@fa-software/semi2-dsh 0.0.10-preview.20260920042705

package/lib/configuration/generated/schema.js

@@ -0,0 +1,95 @@
+/** 账户的 CNB 连接态。AWAITING_BINDING = 账户由上游目录预建，还没绑定本人令牌。 */
+export var CnbConnectionState;
+(function (CnbConnectionState) {
+    CnbConnectionState["AwaitingBinding"] = "AWAITING_BINDING";
+    CnbConnectionState["Connected"] = "CONNECTED";
+    CnbConnectionState["ReconnectRequired"] = "RECONNECT_REQUIRED";
+})(CnbConnectionState || (CnbConnectionState = {}));
+export var DiscoveryErrorCode;
+(function (DiscoveryErrorCode) {
+    DiscoveryErrorCode["CredentialsNotConfigured"] = "CREDENTIALS_NOT_CONFIGURED";
+    DiscoveryErrorCode["DiscoveryUnsupported"] = "DISCOVERY_UNSUPPORTED";
+    DiscoveryErrorCode["InvalidModelCatalog"] = "INVALID_MODEL_CATALOG";
+    DiscoveryErrorCode["InvalidModelUrl"] = "INVALID_MODEL_URL";
+    DiscoveryErrorCode["ModelCatalogTooLarge"] = "MODEL_CATALOG_TOO_LARGE";
+    DiscoveryErrorCode["ModelUrlForbidden"] = "MODEL_URL_FORBIDDEN";
+    DiscoveryErrorCode["UpstreamCredentialsRejected"] = "UPSTREAM_CREDENTIALS_REJECTED";
+    DiscoveryErrorCode["UpstreamPaginationError"] = "UPSTREAM_PAGINATION_ERROR";
+    DiscoveryErrorCode["UpstreamRedirectForbidden"] = "UPSTREAM_REDIRECT_FORBIDDEN";
+    DiscoveryErrorCode["UpstreamResponseTooLarge"] = "UPSTREAM_RESPONSE_TOO_LARGE";
+    DiscoveryErrorCode["UpstreamTimeout"] = "UPSTREAM_TIMEOUT";
+    DiscoveryErrorCode["UpstreamUnavailable"] = "UPSTREAM_UNAVAILABLE";
+})(DiscoveryErrorCode || (DiscoveryErrorCode = {}));
+export var DiscoveryStatus;
+(function (DiscoveryStatus) {
+    DiscoveryStatus["Failed"] = "FAILED";
+    DiscoveryStatus["Never"] = "NEVER";
+    DiscoveryStatus["Stale"] = "STALE";
+    DiscoveryStatus["Success"] = "SUCCESS";
+})(DiscoveryStatus || (DiscoveryStatus = {}));
+export var InputModality;
+(function (InputModality) {
+    InputModality["Image"] = "IMAGE";
+    InputModality["Text"] = "TEXT";
+})(InputModality || (InputModality = {}));
+export var MetadataField;
+(function (MetadataField) {
+    MetadataField["ContextWindow"] = "CONTEXT_WINDOW";
+    MetadataField["Input"] = "INPUT";
+    MetadataField["MaxTokens"] = "MAX_TOKENS";
+    MetadataField["ReasoningLevels"] = "REASONING_LEVELS";
+})(MetadataField || (MetadataField = {}));
+/** 模型元数据来源的优先级：手工 > 目录（内置或上游发现）> dsh 默认。 */
+export var MetadataSource;
+(function (MetadataSource) {
+    MetadataSource["Builtin"] = "BUILTIN";
+    MetadataSource["Discovered"] = "DISCOVERED";
+    MetadataSource["DshDefault"] = "DSH_DEFAULT";
+    MetadataSource["Manual"] = "MANUAL";
+})(MetadataSource || (MetadataSource = {}));
+export var ModelProtocol;
+(function (ModelProtocol) {
+    ModelProtocol["Anthropic"] = "ANTHROPIC";
+    ModelProtocol["Deepseek"] = "DEEPSEEK";
+    ModelProtocol["OpenaiChat"] = "OPENAI_CHAT";
+    ModelProtocol["OpenaiResponses"] = "OPENAI_RESPONSES";
+})(ModelProtocol || (ModelProtocol = {}));
+export var ProjectKind;
+(function (ProjectKind) {
+    ProjectKind["Cnb"] = "CNB";
+    ProjectKind["Local"] = "LOCAL";
+})(ProjectKind || (ProjectKind = {}));
+export var ReasoningLevel;
+(function (ReasoningLevel) {
+    ReasoningLevel["High"] = "HIGH";
+    ReasoningLevel["Low"] = "LOW";
+    ReasoningLevel["Max"] = "MAX";
+    ReasoningLevel["Medium"] = "MEDIUM";
+    ReasoningLevel["Minimal"] = "MINIMAL";
+    ReasoningLevel["Off"] = "OFF";
+    ReasoningLevel["Xhigh"] = "XHIGH";
+})(ReasoningLevel || (ReasoningLevel = {}));
+export var Role;
+(function (Role) {
+    Role["Admin"] = "ADMIN";
+    Role["User"] = "USER";
+})(Role || (Role = {}));
+/** 技能附件内容的编码：文本类用 UTF8，其余（图片 / 二进制）用 BASE64。 */
+export var SkillFileEncoding;
+(function (SkillFileEncoding) {
+    SkillFileEncoding["Base64"] = "BASE64";
+    SkillFileEncoding["Utf8"] = "UTF8";
+})(SkillFileEncoding || (SkillFileEncoding = {}));
+export var UpstreamStatus;
+(function (UpstreamStatus) {
+    UpstreamStatus["Active"] = "ACTIVE";
+    UpstreamStatus["Archived"] = "ARCHIVED";
+    UpstreamStatus["Forking"] = "FORKING";
+    UpstreamStatus["Unavailable"] = "UNAVAILABLE";
+})(UpstreamStatus || (UpstreamStatus = {}));
+export var UserStatus;
+(function (UserStatus) {
+    UserStatus["Active"] = "ACTIVE";
+    UserStatus["Disabled"] = "DISABLED";
+    UserStatus["Pending"] = "PENDING";
+})(UserStatus || (UserStatus = {}));

package/lib/configuration/graphql.js

@@ -0,0 +1,193 @@
+// @fa-software/semi2-dsh/configuration/graphql —— 通用 GraphQL client（本包唯一的网络出口）。
+// 错误码一律取 `errors[].extensions.code`（GraphQL 通路恒 HTTP 200）；文档唯一来源是 operations.graphql（与常量逐字一致由 test 钉住）。
+/** 只承载 code，绝不把上游内容插值进 message。 */
+export class ConfigurationError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = 'ConfigurationError';
+    }
+}
+/** 启动装配：五个用户级领域问题一个文档（项目绑定按工作区另行按需取，见下）。 */
+export const RUNTIME_BOOT_DOCUMENT = `query RuntimeBoot {
+  runtimeViewer {
+    id
+    username
+    displayName
+  }
+  runtimeModels {
+    id
+    upstreamId
+    displayName
+    metadata { contextWindow maxTokens input reasoningLevels }
+    connection { id provider protocol baseUrl }
+  }
+  runtimeDefaultModelId
+  runtimeModelCredentials {
+    connectionId
+    value
+  }
+  runtimeSkills {
+    id
+    projectId
+    name
+    description
+    whenToUse
+    content
+    version
+    files {
+      path
+      sizeBytes
+      mimeType
+      isExecutable
+    }
+    fileCount
+    filesBytes
+  }
+}`;
+/**
+ * 技能附属资源字节：boot 文档只带清单（避免目录膨胀），真正加载某个技能时才按需取这一条。
+ * 可空根字段：读取者不可见 / 不存在回空数组（权威「没有」），领域失败回 null（降级，不物化）。
+ */
+export const RUNTIME_SKILL_FILES_DOCUMENT = `query RuntimeSkillFiles($skillId: ID!) {
+  runtimeSkillFiles(skillId: $skillId) {
+    path
+    content
+    encoding
+    sizeBytes
+    mimeType
+    isExecutable
+  }
+}`;
+/**
+ * 项目绑定按 slug 取：只问已登记工作区命中的那几个项目，绝不把整张项目表拉回本地。
+ * `slugs` 是读范围之上的过滤（不是绕过），空数组 = 空集合。
+ */
+export const RUNTIME_WORKSPACE_PROJECTS_DOCUMENT = `query RuntimeWorkspaceProjects($slugs: [String!]) {
+  runtimeProjects(slugs: $slugs) {
+    id slug name enabled planModelId executeModelId
+  }
+}`;
+/** 密钥重取（「重新加载」时只刷新密钥）。 */
+export const RUNTIME_MODEL_CREDENTIALS_DOCUMENT = `query RuntimeModelCredentials($connectionIds: [ID!]) {
+  runtimeModelCredentials(connectionIds: $connectionIds) {
+    connectionId
+    value
+  }
+}`;
+/** 连接令牌形状：hub 接入密钥（cnbk_）、部署面运行令牌（semi2_）或用户密钥（JWT 三段形态）。 */
+const TOKEN_SHAPE = /^(?:cnbk_[A-Za-z0-9_-]+|semi2_[A-Za-z0-9_-]+|[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)$/;
+const REQUEST_TIMEOUT_MS = 15_000;
+const MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+/** semi2-hub 根地址：生产/预览都是 https；development 下额外放行回环 http。 */
+export function consoleEndpoint(value, nodeEnv) {
+    let endpoint;
+    try {
+        endpoint = new URL(value.trim());
+    }
+    catch {
+        throw new ConfigurationError('INVALID_CONFIG_URL');
+    }
+    const loopback = endpoint.hostname === 'localhost' ||
+        endpoint.hostname === '[::1]' ||
+        /^127(?:\.\d{1,3}){3}$/.test(endpoint.hostname);
+    if (endpoint.username ||
+        endpoint.password ||
+        endpoint.search ||
+        endpoint.hash ||
+        (endpoint.protocol !== 'https:' &&
+            !(endpoint.protocol === 'http:' && nodeEnv !== 'production' && loopback))) {
+        throw new ConfigurationError('INVALID_CONFIG_URL');
+    }
+    endpoint.pathname = `${endpoint.pathname.replace(/\/+$/, '')}/graphql`;
+    return endpoint;
+}
+function asRecord(value) {
+    return value === null || typeof value !== 'object' || Array.isArray(value)
+        ? null
+        : value;
+}
+function errorCodeOf(payload) {
+    const errors = payload.errors;
+    if (!Array.isArray(errors))
+        return null;
+    for (const entry of errors) {
+        const code = asRecord(asRecord(entry)?.extensions)?.code;
+        if (typeof code === 'string' && code !== '')
+            return code;
+    }
+    return null;
+}
+/** 流式累计，超 2MB 判失败；不把上游内容带进错误。 */
+async function readPayload(response) {
+    const body = response.body;
+    if (body === null)
+        throw new ConfigurationError('CONFIG_REQUEST_FAILED');
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of body) {
+        if (!(chunk instanceof Uint8Array))
+            throw new ConfigurationError('CONFIG_REQUEST_FAILED');
+        size += chunk.byteLength;
+        if (size > MAX_RESPONSE_BYTES)
+            throw new ConfigurationError('CONFIG_REQUEST_FAILED');
+        chunks.push(chunk);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    catch {
+        throw new ConfigurationError('CONFIG_REQUEST_FAILED');
+    }
+    const payload = asRecord(parsed);
+    if (payload === null)
+        throw new ConfigurationError('CONFIG_REQUEST_FAILED');
+    return payload;
+}
+/**
+ * 传输层失败抛 `ConfigurationError`；服务端领域失败回落在返回值的 errorCode 上（HTTP 200 +
+ * `errors[].extensions.code`），由调用方决定降级。
+ */
+export async function postGraphql(client, request) {
+    const token = client.token.trim();
+    if (token === '' || token.length > 512 || !TOKEN_SHAPE.test(token))
+        throw new ConfigurationError('MISSING_ACCESS_TOKEN');
+    const fetchImpl = client.fetchImpl ?? fetch;
+    let response;
+    try {
+        response = await fetchImpl(client.endpoint, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                authorization: `Bearer ${token}`,
+                'cache-control': 'no-store',
+                ...(client.creator === undefined
+                    ? {}
+                    : { 'x-semi2-cnb-creator': client.creator }),
+            },
+            cache: 'no-store',
+            redirect: 'error',
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+            body: JSON.stringify({
+                operationName: request.operationName,
+                query: request.document,
+                ...(request.variables === undefined
+                    ? {}
+                    : { variables: request.variables }),
+            }),
+        });
+    }
+    catch {
+        throw new ConfigurationError('CONFIG_REQUEST_FAILED');
+    }
+    if (!response.ok)
+        throw new ConfigurationError(response.status === 401 ? 'UNAUTHENTICATED' : 'CONFIG_REQUEST_FAILED');
+    const payload = await readPayload(response);
+    const data = payload.data;
+    return {
+        data: data === null || data === undefined ? null : data,
+        errorCode: errorCodeOf(payload),
+    };
+}

package/lib/configuration/index.js

@@ -0,0 +1,29 @@
+import { Semi2ConfigRuntime, } from './runtime.js';
+import { installSkills } from './skills.js';
+/**
+ * 同步发布 `ctx.semi2Config`，首次领取在后台——不阻塞插件树 settle，失败只 warn 绝不 reject
+ *（读 state.error 诊断）；缺任一连接凭据即不做任何注入。
+ */
+export function installConfiguration(ctx, options = {}) {
+    const runtime = new Semi2ConfigRuntime(ctx, { ...process.env }, options);
+    ctx.provide('semi2Config', runtime);
+    // 技能目录由 boot 缓存驱动：注册 provider 只 warn，注册失败不影响配置领取。
+    installSkills(ctx, runtime, (message) => {
+        warn(ctx, message);
+    });
+    // fire-and-forget 不得产生 unhandled rejection（start() 自身不抛，仍显式接住）。
+    void runtime.start().catch((error) => {
+        const message = error instanceof Error ? error.message : String(error);
+        warn(ctx, `首次领取失败：${message}`);
+    });
+    return runtime;
+}
+/** 无 logger 的宿主（单测）忽略。 */
+function warn(ctx, message) {
+    try {
+        ctx.logger('semi2-config').warn(message);
+    }
+    catch {
+        // 忽略
+    }
+}

package/lib/configuration/login.js

@@ -0,0 +1,96 @@
+// @fa-software/semi2-dsh/configuration/login —— 设置页「登录 semi2-hub」（本地宿主）。
+// `POST {semi2-hub}/auth/token` 一步换 JWT：无 cookie / CSRF / 服务端会话；semi2-hub 要求 Origin 命中其公开地址，故显式带上 origin。
+// 密码只存在本次请求内存里（不写日志、不进设置命名空间）；凭据落盘由调用方写 dsh credentials 存储，本模块不落盘。
+import { ConfigurationError } from './graphql.js';
+const USER_KEY_SHAPE = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+/** semi2-hub 根地址：https（development 下额外放行回环 http），不允许凭据/查询串。 */
+export function consoleOrigin(value, nodeEnv) {
+    let endpoint;
+    try {
+        endpoint = new URL(value.trim());
+    }
+    catch {
+        throw new ConfigurationError('INVALID_CONFIG_URL');
+    }
+    const loopback = endpoint.hostname === 'localhost' ||
+        endpoint.hostname === '[::1]' ||
+        /^127(?:\.\d{1,3}){3}$/.test(endpoint.hostname);
+    if (endpoint.username ||
+        endpoint.password ||
+        endpoint.search ||
+        endpoint.hash ||
+        (endpoint.protocol !== 'https:' &&
+            !(endpoint.protocol === 'http:' &&
+                nodeEnv !== 'production' &&
+                loopback)))
+        throw new ConfigurationError('INVALID_CONFIG_URL');
+    return endpoint.origin;
+}
+async function consoleFailure(response) {
+    let code = 'LOGIN_FAILED';
+    try {
+        const body = (await response.json());
+        if (typeof body.code === 'string' && body.code !== '')
+            code = body.code;
+    }
+    catch {
+        // 非 JSON 响应：保留通用码。
+    }
+    return new ConfigurationError(code);
+}
+/** 失败抛 `ConfigurationError`（code 由 UI 透传展示）。 */
+export async function loginToConsole(input, fetchImpl = fetch) {
+    const origin = consoleOrigin(input.url, process.env.NODE_ENV);
+    const response = await fetchImpl(`${origin}/auth/token`, {
+        cache: 'no-store',
+        redirect: 'error',
+        signal: AbortSignal.timeout(15_000),
+        method: 'POST',
+        headers: {
+            'content-type': 'application/json',
+            origin,
+            accept: 'application/json',
+        },
+        body: JSON.stringify({
+            username: input.username,
+            password: input.password,
+        }),
+    }).catch(() => {
+        throw new ConfigurationError('CONFIG_REQUEST_FAILED');
+    });
+    if (!response.ok)
+        throw await consoleFailure(response);
+    const payload = (await response.json().catch(() => null));
+    const token = payload?.token;
+    if (typeof token !== 'string' || !USER_KEY_SHAPE.test(token))
+        throw new ConfigurationError('LOGIN_FAILED');
+    const userName = typeof payload?.user?.username === 'string'
+        ? payload.user.username
+        : '';
+    return { userName, token, url: origin };
+}
+/** CNB 运行面：平台注入的短期 CNB_TOKEN 换 hub 用户密钥（服务端到服务端，无 Origin/CSRF）。 */
+export async function exchangeCnbToken(input, fetchImpl = fetch) {
+    const origin = consoleOrigin(input.url, process.env.NODE_ENV);
+    const response = await fetchImpl(`${origin}/auth/cnb-token`, {
+        cache: 'no-store',
+        redirect: 'error',
+        signal: AbortSignal.timeout(15_000),
+        method: 'POST',
+        headers: {
+            'content-type': 'application/json',
+            accept: 'application/json',
+        },
+        body: JSON.stringify({ token: input.token }),
+    }).catch(() => {
+        throw new ConfigurationError('CONFIG_REQUEST_FAILED');
+    });
+    if (!response.ok)
+        throw await consoleFailure(response);
+    const payload = (await response.json().catch(() => null));
+    const token = payload?.token;
+    if (typeof token !== 'string' || !USER_KEY_SHAPE.test(token))
+        throw new ConfigurationError('EXCHANGE_FAILED');
+    const userName = typeof payload?.user?.username === 'string' ? payload.user.username : '';
+    return { userName, token };
+}