@lark-base-open/base-database-app-sdk 0.0.0-stage → 0.0.1-alpha.1

package/dist/server.js

@@ -0,0 +1 @@
+import{a as y}from"./chunk-3JX3FIBG.js";var d=t=>typeof t=="object"&&t!==null&&!Array.isArray(t),w=t=>typeof t=="string"&&/^rec[A-Za-z0-9]{1,32}$/.test(t);function O(t){let a=new Set,i=e=>{if(!(e===null||typeof e=="string"||typeof e=="boolean"||typeof e=="number"&&Number.isFinite(e))){if(typeof e!="object"||!e||a.has(e)||Array.isArray(e)&&Object.getPrototypeOf(e)!==Array.prototype||!Array.isArray(e)&&Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null||Array.isArray(e)&&(Object.keys(e).length!==e.length||Object.keys(e).some((r,n)=>r!==String(n))))throw 0;a.add(e);for(let r of Reflect.ownKeys(e)){if(Array.isArray(e)&&r==="length")continue;if(typeof r!="string")throw 0;let n=Object.getOwnPropertyDescriptor(e,r);if(!n.enumerable||!("value"in n))throw 0;i(n.value)}a.delete(e)}};try{i(t)}catch{throw new y("SDK_OUTPUT_NOT_JSON","\u8F93\u51FA\u5FC5\u987B\u662F\u65E0\u635F JSON \u503C")}}function x(t,a,i){return{status:"unknown",code:t,retryable:!1,...a?{requestedIds:[...a]}:{},...i?{logid:i}:{}}}var P=t=>typeof t=="number"&&[401,403,404,91403,1254302,1254043,1254044].includes(t),I=t=>({status:"failed",code:"SDK_RECORDS_REJECTED",upstreamCode:t,retryable:!1,appliedIds:[]}),F=t=>Array.isArray(t)&&t.every(w)&&new Set(t).size===t.length;function _(t,a){let i=()=>x("SDK_RECORDS_RESULT_UNKNOWN",a.requestedIds);if(d(t)&&P(t.code))return I(t.code);if(!d(t)||t.code!==0||!d(t.data))return i();let e=t.data,r=e.ignored_fields??[];if(!Array.isArray(r)||!r.every(s=>d(s)&&["id","name","reason"].every(o=>typeof s[o]=="string")))return i();let n=e.record_not_found??[];if(!F(n))return i();let c=a.requestedIds??[],u,m;if(a.operation==="appendAttachments"||a.operation==="removeAttachments"){if(!d(e.attachments))return i();try{O(e.attachments)}catch{return i()}for(let[s,o]of Object.entries(e.attachments)){if(!w(s)||!c.includes(s)||!d(o)||!Object.keys(o).length)return i();for(let[p,f]of Object.entries(o))if(!/^fld[A-Za-z0-9]+$/.test(p)||!Array.isArray(f)||!f.every(g=>d(g)&&typeof g.file_token=="string"&&g.file_token.length>0))return i()}if(u=Object.keys(e.attachments),n.some(s=>!c.includes(s)||u.includes(s))||!r.length&&c.some(s=>!u.includes(s)&&!n.includes(s)))return i();m=e.attachments}else{if(!F(e.record_id_list))return i();let s=e.record_id_list;if(a.operation==="create"){if(s.length!==a.count||Object.hasOwn(e,"record_not_found"))return i();u=s}else if(a.operation==="update"){if(s.some(o=>!c.includes(o)||n.includes(o))||n.some(o=>!c.includes(o))||s.length+n.length!==c.length)return i();u=s}else{if(s.length!==c.length||s.some((o,p)=>o!==c[p])||n.some(o=>!c.includes(o)))return i();u=s.filter(o=>!n.includes(o))}}let l=m===void 0?{}:{attachments:m};return n.length||r.length?{status:"partial",appliedIds:u,notFoundIds:n,ignoredFields:r,...l}:{status:"success",appliedIds:u,notFoundIds:[],ignoredFields:[],...l}}var C={create:"records/batch_create",update:"records/batch_update",delete:"records/batch_delete",appendAttachments:"append_attachments",removeAttachments:"remove_attachments"},S=t=>({status:"failed",code:t,retryable:!1,appliedIds:[]});function j(t){if(t?.platformEnv==="online")return t.brand==="feishu"?"https://open.feishu.cn":t.brand==="lark"?"https://open.larksuite.com":void 0;if(t?.brand==="feishu"){if(t.platformEnv==="pre")return"https://open.feishu-pre.cn";if(t.platformEnv==="boe")return"https://open.feishu-boe.cn"}}function E(t,a){let i=async(e,r,n,c)=>{if(!a)return S("SDK_RUNTIME_PROFILE_MISSING");let u=j(a);if(!u)return S("SDK_RUNTIME_PROFILE_UNSUPPORTED");if(c?.signal?.aborted)return S("SDK_CANCELLED");let m,l,s;try{if(!d(r)||typeof r.baseToken!="string"||typeof r.tableId!="string"||!/^[A-Za-z0-9]+$/.test(r.baseToken)||!/^tbl[A-Za-z0-9]+$/.test(r.tableId))throw 0;if(O(n),e==="create"){if(!Array.isArray(n)||!n.every(d))throw 0;s=n.length,m={create_records:n}}else if(e==="update"){if(!d(n)||!Object.values(n).every(d))throw 0;l=Object.keys(n),s=l.length,m={update_records:n}}else if(e==="delete"){if(!Array.isArray(n)||!n.every(w))throw 0;l=n,s=n.length,m={record_id_list:n}}else{if(!d(n))throw 0;let o=Object.create(null),p=0;for(let[f,g]of Object.entries(n)){if(!w(f)||!d(g))throw 0;for(let[A,b]of Object.entries(g)){if(!A.trim()||!Array.isArray(b))throw 0;for(let h of b){if(!d(h)||typeof h.file_token!="string"||!h.file_token.trim()||Object.keys(h).some(R=>!["file_token",...e==="appendAttachments"?["image_width","image_height"]:[]].includes(R)))throw 0;for(let R of["image_width","image_height"])if(h[R]!==void 0&&(typeof h[R]!="number"||!Number.isInteger(h[R])||h[R]<=0))throw 0}p+=b.length,b.length&&(o[f]??=Object.create(null),o[f][A]=b)}}if(p>50)throw 0;if(!p)return{status:"success",appliedIds:[],notFoundIds:[],ignoredFields:[],noop:!0};l=Object.keys(o),m={attachments:o}}if(s!==void 0&&(s<1||s>200)||l&&(!l.every(w)||new Set(l).size!==l.length))throw 0}catch{return S("SDK_RECORDS_INPUT_INVALID")}try{let o=await t.fetch(`${u}/open-apis/bitable/v1/apps/${encodeURIComponent(r.baseToken)}/tables/${encodeURIComponent(r.tableId)}/${C[e]}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(m),signal:c?.signal}),p=o.headers.get("x-tt-logid")??void 0;if([401,403,404].includes(o.status))return I(o.status);if(!o.ok)return x("SDK_RECORDS_HTTP_ERROR",l,p);let f=_(await o.json(),{operation:e,requestedIds:l,count:s});return f.status==="unknown"&&p?{...f,logid:p}:f}catch(o){let p=o instanceof Error?o.name:"";return x(p==="AbortError"?"SDK_CANCELLED":p==="TimeoutError"?"SDK_TIMEOUT":"SDK_RECORDS_RESULT_UNKNOWN",l)}};return Object.fromEntries(Object.keys(C).map(e=>[e,(r,n,c)=>i(e,r,n,c)]))}var T=Symbol("base-database-runtime-profile");function N(t,a){let i=Object.freeze({platformEnv:a.platformEnv,brand:a.brand});return function(e,r){let n=Object.defineProperty({...r},T,{value:i});return t.call(this,e,n)}}function k(t){return{...t,records:E(t,t[T])}}async function D(t,a,i){let e;try{e=await t["~standard"].validate(a)}catch{throw new y("SDK_VALIDATOR_FAILED","Schema \u6821\u9A8C\u5668\u6267\u884C\u5931\u8D25")}if(e.issues){let r=e.issues.map(n=>(n.path??[]).map(c=>{let u=typeof c=="object"?c.key:c;return typeof u=="number"||typeof u=="string"?u:"[symbol]"}));throw new y(`SDK_${i}_INVALID`,i==="INPUT"?"\u8F93\u5165\u4E0D\u7B26\u5408\u5951\u7EA6":"\u8F93\u51FA\u4E0D\u7B26\u5408\u5951\u7EA6",{paths:r})}return e.value}function K(t){return async(a,i)=>{try{let e=await D(t.input,a,"INPUT"),r=await t.handler(e,k(i)),n=await D(t.output,r,"OUTPUT");return O(n),{code:0,msg:"success",data:n}}catch(e){let r=e instanceof y?e:new y("SDK_HANDLER_FAILED","\u51FD\u6570\u6267\u884C\u5931\u8D25");return console.error(JSON.stringify({source:"sdk",code:r.code,paths:r.paths,retryable:r.retryable,outcome:r.outcome})),{code:r.wireCode,msg:r.safeMessage}}}}export{y as SDKError,N as bindFunctionRuntime,k as createServerContext,K as defineFunction,_ as normalizeRecordsResult};

package/dist/shared.cjs

@@ -0,0 +1 @@
+"use strict";var p=Object.defineProperty;var b=Object.getOwnPropertyDescriptor;var c=Object.getOwnPropertyNames;var m=Object.prototype.hasOwnProperty;var C=(t,r)=>{for(var e in r)p(t,e,{get:r[e],enumerable:!0})},E=(t,r,e,n)=>{if(r&&typeof r=="object"||typeof r=="function")for(let o of c(r))!m.call(t,o)&&o!==e&&p(t,o,{get:()=>r[o],enumerable:!(n=b(r,o))||n.enumerable});return t};var A=t=>E(p({},"__esModule",{value:!0}),t);var T={};C(T,{CAPABILITY_CATALOG:()=>y.CAPABILITY_CATALOG,CapabilityUnavailableError:()=>d,DiagnosticCode:()=>a,SDKError:()=>i,classifyRuntimeError:()=>I});module.exports=A(T);var y=require("@lark-base-open/base-site-channel/capabilities");var u=Symbol.for("@lark-base-open/base-database-app-sdk/SDKError/v1"),i=class extends Error{constructor(e,n,o,l){super(n);this.code=e;this.name="SDKError",this.safeMessage=n;let s=typeof o=="object"?o:{};this.upstreamCode=typeof o=="string"?o:void 0,this.wireCode=Number.isSafeInteger(s.wireCode)&&s.wireCode!==0?s.wireCode:e==="SDK_TIMEOUT"?504:e==="SDK_CANCELLED"?499:e==="SDK_INPUT_INVALID"?400:500,this.retryable=s.retryable??l??!1,this.outcome=s.outcome??"failed",this.paths=s.paths??[]}[u]=!0;static[Symbol.hasInstance](e){return this!==i?Function.prototype[Symbol.hasInstance].call(this,e):e!==null&&typeof e=="object"&&e[u]===!0}wireCode;safeMessage;retryable;outcome;paths;upstreamCode};var a={HostUnsupported:"CAPABILITY_HOST_UNSUPPORTED",PermissionDenied:"CAPABILITY_PERMISSION_DENIED",RegionUnavailable:"CAPABILITY_REGION_UNAVAILABLE",TemporarilyUnavailable:"CAPABILITY_TEMPORARILY_UNAVAILABLE",ContextInvalid:"CAPABILITY_CONTEXT_INVALID",UnavailableUnknown:"CAPABILITY_UNAVAILABLE_UNKNOWN"},d=class extends i{constructor(e,n){super(a.HostUnsupported,`\u5F53\u524D\u5BBF\u4E3B\u4E0D\u652F\u6301 ${e} v${n}`);this.capability=e;this.minimumVersion=n;this.name="CapabilityUnavailableError"}};function I(t){let r=t&&typeof t=="object"?t:{},e=typeof r.code=="string"||typeof r.code=="number"?String(r.code):"UNKNOWN",n=a.UnavailableUnknown,o="unknown";[a.HostUnsupported,"10004","PROTOCOL_MISMATCH","ATTACHMENT_UNAVAILABLE","HTTP_RESPONSE_TYPE_UNSUPPORTED"].includes(e)?(n=a.HostUnsupported,o="host-unsupported"):[a.PermissionDenied,"403","PERMISSION_DENIED","FORBIDDEN","FUNCTION_NOT_ALLOWED"].includes(e)?(n=a.PermissionDenied,o="permission-denied"):[a.RegionUnavailable,"REGION_UNAVAILABLE","REGION_NOT_SUPPORTED"].includes(e)?(n=a.RegionUnavailable,o="region-unavailable"):[a.TemporarilyUnavailable,"REQUEST_TIMEOUT","10003","10005","HTTP_REQUEST_FAILED","FUNCTION_REQUEST_FAILED","STREAM_DISCONNECTED","STREAM_HEALTH_TIMEOUT","ATTACHMENT_UPLOAD_STALLED"].includes(e)?(n=a.TemporarilyUnavailable,o="temporary"):e===a.ContextInvalid&&(n=a.ContextInvalid,o="protocol");let l={"host-unsupported":"\u5F53\u524D\u5BBF\u4E3B\u4E0D\u652F\u6301\u6B64\u80FD\u529B","permission-denied":"\u5F53\u524D\u8EAB\u4EFD\u6216\u53D1\u5E03\u6E05\u5355\u4E0D\u5141\u8BB8\u6B64\u64CD\u4F5C","region-unavailable":"\u5BBF\u4E3B\u660E\u786E\u5F53\u524D\u533A\u57DF\u4E0D\u53EF\u7528",temporary:"\u8C03\u7528\u6682\u65F6\u5931\u8D25\uFF0C\u8BF7\u6838\u5BF9\u7ED3\u679C\u540E\u51B3\u5B9A\u662F\u5426\u91CD\u8BD5",protocol:"\u5BBF\u4E3B\u80FD\u529B\u5B57\u6BB5\u65E0\u6548",unknown:"\u8C03\u7528\u5931\u8D25\uFF0C\u539F\u56E0\u672A\u660E\u786E"};return{source:"sdk",code:n,upstreamCode:r.upstreamCode??e,category:o,retryable:o==="temporary"&&r.retryable!==!1,message:l[o],redaction:"\u539F\u59CB\u9519\u8BEF\u6D88\u606F\u548C\u4E1A\u52A1\u53C2\u6570\u5DF2\u7701\u7565"}}0&&(module.exports={CAPABILITY_CATALOG,CapabilityUnavailableError,DiagnosticCode,SDKError,classifyRuntimeError});

package/dist/shared.d.cts

@@ -0,0 +1,115 @@
+import { CAPABILITY_CATALOG } from '@lark-base-open/base-site-channel/capabilities';
+export { CAPABILITY_CATALOG } from '@lark-base-open/base-site-channel/capabilities';
+
+interface SDKErrorOptions {
+    wireCode?: number;
+    retryable?: boolean;
+    outcome?: "failed" | "unknown";
+    paths?: readonly (readonly (string | number)[])[];
+}
+/** message 必须是开发者提供的安全文案，不能包含原始错误或参数。 */
+declare const errorBrand: unique symbol;
+declare class SDKError extends Error {
+    readonly code: string;
+    private readonly [errorBrand];
+    static [Symbol.hasInstance](value: unknown): boolean;
+    readonly wireCode: number;
+    readonly safeMessage: string;
+    readonly retryable: boolean;
+    readonly outcome: "failed" | "unknown";
+    readonly paths: readonly (readonly (string | number)[])[];
+    readonly upstreamCode?: string;
+    constructor(code: string, message: string, options?: SDKErrorOptions | string, legacyRetryable?: boolean);
+}
+
+type JsonValue = null | boolean | number | string | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+interface FunctionEnvelope<T = unknown> {
+    code: number;
+    msg: string;
+    data?: T;
+}
+type IgnoredField = {
+    id: string;
+    name: string;
+    reason: string;
+};
+type WriteResult = {
+    status: "success";
+    appliedIds: string[];
+    notFoundIds: [];
+    ignoredFields: [];
+    attachments?: JsonValue;
+    noop?: boolean;
+} | {
+    status: "partial";
+    appliedIds: string[];
+    notFoundIds: string[];
+    ignoredFields: IgnoredField[];
+    attachments?: JsonValue;
+} | {
+    status: "failed";
+    code: string;
+    upstreamCode?: number;
+    retryable: false;
+    appliedIds: [];
+} | {
+    status: "unknown";
+    code: string;
+    retryable: false;
+    requestedIds?: string[];
+    logid?: string;
+};
+
+type CapabilityDescriptor = Readonly<{
+    version: number;
+}>;
+type CapabilityMap = Readonly<Record<string, CapabilityDescriptor>>;
+type RuntimeCapabilities = CapabilityMap;
+type CapabilityUnavailableReason = "permission-denied" | "region-unavailable" | "temporarily-unavailable";
+interface CapabilityContext {
+    capabilities?: CapabilityMap;
+    capabilityUnavailable?: Readonly<Record<string, {
+        reason: CapabilityUnavailableReason;
+        retryable: boolean;
+    }>>;
+}
+
+type CapabilityName = keyof typeof CAPABILITY_CATALOG;
+interface CapabilityQueryResult {
+    name: string;
+    requiredVersion: number;
+    version: number | null;
+    supported: boolean;
+    source: "advertised" | "host-baseline";
+    availability: "available" | "unknown" | CapabilityUnavailableReason | "unsupported";
+}
+declare const DiagnosticCode: {
+    readonly HostUnsupported: "CAPABILITY_HOST_UNSUPPORTED";
+    readonly PermissionDenied: "CAPABILITY_PERMISSION_DENIED";
+    readonly RegionUnavailable: "CAPABILITY_REGION_UNAVAILABLE";
+    readonly TemporarilyUnavailable: "CAPABILITY_TEMPORARILY_UNAVAILABLE";
+    readonly ContextInvalid: "CAPABILITY_CONTEXT_INVALID";
+    readonly UnavailableUnknown: "CAPABILITY_UNAVAILABLE_UNKNOWN";
+};
+type DiagnosticCategory = "host-unsupported" | "permission-denied" | "region-unavailable" | "temporary" | "protocol" | "unknown";
+interface RuntimeDiagnostic {
+    source: "sdk";
+    code: string;
+    upstreamCode?: string;
+    category: DiagnosticCategory;
+    retryable: boolean;
+    message: string;
+    redaction: "原始错误消息和业务参数已省略";
+}
+
+declare class CapabilityUnavailableError extends SDKError {
+    readonly capability: string;
+    readonly minimumVersion: number;
+    constructor(capability: string, minimumVersion: number);
+}
+/** 不解析 message 猜测原因；可恢复不代表写入可安全重试。 */
+declare function classifyRuntimeError(error: unknown): RuntimeDiagnostic;
+
+export { CapabilityContext, CapabilityDescriptor, CapabilityMap, CapabilityName, CapabilityQueryResult, CapabilityUnavailableError, CapabilityUnavailableReason, DiagnosticCategory, DiagnosticCode, FunctionEnvelope, JsonValue, RuntimeCapabilities, RuntimeDiagnostic, SDKError, SDKErrorOptions, WriteResult, classifyRuntimeError };

package/dist/shared.d.ts

@@ -0,0 +1,115 @@
+import { CAPABILITY_CATALOG } from '@lark-base-open/base-site-channel/capabilities';
+export { CAPABILITY_CATALOG } from '@lark-base-open/base-site-channel/capabilities';
+
+interface SDKErrorOptions {
+    wireCode?: number;
+    retryable?: boolean;
+    outcome?: "failed" | "unknown";
+    paths?: readonly (readonly (string | number)[])[];
+}
+/** message 必须是开发者提供的安全文案，不能包含原始错误或参数。 */
+declare const errorBrand: unique symbol;
+declare class SDKError extends Error {
+    readonly code: string;
+    private readonly [errorBrand];
+    static [Symbol.hasInstance](value: unknown): boolean;
+    readonly wireCode: number;
+    readonly safeMessage: string;
+    readonly retryable: boolean;
+    readonly outcome: "failed" | "unknown";
+    readonly paths: readonly (readonly (string | number)[])[];
+    readonly upstreamCode?: string;
+    constructor(code: string, message: string, options?: SDKErrorOptions | string, legacyRetryable?: boolean);
+}
+
+type JsonValue = null | boolean | number | string | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+interface FunctionEnvelope<T = unknown> {
+    code: number;
+    msg: string;
+    data?: T;
+}
+type IgnoredField = {
+    id: string;
+    name: string;
+    reason: string;
+};
+type WriteResult = {
+    status: "success";
+    appliedIds: string[];
+    notFoundIds: [];
+    ignoredFields: [];
+    attachments?: JsonValue;
+    noop?: boolean;
+} | {
+    status: "partial";
+    appliedIds: string[];
+    notFoundIds: string[];
+    ignoredFields: IgnoredField[];
+    attachments?: JsonValue;
+} | {
+    status: "failed";
+    code: string;
+    upstreamCode?: number;
+    retryable: false;
+    appliedIds: [];
+} | {
+    status: "unknown";
+    code: string;
+    retryable: false;
+    requestedIds?: string[];
+    logid?: string;
+};
+
+type CapabilityDescriptor = Readonly<{
+    version: number;
+}>;
+type CapabilityMap = Readonly<Record<string, CapabilityDescriptor>>;
+type RuntimeCapabilities = CapabilityMap;
+type CapabilityUnavailableReason = "permission-denied" | "region-unavailable" | "temporarily-unavailable";
+interface CapabilityContext {
+    capabilities?: CapabilityMap;
+    capabilityUnavailable?: Readonly<Record<string, {
+        reason: CapabilityUnavailableReason;
+        retryable: boolean;
+    }>>;
+}
+
+type CapabilityName = keyof typeof CAPABILITY_CATALOG;
+interface CapabilityQueryResult {
+    name: string;
+    requiredVersion: number;
+    version: number | null;
+    supported: boolean;
+    source: "advertised" | "host-baseline";
+    availability: "available" | "unknown" | CapabilityUnavailableReason | "unsupported";
+}
+declare const DiagnosticCode: {
+    readonly HostUnsupported: "CAPABILITY_HOST_UNSUPPORTED";
+    readonly PermissionDenied: "CAPABILITY_PERMISSION_DENIED";
+    readonly RegionUnavailable: "CAPABILITY_REGION_UNAVAILABLE";
+    readonly TemporarilyUnavailable: "CAPABILITY_TEMPORARILY_UNAVAILABLE";
+    readonly ContextInvalid: "CAPABILITY_CONTEXT_INVALID";
+    readonly UnavailableUnknown: "CAPABILITY_UNAVAILABLE_UNKNOWN";
+};
+type DiagnosticCategory = "host-unsupported" | "permission-denied" | "region-unavailable" | "temporary" | "protocol" | "unknown";
+interface RuntimeDiagnostic {
+    source: "sdk";
+    code: string;
+    upstreamCode?: string;
+    category: DiagnosticCategory;
+    retryable: boolean;
+    message: string;
+    redaction: "原始错误消息和业务参数已省略";
+}
+
+declare class CapabilityUnavailableError extends SDKError {
+    readonly capability: string;
+    readonly minimumVersion: number;
+    constructor(capability: string, minimumVersion: number);
+}
+/** 不解析 message 猜测原因；可恢复不代表写入可安全重试。 */
+declare function classifyRuntimeError(error: unknown): RuntimeDiagnostic;
+
+export { CapabilityContext, CapabilityDescriptor, CapabilityMap, CapabilityName, CapabilityQueryResult, CapabilityUnavailableError, CapabilityUnavailableReason, DiagnosticCategory, DiagnosticCode, FunctionEnvelope, JsonValue, RuntimeCapabilities, RuntimeDiagnostic, SDKError, SDKErrorOptions, WriteResult, classifyRuntimeError };

package/dist/shared.js

@@ -0,0 +1 @@
+import{a as b,b as c,c as d,d as e}from"./chunk-ZKBZAK4L.js";import{a}from"./chunk-3JX3FIBG.js";export{b as CAPABILITY_CATALOG,d as CapabilityUnavailableError,c as DiagnosticCode,a as SDKError,e as classifyRuntimeError};

package/dist/testing.d.ts

@@ -0,0 +1,74 @@
+import { SiteRuntimeApi } from '@lark-base-open/base-site-channel/runtime-contract';
+import { RuntimeChannel } from '@lark-base-open/base-site-channel/runtime';
+import { S as SiteRuntimeContext } from './capabilities-56e403e7.js';
+import { RuntimeCapabilities } from './shared.js';
+import { HttpHandler } from 'msw';
+import '@lark-base-open/base-site-channel/capabilities';
+
+interface SiteHttpBridgeRoute {
+    method: string;
+    path: string;
+}
+interface SiteHttpBridgeAllowlistConfig {
+    routes: SiteHttpBridgeRoute[];
+}
+/**
+ * Runtime 当前使用的全部父页面 HTTP bridge 路由。AppSettings 未配置或配置非法时回退到这里，
+ * 避免把 bridge 重新退化为任意同源请求代理。
+ */
+declare const DEFAULT_SITE_HTTP_BRIDGE_ALLOWLIST: SiteHttpBridgeAllowlistConfig;
+
+interface HttpFixture {
+    method?: "get" | "post" | "put" | "patch" | "delete";
+    url: string;
+    status?: number;
+    body?: unknown;
+    headers?: Record<string, string>;
+}
+/** 仅替换真正的 HTTP；channel 的 postMessage 必须使用 createMockHost。 */
+declare function createHttpHandlers(fixtures: readonly HttpFixture[]): HttpHandler[];
+
+type MockApi = (typeof SiteRuntimeApi)[keyof typeof SiteRuntimeApi];
+interface MockCall {
+    api: string;
+    params: unknown;
+}
+interface MockHandlerContext {
+    signal: AbortSignal;
+    emit: (event: string, payload: unknown) => Promise<void>;
+}
+interface MockHostOptions {
+    context?: Partial<SiteRuntimeContext>;
+    /** undefined 模拟未提供能力字段的宿主；{} 模拟明确无能力的新宿主。 */
+    capabilities?: RuntimeCapabilities;
+    bindings?: readonly {
+        baseToken: string;
+        tableIds: readonly string[];
+    }[];
+    allowedRoutes?: readonly SiteHttpBridgeRoute[];
+    origin?: string;
+    secureLinkAvailable?: boolean;
+    functions?: Record<string, (params: unknown) => unknown | Promise<unknown>>;
+    handlers?: Partial<Record<MockApi, (params: unknown, context: MockHandlerContext) => unknown | Promise<unknown>>>;
+    failures?: Partial<Record<MockApi, {
+        code: string;
+        message?: string;
+    }>>;
+}
+/** 无网络、无真实身份。校验始终先于配置的失败和 handler。 */
+declare function createMockHost(options?: MockHostOptions): {
+    channel: RuntimeChannel;
+    context: SiteRuntimeContext;
+    calls: MockCall[];
+    events: {
+        event: string;
+        payload: unknown;
+    }[];
+    emit: (event: string, payload: unknown) => Promise<void>;
+    /** 真实 postMessage 传输使用 channel Host 的 origin/source 校验，非法消息无回包。 */
+    mount(container: HTMLElement, url: string, allowedOrigin?: string): () => void;
+    emitStreamMessage(subscriptionId: string, data: unknown, seq: number, ai?: boolean): Promise<void>;
+    dispose(): void;
+};
+
+export { DEFAULT_SITE_HTTP_BRIDGE_ALLOWLIST, HttpFixture, MockApi, MockCall, MockHandlerContext, MockHostOptions, createHttpHandlers, createMockHost };

package/dist/testing.js

@@ -0,0 +1 @@
+import{Host as me,ChannelCallbackError as P}from"@lark-base-open/base-site-channel";import{SiteRuntimeApi as s,SiteRuntimeEvent as C,SiteRuntimeFunction as D,isValidSiteFunctionName as he}from"@lark-base-open/base-site-channel/runtime-contract";import{ChannelCallbackError as K}from"@lark-base-open/base-site-channel";import{SiteRuntimeErrorCode as g}from"@lark-base-open/base-site-channel/runtime-contract";var X=3e4,Z=6e4,Y=4;var J=32,Q=127,ee=new Set(["DELETE","GET","PATCH","POST","PUT"]),te=new Set(["authorization","connection","content-length","cookie","host","origin","proxy-authorization","referer","transfer-encoding"]);var ne=/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/,E=(e,n)=>{throw new K(e,n)},oe=e=>{let n=e;for(let r=0;r<Y;r+=1){let a;try{a=decodeURIComponent(n)}catch{return E(g.InvalidHttpUrl,"\u8BF7\u6C42\u8DEF\u5F84\u7F16\u7801\u65E0\u6548")}if(a===n)return n;n=a}return n},B=(e,n)=>{if(typeof e!="string"||!e.startsWith("/")||e.startsWith("//"))return E(g.InvalidHttpUrl,"\u8BF7\u6C42\u8DEF\u5F84\u5FC5\u987B\u4EE5\u5355\u4E2A / \u5F00\u5934");if(e.includes("\\")||e.includes("#"))return E(g.InvalidHttpUrl,"\u8BF7\u6C42\u8DEF\u5F84\u5305\u542B\u975E\u6CD5\u5B57\u7B26");let r=oe(e),a=r.split("?")[0]??"";if(r.startsWith("//")||r.includes("\\")||Array.from(r).some(f=>{let m=f.charCodeAt(0);return m<J||m===Q})||a.split("/").some(f=>f===".."))return E(g.InvalidHttpUrl,"\u8BF7\u6C42\u8DEF\u5F84\u4E0D\u5141\u8BB8\u8DE8\u76EE\u5F55\u6216\u8DE8\u57DF");let c=new URL(e,n);return c.origin!==n?E(g.InvalidHttpUrl,"\u8BF7\u6C42\u8DEF\u5F84\u4E0D\u5141\u8BB8\u8DE8\u57DF"):`${c.pathname}${c.search}`},ie=e=>{if(e===void 0)return{};if(e===null||typeof e!="object"||Array.isArray(e))return E(g.InvalidHttpHeader,"\u8BF7\u6C42\u5934\u5FC5\u987B\u662F\u5B57\u7B26\u4E32\u952E\u503C\u5BF9\u8C61");let n={};for(let[r,a]of Object.entries(e)){let c=r.toLowerCase();if(typeof a!="string"||!ne.test(r)||te.has(c)||c.startsWith("sec-")||c.startsWith("x-forwarded-")||c.startsWith("rpc-"))return E(g.InvalidHttpHeader,`\u8BF7\u6C42\u5934 ${r} \u4E0D\u5141\u8BB8\u900F\u4F20`);n[r]=a}return n},F=e=>{let n=e?.method?.toUpperCase()??"GET";if(!ee.has(n))return E(g.InvalidHttpUrl,"\u8BF7\u6C42\u65B9\u6CD5\u4E0D\u53D7\u652F\u6301");if(e?.body!==void 0&&typeof e.body!="string")return E(g.UnsupportedHttpBody,"\u8BF7\u6C42\u4F53\u4EC5\u652F\u6301\u5B57\u7B26\u4E32");if((n==="GET"||n==="HEAD")&&e?.body!==void 0)return E(g.UnsupportedHttpBody,"GET \u8BF7\u6C42\u4E0D\u652F\u6301\u8BF7\u6C42\u4F53");let r=e?.timeoutMs??X;if(typeof r!="number"||!Number.isFinite(r)||r<=0)return E(g.InvalidHttpUrl,"\u8BF7\u6C42\u8D85\u65F6\u65F6\u95F4\u65E0\u6548");let a=Math.min(Math.max(r,1),Z);return{body:e?.body,credentials:"same-origin",headers:ie(e?.headers),method:n,timeoutMs:a}};var re=/^:[A-Za-z][A-Za-z0-9_]*$/;var v={routes:[{method:"GET",path:"/space/api/box/stream/download/v2/cover/:fileToken"},{method:"GET",path:"/space/api/bitable/site/v1/:siteToken/invoke_get"},{method:"POST",path:"/space/api/bitable/site/v1/:siteToken/functions/:key/invoke"},{method:"GET",path:"/space/api/bitable/site/v1/:siteToken/functions/:key/tasks/:taskId"},{method:"POST",path:"/space/api/bitable/site/v1/:siteToken/invoke_function/:functionId"},{method:"POST",path:"/space/api/bitable/site/v1/:siteToken/ai_functions/:functionKey/tasks"},{method:"GET",path:"/space/api/bitable/site/v1/:siteToken/ai_functions/:functionKey/tasks/:taskId"},{method:"POST",path:"/space/api/bitable/site/v1/:siteToken/bases/:baseToken/tables/:tableId/records/batch_create"},{method:"POST",path:"/space/api/bitable/site/v1/:siteToken/bases/:baseToken/tables/:tableId/records/batch_update"},{method:"POST",path:"/space/api/bitable/site/v1/:siteToken/bases/:baseToken/tables/:tableId/records/batch_delete"},{method:"POST",path:"/space/api/box/file/temporary_download_url"},{method:"POST",path:"/space/api/mention/recommend.v2"},{method:"GET",path:"/space/api/user"},{method:"POST",path:"/space/api/bitable/chatbot/chat"},{method:"GET",path:"/space/api/bitable/chatbot/poll"},{method:"POST",path:"/space/api/bitable/chatbot/:chatbotId/history/list"},{method:"POST",path:"/space/api/bitable/chatbot/chatbot_session/reset"},{method:"GET",path:"/space/api/bitable/chatbot/:chatbotId/run_log/session"},{method:"POST",path:"/space/api/bitable/chatbot/:chatbotId/run_log/stop"}]},q=e=>e.length>1&&e.endsWith("/")?e.slice(0,-1):e;var se=(e,n)=>{let r=q(e).split("/"),a=q(n).split("/");return r.length===a.length&&a.every((c,f)=>{let m=r[f];return re.test(c)?!!m:c===m})},z=(e,n,r)=>{let a=e.split("?")[0]??"";return r.some(c=>c.method===n&&se(a,c.path))};import{ChannelCallbackError as j}from"@lark-base-open/base-site-channel";import{SiteRuntimeErrorCode as ae}from"@lark-base-open/base-site-channel/runtime-contract";var G="/space/api/box/stream/download/v2/cover/",ce="/space/api/box/file/temporary_download_url",le=new Set(["120","360","720","1280"]),de=/^[A-Za-z0-9_-]{1,256}$/,w=e=>typeof e=="string"&&de.test(e),y=()=>{throw new j(ae.InvalidAttachmentTarget,"\u9644\u4EF6\u76EE\u6807\u4E0D\u5C5E\u4E8E\u5F53\u524D Site \u6216\u9644\u4EF6\u5750\u6807\u65E0\u6548")},$=(e,n,r)=>{let a=e.pathname.startsWith(G),c=e.pathname.replace(/\/+$/,"")===ce;if(!a&&!c)return()=>{};try{let f=c&&typeof r?.body=="string"?JSON.parse(r.body):void 0,m=a?e.pathname.slice(G.length):f?.file_token;if(a&&(e.searchParams.getAll("extra").length!==1||!["width","height"].every(o=>e.searchParams.getAll(o).length===1&&le.has(e.searchParams.get(o)??""))))return y();let R=JSON.parse(a?e.searchParams.get("extra")??"null":f?.extra??"null"),p=R?.bitablePerm;if(!n||!w(m)||!w(p?.tableId))return y();let _=Object.entries(p.attachments??{});if(_.length!==1||!w(_[0][0]))return y();let A=Object.entries(_[0][1]);if(A.length!==1||!w(A[0][0]))return y();let k=A[0][1];if(!Array.isArray(k)||k.length!==1||k[0]!==m)return y();let I=n.getSiteToken(),H=n.getSiteEnv?.()??"prod";if(!I||p.siteToken!==void 0&&p.baseAppToken!==void 0||(p.siteToken??p.baseAppToken)!==I||p.siteEnv!==void 0&&p.siteEnv!==H||c&&(r?.method!=="POST"||e.searchParams.has("extra"))||Object.keys(R).some(o=>o!=="bitablePerm"))return y();let O=JSON.stringify({bitablePerm:{tableId:p.tableId,attachments:p.attachments,siteToken:I,siteEnv:H}});a?e.searchParams.set("extra",O):r&&(r.body=JSON.stringify({file_token:m,extra:O}));let t=()=>{(I!==n.getSiteToken()||H!==(n.getSiteEnv?.()??"prod")||!n.isBoundTable(p.tableId))&&y()};return t(),t}catch(f){if(f instanceof j)throw f;return y()}};import{http as pe,HttpResponse as ue}from"msw";function fe(e){return e.map(n=>pe[n.method??"get"](n.url,()=>ue.json(n.body??null,{status:n.status??200,headers:n.headers})))}var u=(e,n=e)=>{throw new P(e,n)},Te=new Set(["cache-control","content-language","content-type","etag","last-modified","x-request-id","x-tt-logid","x-tt-trace-id"]);function Oe(e={}){let n={protocolVersion:"site.v1",colorScheme:"light",locale:"zh-CN",mode:"reading",env:"preview",siteToken:"mock-site",...e.context,...e.capabilities===void 0?{}:{capabilities:e.capabilities}},r=e.origin??"https://host.example",a=[],c=[],f=new Map,m=new Map,R=new Set,p=new Set,_=!1,A=0,k=async(t,o)=>{_||(c.push({event:t,payload:o}),await Promise.all([...[...f.get(t)??[]].map(l=>l(o)),...[...p].map(l=>l.emitEvent(t,o))]))},I=(t,o)=>(e.bindings??[]).some(l=>l.baseToken===t&&l.tableIds.includes(o)),H=async(t,o)=>{if(_&&u("CHANNEL_DESTROYED"),Object.values(s).includes(t)||u("10004"),a.push({api:t,params:o}),t!==s.RuntimeContext&&n.capabilities!==void 0){let h={[s.HttpRequestCancel]:"http.cancel",[s.AttachmentUploadCancel]:"attachment.cancel",[s.StreamOpen]:"chatbot.stream",[s.StreamClose]:"chatbot.stream",[s.AIFunctionStreamOpen]:"ai.function.stream",[s.AIFunctionStreamClose]:"ai.function.stream"}[t]??t.replace("site.v1.",""),d=Object.prototype.hasOwnProperty.call(n.capabilities,h)?n.capabilities[h]?.version:void 0;(!Number.isInteger(d)||(d??0)<1)&&u("10004")}let l,T=()=>{},b,S;if(t===s.RuntimeContext)l=structuredClone(n);else if(t===s.OpenLink){let i;try{if(typeof o?.url!="string"||!o.url.trim())throw 0;i=new URL(o.url)}catch{return u("INVALID_LINK_URL")}["http:","https:","mailto:","tel:"].includes(i.protocol)||u("INVALID_LINK_URL"),["http:","https:"].includes(i.protocol)&&e.secureLinkAvailable===!1&&u("LINK_CHECK_UNAVAILABLE"),l={opened:!0}}else if(t===s.HttpRequest){(!o||typeof o!="object")&&u("INVALID_HTTP_URL");let i=o,h=B(i.url,r);S=F(i.init),z(h,S.method??"GET",e.allowedRoutes??v.routes)||u("INVALID_HTTP_URL"),["text","arrayBuffer"].includes(i.init?.responseType??"text")||u("HTTP_RESPONSE_TYPE_UNSUPPORTED");let d=i.requestId??`legacy-${++A}`;(typeof d!="string"||!d||d.length>256||m.has(`http:${d}`))&&u("HTTP_REQUEST_FAILED"),b=`http:${d}`,T=$(new URL(h,r),{getSiteToken:()=>n.siteToken,getSiteEnv:()=>n.env??"prod",isBoundTable:U=>(e.bindings??[]).some(V=>V.tableIds.includes(U))},S),l={body:i.init?.responseType==="arrayBuffer"?new ArrayBuffer(0):"{}",...i.init?.responseType==="arrayBuffer"?{bodyType:"arrayBuffer"}:{},headers:{},status:200,statusText:"OK"}}else if(t===s.AttachmentUpload){let i=o,h=typeof i?.baseToken=="string"?i.baseToken.trim():"",d=typeof i?.tableId=="string"?i.tableId.trim():"";(!h||!d||typeof File>"u"||!(i.file instanceof File)||i.file.size<=0||i.file.size>2*1024*1024*1024||!I(h,d))&&u("INVALID_ATTACHMENT_TARGET"),n.siteToken?.trim()||u("ATTACHMENT_UPLOAD_FAILED"),b=`upload:${i.uploadId??++A}`,l={fileToken:"mock-file",name:i.file.name,size:i.file.size,mimeType:i.file.type}}else if(t===s.HttpRequestCancel||t===s.AttachmentUploadCancel){let i=t===s.HttpRequestCancel?`http:${o?.requestId}`:`upload:${o?.uploadId}`,h=m.get(i);h?.controller.abort(),h?.reject(new P(t===s.HttpRequestCancel?"HTTP_REQUEST_CANCELED":"ATTACHMENT_UPLOAD_CANCELED","\u6D4B\u8BD5\u8C03\u7528\u5DF2\u53D6\u6D88"))}else if(t===s.FunctionInvoke){let i=o?.functionName;(typeof i!="string"||!he(i))&&u("INVALID_FUNCTION_NAME"),i===D.GetCurrentUser?l={name:"\u6D4B\u8BD5\u7528\u6237",avatarUrl:""}:[D.Logout,D.RequestEdit].includes(i)||(!e.functions||!Object.prototype.hasOwnProperty.call(e.functions,i))&&u("FUNCTION_NOT_ALLOWED")}else t===s.AIFunctionStreamOpen||t===s.StreamOpen?(o?.subscriptionId||u("STREAM_UNAVAILABLE"),t===s.AIFunctionStreamOpen&&(!n.siteToken||!o.functionKey)&&u("STREAM_UNAVAILABLE")):(t===s.AIFunctionStreamClose||t===s.StreamClose)&&R.delete(o?.subscriptionId);let L=e.failures?.[t];L&&u(L.code,L.message);let x=new AbortController,M,N=()=>{},W=new Promise((i,h)=>{N=h});b??=`call:${++A}`,m.set(b,{controller:x,reject:N}),S&&(M=setTimeout(()=>{x.abort(),N(new P("REQUEST_TIMEOUT","HTTP \u8BF7\u6C42\u8D85\u65F6"))},S.timeoutMs));try{T();let i=e.handlers?.[t],h=t===s.FunctionInvoke?e.functions?.[o.functionName]:void 0,d=await Promise.race([Promise.resolve().then(()=>i?i(o,{signal:x.signal,emit:k}):h?h(o.params):l),W]);return T(),(t===s.AIFunctionStreamOpen||t===s.StreamOpen)&&R.add(o.subscriptionId),t===s.HttpRequest&&d&&typeof d=="object"&&"headers"in d?{...d,headers:Object.fromEntries(Object.entries(d.headers).filter(([U])=>Te.has(U.toLowerCase())))}:d}finally{clearTimeout(M),b&&m.delete(b)}};return{channel:{invokeApi:H,emitEvent:async(t,o)=>{c.push({event:t,payload:o})},subscribeEvent:(t,o)=>{let l=f.get(t)??new Set;return l.add(o),f.set(t,l),()=>{l.delete(o)}}},context:n,calls:a,events:c,emit:k,mount(t,o,l=new URL(o).origin){let T=new me(t,()=>{},`mock-${++A}`,[l],{sandbox:"allow-scripts allow-same-origin allow-downloads"},{enableBinaryFetch:!1});for(let b of Object.values(s))T.registerApi(b,S=>H(b,S));for(let b of[C.LifecycleReady,C.LifecycleLoadFailed])T.subscribeEvent(b,S=>{c.push({event:b,payload:S})});return p.add(T),T.setClientUrl(o),()=>{T.destroy(),p.delete(T)}},emitStreamMessage(t,o,l,T=!1){return R.has(t)?k(T?C.AIFunctionStreamMessage:C.StreamMessage,{subscriptionId:t,data:o,seq:l}):Promise.resolve()},dispose(){_=!0;for(let t of m.values())t.controller.abort(),t.reject(new P("CHANNEL_DESTROYED","\u6D4B\u8BD5\u5BBF\u4E3B\u5DF2\u9500\u6BC1"));m.clear(),f.clear(),R.clear();for(let t of p)t.destroy();p.clear()}}}export{v as DEFAULT_SITE_HTTP_BRIDGE_ALLOWLIST,fe as createHttpHandlers,Oe as createMockHost};

package/dist/theme.css

@@ -0,0 +1,168 @@
+@layer base-app {
+  .base-app-platform {
+    --base-app-color-bg: #fff;
+    --base-app-color-fg: #1f2329;
+    --base-app-color-muted: #646a73;
+    --base-app-color-accent: #1456f0;
+    --base-app-color-danger: #c6262e;
+    --base-app-color-border: #dee0e3;
+    --base-app-radius: 8px;
+    --base-app-font-family: system-ui, sans-serif;
+    --base-app-font-size: 14px;
+    --base-app-z-popover: 1000;
+    --base-app-z-floating: 900;
+    --base-app-shadow: 0 4px 20px #0002;
+    color: var(--base-app-color-fg);
+    font: var(--base-app-font-size) / 1.5 var(--base-app-font-family);
+    box-sizing: border-box;
+  }
+  .base-app-platform[data-theme="dark"],
+  [data-theme="dark"] .base-app-platform {
+    --base-app-color-bg: #22252b;
+    --base-app-color-fg: #f4f5f7;
+    --base-app-color-muted: #b3b7c0;
+    --base-app-color-border: #515660;
+    --base-app-color-accent: #7da6ff;
+  }
+  @media (prefers-color-scheme: dark) {
+    .base-app-platform[data-theme="host"] {
+      --base-app-color-bg: #22252b;
+      --base-app-color-fg: #f4f5f7;
+      --base-app-color-muted: #b3b7c0;
+      --base-app-color-border: #515660;
+      --base-app-color-accent: #7da6ff;
+    }
+  }
+  .base-app-platform button {
+    font: inherit;
+    color: inherit;
+    background: var(--base-app-color-bg);
+    border: 1px solid var(--base-app-color-border);
+    border-radius: var(--base-app-radius);
+    padding: 6px 10px;
+    cursor: pointer;
+  }
+  .base-app-platform button:focus-visible,
+  .base-app-platform input:focus-visible {
+    outline: 2px solid var(--base-app-color-accent);
+    outline-offset: 2px;
+  }
+  .base-app-popover {
+    background: var(--base-app-color-bg);
+    border: 1px solid var(--base-app-color-border);
+    border-radius: var(--base-app-radius);
+    box-shadow: var(--base-app-shadow);
+    padding: 8px;
+    width: 280px;
+    max-width: calc(100vw - 16px);
+    max-height: var(--radix-popover-content-available-height);
+    overflow: auto;
+    z-index: var(--base-app-z-popover);
+  }
+  .base-app-editor {
+    display: flex;
+    gap: 4px;
+    align-items: center;
+  }
+  .base-app-editor > button:first-child {
+    flex: 1;
+    text-align: start;
+  }
+  .base-app-editor span + span {
+    margin-inline-start: 8px;
+  }
+  .base-app-selector {
+    background: var(--base-app-color-bg);
+    min-width: 0;
+  }
+  .base-app-selector [cmdk-input] {
+    box-sizing: border-box;
+    width: 100%;
+    padding: 8px;
+    border: 1px solid var(--base-app-color-border);
+    border-radius: var(--base-app-radius);
+    background: var(--base-app-color-bg);
+    color: inherit;
+    font: inherit;
+  }
+  .base-app-selector [cmdk-list] {
+    max-height: 240px;
+    overflow: auto;
+    margin-top: 6px;
+  }
+  .base-app-selector [cmdk-item] {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    padding: 8px;
+    border-radius: var(--base-app-radius);
+    cursor: pointer;
+  }
+  .base-app-selector [cmdk-item][data-selected="true"] {
+    background: color-mix(
+      in srgb,
+      var(--base-app-color-accent) 16%,
+      transparent
+    );
+  }
+  .base-app-selector small {
+    color: var(--base-app-color-muted);
+  }
+  .base-app-selector [role="status"] {
+    padding: 12px;
+    color: var(--base-app-color-muted);
+  }
+  .base-app-floating {
+    position: fixed;
+    bottom: 24px;
+    right: 24px;
+    z-index: var(--base-app-z-floating);
+    display: flex;
+    gap: 4px;
+  }
+  .base-app-floating[data-position="bottom-left"] {
+    left: 24px;
+    right: auto;
+  }
+  .base-app-floating [role="tooltip"],
+  .base-app-floating [role="alert"] {
+    position: absolute;
+    bottom: 100%;
+    width: 220px;
+    background: var(--base-app-color-bg);
+    padding: 8px;
+    border-radius: var(--base-app-radius);
+    box-shadow: var(--base-app-shadow);
+  }
+  .base-app-notice {
+    position: fixed;
+    top: 20px;
+    left: 50%;
+    transform: translateX(-50%);
+    background: var(--base-app-color-bg);
+    padding: 12px;
+    z-index: var(--base-app-z-floating);
+  }
+  .base-app-user-menu {
+    display: inline-flex;
+    align-items: center;
+    gap: 8px;
+  }
+  .base-app-user-menu img {
+    width: 28px;
+    height: 28px;
+    border-radius: 50%;
+  }
+  .base-app-attachment img {
+    max-width: 100%;
+  }
+  .base-app-platform [role="alert"] {
+    color: var(--base-app-color-danger);
+  }
+  @media (prefers-reduced-motion: reduce) {
+    .base-app-platform * {
+      animation: none !important;
+      transition: none !important;
+    }
+  }
+}

package/dist/vite.d.ts

@@ -0,0 +1,15 @@
+import { Server, IncomingMessage, ServerResponse } from 'node:http';
+
+/** Only server-side environment receives the token. Never inject it into Vite defines. */
+declare function baseAppDevelopmentPairingPlugin(): {
+    name: string;
+    apply: "serve";
+    configureServer(server: {
+        httpServer: Server | null;
+        middlewares: {
+            use(handler: (req: IncomingMessage, res: ServerResponse, next: () => void) => void): void;
+        };
+    }): void;
+};
+
+export { baseAppDevelopmentPairingPlugin };

package/dist/vite.js

@@ -0,0 +1,3 @@
+import{a as r}from"./chunk-OHPYKFCM.js";import{createHmac as h}from"crypto";function I(){let i=process.env[r.tokenEnv];return{name:"base-app-development-pairing",apply:"serve",configureServer(c){if(i){if(!/^[A-Za-z0-9_-]{43}$/.test(i))throw new Error("Invalid development pairing token");c.middlewares.use((e,o,m)=>{if(e.url?.split("?")[0]!==r.endpoint)return m();let n=(t,f)=>{for(let g of o.getHeaderNames())g.toLowerCase().startsWith("access-control-")&&o.removeHeader(g);o.setHeader("Cache-Control","no-store"),o.setHeader("Content-Type","application/json"),o.statusCode=t,o.end(JSON.stringify(f))},a=c.httpServer?.address(),s=a&&typeof a!="string"?a.port:0,l=`http://${r.host}:${s}`,u=e.headers.origin===void 0?e.headers["sec-fetch-site"]==="same-origin":e.headers.origin===l;if(s<r.portMin||s>r.portMax||e.headers.host!==`${r.host}:${s}`||!u)return n(403,{error:"PAIRING_ORIGIN_REJECTED"});if(e.method!=="POST")return n(405,{error:"PAIRING_METHOD_REJECTED"});let p="",d=!1;e.on("data",t=>{d||(p+=t.toString(),p.length>1024&&(d=!0,n(413,{error:"PAIRING_BODY_TOO_LARGE"})))}),e.on("end",()=>{if(!d)try{let{challenge:t}=JSON.parse(p);if(typeof t!="string"||!/^[A-Za-z0-9_-]{43}$/.test(t))return n(400,{error:"PAIRING_CHALLENGE_INVALID"});let f=h("sha256",i).update(`${r.proofPrefix}
+${l}
+${t}`).digest("base64url");n(200,{proof:f})}catch{n(400,{error:"PAIRING_CHALLENGE_INVALID"})}})})}}}}export{I as baseAppDevelopmentPairingPlugin};

package/docs/README.md

@@ -0,0 +1,16 @@
+# SDK 文档索引
+
+本版本提供页面与服务端 SDK、平台组件、启动管理及测试替身。没有根入口；以 [完整导出清单](exports.md) 和已安装包的 dist 声明为准。
+
+- [page：页面运行时、附件与兼容调用](page.md)
+- [server：defineFunction、ctx.records 与结果语义](server.md)
+- [shared：通用类型与诊断](shared.md)
+- [testing：模拟宿主与 MSW](testing.md)
+- [components：平台组件、主题与插槽](components.md)
+- [start-base-app：启动、清理与 Vite 开发插件](start-base-app.md)
+- [capabilities：能力协商与诊断](capabilities.md)
+- [compat：老模板兼容](compat.md)
+- [upgrade：codemod 与模板 1→2 迁移](upgrade.md)
+- [可编译示例](../examples)
+
+SDK 文档说明本版本 API、组件、兼容语义与可编译示例。业务规则、服务端契约、Mutation 结果、CLI 命令与发布流程，请查阅 [@lark-base-open/base-database-cli](https://www.npmjs.com/package/@lark-base-open/base-database-cli) 随包安装的 lark-base-database Skill 及其 references。升级 CLI 时以该版本随包 Skill 为准。

package/docs/capabilities.md

@@ -0,0 +1,42 @@
+# 能力与诊断
+
+宿主字段形状为 `capabilities: { [name: string]: { version: number } }`。只有缺字段才使用下面的 `host-baseline` 宿主基线；显式空表不回退。null、数组或非正安全整数版本抛 CAPABILITY_CONTEXT_INVALID；未知能力和过低版本不支持。能力声明不代表用户有权限，也不保证依赖服务当前可用。
+
+| 能力 | 分类 | 缺字段时 host-baseline（版本 1） |
+|---|---|---|
+| runtime.context | 关键 | 是 |
+| http.request | 关键 | 是 |
+| http.binary | 关键 | 是 |
+| http.cancel | 可选 | 是 |
+| function.invoke | 关键 | 是 |
+| runtime.user | 可选 | 是 |
+| runtime.[`logout`](exports.md#page) | 可选 | 是 |
+| runtime.[`requestEdit`](exports.md#page) | 可选 | 是 |
+| attachment.upload | 关键 | 是 |
+| attachment.cancel | 可选 | 是 |
+| chatbot.stream | 关键 | 是 |
+| ai.function.stream | 关键 | 是 |
+| runtime.lifecycle | 可选 | 是 |
+| runtime.mode | 可选 | 是 |
+| attachment.progress | 可选 | 是 |
+| link.open | 可选 | 是 |
+
+宿主集中部署；缺少 capabilities 字段仅代表能力协商尚未上线，不代表缺少外链或进度能力。基线以包内 capabilities.json 的能力清单为准，由宿主注册与事件实现的回归测试验证。服务端 ctx.records 不属于页面能力协商；未知能力不在基线。[`queryCapability`](exports.md#page) 的 source 此时为 `host-baseline`；显式能力表为 `advertised`。
+`readCapabilities(context)`、`hasCapability(context,name,minVersion)` 是纯查询；[`getCapabilities`](exports.md#page) 为标准查询入口，[`getRuntimeCapabilities`](exports.md#page) 是别名；[`queryCapability`](exports.md#page) 返回 supported/version/source/availability，未明确健康状态时 availability 为 unknown；`getRuntimeCapabilities(runtime?)` 每次读宿主，不跨应用、环境或用户缓存。[`requireCapability`](exports.md#page) 查询失败或缺失时抛错。所有公开业务入口、兼容 helper 与组件通过同一调用边界：等待配对 → 自动能力预检 → 发送。显式缺失能力时本地抛结构化能力错误，不发送业务请求；RuntimeContext 是协商引导请求，不对自身递归预检。显式 [`requireCapability`](exports.md#page) 仍可用于界面判断，宿主是最终授权方。
+
+<!-- example: capabilities.ts -->
+```ts
+import { getRuntimeCapabilities, requireCapability, classifyRuntimeError } from '@lark-base-open/base-database-app-sdk/page';
+export async function inspectHost() {
+  const capabilities = await getRuntimeCapabilities();
+  try { await requireCapability('function.invoke'); }
+  catch (error) { return { capabilities, diagnostic: classifyRuntimeError(error) }; }
+  return { capabilities };
+}
+```
+
+诊断分类：host-unsupported（CAPABILITY_HOST_UNSUPPORTED）、permission-denied（CAPABILITY_PERMISSION_DENIED）、region-unavailable（CAPABILITY_REGION_UNAVAILABLE）、temporary（CAPABILITY_TEMPORARILY_UNAVAILABLE）、protocol（CAPABILITY_CONTEXT_INVALID）、unknown（CAPABILITY_UNAVAILABLE_UNKNOWN）。
+分类只用稳定错误码，不解析含业务内容的 message。LINK_CHECK_UNAVAILABLE 表示服务不可用，分类为 unknown，不能据此断言地域政策。宿主可用 companion 字段 capabilityUnavailable 明确 permission-denied/region-unavailable/temporarily-unavailable；[`requireCapability`](exports.md#page) 会根据该原因拒绝。unknown 不猜测也不自动重试；retryable 提示不保证非幂等写入重试安全。
+输出含 source/code/upstreamCode/category/retryable/message/redaction；不附原始异常、请求参数、URL、身份、token。应用、环境、制品版本与 requestId/logid 由持有可信上下文的诊断汇总端补齐，本模块不伪造关联信息。
+
+结构化清单位于包内 capabilities.json，测试保证它与共享 [`CAPABILITY_CATALOG`](exports.md#page) 一致。无缓存实现每次读取当前 channel 上下文，避免跨 mount/用户/应用泄漏旧状态。基线包含 link.open 与 attachment.progress；支持进度事件不代表每次上传都必定出现回调或保证服务当前可用。

package/docs/codegen.md

@@ -0,0 +1,28 @@
+# Page 客户端代码生成
+
+`@lark-base-open/base-database-app-sdk/codegen` 是 Node.js 工具入口，不导入浏览器运行时。首个支持版本为 0.0.1-alpha.1；调用方必须安装含此入口的 SDK，不回退旧模板。
+
+<!-- example: codegen.ts -->
+```ts
+import { generateFunctionClients, type FunctionContractData } from '@lark-base-open/base-database-app-sdk/codegen';
+const data: FunctionContractData = {
+  contractFormatVersion: 1,
+  layout: 'workspace',
+  schemaHash: 'sha256:application-contract-hash',
+  functions: [{ functionId: 'hello', functionType: 2, output: { type: 'string' } }],
+  inputs: [{ functionId: 'hello', inputSchema: { type: 'object', properties: {}, additionalProperties: false } }],
+  client: true,
+  augmentation: 'none',
+};
+const files = await generateFunctionClients(data);
+// [{path:'page/src/generated/function-inputs.ts',content:...},
+//  {path:'page/src/generated/functions.ts',content:...}]
+```
+
+此入口只接收提取后的 JSON 数据并返回 `{path, content}[]`，不读工程、不写文件、不加载函数源码。函数契约、inputSchema、SQL/Mutation 命名参数转换及 parameterOptions 由 CLI 提取；SDK 负责所有 SDK 工程的 Page 生成模板。`functions` 的 output 仅用于 FaaS（functionType 2），SQL/Mutation 返回类型保持 unknown。
+
+格式类型 `FunctionContractData`、`FunctionInputContract`、`ClientContract` 与等价校验函数 `validateContractData` 同入口导出。`SUPPORTED_CONTRACT_FORMAT_VERSIONS` 当前为 `[1]`。未知格式版本抛 `CodegenError`，其 `code=CONTRACT_FORMAT_UNSUPPORTED`、`toJSON()` 返回结构化错误；非法数据为 `CONTRACT_DATA_INVALID`。不接受外部 Schema 引用；沿用单 Schema 32KiB、256 节点和16层限制。
+
+`client=false` 仅输出输入映射；`augmentation=compat|client` 生成相应 FunctionInputMap 增强文件，none 不生成增强。`previousAugmentation` 若提供，必须为已知的未修改生成文件，否则报 `CONTRACT_INPUT_MAP_CONFLICT`。输出保留历史 CLI 的文件文本和生成注释，便于逐字节对比。
+
+CLI 在与契约提取相同的受限子进程边界执行安装在工程内的 codegen：环境清空、只读临时包快照、禁子进程/写文件、时间和内存限制；父进程校验相对路径、文件大小与目标软链后写入，check 比较文件内容。此机制不是面向任意恶意原生程序的通用沙箱。