@awiki/dsh-pap 0.0.0-stage → 0.1.0

package/lib/callback-handoff.d.ts

@@ -0,0 +1,55 @@
+import type { CallbackHandoff } from './host.js';
+export interface CallbackRegistration {
+    transaction_id: string;
+    client_id: string;
+    issuer: string;
+    redirect_uri: string;
+    state_sha256: string;
+    claim_sha256: string;
+    expires_at: string;
+}
+export interface CallbackClaim {
+    transaction_id: string;
+    claim_secret: string;
+}
+export interface CallbackRegistrationResult {
+    transaction_id: string;
+    callback_uri: string;
+    expires_at: string;
+}
+export type CallbackClaimResult = {
+    state: string;
+    iss: string;
+    code: string;
+    error?: never;
+} | {
+    state: string;
+    iss: string;
+    error: string;
+    code?: never;
+};
+export interface RegisterCallbackOperation {
+    action: 'pap-callback-register';
+    operationId: string;
+    callback: CallbackRegistration;
+}
+export interface ClaimCallbackOperation {
+    action: 'pap-callback-claim';
+    operationId: string;
+    callback: CallbackClaim;
+}
+export type CallbackManagementOperation = RegisterCallbackOperation | ClaimCallbackOperation;
+export interface DeviceManagementOperations {
+    /** The authenticated C Host driver supplies checkpoint/device proof and only the two fixed B routes. */
+    execute(input: RegisterCallbackOperation): Promise<CallbackRegistrationResult>;
+    execute(input: ClaimCallbackOperation): Promise<CallbackClaimResult>;
+}
+/** Fixed B callback relay, with an independent pickup secret. callbackRef is encrypted by PapStore. */
+export declare class DeviceCallbackHandoff implements CallbackHandoff {
+    private readonly management;
+    constructor(management: DeviceManagementOperations);
+    register(input: Parameters<CallbackHandoff['register']>[0]): Promise<{
+        callbackRef: string;
+    }>;
+    collect(callbackRef: string): ReturnType<CallbackHandoff['collect']>;
+}

package/lib/callback-handoff.js

@@ -0,0 +1,33 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { PapError, requirePap } from './errors.js';
+const hex = (value) => createHash('sha256').update(value, 'utf8').digest('hex');
+/** Fixed B callback relay, with an independent pickup secret. callbackRef is encrypted by PapStore. */
+export class DeviceCallbackHandoff {
+    management;
+    constructor(management) {
+        this.management = management;
+    }
+    async register(input) {
+        const claimSecret = randomBytes(32).toString('base64url');
+        const registration = {
+            transaction_id: input.transactionId, client_id: input.clientId, issuer: input.issuer, redirect_uri: input.redirectUri,
+            state_sha256: hex(input.state), claim_sha256: hex(claimSecret), expires_at: new Date(input.expiresAt).toISOString().replace(/\.\d{3}Z$/, 'Z'),
+        };
+        const response = await this.management.execute({ action: 'pap-callback-register', operationId: `register_${input.transactionId}`, callback: registration });
+        requirePap(response.transaction_id === input.transactionId && response.callback_uri === input.redirectUri, 'invalid_authorization_response');
+        return { callbackRef: JSON.stringify({ transactionId: input.transactionId, claimSecret, expiresAt: input.expiresAt }) };
+    }
+    async collect(callbackRef) {
+        let reference;
+        try {
+            reference = JSON.parse(callbackRef);
+        }
+        catch {
+            throw new PapError('invalid_authorization_response');
+        }
+        requirePap(typeof reference.transactionId === 'string' && typeof reference.claimSecret === 'string' && /^[A-Za-z0-9_-]{43}$/.test(reference.claimSecret) && reference.expiresAt > Date.now(), 'invalid_authorization_response');
+        const response = await this.management.execute({ action: 'pap-callback-claim', operationId: `claim_${reference.transactionId}`, callback: { transaction_id: reference.transactionId, claim_secret: reference.claimSecret } });
+        requirePap(typeof response.state === 'string' && typeof response.iss === 'string' && ((typeof response.code === 'string' && !response.error) || (typeof response.error === 'string' && !response.code)), 'invalid_authorization_response');
+        return { state: response.state, iss: response.iss, code: response.code, error: response.error };
+    }
+}

package/lib/client/controller.d.ts

@@ -0,0 +1,107 @@
+import { z } from 'zod';
+import type { PapManagementRequest } from '../product-api.js';
+declare const reference: z.ZodObject<{
+    storeId: z.ZodString;
+    identityId: z.ZodString;
+    did: z.ZodString;
+}, z.core.$strip>;
+declare const status: z.ZodObject<{
+    state: z.ZodString;
+    error: z.ZodOptional<z.ZodString>;
+    identity: z.ZodOptional<z.ZodObject<{
+        storeId: z.ZodString;
+        identityId: z.ZodString;
+        did: z.ZodString;
+    }, z.core.$strip>>;
+    companies: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        companyRef: z.ZodString;
+        name: z.ZodString;
+        authMode: z.ZodEnum<{
+            no_as: "no_as";
+            account: "account";
+            disabled: "disabled";
+        }>;
+        scopes: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>>;
+    sessions: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        sessionRef: z.ZodString;
+        companyRef: z.ZodOptional<z.ZodString>;
+        connected: z.ZodBoolean;
+        account: z.ZodBoolean;
+        accountSlot: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    accounts: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        accountSlot: z.ZodString;
+        companyRef: z.ZodOptional<z.ZodString>;
+        status: z.ZodString;
+        scopes: z.ZodArray<z.ZodString>;
+        canRefresh: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+    pendingSignIns: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        transactionRef: z.ZodString;
+        accountSlot: z.ZodString;
+        companyRef: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodNumber;
+    }, z.core.$strip>>>;
+    authenticationHints: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        operationRef: z.ZodString;
+        scheme: z.ZodEnum<{
+            Bearer: "Bearer";
+            DPoP: "DPoP";
+        }>;
+        scope: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        resourceMetadataUrl: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+declare const operation: z.ZodObject<{
+    operationRef: z.ZodString;
+    companyRef: z.ZodString;
+    method: z.ZodString;
+    path: z.ZodString;
+    enabled: z.ZodBoolean;
+    account: z.ZodBoolean;
+}, z.core.$strip>;
+export interface UserPapRemote {
+    status(): Promise<any>;
+    operations(): Promise<any>;
+    manage(input: PapManagementRequest): Promise<any>;
+}
+export interface PublicIdentityRemote {
+    listIdentities(): Promise<any>;
+    publicationStatus(identity: z.infer<typeof reference>): Promise<any>;
+}
+export interface SettingsView {
+    status: z.infer<typeof status>;
+    operations: z.infer<typeof operation>[];
+    identities: {
+        reference: z.infer<typeof reference>;
+        label: string;
+    }[];
+    loading: boolean;
+    pending: boolean;
+    waitingIdentity: boolean;
+    error: string | null;
+    authorization: {
+        transactionRef: string;
+        url: string;
+    } | null;
+}
+export declare const identityKey: (value: z.infer<typeof reference>) => string;
+export declare class PapSettingsController {
+    private readonly remotes;
+    private view;
+    private readonly listeners;
+    private disposed;
+    private refreshing;
+    constructor(remotes: () => {
+        pap?: UserPapRemote;
+        identities?: PublicIdentityRemote;
+    });
+    getSnapshot: () => SettingsView;
+    subscribe: (listener: () => void) => () => void;
+    private patch;
+    dispose(): void;
+    refresh(): Promise<void>;
+    execute(input: PapManagementRequest): Promise<void>;
+}
+export {};

package/lib/client/controller.js

@@ -0,0 +1,106 @@
+import { z } from 'zod';
+const reference = z.object({ storeId: z.string(), identityId: z.string(), did: z.string() });
+const company = z.object({ companyRef: z.string(), name: z.string(), authMode: z.enum(['no_as', 'account', 'disabled']), scopes: z.array(z.string()) });
+const session = z.object({ sessionRef: z.string(), companyRef: z.string().optional(), connected: z.boolean(), account: z.boolean(), accountSlot: z.string().optional() });
+const account = z.object({ accountSlot: z.string(), companyRef: z.string().optional(), status: z.string(), scopes: z.array(z.string()), canRefresh: z.boolean().default(false) });
+const pending = z.object({ transactionRef: z.string(), accountSlot: z.string(), companyRef: z.string().optional(), expiresAt: z.number() });
+const hint = z.object({ operationRef: z.string(), scheme: z.enum(['Bearer', 'DPoP']), scope: z.array(z.string()).optional(), resourceMetadataUrl: z.string().optional() });
+const status = z.object({ state: z.string(), error: z.string().optional(), identity: reference.optional(), companies: z.array(company).default([]), sessions: z.array(session).default([]), accounts: z.array(account).default([]), pendingSignIns: z.array(pending).default([]), authenticationHints: z.array(hint).default([]) });
+const operation = z.object({ operationRef: z.string(), companyRef: z.string(), method: z.string(), path: z.string(), enabled: z.boolean(), account: z.boolean() });
+const messages = {
+    credential_history_incomplete: '旧账户凭据历史不完整。请先处理原账户并由受信管理核验，不能继续提供给 Agent。',
+    not_configured: '请先在 Host 配置中启用 PAP，并指定已批准的身份政策。', credential_unavailable: '受保护凭据暂不可用，请检查系统秘密存储后重试。',
+    permission_denied: '当前操作未获允许，请检查身份、连接与权限。', consumer_forbidden: 'PAP 身份许可暂不可用。', provider_disposed: '身份服务已更新，请重新选择身份。',
+    not_published: '请先在身份设置中完成注册和发布。', unsupported_sign_in: '此 Company 当前不支持发起账户登录。', insufficient_scope: '请选择此 Company 提供的账户权限。',
+    callback_not_ready: '浏览器登录尚未完成，请完成后再次领取。', callback_claimed: '该登录结果已领取，请刷新状态或重新发起。', callback_expired: '登录已过期，请重新发起。',
+    reauthorization_required: '账户需要重新登录。', revocation_pending: '本地已停止账户使用，远端撤销仍待确认。', state_conflict: '连接状态已变化，请刷新后重试。',
+    disconnected: '连接已停止，请刷新状态。', request_uncertain: '请求结果不确定，请先确认远端状态。', rate_limited: '请求暂受限，请稍后重试。',
+};
+class SafeMessage extends Error {
+    displayText;
+    constructor(displayText) {
+        super('PAP user operation unavailable');
+        this.displayText = displayText;
+    }
+}
+function unwrap(response) {
+    if (!response || response.ok !== true || !response.value)
+        throw new SafeMessage('等待 PAP Host 服务，请连接后刷新。');
+    if (response.value.ok !== true)
+        throw new SafeMessage(messages[response.value.error?.code] ?? '操作暂不可用，请刷新状态后重试。');
+    return response.value.value;
+}
+export const identityKey = (value) => JSON.stringify([value.storeId, value.identityId, value.did]);
+export class PapSettingsController {
+    remotes;
+    view = { status: { state: 'waiting', companies: [], sessions: [], accounts: [], pendingSignIns: [], authenticationHints: [] }, operations: [], identities: [], loading: true, pending: false, waitingIdentity: true, error: null, authorization: null };
+    listeners = new Set();
+    disposed = false;
+    refreshing = false;
+    constructor(remotes) {
+        this.remotes = remotes;
+    }
+    getSnapshot = () => this.view;
+    subscribe = (listener) => { this.listeners.add(listener); return () => { this.listeners.delete(listener); }; };
+    patch(value) { if (this.disposed)
+        return; this.view = { ...this.view, ...value }; for (const listener of this.listeners)
+        listener(); }
+    dispose() { this.disposed = true; this.listeners.clear(); this.view.authorization = null; }
+    async refresh() {
+        if (this.refreshing || this.disposed)
+            return;
+        this.refreshing = true;
+        try {
+            const remote = this.remotes();
+            if (!remote.pap)
+                throw new SafeMessage('等待 PAP Host 服务，请连接后刷新。');
+            const snapshot = status.parse(unwrap(await remote.pap.status()));
+            const operations = snapshot.state === 'ready' ? z.array(operation).parse(unwrap(await remote.pap.operations())) : [];
+            let identities = [];
+            let waitingIdentity = true;
+            if (remote.identities)
+                try {
+                    const result = await remote.identities.listIdentities();
+                    if (result?.ok && Array.isArray(result.value)) {
+                        const candidates = result.value.flatMap((item) => { const parsed = z.object({ reference, label: z.string().optional(), handle: z.string().optional(), catalogState: z.string() }).safeParse(item); return parsed.success && parsed.data.catalogState === 'active' ? [{ reference: parsed.data.reference, label: parsed.data.label ?? parsed.data.handle ?? parsed.data.reference.did }] : []; });
+                        identities = (await Promise.all(candidates.map(async (item) => { const publication = await remote.identities.publicationStatus(item.reference); return publication?.ok && publication.value?.state === 'published' && publication.value.capabilities?.papSession === true ? item : undefined; }))).filter((item) => Boolean(item));
+                        waitingIdentity = false;
+                    }
+                }
+                catch { }
+            this.patch({ status: snapshot, operations, identities, waitingIdentity, loading: false, error: null,
+                ...(this.view.authorization && !snapshot.pendingSignIns.some(item => item.transactionRef === this.view.authorization.transactionRef) ? { authorization: null } : {}) });
+        }
+        catch (error) {
+            this.patch({ loading: false, authorization: null, error: error instanceof SafeMessage ? error.displayText : 'PAP 状态暂不可用，请刷新后重试。' });
+        }
+        finally {
+            this.refreshing = false;
+        }
+    }
+    async execute(input) {
+        if (this.view.pending || this.disposed)
+            return;
+        this.patch({ pending: true, error: null, ...(input.action === 'identity/select' ? { authorization: null } : {}) });
+        try {
+            const remote = this.remotes().pap;
+            if (!remote)
+                throw new SafeMessage('等待 PAP Host 服务，请连接后刷新。');
+            const value = unwrap(await remote.manage(input));
+            if (input.action === 'account/sign-in') {
+                const result = z.object({ transactionRef: z.string(), authorizationUrl: z.string() }).parse(value);
+                const url = new URL(result.authorizationUrl);
+                if (url.protocol !== 'https:' || url.username || url.password || url.hash)
+                    throw new SafeMessage('登录链接暂不可用，请重新发起。');
+                this.patch({ authorization: { transactionRef: result.transactionRef, url: url.href } });
+            }
+            await this.refresh();
+        }
+        catch (error) {
+            this.patch({ error: error instanceof SafeMessage ? error.displayText : 'PAP 操作暂不可用，请刷新后重试。' });
+        }
+        finally {
+            this.patch({ pending: false });
+        }
+    }
+}

package/lib/client/index.d.ts

@@ -0,0 +1,6 @@
+import type { Context } from '@deepseek-ai/cordis';
+import { PapSettingsController } from './controller.js';
+import { PapSettings } from './views.js';
+export declare const inject: string[];
+export declare function apply(ctx: Context): Promise<() => Promise<void>>;
+export { PapSettingsController, PapSettings };

package/lib/client/index.js

@@ -0,0 +1,28 @@
+import contribution from '../remote.js';
+import { PapSettingsController } from './controller.js';
+import { PapSettings } from './views.js';
+export const inject = ['slots', 'remote', 'connection'];
+export async function apply(ctx) {
+    let unmount;
+    try {
+        unmount = await ctx.remote.$mount(contribution);
+    }
+    catch { }
+    const controller = new PapSettingsController(() => {
+        const identities = ctx.get('remote.anpIdentityManager');
+        return { pap: ctx.get('remote.papManager'),
+            identities: identities ? { listIdentities: () => identities.listIdentities(), publicationStatus: reference => identities.publicationStatus(reference) } : undefined };
+    });
+    let unregister;
+    try {
+        unregister = ctx.slots.inject('settings.section', () => ctx.slots.register({ name: 'settings.section', id: 'pap-companies', label: 'PAP 连接', order: 45, inject: () => ({ controller }) }, PapSettings));
+        void controller.refresh();
+    }
+    catch (error) {
+        controller.dispose();
+        await unmount?.();
+        throw error;
+    }
+    return async () => { controller.dispose(); unregister(); await unmount?.(); };
+}
+export { PapSettingsController, PapSettings };

package/lib/client/views.d.ts

@@ -0,0 +1,5 @@
+import { type ReactNode } from 'react';
+import { PapSettingsController } from './controller.js';
+export declare function PapSettings({ controller }: {
+    controller: PapSettingsController;
+}): ReactNode;

package/lib/client/views.js

@@ -0,0 +1,28 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useState, useSyncExternalStore } from 'react';
+import { PapSettingsController, identityKey } from './controller.js';
+const stateNames = { disabled: '未启用', unconfigured: '未配置身份', credential_unavailable: '受保护凭据不可用', migration_required: '旧凭据历史需要管理处理', ready: '可用', waiting: '等待 Host' };
+function httpsLink(value) { try {
+    const url = new URL(value ?? '');
+    return url.protocol === 'https:' && !url.username && !url.password && !url.hash ? url.href : undefined;
+}
+catch {
+    return undefined;
+} }
+export function PapSettings({ controller }) {
+    const view = useSyncExternalStore(controller.subscribe, controller.getSnapshot, controller.getSnapshot);
+    const [identity, setIdentity] = useState('');
+    const [domain, setDomain] = useState('');
+    const busy = view.pending || view.loading;
+    const run = (input) => { void controller.execute(input); };
+    return _jsxs("section", { "aria-label": "PAP \u8BBE\u7F6E", style: { display: 'grid', gap: 12, maxWidth: 960 }, children: [_jsx("h2", { children: "PAP Company \u8FDE\u63A5" }), _jsxs("p", { role: "status", children: ["\u72B6\u6001\uFF1A", stateNames[view.status.state] ?? '暂不可用'] }), _jsx("p", { children: "\u5148\u9009\u62E9\u5DF2\u53D1\u5E03\u8EAB\u4EFD\uFF0C\u518D\u53D1\u73B0 Company \u5E76\u5EFA\u7ACB\u8FDE\u63A5\u3002\u53EA\u6709\u4F60\u660E\u786E\u5141\u8BB8\u7684\u64CD\u4F5C\u4F1A\u63D0\u4F9B\u7ED9 Agent\u3002" }), _jsx("button", { disabled: busy, onClick: () => { void controller.refresh(); }, children: "\u5237\u65B0\u72B6\u6001" }), view.error && _jsx("p", { role: "alert", children: view.error }), view.status.authenticationHints.map(hint => _jsxs("p", { role: "status", children: ["\u8BE5\u64CD\u4F5C\u9700\u8981\u68C0\u67E5\u8D26\u6237\u6743\u9650\uFF1A", hint.scope?.join('、') ?? '请检查当前账户授权', " ", httpsLink(hint.resourceMetadataUrl) && _jsx("a", { href: httpsLink(hint.resourceMetadataUrl), target: "_blank", rel: "noopener noreferrer", children: "\u67E5\u770B\u8D44\u6E90\u6388\u6743\u8BF4\u660E" })] }, hint.operationRef)), view.status.state === 'disabled' && _jsx("p", { children: "\u8BF7\u5148\u5728 Host \u914D\u7F6E\u4E2D\u542F\u7528 PAP\uFF0C\u5E76\u914D\u7F6E\u5DF2\u6279\u51C6\u7684\u8EAB\u4EFD\u653F\u7B56\u3002" }), view.status.state === 'migration_required' && _jsxs("div", { children: [_jsx("p", { children: "\u65E7\u8D26\u6237\u51ED\u636E\u5386\u53F2\u4E0D\u5B8C\u6574\uFF0CAgent \u64CD\u4F5C\u5DF2\u505C\u6B62\u3002\u9000\u51FA\u5F53\u524D\u8D26\u6237\u4E0D\u4F1A\u8BC1\u660E\u5168\u90E8\u65E7\u51ED\u636E\u5DF2\u5931\u6548\uFF1B\u8BF7\u4FDD\u7559\u52A0\u5BC6\u72B6\u6001\uFF0C\u7531\u53D7\u4FE1\u7BA1\u7406\u6838\u9A8C\u5168\u90E8\u65E7\u51ED\u636E\u64A4\u9500\u540E\u5904\u7406\u3002" }), view.status.accounts.map(account => _jsxs("p", { children: ["\u8D26\u6237 ", account.accountSlot.slice(-8), " \u00B7 ", account.status, " ", _jsx("button", { disabled: busy || account.status === 'signed_out', onClick: () => run({ action: 'account/sign-out', accountSlot: account.accountSlot }), children: "\u64A4\u9500\u5F53\u524D\u8D26\u6237" })] }, account.accountSlot))] }), view.waitingIdentity && _jsx("p", { role: "status", children: "\u7B49\u5F85\u8EAB\u4EFD\u7BA1\u7406\u670D\u52A1\u3002\u8BF7\u5148\u5728\u201C\u8EAB\u4EFD\u201D\u8BBE\u7F6E\u4E2D\u5B8C\u6210\u6CE8\u518C\u548C\u53D1\u5E03\uFF0C\u518D\u5237\u65B0\u3002" }), !view.waitingIdentity && view.identities.length === 0 && _jsx("p", { children: "\u6682\u65E0\u652F\u6301 PAP Session \u7684\u5DF2\u53D1\u5E03\u8EAB\u4EFD\uFF0C\u8BF7\u5148\u5728\u201C\u8EAB\u4EFD\u201D\u8BBE\u7F6E\u4E2D\u5B8C\u6210\u53D1\u5E03\u3002" }), _jsxs("form", { onSubmit: event => { event.preventDefault(); const selected = view.identities.find(item => identityKey(item.reference) === identity); if (selected)
+                    run({ action: 'identity/select', reference: selected.reference }); }, children: [_jsxs("label", { children: ["\u5DF2\u53D1\u5E03\u8EAB\u4EFD ", _jsxs("select", { "aria-label": "PAP \u8EAB\u4EFD", value: identity, disabled: busy || view.status.state === 'disabled', onChange: event => setIdentity(event.target.value), children: [_jsx("option", { value: "", children: "\u8BF7\u9009\u62E9\u8EAB\u4EFD" }), view.identities.map(item => _jsx("option", { value: identityKey(item.reference), children: item.label }, identityKey(item.reference)))] })] }), _jsx("button", { disabled: busy || !identity || view.status.state === 'disabled', children: "\u4F7F\u7528\u6B64\u8EAB\u4EFD" })] }), _jsxs("form", { onSubmit: event => { event.preventDefault(); run({ action: 'company/discover', domain: domain.trim() }); }, children: [_jsxs("label", { children: ["Company \u57DF\u540D ", _jsx("input", { "aria-label": "Company \u57DF\u540D", value: domain, placeholder: "company.example", onChange: event => setDomain(event.target.value), disabled: busy || view.status.state !== 'ready' })] }), _jsx("button", { disabled: busy || !domain.trim() || view.status.state !== 'ready', children: "\u53D1\u73B0 Company" })] }), view.status.companies.map(company => _jsxs("article", { style: { border: '1px solid #8885', padding: 12 }, children: [_jsx("h3", { children: company.name }), _jsx("p", { children: company.authMode === 'no_as' ? '无需账户即可使用 Session' : company.authMode === 'disabled' ? '暂停新账户登录，已有账户按授权继续使用' : '支持独立账户登录' }), _jsx("button", { disabled: busy, onClick: () => run({ action: 'session/connect', companyRef: company.companyRef }), children: "\u5EFA\u7ACB\u672A\u767B\u5F55\u8FDE\u63A5" }), view.status.sessions.filter(session => session.companyRef === company.companyRef && session.connected).map(session => _jsxs("p", { children: [session.account ? '账户连接' : '未登录连接', " ", session.sessionRef.slice(-8), " ", _jsxs("button", { disabled: busy, onClick: () => run({ action: 'session/disconnect', sessionRef: session.sessionRef }), children: ["\u65AD\u5F00\u8FDE\u63A5 ", session.sessionRef.slice(-8)] })] }, session.sessionRef)), view.status.accounts.filter(account => account.companyRef === company.companyRef).map(account => _jsxs("div", { children: [_jsxs("span", { children: ["\u8D26\u6237 ", account.accountSlot.slice(-8), " \u00B7 ", account.status, " \u00B7 ", account.scopes.join('、')] }), account.status === 'active' && _jsx("button", { disabled: busy, onClick: () => run({ action: 'session/connect', companyRef: company.companyRef, accountSlot: account.accountSlot }), children: "\u5EFA\u7ACB\u8D26\u6237\u8FDE\u63A5" }), account.status === 'active' && _jsx("button", { disabled: busy || !account.canRefresh, onClick: () => run({ action: 'account/refresh', accountSlot: account.accountSlot }), children: "\u5237\u65B0\u8D26\u6237" }), !['signed_out'].includes(account.status) && _jsx("button", { disabled: busy, onClick: () => run({ action: 'account/sign-out', accountSlot: account.accountSlot }), children: "\u9000\u51FA\u8D26\u6237" })] }, account.accountSlot)), view.operations.filter(operation => operation.companyRef === company.companyRef).map(operation => _jsx(Operation, { operation: operation, company: company, view: view, controller: controller }, operation.operationRef))] }, company.companyRef)), view.status.pendingSignIns.map(pending => _jsxs("div", { children: [_jsx("p", { children: "\u8D26\u6237\u767B\u5F55\u7B49\u5F85\u5B8C\u6210\u3002" }), view.authorization?.transactionRef === pending.transactionRef && _jsx("a", { href: view.authorization.url, target: "_blank", rel: "noopener noreferrer", children: "\u5728\u6D4F\u89C8\u5668\u4E2D\u5B8C\u6210\u8D26\u6237\u767B\u5F55" }), _jsx("button", { disabled: busy, onClick: () => run({ action: 'account/collect', transactionRef: pending.transactionRef }), children: "\u9886\u53D6\u767B\u5F55\u7ED3\u679C" }), _jsx("button", { disabled: busy, onClick: () => run({ action: 'account/sign-out', accountSlot: pending.accountSlot }), children: "\u53D6\u6D88\u8D26\u6237\u767B\u5F55" })] }, pending.transactionRef))] });
+}
+function Operation({ operation, company, view, controller }) {
+    const [sessionRef, setSession] = useState('');
+    const [scopes, setScopes] = useState([]);
+    const sessions = view.status.sessions.filter(session => session.companyRef === company.companyRef && session.connected);
+    const selected = sessions.find(session => session.sessionRef === sessionRef);
+    const busy = view.pending || view.loading;
+    return _jsxs("fieldset", { children: [_jsxs("legend", { children: [operation.method, " ", operation.path] }), _jsx("p", { children: operation.enabled ? '已允许 Agent 调用' : '未允许 Agent 调用' }), _jsxs("label", { children: ["\u64CD\u4F5C\u8FDE\u63A5 ", _jsxs("select", { "aria-label": `连接 ${operation.method} ${operation.path}`, value: sessionRef, onChange: event => setSession(event.target.value), disabled: busy, children: [_jsx("option", { value: "", children: "\u9009\u62E9\u8FDE\u63A5" }), sessions.map(session => _jsxs("option", { value: session.sessionRef, children: [session.account ? '账户' : '未登录', " ", session.sessionRef.slice(-8)] }, session.sessionRef))] })] }), !!company.scopes.length && _jsxs("div", { children: ["\u8D26\u6237\u6743\u9650 ", company.scopes.map(scope => _jsxs("label", { children: [_jsx("input", { type: "checkbox", checked: scopes.includes(scope), disabled: busy, onChange: event => setScopes(event.target.checked ? [...scopes, scope] : scopes.filter(item => item !== scope)) }), scope] }, scope))] }), _jsx("button", { disabled: busy || !selected, onClick: () => { void controller.execute({ action: 'operation/enable', operationRef: operation.operationRef, sessionRef, scopes: selected?.account ? scopes : [] }); }, children: "\u5141\u8BB8 Agent \u8C03\u7528" }), operation.enabled && _jsx("button", { disabled: busy, onClick: () => { void controller.execute({ action: 'operation/disable', operationRef: operation.operationRef }); }, children: "\u64A4\u9500\u64CD\u4F5C\u8BB8\u53EF" }), _jsx("button", { disabled: busy || !selected || scopes.length === 0 || company.authMode !== 'account', onClick: () => { void controller.execute({ action: 'account/sign-in', sessionRef, operationRef: operation.operationRef, scopes }); }, children: "\u53D1\u8D77\u8D26\u6237\u767B\u5F55" })] });
+}

package/lib/client.d.ts

@@ -0,0 +1,108 @@
+import type { CredentialObservation } from './credential-history.js';
+import type { PapHostOptions } from './host.js';
+import { PapStore } from './store.js';
+import type { Company, Grant, HttpResponse, HttpTransport, Operation, PapState } from './types.js';
+/** Same-process permission fence, never a wire input. */
+export interface PapDispatchControl {
+    signal?: AbortSignal;
+    assertAllowed?: (state: PapState) => void;
+    /** Host-only in-memory response redaction set; never register this callback on a wire surface. */
+    captureSecrets?: (values: readonly string[], credentials?: CredentialObservation) => void;
+}
+/** Host-only engine. UI receives safe summaries, never this object or signer capabilities. */
+export declare class PapClient {
+    private readonly options;
+    private readonly transport;
+    readonly store: PapStore;
+    private readonly discovery;
+    private readonly clock;
+    private closed;
+    private readonly discoveryFlights;
+    private readonly recentJtis;
+    private readonly cooldownWaiters;
+    private readonly refreshFlights;
+    private readonly abortedSessions;
+    constructor(options: PapHostOptions, transport: HttpTransport);
+    close(): void;
+    recover(): Promise<void>;
+    resolvePapCompany(domain: string): Promise<{
+        companyRef: string;
+        companyId: string;
+        name: string;
+        authMode: Company['authMode'];
+        scopes: string[];
+    }>;
+    getOrCreatePapUser(companyRef: string, mode?: 'regular' | 'anonymous', agent?: boolean): Promise<{
+        subjectRef: string;
+    }>;
+    openPapSession(subjectRef: string, accountSlot?: string): Promise<{
+        sessionRef: string;
+    }>;
+    private company;
+    private subject;
+    private sameUser;
+    private assertAccountEpoch;
+    private session;
+    private ensureCompanyFresh;
+    private lease;
+    private assertWaitActive;
+    private awaitCooldown;
+    rotateDelegation(subjectRef: string): Promise<void>;
+    private delegation;
+    private cleanupRetirements;
+    dispatchPap(sessionRef: string, operation: Operation, control?: PapDispatchControl): Promise<HttpResponse>;
+    private checkSessionJwt;
+    private saveNonce;
+    startSignIn(subjectRef: string, input: {
+        scopes: string[];
+        resource: string;
+        redirectUri: string;
+        callbackMode: 'handoff' | 'loopback';
+        method?: 'direct' | 'device';
+    }): Promise<{
+        transactionRef: string;
+        authorizationUrl: string;
+        accountSlot: string;
+    }>;
+    collectSignIn(transactionRef: string): Promise<{
+        grantRef: string;
+        accountSlot: string;
+    }>;
+    /** Called only by an authenticated Host callback listener or handoff, never an arbitrary model tool. */
+    completeSignIn(transactionRef: string, response: {
+        state?: string;
+        iss?: string;
+        code?: string;
+        error?: string;
+    }): Promise<{
+        grantRef: string;
+        accountSlot: string;
+    }>;
+    private parseGrant;
+    private tokenRequest;
+    refreshAccountGrant(grantRef: string, sessionRef?: string): Promise<void>;
+    private waitForRefresh;
+    private refresh;
+    signOutAccount(subjectRef: string, accountSlot: string): Promise<{
+        status: 'signed_out' | 'revocation_pending';
+    }>;
+    disconnectPap(sessionRef: string): Promise<void>;
+    getPapStatus(): Promise<{
+        companies: {
+            companyRef: string;
+            name: string;
+            authMode: Company['authMode'];
+        }[];
+        sessions: {
+            sessionRef: string;
+            connected: boolean;
+            account: boolean;
+        }[];
+        accounts: {
+            grantRef: string;
+            status: Grant['status'];
+            scopes: string[];
+        }[];
+        supportedSignIn: ['direct'];
+    }>;
+}