@onebullex-group/cli 1.1.2

package/CHANGELOG.md

@@ -0,0 +1,61 @@
+# Changelog
+
+All notable changes to `@onebullex-group/cli` (formerly briefly published as `@onemore-group/cli`).
+
+## 1.1.2 — 2026-05-16
+
+Rename only — no functional changes from 1.1.1.
+
+- Package renamed from `@onebullex/cli` → `@onebullex-group/cli`. The
+  CLI binary remains `onebullex` (unchanged), the README still
+  describes "OneBullEx Open API V2" — only the npm package name moved.
+- A short-lived `@onemore-group/cli@1.1.2` was published earlier the
+  same day and has been unpublished. If you installed it, switch to
+  `@onebullex-group/cli@1.1.2` (identical contents).
+- Existing 1.1.0 / 1.1.1 were never published.
+
+## Unreleased
+
+- ci(cli): nightly `cli-e2e-nightly` job in `.gitlab-ci.yml`, runs the full
+  `tests/e2e/` suite when triggered by a Pipeline Schedule. Reads
+  `ONEBULLEX_E2E_API_KEY` / `_SECRET` from GitLab CI variables. Marked
+  `allow_failure: true` with one retry so testnet flakes don't block the
+  schedule.
+- test(cli): testnet write e2e suite covering all 20 V2 write endpoints,
+  organized into 4 business-flow blocks (configuration / limit orders /
+  plan + order-entrust / position + TP-SL). Gated on `ONEBULLEX_E2E=1`
+  with separate `ONEBULLEX_E2E_API_KEY` / `_SECRET` env vars. Default-
+  skipped. Each block has best-effort cleanup so consecutive runs leave
+  the testnet account state-clean.
+
+## 1.1.0 — 2026-05-15
+
+Adds Phase 2: 20 write operations covering order placement / cancellation,
+plan + TP/SL entrust management, and position margin / leverage / type changes.
+
+- 5 order write commands (create, create-batch, cancel, cancel-batch, cancel-all)
+- 7 entrust write commands (create-plan, create-profit, cancel-plan,
+  cancel-profit, update-profit, cancel-all-plan, cancel-all-profit)
+- 2 order-entrust write commands (cancel, cancel-all)
+- 6 position write commands (adjust-leverage, margin, auto-margin, close-all,
+  merge, change-type)
+- New `executeWrite` helper guards every write with a default dry-run; `--confirm`
+  is required for the actual POST. Dry-run preview goes to stdout, the
+  `--confirm` hint goes to stderr.
+- Drift-detection lint now covers all 60 V2 endpoints; the `PHASE1_DEFERRED`
+  whitelist is empty.
+- Adds 21 new write command integration tests verifying both the dry-run path
+  (no fetch, structured preview) and the confirm path (camelCase body shape).
+
+## 1.0.0 — 2026-05-15
+
+Initial release. Covers OneBullEx Open API V2:
+
+- 22 public endpoints (server time, symbol/ticker/depth/kline/funding/...)
+- 18 private read-only endpoints (balance/order/entrust/position/...)
+- HMAC-SHA256 auth aligned byte-for-byte with `SignatureUtilsV2.java`
+- 6 config commands with multi-profile support, `--stdin` enforcement on
+  api-key/secret, and 0600 file mode
+- Drift-detection lint comparing CLI registry against V2 markdown docs
+  (endpoint coverage + parameter coverage + write-safety)
+- 155 unit / integration tests + 5 testnet e2e smoke tests

package/README.md

@@ -0,0 +1,243 @@
+# @onebullex-group/cli
+
+OneBullEx Open API V2 的命令行工具。
+
+> 当前版本（1.1.0）覆盖 V2 文档的全部 60 个端点：22 个公开 + 18 个私有只读 + 20 个写。所有写命令默认 dry-run，需 `--confirm` 才真发请求。
+
+---
+
+## 安装
+
+```bash
+npm i -g @onebullex-group/cli
+```
+
+或本地构建：
+
+```bash
+cd cli
+pnpm install
+pnpm build
+pnpm link --global
+```
+
+校验：
+
+```bash
+onebullex --version
+onebullex public time --base-url https://futures-openapi.1bullex.com
+```
+
+## Quick Start
+
+```bash
+# 1. 初始化一个 profile（向导式）
+onebullex config init
+
+# 2. 看下当前 profile 配置（敏感字段已脱敏）
+onebullex config show
+
+# 3. 跑公开接口验证联通性
+onebullex public time
+onebullex symbol list
+
+# 4. 跑私有只读接口（需要在 config init 时填了 api-key/secret）
+onebullex balance list
+onebullex position list
+```
+
+## 命令分组
+
+完整命令列表跟 V2 文档逐项对齐，可用 `onebullex <group> --help` 查询。
+
+### 公开（22）
+
+```
+public time                    GET /v2/public/time
+symbol  list / get / coins / all
+ticker  get / list / agg / agg-list
+depth   get
+deal    list
+kline   list
+mark-price  list / get
+index-price list / get*       (* index-price get 需要认证)
+funding rate / history
+risk-balance list
+open-interest get
+leverage brackets-list / brackets-get
+```
+
+### 私有只读（18）
+
+```
+listen-key get
+balance list / get / bills
+order list-unfinished / list-unfinished-multi / list / list-by-ids /
+      list-history / get / trades
+entrust plan-list / plan-history / plan-get / profit-list / profit-get
+order-entrust list
+position list
+```
+
+### 写操作（20）
+
+所有写命令默认 dry-run：仅打印预览不发请求。**加 `--confirm` 才会真正下单/撤单/改仓。**
+
+```
+order create / create-batch / cancel / cancel-batch / cancel-all
+entrust create-plan / create-profit /
+        cancel-plan / cancel-profit / update-profit /
+        cancel-all-plan / cancel-all-profit
+order-entrust cancel / cancel-all
+position adjust-leverage / margin / auto-margin /
+         close-all / merge / change-type
+```
+
+例：
+```bash
+# dry-run（默认，退出码 4，preview 在 stdout）
+onebullex order create --symbol btc_usdt --order-type LIMIT \
+  --order-side BUY --position-side LONG --orig-qty 0.001 --price 50000
+
+# 真正下单
+onebullex order create --symbol btc_usdt --order-type LIMIT \
+  --order-side BUY --position-side LONG --orig-qty 0.001 --price 50000 \
+  --confirm
+```
+
+CLI flag 用 kebab-case，会映射到 API 的 camelCase 字段（如 `--order-side` → `orderSide`）。批量类（`create-batch` / `cancel-batch`）的 `--list` / `--order-ids` 接受 JSON 字符串数组。
+
+### 配置管理（6）
+
+```
+config init           交互式向导
+config set <key>      仅 base-url / identify / env 可用 --value
+                      api-key / secret 必须用 --stdin
+config show           [--reveal] 默认脱敏，加 --reveal 后明文（带 stderr 警告）
+config use <profile>  切换默认 profile
+config list-profiles  表格列出全部 profile
+config remove <p>     删除 profile（防止删掉最后一个）
+```
+
+## 配置文件
+
+默认路径 `~/.onebullex/config.json`，权限 0600（非 Windows 上自动校正）。
+
+```json
+{
+  "version": 1,
+  "default-profile": "test",
+  "profiles": {
+    "test": {
+      "base-url": "https://futures-openapi.1bullex.com",
+      "api-key": "AK...",
+      "secret": "...",
+      "identify": null,
+      "env": "test"
+    }
+  }
+}
+```
+
+可通过 `ONEBULLEX_CONFIG_PATH` 环境变量覆盖路径（脚本/CI 友好）。
+
+## 优先级与全局 flag
+
+每次调用按以下顺序解析：
+
+```
+CLI flag > 环境变量 > 配置文件 profile > 报错（要求 config init）
+```
+
+| 全局 flag | 环境变量 | 说明 |
+|---|---|---|
+| `--profile <name>` | `ONEBULLEX_PROFILE` | 临时切换 profile |
+| `--api-key <key>` | `ONEBULLEX_API_KEY` | 覆盖 api key |
+| `--secret <s>` | `ONEBULLEX_SECRET` | 覆盖 secret（不建议 CLI 上明文） |
+| `--base-url <url>` | `ONEBULLEX_BASE_URL` | 覆盖 base URL |
+| `--output <fmt>` | — | `table` / `json`，TTY 默认 table，否则 json |
+| `--debug` | `ONEBULLEX_DEBUG=1` | 把请求/响应（脱敏后）写到 stderr |
+| `--timeout <ms>` | — | HTTP 超时，默认 10s |
+| `--confirm` | — | Phase 2 写命令使用，未传时走 dry-run |
+
+## 安全
+
+- secret 与 api-key **明文落盘**在 config.json，权限收紧到 0600
+- `config set api-key` / `config set secret` 拒绝 `--value`，强制 `--stdin`，防止 shell history 泄漏
+- `config show` 默认脱敏（`AK****1234` / `****`），仅 `--reveal` 时明文并带 stderr 警告
+- `--debug` 输出会通过 redact 过滤掉 `X-Signature` / `X-API-KEY` / `Authorization` / `secret` 字段
+- 每次调用都会校验 `~/.onebullex/config.json` 的 mode（非 win32），不是 0600 时打 warn 并自动修复
+
+## 输出格式
+
+- TTY 下默认表格（`cli-table3`），列名取并集，时间戳列自动渲染成 `YYYY-MM-DD HH:mm:ss`
+- 非 TTY（管道、重定向、CI）默认 JSON，`jq` 友好
+- 任意时候用 `--output json` 强制 JSON，`--output table` 强制表格
+
+## 防漂移 lint
+
+`pnpm check-coverage` 跑三层校验：
+
+1. **端点级**：把 `docs/onebullex-openapi-cn-v2.md` 里的所有 `#### GET/POST /v2/*` 标题与 `cli/src/registry.ts` 对账，缺/多就 fail
+2. **参数级**：用 ts-morph 解析每个命令文件，提取 commander 的 `command()` / `requiredOption()` / `option()`，与文档参数表的 `必填` 列对账
+3. **写守门**：方法是 GET 但 `isWrite=true`，或者 method 是 POST 但 `isWrite=false`（`/v2/order/list-by-ids` 是已知例外）
+
+CI 上当文档新增一个端点时，coverage 检查会立刻 fail，强制开发者补一个新命令。
+
+## 开发
+
+```bash
+cd cli
+pnpm install
+pnpm dev <command>      # 直接跑 src/index.ts，无需先 build
+pnpm test               # 跑全部单测/集成测
+pnpm typecheck          # tsc --noEmit
+pnpm lint               # biome
+pnpm check-coverage     # 防漂移 lint
+pnpm build              # 产出 dist/index.js
+```
+
+### 跑 testnet e2e
+
+只读 e2e（默认跳过）只验证公开接口连通性：
+
+```bash
+ONEBULLEX_E2E=1 pnpm vitest run tests/e2e/public.e2e.test.ts
+```
+
+写 e2e（默认跳过）会真发请求到 testnet：下/撤远价限价单、改杠杆、改持仓模式、用 MARKET 单开仓 → 加保证金 → 创建止盈止损 → close-all。需要测试网账户和 ≥ 50 USDT 余额：
+
+```bash
+ONEBULLEX_E2E=1 \
+ONEBULLEX_E2E_API_KEY=<testnet-key> \
+ONEBULLEX_E2E_SECRET=<testnet-secret> \
+pnpm vitest run tests/e2e/write.e2e.test.ts
+```
+
+按业务流程组织成 4 个 block，串行执行：configuration chain → limit order chain → plan + order-entrust chain → position + profit chain。每个 block 末尾有 best-effort `cancel-all` / `close-all`，跑挂时也尽量不留挂单/持仓残留。
+
+#### Nightly CI（可选）
+
+`cli/.gitlab-ci.yml` 里有一个 `cli-e2e-nightly` job，仅在 schedule 触发时跑（`$CI_PIPELINE_SOURCE == "schedule"`），跑完整 `tests/e2e/` 套件。开启方式：
+
+1. 在 GitLab project **Settings → CI/CD → Variables** 添加 masked + protected 变量：
+   - `ONEBULLEX_E2E_API_KEY` = testnet API key
+   - `ONEBULLEX_E2E_SECRET` = testnet API secret
+2. **Build → Pipeline schedules → New schedule**，cron 设成例如 `0 19 * * *`（每日 03:00 UTC+8），target branch 选 `main`。
+
+job 标 `allow_failure: true` 且 retry 一次——testnet 偶发抖动不会阻塞调度。变量没配时只有 public e2e 跑，写 e2e 自动 skip（HAS_AUTH 门控）。
+
+## 与 Java SDK 的关系
+
+签名实现严格对齐 `src/main/java/com/onebullex/api/common/SignatureUtilsV2.java`：
+
+- timestamp 秒级（10 位）
+- nonce 是 UUID v4 去横线（32 位 hex 小写）
+- query string 按 key 字典序排序，**不做 URL 编码**
+- HMAC-SHA256，输出 hex 小写
+
+Java 端通过 `SignatureVectorGenTest` 生成 `cli/tests/fixtures/signature-vectors.json`，CLI 端 `signature-parity.test.ts` 把 7 条向量逐条对照 Java 输出，保证字节级一致。
+
+## License
+
+MIT

package/dist/chunk-AKGCHJPQ.js

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+import {
+  redactSecret
+} from "./chunk-OOLZIYXS.js";
+
+// src/core/config.ts
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
+import { chmodSync, statSync } from "fs";
+import { homedir, platform } from "os";
+import { dirname, join } from "path";
+var DEFAULT_CONFIG_PATH = join(homedir(), ".onebullex", "config.json");
+function readConfigFile(path) {
+  const raw = readFileSync(path, "utf8");
+  const parsed = JSON.parse(raw);
+  if (typeof parsed !== "object" || parsed === null || parsed["version"] !== 1) {
+    throw new Error(`\u914D\u7F6E\u6587\u4EF6\u683C\u5F0F\u65E0\u6548\uFF1Aversion \u5FC5\u987B\u4E3A 1\uFF08\u8DEF\u5F84\uFF1A${path}\uFF09`);
+  }
+  return parsed;
+}
+function writeConfigFile(path, cfg) {
+  const dir = dirname(path);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  const tmp = `${path}.tmp.${process.pid}`;
+  const content = JSON.stringify(cfg, null, 2);
+  writeFileSync(tmp, content, { encoding: "utf8", mode: 384 });
+  renameSync(tmp, path);
+}
+function checkConfigPermissions(path, warn) {
+  if (platform() === "win32") return;
+  try {
+    const st = statSync(path);
+    const mode = st.mode & 511;
+    if (mode !== 384) {
+      warn(
+        `\u914D\u7F6E\u6587\u4EF6\u6743\u9650\u4E0D\u5B89\u5168\uFF08\u5F53\u524D\uFF1A${mode.toString(8)}\uFF0C\u671F\u671B\uFF1A600\uFF09\uFF1A${path}\uFF0C\u6B63\u5728\u4FEE\u590D\u2026`
+      );
+      chmodSync(path, 384);
+    }
+  } catch {
+  }
+}
+function resolveConfig(input) {
+  const { configPath, flags, env } = input;
+  let file = null;
+  try {
+    file = readConfigFile(configPath);
+  } catch {
+  }
+  const profileName = flags.profile ?? env["ONEBULLEX_PROFILE"] ?? file?.["default-profile"] ?? "default";
+  const profile = file?.profiles?.[profileName];
+  const baseUrl = flags["base-url"] ?? env["ONEBULLEX_BASE_URL"] ?? profile?.["base-url"];
+  if (!baseUrl) {
+    throw new Error(
+      `\u672A\u627E\u5230 baseUrl \u914D\u7F6E\u3002\u8BF7\u5148\u8FD0\u884C "onebullex config init" \u521D\u59CB\u5316\u914D\u7F6E\uFF0C\u6216\u901A\u8FC7 --base-url \u53C2\u6570 / ONEBULLEX_BASE_URL \u73AF\u5883\u53D8\u91CF\u6307\u5B9A\u3002`
+    );
+  }
+  const apiKey = flags["api-key"] ?? env["ONEBULLEX_API_KEY"] ?? profile?.["api-key"];
+  const secret = flags.secret ?? env["ONEBULLEX_SECRET"] ?? profile?.secret;
+  const identify = profile?.identify ?? null;
+  const debug = flags.debug ?? env["ONEBULLEX_DEBUG"] === "1";
+  const timeoutMs = flags.timeout ?? 1e4;
+  return {
+    baseUrl,
+    apiKey,
+    secret,
+    identify,
+    profileName,
+    env: profile?.env,
+    debug,
+    timeoutMs
+  };
+}
+function redactProfile(p) {
+  return {
+    ...p,
+    ...p["api-key"] !== void 0 ? { "api-key": redactSecret(p["api-key"]) } : {},
+    ...p.secret !== void 0 ? { secret: "****" } : {}
+  };
+}
+
+export {
+  DEFAULT_CONFIG_PATH,
+  readConfigFile,
+  writeConfigFile,
+  checkConfigPermissions,
+  resolveConfig,
+  redactProfile
+};

package/dist/chunk-CVOY2SOS.js

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+import {
+  OneBullExError
+} from "./chunk-JRUFIHU7.js";
+import {
+  redactObject
+} from "./chunk-OOLZIYXS.js";
+import {
+  generateNonce,
+  sign
+} from "./chunk-LVNSFQXS.js";
+
+// src/core/http-client.ts
+function flattenForSign(body) {
+  if (!body) return {};
+  const out = {};
+  for (const [k, v] of Object.entries(body)) {
+    if (v == null) continue;
+    if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") {
+      out[k] = v;
+      continue;
+    }
+    throw new Error(
+      `flattenForSign: unsupported value type for key "${k}" (${typeof v}). Nested objects/arrays must be pre-serialized by the caller (e.g. JSON.stringify).`
+    );
+  }
+  return out;
+}
+var HttpClient = class {
+  constructor(cfg, fetchFn) {
+    this.cfg = cfg;
+    this.fetch = fetchFn ?? globalThis.fetch.bind(globalThis);
+  }
+  cfg;
+  fetch;
+  async getPublic(path, query) {
+    return this.withRetry(() => this.send("GET", path, query, void 0, false));
+  }
+  async getPrivate(path, query) {
+    return this.withRetry(() => this.send("GET", path, query, void 0, true));
+  }
+  async postPrivate(path, body) {
+    return this.send("POST", path, void 0, body, true);
+  }
+  /**
+   * GET 请求重试包装：网络错误最多重试 2 次（共 3 次尝试），延迟 300ms / 900ms。
+   * OneBullExError（业务错误）不重试。
+   */
+  async withRetry(fn) {
+    const delays = [300, 900];
+    let lastErr;
+    for (let i = 0; i <= delays.length; i++) {
+      try {
+        return await fn();
+      } catch (e) {
+        if (e instanceof OneBullExError) throw e;
+        lastErr = e;
+        if (i === delays.length) break;
+        await new Promise((r) => setTimeout(r, delays[i]));
+      }
+    }
+    throw lastErr;
+  }
+  async send(method, path, query, body, requireAuth) {
+    const headers = {
+      "Content-Type": "application/json",
+      Accept: "application/json",
+      "User-Agent": "@onebullex-group/cli"
+    };
+    let url = `${this.cfg.baseUrl}${path}`;
+    const params = method === "GET" ? { ...query ?? {} } : flattenForSign(body);
+    if (requireAuth) {
+      if (!this.cfg.apiKey || !this.cfg.secret) {
+        throw new OneBullExError(
+          "API key and secret are required for authenticated requests",
+          "NO_AUTH"
+        );
+      }
+      const nonce = generateNonce();
+      const timestamp = Math.floor(Date.now() / 1e3);
+      const signature = sign({ params, nonce, timestamp, secret: this.cfg.secret });
+      headers["X-API-Key"] = this.cfg.apiKey;
+      headers["X-Nonce"] = nonce;
+      headers["X-Timestamp"] = String(timestamp);
+      headers["X-Signature"] = signature;
+      if (this.cfg.identify) {
+        headers["X-Identify"] = this.cfg.identify;
+        headers["Identify"] = this.cfg.identify;
+      }
+    }
+    if (method === "GET" && query && Object.keys(query).length > 0) {
+      const qs = new URLSearchParams();
+      for (const [k, v] of Object.entries(query)) qs.set(k, String(v));
+      url += `?${qs.toString()}`;
+    }
+    if (this.cfg.debug) {
+      console.error(
+        "[debug request]",
+        JSON.stringify(redactObject({ method, url, headers, body }))
+      );
+    }
+    const ctrl = new AbortController();
+    const t = setTimeout(() => ctrl.abort(), this.cfg.timeoutMs);
+    let res;
+    try {
+      res = await this.fetch(url, {
+        method,
+        headers,
+        body: body !== void 0 ? JSON.stringify(body) : void 0,
+        signal: ctrl.signal
+      });
+    } finally {
+      clearTimeout(t);
+    }
+    if (!res.ok) {
+      throw new OneBullExError(
+        `HTTP ${res.status} ${res.statusText}`,
+        res.status,
+        res.status,
+        path
+      );
+    }
+    const json = await res.json();
+    if (this.cfg.debug) {
+      console.error("[debug response]", JSON.stringify(redactObject(json)));
+    }
+    const returnCode = json.code ?? json.returnCode;
+    const msgInfo = json.msg ?? json.msgInfo ?? "";
+    if (returnCode !== 0 && returnCode !== "0") {
+      throw new OneBullExError(msgInfo, returnCode ?? "UNKNOWN", res.status, path);
+    }
+    return json.data;
+  }
+};
+
+export {
+  flattenForSign,
+  HttpClient
+};