@bizhou/cli 1.0.0

package/dist/index.js

@@ -0,0 +1,3839 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname6, join as join12 } from "path";
+import { fileURLToPath } from "url";
+import { parseArgs } from "util";
+
+// ../core/src/errors.ts
+var BizhouError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+    this.name = `Bizhou${code}Error`;
+  }
+};
+var CryptoError = class extends BizhouError {
+  constructor(message, options) {
+    super("CRYPTO", message, options);
+  }
+};
+var AuthError = class extends BizhouError {
+  constructor(message, options) {
+    super("AUTH", message, options);
+  }
+};
+var ManifestError = class extends BizhouError {
+  constructor(message, options) {
+    super("MANIFEST", message, options);
+  }
+};
+var VaultError = class extends BizhouError {
+  constructor(message, options) {
+    super("VAULT", message, options);
+  }
+};
+var InvalidArgError = class extends BizhouError {
+  constructor(message, options) {
+    super("INVALID_ARG", message, options);
+  }
+};
+
+// ../core/src/account/index.ts
+var ACCOUNTS_KEY = "accounts";
+var MK_CACHE_KEY = "mkCache";
+var AccountManager = class {
+  constructor(secrets) {
+    this.secrets = secrets;
+  }
+  secrets;
+  async state() {
+    const raw = await this.secrets.get(ACCOUNTS_KEY);
+    if (!raw) return { accounts: {} };
+    return JSON.parse(raw);
+  }
+  async save(state) {
+    await this.secrets.set(ACCOUNTS_KEY, JSON.stringify(state));
+  }
+  /** 新增/更新账号 token；若是首个账号则自动设为当前。 */
+  async upsertAccount(name, tokens) {
+    if (!name) throw new BizhouError("ACCOUNT", "\u8D26\u53F7\u540D\u4E0D\u80FD\u4E3A\u7A7A");
+    const state = await this.state();
+    state.accounts[name] = tokens;
+    if (!state.current) state.current = name;
+    await this.save(state);
+  }
+  async listAccounts() {
+    const state = await this.state();
+    return { names: Object.keys(state.accounts), current: state.current };
+  }
+  async useAccount(name) {
+    const state = await this.state();
+    if (!state.accounts[name]) throw new BizhouError("ACCOUNT", `\u8D26\u53F7\u4E0D\u5B58\u5728\uFF1A${name}`);
+    state.current = name;
+    await this.save(state);
+  }
+  async removeAccount(name) {
+    const state = await this.state();
+    if (!state.accounts[name]) throw new BizhouError("ACCOUNT", `\u8D26\u53F7\u4E0D\u5B58\u5728\uFF1A${name}`);
+    delete state.accounts[name];
+    if (state.current === name) state.current = Object.keys(state.accounts)[0];
+    await this.save(state);
+  }
+  async getCurrent() {
+    const state = await this.state();
+    if (!state.current) return void 0;
+    const tokens = state.accounts[state.current];
+    if (!tokens) return void 0;
+    return { name: state.current, tokens };
+  }
+  /** 更新指定账号 token（如刷新后）。 */
+  async updateTokens(name, tokens) {
+    const state = await this.state();
+    if (!state.accounts[name]) throw new BizhouError("ACCOUNT", `\u8D26\u53F7\u4E0D\u5B58\u5728\uFF1A${name}`);
+    state.accounts[name] = tokens;
+    await this.save(state);
+  }
+  // ---- 解锁后的 MK 缓存（"每设备解锁一次"）--------------------------------
+  /** 缓存解锁得到的 MK（base64），带绝对过期时间戳。 */
+  async cacheMk(mk, expiresAt) {
+    await this.secrets.set(MK_CACHE_KEY, JSON.stringify({ mk: mk.toString("base64"), expiresAt }));
+  }
+  /** 读取缓存 MK；未解锁或已过期（相对传入的 now）返回 undefined。 */
+  async getCachedMk(now) {
+    const raw = await this.secrets.get(MK_CACHE_KEY);
+    if (!raw) return void 0;
+    const { mk, expiresAt } = JSON.parse(raw);
+    if (typeof expiresAt === "number" && now > expiresAt) {
+      await this.secrets.delete(MK_CACHE_KEY);
+      return void 0;
+    }
+    return Buffer.from(mk, "base64");
+  }
+  /** 清除 MK 缓存（`bz lock`）。 */
+  async clearMk() {
+    await this.secrets.delete(MK_CACHE_KEY);
+  }
+};
+
+// ../core/src/baidu/client.ts
+import { createHash } from "crypto";
+var PAN_API = "https://pan.baidu.com/rest/2.0/xpan";
+var PCS_SUPERFILE = "https://d.pcs.baidu.com/rest/2.0/pcs/superfile2";
+var APP_ROOT = "/apps/bizhou";
+var TRANSFER_SLICE = 4 * 1024 * 1024;
+function md5hex(b) {
+  return createHash("md5").update(b).digest("hex");
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function withRetry(fn, opts = {}) {
+  const tries = opts.tries ?? 3;
+  const baseMs = opts.baseMs ?? 500;
+  let lastErr;
+  for (let i = 0; i < tries; i++) {
+    if (opts.signal?.aborted) throw lastErr ?? new BizhouError("BAIDU", "\u4E0A\u4F20\u5DF2\u53D6\u6D88");
+    try {
+      return await fn();
+    } catch (err) {
+      lastErr = err;
+      if (opts.signal?.aborted) throw err;
+      if (i < tries - 1) {
+        opts.onRetry?.(i + 1, err);
+        await sleep(baseMs * 2 ** i);
+      }
+    }
+  }
+  throw lastErr;
+}
+function sliceTransfer(data) {
+  const parts = [];
+  for (let off = 0; off < data.length; off += TRANSFER_SLICE) {
+    parts.push(data.subarray(off, Math.min(off + TRANSFER_SLICE, data.length)));
+  }
+  if (parts.length === 0) parts.push(Buffer.alloc(0));
+  return parts;
+}
+function lastSegment(path) {
+  return path.slice(path.lastIndexOf("/") + 1);
+}
+function form(params) {
+  return Object.entries(params).map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&");
+}
+var BaiduClient = class {
+  constructor(_config, accessToken, http, opts = {}) {
+    this._config = _config;
+    this.accessToken = accessToken;
+    this.http = http;
+    this.maxRetries = opts.maxRetries ?? 3;
+    this.uploadConcurrency = Math.min(16, Math.max(1, opts.uploadConcurrency ?? 4));
+  }
+  _config;
+  accessToken;
+  http;
+  maxRetries;
+  uploadConcurrency;
+  setAccessToken(token) {
+    this.accessToken = token;
+  }
+  async fileApi(method, query, body) {
+    const url = `${PAN_API}/file?${form({ method, access_token: this.accessToken, ...query })}`;
+    const res = await this.http(url, {
+      method: body ? "POST" : "GET",
+      headers: body ? { "content-type": "application/x-www-form-urlencoded" } : void 0,
+      body
+    });
+    const data = await res.json();
+    const errno = data.errno;
+    if (typeof errno === "number" && errno !== 0) {
+      throw new BizhouError("BAIDU", `\u767E\u5EA6\u6587\u4EF6 API \u9519\u8BEF\uFF1Amethod=${method} errno=${errno}`);
+    }
+    return data;
+  }
+  /** 预创建，拿 uploadid 与需上传的分片列表。 */
+  async precreate(path, size, blockMd5) {
+    const data = await this.fileApi(
+      "precreate",
+      {},
+      form({
+        path,
+        size: String(size),
+        isdir: "0",
+        autoinit: "1",
+        rtype: "3",
+        block_list: JSON.stringify(blockMd5)
+      })
+    );
+    if (typeof data.uploadid !== "string") {
+      throw new BizhouError("BAIDU", "precreate \u672A\u8FD4\u56DE uploadid");
+    }
+    const blocks = Array.isArray(data.block_list) ? data.block_list : blockMd5.map((_, i) => i);
+    return { uploadid: data.uploadid, blocksToUpload: blocks };
+  }
+  /** 上传一个 4MB 传输分片，返回其 md5。 */
+  async uploadSlice(path, uploadid, partseq, slice, signal) {
+    const url = `${PCS_SUPERFILE}?${form({
+      method: "upload",
+      access_token: this.accessToken,
+      type: "tmpfile",
+      path,
+      uploadid,
+      partseq: String(partseq)
+    })}`;
+    const fd = new FormData();
+    fd.append("file", new Blob([new Uint8Array(slice)]), "part");
+    const res = await this.http(url, { method: "POST", body: fd, signal });
+    const data = await res.json();
+    if (typeof data.md5 !== "string") {
+      throw new BizhouError("BAIDU", `superfile2 \u5206\u7247 ${partseq} \u672A\u8FD4\u56DE md5`);
+    }
+    return data.md5;
+  }
+  /** 合并落盘。 */
+  async create(path, size, uploadid, blockMd5) {
+    const data = await this.fileApi(
+      "create",
+      {},
+      form({
+        path,
+        size: String(size),
+        isdir: "0",
+        uploadid,
+        rtype: "3",
+        block_list: JSON.stringify(blockMd5)
+      })
+    );
+    return { fsId: typeof data.fs_id === "number" ? data.fs_id : void 0 };
+  }
+  /**
+   * 上传一个逻辑分片文件（≤100MB）到 path：precreate → 逐 4MB superfile2 → create。
+   * 复用 uploadid，precreate 返回的 blocksToUpload 天然支持断点续传。
+   */
+  async uploadPart(path, data, onSlice) {
+    const slices = sliceTransfer(data);
+    const blockMd5 = slices.map(md5hex);
+    const { uploadid, blocksToUpload } = await this.precreate(path, data.length, blockMd5);
+    const need = blocksToUpload.filter((i) => i >= 0 && i < slices.length);
+    const total = slices.length;
+    const ac = new AbortController();
+    let nextK = 0;
+    const worker = async () => {
+      while (true) {
+        if (ac.signal.aborted) return;
+        const k = nextK++;
+        if (k >= need.length) return;
+        const i = need[k];
+        await withRetry(() => this.uploadSlice(path, uploadid, i, slices[i], ac.signal), {
+          tries: this.maxRetries,
+          signal: ac.signal
+        });
+        onSlice?.(i, total);
+      }
+    };
+    const poolN = Math.min(this.uploadConcurrency, Math.max(1, need.length));
+    try {
+      await Promise.all(Array.from({ length: poolN }, () => worker()));
+    } catch (err) {
+      ac.abort();
+      throw err;
+    }
+    return this.create(path, data.length, uploadid, blockMd5);
+  }
+  /** 列目录。 */
+  async list(dir) {
+    const data = await this.fileApi("list", { dir, order: "name" });
+    const list = Array.isArray(data.list) ? data.list : [];
+    return list.map((e) => ({
+      fsId: Number(e.fs_id),
+      path: String(e.path),
+      filename: String(e.server_filename ?? e.filename ?? ""),
+      size: Number(e.size ?? 0),
+      isdir: Number(e.isdir ?? 0) === 1
+    }));
+  }
+  /** 取 dlink（下载直链）。 */
+  async filemetas(fsIds) {
+    const url = `${PAN_API}/multimedia?${form({
+      method: "filemetas",
+      access_token: this.accessToken,
+      fsids: JSON.stringify(fsIds),
+      dlink: "1"
+    })}`;
+    const res = await this.http(url);
+    const data = await res.json();
+    const errno = data.errno;
+    if (typeof errno === "number" && errno !== 0) {
+      throw new BizhouError("BAIDU", `filemetas \u9519\u8BEF errno=${errno}`);
+    }
+    const list = Array.isArray(data.list) ? data.list : [];
+    return list.map((e) => ({
+      fsId: Number(e.fs_id),
+      dlink: String(e.dlink ?? ""),
+      filename: String(e.filename ?? e.server_filename ?? "")
+    }));
+  }
+  /** filemanager 通用封装：POST filemanager?opera=... body async=0&filelist=[...]。 */
+  async fileManagerOp(opera, filelist) {
+    await this.fileApi(
+      "filemanager",
+      { opera },
+      form({ async: "0", filelist: JSON.stringify(filelist), ondup: "fail" })
+    );
+  }
+  /** 删除远端路径（文件或目录）。 */
+  async deletePaths(paths) {
+    await this.fileManagerOp("delete", paths);
+  }
+  /** 移动 srcPath 到 dstDir 下（目录级，保留原名）。 */
+  async move(srcPath, dstDir) {
+    await this.fileManagerOp("move", [
+      { path: srcPath, dest: dstDir, newname: lastSegment(srcPath) }
+    ]);
+  }
+  /** 复制 srcPath 到 dstDir 下（目录级，保留原名；源保留）。 */
+  async copy(srcPath, dstDir) {
+    await this.fileManagerOp("copy", [
+      { path: srcPath, dest: dstDir, newname: lastSegment(srcPath) }
+    ]);
+  }
+  /** 原地改名（同目录下改末段名）。 */
+  async rename(srcPath, newName) {
+    await this.fileManagerOp("rename", [{ path: srcPath, newname: newName }]);
+  }
+  /** 创建目录（xpan create isdir=1，等价 mkdir -p）。 */
+  async mkdir(path) {
+    await this.fileApi("create", {}, form({ path, isdir: "1", rtype: "3" }));
+  }
+  /** 通过 dlink 下载文件字节（瞬时失败重试）。 */
+  async download(dlink) {
+    const sep3 = dlink.includes("?") ? "&" : "?";
+    const url = `${dlink}${sep3}access_token=${encodeURIComponent(this.accessToken)}`;
+    return withRetry(
+      async () => {
+        const res = await this.http(url, { headers: { "User-Agent": "pan.baidu.com" } });
+        if (!res.ok) {
+          throw new BizhouError("BAIDU", `\u4E0B\u8F7D\u5931\u8D25\uFF1AHTTP ${res.status}`);
+        }
+        return Buffer.from(await res.arrayBuffer());
+      },
+      { tries: this.maxRetries }
+    );
+  }
+};
+
+// ../core/src/bundle/index.ts
+import { randomBytes as randomBytes2 } from "crypto";
+
+// ../core/src/crypto/index.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHmac,
+  randomBytes,
+  scrypt as scryptCallback,
+  timingSafeEqual
+} from "crypto";
+import { promisify } from "util";
+var scryptAsync = promisify(scryptCallback);
+var CIPHER_ALGO = "aes-256-gcm";
+var KEY_BYTES = 32;
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
+var SALT_BYTES = 16;
+var DEFAULT_SCRYPT = {
+  algo: "scrypt",
+  N: 1 << 15,
+  r: 8,
+  p: 1,
+  keylen: KEY_BYTES
+};
+function assertKey(key) {
+  if (key.length !== KEY_BYTES) {
+    throw new CryptoError(`\u5BC6\u94A5\u957F\u5EA6\u5FC5\u987B\u4E3A ${KEY_BYTES} \u5B57\u8282\uFF0C\u5B9E\u9645 ${key.length}`);
+  }
+}
+function deriveDeterministicIv(key, context) {
+  return createHmac("sha256", key).update(context).digest().subarray(0, IV_BYTES);
+}
+function aeadEncrypt(key, plaintext, aad, iv) {
+  assertKey(key);
+  if (iv && iv.length !== IV_BYTES) throw new CryptoError(`IV \u957F\u5EA6\u5FC5\u987B\u4E3A ${IV_BYTES} \u5B57\u8282`);
+  const nonce = iv ?? randomBytes(IV_BYTES);
+  const cipher = createCipheriv(CIPHER_ALGO, key, nonce, { authTagLength: TAG_BYTES });
+  if (aad) cipher.setAAD(aad);
+  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return { iv: nonce, ciphertext, tag };
+}
+function aeadDecrypt(key, iv, ciphertext, tag, aad) {
+  assertKey(key);
+  if (iv.length !== IV_BYTES) throw new CryptoError(`IV \u957F\u5EA6\u5FC5\u987B\u4E3A ${IV_BYTES} \u5B57\u8282`);
+  if (tag.length !== TAG_BYTES) throw new CryptoError(`tag \u957F\u5EA6\u5FC5\u987B\u4E3A ${TAG_BYTES} \u5B57\u8282`);
+  const decipher = createDecipheriv(CIPHER_ALGO, key, iv, { authTagLength: TAG_BYTES });
+  if (aad) decipher.setAAD(aad);
+  decipher.setAuthTag(tag);
+  try {
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  } catch (cause) {
+    throw new AuthError("\u89E3\u5BC6\u5931\u8D25\uFF1AGCM \u8BA4\u8BC1\u6807\u7B7E\u6821\u9A8C\u4E0D\u901A\u8FC7\uFF08\u5185\u5BB9\u88AB\u7BE1\u6539\u3001\u5BC6\u94A5\u9519\u8BEF\u6216 AAD \u4E0D\u5339\u914D\uFF09", {
+      cause
+    });
+  }
+}
+function packAead(r) {
+  return Buffer.concat([r.iv, r.tag, r.ciphertext]);
+}
+function unpackAead(blob) {
+  const min = IV_BYTES + TAG_BYTES;
+  if (blob.length < min) {
+    throw new CryptoError(`AEAD blob \u8FC7\u77ED\uFF1A\u81F3\u5C11 ${min} \u5B57\u8282\uFF0C\u5B9E\u9645 ${blob.length}`);
+  }
+  const iv = blob.subarray(0, IV_BYTES);
+  const tag = blob.subarray(IV_BYTES, IV_BYTES + TAG_BYTES);
+  const ciphertext = blob.subarray(IV_BYTES + TAG_BYTES);
+  return { iv, ciphertext, tag };
+}
+function sealToBase64(key, plaintext, aad) {
+  return packAead(aeadEncrypt(key, plaintext, aad)).toString("base64");
+}
+function openFromBase64(key, b64, aad) {
+  const { iv, ciphertext, tag } = unpackAead(Buffer.from(b64, "base64"));
+  return aeadDecrypt(key, iv, ciphertext, tag, aad);
+}
+function generateSalt() {
+  return randomBytes(SALT_BYTES);
+}
+async function deriveKey(password, salt, params = DEFAULT_SCRYPT) {
+  if (params.algo !== "scrypt") {
+    throw new InvalidArgError(`\u4E0D\u652F\u6301\u7684 KDF \u7B97\u6CD5\uFF1A${String(params.algo)}`);
+  }
+  const pw = Buffer.from(password.normalize("NFKC"), "utf8");
+  const maxmem = 256 * params.N * params.r + 1024 * 1024;
+  const key = await scryptAsync(pw, salt, params.keylen, {
+    N: params.N,
+    r: params.r,
+    p: params.p,
+    maxmem
+  });
+  return key;
+}
+function generateKey() {
+  return randomBytes(KEY_BYTES);
+}
+function wrapKey(kek, key) {
+  assertKey(key);
+  return sealToBase64(kek, key);
+}
+function unwrapKey(kek, wrapped) {
+  const key = openFromBase64(kek, wrapped);
+  assertKey(key);
+  return key;
+}
+
+// ../core/src/bundle/index.ts
+var MANIFEST_VERSION = 1;
+var BUNDLE_SUFFIX = ".bz";
+var MANIFEST_FILENAME = "manifest.json";
+var PREVIEW_FILENAME = "preview.part";
+function generateBundleId() {
+  return randomBytes2(16).toString("hex");
+}
+function bundleDirName(bundleId) {
+  return `${bundleId}${BUNDLE_SUFFIX}`;
+}
+function chunkFileName(seq) {
+  return `${String(seq).padStart(3, "0")}.part`;
+}
+function chunkAad(bundleId, seq) {
+  return Buffer.from(`${bundleId}:${seq}`, "utf8");
+}
+function sealMeta(dek, meta) {
+  return sealToBase64(dek, Buffer.from(JSON.stringify(meta), "utf8"));
+}
+function openMeta(dek, encMeta) {
+  const json = openFromBase64(dek, encMeta).toString("utf8");
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch (cause) {
+    throw new ManifestError("encMeta \u89E3\u5BC6\u540E\u4E0D\u662F\u5408\u6CD5 JSON", { cause });
+  }
+  const m = parsed;
+  if (typeof m.name !== "string" || typeof m.size !== "number") {
+    throw new ManifestError("encMeta \u7F3A\u5C11\u5FC5\u9700\u5B57\u6BB5 name/size");
+  }
+  return parsed;
+}
+function serializeManifest(m) {
+  const ordered = {
+    version: m.version,
+    bundleId: m.bundleId,
+    createdAt: m.createdAt,
+    cipher: m.cipher,
+    compression: m.compression,
+    chunkSize: m.chunkSize,
+    wrappedKey: m.wrappedKey,
+    chunks: m.chunks.map((c2) => ({
+      seq: c2.seq,
+      file: c2.file,
+      plainSize: c2.plainSize,
+      encSize: c2.encSize,
+      iv: c2.iv,
+      tag: c2.tag,
+      sha256: c2.sha256
+    })),
+    ...m.preview ? { preview: m.preview } : {},
+    encMeta: m.encMeta
+  };
+  return JSON.stringify(ordered, null, 2);
+}
+function req(obj, key, type) {
+  const v = obj[key];
+  if (typeof v !== type) {
+    throw new ManifestError(`manifest \u5B57\u6BB5 '${key}' \u5E94\u4E3A ${type}\uFF0C\u5B9E\u9645 ${typeof v}`);
+  }
+  return v;
+}
+function validateChunk(raw, index) {
+  if (typeof raw !== "object" || raw === null) {
+    throw new ManifestError(`manifest.chunks[${index}] \u4E0D\u662F\u5BF9\u8C61`);
+  }
+  const c2 = raw;
+  const seq = req(c2, "seq", "number");
+  const chunk = {
+    seq,
+    file: req(c2, "file", "string"),
+    plainSize: req(c2, "plainSize", "number"),
+    encSize: req(c2, "encSize", "number"),
+    iv: req(c2, "iv", "string"),
+    tag: req(c2, "tag", "string"),
+    sha256: req(c2, "sha256", "string")
+  };
+  if (chunk.seq !== index) {
+    throw new ManifestError(
+      `manifest.chunks[${index}] \u7684 seq=${chunk.seq} \u4E0E\u4F4D\u7F6E\u4E0D\u7B26\uFF08\u5E94\u8FDE\u7EED\u4ECE 0\uFF09`
+    );
+  }
+  return chunk;
+}
+function parseManifest(json) {
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch (cause) {
+    throw new ManifestError("manifest \u4E0D\u662F\u5408\u6CD5 JSON", { cause });
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new ManifestError("manifest \u9876\u5C42\u4E0D\u662F\u5BF9\u8C61");
+  }
+  const o = parsed;
+  const version2 = req(o, "version", "number");
+  if (version2 !== MANIFEST_VERSION) {
+    throw new ManifestError(`\u4E0D\u652F\u6301\u7684 manifest \u7248\u672C\uFF1A${version2}\uFF08\u5F53\u524D\u4EC5\u652F\u6301 ${MANIFEST_VERSION}\uFF09`);
+  }
+  const cipher = req(o, "cipher", "string");
+  if (cipher !== "AES-256-GCM") {
+    throw new ManifestError(`\u4E0D\u652F\u6301\u7684 cipher\uFF1A${cipher}`);
+  }
+  const compression = req(o, "compression", "string");
+  if (compression !== "none" && compression !== "gzip") {
+    throw new ManifestError(`\u4E0D\u652F\u6301\u7684 compression\uFF1A${compression}`);
+  }
+  if (!Array.isArray(o.chunks)) {
+    throw new ManifestError("manifest.chunks \u5FC5\u987B\u662F\u6570\u7EC4");
+  }
+  const chunks = o.chunks.map(validateChunk);
+  let preview;
+  if (o.preview !== void 0) {
+    if (typeof o.preview !== "object" || o.preview === null) {
+      throw new ManifestError("manifest.preview \u4E0D\u662F\u5BF9\u8C61");
+    }
+    const p = o.preview;
+    const kind = req(p, "kind", "string");
+    if (kind !== "video" && kind !== "audio" && kind !== "image" && kind !== "text") {
+      throw new ManifestError(`\u4E0D\u652F\u6301\u7684 preview.kind\uFF1A${kind}`);
+    }
+    preview = {
+      file: req(p, "file", "string"),
+      kind,
+      iv: req(p, "iv", "string"),
+      tag: req(p, "tag", "string")
+    };
+  }
+  return {
+    version: MANIFEST_VERSION,
+    bundleId: req(o, "bundleId", "string"),
+    createdAt: req(o, "createdAt", "string"),
+    cipher: "AES-256-GCM",
+    compression,
+    chunkSize: req(o, "chunkSize", "number"),
+    wrappedKey: req(o, "wrappedKey", "string"),
+    chunks,
+    ...preview ? { preview } : {},
+    encMeta: req(o, "encMeta", "string")
+  };
+}
+
+// ../core/src/cloudpath/index.ts
+import { basename, dirname, isAbsolute, join, relative } from "path";
+function normalizeCloudPath(p) {
+  const parts = p.split(/[/\\]/).filter((s) => s.length > 0 && s !== ".");
+  if (parts.includes("..")) {
+    throw new InvalidArgError(`\u4E91\u7AEF\u8DEF\u5F84\u4E0D\u5141\u8BB8 '..' \u6BB5\uFF1A${p}`);
+  }
+  return parts.length === 0 ? "/" : `/${parts.join("/")}`;
+}
+function joinCloudPath(...parts) {
+  return normalizeCloudPath(parts.join("/"));
+}
+function cloudBasename(p) {
+  const n = normalizeCloudPath(p);
+  if (n === "/") return "";
+  return n.slice(n.lastIndexOf("/") + 1);
+}
+function assertNameSegment(name) {
+  if (name === "" || name === "." || name === ".." || /[/\\]/.test(name)) {
+    throw new InvalidArgError(`\u975E\u6CD5\u540D\u79F0\uFF08\u987B\u4E3A\u5355\u6BB5\u6587\u4EF6\u540D\uFF0C\u4E0D\u542B\u8DEF\u5F84\u5206\u9694\u7B26/..\uFF09\uFF1A${name}`);
+  }
+}
+function defaultUploadCloudDir(sourceAbs, fileRoot) {
+  const rel = relative(fileRoot, dirname(sourceAbs));
+  if (rel === "") return "/";
+  if (isAbsolute(rel) || rel.split(/[/\\]/)[0] === "..") return "/";
+  return normalizeCloudPath(rel);
+}
+function downloadLocalPath(fileRoot, cloudDir, name) {
+  const segs = normalizeCloudPath(cloudDir).split("/").filter(Boolean);
+  const safeName = basename(name.replace(/\\/g, "/"));
+  if (safeName === "" || safeName === "." || safeName === "..") {
+    throw new InvalidArgError(`\u975E\u6CD5\u6587\u4EF6\u540D\uFF08\u89E3\u5BC6\u5143\u6570\u636E\u53EF\u80FD\u88AB\u7BE1\u6539\uFF09\uFF1A${name}`);
+  }
+  return join(fileRoot, ...segs, safeName);
+}
+
+// ../core/src/baidu/store.ts
+var BaiduBundleStore = class {
+  constructor(client, bundleId, cloudDir = "") {
+    this.client = client;
+    this.bundleId = bundleId;
+    this.dir = `${APP_ROOT}${joinCloudPath("/", cloudDir, bundleDirName(bundleId))}`;
+  }
+  client;
+  bundleId;
+  dir;
+  fsidCache;
+  remotePath(filename) {
+    return `${this.dir}/${filename}`;
+  }
+  async refreshFsids() {
+    const entries = await this.client.list(this.dir);
+    const map = /* @__PURE__ */ new Map();
+    for (const e of entries) if (!e.isdir) map.set(e.filename, e.fsId);
+    this.fsidCache = map;
+    return map;
+  }
+  async fsidOf(filename) {
+    let map = this.fsidCache ?? await this.refreshFsids();
+    if (!map.has(filename)) map = await this.refreshFsids();
+    const fsid = map.get(filename);
+    if (fsid === void 0) {
+      throw new BizhouError("BAIDU", `\u8FDC\u7AEF\u7F3A\u5C11\u6587\u4EF6\uFF1A${this.remotePath(filename)}`);
+    }
+    return fsid;
+  }
+  async downloadByName(filename) {
+    const fsid = await this.fsidOf(filename);
+    const metas = await this.client.filemetas([fsid]);
+    const dlink = metas[0]?.dlink;
+    if (!dlink) throw new BizhouError("BAIDU", `\u65E0\u6CD5\u83B7\u53D6 dlink\uFF1A${filename}`);
+    return this.client.download(dlink);
+  }
+  async putChunk(seq, data) {
+    await this.client.uploadPart(this.remotePath(chunkFileName(seq)), data);
+    this.fsidCache = void 0;
+  }
+  async getChunk(seq) {
+    return this.downloadByName(chunkFileName(seq));
+  }
+  async putManifest(json) {
+    await this.client.uploadPart(this.remotePath(MANIFEST_FILENAME), Buffer.from(json, "utf8"));
+    this.fsidCache = void 0;
+  }
+  async getManifest() {
+    return (await this.downloadByName(MANIFEST_FILENAME)).toString("utf8");
+  }
+  async putPreview(data) {
+    await this.client.uploadPart(this.remotePath(PREVIEW_FILENAME), data);
+    this.fsidCache = void 0;
+  }
+  async getPreview() {
+    return this.downloadByName(PREVIEW_FILENAME);
+  }
+  async listChunks() {
+    const map = await this.refreshFsids();
+    const seqs = [];
+    for (const name of map.keys()) {
+      const m = /^(\d+)\.part$/.exec(name);
+      if (m) seqs.push(Number(m[1]));
+    }
+    return seqs.sort((a, b) => a - b);
+  }
+  async remove() {
+    await this.client.deletePaths([this.dir]);
+    this.fsidCache = void 0;
+  }
+};
+
+// ../core/src/backend/baidu.ts
+var NO_TRASH_MANAGEMENT_MSG = "\u767E\u5EA6\u5F00\u653E\u5E73\u53F0\u672A\u63D0\u4F9B\u56DE\u6536\u7AD9\u7BA1\u7406\u63A5\u53E3\uFF0C\u8BF7\u5230\u767E\u5EA6\u7F51\u76D8 App/\u7F51\u9875\u7684\u56DE\u6536\u7AD9\u64CD\u4F5C";
+var BaiduBackend = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  remote(cloudDir) {
+    const n = normalizeCloudPath(cloudDir);
+    return n === "/" ? APP_ROOT : `${APP_ROOT}${n}`;
+  }
+  async mkdir(cloudDir) {
+    await this.client.mkdir(this.remote(cloudDir));
+  }
+  async listDir(cloudDir) {
+    const dir = normalizeCloudPath(cloudDir);
+    const entries = await this.client.list(this.remote(cloudDir));
+    const dirs = [];
+    const bundles = [];
+    for (const e of entries) {
+      if (!e.isdir) continue;
+      if (e.filename.endsWith(BUNDLE_SUFFIX)) {
+        bundles.push({ id: e.filename.slice(0, -BUNDLE_SUFFIX.length), dir });
+      } else {
+        dirs.push(e.filename);
+      }
+    }
+    return { dirs, bundles };
+  }
+  bundleStore(bundleId, cloudDir) {
+    return new BaiduBundleStore(this.client, bundleId, cloudDir);
+  }
+  async move(srcCloudPath, dstDir) {
+    await this.client.move(this.remote(srcCloudPath), this.remote(dstDir));
+  }
+  async copy(srcCloudPath, dstDir) {
+    await this.client.copy(this.remote(srcCloudPath), this.remote(dstDir));
+  }
+  async rename(srcCloudPath, newName) {
+    assertNameSegment(newName);
+    await this.client.rename(this.remote(srcCloudPath), newName);
+  }
+  /** 删到百度原生回收站（filemanager delete）。deletedAt 由核心库以外注入，此后端不使用。 */
+  async trashPath(cloudPath, _deletedAt) {
+    await this.client.deletePaths([this.remote(cloudPath)]);
+  }
+  async listTrash() {
+    throw new BizhouError("BAIDU", NO_TRASH_MANAGEMENT_MSG);
+  }
+  async restoreTrash(_entryId) {
+    throw new BizhouError("BAIDU", NO_TRASH_MANAGEMENT_MSG);
+  }
+  async deleteTrash(_entryId) {
+    throw new BizhouError("BAIDU", NO_TRASH_MANAGEMENT_MSG);
+  }
+  async clearTrash() {
+    throw new BizhouError("BAIDU", NO_TRASH_MANAGEMENT_MSG);
+  }
+};
+
+// ../core/src/backend/local.ts
+import { randomBytes as randomBytes3 } from "crypto";
+import { cp, mkdir as mkdir2, readdir as readdir2, readFile as readFile2, rename, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname2, join as join3 } from "path";
+
+// ../core/src/store/index.ts
+import { mkdir, readdir, readFile, rm, writeFile } from "fs/promises";
+import { join as join2 } from "path";
+var LocalBundleStore = class {
+  bundleId;
+  dir;
+  constructor(baseDir, bundleId) {
+    this.bundleId = bundleId;
+    this.dir = join2(baseDir, bundleDirName(bundleId));
+  }
+  /** bundle 目录路径。 */
+  get path() {
+    return this.dir;
+  }
+  async ensureDir() {
+    await mkdir(this.dir, { recursive: true });
+  }
+  async putChunk(seq, data) {
+    await this.ensureDir();
+    await writeFile(join2(this.dir, chunkFileName(seq)), data);
+  }
+  async getChunk(seq) {
+    return readFile(join2(this.dir, chunkFileName(seq)));
+  }
+  async putManifest(json) {
+    await this.ensureDir();
+    await writeFile(join2(this.dir, MANIFEST_FILENAME), json, "utf8");
+  }
+  async getManifest() {
+    return readFile(join2(this.dir, MANIFEST_FILENAME), "utf8");
+  }
+  async putPreview(data) {
+    await this.ensureDir();
+    await writeFile(join2(this.dir, PREVIEW_FILENAME), data);
+  }
+  async getPreview() {
+    return readFile(join2(this.dir, PREVIEW_FILENAME));
+  }
+  async listChunks() {
+    let entries;
+    try {
+      entries = await readdir(this.dir);
+    } catch {
+      return [];
+    }
+    const seqs = [];
+    for (const name of entries) {
+      const m = /^(\d+)\.part$/.exec(name);
+      if (m) seqs.push(Number(m[1]));
+    }
+    return seqs.sort((a, b) => a - b);
+  }
+  async remove() {
+    await rm(this.dir, { recursive: true, force: true });
+  }
+};
+
+// ../core/src/backend/local.ts
+var TRASH_DIR = ".trash";
+var LocalBackend = class {
+  constructor(baseDir) {
+    this.baseDir = baseDir;
+  }
+  baseDir;
+  abs(cloudDir) {
+    const n = normalizeCloudPath(cloudDir);
+    return n === "/" ? this.baseDir : join3(this.baseDir, ...n.split("/").filter(Boolean));
+  }
+  get trashRoot() {
+    return join3(this.baseDir, TRASH_DIR);
+  }
+  trashMetaPath(entryId) {
+    assertNameSegment(entryId);
+    return join3(this.trashRoot, `${entryId}.json`);
+  }
+  trashItemDir(entryId) {
+    assertNameSegment(entryId);
+    return join3(this.trashRoot, entryId);
+  }
+  async readTrashEntry(entryId) {
+    const raw = await readFile2(this.trashMetaPath(entryId), "utf8");
+    return JSON.parse(raw);
+  }
+  async mkdir(cloudDir) {
+    await mkdir2(this.abs(cloudDir), { recursive: true });
+  }
+  async listDir(cloudDir) {
+    let entries;
+    try {
+      entries = await readdir2(this.abs(cloudDir), { withFileTypes: true });
+    } catch {
+      return { dirs: [], bundles: [] };
+    }
+    const dir = normalizeCloudPath(cloudDir);
+    const dirs = [];
+    const bundles = [];
+    for (const e of entries) {
+      if (!e.isDirectory()) continue;
+      if (e.name === TRASH_DIR) continue;
+      if (e.name.endsWith(BUNDLE_SUFFIX)) {
+        bundles.push({ id: e.name.slice(0, -BUNDLE_SUFFIX.length), dir });
+      } else {
+        dirs.push(e.name);
+      }
+    }
+    return { dirs, bundles };
+  }
+  bundleStore(bundleId, cloudDir) {
+    return new LocalBundleStore(this.abs(cloudDir), bundleId);
+  }
+  async move(srcCloudPath, dstDir) {
+    const base = cloudBasename(normalizeCloudPath(srcCloudPath));
+    await mkdir2(this.abs(dstDir), { recursive: true });
+    await rename(this.abs(srcCloudPath), join3(this.abs(dstDir), base));
+  }
+  async copy(srcCloudPath, dstDir) {
+    const base = cloudBasename(normalizeCloudPath(srcCloudPath));
+    await mkdir2(this.abs(dstDir), { recursive: true });
+    await cp(this.abs(srcCloudPath), join3(this.abs(dstDir), base), { recursive: true });
+  }
+  async rename(srcCloudPath, newName) {
+    assertNameSegment(newName);
+    const absSrc = this.abs(srcCloudPath);
+    await rename(absSrc, join3(dirname2(absSrc), newName));
+  }
+  async trashPath(cloudPath, deletedAt) {
+    const originalPath = normalizeCloudPath(cloudPath);
+    const name = cloudBasename(originalPath);
+    const entryId = randomBytes3(8).toString("hex");
+    await mkdir2(this.trashItemDir(entryId), { recursive: true });
+    await rename(this.abs(originalPath), join3(this.trashItemDir(entryId), name));
+    const entry = { entryId, name, originalPath, deletedAt };
+    await writeFile2(this.trashMetaPath(entryId), JSON.stringify(entry), "utf8");
+  }
+  async listTrash() {
+    let files;
+    try {
+      files = await readdir2(this.trashRoot);
+    } catch {
+      return [];
+    }
+    const entries = [];
+    for (const f of files) {
+      if (!f.endsWith(".json")) continue;
+      entries.push(await this.readTrashEntry(f.slice(0, -".json".length)));
+    }
+    return entries;
+  }
+  async restoreTrash(entryId) {
+    const entry = await this.readTrashEntry(entryId);
+    const absTarget = this.abs(entry.originalPath);
+    await mkdir2(dirname2(absTarget), { recursive: true });
+    await rename(join3(this.trashItemDir(entryId), entry.name), absTarget);
+    await rm2(this.trashItemDir(entryId), { recursive: true, force: true });
+    await rm2(this.trashMetaPath(entryId), { force: true });
+  }
+  async deleteTrash(entryId) {
+    await rm2(this.trashItemDir(entryId), { recursive: true, force: true });
+    await rm2(this.trashMetaPath(entryId), { force: true });
+  }
+  async clearTrash() {
+    await rm2(this.trashRoot, { recursive: true, force: true });
+  }
+};
+
+// ../core/src/backup/index.ts
+import { randomBytes as randomBytes4 } from "crypto";
+import { mkdir as mkdir3, readFile as readFile3, rename as rename2, writeFile as writeFile3 } from "fs/promises";
+import { join as join4 } from "path";
+var BACKUPS_FILENAME = "backups.json";
+var BACKUPS_VERSION = 1;
+function backupsPath(keyRoot) {
+  return join4(keyRoot, BACKUPS_FILENAME);
+}
+async function readBackups(keyRoot) {
+  let raw;
+  try {
+    raw = await readFile3(backupsPath(keyRoot), "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+  try {
+    const f = JSON.parse(raw);
+    if (!Array.isArray(f.jobs)) return [];
+    return f.jobs.filter((j) => typeof j?.id === "string" && typeof j?.localDir === "string");
+  } catch {
+    return [];
+  }
+}
+async function writeBackups(keyRoot, jobs) {
+  await mkdir3(keyRoot, { recursive: true });
+  const p = backupsPath(keyRoot);
+  const tmp = `${p}.${process.pid}.${randomBytes4(4).toString("hex")}.tmp`;
+  await writeFile3(tmp, JSON.stringify({ version: BACKUPS_VERSION, jobs }, null, 2), "utf8");
+  await rename2(tmp, p);
+}
+async function addBackup(keyRoot, input) {
+  const jobs = await readBackups(keyRoot);
+  const existing = jobs.find(
+    (j) => j.localDir === input.localDir && (j.cloudDir ?? "") === (input.cloudDir ?? "")
+  );
+  if (existing) return existing;
+  const job = {
+    id: randomBytes4(4).toString("hex"),
+    localDir: input.localDir,
+    ...input.cloudDir ? { cloudDir: input.cloudDir } : {},
+    addedAt: input.addedAt
+  };
+  await writeBackups(keyRoot, [...jobs, job]);
+  return job;
+}
+async function removeBackup(keyRoot, id) {
+  const jobs = await readBackups(keyRoot);
+  const next = jobs.filter((j) => j.id !== id);
+  if (next.length === jobs.length) return false;
+  await writeBackups(keyRoot, next);
+  return true;
+}
+async function updateLastBackup(keyRoot, id, whenISO) {
+  const jobs = await readBackups(keyRoot);
+  let changed = false;
+  const next = jobs.map((j) => {
+    if (j.id === id) {
+      changed = true;
+      return { ...j, lastBackupAt: whenISO };
+    }
+    return j;
+  });
+  if (changed) await writeBackups(keyRoot, next);
+}
+
+// ../core/src/baidu/oauth.ts
+var OAUTH_BASE = "https://openapi.baidu.com/oauth/2.0";
+var DEFAULT_SCOPE = "basic,netdisk";
+function enc(params) {
+  return Object.entries(params).map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&");
+}
+async function asJson(res) {
+  const data = await res.json();
+  if (typeof data.error === "string") {
+    throw new BizhouError(
+      "OAUTH",
+      `\u767E\u5EA6 OAuth \u9519\u8BEF\uFF1A${data.error} - ${String(data.error_description ?? "")}`
+    );
+  }
+  return data;
+}
+function toTokenResponse(d) {
+  if (typeof d.access_token !== "string") {
+    throw new BizhouError("OAUTH", "OAuth \u54CD\u5E94\u7F3A\u5C11 access_token");
+  }
+  return {
+    accessToken: d.access_token,
+    refreshToken: typeof d.refresh_token === "string" ? d.refresh_token : void 0,
+    expiresIn: typeof d.expires_in === "number" ? d.expires_in : 0,
+    scope: typeof d.scope === "string" ? d.scope : void 0
+  };
+}
+function buildAuthorizeUrl(config, redirectUri, opts = {}) {
+  const params = {
+    response_type: "code",
+    client_id: config.appKey,
+    redirect_uri: redirectUri,
+    scope: opts.scope ?? DEFAULT_SCOPE
+  };
+  if (opts.state) params.state = opts.state;
+  return `${OAUTH_BASE}/authorize?${enc(params)}`;
+}
+async function exchangeCodeForToken(config, code, redirectUri, fetchLike) {
+  const url = `${OAUTH_BASE}/token?${enc({
+    grant_type: "authorization_code",
+    code,
+    client_id: config.appKey,
+    client_secret: config.secretKey,
+    redirect_uri: redirectUri
+  })}`;
+  return toTokenResponse(await asJson(await fetchLike(url)));
+}
+async function startDeviceFlow(config, fetchLike, scope = DEFAULT_SCOPE) {
+  const url = `${OAUTH_BASE}/device/code?${enc({
+    response_type: "device_code",
+    client_id: config.appKey,
+    scope
+  })}`;
+  const d = await asJson(await fetchLike(url));
+  if (typeof d.device_code !== "string" || typeof d.user_code !== "string") {
+    throw new BizhouError("OAUTH", "\u8BBE\u5907\u7801\u54CD\u5E94\u7F3A\u5C11 device_code/user_code");
+  }
+  return {
+    deviceCode: d.device_code,
+    userCode: d.user_code,
+    verificationUrl: String(d.verification_url ?? "https://openapi.baidu.com/device"),
+    qrcodeUrl: typeof d.qrcode_url === "string" ? d.qrcode_url : void 0,
+    interval: typeof d.interval === "number" ? d.interval : 5,
+    expiresIn: typeof d.expires_in === "number" ? d.expires_in : 0
+  };
+}
+async function pollDeviceToken(config, deviceCode, fetchLike) {
+  const url = `${OAUTH_BASE}/token?${enc({
+    grant_type: "device_token",
+    code: deviceCode,
+    client_id: config.appKey,
+    client_secret: config.secretKey
+  })}`;
+  const raw = await (await fetchLike(url)).json();
+  if (raw.error === "authorization_pending" || raw.error === "slow_down") {
+    return null;
+  }
+  if (typeof raw.error === "string") {
+    throw new BizhouError("OAUTH", `\u8BBE\u5907\u7801\u6388\u6743\u5931\u8D25\uFF1A${raw.error}`);
+  }
+  return toTokenResponse(raw);
+}
+async function refreshAccessToken(config, refreshToken, fetchLike) {
+  const url = `${OAUTH_BASE}/token?${enc({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+    client_id: config.appKey,
+    client_secret: config.secretKey
+  })}`;
+  return toTokenResponse(await asJson(await fetchLike(url)));
+}
+
+// ../core/src/cache/index.ts
+import { mkdir as mkdir4, readFile as readFile4, rename as rename3, rm as rm3, writeFile as writeFile4 } from "fs/promises";
+import { join as join5 } from "path";
+var CACHE_SUBDIR = join5(".cache", "manifests");
+function cacheFile(keyRoot, bundleId) {
+  assertNameSegment(bundleId);
+  return join5(keyRoot, CACHE_SUBDIR, `${bundleId}.json`);
+}
+async function getCachedManifest(keyRoot, bundleId) {
+  try {
+    return await readFile4(cacheFile(keyRoot, bundleId), "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+}
+async function putCachedManifest(keyRoot, bundleId, rawManifest) {
+  const path = cacheFile(keyRoot, bundleId);
+  await mkdir4(join5(keyRoot, CACHE_SUBDIR), { recursive: true });
+  const tmp = `${path}.tmp`;
+  await writeFile4(tmp, rawManifest, "utf8");
+  await rename3(tmp, path);
+}
+async function invalidateManifest(keyRoot, bundleId) {
+  await rm3(cacheFile(keyRoot, bundleId), { force: true });
+}
+
+// ../core/src/chunker/index.ts
+import { createHash as createHash2 } from "crypto";
+import { open } from "fs/promises";
+import { gunzipSync, gzipSync } from "zlib";
+function sha256hex(b) {
+  return createHash2("sha256").update(b).digest("hex");
+}
+async function encryptFileToChunks(opts) {
+  if (opts.chunkSize <= 0) throw new BizhouError("INVALID_ARG", "chunkSize \u5FC5\u987B\u4E3A\u6B63");
+  const totalChunks = Math.max(1, Math.ceil(opts.fileSize / opts.chunkSize));
+  const skip = new Set(opts.skipExisting ?? []);
+  const chunks = [];
+  const fh = await open(opts.filePath, "r");
+  try {
+    const buf = Buffer.allocUnsafe(opts.chunkSize);
+    let seq = 0;
+    let position = 0;
+    let bytesDone = 0;
+    while (true) {
+      const { bytesRead } = await fh.read(buf, 0, opts.chunkSize, position);
+      if (bytesRead === 0 && seq > 0) break;
+      const plain = buf.subarray(0, bytesRead);
+      const payload = opts.compression === "gzip" ? gzipSync(plain) : plain;
+      const aad = chunkAad(opts.bundleId, seq);
+      const { iv, ciphertext, tag } = aeadEncrypt(
+        opts.dek,
+        payload,
+        aad,
+        deriveDeterministicIv(opts.dek, aad)
+      );
+      if (!skip.has(seq)) {
+        await opts.store.putChunk(seq, ciphertext);
+      }
+      chunks.push({
+        seq,
+        file: chunkFileName(seq),
+        plainSize: bytesRead,
+        encSize: ciphertext.length,
+        iv: iv.toString("base64"),
+        tag: tag.toString("base64"),
+        sha256: sha256hex(ciphertext)
+      });
+      bytesDone += bytesRead;
+      position += bytesRead;
+      opts.onProgress?.({
+        phase: "encrypt",
+        seq,
+        totalChunks,
+        bytesDone,
+        bytesTotal: opts.fileSize
+      });
+      seq++;
+      if (bytesRead < opts.chunkSize) break;
+    }
+    return chunks;
+  } finally {
+    await fh.close();
+  }
+}
+async function decryptChunksToFile(opts) {
+  const totalChunks = opts.chunks.length;
+  const bytesTotal = opts.chunks.reduce((a, c2) => a + c2.plainSize, 0);
+  const skip = new Set(opts.skip ?? []);
+  const resuming = skip.size > 0;
+  let bytesDone = 0;
+  const fh = await open(opts.outPath, resuming ? "r+" : "w");
+  try {
+    let position = 0;
+    for (const info2 of opts.chunks) {
+      if (skip.has(info2.seq)) {
+        position += info2.plainSize;
+        bytesDone += info2.plainSize;
+        opts.onProgress?.({ phase: "decrypt", seq: info2.seq, totalChunks, bytesDone, bytesTotal });
+        continue;
+      }
+      const ct = await opts.store.getChunk(info2.seq);
+      if (sha256hex(ct) !== info2.sha256) {
+        throw new BizhouError("CHUNK", `\u5206\u7247 ${info2.seq} \u5BC6\u6587 sha256 \u6821\u9A8C\u5931\u8D25\uFF08\u6570\u636E\u635F\u574F\u6216\u88AB\u7BE1\u6539\uFF09`);
+      }
+      const iv = Buffer.from(info2.iv, "base64");
+      const tag = Buffer.from(info2.tag, "base64");
+      const payload = aeadDecrypt(opts.dek, iv, ct, tag, chunkAad(opts.bundleId, info2.seq));
+      const plain = opts.compression === "gzip" ? gunzipSync(payload) : payload;
+      if (plain.length !== info2.plainSize) {
+        throw new BizhouError(
+          "CHUNK",
+          `\u5206\u7247 ${info2.seq} \u8FD8\u539F\u957F\u5EA6 ${plain.length} \u4E0E manifest plainSize ${info2.plainSize} \u4E0D\u7B26`
+        );
+      }
+      await fh.write(plain, 0, plain.length, position);
+      position += plain.length;
+      bytesDone += plain.length;
+      opts.onProgress?.({ phase: "decrypt", seq: info2.seq, totalChunks, bytesDone, bytesTotal });
+    }
+    await fh.truncate(position);
+    return { bytesWritten: bytesDone };
+  } finally {
+    await fh.close();
+  }
+}
+
+// ../core/src/config/index.ts
+import { join as join6 } from "path";
+var VAULT_FILENAME = "vault.json";
+var SECRETS_FILENAME = "secrets.enc";
+var DEVICE_KEY_FILENAME = "device.key";
+var CONFIG_FILENAME = "config.json";
+function resolveKeyRoot(env, platform) {
+  if (env.BIZHOU_HOME) return env.BIZHOU_HOME;
+  if (env.BIZHOU_CONFIG_DIR) return env.BIZHOU_CONFIG_DIR;
+  const home = env.HOME ?? env.USERPROFILE ?? ".";
+  return join6(home, ".bizhou");
+}
+function defaultDownloadsDir(env, platform) {
+  const home = platform === "win32" ? env.USERPROFILE ?? env.HOME ?? "." : env.HOME ?? ".";
+  return join6(home, "Downloads");
+}
+function resolveFileRoot(env, platform, configFileRoot) {
+  if (env.BIZHOU_FILE_ROOT) return env.BIZHOU_FILE_ROOT;
+  if (configFileRoot) return configFileRoot;
+  return defaultDownloadsDir(env, platform);
+}
+function configPaths(env, platform) {
+  const dir = resolveKeyRoot(env, platform);
+  return {
+    dir,
+    vault: join6(dir, VAULT_FILENAME),
+    secrets: join6(dir, SECRETS_FILENAME),
+    deviceKey: join6(dir, DEVICE_KEY_FILENAME),
+    config: join6(dir, CONFIG_FILENAME)
+  };
+}
+
+// ../core/src/content/index.ts
+import { createHmac as createHmac2, hkdfSync } from "crypto";
+import { open as open2 } from "fs/promises";
+var CONTENT_ID_INFO = Buffer.from("bizhou-content-id", "utf8");
+var READ_BUF_BYTES = 1024 * 1024;
+function deriveContentKey(mk) {
+  return Buffer.from(hkdfSync("sha256", mk, Buffer.alloc(0), CONTENT_ID_INFO, 32));
+}
+async function hashPlaintextFile(filePath, contentKey) {
+  const hmac = createHmac2("sha256", contentKey);
+  const fh = await open2(filePath, "r");
+  try {
+    const buf = Buffer.allocUnsafe(READ_BUF_BYTES);
+    let position = 0;
+    while (true) {
+      const { bytesRead } = await fh.read(buf, 0, READ_BUF_BYTES, position);
+      if (bytesRead === 0) break;
+      hmac.update(buf.subarray(0, bytesRead));
+      position += bytesRead;
+    }
+  } finally {
+    await fh.close();
+  }
+  return hmac.digest("hex");
+}
+
+// ../core/src/crypto/base32.ts
+var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+var CHAR_TO_VAL = {};
+for (let i = 0; i < ALPHABET.length; i++) CHAR_TO_VAL[ALPHABET[i]] = i;
+function base32Encode(data) {
+  let bits = 0;
+  let value = 0;
+  let out2 = "";
+  for (const byte of data) {
+    value = value << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      out2 += ALPHABET[value >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) {
+    out2 += ALPHABET[value << 5 - bits & 31];
+  }
+  return out2;
+}
+function base32Decode(input) {
+  const clean = input.replace(/[-\s]/g, "").toUpperCase();
+  let bits = 0;
+  let value = 0;
+  const bytes = [];
+  for (const ch of clean) {
+    const v = CHAR_TO_VAL[ch];
+    if (v === void 0) {
+      throw new InvalidArgError(`base32 \u542B\u975E\u6CD5\u5B57\u7B26\uFF1A'${ch}'`);
+    }
+    value = value << 5 | v;
+    bits += 5;
+    if (bits >= 8) {
+      bytes.push(value >>> bits - 8 & 255);
+      bits -= 8;
+    }
+  }
+  return Buffer.from(bytes);
+}
+function groupBase32(s, groupSize = 4) {
+  const groups = [];
+  for (let i = 0; i < s.length; i += groupSize) {
+    groups.push(s.slice(i, i + groupSize));
+  }
+  return groups.join("-");
+}
+
+// ../core/src/journal/index.ts
+import { createHash as createHash3 } from "crypto";
+import { mkdir as mkdir5, readFile as readFile5, rename as rename4, rm as rm4, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname3, join as join7 } from "path";
+var KIND_DIR = { upload: ".uploads", download: ".downloads" };
+function journalPath(keyRoot, kind, contentId, destKey) {
+  const destHash = createHash3("sha256").update(destKey).digest("hex").slice(0, 16);
+  return join7(keyRoot, KIND_DIR[kind], `${contentId}@${destHash}.json`);
+}
+function isValidJournalEntry(e) {
+  if (typeof e !== "object" || e === null) return false;
+  const o = e;
+  const common = typeof o.bundleId === "string" && typeof o.cloudDir === "string" && typeof o.contentId === "string" && Array.isArray(o.doneChunks) && o.doneChunks.every((n) => typeof n === "number") && typeof o.totalChunks === "number" && typeof o.startedAt === "string" && typeof o.pid === "number";
+  if (!common) return false;
+  if (o.wrappedKey !== void 0 && typeof o.wrappedKey !== "string") return false;
+  if (o.chunkSize !== void 0 && typeof o.chunkSize !== "number") return false;
+  if (o.compression !== void 0 && o.compression !== "none" && o.compression !== "gzip")
+    return false;
+  return true;
+}
+async function readJournal(path) {
+  try {
+    const raw = await readFile5(path, "utf8");
+    const e = JSON.parse(raw);
+    if (!isValidJournalEntry(e)) return null;
+    return e;
+  } catch {
+    return null;
+  }
+}
+async function writeJournal(path, entry) {
+  await mkdir5(dirname3(path), { recursive: true });
+  const tmp = `${path}.tmp`;
+  await writeFile5(tmp, JSON.stringify(entry), "utf8");
+  await rename4(tmp, path);
+}
+async function appendDoneChunk(path, seq) {
+  const e = await readJournal(path);
+  if (!e) return;
+  if (!e.doneChunks.includes(seq)) {
+    e.doneChunks.push(seq);
+    e.doneChunks.sort((a, b) => a - b);
+    await writeJournal(path, e);
+  }
+}
+async function removeJournal(path) {
+  await rm4(path, { force: true });
+}
+function isLockAlive(entry, opts) {
+  if (opts.pidAlive) return true;
+  return opts.now - Date.parse(entry.startedAt) < opts.ttlMs;
+}
+
+// ../core/src/keystore/index.ts
+import { randomBytes as randomBytes5 } from "crypto";
+import { chmod, mkdir as mkdir6, readFile as readFile6, writeFile as writeFile6 } from "fs/promises";
+var FileSecretStore = class {
+  constructor(dir, secretsPath, deviceKeyPath) {
+    this.dir = dir;
+    this.secretsPath = secretsPath;
+    this.deviceKeyPath = deviceKeyPath;
+  }
+  dir;
+  secretsPath;
+  deviceKeyPath;
+  async ensureDir() {
+    await mkdir6(this.dir, { recursive: true });
+  }
+  async deviceKey() {
+    try {
+      const b64 = await readFile6(this.deviceKeyPath, "utf8");
+      return Buffer.from(b64.trim(), "base64");
+    } catch {
+      await this.ensureDir();
+      const key = randomBytes5(32);
+      await writeFile6(this.deviceKeyPath, key.toString("base64"), { mode: 384 });
+      await chmod(this.deviceKeyPath, 384).catch(() => {
+      });
+      return key;
+    }
+  }
+  async load() {
+    let enc2;
+    try {
+      enc2 = await readFile6(this.secretsPath, "utf8");
+    } catch {
+      return {};
+    }
+    const key = await this.deviceKey();
+    const json = openFromBase64(key, enc2.trim()).toString("utf8");
+    return JSON.parse(json);
+  }
+  async save(data) {
+    await this.ensureDir();
+    const key = await this.deviceKey();
+    const blob = sealToBase64(key, Buffer.from(JSON.stringify(data), "utf8"));
+    await writeFile6(this.secretsPath, blob, { mode: 384 });
+    await chmod(this.secretsPath, 384).catch(() => {
+    });
+  }
+  async getAll() {
+    return this.load();
+  }
+  async get(key) {
+    return (await this.load())[key];
+  }
+  async set(key, value) {
+    const data = await this.load();
+    data[key] = value;
+    await this.save(data);
+  }
+  async delete(key) {
+    const data = await this.load();
+    delete data[key];
+    await this.save(data);
+  }
+};
+
+// ../core/src/resource/index.ts
+import { basename as basename2 } from "path";
+
+// ../core/src/vault/index.ts
+var MK_CHECK_MARKER = Buffer.from("bizhou-vault-check-v1", "utf8");
+var VAULT_VERSION = 1;
+function makeMkCheck(mk) {
+  return sealToBase64(mk, MK_CHECK_MARKER);
+}
+function verifyMk(vault, mk) {
+  let opened;
+  try {
+    opened = openFromBase64(mk, vault.mkCheck);
+  } catch (cause) {
+    throw new VaultError("vault \u6821\u9A8C\u5931\u8D25\uFF1A\u89E3\u9501\u5F97\u5230\u7684\u4E3B\u5BC6\u94A5\u65E0\u6CD5\u9A8C\u8BC1\uFF08vault \u6587\u4EF6\u53EF\u80FD\u635F\u574F\uFF09", {
+      cause
+    });
+  }
+  if (!opened.equals(MK_CHECK_MARKER)) {
+    throw new VaultError("vault \u6821\u9A8C\u5931\u8D25\uFF1A\u4E3B\u5BC6\u94A5\u6807\u8BB0\u4E0D\u5339\u914D");
+  }
+}
+async function createVault(masterPassword, opts = { createdAt: "" }) {
+  if (masterPassword.length === 0) {
+    throw new VaultError("\u4E3B\u5BC6\u7801\u4E0D\u80FD\u4E3A\u7A7A");
+  }
+  const params = opts.params ?? DEFAULT_SCRYPT;
+  const mk = generateKey();
+  const pwSalt = generateSalt();
+  const kekPw = await deriveKey(masterPassword, pwSalt, params);
+  const recoveryRaw = generateKey();
+  const recoveryKey = groupBase32(base32Encode(recoveryRaw));
+  const vault = {
+    version: VAULT_VERSION,
+    kdf: params,
+    pwSalt: pwSalt.toString("base64"),
+    wrappedMkByPassword: wrapKey(kekPw, mk),
+    wrappedMkByRecovery: wrapKey(recoveryRaw, mk),
+    mkCheck: makeMkCheck(mk),
+    createdAt: opts.createdAt
+  };
+  return { vault, recoveryKey };
+}
+async function unlockWithPassword(vault, masterPassword) {
+  const pwSalt = Buffer.from(vault.pwSalt, "base64");
+  const kekPw = await deriveKey(masterPassword, pwSalt, vault.kdf);
+  let mk;
+  try {
+    mk = unwrapKey(kekPw, vault.wrappedMkByPassword);
+  } catch (cause) {
+    throw new AuthError("\u4E3B\u5BC6\u7801\u9519\u8BEF\uFF1A\u65E0\u6CD5\u89E3\u5F00\u4E3B\u5BC6\u94A5", { cause });
+  }
+  verifyMk(vault, mk);
+  return mk;
+}
+async function unlockWithRecovery(vault, recoveryKey) {
+  const raw = base32Decode(recoveryKey);
+  if (raw.length !== KEY_BYTES) {
+    throw new AuthError(`\u6062\u590D\u5BC6\u94A5\u957F\u5EA6\u4E0D\u6B63\u786E\uFF08\u5E94\u89E3\u51FA ${KEY_BYTES} \u5B57\u8282\uFF0C\u5B9E\u9645 ${raw.length}\uFF09`);
+  }
+  let mk;
+  try {
+    mk = unwrapKey(raw, vault.wrappedMkByRecovery);
+  } catch (cause) {
+    throw new AuthError("\u6062\u590D\u5BC6\u94A5\u9519\u8BEF\uFF1A\u65E0\u6CD5\u89E3\u5F00\u4E3B\u5BC6\u94A5", { cause });
+  }
+  verifyMk(vault, mk);
+  return mk;
+}
+async function changePassword(vault, currentPassword, newPassword, params = DEFAULT_SCRYPT) {
+  if (newPassword.length === 0) throw new VaultError("\u65B0\u4E3B\u5BC6\u7801\u4E0D\u80FD\u4E3A\u7A7A");
+  const mk = await unlockWithPassword(vault, currentPassword);
+  const pwSalt = generateSalt();
+  const kekPw = await deriveKey(newPassword, pwSalt, params);
+  return {
+    ...vault,
+    kdf: params,
+    pwSalt: pwSalt.toString("base64"),
+    wrappedMkByPassword: wrapKey(kekPw, mk)
+  };
+}
+function wrapDek(mk, dek) {
+  return wrapKey(mk, dek);
+}
+function unwrapDek(mk, wrapped) {
+  return unwrapKey(mk, wrapped);
+}
+
+// ../core/src/resource/index.ts
+var DEFAULT_CHUNK_SIZE = 100 * 1024 * 1024;
+async function packResource(opts) {
+  const chunkSize = opts.chunkSize ?? DEFAULT_CHUNK_SIZE;
+  const compression = opts.compression ?? "none";
+  const dek = opts.dek ?? generateKey();
+  const chunks = await encryptFileToChunks({
+    filePath: opts.filePath,
+    fileSize: opts.fileSize,
+    dek,
+    bundleId: opts.bundleId,
+    chunkSize,
+    compression,
+    store: opts.store,
+    onProgress: opts.onProgress,
+    skipExisting: opts.skipExisting
+  });
+  const meta = {
+    name: opts.name ?? basename2(opts.filePath),
+    size: opts.fileSize,
+    ...opts.mtime ? { mtime: opts.mtime } : {},
+    ...opts.contentType ? { contentType: opts.contentType } : {},
+    ...opts.contentId ? { contentId: opts.contentId } : {}
+  };
+  let previewInfo;
+  if (opts.preview) {
+    const { iv, ciphertext, tag } = aeadEncrypt(dek, opts.preview.data);
+    await opts.store.putPreview(ciphertext);
+    previewInfo = {
+      file: PREVIEW_FILENAME,
+      kind: opts.preview.kind,
+      iv: iv.toString("base64"),
+      tag: tag.toString("base64")
+    };
+  }
+  const manifest = {
+    version: 1,
+    bundleId: opts.bundleId,
+    createdAt: opts.createdAt,
+    cipher: "AES-256-GCM",
+    compression,
+    chunkSize,
+    wrappedKey: wrapDek(opts.mk, dek),
+    chunks,
+    ...previewInfo ? { preview: previewInfo } : {},
+    encMeta: sealMeta(dek, meta)
+  };
+  await opts.store.putManifest(serializeManifest(manifest));
+  return manifest;
+}
+async function openPreview(mk, store) {
+  const manifest = parseManifest(await store.getManifest());
+  if (!manifest.preview) {
+    throw new BizhouError("BUNDLE", "\u8BE5\u8D44\u6E90\u6CA1\u6709\u9884\u89C8\u5305");
+  }
+  const dek = unwrapDek(mk, manifest.wrappedKey);
+  const ct = await store.getPreview();
+  const data = aeadDecrypt(
+    dek,
+    Buffer.from(manifest.preview.iv, "base64"),
+    ct,
+    Buffer.from(manifest.preview.tag, "base64")
+  );
+  return { kind: manifest.preview.kind, data };
+}
+async function unpackResource(opts) {
+  const manifest = parseManifest(await opts.store.getManifest());
+  const dek = unwrapDek(opts.mk, manifest.wrappedKey);
+  const meta = openMeta(dek, manifest.encMeta);
+  const { bytesWritten } = await decryptChunksToFile({
+    chunks: manifest.chunks,
+    dek,
+    bundleId: manifest.bundleId,
+    compression: manifest.compression,
+    store: opts.store,
+    outPath: opts.outPath,
+    skip: opts.skip,
+    onProgress: opts.onProgress
+  });
+  return { manifest, meta, bytesWritten };
+}
+async function readResourceMeta(mk, store) {
+  const manifest = parseManifest(await store.getManifest());
+  const dek = unwrapDek(mk, manifest.wrappedKey);
+  return { manifest, meta: openMeta(dek, manifest.encMeta) };
+}
+async function renameResource(mk, store, newName) {
+  const manifest = parseManifest(await store.getManifest());
+  const dek = unwrapDek(mk, manifest.wrappedKey);
+  const meta = openMeta(dek, manifest.encMeta);
+  const manifest2 = {
+    ...manifest,
+    encMeta: sealMeta(dek, { ...meta, name: newName })
+  };
+  await store.putManifest(serializeManifest(manifest2));
+}
+
+// src/commands.ts
+import { mkdir as mkdir8, mkdtemp as mkdtemp2, readdir as readdir4, rename as rename5, rm as rm6, stat, writeFile as writeFile8 } from "fs/promises";
+import { createServer } from "http";
+import { tmpdir as tmpdir2 } from "os";
+import { basename as basename3, dirname as dirname4, join as join10, relative as relative2, resolve as resolve3, sep } from "path";
+
+// src/export7z.ts
+import { spawn } from "child_process";
+import { access } from "fs/promises";
+import { resolve } from "path";
+var CANDIDATES = ["7z", "7za", "7zz"];
+async function onPath(bin) {
+  const dirs = (process.env.PATH ?? "").split(":");
+  for (const d of dirs) {
+    try {
+      await access(`${d}/${bin}`);
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+async function findSevenZip() {
+  if (process.env.BIZHOU_7Z_BIN) return process.env.BIZHOU_7Z_BIN;
+  for (const c2 of CANDIDATES) {
+    if (await onPath(c2)) return c2;
+  }
+  return null;
+}
+function sevenZipArchive(bin, outArchive, inputPaths, password) {
+  const outAbs = resolve(outArchive);
+  const inAbs = inputPaths.map((p) => resolve(p));
+  return new Promise((resolvePromise, reject) => {
+    const args = ["a", "-t7z", "-mhe=on", `-p${password}`, "--", outAbs, ...inAbs];
+    const p = spawn(bin, args, { stdio: "ignore" });
+    p.on("error", reject);
+    p.on(
+      "close",
+      (code) => code === 0 ? resolvePromise() : reject(new BizhouError("IO", `7z \u6253\u5305\u5931\u8D25\uFF08\u9000\u51FA\u7801 ${code}\uFF09`))
+    );
+  });
+}
+
+// src/preview.ts
+import { spawn as spawn2 } from "child_process";
+import { createReadStream } from "fs";
+import { mkdtemp, open as open3, readdir as readdir3, readFile as readFile7, rm as rm5 } from "fs/promises";
+import { tmpdir } from "os";
+import { extname, join as join8, resolve as resolve2 } from "path";
+import { createGunzip } from "zlib";
+var IMAGE_EXT = /* @__PURE__ */ new Set([".jpg", ".jpeg", ".png", ".gif", ".webp", ".bmp", ".tiff", ".heic"]);
+var VIDEO_EXT = /* @__PURE__ */ new Set([".mp4", ".mov", ".mkv", ".avi", ".webm", ".flv", ".m4v", ".wmv"]);
+var AUDIO_EXT = /* @__PURE__ */ new Set([".mp3", ".flac", ".wav", ".aac", ".ogg", ".m4a", ".wma"]);
+var TEXT_EXT = /* @__PURE__ */ new Set([
+  ".txt",
+  ".md",
+  ".markdown",
+  ".json",
+  ".jsonc",
+  ".csv",
+  ".tsv",
+  ".log",
+  ".yaml",
+  ".yml",
+  ".xml",
+  ".ini",
+  ".toml",
+  ".cfg",
+  ".conf",
+  ".env",
+  ".properties",
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".py",
+  ".go",
+  ".rs",
+  ".java",
+  ".kt",
+  ".c",
+  ".h",
+  ".cpp",
+  ".hpp",
+  ".cc",
+  ".cs",
+  ".rb",
+  ".php",
+  ".swift",
+  ".scala",
+  ".sh",
+  ".bash",
+  ".zsh",
+  ".ps1",
+  ".sql",
+  ".html",
+  ".htm",
+  ".css",
+  ".scss",
+  ".less",
+  ".vue",
+  ".svelte"
+]);
+function detectStrategy(path) {
+  const lower = path.toLowerCase();
+  const ext = extname(lower);
+  if (IMAGE_EXT.has(ext)) return "image";
+  if (VIDEO_EXT.has(ext)) return "video";
+  if (AUDIO_EXT.has(ext)) return "audio";
+  if (ext === ".pdf") return "pdf";
+  if (ext === ".zip" || ext === ".tar" || ext === ".tgz" || lower.endsWith(".tar.gz")) {
+    return "archive";
+  }
+  if (TEXT_EXT.has(ext)) return "text";
+  return null;
+}
+var TEXT_PREVIEW_BYTES = 32 * 1024;
+function trimToUtf8Boundary(buf) {
+  if (buf.length === 0) return buf;
+  let i = buf.length - 1;
+  let cont = 0;
+  while (i >= 0 && (buf[i] & 192) === 128 && cont < 3) {
+    i--;
+    cont++;
+  }
+  if (i < 0) return buf;
+  const lead = buf[i];
+  let need;
+  if ((lead & 128) === 0) need = 1;
+  else if ((lead & 224) === 192) need = 2;
+  else if ((lead & 240) === 224) need = 3;
+  else if ((lead & 248) === 240) need = 4;
+  else return buf;
+  const have = buf.length - i;
+  return have >= need ? buf : buf.subarray(0, i);
+}
+async function genText(path) {
+  let fh;
+  try {
+    fh = await open3(path, "r");
+    const buf = Buffer.allocUnsafe(TEXT_PREVIEW_BYTES);
+    const { bytesRead } = await fh.read(buf, 0, TEXT_PREVIEW_BYTES, 0);
+    return { kind: "text", data: trimToUtf8Boundary(buf.subarray(0, bytesRead)) };
+  } catch {
+    return null;
+  } finally {
+    await fh?.close();
+  }
+}
+function ffmpegBin() {
+  return process.env.BIZHOU_FFMPEG_BIN ?? "ffmpeg";
+}
+function runFfmpeg(args) {
+  return new Promise((resolve5, reject) => {
+    const p = spawn2(ffmpegBin(), ["-y", "-loglevel", "error", ...args], { stdio: "ignore" });
+    p.on("error", reject);
+    p.on("close", (code) => code === 0 ? resolve5() : reject(new Error(`ffmpeg \u9000\u51FA\u7801 ${code}`)));
+  });
+}
+async function genFfmpeg(src, kind) {
+  let work;
+  try {
+    work = await mkdtemp(join8(tmpdir(), "bizhou-prev-"));
+    if (kind === "image" || kind === "video") {
+      const out3 = join8(work, "thumb.jpg");
+      const vf = "scale=320:-1";
+      const args = kind === "video" ? ["-i", src, "-ss", "00:00:01", "-vframes", "1", "-vf", vf, out3] : ["-i", src, "-vf", vf, out3];
+      await runFfmpeg(args);
+      return { kind, data: await readFile7(out3) };
+    }
+    const out2 = join8(work, "clip.mp3");
+    await runFfmpeg(["-i", src, "-t", "15", "-b:a", "64k", out2]);
+    return { kind, data: await readFile7(out2) };
+  } catch {
+    return null;
+  } finally {
+    if (work) await rm5(work, { recursive: true, force: true });
+  }
+}
+var ARCHIVE_MAX_ENTRIES = 500;
+var TarLister = class {
+  names = [];
+  buf = Buffer.alloc(0);
+  skip = 0;
+  // 待丢弃的数据字节
+  done = false;
+  feed(chunk) {
+    if (this.done) return;
+    let data = chunk;
+    if (this.skip > 0) {
+      const drop = Math.min(this.skip, data.length);
+      this.skip -= drop;
+      data = data.subarray(drop);
+      if (data.length === 0) return;
+    }
+    this.buf = this.buf.length ? Buffer.concat([this.buf, data]) : data;
+    while (this.buf.length >= 512) {
+      const block = this.buf.subarray(0, 512);
+      if (block.every((b) => b === 0)) {
+        this.done = true;
+        return;
+      }
+      const raw = block.subarray(0, 100);
+      const nul = raw.indexOf(0);
+      const name = raw.toString("utf8", 0, nul === -1 ? 100 : nul);
+      const sizeStr = block.toString("ascii", 124, 136).replace(/\0.*$/, "").trim();
+      const size = Math.max(0, Number.parseInt(sizeStr, 8) || 0);
+      if (name) this.names.push(name);
+      if (this.names.length >= ARCHIVE_MAX_ENTRIES) {
+        this.done = true;
+        return;
+      }
+      const dataLen = Math.ceil(size / 512) * 512;
+      this.buf = this.buf.subarray(512);
+      const inBuf = Math.min(dataLen, this.buf.length);
+      this.buf = this.buf.subarray(inBuf);
+      this.skip = dataLen - inBuf;
+      if (this.skip > 0) return;
+    }
+  }
+  result() {
+    return this.names;
+  }
+};
+function listTar(buf) {
+  const l = new TarLister();
+  l.feed(buf);
+  return l.result();
+}
+function listZip(buf) {
+  const EOCD = 101010256;
+  let p = buf.length - 22;
+  const min = Math.max(0, buf.length - 22 - 65535);
+  for (; p >= min; p--) {
+    if (p + 4 <= buf.length && buf.readUInt32LE(p) === EOCD) break;
+  }
+  if (p < min) throw new Error("no EOCD");
+  const count = buf.readUInt16LE(p + 10);
+  let off = buf.readUInt32LE(p + 16);
+  const names = [];
+  for (let i = 0; i < count && i < ARCHIVE_MAX_ENTRIES; i++) {
+    if (off + 46 > buf.length || buf.readUInt32LE(off) !== 33639248) break;
+    const nameLen = buf.readUInt16LE(off + 28);
+    const extraLen = buf.readUInt16LE(off + 30);
+    const commentLen = buf.readUInt16LE(off + 32);
+    names.push(buf.toString("utf8", off + 46, off + 46 + nameLen));
+    off += 46 + nameLen + extraLen + commentLen;
+  }
+  return names;
+}
+var ARCHIVE_MAX_SCAN_BYTES = 64 * 1024 * 1024;
+function listTarGz(path) {
+  return new Promise((resolve5, reject) => {
+    const lister = new TarLister();
+    const gunzip = createGunzip();
+    const rs = createReadStream(path);
+    let totalDecompressed = 0;
+    const finish = () => {
+      rs.destroy();
+      gunzip.destroy();
+      resolve5(lister.result());
+    };
+    gunzip.on("data", (c2) => {
+      totalDecompressed += c2.length;
+      try {
+        lister.feed(c2);
+      } catch {
+        finish();
+        return;
+      }
+      if (lister.done || totalDecompressed > ARCHIVE_MAX_SCAN_BYTES) finish();
+    });
+    gunzip.on("end", () => resolve5(lister.result()));
+    gunzip.on("error", reject);
+    rs.on("error", reject);
+    rs.pipe(gunzip);
+  });
+}
+async function genArchive(path) {
+  const lower = path.toLowerCase();
+  const ext = extname(lower);
+  try {
+    let names;
+    if (ext === ".zip") names = listZip(await readFile7(path));
+    else if (ext === ".tgz" || lower.endsWith(".tar.gz")) names = await listTarGz(path);
+    else if (ext === ".tar") names = listTar(await readFile7(path));
+    else return null;
+    if (names.length === 0) return null;
+    let text = names.join("\n");
+    if (names.length >= ARCHIVE_MAX_ENTRIES) text += `
+\u2026\uFF08\u4EC5\u5217\u524D ${ARCHIVE_MAX_ENTRIES} \u6761\uFF09`;
+    return { kind: "text", data: Buffer.from(text, "utf8") };
+  } catch {
+    return null;
+  }
+}
+function pdftoppmBin() {
+  return process.env.BIZHOU_PDFTOPPM_BIN ?? "pdftoppm";
+}
+function runPdftoppm(args) {
+  return new Promise((resolvePromise, reject) => {
+    const p = spawn2(pdftoppmBin(), args, { stdio: "ignore" });
+    p.on("error", reject);
+    p.on(
+      "close",
+      (code) => code === 0 ? resolvePromise() : reject(new Error(`pdftoppm \u9000\u51FA\u7801 ${code}`))
+    );
+  });
+}
+async function genPdf(path) {
+  const src = resolve2(path);
+  let work;
+  try {
+    work = await mkdtemp(join8(tmpdir(), "bizhou-pdf-"));
+    const prefix = join8(work, "pg");
+    await runPdftoppm(["-jpeg", "-f", "1", "-l", "1", "-scale-to", "320", src, prefix]);
+    const files = (await readdir3(work)).filter((f) => f.toLowerCase().endsWith(".jpg")).sort();
+    if (files.length === 0) return null;
+    return { kind: "image", data: await readFile7(join8(work, files[0])) };
+  } catch {
+    return null;
+  } finally {
+    if (work) await rm5(work, { recursive: true, force: true });
+  }
+}
+async function generatePreview(sourcePath) {
+  const strat = detectStrategy(sourcePath);
+  if (!strat) return null;
+  const src = resolve2(sourcePath);
+  switch (strat) {
+    case "image":
+    case "video":
+    case "audio":
+      return genFfmpeg(src, strat);
+    case "text":
+      return genText(src);
+    case "pdf":
+      return genPdf(src);
+    case "archive":
+      return genArchive(src);
+  }
+}
+
+// src/prompt.ts
+function readLineFromStdin() {
+  return new Promise((resolve5) => {
+    let data = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (ch) => data += ch);
+    process.stdin.on("end", () => resolve5(data.replace(/\r?\n$/, "")));
+    process.stdin.resume();
+  });
+}
+function readPassword(promptText) {
+  const stdin = process.stdin;
+  if (!stdin.isTTY) return readLineFromStdin();
+  return new Promise((resolve5, reject) => {
+    process.stderr.write(promptText);
+    let input = "";
+    const wasRaw = stdin.isRaw;
+    stdin.setRawMode?.(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    const cleanup = () => {
+      stdin.setRawMode?.(wasRaw ?? false);
+      stdin.pause();
+      stdin.off("data", onData);
+    };
+    const onData = (ch) => {
+      for (const ct of ch) {
+        if (ct === "\r" || ct === "\n") {
+          cleanup();
+          process.stderr.write("\n");
+          resolve5(input);
+          return;
+        } else if (ct === "") {
+          cleanup();
+          reject(new BizhouError("INVALID_ARG", "\u5DF2\u53D6\u6D88"));
+          return;
+        } else if (ct === "\x7F" || ct === "\b") {
+          input = input.slice(0, -1);
+        } else if (ct >= " ") {
+          input += ct;
+        }
+      }
+    };
+    stdin.on("data", onData);
+  });
+}
+async function resolveMasterPassword(promptText, opts = {}) {
+  if (opts.passwordStdin) return readLineFromStdin();
+  const fromEnv = process.env.BIZHOU_MASTER_PASSWORD;
+  if (fromEnv !== void 0) return fromEnv;
+  return readPassword(promptText);
+}
+
+// src/render.ts
+var useColor = process.stdout.isTTY && !process.env.NO_COLOR;
+function paint(code, s) {
+  return useColor ? `\x1B[${code}m${s}\x1B[0m` : s;
+}
+var c = {
+  green: (s) => paint("32", s),
+  red: (s) => paint("31", s),
+  yellow: (s) => paint("33", s),
+  dim: (s) => paint("2", s),
+  bold: (s) => paint("1", s),
+  cyan: (s) => paint("36", s)
+};
+function info(msg) {
+  process.stderr.write(`${msg}
+`);
+}
+function ok(msg) {
+  process.stderr.write(`${c.green("\u2713 ") + msg}
+`);
+}
+function warn(msg) {
+  process.stderr.write(`${c.yellow("\u26A0 ") + msg}
+`);
+}
+function errorLine(msg) {
+  process.stderr.write(`${c.red("\u2717 ") + msg}
+`);
+}
+function out(msg) {
+  process.stdout.write(`${msg}
+`);
+}
+function formatBytes(n) {
+  const units = ["B", "KB", "MB", "GB", "TB"];
+  let v = n;
+  let i = 0;
+  while (v >= 1024 && i < units.length - 1) {
+    v /= 1024;
+    i++;
+  }
+  return `${i === 0 ? v : v.toFixed(2)} ${units[i]}`;
+}
+function renderProgress(label, done, total) {
+  if (!process.stderr.isTTY) return;
+  const pct = total > 0 ? Math.min(100, Math.floor(done / total * 100)) : 100;
+  const width = 24;
+  const filled = Math.floor(pct / 100 * width);
+  const bar = "\u2588".repeat(filled) + "\u2591".repeat(width - filled);
+  process.stderr.write(
+    `\r${label} ${c.cyan(bar)} ${pct}%  ${formatBytes(done)}/${formatBytes(total)}   `
+  );
+}
+function endProgress() {
+  if (process.stderr.isTTY) process.stderr.write("\n");
+}
+function exitCodeFor(code) {
+  switch (code) {
+    case "INVALID_ARG":
+      return 2;
+    case "AUTH":
+      return 3;
+    case "OAUTH":
+      return 4;
+    case "BAIDU":
+      return 5;
+    case "MANIFEST":
+    case "BUNDLE":
+    case "CHUNK":
+      return 6;
+    case "ACCOUNT":
+    case "VAULT":
+      return 7;
+    default:
+      return 1;
+  }
+}
+
+// src/runtime.ts
+import { existsSync, readFileSync } from "fs";
+import { mkdir as mkdir7, readFile as readFile8, writeFile as writeFile7 } from "fs/promises";
+import { join as join9 } from "path";
+function parseDotenv(text) {
+  const out2 = {};
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq < 0) continue;
+    const key = line.slice(0, eq).trim();
+    let val = line.slice(eq + 1).trim();
+    if (val.startsWith("'") && val.endsWith("'") || val.startsWith('"') && val.endsWith('"')) {
+      val = val.slice(1, -1);
+    }
+    out2[key] = val;
+  }
+  return out2;
+}
+function loadDotenv(cwd = process.cwd()) {
+  const p = join9(cwd, ".env");
+  if (!existsSync(p)) return;
+  const parsed = parseDotenv(readFileSync(p, "utf8"));
+  for (const [k, v] of Object.entries(parsed)) {
+    if (process.env[k] === void 0) process.env[k] = v;
+  }
+}
+var httpAdapter = (url, init) => fetch(url, init);
+function createRuntime() {
+  loadDotenv();
+  const paths = configPaths(process.env, process.platform);
+  const secrets = new FileSecretStore(paths.dir, paths.secrets, paths.deviceKey);
+  const accounts = new AccountManager(secrets);
+  let configFileRoot;
+  let configUploadConcurrency;
+  let configDaemonSweepIntervalMs;
+  let configDaemonDebounceMs;
+  try {
+    const cfg = JSON.parse(readFileSync(paths.config, "utf8"));
+    configFileRoot = cfg.fileRoot;
+    configUploadConcurrency = cfg.uploadConcurrency;
+    configDaemonSweepIntervalMs = cfg.daemonSweepIntervalMs;
+    configDaemonDebounceMs = cfg.daemonDebounceMs;
+  } catch {
+  }
+  const fileRoot = resolveFileRoot(process.env, process.platform, configFileRoot);
+  const uploadConcurrency = Math.min(16, Math.max(1, configUploadConcurrency ?? 4));
+  const daemonSweepIntervalMs = Math.max(5e3, configDaemonSweepIntervalMs ?? 30 * 60 * 1e3);
+  const daemonDebounceMs = Math.max(100, configDaemonDebounceMs ?? 2e3);
+  return {
+    paths,
+    accounts,
+    http: httpAdapter,
+    fileRoot,
+    uploadConcurrency,
+    daemonSweepIntervalMs,
+    daemonDebounceMs,
+    now: () => Date.now(),
+    oauthConfig() {
+      const appKey = process.env.BAIDU_APP_KEY;
+      const secretKey = process.env.BAIDU_SECRET_KEY;
+      if (!appKey || !secretKey) {
+        throw new VaultError(
+          "\u7F3A\u5C11\u767E\u5EA6\u51ED\u8BC1\uFF1A\u8BF7\u5728 .env \u914D\u7F6E BAIDU_APP_KEY \u4E0E BAIDU_SECRET_KEY\uFF08\u89C1 .env.example\uFF09"
+        );
+      }
+      return { appKey, secretKey };
+    },
+    vaultExists: () => existsSync(paths.vault),
+    async loadVault() {
+      if (!existsSync(paths.vault)) {
+        throw new VaultError("\u5C1A\u672A\u521D\u59CB\u5316\uFF1A\u8BF7\u5148\u8FD0\u884C `bz init`");
+      }
+      return JSON.parse(await readFile8(paths.vault, "utf8"));
+    },
+    async saveVault(v) {
+      await mkdir7(paths.dir, { recursive: true });
+      await writeFile7(paths.vault, JSON.stringify(v, null, 2), "utf8");
+    },
+    async resolveMk(opts = {}) {
+      const cached = await accounts.getCachedMk(Date.now());
+      if (cached) return cached;
+      const vault = await this.loadVault();
+      const pw = await resolveMasterPassword("\u4E3B\u5BC6\u7801: ", opts);
+      return unlockWithPassword(vault, pw);
+    }
+  };
+}
+async function baiduClientForCurrent(rt, concurrency) {
+  const cur = await rt.accounts.getCurrent();
+  if (!cur) {
+    throw new VaultError("\u5C1A\u672A\u767B\u5F55\u4EFB\u4F55\u8D26\u53F7\uFF1A\u8BF7\u5148 `bz login`");
+  }
+  let tokens = cur.tokens;
+  const nearExpiry = tokens.expiresAt !== void 0 && Date.now() > tokens.expiresAt - 6e4;
+  if (nearExpiry && tokens.refreshToken) {
+    const r = await refreshAccessToken(rt.oauthConfig(), tokens.refreshToken, rt.http);
+    tokens = {
+      accessToken: r.accessToken,
+      refreshToken: r.refreshToken ?? tokens.refreshToken,
+      expiresAt: Date.now() + r.expiresIn * 1e3,
+      scope: r.scope ?? tokens.scope
+    };
+    await rt.accounts.updateTokens(cur.name, tokens);
+  }
+  return new BaiduClient(rt.oauthConfig(), tokens.accessToken, rt.http, {
+    uploadConcurrency: concurrency ?? rt.uploadConcurrency
+  });
+}
+async function makeBackend(rt, localDir, concurrency) {
+  if (localDir) return new LocalBackend(localDir);
+  return new BaiduBackend(await baiduClientForCurrent(rt, concurrency));
+}
+
+// src/commands.ts
+function parseSize(s) {
+  const m = /^(\d+(?:\.\d+)?)\s*(b|kb|mb|gb|k|m|g)?$/i.exec(s.trim());
+  if (!m) throw new BizhouError("INVALID_ARG", `\u65E0\u6CD5\u89E3\u6790\u5927\u5C0F\uFF1A${s}`);
+  const n = Number.parseFloat(m[1]);
+  const unit = (m[2] ?? "b").toLowerCase();
+  const mult = {
+    b: 1,
+    k: 1024,
+    kb: 1024,
+    m: 1024 ** 2,
+    mb: 1024 ** 2,
+    g: 1024 ** 3,
+    gb: 1024 ** 3
+  };
+  return Math.floor(n * mult[unit]);
+}
+var SHARE_PREFIX = "BZK1-";
+async function cmdInit(rt, opts) {
+  if (rt.vaultExists() && !opts.force) {
+    throw new BizhouError(
+      "VAULT",
+      "\u5DF2\u521D\u59CB\u5316\uFF08vault \u5DF2\u5B58\u5728\uFF09\u3002\u5982\u9700\u91CD\u7F6E\u8BF7\u52A0 --force\uFF08\u4F1A\u4F7F\u65E7\u6570\u636E\u4E0D\u53EF\u89E3\uFF01\uFF09"
+    );
+  }
+  const interactive = process.stdin.isTTY && !opts.passwordStdin && process.env.BIZHOU_MASTER_PASSWORD === void 0;
+  const pw = await resolveMasterPassword("\u8BBE\u7F6E\u4E3B\u5BC6\u7801: ", opts);
+  if (!pw) throw new BizhouError("INVALID_ARG", "\u4E3B\u5BC6\u7801\u4E0D\u80FD\u4E3A\u7A7A");
+  if (interactive) {
+    const pw2 = await readPassword("\u518D\u6B21\u8F93\u5165\u786E\u8BA4: ");
+    if (pw !== pw2) throw new BizhouError("INVALID_ARG", "\u4E24\u6B21\u8F93\u5165\u4E0D\u4E00\u81F4");
+  }
+  const { vault, recoveryKey } = await createVault(pw, { createdAt: (/* @__PURE__ */ new Date()).toISOString() });
+  await rt.saveVault(vault);
+  ok(`\u5DF2\u521D\u59CB\u5316 vault\uFF1A${rt.paths.vault}`);
+  info("");
+  warn("\u4EE5\u4E0B\u662F\u4F60\u7684\u6062\u590D\u5BC6\u94A5\uFF0C\u53EA\u663E\u793A\u8FD9\u4E00\u6B21\uFF0C\u8BF7\u79BB\u7EBF\u59A5\u5584\u4FDD\u7BA1\uFF08\u5FD8\u8BB0\u4E3B\u5BC6\u7801\u65F6\u7528\u5B83\u6062\u590D\uFF09\uFF1A");
+  out(c.bold(recoveryKey));
+  info("");
+  warn("\u4EFB\u4F55\u4EBA\u62FF\u5230\u6062\u590D\u5BC6\u94A5\u5373\u53EF\u89E3\u5F00\u4F60\u7684\u6570\u636E \u2014\u2014 \u5207\u52FF\u4E0A\u4F20\u3001\u622A\u56FE\u6216\u5B58\u5165\u4E91\u7AEF\u3002");
+}
+async function cmdUnlock(rt, opts) {
+  const vault = await rt.loadVault();
+  const pw = await resolveMasterPassword("\u4E3B\u5BC6\u7801: ", opts);
+  const mk = await unlockWithPassword(vault, pw);
+  const ttlSec = opts.ttl ?? Number(process.env.BIZHOU_UNLOCK_TTL ?? 8 * 3600);
+  await rt.accounts.cacheMk(mk, Date.now() + ttlSec * 1e3);
+  ok(`\u5DF2\u89E3\u9501\u672C\u8BBE\u5907\u4F1A\u8BDD\uFF08${Math.round(ttlSec / 3600)} \u5C0F\u65F6\u540E\u81EA\u52A8\u4E0A\u9501\uFF09`);
+}
+async function cmdLock(rt) {
+  await rt.accounts.clearMk();
+  ok("\u5DF2\u4E0A\u9501\uFF08\u6E05\u9664\u7F13\u5B58\u4E3B\u5BC6\u94A5\uFF09");
+}
+async function cmdPasswd(rt, opts) {
+  const vault = await rt.loadVault();
+  const cur = await resolveMasterPassword("\u5F53\u524D\u4E3B\u5BC6\u7801: ", opts);
+  const next = await readPassword("\u65B0\u4E3B\u5BC6\u7801: ");
+  const confirm = await readPassword("\u518D\u6B21\u8F93\u5165\u65B0\u4E3B\u5BC6\u7801: ");
+  if (next !== confirm) throw new BizhouError("INVALID_ARG", "\u4E24\u6B21\u8F93\u5165\u4E0D\u4E00\u81F4");
+  const v2 = await changePassword(vault, cur, next);
+  await rt.saveVault(v2);
+  await rt.accounts.clearMk();
+  ok("\u4E3B\u5BC6\u7801\u5DF2\u66F4\u65B0\uFF08\u6062\u590D\u5BC6\u94A5\u4E0D\u53D8\uFF1B\u5DF2\u4E0A\u9501\uFF0C\u8BF7\u91CD\u65B0 unlock\uFF09");
+}
+async function cmdRecover(rt) {
+  const vault = await rt.loadVault();
+  info("\u7528\u6062\u590D\u5BC6\u94A5\u9A8C\u8BC1\u5E76\u91CD\u8BBE\u4E3B\u5BC6\u7801\u3002");
+  const rk = (await readPassword("\u6062\u590D\u5BC6\u94A5: ")).trim();
+  const mk = await unlockWithRecovery(vault, rk);
+  const next = await readPassword("\u65B0\u4E3B\u5BC6\u7801: ");
+  const confirm = await readPassword("\u518D\u6B21\u8F93\u5165\u65B0\u4E3B\u5BC6\u7801: ");
+  if (next !== confirm) throw new BizhouError("INVALID_ARG", "\u4E24\u6B21\u8F93\u5165\u4E0D\u4E00\u81F4");
+  const salt = generateSalt();
+  const kek = await deriveKey(next, salt, vault.kdf);
+  const v2 = { ...vault, pwSalt: salt.toString("base64"), wrappedMkByPassword: wrapKey(kek, mk) };
+  await rt.saveVault(v2);
+  await rt.accounts.clearMk();
+  ok("\u5DF2\u7528\u6062\u590D\u5BC6\u94A5\u91CD\u8BBE\u4E3B\u5BC6\u7801\u3002");
+}
+async function completeLoginToken(rt, name, token) {
+  await rt.accounts.upsertAccount(name, {
+    accessToken: token.accessToken,
+    refreshToken: token.refreshToken,
+    expiresAt: Date.now() + token.expiresIn * 1e3,
+    scope: token.scope
+  });
+  ok(`\u8D26\u53F7\u300C${name}\u300D\u767B\u5F55\u6210\u529F\u3002`);
+}
+async function cmdLogin(rt, opts) {
+  const config = rt.oauthConfig();
+  const name = opts.name ?? "default";
+  if (opts.device) {
+    const dc = await startDeviceFlow(config, rt.http);
+    info(`\u8BF7\u5728\u6D4F\u89C8\u5668\u6253\u5F00\uFF1A${c.cyan(dc.verificationUrl)}`);
+    info(`\u5E76\u8F93\u5165\u8BBE\u5907\u7801\uFF1A${c.bold(dc.userCode)}`);
+    info("\u7B49\u5F85\u6388\u6743\u4E2D\u2026\uFF08Ctrl-C \u53D6\u6D88\uFF09");
+    const deadline = Date.now() + dc.expiresIn * 1e3;
+    while (Date.now() < deadline) {
+      await new Promise((r) => setTimeout(r, dc.interval * 1e3));
+      const token2 = await pollDeviceToken(config, dc.deviceCode, rt.http);
+      if (token2) {
+        await completeLoginToken(rt, name, token2);
+        return;
+      }
+    }
+    throw new BizhouError("OAUTH", "\u8BBE\u5907\u7801\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u8BD5\u3002");
+  }
+  const port = opts.port ?? 8899;
+  const redirectUri = `http://127.0.0.1:${port}/callback`;
+  const url = buildAuthorizeUrl(config, redirectUri);
+  info(`\u8BF7\u5728\u6D4F\u89C8\u5668\u6253\u5F00\u4EE5\u4E0B\u5730\u5740\u5B8C\u6210\u6388\u6743\uFF1A`);
+  out(url);
+  const code = await waitForCallbackCode(port);
+  const token = await exchangeCodeForToken(config, code, redirectUri, rt.http);
+  await completeLoginToken(rt, name, token);
+}
+function waitForCallbackCode(port) {
+  return new Promise((resolve5, reject) => {
+    const server = createServer((req2, res) => {
+      const u = new URL(req2.url ?? "/", `http://127.0.0.1:${port}`);
+      const code = u.searchParams.get("code");
+      if (code) {
+        res.end("\u655D\u5E1A\uFF1A\u6388\u6743\u6210\u529F\uFF0C\u53EF\u4EE5\u5173\u95ED\u6B64\u9875\u9762\u8FD4\u56DE\u7EC8\u7AEF\u3002");
+        server.close();
+        resolve5(code);
+      } else {
+        res.statusCode = 400;
+        res.end("\u7F3A\u5C11 code");
+      }
+    });
+    server.on("error", reject);
+    server.listen(port, "127.0.0.1");
+  });
+}
+async function cmdLogout(rt) {
+  const cur = await rt.accounts.getCurrent();
+  if (!cur) throw new BizhouError("ACCOUNT", "\u5F53\u524D\u65E0\u767B\u5F55\u8D26\u53F7");
+  await rt.accounts.removeAccount(cur.name);
+  ok(`\u8D26\u53F7\u300C${cur.name}\u300D\u5DF2\u6CE8\u9500\u3002`);
+}
+async function cmdAccount(rt, sub, arg) {
+  if (!sub || sub === "list") {
+    const { names, current } = await rt.accounts.listAccounts();
+    if (names.length === 0) {
+      info("\uFF08\u6682\u65E0\u8D26\u53F7\uFF0C\u5148 `bz login`\uFF09");
+      return;
+    }
+    for (const n of names) out(`${n === current ? c.green("* ") : "  "}${n}`);
+    return;
+  }
+  if (sub === "use") {
+    if (!arg) throw new BizhouError("INVALID_ARG", "\u7528\u6CD5\uFF1Abz account use <name>");
+    await rt.accounts.useAccount(arg);
+    ok(`\u5DF2\u5207\u6362\u5230\u8D26\u53F7\u300C${arg}\u300D`);
+    return;
+  }
+  if (sub === "add") {
+    await cmdLogin(rt, { name: arg });
+    return;
+  }
+  throw new BizhouError("INVALID_ARG", `\u672A\u77E5\u5B50\u547D\u4EE4\uFF1Aaccount ${sub}`);
+}
+var UPLOAD_LOCK_TTL_MS = 30 * 60 * 1e3;
+function pidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM";
+  }
+}
+function resolveUploadConcurrency(rt, flag) {
+  const v = Number.isFinite(flag) ? flag : rt.uploadConcurrency ?? 4;
+  const finite = Number.isFinite(v) ? v : 4;
+  return Math.min(16, Math.max(1, Math.floor(finite)));
+}
+async function findDuplicateBundle(rt, backend, mk, cloudDir, targetContentId) {
+  const { bundles } = await backend.listDir(cloudDir);
+  for (const b of bundles) {
+    let raw = await getCachedManifest(rt.paths.dir, b.id);
+    if (raw === null) {
+      try {
+        raw = await backend.bundleStore(b.id, cloudDir).getManifest();
+      } catch {
+        continue;
+      }
+      await putCachedManifest(rt.paths.dir, b.id, raw);
+    }
+    try {
+      const m = parseManifest(raw);
+      const meta = openMeta(unwrapDek(mk, m.wrappedKey), m.encMeta);
+      if (meta.contentId === targetContentId) return b.id;
+    } catch {
+    }
+  }
+  return null;
+}
+async function pushOneFile(rt, backend, mk, contentKey, absFile, cloudDir, opts) {
+  const st = await stat(absFile);
+  const contentId = await hashPlaintextFile(absFile, contentKey);
+  const jpath = journalPath(rt.paths.dir, "upload", contentId, cloudDir);
+  if (cloudDir !== "/") await backend.mkdir(cloudDir);
+  if (!opts.force) {
+    const dup = await findDuplicateBundle(rt, backend, mk, cloudDir, contentId);
+    if (dup) {
+      warn(`\u76EE\u6807\u5DF2\u6709\u76F8\u540C\u6587\u4EF6\uFF08${c.bold(dup)}\uFF09\uFF0C\u8DF3\u8FC7\uFF1A${absFile}`);
+      return { bundleId: dup, status: "skipped-dup" };
+    }
+  }
+  const optChunkSize = opts.noSplit ? Math.max(st.size, 1) : opts.chunk ? parseSize(opts.chunk) : DEFAULT_CHUNK_SIZE;
+  const optCompression = opts.compress ? "gzip" : "none";
+  const existing = await readJournal(jpath);
+  let bundleId;
+  let skipExisting = [];
+  let status = "uploaded";
+  let dek;
+  let chunkSize;
+  let compression;
+  if (existing) {
+    const alive = isLockAlive(existing, {
+      ttlMs: UPLOAD_LOCK_TTL_MS,
+      now: rt.now(),
+      pidAlive: pidAlive(existing.pid)
+    });
+    if (alive && !opts.force) {
+      warn(`\u540C\u6587\u4EF6\u6B63\u5728\u4E0A\u4F20\u81F3\u8BE5\u76EE\u5F55\uFF0C\u672C\u6B21\u8DF3\u8FC7\uFF1A${absFile}`);
+      return { bundleId: existing.bundleId, status: "locked" };
+    }
+    if (existing.wrappedKey === void 0 || existing.chunkSize === void 0 || existing.compression === void 0) {
+      throw new BizhouError(
+        "INVALID_ARG",
+        `\u4E0A\u4F20\u65E5\u5FD7\u7F3A\u5C11\u5FC5\u8981\u5B57\u6BB5\uFF08wrappedKey/chunkSize/compression\uFF09\uFF0C\u65E0\u6CD5\u7EED\u4F20\uFF1A${jpath}`
+      );
+    }
+    bundleId = existing.bundleId;
+    skipExisting = existing.doneChunks;
+    dek = unwrapDek(mk, existing.wrappedKey);
+    status = "resumed";
+    chunkSize = existing.chunkSize;
+    compression = existing.compression;
+    if (chunkSize !== optChunkSize || compression !== optCompression) {
+      warn("\u7EED\u4F20\uFF1A\u6CBF\u7528\u539F\u5206\u7247\u5927\u5C0F/\u538B\u7F29\u8BBE\u7F6E\uFF0C\u5FFD\u7565\u672C\u6B21\u4E0D\u540C\u7684 --chunk/--no-split/--compress");
+    }
+  } else {
+    bundleId = generateBundleId();
+    dek = generateKey();
+    chunkSize = optChunkSize;
+    compression = optCompression;
+  }
+  const totalChunks = Math.max(1, Math.ceil(st.size / chunkSize));
+  const store = backend.bundleStore(bundleId, cloudDir);
+  await writeJournal(jpath, {
+    bundleId,
+    cloudDir,
+    contentId,
+    doneChunks: skipExisting,
+    totalChunks,
+    chunkSize,
+    // 固定分片大小，续传原样沿用（杜绝确定性 IV 的 nonce 复用）
+    compression,
+    // 固定压缩方式，同上
+    wrappedKey: wrapDek(mk, dek),
+    // MK 包裹的 DEK（非裸密钥），供续传还原同一 DEK
+    startedAt: new Date(rt.now()).toISOString(),
+    pid: process.pid
+  });
+  let preview;
+  if (opts.preview) {
+    let p = null;
+    try {
+      p = await generatePreview(absFile);
+    } catch {
+      p = null;
+    }
+    if (p) {
+      preview = p;
+      info(`\u5DF2\u751F\u6210\u9884\u89C8\u5305\uFF08${p.kind}\uFF0C${formatBytes(p.data.length)}\uFF09`);
+    } else {
+      warn("\u672A\u751F\u6210\u9884\u89C8\uFF08\u975E\u76EE\u6807\u7C7B\u578B\u6216\u6240\u9700\u5916\u90E8\u5DE5\u5177\u4E0D\u53EF\u7528\uFF09\uFF0C\u7EE7\u7EED\u4E0A\u4F20\u539F\u6587\u4EF6\u3002");
+    }
+  }
+  let chain = Promise.resolve();
+  try {
+    await packResource({
+      filePath: absFile,
+      fileSize: st.size,
+      mk,
+      dek,
+      bundleId,
+      createdAt: new Date(rt.now()).toISOString(),
+      chunkSize,
+      compression,
+      store,
+      name: opts.name ?? basename3(absFile),
+      mtime: st.mtime.toISOString(),
+      contentId,
+      preview,
+      skipExisting,
+      onProgress: (e) => {
+        renderProgress("\u52A0\u5BC6", e.bytesDone, e.bytesTotal);
+        chain = chain.then(() => appendDoneChunk(jpath, e.seq));
+      }
+    });
+    await chain;
+  } catch (err) {
+    await chain.catch(() => {
+    });
+    endProgress();
+    throw err;
+  }
+  endProgress();
+  await removeJournal(jpath);
+  return { bundleId, status };
+}
+async function cmdPush(rt, filePath, opts) {
+  const st = await stat(filePath);
+  if (opts.recursive) {
+    if (!st.isDirectory()) throw new BizhouError("INVALID_ARG", `-r \u9700\u8981\u76EE\u5F55\uFF1A${filePath}`);
+    return cmdPushRecursive(rt, filePath, opts);
+  }
+  if (!st.isFile()) throw new BizhouError("INVALID_ARG", `\u4E0D\u662F\u6587\u4EF6\uFF1A${filePath}`);
+  const mk = await rt.resolveMk(opts);
+  const contentKey = deriveContentKey(mk);
+  const cloudDir = opts.to ? normalizeCloudPath(opts.to) : defaultUploadCloudDir(resolve3(filePath), rt.fileRoot);
+  const backend = await makeBackend(rt, opts.local, resolveUploadConcurrency(rt, opts.concurrency));
+  info(`\u52A0\u5BC6\u4E0A\u4F20\uFF1A${filePath}\uFF08${formatBytes(st.size)}\uFF09\u2192 ${cloudDir}`);
+  const r = await pushOneFile(rt, backend, mk, contentKey, resolve3(filePath), cloudDir, opts);
+  if (r.status === "skipped-dup" || r.status === "locked") return r.bundleId;
+  ok(`\u5DF2\u4E0A\u4F20${r.status === "resumed" ? "\uFF08\u7EED\u4F20\uFF09" : ""}\u3002\u8D44\u6E90 ID\uFF1A${c.bold(r.bundleId)}`);
+  out(r.bundleId);
+  return r.bundleId;
+}
+async function walkLocalFiles(absDir) {
+  const result = [];
+  const walk = async (dir) => {
+    const entries = await readdir4(dir, { withFileTypes: true });
+    for (const e of entries) {
+      const p = join10(dir, e.name);
+      if (e.isDirectory()) await walk(p);
+      else if (e.isFile()) result.push(p);
+    }
+  };
+  await walk(absDir);
+  return result;
+}
+async function cmdPushRecursive(rt, dirPath, opts) {
+  const mk = await rt.resolveMk(opts);
+  const contentKey = deriveContentKey(mk);
+  const absDir = resolve3(dirPath);
+  const baseCloud = opts.to ? normalizeCloudPath(opts.to) : defaultUploadCloudDir(absDir + sep, rt.fileRoot);
+  const rootCloud = joinCloudPath(baseCloud, basename3(absDir));
+  const backend = await makeBackend(rt, opts.local, resolveUploadConcurrency(rt, opts.concurrency));
+  if (rootCloud !== "/") await backend.mkdir(rootCloud);
+  const files = await walkLocalFiles(absDir);
+  if (files.length === 0) {
+    info(`\uFF08\u7A7A\u76EE\u5F55\uFF0C\u65E0\u6587\u4EF6\u53EF\u4E0A\u4F20\uFF09\uFF1A${absDir}`);
+    return rootCloud;
+  }
+  let uploaded = 0;
+  let skipped = 0;
+  for (const abs of files) {
+    const rel = relative2(absDir, abs);
+    const relDir = dirname4(rel);
+    const cloudDir = relDir === "." ? rootCloud : joinCloudPath(rootCloud, relDir);
+    info(`\u52A0\u5BC6\u4E0A\u4F20\uFF1A${abs} \u2192 ${cloudDir}/${basename3(abs)}`);
+    const r = await pushOneFile(rt, backend, mk, contentKey, abs, cloudDir, opts);
+    if (r.status === "skipped-dup") skipped++;
+    else if (r.status === "locked") {
+    } else uploaded++;
+    if (r.status === "uploaded" || r.status === "resumed") ok(`\u5DF2\u4E0A\u4F20\uFF1A${rel} \u2192 ${r.bundleId}`);
+  }
+  ok(
+    `\u6574\u6811\u5B8C\u6210\uFF1A\u4E0A\u4F20 ${uploaded}\uFF0C\u8DF3\u8FC7\uFF08\u5DF2\u5B58\u5728\uFF09${skipped}\uFF0C\u5171 ${files.length} \u4E2A\u6587\u4EF6 \u2192 ${rootCloud}`
+  );
+  return rootCloud;
+}
+var DOWNLOAD_LOCK_TTL_MS = 30 * 60 * 1e3;
+function downloadJournalKey(contentId, bundleId) {
+  return contentId && contentId.length > 0 ? contentId : bundleId;
+}
+async function fileExists(p) {
+  try {
+    await stat(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function pullOneBundle(rt, backend, mk, contentKey, fullId, dir, outPath, opts) {
+  const store = backend.bundleStore(fullId, dir);
+  const { manifest, meta } = await readResourceMeta(mk, store);
+  const cid = meta.contentId;
+  const jkey = downloadJournalKey(cid, fullId);
+  const jpath = journalPath(rt.paths.dir, "download", jkey, outPath);
+  const partPath = `${outPath}.part`;
+  if (!opts.force && cid && await fileExists(outPath)) {
+    if (await hashPlaintextFile(outPath, contentKey) === cid) {
+      warn(`\u76EE\u6807\u5DF2\u6709\u76F8\u540C\u6587\u4EF6\uFF0C\u8DF3\u8FC7\uFF1A${outPath}`);
+      return { status: "skipped-dup", bytesWritten: 0 };
+    }
+  }
+  const existing = await readJournal(jpath);
+  let skip = [];
+  let status = "restored";
+  if (existing) {
+    const alive = isLockAlive(existing, {
+      ttlMs: DOWNLOAD_LOCK_TTL_MS,
+      now: rt.now(),
+      pidAlive: pidAlive(existing.pid)
+    });
+    if (alive && !opts.force) {
+      warn(`\u540C\u6587\u4EF6\u6B63\u5728\u4E0B\u8F7D\uFF0C\u672C\u6B21\u8DF3\u8FC7\uFF1A${outPath}`);
+      return { status: "locked", bytesWritten: 0 };
+    }
+    if (await fileExists(partPath)) {
+      skip = existing.doneChunks;
+      status = "resumed";
+    }
+  }
+  await mkdir8(dirname4(outPath), { recursive: true });
+  await writeJournal(jpath, {
+    bundleId: fullId,
+    cloudDir: dir,
+    contentId: cid ?? "",
+    doneChunks: skip,
+    totalChunks: manifest.chunks.length,
+    startedAt: new Date(rt.now()).toISOString(),
+    pid: process.pid
+  });
+  let chain = Promise.resolve();
+  let bytesWritten = 0;
+  try {
+    const res = await unpackResource({
+      mk,
+      store,
+      outPath: partPath,
+      skip,
+      onProgress: (e) => {
+        renderProgress("\u89E3\u5BC6", e.bytesDone, e.bytesTotal);
+        chain = chain.then(() => appendDoneChunk(jpath, e.seq));
+      }
+    });
+    bytesWritten = res.bytesWritten;
+    await chain;
+  } catch (err) {
+    endProgress();
+    await chain.catch(() => {
+    });
+    throw err;
+  }
+  endProgress();
+  if (cid) {
+    const got = await hashPlaintextFile(partPath, contentKey);
+    if (got !== cid) {
+      throw new BizhouError(
+        "CHUNK",
+        `\u4E0B\u8F7D\u6587\u4EF6 contentId \u6821\u9A8C\u5931\u8D25\uFF08\u6570\u636E\u4E0D\u5B8C\u6574\u6216\u635F\u574F\uFF09\uFF0C\u672A\u4EA4\u4ED8\uFF1A${outPath}`
+      );
+    }
+  }
+  await rename5(partPath, outPath);
+  await removeJournal(jpath);
+  return { status, bytesWritten };
+}
+async function cmdPull(rt, id, opts) {
+  const mk = await rt.resolveMk(opts);
+  const backend = await makeBackend(rt, opts.local);
+  if (opts.recursive) {
+    const startDir = normalizeCloudPath(id);
+    const bundles = await walkBundlesUnder(backend, startDir);
+    if (bundles.length === 0) {
+      info(`\uFF08\u7A7A\uFF09\u4E91\u7AEF\u76EE\u5F55\u4E0B\u65E0\u8D44\u6E90\uFF1A${startDir}`);
+      return;
+    }
+    const contentKey2 = deriveContentKey(mk);
+    let restored = 0;
+    let skipped = 0;
+    for (const b of bundles) {
+      const { meta: meta2 } = await readResourceMeta(mk, backend.bundleStore(b.id, b.dir));
+      const outPath2 = downloadLocalPath(rt.fileRoot, b.dir, meta2.name);
+      info(`\u4E0B\u8F7D\u8FD8\u539F\uFF1A${b.id} \u2192 ${outPath2}\uFF08${formatBytes(meta2.size)}\uFF09`);
+      const r2 = await pullOneBundle(rt, backend, mk, contentKey2, b.id, b.dir, outPath2, opts);
+      if (r2.status === "skipped-dup") skipped++;
+      else if (r2.status === "locked") {
+      } else {
+        restored++;
+        ok(
+          `\u5DF2\u8FD8\u539F${r2.status === "resumed" ? "\uFF08\u7EED\u4F20\uFF09" : ""} ${formatBytes(r2.bytesWritten)} \u2192 ${outPath2}`
+        );
+      }
+    }
+    ok(
+      `\u6574\u6811\u8FD8\u539F\u5B8C\u6210\uFF1A\u8FD8\u539F ${restored}\uFF0C\u8DF3\u8FC7\uFF08\u5DF2\u5B58\u5728\uFF09${skipped}\uFF0C\u5171 ${bundles.length} \u4E2A \u2192 ${rt.fileRoot}`
+    );
+    return;
+  }
+  const { id: fullId, dir } = await resolveBundle(rt, id, opts.local);
+  const { meta } = await readResourceMeta(mk, backend.bundleStore(fullId, dir));
+  const outPath = downloadLocalPath(rt.fileRoot, opts.out ?? dir, meta.name);
+  const contentKey = deriveContentKey(mk);
+  info(`\u4E0B\u8F7D\u8FD8\u539F\uFF1A${fullId} \u2192 ${outPath}\uFF08${formatBytes(meta.size)}\uFF09`);
+  const r = await pullOneBundle(rt, backend, mk, contentKey, fullId, dir, outPath, opts);
+  if (r.status === "skipped-dup" || r.status === "locked") return;
+  ok(
+    `\u5DF2\u8FD8\u539F${r.status === "resumed" ? "\uFF08\u7EED\u4F20\uFF09" : ""} ${formatBytes(r.bytesWritten)} \u2192 ${outPath}`
+  );
+}
+async function walkBundlesUnder(backend, startDir) {
+  const result = [];
+  const walk = async (dir) => {
+    const listing = await backend.listDir(dir);
+    result.push(...listing.bundles);
+    for (const d of listing.dirs) {
+      await walk(dir === "/" ? `/${d}` : `${dir}/${d}`);
+    }
+  };
+  await walk(startDir);
+  return result;
+}
+async function listBundles(rt, local, backend) {
+  const b = backend ?? await makeBackend(rt, local);
+  return walkBundlesUnder(b, "/");
+}
+async function resolveBundle(rt, idOrPrefix, local, backend) {
+  const bundles = await listBundles(rt, local, backend);
+  if (/^[0-9a-f]{32}$/.test(idOrPrefix)) {
+    const found = bundles.find((b) => b.id === idOrPrefix);
+    if (!found) throw new BizhouError("INVALID_ARG", `\u627E\u4E0D\u5230\u8D44\u6E90\uFF1A${idOrPrefix}`);
+    return found;
+  }
+  const matches = bundles.filter((b) => b.id.startsWith(idOrPrefix.toLowerCase()));
+  if (matches.length === 0) throw new BizhouError("INVALID_ARG", `\u627E\u4E0D\u5230\u8D44\u6E90\uFF1A${idOrPrefix}`);
+  if (matches.length > 1) {
+    throw new BizhouError(
+      "INVALID_ARG",
+      `ID \u524D\u7F00 ${idOrPrefix} \u4E0D\u552F\u4E00\uFF08\u5339\u914D ${matches.length} \u4E2A\uFF09\uFF0C\u8BF7\u7ED9\u66F4\u957F\u524D\u7F00`
+    );
+  }
+  return matches[0];
+}
+async function resolveBundleOrNull(rt, idOrPrefix, local, backend) {
+  const bundles = await listBundles(rt, local, backend);
+  const full = /^[0-9a-f]{32}$/.test(idOrPrefix) ? bundles.filter((b) => b.id === idOrPrefix) : bundles.filter((b) => b.id.startsWith(idOrPrefix.toLowerCase()));
+  if (full.length === 0) return null;
+  if (full.length > 1) {
+    throw new BizhouError(
+      "INVALID_ARG",
+      `ID \u524D\u7F00 ${idOrPrefix} \u4E0D\u552F\u4E00\uFF08\u5339\u914D ${full.length} \u4E2A\uFF09\uFF0C\u8BF7\u7ED9\u66F4\u957F\u524D\u7F00`
+    );
+  }
+  return full[0];
+}
+async function cmdMkdir(rt, cloudDir, opts) {
+  const backend = await makeBackend(rt, opts.local);
+  await backend.mkdir(normalizeCloudPath(cloudDir));
+  ok(`\u5DF2\u521B\u5EFA\u76EE\u5F55 ${normalizeCloudPath(cloudDir)}`);
+}
+async function cmdLs(rt, cloudDir, opts) {
+  const mk = await rt.resolveMk(opts);
+  const backend = await makeBackend(rt, opts.local);
+  const start = normalizeCloudPath(cloudDir ?? "/");
+  let printedAny = false;
+  const walk = async (dir, depth) => {
+    const listing = await backend.listDir(dir);
+    for (const d of listing.dirs.sort()) {
+      printedAny = true;
+      out(`${"  ".repeat(depth)}${c.cyan(`${d}/`)}`);
+      if (opts.recursive) await walk(dir === "/" ? `/${d}` : `${dir}/${d}`, depth + 1);
+    }
+    for (const b of listing.bundles) {
+      printedAny = true;
+      try {
+        const store = backend.bundleStore(b.id, dir);
+        const { meta } = await readResourceMeta(mk, store);
+        out(
+          `${"  ".repeat(depth)}${c.dim(b.id.slice(0, 12))}  ${formatBytes(meta.size).padStart(10)}  ${meta.name}`
+        );
+      } catch {
+        out(`${"  ".repeat(depth)}${c.dim(b.id.slice(0, 12))}  ${c.yellow("(\u65E0\u6CD5\u8BFB\u53D6)")}`);
+      }
+    }
+  };
+  await walk(start, 0);
+  if (!printedAny) info("\uFF08\u7A7A\uFF09");
+}
+async function cmdInfo(rt, id, opts) {
+  const mk = await rt.resolveMk(opts);
+  const { id: fullId, dir } = await resolveBundle(rt, id, opts.local);
+  const backend = await makeBackend(rt, opts.local);
+  const store = backend.bundleStore(fullId, dir);
+  const { manifest, meta } = await readResourceMeta(mk, store);
+  out(`\u8D44\u6E90 ID   : ${manifest.bundleId}`);
+  out(`\u539F\u6587\u4EF6\u540D  : ${meta.name}`);
+  out(`\u5927\u5C0F      : ${formatBytes(meta.size)}`);
+  out(`\u521B\u5EFA\u65F6\u95F4  : ${manifest.createdAt}`);
+  out(`\u52A0\u5BC6\u7B97\u6CD5  : ${manifest.cipher}`);
+  out(`\u538B\u7F29      : ${manifest.compression}`);
+  out(`\u5206\u7247      : ${manifest.chunks.length} \u7247 \xD7 ${formatBytes(manifest.chunkSize)}`);
+  if (meta.mtime) out(`\u539F\u4FEE\u6539\u65F6\u95F4: ${meta.mtime}`);
+}
+async function cmdRm(rt, src, opts) {
+  const backend = await makeBackend(rt, opts.local);
+  const b = await resolveBundleOrNull(rt, src, opts.local, backend);
+  const isBundle = b !== null;
+  const path = b ? joinCloudPath(b.dir, bundleDirName(b.id)) : normalizeCloudPath(src);
+  if (!isBundle && !opts.yes) {
+    throw new BizhouError("INVALID_ARG", `\u5220\u9664\u76EE\u5F55 ${path} \u53CA\u5176\u5185\u5BB9\u5C06\u8FDB\u56DE\u6536\u7AD9\uFF0C\u8BF7\u52A0 --yes \u786E\u8BA4`);
+  }
+  await backend.trashPath(path, (/* @__PURE__ */ new Date()).toISOString());
+  if (isBundle) await invalidateManifest(rt.paths.dir, b.id);
+  ok(`\u5DF2\u5220\u9664\u5230\u56DE\u6536\u7AD9\uFF1A${isBundle ? b.id : path}`);
+}
+async function cmdTrash(rt, sub, arg, opts) {
+  const backend = await makeBackend(rt, opts.local);
+  if (!sub || sub === "list") {
+    const entries = await backend.listTrash();
+    if (entries.length === 0) {
+      info("\uFF08\u56DE\u6536\u7AD9\u4E3A\u7A7A\uFF09");
+      return;
+    }
+    for (const e of entries) {
+      out(`${e.entryId}  ${e.name}  ${e.originalPath}  ${e.deletedAt}`);
+    }
+    return;
+  }
+  if (sub === "restore") {
+    if (!arg) throw new BizhouError("INVALID_ARG", "\u7528\u6CD5\uFF1Abz trash restore <entryId>");
+    await backend.restoreTrash(arg);
+    ok(`\u5DF2\u4ECE\u56DE\u6536\u7AD9\u6062\u590D\uFF1A${arg}`);
+    return;
+  }
+  if (sub === "rm") {
+    if (!arg) throw new BizhouError("INVALID_ARG", "\u7528\u6CD5\uFF1Abz trash rm <entryId>");
+    const entries = await backend.listTrash();
+    const entry = entries.find((e) => e.entryId === arg);
+    await backend.deleteTrash(arg);
+    if (entry?.name.endsWith(BUNDLE_SUFFIX)) {
+      await invalidateManifest(rt.paths.dir, entry.name.slice(0, -BUNDLE_SUFFIX.length));
+    }
+    ok(`\u5DF2\u4ECE\u56DE\u6536\u7AD9\u6C38\u4E45\u5220\u9664\uFF1A${arg}`);
+    return;
+  }
+  if (sub === "clear") {
+    await backend.clearTrash();
+    await rm6(join10(rt.paths.dir, ".cache", "manifests"), { recursive: true, force: true });
+    ok("\u56DE\u6536\u7AD9\u5DF2\u6E05\u7A7A");
+    return;
+  }
+  throw new BizhouError("INVALID_ARG", `\u672A\u77E5\u5B50\u547D\u4EE4\uFF1Atrash ${sub}`);
+}
+async function cmdMv(rt, src, dstDir, opts) {
+  const backend = await makeBackend(rt, opts.local);
+  const b = await resolveBundleOrNull(rt, src, opts.local, backend);
+  const srcPath = b ? joinCloudPath(b.dir, bundleDirName(b.id)) : normalizeCloudPath(src);
+  const dst = normalizeCloudPath(dstDir);
+  await backend.mkdir(dst);
+  await backend.move(srcPath, dst);
+  ok(`\u5DF2\u79FB\u52A8 ${srcPath} \u2192 ${dst}`);
+}
+async function cmdCp(rt, src, dstDir, opts) {
+  const backend = await makeBackend(rt, opts.local);
+  const b = await resolveBundleOrNull(rt, src, opts.local, backend);
+  const isBundle = b !== null;
+  const srcPath = b ? joinCloudPath(b.dir, bundleDirName(b.id)) : normalizeCloudPath(src);
+  if (!isBundle && !opts.recursive) {
+    throw new BizhouError("INVALID_ARG", "\u590D\u5236\u76EE\u5F55\u9700 -r");
+  }
+  const dst = normalizeCloudPath(dstDir);
+  await backend.mkdir(dst);
+  await backend.copy(srcPath, dst);
+  ok(`\u5DF2\u590D\u5236 ${srcPath} \u2192 ${dst}`);
+}
+async function cmdRename(rt, src, newName, opts) {
+  const backend = await makeBackend(rt, opts.local);
+  const b = await resolveBundleOrNull(rt, src, opts.local, backend);
+  if (b) {
+    const mk = await rt.resolveMk(opts);
+    const bundleStore = backend.bundleStore(b.id, b.dir);
+    await renameResource(mk, bundleStore, newName);
+    await invalidateManifest(rt.paths.dir, b.id);
+    ok(`\u5DF2\u6539\u540D ${b.id} \u2192 ${newName}`);
+    return;
+  }
+  const srcPath = normalizeCloudPath(src);
+  await backend.rename(srcPath, newName);
+  ok(`\u5DF2\u6539\u540D ${srcPath} \u2192 ${newName}`);
+}
+async function cmdShare(rt, id, opts) {
+  if (opts.sevenz) {
+    return cmdShare7z(rt, id, opts);
+  }
+  const mk = await rt.resolveMk(opts);
+  const { id: fullId, dir } = await resolveBundle(rt, id, opts.local);
+  const backend = await makeBackend(rt, opts.local);
+  const store = backend.bundleStore(fullId, dir);
+  const manifest = parseManifest(await store.getManifest());
+  const dek = unwrapDek(mk, manifest.wrappedKey);
+  const shareCode = SHARE_PREFIX + groupBase32(base32Encode(dek));
+  info("\u5206\u4EAB\u7801\uFF08\u8FDE\u540C\u4E91\u7AEF\u6587\u4EF6\u5939\u94FE\u63A5\u4EA4\u7ED9\u5BF9\u65B9\uFF1B\u5BF9\u65B9\u7528\u655D\u5E1A + \u5206\u4EAB\u7801\u89E3\u5BC6\u8BE5\u8D44\u6E90\uFF09\uFF1A");
+  out(c.bold(shareCode));
+  warn("\u5206\u4EAB\u7801\u7B49\u540C\u4E8E\u8BE5\u8D44\u6E90\u7684\u89E3\u5BC6\u94A5\u5319\uFF0C\u8BF7\u901A\u8FC7\u5B89\u5168\u6E20\u9053\u4F20\u9012\u3002");
+}
+async function cmdShare7z(rt, id, opts) {
+  const bin = await findSevenZip();
+  if (!bin) {
+    throw new BizhouError(
+      "INVALID_ARG",
+      "\u672A\u627E\u5230 7z \u53EF\u6267\u884C\u6587\u4EF6\uFF1A\u8BF7\u5B89\u88C5 p7zip\uFF08brew install p7zip / apt install p7zip-full\uFF09\u6216\u8BBE\u7F6E BIZHOU_7Z_BIN"
+    );
+  }
+  const mk = await rt.resolveMk(opts);
+  const { id: fullId, dir } = await resolveBundle(rt, id, opts.local);
+  const backend = await makeBackend(rt, opts.local);
+  const store = backend.bundleStore(fullId, dir);
+  const { meta } = await readResourceMeta(mk, store);
+  const work = await mkdtemp2(join10(tmpdir2(), "bizhou-7z-"));
+  try {
+    const restored = join10(work, meta.name);
+    await unpackResource({ mk, store, outPath: restored });
+    const outArchive = join10(opts.out ?? ".", `${meta.name}.7z`);
+    await mkdir8(dirname4(outArchive), { recursive: true });
+    const pw = process.env.BIZHOU_SHARE_PASSWORD ?? await readPassword("\u4E3A 7z \u5305\u8BBE\u7F6E\u5BC6\u7801: ");
+    if (!pw) throw new BizhouError("INVALID_ARG", "7z \u5BC6\u7801\u4E0D\u80FD\u4E3A\u7A7A");
+    await sevenZipArchive(bin, outArchive, [restored], pw);
+    ok(`\u5DF2\u5BFC\u51FA\u5934\u90E8\u52A0\u5BC6 7z\uFF1A${outArchive}\uFF08\u5BF9\u65B9\u7528 7-Zip/Keka/p7zip + \u5BC6\u7801\u89E3\u5F00\uFF09`);
+  } finally {
+    await rm6(work, { recursive: true, force: true });
+  }
+}
+async function cmdPreview(rt, id, opts) {
+  const mk = await rt.resolveMk(opts);
+  const { id: fullId, dir } = await resolveBundle(rt, id, opts.local);
+  const backend = await makeBackend(rt, opts.local);
+  const store = backend.bundleStore(fullId, dir);
+  const { kind, data } = await openPreview(mk, store);
+  if (kind === "text") {
+    out(data.toString("utf8"));
+    return;
+  }
+  const ext = kind === "audio" ? "mp3" : "jpg";
+  const outPath = join10(opts.out ?? ".", `${fullId.slice(0, 12)}-preview.${ext}`);
+  await mkdir8(dirname4(outPath), { recursive: true });
+  await writeFile8(outPath, data);
+  ok(`\u9884\u89C8\uFF08${kind}\uFF0C${formatBytes(data.length)}\uFF09\u5DF2\u4FDD\u5B58\uFF1A${outPath}`);
+}
+
+// src/completion.ts
+var F = (name, takesValue = false, valueArg) => ({
+  name,
+  takesValue,
+  ...valueArg ? { valueArg } : {}
+});
+var GLOBAL_FLAGS = [
+  F("--help"),
+  F("--version"),
+  F("--local", true, { kind: "dir" }),
+  F("--password-stdin")
+];
+var FILE = { kind: "file" };
+var DIR = { kind: "dir" };
+var CLOUD_ID = { kind: "cloud", ctx: "bundle-id" };
+var CLOUD_DIR = { kind: "cloud", ctx: "cloud-dir" };
+var COMMANDS = [
+  { name: "init", flags: [F("--force")], args: [] },
+  { name: "unlock", flags: [F("--ttl", true)], args: [] },
+  { name: "lock", flags: [], args: [] },
+  { name: "passwd", flags: [], args: [] },
+  { name: "recover", flags: [], args: [] },
+  {
+    name: "login",
+    flags: [F("--name", true), F("--device"), F("--port", true)],
+    args: []
+  },
+  { name: "logout", flags: [], args: [] },
+  {
+    name: "account",
+    flags: [],
+    args: [{ kind: "subcommand", names: ["list", "use", "add"] }],
+    subArgs: { use: [{ kind: "dynamic", ctx: "account" }], add: [{ kind: "none" }], list: [] }
+  },
+  {
+    name: "push",
+    flags: [
+      F("--to", true),
+      F("--chunk", true),
+      F("--compress"),
+      F("--no-split"),
+      F("--name", true),
+      F("--preview"),
+      F("--force"),
+      F("--concurrency", true),
+      F("--recursive")
+    ],
+    args: [FILE]
+  },
+  {
+    name: "pull",
+    flags: [F("--out", true, DIR), F("--recursive"), F("--force")],
+    args: [CLOUD_ID]
+  },
+  { name: "mkdir", flags: [], args: [CLOUD_DIR] },
+  { name: "ls", flags: [F("--recursive")], args: [CLOUD_DIR] },
+  { name: "info", flags: [], args: [CLOUD_ID] },
+  { name: "rm", flags: [F("--yes")], args: [CLOUD_ID] },
+  {
+    name: "trash",
+    flags: [],
+    args: [{ kind: "subcommand", names: ["list", "restore", "rm", "clear"] }],
+    // restore/rm 的回收站条目 id 需后端（本轮不补，走 none）
+    subArgs: { restore: [{ kind: "none" }], rm: [{ kind: "none" }], list: [], clear: [] }
+  },
+  { name: "mv", flags: [], args: [CLOUD_ID, CLOUD_DIR] },
+  { name: "cp", flags: [F("--recursive")], args: [CLOUD_ID, CLOUD_DIR] },
+  { name: "rename", flags: [], args: [CLOUD_ID, { kind: "none" }] },
+  {
+    name: "share",
+    // 注：cmdShare 当前只读 --code/--7z/--out（不含 --ttl）；补全须贴合实际，避免提示无效 flag。
+    flags: [F("--code"), F("--7z"), F("--out", true, DIR)],
+    args: [CLOUD_ID]
+  },
+  { name: "preview", flags: [F("--out", true, DIR)], args: [CLOUD_ID] },
+  {
+    name: "backup",
+    flags: [F("--to", true)],
+    args: [{ kind: "subcommand", names: ["add", "list", "rm", "run"] }],
+    subArgs: {
+      add: [DIR],
+      list: [],
+      rm: [{ kind: "dynamic", ctx: "backup-id" }],
+      run: [{ kind: "dynamic", ctx: "backup-id" }]
+    }
+  },
+  { name: "daemon", flags: [], args: [] },
+  { name: "completion", flags: [], args: [{ kind: "dynamic", ctx: "shell" }] }
+];
+function allCommandNames() {
+  return COMMANDS.map((c2) => c2.name).join(" ");
+}
+function flagsFor(name) {
+  const c2 = COMMANDS.find((x) => x.name === name);
+  const flags = [...c2?.flags ?? [], ...GLOBAL_FLAGS].map((f) => f.name);
+  return [...new Set(flags)].join(" ");
+}
+function subNamesFor(name) {
+  const a = COMMANDS.find((x) => x.name === name)?.args[0];
+  return a?.kind === "subcommand" ? a.names.join(" ") : void 0;
+}
+function subNameList(name) {
+  const a = COMMANDS.find((x) => x.name === name)?.args[0];
+  return a?.kind === "subcommand" ? a.names : [];
+}
+function dynamicCtxFor(cmd, sub) {
+  const c2 = COMMANDS.find((x) => x.name === cmd);
+  if (!c2) return void 0;
+  const arg = sub ? c2.subArgs?.[sub]?.[0] : c2.args[0];
+  if (!arg) return void 0;
+  if (arg.kind === "dynamic") return { kind: "dynamic", ctx: arg.ctx };
+  if (arg.kind === "file") return { kind: "file" };
+  if (arg.kind === "dir") return { kind: "dir" };
+  return void 0;
+}
+function genBash() {
+  const cmds = allCommandNames();
+  const perCmd = COMMANDS.map((c2) => {
+    const subs = subNamesFor(c2.name);
+    const dyn = dynamicCtxFor(c2.name);
+    const lines = [];
+    if (subs) {
+      lines.push(
+        `      if [ "$cword" -eq 2 ]; then COMPREPLY=( $(compgen -W "${subs} ${flagsFor(c2.name)}" -- "$cur") ); return; fi`
+      );
+      for (const sub of subNameList(c2.name)) {
+        const d = dynamicCtxFor(c2.name, sub);
+        if (d?.kind === "dynamic")
+          lines.push(
+            `      if [ "\${words[2]}" = "${sub}" ]; then COMPREPLY=( $(compgen -W "$(bz __complete ${d.ctx} "$cur")" -- "$cur") ); return; fi`
+          );
+        else if (d?.kind === "dir")
+          lines.push(`      if [ "\${words[2]}" = "${sub}" ]; then _filedir -d; return; fi`);
+        else if (d?.kind === "file")
+          lines.push(`      if [ "\${words[2]}" = "${sub}" ]; then _filedir; return; fi`);
+      }
+    } else if (dyn?.kind === "dynamic") {
+      lines.push(
+        `      COMPREPLY=( $(compgen -W "$(bz __complete ${dyn.ctx} "$cur")" -- "$cur") ); return;`
+      );
+    } else if (dyn?.kind === "file") {
+      lines.push(`      _filedir; return;`);
+    } else if (dyn?.kind === "dir") {
+      lines.push(`      _filedir -d; return;`);
+    }
+    lines.push(`      COMPREPLY=( $(compgen -W "${flagsFor(c2.name)}" -- "$cur") ); return;`);
+    return `    ${c2.name})
+${lines.join("\n")}
+      ;;`;
+  }).join("\n");
+  return `# bash completion for bz \u2014\u2014 \u5B89\u88C5\uFF1Aeval "$(bz completion bash)"\uFF08\u5199\u5165 ~/.bashrc\uFF09
+_bz() {
+  local cur cword words
+  _get_comp_words_by_ref -n : cur words cword 2>/dev/null || { cur="\${COMP_WORDS[COMP_CWORD]}"; words=("\${COMP_WORDS[@]}"); cword=$COMP_CWORD; }
+  if [ "$cword" -eq 1 ]; then
+    COMPREPLY=( $(compgen -W "${cmds}" -- "$cur") ); return
+  fi
+  case "\${words[1]}" in
+${perCmd}
+  esac
+}
+complete -F _bz bz
+`;
+}
+function genZsh() {
+  const cmds = allCommandNames();
+  const perCmd = COMMANDS.map((c2) => {
+    const subs = subNamesFor(c2.name);
+    const dyn = dynamicCtxFor(c2.name);
+    const body = [];
+    if (subs) {
+      body.push(`      if (( CURRENT == 3 )); then compadd ${subs}; return; fi`);
+      for (const sub of subNameList(c2.name)) {
+        const d = dynamicCtxFor(c2.name, sub);
+        if (d?.kind === "dynamic")
+          body.push(
+            `      [[ "\${words[3]}" == "${sub}" ]] && { compadd \${(f)"$(bz __complete ${d.ctx})"}; return; }`
+          );
+        else if (d?.kind === "dir")
+          body.push(`      [[ "\${words[3]}" == "${sub}" ]] && { _files -/; return; }`);
+        else if (d?.kind === "file")
+          body.push(`      [[ "\${words[3]}" == "${sub}" ]] && { _files; return; }`);
+      }
+    } else if (dyn?.kind === "dynamic") {
+      body.push(`      compadd \${(f)"$(bz __complete ${dyn.ctx})"}; return;`);
+    } else if (dyn?.kind === "file") {
+      body.push(`      _files; return;`);
+    } else if (dyn?.kind === "dir") {
+      body.push(`      _files -/; return;`);
+    }
+    body.push(`      compadd ${flagsFor(c2.name)};`);
+    return `    ${c2.name})
+${body.join("\n")}
+      ;;`;
+  }).join("\n");
+  return `#compdef bz
+# zsh completion for bz \u2014\u2014 \u5B89\u88C5\uFF1Abz completion zsh > "\${fpath[1]}/_bz"\uFF08\u6216 eval\uFF09
+_bz() {
+  # $words/$CURRENT \u7531 zsh \u8865\u5168 widget \u63D0\u4F9B\uFF081-\u7D22\u5F15\uFF1Awords[1]=bz words[2]=command\uFF09
+  # \u5207\u52FF local -a words \u91CD\u58F0\u660E\u2014\u2014\u4F1A\u5148\u63A9\u853D\u518D\u8D4B\u503C\u6210\u7A7A\u6570\u7EC4\uFF0C\u4EE4\u4E0B\u65B9 case \u5168\u90E8\u843D\u7A7A\u3002
+  if (( CURRENT == 2 )); then
+    compadd ${cmds}; return
+  fi
+  case "\${words[2]}" in
+${perCmd}
+  esac
+}
+compdef _bz bz
+`;
+}
+function psArgKindOf(arg) {
+  if (!arg) return void 0;
+  if (arg.kind === "file") return "file";
+  if (arg.kind === "dir") return "dir";
+  if (arg.kind === "dynamic") return "dynamic";
+  return void 0;
+}
+function genPowerShell() {
+  const cmds = COMMANDS.map((c2) => `'${c2.name}'`).join(", ");
+  const table = COMMANDS.map((c2) => {
+    const flagsArr = flagsFor(c2.name).split(" ").filter(Boolean).map((f) => `'${f}'`).join(", ");
+    const parts = [`flags = @(${flagsArr})`];
+    const subs = subNamesFor(c2.name);
+    if (subs) {
+      parts.push(
+        `subs = @(${subs.split(" ").map((s) => `'${s}'`).join(", ")})`
+      );
+      const subKindEntries = [];
+      const subCtxEntries = [];
+      for (const sub of subNameList(c2.name)) {
+        const arg = c2.subArgs?.[sub]?.[0];
+        const k = psArgKindOf(arg);
+        if (k) subKindEntries.push(`'${sub}'='${k}'`);
+        if (k === "dynamic" && arg?.kind === "dynamic") subCtxEntries.push(`'${sub}'='${arg.ctx}'`);
+      }
+      if (subKindEntries.length) parts.push(`subKind = @{${subKindEntries.join("; ")}}`);
+      if (subCtxEntries.length) parts.push(`subCtx = @{${subCtxEntries.join("; ")}}`);
+    } else {
+      const arg = c2.args[0];
+      const k = psArgKindOf(arg);
+      if (k) parts.push(`argKind = '${k}'`);
+      if (k === "dynamic" && arg?.kind === "dynamic") parts.push(`ctx = '${arg.ctx}'`);
+    }
+    return `    '${c2.name}' = @{ ${parts.join("; ")} }`;
+  }).join("\n");
+  return `# PowerShell completion for bz \u2014\u2014 \u5B89\u88C5\uFF1Abz completion powershell | Out-String | Invoke-Expression\uFF08\u5199\u5165 $PROFILE\uFF09
+# \u6CE8\uFF1ARegister-ArgumentCompleter -Native \u4F1A\u6291\u5236 PowerShell \u9ED8\u8BA4\u7684\u8DEF\u5F84\u8865\u5168\uFF0C
+# \u56E0\u6B64 file/dir \u4F4D\u7F6E\u53C2\u6570\u987B\u7531\u811A\u672C\u5757\u81EA\u5DF1\u8C03\u7528 CompleteFilename \u751F\u6210\u5019\u9009\u3002
+$script:BzSpec = @{
+${table}
+}
+Register-ArgumentCompleter -Native -CommandName bz -ScriptBlock {
+  param($wordToComplete, $commandAst, $cursorPosition)
+  $tokens = $commandAst.CommandElements | ForEach-Object { $_.ToString() }
+  # \u53BB\u6389\u547D\u4EE4\u540D 'bz'\uFF1B\u82E5\u672B\u5C3E token \u5C31\u662F\u6B63\u5728\u8865\u5168\u7684\u5F53\u524D\u8BCD\uFF0C\u5148\u5254\u9664\u2014\u2014
+  # \u8FD9\u6837 $rest.Count \u624D\u80FD\u7A33\u5B9A\u8868\u793A"\u5DF2\u7ECF\u5B8C\u6574\u8F93\u5165\u7684\u53C2\u6570\u4E2A\u6570"\uFF0C
+  # \u65E0\u8BBA\u7528\u6237\u662F\u521A\u6572\u5B8C\u4E00\u4E2A\u7A7A\u683C\uFF08wordToComplete \u4E3A\u7A7A\uFF09\u8FD8\u662F\u6B63\u5728\u6253\u534A\u4E2A\u8BCD\uFF08\u5982 'u'\uFF09\u3002
+  $rest = @($tokens | Select-Object -Skip 1)
+  if ($rest.Count -gt 0 -and $rest[$rest.Count - 1] -eq $wordToComplete) {
+    $rest = @($rest | Select-Object -First ($rest.Count - 1))
+  }
+  $cands = @()
+  if ($rest.Count -eq 0) {
+    $cands = @(${cmds})
+  } else {
+    $cmd = $rest[0]
+    $spec = $script:BzSpec[$cmd]
+    if ($spec) {
+      # flag \u8865\u5168\uFF1A\u4EFB\u610F\u4F4D\u7F6E\uFF0C\u53EA\u8981\u5F53\u524D\u8BCD\u4EE5 - \u5F00\u5934
+      if ($wordToComplete -like '-*') {
+        $cands = $spec.flags
+      } elseif ($rest.Count -eq 1 -and $spec.subs) {
+        $cands = $spec.subs
+      } elseif ($rest.Count -eq 1 -and $spec.argKind -eq 'dynamic') {
+        $cands = @(bz __complete $spec.ctx)
+      } elseif ($rest.Count -eq 1 -and ($spec.argKind -eq 'file' -or $spec.argKind -eq 'dir')) {
+        return [System.Management.Automation.CompletionCompleters]::CompleteFilename($wordToComplete)
+      } elseif ($spec.subs -and $rest.Count -ge 2) {
+        $sub = $rest[1]
+        $subKind = $spec.subKind[$sub]
+        if ($subKind -eq 'dynamic') {
+          $cands = @(bz __complete $spec.subCtx[$sub])
+        } elseif ($subKind -eq 'file' -or $subKind -eq 'dir') {
+          return [System.Management.Automation.CompletionCompleters]::CompleteFilename($wordToComplete)
+        }
+      }
+    }
+  }
+  $cands | Where-Object { $_ -like "$wordToComplete*" } | ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', $_) }
+}
+`;
+}
+function cmdCompletion(shell) {
+  switch (shell) {
+    case "bash":
+      process.stdout.write(genBash());
+      break;
+    case "zsh":
+      process.stdout.write(genZsh());
+      break;
+    case "powershell":
+      process.stdout.write(genPowerShell());
+      break;
+    default:
+      throw new BizhouError(
+        "INVALID_ARG",
+        `\u7528\u6CD5\uFF1Abz completion <bash|zsh|powershell>\uFF08\u4E0D\u652F\u6301\uFF1A${shell ?? "\uFF08\u7A7A\uFF09"}\uFF09`
+      );
+  }
+}
+async function cmdComplete(rt, ctx, prefix) {
+  let candidates = [];
+  try {
+    switch (ctx) {
+      case "shell":
+        candidates = ["bash", "zsh", "powershell"];
+        break;
+      case "backup-id":
+        candidates = (await readBackups(rt.paths.dir)).map((j) => j.id);
+        break;
+      case "account":
+        candidates = (await rt.accounts.listAccounts()).names;
+        break;
+      default:
+        candidates = [];
+    }
+  } catch {
+    candidates = [];
+  }
+  const p = prefix ?? "";
+  for (const c2 of candidates) {
+    if (c2.startsWith(p)) process.stdout.write(`${c2}
+`);
+  }
+}
+
+// src/daemon.ts
+import { stat as stat2 } from "fs/promises";
+import { basename as basename4, dirname as dirname5, relative as relative3, resolve as resolve4, sep as sep2 } from "path";
+
+// src/watcher.ts
+import { watch } from "fs";
+import { readdir as readdir5 } from "fs/promises";
+import { join as join11 } from "path";
+function debounce(fn, ms) {
+  let timer;
+  let lastArgs;
+  return {
+    call: (...args) => {
+      lastArgs = args;
+      if (timer) clearTimeout(timer);
+      timer = setTimeout(() => {
+        timer = void 0;
+        if (lastArgs) fn(...lastArgs);
+      }, ms);
+    },
+    cancel: () => {
+      if (timer) {
+        clearTimeout(timer);
+        timer = void 0;
+      }
+    }
+  };
+}
+async function listDirsRecursive(root) {
+  const dirs = [root];
+  const walk = async (dir) => {
+    let entries;
+    try {
+      entries = await readdir5(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      if (e.isDirectory()) {
+        const sub = join11(dir, e.name);
+        dirs.push(sub);
+        await walk(sub);
+      }
+    }
+  };
+  await walk(root);
+  return dirs;
+}
+function watchRecursive(dir, onChange, opts) {
+  const plat = opts.platform ?? process.platform;
+  const d = debounce(onChange, opts.debounceMs);
+  const watchers = [];
+  let stopped = false;
+  const safeWatch = (target) => {
+    if (stopped) return;
+    try {
+      watchers.push(watch(target, () => d.call()));
+    } catch {
+    }
+  };
+  if (plat === "darwin" || plat === "win32") {
+    try {
+      watchers.push(watch(dir, { recursive: true }, () => d.call()));
+    } catch {
+      void listDirsRecursive(dir).then((dirs) => {
+        for (const sub of dirs) safeWatch(sub);
+      });
+    }
+  } else {
+    void listDirsRecursive(dir).then((dirs) => {
+      for (const sub of dirs) safeWatch(sub);
+    });
+  }
+  return {
+    stop() {
+      stopped = true;
+      d.cancel();
+      for (const w of watchers) {
+        try {
+          w.close();
+        } catch {
+        }
+      }
+    }
+  };
+}
+
+// src/daemon.ts
+async function sweepJob(rt, backend, mk, contentKey, job, log) {
+  const localDir = resolve4(job.localDir);
+  const st = await stat2(localDir).catch(() => null);
+  if (!st?.isDirectory()) {
+    log(`\u8DF3\u8FC7\uFF08\u6E90\u76EE\u5F55\u4E0D\u5B58\u5728\uFF09\uFF1A${localDir}`);
+    return { uploaded: 0, skipped: 0, failed: 0 };
+  }
+  const baseCloud = job.cloudDir ? normalizeCloudPath(job.cloudDir) : defaultUploadCloudDir(localDir + sep2, rt.fileRoot);
+  const rootCloud = joinCloudPath(baseCloud, basename4(localDir));
+  const files = await walkLocalFiles(localDir);
+  let uploaded = 0;
+  let skipped = 0;
+  let failed = 0;
+  for (const abs of files) {
+    const relDir = dirname5(relative3(localDir, abs));
+    const cloudDir = relDir === "." ? rootCloud : joinCloudPath(rootCloud, relDir);
+    try {
+      const r = await pushOneFile(rt, backend, mk, contentKey, abs, cloudDir, {});
+      if (r.status === "skipped-dup") skipped++;
+      else if (r.status === "locked") {
+      } else {
+        uploaded++;
+        log(`\u5DF2\u5907\u4EFD\uFF1A${abs} \u2192 ${r.bundleId}`);
+      }
+    } catch (err) {
+      failed++;
+      log(`\u5931\u8D25\uFF08\u8DF3\u8FC7\u7EE7\u7EED\uFF09\uFF1A${abs} \u2014 ${err.message}`);
+    }
+  }
+  return { uploaded, skipped, failed };
+}
+var SerialJobRunner = class {
+  constructor(run) {
+    this.run = run;
+  }
+  run;
+  running = false;
+  dirty = false;
+  current = Promise.resolve();
+  trigger() {
+    if (this.running) {
+      this.dirty = true;
+      return;
+    }
+    this.running = true;
+    this.current = this.loop();
+  }
+  async loop() {
+    try {
+      do {
+        this.dirty = false;
+        try {
+          await this.run();
+        } catch {
+        }
+      } while (this.dirty);
+    } finally {
+      this.running = false;
+    }
+  }
+  /** 等当前（及补跑）结束。 */
+  async drain() {
+    await this.current;
+  }
+};
+async function cmdBackup(rt, sub, arg, opts) {
+  switch (sub) {
+    case "add": {
+      if (!arg) {
+        throw new BizhouError("INVALID_ARG", "\u7528\u6CD5\uFF1Abz backup add <\u672C\u5730\u76EE\u5F55> [--to <\u4E91\u7AEF\u76EE\u5F55>]");
+      }
+      const abs = resolve4(arg);
+      const st = await stat2(abs).catch(() => null);
+      if (!st?.isDirectory()) throw new BizhouError("INVALID_ARG", `\u4E0D\u662F\u76EE\u5F55\uFF1A${abs}`);
+      const cloudDir = opts.to ? normalizeCloudPath(opts.to) : void 0;
+      const job = await addBackup(rt.paths.dir, {
+        localDir: abs,
+        ...cloudDir ? { cloudDir } : {},
+        addedAt: new Date(rt.now()).toISOString()
+      });
+      ok(`\u5DF2\u6CE8\u518C\u5907\u4EFD\u4EFB\u52A1 ${job.id}\uFF1A${abs}${cloudDir ? ` \u2192 ${cloudDir}` : ""}`);
+      return;
+    }
+    case "list": {
+      const jobs = await readBackups(rt.paths.dir);
+      if (jobs.length === 0) {
+        info("\uFF08\u65E0\u5907\u4EFD\u4EFB\u52A1\uFF09\u6DFB\u52A0\uFF1Abz backup add <\u76EE\u5F55> [--to <\u4E91\u7AEF\u76EE\u5F55>]");
+        return;
+      }
+      for (const j of jobs) {
+        out(
+          `${j.id}  ${j.localDir}${j.cloudDir ? ` \u2192 ${j.cloudDir}` : "\uFF08\u955C\u50CF\uFF09"}  \u4E0A\u6B21\uFF1A${j.lastBackupAt ?? "\u4ECE\u672A"}`
+        );
+      }
+      return;
+    }
+    case "rm": {
+      if (!arg) throw new BizhouError("INVALID_ARG", "\u7528\u6CD5\uFF1Abz backup rm <id>");
+      const removed = await removeBackup(rt.paths.dir, arg);
+      if (removed) ok(`\u5DF2\u5220\u9664\u5907\u4EFD\u4EFB\u52A1 ${arg}\uFF08\u4E91\u7AEF\u5DF2\u5907\u4EFD\u6570\u636E\u4E0D\u53D7\u5F71\u54CD\uFF09`);
+      else warn(`\u672A\u627E\u5230\u5907\u4EFD\u4EFB\u52A1\uFF1A${arg}`);
+      return;
+    }
+    case "run": {
+      const jobs = await readBackups(rt.paths.dir);
+      const targets = arg ? jobs.filter((j) => j.id === arg) : jobs;
+      if (targets.length === 0) {
+        warn(arg ? `\u672A\u627E\u5230\u5907\u4EFD\u4EFB\u52A1\uFF1A${arg}` : "\uFF08\u65E0\u5907\u4EFD\u4EFB\u52A1\uFF09");
+        return;
+      }
+      const mk = await rt.resolveMk(opts);
+      const contentKey = deriveContentKey(mk);
+      const backend = await makeBackend(rt, opts.local);
+      for (const job of targets) {
+        info(`\u5907\u4EFD ${job.id}\uFF1A${job.localDir}`);
+        const r = await sweepJob(rt, backend, mk, contentKey, job, (m) => info(m));
+        await updateLastBackup(rt.paths.dir, job.id, new Date(rt.now()).toISOString());
+        ok(`\u4EFB\u52A1 ${job.id} \u5B8C\u6210\uFF1A\u4E0A\u4F20 ${r.uploaded}\uFF0C\u8DF3\u8FC7 ${r.skipped}\uFF0C\u5931\u8D25 ${r.failed}`);
+      }
+      return;
+    }
+    default:
+      throw new BizhouError("INVALID_ARG", `\u672A\u77E5\u5B50\u547D\u4EE4\uFF1Abackup ${sub}\uFF08\u7528 add/list/rm\uFF09`);
+  }
+}
+async function cmdDaemon(rt, opts) {
+  const jobs = await readBackups(rt.paths.dir);
+  if (jobs.length === 0) {
+    info("\u65E0\u5907\u4EFD\u4EFB\u52A1\uFF0C\u5148\u8FD0\u884C `bz backup add <\u76EE\u5F55>`\u3002");
+    return;
+  }
+  const mk = await rt.resolveMk(opts);
+  try {
+    const contentKey = deriveContentKey(mk);
+    const backend = await makeBackend(rt, opts.local);
+    const runners = /* @__PURE__ */ new Map();
+    for (const job of jobs) {
+      runners.set(
+        job.id,
+        new SerialJobRunner(async () => {
+          try {
+            const r = await sweepJob(rt, backend, mk, contentKey, job, (m) => info(m));
+            await updateLastBackup(rt.paths.dir, job.id, new Date(rt.now()).toISOString());
+            info(`\u4EFB\u52A1 ${job.id}\uFF1A\u4E0A\u4F20 ${r.uploaded}\uFF0C\u8DF3\u8FC7 ${r.skipped}\uFF0C\u5931\u8D25 ${r.failed}`);
+          } catch (err) {
+            warn(`\u4EFB\u52A1 ${job.id} \u672C\u8F6E\u51FA\u9519\uFF08\u4E0B\u6B21\u89E6\u53D1\u91CD\u8BD5\uFF09\uFF1A${err.message}`);
+          }
+        })
+      );
+    }
+    info(`daemon \u542F\u52A8\uFF1A${jobs.length} \u4E2A\u4EFB\u52A1\uFF0C\u542F\u52A8\u5373\u626B...`);
+    for (const job of jobs) runners.get(job.id)?.trigger();
+    await Promise.all([...runners.values()].map((r) => r.drain()));
+    const watchers = jobs.map(
+      (job) => watchRecursive(job.localDir, () => runners.get(job.id)?.trigger(), {
+        debounceMs: rt.daemonDebounceMs
+      })
+    );
+    const timer = setInterval(() => {
+      for (const job of jobs) runners.get(job.id)?.trigger();
+    }, rt.daemonSweepIntervalMs);
+    info(
+      `\u76D1\u542C\u4E2D\uFF08\u9632\u6296 ${rt.daemonDebounceMs}ms\uFF0C\u5B9A\u65F6\u515C\u5E95 ${Math.round(rt.daemonSweepIntervalMs / 6e4)}min\uFF09\u3002Ctrl-C \u9000\u51FA\u3002`
+    );
+    await new Promise((resolve5) => {
+      let shutting = false;
+      const shutdown = (sig) => {
+        if (shutting) return;
+        shutting = true;
+        info(`\u6536\u5230 ${sig}\uFF0C\u505C\u6B62 daemon\uFF08\u7B49\u5728\u98DE\u5907\u4EFD\u5B8C\u6210\uFF09...`);
+        for (const w of watchers) w.stop();
+        clearInterval(timer);
+        void Promise.all([...runners.values()].map((r) => r.drain())).catch(() => {
+        }).then(() => resolve5());
+      };
+      process.once("SIGINT", () => shutdown("SIGINT"));
+      process.once("SIGTERM", () => shutdown("SIGTERM"));
+    });
+    ok("daemon \u5DF2\u9000\u51FA\u3002");
+  } finally {
+    mk.fill(0);
+  }
+}
+
+// src/index.ts
+var HELP = `\u655D\u5E1A bz \u2014\u2014 \u5BA2\u6237\u7AEF\u52A0\u5BC6\u5F15\u64CE CLI
+
+\u7528\u6CD5: bz <\u547D\u4EE4> [\u53C2\u6570] [\u9009\u9879]
+
+\u5BC6\u94A5\u4E0E\u4F1A\u8BDD:
+  init                     \u9996\u6B21\u8BBE\u7F6E\u4E3B\u5BC6\u7801\uFF0C\u751F\u6210\u6062\u590D\u5BC6\u94A5
+  unlock [--ttl <\u79D2>]      \u8F93\u5165\u4E3B\u5BC6\u7801\u89E3\u9501\u672C\u8BBE\u5907\u4F1A\u8BDD\uFF08\u7F13\u5B58\u4E3B\u5BC6\u94A5\uFF09
+  lock                     \u7ACB\u5373\u4E0A\u9501\uFF08\u6E05\u9664\u7F13\u5B58\u4E3B\u5BC6\u94A5\uFF09
+  passwd                   \u4FEE\u6539\u4E3B\u5BC6\u7801\uFF08\u6062\u590D\u5BC6\u94A5\u4E0D\u53D8\uFF09
+  recover                  \u7528\u6062\u590D\u5BC6\u94A5\u91CD\u8BBE\u4E3B\u5BC6\u7801
+
+\u8D26\u53F7:
+  login [--name <n>] [--device] [--port <p>]   OAuth \u767B\u5F55\u767E\u5EA6
+  logout                                       \u6CE8\u9500\u5F53\u524D\u8D26\u53F7
+  account [list|use <n>|add <n>]               \u591A\u8D26\u53F7\u7BA1\u7406
+
+\u8D44\u6E90:
+  push <path> [-r] [--chunk 100MB] [--compress] [--no-split] [--name <n>] [--preview] [--to <\u4E91\u7AEF\u76EE\u5F55>] [--force] [--concurrency N]
+                          \uFF08--force \u65E0\u89C6\u53BB\u91CD/\u5728\u98DE\u9501\u5F3A\u5236\u4E0A\u4F20\uFF1B--concurrency \u7247\u5185\u5E76\u53D1\u6570\uFF0C\u9ED8\u8BA4 4\uFF0C\u8303\u56F4 1-16\uFF09
+  pull <id|\u4E91\u7AEF\u76EE\u5F55> [-r] [--out <dir>] [--force]   \u8FD8\u539F\u5230\u6587\u4EF6\u6839\u4E0B\uFF08--force \u65E0\u89C6\u5E42\u7B49/\u5728\u98DE\u9501\u5F3A\u5236\u4E0B\u8F7D\uFF09
+  mkdir <\u76EE\u5F55>             \u521B\u5EFA\u4E91\u7AEF\u76EE\u5F55\uFF08mkdir -p \u8BED\u4E49\uFF09
+  ls [\u76EE\u5F55] [-r]           \u5217\u51FA\u76EE\u5F55\uFF08\u663E\u793A\u771F\u540D\uFF0C\u9700\u5DF2\u89E3\u9501\uFF1B-r \u9012\u5F52\uFF09
+  info <id>                \u67E5\u770B\u8D44\u6E90\u5143\u6570\u636E
+  rm <\u8DEF\u5F84|id> [--yes]     \u5220\u9664\u5230\u56DE\u6536\u7AD9\uFF08\u5220\u9664\u76EE\u5F55\u9700 --yes \u786E\u8BA4\uFF09
+  trash [list|restore <id>|rm <id>|clear]  \u56DE\u6536\u7AD9\u7BA1\u7406\uFF08\u5217\u51FA/\u6062\u590D/\u6C38\u4E45\u5220\u9664/\u6E05\u7A7A\uFF09
+  mv <src> <\u76EE\u6807\u76EE\u5F55>       \u79FB\u52A8 bundle \u6216\u76EE\u5F55\u5230\u76EE\u6807\u76EE\u5F55\u4E0B
+  cp <src> <\u76EE\u6807\u76EE\u5F55> [-r]  \u590D\u5236 bundle \u6216\u76EE\u5F55\uFF08\u76EE\u5F55\u9700 -r\uFF09\u5230\u76EE\u6807\u76EE\u5F55\u4E0B
+  rename <src> <\u65B0\u540D>       \u6539\u540D\uFF1Abundle \u6539\u771F\u540D\uFF08\u91CD\u5199 encMeta\uFF09/ \u76EE\u5F55 native \u6539\u540D
+  share <id> [--code|--7z] \u751F\u6210\u5206\u4EAB\u7801 / \u5BFC\u51FA 7z-AES\uFF08--7z \u9700 7z \u4E8C\u8FDB\u5236\uFF09
+  preview <id> [--out <dir>]  \u4E0B\u8F7D\u5E76\u89E3\u5BC6\u9884\u89C8\u5305\uFF1A\u56FE\u7247/\u89C6\u9891\u7F29\u7565\u56FE\u3001\u97F3\u9891\u7247\u6BB5\u3001PDF \u9996\u9875\uFF08\u843D\u6587\u4EF6\uFF09\uFF1B
+                              \u6587\u672C/\u4EE3\u7801\u524D 32KB\u3001\u538B\u7F29\u5305(zip/tar/tgz)\u6587\u4EF6\u5217\u8868\uFF08\u76F4\u63A5\u6253\u5370\u5230 stdout\uFF09
+
+\u5907\u4EFD/\u5B88\u62A4:
+  backup add <\u672C\u5730\u76EE\u5F55> [--to <\u4E91\u7AEF\u76EE\u5F55>]   \u6CE8\u518C\u52A0\u5BC6\u5907\u4EFD\u4EFB\u52A1
+  backup list                              \u5217\u51FA\u5907\u4EFD\u4EFB\u52A1
+  backup rm <id>                           \u5220\u9664\u5907\u4EFD\u4EFB\u52A1\uFF08\u4E0D\u52A8\u4E91\u7AEF\u5DF2\u5907\u4EFD\u6570\u636E\uFF09
+  backup run [<id>]                        \u624B\u52A8\u6267\u884C\u4E00\u6B21\u5907\u4EFD\uFF08\u7701\u7565 id \u8DD1\u5168\u90E8\uFF09
+  daemon                                   \u524D\u53F0\u5B88\u62A4\uFF1A\u542F\u52A8\u5373\u626B + \u5B9E\u65F6\u76D1\u542C + \u5B9A\u65F6\u515C\u5E95\uFF08Ctrl-C \u9000\u51FA\uFF09
+
+\u5176\u5B83:
+  completion <bash|zsh|powershell>   \u8F93\u51FA shell \u8865\u5168\u811A\u672C\uFF08eval \u6216\u5199\u5165 rc \u6587\u4EF6\uFF09
+
+\u901A\u7528\u9009\u9879:
+  --local <dir>            \u7528\u672C\u5730\u76EE\u5F55\u4EE3\u66FF\u767E\u5EA6\u7F51\u76D8\uFF08\u79BB\u7EBF\u6D4B\u8BD5/\u81EA\u5EFA\u540E\u7AEF\uFF09
+  --password-stdin         \u4ECE stdin \u8BFB\u4E3B\u5BC6\u7801\uFF08\u811A\u672C\u5316\uFF09
+  -h, --help               \u663E\u793A\u5E2E\u52A9
+  -v, --version            \u663E\u793A\u7248\u672C
+
+\u51ED\u8BC1: \u5728\u9879\u76EE .env \u914D\u7F6E BAIDU_APP_KEY / BAIDU_SECRET_KEY\uFF08\u89C1 .env.example\uFF09\u3002`;
+function version() {
+  if ("1.0.0") return "1.0.0";
+  try {
+    const here = dirname6(fileURLToPath(import.meta.url));
+    return readFileSync2(join12(here, "..", "..", "..", "VERSION"), "utf8").trim();
+  } catch {
+    return "0.0.0";
+  }
+}
+async function main(argv) {
+  const { values, positionals } = parseArgs({
+    args: argv,
+    allowPositionals: true,
+    strict: false,
+    options: {
+      help: { type: "boolean", short: "h" },
+      version: { type: "boolean", short: "v" },
+      local: { type: "string" },
+      "password-stdin": { type: "boolean" },
+      out: { type: "string" },
+      chunk: { type: "string" },
+      compress: { type: "boolean" },
+      "no-split": { type: "boolean" },
+      name: { type: "string" },
+      preview: { type: "boolean" },
+      device: { type: "boolean" },
+      port: { type: "string" },
+      code: { type: "boolean" },
+      "7z": { type: "boolean" },
+      ttl: { type: "string" },
+      force: { type: "boolean" },
+      recursive: { type: "boolean", short: "r" },
+      to: { type: "string" },
+      yes: { type: "boolean" },
+      concurrency: { type: "string" }
+    }
+  });
+  const cmd = positionals[0];
+  if (values.version) {
+    out(version());
+    return 0;
+  }
+  if (!cmd || values.help) {
+    info(HELP);
+    return cmd ? 0 : values.help ? 0 : 1;
+  }
+  const common = {
+    local: values.local,
+    passwordStdin: Boolean(values["password-stdin"])
+  };
+  const rt = createRuntime();
+  switch (cmd) {
+    case "init":
+      await cmdInit(rt, { ...common, force: Boolean(values.force) });
+      return 0;
+    case "unlock":
+      await cmdUnlock(rt, { ...common, ttl: values.ttl ? Number(values.ttl) : void 0 });
+      return 0;
+    case "lock":
+      await cmdLock(rt);
+      return 0;
+    case "passwd":
+      await cmdPasswd(rt, common);
+      return 0;
+    case "recover":
+      await cmdRecover(rt);
+      return 0;
+    case "login":
+      await cmdLogin(rt, {
+        name: values.name,
+        device: Boolean(values.device),
+        port: values.port ? Number(values.port) : void 0
+      });
+      return 0;
+    case "logout":
+      await cmdLogout(rt);
+      return 0;
+    case "account":
+      await cmdAccount(rt, positionals[1], positionals[2]);
+      return 0;
+    case "push":
+      if (!positionals[1]) throw new BizhouError("INVALID_ARG", "\u7528\u6CD5\uFF1Abz push <path>");
+      await cmdPush(rt, positionals[1], {
+        ...common,
+        chunk: values.chunk,
+        compress: Boolean(values.compress),
+        noSplit: Boolean(values["no-split"]),
+        name: values.name,
+        preview: Boolean(values.preview),
+        to: values.to,
+        recursive: Boolean(values.recursive),
+        force: Boolean(values.force),
+        concurrency: values.concurrency ? Number(values.concurrency) : void 0
+      });
+      return 0;
+    case "pull":
+      if (!positionals[1]) throw new BizhouError("INVALID_ARG", "\u7528\u6CD5\uFF1Abz pull <id>");
+      await cmdPull(rt, positionals[1], {
+        ...common,
+        out: values.out,
+        recursive: Boolean(values.recursive),
+        force: Boolean(values.force)
+      });
+      return 0;
+    case "mkdir":
+      if (!positionals[1]) throw new BizhouError("INVALID_ARG", "\u7528\u6CD5\uFF1Abz mkdir <\u76EE\u5F55>");
+      await cmdMkdir(rt, positionals[1], common);
+      return 0;
+    case "ls":
+      await cmdLs(rt, positionals[1], { ...common, recursive: Boolean(values.recursive) });
+      return 0;
+    case "info":
+      if (!positionals[1]) throw new BizhouError("INVALID_ARG", "\u7528\u6CD5\uFF1Abz info <id>");
+      await cmdInfo(rt, positionals[1], common);
+      return 0;
+    case "rm":
+      if (!positionals[1]) throw new BizhouError("INVALID_ARG", "\u7528\u6CD5\uFF1Abz rm <\u8DEF\u5F84|id> [--yes]");
+      await cmdRm(rt, positionals[1], {
+        ...common,
+        yes: Boolean(values.yes)
+      });
+      return 0;
+    case "trash":
+      await cmdTrash(rt, positionals[1], positionals[2], common);
+      return 0;
+    case "mv":
+      if (!positionals[1] || !positionals[2]) {
+        throw new BizhouError("INVALID_ARG", "\u7528\u6CD5\uFF1Abz mv <src> <\u76EE\u6807\u76EE\u5F55>");
+      }
+      await cmdMv(rt, positionals[1], positionals[2], common);
+      return 0;
+    case "cp":
+      if (!positionals[1] || !positionals[2]) {
+        throw new BizhouError("INVALID_ARG", "\u7528\u6CD5\uFF1Abz cp <src> <\u76EE\u6807\u76EE\u5F55> [-r]");
+      }
+      await cmdCp(rt, positionals[1], positionals[2], {
+        ...common,
+        recursive: Boolean(values.recursive)
+      });
+      return 0;
+    case "rename":
+      if (!positionals[1] || !positionals[2]) {
+        throw new BizhouError("INVALID_ARG", "\u7528\u6CD5\uFF1Abz rename <src> <\u65B0\u540D>");
+      }
+      await cmdRename(rt, positionals[1], positionals[2], common);
+      return 0;
+    case "share":
+      if (!positionals[1]) throw new BizhouError("INVALID_ARG", "\u7528\u6CD5\uFF1Abz share <id>");
+      await cmdShare(rt, positionals[1], {
+        ...common,
+        code: Boolean(values.code),
+        sevenz: Boolean(values["7z"]),
+        out: values.out
+      });
+      return 0;
+    case "preview":
+      if (!positionals[1]) throw new BizhouError("INVALID_ARG", "\u7528\u6CD5\uFF1Abz preview <id>");
+      await cmdPreview(rt, positionals[1], { ...common, out: values.out });
+      return 0;
+    case "backup":
+      if (!positionals[1]) {
+        throw new BizhouError("INVALID_ARG", "\u7528\u6CD5\uFF1Abz backup <add|list|rm> ...");
+      }
+      await cmdBackup(rt, positionals[1], positionals[2], {
+        ...common,
+        to: values.to
+      });
+      return 0;
+    case "daemon":
+      await cmdDaemon(rt, common);
+      return 0;
+    case "completion":
+      cmdCompletion(positionals[1]);
+      return 0;
+    case "__complete":
+      await cmdComplete(rt, positionals[1] ?? "", positionals[2]);
+      return 0;
+    default:
+      errorLine(`\u672A\u77E5\u547D\u4EE4\uFF1A${cmd}`);
+      info(HELP);
+      return 2;
+  }
+}
+main(process.argv.slice(2)).then((code) => process.exit(code)).catch((err) => {
+  if (err instanceof BizhouError) {
+    errorLine(err.message);
+    process.exit(exitCodeFor(err.code));
+  }
+  errorLine(`\u672A\u9884\u671F\u9519\u8BEF\uFF1A${err instanceof Error ? err.message : String(err)}`);
+  process.exit(1);
+});