@tier0/sdk-v2 0.9.10 → 0.10.1

package/dist/cjs/client.d.ts

@@ -8,7 +8,7 @@ import type { CloudTransportConfig } from './cloud-transport.js';
 export interface Tier0ClientConfig extends ClientConfig, CloudTransportConfig {
 }
 export type Tier0Client = ReturnType<typeof createClient>;
-/** 现役服务端和数据客户端保留独立配置；浏览器交互仅使用受信宿主。 */
+/** 每个实例持有独立配置；带 Key 的客户端只在服务端使用。 */
 export declare function createClient(config?: Tier0ClientConfig): Readonly<{
     streams: {
         requests: StreamRequestsClient;
@@ -28,6 +28,7 @@ export declare function createClient(config?: Tier0ClientConfig): Readonly<{
             email: string;
             keyPrefix: string;
             keyType: string;
+            permission?: string;
             permissions: string[];
             roles: string[];
             userID: number | bigint;
@@ -59,6 +60,8 @@ export declare function createClient(config?: Tier0ClientConfig): Readonly<{
         send: (body: import("./index.js").components["schemas"]["SdknotificationsSendRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
             createdAt: string;
             messageId: string;
+            recipientName?: string;
+            recipientUserId: string;
             status: string;
         }>;
         get: (body: import("./index.js").components["schemas"]["SdknotificationsGetRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
@@ -68,9 +71,17 @@ export declare function createClient(config?: Tier0ClientConfig): Readonly<{
             errorCode?: string;
             message?: string;
             messageId: string;
+            recipientName?: string;
+            recipientUserId: string;
             status: string;
             type: string;
         }>;
+        list: (body?: import("./index.js").components["schemas"]["SdknotificationsListRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
+            list: import("./index.js").components["schemas"]["NotificationListItem"][];
+            page: number | bigint;
+            size: number | bigint;
+            total: number | bigint;
+        }>;
     };
     mqttAuth: {
         create: (body: import("./index.js").components["schemas"]["SdkmqttAuthCreateRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
@@ -210,7 +221,6 @@ export declare function createClient(config?: Tier0ClientConfig): Readonly<{
     files: FilesClient;
     capabilities: CapabilitiesClient;
     source: Readonly<{
-        delete: (request: import("./index.js").CloudSourceDeleteReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDeleteResponse>;
         validate: (request: import("./index.js").UnsV2SourceValidateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceValidateResponse>;
         probe: (request: import("./index.js").UnsV2SourceProbeReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceProbeResponse>;
         discover: (request: import("./index.js").CloudSourceDiscoverReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDiscoverResponse>;
@@ -225,11 +235,30 @@ export declare function createClient(config?: Tier0ClientConfig): Readonly<{
         observations: Readonly<{
             get: (request: import("./index.js").CloudSourceObservationsGetReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceObservationsGetResponse>;
         }>;
+        resources: Readonly<{
+            catalog: (request: import("./index.js").CloudSourceResourceCatalogReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceResourceCatalogResponse>;
+            preview: (request: import("./index.js").CloudSourceResourceReadReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceResourceReadResponse>;
+            scan: (request: import("./index.js").CloudSourceResourceScanReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceResourceScanResponse>;
+        }>;
+        devices: Readonly<{
+            list: (request: import("./index.js").CloudSourceDevicesListReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDevicesListResponse>;
+        }>;
         documents: Readonly<{
             list: (request: import("./index.js").CloudSourceDocumentListReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDocumentListResponse>;
             get: (request: import("./index.js").CloudSourceDocumentGetReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDocumentGetResponse>;
             create: (request: import("./index.js").CloudSourceDocumentCreateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDocumentCreateResponse>;
             update: (request: import("./index.js").CloudSourceDocumentUpdateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDocumentUpdateResponse>;
+            delete: (request: import("./index.js").UnsV2SourceDocumentDeleteReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceDocumentDeleteResponse>;
+            credentials: Readonly<{
+                update: (request: import("./index.js").UnsV2SourceNativeCredentialsUpdateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceNativeCredentialsUpdateResponse>;
+            }>;
+            state: Readonly<{
+                update: (request: import("./index.js").CloudEdgeSourceStateUpdateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudEdgeSourceStateUpdateResponse>;
+            }>;
+            oauth: Readonly<{
+                start: (request: import("./index.js").UnsV2SourceNativeOAuthStartReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceNativeOAuthStartResponse>;
+                complete: (request: import("./index.js").UnsV2SourceNativeOAuthCompleteReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceNativeOAuthCompleteResponse>;
+            }>;
         }>;
     }>;
     stream: Readonly<{
@@ -271,6 +300,7 @@ export declare function createClient(config?: Tier0ClientConfig): Readonly<{
                 email: string;
                 keyPrefix: string;
                 keyType: string;
+                permission?: string;
                 permissions: string[];
                 roles: string[];
                 userID: number | bigint;
@@ -335,6 +365,8 @@ export declare function createClient(config?: Tier0ClientConfig): Readonly<{
             send: (body: import("./index.js").components["schemas"]["SdknotificationsSendRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
                 createdAt: string;
                 messageId: string;
+                recipientName?: string;
+                recipientUserId: string;
                 status: string;
             }>;
             get: (body: import("./index.js").components["schemas"]["SdknotificationsGetRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
@@ -344,9 +376,17 @@ export declare function createClient(config?: Tier0ClientConfig): Readonly<{
                 errorCode?: string;
                 message?: string;
                 messageId: string;
+                recipientName?: string;
+                recipientUserId: string;
                 status: string;
                 type: string;
             }>;
+            list: (body?: import("./index.js").components["schemas"]["SdknotificationsListRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
+                list: import("./index.js").components["schemas"]["NotificationListItem"][];
+                page: number | bigint;
+                size: number | bigint;
+                total: number | bigint;
+            }>;
         };
         members: {
             listWorkspace: (body?: import("./index.js").components["schemas"]["SdkmembersListWorkspaceRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
@@ -539,6 +579,7 @@ export declare const client: Readonly<{
             email: string;
             keyPrefix: string;
             keyType: string;
+            permission?: string;
             permissions: string[];
             roles: string[];
             userID: number | bigint;
@@ -570,6 +611,8 @@ export declare const client: Readonly<{
         send: (body: import("./index.js").components["schemas"]["SdknotificationsSendRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
             createdAt: string;
             messageId: string;
+            recipientName?: string;
+            recipientUserId: string;
             status: string;
         }>;
         get: (body: import("./index.js").components["schemas"]["SdknotificationsGetRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
@@ -579,9 +622,17 @@ export declare const client: Readonly<{
             errorCode?: string;
             message?: string;
             messageId: string;
+            recipientName?: string;
+            recipientUserId: string;
             status: string;
             type: string;
         }>;
+        list: (body?: import("./index.js").components["schemas"]["SdknotificationsListRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
+            list: import("./index.js").components["schemas"]["NotificationListItem"][];
+            page: number | bigint;
+            size: number | bigint;
+            total: number | bigint;
+        }>;
     };
     mqttAuth: {
         create: (body: import("./index.js").components["schemas"]["SdkmqttAuthCreateRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
@@ -721,7 +772,6 @@ export declare const client: Readonly<{
     files: FilesClient;
     capabilities: CapabilitiesClient;
     source: Readonly<{
-        delete: (request: import("./index.js").CloudSourceDeleteReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDeleteResponse>;
         validate: (request: import("./index.js").UnsV2SourceValidateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceValidateResponse>;
         probe: (request: import("./index.js").UnsV2SourceProbeReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceProbeResponse>;
         discover: (request: import("./index.js").CloudSourceDiscoverReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDiscoverResponse>;
@@ -736,11 +786,30 @@ export declare const client: Readonly<{
         observations: Readonly<{
             get: (request: import("./index.js").CloudSourceObservationsGetReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceObservationsGetResponse>;
         }>;
+        resources: Readonly<{
+            catalog: (request: import("./index.js").CloudSourceResourceCatalogReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceResourceCatalogResponse>;
+            preview: (request: import("./index.js").CloudSourceResourceReadReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceResourceReadResponse>;
+            scan: (request: import("./index.js").CloudSourceResourceScanReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceResourceScanResponse>;
+        }>;
+        devices: Readonly<{
+            list: (request: import("./index.js").CloudSourceDevicesListReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDevicesListResponse>;
+        }>;
         documents: Readonly<{
             list: (request: import("./index.js").CloudSourceDocumentListReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDocumentListResponse>;
             get: (request: import("./index.js").CloudSourceDocumentGetReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDocumentGetResponse>;
             create: (request: import("./index.js").CloudSourceDocumentCreateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDocumentCreateResponse>;
             update: (request: import("./index.js").CloudSourceDocumentUpdateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDocumentUpdateResponse>;
+            delete: (request: import("./index.js").UnsV2SourceDocumentDeleteReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceDocumentDeleteResponse>;
+            credentials: Readonly<{
+                update: (request: import("./index.js").UnsV2SourceNativeCredentialsUpdateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceNativeCredentialsUpdateResponse>;
+            }>;
+            state: Readonly<{
+                update: (request: import("./index.js").CloudEdgeSourceStateUpdateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudEdgeSourceStateUpdateResponse>;
+            }>;
+            oauth: Readonly<{
+                start: (request: import("./index.js").UnsV2SourceNativeOAuthStartReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceNativeOAuthStartResponse>;
+                complete: (request: import("./index.js").UnsV2SourceNativeOAuthCompleteReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceNativeOAuthCompleteResponse>;
+            }>;
         }>;
     }>;
     stream: Readonly<{
@@ -782,6 +851,7 @@ export declare const client: Readonly<{
                 email: string;
                 keyPrefix: string;
                 keyType: string;
+                permission?: string;
                 permissions: string[];
                 roles: string[];
                 userID: number | bigint;
@@ -846,6 +916,8 @@ export declare const client: Readonly<{
             send: (body: import("./index.js").components["schemas"]["SdknotificationsSendRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
                 createdAt: string;
                 messageId: string;
+                recipientName?: string;
+                recipientUserId: string;
                 status: string;
             }>;
             get: (body: import("./index.js").components["schemas"]["SdknotificationsGetRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
@@ -855,9 +927,17 @@ export declare const client: Readonly<{
                 errorCode?: string;
                 message?: string;
                 messageId: string;
+                recipientName?: string;
+                recipientUserId: string;
                 status: string;
                 type: string;
             }>;
+            list: (body?: import("./index.js").components["schemas"]["SdknotificationsListRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{
+                list: import("./index.js").components["schemas"]["NotificationListItem"][];
+                page: number | bigint;
+                size: number | bigint;
+                total: number | bigint;
+            }>;
         };
         members: {
             listWorkspace: (body?: import("./index.js").components["schemas"]["SdkmembersListWorkspaceRequest"], options?: import("./openapi/client.js").RequestOptions) => Promise<{

package/dist/cjs/client.js

@@ -14,9 +14,7 @@ const source_js_1 = require("./source.js");
 const stream_js_1 = require("./stream.js");
 const capabilities_js_2 = require("./capabilities.js");
 const files_js_1 = require("./files.js");
-/** Use a fresh instance per incoming request when supplying employee data delegation. */
-function assemble(resolve, snapshot) {
-    const http = resolve();
+function assemble(resolve, snapshot, http = resolve()) {
     const api = (0, api_generated_js_1.createOpenAPI)(http);
     const transport = new transport_js_1.StreamTransport(resolve, snapshot);
     const messages = new messages_js_1.StreamMessagesClient(transport);
@@ -37,9 +35,9 @@ function assemble(resolve, snapshot) {
         api,
     });
 }
-/** 现役服务端和数据客户端保留独立配置；浏览器交互仅使用受信宿主。 */
+/** 每个实例持有独立配置；带 Key 的客户端只在服务端使用。 */
 function createClient(config = {}) {
-    const snapshot = Object.freeze({ ...config });
+    const snapshot = Object.freeze((0, client_js_1.snapshotClientConfig)(config));
     const http = new client_js_1.HttpClient(snapshot);
     return assemble(() => http, snapshot);
 }
@@ -52,5 +50,5 @@ const defaultHttp = new Proxy(new client_js_1.HttpClient(), {
     },
 });
 /** App 默认交互客户端在调用时解析宿主，无需在浏览器配置密钥。 */
-exports.client = assemble(() => defaultHttp, {});
+exports.client = assemble(client_js_1.getClient, {}, defaultHttp);
 //# sourceMappingURL=client.js.map

package/dist/cjs/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":";;;AAyCA,oCAIC;AA7CD,uDAA6D;AAC7D,uDAA6D;AAC7D,yDAAyD;AACzD,+DAAqE;AACrE,mDAA+E;AAC/E,iEAA2D;AAC3D,kDAAuD;AACvD,4DAA4D;AAC5D,2CAA+C;AAC/C,2CAA+C;AAC/C,uDAAuD;AACvD,yCAAyC;AAIzC,yFAAyF;AACzF,SAAS,QAAQ,CAAC,OAAyB,EAAE,QAA2B;IACtE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,IAAA,gCAAa,EAAC,IAAI,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,8BAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,kCAAoB,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAA,6BAAiB,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,kCAAoB,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,0CAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;QACnI,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE;QACjC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,IAAI,sBAAW,CAAC,IAAI,CAAC;QAC5B,YAAY,EAAE,IAAI,oCAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC;QACvD,MAAM,EAAE,IAAA,4BAAgB,EAAC,GAAG,CAAC;QAC7B,MAAM,EAAE,IAAA,4BAAgB,EAAC,GAAG,CAAC;QAC7B,GAAG,EAAE,IAAA,kCAAiB,EAAC,GAAG,CAAC;QAC3B,GAAG;KACJ,CAAC,CAAC;AACL,CAAC;AAGD,sCAAsC;AACtC,SAAgB,YAAY,CAAC,SAA4B,EAAE;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,sBAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,6CAA6C;AAC7C,MAAM,WAAW,GAAG,IAAI,KAAK,CAAC,IAAI,sBAAU,EAAE,EAAE;IAC9C,GAAG,CAAC,OAAO,EAAE,GAAG;QACd,MAAM,OAAO,GAAG,IAAA,qBAAS,GAAE,CAAC;QAC5B,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACjD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACnE,CAAC;CACF,CAAC,CAAC;AACH,sCAAsC;AACzB,QAAA,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC","sourcesContent":["import { StreamRequestsClient } from './streams/requests.js';\nimport { StreamMessagesClient } from './streams/messages.js';\nimport { StreamTransport } from './streams/transport.js';\nimport { StreamCapabilitiesClient } from './streams/capabilities.js';\nimport { getClient, HttpClient, type ClientConfig } from './openapi/client.js';\nimport { createOpenAPI } from './openapi/api.generated.js';\nimport { createUnsV2Client } from './uns-v2/client.js';\nimport { bindUnsDataClient } from './uns-v2/data-client.js';\nimport { bindSourceClient } from './source.js';\nimport { bindStreamClient } from './stream.js';\nimport { CapabilitiesClient } from './capabilities.js';\nimport { FilesClient } from './files.js';\nimport type { CloudTransportConfig } from './cloud-transport.js';\n\nexport interface Tier0ClientConfig extends ClientConfig, CloudTransportConfig {}\n/** Use a fresh instance per incoming request when supplying employee data delegation. */\nfunction assemble(resolve: () => HttpClient, snapshot: Tier0ClientConfig) {\n  const http = resolve();\n  const api = createOpenAPI(http);\n  const transport = new StreamTransport(resolve, snapshot);\n  const messages = new StreamMessagesClient(transport);\n  const raw = createUnsV2Client(resolve, snapshot);\n  return Object.freeze({\n    streams: { requests: new StreamRequestsClient(transport), messages, capabilities: new StreamCapabilitiesClient(resolve, snapshot) },\n    dispose: () => messages.dispose(),\n    system: api.system,\n    members: api.members,\n    notifications: api.notifications,\n    mqttAuth: api.mqttAuth,\n    agent: api.agent,\n    files: new FilesClient(http),\n    capabilities: new CapabilitiesClient(resolve, snapshot),\n    source: bindSourceClient(raw),\n    stream: bindStreamClient(raw),\n    uns: bindUnsDataClient(raw),\n    api,\n  });\n}\nexport type Tier0Client = ReturnType<typeof createClient>;\n\n/** 现役服务端和数据客户端保留独立配置；浏览器交互仅使用受信宿主。 */\nexport function createClient(config: Tier0ClientConfig = {}) {\n  const snapshot = Object.freeze({ ...config });\n  const http = new HttpClient(snapshot);\n  return assemble(() => http, snapshot);\n}\n\n// 全局兼容入口也在调用时读取 configureClient，不固化模块导入时的配置。\nconst defaultHttp = new Proxy(new HttpClient(), {\n  get(_target, key) {\n    const current = getClient();\n    const value: unknown = Reflect.get(current, key);\n    return typeof value === 'function' ? value.bind(current) : value;\n  },\n});\n/** App 默认交互客户端在调用时解析宿主，无需在浏览器配置密钥。 */\nexport const client = assemble(() => defaultHttp, {});\n"]}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":";;;AAuCA,oCAIC;AA3CD,uDAA6D;AAC7D,uDAA6D;AAC7D,yDAAyD;AACzD,+DAAqE;AACrE,mDAAqG;AACrG,iEAA2D;AAC3D,kDAAuD;AACvD,4DAA4D;AAC5D,2CAA+C;AAC/C,2CAA+C;AAC/C,uDAAuD;AACvD,yCAAyC;AAIzC,SAAS,QAAQ,CAAC,OAAyB,EAAE,QAA2B,EAAE,IAAI,GAAG,OAAO,EAAE;IACxF,MAAM,GAAG,GAAG,IAAA,gCAAa,EAAC,IAAI,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,8BAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,kCAAoB,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAA,6BAAiB,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,kCAAoB,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,0CAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;QACnI,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE;QACjC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,IAAI,sBAAW,CAAC,IAAI,CAAC;QAC5B,YAAY,EAAE,IAAI,oCAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC;QACvD,MAAM,EAAE,IAAA,4BAAgB,EAAC,GAAG,CAAC;QAC7B,MAAM,EAAE,IAAA,4BAAgB,EAAC,GAAG,CAAC;QAC7B,GAAG,EAAE,IAAA,kCAAiB,EAAC,GAAG,CAAC;QAC3B,GAAG;KACJ,CAAC,CAAC;AACL,CAAC;AAGD,oCAAoC;AACpC,SAAgB,YAAY,CAAC,SAA4B,EAAE;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAA,gCAAoB,EAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,sBAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,6CAA6C;AAC7C,MAAM,WAAW,GAAG,IAAI,KAAK,CAAC,IAAI,sBAAU,EAAE,EAAE;IAC9C,GAAG,CAAC,OAAO,EAAE,GAAG;QACd,MAAM,OAAO,GAAG,IAAA,qBAAS,GAAE,CAAC;QAC5B,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACjD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACnE,CAAC;CACF,CAAC,CAAC;AACH,sCAAsC;AACzB,QAAA,MAAM,GAAG,QAAQ,CAAC,qBAAS,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC","sourcesContent":["import { StreamRequestsClient } from './streams/requests.js';\nimport { StreamMessagesClient } from './streams/messages.js';\nimport { StreamTransport } from './streams/transport.js';\nimport { StreamCapabilitiesClient } from './streams/capabilities.js';\nimport { getClient, HttpClient, snapshotClientConfig, type ClientConfig } from './openapi/client.js';\nimport { createOpenAPI } from './openapi/api.generated.js';\nimport { createUnsV2Client } from './uns-v2/client.js';\nimport { bindUnsDataClient } from './uns-v2/data-client.js';\nimport { bindSourceClient } from './source.js';\nimport { bindStreamClient } from './stream.js';\nimport { CapabilitiesClient } from './capabilities.js';\nimport { FilesClient } from './files.js';\nimport type { CloudTransportConfig } from './cloud-transport.js';\n\nexport interface Tier0ClientConfig extends ClientConfig, CloudTransportConfig {}\nfunction assemble(resolve: () => HttpClient, snapshot: Tier0ClientConfig, http = resolve()) {\n  const api = createOpenAPI(http);\n  const transport = new StreamTransport(resolve, snapshot);\n  const messages = new StreamMessagesClient(transport);\n  const raw = createUnsV2Client(resolve, snapshot);\n  return Object.freeze({\n    streams: { requests: new StreamRequestsClient(transport), messages, capabilities: new StreamCapabilitiesClient(resolve, snapshot) },\n    dispose: () => messages.dispose(),\n    system: api.system,\n    members: api.members,\n    notifications: api.notifications,\n    mqttAuth: api.mqttAuth,\n    agent: api.agent,\n    files: new FilesClient(http),\n    capabilities: new CapabilitiesClient(resolve, snapshot),\n    source: bindSourceClient(raw),\n    stream: bindStreamClient(raw),\n    uns: bindUnsDataClient(raw),\n    api,\n  });\n}\nexport type Tier0Client = ReturnType<typeof createClient>;\n\n/** 每个实例持有独立配置；带 Key 的客户端只在服务端使用。 */\nexport function createClient(config: Tier0ClientConfig = {}) {\n  const snapshot = Object.freeze(snapshotClientConfig(config));\n  const http = new HttpClient(snapshot);\n  return assemble(() => http, snapshot);\n}\n\n// 全局兼容入口也在调用时读取 configureClient，不固化模块导入时的配置。\nconst defaultHttp = new Proxy(new HttpClient(), {\n  get(_target, key) {\n    const current = getClient();\n    const value: unknown = Reflect.get(current, key);\n    return typeof value === 'function' ? value.bind(current) : value;\n  },\n});\n/** App 默认交互客户端在调用时解析宿主，无需在浏览器配置密钥。 */\nexport const client = assemble(getClient, {}, defaultHttp);\n"]}

package/dist/cjs/cloud-server.d.ts

@@ -1,31 +1,38 @@
-export declare const APP_REQUEST_IDENTITY_HEADER: "X-Tier0-App-Identity";
-export declare class AppRequestIdentityError extends Error {
-    readonly code: 'APP_IDENTITY_INVALID' | 'APP_IDENTITY_CONFIGURATION_INVALID';
-    constructor(code: 'APP_IDENTITY_INVALID' | 'APP_IDENTITY_CONFIGURATION_INVALID');
+/** Set by the front door on every request it forwards to the App, after stripping any `X-Tier0-*` the client sent. */
+export declare const VISITOR_HEADER = "X-Tier0-Visitor";
+export type VisitorErrorCode = 'VISITOR_HEADER_INVALID' | 'VISITOR_CONFIGURATION_INVALID';
+export declare class VisitorError extends Error {
+    readonly code: VisitorErrorCode;
+    constructor(code: VisitorErrorCode);
 }
-export interface VerifiedCloudAppUser {
-    readonly kind: 'gateway-user';
-    readonly userID: string;
+/** The visitor of a request, from `X-Tier0-Visitor`. */
+export interface Visitor {
+    readonly subType: 'employee' | 'machine';
+    /** Employee user ID, or the call token ID of a machine visitor. */
+    readonly subject: string;
+    /** Grant of an employee's access; empty for a machine visitor. */
+    readonly grant: string;
     readonly workspaceID: string;
     readonly appID: string;
-    readonly roleKeys: readonly string[];
-    readonly requestID: string;
-    readonly issuedAt: number;
-    readonly expiresAt: number;
-    readonly verificationKeyID: string;
+    readonly runtime: 'deployed' | 'preview';
+    /** Roles of this visitor in the App; in Preview, the roles selected in "view as". */
+    readonly appRoles: readonly string[];
+    /** Only in Preview's "view as". */
+    readonly activeRole?: string;
 }
-export interface CloudAppIdentityAuthority {
-    appID: string;
-    workspaceID: string;
-    /** Pinned server configuration, never a key or URL taken from the request. */
-    publicKeys: unknown;
+export interface ParseVisitorOptions {
+    /** The App the header must name. Defaults to `TIER0_APP_ID`. */
+    appID?: string;
 }
-export interface CloudAppIdentityRequest {
-    assertion: string | undefined;
-    method: string;
-    requestURI: string;
-    /** Exact bytes received from the gateway, before JSON parsing or normalization. */
-    body: Uint8Array;
-}
-/** Verifies request provenance, not business authorization or delegated UNS permissions. */
-export declare function createCloudAppRequestVerifier(authority: CloudAppIdentityAuthority): (request: CloudAppIdentityRequest) => VerifiedCloudAppUser;
+/**
+ * Parses `X-Tier0-Visitor`: the unpadded base64url (RFC 4648 §5) of a UTF-8
+ * JSON object of at most 8192 bytes. The header is not signed; the front door
+ * is the only way into the App and replaces whatever the client sent. Parsing
+ * is strict: a byte order mark, a duplicate key, a lone UTF-16 surrogate
+ * (e.g. `"\ud800"`), an unknown or missing field, a wrong type or length, a `ws` that
+ * is not a positive decimal ID without sign or leading zero, an employee
+ * without a grant or a machine visitor with one, or an `app` other than this
+ * App's throws `VISITOR_HEADER_INVALID`. Without an App ID
+ * (`TIER0_APP_ID` unset) it throws `VISITOR_CONFIGURATION_INVALID`.
+ */
+export declare function parseVisitorHeader(value: string | null | undefined, options?: ParseVisitorOptions): Visitor;

package/dist/cjs/cloud-server.js

@@ -1,114 +1,116 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AppRequestIdentityError = exports.APP_REQUEST_IDENTITY_HEADER = void 0;
-exports.createCloudAppRequestVerifier = createCloudAppRequestVerifier;
-// Server-only entry point. Browser HTTP clients remain independent of node:crypto.
-const node_crypto_1 = require("node:crypto");
-const app_identity_contract_generated_js_1 = require("./app-identity-contract.generated.js");
-exports.APP_REQUEST_IDENTITY_HEADER = app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.header;
-class AppRequestIdentityError extends Error {
+exports.VisitorError = exports.VISITOR_HEADER = void 0;
+exports.parseVisitorHeader = parseVisitorHeader;
+// Server-only entry point: the App's view of the request it is serving.
+const runtime_env_js_1 = require("./runtime-env.js");
+const maxID = BigInt('9223372036854775807');
+/** A positive decimal int64 without sign or leading zero. */
+const validID = (value) => typeof value === 'string' && /^[1-9]\d{0,18}$/.test(value) && BigInt(value) <= maxID;
+const isObject = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+/** Set by the front door on every request it forwards to the App, after stripping any `X-Tier0-*` the client sent. */
+exports.VISITOR_HEADER = 'X-Tier0-Visitor';
+/** Limit of the JSON before encoding. */
+const VISITOR_MAX_JSON_BYTES = 8192;
+/** Unpadded base64url of `VISITOR_MAX_JSON_BYTES`. */
+const VISITOR_MAX_HEADER_LENGTH = Math.ceil((VISITOR_MAX_JSON_BYTES * 4) / 3);
+const VISITOR_MAX_STRING_BYTES = 128;
+const VISITOR_FIELDS = new Set(['ws', 'app', 'runtime', 'sub_type', 'sub', 'grant', 'app_roles', 'active_role']);
+class VisitorError extends Error {
     code;
     constructor(code) {
         super(code);
         this.code = code;
-        this.name = 'AppRequestIdentityError';
+        this.name = 'VisitorError';
     }
 }
-exports.AppRequestIdentityError = AppRequestIdentityError;
-const invalid = () => new AppRequestIdentityError('APP_IDENTITY_INVALID');
-const invalidConfig = () => new AppRequestIdentityError('APP_IDENTITY_CONFIGURATION_INVALID');
-const appPattern = new RegExp(app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.appIDPattern);
-const kidPattern = new RegExp(app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.keyIDPattern);
-const methodPattern = new RegExp(app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.methodPattern);
-const maxID = BigInt('9223372036854775807');
-const validID = (value) => typeof value === 'string' && /^[1-9]\d{0,18}$/.test(value) && BigInt(value) <= maxID;
-const isObject = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
-const exactKeys = (value, keys) => Object.keys(value).length === keys.length && Object.keys(value).every((key) => keys.includes(key));
-const validString = (value, maxBytes) => typeof value === 'string' && value.length > 0 && Buffer.byteLength(value) <= maxBytes &&
-    Buffer.from(value).toString('utf8') === value && !/[\u0000-\u001f\u007f-\u009f]/.test(value);
-const decode = (value) => {
-    if (!/^[A-Za-z0-9_-]+$/.test(value))
-        throw invalid();
-    const bytes = Buffer.from(value, 'base64url');
-    if (bytes.toString('base64url') !== value)
-        throw invalid();
-    return bytes;
-};
-/** Verifies request provenance, not business authorization or delegated UNS permissions. */
-function createCloudAppRequestVerifier(authority) {
-    if (!isObject(authority) || typeof authority.appID !== 'string' || !appPattern.test(authority.appID) || !validID(authority.workspaceID))
-        throw invalidConfig();
-    const appID = authority.appID;
-    const workspaceID = authority.workspaceID;
-    const keys = new Map();
-    try {
-        let raw = authority.publicKeys;
-        if (typeof raw === 'string') {
-            if (Buffer.byteLength(raw) > app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.maxTokenBytes * app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.maxKeys)
-                throw invalidConfig();
-            raw = JSON.parse(raw);
-        }
-        if (!isObject(raw) || !exactKeys(raw, ['keys']) || !Array.isArray(raw.keys) ||
-            raw.keys.length === 0 || raw.keys.length > app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.maxKeys)
-            throw invalidConfig();
-        for (const key of raw.keys) {
-            if (!isObject(key) || !exactKeys(key, app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.publicKeyFields) || key.kty !== 'OKP' ||
-                key.crv !== 'Ed25519' || typeof key.kid !== 'string' || !kidPattern.test(key.kid) ||
-                keys.has(key.kid) || typeof key.x !== 'string' || decode(key.x).length !== 32)
-                throw invalidConfig();
-            keys.set(key.kid, (0, node_crypto_1.createPublicKey)({ key: { kty: 'OKP', crv: 'Ed25519', x: key.x }, format: 'jwk' }));
+exports.VisitorError = VisitorError;
+/** A UTF-16 surrogate without its pair, as JSON escapes like "\ud800" can produce. */
+const LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+/**
+ * Raw key tokens of the top-level object, for spotting duplicates
+ * (`JSON.parse` keeps the last silently). Values of the visitor are strings
+ * and arrays of strings, so only depth 1 holds keys.
+ */
+function topLevelKeys(json) {
+    const keys = [];
+    let depth = 0;
+    for (let i = 0; i < json.length; i += 1) {
+        const char = json[i];
+        if (char === '{' || char === '[')
+            depth += 1;
+        else if (char === '}' || char === ']')
+            depth -= 1;
+        else if (char === '"') {
+            const start = i;
+            for (i += 1; i < json.length && json[i] !== '"'; i += 1)
+                if (json[i] === '\\')
+                    i += 1;
+            let next = i + 1;
+            while (next < json.length && /\s/.test(json[next]))
+                next += 1;
+            if (depth === 1 && json[next] === ':')
+                keys.push(json.slice(start, i + 1));
         }
     }
+    return keys;
+}
+const bytes = (value) => Buffer.byteLength(value, 'utf8');
+const sized = (value, min, max) => typeof value === 'string' && !LONE_SURROGATE.test(value) && bytes(value) >= min && bytes(value) <= max;
+/**
+ * Parses `X-Tier0-Visitor`: the unpadded base64url (RFC 4648 §5) of a UTF-8
+ * JSON object of at most 8192 bytes. The header is not signed; the front door
+ * is the only way into the App and replaces whatever the client sent. Parsing
+ * is strict: a byte order mark, a duplicate key, a lone UTF-16 surrogate
+ * (e.g. `"\ud800"`), an unknown or missing field, a wrong type or length, a `ws` that
+ * is not a positive decimal ID without sign or leading zero, an employee
+ * without a grant or a machine visitor with one, or an `app` other than this
+ * App's throws `VISITOR_HEADER_INVALID`. Without an App ID
+ * (`TIER0_APP_ID` unset) it throws `VISITOR_CONFIGURATION_INVALID`.
+ */
+function parseVisitorHeader(value, options = {}) {
+    const appID = options.appID ?? (0, runtime_env_js_1.getEnvVar)('TIER0_APP_ID')?.trim();
+    if (!appID)
+        throw new VisitorError('VISITOR_CONFIGURATION_INVALID');
+    const fail = () => new VisitorError('VISITOR_HEADER_INVALID');
+    if (typeof value !== 'string' || value.length === 0 || value.length > VISITOR_MAX_HEADER_LENGTH || !/^[A-Za-z0-9_-]+$/.test(value))
+        throw fail();
+    const raw = Buffer.from(value, 'base64url');
+    // Only the canonical encoding: no padding, no stray trailing bits.
+    if (raw.length > VISITOR_MAX_JSON_BYTES || raw.toString('base64url') !== value)
+        throw fail();
+    // A UTF-8 byte order mark is not part of the contract (TextDecoder would drop it silently).
+    if (raw[0] === 0xef && raw[1] === 0xbb && raw[2] === 0xbf)
+        throw fail();
+    let claims;
+    let json;
+    try {
+        json = new TextDecoder('utf-8', { fatal: true }).decode(raw);
+        claims = JSON.parse(json);
+    }
     catch {
-        throw invalidConfig();
+        throw fail();
     }
-    return (request) => {
-        try {
-            if (typeof request.assertion !== 'string' || Buffer.byteLength(request.assertion) > app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.maxTokenBytes ||
-                !(request.body instanceof Uint8Array) || request.body.byteLength > app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.maxBodyBytes ||
-                !methodPattern.test(request.method) || !validString(request.requestURI, app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.maxURIBytes) ||
-                !request.requestURI.startsWith('/') || request.requestURI.startsWith('//'))
-                throw invalid();
-            const parts = request.assertion.split('.');
-            if (parts.length !== 3)
-                throw invalid();
-            const header = JSON.parse(decode(parts[0]).toString('utf8'));
-            if (!isObject(header) || !exactKeys(header, app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.requiredHeaderFields) ||
-                header.alg !== app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.algorithm || header.typ !== app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.type ||
-                typeof header.kid !== 'string' || !kidPattern.test(header.kid))
-                throw invalid();
-            const key = keys.get(header.kid);
-            const signature = decode(parts[2]);
-            if (!key || signature.length !== 64 ||
-                !(0, node_crypto_1.verify)(null, Buffer.from(parts[0] + '.' + parts[1], 'ascii'), key, signature))
-                throw invalid();
-            const claims = JSON.parse(decode(parts[1]).toString('utf8'));
-            if (!isObject(claims) || !exactKeys(claims, app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.requiredClaims) ||
-                claims.ver !== app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.version || claims.iss !== app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.issuer || claims.aud !== app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.audience ||
-                !validID(claims.sub) || claims.workspaceID !== workspaceID || claims.appID !== appID ||
-                claims.method !== request.method || claims.requestURI !== request.requestURI ||
-                typeof claims.bodySHA256 !== 'string' || !/^[a-f0-9]{64}$/.test(claims.bodySHA256) ||
-                claims.bodySHA256 !== (0, node_crypto_1.createHash)('sha256').update(request.body).digest('hex') ||
-                typeof claims.iat !== 'number' || !Number.isSafeInteger(claims.iat) || claims.iat <= 0 ||
-                typeof claims.exp !== 'number' || !Number.isSafeInteger(claims.exp) || claims.exp <= claims.iat ||
-                claims.exp - claims.iat > app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.maxTTLSeconds ||
-                typeof claims.jti !== 'string' || !/^[a-f0-9]{32}$/.test(claims.jti) ||
-                !Array.isArray(claims.roles) || claims.roles.length > app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.maxRoles ||
-                claims.roles.some((role) => !validString(role, app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.maxRoleBytes) || role.trim() !== role) ||
-                new Set(claims.roles).size !== claims.roles.length)
-                throw invalid();
-            const now = Math.floor(Date.now() / 1000);
-            if (claims.iat > now + app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.clockSkewSeconds || now >= claims.exp + app_identity_contract_generated_js_1.APP_REQUEST_IDENTITY_CONTRACT.clockSkewSeconds)
-                throw invalid();
-            return Object.freeze({
-                kind: 'gateway-user', userID: claims.sub, workspaceID, appID,
-                roleKeys: Object.freeze([...claims.roles]), requestID: claims.jti,
-                issuedAt: claims.iat, expiresAt: claims.exp, verificationKeyID: header.kid,
-            });
-        }
-        catch {
-            throw invalid();
-        }
-    };
+    if (!isObject(claims) || Object.keys(claims).some((key) => !VISITOR_FIELDS.has(key)))
+        throw fail();
+    // Every key at most once, each spelling decoded ("\u0077s" is "ws").
+    const keys = topLevelKeys(json).map((token) => JSON.parse(token));
+    if (new Set(keys).size !== keys.length)
+        throw fail();
+    const { ws, app, runtime, sub_type: subType, sub, grant, app_roles: appRoles, active_role: activeRole } = claims;
+    if (!validID(ws) || app !== appID ||
+        (runtime !== 'deployed' && runtime !== 'preview') ||
+        (subType !== 'employee' && subType !== 'machine') ||
+        !sized(sub, 1, VISITOR_MAX_STRING_BYTES) ||
+        // An employee's access always has a grant; a machine visitor has none.
+        typeof grant !== 'string' || (subType === 'employee' ? !sized(grant, 1, VISITOR_MAX_STRING_BYTES) : grant !== '') ||
+        !Array.isArray(appRoles) || appRoles.some((role) => !sized(role, 1, VISITOR_MAX_STRING_BYTES)) ||
+        (activeRole !== undefined && !sized(activeRole, 1, VISITOR_MAX_STRING_BYTES)))
+        throw fail();
+    return Object.freeze({
+        subType, subject: sub, grant, workspaceID: ws, appID, runtime,
+        appRoles: Object.freeze([...new Set(appRoles)]),
+        ...(activeRole === undefined ? {} : { activeRole }),
+    });
 }
 //# sourceMappingURL=cloud-server.js.map