@twin.org/dataspace-control-plane-service 0.0.3-next.28 → 0.0.3-next.30

package/dist/es/dataspaceControlPlaneService.js

@@ -1,7 +1,7 @@
 import { ContextIdKeys, ContextIdStore } from "@twin.org/context";
-import { ArrayHelper, BaseError, ComponentFactory, Converter, GeneralError, Guards, Is, NotFoundError, RandomHelper, StringHelper, UnauthorizedError, ValidationError } from "@twin.org/core";
+import { ArrayHelper, BaseError, ComponentFactory, Converter, GeneralError, Guards, Is, NotFoundError, ObjectHelper, RandomHelper, StringHelper, UnauthorizedError, ValidationError } from "@twin.org/core";
 import { JsonLdHelper } from "@twin.org/data-json-ld";
-import { DataspaceAppFactory, TransferProcessRole } from "@twin.org/dataspace-models";
+import { DataspaceAppFactory, DataspaceTransferFormat, TransferProcessRole, getJsonLdId, getJsonLdType } from "@twin.org/dataspace-models";
 import { EngineCoreFactory } from "@twin.org/engine-models";
 import { ComparisonOperator } from "@twin.org/entity";
 import { EntityStorageConnectorFactory } from "@twin.org/entity-storage-models";
@@ -9,7 +9,7 @@ import { OdrlPolicyHelper, PolicyRequesterFactory } from "@twin.org/rights-manag
 import { DataspaceProtocolContexts, DataspaceProtocolContractNegotiationTypes, DataspaceProtocolEndpointType, DataspaceProtocolHelper, DataspaceProtocolTransferProcessStateType, DataspaceProtocolTransferProcessTypes } from "@twin.org/standards-dataspace-protocol";
 import { TrustHelper } from "@twin.org/trust-models";
 import { DataspaceControlPlanePolicyRequester } from "./dataspaceControlPlanePolicyRequester.js";
-import { getJsonLdId, getJsonLdType } from "./utils/dataHelpers.js";
+import { EndpointProperties } from "./models/endpointProperties.js";
 import { isCatalogError, isCatalogErrorName, transformToTransferError } from "./utils/transferErrorUtils.js";
 /**
  * Dataspace Control Plane Service implementation.
@@ -35,6 +35,14 @@ export class DataspaceControlPlaneService {
      * @internal
      */
     static _STALLED_NEGOTIATION_THRESHOLD_MS = 30 * 60 * 1000;
+    /**
+     * Matches the base64url encoding of a BLAKE2b-256 hash (32 bytes → 43 base64url
+     * chars, no padding). Used to discriminate the tenant-hash portion of a
+     * composite tenant identifier from a bare IOTA DID, whose `<id>` segment is
+     * always `0x<64-hex>` (66 chars) and cannot match.
+     * @internal
+     */
+    static _TENANT_HASH_PATTERN = /^[\w-]{43}$/;
     /**
      * The logging component.
      * @internal
@@ -92,6 +100,12 @@ export class DataspaceControlPlaneService {
      * @internal
      */
     _dataPlanePath;
+    /**
+     * Factory key used to look up the data plane component. Resolved lazily at push-time
+     * (not at construction) so the data plane may register after the control plane is built.
+     * @internal
+     */
+    _dataPlaneComponentType;
     /**
      * Policy requester instance for handling negotiation callbacks.
      * @internal
@@ -133,61 +147,20 @@ export class DataspaceControlPlaneService {
         this._trustComponent = ComponentFactory.get(options?.trustComponentType ?? "trust");
         this._overrideTrustGeneratorType = options?.config?.overrideTrustGeneratorType;
         this._dataPlanePath = Is.stringValue(options?.config?.dataPlanePath)
-            ? StringHelper.trimLeadingSlashes(options.config.dataPlanePath)
+            ? StringHelper.trimTrailingSlashes(StringHelper.trimLeadingSlashes(options.config.dataPlanePath))
             : undefined;
         this._taskScheduler = ComponentFactory.getIfExists(options?.taskSchedulerComponentType ?? "task-scheduler");
+        // Data plane component is optional and resolved lazily. The control plane is initialised
+        // BEFORE the data plane in engine startup order, so `getRegisteredInstanceTypeOptional`
+        // returns undefined when the engine constructs us — the wiring override can't fire here.
+        // The default therefore matches the engine's actual factory key
+        // (`nameofKebabCase(DataspaceDataPlaneService)`) so the late-bound `requireDataPlane()`
+        // lookup at push time finds it regardless of init order.
+        this._dataPlaneComponentType =
+            options?.dataPlaneComponentType ?? "dataspace-data-plane-service";
         this._urlTransformerComponent = ComponentFactory.get(options?.urlTransformerComponentType ?? "url-transformer");
         this._negotiationCallbacks = new Map();
-        const internalCallback = {
-            onStateChanged: async (negotiationId, state, data) => {
-                for (const [key, cb] of this._negotiationCallbacks.entries()) {
-                    try {
-                        await cb.onStateChanged(negotiationId, state, data);
-                    }
-                    catch (error) {
-                        await this._loggingComponent?.log({
-                            level: "error",
-                            source: DataspaceControlPlaneService.CLASS_NAME,
-                            ts: Date.now(),
-                            message: "negotiationCallbackError",
-                            data: { key, negotiationId, method: "onStateChanged", error }
-                        });
-                    }
-                }
-            },
-            onCompleted: async (negotiationId, agreementId) => {
-                for (const [key, cb] of this._negotiationCallbacks.entries()) {
-                    try {
-                        await cb.onCompleted(negotiationId, agreementId);
-                    }
-                    catch (error) {
-                        await this._loggingComponent?.log({
-                            level: "error",
-                            source: DataspaceControlPlaneService.CLASS_NAME,
-                            ts: Date.now(),
-                            message: "negotiationCallbackError",
-                            data: { key, negotiationId, method: "onCompleted", error }
-                        });
-                    }
-                }
-            },
-            onFailed: async (negotiationId, reason) => {
-                for (const [key, cb] of this._negotiationCallbacks.entries()) {
-                    try {
-                        await cb.onFailed(negotiationId, reason);
-                    }
-                    catch (error) {
-                        await this._loggingComponent?.log({
-                            level: "error",
-                            source: DataspaceControlPlaneService.CLASS_NAME,
-                            ts: Date.now(),
-                            message: "negotiationCallbackError",
-                            data: { key, negotiationId, method: "onFailed", error }
-                        });
-                    }
-                }
-            }
-        };
+        const internalCallback = this.createInternalCallback();
         this._policyRequester = new DataspaceControlPlanePolicyRequester(options?.loggingComponentType ?? "logging", internalCallback);
         PolicyRequesterFactory.register(DataspaceControlPlaneService._REQUESTER_TYPE, () => this._policyRequester);
     }
@@ -371,10 +344,12 @@ export class DataspaceControlPlaneService {
             }
             const assigneeIdentity = OdrlPolicyHelper.extractAssigneeIdentity(agreement);
             const assigneeIds = ArrayHelper.fromObjectOrArray(assigneeIdentity);
-            if (!assigneeIds.includes(trustInfo.identity)) {
+            // The agreement's assignee is stamped by the provider as the consumer's composite identity (`consumerNodeDid:hash(consumerTenantId)`).
+            const callerComposite = this.buildCallerComposite(trustInfo);
+            if (!assigneeIds.includes(callerComposite)) {
                 throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "callerNotAuthorizedForAgreement");
             }
-            consumerIdentity = trustInfo.identity;
+            consumerIdentity = callerComposite;
             const assignerIdentity = OdrlPolicyHelper.extractAssignerIdentity(agreement);
             const assignerIds = ArrayHelper.fromObjectOrArray(assignerIdentity);
             if (assignerIds.length > 1) {
@@ -389,6 +364,8 @@ export class DataspaceControlPlaneService {
             return transformToTransferError(error, { consumerPid: request.consumerPid, providerPid });
         }
         const now = new Date();
+        const requestContextIds = await ContextIdStore.getContextIds();
+        const requestTenantId = requestContextIds?.[ContextIdKeys.Tenant];
         const storageEntity = {
             id: Converter.bytesToHex(RandomHelper.generate(32)),
             consumerPid: request.consumerPid,
@@ -404,6 +381,7 @@ export class DataspaceControlPlaneService {
             policies,
             callbackAddress: request.callbackAddress,
             format: request.format,
+            tenantId: Is.stringValue(requestTenantId) ? requestTenantId : undefined,
             dataAddress: request.dataAddress,
             dateCreated: now.toISOString(),
             dateModified: now.toISOString()
@@ -443,6 +421,7 @@ export class DataspaceControlPlaneService {
      * Role Performed: Provider / Consumer
      */
     async startTransfer(message, publicOrigin, trustPayload) {
+        publicOrigin = StringHelper.trimTrailingSlashes(publicOrigin);
         const trustInfo = await TrustHelper.verifyTrust(this._trustComponent, trustPayload, "startTransfer");
         const validationFailures = await DataspaceProtocolHelper.validate(JsonLdHelper.toNodeObject(message));
         if (Is.arrayValue(validationFailures)) {
@@ -457,7 +436,15 @@ export class DataspaceControlPlaneService {
         }
         try {
             const { entity, role } = await this.lookupTransferByMessage(message);
-            this.validateCallerIsProvider(trustInfo.identity, entity);
+            this.validateCallerIsProvider(this.buildCallerComposite(trustInfo), entity);
+            // Only the tenant that owns this transfer can mutate it.
+            // Skipped on single-tenant nodes (entity.tenantId undefined).
+            const callingTenantId = await this.resolveCallingTenantId();
+            if (Is.stringValue(entity.tenantId) &&
+                Is.stringValue(callingTenantId) &&
+                entity.tenantId !== callingTenantId) {
+                throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "transferWrongTenant");
+            }
             if (entity.state !== DataspaceProtocolTransferProcessStateType.REQUESTED &&
                 entity.state !== DataspaceProtocolTransferProcessStateType.SUSPENDED) {
                 return transformToTransferError(new GeneralError(DataspaceControlPlaneService.CLASS_NAME, "invalidStateForStart", {
@@ -466,6 +453,7 @@ export class DataspaceControlPlaneService {
                     currentState: entity.state
                 }), message);
             }
+            const previousState = entity.state;
             entity.state = DataspaceProtocolTransferProcessStateType.STARTED;
             entity.dateModified = new Date();
             await this._transferProcessStorage.set(this.modelToStorageEntity(entity));
@@ -505,7 +493,68 @@ export class DataspaceControlPlaneService {
             //
             // See: https://eclipse-dataspace-protocol-base.github.io/DataspaceProtocol/2025-1-err1/#transfer-start-message
             // ============================================================================
-            if (Is.empty(entity.dataAddress)) {
+            if (Is.empty(entity.dataAddress) && entity.format === DataspaceTransferFormat.HttpProxyPost) {
+                // PROVIDER-INITIATED PUSH: Consumer requested push but did not supply an /inbox.
+                // Provider returns its own /inbox URL + a signed JWT so the consumer can verify
+                // the incoming activities (HttpProxy-POST / DataspaceTransferFormat.HttpProxyPost).
+                if (!Is.stringValue(this._dataPlanePath)) {
+                    return transformToTransferError(new GeneralError(DataspaceControlPlaneService.CLASS_NAME, "pushTransferDataPathNotConfigured", { consumerPid: entity.consumerPid }), message);
+                }
+                if (!Is.stringValue(entity.providerIdentity)) {
+                    throw new GeneralError(DataspaceControlPlaneService.CLASS_NAME, "providerIdentityMissing");
+                }
+                // providerIdentity is a composite `nodeDid:hash(tenantId)`
+                const pushProviderId = this.parseTenantIdentifier(entity.providerIdentity);
+                const accessToken = await this._trustComponent.generate(pushProviderId.nodeDid, this._overrideTrustGeneratorType, {
+                    subject: {
+                        consumerPid: entity.consumerPid,
+                        providerPid: entity.providerPid,
+                        agreementId: entity.agreementId,
+                        datasetId: entity.datasetId
+                    }
+                }, pushProviderId.tenantIdHash);
+                Guards.stringValue(DataspaceControlPlaneService.CLASS_NAME, "accessToken", accessToken);
+                const tokenString = accessToken;
+                let fullEndpoint = `${publicOrigin}/${this._dataPlanePath}/inbox`;
+                // Bake the provider's tenant token into the /inbox URL so the consumer's
+                // inbound POST routes to the right tenant via TenantProcessor — mirrors the
+                // pull-mode endpoint baking below.
+                const inboxContextIds1 = await ContextIdStore.getContextIds();
+                const inboxTenantId1 = inboxContextIds1?.[ContextIdKeys.Tenant];
+                if (Is.stringValue(inboxTenantId1)) {
+                    fullEndpoint = await this._urlTransformerComponent.addEncryptedQueryParamToUrl(fullEndpoint, "tenant", inboxTenantId1);
+                }
+                response.dataAddress = {
+                    "@type": DataspaceProtocolTransferProcessTypes.DataAddress,
+                    endpointType: DataspaceProtocolEndpointType.HttpsActivityStreamEndpoint,
+                    endpoint: fullEndpoint,
+                    endpointProperties: [
+                        {
+                            "@type": DataspaceProtocolTransferProcessTypes.EndpointProperty,
+                            name: EndpointProperties.Authorization,
+                            value: tokenString
+                        },
+                        {
+                            "@type": DataspaceProtocolTransferProcessTypes.EndpointProperty,
+                            name: EndpointProperties.AuthType,
+                            value: "bearer"
+                        }
+                    ]
+                };
+                await this._loggingComponent?.log({
+                    level: "info",
+                    source: DataspaceControlPlaneService.CLASS_NAME,
+                    ts: Date.now(),
+                    message: "pushTransferStarted",
+                    data: {
+                        consumerPid: entity.consumerPid,
+                        providerPid: entity.providerPid,
+                        endpoint: fullEndpoint,
+                        transferMode: DataspaceTransferFormat.HttpProxyPost
+                    }
+                });
+            }
+            else if (Is.empty(entity.dataAddress)) {
                 if (!Is.stringValue(this._dataPlanePath)) {
                     return transformToTransferError(new GeneralError(DataspaceControlPlaneService.CLASS_NAME, "pullTransfersNotSupported", {
                         consumerPid: entity.consumerPid,
@@ -514,18 +563,22 @@ export class DataspaceControlPlaneService {
                 }
                 // Provider signs the data access token with its own identity.
                 // The subject contains the transfer context claims that the data plane
-                // will verify when the consumer presents this token.
+                // will verify when the consumer presents this token. Parse
+                // the composite providerIdentity to extract the signing nodeDid and
+                // the tenant-hash to embed as `tid`.
                 if (!Is.stringValue(entity.providerIdentity)) {
                     throw new GeneralError(DataspaceControlPlaneService.CLASS_NAME, "providerIdentityMissing");
                 }
-                const accessToken = await this._trustComponent.generate(entity.providerIdentity, this._overrideTrustGeneratorType, {
+                const pullProviderId = this.parseTenantIdentifier(entity.providerIdentity);
+                const accessToken = await this._trustComponent.generate(pullProviderId.nodeDid, this._overrideTrustGeneratorType, {
                     subject: {
                         consumerPid: entity.consumerPid,
                         providerPid: entity.providerPid,
                         agreementId: entity.agreementId,
                         datasetId: entity.datasetId
                     }
-                });
+                }, pullProviderId.tenantIdHash);
+                Guards.stringValue(DataspaceControlPlaneService.CLASS_NAME, "accessToken", accessToken);
                 const tokenString = accessToken;
                 let fullEndpoint = `${publicOrigin}/${this._dataPlanePath}`;
                 const contextIds = await ContextIdStore.getContextIds();
@@ -540,12 +593,12 @@ export class DataspaceControlPlaneService {
                     endpointProperties: [
                         {
                             "@type": DataspaceProtocolTransferProcessTypes.EndpointProperty,
-                            name: "authorization",
+                            name: EndpointProperties.Authorization,
                             value: tokenString
                         },
                         {
                             "@type": DataspaceProtocolTransferProcessTypes.EndpointProperty,
-                            name: "authType",
+                            name: EndpointProperties.AuthType,
                             value: "bearer"
                         }
                     ]
@@ -564,35 +617,59 @@ export class DataspaceControlPlaneService {
                 });
             }
             else {
-                // PUSH MODE: Provider will push data to consumer's specified endpoint
-                // The consumer provided dataAddress in TransferRequestMessage, indicating
-                // where they want data sent. Provider acknowledges and will push data there.
-                //
-                // TODO: PUSH transfer implementation (RFC-007 future work)
-                // Implementation would need to:
-                // 1. Generate provider's own trust token to authenticate when pushing to consumer
-                // 2. Validate consumer's dataAddress endpoint is reachable
-                // 3. Extract any consumer-provided authorization from endpointProperties
-                // 4. Schedule background task to push data to consumer's endpoint
-                // 5. POST data to entity.dataAddress.endpoint with provider's trust token
-                // 6. Implement retry logic with exponential backoff
-                // 7. Send TransferCompletionMessage when push completes successfully
-                //
-                // Trust flow for PUSH (mirror of PULL):
-                // - PULL: Provider generates token → Consumer uses to authenticate when pulling
-                // - PUSH: Provider generates token → Provider uses to authenticate when pushing
+                // PUSH MODE (consumer-initiated): Consumer provided their /inbox endpoint in
+                // the TransferRequestMessage.dataAddress. Provider responds with its own /inbox
+                // URL so the consumer knows where to route data notifications.
+                if (!Is.stringValue(entity.dataAddress?.endpoint) ||
+                    !Is.stringValue(entity.dataAddress?.endpointType)) {
+                    return transformToTransferError(new GeneralError(DataspaceControlPlaneService.CLASS_NAME, "invalidPushDataAddress", {
+                        consumerPid: entity.consumerPid
+                    }), message);
+                }
+                if (!Is.stringValue(this._dataPlanePath)) {
+                    return transformToTransferError(new GeneralError(DataspaceControlPlaneService.CLASS_NAME, "pushTransferDataPathNotConfigured", { consumerPid: entity.consumerPid }), message);
+                }
+                let fullEndpoint = `${publicOrigin}/${this._dataPlanePath}/inbox`;
+                // Bake the provider's tenant token into the /inbox URL so the consumer's
+                // inbound POST routes to the right tenant via TenantProcessor — mirrors the
+                // pull-mode endpoint baking.
+                const inboxContextIds2 = await ContextIdStore.getContextIds();
+                const inboxTenantId2 = inboxContextIds2?.[ContextIdKeys.Tenant];
+                if (Is.stringValue(inboxTenantId2)) {
+                    fullEndpoint = await this._urlTransformerComponent.addEncryptedQueryParamToUrl(fullEndpoint, "tenant", inboxTenantId2);
+                }
+                response.dataAddress = {
+                    "@type": DataspaceProtocolTransferProcessTypes.DataAddress,
+                    endpointType: DataspaceProtocolEndpointType.HttpsActivityStreamEndpoint,
+                    endpoint: fullEndpoint
+                };
                 await this._loggingComponent?.log({
-                    level: "warn",
+                    level: "info",
                     source: DataspaceControlPlaneService.CLASS_NAME,
                     ts: Date.now(),
-                    message: "pushTransferModeNotImplemented",
+                    message: "pushTransferStarted",
                     data: {
                         consumerPid: entity.consumerPid,
                         providerPid: entity.providerPid,
-                        consumerEndpoint: entity.dataAddress.endpoint,
-                        transferMode: "PUSH"
+                        endpoint: fullEndpoint,
+                        transferMode: DataspaceTransferFormat.HttpProxyPush
                     }
                 });
+                try {
+                    const dataPlane = this.requireDataPlane();
+                    if (previousState === DataspaceProtocolTransferProcessStateType.REQUESTED) {
+                        await dataPlane.setupPushSubscription(entity.consumerPid);
+                    }
+                    else if (previousState === DataspaceProtocolTransferProcessStateType.SUSPENDED) {
+                        await dataPlane.resumePushSubscription(entity.consumerPid);
+                    }
+                }
+                catch (setupError) {
+                    entity.state = previousState;
+                    entity.dateModified = new Date();
+                    await this._transferProcessStorage.set(this.modelToStorageEntity(entity));
+                    throw setupError;
+                }
             }
             return response;
         }
@@ -624,7 +701,27 @@ export class DataspaceControlPlaneService {
         }
         try {
             const { entity, role } = await this.lookupTransferByMessage(message);
-            this.validateCallerIsConsumer(trustInfo.identity, entity);
+            this.validateCallerIsConsumer(this.buildCallerComposite(trustInfo), entity);
+            // Only the tenant that owns this transfer can mutate it.
+            // Skipped on single-tenant nodes (entity.tenantId undefined).
+            const callingTenantId = await this.resolveCallingTenantId();
+            if (Is.stringValue(entity.tenantId) &&
+                Is.stringValue(callingTenantId) &&
+                entity.tenantId !== callingTenantId) {
+                throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "transferWrongTenant");
+            }
+            // DSP idempotency: re-receiving TransferCompletionMessage for a transfer already
+            // in COMPLETED should return the same success response, not invalidStateForComplete.
+            // Data-plane teardown already ran on the first attempt.
+            if (entity.state === DataspaceProtocolTransferProcessStateType.COMPLETED) {
+                return {
+                    "@context": [DataspaceProtocolContexts.Context],
+                    "@type": DataspaceProtocolTransferProcessTypes.TransferProcess,
+                    consumerPid: entity.consumerPid,
+                    providerPid: entity.providerPid,
+                    state: entity.state
+                };
+            }
             if (entity.state !== DataspaceProtocolTransferProcessStateType.STARTED) {
                 return transformToTransferError(new GeneralError(DataspaceControlPlaneService.CLASS_NAME, "invalidStateForComplete", {
                     consumerPid: entity.consumerPid,
@@ -632,6 +729,7 @@ export class DataspaceControlPlaneService {
                     currentState: entity.state
                 }), message);
             }
+            const previousState = entity.state;
             entity.state = DataspaceProtocolTransferProcessStateType.COMPLETED;
             entity.dateModified = new Date();
             await this._transferProcessStorage.set(this.modelToStorageEntity(entity));
@@ -646,6 +744,20 @@ export class DataspaceControlPlaneService {
                     role
                 }
             });
+            if (this.isPushFormat(entity.format)) {
+                try {
+                    await this.requireDataPlane().teardownPushSubscription(entity.consumerPid);
+                }
+                catch (teardownError) {
+                    // Symmetric rollback: data-plane teardown failed, revert the transfer state
+                    // so the client can retry. Without this the storage row is COMPLETED but
+                    // the subscription is still flowing, and a retry hits invalidStateForComplete.
+                    entity.state = previousState;
+                    entity.dateModified = new Date();
+                    await this._transferProcessStorage.set(this.modelToStorageEntity(entity));
+                    throw teardownError;
+                }
+            }
             return {
                 "@context": [DataspaceProtocolContexts.Context],
                 "@type": DataspaceProtocolTransferProcessTypes.TransferProcess,
@@ -679,7 +791,26 @@ export class DataspaceControlPlaneService {
         }
         try {
             const { entity, role } = await this.lookupTransferByMessage(message);
-            this.validateCallerIsTransferParty(trustInfo.identity, entity);
+            this.validateCallerIsTransferParty(this.buildCallerComposite(trustInfo), entity);
+            // S2 belt-and-braces: only the tenant that owns this transfer can mutate it.
+            // Skipped on single-tenant nodes (entity.tenantId undefined).
+            const callingTenantId = await this.resolveCallingTenantId();
+            if (Is.stringValue(entity.tenantId) &&
+                Is.stringValue(callingTenantId) &&
+                entity.tenantId !== callingTenantId) {
+                throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "transferWrongTenant");
+            }
+            // DSP idempotency: re-receiving TransferSuspensionMessage for a transfer already
+            // in SUSPENDED should return success. Data-plane suspend already ran.
+            if (entity.state === DataspaceProtocolTransferProcessStateType.SUSPENDED) {
+                return {
+                    "@context": [DataspaceProtocolContexts.Context],
+                    "@type": DataspaceProtocolTransferProcessTypes.TransferProcess,
+                    consumerPid: entity.consumerPid,
+                    providerPid: entity.providerPid,
+                    state: entity.state
+                };
+            }
             if (entity.state !== DataspaceProtocolTransferProcessStateType.STARTED) {
                 return transformToTransferError(new GeneralError(DataspaceControlPlaneService.CLASS_NAME, "invalidStateForSuspend", {
                     consumerPid: entity.consumerPid,
@@ -687,6 +818,7 @@ export class DataspaceControlPlaneService {
                     currentState: entity.state
                 }), message);
             }
+            const previousState = entity.state;
             entity.state = DataspaceProtocolTransferProcessStateType.SUSPENDED;
             entity.dateModified = new Date();
             await this._transferProcessStorage.set(this.modelToStorageEntity(entity));
@@ -702,6 +834,19 @@ export class DataspaceControlPlaneService {
                     reason: message.reason
                 }
             });
+            if (this.isPushFormat(entity.format)) {
+                try {
+                    await this.requireDataPlane().suspendPushSubscription(entity.consumerPid);
+                }
+                catch (suspendError) {
+                    // Symmetric rollback: data-plane suspend failed, revert transfer state so
+                    // a retry can repair the subscription instead of failing invalidStateForSuspend.
+                    entity.state = previousState;
+                    entity.dateModified = new Date();
+                    await this._transferProcessStorage.set(this.modelToStorageEntity(entity));
+                    throw suspendError;
+                }
+            }
             return {
                 "@context": [DataspaceProtocolContexts.Context],
                 "@type": DataspaceProtocolTransferProcessTypes.TransferProcess,
@@ -735,7 +880,27 @@ export class DataspaceControlPlaneService {
         }
         try {
             const { entity, role } = await this.lookupTransferByMessage(message);
-            this.validateCallerIsTransferParty(trustInfo.identity, entity);
+            this.validateCallerIsTransferParty(this.buildCallerComposite(trustInfo), entity);
+            // Only the tenant that owns this transfer can mutate it.
+            // Skipped on single-tenant nodes (entity.tenantId undefined).
+            const callingTenantId = await this.resolveCallingTenantId();
+            if (Is.stringValue(entity.tenantId) &&
+                Is.stringValue(callingTenantId) &&
+                entity.tenantId !== callingTenantId) {
+                throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "transferWrongTenant");
+            }
+            // DSP idempotency: re-receiving TransferTerminationMessage for a transfer already
+            // in TERMINATED should return success. Data-plane teardown already ran.
+            if (entity.state === DataspaceProtocolTransferProcessStateType.TERMINATED) {
+                return {
+                    "@context": [DataspaceProtocolContexts.Context],
+                    "@type": DataspaceProtocolTransferProcessTypes.TransferProcess,
+                    consumerPid: entity.consumerPid,
+                    providerPid: entity.providerPid,
+                    state: entity.state
+                };
+            }
+            const previousState = entity.state;
             entity.state = DataspaceProtocolTransferProcessStateType.TERMINATED;
             entity.dateModified = new Date();
             await this._transferProcessStorage.set(this.modelToStorageEntity(entity));
@@ -751,6 +916,20 @@ export class DataspaceControlPlaneService {
                     reason: message.reason
                 }
             });
+            if (this.isPushFormat(entity.format)) {
+                try {
+                    await this.requireDataPlane().teardownPushSubscription(entity.consumerPid);
+                }
+                catch (teardownError) {
+                    // Symmetric rollback: data-plane teardown failed, revert transfer state so
+                    // a retry can repair the subscription. Terminate is reachable from multiple
+                    // states (REQUESTED/STARTED/SUSPENDED), so restore the actual previous one.
+                    entity.state = previousState;
+                    entity.dateModified = new Date();
+                    await this._transferProcessStorage.set(this.modelToStorageEntity(entity));
+                    throw teardownError;
+                }
+            }
             return {
                 "@context": [DataspaceProtocolContexts.Context],
                 "@type": DataspaceProtocolTransferProcessTypes.TransferProcess,
@@ -773,7 +952,7 @@ export class DataspaceControlPlaneService {
         const trustInfo = await TrustHelper.verifyTrust(this._trustComponent, trustPayload, "getTransferProcess");
         try {
             const { entity, role } = await this.lookupTransferByPid(pid);
-            this.validateCallerIsTransferParty(trustInfo.identity, entity);
+            this.validateCallerIsTransferParty(this.buildCallerComposite(trustInfo), entity);
             await this._loggingComponent?.log({
                 level: "info",
                 source: DataspaceControlPlaneService.CLASS_NAME,
@@ -1003,19 +1182,22 @@ export class DataspaceControlPlaneService {
         }
         const agreement = await this.lookupAgreement(entity.agreementId);
         const contextIds = await ContextIdStore.getContextIds();
-        const currentOrgId = contextIds?.[ContextIdKeys.Organization];
-        if (!currentOrgId) {
+        const currentComposite = this.buildTenantIdentifier(contextIds?.[ContextIdKeys.Node], contextIds?.[ContextIdKeys.Tenant]);
+        // Identity is `nodeDid:hash(tenantId)` (or just `nodeDid` in
+        // single-tenant). Without a node DID in context we cannot derive any
+        // caller identity at all.
+        if (!Is.stringValue(currentComposite)) {
             throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "organizationContextMissing", {
                 consumerPid
             });
         }
         const assignerIdentity = OdrlPolicyHelper.extractAssignerIdentity(agreement);
         const assignerIds = ArrayHelper.fromObjectOrArray(assignerIdentity);
-        if (!assignerIds.includes(currentOrgId)) {
+        if (!assignerIds.includes(currentComposite)) {
             throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "agreementAssignerMismatch", {
                 consumerPid,
                 agreementId: OdrlPolicyHelper.getUid(agreement),
-                expectedOrgId: currentOrgId,
+                expectedComposite: currentComposite,
                 actualAssigner: assignerIds.join(", ")
             });
         }
@@ -1030,7 +1212,7 @@ export class DataspaceControlPlaneService {
                 state: entity.state,
                 consumerIdentity: entity.consumerIdentity,
                 agreementId: OdrlPolicyHelper.getUid(agreement),
-                organizationId: currentOrgId
+                organizationId: contextIds?.[ContextIdKeys.Organization]
             }
         });
         return {
@@ -1062,20 +1244,19 @@ export class DataspaceControlPlaneService {
         }
         const agreement = await this.lookupAgreement(entity.agreementId);
         const contextIds = await ContextIdStore.getContextIds();
-        const currentOrgId = contextIds?.[ContextIdKeys.Organization];
-        if (!currentOrgId) {
+        const currentComposite = this.buildTenantIdentifier(contextIds?.[ContextIdKeys.Node], contextIds?.[ContextIdKeys.Tenant]);
+        if (!Is.stringValue(currentComposite)) {
             throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "organizationContextMissingProvider", {
                 providerPid
             });
         }
-        // Extract assigner UID (can be string, array, or IOdrlParty object)
         const assignerIdentity = OdrlPolicyHelper.extractAssignerIdentity(agreement);
         const assignerIds = ArrayHelper.fromObjectOrArray(assignerIdentity);
-        if (!assignerIds.includes(currentOrgId)) {
+        if (!assignerIds.includes(currentComposite)) {
             throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "agreementAssignerMismatchProvider", {
                 providerPid,
                 agreementId: OdrlPolicyHelper.getUid(agreement),
-                expectedOrgId: currentOrgId,
+                expectedComposite: currentComposite,
                 actualAssigner: assignerIds.join(", ")
             });
         }
@@ -1105,7 +1286,7 @@ export class DataspaceControlPlaneService {
                 consumerIdentity: entity.consumerIdentity,
                 providerIdentity: entity.providerIdentity,
                 agreementId: OdrlPolicyHelper.getUid(agreement),
-                organizationId: currentOrgId
+                organizationId: contextIds?.[ContextIdKeys.Organization]
             }
         });
         return {
@@ -1147,7 +1328,7 @@ export class DataspaceControlPlaneService {
             nodeIdentity,
             tenantId,
             appId,
-            dataset: this.stripDatasetId(dataset),
+            dataset: ObjectHelper.omit(dataset, ["@id"]),
             dateCreated: now,
             dateModified: now
         };
@@ -1195,11 +1376,11 @@ export class DataspaceControlPlaneService {
             }
             : undefined, undefined, undefined, cursor, limit);
         const entities = (page.entities ?? []).map(entity => ({
-            id: entity.id ?? "",
-            appId: entity.appId ?? "",
+            id: entity.id,
+            appId: entity.appId,
             dataset: this.restampDatasetId(entity.dataset ?? {}, entity.id ?? ""),
-            dateCreated: entity.dateCreated ?? "",
-            dateModified: entity.dateModified ?? ""
+            dateCreated: entity.dateCreated,
+            dateModified: entity.dateModified
         }));
         return {
             entities,
@@ -1227,7 +1408,7 @@ export class DataspaceControlPlaneService {
         const updated = {
             ...existing,
             appId,
-            dataset: this.stripDatasetId(dataset),
+            dataset: ObjectHelper.omit(dataset, ["@id"]),
             dateModified: new Date().toISOString()
         };
         // Side effect first, primary storage last
@@ -1327,6 +1508,7 @@ export class DataspaceControlPlaneService {
             providerIdentity: storageEntity.providerIdentity,
             format: storageEntity.format,
             callbackAddress: storageEntity.callbackAddress,
+            tenantId: storageEntity.tenantId,
             dateCreated: new Date(storageEntity.dateCreated),
             dateModified: new Date(storageEntity.dateModified),
             policies: storageEntity.policies,
@@ -1352,6 +1534,7 @@ export class DataspaceControlPlaneService {
             providerIdentity: entity.providerIdentity,
             format: entity.format,
             callbackAddress: entity.callbackAddress,
+            tenantId: entity.tenantId,
             dateCreated: entity.dateCreated.toISOString(),
             dateModified: entity.dateModified.toISOString(),
             policies: entity.policies,
@@ -1378,39 +1561,54 @@ export class DataspaceControlPlaneService {
         }
         return agreement;
     }
+    /**
+     * Build the caller's composite identity (`nodeDid:tenantIdHash`) from a
+     * verified trust payload.
+     * @param trustInfo The verification info from `TrustHelper.verifyTrust`.
+     * @returns The composite identity.
+     * @internal
+     */
+    buildCallerComposite(trustInfo) {
+        Guards.object(DataspaceControlPlaneService.CLASS_NAME, "trustInfo", trustInfo);
+        Guards.stringValue(DataspaceControlPlaneService.CLASS_NAME, "trustInfo.identity", trustInfo.identity);
+        return Is.stringValue(trustInfo.tenantId)
+            ? `${trustInfo.identity}:${trustInfo.tenantId}`
+            : trustInfo.identity;
+    }
     /**
      * Validate that the caller's verified identity matches the consumer of a transfer process.
-     * @param callerIdentity The identity from the verified trust token.
+     * @param callerComposite The caller's composite identity (`nodeDid:tenantIdHash`).
      * @param entity The transfer process entity.
      * @throws UnauthorizedError if the caller is not the consumer.
      * @internal
      */
-    validateCallerIsConsumer(callerIdentity, entity) {
-        if (callerIdentity !== entity.consumerIdentity) {
+    validateCallerIsConsumer(callerComposite, entity) {
+        if (callerComposite !== entity.consumerIdentity) {
             throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "callerNotAuthorizedAsConsumer");
         }
     }
     /**
      * Validate that the caller's verified identity matches the provider of a transfer process.
-     * @param callerIdentity The identity from the verified trust token.
+     * @param callerComposite The caller's composite identity (`nodeDid:tenantIdHash`).
      * @param entity The transfer process entity.
      * @throws UnauthorizedError if the caller is not the provider.
      * @internal
      */
-    validateCallerIsProvider(callerIdentity, entity) {
-        if (callerIdentity !== entity.providerIdentity) {
+    validateCallerIsProvider(callerComposite, entity) {
+        if (callerComposite !== entity.providerIdentity) {
             throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "callerNotAuthorizedAsProvider");
         }
     }
     /**
      * Validate that the caller's verified identity matches either the consumer or provider of a transfer process.
-     * @param callerIdentity The identity from the verified trust token.
+     * @param callerComposite The caller's composite identity (`nodeDid:tenantIdHash`).
      * @param entity The transfer process entity.
      * @throws UnauthorizedError if the caller is not a party to the transfer.
      * @internal
      */
-    validateCallerIsTransferParty(callerIdentity, entity) {
-        if (callerIdentity !== entity.consumerIdentity && callerIdentity !== entity.providerIdentity) {
+    validateCallerIsTransferParty(callerComposite, entity) {
+        if (callerComposite !== entity.consumerIdentity &&
+            callerComposite !== entity.providerIdentity) {
             throw new UnauthorizedError(DataspaceControlPlaneService.CLASS_NAME, "callerNotAuthorizedForTransfer");
         }
     }
@@ -1420,6 +1618,16 @@ export class DataspaceControlPlaneService {
      * @returns Dataset ID.
      * @internal
      */
+    isPushFormat(format) {
+        return (format === DataspaceTransferFormat.HttpProxyPush ||
+            format === DataspaceTransferFormat.HttpProxyPost);
+    }
+    /**
+     * Extract the dataset ID from an ODRL agreement's target.
+     * @param agreement The ODRL agreement containing the target.
+     * @returns The dataset ID extracted from the target URN.
+     * @throws GeneralError if the agreement target is missing, has no UID, or has multiple targets.
+     */
     extractDatasetId(agreement) {
         if (Is.empty(agreement.target)) {
             throw new GeneralError(DataspaceControlPlaneService.CLASS_NAME, "agreementMissingTarget", {
@@ -1656,22 +1864,124 @@ export class DataspaceControlPlaneService {
             return dataset;
         }
         const contextIds = await ContextIdStore.getContextIds();
-        const orgId = contextIds?.[ContextIdKeys.Organization];
-        if (orgId) {
-            return { ...dataset, "dcterms:publisher": orgId };
+        // The publisher attribution is always the composite identifier
+        const compositePublisher = this.buildTenantIdentifier(contextIds?.[ContextIdKeys.Node], contextIds?.[ContextIdKeys.Tenant]);
+        if (compositePublisher) {
+            return { ...dataset, "dcterms:publisher": compositePublisher };
         }
         return dataset;
     }
     /**
-     * Strip `@id` from a dataset payload before storing it.
-     * @param dataset The dataset payload.
-     * @returns The dataset payload with `@id` removed.
+     * Build the tenant-attributed identifier.
+     * @param nodeId The node identity (from `ContextIdKeys.Node`).
+     * @param tenantId The plaintext tenant id (from `ContextIdKeys.Tenant`), if
+     *   any. Hashed before insertion into the composite.
+     * @returns Composite identifier, or undefined if nodeId is missing.
+     * @internal
+     */
+    buildTenantIdentifier(nodeId, tenantId) {
+        if (!Is.stringValue(nodeId)) {
+            return undefined;
+        }
+        return Is.stringValue(tenantId) ? `${nodeId}:${TrustHelper.hashTenantId(tenantId)}` : nodeId;
+    }
+    /**
+     * Parse a composite tenant identifier into its node and tenant-hash portions.
+     * @param composite The composite identifier (`nodeDid` or `nodeDid:hash`).
+     * @returns The parsed parts. `tenantIdHash` is undefined when the composite
+     *   has no tenant portion (single-tenant node form).
+     * @throws GuardError if the input is not a non-empty string.
+     * @throws GeneralError if the input does not start with `did:` — the only
+     *   valid composite identifier shapes carry a DID as the leading portion.
      * @internal
      */
-    stripDatasetId(dataset) {
-        const copy = { ...dataset };
-        delete copy["@id"];
-        return copy;
+    parseTenantIdentifier(composite) {
+        Guards.stringValue(DataspaceControlPlaneService.CLASS_NAME, "composite", composite);
+        if (!composite.startsWith("did:")) {
+            throw new GeneralError(DataspaceControlPlaneService.CLASS_NAME, "invalidCompositeIdentifier", { composite });
+        }
+        const lastColon = composite.lastIndexOf(":");
+        if (lastColon === -1) {
+            return { nodeDid: composite };
+        }
+        const candidateHash = composite.slice(lastColon + 1);
+        if (DataspaceControlPlaneService._TENANT_HASH_PATTERN.test(candidateHash)) {
+            return {
+                nodeDid: composite.slice(0, lastColon),
+                tenantIdHash: candidateHash
+            };
+        }
+        return { nodeDid: composite };
+    }
+    /**
+     * Resolve the data plane component or throw if it isn't registered. Push-mode transfers
+     * require the data plane; pull-only deployments may run without it.
+     * @returns The data plane component.
+     * @throws GeneralError if the data plane component is not registered.
+     * @internal
+     */
+    requireDataPlane() {
+        const dataPlane = ComponentFactory.getIfExists(this._dataPlaneComponentType);
+        if (!dataPlane) {
+            throw new GeneralError(DataspaceControlPlaneService.CLASS_NAME, "dataPlaneNotRegistered");
+        }
+        return dataPlane;
+    }
+    /**
+     * Creates the internal INegotiationCallback that fans out to all registered callbacks.
+     * @returns The internal negotiation callback.
+     */
+    createInternalCallback() {
+        return {
+            onStateChanged: async (negotiationId, state, data) => {
+                for (const [key, cb] of this._negotiationCallbacks.entries()) {
+                    try {
+                        await cb.onStateChanged(negotiationId, state, data);
+                    }
+                    catch (error) {
+                        await this._loggingComponent?.log({
+                            level: "error",
+                            source: DataspaceControlPlaneService.CLASS_NAME,
+                            ts: Date.now(),
+                            message: "negotiationCallbackError",
+                            data: { key, negotiationId, method: "onStateChanged", error }
+                        });
+                    }
+                }
+            },
+            onCompleted: async (negotiationId, agreementId) => {
+                for (const [key, cb] of this._negotiationCallbacks.entries()) {
+                    try {
+                        await cb.onCompleted(negotiationId, agreementId);
+                    }
+                    catch (error) {
+                        await this._loggingComponent?.log({
+                            level: "error",
+                            source: DataspaceControlPlaneService.CLASS_NAME,
+                            ts: Date.now(),
+                            message: "negotiationCallbackError",
+                            data: { key, negotiationId, method: "onCompleted", error }
+                        });
+                    }
+                }
+            },
+            onFailed: async (negotiationId, reason) => {
+                for (const [key, cb] of this._negotiationCallbacks.entries()) {
+                    try {
+                        await cb.onFailed(negotiationId, reason);
+                    }
+                    catch (error) {
+                        await this._loggingComponent?.log({
+                            level: "error",
+                            source: DataspaceControlPlaneService.CLASS_NAME,
+                            ts: Date.now(),
+                            message: "negotiationCallbackError",
+                            data: { key, negotiationId, method: "onFailed", error }
+                        });
+                    }
+                }
+            }
+        };
     }
     /**
      * Re-stamp `@id` onto a stored payload blob using the entity primary key.
@@ -1693,8 +2003,9 @@ export class DataspaceControlPlaneService {
         // Override `Tenant` in the context wrap so federated catalogue captures the
         // appDataset's owning tenant. On single-tenant nodes the appDataset has no tenantId,
         // so the assignment writes `Tenant: undefined` — equivalent to no override.
+        const contextIds = (await ContextIdStore.getContextIds()) ?? {};
         const wrappedContextIds = {
-            ...((await ContextIdStore.getContextIds()) ?? {}),
+            ...contextIds,
             [ContextIdKeys.Tenant]: appDataset.tenantId
         };
         await ContextIdStore.run(wrappedContextIds, async () => {