feat(api): bind encrypted workspaces to accounts and devices

packages/core/src/reader.ts

@@ -14,7 +14,7 @@ export interface ReaderContext {
   itemKey(itemId: Uint8Array): Promise<CryptoKey>;
 }
 
-export type ReceivedKind = ItemKind | 'raw';
+export type ReceivedKind = ItemKind;
 
 export interface ReceivedItem {
   itemId: string;
@@ -124,7 +124,7 @@ export class ItemReader {
     if (isEncFrame !== (this.#ctx.mode === 'enc')) throw new IntegrityError('wrong_mode');
     if (this.#done.has(itemId)) return [];
 
-    const itemFlags = env.flags & (Flags.Gated | Flags.Snapshot);
+    const itemFlags = env.flags & (Flags.Gated | Flags.Snapshot | Flags.Control);
     const gated = (env.flags & Flags.Gated) !== 0;
     const isFinal = (env.flags & Flags.Final) !== 0;
     // 非 GATED 条目必须是单帧且 FINAL(协议规则,服务端也强制)
@@ -156,7 +156,7 @@ export class ItemReader {
 
     let meta = state?.meta;
     let content = data;
-    if (this.#ctx.mode === 'enc' && env.frameIndex === 0) {
+    if (env.frameIndex === 0) {
       const first = decodeFirstFrame(data);
       meta = first.meta;
       content = first.content;
@@ -179,7 +179,7 @@ export class ItemReader {
     const item: ReceivedItem = {
       itemId,
       seq,
-      kind: this.#ctx.mode === 'raw' ? 'raw' : (state.meta?.kind ?? 'other'),
+      kind: state.meta?.kind ?? 'other',
       snapshot: (itemFlags & Flags.Snapshot) !== 0,
       gated,
       complete,