agent-bridge-aun 1.0.41 → 1.0.44

package/dist/src-ts/plugins/aun/ability-publication.js

@@ -0,0 +1,165 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.abilityDefinitionId = abilityDefinitionId;
+exports.publishAbilityCatalog = publishAbilityCatalog;
+const node_crypto_1 = require("node:crypto");
+const indexPath = "/.well-known/ability/index.json";
+const abilityPathPattern = /^(?!protocol\/|definitions\/)[a-z0-9]+(?:[a-z0-9._-]*[a-z0-9])?(?:\/[a-z0-9]+(?:[a-z0-9._-]*[a-z0-9])?)+$/;
+const encoder = new TextEncoder();
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (!value || typeof value !== "object")
+        return JSON.stringify(value);
+    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(",")}}`;
+}
+function id(value) { return (0, node_crypto_1.createHash)("sha256").update(canonical(value)).digest("hex"); }
+function abilityDefinitionId(definition) { return id(definition); }
+function same(left, right) { return Buffer.from(left).equals(Buffer.from(right)); }
+async function verifyPublicDocument(aid, path, expected) {
+    if (!/^[a-z0-9][a-z0-9._-]*\.[a-z0-9.-]+$/i.test(aid))
+        throw new Error("能力公开校验的 AID 无效");
+    const origin = new URL(`https://${aid}`);
+    const issuer = aid.slice(aid.indexOf(".") + 1);
+    const providerLabel = aid.slice(0, aid.indexOf("."));
+    let url = new URL(path, origin);
+    const signal = AbortSignal.timeout(15_000);
+    try {
+        for (let redirects = 0;; redirects++) {
+            const response = await fetch(url.href, { redirect: "manual", credentials: "omit", cache: "no-store", signal });
+            if ([301, 302, 303, 307, 308].includes(response.status)) {
+                const location = response.headers.get("location");
+                await response.body?.cancel();
+                if (!location || redirects >= 5)
+                    throw new Error("重定向缺少地址或超过 5 次");
+                const next = new URL(location, url);
+                const sameProvider = next.origin === origin.origin;
+                const issuerStorage = next.hostname === `storage.${issuer}` && ["", "9470"].includes(next.port) && next.pathname.startsWith(`/${providerLabel}/`);
+                const storageDownload = url.hostname === `storage.${issuer}` && ["", "9470"].includes(url.port) && url.pathname.startsWith(`/${providerLabel}/`) && next.origin === url.origin && next.pathname === "/api/storage/download";
+                if (next.protocol !== "https:" || next.username || next.password || next.hash || (!sameProvider && !issuerStorage && !storageDownload))
+                    throw new Error("重定向不属于同一 Provider 或 issuer HTTPS 存储");
+                url = next;
+                continue;
+            }
+            if (!response.ok || !response.body) {
+                await response.body?.cancel();
+                throw new Error(`HTTP ${response.status}`);
+            }
+            const chunks = [];
+            let size = 0;
+            const reader = response.body.getReader();
+            try {
+                for (;;) {
+                    const { done, value } = await reader.read();
+                    if (done)
+                        break;
+                    size += value.byteLength;
+                    if (size > 128 * 1024) {
+                        await reader.cancel();
+                        throw new Error("公开资料超过 128 KiB");
+                    }
+                    chunks.push(value);
+                }
+            }
+            finally {
+                reader.releaseLock();
+            }
+            if (!same(Buffer.concat(chunks), expected))
+                throw new Error("公开内容与发布内容不一致");
+            return;
+        }
+    }
+    catch (error) {
+        throw new Error(`能力资料匿名公开校验失败：${path}（${error instanceof Error ? error.message : "网络错误"}）`, { cause: error });
+    }
+}
+async function readIndex(storage, aid) {
+    try {
+        const bytes = await storage.readBytes(indexPath);
+        const index = JSON.parse(Buffer.from(bytes).toString("utf8"));
+        if (index.schema !== "aun.ability.index.v1" || index.publisher !== aid || !Number.isSafeInteger(index.catalog_revision) || index.catalog_revision < 0 || !Array.isArray(index.capabilities))
+            throw new Error("已有 AUN 能力索引格式无效或 publisher 不匹配");
+        if (index.capabilities.some((entry) => !entry || typeof entry !== "object" || typeof entry.path !== "string" || typeof entry.definition_id !== "string"))
+            throw new Error("已有 AUN 能力索引包含无效条目");
+        return index;
+    }
+    catch (error) {
+        if (error.code === "ENOENT" || error.status === 404)
+            return { schema: "aun.ability.index.v1", publisher: aid, version: "1.0.0", catalog_revision: 0, capabilities: [] };
+        throw error;
+    }
+}
+async function publishAbilityCatalog(input) {
+    const { storage, aid, pluginId, pluginVersion } = input;
+    const definitions = new Map();
+    for (const definition of input.definitions) {
+        const path = definition.path;
+        if (typeof path !== "string" || !abilityPathPattern.test(path) || definitions.has(path))
+            throw new Error("Ability path 无效或重复");
+        if (definition.contract_revision !== undefined && (typeof definition.contract_revision !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(definition.contract_revision)))
+            throw new Error(`Ability ${path} 的契约修订号无效`);
+        if (definition.auth_required !== true || definition.require_confirm !== true || definition.idempotency !== "keyed" || !Array.isArray(definition.allowed_modes) || !definition.allowed_modes.includes("explicit"))
+            throw new Error(`Ability ${path} 的授权、确认或幂等字段不符合协议`);
+        definitions.set(path, definition);
+    }
+    const selected = new Set(input.selectedPaths);
+    if ([...selected].some((path) => !definitions.has(path)))
+        throw new Error("发布选择包含当前 Agent 未声明的 Ability path");
+    const oldIndex = await readIndex(storage, aid);
+    const oldLedger = input.ledger;
+    const otherEntries = oldIndex.capabilities.filter((entry) => {
+        const owned = oldLedger[String(entry.path)];
+        return !owned || ![owned.definition_id, ...(owned.previous_definition_ids ?? [])].includes(String(entry.definition_id));
+    });
+    const nextLedger = {};
+    const published = [];
+    for (const path of [...selected].sort()) {
+        const definition = definitions.get(path);
+        const definitionId = abilityDefinitionId(definition);
+        const releaseId = id({ aid, path, definition_id: definitionId, pluginId, pluginVersion });
+        const detailPath = `/ability/definitions/${definitionId}/${path}.json`;
+        const { contract_revision: _revision, ...publicDefinition } = definition;
+        const detail = { ...publicDefinition, path, definition_id: definitionId, description: definition.summary };
+        const bytes = encoder.encode(`${canonical(detail)}\n`);
+        try {
+            const existing = await storage.readBytes(detailPath);
+            if (!same(existing, bytes))
+                throw new Error(`L3 内容冲突：${path}`);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT" && error.status !== 404)
+                throw error;
+            await storage.writeBytes(detailPath, bytes, { contentType: "application/json", public: true, overwrite: false });
+        }
+        await verifyPublicDocument(aid, detailPath, bytes);
+        nextLedger[path] = { definition_id: definitionId, release_id: releaseId, plugin_id: pluginId, plugin_version: pluginVersion };
+        published.push({ ...publicDefinition, definition_id: definitionId, release_id: releaseId, plugin_version: pluginVersion, detail_ref: `${aid}:${detailPath}` });
+    }
+    const capabilities = [...otherEntries, ...published].sort((left, right) => String(left.path).localeCompare(String(right.path)));
+    const changed = canonical(capabilities) !== canonical(oldIndex.capabilities);
+    const index = {
+        ...oldIndex,
+        schema: "aun.ability.index.v1",
+        publisher: aid,
+        version: "1.0.0",
+        catalog_revision: changed ? oldIndex.catalog_revision + 1 : oldIndex.catalog_revision,
+        ...(changed ? { updated_at: new Date().toISOString() } : {}),
+        capabilities,
+    };
+    if (changed) {
+        const pendingLedger = structuredClone(oldLedger);
+        for (const [path, record] of Object.entries(nextLedger)) {
+            const old = pendingLedger[path];
+            pendingLedger[path] = { ...record, ...(old ? { previous_definition_ids: [...new Set([old.definition_id, ...(old.previous_definition_ids ?? [])])].filter(value => value !== record.definition_id) } : {}) };
+        }
+        await input.beforeIndexWrite?.(pendingLedger);
+        await storage.writeBytes(indexPath, encoder.encode(`${JSON.stringify(index, null, 2)}\n`), { contentType: "application/json", public: true, overwrite: true });
+        const confirmed = await readIndex(storage, aid);
+        if (canonical(confirmed) !== canonical(index))
+            throw new Error("L1 能力索引写后读回不一致，发布状态未确认");
+    }
+    if (changed || index.capabilities.length > 0 || Object.keys(oldLedger).length > 0) {
+        await verifyPublicDocument(aid, indexPath, await storage.readBytes(indexPath));
+    }
+    return { index, ledger: nextLedger };
+}