@huoye/app-ship 0.2.0 → 0.3.0

package/dist/browser-native.js

@@ -0,0 +1,2031 @@
+// src/browser-native.ts
+import { lstat as lstat3, readFile as readFile2 } from "fs/promises";
+import path3 from "path";
+
+// src/credential-store.ts
+import { spawn } from "child_process";
+import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
+import { homedir } from "os";
+import path from "path";
+import { chmod, lstat, mkdir, open, readFile, rename, unlink } from "fs/promises";
+
+// src/release-contract.ts
+var RELEASE_PLATFORM_CAPABILITIES = {
+  honor: {
+    platform: "honor",
+    channelKind: "store",
+    supportedActions: ["create_draft"],
+    defaultAction: "create_draft",
+    resultingState: "draft_created",
+    afterApproval: "not_applicable",
+    cancelUntil: "before_remote_request",
+    withdrawal: "not_verified",
+    riskLevel: "high",
+    automaticRetry: "disabled",
+    requiresExplicitConfirmation: true,
+    evidence: "official_documentation",
+    note: "\u7ED1\u5B9A\u5B89\u88C5\u5305\u5230\u8363\u8000\u8349\u7A3F\uFF0C\u4E0D\u63D0\u4EA4\u5BA1\u6838\u3002"
+  },
+  meizu: {
+    platform: "meizu",
+    channelKind: "store",
+    supportedActions: ["upload_build"],
+    defaultAction: "upload_build",
+    resultingState: "build_uploaded",
+    afterApproval: "not_applicable",
+    cancelUntil: "before_remote_request",
+    withdrawal: "not_verified",
+    riskLevel: "high",
+    automaticRetry: "disabled",
+    requiresExplicitConfirmation: true,
+    evidence: "official_documentation",
+    note: "\u4EC5\u6682\u5B58 APK \u6587\u4EF6\uFF0C\u4E0D\u7ED1\u5B9A\u7248\u672C\u3001\u4E0D\u9001\u5BA1\u6216\u53D1\u5E03\u3002"
+  },
+  samsung: {
+    platform: "samsung",
+    channelKind: "store",
+    supportedActions: ["create_draft"],
+    defaultAction: "create_draft",
+    resultingState: "draft_created",
+    afterApproval: "not_applicable",
+    cancelUntil: "before_remote_request",
+    withdrawal: "not_verified",
+    riskLevel: "high",
+    automaticRetry: "disabled",
+    requiresExplicitConfirmation: true,
+    evidence: "official_documentation",
+    note: "\u521B\u5EFA\u6216\u66F4\u65B0\u4E09\u661F\u8349\u7A3F\u5E76\u7ED1\u5B9A\u5B89\u88C5\u5305\uFF0C\u4E0D\u63D0\u4EA4\u5BA1\u6838\u6216\u4E0A\u7EBF\u3002"
+  },
+  pgyer: {
+    platform: "pgyer",
+    channelKind: "test_distribution",
+    supportedActions: ["distribute_test_build"],
+    defaultAction: "distribute_test_build",
+    resultingState: "test_build_distributed",
+    afterApproval: "not_applicable",
+    cancelUntil: "before_distribution_created",
+    withdrawal: "console_only",
+    riskLevel: "high",
+    automaticRetry: "disabled",
+    requiresExplicitConfirmation: true,
+    evidence: "official_and_code",
+    note: "\u4E0A\u4F20\u5B8C\u6210\u5373\u5F62\u6210\u5B89\u88C5\u94FE\u63A5\uFF0C\u5FC5\u987B\u663E\u5F0F\u9009\u62E9\u516C\u5F00\u3001\u5BC6\u7801\u6216\u9080\u8BF7\u5B89\u88C5\u3002"
+  },
+  huawei: {
+    platform: "huawei",
+    channelKind: "store",
+    supportedActions: ["create_draft", "submit_review"],
+    defaultAction: "create_draft",
+    resultingState: "draft_created",
+    afterApproval: "platform_controlled",
+    cancelUntil: "while_remote_draft_exists",
+    withdrawal: "not_verified",
+    riskLevel: "high",
+    automaticRetry: "disabled",
+    requiresExplicitConfirmation: true,
+    evidence: "official_and_code",
+    note: "\u8349\u7A3F\u4E0A\u4F20\u4E0E\u9001\u5BA1\u662F\u4E0D\u540C\u52A8\u4F5C\uFF1B\u9001\u5BA1\u5FC5\u987B\u5355\u72EC\u786E\u8BA4\u3002"
+  },
+  harmony: {
+    platform: "harmony",
+    channelKind: "store",
+    supportedActions: ["create_draft"],
+    defaultAction: "create_draft",
+    resultingState: "draft_created",
+    afterApproval: "not_applicable",
+    cancelUntil: "while_remote_draft_exists",
+    withdrawal: "not_applicable",
+    riskLevel: "medium",
+    automaticRetry: "allowed_for_pre_submission_steps",
+    requiresExplicitConfirmation: true,
+    evidence: "code_observation",
+    note: "\u5F53\u524D submit \u4EE3\u7801\u672A\u5B9E\u73B0\uFF1B\u9A8C\u8BC1\u524D\u53EA\u5F00\u653E\u8349\u7A3F\u3002"
+  },
+  xiaomi: {
+    platform: "xiaomi",
+    channelKind: "store",
+    supportedActions: ["submit_review", "schedule_release_after_review"],
+    defaultAction: "submit_review",
+    resultingState: "review_submitted",
+    afterApproval: "platform_controlled",
+    cancelUntil: "platform_controlled",
+    withdrawal: "not_verified",
+    riskLevel: "critical",
+    automaticRetry: "disabled",
+    requiresExplicitConfirmation: true,
+    evidence: "official_and_code",
+    note: "/dev/push \u4F1A\u63D0\u4EA4\u5E94\u7528\uFF1B\u65E0\u6C99\u76D2\uFF0C\u9001\u5BA1\u6B65\u9AA4\u4E0D\u5F97\u81EA\u52A8\u91CD\u8BD5\u3002"
+  },
+  oppo: {
+    platform: "oppo",
+    channelKind: "store",
+    supportedActions: ["submit_review_auto_release"],
+    defaultAction: "submit_review_auto_release",
+    resultingState: "review_submitted_auto_release",
+    afterApproval: "auto_release",
+    cancelUntil: "not_verified",
+    withdrawal: "not_verified",
+    riskLevel: "critical",
+    automaticRetry: "disabled",
+    requiresExplicitConfirmation: true,
+    evidence: "code_observation",
+    note: "\u5F53\u524D\u9002\u914D\u5668\u9001\u5BA1\u4E14\u5BA1\u6838\u901A\u8FC7\u540E\u7ACB\u5373\u53D1\u5E03\uFF1B\u5B98\u65B9\u5B57\u6BB5\u7EA7\u80FD\u529B\u4ECD\u9700\u771F\u5B9E\u8D26\u53F7\u9A8C\u8BC1\u3002"
+  },
+  vivo: {
+    platform: "vivo",
+    channelKind: "store",
+    supportedActions: ["submit_review_auto_release"],
+    defaultAction: "submit_review_auto_release",
+    resultingState: "review_submitted_auto_release",
+    afterApproval: "auto_release",
+    cancelUntil: "not_verified",
+    withdrawal: "not_verified",
+    riskLevel: "critical",
+    automaticRetry: "disabled",
+    requiresExplicitConfirmation: true,
+    evidence: "code_observation",
+    note: "\u5F53\u524D\u9002\u914D\u5668\u5199\u6B7B onlineType=1\uFF1B\u5B98\u65B9\u5B57\u6BB5\u7EA7\u80FD\u529B\u4ECD\u9700\u771F\u5B9E\u8D26\u53F7\u9A8C\u8BC1\u3002"
+  },
+  tencent: {
+    platform: "tencent",
+    channelKind: "store",
+    supportedActions: ["submit_review_auto_release"],
+    defaultAction: "submit_review_auto_release",
+    resultingState: "review_submitted_auto_release",
+    afterApproval: "auto_release",
+    cancelUntil: "not_verified",
+    withdrawal: "not_verified",
+    riskLevel: "critical",
+    automaticRetry: "disabled",
+    requiresExplicitConfirmation: true,
+    evidence: "code_observation",
+    note: "\u5F53\u524D\u9002\u914D\u5668\u9ED8\u8BA4 deploy_type=1\uFF1B\u5B98\u65B9\u5B57\u6BB5\u7EA7\u80FD\u529B\u4ECD\u9700\u771F\u5B9E\u8D26\u53F7\u9A8C\u8BC1\u3002"
+  },
+  app_store: {
+    platform: "app_store",
+    channelKind: "store",
+    supportedActions: ["upload_build"],
+    defaultAction: "upload_build",
+    resultingState: "build_uploaded",
+    afterApproval: "not_applicable",
+    cancelUntil: "before_remote_request",
+    withdrawal: "not_applicable",
+    riskLevel: "medium",
+    automaticRetry: "allowed_for_pre_submission_steps",
+    requiresExplicitConfirmation: true,
+    evidence: "official_and_code",
+    note: "\u5F53\u524D\u53EA\u4E0A\u4F20\u6784\u5EFA\uFF0C\u4E0D\u9009\u62E9\u6784\u5EFA\u3001\u4E0D\u9001\u5BA1\u3002"
+  },
+  google_play: {
+    platform: "google_play",
+    channelKind: "store",
+    supportedActions: ["create_draft"],
+    defaultAction: "create_draft",
+    resultingState: "draft_created",
+    afterApproval: "not_applicable",
+    cancelUntil: "while_remote_draft_exists",
+    withdrawal: "not_applicable",
+    riskLevel: "medium",
+    automaticRetry: "allowed_for_pre_submission_steps",
+    requiresExplicitConfirmation: true,
+    evidence: "official_and_code",
+    note: "\u4EC5\u4FDD\u5B58 internal \u6216 production \u8349\u7A3F\uFF0C\u4E0D\u9001\u5BA1\u3001\u4E0D\u5411\u6D4B\u8BD5\u7528\u6237\u6216\u751F\u4EA7\u7528\u6237\u5F00\u653E\u3002"
+  }
+};
+
+// src/credentials.ts
+function assertSafeCredentialMetadata(metadata) {
+  const keys = Object.keys(metadata);
+  const forbidden = keys.filter(
+    (key) => /secret|token|password|private|content|path|key$/i.test(key)
+  );
+  if (forbidden.length > 0) {
+    throw new Error(`\u51ED\u636E\u5143\u6570\u636E\u5305\u542B\u7981\u6B62\u5B57\u6BB5: ${forbidden.join(", ")}`);
+  }
+  if (!metadata.credentialProfile.trim()) {
+    throw new Error("credentialProfile \u4E0D\u80FD\u4E3A\u7A7A");
+  }
+}
+function assertCredentialProfileName(value) {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,79}$/.test(value)) {
+    throw new Error("credentialProfile \u53EA\u80FD\u5305\u542B\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u70B9\u3001\u4E0B\u5212\u7EBF\u548C\u8FDE\u5B57\u7B26\uFF0C\u957F\u5EA6\u4E0D\u8D85\u8FC7 80");
+  }
+}
+
+// src/credential-store.ts
+var VAULT_SCHEMA_VERSION = 1;
+var MASTER_KEY_ACCOUNT = "__vault_master_key_v1__";
+var DEFAULT_KEYCHAIN_SERVICE = "cn.huoye.app-ship.credentials.v1";
+var MAX_SECURITY_OUTPUT_BYTES = 1024 * 1024;
+var MAX_SECRET_VALUE_BYTES = 5 * 1024 * 1024;
+var MAX_VAULT_BYTES = 20 * 1024 * 1024;
+var DEFAULT_CREDENTIAL_VAULT_PATH = path.join(
+  process.env.APP_SHIP_HOME || path.join(homedir(), ".app-ship"),
+  "credentials.v1.json"
+);
+var MacOSKeychainSecretStore = class {
+  constructor(service = DEFAULT_KEYCHAIN_SERVICE, runner = runSecurity) {
+    this.service = service;
+    this.runner = runner;
+    if (process.platform !== "darwin") {
+      throw new Error("\u5F53\u524D\u5B89\u5168\u5B58\u50A8\u5782\u76F4\u5207\u7247\u4EC5\u9A8C\u8BC1 macOS Keychain");
+    }
+    assertSafeIdentifier(service, "Keychain service");
+  }
+  async getSecret(account) {
+    assertSafeIdentifier(account, "Keychain account");
+    const result = await this.runner([
+      "find-generic-password",
+      "-s",
+      this.service,
+      "-a",
+      account,
+      "-w"
+    ]);
+    if (result.code === 44) return void 0;
+    if (result.code !== 0) {
+      throw new Error("macOS Keychain \u8BFB\u53D6\u5931\u8D25\uFF0C\u8BF7\u786E\u8BA4\u5F53\u524D\u7528\u6237 Keychain \u5DF2\u89E3\u9501\u5E76\u5141\u8BB8\u8BBF\u95EE");
+    }
+    return result.stdout.replace(/[\r\n]+$/, "");
+  }
+  async setSecret(account, secret) {
+    assertSafeIdentifier(account, "Keychain account");
+    if (!secret) throw new Error("\u4E0D\u80FD\u5199\u5165\u7A7A\u79D8\u5BC6");
+    const result = await this.runner(
+      ["add-generic-password", "-U", "-s", this.service, "-a", account, "-w"],
+      `${secret}
+${secret}
+`
+    );
+    if (result.code !== 0) {
+      throw new Error("macOS Keychain \u5199\u5165\u5931\u8D25\uFF0C\u8BF7\u786E\u8BA4\u5F53\u524D\u7528\u6237 Keychain \u53EF\u7528");
+    }
+  }
+  async deleteSecret(account) {
+    assertSafeIdentifier(account, "Keychain account");
+    const result = await this.runner(["delete-generic-password", "-s", this.service, "-a", account]);
+    if (result.code === 44) return false;
+    if (result.code !== 0) {
+      throw new Error("macOS Keychain \u5220\u9664\u5931\u8D25");
+    }
+    return true;
+  }
+};
+var LocalCredentialProfileStore = class {
+  constructor(secretStore, vaultPath = DEFAULT_CREDENTIAL_VAULT_PATH) {
+    this.secretStore = secretStore;
+    this.vaultPath = vaultPath;
+  }
+  async listMetadata() {
+    const document = await this.readDocument();
+    return Object.values(document.profiles).map(({ metadata }) => ({ ...metadata })).sort((left, right) => left.credentialProfile.localeCompare(right.credentialProfile));
+  }
+  async getMetadata(credentialProfile) {
+    assertCredentialProfileName(credentialProfile);
+    const document = await this.readDocument();
+    const metadata = document.profiles[credentialProfile]?.metadata;
+    return metadata ? { ...metadata } : void 0;
+  }
+  async saveProfile(input, options = {}) {
+    return this.withWriteLock(() => this.saveProfileUnlocked(input, options));
+  }
+  async saveProfileUnlocked(input, options) {
+    assertCredentialProfileName(input.credentialProfile);
+    const document = await this.readDocument();
+    if (document.profiles[input.credentialProfile] && !options.overwrite) {
+      throw new Error(`credentialProfile \u5DF2\u5B58\u5728: ${input.credentialProfile}`);
+    }
+    const fields = validateFields(input.material.fields);
+    const files = await normalizeSecretFiles(input.material.files);
+    if (Object.keys(fields).length === 0 && Object.keys(files).length === 0) {
+      throw new Error("\u51ED\u636E\u6750\u6599\u4E0D\u80FD\u4E3A\u7A7A");
+    }
+    const metadata = {
+      credentialProfile: input.credentialProfile,
+      platform: input.platform,
+      configured: true,
+      verified: false,
+      storageKind: Object.keys(files).length > 0 ? "encrypted_local_vault" : "os_secure_storage"
+    };
+    assertSafeCredentialMetadata(metadata);
+    const encryptedFiles = Object.keys(files).length > 0 ? await this.encryptFiles(input.credentialProfile, input.platform, files) : void 0;
+    const previousSecret = await this.secretStore.getSecret(input.credentialProfile);
+    await this.secretStore.setSecret(input.credentialProfile, JSON.stringify(fields));
+    try {
+      document.profiles[input.credentialProfile] = {
+        metadata,
+        ...encryptedFiles ? { encryptedFiles } : {}
+      };
+      await this.writeDocument(document);
+    } catch (error) {
+      try {
+        await this.restoreSecret(input.credentialProfile, previousSecret);
+      } catch {
+        throw new Error("\u51ED\u636E vault \u5199\u5165\u5931\u8D25\u4E14 Keychain \u56DE\u6EDA\u672A\u5B8C\u6210\uFF0C\u8BF7\u505C\u6B62\u6267\u884C\u5E76\u4EBA\u5DE5\u68C0\u67E5");
+      }
+      throw error;
+    }
+    return { ...metadata };
+  }
+  async deleteProfile(credentialProfile) {
+    return this.withWriteLock(() => this.deleteProfileUnlocked(credentialProfile));
+  }
+  async deleteProfileUnlocked(credentialProfile) {
+    assertCredentialProfileName(credentialProfile);
+    const document = await this.readDocument();
+    const existingRecord = document.profiles[credentialProfile];
+    const previousSecret = await this.secretStore.getSecret(credentialProfile);
+    if (!existingRecord && previousSecret === void 0) return false;
+    await this.secretStore.deleteSecret(credentialProfile);
+    try {
+      delete document.profiles[credentialProfile];
+      await this.writeDocument(document);
+    } catch (error) {
+      try {
+        await this.restoreSecret(credentialProfile, previousSecret);
+      } catch {
+        throw new Error("\u51ED\u636E vault \u5220\u9664\u5931\u8D25\u4E14 Keychain \u56DE\u6EDA\u672A\u5B8C\u6210\uFF0C\u8BF7\u505C\u6B62\u6267\u884C\u5E76\u4EBA\u5DE5\u68C0\u67E5");
+      }
+      throw error;
+    }
+    return true;
+  }
+  /**
+   * 为可信本机调用读取当前平台材料；普通回显不解密文件，主动查看仅在本机返回内容。
+   * @param request - 明确平台、档案与用途；local_view 由用户点击查看触发，local_export 继续拒绝。
+   */
+  async resolveForLocalExecution(request) {
+    assertCredentialProfileName(request.credentialProfile);
+    if (request.purpose === "local_export") {
+      throw new Error("\u672C\u5730\u51ED\u636E\u5BFC\u51FA\u5C1A\u672A\u5B9E\u73B0\u8EAB\u4EFD\u786E\u8BA4\uFF0C\u5F53\u524D\u7981\u6B62\u5BFC\u51FA");
+    }
+    const document = await this.readDocument();
+    const record2 = document.profiles[request.credentialProfile];
+    if (!record2 || record2.metadata.platform !== request.platform) {
+      throw new Error("credentialProfile \u4E0D\u5B58\u5728\u6216\u4E0E\u76EE\u6807\u5E73\u53F0\u4E0D\u5339\u914D");
+    }
+    const serializedFields = await this.secretStore.getSecret(request.credentialProfile);
+    if (serializedFields === void 0) {
+      throw new Error("credentialProfile \u7684 Keychain \u6750\u6599\u7F3A\u5931");
+    }
+    const fields = parseStoredFields(serializedFields);
+    if (request.purpose === "local_display") return { fields };
+    const files = record2.encryptedFiles ? await this.decryptFiles(request.credentialProfile, request.platform, record2.encryptedFiles) : void 0;
+    return {
+      fields,
+      ...files ? {
+        files: Object.fromEntries(
+          Object.entries(files).map(([name, content]) => [name, { content }])
+        )
+      } : {}
+    };
+  }
+  async encryptFiles(credentialProfile, platform, files) {
+    const key = await this.getOrCreateMasterKey();
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", key, iv, { authTagLength: 16 });
+    cipher.setAAD(createAad(credentialProfile, platform));
+    const ciphertext = Buffer.concat([cipher.update(JSON.stringify(files), "utf8"), cipher.final()]);
+    return {
+      algorithm: "aes-256-gcm",
+      iv: iv.toString("base64"),
+      authTag: cipher.getAuthTag().toString("base64"),
+      ciphertext: ciphertext.toString("base64")
+    };
+  }
+  async decryptFiles(credentialProfile, platform, envelope) {
+    if (envelope.algorithm !== "aes-256-gcm") {
+      throw new Error("\u51ED\u636E vault \u4F7F\u7528\u4E86\u4E0D\u652F\u6301\u7684\u52A0\u5BC6\u7B97\u6CD5");
+    }
+    try {
+      const key = await this.getMasterKey();
+      const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(envelope.iv, "base64"), {
+        authTagLength: 16
+      });
+      decipher.setAAD(createAad(credentialProfile, platform));
+      decipher.setAuthTag(Buffer.from(envelope.authTag, "base64"));
+      const plaintext = Buffer.concat([
+        decipher.update(Buffer.from(envelope.ciphertext, "base64")),
+        decipher.final()
+      ]);
+      return validateFields(JSON.parse(plaintext.toString("utf8")));
+    } catch {
+      throw new Error("\u51ED\u636E vault \u5B8C\u6574\u6027\u6821\u9A8C\u5931\u8D25\uFF0C\u6587\u4EF6\u53EF\u80FD\u635F\u574F\u6216\u4E3B\u5BC6\u94A5\u4E0D\u5339\u914D");
+    }
+  }
+  async getOrCreateMasterKey() {
+    const existing = await this.secretStore.getSecret(MASTER_KEY_ACCOUNT);
+    if (existing) return decodeMasterKey(existing);
+    const key = randomBytes(32);
+    await this.secretStore.setSecret(MASTER_KEY_ACCOUNT, key.toString("base64"));
+    return key;
+  }
+  async getMasterKey() {
+    const value = await this.secretStore.getSecret(MASTER_KEY_ACCOUNT);
+    if (!value) throw new Error("\u51ED\u636E vault \u4E3B\u5BC6\u94A5\u7F3A\u5931");
+    return decodeMasterKey(value);
+  }
+  async restoreSecret(account, previousSecret) {
+    if (previousSecret === void 0) {
+      await this.secretStore.deleteSecret(account);
+    } else {
+      await this.secretStore.setSecret(account, previousSecret);
+    }
+  }
+  async readDocument() {
+    try {
+      const fileStat = await lstat(this.vaultPath);
+      if (fileStat.isSymbolicLink() || !fileStat.isFile()) {
+        throw new Error("\u51ED\u636E vault \u5FC5\u987B\u662F\u666E\u901A\u6587\u4EF6\u4E14\u4E0D\u80FD\u662F\u7B26\u53F7\u94FE\u63A5");
+      }
+      if (fileStat.size > MAX_VAULT_BYTES) throw new Error("\u51ED\u636E vault \u8D85\u8FC7\u5B89\u5168\u5927\u5C0F\u4E0A\u9650");
+      if ((fileStat.mode & 63) !== 0) {
+        throw new Error("\u51ED\u636E vault \u6743\u9650\u4E0D\u5B89\u5168\uFF0C\u8981\u6C42\u4EC5\u5F53\u524D\u7528\u6237\u53EF\u8BFB\u5199\uFF080600\uFF09");
+      }
+      const value = JSON.parse(await readFile(this.vaultPath, "utf8"));
+      return validateDocument(value);
+    } catch (error) {
+      if (error?.code === "ENOENT") return emptyDocument();
+      throw error;
+    }
+  }
+  /** 多个 Native Host/CLI 进程共享同一安全库，读改写必须排他；冲突明确失败，不覆盖或自动重试。 */
+  async withWriteLock(operation) {
+    const directory = path.dirname(this.vaultPath);
+    await mkdir(directory, { recursive: true, mode: 448 });
+    const directoryStat = await lstat(directory);
+    if (directoryStat.isSymbolicLink() || !directoryStat.isDirectory() || process.getuid && directoryStat.uid !== process.getuid()) {
+      throw new Error("\u51ED\u636E vault \u76EE\u5F55\u5FC5\u987B\u662F\u666E\u901A\u76EE\u5F55\u4E14\u4E0D\u80FD\u662F\u7B26\u53F7\u94FE\u63A5");
+    }
+    if (process.platform !== "win32" && (directoryStat.mode & 63) !== 0) {
+      throw new Error("\u51ED\u636E vault \u76EE\u5F55\u6743\u9650\u4E0D\u5B89\u5168\uFF0C\u8981\u6C42\u4EC5\u5F53\u524D\u7528\u6237\u53EF\u8BBF\u95EE\uFF080700\uFF09");
+    }
+    const lockPath = `${this.vaultPath}.write-lock`;
+    let lock;
+    try {
+      lock = await open(lockPath, "wx", 384);
+    } catch {
+      throw new Error("\u51ED\u636E\u5B89\u5168\u5E93\u6B63\u5728\u5199\u5165\u6216\u5B58\u5728\u672A\u6E05\u7406\u5199\u9501\uFF0C\u8BF7\u6838\u5BF9\u540E\u91CD\u8BD5");
+    }
+    try {
+      return await operation();
+    } finally {
+      await lock.close();
+      await unlink(lockPath);
+    }
+  }
+  async writeDocument(document) {
+    const temporaryPath = `${this.vaultPath}.tmp-${process.pid}-${randomBytes(6).toString("hex")}`;
+    try {
+      const handle = await open(temporaryPath, "wx", 384);
+      try {
+        await handle.writeFile(`${JSON.stringify(document, null, 2)}
+`, "utf8");
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      await rename(temporaryPath, this.vaultPath);
+      await chmod(this.vaultPath, 384);
+    } catch (error) {
+      await unlink(temporaryPath).catch(() => void 0);
+      throw error;
+    }
+  }
+};
+function createDefaultCredentialProfileStore(vaultPath = DEFAULT_CREDENTIAL_VAULT_PATH) {
+  if (process.platform !== "darwin") {
+    throw new Error("\u5F53\u524D\u7248\u672C\u4EC5\u5B8C\u6210 macOS Keychain \u5782\u76F4\u5207\u7247\uFF0CLinux/Windows \u5C1A\u672A\u9A8C\u8BC1");
+  }
+  return new LocalCredentialProfileStore(new MacOSKeychainSecretStore(), vaultPath);
+}
+async function runSecurity(args, input) {
+  return new Promise((resolve, reject) => {
+    const child = spawn("/usr/bin/security", args, {
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let outputBytes = 0;
+    const timeout = setTimeout(() => {
+      child.kill("SIGTERM");
+      reject(new Error("macOS Keychain \u64CD\u4F5C\u8D85\u65F6"));
+    }, 15e3);
+    child.stdout.on("data", (chunk) => {
+      outputBytes += chunk.length;
+      if (outputBytes > MAX_SECURITY_OUTPUT_BYTES) {
+        child.kill("SIGTERM");
+        return;
+      }
+      stdout += chunk.toString("utf8");
+    });
+    child.stderr.on("data", (chunk) => {
+      outputBytes += chunk.length;
+      if (outputBytes > MAX_SECURITY_OUTPUT_BYTES) child.kill("SIGTERM");
+    });
+    child.on("error", () => {
+      clearTimeout(timeout);
+      reject(new Error("\u65E0\u6CD5\u542F\u52A8 macOS security \u5DE5\u5177"));
+    });
+    child.on("close", (code) => {
+      clearTimeout(timeout);
+      if (outputBytes > MAX_SECURITY_OUTPUT_BYTES) {
+        reject(new Error("macOS Keychain \u8F93\u51FA\u8D85\u8FC7\u5B89\u5168\u4E0A\u9650"));
+        return;
+      }
+      resolve({ code: code ?? 1, stdout });
+    });
+    child.stdin.on("error", () => {
+    });
+    child.stdin.end(input);
+  });
+}
+async function normalizeSecretFiles(files) {
+  const result = {};
+  for (const [name, file] of Object.entries(files || {})) {
+    if (!/^[a-zA-Z0-9._-]{1,80}$/.test(name)) {
+      throw new Error(`\u6587\u4EF6\u578B\u51ED\u636E\u540D\u79F0\u4E0D\u5B89\u5168: ${name}`);
+    }
+    if (file.content && file.externalPath) {
+      throw new Error(`\u6587\u4EF6\u578B\u51ED\u636E ${name} \u4E0D\u80FD\u540C\u65F6\u63D0\u4F9B content \u4E0E externalPath`);
+    }
+    if (file.content !== void 0) {
+      if (!file.content) throw new Error(`\u6587\u4EF6\u578B\u51ED\u636E ${name} \u4E0D\u80FD\u4E3A\u7A7A`);
+      if (Buffer.byteLength(file.content, "utf8") > MAX_SECRET_VALUE_BYTES) {
+        throw new Error(`\u6587\u4EF6\u578B\u51ED\u636E ${name} \u8D85\u8FC7\u5B89\u5168\u5927\u5C0F\u4E0A\u9650`);
+      }
+      result[name] = file.content;
+      continue;
+    }
+    if (!file.externalPath) throw new Error(`\u6587\u4EF6\u578B\u51ED\u636E ${name} \u7F3A\u5C11\u5185\u5BB9\u6216\u8DEF\u5F84`);
+    const fileStat = await lstat(file.externalPath);
+    if (fileStat.isSymbolicLink() || !fileStat.isFile()) {
+      throw new Error(`\u5916\u90E8\u51ED\u636E\u8DEF\u5F84\u5FC5\u987B\u662F\u666E\u901A\u6587\u4EF6\u4E14\u4E0D\u80FD\u662F\u7B26\u53F7\u94FE\u63A5: ${name}`);
+    }
+    if (process.platform !== "win32" && (fileStat.mode & 63) !== 0) {
+      throw new Error(`\u5916\u90E8\u51ED\u636E\u6587\u4EF6\u6743\u9650\u4E0D\u5B89\u5168\uFF0C\u8981\u6C42 0600: ${name}`);
+    }
+    if (fileStat.size > MAX_SECRET_VALUE_BYTES) {
+      throw new Error(`\u5916\u90E8\u51ED\u636E\u6587\u4EF6\u8D85\u8FC7\u5B89\u5168\u5927\u5C0F\u4E0A\u9650: ${name}`);
+    }
+    const content = await readFile(file.externalPath, "utf8");
+    if (!content) throw new Error(`\u5916\u90E8\u51ED\u636E\u6587\u4EF6\u4E3A\u7A7A: ${name}`);
+    result[name] = content;
+  }
+  return result;
+}
+function validateFields(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("\u51ED\u636E\u5B57\u6BB5\u5FC5\u987B\u662F\u5B57\u7B26\u4E32\u5BF9\u8C61");
+  }
+  const result = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (!/^[a-zA-Z0-9._-]{1,80}$/.test(key) || ["__proto__", "prototype", "constructor"].includes(key) || typeof item !== "string") {
+      throw new Error("\u51ED\u636E\u5B57\u6BB5\u540D\u79F0\u6216\u503C\u4E0D\u5408\u6CD5");
+    }
+    if (Buffer.byteLength(item, "utf8") > MAX_SECRET_VALUE_BYTES) {
+      throw new Error(`\u51ED\u636E\u5B57\u6BB5\u8D85\u8FC7\u5B89\u5168\u5927\u5C0F\u4E0A\u9650: ${key}`);
+    }
+    result[key] = item;
+  }
+  return result;
+}
+function parseStoredFields(value) {
+  try {
+    return validateFields(JSON.parse(value));
+  } catch {
+    throw new Error("Keychain \u4E2D\u7684\u51ED\u636E\u5B57\u6BB5\u683C\u5F0F\u65E0\u6548");
+  }
+}
+function validateDocument(value) {
+  if (value?.schemaVersion !== VAULT_SCHEMA_VERSION || !value.profiles || typeof value.profiles !== "object" || Array.isArray(value.profiles)) {
+    throw new Error("\u51ED\u636E vault \u7248\u672C\u6216\u7ED3\u6784\u65E0\u6548");
+  }
+  for (const [name, record2] of Object.entries(value.profiles)) {
+    assertCredentialProfileName(name);
+    if (!record2 || typeof record2 !== "object" || Array.isArray(record2)) {
+      throw new Error("\u51ED\u636E vault \u7684 Profile \u7ED3\u6784\u65E0\u6548");
+    }
+    assertSafeCredentialMetadata(record2.metadata);
+    if (record2.metadata.credentialProfile !== name) {
+      throw new Error("\u51ED\u636E vault \u7684 Profile \u7D22\u5F15\u4E0D\u4E00\u81F4");
+    }
+    if (!(record2.metadata.platform in RELEASE_PLATFORM_CAPABILITIES) || typeof record2.metadata.configured !== "boolean" || typeof record2.metadata.verified !== "boolean" || !["os_secure_storage", "encrypted_local_vault", "external_file"].includes(
+      record2.metadata.storageKind
+    )) {
+      throw new Error("\u51ED\u636E vault \u7684\u5143\u6570\u636E\u65E0\u6548");
+    }
+    if (record2.encryptedFiles) validateEnvelope(record2.encryptedFiles);
+  }
+  return value;
+}
+function validateEnvelope(value) {
+  if (value?.algorithm !== "aes-256-gcm" || typeof value.iv !== "string" || typeof value.authTag !== "string" || typeof value.ciphertext !== "string") {
+    throw new Error("\u51ED\u636E vault \u7684\u52A0\u5BC6\u4FE1\u5C01\u65E0\u6548");
+  }
+}
+function emptyDocument() {
+  return { schemaVersion: VAULT_SCHEMA_VERSION, profiles: {} };
+}
+function createAad(credentialProfile, platform) {
+  return Buffer.from(`app-ship\0${VAULT_SCHEMA_VERSION}\0${platform}\0${credentialProfile}`, "utf8");
+}
+function decodeMasterKey(value) {
+  const key = Buffer.from(value, "base64");
+  if (key.length !== 32) throw new Error("\u51ED\u636E vault \u4E3B\u5BC6\u94A5\u957F\u5EA6\u65E0\u6548");
+  return key;
+}
+function assertSafeIdentifier(value, label) {
+  if (!/^[a-zA-Z0-9._-]{1,120}$/.test(value)) {
+    throw new Error(`${label} \u5305\u542B\u4E0D\u5B89\u5168\u5B57\u7B26`);
+  }
+}
+
+// src/credential-setup.ts
+import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto";
+import { constants as constants3 } from "fs";
+import { lstat as lstat2, mkdir as mkdir2, open as open2, readdir, realpath, rename as rename2, unlink as unlink2 } from "fs/promises";
+import path2 from "path";
+import yaml from "js-yaml";
+
+// src/preflight-http.ts
+var ProbeFailure = class extends Error {
+  /**
+   * 创建脱敏核验错误。
+   * @param code - 对外允许公开的失败分类。
+   */
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
+};
+async function jsonRequest(transport, url, init, allowNoContent = false) {
+  const response = await transport(url, { ...init, redirect: "error" });
+  if (response.status === 401) throw new ProbeFailure("invalid_credentials");
+  if (response.status === 404) throw new ProbeFailure("application_not_found");
+  if (response.status === 403) throw new ProbeFailure("rejected");
+  if (allowNoContent && response.status === 204) return {};
+  if (!response.ok || !response.body) throw new ProbeFailure("network_unavailable");
+  const reader = response.body.getReader();
+  const chunks = [];
+  let bytes = 0;
+  try {
+    for (; ; ) {
+      const next = await reader.read();
+      if (next.done) break;
+      bytes += next.value.length;
+      if (bytes > 1048576) {
+        await reader.cancel();
+        throw new ProbeFailure("invalid_response");
+      }
+      chunks.push(next.value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  let result;
+  try {
+    result = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    throw new ProbeFailure("invalid_response");
+  }
+  if (!result || typeof result !== "object" || Array.isArray(result))
+    throw new ProbeFailure("invalid_response");
+  return result;
+}
+
+// src/remaining-store-preflight.ts
+import {
+  constants,
+  createHash,
+  createHmac,
+  createPublicKey as createPublicKey2,
+  publicEncrypt,
+  sign as sign2
+} from "crypto";
+
+// src/credential-file-material.ts
+import { createPrivateKey, createPublicKey, X509Certificate, sign } from "crypto";
+function parseGoogleServiceAccount(content) {
+  try {
+    const value = JSON.parse(content);
+    if (value.type !== "service_account" || !/^[^\s@]+@[^\s@]+\.iam\.gserviceaccount\.com$/u.test(value.client_email) || typeof value.private_key !== "string" || value.token_uri !== void 0 && value.token_uri !== "https://oauth2.googleapis.com/token" || createPrivateKey(value.private_key).asymmetricKeyType !== "rsa")
+      throw new Error();
+    return value;
+  } catch {
+    throw new Error("invalid_service_account");
+  }
+}
+function normalizeXiaomiPublicKey(content) {
+  try {
+    let key;
+    try {
+      key = new X509Certificate(content).publicKey;
+    } catch {
+      key = createPublicKey(
+        content.includes("-----BEGIN") ? content : `-----BEGIN PUBLIC KEY-----
+${content}
+-----END PUBLIC KEY-----`
+      );
+    }
+    if (key.asymmetricKeyType !== "rsa" || /PRIVATE KEY/u.test(content)) throw new Error();
+    return key.export({ type: "spki", format: "pem" }).toString();
+  } catch {
+    throw new Error("invalid_public_key");
+  }
+}
+function appleCredentialToken(fields, content) {
+  if (!/^[A-Za-z0-9]{10}$/u.test(fields.apiKeyId || "") || !/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/iu.test(fields.apiIssuerId || ""))
+    throw new Error("invalid_apple_key");
+  const key = createPrivateKey(content);
+  if (key.asymmetricKeyType !== "ec" || key.asymmetricKeyDetails?.namedCurve !== "prime256v1")
+    throw new Error("invalid_apple_key");
+  const now = Math.floor(Date.now() / 1e3);
+  const header = Buffer.from(
+    JSON.stringify({ alg: "ES256", kid: fields.apiKeyId, typ: "JWT" })
+  ).toString("base64url");
+  const payload = Buffer.from(
+    JSON.stringify({
+      iss: fields.apiIssuerId,
+      aud: "appstoreconnect-v1",
+      iat: now,
+      exp: now + 600
+    })
+  ).toString("base64url");
+  const body = `${header}.${payload}`;
+  return `${body}.${sign("sha256", Buffer.from(body), { key, dsaEncoding: "ieee-p1363" }).toString("base64url")}`;
+}
+function importedCredentialMaterial(platform, content, fields) {
+  if (Buffer.byteLength(content) > 65536 || !content.trim())
+    throw new Error("invalid_credential_file");
+  if (platform === "google_play") {
+    if (Object.keys(fields).length) throw new Error("invalid_import_fields");
+    const value = parseGoogleServiceAccount(content);
+    return { fields: {}, files: { serviceAccountJson: { content: JSON.stringify(value) } } };
+  }
+  const expected = platform === "app_store" ? ["apiIssuerId", "apiKeyId", "appleId", "appPassword"] : platform === "xiaomi" ? ["userName", "privateKey"] : [];
+  if (!expected.length || Object.keys(fields).length !== expected.length || expected.some(
+    (key) => typeof fields[key] !== "string" || !fields[key].trim() || fields[key].length > 8192 || /[\r\n\0*•●]/u.test(fields[key])
+  ))
+    throw new Error("invalid_import_fields");
+  if (platform === "app_store") {
+    try {
+      appleCredentialToken(fields, content);
+    } catch {
+      throw new Error("invalid_apple_key");
+    }
+    return { fields, files: { privateKey: { content } } };
+  }
+  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/u.test(fields.userName)) throw new Error("invalid_import_fields");
+  return { fields, files: { publicKey: { content: normalizeXiaomiPublicKey(content) } } };
+}
+
+// src/remaining-store-preflight.ts
+function hmac(fields, secret) {
+  return createHmac("sha256", secret).update(
+    Object.keys(fields).sort().map((key) => `${key}=${fields[key]}`).join("&")
+  ).digest("hex");
+}
+async function preflightRemainingStore(input, store, result, transport, signal) {
+  let material;
+  try {
+    material = await store.resolveForLocalExecution({
+      platform: input.platform,
+      credentialProfile: input.credentialProfile,
+      purpose: "verify"
+    });
+  } catch {
+    return result;
+  }
+  const fields = material.fields;
+  const field = (name) => {
+    const value = fields[name];
+    if (!value || value.length > 8192 || /[\r\n\0]/u.test(value))
+      throw new ProbeFailure("invalid_credentials");
+    return value;
+  };
+  const request = (url, init = {}) => jsonRequest(transport, url, { ...init, signal });
+  const matchPackage = (value) => {
+    if (typeof value !== "string" || !value) throw new ProbeFailure("invalid_response");
+    if (value !== input.packageName) throw new ProbeFailure("application_mismatch");
+  };
+  const matchId = (value) => {
+    if (typeof value !== "string" || !/^\d{1,32}$/u.test(value))
+      throw new ProbeFailure("invalid_response");
+    if (input.appId && value !== input.appId) throw new ProbeFailure("application_mismatch");
+    result.appId = value;
+  };
+  if (signal.aborted) throw new ProbeFailure("network_unavailable");
+  if (input.platform === "oppo") {
+    const authUrl = new URL("https://oop-openapi-cn.heytapmobi.com/developer/v1/token");
+    authUrl.search = new URLSearchParams({
+      client_id: field("clientId"),
+      client_secret: field("clientSecret")
+    }).toString();
+    const auth = await request(authUrl);
+    if (auth.errno !== 0)
+      throw new ProbeFailure(
+        Number.isInteger(auth.errno) ? "invalid_credentials" : "invalid_response"
+      );
+    const token = auth.data?.access_token;
+    if (typeof token !== "string" || !token || /[\r\n\0]/u.test(token))
+      throw new ProbeFailure("invalid_response");
+    result.authentication = "verified";
+    const params = {
+      access_token: token,
+      pkg_name: input.packageName,
+      timestamp: String(Math.floor(Date.now() / 1e3))
+    };
+    const url = new URL("https://oop-openapi-cn.heytapmobi.com/resource/v1/app/info");
+    url.search = new URLSearchParams({
+      ...params,
+      api_sign: hmac(params, field("clientSecret"))
+    }).toString();
+    const response = await request(url);
+    if (response.errno !== 0)
+      throw new ProbeFailure(Number.isInteger(response.errno) ? "rejected" : "invalid_response");
+    matchPackage(response.data?.pkg_name);
+    matchId(response.data?.app_id);
+  } else if (input.platform === "vivo") {
+    const params = {
+      method: "app.query.details",
+      access_key: field("accessKey"),
+      timestamp: String(Date.now()),
+      format: "json",
+      v: "1.0",
+      sign_method: "HMAC-SHA256",
+      target_app_key: "developer",
+      packageName: input.packageName
+    };
+    const response = await request(new URL("https://developer-api.vivo.com.cn/router/rest"), {
+      method: "POST",
+      body: new URLSearchParams({ ...params, sign: hmac(params, field("accessSecret")) })
+    });
+    if (!Number.isInteger(response.code)) throw new ProbeFailure("invalid_response");
+    if (response.code !== 0)
+      throw new ProbeFailure(response.code === 10001 ? "invalid_credentials" : "rejected");
+    result.authentication = "verified";
+    if (response.subCode !== void 0 && response.subCode !== "0" && response.subCode !== 0)
+      throw new ProbeFailure(
+        String(response.subCode) === "11001" ? "application_not_found" : "rejected"
+      );
+    matchPackage(response.data?.packageName);
+  } else if (input.platform === "tencent") {
+    const appId = field("appId");
+    if (!/^\d{1,32}$/u.test(appId)) throw new ProbeFailure("invalid_credentials");
+    if (input.appId && input.appId !== appId) throw new ProbeFailure("application_mismatch");
+    const params = {
+      user_id: field("userId"),
+      timestamp: String(Math.floor(Date.now() / 1e3)),
+      app_id: appId,
+      pkg_name: input.packageName
+    };
+    const response = await request(
+      new URL("https://p.open.qq.com/open_file/developer_api/query_app_detail"),
+      {
+        method: "POST",
+        body: new URLSearchParams({ ...params, sign: hmac(params, field("accessSecret")) })
+      }
+    );
+    if (!Number.isInteger(response.ret)) throw new ProbeFailure("invalid_response");
+    if (response.ret !== 0)
+      throw new ProbeFailure(
+        [1000019, 1000020].includes(Number(response.ret)) ? "invalid_credentials" : [1000008, 3000002].includes(Number(response.ret)) ? "application_not_found" : [1000009, 3000003].includes(Number(response.ret)) ? "application_mismatch" : "rejected"
+      );
+    result.authentication = "verified";
+    matchPackage(response.pkg_name);
+  } else if (input.platform === "xiaomi") {
+    let publicKey;
+    try {
+      publicKey = createPublicKey2(
+        normalizeXiaomiPublicKey(material.files?.publicKey?.content || "")
+      );
+    } catch {
+      throw new ProbeFailure("invalid_credentials");
+    }
+    const data = JSON.stringify({ userName: field("userName"), packageName: input.packageName });
+    const signature = Buffer.from(
+      JSON.stringify({
+        sig: [{ name: "RequestData", hash: createHash("md5").update(data).digest("hex") }],
+        password: field("privateKey")
+      })
+    );
+    const block = Math.ceil((publicKey.asymmetricKeyDetails?.modulusLength || 1024) / 8) - 11;
+    const parts = [];
+    for (let i = 0; i < signature.length; i += block)
+      parts.push(
+        publicEncrypt(
+          { key: publicKey, padding: constants.RSA_PKCS1_PADDING },
+          signature.subarray(i, i + block)
+        )
+      );
+    const body = new FormData();
+    body.set("RequestData", data);
+    body.set("SIG", Buffer.concat(parts).toString("hex"));
+    const response = await request(
+      new URL("https://api.developer.xiaomi.com/devupload/dev/query"),
+      { method: "POST", body }
+    );
+    if (!Number.isInteger(response.result)) throw new ProbeFailure("invalid_response");
+    if (response.result !== 0)
+      throw new ProbeFailure(response.result === -20014 ? "invalid_credentials" : "rejected");
+    result.authentication = "verified";
+    if (!response.packageInfo) throw new ProbeFailure("application_not_found");
+    matchPackage(response.packageInfo?.packageName);
+  } else if (input.platform === "app_store") {
+    if ((fields.appleId || fields.appPassword) && !fields.apiKeyId && !fields.apiIssuerId && !material.files?.privateKey?.content)
+      return { ...result, code: "unsupported_credential_method" };
+    let token;
+    try {
+      token = appleCredentialToken(fields, material.files?.privateKey?.content || "");
+    } catch {
+      throw new ProbeFailure("invalid_credentials");
+    }
+    const url = new URL("https://api.appstoreconnect.apple.com/v1/apps");
+    url.search = new URLSearchParams({
+      "filter[bundleId]": input.packageName,
+      limit: "2",
+      "fields[apps]": "bundleId"
+    }).toString();
+    const response = await request(url, { headers: { Authorization: `Bearer ${token}` } });
+    if (!Array.isArray(response.data)) throw new ProbeFailure("invalid_response");
+    result.authentication = "verified";
+    if (!response.data.length) throw new ProbeFailure("application_not_found");
+    if (response.data.length !== 1 || response.links?.next)
+      throw new ProbeFailure("ambiguous_application");
+    matchPackage(response.data[0]?.attributes?.bundleId);
+    matchId(response.data[0]?.id);
+  } else if (input.platform === "google_play") {
+    let account, assertion;
+    try {
+      account = parseGoogleServiceAccount(material.files?.serviceAccountJson?.content || "");
+      const now = Math.floor(Date.now() / 1e3);
+      const header = Buffer.from(JSON.stringify({ alg: "RS256", typ: "JWT" })).toString("base64url");
+      const payload = Buffer.from(
+        JSON.stringify({
+          iss: account.client_email,
+          scope: "https://www.googleapis.com/auth/androidpublisher",
+          aud: "https://oauth2.googleapis.com/token",
+          iat: now,
+          exp: now + 600
+        })
+      ).toString("base64url");
+      const body = `${header}.${payload}`;
+      assertion = `${body}.${sign2("RSA-SHA256", Buffer.from(body), account.private_key).toString("base64url")}`;
+    } catch {
+      throw new ProbeFailure("invalid_credentials");
+    }
+    const auth = await request(new URL("https://oauth2.googleapis.com/token"), {
+      method: "POST",
+      body: new URLSearchParams({
+        grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+        assertion
+      })
+    });
+    if (typeof auth.access_token !== "string" || !auth.access_token || /[\r\n\0]/u.test(auth.access_token))
+      throw new ProbeFailure("invalid_credentials");
+    result.authentication = "verified";
+    const response = await jsonRequest(
+      transport,
+      new URL(
+        `https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${encodeURIComponent(input.packageName)}/deviceTierConfigs?pageSize=1`
+      ),
+      { headers: { Authorization: `Bearer ${auth.access_token}` }, signal },
+      // 此固定包名 GET 的真实成功空结果使用 204；不能放宽 token 或其他平台的正文校验。
+      true
+    );
+    if (Object.keys(response).some((key) => !["deviceTierConfigs", "nextPageToken"].includes(key)) || response.deviceTierConfigs !== void 0 && !Array.isArray(response.deviceTierConfigs))
+      throw new ProbeFailure("invalid_response");
+  } else throw new ProbeFailure("invalid_response");
+  if (signal.aborted) throw new ProbeFailure("network_unavailable");
+  return { ...result, verified: true, code: "verified", application: "matched" };
+}
+
+// src/store-publishing.ts
+import { createHash as createHash2, createPrivateKey as createPrivateKey2, randomUUID, sign as sign3 } from "crypto";
+var StorePublishingError = class extends Error {
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
+};
+var storeRecord = (value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new StorePublishingError("invalid_response");
+  return value;
+};
+function storeIdentifier(value) {
+  if (typeof value === "number" && Number.isSafeInteger(value) && value >= 0) return String(value);
+  if (typeof value === "string" && /^[A-Za-z0-9._-]{1,160}$/u.test(value)) return value;
+  throw new StorePublishingError("invalid_response");
+}
+function credentialField(value) {
+  if (typeof value !== "string" || !value || value.length > 8192 || /[\r\n\0]/u.test(value))
+    throw new StorePublishingError("invalid_credentials");
+  return value;
+}
+function createSamsungJwt(accountId, privateKey, now = Date.now()) {
+  credentialField(accountId);
+  let key;
+  try {
+    key = createPrivateKey2(privateKey);
+  } catch {
+    throw new StorePublishingError("invalid_credentials");
+  }
+  if (key.asymmetricKeyType !== "rsa" || (key.asymmetricKeyDetails?.modulusLength ?? 0) < 2048)
+    throw new StorePublishingError("invalid_credentials");
+  const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+  const iat = Math.floor(now / 1e3);
+  const unsigned = `${encode({ alg: "RS256", typ: "JWT" })}.${encode({ iss: accountId, scopes: ["publishing"], iat, exp: iat + 1200 })}`;
+  return `${unsigned}.${sign3("RSA-SHA256", Buffer.from(unsigned), key).toString("base64url")}`;
+}
+function createMeizuHeaders(clientId, clientSecret, uri, accessToken, timestamp = String(Date.now()), traceId = randomUUID()) {
+  const fields = { traceId, clientId, timestamp, uri };
+  const unsigned = Object.entries(fields).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `${key}=${value}`).join("&");
+  return {
+    traceId,
+    clientId,
+    timestamp,
+    accessToken,
+    sign: createHash2("sha256").update(`${unsigned}:${clientSecret}`).digest("hex")
+  };
+}
+var StorePublishingClient = class {
+  constructor(platform, material, transport = globalThis.fetch, signal) {
+    this.platform = platform;
+    this.material = material;
+    this.transport = transport;
+    this.signal = signal;
+  }
+  token = "";
+  authenticated = false;
+  get authenticationVerified() {
+    return this.authenticated;
+  }
+  headers(uri) {
+    if (!this.token) throw new StorePublishingError("invalid_credentials");
+    const fields = this.material.fields;
+    if (this.platform === "meizu")
+      return createMeizuHeaders(
+        credentialField(fields.clientId),
+        credentialField(fields.clientSecret),
+        uri,
+        this.token
+      );
+    return {
+      Authorization: `Bearer ${this.token}`,
+      ...this.platform === "samsung" ? { "service-account-id": credentialField(fields.serviceAccountId) } : {}
+    };
+  }
+  url(uri, query = {}) {
+    const origin = this.platform === "honor" ? "https://appmarket-openapi-drcn.cloud.honor.com" : this.platform === "meizu" ? "https://developer.meizu.com" : "https://devapi.samsungapps.com";
+    const url = new URL(uri, origin);
+    if (url.origin !== origin) throw new StorePublishingError("invalid_response");
+    for (const [key, value] of Object.entries(query)) url.searchParams.set(key, value);
+    return url;
+  }
+  async request(url, init) {
+    this.signal?.throwIfAborted();
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    this.signal?.addEventListener("abort", abort, { once: true });
+    const timer = setTimeout(abort, 2e4);
+    try {
+      const response = await this.transport(url, {
+        ...init,
+        redirect: "error",
+        signal: controller.signal
+      });
+      if (response.status === 401) throw new StorePublishingError("invalid_credentials");
+      if (response.status === 403) throw new StorePublishingError("rejected");
+      if (!response.ok || !response.body) throw new StorePublishingError("network_unavailable");
+      const reader = response.body.getReader();
+      const chunks = [];
+      let size = 0;
+      try {
+        for (; ; ) {
+          const part = await reader.read();
+          if (part.done) break;
+          size += part.value.length;
+          if (size > 1048576) {
+            await reader.cancel();
+            throw new StorePublishingError("invalid_response");
+          }
+          chunks.push(part.value);
+        }
+      } finally {
+        reader.releaseLock();
+      }
+      try {
+        return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+      } catch {
+        throw new StorePublishingError("invalid_response");
+      }
+    } catch (error) {
+      if (error instanceof StorePublishingError) throw error;
+      throw new StorePublishingError(this.signal?.aborted ? "cancelled" : "network_unavailable");
+    } finally {
+      clearTimeout(timer);
+      this.signal?.removeEventListener("abort", abort);
+    }
+  }
+  async authenticate() {
+    const fields = this.material.fields;
+    if (this.platform === "honor") {
+      const response = storeRecord(
+        await this.request(new URL("https://iam.developer.honor.com/auth/token"), {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: new URLSearchParams({
+            grant_type: "client_credentials",
+            client_id: credentialField(fields.clientId),
+            client_secret: credentialField(fields.clientSecret)
+          })
+        })
+      );
+      this.token = credentialField(response.access_token);
+    } else if (this.platform === "meizu") {
+      const response = storeRecord(
+        await this.request(this.url("/open/api/v1/token"), {
+          method: "GET",
+          headers: {
+            clientId: credentialField(fields.clientId),
+            clientSecret: credentialField(fields.clientSecret)
+          }
+        })
+      );
+      if (response.code !== 200) throw new StorePublishingError("invalid_credentials");
+      this.token = credentialField(storeRecord(response.value).accessToken);
+    } else {
+      const privateKey = this.material.files?.privateKey?.content;
+      if (!privateKey) throw new StorePublishingError("invalid_credentials");
+      const jwt = createSamsungJwt(credentialField(fields.serviceAccountId), privateKey);
+      const response = storeRecord(
+        await this.request(this.url("/auth/accessToken"), {
+          method: "POST",
+          headers: { "Content-Type": "application/json", Authorization: `Bearer ${jwt}` }
+        })
+      );
+      if (response.ok !== true) throw new StorePublishingError("invalid_credentials");
+      this.token = credentialField(storeRecord(response.createdItem).accessToken);
+    }
+    this.authenticated = true;
+  }
+  /** 通用请求仅接受本适配器固定域名上的相对路径。 */
+  async json(uri, query = {}, body) {
+    return this.request(this.url(uri, query), {
+      method: body === void 0 ? "GET" : "POST",
+      headers: {
+        ...this.headers(uri),
+        ...body === void 0 ? {} : { "Content-Type": "application/json" }
+      },
+      ...body === void 0 ? {} : { body: JSON.stringify(body) }
+    });
+  }
+  /** 精确包名匹配；列表不完整、多候选或既有应用 ID 冲突时均停止。 */
+  async application(packageName, expectedAppId) {
+    let matches = [];
+    if (this.platform === "honor") {
+      const response = storeRecord(
+        await this.json("/openapi/v1/publish/get-app-id", { pkgName: packageName })
+      );
+      if (response.code !== 0) throw new StorePublishingError("rejected");
+      if (!Array.isArray(response.data)) throw new StorePublishingError("invalid_response");
+      matches = response.data.map(storeRecord).filter((item) => item.packageName === packageName).map((item) => ({ appId: storeIdentifier(item.appId), packageName }));
+    } else if (this.platform === "meizu") {
+      for (let start = 0; ; start += 10) {
+        if (start >= 1e3) throw new StorePublishingError("lookup_limit_exceeded");
+        const response = storeRecord(
+          await this.json("/open/api/v1/app/list", { start: String(start), limit: "10" })
+        );
+        if (response.code !== 200) throw new StorePublishingError("rejected");
+        const value = storeRecord(response.value);
+        if (!Array.isArray(value.data) || !Number.isSafeInteger(value.total) || value.total < 0 || value.data.length > 10)
+          throw new StorePublishingError("invalid_response");
+        matches.push(
+          ...value.data.map(storeRecord).filter((item) => item.pkgName === packageName).map((item) => ({ appId: storeIdentifier(item.id), packageName }))
+        );
+        if (start + value.data.length >= value.total) break;
+        if (!value.data.length) throw new StorePublishingError("invalid_response");
+      }
+    } else {
+      const list = expectedAppId ? [{ contentId: expectedAppId }] : await this.json("/seller/contentList");
+      if (!Array.isArray(list)) throw new StorePublishingError("invalid_response");
+      if (list.length > 100) throw new StorePublishingError("lookup_limit_exceeded");
+      for (const item of list) {
+        const contentId = storeIdentifier(storeRecord(item).contentId);
+        if (!/^\d{12}$/u.test(contentId)) throw new StorePublishingError("invalid_response");
+        const details = await this.json("/seller/contentInfo", { contentId });
+        if (!Array.isArray(details) || details.length !== 1)
+          throw new StorePublishingError("invalid_response");
+        const detail = storeRecord(details[0]);
+        if (storeIdentifier(detail.contentId) !== contentId || !Array.isArray(detail.binaryList))
+          throw new StorePublishingError("invalid_response");
+        const packages = new Set(
+          detail.binaryList.map(storeRecord).map((binary) => binary.packageName)
+        );
+        if (packages.has(packageName)) {
+          if (packages.size !== 1) throw new StorePublishingError("application_mismatch");
+          matches.push({ appId: contentId, packageName, detail });
+        }
+      }
+    }
+    if (!matches.length)
+      throw new StorePublishingError(
+        expectedAppId && this.platform === "samsung" ? "application_mismatch" : "application_not_found"
+      );
+    if (matches.length !== 1) throw new StorePublishingError("ambiguous_application");
+    if (!/^\d{1,32}$/u.test(matches[0].appId)) throw new StorePublishingError("invalid_response");
+    if (expectedAppId && matches[0].appId !== expectedAppId)
+      throw new StorePublishingError("application_mismatch");
+    return matches[0];
+  }
+};
+
+// src/huawei-authorization.ts
+import { constants as constants2, createPrivateKey as createPrivateKey3, sign as sign4 } from "crypto";
+function parseHuaweiServiceAccount(content) {
+  if (Buffer.byteLength(content) > 65536) throw new Error("invalid_service_account");
+  let account;
+  try {
+    account = JSON.parse(content);
+  } catch {
+    throw new Error("invalid_service_account");
+  }
+  if (!account || typeof account !== "object" || Array.isArray(account))
+    throw new Error("invalid_service_account");
+  const value = account;
+  for (const key of ["key_id", "sub_account"]) {
+    if (typeof value[key] !== "string" || !/^[A-Za-z0-9_-]{1,160}$/u.test(value[key]))
+      throw new Error("invalid_service_account");
+  }
+  if (typeof value.private_key !== "string" || !value.private_key.startsWith("-----BEGIN PRIVATE KEY-----"))
+    throw new Error("invalid_service_account");
+  try {
+    const key = createPrivateKey3(value.private_key);
+    if (key.asymmetricKeyType !== "rsa" || (key.asymmetricKeyDetails?.modulusLength ?? 0) < 2048)
+      throw new Error();
+  } catch {
+    throw new Error("invalid_service_account");
+  }
+  return {
+    key_id: value.key_id,
+    sub_account: value.sub_account,
+    private_key: value.private_key
+  };
+}
+function createHuaweiServiceAccountToken(content, now = Date.now()) {
+  const account = parseHuaweiServiceAccount(content);
+  const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+  const iat = Math.floor(now / 1e3);
+  const unsigned = `${encode({ kid: account.key_id, typ: "JWT", alg: "PS256" })}.${encode({
+    aud: "https://oauth-login.cloud.huawei.com/oauth2/v3/token",
+    iss: account.sub_account,
+    iat,
+    exp: iat + 3600
+  })}`;
+  const signature = sign4("sha256", Buffer.from(unsigned), {
+    key: account.private_key,
+    padding: constants2.RSA_PKCS1_PSS_PADDING,
+    saltLength: 32
+  }).toString("base64url");
+  return `${unsigned}.${signature}`;
+}
+
+// src/publish-preflight.ts
+var PREFLIGHT_PLATFORMS = [
+  "huawei",
+  "harmony",
+  "pgyer",
+  "honor",
+  "meizu",
+  "samsung",
+  "xiaomi",
+  "oppo",
+  "vivo",
+  "tencent",
+  "app_store",
+  "google_play"
+];
+var record = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+var safeField = (value) => typeof value === "string" && value.length > 0 && value.length <= 8192 && !/[\r\n\0]/u.test(value);
+function assertPublishPackageName(value, platform) {
+  const pattern = platform === "app_store" ? /^[A-Za-z0-9][A-Za-z0-9-]*(?:\.[A-Za-z0-9-]+)+$/u : /^[A-Za-z][A-Za-z0-9_]*(?:\.[A-Za-z][A-Za-z0-9_]*)+$/u;
+  if (value.length > 256 || !pattern.test(value)) {
+    throw new Error("invalid_package_name");
+  }
+}
+async function preflightPublish(input, store, signal, transport = globalThis.fetch) {
+  assertCredentialProfileName(input.credentialProfile);
+  assertPublishPackageName(input.packageName, input.platform);
+  if (!PREFLIGHT_PLATFORMS.includes(input.platform)) throw new Error("unsupported_platform");
+  if (input.appId !== void 0 && !/^\d{1,32}$/u.test(input.appId))
+    throw new Error("invalid_app_id");
+  const result = {
+    platform: input.platform,
+    credentialProfile: input.credentialProfile,
+    packageName: input.packageName,
+    verified: false,
+    code: "credentials_unavailable",
+    checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    authentication: "not_verified",
+    application: input.platform === "pgyer" ? "not_required" : "not_verified",
+    uploadPermission: "not_verified"
+  };
+  if (signal?.aborted) return { ...result, code: "cancelled" };
+  const controller = new AbortController();
+  const cancel = () => controller.abort();
+  signal?.addEventListener("abort", cancel, { once: true });
+  const deadline = setTimeout(cancel, 2e4);
+  try {
+    if (["xiaomi", "oppo", "vivo", "tencent", "app_store", "google_play"].includes(input.platform)) {
+      return await preflightRemainingStore(input, store, result, transport, controller.signal);
+    }
+    if (input.platform === "honor" || input.platform === "meizu" || input.platform === "samsung") {
+      let material;
+      try {
+        material = await store.resolveForLocalExecution({
+          credentialProfile: input.credentialProfile,
+          platform: input.platform,
+          purpose: "verify"
+        });
+      } catch {
+        return result;
+      }
+      const client = new StorePublishingClient(
+        input.platform,
+        material,
+        transport,
+        controller.signal
+      );
+      try {
+        await client.authenticate();
+        result.authentication = "verified";
+        const app = await client.application(input.packageName, input.appId);
+        return {
+          ...result,
+          verified: true,
+          code: "verified",
+          appId: app.appId,
+          application: "matched"
+        };
+      } catch (error) {
+        return {
+          ...result,
+          code: signal?.aborted ? "cancelled" : error instanceof StorePublishingError ? error.code : "network_unavailable"
+        };
+      }
+    }
+    let fields;
+    let serviceAccountJson;
+    try {
+      const material = await store.resolveForLocalExecution({
+        credentialProfile: input.credentialProfile,
+        platform: input.platform,
+        purpose: "verify"
+      });
+      fields = material.fields;
+      serviceAccountJson = material.files?.serviceAccountJson?.content;
+    } catch {
+      return result;
+    }
+    if (controller.signal.aborted)
+      throw new ProbeFailure(signal?.aborted ? "cancelled" : "network_unavailable");
+    if (input.platform === "pgyer") {
+      if (!safeField(fields.apiKey)) return result;
+      const response = await jsonRequest(
+        transport,
+        new URL("https://www.pgyer.com/apiv2/app/listMy"),
+        {
+          method: "POST",
+          signal: controller.signal,
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: new URLSearchParams({ _api_key: fields.apiKey, page: "1" })
+        }
+      );
+      if (!Number.isSafeInteger(response.code)) throw new ProbeFailure("invalid_response");
+      if (response.code !== 0)
+        throw new ProbeFailure(
+          [1001, 1002].includes(Number(response.code)) ? "invalid_credentials" : "rejected"
+        );
+      result.authentication = "verified";
+    } else {
+      let token;
+      if (serviceAccountJson) {
+        try {
+          token = createHuaweiServiceAccountToken(serviceAccountJson);
+        } catch {
+          return result;
+        }
+      } else {
+        if (!safeField(fields.clientId) || !safeField(fields.clientSecret)) return result;
+        const auth = await jsonRequest(
+          transport,
+          new URL("https://connect-api.cloud.huawei.com/api/oauth2/v1/token"),
+          {
+            method: "POST",
+            signal: controller.signal,
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+              grant_type: "client_credentials",
+              client_id: fields.clientId,
+              client_secret: fields.clientSecret
+            })
+          }
+        );
+        token = auth.access_token ?? auth.token;
+      }
+      if (!safeField(token)) throw new ProbeFailure("invalid_credentials");
+      if (!serviceAccountJson) result.authentication = "verified";
+      const url = new URL("https://connect-api.cloud.huawei.com/api/publish/v2/appid-list");
+      url.searchParams.set("packageName", input.packageName);
+      url.searchParams.set("packageTypes", input.platform === "harmony" ? "7" : "1");
+      const response = await jsonRequest(transport, url, {
+        method: "GET",
+        signal: controller.signal,
+        headers: {
+          Authorization: `Bearer ${token}`,
+          ...!serviceAccountJson ? { client_id: fields.clientId } : {}
+        }
+      });
+      let ret = response.ret;
+      if (typeof ret === "string") {
+        try {
+          ret = JSON.parse(ret);
+        } catch {
+          throw new ProbeFailure("invalid_response");
+        }
+      }
+      if (!record(ret) || ret.code !== 0) throw new ProbeFailure("rejected");
+      result.authentication = "verified";
+      const entries = response.appids ?? [];
+      if (!Array.isArray(entries) || entries.length > 1e3)
+        throw new ProbeFailure("invalid_response");
+      if (!entries.length) throw new ProbeFailure("application_not_found");
+      if (entries.length !== 1) throw new ProbeFailure("ambiguous_application");
+      if (!record(entries[0])) throw new ProbeFailure("invalid_response");
+      const appId = entries[0].value;
+      if (typeof appId !== "string" || !/^\d{1,32}$/u.test(appId))
+        throw new ProbeFailure("invalid_response");
+      if (input.appId && input.appId !== appId) throw new ProbeFailure("application_mismatch");
+      result.appId = appId;
+      result.application = "matched";
+    }
+    if (controller.signal.aborted)
+      throw new ProbeFailure(signal?.aborted ? "cancelled" : "network_unavailable");
+    return { ...result, verified: true, code: "verified" };
+  } catch (error) {
+    return {
+      ...result,
+      code: signal?.aborted ? "cancelled" : error instanceof ProbeFailure ? error.code : "network_unavailable"
+    };
+  } finally {
+    clearTimeout(deadline);
+    signal?.removeEventListener("abort", cancel);
+  }
+}
+
+// src/credential-setup.ts
+var CREDENTIAL_CONSOLES = {
+  huawei: "https://developer.huawei.com/consumer/cn/hdc-console/index.html#/home/101653523124950083",
+  harmony: "https://developer.huawei.com/consumer/cn/hdc-console/index.html#/home/101653523124950083",
+  pgyer: "https://www.pgyer.com/account/api",
+  honor: "https://developer.honor.com/cn/manageCenter",
+  meizu: "https://developer.meizu.com/",
+  samsung: "https://seller.samsungapps.com/",
+  xiaomi: "https://dev.mi.com/distribute",
+  oppo: "https://open.oppomobile.com/new/ecology/myApi",
+  vivo: "https://dev.vivo.com.cn/personalCenter",
+  tencent: "https://app.open.qq.com/p/app/list",
+  app_store: "https://appstoreconnect.apple.com/access/integrations/api",
+  google_play: "https://console.cloud.google.com/iam-admin/serviceaccounts"
+};
+var digest = (value) => createHash3("sha256").update(value).digest("hex");
+var object = (value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("invalid_setup_config");
+  return value;
+};
+var setupIdPattern = /^[a-f0-9-]{36}$/u;
+function credentialPagePlatform(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return;
+  }
+  if (url.protocol !== "https:" || url.port || url.username || url.password) return;
+  if (url.hostname === "dev.mi.com" && /^\/(?:distribute|console)(?:\/|$)/u.test(url.pathname))
+    return "xiaomi";
+  if (url.hostname === "open.oppomobile.com" && /^\/new\/ecology\/myApi(?:\/|$)/u.test(url.pathname))
+    return "oppo";
+  if (url.hostname === "dev.vivo.com.cn" && /^\/personalCenter(?:\/|$)/u.test(url.pathname))
+    return "vivo";
+  if (url.hostname === "app.open.qq.com" && /^\/p\/app(?:\/|$)/u.test(url.pathname))
+    return "tencent";
+  if (url.hostname === "developer.honor.com" && /^\/cn\/(?:manageCenter|console)(?:\/|$)/u.test(url.pathname))
+    return "honor";
+  if (url.hostname === "developer.meizu.com" && !/^\/(?:docs?|open\/api)(?:\/|$)/u.test(url.pathname) || url.hostname === "open.flyme.cn" && /^\/console(?:\/|$)/u.test(url.pathname))
+    return "meizu";
+  if (url.hostname === "seller.samsungapps.com" && url.pathname !== "/galaxyapi/fileUpload")
+    return "samsung";
+  if (["www.pgyer.com", "pgyer.com"].includes(url.hostname) && !url.hash) {
+    if (/^\/account\/api\/?$/u.test(url.pathname) && !url.search) return "pgyer";
+    if (/^\/dashboard\/?$/u.test(url.pathname) && url.searchParams.getAll("account").length === 1 && url.searchParams.get("account") === "api" && [...url.searchParams.keys()].every((key) => ["account", "agKey"].includes(key)) && url.searchParams.getAll("agKey").length <= 1 && (!url.searchParams.has("agKey") || /^[a-f0-9]{32}$/iu.test(url.searchParams.get("agKey"))))
+      return "pgyer";
+  }
+  if (url.hostname === "developer.huawei.com" && /^\/consumer\/(?:cn|en)\/hdc-console\/(?:index\.html)?$/u.test(url.pathname) && !url.search && url.hash === "#/home/101653523124950083")
+    return "huawei";
+  if (url.hostname === "developer.huawei.com" && /^\/consumer\/(?:cn|en)\/(?:service\/josp\/agc\/index\.html|console(?:\/[^?#]*)?)$/u.test(
+    url.pathname
+  ))
+    return "huawei";
+}
+var CredentialSetupService = class {
+  constructor(store, directory = path2.join(
+    path2.dirname(DEFAULT_CREDENTIAL_VAULT_PATH),
+    "browser-requests"
+  ), transport = globalThis.fetch, now = Date.now) {
+    this.store = store;
+    this.directory = directory;
+    this.transport = transport;
+    this.now = now;
+  }
+  async privateDirectory() {
+    await mkdir2(this.directory, { recursive: true, mode: 448 });
+    const info = await lstat2(this.directory);
+    if (!info.isDirectory() || info.isSymbolicLink() || info.uid !== process.getuid?.() || info.mode & 63 || await realpath(this.directory) !== this.directory)
+      throw new Error("unsafe_setup_directory");
+  }
+  async readFile(file) {
+    const handle = await open2(file, constants3.O_RDONLY | constants3.O_NOFOLLOW);
+    try {
+      const info = await handle.stat();
+      if (!info.isFile() || info.size > 262144 || info.uid !== process.getuid?.())
+        throw new Error("unsafe_setup_file");
+      return await handle.readFile("utf8");
+    } finally {
+      await handle.close();
+    }
+  }
+  filename(id) {
+    if (!setupIdPattern.test(id)) throw new Error("invalid_setup_id");
+    return path2.join(this.directory, `${id}.json`);
+  }
+  /**
+   * 从私有目录读取并校验本机任务，不读取凭据。
+   * @param id - 当前任务的 UUID；不接受任意路径。
+   */
+  async load(id) {
+    await this.privateDirectory();
+    const raw = object(JSON.parse(await this.readFile(this.filename(id))));
+    if (raw.setupId !== id || !PREFLIGHT_PLATFORMS.includes(raw.platform) || !Number.isSafeInteger(raw.expiresAt) || !["waiting_for_browser", "captured", "configured", "cancelled"].includes(raw.status) || typeof raw.configPath !== "string" || !path2.isAbsolute(raw.configPath) || typeof raw.configDigest !== "string" || typeof raw.credentialProfile !== "string" || raw.previousProfile !== void 0 && typeof raw.previousProfile !== "string" || typeof raw.packageName !== "string" || !/^[a-f0-9]{64}$/u.test(raw.configDigest)) {
+      throw new Error("invalid_setup_record");
+    }
+    assertCredentialProfileName(raw.credentialProfile);
+    if (raw.previousProfile !== void 0) assertCredentialProfileName(raw.previousProfile);
+    assertPublishPackageName(raw.packageName, raw.platform);
+    return raw;
+  }
+  status(task) {
+    return {
+      setupId: task.setupId,
+      platform: task.platform,
+      credentialProfile: task.credentialProfile,
+      packageName: task.packageName,
+      status: task.status === "configured" || task.status === "cancelled" ? task.status : task.expiresAt <= this.now() ? "expired" : task.status,
+      expiresAt: task.expiresAt,
+      consoleUrl: CREDENTIAL_CONSOLES[task.platform]
+    };
+  }
+  async save(task, exclusive = false) {
+    const filename = this.filename(task.setupId);
+    if (exclusive) {
+      const handle2 = await open2(filename, "wx", 384);
+      try {
+        await handle2.writeFile(JSON.stringify(task));
+      } finally {
+        await handle2.close();
+      }
+      return;
+    }
+    const temp = `${filename}.${randomUUID2()}.tmp`;
+    const handle = await open2(temp, "wx", 384);
+    try {
+      await handle.writeFile(JSON.stringify(task));
+    } finally {
+      await handle.close();
+    }
+    try {
+      await rename2(temp, filename);
+    } finally {
+      await unlink2(temp).catch(() => {
+      });
+    }
+  }
+  async locked(id, operation) {
+    await this.privateDirectory();
+    const file = `${this.filename(id)}.lock`;
+    let handle;
+    try {
+      handle = await open2(file, "wx", 384);
+    } catch {
+      throw new Error("credential_setup_busy");
+    }
+    try {
+      return await operation();
+    } finally {
+      await handle.close();
+      await unlink2(file);
+    }
+  }
+  /**
+   * 创建十分钟任务或复用已有 Profile；不读取浏览器、秘密或修改配置。
+   * @param input - 已保存的目标渠道与配置身份，不要求启用上传；更换账号须显式 refreshExisting。
+   */
+  async begin(input) {
+    if (!PREFLIGHT_PLATFORMS.includes(input.platform)) throw new Error("unsupported_platform");
+    assertPublishPackageName(input.packageName, input.platform);
+    const configPath = path2.resolve(input.configPath);
+    if (!["flu_release.yaml", "flu_release.yml", "app-ship.yaml", "app-ship.yml"].includes(
+      path2.basename(configPath)
+    )) {
+      throw new Error("unsupported_setup_config");
+    }
+    if (await realpath(path2.dirname(configPath)) !== path2.dirname(configPath))
+      throw new Error("unsafe_setup_config");
+    const raw = await this.readFile(configPath);
+    const config = object(yaml.load(raw));
+    const publish = object(config.publish);
+    const target = object(publish[input.platform]);
+    if (target.packageName !== input.packageName) throw new Error("setup_target_mismatch");
+    if (target.credentialProfile !== void 0) {
+      if (typeof target.credentialProfile !== "string") throw new Error("invalid_setup_config");
+      assertCredentialProfileName(target.credentialProfile);
+    }
+    if (target.auth || [
+      "apiKey",
+      "token",
+      "userName",
+      "privateKey",
+      "publicKeyPath",
+      "serviceAccountPath",
+      "privateKeyPath",
+      "appleId",
+      "appPassword",
+      "issuerId",
+      "keyId",
+      "clientId",
+      "clientSecret",
+      "accessKey",
+      "accessSecret",
+      "userId"
+    ].some((key) => target[key]))
+      throw new Error("legacy_credentials_require_migration");
+    await this.privateDirectory();
+    const setupId = randomUUID2();
+    const credentialProfile = input.refreshExisting ? `browser-${input.platform}-${setupId}` : input.credentialProfile ?? target.credentialProfile ?? `browser-${input.platform}-${setupId}`;
+    assertCredentialProfileName(credentialProfile);
+    if (!input.refreshExisting && target.credentialProfile && target.credentialProfile !== credentialProfile)
+      throw new Error("credential_profile_conflict");
+    const existing = await this.store.getMetadata(credentialProfile);
+    if (existing && existing.platform !== input.platform)
+      throw new Error("credential_profile_platform_mismatch");
+    const task = {
+      setupId,
+      platform: input.platform,
+      credentialProfile,
+      packageName: input.packageName,
+      status: existing?.configured ? "captured" : "waiting_for_browser",
+      expiresAt: this.now() + 10 * 6e4,
+      configPath,
+      configDigest: digest(raw),
+      ...target.credentialProfile ? { previousProfile: target.credentialProfile } : {}
+    };
+    await this.save(task, true);
+    return this.status(task);
+  }
+  /** 状态读取没有隐式保存、网络请求或补配副作用。 */
+  async inspect(id) {
+    return this.status(await this.load(id));
+  }
+  /** 扩展只处理当前站点的唯一待采集请求，多请求时要求调用方明确选择。 */
+  async pending(pageUrl) {
+    const platform = credentialPagePlatform(pageUrl);
+    if (!platform) throw new Error("unsupported_credential_page");
+    return (await this.waiting()).filter(
+      (task) => task.platform === platform || platform === "huawei" && task.platform === "harmony"
+    );
+  }
+  /** 仅列出需要已有文件的六渠道待处理任务，不读取网页或密钥文件。 */
+  async pendingImports() {
+    return (await this.waiting()).filter(
+      (task) => ["huawei", "harmony", "samsung", "xiaomi", "app_store", "google_play"].includes(
+        task.platform
+      )
+    );
+  }
+  async waiting() {
+    await this.privateDirectory();
+    const files = await readdir(this.directory);
+    if (files.length > 1e3) throw new Error("setup_request_limit");
+    const tasks = [];
+    for (const file of files.filter((name) => /^[a-f0-9-]{36}\.json$/u.test(name))) {
+      const task = await this.inspect(file.slice(0, -5));
+      if (task.status === "waiting_for_browser") tasks.push(task);
+    }
+    return tasks;
+  }
+  /** 仅供受信任 Native Host；材料不进入 MCP，且不能覆盖已有 Profile 或创建商店密钥。 */
+  async capture(id, pageUrl, input) {
+    return this.locked(id, async () => {
+      const task = await this.load(id);
+      if (this.status(task).status !== "waiting_for_browser")
+        throw new Error("credential_setup_not_pending");
+      const pagePlatform = credentialPagePlatform(pageUrl);
+      if (pagePlatform !== task.platform && !(pagePlatform === "huawei" && task.platform === "harmony"))
+        throw new Error("credential_origin_mismatch");
+      return this.saveCaptured(task, input);
+    });
+  }
+  /** 用户在扩展自身的文件选择器选择已有 JSON；材料不会进入商店页面或模型参数。 */
+  async importServiceAccount(id, content) {
+    return this.locked(id, async () => {
+      const task = await this.load(id);
+      if (!["huawei", "harmony"].includes(task.platform) || this.status(task).status !== "waiting_for_browser")
+        throw new Error("credential_setup_not_pending");
+      return this.saveCaptured(task, { serviceAccountJson: content });
+    });
+  }
+  /** 三星账号 ID 与已有私钥必须在同一任务中一起导入；不在网页上生成新密钥。 */
+  async importSamsungPrivateKey(id, serviceAccountId, content) {
+    return this.locked(id, async () => {
+      const task = await this.load(id);
+      if (task.platform !== "samsung" || this.status(task).status !== "waiting_for_browser")
+        throw new Error("credential_setup_not_pending");
+      if (Buffer.byteLength(content) > 65536) throw new Error("invalid_private_key");
+      createSamsungJwt(serviceAccountId, content);
+      await this.store.saveProfile({
+        platform: "samsung",
+        credentialProfile: task.credentialProfile,
+        material: { fields: { serviceAccountId }, files: { privateKey: { content } } }
+      });
+      task.status = "captured";
+      await this.save(task);
+      return this.status(task);
+    });
+  }
+  /**
+   * 导入 Apple/Google/小米已有文件并配对账号字段；仅受信任 Native Host 调用。
+   * @param id - 当前等待采集的本机任务，平台不能由文件覆盖。
+   * @param content - 用户已下载文件的内存内容，不是路径或网络地址。
+   * @param fields - 当前平台所需的配对字段；Google 必须为空对象。
+   */
+  async importCredentialFile(id, content, fields) {
+    return this.locked(id, async () => {
+      const task = await this.load(id);
+      if (this.status(task).status !== "waiting_for_browser")
+        throw new Error("credential_setup_not_pending");
+      const material = importedCredentialMaterial(task.platform, content, fields);
+      await this.store.saveProfile({
+        platform: task.platform,
+        credentialProfile: task.credentialProfile,
+        material
+      });
+      task.status = "captured";
+      await this.save(task);
+      return this.status(task);
+    });
+  }
+  /**
+   * 校验平台专属字段并写入不可覆盖的安全档案，文件型渠道须使用导入入口。
+   * @param task - 已锁定且仍在等待采集的当前任务。
+   * @param input - 浏览器经本机管道提交的材料，不允许额外或被遮盖字段。
+   */
+  async saveCaptured(task, input) {
+    const fields = object(input);
+    if (["huawei", "harmony"].includes(task.platform) && Object.keys(fields).join() === "serviceAccountJson" && typeof fields.serviceAccountJson === "string") {
+      const account = parseHuaweiServiceAccount(fields.serviceAccountJson);
+      await this.store.saveProfile({
+        platform: task.platform,
+        credentialProfile: task.credentialProfile,
+        material: {
+          fields: {},
+          files: { serviceAccountJson: { content: JSON.stringify(account) } }
+        }
+      });
+      task.status = "captured";
+      await this.save(task);
+      return this.status(task);
+    }
+    if (["samsung", "xiaomi", "app_store", "google_play"].includes(task.platform))
+      throw new Error("credential_file_required");
+    const expected = task.platform === "vivo" ? ["accessKey", "accessSecret"] : task.platform === "tencent" ? ["userId", "appId", "accessSecret"] : task.platform !== "pgyer" ? ["clientId", "clientSecret"] : ["apiKey"];
+    if (Object.keys(fields).length !== expected.length || expected.some(
+      (key) => typeof fields[key] !== "string" || !fields[key].trim() || fields[key].length > 8192 || /[\r\n\0*•●]/u.test(fields[key])
+    ))
+      throw new Error("credentials_not_visible");
+    await this.store.saveProfile({
+      platform: task.platform,
+      credentialProfile: task.credentialProfile,
+      material: { fields: Object.fromEntries(expected.map((key) => [key, fields[key]])) }
+    });
+    task.status = "captured";
+    await this.save(task);
+    return this.status(task);
+  }
+  /**
+   * 核验成功后补入 Profile/App ID 并同步已有表单快照；配置变化、冲突或取消停止写入。
+   * @param id - 本机采集任务标识，必须处于已采集状态或已经完成。
+   * @param signal - 可选取消信号，核验及配置落盘前再次检查。
+   * @param assertCurrent - 可选宿主检查，在原子替换前确认当前项目未改变。
+   */
+  async complete(id, signal, assertCurrent) {
+    return this.locked(id, async () => {
+      const task = await this.load(id);
+      if (await realpath(path2.dirname(task.configPath)) !== path2.dirname(task.configPath))
+        throw new Error("unsafe_setup_config");
+      if (this.status(task).status === "configured") {
+        const target2 = object(
+          object(object(yaml.load(await this.readFile(task.configPath))).publish)[task.platform]
+        );
+        if (target2.credentialProfile !== task.credentialProfile || target2.packageName !== task.packageName) {
+          throw new Error("configuration_changed");
+        }
+        return { ...this.status(task), code: "already_configured" };
+      }
+      if (this.status(task).status !== "captured") throw new Error("credential_setup_not_captured");
+      const raw = await this.readFile(task.configPath);
+      if (digest(raw) !== task.configDigest) throw new Error("configuration_changed");
+      const config = object(yaml.load(raw));
+      const target = object(object(config.publish)[task.platform]);
+      const probe = await preflightPublish(
+        {
+          platform: task.platform,
+          credentialProfile: task.credentialProfile,
+          packageName: task.packageName,
+          ...task.platform !== "pgyer" && target.appId ? { appId: String(target.appId) } : {}
+        },
+        this.store,
+        signal,
+        this.transport
+      );
+      if (!probe.verified) return { ...this.status(task), preflight: probe };
+      if (signal?.aborted || task.expiresAt <= this.now())
+        throw new Error("credential_setup_expired");
+      const lockFile = `${task.configPath}.credential-setup.lock`;
+      const lock = await open2(lockFile, "wx", 384);
+      let temporary;
+      try {
+        if (digest(await this.readFile(task.configPath)) !== task.configDigest)
+          throw new Error("configuration_changed");
+        if (target.credentialProfile && target.credentialProfile !== task.credentialProfile && target.credentialProfile !== task.previousProfile)
+          throw new Error("credential_profile_conflict");
+        target.credentialProfile = task.credentialProfile;
+        if (probe.appId) target.appId = probe.appId;
+        if (config.publishCenter?.channelOptions) {
+          const options = config.publishCenter.channelOptions[task.platform] ||= {};
+          options.credentialProfile = task.credentialProfile;
+          options.packageName = task.packageName;
+          if (probe.appId) options.appId = probe.appId;
+        }
+        temporary = `${task.configPath}.${randomUUID2()}.tmp`;
+        const handle = await open2(temporary, "wx", 384);
+        try {
+          await handle.writeFile(yaml.dump(config, { noRefs: true, lineWidth: -1 }));
+        } finally {
+          await handle.close();
+        }
+        if (signal?.aborted || task.expiresAt <= this.now() || digest(await this.readFile(task.configPath)) !== task.configDigest) {
+          throw new Error("configuration_changed");
+        }
+        assertCurrent?.();
+        signal?.throwIfAborted();
+        await rename2(temporary, task.configPath);
+        task.status = "configured";
+        await this.save(task);
+      } finally {
+        if (temporary) await unlink2(temporary).catch(() => {
+        });
+        await lock.close();
+        await unlink2(lockFile);
+      }
+      return { ...this.status(task), preflight: probe };
+    });
+  }
+  /** 取消只关闭请求，已保存的 Profile 保留；绝不隐式删除用户凭据。 */
+  async cancel(id) {
+    return this.locked(id, async () => {
+      const task = await this.load(id);
+      if (task.status !== "configured") {
+        task.status = "cancelled";
+        await this.save(task);
+      }
+      return this.status(task);
+    });
+  }
+};
+
+// src/browser-native.ts
+async function trustedOrigin(origin) {
+  const file = path3.join(path3.dirname(DEFAULT_CREDENTIAL_VAULT_PATH), "browser-connector.v1.json");
+  const info = await lstat3(file);
+  if (!info.isFile() || info.isSymbolicLink() || info.size > 4096 || info.uid !== process.getuid?.() || info.mode & 63)
+    throw new Error("connector_not_registered");
+  const config = JSON.parse(await readFile2(file, "utf8"));
+  if (!/^[a-p]{32}$/u.test(config.extensionId) || origin !== `chrome-extension://${config.extensionId}/`) {
+    throw new Error("connector_origin_rejected");
+  }
+}
+async function main() {
+  await trustedOrigin(process.argv[2]);
+  const service = new CredentialSetupService(createDefaultCredentialProfileStore());
+  const message = await new Promise((resolve, reject) => {
+    let buffer = Buffer.alloc(0);
+    const timer = setTimeout(() => reject(new Error("native_message_timeout")), 5e3);
+    process.stdin.on("data", (chunk) => {
+      buffer = Buffer.concat([buffer, chunk]);
+      if (buffer.length > 65540) {
+        clearTimeout(timer);
+        reject(new Error("native_message_too_large"));
+        return;
+      }
+      if (buffer.length < 4) return;
+      const size = buffer.readUInt32LE(0);
+      if (!size || size > 65536) {
+        clearTimeout(timer);
+        reject(new Error("invalid_native_message"));
+        return;
+      }
+      if (buffer.length < size + 4) return;
+      clearTimeout(timer);
+      process.stdin.pause();
+      try {
+        if (buffer.length !== size + 4) throw new Error("invalid_native_message");
+        resolve(JSON.parse(buffer.subarray(4).toString("utf8")));
+      } catch {
+        reject(new Error("invalid_native_message"));
+      } finally {
+        buffer.fill(0);
+      }
+    });
+    process.stdin.once("end", () => {
+      clearTimeout(timer);
+      reject(new Error("incomplete_native_message"));
+    });
+    process.stdin.once("error", () => {
+      clearTimeout(timer);
+      reject(new Error("invalid_native_message"));
+    });
+  });
+  if (!message || typeof message !== "object" || Array.isArray(message))
+    throw new Error("invalid_native_message");
+  const input = message;
+  const keys = input.operation === "pending_imports" ? ["operation"] : input.operation === "import_file" ? ["operation", "setupId", "content", "serviceAccountId", "fields"] : input.operation === "pending" ? ["operation", "pageUrl"] : ["operation", "pageUrl", "setupId", "fields"];
+  if (Object.keys(input).some((key) => !keys.includes(key))) {
+    throw new Error("invalid_native_message");
+  }
+  if (input.operation === "pending_imports") return { requests: await service.pendingImports() };
+  if (input.operation === "import_file" && typeof input.setupId === "string" && typeof input.content === "string") {
+    if (input.fields !== void 0) {
+      if (!input.fields || typeof input.fields !== "object" || Array.isArray(input.fields) || input.serviceAccountId !== void 0)
+        throw new Error("invalid_native_message");
+      return service.importCredentialFile(
+        input.setupId,
+        input.content,
+        input.fields
+      );
+    }
+    if (typeof input.serviceAccountId === "string")
+      return service.importSamsungPrivateKey(input.setupId, input.serviceAccountId, input.content);
+    return service.importServiceAccount(input.setupId, input.content);
+  }
+  if (typeof input.pageUrl !== "string" || input.pageUrl.length > 4096)
+    throw new Error("invalid_native_message");
+  if (input.operation === "pending") return { requests: await service.pending(input.pageUrl) };
+  if (input.operation === "capture" && typeof input.setupId === "string") {
+    return service.capture(input.setupId, input.pageUrl, input.fields);
+  }
+  throw new Error("invalid_native_message");
+}
+function respond(value) {
+  const body = Buffer.from(JSON.stringify(value));
+  const header = Buffer.alloc(4);
+  header.writeUInt32LE(body.length);
+  process.stdout.end(Buffer.concat([header, body]));
+}
+main().then(
+  (result) => respond({ ok: true, result }),
+  (error) => respond({
+    ok: false,
+    error: [
+      "invalid_credential_file",
+      "invalid_service_account",
+      "invalid_apple_key",
+      "invalid_public_key",
+      "invalid_import_fields",
+      "credential_file_required",
+      "credential_setup_not_pending"
+    ].includes(error?.message) ? error.message : "credential_capture_failed"
+  })
+).finally(() => process.stdin.destroy());
+//# sourceMappingURL=browser-native.js.map