@evomap/evolver-adapter-public 2.0.19 → 2.0.24

package/dist/auth/credentialStore.d.ts

@@ -1,4 +1,4 @@
-import { linkSync } from 'node:fs';
+import { linkSync, renameSync } from 'node:fs';
 import type { hub } from '@evomap/evolver-core';
 export interface CredentialStoreOptions {
     /**
@@ -15,6 +15,8 @@ export interface CredentialStoreOptions {
     windowsParentStateReader?: (path: string) => readonly PathSecurityState[];
     /** Injectable filesystem primitive for deterministic no-clobber publication tests. */
     linkFile?: typeof linkSync;
+    /** Injectable filesystem primitive for deterministic atomic replacement tests. */
+    renameFile?: typeof renameSync;
 }
 export interface WindowsCredentialAclOps {
     assertTrustedParent(path: string, strictCreate: boolean): void;
@@ -44,6 +46,7 @@ export declare class CredentialStore {
     private readonly darwinAclReader;
     private readonly windowsParentStateReader;
     private readonly linkFile;
+    private readonly renameFile;
     private securedDirectoryState;
     private securedCredentialState;
     private readonly securedAncestorStates;

package/dist/auth/credentialStore.js

@@ -19,6 +19,7 @@ export class CredentialStore {
     darwinAclReader;
     windowsParentStateReader;
     linkFile;
+    renameFile;
     // ctime detects in-place ACL drift while dev/ino detects entry replacement.
     securedDirectoryState = null;
     securedCredentialState = null;
@@ -33,6 +34,7 @@ export class CredentialStore {
         this.darwinAclReader = options.darwinAclReader ?? readDarwinAcl;
         this.windowsParentStateReader = options.windowsParentStateReader ?? parentSecurityStates;
         this.linkFile = options.linkFile ?? linkSync;
+        this.renameFile = options.renameFile ?? renameSync;
     }
     load() {
         if (!this.prepareDirectory(false))
@@ -153,7 +155,7 @@ export class CredentialStore {
             this.assertDirectoryIdentity(directory, directoryIdentity);
             if (replaceExisting) {
                 this.assertSafeDestination();
-                renameSync(temporaryPath, this.path);
+                this.renameFile(temporaryPath, this.path);
             }
             else if (!this.publishIfAbsent(temporaryPath)) {
                 const incumbentFd = this.openCredentialFile();

package/dist/auth/legacyShim.d.ts

@@ -13,8 +13,8 @@ export type NodeSecretVersionHandler = (nodeSecretVersion?: number) => void;
  */
 export type NodeSecretDivergenceHandler = () => void;
 /**
- * node_secret 双轨过渡(M6-5, 6 个月). 包旧 64-hex node_secret 成 AuthProvider.
- * **node_secret 走 request body**(gep-a2a 契约, 实测 dev: requireNodeSecret 读 body 非 header), 不轮换.
+ * LegacyAuthShim exposes node_secret as a transport-neutral credential field. HubFetch promotes it to
+ * Authorization: Bearer for GET and strict GEP envelope endpoints before egress.
  */
 export declare class LegacyAuthShim implements hub.AuthProvider {
     private nodeSecret;

package/dist/auth/legacyShim.js

@@ -13,8 +13,8 @@ export function parseNodeSecretVersion(value) {
     return Number.isSafeInteger(parsed) ? parsed : undefined;
 }
 /**
- * node_secret 双轨过渡(M6-5, 6 个月). 包旧 64-hex node_secret 成 AuthProvider.
- * **node_secret 走 request body**(gep-a2a 契约, 实测 dev: requireNodeSecret 读 body 非 header), 不轮换.
+ * LegacyAuthShim exposes node_secret as a transport-neutral credential field. HubFetch promotes it to
+ * Authorization: Bearer for GET and strict GEP envelope endpoints before egress.
  */
 export class LegacyAuthShim {
     nodeSecret;

package/dist/hubCapability.d.ts

@@ -194,6 +194,8 @@ export declare class PublicHubCapability implements hub.HubCapability {
     createRecipe(request: hub.RecipeCreateRequest): Promise<hub.RecipeReceipt>;
     publishRecipe(recipeId: string, options?: hub.RecipePublishOptions): Promise<hub.RecipeReceipt>;
     getRecipe(recipeId: string): Promise<hub.RecipeFetchReceipt>;
+    searchRecipes(request?: hub.RecipeSearchRequest): Promise<hub.RecipeSearchReceipt>;
+    listRecipes(request?: hub.RecipeSearchRequest): Promise<hub.RecipeSearchReceipt>;
     expressRecipe(recipeId: string, request?: hub.RecipeExpressRequest): Promise<hub.RecipeExpressionReceipt>;
     task: {
         claim: (taskId: string) => Promise<{

package/dist/hubCapability.js

@@ -103,6 +103,8 @@ export class PublicHubCapability {
         publish: async (recipeId, options) => this.publishRecipe(recipeId, options),
         get: async (recipeId) => this.getRecipe(recipeId),
         express: async (recipeId, request = {}) => this.expressRecipe(recipeId, request),
+        search: async (request = {}) => this.searchRecipes(request),
+        list: async (request = {}) => this.listRecipes(request),
     };
     constructor(opts) {
         this.opts = opts;
@@ -633,6 +635,20 @@ export class PublicHubCapability {
             ...(recipe !== undefined ? { recipe } : {}),
         };
     }
+    async searchRecipes(request = {}) {
+        if (isHubDryRunEnabled()) {
+            return dryRunRecipeSearchReceipt('search_recipe', request);
+        }
+        const body = await this.http.call('GET', '/a2a/recipe/search', undefined, recipeSearchQuery(request));
+        return recipeSearchReceiptFromBody(body);
+    }
+    async listRecipes(request = {}) {
+        if (isHubDryRunEnabled()) {
+            return dryRunRecipeSearchReceipt('list_recipe', request);
+        }
+        const body = await this.http.call('GET', '/a2a/recipe/list', undefined, recipeSearchQuery(request));
+        return recipeSearchReceiptFromBody(body);
+    }
     async expressRecipe(recipeId, request = {}) {
         if (isHubDryRunEnabled()) {
             return dryRunRecipeReceipt('express_recipe', recipeId, { input_payload: request.inputPayload ?? {} });
@@ -878,6 +894,58 @@ function recipeOrganismIdFromPayload(payload) {
         ? stringField(organism, 'id') ?? stringField(organism, 'organism_id') ?? stringField(organism, 'organismId')
         : undefined;
 }
+function recipeSearchQuery(request) {
+    return {
+        ...(request.q ? { q: request.q } : {}),
+        ...(request.limit !== undefined ? { limit: request.limit } : {}),
+        ...(request.cursor ? { cursor: request.cursor } : {}),
+        ...(request.sort ? { sort: request.sort } : {}),
+    };
+}
+function recipeListFromRecord(value) {
+    for (const key of ['recipes', 'items', 'results']) {
+        const found = value[key];
+        if (Array.isArray(found))
+            return found;
+    }
+    const nested = asRecord(value['data']);
+    if (!nested)
+        return undefined;
+    for (const key of ['recipes', 'items', 'results']) {
+        const found = nested[key];
+        if (Array.isArray(found))
+            return found;
+    }
+    return undefined;
+}
+function recipeSearchReceiptFromBody(body) {
+    const payload = recipePayload(body);
+    const recipes = recipeListFromRecord(payload) ?? recipeListFromRecord(body) ?? [];
+    const nextCursor = stringField(payload, 'next_cursor')
+        ?? stringField(payload, 'nextCursor')
+        ?? stringField(body, 'next_cursor')
+        ?? stringField(body, 'nextCursor');
+    const hasMore = booleanField(payload, 'has_more')
+        ?? booleanField(payload, 'hasMore')
+        ?? booleanField(body, 'has_more')
+        ?? booleanField(body, 'hasMore');
+    return {
+        recipes,
+        ...(nextCursor ? { nextCursor } : {}),
+        ...(hasMore !== undefined ? { hasMore } : {}),
+        raw: body,
+    };
+}
+function dryRunRecipeSearchReceipt(action, request) {
+    return {
+        recipes: [],
+        raw: {
+            dry_run: true,
+            would: action,
+            ...request,
+        },
+    };
+}
 function recipeReceiptFromBody(body) {
     const payload = recipePayload(body);
     const recipe = asRecord(payload['recipe']);

package/dist/hubFetch.d.ts

@@ -84,9 +84,9 @@ export interface HubFetchDeps {
     deadlineScheduler?: HubDeadlineScheduler;
 }
 /**
- * 公版 hub HTTP 客户端(M6-6). 每请求经 AuthProvider 取凭证: POST 通常注入 body; GET 与 strict hello envelope
- * 走 **Authorization: Bearer <node_secret>** 头(hub 只从 header/body 读 node_secret, 绝不从 query — #8);
- * sender_id 是标识非凭证, 留 query/body.
+ * 公版 hub HTTP 客户端(M6-6). 每请求经 AuthProvider 取凭证: legacy node_secret 对 GET 与 strict
+ * GEP envelope POST 走 **Authorization: Bearer <node_secret>** 头，绝不进入 query 或 envelope body；
+ * 其余兼容 REST POST 保留既有 body contract。sender_id 是标识非凭证, 留 query/body.
  * 401/403→AuthError(reauth), 4xx→HubClientError(终态), 5xx→重试.
  * 非 JSON Hub 响应(WAF/HTML/captive portal/gateway text)→HubUnreachableError, 不触发 auth recovery.
  */

package/dist/hubFetch.js

@@ -72,6 +72,46 @@ const PROTECTED_REQUEST_HEADERS = new Set([
     'x-evomap-signature',
     'x-node-secret',
 ]);
+const LEGACY_BEARER_POST_PATHS = new Set([
+    '/a2a/hello',
+    '/a2a/publish',
+    '/a2a/validate',
+    '/a2a/fetch',
+    '/a2a/events/poll',
+    '/a2a/mailbox/outbound',
+]);
+function requestHeaderName(headers, name) {
+    const normalized = name.toLowerCase();
+    return Object.keys(headers).find((headerName) => headerName.toLowerCase() === normalized);
+}
+function setLegacyBearerFallback(headers, nodeSecret) {
+    const existingName = requestHeaderName(headers, 'authorization');
+    if (existingName !== undefined && headers[existingName]?.trim())
+        return false;
+    if (existingName !== undefined)
+        delete headers[existingName];
+    headers['authorization'] = `Bearer ${nodeSecret}`;
+    return true;
+}
+function legacyNodeSecret(value) {
+    return typeof value === 'string' && /^[a-f0-9]{64}$/i.test(value) ? value : undefined;
+}
+function isGepEnvelope(body) {
+    return body?.['protocol'] === 'gep-a2a'
+        && body['protocol_version'] === '1.0.0'
+        && typeof body['message_type'] === 'string'
+        && body['message_type'].trim().length > 0
+        && typeof body['message_id'] === 'string'
+        && body['message_id'].trim().length > 0
+        && typeof body['timestamp'] === 'string'
+        && Number.isFinite(Date.parse(body['timestamp']))
+        && Object.prototype.hasOwnProperty.call(body, 'payload')
+        && body['payload'] !== undefined;
+}
+function usesLegacyBearerForPost(method, path, body) {
+    return method.toUpperCase() === 'POST'
+        && (LEGACY_BEARER_POST_PATHS.has(path) || isGepEnvelope(body));
+}
 function mergeRequestHeaders(requestHeaders, signedHeaders) {
     const signedNames = new Set(Object.keys(signedHeaders ?? {}).map((name) => name.toLowerCase()));
     const headers = {};
@@ -93,9 +133,9 @@ function mergeRequestHeaders(requestHeaders, signedHeaders) {
     return { ...headers, ...signedHeaders };
 }
 /**
- * 公版 hub HTTP 客户端(M6-6). 每请求经 AuthProvider 取凭证: POST 通常注入 body; GET 与 strict hello envelope
- * 走 **Authorization: Bearer <node_secret>** 头(hub 只从 header/body 读 node_secret, 绝不从 query — #8);
- * sender_id 是标识非凭证, 留 query/body.
+ * 公版 hub HTTP 客户端(M6-6). 每请求经 AuthProvider 取凭证: legacy node_secret 对 GET 与 strict
+ * GEP envelope POST 走 **Authorization: Bearer <node_secret>** 头，绝不进入 query 或 envelope body；
+ * 其余兼容 REST POST 保留既有 body contract。sender_id 是标识非凭证, 留 query/body.
  * 401/403→AuthError(reauth), 4xx→HubClientError(终态), 5xx→重试.
  * 非 JSON Hub 响应(WAF/HTML/captive portal/gateway text)→HubUnreachableError, 不触发 auth recovery.
  */
@@ -148,26 +188,28 @@ export class HubFetch {
                             qs.set(k, String(v)); // non-credential GET params (e.g. semantic-search q)
                 // #8: credentials must NOT go in the query (leaks to access logs / proxies even over https).
                 // node_secret travels via Authorization: Bearer; the hub reads it there, never from the query.
-                const nodeSecret = creds['node_secret'];
-                if (nodeSecret !== undefined && headers['authorization'] === undefined)
-                    headers['authorization'] = `Bearer ${String(nodeSecret)}`;
+                const nodeSecret = legacyNodeSecret(creds['node_secret']);
+                if (nodeSecret !== undefined)
+                    setLegacyBearerFallback(headers, nodeSecret);
                 const q = qs.toString();
                 if (q)
                     url += `?${q}`;
             }
             else {
                 const postCreds = { ...creds };
-                const nodeSecret = postCreds['node_secret'];
-                if ((path === '/a2a/hello' || path === '/a2a/mailbox/outbound') && nodeSecret !== undefined) {
-                    if (headers['authorization'] === undefined)
-                        headers['authorization'] = `Bearer ${String(nodeSecret)}`;
-                    delete postCreds['node_secret'];
+                const postBody = { ...(bodyObj ?? {}) };
+                const nodeSecret = legacyNodeSecret(postCreds['node_secret']);
+                if (usesLegacyBearerForPost(method, path, bodyObj)) {
+                    delete postBody['node_secret'];
+                    if (nodeSecret !== undefined && setLegacyBearerFallback(headers, nodeSecret)) {
+                        delete postCreds['node_secret'];
+                    }
                 }
                 if (path === '/a2a/mailbox/outbound' && sender) {
                     const qs = new URLSearchParams({ sender_id: sender });
                     url += `?${qs.toString()}`;
                 }
-                body = JSON.stringify({ ...(sender ? { sender_id: sender } : {}), ...postCreds, ...(bodyObj ?? {}) });
+                body = JSON.stringify({ ...(sender ? { sender_id: sender } : {}), ...postCreds, ...postBody });
             }
             let res;
             try {
@@ -246,7 +288,7 @@ function hubOperationForRequest(path, bodyObj) {
             && payload['search_only'] === true)
             return 'search';
     }
-    if (path === '/a2a/assets/semantic-search' || path === '/a2a/directory/search')
+    if (path === '/a2a/assets/semantic-search' || path === '/a2a/directory/search' || path === '/a2a/recipe/search' || path === '/a2a/recipe/list')
         return 'search';
     if (path === '/a2a/heartbeat')
         return 'heartbeat';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evomap/evolver-adapter-public",
-  "version": "2.0.19",
+  "version": "2.0.24",
   "private": false,
   "type": "module",
   "engines": {
@@ -17,7 +17,7 @@
   },
   "dependencies": {
     "@evomap/atp-sdk": "^0.1.0",
-    "@evomap/evolver-core": "2.0.19",
+    "@evomap/evolver-core": "2.0.24",
     "undici": "^6.27.0"
   },
   "optionalDependencies": {