@agentunion/fastaun 0.5.18 → 0.5.19

package/dist/tools/cross-sdk-agent.js

@@ -3,11 +3,15 @@ import * as http from 'node:http';
 import * as https from 'node:https';
 import * as crypto from 'node:crypto';
 import * as fs from 'node:fs';
+import * as path from 'node:path';
 import { URL } from 'node:url';
+import { fileURLToPath } from 'node:url';
 import { AUNClient } from '../client.js';
 import { AIDStore } from '../aid-store.js';
 import { publicKeyFingerprint } from '../cert-utils.js';
 import { VERSION } from '../version.js';
+import { canonicalJson, digest, buildRequestBinding, verifyMembershipBinding, ProtocolError } from '../org-protocol.js';
+import { ownershipTaskResult } from '../ownership-workflow.js';
 function envBool(name, fallback = false) {
     const raw = process.env[name];
     if (raw == null)
@@ -105,7 +109,7 @@ function sendJson(res, status, data) {
     });
     res.end(body);
 }
-class CrossSdkTsAgent {
+export class CrossSdkTsAgent {
     language = 'ts';
     sdkVersion = VERSION;
     aid = textOf(process.env.AUN_TEST_AID || 'cross-ts.agentid.pub').trim();
@@ -125,6 +129,8 @@ class CrossSdkTsAgent {
     rpcObservedTransports = new WeakSet();
     groupChangedEvents = [];
     groupInviteEvents = [];
+    readStateEvents = [];
+    ownershipEvents = [];
     traces = new Map();
     sendResults = new Map();
     inlineRealtimePayloadV1 = true;
@@ -166,6 +172,21 @@ class CrossSdkTsAgent {
         });
         this.client.on('group.changed', (data) => this.storeGroupChangedPublicEvent(data));
         this.client.on('group.invite_received', (data) => this.storeGroupInviteEvent(data));
+        for (const event of ['message.read_changed', 'group.read_changed', 'read_state_sync']) {
+            this.client.on(event, (payload) => { this.readStateEvents.push({ event, payload: jsonSafe(payload) }); });
+        }
+        for (const event of ['ownership.request', 'ownership.pending', 'ownership.progress', 'ownership.completed', 'ownership.rejected', 'ownership.stopped', 'ownership.error', 'ownership.action_required']) {
+            this.client.on(event, (payload) => {
+                this.ownershipEvents.push({ event, payload: jsonSafe(payload) });
+            });
+        }
+        for (const suffix of ['join_requested', 'join_approved', 'join_rejected', 'invite_created', 'invite_accepted', 'invite_rejected']) {
+            const event = 'org.member.' + suffix;
+            this.client.on(event, (value) => {
+                const payload = value;
+                this.recordTrace(textOf(payload.org_id), { stage: event, payload });
+            });
+        }
     }
     installTransportRpcObserver() {
         const transport = this.client._transport;
@@ -292,7 +313,14 @@ class CrossSdkTsAgent {
             debug: this.debug,
         });
         try {
-            const registered = await store.register(this.aid);
+            const fixedIdentityFile = textOf(process.env.AUN_TEST_FIXED_IDENTITY_FILE).trim();
+            if (fixedIdentityFile) {
+                const identity = JSON.parse(fs.readFileSync(fixedIdentityFile, 'utf-8'));
+                if (identity.aid !== this.aid)
+                    throw new Error('固定测试身份与配置 AID 不一致');
+                store._keystore.saveIdentity(this.aid, identity);
+            }
+            const registered = fixedIdentityFile ? store.load(this.aid) : await store.register(this.aid, { type: 'service' });
             if (!registered.ok) {
                 const loaded = store.load(this.aid);
                 if (!loaded.ok) {
@@ -301,6 +329,8 @@ class CrossSdkTsAgent {
             }
         }
         catch (err) {
+            if (textOf(process.env.AUN_TEST_FIXED_IDENTITY_FILE).trim())
+                throw err;
             const localIdentity = internal._auth?.loadIdentityOrNone?.(this.aid);
             if (!localIdentity) {
                 throw new Error(`registerAid failed and no local identity exists: ${err instanceof Error ? err.message : String(err)}`);
@@ -310,11 +340,15 @@ class CrossSdkTsAgent {
         if (!loaded.ok) {
             throw new Error(`load identity failed: ${loaded.error.code}: ${loaded.error.message}`);
         }
-        const uploaded = await store.uploadAgentMd(this.aid, this.agentMdContent(this.aid, this.aid, 'agent', 'Cross-SDK TypeScript test agent'));
-        if (!uploaded.ok) {
-            throw new Error(`upload agent.md failed: ${uploaded.error.code}: ${uploaded.error.message}`);
-        }
         this.client.loadIdentity(loaded.data.aid);
+        const checked = await store.checkAgentMd(this.aid);
+        const localEtag = checked.ok ? String(checked.data.local_etag ?? '').trim() : '';
+        const remoteEtag = checked.ok ? String(checked.data.remote_etag ?? '').trim() : '';
+        const inSync = Boolean(localEtag && remoteEtag && localEtag === remoteEtag);
+        const remoteFound = checked.ok && checked.data.remote_found === true;
+        if (!inSync && !remoteFound) {
+            await this.client._ensureInitialAgentMd();
+        }
         this.installTransportRpcObserver();
         await this.client.connect({ auto_reconnect: false, background_sync: backgroundSync });
     }
@@ -330,6 +364,96 @@ class CrossSdkTsAgent {
             public_key_fingerprint: cert ? publicKeyFingerprint(cert) : '',
         };
     }
+    async ownershipBind(req, res) {
+        const body = await readJson(req);
+        const role = textOf(body.role).trim().toLowerCase();
+        const peerAid = textOf(body.peer_aid).trim();
+        if (!['owner', 'subject'].includes(role) || !peerAid) {
+            sendJson(res, 400, { ok: false, error_code: 'bad_request', error_message: 'role and peer_aid are required' });
+            return;
+        }
+        try {
+            const task = role === 'owner' ? await this.client.bindSubaid(peerAid) : await this.client.bindOwneraid(peerAid);
+            sendJson(res, 200, { ok: true, operation_id: task.operation_id, task: jsonSafe(task) });
+        }
+        catch (err) {
+            sendJson(res, 500, {
+                ok: false,
+                error_code: textOf(err?.stringCode ?? err?.code ?? (err instanceof Error ? err.name : 'Error')),
+                error_message: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    async ownershipAction(req, res, action) {
+        const body = await readJson(req);
+        const operationId = textOf(body.operation_id).trim(), subAid = textOf(body.sub_aid).trim(), newOwnerAid = textOf(body.new_owner_aid).trim();
+        if ((action === 'accept' || action === 'reject') ? !operationId : !subAid || action === 'transfer' && !newOwnerAid) {
+            sendJson(res, 400, { ok: false, error_code: 'bad_request', error_message: action === 'accept' || action === 'reject' ? 'operation_id is required' : 'sub_aid and transfer new_owner_aid are required' });
+            return;
+        }
+        try {
+            const task = action === 'accept' ? await this.client.acceptOwnershipRequest(operationId)
+                : action === 'reject' ? await this.client.rejectOwnershipRequest(operationId, body.reason)
+                    : action === 'release' ? await this.client.releaseSubaid(subAid)
+                        : await this.client.transferSubaid(subAid, newOwnerAid);
+            sendJson(res, 200, { ok: true, operation_id: task.operation_id, task: jsonSafe(task) });
+        }
+        catch (err) {
+            sendJson(res, 500, {
+                ok: false,
+                error_code: textOf(err?.stringCode ?? err?.code ?? (err instanceof Error ? err.name : 'Error')),
+                error_message: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    ownershipPublicTask(record) {
+        const decision = record.local_decision;
+        if (!['pending', 'accept', 'reject'].includes(String(decision)) || typeof record.initiator_aid !== 'string' || !record.initiator_aid)
+            throw new Error('persisted ownership approval context is unavailable');
+        return { ...ownershipTaskResult(record), initiator_aid: record.initiator_aid, local_approval: decision === 'accept' ? 'accepted' : decision === 'reject' ? 'rejected' : 'pending' };
+    }
+    async ownershipStatus(url, res) {
+        const internal = this.client;
+        if (!internal._tokenStore.listOwnershipTasks)
+            throw new Error('ownership task store is unavailable');
+        const operationId = textOf(url.searchParams.get('operation_id')).trim(), selectedSub = textOf(url.searchParams.get('sub_aid')).trim();
+        const records = internal._tokenStore.listOwnershipTasks(this.aid).map((item) => item.task).filter((record) => (!operationId || record.operation_id === operationId) && (!selectedSub || record.sub_aid === selectedSub));
+        const tasks = records.map((record) => this.ownershipPublicTask(record)), task = tasks[tasks.length - 1] ?? null;
+        const subAid = textOf(task?.sub_aid ?? selectedSub).trim() || this.aid;
+        const consensus = await this.client.checkOwnershipConsensus(subAid);
+        const files = { agent_md: null, owner_md: null, storage_agent_md: null }, fileErrors = {};
+        let nsProtocol = null;
+        try {
+            const current = await internal._getOwnershipFiles().readAgent(subAid);
+            nsProtocol = current.protocol;
+            if (!current.exists)
+                fileErrors.agent_md = 'not_found';
+            else
+                files.agent_md = { raw_base64: Buffer.from(current.content, 'utf8').toString('base64'), sha256: crypto.createHash('sha256').update(current.content, 'utf8').digest('hex'), etag: current.etag };
+        }
+        catch (err) {
+            fileErrors.agent_md = err instanceof Error ? err.message : String(err);
+        }
+        const ownerAid = textOf(task?.operation === 'release' ? task.owner_aid : consensus.owner_aid ?? task?.new_owner_aid ?? task?.owner_aid).trim();
+        const readStorageFile = async (name, read) => {
+            try {
+                const current = await read();
+                if (!current.exists)
+                    fileErrors[name] = 'not_found';
+                else
+                    files[name] = { raw_base64: Buffer.from(current.content, 'utf8').toString('base64'), sha256: crypto.createHash('sha256').update(current.content, 'utf8').digest('hex'), revision: current.revision };
+            }
+            catch (err) {
+                fileErrors[name] = err instanceof Error ? err.message : String(err);
+            }
+        };
+        await Promise.all([
+            ownerAid ? readStorageFile('owner_md', () => internal._getOwnershipFiles().readOwner(ownerAid, subAid)) : Promise.resolve().then(() => { fileErrors.owner_md = 'owner_aid is unavailable'; }),
+            readStorageFile('storage_agent_md', () => internal._getOwnershipStorage().readObject(subAid, 'agent.md')),
+        ]);
+        const events = this.ownershipEvents.filter((item) => (!operationId || item.payload?.operation_id === operationId) && (!selectedSub || item.payload?.sub_aid === selectedSub));
+        sendJson(res, 200, { ok: true, task, tasks, events, consensus: consensus, files, file_errors: fileErrors, ns_protocol: nsProtocol });
+    }
     recordTrace(traceId, item) {
         if (!traceId)
             return;
@@ -439,6 +563,7 @@ class CrossSdkTsAgent {
                 this.rawPushRpcMethods = [];
                 this.groupChangedEvents = [];
                 this.groupInviteEvents = [];
+                this.readStateEvents = [];
                 this.rawPushObservationId = textOf(body.observation_id ?? '');
                 sendJson(res, 200, { ok: true, observation_id: this.rawPushObservationId });
                 return;
@@ -477,6 +602,7 @@ class CrossSdkTsAgent {
                     rpc_calls: rpcEntries,
                     group_changed_events: groupChangedEvents.slice(-limit),
                     group_invite_events: groupInviteEvents.slice(-limit),
+                    read_state_events: this.readStateEvents.slice(-limit),
                 });
                 return;
             }
@@ -484,6 +610,34 @@ class CrossSdkTsAgent {
                 sendJson(res, 200, this.identity());
                 return;
             }
+            if (req.method === 'POST' && url.pathname === '/ownership/bind') {
+                await this.ownershipBind(req, res);
+                return;
+            }
+            if (req.method === 'POST' && url.pathname === '/ownership/accept') {
+                await this.ownershipAction(req, res, 'accept');
+                return;
+            }
+            if (req.method === 'POST' && url.pathname === '/ownership/reject') {
+                await this.ownershipAction(req, res, 'reject');
+                return;
+            }
+            if (req.method === 'POST' && url.pathname === '/ownership/release') {
+                await this.ownershipAction(req, res, 'release');
+                return;
+            }
+            if (req.method === 'POST' && url.pathname === '/ownership/transfer') {
+                await this.ownershipAction(req, res, 'transfer');
+                return;
+            }
+            if (req.method === 'GET' && url.pathname === '/ownership/status') {
+                await this.ownershipStatus(url, res);
+                return;
+            }
+            if (req.method === 'GET' && url.pathname === '/ownership/events') {
+                sendJson(res, 200, { ok: true, events: this.ownershipEvents });
+                return;
+            }
             if (req.method === 'POST' && url.pathname === '/send') {
                 await this.send(req, res);
                 return;
@@ -496,6 +650,10 @@ class CrossSdkTsAgent {
                 await this.pull(req, res);
                 return;
             }
+            if (req.method === 'POST' && url.pathname === '/message/call') {
+                await this.messageCall(req, res);
+                return;
+            }
             if (req.method === 'GET' && url.pathname === '/sync/state') {
                 this.syncState(url, res);
                 return;
@@ -721,6 +879,39 @@ class CrossSdkTsAgent {
             });
         }
     }
+    async messageCall(req, res) {
+        const body = await readJson(req);
+        const traceId = textOf(body.trace_id || crypto.randomUUID().replace(/-/g, ''));
+        const method = textOf(body.method).trim();
+        const params = jsonObjectOf(body.params) ?? {};
+        if (!method) {
+            sendJson(res, 400, { ok: false, trace_id: traceId, error_code: 'bad_request', error_message: 'method is required' });
+            return;
+        }
+        try {
+            let result;
+            if (method === 'message.read')
+                result = await this.client.message.read(params);
+            else if (method === 'message.read_state')
+                result = await this.client.message.readState(params);
+            else
+                result = await this.client.call(method, params);
+            const response = { ok: true, trace_id: traceId, method, result: jsonSafe(result) };
+            this.recordTrace(traceId, { stage: 'message_call', method, result: response });
+            sendJson(res, 200, response);
+        }
+        catch (err) {
+            const error = {
+                ok: false,
+                trace_id: traceId,
+                method,
+                error_code: err instanceof Error ? err.name : 'Error',
+                error_message: err instanceof Error ? err.message : String(err),
+            };
+            this.recordTrace(traceId, { stage: 'message_call_error', method, error });
+            sendJson(res, 500, error);
+        }
+    }
     syncNamespace(scope, groupId = '') {
         if (scope === 'p2p')
             return `p2p:${this.aid}`;
@@ -940,6 +1131,76 @@ class CrossSdkTsAgent {
             store.close();
         }
     }
+    async orgProtocol(params) {
+        const op = textOf(params.op);
+        const now = Math.floor(Date.now() / 1000);
+        if (op === 'request')
+            return buildRequestBinding(textOf(params.method), textOf(params.target), params.params, textOf(params.credential_cid), textOf(params.nonce), textOf(params.request_id), now, now + 300);
+        if (['register', 'sign', 'certificate', 'create'].includes(op)) {
+            const store = this.aidStore();
+            try {
+                if (op === 'register') {
+                    const registered = await store.register(textOf(params.org_id), { type: 'org', owner: this.aid, exttype: 'company' });
+                    if (!registered.ok)
+                        throw new Error(String(registered.error));
+                }
+                const loaded = op === 'certificate'
+                    ? await store.resolve(textOf(params.as_aid), { skipAgentMd: true })
+                    : (params.as_aid || params.org_id) ? store.load(textOf(params.as_aid ?? params.org_id)) : null;
+                if (loaded && !loaded.ok)
+                    throw new Error(String(loaded.error));
+                const identity = loaded?.data?.aid ?? this.client.currentAid;
+                const result = { cert_fingerprint: identity.certFingerprint, certificate: identity.certPem };
+                if (op === 'sign') {
+                    const signed = await identity.sign(Buffer.from(canonicalJson(params.payload)));
+                    if (!signed.ok)
+                        throw new Error(String(signed.error));
+                    result.signature = { cert_fingerprint: identity.certFingerprint, timestamp: now, signature: signed.data.signature };
+                }
+                else if (op === 'create') {
+                    result.credential = params.membership_binding
+                        ? this.client.org.member.createCredential(params.membership_binding, identity, params.options)
+                        : this.client.credential.create(params.options, identity);
+                }
+                return result;
+            }
+            finally {
+                store.close();
+            }
+        }
+        const value = params.document ?? params.payload;
+        const result = { canonical: new TextDecoder().decode(canonicalJson(value)), digest: digest(value), error_code: '' };
+        if (op === 'verify' || op === 'verify_full') {
+            const certificates = params.certificates;
+            const resolver = (fingerprint) => certificates[fingerprint];
+            try {
+                if (op === 'verify_full') {
+                    const actual = jsonObjectOf(params.context) ?? params;
+                    const memberships = jsonObjectOf(params.memberships) ?? {};
+                    result.verification = { ...this.client.credential.verify(value, { resolveCertificate: resolver, resolveActorCertificate: resolver,
+                            resolveStatus: (cid) => params.statuses?.[cid], now, audience: textOf(actual.audience), subject: textOf(actual.subject) || undefined,
+                            ns: textOf(actual.ns), action: textOf(actual.action), resource: textOf(actual.resource), rootIssuer: textOf(actual.root_issuer) || undefined,
+                            params: jsonObjectOf(actual.params) ?? {}, units: jsonObjectOf(actual.units) ?? {}, clientIp: textOf(actual.client_ip), method: textOf(actual.method), target: textOf(actual.target),
+                            requestId: textOf(actual.request_id), nonce: textOf(actual.nonce), requestBinding: actual.request_binding, proofChain: actual.proof_chain, membershipBinding: actual.membership_binding,
+                            orgSigner: textOf(actual.org_signer) || undefined, actor: textOf(actual.actor) || undefined, for: textOf(actual.for) || undefined, representationProof: actual.representation_proof,
+                            resolveMembershipStatus: (binding, credential) => { const current = jsonObjectOf(memberships[String(binding.membership_id)]); return current?.status === 'active' && current.credential_cid === credential.cid; },
+                            resolveOwnership: (subject, owner) => (jsonObjectOf(params.ownerships) ?? {})[subject] === owner, checkRateLimit: () => params.rate_limit_allowed === true }) };
+                }
+                else if (params.kind === 'credential')
+                    result.verification = { ...this.client.credential.verifySignature(value, resolver, now, textOf(params.audience)) };
+                else if (params.kind === 'binding')
+                    await verifyMembershipBinding(value, resolver, now, textOf(params.expected_org_signer));
+                else
+                    result.verification = { ...this.client.credential.verifyRegistrationReceipt(value, params.credential, params.request, resolver, textOf(params.service_aid), now) };
+            }
+            catch (error) {
+                if (!(error instanceof ProtocolError))
+                    throw error;
+                result.error_code = error.code;
+            }
+        }
+        return result;
+    }
     async groupCall(req, res) {
         const body = await readJson(req);
         const traceId = textOf(body.trace_id || crypto.randomUUID().replace(/-/g, ''));
@@ -955,6 +1216,48 @@ class CrossSdkTsAgent {
         try {
             let result;
             switch (method) {
+                case 'sdk.org.protocol':
+                    result = await this.orgProtocol(params);
+                    break;
+                case 'org.lifecycle.create':
+                    result = await this.client.org.lifecycle.create(params);
+                    break;
+                case 'org.lifecycle.dissolve':
+                    result = await this.client.org.lifecycle.dissolve(params);
+                    break;
+                case 'org.lifecycle.transfer':
+                    result = await this.client.org.lifecycle.transfer(params);
+                    break;
+                case 'org.lifecycle.transferAccept':
+                    result = await this.client.org.lifecycle.transferAccept(params);
+                    break;
+                case 'org.member.join':
+                    result = await this.client.org.member.join(params);
+                    break;
+                case 'org.member.approveJoin':
+                    result = await this.client.org.member.approveJoin(params);
+                    break;
+                case 'org.member.rejectJoin':
+                    result = await this.client.org.member.rejectJoin(params);
+                    break;
+                case 'org.member.invite':
+                    result = await this.client.org.member.invite(params);
+                    break;
+                case 'org.member.inviteAccept':
+                    result = await this.client.org.member.inviteAccept(params);
+                    break;
+                case 'org.member.inviteReject':
+                    result = await this.client.org.member.inviteReject(params);
+                    break;
+                case 'org.member.leave':
+                    result = await this.client.org.member.leave(params);
+                    break;
+                case 'org.member.offboard':
+                    result = await this.client.org.member.offboard(params);
+                    break;
+                case 'org.credential.getStatus':
+                    result = await this.client.org.credential.getStatus(params);
+                    break;
                 case 'sdk.update_group_index':
                     result = await this.client.group.updateGroupIndex(params);
                     break;
@@ -988,6 +1291,12 @@ class CrossSdkTsAgent {
                 case 'group.get_member_statuses':
                     result = await this.client.group.getMemberStatuses(params);
                     break;
+                case 'group.read':
+                    result = await this.client.group.read(params);
+                    break;
+                case 'group.read_state':
+                    result = await this.client.group.readState(params);
+                    break;
                 default: result = await this.client.call(method, params);
             }
             const response = { ok: true, trace_id: traceId, method, result: jsonSafe(result) };
@@ -1750,6 +2059,27 @@ class CrossSdkTsAgent {
             '',
         ].join('\n');
     }
+    agentMdContentForUpload(aid, name, type, description) {
+        let content = '';
+        try {
+            const manager = this.client._agentMdManager;
+            const managed = manager?.readContent?.(aid);
+            content = typeof managed === 'string' ? managed : '';
+        }
+        catch {
+            content = '';
+        }
+        if (content && (content.includes('owner:') || content.includes('ownership_proof:') || content.includes('ownership_release:')))
+            return content;
+        try {
+            content = fs.readFileSync(path.join(this.aunPath, 'AIDs', aid, 'agent.md'), 'utf-8');
+            if (content.includes('owner:') || content.includes('ownership_proof:') || content.includes('ownership_release:'))
+                return content;
+        }
+        catch {
+        }
+        return this.agentMdContent(aid, name, type, description);
+    }
     aidStore() {
         return new AIDStore({
             aunPath: this.aunPath,
@@ -1834,5 +2164,6 @@ async function main() {
     process.on('SIGINT', () => { void shutdown(); });
     process.on('SIGTERM', () => { void shutdown(); });
 }
-void main();
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url))
+    void main();
 //# sourceMappingURL=cross-sdk-agent.js.map