@acosmi/sdk-ts 1.3.1 → 1.4.0

package/dist/index.mjs

@@ -1056,7 +1056,7 @@ init_adapters();
 
 // src/auth.ts
 var authTimeoutMs = 3e4;
-async function discover(serverURL, signal) {
+async function discoverWithProfile(serverURL, profile, signal) {
   let parsed;
   try {
     parsed = new URL(serverURL.replace(/\/+$/, ""));
@@ -1064,7 +1064,7 @@ async function discover(serverURL, signal) {
     throw new Error(`discover: invalid server URL: ${e instanceof Error ? e.message : String(e)}`);
   }
   const origin = `${parsed.protocol}//${parsed.host}`;
-  const endpoint = `${origin}/.well-known/oauth-authorization-server/desktop`;
+  const endpoint = `${origin}/.well-known/oauth-authorization-server/${profile}`;
   const ctl = withTimeout(authTimeoutMs, signal);
   let resp;
   try {
@@ -1090,6 +1090,12 @@ async function discover(serverURL, signal) {
   }
   return meta;
 }
+async function discover(serverURL, signal) {
+  return discoverWithProfile(serverURL, "desktop", signal);
+}
+async function discoverWebOAuthMetadata(serverURL, signal) {
+  return discoverWithProfile(serverURL, "web", signal);
+}
 async function register(meta, appName, signal) {
   const regReq = {
     client_name: appName,
@@ -1121,12 +1127,50 @@ async function register(meta, appName, signal) {
     throw new Error(`register: decode: ${e instanceof Error ? e.message : String(e)}`);
   }
 }
-async function generateCodeVerifier() {
+async function registerWebOAuthClient(meta, opts, signal) {
+  const regReq = {
+    client_name: opts.clientName,
+    token_endpoint_auth_method: "none",
+    grant_types: ["authorization_code", "refresh_token"],
+    redirect_uris: opts.redirectURIs,
+    response_types: ["code"],
+    ...opts.scopes ? { scope: opts.scopes.join(" ") } : {}
+  };
+  const ctl = withTimeout(authTimeoutMs, signal);
+  let resp;
+  try {
+    resp = await fetch(meta.registration_endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(regReq),
+      signal: ctl.signal
+    });
+  } catch (e) {
+    throw new Error(`register: ${e instanceof Error ? e.message : String(e)}`);
+  } finally {
+    ctl.dispose();
+  }
+  if (resp.status !== 200 && resp.status !== 201) {
+    throw new Error(`register: HTTP ${resp.status}`);
+  }
+  try {
+    return await resp.json();
+  } catch (e) {
+    throw new Error(`register: decode: ${e instanceof Error ? e.message : String(e)}`);
+  }
+}
+async function randomBase64Url32() {
   const c = await getCrypto();
   const b = new Uint8Array(32);
   c.getRandomValues(b);
   return base64urlNoPad(b);
 }
+async function generateCodeVerifier() {
+  return randomBase64Url32();
+}
+async function generateState() {
+  return randomBase64Url32();
+}
 async function codeChallenge(verifier) {
   const c = await getCrypto();
   const buf = await c.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
@@ -1160,6 +1204,7 @@ var ErrAuthDenied = "auth_denied";
 var ErrTimeout = "auth_timeout";
 var ErrTokenExchange = "token_exchange_failed";
 var ErrSSLProxy = "ssl_proxy_detected";
+var ErrStateMismatch = "state_mismatch";
 function isSSLError(err) {
   const msg = err instanceof Error ? err.message : String(err);
   return msg.includes("tls:") || msg.includes("x509:") || msg.includes("certificate");
@@ -1273,6 +1318,51 @@ async function authorize(meta, clientID, scopes, opts = {}) {
 function htmlEscape(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
+async function createWebAuthorizationRequest(meta, opts) {
+  const verifier = await generateCodeVerifier();
+  const challenge = await codeChallenge(verifier);
+  const state = await generateState();
+  const authURL = new URL(meta.authorization_endpoint);
+  authURL.searchParams.set("response_type", "code");
+  authURL.searchParams.set("client_id", opts.clientID);
+  authURL.searchParams.set("redirect_uri", opts.redirectURI);
+  authURL.searchParams.set("code_challenge", challenge);
+  authURL.searchParams.set("code_challenge_method", "S256");
+  authURL.searchParams.set("state", state);
+  authURL.searchParams.set("scope", opts.scopes.join(" "));
+  if (opts.loginHint) {
+    authURL.searchParams.set("login_hint", opts.loginHint);
+  }
+  return {
+    authUrl: authURL.toString(),
+    state,
+    verifier,
+    clientID: opts.clientID,
+    redirectURI: opts.redirectURI,
+    serverURL: opts.serverURL,
+    createdAt: Date.now()
+  };
+}
+async function completeWebAuthorizationRequest(pending, params, signal) {
+  if (!params.code) {
+    throw new Error("completeWebAuthorizationRequest: missing authorization code");
+  }
+  if (params.state !== pending.state) {
+    throw new Error(
+      `completeWebAuthorizationRequest: ${ErrStateMismatch}: callback state does not match pending state (possible CSRF)`
+    );
+  }
+  const meta = await discoverWebOAuthMetadata(pending.serverURL, signal);
+  const resp = await exchangeCode(
+    meta,
+    pending.clientID,
+    params.code,
+    pending.redirectURI,
+    pending.verifier,
+    signal
+  );
+  return newTokenSet(resp, pending.clientID, pending.serverURL);
+}
 async function exchangeCode(meta, clientID, code, redirectURI, codeVerifier, signal) {
   const data = new URLSearchParams({
     grant_type: "authorization_code",
@@ -1439,6 +1529,7 @@ var ScopeComplianceSealApprovalRequest = "compliance:seal_approval:request";
 var ScopeComplianceSealApprovalApprove = "compliance:seal_approval:approve";
 var ScopeComplianceSealUseExecute = "compliance:seal_use:execute";
 var ScopeComplianceReportsRead = "compliance:reports:read";
+var ScopeComplianceReportsWrite = "compliance:reports:write";
 var ScopeComplianceReportsPublish = "compliance:reports:publish";
 function allScopes() {
   return [ScopeAI, ScopeSkills, ScopeAccount];
@@ -1456,6 +1547,7 @@ function complianceScopes() {
     ScopeComplianceSealApprovalApprove,
     ScopeComplianceSealUseExecute,
     ScopeComplianceReportsRead,
+    ScopeComplianceReportsWrite,
     ScopeComplianceReportsPublish
   ];
 }
@@ -2163,6 +2255,8 @@ var Client = class _Client {
   serverURL;
   /** Compliance API 根地址 (已 trim 尾随 /); null = 走默认 ${serverURL}/admin-api */
   complianceBaseURL;
+  /** OAuth metadata profile — 刷新 token 时发现 metadata 用 (默认 'desktop') */
+  oauthMetadataProfile;
   /** OAuth metadata (lazy loaded) */
   meta = null;
   /** 当前 token (内存) */
@@ -2197,6 +2291,7 @@ var Client = class _Client {
   constructor(cfg = {}) {
     this.serverURL = (cfg.serverURL ?? "https://acosmi.com").replace(/\/+$/, "");
     this.complianceBaseURL = cfg.complianceBaseURL ? cfg.complianceBaseURL.replace(/\/+$/, "") : null;
+    this.oauthMetadataProfile = cfg.oauthMetadataProfile ?? "desktop";
     this.store = cfg.store ?? defaultTokenStore();
     this.fetchImpl = cfg.fetchImpl ?? globalThis.fetch.bind(globalThis);
     this.retryPolicy = effectivePolicy(cfg.retryPolicy ?? null);
@@ -2371,7 +2466,7 @@ var Client = class _Client {
     if (tokens) {
       if (!meta) {
         try {
-          meta = await discover(this.serverURL, signal);
+          meta = await discoverWithProfile(this.serverURL, this.oauthMetadataProfile, signal);
         } catch (e) {
           console.warn(`[acosmi-sdk] warning: discover for revocation failed: ${e instanceof Error ? e.message : String(e)}`);
         }
@@ -2442,7 +2537,7 @@ var Client = class _Client {
         }
         if (this.meta == null) {
           try {
-            this.meta = await discover(this.serverURL, signal);
+            this.meta = await discoverWithProfile(this.serverURL, this.oauthMetadataProfile, signal);
           } catch (e) {
             throw new Error(
               `discover for refresh: ${e instanceof Error ? e.message : String(e)}`
@@ -2474,7 +2569,7 @@ var Client = class _Client {
           throw new Error("no tokens to refresh");
         }
         if (this.meta == null) {
-          this.meta = await discover(this.serverURL, signal);
+          this.meta = await discoverWithProfile(this.serverURL, this.oauthMetadataProfile, signal);
         }
         const tokenResp = await refreshToken(
           this.meta,
@@ -3326,17 +3421,20 @@ var ComplianceClient = class {
   }
   /**
    * 公开 verify。隐私边界：返回字段不含 PII / 合同原文 / storage / provider raw。
-   * 服务端不要求 compliance scope（公开端点）；但 SDK 仍带上 token 以便审计。
+   *
+   * 匿名可调用：未 login 时走匿名请求，不会抛 `not authorized, call login() first`。
+   * 已 login / 已持有 token 时附带 `Authorization` 以保留审计上下文。public 端点不
+   * 应要求认证 — 收到 401 直接抛 HTTPError，不触发 `forceRefresh`，也不做 refresh
+   * replay。
    */
   verifyEvidencePublic(params, signal) {
     const q = new URLSearchParams();
     if (params.evidenceNo) q.set("evidenceNo", params.evidenceNo);
     if (params.publicVerifyCode) q.set("publicVerifyCode", params.publicVerifyCode);
     const qs = q.toString();
-    return this.read(
+    return this.publicRead(
       "GET",
       `/compliance/evidence/verify${qs ? "?" + qs : ""}`,
-      null,
       signal
     );
   }
@@ -3420,9 +3518,10 @@ var ComplianceClient = class {
   /**
    * 发布报告（写，step-up 必须）。
    *
-   * 缺少 step-up 时服务端会返回 `COMPLIANCE_STEP_UP_REQUIRED`（数值码
-   * 1031000013）。SDK 不会自动重试；调用方需要引导用户重新做 OAuth introspection 或
-   * 重新登录后再次调用本方法（使用同一 idempotency-key）。
+   * `@status gated` — step-up 闸门未闭合前服务端会一致返回
+   * `COMPLIANCE_STEP_UP_REQUIRED`（数值码 1031000013）。SDK 不会自动重试、不伪成功；
+   * 调用方需要引导用户重新做 OAuth introspection 或重新登录后再次调用本方法
+   *（使用同一 idempotency-key）。方法状态分级见 `docs/compliance.md` Method Status。
    */
   publishReport(id, opts = {}) {
     return this.write(
@@ -3469,7 +3568,7 @@ var ComplianceClient = class {
   /**
    * 正式签署（写，step-up 必须）。
    *
-   * 服务端闸门关闭时会一致返回 `ENVELOPE_GATE_CLOSED` (1031004004)。
+   * `@status gated` — 服务端闸门关闭时会一致返回 `ENVELOPE_GATE_CLOSED` (1031004004)。
    * SDK 不重试、不伪成功；调用方应该将该错误展示为"功能未开放"。
    */
   signEnvelope(envelopeId, req, opts = {}) {
@@ -3483,7 +3582,7 @@ var ComplianceClient = class {
   /**
    * 创建 H5 签署短链（写，step-up 必须）。
    *
-   * 同上：服务端闸门关闭时 SDK 不重试。
+   * `@status gated` — 同 {@link signEnvelope}：服务端闸门关闭时 SDK 不重试、不伪成功。
    */
   createH5SigningUrl(envelopeId, req, opts = {}) {
     return this.write(
@@ -3505,6 +3604,13 @@ var ComplianceClient = class {
   // =========================================================================
   // Seal Approval
   // =========================================================================
+  /**
+   * 提交用印审批申请（写）。
+   *
+   * `@status production-ready` — 服务端以 `Idempotency-Key` + 业务请求指纹做重放保护：
+   * 同 key + 同请求 → 返回原审批 id；同 key + 不同请求 → 拒绝复用幂等键。强烈建议调用方
+   * 持久化 `idempotencyKey`，网络重试 / 任务恢复时复用，避免重复创建审批单。
+   */
   submitSealApproval(req, opts = {}) {
     return this.write(
       "POST",
@@ -3513,6 +3619,12 @@ var ComplianceClient = class {
       writeCtx(opts)
     );
   }
+  /**
+   * 审批通过用印申请（写，step-up 必须）。
+   *
+   * `@status gated` — step-up 未闭合前服务端会返回 `COMPLIANCE_STEP_UP_REQUIRED`。
+   * SDK 不重试、不伪成功。方法状态分级见 `docs/compliance.md` Method Status。
+   */
   approveSealApproval(id, query, opts = {}) {
     const q = new URLSearchParams();
     if (query.expiresAt) q.set("expiresAt", query.expiresAt);
@@ -3610,6 +3722,38 @@ var ComplianceClient = class {
       extraHeaders
     });
   }
+  /**
+   * 公开读路径：public verify。
+   *
+   * 与 {@link read} 的区别 — public 端点不应要求认证：
+   *   - 无 token 时匿名请求：ensureToken 抛 `not authorized` 会被吞掉，继续匿名发送。
+   *   - 有 token 时附带 `Authorization`，保留后端审计上下文。
+   *   - 不做 401 refresh replay：401 直接抛 HTTPError，不触发 `forceRefresh`。
+   *
+   * URL 仍走 `client.complianceURL(path)`，不复用 `/api/v4`；底层复用
+   * `client.doRequest`，不新增 fetch/axios 直连。
+   */
+  async publicRead(method, path, signal) {
+    let token = "";
+    try {
+      token = await this.client.ensureToken(signal);
+    } catch {
+    }
+    const url = this.client.complianceURL(path);
+    const headers = { Accept: "application/json" };
+    if (token) headers.Authorization = `Bearer ${token}`;
+    const resp = await this.client.doRequest({ method, url, headers }, signal);
+    if (resp.status < 200 || resp.status >= 300) {
+      const bodyBytes = resp.body ? await readLimited(resp.body, maxErrorBodySize) : new Uint8Array();
+      throw parseHTTPErrorWithHeader(resp.status, bodyBytes, resp.headers);
+    }
+    const text = await resp.text();
+    if (!text) return void 0;
+    const parsed = JSON.parse(text);
+    const bizErr = apiResponseBusinessError(parsed);
+    if (bizErr) throw bizErr;
+    return parsed.data;
+  }
   /**
    * 写路径：POST。
    * - 发送前 ensureToken 一次确保 token fresh。
@@ -5318,6 +5462,6 @@ Client.prototype.getBugReport = async function(bugID, signal) {
   return resp.data;
 };
 
-export { AgentRunStreamError, AgentRunsClient, AnthropicAdapter, BucketClassCommercial, BucketClassGeneric, BusinessError, Client, ComplianceClient, CompliancePollError, DefaultRetryPolicy, ErrAuthDenied, ErrBillingCallbackCannotCommit, ErrBillingCommitRequiresLocalVerify, ErrBillingS2sForbidden, ErrBrowserOpen, ErrComplianceStepUpRequired, ErrDiscovery, ErrEnvelopeGateClosed, ErrProviderNotConfigured, ErrProviderUnknownNoRetry, ErrRegistration, ErrSSLProxy, ErrSealApprovalContractHashMismatch, ErrSealApprovalExpired, ErrSealApprovalLocationMismatch, ErrSealApprovalNonceUsed, ErrSealApprovalNotApproved, ErrSealApprovalSealMismatch, ErrSealApprovalTransactorMismatch, ErrSealUseAlreadyConsumed, ErrTimeout, ErrTokenExchange, EventAuthURL, EventComplete, EventError, FileTokenStore, FilterStatusAdminBypass, FilterStatusDisabledByFlag, FilterStatusFallbackMissingUser, FilterStatusFallbackNoBuckets, FilterStatusFallbackTkdistError, FilterStatusFallbackTkdistSkew, FilterStatusInternalBypass, FilterStatusOK, FilterStatusUnknown, HTTPError, InMemoryTokenStore, LocalStorageTokenStore, ModelNotFoundError, NetworkError, OpenAIAdapter, OrderTerminalError, ProviderFormat, RateLimitError, ScopeAI, ScopeAccount, ScopeComplianceContractSigningRead, ScopeComplianceContractSigningWrite, ScopeComplianceEvidenceRead, ScopeComplianceEvidenceWrite, ScopeComplianceReportsPublish, ScopeComplianceReportsRead, ScopeComplianceSealApprovalApprove, ScopeComplianceSealApprovalRequest, ScopeComplianceSealManage, ScopeComplianceSealUseExecute, ScopeComplianceTimestampIssue, ScopeComplianceTimestampVerify, ScopeEntitlements, ScopeModels, ScopeModelsChat, ScopeProfile, ScopeSkillStore, ScopeSkills, ScopeTokenPackages, ScopeTools, ScopeToolsExecute, ScopeWallet, ScopeWalletReadonly, ServerToolTypeWebSearch, StreamError, ThinkingHigh, ThinkingHighMinMaxTokens, ThinkingMax, ThinkingMaxFallbackMaxTokens, ThinkingOff, allScopes, anthropicResponseTextContent, anthropicResponseThinkingContent, anthropicResponseToolUseBlocks, apiResponseBusinessError, apiResponseGetMessage, authorize, bucketInfoIsCommercial, bucketRowIsCommercial, buildBetas, classifyComplianceError, commerceScopes, complianceScopes, computeBackoff, defaultRetryable, defaultSafeToRetry, discover, effectivePolicy, exchangeCode, extractAnthropicBlockMeta, fileLockDefaults, findDesktopVisualUnderstandingModel, findFirstModelByInputModality, getAdapter, getAdapterForModel, isBillingConfirmable, isComplianceBusinessError, isComplianceTerminalError, isSSLError, modelScopes, modelSupportsImageInput, modelSupportsInputModality, newFileTokenStore, newThinkingConfig, newTokenSet, newWebSearchTool, parseNotificationEvent, parseSettlement, parseSourcesEvent, refreshToken, register, revokeToken, sanitize_exports as sanitize, skillScopes, tokenSetIsExpired, uniqueMerge };
+export { AgentRunStreamError, AgentRunsClient, AnthropicAdapter, BucketClassCommercial, BucketClassGeneric, BusinessError, Client, ComplianceClient, CompliancePollError, DefaultRetryPolicy, ErrAuthDenied, ErrBillingCallbackCannotCommit, ErrBillingCommitRequiresLocalVerify, ErrBillingS2sForbidden, ErrBrowserOpen, ErrComplianceStepUpRequired, ErrDiscovery, ErrEnvelopeGateClosed, ErrProviderNotConfigured, ErrProviderUnknownNoRetry, ErrRegistration, ErrSSLProxy, ErrSealApprovalContractHashMismatch, ErrSealApprovalExpired, ErrSealApprovalLocationMismatch, ErrSealApprovalNonceUsed, ErrSealApprovalNotApproved, ErrSealApprovalSealMismatch, ErrSealApprovalTransactorMismatch, ErrSealUseAlreadyConsumed, ErrStateMismatch, ErrTimeout, ErrTokenExchange, EventAuthURL, EventComplete, EventError, FileTokenStore, FilterStatusAdminBypass, FilterStatusDisabledByFlag, FilterStatusFallbackMissingUser, FilterStatusFallbackNoBuckets, FilterStatusFallbackTkdistError, FilterStatusFallbackTkdistSkew, FilterStatusInternalBypass, FilterStatusOK, FilterStatusUnknown, HTTPError, InMemoryTokenStore, LocalStorageTokenStore, ModelNotFoundError, NetworkError, OpenAIAdapter, OrderTerminalError, ProviderFormat, RateLimitError, ScopeAI, ScopeAccount, ScopeComplianceContractSigningRead, ScopeComplianceContractSigningWrite, ScopeComplianceEvidenceRead, ScopeComplianceEvidenceWrite, ScopeComplianceReportsPublish, ScopeComplianceReportsRead, ScopeComplianceReportsWrite, ScopeComplianceSealApprovalApprove, ScopeComplianceSealApprovalRequest, ScopeComplianceSealManage, ScopeComplianceSealUseExecute, ScopeComplianceTimestampIssue, ScopeComplianceTimestampVerify, ScopeEntitlements, ScopeModels, ScopeModelsChat, ScopeProfile, ScopeSkillStore, ScopeSkills, ScopeTokenPackages, ScopeTools, ScopeToolsExecute, ScopeWallet, ScopeWalletReadonly, ServerToolTypeWebSearch, StreamError, ThinkingHigh, ThinkingHighMinMaxTokens, ThinkingMax, ThinkingMaxFallbackMaxTokens, ThinkingOff, allScopes, anthropicResponseTextContent, anthropicResponseThinkingContent, anthropicResponseToolUseBlocks, apiResponseBusinessError, apiResponseGetMessage, authorize, bucketInfoIsCommercial, bucketRowIsCommercial, buildBetas, classifyComplianceError, commerceScopes, completeWebAuthorizationRequest, complianceScopes, computeBackoff, createWebAuthorizationRequest, defaultRetryable, defaultSafeToRetry, discover, discoverWebOAuthMetadata, discoverWithProfile, effectivePolicy, exchangeCode, extractAnthropicBlockMeta, fileLockDefaults, findDesktopVisualUnderstandingModel, findFirstModelByInputModality, generateState, getAdapter, getAdapterForModel, isBillingConfirmable, isComplianceBusinessError, isComplianceTerminalError, isSSLError, modelScopes, modelSupportsImageInput, modelSupportsInputModality, newFileTokenStore, newThinkingConfig, newTokenSet, newWebSearchTool, parseNotificationEvent, parseSettlement, parseSourcesEvent, refreshToken, register, registerWebOAuthClient, revokeToken, sanitize_exports as sanitize, skillScopes, tokenSetIsExpired, uniqueMerge };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map