linkque-cli-v2 1.0.6 → 1.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,20 +1,23 @@
1
1
  import {
2
+ LinkqueGatewayAuthError,
3
+ LinkqueGatewayAuthUnconfiguredError,
2
4
  Query,
3
5
  createAppBaseClient,
4
6
  createClientCapabilityStore,
5
7
  describeRuntimeEnv,
6
8
  isDebugLogLevel,
7
9
  jsonError,
8
- maskSecret,
9
10
  parseStoredClientCapabilityResult,
10
11
  readAppwriteApiKey,
11
12
  readAuthenticatedUserId,
12
13
  readEnvSelector,
13
14
  readTraceId,
14
15
  resolveBodyJSON,
16
+ resolveGatewayAuthContext,
17
+ resolveLinkqueGatewayAuth,
15
18
  resolveRunStorage,
16
19
  toAgentRunMessages
17
- } from "../../chunk-NQM5ZCTR.js";
20
+ } from "../../chunk-IAT272TH.js";
18
21
  import "../../chunk-MKS245OU.js";
19
22
  import "../../chunk-YDKZZ6EH.js";
20
23
  import "../../chunk-2NGJGNYB.js";
@@ -28,7 +31,9 @@ import {
28
31
  DEFAULT_CONVERSATION_LIST_LIMIT,
29
32
  DEFAULT_CONVERSATION_RUN_LIST_LIMIT,
30
33
  DEFAULT_CONVERSATION_SEARCH_LIMIT,
31
- EModelProvider,
34
+ EHookExecutorName,
35
+ EHookStage,
36
+ EResourceProviderType,
32
37
  EResourceType,
33
38
  ESkillUrlScheme,
34
39
  EventType,
@@ -46,7 +51,7 @@ import {
46
51
  parseConversationRunRequest,
47
52
  parseSkillFile,
48
53
  streamToConversationEvents
49
- } from "../../chunk-52BVDZQ2.js";
54
+ } from "../../chunk-MN4S5EF5.js";
50
55
  import "../../chunk-XUFLSZM4.js";
51
56
  import "../../chunk-I64V3ICJ.js";
52
57
  import "../../chunk-6MHDOBWO.js";
@@ -60,6 +65,61 @@ import "../../chunk-VS2QQHAK.js";
60
65
  // ../linkque-agent-appwrite-integrate/dist/esm/runtime/handler/chat.js
61
66
  import { randomUUID as randomUUID3 } from "node:crypto";
62
67
 
68
+ // ../linkque-agent-runtime/dist/esm/impl/plugin/linkquegwEventPlugin.js
69
+ var LINKQUEGW_EVENT_PLUGIN_NAME = "linkquegw-event-plugin";
70
+ var LINKQUEGW_EVENT_HOOK_RESOURCE_ID = "linkquegw-event-run-started";
71
+ var createLinkquegwEventHookResource = () => ({
72
+ resourceId: LINKQUEGW_EVENT_HOOK_RESOURCE_ID,
73
+ resourceType: EResourceType.HOOK,
74
+ providerType: EResourceProviderType.LINK_QUE,
75
+ config: {
76
+ name: "LinkqueGW \u751F\u547D\u5468\u671F\u4E8B\u4EF6\u4E0A\u62A5",
77
+ executorName: EHookExecutorName.LinkquegwEventHookExecutor,
78
+ stage: EHookStage.RUN_STARTED,
79
+ hasSideEffects: true
80
+ }
81
+ });
82
+ var isUserTokenAuthorization = (value) => /^Bearer[\t ]+[^\s,]+$/u.test(value);
83
+ var isLinkquegwRunStartedHook = (resource) => {
84
+ if (resource.resourceType !== EResourceType.HOOK)
85
+ return false;
86
+ const hookResource = resource;
87
+ return hookResource.config.executorName === EHookExecutorName.LinkquegwEventHookExecutor && hookResource.config.stage === EHookStage.RUN_STARTED;
88
+ };
89
+ var LinkquegwEventPlugin = class {
90
+ name = LINKQUEGW_EVENT_PLUGIN_NAME;
91
+ hookExecutorList;
92
+ constructor(options) {
93
+ const executorOptions = {
94
+ getAuthHeaders: async () => {
95
+ const authorization = await options.getUserTokenAuthorizationHeader();
96
+ if (!isUserTokenAuthorization(authorization)) {
97
+ throw new Error("LinkqueGW event trigger \u53EA\u5141\u8BB8\u5355\u4E2A Bearer user token");
98
+ }
99
+ return {
100
+ authorization,
101
+ ...options.agentId ? { "x-linkque-agent-id": options.agentId } : {}
102
+ };
103
+ },
104
+ ...options.baseUrl !== void 0 && { baseUrl: options.baseUrl },
105
+ ...options.fetchImpl !== void 0 && { fetchImpl: options.fetchImpl },
106
+ ...options.debugLog !== void 0 && { debugLog: options.debugLog },
107
+ ...options.metricsSink !== void 0 && {
108
+ metricsSink: options.metricsSink
109
+ },
110
+ ...options.now !== void 0 && { now: options.now }
111
+ };
112
+ this.hookExecutorList = [new LinkquegwEventHookExecutor(executorOptions)];
113
+ }
114
+ /** 自动补入 event trigger 所需 HookResource;已有同 executorName + stage 时保持原配置。 */
115
+ modifyAgentConfig(agentConfig) {
116
+ const exists = agentConfig.agent.resources.some(isLinkquegwRunStartedHook);
117
+ if (exists)
118
+ return;
119
+ agentConfig.agent.resources.push(createLinkquegwEventHookResource());
120
+ }
121
+ };
122
+
63
123
  // ../linkque-agent-appwrite-integrate/dist/esm/runtime/ports/appbaseSessionManager.js
64
124
  var AppbaseSessionManager = class {
65
125
  store;
@@ -288,15 +348,23 @@ function createAppBaseRuntime(protocol, env = process.env, ports = {}, logCtx) {
288
348
  ...debugLog ? { debugLog } : {}
289
349
  }) : void 0);
290
350
  log("knowledgeSearchPort:", ports.knowledgeSearchPort ? "\u4F7F\u7528\u6CE8\u5165\u5B9E\u73B0" : mcpAuthHeader ? "LinkqueKnowledgeSearchPort(\u9274\u6743\u5934\u6A21\u5F0F,\u9ED8\u8BA4\u6D3E\u751F)" : "Noop(\u9ED8\u8BA4,\u65E0\u9274\u6743\u5934\u6E90)");
291
- runtimePorts.hookExecutor = ports.hookExecutor ?? (mcpAuthHeader ? new LinkquegwEventHookExecutor({
292
- baseUrl: ports.knowledgeBaseUrl,
293
- getAuthHeaders: async () => ({
294
- authorization: await mcpAuthHeader(),
295
- ...ports.gatewayAgentId ? { "x-linkque-agent-id": ports.gatewayAgentId } : {}
296
- }),
297
- ...debugLog ? { debugLog } : {}
298
- }) : void 0);
299
- log("hookExecutor:", ports.hookExecutor ? "\u4F7F\u7528\u6CE8\u5165\u5B9E\u73B0" : mcpAuthHeader ? "LinkquegwEventHookExecutor(\u9274\u6743\u5934\u6A21\u5F0F,\u9ED8\u8BA4\u6D3E\u751F)" : "Noop(\u9ED8\u8BA4,\u65E0\u9274\u6743\u5934\u6E90)");
351
+ if (ports.hookExecutorList) {
352
+ runtimePorts.hookExecutorList = ports.hookExecutorList;
353
+ }
354
+ const plugins = [...ports.plugins ?? []];
355
+ const hasLinkquegwEventPlugin = plugins.some((plugin) => plugin.name === LINKQUEGW_EVENT_PLUGIN_NAME);
356
+ if (ports.gatewayAuthMode === "user-token" && mcpAuthHeader && !hasLinkquegwEventPlugin) {
357
+ plugins.push(new LinkquegwEventPlugin({
358
+ getUserTokenAuthorizationHeader: mcpAuthHeader,
359
+ ...ports.knowledgeBaseUrl ? { baseUrl: ports.knowledgeBaseUrl } : {},
360
+ ...ports.gatewayAgentId ? { agentId: ports.gatewayAgentId } : {},
361
+ ...debugLog ? { debugLog } : {}
362
+ }));
363
+ }
364
+ if (plugins.length > 0) {
365
+ runtimePorts.plugins = plugins;
366
+ }
367
+ log("hookExecutorList:", ports.hookExecutorList ? "\u7AEF\u53E3\u5217\u8868\u4E0E\u63D2\u4EF6\u5217\u8868\u6309 name \u5408\u5E76" : ports.gatewayAuthMode === "user-token" && mcpAuthHeader ? hasLinkquegwEventPlugin ? "\u4F7F\u7528\u6CE8\u5165\u7684 LinkquegwEventPlugin" : "LinkquegwEventPlugin(user-token,\u9ED8\u8BA4\u6CE8\u5165)" : ports.gatewayAuthMode === "aak" ? "Noop(AAK \u6A21\u5F0F\u4E0D\u89E6\u53D1 user-token-only event)" : plugins.length > 0 ? "\u4F7F\u7528\u6CE8\u5165\u63D2\u4EF6" : "Noop(\u9ED8\u8BA4,\u65E0 user token)");
300
368
  if (debugLog) {
301
369
  runtimePorts.debugLog = debugLog;
302
370
  log("debugLog: \u6CE8\u5165 runtime(\u7EDF\u4E00 ctx.log sink)");
@@ -307,25 +375,29 @@ function createAppBaseRuntime(protocol, env = process.env, ports = {}, logCtx) {
307
375
 
308
376
  // ../linkque-agent-appwrite-integrate/dist/esm/runtime/handler/asr.js
309
377
  var ASR_CREATE_CREDENTIAL_OPERATION = "asr.createCredential";
310
- async function runAsrCredential(method, env, authenticatedUserId, agentId, fetchImpl = fetch, envSelector) {
378
+ async function runAsrCredential(method, env, authenticatedUserId, agentId, fetchImpl = fetch, envSelector, gatewayAuth, logCtx) {
311
379
  if (method !== "POST")
312
380
  return jsonError(405, "method_not_allowed", "\u4EC5\u652F\u6301 POST");
313
381
  if (!authenticatedUserId) {
314
382
  return jsonError(401, "authentication_required", "\u7F3A\u5C11 Appwrite \u8BA4\u8BC1\u7528\u6237");
315
383
  }
316
- const accessToken = env.LINKQUE_AGENT_ACCESS_KEY?.trim();
384
+ let resolvedAuth;
385
+ try {
386
+ resolvedAuth = resolveGatewayAuthContext(gatewayAuth, env, logCtx, "asr");
387
+ } catch {
388
+ return jsonError(500, "auth_unconfigured", "linkquegw AAK \u672A\u914D\u7F6E");
389
+ }
317
390
  const gatewayBaseUrl = resolveLinkqueEndpoints(env, envSelector).knowledgeBaseUrl;
318
- if (!accessToken || !gatewayBaseUrl) {
319
- return jsonError(500, "gateway_unconfigured", "linkquegw AAK \u6216\u5730\u5740\u672A\u914D\u7F6E");
391
+ if (!gatewayBaseUrl) {
392
+ return jsonError(500, "gateway_unconfigured", "linkquegw \u5730\u5740\u672A\u914D\u7F6E");
320
393
  }
321
394
  let response;
322
395
  try {
323
396
  response = await fetchImpl(`${gatewayBaseUrl}/api/asr/credential`, {
324
397
  method: "POST",
325
398
  headers: {
326
- Authorization: `aak ${accessToken}`,
327
- "x-linkque-agent-id": agentId,
328
- "x-linkque-appbase-user-id": authenticatedUserId
399
+ Authorization: resolvedAuth.authorizationHeader,
400
+ "x-linkque-agent-id": agentId
329
401
  }
330
402
  });
331
403
  } catch {
@@ -352,27 +424,31 @@ async function runAsrCredential(method, env, authenticatedUserId, agentId, fetch
352
424
 
353
425
  // ../linkque-agent-appwrite-integrate/dist/esm/runtime/handler/attachment.js
354
426
  var ATTACHMENT_CREATE_UPLOAD_TOKEN_OPERATION = "attachment.createUploadToken";
355
- async function runAttachmentUploadToken(method, env, authenticatedUserId, agentId, fetchImpl = fetch, envSelector) {
427
+ async function runAttachmentUploadToken(method, env, authenticatedUserId, agentId, fetchImpl = fetch, envSelector, gatewayAuth, logCtx) {
356
428
  if (method !== "POST") {
357
429
  return jsonError(405, "method_not_allowed", "\u4EC5\u652F\u6301 POST");
358
430
  }
359
431
  if (!authenticatedUserId) {
360
432
  return jsonError(401, "authentication_required", "\u7F3A\u5C11 Appwrite \u8BA4\u8BC1\u7528\u6237");
361
433
  }
362
- const accessToken = env.LINKQUE_AGENT_ACCESS_KEY?.trim();
434
+ let resolvedAuth;
435
+ try {
436
+ resolvedAuth = resolveGatewayAuthContext(gatewayAuth, env, logCtx, "attachment");
437
+ } catch {
438
+ return jsonError(500, "auth_unconfigured", "linkquegw AAK \u672A\u914D\u7F6E");
439
+ }
363
440
  const gatewayBaseUrl = resolveLinkqueEndpoints(env, envSelector).knowledgeBaseUrl;
364
- if (!accessToken || !gatewayBaseUrl) {
365
- return jsonError(500, "gateway_unconfigured", "linkquegw AAK \u6216\u5730\u5740\u672A\u914D\u7F6E");
441
+ if (!gatewayBaseUrl) {
442
+ return jsonError(500, "gateway_unconfigured", "linkquegw \u5730\u5740\u672A\u914D\u7F6E");
366
443
  }
367
444
  let response;
368
445
  try {
369
446
  response = await fetchImpl(`${gatewayBaseUrl}/api/mass/token`, {
370
447
  method: "POST",
371
448
  headers: {
372
- Authorization: `aak ${accessToken}`,
449
+ Authorization: resolvedAuth.authorizationHeader,
373
450
  "content-type": "application/json",
374
- "x-linkque-agent-id": agentId,
375
- "x-linkque-appbase-user-id": authenticatedUserId
451
+ "x-linkque-agent-id": agentId
376
452
  },
377
453
  body: JSON.stringify({ massType: 3 })
378
454
  });
@@ -1143,28 +1219,6 @@ function controlError(status, code, message) {
1143
1219
  return { status, body: { error: { code, message, status } } };
1144
1220
  }
1145
1221
 
1146
- // ../linkque-agent-appwrite-integrate/dist/esm/runtime/auth.js
1147
- function resolveAuthFromEnv(env = process.env, logCtx) {
1148
- const log = (...a) => logCtx?.log?.("[auth-resolve]", ...a);
1149
- const apiKey = env.LINKQUE_AGENT_ACCESS_KEY?.trim();
1150
- if (!apiKey) {
1151
- throw new Error("\u8BA4\u8BC1\u914D\u7F6E\u7F3A\u5931:LINKQUE_AGENT_ACCESS_KEY \u672A\u8BBE\u7F6E");
1152
- }
1153
- const provider = parseProvider(env.LINKQUE_MODEL_PROVIDER);
1154
- log("agent \u8BA4\u8BC1\u89E3\u6790\u6210\u529F, provider=", provider, "apiKey=", maskSecret(apiKey), "source=env:LINKQUE_AGENT_ACCESS_KEY");
1155
- return { auth: { provider, apiKey } };
1156
- }
1157
- function parseProvider(raw) {
1158
- if (!raw)
1159
- return EModelProvider.LINKQUE;
1160
- const upper = raw.toUpperCase();
1161
- if (upper === "LINKQUE")
1162
- return EModelProvider.LINKQUE;
1163
- if (upper === "TEST")
1164
- return EModelProvider.TEST;
1165
- throw new Error(`\u4E0D\u652F\u6301\u7684 LINKQUE_MODEL_PROVIDER="${raw}"(\u5F53\u524D\u652F\u6301:LINKQUE\u3001TEST)`);
1166
- }
1167
-
1168
1222
  // ../linkque-agent-appwrite-integrate/dist/esm/runtime/appbaseStore.js
1169
1223
  function createAppBaseStore(databases, databaseId, tableId, ownerId) {
1170
1224
  const permissions = rowPermissions(ownerId);
@@ -1599,7 +1653,7 @@ function historyError(status, code, message) {
1599
1653
 
1600
1654
  // ../linkque-agent-appwrite-integrate/dist/esm/runtime/handler/homeData.js
1601
1655
  var HOME_DATA_REQUEST_OPERATION = "homeData.request";
1602
- async function runHomeData(method, body, userId, deps = {}, env = process.env, envSelector = "PROD") {
1656
+ async function runHomeData(method, body, userId, deps = {}, env = process.env, envSelector = "PROD", gatewayAuth, logCtx) {
1603
1657
  if (method.toUpperCase() !== "POST") {
1604
1658
  return jsonError(405, "method_not_allowed", "\u4EC5\u652F\u6301 POST");
1605
1659
  }
@@ -1609,8 +1663,10 @@ async function runHomeData(method, body, userId, deps = {}, env = process.env, e
1609
1663
  const protocol = deps.protocol ?? getBakedProtocol();
1610
1664
  let provider = deps.mcpServerProvider;
1611
1665
  if (!provider) {
1612
- const accessKey = env.LINKQUE_AGENT_ACCESS_KEY?.trim();
1613
- if (!accessKey) {
1666
+ let resolvedAuth;
1667
+ try {
1668
+ resolvedAuth = resolveGatewayAuthContext(gatewayAuth, env, logCtx, "home-data");
1669
+ } catch {
1614
1670
  return jsonError(500, "auth_unconfigured", "LINKQUE_AGENT_ACCESS_KEY \u672A\u914D\u7F6E");
1615
1671
  }
1616
1672
  const { mcpSignEndpoint } = resolveLinkqueEndpoints(env, envSelector);
@@ -1619,7 +1675,7 @@ async function runHomeData(method, body, userId, deps = {}, env = process.env, e
1619
1675
  agentId: protocol.agentId,
1620
1676
  ...mcpSignEndpoint ? { signEndpoint: mcpSignEndpoint } : {}
1621
1677
  }),
1622
- getAuthorizationHeader: async () => `aak ${accessKey}`
1678
+ getAuthorizationHeader: async () => resolvedAuth.authorizationHeader
1623
1679
  });
1624
1680
  }
1625
1681
  const response = await executeHomeData({
@@ -1632,7 +1688,7 @@ async function runHomeData(method, body, userId, deps = {}, env = process.env, e
1632
1688
  }
1633
1689
 
1634
1690
  // ../linkque-agent-appwrite-integrate/dist/esm/runtime/handler/chatConfig.js
1635
- function resolveChatDeps(env, deps, logCtx, historyOwnerId, appwriteApiKey, envSelector) {
1691
+ function resolveChatDeps(env, deps, logCtx, historyOwnerId, appwriteApiKey, envSelector, gatewayAuth) {
1636
1692
  const log = (...a) => logCtx?.log?.("[chat]", ...a);
1637
1693
  const logError = (...a) => logCtx?.error?.("[chat]", ...a);
1638
1694
  const protocol = deps?.protocol ?? getBakedProtocol();
@@ -1642,8 +1698,8 @@ function resolveChatDeps(env, deps, logCtx, historyOwnerId, appwriteApiKey, envS
1642
1698
  }
1643
1699
  let resolved;
1644
1700
  try {
1645
- resolved = resolveAuthFromEnv(env, logCtx);
1646
- log("\u8BA4\u8BC1\u89E3\u6790\u6210\u529F, provider=", resolved.auth.provider, "model=", protocol.agent.model.defaultModel ?? "default");
1701
+ resolved = resolveGatewayAuthContext(gatewayAuth, env, logCtx, "chat");
1702
+ log("\u8BA4\u8BC1\u89E3\u6790\u6210\u529F, provider=", resolved.auth.provider, "mode=", resolved.mode, "model=", protocol.agent.model.defaultModel ?? "default");
1647
1703
  } catch (err) {
1648
1704
  logError("\u8BA4\u8BC1\u914D\u7F6E\u7F3A\u5931:", err);
1649
1705
  return jsonError(500, "auth_unconfigured", err instanceof Error ? err.message : "\u8BA4\u8BC1\u914D\u7F6E\u7F3A\u5931");
@@ -1688,7 +1744,7 @@ function resolveChatDeps(env, deps, logCtx, historyOwnerId, appwriteApiKey, envS
1688
1744
  }
1689
1745
  chunkSize = storage.chunkSize;
1690
1746
  }
1691
- const mcpAuthorizationHeaderProvider = async () => `aak ${resolved.auth.apiKey}`;
1747
+ const mcpAuthorizationHeaderProvider = async () => resolved.authorizationHeader;
1692
1748
  const { linkqueBaseUrl, knowledgeBaseUrl, mcpSignEndpoint } = resolveLinkqueEndpoints(env, envSelector);
1693
1749
  const mcpConfigResolver = createAppbaseMcpConfigResolver({
1694
1750
  agentId: protocol.agentId,
@@ -1698,6 +1754,7 @@ function resolveChatDeps(env, deps, logCtx, historyOwnerId, appwriteApiKey, envS
1698
1754
  ...appwriteApiKey ? { appBaseApiKey: appwriteApiKey } : {},
1699
1755
  mcpConfigResolver,
1700
1756
  mcpAuthorizationHeaderProvider,
1757
+ gatewayAuthMode: resolved.mode,
1701
1758
  gatewayAgentId: protocol.agentId,
1702
1759
  ...linkqueBaseUrl ? { linkqueBaseUrl } : {},
1703
1760
  ...knowledgeBaseUrl ? { knowledgeBaseUrl } : {}
@@ -2035,7 +2092,7 @@ function shouldFlushConversationEvent(event) {
2035
2092
  }
2036
2093
 
2037
2094
  // ../linkque-agent-appwrite-integrate/dist/esm/runtime/handler/chat.js
2038
- async function runChat(method, bodyJSON, env, deps, logCtx, historyOwnerId, appwriteApiKey, envSelector, traceId) {
2095
+ async function runChat(method, bodyJSON, env, deps, logCtx, historyOwnerId, appwriteApiKey, envSelector, traceId, gatewayAuth) {
2039
2096
  const log = (...args) => logCtx?.log?.("[chat]", ...args);
2040
2097
  const logError = (...args) => logCtx?.error?.("[chat]", ...args);
2041
2098
  const guarded = guardChatRequest(method, bodyJSON, logCtx);
@@ -2043,7 +2100,7 @@ async function runChat(method, bodyJSON, env, deps, logCtx, historyOwnerId, appw
2043
2100
  return guarded;
2044
2101
  const request = guarded;
2045
2102
  const isPresentationRun = request.executionScope === "presentation";
2046
- const cfg = resolveChatDeps(env, deps, logCtx, historyOwnerId, appwriteApiKey, envSelector);
2103
+ const cfg = resolveChatDeps(env, deps, logCtx, historyOwnerId, appwriteApiKey, envSelector, gatewayAuth);
2047
2104
  if ("status" in cfg)
2048
2105
  return cfg;
2049
2106
  const leaseOwnerId = randomUUID3();
@@ -2265,18 +2322,18 @@ function waitForCancellationPoll(delayMs, signal) {
2265
2322
  }
2266
2323
  });
2267
2324
  }
2268
- async function runGateway(method, bodyJSON, env, deps, logCtx, historyOwnerId, appwriteApiKey, envSelector, traceId) {
2325
+ async function runGateway(method, bodyJSON, env, deps, logCtx, historyOwnerId, appwriteApiKey, envSelector, traceId, gatewayAuth) {
2269
2326
  const operation = readOperation(bodyJSON);
2270
2327
  if (operation === "cancelConversationRun") {
2271
2328
  return runCancelConversation(method, bodyJSON, env, deps ? { protocol: deps.protocol, store: deps.historyStore } : void 0, logCtx, historyOwnerId, appwriteApiKey);
2272
2329
  }
2273
2330
  if (operation === ASR_CREATE_CREDENTIAL_OPERATION) {
2274
2331
  const agentId = deps?.protocol?.agentId ?? getBakedProtocol().agentId;
2275
- return runAsrCredential(method, env, historyOwnerId, agentId, void 0, envSelector);
2332
+ return runAsrCredential(method, env, historyOwnerId, agentId, void 0, envSelector, gatewayAuth, logCtx);
2276
2333
  }
2277
2334
  if (operation === ATTACHMENT_CREATE_UPLOAD_TOKEN_OPERATION) {
2278
2335
  const agentId = deps?.protocol?.agentId ?? getBakedProtocol().agentId;
2279
- return runAttachmentUploadToken(method, env, historyOwnerId, agentId, void 0, envSelector);
2336
+ return runAttachmentUploadToken(method, env, historyOwnerId, agentId, void 0, envSelector, gatewayAuth, logCtx);
2280
2337
  }
2281
2338
  if (operation === HOME_DATA_REQUEST_OPERATION) {
2282
2339
  const request = readOperationPayload(bodyJSON);
@@ -2294,7 +2351,7 @@ async function runGateway(method, bodyJSON, env, deps, logCtx, historyOwnerId, a
2294
2351
  if (operation) {
2295
2352
  return jsonError(400, "operation_unsupported", `\u4E0D\u652F\u6301\u7684 operation: ${operation}`);
2296
2353
  }
2297
- return runChat(method, bodyJSON, env, deps, logCtx, historyOwnerId, appwriteApiKey, envSelector, traceId);
2354
+ return runChat(method, bodyJSON, env, deps, logCtx, historyOwnerId, appwriteApiKey, envSelector, traceId, gatewayAuth);
2298
2355
  }
2299
2356
  async function chat(ctx) {
2300
2357
  let result;
@@ -2304,10 +2361,14 @@ async function chat(ctx) {
2304
2361
  const appwriteApiKey = readAppwriteApiKey(ctx.req.headers);
2305
2362
  const envSelector = readEnvSelector(ctx.req.headers);
2306
2363
  const traceId = readTraceId(ctx.req.headers);
2307
- result = historyOwnerId ? await runGateway(ctx.req.method, bodyJSON, process.env, void 0, { log: ctx.log, error: ctx.error }, historyOwnerId, appwriteApiKey, envSelector, traceId) : jsonError(401, "authentication_required", "\u7F3A\u5C11 Appwrite \u8BA4\u8BC1\u7528\u6237");
2364
+ const gatewayAuth = historyOwnerId ? resolveLinkqueGatewayAuth(ctx.req.headers, process.env, {
2365
+ log: ctx.log,
2366
+ error: ctx.error
2367
+ }) : void 0;
2368
+ result = historyOwnerId ? await runGateway(ctx.req.method, bodyJSON, process.env, void 0, { log: ctx.log, error: ctx.error }, historyOwnerId, appwriteApiKey, envSelector, traceId, gatewayAuth) : jsonError(401, "authentication_required", "\u7F3A\u5C11 Appwrite \u8BA4\u8BC1\u7528\u6237");
2308
2369
  } catch (err) {
2309
2370
  ctx.error?.(err);
2310
- result = {
2371
+ result = err instanceof LinkqueGatewayAuthError || err instanceof LinkqueGatewayAuthUnconfiguredError ? jsonError(err.status, err.code, err.message) : {
2311
2372
  status: 500,
2312
2373
  body: {
2313
2374
  error: {
@@ -3,7 +3,7 @@ import {
3
3
  runClientCapability,
4
4
  runClientCapabilityCleanup,
5
5
  runClientCapabilityResult
6
- } from "../../chunk-NQM5ZCTR.js";
6
+ } from "../../chunk-IAT272TH.js";
7
7
  import "../../chunk-MKS245OU.js";
8
8
  import "../../chunk-YDKZZ6EH.js";
9
9
  import "../../chunk-2NGJGNYB.js";
@@ -1,7 +1,7 @@
1
1
  import {
2
2
  getBakedProtocol,
3
3
  setBakedProtocol
4
- } from "../chunk-52BVDZQ2.js";
4
+ } from "../chunk-MN4S5EF5.js";
5
5
  import "../chunk-XUFLSZM4.js";
6
6
  import "../chunk-I64V3ICJ.js";
7
7
  import "../chunk-6MHDOBWO.js";