@agentunion/fastaun-browser 0.4.13 → 0.5.0

package/dist/client.js

@@ -8,6 +8,7 @@ import { createConfig, getDeviceId, normalizeSlotId } from './config.js';
 import { EventDispatcher } from './events.js';
 import { normalizeGroupId } from './group-id.js';
 import { GatewayDiscovery } from './discovery.js';
+import { AIDStore } from './aid-store.js';
 import { RPCTransport } from './transport.js';
 import { AuthFlow } from './auth.js';
 import { SeqTracker } from './seq-tracker.js';
@@ -17,6 +18,9 @@ import { IdentityRuntimeManager } from './client/identity.js';
 import { LifecycleController } from './client/lifecycle.js';
 import { PeerDirectory } from './client/peers.js';
 import { RpcPipeline } from './client/rpc-pipeline.js';
+import { GroupFacade, MessageFacade, StreamFacade } from './facades.js';
+import { StorageVFS } from './storage/vfs.js';
+import { CollabClient } from './collab/client.js';
 import { V2E2EECoordinator } from './client/v2-e2ee.js';
 import { GroupStateCoordinator } from './client/group-state.js';
 import { CryptoProvider, base64ToUint8, pemToArrayBuffer, ecdsaVerifyDer, importCertPublicKeyEcdsa, } from './crypto.js';
@@ -110,18 +114,25 @@ const NON_IDEMPOTENT_METHODS = new Set([
     'storage.create_folder', 'storage.rename_folder', 'storage.move_folder',
     'storage.delete_folder', 'storage.move_object', 'storage.copy_object',
     'storage.batch_delete', 'storage.set_object_meta', 'storage.append_object',
+    'storage.set_acl', 'storage.remove_acl', 'storage.set_visibility',
+    'storage.issue_token', 'storage.revoke_token',
+    'storage.create_symlink', 'storage.atomic_repoint',
+    'storage.rename_symlink', 'storage.delete_symlink',
+    'storage.fs.mkdir', 'storage.fs.remove', 'storage.fs.rename', 'storage.fs.copy',
+    'storage.fs.mount', 'storage.fs.approve', 'storage.fs.reject', 'storage.fs.unmount',
+    'storage.fs.invalidate_membership',
+    'storage.volume.create', 'storage.volume.renew', 'storage.volume.expire_due',
     'auth.create_aid', 'auth.renew_cert', 'auth.rekey',
     'message.thought.put', 'group.thought.put',
-    'group.add_member',
-    'group.resources.put', 'group.resources.create_folder',
-    'group.resources.rename', 'group.resources.move',
-    'group.resources.mount_object', 'group.resources.update',
-    'group.resources.delete', 'group.resources.cleanup_by_storage_ref',
-    'group.resources.request_add', 'group.resources.request_mount_object',
-    'group.resources.direct_add', 'group.resources.approve_request',
-    'group.resources.reject_request', 'group.resources.unmount',
-    'group.resources.get_access',
-    'group.resources.resolve_access_ticket',
+    'group.add_member', 'group.bind_group_aid', 'group.complete_transfer',
+    'group.fs.mkdir', 'group.fs.rm', 'group.fs.cp', 'group.fs.mv',
+    'group.fs.mount', 'group.fs.umount',
+    'group.fs.check_upload', 'group.fs.create_upload_session',
+    'group.fs.complete_upload', 'group.fs.create_download_ticket',
+    'collab.create', 'collab.commit', 'collab.clone',
+    'collab.prune', 'collab.unregister',
+    'collab.tag.create', 'collab.tag.restore',
+    'collab.tag.rm', 'collab.tag.prune',
 ]);
 /** 需要客户端签名的关键方法。运行时逻辑已迁入 RpcPipeline，此处保留给源码审计测试。 */
 const SIGNED_METHODS = new Set([
@@ -138,20 +149,17 @@ const SIGNED_METHODS = new Set([
     'group.leave', 'group.remove_member', 'group.update_rules',
     'group.update', 'group.update_announcement',
     'group.update_join_requirements', 'group.set_role',
-    'group.transfer_owner', 'group.review_join_request',
+    'group.transfer_owner', 'group.bind_group_aid', 'group.complete_transfer',
+    'group.review_join_request',
     'group.batch_review_join_request',
     'group.request_join', 'group.use_invite_code',
     'group.thought.put',
     'message.thought.put',
     'group.set_settings',
-    'group.resources.put', 'group.resources.create_folder',
-    'group.resources.rename', 'group.resources.move',
-    'group.resources.mount_object', 'group.resources.update',
-    'group.resources.delete', 'group.resources.cleanup_by_storage_ref',
-    'group.resources.request_add', 'group.resources.request_mount_object',
-    'group.resources.direct_add', 'group.resources.approve_request',
-    'group.resources.reject_request', 'group.resources.unmount',
-    'group.resources.get_access', 'group.resources.resolve_access_ticket',
+    'group.fs.mkdir', 'group.fs.rm', 'group.fs.cp', 'group.fs.mv',
+    'group.fs.mount', 'group.fs.umount',
+    'group.fs.check_upload', 'group.fs.create_upload_session',
+    'group.fs.complete_upload', 'group.fs.create_download_ticket',
     'storage.put_object', 'storage.delete_object',
     'storage.create_share_link', 'storage.revoke_share_link',
     'storage.get_by_share',
@@ -159,6 +167,19 @@ const SIGNED_METHODS = new Set([
     'storage.create_folder', 'storage.rename_folder', 'storage.move_folder',
     'storage.delete_folder', 'storage.move_object', 'storage.copy_object',
     'storage.batch_delete', 'storage.set_object_meta', 'storage.append_object',
+    'storage.set_acl', 'storage.remove_acl', 'storage.set_visibility',
+    'storage.check_access',
+    'storage.issue_token', 'storage.revoke_token',
+    'storage.create_symlink', 'storage.atomic_repoint',
+    'storage.rename_symlink', 'storage.delete_symlink',
+    'storage.fs.mkdir', 'storage.fs.remove', 'storage.fs.rename', 'storage.fs.copy',
+    'storage.fs.mount', 'storage.fs.approve', 'storage.fs.reject', 'storage.fs.unmount',
+    'storage.fs.invalidate_membership',
+    'storage.volume.create', 'storage.volume.renew', 'storage.volume.expire_due',
+    'collab.create', 'collab.commit', 'collab.clone',
+    'collab.prune', 'collab.unregister',
+    'collab.tag.create', 'collab.tag.restore',
+    'collab.tag.rm', 'collab.tag.prune',
     'group.commit_state',
     'group.ban', 'group.unban',
     'group.dissolve', 'group.suspend', 'group.resume',
@@ -560,6 +581,7 @@ export class AUNClient {
     _onlineUnreadHintIntervalMs = 50;
     /** gap fill 来源标记：true 表示当前正在补洞（pull 触发），false 表示非补洞 */
     _gapFillActive = false;
+    _backgroundRpcDepth = 0;
     // Pull Gate：序列化同一 key 的并发 pull 操作，防止重复拉取
     _pullGates = new Map();
     // 重连相关
@@ -595,6 +617,11 @@ export class AUNClient {
     _delivery;
     _v2E2EE;
     _groupState;
+    _storage;
+    _collab;
+    _messageFacade;
+    _groupFacade;
+    _streamFacade;
     constructor(aid) {
         if (aid !== null && aid !== undefined && !isAIDObject(aid)) {
             throw new ValidationError('AUNClient only accepts an AID object or no argument');
@@ -751,6 +778,36 @@ export class AUNClient {
     get aid() {
         return this._aid;
     }
+    /** AUN Storage VFS 入口 */
+    get storage() {
+        if (!this._storage)
+            this._storage = new StorageVFS(this);
+        return this._storage;
+    }
+    /** AUN collab 协作层入口 */
+    get collab() {
+        if (!this._collab)
+            this._collab = new CollabClient(this);
+        return this._collab;
+    }
+    /** Message RPC facade 入口 */
+    get message() {
+        if (!this._messageFacade)
+            this._messageFacade = new MessageFacade(this);
+        return this._messageFacade;
+    }
+    /** Group RPC facade 入口 */
+    get group() {
+        if (!this._groupFacade)
+            this._groupFacade = new GroupFacade(this);
+        return this._groupFacade;
+    }
+    /** Stream RPC facade 入口 */
+    get stream() {
+        if (!this._streamFacade)
+            this._streamFacade = new StreamFacade(this);
+        return this._streamFacade;
+    }
     async _observeAgentMdFromEnvelope(envelope) {
         await this._agentMdManager.observeEnvelope(envelope);
     }
@@ -992,6 +1049,200 @@ export class AUNClient {
     async call(method, params) {
         return await this._rpcPipeline.call(method, params);
     }
+    async createGroup(params = {}) {
+        if (!isJsonObject(params)) {
+            throw new ValidationError('createGroup params must be an object');
+        }
+        const payload = { ...params };
+        const groupName = String(payload.group_name ?? payload.groupName ?? '').trim();
+        if (!groupName) {
+            return await this.call('group.create', payload);
+        }
+        const keyPair = await new CryptoProvider().generateIdentity();
+        payload.public_key = keyPair.public_key_der_b64;
+        payload.curve = keyPair.curve;
+        const result = await this.call('group.create', payload);
+        const resultMap = isJsonObject(result) ? result : {};
+        const group = isJsonObject(resultMap.group) ? resultMap.group : {};
+        const aidCert = isJsonObject(resultMap.aid_cert) ? resultMap.aid_cert : {};
+        const groupAid = String(group.group_aid ?? resultMap.group_aid ?? '').trim();
+        const certPem = String(aidCert.cert ?? aidCert.cert_pem ?? resultMap.cert ?? resultMap.cert_pem ?? '').trim();
+        if (!groupAid || !certPem) {
+            throw new ValidationError('group.create named group response missing group.group_aid or aid_cert.cert');
+        }
+        const store = new AIDStore({
+            aunPath: this.configModel.aunPath,
+            encryptionSeed: this.configModel.seedPassword ?? '',
+            slotId: this._slotId,
+            rootCaPem: this.configModel.rootCaPem,
+            verifySsl: this.configModel.verifySsl,
+        });
+        try {
+            const imported = await store.importGroupIdentity(groupAid, {
+                private_key_pem: keyPair.private_key_pem,
+                public_key_der_b64: keyPair.public_key_der_b64,
+                curve: keyPair.curve,
+                cert_pem: certPem,
+            });
+            if (!imported.ok) {
+                throw new ValidationError(imported.error.message);
+            }
+        }
+        finally {
+            store.close();
+        }
+        return result;
+    }
+    async bindGroupAid(params = {}, options = {}) {
+        if (!isJsonObject(params)) {
+            throw new ValidationError('bindGroupAid params must be an object');
+        }
+        const store = options.aidStore;
+        if (!store) {
+            throw new ValidationError('bindGroupAid requires aidStore');
+        }
+        const keyPair = await new CryptoProvider().generateIdentity();
+        const payload = { ...params };
+        payload.public_key = keyPair.public_key_der_b64;
+        payload.curve = keyPair.curve;
+        const result = await this.call('group.bind_group_aid', payload);
+        const resultMap = isJsonObject(result) ? result : {};
+        const group = isJsonObject(resultMap.group) ? resultMap.group : {};
+        const aidCert = isJsonObject(resultMap.aid_cert) ? resultMap.aid_cert : {};
+        const groupAid = String(group.group_aid ?? resultMap.group_aid ?? '').trim();
+        const certPem = String(aidCert.cert ?? aidCert.cert_pem ?? resultMap.cert ?? resultMap.cert_pem ?? '').trim();
+        if (!groupAid || !certPem) {
+            throw new ValidationError('group.bind_group_aid response missing group.group_aid or aid_cert.cert');
+        }
+        const imported = await store.importGroupIdentity(groupAid, {
+            private_key_pem: keyPair.private_key_pem,
+            public_key_der_b64: keyPair.public_key_der_b64,
+            curve: keyPair.curve,
+            cert_pem: certPem,
+        });
+        if (!imported.ok) {
+            throw new ValidationError(imported.error.message);
+        }
+        return result;
+    }
+    async startGroupTransfer(params = {}, options = {}) {
+        if (!isJsonObject(params)) {
+            throw new ValidationError('startGroupTransfer params must be an object');
+        }
+        const store = options.aidStore;
+        if (!store) {
+            throw new ValidationError('startGroupTransfer requires aidStore');
+        }
+        const groupId = String(params.group_id ?? '').trim();
+        const newOwner = String(params.new_owner ?? '').trim();
+        if (!groupId || !newOwner) {
+            throw new ValidationError('startGroupTransfer requires group_id and new_owner');
+        }
+        let groupAid = String(params.group_aid ?? '').trim();
+        if (!groupAid) {
+            const info = await this.call('group.get', { group_id: groupId });
+            const infoMap = isJsonObject(info) ? info : {};
+            const grp = isJsonObject(infoMap.group) ? infoMap.group : infoMap;
+            groupAid = String(grp.group_aid ?? '').trim();
+        }
+        if (!groupAid) {
+            throw new ValidationError('startGroupTransfer: unable to determine group_aid');
+        }
+        const loaded = await store.load(groupAid);
+        if (!loaded.ok || !loaded.data) {
+            throw new ValidationError(`startGroupTransfer: group_aid identity not found: ${groupAid}`);
+        }
+        const aidObj = loaded.data.aid;
+        if (!aidObj.isPrivateKeyValid() || !aidObj.privateKeyPem) {
+            throw new ValidationError(`startGroupTransfer: group_aid private key not found: ${groupAid}`);
+        }
+        const nonce = globalThis.crypto.randomUUID().replace(/-/g, '');
+        const issuedMs = Date.now();
+        const canonical = [
+            'aun-group-owner-transfer-v1',
+            groupId.toLowerCase(),
+            groupAid.toLowerCase(),
+            newOwner.toLowerCase(),
+            nonce,
+            String(issuedMs),
+        ].join('|');
+        const signed = await aidObj.sign(canonical);
+        if (!signed.ok) {
+            throw new ValidationError(`startGroupTransfer: sign failed: ${signed.error.message}`);
+        }
+        const payload = { ...params, group_aid: groupAid };
+        payload.transfer_auth = { nonce, issued_ms: issuedMs, signature: signed.data.signature };
+        return await this.call('group.transfer_owner', payload);
+    }
+    async completeGroupTransfer(params = {}, options = {}) {
+        if (!isJsonObject(params)) {
+            throw new ValidationError('completeGroupTransfer params must be an object');
+        }
+        const store = options.aidStore;
+        if (!store) {
+            throw new ValidationError('completeGroupTransfer requires aidStore');
+        }
+        const keyPair = await new CryptoProvider().generateIdentity();
+        const payload = { ...params };
+        const groupId = String(params.group_id ?? '').trim();
+        if (!groupId) {
+            throw new ValidationError('completeGroupTransfer requires group_id');
+        }
+        let groupAid = String(params.group_aid ?? '').trim();
+        if (!groupAid) {
+            const info = await this.call('group.get', { group_id: groupId });
+            const infoMap = isJsonObject(info) ? info : {};
+            const grp = isJsonObject(infoMap.group) ? infoMap.group : infoMap;
+            groupAid = String(grp.group_aid ?? '').trim();
+        }
+        if (!groupAid) {
+            throw new ValidationError('completeGroupTransfer: unable to determine group_aid');
+        }
+        const current = this.currentAid;
+        const newOwner = String(current?.aid ?? '').trim();
+        if (!current || !newOwner || !current.isPrivateKeyValid()) {
+            throw new ValidationError('completeGroupTransfer requires current new-owner AID with private key');
+        }
+        const nonce = globalThis.crypto.randomUUID().replace(/-/g, '');
+        const issuedMs = Date.now();
+        const publicKeyHash = bytesToHex(new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(keyPair.public_key_der_b64))));
+        const canonical = [
+            'aun-group-owner-transfer-accept-v1',
+            groupId.toLowerCase(),
+            groupAid.toLowerCase(),
+            newOwner.toLowerCase(),
+            publicKeyHash,
+            nonce,
+            String(issuedMs),
+        ].join('|');
+        const signed = await current.sign(canonical);
+        if (!signed.ok) {
+            throw new ValidationError(`completeGroupTransfer: accept sign failed: ${signed.error.message}`);
+        }
+        payload.group_aid = groupAid;
+        payload.public_key = keyPair.public_key_der_b64;
+        payload.curve = keyPair.curve;
+        payload.transfer_accept = { nonce, issued_ms: issuedMs, signature: signed.data.signature };
+        const result = await this.call('group.complete_transfer', payload);
+        const resultMap = isJsonObject(result) ? result : {};
+        const group = isJsonObject(resultMap.group) ? resultMap.group : {};
+        const aidCert = isJsonObject(resultMap.aid_cert) ? resultMap.aid_cert : {};
+        const returnedGroupAid = String(group.group_aid ?? resultMap.group_aid ?? '').trim();
+        const certPem = String(aidCert.cert ?? aidCert.cert_pem ?? resultMap.cert ?? resultMap.cert_pem ?? '').trim();
+        if (!returnedGroupAid || !certPem) {
+            throw new ValidationError('group.complete_transfer response missing group.group_aid or aid_cert.cert');
+        }
+        const imported = await store.importGroupIdentity(returnedGroupAid, {
+            private_key_pem: keyPair.private_key_pem,
+            public_key_der_b64: keyPair.public_key_der_b64,
+            curve: keyPair.curve,
+            cert_pem: certPem,
+        });
+        if (!imported.ok) {
+            throw new ValidationError(imported.error.message);
+        }
+        return result;
+    }
     static _notifyParamsSizeOk(params) {
         return new TextEncoder().encode(JSON.stringify(params)).length <= MAX_NOTIFY_PAYLOAD_SIZE;
     }
@@ -1078,6 +1329,8 @@ export class AUNClient {
     }
     async _callRawV2Rpc(method, params) {
         const p = { ...(params ?? {}) };
+        const rpcBackground = Boolean(p._rpc_background) || this._backgroundRpcDepth > 0;
+        delete p._rpc_background;
         delete p._pull_gate_locked;
         delete p._skip_auto_ack;
         delete p.skip_auto_ack;
@@ -1091,7 +1344,7 @@ export class AUNClient {
         if (method.startsWith('group.') && p.slot_id === undefined) {
             p.slot_id = this._slotId;
         }
-        return await this._rpcPipeline.rawCall(method, p);
+        return await this._rpcPipeline.rawCall(method, p, { background: rpcBackground });
     }
     // ── 事件 ──────────────────────────────────────────
     /**
@@ -2688,6 +2941,15 @@ export class AUNClient {
             && (!slotId || slotId === (this._slotId ?? ''));
     }
     // ── Pull Gate（序列化同一 key 的并发 pull）──────────────────
+    async _withBackgroundRpc(operation) {
+        this._backgroundRpcDepth += 1;
+        try {
+            return await operation();
+        }
+        finally {
+            this._backgroundRpcDepth = Math.max(0, this._backgroundRpcDepth - 1);
+        }
+    }
     async _runPullSerialized(key, operation) {
         return await this._rpcPipeline.runPullSerialized(key, operation);
     }