@agentunion/fastaun 0.5.21 → 0.5.23

package/dist/client.d.ts

@@ -90,6 +90,7 @@ export declare class AUNClient {
     private _ownershipWorkflow;
     private _getOwnershipStorage;
     private _getOwnershipFiles;
+    private _createOwnershipFiles;
     private _getOwnershipWorkflow;
     private _persistOwnershipRecords;
     private _restoreOwnershipRecords;
@@ -98,6 +99,7 @@ export declare class AUNClient {
     private _credentialRenewalTimer;
     private _credentialRenewalAbort;
     private _credentialRenewalScan;
+    private _nextCredentialRevocationSyncAt;
     private _getCredentialRenewal;
     _assertCredentialNotRevoked(credential: JsonObject, proofChain?: JsonObject[]): () => void;
     private _credentialRenewalSigner;
@@ -274,6 +276,7 @@ export declare class AUNClient {
     releaseSubaid(subAid: string): Promise<OwnershipTaskResult>;
     transferSubaid(subAid: string, newOwnerAid: string): Promise<OwnershipTaskResult>;
     checkOwnershipConsensus(subAid?: string): Promise<OwnershipConsensusResult>;
+    private _checkOwnershipConsensusFresh;
     bindAid(subjectAid: string, options?: {
         subjectType?: string;
         subject_type?: string;

package/dist/client.js

@@ -48,7 +48,7 @@ import { isJsonObject, ConnectionState, STATE_TO_PUBLIC, } from './types.js';
 import { AID } from './aid.js';
 import { certFingerprint, certMatchesFingerprint, normalizeFingerprintHex, publicKeyMatchesFingerprint } from './cert-utils.js';
 import { validateAgentMdCertificate, validateAgentMdDocument } from './agent-md-schema.js';
-import { OwnershipFiles, OwnershipStorageAdapter, ownershipFailure } from './ownership-v21.js';
+import { OwnershipFiles, OwnershipStorageAdapter, ownershipAid, ownershipFailure } from './ownership-v21.js';
 import { OwnershipWorkflow } from './ownership-workflow.js';
 import { canonicalJson, createCredential, createMemberCredential, signMembershipBinding, digest, validateMembershipBinding, verifyMembershipBinding, verifyCredentialSignature, createRepresentationProof, verifyServiceEvent, buildRequestBinding, validateRequestBinding, CredentialRenewal } from './org-protocol.js';
 function isPromiseLike(value) {
@@ -489,16 +489,19 @@ export class AUNClient {
         return this._ownershipStorage ??= new OwnershipStorageAdapter({ currentAid: () => this._aid, call: (method, params) => this.call(method, params), httpPut: (url, data, headers) => this.storage.lowlevel.httpPut(url, data, headers) });
     }
     _getOwnershipFiles() {
-        return this._ownershipFiles ??= new OwnershipFiles({
+        return this._ownershipFiles ??= this._createOwnershipFiles((subAid) => this._agentMdManager.readOwnershipFresh(subAid));
+    }
+    _createOwnershipFiles(readAgentMdFresh) {
+        return new OwnershipFiles({
             currentAid: () => { if (!this._currentAid)
                 throw ownershipFailure('forbidden', 'ownership requires a loaded identity'); return this._currentAid; },
             currentType: () => this.getType(),
             now: () => Math.trunc(Date.now() / 1000),
-            readAgentMdFresh: (subAid) => this._agentMdManager.readOwnershipFresh(subAid),
-            submitAgentMdRaw: (subAid, raw, condition, assertActive) => this._agentMdManager.submitOwnershipRaw(subAid, raw, condition, assertActive),
+            readAgentMdFresh,
+            submitAgentMdRaw: (subAid, raw, condition, assertActive, stage) => this._agentMdManager.submitOwnershipRaw(subAid, raw, condition, assertActive, stage),
             readOwnerMd: (ownerAid, subAid) => this._getOwnershipStorage().readOwnerMd(ownerAid, subAid),
             writeOwnerMd: (ownerAid, subAid, raw, original, assertActive) => this._getOwnershipStorage().writeOwnerMd(ownerAid, subAid, raw, original, assertActive),
-            deleteOwnerMd: (ownerAid, subAid) => this._getOwnershipStorage().deleteOwnerMd(ownerAid, subAid),
+            deleteOwnerMd: (ownerAid, subAid, expectedVersion) => this._getOwnershipStorage().deleteOwnerMd(ownerAid, subAid, expectedVersion),
             resolveCertificate: async (aid, fingerprint, purpose) => this._auth.resolveOwnershipCertificate(await this._resolveOwnershipCertificateGateway(aid), aid, fingerprint, purpose),
         });
     }
@@ -506,7 +509,7 @@ export class AUNClient {
         return this._ownershipWorkflow ??= new OwnershipWorkflow({
             currentAid: () => this._aid, store: this._tokenStore, files: this._getOwnershipFiles(),
             currentType: () => this.getType(),
-            send: (to, payload) => this.call('message.send', { to, encrypt: true, payload: payload }),
+            send: (to, payload, messageId) => this.call('message.send', { to, encrypt: true, message_id: messageId, payload: payload }),
             emit: (event, payload) => this._dispatcher.enqueue(event, payload),
         });
     }
@@ -554,9 +557,11 @@ export class AUNClient {
     _credentialRenewalTimer = null;
     _credentialRenewalAbort = null;
     _credentialRenewalScan = Promise.resolve();
+    _nextCredentialRevocationSyncAt = 0;
     _getCredentialRenewal() {
         return this._credentialRenewal ??= new CredentialRenewal({
             currentAid: () => this._aid ?? '',
+            queryContext: () => JSON.stringify([this._serviceEventIdentityVersion, this._gatewayUrl, this._transport?._connectionGeneration, this._transport?._workerGeneration]),
             atomicCheckpointSave: () => this._tokenStore instanceof LocalTokenStore,
             load: (aid) => (this._tokenStore._loadMetadataStrict?.(aid) ?? this._tokenStore.loadMetadata?.(aid))?.credential_renewals_v1 ?? {},
             ...(typeof this._tokenStore._loadMetadataStrict === 'function' ? {
@@ -630,6 +635,7 @@ export class AUNClient {
             if (aid === this._aid && this._identity) {
                 this._identity.cert = identity.certPem;
                 this._currentAid = identity;
+                this._auth.setIdentity(this._identity);
             }
         }
         return identity;
@@ -647,11 +653,11 @@ export class AUNClient {
     _credentialCurrent(input) {
         return this._getCredentialRenewal().current(input);
     }
-    async _resumeCredentialRenewalAfterConnect(guard) {
+    async _resumeCredentialRenewalAfterConnect(guard, syncRevocations = false) {
         if (!this._aid || (guard && !guard.current()))
             return;
         await this._safeAsync(guard ? this._credentialRenewalSigner(this._aid, guard) : this._credentialRenewalSigner(this._aid));
-        if (!guard || guard.current())
+        if (syncRevocations && (!guard || guard.current()))
             await this._safeAsync(this._getCredentialRenewal()._syncRevocations?.(guard) ?? Promise.resolve());
         if (!guard || guard.current())
             await this._getCredentialRenewal().resume(guard);
@@ -665,11 +671,15 @@ export class AUNClient {
         this._credentialRenewalAbort = abort;
         const current = () => this._credentialRenewalAbort === abort && !abort.signal.aborted && aid === this._aid && version === this._serviceEventIdentityVersion && ['ready', 'connected'].includes(this._state) && !this._closing && !this._disconnecting;
         const guard = { current, signal: abort.signal };
+        this._nextCredentialRevocationSyncAt ||= Date.now() + 3_600_000;
         const scan = async () => {
             const task = this._credentialRenewalScan.then(async () => {
                 if (!current())
                     return;
-                await this._resumeCredentialRenewalAfterConnect(guard);
+                const syncRevocations = Date.now() >= this._nextCredentialRevocationSyncAt;
+                if (syncRevocations)
+                    this._nextCredentialRevocationSyncAt = Date.now() + 3_600_000;
+                await this._resumeCredentialRenewalAfterConnect(guard, syncRevocations);
             });
             this._credentialRenewalScan = task.catch(() => { });
             await this._safeAsync(task);
@@ -701,10 +711,18 @@ export class AUNClient {
         const version = this._serviceEventIdentityVersion;
         const signal = this._serviceEventIdentityAbort.signal;
         const expiresAt = Number(payload?.expires_at);
-        const current = () => version === this._serviceEventIdentityVersion && targetAid === (this._identity?.aid ?? '') && Date.now() / 1000 < expiresAt;
+        const transport = this._transport, connectionGeneration = transport?._connectionGeneration, workerGeneration = transport?._workerGeneration;
+        const current = () => version === this._serviceEventIdentityVersion && targetAid === (this._identity?.aid ?? '') && transport === this._transport && connectionGeneration === this._transport?._connectionGeneration && workerGeneration === this._transport?._workerGeneration && Date.now() / 1000 < expiresAt;
         const verified = await verifyServiceEvent(event, payload, { targetAid, resolveEventCertificate: (aid, fingerprint) => this._fetchServiceEventCertificate(aid, fingerprint), resolveCredentialService: this.resolveCredentialService });
         if (!current())
             throw new ValidationError('service event receiver identity changed');
+        const eventName = event.replace(/^event\//, '');
+        if (eventName.startsWith('org.') || ['credential.revoked', 'credential.revocationList'].includes(eventName)) {
+            this._getCredentialRenewal().invalidateQueries?.();
+        }
+        if (['credential.revoked', 'credential.revocationList'].includes(event.replace(/^event\//, ''))) {
+            await this._getCredentialRenewal()._receiveRevocations(payload, { current, signal });
+        }
         if (event.replace(/^event\//, '') === 'org.member.changed' && isJsonObject(payload) && Object.hasOwn(payload, 'membership_package')) {
             await this._getCredentialRenewal().importMembershipPackage(payload, { current, signal });
             if (!current())
@@ -1179,7 +1197,12 @@ export class AUNClient {
     async resetOwnershipTask() { return this._getOwnershipWorkflow().resetOwnershipTask(); }
     async releaseSubaid(subAid) { return this._getOwnershipWorkflow().releaseSubaid(subAid); }
     async transferSubaid(subAid, newOwnerAid) { return this._getOwnershipWorkflow().transferSubaid(subAid, newOwnerAid); }
-    async checkOwnershipConsensus(subAid) { return this._getOwnershipWorkflow().checkOwnershipConsensus(subAid); }
+    async checkOwnershipConsensus(subAid) {
+        return this._createOwnershipFiles((aid) => this._agentMdManager._readOwnershipQuery(aid)).checkConsensus(ownershipAid(subAid ?? this._aid, 'sub_aid'));
+    }
+    async _checkOwnershipConsensusFresh(subAid) {
+        return this._getOwnershipWorkflow().checkOwnershipConsensus(subAid);
+    }
     async bindAid(subjectAid, options = {}) {
         throw ownershipFailure('unsupported_protocol', 'legacy bindAid is unsupported; use bindSubaid');
     }
@@ -1386,6 +1409,9 @@ export class AUNClient {
         this._identityRuntime.loadIdentity(aid);
         this._stopCredentialRenewal();
         this._serviceEventIdentityVersion++;
+        this._auth.invalidateStrictPkiCache();
+        this._certCache.clear();
+        this._certFetchInFlight.clear();
         this._serviceEventIdentityAbort.abort();
         this._serviceEventIdentityAbort = new AbortController();
         this._ensureReadStateIdentity();
@@ -1614,6 +1640,9 @@ export class AUNClient {
             if (!isJsonObject(raw))
                 continue;
             const group = raw;
+            const status = String(group.status ?? '').trim().toLowerCase();
+            if (status && status !== 'active')
+                continue;
             const role = String(group.role ?? group.my_role ?? '').trim().toLowerCase();
             const groupId = String(group.group_id ?? group.groupId ?? group.group_aid ?? group.groupAid ?? '').trim();
             const groupAid = String(group.group_aid ?? group.groupAid ?? groupId).trim();
@@ -1753,7 +1782,7 @@ export class AUNClient {
                     await this.createOrg(creation.source_params, { aidStore: store });
                     continue;
                 }
-                if (transfer?.owner_aid === this._aid) {
+                if (transfer?.owner_aid === this._aid && transfer.phase !== 'completed') {
                     await this.completeOrgTransfer(transfer.source_params, { aidStore: store });
                     continue;
                 }
@@ -1817,8 +1846,14 @@ export class AUNClient {
         let pending = (typeof tokenStore._loadMetadataStrict === 'function' ? tokenStore._loadMetadataStrict(orgAid) : tokenStore.loadMetadata(orgAid))?.org_identity_transfer;
         if (pending != null && !isJsonObject(pending))
             throw ownershipFailure('persistence_unavailable', 'Org transfer checkpoint is invalid');
+        if (pending?.phase === 'completed' && pending.transfer_id !== transferId)
+            pending = undefined;
         if (pending && (pending.transfer_id !== transferId || pending.owner_aid !== owner.aid || pending.input_hash !== inputHash))
             throw ownershipFailure('conflict', 'pending Org transfer context changed');
+        if (pending?.phase === 'completed') {
+            localStore.clearPendingGroupBind(pendingKey);
+            return pending.result;
+        }
         if (!pending)
             await this._verifyOrgTransferMaterials(params, owner.aid);
         let keyPair = localStore.loadPendingGroupBind(pendingKey);
@@ -1879,7 +1914,7 @@ export class AUNClient {
         }
         const result = await this.call('org.lifecycle.transferAccept', await this._resumeOrgRequest('org.lifecycle.transferAccept', pending.finalize_params, target));
         await this._uploadOrgAgentMd(store, orgAid, pending.source_params);
-        tokenStore.saveMetadata(orgAid, { org_identity_transfer: null });
+        tokenStore.saveMetadata(orgAid, { org_identity_transfer: { transfer_id: transferId, owner_aid: owner.aid, input_hash: inputHash, phase: 'completed', result } });
         localStore.clearPendingGroupBind(pendingKey);
         return result;
     }
@@ -2132,7 +2167,13 @@ export class AUNClient {
             entityIdentityGetter: (aid, type) => this._freshEntityCertificate(aid, type),
             entitySignerResolver: (aid, fingerprint) => this._freshEntitySigner(aid, fingerprint),
             gatewayResolver: (aid) => identityStore._resolveGateway(aid),
-            accessTokenResolver: (_aid, gatewayUrl) => identityStore._uploadAgentMdToken(identity, gatewayUrl),
+            accessTokenResolver: async () => {
+                const state = identityStore._tokenStore?.loadInstanceState?.(identity.aid, store.deviceId, store.slotId) ?? {};
+                const token = AuthFlow._getCachedAccessToken(state);
+                if (token && String(state.refresh_token ?? '') && !this._auth._validateCachedCredentials(identityStore._authIdentityFromAid(identity)))
+                    return token;
+                return identityStore._uploadAgentMdToken(identity, await identityStore._resolveGateway(identity.aid));
+            },
             aidValidator: (aid) => identityStore._registerFlow.validateAidName(aid),
         });
         return await manager.resumePendingUpload(groupAid);
@@ -2607,6 +2648,11 @@ export class AUNClient {
         const tStart = Date.now();
         this._clientLog.debug(`on enter: event=${event}`);
         const result = this._dispatcher.subscribe(event, handler);
+        if (event === 'message.received' || event === 'message.recalled' || event === 'message.batch') {
+            if (this._p2pPeerPullEnabled)
+                this._delivery.refreshPendingPeers();
+            this._delivery.requestBackgroundPullRecovery();
+        }
         this._clientLog.debug(`on exit: elapsed=${Date.now() - tStart}ms event=${event}`);
         return result;
     }
@@ -3311,6 +3357,8 @@ export class AUNClient {
                 this._clientLog.debug(`bootstrap CA chain cache skipped: peer=${aid}, source=${opts.source ?? 'unknown'}, err=${formatCaughtError(exc)}`);
             }
         }
+        const auth = this._auth;
+        const pkiEpoch = auth._strictPkiEpoch;
         try {
             if (opts.signedAt === undefined)
                 await this._auth.verifyPeerCertificate(peerGatewayUrl, certPem, aid);
@@ -3328,20 +3376,21 @@ export class AUNClient {
             }
             throw new ValidationError(`peer cert verification failed for ${aid}: ${exc instanceof Error ? exc.message : String(exc)}`);
         }
+        if (auth !== this._auth || pkiEpoch !== auth._strictPkiEpoch)
+            throw new ValidationError('peer certificate validation context changed');
         const nowSec = Date.now() / 1000;
         const entry = {
             certPem,
             validatedAt: nowSec,
-            refreshAfter: nowSec + PEER_CERT_CACHE_TTL,
+            refreshAfter: Math.min(nowSec + PEER_CERT_CACHE_TTL, Date.parse(x509Cert.validTo) / 1000, auth._gatewayChainCache.get(`${peerGatewayUrl}:${aid}`)?.expiresAt / 1000 || Infinity),
+            auth,
+            pkiEpoch,
         };
-        const cacheKey = AUNClient._certCacheKey(aid, certFingerprint) + (opts.signedAt === undefined ? '' : `:signed:${opts.signedAt}${opts.agentMdRead ? ':agentmd' : ''}`);
+        const scope = opts.signedAt === undefined ? '' : `:historical${opts.agentMdRead ? ':agentmd' : ''}`;
+        const actualFp = `sha256:${x509Cert.fingerprint256.replace(/:/g, '').toLowerCase()}`;
+        const cacheKey = AUNClient._certCacheKey(aid, actualFp) + scope;
         this._certCache.set(cacheKey, entry);
-        if (!certFingerprint && opts.signedAt === undefined) {
-            const bareKey = AUNClient._certCacheKey(aid);
-            this._certCache.set(bareKey, entry);
-            const actualFp = `sha256:${x509Cert.fingerprint256.replace(/:/g, '').toLowerCase()}`;
-            this._certCache.set(AUNClient._certCacheKey(aid, actualFp), entry);
-        }
+        this._certCache.set(AUNClient._certCacheKey(aid, certFingerprint) + scope, entry);
         try {
             // peer 证书只存版本目录，不覆盖 cert.pem
             this._tokenStore.saveCert(aid, certPem, opts.agentMdRead && opts.signedAt !== undefined ? `sha256:${x509Cert.fingerprint256.replace(/:/g, '').toLowerCase()}` : certFingerprint, { makeActive: false });
@@ -3363,14 +3412,46 @@ export class AUNClient {
         const tStart = Date.now();
         this._clientLog.debug(`_fetchPeerCert enter: aid=${aid}, fp=${certFingerprint ?? ''}`);
         try {
-            const cacheKey = AUNClient._certCacheKey(aid, certFingerprint) + (signedAt === undefined ? '' : `:signed:${signedAt}${agentMdRead ? ':agentmd' : ''}`);
+            const cacheKey = AUNClient._certCacheKey(aid, certFingerprint) + (signedAt === undefined ? '' : `:historical${agentMdRead ? ':agentmd' : ''}`);
             const cached = this._certCache.get(cacheKey);
             const now = Date.now() / 1000;
-            if (cached && now < cached.refreshAfter) {
+            const auth = this._auth, pkiEpoch = auth._strictPkiEpoch;
+            if (cached && cached.auth === auth && cached.pkiEpoch === pkiEpoch && now < cached.refreshAfter) {
+                if (signedAt === undefined) {
+                    const statusKey = `${cacheKey}:status:${pkiEpoch}`;
+                    let pending = this._certFetchInFlight.get(statusKey);
+                    if (!pending) {
+                        pending = (async () => {
+                            await auth.verifyPeerCertificate(AUNClient._resolvePeerGatewayUrl(this._gatewayUrl, aid), cached.certPem, aid);
+                            if (auth !== this._auth || pkiEpoch !== auth._strictPkiEpoch)
+                                throw new ValidationError('peer certificate status context changed');
+                            return cached.certPem;
+                        })();
+                        this._certFetchInFlight.set(statusKey, pending);
+                    }
+                    try {
+                        await pending;
+                    }
+                    finally {
+                        if (this._certFetchInFlight.get(statusKey) === pending)
+                            this._certFetchInFlight.delete(statusKey);
+                    }
+                }
+                else {
+                    const peerGatewayUrl = AUNClient._resolvePeerGatewayUrl(this._gatewayUrl, aid);
+                    if (agentMdRead) {
+                        validateAgentMdCertificate(cached.certPem, aid, signedAt, { requireCurrentValidity: false, readCompatibility: true });
+                        await auth._verifyAuthCertChain(peerGatewayUrl, new crypto.X509Certificate(cached.certPem), aid, signedAt);
+                    }
+                    else
+                        await auth.verifyPeerCertificate(peerGatewayUrl, cached.certPem, aid, signedAt);
+                    if (auth !== this._auth || pkiEpoch !== auth._strictPkiEpoch)
+                        throw new ValidationError('peer certificate validation context changed');
+                }
                 this._clientLog.debug(`_fetchPeerCert exit: elapsed=${Date.now() - tStart}ms aid=${aid} (cache_hit)`);
                 return cached.certPem;
             }
-            const inFlightKey = `${cacheKey}:timeout:${timeoutMs}`;
+            const inFlightKey = `${cacheKey}:signed:${signedAt ?? 'current'}:timeout:${timeoutMs}:pki:${pkiEpoch}`;
             const pending = this._certFetchInFlight.get(inFlightKey);
             if (pending)
                 return await pending;
@@ -3381,6 +3462,8 @@ export class AUNClient {
                 }
                 const peerGatewayUrl = AUNClient._resolvePeerGatewayUrl(gatewayUrl, aid);
                 const certPem = await _httpGetText(AUNClient._buildCertUrl(peerGatewayUrl, aid, certFingerprint), this._configModel.verifySsl, timeoutMs);
+                if (auth !== this._auth || pkiEpoch !== auth._strictPkiEpoch)
+                    throw new ValidationError('peer certificate fetch context changed');
                 const validated = await this._validateAndCachePeerCert({
                     aid,
                     certPem,
@@ -3801,7 +3884,9 @@ export class AUNClient {
     }
     /** 构建证书下载 URL */
     static _certCacheKey(aid, certFingerprint) {
-        const normalized = String(certFingerprint ?? '').trim().toLowerCase();
+        const raw = String(certFingerprint ?? '').trim().toLowerCase();
+        const hex = normalizeFingerprintHex(raw);
+        const normalized = hex ? `sha256:${hex}` : raw;
         return normalized ? `${aid}#${normalized}` : aid;
     }
     static _buildCertUrl(gatewayUrl, aid, certFingerprint) {
@@ -4846,6 +4931,9 @@ export class AUNClient {
     /** 停止所有后台任务 */
     _stopBackgroundTasks() {
         this._stopCredentialRenewal();
+        this._auth.invalidateStrictPkiCache();
+        this._certCache.clear();
+        this._certFetchInFlight.clear();
         if (this._heartbeatTimer !== null) {
             clearInterval(this._heartbeatTimer);
             this._heartbeatTimer = null;