@dharma-ai-labs/agent-fabric 0.2.109 → 0.2.111

package/README.md

@@ -31,6 +31,47 @@ is sent. An acknowledged message proves delivery, not that the recipient agent
 used or correctly applied the answer. The Demo peer transport is separate from
 the signed package, knowledge, Atlas, and autonomous-update readiness gates.
 
+## Signing Upgrade Proof Preparation
+
+For a reviewed Demo signing-consumer upgrade, an operator supplies the bounded
+`dharma.signing-upgrade-context/v1` review JSON for the exact organization and
+repository. It identifies the candidate, predecessor, installed preload hash,
+unchanged original-client inventory, current and requested consumer versions,
+and a proof expiry no more than 15 minutes away. This file is a review request,
+not authorization. Never put a grant, credential or private key in it.
+
+```bash
+dharma demo signing-client-proof --organization-id <org> --repository-id <repo> --normalized-repository <normalized-remote> --review-context <review.json>
+dharma demo signing-client-proof --organization-id <org> --repository-id <repo> --normalized-repository <normalized-remote> --review-context <review.json> --submit
+dharma demo signing-owner-proof --organization-id <org> --repository-id <repo> --normalized-repository <normalized-remote> --review-context <review.json>
+```
+
+`--submit` records only an original enrolled client's signing-upgrade proof. It
+uses the existing device key and still-valid protected preload, verifies the
+exact server receipt, and preserves the same pending proof for a grant-free
+retry after a lost response. Run the same command with the same review context
+to resume; do not delete the pending proof or change trust files. A recorded
+proof is not activation. Owner proofs still require explicit ordinary-session
+browser review; `signing-owner-proof --submit` is rejected. Expired trust requires
+browser-authorized re-enrollment, not a locally extended anchor.
+
+Both commands verify the current Git remote, use the existing enrolled device
+and protected, still-valid preload, and read versions from the actual installed
+CLI/contracts packages. `--dry-run` verifies the repository scope and reports
+only a plan; it does not attest installed trust or issue a signature.
+
+Without `--submit`, the JSON result has `stage: "proof_prepared"` and
+`submitted: false`. It contains
+the device signature and source hash, not enrollment credentials. Preparing an
+owner proof does not prove owner authority or approve rotation: the current
+owner must separately review and confirm it in the ordinary browser session.
+The server must independently check current access, preload and inventory for
+every submitted source and final registration. Only client `--submit` sends the
+proof. Neither command rotates or activates keys, extends trust, replaces an original client, alters
+financial records, or bypass browser approval. Missing OS credentials or a
+missing protected signing anchor fail without recreating them. Expired trust requires supported
+browser-authorized re-enrollment, never editing local trust files.
+
 ## Autonomous organization setup
 
 Requires Node.js 22.20.0 through 24.x.

package/dist/codexInboxSession.d.ts

@@ -20,7 +20,7 @@ export declare function openCodexInboxSession(input: Parameters<typeof openCodex
         questionId: string;
         taskId: string;
         completionHash: string;
-        reasonCode: "content_or_contract_blocked" | "receipt_invalid" | "delivery_unconfirmed";
+        reasonCode: "receipt_invalid" | "content_or_contract_blocked" | "delivery_unconfirmed";
         replyReceiptHash?: undefined;
         correlationId?: undefined;
     } | {

package/dist/cooperativeInboxSession.d.ts

@@ -42,7 +42,7 @@ export declare function openCooperativeInboxSession(input: {
         questionId: string;
         taskId: string;
         completionHash: string;
-        reasonCode: "content_or_contract_blocked" | "receipt_invalid" | "delivery_unconfirmed";
+        reasonCode: "receipt_invalid" | "content_or_contract_blocked" | "delivery_unconfirmed";
         replyReceiptHash?: undefined;
         correlationId?: undefined;
     } | {

package/dist/demoDeviceTransport.d.ts

@@ -0,0 +1,33 @@
+import { type SecureSecretStore } from '@dharma-ai-labs/agent-fabric-relay-client';
+import { type DemoDeviceScope } from './demoEnrollment.js';
+export declare function createDemoDeviceTransport(input: DemoDeviceScope, deps?: {
+    store?: SecureSecretStore;
+    fetcher?: typeof fetch;
+}): Promise<{
+    store: SecureSecretStore;
+    fetcher: typeof fetch;
+    connectTransport: (target: string) => Promise<{
+        ok: boolean;
+        stage: "demo_transport_verified";
+        enrolled: boolean;
+        duplicate: boolean;
+        deviceId: string;
+        repositoryId: string;
+        transportOrigin: string;
+        expiresAt: string;
+        resumed: boolean;
+        correlationId?: undefined;
+    } | {
+        ok: boolean;
+        stage: "demo_transport_verified";
+        enrolled: boolean;
+        duplicate: boolean;
+        deviceId: string;
+        repositoryId: string;
+        transportOrigin: string;
+        expiresAt: string;
+        correlationId: string;
+        resumed: boolean;
+    }>;
+}>;
+//# sourceMappingURL=demoDeviceTransport.d.ts.map

package/dist/demoDeviceTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"demoDeviceTransport.d.ts","sourceRoot":"","sources":["../src/demoDeviceTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8C,KAAK,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAG/H,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAWjF,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,eAAe,EACpE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;CAAO;;;+BAuBxB,MAAM;;;;;;;;;;;;;;;;;;;;;;;GAY/C"}

package/dist/demoDeviceTransport.js

@@ -0,0 +1,52 @@
+import { loadOrCreateDeviceIdentity, normalizeHqUrl } from '@dharma-ai-labs/agent-fabric-relay-client';
+import { createSystemSecureStore } from '@dharma-ai-labs/agent-fabric-secure-store';
+import { sign } from 'node:crypto';
+import { loadDemoSigningTrust } from './demoEnrollment.js';
+import { createDemoTransportFetcher } from './demoTransportFetch.js';
+import { requestDemoTransportContinuity } from './demoTransportRequest.js';
+function immutableIdentity() {
+    throw Object.assign(new Error('Demo transport requires existing_protected_state_required. Preserve the original enrollment.'), { code: 'demo_transport_existing_protected_state_required' });
+}
+// Invoke within withDemoDeviceLock. Keep all config paths and private-key
+// accounts on the original enrollment origin, even when HTTP moves elsewhere.
+export async function createDemoDeviceTransport(input, deps = {}) {
+    const scope = structuredClone(input), enrollmentOrigin = normalizeHqUrl(scope.hqUrl);
+    const store = deps.store ?? await createSystemSecureStore();
+    const fresh = (account) => store.getFresh ? store.getFresh(account) : store.get(account);
+    const readOnly = { backend: store.backend, get: fresh, getFresh: fresh,
+        async put() { immutableIdentity(); }, async delete() { immutableIdentity(); } };
+    const identity = await loadOrCreateDeviceIdentity({ hqUrl: enrollmentOrigin,
+        organizationId: `${scope.organizationId}:${scope.repositoryId}`, installationId: scope.installationId, store: readOnly });
+    const operationStore = { backend: store.backend, get: fresh, getFresh: fresh,
+        async put(account, value) { if (account === identity.account)
+            immutableIdentity(); await store.put(account, value); },
+        async delete(account) { if (account === identity.account)
+            immutableIdentity(); await store.delete(account); } };
+    const initial = await loadDemoSigningTrust(scope, { store: operationStore });
+    const loadBinding = async (protectedStore) => {
+        const trust = await loadDemoSigningTrust(scope, { store: protectedStore });
+        const currentIdentity = await loadOrCreateDeviceIdentity({ hqUrl: enrollmentOrigin,
+            organizationId: `${scope.organizationId}:${scope.repositoryId}`,
+            installationId: scope.installationId, store: protectedStore });
+        if (trust.deviceId !== initial.deviceId || currentIdentity.publicKeyEd25519 !== identity.publicKeyEd25519)
+            immutableIdentity();
+        return { organizationId: scope.organizationId, repositoryId: scope.repositoryId,
+            deviceId: trust.deviceId, installationId: scope.installationId,
+            publicKeyEd25519: currentIdentity.publicKeyEd25519, enrollmentOrigin,
+            protectedKeyset: trust.keyset, minimumPolicyRevision: 1 };
+    };
+    const connectTransport = async (target) => requestDemoTransportContinuity(await loadBinding(readOnly), target, {
+        store: operationStore, fetcher: deps.fetcher, loadBinding: () => loadBinding(readOnly),
+        sign: async (payload) => {
+            const current = await loadOrCreateDeviceIdentity({ hqUrl: enrollmentOrigin,
+                organizationId: `${scope.organizationId}:${scope.repositoryId}`, installationId: scope.installationId, store: readOnly });
+            if (current.publicKeyEd25519 !== identity.publicKeyEd25519)
+                immutableIdentity();
+            return sign(null, Buffer.from(payload), { key: current.privateJwk, format: 'jwk' }).toString('base64url');
+        },
+    });
+    const fetcher = createDemoTransportFetcher({ store: operationStore, fetcher: deps.fetcher, loadBinding,
+        refresh: (_binding, target) => connectTransport(target) });
+    return { store: operationStore, fetcher, connectTransport };
+}
+//# sourceMappingURL=demoDeviceTransport.js.map

package/dist/demoDeviceTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"demoDeviceTransport.js","sourceRoot":"","sources":["../src/demoDeviceTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,cAAc,EAA0B,MAAM,2CAA2C,CAAC;AAC/H,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAwB,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAE3E,SAAS,iBAAiB;IACxB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8FAA8F,CAAC,EAC3H,EAAE,IAAI,EAAE,kDAAkD,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,0EAA0E;AAC1E,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAAsB,EACpE,OAA8D,EAAE;IAChE,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,EAAE,gBAAgB,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,uBAAuB,EAAE,CAAC;IAC5D,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAsB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK;QACvF,KAAK,CAAC,GAAG,KAAK,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,EAAE,KAAK,EAAE,gBAAgB;QACzE,cAAc,EAAE,GAAG,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5H,MAAM,cAAc,GAAsB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK;QAC7F,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,IAAI,OAAO,KAAK,QAAQ,CAAC,OAAO;YAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QACrH,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,OAAO,KAAK,QAAQ,CAAC,OAAO;YAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAC7E,MAAM,WAAW,GAAG,KAAK,EAAE,cAAiC,EAAE,EAAE;QAC5D,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3E,MAAM,eAAe,GAAG,MAAM,0BAA0B,CAAC,EAAE,KAAK,EAAE,gBAAgB;YAChF,cAAc,EAAE,GAAG,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,YAAY,EAAE;YAC/D,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC,gBAAgB,KAAK,QAAQ,CAAC,gBAAgB;YAAE,iBAAiB,EAAE,CAAC;QAC/H,OAAO,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;YAC7E,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc;YAC9D,gBAAgB,EAAE,eAAe,CAAC,gBAAgB,EAAE,gBAAgB;YACpE,eAAe,EAAE,KAAK,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC,EAAE,CAAC;IAC9D,CAAC,CAAC;IACJ,MAAM,gBAAgB,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE,CAAC,8BAA8B,CAAC,MAAM,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE;QACrH,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC;QACtF,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,EAAE,KAAK,EAAE,gBAAgB;gBACxE,cAAc,EAAE,GAAG,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5H,IAAI,OAAO,CAAC,gBAAgB,KAAK,QAAQ,CAAC,gBAAgB;gBAAE,iBAAiB,EAAE,CAAC;YAChF,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5G,CAAC;KACF,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,0BAA0B,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW;QACpG,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7D,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAC9D,CAAC"}

package/dist/demoDeviceTransport.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=demoDeviceTransport.test.d.ts.map

package/dist/demoDeviceTransport.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"demoDeviceTransport.test.d.ts","sourceRoot":"","sources":["../src/demoDeviceTransport.test.ts"],"names":[],"mappings":""}

package/dist/demoDeviceTransport.test.js

@@ -0,0 +1,178 @@
+import assert from 'node:assert/strict';
+import { generateKeyPairSync } from 'node:crypto';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { resolve } from 'node:path';
+import test from 'node:test';
+import { canonicalize, sha256, signCanonicalObject } from '@dharma-ai-labs/agent-fabric-contracts';
+import { connectDemoDevice, scopePath, verifyDemoDevice } from './demoEnrollment.js';
+import { createDemoDeviceTransport } from './demoDeviceTransport.js';
+import { acceptDemoTransport } from './demoTransportState.js';
+async function fixture(t) {
+    const stateRoot = await mkdtemp(resolve(tmpdir(), 'dharma-device-transport-'));
+    t.after(() => rm(stateRoot, { recursive: true, force: true }));
+    const scope = { hqUrl: 'https://original.example', organizationId: 'org_fixture',
+        repositoryId: '10000000-0000-4000-8000-000000000001', normalizedRepository: 'github.com/example/private',
+        installationId: '40000000-0000-4000-8000-000000000001', stateRoot };
+    const deviceId = '30000000-0000-4000-8000-000000000001', signer = generateKeyPairSync('ed25519');
+    const issuedAt = new Date(Date.now() - 60_000).toISOString(), expiresAt = new Date(Date.now() + 24 * 60 * 60_000).toISOString();
+    const unsigned = { schema: 'dharma.server-signing-keyset/v1', organizationId: scope.organizationId,
+        generation: 1, signedByKeyVersion: 'original', issuedAt, expiresAt,
+        keys: [{ keyVersion: 'original', publicKeyEd25519: signer.publicKey.export({ format: 'jwk' }).x,
+                status: 'active', notBefore: issuedAt, notAfter: expiresAt }] };
+    const keyset = { ...unsigned, signature: signCanonicalObject(unsigned, signer.privateKey) };
+    const values = new Map();
+    const store = { backend: 'linux-secret-service',
+        async get(account) { return values.get(account) ?? null; },
+        async getFresh(account) { return values.get(account) ?? null; },
+        async put(account, value) { values.set(account, value); },
+        async delete(account) { values.delete(account); } };
+    const calls = [];
+    const fetcher = async (resource) => {
+        const url = new URL(String(resource));
+        calls.push(url.toString());
+        if (url.pathname.endsWith('/enrollments'))
+            return Response.json({ ok: true, status: 'pending',
+                organizationId: scope.organizationId, repositoryId: scope.repositoryId, deviceCode: 'B'.repeat(43),
+                expiresAt: new Date(Date.now() + 60_000).toISOString(), verificationUri: `${scope.hqUrl}/demo/fabric/approve?orgId=${scope.organizationId}&repositoryId=${scope.repositoryId}&code=ABCDEF0123456789ABCD` }, { status: 202 });
+        if (url.pathname.endsWith('/poll'))
+            return Response.json({ ok: true, status: 'approved', deviceId,
+                repositoryId: scope.repositoryId, serverPublicKeyEd25519: unsigned.keys[0].publicKeyEd25519, serverSigningKeyset: keyset });
+        return Response.json({ ok: true, organizationId: scope.organizationId, repositoryId: scope.repositoryId,
+            deviceId, normalizedRepository: scope.normalizedRepository });
+    };
+    await connectDemoDevice({ ...scope, grant: 'A'.repeat(43), deviceName: 'Fixture', platform: 'linux', maximumWaitMs: 1000 }, { store, fetcher });
+    calls.length = 0;
+    const config = JSON.parse(await readFile(scopePath(scope, scope.hqUrl), 'utf8'));
+    const binding = { organizationId: scope.organizationId, repositoryId: scope.repositoryId, deviceId,
+        installationId: scope.installationId, publicKeyEd25519: config.publicKeyEd25519,
+        enrollmentOrigin: scope.hqUrl, protectedKeyset: keyset, minimumPolicyRevision: 1 };
+    const target = 'https://corrected.example', now = new Date();
+    const body = { schema: 'dharma.demo-transport-continuity/v1', purpose: 'same-authority-repository-transport',
+        organizationId: binding.organizationId, repositoryId: binding.repositoryId, deviceId,
+        installationId: binding.installationId, publicKeyEd25519: binding.publicKeyEd25519,
+        enrollmentOrigin: scope.hqUrl, transportOrigin: target, requestNonce: 'N'.repeat(32), policyRevision: 2,
+        trustGeneration: 1, installedKeysetHash: sha256(canonicalize(keyset)), signingKeyVersion: 'original',
+        issuedAt: now.toISOString(), expiresAt: new Date(now.getTime() + 600_000).toISOString() };
+    return { scope, store, fetcher, calls, values, config, binding, target,
+        issue: async (resource, init) => {
+            calls.push(String(resource));
+            const request = JSON.parse(String(init?.body)), now = new Date();
+            const issued = { ...body, ...request, issuedAt: now.toISOString(), expiresAt: new Date(now.getTime() + 600_000).toISOString() };
+            const correlationId = new Headers(init?.headers).get('x-dharma-correlation-id');
+            return Response.json({ ok: true, certificate: { ...issued, signature: signCanonicalObject(issued, signer.privateKey) },
+                duplicate: false, correlationId }, { headers: { 'x-dharma-correlation-id': correlationId } });
+        },
+        shortCertificate: () => {
+            const issued = { ...body, expiresAt: new Date(Date.now() + 30_000).toISOString() };
+            return { ...issued, signature: signCanonicalObject(issued, signer.privateKey) };
+        },
+        certificate: { ...body, signature: signCanonicalObject(body, signer.privateKey) } };
+}
+test('enrolled status resolves the new transport under original config/key accounts and keeps its sequence', async (t) => {
+    const f = await fixture(t), enrollmentRecords = new Map(f.values);
+    await acceptDemoTransport(f.certificate, f.binding, { transportOrigin: f.target, requestNonce: f.certificate.requestNonce }, { store: f.store });
+    const deps = await createDemoDeviceTransport(f.scope, { store: f.store, fetcher: f.fetcher });
+    await verifyDemoDevice(f.scope, deps);
+    assert.equal(f.calls.length, 1);
+    assert.equal(new URL(f.calls[0]).origin, f.target);
+    const config = JSON.parse(await readFile(scopePath(f.scope, f.scope.hqUrl), 'utf8'));
+    for (const field of ['hqUrl', 'deviceId', 'installationId', 'publicKeyEd25519', 'enrolledAt'])
+        assert.equal(config[field], f.config[field]);
+    assert.equal(config.nextSequence, f.config.nextSequence + 1);
+    for (const [account, value] of enrollmentRecords)
+        assert.equal(f.values.get(account), value);
+});
+test('ordinary unmapped status keeps its original origin and signing behavior', async (t) => {
+    const f = await fixture(t), before = [...f.values];
+    await verifyDemoDevice(f.scope, await createDemoDeviceTransport(f.scope, { store: f.store, fetcher: f.fetcher }));
+    assert.equal(new URL(f.calls[0]).origin, f.scope.hqUrl);
+    assert.deepEqual([...f.values], before);
+});
+test('a missing or corrupted enrolled identity never generates a replacement', async (t) => {
+    const f = await fixture(t);
+    const identityAccount = [...f.values].find(([, value]) => value.includes('"d":'))[0];
+    for (const value of [null, 'corrupted']) {
+        if (value === null)
+            f.values.delete(identityAccount);
+        else
+            f.values.set(identityAccount, value);
+        const before = [...f.values];
+        await assert.rejects(createDemoDeviceTransport(f.scope, { store: f.store, fetcher: f.fetcher }));
+        assert.deepEqual([...f.values], before);
+    }
+    assert.equal(f.calls.length, 0);
+});
+test('operation dependencies prohibit replacement of the original identity while retaining trust-update capability', async (t) => {
+    const f = await fixture(t), before = [...f.values];
+    const identityAccount = [...f.values].find(([, value]) => value.includes('"d":'))[0];
+    const deps = await createDemoDeviceTransport(f.scope, { store: f.store, fetcher: f.fetcher });
+    await assert.rejects(deps.store.put(identityAccount, 'replacement'), /existing_protected_state_required/);
+    await assert.rejects(deps.store.delete(identityAccount), /existing_protected_state_required/);
+    assert.deepEqual([...f.values], before);
+});
+test('lost status responses resume the same original pending request after transport setup restarts', async (t) => {
+    const f = await fixture(t), before = new Map(f.values), sequences = [];
+    await acceptDemoTransport(f.certificate, f.binding, { transportOrigin: f.target, requestNonce: f.certificate.requestNonce }, { store: f.store });
+    let lost = false;
+    const network = async (resource, init) => {
+        assert.equal(new URL(String(resource)).origin, f.target);
+        sequences.push(new Headers(init?.headers).get('x-dharma-sequence'));
+        const response = await f.fetcher(resource, init);
+        if (!lost) {
+            lost = true;
+            throw new TypeError('Fixture response lost after acceptance');
+        }
+        return response;
+    };
+    await assert.rejects(verifyDemoDevice(f.scope, await createDemoDeviceTransport(f.scope, { store: f.store, fetcher: network })), /response lost/);
+    const pendingPath = `${scopePath(f.scope, f.scope.hqUrl)}.pending-status.json`;
+    const pending = JSON.parse(await readFile(pendingPath, 'utf8'));
+    assert.equal(new URL(pending.url).origin, f.scope.hqUrl);
+    await verifyDemoDevice(f.scope, await createDemoDeviceTransport(f.scope, { store: f.store, fetcher: network }));
+    assert.deepEqual(sequences, [String(f.config.nextSequence), String(f.config.nextSequence)]);
+    const after = JSON.parse(await readFile(scopePath(f.scope, f.scope.hqUrl), 'utf8'));
+    assert.equal(after.nextSequence, f.config.nextSequence + 1);
+    for (const [account, value] of before)
+        assert.equal(f.values.get(account), value);
+    await assert.rejects(readFile(pendingPath), { code: 'ENOENT' });
+});
+test('grant-free issuance cannot consume the business sequence, and pending status resumes unchanged', async (t) => {
+    const f = await fixture(t), before = new Map(f.values), sequences = [];
+    let lost = true;
+    const network = async (resource, init) => {
+        if (String(resource).includes('/transport-continuity'))
+            return f.issue(resource, init);
+        sequences.push(new Headers(init?.headers).get('x-dharma-sequence'));
+        if (lost) {
+            lost = false;
+            throw new TypeError('Fixture status response lost');
+        }
+        return f.fetcher(resource, init);
+    };
+    await assert.rejects(verifyDemoDevice(f.scope, await createDemoDeviceTransport(f.scope, { store: f.store, fetcher: network })), /response lost/);
+    const pendingPath = `${scopePath(f.scope, f.scope.hqUrl)}.pending-status.json`;
+    const pendingBefore = await readFile(pendingPath, 'utf8');
+    const deps = await createDemoDeviceTransport(f.scope, { store: f.store, fetcher: network });
+    await deps.connectTransport(f.target);
+    assert.equal(await readFile(pendingPath, 'utf8'), pendingBefore);
+    assert.equal(JSON.parse(await readFile(scopePath(f.scope, f.scope.hqUrl), 'utf8')).nextSequence, f.config.nextSequence);
+    await verifyDemoDevice(f.scope, deps);
+    assert.deepEqual(sequences, [String(f.config.nextSequence), String(f.config.nextSequence)]);
+    assert.equal(JSON.parse(await readFile(scopePath(f.scope, f.scope.hqUrl), 'utf8')).nextSequence, f.config.nextSequence + 1);
+    for (const [account, value] of before)
+        assert.equal(f.values.get(account), value);
+});
+test('routine status refreshes near-expiry transport autonomously before unchanged signed work', async (t) => {
+    const f = await fixture(t), before = new Map(f.values);
+    await acceptDemoTransport(f.shortCertificate(), f.binding, { transportOrigin: f.target, requestNonce: f.certificate.requestNonce }, { store: f.store });
+    const network = (resource, init) => String(resource).includes('/transport-continuity') ? f.issue(resource, init) : f.fetcher(resource, init);
+    await verifyDemoDevice(f.scope, await createDemoDeviceTransport(f.scope, { store: f.store, fetcher: network }));
+    assert.equal(f.calls.length, 2);
+    assert.ok(f.calls[0].includes('/transport-continuity'));
+    assert.ok(f.calls[1].includes('/status'));
+    assert.equal(JSON.parse(await readFile(scopePath(f.scope, f.scope.hqUrl), 'utf8')).nextSequence, f.config.nextSequence + 1);
+    for (const [account, value] of before)
+        assert.equal(f.values.get(account), value);
+});
+//# sourceMappingURL=demoDeviceTransport.test.js.map

package/dist/demoDeviceTransport.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"demoDeviceTransport.test.js","sourceRoot":"","sources":["../src/demoDeviceTransport.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,IAA0B,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAEnG,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,KAAK,UAAU,OAAO,CAAC,CAAc;IACnC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,0BAA0B,EAAE,cAAc,EAAE,aAAa;QAC9E,YAAY,EAAE,sCAAsC,EAAE,oBAAoB,EAAE,4BAA4B;QACxG,cAAc,EAAE,sCAAsC,EAAE,SAAS,EAAE,CAAC;IACtE,MAAM,QAAQ,GAAG,sCAAsC,EAAE,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAChI,MAAM,QAAQ,GAAG,EAAE,MAAM,EAAE,iCAA0C,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc;QACzG,UAAU,EAAE,CAAC,EAAE,kBAAkB,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS;QAClE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAE;gBAC9F,MAAM,EAAE,QAAiB,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC7E,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;IAC5F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,KAAK,GAAsB,EAAE,OAAO,EAAE,sBAAsB;QAChE,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAC1D,KAAK,CAAC,QAAQ,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAiB,KAAK,EAAC,QAAQ,EAAC,EAAE;QAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAClE,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS;gBAC3F,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClG,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,eAAe,EACrE,GAAG,KAAK,CAAC,KAAK,8BAA8B,KAAK,CAAC,cAAc,iBAAiB,KAAK,CAAC,YAAY,4BAA4B,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACxJ,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ;gBAC/F,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,sBAAsB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/H,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;YACrG,QAAQ,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC;IACF,MAAM,iBAAiB,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAChJ,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACjB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ;QAChG,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QAC/E,gBAAgB,EAAE,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,EAAE,CAAC;IACrF,MAAM,MAAM,GAAG,2BAA2B,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7D,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,qCAAqC,EAAE,OAAO,EAAE,qCAAqC;QAC1G,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,QAAQ;QACpF,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAClF,gBAAgB,EAAE,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC;QACvG,eAAe,EAAE,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,iBAAiB,EAAE,UAAU;QACpG,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;IAC5F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;QACpE,KAAK,EAAE,KAAK,EAAE,QAAqC,EAAE,IAAkB,EAAE,EAAE;YACzE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAChI,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAE,CAAC;YACjF,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE;gBACpH,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,yBAAyB,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACnF,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,CAAC;QACD,WAAW,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;AACxF,CAAC;AAED,IAAI,CAAC,sGAAsG,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACrH,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,mBAAmB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,EAChD,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9F,MAAM,gBAAgB,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACrF,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,CAAC;QAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5I,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,iBAAiB;QAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;AAC/F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yEAAyE,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACxF,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,gBAAgB,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,yBAAyB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAClH,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACvF,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC;IACtF,KAAK,MAAM,KAAK,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;QACxC,IAAI,KAAK,KAAK,IAAI;YAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;;YAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACjG,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8GAA8G,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC7H,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9F,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,EAAE,mCAAmC,CAAC,CAAC;IAC1G,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,mCAAmC,CAAC,CAAC;IAC9F,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+FAA+F,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC9G,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,GAAa,EAAE,CAAC;IACjF,MAAM,mBAAmB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,EAChD,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/F,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,MAAM,OAAO,GAAiB,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACrD,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACzD,SAAS,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAE,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC;YAAC,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;QAAC,CAAC;QAC1F,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,EAC3C,MAAM,yBAAyB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IACpG,MAAM,WAAW,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,gBAAgB,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,yBAAyB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAChH,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACpF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;IAC5D,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM;QAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IAClF,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,gGAAgG,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC/G,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,GAAa,EAAE,CAAC;IACjF,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,MAAM,OAAO,GAAiB,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvF,SAAS,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAE,CAAC,CAAC;QACrE,IAAI,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,KAAK,CAAC;YAAC,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;QAAC,CAAC;QAChF,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,yBAAyB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IACjJ,MAAM,WAAW,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC;IAC/E,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5F,MAAM,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;IACjE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACxH,MAAM,gBAAgB,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;IAC5H,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM;QAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;AACpF,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,0FAA0F,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACzG,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,OAAO,EACvD,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC3J,MAAM,gBAAgB,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,yBAAyB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAChH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACrG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;IAC5H,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM;QAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;AACpF,CAAC,CAAC,CAAC"}

package/dist/demoEnrollment.d.ts

@@ -1,5 +1,6 @@
 import { type SecureSecretStore } from '@dharma-ai-labs/agent-fabric-relay-client';
 import { type TrustedServerSigningKeyset } from '@dharma-ai-labs/agent-fabric-contracts';
+import { type DemoSigningDependencies } from './demoSigningTrust.js';
 export interface DemoDeviceConnectOptions {
     hqUrl: string;
     organizationId: string;
@@ -21,7 +22,7 @@ export interface DemoDeviceConnectDependencies {
     expectedAcceptedSequence?: number;
 }
 export declare function scopePath(input: DemoDeviceScope, origin: string): string;
-export declare function loadDemoSigningTrust(input: DemoDeviceScope): Promise<{
+export declare function loadDemoSigningTrust(input: DemoDeviceScope, deps?: DemoSigningDependencies): Promise<{
     publicKey: import("crypto").KeyObject;
     keyset: TrustedServerSigningKeyset;
     deviceId: string;

package/dist/demoEnrollment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"demoEnrollment.d.ts","sourceRoot":"","sources":["../src/demoEnrollment.ts"],"names":[],"mappings":"AAGA,OAAO,EAA8C,KAAK,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC/H,OAAO,EAAoC,KAAK,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AAM3H,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,SAAS,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,CAAC;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,wBAAwB,EACzD,OAAO,GAAG,gBAAgB,GAAG,cAAc,GAAG,sBAAsB,GAAG,gBAAgB,GAAG,WAAW,CAAC,CAAC;AAkBzG,MAAM,WAAW,6BAA6B;IAC5C,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AA6CD,wBAAgB,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,UAI/D;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,eAAe;;;;GAgBhE;AAuDD,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAC3D,IAAI,GAAE,IAAI,CAAC,6BAA6B,EAAE,OAAO,GAAG,SAAS,GAAG,0BAA0B,CAAM;;;;;;;;;GA+EjG;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,EACrE,IAAI,GAAE,6BAAkC;;;;;;;;;GAqFzC"}
+{"version":3,"file":"demoEnrollment.d.ts","sourceRoot":"","sources":["../src/demoEnrollment.ts"],"names":[],"mappings":"AAGA,OAAO,EAA8C,KAAK,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC/H,OAAO,EAAoC,KAAK,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AAC3H,OAAO,EAAkF,KAAK,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAMrJ,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,SAAS,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,CAAC;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,wBAAwB,EACzD,OAAO,GAAG,gBAAgB,GAAG,cAAc,GAAG,sBAAsB,GAAG,gBAAgB,GAAG,WAAW,CAAC,CAAC;AAkBzG,MAAM,WAAW,6BAA6B;IAC5C,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AA6CD,wBAAgB,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,UAI/D;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,GAAE,uBAA4B;;;;GA2BpG;AAwDD,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAC3D,IAAI,GAAE,IAAI,CAAC,6BAA6B,EAAE,OAAO,GAAG,SAAS,GAAG,0BAA0B,CAAM;;;;;;;;;GA2FjG;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,EACrE,IAAI,GAAE,6BAAkC;;;;;;;;;GAoIzC"}