@skillbuilder/minitool-cli-auth 0.0.0-beta-20261027053041051

package/lib/device-auth.js

@@ -0,0 +1,302 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceAuthService = void 0;
+const node_crypto_1 = require("node:crypto");
+const promises_1 = require("node:timers/promises");
+const minitool_cli_config_1 = require("@skillbuilder/minitool-cli-config");
+const auth_state_1 = require("./auth-state");
+const device_auth_api_1 = require("./device-auth-api");
+const REFRESH_BUFFER_MS = 5 * 60 * 1000;
+const defaultClock = {
+    now: Date.now,
+    sleep: async (milliseconds, signal) => {
+        await (0, promises_1.setTimeout)(milliseconds, undefined, { signal });
+    },
+};
+/** 扫码 PKCE 与续期生命周期；UI 回调只接收公开授权链接，不接收设备码和 verifier。 */
+class DeviceAuthService {
+    store;
+    api;
+    storage;
+    pending;
+    secretAuth;
+    clock;
+    refreshPromise;
+    constructor(store, api, storage, pending, secretAuth, clock = defaultClock) {
+        this.store = store;
+        this.api = api;
+        this.storage = storage;
+        this.pending = pending;
+        this.secretAuth = secretAuth;
+        this.clock = clock;
+    }
+    loginWithSecret(id, key) {
+        if (!this.secretAuth)
+            throw new Error("当前宿主未启用 Secret 登录");
+        return this.secretAuth.loginWithSecret(id, key);
+    }
+    read() {
+        try {
+            return this.store.get();
+        }
+        catch {
+            throw new auth_state_1.CredentialStoreUnavailableError();
+        }
+    }
+    owns(credential) {
+        return credential.apiBaseUrl === this.api.apiBaseUrl;
+    }
+    canRefresh(credential) {
+        return (this.owns(credential) &&
+            Date.parse(credential.refreshExpiresAt) > this.clock.now() + REFRESH_BUFFER_MS);
+    }
+    identity(credential) {
+        if (!credential.openId)
+            return null;
+        return {
+            creatorId: credential.openId,
+            displayName: credential.creator?.displayName ?? credential.openId,
+            avatarUrl: credential.creator?.avatarUrl,
+            description: credential.creator?.description,
+        };
+    }
+    async getAuthState() {
+        let credential;
+        let source;
+        try {
+            credential = this.read();
+            source = this.storage.getMode() === "keychain" ? "os_keychain" : "local_file";
+        }
+        catch {
+            return { status: "unavailable", reason: "credential_store_error" };
+        }
+        if (!credential)
+            return { status: "anonymous", reason: "not_logged_in" };
+        if (credential.method === "secret")
+            return this.secretAuth
+                ? this.secretAuth.getAuthState()
+                : { status: "anonymous", reason: "not_logged_in" };
+        if (!this.owns(credential) ||
+            (Date.parse(credential.expiresAt) <= this.clock.now() && !this.canRefresh(credential)))
+            return { status: "anonymous", reason: "expired" };
+        return {
+            status: "authenticated",
+            method: "device",
+            source,
+            identitySnapshot: this.identity(credential),
+            expiresAt: credential.expiresAt,
+        };
+    }
+    async getAccessToken() {
+        const credential = this.read();
+        if (!credential)
+            throw new auth_state_1.AuthenticationRequiredError();
+        if (credential.method === "secret") {
+            if (!this.secretAuth)
+                throw new auth_state_1.AuthenticationRequiredError();
+            return this.secretAuth.getAccessToken();
+        }
+        if (!this.owns(credential))
+            throw new auth_state_1.AuthenticationRequiredError("登录环境与当前服务不一致，请重新扫码登录");
+        if (Date.parse(credential.expiresAt) > this.clock.now() + REFRESH_BUFFER_MS)
+            return credential.accessToken;
+        if (!this.canRefresh(credential)) {
+            if (Date.parse(credential.expiresAt) > this.clock.now())
+                return credential.accessToken;
+            throw new auth_state_1.AuthenticationRequiredError("登录态已过期，请重新扫码登录");
+        }
+        if (!this.refreshPromise) {
+            this.refreshPromise = this.refresh(credential).finally(() => {
+                this.refreshPromise = undefined;
+            });
+        }
+        return this.refreshPromise;
+    }
+    tokenCredential(data, previous) {
+        const now = this.clock.now();
+        const expires = data.expire_time_ms ?? data.expireTimeMs ?? now + Number(data.expires_in ?? 7200) * 1000;
+        const refreshExpires = data.refresh_expire_time_ms ?? data.refreshExpireTimeMs ?? now + 180 * 24 * 3600_000;
+        try {
+            if (Number(expires) <= now || Number(refreshExpires) <= now)
+                throw new Error();
+            const openId = (0, device_auth_api_1.authText)(data.open_id ?? data.openId).trim() || previous?.openId;
+            const info = (0, device_auth_api_1.authRecord)(data.userInfo) ? data.userInfo : {};
+            const credential = (0, minitool_cli_config_1.parseAuthFileConfig)({
+                schemaVersion: 1,
+                method: "device",
+                apiBaseUrl: this.api.apiBaseUrl,
+                accessToken: data.access_token ?? data.accessToken,
+                refreshToken: data.refresh_token ?? data.refreshToken,
+                issuedAt: new Date(now).toISOString(),
+                expiresAt: new Date(Number(expires)).toISOString(),
+                refreshExpiresAt: new Date(Number(refreshExpires)).toISOString(),
+                openId,
+                scope: (0, device_auth_api_1.authText)(data.scope) || previous?.scope || "base_info,skill_publish",
+                creator: openId
+                    ? {
+                        creatorId: openId,
+                        displayName: (0, device_auth_api_1.authText)(info.nick ?? info.nickname) || previous?.creator?.displayName || openId,
+                        avatarUrl: (0, device_auth_api_1.authText)(info.avatar) || previous?.creator?.avatarUrl,
+                    }
+                    : undefined,
+            });
+            if (credential.method !== "device")
+                throw new Error();
+            return credential;
+        }
+        catch {
+            throw new device_auth_api_1.DeviceAuthError("AUTH_INVALID_RESPONSE", "Token 响应无效，本次登录态未保存");
+        }
+    }
+    async refresh(original) {
+        let data;
+        try {
+            data = await this.api.refresh(original.refreshToken);
+        }
+        catch (error) {
+            const current = this.read();
+            if (error instanceof device_auth_api_1.DeviceAuthError &&
+                error.code === "AUTH_EXPIRED" &&
+                current?.method === "device" &&
+                current.refreshToken === original.refreshToken &&
+                current.accessToken === original.accessToken)
+                this.store.delete();
+            throw error;
+        }
+        const credential = this.tokenCredential(data, original);
+        if (original.openId && credential.openId !== original.openId)
+            throw new device_auth_api_1.DeviceAuthError("AUTH_INVALID_RESPONSE", "续期返回了不同账号，本次登录态未保存");
+        const current = this.read();
+        if (current?.method !== "device" ||
+            current.refreshToken !== original.refreshToken ||
+            current.accessToken !== original.accessToken)
+            throw new device_auth_api_1.DeviceAuthError("AUTH_CHANGED", "登录态已变化，请重新执行命令");
+        this.store.update(credential);
+        return credential.accessToken;
+    }
+    async loginWithQr(options) {
+        const state = await this.getAuthState();
+        if (state.status === "unavailable")
+            throw new auth_state_1.CredentialStoreUnavailableError();
+        if (state.status === "authenticated" && state.method === "device") {
+            try {
+                await this.getAccessToken();
+                const current = this.read();
+                if (current?.method === "device")
+                    return { creator: this.identity(current) ?? undefined, expiresAt: current.expiresAt };
+            }
+            catch (error) {
+                if (!(error instanceof device_auth_api_1.DeviceAuthError) ||
+                    !["AUTH_EXPIRED", "AUTH_REJECTED"].includes(error.code))
+                    throw error;
+            }
+        }
+        if (options.signal?.aborted)
+            throw new device_auth_api_1.DeviceAuthError("AUTH_CANCELLED", "已取消扫码登录");
+        let pending = this.pending.readPendingAuth();
+        if (!pending ||
+            pending.apiBaseUrl !== this.api.apiBaseUrl ||
+            Date.parse(pending.expiresAt) <= this.clock.now()) {
+            const verifier = (0, node_crypto_1.randomBytes)(48).toString("base64url").replace(/-/g, ".");
+            const challenge = (0, node_crypto_1.createHash)("sha256").update(verifier).digest("base64url");
+            const device = await this.api.create(challenge, options.signal);
+            const common = new URL(device.authorizeCommonUrl);
+            const h5 = new URL(device.authorizeH5Url);
+            if (!["https:", "xhsopen:", "xhsdiscover:"].includes(common.protocol) ||
+                common.username ||
+                common.password ||
+                h5.protocol !== "https:" ||
+                h5.username ||
+                h5.password ||
+                !device.deviceCode ||
+                !Number.isSafeInteger(device.expiresInSeconds) ||
+                device.expiresInSeconds < 1 ||
+                device.expiresInSeconds > 3600 ||
+                !Number.isInteger(device.pollIntervalSeconds) ||
+                device.pollIntervalSeconds < 1 ||
+                device.pollIntervalSeconds > 60)
+                throw new device_auth_api_1.DeviceAuthError("AUTH_INVALID_RESPONSE", "扫码授权响应格式无效");
+            pending = {
+                apiBaseUrl: this.api.apiBaseUrl,
+                deviceCode: device.deviceCode,
+                codeVerifier: verifier,
+                authorizeCommonUrl: common.toString(),
+                authorizeH5Url: h5.toString(),
+                userCode: device.userCode,
+                pollIntervalSeconds: device.pollIntervalSeconds,
+                expiresAt: new Date(this.clock.now() + device.expiresInSeconds * 1000).toISOString(),
+            };
+            this.pending.writePendingAuth(pending);
+        }
+        const active = pending;
+        const checkActive = () => {
+            if (options.signal?.aborted ||
+                this.pending.readPendingAuth()?.deviceCode !== active.deviceCode)
+                throw new device_auth_api_1.DeviceAuthError("AUTH_CANCELLED", "已取消扫码登录");
+        };
+        try {
+            await options.onPrompt({
+                authorizeCommonUrl: active.authorizeCommonUrl,
+                authorizeH5Url: active.authorizeH5Url,
+                userCode: active.userCode,
+                expiresAt: active.expiresAt,
+            });
+            while (this.clock.now() < Date.parse(active.expiresAt)) {
+                checkActive();
+                await this.clock.sleep(Math.min(active.pollIntervalSeconds * 1000, Date.parse(active.expiresAt) - this.clock.now()), options.signal);
+                checkActive();
+                if (this.clock.now() >= Date.parse(active.expiresAt))
+                    break;
+                const polled = await this.api.poll(active.deviceCode, options.signal);
+                if (polled.status === "approved") {
+                    if (!polled.authorizationCode)
+                        throw new device_auth_api_1.DeviceAuthError("AUTH_INVALID_RESPONSE", "授权响应缺少 authorizationCode");
+                    const data = await this.api.exchange(polled.authorizationCode, active.codeVerifier, options.signal);
+                    checkActive();
+                    const credential = this.tokenCredential(data);
+                    this.store.update(credential);
+                    this.pending.clearPendingAuth();
+                    return {
+                        creator: this.identity(credential) ?? undefined,
+                        expiresAt: credential.expiresAt,
+                    };
+                }
+                if (["denied", "cancelled"].includes(polled.status))
+                    throw new device_auth_api_1.DeviceAuthError("AUTH_DENIED", "用户已拒绝或取消授权");
+                if (polled.status === "expired")
+                    break;
+            }
+            throw new device_auth_api_1.DeviceAuthError("AUTH_TIMEOUT", "扫码授权已超时，请重新登录");
+        }
+        catch (error) {
+            const cancelled = options.signal?.aborted;
+            // 网络故障保留有时效的等待状态供下次恢复；终止、拒绝和异常响应清理。
+            if ((cancelled || !(error instanceof device_auth_api_1.DeviceAuthError) || error.code !== "AUTH_UNAVAILABLE") &&
+                this.pending.readPendingAuth()?.deviceCode === active.deviceCode)
+                this.pending.clearPendingAuth();
+            if (cancelled)
+                throw new device_auth_api_1.DeviceAuthError("AUTH_CANCELLED", "已取消扫码登录");
+            throw error;
+        }
+    }
+    async cancelLogin() {
+        this.pending.clearPendingAuth();
+    }
+    async whoAmI() {
+        await this.getAccessToken();
+        const credential = this.read();
+        if (credential?.method === "secret" && this.secretAuth)
+            return this.secretAuth.whoAmI();
+        if (!credential || credential.method !== "device")
+            throw new auth_state_1.AuthenticationRequiredError();
+        const identity = this.identity(credential);
+        if (!identity)
+            throw new auth_state_1.CreatorIdentityUnavailableError();
+        return identity;
+    }
+    async logout() {
+        this.pending.clearPendingAuth();
+        this.store.delete();
+    }
+}
+exports.DeviceAuthService = DeviceAuthService;

package/lib/device-auth.test.js

@@ -0,0 +1,238 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_crypto_1 = require("node:crypto");
+const node_test_1 = __importDefault(require("node:test"));
+const device_auth_1 = require("./device-auth");
+const device_auth_api_1 = require("./device-auth-api");
+function fixture() {
+    let now = Date.parse("2026-10-26T00:00:00Z");
+    let credential = null;
+    let pending = null;
+    let challenge = "";
+    let refreshCalls = 0;
+    let createCalls = 0;
+    const token = () => ({
+        access_token: "private-access",
+        refresh_token: "private-refresh",
+        open_id: "creator",
+        expire_time_ms: now + 7200_000,
+        refresh_expire_time_ms: now + 86400_000,
+    });
+    const api = {
+        apiBaseUrl: "https://auth.example",
+        async create(value) {
+            createCalls++;
+            challenge = value;
+            return {
+                deviceCode: "private-device",
+                authorizeCommonUrl: "xhsopen://account/oauth",
+                authorizeH5Url: "https://auth.example/web",
+                userCode: "CODE",
+                pollIntervalSeconds: 1,
+                expiresInSeconds: 60,
+            };
+        },
+        async poll() {
+            return { status: "approved", authorizationCode: "private-code" };
+        },
+        async exchange(_code, verifier) {
+            strict_1.default.equal((0, node_crypto_1.createHash)("sha256").update(verifier).digest("base64url"), challenge);
+            return token();
+        },
+        async refresh() {
+            refreshCalls++;
+            return { ...token(), access_token: "renewed-access", refresh_token: "renewed-refresh" };
+        },
+    };
+    const store = {
+        get: () => credential,
+        update: (value) => {
+            credential = value;
+        },
+        delete: () => {
+            credential = null;
+        },
+    };
+    const waiting = {
+        readPendingAuth: () => pending,
+        writePendingAuth: (value) => {
+            pending = value;
+        },
+        clearPendingAuth: () => {
+            pending = null;
+        },
+    };
+    const clock = {
+        now: () => now,
+        sleep: async (ms) => {
+            now += ms;
+        },
+    };
+    const service = new device_auth_1.DeviceAuthService(store, api, { getMode: () => "file" }, waiting, undefined, clock);
+    return {
+        service,
+        api,
+        store,
+        waiting,
+        clock,
+        token,
+        advance(ms) {
+            now += ms;
+        },
+        get createCalls() {
+            return createCalls;
+        },
+        get refreshCalls() {
+            return refreshCalls;
+        },
+    };
+}
+(0, node_test_1.default)("扫码使用 S256 PKCE，持久化 Token，输出身份不泄漏凭据", async () => {
+    const f = fixture();
+    let prompt;
+    const result = await f.service.loginWithQr({
+        onPrompt: (value) => {
+            prompt = value;
+        },
+    });
+    strict_1.default.equal(result.creator?.creatorId, "creator");
+    strict_1.default.equal(f.store.get()?.method, "device");
+    strict_1.default.equal(f.waiting.readPendingAuth(), null);
+    strict_1.default.equal(await f.service.getAccessToken(), "private-access");
+    const publicOutput = JSON.stringify([
+        prompt,
+        result,
+        await f.service.getAuthState(),
+        await f.service.whoAmI(),
+    ]);
+    for (const secret of [
+        "private-access",
+        "private-refresh",
+        "private-device",
+        "private-code",
+        "codeVerifier",
+    ])
+        strict_1.default.equal(publicOutput.includes(secret), false);
+});
+(0, node_test_1.default)("过期前并发请求只续期一次；登录环境不一致时不发 Token", async () => {
+    const f = fixture();
+    await f.service.loginWithQr({ onPrompt() { } });
+    f.advance(7100_000);
+    strict_1.default.deepEqual(await Promise.all([f.service.getAccessToken(), f.service.getAccessToken()]), [
+        "renewed-access",
+        "renewed-access",
+    ]);
+    strict_1.default.equal(f.refreshCalls, 1);
+    const foreign = new device_auth_1.DeviceAuthService(f.store, { ...f.api, apiBaseUrl: "https://other.example" }, { getMode: () => "file" }, f.waiting, undefined, f.clock);
+    await strict_1.default.rejects(foreign.getAccessToken(), { code: "AUTHENTICATION_REQUIRED" });
+});
+(0, node_test_1.default)("拒绝、超时、外部取消均清理等待状态且不覆盖已有凭据", async () => {
+    for (const status of ["denied", "expired"]) {
+        const f = fixture();
+        f.api.poll = async () => ({ status });
+        await strict_1.default.rejects(f.service.loginWithQr({ onPrompt() { } }), {
+            code: status === "denied" ? "AUTH_DENIED" : "AUTH_TIMEOUT",
+        });
+        strict_1.default.equal(f.waiting.readPendingAuth(), null);
+        strict_1.default.equal(f.store.get(), null);
+    }
+    const f = fixture();
+    await strict_1.default.rejects(f.service.loginWithQr({
+        onPrompt() {
+            f.waiting.clearPendingAuth();
+        },
+    }), { code: "AUTH_CANCELLED" });
+    strict_1.default.equal(f.store.get(), null);
+});
+(0, node_test_1.default)("网络中断恢复同一设备码；abort 清理；非法 Token 不落盘", async () => {
+    const f = fixture();
+    f.api.poll = async () => {
+        throw new device_auth_api_1.DeviceAuthError("AUTH_UNAVAILABLE", "暂不可用");
+    };
+    await strict_1.default.rejects(f.service.loginWithQr({ onPrompt() { } }), { code: "AUTH_UNAVAILABLE" });
+    strict_1.default.ok(f.waiting.readPendingAuth());
+    f.api.poll = async () => ({
+        status: "approved",
+        authorizationCode: "private-code",
+    });
+    await f.service.loginWithQr({ onPrompt() { } });
+    strict_1.default.equal(f.createCalls, 1);
+    await f.service.logout();
+    const controller = new AbortController();
+    await strict_1.default.rejects(f.service.loginWithQr({
+        signal: controller.signal,
+        onPrompt() {
+            controller.abort();
+        },
+    }), { code: "AUTH_CANCELLED" });
+    strict_1.default.equal(f.waiting.readPendingAuth(), null);
+    f.api.exchange = async () => ({ access_token: "private", expires_in: -1 });
+    await strict_1.default.rejects(f.service.loginWithQr({ onPrompt() { } }), { code: "AUTH_INVALID_RESPONSE" });
+    strict_1.default.equal(f.store.get(), null);
+});
+(0, node_test_1.default)("续期不会复活并发登出的账号；失效续期可重新扫码", async () => {
+    const f = fixture();
+    await f.service.loginWithQr({ onPrompt() { } });
+    f.advance(7100_000);
+    f.api.refresh = async () => {
+        await f.service.logout();
+        return f.token();
+    };
+    await strict_1.default.rejects(f.service.getAccessToken(), { code: "AUTH_CHANGED" });
+    strict_1.default.equal(f.store.get(), null);
+    await f.service.loginWithQr({ onPrompt() { } });
+    f.advance(7100_000);
+    f.api.refresh = async () => {
+        throw new device_auth_api_1.DeviceAuthError("AUTH_EXPIRED", "expired");
+    };
+    await f.service.loginWithQr({ onPrompt() { } });
+    strict_1.default.equal(f.createCalls, 3);
+});
+(0, node_test_1.default)("HTTP 扫码协议发送正确字段，拒绝业务失败且不回显私密响应", async () => {
+    const seen = [];
+    const api = new device_auth_api_1.HttpDeviceAuthApi("https://auth.example", async (url, init) => {
+        seen.push({ url: new URL(String(url)), init });
+        return new Response(JSON.stringify({ code: 0, data: { auth_status: 2, authorization_code: "code" } }));
+    });
+    await api.create("challenge");
+    strict_1.default.deepEqual(JSON.parse(String(seen[0].init?.body)), {
+        code_challenge: "challenge",
+        code_challenge_method: "S256",
+        scopes: ["base_info", "skill_publish"],
+    });
+    strict_1.default.deepEqual(await api.poll("device&private"), {
+        status: "approved",
+        authorizationCode: "code",
+    });
+    strict_1.default.equal(seen[1].url.searchParams.get("device_code"), "device&private");
+    await api.exchange("code", "verifier");
+    strict_1.default.deepEqual(JSON.parse(String(seen[2].init?.body)), {
+        authorization_code: "code",
+        code_verifier: "verifier",
+    });
+    await api.refresh("refresh");
+    strict_1.default.deepEqual(JSON.parse(String(seen[3].init?.body)), { refresh_token: "refresh" });
+    strict_1.default.equal(seen[3].init?.redirect, "error");
+    const denied = new device_auth_api_1.HttpDeviceAuthApi("https://auth.example", async () => new Response(JSON.stringify({ code: 9, msg: "private-token", data: {} })));
+    await strict_1.default.rejects(denied.refresh("private-token"), (error) => error instanceof device_auth_api_1.DeviceAuthError &&
+        error.code === "AUTH_REJECTED" &&
+        !error.message.includes("private-token"));
+});
+(0, node_test_1.default)("无身份字段的 Token 可登录；续期不回传身份时保留原有身份", async () => {
+    const f = fixture();
+    f.api.exchange = async () => ({ ...f.token(), open_id: undefined });
+    const login = await f.service.loginWithQr({ onPrompt() { } });
+    strict_1.default.equal(login.creator, undefined);
+    strict_1.default.equal((await f.service.getAuthState()).status, "authenticated");
+    await strict_1.default.rejects(f.service.whoAmI(), { code: "CREATOR_IDENTITY_UNAVAILABLE" });
+    await f.service.logout();
+    f.api.exchange = async () => f.token();
+    await f.service.loginWithQr({ onPrompt() { } });
+    f.advance(7100_000);
+    f.api.refresh = async () => ({ ...f.token(), open_id: undefined });
+    strict_1.default.equal((await f.service.whoAmI()).creatorId, "creator");
+});

package/lib/index.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEVICE_AUTH_PATHS = exports.DeviceAuthError = exports.HttpDeviceAuthApi = exports.DeviceAuthService = exports.ManagedCredentialStore = exports.SecretAuthService = exports.HttpSecretAuthApi = exports.requireAuthenticatedAuthState = exports.CreatorIdentityUnavailableError = exports.CredentialStoreUnavailableError = exports.AuthenticationRequiredError = void 0;
+var auth_state_1 = require("./auth-state");
+Object.defineProperty(exports, "AuthenticationRequiredError", { enumerable: true, get: function () { return auth_state_1.AuthenticationRequiredError; } });
+Object.defineProperty(exports, "CredentialStoreUnavailableError", { enumerable: true, get: function () { return auth_state_1.CredentialStoreUnavailableError; } });
+Object.defineProperty(exports, "CreatorIdentityUnavailableError", { enumerable: true, get: function () { return auth_state_1.CreatorIdentityUnavailableError; } });
+Object.defineProperty(exports, "requireAuthenticatedAuthState", { enumerable: true, get: function () { return auth_state_1.requireAuthenticatedAuthState; } });
+var secret_auth_1 = require("./secret-auth");
+Object.defineProperty(exports, "HttpSecretAuthApi", { enumerable: true, get: function () { return secret_auth_1.HttpSecretAuthApi; } });
+Object.defineProperty(exports, "SecretAuthService", { enumerable: true, get: function () { return secret_auth_1.SecretAuthService; } });
+var managed_credential_store_1 = require("./managed-credential-store");
+Object.defineProperty(exports, "ManagedCredentialStore", { enumerable: true, get: function () { return managed_credential_store_1.ManagedCredentialStore; } });
+var device_auth_1 = require("./device-auth");
+Object.defineProperty(exports, "DeviceAuthService", { enumerable: true, get: function () { return device_auth_1.DeviceAuthService; } });
+var device_auth_api_1 = require("./device-auth-api");
+Object.defineProperty(exports, "HttpDeviceAuthApi", { enumerable: true, get: function () { return device_auth_api_1.HttpDeviceAuthApi; } });
+Object.defineProperty(exports, "DeviceAuthError", { enumerable: true, get: function () { return device_auth_api_1.DeviceAuthError; } });
+Object.defineProperty(exports, "DEVICE_AUTH_PATHS", { enumerable: true, get: function () { return device_auth_api_1.DEVICE_AUTH_PATHS; } });

package/lib/keyring-credential-store.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyringCredentialStore = exports.KeyringAccessError = exports.KeyringUnavailableError = void 0;
+exports.getSystemCredentialStoreName = getSystemCredentialStoreName;
+const node_crypto_1 = require("node:crypto");
+const minitool_cli_config_1 = require("@skillbuilder/minitool-cli-config");
+const KEYRING_SERVICE = "com.xiaohongshu.redminitool";
+class KeyringUnavailableError extends Error {
+    code = "KEYRING_UNAVAILABLE";
+    constructor() {
+        super("系统凭据库不可用；凭据未降级保存到 auth.json");
+        this.name = "KeyringUnavailableError";
+    }
+}
+exports.KeyringUnavailableError = KeyringUnavailableError;
+class KeyringAccessError extends Error {
+    code = "KEYRING_ACCESS_FAILED";
+    constructor(operation) {
+        super(`系统凭据库${operation}失败；未执行明文文件降级`);
+        this.name = "KeyringAccessError";
+    }
+}
+exports.KeyringAccessError = KeyringAccessError;
+function getSystemCredentialStoreName(platform = process.platform) {
+    if (platform === "darwin")
+        return "macOS Keychain";
+    if (platform === "win32")
+        return "Windows Credential Manager";
+    if (platform === "linux")
+        return "Linux Secret Service / Keyutils";
+    return "OS Keyring";
+}
+function createNativeEntry(service, account) {
+    try {
+        const { Entry } = require("@napi-rs/keyring");
+        return new Entry(service, account);
+    }
+    catch {
+        throw new KeyringUnavailableError();
+    }
+}
+function execute(operation, task) {
+    try {
+        return task();
+    }
+    catch (error) {
+        if (error instanceof KeyringUnavailableError)
+            throw error;
+        throw new KeyringAccessError(operation);
+    }
+}
+/** 每个配置目录使用独立系统凭据条目。 */
+class KeyringCredentialStore {
+    entryFactory;
+    account;
+    constructor(authPath, entryFactory = createNativeEntry) {
+        this.entryFactory = entryFactory;
+        this.account = `cli:${(0, node_crypto_1.createHash)("sha256").update(authPath).digest("hex").slice(0, 24)}`;
+    }
+    probe() {
+        execute("读取", () => this.entryFactory(KEYRING_SERVICE, this.account).getPassword());
+    }
+    get() {
+        return execute("读取", () => {
+            const password = this.entryFactory(KEYRING_SERVICE, this.account).getPassword();
+            return password === null ? null : (0, minitool_cli_config_1.parseAuthFileConfig)(JSON.parse(password));
+        });
+    }
+    update(config) {
+        const password = JSON.stringify((0, minitool_cli_config_1.parseAuthFileConfig)(config));
+        execute("写入", () => this.entryFactory(KEYRING_SERVICE, this.account).setPassword(password));
+    }
+    delete() {
+        execute("删除", () => this.entryFactory(KEYRING_SERVICE, this.account).deleteCredential());
+    }
+}
+exports.KeyringCredentialStore = KeyringCredentialStore;