@harrylabsj/kiwi 0.7.22 → 0.9.0

package/dist/discovery/catalog-source/buyer-follows.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { CatalogSourceDeps } from "./source.js";
+export interface BuyerFollowsSourceDeps extends CatalogSourceDeps {
+    /** catalog 账号会话 token（作为 cookie kiwi_session 发送）。 */
+    sessionToken?: string;
+}
+/** 买家视角的关注视图（上游 follow_view；不含 buyer_subject——响应即买家本人）。 */
+export interface BuyerFollowRecord {
+    readonly merchant_id: string;
+    readonly merchant_name?: string;
+    readonly category?: string;
+    readonly status: string;
+    readonly consent_version?: string;
+    readonly created_at?: string;
+    readonly last_seen_at?: string;
+}
+/** 商家公开事件类型（上游 EVENT_TYPES；新增类型上游可扩，运行时按非空字符串容忍）。 */
+export type MerchantPublicEventType = "product_added" | "product_updated" | "faq_updated" | "service_notice" | "publication_withdrawn";
+/** 商家公开事件（只含公开字段；payload 即 M0 公开投影）。 */
+export interface MerchantPublicEvent {
+    readonly event_id: string;
+    readonly event_type: MerchantPublicEventType | string;
+    readonly publication_id?: string;
+    readonly version?: number;
+    readonly payload: Record<string, unknown>;
+    readonly created_at: string;
+}
+/** 一个商家的增量更新分组（updates 元素；last_seen_at 为本次推进后的水位）。 */
+export interface BuyerFollowUpdateGroup {
+    readonly merchant_id: string;
+    readonly merchant_name?: string;
+    readonly events: MerchantPublicEvent[];
+    readonly last_seen_at?: string;
+}
+export declare function validateBuyerFollow(value: unknown): BuyerFollowRecord;
+export declare function validateMerchantPublicEvent(value: unknown): MerchantPublicEvent;
+export declare function validateFollowUpdateGroup(value: unknown): BuyerFollowUpdateGroup;
+export declare class BuyerFollowsSource {
+    private readonly baseUrl;
+    private readonly deps;
+    constructor(deps: BuyerFollowsSourceDeps);
+    /**
+     * 核心请求：会话认证（cookie kiwi_session）；超时 / HTTP / 网络失败统一映射
+     * 为 CatalogSourceError；HTTP 401/403 → session_rejected（fail-closed，不伪造
+     * 身份、不静默降级为匿名）。
+     */
+    private request;
+    /** 显式关注（幂等；可选 category/consent_version）。仅买家主动调用构成订阅。 */
+    follow(merchantId: string, opts?: {
+        category?: string;
+        consent_version?: string;
+    }): Promise<{
+        follow: BuyerFollowRecord;
+        created: boolean;
+    }>;
+    /** 取消关注（幂等；无活跃关注同样 ok）。 */
+    unfollow(merchantId: string): Promise<{
+        merchant_id: string;
+        following: false;
+    }>;
+    /** 我的活跃关注列表（cancelled 不在其列）。 */
+    listFollows(): Promise<BuyerFollowRecord[]>;
+    /**
+     * 主动拉取关注更新：仅响应买家主动查询。水位语义在上游（返回什么再推进
+     * last_seen_at，不丢不重）；本客户端原样透传分组，不本地过滤、不缓存重放。
+     */
+    getUpdates(): Promise<BuyerFollowUpdateGroup[]>;
+}

package/dist/discovery/catalog-source/buyer-follows.js

@@ -0,0 +1,228 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * BuyerFollowsSource —— kiwi-catalog 买家关注（M4 拉取式订阅）读/写客户端。
+ *
+ *   PUT    {baseUrl}/v1/me/follows/{merchant_id}   → {ok, follow, created}
+ *   DELETE {baseUrl}/v1/me/follows/{merchant_id}   → {ok, merchant_id, following: false}
+ *   GET    {baseUrl}/v1/me/follows                 → {ok, follows: […]}
+ *   GET    {baseUrl}/v1/me/follows/updates         → {ok, updates: […]}
+ *
+ * 契约来源：kiwi-catalog 仓 kiwi_catalog/services/buyer_follows.py 与
+ * api/handlers/buyer_follows.py（schema v30，merchant-buddy 第 0 版设计 §4）。
+ *
+ * 与 KiwiCatalogSource / MerchantPublicationsSource 的关键差异：这四条路由走
+ * catalog **账号会话**（cookie kiwi_session），不是匿名公开读——buyer_subject
+ * 由服务端从会话解析（account:{account_id} 不透明字符串），客户端不传身份、
+ * 不伪造身份。会话 token 由部署方显式配置（KIWI_CATALOG_SESSION /
+ * --catalog-session）；HTTP 401/403 映射为 session_rejected（fail-closed），
+ * 由上层转成"需要先在 Kiwi 目录登录"的可解释引导。
+ *
+ * 出站加固与兄弟 source 一致：不跟随重定向、超时、响应大小上限；响应手写校验
+ * （merchant-publications.ts 同风格，上游暂无 vendored schema）。
+ */
+import { CatalogSourceError } from "./errors.js";
+import { PRODUCT_VERSION } from "../../product-cli.js";
+import { isRedirectResponse, readJsonBody, SafeHttpError } from "../../net/safe-http.js";
+import { validateBaseUrl } from "./source.js";
+const DEFAULT_TIMEOUT_MS = 15_000;
+// ── 手写响应校验（fail-closed，同 merchant-publications.ts 风格）────────────
+function requireObject(value, what) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new CatalogSourceError("contract_violation", `${what} must be a JSON object`);
+    }
+    return value;
+}
+function requireNonEmptyString(record, field, what) {
+    if (typeof record[field] !== "string" || record[field] === "") {
+        throw new CatalogSourceError("contract_violation", `${what} missing non-empty string field "${field}"`);
+    }
+}
+function optionalString(record, field, what) {
+    const v = record[field];
+    if (v !== undefined && v !== null && typeof v !== "string") {
+        throw new CatalogSourceError("contract_violation", `${what} field "${field}" must be a string when present`);
+    }
+}
+export function validateBuyerFollow(value) {
+    const record = requireObject(value, "BuyerFollow");
+    requireNonEmptyString(record, "merchant_id", "BuyerFollow");
+    requireNonEmptyString(record, "status", "BuyerFollow");
+    for (const field of [
+        "merchant_name",
+        "category",
+        "consent_version",
+        "created_at",
+        "last_seen_at",
+    ]) {
+        optionalString(record, field, "BuyerFollow");
+    }
+    return record;
+}
+export function validateMerchantPublicEvent(value) {
+    const record = requireObject(value, "MerchantPublicEvent");
+    requireNonEmptyString(record, "event_id", "MerchantPublicEvent");
+    requireNonEmptyString(record, "event_type", "MerchantPublicEvent");
+    requireNonEmptyString(record, "created_at", "MerchantPublicEvent");
+    optionalString(record, "publication_id", "MerchantPublicEvent");
+    if (record.version !== undefined &&
+        record.version !== null &&
+        typeof record.version !== "number") {
+        throw new CatalogSourceError("contract_violation", 'MerchantPublicEvent field "version" must be a number when present');
+    }
+    // payload 即商家公开投影（public-only 白名单由上游写入侧保证）；必须是对象。
+    requireObject(record.payload, "MerchantPublicEvent.payload");
+    return record;
+}
+export function validateFollowUpdateGroup(value) {
+    const record = requireObject(value, "FollowUpdateGroup");
+    requireNonEmptyString(record, "merchant_id", "FollowUpdateGroup");
+    optionalString(record, "merchant_name", "FollowUpdateGroup");
+    optionalString(record, "last_seen_at", "FollowUpdateGroup");
+    if (!Array.isArray(record.events)) {
+        throw new CatalogSourceError("contract_violation", 'FollowUpdateGroup missing array field "events"');
+    }
+    const events = record.events.map(validateMerchantPublicEvent);
+    return { ...record, events };
+}
+export class BuyerFollowsSource {
+    baseUrl;
+    deps;
+    constructor(deps) {
+        this.baseUrl = validateBaseUrl(deps.baseUrl);
+        this.deps = deps;
+    }
+    /**
+     * 核心请求：会话认证（cookie kiwi_session）；超时 / HTTP / 网络失败统一映射
+     * 为 CatalogSourceError；HTTP 401/403 → session_rejected（fail-closed，不伪造
+     * 身份、不静默降级为匿名）。
+     */
+    async request(method, requestPath, body) {
+        const sessionToken = this.deps.sessionToken;
+        if (sessionToken === undefined || sessionToken === "") {
+            throw new CatalogSourceError("session_rejected", "kiwi-catalog buyer session token is not configured");
+        }
+        const fetchImpl = this.deps.fetchImpl ?? globalThis.fetch;
+        const timeoutMs = this.deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const url = `${this.baseUrl}${requestPath}`;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        let response;
+        let raw;
+        try {
+            try {
+                response = await fetchImpl(url, {
+                    method,
+                    // 出站加固：绝不跟随重定向（3xx 目标不经过校验，且可能转发会话 cookie）。
+                    redirect: "manual",
+                    signal: controller.signal,
+                    headers: {
+                        accept: "application/json",
+                        "user-agent": `kiwi-buyer/${PRODUCT_VERSION}`,
+                        cookie: `kiwi_session=${sessionToken}`,
+                        ...(body !== undefined ? { "content-type": "application/json" } : {}),
+                        ...(this.deps.buyerId !== undefined ? { "x-buyer-id": this.deps.buyerId } : {}),
+                    },
+                    ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+                });
+            }
+            catch (err) {
+                const name = err?.name;
+                const detail = err instanceof Error ? err.message : String(err);
+                throw new CatalogSourceError("request_failed", name === "AbortError"
+                    ? `kiwi-catalog request timed out after ${timeoutMs}ms: ${url}`
+                    : `kiwi-catalog request failed: ${url} (${detail})`);
+            }
+            if (isRedirectResponse(response)) {
+                throw new CatalogSourceError("request_failed", `kiwi-catalog request must not follow redirects (HTTP ${response.status} from ${url})`);
+            }
+            if (response.status === 401 || response.status === 403) {
+                throw new CatalogSourceError("session_rejected", `kiwi-catalog buyer session rejected (HTTP ${response.status}) from ${url}`);
+            }
+            if (!response.ok) {
+                throw new CatalogSourceError("request_failed", `kiwi-catalog request returned HTTP ${response.status} from ${url}`);
+            }
+            try {
+                raw = await readJsonBody(response, { signal: controller.signal });
+            }
+            catch (err) {
+                if (controller.signal.aborted) {
+                    throw new CatalogSourceError("request_failed", `kiwi-catalog request timed out after ${timeoutMs}ms while reading response: ${url}`);
+                }
+                throw new CatalogSourceError("response_invalid", err instanceof SafeHttpError && err.code === "response_too_large"
+                    ? `kiwi-catalog response from ${url}: ${err.message}`
+                    : `kiwi-catalog response from ${url} is not valid JSON`);
+            }
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        return raw;
+    }
+    /** 显式关注（幂等；可选 category/consent_version）。仅买家主动调用构成订阅。 */
+    async follow(merchantId, opts) {
+        if (typeof merchantId !== "string" || merchantId === "") {
+            throw new CatalogSourceError("invalid_input", "merchantId must be a non-empty string");
+        }
+        const raw = await this.request("PUT", `/v1/me/follows/${encodeURIComponent(merchantId)}`, {
+            ...(opts?.category !== undefined ? { category: opts.category } : {}),
+            ...(opts?.consent_version !== undefined ? { consent_version: opts.consent_version } : {}),
+        });
+        const body = requireObject(raw, "follow response");
+        if (body.follow === undefined) {
+            throw new CatalogSourceError("response_invalid", 'follow response is missing field "follow"');
+        }
+        if (typeof body.created !== "boolean") {
+            throw new CatalogSourceError("response_invalid", 'follow response field "created" must be a boolean');
+        }
+        return { follow: validateBuyerFollow(body.follow), created: body.created };
+    }
+    /** 取消关注（幂等；无活跃关注同样 ok）。 */
+    async unfollow(merchantId) {
+        if (typeof merchantId !== "string" || merchantId === "") {
+            throw new CatalogSourceError("invalid_input", "merchantId must be a non-empty string");
+        }
+        const raw = await this.request("DELETE", `/v1/me/follows/${encodeURIComponent(merchantId)}`);
+        const body = requireObject(raw, "unfollow response");
+        if (body.following !== false) {
+            throw new CatalogSourceError("response_invalid", 'unfollow response field "following" must be false');
+        }
+        requireNonEmptyString(body, "merchant_id", "unfollow response");
+        return { merchant_id: body.merchant_id, following: false };
+    }
+    /** 我的活跃关注列表（cancelled 不在其列）。 */
+    async listFollows() {
+        const raw = await this.request("GET", "/v1/me/follows");
+        const body = requireObject(raw, "list follows response");
+        if (!Array.isArray(body.follows)) {
+            throw new CatalogSourceError("response_invalid", 'list follows response is missing array field "follows"');
+        }
+        return body.follows.map(validateBuyerFollow);
+    }
+    /**
+     * 主动拉取关注更新：仅响应买家主动查询。水位语义在上游（返回什么再推进
+     * last_seen_at，不丢不重）；本客户端原样透传分组，不本地过滤、不缓存重放。
+     */
+    async getUpdates() {
+        const raw = await this.request("GET", "/v1/me/follows/updates");
+        const body = requireObject(raw, "follow updates response");
+        if (!Array.isArray(body.updates)) {
+            throw new CatalogSourceError("response_invalid", 'follow updates response is missing array field "updates"');
+        }
+        return body.updates.map(validateFollowUpdateGroup);
+    }
+}
+//# sourceMappingURL=buyer-follows.js.map

package/dist/discovery/catalog-source/buyer-follows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buyer-follows.js","sourceRoot":"","sources":["../../../src/discovery/catalog-source/buyer-follows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAwClC,mEAAmE;AAEnE,SAAS,aAAa,CAAC,KAAc,EAAE,IAAY;IACjD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,GAAG,IAAI,wBAAwB,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,qBAAqB,CAAC,MAA+B,EAAE,KAAa,EAAE,IAAY;IACzF,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9D,MAAM,IAAI,kBAAkB,CAC1B,oBAAoB,EACpB,GAAG,IAAI,oCAAoC,KAAK,GAAG,CACpD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAA+B,EAAE,KAAa,EAAE,IAAY;IAClF,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,kBAAkB,CAC1B,oBAAoB,EACpB,GAAG,IAAI,WAAW,KAAK,iCAAiC,CACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACnD,qBAAqB,CAAC,MAAM,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;IAC5D,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IACvD,KAAK,MAAM,KAAK,IAAI;QAClB,eAAe;QACf,UAAU;QACV,iBAAiB;QACjB,YAAY;QACZ,cAAc;KACf,EAAE,CAAC;QACF,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,MAAsC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IAC3D,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;IACjE,qBAAqB,CAAC,MAAM,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC;IACnE,qBAAqB,CAAC,MAAM,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC;IACnE,cAAc,CAAC,MAAM,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;IAChE,IACE,MAAM,CAAC,OAAO,KAAK,SAAS;QAC5B,MAAM,CAAC,OAAO,KAAK,IAAI;QACvB,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAClC,CAAC;QACD,MAAM,IAAI,kBAAkB,CAC1B,oBAAoB,EACpB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,kDAAkD;IAClD,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;IAC7D,OAAO,MAAwC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IACzD,qBAAqB,CAAC,MAAM,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;IAClE,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;IAC7D,cAAc,CAAC,MAAM,EAAE,cAAc,EAAE,mBAAmB,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,kBAAkB,CAC1B,oBAAoB,EACpB,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC9D,OAAO,EAAE,GAAI,MAA4C,EAAE,MAAM,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,OAAO,kBAAkB;IACZ,OAAO,CAAS;IAChB,IAAI,CAAyB;IAE9C,YAAY,IAA4B;QACtC,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,WAAmB,EAAE,IAAc;QACvE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;QAC5C,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,oDAAoD,CACrD,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;QAC5D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,WAAW,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,QAAkB,CAAC;QACvB,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;oBAC9B,MAAM;oBACN,4CAA4C;oBAC5C,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,OAAO,EAAE;wBACP,MAAM,EAAE,kBAAkB;wBAC1B,YAAY,EAAE,cAAc,eAAe,EAAE;wBAC7C,MAAM,EAAE,gBAAgB,YAAY,EAAE;wBACtC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACrE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAChF;oBACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAI,GAAgC,EAAE,IAAI,CAAC;gBACrD,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAChE,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,EAChB,IAAI,KAAK,YAAY;oBACnB,CAAC,CAAC,wCAAwC,SAAS,OAAO,GAAG,EAAE;oBAC/D,CAAC,CAAC,gCAAgC,GAAG,KAAK,MAAM,GAAG,CACtD,CAAC;YACJ,CAAC;YACD,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,EAChB,wDAAwD,QAAQ,CAAC,MAAM,SAAS,GAAG,GAAG,CACvF,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvD,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,6CAA6C,QAAQ,CAAC,MAAM,UAAU,GAAG,EAAE,CAC5E,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,EAChB,sCAAsC,QAAQ,CAAC,MAAM,SAAS,GAAG,EAAE,CACpE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC9B,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,EAChB,wCAAwC,SAAS,8BAA8B,GAAG,EAAE,CACrF,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,oBAAoB;oBAC/D,CAAC,CAAC,8BAA8B,GAAG,KAAK,GAAG,CAAC,OAAO,EAAE;oBACrD,CAAC,CAAC,8BAA8B,GAAG,oBAAoB,CAC1D,CAAC;YACJ,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,MAAM,CACV,UAAkB,EAClB,IAAsD;QAEtD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,kBAAkB,kBAAkB,CAAC,UAAU,CAAC,EAAE,EAAE;YACxF,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,IAAI,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1F,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,2CAA2C,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC7E,CAAC;IAED,2BAA2B;IAC3B,KAAK,CAAC,QAAQ,CAAC,UAAkB;QAC/B,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7F,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YAC7B,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,qBAAqB,CAAC,IAAI,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;QAChE,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAqB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACvE,CAAC;IAED,gCAAgC;IAChC,KAAK,CAAC,WAAW;QACf,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACrD,CAAC;CACF"}

package/dist/discovery/catalog-source/connector-identity.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** 授权请求（入口持有；login_url 是给商家浏览器打开的地址）。 */
+export interface ConnectorIdentityRequest {
+    readonly requestId: string;
+    readonly loginUrl: string;
+    readonly expiresAt: string;
+}
+/**
+ * 身份兑换时同时签发的商家作用域凭据（目录侧 schema v32）。
+ *
+ * 入口用它代表**该商家**调用目录的商家接口（公开资料草稿/状态/撤回）；发布
+ * 仍须商家在目录门户确认页批准，凭据本身不能把 draft 变成 published。
+ */
+export interface ConnectorMerchantCredential {
+    readonly accessToken: string;
+    readonly scope: string;
+    readonly expiresAt: string;
+}
+/** 兑换结果：已验证的商家身份（唯一可信来源）+ 该商家的作用域凭据。 */
+export interface ConnectorIdentity {
+    readonly merchantId: string;
+    readonly merchantName: string;
+    readonly credential: ConnectorMerchantCredential;
+}
+/**
+ * 入口需要的身份能力。测试与部署可注入不同实现；生产实现是本文件的
+ * HTTP 客户端。
+ */
+export interface CatalogIdentityProvider {
+    createRequest(input: {
+        returnUrl: string;
+        clientLabel?: string;
+    }): Promise<ConnectorIdentityRequest>;
+    exchange(input: {
+        requestId: string;
+        code: string;
+    }): Promise<ConnectorIdentity>;
+}
+export interface CatalogConnectorIdentityDeps {
+    /** Catalog 服务根 URL（http/https）。 */
+    baseUrl: string;
+    /** 连接器机器凭据（catalog 侧 KIWI_CATALOG_CONNECTOR_TOKEN）。 */
+    connectorToken: string;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}
+export declare class CatalogConnectorIdentityClient implements CatalogIdentityProvider {
+    private readonly baseUrl;
+    private readonly connectorToken;
+    private readonly deps;
+    constructor(deps: CatalogConnectorIdentityDeps);
+    createRequest(input: {
+        returnUrl: string;
+        clientLabel?: string;
+    }): Promise<ConnectorIdentityRequest>;
+    exchange(input: {
+        requestId: string;
+        code: string;
+    }): Promise<ConnectorIdentity>;
+    private postJson;
+}

package/dist/discovery/catalog-source/connector-identity.js

@@ -0,0 +1,175 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * CatalogConnectorIdentityClient —— kiwi-catalog 一次性身份授权（连接器侧）。
+ *
+ *   POST {baseUrl}/v1/connector-identity/requests
+ *        {return_url, client_label?} → {ok, request:{request_id, expires_at}, login_url}
+ *   POST {baseUrl}/v1/connector-identity/exchange
+ *        {request_id, code}         → {ok, identity:{merchant_id, merchant_name}}
+ *
+ * 契约来源：kiwi-catalog 仓 kiwi_catalog/api/handlers/connector_identity.py
+ * （schema v31；merchant-buddy 第 1 版设计 §3.2 / 商家连接器发布计划 §3.1）。
+ * 调用方是**商家连接器**的远程入口——买方连接器（`kiwi-sourcing`，本地
+ * stdio）不使用本接口。
+ *
+ * 硬边界（fail-closed，调用方不得吞掉错误）：
+ *   - merchant_id 只能来自 exchange 的返回值——绝不从工具参数、URL 或
+ *     客户端自述值推断（商家连接器入口的租户判定唯一来源）；
+ *   - 出站加固与既有 catalog 客户端一致：不跟随重定向（3xx 可能转发凭据）、
+ *     超时、响应大小上限、响应结构逐字段校验。
+ *
+ * connector token（`KIWI_CATALOG_CONNECTOR_TOKEN`）是入口与目录之间的机器
+ * 凭据：它只够创建/兑换一次性授权请求，不能读写任何商家数据（目录侧在
+ * 商家确认前不会为该请求绑定 merchant_id）。
+ */
+import { PRODUCT_VERSION } from "../../product-cli.js";
+import { isRedirectResponse, readJsonBody } from "../../net/safe-http.js";
+import { CatalogSourceError } from "./errors.js";
+import { validateBaseUrl } from "./source.js";
+const DEFAULT_TIMEOUT_MS = 15_000;
+function nonEmptyString(value, field) {
+    if (typeof value !== "string" || value.trim() === "") {
+        throw new CatalogSourceError("response_invalid", `connector-identity response is missing non-empty string field "${field}"`);
+    }
+    return value;
+}
+export class CatalogConnectorIdentityClient {
+    baseUrl;
+    connectorToken;
+    deps;
+    constructor(deps) {
+        this.baseUrl = validateBaseUrl(deps.baseUrl);
+        if (typeof deps.connectorToken !== "string" || deps.connectorToken.trim() === "") {
+            throw new CatalogSourceError("invalid_input", "connector-identity client requires a non-empty connector token");
+        }
+        this.connectorToken = deps.connectorToken;
+        this.deps = deps;
+    }
+    async createRequest(input) {
+        const body = await this.postJson("/v1/connector-identity/requests", {
+            return_url: input.returnUrl,
+            ...(input.clientLabel !== undefined ? { client_label: input.clientLabel } : {}),
+        });
+        const request = body.request;
+        if (request === null || typeof request !== "object" || Array.isArray(request)) {
+            throw new CatalogSourceError("response_invalid", 'connector-identity response is missing object field "request"');
+        }
+        const record = request;
+        const loginUrl = nonEmptyString(body.login_url, "login_url");
+        let parsedLoginUrl;
+        try {
+            parsedLoginUrl = new URL(loginUrl);
+        }
+        catch {
+            throw new CatalogSourceError("response_invalid", "connector-identity login_url is not an absolute URL");
+        }
+        if (parsedLoginUrl.protocol !== "https:" && parsedLoginUrl.protocol !== "http:") {
+            throw new CatalogSourceError("response_invalid", `connector-identity login_url must use http or https (got ${parsedLoginUrl.protocol})`);
+        }
+        return {
+            requestId: nonEmptyString(record.request_id, "request.request_id"),
+            loginUrl,
+            expiresAt: nonEmptyString(record.expires_at, "request.expires_at"),
+        };
+    }
+    async exchange(input) {
+        const body = await this.postJson("/v1/connector-identity/exchange", {
+            request_id: input.requestId,
+            code: input.code,
+        });
+        const identity = body.identity;
+        if (identity === null || typeof identity !== "object" || Array.isArray(identity)) {
+            throw new CatalogSourceError("response_invalid", 'connector-identity response is missing object field "identity"');
+        }
+        const record = identity;
+        const credential = body.credential;
+        if (credential === null || typeof credential !== "object" || Array.isArray(credential)) {
+            throw new CatalogSourceError("response_invalid", 'connector-identity response is missing object field "credential"');
+        }
+        const credentialRecord = credential;
+        return {
+            merchantId: nonEmptyString(record.merchant_id, "identity.merchant_id"),
+            // 商家名允许为空字符串（未填名称的账号），不做非空校验。
+            merchantName: typeof record.merchant_name === "string" ? record.merchant_name : "",
+            credential: {
+                accessToken: nonEmptyString(credentialRecord.access_token, "credential.access_token"),
+                scope: typeof credentialRecord.scope === "string" ? credentialRecord.scope : "",
+                expiresAt: nonEmptyString(credentialRecord.expires_at, "credential.expires_at"),
+            },
+        };
+    }
+    async postJson(requestPath, body) {
+        const fetchImpl = this.deps.fetchImpl ?? globalThis.fetch;
+        const timeoutMs = this.deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const url = `${this.baseUrl}${requestPath}`;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        let response;
+        let raw;
+        try {
+            try {
+                response = await fetchImpl(url, {
+                    method: "POST",
+                    // 出站加固：绝不跟随重定向（3xx 目标不经过校验，且可能转发凭据）。
+                    redirect: "manual",
+                    signal: controller.signal,
+                    headers: {
+                        accept: "application/json",
+                        "content-type": "application/json",
+                        authorization: `Bearer ${this.connectorToken}`,
+                        "user-agent": `kiwi-connector/${PRODUCT_VERSION}`,
+                    },
+                    body: JSON.stringify(body),
+                });
+            }
+            catch (err) {
+                const name = err?.name;
+                const detail = err instanceof Error ? err.message : String(err);
+                throw new CatalogSourceError("request_failed", name === "AbortError"
+                    ? `kiwi-catalog connector request timed out after ${timeoutMs}ms: ${url}`
+                    : `kiwi-catalog connector request failed: ${url} (${detail})`);
+            }
+            if (isRedirectResponse(response)) {
+                throw new CatalogSourceError("request_failed", `kiwi-catalog connector request must not follow redirects (HTTP ${response.status} from ${url})`);
+            }
+            if (response.status === 401 || response.status === 403) {
+                throw new CatalogSourceError("session_rejected", `kiwi-catalog rejected the connector credential (HTTP ${response.status} from ${url})`);
+            }
+            if (!response.ok) {
+                throw new CatalogSourceError("request_failed", `kiwi-catalog connector request returned HTTP ${response.status} from ${url}`);
+            }
+            try {
+                raw = await readJsonBody(response, { signal: controller.signal });
+            }
+            catch {
+                throw new CatalogSourceError("response_invalid", `kiwi-catalog connector response from ${url} is not valid JSON`);
+            }
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+            throw new CatalogSourceError("response_invalid", "connector-identity response must be a JSON object");
+        }
+        const envelope = raw;
+        if (envelope.ok !== true) {
+            throw new CatalogSourceError("response_invalid", `connector-identity response is not ok: ${typeof envelope.error === "string" ? envelope.error : "unknown error"}`);
+        }
+        return envelope;
+    }
+}
+//# sourceMappingURL=connector-identity.js.map

package/dist/discovery/catalog-source/connector-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-identity.js","sourceRoot":"","sources":["../../../src/discovery/catalog-source/connector-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAwClC,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,kEAAkE,KAAK,GAAG,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAWD,MAAM,OAAO,8BAA8B;IACxB,OAAO,CAAS;IAChB,cAAc,CAAS;IACvB,IAAI,CAA+B;IAEpD,YAAY,IAAkC;QAC5C,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACjF,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAGnB;QACC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE;YAClE,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,OAAkC,CAAC;QAClD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC7D,IAAI,cAAmB,CAAC;QACxB,IAAI,CAAC;YACH,cAAc,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,IAAI,cAAc,CAAC,QAAQ,KAAK,QAAQ,IAAI,cAAc,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChF,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,4DAA4D,cAAc,CAAC,QAAQ,GAAG,CACvF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,oBAAoB,CAAC;YAClE,QAAQ;YACR,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,oBAAoB,CAAC;SACnE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAA0C;QACvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE;YAClE,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,QAAmC,CAAC;QACnD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,gBAAgB,GAAG,UAAqC,CAAC;QAC/D,OAAO;YACL,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,sBAAsB,CAAC;YACtE,8BAA8B;YAC9B,YAAY,EAAE,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;YAClF,UAAU,EAAE;gBACV,WAAW,EAAE,cAAc,CAAC,gBAAgB,CAAC,YAAY,EAAE,yBAAyB,CAAC;gBACrF,KAAK,EAAE,OAAO,gBAAgB,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAC/E,SAAS,EAAE,cAAc,CAAC,gBAAgB,CAAC,UAAU,EAAE,uBAAuB,CAAC;aAChF;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,WAAmB,EACnB,IAA6B;QAE7B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;QAC5D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,WAAW,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,QAAkB,CAAC;QACvB,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;oBAC9B,MAAM,EAAE,MAAM;oBACd,qCAAqC;oBACrC,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,OAAO,EAAE;wBACP,MAAM,EAAE,kBAAkB;wBAC1B,cAAc,EAAE,kBAAkB;wBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,cAAc,EAAE;wBAC9C,YAAY,EAAE,kBAAkB,eAAe,EAAE;qBAClD;oBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;iBAC3B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAI,GAAgC,EAAE,IAAI,CAAC;gBACrD,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAChE,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,EAChB,IAAI,KAAK,YAAY;oBACnB,CAAC,CAAC,kDAAkD,SAAS,OAAO,GAAG,EAAE;oBACzE,CAAC,CAAC,0CAA0C,GAAG,KAAK,MAAM,GAAG,CAChE,CAAC;YACJ,CAAC;YACD,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,EAChB,kEAAkE,QAAQ,CAAC,MAAM,SAAS,GAAG,GAAG,CACjG,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvD,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,wDAAwD,QAAQ,CAAC,MAAM,SAAS,GAAG,GAAG,CACvF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,EAChB,gDAAgD,QAAQ,CAAC,MAAM,SAAS,GAAG,EAAE,CAC9E,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YACpE,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,wCAAwC,GAAG,oBAAoB,CAChE,CAAC;YACJ,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,GAA8B,CAAC;QAChD,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,0CAA0C,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,EAAE,CAClH,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/discovery/catalog-source/errors.d.ts

@@ -23,7 +23,7 @@
  *   - contract_violation 候选元素未通过 CandidateAgent DTO schema 校验，或 contract
  *                        注解非 candidate-agent / 非 1.x（视为协议级违规）。
  */
-export declare const CATALOG_SOURCE_ERROR_CODES: readonly ["invalid_input", "request_failed", "response_invalid", "contract_violation"];
+export declare const CATALOG_SOURCE_ERROR_CODES: readonly ["invalid_input", "request_failed", "response_invalid", "contract_violation", "session_rejected"];
 export type CatalogSourceErrorCode = (typeof CATALOG_SOURCE_ERROR_CODES)[number];
 /** Catalog 读取失败。带错误码；fail-closed，调用方不得吞掉。 */
 export declare class CatalogSourceError extends Error {

package/dist/discovery/catalog-source/errors.js

@@ -28,6 +28,8 @@ export const CATALOG_SOURCE_ERROR_CODES = [
     "request_failed",
     "response_invalid",
     "contract_violation",
+    /** 会话认证端点拒绝了买家会话（HTTP 401/403）：登录态缺失或已过期。 */
+    "session_rejected",
 ];
 /** Catalog 读取失败。带错误码；fail-closed，调用方不得吞掉。 */
 export class CatalogSourceError extends Error {

package/dist/discovery/catalog-source/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/discovery/catalog-source/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,eAAe;IACf,gBAAgB;IAChB,kBAAkB;IAClB,oBAAoB;CACZ,CAAC;AAIX,6CAA6C;AAC7C,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAyB;IAEtC,YAAY,IAA4B,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/discovery/catalog-source/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,eAAe;IACf,gBAAgB;IAChB,kBAAkB;IAClB,oBAAoB;IACpB,6CAA6C;IAC7C,kBAAkB;CACV,CAAC;AAIX,6CAA6C;AAC7C,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAyB;IAEtC,YAAY,IAA4B,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/discovery/catalog-source/kiwi-record.d.ts

@@ -163,6 +163,8 @@ export interface ListingSearchResult {
  */
 export interface KiwiListingSearchQuery {
     q?: string;
+    /** 精确限定 listing owner，避免先做全局限量搜索再在本地过滤。 */
+    owner_agent_id?: string;
     listing_type?: ListingType;
     category?: string;
     brand?: string;

package/dist/discovery/catalog-source/kiwi-record.js.map

@@ -1 +1 @@
-{"version":3,"file":"kiwi-record.js","sourceRoot":"","sources":["../../../src/discovery/catalog-source/kiwi-record.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAmMH,mCAAmC;AACnC,SAAS,sBAAsB,CAC7B,KAAwB,EACxB,SAAyB,EACzB,KAA0B;IAE1B,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAC5C,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC;IAC9C,IAAI,SAAS,KAAK,aAAa;QAAE,OAAO,aAAa,CAAC;IACtD,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,MAAM,SAAS,GAAmB;QAChC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,QAAQ,EAAE;YACR,EAAE,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,gBAAgB;YACjD,IAAI,EAAE,MAAM,CAAC,YAAY;YACzB,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF;QACD,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS;YAC7E,CAAC,CAAC;gBACE,SAAS,EAAE;oBACT,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzF,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC7F;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS;YAChC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAqC,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS;YAC7B,CAAC,CAAC;gBACE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAChC,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;aACJ;YACH,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,EAAE;YACZ,MAAM,EAAE,sBAAsB,CAC5B,MAAM,CAAC,kBAAkB,EACzB,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,oBAAoB,CAC5B;YACD,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChG;QACD,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE;QACtC,QAAQ,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE;KACtD,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"kiwi-record.js","sourceRoot":"","sources":["../../../src/discovery/catalog-source/kiwi-record.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAqMH,mCAAmC;AACnC,SAAS,sBAAsB,CAC7B,KAAwB,EACxB,SAAyB,EACzB,KAA0B;IAE1B,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAC5C,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC;IAC9C,IAAI,SAAS,KAAK,aAAa;QAAE,OAAO,aAAa,CAAC;IACtD,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,MAAM,SAAS,GAAmB;QAChC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,QAAQ,EAAE;YACR,EAAE,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,gBAAgB;YACjD,IAAI,EAAE,MAAM,CAAC,YAAY;YACzB,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF;QACD,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS;YAC7E,CAAC,CAAC;gBACE,SAAS,EAAE;oBACT,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzF,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC7F;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS;YAChC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAqC,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS;YAC7B,CAAC,CAAC;gBACE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAChC,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;aACJ;YACH,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,EAAE;YACZ,MAAM,EAAE,sBAAsB,CAC5B,MAAM,CAAC,kBAAkB,EACzB,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,oBAAoB,CAC5B;YACD,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChG;QACD,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE;QACtC,QAAQ,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE;KACtD,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC"}