@skillbuilder/minitool-core 0.0.0-beta-20261027053041051

package/README.md

@@ -0,0 +1,74 @@
+# @skillbuilder/minitool-core
+
+小工具 CLI / MCP 共用业务核心，通过 `createMinitoolCore()` 的私有 Inversify 容器组装。
+接口依据 `skill-cli` 的 `origin/feat-pipline-auth` 分支实现；不再要求宿主填写占位接口路径。
+
+## 服务与接口
+
+| 服务方法 | 平台接口 | 关键参数 |
+| --- | --- | --- |
+| `getConfig` | GET `/api/sns/v2/creator/red_app/third/config` | `source` |
+| `list` | GET `…/list` | `source`、`page_num`、`page_size` |
+| `getStatus` | GET `…/detail` | `source`、`appId` |
+| `getHistory` | GET `…/history_version` | `source`、`appId` |
+| `createPreview` | POST `…/preview_code` | `source`、`pkgFileId`、`md5`；可选名称、图标、版本 |
+| `submitReview` | POST `…/save` | `source`、名称、简介、图标/封面/代码包 fileId、md5、版本、类目、权限 |
+| `edit` | POST `…/base/save` | `source`、`appId`、`appName`、`slogan`、`iconFileId` 必填且非空白；`coverFileId` 可选 |
+| `upload` | GET `/api/sns/v2/red_skill/upload/permit` + COS/ROS | `spectrum/red_app` 或 `spectrum/red_skill_tool_image` |
+
+`source` 必须来自平台分配，不设置默认来源。请求只使用 Bearer 请求头，身份由网关决定。
+列表保留平台的 `apps`，详情保留 `appId` 等 camelCase 字段；展示状态与历史审核状态分别补充中文标签。
+提审前查询当前配置，校验类目和权限编码；本地校验不代表服务端审核通过。
+
+上传接受 ZIP / 图片，返回 `fileId`、`md5`、`sha256`、`size`、`type`，不创建小工具。
+ZIP 根目录必须含 `index.html`，文件不超过 10 MiB，解压不超过 30 MiB，拒绝越界、重复路径、符号链接和 CRC 错误。
+图片接受 PNG、JPEG、GIF、WebP。上传使用经过校验的临时快照，最终清理；可传 `expectedSha256` 拒绝确认后变更的文件。
+通用上传服务只提供安全的 HTTPS 展示地址，忽略 ROS 返回的 HTTP、临时签名或无效地址；上传成功仍返回 `fileId`。
+预览和提审消费上传返回的文件标识；首次提审不传 `appId`，更新版本传已有 `appId`。
+
+## DI 与鉴权边界
+
+`MiniToolService` 注入 `IMiniToolApi`、`IUploadService`；HTTP 适配器注入 `AccessTokenProvider` 和网关配置。
+凭据存储、扫码、PKCE、刷新和 Secret 登录在 `minitool-cli-auth` 中实现，core 不读取凭据文件。
+域名由 `@skillbuilder/endpoints` 集中维护，宿主可显式传入网关和请求函数供集成测试。
+
+```ts
+const runtime = createMinitoolCore({
+  accessTokens,
+  api: { apiBaseUrl },
+});
+try {
+  const page = await runtime.miniTools.list({ source, pageNum: 1, pageSize: 20 });
+} finally {
+  await runtime.dispose();
+}
+```
+
+公共 Token 集中在 `src/di/tokens.ts`；测试可通过后加载的 `ContainerModule` + `rebindSync` 替换 API、上传或业务服务。
+上传还提供 `MINITOOL_TOKENS.cosClientFactory`：可注入 `CosClientFactory` 替换文件存储传输，保留正式 `UploadService`、授权策略和文件校验。
+每个 Runtime 使用独立单例容器，`dispose()` 幂等释放资源。禁止目录扫描和生产假数据。
+写接口不自动重试；网络中断、5xx/408、不可解析响应或缺少成功字段返回 `OUTCOME_UNKNOWN`，应先查询列表、状态或历史。
+服务端拒绝、HTTP 权限错误和本地参数错误有独立错误码，错误信息不回显 Token 或上传授权。
+
+通用工具继续提供 Logger、Loading、浏览器启动、端口发现、HTTP 和表格输出。
+CLI APM 默认关闭，仅显式设置 `REDMINITOOL_APM_ENDPOINT` 后上报脱敏事件。
+
+## 可视化工作台与测试
+
+在仓库根目录执行：
+
+```sh
+pnpm --filter @skillbuilder/minitool-core playground
+```
+
+打开 `http://127.0.0.1:5189`，点击「运行完整验证」。默认使用独立本地演示平台，22 项检查覆盖全部 8 个业务服务，运行结束会登出演示账号。
+工作台提供参数表单 / JSON 编辑、ZIP 和图片上传、模拟扫码确认 / 拒绝、自动续期、7 类故障注入和脱敏 HTTP 记录。
+服务端通过真实 HTTP 调用本地平台，仅通过 DI 替换云存储传输；本地上传会实际传送字节并校验 MD5。详细结构、真实环境用法与测试说明见 [playground/README.md](playground/README.md)。
+
+```sh
+# 自动构建依赖与 core，执行单元、契约和 HTTP 集成测试
+pnpm --filter @skillbuilder/minitool-core test
+
+# 同一套测试，附 Node.js 覆盖率报告
+pnpm --filter @skillbuilder/minitool-core test:coverage
+```

package/lib/di/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContainerModule = void 0;
+var inversify_1 = require("inversify");
+Object.defineProperty(exports, "ContainerModule", { enumerable: true, get: function () { return inversify_1.ContainerModule; } });
+__exportStar(require("./modules"), exports);
+__exportStar(require("./tokens"), exports);

package/lib/di/modules.js

@@ -0,0 +1,23 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMinitoolModule = createMinitoolModule;
+const cos_nodejs_sdk_v5_1 = __importDefault(require("cos-nodejs-sdk-v5"));
+const inversify_1 = require("inversify");
+const minitool_api_1 = require("../services/minitool-api");
+const minitool_service_1 = require("../services/minitool-service");
+const upload_service_1 = require("../services/upload-service");
+const tokens_1 = require("./tokens");
+/** MiniTool Core 显式注册业务、传输及其窄依赖。 */
+function createMinitoolModule(options) {
+    return new inversify_1.ContainerModule(({ bind }) => {
+        bind(tokens_1.MINITOOL_TOKENS.auth).toConstantValue(options.auth);
+        bind(tokens_1.MINITOOL_TOKENS.apiOptions).toConstantValue(options.api);
+        bind(tokens_1.MINITOOL_TOKENS.api).to(minitool_api_1.MiniToolHttpClient).inSingletonScope();
+        bind(tokens_1.MINITOOL_TOKENS.cosClientFactory).toConstantValue((options) => new cos_nodejs_sdk_v5_1.default(options));
+        bind(tokens_1.MINITOOL_TOKENS.upload).to(upload_service_1.UploadService).inSingletonScope();
+        bind(tokens_1.MINITOOL_TOKENS.miniTool).to(minitool_service_1.MiniToolService).inSingletonScope();
+    });
+}

package/lib/di/tokens.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MINITOOL_TOKENS = void 0;
+/** MiniTool Runtime 服务与依赖标识。 */
+exports.MINITOOL_TOKENS = Object.freeze({
+    api: Symbol.for("@skillbuilder/minitool-core/api"),
+    apiOptions: Symbol.for("@skillbuilder/minitool-core/api-options"),
+    auth: Symbol.for("@skillbuilder/minitool-core/auth"),
+    miniTool: Symbol.for("@skillbuilder/minitool-core/minitool"),
+    cosClientFactory: Symbol.for("@skillbuilder/minitool-core/cos-client-factory"),
+    upload: Symbol.for("@skillbuilder/minitool-core/upload"),
+});

package/lib/index.js

@@ -0,0 +1,29 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./di"), exports);
+__exportStar(require("./runtime"), exports);
+__exportStar(require("./services"), exports);
+__exportStar(require("./utils/tracker"), exports);
+__exportStar(require("./utils/helper"), exports);
+__exportStar(require("./utils/loading"), exports);
+__exportStar(require("./utils/logger"), exports);
+__exportStar(require("./utils/open-browser"), exports);
+__exportStar(require("./utils/output"), exports);
+__exportStar(require("./utils/port-finder"), exports);
+__exportStar(require("./utils/project-validator"), exports);
+__exportStar(require("./utils/request"), exports);
+__exportStar(require("./utils/table"), exports);

package/lib/runtime.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMinitoolCore = createMinitoolCore;
+const endpoints_1 = require("@skillbuilder/endpoints");
+const inversify_1 = require("inversify");
+const modules_1 = require("./di/modules");
+const tokens_1 = require("./di/tokens");
+class DefaultMinitoolRuntime {
+    container;
+    upload;
+    miniTools;
+    disposed = false;
+    disposePromise;
+    constructor(container) {
+        this.container = container;
+        this.upload = container.get(tokens_1.MINITOOL_TOKENS.upload);
+        this.miniTools = container.get(tokens_1.MINITOOL_TOKENS.miniTool);
+    }
+    get isDisposed() {
+        return this.disposed;
+    }
+    dispose() {
+        if (!this.disposePromise) {
+            this.disposed = true;
+            this.disposePromise = this.container.unbindAll();
+        }
+        return this.disposePromise;
+    }
+}
+/** 组装相互隔离、可释放的业务 Runtime；Container 不向调用方暴露。 */
+function createMinitoolCore(options) {
+    const container = new inversify_1.Container({ defaultScope: "Singleton" });
+    const modules = [
+        (0, modules_1.createMinitoolModule)({
+            auth: options.accessTokens,
+            api: options.api ?? { apiBaseUrl: endpoints_1.EDITH_BASE_URL },
+        }),
+    ];
+    modules.push(...(options.modules ?? []));
+    container.loadSync(...modules);
+    return new DefaultMinitoolRuntime(container);
+}

package/lib/services/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./minitool-service"), exports);
+__exportStar(require("./upload-service"), exports);
+__exportStar(require("./minitool-api"), exports);

package/lib/services/minitool-api.js

@@ -0,0 +1,125 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MiniToolHttpClient = exports.MINITOOL_ROUTES = void 0;
+exports.isRecord = isRecord;
+exports.validateApiBaseUrl = validateApiBaseUrl;
+require("reflect-metadata");
+const inversify_1 = require("inversify");
+const tokens_1 = require("../di/tokens");
+const cli_apm_1 = require("../utils/tracker/cli-apm");
+const minitool_contract_1 = require("./minitool-contract");
+const PREFIX = "/api/sns/v2/creator/red_app/third";
+exports.MINITOOL_ROUTES = Object.freeze({
+    config: ["GET", `${PREFIX}/config`],
+    list: ["GET", `${PREFIX}/list`],
+    status: ["GET", `${PREFIX}/detail`],
+    history: ["GET", `${PREFIX}/history_version`],
+    submit: ["POST", `${PREFIX}/save`],
+    edit: ["POST", `${PREFIX}/base/save`],
+    preview: ["POST", `${PREFIX}/preview_code`],
+    permit: ["GET", "/api/sns/v2/red_skill/upload/permit"],
+});
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/** 仅允许 HTTPS 或本机测试地址，且禁止凭据重定向到其他 host。 */
+function validateApiBaseUrl(value) {
+    const url = new URL(value);
+    if ((url.protocol !== "https:" &&
+        !(url.protocol === "http:" && ["localhost", "127.0.0.1"].includes(url.hostname))) ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        url.pathname !== "/")
+        throw new Error("API 地址须为 HTTPS origin（本机测试服务除外）");
+    return url.origin;
+}
+let MiniToolHttpClient = class MiniToolHttpClient {
+    accessTokens;
+    baseUrl;
+    request;
+    constructor(accessTokens, options) {
+        this.accessTokens = accessTokens;
+        this.baseUrl = validateApiBaseUrl(options.apiBaseUrl);
+        this.request = options.request ?? fetch;
+    }
+    async call(operation, payload) {
+        const [method, route] = exports.MINITOOL_ROUTES[operation];
+        const url = new URL(route, this.baseUrl);
+        const mutation = method === "POST";
+        if (!mutation) {
+            for (const [key, value] of Object.entries(payload)) {
+                if (value !== undefined)
+                    url.searchParams.set(key, String(value));
+            }
+        }
+        const token = await this.accessTokens.getAccessToken();
+        const unknown = () => new minitool_contract_1.MiniToolError("OUTCOME_UNKNOWN", "请求结果未知，请先查询列表、状态或历史版本确认结果，再决定是否重试。");
+        let response;
+        try {
+            response = await this.request(url, {
+                method,
+                headers: {
+                    authorization: `Bearer ${token}`,
+                    ...(mutation ? { "content-type": "application/json" } : {}),
+                },
+                body: mutation ? JSON.stringify(payload) : undefined,
+                redirect: "error",
+                signal: AbortSignal.timeout(30_000),
+            });
+        }
+        catch {
+            (0, cli_apm_1.reportCliHttpError)({ method, url: `${url.origin}${url.pathname}` });
+            throw mutation
+                ? unknown()
+                : new minitool_contract_1.MiniToolError("REQUEST_FAILED", "小工具接口请求失败，请稍后重试");
+        }
+        if (response.status === 401 || response.status === 403) {
+            throw new minitool_contract_1.MiniToolError("AUTH_REQUIRED", "登录凭据或接口权限无效，请重新扫码登录并检查来源权限");
+        }
+        if (!response.ok) {
+            if (mutation && (response.status >= 500 || response.status === 408))
+                throw unknown();
+            throw new minitool_contract_1.MiniToolError("REQUEST_FAILED", `小工具接口请求失败（HTTP ${response.status}）`);
+        }
+        let body;
+        try {
+            body = await response.json();
+        }
+        catch {
+            throw mutation ? unknown() : new minitool_contract_1.MiniToolError("INVALID_RESPONSE", "服务端未返回有效 JSON");
+        }
+        if (isRecord(body) &&
+            (body.success === false ||
+                (body.code !== undefined && ![0, "0", "OK"].includes(body.code)))) {
+            // 不拼接服务端原文，避免网关回显 Token / 临时上传凭据。
+            throw new minitool_contract_1.MiniToolError("API_REJECTED", "服务端拒绝请求，请检查参数与账号权限");
+        }
+        if (!isRecord(body) || !isRecord(body.data)) {
+            throw mutation
+                ? unknown()
+                : new minitool_contract_1.MiniToolError("INVALID_RESPONSE", "服务端响应缺少 data 对象");
+        }
+        return body.data;
+    }
+};
+exports.MiniToolHttpClient = MiniToolHttpClient;
+exports.MiniToolHttpClient = MiniToolHttpClient = __decorate([
+    (0, inversify_1.injectable)(),
+    __param(0, (0, inversify_1.inject)(tokens_1.MINITOOL_TOKENS.auth)),
+    __param(1, (0, inversify_1.inject)(tokens_1.MINITOOL_TOKENS.apiOptions)),
+    __metadata("design:paramtypes", [Object, Object])
+], MiniToolHttpClient);

package/lib/services/minitool-contract.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MiniToolError = exports.miniToolUploadSchema = exports.miniToolEditSchema = exports.miniToolReviewSchema = exports.miniToolPreviewSchema = exports.miniToolDetailSchema = exports.miniToolListSchema = exports.miniToolSourceSchema = void 0;
+exports.parseMiniToolInput = parseMiniToolInput;
+const zod_1 = require("zod");
+const text = zod_1.z.string().trim().min(1);
+const version = text.regex(/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/, "版本须为 x.y.z");
+const md5 = text.regex(/^[a-f\d]{32}$/i, "md5 须为 32 位十六进制字符串").toLowerCase();
+const codes = zod_1.z
+    .array(text)
+    .refine((values) => new Set(values).size === values.length, "编码不能重复");
+const source = { source: text };
+exports.miniToolSourceSchema = zod_1.z.strictObject(source);
+exports.miniToolListSchema = zod_1.z.strictObject({
+    ...source,
+    pageNum: zod_1.z.number().int().min(1).max(2147483647).default(1),
+    pageSize: zod_1.z.number().int().min(1).max(100).default(20),
+});
+exports.miniToolDetailSchema = zod_1.z.strictObject({ ...source, appId: text });
+exports.miniToolPreviewSchema = zod_1.z.strictObject({
+    ...source,
+    pkgFileId: text,
+    md5,
+    appName: text.optional(),
+    iconFileId: text.optional(),
+    version: version.optional(),
+});
+exports.miniToolReviewSchema = zod_1.z.strictObject({
+    ...source,
+    appId: text.optional(),
+    appName: text,
+    slogan: text,
+    iconFileId: text,
+    coverFileId: text,
+    version,
+    pkgFileId: text,
+    md5,
+    categories: codes.length(1),
+    authorizations: codes.default([]),
+});
+// 平台 base/save 要求完整基础资料；只改一项时，其余必填项仍需传回现有值。
+exports.miniToolEditSchema = zod_1.z.strictObject({
+    ...source,
+    appId: text,
+    appName: text,
+    slogan: text,
+    iconFileId: text,
+    coverFileId: text.optional(),
+});
+exports.miniToolUploadSchema = zod_1.z.strictObject({
+    filePath: text,
+    type: zod_1.z.enum(["pkg", "image"]),
+    expectedSha256: text
+        .regex(/^[a-f\d]{64}$/i)
+        .toLowerCase()
+        .optional(),
+});
+function parseMiniToolInput(schema, value) {
+    const result = schema.safeParse(value);
+    if (!result.success) {
+        const detail = result.error.issues
+            .map((issue) => `${issue.path.join(".") || "参数"}: ${issue.message}`)
+            .join("；");
+        throw new MiniToolError("INVALID_ARGS", detail);
+    }
+    return result.data;
+}
+class MiniToolError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "MiniToolError";
+    }
+}
+exports.MiniToolError = MiniToolError;

package/lib/services/minitool-service.js

@@ -0,0 +1,161 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MiniToolService = void 0;
+require("reflect-metadata");
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const inversify_1 = require("inversify");
+const zod_1 = require("zod");
+const tokens_1 = require("../di/tokens");
+const project_validator_1 = require("../utils/project-validator");
+const minitool_contract_1 = require("./minitool-contract");
+const upload_service_1 = require("./upload-service");
+__exportStar(require("./minitool-contract"), exports);
+const appSchema = zod_1.z
+    .object({
+    appId: zod_1.z.string().min(1),
+    appName: zod_1.z.string().optional(),
+    version: zod_1.z.string().optional(),
+    status: zod_1.z.number().optional(),
+    auditStatus: zod_1.z.number().optional(),
+})
+    .passthrough();
+const optionSchema = zod_1.z.object({ code: zod_1.z.string(), name: zod_1.z.string().optional() }).passthrough();
+const configSchema = zod_1.z
+    .object({ categories: zod_1.z.array(optionSchema), authorizations: zod_1.z.array(optionSchema) })
+    .passthrough();
+function response(schema, value, mutation = false) {
+    const result = schema.safeParse(value);
+    if (!result.success)
+        throw new minitool_contract_1.MiniToolError(mutation ? "OUTCOME_UNKNOWN" : "INVALID_RESPONSE", mutation ? "请求结果未知，请先查询状态确认结果，再决定是否重试" : "小工具接口响应格式无效");
+    return result.data;
+}
+function statusText(value) {
+    const output = { ...value };
+    if (Number.isInteger(value.status))
+        output.statusText =
+            ["未发布", "审核中", "已发布", "未通过", "已下架"][value.status] ?? "未知";
+    if (Number.isInteger(value.auditStatus))
+        output.auditStatusText =
+            ["未知", "审核中", "审核通过", "审核驳回", "创作者撤回"][value.auditStatus] ??
+                "未知";
+    return output;
+}
+/** 编排业务校验、平台接口与文件传输；不读取凭据文件。 */
+let MiniToolService = class MiniToolService {
+    api;
+    uploadService;
+    constructor(api, uploadService) {
+        this.api = api;
+        this.uploadService = uploadService;
+    }
+    async getConfig(input) {
+        return response(configSchema, await this.api.call("config", (0, minitool_contract_1.parseMiniToolInput)(minitool_contract_1.miniToolSourceSchema, input)));
+    }
+    async list(input) {
+        const { source, pageNum, pageSize } = (0, minitool_contract_1.parseMiniToolInput)(minitool_contract_1.miniToolListSchema, input);
+        const data = response(zod_1.z.object({ apps: zod_1.z.array(appSchema), total: zod_1.z.number().int().nonnegative() }), await this.api.call("list", { source, page_num: pageNum, page_size: pageSize }));
+        return { apps: data.apps.map(statusText), total: data.total, pageNum, pageSize };
+    }
+    async getStatus(input) {
+        return statusText(response(appSchema, await this.api.call("status", (0, minitool_contract_1.parseMiniToolInput)(minitool_contract_1.miniToolDetailSchema, input))));
+    }
+    async getHistory(input) {
+        const data = response(zod_1.z.object({ versions: zod_1.z.array(zod_1.z.record(zod_1.z.string(), zod_1.z.unknown())) }).passthrough(), await this.api.call("history", (0, minitool_contract_1.parseMiniToolInput)(minitool_contract_1.miniToolDetailSchema, input)));
+        return { ...data, versions: data.versions.map(statusText) };
+    }
+    async upload(input) {
+        const valid = (0, minitool_contract_1.parseMiniToolInput)(minitool_contract_1.miniToolUploadSchema, input);
+        const { bytes, ...file } = await (0, project_validator_1.inspectMiniToolFile)(valid.filePath, valid.type);
+        if (valid.expectedSha256 && valid.expectedSha256 !== file.sha256)
+            throw new minitool_contract_1.MiniToolError("LOCAL_FILE_CHANGED", "文件在确认后发生变化，请重新检查并确认上传");
+        const scene = file.type === "pkg" ? "red_app" : "red_skill_tool_image";
+        // 上传校验过的快照，避免 COS 按路径读取期间本地产物被改写。
+        const temporary = await promises_1.default.mkdtemp(node_path_1.default.join(node_os_1.default.tmpdir(), "redminitool-upload-"));
+        try {
+            const snapshot = node_path_1.default.join(temporary, `upload.${file.format}`);
+            await promises_1.default.writeFile(snapshot, bytes, { mode: 0o600 });
+            const uploaded = await this.uploadService.upload({
+                filePath: snapshot,
+                bizName: "spectrum",
+                scene,
+                contentType: file.type === "pkg"
+                    ? "application/zip"
+                    : `image/${file.format === "jpg" ? "jpeg" : file.format}`,
+                getPermit: async () => (0, upload_service_1.normalizeUploadPermit)(await this.api.call("permit", {
+                    biz_name: "spectrum",
+                    scene,
+                    file_count: 1,
+                    file_format: file.format,
+                    version: 1,
+                    source: "web",
+                })),
+            });
+            return {
+                fileId: uploaded.fileId,
+                md5: file.md5,
+                sha256: file.sha256,
+                size: file.size,
+                type: file.type,
+            };
+        }
+        finally {
+            await promises_1.default.rm(temporary, { recursive: true, force: true });
+        }
+    }
+    async createPreview(input) {
+        const valid = (0, minitool_contract_1.parseMiniToolInput)(minitool_contract_1.miniToolPreviewSchema, input);
+        return response(zod_1.z.object({ previewUrl: zod_1.z.url() }).passthrough(), await this.api.call("preview", valid), true);
+    }
+    async submitReview(input) {
+        const valid = (0, minitool_contract_1.parseMiniToolInput)(minitool_contract_1.miniToolReviewSchema, input);
+        const config = await this.getConfig({ source: valid.source });
+        for (const field of ["categories", "authorizations"]) {
+            const allowed = new Set(config[field].map((item) => item.code));
+            if (valid[field].some((code) => !allowed.has(code)))
+                throw new minitool_contract_1.MiniToolError("INVALID_ARGS", `${field} 包含平台配置中不存在的编码`);
+        }
+        return statusText(response(zod_1.z.object({ appId: zod_1.z.string().min(1) }).passthrough(), await this.api.call("submit", valid), true));
+    }
+    async edit(input) {
+        const valid = (0, minitool_contract_1.parseMiniToolInput)(minitool_contract_1.miniToolEditSchema, input);
+        return response(zod_1.z.object({ appId: zod_1.z.string().min(1) }).passthrough(), await this.api.call("edit", valid), true);
+    }
+};
+exports.MiniToolService = MiniToolService;
+exports.MiniToolService = MiniToolService = __decorate([
+    (0, inversify_1.injectable)(),
+    __param(0, (0, inversify_1.inject)(tokens_1.MINITOOL_TOKENS.api)),
+    __param(1, (0, inversify_1.inject)(tokens_1.MINITOOL_TOKENS.upload)),
+    __metadata("design:paramtypes", [Object, Object])
+], MiniToolService);