'spki' }).toString();
-        let pending = tokenStore.loadMetadata(orgAid)?.org_identity_transfer;
-        if (pending && (pending.transfer_id !== transferId || pending.owner_aid !== owner.aid || pending.public_key !== publicKey || pending.input_hash !== inputHash))
+        if (pending && pending.public_key !== publicKey)
             throw ownershipFailure('conflict', 'pending Org transfer context changed');
         if (!pending) {
             const rekey = { ...params, stage: 'rekey', public_key: publicKey, curve: 'P-256' };
@@ -1584,8 +1606,8 @@ export class AUNClient {
         }
         const result = await this.call('org.lifecycle.transferAccept', pending.finalize_params);
         await this._uploadOrgAgentMd(store, orgAid, pending.source_params);
-        localStore.clearPendingGroupBind(pendingKey);
         tokenStore.saveMetadata(orgAid, { org_identity_transfer: null });
+        localStore.clearPendingGroupBind(pendingKey);
         return result;
     }
     async dissolveOrg(params = {}, options = {}) {
@@ -2443,7 +2465,8 @@ export class AUNClient {
                 return;
             this._readStateCache.set(key, { method, params: query, state: { ...eventData } });
         }
-        this._dispatcher.enqueue(scope === 'group' ? 'group.read_changed' : 'message.read_changed', eventData);
+        const identity = this._ensureReadStateIdentity();
+        this._dispatcher.enqueue(scope === 'group' ? 'group.read_changed' : 'message.read_changed', eventData, () => identity === this._ensureReadStateIdentity());
     }
     async _reconcileReadStates() {
         const identity = this._ensureReadStateIdentity();
@@ -2475,7 +2498,7 @@ export class AUNClient {
             owner_aid: this._aid ?? '',
             states: [...keys].map((key) => ({ ...this._readStateCache.get(key).state })),
             errors,
-        });
+        }, () => identity === this._ensureReadStateIdentity());
     }
     async _callRawV2Rpc(method, params, pullGateKey = '') {
         const p = { ...(params ?? {}) };
@@ -3015,8 +3038,13 @@ export class AUNClient {
         try {
             if (opts.signedAt === undefined)
                 await this._auth.verifyPeerCertificate(peerGatewayUrl, certPem, aid);
-            else
+            else if (opts.agentMdRead) {
+                validateAgentMdCertificate(certPem, aid, opts.signedAt, { requireCurrentValidity: false, readCompatibility: true });
+                await this._auth._verifyAuthCertChain(peerGatewayUrl, new crypto.X509Certificate(certPem), aid, opts.signedAt);
+            }
+            else {
                 await this._auth.verifyPeerCertificate(peerGatewayUrl, certPem, aid, opts.signedAt);
+            }
         }
         catch (exc) {
             if (cachedBootstrapChain) {
@@ -3030,7 +3058,7 @@ export class AUNClient {
             validatedAt: nowSec,
             refreshAfter: nowSec + PEER_CERT_CACHE_TTL,
         };
-        const cacheKey = AUNClient._certCacheKey(aid, certFingerprint) + (opts.signedAt === undefined ? '' : `:signed:${opts.signedAt}`);
+        const cacheKey = AUNClient._certCacheKey(aid, certFingerprint) + (opts.signedAt === undefined ? '' : `:signed:${opts.signedAt}${opts.agentMdRead ? ':agentmd' : ''}`);
         this._certCache.set(cacheKey, entry);
         if (!certFingerprint && opts.signedAt === undefined) {
             const bareKey = AUNClient._certCacheKey(aid);
@@ -3040,7 +3068,7 @@ export class AUNClient {
         }
         try {
             // peer 证书只存版本目录，不覆盖 cert.pem
-            this._tokenStore.saveCert(aid, certPem, certFingerprint, { makeActive: false });
+            this._tokenStore.saveCert(aid, certPem, opts.agentMdRead && opts.signedAt !== undefined ? `sha256:${x509Cert.fingerprint256.replace(/:/g, '').toLowerCase()}` : certFingerprint, { makeActive: false });
         }
         catch (exc) {
             this._clientLog.error(`failed to write cert to keystore (aid=${aid}, fp=${certFingerprint ?? ''}): ${formatCaughtError(exc)}`, exc instanceof Error ? exc : undefined);
@@ -3055,11 +3083,11 @@ export class AUNClient {
         return certificate;
     }
     /** 获取对方证书（带缓存 + 完整 PKI 验证），跨域时自动路由到 peer 所在域。 */
-    async _fetchPeerCert(aid, certFingerprint, timeoutMs = 30_000, signedAt) {
+    async _fetchPeerCert(aid, certFingerprint, timeoutMs = 30_000, signedAt, agentMdRead = false) {
         const tStart = Date.now();
         this._clientLog.debug(`_fetchPeerCert enter: aid=${aid}, fp=${certFingerprint ?? ''}`);
         try {
-            const cacheKey = AUNClient._certCacheKey(aid, certFingerprint) + (signedAt === undefined ? '' : `:signed:${signedAt}`);
+            const cacheKey = AUNClient._certCacheKey(aid, certFingerprint) + (signedAt === undefined ? '' : `:signed:${signedAt}${agentMdRead ? ':agentmd' : ''}`);
             const cached = this._certCache.get(cacheKey);
             const now = Date.now() / 1000;
             if (cached && now < cached.refreshAfter) {
@@ -3078,6 +3106,7 @@ export class AUNClient {
                 certFingerprint,
                 source: 'fetch',
                 signedAt,
+                agentMdRead,
             });
             this._clientLog.debug(`_fetchPeerCert exit: elapsed=${Date.now() - tStart}ms aid=${aid} (fetched)`);
             return validated;