@agentunion/fastaun 0.5.29 → 0.5.31

package/_packed_docs//351/231/214/347/224/237/344/272/272/346/213/222/347/273/235/345/215/217/350/256/256/350/257/246/347/273/206/350/256/276/350/256/241.md

@@ -0,0 +1,231 @@
+# AUN 陌生人拒绝协议详细设计
+
+> 状态：实施中；本地实现、Ubuntu 真实单域/双域专项及 Console 浏览器验收记录见对应计划，完整发布门禁尚未完成。
+>
+> 对应计划：[陌生人拒绝协议 TDD 分阶段实施计划](陌生人拒绝协议TDD分阶段实施计划.md)
+>
+> 版本：v1.0
+>
+> 更新时间：2026-11-01
+
+## 1. 目标与范围
+
+由 Gateway 对 P2P 消息执行陌生人额度检查，并在接收方登记的拒绝/屏蔽状态下阻止消息继续转发。双方完成 Gateway 可观察到的双向 P2P 交流后，永久豁免陌生人额度；接收方仍可随时拒绝或屏蔽对端。
+
+状态由服务端持久化，Gateway 为在线判定权威，并维护高频查询缓存。SDK 提供拒绝/屏蔽状态的设置、解除和本人清单查询。AUN Console 提供 Gateway 策略开关、一次性历史状态回填操作、观察结果及 AID 对状态查询。
+
+本设计不把拒绝状态通知对端，不让 Gateway 替客户端决定拒绝对象，不用历史消息库推断不可证明的交流关系，也不把入群申请并入 P2P 状态。
+
+## 2. 与常见 IM 机制的对应
+
+常见 IM 的陌生人治理通常分成三类：未建立关系前的私信额度、接收方维护的拒收名单、群组申请队列上限。本设计分别映射为 Gateway 的 P2P 待处理消息上限、服务端持久化的单向拒绝/屏蔽状态、Group 服务已有的 `max_pending`。额度属于服务端防滥用策略；拒绝/屏蔽属于接收方选择，服务端负责执行，不广播决定。
+
+## 3. 术语与策略
+
+| 术语 | 定义 |
+|---|---|
+| owner | 状态所有者；对收件方向的状态来说是接收消息的 AID |
+| peer | 与 owner 通信的另一个 AID |
+| pending 消息数 | 尚未形成互通时，peer 通过 Gateway 准入的提交次数；重复提交重复消耗额度 |
+| 互通 | 服务端能证实 owner 与 peer 双向都至少有一条 P2P 消息 |
+| 拒绝状态 | owner 对 peer 设置的 `rejected` 或 `blocked`，两种状态均阻止 peer 向 owner 发送 P2P 消息 |
+| observe | 记录状态和计数，不因陌生人额度拒绝消息；拒绝/屏蔽仍生效 |
+| enforce | 陌生人额度达到上限后，Gateway 拒绝转发新的 P2P 消息 |
+
+陌生人额度按 `(owner_aid, peer_aid)` 独立计算。配置为每个接收 AID 的全局策略，不由 SDK 参数覆写。达到上限只影响该方向；如果 owner 给 peer 发送了消息，形成双向交流后不再受陌生人额度限制。
+
+## 4. Gateway 判定边界
+
+### 4.1 覆盖范围
+
+Gateway 在认证身份和接收目标均已确定后、业务消息进入 Message 服务或跨域转发前执行入站检查。入口识别 `message.send`、`message.v2.send` 及内部分类兼容方法 `message.send_classified_v1`、`message.v2.send_classified_v1`，持久/volatile 适用同一规则；E2EE 密文和在线/离线状态不改变限额判定。Gateway 不读取 `message_id` 作额度判断。跨域按实际到达接收域 Gateway 的请求计数；来源 Message 已按原有幂等提前返回的重复请求不增加目标域计数，Message 原有幂等保持不变。
+
+`from` 必须来自当前认证连接或经过验证的 federation 身份；不得信任请求 payload 自带的发送方。`to` 必须是本次路由的实际接收 AID。
+
+`group.send`、`group.v2.send` 和 `group.request_join` 不参与 P2P 限额。入群申请继续由 Group 服务按 `max_pending` 拒绝超量的新申请；已有待审批申请数和 P2P 互通状态相互独立。
+
+### 4.2 不能绕过 Gateway 的要求
+
+Peer 直连及不经过受控 Gateway 的 Relay 业务数据路径无法由 Gateway 检查。此方案对经过 Gateway 的 P2P 路由提供强制限制；若产品要求覆盖所有 Peer/Relay 直连业务消息，实施前必须把这些业务路径纳入 Gateway 仲裁，或明确其不受本策略约束。不能把 Gateway 观察到的状态描述成全网完整状态，除非全部业务流量都经过受控 Gateway。
+
+## 5. P2P 状态机
+
+### 5.1 入站消息判定顺序
+
+对从 `peer_aid` 发往 `owner_aid` 的每条 P2P 消息，Gateway 按下列顺序在数据库事务中读取并更新 owner/peer 状态：
+
+1. 若 `deny_status` 是 `rejected` 或 `blocked`，返回拒收结果，不转发、不增加 pending 数。
+2. 若 `mutual_confirmed_at_ms` 已设置，允许转发，不再检查陌生人额度。
+3. 若此前已记录 owner 给 peer 发过消息，本条入站消息证明双方已经互通；设置互通标记、清零 pending 数并允许转发。
+4. 在 `enforce` 模式下，若 `pending_message_count >= stranger_pending_limit`，拒绝本条消息且计数不变。
+5. 否则允许消息进入路由并原子增加 pending 数、记录 peer 已发消息。
+
+额度的含义是“最多准入 N 次单向提交”；当计数为 N 时，下一次被拒绝。`observe` 模式执行同样的状态记录和计数更新，但跳过第 4 步的拒绝。Gateway 只做入口状态与次数判断，不检查 `message_id`，相同消息重复提交也重新计数。
+
+### 5.2 出站与互通确认
+
+owner 向 peer 成功提交一条 P2P 消息后，Gateway 将 owner 已发标记写入 `(owner, peer)` 状态。若该状态已经有 peer 入站记录，则在同一事务中设置 `mutual_confirmed_at_ms` 并清零 pending 数。出站失败或被目标 Gateway 拒绝时不得登记为成功出站。
+
+互通是单调状态：一旦确认，不因消息过期、撤回、离线或缓存淘汰而清除。互通不会覆盖 `deny_status`；即使双方已互通，owner 后续设置拒绝/屏蔽仍会拦截 peer 发来的消息。
+
+状态表记录由各 owner 所属域维护。跨域消息在发送域记录 owner 出站事实，在接收域记录 owner 入站事实；反向消息到达时，两域各自按本地事实确认本地 owner 的互通状态。
+
+### 5.3 拒绝结果
+
+被拒绝的请求返回可重试性明确的 JSON-RPC 错误，不产生 `event`，不向发送方主动发送通知。屏蔽状态的存在不对对端公开；对端只能知道该次消息未被接受。错误契约冻结为：拒收 `-32004 / PEER_NOT_ACCEPTING`，额度超限 `-32029 / STRANGER_PENDING_LIMIT`，状态服务不可用 `-32603 / PEER_STATE_UNAVAILABLE`；前两项不可重试，服务不可用可重试。参数错误沿用 `-32602`，配置版本冲突沿用 `-32009 / POLICY_VERSION_CONFLICT`。
+
+## 6. 持久化模型
+
+### 6.1 关系与拒绝状态表
+
+Gateway 在现有持久化数据库中新增 `gateway_peer_state`。互通、待处理计数、出入站方向标记和接收方拒绝状态使用同一张业务表，owner/peer 是有向键；回填任务运行信息单独存储，避免把任务进度混入业务状态。
+
+| 字段 | 类型/约束 | 说明 |
+|---|---|---|
+| `owner_aid` | `VARCHAR(255)`，非空 | 当前域内状态所有者，使用 Gateway 现有 AID 字符集与比较规则 |
+| `peer_aid` | `VARCHAR(255)`，非空 | 对端 AID；按原始规范化后字符串精确比较 |
+| `pending_message_count` | `BIGINT UNSIGNED`，默认 0 | peer 尚未得到 owner 回应前，通过 Gateway 准入的提交次数 |
+| `owner_sent_any` | `BOOLEAN`，默认 false | owner 是否成功给 peer 发过 P2P 消息 |
+| `peer_sent_any` | `BOOLEAN`，默认 false | peer 是否成功给 owner 发过 P2P 消息 |
+| `last_inbound_at_ms` | 可空 `BIGINT` | 最近一次从 peer 到 owner 的已准入消息时间 |
+| `last_outbound_at_ms` | 可空 `BIGINT` | 最近一次从 owner 到 peer 的成功消息时间 |
+| `mutual_confirmed_at_ms` | 可空 `BIGINT` | 互通确认的服务端时间；历史回填写入回填确认时间，不伪装成实际首条消息时间 |
+| `mutual_source` | `live` / `backfill` | 互通状态来源；实时流量再次证明时更新为 `live` |
+| `deny_status` | `none` / `rejected` / `blocked` | owner 设置的拒绝/屏蔽状态 |
+| `deny_updated_at_ms` | 可空 `BIGINT` | 拒绝状态最近更新时间 |
+| `created_at_ms` / `updated_at_ms` | `BIGINT` | 服务端维护时间 |
+
+主键为 `(owner_aid, peer_aid)`，支持 Gateway 热路径定点查找；另建 `(owner_aid, deny_status, peer_aid)` 支持本人拒绝清单，`(owner_aid, mutual_confirmed_at_ms, peer_aid)` 支持 Console 按互通状态分页，`(owner_aid, pending_message_count, peer_aid)` 支持 pending 过滤。AID 长度、字符集、排序规则沿用 Gateway 现有表定义，迁移测试须覆盖大小写与规范化后的精确键行为。
+
+对 enforce 入站操作采用行锁或等价的原子条件更新，检查拒绝状态、互通标记、限额并增加计数必须属于一个事务；并发 N+K 条消息不能超过 N 条额度。表是权威数据，缓存不代替事务。
+
+Gateway 不保存逐消息准入记录，不新增去重表、消息 ID 缓存或相应清理任务。每次提交独立判断和计数，重复提交由调用方避免。
+
+陌生人策略作为 Gateway 持久配置保存：`stranger_mode` 默认 `observe`，可选 `enforce`；`stranger_pending_limit` 必须为正整数。配置写入使用版本号/CAS，避免 Console 并发覆盖。启动时缺少配置记录表示首次部署，初始化为 observe；无效配置或数据库读取失败不能被解释成首次部署，Gateway 未完成首次读取前不接受 P2P 路由，已启动后则保留最后已知配置，并在配置缓存过期且数据库仍不可用时暂停 P2P 路由并返回可重试错误。
+
+### 6.2 回填任务状态
+
+一次性任务状态存于独立的 `gateway_peer_backfill_jobs` 或等价的现有任务记录中，至少包含：`job_id`、状态、触发管理员、启动/结束时间、扫描游标/快照水位、扫描消息数、候选关系数、确认互通数、回填 pending 数、跨域确认数、未知数、失败域、错误摘要及可续跑 checkpoint。状态枚举为 `queued`、`running`、`completed`、`partial`、`failed`、`cancelled`。任务记录不保存消息 payload。
+
+同一时刻只允许一个回填任务运行。手动重试采用原 job checkpoint 幂等续跑；不配置周期调度，不在 Gateway 启动时自动开始。
+
+## 7. 内存缓存与一致性
+
+Gateway 维护有界 read-through 内存缓存，按 `(owner_aid, peer_aid)` 缓存互通、pending 和拒绝状态；拒绝清单可按 owner 缓存分页结果或短时索引。数据库提交成功后更新/淘汰本地缓存；其他实例的只读缓存通过短 TTL 收敛。当前不假定 Gateway 已有跨实例键级失效通道。
+
+缓存用于加速状态查询和只读展示，不作为消息转发的最终授权依据；额度增量及拒绝状态检查始终以数据库原子事务为准，不能依赖过期缓存放行。缓存未命中、淘汰或重启时从数据库读取；缓存故障不得清空持久状态。若数据库不可用，enforce 和拒绝状态检查失败时不转发 P2P 消息，并返回可重试的服务不可用错误；observe 下为避免新增功能中断旧消息路由，可允许消息继续路由并记录回填/观察缺口。
+
+## 8. SDK 拒绝/屏蔽 RPC
+
+SDK 只管理当前认证 AID 自己的状态；`owner_aid` 必须由 Gateway 认证上下文注入，忽略或拒绝客户端提供的 owner 字段。
+
+| 方法 | 参数 | 行为 |
+|---|---|---|
+| `message.peer_deny.set` | `peer_aid`, `status: rejected\|blocked` | 幂等设置本人对 peer 的拒绝/屏蔽 |
+| `message.peer_deny.clear` | `peer_aid` | 幂等解除本人对 peer 的拒绝/屏蔽 |
+| `message.peer_deny.list` | 可选 `status`, `page`, `size` | 分页查询本人拒绝清单；默认返回 rejected 和 blocked |
+
+请求和响应契约：
+
+```json
+{"method":"message.peer_deny.set","params":{"peer_aid":"bob.agentid.pub","status":"blocked"}}
+{"result":{"peer_aid":"bob.agentid.pub","status":"blocked","updated_at_ms":1780000000000}}
+
+{"method":"message.peer_deny.clear","params":{"peer_aid":"bob.agentid.pub"}}
+{"result":{"peer_aid":"bob.agentid.pub","status":"none","updated_at_ms":1780000000001}}
+
+{"method":"message.peer_deny.list","params":{"status":"blocked","page":1,"size":50}}
+{"result":{"items":[{"peer_aid":"bob.agentid.pub","status":"blocked","updated_at_ms":1780000000000}],"page":1,"size":50,"total":1}}
+```
+
+省略 `status` 過濾時返回 `rejected` 和 `blocked`；`page` 預設 1，`size` 預設 50、最大 100；非法枚舉、page/size、空 peer、自身 peer 返回參數錯誤。list 只返回當前認證 AID 的清單，不提供任意 `owner_aid` 過濾。
+
+设置和解除只写服务端状态，不推送对端事件；成功后立即更新本实例缓存，其他实例在短 TTL 到期后回源读取新状态。SDK 不在本地替代 Gateway 决策，不自动对已互通联系人放行，也不自动清除拒绝状态。
+
+上述 RPC 名称、参数与分页字段作为 Gateway 和四端 SDK 的统一实施契约。
+
+## 9. AUN Console 管理面板
+
+新增“陌生人策略”管理页，页面仅限 Console 管理员访问，不暴露为客户端 API。
+
+页面分为三部分：
+
+- **策略开关**：显示 `observe/enforce` 当前模式和 `stranger_pending_limit`。缺少有效正整数上限时不能切换到 enforce；首次启动/缺省配置必须是 observe。切换动作需确认并写现有 Console 管理审计。
+- **状态查询**：按 `owner_aid`、`peer_aid`、互通状态、拒绝状态、pending 是否大于 0 过滤，支持分页和按更新时间排序。表格显示有向 AID 对、互通/来源、pending 数、拒绝/屏蔽状态、最近入站/出站时间、更新时间；不展示消息内容。跨域查询只显示本 Gateway 所属域持有的 owner 状态。
+- **回填控制与观察报告**：显示 job 状态、进度、快照时间、已确认/未知/失败关系数和各域结果；提供手动开始、续跑失败任务和查看结果的操作。任务完成不会自动切换 enforce。
+
+Console 使用现有认证控制面代理访问 Gateway 管理接口。HTTP 契约如下，所有响应为 JSON，路径仅供 Console 管理调用：
+
+| Console API | 请求 | 响应 |
+|---|---|---|
+| `GET /api/aun/stranger-policy` | 无 | `{mode, pending_limit, version, observation}` |
+| `PUT /api/aun/stranger-policy` | `{mode, pending_limit, expected_version}` | `{mode, pending_limit, version, updated_at_ms}` |
+| `GET /api/aun/peer-states` | `owner_aid`, 可选 `peer_aid/mutual/deny_status/pending_only`, `page`, `page_size` | `{items, page, page_size, total}` |
+| `POST /api/aun/peer-backfill` | `{}`；显式开始一次任务 | `{job_id, status}` |
+| `GET /api/aun/peer-backfill/{job_id}` | `job_id=latest` 读取持久记录中按启动时间、任务 ID 降序的最近任务；也可指定真实 ID | job 状态、进度、未知/失败和 checkpoint 摘要；无任务时返回 404 |
+| `POST /api/aun/peer-backfill/{job_id}/resume` | `{}`；真实任务 ID，仅失败/部分完成/中断任务 | `{job_id, status}` |
+
+`observation` 返回本域聚合的 `pair_count`、`mutual_pair_count`、`pending_pair_count` 和 `at_or_over_limit_pair_count`，各项按有向 `(owner_aid, peer_aid)` 行计数；双向会话对应两行。它们按当前 Gateway 持久状态计算，不是消息投递/阅读统计。`incomplete` 和 `recording_failure_count` 报告当前 Gateway 进程的观察记录缺口，重启后计数重新开始。Gateway 可对该汇总短时缓存；AID 对明细查询始终分页回源。Console 上述 API 由后端代理到 Gateway 内部管理接口，要求管理员身份并审计；回填 `start/get/resume` 仅允许已认证且声明这些方法的 `aun_console` 服务连接调用，普通 SDK、其他服务模块及 federation 不可调用；跨域专用 `probe` 按第 10.3 节认证。配置 `mode=enforce` 且 `pending_limit` 缺失或非正整数时返回参数错误；列表 `page_size` 服务端上限固定为 100。状态查询不支持跨 Gateway 全网枚举，只查询本域持有的 owner 状态。
+
+## 10. 一次性历史互通回填
+
+### 10.1 触发与数据源
+
+回填由管理员在 Console 手动触发，执行一次对现存持久 P2P Inbox 的只读扫描；不周期执行、不改写消息、不读取 payload。Gateway 通过语言无关内部 RPC 请求本域 Message 服务按稳定快照水位/游标分批返回最小方向摘要：`from_aid`、`to_aid`、消息计数和时间范围。Message 服务自行读取自己的存储，不共享代码或数据库连接给 Gateway。
+
+内部扫描请求为 `{snapshot_id, cursor, limit}`，首个请求省略 snapshot/cursor 后由 Message 建立可续读快照；响应为 `{snapshot_id, next_cursor, done, scanned_rows, directions:[{from_aid,to_aid,message_count,first_at_ms,last_at_ms}]}`。`limit` 上限为 1000 个方向记录。Message 服务负责生成稳定扫描快照并保存紧凑方向摘要，快照分页期间不依赖跨请求数据库事务；Gateway 持久化 snapshot_id 和 next_cursor 后再请求下一页。快照在任务完成/取消后释放，过期快照只能从头重新扫描并创建新 job attempt。内部方法只授权 Gateway service identity，不加入客户端 RPC 或 federation relay 白名单。内部 scan 处理预算为 5 分钟，Gateway 等待预算为 302 秒；该预算只用于手动回填扫描。
+
+扫描只覆盖当前 Message 存储仍保留的持久 Inbox。volatile 消息、已按 TTL/保留策略清理的消息、历史部署未保留的记录不可恢复。
+
+### 10.2 同域互通判定
+
+对每个有向 AID 对统计至少一条有效入站记录。只有 `A→B` 与 `B→A` 两个方向都被同一域扫描结果证明时，才把双方 owner 行标记为互通；同时设置两个方向标记，pending 置 0，来源标记为 `backfill`。只有单方向证据时，按可证明的入站数回填 pending，不推断对方曾回复。
+
+回填按关系摘要合并：未互通时 pending 取当前值与历史入站计数的较大值，重复扫描不累加；确认互通后清零。已存在的 `live` 互通不可降级，拒绝状态不得被回填覆盖。回填与实时流量重叠时不做逐消息对账，合并值是已知数量的下界，不保证等于历史计数与实时增量之和；由管理员结合观察结果决定是否启用限额。任务失败可从稳定游标续跑。
+
+### 10.3 跨域互通探测
+
+同一对跨域 AID 的两个方向可能分别保存在发送目标所在域的 Inbox，单域扫描不能证明双向。对本域 Inbox 中出现的跨域候选对，Gateway 按 peer issuer 对远端 Gateway 发起受双向认证的批量内部探测；远端 Message 服务仅回答其本地域 Inbox 是否存在 `local_owner→remote_peer` 的持久消息，不返回消息正文或全量联系人。请求只能查询本次本域扫描发现的候选对，并校验请求方 issuer 与消息发送方 issuer 相符。探测由回填 Worker 的内部链路发起，通用服务转发及批量转发出口不开放该方法。
+
+探测请求为 `{job_id, pairs:[{local_owner_aid,remote_peer_aid}]}`，单批最多 100 对；响应对每对返回 `reverse_inbox_exists: true|false|unknown`。双方消息只通过 AID issuer 路由到远域，认证上下文与 pairs 内 issuer 必须一致。远端响应不含消息数、时间、message ID 或 payload。
+
+远端不可达、不支持探测、数据已过保留期或校验不匹配时，候选状态记为 `unknown` 并写入任务报告，不得假定为互通。每个域必须分别完成本地管理员触发的回填；跨域探测只补齐能由双方保留数据证明的配对。
+
+### 10.4 可证明性边界
+
+回填能证明“当前保留数据中存在双向消息”，不能证明已清理历史的完整性。跨域双方必须都能应答，才可标记互通。Console 必须报告扫描水位、保留范围、已扫描方向的 `scan_first_at_ms/scan_last_at_ms`、远端不可达域和未知数；不能把“回填完成”表述成“历史互通关系全量恢复”。若未知关系在 enforce 后重新联系，服务端将按新观察到的状态处理，并可能适用额度。这是只保留收件箱数据时无法消除的边界；不得通过单向消息猜测互通，以免错误豁免陌生人额度。
+
+## 11. 发布顺序
+
+1. 部署 Gateway 状态表、缓存和实时记录逻辑，陌生人额度模式默认 `observe`；管理员显式配置本轮初始 `pending_limit=5`，拒绝/屏蔽 RPC 和拒收检查可启用。
+2. 管理员在 Console 手动运行一次回填，查看完成、失败和未知报告；失败可手动续跑。
+3. 任务完成后继续 `observe`，观察期不执行测试；Console 持续展示新增 AID 对、pending 计数、互通比例和限额超限候选统计，但不拒绝陌生人消息。观察期由运维安排，到时管理员手动切换。
+4. 管理员在 Console 确认回填/观察结果，包括未知关系数和 `at_or_over_limit_pair_count`，并显式切换到 `enforce`。此开关不因服务重启自行打开；缺失配置默认为 `observe`。
+5. 出现误伤时可手动切回 `observe`；保留互通和拒绝状态，不执行数据回滚。拒绝/屏蔽依然有效。
+
+## 12. 失败处理与兼容
+
+- 状态表迁移失败时 Gateway 不得报告策略能力就绪或接受 P2P 路由；缺省策略只有在存储可用且确认没有配置记录时才初始化为 observe，拒绝 RPC 返回明确服务不可用。
+- enforce 下状态事务失败、锁超时或缓存失效依赖不可用时，不向 Message 或远端 Gateway 转发，返回可重试错误；不以“默认允许”绕过额度或屏蔽。
+- observe 下拒绝状态读取成功但陌生人计数写入失败时，允许既有 P2P 路由继续并在 Console/健康状态中暴露观察数据不完整；拒绝状态读取失败仍按服务不可用拒绝转发。
+- 旧 SDK 不调用新 RPC 时行为不变；新 RPC 不可用时 SDK 返回 Method not found，不静默在客户端维护另一份服务器状态。
+- 群申请继续由 Group 的 pending 队列和 `max_pending` 处理；不受 P2P 开关影响。
+
+## 13. 安全与隐私
+
+- 所有状态以 Gateway 认证身份绑定；不能通过 RPC 指定任意 owner。
+- 拒绝/屏蔽是单向的，仅 owner 可设置/解除/查询；发送方不能查询自己是否在对方名单。
+- 拒绝状态不发事件、不发邮件、不撤销连接、不影响对方其他 AID。
+- backfill 跨域探测要求 Gateway 双向认证，只返回候选关系是否有反向 Inbox 记录；限制批大小和频率，不接收任意 AID 枚举。
+- Console 状态查询、配置和回填操作要求管理员认证并审计；记录不含消息正文、payload、密钥或凭证。
+
+## 14. 验收标准
+
+实现与测试验收必须通过：陌生人额度 N/N+1 边界、双向互通豁免、拒绝状态覆盖互通、并发上限、状态持久化和缓存一致性；回填幂等/断点续跑/同域双向/单向 pending/跨域探测成功与未知报告；默认 observe、手动切换 enforce/回退 observe 的功能；本人拒绝 RPC 权限与不通知对端；Console 策略、状态查询、分页和回填流程；单域、跨域及旧 SDK 兼容测试。实际观察期不执行测试，管理员到时手动切换属于后续运维操作，不纳入本轮测试门禁。
+
+## 15. 已冻结参数与运行约定
+
+1. 用户已确认 `stranger_pending_limit/pending_limit` 初始配置为 `5`，由管理员显式配置，作为本轮环境基线；测试使用显式配置值覆盖边界。
+2. 观察期不执行测试，也不自动定时结束；管理员到时根据 Console 报告手动切换 `enforce`，实际观察和切换不纳入本轮测试门禁。
+3. backfill 只对现存 Inbox 及远端可应答的数据作确定性结论；未知关系量必须在启用 enforce 前展示并由管理员知悉。
+4. RPC 名称、错误码和管理 API 路径以第 5.3、8、9 节为实施契约；状态服务不可用沿用 `-32603`，不占用会话初始化的 `-32013`。

package/dist/agent-md-schema.js

@@ -35,7 +35,7 @@ function parseFileFrontmatterInternal(payload, validateOwnership, forUpload = fa
     });
     if (doc.warnings.length)
         throw new ValidationError(`agent.md frontmatter is invalid: ${doc.warnings[0].message}`);
-    if (validateOwnership && !(forUpload && ['group', 'org'].includes(String(doc.get('type')))))
+    if (validateOwnership)
         for (const [section, fields] of [['statement', ['version', 'relation_version', 'declared_at']], ['transfer', ['target_relation_version', 'expires_at']]]) {
             for (const field of fields) {
                 const node = doc.getIn(['ownership', section, field], true);
@@ -70,7 +70,7 @@ function validateAgentMdDocumentInternal(content, opts) {
     const bare = opts.readCompatibility && parsed.payload.replace(/^\ufeff/, '').split(/\r\n|\n|\r/, 1)[0]?.trim() !== '---';
     const meta = bare ? {} : parseFileFrontmatterInternal(parsed.payload, !opts.readCompatibility && (opts.forUpload || (opts.validateOwnership ?? true)), opts.forUpload);
     const legacyEntity = meta.type === 'group' && parsed.signatures.length === 1 && !Object.hasOwn(meta, 'entity_cert_fingerprint') && (parsed.fields?.signer_aid === undefined || aidEqual(parsed.fields.signer_aid, meta.aid));
-    if (opts.readCompatibility && ['group', 'org'].includes(String(meta.type)) && !legacyEntity)
+    if (opts.readCompatibility && ['group', 'org'].includes(String(meta.type)) && !Object.hasOwn(meta, 'ownership') && !legacyEntity)
         return validateAgentMdDocumentInternal(content, { ...opts, readCompatibility: false, historicalEntityOwner: parsed.signatures.length === 1 && parsed.fields?.signer_aid !== undefined && aidEqual(parsed.fields.signer_aid, meta.owner) && !aidEqual(parsed.fields.signer_aid, meta.aid) });
     for (const key of opts.readCompatibility ? [] : ['aid', 'name', 'type', 'version'])
         if (!(key in meta))
@@ -104,7 +104,8 @@ function validateAgentMdDocumentInternal(content, opts) {
     const human = String(meta.type ?? '').trim().toLowerCase() === 'human';
     if (human && ['owner', 'ownership', 'ownership_proof', 'ownership_release'].some(field => Object.hasOwn(meta, field)))
         throw new ValidationError('human AID cannot specify owner or ownership');
-    if (entity) {
+    const modernEntity = entity && Object.hasOwn(meta, 'ownership');
+    if (entity && !modernEntity) {
         if (opts.forUpload) {
             if (!Object.hasOwn(meta, 'owner'))
                 throw new ValidationError('group/org agent.md requires owner');
@@ -136,15 +137,15 @@ function validateAgentMdDocumentInternal(content, opts) {
     if (fields) {
         if (Object.keys(fields).some((key) => !['cert_fingerprint', 'public_key_fingerprint', 'timestamp', 'signature', 'signer_aid'].includes(key)))
             throw new ValidationError('agent.md signature contains unknown fields');
-        if (entity && !opts.readCompatibility && fields.signer_aid === undefined)
+        if (entity && !modernEntity && !opts.readCompatibility && fields.signer_aid === undefined)
             throw new ValidationError('group/org agent.md main signature requires signer_aid');
-        if (!entity && fields.signer_aid !== undefined)
+        if ((!entity || modernEntity) && fields.signer_aid !== undefined)
             throw new ValidationError('ordinary agent.md main signature contains unknown signer_aid');
         if (fields.signer_aid !== undefined && !aidEqual(fields.signer_aid, opts.historicalEntityOwner ? meta.owner : meta.aid))
             throw new ValidationError('agent.md main signer must be its own AID');
         if (entity && !opts.forUpload && !opts.historicalEntityOwner && Object.hasOwn(meta, 'entity_cert_fingerprint') && fields.cert_fingerprint !== meta.entity_cert_fingerprint)
             throw new ValidationError('entity signature certificate fingerprint does not match entity_cert_fingerprint', { stringCode: 'invalid' });
-        if (entity && parsed.signatures.slice(1).some(item => !aidEqual(item.fields.signer_aid, meta.owner)))
+        if (entity && !modernEntity && parsed.signatures.slice(1).some(item => !aidEqual(item.fields.signer_aid, meta.owner)))
             throw new ValidationError('group/org additional signer must be owner');
         const validFingerprint = (value) => opts.readCompatibility ? !!normalizeFingerprintHex(value) : /^sha256:[0-9a-f]{64}$/.test(value);
         if (!validFingerprint(fields.cert_fingerprint))

package/dist/agent-md-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-md-schema.js","sourceRoot":"","sources":["../src/agent-md-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,cAAc,EAAE,eAAe,EAAE,2BAA2B,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AACnK,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC/D,OAAO,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,iCAAiC,EAAE,MAAM,oBAAoB,CAAC;AAEvE,MAAM,MAAM,GAAG,+DAA+D,CAAC;AAC/E,MAAM,SAAS,GAAG,iBAAiB,CAAC;AACpC,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAEjD,SAAS,QAAQ,CAAC,IAAa,EAAE,KAAc;IAC7C,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;AAC7G,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;QAC3F,MAAM,IAAI,eAAe,CAAC,mCAAmC,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,4BAA4B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,4BAA4B,CAAC,OAAe,EAAE,iBAA0B,EAAE,SAAS,GAAG,KAAK;IAClG,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK;QAAE,MAAM,IAAI,eAAe,CAAC,2CAA2C,CAAC,CAAC;IACvG,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,CAAC;IACtE,IAAI,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,oCAAoC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,eAAe,CAAC,oCAAoC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/G,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,8CAA8C,CAAC,CAAC;IACrM,CAAC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,eAAe,CAAC,oCAAoC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACnH,IAAI,iBAAiB,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAAE,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC,CAAU,EAAE,CAAC;YAC/P,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;gBAC5D,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;oBAAE,MAAM,IAAI,eAAe,CAAC,aAAa,OAAO,IAAI,KAAK,sBAAsB,CAAC,CAAC;YACzL,CAAC;QACH,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,wCAAwC,CAAC,CAAC;IACxI,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,OAAuJ,EAAE;IAChN,OAAO,+BAA+B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAAe,EAAE,OAAqG,EAAE;IAClK,OAAO,+BAA+B,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;AAClH,CAAC;AAED,SAAS,+BAA+B,CAAC,OAAe,EAAE,IAAkN;IAC1Q,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,eAAe,CAAC,kCAAkC,CAAC,CAAC;IACjG,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAClF,IAAI,MAAM,CAAC,UAAU;QAAE,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACpE,IAAI,IAAI,CAAC,gBAAgB,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,eAAe,CAAC,gCAAgC,CAAC,CAAC;IACzG,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,qCAAqC,CAAC,CAAC;IAC3J,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,GAAG,4BAA4B;QAAE,MAAM,IAAI,eAAe,CAAC,oCAAoC,4BAA4B,QAAQ,CAAC,CAAC;IACpQ,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,CAAC;IACzH,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,4BAA4B,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvK,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7N,IAAI,IAAI,CAAC,iBAAiB,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY;QAAE,OAAO,+BAA+B,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzX,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC;QAAE,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAC;IACzK,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,6CAA6C,CAAC,CAAC;IAClM,IAAI,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,eAAe,CAAC,mDAAmD,CAAC,CAAC;IAC/M,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;QAAE,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,wBAAwB,GAAG,6BAA6B,CAAC,CAAC;IACtO,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,mDAAmD,CAAC,CAAC;IAC1M,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,mDAAmD,CAAC,CAAC;QACzH,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,eAAe,CAAC,6CAA6C,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,8CAA8C,CAAC,CAAC;QAC/G,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,eAAe,CAAC,wCAAwC,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,SAAS,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,eAAe,CAAC,+CAA+C,CAAC,CAAC;IACtI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,2CAA2C,CAAC,CAAC;IACzL,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;IACvE,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,6CAA6C,CAAC,CAAC;IAChM,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,mCAAmC,CAAC,CAAC;QACpG,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,mCAAmC,CAAC,CAAC;YAC9L,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,uBAAuB,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,qDAAqD,CAAC,CAAC;QACzR,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,6CAA6C,CAAC,CAAC;IACjO,CAAC;SAAM,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,EAAE,CAAC;QAC9D,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,oEAAoE,CAAC,CAAC;QAChP,IAAI,WAAW,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC;YAAE,iCAAiC,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;aACjI,CAAC;YACJ,4BAA4B,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACrD,IAAI,IAAI,CAAC,SAAS,IAAI,iBAAiB,IAAI,IAAI,EAAE,CAAC;gBAChD,MAAM,KAAK,GAAG,IAAI,CAAC,eAA0C,CAAC;gBAC9D,IAAI,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,mBAAmB,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,KAAK,CAAC;oBAAE,MAAM,IAAI,eAAe,CAAC,qDAAqD,CAAC,CAAC;YACtN,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,EAAE,wBAAwB,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,4CAA4C,CAAC,CAAC;QACtN,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;YAAE,MAAM,IAAI,eAAe,CAAC,uDAAuD,CAAC,CAAC;QAC7J,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;YAAE,MAAM,IAAI,eAAe,CAAC,8DAA8D,CAAC,CAAC;QAC1I,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,0CAA0C,CAAC,CAAC;QAC/L,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,qBAAqB,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,yBAAyB,CAAC,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC,uBAAuB;YAAE,MAAM,IAAI,eAAe,CAAC,iFAAiF,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QACpT,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,2CAA2C,CAAC,CAAC;QAC7K,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5I,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,sCAAsC,CAAC,CAAC;QAClH,IAAI,wBAAwB,IAAI,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,sBAAsB,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,4CAA4C,CAAC,CAAC;QACpK,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,uCAAuC,CAAC,CAAC;QACjR,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3F,IAAI,EAAE,GAAG,GAAG,GAAG,GAAG;YAAE,MAAM,IAAI,eAAe,CAAC,uDAAuD,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,OAAe,EAAE,WAAmB,EAAE,GAAY,EAAE,mBAAqF;IAC5L,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,OAAe,EAAE,WAAmB,EAAE,GAAY,EAAE,mBAAqF;IAChM,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,2BAA2B,CAAC,OAAe,EAAE,OAAe,EAAE,WAAmB,EAAE,GAAuB,EAAE,iBAA0B,EAAE,mBAAqF;IACpO,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClI,MAAM,MAAM,GAAG,MAAM,CAAC,SAAU,CAAC;IACjC,MAAM,MAAM,GAAG,WAAW,CAAC;IAC3B,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;QACpE,GAAG;QACH,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,eAAe,CAAC,2CAA2C,CAAC,CAAC;IACpK,IAAI,MAAM,CAAC,sBAAsB,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,MAAM,CAAC,sBAAsB,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,0CAA0C,CAAC,CAAC;IACjL,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC3I,IAAI,CAAC,QAAQ,CAAC,KAAK;QAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,IAAI,wCAAwC,CAAC,CAAC;AAC9G,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAe,EACf,WAAmB,EACnB,SAAiB,EACjB,OAAwF,EAAE;IAE1F,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,SAAS,CAAC,iBAAiB,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,oBAAoB,EAAE,UAAU,KAAK,YAAY,EAAE,CAAC;QAClH,MAAM,IAAI,eAAe,CAAC,6CAA6C,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,yCAAyC,CAAC,CAAC;IAC5I,IAAI,CAAC,IAAI,CAAC,sBAAsB,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,GAAG,QAAQ,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,0DAA0D,CAAC,CAAC;IAC5L,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,yDAAyD,CAAC,CAAC;IAC1M,IAAI,SAAS,GAAG,SAAS,IAAI,SAAS,GAAG,QAAQ;QAAE,MAAM,IAAI,eAAe,CAAC,8DAA8D,CAAC,CAAC;AAC/I,CAAC"}
+{"version":3,"file":"agent-md-schema.js","sourceRoot":"","sources":["../src/agent-md-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,cAAc,EAAE,eAAe,EAAE,2BAA2B,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AACnK,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC/D,OAAO,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,iCAAiC,EAAE,MAAM,oBAAoB,CAAC;AAEvE,MAAM,MAAM,GAAG,+DAA+D,CAAC;AAC/E,MAAM,SAAS,GAAG,iBAAiB,CAAC;AACpC,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAEjD,SAAS,QAAQ,CAAC,IAAa,EAAE,KAAc;IAC7C,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;AAC7G,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,OAAO,EAAE,CAAC;QAC3F,MAAM,IAAI,eAAe,CAAC,mCAAmC,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,4BAA4B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,4BAA4B,CAAC,OAAe,EAAE,iBAA0B,EAAE,SAAS,GAAG,KAAK;IAClG,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK;QAAE,MAAM,IAAI,eAAe,CAAC,2CAA2C,CAAC,CAAC;IACvG,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,CAAC;IACtE,IAAI,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,oCAAoC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,eAAe,CAAC,oCAAoC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/G,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,8CAA8C,CAAC,CAAC;IACrM,CAAC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,eAAe,CAAC,oCAAoC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACnH,IAAI,iBAAiB;QAAE,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC,CAAU,EAAE,CAAC;YACzL,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;gBAC5D,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;oBAAE,MAAM,IAAI,eAAe,CAAC,aAAa,OAAO,IAAI,KAAK,sBAAsB,CAAC,CAAC;YACzL,CAAC;QACH,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,wCAAwC,CAAC,CAAC;IACxI,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,OAAuJ,EAAE;IAChN,OAAO,+BAA+B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAAe,EAAE,OAAqG,EAAE;IAClK,OAAO,+BAA+B,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;AAClH,CAAC;AAED,SAAS,+BAA+B,CAAC,OAAe,EAAE,IAAkN;IAC1Q,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,eAAe,CAAC,kCAAkC,CAAC,CAAC;IACjG,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAClF,IAAI,MAAM,CAAC,UAAU;QAAE,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACpE,IAAI,IAAI,CAAC,gBAAgB,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,eAAe,CAAC,gCAAgC,CAAC,CAAC;IACzG,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,qCAAqC,CAAC,CAAC;IAC3J,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,GAAG,4BAA4B;QAAE,MAAM,IAAI,eAAe,CAAC,oCAAoC,4BAA4B,QAAQ,CAAC,CAAC;IACpQ,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,CAAC;IACzH,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,4BAA4B,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvK,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7N,IAAI,IAAI,CAAC,iBAAiB,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,YAAY;QAAE,OAAO,+BAA+B,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9Z,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC;QAAE,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAC;IACzK,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,6CAA6C,CAAC,CAAC;IAClM,IAAI,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,eAAe,CAAC,mDAAmD,CAAC,CAAC;IAC/M,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;QAAE,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,wBAAwB,GAAG,6BAA6B,CAAC,CAAC;IACtO,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,mDAAmD,CAAC,CAAC;IAC1M,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,mDAAmD,CAAC,CAAC;QACzH,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,eAAe,CAAC,6CAA6C,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,8CAA8C,CAAC,CAAC;QAC/G,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,eAAe,CAAC,wCAAwC,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,SAAS,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,eAAe,CAAC,+CAA+C,CAAC,CAAC;IACtI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,2CAA2C,CAAC,CAAC;IACzL,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;IACvE,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,6CAA6C,CAAC,CAAC;IAChM,MAAM,YAAY,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAChE,IAAI,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,mCAAmC,CAAC,CAAC;QACpG,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,mCAAmC,CAAC,CAAC;YAC9L,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,uBAAuB,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,qDAAqD,CAAC,CAAC;QACzR,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,6CAA6C,CAAC,CAAC;IACjO,CAAC;SAAM,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,EAAE,CAAC;QAC9D,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,oEAAoE,CAAC,CAAC;QAChP,IAAI,WAAW,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC;YAAE,iCAAiC,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;aACjI,CAAC;YACJ,4BAA4B,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACrD,IAAI,IAAI,CAAC,SAAS,IAAI,iBAAiB,IAAI,IAAI,EAAE,CAAC;gBAChD,MAAM,KAAK,GAAG,IAAI,CAAC,eAA0C,CAAC;gBAC9D,IAAI,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,mBAAmB,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,KAAK,CAAC;oBAAE,MAAM,IAAI,eAAe,CAAC,qDAAqD,CAAC,CAAC;YACtN,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,EAAE,wBAAwB,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,4CAA4C,CAAC,CAAC;QACtN,IAAI,MAAM,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;YAAE,MAAM,IAAI,eAAe,CAAC,uDAAuD,CAAC,CAAC;QAC9K,IAAI,CAAC,CAAC,MAAM,IAAI,YAAY,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;YAAE,MAAM,IAAI,eAAe,CAAC,8DAA8D,CAAC,CAAC;QAC5J,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,0CAA0C,CAAC,CAAC;QAC/L,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,qBAAqB,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,yBAAyB,CAAC,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC,uBAAuB;YAAE,MAAM,IAAI,eAAe,CAAC,iFAAiF,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QACpT,IAAI,MAAM,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,2CAA2C,CAAC,CAAC;QAC9L,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5I,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,sCAAsC,CAAC,CAAC;QAClH,IAAI,wBAAwB,IAAI,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,sBAAsB,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,4CAA4C,CAAC,CAAC;QACpK,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,uCAAuC,CAAC,CAAC;QACjR,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3F,IAAI,EAAE,GAAG,GAAG,GAAG,GAAG;YAAE,MAAM,IAAI,eAAe,CAAC,uDAAuD,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,OAAe,EAAE,WAAmB,EAAE,GAAY,EAAE,mBAAqF;IAC5L,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,OAAe,EAAE,WAAmB,EAAE,GAAY,EAAE,mBAAqF;IAChM,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,2BAA2B,CAAC,OAAe,EAAE,OAAe,EAAE,WAAmB,EAAE,GAAuB,EAAE,iBAA0B,EAAE,mBAAqF;IACpO,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClI,MAAM,MAAM,GAAG,MAAM,CAAC,SAAU,CAAC;IACjC,MAAM,MAAM,GAAG,WAAW,CAAC;IAC3B,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;QACpE,GAAG;QACH,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,eAAe,CAAC,2CAA2C,CAAC,CAAC;IACpK,IAAI,MAAM,CAAC,sBAAsB,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,MAAM,CAAC,sBAAsB,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,0CAA0C,CAAC,CAAC;IACjL,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC3I,IAAI,CAAC,QAAQ,CAAC,KAAK;QAAE,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,IAAI,wCAAwC,CAAC,CAAC;AAC9G,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAe,EACf,WAAmB,EACnB,SAAiB,EACjB,OAAwF,EAAE;IAE1F,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,SAAS,CAAC,iBAAiB,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,oBAAoB,EAAE,UAAU,KAAK,YAAY,EAAE,CAAC;QAClH,MAAM,IAAI,eAAe,CAAC,6CAA6C,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,yCAAyC,CAAC,CAAC;IAC5I,IAAI,CAAC,IAAI,CAAC,sBAAsB,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,GAAG,QAAQ,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,0DAA0D,CAAC,CAAC;IAC5L,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,yDAAyD,CAAC,CAAC;IAC1M,IAAI,SAAS,GAAG,SAAS,IAAI,SAAS,GAAG,QAAQ;QAAE,MAAM,IAAI,eAAe,CAAC,8DAA8D,CAAC,CAAC;AAC/I,CAAC"}

package/dist/agent-md.d.ts

@@ -80,6 +80,7 @@ export interface AgentMdManagerOptions {
     currentAidGetter?: () => AID | null | undefined;
     entityIdentityGetter?: (aid: string, type?: string) => Promise<AID> | AID;
     entityOwnerResolver?: (aid: string, type: string) => Promise<string> | string;
+    sourceGuard?: () => void;
     entitySignerResolver?: (aid: string, fingerprint: string) => Promise<AID> | AID;
     gatewayResolver?: (aid: string) => Promise<string> | string;
     peerResolver?: (aid: string, certFingerprint?: string | null, signedAt?: number) => Promise<AID> | AID;
@@ -98,6 +99,7 @@ export declare class AgentMdManager {
     private _ownerAidGetter?;
     private _entityIdentityGetter?;
     private _entityOwnerResolver?;
+    private _sourceGuard?;
     private _entitySignerResolver?;
     private _currentAidGetter?;
     private _gatewayResolver?;

package/dist/agent-md.js

@@ -13,6 +13,7 @@ import { AUNError, ClientSignatureError, NotFoundError, StateError, ValidationEr
 import { isJsonObject } from './types.js';
 import { ownershipAid, ownershipFailure, parseOwnershipFile } from './ownership-v21.js';
 import { resultOk } from './result.js';
+import { INVALID_AID_FORMAT } from './error-codes.js';
 const DEFAULT_HTTP_TIMEOUT_MS = 30_000;
 function relationshipFields(meta) {
     return Object.fromEntries(['owner', 'ownership', 'ownership_proof', 'ownership_release'].filter((key) => Object.hasOwn(meta, key)).map((key) => [key, meta[key]]));
@@ -48,7 +49,7 @@ export function updateOwnershipAgentMd(content, fields) {
     document.delete('ownership_release');
     for (const [name, value] of Object.entries(fields))
         document.set(name, value);
-    const yamlText = document.toString().replace(/\r\n/g, '\n');
+    const yamlText = document.toString({ lineWidth: 0, blockQuote: 'literal' }).replace(/\r\n/g, '\n');
     const updated = `${payload.startsWith('\ufeff') ? '\ufeff' : ''}---\n${yamlText.endsWith('\n') ? yamlText : `${yamlText}\n`}---${match[2]}`;
     validateAgentMdDocument(updated, { expectedAid: String(frontmatter.aid ?? '') });
     return updated;
@@ -203,6 +204,7 @@ export class AgentMdManager {
     _ownerAidGetter;
     _entityIdentityGetter;
     _entityOwnerResolver;
+    _sourceGuard;
     _entitySignerResolver;
     _currentAidGetter;
     _gatewayResolver;
@@ -218,9 +220,13 @@ export class AgentMdManager {
     _httpHandler = null;
     setHttpHandler(handler) { this._httpHandler = handler; }
     async _requestText(url, opts) {
+        if (opts.method === 'PUT')
+            this._sourceGuard?.();
         if (!this._httpHandler)
             return requestText(url, opts);
         const perform = async () => {
+            if (opts.method === 'PUT')
+                this._sourceGuard?.();
             const result = await requestText(url, opts);
             return new Response(opts.method === 'HEAD' || [204, 205, 304].includes(result.status) ? null : result.text, { status: result.status, headers: result.headers });
         };
@@ -238,6 +244,7 @@ export class AgentMdManager {
         this._ownerAidGetter = opts.ownerAidGetter;
         this._entityIdentityGetter = opts.entityIdentityGetter;
         this._entityOwnerResolver = opts.entityOwnerResolver;
+        this._sourceGuard = opts.sourceGuard;
         this._entitySignerResolver = opts.entitySignerResolver;
         this._currentAidGetter = opts.currentAidGetter;
         this._gatewayResolver = opts.gatewayResolver;
@@ -263,7 +270,7 @@ export class AgentMdManager {
     safeAid(aid) {
         const target = String(aid ?? '').trim();
         if (!target || target.includes('/') || target.includes('\\') || target.includes('\0')) {
-            throw new ValidationError('agent.md aid is empty or contains path separators');
+            throw new ValidationError('agent.md aid is empty or contains path separators', { stringCode: INVALID_AID_FORMAT });
         }
         this._aidValidator?.(target);
         return target;
@@ -295,7 +302,9 @@ export class AgentMdManager {
                 loaded.local_etag = AgentMdManager.contentEtag(content);
             }
             catch (err) {
-                if (fs.existsSync(this.metaPath(target))) {
+                delete loaded.content;
+                delete loaded.local_etag;
+                if (err?.code !== 'ENOENT' && fs.existsSync(this.metaPath(target))) {
                     this._log.warn(`agent.md content read failed: aid=${target} err=${err instanceof Error ? err.message : String(err)}`);
                 }
             }
@@ -392,8 +401,14 @@ export class AgentMdManager {
             }
             else {
                 const current = this._loadRecord(target, strict);
-                if (current && typeof current.content === 'string')
+                if (current && typeof current.content === 'string') {
                     loaded.content = current.content;
+                    loaded.local_etag = current.local_etag;
+                }
+                else {
+                    delete loaded.content;
+                    delete loaded.local_etag;
+                }
             }
             this._cache.set(target, { ...loaded });
             return { ...loaded };
@@ -508,8 +523,6 @@ export class AgentMdManager {
             }
             catch { }
         }
-        if (['group', 'org'].includes(String(type)))
-            throw ownershipFailure('not_applicable', 'group/org uses its lifecycle owner relationship');
         const protocol = headerValue(response.headers, 'X-AUN-Ownership-Protocol');
         if (protocol !== '2.1')
             throw ownershipFailure('unsupported_protocol', 'NS does not provide Ownership 2.1 metadata');
@@ -670,7 +683,7 @@ export class AgentMdManager {
                 if (pending.content_etag !== AgentMdManager.contentEtag(pending.content))
                     throw ownershipFailure('persistence_unavailable', 'pending entity original bytes are corrupt');
                 await this._verifyDocument(pending.content, aid, identity, true);
-                const remote = await this._readEntityFresh(aid);
+                const remote = meta.ownership ? await this.readAgentMdFresh(aid) : await this._readEntityFresh(aid);
                 if (remote.exists && remote.content === pending.content && remote.etag === pending.content_etag) {
                     const saved = await this._saveCommittedRecord(aid, { content: pending.content, remote_etag: remote.etag, pending_operation: '', pending_content: '', pending_content_etag: '', pending_error: '', pending_condition: {}, pending_relation: {}, pending_authorization: '' });
                     if (!saved.aid)
@@ -729,7 +742,7 @@ export class AgentMdManager {
         let condition = originalCondition;
         let relation = entityContext ?? (this._pendingUpload(target, draftStrict))?.relation;
         if (!condition) {
-            const fresh = entity ? await this._readEntityFresh(target) : await this._readBodyOriginalFresh(target);
+            const fresh = entity ? await this.readAgentMdFresh(target) : await this._readBodyOriginalFresh(target);
             condition = fresh.exists ? { if_match: fresh.etag } : { if_none_match: '*' };
             if (!entity) {
                 // 锁未知时按 locked 处理：关系字段必须与原件完全一致
@@ -942,7 +955,7 @@ export class AgentMdManager {
             throw ownershipFailure('unavailable', 'entity current certificate is unavailable', true);
         if (observed && observed.entity_cert_fingerprint !== entity.certFingerprint)
             throw ownershipFailure('conflict', 'entity authority changed during verification');
-        if (meta.entity_cert_fingerprint !== entity.certFingerprint)
+        if (meta.entity_cert_fingerprint !== undefined && meta.entity_cert_fingerprint !== entity.certFingerprint)
             throw ownershipFailure('conflict', 'entity agent.md certificate generation changed');
         return { type: meta.type, owner_aid: owner, entity_cert_fingerprint: entity.certFingerprint };
     }
@@ -977,6 +990,7 @@ export class AgentMdManager {
         const entity = ['group', 'org'].includes(String(meta.type));
         const uploadHeaders = {
             'X-AUN-Signature-Format': 'multi-v1',
+            ...(entity && meta.ownership ? { 'X-AUN-Ownership-Check': '1' } : {}),
             'Content-Type': 'text/markdown; charset=utf-8',
             ...(condition.if_match ? { 'If-Match': condition.if_match } : { 'If-None-Match': '*' }),
             ...(this._uploadViaGatewayHost ? { Host: target } : {}),
@@ -1388,7 +1402,16 @@ export class AgentMdManager {
             throw new ClientSignatureError(`agent.md verification failed for ${target}${reason ? `: ${reason}` : ''}`, entity ? { stringCode: 'invalid' } : {});
         }
         let ownershipStatus;
-        if (entity)
+        if (Object.hasOwn(frontmatter, 'ownership')) {
+            try {
+                parseOwnershipFile(content, 'agent', { expectedSubAid: target });
+                ownershipStatus = 'incomplete';
+            }
+            catch {
+                ownershipStatus = 'invalid';
+            }
+        }
+        else if (entity)
             ownershipStatus = 'not_applicable';
         else {
             try {