@dharma-ai-labs/agent-fabric 0.2.110 → 0.2.111

package/dist/demoDeviceTransport.d.ts

@@ -0,0 +1,33 @@
+import { type SecureSecretStore } from '@dharma-ai-labs/agent-fabric-relay-client';
+import { type DemoDeviceScope } from './demoEnrollment.js';
+export declare function createDemoDeviceTransport(input: DemoDeviceScope, deps?: {
+    store?: SecureSecretStore;
+    fetcher?: typeof fetch;
+}): Promise<{
+    store: SecureSecretStore;
+    fetcher: typeof fetch;
+    connectTransport: (target: string) => Promise<{
+        ok: boolean;
+        stage: "demo_transport_verified";
+        enrolled: boolean;
+        duplicate: boolean;
+        deviceId: string;
+        repositoryId: string;
+        transportOrigin: string;
+        expiresAt: string;
+        resumed: boolean;
+        correlationId?: undefined;
+    } | {
+        ok: boolean;
+        stage: "demo_transport_verified";
+        enrolled: boolean;
+        duplicate: boolean;
+        deviceId: string;
+        repositoryId: string;
+        transportOrigin: string;
+        expiresAt: string;
+        correlationId: string;
+        resumed: boolean;
+    }>;
+}>;
+//# sourceMappingURL=demoDeviceTransport.d.ts.map

package/dist/demoDeviceTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"demoDeviceTransport.d.ts","sourceRoot":"","sources":["../src/demoDeviceTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8C,KAAK,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAG/H,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAWjF,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,eAAe,EACpE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;CAAO;;;+BAuBxB,MAAM;;;;;;;;;;;;;;;;;;;;;;;GAY/C"}

package/dist/demoDeviceTransport.js

@@ -0,0 +1,52 @@
+import { loadOrCreateDeviceIdentity, normalizeHqUrl } from '@dharma-ai-labs/agent-fabric-relay-client';
+import { createSystemSecureStore } from '@dharma-ai-labs/agent-fabric-secure-store';
+import { sign } from 'node:crypto';
+import { loadDemoSigningTrust } from './demoEnrollment.js';
+import { createDemoTransportFetcher } from './demoTransportFetch.js';
+import { requestDemoTransportContinuity } from './demoTransportRequest.js';
+function immutableIdentity() {
+    throw Object.assign(new Error('Demo transport requires existing_protected_state_required. Preserve the original enrollment.'), { code: 'demo_transport_existing_protected_state_required' });
+}
+// Invoke within withDemoDeviceLock. Keep all config paths and private-key
+// accounts on the original enrollment origin, even when HTTP moves elsewhere.
+export async function createDemoDeviceTransport(input, deps = {}) {
+    const scope = structuredClone(input), enrollmentOrigin = normalizeHqUrl(scope.hqUrl);
+    const store = deps.store ?? await createSystemSecureStore();
+    const fresh = (account) => store.getFresh ? store.getFresh(account) : store.get(account);
+    const readOnly = { backend: store.backend, get: fresh, getFresh: fresh,
+        async put() { immutableIdentity(); }, async delete() { immutableIdentity(); } };
+    const identity = await loadOrCreateDeviceIdentity({ hqUrl: enrollmentOrigin,
+        organizationId: `${scope.organizationId}:${scope.repositoryId}`, installationId: scope.installationId, store: readOnly });
+    const operationStore = { backend: store.backend, get: fresh, getFresh: fresh,
+        async put(account, value) { if (account === identity.account)
+            immutableIdentity(); await store.put(account, value); },
+        async delete(account) { if (account === identity.account)
+            immutableIdentity(); await store.delete(account); } };
+    const initial = await loadDemoSigningTrust(scope, { store: operationStore });
+    const loadBinding = async (protectedStore) => {
+        const trust = await loadDemoSigningTrust(scope, { store: protectedStore });
+        const currentIdentity = await loadOrCreateDeviceIdentity({ hqUrl: enrollmentOrigin,
+            organizationId: `${scope.organizationId}:${scope.repositoryId}`,
+            installationId: scope.installationId, store: protectedStore });
+        if (trust.deviceId !== initial.deviceId || currentIdentity.publicKeyEd25519 !== identity.publicKeyEd25519)
+            immutableIdentity();
+        return { organizationId: scope.organizationId, repositoryId: scope.repositoryId,
+            deviceId: trust.deviceId, installationId: scope.installationId,
+            publicKeyEd25519: currentIdentity.publicKeyEd25519, enrollmentOrigin,
+            protectedKeyset: trust.keyset, minimumPolicyRevision: 1 };
+    };
+    const connectTransport = async (target) => requestDemoTransportContinuity(await loadBinding(readOnly), target, {
+        store: operationStore, fetcher: deps.fetcher, loadBinding: () => loadBinding(readOnly),
+        sign: async (payload) => {
+            const current = await loadOrCreateDeviceIdentity({ hqUrl: enrollmentOrigin,
+                organizationId: `${scope.organizationId}:${scope.repositoryId}`, installationId: scope.installationId, store: readOnly });
+            if (current.publicKeyEd25519 !== identity.publicKeyEd25519)
+                immutableIdentity();
+            return sign(null, Buffer.from(payload), { key: current.privateJwk, format: 'jwk' }).toString('base64url');
+        },
+    });
+    const fetcher = createDemoTransportFetcher({ store: operationStore, fetcher: deps.fetcher, loadBinding,
+        refresh: (_binding, target) => connectTransport(target) });
+    return { store: operationStore, fetcher, connectTransport };
+}
+//# sourceMappingURL=demoDeviceTransport.js.map

package/dist/demoDeviceTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"demoDeviceTransport.js","sourceRoot":"","sources":["../src/demoDeviceTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,cAAc,EAA0B,MAAM,2CAA2C,CAAC;AAC/H,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAwB,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAE3E,SAAS,iBAAiB;IACxB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8FAA8F,CAAC,EAC3H,EAAE,IAAI,EAAE,kDAAkD,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,0EAA0E;AAC1E,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAAsB,EACpE,OAA8D,EAAE;IAChE,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,EAAE,gBAAgB,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,uBAAuB,EAAE,CAAC;IAC5D,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAsB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK;QACvF,KAAK,CAAC,GAAG,KAAK,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,EAAE,KAAK,EAAE,gBAAgB;QACzE,cAAc,EAAE,GAAG,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5H,MAAM,cAAc,GAAsB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK;QAC7F,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,IAAI,OAAO,KAAK,QAAQ,CAAC,OAAO;YAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QACrH,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,OAAO,KAAK,QAAQ,CAAC,OAAO;YAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAC7E,MAAM,WAAW,GAAG,KAAK,EAAE,cAAiC,EAAE,EAAE;QAC5D,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3E,MAAM,eAAe,GAAG,MAAM,0BAA0B,CAAC,EAAE,KAAK,EAAE,gBAAgB;YAChF,cAAc,EAAE,GAAG,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,YAAY,EAAE;YAC/D,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC,gBAAgB,KAAK,QAAQ,CAAC,gBAAgB;YAAE,iBAAiB,EAAE,CAAC;QAC/H,OAAO,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;YAC7E,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc;YAC9D,gBAAgB,EAAE,eAAe,CAAC,gBAAgB,EAAE,gBAAgB;YACpE,eAAe,EAAE,KAAK,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC,EAAE,CAAC;IAC9D,CAAC,CAAC;IACJ,MAAM,gBAAgB,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE,CAAC,8BAA8B,CAAC,MAAM,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE;QACrH,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC;QACtF,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,EAAE,KAAK,EAAE,gBAAgB;gBACxE,cAAc,EAAE,GAAG,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5H,IAAI,OAAO,CAAC,gBAAgB,KAAK,QAAQ,CAAC,gBAAgB;gBAAE,iBAAiB,EAAE,CAAC;YAChF,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5G,CAAC;KACF,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,0BAA0B,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW;QACpG,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7D,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAC9D,CAAC"}

package/dist/demoDeviceTransport.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=demoDeviceTransport.test.d.ts.map

package/dist/demoDeviceTransport.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"demoDeviceTransport.test.d.ts","sourceRoot":"","sources":["../src/demoDeviceTransport.test.ts"],"names":[],"mappings":""}

package/dist/demoDeviceTransport.test.js

@@ -0,0 +1,178 @@
+import assert from 'node:assert/strict';
+import { generateKeyPairSync } from 'node:crypto';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { resolve } from 'node:path';
+import test from 'node:test';
+import { canonicalize, sha256, signCanonicalObject } from '@dharma-ai-labs/agent-fabric-contracts';
+import { connectDemoDevice, scopePath, verifyDemoDevice } from './demoEnrollment.js';
+import { createDemoDeviceTransport } from './demoDeviceTransport.js';
+import { acceptDemoTransport } from './demoTransportState.js';
+async function fixture(t) {
+    const stateRoot = await mkdtemp(resolve(tmpdir(), 'dharma-device-transport-'));
+    t.after(() => rm(stateRoot, { recursive: true, force: true }));
+    const scope = { hqUrl: 'https://original.example', organizationId: 'org_fixture',
+        repositoryId: '10000000-0000-4000-8000-000000000001', normalizedRepository: 'github.com/example/private',
+        installationId: '40000000-0000-4000-8000-000000000001', stateRoot };
+    const deviceId = '30000000-0000-4000-8000-000000000001', signer = generateKeyPairSync('ed25519');
+    const issuedAt = new Date(Date.now() - 60_000).toISOString(), expiresAt = new Date(Date.now() + 24 * 60 * 60_000).toISOString();
+    const unsigned = { schema: 'dharma.server-signing-keyset/v1', organizationId: scope.organizationId,
+        generation: 1, signedByKeyVersion: 'original', issuedAt, expiresAt,
+        keys: [{ keyVersion: 'original', publicKeyEd25519: signer.publicKey.export({ format: 'jwk' }).x,
+                status: 'active', notBefore: issuedAt, notAfter: expiresAt }] };
+    const keyset = { ...unsigned, signature: signCanonicalObject(unsigned, signer.privateKey) };
+    const values = new Map();
+    const store = { backend: 'linux-secret-service',
+        async get(account) { return values.get(account) ?? null; },
+        async getFresh(account) { return values.get(account) ?? null; },
+        async put(account, value) { values.set(account, value); },
+        async delete(account) { values.delete(account); } };
+    const calls = [];
+    const fetcher = async (resource) => {
+        const url = new URL(String(resource));
+        calls.push(url.toString());
+        if (url.pathname.endsWith('/enrollments'))
+            return Response.json({ ok: true, status: 'pending',
+                organizationId: scope.organizationId, repositoryId: scope.repositoryId, deviceCode: 'B'.repeat(43),
+                expiresAt: new Date(Date.now() + 60_000).toISOString(), verificationUri: `${scope.hqUrl}/demo/fabric/approve?orgId=${scope.organizationId}&repositoryId=${scope.repositoryId}&code=ABCDEF0123456789ABCD` }, { status: 202 });
+        if (url.pathname.endsWith('/poll'))
+            return Response.json({ ok: true, status: 'approved', deviceId,
+                repositoryId: scope.repositoryId, serverPublicKeyEd25519: unsigned.keys[0].publicKeyEd25519, serverSigningKeyset: keyset });
+        return Response.json({ ok: true, organizationId: scope.organizationId, repositoryId: scope.repositoryId,
+            deviceId, normalizedRepository: scope.normalizedRepository });
+    };
+    await connectDemoDevice({ ...scope, grant: 'A'.repeat(43), deviceName: 'Fixture', platform: 'linux', maximumWaitMs: 1000 }, { store, fetcher });
+    calls.length = 0;
+    const config = JSON.parse(await readFile(scopePath(scope, scope.hqUrl), 'utf8'));
+    const binding = { organizationId: scope.organizationId, repositoryId: scope.repositoryId, deviceId,
+        installationId: scope.installationId, publicKeyEd25519: config.publicKeyEd25519,
+        enrollmentOrigin: scope.hqUrl, protectedKeyset: keyset, minimumPolicyRevision: 1 };
+    const target = 'https://corrected.example', now = new Date();
+    const body = { schema: 'dharma.demo-transport-continuity/v1', purpose: 'same-authority-repository-transport',
+        organizationId: binding.organizationId, repositoryId: binding.repositoryId, deviceId,
+        installationId: binding.installationId, publicKeyEd25519: binding.publicKeyEd25519,
+        enrollmentOrigin: scope.hqUrl, transportOrigin: target, requestNonce: 'N'.repeat(32), policyRevision: 2,
+        trustGeneration: 1, installedKeysetHash: sha256(canonicalize(keyset)), signingKeyVersion: 'original',
+        issuedAt: now.toISOString(), expiresAt: new Date(now.getTime() + 600_000).toISOString() };
+    return { scope, store, fetcher, calls, values, config, binding, target,
+        issue: async (resource, init) => {
+            calls.push(String(resource));
+            const request = JSON.parse(String(init?.body)), now = new Date();
+            const issued = { ...body, ...request, issuedAt: now.toISOString(), expiresAt: new Date(now.getTime() + 600_000).toISOString() };
+            const correlationId = new Headers(init?.headers).get('x-dharma-correlation-id');
+            return Response.json({ ok: true, certificate: { ...issued, signature: signCanonicalObject(issued, signer.privateKey) },
+                duplicate: false, correlationId }, { headers: { 'x-dharma-correlation-id': correlationId } });
+        },
+        shortCertificate: () => {
+            const issued = { ...body, expiresAt: new Date(Date.now() + 30_000).toISOString() };
+            return { ...issued, signature: signCanonicalObject(issued, signer.privateKey) };
+        },
+        certificate: { ...body, signature: signCanonicalObject(body, signer.privateKey) } };
+}
+test('enrolled status resolves the new transport under original config/key accounts and keeps its sequence', async (t) => {
+    const f = await fixture(t), enrollmentRecords = new Map(f.values);
+    await acceptDemoTransport(f.certificate, f.binding, { transportOrigin: f.target, requestNonce: f.certificate.requestNonce }, { store: f.store });
+    const deps = await createDemoDeviceTransport(f.scope, { store: f.store, fetcher: f.fetcher });
+    await verifyDemoDevice(f.scope, deps);
+    assert.equal(f.calls.length, 1);
+    assert.equal(new URL(f.calls[0]).origin, f.target);
+    const config = JSON.parse(await readFile(scopePath(f.scope, f.scope.hqUrl), 'utf8'));
+    for (const field of ['hqUrl', 'deviceId', 'installationId', 'publicKeyEd25519', 'enrolledAt'])
+        assert.equal(config[field], f.config[field]);
+    assert.equal(config.nextSequence, f.config.nextSequence + 1);
+    for (const [account, value] of enrollmentRecords)
+        assert.equal(f.values.get(account), value);
+});
+test('ordinary unmapped status keeps its original origin and signing behavior', async (t) => {
+    const f = await fixture(t), before = [...f.values];
+    await verifyDemoDevice(f.scope, await createDemoDeviceTransport(f.scope, { store: f.store, fetcher: f.fetcher }));
+    assert.equal(new URL(f.calls[0]).origin, f.scope.hqUrl);
+    assert.deepEqual([...f.values], before);
+});
+test('a missing or corrupted enrolled identity never generates a replacement', async (t) => {
+    const f = await fixture(t);
+    const identityAccount = [...f.values].find(([, value]) => value.includes('"d":'))[0];
+    for (const value of [null, 'corrupted']) {
+        if (value === null)
+            f.values.delete(identityAccount);
+        else
+            f.values.set(identityAccount, value);
+        const before = [...f.values];
+        await assert.rejects(createDemoDeviceTransport(f.scope, { store: f.store, fetcher: f.fetcher }));
+        assert.deepEqual([...f.values], before);
+    }
+    assert.equal(f.calls.length, 0);
+});
+test('operation dependencies prohibit replacement of the original identity while retaining trust-update capability', async (t) => {
+    const f = await fixture(t), before = [...f.values];
+    const identityAccount = [...f.values].find(([, value]) => value.includes('"d":'))[0];
+    const deps = await createDemoDeviceTransport(f.scope, { store: f.store, fetcher: f.fetcher });
+    await assert.rejects(deps.store.put(identityAccount, 'replacement'), /existing_protected_state_required/);
+    await assert.rejects(deps.store.delete(identityAccount), /existing_protected_state_required/);
+    assert.deepEqual([...f.values], before);
+});
+test('lost status responses resume the same original pending request after transport setup restarts', async (t) => {
+    const f = await fixture(t), before = new Map(f.values), sequences = [];
+    await acceptDemoTransport(f.certificate, f.binding, { transportOrigin: f.target, requestNonce: f.certificate.requestNonce }, { store: f.store });
+    let lost = false;
+    const network = async (resource, init) => {
+        assert.equal(new URL(String(resource)).origin, f.target);
+        sequences.push(new Headers(init?.headers).get('x-dharma-sequence'));
+        const response = await f.fetcher(resource, init);
+        if (!lost) {
+            lost = true;
+            throw new TypeError('Fixture response lost after acceptance');
+        }
+        return response;
+    };
+    await assert.rejects(verifyDemoDevice(f.scope, await createDemoDeviceTransport(f.scope, { store: f.store, fetcher: network })), /response lost/);
+    const pendingPath = `${scopePath(f.scope, f.scope.hqUrl)}.pending-status.json`;
+    const pending = JSON.parse(await readFile(pendingPath, 'utf8'));
+    assert.equal(new URL(pending.url).origin, f.scope.hqUrl);
+    await verifyDemoDevice(f.scope, await createDemoDeviceTransport(f.scope, { store: f.store, fetcher: network }));
+    assert.deepEqual(sequences, [String(f.config.nextSequence), String(f.config.nextSequence)]);
+    const after = JSON.parse(await readFile(scopePath(f.scope, f.scope.hqUrl), 'utf8'));
+    assert.equal(after.nextSequence, f.config.nextSequence + 1);
+    for (const [account, value] of before)
+        assert.equal(f.values.get(account), value);
+    await assert.rejects(readFile(pendingPath), { code: 'ENOENT' });
+});
+test('grant-free issuance cannot consume the business sequence, and pending status resumes unchanged', async (t) => {
+    const f = await fixture(t), before = new Map(f.values), sequences = [];
+    let lost = true;
+    const network = async (resource, init) => {
+        if (String(resource).includes('/transport-continuity'))
+            return f.issue(resource, init);
+        sequences.push(new Headers(init?.headers).get('x-dharma-sequence'));
+        if (lost) {
+            lost = false;
+            throw new TypeError('Fixture status response lost');
+        }
+        return f.fetcher(resource, init);
+    };
+    await assert.rejects(verifyDemoDevice(f.scope, await createDemoDeviceTransport(f.scope, { store: f.store, fetcher: network })), /response lost/);
+    const pendingPath = `${scopePath(f.scope, f.scope.hqUrl)}.pending-status.json`;
+    const pendingBefore = await readFile(pendingPath, 'utf8');
+    const deps = await createDemoDeviceTransport(f.scope, { store: f.store, fetcher: network });
+    await deps.connectTransport(f.target);
+    assert.equal(await readFile(pendingPath, 'utf8'), pendingBefore);
+    assert.equal(JSON.parse(await readFile(scopePath(f.scope, f.scope.hqUrl), 'utf8')).nextSequence, f.config.nextSequence);
+    await verifyDemoDevice(f.scope, deps);
+    assert.deepEqual(sequences, [String(f.config.nextSequence), String(f.config.nextSequence)]);
+    assert.equal(JSON.parse(await readFile(scopePath(f.scope, f.scope.hqUrl), 'utf8')).nextSequence, f.config.nextSequence + 1);
+    for (const [account, value] of before)
+        assert.equal(f.values.get(account), value);
+});
+test('routine status refreshes near-expiry transport autonomously before unchanged signed work', async (t) => {
+    const f = await fixture(t), before = new Map(f.values);
+    await acceptDemoTransport(f.shortCertificate(), f.binding, { transportOrigin: f.target, requestNonce: f.certificate.requestNonce }, { store: f.store });
+    const network = (resource, init) => String(resource).includes('/transport-continuity') ? f.issue(resource, init) : f.fetcher(resource, init);
+    await verifyDemoDevice(f.scope, await createDemoDeviceTransport(f.scope, { store: f.store, fetcher: network }));
+    assert.equal(f.calls.length, 2);
+    assert.ok(f.calls[0].includes('/transport-continuity'));
+    assert.ok(f.calls[1].includes('/status'));
+    assert.equal(JSON.parse(await readFile(scopePath(f.scope, f.scope.hqUrl), 'utf8')).nextSequence, f.config.nextSequence + 1);
+    for (const [account, value] of before)
+        assert.equal(f.values.get(account), value);
+});
+//# sourceMappingURL=demoDeviceTransport.test.js.map

package/dist/demoDeviceTransport.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"demoDeviceTransport.test.js","sourceRoot":"","sources":["../src/demoDeviceTransport.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,IAA0B,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAEnG,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,KAAK,UAAU,OAAO,CAAC,CAAc;IACnC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,0BAA0B,EAAE,cAAc,EAAE,aAAa;QAC9E,YAAY,EAAE,sCAAsC,EAAE,oBAAoB,EAAE,4BAA4B;QACxG,cAAc,EAAE,sCAAsC,EAAE,SAAS,EAAE,CAAC;IACtE,MAAM,QAAQ,GAAG,sCAAsC,EAAE,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAChI,MAAM,QAAQ,GAAG,EAAE,MAAM,EAAE,iCAA0C,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc;QACzG,UAAU,EAAE,CAAC,EAAE,kBAAkB,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS;QAClE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAE;gBAC9F,MAAM,EAAE,QAAiB,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC7E,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;IAC5F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,KAAK,GAAsB,EAAE,OAAO,EAAE,sBAAsB;QAChE,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAC1D,KAAK,CAAC,QAAQ,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAiB,KAAK,EAAC,QAAQ,EAAC,EAAE;QAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAClE,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS;gBAC3F,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClG,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,eAAe,EACrE,GAAG,KAAK,CAAC,KAAK,8BAA8B,KAAK,CAAC,cAAc,iBAAiB,KAAK,CAAC,YAAY,4BAA4B,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACxJ,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ;gBAC/F,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,sBAAsB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/H,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;YACrG,QAAQ,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC;IACF,MAAM,iBAAiB,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAChJ,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACjB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ;QAChG,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QAC/E,gBAAgB,EAAE,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,EAAE,CAAC;IACrF,MAAM,MAAM,GAAG,2BAA2B,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7D,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,qCAAqC,EAAE,OAAO,EAAE,qCAAqC;QAC1G,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,QAAQ;QACpF,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAClF,gBAAgB,EAAE,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC;QACvG,eAAe,EAAE,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,iBAAiB,EAAE,UAAU;QACpG,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;IAC5F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;QACpE,KAAK,EAAE,KAAK,EAAE,QAAqC,EAAE,IAAkB,EAAE,EAAE;YACzE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAChI,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAE,CAAC;YACjF,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE;gBACpH,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,yBAAyB,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACnF,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,CAAC;QACD,WAAW,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;AACxF,CAAC;AAED,IAAI,CAAC,sGAAsG,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACrH,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,mBAAmB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,EAChD,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9F,MAAM,gBAAgB,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACrF,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,CAAC;QAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5I,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,iBAAiB;QAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;AAC/F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yEAAyE,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACxF,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,gBAAgB,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,yBAAyB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAClH,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACvF,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC;IACtF,KAAK,MAAM,KAAK,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;QACxC,IAAI,KAAK,KAAK,IAAI;YAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;;YAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACjG,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8GAA8G,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC7H,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9F,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,EAAE,mCAAmC,CAAC,CAAC;IAC1G,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,mCAAmC,CAAC,CAAC;IAC9F,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+FAA+F,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC9G,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,GAAa,EAAE,CAAC;IACjF,MAAM,mBAAmB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,EAChD,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/F,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,MAAM,OAAO,GAAiB,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACrD,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACzD,SAAS,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAE,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC;YAAC,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;QAAC,CAAC;QAC1F,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,EAC3C,MAAM,yBAAyB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IACpG,MAAM,WAAW,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,gBAAgB,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,yBAAyB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAChH,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACpF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;IAC5D,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM;QAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IAClF,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,gGAAgG,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC/G,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,GAAa,EAAE,CAAC;IACjF,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,MAAM,OAAO,GAAiB,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvF,SAAS,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAE,CAAC,CAAC;QACrE,IAAI,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,KAAK,CAAC;YAAC,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;QAAC,CAAC;QAChF,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,yBAAyB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IACjJ,MAAM,WAAW,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC;IAC/E,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5F,MAAM,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;IACjE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACxH,MAAM,gBAAgB,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;IAC5H,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM;QAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;AACpF,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,0FAA0F,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACzG,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,OAAO,EACvD,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC3J,MAAM,gBAAgB,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,yBAAyB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAChH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACrG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;IAC5H,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM;QAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;AACpF,CAAC,CAAC,CAAC"}

package/dist/demoTransportCommand.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=demoTransportCommand.test.d.ts.map

package/dist/demoTransportCommand.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"demoTransportCommand.test.d.ts","sourceRoot":"","sources":["../src/demoTransportCommand.test.ts"],"names":[],"mappings":""}

package/dist/demoTransportCommand.test.js

@@ -0,0 +1,28 @@
+import assert from 'node:assert/strict';
+import { execFile } from 'node:child_process';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { resolve } from 'node:path';
+import test from 'node:test';
+import { promisify } from 'node:util';
+import { run } from './index.js';
+const exec = promisify(execFile);
+test('transport recovery dry-run verifies repository and target without issuing grants or keys', async (t) => {
+    const workspace = await mkdtemp(resolve(tmpdir(), 'dharma-transport-command-'));
+    t.after(() => rm(workspace, { recursive: true, force: true }));
+    await exec('git', ['init', '-q', workspace]);
+    await exec('git', ['-C', workspace, 'remote', 'add', 'origin', 'https://github.com/fixture/showcase.git']);
+    const args = ['demo', 'transport-connect', '--hq-url', 'https://original.example', '--organization-id', 'org_fixture',
+        '--repository-id', '10000000-0000-4000-8000-000000000001', '--normalized-repository', 'github.com/fixture/showcase',
+        '--workspace', workspace, '--dry-run'];
+    await assert.rejects(run(args), /transport-origin/);
+    for (const target of ['http://corrected.example', 'https://corrected.example/', 'https://original.example']) {
+        await assert.rejects(run([...args, '--transport-origin', target]), /target_invalid/);
+    }
+    assert.deepEqual(await run([...args, '--transport-origin', 'https://corrected.example']), {
+        ok: true, stage: 'demo_transport_plan', organizationId: 'org_fixture',
+        repositoryId: '10000000-0000-4000-8000-000000000001', normalizedRepository: 'github.com/fixture/showcase',
+        workspaceVerified: true, repositoryPackageState: 'not_connected', transportOrigin: 'https://corrected.example'
+    });
+});
+//# sourceMappingURL=demoTransportCommand.test.js.map

package/dist/demoTransportCommand.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"demoTransportCommand.test.js","sourceRoot":"","sources":["../src/demoTransportCommand.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACjC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC,IAAI,CAAC,0FAA0F,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACzG,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC;IAChF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7C,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,yCAAyC,CAAC,CAAC,CAAC;IAC3G,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,UAAU,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,aAAa;QACnH,iBAAiB,EAAE,sCAAsC,EAAE,yBAAyB,EAAE,6BAA6B;QACnH,aAAa,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACzC,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACpD,KAAK,MAAM,MAAM,IAAI,CAAC,0BAA0B,EAAE,4BAA4B,EAAE,0BAA0B,CAAC,EAAE,CAAC;QAC5G,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,oBAAoB,EAAE,2BAA2B,CAAC,CAAC,EAAE;QACxF,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,qBAAqB,EAAE,cAAc,EAAE,aAAa;QACrE,YAAY,EAAE,sCAAsC,EAAE,oBAAoB,EAAE,6BAA6B;QACzG,iBAAiB,EAAE,IAAI,EAAE,sBAAsB,EAAE,eAAe,EAAE,eAAe,EAAE,2BAA2B;KAAE,CAAC,CAAC;AACtH,CAAC,CAAC,CAAC"}

package/dist/demoTransportContinuity.d.ts

@@ -0,0 +1,39 @@
+import { type TrustedServerSigningKeyset } from '@dharma-ai-labs/agent-fabric-contracts';
+export interface DemoTransportContinuity {
+    schema: 'dharma.demo-transport-continuity/v1';
+    purpose: 'same-authority-repository-transport';
+    organizationId: string;
+    repositoryId: string;
+    deviceId: string;
+    installationId: string;
+    publicKeyEd25519: string;
+    enrollmentOrigin: string;
+    transportOrigin: string;
+    requestNonce: string;
+    policyRevision: number;
+    trustGeneration: number;
+    installedKeysetHash: string;
+    signingKeyVersion: string;
+    issuedAt: string;
+    expiresAt: string;
+    signature: string;
+}
+export interface DemoTransportContinuityContext {
+    organizationId: string;
+    repositoryId: string;
+    deviceId: string;
+    installationId: string;
+    publicKeyEd25519: string;
+    enrollmentOrigin: string;
+    transportOrigin: string;
+    requestNonce: string;
+    protectedKeyset: TrustedServerSigningKeyset;
+    minimumPolicyRevision: number;
+    previous?: {
+        policyRevision: number;
+        transportOrigin: string;
+    };
+    now?: Date;
+}
+export declare function verifyDemoTransportContinuity(input: unknown, inputContext: DemoTransportContinuityContext): Promise<DemoTransportContinuity>;
+//# sourceMappingURL=demoTransportContinuity.d.ts.map

package/dist/demoTransportContinuity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"demoTransportContinuity.d.ts","sourceRoot":"","sources":["../src/demoTransportContinuity.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,KAAK,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AAElF,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,qCAAqC,CAAC;IAC9C,OAAO,EAAE,qCAAqC,CAAC;IAC/C,cAAc,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IACvF,gBAAgB,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAClG,cAAc,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAC7E,iBAAiB,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;CACnF;AACD,MAAM,WAAW,8BAA8B;IAC7C,cAAc,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IACvF,gBAAgB,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAClG,eAAe,EAAE,0BAA0B,CAAC;IAC5C,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAuBD,wBAAsB,6BAA6B,CAAC,KAAK,EAAE,OAAO,EAChE,YAAY,EAAE,8BAA8B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAoChF"}

package/dist/demoTransportContinuity.js

@@ -0,0 +1,82 @@
+import { createPublicKey } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { Ajv2020 } from 'ajv/dist/2020.js';
+import { canonicalize, sha256, validateTrustedServerSigningKeysetContract, verifyCanonicalObject, verifyInitialServerSigningKeyset } from '@dharma-ai-labs/agent-fabric-contracts';
+let validator;
+function continuityValidator() {
+    return validator ??= (async () => {
+        const ajv = new Ajv2020({ allErrors: true, strict: true });
+        const addFormats = createRequire(import.meta.url)('ajv-formats').default;
+        addFormats(ajv);
+        return ajv.compile(JSON.parse(await readFile(new URL('./schemas/demo-transport-continuity.schema.json', import.meta.url), 'utf8')));
+    })();
+}
+function reject(reason) {
+    throw new Error(`Demo transport continuity rejected: ${reason}. Original enrollment and trust remain unchanged.`);
+}
+function canonicalOrigin(value) {
+    try {
+        return new URL(value).protocol === 'https:' && new URL(value).origin === value;
+    }
+    catch {
+        return false;
+    }
+}
+function validRevision(value) { return Number.isSafeInteger(value) && value > 0; }
+// The caller must load protectedKeyset and previous from the existing OS trust
+// store. A keyset returned by the proposed destination is never authority here.
+export async function verifyDemoTransportContinuity(input, inputContext) {
+    let value, context;
+    try {
+        value = structuredClone(input);
+        context = structuredClone(inputContext);
+    }
+    catch {
+        reject('schema_invalid');
+    }
+    const now = context.now ?? new Date();
+    if (!Number.isFinite(now.getTime()) || !validRevision(context.minimumPolicyRevision)
+        || (context.previous && !validRevision(context.previous.policyRevision)))
+        reject('context_invalid');
+    if (!(await continuityValidator())(value))
+        reject('schema_invalid');
+    if (!canonicalOrigin(value.enrollmentOrigin) || !canonicalOrigin(value.transportOrigin)
+        || (context.previous && !canonicalOrigin(context.previous.transportOrigin)))
+        reject('origin_invalid');
+    const keyset = context.protectedKeyset;
+    if (!validateTrustedServerSigningKeysetContract(keyset).ok)
+        reject('authority_invalid');
+    const signer = keyset.keys.find(key => key.keyVersion === keyset.signedByKeyVersion);
+    if (!signer || signer.status !== 'active' || keyset.keys.filter(key => key.status === 'active').length !== 1
+        || !/^[A-Za-z0-9_-]{43}$/.test(signer.publicKeyEd25519)
+        || Date.parse(signer.notBefore) > now.getTime()
+        || Date.parse(signer.notAfter) < Date.parse(keyset.expiresAt))
+        reject('authority_invalid');
+    const key = createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: signer.publicKeyEd25519 }, format: 'jwk' });
+    if (!verifyInitialServerSigningKeyset(keyset, key, context.organizationId, now).ok)
+        reject('authority_invalid');
+    const scopeFields = ['organizationId', 'repositoryId', 'deviceId', 'installationId',
+        'publicKeyEd25519', 'enrollmentOrigin', 'transportOrigin', 'requestNonce'];
+    if (scopeFields.some(field => value[field] !== context[field]))
+        reject('scope_mismatch');
+    if (value.trustGeneration !== keyset.generation || value.installedKeysetHash !== sha256(canonicalize(keyset))
+        || value.signingKeyVersion !== keyset.signedByKeyVersion)
+        reject('authority_mismatch');
+    if (value.policyRevision < context.minimumPolicyRevision)
+        reject('policy_revision_conflict');
+    if (context.previous && (value.policyRevision < context.previous.policyRevision
+        || (value.policyRevision === context.previous.policyRevision
+            && value.transportOrigin !== context.previous.transportOrigin)))
+        reject('policy_revision_conflict');
+    const issued = Date.parse(value.issuedAt), expiry = Date.parse(value.expiresAt);
+    if (issued > now.getTime() || expiry <= now.getTime() || expiry <= issued
+        || expiry - issued > 600_000 || expiry > Date.parse(keyset.expiresAt)
+        || expiry > Date.parse(signer.notAfter))
+        reject('lifetime_invalid');
+    const { signature, ...unsigned } = value;
+    if (!verifyCanonicalObject(unsigned, signature, key))
+        reject('signature_invalid');
+    return value;
+}
+//# sourceMappingURL=demoTransportContinuity.js.map

package/dist/demoTransportContinuity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"demoTransportContinuity.js","sourceRoot":"","sources":["../src/demoTransportContinuity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAyB,MAAM,kBAAkB,CAAC;AAElE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,0CAA0C,EACvE,qBAAqB,EAAE,gCAAgC,EACtB,MAAM,wCAAwC,CAAC;AAmBlF,IAAI,SAAyE,CAAC;AAC9E,SAAS,mBAAmB;IAC1B,OAAO,SAAS,KAAK,CAAC,KAAK,IAAI,EAAE;QAC/B,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,OAAwB,CAAC;QAC1F,UAAU,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,GAAG,CAAC,OAAO,CAA0B,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CACnE,IAAI,GAAG,CAAC,iDAAiD,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3F,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AACD,SAAS,MAAM,CAAC,MAAc;IAC5B,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,mDAAmD,CAAC,CAAC;AACpH,CAAC;AACD,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QAAC,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC;IAAC,CAAC;IACvF,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACzB,CAAC;AACD,SAAS,aAAa,CAAC,KAAa,IAAI,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;AAE1F,+EAA+E;AAC/E,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAAc,EAChE,YAA4C;IAC5C,IAAI,KAAc,EAAE,OAAuC,CAAC;IAC5D,IAAI,CAAC;QAAC,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IAAC,CAAC;IAChF,MAAM,CAAC;QAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAAC,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,qBAAqB,CAAC;WAC/E,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtG,IAAI,CAAC,CAAC,MAAM,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC;QAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACpE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC;WAClF,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAExG,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IACvC,IAAI,CAAC,0CAA0C,CAAC,MAAM,CAAC,CAAC,EAAE;QAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACrF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;WACvG,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;WACpD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE;WAC5C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAChH,IAAI,CAAC,gCAAgC,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,EAAE;QAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAChH,MAAM,WAAW,GAAG,CAAC,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB;QACjF,kBAAkB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,cAAc,CAAU,CAAC;IACtF,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzF,IAAI,KAAK,CAAC,eAAe,KAAK,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,mBAAmB,KAAK,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;WACxG,KAAK,CAAC,iBAAiB,KAAK,MAAM,CAAC,kBAAkB;QAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACzF,IAAI,KAAK,CAAC,cAAc,GAAG,OAAO,CAAC,qBAAqB;QAAE,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAC7F,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,cAAc;WAC1E,CAAC,KAAK,CAAC,cAAc,KAAK,OAAO,CAAC,QAAQ,CAAC,cAAc;eACvD,KAAK,CAAC,eAAe,KAAK,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAAE,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACxG,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChF,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,MAAM,IAAI,MAAM;WACpE,MAAM,GAAG,MAAM,GAAG,OAAO,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;WAClE,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACtE,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC;IACzC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC;QAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAClF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/demoTransportContinuity.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=demoTransportContinuity.test.d.ts.map

package/dist/demoTransportContinuity.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"demoTransportContinuity.test.d.ts","sourceRoot":"","sources":["../src/demoTransportContinuity.test.ts"],"names":[],"mappings":""}