@agentunion/fastaun 0.5.19 → 0.5.21

package/dist/aid-store.js

@@ -7,9 +7,10 @@ import * as https from 'node:https';
 import { X509Certificate, createPrivateKey, createPublicKey, randomUUID } from 'node:crypto';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
+import { readFileSync, writeFileSync } from 'node:fs';
 import { AID } from './aid.js';
 import * as codes from './error-codes.js';
-import { certCommonName, certMatchesFingerprint, certTimeError, signBytes, verifySignatureWithCert } from './cert-utils.js';
+import { certCommonName, certMatchesFingerprint, certTimeError, parseAgentMdTailSignature, publicKeyMatchesFingerprint, signBytes, signDocument, verifyDocument, verifySignatureWithCert } from './cert-utils.js';
 import { certFingerprint as _certFingerprint } from './cert-utils.js';
 import { resultErr, resultOk } from './result.js';
 import { LocalIdentityStore } from './keystore/local-identity-store.js';
@@ -21,10 +22,10 @@ import { AUNLogger } from './logger.js';
 import { getDeviceId, normalizeSlotId } from './config.js';
 import { AUNError, ClientSignatureError, IdentityConflictError, NotFoundError, ValidationError } from './errors.js';
 import { AgentMdManager, buildDefaultAgentMd } from './agent-md.js';
-import { validateAgentMdDocument } from './agent-md-schema.js';
+import { parseFileFrontmatter, validateAgentMdCertificate, validateAgentMdDocument, validateAgentMdReadDocument } from './agent-md-schema.js';
 import { LocalTokenStore } from './keystore/local-token-store.js';
 import { AuthFlow } from './auth.js';
-import { OWNERSHIP_UUID_V4_RE, ownershipFailure, signOwnershipFile } from './ownership-v21.js';
+import { OWNERSHIP_UUID_V4_RE, ownershipFailure } from './ownership-v21.js';
 import { validateAIDFormat } from './validators.js';
 function resultError(r) {
     if (r.ok)
@@ -96,6 +97,114 @@ export class AIDStore {
     _gatewayCache = new Map();
     _agentMdManager;
     _peerAuth;
+    async sign(aid, input, options = {}) {
+        try {
+            if (!['text', 'file'].includes(options.inputType ?? 'text') || !['raw', 'document'].includes(options.format ?? 'raw'))
+                throw new Error('invalid signature inputType or format');
+            if (options.append && options.format !== 'document')
+                throw new Error('append requires document format');
+            if (options.inPlace && (options.inputType !== 'file' || options.format !== 'document'))
+                throw new Error('inPlace requires file input and document format');
+            const raw = options.inputType === 'file' ? readFileSync(input) : input;
+            if (typeof raw === 'string' && options.format !== 'document' && new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(new TextEncoder().encode(raw)) !== raw)
+                throw new Error('signature text must be valid UTF-8');
+            const loaded = options.identity ? resultOk({ aid: options.identity }) : this.load(aid);
+            if (!loaded.ok)
+                return loaded;
+            const identity = loaded.data.aid;
+            if (identity.aid !== aid || identity.certSubject.toLowerCase() !== aid.toLowerCase() || !identity.isPrivateKeyValid() || !identity.isCertValid())
+                return resultErr(codes.PRIVATE_KEY_NOT_VALID, 'sign requires a valid local signing identity');
+            if (options.format !== 'document')
+                return identity.sign(raw);
+            const content = typeof raw === 'string' ? raw : new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(raw);
+            const signed = signDocument(identity, content, { append: options.append, tag: options.tag, timestamp: options.timestamp, signerAid: options.signerAid });
+            if (options.inPlace)
+                writeFileSync(input, signed.signed, 'utf8');
+            return resultOk(signed);
+        }
+        catch (error) {
+            return resultErr(codes.SIGNATURE_OPERATION_ERROR, error instanceof Error ? error.message : String(error), error);
+        }
+    }
+    async verify(aid, input, signatureOrOptions, options = {}) {
+        const signature = typeof signatureOrOptions === 'string' ? signatureOrOptions : undefined;
+        if (signatureOrOptions && typeof signatureOrOptions === 'object')
+            options = signatureOrOptions;
+        try {
+            if (!['text', 'file'].includes(options.inputType ?? 'text') || !['raw', 'document'].includes(options.format ?? 'raw'))
+                throw new Error('invalid signature inputType or format');
+            if (options.inPlace)
+                throw new Error('verify does not modify files');
+            if (options.identity && (options.identity.aid !== aid || options.identity.certSubject.toLowerCase() !== aid.toLowerCase()))
+                throw new Error('verification identity does not match AID');
+            const raw = options.inputType === 'file' ? readFileSync(input) : input;
+            if (typeof raw === 'string' && options.format !== 'document' && new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(new TextEncoder().encode(raw)) !== raw)
+                throw new Error('signature text must be valid UTF-8');
+            if (options.format === 'document') {
+                const text = typeof raw === 'string' ? raw : new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(raw);
+                const parsed = parseAgentMdTailSignature(text, options.readCompatibility);
+                if (parsed.parseError || !parsed.fields)
+                    return resultOk(verifyDocument(text, { expectedAid: aid, readCompatibility: options.readCompatibility }));
+            }
+            let loaded = options.identity ? resultOk({ aid: options.identity }) : this.load(aid);
+            if (!loaded.ok && options.format === 'document' && options.certificateResolver) {
+                const text = typeof raw === 'string' ? raw : new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(raw);
+                const primary = parseAgentMdTailSignature(text, options.readCompatibility).fields;
+                if (primary) {
+                    const certificate = await options.certificateResolver(aid, primary.cert_fingerprint, Number(primary.timestamp));
+                    loaded = resultOk({ aid: typeof certificate === 'string' ? AID._create({ aid, aunPath: this.aunPath, certPem: certificate, certValid: true, privateKeyPem: null, privateKeyValid: false }) : certificate });
+                }
+            }
+            if (!loaded.ok)
+                return loaded;
+            const identity = loaded.data.aid;
+            if (identity.aid !== aid || identity.certSubject.toLowerCase() !== aid.toLowerCase())
+                throw new Error('verification identity does not match AID');
+            if (options.format !== 'document')
+                return identity.verify(raw, signature ?? '');
+            const content = typeof raw === 'string' ? raw : new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(raw);
+            const certificates = await this._documentCertificates(content, options, identity);
+            const primary = parseAgentMdTailSignature(content, options.readCompatibility).fields;
+            const primaryCertPem = primary ? certificates.get(`${aid};${primary.cert_fingerprint}`) ?? identity.certPem : identity.certPem;
+            return resultOk(verifyDocument(content, { expectedAid: aid, primaryCertPem, readCompatibility: options.readCompatibility, requireCurrentValidity: options.requireCurrentValidity, certificateResolver: (signer, fingerprint) => certificates.get(`${signer};${fingerprint}`) }));
+        }
+        catch (error) {
+            return resultErr(codes.VERIFICATION_OPERATION_ERROR, error instanceof Error ? error.message : String(error), error);
+        }
+    }
+    async _documentCertificates(content, options, primary) {
+        const certificates = new Map();
+        let inferredAid = primary?.aid;
+        if (!inferredAid) {
+            try {
+                const meta = parseFileFrontmatter(parseAgentMdTailSignature(content).payload);
+                inferredAid = String(meta.aid ?? meta.owner_aid ?? '') || undefined;
+            }
+            catch { }
+        }
+        for (const item of parseAgentMdTailSignature(content, options.readCompatibility).signatures) {
+            const fields = item.fields, signer = fields.signer_aid ?? inferredAid;
+            if (!signer)
+                continue;
+            let cert;
+            if (options.certificateResolver)
+                cert = await options.certificateResolver(signer, fields.cert_fingerprint, Number(fields.timestamp));
+            else if (primary?.aid === signer && certMatchesFingerprint(primary.certPem, fields.cert_fingerprint))
+                cert = primary;
+            else {
+                const loaded = this.load(signer);
+                if (loaded.ok && certMatchesFingerprint(loaded.data.aid.certPem, fields.cert_fingerprint))
+                    cert = loaded.data.aid;
+                else
+                    throw new Error('signing certificate is unavailable locally; an explicit certificateResolver is required');
+            }
+            if (cert && typeof cert !== 'string' && cert.aid !== signer)
+                throw new Error('resolved certificate identity does not match signer AID');
+            if (cert)
+                certificates.set(`${signer};${fields.cert_fingerprint}`, typeof cert === 'string' ? cert : cert.certPem);
+        }
+        return certificates;
+    }
     constructor(opts) {
         this.aunPath = String(opts.aunPath ?? join(homedir(), '.aun'));
         this._encryptionSeed = String(opts.encryptionSeed ?? '');
@@ -148,28 +257,7 @@ export class AIDStore {
                 const material = await this._peerAuth.resolveCurrentEntityCertificate(await this._resolveGateway(target), target, type ?? 'org');
                 return AID._create({ aid: target, aunPath: this.aunPath, certPem: material.cert_pem, privateKeyPem: null, certValid: true, privateKeyValid: false });
             },
-            peerResolver: async (target, certFingerprint, signedAt) => {
-                const fp = String(certFingerprint ?? '').trim().toLowerCase();
-                const cachedCert = this._keystore.loadCert(target, fp || undefined);
-                if (cachedCert) {
-                    return AID._create({ aid: target, aunPath: this.aunPath, certPem: cachedCert, privateKeyPem: null, certValid: true, privateKeyValid: false, deviceId: this.deviceId, slotId: this.slotId, verifySsl: this._verifySsl, rootCaPath: this._rootCaPath, debug: this._debug });
-                }
-                if (fp) {
-                    const gatewayUrl = await this._resolveGateway(target);
-                    const certPem = await this._net.httpGetText(pkiCertUrl(gatewayUrl, target, fp), 10_000);
-                    await this._verifyDownloadedPeerCertificate(gatewayUrl, target, certPem, fp, signedAt);
-                    this._keystore.saveCert(target, certPem, fp, { makeActive: false });
-                    return AID._create({ aid: target, aunPath: this.aunPath, certPem, privateKeyPem: null, certValid: true, privateKeyValid: false });
-                }
-                const gatewayUrl = await this._resolveGateway(target);
-                const certPem = await this._registerFlow.fetchPeerCert(gatewayUrl, target);
-                if (!certPem) {
-                    throw new Error(`certificate not found for aid: ${target}`);
-                }
-                await this._verifyDownloadedPeerCertificate(gatewayUrl, target, certPem, undefined, signedAt);
-                this._keystore.saveCert(target, certPem);
-                return AID._create({ aid: target, aunPath: this.aunPath, certPem, privateKeyPem: null, certValid: true, privateKeyValid: false });
-            },
+            peerResolver: (target, certFingerprint, signedAt) => this._resolveAgentMdPeerCertificate(target, certFingerprint, signedAt),
         });
     }
     close() {
@@ -179,6 +267,29 @@ export class AIDStore {
         if (typeof net.close === 'function')
             net.close();
     }
+    async _resolveAgentMdPeerCertificate(target, certFingerprint, signedAt) {
+        const fp = String(certFingerprint ?? '').trim().toLowerCase();
+        const cachedCert = this._keystore.loadCert(target, fp || undefined);
+        if (cachedCert && (!fp || certMatchesFingerprint(cachedCert, fp) || publicKeyMatchesFingerprint(cachedCert, fp))) {
+            if (signedAt !== undefined)
+                await this._verifyDownloadedPeerCertificate(await this._resolveGateway(target), target, cachedCert, fp, signedAt);
+            return AID._create({ aid: target, aunPath: this.aunPath, certPem: cachedCert, privateKeyPem: null, certValid: true, privateKeyValid: false, deviceId: this.deviceId, slotId: this.slotId, verifySsl: this._verifySsl, rootCaPath: this._rootCaPath, debug: this._debug });
+        }
+        if (fp) {
+            const gatewayUrl = await this._resolveGateway(target);
+            const certPem = await this._net.httpGetText(pkiCertUrl(gatewayUrl, target, fp), 10_000);
+            await this._verifyDownloadedPeerCertificate(gatewayUrl, target, certPem, fp, signedAt);
+            this._keystore.saveCert(target, certPem, _certFingerprint(certPem), { makeActive: false });
+            return AID._create({ aid: target, aunPath: this.aunPath, certPem, privateKeyPem: null, certValid: true, privateKeyValid: false });
+        }
+        const gatewayUrl = await this._resolveGateway(target);
+        const certPem = await this._registerFlow.fetchPeerCert(gatewayUrl, target);
+        if (!certPem)
+            throw new Error(`certificate not found for aid: ${target}`);
+        await this._verifyDownloadedPeerCertificate(gatewayUrl, target, certPem, undefined, signedAt);
+        this._keystore.saveCert(target, certPem);
+        return AID._create({ aid: target, aunPath: this.aunPath, certPem, privateKeyPem: null, certValid: true, privateKeyValid: false });
+    }
     // ── 离线方法 ──────────────────────────────────────────────────
     load(aid) {
         const target = String(aid ?? '').trim();
@@ -287,6 +398,7 @@ export class AIDStore {
             return resultErr(codes.PRIVATE_KEY_PARSE_ERROR, 'newSeed must differ from oldSeed');
         try {
             const result = this._keystore.changeSeed(oldSeed, newSeed);
+            this._tokenStore['_setEncryptionSeed'](newSeed);
             this._encryptionSeed = newSeed;
             return resultOk({ changed: true, count: result.migrated ?? 0 });
         }
@@ -307,8 +419,8 @@ export class AIDStore {
             const entity = ['group', 'org'].includes(type);
             if (entity && !owner)
                 throw new ValidationError('group/org registration requires owner');
-            if (!type || type === 'human' && owner || type === 'agent' && !owner)
-                throw new ValidationError('register requires type; human forbids owner; agent requires owner');
+            if (!type || type === 'human' && owner)
+                throw new ValidationError('register requires type; human forbids owner');
             if (owner)
                 validateAIDFormat(owner, 'owner');
             const previous = this._tokenStore.loadMetadata(target)?.registration_intent;
@@ -318,7 +430,8 @@ export class AIDStore {
             if (previous && (previous.type !== type || previous.owner !== owner || previous.exttype !== exttype))
                 throw new IdentityConflictError('registration ownership intent already exists with a different context');
             const intent = previous ?? (entity ? { protocol: 'entity', type, owner, exttype, pending: false } : { protocol: '2.1', type, owner, exttype, operation_id: randomUUID(), pending: Boolean(owner) });
-            this._tokenStore.saveMetadata(target, { registration_intent: intent });
+            if (type !== 'agent' || owner)
+                this._tokenStore.saveMetadata(target, { registration_intent: intent });
             const gatewayUrl = await this._resolveGateway(target);
             const result = await this._registerFlow.registerAid(gatewayUrl, target);
             if (result.cert) {
@@ -360,15 +473,10 @@ export class AIDStore {
                 accessTokenResolver: async () => this._uploadAgentMdToken(current, await this._resolveGateway(target)),
                 aidValidator: (value) => this._registerFlow.validateAidName(value),
             });
-            const fresh = await manager.readOwnershipFresh(target), now = Math.trunc(Date.now() / 1000);
-            if (fresh.protocol !== '2.1' || fresh.sub_aid !== target || !Number.isSafeInteger(fresh.relation_version) || fresh.relation_version < 0 || !['locked', 'unlocked'].includes(fresh.lock) || !Number.isSafeInteger(fresh.observed_at) || fresh.observed_at < now - 30 || fresh.observed_at > now + 5)
-                throw ownershipFailure('unavailable', 'initial NS authority is unavailable', true);
+            const fresh = await manager.readAgentMdFresh(target);
             if (fresh.exists)
                 return resultOk({ initialized: false });
-            if (fresh.relation_version !== 0 || fresh.lock !== 'unlocked')
-                throw ownershipFailure('conflict', 'initial NS relation is not unbound');
-            const raw = signOwnershipFile(current, buildDefaultAgentMd(target, { type, exttype }), 'agent', { now });
-            await manager.submitOwnershipRaw(target, raw, { if_none_match: '*' });
+            await manager.upload(buildDefaultAgentMd(target, { type, exttype }), { if_none_match: '*' });
             return resultOk({ initialized: true });
         }
         catch (error) {
@@ -401,6 +509,19 @@ export class AIDStore {
             let peer;
             let certFromCache = false;
             const loaded = this.load(target);
+            const local = !forceRefresh && !skipAgentMd && ((loaded.ok && loaded.data?.aid.isPrivateKeyValid()) || this._keystore.loadKeyPair(target)?.private_key_pem) ? (this._agentMdManager._loadRecord?.(target, true) ?? this._agentMdManager.loadRecord(target)) : null;
+            const draft = String(local?.local_draft_content ?? '');
+            const content = draft || String(local?.content ?? '');
+            if (content) {
+                peer = loaded.ok && loaded.data ? loaded.data.aid : AID._create({ aid: target, aunPath: this.aunPath, certPem: this._keystore.loadCert(target) ?? '', privateKeyPem: null, certValid: false, privateKeyValid: false, deviceId: this.deviceId, slotId: this.slotId, verifySsl: this._verifySsl, rootCaPath: this._rootCaPath, debug: this._debug, aidStore: this });
+                const localEtag = AgentMdManager.contentEtag(content), remoteEtag = String(local?.remote_etag ?? '');
+                return await this._resolveOwnership({ aid: peer, source: { cert_from_cache: true, agent_md_fetched: false }, agent_md: {
+                        aid: target, content, frontmatter: validateAgentMdReadDocument(content).frontmatter, verification: { status: 'unverified' }, signature: {}, cert_pem: '',
+                        etag: localEtag, last_modified: String(local?.last_modified ?? ''), status: 200,
+                        in_sync: !draft && !!remoteEtag && localEtag === remoteEtag,
+                        saved_to: draft ? this._agentMdManager.metaPath(target) : this._agentMdManager.filePath(target), save_error: null,
+                    } }, opts);
+            }
             if (loaded.ok && loaded.data && !forceRefresh) {
                 peer = loaded.data.aid;
                 certFromCache = true;
@@ -419,17 +540,42 @@ export class AIDStore {
             }
             const source = { cert_from_cache: certFromCache, agent_md_fetched: false };
             if (skipAgentMd)
-                return resultOk({ aid: peer, source });
+                return await this._resolveOwnership({ aid: peer, source }, opts);
             const agentMd = await this.downloadAgentMd(target, opts?.timeout ?? 10000);
             if (!agentMd.ok)
                 return agentMd;
             source.agent_md_fetched = true;
-            return resultOk({ aid: peer, agent_md: agentMd.data, source });
+            return await this._resolveOwnership({ aid: peer, agent_md: agentMd.data, source }, opts);
         }
         catch (exc) {
+            if (exc instanceof AUNError && exc.stringCode)
+                return resultErr(exc.stringCode, exc.message, exc);
             return resultErr(codes.NETWORK_ERROR, String(exc), exc);
         }
     }
+    async _resolveOwnership(data, opts) {
+        if (!opts?.ownership)
+            return resultOk(data);
+        const target = data.aid.aid;
+        try {
+            const cached = this._agentMdManager.loadRecord(target)?.ownership_snapshot;
+            const now = Date.now(), ttl = opts.ownershipTtlMs ?? 60_000;
+            const hash = data.agent_md ? AgentMdManager.contentEtag(data.agent_md.content).slice(1, -1) : '';
+            if (!opts.forceRefresh && cached?.sub_aid === target && cached.status !== 'unavailable' && now >= cached.checked_at && now - cached.checked_at < ttl && (!hash || cached.agent_md_sha256 === hash)) {
+                data.ownership = { ...JSON.parse(JSON.stringify(cached)), cached: true };
+            }
+            else {
+                const checked = await opts.ownership.checkOwnershipConsensus(target);
+                data.ownership = { ...JSON.parse(JSON.stringify(checked)), checked_at: Date.now(), cached: false };
+                this._agentMdManager.saveRecord(target, { ownership_snapshot: JSON.parse(JSON.stringify(data.ownership)) });
+            }
+        }
+        catch (error) {
+            data.ownership = { status: 'unavailable', sub_aid: target, owner_aid: null, relation_version: 0, lock: 'unlocked', agent_md_etag: '', agent_md_sha256: '', owner_md_sha256: '', code: 'unavailable', reason: error instanceof Error ? error.message : String(error), retryable: true, checked_at: Date.now(), cached: false };
+            this._agentMdManager.saveRecord(target, { ownership_snapshot: data.ownership });
+        }
+        return resultOk(data);
+    }
     async downloadAgentMd(aid, timeoutMs = 30000) {
         try {
             return resultOk(await this._agentMdManager.download(aid, timeoutMs));
@@ -448,13 +594,15 @@ export class AIDStore {
     }
     async _verifyDownloadedPeerCertificate(gatewayUrl, aid, certPem, certFingerprint = '', signedAt) {
         const expectedFp = String(certFingerprint ?? '').trim().toLowerCase();
-        if (expectedFp && !certMatchesFingerprint(certPem, expectedFp)) {
+        if (expectedFp && !certMatchesFingerprint(certPem, expectedFp) && !(signedAt !== undefined && publicKeyMatchesFingerprint(certPem, expectedFp))) {
             throw new ValidationError(`certificate fingerprint mismatch for aid: ${aid}`);
         }
         if (signedAt === undefined)
             await this._peerAuth.verifyPeerCertificate(gatewayUrl, certPem, aid);
-        else
-            await this._peerAuth.verifyPeerCertificate(gatewayUrl, certPem, aid, signedAt);
+        else {
+            validateAgentMdCertificate(certPem, aid, signedAt, { requireCurrentValidity: false, readCompatibility: true });
+            await this._peerAuth._verifyAuthCertChain(gatewayUrl, new X509Certificate(certPem), aid, signedAt);
+        }
     }
     _authIdentityFromAid(aid) {
         return {
@@ -493,8 +641,9 @@ export class AIDStore {
                 return resultErr(err?.code ?? codes.CERT_NOT_FOUND, err?.message ?? `certificate not found for aid: ${target}`);
             }
             const current = loaded.data.aid;
-            const raw = content ?? this._agentMdManager.readContent(target);
-            const parsed = validateAgentMdDocument(raw, { expectedAid: target });
+            const pending = content === undefined || content === null ? this._agentMdManager.pendingUpload(target) : null;
+            const raw = pending?.content ?? content ?? (String((this._agentMdManager._loadRecord?.(target, true) ?? this._agentMdManager.loadRecord(target))?.local_draft_content ?? '') || this._agentMdManager.readContent(target));
+            const parsed = validateAgentMdDocument(raw, { expectedAid: target, validateOwnership: false });
             const meta = parsed.frontmatter;
             const entity = ['group', 'org'].includes(String(meta.type));
             const uploaderTarget = String(options.uploaderAid ?? options.uploader_aid ?? (entity ? meta.owner : target)).trim();
@@ -511,7 +660,7 @@ export class AIDStore {
                     return resultErr(codes.PRIVATE_KEY_NOT_VALID, `uploadAgentMd requires uploader AID with a valid private key: ${uploaderTarget}`);
                 }
             }
-            if ((!current.isPrivateKeyValid() || !current.privateKeyPem) && !(entity && parsed.signature && uploaderTarget.toLowerCase() !== target.toLowerCase())) {
+            if (!entity && (!current.isPrivateKeyValid() || !current.privateKeyPem)) {
                 return resultErr(codes.PRIVATE_KEY_NOT_VALID, `uploadAgentMd requires local AID with a valid private key: ${target}`);
             }
             const manager = new AgentMdManager({
@@ -532,11 +681,32 @@ export class AIDStore {
                     return AID._create({ aid: value, aunPath: this.aunPath, certPem: material.cert_pem, certValid: true, privateKeyPem: null, privateKeyValid: false });
                 },
                 entityOwnerResolver: options.entityOwnerResolver,
+                peerResolver: (value, fingerprint, signedAt) => this._resolveAgentMdPeerCertificate(value, fingerprint, signedAt),
                 gatewayResolver: (value) => this._resolveGateway(value),
                 accessTokenResolver: async () => this._uploadAgentMdToken(uploader, await this._resolveGateway(uploaderTarget)),
                 aidValidator: (value) => this._registerFlow.validateAidName(value),
             });
-            return resultOk(entity ? await manager.uploadAs(target, raw, current) : await manager.upload(raw));
+            if (pending) {
+                await manager.resumePendingUpload(target, current);
+                const record = manager.loadRecord(target);
+                return resultOk({ aid: target, etag: String(record?.remote_etag ?? ''), last_modified: String(record?.last_modified ?? '') });
+            }
+            let prepared = raw;
+            if (entity && !parsed.signature) {
+                const signed = await this.sign(target, raw, { format: 'document', identity: current, signerAid: target });
+                if (!signed.ok)
+                    return signed;
+                prepared = signed.data.signed;
+            }
+            if (entity && options.coSignerAid) {
+                if (options.coSignerAid !== uploaderTarget)
+                    throw new ValidationError('entity additional signer must be its uploading owner');
+                const signed = await this.sign(options.coSignerAid, prepared, { format: 'document', append: true, identity: uploader });
+                if (!signed.ok)
+                    return signed;
+                prepared = signed.data.signed;
+            }
+            return resultOk(entity ? await manager.uploadAs(target, prepared, current) : await manager.upload(raw));
         }
         catch (exc) {
             return agentMdFailure(exc);
@@ -587,6 +757,12 @@ export class AIDStore {
         });
     }
     async renewCert(aid) {
+        return this._renewCert(aid);
+    }
+    async _renewCert(aid, guard) {
+        const check = () => { if (guard && (!guard.current() || guard.signal?.aborted))
+            throw new Error('credential renewal was superseded'); };
+        check();
         const target = String(aid ?? '').trim();
         const loaded = this.load(target);
         if (!loaded.ok || !loaded.data || !loaded.data.aid.isPrivateKeyValid()) {
@@ -595,12 +771,15 @@ export class AIDStore {
         try {
             this._registerFlow.validateAidName(target);
             const gatewayUrl = await this._resolveGateway(target);
+            check();
             const aidObj = loaded.data.aid;
             const clientNonce = this._registerFlow.newClientNonce();
             const phase1 = await this._registerFlow.shortRpc(gatewayUrl, 'auth.aid_login1', {
                 aid: target, cert: aidObj.certPem, client_nonce: clientNonce,
             });
+            check();
             await this._registerFlow.verifyPhase1Response(gatewayUrl, phase1, clientNonce);
+            check();
             const signResult = aidObj.sign(String(phase1.nonce));
             if (!signResult.ok || !signResult.data) {
                 return resultErr(codes.CERT_RENEWAL_FAILED, resultError(signResult)?.message ?? 'sign failed');
@@ -611,6 +790,7 @@ export class AIDStore {
             const certPem = String(response.cert ?? response.cert_pem ?? '').trim();
             if (!certPem)
                 return resultErr(codes.CERT_RENEWAL_FAILED, 'server response missing certificate');
+            check();
             this._keystore.saveCert(target, certPem);
             const refreshed = this.load(target);
             if (!refreshed.ok || !refreshed.data)