@agentunion/fastaun 0.4.12 → 0.5.0

package/dist/client.js

@@ -16,6 +16,7 @@ import * as https from 'node:https';
 import { URL } from 'node:url';
 import { configFromMap, getDeviceId, normalizeSlotId } from './config.js';
 import { CryptoProvider } from './crypto.js';
+import { AIDStore } from './aid-store.js';
 import { GatewayDiscovery } from './discovery.js';
 import { DnsResilientNet } from './net.js';
 import { AUNError, AuthError, ConnectionError, E2EEError, NotFoundError, PermissionError, StateError, TimeoutError, ValidationError, } from './errors.js';
@@ -33,6 +34,9 @@ import { IdentityRuntimeManager } from './client/identity.js';
 import { LifecycleController } from './client/lifecycle.js';
 import { PeerDirectory } from './client/peers.js';
 import { RpcPipeline } from './client/rpc-pipeline.js';
+import { CollabClient } from './collab/client.js';
+import { GroupFacade, MessageFacade, StreamFacade } from './facades.js';
+import { StorageVFS } from './storage/vfs.js';
 import { V2E2EECoordinator } from './client/v2-e2ee.js';
 import { GroupStateCoordinator } from './client/group-state.js';
 import { decryptMessage, } from './v2/e2ee/index.js';
@@ -142,18 +146,25 @@ const NON_IDEMPOTENT_METHODS = new Set([
     'storage.create_folder', 'storage.rename_folder', 'storage.move_folder',
     'storage.delete_folder', 'storage.move_object', 'storage.copy_object',
     'storage.batch_delete', 'storage.set_object_meta', 'storage.append_object',
+    'storage.set_acl', 'storage.remove_acl', 'storage.set_visibility',
+    'storage.issue_token', 'storage.revoke_token',
+    'storage.create_symlink', 'storage.atomic_repoint',
+    'storage.rename_symlink', 'storage.delete_symlink',
+    'storage.fs.mkdir', 'storage.fs.remove', 'storage.fs.rename', 'storage.fs.copy',
+    'storage.fs.mount', 'storage.fs.approve', 'storage.fs.reject', 'storage.fs.unmount',
+    'storage.fs.invalidate_membership',
+    'storage.volume.create', 'storage.volume.renew', 'storage.volume.expire_due',
+    'group.fs.mkdir', 'group.fs.rm', 'group.fs.cp', 'group.fs.mv',
+    'group.fs.mount', 'group.fs.umount',
+    'group.fs.check_upload', 'group.fs.create_upload_session',
+    'group.fs.complete_upload', 'group.fs.create_download_ticket',
     'auth.create_aid', 'auth.renew_cert', 'auth.rekey',
     'message.thought.put', 'group.thought.put',
-    'group.add_member',
-    'group.resources.put', 'group.resources.create_folder',
-    'group.resources.rename', 'group.resources.move',
-    'group.resources.mount_object', 'group.resources.update',
-    'group.resources.delete', 'group.resources.cleanup_by_storage_ref',
-    'group.resources.request_add', 'group.resources.request_mount_object',
-    'group.resources.direct_add', 'group.resources.approve_request',
-    'group.resources.reject_request', 'group.resources.unmount',
-    'group.resources.get_access',
-    'group.resources.resolve_access_ticket',
+    'group.add_member', 'group.bind_group_aid', 'group.complete_transfer',
+    'collab.create', 'collab.commit', 'collab.clone',
+    'collab.prune', 'collab.unregister',
+    'collab.tag.create', 'collab.tag.restore',
+    'collab.tag.rm', 'collab.tag.prune',
 ]);
 /** 需要客户端签名的关键方法。运行时逻辑已迁入 RpcPipeline，此处保留给源码审计测试。 */
 const SIGNED_METHODS = new Set([
@@ -170,26 +181,36 @@ const SIGNED_METHODS = new Set([
     'group.leave', 'group.remove_member', 'group.update_rules',
     'group.update', 'group.update_announcement',
     'group.update_join_requirements', 'group.set_role',
-    'group.transfer_owner', 'group.review_join_request',
+    'group.transfer_owner', 'group.bind_group_aid', 'group.complete_transfer',
+    'group.review_join_request',
     'group.batch_review_join_request',
     'group.request_join', 'group.use_invite_code',
     'group.thought.put',
     'message.thought.put',
     'group.set_settings',
-    'group.resources.put', 'group.resources.create_folder',
-    'group.resources.rename', 'group.resources.move',
-    'group.resources.mount_object', 'group.resources.update',
-    'group.resources.delete', 'group.resources.cleanup_by_storage_ref',
-    'group.resources.request_add', 'group.resources.request_mount_object',
-    'group.resources.direct_add', 'group.resources.approve_request',
-    'group.resources.reject_request', 'group.resources.unmount',
-    'group.resources.get_access', 'group.resources.resolve_access_ticket',
     'storage.put_object', 'storage.delete_object', 'storage.get_by_share',
     'storage.create_share_link', 'storage.revoke_share_link',
     'storage.create_upload_session', 'storage.complete_upload',
     'storage.create_folder', 'storage.rename_folder', 'storage.move_folder',
     'storage.delete_folder', 'storage.move_object', 'storage.copy_object',
     'storage.batch_delete', 'storage.set_object_meta', 'storage.append_object',
+    'storage.set_acl', 'storage.remove_acl', 'storage.set_visibility',
+    'storage.check_access',
+    'storage.issue_token', 'storage.revoke_token',
+    'storage.create_symlink', 'storage.atomic_repoint',
+    'storage.rename_symlink', 'storage.delete_symlink',
+    'storage.fs.mkdir', 'storage.fs.remove', 'storage.fs.rename', 'storage.fs.copy',
+    'storage.fs.mount', 'storage.fs.approve', 'storage.fs.reject', 'storage.fs.unmount',
+    'storage.fs.invalidate_membership',
+    'storage.volume.create', 'storage.volume.renew', 'storage.volume.expire_due',
+    'group.fs.mkdir', 'group.fs.rm', 'group.fs.cp', 'group.fs.mv',
+    'group.fs.mount', 'group.fs.umount',
+    'group.fs.check_upload', 'group.fs.create_upload_session',
+    'group.fs.complete_upload', 'group.fs.create_download_ticket',
+    'collab.create', 'collab.commit', 'collab.clone',
+    'collab.prune', 'collab.unregister',
+    'collab.tag.create', 'collab.tag.restore',
+    'collab.tag.rm', 'collab.tag.prune',
     'group.commit_state',
     'group.ban', 'group.unban',
     'group.dissolve', 'group.suspend', 'group.resume',
@@ -226,6 +247,22 @@ function _v2BytesEqual(a, b) {
 function formatCaughtError(error) {
     return error instanceof Error ? error : String(error);
 }
+const RELOGIN_REFRESH_ERRORS = new Set([
+    'missing refresh_token',
+    'invalid_or_expired_refresh_token',
+    'refresh not supported',
+]);
+function authErrorRequiresRelogin(error) {
+    const data = error.data;
+    if (isJsonObject(data)) {
+        if (data.relogin_required === true)
+            return true;
+        const code = String(data.error ?? '').trim().toLowerCase();
+        if (RELOGIN_REFRESH_ERRORS.has(code))
+            return true;
+    }
+    return RELOGIN_REFRESH_ERRORS.has(error.message.trim().toLowerCase());
+}
 function normalizeDeliveryModeConfig(raw, opts = {}) {
     const defaultMode = String(opts.defaultMode ?? 'fanout').trim().toLowerCase() || 'fanout';
     const defaultRouting = String(opts.defaultRouting ?? 'round_robin').trim().toLowerCase() || 'round_robin';
@@ -497,6 +534,11 @@ export class AUNClient {
     _delivery;
     _v2E2EE;
     _groupState;
+    _storage;
+    _collab;
+    _message;
+    _group;
+    _stream;
     constructor(aid) {
         if (aid !== null && aid !== undefined && !isAIDObject(aid)) {
             throw new ValidationError('AUNClient only accepts an AID object or no argument');
@@ -635,6 +677,36 @@ export class AUNClient {
     get aid() {
         return this._aid;
     }
+    /** AUN Storage VFS 入口 */
+    get storage() {
+        if (!this._storage)
+            this._storage = new StorageVFS(this);
+        return this._storage;
+    }
+    /** AUN Collab 入口 */
+    get collab() {
+        if (!this._collab)
+            this._collab = new CollabClient(this);
+        return this._collab;
+    }
+    /** Message facade 入口 */
+    get message() {
+        if (!this._message)
+            this._message = new MessageFacade(this);
+        return this._message;
+    }
+    /** Group facade 入口 */
+    get group() {
+        if (!this._group)
+            this._group = new GroupFacade(this);
+        return this._group;
+    }
+    /** Stream facade 入口 */
+    get stream() {
+        if (!this._stream)
+            this._stream = new StreamFacade(this);
+        return this._stream;
+    }
     /** 当前 AID 值对象 */
     get currentAid() {
         return this._currentAid;
@@ -882,6 +954,201 @@ export class AUNClient {
     async call(method, params) {
         return await this._rpcPipeline.call(method, params);
     }
+    async createGroup(params = {}) {
+        if (!isJsonObject(params)) {
+            throw new ValidationError('createGroup params must be an object');
+        }
+        const payload = { ...params };
+        const groupName = String(payload.group_name ?? payload.groupName ?? '').trim();
+        if (!groupName) {
+            return await this.call('group.create', payload);
+        }
+        const keyPair = new CryptoProvider().generateIdentity();
+        payload.public_key = keyPair.public_key_der_b64;
+        payload.curve = keyPair.curve;
+        const result = await this.call('group.create', payload);
+        const resultMap = isJsonObject(result) ? result : {};
+        const group = isJsonObject(resultMap.group) ? resultMap.group : {};
+        const aidCert = isJsonObject(resultMap.aid_cert) ? resultMap.aid_cert : {};
+        const groupAid = String(group.group_aid ?? resultMap.group_aid ?? '').trim();
+        const certPem = String(aidCert.cert ?? aidCert.cert_pem ?? resultMap.cert ?? resultMap.cert_pem ?? '').trim();
+        if (!groupAid || !certPem) {
+            throw new ValidationError('group.create named group response missing group.group_aid or aid_cert.cert');
+        }
+        const store = new AIDStore({
+            aunPath: this._configModel.aunPath,
+            encryptionSeed: this._configModel.seedPassword ?? '',
+            slotId: this._slotId,
+            verifySsl: this._configModel.verifySsl,
+            rootCaPath: this._configModel.rootCaPath,
+            debug: this._configModel.debug,
+        });
+        try {
+            const imported = store.importGroupIdentity(groupAid, {
+                private_key_pem: keyPair.private_key_pem,
+                public_key_der_b64: keyPair.public_key_der_b64,
+                curve: keyPair.curve,
+                cert_pem: certPem,
+            });
+            if (!imported.ok) {
+                throw new ValidationError(imported.error.message);
+            }
+        }
+        finally {
+            store.close();
+        }
+        return result;
+    }
+    async bindGroupAid(params = {}, options = {}) {
+        if (!isJsonObject(params)) {
+            throw new ValidationError('bindGroupAid params must be an object');
+        }
+        const store = options.aidStore;
+        if (!store) {
+            throw new ValidationError('bindGroupAid requires aidStore');
+        }
+        const keyPair = new CryptoProvider().generateIdentity();
+        const payload = { ...params };
+        payload.public_key = keyPair.public_key_der_b64;
+        payload.curve = keyPair.curve;
+        const result = await this.call('group.bind_group_aid', payload);
+        const resultMap = isJsonObject(result) ? result : {};
+        const group = isJsonObject(resultMap.group) ? resultMap.group : {};
+        const aidCert = isJsonObject(resultMap.aid_cert) ? resultMap.aid_cert : {};
+        const groupAid = String(group.group_aid ?? resultMap.group_aid ?? '').trim();
+        const certPem = String(aidCert.cert ?? aidCert.cert_pem ?? resultMap.cert ?? resultMap.cert_pem ?? '').trim();
+        if (!groupAid || !certPem) {
+            throw new ValidationError('group.bind_group_aid response missing group.group_aid or aid_cert.cert');
+        }
+        const imported = store.importGroupIdentity(groupAid, {
+            private_key_pem: keyPair.private_key_pem,
+            public_key_der_b64: keyPair.public_key_der_b64,
+            curve: keyPair.curve,
+            cert_pem: certPem,
+        });
+        if (!imported.ok) {
+            throw new ValidationError(imported.error.message);
+        }
+        return result;
+    }
+    async startGroupTransfer(params = {}, options = {}) {
+        if (!isJsonObject(params)) {
+            throw new ValidationError('startGroupTransfer params must be an object');
+        }
+        const store = options.aidStore;
+        if (!store) {
+            throw new ValidationError('startGroupTransfer requires aidStore');
+        }
+        const groupId = String(params.group_id ?? '').trim();
+        const newOwner = String(params.new_owner ?? '').trim();
+        if (!groupId || !newOwner) {
+            throw new ValidationError('startGroupTransfer requires group_id and new_owner');
+        }
+        let groupAid = String(params.group_aid ?? '').trim();
+        if (!groupAid) {
+            const info = await this.call('group.get', { group_id: groupId });
+            const infoMap = isJsonObject(info) ? info : {};
+            const grp = isJsonObject(infoMap.group) ? infoMap.group : infoMap;
+            groupAid = String(grp.group_aid ?? '').trim();
+        }
+        if (!groupAid) {
+            throw new ValidationError('startGroupTransfer: unable to determine group_aid');
+        }
+        const loaded = store.load(groupAid);
+        if (!loaded.ok || !loaded.data) {
+            throw new ValidationError(`startGroupTransfer: group_aid identity not found: ${groupAid}`);
+        }
+        const aidObj = loaded.data.aid;
+        if (!aidObj.isPrivateKeyValid() || !aidObj.privateKeyPem) {
+            throw new ValidationError(`startGroupTransfer: group_aid private key not found: ${groupAid}`);
+        }
+        const nonce = crypto.randomUUID().replace(/-/g, '');
+        const issuedMs = Date.now();
+        const canonical = [
+            'aun-group-owner-transfer-v1',
+            groupId.toLowerCase(),
+            groupAid.toLowerCase(),
+            newOwner.toLowerCase(),
+            nonce,
+            String(issuedMs),
+        ].join('|');
+        const signed = aidObj.sign(canonical);
+        if (!signed.ok) {
+            throw new ValidationError(`startGroupTransfer: sign failed: ${signed.error.message}`);
+        }
+        const payload = { ...params, group_aid: groupAid };
+        payload.transfer_auth = { nonce, issued_ms: issuedMs, signature: signed.data.signature };
+        return await this.call('group.transfer_owner', payload);
+    }
+    async completeGroupTransfer(params = {}, options = {}) {
+        if (!isJsonObject(params)) {
+            throw new ValidationError('completeGroupTransfer params must be an object');
+        }
+        const store = options.aidStore;
+        if (!store) {
+            throw new ValidationError('completeGroupTransfer requires aidStore');
+        }
+        const keyPair = new CryptoProvider().generateIdentity();
+        const payload = { ...params };
+        const groupId = String(params.group_id ?? '').trim();
+        if (!groupId) {
+            throw new ValidationError('completeGroupTransfer requires group_id');
+        }
+        let groupAid = String(params.group_aid ?? '').trim();
+        if (!groupAid) {
+            const info = await this.call('group.get', { group_id: groupId });
+            const infoMap = isJsonObject(info) ? info : {};
+            const grp = isJsonObject(infoMap.group) ? infoMap.group : infoMap;
+            groupAid = String(grp.group_aid ?? '').trim();
+        }
+        if (!groupAid) {
+            throw new ValidationError('completeGroupTransfer: unable to determine group_aid');
+        }
+        const current = this.currentAid;
+        const newOwner = String(current?.aid ?? '').trim();
+        if (!current || !newOwner || !current.isPrivateKeyValid()) {
+            throw new ValidationError('completeGroupTransfer requires current new-owner AID with private key');
+        }
+        const nonce = crypto.randomUUID().replace(/-/g, '');
+        const issuedMs = Date.now();
+        const publicKeyHash = crypto.createHash('sha256').update(keyPair.public_key_der_b64, 'utf8').digest('hex');
+        const canonical = [
+            'aun-group-owner-transfer-accept-v1',
+            groupId.toLowerCase(),
+            groupAid.toLowerCase(),
+            newOwner.toLowerCase(),
+            publicKeyHash,
+            nonce,
+            String(issuedMs),
+        ].join('|');
+        const signed = current.sign(canonical);
+        if (!signed.ok) {
+            throw new ValidationError(`completeGroupTransfer: accept sign failed: ${signed.error.message}`);
+        }
+        payload.group_aid = groupAid;
+        payload.public_key = keyPair.public_key_der_b64;
+        payload.curve = keyPair.curve;
+        payload.transfer_accept = { nonce, issued_ms: issuedMs, signature: signed.data.signature };
+        const result = await this.call('group.complete_transfer', payload);
+        const resultMap = isJsonObject(result) ? result : {};
+        const group = isJsonObject(resultMap.group) ? resultMap.group : {};
+        const aidCert = isJsonObject(resultMap.aid_cert) ? resultMap.aid_cert : {};
+        const returnedGroupAid = String(group.group_aid ?? resultMap.group_aid ?? '').trim();
+        const certPem = String(aidCert.cert ?? aidCert.cert_pem ?? resultMap.cert ?? resultMap.cert_pem ?? '').trim();
+        if (!returnedGroupAid || !certPem) {
+            throw new ValidationError('group.complete_transfer response missing group.group_aid or aid_cert.cert');
+        }
+        const imported = store.importGroupIdentity(returnedGroupAid, {
+            private_key_pem: keyPair.private_key_pem,
+            public_key_der_b64: keyPair.public_key_der_b64,
+            curve: keyPair.curve,
+            cert_pem: certPem,
+        });
+        if (!imported.ok) {
+            throw new ValidationError(imported.error.message);
+        }
+        return result;
+    }
     static _notifyParamsSizeOk(params) {
         return new TextEncoder().encode(JSON.stringify(params)).length <= MAX_NOTIFY_PAYLOAD_SIZE;
     }
@@ -2624,6 +2891,18 @@ export class AUNClient {
                 }
                 catch (exc) {
                     if (exc instanceof AuthError) {
+                        if (authErrorRequiresRelogin(exc)) {
+                            this._clientLog.warn(`token refresh requires relogin, stopping refresh loop and triggering reconnect: ${exc.message}`);
+                            await this._dispatcher.publish('token.refresh_exhausted', {
+                                aid: this._identity?.aid ?? null,
+                                consecutive_failures: 1,
+                                last_error: String(exc),
+                                relogin_required: true,
+                            });
+                            this._tokenRefreshFailures = 0;
+                            await this._handleTransportDisconnect(new Error('token refresh relogin required, triggering reconnect'));
+                            return;
+                        }
                         this._tokenRefreshFailures++;
                         if (this._tokenRefreshFailures >= 3) {
                             this._clientLog.warn(`token refresh failed ${this._tokenRefreshFailures} consecutive times, stopping refresh loop and triggering reconnect`);
@@ -2633,7 +2912,7 @@ export class AUNClient {
                                 last_error: String(exc),
                             });
                             this._tokenRefreshFailures = 0;
-                            this._handleTransportDisconnect(new Error('token refresh exhausted, triggering reconnect'));
+                            await this._handleTransportDisconnect(new Error('token refresh exhausted, triggering reconnect'));
                             return;
                         }
                         this._clientLog.debug(`token refresh failed (${this._tokenRefreshFailures}/3), will retry: ${exc}`);
@@ -2750,10 +3029,12 @@ export class AUNClient {
                 eventPayload.code = disconnectInfo.code;
             }
             await this._dispatcher.publish('state_change', eventPayload);
+            this._reconnectActive = false;
             return;
         }
         // 1000 = 正常关闭, 1006 = 网络异常断开（无 close frame），其他 code = 服务端主动关闭
         const serverInitiated = closeCode !== undefined && closeCode !== 1000 && closeCode !== 1006;
+        this._reconnectActive = false;
         this._startReconnect(serverInitiated);
     }
     /** 启动重连循环（默认无限重试 + 指数退避 + 固定上限抖动，仅在不可重试错误、close() 或 max_attempts 耗尽时终止） */