@qomicex/cli 0.1.0

package/dist/lib/manifest.js

@@ -0,0 +1,93 @@
+// manifest.json 校验（手写极简 schema，等价于 zod 子集，零依赖）。
+// 字段蓝本：src/plugins/types.ts + store 上传校验（checkQplugin）。
+import { PERMISSION_CATALOG } from "./permissions.js";
+export const ID_RE = /^(?!.*\.\.)[a-z0-9]+([.-][a-z0-9]+)*$/;
+export const SEMVER_RE = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/;
+export const LAYERS = ['l0', 'l1', 'l2', 'l3'];
+export function checkId(id) {
+    const errs = [];
+    if (typeof id !== 'string')
+        return ['id 必须是字符串'];
+    if (id.length < 3 || id.length > 128)
+        errs.push('id 长度必须在 3-128 之间');
+    if (!ID_RE.test(id))
+        errs.push('id 必须是反向域名格式（小写字母/数字/点/连字符，禁止连续双点，如 com.example.demo）');
+    if (!id.includes('.'))
+        errs.push('id 建议使用反向域名格式（含至少一个点），当前形如 hello-plugin');
+    return errs;
+}
+export function validateManifest(raw) {
+    const issues = [];
+    const add = (severity, path, message) => issues.push({ severity, path, message });
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
+        return { ok: false, issues: [{ severity: 'error', path: 'manifest', message: 'manifest 必须是 JSON 对象' }] };
+    }
+    const m = raw;
+    for (const err of checkId(m.id))
+        add(err.startsWith('id 建议') ? 'warning' : 'error', 'id', err);
+    if (typeof m.name !== 'string' || !m.name.trim())
+        add('error', 'name', '缺少必填字段 name');
+    if (typeof m.version !== 'string') {
+        add('error', 'version', '缺少必填字段 version');
+    }
+    else if (!SEMVER_RE.test(m.version)) {
+        add('error', 'version', `version 不是合法 semver: ${m.version}`);
+    }
+    if (typeof m.minLauncherVersion !== 'string')
+        add('error', 'minLauncherVersion', '缺少必填字段 minLauncherVersion');
+    if (!Array.isArray(m.layers) || m.layers.length === 0) {
+        add('error', 'layers', 'layers 必须是数组且至少一项');
+    }
+    else {
+        for (const l of m.layers) {
+            if (!LAYERS.includes(l))
+                add('error', 'layers', `未知 layer: ${String(l)}（可用 ${LAYERS.join('/')}）`);
+        }
+        const hasFrontend = !!m.entry?.frontend;
+        if (!m.layers.includes('l2') && !m.layers.includes('l3') && hasFrontend) {
+            add('warning', 'layers', '声明了 frontend 入口但 layers 无 l2/l3，将无法渲染 UI');
+        }
+        if (!m.layers.includes('l2') && hasFrontend) {
+            add('warning', 'layers', 'UI 插件建议声明 l2（iframe 沙箱）');
+        }
+    }
+    if (!Array.isArray(m.permissions)) {
+        add('error', 'permissions', 'permissions 必须是数组');
+    }
+    else {
+        for (const p of m.permissions) {
+            if (!PERMISSION_CATALOG[p]) {
+                add('warning', 'permissions', `未知权限: ${String(p)}（启动器可能不认识）`);
+            }
+        }
+    }
+    const entry = m.entry;
+    if (entry === null || typeof entry !== 'object' || Array.isArray(entry)) {
+        add('error', 'entry', '缺少必填字段 entry（至少 frontend/backend/theme 之一）');
+    }
+    else {
+        const e = entry;
+        if (!e.frontend && !e.backend && !e.theme) {
+            add('error', 'entry', 'entry 至少需要 frontend/backend/theme 之一');
+        }
+        if (typeof e.frontend === 'string' && !e.frontend.endsWith('.html')) {
+            add('warning', 'entry.frontend', 'frontend 应指向 .html（如 dist/index.html）');
+        }
+    }
+    if (m.dependencies !== undefined && !Array.isArray(m.dependencies))
+        add('error', 'dependencies', 'dependencies 必须是数组');
+    if (m.render !== undefined && m.render !== 'inline' && m.render !== 'iframe') {
+        add('warning', 'render', "render 仅支持 'inline' / 'iframe'");
+    }
+    if (m.contributes !== undefined) {
+        const c = m.contributes;
+        if (c.menuItems !== undefined && !Array.isArray(c.menuItems))
+            add('error', 'contributes.menuItems', 'menuItems 必须是数组');
+        if (c.overlay !== undefined) {
+            const o = c.overlay;
+            if (typeof o.file !== 'string')
+                add('error', 'contributes.overlay.file', 'overlay.file 必须指定 .html 文件');
+        }
+    }
+    return { ok: issues.every((i) => i.severity !== 'error'), issues };
+}

package/dist/lib/permissions.js

@@ -0,0 +1,51 @@
+export const PERMISSION_CATALOG = {
+    'instance:read': { id: 'instance:read', risk: 'normal' },
+    'instance:write': { id: 'instance:write', risk: 'warning' },
+    'account:read': { id: 'account:read', risk: 'normal' },
+    'license:read': { id: 'license:read', risk: 'normal' },
+    'config:read': { id: 'config:read', risk: 'normal' },
+    'config:write': { id: 'config:write', risk: 'warning' },
+    'cache:access': { id: 'cache:access', risk: 'normal' },
+    'endpoint:discover': { id: 'endpoint:discover', risk: 'normal' },
+    'page:list': { id: 'page:list', risk: 'normal' },
+    'network:fetch': { id: 'network:fetch', risk: 'warning' },
+    'network:cors_proxy': { id: 'network:cors_proxy', risk: 'warning' },
+    'network:websocket': { id: 'network:websocket', risk: 'warning' },
+    'network:proxy': { id: 'network:proxy', risk: 'warning' },
+    'ui:inject_sidebar': { id: 'ui:inject_sidebar', risk: 'normal' },
+    'ui:inject_settings': { id: 'ui:inject_settings', risk: 'normal' },
+    'ui:picture_in_picture': { id: 'ui:picture_in_picture', risk: 'warning' },
+    'ui:sub_window': { id: 'ui:sub_window', risk: 'warning' },
+    'ui:context_menu': { id: 'ui:context_menu', risk: 'normal' },
+    'ui:toast': { id: 'ui:toast', risk: 'normal' },
+    'ui:navigate': { id: 'ui:navigate', risk: 'normal' },
+    'system:info': { id: 'system:info', risk: 'normal' },
+    'system:notification': { id: 'system:notification', risk: 'normal' },
+    'clipboard:read': { id: 'clipboard:read', risk: 'warning' },
+    'clipboard:write': { id: 'clipboard:write', risk: 'warning' },
+    'wasm:execute': { id: 'wasm:execute', risk: 'warning' },
+    'plugin:install': { id: 'plugin:install', risk: 'danger' },
+    'plugin:list': { id: 'plugin:list', risk: 'normal' },
+    'resource:read': { id: 'resource:read', risk: 'normal' },
+    'resource:write': { id: 'resource:write', risk: 'warning' },
+    'java:manage': { id: 'java:manage', risk: 'warning' },
+    'download:manage': { id: 'download:manage', risk: 'warning' },
+    'game:process': { id: 'game:process', risk: 'warning' },
+    'game:log': { id: 'game:log', risk: 'normal' },
+    'connector:host': { id: 'connector:host', risk: 'warning' },
+    'connector:scan': { id: 'connector:scan', risk: 'normal' },
+    'shell:execute': { id: 'shell:execute', risk: 'danger' },
+    'filesystem:read': { id: 'filesystem:read', risk: 'warning' },
+    'filesystem:write': { id: 'filesystem:write', risk: 'danger' },
+};
+// 桥方法 → 所需权限（与 src/plugins/sandbox.ts METHOD_PERMISSIONS 保持一致，供权限最小化扫描）
+export const METHOD_PERMISSIONS = {
+    getSettings: 'config:read', setSettings: 'config:write', setCache: 'cache:access', getCache: 'cache:access', callBackend: 'network:fetch', uploadPlugin: 'plugin:install', proxyFetch: 'network:cors_proxy', proxyFetchStream: 'network:cors_proxy',
+    registerMethod: 'config:write', callPlugin: 'network:fetch', callWasm: 'wasm:execute', listWasmPlugins: 'wasm:execute',
+    readText: 'filesystem:read', readBytes: 'filesystem:read', writeText: 'filesystem:write', writeBytes: 'filesystem:write', deleteFile: 'filesystem:write', execCommand: 'shell:execute',
+    navigate: 'config:read', showToast: 'ui:toast', getSystemInfo: 'system:info', openUrl: 'system:notification', listPlugins: 'plugin:list',
+    'overlay.create': 'ui:sub_window', 'overlay.show': 'ui:sub_window', 'overlay.hide': 'ui:sub_window',
+    'overlay.destroy': 'ui:sub_window', 'overlay.setHtml': 'ui:sub_window', 'overlay.setPosition': 'ui:sub_window',
+    'download.addTask': 'download:manage', 'download.progress': 'download:manage', 'download.cancel': 'download:manage', 'download.list': 'download:manage', 'download.registerInstall': 'instance:write',
+    'modpack.install': 'instance:write',
+};

package/dist/lib/project.js

@@ -0,0 +1,35 @@
+// 插件项目本地操作：manifest 读取 / dist 收集。
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { join, relative } from 'node:path';
+export function readManifestFile(file) {
+    const text = readFileSync(file, 'utf8');
+    return JSON.parse(text);
+}
+/** 收集目录下全部文件为 zip 条目（prefix 为包内前缀，路径用 /）。 */
+export function collectDir(root, prefix) {
+    const out = [];
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = readdirSync(dir);
+        }
+        catch {
+            return;
+        }
+        for (const name of entries) {
+            const p = join(dir, name);
+            const st = statSync(p);
+            if (st.isDirectory())
+                walk(p);
+            else
+                out.push({ name: `${prefix}${relative(root, p).split('\\').join('/')}`, data: readFileSync(p) });
+        }
+    };
+    walk(root);
+    return out;
+}
+export function assertProjectRoot(cwd) {
+    if (cwd === '' || cwd === undefined)
+        return '';
+    return cwd;
+}

package/dist/lib/scan.js

@@ -0,0 +1,104 @@
+// verify 的静态启发式扫描：权限最小化 + 主线程长循环告警。
+// 均为轻量文本/正则，不做真 AST（提案允许"简单启发式即可"）。
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { METHOD_PERMISSIONS } from "./permissions.js";
+const SRC_EXTS = /\.(ts|tsx|js|jsx|mjs|cjs|html)$/;
+/** 递归收集插件源码文件（跳过 node_modules/dist/release/.staging）。 */
+export function collectSourceFiles(root, maxFiles = 400) {
+    const out = [];
+    const walk = (dir) => {
+        if (out.length >= maxFiles)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(dir);
+        }
+        catch {
+            return;
+        }
+        for (const name of entries) {
+            if (name === 'node_modules' || name === 'dist' || name === 'release' || name.startsWith('.staging'))
+                continue;
+            const p = join(dir, name);
+            try {
+                const st = statSync(p);
+                if (st.isDirectory())
+                    walk(p);
+                else if (st.size < 1_000_000 && SRC_EXTS.test(name))
+                    out.push(p);
+            }
+            catch {
+                /* ignore unreadable */
+            }
+        }
+    };
+    walk(root);
+    return out;
+}
+/** 提取源码里用到的桥方法名（.call('x') 与 __PLUGIN_API__.x 两种形态）。 */
+function usedMethods(content) {
+    const found = new Set();
+    const callRe = /\.call\(\s*['"]([a-zA-Z0-9_.]+)['"]/g;
+    let m;
+    while ((m = callRe.exec(content)) !== null)
+        found.add(m[1]);
+    const directRe = /__PLUGIN_API__\.([a-zA-Z0-9_]+)\(/g;
+    while ((m = directRe.exec(content)) !== null) {
+        const name = m[1];
+        if (name in METHOD_PERMISSIONS)
+            found.add(name);
+    }
+    const dottedRe = /__PLUGIN_API__\.(download|overlay|modpack)\.([a-zA-Z0-9_]+)\(/g;
+    while ((m = dottedRe.exec(content)) !== null)
+        found.add(`${m[1]}.${m[2]}`);
+    return found;
+}
+export function checkPermissions(root, declared) {
+    const findings = [];
+    const used = new Set();
+    for (const file of collectSourceFiles(root)) {
+        try {
+            for (const method of usedMethods(readFileSync(file, 'utf8')))
+                used.add(method);
+        }
+        catch {
+            /* skip */
+        }
+    }
+    const required = new Set();
+    for (const method of used) {
+        const perm = METHOD_PERMISSIONS[method];
+        if (perm)
+            required.add(perm);
+    }
+    const missing = [...required].filter((p) => !declared.includes(p));
+    const unused = declared.filter((p) => !required.has(p));
+    for (const p of missing) {
+        findings.push({ severity: 'error', message: `源码调用了桥方法，但未声明所需权限 ${p}（运行时会被启动器拒绝）` });
+    }
+    for (const p of unused) {
+        findings.push({ severity: 'error', message: `声明了权限 ${p} 但源码未使用（最小权限原则，建议移除）` });
+    }
+    return { findings, unused, missing };
+}
+/** 长循环 / 无界定时器启发式：命中即告警（不阻断），提示放到 Worker/WASM/后端。 */
+export function checkLongLoops(root) {
+    const findings = [];
+    const patterns = [
+        [/while\s*\(\s*(?:true|1)\s*\)/, '检测到 while(true) 同步死循环，会冻结整个启动器主线程（即使在内联/iframe 内）'],
+        [/for\s*\(\s*;\s*;\s*\)/, '检测到 for(;;) 无退出条件同步死循环'],
+        [/setInterval\s*\(/, '检测到 setInterval 高频轮询；请确保有 clearInterval 且间隔合理（默认建议 ≥500ms）'],
+    ];
+    for (const file of collectSourceFiles(root)) {
+        const content = readFileSync(file, 'utf8');
+        for (const [re, msg] of patterns) {
+            const m = re.exec(content);
+            if (m) {
+                const lineNo = content.slice(0, m.index).split('\n').length;
+                findings.push({ severity: 'warning', message: msg, file: `${relative(root, file)}:${lineNo}` });
+            }
+        }
+    }
+    return findings;
+}

package/dist/lib/signature.js

@@ -0,0 +1,171 @@
+// 插件包 Ed25519 签名（ADR-050 三级信任链）。
+// 规范化与 store `src/lib/signature.ts` / launcher `plugin_signature.rs` 字节级一致：
+//   signedHash = SHA-256( canonicalJson({ manifest: sha256Hex(manifest.json 原始字节),
+//                                        files: [{path, sha256}...按 path 排序] }) )
+//   signature  = Ed25519(私钥, 同载荷 UTF-8 字节)
+// 用 Node WebCrypto（node >= 20），零第三方依赖。
+export const SIGNATURE_FILE = 'signature.json';
+export const CERT_FILE = 'signature.cert.json';
+export const ALG = 'Ed25519';
+/** 商店签名根公钥（raw base64），与 launcher plugin_signature.rs ROOT_PUBLIC_KEY_B64 一致 */
+export const STORE_ROOT_PUBLIC_KEY_B64 = 'hNoXOazEkdTRoxBra8ABlCWXhy16S7rM5ZmEDa+GmnE=';
+/** Ed25519 PKCS#8 DER 固定前缀（前 16 字节），后接 32 字节 seed */
+const ED25519_PKCS8_PREFIX = Uint8Array.from([0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x04, 0x22, 0x04, 0x20]);
+export function bytesToBase64(bytes) {
+    return Buffer.from(bytes).toString('base64');
+}
+export function base64ToBytes(b64) {
+    try {
+        return new Uint8Array(Buffer.from(b64, 'base64'));
+    }
+    catch {
+        return null;
+    }
+}
+/** 递归按键排序、无空白 JSON（键序对哈希无影响，保持确定性） */
+export function canonicalJson(value) {
+    if (value === null || typeof value !== 'object') {
+        if (typeof value === 'string')
+            return JSON.stringify(value);
+        return String(value);
+    }
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`).join(',')}}`;
+}
+function toHex(bytes) {
+    return [...bytes].map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+export async function sha256HexOf(bytes) {
+    const digest = await crypto.subtle.digest('SHA-256', bytes);
+    return toHex(new Uint8Array(digest));
+}
+/** 签名待签载荷：{ manifest: sha256Hex(manifest.json 原始字节), files: 按 path 排序 } */
+export async function signedPayloadBytes(entries) {
+    const manifestBytes = entries['manifest.json'];
+    if (!manifestBytes)
+        throw new Error('包内缺少 manifest.json，无法签名');
+    const files = [];
+    for (const name of Object.keys(entries)) {
+        if (name === SIGNATURE_FILE || name === CERT_FILE)
+            continue;
+        files.push({ path: name, sha256: await sha256HexOf(entries[name]) });
+    }
+    files.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    return new TextEncoder().encode(canonicalJson({ manifest: await sha256HexOf(manifestBytes), files }));
+}
+/**
+ * 解析私钥 → PKCS#8 DER。支持：PKCS#8 PEM、PKCS#8 DER base64、raw 32 字节 seed base64。
+ */
+export function parsePrivateKey(input) {
+    let pem = input.trim();
+    if (pem.includes('-----BEGIN')) {
+        const body = pem.replace(/-----BEGIN[^-]+-----/, '').replace(/-----END[^-]+-----/, '').replace(/\s+/g, '');
+        const der = base64ToBytes(body);
+        if (der)
+            return der;
+    }
+    // 可能是 DER base64（45-48 字节，含前缀）或 raw seed base64（32 字节）
+    const maybe = base64ToBytes(pem);
+    if (!maybe || maybe.length === 0)
+        throw new Error('无法解析私钥：只支持 PKCS#8 PEM / DER base64 / raw 32 字节 seed base64');
+    if (maybe.length === 32) {
+        const der = new Uint8Array(48);
+        der.set(ED25519_PKCS8_PREFIX, 0);
+        der.set(maybe, 16);
+        return der;
+    }
+    if (maybe.length === 45 || maybe.length === 48)
+        return maybe;
+    throw new Error(`私钥长度异常（${maybe.length} 字节），应为 32（raw seed）或 45/48（PKCS#8 DER）`);
+}
+async function signingKey(der) {
+    return crypto.subtle.importKey('pkcs8', der, { name: ALG }, true, ['sign']);
+}
+export async function derivePublicKey(privDer) {
+    // WebCrypto 不支持从私钥 exportKey('raw')，改用 node:crypto：PKCS#8 → 私钥对象 → 公钥 → SPKI 末 32 字节 raw。
+    const { createPrivateKey, createPublicKey } = await import('node:crypto');
+    const priv = createPrivateKey({ key: privDer, format: 'der', type: 'pkcs8' });
+    const pub = createPublicKey(priv);
+    const spki = pub.export({ format: 'der', type: 'spki' });
+    const raw = spki.subarray(spki.length - 32);
+    return bytesToBase64(new Uint8Array(raw));
+}
+async function signBytes(privDer, msg) {
+    const key = await signingKey(privDer);
+    const sig = await crypto.subtle.sign({ name: ALG }, key, msg);
+    return bytesToBase64(new Uint8Array(sig));
+}
+/**
+ * 对包内全部条目生成签名文件。
+ * @param certJson 商店根钥签发的开发者证书 JSON（POST /developer/keys 返回值），
+ *                 无 cert 时仅生成 signature.json（pack 场景，publish 会走完整证书链）。
+ */
+export async function signPackage(entries, privDer, keyId, certJson) {
+    const payload = await signedPayloadBytes(entries);
+    const signedHash = await sha256HexOf(payload);
+    const signature = await signBytes(privDer, payload);
+    const sigJson = { alg: ALG, signedHash, signerKeyId: keyId, signature };
+    const out = {};
+    out[SIGNATURE_FILE] = new TextEncoder().encode(JSON.stringify(sigJson));
+    if (certJson)
+        out[CERT_FILE] = new TextEncoder().encode(certJson);
+    return out;
+}
+async function verifyEd25519(pubKeyB64, msg, sigB64) {
+    const pubBytes = base64ToBytes(pubKeyB64);
+    const sigBytes = base64ToBytes(sigB64);
+    if (!pubBytes || !sigBytes || pubBytes.length !== 32 || sigBytes.length !== 64)
+        return false;
+    try {
+        const key = await crypto.subtle.importKey('raw', pubBytes, { name: ALG }, false, ['verify']);
+        return await crypto.subtle.verify({ name: ALG }, key, sigBytes, msg);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * 验包（与 store verifyPackageSignature 同逻辑）：缺少签名/证书、根钥验证失败、包体签名失败、哈希不符 → 拒绝。
+ */
+export async function verifyPackageSignature(entries, rootPubKeyB64 = STORE_ROOT_PUBLIC_KEY_B64) {
+    const sigRaw = entries[SIGNATURE_FILE];
+    const certRaw = entries[CERT_FILE];
+    if (!sigRaw || !certRaw) {
+        return { ok: false, code: 'signature_required', reason: '缺少 signature.json / signature.cert.json（未签名）' };
+    }
+    let sig;
+    let cert;
+    try {
+        sig = JSON.parse(new TextDecoder().decode(sigRaw));
+        cert = JSON.parse(new TextDecoder().decode(certRaw));
+    }
+    catch {
+        return { ok: false, code: 'signature_invalid', reason: '签名文件解析失败' };
+    }
+    if (sig.alg !== ALG || cert.alg !== ALG)
+        return { ok: false, code: 'signature_invalid', reason: '不支持的签名算法' };
+    if (cert.keyId !== sig.signerKeyId)
+        return { ok: false, code: 'signature_invalid', reason: '证书与签名 signerKeyId 不一致' };
+    const certBody = canonicalJson({
+        alg: cert.alg,
+        keyId: cert.keyId,
+        developerId: cert.developerId,
+        developerName: cert.developerName,
+        publicKey: cert.publicKey,
+        issuedAt: cert.issuedAt,
+    });
+    const certSigOk = await verifyEd25519(rootPubKeyB64, new TextEncoder().encode(certBody), cert.signature);
+    if (!certSigOk)
+        return { ok: false, code: 'signature_invalid', reason: '签名证书无效（商店根钥验证失败）' };
+    const payload = await signedPayloadBytes(entries);
+    const sigOk = await verifyEd25519(cert.publicKey, payload, sig.signature);
+    if (!sigOk)
+        return { ok: false, code: 'signature_invalid', reason: '包体签名验证失败（开发者密钥不符或包被篡改）' };
+    const recomputed = await sha256HexOf(payload);
+    if (recomputed !== sig.signedHash)
+        return { ok: false, code: 'signature_invalid', reason: '签名哈希与包内容不匹配' };
+    return { ok: true, cert };
+}

package/dist/lib/store.js

@@ -0,0 +1,100 @@
+// 商店 API 客户端（只读参考契约，不改 store 接口）。
+// API base: https://plugins.qomicex.top/api/v1（可用 QOMICEX_STORE_API 覆盖，本地测试指向 wrangler dev）
+import { sleep } from "./io.js";
+export const DEFAULT_API_BASE = 'https://plugins.qomicex.top/api/v1';
+export class StoreApiError extends Error {
+    status;
+    code;
+    constructor(status, message, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+async function request(base, path, init, token) {
+    const headers = new Headers(init?.headers);
+    if (token)
+        headers.set('Authorization', `Bearer ${token}`);
+    let res;
+    try {
+        res = await fetch(`${base}${path}`, { ...init, headers });
+    }
+    catch {
+        throw new StoreApiError(0, `无法连接商店 ${base}${path}（网络错误）`);
+    }
+    const text = await res.text();
+    let body = null;
+    try {
+        body = text ? JSON.parse(text) : null;
+    }
+    catch {
+        body = text;
+    }
+    if (!res.ok) {
+        const errBody = body;
+        throw new StoreApiError(res.status, errBody?.message ?? errBody?.error ?? `HTTP ${res.status}`, errBody?.code);
+    }
+    return body;
+}
+/** 发起设备流登录（RFC 8628）。 */
+export async function requestDeviceCode(base) {
+    return request(base, '/auth/device/code', { method: 'POST' });
+}
+/** 轮询设备流换取访问令牌。 */
+export async function pollDeviceLogin(base, code, onTick) {
+    const deadline = Date.now() + code.expiresIn * 1000;
+    let tried = 0;
+    for (;;) {
+        if (Date.now() > deadline)
+            throw new StoreApiError(0, '设备授权超时，请重新发起 qomicex publish');
+        await sleep(code.interval * 1000);
+        tried++;
+        onTick?.(tried);
+        const r = await request(base, '/auth/device/token', { method: 'POST', body: JSON.stringify({ deviceCode: code.deviceCode }), headers: { 'Content-Type': 'application/json' } });
+        if (r.status === 'ok' && r.accessToken) {
+            return { accessToken: r.accessToken, refreshToken: r.refreshToken ?? '', user: r.user ?? { id: '', username: '?' } };
+        }
+        if (r.status !== 'pending')
+            throw new StoreApiError(0, `设备授权失败: ${JSON.stringify(r)}`);
+    }
+}
+/** 我名下/我参与的插件（store 用 slug 查询，上传用行 id）。 */
+export async function fetchMinePlugins(base, token) {
+    const r = await request(base, '/plugins/mine', {}, token);
+    return r.items ?? [];
+}
+/** 新建插件（store 返回 201 {plugin:{id}}），slug 占用抛 409。 */
+export async function createPlugin(base, token, input) {
+    const r = await request(base, '/plugins/', {
+        method: 'POST',
+        body: JSON.stringify({
+            slug: input.slug,
+            name: input.name,
+            description: input.description ?? '',
+            category: input.category ?? 'tool',
+            tags: input.tags ?? [],
+            ...(input.orgId ? { orgId: input.orgId } : {}),
+        }),
+        headers: { 'Content-Type': 'application/json' },
+    }, token);
+    return { id: r.plugin?.id ?? r.id ?? '' };
+}
+/** 注册/替换开发者签名公钥，返回 keyId + 商店根钥签发的证书。 */
+export async function registerDevKey(base, token, publicKey) {
+    const r = await request(base, '/developer/keys', {
+        method: 'POST',
+        body: JSON.stringify({ publicKey }),
+        headers: { 'Content-Type': 'application/json' },
+    }, token);
+    if (!r.keyId || !r.cert)
+        throw new StoreApiError(0, '注册签名公钥响应缺少 keyId/cert');
+    return r;
+}
+/** 上传插件版本（multipart file + 可选 changelog）。 */
+export async function uploadVersion(base, token, pluginId, fileBytes, changelog) {
+    const form = new FormData();
+    form.append('file', new Blob([fileBytes], { type: 'application/zip' }), 'plugin.qplugin');
+    if (changelog)
+        form.append('changelog', changelog);
+    return request(base, `/plugins/${encodeURIComponent(pluginId)}/versions`, { method: 'POST', body: form }, token);
+}