linkque-cli-v2 1.0.6 → 1.0.7

package/linkquejs.js

@@ -20363,31 +20363,27 @@ function parseEnvEntry(raw) {
 var import_fs6 = require("fs");
 var import_path9 = require("path");
 var INTEGRATE_PKG = "@alipay/linkque-agent-appwrite-integrate";
-var resolveIntegrateRoot = () => resolveInstalledIntegrateRoot() ?? resolvePortableIntegrateRoot();
+var resolveIntegrateRoot = () => resolvePortableIntegrateRoot() ?? resolveInstalledIntegrateRoot();
 var resolveInstalledIntegrateRoot = () => {
   try {
     return (0, import_path9.dirname)(require.resolve(`${INTEGRATE_PKG}/package.json`));
   } catch {
-    return void 0;
+    throw new LinkqueCliError(
+      "AGENTBUILD_INTEGRATE_NOT_BUILT",
+      "@alipay/linkque-agent-appwrite-integrate \u672A\u5B89\u88C5\uFF0C\u4E14 public bundle \u672A\u643A\u5E26 vendor \u6784\u5EFA\u8D44\u4EA7"
+    );
   }
 };
 var resolvePortableIntegrateRoot = () => {
   let dir = __dirname;
   while (true) {
-    const candidate = (0, import_path9.join)(
-      dir,
-      "vendor",
-      "linkque-agent-appwrite-integrate"
-    );
+    const candidate = (0, import_path9.join)(dir, "vendor", "linkque-agent-appwrite-integrate");
     if ((0, import_fs6.existsSync)((0, import_path9.join)(candidate, "package.json"))) return candidate;
     const parent = (0, import_path9.dirname)(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  throw new LinkqueCliError(
-    "AGENTBUILD_INTEGRATE_NOT_BUILT",
-    "@alipay/linkque-agent-appwrite-integrate \u672A\u5B89\u88C5\uFF0C\u4E14 public bundle \u672A\u643A\u5E26 vendor \u6784\u5EFA\u8D44\u4EA7"
-  );
+  return void 0;
 };
 var assertIntegrateBuilt = (pkgRoot) => {
   const distEsm = (0, import_path9.join)(pkgRoot, "dist", "esm");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "linkque-cli-v2",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "Public Linkque CLI bundle for sandbox debugging",
   "bin": {
     "linkquejs": "linkquejs.js"

package/vendor/linkque-agent-appwrite-integrate/dist/esm/{chunk-52BVDZQ2.js → chunk-FJ2BZPIM.js}

@@ -19798,7 +19798,6 @@ function buildLinkquegwEventBody(context) {
     eventType,
     eventId: context.eventId,
     eventTime: context.timestamp,
-    ...commonParams.userId !== void 0 && { userId: commonParams.userId },
     conversationId: commonParams.conversationId,
     ...commonParams.sessionId !== void 0 && {
       sessionId: commonParams.sessionId
@@ -56373,7 +56372,7 @@ var RemoteSignatureSigner = class {
    * 对一次出站请求取签名。
    *
    * @param req 见 {@link ISignRequest}(method/url/body)
-   * @returns   `{authorization, signatureContent}`
+   * @returns   `{authorization, signatureContent, userId?}`
    * @throws    签名服务非 2xx / 鉴权头获取失败 / 响应缺字段时抛错(由 signingFetch 转 transport-error)。
    */
   async sign(req) {
@@ -56409,7 +56408,8 @@ var RemoteSignatureSigner = class {
     }
     return {
       authorization: payload.authorization,
-      signatureContent: payload.signatureContent
+      signatureContent: payload.signatureContent,
+      ...optionalUserId(payload.userId)
     };
   }
 };
@@ -56431,9 +56431,13 @@ function extractFromWrapped(wrapped) {
   }
   return {
     authorization: data.authorization,
-    signatureContent: data.signatureContent
+    signatureContent: data.signatureContent,
+    ...optionalUserId(data.userId)
   };
 }
+function optionalUserId(value) {
+  return typeof value === "string" && value.trim() ? { userId: value.trim() } : {};
+}
 async function safeText(resp) {
   try {
     return await resp.text();
@@ -57978,6 +57982,7 @@ var SSEClientTransport = class {
 
 // ../linkque-agent-runtime/dist/esm/impl/mcp/alipay/signingFetch.js
 var ALIPAY_SDK_VERSION = "@alipay/open-mcp-server-2.0.4";
+var OAGW_ALIPAY_UID_HEADER = "x-oagw-alipay-uid";
 function createSigningFetch(signer, baseFetch = globalThis.fetch, onTraceId, debugLog) {
   const loggedFetch = debugLog ? createHttpLoggingFetch(debugLog, "mcp-call", baseFetch) : baseFetch;
   return async (url2, init) => {
@@ -57987,11 +57992,16 @@ function createSigningFetch(signer, baseFetch = globalThis.fetch, onTraceId, deb
       httpRequestUrl: targetUrl.pathname + targetUrl.search,
       httpRequestBody: typeof init?.body === "string" ? init.body : ""
     };
-    const { authorization, signatureContent } = await signer.sign(req);
+    const { authorization, signatureContent, userId } = await signer.sign(req);
     const headers = new Headers(init?.headers);
     headers.set("Authorization", authorization);
     headers.set("X-Signature-Content", Buffer.from(signatureContent).toString("base64"));
     headers.set("X-Alipay-SDK-Version", ALIPAY_SDK_VERSION);
+    if (userId) {
+      headers.set(OAGW_ALIPAY_UID_HEADER, userId);
+    } else {
+      headers.delete(OAGW_ALIPAY_UID_HEADER);
+    }
     const resp = await loggedFetch(url2, { ...init, headers });
     if (onTraceId) {
       try {
@@ -60268,7 +60278,6 @@ function setBakedProtocol(protocol) {
 }
 
 export {
-  EModelProvider,
   EResourceType,
   executeHomeData,
   FOLLOW_UP_CONTEXT_MAX_HISTORY_RUNS,

package/vendor/linkque-agent-appwrite-integrate/dist/esm/{chunk-NQM5ZCTR.js → chunk-IAT272TH.js}

@@ -7328,6 +7328,109 @@ var require_agent = __commonJS({
   }
 });
 
+// ../linkque-agent-appwrite-integrate/dist/esm/runtime/auth.js
+var LINKQUE_AUTHORIZATION_HEADER = "x-linkque-authorization";
+var LinkqueGatewayAuthError = class extends Error {
+  code = "invalid_linkque_authorization";
+  status = 401;
+  constructor(message = "X-Linkque-Authorization \u5FC5\u987B\u662F\u5355\u4E2A Bearer \u51ED\u636E") {
+    super(message);
+    this.name = "LinkqueGatewayAuthError";
+  }
+};
+var LinkqueGatewayAuthUnconfiguredError = class extends Error {
+  code = "auth_unconfigured";
+  status = 500;
+  constructor(message = "\u8BA4\u8BC1\u914D\u7F6E\u7F3A\u5931:LINKQUE_AGENT_ACCESS_KEY \u672A\u8BBE\u7F6E") {
+    super(message);
+    this.name = "LinkqueGatewayAuthUnconfiguredError";
+  }
+};
+function resolveLinkqueGatewayAuth(headers, env = process.env, logCtx) {
+  const log = (...a2) => logCtx?.log?.("[auth-resolve]", ...a2);
+  const logError = (...a2) => logCtx?.error?.("[auth-resolve]", ...a2);
+  log("stage=start");
+  const matches = Object.entries(headers ?? {}).filter(([key]) => key.toLowerCase() === LINKQUE_AUTHORIZATION_HEADER);
+  if (matches.length > 0) {
+    log(`stage=header-inspection, state=present, count=${matches.length}`);
+    log("stage=user-token-validation, state=start");
+    if (matches.length !== 1) {
+      logError("stage=failed, reason=duplicate-header");
+      throw new LinkqueGatewayAuthError();
+    }
+    const value = matches[0]?.[1];
+    if (typeof value !== "string") {
+      logError("stage=failed, reason=multi-value-header");
+      throw new LinkqueGatewayAuthError();
+    }
+    if (value.includes(",")) {
+      logError("stage=failed, reason=joined-header");
+      throw new LinkqueGatewayAuthError();
+    }
+    const match = /^Bearer[\t ]+([^\s,]+)$/iu.exec(value.trim());
+    const token = match?.[1];
+    if (!token) {
+      logError("stage=failed, reason=invalid-bearer-format");
+      throw new LinkqueGatewayAuthError();
+    }
+    log("stage=user-token-validation, state=success, scheme=Bearer");
+    const provider2 = resolveProvider(env.LINKQUE_MODEL_PROVIDER, log, logError);
+    log("stage=complete, mode=user-token, source=request-header");
+    return {
+      mode: "user-token",
+      modelCredential: token,
+      authorizationHeader: `Bearer ${token}`,
+      auth: { provider: provider2, apiKey: token }
+    };
+  }
+  log("stage=header-inspection, state=absent");
+  log("stage=aak-fallback, state=start, source=env:LINKQUE_AGENT_ACCESS_KEY");
+  const apiKey = env.LINKQUE_AGENT_ACCESS_KEY?.trim();
+  if (!apiKey) {
+    logError("stage=failed, reason=aak-unconfigured");
+    throw new LinkqueGatewayAuthUnconfiguredError();
+  }
+  log("stage=aak-fallback, state=configured");
+  const provider = resolveProvider(env.LINKQUE_MODEL_PROVIDER, log, logError);
+  log("stage=complete, mode=aak, source=env:LINKQUE_AGENT_ACCESS_KEY");
+  return {
+    mode: "aak",
+    modelCredential: apiKey,
+    authorizationHeader: `aak ${apiKey}`,
+    auth: { provider, apiKey }
+  };
+}
+function resolveGatewayAuthContext(gatewayAuth, env = process.env, logCtx, caller = "unknown") {
+  const log = (...a2) => logCtx?.log?.("[auth-resolve]", ...a2);
+  if (gatewayAuth) {
+    log(`stage=context-selection, caller=${caller}, branch=request-context, mode=${gatewayAuth.mode}`);
+    return gatewayAuth;
+  }
+  log(`stage=context-selection, caller=${caller}, branch=compat-env-fallback`);
+  return resolveLinkqueGatewayAuth(void 0, env, logCtx);
+}
+function parseProvider(raw) {
+  if (!raw)
+    return "LINKQUE";
+  const upper = raw.toUpperCase();
+  if (upper === "LINKQUE")
+    return "LINKQUE";
+  if (upper === "TEST")
+    return "TEST";
+  throw new Error(`\u4E0D\u652F\u6301\u7684 LINKQUE_MODEL_PROVIDER="${raw}"(\u5F53\u524D\u652F\u6301:LINKQUE\u3001TEST)`);
+}
+function resolveProvider(raw, log, logError) {
+  log("stage=provider-resolution, state=start");
+  try {
+    const provider = parseProvider(raw);
+    log(`stage=provider-resolution, state=success, provider=${provider}`);
+    return provider;
+  } catch (error) {
+    logError("stage=failed, reason=invalid-provider");
+    throw error;
+  }
+}
+
 // ../../node_modules/node-fetch-native-with-agent/dist/index.mjs
 var a = Object.defineProperty;
 var t = (e, r) => a(e, "name", { value: r, configurable: true });
@@ -11699,7 +11802,7 @@ function apiKeySource(env, hasRequestKey) {
 }
 function describeRuntimeEnv(env, hasRequestKey = false) {
   const lines = [];
-  lines.push(envLine("LINKQUE_AGENT_ACCESS_KEY", maskSecret(env.LINKQUE_AGENT_ACCESS_KEY?.trim())));
+  lines.push(envLine("LINKQUE_AGENT_ACCESS_KEY", env.LINKQUE_AGENT_ACCESS_KEY?.trim() ? "<set>" : "<unset>"));
   lines.push(envLine("LINKQUE_MODEL_PROVIDER", envValue(env, "LINKQUE_MODEL_PROVIDER")));
   lines.push(envLine("APPBASE_ENDPOINT", `${maskEndpoint(firstHit(env, ENDPOINT_SOURCES))}(src=${whichSource(env, ENDPOINT_SOURCES)})`));
   lines.push(envLine("APPBASE_PROJECT_ID", `${firstHit(env, PROJECT_SOURCES)}(src=${whichSource(env, PROJECT_SOURCES)})`));
@@ -11954,7 +12057,7 @@ async function clientCapability(ctx) {
     result = await runClientCapability(readAppwriteTrigger(ctx.req.headers), ctx.req.method, resolveBodyJSON(ctx.req), readAuthenticatedUserId(ctx.req.headers), store);
   } catch (error) {
     ctx.error?.(error);
-    result = jsonError(500, "internal_error", error instanceof Error ? error.message : "unknown error");
+    result = error instanceof LinkqueGatewayAuthError || error instanceof LinkqueGatewayAuthUnconfiguredError ? jsonError(error.status, error.code, error.message) : jsonError(500, "internal_error", error instanceof Error ? error.message : "unknown error");
   }
   return ctx.res.json?.(result.body, result.status);
 }
@@ -11993,6 +12096,10 @@ function requiredEnv(name) {
 }
 
 export {
+  LinkqueGatewayAuthError,
+  LinkqueGatewayAuthUnconfiguredError,
+  resolveLinkqueGatewayAuth,
+  resolveGatewayAuthContext,
   resolveBodyJSON,
   toAgentRunMessages,
   jsonError,
@@ -12001,7 +12108,6 @@ export {
   readAuthenticatedUserId,
   readAppwriteApiKey,
   Query,
-  maskSecret,
   isDebugLogLevel,
   describeRuntimeEnv,
   resolveRunStorage,

package/vendor/linkque-agent-appwrite-integrate/dist/esm/runtime/handler/chat.js

@@ -1,20 +1,23 @@
 import {
+  LinkqueGatewayAuthError,
+  LinkqueGatewayAuthUnconfiguredError,
   Query,
   createAppBaseClient,
   createClientCapabilityStore,
   describeRuntimeEnv,
   isDebugLogLevel,
   jsonError,
-  maskSecret,
   parseStoredClientCapabilityResult,
   readAppwriteApiKey,
   readAuthenticatedUserId,
   readEnvSelector,
   readTraceId,
   resolveBodyJSON,
+  resolveGatewayAuthContext,
+  resolveLinkqueGatewayAuth,
   resolveRunStorage,
   toAgentRunMessages
-} from "../../chunk-NQM5ZCTR.js";
+} from "../../chunk-IAT272TH.js";
 import "../../chunk-MKS245OU.js";
 import "../../chunk-YDKZZ6EH.js";
 import "../../chunk-2NGJGNYB.js";
@@ -28,7 +31,6 @@ import {
   DEFAULT_CONVERSATION_LIST_LIMIT,
   DEFAULT_CONVERSATION_RUN_LIST_LIMIT,
   DEFAULT_CONVERSATION_SEARCH_LIMIT,
-  EModelProvider,
   EResourceType,
   ESkillUrlScheme,
   EventType,
@@ -46,7 +48,7 @@ import {
   parseConversationRunRequest,
   parseSkillFile,
   streamToConversationEvents
-} from "../../chunk-52BVDZQ2.js";
+} from "../../chunk-FJ2BZPIM.js";
 import "../../chunk-XUFLSZM4.js";
 import "../../chunk-I64V3ICJ.js";
 import "../../chunk-6MHDOBWO.js";
@@ -307,25 +309,29 @@ function createAppBaseRuntime(protocol, env = process.env, ports = {}, logCtx) {
 
 // ../linkque-agent-appwrite-integrate/dist/esm/runtime/handler/asr.js
 var ASR_CREATE_CREDENTIAL_OPERATION = "asr.createCredential";
-async function runAsrCredential(method, env, authenticatedUserId, agentId, fetchImpl = fetch, envSelector) {
+async function runAsrCredential(method, env, authenticatedUserId, agentId, fetchImpl = fetch, envSelector, gatewayAuth, logCtx) {
   if (method !== "POST")
     return jsonError(405, "method_not_allowed", "\u4EC5\u652F\u6301 POST");
   if (!authenticatedUserId) {
     return jsonError(401, "authentication_required", "\u7F3A\u5C11 Appwrite \u8BA4\u8BC1\u7528\u6237");
   }
-  const accessToken = env.LINKQUE_AGENT_ACCESS_KEY?.trim();
+  let resolvedAuth;
+  try {
+    resolvedAuth = resolveGatewayAuthContext(gatewayAuth, env, logCtx, "asr");
+  } catch {
+    return jsonError(500, "auth_unconfigured", "linkquegw AAK \u672A\u914D\u7F6E");
+  }
   const gatewayBaseUrl = resolveLinkqueEndpoints(env, envSelector).knowledgeBaseUrl;
-  if (!accessToken || !gatewayBaseUrl) {
-    return jsonError(500, "gateway_unconfigured", "linkquegw AAK \u6216\u5730\u5740\u672A\u914D\u7F6E");
+  if (!gatewayBaseUrl) {
+    return jsonError(500, "gateway_unconfigured", "linkquegw \u5730\u5740\u672A\u914D\u7F6E");
   }
   let response;
   try {
     response = await fetchImpl(`${gatewayBaseUrl}/api/asr/credential`, {
       method: "POST",
       headers: {
-        Authorization: `aak ${accessToken}`,
-        "x-linkque-agent-id": agentId,
-        "x-linkque-appbase-user-id": authenticatedUserId
+        Authorization: resolvedAuth.authorizationHeader,
+        "x-linkque-agent-id": agentId
       }
     });
   } catch {
@@ -352,27 +358,31 @@ async function runAsrCredential(method, env, authenticatedUserId, agentId, fetch
 
 // ../linkque-agent-appwrite-integrate/dist/esm/runtime/handler/attachment.js
 var ATTACHMENT_CREATE_UPLOAD_TOKEN_OPERATION = "attachment.createUploadToken";
-async function runAttachmentUploadToken(method, env, authenticatedUserId, agentId, fetchImpl = fetch, envSelector) {
+async function runAttachmentUploadToken(method, env, authenticatedUserId, agentId, fetchImpl = fetch, envSelector, gatewayAuth, logCtx) {
   if (method !== "POST") {
     return jsonError(405, "method_not_allowed", "\u4EC5\u652F\u6301 POST");
   }
   if (!authenticatedUserId) {
     return jsonError(401, "authentication_required", "\u7F3A\u5C11 Appwrite \u8BA4\u8BC1\u7528\u6237");
   }
-  const accessToken = env.LINKQUE_AGENT_ACCESS_KEY?.trim();
+  let resolvedAuth;
+  try {
+    resolvedAuth = resolveGatewayAuthContext(gatewayAuth, env, logCtx, "attachment");
+  } catch {
+    return jsonError(500, "auth_unconfigured", "linkquegw AAK \u672A\u914D\u7F6E");
+  }
   const gatewayBaseUrl = resolveLinkqueEndpoints(env, envSelector).knowledgeBaseUrl;
-  if (!accessToken || !gatewayBaseUrl) {
-    return jsonError(500, "gateway_unconfigured", "linkquegw AAK \u6216\u5730\u5740\u672A\u914D\u7F6E");
+  if (!gatewayBaseUrl) {
+    return jsonError(500, "gateway_unconfigured", "linkquegw \u5730\u5740\u672A\u914D\u7F6E");
   }
   let response;
   try {
     response = await fetchImpl(`${gatewayBaseUrl}/api/mass/token`, {
       method: "POST",
       headers: {
-        Authorization: `aak ${accessToken}`,
+        Authorization: resolvedAuth.authorizationHeader,
         "content-type": "application/json",
-        "x-linkque-agent-id": agentId,
-        "x-linkque-appbase-user-id": authenticatedUserId
+        "x-linkque-agent-id": agentId
       },
       body: JSON.stringify({ massType: 3 })
     });
@@ -1143,28 +1153,6 @@ function controlError(status, code, message) {
   return { status, body: { error: { code, message, status } } };
 }
 
-// ../linkque-agent-appwrite-integrate/dist/esm/runtime/auth.js
-function resolveAuthFromEnv(env = process.env, logCtx) {
-  const log = (...a) => logCtx?.log?.("[auth-resolve]", ...a);
-  const apiKey = env.LINKQUE_AGENT_ACCESS_KEY?.trim();
-  if (!apiKey) {
-    throw new Error("\u8BA4\u8BC1\u914D\u7F6E\u7F3A\u5931:LINKQUE_AGENT_ACCESS_KEY \u672A\u8BBE\u7F6E");
-  }
-  const provider = parseProvider(env.LINKQUE_MODEL_PROVIDER);
-  log("agent \u8BA4\u8BC1\u89E3\u6790\u6210\u529F, provider=", provider, "apiKey=", maskSecret(apiKey), "source=env:LINKQUE_AGENT_ACCESS_KEY");
-  return { auth: { provider, apiKey } };
-}
-function parseProvider(raw) {
-  if (!raw)
-    return EModelProvider.LINKQUE;
-  const upper = raw.toUpperCase();
-  if (upper === "LINKQUE")
-    return EModelProvider.LINKQUE;
-  if (upper === "TEST")
-    return EModelProvider.TEST;
-  throw new Error(`\u4E0D\u652F\u6301\u7684 LINKQUE_MODEL_PROVIDER="${raw}"(\u5F53\u524D\u652F\u6301:LINKQUE\u3001TEST)`);
-}
-
 // ../linkque-agent-appwrite-integrate/dist/esm/runtime/appbaseStore.js
 function createAppBaseStore(databases, databaseId, tableId, ownerId) {
   const permissions = rowPermissions(ownerId);
@@ -1599,7 +1587,7 @@ function historyError(status, code, message) {
 
 // ../linkque-agent-appwrite-integrate/dist/esm/runtime/handler/homeData.js
 var HOME_DATA_REQUEST_OPERATION = "homeData.request";
-async function runHomeData(method, body, userId, deps = {}, env = process.env, envSelector = "PROD") {
+async function runHomeData(method, body, userId, deps = {}, env = process.env, envSelector = "PROD", gatewayAuth, logCtx) {
   if (method.toUpperCase() !== "POST") {
     return jsonError(405, "method_not_allowed", "\u4EC5\u652F\u6301 POST");
   }
@@ -1609,8 +1597,10 @@ async function runHomeData(method, body, userId, deps = {}, env = process.env, e
   const protocol = deps.protocol ?? getBakedProtocol();
   let provider = deps.mcpServerProvider;
   if (!provider) {
-    const accessKey = env.LINKQUE_AGENT_ACCESS_KEY?.trim();
-    if (!accessKey) {
+    let resolvedAuth;
+    try {
+      resolvedAuth = resolveGatewayAuthContext(gatewayAuth, env, logCtx, "home-data");
+    } catch {
       return jsonError(500, "auth_unconfigured", "LINKQUE_AGENT_ACCESS_KEY \u672A\u914D\u7F6E");
     }
     const { mcpSignEndpoint } = resolveLinkqueEndpoints(env, envSelector);
@@ -1619,7 +1609,7 @@ async function runHomeData(method, body, userId, deps = {}, env = process.env, e
         agentId: protocol.agentId,
         ...mcpSignEndpoint ? { signEndpoint: mcpSignEndpoint } : {}
       }),
-      getAuthorizationHeader: async () => `aak ${accessKey}`
+      getAuthorizationHeader: async () => resolvedAuth.authorizationHeader
     });
   }
   const response = await executeHomeData({
@@ -1632,7 +1622,7 @@ async function runHomeData(method, body, userId, deps = {}, env = process.env, e
 }
 
 // ../linkque-agent-appwrite-integrate/dist/esm/runtime/handler/chatConfig.js
-function resolveChatDeps(env, deps, logCtx, historyOwnerId, appwriteApiKey, envSelector) {
+function resolveChatDeps(env, deps, logCtx, historyOwnerId, appwriteApiKey, envSelector, gatewayAuth) {
   const log = (...a) => logCtx?.log?.("[chat]", ...a);
   const logError = (...a) => logCtx?.error?.("[chat]", ...a);
   const protocol = deps?.protocol ?? getBakedProtocol();
@@ -1642,8 +1632,8 @@ function resolveChatDeps(env, deps, logCtx, historyOwnerId, appwriteApiKey, envS
   }
   let resolved;
   try {
-    resolved = resolveAuthFromEnv(env, logCtx);
-    log("\u8BA4\u8BC1\u89E3\u6790\u6210\u529F, provider=", resolved.auth.provider, "model=", protocol.agent.model.defaultModel ?? "default");
+    resolved = resolveGatewayAuthContext(gatewayAuth, env, logCtx, "chat");
+    log("\u8BA4\u8BC1\u89E3\u6790\u6210\u529F, provider=", resolved.auth.provider, "mode=", resolved.mode, "model=", protocol.agent.model.defaultModel ?? "default");
   } catch (err) {
     logError("\u8BA4\u8BC1\u914D\u7F6E\u7F3A\u5931:", err);
     return jsonError(500, "auth_unconfigured", err instanceof Error ? err.message : "\u8BA4\u8BC1\u914D\u7F6E\u7F3A\u5931");
@@ -1688,7 +1678,7 @@ function resolveChatDeps(env, deps, logCtx, historyOwnerId, appwriteApiKey, envS
     }
     chunkSize = storage.chunkSize;
   }
-  const mcpAuthorizationHeaderProvider = async () => `aak ${resolved.auth.apiKey}`;
+  const mcpAuthorizationHeaderProvider = async () => resolved.authorizationHeader;
   const { linkqueBaseUrl, knowledgeBaseUrl, mcpSignEndpoint } = resolveLinkqueEndpoints(env, envSelector);
   const mcpConfigResolver = createAppbaseMcpConfigResolver({
     agentId: protocol.agentId,
@@ -2035,7 +2025,7 @@ function shouldFlushConversationEvent(event) {
 }
 
 // ../linkque-agent-appwrite-integrate/dist/esm/runtime/handler/chat.js
-async function runChat(method, bodyJSON, env, deps, logCtx, historyOwnerId, appwriteApiKey, envSelector, traceId) {
+async function runChat(method, bodyJSON, env, deps, logCtx, historyOwnerId, appwriteApiKey, envSelector, traceId, gatewayAuth) {
   const log = (...args) => logCtx?.log?.("[chat]", ...args);
   const logError = (...args) => logCtx?.error?.("[chat]", ...args);
   const guarded = guardChatRequest(method, bodyJSON, logCtx);
@@ -2043,7 +2033,7 @@ async function runChat(method, bodyJSON, env, deps, logCtx, historyOwnerId, appw
     return guarded;
   const request = guarded;
   const isPresentationRun = request.executionScope === "presentation";
-  const cfg = resolveChatDeps(env, deps, logCtx, historyOwnerId, appwriteApiKey, envSelector);
+  const cfg = resolveChatDeps(env, deps, logCtx, historyOwnerId, appwriteApiKey, envSelector, gatewayAuth);
   if ("status" in cfg)
     return cfg;
   const leaseOwnerId = randomUUID3();
@@ -2265,18 +2255,18 @@ function waitForCancellationPoll(delayMs, signal) {
     }
   });
 }
-async function runGateway(method, bodyJSON, env, deps, logCtx, historyOwnerId, appwriteApiKey, envSelector, traceId) {
+async function runGateway(method, bodyJSON, env, deps, logCtx, historyOwnerId, appwriteApiKey, envSelector, traceId, gatewayAuth) {
   const operation = readOperation(bodyJSON);
   if (operation === "cancelConversationRun") {
     return runCancelConversation(method, bodyJSON, env, deps ? { protocol: deps.protocol, store: deps.historyStore } : void 0, logCtx, historyOwnerId, appwriteApiKey);
   }
   if (operation === ASR_CREATE_CREDENTIAL_OPERATION) {
     const agentId = deps?.protocol?.agentId ?? getBakedProtocol().agentId;
-    return runAsrCredential(method, env, historyOwnerId, agentId, void 0, envSelector);
+    return runAsrCredential(method, env, historyOwnerId, agentId, void 0, envSelector, gatewayAuth, logCtx);
   }
   if (operation === ATTACHMENT_CREATE_UPLOAD_TOKEN_OPERATION) {
     const agentId = deps?.protocol?.agentId ?? getBakedProtocol().agentId;
-    return runAttachmentUploadToken(method, env, historyOwnerId, agentId, void 0, envSelector);
+    return runAttachmentUploadToken(method, env, historyOwnerId, agentId, void 0, envSelector, gatewayAuth, logCtx);
   }
   if (operation === HOME_DATA_REQUEST_OPERATION) {
     const request = readOperationPayload(bodyJSON);
@@ -2294,7 +2284,7 @@ async function runGateway(method, bodyJSON, env, deps, logCtx, historyOwnerId, a
   if (operation) {
     return jsonError(400, "operation_unsupported", `\u4E0D\u652F\u6301\u7684 operation: ${operation}`);
   }
-  return runChat(method, bodyJSON, env, deps, logCtx, historyOwnerId, appwriteApiKey, envSelector, traceId);
+  return runChat(method, bodyJSON, env, deps, logCtx, historyOwnerId, appwriteApiKey, envSelector, traceId, gatewayAuth);
 }
 async function chat(ctx) {
   let result;
@@ -2304,10 +2294,14 @@ async function chat(ctx) {
     const appwriteApiKey = readAppwriteApiKey(ctx.req.headers);
     const envSelector = readEnvSelector(ctx.req.headers);
     const traceId = readTraceId(ctx.req.headers);
-    result = historyOwnerId ? await runGateway(ctx.req.method, bodyJSON, process.env, void 0, { log: ctx.log, error: ctx.error }, historyOwnerId, appwriteApiKey, envSelector, traceId) : jsonError(401, "authentication_required", "\u7F3A\u5C11 Appwrite \u8BA4\u8BC1\u7528\u6237");
+    const gatewayAuth = historyOwnerId ? resolveLinkqueGatewayAuth(ctx.req.headers, process.env, {
+      log: ctx.log,
+      error: ctx.error
+    }) : void 0;
+    result = historyOwnerId ? await runGateway(ctx.req.method, bodyJSON, process.env, void 0, { log: ctx.log, error: ctx.error }, historyOwnerId, appwriteApiKey, envSelector, traceId, gatewayAuth) : jsonError(401, "authentication_required", "\u7F3A\u5C11 Appwrite \u8BA4\u8BC1\u7528\u6237");
   } catch (err) {
     ctx.error?.(err);
-    result = {
+    result = err instanceof LinkqueGatewayAuthError || err instanceof LinkqueGatewayAuthUnconfiguredError ? jsonError(err.status, err.code, err.message) : {
       status: 500,
       body: {
         error: {

package/vendor/linkque-agent-appwrite-integrate/dist/esm/runtime/handler/clientCapability.js

@@ -3,7 +3,7 @@ import {
   runClientCapability,
   runClientCapabilityCleanup,
   runClientCapabilityResult
-} from "../../chunk-NQM5ZCTR.js";
+} from "../../chunk-IAT272TH.js";
 import "../../chunk-MKS245OU.js";
 import "../../chunk-YDKZZ6EH.js";
 import "../../chunk-2NGJGNYB.js";

package/vendor/linkque-agent-appwrite-integrate/dist/esm/runtime/protocol.js

@@ -1,7 +1,7 @@
 import {
   getBakedProtocol,
   setBakedProtocol
-} from "../chunk-52BVDZQ2.js";
+} from "../chunk-FJ2BZPIM.js";
 import "../chunk-XUFLSZM4.js";
 import "../chunk-I64V3ICJ.js";
 import "../chunk-6MHDOBWO.js";

package/worker.js

@@ -16845,7 +16845,6 @@ function buildLinkquegwEventBody(context2) {
     eventType,
     eventId: context2.eventId,
     eventTime: context2.timestamp,
-    ...commonParams.userId !== void 0 && { userId: commonParams.userId },
     conversationId: commonParams.conversationId,
     ...commonParams.sessionId !== void 0 && {
       sessionId: commonParams.sessionId
@@ -193399,9 +193398,13 @@ function extractFromWrapped(wrapped) {
   }
   return {
     authorization: data.authorization,
-    signatureContent: data.signatureContent
+    signatureContent: data.signatureContent,
+    ...optionalUserId(data.userId)
   };
 }
+function optionalUserId(value) {
+  return typeof value === "string" && value.trim() ? { userId: value.trim() } : {};
+}
 async function safeText(resp) {
   try {
     return await resp.text();
@@ -193431,7 +193434,7 @@ var init_remoteSignatureSigner = __esm({
        * 对一次出站请求取签名。
        *
        * @param req 见 {@link ISignRequest}(method/url/body)
-       * @returns   `{authorization, signatureContent}`
+       * @returns   `{authorization, signatureContent, userId?}`
        * @throws    签名服务非 2xx / 鉴权头获取失败 / 响应缺字段时抛错(由 signingFetch 转 transport-error)。
        */
       async sign(req) {
@@ -193467,7 +193470,8 @@ var init_remoteSignatureSigner = __esm({
         }
         return {
           authorization: payload.authorization,
-          signatureContent: payload.signatureContent
+          signatureContent: payload.signatureContent,
+          ...optionalUserId(payload.userId)
         };
       }
     };
@@ -195049,11 +195053,16 @@ function createSigningFetch(signer, baseFetch = globalThis.fetch, onTraceId, deb
       httpRequestUrl: targetUrl.pathname + targetUrl.search,
       httpRequestBody: typeof init?.body === "string" ? init.body : ""
     };
-    const { authorization, signatureContent } = await signer.sign(req);
+    const { authorization, signatureContent, userId } = await signer.sign(req);
     const headers = new Headers(init?.headers);
     headers.set("Authorization", authorization);
     headers.set("X-Signature-Content", Buffer.from(signatureContent).toString("base64"));
     headers.set("X-Alipay-SDK-Version", ALIPAY_SDK_VERSION);
+    if (userId) {
+      headers.set(OAGW_ALIPAY_UID_HEADER, userId);
+    } else {
+      headers.delete(OAGW_ALIPAY_UID_HEADER);
+    }
     const resp = await loggedFetch(url2, { ...init, headers });
     if (onTraceId) {
       try {
@@ -195071,12 +195080,13 @@ function createSigningFetch(signer, baseFetch = globalThis.fetch, onTraceId, deb
     return resp;
   };
 }
-var ALIPAY_SDK_VERSION;
+var ALIPAY_SDK_VERSION, OAGW_ALIPAY_UID_HEADER;
 var init_signingFetch = __esm({
   "../linkque-agent-runtime/dist/esm/impl/mcp/alipay/signingFetch.js"() {
     "use strict";
     init_httpLoggingFetch();
     ALIPAY_SDK_VERSION = "@alipay/open-mcp-server-2.0.4";
+    OAGW_ALIPAY_UID_HEADER = "x-oagw-alipay-uid";
   }
 });