@harrylabsj/kiwi 0.7.8 → 0.7.10

package/dist/mcp/types.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * kiwi-buyer-mcp 薄 facade 的 MCP 协议类型（战略 v2.5 §6.1 / §6.2）。
+ *
+ * 手写 stdio JSON-RPC 2.0 最小 MCP 实现（零新运行时依赖）：只实现 initialize
+ * 握手、notifications/initialized、tools/list、tools/call 与 JSON-RPC 错误面。
+ * 其余 MCP 能力（resources/prompts/sampling/roots）不在 v0.1 范围内——严格
+ * fail-closed，遇到未实现方法返回 METHOD_NOT_FOUND。
+ *
+ * 对外只暴露 5—7 个高层 Sourcing Tools，不暴露 KNP 底层消息、不复制 UCP 的
+ * Catalog/Checkout primitives（§6.1）。每个写 tool 绑定 idempotency_key 并返回
+ * 稳定 task_id / candidate_id / approval_id / agreement_id（§6.2）。
+ */
+/** MCP 协议版本：本 server 接受并回显的标准版本（v0.1）。Hermes v0.20.1 协商 2025-11-25。 */
+export declare const MCP_PROTOCOL_VERSIONS: readonly ["2024-11-05", "2025-06-18", "2025-11-25"];
+/** MCP 错误码（JSON-RPC 标准 + MCP 扩展）。 */
+export declare const MCP_ERROR: {
+    readonly PARSE_ERROR: -32700;
+    readonly INVALID_REQUEST: -32600;
+    readonly METHOD_NOT_FOUND: -32601;
+    readonly INVALID_PARAMS: -32602;
+    readonly INTERNAL_ERROR: -32603;
+    readonly SERVER_NOT_INITIALIZED: -32002;
+    readonly TOOL_NOT_FOUND: -32002;
+};
+export type McpJsonRpcVersion = "2.0";
+export interface JsonRpcRequest {
+    jsonrpc: McpJsonRpcVersion;
+    id: number | string | null;
+    method: string;
+    params?: unknown;
+}
+export interface JsonRpcResponse {
+    jsonrpc: McpJsonRpcVersion;
+    id: number | string | null;
+    result?: unknown;
+    error?: {
+        code: number;
+        message: string;
+        data?: unknown;
+    };
+}
+/** MCP initialize 请求参数（§6.1 version negotiation）。 */
+export interface McpInitializeParams {
+    protocolVersion: string;
+    capabilities?: Record<string, unknown>;
+    clientInfo?: {
+        name: string;
+        version?: string;
+    };
+}
+export interface McpInitializeResult {
+    protocolVersion: string;
+    capabilities: {
+        tools: {
+            listChanged: boolean;
+        };
+    };
+    serverInfo: {
+        name: string;
+        version: string;
+    };
+}
+export interface McpListToolsResult {
+    tools: McpTool[];
+}
+export interface McpTool {
+    name: string;
+    description: string;
+    inputSchema: Record<string, unknown>;
+}
+export interface McpCallToolParams {
+    name: string;
+    arguments?: Record<string, unknown>;
+}
+export interface McpCallToolResult {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+}
+/** 一个高层 Kiwi Sourcing Tool 的声明（§6.1 词表）。 */
+export interface KiwiToolDefinition {
+    name: string;
+    description: string;
+    /** 输入 JSON Schema（2020-12，自包含）。 */
+    inputSchema: Record<string, unknown>;
+    handle(args: Record<string, unknown>): Promise<McpCallToolResult>;
+}
+/** 顶层 Kiwi Sourcing Tool 词表（单一来源，§6.1）。 */
+export declare const KIWI_SOURCING_TOOLS: readonly ["kiwi_search", "kiwi_request_quotes", "kiwi_get_task", "kiwi_negotiate", "kiwi_accept_agreement", "kiwi_get_agreement", "kiwi_handoff"];
+export type KiwiSourcingToolName = (typeof KIWI_SOURCING_TOOLS)[number];

package/dist/mcp/types.js

@@ -0,0 +1,50 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * kiwi-buyer-mcp 薄 facade 的 MCP 协议类型（战略 v2.5 §6.1 / §6.2）。
+ *
+ * 手写 stdio JSON-RPC 2.0 最小 MCP 实现（零新运行时依赖）：只实现 initialize
+ * 握手、notifications/initialized、tools/list、tools/call 与 JSON-RPC 错误面。
+ * 其余 MCP 能力（resources/prompts/sampling/roots）不在 v0.1 范围内——严格
+ * fail-closed，遇到未实现方法返回 METHOD_NOT_FOUND。
+ *
+ * 对外只暴露 5—7 个高层 Sourcing Tools，不暴露 KNP 底层消息、不复制 UCP 的
+ * Catalog/Checkout primitives（§6.1）。每个写 tool 绑定 idempotency_key 并返回
+ * 稳定 task_id / candidate_id / approval_id / agreement_id（§6.2）。
+ */
+/** MCP 协议版本：本 server 接受并回显的标准版本（v0.1）。Hermes v0.20.1 协商 2025-11-25。 */
+export const MCP_PROTOCOL_VERSIONS = ["2024-11-05", "2025-06-18", "2025-11-25"];
+/** MCP 错误码（JSON-RPC 标准 + MCP 扩展）。 */
+export const MCP_ERROR = {
+    PARSE_ERROR: -32700,
+    INVALID_REQUEST: -32600,
+    METHOD_NOT_FOUND: -32601,
+    INVALID_PARAMS: -32602,
+    INTERNAL_ERROR: -32603,
+    SERVER_NOT_INITIALIZED: -32002,
+    TOOL_NOT_FOUND: -32002,
+};
+/** 顶层 Kiwi Sourcing Tool 词表（单一来源，§6.1）。 */
+export const KIWI_SOURCING_TOOLS = [
+    "kiwi_search",
+    "kiwi_request_quotes",
+    "kiwi_get_task",
+    "kiwi_negotiate",
+    "kiwi_accept_agreement",
+    "kiwi_get_agreement",
+    "kiwi_handoff",
+];
+//# sourceMappingURL=types.js.map

package/dist/mcp/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/mcp/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;GAWG;AAEH,uEAAuE;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAU,CAAC;AAEzF,qCAAqC;AACrC,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,WAAW,EAAE,CAAC,KAAK;IACnB,eAAe,EAAE,CAAC,KAAK;IACvB,gBAAgB,EAAE,CAAC,KAAK;IACxB,cAAc,EAAE,CAAC,KAAK;IACtB,cAAc,EAAE,CAAC,KAAK;IACtB,sBAAsB,EAAE,CAAC,KAAK;IAC9B,cAAc,EAAE,CAAC,KAAK;CACd,CAAC;AA4DX,2CAA2C;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,aAAa;IACb,qBAAqB;IACrB,eAAe;IACf,gBAAgB;IAChB,uBAAuB;IACvB,oBAAoB;IACpB,cAAc;CACN,CAAC"}

package/dist/merchant/ops.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Merchant Ops API（战略 v2.5 §7.6 / §7.7）。
+ *
+ * Host/Hermes 作为 Operator Console 查看 RFQ 队列、处理 human_required、批准
+ * 异常报价、查看 Agreement/Analytics。Merchant Core 仍是状态权威；Ops 只投影
+ * 状态与接收审批输入（§7.5 Intelligence & Ops Plane）。
+ *
+ * 命名空间隔离（§7.7）：本服务用 **merchant token** 认证（`kiwi.merchant.*`）；
+ * 任何 Buyer token 不得访问 Merchant Ops，任何 Merchant Ops token 不得获得
+ * Buyer Principal Memory。与 `kiwi.buyer.*`（Buyer Kit）完全分离。
+ */
+export interface MerchantOpsServiceOptions {
+    baseUrl: string;
+    /** 商家 API token（merchant 作用域，非 buyer token）。 */
+    merchantToken: string;
+    timeoutMs?: number;
+    fetchImpl?: typeof fetch;
+}
+export interface RfqConversation {
+    id: string;
+    buyer_id: string;
+    sku: string;
+    status: string;
+    next_actor: string;
+    created_at: string;
+    updated_at: string;
+    last_sender: string;
+    message_count?: number;
+}
+export interface HumanReviewConversation {
+    id: string;
+    buyer_id: string;
+    status: string;
+    reason?: string;
+    created_at?: string;
+}
+export interface MerchantAnalytics {
+    merchant_id: string;
+    total_rfqs: number;
+    pending_rfqs: number;
+    completed_rfqs: number;
+    human_review_count: number;
+}
+export declare class MerchantOpsService {
+    private readonly baseUrl;
+    private readonly merchantToken;
+    private readonly timeoutMs;
+    private readonly fetchImpl;
+    constructor(options: MerchantOpsServiceOptions);
+    /** RFQ 队列：商家名下活跃会话（§7.6 查看 RFQ）。 */
+    listRfqQueue(merchantId: string): Promise<{
+        rfqs: RfqConversation[];
+    }>;
+    /** human_required 会话（§7.6 处理人工审核）。 */
+    listHumanReview(merchantId: string): Promise<{
+        conversations: HumanReviewConversation[];
+    }>;
+    /** 处理 human_required：resolve 会话（商家运营决定）。 */
+    resolveReview(merchantId: string, conversationId: string, decision: string): Promise<{
+        ok: boolean;
+    }>;
+    /** Analytics：RFQ 量、待办/完成、人工审核数（§7.6）。 */
+    analytics(merchantId: string): Promise<MerchantAnalytics>;
+    private getJson;
+}

package/dist/merchant/ops.js

@@ -0,0 +1,75 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export class MerchantOpsService {
+    baseUrl;
+    merchantToken;
+    timeoutMs;
+    fetchImpl;
+    constructor(options) {
+        this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+        this.merchantToken = options.merchantToken;
+        this.timeoutMs = options.timeoutMs ?? 5000;
+        this.fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    }
+    /** RFQ 队列：商家名下活跃会话（§7.6 查看 RFQ）。 */
+    async listRfqQueue(merchantId) {
+        const data = await this.getJson(`/merchants/${encodeURIComponent(merchantId)}/conversations`);
+        const rfqs = Array.isArray(data)
+            ? data
+            : ((data.conversations ?? data.results) ?? []);
+        return { rfqs };
+    }
+    /** human_required 会话（§7.6 处理人工审核）。 */
+    async listHumanReview(merchantId) {
+        const data = await this.getJson(`/merchants/${encodeURIComponent(merchantId)}/human-review`);
+        return { conversations: data.conversations ?? [] };
+    }
+    /** 处理 human_required：resolve 会话（商家运营决定）。 */
+    async resolveReview(merchantId, conversationId, decision) {
+        const res = await this.fetchImpl(`${this.baseUrl}/conversations/${encodeURIComponent(conversationId)}/human-review/resolve`, {
+            method: "POST",
+            headers: { authorization: `Bearer ${this.merchantToken}`, "content-type": "application/json" },
+            body: JSON.stringify({ decision, merchant_id: merchantId }),
+            signal: AbortSignal.timeout(this.timeoutMs),
+        });
+        if (!res.ok)
+            throw new Error(`resolve review ${res.status}`);
+        const data = (await res.json());
+        return { ok: data.ok === true };
+    }
+    /** Analytics：RFQ 量、待办/完成、人工审核数（§7.6）。 */
+    async analytics(merchantId) {
+        const { rfqs } = await this.listRfqQueue(merchantId);
+        const { conversations } = await this.listHumanReview(merchantId);
+        return {
+            merchant_id: merchantId,
+            total_rfqs: rfqs.length,
+            pending_rfqs: rfqs.filter((r) => r.status === "waiting_merchant").length,
+            completed_rfqs: rfqs.filter((r) => r.status === "closed").length,
+            human_review_count: conversations.length,
+        };
+    }
+    async getJson(path) {
+        const res = await this.fetchImpl(`${this.baseUrl}${path}`, {
+            headers: { authorization: `Bearer ${this.merchantToken}`, accept: "application/json" },
+            signal: AbortSignal.timeout(this.timeoutMs),
+        });
+        if (!res.ok)
+            throw new Error(`merchant ops ${path} ${res.status}`);
+        return (await res.json());
+    }
+}
+//# sourceMappingURL=ops.js.map

package/dist/merchant/ops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops.js","sourceRoot":"","sources":["../../src/merchant/ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAkDH,MAAM,OAAO,kBAAkB;IACZ,OAAO,CAAS;IAChB,aAAa,CAAS;IACtB,SAAS,CAAS;IAClB,SAAS,CAAe;IAEzC,YAAY,OAAkC;QAC5C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;QAC3C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACzD,CAAC;IAED,oCAAoC;IACpC,KAAK,CAAC,YAAY,CAAC,UAAkB;QACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,cAAc,kBAAkB,CAAC,UAAU,CAAC,gBAAgB,CAC7D,CAAC;QACF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAC9B,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED,sCAAsC;IACtC,KAAK,CAAC,eAAe,CAAC,UAAkB;QACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,cAAc,kBAAkB,CAAC,UAAU,CAAC,eAAe,CAC5D,CAAC;QACF,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;IACrD,CAAC;IAED,4CAA4C;IAC5C,KAAK,CAAC,aAAa,CAAC,UAAkB,EAAE,cAAsB,EAAE,QAAgB;QAC9E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAC9B,GAAG,IAAI,CAAC,OAAO,kBAAkB,kBAAkB,CAAC,cAAc,CAAC,uBAAuB,EAC1F;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,aAAa,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC9F,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YAC3D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;SAC5C,CACF,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,yCAAyC;IACzC,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QACjE,OAAO;YACL,WAAW,EAAE,UAAU;YACvB,UAAU,EAAE,IAAI,CAAC,MAAM;YACvB,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,kBAAkB,CAAC,CAAC,MAAM;YACxE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;YAChE,kBAAkB,EAAE,aAAa,CAAC,MAAM;SACzC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,IAAY;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACzD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACtF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;SAC5C,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;CACF"}

package/dist/merchant/ucp-profile.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Merchant UCP Profile 生成（战略 v2.5 §7.1 Protocol Publishing / §7.8 UCP-ready）。
+ *
+ * 商家在 `/.well-known/ucp` 发布 UCP Profile：声明 Catalog service（指向真实
+ * 商品 endpoint）与 KNP 磋商 capability。Kiwi 的 Buyer 端（UcpProfileResolver）
+ * 通过该 profile 发现商家能力；商品 truth 仍在 merchant/marketplace，不落 Kiwi。
+ *
+ * UCP 命名不变量（基线 §8.3）：service 名 = {reverse-domain}.{service}，
+ * reverse-domain 反转即 namespace authority host；spec/schema URL origin MUST
+ * 与 namespace authority 一致。
+ */
+import type { UcpProfile } from "../discovery/ucp/types.js";
+export declare const UCP_VERSION = "2026-04-08";
+export interface MerchantUcpProfileOptions {
+    /** 商家规范域名（如 xihu-digital.example.com）——决定 namespace authority。 */
+    domain: string;
+    /** 商家 id（marketplace 商家 id，如 merchant-hz-xihu）。 */
+    merchantId: string;
+    /** 真实商品 catalog endpoint（marketplace search，如 http://127.0.0.1:8765/search/products）。 */
+    catalogEndpoint: string;
+}
+/** 由域名派生 reverse-domain（UCP §8.3：反转 authority host 的 label）。 */
+export declare function reverseDomain(domain: string): string;
+export declare function buildMerchantUcpProfile(options: MerchantUcpProfileOptions): UcpProfile;

package/dist/merchant/ucp-profile.js

@@ -0,0 +1,55 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export const UCP_VERSION = "2026-04-08";
+/** 由域名派生 reverse-domain（UCP §8.3：反转 authority host 的 label）。 */
+export function reverseDomain(domain) {
+    return domain.split(".").reverse().join(".");
+}
+export function buildMerchantUcpProfile(options) {
+    const authority = options.domain;
+    const rd = reverseDomain(options.domain);
+    const catalogService = `${rd}.catalog`;
+    const negotiationCapability = "com.harrylabsj.kiwi.shopping.negotiation";
+    return {
+        ucp: {
+            version: UCP_VERSION,
+            services: {
+                [catalogService]: [
+                    {
+                        version: UCP_VERSION,
+                        spec: `https://${authority}/.well-known/ucp#catalog`,
+                        transport: "rest",
+                        endpoint: options.catalogEndpoint,
+                        schema: `https://${authority}/schemas/catalog.json`,
+                    },
+                ],
+            },
+            capabilities: {
+                [negotiationCapability]: [
+                    {
+                        version: "1.0",
+                        spec: "https://kiwi.harrylabsj.com/spec/negotiation/1.0",
+                        schema: "https://kiwi.harrylabsj.com/schemas/negotiation/1.0/schema.json",
+                    },
+                ],
+            },
+        },
+        signing_keys: [],
+        // 商家元信息（非 UCP 标准字段，forward-compat）。
+        merchant_id: options.merchantId,
+    };
+}
+//# sourceMappingURL=ucp-profile.js.map

package/dist/merchant/ucp-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ucp-profile.js","sourceRoot":"","sources":["../../src/merchant/ucp-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAgBH,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC;AAWxC,gEAAgE;AAChE,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAkC;IACxE,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IACjC,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,GAAG,EAAE,UAAU,CAAC;IACvC,MAAM,qBAAqB,GAAG,0CAA0C,CAAC;IAEzE,OAAO;QACL,GAAG,EAAE;YACH,OAAO,EAAE,WAAW;YACpB,QAAQ,EAAE;gBACR,CAAC,cAAc,CAAC,EAAE;oBAChB;wBACE,OAAO,EAAE,WAAW;wBACpB,IAAI,EAAE,WAAW,SAAS,0BAA0B;wBACpD,SAAS,EAAE,MAAM;wBACjB,QAAQ,EAAE,OAAO,CAAC,eAAe;wBACjC,MAAM,EAAE,WAAW,SAAS,uBAAuB;qBACpD;iBACF;aACF;YACD,YAAY,EAAE;gBACZ,CAAC,qBAAqB,CAAC,EAAE;oBACvB;wBACE,OAAO,EAAE,KAAK;wBACd,IAAI,EAAE,kDAAkD;wBACxD,MAAM,EAAE,iEAAiE;qBAC1E;iBACF;aACF;SACF;QACD,YAAY,EAAE,EAAE;QAChB,oCAAoC;QACpC,WAAW,EAAE,OAAO,CAAC,UAAU;KAChC,CAAC;AACJ,CAAC"}

package/dist/product-cli.d.ts

@@ -42,7 +42,7 @@ export declare const DEFAULT_PROFILE_PATH: string;
  */
 export declare function writeDefaultProfile(yaml: string, profilePath?: string): void;
 /** 与 package.json / USAGE 同步的产品版本。 */
-export declare const PRODUCT_VERSION = "0.7.8";
+export declare const PRODUCT_VERSION = "0.7.10";
 /**
  * 缺省 kiwi-catalog 地址（单一来源，cli.ts 各处解析一致）。
  *

package/dist/product-cli.js

@@ -51,7 +51,7 @@ export function writeDefaultProfile(yaml, profilePath) {
     writeFileSync(target, yaml, { mode: 0o600 });
 }
 /** 与 package.json / USAGE 同步的产品版本。 */
-export const PRODUCT_VERSION = "0.7.8";
+export const PRODUCT_VERSION = "0.7.10";
 /**
  * 缺省 kiwi-catalog 地址（单一来源，cli.ts 各处解析一致）。
  *

package/dist/product-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"product-cli.js","sourceRoot":"","sources":["../src/product-cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE3F;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AAE/E;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,WAAoB;IACpE,MAAM,MAAM,GAAG,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,oBAAoB,CAAC;IACvF,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,sCAAsC;AACtC,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,qCAAqC,CAAC;AAEzE,MAAM,UAAU,GAAG;;;;;;;;;;;CAWlB,CAAC;AAEF,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;CAkBrB,CAAC;AAEF,MAAM,YAAY,GAAG;;;;;;;;CAQpB,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,UAAU,CAAC;IACzC,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,aAAa,CAAC;IAC/C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAC7C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,+DAA+D;AAE/D,MAAM,UAAU,iBAAiB,CAC/B,SAA4B;IAE5B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,IAAI,SAAS,CAAC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE;YAC9C,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,MAAM,CAAC,MAAM,IAAI,GAAG,EAAE,EAAE,CAAC;QACjG,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa;IAM1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,mBAAmB,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,SAAS,EAAE;YAChD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9F,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC;IACzC,MAAM,UAAU,GACd,QAAQ,CAAC,KAAK;QACd,eAAe,KAAK,SAAS;QAC7B,cAAc,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACvD,MAAM,YAAY,GAA4B;QAC5C,EAAE,EAAE,QAAQ,CAAC,EAAE,IAAI,UAAU;QAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC;IACF,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,YAAY,CAAC,OAAO,GAAG,eAAe,IAAI,SAAS,CAAC;QACpD,YAAY,CAAC,UAAU,GAAG,UAAU,CAAC;QACrC,IAAI,eAAe,KAAK,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;YACjD,YAAY,CAAC,KAAK;gBAChB,gBAAgB,eAAe,iBAAiB,eAAe,CAAC,mBAAmB,CAAC,GAAG,CAAC;QAC5F,CAAC;IACH,CAAC;SAAM,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACxC,YAAY,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IACtC,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE;QAC5C,YAAY,EAAE,YAAY;QAC1B,YAAY,EAAE,MAAM,aAAa,EAAE;KACpC,CAAC;IACF,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;IACjE,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;AACpC,CAAC"}
+{"version":3,"file":"product-cli.js","sourceRoot":"","sources":["../src/product-cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE3F;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AAE/E;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,WAAoB;IACpE,MAAM,MAAM,GAAG,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,oBAAoB,CAAC;IACvF,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,sCAAsC;AACtC,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AAExC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,qCAAqC,CAAC;AAEzE,MAAM,UAAU,GAAG;;;;;;;;;;;CAWlB,CAAC;AAEF,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;CAkBrB,CAAC;AAEF,MAAM,YAAY,GAAG;;;;;;;;CAQpB,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,UAAU,CAAC;IACzC,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,aAAa,CAAC;IAC/C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAC7C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,+DAA+D;AAE/D,MAAM,UAAU,iBAAiB,CAC/B,SAA4B;IAE5B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,IAAI,SAAS,CAAC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE;YAC9C,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,MAAM,CAAC,MAAM,IAAI,GAAG,EAAE,EAAE,CAAC;QACjG,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa;IAM1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,mBAAmB,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,SAAS,EAAE;YAChD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9F,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC;IACzC,MAAM,UAAU,GACd,QAAQ,CAAC,KAAK;QACd,eAAe,KAAK,SAAS;QAC7B,cAAc,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACvD,MAAM,YAAY,GAA4B;QAC5C,EAAE,EAAE,QAAQ,CAAC,EAAE,IAAI,UAAU;QAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC;IACF,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,YAAY,CAAC,OAAO,GAAG,eAAe,IAAI,SAAS,CAAC;QACpD,YAAY,CAAC,UAAU,GAAG,UAAU,CAAC;QACrC,IAAI,eAAe,KAAK,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;YACjD,YAAY,CAAC,KAAK;gBAChB,gBAAgB,eAAe,iBAAiB,eAAe,CAAC,mBAAmB,CAAC,GAAG,CAAC;QAC5F,CAAC;IACH,CAAC;SAAM,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACxC,YAAY,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IACtC,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE;QAC5C,YAAY,EAAE,YAAY;QAC1B,YAAY,EAAE,MAAM,aAAa,EAAE;KACpC,CAAC;IACF,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;IACjE,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;AACpC,CAAC"}

package/dist/trust/identity/auth-verifier.d.ts

@@ -99,6 +99,8 @@ export declare class HttpMessageSignatureVerifier implements AuthVerifier {
     private readonly maxClockSkewSeconds;
     private readonly maxSignatureAgeSeconds;
     private readonly expectedAuthority;
+    /** scheme 是否显式配置（公网 https 节点经反代终结 TLS 时必须显式 https）。 */
+    private readonly schemeExplicit;
     constructor(options: HttpMessageSignatureVerifierOptions);
     verify(ctx: AuthContext): AuthResult;
 }

package/dist/trust/identity/auth-verifier.js

@@ -48,6 +48,20 @@ export function parseClaimedIdentityHeader(headers) {
         out.role = obj.role;
     return out;
 }
+/**
+ * authority（host[:port]）→ hostname 归一（审查 K-M19）。Host 头可能带端口
+ * （veyquo.com:8443）或 IPv6 括号形式（[::1]:8080）；expectedAuthority 常为
+ * 无端口的 hostname。跨主机重放判定只看 hostname，端口差异不构成重放。
+ */
+function authorityHostname(authority) {
+    const trimmed = authority.trim();
+    if (trimmed.startsWith("[")) {
+        const end = trimmed.indexOf("]");
+        return end === -1 ? trimmed.toLowerCase() : trimmed.slice(0, end + 1).toLowerCase();
+    }
+    const host = trimmed.split(":")[0] ?? "";
+    return host.toLowerCase();
+}
 /** 完整 HTTP Message Signature 入站验证器（AuthVerifier 实现）。 */
 export class HttpMessageSignatureVerifier {
     name = "http-message-signature";
@@ -62,12 +76,15 @@ export class HttpMessageSignatureVerifier {
     maxClockSkewSeconds;
     maxSignatureAgeSeconds;
     expectedAuthority;
+    /** scheme 是否显式配置（公网 https 节点经反代终结 TLS 时必须显式 https）。 */
+    schemeExplicit;
     constructor(options) {
         this.resolver = options.resolver;
         this.policy = options.policy ?? DEFAULT_TRUST_POLICY;
         this.nonceStore = options.nonceStore;
         this.now = options.now ?? (() => Math.floor(Date.now() / 1000));
         this.scheme = options.scheme ?? "http";
+        this.schemeExplicit = options.scheme !== undefined;
         this.anonymousTrustLevel = options.anonymousTrustLevel ?? "T0";
         this.anonymousIdentity = options.anonymousIdentity ?? "anonymous";
         this.verifyCardJws = options.verifyCardJws;
@@ -90,7 +107,14 @@ export class HttpMessageSignatureVerifier {
         }
         // 签名请求：重建 @target-uri / @authority（服务端只有 origin-form req.url）。
         const authority = headerValue(headers, "host") ?? "";
-        const scheme = ctx.scheme ?? this.scheme;
+        // scheme 优先级：节点**显式**配置了 scheme + expectedAuthority（声明固定公网
+        // 身份，如 https://veyquo.com，反代终结 TLS、本地 socket 是 http）时，
+        // @target-uri 必须用节点声明的 scheme——否则签名者按 https 签、节点按本地 http
+        // 重建，验签必败。scheme 未显式配置（默认 http）时维持 ctx.scheme 优先（兼容
+        // 未配置身份的既有调用方）。
+        const scheme = this.schemeExplicit && this.expectedAuthority !== undefined
+            ? this.scheme
+            : (ctx.scheme ?? this.scheme);
         const targetUri = ctx.url.startsWith("http://") || ctx.url.startsWith("https://")
             ? ctx.url
             : `${scheme}://${authority}${ctx.url}`;
@@ -98,8 +122,12 @@ export class HttpMessageSignatureVerifier {
         // 并在此通过验签（签名绑定的是「签名者声明的目标」而非「实际连接目标」）。
         // 配置 expectedAuthority（自身广告主机 / SNI / TLS 证书 host）时强制绑定：
         // 声明的 authority 必须等于它，跨主机重放直接拒绝。
+        // 审查 K-M19：authority 可能带端口（Host: veyquo.com:8443），而
+        // expectedAuthority 是 hostname（advertised.hostname 无端口）——字符串全等
+        // 会把非默认端口的合法签名全拒（匿名却照常放行，签名认证形同虚设）。
+        // hostname 归一比较：端口差异不构成跨主机重放，hostname 不同仍拒绝。
         if (this.expectedAuthority !== undefined &&
-            authority.toLowerCase() !== this.expectedAuthority.toLowerCase()) {
+            authorityHostname(authority) !== authorityHostname(this.expectedAuthority)) {
             return {
                 authenticated: false,
                 protocolCode: "authorization_failed",

package/dist/trust/identity/auth-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-verifier.js","sourceRoot":"","sources":["../../../src/trust/identity/auth-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAyBH,OAAO,EAAE,YAAY,EAAgD,MAAM,uBAAuB,CAAC;AAEnG,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,oBAAoB,GAGrB,MAAM,mBAAmB,CAAC;AAE3B,iCAAiC;AACjC,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAClD,yCAAyC;AACzC,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAmCjE;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAsD;IAEtD,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IAC5D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7F,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAClE,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;QAAE,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC;IAC9E,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU;QAAE,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wDAAwD;AACxD,MAAM,OAAO,4BAA4B;IAC9B,IAAI,GAAG,wBAAwB,CAAC;IACxB,QAAQ,CAAc;IACtB,MAAM,CAAc;IACpB,UAAU,CAAyB;IACnC,GAAG,CAAe;IAClB,MAAM,CAAmB;IACzB,mBAAmB,CAAa;IAChC,iBAAiB,CAAS;IAC1B,aAAa,CAA2D;IACxE,mBAAmB,CAAS;IAC5B,sBAAsB,CAAS;IAC/B,iBAAiB,CAAqB;IAEvD,YAAY,OAA4C;QACtD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,oBAAoB,CAAC;QACrD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;QACvC,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,IAAI,CAAC;QAC/D,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,WAAW,CAAC;QAClE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,GAAG,CAAC;QAC9D,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,GAAG,CAAC;QACpE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACrD,CAAC;IAED,MAAM,CAAC,GAAgB;QACrB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAElC,mBAAmB;QACnB,IAAI,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC,KAAK,SAAS,EAAE,CAAC;YAC1D,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAC/D,OAAO;oBACL,aAAa,EAAE,KAAK;oBACpB,YAAY,EAAE,yBAAyB;oBACvC,MAAM,EAAE,sCAAsC,IAAI,CAAC,mBAAmB,EAAE;iBACzE,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACnE,CAAC;QAED,+DAA+D;QAC/D,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;QACzC,MAAM,SAAS,GACb,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;YAC7D,CAAC,CAAC,GAAG,CAAC,GAAG;YACT,CAAC,CAAC,GAAG,MAAM,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;QAE3C,2DAA2D;QAC3D,uCAAuC;QACvC,yDAAyD;QACzD,iCAAiC;QACjC,IACE,IAAI,CAAC,iBAAiB,KAAK,SAAS;YACpC,SAAS,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,EAChE,CAAC;YACD,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,YAAY,EAAE,sBAAsB;gBACpC,MAAM,EAAE,uBAAuB,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,sCAAsC,IAAI,CAAC,iBAAiB,EAAE;aACrI,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,0BAA0B,CAAC;YACxC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS;YACT,SAAS;YACT,OAAO;YACP,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;SACpD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACpF,CAAC;QAED,MAAM,SAAS,GAAsB;YACnC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,IAAI,MAAM,CAAC,KAAK;YAClD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC,mBAAmB;YAClE,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;QAEF,4CAA4C;QAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACxF,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,YAAY,EAAE,sBAAsB;gBACpC,MAAM,EAAE,+BAA+B,SAAS,CAAC,UAAU,EAAE;aAC9D,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACtD,IAAI,UAAiD,CAAC;QACtD,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO;oBACL,aAAa,EAAE,KAAK;oBACpB,YAAY,EAAE,yBAAyB;oBACvC,MAAM,EAAE,8BAA8B,SAAS,CAAC,UAAU,EAAE;iBAC7D,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO;oBACL,aAAa,EAAE,KAAK;oBACpB,YAAY,EAAE,sBAAsB;oBACpC,MAAM,EAAE,+CAA+C;iBACxD,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;gBACnB,OAAO;oBACL,aAAa,EAAE,KAAK;oBACpB,YAAY,EAAE,sBAAsB;oBACpC,MAAM,EAAE,2BAA2B,UAAU,CAAC,MAAM,EAAE;iBACvD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,MAAM,OAAO,GAAG;YACd,GAAG,CAAC,0BAA0B,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC9C,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QACF,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC3F,CAAC;QACD,mDAAmD;QACnD,4DAA4D;QAC5D,gDAAgD;QAChD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACzF,CAAC;CACF"}
+{"version":3,"file":"auth-verifier.js","sourceRoot":"","sources":["../../../src/trust/identity/auth-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAyBH,OAAO,EAAE,YAAY,EAAgD,MAAM,uBAAuB,CAAC;AAEnG,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,oBAAoB,GAGrB,MAAM,mBAAmB,CAAC;AAE3B,iCAAiC;AACjC,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAClD,yCAAyC;AACzC,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAmCjE;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAsD;IAEtD,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IAC5D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7F,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAClE,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;QAAE,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC;IAC9E,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU;QAAE,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED,wDAAwD;AACxD,MAAM,OAAO,4BAA4B;IAC9B,IAAI,GAAG,wBAAwB,CAAC;IACxB,QAAQ,CAAc;IACtB,MAAM,CAAc;IACpB,UAAU,CAAyB;IACnC,GAAG,CAAe;IAClB,MAAM,CAAmB;IACzB,mBAAmB,CAAa;IAChC,iBAAiB,CAAS;IAC1B,aAAa,CAA2D;IACxE,mBAAmB,CAAS;IAC5B,sBAAsB,CAAS;IAC/B,iBAAiB,CAAqB;IACvD,uDAAuD;IACtC,cAAc,CAAU;IAEzC,YAAY,OAA4C;QACtD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,oBAAoB,CAAC;QACrD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;QACvC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC;QACnD,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,IAAI,CAAC;QAC/D,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,WAAW,CAAC;QAClE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,GAAG,CAAC;QAC9D,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,GAAG,CAAC;QACpE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACrD,CAAC;IAED,MAAM,CAAC,GAAgB;QACrB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAElC,mBAAmB;QACnB,IAAI,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC,KAAK,SAAS,EAAE,CAAC;YAC1D,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAC/D,OAAO;oBACL,aAAa,EAAE,KAAK;oBACpB,YAAY,EAAE,yBAAyB;oBACvC,MAAM,EAAE,sCAAsC,IAAI,CAAC,mBAAmB,EAAE;iBACzE,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACnE,CAAC;QAED,+DAA+D;QAC/D,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACrD,2DAA2D;QAC3D,uDAAuD;QACvD,yDAAyD;QACzD,oDAAoD;QACpD,gBAAgB;QAChB,MAAM,MAAM,GACV,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS;YACzD,CAAC,CAAC,IAAI,CAAC,MAAM;YACb,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,SAAS,GACb,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;YAC7D,CAAC,CAAC,GAAG,CAAC,GAAG;YACT,CAAC,CAAC,GAAG,MAAM,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;QAE3C,2DAA2D;QAC3D,uCAAuC;QACvC,yDAAyD;QACzD,iCAAiC;QACjC,oDAAoD;QACpD,+DAA+D;QAC/D,oCAAoC;QACpC,6CAA6C;QAC7C,IACE,IAAI,CAAC,iBAAiB,KAAK,SAAS;YACpC,iBAAiB,CAAC,SAAS,CAAC,KAAK,iBAAiB,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAC1E,CAAC;YACD,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,YAAY,EAAE,sBAAsB;gBACpC,MAAM,EAAE,uBAAuB,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,sCAAsC,IAAI,CAAC,iBAAiB,EAAE;aACrI,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,0BAA0B,CAAC;YACxC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS;YACT,SAAS;YACT,OAAO;YACP,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;SACpD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACpF,CAAC;QAED,MAAM,SAAS,GAAsB;YACnC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,IAAI,MAAM,CAAC,KAAK;YAClD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC,mBAAmB;YAClE,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;QAEF,4CAA4C;QAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACxF,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,YAAY,EAAE,sBAAsB;gBACpC,MAAM,EAAE,+BAA+B,SAAS,CAAC,UAAU,EAAE;aAC9D,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACtD,IAAI,UAAiD,CAAC;QACtD,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO;oBACL,aAAa,EAAE,KAAK;oBACpB,YAAY,EAAE,yBAAyB;oBACvC,MAAM,EAAE,8BAA8B,SAAS,CAAC,UAAU,EAAE;iBAC7D,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO;oBACL,aAAa,EAAE,KAAK;oBACpB,YAAY,EAAE,sBAAsB;oBACpC,MAAM,EAAE,+CAA+C;iBACxD,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;gBACnB,OAAO;oBACL,aAAa,EAAE,KAAK;oBACpB,YAAY,EAAE,sBAAsB;oBACpC,MAAM,EAAE,2BAA2B,UAAU,CAAC,MAAM,EAAE;iBACvD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,MAAM,OAAO,GAAG;YACd,GAAG,CAAC,0BAA0B,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC9C,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QACF,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC3F,CAAC;QACD,mDAAmD;QACnD,4DAA4D;QAC5D,gDAAgD;QAChD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACzF,CAAC;CACF"}

package/dist/trust/identity/message-signature.js

@@ -225,14 +225,20 @@ function verifyEntry(entry, signatureBytes, input, now, skew, maxAge) {
         };
     }
     const algorithm = requested ?? key.algorithm;
-    // created/expires 窗口（RFC 9421 §3.1 / 防重放第一道防线）。
-    if (entry.params.created !== undefined) {
-        if (entry.params.created > now + skew) {
-            return { ok: false, code: "authorization_failed", reason: "signature created in the future" };
-        }
-        if (entry.params.expires === undefined && now - entry.params.created > maxAge) {
-            return { ok: false, code: "authorization_failed", reason: "signature is too old" };
-        }
+    // created/expires 窗口（RFC 9421 §2.2：created 必选——缺失即无任何防重放
+    // 时间边界，捕获签名可无限期重放。审查 K-M17：fail-closed，不再跳过时间检查）。
+    if (entry.params.created === undefined) {
+        return {
+            ok: false,
+            code: "authorization_failed",
+            reason: "signature has no created parameter (RFC 9421 requires it)",
+        };
+    }
+    if (entry.params.created > now + skew) {
+        return { ok: false, code: "authorization_failed", reason: "signature created in the future" };
+    }
+    if (entry.params.expires === undefined && now - entry.params.created > maxAge) {
+        return { ok: false, code: "authorization_failed", reason: "signature is too old" };
     }
     if (entry.params.expires !== undefined && entry.params.expires < now - skew) {
         return { ok: false, code: "authorization_failed", reason: "signature has expired" };