npm - @lark-apaas/http-client - Versions diffs - 0.1.8 → 0.1.9-alpha.20261024072008 - Mend

@lark-apaas/http-client 0.1.8 → 0.1.9-alpha.20261024072008

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/README.md CHANGED Viewed

@@ -361,6 +361,15 @@ async function main() {
 main();
 ```
+## PPE 泳道路由
+所有请求在拦截器全部执行完、真正发出前，会按最终的 `x-tt-env` 自动处理 PPE 路由头（与是否开启平台模式无关）：
+- `x-tt-env` 以 `ppe` 开头（忽略首尾空白和大小写）且未设置 `x-use-ppe` 时，自动补 `x-use-ppe: 1`；没有它请求不会被路由到 PPE
+- 已显式设置的 `x-use-ppe`（header 名大小写不敏感，任意非空值）原样保留；值为 `undefined` / `null` 的视为未设置，补头时一并去掉
+- 按实际发出的值判断：同时存在大小写不同的多个 `x-tt-env` 时，fetch 会发出 `"a, b"` 的拼接值，这里也按拼接值判断，不改动这些 header
+- 对所有目标 host 生效，包括第三方地址
 ## 平台 JWT 鉴权
 在平台内部署的服务可以开启内置 JWT 鉴权能力，SDK 会：

package/dist/index.js CHANGED Viewed

@@ -456,6 +456,21 @@ function normalizeHeaders(headers) {
   );
   return normalized;
 }
+function withPpeLaneHeader(headers) {
+  const entries = Object.entries(headers);
+  const isSet = (value) => value !== void 0 && value !== null;
+  const ttEnv = entries.filter(([key, value]) => key.toLowerCase() === "x-tt-env" && isSet(value)).map(([, value]) => String(value).trim()).join(", ");
+  const usePpeKeys = entries.filter(([key]) => key.toLowerCase() === "x-use-ppe");
+  if (!ttEnv.toLowerCase().startsWith("ppe") || usePpeKeys.some(([, value]) => isSet(value))) {
+    return headers;
+  }
+  const result = { ...headers };
+  for (const [key] of usePpeKeys) {
+    delete result[key];
+  }
+  result["x-use-ppe"] = "1";
+  return result;
+}
 // src/core/types.ts
 var HttpError = class _HttpError extends Error {
@@ -629,7 +644,7 @@ var HttpClient = class {
     } catch (error) {
       return Promise.reject(error);
     }
-    mergedConfig.headers = normalizeHeaders(mergedConfig.headers);
+    mergedConfig.headers = withPpeLaneHeader(normalizeHeaders(mergedConfig.headers));
     const fullUrl = this.buildUrl(mergedConfig.url, mergedConfig.params);
     const timeout = mergedConfig.timeout || this.defaultConfig.timeout || 5e3;
     const controller = new AbortController();

package/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/index.ts","../src/helper/jwt.ts","../src/helper/jwt-manager.ts","../src/helper/file-token-provider.ts","../src/plugins/platform-plugin.ts","../src/core/InterceptorManager.ts","../src/core/utils.ts","../src/core/types.ts","../src/core/HttpClient.ts"],"sourcesContent":["export { HttpClient } from './core/HttpClient';\nexport { HttpError } from './core/types';\nexport type {\n RequestConfig,\n HttpClientConfig,\n HttpClientPreInterceptors,\n RequestInterceptor,\n ResponseInterceptor,\n SecurityConfig,\n SafeRequestConfig,\n} from './core/types';\n\nexport type { CustomClaims, JWTClaims, JWTConfig, JWTVerifyOptions } from './helper/jwt';\nexport {\n generateJWTToken,\n parseJWTTokenWithVerify,\n DEFAULT_JWT_EXPIRE_TIME_MS,\n DEFAULT_CLOCK_TOLERANCE_SEC,\n} from './helper/jwt';\n\nexport type {\n PlatformPluginOptions,\n PlatformRequestAuthConfig,\n PlatformClaims,\n TokenProviderConfig,\n} from './plugins/platform-plugin';\nexport {\n registerPlatformPlugin,\n resolvePlatformBaseURL,\n} from './plugins/platform-plugin';\n\nexport { FileTokenProvider } from './helper/file-token-provider';\nexport type { FileTokenProviderConfig } from './helper/file-token-provider';\n\n","import { createHmac, randomUUID, timingSafeEqual } from 'crypto';\n\nexport interface CustomClaims {\n tenant_id?: string;\n user_id?: string;\n app_id?: string;\n app_env?: string;\n sandbox_id?: string;\n access_key: string;\n}\n\nexport interface JWTClaims extends CustomClaims {\n iss: string;\n iat: number;\n nbf: number;\n exp: number;\n jti: string;\n [key: string]: any;\n}\n\nexport interface JWTConfig {\n accessKey: string;\n secretKey: string;\n expireTimeMs: number;\n}\n\nexport interface JWTVerifyOptions {\n /*\n 时钟容差（秒），用于处理服务器时间不同步的情况\n * 默认 60 秒\n /\n clockTolerance?: number;\n\n /\n 是否跳过过期验证（仅用于调试）\n * 默认 false\n /\n skipExpiration?: boolean;\n}\n\nexport const DEFAULT_JWT_EXPIRE_TIME_MS = 30 60 * 1000;\nexport const DEFAULT_CLOCK_TOLERANCE_SEC = 60;\n\nconst JWT_HEADER = {\n alg: 'HS256',\n typ: 'JWT',\n};\n\nexport function generateJWTToken(\n customClaims: CustomClaims,\n config: JWTConfig,\n): string {\n const nowSeconds = Math.floor(Date.now() / 1000);\n const payload: JWTClaims = {\n ...customClaims,\n iss: customClaims.access_key,\n iat: nowSeconds,\n nbf: nowSeconds,\n exp: nowSeconds + Math.floor(config.expireTimeMs / 1000),\n jti: randomUUID(),\n };\n\n const encodedHeader = base64UrlEncode(JSON.stringify(JWT_HEADER));\n const encodedPayload = base64UrlEncode(JSON.stringify(payload));\n const signature = sign(`${encodedHeader}.${encodedPayload}`, config.secretKey);\n\n return `${encodedHeader}.${encodedPayload}.${signature}`;\n}\n\nexport function parseJWTTokenWithVerify(\n tokenString: string,\n config: JWTConfig,\n options?: JWTVerifyOptions,\n): JWTClaims {\n const segments = tokenString.split('.');\n if (segments.length !== 3) {\n throw new Error('invalid JWT token format');\n }\n\n const [encodedHeader, encodedPayload, signature] = segments;\n\n // 1. 验证 header\n const headerJson = JSON.parse(base64UrlDecode(encodedHeader));\n if (headerJson.alg !== 'HS256') {\n throw new Error('unsupported JWT alg');\n }\n\n // 2. 验证签名\n const expectedSignature = sign(`${encodedHeader}.${encodedPayload}`, config.secretKey);\n\n const expectedBuffer = Buffer.from(expectedSignature);\n const signatureBuffer = Buffer.from(signature);\n if (\n expectedBuffer.length !== signatureBuffer.length \|\|\n !timingSafeEqual(expectedBuffer, signatureBuffer)\n ) {\n throw new Error('JWT signature verification failed');\n }\n\n // 3. 解析 payload\n const payload = JSON.parse(base64UrlDecode(encodedPayload)) as JWTClaims;\n\n // 4. 验证时间声明\n if (!options?.skipExpiration) {\n const clockTolerance = options?.clockTolerance ?? DEFAULT_CLOCK_TOLERANCE_SEC;\n const now = Math.floor(Date.now() / 1000);\n\n // 验证 exp (过期时间)\n if (payload.exp !== undefined) {\n if (payload.exp + clockTolerance < now) {\n throw new Error(\n `JWT token expired at ${new Date(payload.exp * 1000).toISOString()}`,\n );\n }\n }\n\n // 验证 nbf (生效时间)\n if (payload.nbf !== undefined) {\n if (payload.nbf - clockTolerance > now) {\n throw new Error(\n `JWT token not yet valid, will be valid at ${new Date(payload.nbf * 1000).toISOString()}`,\n );\n }\n }\n\n // 验证 iat (签发时间) - 防止未来时间的 token\n if (payload.iat !== undefined) {\n if (payload.iat - clockTolerance > now) {\n throw new Error(\n `JWT token issued in the future at ${new Date(payload.iat * 1000).toISOString()}`,\n );\n }\n }\n }\n\n return payload;\n}\n\nfunction sign(input: string, secret: string): string {\n return createHmac('sha256', secret)\n .update(input)\n .digest('base64')\n .replace(/=/g, '')\n .replace(/\\+/g, '-')\n .replace(/\\//g, '_');\n}\n\nfunction base64UrlEncode(input: string): string {\n return Buffer.from(input)\n .toString('base64')\n .replace(/=/g, '')\n .replace(/\\+/g, '-')\n .replace(/\\//g, '_');\n}\n\nfunction base64UrlDecode(input: string): string {\n const padLength = (4 - (input.length % 4 \|\| 4)) % 4;\n const padded = `${input}${'='.repeat(padLength)}`\n .replace(/-/g, '+')\n .replace(/_/g, '/');\n return Buffer.from(padded, 'base64').toString('utf8');\n}\n","import { CustomClaims, JWTConfig, generateJWTToken } from './jwt';\n\n/*\n Token 来源的最小抽象。`platform-plugin` 用它做 primary / fallback 链\n * (env token 优先,sk 自签兜底)。`JWTTokenManager`(下方)和 `StaticTokenSource`\n * (本文件底部)都实现这个接口。\n /\nexport interface TokenSource {\n /\n 拿一个可用的 token(用作 Authorization Bearer)。拿不到必须抛 —— 调用方据此决定走 fallback。\n * 不要返回空串 / null,会让上层 `if (token)` 误判通过。\n /\n getToken(claims: CustomClaims): string;\n}\n\ninterface CachedToken {\n token: string;\n expiresAtMs: number;\n}\n\ninterface JWTManagerConfig extends JWTConfig {\n /\n 在过期前多久刷新 token（毫秒）\n * 默认 5 分钟\n /\n refreshBeforeMs?: number;\n}\n\n/\n JWT Token 管理器，负责 token 的生成、缓存和自动刷新\n \n 缓存策略：\n * - 基于 claims 的哈希值作为缓存 key（支持多租户+多用户）\n * - 在 token 过期前 refreshBeforeMs 时间内自动刷新\n \n @example\n * ```typescript\n * const manager = new JWTTokenManager({\n * accessKey: 'your-access-key',\n * secretKey: 'your-secret-key',\n * expireTimeMs: 30 * 60 * 1000,\n * refreshBeforeMs: 5 * 60 * 1000,\n * });\n \n // 获取 token（会自动缓存）\n * const token = manager.getToken({\n * access_key: 'your-access-key',\n * tenant_id: '1001',\n * user_id: 'user123',\n * });\n * ```\n /\nexport class JWTTokenManager {\n private cache = new Map<string, CachedToken>();\n private config: Required<JWTManagerConfig>;\n\n constructor(config: JWTManagerConfig) {\n this.config = {\n refreshBeforeMs: 5 60 * 1000, // 默认 5 分钟\n ...config,\n };\n }\n\n /*\n 获取 JWT token，优先使用缓存\n \n 如果缓存的 token 即将过期（距离过期时间小于 refreshBeforeMs），\n * 则会生成新的 token 并更新缓存\n \n @param claims - JWT claims\n * @returns JWT token 字符串\n /\n getToken(claims: CustomClaims): string {\n const cacheKey = this.getCacheKey(claims);\n const cached = this.cache.get(cacheKey);\n const now = Date.now();\n\n // 检查缓存是否有效（未过期且不需要刷新）\n if (cached && cached.expiresAtMs - now > this.config.refreshBeforeMs) {\n return cached.token;\n }\n\n // 生成新 token\n const token = generateJWTToken(claims, this.config);\n const expiresAtMs = now + this.config.expireTimeMs;\n\n this.cache.set(cacheKey, { token, expiresAtMs });\n\n return token;\n }\n\n /\n 清除所有缓存的 token\n /\n clearCache(): void {\n this.cache.clear();\n }\n\n /\n 清除特定 claims 的缓存\n \n @param claims - 要清除的 claims\n /\n clearCacheFor(claims: CustomClaims): void {\n const cacheKey = this.getCacheKey(claims);\n this.cache.delete(cacheKey);\n }\n\n /\n 生成缓存 key（基于关键的 claims 字段）\n \n 使用稳定的字段顺序确保相同 claims 生成相同 key\n \n @private\n /\n private getCacheKey(claims: CustomClaims): string {\n // 使用稳定的字段顺序确保相同 claims 生成相同 key\n const parts = [\n claims.access_key,\n claims.tenant_id \|\| '',\n claims.user_id \|\| '',\n claims.app_id \|\| '',\n claims.app_env \|\| '',\n claims.sandbox_id \|\| '',\n ];\n return parts.join(':');\n }\n\n /\n 获取缓存统计信息（用于监控和调试）\n \n @returns 缓存统计信息\n /\n getCacheStats() {\n const now = Date.now();\n let validCount = 0;\n let expiredCount = 0;\n\n for (const cached of this.cache.values()) {\n if (cached.expiresAtMs > now) {\n validCount++;\n } else {\n expiredCount++;\n }\n }\n\n return {\n total: this.cache.size,\n valid: validCount,\n expired: expiredCount,\n };\n }\n}\n\n/\n 平台直接派发的静态 token(短期凭据,默认 5 天有效,当前实现为 JWT 但对调用方不透明),\n * client 不签也不刷,拿到啥就用啥。过期了 server 端会 401,由 platform-plugin 的 fallback 链\n * 退到 sk 自签(JWTTokenManager)。\n \n 用于 §2.2 InnerAPI 鉴权 — ak/sk → token + ak 演进:\n * `.env.local` 仅注入 token(不再下发 sk),消除 sk 长期落地的泄漏面。\n /\nexport class StaticTokenSource implements TokenSource {\n constructor(private readonly token: string) {\n if (!token) {\n throw new Error('StaticTokenSource: token 不能为空');\n }\n }\n\n getToken(_claims: CustomClaims): string {\n return this.token;\n }\n}\n","import { readFileSync } from 'fs';\n\ninterface CachedFileToken {\n token: string;\n accessKey: string;\n expiresAtMs: number;\n}\n\nexport interface FileTokenProviderConfig {\n paths?: string[];\n refreshBeforeMs?: number;\n}\n\nconst DEFAULT_REFRESH_BEFORE_MS = 5 60 * 1000;\nconst DEFAULT_TOKEN_PATHS = [\n '/home/gem/workspace/.force/openclaw/miaoda-provider-key',\n];\n\n/*\n 从文件读取 JWT Token 的 Provider\n \n 支持多路径优先级链：按顺序尝试读取，命中第一个有效 token 即返回。\n * 缓存策略基于 token 自身的 exp 字段，在过期前 refreshBeforeMs 窗口内重新读取文件。\n \n @example\n * ```typescript\n * const provider = new FileTokenProvider({\n * paths: ['/path/a/token', '/path/b/token'],\n * refreshBeforeMs: 5 * 60 * 1000,\n * });\n \n const result = provider.getToken();\n * if (result) {\n * console.log(result.token, result.accessKey);\n * }\n * ```\n /\nexport class FileTokenProvider {\n private cache = new Map<string, CachedFileToken>();\n private paths: string[];\n private refreshBeforeMs: number;\n\n constructor(config?: FileTokenProviderConfig) {\n this.paths = config?.paths ?? DEFAULT_TOKEN_PATHS;\n this.refreshBeforeMs = config?.refreshBeforeMs ?? DEFAULT_REFRESH_BEFORE_MS;\n }\n\n /\n 获取 token，按路径优先级依次尝试\n \n 1. 缓存有效且不在刷新窗口 → 直接返回\n * 2. 进入刷新窗口 → 重读文件，更新缓存\n * 3. 文件未更新但缓存未过期 → 仍返回旧缓存\n * 4. 所有路径均无有效 token → 返回 null\n /\n getToken(): { token: string; accessKey: string } \| null {\n const now = Date.now();\n\n for (const filePath of this.paths) {\n const cached = this.cache.get(filePath);\n\n // 缓存命中且不在刷新窗口\n if (cached && cached.expiresAtMs - now > this.refreshBeforeMs) {\n return { token: cached.token, accessKey: cached.accessKey };\n }\n\n // 需要读取/重读文件\n const result = this.readAndParse(filePath);\n if (result) {\n this.cache.set(filePath, result);\n if (result.expiresAtMs > now) {\n return { token: result.token, accessKey: result.accessKey };\n }\n }\n\n // 文件未更新，但缓存的 token 仍未过期\n if (cached && cached.expiresAtMs > now) {\n return { token: cached.token, accessKey: cached.accessKey };\n }\n }\n\n return null;\n }\n\n clearCache(): void {\n this.cache.clear();\n }\n\n private readAndParse(filePath: string): CachedFileToken \| null {\n try {\n const token = readFileSync(filePath, 'utf-8').trim();\n if (!token) return null;\n\n const payload = this.decodePayload(token);\n if (!payload?.exp) return null;\n\n return {\n token,\n accessKey: payload.access_key ?? '',\n expiresAtMs: payload.exp 1000,\n };\n } catch {\n return null;\n }\n }\n\n private decodePayload(token: string): Record<string, any> \| null {\n try {\n const segments = token.split('.');\n if (segments.length !== 3) return null;\n\n const padLength = (4 - (segments[1].length % 4 \|\| 4)) % 4;\n const padded = `${segments[1]}${'='.repeat(padLength)}`\n .replace(/-/g, '+')\n .replace(/_/g, '/');\n\n return JSON.parse(Buffer.from(padded, 'base64').toString('utf8'));\n } catch {\n return null;\n }\n }\n}\n","import type { RequestConfig, RequestInterceptor } from '../core/types';\nimport {\n DEFAULT_JWT_EXPIRE_TIME_MS,\n CustomClaims,\n} from '../helper/jwt';\nimport { JWTTokenManager, StaticTokenSource } from '../helper/jwt-manager';\nimport { FileTokenProvider } from '../helper/file-token-provider';\n\nexport type PlatformClaims = Omit<CustomClaims, 'access_key'>;\n\nexport interface TokenProviderConfig {\n type: 'file';\n paths?: string[];\n}\n\nexport interface PlatformPluginOptions {\n enabled?: boolean;\n baseURL?: string;\n domainEnv?: string;\n accessKeyEnv?: string;\n secretKeyEnv?: string;\n accessKey?: string;\n secretKey?: string;\n expireTimeMs?: number;\n refreshBeforeMs?: number;\n defaultClaims?: PlatformClaims;\n /*\n 平台直接派发的静态 token（短期凭据，默认 5 天有效，当前实现为 JWT）。配置后：\n * - 优先用此 token 调 InnerAPI（不再用 sk 自签），消除 sk 长期落地的泄漏面\n * - 若同时配置了 sk（accessKey/secretKey 或对应 env），sk 自签作为最终 fallback\n * 优先级：`token` option > `process.env[tokenEnv ?? 'FORCE_AUTHN_TOKEN']`\n * 与 `tokenProvider`（文件 token）共存：fileToken > envToken > sk 自签。\n /\n token?: string;\n tokenEnv?: string;\n /\n 管理端 innerapi 链路（仅用于妙搭开发态）\n * 启用后：\n * - baseURL 改从 adminDomainEnv（默认 MIAODA_DEV_INNER_DOMAIN_WITH_PREFIX）读取\n * - 每次请求从 clientTokenEnv（默认 MIAODA_AUTHN_CODE）读取用户凭证，\n * 注入为 X-Miaoda-Client-Token 请求头（读不到则不注入）\n * - AK/SK 的 Authorization + x-api-key 照旧\n /\n adminInnerApi?: boolean;\n adminDomainEnv?: string;\n clientTokenEnv?: string;\n tokenProvider?: TokenProviderConfig;\n}\n\nexport interface PlatformRequestAuthConfig {\n customClaims?: PlatformClaims;\n}\n\nconst DEFAULT_DOMAIN_ENV = 'FORCE_AUTHN_INNERAPI_DOMAIN';\nconst DEFAULT_ACCESS_KEY_ENV = 'FORCE_AUTHN_ACCESS_KEY';\nconst DEFAULT_SECRET_KEY_ENV = 'FORCE_AUTHN_ACCESS_SECRET';\nconst DEFAULT_TOKEN_ENV = 'FORCE_AUTHN_TOKEN';\nconst DEFAULT_ADMIN_DOMAIN_ENV = 'MIAODA_DEV_INNER_DOMAIN_WITH_PREFIX';\nconst DEFAULT_CLIENT_TOKEN_ENV = 'MIAODA_AUTHN_CODE';\nconst MIAODA_CLIENT_TOKEN_HEADER = 'X-Miaoda-Client-Token';\n\nexport function resolvePlatformBaseURL(options?: PlatformPluginOptions): string \| undefined {\n if (!options?.enabled) {\n return options?.baseURL;\n }\n\n if (options.baseURL) {\n return options.baseURL;\n }\n\n const envName = options.adminInnerApi\n ? (options.adminDomainEnv \|\| DEFAULT_ADMIN_DOMAIN_ENV)\n : (options.domainEnv \|\| DEFAULT_DOMAIN_ENV);\n const domain = process.env[envName];\n if (!domain) {\n throw new Error(`平台模式需要基础域名，请设置环境变量 ${envName}`);\n }\n return domain;\n}\n\ntype RequestInterceptorManager = {\n use: (\n onFulfilled?: RequestInterceptor['onFulfilled'],\n onRejected?: RequestInterceptor['onRejected'],\n ) => number;\n eject: (id: number) => void;\n};\n\ninterface InterceptorHost {\n request: RequestInterceptorManager;\n}\n\nexport function registerPlatformPlugin(\n interceptors: InterceptorHost,\n options: PlatformPluginOptions,\n): JWTTokenManager \| undefined {\n if (!options.enabled) {\n return undefined;\n }\n\n ensureNoAccessKeyOverride('platform.defaultClaims', options.defaultClaims);\n\n // 创建文件 token provider（如果配置了）\n let fileTokenProvider: FileTokenProvider \| undefined;\n if (options.tokenProvider?.type === 'file') {\n fileTokenProvider = new FileTokenProvider({\n paths: options.tokenProvider.paths,\n refreshBeforeMs: options.refreshBeforeMs,\n });\n }\n\n // 提前检查 AK/SK，避免每次请求时检查\n const accessKeyEnv = options.accessKeyEnv \|\| DEFAULT_ACCESS_KEY_ENV;\n const secretKeyEnv = options.secretKeyEnv \|\| DEFAULT_SECRET_KEY_ENV;\n\n const accessKey = options.accessKey ?? (process.env[accessKeyEnv] \|\| '');\n const secretKey = options.secretKey ?? (process.env[secretKeyEnv] \|\| '');\n\n const expireTimeMs = options.expireTimeMs ?? DEFAULT_JWT_EXPIRE_TIME_MS;\n\n // 创建 JWT Token Manager（支持缓存和自动刷新，同时作为 fallback）\n const tokenManager = new JWTTokenManager({\n accessKey,\n secretKey,\n expireTimeMs,\n refreshBeforeMs: options.refreshBeforeMs,\n });\n\n // 平台派发的静态 token（可选；有则在 fileToken 之后、sk 自签之前用，消除 sk 长期落地的泄漏面）\n const tokenEnv = options.tokenEnv \|\| DEFAULT_TOKEN_ENV;\n const platformToken = options.token ?? (process.env[tokenEnv] \|\| '');\n const staticTokenSource = platformToken ? new StaticTokenSource(platformToken) : null;\n\n const clientTokenEnv = options.clientTokenEnv \|\| DEFAULT_CLIENT_TOKEN_ENV;\n\n // 注册请求拦截器\n interceptors.request.use((config: RequestConfig) => {\n // 优先尝试文件 token\n if (fileTokenProvider) {\n const fileToken = fileTokenProvider.getToken();\n if (fileToken) {\n const headers = {\n ...(config.headers as Record<string, string>),\n 'Authorization': `Bearer ${fileToken.token}`,\n 'x-api-key': fileToken.accessKey,\n };\n return { ...config, headers };\n }\n }\n\n ensureNoAccessKeyOverride('request.platformAuth.customClaims', config.platformAuth?.customClaims);\n\n const claims: CustomClaims = {\n ...(options.defaultClaims \|\| {}),\n ...(config.platformAuth?.customClaims \|\| {}),\n access_key: accessKey,\n };\n\n // 次选 envToken（FORCE_AUTHN_TOKEN env / options.token）—— 短期凭据,跟 fileToken 同样\n // 替代 sk 长期落地。envToken 拿到才用,拿不到继续往下退到 sk 自签。\n // 注:StaticTokenSource.getToken 当前实现是直接返回构造时传入的 token,不会抛 —— 即便将来\n // 改成可能抛的实现(比如带过期校验),也走 sk 自签 fallback。\n let token: string;\n if (staticTokenSource) {\n try {\n token = staticTokenSource.getToken(claims);\n } catch {\n token = tokenManager.getToken(claims);\n }\n } else {\n token = tokenManager.getToken(claims);\n }\n\n // 统一使用 Record<string, string> 类型，由 client.ts 的 normalizeHeaders 处理\n const headers: Record<string, string> = {\n ...(config.headers as Record<string, string>),\n 'Authorization': `Bearer ${token}`,\n 'x-api-key': accessKey,\n };\n\n // 管理端 innerapi：运行时读取用户凭证并注入\n if (options.adminInnerApi) {\n const clientToken = process.env[clientTokenEnv];\n if (clientToken) {\n headers[MIAODA_CLIENT_TOKEN_HEADER] = clientToken;\n }\n }\n\n return {\n ...config,\n headers,\n };\n });\n\n return tokenManager;\n}\n\nfunction ensureNoAccessKeyOverride(name: string, claims?: PlatformClaims) {\n if (claims && Object.prototype.hasOwnProperty.call(claims, 'access_key')) {\n throw new Error(`${name} 不允许设置 access_key`);\n }\n}\n","/\n 拦截器管理器（模仿 Axios 的 InterceptorManager）\n /\nexport class InterceptorManager<T> {\n private interceptors: (T \| null)[] = [];\n\n /\n 添加拦截器\n * @returns 拦截器 ID，用于后续移除\n /\n use(onFulfilled?: any, onRejected?: any): number {\n this.interceptors.push({ onFulfilled, onRejected } as T);\n return this.interceptors.length - 1;\n }\n\n /\n 移除拦截器\n /\n eject(id: number): void {\n if (this.interceptors[id]) {\n this.interceptors[id] = null;\n }\n }\n\n /\n 清空所有拦截器\n /\n clear(): void {\n this.interceptors = [];\n }\n\n /\n 遍历所有拦截器\n /\n forEach(fn: (interceptor: T) => void): void {\n this.interceptors.forEach((interceptor) => {\n if (interceptor !== null) {\n fn(interceptor);\n }\n });\n }\n}\n","/\n Checks if a value is a plain object.\n * @param value The value to check.\n * @returns True if the value is a plain object, false otherwise.\n /\nexport function isPlainObject(value: any): boolean {\n if (typeof value !== 'object' \|\| value === null) {\n return false;\n }\n const proto = Object.getPrototypeOf(value);\n return proto === Object.prototype \|\| proto === null;\n}\n\nexport function normalizeHeaders(headers?: RequestInit['headers']): Record<string, string> {\n if (!headers) {\n return {};\n }\n\n if (headers instanceof Headers) {\n const normalized: Record<string, string> = {};\n headers.forEach((value, key) => {\n normalized[key] = value;\n });\n return normalized;\n }\n\n if (Array.isArray(headers)) {\n return headers.reduce<Record<string, string>>((acc, [key, value]) => {\n acc[key] = value;\n return acc;\n }, {});\n }\n\n const normalized: Record<string, string> = {};\n Object.entries(headers as Record<string, string \| readonly string[]>).forEach(\n ([key, value]) => {\n const normalizedValue = Array.isArray(value) ? value.join(',') : value;\n normalized[key] = normalizedValue as string;\n },\n );\n return normalized;\n}\n","import type { PlatformPluginOptions, PlatformRequestAuthConfig } from '../plugins/platform-plugin';\nimport { normalizeHeaders } from './utils';\n\n/\n 清理后的请求配置（移除敏感信息）\n /\nexport interface SafeRequestConfig extends Omit<RequestConfig, 'headers'> {\n headers?: Record<string, string>; // 已清理的 headers\n}\n\n/\n HTTP 错误对象\n \n 注意：为了安全考虑，error.config 中的敏感 headers (如 Authorization, x-api-key)\n * 会被替换为 '[REDACTED]'\n /\nexport class HttpError extends Error {\n public readonly isHttpError: boolean = true;\n public response: Response \| undefined;\n public config: SafeRequestConfig;\n\n constructor(\n response: Response \| undefined,\n config: RequestConfig,\n message?: string,\n options?: { cause?: unknown },\n ) {\n super(message \|\| `Request failed with status ${response?.status \|\| 'unknown'}`, options);\n this.name = 'HttpError';\n this.response = response;\n this.config = sanitizeConfig(config);\n Object.setPrototypeOf(this, HttpError.prototype);\n }\n}\n\nexport interface RequestConfig extends RequestInit {\n url?: string;\n params?: Record<string, any>;\n timeout?: number;\n baseURL?: string;\n platformAuth?: PlatformRequestAuthConfig;\n}\n\nexport interface SecurityConfig {\n /\n 允许的 URL 协议白名单\n * 默认: null (不限制)\n * 设置为 ['http:', 'https:'] 可限制只允许 HTTP/HTTPS\n /\n allowedProtocols?: string[] \| null;\n\n /\n 最大响应体大小（字节）\n * 默认: 0 (不限制)\n * 设置为正数可限制响应体大小，防止内存耗尽攻击\n /\n maxResponseSize?: number;\n\n /\n 是否启用严格模式（启用所有安全检查）\n * 默认: false\n * 启用后会自动设置：\n * - allowedProtocols = ['http:', 'https:']\n * - maxResponseSize = 50MB\n /\n strictMode?: boolean;\n}\n\nexport interface HttpClientPreInterceptors {\n request?: RequestInterceptor[];\n response?: ResponseInterceptor[];\n}\n\nexport interface HttpClientConfig extends RequestConfig {\n platform?: PlatformPluginOptions;\n security?: SecurityConfig;\n preInterceptors?: HttpClientPreInterceptors;\n}\n\n/\n 请求拦截器函数\n /\nexport type RequestInterceptor = {\n onFulfilled?: (config: RequestConfig) => RequestConfig \| Promise<RequestConfig>;\n onRejected?: (error: any) => any;\n};\n\n/\n 响应拦截器函数（fetch 风格）\n /\nexport type ResponseInterceptor = {\n onFulfilled?: (response: Response) => Response \| Promise<Response>;\n onRejected?: (error: any) => any;\n};\n\n/\n 清理配置中的敏感信息\n /\nfunction sanitizeConfig(config: RequestConfig): SafeRequestConfig {\n const { headers, ...rest } = config;\n\n return {\n ...rest,\n headers: sanitizeHeaders(headers),\n };\n}\n\n/\n 清理敏感 headers\n \n 将 Authorization, x-api-key, cookie 等敏感字段替换为 '[REDACTED]'\n /\nfunction sanitizeHeaders(headers?: RequestInit['headers']): Record<string, string> \| undefined {\n if (!headers) {\n return undefined;\n }\n\n const normalized = normalizeHeaders(headers);\n const sanitized: Record<string, string> = {};\n\n const sensitiveHeaders = ['authorization', 'x-api-key', 'cookie', 'x-secret'];\n\n for (const [key, value] of Object.entries(normalized)) {\n const lowerKey = key.toLowerCase();\n if (sensitiveHeaders.includes(lowerKey)) {\n sanitized[key] = '[REDACTED]';\n } else {\n sanitized[key] = value;\n }\n }\n\n return sanitized;\n}\n","import { registerPlatformPlugin, resolvePlatformBaseURL } from '../plugins/platform-plugin';\nimport { InterceptorManager } from './InterceptorManager';\nimport {\n HttpError,\n type HttpClientConfig,\n type RequestConfig,\n type RequestInterceptor,\n type ResponseInterceptor,\n type SecurityConfig,\n} from './types';\nimport { isPlainObject, normalizeHeaders } from './utils';\n\n/\n 技术栈无关的 HTTP 客户端\n \n 设计理念：\n * - 基于原生 fetch API，零依赖\n * - 拦截器模式遵循 Axios 标准，AI 模型和开发者都熟悉\n * - 可在任何 Node.js 环境使用（NestJS, Express, Koa, 纯 Node）\n \n @example\n * ```typescript\n * const client = new HttpClient({\n * baseURL: 'https://api.example.com',\n * timeout: 5000,\n * });\n \n // 添加请求拦截器（类似 Axios）\n * client.interceptors.request.use(\n * config => {\n * config.headers = config.headers \|\| {};\n * config.headers['Authorization'] = 'Bearer token';\n * return config;\n * },\n * error => Promise.reject(error)\n * );\n \n // 添加响应拦截器（类似 Axios）\n * client.interceptors.response.use(\n * response => {\n * console.log('Response:', response.status);\n * return response;\n * },\n * error => {\n * if (error.response?.status === 401) {\n * // 处理未授权\n * }\n * return Promise.reject(error);\n * }\n * );\n \n // 发起请求\n * const response = await client.get('/users');\n * console.log(response.data);\n * ```\n /\nexport class HttpClient {\n private defaultConfig: RequestConfig;\n private securityConfig: Required<SecurityConfig>;\n /\n 拦截器管理器（API 与 Axios 一致）\n /\n public interceptors = {\n request: new InterceptorManager<RequestInterceptor>(),\n response: new InterceptorManager<ResponseInterceptor>(),\n };\n\n constructor(config?: HttpClientConfig) {\n const { platform, security, preInterceptors, ...restConfig } = config \|\| {};\n\n this.defaultConfig = {\n timeout: 5000,\n ...restConfig,\n };\n\n // 初始化安全配置\n const strictMode = security?.strictMode ?? false;\n this.securityConfig = {\n allowedProtocols: strictMode ? ['http:', 'https:'] : null,\n maxResponseSize: strictMode ? 50 1024 * 1024 : 0, // 50MB\n strictMode,\n ...security,\n };\n\n this.registerRequestPreInterceptors(preInterceptors?.request);\n\n if (platform?.enabled) {\n if (!this.defaultConfig.baseURL) {\n this.defaultConfig.baseURL = resolvePlatformBaseURL(platform);\n }\n registerPlatformPlugin(this.interceptors, platform);\n }\n\n this.registerResponsePreInterceptors(preInterceptors?.response);\n }\n\n /*\n GET 请求\n /\n async get(url: string, config?: RequestConfig): Promise<Response> {\n return this.request({ ...config, url, method: 'GET' });\n }\n\n /\n POST 请求\n /\n async post(url: string, data?: any, config?: RequestConfig): Promise<Response> {\n const headers: Record<string, string> = { ...config?.headers } as Record<string, string>;\n let body: any = data;\n\n if (isPlainObject(data)) {\n body = JSON.stringify(data);\n if (!Object.keys(headers).some((key) => key.toLowerCase() === 'content-type')) {\n headers['Content-Type'] = 'application/json';\n }\n }\n\n return this.request({\n ...config,\n url,\n method: 'POST',\n body,\n headers,\n });\n }\n\n /\n PUT 请求\n /\n async put(url: string, data?: any, config?: RequestConfig): Promise<Response> {\n const headers: Record<string, string> = { ...config?.headers } as Record<string, string>;\n let body: any = data;\n\n if (isPlainObject(data)) {\n body = JSON.stringify(data);\n if (!Object.keys(headers).some((key) => key.toLowerCase() === 'content-type')) {\n headers['Content-Type'] = 'application/json';\n }\n }\n\n return this.request({\n ...config,\n url,\n method: 'PUT',\n body,\n headers,\n });\n }\n\n /\n DELETE 请求\n /\n async delete(url: string, config?: RequestConfig): Promise<Response> {\n return this.request({ ...config, url, method: 'DELETE' });\n }\n\n /\n PATCH 请求\n /\n async patch(url: string, data?: any, config?: RequestConfig): Promise<Response> {\n const headers: Record<string, string> = { ...config?.headers } as Record<string, string>;\n let body: any = data;\n\n if (isPlainObject(data)) {\n body = JSON.stringify(data);\n if (!Object.keys(headers).some((key) => key.toLowerCase() === 'content-type')) {\n headers['Content-Type'] = 'application/json';\n }\n }\n\n return this.request({\n ...config,\n url,\n method: 'PATCH',\n body,\n headers,\n });\n }\n\n /\n 核心请求方法（fetch 风格）\n /\n async request(config: RequestConfig): Promise<Response> {\n // 1. 合并配置\n // Perform a case-insensitive header merge that preserves the final key's casing.\n const baseHeaders = normalizeHeaders(this.defaultConfig.headers);\n const overrideHeaders = normalizeHeaders(config.headers);\n const mergedKeyMap: Record<string, { key: string; value: string }> = {};\n\n for (const key in baseHeaders) {\n mergedKeyMap[key.toLowerCase()] = { key, value: baseHeaders[key] };\n }\n for (const key in overrideHeaders) {\n mergedKeyMap[key.toLowerCase()] = { key, value: overrideHeaders[key] };\n }\n\n const finalHeaders: Record<string, string> = {};\n for (const lowerKey in mergedKeyMap) {\n const { key, value } = mergedKeyMap[lowerKey];\n finalHeaders[key] = value;\n }\n\n let mergedConfig: RequestConfig = {\n ...this.defaultConfig,\n ...config,\n headers: finalHeaders,\n };\n\n // 2. 执行请求拦截器\n try {\n mergedConfig = await this.runRequestInterceptors(mergedConfig);\n } catch (error) {\n return Promise.reject(error);\n }\n\n // 3. 统一 normalize headers（拦截器可能返回 Headers 对象）\n mergedConfig.headers = normalizeHeaders(mergedConfig.headers);\n\n // 4. 构建完整 URL\n const fullUrl = this.buildUrl(mergedConfig.url!, mergedConfig.params);\n\n // 5. 设置超时和取消\n const timeout = mergedConfig.timeout \|\| this.defaultConfig.timeout \|\| 5000;\n const controller = new AbortController();\n const timeoutId = setTimeout(() => controller.abort(), timeout);\n\n // 监听外部 signal\n const externalSignal = mergedConfig.signal;\n if (externalSignal) {\n // 如果外部 signal 已经终止，立即终止\n if (externalSignal.aborted) {\n clearTimeout(timeoutId);\n controller.abort();\n } else {\n // 使用 { once: true } 避免内存泄漏\n externalSignal.addEventListener('abort', () => controller.abort(), { once: true });\n }\n }\n\n // 6. 准备 fetch 配置（排除自定义字段）\n const { platformAuth, params, timeout: _timeout, baseURL, url, ...fetchOptions } = mergedConfig;\n\n try {\n // 7. 发起请求\n const response = await fetch(fullUrl, {\n ...fetchOptions,\n signal: controller.signal, // 传递我们自己的 controller signal\n });\n\n clearTimeout(timeoutId);\n\n // 安全检查：响应体大小限制\n if (this.securityConfig.maxResponseSize > 0) {\n const contentLength = response.headers.get('content-length');\n if (contentLength) {\n const size = parseInt(contentLength, 10);\n if (size > this.securityConfig.maxResponseSize) {\n throw new Error(\n `Response size ${size} bytes exceeds limit of ${this.securityConfig.maxResponseSize} bytes`\n );\n }\n }\n }\n\n // 检查响应状态\n if (!response.ok) {\n const error = new HttpError(response, mergedConfig);\n return this.runResponseInterceptors(Promise.reject(error));\n }\n\n // 执行响应拦截器（直接返回 Response）\n return this.runResponseInterceptors(Promise.resolve(response));\n } catch (error) {\n clearTimeout(timeoutId);\n\n // 网络错误或超时错误\n const httpError =\n error instanceof HttpError\n ? error\n : new HttpError(\n undefined,\n mergedConfig,\n describeFetchError(error, externalSignal?.aborted ? undefined : timeout),\n { cause: error },\n );\n\n return this.runResponseInterceptors(Promise.reject(httpError));\n }\n }\n\n /\n 注册请求 preInterceptors\n /\n private registerRequestPreInterceptors(interceptors?: RequestInterceptor[]) {\n if (!interceptors?.length) {\n return;\n }\n\n for (const interceptor of interceptors) {\n this.interceptors.request.use(\n interceptor.onFulfilled,\n interceptor.onRejected,\n );\n }\n }\n\n /\n 注册响应 preInterceptors\n /\n private registerResponsePreInterceptors(interceptors?: ResponseInterceptor[]) {\n if (!interceptors?.length) {\n return;\n }\n\n for (const interceptor of interceptors) {\n this.interceptors.response.use(\n interceptor.onFulfilled,\n interceptor.onRejected,\n );\n }\n }\n\n /\n 执行请求拦截器链\n /\n private runRequestInterceptors(config: RequestConfig): Promise<RequestConfig> {\n let promise: Promise<RequestConfig> = Promise.resolve(config);\n\n const interceptors: RequestInterceptor[] = [];\n this.interceptors.request.forEach((interceptor) => {\n interceptors.push(interceptor);\n });\n\n for (const interceptor of interceptors) {\n promise = promise.then(\n interceptor.onFulfilled,\n interceptor.onRejected,\n );\n }\n\n return promise;\n }\n\n /\n 执行响应拦截器链\n /\n private async runResponseInterceptors(\n promise: Promise<Response>,\n ): Promise<Response> {\n let currentPromise = promise;\n\n // 按顺序执行所有响应拦截器\n const interceptors: ResponseInterceptor[] = [];\n this.interceptors.response.forEach((interceptor) => {\n interceptors.push(interceptor);\n });\n\n for (const interceptor of interceptors) {\n currentPromise = currentPromise.then(\n interceptor.onFulfilled,\n interceptor.onRejected,\n );\n }\n\n return currentPromise;\n }\n\n /\n 构建完整 URL（包含 baseURL 和 query params）\n /\n private buildUrl(url: string, params?: Record<string, any>): string {\n const baseURL = this.defaultConfig.baseURL;\n\n // 拼接 baseURL 和 url（Axios 风格）\n // - 如果 url 是绝对路径（含协议），直接使用 url\n // - 否则拼接 baseURL 和 url，正确处理斜杠\n let combinedUrl: string;\n if (!baseURL \|\| /^https?:\\/\\//i.test(url)) {\n combinedUrl = url;\n } else {\n combinedUrl = baseURL.replace(/\\/+$/, '') + '/' + url.replace(/^\\/+/, '');\n }\n\n const fullUrl = new URL(combinedUrl);\n\n // 协议白名单检查\n const { allowedProtocols } = this.securityConfig;\n if (allowedProtocols && !allowedProtocols.includes(fullUrl.protocol)) {\n throw new Error(\n `Protocol ${fullUrl.protocol} is not allowed. Allowed: ${allowedProtocols.join(', ')}`\n );\n }\n\n // 合并 query params\n if (params) {\n for (const [key, value] of Object.entries(params)) {\n if (value === undefined \|\| value === null) continue;\n fullUrl.searchParams.set(key, String(value));\n }\n }\n\n return fullUrl.href;\n }\n}\n\n/\n 生成网络错误的 message：拼上 cause 的 code 与原因；AbortError 区分超时与主动取消\n * @param timeout 超时触发时传入，主动取消时为 undefined\n */\nfunction describeFetchError(error: unknown, timeout?: number): string {\n const err = error as (Error & { cause?: { code?: string; message?: string } }) \| undefined;\n if (err?.name === 'AbortError') {\n return timeout ? `Request timeout after ${timeout}ms` : 'Request aborted';\n }\n // 底层报错可能含换行（如 TLS），压成一行\n const detail = [err?.cause?.code, err?.cause?.message]\n .filter(Boolean)\n .join(': ')\n .replace(/\\s+/g, ' ')\n .trim();\n const message = err?.message ?? String(error);\n return detail ? `${message} (${detail})` : message;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,oBAAwD;AAwCjD,IAAM,6BAA6B,KAAK,KAAK;AAC7C,IAAM,8BAA8B;AAE3C,IAAM,aAAa;AAAA,EACjB,KAAK;AAAA,EACL,KAAK;AACP;AAEO,SAAS,iBACd,cACA,QACQ;AACR,QAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC/C,QAAM,UAAqB;AAAA,IACzB,GAAG;AAAA,IACH,KAAK,aAAa;AAAA,IAClB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,aAAa,KAAK,MAAM,OAAO,eAAe,GAAI;AAAA,IACvD,SAAK,0BAAW;AAAA,EAClB;AAEA,QAAM,gBAAgB,gBAAgB,KAAK,UAAU,UAAU,CAAC;AAChE,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,OAAO,CAAC;AAC9D,QAAM,YAAY,KAAK,GAAG,aAAa,IAAI,cAAc,IAAI,OAAO,SAAS;AAE7E,SAAO,GAAG,aAAa,IAAI,cAAc,IAAI,SAAS;AACxD;AAEO,SAAS,wBACd,aACA,QACA,SACW;AACX,QAAM,WAAW,YAAY,MAAM,GAAG;AACtC,MAAI,SAAS,WAAW,GAAG;AACzB,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AAEA,QAAM,CAAC,eAAe,gBAAgB,SAAS,IAAI;AAGnD,QAAM,aAAa,KAAK,MAAM,gBAAgB,aAAa,CAAC;AAC5D,MAAI,WAAW,QAAQ,SAAS;AAC9B,UAAM,IAAI,MAAM,qBAAqB;AAAA,EACvC;AAGA,QAAM,oBAAoB,KAAK,GAAG,aAAa,IAAI,cAAc,IAAI,OAAO,SAAS;AAErF,QAAM,iBAAiB,OAAO,KAAK,iBAAiB;AACpD,QAAM,kBAAkB,OAAO,KAAK,SAAS;AAC7C,MACE,eAAe,WAAW,gBAAgB,UAC1C,KAAC,+BAAgB,gBAAgB,eAAe,GAChD;AACA,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AAGA,QAAM,UAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC;AAG1D,MAAI,CAAC,SAAS,gBAAgB;AAC5B,UAAM,iBAAiB,SAAS,kBAAkB;AAClD,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAGxC,QAAI,QAAQ,QAAQ,QAAW;AAC7B,UAAI,QAAQ,MAAM,iBAAiB,KAAK;AACtC,cAAM,IAAI;AAAA,UACR,wBAAwB,IAAI,KAAK,QAAQ,MAAM,GAAI,EAAE,YAAY,CAAC;AAAA,QACpE;AAAA,MACF;AAAA,IACF;AAGA,QAAI,QAAQ,QAAQ,QAAW;AAC7B,UAAI,QAAQ,MAAM,iBAAiB,KAAK;AACtC,cAAM,IAAI;AAAA,UACR,6CAA6C,IAAI,KAAK,QAAQ,MAAM,GAAI,EAAE,YAAY,CAAC;AAAA,QACzF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,QAAQ,QAAQ,QAAW;AAC7B,UAAI,QAAQ,MAAM,iBAAiB,KAAK;AACtC,cAAM,IAAI;AAAA,UACR,qCAAqC,IAAI,KAAK,QAAQ,MAAM,GAAI,EAAE,YAAY,CAAC;AAAA,QACjF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,KAAK,OAAe,QAAwB;AACnD,aAAO,0BAAW,UAAU,MAAM,EAC/B,OAAO,KAAK,EACZ,OAAO,QAAQ,EACf,QAAQ,MAAM,EAAE,EAChB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG;AACvB;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,OAAO,KAAK,KAAK,EACrB,SAAS,QAAQ,EACjB,QAAQ,MAAM,EAAE,EAChB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG;AACvB;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,QAAM,aAAa,KAAK,MAAM,SAAS,KAAK,MAAM;AAClD,QAAM,SAAS,GAAG,KAAK,GAAG,IAAI,OAAO,SAAS,CAAC,GAC5C,QAAQ,MAAM,GAAG,EACjB,QAAQ,MAAM,GAAG;AACpB,SAAO,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM;AACtD;;;AC7GO,IAAM,kBAAN,MAAsB;AAAA,EACnB,QAAQ,oBAAI,IAAyB;AAAA,EACrC;AAAA,EAER,YAAY,QAA0B;AACpC,SAAK,SAAS;AAAA,MACZ,iBAAiB,IAAI,KAAK;AAAA;AAAA,MAC1B,GAAG;AAAA,IACL;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,SAAS,QAA8B;AACrC,UAAM,WAAW,KAAK,YAAY,MAAM;AACxC,UAAM,SAAS,KAAK,MAAM,IAAI,QAAQ;AACtC,UAAM,MAAM,KAAK,IAAI;AAGrB,QAAI,UAAU,OAAO,cAAc,MAAM,KAAK,OAAO,iBAAiB;AACpE,aAAO,OAAO;AAAA,IAChB;AAGA,UAAM,QAAQ,iBAAiB,QAAQ,KAAK,MAAM;AAClD,UAAM,cAAc,MAAM,KAAK,OAAO;AAEtC,SAAK,MAAM,IAAI,UAAU,EAAE,OAAO,YAAY,CAAC;AAE/C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,aAAmB;AACjB,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAc,QAA4B;AACxC,UAAM,WAAW,KAAK,YAAY,MAAM;AACxC,SAAK,MAAM,OAAO,QAAQ;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,YAAY,QAA8B;AAEhD,UAAM,QAAQ;AAAA,MACZ,OAAO;AAAA,MACP,OAAO,aAAa;AAAA,MACpB,OAAO,WAAW;AAAA,MAClB,OAAO,UAAU;AAAA,MACjB,OAAO,WAAW;AAAA,MAClB,OAAO,cAAc;AAAA,IACvB;AACA,WAAO,MAAM,KAAK,GAAG;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB;AACd,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,aAAa;AACjB,QAAI,eAAe;AAEnB,eAAW,UAAU,KAAK,MAAM,OAAO,GAAG;AACxC,UAAI,OAAO,cAAc,KAAK;AAC5B;AAAA,MACF,OAAO;AACL;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO,KAAK,MAAM;AAAA,MAClB,OAAO;AAAA,MACP,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAUO,IAAM,oBAAN,MAA+C;AAAA,EACpD,YAA6B,OAAe;AAAf;AAC3B,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,MAAM,mDAA+B;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,SAAS,SAA+B;AACtC,WAAO,KAAK;AAAA,EACd;AACF;;;AC5KA,gBAA6B;AAa7B,IAAM,4BAA4B,IAAI,KAAK;AAC3C,IAAM,sBAAsB;AAAA,EAC1B;AACF;AAqBO,IAAM,oBAAN,MAAwB;AAAA,EACrB,QAAQ,oBAAI,IAA6B;AAAA,EACzC;AAAA,EACA;AAAA,EAER,YAAY,QAAkC;AAC5C,SAAK,QAAQ,QAAQ,SAAS;AAC9B,SAAK,kBAAkB,QAAQ,mBAAmB;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,WAAwD;AACtD,UAAM,MAAM,KAAK,IAAI;AAErB,eAAW,YAAY,KAAK,OAAO;AACjC,YAAM,SAAS,KAAK,MAAM,IAAI,QAAQ;AAGtC,UAAI,UAAU,OAAO,cAAc,MAAM,KAAK,iBAAiB;AAC7D,eAAO,EAAE,OAAO,OAAO,OAAO,WAAW,OAAO,UAAU;AAAA,MAC5D;AAGA,YAAM,SAAS,KAAK,aAAa,QAAQ;AACzC,UAAI,QAAQ;AACV,aAAK,MAAM,IAAI,UAAU,MAAM;AAC/B,YAAI,OAAO,cAAc,KAAK;AAC5B,iBAAO,EAAE,OAAO,OAAO,OAAO,WAAW,OAAO,UAAU;AAAA,QAC5D;AAAA,MACF;AAGA,UAAI,UAAU,OAAO,cAAc,KAAK;AACtC,eAAO,EAAE,OAAO,OAAO,OAAO,WAAW,OAAO,UAAU;AAAA,MAC5D;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,aAAmB;AACjB,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEQ,aAAa,UAA0C;AAC7D,QAAI;AACF,YAAM,YAAQ,wBAAa,UAAU,OAAO,EAAE,KAAK;AACnD,UAAI,CAAC,MAAO,QAAO;AAEnB,YAAM,UAAU,KAAK,cAAc,KAAK;AACxC,UAAI,CAAC,SAAS,IAAK,QAAO;AAE1B,aAAO;AAAA,QACL;AAAA,QACA,WAAW,QAAQ,cAAc;AAAA,QACjC,aAAa,QAAQ,MAAM;AAAA,MAC7B;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,cAAc,OAA2C;AAC/D,QAAI;AACF,YAAM,WAAW,MAAM,MAAM,GAAG;AAChC,UAAI,SAAS,WAAW,EAAG,QAAO;AAElC,YAAM,aAAa,KAAK,SAAS,CAAC,EAAE,SAAS,KAAK,MAAM;AACxD,YAAM,SAAS,GAAG,SAAS,CAAC,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC,GAClD,QAAQ,MAAM,GAAG,EACjB,QAAQ,MAAM,GAAG;AAEpB,aAAO,KAAK,MAAM,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM,CAAC;AAAA,IAClE,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACpEA,IAAM,qBAAqB;AAC3B,IAAM,yBAAyB;AAC/B,IAAM,yBAAyB;AAC/B,IAAM,oBAAoB;AAC1B,IAAM,2BAA2B;AACjC,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AAE5B,SAAS,uBAAuB,SAAqD;AAC1F,MAAI,CAAC,SAAS,SAAS;AACrB,WAAO,SAAS;AAAA,EAClB;AAEA,MAAI,QAAQ,SAAS;AACnB,WAAO,QAAQ;AAAA,EACjB;AAEA,QAAM,UAAU,QAAQ,gBACnB,QAAQ,kBAAkB,2BAC1B,QAAQ,aAAa;AAC1B,QAAM,SAAS,QAAQ,IAAI,OAAO;AAClC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,gHAAsB,OAAO,EAAE;AAAA,EACjD;AACA,SAAO;AACT;AAcO,SAAS,uBACd,cACA,SAC6B;AAC7B,MAAI,CAAC,QAAQ,SAAS;AACpB,WAAO;AAAA,EACT;AAEA,4BAA0B,0BAA0B,QAAQ,aAAa;AAGzE,MAAI;AACJ,MAAI,QAAQ,eAAe,SAAS,QAAQ;AAC1C,wBAAoB,IAAI,kBAAkB;AAAA,MACxC,OAAO,QAAQ,cAAc;AAAA,MAC7B,iBAAiB,QAAQ;AAAA,IAC3B,CAAC;AAAA,EACH;AAGA,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,eAAe,QAAQ,gBAAgB;AAE7C,QAAM,YAAY,QAAQ,cAAc,QAAQ,IAAI,YAAY,KAAK;AACrE,QAAM,YAAY,QAAQ,cAAc,QAAQ,IAAI,YAAY,KAAK;AAErE,QAAM,eAAe,QAAQ,gBAAgB;AAG7C,QAAM,eAAe,IAAI,gBAAgB;AAAA,IACvC;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,QAAQ;AAAA,EAC3B,CAAC;AAGD,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,gBAAgB,QAAQ,UAAU,QAAQ,IAAI,QAAQ,KAAK;AACjE,QAAM,oBAAoB,gBAAgB,IAAI,kBAAkB,aAAa,IAAI;AAEjF,QAAM,iBAAiB,QAAQ,kBAAkB;AAGjD,eAAa,QAAQ,IAAI,CAAC,WAA0B;AAElD,QAAI,mBAAmB;AACrB,YAAM,YAAY,kBAAkB,SAAS;AAC7C,UAAI,WAAW;AACb,cAAMA,WAAU;AAAA,UACd,GAAI,OAAO;AAAA,UACX,iBAAiB,UAAU,UAAU,KAAK;AAAA,UAC1C,aAAa,UAAU;AAAA,QACzB;AACA,eAAO,EAAE,GAAG,QAAQ,SAAAA,SAAQ;AAAA,MAC9B;AAAA,IACF;AAEA,8BAA0B,qCAAqC,OAAO,cAAc,YAAY;AAEhG,UAAM,SAAuB;AAAA,MAC3B,GAAI,QAAQ,iBAAiB,CAAC;AAAA,MAC9B,GAAI,OAAO,cAAc,gBAAgB,CAAC;AAAA,MAC1C,YAAY;AAAA,IACd;AAMA,QAAI;AACJ,QAAI,mBAAmB;AACrB,UAAI;AACF,gBAAQ,kBAAkB,SAAS,MAAM;AAAA,MAC3C,QAAQ;AACN,gBAAQ,aAAa,SAAS,MAAM;AAAA,MACtC;AAAA,IACF,OAAO;AACL,cAAQ,aAAa,SAAS,MAAM;AAAA,IACtC;AAGA,UAAM,UAAkC;AAAA,MACtC,GAAI,OAAO;AAAA,MACX,iBAAiB,UAAU,KAAK;AAAA,MAChC,aAAa;AAAA,IACf;AAGA,QAAI,QAAQ,eAAe;AACzB,YAAM,cAAc,QAAQ,IAAI,cAAc;AAC9C,UAAI,aAAa;AACf,gBAAQ,0BAA0B,IAAI;AAAA,MACxC;AAAA,IACF;AAEA,WAAO;AAAA,MACL,GAAG;AAAA,MACH;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAEA,SAAS,0BAA0B,MAAc,QAAyB;AACxE,MAAI,UAAU,OAAO,UAAU,eAAe,KAAK,QAAQ,YAAY,GAAG;AACxE,UAAM,IAAI,MAAM,GAAG,IAAI,4CAAmB;AAAA,EAC5C;AACF;;;ACtMO,IAAM,qBAAN,MAA4B;AAAA,EACzB,eAA6B,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,IAAI,aAAmB,YAA0B;AAC/C,SAAK,aAAa,KAAK,EAAE,aAAa,WAAW,CAAM;AACvD,WAAO,KAAK,aAAa,SAAS;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IAAkB;AACtB,QAAI,KAAK,aAAa,EAAE,GAAG;AACzB,WAAK,aAAa,EAAE,IAAI;AAAA,IAC1B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,QAAc;AACZ,SAAK,eAAe,CAAC;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,IAAoC;AAC1C,SAAK,aAAa,QAAQ,CAAC,gBAAgB;AACzC,UAAI,gBAAgB,MAAM;AACxB,WAAG,WAAW;AAAA,MAChB;AAAA,IACF,CAAC;AAAA,EACH;AACF;;;ACpCO,SAAS,cAAc,OAAqB;AACjD,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,SAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEO,SAAS,iBAAiB,SAA0D;AACzF,MAAI,CAAC,SAAS;AACZ,WAAO,CAAC;AAAA,EACV;AAEA,MAAI,mBAAmB,SAAS;AAC9B,UAAMC,cAAqC,CAAC;AAC5C,YAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC9B,MAAAA,YAAW,GAAG,IAAI;AAAA,IACpB,CAAC;AACD,WAAOA;AAAA,EACT;AAEA,MAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,WAAO,QAAQ,OAA+B,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM;AACnE,UAAI,GAAG,IAAI;AACX,aAAO;AAAA,IACT,GAAG,CAAC,CAAC;AAAA,EACP;AAEA,QAAM,aAAqC,CAAC;AAC5C,SAAO,QAAQ,OAAqD,EAAE;AAAA,IACpE,CAAC,CAAC,KAAK,KAAK,MAAM;AAChB,YAAM,kBAAkB,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,GAAG,IAAI;AACjE,iBAAW,GAAG,IAAI;AAAA,IACpB;AAAA,EACF;AACA,SAAO;AACT;;;ACzBO,IAAM,YAAN,MAAM,mBAAkB,MAAM;AAAA,EACnB,cAAuB;AAAA,EAChC;AAAA,EACA;AAAA,EAEP,YACE,UACA,QACA,SACA,SACA;AACA,UAAM,WAAW,8BAA8B,UAAU,UAAU,SAAS,IAAI,OAAO;AACvF,SAAK,OAAO;AACZ,SAAK,WAAW;AAChB,SAAK,SAAS,eAAe,MAAM;AACnC,WAAO,eAAe,MAAM,WAAU,SAAS;AAAA,EACjD;AACF;AAiEA,SAAS,eAAe,QAA0C;AAChE,QAAM,EAAE,SAAS,GAAG,KAAK,IAAI;AAE7B,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,gBAAgB,OAAO;AAAA,EAClC;AACF;AAOA,SAAS,gBAAgB,SAAsE;AAC7F,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,iBAAiB,OAAO;AAC3C,QAAM,YAAoC,CAAC;AAE3C,QAAM,mBAAmB,CAAC,iBAAiB,aAAa,UAAU,UAAU;AAE5E,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACrD,UAAM,WAAW,IAAI,YAAY;AACjC,QAAI,iBAAiB,SAAS,QAAQ,GAAG;AACvC,gBAAU,GAAG,IAAI;AAAA,IACnB,OAAO;AACL,gBAAU,GAAG,IAAI;AAAA,IACnB;AAAA,EACF;AAEA,SAAO;AACT;;;AC5EO,IAAM,aAAN,MAAiB;AAAA,EACd;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAID,eAAe;AAAA,IACpB,SAAS,IAAI,mBAAuC;AAAA,IACpD,UAAU,IAAI,mBAAwC;AAAA,EACxD;AAAA,EAEA,YAAY,QAA2B;AACrC,UAAM,EAAE,UAAU,UAAU,iBAAiB,GAAG,WAAW,IAAI,UAAU,CAAC;AAE1E,SAAK,gBAAgB;AAAA,MACnB,SAAS;AAAA,MACT,GAAG;AAAA,IACL;AAGA,UAAM,aAAa,UAAU,cAAc;AAC3C,SAAK,iBAAiB;AAAA,MACpB,kBAAkB,aAAa,CAAC,SAAS,QAAQ,IAAI;AAAA,MACrD,iBAAiB,aAAa,KAAK,OAAO,OAAO;AAAA;AAAA,MACjD;AAAA,MACA,GAAG;AAAA,IACL;AAEA,SAAK,+BAA+B,iBAAiB,OAAO;AAE5D,QAAI,UAAU,SAAS;AACrB,UAAI,CAAC,KAAK,cAAc,SAAS;AAC/B,aAAK,cAAc,UAAU,uBAAuB,QAAQ;AAAA,MAC9D;AACA,6BAAuB,KAAK,cAAc,QAAQ;AAAA,IACpD;AAEA,SAAK,gCAAgC,iBAAiB,QAAQ;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IAAI,KAAa,QAA2C;AAChE,WAAO,KAAK,QAAQ,EAAE,GAAG,QAAQ,KAAK,QAAQ,MAAM,CAAC;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,KAAK,KAAa,MAAY,QAA2C;AAC7E,UAAM,UAAkC,EAAE,GAAG,QAAQ,QAAQ;AAC7D,QAAI,OAAY;AAEhB,QAAI,cAAc,IAAI,GAAG;AACvB,aAAO,KAAK,UAAU,IAAI;AAC1B,UAAI,CAAC,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,IAAI,YAAY,MAAM,cAAc,GAAG;AAC7E,gBAAQ,cAAc,IAAI;AAAA,MAC5B;AAAA,IACF;AAEA,WAAO,KAAK,QAAQ;AAAA,MAClB,GAAG;AAAA,MACH;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IAAI,KAAa,MAAY,QAA2C;AAC5E,UAAM,UAAkC,EAAE,GAAG,QAAQ,QAAQ;AAC7D,QAAI,OAAY;AAEhB,QAAI,cAAc,IAAI,GAAG;AACvB,aAAO,KAAK,UAAU,IAAI;AAC1B,UAAI,CAAC,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,IAAI,YAAY,MAAM,cAAc,GAAG;AAC7E,gBAAQ,cAAc,IAAI;AAAA,MAC5B;AAAA,IACF;AAEA,WAAO,KAAK,QAAQ;AAAA,MAClB,GAAG;AAAA,MACH;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAO,KAAa,QAA2C;AACnE,WAAO,KAAK,QAAQ,EAAE,GAAG,QAAQ,KAAK,QAAQ,SAAS,CAAC;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAM,KAAa,MAAY,QAA2C;AAC9E,UAAM,UAAkC,EAAE,GAAG,QAAQ,QAAQ;AAC7D,QAAI,OAAY;AAEhB,QAAI,cAAc,IAAI,GAAG;AACvB,aAAO,KAAK,UAAU,IAAI;AAC1B,UAAI,CAAC,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,IAAI,YAAY,MAAM,cAAc,GAAG;AAC7E,gBAAQ,cAAc,IAAI;AAAA,MAC5B;AAAA,IACF;AAEA,WAAO,KAAK,QAAQ;AAAA,MAClB,GAAG;AAAA,MACH;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAQ,QAA0C;AAGtD,UAAM,cAAc,iBAAiB,KAAK,cAAc,OAAO;AAC/D,UAAM,kBAAkB,iBAAiB,OAAO,OAAO;AACvD,UAAM,eAA+D,CAAC;AAEtE,eAAW,OAAO,aAAa;AAC7B,mBAAa,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,YAAY,GAAG,EAAE;AAAA,IACnE;AACA,eAAW,OAAO,iBAAiB;AACjC,mBAAa,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,gBAAgB,GAAG,EAAE;AAAA,IACvE;AAEA,UAAM,eAAuC,CAAC;AAC9C,eAAW,YAAY,cAAc;AACnC,YAAM,EAAE,KAAK,MAAM,IAAI,aAAa,QAAQ;AAC5C,mBAAa,GAAG,IAAI;AAAA,IACtB;AAEA,QAAI,eAA8B;AAAA,MAChC,GAAG,KAAK;AAAA,MACR,GAAG;AAAA,MACH,SAAS;AAAA,IACX;AAGA,QAAI;AACF,qBAAe,MAAM,KAAK,uBAAuB,YAAY;AAAA,IAC/D,SAAS,OAAO;AACd,aAAO,QAAQ,OAAO,KAAK;AAAA,IAC7B;AAGA,iBAAa,UAAU,iBAAiB,aAAa,OAAO;AAG5D,UAAM,UAAU,KAAK,SAAS,aAAa,KAAM,aAAa,MAAM;AAGpE,UAAM,UAAU,aAAa,WAAW,KAAK,cAAc,WAAW;AACtE,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,YAAY,WAAW,MAAM,WAAW,MAAM,GAAG,OAAO;AAG9D,UAAM,iBAAiB,aAAa;AACpC,QAAI,gBAAgB;AAElB,UAAI,eAAe,SAAS;AAC1B,qBAAa,SAAS;AACtB,mBAAW,MAAM;AAAA,MACnB,OAAO;AAEL,uBAAe,iBAAiB,SAAS,MAAM,WAAW,MAAM,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,MACnF;AAAA,IACF;AAGA,UAAM,EAAE,cAAc,QAAQ,SAAS,UAAU,SAAS,KAAK,GAAG,aAAa,IAAI;AAEnF,QAAI;AAEF,YAAM,WAAW,MAAM,MAAM,SAAS;AAAA,QACpC,GAAG;AAAA,QACH,QAAQ,WAAW;AAAA;AAAA,MACrB,CAAC;AAED,mBAAa,SAAS;AAGtB,UAAI,KAAK,eAAe,kBAAkB,GAAG;AAC3C,cAAM,gBAAgB,SAAS,QAAQ,IAAI,gBAAgB;AAC3D,YAAI,eAAe;AACjB,gBAAM,OAAO,SAAS,eAAe,EAAE;AACvC,cAAI,OAAO,KAAK,eAAe,iBAAiB;AAC9C,kBAAM,IAAI;AAAA,cACR,iBAAiB,IAAI,2BAA2B,KAAK,eAAe,eAAe;AAAA,YACrF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAGA,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,QAAQ,IAAI,UAAU,UAAU,YAAY;AAClD,eAAO,KAAK,wBAAwB,QAAQ,OAAO,KAAK,CAAC;AAAA,MAC3D;AAGA,aAAO,KAAK,wBAAwB,QAAQ,QAAQ,QAAQ,CAAC;AAAA,IAC/D,SAAS,OAAO;AACd,mBAAa,SAAS;AAGtB,YAAM,YACJ,iBAAiB,YACb,QACA,IAAI;AAAA,QACJ;AAAA,QACA;AAAA,QACA,mBAAmB,OAAO,gBAAgB,UAAU,SAAY,OAAO;AAAA,QACvE,EAAE,OAAO,MAAM;AAAA,MACjB;AAEJ,aAAO,KAAK,wBAAwB,QAAQ,OAAO,SAAS,CAAC;AAAA,IAC/D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,+BAA+B,cAAqC;AAC1E,QAAI,CAAC,cAAc,QAAQ;AACzB;AAAA,IACF;AAEA,eAAW,eAAe,cAAc;AACtC,WAAK,aAAa,QAAQ;AAAA,QACxB,YAAY;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,gCAAgC,cAAsC;AAC5E,QAAI,CAAC,cAAc,QAAQ;AACzB;AAAA,IACF;AAEA,eAAW,eAAe,cAAc;AACtC,WAAK,aAAa,SAAS;AAAA,QACzB,YAAY;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,uBAAuB,QAA+C;AAC5E,QAAI,UAAkC,QAAQ,QAAQ,MAAM;AAE5D,UAAM,eAAqC,CAAC;AAC5C,SAAK,aAAa,QAAQ,QAAQ,CAAC,gBAAgB;AACjD,mBAAa,KAAK,WAAW;AAAA,IAC/B,CAAC;AAED,eAAW,eAAe,cAAc;AACtC,gBAAU,QAAQ;AAAA,QAChB,YAAY;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,wBACZ,SACmB;AACnB,QAAI,iBAAiB;AAGrB,UAAM,eAAsC,CAAC;AAC7C,SAAK,aAAa,SAAS,QAAQ,CAAC,gBAAgB;AAClD,mBAAa,KAAK,WAAW;AAAA,IAC/B,CAAC;AAED,eAAW,eAAe,cAAc;AACtC,uBAAiB,eAAe;AAAA,QAC9B,YAAY;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,SAAS,KAAa,QAAsC;AAClE,UAAM,UAAU,KAAK,cAAc;AAKnC,QAAI;AACJ,QAAI,CAAC,WAAW,gBAAgB,KAAK,GAAG,GAAG;AACzC,oBAAc;AAAA,IAChB,OAAO;AACL,oBAAc,QAAQ,QAAQ,QAAQ,EAAE,IAAI,MAAM,IAAI,QAAQ,QAAQ,EAAE;AAAA,IAC1E;AAEA,UAAM,UAAU,IAAI,IAAI,WAAW;AAGnC,UAAM,EAAE,iBAAiB,IAAI,KAAK;AAClC,QAAI,oBAAoB,CAAC,iBAAiB,SAAS,QAAQ,QAAQ,GAAG;AACpE,YAAM,IAAI;AAAA,QACR,YAAY,QAAQ,QAAQ,6BAA6B,iBAAiB,KAAK,IAAI,CAAC;AAAA,MACtF;AAAA,IACF;AAGA,QAAI,QAAQ;AACV,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,YAAI,UAAU,UAAa,UAAU,KAAM;AAC3C,gBAAQ,aAAa,IAAI,KAAK,OAAO,KAAK,CAAC;AAAA,MAC7C;AAAA,IACF;AAEA,WAAO,QAAQ;AAAA,EACjB;AACF;AAMA,SAAS,mBAAmB,OAAgB,SAA0B;AACpE,QAAM,MAAM;AACZ,MAAI,KAAK,SAAS,cAAc;AAC9B,WAAO,UAAU,yBAAyB,OAAO,OAAO;AAAA,EAC1D;AAEA,QAAM,SAAS,CAAC,KAAK,OAAO,MAAM,KAAK,OAAO,OAAO,EAClD,OAAO,OAAO,EACd,KAAK,IAAI,EACT,QAAQ,QAAQ,GAAG,EACnB,KAAK;AACR,QAAM,UAAU,KAAK,WAAW,OAAO,KAAK;AAC5C,SAAO,SAAS,GAAG,OAAO,KAAK,MAAM,MAAM;AAC7C;","names":["headers","normalized"]}
1	+ {"version":3,"sources":["../src/index.ts","../src/helper/jwt.ts","../src/helper/jwt-manager.ts","../src/helper/file-token-provider.ts","../src/plugins/platform-plugin.ts","../src/core/InterceptorManager.ts","../src/core/utils.ts","../src/core/types.ts","../src/core/HttpClient.ts"],"sourcesContent":["export { HttpClient } from './core/HttpClient';\nexport { HttpError } from './core/types';\nexport type {\n RequestConfig,\n HttpClientConfig,\n HttpClientPreInterceptors,\n RequestInterceptor,\n ResponseInterceptor,\n SecurityConfig,\n SafeRequestConfig,\n} from './core/types';\n\nexport type { CustomClaims, JWTClaims, JWTConfig, JWTVerifyOptions } from './helper/jwt';\nexport {\n generateJWTToken,\n parseJWTTokenWithVerify,\n DEFAULT_JWT_EXPIRE_TIME_MS,\n DEFAULT_CLOCK_TOLERANCE_SEC,\n} from './helper/jwt';\n\nexport type {\n PlatformPluginOptions,\n PlatformRequestAuthConfig,\n PlatformClaims,\n TokenProviderConfig,\n} from './plugins/platform-plugin';\nexport {\n registerPlatformPlugin,\n resolvePlatformBaseURL,\n} from './plugins/platform-plugin';\n\nexport { FileTokenProvider } from './helper/file-token-provider';\nexport type { FileTokenProviderConfig } from './helper/file-token-provider';\n\n","import { createHmac, randomUUID, timingSafeEqual } from 'crypto';\n\nexport interface CustomClaims {\n tenant_id?: string;\n user_id?: string;\n app_id?: string;\n app_env?: string;\n sandbox_id?: string;\n access_key: string;\n}\n\nexport interface JWTClaims extends CustomClaims {\n iss: string;\n iat: number;\n nbf: number;\n exp: number;\n jti: string;\n [key: string]: any;\n}\n\nexport interface JWTConfig {\n accessKey: string;\n secretKey: string;\n expireTimeMs: number;\n}\n\nexport interface JWTVerifyOptions {\n /*\n 时钟容差（秒），用于处理服务器时间不同步的情况\n * 默认 60 秒\n /\n clockTolerance?: number;\n\n /\n 是否跳过过期验证（仅用于调试）\n * 默认 false\n /\n skipExpiration?: boolean;\n}\n\nexport const DEFAULT_JWT_EXPIRE_TIME_MS = 30 60 * 1000;\nexport const DEFAULT_CLOCK_TOLERANCE_SEC = 60;\n\nconst JWT_HEADER = {\n alg: 'HS256',\n typ: 'JWT',\n};\n\nexport function generateJWTToken(\n customClaims: CustomClaims,\n config: JWTConfig,\n): string {\n const nowSeconds = Math.floor(Date.now() / 1000);\n const payload: JWTClaims = {\n ...customClaims,\n iss: customClaims.access_key,\n iat: nowSeconds,\n nbf: nowSeconds,\n exp: nowSeconds + Math.floor(config.expireTimeMs / 1000),\n jti: randomUUID(),\n };\n\n const encodedHeader = base64UrlEncode(JSON.stringify(JWT_HEADER));\n const encodedPayload = base64UrlEncode(JSON.stringify(payload));\n const signature = sign(`${encodedHeader}.${encodedPayload}`, config.secretKey);\n\n return `${encodedHeader}.${encodedPayload}.${signature}`;\n}\n\nexport function parseJWTTokenWithVerify(\n tokenString: string,\n config: JWTConfig,\n options?: JWTVerifyOptions,\n): JWTClaims {\n const segments = tokenString.split('.');\n if (segments.length !== 3) {\n throw new Error('invalid JWT token format');\n }\n\n const [encodedHeader, encodedPayload, signature] = segments;\n\n // 1. 验证 header\n const headerJson = JSON.parse(base64UrlDecode(encodedHeader));\n if (headerJson.alg !== 'HS256') {\n throw new Error('unsupported JWT alg');\n }\n\n // 2. 验证签名\n const expectedSignature = sign(`${encodedHeader}.${encodedPayload}`, config.secretKey);\n\n const expectedBuffer = Buffer.from(expectedSignature);\n const signatureBuffer = Buffer.from(signature);\n if (\n expectedBuffer.length !== signatureBuffer.length \|\|\n !timingSafeEqual(expectedBuffer, signatureBuffer)\n ) {\n throw new Error('JWT signature verification failed');\n }\n\n // 3. 解析 payload\n const payload = JSON.parse(base64UrlDecode(encodedPayload)) as JWTClaims;\n\n // 4. 验证时间声明\n if (!options?.skipExpiration) {\n const clockTolerance = options?.clockTolerance ?? DEFAULT_CLOCK_TOLERANCE_SEC;\n const now = Math.floor(Date.now() / 1000);\n\n // 验证 exp (过期时间)\n if (payload.exp !== undefined) {\n if (payload.exp + clockTolerance < now) {\n throw new Error(\n `JWT token expired at ${new Date(payload.exp * 1000).toISOString()}`,\n );\n }\n }\n\n // 验证 nbf (生效时间)\n if (payload.nbf !== undefined) {\n if (payload.nbf - clockTolerance > now) {\n throw new Error(\n `JWT token not yet valid, will be valid at ${new Date(payload.nbf * 1000).toISOString()}`,\n );\n }\n }\n\n // 验证 iat (签发时间) - 防止未来时间的 token\n if (payload.iat !== undefined) {\n if (payload.iat - clockTolerance > now) {\n throw new Error(\n `JWT token issued in the future at ${new Date(payload.iat * 1000).toISOString()}`,\n );\n }\n }\n }\n\n return payload;\n}\n\nfunction sign(input: string, secret: string): string {\n return createHmac('sha256', secret)\n .update(input)\n .digest('base64')\n .replace(/=/g, '')\n .replace(/\\+/g, '-')\n .replace(/\\//g, '_');\n}\n\nfunction base64UrlEncode(input: string): string {\n return Buffer.from(input)\n .toString('base64')\n .replace(/=/g, '')\n .replace(/\\+/g, '-')\n .replace(/\\//g, '_');\n}\n\nfunction base64UrlDecode(input: string): string {\n const padLength = (4 - (input.length % 4 \|\| 4)) % 4;\n const padded = `${input}${'='.repeat(padLength)}`\n .replace(/-/g, '+')\n .replace(/_/g, '/');\n return Buffer.from(padded, 'base64').toString('utf8');\n}\n","import { CustomClaims, JWTConfig, generateJWTToken } from './jwt';\n\n/*\n Token 来源的最小抽象。`platform-plugin` 用它做 primary / fallback 链\n * (env token 优先,sk 自签兜底)。`JWTTokenManager`(下方)和 `StaticTokenSource`\n * (本文件底部)都实现这个接口。\n /\nexport interface TokenSource {\n /\n 拿一个可用的 token(用作 Authorization Bearer)。拿不到必须抛 —— 调用方据此决定走 fallback。\n * 不要返回空串 / null,会让上层 `if (token)` 误判通过。\n /\n getToken(claims: CustomClaims): string;\n}\n\ninterface CachedToken {\n token: string;\n expiresAtMs: number;\n}\n\ninterface JWTManagerConfig extends JWTConfig {\n /\n 在过期前多久刷新 token（毫秒）\n * 默认 5 分钟\n /\n refreshBeforeMs?: number;\n}\n\n/\n JWT Token 管理器，负责 token 的生成、缓存和自动刷新\n \n 缓存策略：\n * - 基于 claims 的哈希值作为缓存 key（支持多租户+多用户）\n * - 在 token 过期前 refreshBeforeMs 时间内自动刷新\n \n @example\n * ```typescript\n * const manager = new JWTTokenManager({\n * accessKey: 'your-access-key',\n * secretKey: 'your-secret-key',\n * expireTimeMs: 30 * 60 * 1000,\n * refreshBeforeMs: 5 * 60 * 1000,\n * });\n \n // 获取 token（会自动缓存）\n * const token = manager.getToken({\n * access_key: 'your-access-key',\n * tenant_id: '1001',\n * user_id: 'user123',\n * });\n * ```\n /\nexport class JWTTokenManager {\n private cache = new Map<string, CachedToken>();\n private config: Required<JWTManagerConfig>;\n\n constructor(config: JWTManagerConfig) {\n this.config = {\n refreshBeforeMs: 5 60 * 1000, // 默认 5 分钟\n ...config,\n };\n }\n\n /*\n 获取 JWT token，优先使用缓存\n \n 如果缓存的 token 即将过期（距离过期时间小于 refreshBeforeMs），\n * 则会生成新的 token 并更新缓存\n \n @param claims - JWT claims\n * @returns JWT token 字符串\n /\n getToken(claims: CustomClaims): string {\n const cacheKey = this.getCacheKey(claims);\n const cached = this.cache.get(cacheKey);\n const now = Date.now();\n\n // 检查缓存是否有效（未过期且不需要刷新）\n if (cached && cached.expiresAtMs - now > this.config.refreshBeforeMs) {\n return cached.token;\n }\n\n // 生成新 token\n const token = generateJWTToken(claims, this.config);\n const expiresAtMs = now + this.config.expireTimeMs;\n\n this.cache.set(cacheKey, { token, expiresAtMs });\n\n return token;\n }\n\n /\n 清除所有缓存的 token\n /\n clearCache(): void {\n this.cache.clear();\n }\n\n /\n 清除特定 claims 的缓存\n \n @param claims - 要清除的 claims\n /\n clearCacheFor(claims: CustomClaims): void {\n const cacheKey = this.getCacheKey(claims);\n this.cache.delete(cacheKey);\n }\n\n /\n 生成缓存 key（基于关键的 claims 字段）\n \n 使用稳定的字段顺序确保相同 claims 生成相同 key\n \n @private\n /\n private getCacheKey(claims: CustomClaims): string {\n // 使用稳定的字段顺序确保相同 claims 生成相同 key\n const parts = [\n claims.access_key,\n claims.tenant_id \|\| '',\n claims.user_id \|\| '',\n claims.app_id \|\| '',\n claims.app_env \|\| '',\n claims.sandbox_id \|\| '',\n ];\n return parts.join(':');\n }\n\n /\n 获取缓存统计信息（用于监控和调试）\n \n @returns 缓存统计信息\n /\n getCacheStats() {\n const now = Date.now();\n let validCount = 0;\n let expiredCount = 0;\n\n for (const cached of this.cache.values()) {\n if (cached.expiresAtMs > now) {\n validCount++;\n } else {\n expiredCount++;\n }\n }\n\n return {\n total: this.cache.size,\n valid: validCount,\n expired: expiredCount,\n };\n }\n}\n\n/\n 平台直接派发的静态 token(短期凭据,默认 5 天有效,当前实现为 JWT 但对调用方不透明),\n * client 不签也不刷,拿到啥就用啥。过期了 server 端会 401,由 platform-plugin 的 fallback 链\n * 退到 sk 自签(JWTTokenManager)。\n \n 用于 §2.2 InnerAPI 鉴权 — ak/sk → token + ak 演进:\n * `.env.local` 仅注入 token(不再下发 sk),消除 sk 长期落地的泄漏面。\n /\nexport class StaticTokenSource implements TokenSource {\n constructor(private readonly token: string) {\n if (!token) {\n throw new Error('StaticTokenSource: token 不能为空');\n }\n }\n\n getToken(_claims: CustomClaims): string {\n return this.token;\n }\n}\n","import { readFileSync } from 'fs';\n\ninterface CachedFileToken {\n token: string;\n accessKey: string;\n expiresAtMs: number;\n}\n\nexport interface FileTokenProviderConfig {\n paths?: string[];\n refreshBeforeMs?: number;\n}\n\nconst DEFAULT_REFRESH_BEFORE_MS = 5 60 * 1000;\nconst DEFAULT_TOKEN_PATHS = [\n '/home/gem/workspace/.force/openclaw/miaoda-provider-key',\n];\n\n/*\n 从文件读取 JWT Token 的 Provider\n \n 支持多路径优先级链：按顺序尝试读取，命中第一个有效 token 即返回。\n * 缓存策略基于 token 自身的 exp 字段，在过期前 refreshBeforeMs 窗口内重新读取文件。\n \n @example\n * ```typescript\n * const provider = new FileTokenProvider({\n * paths: ['/path/a/token', '/path/b/token'],\n * refreshBeforeMs: 5 * 60 * 1000,\n * });\n \n const result = provider.getToken();\n * if (result) {\n * console.log(result.token, result.accessKey);\n * }\n * ```\n /\nexport class FileTokenProvider {\n private cache = new Map<string, CachedFileToken>();\n private paths: string[];\n private refreshBeforeMs: number;\n\n constructor(config?: FileTokenProviderConfig) {\n this.paths = config?.paths ?? DEFAULT_TOKEN_PATHS;\n this.refreshBeforeMs = config?.refreshBeforeMs ?? DEFAULT_REFRESH_BEFORE_MS;\n }\n\n /\n 获取 token，按路径优先级依次尝试\n \n 1. 缓存有效且不在刷新窗口 → 直接返回\n * 2. 进入刷新窗口 → 重读文件，更新缓存\n * 3. 文件未更新但缓存未过期 → 仍返回旧缓存\n * 4. 所有路径均无有效 token → 返回 null\n /\n getToken(): { token: string; accessKey: string } \| null {\n const now = Date.now();\n\n for (const filePath of this.paths) {\n const cached = this.cache.get(filePath);\n\n // 缓存命中且不在刷新窗口\n if (cached && cached.expiresAtMs - now > this.refreshBeforeMs) {\n return { token: cached.token, accessKey: cached.accessKey };\n }\n\n // 需要读取/重读文件\n const result = this.readAndParse(filePath);\n if (result) {\n this.cache.set(filePath, result);\n if (result.expiresAtMs > now) {\n return { token: result.token, accessKey: result.accessKey };\n }\n }\n\n // 文件未更新，但缓存的 token 仍未过期\n if (cached && cached.expiresAtMs > now) {\n return { token: cached.token, accessKey: cached.accessKey };\n }\n }\n\n return null;\n }\n\n clearCache(): void {\n this.cache.clear();\n }\n\n private readAndParse(filePath: string): CachedFileToken \| null {\n try {\n const token = readFileSync(filePath, 'utf-8').trim();\n if (!token) return null;\n\n const payload = this.decodePayload(token);\n if (!payload?.exp) return null;\n\n return {\n token,\n accessKey: payload.access_key ?? '',\n expiresAtMs: payload.exp 1000,\n };\n } catch {\n return null;\n }\n }\n\n private decodePayload(token: string): Record<string, any> \| null {\n try {\n const segments = token.split('.');\n if (segments.length !== 3) return null;\n\n const padLength = (4 - (segments[1].length % 4 \|\| 4)) % 4;\n const padded = `${segments[1]}${'='.repeat(padLength)}`\n .replace(/-/g, '+')\n .replace(/_/g, '/');\n\n return JSON.parse(Buffer.from(padded, 'base64').toString('utf8'));\n } catch {\n return null;\n }\n }\n}\n","import type { RequestConfig, RequestInterceptor } from '../core/types';\nimport {\n DEFAULT_JWT_EXPIRE_TIME_MS,\n CustomClaims,\n} from '../helper/jwt';\nimport { JWTTokenManager, StaticTokenSource } from '../helper/jwt-manager';\nimport { FileTokenProvider } from '../helper/file-token-provider';\n\nexport type PlatformClaims = Omit<CustomClaims, 'access_key'>;\n\nexport interface TokenProviderConfig {\n type: 'file';\n paths?: string[];\n}\n\nexport interface PlatformPluginOptions {\n enabled?: boolean;\n baseURL?: string;\n domainEnv?: string;\n accessKeyEnv?: string;\n secretKeyEnv?: string;\n accessKey?: string;\n secretKey?: string;\n expireTimeMs?: number;\n refreshBeforeMs?: number;\n defaultClaims?: PlatformClaims;\n /*\n 平台直接派发的静态 token（短期凭据，默认 5 天有效，当前实现为 JWT）。配置后：\n * - 优先用此 token 调 InnerAPI（不再用 sk 自签），消除 sk 长期落地的泄漏面\n * - 若同时配置了 sk（accessKey/secretKey 或对应 env），sk 自签作为最终 fallback\n * 优先级：`token` option > `process.env[tokenEnv ?? 'FORCE_AUTHN_TOKEN']`\n * 与 `tokenProvider`（文件 token）共存：fileToken > envToken > sk 自签。\n /\n token?: string;\n tokenEnv?: string;\n /\n 管理端 innerapi 链路（仅用于妙搭开发态）\n * 启用后：\n * - baseURL 改从 adminDomainEnv（默认 MIAODA_DEV_INNER_DOMAIN_WITH_PREFIX）读取\n * - 每次请求从 clientTokenEnv（默认 MIAODA_AUTHN_CODE）读取用户凭证，\n * 注入为 X-Miaoda-Client-Token 请求头（读不到则不注入）\n * - AK/SK 的 Authorization + x-api-key 照旧\n /\n adminInnerApi?: boolean;\n adminDomainEnv?: string;\n clientTokenEnv?: string;\n tokenProvider?: TokenProviderConfig;\n}\n\nexport interface PlatformRequestAuthConfig {\n customClaims?: PlatformClaims;\n}\n\nconst DEFAULT_DOMAIN_ENV = 'FORCE_AUTHN_INNERAPI_DOMAIN';\nconst DEFAULT_ACCESS_KEY_ENV = 'FORCE_AUTHN_ACCESS_KEY';\nconst DEFAULT_SECRET_KEY_ENV = 'FORCE_AUTHN_ACCESS_SECRET';\nconst DEFAULT_TOKEN_ENV = 'FORCE_AUTHN_TOKEN';\nconst DEFAULT_ADMIN_DOMAIN_ENV = 'MIAODA_DEV_INNER_DOMAIN_WITH_PREFIX';\nconst DEFAULT_CLIENT_TOKEN_ENV = 'MIAODA_AUTHN_CODE';\nconst MIAODA_CLIENT_TOKEN_HEADER = 'X-Miaoda-Client-Token';\n\nexport function resolvePlatformBaseURL(options?: PlatformPluginOptions): string \| undefined {\n if (!options?.enabled) {\n return options?.baseURL;\n }\n\n if (options.baseURL) {\n return options.baseURL;\n }\n\n const envName = options.adminInnerApi\n ? (options.adminDomainEnv \|\| DEFAULT_ADMIN_DOMAIN_ENV)\n : (options.domainEnv \|\| DEFAULT_DOMAIN_ENV);\n const domain = process.env[envName];\n if (!domain) {\n throw new Error(`平台模式需要基础域名，请设置环境变量 ${envName}`);\n }\n return domain;\n}\n\ntype RequestInterceptorManager = {\n use: (\n onFulfilled?: RequestInterceptor['onFulfilled'],\n onRejected?: RequestInterceptor['onRejected'],\n ) => number;\n eject: (id: number) => void;\n};\n\ninterface InterceptorHost {\n request: RequestInterceptorManager;\n}\n\nexport function registerPlatformPlugin(\n interceptors: InterceptorHost,\n options: PlatformPluginOptions,\n): JWTTokenManager \| undefined {\n if (!options.enabled) {\n return undefined;\n }\n\n ensureNoAccessKeyOverride('platform.defaultClaims', options.defaultClaims);\n\n // 创建文件 token provider（如果配置了）\n let fileTokenProvider: FileTokenProvider \| undefined;\n if (options.tokenProvider?.type === 'file') {\n fileTokenProvider = new FileTokenProvider({\n paths: options.tokenProvider.paths,\n refreshBeforeMs: options.refreshBeforeMs,\n });\n }\n\n // 提前检查 AK/SK，避免每次请求时检查\n const accessKeyEnv = options.accessKeyEnv \|\| DEFAULT_ACCESS_KEY_ENV;\n const secretKeyEnv = options.secretKeyEnv \|\| DEFAULT_SECRET_KEY_ENV;\n\n const accessKey = options.accessKey ?? (process.env[accessKeyEnv] \|\| '');\n const secretKey = options.secretKey ?? (process.env[secretKeyEnv] \|\| '');\n\n const expireTimeMs = options.expireTimeMs ?? DEFAULT_JWT_EXPIRE_TIME_MS;\n\n // 创建 JWT Token Manager（支持缓存和自动刷新，同时作为 fallback）\n const tokenManager = new JWTTokenManager({\n accessKey,\n secretKey,\n expireTimeMs,\n refreshBeforeMs: options.refreshBeforeMs,\n });\n\n // 平台派发的静态 token（可选；有则在 fileToken 之后、sk 自签之前用，消除 sk 长期落地的泄漏面）\n const tokenEnv = options.tokenEnv \|\| DEFAULT_TOKEN_ENV;\n const platformToken = options.token ?? (process.env[tokenEnv] \|\| '');\n const staticTokenSource = platformToken ? new StaticTokenSource(platformToken) : null;\n\n const clientTokenEnv = options.clientTokenEnv \|\| DEFAULT_CLIENT_TOKEN_ENV;\n\n // 注册请求拦截器\n interceptors.request.use((config: RequestConfig) => {\n // 优先尝试文件 token\n if (fileTokenProvider) {\n const fileToken = fileTokenProvider.getToken();\n if (fileToken) {\n const headers = {\n ...(config.headers as Record<string, string>),\n 'Authorization': `Bearer ${fileToken.token}`,\n 'x-api-key': fileToken.accessKey,\n };\n return { ...config, headers };\n }\n }\n\n ensureNoAccessKeyOverride('request.platformAuth.customClaims', config.platformAuth?.customClaims);\n\n const claims: CustomClaims = {\n ...(options.defaultClaims \|\| {}),\n ...(config.platformAuth?.customClaims \|\| {}),\n access_key: accessKey,\n };\n\n // 次选 envToken（FORCE_AUTHN_TOKEN env / options.token）—— 短期凭据,跟 fileToken 同样\n // 替代 sk 长期落地。envToken 拿到才用,拿不到继续往下退到 sk 自签。\n // 注:StaticTokenSource.getToken 当前实现是直接返回构造时传入的 token,不会抛 —— 即便将来\n // 改成可能抛的实现(比如带过期校验),也走 sk 自签 fallback。\n let token: string;\n if (staticTokenSource) {\n try {\n token = staticTokenSource.getToken(claims);\n } catch {\n token = tokenManager.getToken(claims);\n }\n } else {\n token = tokenManager.getToken(claims);\n }\n\n // 统一使用 Record<string, string> 类型，由 client.ts 的 normalizeHeaders 处理\n const headers: Record<string, string> = {\n ...(config.headers as Record<string, string>),\n 'Authorization': `Bearer ${token}`,\n 'x-api-key': accessKey,\n };\n\n // 管理端 innerapi：运行时读取用户凭证并注入\n if (options.adminInnerApi) {\n const clientToken = process.env[clientTokenEnv];\n if (clientToken) {\n headers[MIAODA_CLIENT_TOKEN_HEADER] = clientToken;\n }\n }\n\n return {\n ...config,\n headers,\n };\n });\n\n return tokenManager;\n}\n\nfunction ensureNoAccessKeyOverride(name: string, claims?: PlatformClaims) {\n if (claims && Object.prototype.hasOwnProperty.call(claims, 'access_key')) {\n throw new Error(`${name} 不允许设置 access_key`);\n }\n}\n","/\n 拦截器管理器（模仿 Axios 的 InterceptorManager）\n /\nexport class InterceptorManager<T> {\n private interceptors: (T \| null)[] = [];\n\n /\n 添加拦截器\n * @returns 拦截器 ID，用于后续移除\n /\n use(onFulfilled?: any, onRejected?: any): number {\n this.interceptors.push({ onFulfilled, onRejected } as T);\n return this.interceptors.length - 1;\n }\n\n /\n 移除拦截器\n /\n eject(id: number): void {\n if (this.interceptors[id]) {\n this.interceptors[id] = null;\n }\n }\n\n /\n 清空所有拦截器\n /\n clear(): void {\n this.interceptors = [];\n }\n\n /\n 遍历所有拦截器\n /\n forEach(fn: (interceptor: T) => void): void {\n this.interceptors.forEach((interceptor) => {\n if (interceptor !== null) {\n fn(interceptor);\n }\n });\n }\n}\n","/\n Checks if a value is a plain object.\n * @param value The value to check.\n * @returns True if the value is a plain object, false otherwise.\n /\nexport function isPlainObject(value: any): boolean {\n if (typeof value !== 'object' \|\| value === null) {\n return false;\n }\n const proto = Object.getPrototypeOf(value);\n return proto === Object.prototype \|\| proto === null;\n}\n\nexport function normalizeHeaders(headers?: RequestInit['headers']): Record<string, string> {\n if (!headers) {\n return {};\n }\n\n if (headers instanceof Headers) {\n const normalized: Record<string, string> = {};\n headers.forEach((value, key) => {\n normalized[key] = value;\n });\n return normalized;\n }\n\n if (Array.isArray(headers)) {\n return headers.reduce<Record<string, string>>((acc, [key, value]) => {\n acc[key] = value;\n return acc;\n }, {});\n }\n\n const normalized: Record<string, string> = {};\n Object.entries(headers as Record<string, string \| readonly string[]>).forEach(\n ([key, value]) => {\n const normalizedValue = Array.isArray(value) ? value.join(',') : value;\n normalized[key] = normalizedValue as string;\n },\n );\n return normalized;\n}\n\n/\n 最终 x-tt-env 是 PPE 泳道（以 `ppe` 开头）且调用方未设置 x-use-ppe 时，补 `x-use-ppe: 1`，\n * 否则请求不会被路由到 PPE。\n \n 按 fetch 实际发出的值判断：大小写不同的多个 x-tt-env 会被拼成 `\"a, b\"`，这里同样拼接后再判断。\n * 值为 undefined / null 的 x-use-ppe 视为未设置，补头时一并去掉，避免与补上的值拼在一起。\n /\nexport function withPpeLaneHeader(headers: Record<string, string>): Record<string, string> {\n const entries = Object.entries(headers) as [string, unknown][];\n const isSet = (value: unknown) => value !== undefined && value !== null;\n const ttEnv = entries\n .filter(([key, value]) => key.toLowerCase() === 'x-tt-env' && isSet(value))\n .map(([, value]) => String(value).trim())\n .join(', ');\n const usePpeKeys = entries.filter(([key]) => key.toLowerCase() === 'x-use-ppe');\n if (!ttEnv.toLowerCase().startsWith('ppe') \|\| usePpeKeys.some(([, value]) => isSet(value))) {\n return headers;\n }\n\n const result = { ...headers };\n for (const [key] of usePpeKeys) {\n delete result[key];\n }\n result['x-use-ppe'] = '1';\n return result;\n}\n","import type { PlatformPluginOptions, PlatformRequestAuthConfig } from '../plugins/platform-plugin';\nimport { normalizeHeaders } from './utils';\n\n/\n 清理后的请求配置（移除敏感信息）\n /\nexport interface SafeRequestConfig extends Omit<RequestConfig, 'headers'> {\n headers?: Record<string, string>; // 已清理的 headers\n}\n\n/\n HTTP 错误对象\n \n 注意：为了安全考虑，error.config 中的敏感 headers (如 Authorization, x-api-key)\n * 会被替换为 '[REDACTED]'\n /\nexport class HttpError extends Error {\n public readonly isHttpError: boolean = true;\n public response: Response \| undefined;\n public config: SafeRequestConfig;\n\n constructor(\n response: Response \| undefined,\n config: RequestConfig,\n message?: string,\n options?: { cause?: unknown },\n ) {\n super(message \|\| `Request failed with status ${response?.status \|\| 'unknown'}`, options);\n this.name = 'HttpError';\n this.response = response;\n this.config = sanitizeConfig(config);\n Object.setPrototypeOf(this, HttpError.prototype);\n }\n}\n\nexport interface RequestConfig extends RequestInit {\n url?: string;\n params?: Record<string, any>;\n timeout?: number;\n baseURL?: string;\n platformAuth?: PlatformRequestAuthConfig;\n}\n\nexport interface SecurityConfig {\n /\n 允许的 URL 协议白名单\n * 默认: null (不限制)\n * 设置为 ['http:', 'https:'] 可限制只允许 HTTP/HTTPS\n /\n allowedProtocols?: string[] \| null;\n\n /\n 最大响应体大小（字节）\n * 默认: 0 (不限制)\n * 设置为正数可限制响应体大小，防止内存耗尽攻击\n /\n maxResponseSize?: number;\n\n /\n 是否启用严格模式（启用所有安全检查）\n * 默认: false\n * 启用后会自动设置：\n * - allowedProtocols = ['http:', 'https:']\n * - maxResponseSize = 50MB\n /\n strictMode?: boolean;\n}\n\nexport interface HttpClientPreInterceptors {\n request?: RequestInterceptor[];\n response?: ResponseInterceptor[];\n}\n\nexport interface HttpClientConfig extends RequestConfig {\n platform?: PlatformPluginOptions;\n security?: SecurityConfig;\n preInterceptors?: HttpClientPreInterceptors;\n}\n\n/\n 请求拦截器函数\n /\nexport type RequestInterceptor = {\n onFulfilled?: (config: RequestConfig) => RequestConfig \| Promise<RequestConfig>;\n onRejected?: (error: any) => any;\n};\n\n/\n 响应拦截器函数（fetch 风格）\n /\nexport type ResponseInterceptor = {\n onFulfilled?: (response: Response) => Response \| Promise<Response>;\n onRejected?: (error: any) => any;\n};\n\n/\n 清理配置中的敏感信息\n /\nfunction sanitizeConfig(config: RequestConfig): SafeRequestConfig {\n const { headers, ...rest } = config;\n\n return {\n ...rest,\n headers: sanitizeHeaders(headers),\n };\n}\n\n/\n 清理敏感 headers\n \n 将 Authorization, x-api-key, cookie 等敏感字段替换为 '[REDACTED]'\n /\nfunction sanitizeHeaders(headers?: RequestInit['headers']): Record<string, string> \| undefined {\n if (!headers) {\n return undefined;\n }\n\n const normalized = normalizeHeaders(headers);\n const sanitized: Record<string, string> = {};\n\n const sensitiveHeaders = ['authorization', 'x-api-key', 'cookie', 'x-secret'];\n\n for (const [key, value] of Object.entries(normalized)) {\n const lowerKey = key.toLowerCase();\n if (sensitiveHeaders.includes(lowerKey)) {\n sanitized[key] = '[REDACTED]';\n } else {\n sanitized[key] = value;\n }\n }\n\n return sanitized;\n}\n","import { registerPlatformPlugin, resolvePlatformBaseURL } from '../plugins/platform-plugin';\nimport { InterceptorManager } from './InterceptorManager';\nimport {\n HttpError,\n type HttpClientConfig,\n type RequestConfig,\n type RequestInterceptor,\n type ResponseInterceptor,\n type SecurityConfig,\n} from './types';\nimport { isPlainObject, normalizeHeaders, withPpeLaneHeader } from './utils';\n\n/\n 技术栈无关的 HTTP 客户端\n \n 设计理念：\n * - 基于原生 fetch API，零依赖\n * - 拦截器模式遵循 Axios 标准，AI 模型和开发者都熟悉\n * - 可在任何 Node.js 环境使用（NestJS, Express, Koa, 纯 Node）\n \n @example\n * ```typescript\n * const client = new HttpClient({\n * baseURL: 'https://api.example.com',\n * timeout: 5000,\n * });\n \n // 添加请求拦截器（类似 Axios）\n * client.interceptors.request.use(\n * config => {\n * config.headers = config.headers \|\| {};\n * config.headers['Authorization'] = 'Bearer token';\n * return config;\n * },\n * error => Promise.reject(error)\n * );\n \n // 添加响应拦截器（类似 Axios）\n * client.interceptors.response.use(\n * response => {\n * console.log('Response:', response.status);\n * return response;\n * },\n * error => {\n * if (error.response?.status === 401) {\n * // 处理未授权\n * }\n * return Promise.reject(error);\n * }\n * );\n \n // 发起请求\n * const response = await client.get('/users');\n * console.log(response.data);\n * ```\n /\nexport class HttpClient {\n private defaultConfig: RequestConfig;\n private securityConfig: Required<SecurityConfig>;\n /\n 拦截器管理器（API 与 Axios 一致）\n /\n public interceptors = {\n request: new InterceptorManager<RequestInterceptor>(),\n response: new InterceptorManager<ResponseInterceptor>(),\n };\n\n constructor(config?: HttpClientConfig) {\n const { platform, security, preInterceptors, ...restConfig } = config \|\| {};\n\n this.defaultConfig = {\n timeout: 5000,\n ...restConfig,\n };\n\n // 初始化安全配置\n const strictMode = security?.strictMode ?? false;\n this.securityConfig = {\n allowedProtocols: strictMode ? ['http:', 'https:'] : null,\n maxResponseSize: strictMode ? 50 1024 * 1024 : 0, // 50MB\n strictMode,\n ...security,\n };\n\n this.registerRequestPreInterceptors(preInterceptors?.request);\n\n if (platform?.enabled) {\n if (!this.defaultConfig.baseURL) {\n this.defaultConfig.baseURL = resolvePlatformBaseURL(platform);\n }\n registerPlatformPlugin(this.interceptors, platform);\n }\n\n this.registerResponsePreInterceptors(preInterceptors?.response);\n }\n\n /*\n GET 请求\n /\n async get(url: string, config?: RequestConfig): Promise<Response> {\n return this.request({ ...config, url, method: 'GET' });\n }\n\n /\n POST 请求\n /\n async post(url: string, data?: any, config?: RequestConfig): Promise<Response> {\n const headers: Record<string, string> = { ...config?.headers } as Record<string, string>;\n let body: any = data;\n\n if (isPlainObject(data)) {\n body = JSON.stringify(data);\n if (!Object.keys(headers).some((key) => key.toLowerCase() === 'content-type')) {\n headers['Content-Type'] = 'application/json';\n }\n }\n\n return this.request({\n ...config,\n url,\n method: 'POST',\n body,\n headers,\n });\n }\n\n /\n PUT 请求\n /\n async put(url: string, data?: any, config?: RequestConfig): Promise<Response> {\n const headers: Record<string, string> = { ...config?.headers } as Record<string, string>;\n let body: any = data;\n\n if (isPlainObject(data)) {\n body = JSON.stringify(data);\n if (!Object.keys(headers).some((key) => key.toLowerCase() === 'content-type')) {\n headers['Content-Type'] = 'application/json';\n }\n }\n\n return this.request({\n ...config,\n url,\n method: 'PUT',\n body,\n headers,\n });\n }\n\n /\n DELETE 请求\n /\n async delete(url: string, config?: RequestConfig): Promise<Response> {\n return this.request({ ...config, url, method: 'DELETE' });\n }\n\n /\n PATCH 请求\n /\n async patch(url: string, data?: any, config?: RequestConfig): Promise<Response> {\n const headers: Record<string, string> = { ...config?.headers } as Record<string, string>;\n let body: any = data;\n\n if (isPlainObject(data)) {\n body = JSON.stringify(data);\n if (!Object.keys(headers).some((key) => key.toLowerCase() === 'content-type')) {\n headers['Content-Type'] = 'application/json';\n }\n }\n\n return this.request({\n ...config,\n url,\n method: 'PATCH',\n body,\n headers,\n });\n }\n\n /\n 核心请求方法（fetch 风格）\n /\n async request(config: RequestConfig): Promise<Response> {\n // 1. 合并配置\n // Perform a case-insensitive header merge that preserves the final key's casing.\n const baseHeaders = normalizeHeaders(this.defaultConfig.headers);\n const overrideHeaders = normalizeHeaders(config.headers);\n const mergedKeyMap: Record<string, { key: string; value: string }> = {};\n\n for (const key in baseHeaders) {\n mergedKeyMap[key.toLowerCase()] = { key, value: baseHeaders[key] };\n }\n for (const key in overrideHeaders) {\n mergedKeyMap[key.toLowerCase()] = { key, value: overrideHeaders[key] };\n }\n\n const finalHeaders: Record<string, string> = {};\n for (const lowerKey in mergedKeyMap) {\n const { key, value } = mergedKeyMap[lowerKey];\n finalHeaders[key] = value;\n }\n\n let mergedConfig: RequestConfig = {\n ...this.defaultConfig,\n ...config,\n headers: finalHeaders,\n };\n\n // 2. 执行请求拦截器\n try {\n mergedConfig = await this.runRequestInterceptors(mergedConfig);\n } catch (error) {\n return Promise.reject(error);\n }\n\n // 3. 统一 normalize headers（拦截器可能返回 Headers 对象），再按最终 x-tt-env 补 PPE 路由头\n mergedConfig.headers = withPpeLaneHeader(normalizeHeaders(mergedConfig.headers));\n\n // 4. 构建完整 URL\n const fullUrl = this.buildUrl(mergedConfig.url!, mergedConfig.params);\n\n // 5. 设置超时和取消\n const timeout = mergedConfig.timeout \|\| this.defaultConfig.timeout \|\| 5000;\n const controller = new AbortController();\n const timeoutId = setTimeout(() => controller.abort(), timeout);\n\n // 监听外部 signal\n const externalSignal = mergedConfig.signal;\n if (externalSignal) {\n // 如果外部 signal 已经终止，立即终止\n if (externalSignal.aborted) {\n clearTimeout(timeoutId);\n controller.abort();\n } else {\n // 使用 { once: true } 避免内存泄漏\n externalSignal.addEventListener('abort', () => controller.abort(), { once: true });\n }\n }\n\n // 6. 准备 fetch 配置（排除自定义字段）\n const { platformAuth, params, timeout: _timeout, baseURL, url, ...fetchOptions } = mergedConfig;\n\n try {\n // 7. 发起请求\n const response = await fetch(fullUrl, {\n ...fetchOptions,\n signal: controller.signal, // 传递我们自己的 controller signal\n });\n\n clearTimeout(timeoutId);\n\n // 安全检查：响应体大小限制\n if (this.securityConfig.maxResponseSize > 0) {\n const contentLength = response.headers.get('content-length');\n if (contentLength) {\n const size = parseInt(contentLength, 10);\n if (size > this.securityConfig.maxResponseSize) {\n throw new Error(\n `Response size ${size} bytes exceeds limit of ${this.securityConfig.maxResponseSize} bytes`\n );\n }\n }\n }\n\n // 检查响应状态\n if (!response.ok) {\n const error = new HttpError(response, mergedConfig);\n return this.runResponseInterceptors(Promise.reject(error));\n }\n\n // 执行响应拦截器（直接返回 Response）\n return this.runResponseInterceptors(Promise.resolve(response));\n } catch (error) {\n clearTimeout(timeoutId);\n\n // 网络错误或超时错误\n const httpError =\n error instanceof HttpError\n ? error\n : new HttpError(\n undefined,\n mergedConfig,\n describeFetchError(error, externalSignal?.aborted ? undefined : timeout),\n { cause: error },\n );\n\n return this.runResponseInterceptors(Promise.reject(httpError));\n }\n }\n\n /\n 注册请求 preInterceptors\n /\n private registerRequestPreInterceptors(interceptors?: RequestInterceptor[]) {\n if (!interceptors?.length) {\n return;\n }\n\n for (const interceptor of interceptors) {\n this.interceptors.request.use(\n interceptor.onFulfilled,\n interceptor.onRejected,\n );\n }\n }\n\n /\n 注册响应 preInterceptors\n /\n private registerResponsePreInterceptors(interceptors?: ResponseInterceptor[]) {\n if (!interceptors?.length) {\n return;\n }\n\n for (const interceptor of interceptors) {\n this.interceptors.response.use(\n interceptor.onFulfilled,\n interceptor.onRejected,\n );\n }\n }\n\n /\n 执行请求拦截器链\n /\n private runRequestInterceptors(config: RequestConfig): Promise<RequestConfig> {\n let promise: Promise<RequestConfig> = Promise.resolve(config);\n\n const interceptors: RequestInterceptor[] = [];\n this.interceptors.request.forEach((interceptor) => {\n interceptors.push(interceptor);\n });\n\n for (const interceptor of interceptors) {\n promise = promise.then(\n interceptor.onFulfilled,\n interceptor.onRejected,\n );\n }\n\n return promise;\n }\n\n /\n 执行响应拦截器链\n /\n private async runResponseInterceptors(\n promise: Promise<Response>,\n ): Promise<Response> {\n let currentPromise = promise;\n\n // 按顺序执行所有响应拦截器\n const interceptors: ResponseInterceptor[] = [];\n this.interceptors.response.forEach((interceptor) => {\n interceptors.push(interceptor);\n });\n\n for (const interceptor of interceptors) {\n currentPromise = currentPromise.then(\n interceptor.onFulfilled,\n interceptor.onRejected,\n );\n }\n\n return currentPromise;\n }\n\n /\n 构建完整 URL（包含 baseURL 和 query params）\n /\n private buildUrl(url: string, params?: Record<string, any>): string {\n const baseURL = this.defaultConfig.baseURL;\n\n // 拼接 baseURL 和 url（Axios 风格）\n // - 如果 url 是绝对路径（含协议），直接使用 url\n // - 否则拼接 baseURL 和 url，正确处理斜杠\n let combinedUrl: string;\n if (!baseURL \|\| /^https?:\\/\\//i.test(url)) {\n combinedUrl = url;\n } else {\n combinedUrl = baseURL.replace(/\\/+$/, '') + '/' + url.replace(/^\\/+/, '');\n }\n\n const fullUrl = new URL(combinedUrl);\n\n // 协议白名单检查\n const { allowedProtocols } = this.securityConfig;\n if (allowedProtocols && !allowedProtocols.includes(fullUrl.protocol)) {\n throw new Error(\n `Protocol ${fullUrl.protocol} is not allowed. Allowed: ${allowedProtocols.join(', ')}`\n );\n }\n\n // 合并 query params\n if (params) {\n for (const [key, value] of Object.entries(params)) {\n if (value === undefined \|\| value === null) continue;\n fullUrl.searchParams.set(key, String(value));\n }\n }\n\n return fullUrl.href;\n }\n}\n\n/\n 生成网络错误的 message：拼上 cause 的 code 与原因；AbortError 区分超时与主动取消\n * @param timeout 超时触发时传入，主动取消时为 undefined\n */\nfunction describeFetchError(error: unknown, timeout?: number): string {\n const err = error as (Error & { cause?: { code?: string; message?: string } }) \| undefined;\n if (err?.name === 'AbortError') {\n return timeout ? `Request timeout after ${timeout}ms` : 'Request aborted';\n }\n // 底层报错可能含换行（如 TLS），压成一行\n const detail = [err?.cause?.code, err?.cause?.message]\n .filter(Boolean)\n .join(': ')\n .replace(/\\s+/g, ' ')\n .trim();\n const message = err?.message ?? String(error);\n return detail ? `${message} (${detail})` : message;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,oBAAwD;AAwCjD,IAAM,6BAA6B,KAAK,KAAK;AAC7C,IAAM,8BAA8B;AAE3C,IAAM,aAAa;AAAA,EACjB,KAAK;AAAA,EACL,KAAK;AACP;AAEO,SAAS,iBACd,cACA,QACQ;AACR,QAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC/C,QAAM,UAAqB;AAAA,IACzB,GAAG;AAAA,IACH,KAAK,aAAa;AAAA,IAClB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,aAAa,KAAK,MAAM,OAAO,eAAe,GAAI;AAAA,IACvD,SAAK,0BAAW;AAAA,EAClB;AAEA,QAAM,gBAAgB,gBAAgB,KAAK,UAAU,UAAU,CAAC;AAChE,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,OAAO,CAAC;AAC9D,QAAM,YAAY,KAAK,GAAG,aAAa,IAAI,cAAc,IAAI,OAAO,SAAS;AAE7E,SAAO,GAAG,aAAa,IAAI,cAAc,IAAI,SAAS;AACxD;AAEO,SAAS,wBACd,aACA,QACA,SACW;AACX,QAAM,WAAW,YAAY,MAAM,GAAG;AACtC,MAAI,SAAS,WAAW,GAAG;AACzB,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AAEA,QAAM,CAAC,eAAe,gBAAgB,SAAS,IAAI;AAGnD,QAAM,aAAa,KAAK,MAAM,gBAAgB,aAAa,CAAC;AAC5D,MAAI,WAAW,QAAQ,SAAS;AAC9B,UAAM,IAAI,MAAM,qBAAqB;AAAA,EACvC;AAGA,QAAM,oBAAoB,KAAK,GAAG,aAAa,IAAI,cAAc,IAAI,OAAO,SAAS;AAErF,QAAM,iBAAiB,OAAO,KAAK,iBAAiB;AACpD,QAAM,kBAAkB,OAAO,KAAK,SAAS;AAC7C,MACE,eAAe,WAAW,gBAAgB,UAC1C,KAAC,+BAAgB,gBAAgB,eAAe,GAChD;AACA,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AAGA,QAAM,UAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC;AAG1D,MAAI,CAAC,SAAS,gBAAgB;AAC5B,UAAM,iBAAiB,SAAS,kBAAkB;AAClD,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAGxC,QAAI,QAAQ,QAAQ,QAAW;AAC7B,UAAI,QAAQ,MAAM,iBAAiB,KAAK;AACtC,cAAM,IAAI;AAAA,UACR,wBAAwB,IAAI,KAAK,QAAQ,MAAM,GAAI,EAAE,YAAY,CAAC;AAAA,QACpE;AAAA,MACF;AAAA,IACF;AAGA,QAAI,QAAQ,QAAQ,QAAW;AAC7B,UAAI,QAAQ,MAAM,iBAAiB,KAAK;AACtC,cAAM,IAAI;AAAA,UACR,6CAA6C,IAAI,KAAK,QAAQ,MAAM,GAAI,EAAE,YAAY,CAAC;AAAA,QACzF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,QAAQ,QAAQ,QAAW;AAC7B,UAAI,QAAQ,MAAM,iBAAiB,KAAK;AACtC,cAAM,IAAI;AAAA,UACR,qCAAqC,IAAI,KAAK,QAAQ,MAAM,GAAI,EAAE,YAAY,CAAC;AAAA,QACjF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,KAAK,OAAe,QAAwB;AACnD,aAAO,0BAAW,UAAU,MAAM,EAC/B,OAAO,KAAK,EACZ,OAAO,QAAQ,EACf,QAAQ,MAAM,EAAE,EAChB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG;AACvB;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,OAAO,KAAK,KAAK,EACrB,SAAS,QAAQ,EACjB,QAAQ,MAAM,EAAE,EAChB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG;AACvB;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,QAAM,aAAa,KAAK,MAAM,SAAS,KAAK,MAAM;AAClD,QAAM,SAAS,GAAG,KAAK,GAAG,IAAI,OAAO,SAAS,CAAC,GAC5C,QAAQ,MAAM,GAAG,EACjB,QAAQ,MAAM,GAAG;AACpB,SAAO,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM;AACtD;;;AC7GO,IAAM,kBAAN,MAAsB;AAAA,EACnB,QAAQ,oBAAI,IAAyB;AAAA,EACrC;AAAA,EAER,YAAY,QAA0B;AACpC,SAAK,SAAS;AAAA,MACZ,iBAAiB,IAAI,KAAK;AAAA;AAAA,MAC1B,GAAG;AAAA,IACL;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,SAAS,QAA8B;AACrC,UAAM,WAAW,KAAK,YAAY,MAAM;AACxC,UAAM,SAAS,KAAK,MAAM,IAAI,QAAQ;AACtC,UAAM,MAAM,KAAK,IAAI;AAGrB,QAAI,UAAU,OAAO,cAAc,MAAM,KAAK,OAAO,iBAAiB;AACpE,aAAO,OAAO;AAAA,IAChB;AAGA,UAAM,QAAQ,iBAAiB,QAAQ,KAAK,MAAM;AAClD,UAAM,cAAc,MAAM,KAAK,OAAO;AAEtC,SAAK,MAAM,IAAI,UAAU,EAAE,OAAO,YAAY,CAAC;AAE/C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,aAAmB;AACjB,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAc,QAA4B;AACxC,UAAM,WAAW,KAAK,YAAY,MAAM;AACxC,SAAK,MAAM,OAAO,QAAQ;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,YAAY,QAA8B;AAEhD,UAAM,QAAQ;AAAA,MACZ,OAAO;AAAA,MACP,OAAO,aAAa;AAAA,MACpB,OAAO,WAAW;AAAA,MAClB,OAAO,UAAU;AAAA,MACjB,OAAO,WAAW;AAAA,MAClB,OAAO,cAAc;AAAA,IACvB;AACA,WAAO,MAAM,KAAK,GAAG;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB;AACd,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,aAAa;AACjB,QAAI,eAAe;AAEnB,eAAW,UAAU,KAAK,MAAM,OAAO,GAAG;AACxC,UAAI,OAAO,cAAc,KAAK;AAC5B;AAAA,MACF,OAAO;AACL;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO,KAAK,MAAM;AAAA,MAClB,OAAO;AAAA,MACP,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAUO,IAAM,oBAAN,MAA+C;AAAA,EACpD,YAA6B,OAAe;AAAf;AAC3B,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,MAAM,mDAA+B;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,SAAS,SAA+B;AACtC,WAAO,KAAK;AAAA,EACd;AACF;;;AC5KA,gBAA6B;AAa7B,IAAM,4BAA4B,IAAI,KAAK;AAC3C,IAAM,sBAAsB;AAAA,EAC1B;AACF;AAqBO,IAAM,oBAAN,MAAwB;AAAA,EACrB,QAAQ,oBAAI,IAA6B;AAAA,EACzC;AAAA,EACA;AAAA,EAER,YAAY,QAAkC;AAC5C,SAAK,QAAQ,QAAQ,SAAS;AAC9B,SAAK,kBAAkB,QAAQ,mBAAmB;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,WAAwD;AACtD,UAAM,MAAM,KAAK,IAAI;AAErB,eAAW,YAAY,KAAK,OAAO;AACjC,YAAM,SAAS,KAAK,MAAM,IAAI,QAAQ;AAGtC,UAAI,UAAU,OAAO,cAAc,MAAM,KAAK,iBAAiB;AAC7D,eAAO,EAAE,OAAO,OAAO,OAAO,WAAW,OAAO,UAAU;AAAA,MAC5D;AAGA,YAAM,SAAS,KAAK,aAAa,QAAQ;AACzC,UAAI,QAAQ;AACV,aAAK,MAAM,IAAI,UAAU,MAAM;AAC/B,YAAI,OAAO,cAAc,KAAK;AAC5B,iBAAO,EAAE,OAAO,OAAO,OAAO,WAAW,OAAO,UAAU;AAAA,QAC5D;AAAA,MACF;AAGA,UAAI,UAAU,OAAO,cAAc,KAAK;AACtC,eAAO,EAAE,OAAO,OAAO,OAAO,WAAW,OAAO,UAAU;AAAA,MAC5D;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,aAAmB;AACjB,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEQ,aAAa,UAA0C;AAC7D,QAAI;AACF,YAAM,YAAQ,wBAAa,UAAU,OAAO,EAAE,KAAK;AACnD,UAAI,CAAC,MAAO,QAAO;AAEnB,YAAM,UAAU,KAAK,cAAc,KAAK;AACxC,UAAI,CAAC,SAAS,IAAK,QAAO;AAE1B,aAAO;AAAA,QACL;AAAA,QACA,WAAW,QAAQ,cAAc;AAAA,QACjC,aAAa,QAAQ,MAAM;AAAA,MAC7B;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,cAAc,OAA2C;AAC/D,QAAI;AACF,YAAM,WAAW,MAAM,MAAM,GAAG;AAChC,UAAI,SAAS,WAAW,EAAG,QAAO;AAElC,YAAM,aAAa,KAAK,SAAS,CAAC,EAAE,SAAS,KAAK,MAAM;AACxD,YAAM,SAAS,GAAG,SAAS,CAAC,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC,GAClD,QAAQ,MAAM,GAAG,EACjB,QAAQ,MAAM,GAAG;AAEpB,aAAO,KAAK,MAAM,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM,CAAC;AAAA,IAClE,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACpEA,IAAM,qBAAqB;AAC3B,IAAM,yBAAyB;AAC/B,IAAM,yBAAyB;AAC/B,IAAM,oBAAoB;AAC1B,IAAM,2BAA2B;AACjC,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AAE5B,SAAS,uBAAuB,SAAqD;AAC1F,MAAI,CAAC,SAAS,SAAS;AACrB,WAAO,SAAS;AAAA,EAClB;AAEA,MAAI,QAAQ,SAAS;AACnB,WAAO,QAAQ;AAAA,EACjB;AAEA,QAAM,UAAU,QAAQ,gBACnB,QAAQ,kBAAkB,2BAC1B,QAAQ,aAAa;AAC1B,QAAM,SAAS,QAAQ,IAAI,OAAO;AAClC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,gHAAsB,OAAO,EAAE;AAAA,EACjD;AACA,SAAO;AACT;AAcO,SAAS,uBACd,cACA,SAC6B;AAC7B,MAAI,CAAC,QAAQ,SAAS;AACpB,WAAO;AAAA,EACT;AAEA,4BAA0B,0BAA0B,QAAQ,aAAa;AAGzE,MAAI;AACJ,MAAI,QAAQ,eAAe,SAAS,QAAQ;AAC1C,wBAAoB,IAAI,kBAAkB;AAAA,MACxC,OAAO,QAAQ,cAAc;AAAA,MAC7B,iBAAiB,QAAQ;AAAA,IAC3B,CAAC;AAAA,EACH;AAGA,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,eAAe,QAAQ,gBAAgB;AAE7C,QAAM,YAAY,QAAQ,cAAc,QAAQ,IAAI,YAAY,KAAK;AACrE,QAAM,YAAY,QAAQ,cAAc,QAAQ,IAAI,YAAY,KAAK;AAErE,QAAM,eAAe,QAAQ,gBAAgB;AAG7C,QAAM,eAAe,IAAI,gBAAgB;AAAA,IACvC;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,QAAQ;AAAA,EAC3B,CAAC;AAGD,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,gBAAgB,QAAQ,UAAU,QAAQ,IAAI,QAAQ,KAAK;AACjE,QAAM,oBAAoB,gBAAgB,IAAI,kBAAkB,aAAa,IAAI;AAEjF,QAAM,iBAAiB,QAAQ,kBAAkB;AAGjD,eAAa,QAAQ,IAAI,CAAC,WAA0B;AAElD,QAAI,mBAAmB;AACrB,YAAM,YAAY,kBAAkB,SAAS;AAC7C,UAAI,WAAW;AACb,cAAMA,WAAU;AAAA,UACd,GAAI,OAAO;AAAA,UACX,iBAAiB,UAAU,UAAU,KAAK;AAAA,UAC1C,aAAa,UAAU;AAAA,QACzB;AACA,eAAO,EAAE,GAAG,QAAQ,SAAAA,SAAQ;AAAA,MAC9B;AAAA,IACF;AAEA,8BAA0B,qCAAqC,OAAO,cAAc,YAAY;AAEhG,UAAM,SAAuB;AAAA,MAC3B,GAAI,QAAQ,iBAAiB,CAAC;AAAA,MAC9B,GAAI,OAAO,cAAc,gBAAgB,CAAC;AAAA,MAC1C,YAAY;AAAA,IACd;AAMA,QAAI;AACJ,QAAI,mBAAmB;AACrB,UAAI;AACF,gBAAQ,kBAAkB,SAAS,MAAM;AAAA,MAC3C,QAAQ;AACN,gBAAQ,aAAa,SAAS,MAAM;AAAA,MACtC;AAAA,IACF,OAAO;AACL,cAAQ,aAAa,SAAS,MAAM;AAAA,IACtC;AAGA,UAAM,UAAkC;AAAA,MACtC,GAAI,OAAO;AAAA,MACX,iBAAiB,UAAU,KAAK;AAAA,MAChC,aAAa;AAAA,IACf;AAGA,QAAI,QAAQ,eAAe;AACzB,YAAM,cAAc,QAAQ,IAAI,cAAc;AAC9C,UAAI,aAAa;AACf,gBAAQ,0BAA0B,IAAI;AAAA,MACxC;AAAA,IACF;AAEA,WAAO;AAAA,MACL,GAAG;AAAA,MACH;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAEA,SAAS,0BAA0B,MAAc,QAAyB;AACxE,MAAI,UAAU,OAAO,UAAU,eAAe,KAAK,QAAQ,YAAY,GAAG;AACxE,UAAM,IAAI,MAAM,GAAG,IAAI,4CAAmB;AAAA,EAC5C;AACF;;;ACtMO,IAAM,qBAAN,MAA4B;AAAA,EACzB,eAA6B,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,IAAI,aAAmB,YAA0B;AAC/C,SAAK,aAAa,KAAK,EAAE,aAAa,WAAW,CAAM;AACvD,WAAO,KAAK,aAAa,SAAS;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IAAkB;AACtB,QAAI,KAAK,aAAa,EAAE,GAAG;AACzB,WAAK,aAAa,EAAE,IAAI;AAAA,IAC1B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,QAAc;AACZ,SAAK,eAAe,CAAC;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,IAAoC;AAC1C,SAAK,aAAa,QAAQ,CAAC,gBAAgB;AACzC,UAAI,gBAAgB,MAAM;AACxB,WAAG,WAAW;AAAA,MAChB;AAAA,IACF,CAAC;AAAA,EACH;AACF;;;ACpCO,SAAS,cAAc,OAAqB;AACjD,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,SAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEO,SAAS,iBAAiB,SAA0D;AACzF,MAAI,CAAC,SAAS;AACZ,WAAO,CAAC;AAAA,EACV;AAEA,MAAI,mBAAmB,SAAS;AAC9B,UAAMC,cAAqC,CAAC;AAC5C,YAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC9B,MAAAA,YAAW,GAAG,IAAI;AAAA,IACpB,CAAC;AACD,WAAOA;AAAA,EACT;AAEA,MAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,WAAO,QAAQ,OAA+B,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM;AACnE,UAAI,GAAG,IAAI;AACX,aAAO;AAAA,IACT,GAAG,CAAC,CAAC;AAAA,EACP;AAEA,QAAM,aAAqC,CAAC;AAC5C,SAAO,QAAQ,OAAqD,EAAE;AAAA,IACpE,CAAC,CAAC,KAAK,KAAK,MAAM;AAChB,YAAM,kBAAkB,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,GAAG,IAAI;AACjE,iBAAW,GAAG,IAAI;AAAA,IACpB;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,kBAAkB,SAAyD;AACzF,QAAM,UAAU,OAAO,QAAQ,OAAO;AACtC,QAAM,QAAQ,CAAC,UAAmB,UAAU,UAAa,UAAU;AACnE,QAAM,QAAQ,QACX,OAAO,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,YAAY,MAAM,cAAc,MAAM,KAAK,CAAC,EACzE,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,OAAO,KAAK,EAAE,KAAK,CAAC,EACvC,KAAK,IAAI;AACZ,QAAM,aAAa,QAAQ,OAAO,CAAC,CAAC,GAAG,MAAM,IAAI,YAAY,MAAM,WAAW;AAC9E,MAAI,CAAC,MAAM,YAAY,EAAE,WAAW,KAAK,KAAK,WAAW,KAAK,CAAC,CAAC,EAAE,KAAK,MAAM,MAAM,KAAK,CAAC,GAAG;AAC1F,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,EAAE,GAAG,QAAQ;AAC5B,aAAW,CAAC,GAAG,KAAK,YAAY;AAC9B,WAAO,OAAO,GAAG;AAAA,EACnB;AACA,SAAO,WAAW,IAAI;AACtB,SAAO;AACT;;;ACpDO,IAAM,YAAN,MAAM,mBAAkB,MAAM;AAAA,EACnB,cAAuB;AAAA,EAChC;AAAA,EACA;AAAA,EAEP,YACE,UACA,QACA,SACA,SACA;AACA,UAAM,WAAW,8BAA8B,UAAU,UAAU,SAAS,IAAI,OAAO;AACvF,SAAK,OAAO;AACZ,SAAK,WAAW;AAChB,SAAK,SAAS,eAAe,MAAM;AACnC,WAAO,eAAe,MAAM,WAAU,SAAS;AAAA,EACjD;AACF;AAiEA,SAAS,eAAe,QAA0C;AAChE,QAAM,EAAE,SAAS,GAAG,KAAK,IAAI;AAE7B,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,gBAAgB,OAAO;AAAA,EAClC;AACF;AAOA,SAAS,gBAAgB,SAAsE;AAC7F,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,iBAAiB,OAAO;AAC3C,QAAM,YAAoC,CAAC;AAE3C,QAAM,mBAAmB,CAAC,iBAAiB,aAAa,UAAU,UAAU;AAE5E,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACrD,UAAM,WAAW,IAAI,YAAY;AACjC,QAAI,iBAAiB,SAAS,QAAQ,GAAG;AACvC,gBAAU,GAAG,IAAI;AAAA,IACnB,OAAO;AACL,gBAAU,GAAG,IAAI;AAAA,IACnB;AAAA,EACF;AAEA,SAAO;AACT;;;AC5EO,IAAM,aAAN,MAAiB;AAAA,EACd;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAID,eAAe;AAAA,IACpB,SAAS,IAAI,mBAAuC;AAAA,IACpD,UAAU,IAAI,mBAAwC;AAAA,EACxD;AAAA,EAEA,YAAY,QAA2B;AACrC,UAAM,EAAE,UAAU,UAAU,iBAAiB,GAAG,WAAW,IAAI,UAAU,CAAC;AAE1E,SAAK,gBAAgB;AAAA,MACnB,SAAS;AAAA,MACT,GAAG;AAAA,IACL;AAGA,UAAM,aAAa,UAAU,cAAc;AAC3C,SAAK,iBAAiB;AAAA,MACpB,kBAAkB,aAAa,CAAC,SAAS,QAAQ,IAAI;AAAA,MACrD,iBAAiB,aAAa,KAAK,OAAO,OAAO;AAAA;AAAA,MACjD;AAAA,MACA,GAAG;AAAA,IACL;AAEA,SAAK,+BAA+B,iBAAiB,OAAO;AAE5D,QAAI,UAAU,SAAS;AACrB,UAAI,CAAC,KAAK,cAAc,SAAS;AAC/B,aAAK,cAAc,UAAU,uBAAuB,QAAQ;AAAA,MAC9D;AACA,6BAAuB,KAAK,cAAc,QAAQ;AAAA,IACpD;AAEA,SAAK,gCAAgC,iBAAiB,QAAQ;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IAAI,KAAa,QAA2C;AAChE,WAAO,KAAK,QAAQ,EAAE,GAAG,QAAQ,KAAK,QAAQ,MAAM,CAAC;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,KAAK,KAAa,MAAY,QAA2C;AAC7E,UAAM,UAAkC,EAAE,GAAG,QAAQ,QAAQ;AAC7D,QAAI,OAAY;AAEhB,QAAI,cAAc,IAAI,GAAG;AACvB,aAAO,KAAK,UAAU,IAAI;AAC1B,UAAI,CAAC,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,IAAI,YAAY,MAAM,cAAc,GAAG;AAC7E,gBAAQ,cAAc,IAAI;AAAA,MAC5B;AAAA,IACF;AAEA,WAAO,KAAK,QAAQ;AAAA,MAClB,GAAG;AAAA,MACH;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IAAI,KAAa,MAAY,QAA2C;AAC5E,UAAM,UAAkC,EAAE,GAAG,QAAQ,QAAQ;AAC7D,QAAI,OAAY;AAEhB,QAAI,cAAc,IAAI,GAAG;AACvB,aAAO,KAAK,UAAU,IAAI;AAC1B,UAAI,CAAC,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,IAAI,YAAY,MAAM,cAAc,GAAG;AAC7E,gBAAQ,cAAc,IAAI;AAAA,MAC5B;AAAA,IACF;AAEA,WAAO,KAAK,QAAQ;AAAA,MAClB,GAAG;AAAA,MACH;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAO,KAAa,QAA2C;AACnE,WAAO,KAAK,QAAQ,EAAE,GAAG,QAAQ,KAAK,QAAQ,SAAS,CAAC;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAM,KAAa,MAAY,QAA2C;AAC9E,UAAM,UAAkC,EAAE,GAAG,QAAQ,QAAQ;AAC7D,QAAI,OAAY;AAEhB,QAAI,cAAc,IAAI,GAAG;AACvB,aAAO,KAAK,UAAU,IAAI;AAC1B,UAAI,CAAC,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,IAAI,YAAY,MAAM,cAAc,GAAG;AAC7E,gBAAQ,cAAc,IAAI;AAAA,MAC5B;AAAA,IACF;AAEA,WAAO,KAAK,QAAQ;AAAA,MAClB,GAAG;AAAA,MACH;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAQ,QAA0C;AAGtD,UAAM,cAAc,iBAAiB,KAAK,cAAc,OAAO;AAC/D,UAAM,kBAAkB,iBAAiB,OAAO,OAAO;AACvD,UAAM,eAA+D,CAAC;AAEtE,eAAW,OAAO,aAAa;AAC7B,mBAAa,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,YAAY,GAAG,EAAE;AAAA,IACnE;AACA,eAAW,OAAO,iBAAiB;AACjC,mBAAa,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,gBAAgB,GAAG,EAAE;AAAA,IACvE;AAEA,UAAM,eAAuC,CAAC;AAC9C,eAAW,YAAY,cAAc;AACnC,YAAM,EAAE,KAAK,MAAM,IAAI,aAAa,QAAQ;AAC5C,mBAAa,GAAG,IAAI;AAAA,IACtB;AAEA,QAAI,eAA8B;AAAA,MAChC,GAAG,KAAK;AAAA,MACR,GAAG;AAAA,MACH,SAAS;AAAA,IACX;AAGA,QAAI;AACF,qBAAe,MAAM,KAAK,uBAAuB,YAAY;AAAA,IAC/D,SAAS,OAAO;AACd,aAAO,QAAQ,OAAO,KAAK;AAAA,IAC7B;AAGA,iBAAa,UAAU,kBAAkB,iBAAiB,aAAa,OAAO,CAAC;AAG/E,UAAM,UAAU,KAAK,SAAS,aAAa,KAAM,aAAa,MAAM;AAGpE,UAAM,UAAU,aAAa,WAAW,KAAK,cAAc,WAAW;AACtE,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,YAAY,WAAW,MAAM,WAAW,MAAM,GAAG,OAAO;AAG9D,UAAM,iBAAiB,aAAa;AACpC,QAAI,gBAAgB;AAElB,UAAI,eAAe,SAAS;AAC1B,qBAAa,SAAS;AACtB,mBAAW,MAAM;AAAA,MACnB,OAAO;AAEL,uBAAe,iBAAiB,SAAS,MAAM,WAAW,MAAM,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,MACnF;AAAA,IACF;AAGA,UAAM,EAAE,cAAc,QAAQ,SAAS,UAAU,SAAS,KAAK,GAAG,aAAa,IAAI;AAEnF,QAAI;AAEF,YAAM,WAAW,MAAM,MAAM,SAAS;AAAA,QACpC,GAAG;AAAA,QACH,QAAQ,WAAW;AAAA;AAAA,MACrB,CAAC;AAED,mBAAa,SAAS;AAGtB,UAAI,KAAK,eAAe,kBAAkB,GAAG;AAC3C,cAAM,gBAAgB,SAAS,QAAQ,IAAI,gBAAgB;AAC3D,YAAI,eAAe;AACjB,gBAAM,OAAO,SAAS,eAAe,EAAE;AACvC,cAAI,OAAO,KAAK,eAAe,iBAAiB;AAC9C,kBAAM,IAAI;AAAA,cACR,iBAAiB,IAAI,2BAA2B,KAAK,eAAe,eAAe;AAAA,YACrF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAGA,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,QAAQ,IAAI,UAAU,UAAU,YAAY;AAClD,eAAO,KAAK,wBAAwB,QAAQ,OAAO,KAAK,CAAC;AAAA,MAC3D;AAGA,aAAO,KAAK,wBAAwB,QAAQ,QAAQ,QAAQ,CAAC;AAAA,IAC/D,SAAS,OAAO;AACd,mBAAa,SAAS;AAGtB,YAAM,YACJ,iBAAiB,YACb,QACA,IAAI;AAAA,QACJ;AAAA,QACA;AAAA,QACA,mBAAmB,OAAO,gBAAgB,UAAU,SAAY,OAAO;AAAA,QACvE,EAAE,OAAO,MAAM;AAAA,MACjB;AAEJ,aAAO,KAAK,wBAAwB,QAAQ,OAAO,SAAS,CAAC;AAAA,IAC/D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,+BAA+B,cAAqC;AAC1E,QAAI,CAAC,cAAc,QAAQ;AACzB;AAAA,IACF;AAEA,eAAW,eAAe,cAAc;AACtC,WAAK,aAAa,QAAQ;AAAA,QACxB,YAAY;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,gCAAgC,cAAsC;AAC5E,QAAI,CAAC,cAAc,QAAQ;AACzB;AAAA,IACF;AAEA,eAAW,eAAe,cAAc;AACtC,WAAK,aAAa,SAAS;AAAA,QACzB,YAAY;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,uBAAuB,QAA+C;AAC5E,QAAI,UAAkC,QAAQ,QAAQ,MAAM;AAE5D,UAAM,eAAqC,CAAC;AAC5C,SAAK,aAAa,QAAQ,QAAQ,CAAC,gBAAgB;AACjD,mBAAa,KAAK,WAAW;AAAA,IAC/B,CAAC;AAED,eAAW,eAAe,cAAc;AACtC,gBAAU,QAAQ;AAAA,QAChB,YAAY;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,wBACZ,SACmB;AACnB,QAAI,iBAAiB;AAGrB,UAAM,eAAsC,CAAC;AAC7C,SAAK,aAAa,SAAS,QAAQ,CAAC,gBAAgB;AAClD,mBAAa,KAAK,WAAW;AAAA,IAC/B,CAAC;AAED,eAAW,eAAe,cAAc;AACtC,uBAAiB,eAAe;AAAA,QAC9B,YAAY;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,SAAS,KAAa,QAAsC;AAClE,UAAM,UAAU,KAAK,cAAc;AAKnC,QAAI;AACJ,QAAI,CAAC,WAAW,gBAAgB,KAAK,GAAG,GAAG;AACzC,oBAAc;AAAA,IAChB,OAAO;AACL,oBAAc,QAAQ,QAAQ,QAAQ,EAAE,IAAI,MAAM,IAAI,QAAQ,QAAQ,EAAE;AAAA,IAC1E;AAEA,UAAM,UAAU,IAAI,IAAI,WAAW;AAGnC,UAAM,EAAE,iBAAiB,IAAI,KAAK;AAClC,QAAI,oBAAoB,CAAC,iBAAiB,SAAS,QAAQ,QAAQ,GAAG;AACpE,YAAM,IAAI;AAAA,QACR,YAAY,QAAQ,QAAQ,6BAA6B,iBAAiB,KAAK,IAAI,CAAC;AAAA,MACtF;AAAA,IACF;AAGA,QAAI,QAAQ;AACV,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,YAAI,UAAU,UAAa,UAAU,KAAM;AAC3C,gBAAQ,aAAa,IAAI,KAAK,OAAO,KAAK,CAAC;AAAA,MAC7C;AAAA,IACF;AAEA,WAAO,QAAQ;AAAA,EACjB;AACF;AAMA,SAAS,mBAAmB,OAAgB,SAA0B;AACpE,QAAM,MAAM;AACZ,MAAI,KAAK,SAAS,cAAc;AAC9B,WAAO,UAAU,yBAAyB,OAAO,OAAO;AAAA,EAC1D;AAEA,QAAM,SAAS,CAAC,KAAK,OAAO,MAAM,KAAK,OAAO,OAAO,EAClD,OAAO,OAAO,EACd,KAAK,IAAI,EACT,QAAQ,QAAQ,GAAG,EACnB,KAAK;AACR,QAAM,UAAU,KAAK,WAAW,OAAO,KAAK;AAC5C,SAAO,SAAS,GAAG,OAAO,KAAK,MAAM,MAAM;AAC7C;","names":["headers","normalized"]}

package/dist/index.mjs CHANGED Viewed

@@ -422,6 +422,21 @@ function normalizeHeaders(headers) {
   );
   return normalized;
 }
+function withPpeLaneHeader(headers) {
+  const entries = Object.entries(headers);
+  const isSet = (value) => value !== void 0 && value !== null;
+  const ttEnv = entries.filter(([key, value]) => key.toLowerCase() === "x-tt-env" && isSet(value)).map(([, value]) => String(value).trim()).join(", ");
+  const usePpeKeys = entries.filter(([key]) => key.toLowerCase() === "x-use-ppe");
+  if (!ttEnv.toLowerCase().startsWith("ppe") || usePpeKeys.some(([, value]) => isSet(value))) {
+    return headers;
+  }
+  const result = { ...headers };
+  for (const [key] of usePpeKeys) {
+    delete result[key];
+  }
+  result["x-use-ppe"] = "1";
+  return result;
+}
 // src/core/types.ts
 var HttpError = class _HttpError extends Error {
@@ -595,7 +610,7 @@ var HttpClient = class {
     } catch (error) {
       return Promise.reject(error);
     }
-    mergedConfig.headers = normalizeHeaders(mergedConfig.headers);
+    mergedConfig.headers = withPpeLaneHeader(normalizeHeaders(mergedConfig.headers));
     const fullUrl = this.buildUrl(mergedConfig.url, mergedConfig.params);
     const timeout = mergedConfig.timeout || this.defaultConfig.timeout || 5e3;
     const controller = new AbortController();

package/dist/index.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/helper/jwt.ts","../src/helper/jwt-manager.ts","../src/helper/file-token-provider.ts","../src/plugins/platform-plugin.ts","../src/core/InterceptorManager.ts","../src/core/utils.ts","../src/core/types.ts","../src/core/HttpClient.ts"],"sourcesContent":["import { createHmac, randomUUID, timingSafeEqual } from 'crypto';\n\nexport interface CustomClaims {\n tenant_id?: string;\n user_id?: string;\n app_id?: string;\n app_env?: string;\n sandbox_id?: string;\n access_key: string;\n}\n\nexport interface JWTClaims extends CustomClaims {\n iss: string;\n iat: number;\n nbf: number;\n exp: number;\n jti: string;\n [key: string]: any;\n}\n\nexport interface JWTConfig {\n accessKey: string;\n secretKey: string;\n expireTimeMs: number;\n}\n\nexport interface JWTVerifyOptions {\n /*\n 时钟容差（秒），用于处理服务器时间不同步的情况\n * 默认 60 秒\n /\n clockTolerance?: number;\n\n /\n 是否跳过过期验证（仅用于调试）\n * 默认 false\n /\n skipExpiration?: boolean;\n}\n\nexport const DEFAULT_JWT_EXPIRE_TIME_MS = 30 60 * 1000;\nexport const DEFAULT_CLOCK_TOLERANCE_SEC = 60;\n\nconst JWT_HEADER = {\n alg: 'HS256',\n typ: 'JWT',\n};\n\nexport function generateJWTToken(\n customClaims: CustomClaims,\n config: JWTConfig,\n): string {\n const nowSeconds = Math.floor(Date.now() / 1000);\n const payload: JWTClaims = {\n ...customClaims,\n iss: customClaims.access_key,\n iat: nowSeconds,\n nbf: nowSeconds,\n exp: nowSeconds + Math.floor(config.expireTimeMs / 1000),\n jti: randomUUID(),\n };\n\n const encodedHeader = base64UrlEncode(JSON.stringify(JWT_HEADER));\n const encodedPayload = base64UrlEncode(JSON.stringify(payload));\n const signature = sign(`${encodedHeader}.${encodedPayload}`, config.secretKey);\n\n return `${encodedHeader}.${encodedPayload}.${signature}`;\n}\n\nexport function parseJWTTokenWithVerify(\n tokenString: string,\n config: JWTConfig,\n options?: JWTVerifyOptions,\n): JWTClaims {\n const segments = tokenString.split('.');\n if (segments.length !== 3) {\n throw new Error('invalid JWT token format');\n }\n\n const [encodedHeader, encodedPayload, signature] = segments;\n\n // 1. 验证 header\n const headerJson = JSON.parse(base64UrlDecode(encodedHeader));\n if (headerJson.alg !== 'HS256') {\n throw new Error('unsupported JWT alg');\n }\n\n // 2. 验证签名\n const expectedSignature = sign(`${encodedHeader}.${encodedPayload}`, config.secretKey);\n\n const expectedBuffer = Buffer.from(expectedSignature);\n const signatureBuffer = Buffer.from(signature);\n if (\n expectedBuffer.length !== signatureBuffer.length \|\|\n !timingSafeEqual(expectedBuffer, signatureBuffer)\n ) {\n throw new Error('JWT signature verification failed');\n }\n\n // 3. 解析 payload\n const payload = JSON.parse(base64UrlDecode(encodedPayload)) as JWTClaims;\n\n // 4. 验证时间声明\n if (!options?.skipExpiration) {\n const clockTolerance = options?.clockTolerance ?? DEFAULT_CLOCK_TOLERANCE_SEC;\n const now = Math.floor(Date.now() / 1000);\n\n // 验证 exp (过期时间)\n if (payload.exp !== undefined) {\n if (payload.exp + clockTolerance < now) {\n throw new Error(\n `JWT token expired at ${new Date(payload.exp * 1000).toISOString()}`,\n );\n }\n }\n\n // 验证 nbf (生效时间)\n if (payload.nbf !== undefined) {\n if (payload.nbf - clockTolerance > now) {\n throw new Error(\n `JWT token not yet valid, will be valid at ${new Date(payload.nbf * 1000).toISOString()}`,\n );\n }\n }\n\n // 验证 iat (签发时间) - 防止未来时间的 token\n if (payload.iat !== undefined) {\n if (payload.iat - clockTolerance > now) {\n throw new Error(\n `JWT token issued in the future at ${new Date(payload.iat * 1000).toISOString()}`,\n );\n }\n }\n }\n\n return payload;\n}\n\nfunction sign(input: string, secret: string): string {\n return createHmac('sha256', secret)\n .update(input)\n .digest('base64')\n .replace(/=/g, '')\n .replace(/\\+/g, '-')\n .replace(/\\//g, '_');\n}\n\nfunction base64UrlEncode(input: string): string {\n return Buffer.from(input)\n .toString('base64')\n .replace(/=/g, '')\n .replace(/\\+/g, '-')\n .replace(/\\//g, '_');\n}\n\nfunction base64UrlDecode(input: string): string {\n const padLength = (4 - (input.length % 4 \|\| 4)) % 4;\n const padded = `${input}${'='.repeat(padLength)}`\n .replace(/-/g, '+')\n .replace(/_/g, '/');\n return Buffer.from(padded, 'base64').toString('utf8');\n}\n","import { CustomClaims, JWTConfig, generateJWTToken } from './jwt';\n\n/*\n Token 来源的最小抽象。`platform-plugin` 用它做 primary / fallback 链\n * (env token 优先,sk 自签兜底)。`JWTTokenManager`(下方)和 `StaticTokenSource`\n * (本文件底部)都实现这个接口。\n /\nexport interface TokenSource {\n /\n 拿一个可用的 token(用作 Authorization Bearer)。拿不到必须抛 —— 调用方据此决定走 fallback。\n * 不要返回空串 / null,会让上层 `if (token)` 误判通过。\n /\n getToken(claims: CustomClaims): string;\n}\n\ninterface CachedToken {\n token: string;\n expiresAtMs: number;\n}\n\ninterface JWTManagerConfig extends JWTConfig {\n /\n 在过期前多久刷新 token（毫秒）\n * 默认 5 分钟\n /\n refreshBeforeMs?: number;\n}\n\n/\n JWT Token 管理器，负责 token 的生成、缓存和自动刷新\n \n 缓存策略：\n * - 基于 claims 的哈希值作为缓存 key（支持多租户+多用户）\n * - 在 token 过期前 refreshBeforeMs 时间内自动刷新\n \n @example\n * ```typescript\n * const manager = new JWTTokenManager({\n * accessKey: 'your-access-key',\n * secretKey: 'your-secret-key',\n * expireTimeMs: 30 * 60 * 1000,\n * refreshBeforeMs: 5 * 60 * 1000,\n * });\n \n // 获取 token（会自动缓存）\n * const token = manager.getToken({\n * access_key: 'your-access-key',\n * tenant_id: '1001',\n * user_id: 'user123',\n * });\n * ```\n /\nexport class JWTTokenManager {\n private cache = new Map<string, CachedToken>();\n private config: Required<JWTManagerConfig>;\n\n constructor(config: JWTManagerConfig) {\n this.config = {\n refreshBeforeMs: 5 60 * 1000, // 默认 5 分钟\n ...config,\n };\n }\n\n /*\n 获取 JWT token，优先使用缓存\n \n 如果缓存的 token 即将过期（距离过期时间小于 refreshBeforeMs），\n * 则会生成新的 token 并更新缓存\n \n @param claims - JWT claims\n * @returns JWT token 字符串\n /\n getToken(claims: CustomClaims): string {\n const cacheKey = this.getCacheKey(claims);\n const cached = this.cache.get(cacheKey);\n const now = Date.now();\n\n // 检查缓存是否有效（未过期且不需要刷新）\n if (cached && cached.expiresAtMs - now > this.config.refreshBeforeMs) {\n return cached.token;\n }\n\n // 生成新 token\n const token = generateJWTToken(claims, this.config);\n const expiresAtMs = now + this.config.expireTimeMs;\n\n this.cache.set(cacheKey, { token, expiresAtMs });\n\n return token;\n }\n\n /\n 清除所有缓存的 token\n /\n clearCache(): void {\n this.cache.clear();\n }\n\n /\n 清除特定 claims 的缓存\n \n @param claims - 要清除的 claims\n /\n clearCacheFor(claims: CustomClaims): void {\n const cacheKey = this.getCacheKey(claims);\n this.cache.delete(cacheKey);\n }\n\n /\n 生成缓存 key（基于关键的 claims 字段）\n \n 使用稳定的字段顺序确保相同 claims 生成相同 key\n \n @private\n /\n private getCacheKey(claims: CustomClaims): string {\n // 使用稳定的字段顺序确保相同 claims 生成相同 key\n const parts = [\n claims.access_key,\n claims.tenant_id \|\| '',\n claims.user_id \|\| '',\n claims.app_id \|\| '',\n claims.app_env \|\| '',\n claims.sandbox_id \|\| '',\n ];\n return parts.join(':');\n }\n\n /\n 获取缓存统计信息（用于监控和调试）\n \n @returns 缓存统计信息\n /\n getCacheStats() {\n const now = Date.now();\n let validCount = 0;\n let expiredCount = 0;\n\n for (const cached of this.cache.values()) {\n if (cached.expiresAtMs > now) {\n validCount++;\n } else {\n expiredCount++;\n }\n }\n\n return {\n total: this.cache.size,\n valid: validCount,\n expired: expiredCount,\n };\n }\n}\n\n/\n 平台直接派发的静态 token(短期凭据,默认 5 天有效,当前实现为 JWT 但对调用方不透明),\n * client 不签也不刷,拿到啥就用啥。过期了 server 端会 401,由 platform-plugin 的 fallback 链\n * 退到 sk 自签(JWTTokenManager)。\n \n 用于 §2.2 InnerAPI 鉴权 — ak/sk → token + ak 演进:\n * `.env.local` 仅注入 token(不再下发 sk),消除 sk 长期落地的泄漏面。\n /\nexport class StaticTokenSource implements TokenSource {\n constructor(private readonly token: string) {\n if (!token) {\n throw new Error('StaticTokenSource: token 不能为空');\n }\n }\n\n getToken(_claims: CustomClaims): string {\n return this.token;\n }\n}\n","import { readFileSync } from 'fs';\n\ninterface CachedFileToken {\n token: string;\n accessKey: string;\n expiresAtMs: number;\n}\n\nexport interface FileTokenProviderConfig {\n paths?: string[];\n refreshBeforeMs?: number;\n}\n\nconst DEFAULT_REFRESH_BEFORE_MS = 5 60 * 1000;\nconst DEFAULT_TOKEN_PATHS = [\n '/home/gem/workspace/.force/openclaw/miaoda-provider-key',\n];\n\n/*\n 从文件读取 JWT Token 的 Provider\n \n 支持多路径优先级链：按顺序尝试读取，命中第一个有效 token 即返回。\n * 缓存策略基于 token 自身的 exp 字段，在过期前 refreshBeforeMs 窗口内重新读取文件。\n \n @example\n * ```typescript\n * const provider = new FileTokenProvider({\n * paths: ['/path/a/token', '/path/b/token'],\n * refreshBeforeMs: 5 * 60 * 1000,\n * });\n \n const result = provider.getToken();\n * if (result) {\n * console.log(result.token, result.accessKey);\n * }\n * ```\n /\nexport class FileTokenProvider {\n private cache = new Map<string, CachedFileToken>();\n private paths: string[];\n private refreshBeforeMs: number;\n\n constructor(config?: FileTokenProviderConfig) {\n this.paths = config?.paths ?? DEFAULT_TOKEN_PATHS;\n this.refreshBeforeMs = config?.refreshBeforeMs ?? DEFAULT_REFRESH_BEFORE_MS;\n }\n\n /\n 获取 token，按路径优先级依次尝试\n \n 1. 缓存有效且不在刷新窗口 → 直接返回\n * 2. 进入刷新窗口 → 重读文件，更新缓存\n * 3. 文件未更新但缓存未过期 → 仍返回旧缓存\n * 4. 所有路径均无有效 token → 返回 null\n /\n getToken(): { token: string; accessKey: string } \| null {\n const now = Date.now();\n\n for (const filePath of this.paths) {\n const cached = this.cache.get(filePath);\n\n // 缓存命中且不在刷新窗口\n if (cached && cached.expiresAtMs - now > this.refreshBeforeMs) {\n return { token: cached.token, accessKey: cached.accessKey };\n }\n\n // 需要读取/重读文件\n const result = this.readAndParse(filePath);\n if (result) {\n this.cache.set(filePath, result);\n if (result.expiresAtMs > now) {\n return { token: result.token, accessKey: result.accessKey };\n }\n }\n\n // 文件未更新，但缓存的 token 仍未过期\n if (cached && cached.expiresAtMs > now) {\n return { token: cached.token, accessKey: cached.accessKey };\n }\n }\n\n return null;\n }\n\n clearCache(): void {\n this.cache.clear();\n }\n\n private readAndParse(filePath: string): CachedFileToken \| null {\n try {\n const token = readFileSync(filePath, 'utf-8').trim();\n if (!token) return null;\n\n const payload = this.decodePayload(token);\n if (!payload?.exp) return null;\n\n return {\n token,\n accessKey: payload.access_key ?? '',\n expiresAtMs: payload.exp 1000,\n };\n } catch {\n return null;\n }\n }\n\n private decodePayload(token: string): Record<string, any> \| null {\n try {\n const segments = token.split('.');\n if (segments.length !== 3) return null;\n\n const padLength = (4 - (segments[1].length % 4 \|\| 4)) % 4;\n const padded = `${segments[1]}${'='.repeat(padLength)}`\n .replace(/-/g, '+')\n .replace(/_/g, '/');\n\n return JSON.parse(Buffer.from(padded, 'base64').toString('utf8'));\n } catch {\n return null;\n }\n }\n}\n","import type { RequestConfig, RequestInterceptor } from '../core/types';\nimport {\n DEFAULT_JWT_EXPIRE_TIME_MS,\n CustomClaims,\n} from '../helper/jwt';\nimport { JWTTokenManager, StaticTokenSource } from '../helper/jwt-manager';\nimport { FileTokenProvider } from '../helper/file-token-provider';\n\nexport type PlatformClaims = Omit<CustomClaims, 'access_key'>;\n\nexport interface TokenProviderConfig {\n type: 'file';\n paths?: string[];\n}\n\nexport interface PlatformPluginOptions {\n enabled?: boolean;\n baseURL?: string;\n domainEnv?: string;\n accessKeyEnv?: string;\n secretKeyEnv?: string;\n accessKey?: string;\n secretKey?: string;\n expireTimeMs?: number;\n refreshBeforeMs?: number;\n defaultClaims?: PlatformClaims;\n /*\n 平台直接派发的静态 token（短期凭据，默认 5 天有效，当前实现为 JWT）。配置后：\n * - 优先用此 token 调 InnerAPI（不再用 sk 自签），消除 sk 长期落地的泄漏面\n * - 若同时配置了 sk（accessKey/secretKey 或对应 env），sk 自签作为最终 fallback\n * 优先级：`token` option > `process.env[tokenEnv ?? 'FORCE_AUTHN_TOKEN']`\n * 与 `tokenProvider`（文件 token）共存：fileToken > envToken > sk 自签。\n /\n token?: string;\n tokenEnv?: string;\n /\n 管理端 innerapi 链路（仅用于妙搭开发态）\n * 启用后：\n * - baseURL 改从 adminDomainEnv（默认 MIAODA_DEV_INNER_DOMAIN_WITH_PREFIX）读取\n * - 每次请求从 clientTokenEnv（默认 MIAODA_AUTHN_CODE）读取用户凭证，\n * 注入为 X-Miaoda-Client-Token 请求头（读不到则不注入）\n * - AK/SK 的 Authorization + x-api-key 照旧\n /\n adminInnerApi?: boolean;\n adminDomainEnv?: string;\n clientTokenEnv?: string;\n tokenProvider?: TokenProviderConfig;\n}\n\nexport interface PlatformRequestAuthConfig {\n customClaims?: PlatformClaims;\n}\n\nconst DEFAULT_DOMAIN_ENV = 'FORCE_AUTHN_INNERAPI_DOMAIN';\nconst DEFAULT_ACCESS_KEY_ENV = 'FORCE_AUTHN_ACCESS_KEY';\nconst DEFAULT_SECRET_KEY_ENV = 'FORCE_AUTHN_ACCESS_SECRET';\nconst DEFAULT_TOKEN_ENV = 'FORCE_AUTHN_TOKEN';\nconst DEFAULT_ADMIN_DOMAIN_ENV = 'MIAODA_DEV_INNER_DOMAIN_WITH_PREFIX';\nconst DEFAULT_CLIENT_TOKEN_ENV = 'MIAODA_AUTHN_CODE';\nconst MIAODA_CLIENT_TOKEN_HEADER = 'X-Miaoda-Client-Token';\n\nexport function resolvePlatformBaseURL(options?: PlatformPluginOptions): string \| undefined {\n if (!options?.enabled) {\n return options?.baseURL;\n }\n\n if (options.baseURL) {\n return options.baseURL;\n }\n\n const envName = options.adminInnerApi\n ? (options.adminDomainEnv \|\| DEFAULT_ADMIN_DOMAIN_ENV)\n : (options.domainEnv \|\| DEFAULT_DOMAIN_ENV);\n const domain = process.env[envName];\n if (!domain) {\n throw new Error(`平台模式需要基础域名，请设置环境变量 ${envName}`);\n }\n return domain;\n}\n\ntype RequestInterceptorManager = {\n use: (\n onFulfilled?: RequestInterceptor['onFulfilled'],\n onRejected?: RequestInterceptor['onRejected'],\n ) => number;\n eject: (id: number) => void;\n};\n\ninterface InterceptorHost {\n request: RequestInterceptorManager;\n}\n\nexport function registerPlatformPlugin(\n interceptors: InterceptorHost,\n options: PlatformPluginOptions,\n): JWTTokenManager \| undefined {\n if (!options.enabled) {\n return undefined;\n }\n\n ensureNoAccessKeyOverride('platform.defaultClaims', options.defaultClaims);\n\n // 创建文件 token provider（如果配置了）\n let fileTokenProvider: FileTokenProvider \| undefined;\n if (options.tokenProvider?.type === 'file') {\n fileTokenProvider = new FileTokenProvider({\n paths: options.tokenProvider.paths,\n refreshBeforeMs: options.refreshBeforeMs,\n });\n }\n\n // 提前检查 AK/SK，避免每次请求时检查\n const accessKeyEnv = options.accessKeyEnv \|\| DEFAULT_ACCESS_KEY_ENV;\n const secretKeyEnv = options.secretKeyEnv \|\| DEFAULT_SECRET_KEY_ENV;\n\n const accessKey = options.accessKey ?? (process.env[accessKeyEnv] \|\| '');\n const secretKey = options.secretKey ?? (process.env[secretKeyEnv] \|\| '');\n\n const expireTimeMs = options.expireTimeMs ?? DEFAULT_JWT_EXPIRE_TIME_MS;\n\n // 创建 JWT Token Manager（支持缓存和自动刷新，同时作为 fallback）\n const tokenManager = new JWTTokenManager({\n accessKey,\n secretKey,\n expireTimeMs,\n refreshBeforeMs: options.refreshBeforeMs,\n });\n\n // 平台派发的静态 token（可选；有则在 fileToken 之后、sk 自签之前用，消除 sk 长期落地的泄漏面）\n const tokenEnv = options.tokenEnv \|\| DEFAULT_TOKEN_ENV;\n const platformToken = options.token ?? (process.env[tokenEnv] \|\| '');\n const staticTokenSource = platformToken ? new StaticTokenSource(platformToken) : null;\n\n const clientTokenEnv = options.clientTokenEnv \|\| DEFAULT_CLIENT_TOKEN_ENV;\n\n // 注册请求拦截器\n interceptors.request.use((config: RequestConfig) => {\n // 优先尝试文件 token\n if (fileTokenProvider) {\n const fileToken = fileTokenProvider.getToken();\n if (fileToken) {\n const headers = {\n ...(config.headers as Record<string, string>),\n 'Authorization': `Bearer ${fileToken.token}`,\n 'x-api-key': fileToken.accessKey,\n };\n return { ...config, headers };\n }\n }\n\n ensureNoAccessKeyOverride('request.platformAuth.customClaims', config.platformAuth?.customClaims);\n\n const claims: CustomClaims = {\n ...(options.defaultClaims \|\| {}),\n ...(config.platformAuth?.customClaims \|\| {}),\n access_key: accessKey,\n };\n\n // 次选 envToken（FORCE_AUTHN_TOKEN env / options.token）—— 短期凭据,跟 fileToken 同样\n // 替代 sk 长期落地。envToken 拿到才用,拿不到继续往下退到 sk 自签。\n // 注:StaticTokenSource.getToken 当前实现是直接返回构造时传入的 token,不会抛 —— 即便将来\n // 改成可能抛的实现(比如带过期校验),也走 sk 自签 fallback。\n let token: string;\n if (staticTokenSource) {\n try {\n token = staticTokenSource.getToken(claims);\n } catch {\n token = tokenManager.getToken(claims);\n }\n } else {\n token = tokenManager.getToken(claims);\n }\n\n // 统一使用 Record<string, string> 类型，由 client.ts 的 normalizeHeaders 处理\n const headers: Record<string, string> = {\n ...(config.headers as Record<string, string>),\n 'Authorization': `Bearer ${token}`,\n 'x-api-key': accessKey,\n };\n\n // 管理端 innerapi：运行时读取用户凭证并注入\n if (options.adminInnerApi) {\n const clientToken = process.env[clientTokenEnv];\n if (clientToken) {\n headers[MIAODA_CLIENT_TOKEN_HEADER] = clientToken;\n }\n }\n\n return {\n ...config,\n headers,\n };\n });\n\n return tokenManager;\n}\n\nfunction ensureNoAccessKeyOverride(name: string, claims?: PlatformClaims) {\n if (claims && Object.prototype.hasOwnProperty.call(claims, 'access_key')) {\n throw new Error(`${name} 不允许设置 access_key`);\n }\n}\n","/\n 拦截器管理器（模仿 Axios 的 InterceptorManager）\n /\nexport class InterceptorManager<T> {\n private interceptors: (T \| null)[] = [];\n\n /\n 添加拦截器\n * @returns 拦截器 ID，用于后续移除\n /\n use(onFulfilled?: any, onRejected?: any): number {\n this.interceptors.push({ onFulfilled, onRejected } as T);\n return this.interceptors.length - 1;\n }\n\n /\n 移除拦截器\n /\n eject(id: number): void {\n if (this.interceptors[id]) {\n this.interceptors[id] = null;\n }\n }\n\n /\n 清空所有拦截器\n /\n clear(): void {\n this.interceptors = [];\n }\n\n /\n 遍历所有拦截器\n /\n forEach(fn: (interceptor: T) => void): void {\n this.interceptors.forEach((interceptor) => {\n if (interceptor !== null) {\n fn(interceptor);\n }\n });\n }\n}\n","/\n Checks if a value is a plain object.\n * @param value The value to check.\n * @returns True if the value is a plain object, false otherwise.\n /\nexport function isPlainObject(value: any): boolean {\n if (typeof value !== 'object' \|\| value === null) {\n return false;\n }\n const proto = Object.getPrototypeOf(value);\n return proto === Object.prototype \|\| proto === null;\n}\n\nexport function normalizeHeaders(headers?: RequestInit['headers']): Record<string, string> {\n if (!headers) {\n return {};\n }\n\n if (headers instanceof Headers) {\n const normalized: Record<string, string> = {};\n headers.forEach((value, key) => {\n normalized[key] = value;\n });\n return normalized;\n }\n\n if (Array.isArray(headers)) {\n return headers.reduce<Record<string, string>>((acc, [key, value]) => {\n acc[key] = value;\n return acc;\n }, {});\n }\n\n const normalized: Record<string, string> = {};\n Object.entries(headers as Record<string, string \| readonly string[]>).forEach(\n ([key, value]) => {\n const normalizedValue = Array.isArray(value) ? value.join(',') : value;\n normalized[key] = normalizedValue as string;\n },\n );\n return normalized;\n}\n","import type { PlatformPluginOptions, PlatformRequestAuthConfig } from '../plugins/platform-plugin';\nimport { normalizeHeaders } from './utils';\n\n/\n 清理后的请求配置（移除敏感信息）\n /\nexport interface SafeRequestConfig extends Omit<RequestConfig, 'headers'> {\n headers?: Record<string, string>; // 已清理的 headers\n}\n\n/\n HTTP 错误对象\n \n 注意：为了安全考虑，error.config 中的敏感 headers (如 Authorization, x-api-key)\n * 会被替换为 '[REDACTED]'\n /\nexport class HttpError extends Error {\n public readonly isHttpError: boolean = true;\n public response: Response \| undefined;\n public config: SafeRequestConfig;\n\n constructor(\n response: Response \| undefined,\n config: RequestConfig,\n message?: string,\n options?: { cause?: unknown },\n ) {\n super(message \|\| `Request failed with status ${response?.status \|\| 'unknown'}`, options);\n this.name = 'HttpError';\n this.response = response;\n this.config = sanitizeConfig(config);\n Object.setPrototypeOf(this, HttpError.prototype);\n }\n}\n\nexport interface RequestConfig extends RequestInit {\n url?: string;\n params?: Record<string, any>;\n timeout?: number;\n baseURL?: string;\n platformAuth?: PlatformRequestAuthConfig;\n}\n\nexport interface SecurityConfig {\n /\n 允许的 URL 协议白名单\n * 默认: null (不限制)\n * 设置为 ['http:', 'https:'] 可限制只允许 HTTP/HTTPS\n /\n allowedProtocols?: string[] \| null;\n\n /\n 最大响应体大小（字节）\n * 默认: 0 (不限制)\n * 设置为正数可限制响应体大小，防止内存耗尽攻击\n /\n maxResponseSize?: number;\n\n /\n 是否启用严格模式（启用所有安全检查）\n * 默认: false\n * 启用后会自动设置：\n * - allowedProtocols = ['http:', 'https:']\n * - maxResponseSize = 50MB\n /\n strictMode?: boolean;\n}\n\nexport interface HttpClientPreInterceptors {\n request?: RequestInterceptor[];\n response?: ResponseInterceptor[];\n}\n\nexport interface HttpClientConfig extends RequestConfig {\n platform?: PlatformPluginOptions;\n security?: SecurityConfig;\n preInterceptors?: HttpClientPreInterceptors;\n}\n\n/\n 请求拦截器函数\n /\nexport type RequestInterceptor = {\n onFulfilled?: (config: RequestConfig) => RequestConfig \| Promise<RequestConfig>;\n onRejected?: (error: any) => any;\n};\n\n/\n 响应拦截器函数（fetch 风格）\n /\nexport type ResponseInterceptor = {\n onFulfilled?: (response: Response) => Response \| Promise<Response>;\n onRejected?: (error: any) => any;\n};\n\n/\n 清理配置中的敏感信息\n /\nfunction sanitizeConfig(config: RequestConfig): SafeRequestConfig {\n const { headers, ...rest } = config;\n\n return {\n ...rest,\n headers: sanitizeHeaders(headers),\n };\n}\n\n/\n 清理敏感 headers\n \n 将 Authorization, x-api-key, cookie 等敏感字段替换为 '[REDACTED]'\n /\nfunction sanitizeHeaders(headers?: RequestInit['headers']): Record<string, string> \| undefined {\n if (!headers) {\n return undefined;\n }\n\n const normalized = normalizeHeaders(headers);\n const sanitized: Record<string, string> = {};\n\n const sensitiveHeaders = ['authorization', 'x-api-key', 'cookie', 'x-secret'];\n\n for (const [key, value] of Object.entries(normalized)) {\n const lowerKey = key.toLowerCase();\n if (sensitiveHeaders.includes(lowerKey)) {\n sanitized[key] = '[REDACTED]';\n } else {\n sanitized[key] = value;\n }\n }\n\n return sanitized;\n}\n","import { registerPlatformPlugin, resolvePlatformBaseURL } from '../plugins/platform-plugin';\nimport { InterceptorManager } from './InterceptorManager';\nimport {\n HttpError,\n type HttpClientConfig,\n type RequestConfig,\n type RequestInterceptor,\n type ResponseInterceptor,\n type SecurityConfig,\n} from './types';\nimport { isPlainObject, normalizeHeaders } from './utils';\n\n/\n 技术栈无关的 HTTP 客户端\n \n 设计理念：\n * - 基于原生 fetch API，零依赖\n * - 拦截器模式遵循 Axios 标准，AI 模型和开发者都熟悉\n * - 可在任何 Node.js 环境使用（NestJS, Express, Koa, 纯 Node）\n \n @example\n * ```typescript\n * const client = new HttpClient({\n * baseURL: 'https://api.example.com',\n * timeout: 5000,\n * });\n \n // 添加请求拦截器（类似 Axios）\n * client.interceptors.request.use(\n * config => {\n * config.headers = config.headers \|\| {};\n * config.headers['Authorization'] = 'Bearer token';\n * return config;\n * },\n * error => Promise.reject(error)\n * );\n \n // 添加响应拦截器（类似 Axios）\n * client.interceptors.response.use(\n * response => {\n * console.log('Response:', response.status);\n * return response;\n * },\n * error => {\n * if (error.response?.status === 401) {\n * // 处理未授权\n * }\n * return Promise.reject(error);\n * }\n * );\n \n // 发起请求\n * const response = await client.get('/users');\n * console.log(response.data);\n * ```\n /\nexport class HttpClient {\n private defaultConfig: RequestConfig;\n private securityConfig: Required<SecurityConfig>;\n /\n 拦截器管理器（API 与 Axios 一致）\n /\n public interceptors = {\n request: new InterceptorManager<RequestInterceptor>(),\n response: new InterceptorManager<ResponseInterceptor>(),\n };\n\n constructor(config?: HttpClientConfig) {\n const { platform, security, preInterceptors, ...restConfig } = config \|\| {};\n\n this.defaultConfig = {\n timeout: 5000,\n ...restConfig,\n };\n\n // 初始化安全配置\n const strictMode = security?.strictMode ?? false;\n this.securityConfig = {\n allowedProtocols: strictMode ? ['http:', 'https:'] : null,\n maxResponseSize: strictMode ? 50 1024 * 1024 : 0, // 50MB\n strictMode,\n ...security,\n };\n\n this.registerRequestPreInterceptors(preInterceptors?.request);\n\n if (platform?.enabled) {\n if (!this.defaultConfig.baseURL) {\n this.defaultConfig.baseURL = resolvePlatformBaseURL(platform);\n }\n registerPlatformPlugin(this.interceptors, platform);\n }\n\n this.registerResponsePreInterceptors(preInterceptors?.response);\n }\n\n /*\n GET 请求\n /\n async get(url: string, config?: RequestConfig): Promise<Response> {\n return this.request({ ...config, url, method: 'GET' });\n }\n\n /\n POST 请求\n /\n async post(url: string, data?: any, config?: RequestConfig): Promise<Response> {\n const headers: Record<string, string> = { ...config?.headers } as Record<string, string>;\n let body: any = data;\n\n if (isPlainObject(data)) {\n body = JSON.stringify(data);\n if (!Object.keys(headers).some((key) => key.toLowerCase() === 'content-type')) {\n headers['Content-Type'] = 'application/json';\n }\n }\n\n return this.request({\n ...config,\n url,\n method: 'POST',\n body,\n headers,\n });\n }\n\n /\n PUT 请求\n /\n async put(url: string, data?: any, config?: RequestConfig): Promise<Response> {\n const headers: Record<string, string> = { ...config?.headers } as Record<string, string>;\n let body: any = data;\n\n if (isPlainObject(data)) {\n body = JSON.stringify(data);\n if (!Object.keys(headers).some((key) => key.toLowerCase() === 'content-type')) {\n headers['Content-Type'] = 'application/json';\n }\n }\n\n return this.request({\n ...config,\n url,\n method: 'PUT',\n body,\n headers,\n });\n }\n\n /\n DELETE 请求\n /\n async delete(url: string, config?: RequestConfig): Promise<Response> {\n return this.request({ ...config, url, method: 'DELETE' });\n }\n\n /\n PATCH 请求\n /\n async patch(url: string, data?: any, config?: RequestConfig): Promise<Response> {\n const headers: Record<string, string> = { ...config?.headers } as Record<string, string>;\n let body: any = data;\n\n if (isPlainObject(data)) {\n body = JSON.stringify(data);\n if (!Object.keys(headers).some((key) => key.toLowerCase() === 'content-type')) {\n headers['Content-Type'] = 'application/json';\n }\n }\n\n return this.request({\n ...config,\n url,\n method: 'PATCH',\n body,\n headers,\n });\n }\n\n /\n 核心请求方法（fetch 风格）\n /\n async request(config: RequestConfig): Promise<Response> {\n // 1. 合并配置\n // Perform a case-insensitive header merge that preserves the final key's casing.\n const baseHeaders = normalizeHeaders(this.defaultConfig.headers);\n const overrideHeaders = normalizeHeaders(config.headers);\n const mergedKeyMap: Record<string, { key: string; value: string }> = {};\n\n for (const key in baseHeaders) {\n mergedKeyMap[key.toLowerCase()] = { key, value: baseHeaders[key] };\n }\n for (const key in overrideHeaders) {\n mergedKeyMap[key.toLowerCase()] = { key, value: overrideHeaders[key] };\n }\n\n const finalHeaders: Record<string, string> = {};\n for (const lowerKey in mergedKeyMap) {\n const { key, value } = mergedKeyMap[lowerKey];\n finalHeaders[key] = value;\n }\n\n let mergedConfig: RequestConfig = {\n ...this.defaultConfig,\n ...config,\n headers: finalHeaders,\n };\n\n // 2. 执行请求拦截器\n try {\n mergedConfig = await this.runRequestInterceptors(mergedConfig);\n } catch (error) {\n return Promise.reject(error);\n }\n\n // 3. 统一 normalize headers（拦截器可能返回 Headers 对象）\n mergedConfig.headers = normalizeHeaders(mergedConfig.headers);\n\n // 4. 构建完整 URL\n const fullUrl = this.buildUrl(mergedConfig.url!, mergedConfig.params);\n\n // 5. 设置超时和取消\n const timeout = mergedConfig.timeout \|\| this.defaultConfig.timeout \|\| 5000;\n const controller = new AbortController();\n const timeoutId = setTimeout(() => controller.abort(), timeout);\n\n // 监听外部 signal\n const externalSignal = mergedConfig.signal;\n if (externalSignal) {\n // 如果外部 signal 已经终止，立即终止\n if (externalSignal.aborted) {\n clearTimeout(timeoutId);\n controller.abort();\n } else {\n // 使用 { once: true } 避免内存泄漏\n externalSignal.addEventListener('abort', () => controller.abort(), { once: true });\n }\n }\n\n // 6. 准备 fetch 配置（排除自定义字段）\n const { platformAuth, params, timeout: _timeout, baseURL, url, ...fetchOptions } = mergedConfig;\n\n try {\n // 7. 发起请求\n const response = await fetch(fullUrl, {\n ...fetchOptions,\n signal: controller.signal, // 传递我们自己的 controller signal\n });\n\n clearTimeout(timeoutId);\n\n // 安全检查：响应体大小限制\n if (this.securityConfig.maxResponseSize > 0) {\n const contentLength = response.headers.get('content-length');\n if (contentLength) {\n const size = parseInt(contentLength, 10);\n if (size > this.securityConfig.maxResponseSize) {\n throw new Error(\n `Response size ${size} bytes exceeds limit of ${this.securityConfig.maxResponseSize} bytes`\n );\n }\n }\n }\n\n // 检查响应状态\n if (!response.ok) {\n const error = new HttpError(response, mergedConfig);\n return this.runResponseInterceptors(Promise.reject(error));\n }\n\n // 执行响应拦截器（直接返回 Response）\n return this.runResponseInterceptors(Promise.resolve(response));\n } catch (error) {\n clearTimeout(timeoutId);\n\n // 网络错误或超时错误\n const httpError =\n error instanceof HttpError\n ? error\n : new HttpError(\n undefined,\n mergedConfig,\n describeFetchError(error, externalSignal?.aborted ? undefined : timeout),\n { cause: error },\n );\n\n return this.runResponseInterceptors(Promise.reject(httpError));\n }\n }\n\n /\n 注册请求 preInterceptors\n /\n private registerRequestPreInterceptors(interceptors?: RequestInterceptor[]) {\n if (!interceptors?.length) {\n return;\n }\n\n for (const interceptor of interceptors) {\n this.interceptors.request.use(\n interceptor.onFulfilled,\n interceptor.onRejected,\n );\n }\n }\n\n /\n 注册响应 preInterceptors\n /\n private registerResponsePreInterceptors(interceptors?: ResponseInterceptor[]) {\n if (!interceptors?.length) {\n return;\n }\n\n for (const interceptor of interceptors) {\n this.interceptors.response.use(\n interceptor.onFulfilled,\n interceptor.onRejected,\n );\n }\n }\n\n /\n 执行请求拦截器链\n /\n private runRequestInterceptors(config: RequestConfig): Promise<RequestConfig> {\n let promise: Promise<RequestConfig> = Promise.resolve(config);\n\n const interceptors: RequestInterceptor[] = [];\n this.interceptors.request.forEach((interceptor) => {\n interceptors.push(interceptor);\n });\n\n for (const interceptor of interceptors) {\n promise = promise.then(\n interceptor.onFulfilled,\n interceptor.onRejected,\n );\n }\n\n return promise;\n }\n\n /\n 执行响应拦截器链\n /\n private async runResponseInterceptors(\n promise: Promise<Response>,\n ): Promise<Response> {\n let currentPromise = promise;\n\n // 按顺序执行所有响应拦截器\n const interceptors: ResponseInterceptor[] = [];\n this.interceptors.response.forEach((interceptor) => {\n interceptors.push(interceptor);\n });\n\n for (const interceptor of interceptors) {\n currentPromise = currentPromise.then(\n interceptor.onFulfilled,\n interceptor.onRejected,\n );\n }\n\n return currentPromise;\n }\n\n /\n 构建完整 URL（包含 baseURL 和 query params）\n /\n private buildUrl(url: string, params?: Record<string, any>): string {\n const baseURL = this.defaultConfig.baseURL;\n\n // 拼接 baseURL 和 url（Axios 风格）\n // - 如果 url 是绝对路径（含协议），直接使用 url\n // - 否则拼接 baseURL 和 url，正确处理斜杠\n let combinedUrl: string;\n if (!baseURL \|\| /^https?:\\/\\//i.test(url)) {\n combinedUrl = url;\n } else {\n combinedUrl = baseURL.replace(/\\/+$/, '') + '/' + url.replace(/^\\/+/, '');\n }\n\n const fullUrl = new URL(combinedUrl);\n\n // 协议白名单检查\n const { allowedProtocols } = this.securityConfig;\n if (allowedProtocols && !allowedProtocols.includes(fullUrl.protocol)) {\n throw new Error(\n `Protocol ${fullUrl.protocol} is not allowed. Allowed: ${allowedProtocols.join(', ')}`\n );\n }\n\n // 合并 query params\n if (params) {\n for (const [key, value] of Object.entries(params)) {\n if (value === undefined \|\| value === null) continue;\n fullUrl.searchParams.set(key, String(value));\n }\n }\n\n return fullUrl.href;\n }\n}\n\n/\n 生成网络错误的 message：拼上 cause 的 code 与原因；AbortError 区分超时与主动取消\n * @param timeout 超时触发时传入，主动取消时为 undefined\n */\nfunction describeFetchError(error: unknown, timeout?: number): string {\n const err = error as (Error & { cause?: { code?: string; message?: string } }) \| undefined;\n if (err?.name === 'AbortError') {\n return timeout ? `Request timeout after ${timeout}ms` : 'Request aborted';\n }\n // 底层报错可能含换行（如 TLS），压成一行\n const detail = [err?.cause?.code, err?.cause?.message]\n .filter(Boolean)\n .join(': ')\n .replace(/\\s+/g, ' ')\n .trim();\n const message = err?.message ?? String(error);\n return detail ? `${message} (${detail})` : message;\n}\n"],"mappings":";AAAA,SAAS,YAAY,YAAY,uBAAuB;AAwCjD,IAAM,6BAA6B,KAAK,KAAK;AAC7C,IAAM,8BAA8B;AAE3C,IAAM,aAAa;AAAA,EACjB,KAAK;AAAA,EACL,KAAK;AACP;AAEO,SAAS,iBACd,cACA,QACQ;AACR,QAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC/C,QAAM,UAAqB;AAAA,IACzB,GAAG;AAAA,IACH,KAAK,aAAa;AAAA,IAClB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,aAAa,KAAK,MAAM,OAAO,eAAe,GAAI;AAAA,IACvD,KAAK,WAAW;AAAA,EAClB;AAEA,QAAM,gBAAgB,gBAAgB,KAAK,UAAU,UAAU,CAAC;AAChE,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,OAAO,CAAC;AAC9D,QAAM,YAAY,KAAK,GAAG,aAAa,IAAI,cAAc,IAAI,OAAO,SAAS;AAE7E,SAAO,GAAG,aAAa,IAAI,cAAc,IAAI,SAAS;AACxD;AAEO,SAAS,wBACd,aACA,QACA,SACW;AACX,QAAM,WAAW,YAAY,MAAM,GAAG;AACtC,MAAI,SAAS,WAAW,GAAG;AACzB,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AAEA,QAAM,CAAC,eAAe,gBAAgB,SAAS,IAAI;AAGnD,QAAM,aAAa,KAAK,MAAM,gBAAgB,aAAa,CAAC;AAC5D,MAAI,WAAW,QAAQ,SAAS;AAC9B,UAAM,IAAI,MAAM,qBAAqB;AAAA,EACvC;AAGA,QAAM,oBAAoB,KAAK,GAAG,aAAa,IAAI,cAAc,IAAI,OAAO,SAAS;AAErF,QAAM,iBAAiB,OAAO,KAAK,iBAAiB;AACpD,QAAM,kBAAkB,OAAO,KAAK,SAAS;AAC7C,MACE,eAAe,WAAW,gBAAgB,UAC1C,CAAC,gBAAgB,gBAAgB,eAAe,GAChD;AACA,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AAGA,QAAM,UAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC;AAG1D,MAAI,CAAC,SAAS,gBAAgB;AAC5B,UAAM,iBAAiB,SAAS,kBAAkB;AAClD,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAGxC,QAAI,QAAQ,QAAQ,QAAW;AAC7B,UAAI,QAAQ,MAAM,iBAAiB,KAAK;AACtC,cAAM,IAAI;AAAA,UACR,wBAAwB,IAAI,KAAK,QAAQ,MAAM,GAAI,EAAE,YAAY,CAAC;AAAA,QACpE;AAAA,MACF;AAAA,IACF;AAGA,QAAI,QAAQ,QAAQ,QAAW;AAC7B,UAAI,QAAQ,MAAM,iBAAiB,KAAK;AACtC,cAAM,IAAI;AAAA,UACR,6CAA6C,IAAI,KAAK,QAAQ,MAAM,GAAI,EAAE,YAAY,CAAC;AAAA,QACzF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,QAAQ,QAAQ,QAAW;AAC7B,UAAI,QAAQ,MAAM,iBAAiB,KAAK;AACtC,cAAM,IAAI;AAAA,UACR,qCAAqC,IAAI,KAAK,QAAQ,MAAM,GAAI,EAAE,YAAY,CAAC;AAAA,QACjF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,KAAK,OAAe,QAAwB;AACnD,SAAO,WAAW,UAAU,MAAM,EAC/B,OAAO,KAAK,EACZ,OAAO,QAAQ,EACf,QAAQ,MAAM,EAAE,EAChB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG;AACvB;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,OAAO,KAAK,KAAK,EACrB,SAAS,QAAQ,EACjB,QAAQ,MAAM,EAAE,EAChB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG;AACvB;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,QAAM,aAAa,KAAK,MAAM,SAAS,KAAK,MAAM;AAClD,QAAM,SAAS,GAAG,KAAK,GAAG,IAAI,OAAO,SAAS,CAAC,GAC5C,QAAQ,MAAM,GAAG,EACjB,QAAQ,MAAM,GAAG;AACpB,SAAO,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM;AACtD;;;AC7GO,IAAM,kBAAN,MAAsB;AAAA,EACnB,QAAQ,oBAAI,IAAyB;AAAA,EACrC;AAAA,EAER,YAAY,QAA0B;AACpC,SAAK,SAAS;AAAA,MACZ,iBAAiB,IAAI,KAAK;AAAA;AAAA,MAC1B,GAAG;AAAA,IACL;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,SAAS,QAA8B;AACrC,UAAM,WAAW,KAAK,YAAY,MAAM;AACxC,UAAM,SAAS,KAAK,MAAM,IAAI,QAAQ;AACtC,UAAM,MAAM,KAAK,IAAI;AAGrB,QAAI,UAAU,OAAO,cAAc,MAAM,KAAK,OAAO,iBAAiB;AACpE,aAAO,OAAO;AAAA,IAChB;AAGA,UAAM,QAAQ,iBAAiB,QAAQ,KAAK,MAAM;AAClD,UAAM,cAAc,MAAM,KAAK,OAAO;AAEtC,SAAK,MAAM,IAAI,UAAU,EAAE,OAAO,YAAY,CAAC;AAE/C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,aAAmB;AACjB,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAc,QAA4B;AACxC,UAAM,WAAW,KAAK,YAAY,MAAM;AACxC,SAAK,MAAM,OAAO,QAAQ;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,YAAY,QAA8B;AAEhD,UAAM,QAAQ;AAAA,MACZ,OAAO;AAAA,MACP,OAAO,aAAa;AAAA,MACpB,OAAO,WAAW;AAAA,MAClB,OAAO,UAAU;AAAA,MACjB,OAAO,WAAW;AAAA,MAClB,OAAO,cAAc;AAAA,IACvB;AACA,WAAO,MAAM,KAAK,GAAG;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB;AACd,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,aAAa;AACjB,QAAI,eAAe;AAEnB,eAAW,UAAU,KAAK,MAAM,OAAO,GAAG;AACxC,UAAI,OAAO,cAAc,KAAK;AAC5B;AAAA,MACF,OAAO;AACL;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO,KAAK,MAAM;AAAA,MAClB,OAAO;AAAA,MACP,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAUO,IAAM,oBAAN,MAA+C;AAAA,EACpD,YAA6B,OAAe;AAAf;AAC3B,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,MAAM,mDAA+B;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,SAAS,SAA+B;AACtC,WAAO,KAAK;AAAA,EACd;AACF;;;AC5KA,SAAS,oBAAoB;AAa7B,IAAM,4BAA4B,IAAI,KAAK;AAC3C,IAAM,sBAAsB;AAAA,EAC1B;AACF;AAqBO,IAAM,oBAAN,MAAwB;AAAA,EACrB,QAAQ,oBAAI,IAA6B;AAAA,EACzC;AAAA,EACA;AAAA,EAER,YAAY,QAAkC;AAC5C,SAAK,QAAQ,QAAQ,SAAS;AAC9B,SAAK,kBAAkB,QAAQ,mBAAmB;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,WAAwD;AACtD,UAAM,MAAM,KAAK,IAAI;AAErB,eAAW,YAAY,KAAK,OAAO;AACjC,YAAM,SAAS,KAAK,MAAM,IAAI,QAAQ;AAGtC,UAAI,UAAU,OAAO,cAAc,MAAM,KAAK,iBAAiB;AAC7D,eAAO,EAAE,OAAO,OAAO,OAAO,WAAW,OAAO,UAAU;AAAA,MAC5D;AAGA,YAAM,SAAS,KAAK,aAAa,QAAQ;AACzC,UAAI,QAAQ;AACV,aAAK,MAAM,IAAI,UAAU,MAAM;AAC/B,YAAI,OAAO,cAAc,KAAK;AAC5B,iBAAO,EAAE,OAAO,OAAO,OAAO,WAAW,OAAO,UAAU;AAAA,QAC5D;AAAA,MACF;AAGA,UAAI,UAAU,OAAO,cAAc,KAAK;AACtC,eAAO,EAAE,OAAO,OAAO,OAAO,WAAW,OAAO,UAAU;AAAA,MAC5D;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,aAAmB;AACjB,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEQ,aAAa,UAA0C;AAC7D,QAAI;AACF,YAAM,QAAQ,aAAa,UAAU,OAAO,EAAE,KAAK;AACnD,UAAI,CAAC,MAAO,QAAO;AAEnB,YAAM,UAAU,KAAK,cAAc,KAAK;AACxC,UAAI,CAAC,SAAS,IAAK,QAAO;AAE1B,aAAO;AAAA,QACL;AAAA,QACA,WAAW,QAAQ,cAAc;AAAA,QACjC,aAAa,QAAQ,MAAM;AAAA,MAC7B;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,cAAc,OAA2C;AAC/D,QAAI;AACF,YAAM,WAAW,MAAM,MAAM,GAAG;AAChC,UAAI,SAAS,WAAW,EAAG,QAAO;AAElC,YAAM,aAAa,KAAK,SAAS,CAAC,EAAE,SAAS,KAAK,MAAM;AACxD,YAAM,SAAS,GAAG,SAAS,CAAC,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC,GAClD,QAAQ,MAAM,GAAG,EACjB,QAAQ,MAAM,GAAG;AAEpB,aAAO,KAAK,MAAM,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM,CAAC;AAAA,IAClE,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACpEA,IAAM,qBAAqB;AAC3B,IAAM,yBAAyB;AAC/B,IAAM,yBAAyB;AAC/B,IAAM,oBAAoB;AAC1B,IAAM,2BAA2B;AACjC,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AAE5B,SAAS,uBAAuB,SAAqD;AAC1F,MAAI,CAAC,SAAS,SAAS;AACrB,WAAO,SAAS;AAAA,EAClB;AAEA,MAAI,QAAQ,SAAS;AACnB,WAAO,QAAQ;AAAA,EACjB;AAEA,QAAM,UAAU,QAAQ,gBACnB,QAAQ,kBAAkB,2BAC1B,QAAQ,aAAa;AAC1B,QAAM,SAAS,QAAQ,IAAI,OAAO;AAClC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,gHAAsB,OAAO,EAAE;AAAA,EACjD;AACA,SAAO;AACT;AAcO,SAAS,uBACd,cACA,SAC6B;AAC7B,MAAI,CAAC,QAAQ,SAAS;AACpB,WAAO;AAAA,EACT;AAEA,4BAA0B,0BAA0B,QAAQ,aAAa;AAGzE,MAAI;AACJ,MAAI,QAAQ,eAAe,SAAS,QAAQ;AAC1C,wBAAoB,IAAI,kBAAkB;AAAA,MACxC,OAAO,QAAQ,cAAc;AAAA,MAC7B,iBAAiB,QAAQ;AAAA,IAC3B,CAAC;AAAA,EACH;AAGA,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,eAAe,QAAQ,gBAAgB;AAE7C,QAAM,YAAY,QAAQ,cAAc,QAAQ,IAAI,YAAY,KAAK;AACrE,QAAM,YAAY,QAAQ,cAAc,QAAQ,IAAI,YAAY,KAAK;AAErE,QAAM,eAAe,QAAQ,gBAAgB;AAG7C,QAAM,eAAe,IAAI,gBAAgB;AAAA,IACvC;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,QAAQ;AAAA,EAC3B,CAAC;AAGD,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,gBAAgB,QAAQ,UAAU,QAAQ,IAAI,QAAQ,KAAK;AACjE,QAAM,oBAAoB,gBAAgB,IAAI,kBAAkB,aAAa,IAAI;AAEjF,QAAM,iBAAiB,QAAQ,kBAAkB;AAGjD,eAAa,QAAQ,IAAI,CAAC,WAA0B;AAElD,QAAI,mBAAmB;AACrB,YAAM,YAAY,kBAAkB,SAAS;AAC7C,UAAI,WAAW;AACb,cAAMA,WAAU;AAAA,UACd,GAAI,OAAO;AAAA,UACX,iBAAiB,UAAU,UAAU,KAAK;AAAA,UAC1C,aAAa,UAAU;AAAA,QACzB;AACA,eAAO,EAAE,GAAG,QAAQ,SAAAA,SAAQ;AAAA,MAC9B;AAAA,IACF;AAEA,8BAA0B,qCAAqC,OAAO,cAAc,YAAY;AAEhG,UAAM,SAAuB;AAAA,MAC3B,GAAI,QAAQ,iBAAiB,CAAC;AAAA,MAC9B,GAAI,OAAO,cAAc,gBAAgB,CAAC;AAAA,MAC1C,YAAY;AAAA,IACd;AAMA,QAAI;AACJ,QAAI,mBAAmB;AACrB,UAAI;AACF,gBAAQ,kBAAkB,SAAS,MAAM;AAAA,MAC3C,QAAQ;AACN,gBAAQ,aAAa,SAAS,MAAM;AAAA,MACtC;AAAA,IACF,OAAO;AACL,cAAQ,aAAa,SAAS,MAAM;AAAA,IACtC;AAGA,UAAM,UAAkC;AAAA,MACtC,GAAI,OAAO;AAAA,MACX,iBAAiB,UAAU,KAAK;AAAA,MAChC,aAAa;AAAA,IACf;AAGA,QAAI,QAAQ,eAAe;AACzB,YAAM,cAAc,QAAQ,IAAI,cAAc;AAC9C,UAAI,aAAa;AACf,gBAAQ,0BAA0B,IAAI;AAAA,MACxC;AAAA,IACF;AAEA,WAAO;AAAA,MACL,GAAG;AAAA,MACH;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAEA,SAAS,0BAA0B,MAAc,QAAyB;AACxE,MAAI,UAAU,OAAO,UAAU,eAAe,KAAK,QAAQ,YAAY,GAAG;AACxE,UAAM,IAAI,MAAM,GAAG,IAAI,4CAAmB;AAAA,EAC5C;AACF;;;ACtMO,IAAM,qBAAN,MAA4B;AAAA,EACzB,eAA6B,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,IAAI,aAAmB,YAA0B;AAC/C,SAAK,aAAa,KAAK,EAAE,aAAa,WAAW,CAAM;AACvD,WAAO,KAAK,aAAa,SAAS;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IAAkB;AACtB,QAAI,KAAK,aAAa,EAAE,GAAG;AACzB,WAAK,aAAa,EAAE,IAAI;AAAA,IAC1B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,QAAc;AACZ,SAAK,eAAe,CAAC;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,IAAoC;AAC1C,SAAK,aAAa,QAAQ,CAAC,gBAAgB;AACzC,UAAI,gBAAgB,MAAM;AACxB,WAAG,WAAW;AAAA,MAChB;AAAA,IACF,CAAC;AAAA,EACH;AACF;;;ACpCO,SAAS,cAAc,OAAqB;AACjD,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,SAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEO,SAAS,iBAAiB,SAA0D;AACzF,MAAI,CAAC,SAAS;AACZ,WAAO,CAAC;AAAA,EACV;AAEA,MAAI,mBAAmB,SAAS;AAC9B,UAAMC,cAAqC,CAAC;AAC5C,YAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC9B,MAAAA,YAAW,GAAG,IAAI;AAAA,IACpB,CAAC;AACD,WAAOA;AAAA,EACT;AAEA,MAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,WAAO,QAAQ,OAA+B,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM;AACnE,UAAI,GAAG,IAAI;AACX,aAAO;AAAA,IACT,GAAG,CAAC,CAAC;AAAA,EACP;AAEA,QAAM,aAAqC,CAAC;AAC5C,SAAO,QAAQ,OAAqD,EAAE;AAAA,IACpE,CAAC,CAAC,KAAK,KAAK,MAAM;AAChB,YAAM,kBAAkB,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,GAAG,IAAI;AACjE,iBAAW,GAAG,IAAI;AAAA,IACpB;AAAA,EACF;AACA,SAAO;AACT;;;ACzBO,IAAM,YAAN,MAAM,mBAAkB,MAAM;AAAA,EACnB,cAAuB;AAAA,EAChC;AAAA,EACA;AAAA,EAEP,YACE,UACA,QACA,SACA,SACA;AACA,UAAM,WAAW,8BAA8B,UAAU,UAAU,SAAS,IAAI,OAAO;AACvF,SAAK,OAAO;AACZ,SAAK,WAAW;AAChB,SAAK,SAAS,eAAe,MAAM;AACnC,WAAO,eAAe,MAAM,WAAU,SAAS;AAAA,EACjD;AACF;AAiEA,SAAS,eAAe,QAA0C;AAChE,QAAM,EAAE,SAAS,GAAG,KAAK,IAAI;AAE7B,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,gBAAgB,OAAO;AAAA,EAClC;AACF;AAOA,SAAS,gBAAgB,SAAsE;AAC7F,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,iBAAiB,OAAO;AAC3C,QAAM,YAAoC,CAAC;AAE3C,QAAM,mBAAmB,CAAC,iBAAiB,aAAa,UAAU,UAAU;AAE5E,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACrD,UAAM,WAAW,IAAI,YAAY;AACjC,QAAI,iBAAiB,SAAS,QAAQ,GAAG;AACvC,gBAAU,GAAG,IAAI;AAAA,IACnB,OAAO;AACL,gBAAU,GAAG,IAAI;AAAA,IACnB;AAAA,EACF;AAEA,SAAO;AACT;;;AC5EO,IAAM,aAAN,MAAiB;AAAA,EACd;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAID,eAAe;AAAA,IACpB,SAAS,IAAI,mBAAuC;AAAA,IACpD,UAAU,IAAI,mBAAwC;AAAA,EACxD;AAAA,EAEA,YAAY,QAA2B;AACrC,UAAM,EAAE,UAAU,UAAU,iBAAiB,GAAG,WAAW,IAAI,UAAU,CAAC;AAE1E,SAAK,gBAAgB;AAAA,MACnB,SAAS;AAAA,MACT,GAAG;AAAA,IACL;AAGA,UAAM,aAAa,UAAU,cAAc;AAC3C,SAAK,iBAAiB;AAAA,MACpB,kBAAkB,aAAa,CAAC,SAAS,QAAQ,IAAI;AAAA,MACrD,iBAAiB,aAAa,KAAK,OAAO,OAAO;AAAA;AAAA,MACjD;AAAA,MACA,GAAG;AAAA,IACL;AAEA,SAAK,+BAA+B,iBAAiB,OAAO;AAE5D,QAAI,UAAU,SAAS;AACrB,UAAI,CAAC,KAAK,cAAc,SAAS;AAC/B,aAAK,cAAc,UAAU,uBAAuB,QAAQ;AAAA,MAC9D;AACA,6BAAuB,KAAK,cAAc,QAAQ;AAAA,IACpD;AAEA,SAAK,gCAAgC,iBAAiB,QAAQ;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IAAI,KAAa,QAA2C;AAChE,WAAO,KAAK,QAAQ,EAAE,GAAG,QAAQ,KAAK,QAAQ,MAAM,CAAC;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,KAAK,KAAa,MAAY,QAA2C;AAC7E,UAAM,UAAkC,EAAE,GAAG,QAAQ,QAAQ;AAC7D,QAAI,OAAY;AAEhB,QAAI,cAAc,IAAI,GAAG;AACvB,aAAO,KAAK,UAAU,IAAI;AAC1B,UAAI,CAAC,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,IAAI,YAAY,MAAM,cAAc,GAAG;AAC7E,gBAAQ,cAAc,IAAI;AAAA,MAC5B;AAAA,IACF;AAEA,WAAO,KAAK,QAAQ;AAAA,MAClB,GAAG;AAAA,MACH;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IAAI,KAAa,MAAY,QAA2C;AAC5E,UAAM,UAAkC,EAAE,GAAG,QAAQ,QAAQ;AAC7D,QAAI,OAAY;AAEhB,QAAI,cAAc,IAAI,GAAG;AACvB,aAAO,KAAK,UAAU,IAAI;AAC1B,UAAI,CAAC,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,IAAI,YAAY,MAAM,cAAc,GAAG;AAC7E,gBAAQ,cAAc,IAAI;AAAA,MAC5B;AAAA,IACF;AAEA,WAAO,KAAK,QAAQ;AAAA,MAClB,GAAG;AAAA,MACH;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAO,KAAa,QAA2C;AACnE,WAAO,KAAK,QAAQ,EAAE,GAAG,QAAQ,KAAK,QAAQ,SAAS,CAAC;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAM,KAAa,MAAY,QAA2C;AAC9E,UAAM,UAAkC,EAAE,GAAG,QAAQ,QAAQ;AAC7D,QAAI,OAAY;AAEhB,QAAI,cAAc,IAAI,GAAG;AACvB,aAAO,KAAK,UAAU,IAAI;AAC1B,UAAI,CAAC,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,IAAI,YAAY,MAAM,cAAc,GAAG;AAC7E,gBAAQ,cAAc,IAAI;AAAA,MAC5B;AAAA,IACF;AAEA,WAAO,KAAK,QAAQ;AAAA,MAClB,GAAG;AAAA,MACH;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAQ,QAA0C;AAGtD,UAAM,cAAc,iBAAiB,KAAK,cAAc,OAAO;AAC/D,UAAM,kBAAkB,iBAAiB,OAAO,OAAO;AACvD,UAAM,eAA+D,CAAC;AAEtE,eAAW,OAAO,aAAa;AAC7B,mBAAa,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,YAAY,GAAG,EAAE;AAAA,IACnE;AACA,eAAW,OAAO,iBAAiB;AACjC,mBAAa,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,gBAAgB,GAAG,EAAE;AAAA,IACvE;AAEA,UAAM,eAAuC,CAAC;AAC9C,eAAW,YAAY,cAAc;AACnC,YAAM,EAAE,KAAK,MAAM,IAAI,aAAa,QAAQ;AAC5C,mBAAa,GAAG,IAAI;AAAA,IACtB;AAEA,QAAI,eAA8B;AAAA,MAChC,GAAG,KAAK;AAAA,MACR,GAAG;AAAA,MACH,SAAS;AAAA,IACX;AAGA,QAAI;AACF,qBAAe,MAAM,KAAK,uBAAuB,YAAY;AAAA,IAC/D,SAAS,OAAO;AACd,aAAO,QAAQ,OAAO,KAAK;AAAA,IAC7B;AAGA,iBAAa,UAAU,iBAAiB,aAAa,OAAO;AAG5D,UAAM,UAAU,KAAK,SAAS,aAAa,KAAM,aAAa,MAAM;AAGpE,UAAM,UAAU,aAAa,WAAW,KAAK,cAAc,WAAW;AACtE,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,YAAY,WAAW,MAAM,WAAW,MAAM,GAAG,OAAO;AAG9D,UAAM,iBAAiB,aAAa;AACpC,QAAI,gBAAgB;AAElB,UAAI,eAAe,SAAS;AAC1B,qBAAa,SAAS;AACtB,mBAAW,MAAM;AAAA,MACnB,OAAO;AAEL,uBAAe,iBAAiB,SAAS,MAAM,WAAW,MAAM,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,MACnF;AAAA,IACF;AAGA,UAAM,EAAE,cAAc,QAAQ,SAAS,UAAU,SAAS,KAAK,GAAG,aAAa,IAAI;AAEnF,QAAI;AAEF,YAAM,WAAW,MAAM,MAAM,SAAS;AAAA,QACpC,GAAG;AAAA,QACH,QAAQ,WAAW;AAAA;AAAA,MACrB,CAAC;AAED,mBAAa,SAAS;AAGtB,UAAI,KAAK,eAAe,kBAAkB,GAAG;AAC3C,cAAM,gBAAgB,SAAS,QAAQ,IAAI,gBAAgB;AAC3D,YAAI,eAAe;AACjB,gBAAM,OAAO,SAAS,eAAe,EAAE;AACvC,cAAI,OAAO,KAAK,eAAe,iBAAiB;AAC9C,kBAAM,IAAI;AAAA,cACR,iBAAiB,IAAI,2BAA2B,KAAK,eAAe,eAAe;AAAA,YACrF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAGA,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,QAAQ,IAAI,UAAU,UAAU,YAAY;AAClD,eAAO,KAAK,wBAAwB,QAAQ,OAAO,KAAK,CAAC;AAAA,MAC3D;AAGA,aAAO,KAAK,wBAAwB,QAAQ,QAAQ,QAAQ,CAAC;AAAA,IAC/D,SAAS,OAAO;AACd,mBAAa,SAAS;AAGtB,YAAM,YACJ,iBAAiB,YACb,QACA,IAAI;AAAA,QACJ;AAAA,QACA;AAAA,QACA,mBAAmB,OAAO,gBAAgB,UAAU,SAAY,OAAO;AAAA,QACvE,EAAE,OAAO,MAAM;AAAA,MACjB;AAEJ,aAAO,KAAK,wBAAwB,QAAQ,OAAO,SAAS,CAAC;AAAA,IAC/D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,+BAA+B,cAAqC;AAC1E,QAAI,CAAC,cAAc,QAAQ;AACzB;AAAA,IACF;AAEA,eAAW,eAAe,cAAc;AACtC,WAAK,aAAa,QAAQ;AAAA,QACxB,YAAY;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,gCAAgC,cAAsC;AAC5E,QAAI,CAAC,cAAc,QAAQ;AACzB;AAAA,IACF;AAEA,eAAW,eAAe,cAAc;AACtC,WAAK,aAAa,SAAS;AAAA,QACzB,YAAY;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,uBAAuB,QAA+C;AAC5E,QAAI,UAAkC,QAAQ,QAAQ,MAAM;AAE5D,UAAM,eAAqC,CAAC;AAC5C,SAAK,aAAa,QAAQ,QAAQ,CAAC,gBAAgB;AACjD,mBAAa,KAAK,WAAW;AAAA,IAC/B,CAAC;AAED,eAAW,eAAe,cAAc;AACtC,gBAAU,QAAQ;AAAA,QAChB,YAAY;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,wBACZ,SACmB;AACnB,QAAI,iBAAiB;AAGrB,UAAM,eAAsC,CAAC;AAC7C,SAAK,aAAa,SAAS,QAAQ,CAAC,gBAAgB;AAClD,mBAAa,KAAK,WAAW;AAAA,IAC/B,CAAC;AAED,eAAW,eAAe,cAAc;AACtC,uBAAiB,eAAe;AAAA,QAC9B,YAAY;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,SAAS,KAAa,QAAsC;AAClE,UAAM,UAAU,KAAK,cAAc;AAKnC,QAAI;AACJ,QAAI,CAAC,WAAW,gBAAgB,KAAK,GAAG,GAAG;AACzC,oBAAc;AAAA,IAChB,OAAO;AACL,oBAAc,QAAQ,QAAQ,QAAQ,EAAE,IAAI,MAAM,IAAI,QAAQ,QAAQ,EAAE;AAAA,IAC1E;AAEA,UAAM,UAAU,IAAI,IAAI,WAAW;AAGnC,UAAM,EAAE,iBAAiB,IAAI,KAAK;AAClC,QAAI,oBAAoB,CAAC,iBAAiB,SAAS,QAAQ,QAAQ,GAAG;AACpE,YAAM,IAAI;AAAA,QACR,YAAY,QAAQ,QAAQ,6BAA6B,iBAAiB,KAAK,IAAI,CAAC;AAAA,MACtF;AAAA,IACF;AAGA,QAAI,QAAQ;AACV,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,YAAI,UAAU,UAAa,UAAU,KAAM;AAC3C,gBAAQ,aAAa,IAAI,KAAK,OAAO,KAAK,CAAC;AAAA,MAC7C;AAAA,IACF;AAEA,WAAO,QAAQ;AAAA,EACjB;AACF;AAMA,SAAS,mBAAmB,OAAgB,SAA0B;AACpE,QAAM,MAAM;AACZ,MAAI,KAAK,SAAS,cAAc;AAC9B,WAAO,UAAU,yBAAyB,OAAO,OAAO;AAAA,EAC1D;AAEA,QAAM,SAAS,CAAC,KAAK,OAAO,MAAM,KAAK,OAAO,OAAO,EAClD,OAAO,OAAO,EACd,KAAK,IAAI,EACT,QAAQ,QAAQ,GAAG,EACnB,KAAK;AACR,QAAM,UAAU,KAAK,WAAW,OAAO,KAAK;AAC5C,SAAO,SAAS,GAAG,OAAO,KAAK,MAAM,MAAM;AAC7C;","names":["headers","normalized"]}
1	+ {"version":3,"sources":["../src/helper/jwt.ts","../src/helper/jwt-manager.ts","../src/helper/file-token-provider.ts","../src/plugins/platform-plugin.ts","../src/core/InterceptorManager.ts","../src/core/utils.ts","../src/core/types.ts","../src/core/HttpClient.ts"],"sourcesContent":["import { createHmac, randomUUID, timingSafeEqual } from 'crypto';\n\nexport interface CustomClaims {\n tenant_id?: string;\n user_id?: string;\n app_id?: string;\n app_env?: string;\n sandbox_id?: string;\n access_key: string;\n}\n\nexport interface JWTClaims extends CustomClaims {\n iss: string;\n iat: number;\n nbf: number;\n exp: number;\n jti: string;\n [key: string]: any;\n}\n\nexport interface JWTConfig {\n accessKey: string;\n secretKey: string;\n expireTimeMs: number;\n}\n\nexport interface JWTVerifyOptions {\n /*\n 时钟容差（秒），用于处理服务器时间不同步的情况\n * 默认 60 秒\n /\n clockTolerance?: number;\n\n /\n 是否跳过过期验证（仅用于调试）\n * 默认 false\n /\n skipExpiration?: boolean;\n}\n\nexport const DEFAULT_JWT_EXPIRE_TIME_MS = 30 60 * 1000;\nexport const DEFAULT_CLOCK_TOLERANCE_SEC = 60;\n\nconst JWT_HEADER = {\n alg: 'HS256',\n typ: 'JWT',\n};\n\nexport function generateJWTToken(\n customClaims: CustomClaims,\n config: JWTConfig,\n): string {\n const nowSeconds = Math.floor(Date.now() / 1000);\n const payload: JWTClaims = {\n ...customClaims,\n iss: customClaims.access_key,\n iat: nowSeconds,\n nbf: nowSeconds,\n exp: nowSeconds + Math.floor(config.expireTimeMs / 1000),\n jti: randomUUID(),\n };\n\n const encodedHeader = base64UrlEncode(JSON.stringify(JWT_HEADER));\n const encodedPayload = base64UrlEncode(JSON.stringify(payload));\n const signature = sign(`${encodedHeader}.${encodedPayload}`, config.secretKey);\n\n return `${encodedHeader}.${encodedPayload}.${signature}`;\n}\n\nexport function parseJWTTokenWithVerify(\n tokenString: string,\n config: JWTConfig,\n options?: JWTVerifyOptions,\n): JWTClaims {\n const segments = tokenString.split('.');\n if (segments.length !== 3) {\n throw new Error('invalid JWT token format');\n }\n\n const [encodedHeader, encodedPayload, signature] = segments;\n\n // 1. 验证 header\n const headerJson = JSON.parse(base64UrlDecode(encodedHeader));\n if (headerJson.alg !== 'HS256') {\n throw new Error('unsupported JWT alg');\n }\n\n // 2. 验证签名\n const expectedSignature = sign(`${encodedHeader}.${encodedPayload}`, config.secretKey);\n\n const expectedBuffer = Buffer.from(expectedSignature);\n const signatureBuffer = Buffer.from(signature);\n if (\n expectedBuffer.length !== signatureBuffer.length \|\|\n !timingSafeEqual(expectedBuffer, signatureBuffer)\n ) {\n throw new Error('JWT signature verification failed');\n }\n\n // 3. 解析 payload\n const payload = JSON.parse(base64UrlDecode(encodedPayload)) as JWTClaims;\n\n // 4. 验证时间声明\n if (!options?.skipExpiration) {\n const clockTolerance = options?.clockTolerance ?? DEFAULT_CLOCK_TOLERANCE_SEC;\n const now = Math.floor(Date.now() / 1000);\n\n // 验证 exp (过期时间)\n if (payload.exp !== undefined) {\n if (payload.exp + clockTolerance < now) {\n throw new Error(\n `JWT token expired at ${new Date(payload.exp * 1000).toISOString()}`,\n );\n }\n }\n\n // 验证 nbf (生效时间)\n if (payload.nbf !== undefined) {\n if (payload.nbf - clockTolerance > now) {\n throw new Error(\n `JWT token not yet valid, will be valid at ${new Date(payload.nbf * 1000).toISOString()}`,\n );\n }\n }\n\n // 验证 iat (签发时间) - 防止未来时间的 token\n if (payload.iat !== undefined) {\n if (payload.iat - clockTolerance > now) {\n throw new Error(\n `JWT token issued in the future at ${new Date(payload.iat * 1000).toISOString()}`,\n );\n }\n }\n }\n\n return payload;\n}\n\nfunction sign(input: string, secret: string): string {\n return createHmac('sha256', secret)\n .update(input)\n .digest('base64')\n .replace(/=/g, '')\n .replace(/\\+/g, '-')\n .replace(/\\//g, '_');\n}\n\nfunction base64UrlEncode(input: string): string {\n return Buffer.from(input)\n .toString('base64')\n .replace(/=/g, '')\n .replace(/\\+/g, '-')\n .replace(/\\//g, '_');\n}\n\nfunction base64UrlDecode(input: string): string {\n const padLength = (4 - (input.length % 4 \|\| 4)) % 4;\n const padded = `${input}${'='.repeat(padLength)}`\n .replace(/-/g, '+')\n .replace(/_/g, '/');\n return Buffer.from(padded, 'base64').toString('utf8');\n}\n","import { CustomClaims, JWTConfig, generateJWTToken } from './jwt';\n\n/*\n Token 来源的最小抽象。`platform-plugin` 用它做 primary / fallback 链\n * (env token 优先,sk 自签兜底)。`JWTTokenManager`(下方)和 `StaticTokenSource`\n * (本文件底部)都实现这个接口。\n /\nexport interface TokenSource {\n /\n 拿一个可用的 token(用作 Authorization Bearer)。拿不到必须抛 —— 调用方据此决定走 fallback。\n * 不要返回空串 / null,会让上层 `if (token)` 误判通过。\n /\n getToken(claims: CustomClaims): string;\n}\n\ninterface CachedToken {\n token: string;\n expiresAtMs: number;\n}\n\ninterface JWTManagerConfig extends JWTConfig {\n /\n 在过期前多久刷新 token（毫秒）\n * 默认 5 分钟\n /\n refreshBeforeMs?: number;\n}\n\n/\n JWT Token 管理器，负责 token 的生成、缓存和自动刷新\n \n 缓存策略：\n * - 基于 claims 的哈希值作为缓存 key（支持多租户+多用户）\n * - 在 token 过期前 refreshBeforeMs 时间内自动刷新\n \n @example\n * ```typescript\n * const manager = new JWTTokenManager({\n * accessKey: 'your-access-key',\n * secretKey: 'your-secret-key',\n * expireTimeMs: 30 * 60 * 1000,\n * refreshBeforeMs: 5 * 60 * 1000,\n * });\n \n // 获取 token（会自动缓存）\n * const token = manager.getToken({\n * access_key: 'your-access-key',\n * tenant_id: '1001',\n * user_id: 'user123',\n * });\n * ```\n /\nexport class JWTTokenManager {\n private cache = new Map<string, CachedToken>();\n private config: Required<JWTManagerConfig>;\n\n constructor(config: JWTManagerConfig) {\n this.config = {\n refreshBeforeMs: 5 60 * 1000, // 默认 5 分钟\n ...config,\n };\n }\n\n /*\n 获取 JWT token，优先使用缓存\n \n 如果缓存的 token 即将过期（距离过期时间小于 refreshBeforeMs），\n * 则会生成新的 token 并更新缓存\n \n @param claims - JWT claims\n * @returns JWT token 字符串\n /\n getToken(claims: CustomClaims): string {\n const cacheKey = this.getCacheKey(claims);\n const cached = this.cache.get(cacheKey);\n const now = Date.now();\n\n // 检查缓存是否有效（未过期且不需要刷新）\n if (cached && cached.expiresAtMs - now > this.config.refreshBeforeMs) {\n return cached.token;\n }\n\n // 生成新 token\n const token = generateJWTToken(claims, this.config);\n const expiresAtMs = now + this.config.expireTimeMs;\n\n this.cache.set(cacheKey, { token, expiresAtMs });\n\n return token;\n }\n\n /\n 清除所有缓存的 token\n /\n clearCache(): void {\n this.cache.clear();\n }\n\n /\n 清除特定 claims 的缓存\n \n @param claims - 要清除的 claims\n /\n clearCacheFor(claims: CustomClaims): void {\n const cacheKey = this.getCacheKey(claims);\n this.cache.delete(cacheKey);\n }\n\n /\n 生成缓存 key（基于关键的 claims 字段）\n \n 使用稳定的字段顺序确保相同 claims 生成相同 key\n \n @private\n /\n private getCacheKey(claims: CustomClaims): string {\n // 使用稳定的字段顺序确保相同 claims 生成相同 key\n const parts = [\n claims.access_key,\n claims.tenant_id \|\| '',\n claims.user_id \|\| '',\n claims.app_id \|\| '',\n claims.app_env \|\| '',\n claims.sandbox_id \|\| '',\n ];\n return parts.join(':');\n }\n\n /\n 获取缓存统计信息（用于监控和调试）\n \n @returns 缓存统计信息\n /\n getCacheStats() {\n const now = Date.now();\n let validCount = 0;\n let expiredCount = 0;\n\n for (const cached of this.cache.values()) {\n if (cached.expiresAtMs > now) {\n validCount++;\n } else {\n expiredCount++;\n }\n }\n\n return {\n total: this.cache.size,\n valid: validCount,\n expired: expiredCount,\n };\n }\n}\n\n/\n 平台直接派发的静态 token(短期凭据,默认 5 天有效,当前实现为 JWT 但对调用方不透明),\n * client 不签也不刷,拿到啥就用啥。过期了 server 端会 401,由 platform-plugin 的 fallback 链\n * 退到 sk 自签(JWTTokenManager)。\n \n 用于 §2.2 InnerAPI 鉴权 — ak/sk → token + ak 演进:\n * `.env.local` 仅注入 token(不再下发 sk),消除 sk 长期落地的泄漏面。\n /\nexport class StaticTokenSource implements TokenSource {\n constructor(private readonly token: string) {\n if (!token) {\n throw new Error('StaticTokenSource: token 不能为空');\n }\n }\n\n getToken(_claims: CustomClaims): string {\n return this.token;\n }\n}\n","import { readFileSync } from 'fs';\n\ninterface CachedFileToken {\n token: string;\n accessKey: string;\n expiresAtMs: number;\n}\n\nexport interface FileTokenProviderConfig {\n paths?: string[];\n refreshBeforeMs?: number;\n}\n\nconst DEFAULT_REFRESH_BEFORE_MS = 5 60 * 1000;\nconst DEFAULT_TOKEN_PATHS = [\n '/home/gem/workspace/.force/openclaw/miaoda-provider-key',\n];\n\n/*\n 从文件读取 JWT Token 的 Provider\n \n 支持多路径优先级链：按顺序尝试读取，命中第一个有效 token 即返回。\n * 缓存策略基于 token 自身的 exp 字段，在过期前 refreshBeforeMs 窗口内重新读取文件。\n \n @example\n * ```typescript\n * const provider = new FileTokenProvider({\n * paths: ['/path/a/token', '/path/b/token'],\n * refreshBeforeMs: 5 * 60 * 1000,\n * });\n \n const result = provider.getToken();\n * if (result) {\n * console.log(result.token, result.accessKey);\n * }\n * ```\n /\nexport class FileTokenProvider {\n private cache = new Map<string, CachedFileToken>();\n private paths: string[];\n private refreshBeforeMs: number;\n\n constructor(config?: FileTokenProviderConfig) {\n this.paths = config?.paths ?? DEFAULT_TOKEN_PATHS;\n this.refreshBeforeMs = config?.refreshBeforeMs ?? DEFAULT_REFRESH_BEFORE_MS;\n }\n\n /\n 获取 token，按路径优先级依次尝试\n \n 1. 缓存有效且不在刷新窗口 → 直接返回\n * 2. 进入刷新窗口 → 重读文件，更新缓存\n * 3. 文件未更新但缓存未过期 → 仍返回旧缓存\n * 4. 所有路径均无有效 token → 返回 null\n /\n getToken(): { token: string; accessKey: string } \| null {\n const now = Date.now();\n\n for (const filePath of this.paths) {\n const cached = this.cache.get(filePath);\n\n // 缓存命中且不在刷新窗口\n if (cached && cached.expiresAtMs - now > this.refreshBeforeMs) {\n return { token: cached.token, accessKey: cached.accessKey };\n }\n\n // 需要读取/重读文件\n const result = this.readAndParse(filePath);\n if (result) {\n this.cache.set(filePath, result);\n if (result.expiresAtMs > now) {\n return { token: result.token, accessKey: result.accessKey };\n }\n }\n\n // 文件未更新，但缓存的 token 仍未过期\n if (cached && cached.expiresAtMs > now) {\n return { token: cached.token, accessKey: cached.accessKey };\n }\n }\n\n return null;\n }\n\n clearCache(): void {\n this.cache.clear();\n }\n\n private readAndParse(filePath: string): CachedFileToken \| null {\n try {\n const token = readFileSync(filePath, 'utf-8').trim();\n if (!token) return null;\n\n const payload = this.decodePayload(token);\n if (!payload?.exp) return null;\n\n return {\n token,\n accessKey: payload.access_key ?? '',\n expiresAtMs: payload.exp 1000,\n };\n } catch {\n return null;\n }\n }\n\n private decodePayload(token: string): Record<string, any> \| null {\n try {\n const segments = token.split('.');\n if (segments.length !== 3) return null;\n\n const padLength = (4 - (segments[1].length % 4 \|\| 4)) % 4;\n const padded = `${segments[1]}${'='.repeat(padLength)}`\n .replace(/-/g, '+')\n .replace(/_/g, '/');\n\n return JSON.parse(Buffer.from(padded, 'base64').toString('utf8'));\n } catch {\n return null;\n }\n }\n}\n","import type { RequestConfig, RequestInterceptor } from '../core/types';\nimport {\n DEFAULT_JWT_EXPIRE_TIME_MS,\n CustomClaims,\n} from '../helper/jwt';\nimport { JWTTokenManager, StaticTokenSource } from '../helper/jwt-manager';\nimport { FileTokenProvider } from '../helper/file-token-provider';\n\nexport type PlatformClaims = Omit<CustomClaims, 'access_key'>;\n\nexport interface TokenProviderConfig {\n type: 'file';\n paths?: string[];\n}\n\nexport interface PlatformPluginOptions {\n enabled?: boolean;\n baseURL?: string;\n domainEnv?: string;\n accessKeyEnv?: string;\n secretKeyEnv?: string;\n accessKey?: string;\n secretKey?: string;\n expireTimeMs?: number;\n refreshBeforeMs?: number;\n defaultClaims?: PlatformClaims;\n /*\n 平台直接派发的静态 token（短期凭据，默认 5 天有效，当前实现为 JWT）。配置后：\n * - 优先用此 token 调 InnerAPI（不再用 sk 自签），消除 sk 长期落地的泄漏面\n * - 若同时配置了 sk（accessKey/secretKey 或对应 env），sk 自签作为最终 fallback\n * 优先级：`token` option > `process.env[tokenEnv ?? 'FORCE_AUTHN_TOKEN']`\n * 与 `tokenProvider`（文件 token）共存：fileToken > envToken > sk 自签。\n /\n token?: string;\n tokenEnv?: string;\n /\n 管理端 innerapi 链路（仅用于妙搭开发态）\n * 启用后：\n * - baseURL 改从 adminDomainEnv（默认 MIAODA_DEV_INNER_DOMAIN_WITH_PREFIX）读取\n * - 每次请求从 clientTokenEnv（默认 MIAODA_AUTHN_CODE）读取用户凭证，\n * 注入为 X-Miaoda-Client-Token 请求头（读不到则不注入）\n * - AK/SK 的 Authorization + x-api-key 照旧\n /\n adminInnerApi?: boolean;\n adminDomainEnv?: string;\n clientTokenEnv?: string;\n tokenProvider?: TokenProviderConfig;\n}\n\nexport interface PlatformRequestAuthConfig {\n customClaims?: PlatformClaims;\n}\n\nconst DEFAULT_DOMAIN_ENV = 'FORCE_AUTHN_INNERAPI_DOMAIN';\nconst DEFAULT_ACCESS_KEY_ENV = 'FORCE_AUTHN_ACCESS_KEY';\nconst DEFAULT_SECRET_KEY_ENV = 'FORCE_AUTHN_ACCESS_SECRET';\nconst DEFAULT_TOKEN_ENV = 'FORCE_AUTHN_TOKEN';\nconst DEFAULT_ADMIN_DOMAIN_ENV = 'MIAODA_DEV_INNER_DOMAIN_WITH_PREFIX';\nconst DEFAULT_CLIENT_TOKEN_ENV = 'MIAODA_AUTHN_CODE';\nconst MIAODA_CLIENT_TOKEN_HEADER = 'X-Miaoda-Client-Token';\n\nexport function resolvePlatformBaseURL(options?: PlatformPluginOptions): string \| undefined {\n if (!options?.enabled) {\n return options?.baseURL;\n }\n\n if (options.baseURL) {\n return options.baseURL;\n }\n\n const envName = options.adminInnerApi\n ? (options.adminDomainEnv \|\| DEFAULT_ADMIN_DOMAIN_ENV)\n : (options.domainEnv \|\| DEFAULT_DOMAIN_ENV);\n const domain = process.env[envName];\n if (!domain) {\n throw new Error(`平台模式需要基础域名，请设置环境变量 ${envName}`);\n }\n return domain;\n}\n\ntype RequestInterceptorManager = {\n use: (\n onFulfilled?: RequestInterceptor['onFulfilled'],\n onRejected?: RequestInterceptor['onRejected'],\n ) => number;\n eject: (id: number) => void;\n};\n\ninterface InterceptorHost {\n request: RequestInterceptorManager;\n}\n\nexport function registerPlatformPlugin(\n interceptors: InterceptorHost,\n options: PlatformPluginOptions,\n): JWTTokenManager \| undefined {\n if (!options.enabled) {\n return undefined;\n }\n\n ensureNoAccessKeyOverride('platform.defaultClaims', options.defaultClaims);\n\n // 创建文件 token provider（如果配置了）\n let fileTokenProvider: FileTokenProvider \| undefined;\n if (options.tokenProvider?.type === 'file') {\n fileTokenProvider = new FileTokenProvider({\n paths: options.tokenProvider.paths,\n refreshBeforeMs: options.refreshBeforeMs,\n });\n }\n\n // 提前检查 AK/SK，避免每次请求时检查\n const accessKeyEnv = options.accessKeyEnv \|\| DEFAULT_ACCESS_KEY_ENV;\n const secretKeyEnv = options.secretKeyEnv \|\| DEFAULT_SECRET_KEY_ENV;\n\n const accessKey = options.accessKey ?? (process.env[accessKeyEnv] \|\| '');\n const secretKey = options.secretKey ?? (process.env[secretKeyEnv] \|\| '');\n\n const expireTimeMs = options.expireTimeMs ?? DEFAULT_JWT_EXPIRE_TIME_MS;\n\n // 创建 JWT Token Manager（支持缓存和自动刷新，同时作为 fallback）\n const tokenManager = new JWTTokenManager({\n accessKey,\n secretKey,\n expireTimeMs,\n refreshBeforeMs: options.refreshBeforeMs,\n });\n\n // 平台派发的静态 token（可选；有则在 fileToken 之后、sk 自签之前用，消除 sk 长期落地的泄漏面）\n const tokenEnv = options.tokenEnv \|\| DEFAULT_TOKEN_ENV;\n const platformToken = options.token ?? (process.env[tokenEnv] \|\| '');\n const staticTokenSource = platformToken ? new StaticTokenSource(platformToken) : null;\n\n const clientTokenEnv = options.clientTokenEnv \|\| DEFAULT_CLIENT_TOKEN_ENV;\n\n // 注册请求拦截器\n interceptors.request.use((config: RequestConfig) => {\n // 优先尝试文件 token\n if (fileTokenProvider) {\n const fileToken = fileTokenProvider.getToken();\n if (fileToken) {\n const headers = {\n ...(config.headers as Record<string, string>),\n 'Authorization': `Bearer ${fileToken.token}`,\n 'x-api-key': fileToken.accessKey,\n };\n return { ...config, headers };\n }\n }\n\n ensureNoAccessKeyOverride('request.platformAuth.customClaims', config.platformAuth?.customClaims);\n\n const claims: CustomClaims = {\n ...(options.defaultClaims \|\| {}),\n ...(config.platformAuth?.customClaims \|\| {}),\n access_key: accessKey,\n };\n\n // 次选 envToken（FORCE_AUTHN_TOKEN env / options.token）—— 短期凭据,跟 fileToken 同样\n // 替代 sk 长期落地。envToken 拿到才用,拿不到继续往下退到 sk 自签。\n // 注:StaticTokenSource.getToken 当前实现是直接返回构造时传入的 token,不会抛 —— 即便将来\n // 改成可能抛的实现(比如带过期校验),也走 sk 自签 fallback。\n let token: string;\n if (staticTokenSource) {\n try {\n token = staticTokenSource.getToken(claims);\n } catch {\n token = tokenManager.getToken(claims);\n }\n } else {\n token = tokenManager.getToken(claims);\n }\n\n // 统一使用 Record<string, string> 类型，由 client.ts 的 normalizeHeaders 处理\n const headers: Record<string, string> = {\n ...(config.headers as Record<string, string>),\n 'Authorization': `Bearer ${token}`,\n 'x-api-key': accessKey,\n };\n\n // 管理端 innerapi：运行时读取用户凭证并注入\n if (options.adminInnerApi) {\n const clientToken = process.env[clientTokenEnv];\n if (clientToken) {\n headers[MIAODA_CLIENT_TOKEN_HEADER] = clientToken;\n }\n }\n\n return {\n ...config,\n headers,\n };\n });\n\n return tokenManager;\n}\n\nfunction ensureNoAccessKeyOverride(name: string, claims?: PlatformClaims) {\n if (claims && Object.prototype.hasOwnProperty.call(claims, 'access_key')) {\n throw new Error(`${name} 不允许设置 access_key`);\n }\n}\n","/\n 拦截器管理器（模仿 Axios 的 InterceptorManager）\n /\nexport class InterceptorManager<T> {\n private interceptors: (T \| null)[] = [];\n\n /\n 添加拦截器\n * @returns 拦截器 ID，用于后续移除\n /\n use(onFulfilled?: any, onRejected?: any): number {\n this.interceptors.push({ onFulfilled, onRejected } as T);\n return this.interceptors.length - 1;\n }\n\n /\n 移除拦截器\n /\n eject(id: number): void {\n if (this.interceptors[id]) {\n this.interceptors[id] = null;\n }\n }\n\n /\n 清空所有拦截器\n /\n clear(): void {\n this.interceptors = [];\n }\n\n /\n 遍历所有拦截器\n /\n forEach(fn: (interceptor: T) => void): void {\n this.interceptors.forEach((interceptor) => {\n if (interceptor !== null) {\n fn(interceptor);\n }\n });\n }\n}\n","/\n Checks if a value is a plain object.\n * @param value The value to check.\n * @returns True if the value is a plain object, false otherwise.\n /\nexport function isPlainObject(value: any): boolean {\n if (typeof value !== 'object' \|\| value === null) {\n return false;\n }\n const proto = Object.getPrototypeOf(value);\n return proto === Object.prototype \|\| proto === null;\n}\n\nexport function normalizeHeaders(headers?: RequestInit['headers']): Record<string, string> {\n if (!headers) {\n return {};\n }\n\n if (headers instanceof Headers) {\n const normalized: Record<string, string> = {};\n headers.forEach((value, key) => {\n normalized[key] = value;\n });\n return normalized;\n }\n\n if (Array.isArray(headers)) {\n return headers.reduce<Record<string, string>>((acc, [key, value]) => {\n acc[key] = value;\n return acc;\n }, {});\n }\n\n const normalized: Record<string, string> = {};\n Object.entries(headers as Record<string, string \| readonly string[]>).forEach(\n ([key, value]) => {\n const normalizedValue = Array.isArray(value) ? value.join(',') : value;\n normalized[key] = normalizedValue as string;\n },\n );\n return normalized;\n}\n\n/\n 最终 x-tt-env 是 PPE 泳道（以 `ppe` 开头）且调用方未设置 x-use-ppe 时，补 `x-use-ppe: 1`，\n * 否则请求不会被路由到 PPE。\n \n 按 fetch 实际发出的值判断：大小写不同的多个 x-tt-env 会被拼成 `\"a, b\"`，这里同样拼接后再判断。\n * 值为 undefined / null 的 x-use-ppe 视为未设置，补头时一并去掉，避免与补上的值拼在一起。\n /\nexport function withPpeLaneHeader(headers: Record<string, string>): Record<string, string> {\n const entries = Object.entries(headers) as [string, unknown][];\n const isSet = (value: unknown) => value !== undefined && value !== null;\n const ttEnv = entries\n .filter(([key, value]) => key.toLowerCase() === 'x-tt-env' && isSet(value))\n .map(([, value]) => String(value).trim())\n .join(', ');\n const usePpeKeys = entries.filter(([key]) => key.toLowerCase() === 'x-use-ppe');\n if (!ttEnv.toLowerCase().startsWith('ppe') \|\| usePpeKeys.some(([, value]) => isSet(value))) {\n return headers;\n }\n\n const result = { ...headers };\n for (const [key] of usePpeKeys) {\n delete result[key];\n }\n result['x-use-ppe'] = '1';\n return result;\n}\n","import type { PlatformPluginOptions, PlatformRequestAuthConfig } from '../plugins/platform-plugin';\nimport { normalizeHeaders } from './utils';\n\n/\n 清理后的请求配置（移除敏感信息）\n /\nexport interface SafeRequestConfig extends Omit<RequestConfig, 'headers'> {\n headers?: Record<string, string>; // 已清理的 headers\n}\n\n/\n HTTP 错误对象\n \n 注意：为了安全考虑，error.config 中的敏感 headers (如 Authorization, x-api-key)\n * 会被替换为 '[REDACTED]'\n /\nexport class HttpError extends Error {\n public readonly isHttpError: boolean = true;\n public response: Response \| undefined;\n public config: SafeRequestConfig;\n\n constructor(\n response: Response \| undefined,\n config: RequestConfig,\n message?: string,\n options?: { cause?: unknown },\n ) {\n super(message \|\| `Request failed with status ${response?.status \|\| 'unknown'}`, options);\n this.name = 'HttpError';\n this.response = response;\n this.config = sanitizeConfig(config);\n Object.setPrototypeOf(this, HttpError.prototype);\n }\n}\n\nexport interface RequestConfig extends RequestInit {\n url?: string;\n params?: Record<string, any>;\n timeout?: number;\n baseURL?: string;\n platformAuth?: PlatformRequestAuthConfig;\n}\n\nexport interface SecurityConfig {\n /\n 允许的 URL 协议白名单\n * 默认: null (不限制)\n * 设置为 ['http:', 'https:'] 可限制只允许 HTTP/HTTPS\n /\n allowedProtocols?: string[] \| null;\n\n /\n 最大响应体大小（字节）\n * 默认: 0 (不限制)\n * 设置为正数可限制响应体大小，防止内存耗尽攻击\n /\n maxResponseSize?: number;\n\n /\n 是否启用严格模式（启用所有安全检查）\n * 默认: false\n * 启用后会自动设置：\n * - allowedProtocols = ['http:', 'https:']\n * - maxResponseSize = 50MB\n /\n strictMode?: boolean;\n}\n\nexport interface HttpClientPreInterceptors {\n request?: RequestInterceptor[];\n response?: ResponseInterceptor[];\n}\n\nexport interface HttpClientConfig extends RequestConfig {\n platform?: PlatformPluginOptions;\n security?: SecurityConfig;\n preInterceptors?: HttpClientPreInterceptors;\n}\n\n/\n 请求拦截器函数\n /\nexport type RequestInterceptor = {\n onFulfilled?: (config: RequestConfig) => RequestConfig \| Promise<RequestConfig>;\n onRejected?: (error: any) => any;\n};\n\n/\n 响应拦截器函数（fetch 风格）\n /\nexport type ResponseInterceptor = {\n onFulfilled?: (response: Response) => Response \| Promise<Response>;\n onRejected?: (error: any) => any;\n};\n\n/\n 清理配置中的敏感信息\n /\nfunction sanitizeConfig(config: RequestConfig): SafeRequestConfig {\n const { headers, ...rest } = config;\n\n return {\n ...rest,\n headers: sanitizeHeaders(headers),\n };\n}\n\n/\n 清理敏感 headers\n \n 将 Authorization, x-api-key, cookie 等敏感字段替换为 '[REDACTED]'\n /\nfunction sanitizeHeaders(headers?: RequestInit['headers']): Record<string, string> \| undefined {\n if (!headers) {\n return undefined;\n }\n\n const normalized = normalizeHeaders(headers);\n const sanitized: Record<string, string> = {};\n\n const sensitiveHeaders = ['authorization', 'x-api-key', 'cookie', 'x-secret'];\n\n for (const [key, value] of Object.entries(normalized)) {\n const lowerKey = key.toLowerCase();\n if (sensitiveHeaders.includes(lowerKey)) {\n sanitized[key] = '[REDACTED]';\n } else {\n sanitized[key] = value;\n }\n }\n\n return sanitized;\n}\n","import { registerPlatformPlugin, resolvePlatformBaseURL } from '../plugins/platform-plugin';\nimport { InterceptorManager } from './InterceptorManager';\nimport {\n HttpError,\n type HttpClientConfig,\n type RequestConfig,\n type RequestInterceptor,\n type ResponseInterceptor,\n type SecurityConfig,\n} from './types';\nimport { isPlainObject, normalizeHeaders, withPpeLaneHeader } from './utils';\n\n/\n 技术栈无关的 HTTP 客户端\n \n 设计理念：\n * - 基于原生 fetch API，零依赖\n * - 拦截器模式遵循 Axios 标准，AI 模型和开发者都熟悉\n * - 可在任何 Node.js 环境使用（NestJS, Express, Koa, 纯 Node）\n \n @example\n * ```typescript\n * const client = new HttpClient({\n * baseURL: 'https://api.example.com',\n * timeout: 5000,\n * });\n \n // 添加请求拦截器（类似 Axios）\n * client.interceptors.request.use(\n * config => {\n * config.headers = config.headers \|\| {};\n * config.headers['Authorization'] = 'Bearer token';\n * return config;\n * },\n * error => Promise.reject(error)\n * );\n \n // 添加响应拦截器（类似 Axios）\n * client.interceptors.response.use(\n * response => {\n * console.log('Response:', response.status);\n * return response;\n * },\n * error => {\n * if (error.response?.status === 401) {\n * // 处理未授权\n * }\n * return Promise.reject(error);\n * }\n * );\n \n // 发起请求\n * const response = await client.get('/users');\n * console.log(response.data);\n * ```\n /\nexport class HttpClient {\n private defaultConfig: RequestConfig;\n private securityConfig: Required<SecurityConfig>;\n /\n 拦截器管理器（API 与 Axios 一致）\n /\n public interceptors = {\n request: new InterceptorManager<RequestInterceptor>(),\n response: new InterceptorManager<ResponseInterceptor>(),\n };\n\n constructor(config?: HttpClientConfig) {\n const { platform, security, preInterceptors, ...restConfig } = config \|\| {};\n\n this.defaultConfig = {\n timeout: 5000,\n ...restConfig,\n };\n\n // 初始化安全配置\n const strictMode = security?.strictMode ?? false;\n this.securityConfig = {\n allowedProtocols: strictMode ? ['http:', 'https:'] : null,\n maxResponseSize: strictMode ? 50 1024 * 1024 : 0, // 50MB\n strictMode,\n ...security,\n };\n\n this.registerRequestPreInterceptors(preInterceptors?.request);\n\n if (platform?.enabled) {\n if (!this.defaultConfig.baseURL) {\n this.defaultConfig.baseURL = resolvePlatformBaseURL(platform);\n }\n registerPlatformPlugin(this.interceptors, platform);\n }\n\n this.registerResponsePreInterceptors(preInterceptors?.response);\n }\n\n /*\n GET 请求\n /\n async get(url: string, config?: RequestConfig): Promise<Response> {\n return this.request({ ...config, url, method: 'GET' });\n }\n\n /\n POST 请求\n /\n async post(url: string, data?: any, config?: RequestConfig): Promise<Response> {\n const headers: Record<string, string> = { ...config?.headers } as Record<string, string>;\n let body: any = data;\n\n if (isPlainObject(data)) {\n body = JSON.stringify(data);\n if (!Object.keys(headers).some((key) => key.toLowerCase() === 'content-type')) {\n headers['Content-Type'] = 'application/json';\n }\n }\n\n return this.request({\n ...config,\n url,\n method: 'POST',\n body,\n headers,\n });\n }\n\n /\n PUT 请求\n /\n async put(url: string, data?: any, config?: RequestConfig): Promise<Response> {\n const headers: Record<string, string> = { ...config?.headers } as Record<string, string>;\n let body: any = data;\n\n if (isPlainObject(data)) {\n body = JSON.stringify(data);\n if (!Object.keys(headers).some((key) => key.toLowerCase() === 'content-type')) {\n headers['Content-Type'] = 'application/json';\n }\n }\n\n return this.request({\n ...config,\n url,\n method: 'PUT',\n body,\n headers,\n });\n }\n\n /\n DELETE 请求\n /\n async delete(url: string, config?: RequestConfig): Promise<Response> {\n return this.request({ ...config, url, method: 'DELETE' });\n }\n\n /\n PATCH 请求\n /\n async patch(url: string, data?: any, config?: RequestConfig): Promise<Response> {\n const headers: Record<string, string> = { ...config?.headers } as Record<string, string>;\n let body: any = data;\n\n if (isPlainObject(data)) {\n body = JSON.stringify(data);\n if (!Object.keys(headers).some((key) => key.toLowerCase() === 'content-type')) {\n headers['Content-Type'] = 'application/json';\n }\n }\n\n return this.request({\n ...config,\n url,\n method: 'PATCH',\n body,\n headers,\n });\n }\n\n /\n 核心请求方法（fetch 风格）\n /\n async request(config: RequestConfig): Promise<Response> {\n // 1. 合并配置\n // Perform a case-insensitive header merge that preserves the final key's casing.\n const baseHeaders = normalizeHeaders(this.defaultConfig.headers);\n const overrideHeaders = normalizeHeaders(config.headers);\n const mergedKeyMap: Record<string, { key: string; value: string }> = {};\n\n for (const key in baseHeaders) {\n mergedKeyMap[key.toLowerCase()] = { key, value: baseHeaders[key] };\n }\n for (const key in overrideHeaders) {\n mergedKeyMap[key.toLowerCase()] = { key, value: overrideHeaders[key] };\n }\n\n const finalHeaders: Record<string, string> = {};\n for (const lowerKey in mergedKeyMap) {\n const { key, value } = mergedKeyMap[lowerKey];\n finalHeaders[key] = value;\n }\n\n let mergedConfig: RequestConfig = {\n ...this.defaultConfig,\n ...config,\n headers: finalHeaders,\n };\n\n // 2. 执行请求拦截器\n try {\n mergedConfig = await this.runRequestInterceptors(mergedConfig);\n } catch (error) {\n return Promise.reject(error);\n }\n\n // 3. 统一 normalize headers（拦截器可能返回 Headers 对象），再按最终 x-tt-env 补 PPE 路由头\n mergedConfig.headers = withPpeLaneHeader(normalizeHeaders(mergedConfig.headers));\n\n // 4. 构建完整 URL\n const fullUrl = this.buildUrl(mergedConfig.url!, mergedConfig.params);\n\n // 5. 设置超时和取消\n const timeout = mergedConfig.timeout \|\| this.defaultConfig.timeout \|\| 5000;\n const controller = new AbortController();\n const timeoutId = setTimeout(() => controller.abort(), timeout);\n\n // 监听外部 signal\n const externalSignal = mergedConfig.signal;\n if (externalSignal) {\n // 如果外部 signal 已经终止，立即终止\n if (externalSignal.aborted) {\n clearTimeout(timeoutId);\n controller.abort();\n } else {\n // 使用 { once: true } 避免内存泄漏\n externalSignal.addEventListener('abort', () => controller.abort(), { once: true });\n }\n }\n\n // 6. 准备 fetch 配置（排除自定义字段）\n const { platformAuth, params, timeout: _timeout, baseURL, url, ...fetchOptions } = mergedConfig;\n\n try {\n // 7. 发起请求\n const response = await fetch(fullUrl, {\n ...fetchOptions,\n signal: controller.signal, // 传递我们自己的 controller signal\n });\n\n clearTimeout(timeoutId);\n\n // 安全检查：响应体大小限制\n if (this.securityConfig.maxResponseSize > 0) {\n const contentLength = response.headers.get('content-length');\n if (contentLength) {\n const size = parseInt(contentLength, 10);\n if (size > this.securityConfig.maxResponseSize) {\n throw new Error(\n `Response size ${size} bytes exceeds limit of ${this.securityConfig.maxResponseSize} bytes`\n );\n }\n }\n }\n\n // 检查响应状态\n if (!response.ok) {\n const error = new HttpError(response, mergedConfig);\n return this.runResponseInterceptors(Promise.reject(error));\n }\n\n // 执行响应拦截器（直接返回 Response）\n return this.runResponseInterceptors(Promise.resolve(response));\n } catch (error) {\n clearTimeout(timeoutId);\n\n // 网络错误或超时错误\n const httpError =\n error instanceof HttpError\n ? error\n : new HttpError(\n undefined,\n mergedConfig,\n describeFetchError(error, externalSignal?.aborted ? undefined : timeout),\n { cause: error },\n );\n\n return this.runResponseInterceptors(Promise.reject(httpError));\n }\n }\n\n /\n 注册请求 preInterceptors\n /\n private registerRequestPreInterceptors(interceptors?: RequestInterceptor[]) {\n if (!interceptors?.length) {\n return;\n }\n\n for (const interceptor of interceptors) {\n this.interceptors.request.use(\n interceptor.onFulfilled,\n interceptor.onRejected,\n );\n }\n }\n\n /\n 注册响应 preInterceptors\n /\n private registerResponsePreInterceptors(interceptors?: ResponseInterceptor[]) {\n if (!interceptors?.length) {\n return;\n }\n\n for (const interceptor of interceptors) {\n this.interceptors.response.use(\n interceptor.onFulfilled,\n interceptor.onRejected,\n );\n }\n }\n\n /\n 执行请求拦截器链\n /\n private runRequestInterceptors(config: RequestConfig): Promise<RequestConfig> {\n let promise: Promise<RequestConfig> = Promise.resolve(config);\n\n const interceptors: RequestInterceptor[] = [];\n this.interceptors.request.forEach((interceptor) => {\n interceptors.push(interceptor);\n });\n\n for (const interceptor of interceptors) {\n promise = promise.then(\n interceptor.onFulfilled,\n interceptor.onRejected,\n );\n }\n\n return promise;\n }\n\n /\n 执行响应拦截器链\n /\n private async runResponseInterceptors(\n promise: Promise<Response>,\n ): Promise<Response> {\n let currentPromise = promise;\n\n // 按顺序执行所有响应拦截器\n const interceptors: ResponseInterceptor[] = [];\n this.interceptors.response.forEach((interceptor) => {\n interceptors.push(interceptor);\n });\n\n for (const interceptor of interceptors) {\n currentPromise = currentPromise.then(\n interceptor.onFulfilled,\n interceptor.onRejected,\n );\n }\n\n return currentPromise;\n }\n\n /\n 构建完整 URL（包含 baseURL 和 query params）\n /\n private buildUrl(url: string, params?: Record<string, any>): string {\n const baseURL = this.defaultConfig.baseURL;\n\n // 拼接 baseURL 和 url（Axios 风格）\n // - 如果 url 是绝对路径（含协议），直接使用 url\n // - 否则拼接 baseURL 和 url，正确处理斜杠\n let combinedUrl: string;\n if (!baseURL \|\| /^https?:\\/\\//i.test(url)) {\n combinedUrl = url;\n } else {\n combinedUrl = baseURL.replace(/\\/+$/, '') + '/' + url.replace(/^\\/+/, '');\n }\n\n const fullUrl = new URL(combinedUrl);\n\n // 协议白名单检查\n const { allowedProtocols } = this.securityConfig;\n if (allowedProtocols && !allowedProtocols.includes(fullUrl.protocol)) {\n throw new Error(\n `Protocol ${fullUrl.protocol} is not allowed. Allowed: ${allowedProtocols.join(', ')}`\n );\n }\n\n // 合并 query params\n if (params) {\n for (const [key, value] of Object.entries(params)) {\n if (value === undefined \|\| value === null) continue;\n fullUrl.searchParams.set(key, String(value));\n }\n }\n\n return fullUrl.href;\n }\n}\n\n/\n 生成网络错误的 message：拼上 cause 的 code 与原因；AbortError 区分超时与主动取消\n * @param timeout 超时触发时传入，主动取消时为 undefined\n */\nfunction describeFetchError(error: unknown, timeout?: number): string {\n const err = error as (Error & { cause?: { code?: string; message?: string } }) \| undefined;\n if (err?.name === 'AbortError') {\n return timeout ? `Request timeout after ${timeout}ms` : 'Request aborted';\n }\n // 底层报错可能含换行（如 TLS），压成一行\n const detail = [err?.cause?.code, err?.cause?.message]\n .filter(Boolean)\n .join(': ')\n .replace(/\\s+/g, ' ')\n .trim();\n const message = err?.message ?? String(error);\n return detail ? `${message} (${detail})` : message;\n}\n"],"mappings":";AAAA,SAAS,YAAY,YAAY,uBAAuB;AAwCjD,IAAM,6BAA6B,KAAK,KAAK;AAC7C,IAAM,8BAA8B;AAE3C,IAAM,aAAa;AAAA,EACjB,KAAK;AAAA,EACL,KAAK;AACP;AAEO,SAAS,iBACd,cACA,QACQ;AACR,QAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC/C,QAAM,UAAqB;AAAA,IACzB,GAAG;AAAA,IACH,KAAK,aAAa;AAAA,IAClB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,aAAa,KAAK,MAAM,OAAO,eAAe,GAAI;AAAA,IACvD,KAAK,WAAW;AAAA,EAClB;AAEA,QAAM,gBAAgB,gBAAgB,KAAK,UAAU,UAAU,CAAC;AAChE,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,OAAO,CAAC;AAC9D,QAAM,YAAY,KAAK,GAAG,aAAa,IAAI,cAAc,IAAI,OAAO,SAAS;AAE7E,SAAO,GAAG,aAAa,IAAI,cAAc,IAAI,SAAS;AACxD;AAEO,SAAS,wBACd,aACA,QACA,SACW;AACX,QAAM,WAAW,YAAY,MAAM,GAAG;AACtC,MAAI,SAAS,WAAW,GAAG;AACzB,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AAEA,QAAM,CAAC,eAAe,gBAAgB,SAAS,IAAI;AAGnD,QAAM,aAAa,KAAK,MAAM,gBAAgB,aAAa,CAAC;AAC5D,MAAI,WAAW,QAAQ,SAAS;AAC9B,UAAM,IAAI,MAAM,qBAAqB;AAAA,EACvC;AAGA,QAAM,oBAAoB,KAAK,GAAG,aAAa,IAAI,cAAc,IAAI,OAAO,SAAS;AAErF,QAAM,iBAAiB,OAAO,KAAK,iBAAiB;AACpD,QAAM,kBAAkB,OAAO,KAAK,SAAS;AAC7C,MACE,eAAe,WAAW,gBAAgB,UAC1C,CAAC,gBAAgB,gBAAgB,eAAe,GAChD;AACA,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AAGA,QAAM,UAAU,KAAK,MAAM,gBAAgB,cAAc,CAAC;AAG1D,MAAI,CAAC,SAAS,gBAAgB;AAC5B,UAAM,iBAAiB,SAAS,kBAAkB;AAClD,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAGxC,QAAI,QAAQ,QAAQ,QAAW;AAC7B,UAAI,QAAQ,MAAM,iBAAiB,KAAK;AACtC,cAAM,IAAI;AAAA,UACR,wBAAwB,IAAI,KAAK,QAAQ,MAAM,GAAI,EAAE,YAAY,CAAC;AAAA,QACpE;AAAA,MACF;AAAA,IACF;AAGA,QAAI,QAAQ,QAAQ,QAAW;AAC7B,UAAI,QAAQ,MAAM,iBAAiB,KAAK;AACtC,cAAM,IAAI;AAAA,UACR,6CAA6C,IAAI,KAAK,QAAQ,MAAM,GAAI,EAAE,YAAY,CAAC;AAAA,QACzF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,QAAQ,QAAQ,QAAW;AAC7B,UAAI,QAAQ,MAAM,iBAAiB,KAAK;AACtC,cAAM,IAAI;AAAA,UACR,qCAAqC,IAAI,KAAK,QAAQ,MAAM,GAAI,EAAE,YAAY,CAAC;AAAA,QACjF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,KAAK,OAAe,QAAwB;AACnD,SAAO,WAAW,UAAU,MAAM,EAC/B,OAAO,KAAK,EACZ,OAAO,QAAQ,EACf,QAAQ,MAAM,EAAE,EAChB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG;AACvB;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,OAAO,KAAK,KAAK,EACrB,SAAS,QAAQ,EACjB,QAAQ,MAAM,EAAE,EAChB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG;AACvB;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,QAAM,aAAa,KAAK,MAAM,SAAS,KAAK,MAAM;AAClD,QAAM,SAAS,GAAG,KAAK,GAAG,IAAI,OAAO,SAAS,CAAC,GAC5C,QAAQ,MAAM,GAAG,EACjB,QAAQ,MAAM,GAAG;AACpB,SAAO,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM;AACtD;;;AC7GO,IAAM,kBAAN,MAAsB;AAAA,EACnB,QAAQ,oBAAI,IAAyB;AAAA,EACrC;AAAA,EAER,YAAY,QAA0B;AACpC,SAAK,SAAS;AAAA,MACZ,iBAAiB,IAAI,KAAK;AAAA;AAAA,MAC1B,GAAG;AAAA,IACL;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,SAAS,QAA8B;AACrC,UAAM,WAAW,KAAK,YAAY,MAAM;AACxC,UAAM,SAAS,KAAK,MAAM,IAAI,QAAQ;AACtC,UAAM,MAAM,KAAK,IAAI;AAGrB,QAAI,UAAU,OAAO,cAAc,MAAM,KAAK,OAAO,iBAAiB;AACpE,aAAO,OAAO;AAAA,IAChB;AAGA,UAAM,QAAQ,iBAAiB,QAAQ,KAAK,MAAM;AAClD,UAAM,cAAc,MAAM,KAAK,OAAO;AAEtC,SAAK,MAAM,IAAI,UAAU,EAAE,OAAO,YAAY,CAAC;AAE/C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,aAAmB;AACjB,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAc,QAA4B;AACxC,UAAM,WAAW,KAAK,YAAY,MAAM;AACxC,SAAK,MAAM,OAAO,QAAQ;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,YAAY,QAA8B;AAEhD,UAAM,QAAQ;AAAA,MACZ,OAAO;AAAA,MACP,OAAO,aAAa;AAAA,MACpB,OAAO,WAAW;AAAA,MAClB,OAAO,UAAU;AAAA,MACjB,OAAO,WAAW;AAAA,MAClB,OAAO,cAAc;AAAA,IACvB;AACA,WAAO,MAAM,KAAK,GAAG;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB;AACd,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,aAAa;AACjB,QAAI,eAAe;AAEnB,eAAW,UAAU,KAAK,MAAM,OAAO,GAAG;AACxC,UAAI,OAAO,cAAc,KAAK;AAC5B;AAAA,MACF,OAAO;AACL;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO,KAAK,MAAM;AAAA,MAClB,OAAO;AAAA,MACP,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAUO,IAAM,oBAAN,MAA+C;AAAA,EACpD,YAA6B,OAAe;AAAf;AAC3B,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,MAAM,mDAA+B;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,SAAS,SAA+B;AACtC,WAAO,KAAK;AAAA,EACd;AACF;;;AC5KA,SAAS,oBAAoB;AAa7B,IAAM,4BAA4B,IAAI,KAAK;AAC3C,IAAM,sBAAsB;AAAA,EAC1B;AACF;AAqBO,IAAM,oBAAN,MAAwB;AAAA,EACrB,QAAQ,oBAAI,IAA6B;AAAA,EACzC;AAAA,EACA;AAAA,EAER,YAAY,QAAkC;AAC5C,SAAK,QAAQ,QAAQ,SAAS;AAC9B,SAAK,kBAAkB,QAAQ,mBAAmB;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,WAAwD;AACtD,UAAM,MAAM,KAAK,IAAI;AAErB,eAAW,YAAY,KAAK,OAAO;AACjC,YAAM,SAAS,KAAK,MAAM,IAAI,QAAQ;AAGtC,UAAI,UAAU,OAAO,cAAc,MAAM,KAAK,iBAAiB;AAC7D,eAAO,EAAE,OAAO,OAAO,OAAO,WAAW,OAAO,UAAU;AAAA,MAC5D;AAGA,YAAM,SAAS,KAAK,aAAa,QAAQ;AACzC,UAAI,QAAQ;AACV,aAAK,MAAM,IAAI,UAAU,MAAM;AAC/B,YAAI,OAAO,cAAc,KAAK;AAC5B,iBAAO,EAAE,OAAO,OAAO,OAAO,WAAW,OAAO,UAAU;AAAA,QAC5D;AAAA,MACF;AAGA,UAAI,UAAU,OAAO,cAAc,KAAK;AACtC,eAAO,EAAE,OAAO,OAAO,OAAO,WAAW,OAAO,UAAU;AAAA,MAC5D;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,aAAmB;AACjB,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEQ,aAAa,UAA0C;AAC7D,QAAI;AACF,YAAM,QAAQ,aAAa,UAAU,OAAO,EAAE,KAAK;AACnD,UAAI,CAAC,MAAO,QAAO;AAEnB,YAAM,UAAU,KAAK,cAAc,KAAK;AACxC,UAAI,CAAC,SAAS,IAAK,QAAO;AAE1B,aAAO;AAAA,QACL;AAAA,QACA,WAAW,QAAQ,cAAc;AAAA,QACjC,aAAa,QAAQ,MAAM;AAAA,MAC7B;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,cAAc,OAA2C;AAC/D,QAAI;AACF,YAAM,WAAW,MAAM,MAAM,GAAG;AAChC,UAAI,SAAS,WAAW,EAAG,QAAO;AAElC,YAAM,aAAa,KAAK,SAAS,CAAC,EAAE,SAAS,KAAK,MAAM;AACxD,YAAM,SAAS,GAAG,SAAS,CAAC,CAAC,GAAG,IAAI,OAAO,SAAS,CAAC,GAClD,QAAQ,MAAM,GAAG,EACjB,QAAQ,MAAM,GAAG;AAEpB,aAAO,KAAK,MAAM,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM,CAAC;AAAA,IAClE,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACpEA,IAAM,qBAAqB;AAC3B,IAAM,yBAAyB;AAC/B,IAAM,yBAAyB;AAC/B,IAAM,oBAAoB;AAC1B,IAAM,2BAA2B;AACjC,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AAE5B,SAAS,uBAAuB,SAAqD;AAC1F,MAAI,CAAC,SAAS,SAAS;AACrB,WAAO,SAAS;AAAA,EAClB;AAEA,MAAI,QAAQ,SAAS;AACnB,WAAO,QAAQ;AAAA,EACjB;AAEA,QAAM,UAAU,QAAQ,gBACnB,QAAQ,kBAAkB,2BAC1B,QAAQ,aAAa;AAC1B,QAAM,SAAS,QAAQ,IAAI,OAAO;AAClC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,gHAAsB,OAAO,EAAE;AAAA,EACjD;AACA,SAAO;AACT;AAcO,SAAS,uBACd,cACA,SAC6B;AAC7B,MAAI,CAAC,QAAQ,SAAS;AACpB,WAAO;AAAA,EACT;AAEA,4BAA0B,0BAA0B,QAAQ,aAAa;AAGzE,MAAI;AACJ,MAAI,QAAQ,eAAe,SAAS,QAAQ;AAC1C,wBAAoB,IAAI,kBAAkB;AAAA,MACxC,OAAO,QAAQ,cAAc;AAAA,MAC7B,iBAAiB,QAAQ;AAAA,IAC3B,CAAC;AAAA,EACH;AAGA,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,eAAe,QAAQ,gBAAgB;AAE7C,QAAM,YAAY,QAAQ,cAAc,QAAQ,IAAI,YAAY,KAAK;AACrE,QAAM,YAAY,QAAQ,cAAc,QAAQ,IAAI,YAAY,KAAK;AAErE,QAAM,eAAe,QAAQ,gBAAgB;AAG7C,QAAM,eAAe,IAAI,gBAAgB;AAAA,IACvC;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,QAAQ;AAAA,EAC3B,CAAC;AAGD,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,gBAAgB,QAAQ,UAAU,QAAQ,IAAI,QAAQ,KAAK;AACjE,QAAM,oBAAoB,gBAAgB,IAAI,kBAAkB,aAAa,IAAI;AAEjF,QAAM,iBAAiB,QAAQ,kBAAkB;AAGjD,eAAa,QAAQ,IAAI,CAAC,WAA0B;AAElD,QAAI,mBAAmB;AACrB,YAAM,YAAY,kBAAkB,SAAS;AAC7C,UAAI,WAAW;AACb,cAAMA,WAAU;AAAA,UACd,GAAI,OAAO;AAAA,UACX,iBAAiB,UAAU,UAAU,KAAK;AAAA,UAC1C,aAAa,UAAU;AAAA,QACzB;AACA,eAAO,EAAE,GAAG,QAAQ,SAAAA,SAAQ;AAAA,MAC9B;AAAA,IACF;AAEA,8BAA0B,qCAAqC,OAAO,cAAc,YAAY;AAEhG,UAAM,SAAuB;AAAA,MAC3B,GAAI,QAAQ,iBAAiB,CAAC;AAAA,MAC9B,GAAI,OAAO,cAAc,gBAAgB,CAAC;AAAA,MAC1C,YAAY;AAAA,IACd;AAMA,QAAI;AACJ,QAAI,mBAAmB;AACrB,UAAI;AACF,gBAAQ,kBAAkB,SAAS,MAAM;AAAA,MAC3C,QAAQ;AACN,gBAAQ,aAAa,SAAS,MAAM;AAAA,MACtC;AAAA,IACF,OAAO;AACL,cAAQ,aAAa,SAAS,MAAM;AAAA,IACtC;AAGA,UAAM,UAAkC;AAAA,MACtC,GAAI,OAAO;AAAA,MACX,iBAAiB,UAAU,KAAK;AAAA,MAChC,aAAa;AAAA,IACf;AAGA,QAAI,QAAQ,eAAe;AACzB,YAAM,cAAc,QAAQ,IAAI,cAAc;AAC9C,UAAI,aAAa;AACf,gBAAQ,0BAA0B,IAAI;AAAA,MACxC;AAAA,IACF;AAEA,WAAO;AAAA,MACL,GAAG;AAAA,MACH;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAEA,SAAS,0BAA0B,MAAc,QAAyB;AACxE,MAAI,UAAU,OAAO,UAAU,eAAe,KAAK,QAAQ,YAAY,GAAG;AACxE,UAAM,IAAI,MAAM,GAAG,IAAI,4CAAmB;AAAA,EAC5C;AACF;;;ACtMO,IAAM,qBAAN,MAA4B;AAAA,EACzB,eAA6B,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,IAAI,aAAmB,YAA0B;AAC/C,SAAK,aAAa,KAAK,EAAE,aAAa,WAAW,CAAM;AACvD,WAAO,KAAK,aAAa,SAAS;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IAAkB;AACtB,QAAI,KAAK,aAAa,EAAE,GAAG;AACzB,WAAK,aAAa,EAAE,IAAI;AAAA,IAC1B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,QAAc;AACZ,SAAK,eAAe,CAAC;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,IAAoC;AAC1C,SAAK,aAAa,QAAQ,CAAC,gBAAgB;AACzC,UAAI,gBAAgB,MAAM;AACxB,WAAG,WAAW;AAAA,MAChB;AAAA,IACF,CAAC;AAAA,EACH;AACF;;;ACpCO,SAAS,cAAc,OAAqB;AACjD,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,SAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEO,SAAS,iBAAiB,SAA0D;AACzF,MAAI,CAAC,SAAS;AACZ,WAAO,CAAC;AAAA,EACV;AAEA,MAAI,mBAAmB,SAAS;AAC9B,UAAMC,cAAqC,CAAC;AAC5C,YAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC9B,MAAAA,YAAW,GAAG,IAAI;AAAA,IACpB,CAAC;AACD,WAAOA;AAAA,EACT;AAEA,MAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,WAAO,QAAQ,OAA+B,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM;AACnE,UAAI,GAAG,IAAI;AACX,aAAO;AAAA,IACT,GAAG,CAAC,CAAC;AAAA,EACP;AAEA,QAAM,aAAqC,CAAC;AAC5C,SAAO,QAAQ,OAAqD,EAAE;AAAA,IACpE,CAAC,CAAC,KAAK,KAAK,MAAM;AAChB,YAAM,kBAAkB,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,GAAG,IAAI;AACjE,iBAAW,GAAG,IAAI;AAAA,IACpB;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,kBAAkB,SAAyD;AACzF,QAAM,UAAU,OAAO,QAAQ,OAAO;AACtC,QAAM,QAAQ,CAAC,UAAmB,UAAU,UAAa,UAAU;AACnE,QAAM,QAAQ,QACX,OAAO,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,YAAY,MAAM,cAAc,MAAM,KAAK,CAAC,EACzE,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,OAAO,KAAK,EAAE,KAAK,CAAC,EACvC,KAAK,IAAI;AACZ,QAAM,aAAa,QAAQ,OAAO,CAAC,CAAC,GAAG,MAAM,IAAI,YAAY,MAAM,WAAW;AAC9E,MAAI,CAAC,MAAM,YAAY,EAAE,WAAW,KAAK,KAAK,WAAW,KAAK,CAAC,CAAC,EAAE,KAAK,MAAM,MAAM,KAAK,CAAC,GAAG;AAC1F,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,EAAE,GAAG,QAAQ;AAC5B,aAAW,CAAC,GAAG,KAAK,YAAY;AAC9B,WAAO,OAAO,GAAG;AAAA,EACnB;AACA,SAAO,WAAW,IAAI;AACtB,SAAO;AACT;;;ACpDO,IAAM,YAAN,MAAM,mBAAkB,MAAM;AAAA,EACnB,cAAuB;AAAA,EAChC;AAAA,EACA;AAAA,EAEP,YACE,UACA,QACA,SACA,SACA;AACA,UAAM,WAAW,8BAA8B,UAAU,UAAU,SAAS,IAAI,OAAO;AACvF,SAAK,OAAO;AACZ,SAAK,WAAW;AAChB,SAAK,SAAS,eAAe,MAAM;AACnC,WAAO,eAAe,MAAM,WAAU,SAAS;AAAA,EACjD;AACF;AAiEA,SAAS,eAAe,QAA0C;AAChE,QAAM,EAAE,SAAS,GAAG,KAAK,IAAI;AAE7B,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,gBAAgB,OAAO;AAAA,EAClC;AACF;AAOA,SAAS,gBAAgB,SAAsE;AAC7F,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,iBAAiB,OAAO;AAC3C,QAAM,YAAoC,CAAC;AAE3C,QAAM,mBAAmB,CAAC,iBAAiB,aAAa,UAAU,UAAU;AAE5E,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,UAAU,GAAG;AACrD,UAAM,WAAW,IAAI,YAAY;AACjC,QAAI,iBAAiB,SAAS,QAAQ,GAAG;AACvC,gBAAU,GAAG,IAAI;AAAA,IACnB,OAAO;AACL,gBAAU,GAAG,IAAI;AAAA,IACnB;AAAA,EACF;AAEA,SAAO;AACT;;;AC5EO,IAAM,aAAN,MAAiB;AAAA,EACd;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAID,eAAe;AAAA,IACpB,SAAS,IAAI,mBAAuC;AAAA,IACpD,UAAU,IAAI,mBAAwC;AAAA,EACxD;AAAA,EAEA,YAAY,QAA2B;AACrC,UAAM,EAAE,UAAU,UAAU,iBAAiB,GAAG,WAAW,IAAI,UAAU,CAAC;AAE1E,SAAK,gBAAgB;AAAA,MACnB,SAAS;AAAA,MACT,GAAG;AAAA,IACL;AAGA,UAAM,aAAa,UAAU,cAAc;AAC3C,SAAK,iBAAiB;AAAA,MACpB,kBAAkB,aAAa,CAAC,SAAS,QAAQ,IAAI;AAAA,MACrD,iBAAiB,aAAa,KAAK,OAAO,OAAO;AAAA;AAAA,MACjD;AAAA,MACA,GAAG;AAAA,IACL;AAEA,SAAK,+BAA+B,iBAAiB,OAAO;AAE5D,QAAI,UAAU,SAAS;AACrB,UAAI,CAAC,KAAK,cAAc,SAAS;AAC/B,aAAK,cAAc,UAAU,uBAAuB,QAAQ;AAAA,MAC9D;AACA,6BAAuB,KAAK,cAAc,QAAQ;AAAA,IACpD;AAEA,SAAK,gCAAgC,iBAAiB,QAAQ;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IAAI,KAAa,QAA2C;AAChE,WAAO,KAAK,QAAQ,EAAE,GAAG,QAAQ,KAAK,QAAQ,MAAM,CAAC;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,KAAK,KAAa,MAAY,QAA2C;AAC7E,UAAM,UAAkC,EAAE,GAAG,QAAQ,QAAQ;AAC7D,QAAI,OAAY;AAEhB,QAAI,cAAc,IAAI,GAAG;AACvB,aAAO,KAAK,UAAU,IAAI;AAC1B,UAAI,CAAC,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,IAAI,YAAY,MAAM,cAAc,GAAG;AAC7E,gBAAQ,cAAc,IAAI;AAAA,MAC5B;AAAA,IACF;AAEA,WAAO,KAAK,QAAQ;AAAA,MAClB,GAAG;AAAA,MACH;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IAAI,KAAa,MAAY,QAA2C;AAC5E,UAAM,UAAkC,EAAE,GAAG,QAAQ,QAAQ;AAC7D,QAAI,OAAY;AAEhB,QAAI,cAAc,IAAI,GAAG;AACvB,aAAO,KAAK,UAAU,IAAI;AAC1B,UAAI,CAAC,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,IAAI,YAAY,MAAM,cAAc,GAAG;AAC7E,gBAAQ,cAAc,IAAI;AAAA,MAC5B;AAAA,IACF;AAEA,WAAO,KAAK,QAAQ;AAAA,MAClB,GAAG;AAAA,MACH;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAO,KAAa,QAA2C;AACnE,WAAO,KAAK,QAAQ,EAAE,GAAG,QAAQ,KAAK,QAAQ,SAAS,CAAC;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAM,KAAa,MAAY,QAA2C;AAC9E,UAAM,UAAkC,EAAE,GAAG,QAAQ,QAAQ;AAC7D,QAAI,OAAY;AAEhB,QAAI,cAAc,IAAI,GAAG;AACvB,aAAO,KAAK,UAAU,IAAI;AAC1B,UAAI,CAAC,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,IAAI,YAAY,MAAM,cAAc,GAAG;AAC7E,gBAAQ,cAAc,IAAI;AAAA,MAC5B;AAAA,IACF;AAEA,WAAO,KAAK,QAAQ;AAAA,MAClB,GAAG;AAAA,MACH;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAQ,QAA0C;AAGtD,UAAM,cAAc,iBAAiB,KAAK,cAAc,OAAO;AAC/D,UAAM,kBAAkB,iBAAiB,OAAO,OAAO;AACvD,UAAM,eAA+D,CAAC;AAEtE,eAAW,OAAO,aAAa;AAC7B,mBAAa,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,YAAY,GAAG,EAAE;AAAA,IACnE;AACA,eAAW,OAAO,iBAAiB;AACjC,mBAAa,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,gBAAgB,GAAG,EAAE;AAAA,IACvE;AAEA,UAAM,eAAuC,CAAC;AAC9C,eAAW,YAAY,cAAc;AACnC,YAAM,EAAE,KAAK,MAAM,IAAI,aAAa,QAAQ;AAC5C,mBAAa,GAAG,IAAI;AAAA,IACtB;AAEA,QAAI,eAA8B;AAAA,MAChC,GAAG,KAAK;AAAA,MACR,GAAG;AAAA,MACH,SAAS;AAAA,IACX;AAGA,QAAI;AACF,qBAAe,MAAM,KAAK,uBAAuB,YAAY;AAAA,IAC/D,SAAS,OAAO;AACd,aAAO,QAAQ,OAAO,KAAK;AAAA,IAC7B;AAGA,iBAAa,UAAU,kBAAkB,iBAAiB,aAAa,OAAO,CAAC;AAG/E,UAAM,UAAU,KAAK,SAAS,aAAa,KAAM,aAAa,MAAM;AAGpE,UAAM,UAAU,aAAa,WAAW,KAAK,cAAc,WAAW;AACtE,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,YAAY,WAAW,MAAM,WAAW,MAAM,GAAG,OAAO;AAG9D,UAAM,iBAAiB,aAAa;AACpC,QAAI,gBAAgB;AAElB,UAAI,eAAe,SAAS;AAC1B,qBAAa,SAAS;AACtB,mBAAW,MAAM;AAAA,MACnB,OAAO;AAEL,uBAAe,iBAAiB,SAAS,MAAM,WAAW,MAAM,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,MACnF;AAAA,IACF;AAGA,UAAM,EAAE,cAAc,QAAQ,SAAS,UAAU,SAAS,KAAK,GAAG,aAAa,IAAI;AAEnF,QAAI;AAEF,YAAM,WAAW,MAAM,MAAM,SAAS;AAAA,QACpC,GAAG;AAAA,QACH,QAAQ,WAAW;AAAA;AAAA,MACrB,CAAC;AAED,mBAAa,SAAS;AAGtB,UAAI,KAAK,eAAe,kBAAkB,GAAG;AAC3C,cAAM,gBAAgB,SAAS,QAAQ,IAAI,gBAAgB;AAC3D,YAAI,eAAe;AACjB,gBAAM,OAAO,SAAS,eAAe,EAAE;AACvC,cAAI,OAAO,KAAK,eAAe,iBAAiB;AAC9C,kBAAM,IAAI;AAAA,cACR,iBAAiB,IAAI,2BAA2B,KAAK,eAAe,eAAe;AAAA,YACrF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAGA,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,QAAQ,IAAI,UAAU,UAAU,YAAY;AAClD,eAAO,KAAK,wBAAwB,QAAQ,OAAO,KAAK,CAAC;AAAA,MAC3D;AAGA,aAAO,KAAK,wBAAwB,QAAQ,QAAQ,QAAQ,CAAC;AAAA,IAC/D,SAAS,OAAO;AACd,mBAAa,SAAS;AAGtB,YAAM,YACJ,iBAAiB,YACb,QACA,IAAI;AAAA,QACJ;AAAA,QACA;AAAA,QACA,mBAAmB,OAAO,gBAAgB,UAAU,SAAY,OAAO;AAAA,QACvE,EAAE,OAAO,MAAM;AAAA,MACjB;AAEJ,aAAO,KAAK,wBAAwB,QAAQ,OAAO,SAAS,CAAC;AAAA,IAC/D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,+BAA+B,cAAqC;AAC1E,QAAI,CAAC,cAAc,QAAQ;AACzB;AAAA,IACF;AAEA,eAAW,eAAe,cAAc;AACtC,WAAK,aAAa,QAAQ;AAAA,QACxB,YAAY;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,gCAAgC,cAAsC;AAC5E,QAAI,CAAC,cAAc,QAAQ;AACzB;AAAA,IACF;AAEA,eAAW,eAAe,cAAc;AACtC,WAAK,aAAa,SAAS;AAAA,QACzB,YAAY;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,uBAAuB,QAA+C;AAC5E,QAAI,UAAkC,QAAQ,QAAQ,MAAM;AAE5D,UAAM,eAAqC,CAAC;AAC5C,SAAK,aAAa,QAAQ,QAAQ,CAAC,gBAAgB;AACjD,mBAAa,KAAK,WAAW;AAAA,IAC/B,CAAC;AAED,eAAW,eAAe,cAAc;AACtC,gBAAU,QAAQ;AAAA,QAChB,YAAY;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,wBACZ,SACmB;AACnB,QAAI,iBAAiB;AAGrB,UAAM,eAAsC,CAAC;AAC7C,SAAK,aAAa,SAAS,QAAQ,CAAC,gBAAgB;AAClD,mBAAa,KAAK,WAAW;AAAA,IAC/B,CAAC;AAED,eAAW,eAAe,cAAc;AACtC,uBAAiB,eAAe;AAAA,QAC9B,YAAY;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,SAAS,KAAa,QAAsC;AAClE,UAAM,UAAU,KAAK,cAAc;AAKnC,QAAI;AACJ,QAAI,CAAC,WAAW,gBAAgB,KAAK,GAAG,GAAG;AACzC,oBAAc;AAAA,IAChB,OAAO;AACL,oBAAc,QAAQ,QAAQ,QAAQ,EAAE,IAAI,MAAM,IAAI,QAAQ,QAAQ,EAAE;AAAA,IAC1E;AAEA,UAAM,UAAU,IAAI,IAAI,WAAW;AAGnC,UAAM,EAAE,iBAAiB,IAAI,KAAK;AAClC,QAAI,oBAAoB,CAAC,iBAAiB,SAAS,QAAQ,QAAQ,GAAG;AACpE,YAAM,IAAI;AAAA,QACR,YAAY,QAAQ,QAAQ,6BAA6B,iBAAiB,KAAK,IAAI,CAAC;AAAA,MACtF;AAAA,IACF;AAGA,QAAI,QAAQ;AACV,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,YAAI,UAAU,UAAa,UAAU,KAAM;AAC3C,gBAAQ,aAAa,IAAI,KAAK,OAAO,KAAK,CAAC;AAAA,MAC7C;AAAA,IACF;AAEA,WAAO,QAAQ;AAAA,EACjB;AACF;AAMA,SAAS,mBAAmB,OAAgB,SAA0B;AACpE,QAAM,MAAM;AACZ,MAAI,KAAK,SAAS,cAAc;AAC9B,WAAO,UAAU,yBAAyB,OAAO,OAAO;AAAA,EAC1D;AAEA,QAAM,SAAS,CAAC,KAAK,OAAO,MAAM,KAAK,OAAO,OAAO,EAClD,OAAO,OAAO,EACd,KAAK,IAAI,EACT,QAAQ,QAAQ,GAAG,EACnB,KAAK;AACR,QAAM,UAAU,KAAK,WAAW,OAAO,KAAK;AAC5C,SAAO,SAAS,GAAG,OAAO,KAAK,MAAM,MAAM;AAC7C;","names":["headers","normalized"]}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@lark-apaas/http-client",
-  "version": "0.1.8",
+  "version": "0.1.9-alpha.20261024072008",
   "description": "HTTP client with Axios-style interceptors, built on native fetch API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",