@agentunion/fastaun 0.5.22 → 0.5.23

package/dist/client.js

@@ -48,7 +48,7 @@ import { isJsonObject, ConnectionState, STATE_TO_PUBLIC, } from './types.js';
 import { AID } from './aid.js';
 import { certFingerprint, certMatchesFingerprint, normalizeFingerprintHex, publicKeyMatchesFingerprint } from './cert-utils.js';
 import { validateAgentMdCertificate, validateAgentMdDocument } from './agent-md-schema.js';
-import { OwnershipFiles, OwnershipStorageAdapter, ownershipFailure } from './ownership-v21.js';
+import { OwnershipFiles, OwnershipStorageAdapter, ownershipAid, ownershipFailure } from './ownership-v21.js';
 import { OwnershipWorkflow } from './ownership-workflow.js';
 import { canonicalJson, createCredential, createMemberCredential, signMembershipBinding, digest, validateMembershipBinding, verifyMembershipBinding, verifyCredentialSignature, createRepresentationProof, verifyServiceEvent, buildRequestBinding, validateRequestBinding, CredentialRenewal } from './org-protocol.js';
 function isPromiseLike(value) {
@@ -489,12 +489,15 @@ export class AUNClient {
         return this._ownershipStorage ??= new OwnershipStorageAdapter({ currentAid: () => this._aid, call: (method, params) => this.call(method, params), httpPut: (url, data, headers) => this.storage.lowlevel.httpPut(url, data, headers) });
     }
     _getOwnershipFiles() {
-        return this._ownershipFiles ??= new OwnershipFiles({
+        return this._ownershipFiles ??= this._createOwnershipFiles((subAid) => this._agentMdManager.readOwnershipFresh(subAid));
+    }
+    _createOwnershipFiles(readAgentMdFresh) {
+        return new OwnershipFiles({
             currentAid: () => { if (!this._currentAid)
                 throw ownershipFailure('forbidden', 'ownership requires a loaded identity'); return this._currentAid; },
             currentType: () => this.getType(),
             now: () => Math.trunc(Date.now() / 1000),
-            readAgentMdFresh: (subAid) => this._agentMdManager.readOwnershipFresh(subAid),
+            readAgentMdFresh,
             submitAgentMdRaw: (subAid, raw, condition, assertActive, stage) => this._agentMdManager.submitOwnershipRaw(subAid, raw, condition, assertActive, stage),
             readOwnerMd: (ownerAid, subAid) => this._getOwnershipStorage().readOwnerMd(ownerAid, subAid),
             writeOwnerMd: (ownerAid, subAid, raw, original, assertActive) => this._getOwnershipStorage().writeOwnerMd(ownerAid, subAid, raw, original, assertActive),
@@ -554,9 +557,11 @@ export class AUNClient {
     _credentialRenewalTimer = null;
     _credentialRenewalAbort = null;
     _credentialRenewalScan = Promise.resolve();
+    _nextCredentialRevocationSyncAt = 0;
     _getCredentialRenewal() {
         return this._credentialRenewal ??= new CredentialRenewal({
             currentAid: () => this._aid ?? '',
+            queryContext: () => JSON.stringify([this._serviceEventIdentityVersion, this._gatewayUrl, this._transport?._connectionGeneration, this._transport?._workerGeneration]),
             atomicCheckpointSave: () => this._tokenStore instanceof LocalTokenStore,
             load: (aid) => (this._tokenStore._loadMetadataStrict?.(aid) ?? this._tokenStore.loadMetadata?.(aid))?.credential_renewals_v1 ?? {},
             ...(typeof this._tokenStore._loadMetadataStrict === 'function' ? {
@@ -630,6 +635,7 @@ export class AUNClient {
             if (aid === this._aid && this._identity) {
                 this._identity.cert = identity.certPem;
                 this._currentAid = identity;
+                this._auth.setIdentity(this._identity);
             }
         }
         return identity;
@@ -665,14 +671,14 @@ export class AUNClient {
         this._credentialRenewalAbort = abort;
         const current = () => this._credentialRenewalAbort === abort && !abort.signal.aborted && aid === this._aid && version === this._serviceEventIdentityVersion && ['ready', 'connected'].includes(this._state) && !this._closing && !this._disconnecting;
         const guard = { current, signal: abort.signal };
-        let nextRevocationSync = Date.now() + 3_600_000;
+        this._nextCredentialRevocationSyncAt ||= Date.now() + 3_600_000;
         const scan = async () => {
             const task = this._credentialRenewalScan.then(async () => {
                 if (!current())
                     return;
-                const syncRevocations = Date.now() >= nextRevocationSync;
+                const syncRevocations = Date.now() >= this._nextCredentialRevocationSyncAt;
                 if (syncRevocations)
-                    nextRevocationSync = Date.now() + 3_600_000;
+                    this._nextCredentialRevocationSyncAt = Date.now() + 3_600_000;
                 await this._resumeCredentialRenewalAfterConnect(guard, syncRevocations);
             });
             this._credentialRenewalScan = task.catch(() => { });
@@ -710,6 +716,10 @@ export class AUNClient {
         const verified = await verifyServiceEvent(event, payload, { targetAid, resolveEventCertificate: (aid, fingerprint) => this._fetchServiceEventCertificate(aid, fingerprint), resolveCredentialService: this.resolveCredentialService });
         if (!current())
             throw new ValidationError('service event receiver identity changed');
+        const eventName = event.replace(/^event\//, '');
+        if (eventName.startsWith('org.') || ['credential.revoked', 'credential.revocationList'].includes(eventName)) {
+            this._getCredentialRenewal().invalidateQueries?.();
+        }
         if (['credential.revoked', 'credential.revocationList'].includes(event.replace(/^event\//, ''))) {
             await this._getCredentialRenewal()._receiveRevocations(payload, { current, signal });
         }
@@ -1187,7 +1197,12 @@ export class AUNClient {
     async resetOwnershipTask() { return this._getOwnershipWorkflow().resetOwnershipTask(); }
     async releaseSubaid(subAid) { return this._getOwnershipWorkflow().releaseSubaid(subAid); }
     async transferSubaid(subAid, newOwnerAid) { return this._getOwnershipWorkflow().transferSubaid(subAid, newOwnerAid); }
-    async checkOwnershipConsensus(subAid) { return this._getOwnershipWorkflow().checkOwnershipConsensus(subAid); }
+    async checkOwnershipConsensus(subAid) {
+        return this._createOwnershipFiles((aid) => this._agentMdManager._readOwnershipQuery(aid)).checkConsensus(ownershipAid(subAid ?? this._aid, 'sub_aid'));
+    }
+    async _checkOwnershipConsensusFresh(subAid) {
+        return this._getOwnershipWorkflow().checkOwnershipConsensus(subAid);
+    }
     async bindAid(subjectAid, options = {}) {
         throw ownershipFailure('unsupported_protocol', 'legacy bindAid is unsupported; use bindSubaid');
     }
@@ -1394,6 +1409,9 @@ export class AUNClient {
         this._identityRuntime.loadIdentity(aid);
         this._stopCredentialRenewal();
         this._serviceEventIdentityVersion++;
+        this._auth.invalidateStrictPkiCache();
+        this._certCache.clear();
+        this._certFetchInFlight.clear();
         this._serviceEventIdentityAbort.abort();
         this._serviceEventIdentityAbort = new AbortController();
         this._ensureReadStateIdentity();
@@ -3339,6 +3357,8 @@ export class AUNClient {
                 this._clientLog.debug(`bootstrap CA chain cache skipped: peer=${aid}, source=${opts.source ?? 'unknown'}, err=${formatCaughtError(exc)}`);
             }
         }
+        const auth = this._auth;
+        const pkiEpoch = auth._strictPkiEpoch;
         try {
             if (opts.signedAt === undefined)
                 await this._auth.verifyPeerCertificate(peerGatewayUrl, certPem, aid);
@@ -3356,20 +3376,21 @@ export class AUNClient {
             }
             throw new ValidationError(`peer cert verification failed for ${aid}: ${exc instanceof Error ? exc.message : String(exc)}`);
         }
+        if (auth !== this._auth || pkiEpoch !== auth._strictPkiEpoch)
+            throw new ValidationError('peer certificate validation context changed');
         const nowSec = Date.now() / 1000;
         const entry = {
             certPem,
             validatedAt: nowSec,
-            refreshAfter: nowSec + PEER_CERT_CACHE_TTL,
+            refreshAfter: Math.min(nowSec + PEER_CERT_CACHE_TTL, Date.parse(x509Cert.validTo) / 1000, auth._gatewayChainCache.get(`${peerGatewayUrl}:${aid}`)?.expiresAt / 1000 || Infinity),
+            auth,
+            pkiEpoch,
         };
-        const cacheKey = AUNClient._certCacheKey(aid, certFingerprint) + (opts.signedAt === undefined ? '' : `:signed:${opts.signedAt}${opts.agentMdRead ? ':agentmd' : ''}`);
+        const scope = opts.signedAt === undefined ? '' : `:historical${opts.agentMdRead ? ':agentmd' : ''}`;
+        const actualFp = `sha256:${x509Cert.fingerprint256.replace(/:/g, '').toLowerCase()}`;
+        const cacheKey = AUNClient._certCacheKey(aid, actualFp) + scope;
         this._certCache.set(cacheKey, entry);
-        if (!certFingerprint && opts.signedAt === undefined) {
-            const bareKey = AUNClient._certCacheKey(aid);
-            this._certCache.set(bareKey, entry);
-            const actualFp = `sha256:${x509Cert.fingerprint256.replace(/:/g, '').toLowerCase()}`;
-            this._certCache.set(AUNClient._certCacheKey(aid, actualFp), entry);
-        }
+        this._certCache.set(AUNClient._certCacheKey(aid, certFingerprint) + scope, entry);
         try {
             // peer 证书只存版本目录，不覆盖 cert.pem
             this._tokenStore.saveCert(aid, certPem, opts.agentMdRead && opts.signedAt !== undefined ? `sha256:${x509Cert.fingerprint256.replace(/:/g, '').toLowerCase()}` : certFingerprint, { makeActive: false });
@@ -3391,14 +3412,46 @@ export class AUNClient {
         const tStart = Date.now();
         this._clientLog.debug(`_fetchPeerCert enter: aid=${aid}, fp=${certFingerprint ?? ''}`);
         try {
-            const cacheKey = AUNClient._certCacheKey(aid, certFingerprint) + (signedAt === undefined ? '' : `:signed:${signedAt}${agentMdRead ? ':agentmd' : ''}`);
+            const cacheKey = AUNClient._certCacheKey(aid, certFingerprint) + (signedAt === undefined ? '' : `:historical${agentMdRead ? ':agentmd' : ''}`);
             const cached = this._certCache.get(cacheKey);
             const now = Date.now() / 1000;
-            if (cached && now < cached.refreshAfter) {
+            const auth = this._auth, pkiEpoch = auth._strictPkiEpoch;
+            if (cached && cached.auth === auth && cached.pkiEpoch === pkiEpoch && now < cached.refreshAfter) {
+                if (signedAt === undefined) {
+                    const statusKey = `${cacheKey}:status:${pkiEpoch}`;
+                    let pending = this._certFetchInFlight.get(statusKey);
+                    if (!pending) {
+                        pending = (async () => {
+                            await auth.verifyPeerCertificate(AUNClient._resolvePeerGatewayUrl(this._gatewayUrl, aid), cached.certPem, aid);
+                            if (auth !== this._auth || pkiEpoch !== auth._strictPkiEpoch)
+                                throw new ValidationError('peer certificate status context changed');
+                            return cached.certPem;
+                        })();
+                        this._certFetchInFlight.set(statusKey, pending);
+                    }
+                    try {
+                        await pending;
+                    }
+                    finally {
+                        if (this._certFetchInFlight.get(statusKey) === pending)
+                            this._certFetchInFlight.delete(statusKey);
+                    }
+                }
+                else {
+                    const peerGatewayUrl = AUNClient._resolvePeerGatewayUrl(this._gatewayUrl, aid);
+                    if (agentMdRead) {
+                        validateAgentMdCertificate(cached.certPem, aid, signedAt, { requireCurrentValidity: false, readCompatibility: true });
+                        await auth._verifyAuthCertChain(peerGatewayUrl, new crypto.X509Certificate(cached.certPem), aid, signedAt);
+                    }
+                    else
+                        await auth.verifyPeerCertificate(peerGatewayUrl, cached.certPem, aid, signedAt);
+                    if (auth !== this._auth || pkiEpoch !== auth._strictPkiEpoch)
+                        throw new ValidationError('peer certificate validation context changed');
+                }
                 this._clientLog.debug(`_fetchPeerCert exit: elapsed=${Date.now() - tStart}ms aid=${aid} (cache_hit)`);
                 return cached.certPem;
             }
-            const inFlightKey = `${cacheKey}:timeout:${timeoutMs}`;
+            const inFlightKey = `${cacheKey}:signed:${signedAt ?? 'current'}:timeout:${timeoutMs}:pki:${pkiEpoch}`;
             const pending = this._certFetchInFlight.get(inFlightKey);
             if (pending)
                 return await pending;
@@ -3409,6 +3462,8 @@ export class AUNClient {
                 }
                 const peerGatewayUrl = AUNClient._resolvePeerGatewayUrl(gatewayUrl, aid);
                 const certPem = await _httpGetText(AUNClient._buildCertUrl(peerGatewayUrl, aid, certFingerprint), this._configModel.verifySsl, timeoutMs);
+                if (auth !== this._auth || pkiEpoch !== auth._strictPkiEpoch)
+                    throw new ValidationError('peer certificate fetch context changed');
                 const validated = await this._validateAndCachePeerCert({
                     aid,
                     certPem,
@@ -3829,7 +3884,9 @@ export class AUNClient {
     }
     /** 构建证书下载 URL */
     static _certCacheKey(aid, certFingerprint) {
-        const normalized = String(certFingerprint ?? '').trim().toLowerCase();
+        const raw = String(certFingerprint ?? '').trim().toLowerCase();
+        const hex = normalizeFingerprintHex(raw);
+        const normalized = hex ? `sha256:${hex}` : raw;
         return normalized ? `${aid}#${normalized}` : aid;
     }
     static _buildCertUrl(gatewayUrl, aid, certFingerprint) {
@@ -4874,6 +4931,9 @@ export class AUNClient {
     /** 停止所有后台任务 */
     _stopBackgroundTasks() {
         this._stopCredentialRenewal();
+        this._auth.invalidateStrictPkiCache();
+        this._certCache.clear();
+        this._certFetchInFlight.clear();
         if (this._heartbeatTimer !== null) {
             clearInterval(this._heartbeatTimer);
             this._heartbeatTimer = null;