@dharma-ai-labs/agent-fabric 0.2.209 → 0.2.210

package/dist/schemas/device-signing-maintenance-host-progress.schema.json

@@ -0,0 +1,121 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.dharma-ai.io/device-signing-maintenance-host-progress/v1",
+  "title": "Device trust maintenance host-progress; not native continuation",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "organizationId",
+    "deviceId",
+    "preparationId",
+    "state",
+    "expiresAt",
+    "clientTrustInstalled",
+    "ready",
+    "disposition",
+    "authorityKind",
+    "nativeContinuationAuthorized"
+  ],
+  "properties": {
+    "schema": {
+      "const": "dharma.device-signing-maintenance-host-progress/v1"
+    },
+    "organizationId": {
+      "type": "string",
+      "maxLength": 128,
+      "pattern": "^org_[A-Za-z0-9]+$"
+    },
+    "deviceId": {
+      "type": "string",
+      "format": "uuid"
+    },
+    "preparationId": {
+      "type": "string",
+      "format": "uuid"
+    },
+    "recoveryId": {
+      "type": "string",
+      "format": "uuid"
+    },
+    "approvalId": {
+      "type": "string",
+      "format": "uuid"
+    },
+    "state": {
+      "enum": [
+        "prepared",
+        "awaiting_browser_offer",
+        "pending_approval",
+        "submission_unconfirmed",
+        "offer_unconfirmed",
+        "delivery_unconfirmed",
+        "failed",
+        "trust_installed"
+      ]
+    },
+    "expiresAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "clientTrustInstalled": {
+      "type": "boolean"
+    },
+    "ready": {
+      "const": false
+    },
+    "disposition": {
+      "const": "owned_host_progress_not_onboarding_ready"
+    },
+    "authorityKind": {
+      "const": "device_trust_maintenance"
+    },
+    "nativeContinuationAuthorized": {
+      "const": false
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "state": {
+            "enum": [
+              "pending_approval",
+              "delivery_unconfirmed",
+              "trust_installed"
+            ]
+          }
+        }
+      },
+      "then": {
+        "required": [
+          "recoveryId",
+          "approvalId"
+        ]
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "state": {
+            "const": "trust_installed"
+          }
+        }
+      },
+      "then": {
+        "properties": {
+          "clientTrustInstalled": {
+            "const": true
+          }
+        }
+      },
+      "else": {
+        "properties": {
+          "clientTrustInstalled": {
+            "const": false
+          }
+        }
+      }
+    }
+  ]
+}

package/dist/schemas/device-signing-maintenance-plan.schema.json

@@ -0,0 +1,136 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.dharma-ai.io/device-signing-maintenance-plan/v1",
+  "title": "Existing-device signing maintenance plan; no native continuation authority",
+  "$comment": "Distinct device-maintenance origin. Device possession, both fresh browser consents, current member/device/source, independent configured-key provenance, publication CAS and protected installation remain separate and mandatory. Native session liveness or execution is not asserted.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "planId",
+    "authority",
+    "preparedAt",
+    "expiresAt",
+    "origin",
+    "issuer",
+    "audience",
+    "organizationId",
+    "recipientMembershipId",
+    "deviceId",
+    "installationId",
+    "workspaceId",
+    "publicKeyEd25519",
+    "repositoryFingerprint",
+    "policyRevision",
+    "scopeDigest",
+    "contractDigest",
+    "sourceSelectionDigest",
+    "controllerBindingDigest",
+    "previousAnchorHash",
+    "protectedConfigDigest",
+    "previousGeneration",
+    "previousKeysetHash",
+    "previousRootFingerprint"
+  ],
+  "properties": {
+    "schema": {
+      "const": "dharma.device-signing-maintenance-plan/v1"
+    },
+    "planId": {
+      "$ref": "#/$defs/uuid"
+    },
+    "authority": {
+      "const": "local_context_only_not_recovery_authorization"
+    },
+    "preparedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "expiresAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "origin": {
+      "type": "string",
+      "maxLength": 256,
+      "format": "uri",
+      "pattern": "^https://[^/@?#\\s]+$(?![\\s\\S])"
+    },
+    "issuer": {
+      "type": "string",
+      "maxLength": 256,
+      "format": "uri",
+      "pattern": "^https://[^/@?#\\s]+$(?![\\s\\S])"
+    },
+    "audience": {
+      "const": "dharma.agent-fabric.signing-maintenance/v1"
+    },
+    "organizationId": {
+      "type": "string",
+      "maxLength": 256,
+      "pattern": "^org_[A-Za-z0-9]+$(?![\\s\\S])"
+    },
+    "recipientMembershipId": {
+      "$ref": "#/$defs/uuid"
+    },
+    "deviceId": {
+      "$ref": "#/$defs/uuid"
+    },
+    "installationId": {
+      "$ref": "#/$defs/uuid"
+    },
+    "workspaceId": {
+      "$ref": "#/$defs/uuid"
+    },
+    "publicKeyEd25519": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$(?![\\s\\S])"
+    },
+    "repositoryFingerprint": {
+      "$ref": "#/$defs/digest"
+    },
+    "policyRevision": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$(?![\\s\\S])"
+    },
+    "scopeDigest": {
+      "$ref": "#/$defs/digest"
+    },
+    "contractDigest": {
+      "$ref": "#/$defs/digest"
+    },
+    "sourceSelectionDigest": {
+      "$ref": "#/$defs/digest"
+    },
+    "controllerBindingDigest": {
+      "$ref": "#/$defs/digest"
+    },
+    "previousAnchorHash": {
+      "$ref": "#/$defs/digest"
+    },
+    "protectedConfigDigest": {
+      "$ref": "#/$defs/digest"
+    },
+    "previousGeneration": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 9007199254740991
+    },
+    "previousKeysetHash": {
+      "$ref": "#/$defs/digest"
+    },
+    "previousRootFingerprint": {
+      "$ref": "#/$defs/digest"
+    }
+  },
+  "$defs": {
+    "uuid": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$(?![\\s\\S])"
+    },
+    "digest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$(?![\\s\\S])"
+    }
+  }
+}

package/dist/schemas/device-signing-maintenance-preparation.schema.json

@@ -0,0 +1,56 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.dharma-ai.io/device-signing-maintenance-preparation/v1",
+  "title": "Existing-device signing maintenance preparation; no native continuation authority",
+  "$comment": "Distinct device-maintenance origin. Device possession, both fresh browser consents, current member/device/source, independent configured-key provenance, publication CAS and protected installation remain separate and mandatory. Native session liveness or execution is not asserted.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "purpose",
+    "method",
+    "path",
+    "plan",
+    "historicalKeysetCanonical",
+    "historicalRootPublicKey",
+    "credentialEncryptionPublicKey",
+    "nonce"
+  ],
+  "properties": {
+    "schema": {
+      "const": "dharma.device-signing-maintenance-preparation/v1"
+    },
+    "purpose": {
+      "const": "prepare_expired_signing_trust_recovery"
+    },
+    "method": {
+      "const": "POST"
+    },
+    "path": {
+      "const": "/api/v1/agent-fabric/signing-recovery/preparations"
+    },
+    "plan": {
+      "$ref": "https://schemas.dharma-ai.io/device-signing-maintenance-plan/v1"
+    },
+    "historicalKeysetCanonical": {
+      "type": "string",
+      "minLength": 2,
+      "maxLength": 16384
+    },
+    "historicalRootPublicKey": {
+      "$ref": "#/$defs/bytes32"
+    },
+    "credentialEncryptionPublicKey": {
+      "$ref": "#/$defs/bytes32"
+    },
+    "nonce": {
+      "$ref": "#/$defs/bytes32"
+    }
+  },
+  "$defs": {
+    "bytes32": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$(?![\\s\\S])"
+    }
+  }
+}

package/dist/schemas/device-signing-recovery-candidate.schema.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.dharma-ai.io/device-signing-recovery-candidate/v1",
+  "title": "Public candidate and publication evidence, not installation authority",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "organizationId", "recoveryId", "approvalId", "keysetCanonical", "rootPublicKey", "publication"],
+  "properties": {
+    "schema": {"const": "dharma.device-signing-recovery-candidate/v1"},
+    "organizationId": {"type": "string", "pattern": "^org_[A-Za-z0-9]+$(?![\\s\\S])", "maxLength": 200},
+    "recoveryId": {"type": "string", "format": "uuid", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$(?![\\s\\S])"},
+    "approvalId": {"type": "string", "format": "uuid", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$(?![\\s\\S])"},
+    "keysetCanonical": {"type": "string", "minLength": 1, "maxLength": 16384},
+    "rootPublicKey": {"type": "string", "pattern": "^[A-Za-z0-9_-]{43}$(?![\\s\\S])"},
+    "publication": {
+      "type": "object", "additionalProperties": false,
+      "required": ["schema", "organizationId", "recoveryId", "generation", "artifactHash", "publishedAt"],
+      "properties": {
+        "schema": {"const": "dharma.signing-recovery-publication/v1"},
+        "organizationId": {"type": "string", "pattern": "^org_[A-Za-z0-9]+$(?![\\s\\S])", "maxLength": 200},
+        "recoveryId": {"type": "string", "format": "uuid", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$(?![\\s\\S])"},
+        "generation": {"type": "integer", "minimum": 1, "maximum": 9007199254740991},
+        "artifactHash": {"type": "string", "pattern": "^sha256:[a-f0-9]{64}$(?![\\s\\S])"},
+        "publishedAt": {"type": "string", "format": "date-time"}
+      }
+    }
+  }
+}

package/dist/schemas/device-signing-recovery-challenge.schema.json

@@ -0,0 +1,52 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.dharma-ai.io/device-signing-recovery-challenge/v1",
+  "title": "Public device signing recovery proof; not consent or trust-installation authority",
+  "$comment": "Runtime validation additionally enforces canonical HTTPS origin/encoding/timestamps, matching expected context, strictly increasing generation, changed artifact and a live window no longer than 15 minutes. Server approval, provenance and replay fencing are separate.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "origin", "issuer", "audience", "recoveryId", "approvalId", "organizationId", "recipientMembershipId", "deviceId", "installationId", "workspaceId", "publicKeyEd25519", "credentialEncryptionPublicKey", "repositoryFingerprint", "policyRevision", "scopeDigest", "contractDigest", "sourceSelectionDigest", "nativeSessionBindingDigest", "previousAnchorHash", "protectedConfigDigest", "previousGeneration", "previousKeysetHash", "previousRootFingerprint", "candidateGeneration", "candidateKeysetHash", "candidateRootFingerprint", "candidateKeyVersionFingerprint", "purpose", "method", "path", "nonce", "issuedAt", "expiresAt", "authenticator"],
+  "properties": {
+    "schema": {"const": "dharma.device-signing-recovery-challenge/v1"},
+    "origin": {"type": "string", "maxLength": 256, "format": "uri", "pattern": "^https://[^/@?#\\s]+$"},
+    "issuer": {"type": "string", "maxLength": 256, "format": "uri", "pattern": "^https://[^/@?#\\s]+$"},
+    "audience": {"const": "dharma.agent-fabric.signing-recovery/v1"},
+    "recoveryId": {"$ref": "#/$defs/uuid"},
+    "approvalId": {"$ref": "#/$defs/uuid"},
+    "organizationId": {"type": "string", "maxLength": 256, "pattern": "^org_[A-Za-z0-9]+$"},
+    "recipientMembershipId": {"$ref": "#/$defs/uuid"},
+    "deviceId": {"$ref": "#/$defs/uuid"},
+    "installationId": {"$ref": "#/$defs/uuid"},
+    "workspaceId": {"$ref": "#/$defs/uuid"},
+    "publicKeyEd25519": {"$ref": "#/$defs/bytes32"},
+    "credentialEncryptionPublicKey": {"$ref": "#/$defs/bytes32"},
+    "repositoryFingerprint": {"$ref": "#/$defs/digest"},
+    "policyRevision": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$"},
+    "scopeDigest": {"$ref": "#/$defs/digest"},
+    "contractDigest": {"$ref": "#/$defs/digest"},
+    "sourceSelectionDigest": {"$ref": "#/$defs/digest"},
+    "nativeSessionBindingDigest": {"$ref": "#/$defs/digest"},
+    "previousAnchorHash": {"$ref": "#/$defs/digest"},
+    "protectedConfigDigest": {"$ref": "#/$defs/digest"},
+    "previousGeneration": {"$ref": "#/$defs/generation"},
+    "previousKeysetHash": {"$ref": "#/$defs/digest"},
+    "previousRootFingerprint": {"$ref": "#/$defs/digest"},
+    "candidateGeneration": {"$ref": "#/$defs/generation"},
+    "candidateKeysetHash": {"$ref": "#/$defs/digest"},
+    "candidateRootFingerprint": {"$ref": "#/$defs/digest"},
+    "candidateKeyVersionFingerprint": {"$ref": "#/$defs/digest"},
+    "purpose": {"const": "expired_signing_trust_reapproval"},
+    "method": {"const": "POST"},
+    "path": {"const": "/api/v1/agent-fabric/signing-recovery"},
+    "nonce": {"$ref": "#/$defs/bytes32"},
+    "issuedAt": {"type": "string", "format": "date-time", "maxLength": 256},
+    "expiresAt": {"type": "string", "format": "date-time", "maxLength": 256},
+    "authenticator": {"$ref": "#/$defs/bytes32"}
+  },
+  "$defs": {
+    "uuid": {"type": "string", "format": "uuid", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"},
+    "bytes32": {"type": "string", "pattern": "^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$"},
+    "digest": {"type": "string", "pattern": "^sha256:[a-f0-9]{64}$"},
+    "generation": {"type": "integer", "minimum": 1, "maximum": 9007199254740991}
+  }
+}

package/dist/schemas/device-signing-recovery-completion.schema.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.dharma-ai.io/device-signing-recovery-completion/v1",
+  "title": "Trust installation receipt, not customer readiness",
+  "type": "object", "additionalProperties": false,
+  "required": ["schema", "organizationId", "deviceId", "installationId", "workspaceId", "recoveryId", "approvalId", "generation", "keysetHash", "rootFingerprint", "publicationArtifactHash", "observedAt", "connectionMode", "ready", "disposition"],
+  "properties": {
+    "schema": {"const": "dharma.device-signing-recovery-completion/v1"},
+    "organizationId": {"type": "string", "pattern": "^org_[A-Za-z0-9]+$(?![\\s\\S])", "maxLength": 200},
+    "deviceId": {"$ref": "#/$defs/uuid"}, "installationId": {"$ref": "#/$defs/uuid"},
+    "workspaceId": {"$ref": "#/$defs/uuid"}, "recoveryId": {"$ref": "#/$defs/uuid"}, "approvalId": {"$ref": "#/$defs/uuid"},
+    "generation": {"type": "integer", "minimum": 1, "maximum": 9007199254740991},
+    "keysetHash": {"$ref": "#/$defs/digest"}, "rootFingerprint": {"$ref": "#/$defs/digest"},
+    "publicationArtifactHash": {"$ref": "#/$defs/digest"},
+    "observedAt": {"type": "string", "format": "date-time"},
+    "connectionMode": {"enum": ["manual", "resume"]},
+    "ready": {"const": false}, "disposition": {"const": "signing_trust_installed_not_onboarding_ready"}
+  },
+  "$defs": {
+    "uuid": {"type": "string", "format": "uuid", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$(?![\\s\\S])"},
+    "digest": {"type": "string", "pattern": "^sha256:[a-f0-9]{64}$(?![\\s\\S])"}
+  }
+}

package/dist/schemas/device-signing-recovery-delivery-request.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.dharma-ai.io/device-signing-recovery-delivery-request/v1",
+  "title": "Existing device possession request for exact approved recovery delivery",
+  "type": "object", "additionalProperties": false,
+  "required": ["schema", "action", "organizationId", "recoveryId", "approvalId", "signature"],
+  "properties": {
+    "schema": {"const": "dharma.device-signing-recovery-delivery-request/v1"},
+    "action": {"const": "delivery"},
+    "organizationId": {"type": "string", "pattern": "^org_[A-Za-z0-9]+$(?![\\s\\S])", "maxLength": 200},
+    "recoveryId": {"$ref": "#/$defs/uuid"},
+    "approvalId": {"$ref": "#/$defs/uuid"},
+    "signature": {"type": "string", "pattern": "^[A-Za-z0-9_-]{86}$(?![\\s\\S])"}
+  },
+  "$defs": {"uuid": {"type": "string", "format": "uuid", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$(?![\\s\\S])"}}
+}

package/dist/schemas/device-signing-recovery-delivery.schema.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.dharma-ai.io/device-signing-recovery-delivery/v1",
+  "title": "Encrypted device signing recovery delivery, not installation authority",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "organizationId", "recoveryId", "approvalId", "deviceId", "issuedAt", "expiresAt", "ephemeralPublicKey", "iv", "ciphertext", "tag", "contextDigest"],
+  "properties": {
+    "schema": {"const": "dharma.device-signing-recovery-delivery/v1"},
+    "organizationId": {"type": "string", "pattern": "^org_[A-Za-z0-9]+$(?![\\s\\S])", "maxLength": 200},
+    "recoveryId": {"type": "string", "format": "uuid", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$(?![\\s\\S])"},
+    "approvalId": {"type": "string", "format": "uuid", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$(?![\\s\\S])"},
+    "deviceId": {"type": "string", "format": "uuid", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$(?![\\s\\S])"},
+    "issuedAt": {"type": "string", "format": "date-time"},
+    "expiresAt": {"type": "string", "format": "date-time"},
+    "ephemeralPublicKey": {"type": "string", "pattern": "^[A-Za-z0-9_-]{43}$(?![\\s\\S])"},
+    "iv": {"type": "string", "pattern": "^[A-Za-z0-9_-]{16}$(?![\\s\\S])"},
+    "ciphertext": {"type": "string", "pattern": "^[A-Za-z0-9_-]+$(?![\\s\\S])", "minLength": 1, "maxLength": 43691},
+    "tag": {"type": "string", "pattern": "^[A-Za-z0-9_-]{22}$(?![\\s\\S])"},
+    "contextDigest": {"type": "string", "pattern": "^sha256:[a-f0-9]{64}$(?![\\s\\S])"}
+  }
+}

package/dist/schemas/device-signing-recovery-host-progress.schema.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.dharma-ai.io/device-signing-recovery-host-progress/v1",
+  "title": "Owning-host signing recovery progress, not onboarding readiness",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "organizationId", "deviceId", "preparationId", "state", "expiresAt", "clientTrustInstalled", "ready", "disposition"],
+  "properties": {
+    "schema": {"const": "dharma.device-signing-recovery-host-progress/v1"},
+    "organizationId": {"type": "string", "maxLength": 128, "pattern": "^org_[A-Za-z0-9]+$"},
+    "deviceId": {"type": "string", "format": "uuid"},
+    "preparationId": {"type": "string", "format": "uuid"},
+    "recoveryId": {"type": "string", "format": "uuid"},
+    "approvalId": {"type": "string", "format": "uuid"},
+    "state": {"enum": ["prepared", "awaiting_browser_offer", "pending_approval", "submission_unconfirmed", "offer_unconfirmed", "delivery_unconfirmed", "failed", "trust_installed"]},
+    "expiresAt": {"type": "string", "format": "date-time"},
+    "clientTrustInstalled": {"type": "boolean"},
+    "ready": {"const": false},
+    "disposition": {"const": "owned_host_progress_not_onboarding_ready"}
+  },
+  "allOf": [
+    {"if": {"properties": {"state": {"enum": ["pending_approval", "delivery_unconfirmed", "trust_installed"]}}},
+     "then": {"required": ["recoveryId", "approvalId"]}},
+    {"if": {"properties": {"state": {"const": "trust_installed"}}},
+     "then": {"properties": {"clientTrustInstalled": {"const": true}}},
+     "else": {"properties": {"clientTrustInstalled": {"const": false}}}}
+  ]
+}

package/dist/schemas/device-signing-recovery-offer-progress.schema.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.dharma-ai.io/device-signing-recovery-offer-progress/v1",
+  "title": "Prepared signing recovery offer progress without installed authority",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "organizationId", "deviceId", "preparationId", "state", "expiresAt", "deviceProofRegistered", "clientTrustInstalled", "ready", "disposition"],
+  "properties": {
+    "schema": {"const": "dharma.device-signing-recovery-offer-progress/v1"},
+    "organizationId": {"type": "string", "maxLength": 128, "pattern": "^org_[A-Za-z0-9]+$"},
+    "deviceId": {"type": "string", "format": "uuid"},
+    "preparationId": {"type": "string", "format": "uuid"},
+    "recoveryId": {"type": "string", "format": "uuid"},
+    "approvalId": {"type": "string", "format": "uuid"},
+    "state": {"enum": ["awaiting_browser_offer", "pending_approval"]},
+    "expiresAt": {"type": "string", "format": "date-time"},
+    "deviceProofRegistered": {"type": "boolean"},
+    "clientTrustInstalled": {"const": false},
+    "ready": {"const": false},
+    "disposition": {"const": "awaiting_separate_browser_consent_not_onboarding_ready"}
+  },
+  "oneOf": [
+    {
+      "properties": {"state": {"const": "awaiting_browser_offer"}, "deviceProofRegistered": {"const": false}},
+      "not": {"anyOf": [{"required": ["recoveryId"]}, {"required": ["approvalId"]}]}
+    },
+    {
+      "required": ["recoveryId", "approvalId"],
+      "properties": {"state": {"const": "pending_approval"}, "deviceProofRegistered": {"const": true}}
+    }
+  ]
+}

package/dist/schemas/device-signing-recovery-offer-read-request.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema":"https://json-schema.org/draft/2020-12/schema",
+  "$id":"https://schemas.dharma-ai.io/device-signing-recovery-offer-read-request/v1",
+  "title":"Exact signed-device pending offer read; not connected relay or browser authority",
+  "$comment":"Runtime also enforces canonical timestamps, a live maximum 60-second request window, exact expected selection and canonical base64. The server verifies device transport separately.",
+  "type":"object","additionalProperties":false,
+  "required":["schema","purpose","method","path","organizationId","deviceId","preparationId","requestId","nonce","issuedAt","expiresAt"],
+  "properties":{
+    "schema":{"const":"dharma.device-signing-recovery-offer-read-request/v1"},"purpose":{"const":"read_prepared_recovery_offer"},
+    "method":{"const":"POST"},"path":{"const":"/api/v1/agent-fabric/signing-recovery/offers/read"},
+    "organizationId":{"type":"string","maxLength":128,"pattern":"^org_[A-Za-z0-9]+$(?![\\s\\S])"},
+    "deviceId":{"type":"string","format":"uuid"},"preparationId":{"type":"string","format":"uuid"},"requestId":{"type":"string","format":"uuid"},
+    "nonce":{"type":"string","pattern":"^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$(?![\\s\\S])"},
+    "issuedAt":{"type":"string","format":"date-time","maxLength":40},"expiresAt":{"type":"string","format":"date-time","maxLength":40}
+  }
+}

package/dist/schemas/device-signing-recovery-offer-registration-receipt.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema":"https://json-schema.org/draft/2020-12/schema",
+  "$id":"https://schemas.dharma-ai.io/device-signing-recovery-offer-registration-receipt/v1",
+  "title":"Idempotent pending device proof receipt; no consent, publication or credentials",
+  "$comment":"Runtime binds all identifiers to the exact request and expiry to the already validated challenge, checks current time, and retains explicit not-ready state.",
+  "type":"object","additionalProperties":false,
+  "required":["schema","organizationId","deviceId","preparationId","recoveryId","approvalId","state","expiresAt","deviceProofRegistered","clientTrustInstalled","ready"],
+  "properties":{
+    "schema":{"const":"dharma.device-signing-recovery-offer-registration-receipt/v1"},
+    "organizationId":{"type":"string","maxLength":128,"pattern":"^org_[A-Za-z0-9]+$(?![\\s\\S])"},
+    "deviceId":{"type":"string","format":"uuid"},"preparationId":{"type":"string","format":"uuid"},
+    "recoveryId":{"type":"string","format":"uuid"},"approvalId":{"type":"string","format":"uuid"},
+    "state":{"const":"pending_approval"},"expiresAt":{"type":"string","format":"date-time","maxLength":40},
+    "deviceProofRegistered":{"const":true},"clientTrustInstalled":{"const":false},"ready":{"const":false}
+  }
+}

package/dist/schemas/device-signing-recovery-offer-registration-request.schema.json

@@ -0,0 +1,18 @@
+{
+  "$schema":"https://json-schema.org/draft/2020-12/schema",
+  "$id":"https://schemas.dharma-ai.io/device-signing-recovery-offer-registration-request/v1",
+  "title":"Exact retained-offer device proof registration; not consent or trust installation",
+  "$comment":"The request carries only identifiers and the dedicated device purpose proof. Server-owned intent, current authority, device transport and purpose proof are independently verified before an idempotent registration.",
+  "type":"object","additionalProperties":false,
+  "required":["schema","purpose","method","path","organizationId","deviceId","preparationId","requestId","nonce","issuedAt","expiresAt","recoveryId","approvalId","signature"],
+  "properties":{
+    "schema":{"const":"dharma.device-signing-recovery-offer-registration-request/v1"},"purpose":{"const":"register_prepared_recovery_proof"},
+    "method":{"const":"POST"},"path":{"const":"/api/v1/agent-fabric/signing-recovery/offers/register"},
+    "organizationId":{"type":"string","maxLength":128,"pattern":"^org_[A-Za-z0-9]+$(?![\\s\\S])"},
+    "deviceId":{"type":"string","format":"uuid"},"preparationId":{"type":"string","format":"uuid"},"requestId":{"type":"string","format":"uuid"},
+    "nonce":{"type":"string","pattern":"^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$(?![\\s\\S])"},
+    "issuedAt":{"type":"string","format":"date-time","maxLength":40},"expiresAt":{"type":"string","format":"date-time","maxLength":40},
+    "recoveryId":{"type":"string","format":"uuid"},"approvalId":{"type":"string","format":"uuid"},
+    "signature":{"type":"string","pattern":"^[A-Za-z0-9_-]{85}[AQgw]$(?![\\s\\S])"}
+  }
+}

package/dist/schemas/device-signing-recovery-offer-response.schema.json

@@ -0,0 +1,43 @@
+{
+  "$schema":"https://json-schema.org/draft/2020-12/schema",
+  "$id":"https://schemas.dharma-ai.io/device-signing-recovery-offer-response/v1",
+  "title":"Public pending challenge for its exact prepared device; always not ready",
+  "$comment":"Runtime additionally validates the original preparation and every local challenge binding, immutable expiry, exact next generation and distinct root. No intent, candidate keyset, credential, consent or installation is returned.",
+  "oneOf":[
+    {
+      "type":"object","additionalProperties":false,
+      "required":["schema","organizationId","deviceId","preparationId","expiresAt","state","deviceProofRegistered","clientTrustInstalled","ready"],
+      "properties":{
+        "schema":{"const":"dharma.device-signing-recovery-offer-response/v1"},
+        "organizationId":{"type":"string","maxLength":128,"pattern":"^org_[A-Za-z0-9]+$(?![\\s\\S])"},
+        "deviceId":{"type":"string","format":"uuid"},"preparationId":{"type":"string","format":"uuid"},
+        "expiresAt":{"type":"string","format":"date-time","maxLength":40},"state":{"const":"awaiting_browser_offer"},
+        "deviceProofRegistered":{"const":false},"clientTrustInstalled":{"const":false},"ready":{"const":false}
+      }
+    },
+    {
+      "type":"object","additionalProperties":false,
+      "required":["schema","organizationId","deviceId","preparationId","expiresAt","state","deviceProofRegistered","clientTrustInstalled","ready","challenge"],
+      "properties":{
+        "schema":{"const":"dharma.device-signing-recovery-offer-response/v1"},
+        "organizationId":{"type":"string","maxLength":128,"pattern":"^org_[A-Za-z0-9]+$(?![\\s\\S])"},
+        "deviceId":{"type":"string","format":"uuid"},"preparationId":{"type":"string","format":"uuid"},
+        "expiresAt":{"type":"string","format":"date-time","maxLength":40},"state":{"const":"awaiting_device_proof"},
+        "deviceProofRegistered":{"const":false},"clientTrustInstalled":{"const":false},"ready":{"const":false},
+        "challenge":{"oneOf":[{"$ref":"https://schemas.dharma-ai.io/device-signing-recovery-challenge/v1"},{"$ref":"https://schemas.dharma-ai.io/device-signing-maintenance-challenge/v1"}]}
+      }
+    },
+    {
+      "type":"object","additionalProperties":false,
+      "required":["schema","organizationId","deviceId","preparationId","expiresAt","state","deviceProofRegistered","clientTrustInstalled","ready","challenge"],
+      "properties":{
+        "schema":{"const":"dharma.device-signing-recovery-offer-response/v1"},
+        "organizationId":{"type":"string","maxLength":128,"pattern":"^org_[A-Za-z0-9]+$(?![\\s\\S])"},
+        "deviceId":{"type":"string","format":"uuid"},"preparationId":{"type":"string","format":"uuid"},
+        "expiresAt":{"type":"string","format":"date-time","maxLength":40},"state":{"const":"pending_approval"},
+        "deviceProofRegistered":{"const":true},"clientTrustInstalled":{"const":false},"ready":{"const":false},
+        "challenge":{"oneOf":[{"$ref":"https://schemas.dharma-ai.io/device-signing-recovery-challenge/v1"},{"$ref":"https://schemas.dharma-ai.io/device-signing-maintenance-challenge/v1"}]}
+      }
+    }
+  ]
+}