@restoai/resto-datacli 0.1.12 → 0.2.1

package/dist/commands/auth.js

@@ -6,19 +6,66 @@ import { AuthStore } from "../config/auth-store.js";
 import { failJson, printJson } from "./json-command.js";
 const DEFAULT_CHINA_LANGUAGE_CODE = "zh_CN";
 const DEFAULT_CHINA_TIMEZONE = "Asia/Shanghai";
-const DEFAULT_CHINA_BASE_URL = "https://bo.restosuite.cn";
-const PASSWORD_LOGIN_PATH = "/loginApi/loginForToken";
+const DEFAULT_AUTH_GATEWAY_BASE_URL = "https://cli.test.restosuite.ai";
+const DEFAULT_AUTH_GATEWAY_PLAT = "cli";
+const LOGIN_FOR_TOKEN_PATH = "/loginApi/loginForToken";
+const PHONE_CAPTCHA_PATH = "/vulcan/captcha/phoneCaptcha";
 const PROFILE_INFO_PATH = "/vulcan/profile/getInfo";
+const ORGANIZATION_VIEW_PATH = "/vulcan/employee/queryOrgView";
 const REPORT_SHOP_ORG_TYPE_LIST = [7];
+const ORGANIZATION_ID_FIELDS = [
+    "organizationId",
+    "orgId",
+    "corporationOrgId",
+    "brandId",
+    "orgShopId",
+    "franchiseeOrgId",
+    "orgFranchiseeId"
+];
+const PHONE_CAPTCHA_TYPE_VERIFY_CODE = "1";
+const PHONE_CAPTCHA_STEP_LOGIN = "1";
+const DEFAULT_PHONE_AREA_CODE = "86";
+const DEFAULT_PHONE_REGION = "CN";
+const STEP_CHECK_MOBILE = "StepCheckMobile";
 const STEP_CHECK_EMAIL = "StepCheckEmail";
 const STEP_EMAIL = "StepEmail";
+const STEP_MOBILE = "StepMobile";
 const STEP_SELECT_TENANT = "StepSelectTenant";
-const BO_PASSWORD_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+const AUTH_GATEWAY_PASSWORD_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
 MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAo+oABY2n4ff6+ahItStjvnYIPYswCwqhIHMw8IZyWVBv3ygiIbv6Cj2rteiNTQtPZZN/Q9dyASSE7FSaYsc6U/TDYLV40XsywGp4lIzuoq4CTf3Z71exdagUiy5ZAB4Wp+0RUpv8BAA97uLskt/LGLz/5SP66dmZBHkw8NkYppn4VTsLo9JWOGg8PXr3tYs9BDnYh7PiqVcNaS1POM3DQoIMda4mmLez/5nL8SW6KAdKniPEjZFVj3w1ZTeiT4TjCpZaVfVQDpLy0Vs0mKfIf63QXI+wjuxuvEcBcKzM9UAfX+I6gVnSwjRNu2U7HJmux/1vitmT4i/OPS7ZNMTnoQLJm1oWDivr3/JLnyMJKoAmIWUXgWnkb7S0lGA3xF4OdcizRlZyZFLhczNaq6D/ZTcQxu1DfU2/kmNh5JTZgC+50rTb4wxiaIci8cxT4hZsdkUfhE41k/Q7TNGVJZnuQHKRMPC2W10gQcJWG2/gLBv55OB98DE3aE7HVKa3QMVQybm/YjMtt8V+7BhsGiQBTjtVYNdiAHn9brfkhRESxfQ+boIl7n7V8DyMzMnhhZ6K65+whvg8mho5sJCOuI+u+9SCy0WhgpEcZxVG1hxC3oiLkGix0zsH/xEvdCd9xo2HNUXzrBy0Yt4C0VbpKQaD57ZM5vlVNP1ZwwelJi9K5XsCAwEAAQ==
 -----END PUBLIC KEY-----`;
 function trimTrailingSlash(value) {
     return value.replace(/\/+$/, "");
 }
+function normalizeOptionalString(value) {
+    const trimmed = value?.trim();
+    return trimmed ? trimmed : undefined;
+}
+function appendQueryParam(url, key, value) {
+    const normalizedValue = normalizeOptionalString(value);
+    if (!normalizedValue) {
+        return url;
+    }
+    const hashIndex = url.indexOf("#");
+    const base = hashIndex >= 0 ? url.slice(0, hashIndex) : url;
+    const hash = hashIndex >= 0 ? url.slice(hashIndex) : "";
+    if (new RegExp(`(^|[?&])${key}=`).test(base)) {
+        return url;
+    }
+    const separator = base.includes("?") ? "&" : "?";
+    return `${base}${separator}${encodeURIComponent(key)}=${encodeURIComponent(normalizedValue)}${hash}`;
+}
+function authGatewayUrl(baseUrl, path, plat) {
+    return appendQueryParam(`${trimTrailingSlash(baseUrl)}${path}`, "plat", plat);
+}
+function profileFromLoginOptions(options, profile) {
+    const plat = normalizeOptionalString(options.plat);
+    return {
+        baseUrl: options.baseUrl,
+        ...(plat ? { plat } : {}),
+        ...profile
+    };
+}
 function asRecord(value) {
     return value && typeof value === "object" ? value : undefined;
 }
@@ -54,9 +101,9 @@ function extractLoginError(payload) {
     const root = asRecord(payload);
     return firstString(root?.msg, root?.message, root?.errorMessage);
 }
-function encryptBoPassword(password) {
+function encryptGatewayPassword(password) {
     return publicEncrypt({
-        key: BO_PASSWORD_PUBLIC_KEY,
+        key: AUTH_GATEWAY_PASSWORD_PUBLIC_KEY,
         padding: cryptoConstants.RSA_PKCS1_OAEP_PADDING,
         oaepHash: "sha256"
     }, Buffer.from(password)).toString("base64");
@@ -72,22 +119,6 @@ function parseIntegerList(value) {
     const numbers = parts.map((part) => Number.parseInt(part, 10));
     return numbers.every((number) => Number.isInteger(number) && number > 0) ? numbers : undefined;
 }
-function jwtPayload(token) {
-    const parts = token.split(".");
-    if (parts.length < 2) {
-        return undefined;
-    }
-    try {
-        return asRecord(JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8")));
-    }
-    catch {
-        return undefined;
-    }
-}
-function inferEmployeeCodeFromToken(token) {
-    const payload = jwtPayload(token);
-    return firstString(payload?.employeeCode, payload?.loginId, payload?.principalUid);
-}
 function hasCompleteReportContext(reportContext) {
     return Boolean(reportContext?.employeeCode &&
         reportContext.organizationId &&
@@ -97,7 +128,7 @@ function hasCompleteReportContext(reportContext) {
 }
 function buildReportContext(profile, options) {
     const orgTypeList = options.orgTypeList ? parseIntegerList(options.orgTypeList) : profile.reportContext?.orgTypeList;
-    const employeeCode = options.employeeCode ?? profile.reportContext?.employeeCode ?? inferEmployeeCodeFromToken(profile.token);
+    const employeeCode = options.employeeCode ?? profile.reportContext?.employeeCode;
     const organizationId = options.organizationId ?? profile.reportContext?.organizationId;
     const organizationType = options.organizationType ?? profile.reportContext?.organizationType;
     const reportContext = {
@@ -108,20 +139,41 @@ function buildReportContext(profile, options) {
     };
     return Object.keys(reportContext).length > 0 ? reportContext : undefined;
 }
-function extractProfileReportContext(payload) {
+function extractProfileIdentity(payload) {
     const data = asRecord(asRecord(payload)?.data) ?? asRecord(payload);
     const employeeCode = firstString(data?.employeeCode, data?.code, data?.loginId, data?.principalUid);
+    const employeeId = firstString(data?.employeeId, data?.id, data?.userId);
     const organizationId = firstString(data?.organizationId, data?.orgId);
-    const organizationType = firstString(data?.organizationType, data?.orgType, data?.type);
+    const organizationType = firstString(data?.organizationType, data?.orgType);
+    return { employeeCode, employeeId, organizationId, organizationType };
+}
+function extractProfileReportContext(payload, resolvedOrganizationType) {
+    const identity = extractProfileIdentity(payload);
+    const organizationType = resolvedOrganizationType ?? identity.organizationType;
     const reportContext = {
-        ...(employeeCode ? { employeeCode } : {}),
-        ...(organizationId ? { organizationId } : {}),
+        ...(identity.employeeCode ? { employeeCode: identity.employeeCode } : {}),
+        ...(identity.organizationId ? { organizationId: identity.organizationId } : {}),
         ...(organizationType ? { organizationType } : {}),
-        ...(organizationId ? { orgTypeList: REPORT_SHOP_ORG_TYPE_LIST } : {})
+        ...(identity.organizationId ? { orgTypeList: REPORT_SHOP_ORG_TYPE_LIST } : {})
     };
     return Object.keys(reportContext).length > 0 ? reportContext : undefined;
 }
-function extractPasswordLoginProfile(payload, fallbackCorporationId) {
+function resolveOrganizationType(payload, organizationId) {
+    const data = asRecord(asRecord(payload)?.data) ?? asRecord(payload);
+    const matchingTypes = new Set();
+    for (const record of collectRecords(data)) {
+        const matchesOrganization = ORGANIZATION_ID_FIELDS.some((fieldName) => firstString(record[fieldName]) === organizationId);
+        if (!matchesOrganization) {
+            continue;
+        }
+        const organizationType = firstString(record.orgType, record.organizationType);
+        if (organizationType) {
+            matchingTypes.add(organizationType);
+        }
+    }
+    return matchingTypes.size === 1 ? [...matchingTypes][0] : undefined;
+}
+function extractLoginProfile(payload, fallbackCorporationId) {
     const records = collectRecords(payload);
     const token = records.reduce((current, record) => current ?? firstString(record.token, record.accessToken, record.access_token), undefined);
     const employeeCode = records.reduce((current, record) => current ?? firstString(record.employeeCode, record.loginId, record.principalUid), undefined);
@@ -133,8 +185,35 @@ function withReportContext(profile, options) {
     const reportContext = buildReportContext(profile, options);
     return reportContext ? { ...profile, reportContext } : profile;
 }
-async function fetchProfileReportContext(profile, fetchImpl) {
-    const response = await fetchImpl(`${trimTrailingSlash(profile.baseUrl)}${PROFILE_INFO_PATH}`, {
+async function fetchOrganizationType(profile, fetchImpl, employeeId, organizationId) {
+    const response = await fetchImpl(authGatewayUrl(profile.baseUrl, ORGANIZATION_VIEW_PATH, profile.plat), {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            "Content-Type": "application/json",
+            "Corporation-Id": profile.corporationId,
+            "Vulcan-Token": profile.token,
+            "Language-Code": profile.languageCode,
+            "Accept-Timezone": profile.timezone
+        },
+        body: JSON.stringify({ id: employeeId, corporationId: profile.corporationId })
+    });
+    if (!response.ok) {
+        throw new Error(`Organization context request failed: ${response.status} ${response.statusText}`.trim());
+    }
+    const payload = await response.json();
+    const code = firstString(asRecord(payload)?.code);
+    if (code && code !== "000") {
+        throw new Error(extractLoginError(payload) ?? `Organization context request failed with code ${code}.`);
+    }
+    const organizationType = resolveOrganizationType(payload, organizationId);
+    if (!organizationType) {
+        throw new Error("Current organization type could not be resolved from the organization view.");
+    }
+    return organizationType;
+}
+async function fetchProfileReportContext(profile, fetchImpl, organizationTypeOverride) {
+    const response = await fetchImpl(authGatewayUrl(profile.baseUrl, PROFILE_INFO_PATH, profile.plat), {
         method: "GET",
         headers: {
             Accept: "application/json",
@@ -145,43 +224,68 @@ async function fetchProfileReportContext(profile, fetchImpl) {
         }
     });
     if (!response.ok) {
-        return undefined;
+        throw new Error(`Profile request failed: ${response.status} ${response.statusText}`.trim());
     }
     const payload = await response.json();
     const code = firstString(asRecord(payload)?.code);
     if (code && code !== "000") {
-        return undefined;
+        throw new Error(extractLoginError(payload) ?? `Profile request failed with code ${code}.`);
+    }
+    const identity = extractProfileIdentity(payload);
+    let organizationType = organizationTypeOverride ?? identity.organizationType;
+    if (!organizationType && identity.organizationId) {
+        if (!identity.employeeId) {
+            throw new Error("Profile did not contain an employee id for organization resolution.");
+        }
+        organizationType = await fetchOrganizationType(profile, fetchImpl, identity.employeeId, identity.organizationId);
     }
-    return extractProfileReportContext(payload);
+    return extractProfileReportContext(payload, organizationType);
 }
 async function hydrateReportContext(profile, options, fetchImpl) {
     const initialProfile = withReportContext(profile, options);
     if (hasCompleteReportContext(initialProfile.reportContext)) {
         return initialProfile;
     }
-    try {
-        const profileReportContext = await fetchProfileReportContext(profile, fetchImpl);
-        const hydratedProfile = profileReportContext
-            ? { ...profile, reportContext: { ...(profile.reportContext ?? {}), ...profileReportContext } }
-            : profile;
-        return withReportContext(hydratedProfile, options);
-    }
-    catch {
-        return initialProfile;
-    }
+    const profileReportContext = await fetchProfileReportContext(profile, fetchImpl, options.organizationType);
+    const hydratedProfile = profileReportContext
+        ? { ...profile, reportContext: { ...(profile.reportContext ?? {}), ...profileReportContext } }
+        : profile;
+    return withReportContext(hydratedProfile, options);
 }
 async function loginWithPassword(options, fetchImpl) {
     if (!options.baseUrl) {
-        throw new Error("Password login requires --base-url.");
+        throw new Error("Username/password login requires --base-url.");
     }
     const loginOptions = { ...options, baseUrl: options.baseUrl };
     if (options.loginFlowCode || options.loginStepName) {
         return await loginWithExplicitPasswordFlow(loginOptions, fetchImpl);
     }
-    return await loginWithBoPasswordSteps(loginOptions, fetchImpl);
+    return await loginWithGatewayPasswordSteps(loginOptions, fetchImpl);
 }
 async function postLoginForToken(options, fetchImpl, body) {
-    const response = await fetchImpl(`${trimTrailingSlash(options.baseUrl)}${PASSWORD_LOGIN_PATH}`, {
+    const response = await fetchImpl(authGatewayUrl(options.baseUrl, LOGIN_FOR_TOKEN_PATH, options.plat), {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            "Content-Type": "application/json",
+            "Language-Code": options.languageCode,
+            "Accept-Timezone": options.timezone
+        },
+        body: JSON.stringify(body)
+    });
+    const payload = await response.json();
+    if (!response.ok) {
+        throw new Error(`Login request failed: ${response.status} ${response.statusText}`.trim());
+    }
+    const root = asRecord(payload);
+    const code = firstString(root?.code);
+    if (code && code !== "000") {
+        throw new Error(extractLoginError(payload) ?? `Login failed with code ${code}.`);
+    }
+    return payload;
+}
+async function postPhoneCaptcha(options, fetchImpl, body) {
+    const response = await fetchImpl(authGatewayUrl(options.baseUrl, PHONE_CAPTCHA_PATH, options.plat), {
         method: "POST",
         headers: {
             Accept: "application/json",
@@ -193,15 +297,80 @@ async function postLoginForToken(options, fetchImpl, body) {
     });
     const payload = await response.json();
     if (!response.ok) {
-        throw new Error(`Password login request failed: ${response.status} ${response.statusText}`.trim());
+        throw new Error(`Phone dynamic code request failed: ${response.status} ${response.statusText}`.trim());
     }
     const root = asRecord(payload);
     const code = firstString(root?.code);
     if (code && code !== "000") {
-        throw new Error(extractLoginError(payload) ?? `Password login failed with code ${code}.`);
+        throw new Error(extractLoginError(payload) ?? `Phone dynamic code request failed with code ${code}.`);
     }
     return payload;
 }
+function normalizePhoneAreaCode(value) {
+    return normalizeOptionalString(value) ?? DEFAULT_PHONE_AREA_CODE;
+}
+function normalizePhoneRegion(value) {
+    return normalizeOptionalString(value) ?? DEFAULT_PHONE_REGION;
+}
+function maskPhoneNumber(phoneNumber) {
+    const trimmed = phoneNumber.trim();
+    return trimmed.length > 7 ? `${trimmed.slice(0, 3)}****${trimmed.slice(-4)}` : trimmed;
+}
+function formatPhoneCodeSendError(error) {
+    const message = error instanceof Error ? error.message : "验证码发送失败";
+    return message.replace(/^Phone dynamic code request failed:\s*/, "").trim() || "验证码发送失败";
+}
+function buildPhoneIdentity(options) {
+    const phoneNumber = normalizeOptionalString(options.phoneNumber);
+    if (!phoneNumber) {
+        throw new Error("Phone login requires --phone-number.");
+    }
+    return {
+        phoneAreaCode: normalizePhoneAreaCode(options.phoneAreaCode),
+        phoneNumber,
+        phoneRegion: normalizePhoneRegion(options.phoneRegion)
+    };
+}
+async function sendPhoneDynamicCode(options, fetchImpl) {
+    if (!options.corporationId) {
+        throw new Error("Phone login requires --corporation-id before sending a dynamic code.");
+    }
+    const phone = buildPhoneIdentity(options);
+    await postPhoneCaptcha(options, fetchImpl, {
+        corporationId: options.corporationId,
+        captchaType: PHONE_CAPTCHA_TYPE_VERIFY_CODE,
+        step: PHONE_CAPTCHA_STEP_LOGIN,
+        phone: phone.phoneNumber,
+        phoneAreaCode: phone.phoneAreaCode,
+        region: phone.phoneRegion
+    });
+}
+async function collectInteractivePhoneDynamicCode(prompt, phoneOptions, fetchImpl) {
+    let action = await prompt.select(`验证码发送到 ${maskPhoneNumber(phoneOptions.phoneNumber ?? "")}`, [
+        { value: "send", label: "发送验证码" },
+        { value: "manual", label: "我已获取验证码，继续输入" },
+        { value: "cancel", label: "取消登录" }
+    ]);
+    while (action === "send" || action === "retry") {
+        try {
+            await sendPhoneDynamicCode(phoneOptions, fetchImpl);
+            prompt.message?.("验证码已发送，请输入短信验证码。");
+            break;
+        }
+        catch (error) {
+            prompt.message?.(`发送验证码失败：${formatPhoneCodeSendError(error)}`);
+            action = await prompt.select("验证码发送失败", [
+                { value: "retry", label: "重试发送" },
+                { value: "manual", label: "我已获取验证码，继续输入" },
+                { value: "cancel", label: "取消登录" }
+            ]);
+        }
+    }
+    if (action === "cancel") {
+        throw new Error("Interactive login canceled.");
+    }
+    return await prompt.secret("验证码");
+}
 function extractFirstNextStep(payload) {
     const data = asRecord(asRecord(payload)?.data);
     const nextSteps = data?.nextSteps;
@@ -220,7 +389,7 @@ function extractNextStepTicket(payload) {
 }
 function hasCompletedLogin(payload) {
     const data = asRecord(asRecord(payload)?.data);
-    return data?.hasNextStep === false || Boolean(extractPasswordLoginProfile(payload).token);
+    return data?.hasNextStep === false || Boolean(extractLoginProfile(payload).token);
 }
 function inferSingleCorporationId(payload) {
     const corporationIds = new Set();
@@ -232,7 +401,7 @@ function inferSingleCorporationId(payload) {
     }
     return corporationIds.size === 1 ? [...corporationIds][0] : undefined;
 }
-async function loginWithBoPasswordSteps(options, fetchImpl) {
+async function loginWithGatewayPasswordSteps(options, fetchImpl) {
     const email = options.username ?? "";
     const password = options.password ?? "";
     const checkEmailPayload = await postLoginForToken(options, fetchImpl, {
@@ -241,17 +410,16 @@ async function loginWithBoPasswordSteps(options, fetchImpl) {
         stepName: STEP_CHECK_EMAIL
     });
     if (hasCompletedLogin(checkEmailPayload)) {
-        const profile = extractPasswordLoginProfile(checkEmailPayload, options.corporationId);
+        const profile = extractLoginProfile(checkEmailPayload, options.corporationId);
         if (!profile.token || !profile.corporationId) {
             throw new Error("Password login response did not contain a token or corporation id.");
         }
-        return withReportContext({
-            baseUrl: options.baseUrl,
+        return withReportContext(profileFromLoginOptions(options, {
             token: profile.token,
             corporationId: profile.corporationId,
             languageCode: options.languageCode,
             timezone: options.timezone
-        }, { ...options, employeeCode: options.employeeCode ?? profile.employeeCode });
+        }), { ...options, employeeCode: options.employeeCode ?? profile.employeeCode });
     }
     const emailStep = extractFirstNextStep(checkEmailPayload);
     const emailTicket = extractNextStepTicket(checkEmailPayload);
@@ -260,23 +428,22 @@ async function loginWithBoPasswordSteps(options, fetchImpl) {
     }
     const passwordPayload = await postLoginForToken(options, fetchImpl, {
         email,
-        password: encryptBoPassword(password),
+        password: encryptGatewayPassword(password),
         ticket: emailTicket,
         flowCode: emailStep.flowCode,
         stepName: emailStep.stepName
     });
     if (hasCompletedLogin(passwordPayload)) {
-        const profile = extractPasswordLoginProfile(passwordPayload, options.corporationId);
+        const profile = extractLoginProfile(passwordPayload, options.corporationId);
         if (!profile.token || !profile.corporationId) {
             throw new Error("Password login response did not contain a token or corporation id.");
         }
-        return withReportContext({
-            baseUrl: options.baseUrl,
+        return withReportContext(profileFromLoginOptions(options, {
             token: profile.token,
             corporationId: profile.corporationId,
             languageCode: options.languageCode,
             timezone: options.timezone
-        }, { ...options, employeeCode: options.employeeCode ?? profile.employeeCode });
+        }), { ...options, employeeCode: options.employeeCode ?? profile.employeeCode });
     }
     const tenantStep = extractFirstNextStep(passwordPayload);
     if (!tenantStep || tenantStep.stepName !== STEP_SELECT_TENANT) {
@@ -296,17 +463,90 @@ async function loginWithBoPasswordSteps(options, fetchImpl) {
         flowCode: tenantStep.flowCode,
         stepName: tenantStep.stepName
     });
-    const profile = extractPasswordLoginProfile(tenantPayload, tenantId);
+    const profile = extractLoginProfile(tenantPayload, tenantId);
     if (!profile.token || !profile.corporationId) {
         throw new Error("Password login response did not contain a token or corporation id.");
     }
-    return withReportContext({
-        baseUrl: options.baseUrl,
+    return withReportContext(profileFromLoginOptions(options, {
         token: profile.token,
         corporationId: profile.corporationId,
         languageCode: options.languageCode,
         timezone: options.timezone
-    }, { ...options, employeeCode: options.employeeCode ?? profile.employeeCode });
+    }), { ...options, employeeCode: options.employeeCode ?? profile.employeeCode });
+}
+async function loginWithPhone(options, fetchImpl) {
+    if (!options.baseUrl) {
+        throw new Error("Phone login requires --base-url.");
+    }
+    if (!options.dynamicCode) {
+        throw new Error("Phone login requires --dynamic-code.");
+    }
+    const loginOptions = { ...options, baseUrl: options.baseUrl };
+    const phone = buildPhoneIdentity(options);
+    const checkMobilePayload = await postLoginForToken(loginOptions, fetchImpl, {
+        ...phone,
+        flowCode: STEP_CHECK_MOBILE,
+        stepName: STEP_CHECK_MOBILE
+    });
+    if (hasCompletedLogin(checkMobilePayload)) {
+        const profile = extractLoginProfile(checkMobilePayload, options.corporationId);
+        if (!profile.token || !profile.corporationId) {
+            throw new Error("Phone login response did not contain a token or corporation id.");
+        }
+        return withReportContext(profileFromLoginOptions(loginOptions, {
+            token: profile.token,
+            corporationId: profile.corporationId,
+            languageCode: options.languageCode,
+            timezone: options.timezone
+        }), { ...options, employeeCode: options.employeeCode ?? profile.employeeCode });
+    }
+    const mobileStep = extractFirstNextStep(checkMobilePayload);
+    if (!mobileStep || mobileStep.stepName !== STEP_MOBILE) {
+        throw new Error("Phone login did not return the expected StepMobile step.");
+    }
+    const mobilePayload = await postLoginForToken(loginOptions, fetchImpl, {
+        ...phone,
+        dynamicCode: options.dynamicCode,
+        flowCode: mobileStep.flowCode,
+        stepName: mobileStep.stepName
+    });
+    if (hasCompletedLogin(mobilePayload)) {
+        const profile = extractLoginProfile(mobilePayload, options.corporationId);
+        if (!profile.token || !profile.corporationId) {
+            throw new Error("Phone login response did not contain a token or corporation id.");
+        }
+        return withReportContext(profileFromLoginOptions(loginOptions, {
+            token: profile.token,
+            corporationId: profile.corporationId,
+            languageCode: options.languageCode,
+            timezone: options.timezone
+        }), { ...options, employeeCode: options.employeeCode ?? profile.employeeCode });
+    }
+    const tenantStep = extractFirstNextStep(mobilePayload);
+    if (!tenantStep || tenantStep.stepName !== STEP_SELECT_TENANT) {
+        throw new Error("Phone login returned an unsupported next step.");
+    }
+    const tenantId = options.corporationId ?? inferSingleCorporationId(mobilePayload);
+    if (!tenantId) {
+        throw new Error("Phone login requires --corporation-id when multiple corporations are available.");
+    }
+    const tenantTicket = extractNextStepTicket(mobilePayload);
+    const tenantPayload = await postLoginForToken(loginOptions, fetchImpl, {
+        tenantID: tenantId,
+        ...(tenantTicket ? { ticket: tenantTicket } : {}),
+        flowCode: tenantStep.flowCode,
+        stepName: tenantStep.stepName
+    });
+    const profile = extractLoginProfile(tenantPayload, tenantId);
+    if (!profile.token || !profile.corporationId) {
+        throw new Error("Phone login response did not contain a token or corporation id.");
+    }
+    return withReportContext(profileFromLoginOptions(loginOptions, {
+        token: profile.token,
+        corporationId: profile.corporationId,
+        languageCode: options.languageCode,
+        timezone: options.timezone
+    }), { ...options, employeeCode: options.employeeCode ?? profile.employeeCode });
 }
 async function loginWithExplicitPasswordFlow(options, fetchImpl) {
     const body = {
@@ -324,20 +564,19 @@ async function loginWithExplicitPasswordFlow(options, fetchImpl) {
         body.stepName = options.loginStepName;
     }
     const payload = await postLoginForToken(options, fetchImpl, body);
-    const extracted = extractPasswordLoginProfile(payload, options.corporationId);
+    const extracted = extractLoginProfile(payload, options.corporationId);
     if (!extracted.token) {
         throw new Error(extractLoginError(payload) ?? "Password login response did not contain a token.");
     }
     if (!extracted.corporationId) {
         throw new Error("Password login response did not contain a corporation id.");
     }
-    return withReportContext({
-        baseUrl: options.baseUrl,
+    return withReportContext(profileFromLoginOptions(options, {
         token: extracted.token,
         corporationId: extracted.corporationId,
         languageCode: options.languageCode,
         timezone: options.timezone
-    }, { ...options, employeeCode: options.employeeCode ?? extracted.employeeCode });
+    }), { ...options, employeeCode: options.employeeCode ?? extracted.employeeCode });
 }
 async function question(input, output, label, defaultValue) {
     const suffix = defaultValue ? ` (${defaultValue})` : "";
@@ -475,6 +714,7 @@ export function createTerminalPrompt(input = process.stdin, output = process.std
                 }
             },
             secret: (label) => readLine(label),
+            message: (message) => output.write(`${message}\n`),
             close
         };
     }
@@ -513,34 +753,47 @@ export function createTerminalPrompt(input = process.stdin, output = process.std
             }
             return ask(label);
         },
+        message: (message) => output.write(`${message}\n`),
         close
     };
 }
-async function collectInteractiveLoginOptions(prompt, rawOptions) {
+async function collectInteractiveLoginOptions(prompt, rawOptions, fetchImpl) {
     try {
-        const baseUrl = (await prompt.text("BO URL", { defaultValue: DEFAULT_CHINA_BASE_URL })) || DEFAULT_CHINA_BASE_URL;
+        const baseUrl = (await prompt.text("CLI Gateway URL", { defaultValue: DEFAULT_AUTH_GATEWAY_BASE_URL })) || DEFAULT_AUTH_GATEWAY_BASE_URL;
         const corporationId = await prompt.text("集团 ID");
         const method = await prompt.select("鉴权方式", [
-            { value: "password", label: "账号密码" },
-            { value: "token", label: "Token" }
+            { value: "phone", label: "手机号验证码" },
+            { value: "password", label: "账号密码" }
         ]);
-        if (method === "token") {
-            return {
+        if (method === "phone") {
+            const phoneNumber = await prompt.text("手机号");
+            const phoneAreaCode = await prompt.text("手机区号", { defaultValue: DEFAULT_PHONE_AREA_CODE });
+            const phoneRegion = await prompt.text("手机地区", { defaultValue: DEFAULT_PHONE_REGION });
+            const phoneOptions = {
                 ...rawOptions,
                 baseUrl,
+                plat: rawOptions.plat ?? DEFAULT_AUTH_GATEWAY_PLAT,
                 corporationId,
-                token: await prompt.secret("Token"),
                 username: undefined,
-                password: undefined
+                password: undefined,
+                phoneNumber,
+                phoneAreaCode,
+                phoneRegion
+            };
+            return {
+                ...phoneOptions,
+                dynamicCode: await collectInteractivePhoneDynamicCode(prompt, phoneOptions, fetchImpl)
             };
         }
         return {
             ...rawOptions,
             baseUrl,
+            plat: rawOptions.plat ?? DEFAULT_AUTH_GATEWAY_PLAT,
             corporationId,
             username: await prompt.text("账号"),
             password: await prompt.secret("密码"),
-            token: undefined
+            phoneNumber: undefined,
+            dynamicCode: undefined
         };
     }
     finally {
@@ -548,27 +801,29 @@ async function collectInteractiveLoginOptions(prompt, rawOptions) {
     }
 }
 async function saveLoginProfile(rawOptions, store, fetchImpl, write) {
-    const hasToken = Boolean(rawOptions.token);
     const hasUsernamePassword = Boolean(rawOptions.username || rawOptions.password);
+    const hasPhoneLogin = Boolean(rawOptions.phoneNumber || rawOptions.dynamicCode);
     if (!rawOptions.baseUrl) {
         failJson(write, "INVALID_ARGUMENTS", "Login requires --base-url or --interactive.");
     }
-    if (hasToken && hasUsernamePassword) {
-        failJson(write, "INVALID_ARGUMENTS", "Use either --token or --username/--password, not both.");
+    if (hasPhoneLogin && hasUsernamePassword) {
+        failJson(write, "INVALID_ARGUMENTS", "Use either phone/dynamic-code or username/password, not both.");
     }
-    if (hasToken) {
+    if (hasPhoneLogin) {
         if (!rawOptions.corporationId) {
-            failJson(write, "INVALID_ARGUMENTS", "Token login requires --corporation-id.");
+            failJson(write, "INVALID_ARGUMENTS", "Phone login requires --corporation-id.");
+        }
+        if (!rawOptions.phoneNumber || !rawOptions.dynamicCode) {
+            failJson(write, "INVALID_ARGUMENTS", "Phone login requires --phone-number and --dynamic-code.");
+        }
+        try {
+            const profile = await loginWithPhone(rawOptions, fetchImpl);
+            store.save(await hydrateReportContext(profile, rawOptions, fetchImpl));
+            printJson(write, { authenticated: true, loginMethod: "phone" });
+        }
+        catch (error) {
+            failJson(write, "AUTH_LOGIN_FAILED", error instanceof Error ? error.message : "Phone login failed.");
         }
-        const profile = await hydrateReportContext({
-            baseUrl: rawOptions.baseUrl,
-            token: rawOptions.token,
-            corporationId: rawOptions.corporationId,
-            languageCode: rawOptions.languageCode,
-            timezone: rawOptions.timezone
-        }, rawOptions, fetchImpl);
-        store.save(profile);
-        printJson(write, { authenticated: true, loginMethod: "token" });
         return;
     }
     if (!rawOptions.username || !rawOptions.password) {
@@ -592,24 +847,35 @@ export function createAuthCommand(options = {}) {
         .command("login")
         .description("Save local authentication profile")
         .option("--interactive", "Prompt for authentication details")
-        .option("--base-url <url>", "Resto BO base URL")
-        .option("--token <token>", "API token")
+        .option("--base-url <url>", "Resto auth gateway base URL")
+        .option("--plat <plat>", "Auth gateway platform code", DEFAULT_AUTH_GATEWAY_PLAT)
         .option("--corporation-id <id>", "Corporation ID")
-        .option("--username <username>", "BO username/account for password login")
-        .option("--password <password>", "BO password for password login")
+        .option("--username <username>", "Auth gateway username/account for password login")
+        .option("--password <password>", "Auth gateway password for password login")
+        .option("--phone-number <phone>", "Auth gateway phone number for dynamic-code login")
+        .option("--phone-area-code <code>", "Phone area code for dynamic-code login")
+        .option("--phone-region <region>", "Phone region for dynamic-code login")
+        .option("--dynamic-code <code>", "Phone dynamic verification code")
         .option("--employee-code <code>", "Employee code used by report permission context")
         .option("--organization-id <id>", "Current organization ID used by report permission context")
         .option("--organization-type <type>", "Current Organization-Type header used by report permission context")
         .option("--org-type-list <list>", "Comma-separated organization type list used by report permission context")
-        .option("--login-flow-code <code>", "BO password login flowCode")
-        .option("--login-step-name <name>", "BO password login stepName")
+        .option("--login-flow-code <code>", "Auth gateway password login flowCode")
+        .option("--login-step-name <name>", "Auth gateway password login stepName")
         .option("--language-code <code>", "Language code", DEFAULT_CHINA_LANGUAGE_CODE)
         .option("--timezone <timezone>", "Timezone", DEFAULT_CHINA_TIMEZONE)
         .allowExcessArguments(false)
         .action(async (rawOptions) => {
-        const loginOptions = rawOptions.interactive
-            ? await collectInteractiveLoginOptions(options.prompt ?? createTerminalPrompt(), rawOptions)
-            : rawOptions;
+        let loginOptions;
+        try {
+            loginOptions = rawOptions.interactive
+                ? await collectInteractiveLoginOptions(options.prompt ?? createTerminalPrompt(), rawOptions, fetchImpl)
+                : rawOptions;
+        }
+        catch (error) {
+            failJson(write, "AUTH_LOGIN_FAILED", error instanceof Error ? error.message : "Interactive login failed.");
+            return;
+        }
         await saveLoginProfile(loginOptions, store, fetchImpl, write);
     });
     auth
@@ -625,6 +891,7 @@ export function createAuthCommand(options = {}) {
         printJson(write, {
             authenticated: true,
             baseUrl: profile.baseUrl,
+            ...(profile.plat ? { plat: profile.plat } : {}),
             corporationId: profile.corporationId,
             languageCode: profile.languageCode,
             timezone: profile.timezone,