@agentunion/fastaun-browser 0.5.18 → 0.5.19

package/dist/tools/cross-sdk-agent.js

@@ -4,9 +4,14 @@ import * as http from 'node:http';
 import * as https from 'node:https';
 import * as crypto from 'node:crypto';
 import * as fs from 'node:fs';
-import { URL } from 'node:url';
+import * as path from 'node:path';
+import { URL, fileURLToPath } from 'node:url';
 import { AID, AIDStore, AUNClient, __version__ } from '../index.js';
 import { publicKeyFingerprint } from '../cert-utils.js';
+import { StateError } from '../errors.js';
+import { OwnershipStorageAdapter } from '../ownership-v21.js';
+import { ownershipErrorCode, ownershipTaskResult } from '../ownership-workflow.js';
+import { canonicalJson, digest, buildRequestBinding, verifyMembershipBinding, ProtocolError } from '../org-protocol.js';
 function installNodeBrowserShims() {
     const root = globalThis;
     if (!root.WebSocket)
@@ -120,7 +125,7 @@ function envelopeMetadata(data) {
         out.protected_headers = jsonSafe(protectedHeaders);
     return out;
 }
-class CrossSdkJsAgent {
+export class CrossSdkJsAgent {
     language = 'js';
     sdkVersion = __version__;
     aid = textOf(process.env.AUN_TEST_AID || `cross-js-${crypto.randomUUID().slice(0, 8)}.agentid.pub`).trim();
@@ -139,6 +144,8 @@ class CrossSdkJsAgent {
     rpcObservedTransports = new WeakSet();
     groupChangedEvents = [];
     groupInviteEvents = [];
+    readStateEvents = [];
+    ownershipEvents = [];
     traces = new Map();
     sendResults = new Map();
     inlineRealtimePayloadV1 = true;
@@ -178,6 +185,19 @@ class CrossSdkJsAgent {
         });
         this.client.on('group.changed', (data) => this.storeGroupChangedPublicEvent(data));
         this.client.on('group.invite_received', (data) => this.storeGroupInviteEvent(data));
+        for (const event of ['message.read_changed', 'group.read_changed', 'read_state_sync']) {
+            this.client.on(event, (payload) => { this.readStateEvents.push({ event, payload: jsonSafe(payload) }); });
+        }
+        for (const event of ['ownership.request', 'ownership.action_required', 'ownership.progress', 'ownership.completed', 'ownership.rejected', 'ownership.stopped', 'ownership.error']) {
+            this.client.on(event, (payload) => { this.ownershipEvents.push({ event, payload: jsonSafe(payload) }); });
+        }
+        for (const suffix of ['join_requested', 'join_approved', 'join_rejected', 'invite_created', 'invite_accepted', 'invite_rejected']) {
+            const event = 'org.member.' + suffix;
+            this.client.on(event, (value) => {
+                const payload = value;
+                this.recordTrace(textOf(payload.org_id), { stage: event, payload });
+            });
+        }
     }
     installTransportRpcObserver() {
         const transport = this.client._transport;
@@ -317,10 +337,38 @@ class CrossSdkJsAgent {
             '',
         ].join('\n');
     }
+    async agentMdContentForUpload(aid, name, type, description) {
+        let content = '';
+        try {
+            const manager = this.client._agentMdManager;
+            const managed = await Promise.resolve(manager?.readContent?.(aid));
+            content = typeof managed === 'string' ? managed : '';
+        }
+        catch {
+            content = '';
+        }
+        if (content && (content.includes('owner:') || content.includes('ownership_proof:') || content.includes('ownership_release:')))
+            return content;
+        try {
+            content = fs.readFileSync(path.join(this.aunPath, 'AIDs', aid, 'agent.md'), 'utf-8');
+            if (content.includes('owner:') || content.includes('ownership_proof:') || content.includes('ownership_release:'))
+                return content;
+        }
+        catch {
+        }
+        return this.agentMdContent(aid, name, type, description);
+    }
     async ensureConnected(backgroundSync = true) {
         const store = this.aidStore();
         try {
-            const registered = await store.register(this.aid);
+            const fixedIdentityFile = textOf(process.env.AUN_TEST_FIXED_IDENTITY_FILE).trim();
+            if (fixedIdentityFile) {
+                const identity = JSON.parse(fs.readFileSync(fixedIdentityFile, 'utf-8'));
+                if (identity.aid !== this.aid)
+                    throw new Error('固定测试身份与配置 AID 不一致');
+                await store._keystore.saveIdentity(this.aid, identity);
+            }
+            const registered = fixedIdentityFile ? await store.load(this.aid) : await store.register(this.aid, { type: 'service' });
             if (!registered.ok) {
                 const loaded = await store.load(this.aid);
                 if (!loaded.ok) {
@@ -331,9 +379,16 @@ class CrossSdkJsAgent {
             if (!loaded.ok) {
                 throw new Error(`load identity failed: ${loaded.error.code}: ${loaded.error.message}`);
             }
-            const uploaded = await store.uploadAgentMd(this.aid, this.agentMdContent(this.aid, this.aid, 'agent', 'Cross-SDK JavaScript test agent'));
-            if (!uploaded.ok) {
-                throw new Error(`upload agent.md failed: ${uploaded.error.code}: ${uploaded.error.message}`);
+            const checked = await store.checkAgentMd(this.aid);
+            const localEtag = checked.ok ? String(checked.data.local_etag ?? '').trim() : '';
+            const remoteEtag = checked.ok ? String(checked.data.remote_etag ?? '').trim() : '';
+            const inSync = Boolean(localEtag && remoteEtag && localEtag === remoteEtag);
+            const remoteFound = checked.ok && checked.data.remote_found === true;
+            if (!inSync && !remoteFound) {
+                const uploaded = await store.uploadAgentMd(this.aid, await this.agentMdContentForUpload(this.aid, this.aid, 'agent', 'Cross-SDK JavaScript test agent'));
+                if (!uploaded.ok) {
+                    throw new Error(`upload agent.md failed: ${uploaded.error.code}: ${uploaded.error.message}`);
+                }
             }
             let identity = loaded.data.aid;
             if (this.debug && !identity.debug) {
@@ -439,6 +494,106 @@ class CrossSdkJsAgent {
             ...envelopeMetadata(data),
         };
     }
+    async ownershipControl(req, res, action) {
+        const body = await readJson(req);
+        const required = { bind: ['role', 'peer_aid'], accept: ['operation_id'], reject: ['operation_id'], release: ['sub_aid'], transfer: ['sub_aid', 'new_owner_aid'] };
+        const fields = required[action];
+        if (!fields || fields.some((key) => typeof body[key] !== 'string' || !textOf(body[key]).trim()) || Object.keys(body).some((key) => !fields.includes(key) && !(action === 'reject' && key === 'reason')) || action === 'reject' && body.reason !== undefined && typeof body.reason !== 'string' || action === 'bind' && !['owner', 'subject'].includes(textOf(body.role))) {
+            sendJson(res, 400, { ok: false, error_code: 'bad_request', error_message: 'Ownership 2.1 control parameters are invalid' });
+            return;
+        }
+        try {
+            let task;
+            switch (action) {
+                case 'bind':
+                    task = body.role === 'owner' ? await this.client.bindSubaid(textOf(body.peer_aid)) : await this.client.bindOwneraid(textOf(body.peer_aid));
+                    break;
+                case 'accept':
+                    task = await this.client.acceptOwnershipRequest(textOf(body.operation_id));
+                    break;
+                case 'reject':
+                    task = await this.client.rejectOwnershipRequest(textOf(body.operation_id), body.reason);
+                    break;
+                case 'release':
+                    task = await this.client.releaseSubaid(textOf(body.sub_aid));
+                    break;
+                default: task = await this.client.transferSubaid(textOf(body.sub_aid), textOf(body.new_owner_aid));
+            }
+            sendJson(res, 200, { ok: true, operation_id: task.operation_id, task: jsonSafe(task) });
+        }
+        catch (error) {
+            sendJson(res, 500, { ok: false, error_code: ownershipErrorCode(error), error_message: error instanceof Error ? error.message : String(error) });
+        }
+    }
+    async ownershipStatus(url, res) {
+        try {
+            const internal = this.client;
+            if (!internal._tokenStore?.listOwnershipTasks)
+                throw new StateError('ownership durable task storage is unavailable', { stringCode: 'persistence_unavailable' });
+            const operationId = textOf(url.searchParams.get('operation_id')).trim();
+            const requestedSub = textOf(url.searchParams.get('sub_aid')).trim();
+            const records = (await internal._tokenStore.listOwnershipTasks(this.aid))
+                .map((snapshot) => snapshot.record)
+                .filter((record) => (!operationId || record.operation_id === operationId) && (!requestedSub || record.sub_aid === requestedSub))
+                .sort((first, second) => second.created_at - first.created_at);
+            const publicTask = (record) => {
+                const localApproval = { pending: 'pending', accept: 'accepted', reject: 'rejected' }[record.local_decision];
+                if (!localApproval || typeof record.initiator_aid !== 'string' || !record.initiator_aid)
+                    throw new StateError('ownership persisted approval is damaged', { stringCode: 'persistence_unavailable' });
+                return { ...ownershipTaskResult(record), initiator_aid: record.initiator_aid, local_approval: localApproval };
+            };
+            const tasks = records.map(publicTask), task = tasks[0] ?? null, record = records[0];
+            const subAid = record?.sub_aid || requestedSub || this.aid;
+            const consensus = await this.client.checkOwnershipConsensus(subAid);
+            const files = { agent_md: null, owner_md: null, storage_agent_md: null };
+            const fileErrors = {};
+            const evidence = (raw, revision) => ({ raw_base64: Buffer.from(raw, 'utf-8').toString('base64'), sha256: crypto.createHash('sha256').update(raw, 'utf-8').digest('hex'), ...(revision ? { revision } : {}) });
+            const errorText = (error) => ownershipErrorCode(error) + ': ' + (error instanceof Error ? error.message : String(error));
+            let ns = null;
+            try {
+                if (!internal._agentMdManager)
+                    throw new StateError('NS fresh reader is unavailable', { stringCode: 'unavailable' });
+                ns = await internal._agentMdManager.readOwnershipFresh(subAid);
+                if (ns.exists)
+                    files.agent_md = evidence(ns.content);
+                else
+                    fileErrors.agent_md = 'not_found';
+            }
+            catch (error) {
+                fileErrors.agent_md = errorText(error);
+            }
+            const storage = new OwnershipStorageAdapter({ currentAid: () => this.aid, call: (method, params) => this.client.call(method, params) });
+            const ownerAid = record ? record.operation === 'transfer' ? record.new_owner_aid : record.owner_aid : consensus.owner_aid;
+            if (ownerAid) {
+                try {
+                    const owner = await storage.readOwnerMd(ownerAid, subAid);
+                    if (owner.exists)
+                        files.owner_md = evidence(owner.content, owner.revision);
+                    else
+                        fileErrors.owner_md = 'not_found';
+                }
+                catch (error) {
+                    fileErrors.owner_md = errorText(error);
+                }
+            }
+            else
+                fileErrors.owner_md = 'owner_unavailable';
+            try {
+                const copy = await storage.readFile(subAid, 'agent.md');
+                if (copy.exists)
+                    files.storage_agent_md = evidence(copy.content, copy.revision);
+                else
+                    fileErrors.storage_agent_md = 'not_found';
+            }
+            catch (error) {
+                fileErrors.storage_agent_md = errorText(error);
+            }
+            sendJson(res, 200, { ok: true, aid: this.aid, task: jsonSafe(task), tasks: jsonSafe(tasks), events: this.ownershipEvents, consensus: jsonSafe(consensus), ns_protocol: ns?.protocol ?? null, files, file_errors: fileErrors });
+        }
+        catch (error) {
+            sendJson(res, 500, { ok: false, error_code: ownershipErrorCode(error), error_message: error instanceof Error ? error.message : String(error) });
+        }
+    }
     async handle(req, res) {
         const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
         try {
@@ -478,6 +633,7 @@ class CrossSdkJsAgent {
                 this.rawPushRpcMethods = [];
                 this.groupChangedEvents = [];
                 this.groupInviteEvents = [];
+                this.readStateEvents = [];
                 this.rawPushObservationId = textOf(body.observation_id ?? '');
                 sendJson(res, 200, { ok: true, observation_id: this.rawPushObservationId });
                 return;
@@ -516,6 +672,7 @@ class CrossSdkJsAgent {
                     rpc_calls: rpcEntries,
                     group_changed_events: groupChangedEvents.slice(-limit),
                     group_invite_events: groupInviteEvents.slice(-limit),
+                    read_state_events: this.readStateEvents.slice(-limit),
                 });
                 return;
             }
@@ -523,6 +680,18 @@ class CrossSdkJsAgent {
                 sendJson(res, 200, await this.identity());
                 return;
             }
+            if (req.method === 'POST' && ['/ownership/bind', '/ownership/accept', '/ownership/reject', '/ownership/release', '/ownership/transfer'].includes(url.pathname)) {
+                await this.ownershipControl(req, res, url.pathname.slice('/ownership/'.length));
+                return;
+            }
+            if (req.method === 'GET' && url.pathname === '/ownership/status') {
+                await this.ownershipStatus(url, res);
+                return;
+            }
+            if (req.method === 'GET' && url.pathname === '/ownership/events') {
+                sendJson(res, 200, { ok: true, events: this.ownershipEvents });
+                return;
+            }
             if (req.method === 'POST' && url.pathname === '/send') {
                 await this.send(req, res);
                 return;
@@ -535,6 +704,10 @@ class CrossSdkJsAgent {
                 await this.pull(req, res);
                 return;
             }
+            if (req.method === 'POST' && url.pathname === '/message/call') {
+                await this.messageCall(req, res);
+                return;
+            }
             if (req.method === 'GET' && url.pathname === '/sync/state') {
                 this.syncState(url, res);
                 return;
@@ -678,6 +851,76 @@ class CrossSdkJsAgent {
             sendJson(res, 500, error);
         }
     }
+    async orgProtocol(params) {
+        const op = textOf(params.op);
+        const now = Math.floor(Date.now() / 1000);
+        if (op === 'request')
+            return buildRequestBinding(textOf(params.method), textOf(params.target), params.params, textOf(params.credential_cid), textOf(params.nonce), textOf(params.request_id), now, now + 300);
+        if (['register', 'sign', 'certificate', 'create'].includes(op)) {
+            const store = this.aidStore();
+            try {
+                if (op === 'register') {
+                    const registered = await store.register(textOf(params.org_id), { type: 'org', owner: this.aid, exttype: 'company' });
+                    if (!registered.ok)
+                        throw new Error(String(registered.error));
+                }
+                const loaded = op === 'certificate'
+                    ? await store.resolve(textOf(params.as_aid), { skipAgentMd: true })
+                    : (params.as_aid || params.org_id) ? await store.load(textOf(params.as_aid ?? params.org_id)) : null;
+                if (loaded && !loaded.ok)
+                    throw new Error(String(loaded.error));
+                const identity = loaded?.data?.aid ?? this.client.currentAid;
+                const result = { cert_fingerprint: identity.certFingerprint, certificate: identity.certPem };
+                if (op === 'sign') {
+                    const signed = await identity.sign(canonicalJson(params.payload));
+                    if (!signed.ok)
+                        throw new Error(String(signed.error));
+                    result.signature = { cert_fingerprint: identity.certFingerprint, timestamp: now, signature: signed.data.signature };
+                }
+                else if (op === 'create') {
+                    result.credential = params.membership_binding
+                        ? await this.client.org.member.createCredential(params.membership_binding, identity, params.options)
+                        : await this.client.credential.create(params.options, identity);
+                }
+                return result;
+            }
+            finally {
+                store.close();
+            }
+        }
+        const value = params.document ?? params.payload;
+        const result = { canonical: new TextDecoder().decode(canonicalJson(value)), digest: digest(value), error_code: '' };
+        if (op === 'verify' || op === 'verify_full') {
+            const certificates = params.certificates;
+            const resolver = (fingerprint) => certificates[fingerprint];
+            try {
+                if (op === 'verify_full') {
+                    const actual = jsonObjectOf(params.context) ?? params;
+                    const memberships = jsonObjectOf(params.memberships) ?? {};
+                    result.verification = { ...await this.client.credential.verify(value, { resolveCertificate: resolver, resolveActorCertificate: resolver,
+                            resolveStatus: (cid) => params.statuses?.[cid], now, audience: textOf(actual.audience), subject: textOf(actual.subject) || undefined,
+                            ns: textOf(actual.ns), action: textOf(actual.action), resource: textOf(actual.resource), rootIssuer: textOf(actual.root_issuer) || undefined,
+                            params: jsonObjectOf(actual.params) ?? {}, units: jsonObjectOf(actual.units) ?? {}, clientIp: textOf(actual.client_ip), method: textOf(actual.method), target: textOf(actual.target),
+                            requestId: textOf(actual.request_id), nonce: textOf(actual.nonce), requestBinding: actual.request_binding, proofChain: actual.proof_chain, membershipBinding: actual.membership_binding,
+                            orgSigner: textOf(actual.org_signer) || undefined, actor: textOf(actual.actor) || undefined, for: textOf(actual.for) || undefined, representationProof: actual.representation_proof,
+                            resolveMembershipStatus: (binding, credential) => { const current = jsonObjectOf(memberships[String(binding.membership_id)]); return current?.status === 'active' && current.credential_cid === credential.cid; },
+                            resolveOwnership: (subject, owner) => (jsonObjectOf(params.ownerships) ?? {})[subject] === owner, checkRateLimit: () => params.rate_limit_allowed === true }) };
+                }
+                else if (params.kind === 'credential')
+                    result.verification = { ...await this.client.credential.verifySignature(value, resolver, now, textOf(params.audience)) };
+                else if (params.kind === 'binding')
+                    await verifyMembershipBinding(value, resolver, now, textOf(params.expected_org_signer));
+                else
+                    result.verification = { ...await this.client.credential.verifyRegistrationReceipt(value, params.credential, params.request, resolver, textOf(params.service_aid), now) };
+            }
+            catch (error) {
+                if (!(error instanceof ProtocolError))
+                    throw error;
+                result.error_code = error.code;
+            }
+        }
+        return result;
+    }
     async groupCall(req, res) {
         const body = await readJson(req);
         const traceId = textOf(body.trace_id || crypto.randomUUID().replace(/-/g, ''));
@@ -693,6 +936,48 @@ class CrossSdkJsAgent {
         try {
             let result;
             switch (method) {
+                case 'sdk.org.protocol':
+                    result = await this.orgProtocol(params);
+                    break;
+                case 'org.lifecycle.create':
+                    result = await this.client.org.lifecycle.create(params);
+                    break;
+                case 'org.lifecycle.dissolve':
+                    result = await this.client.org.lifecycle.dissolve(params);
+                    break;
+                case 'org.lifecycle.transfer':
+                    result = await this.client.org.lifecycle.transfer(params);
+                    break;
+                case 'org.lifecycle.transferAccept':
+                    result = await this.client.org.lifecycle.transferAccept(params);
+                    break;
+                case 'org.member.join':
+                    result = await this.client.org.member.join(params);
+                    break;
+                case 'org.member.approveJoin':
+                    result = await this.client.org.member.approveJoin(params);
+                    break;
+                case 'org.member.rejectJoin':
+                    result = await this.client.org.member.rejectJoin(params);
+                    break;
+                case 'org.member.invite':
+                    result = await this.client.org.member.invite(params);
+                    break;
+                case 'org.member.inviteAccept':
+                    result = await this.client.org.member.inviteAccept(params);
+                    break;
+                case 'org.member.inviteReject':
+                    result = await this.client.org.member.inviteReject(params);
+                    break;
+                case 'org.member.leave':
+                    result = await this.client.org.member.leave(params);
+                    break;
+                case 'org.member.offboard':
+                    result = await this.client.org.member.offboard(params);
+                    break;
+                case 'org.credential.getStatus':
+                    result = await this.client.org.credential.getStatus(params);
+                    break;
                 case 'sdk.update_group_index':
                     result = await this.client.group.updateGroupIndex(params);
                     break;
@@ -726,6 +1011,12 @@ class CrossSdkJsAgent {
                 case 'group.get_member_statuses':
                     result = await this.client.group.getMemberStatuses(params);
                     break;
+                case 'group.read':
+                    result = await this.client.group.read(params);
+                    break;
+                case 'group.read_state':
+                    result = await this.client.group.readState(params);
+                    break;
                 default: result = await this.client.call(method, params);
             }
             const response = { ok: true, trace_id: traceId, method, result: jsonSafe(result) };
@@ -1395,6 +1686,39 @@ class CrossSdkJsAgent {
             });
         }
     }
+    async messageCall(req, res) {
+        const body = await readJson(req);
+        const traceId = textOf(body.trace_id || crypto.randomUUID().replace(/-/g, ''));
+        const method = textOf(body.method).trim();
+        const params = jsonObjectOf(body.params) ?? {};
+        if (!method) {
+            sendJson(res, 400, { ok: false, trace_id: traceId, error_code: 'bad_request', error_message: 'method is required' });
+            return;
+        }
+        try {
+            let result;
+            if (method === 'message.read')
+                result = await this.client.message.read(params);
+            else if (method === 'message.read_state')
+                result = await this.client.message.readState(params);
+            else
+                result = await this.client.call(method, params);
+            const response = { ok: true, trace_id: traceId, method, result: jsonSafe(result) };
+            this.recordTrace(traceId, { stage: 'message_call', method, result: response });
+            sendJson(res, 200, response);
+        }
+        catch (err) {
+            const error = {
+                ok: false,
+                trace_id: traceId,
+                method,
+                error_code: err instanceof Error ? err.name : 'Error',
+                error_message: err instanceof Error ? err.message : String(err),
+            };
+            this.recordTrace(traceId, { stage: 'message_call_error', method, error });
+            sendJson(res, 500, error);
+        }
+    }
     syncNamespace(scope, groupId = '') {
         if (scope === 'p2p')
             return `p2p:${this.aid}`;
@@ -1831,5 +2155,6 @@ async function main() {
     process.on('SIGINT', () => { void shutdown(); });
     process.on('SIGTERM', () => { void shutdown(); });
 }
-void main();
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url))
+    void main();
 //# sourceMappingURL=cross-sdk-agent.js.map