@crabcloud/cli 0.1.7 → 0.1.9

package/dist/crab.js

@@ -3,7 +3,7 @@
 // src/index.ts
 import { hostname, homedir as homedir2 } from "node:os";
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join2 } from "node:path";
+import { basename, join as join2 } from "node:path";
 
 // ../../node_modules/.bun/zod@4.6.5/node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
@@ -5724,6 +5724,9 @@ function superRefine(fn, params) {
 var accountDomain = "crabcloud.cc";
 var adminDomain = `admin.${accountDomain}`;
 var storageDomain = `storage.${accountDomain}`;
+function storagePublicUrl(objectId) {
+  return `https://${storageDomain}/o/${objectId}`;
+}
 var clientTypes = ["web", "agent", "miniapp", "native"];
 var scopes = [
   "account.read",
@@ -5791,7 +5794,7 @@ var registerInput = object({
   code: string2().trim().regex(/^\d{6}$/),
   displayName: string2().trim().min(1).max(80),
   password: string2().min(8).max(256),
-  invite: string2().trim().min(16).max(128).optional()
+  invite: string2().trim().max(64).transform((v) => v.toUpperCase()).optional()
 });
 var loginInput = object({
   username: string2().trim().toLowerCase().min(3).max(254),
@@ -5866,12 +5869,23 @@ var adminCreditPackInput = object({
   title: string2().trim().min(1).max(100),
   credits: number2().int().positive().max(1e7),
   priceCents: number2().int().positive(),
-  currency: string2().trim().length(3).default("CNY"),
+  currency: string2().trim().length(3).default("USD"),
   sort: number2().int().min(0).max(1e4).default(0)
 });
 var adminCreditPackUpdateInput = adminCreditPackInput.partial().extend({
   status: _enum(creditPackStatuses).optional()
 });
+var adminPricingOverridesInput = object({
+  overrides: record(string2().trim().min(1).max(100), union([number2().int().positive().max(1e8), _null3()]))
+});
+var adminPlanTierStatuses = ["active", "hidden"];
+var adminPlanTierUpdateInput = object({
+  name: string2().trim().min(1).max(50).optional(),
+  priceCents: number2().int().min(0).max(1e8).nullable().optional(),
+  monthlyCredits: number2().int().min(0).max(1e8).optional(),
+  quotaJson: record(string2(), unknown()).optional(),
+  status: _enum(adminPlanTierStatuses).optional()
+});
 var giftFulfillments = ["stock", "webhook"];
 var giftMerchantStatuses = ["active", "disabled"];
 var giftProductStatuses = ["draft", "live", "delisted"];
@@ -5977,6 +5991,57 @@ var contactQueryInput = object({
   offset: number2().int().min(0).default(0)
 });
 
+// ../../packages/cloudkit/src/crypto.ts
+var enc = new TextEncoder;
+var b64urlEncode = (bytes) => {
+  let s = "";
+  for (const b of bytes)
+    s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+var b64urlDecode = (s) => Uint8Array.from(atob(s.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0));
+function randomCode(length = 6) {
+  const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+  return Array.from(crypto.getRandomValues(new Uint8Array(length)), (byte) => alphabet[byte % alphabet.length]).join("");
+}
+
+// ../../packages/cloudkit/src/secretbox.ts
+var enc2 = new TextEncoder;
+var utf8 = (s) => enc2.encode(s);
+var DEFAULT_KEK_ITERATIONS = 210000;
+async function deriveKekBits(password, salt, iterations = DEFAULT_KEK_ITERATIONS) {
+  const key = await crypto.subtle.importKey("raw", utf8(password), "PBKDF2", false, ["deriveBits"]);
+  return new Uint8Array(await crypto.subtle.deriveBits({ name: "PBKDF2", hash: "SHA-256", salt, iterations }, key, 256));
+}
+async function importAesKey(raw, usages = ["encrypt", "decrypt"]) {
+  return crypto.subtle.importKey("raw", raw, "AES-GCM", false, usages);
+}
+function randomKeyBytes(length = 32) {
+  return crypto.getRandomValues(new Uint8Array(length));
+}
+async function aeadEncrypt(key, plaintext, aad) {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const params = aad ? { name: "AES-GCM", iv, additionalData: aad } : { name: "AES-GCM", iv };
+  const ciphertext = await crypto.subtle.encrypt(params, key, plaintext);
+  return { iv, ciphertext: new Uint8Array(ciphertext) };
+}
+async function aeadDecrypt(key, sealed, aad) {
+  const params = aad ? { name: "AES-GCM", iv: sealed.iv, additionalData: aad } : { name: "AES-GCM", iv: sealed.iv };
+  return new Uint8Array(await crypto.subtle.decrypt(params, key, sealed.ciphertext));
+}
+async function unwrapKeyBytes(kek, sealed, aad) {
+  return aeadDecrypt(kek, sealed, aad);
+}
+function sealToB64url(sealed) {
+  return `${b64urlEncode(sealed.iv)}.${b64urlEncode(sealed.ciphertext)}`;
+}
+function sealFromB64url(s) {
+  const [iv, ct] = s.split(".");
+  if (!iv || !ct)
+    throw new Error("invalid sealed payload");
+  return { iv: b64urlDecode(iv), ciphertext: b64urlDecode(ct) };
+}
+
 // ../../packages/skills/src/install.ts
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -6209,6 +6274,7 @@ function exitCodeForApiError(body) {
     case "bad_request":
       return EXIT_USAGE;
     case "insufficient_credits":
+    case "storage.quotaExceeded":
       return EXIT_QUOTA;
     default:
       return 1;
@@ -6264,10 +6330,47 @@ var usage = `crab — Crab Cloud CLI（Agent-first 入口）
                        列出邮件（cursor 分页契约与 Web 工作台一致）
   mail read <id> [--json]            读取邮件正文（自动置已读）
   mail search <query> [--json]       全文搜索（主题/发件人/收件人/正文）
-  mail send --to a@x.cc,b@y.cn [--cc c@z.io] --subject "..." --body "..." | --body-file <path>
-       [--in-reply-to <message-id>]      回信线程锚点（原信 RFC Message-ID，crab mail read 可见）
-                       发送邮件：平台内（@crabcloud.cc）免费，外部出站 2 积分/封
+  mail send --to a@x.cc|联系人名,b@y.cn [--cc c@z.io] --subject "..." --body "..." | --body-file <path>
+       [--attach <云盘id|文件名>,...] [--in-reply-to <message-id>]
+                                         回信线程锚点（原信 RFC Message-ID，crab mail read 可见）
+                       发送邮件：不含 @ 的收件人按联系人簿解析（备注名/地址精确
+                       命中采用，多候选报错列出）；--attach 引用云盘已有对象
+                       （id 或文件名精确唯一命中，未绑信对象，≤10 个，大文件
+                       自动转下载链接）；平台内（@crabcloud.cc）免费，外部出站
+                       2 积分/封
   mail archive|trash|delete <id>     移夹 / 废纸篓 / 彻底删除（delete 不可恢复）
+  contacts list [query] [--offset N] [--json]     列出联系人（地址前缀/显示名匹配）
+  contacts add <address> [--name 名] [--note 备注] [--json]
+                                     添加联系人（站内地址自动关联对方账号）
+  contacts rm <id|address>           删除联系人
+  contacts invite [--reset] [--json] 我的邀请码、链接与统计（--reset 重置，旧链接失效）
+  contacts invitees [--offset N] [--json]
+                                     我邀请的人（直接下级 + 间接计数）
+  storage ls [--q 关键字] [--source files|media|mail] [--category <id|none>]
+               [--type doc|image|video|archive|code] [--tag a,b] [--trash]
+               [--shared] [--recent] [--message-id <id>] [--limit N] [--offset N] [--json]
+                                     列出云盘对象（跨来源统一视图，能力与 Web 云盘一致）
+  storage upload <file...> [--json]  上传一个或多个文件（直传优先，自动回退中转）
+  storage download <id|文件名> [-o 输出路径]
+                                     下载对象内容（默认按原文件名存到当前目录）
+  storage rename <id|文件名> <新名称>  重命名
+  storage tag <id|文件名> --add a,b [--remove c,d]
+                                     增删标签
+  storage category <id|文件名> <categoryId|none>
+                                     设置分类（分类 id 见 storage categories）
+  storage publish|unpublish <id|文件名>
+                                     公开 / 收回公开（公开时打印公开直链）
+  storage rm|restore|purge <id|文件名>
+                                     回收站 / 恢复 / 彻底删除（purge 不可恢复）
+  storage quota [--json]             存储水位（统一容量账：文件/素材/邮件附件一本账）
+  storage share <id|文件名> [--expires 7|30|90|forever] [--passcode 提取码]
+                       创建分享链接（加密文件链接自带解密钥匙 #fragment）
+  storage shares <id|文件名> [--json]
+                                     该文件的分享链接列表（状态/下载计数）
+  storage unshare <shareId>          撤销分享
+  storage categories [--json]        分类列表
+  storage mkcat <名称>               新建分类
+  storage tags [--json]              标签汇总
   skills install|list|uninstall [--agent claude,zcode,codex,agents]
                        skills 管理（claude/zcode/agents 复制目录，codex 写 AGENTS.md 段）
   logout               撤销当前 Agent Token 并清除本地凭证
@@ -6370,7 +6473,7 @@ async function whoami() {
   if (subscription)
     console.log(`  订阅: ${subscription.tier_name}`);
   if (credits !== undefined)
-    console.log(`  积分余额: ${credits}`);
+    console.log(`  积分余额: $${(credits / 100).toFixed(2)} (${credits} credit_cents)`);
   if (apps?.length)
     console.log(`  已启用应用: ${apps.map((a) => a.title).join("、")}`);
   return 0;
@@ -6499,6 +6602,13 @@ async function mailRead(id) {
     console.log(`  回复: ${mail.inReplyTo}`);
   console.log("");
   console.log(mail.bodyText);
+  if (mail.attachments.length > 0) {
+    console.log("");
+    console.log("附件:");
+    for (const att of mail.attachments) {
+      console.log(`  ${att.id}  ${att.filename}  ${att.mimeType}  ${formatBytesCli(att.sizeBytes)}`);
+    }
+  }
   if (mail.actors.length > 0) {
     console.log("");
     console.log("操作记录:");
@@ -6534,15 +6644,63 @@ async function mailSearch(query) {
     printMailRow(mail);
   return 0;
 }
+async function resolveRecipients(credentials, tokens) {
+  const resolved = [];
+  for (const token of tokens) {
+    if (token.includes("@")) {
+      resolved.push(token);
+      continue;
+    }
+    const params = new URLSearchParams({ query: token, limit: "50" });
+    const res = await api2(credentials.apiBase, `/v1/contacts?${params}`, { headers: authHeaders(credentials) });
+    if (res.status !== 200) {
+      console.error(errorMessage(res.body, "查询联系人失败。"));
+      return null;
+    }
+    const items = res.body.data.items;
+    const lowered = token.toLowerCase();
+    const exact = items.filter((c) => c.address.toLowerCase() === lowered || (c.displayName ?? "").toLowerCase() === lowered);
+    if (exact.length === 1) {
+      resolved.push(exact[0].address);
+      continue;
+    }
+    if (exact.length > 1) {
+      console.error(`「${token}」匹配到多个联系人，请改用完整地址：`);
+      for (const c of exact.slice(0, 5))
+        console.error(`  ${contactDisplayName(c)} <${c.address}>`);
+      return null;
+    }
+    if (items.length === 1) {
+      console.error(`「${token}」→ ${contactDisplayName(items[0])} <${items[0].address}>`);
+      resolved.push(items[0].address);
+      continue;
+    }
+    console.error(`「${token}」没有唯一命中的联系人。`);
+    if (items.length > 0) {
+      console.error("相近候选：");
+      for (const c of items.slice(0, 5))
+        console.error(`  ${contactDisplayName(c)} <${c.address}>`);
+    } else {
+      console.error("联系人簿没有相近条目（可先 crab contacts list 查看）。");
+    }
+    return null;
+  }
+  return resolved;
+}
 async function mailSend() {
-  const to = (readFlag("--to") ?? "").split(",").map((x) => x.trim()).filter(Boolean);
-  const cc = (readFlag("--cc") ?? "").split(",").map((x) => x.trim()).filter(Boolean);
+  const toRaw = (readFlag("--to") ?? "").split(",").map((x) => x.trim()).filter(Boolean);
+  const ccRaw = (readFlag("--cc") ?? "").split(",").map((x) => x.trim()).filter(Boolean);
+  const attachRaw = (readFlag("--attach") ?? "").split(",").map((x) => x.trim()).filter(Boolean);
   const subject = readFlag("--subject") ?? "";
   const bodyFlag = readFlag("--body");
   const bodyFile = readFlag("--body-file");
   const inReplyTo = readFlag("--in-reply-to") ?? undefined;
-  if (to.length === 0 || !subject || !bodyFlag && !bodyFile) {
-    console.error('用法：crab mail send --to a@x.cc[,b@y.cn] [--cc c@z.io] --subject "..." --body "..." | --body-file <path> [--in-reply-to <message-id>]');
+  if (toRaw.length === 0 || !subject || !bodyFlag && !bodyFile) {
+    console.error('用法：crab mail send --to a@x.cc|联系人名[,b@y.cn] [--cc c@z.io] --subject "..." --body "..." | --body-file <path> [--attach <云盘id|文件名>,...] [--in-reply-to <message-id>]');
+    return EXIT_USAGE;
+  }
+  if (attachRaw.length > 10) {
+    console.error("附件最多 10 个。");
     return EXIT_USAGE;
   }
   let body = bodyFlag ?? "";
@@ -6557,10 +6715,29 @@ async function mailSend() {
   const credentials = requireCredentials();
   if (typeof credentials === "number")
     return credentials;
+  const to = await resolveRecipients(credentials, toRaw);
+  if (to === null)
+    return 1;
+  const cc = ccRaw.length > 0 ? await resolveRecipients(credentials, ccRaw) : [];
+  if (cc === null)
+    return 1;
+  const attachmentIds = [];
+  for (const token of attachRaw) {
+    const hit = await resolveStorageObject(credentials, token);
+    if (typeof hit === "number")
+      return hit;
+    if (typeof hit === "object" && hit.isEncrypted) {
+      console.error(`「${token}」是端到端加密文件，暂不能作为邮件附件发送（服务端无法解密）。`);
+      return EXIT_USAGE;
+    }
+    const id = typeof hit === "object" ? hit.id : hit;
+    if (!attachmentIds.includes(id))
+      attachmentIds.push(id);
+  }
   const res = await api2(credentials.apiBase, "/v1/mail/messages", {
     method: "POST",
     headers: authHeaders(credentials),
-    body: JSON.stringify({ to, cc, subject, body, ...inReplyTo ? { inReplyTo } : {} })
+    body: JSON.stringify({ to, cc, subject, body, ...inReplyTo ? { inReplyTo } : {}, ...attachmentIds.length > 0 ? { attachmentIds } : {} })
   });
   if (res.status !== 200 && res.status !== 201) {
     console.error(errorMessage(res.body, "发送失败。"));
@@ -6572,8 +6749,10 @@ async function mailSend() {
     return 0;
   }
   console.log(`✓ 已发送（id ${result.message.id}）`);
+  if (attachmentIds.length > 0)
+    console.log(`  附件 ${attachmentIds.length} 个（云盘引用，不复制）`);
   if (result.chargedCredits > 0)
-    console.log(`  消耗积分：${result.chargedCredits}`);
+    console.log(`  消耗积分：$${(result.chargedCredits / 100).toFixed(2)}（${result.chargedCredits} credit_cents）`);
   if (result.failedExternal > 0)
     console.log(`  ⚠ ${result.failedExternal} 个外部收件人发送失败，对应积分已退回`);
   return 0;
@@ -6594,6 +6773,807 @@ async function mailMove(action, id) {
   console.log(`✓ ${action === "archive" ? "已归档" : action === "trash" ? "已移入废纸篓" : "已彻底删除"}（${id}）`);
   return 0;
 }
+function contactDisplayName(contact) {
+  return contact.displayName ?? contact.resolvedName ?? contact.address;
+}
+async function contactsList(query) {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const params = new URLSearchParams;
+  if (query)
+    params.set("query", query);
+  const offset = readFlag("--offset");
+  if (offset)
+    params.set("offset", offset);
+  params.set("limit", readFlag("--limit") ?? "30");
+  const res = await api2(credentials.apiBase, `/v1/contacts?${params}`, { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取联系人失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const page = res.body.data;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(page, null, 2));
+    return 0;
+  }
+  if (page.items.length === 0) {
+    console.log("还没有联系人。");
+    return 0;
+  }
+  for (const contact of page.items) {
+    const name = contactDisplayName(contact);
+    const address = name === contact.address ? "" : ` <${contact.address}>`;
+    const linked = contact.linkedUsername ? `  [站内 ${contact.linkedUsername}]` : "";
+    console.log(`${contact.id}  ${name}${address}${linked}`);
+  }
+  console.log(`共 ${page.total} 条`);
+  if (page.nextOffset !== null)
+    console.log(`（还有更多：contacts list --offset ${page.nextOffset}）`);
+  return 0;
+}
+async function contactsAdd(address) {
+  if (!address) {
+    console.error("用法：crab contacts add <address> [--name 显示名] [--note 备注] [--json]");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const body = { address };
+  const name = readFlag("--name");
+  if (name)
+    body.displayName = name;
+  const note = readFlag("--note");
+  if (note)
+    body.note = note;
+  const res = await api2(credentials.apiBase, "/v1/contacts", {
+    method: "POST",
+    headers: authHeaders(credentials),
+    body: JSON.stringify(body)
+  });
+  if (res.status !== 200 && res.status !== 201) {
+    console.error(errorMessage(res.body, "添加失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const contact = res.body.data;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(contact, null, 2));
+    return 0;
+  }
+  console.log(`✓ 已添加：${contactDisplayName(contact)} <${contact.address}>（id ${contact.id}）`);
+  return 0;
+}
+async function contactsRm(idOrAddress) {
+  if (!idOrAddress) {
+    console.error("用法：crab contacts rm <id|address>");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  let id = idOrAddress;
+  if (idOrAddress.includes("@")) {
+    const res = await api2(credentials.apiBase, `/v1/contacts?query=${encodeURIComponent(idOrAddress)}&limit=50`, {
+      headers: authHeaders(credentials)
+    });
+    if (res.status !== 200) {
+      console.error(errorMessage(res.body, "查找联系人失败。"));
+      return exitCodeForApiError(res.body);
+    }
+    const page = res.body.data;
+    const hit = page.items.find((item) => item.address === idOrAddress.toLowerCase());
+    if (!hit) {
+      console.error("联系人不存在或已删除。");
+      return EXIT_NOT_FOUND;
+    }
+    id = hit.id;
+  }
+  const res = await api2(credentials.apiBase, `/v1/contacts/${encodeURIComponent(id)}`, {
+    method: "DELETE",
+    headers: authHeaders(credentials)
+  });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "删除失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  console.log(`✓ 已删除（${id}）`);
+  return 0;
+}
+async function contactsInvite(reset) {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const res = await api2(credentials.apiBase, "/v1/contacts/invite/reset", {
+    method: reset ? "POST" : "GET",
+    headers: authHeaders(credentials)
+  });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取邀请链接失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const overview = res.body.data;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(overview, null, 2));
+    return 0;
+  }
+  console.log(`邀请码：${overview.token}`);
+  console.log(`邀请链接：https://crabcloud.cc/register?invite=${overview.token}`);
+  console.log(`已邀请 ${overview.directCount} 人 · 含间接 ${overview.indirectCount} 人`);
+  if (!reset)
+    console.log("（重置链接：crab contacts invite --reset）");
+  return 0;
+}
+async function contactsInvitees() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const offset = readFlag("--offset");
+  const res = await api2(credentials.apiBase, `/v1/contacts/invitees?offset=${offset ?? "0"}&limit=30`, {
+    headers: authHeaders(credentials)
+  });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取邀请列表失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const page = res.body.data;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(page, null, 2));
+    return 0;
+  }
+  if (page.items.length === 0) {
+    console.log("还没有人通过你的链接加入。");
+    return 0;
+  }
+  for (const invitee of page.items) {
+    console.log(`${invitee.username}  ${invitee.displayName}  ${new Date(invitee.joinedAt).toLocaleDateString("zh-CN")}`);
+  }
+  console.log(`直接 ${page.directTotal} · 间接 ${page.indirectTotal}`);
+  if (page.nextOffset !== null)
+    console.log(`（还有更多：contacts invitees --offset ${page.nextOffset}）`);
+  return 0;
+}
+var STORAGE_SOURCES = ["files", "media", "mail"];
+var STORAGE_TYPES = ["doc", "image", "video", "archive", "code"];
+var MIME_BY_EXT = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  svg: "image/svg+xml",
+  pdf: "application/pdf",
+  txt: "text/plain",
+  md: "text/markdown",
+  csv: "text/csv",
+  json: "application/json",
+  xml: "application/xml",
+  yaml: "application/x-yaml",
+  yml: "application/x-yaml",
+  js: "text/javascript",
+  zip: "application/zip",
+  gz: "application/gzip",
+  mp3: "audio/mpeg",
+  mp4: "video/mp4"
+};
+function mimeFor(filename) {
+  const ext = filename.split(".").pop()?.toLowerCase() ?? "";
+  return MIME_BY_EXT[ext] ?? "application/octet-stream";
+}
+function formatBytesCli(n) {
+  if (n >= 1073741824)
+    return `${(n / 1073741824).toFixed(1)} GB`;
+  if (n >= 1048576)
+    return `${(n / 1048576).toFixed(1)} MB`;
+  if (n >= 1024)
+    return `${(n / 1024).toFixed(1)} KB`;
+  return `${n} B`;
+}
+function printStorageRow(o) {
+  const flags = [
+    o.source !== "files" ? o.source === "media" ? "素材" : "邮件附件" : null,
+    o.isEncrypted ? "加密" : null,
+    o.isPublic ? "公开" : null
+  ].filter(Boolean);
+  console.log(`${o.id}  ${o.filename}  ${formatBytesCli(o.sizeBytes)}  ${formatTime(o.createdAt)}${flags.length > 0 ? `  [${flags.join(" · ")}]` : ""}`);
+}
+async function resolveStorageObject(credentials, token) {
+  for (const trash of [false, true]) {
+    const params = new URLSearchParams({ limit: "100", q: token });
+    if (trash)
+      params.set("trash", "1");
+    const res = await api2(credentials.apiBase, `/v1/storage?${params}`, {
+      headers: authHeaders(credentials)
+    });
+    if (res.status !== 200) {
+      console.error(errorMessage(res.body, "查找对象失败。"));
+      return exitCodeForApiError(res.body);
+    }
+    const exact = res.body.data.objects.filter((o) => o.filename === token);
+    if (exact.length > 1) {
+      console.error(`文件名「${token}」命中多个对象，请用 id 指定（crab storage ls 查询）。`);
+      return EXIT_USAGE;
+    }
+    if (exact.length === 1)
+      return exact[0];
+  }
+  return token;
+}
+async function resolveStorageId(credentials, token) {
+  const hit = await resolveStorageObject(credentials, token);
+  if (typeof hit === "string" || typeof hit === "number")
+    return hit;
+  return hit.id;
+}
+async function storageList() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const params = new URLSearchParams({ limit: readFlag("--limit") ?? "30" });
+  const source = readFlag("--source");
+  if (source) {
+    if (!STORAGE_SOURCES.includes(source)) {
+      console.error(`未知来源：${source}
+可用：${STORAGE_SOURCES.join(", ")}`);
+      return EXIT_USAGE;
+    }
+    params.set("source", source);
+  }
+  const type = readFlag("--type");
+  if (type) {
+    if (!STORAGE_TYPES.includes(type)) {
+      console.error(`未知类型：${type}
+可用：${STORAGE_TYPES.join(", ")}`);
+      return EXIT_USAGE;
+    }
+    params.set("type", type);
+  }
+  const category = readFlag("--category");
+  if (category)
+    params.set("category", category);
+  const tags = readFlag("--tag");
+  if (tags)
+    params.set("tags", tags);
+  if (hasFlag("--trash"))
+    params.set("trash", "1");
+  if (hasFlag("--shared"))
+    params.set("public", "1");
+  if (hasFlag("--recent"))
+    params.set("since", String(Date.now() - 604800000));
+  const offset = readFlag("--offset");
+  if (offset)
+    params.set("offset", offset);
+  const q = readFlag("--q");
+  if (q)
+    params.set("q", q);
+  const messageId = readFlag("--message-id");
+  if (messageId)
+    params.set("messageId", messageId);
+  const res = await api2(credentials.apiBase, `/v1/storage?${params}`, { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取云盘列表失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const page = res.body.data;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(page, null, 2));
+    return 0;
+  }
+  if (page.objects.length === 0) {
+    console.log("云盘里没有匹配的对象。");
+    return 0;
+  }
+  for (const object of page.objects)
+    printStorageRow(object);
+  console.log(`共 ${page.total} 条`);
+  if (page.nextOffset !== null)
+    console.log(`（还有更多：storage ls --offset ${page.nextOffset}）`);
+  return 0;
+}
+var utf82 = (s) => new TextEncoder().encode(s);
+var MASTER_AAD = utf82("drive-master");
+var DATA_AAD = utf82("drive-data");
+var KEK_ITERATIONS = 210000;
+function drivePassphrase() {
+  return readFlag("--passphrase") ?? process.env.CRAB_PASSPHRASE;
+}
+async function driveMasterKey(credentials) {
+  const passphrase = drivePassphrase();
+  if (!passphrase) {
+    console.error("需要云盘口令：--passphrase <口令> 或环境变量 CRAB_PASSPHRASE。");
+    return EXIT_USAGE;
+  }
+  const res = await api2(credentials.apiBase, "/v1/storage/keys", { headers: authHeaders(credentials) });
+  if (res.status === 404) {
+    console.error("云盘口令尚未设置——正在初始化（恢复码只显示一次，请立即抄写）：");
+    const salt = b64urlEncode(randomKeyBytes(16));
+    const masterRaw = randomKeyBytes(32);
+    const recoveryCode = randomCode(16);
+    const kek = await importAesKey(await deriveKekBits(passphrase, b64urlDecode(salt), KEK_ITERATIONS));
+    const recoveryKek = await importAesKey(await deriveKekBits(recoveryCode, b64urlDecode(salt), KEK_ITERATIONS));
+    const wrapped = await aeadEncrypt(kek, masterRaw, MASTER_AAD);
+    const recoveryWrapped = await aeadEncrypt(recoveryKek, masterRaw, MASTER_AAD);
+    const put = await api2(credentials.apiBase, "/v1/storage/keys", {
+      method: "PUT",
+      headers: authHeaders(credentials),
+      body: JSON.stringify({
+        kdfSalt: salt,
+        kdfIterations: KEK_ITERATIONS,
+        wrappedMasterKey: `u1.${sealToB64url({ iv: wrapped.iv, ciphertext: wrapped.ciphertext })}`,
+        recoveryWrappedMasterKey: `r1.${sealToB64url({ iv: recoveryWrapped.iv, ciphertext: recoveryWrapped.ciphertext })}`
+      })
+    });
+    if (put.status !== 200 && put.status !== 201) {
+      console.error(errorMessage(put.body, "初始化云盘口令失败。"));
+      return exitCodeForApiError(put.body);
+    }
+    console.log(`★ 恢复码：${recoveryCode}`);
+    console.log("  （口令遗忘时的唯一找回方式；平台无后门，丢失即数据不可解）");
+    return importAesKey(masterRaw);
+  }
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取云盘密钥失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const keys = res.body.data;
+  try {
+    const kek = await importAesKey(await deriveKekBits(passphrase, b64urlDecode(keys.kdfSalt), keys.kdfIterations));
+    return await importAesKey(await unwrapKeyBytes(kek, sealFromB64url(keys.wrappedMasterKey.slice(3)), MASTER_AAD));
+  } catch {
+    console.error("口令错误。");
+    return 1;
+  }
+}
+async function storageUploadOne(credentials, filePath) {
+  let buf;
+  try {
+    buf = readFileSync2(filePath);
+  } catch {
+    console.error(`读取文件失败：${filePath}`);
+    return EXIT_USAGE;
+  }
+  const filename = basename(filePath);
+  const mimeType = mimeFor(filename);
+  const master = await driveMasterKey(credentials);
+  if (typeof master === "number")
+    return master;
+  const dataKey = randomKeyBytes(32);
+  const sealed = await aeadEncrypt(await importAesKey(dataKey), new Uint8Array(buf), DATA_AAD);
+  const cipher = new Uint8Array([...sealed.iv, ...sealed.ciphertext]);
+  const wrapped = await aeadEncrypt(master, dataKey, DATA_AAD);
+  const wrappedDataKey = `u1.${sealToB64url({ iv: wrapped.iv, ciphertext: wrapped.ciphertext })}`;
+  const presign = await api2(credentials.apiBase, "/v1/storage/presign", {
+    method: "POST",
+    headers: authHeaders(credentials),
+    body: JSON.stringify({ filename, mimeType, sizeBytes: cipher.byteLength, enc: true })
+  });
+  if (presign.status === 200) {
+    const { fileId, uploadUrl } = presign.body.data;
+    const put = await fetch(uploadUrl, { method: "PUT", body: cipher, headers: { "content-type": mimeType } });
+    if (!put.ok) {
+      console.error(`直传失败（${put.status}）：${filename}`);
+      return 1;
+    }
+    const complete = await api2(credentials.apiBase, `/v1/storage/${encodeURIComponent(fileId)}/complete`, {
+      method: "POST",
+      headers: authHeaders(credentials),
+      body: JSON.stringify({ isEncrypted: true, wrappedDataKey })
+    });
+    if (complete.status !== 200 && complete.status !== 201) {
+      console.error(errorMessage(complete.body, `记账失败：${filename}`));
+      return exitCodeForApiError(complete.body);
+    }
+    const object = complete.body.data;
+    if (hasFlag("--json"))
+      console.log(JSON.stringify(object, null, 2));
+    else
+      console.log(`✓ 已上传（已加密）：${object.filename}（id ${object.id}）`);
+    return 0;
+  }
+  if (presign.body?.error?.code === "presign_unavailable") {
+    const form = new FormData;
+    form.append("file", new Blob([cipher], { type: mimeType }), filename);
+    form.append("enc", "1");
+    form.append("wrappedDataKey", wrappedDataKey);
+    const res = await fetch(`${credentials.apiBase}/v1/storage`, {
+      method: "POST",
+      headers: authHeaders(credentials),
+      body: form
+    });
+    const body = await res.json().catch(() => ({}));
+    if (res.status !== 200 && res.status !== 201) {
+      console.error(body.error?.message ?? `上传失败：${filename}`);
+      return exitCodeForApiError(body);
+    }
+    if (hasFlag("--json"))
+      console.log(JSON.stringify(body.data, null, 2));
+    else
+      console.log(`✓ 已上传（已加密）：${body.data?.filename}（id ${body.data?.id}）`);
+    return 0;
+  }
+  console.error(errorMessage(presign.body, `上传失败：${filename}`));
+  return exitCodeForApiError(presign.body);
+}
+async function storageUpload(paths) {
+  const files = [];
+  for (let i = 0;i < paths.length; i++) {
+    if (paths[i].startsWith("--")) {
+      if (paths[i] === "--passphrase")
+        i++;
+      continue;
+    }
+    files.push(paths[i]);
+  }
+  if (files.length === 0) {
+    console.error("用法：crab storage upload <file...> [--passphrase 口令] [--json]");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  let code = 0;
+  for (const file of files) {
+    const result = await storageUploadOne(credentials, file);
+    if (result !== 0 && code === 0)
+      code = result;
+    if (result === EXIT_AUTH || result === EXIT_SCOPE)
+      return result;
+  }
+  return code;
+}
+async function storageDownload(token) {
+  if (!token) {
+    console.error("用法：crab storage download <id|文件名|分享链接> [-o 输出路径] [--passphrase 口令] [--passcode 提取码]");
+    return EXIT_USAGE;
+  }
+  const urlMatch = token.match(/\/s\/([0-9a-f]{64})(?:#([A-Za-z0-9_-]+))?$/);
+  const shareToken = urlMatch?.[1];
+  const fragment = urlMatch?.[2];
+  if (shareToken) {
+    const apiBase = process.env.CRAB_API ?? readFlag("--api") ?? DEFAULT_API;
+    const passcode = readFlag("--passcode");
+    const url = `${apiBase}/s/${shareToken}${passcode ? `?passcode=${encodeURIComponent(passcode)}` : ""}`;
+    const res = await fetch(url);
+    if (!res.ok) {
+      const body = await res.json().catch(() => ({}));
+      console.error(errorMessage(body, "下载失败。"));
+      return exitCodeForApiError(body);
+    }
+    let bytes = new Uint8Array(await res.arrayBuffer());
+    if (fragment) {
+      bytes = await aeadDecrypt(await importAesKey(b64urlDecode(fragment)), { iv: bytes.slice(0, 12), ciphertext: bytes.slice(12) }, DATA_AAD);
+    }
+    const disposition = res.headers.get("content-disposition") ?? "";
+    const m = disposition.match(/filename\*=UTF-8''([^;]+)/);
+    const out = readFlag("-o") ?? readFlag("--out") ?? (m ? decodeURIComponent(m[1]) : `${shareToken}.bin`);
+    writeFileSync2(out, Buffer.from(bytes));
+    console.log(`✓ 已下载${fragment ? "并解密" : ""}：${out}（${formatBytesCli(bytes.byteLength)}）`);
+    return 0;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const id = await resolveStorageId(credentials, token);
+  if (typeof id === "number")
+    return id;
+  const res = await fetch(`${credentials.apiBase}/v1/storage/${encodeURIComponent(id)}/content`, {
+    headers: authHeaders(credentials)
+  });
+  if (!res.ok) {
+    const body = await res.json().catch(() => ({}));
+    console.error(errorMessage(body, "下载失败。"));
+    return exitCodeForApiError(body);
+  }
+  let bytes = new Uint8Array(await res.arrayBuffer());
+  const wrapped = res.headers.get("x-drive-wrapped-key");
+  if (wrapped?.startsWith("u1.")) {
+    const passphrase = drivePassphrase();
+    if (!passphrase) {
+      console.error("该文件已加密：--passphrase <口令> 或 CRAB_PASSPHRASE 提供云盘口令后重试。");
+      return EXIT_USAGE;
+    }
+    const master = await driveMasterKey(credentials);
+    if (typeof master === "number")
+      return master;
+    const dataKey = await unwrapKeyBytes(master, sealFromB64url(wrapped.slice(3)), DATA_AAD);
+    bytes = await aeadDecrypt(await importAesKey(dataKey), { iv: bytes.slice(0, 12), ciphertext: bytes.slice(12) }, DATA_AAD);
+  }
+  const disposition = res.headers.get("content-disposition") ?? "";
+  const match = disposition.match(/filename\*=UTF-8''([^;]+)/);
+  const fallbackName = match ? decodeURIComponent(match[1]) : `${id}.bin`;
+  const out = readFlag("-o") ?? readFlag("--out") ?? fallbackName;
+  writeFileSync2(out, Buffer.from(bytes));
+  console.log(`✓ 已下载：${out}（${formatBytesCli(bytes.byteLength)}）`);
+  return 0;
+}
+async function storagePatch(credentials, token, patch) {
+  const id = await resolveStorageId(credentials, token);
+  if (typeof id === "number")
+    return id;
+  const res = await api2(credentials.apiBase, `/v1/storage/${encodeURIComponent(id)}`, {
+    method: "PATCH",
+    headers: authHeaders(credentials),
+    body: JSON.stringify(patch)
+  });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "更新失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  return res.body.data;
+}
+async function storageRename(token, name) {
+  if (!token || !name) {
+    console.error("用法：crab storage rename <id|文件名> <新名称>");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const result = await storagePatch(credentials, token, { filename: name });
+  if (typeof result === "number")
+    return result;
+  console.log(`✓ 已重命名：${result.filename}（id ${result.id}）`);
+  return 0;
+}
+async function storageTag(token) {
+  if (!token || !hasFlag("--add") && !hasFlag("--remove")) {
+    console.error("用法：crab storage tag <id|文件名> --add a,b [--remove c,d]");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const add = (readFlag("--add") ?? "").split(",").map((t) => t.trim()).filter(Boolean);
+  const remove = (readFlag("--remove") ?? "").split(",").map((t) => t.trim()).filter(Boolean);
+  const patch = {};
+  if (add.length > 0)
+    patch.addTags = add;
+  if (remove.length > 0)
+    patch.removeTags = remove;
+  const result = await storagePatch(credentials, token, patch);
+  if (typeof result === "number")
+    return result;
+  console.log(`✓ 标签已更新：${result.filename} [${result.tags.join(", ") || "无"}]`);
+  return 0;
+}
+async function storageCategory(token, value) {
+  if (!token || !value) {
+    console.error("用法：crab storage category <id|文件名> <categoryId|none>（分类 id 见 storage categories）");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const result = await storagePatch(credentials, token, { categoryId: value === "none" ? null : value });
+  if (typeof result === "number")
+    return result;
+  console.log(`✓ 分类已更新：${result.filename}`);
+  return 0;
+}
+async function storagePublish(token, publish) {
+  if (!token) {
+    console.error(`用法：crab storage ${publish ? "publish" : "unpublish"} <id|文件名>`);
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const result = await storagePatch(credentials, token, { isPublic: publish });
+  if (typeof result === "number")
+    return result;
+  console.log(`✓ ${publish ? "已公开" : "已收回公开"}：${result.filename}`);
+  if (publish)
+    console.log(`  公开链接：${storagePublicUrl(result.id)}`);
+  return 0;
+}
+async function storageMove(action, token) {
+  if (!token) {
+    console.error(`用法：crab storage ${action} <id|文件名>`);
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const id = await resolveStorageId(credentials, token);
+  if (typeof id === "number")
+    return id;
+  const res = await api2(credentials.apiBase, `/v1/storage/${encodeURIComponent(id)}${action === "restore" ? "/restore" : ""}${action === "purge" ? "/purge" : ""}`, { method: action === "restore" ? "POST" : "DELETE", headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "操作失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  console.log(`✓ ${action === "rm" ? "已移入回收站（7 天后自动清理）" : action === "restore" ? "已恢复" : "已彻底删除"}（${id}）`);
+  return 0;
+}
+async function storageShareCmd(token) {
+  if (!token) {
+    console.error("用法：crab storage share <id|文件名> [--expires 7|30|90|forever] [--passcode 提取码]");
+    return EXIT_USAGE;
+  }
+  const expires = readFlag("--expires") ?? "7";
+  const passcode = readFlag("--passcode");
+  if (!["7", "30", "90", "forever"].includes(expires) || passcode !== undefined && !/^[A-Za-z0-9]{4,8}$/.test(passcode)) {
+    console.error("无效的 --expires / --passcode 参数。");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const hit = await resolveStorageObject(credentials, token);
+  if (typeof hit === "number")
+    return hit;
+  const id = typeof hit === "object" ? hit.id : hit;
+  const needMaster = typeof hit === "object" && hit.isEncrypted === true && (hit.wrappedDataKey ?? "").startsWith("u1.");
+  const master = needMaster ? await driveMasterKey(credentials) : null;
+  if (needMaster && typeof master === "number")
+    return master;
+  const res = await api2(credentials.apiBase, `/v1/storage/${encodeURIComponent(id)}/share`, {
+    method: "POST",
+    headers: authHeaders(credentials),
+    body: JSON.stringify({ expires, ...passcode ? { passcode } : {} })
+  });
+  if (res.status !== 200 && res.status !== 201) {
+    console.error(errorMessage(res.body, "创建分享失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const data = res.body.data;
+  let link = data.shareUrl;
+  if (data.isEncrypted && data.wrappedDataKey) {
+    const masterKey = master ?? await driveMasterKey(credentials);
+    if (typeof masterKey === "number") {
+      await api2(credentials.apiBase, `/v1/storage/shares/${encodeURIComponent(data.share.id)}`, {
+        method: "DELETE",
+        headers: authHeaders(credentials)
+      }).catch(() => null);
+      console.error("该文件是端到端加密文件，需要云盘口令解出分享钥匙：--passphrase <口令> 或 CRAB_PASSPHRASE（本次分享已撤销，未留孤儿链接）。");
+      return EXIT_USAGE;
+    }
+    const dataKey = await unwrapKeyBytes(masterKey, sealFromB64url(data.wrappedDataKey.slice(3)), DATA_AAD);
+    link = `${link}#${b64urlEncode(dataKey)}`;
+  }
+  console.log(`✓ 分享链接已创建（${expires === "forever" ? "永久" : `${expires} 天`}有效）：`);
+  console.log(`  ${link}`);
+  if (data.share.hasPasscode)
+    console.log("  （已设提取码，接收方需携带）");
+  if (data.isEncrypted)
+    console.log("  （链接自带解密钥匙，泄露即泄露文件——请走可信渠道传递）");
+  return 0;
+}
+async function storageShares(token) {
+  if (!token) {
+    console.error("用法：crab storage shares <id|文件名>");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const id = await resolveStorageId(credentials, token);
+  if (typeof id === "number")
+    return id;
+  const res = await api2(credentials.apiBase, `/v1/storage/${encodeURIComponent(id)}/shares`, { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取分享列表失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const rows = res.body.data.shares;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(rows, null, 2));
+    return 0;
+  }
+  if (rows.length === 0) {
+    console.log("该文件还没有分享链接。");
+    return 0;
+  }
+  for (const s of rows) {
+    const state = s.revokedAt ? "已撤销" : s.expiresAt !== null && s.expiresAt <= Date.now() ? "已过期" : "生效中";
+    console.log(`${s.id}  …${s.token.slice(-12)}  ${state}  下载 ${s.downloadCount} 次  ${formatTime(s.createdAt)}${s.hasPasscode ? "  [提取码]" : ""}`);
+  }
+  return 0;
+}
+async function storageUnshare(shareId) {
+  if (!shareId) {
+    console.error("用法：crab storage unshare <shareId>（id 见 crab storage shares）");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const res = await api2(credentials.apiBase, `/v1/storage/shares/${encodeURIComponent(shareId)}`, {
+    method: "DELETE",
+    headers: authHeaders(credentials)
+  });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "撤销失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  console.log(`✓ 已撤销分享（${shareId}）。`);
+  return 0;
+}
+async function storageQuota() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const res = await api2(credentials.apiBase, "/v1/storage/quota", { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取水位失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const quota = res.body.data;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(quota, null, 2));
+    return 0;
+  }
+  const pct = quota.quotaBytes > 0 ? (quota.usedBytes / quota.quotaBytes * 100).toFixed(1) : "0";
+  console.log(`已用 ${formatBytesCli(quota.usedBytes)} / ${formatBytesCli(quota.quotaBytes)}（${pct}%）`);
+  console.log(`  文件 ${formatBytesCli(quota.bySource.files)} · 素材 ${formatBytesCli(quota.bySource.media)} · 邮件附件 ${formatBytesCli(quota.bySource.mail)} · 回收站 ${formatBytesCli(quota.trashBytes)}`);
+  console.log(`  对象数：全部 ${quota.counts.all ?? 0} · 素材 ${quota.counts.media ?? 0} · 邮件附件 ${quota.counts.mail ?? 0} · 共享 ${quota.counts.shared ?? 0} · 回收站 ${quota.counts.trash ?? 0}`);
+  return 0;
+}
+async function storageCategories() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const res = await api2(credentials.apiBase, "/v1/storage/categories", { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取分类失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const rows = res.body.data.categories;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(rows, null, 2));
+    return 0;
+  }
+  if (rows.length === 0) {
+    console.log("还没有分类（crab storage mkcat <名称> 创建）。");
+    return 0;
+  }
+  for (const row of rows)
+    console.log(`${row.id}  ${row.name}  (${row.fileCount})`);
+  return 0;
+}
+async function storageMkCat(name) {
+  if (!name) {
+    console.error("用法：crab storage mkcat <名称>");
+    return EXIT_USAGE;
+  }
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const res = await api2(credentials.apiBase, "/v1/storage/categories", {
+    method: "POST",
+    headers: authHeaders(credentials),
+    body: JSON.stringify({ name })
+  });
+  if (res.status !== 200 && res.status !== 201) {
+    console.error(errorMessage(res.body, "创建分类失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const row = res.body.data;
+  console.log(`✓ 已创建分类：${row.name}（id ${row.id}）`);
+  return 0;
+}
+async function storageTags() {
+  const credentials = requireCredentials();
+  if (typeof credentials === "number")
+    return credentials;
+  const res = await api2(credentials.apiBase, "/v1/storage/tags", { headers: authHeaders(credentials) });
+  if (res.status !== 200) {
+    console.error(errorMessage(res.body, "获取标签失败。"));
+    return exitCodeForApiError(res.body);
+  }
+  const rows = res.body.data;
+  if (hasFlag("--json")) {
+    console.log(JSON.stringify(rows, null, 2));
+    return 0;
+  }
+  if (rows.tags.length === 0) {
+    console.log("还没有标签（crab storage tag <id> --add a,b 添加）。");
+    return 0;
+  }
+  for (const row of rows.tags)
+    console.log(`${row.tag}  (${row.count})`);
+  return 0;
+}
 async function init() {
   if (loadCredentials()) {
     console.log("已登录（crab whoami 查看身份）。");
@@ -6666,6 +7646,64 @@ switch (command) {
       process.exit(await mailMove(sub, args[2]));
     console.error(sub ? `未知子命令：mail ${sub}
 ` : `缺少子命令：mail list | read | search | send | archive | trash | delete
+`);
+    console.log(usage);
+    process.exit(EXIT_USAGE);
+  }
+  case "contacts": {
+    const sub = args[1];
+    if (sub === "list")
+      process.exit(await contactsList(args.slice(2).join(" ") || undefined));
+    if (sub === "add")
+      process.exit(await contactsAdd(args[2]));
+    if (sub === "rm")
+      process.exit(await contactsRm(args[2]));
+    if (sub === "invite")
+      process.exit(await contactsInvite(hasFlag("--reset")));
+    if (sub === "invitees")
+      process.exit(await contactsInvitees());
+    console.error(sub ? `未知子命令：contacts ${sub}
+` : `缺少子命令：contacts list | add | rm | invite | invitees
+`);
+    console.log(usage);
+    process.exit(EXIT_USAGE);
+  }
+  case "storage": {
+    const sub = args[1];
+    if (sub === "ls")
+      process.exit(await storageList());
+    if (sub === "upload")
+      process.exit(await storageUpload(args.slice(2)));
+    if (sub === "download")
+      process.exit(await storageDownload(args[2]));
+    if (sub === "rename")
+      process.exit(await storageRename(args[2], args[3]));
+    if (sub === "tag")
+      process.exit(await storageTag(args[2]));
+    if (sub === "category")
+      process.exit(await storageCategory(args[2], args[3]));
+    if (sub === "publish")
+      process.exit(await storagePublish(args[2], true));
+    if (sub === "unpublish")
+      process.exit(await storagePublish(args[2], false));
+    if (sub === "rm" || sub === "restore" || sub === "purge")
+      process.exit(await storageMove(sub, args[2]));
+    if (sub === "quota")
+      process.exit(await storageQuota());
+    if (sub === "categories")
+      process.exit(await storageCategories());
+    if (sub === "mkcat")
+      process.exit(await storageMkCat(args.slice(2).join(" ") || undefined));
+    if (sub === "tags")
+      process.exit(await storageTags());
+    if (sub === "share")
+      process.exit(await storageShareCmd(args[2]));
+    if (sub === "shares")
+      process.exit(await storageShares(args[2]));
+    if (sub === "unshare")
+      process.exit(await storageUnshare(args[2]));
+    console.error(sub ? `未知子命令：storage ${sub}
+` : `缺少子命令：storage ls | upload | download | rename | tag | category | publish | unpublish | rm | restore | purge | quota | categories | mkcat | tags | share | shares | unshare
 `);
     console.log(usage);
     process.exit(EXIT_USAGE);