linkque-cli-v2 1.0.6 → 1.1.0

package/linkquejs.js

@@ -20363,31 +20363,27 @@ function parseEnvEntry(raw) {
 var import_fs6 = require("fs");
 var import_path9 = require("path");
 var INTEGRATE_PKG = "@alipay/linkque-agent-appwrite-integrate";
-var resolveIntegrateRoot = () => resolveInstalledIntegrateRoot() ?? resolvePortableIntegrateRoot();
+var resolveIntegrateRoot = () => resolvePortableIntegrateRoot() ?? resolveInstalledIntegrateRoot();
 var resolveInstalledIntegrateRoot = () => {
   try {
     return (0, import_path9.dirname)(require.resolve(`${INTEGRATE_PKG}/package.json`));
   } catch {
-    return void 0;
+    throw new LinkqueCliError(
+      "AGENTBUILD_INTEGRATE_NOT_BUILT",
+      "@alipay/linkque-agent-appwrite-integrate \u672A\u5B89\u88C5\uFF0C\u4E14 public bundle \u672A\u643A\u5E26 vendor \u6784\u5EFA\u8D44\u4EA7"
+    );
   }
 };
 var resolvePortableIntegrateRoot = () => {
   let dir = __dirname;
   while (true) {
-    const candidate = (0, import_path9.join)(
-      dir,
-      "vendor",
-      "linkque-agent-appwrite-integrate"
-    );
+    const candidate = (0, import_path9.join)(dir, "vendor", "linkque-agent-appwrite-integrate");
     if ((0, import_fs6.existsSync)((0, import_path9.join)(candidate, "package.json"))) return candidate;
     const parent = (0, import_path9.dirname)(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  throw new LinkqueCliError(
-    "AGENTBUILD_INTEGRATE_NOT_BUILT",
-    "@alipay/linkque-agent-appwrite-integrate \u672A\u5B89\u88C5\uFF0C\u4E14 public bundle \u672A\u643A\u5E26 vendor \u6784\u5EFA\u8D44\u4EA7"
-  );
+  return void 0;
 };
 var assertIntegrateBuilt = (pkgRoot) => {
   const distEsm = (0, import_path9.join)(pkgRoot, "dist", "esm");
@@ -25453,6 +25449,20 @@ function getJsonSchemaIssues(value, path22 = "schema", options = {}) {
   validateSchemaNode(value, path22, issues, options);
   return issues;
 }
+var OPAQUE_OBJECT_SCHEMA = {
+  type: "object",
+  additionalProperties: true
+};
+function normalizeMcpOutputSchema(value) {
+  if (!isPlainRecord(value) || getJsonSchemaIssues(value).length > 0) {
+    return { schema: { ...OPAQUE_OBJECT_SCHEMA }, mode: "opaque" };
+  }
+  const schema = cloneJsonValue(value);
+  if (schema.type === "object" && (!isPlainRecord(schema.properties) || Object.keys(schema.properties).length === 0) && !isPlainRecord(schema.additionalProperties)) {
+    return { schema: { ...OPAQUE_OBJECT_SCHEMA }, mode: "opaque" };
+  }
+  return { schema, mode: "declared" };
+}
 function normalizeTargetJsonSchema(schema) {
   const cloned = JSON.parse(JSON.stringify(schema));
   normalizeObjectDefaults(cloned);
@@ -25905,7 +25915,7 @@ function parseA2UICardBindingContext(value) {
   const issues = getA2UICardBindingContextIssues(value);
   return issues.length > 0 ? { success: false, issues } : {
     success: true,
-    data: JSON.parse(JSON.stringify(value)),
+    data: normalizeBindingContext(value),
     issues: []
   };
 }
@@ -26052,11 +26062,7 @@ function validateA2UICardBindings(input, options = {}) {
       issues.push(issue2(`fields.${field.fieldId}`, "MCP_TOOL_UNAVAILABLE", `MCP tool ${binding.toolName} is absent from binding context`));
       continue;
     }
-    const transform = validateA2UICardTransform(binding.transform, {
-      fieldId: field.fieldId,
-      sourceSchema: tool.outputSchema,
-      targetSchema: field.valueSchema
-    });
+    const transform = validateA2UICardTransform(binding.transform);
     issues.push(...transform.issues.map((entry) => ({
       ...entry,
       path: `fields.${field.fieldId}.${entry.path}`
@@ -26127,6 +26133,7 @@ function validateTool(value, path22, resourceId, issues) {
     "description",
     "inputSchema",
     "outputSchema",
+    "outputSchemaMode",
     "annotations"
   ], path22, issues);
   if (value.resourceId !== resourceId) {
@@ -26136,11 +26143,28 @@ function validateTool(value, path22, resourceId, issues) {
     issues.push(issue2(`${path22}.toolName`, "CARD_BINDING_CONTEXT_INVALID", "toolName is required"));
   }
   issues.push(...getJsonSchemaIssues(value.inputSchema, `${path22}.inputSchema`));
-  issues.push(...getJsonSchemaIssues(value.outputSchema, `${path22}.outputSchema`));
-  if (isPlainRecord(value.annotations) && value.annotations.readOnlyHint === false) {
-    issues.push(issue2(`${path22}.annotations`, "CARD_BINDING_CONTEXT_INVALID", "tool explicitly declares readOnlyHint=false"));
+  if (value.outputSchemaMode !== void 0 && value.outputSchemaMode !== "declared" && value.outputSchemaMode !== "opaque") {
+    issues.push(issue2(`${path22}.outputSchemaMode`, "CARD_BINDING_CONTEXT_INVALID", "outputSchemaMode must be declared or opaque"));
   }
 }
+function normalizeBindingContext(context) {
+  const cloned = JSON.parse(JSON.stringify(context));
+  cloned.candidates = cloned.candidates.map((candidate) => {
+    if (candidate.status !== "ready")
+      return candidate;
+    const normalized = normalizeMcpOutputSchema(candidate.tool.outputSchema);
+    const mode2 = normalized.mode === "opaque" || candidate.tool.outputSchemaMode === "opaque" ? "opaque" : "declared";
+    return {
+      ...candidate,
+      tool: {
+        ...candidate.tool,
+        outputSchema: normalized.schema,
+        outputSchemaMode: mode2
+      }
+    };
+  });
+  return cloned;
+}
 function validatePreferences(value, path22, issues) {
   if (value === void 0)
     return;
@@ -27154,7 +27178,7 @@ function compileV3Resource(draft, revision, bindings, tools) {
       purpose: binding.purpose,
       required: binding.required,
       ...binding.dependsOn?.length ? { dependsOn: [...binding.dependsOn] } : {},
-      outputSchema: tool?.outputSchema ?? {}
+      outputSchema: normalizeMcpOutputSchema(tool?.outputSchema).schema
     };
     const previous = sourceById.get(source.sourceId);
     if (previous && stableJsonStringify(previous) !== stableJsonStringify(source)) {
@@ -27604,7 +27628,10 @@ async function validateCardBindingsFromDisk(cwd, draftId, expectedContextChecksu
   }
   const context = contextResult.data;
   const actualContextChecksum = createA2UICardBindingContextChecksum(context);
-  if (actualContextChecksum !== expectedContextChecksum) {
+  const legacyContextChecksum = createA2UICardBindingContextChecksum(
+    contextValue
+  );
+  if (actualContextChecksum !== expectedContextChecksum && legacyContextChecksum !== expectedContextChecksum) {
     throw new LinkqueCliError(
       "CARD_BINDING_CONTEXT_STALE",
       "\u7ED1\u5B9A\u4E0A\u4E0B\u6587\u5DF2\u53D8\u5316\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77 AI \u8F85\u52A9\u7ED1\u5B9A"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "linkque-cli-v2",
-  "version": "1.0.6",
+  "version": "1.1.0",
   "description": "Public Linkque CLI bundle for sandbox debugging",
   "bin": {
     "linkquejs": "linkquejs.js"

package/vendor/linkque-agent-appwrite-integrate/dist/esm/{chunk-NQM5ZCTR.js → chunk-IAT272TH.js}

@@ -7328,6 +7328,109 @@ var require_agent = __commonJS({
   }
 });
 
+// ../linkque-agent-appwrite-integrate/dist/esm/runtime/auth.js
+var LINKQUE_AUTHORIZATION_HEADER = "x-linkque-authorization";
+var LinkqueGatewayAuthError = class extends Error {
+  code = "invalid_linkque_authorization";
+  status = 401;
+  constructor(message = "X-Linkque-Authorization \u5FC5\u987B\u662F\u5355\u4E2A Bearer \u51ED\u636E") {
+    super(message);
+    this.name = "LinkqueGatewayAuthError";
+  }
+};
+var LinkqueGatewayAuthUnconfiguredError = class extends Error {
+  code = "auth_unconfigured";
+  status = 500;
+  constructor(message = "\u8BA4\u8BC1\u914D\u7F6E\u7F3A\u5931:LINKQUE_AGENT_ACCESS_KEY \u672A\u8BBE\u7F6E") {
+    super(message);
+    this.name = "LinkqueGatewayAuthUnconfiguredError";
+  }
+};
+function resolveLinkqueGatewayAuth(headers, env = process.env, logCtx) {
+  const log = (...a2) => logCtx?.log?.("[auth-resolve]", ...a2);
+  const logError = (...a2) => logCtx?.error?.("[auth-resolve]", ...a2);
+  log("stage=start");
+  const matches = Object.entries(headers ?? {}).filter(([key]) => key.toLowerCase() === LINKQUE_AUTHORIZATION_HEADER);
+  if (matches.length > 0) {
+    log(`stage=header-inspection, state=present, count=${matches.length}`);
+    log("stage=user-token-validation, state=start");
+    if (matches.length !== 1) {
+      logError("stage=failed, reason=duplicate-header");
+      throw new LinkqueGatewayAuthError();
+    }
+    const value = matches[0]?.[1];
+    if (typeof value !== "string") {
+      logError("stage=failed, reason=multi-value-header");
+      throw new LinkqueGatewayAuthError();
+    }
+    if (value.includes(",")) {
+      logError("stage=failed, reason=joined-header");
+      throw new LinkqueGatewayAuthError();
+    }
+    const match = /^Bearer[\t ]+([^\s,]+)$/iu.exec(value.trim());
+    const token = match?.[1];
+    if (!token) {
+      logError("stage=failed, reason=invalid-bearer-format");
+      throw new LinkqueGatewayAuthError();
+    }
+    log("stage=user-token-validation, state=success, scheme=Bearer");
+    const provider2 = resolveProvider(env.LINKQUE_MODEL_PROVIDER, log, logError);
+    log("stage=complete, mode=user-token, source=request-header");
+    return {
+      mode: "user-token",
+      modelCredential: token,
+      authorizationHeader: `Bearer ${token}`,
+      auth: { provider: provider2, apiKey: token }
+    };
+  }
+  log("stage=header-inspection, state=absent");
+  log("stage=aak-fallback, state=start, source=env:LINKQUE_AGENT_ACCESS_KEY");
+  const apiKey = env.LINKQUE_AGENT_ACCESS_KEY?.trim();
+  if (!apiKey) {
+    logError("stage=failed, reason=aak-unconfigured");
+    throw new LinkqueGatewayAuthUnconfiguredError();
+  }
+  log("stage=aak-fallback, state=configured");
+  const provider = resolveProvider(env.LINKQUE_MODEL_PROVIDER, log, logError);
+  log("stage=complete, mode=aak, source=env:LINKQUE_AGENT_ACCESS_KEY");
+  return {
+    mode: "aak",
+    modelCredential: apiKey,
+    authorizationHeader: `aak ${apiKey}`,
+    auth: { provider, apiKey }
+  };
+}
+function resolveGatewayAuthContext(gatewayAuth, env = process.env, logCtx, caller = "unknown") {
+  const log = (...a2) => logCtx?.log?.("[auth-resolve]", ...a2);
+  if (gatewayAuth) {
+    log(`stage=context-selection, caller=${caller}, branch=request-context, mode=${gatewayAuth.mode}`);
+    return gatewayAuth;
+  }
+  log(`stage=context-selection, caller=${caller}, branch=compat-env-fallback`);
+  return resolveLinkqueGatewayAuth(void 0, env, logCtx);
+}
+function parseProvider(raw) {
+  if (!raw)
+    return "LINKQUE";
+  const upper = raw.toUpperCase();
+  if (upper === "LINKQUE")
+    return "LINKQUE";
+  if (upper === "TEST")
+    return "TEST";
+  throw new Error(`\u4E0D\u652F\u6301\u7684 LINKQUE_MODEL_PROVIDER="${raw}"(\u5F53\u524D\u652F\u6301:LINKQUE\u3001TEST)`);
+}
+function resolveProvider(raw, log, logError) {
+  log("stage=provider-resolution, state=start");
+  try {
+    const provider = parseProvider(raw);
+    log(`stage=provider-resolution, state=success, provider=${provider}`);
+    return provider;
+  } catch (error) {
+    logError("stage=failed, reason=invalid-provider");
+    throw error;
+  }
+}
+
 // ../../node_modules/node-fetch-native-with-agent/dist/index.mjs
 var a = Object.defineProperty;
 var t = (e, r) => a(e, "name", { value: r, configurable: true });
@@ -11699,7 +11802,7 @@ function apiKeySource(env, hasRequestKey) {
 }
 function describeRuntimeEnv(env, hasRequestKey = false) {
   const lines = [];
-  lines.push(envLine("LINKQUE_AGENT_ACCESS_KEY", maskSecret(env.LINKQUE_AGENT_ACCESS_KEY?.trim())));
+  lines.push(envLine("LINKQUE_AGENT_ACCESS_KEY", env.LINKQUE_AGENT_ACCESS_KEY?.trim() ? "<set>" : "<unset>"));
   lines.push(envLine("LINKQUE_MODEL_PROVIDER", envValue(env, "LINKQUE_MODEL_PROVIDER")));
   lines.push(envLine("APPBASE_ENDPOINT", `${maskEndpoint(firstHit(env, ENDPOINT_SOURCES))}(src=${whichSource(env, ENDPOINT_SOURCES)})`));
   lines.push(envLine("APPBASE_PROJECT_ID", `${firstHit(env, PROJECT_SOURCES)}(src=${whichSource(env, PROJECT_SOURCES)})`));
@@ -11954,7 +12057,7 @@ async function clientCapability(ctx) {
     result = await runClientCapability(readAppwriteTrigger(ctx.req.headers), ctx.req.method, resolveBodyJSON(ctx.req), readAuthenticatedUserId(ctx.req.headers), store);
   } catch (error) {
     ctx.error?.(error);
-    result = jsonError(500, "internal_error", error instanceof Error ? error.message : "unknown error");
+    result = error instanceof LinkqueGatewayAuthError || error instanceof LinkqueGatewayAuthUnconfiguredError ? jsonError(error.status, error.code, error.message) : jsonError(500, "internal_error", error instanceof Error ? error.message : "unknown error");
   }
   return ctx.res.json?.(result.body, result.status);
 }
@@ -11993,6 +12096,10 @@ function requiredEnv(name) {
 }
 
 export {
+  LinkqueGatewayAuthError,
+  LinkqueGatewayAuthUnconfiguredError,
+  resolveLinkqueGatewayAuth,
+  resolveGatewayAuthContext,
   resolveBodyJSON,
   toAgentRunMessages,
   jsonError,
@@ -12001,7 +12108,6 @@ export {
   readAuthenticatedUserId,
   readAppwriteApiKey,
   Query,
-  maskSecret,
   isDebugLogLevel,
   describeRuntimeEnv,
   resolveRunStorage,