@downcity/city 0.2.205 → 0.2.211

package/bin/client/federation-admin.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Federation 全局控制面客户端。
+ *
+ * 该客户端承载 env、City、余额、模型和 Service 管理能力，不参与终端用户
+ * 或 Bureau 产品后端的请求链路。
+ */
+import { AdminPactAccess } from "../pact/admin/index.js";
+import type { ServiceClient } from "../pact/invoker/invoker.js";
+import type { AdminModelRecord, AdminServiceSummary } from "../pact/admin/types.js";
+import type { FederationAdminOptions } from "../types/FederationAdmin.js";
+/** Federation 全局控制面客户端。 */
+export declare class FederationAdmin {
+    private readonly admin_access;
+    constructor(options: FederationAdminOptions);
+    /** Federation 余额管理入口。 */
+    get balance(): AdminPactAccess["balance"];
+    /** Federation City 管理入口。 */
+    get cities(): AdminPactAccess["cities"];
+    /** Federation Bureau 注册表管理入口。 */
+    get bureaus(): AdminPactAccess["bureaus"];
+    /** Federation 环境变量管理入口。 */
+    get env(): AdminPactAccess["env"];
+    /** 获取管理身份下的 Service 调用器。 */
+    service(name: string): ServiceClient;
+    /** 列出 Federation 暴露的 Service。 */
+    listServices(): Promise<AdminServiceSummary[]>;
+    /** 列出 Federation 模型目录及管理状态。 */
+    listModels(): Promise<AdminModelRecord[]>;
+    /** 读取 Federation 聚合说明文档。 */
+    instruction(): Promise<string>;
+}
+//# sourceMappingURL=federation-admin.d.ts.map

package/bin/client/federation-admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation-admin.d.ts","sourceRoot":"","sources":["../../src/client/federation-admin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AACpF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAE1E,2BAA2B;AAC3B,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAkB;gBAEnC,OAAO,EAAE,sBAAsB;IAW3C,yBAAyB;IACzB,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,4BAA4B;IAC5B,IAAI,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,CAEtC;IAED,iCAAiC;IACjC,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,2BAA2B;IAC3B,IAAI,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAEhC;IAED,4BAA4B;IAC5B,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa;IAIpC,iCAAiC;IACjC,YAAY,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAI9C,+BAA+B;IAC/B,UAAU,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAIzC,4BAA4B;IAC5B,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;CAG/B"}

package/bin/client/federation-admin.js

@@ -0,0 +1,54 @@
+/**
+ * Federation 全局控制面客户端。
+ *
+ * 该客户端承载 env、City、余额、模型和 Service 管理能力，不参与终端用户
+ * 或 Bureau 产品后端的请求链路。
+ */
+import { AdminPactAccess } from "../pact/admin/index.js";
+/** Federation 全局控制面客户端。 */
+export class FederationAdmin {
+    admin_access;
+    constructor(options) {
+        if (!options || typeof options !== "object") {
+            throw new TypeError("FederationAdmin options are required");
+        }
+        this.admin_access = new AdminPactAccess({
+            base_url: options.federation_url,
+            admin_secret_key: options.admin_secret_key,
+            fetch: options.fetch,
+        });
+    }
+    /** Federation 余额管理入口。 */
+    get balance() {
+        return this.admin_access.balance;
+    }
+    /** Federation City 管理入口。 */
+    get cities() {
+        return this.admin_access.cities;
+    }
+    /** Federation Bureau 注册表管理入口。 */
+    get bureaus() {
+        return this.admin_access.bureaus;
+    }
+    /** Federation 环境变量管理入口。 */
+    get env() {
+        return this.admin_access.env;
+    }
+    /** 获取管理身份下的 Service 调用器。 */
+    service(name) {
+        return this.admin_access.service(name);
+    }
+    /** 列出 Federation 暴露的 Service。 */
+    listServices() {
+        return this.admin_access.listServices();
+    }
+    /** 列出 Federation 模型目录及管理状态。 */
+    listModels() {
+        return this.admin_access.listModels();
+    }
+    /** 读取 Federation 聚合说明文档。 */
+    instruction() {
+        return this.admin_access.instruction();
+    }
+}
+//# sourceMappingURL=federation-admin.js.map

package/bin/client/federation-admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation-admin.js","sourceRoot":"","sources":["../../src/client/federation-admin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAKzD,2BAA2B;AAC3B,MAAM,OAAO,eAAe;IACT,YAAY,CAAkB;IAE/C,YAAY,OAA+B;QACzC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,eAAe,CAAC;YACtC,QAAQ,EAAE,OAAO,CAAC,cAAc;YAChC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB;IACzB,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;IACnC,CAAC;IAED,4BAA4B;IAC5B,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;IAClC,CAAC;IAED,iCAAiC;IACjC,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;IACnC,CAAC;IAED,2BAA2B;IAC3B,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;IAC/B,CAAC;IAED,4BAA4B;IAC5B,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,iCAAiC;IACjC,YAAY;QACV,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC;IAC1C,CAAC;IAED,+BAA+B;IAC/B,UAAU;QACR,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;IACxC,CAAC;IAED,4BAA4B;IAC5B,WAAW;QACT,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;IACzC,CAAC;CACF"}

package/bin/client/types.d.ts

@@ -1,81 +1,21 @@
 /**
- * City 客户端构造类型模块。
+ * City 用户客户端构造类型模块。
  *
- * City 是访问 Federation 的统一客户端入口：开发者只需要声明访问角色，
- * SDK 会在内部选择 admin 或 user 能力面。底层 HTTP 协议实现位于 `pact/`。
+ * City 只表达终端用户访问 Federation。已登录身份和 city_id 均来自 user_token，
+ * Bureau 是可选产品后端，Federation 控制面由 FederationAdmin 独立提供。
  */
 import type { FetchLike } from "../pact/http.js";
-/**
- * City 访问角色。
- */
-export type CityRole = "admin" | "user";
-/**
- * City 客户端共享构造参数。
- */
-export interface CityBaseOptions {
-    /**
-     * Federation 的 HTTP 入口地址。
-     *
-     * 示例：`https://city.example.com`、`http://localhost:43127`
-     * 或本机 loopback HTTP：`http://127.0.0.1:15315`。
-     */
+/** City 用户客户端构造参数。 */
+export interface CityOptions {
+    /** Federation 的 HTTP 入口地址。 */
     federation_url: string;
     /**
-     * 自定义 fetch 实现。
-     *
-     * 主要用于测试、Worker 运行时适配，或在请求层注入日志与追踪。
-     */
-    fetch?: FetchLike;
-}
-/**
- * Admin 角色的 City 构造参数。
- */
-export interface AdminCityOptions extends CityBaseOptions {
-    /**
-     * 使用 admin 身份访问 Federation。
-     */
-    role: "admin";
-    /**
-     * 当前管理的 City ID。
+     * Federation 签发的终端用户 token。
      *
-     * token 签发等服务会自动使用该 ID，调用方无需再传 city_id。
-     */
-    city_id: string;
-    /**
-     * Federation 管理密钥。
-     *
-     * 未传入时会由 SDK 回退读取 `DOWNCITY_FEDERATION_ADMIN_SECRET_KEY`。
-     */
-    admin_secret_key?: string;
-}
-/**
- * User 角色的 City 构造参数。
- */
-export interface UserCityOptions extends CityBaseOptions {
-    /**
-     * 使用 user 身份访问 Federation。
-     */
-    role: "user";
-    /**
-     * 当前 user_token 绑定的 City ID。
-     *
-     * 普通 service action 调用会自动把该值注入为 `city_id`。
-     * AI 调用会优先使用 `user_token` 解析出的 City 身份。
-     */
-    city_id?: string;
-    /**
-     * 终端用户访问 token。
-     *
-     * 仅访问 public action（例如 accounts 本地登录）时可以暂不传。
+     * 访问 accounts 登录等公开 Action 时可以省略；受保护操作必须提供。
      */
     user_token?: string;
+    /** 自定义 fetch 实现。 */
+    fetch?: FetchLike;
 }
-/**
- * City 构造参数。
- */
-export type CityOptions = AdminCityOptions | UserCityOptions;
-/**
- * 按角色收窄后的 City 构造参数。
- */
-export type CityOptionsForRole<TRole extends CityRole> = TRole extends "admin" ? AdminCityOptions : UserCityOptions;
 //# sourceMappingURL=types.d.ts.map

package/bin/client/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/client/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAExC;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC;IAEvB;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD;;OAEG;IACH,IAAI,EAAE,OAAO,CAAC;IAEd;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACtD;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,gBAAgB,GAAG,eAAe,CAAC;AAE7D;;GAEG;AACH,MAAM,MAAM,kBAAkB,CAAC,KAAK,SAAS,QAAQ,IAAI,KAAK,SAAS,OAAO,GAC1E,gBAAgB,GAChB,eAAe,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/client/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,sBAAsB;AACtB,MAAM,WAAW,WAAW;IAC1B,8BAA8B;IAC9B,cAAc,EAAE,MAAM,CAAC;IAEvB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,oBAAoB;IACpB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB"}

package/bin/client/types.js

@@ -1,8 +1,8 @@
 /**
- * City 客户端构造类型模块。
+ * City 用户客户端构造类型模块。
  *
- * City 是访问 Federation 的统一客户端入口：开发者只需要声明访问角色，
- * SDK 会在内部选择 admin 或 user 能力面。底层 HTTP 协议实现位于 `pact/`。
+ * City 只表达终端用户访问 Federation。已登录身份和 city_id 均来自 user_token，
+ * Bureau 是可选产品后端，Federation 控制面由 FederationAdmin 独立提供。
  */
 export {};
 //# sourceMappingURL=types.js.map

package/bin/federation/auth/authenticator.d.ts

@@ -1,14 +1,17 @@
 /**
  * 统一鉴权模块。
  *
- * Authenticator 统一处理 admin（secret key）和 user（JWT token）两种鉴权方式。
+ * Authenticator 统一处理 admin（secret key）、bureau（不透明部署凭证）和
+ * user（Ed25519 JWT）三种鉴权方式。
  * 所有鉴权失败统一抛出 httpError（ErrorWithStatus）。
- *
- * TokenSigner 实例通过 getSigner() 缓存，避免重复 new TokenSigner(key)。
  */
 import { type RouteAuth, type RouteIdentity } from "../../service/service.js";
 import type { EnvProvider } from "../runtime.js";
-import type { CreateUserTokenInput, UserTokenPayload, UserTokenIssueResult, RuntimeUser } from "./types.js";
+import { type UserTokenAuthority } from "./user-token-authority.js";
+import type { FederationKeyStore } from "./federation-key-store.js";
+import type { BureauTokenStore } from "./bureau-token-store.js";
+import type { CreateUserTokenInput, FederationDiscovery, FederationJwks, UserTokenPayload, UserTokenIssueResult, RuntimeUser } from "./types.js";
+import type { RuntimeBureau } from "../../types/Bureau.js";
 import type { FederationTrustedIdentity } from "../types.js";
 /** 鉴权级别 */
 /** 鉴权结果 */
@@ -22,13 +25,16 @@ export interface AuthResult {
         city_id: string;
         status: string;
     };
+    /** 解析出的 Bureau 信息（bureau token 时可用）。 */
+    bureau?: RuntimeBureau;
 }
 /** 统一鉴权器 */
 export declare class Authenticator {
     private env;
     private store;
-    /** 缓存的 TokenSigner 实例 */
-    private tokenSigner?;
+    private readonly token_authority;
+    private readonly key_store;
+    private readonly bureau_token_store;
     constructor(env: EnvProvider, store: () => Promise<{
         city: {
             get(id: string): Promise<{
@@ -36,13 +42,7 @@ export declare class Authenticator {
                 status: string;
             } | undefined>;
         };
-    }>);
-    /**
-     * 获取（或创建）TokenSigner 单例。
-     *
-     * 首次调用时从 env 读取 DOWNCITY_FEDERATION_TOKEN_SIGNING_KEY 创建实例并缓存。
-     */
-    private getSigner;
+    }>, token_authority: UserTokenAuthority, key_store: FederationKeyStore, bureau_token_store: BureauTokenStore);
     /**
      * 解析请求身份。
      *
@@ -84,5 +84,9 @@ export declare class Authenticator {
      * @returns 解析出的 token 载荷
      */
     verifyToken(token: string): Promise<UserTokenPayload>;
+    /** 返回 Federation 当前可公开使用的 JWKS。 */
+    get_public_jwks(): Promise<FederationJwks>;
+    /** 根据当前请求 origin 生成 Federation 发现信息。 */
+    get_discovery(origin: string): FederationDiscovery;
 }
 //# sourceMappingURL=authenticator.d.ts.map

package/bin/federation/auth/authenticator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authenticator.d.ts","sourceRoot":"","sources":["../../../src/federation/auth/authenticator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAsB,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAClG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC5G,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7D,WAAW;AACX,WAAW;AACX,MAAM,WAAW,UAAU;IACzB,eAAe;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,2BAA2B;IAC3B,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,+BAA+B;IAC/B,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED,YAAY;AACZ,qBAAa,aAAa;IAKtB,OAAO,CAAC,GAAG;IACX,OAAO,CAAC,KAAK;IALf,yBAAyB;IACzB,OAAO,CAAC,WAAW,CAAC,CAAc;gBAGxB,GAAG,EAAE,WAAW,EAChB,KAAK,EAAE,MAAM,OAAO,CAAC;QAAE,IAAI,EAAE;YAAE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;gBAAE,OAAO,EAAE,MAAM,CAAC;gBAAC,MAAM,EAAE,MAAM,CAAA;aAAE,GAAG,SAAS,CAAC,CAAA;SAAE,CAAA;KAAE,CAAC;IAGvH;;;;OAIG;IACH,OAAO,CAAC,SAAS;IASjB;;;;;OAKG;IACG,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;IA0BpD;;;;;;OAMG;IACH,cAAc,CAAC,QAAQ,EAAE,yBAAyB,GAAG,UAAU;IAW/D;;;;;;OAMG;IACH,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,SAAS,GAAG,UAAU;IAY/D;;OAEG;IACG,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;IAI/E;;;;;OAKG;IACG,WAAW,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAiB7E;;;;;OAKG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAG5D"}
+{"version":3,"file":"authenticator.d.ts","sourceRoot":"","sources":["../../../src/federation/auth/authenticator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAsB,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAClG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,WAAW,EACZ,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7D,WAAW;AACX,WAAW;AACX,MAAM,WAAW,UAAU;IACzB,eAAe;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,2BAA2B;IAC3B,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,+BAA+B;IAC/B,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,wCAAwC;IACxC,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,YAAY;AACZ,qBAAa,aAAa;IAEtB,OAAO,CAAC,GAAG;IACX,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;gBAJ3B,GAAG,EAAE,WAAW,EAChB,KAAK,EAAE,MAAM,OAAO,CAAC;QAAE,IAAI,EAAE;YAAE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;gBAAE,OAAO,EAAE,MAAM,CAAC;gBAAC,MAAM,EAAE,MAAM,CAAA;aAAE,GAAG,SAAS,CAAC,CAAA;SAAE,CAAA;KAAE,CAAC,EACpG,eAAe,EAAE,kBAAkB,EACnC,SAAS,EAAE,kBAAkB,EAC7B,kBAAkB,EAAE,gBAAgB;IAGvD;;;;;OAKG;IACG,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;IAkCpD;;;;;;OAMG;IACH,cAAc,CAAC,QAAQ,EAAE,yBAAyB,GAAG,UAAU;IAW/D;;;;;;OAMG;IACH,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,SAAS,GAAG,UAAU;IAY/D;;OAEG;IACG,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;IAI/E;;;;;OAKG;IACG,WAAW,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAgB7E;;;;;OAKG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAI3D,mCAAmC;IACnC,eAAe,IAAI,OAAO,CAAC,cAAc,CAAC;IAI1C,wCAAwC;IACxC,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB;CASnD"}

package/bin/federation/auth/authenticator.js

@@ -1,37 +1,26 @@
 /**
  * 统一鉴权模块。
  *
- * Authenticator 统一处理 admin（secret key）和 user（JWT token）两种鉴权方式。
+ * Authenticator 统一处理 admin（secret key）、bureau（不透明部署凭证）和
+ * user（Ed25519 JWT）三种鉴权方式。
  * 所有鉴权失败统一抛出 httpError（ErrorWithStatus）。
- *
- * TokenSigner 实例通过 getSigner() 缓存，避免重复 new TokenSigner(key)。
  */
 import { bearerToken, httpError } from "../../utils/helpers.js";
-import { TokenSigner } from "./token-signer.js";
 import { normalizeRouteAuth } from "../../service/service.js";
+import { parse_user_token_ttl } from "./user-token-authority.js";
 /** 统一鉴权器 */
 export class Authenticator {
     env;
     store;
-    /** 缓存的 TokenSigner 实例 */
-    tokenSigner;
-    constructor(env, store) {
+    token_authority;
+    key_store;
+    bureau_token_store;
+    constructor(env, store, token_authority, key_store, bureau_token_store) {
         this.env = env;
         this.store = store;
-    }
-    /**
-     * 获取（或创建）TokenSigner 单例。
-     *
-     * 首次调用时从 env 读取 DOWNCITY_FEDERATION_TOKEN_SIGNING_KEY 创建实例并缓存。
-     */
-    getSigner() {
-        if (!this.tokenSigner) {
-            const signingKey = this.env.get("DOWNCITY_FEDERATION_TOKEN_SIGNING_KEY");
-            if (!signingKey)
-                throw new Error("DOWNCITY_FEDERATION_TOKEN_SIGNING_KEY is required");
-            this.tokenSigner = new TokenSigner(signingKey);
-        }
-        return this.tokenSigner;
+        this.token_authority = token_authority;
+        this.key_store = key_store;
+        this.bureau_token_store = bureau_token_store;
     }
     /**
      * 解析请求身份。
@@ -47,8 +36,16 @@ export class Authenticator {
         if (adminKey && token === adminKey) {
             return { level: "admin" };
         }
+        const bureau = await this.bureau_token_store.resolve(token);
+        if (bureau) {
+            const store = await this.store();
+            const city = await store.city.get(bureau.city_id);
+            if (!city || city.status !== "active")
+                return { level: "guest" };
+            return { level: "bureau", bureau, city };
+        }
         try {
-            const payload = await this.getSigner().verify(token);
+            const payload = await this.token_authority.verify(token);
             const store = await this.store();
             const city = await store.city.get(payload.city_id);
             if (!city)
@@ -119,14 +116,13 @@ export class Authenticator {
             throw httpError(404, `Unknown city: ${input.city_id}`);
         if (city.status !== "active")
             throw httpError(403, `City is not active: ${input.city_id}`);
-        const user_token = await this.getSigner().sign(input);
+        const ttl_seconds = parse_user_token_ttl(input.ttl);
+        const user_token = await this.token_authority.sign(input);
         return {
             user_token,
             city_id: input.city_id,
             user_id: input.user_id,
-            ...(input.ttl
-                ? { expires_at: new Date(Date.now() + TokenSigner.parseTTL(input.ttl) * 1000).toISOString() }
-                : {}),
+            expires_at: new Date(Date.now() + ttl_seconds * 1000).toISOString(),
         };
     }
     /**
@@ -136,7 +132,22 @@ export class Authenticator {
      * @returns 解析出的 token 载荷
      */
     async verifyToken(token) {
-        return this.getSigner().verify(token);
+        return this.token_authority.verify(token);
+    }
+    /** 返回 Federation 当前可公开使用的 JWKS。 */
+    get_public_jwks() {
+        return this.key_store.get_public_jwks();
+    }
+    /** 根据当前请求 origin 生成 Federation 发现信息。 */
+    get_discovery(origin) {
+        const federation_id = this.env.get("DOWNCITY_FEDERATION_ID");
+        if (!federation_id)
+            throw new Error("DOWNCITY_FEDERATION_ID is required");
+        return {
+            issuer: `urn:downcity:federation:${federation_id}`,
+            jwks_uri: `${origin.replace(/\/+$/, "")}/.well-known/jwks.json`,
+            user_token_audience: "downcity:user",
+        };
     }
 }
 //# sourceMappingURL=authenticator.js.map

package/bin/federation/auth/authenticator.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticator.js","sourceRoot":"","sources":["../../../src/federation/auth/authenticator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAsC,MAAM,0BAA0B,CAAC;AAiBlG,YAAY;AACZ,MAAM,OAAO,aAAa;IAKd;IACA;IALV,yBAAyB;IACjB,WAAW,CAAe;IAElC,YACU,GAAgB,EAChB,KAA6G;QAD7G,QAAG,GAAH,GAAG,CAAa;QAChB,UAAK,GAAL,KAAK,CAAwG;IACpH,CAAC;IAEJ;;;;OAIG;IACK,SAAS;QACf,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YACzE,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACtF,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,OAAgB;QAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAEtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACtE,IAAI,QAAQ,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YAExD,OAAO;gBACL,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE;gBACpE,IAAI;aACL,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,QAAmC;QAChD,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO;YACL,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,MAAkB,EAAE,QAAoB;QAChD,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACxC,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QAE9E,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,SAAS,CAAC,GAAG,EAAE,2BAA2B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,OAAgB,EAAE,QAAoB;QACvD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,KAA2B;QAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,MAAM,SAAS,CAAC,GAAG,EAAE,iBAAiB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,SAAS,CAAC,GAAG,EAAE,uBAAuB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAE3F,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO;YACL,UAAU;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,GAAG;gBACX,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE;gBAC7F,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;CACF"}
+{"version":3,"file":"authenticator.js","sourceRoot":"","sources":["../../../src/federation/auth/authenticator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAsC,MAAM,0BAA0B,CAAC;AAElG,OAAO,EAAE,oBAAoB,EAA2B,MAAM,2BAA2B,CAAC;AA4B1F,YAAY;AACZ,MAAM,OAAO,aAAa;IAEd;IACA;IACS;IACA;IACA;IALnB,YACU,GAAgB,EAChB,KAA6G,EACpG,eAAmC,EACnC,SAA6B,EAC7B,kBAAoC;QAJ7C,QAAG,GAAH,GAAG,CAAa;QAChB,UAAK,GAAL,KAAK,CAAwG;QACpG,oBAAe,GAAf,eAAe,CAAoB;QACnC,cAAS,GAAT,SAAS,CAAoB;QAC7B,uBAAkB,GAAlB,kBAAkB,CAAkB;IACpD,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,OAAgB;QAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAEtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACtE,IAAI,QAAQ,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YACjE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YAExD,OAAO;gBACL,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE;gBACpE,IAAI;aACL,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,QAAmC;QAChD,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO;YACL,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,MAAkB,EAAE,QAAoB;QAChD,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACxC,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QAE9E,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,SAAS,CAAC,GAAG,EAAE,2BAA2B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,OAAgB,EAAE,QAAoB;QACvD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,KAA2B;QAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,MAAM,SAAS,CAAC,GAAG,EAAE,iBAAiB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,SAAS,CAAC,GAAG,EAAE,uBAAuB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAE3F,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,OAAO;YACL,UAAU;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;SACpE,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,mCAAmC;IACnC,eAAe;QACb,OAAO,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC;IAC1C,CAAC;IAED,wCAAwC;IACxC,aAAa,CAAC,MAAc;QAC1B,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC7D,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC1E,OAAO;YACL,MAAM,EAAE,2BAA2B,aAAa,EAAE;YAClD,QAAQ,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB;YAC/D,mBAAmB,EAAE,eAAe;SACrC,CAAC;IACJ,CAAC;CACF"}