@cjhyy/code-shell-server 0.9.51 → 0.10.1

package/dist/account/manager.js

@@ -0,0 +1,976 @@
+import { readAccountFeatures } from "@cjhyy/code-shell-web/account";
+import { createHash, randomBytes } from "node:crypto";
+import { cloudManagementTicket, cloudOrigin, cloudId, } from "./cloud-contract.js";
+import { isRelayOrigin, isRelayToken } from "../remote-relay/protocol.js";
+import { accountLinksRequest, accountLinkView, accountLinkRevocation } from "./links.js";
+import { accountProfile, accountProfileRequest } from "./profile.js";
+import { validCloudAccountGrant } from "./store.js";
+import { CloudAccountHttpError, createCloudAccountTransport, } from "./http.js";
+function cancelPrepared(prepared) {
+    try {
+        prepared?.cancel();
+    }
+    catch {
+        /* Link cleanup cannot undo an account login. */
+    }
+}
+function savedGrant(value, origin) {
+    return {
+        origin,
+        accessToken: value.accessToken,
+        refreshToken: value.refreshToken,
+        accessTokenExpiresAt: value.accessTokenExpiresAt,
+        refreshTokenExpiresAt: value.refreshTokenExpiresAt,
+        sessionId: value.sessionId,
+        account: {
+            id: value.account.id,
+            username: value.account.username,
+            ...(value.account.displayName === undefined
+                ? {}
+                : { displayName: value.account.displayName }),
+        },
+        ...(value.kind === undefined ? {} : { kind: value.kind }),
+        ...(value.audience === undefined ? {} : { audience: value.audience }),
+        ...(value.hostId === undefined ? {} : { hostId: value.hostId }),
+    };
+}
+function linkContinuation(value, authorizationUrl) {
+    if (!value || typeof value !== "object")
+        return;
+    const result = value;
+    if (result.state !== "ready" || typeof result.authorizationUrl !== "string")
+        return;
+    try {
+        const expected = new URL(authorizationUrl);
+        const url = new URL(result.authorizationUrl);
+        if (url.origin !== expected.origin ||
+            url.protocol !== "https:" ||
+            url.username ||
+            url.password ||
+            url.hash ||
+            url.pathname !== "/oauth/account-link/claim" ||
+            [...url.searchParams.keys()].length !== 1 ||
+            !/^[A-Za-z0-9_-]{43}$/.test(url.searchParams.get("ticket") ?? "") ||
+            result.authorizationUrl.length > 2048)
+            return;
+        return url.href;
+    }
+    catch {
+        return;
+    }
+}
+function requireOrigin(origin) {
+    if (!isRelayOrigin(origin) || origin.length > 2048)
+        throw new Error("请输入完整的 HTTPS 云服务地址。");
+}
+function wait(ms, signal) {
+    return new Promise((resolve, reject) => {
+        signal.throwIfAborted();
+        const abort = () => {
+            clearTimeout(timer);
+            reject(new Error("云账号操作已取消。"));
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener("abort", abort);
+            resolve();
+        }, ms);
+        signal.addEventListener("abort", abort, { once: true });
+    });
+}
+/** Optional cloud identity. Construction/status never initiate network activity. */
+export class CloudAccountManager {
+    deps;
+    loaded = false;
+    disposed = false;
+    statusListeners = new Set();
+    saved;
+    state = "signed-out";
+    generation = 0;
+    operation = new AbortController();
+    refresh;
+    refreshResponse;
+    revocationResponses = new WeakSet();
+    request;
+    githubConnection;
+    pendingGitHubLink;
+    profileRevision = 0;
+    profileRequestRevision = 0;
+    profileUpdate;
+    activation;
+    expiryTimer;
+    constructor(deps) {
+        this.deps = deps;
+        this.request = deps.request ?? createCloudAccountTransport();
+    }
+    now() {
+        return this.deps.now?.() ?? Date.now();
+    }
+    load() {
+        if (this.loaded)
+            return;
+        this.loaded = true;
+        try {
+            this.saved = this.deps.store.load();
+            this.state = this.saved ? "signed-in" : "signed-out";
+        }
+        catch {
+            this.state = "storage-error";
+        }
+    }
+    status() {
+        this.load();
+        return {
+            state: this.state,
+            ...(this.saved ? { origin: this.saved.origin, account: { ...this.saved.account } } : {}),
+            ...(this.githubConnection ? { githubConnection: { ...this.githubConnection } } : {}),
+        };
+    }
+    onStatus(listener) {
+        this.statusListeners.add(listener);
+        return () => {
+            this.statusListeners.delete(listener);
+        };
+    }
+    /** Cancel this host's work without revoking a saved account session. */
+    dispose() {
+        this.disposed = true;
+        this.invalidate();
+        this.operation.abort();
+        this.statusListeners.clear();
+    }
+    async overview(input, authorized = () => true, signal) {
+        const lease = this.captureRootAccount(input.origin, input.accountId, authorized);
+        const requestSignal = signal ? AbortSignal.any([lease.signal, signal]) : lease.signal;
+        requestSignal.throwIfAborted();
+        const token = await this.getCredential(input.origin, input.accountId, requestSignal);
+        lease.current();
+        const raw = await this.request({
+            origin: input.origin,
+            path: "/api/v1/account/overview",
+            method: "GET",
+            token,
+            signal: requestSignal,
+        });
+        lease.current();
+        requestSignal.throwIfAborted();
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            throw new Error("云服务返回了无效的账号概况。");
+        const value = raw;
+        const account = accountProfile(value, input.accountId);
+        return {
+            account,
+            features: readAccountFeatures(value),
+        };
+    }
+    /** Public service discovery never reads or changes this device's account authority. */
+    async capabilities(origin, signal) {
+        requireOrigin(origin);
+        if (this.disposed)
+            throw new Error("云账号服务已关闭。");
+        const value = (await this.request({
+            origin,
+            path: "/api/v1/account/status",
+            method: "GET",
+            signal,
+        }));
+        if (!value ||
+            typeof value !== "object" ||
+            Array.isArray(value) ||
+            typeof value.registrationAllowed !== "boolean" ||
+            typeof value.githubEnabled !== "boolean" ||
+            (value.browserLoginEnabled !== undefined && typeof value.browserLoginEnabled !== "boolean") ||
+            (value.githubLinkEnabled !== undefined && typeof value.githubLinkEnabled !== "boolean") ||
+            (value.linkManagementEnabled !== undefined &&
+                typeof value.linkManagementEnabled !== "boolean") ||
+            (value.profileEnabled !== undefined && typeof value.profileEnabled !== "boolean"))
+            throw new Error("云服务返回了无效的账号能力信息。");
+        return {
+            features: readAccountFeatures(value),
+            registrationAllowed: value.registrationAllowed,
+            githubEnabled: value.githubEnabled,
+            ...(value.browserLoginEnabled === undefined
+                ? {}
+                : { browserLoginEnabled: value.browserLoginEnabled }),
+            ...(value.githubLinkEnabled === undefined
+                ? {}
+                : { githubLinkEnabled: value.githubLinkEnabled }),
+            ...(value.linkManagementEnabled === undefined
+                ? {}
+                : { linkManagementEnabled: value.linkManagementEnabled }),
+            ...(value.profileEnabled === undefined ? {} : { profileEnabled: value.profileEnabled }),
+            ...(this.relayCapability(value.relay, origin)
+                ? { relay: this.relayCapability(value.relay, origin) }
+                : {}),
+        };
+    }
+    relayCapability(value, origin) {
+        if (value === undefined)
+            return;
+        if (!value || typeof value !== "object" || typeof value.enabled !== "boolean")
+            throw new Error("云服务返回了无效的中继能力信息。");
+        if (!value.enabled)
+            return { enabled: false };
+        if (value.directoryOrigin !== origin ||
+            value.protocolVersion !== 1 ||
+            value.accountHandoffVersion !== 1)
+            throw new Error("此服务的设备协作需要升级，或目录地址不属于当前账号服务。");
+        return {
+            enabled: true,
+            directoryOrigin: origin,
+            protocolVersion: 1,
+            accountHandoffVersion: 1,
+        };
+    }
+    armExpiry() {
+        clearTimeout(this.expiryTimer);
+        const saved = this.saved;
+        if (!saved)
+            return;
+        const delay = Math.min(2_147_483_647, Math.max(1, saved.refreshTokenExpiresAt - this.now()));
+        this.expiryTimer = setTimeout(() => {
+            if (this.saved?.sessionId !== saved.sessionId)
+                return;
+            if (saved.refreshTokenExpiresAt <= this.now())
+                void this.logout().catch(() => { });
+            else
+                this.armExpiry();
+        }, delay);
+        this.expiryTimer.unref?.();
+    }
+    async activate(authorized) {
+        const saved = this.saved;
+        if (!saved || !this.deps.activateRelay)
+            return;
+        if (this.activation?.sessionId === saved.sessionId)
+            return this.activation.pending;
+        const generation = this.generation;
+        const current = () => {
+            try {
+                this.current(generation, authorized);
+            }
+            catch {
+                return false;
+            }
+            return this.state === "signed-in" && this.saved?.sessionId === saved.sessionId;
+        };
+        const pending = (async () => {
+            try {
+                await this.deps.activateRelay({ origin: saved.origin, accountId: saved.account.id }, current);
+            }
+            catch {
+                // Device collaboration reports its own unavailable state; account login remains successful.
+            }
+        })();
+        this.activation = { sessionId: saved.sessionId, pending };
+        await pending;
+        if (this.activation?.pending === pending)
+            this.activation = undefined;
+    }
+    /** The application explicitly restores saved authority once its main window is ready. */
+    async resume(authorized = () => true) {
+        this.load();
+        const saved = this.saved;
+        if (!saved || this.state !== "signed-in" || !authorized())
+            return this.status();
+        await this.getCredential(saved.origin, saved.account.id);
+        if (this.saved?.sessionId !== saved.sessionId || !authorized())
+            return this.status();
+        this.armExpiry();
+        await this.activate(authorized);
+        return this.status();
+    }
+    publish(state) {
+        this.state = state;
+        try {
+            this.deps.changed(this.status());
+        }
+        catch {
+            // A closing renderer cannot keep cloud authority alive.
+        }
+        for (const listener of this.statusListeners) {
+            try {
+                listener(this.status());
+            }
+            catch {
+                /* Observers cannot change authority. */
+            }
+        }
+    }
+    invalidate() {
+        this.generation++;
+        this.activation = undefined;
+        clearTimeout(this.expiryTimer);
+        this.operation.abort();
+        cancelPrepared(this.pendingGitHubLink);
+        this.pendingGitHubLink = undefined;
+        if (this.githubConnection?.state === "pending")
+            this.githubConnection = { state: "skipped" };
+        this.operation = new AbortController();
+        this.refresh = undefined;
+        this.refreshResponse = undefined;
+        this.profileUpdate = undefined;
+    }
+    current(generation, authorized) {
+        if (this.disposed ||
+            generation !== this.generation ||
+            this.operation.signal.aborted ||
+            !authorized())
+            throw new Error("云账号操作已取消。");
+    }
+    async retire(saved) {
+        if (saved)
+            await this.deps.retireRelay?.({ origin: saved.origin, accountId: saved.account.id });
+    }
+    validGrant(value, origin) {
+        if (!validCloudAccountGrant(value) ||
+            value.kind === "device" ||
+            (value.audience !== undefined && value.audience !== origin) ||
+            value.accessTokenExpiresAt <= this.now() ||
+            value.refreshTokenExpiresAt <= this.now())
+            throw new Error("云服务返回了无效的账号授权。");
+    }
+    async complete(value, origin, generation, authorized) {
+        this.validGrant(value, origin);
+        try {
+            this.current(generation, authorized);
+        }
+        catch (error) {
+            void this.revoke({ ...value, origin });
+            throw error;
+        }
+        const previous = this.saved;
+        const next = savedGrant(value, origin);
+        try {
+            this.deps.store.save(next);
+        }
+        catch (error) {
+            void this.revoke(next);
+            throw error;
+        }
+        this.saved = next;
+        this.armExpiry();
+        this.publish("signed-in");
+        if (previous && previous.sessionId !== next.sessionId)
+            await this.revoke(previous);
+        await this.activate(authorized);
+        return this.status();
+    }
+    async revoke(saved, inFlightRefresh) {
+        // A captured refresh can extend the session beyond the saved grant's expiry.
+        if (!inFlightRefresh && saved.refreshTokenExpiresAt <= this.now())
+            return true;
+        try {
+            let token = saved.accessToken;
+            if (inFlightRefresh || saved.accessTokenExpiresAt <= this.now()) {
+                const refreshed = await (inFlightRefresh ??
+                    this.request({
+                        origin: saved.origin,
+                        path: "/api/v1/account/refresh",
+                        body: { refreshToken: saved.refreshToken },
+                    }));
+                this.validGrant(refreshed, saved.origin);
+                if (refreshed.sessionId !== saved.sessionId || refreshed.account.id !== saved.account.id)
+                    return false;
+                token = refreshed.accessToken;
+            }
+            const value = await this.request({
+                origin: saved.origin,
+                path: "/api/v1/account/logout",
+                token,
+                body: {},
+            });
+            return (!!value &&
+                typeof value === "object" &&
+                !Array.isArray(value) &&
+                value.ok === true);
+        }
+        catch {
+            return false;
+        }
+    }
+    async prepare(origin) {
+        requireOrigin(origin);
+        this.load();
+        this.deps.store.preflight();
+        this.invalidate();
+        this.githubConnection = undefined;
+        const generation = this.generation;
+        const signal = this.operation.signal;
+        this.publish("signing-in");
+        try {
+            await this.retire(this.saved);
+            this.current(generation, () => true);
+            return { generation, signal };
+        }
+        catch (error) {
+            if (generation === this.generation)
+                this.publish(this.saved ? "signed-in" : "signed-out");
+            throw error;
+        }
+    }
+    async signIn(kind, input, authorized = () => true) {
+        if (!input ||
+            typeof input.username !== "string" ||
+            !/^[a-z0-9][a-z0-9._-]{2,63}$/i.test(input.username.trim()) ||
+            input.username.length > 128 ||
+            typeof input.password !== "string" ||
+            input.password.length < 12 ||
+            input.password.length > 1024 ||
+            (input.deviceName !== undefined &&
+                (typeof input.deviceName !== "string" || input.deviceName.length > 100)))
+            throw new Error("请填写账号名称和至少 12 位密码。");
+        if (!authorized())
+            throw new Error("云账号操作已取消。");
+        const { generation, signal } = await this.prepare(input.origin);
+        try {
+            const grant = await this.request({
+                origin: input.origin,
+                path: `/api/v1/account/${kind}`,
+                body: {
+                    username: input.username.trim(),
+                    password: input.password,
+                    ...(input.deviceName ? { deviceName: input.deviceName } : {}),
+                },
+                signal,
+            });
+            return await this.complete(grant, input.origin, generation, authorized);
+        }
+        finally {
+            if (generation === this.generation && this.state === "signing-in")
+                this.publish(this.saved ? "signed-in" : "signed-out");
+        }
+    }
+    /** The website confirms identity; only this Host can redeem and persist its own session. */
+    async signInWithBrowser(input, authorized = () => true) {
+        if (!input ||
+            typeof input !== "object" ||
+            Object.keys(input).some((key) => key !== "origin" && key !== "deviceName") ||
+            (input.deviceName !== undefined &&
+                (typeof input.deviceName !== "string" || input.deviceName.length > 100)))
+            throw new Error("网页登录请求无效。");
+        if (!authorized())
+            throw new Error("云账号操作已取消。");
+        const { generation, signal } = await this.prepare(input.origin);
+        const codeVerifier = randomBytes(32).toString("base64url");
+        const codeChallenge = createHash("sha256").update(codeVerifier).digest("base64url");
+        let receipt;
+        try {
+            const capabilities = await this.capabilities(input.origin, signal);
+            this.current(generation, authorized);
+            if (capabilities.browserLoginEnabled !== true)
+                throw new Error("此账号服务尚未启用网页登录，请更新服务或使用其他登录方式。");
+            const flow = (await this.request({
+                origin: input.origin,
+                path: "/api/v1/account/browser/start",
+                body: { codeChallenge, ...(input.deviceName ? { deviceName: input.deviceName } : {}) },
+                signal,
+            }));
+            // Capture a valid receipt before checking navigation so even malformed replies can be cancelled.
+            if (isRelayToken(flow?.receipt))
+                receipt = flow.receipt;
+            let url;
+            try {
+                if (typeof flow?.authorizationUrl === "string" && flow.authorizationUrl.length <= 2048)
+                    url = new URL(flow.authorizationUrl);
+            }
+            catch {
+                /* Invalid service navigation is reported without echoing its contents. */
+            }
+            if (!url ||
+                url.origin !== input.origin ||
+                url.pathname !== "/desktop-login" ||
+                url.username ||
+                url.password ||
+                url.hash ||
+                [...url.searchParams.keys()].length !== 1 ||
+                !isRelayToken(url.searchParams.get("request")) ||
+                url.searchParams.get("request") === receipt ||
+                !receipt ||
+                !Number.isSafeInteger(flow.expiresAt) ||
+                flow.expiresAt <= this.now() ||
+                flow.expiresAt > this.now() + 15 * 60_000)
+                throw new Error("网页登录地址无效，请重新发起登录。");
+            this.current(generation, authorized);
+            await this.deps.openExternal(url.href);
+            const expiresAt = flow.expiresAt;
+            while (this.now() < expiresAt) {
+                this.current(generation, authorized);
+                const result = await this.request({
+                    origin: input.origin,
+                    path: "/api/v1/account/browser/poll",
+                    body: { receipt, codeVerifier },
+                    signal,
+                });
+                if (result?.status !== "pending")
+                    return await this.complete(result, input.origin, generation, authorized);
+                await (this.deps.sleep ?? wait)(Math.min(10_000, Math.max(1000, typeof flow.pollIntervalMs === "number" && Number.isFinite(flow.pollIntervalMs)
+                    ? flow.pollIntervalMs
+                    : 1000)), signal);
+            }
+            throw new Error("网页登录已超时，请重新发起登录。");
+        }
+        finally {
+            if (receipt)
+                void this.request({
+                    origin: input.origin,
+                    path: "/api/v1/account/browser/cancel",
+                    body: { receipt, codeVerifier },
+                }).catch(() => { });
+            if (generation === this.generation && this.state === "signing-in")
+                this.publish(this.saved ? "signed-in" : "signed-out");
+        }
+    }
+    async linkGitHub(authorized = () => true) {
+        this.load();
+        const saved = this.saved;
+        if (!saved || this.state !== "signed-in" || !authorized())
+            throw new Error("请先登录云账号。");
+        const token = await this.getCredential(saved.origin, saved.account.id);
+        if (!this.saved || this.saved.sessionId !== saved.sessionId || !authorized())
+            throw new Error("云账号操作已取消。");
+        return this.github({ origin: saved.origin }, authorized, { saved: this.saved, token });
+    }
+    /** Every read/revoke is bound to the reviewed identity and the current local account incarnation. */
+    async manageLinks(raw, authorized = () => true) {
+        const input = accountLinksRequest(raw);
+        this.load();
+        const saved = this.saved;
+        const generation = this.generation;
+        const signal = this.operation.signal;
+        const current = () => {
+            this.current(generation, authorized);
+            const actual = this.saved;
+            if (!saved ||
+                !actual ||
+                this.state !== "signed-in" ||
+                actual.sessionId !== saved.sessionId ||
+                actual.origin !== input.origin ||
+                actual.account.id !== input.accountId ||
+                actual.kind === "device" ||
+                (actual.audience !== undefined && actual.audience !== input.origin))
+                throw new Error("请先登录此云服务的账号。");
+        };
+        current();
+        const token = await this.getCredential(input.origin, input.accountId, signal);
+        current();
+        const value = await this.request({
+            origin: input.origin,
+            path: input.action === "list"
+                ? "/api/v1/account/links"
+                : `/api/v1/account/links/${input.kind}/${input.id}`,
+            method: input.action === "list" ? "GET" : "DELETE",
+            token,
+            signal,
+        });
+        current();
+        return input.action === "list"
+            ? { action: "list", view: accountLinkView(value) }
+            : accountLinkRevocation(value, input);
+    }
+    async profile(raw, authorized = () => true) {
+        const input = accountProfileRequest(raw);
+        this.load();
+        if (this.profileUpdate)
+            throw new Error("账号资料正在保存，请稍后重试。");
+        const saved = this.saved;
+        const generation = this.generation;
+        const signal = this.operation.signal;
+        const revision = ++this.profileRequestRevision;
+        const current = () => {
+            this.current(generation, authorized);
+            if (!saved ||
+                !this.saved ||
+                this.state !== "signed-in" ||
+                this.saved.sessionId !== saved.sessionId ||
+                this.saved.origin !== input.origin ||
+                this.saved.account.id !== input.accountId ||
+                revision !== this.profileRequestRevision)
+                throw new Error("云账号操作已取消。");
+        };
+        current();
+        const update = input.action === "update" ? {} : undefined;
+        if (update)
+            this.profileUpdate = update;
+        try {
+            const token = await this.getCredential(input.origin, input.accountId, signal);
+            current();
+            const value = await this.request({
+                origin: input.origin,
+                path: "/api/v1/account/profile",
+                method: input.action === "read" ? "GET" : "PATCH",
+                token,
+                signal,
+                ...(input.action === "read"
+                    ? {}
+                    : {
+                        body: {
+                            ...(input.displayName === undefined ? {} : { displayName: input.displayName }),
+                            ...(input.username === undefined ? {} : { username: input.username }),
+                        },
+                    }),
+            });
+            current();
+            const account = accountProfile(value, input.accountId);
+            const next = { ...this.saved, account };
+            try {
+                this.deps.store.save(next);
+            }
+            catch {
+                throw new Error("账号资料同步后无法保存到本机，请重试。");
+            }
+            this.profileRevision++;
+            this.saved = next;
+            this.publish("signed-in");
+            return this.status();
+        }
+        finally {
+            if (update && this.profileUpdate === update)
+                this.profileUpdate = undefined;
+        }
+    }
+    signInWithGitHub(input, authorized = () => true) {
+        return this.github(input, authorized);
+    }
+    async github(input, authorized, link) {
+        if (!input || !authorized())
+            throw new Error("云账号操作已取消。");
+        if ((input.connectGitHub !== undefined && typeof input.connectGitHub !== "boolean") ||
+            (input.deviceName !== undefined &&
+                (typeof input.deviceName !== "string" || input.deviceName.length > 100)))
+            throw new Error("GitHub 登录请求无效。");
+        requireOrigin(input.origin);
+        if (link)
+            this.invalidate();
+        const { generation, signal } = link
+            ? { generation: this.generation, signal: this.operation.signal }
+            : await this.prepare(input.origin);
+        const codeVerifier = randomBytes(32).toString("base64url");
+        const codeChallenge = createHash("sha256").update(codeVerifier).digest("base64url");
+        let receipt;
+        let prepared;
+        try {
+            const status = (await this.request({
+                origin: input.origin,
+                path: "/api/v1/account/github/status",
+                method: "GET",
+                signal,
+            }));
+            this.current(generation, authorized);
+            if (status?.enabled !== true)
+                throw new Error("此云服务尚未配置 GitHub 登录。");
+            if (!link && input.connectGitHub === true && status.linkEnabled === true) {
+                try {
+                    prepared = await this.deps.prepareGitHubLink?.(signal, authorized);
+                    this.current(generation, authorized);
+                    if (prepared) {
+                        const url = new URL(prepared.authorizationUrl);
+                        if (url.protocol !== "https:" ||
+                            url.username ||
+                            url.password ||
+                            url.hash ||
+                            url.pathname !== "/oauth/authorize" ||
+                            prepared.authorizationUrl.length > 16384)
+                            throw new Error("GitHub 数据连接地址无效。");
+                    }
+                }
+                catch {
+                    cancelPrepared(prepared);
+                    prepared = undefined;
+                    this.current(generation, authorized);
+                }
+            }
+            const flow = (await this.request({
+                origin: input.origin,
+                path: "/api/v1/account/github/start",
+                body: {
+                    codeChallenge,
+                    ...(link ? { mode: "link" } : {}),
+                    ...(prepared ? { linkAuthorization: prepared.authorizationUrl } : {}),
+                },
+                ...(link ? { token: link.token } : {}),
+                signal,
+            }));
+            const url = new URL(flow.authorizationUrl);
+            const scopes = url.searchParams.get("scope")?.split(" ").filter(Boolean) ?? [];
+            if (url.origin !== "https://github.com" ||
+                url.pathname !== "/login/oauth/authorize" ||
+                url.username ||
+                url.password ||
+                url.hash ||
+                scopes.some((scope) => scope !== "read:user" && !(prepared && scope === "repo")) ||
+                url.searchParams.get("code_challenge") !== codeChallenge ||
+                url.searchParams.get("code_challenge_method") !== "S256" ||
+                !isRelayToken(flow.receipt) ||
+                !Number.isSafeInteger(flow.expiresAt) ||
+                flow.expiresAt <= this.now() ||
+                flow.expiresAt > this.now() + 15 * 60_000)
+                throw new Error("GitHub 登录地址无效。");
+            receipt = flow.receipt;
+            this.current(generation, authorized);
+            await this.deps.openExternal(url.href);
+            while (this.now() < flow.expiresAt) {
+                this.current(generation, authorized);
+                const result = await this.request({
+                    origin: input.origin,
+                    path: "/api/v1/account/github/poll",
+                    body: {
+                        receipt,
+                        codeVerifier,
+                        ...(input.deviceName ? { deviceName: input.deviceName } : {}),
+                    },
+                    signal,
+                });
+                if (result?.status !== "pending") {
+                    if (link) {
+                        this.current(generation, authorized);
+                        const linked = result;
+                        if (linked?.linked !== true ||
+                            linked.account?.id !== link.saved.account.id ||
+                            this.saved?.sessionId !== link.saved.sessionId)
+                            throw new Error("GitHub 关联未完成。");
+                        return this.status();
+                    }
+                    await this.complete(result, input.origin, generation, authorized);
+                    this.current(generation, authorized);
+                    if (input.connectGitHub === true) {
+                        const continuation = prepared &&
+                            linkContinuation(result.githubLink, prepared.authorizationUrl);
+                        if (prepared && continuation) {
+                            this.continueGitHubLink(prepared, continuation, generation, authorized);
+                            prepared = undefined;
+                        }
+                        else {
+                            this.githubConnection = { state: "failed" };
+                            this.publish("signed-in");
+                        }
+                    }
+                    else if (input.connectGitHub === false) {
+                        this.githubConnection = { state: "skipped" };
+                        this.publish("signed-in");
+                    }
+                    return this.status();
+                }
+                await (this.deps.sleep ?? wait)(Math.min(10_000, Math.max(1000, flow.pollIntervalMs || 1000)), signal);
+            }
+            throw new Error("GitHub 登录已超时，请重试。");
+        }
+        finally {
+            cancelPrepared(prepared);
+            if (receipt)
+                void this.request({
+                    origin: input.origin,
+                    path: "/api/v1/account/github/cancel",
+                    body: { receipt, codeVerifier },
+                }).catch(() => { });
+            if (generation === this.generation && this.state === "signing-in")
+                this.publish(this.saved ? "signed-in" : "signed-out");
+        }
+    }
+    continueGitHubLink(prepared, url, generation, authorized) {
+        const sessionId = this.saved?.sessionId;
+        this.pendingGitHubLink = prepared;
+        this.githubConnection = { state: "pending" };
+        this.publish("signed-in");
+        void Promise.resolve()
+            .then(() => {
+            this.current(generation, authorized);
+            return prepared.continue(url);
+        })
+            .then((result) => {
+            this.current(generation, authorized);
+            if (this.saved?.sessionId !== sessionId)
+                return;
+            this.githubConnection = { state: result === "connected" ? "connected" : "skipped" };
+            this.publish("signed-in");
+        })
+            .catch(() => {
+            if (generation === this.generation && this.saved?.sessionId === sessionId) {
+                let allowed = false;
+                try {
+                    allowed = authorized();
+                }
+                catch {
+                    /* A closed owner cannot receive continuation status. */
+                }
+                this.githubConnection = { state: allowed ? "failed" : "skipped" };
+                this.publish("signed-in");
+            }
+        })
+            .finally(() => {
+            cancelPrepared(prepared);
+            if (this.pendingGitHubLink === prepared)
+                this.pendingGitHubLink = undefined;
+        });
+    }
+    cancelSignIn() {
+        this.load();
+        this.invalidate();
+        this.publish(this.saved ? "signed-in" : "signed-out");
+    }
+    async logout() {
+        this.load();
+        const previous = this.saved;
+        const inFlightRefresh = this.refreshResponse;
+        if (inFlightRefresh)
+            this.revocationResponses.add(inFlightRefresh);
+        this.invalidate();
+        this.saved = undefined;
+        this.githubConnection = undefined;
+        let storageError = false;
+        try {
+            this.deps.store.forget();
+            this.publish("signed-out");
+        }
+        catch {
+            storageError = true;
+            this.publish("storage-error");
+        }
+        let retireError;
+        try {
+            await this.retire(previous);
+        }
+        catch (error) {
+            retireError = error;
+        }
+        const confirmed = previous ? await this.revoke(previous, inFlightRefresh) : true;
+        if (retireError)
+            throw retireError;
+        if (storageError)
+            throw new Error("无法移除账号登记，请检查文件权限后重试。");
+        return { state: "signed-out", revocation: confirmed ? "confirmed" : "unconfirmed" };
+    }
+    /** Main-only root authority lease; refresh preserves it, logout/relogin invalidates it. */
+    captureRootAccount(origin, accountId, authorized) {
+        requireOrigin(origin);
+        this.load();
+        const saved = this.saved;
+        const generation = this.generation;
+        const signal = this.operation.signal;
+        const current = () => {
+            this.current(generation, authorized);
+            const actual = this.saved;
+            if (!saved ||
+                !actual ||
+                this.state !== "signed-in" ||
+                actual.sessionId !== saved.sessionId ||
+                actual.origin !== origin ||
+                actual.account.id !== accountId ||
+                actual.refreshTokenExpiresAt <= this.now() ||
+                actual.kind === "device" ||
+                (actual.audience !== undefined && actual.audience !== origin))
+                throw new Error("请先登录此云服务的账号。");
+        };
+        current();
+        return {
+            signal,
+            current,
+            ticket: async (targetOrigin, installationId) => {
+                cloudOrigin(targetOrigin);
+                cloudId(installationId);
+                current();
+                const token = await this.getCredential(origin, accountId, signal);
+                current();
+                const value = await this.request({
+                    origin,
+                    path: "/api/v1/account/cloud-management/tickets",
+                    method: "POST",
+                    token,
+                    body: { cloudOrigin: targetOrigin, installationId },
+                    signal,
+                });
+                current();
+                return cloudManagementTicket(value, { cloudOrigin: targetOrigin, accountOrigin: origin, installationId }, this.now());
+            },
+        };
+    }
+    /** Returns credentials only to main callers, for one exact service/account. */
+    async getCredential(origin, accountId, signal) {
+        requireOrigin(origin);
+        this.load();
+        const saved = this.saved;
+        if (this.state !== "signed-in" ||
+            !saved ||
+            saved.origin !== origin ||
+            (accountId !== undefined && accountId !== saved.account.id))
+            throw new Error("请先登录此云服务的账号。");
+        signal?.throwIfAborted();
+        if (saved.refreshTokenExpiresAt <= this.now()) {
+            await this.logout();
+            throw new Error("云账号授权已过期，请重新登录。");
+        }
+        if (saved.accessTokenExpiresAt > this.now() + 30_000)
+            return saved.accessToken;
+        if (!this.refresh) {
+            const generation = this.generation;
+            const profileRevision = this.profileRevision;
+            const operationSignal = this.operation.signal;
+            // A logout can await this one response to revoke the rotated token without
+            // persisting it. Client cancellation fences use, not the bounded request.
+            const response = this.request({
+                origin,
+                path: "/api/v1/account/refresh",
+                body: { refreshToken: saved.refreshToken },
+            });
+            this.refreshResponse = response;
+            const pending = (async () => {
+                try {
+                    const grant = await response;
+                    this.validGrant(grant, origin);
+                    try {
+                        this.current(generation, () => this.saved?.sessionId === saved.sessionId &&
+                            this.saved?.account.id === saved.account.id &&
+                            !operationSignal.aborted);
+                    }
+                    catch (error) {
+                        if (!this.revocationResponses.has(response))
+                            void this.revoke({ ...grant, origin });
+                        throw error;
+                    }
+                    if (grant.account.id !== saved.account.id || grant.sessionId !== saved.sessionId)
+                        throw new Error("云账号授权发生变化，请重新登录。");
+                    const next = savedGrant(grant, origin);
+                    // A refresh issued before a profile update may carry its older label.
+                    if (profileRevision !== this.profileRevision && this.saved?.sessionId === saved.sessionId)
+                        next.account = { ...this.saved.account };
+                    try {
+                        this.deps.store.save(next);
+                    }
+                    catch (error) {
+                        this.saved = undefined;
+                        this.publish("storage-error");
+                        try {
+                            await this.retire(saved);
+                        }
+                        finally {
+                            void this.revoke(next);
+                        }
+                        throw error;
+                    }
+                    this.saved = next;
+                    this.armExpiry();
+                    this.publish("signed-in");
+                    return next.accessToken;
+                }
+                catch (error) {
+                    if (generation === this.generation &&
+                        error instanceof CloudAccountHttpError &&
+                        (error.status === 401 || error.status === 403))
+                        await this.logout();
+                    throw error;
+                }
+            })();
+            this.refresh = pending;
+            void pending
+                .finally(() => {
+                if (this.refresh === pending)
+                    this.refresh = undefined;
+                if (this.refreshResponse === response)
+                    this.refreshResponse = undefined;
+            })
+                .catch(() => { });
+        }
+        const token = await this.refresh;
+        signal?.throwIfAborted();
+        return token;
+    }
+}