@uzooai/anime-ai-cli 0.0.0-stage → 0.5.0

package/src/annotation-media.js

@@ -0,0 +1,386 @@
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import { mediaTools, runMedia, probeMedia, hashFile } from './media.js'
+import { cropGeometry } from './image-media.js'
+
+const finite = (value) => typeof value === 'number' && Number.isFinite(value)
+const keys = {
+  rect: ['x', 'y', 'width', 'height', 'strokeWidth'],
+  ellipse: ['x', 'y', 'width', 'height', 'strokeWidth'],
+  line: ['x', 'y', 'x2', 'y2', 'strokeWidth'],
+  brush: ['points', 'strokeWidth'],
+  text: ['x', 'y', 'text', 'fontSize']
+}
+export function annotationCommands(commands) {
+  if (!Array.isArray(commands) || !commands.length || commands.length > 100)
+    throw new Error('标注须为1–100条指令')
+  let points = 0
+  return commands.map((command) => {
+    if (
+      !command ||
+      typeof command !== 'object' ||
+      Array.isArray(command) ||
+      !keys[command.type] ||
+      Object.keys(command).some(
+        (k) => !['type', 'color', 'rotation', ...keys[command.type]].includes(k)
+      )
+    )
+      throw new Error('标注类型/字段未接入')
+    const result = {
+      ...command,
+      color: command.color ?? '#ff4d4f',
+      rotation: command.rotation ?? 0
+    }
+    if (
+      !/^#[a-fA-F0-9]{6}(?:[a-fA-F0-9]{2})?$/.test(result.color) ||
+      !finite(result.rotation) ||
+      Math.abs(result.rotation) > 360
+    )
+      throw new Error('标注颜色须为#RRGGBB或#RRGGBBAA，rotation为-360至360度')
+    if (command.type === 'text') {
+      result.fontSize = command.fontSize ?? 16
+      if (
+        typeof command.text !== 'string' ||
+        !command.text.trim() ||
+        command.text.length > 2000 ||
+        /[\x00-\x1f\x7f]/.test(command.text) ||
+        !finite(result.fontSize) ||
+        result.fontSize < 1 ||
+        result.fontSize > 1024
+      )
+        throw new Error('文字标注须为非空单行文本，fontSize为1–1024原图像素')
+      if (result.rotation !== 0) throw new Error('文字旋转尚未接入；可用未旋转文字，图形旋转已接入')
+    } else {
+      result.strokeWidth = command.strokeWidth ?? 1
+      if (!finite(result.strokeWidth) || result.strokeWidth < 1 || result.strokeWidth > 512)
+        throw new Error('strokeWidth为1–512原图像素')
+    }
+    if (command.type === 'brush') {
+      if (
+        !Array.isArray(command.points) ||
+        command.points.length < 2 ||
+        command.points.some(
+          (p) =>
+            !p ||
+            typeof p !== 'object' ||
+            Array.isArray(p) ||
+            Object.keys(p).some((k) => !['x', 'y'].includes(k)) ||
+            !finite(p.x) ||
+            !finite(p.y)
+        )
+      )
+        throw new Error('画笔需要至少2个有效{x,y}点')
+      points += command.points.length
+      if (points > 20000) throw new Error('本次画笔总点数超过20000')
+      result.points = command.points.map((p) => ({ x: p.x, y: p.y }))
+    } else {
+      const fields =
+        command.type === 'line'
+          ? ['x', 'y', 'x2', 'y2']
+          : ['x', 'y', ...(['rect', 'ellipse'].includes(command.type) ? ['width', 'height'] : [])]
+      if (fields.some((k) => !finite(command[k]))) throw new Error('标注坐标须为有限原图像素数值')
+      if (['rect', 'ellipse'].includes(command.type)) {
+        if (!command.width || !command.height) throw new Error('矩形/椭圆尺寸不能为0')
+        result.x = Math.min(command.x, command.x + command.width)
+        result.y = Math.min(command.y, command.y + command.height)
+        result.width = Math.abs(command.width)
+        result.height = Math.abs(command.height)
+      }
+    }
+    return result
+  })
+}
+export function annotationGeometry(source, commands) {
+  const geometry = cropGeometry(source, {
+    rect: { left: 0, top: 0, width: source.width, height: source.height }
+  })
+  const inside = (x, y) => x >= 0 && y >= 0 && x <= source.width && y <= source.height
+  for (const command of commands) {
+    const positions =
+      command.type === 'brush'
+        ? command.points
+        : command.type === 'line'
+          ? [
+              { x: command.x, y: command.y },
+              { x: command.x2, y: command.y2 }
+            ]
+          : [
+              { x: command.x, y: command.y },
+              ...(['rect', 'ellipse'].includes(command.type)
+                ? [{ x: command.x + command.width, y: command.y + command.height }]
+                : [])
+            ]
+    if (positions.some((p) => !inside(p.x, p.y)))
+      throw new Error('标注区域超出原图；坐标使用原图像素')
+  }
+  return { source: geometry.source, output: geometry.output }
+}
+async function verifyFontGlyphs(file, text) {
+  const stat = await fs.stat(file)
+  if (stat.size > 100 * 1024 * 1024) throw new Error('字体超过可核验大小')
+  const data = await fs.readFile(file)
+  const u16 = (n) => data.readUInt16BE(n),
+    u32 = (n) => data.readUInt32BE(n)
+  const face = data.toString('ascii', 0, 4) === 'ttcf' ? u32(12) : 0
+  let cmap = -1
+  for (let i = 0; i < u16(face + 4); i++) {
+    const entry = face + 12 + i * 16
+    if (data.toString('ascii', entry, entry + 4) === 'cmap') {
+      cmap = u32(entry + 8)
+      break
+    }
+  }
+  if (cmap < 0) throw new Error('字体没有可核验的Unicode字符映射')
+  const tables = []
+  for (let i = 0; i < u16(cmap + 2); i++) {
+    const entry = cmap + 4 + i * 8,
+      platform = u16(entry),
+      encoding = u16(entry + 2),
+      offset = cmap + u32(entry + 4)
+    if (platform === 0 || (platform === 3 && [1, 10].includes(encoding))) {
+      const format = u16(offset)
+      if ([4, 12].includes(format)) tables.push({ offset, format })
+    }
+  }
+  if (!tables.length) throw new Error('字体Unicode映射格式尚不能核验')
+  const contains = (point) =>
+    tables.some(({ offset, format }) => {
+      if (format === 12) {
+        for (let i = 0; i < u32(offset + 12); i++) {
+          const group = offset + 16 + i * 12,
+            start = u32(group),
+            end = u32(group + 4)
+          if (point >= start && point <= end) return u32(group + 8) + (point - start) !== 0
+        }
+      } else if (point <= 65535) {
+        const count = u16(offset + 6) / 2,
+          endBase = offset + 14,
+          startBase = endBase + count * 2 + 2,
+          deltaBase = startBase + count * 2,
+          rangeBase = deltaBase + count * 2
+        for (let i = 0; i < count; i++) {
+          const start = u16(startBase + i * 2),
+            end = u16(endBase + i * 2)
+          if (point >= start && point <= end) {
+            const range = u16(rangeBase + i * 2),
+              delta = u16(deltaBase + i * 2)
+            if (!range) return ((point + delta) & 65535) !== 0
+            const glyph = u16(rangeBase + i * 2 + range + (point - start) * 2)
+            return glyph !== 0 && ((glyph + delta) & 65535) !== 0
+          }
+        }
+      }
+      return false
+    })
+  const missing = [...new Set([...text].map((c) => c.codePointAt(0)))].filter((c) => !contains(c))
+  if (missing.length) throw new Error('所选字体缺少本次文字字形')
+}
+export async function annotationTools(commands, options = {}) {
+  const tools = await mediaTools(options)
+  const filters = (
+    await runMedia(tools.ffmpeg, ['-hide_banner', '-filters'], { maxBytes: 1024 * 1024 })
+  ).toString()
+  const required = [
+    ...(commands.some((c) => c.type !== 'text') ? ['drawvg'] : []),
+    ...(commands.some((c) => c.type === 'text') ? ['drawtext'] : [])
+  ]
+  const missing = required.filter((name) => !new RegExp('\\b' + name + '\\s').test(filters))
+  if (missing.length)
+    throw Object.assign(
+      new Error(
+        '现有FFmpeg缺少标注能力 ' +
+          missing.join('、') +
+          '；请先说明兼容版本/构建方案并询问是否更新，或提供已有兼容工具路径'
+      ),
+      {
+        code: 'MEDIA_UNAVAILABLE',
+        dependency: {
+          status: 'dependency_unavailable',
+          package: 'FFmpeg',
+          required_tools: ['ffmpeg', 'ffprobe'],
+          required_capabilities: required,
+          missing_capabilities: missing,
+          installation_requires_confirmation: true,
+          installation_performed: false,
+          next: 'ask_user_to_update_or_provide_compatible_tools'
+        }
+      }
+    )
+  if (commands.some((c) => c.type === 'text')) {
+    const fontFile =
+      options.fontFile ||
+      (process.platform === 'win32'
+        ? path.join(process.env.WINDIR || 'C:\\Windows', 'Fonts', 'msyh.ttc')
+        : '')
+    try {
+      if (!fontFile) throw new Error('missing')
+      tools.fontFile = path.resolve(fontFile)
+      tools.fontHash = await hashFile(tools.fontFile)
+    } catch {
+      throw Object.assign(
+        new Error(
+          '文字标注需要可用字体文件；中文建议提供已安装的中文字体路径。缺失时先询问安装，不能用缺字方框冒充成功'
+        ),
+        {
+          code: 'MEDIA_UNAVAILABLE',
+          dependency: {
+            status: 'awaiting_dependency_installation',
+            package: 'CJK font',
+            required_fonts: ['中文字体文件'],
+            installation_requires_confirmation: true,
+            installation_performed: false,
+            next: 'ask_user_to_install_font_or_provide_path'
+          }
+        }
+      )
+    }
+    try {
+      await verifyFontGlyphs(
+        tools.fontFile,
+        commands
+          .filter((c) => c.type === 'text')
+          .map((c) => c.text)
+          .join('')
+      )
+    } catch {
+      throw Object.assign(
+        new Error(
+          '所选字体不能完整核验/显示本次文字，请提供包含所需字形的Unicode字体；不以缺字方框继续'
+        ),
+        {
+          code: 'MEDIA_UNAVAILABLE',
+          dependency: {
+            status: 'dependency_unavailable',
+            package: 'font',
+            required_fonts: ['包含本次文字字形的Unicode字体'],
+            installation_requires_confirmation: true,
+            installation_performed: false,
+            next: 'ask_user_to_choose_font_or_confirm_installation'
+          }
+        }
+      )
+    }
+  }
+  return tools
+}
+export function vectorScript(command, source, output) {
+  const color = command.color.slice(1),
+    rgba = [0, 2, 4].map((i) => parseInt(color.slice(i, i + 2), 16) / 255)
+  rgba.push(color.length === 8 ? parseInt(color.slice(6), 16) / 255 : 1)
+  const script = [
+    `scalexy ${output.width / source.width} ${output.height / source.height}`,
+    `setrgba ${rgba.join(' ')}`,
+    `setlinewidth ${command.strokeWidth}`,
+    'setlinecap round',
+    'setlinejoin round'
+  ]
+  let center
+  if (command.type === 'line')
+    center = { x: (command.x + command.x2) / 2, y: (command.y + command.y2) / 2 }
+  else if (command.type === 'brush') {
+    const xs = command.points.map((p) => p.x),
+      ys = command.points.map((p) => p.y)
+    center = {
+      x: (Math.min(...xs) + Math.max(...xs)) / 2,
+      y: (Math.min(...ys) + Math.max(...ys)) / 2
+    }
+  } else center = { x: command.x + command.width / 2, y: command.y + command.height / 2 }
+  if (command.rotation)
+    script.push(
+      `translate ${center.x} ${center.y}`,
+      `rotate ${command.rotation}`,
+      `translate ${-center.x} ${-center.y}`
+    )
+  if (command.type === 'rect')
+    script.push(`rect ${command.x} ${command.y} ${command.width} ${command.height}`)
+  else if (command.type === 'ellipse')
+    script.push(`ellipse ${center.x} ${center.y} ${command.width / 2} ${command.height / 2}`)
+  else {
+    const points =
+      command.type === 'line'
+        ? [
+            { x: command.x, y: command.y },
+            { x: command.x2, y: command.y2 }
+          ]
+        : command.points
+    script.push(
+      `moveto ${points[0].x} ${points[0].y}`,
+      ...points.slice(1).map((p) => `lineto ${p.x} ${p.y}`)
+    )
+  }
+  script.push('stroke')
+  return script.join('\n') + '\n'
+}
+export async function annotateImage(source, target, geometry, commands, tools) {
+  const actual = await probeMedia(source, tools)
+  if (!['png', 'mjpeg'].includes(actual.codec) || actual.rotation || actual.orientation > 1)
+    throw new Error('当前标注仅接入静态PNG/JPEG，方向元数据/其他格式待验证')
+  if (actual.width !== geometry.source.width || actual.height !== geometry.source.height)
+    throw new Error('标注实际原图尺寸与元数据不一致')
+  const directory = path.dirname(target),
+    filters = [
+      `scale=${geometry.output.width}:${geometry.output.height}:flags=lanczos`,
+      'format=bgra'
+    ]
+  if (tools.fontFile) {
+    const hash = await hashFile(tools.fontFile)
+    if (hash.sha256 !== tools.fontHash.sha256) throw new Error('本次文字字体文件发生变化')
+    await fs.copyFile(tools.fontFile, path.join(directory, 'ann-font.bin'))
+  }
+  for (let i = 0; i < commands.length; i++) {
+    const command = commands[i]
+    if (command.type === 'text') {
+      await fs.writeFile(path.join(directory, `ann-text-${i}.txt`), command.text, {
+        encoding: 'utf8'
+      })
+      const size = (command.fontSize * geometry.output.height) / geometry.source.height
+      const x = (command.x * geometry.output.width) / geometry.source.width,
+        y = (command.y * geometry.output.height) / geometry.source.height
+      filters.push(
+        `drawtext=fontfile=ann-font.bin:textfile=ann-text-${i}.txt:expansion=none:fontcolor=0x${command.color.slice(1)}:fontsize=${size}:x=${x}:y=${y}+${size}-ascent`
+      )
+    } else {
+      await fs.writeFile(
+        path.join(directory, `ann-vector-${i}.vgs`),
+        vectorScript(command, geometry.source, geometry.output),
+        { encoding: 'utf8' }
+      )
+      filters.push(`drawvg=file=ann-vector-${i}.vgs`)
+    }
+  }
+  filters.push('format=rgba')
+  await fs.writeFile(path.join(directory, 'ann-filter.txt'), filters.join(','), {
+    encoding: 'utf8'
+  })
+  await runMedia(
+    tools.ffmpeg,
+    [
+      '-nostdin',
+      '-v',
+      'error',
+      '-protocol_whitelist',
+      'file,pipe',
+      '-i',
+      source,
+      '-map',
+      '0:v:0',
+      '-filter_script:v',
+      'ann-filter.txt',
+      '-frames:v',
+      '1',
+      '-c:v',
+      'png',
+      '-n',
+      target
+    ],
+    { cwd: directory }
+  )
+  const image = await probeMedia(target, tools)
+  if (
+    image.codec !== 'png' ||
+    image.width !== geometry.output.width ||
+    image.height !== geometry.output.height
+  )
+    throw new Error('标注PNG导出尺寸不一致')
+  return { width: image.width, height: image.height, ...(await hashFile(target)) }
+}

package/src/api.js

@@ -0,0 +1,168 @@
+import { signRequest, bodyBytes, unwrap, getSetCookie, mergeCookie } from './protocol.js'
+import crypto from 'node:crypto'
+import { CLIENT_ID, e1Request } from './cli-authorization.js'
+
+export const cancellation = new AbortController()
+
+export function baseUrl(value = 'http://localhost:8000/api/v1') {
+  const url = new URL(value)
+  if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) throw new Error('API URL 无效')
+  if (url.protocol !== 'https:' && !['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)) throw new Error('远程 API 必须使用 HTTPS')
+  return url.toString().replace(/\/+$/, '').replace(/(?:\/api\/v1)?$/, '/api/v1')
+}
+function resourceUrl(url) {
+  const u = new URL(url)
+  if (!['http:', 'https:'].includes(u.protocol) || u.username || u.password) throw new Error('资源 URL 无效')
+  if (u.protocol !== 'https:' && !['localhost', '127.0.0.1', '[::1]'].includes(u.hostname)) throw new Error('远程资源必须使用 HTTPS')
+  return u
+}
+export async function request(url, options = {}, timeout = 30000) {
+  return fetch(resourceUrl(url), { ...options, redirect: 'error', signal: AbortSignal.any([cancellation.signal, options.signal || AbortSignal.timeout(timeout)]) })
+}
+// Only anonymous file GETs may follow the backend's signed-reference renewal.
+// API/auth requests and uploads retain the strict no-redirect contract above.
+export async function requestFile(url, timeout = 30000) {
+  const signal = AbortSignal.any([cancellation.signal, AbortSignal.timeout(timeout)])
+  let current = resourceUrl(url)
+  for (let redirects = 0; ; redirects++) {
+    const response = await fetch(current, { method: 'GET', redirect: 'manual', credentials: 'omit', signal })
+    if (response.status === 307) {
+      const location = response.headers.get('location')
+      await response.body?.cancel()
+      if (!location || redirects >= 5) throw new Error('文件引用续期跳转缺少地址或超过5次；重新从有权限的业务下载接口获取链接')
+      const next = resourceUrl(new URL(location, current))
+      if (current.protocol === 'https:' && next.protocol !== 'https:') throw new Error('文件续期不能从HTTPS降级；请核对服务返回地址')
+      current = next
+      continue
+    }
+    const mime = response.headers.get('content-type') || ''
+    if (response.status === 200 && !/(?:json|text\/html)/i.test(mime)) return response
+    let payload
+    if (/json/i.test(mime)) {
+      const reader = response.body?.getReader(), chunks = []
+      let bytes = 0
+      try {
+        while (reader) {
+          const { done, value } = await reader.read()
+          if (done) { try { payload = JSON.parse(Buffer.concat(chunks).toString('utf8')) } catch {} break }
+          bytes += value.length
+          if (bytes > 65536) break
+          chunks.push(value)
+        }
+      } finally { await reader?.cancel().catch(() => {}) }
+    } else await response.body?.cancel()
+    const apiCode = Number(payload?.code)
+    const error = Object.assign(new Error('文件下载返回错误状态或错误页面（HTTP ' + response.status +
+      (Number.isFinite(apiCode) && apiCode !== 0 ? '，code ' + apiCode : '') + '）；未保存文件，需通过原业务接口核验权限或刷新链接'),
+    { code: 'API_ERROR', status: response.status })
+    if (Number.isFinite(apiCode) && apiCode !== 0) error.apiCode = apiCode
+    const requestId = String(payload?.request_id || response.headers.get('x-request-id') || '')
+    if (/^[a-zA-Z0-9_-]{1,120}$/.test(requestId)) error.requestId = requestId
+    throw error
+  }
+}
+
+export class ApiClient {
+  constructor(profile, store, timeout = 30000) { Object.assign(this, profile); this.baseUrl = baseUrl(profile.baseUrl); this.store = store; this.timeout = timeout; this.sign = null }
+  async save() { await this.store.save(this) }
+  async raw(endpoint, options = {}, { signed = true, retry = true, binaryPng = false, jsonMetadata = false } = {}) {
+    const method = options.method || 'GET'
+    const headers = new Headers(options.headers)
+    if (endpoint.startsWith('/canvas/')) headers.set('X-Client-Source', 'canvas')
+    const url = `${this.baseUrl}${endpoint}`
+    if (signed) {
+      if (!this.sign || this.sign.expiresAt < Date.now() + 5000) {
+        const data = await this.raw('/auth/sign-session', {}, { signed: false, retry })
+        const s = data.sign || data
+        if (!s.keyId || !s.apiSecret) throw new Error('签名会话响应不完整')
+        this.sign = { ...s, expiresAt: Date.now() + Number(s.expiresIn || 7200) * 1000 }
+      }
+      Object.entries(signRequest({ method, url, body: options.body, ...this.sign })).forEach(([k, v]) => headers.set(k, v))
+    }
+    // Fetching the signing session may rotate credentials; use the current pair.
+    if (this.accessToken) headers.set('Authorization', `Bearer ${this.accessToken}`)
+    if (this.cookie) headers.set('Cookie', this.cookie)
+    if (this.deviceId) headers.set('X-Device-Id', this.deviceId)
+    const csrf = String(this.cookie || '').split(';').map(x => x.trim()).find(x => /csrf/i.test(x.split('=')[0]))
+    if (csrf) headers.set('X-CSRF-Token', csrf.slice(csrf.indexOf('=') + 1))
+    if (options.body !== undefined && !headers.has('Content-Type')) headers.set('Content-Type', options.body instanceof URLSearchParams ? 'application/x-www-form-urlencoded' : 'application/json')
+    const response = await request(url, { ...options, method, headers, body: options.body === undefined ? undefined : bodyBytes(options.body) }, this.timeout)
+    const cookies = getSetCookie(response.headers)
+    if (cookies.length) { this.cookie = mergeCookie(this.cookie, cookies); await this.save() }
+    if (binaryPng && response.ok && /^image\/png(?:;|$)/i.test(response.headers.get('content-type') || '')) {
+      const limit = 128 * 1024 * 1024
+      if (Number(response.headers.get('content-length')) > limit) { await response.body?.cancel(); throw new Error('PNG响应超过128MB限制；不重发处理') }
+      const chunks = []; let size = 0
+      for await (const chunk of response.body) {
+        size += chunk.length
+        if (size > limit) throw new Error('PNG响应超过128MB限制；不重发处理')
+        chunks.push(chunk)
+      }
+      const headers = Object.fromEntries(['content-type','content-length','content-disposition','x-result-ref','x-result-url','x-source-ref','x-source-url','x-credit-cost','x-request-id']
+        .map(key => [key,response.headers.get(key)]).filter(([,value]) => value !== null))
+      return { status:response.status,headers,body:Buffer.concat(chunks,size) }
+    }
+    const payload = await response.json().catch(() => null)
+    const requestId = String(payload?.request_id || response.headers.get('x-request-id') || '')
+    const diagnostics = error => {
+      if (/^[a-zA-Z0-9_-]{1,120}$/.test(requestId)) error.requestId = requestId
+      return error
+    }
+    if (this.authMode === 'cli' && [2011, 2012].includes(payload?.code)) {
+      const error = new Error(payload.code === 2012 ? 'CLI 会话已被新的 CLI 登录替换，请重新运行 auth login' : 'CLI 会话已过期，请重新运行 auth login')
+      error.code = 'API_ERROR'
+      throw diagnostics(error)
+    }
+    if (signed && retry && payload?.code === 2205) {
+      this.sign = null
+      return this.raw(endpoint, options, { signed, retry: false, binaryPng, jsonMetadata })
+    }
+    if ((payload?.code === 2010 || (response.status === 401 && (this.authMode !== 'cli' || payload?.code == null))) && retry && (this.refreshToken || this.cookie)) {
+      await this.refresh()
+      return this.raw(endpoint, options, { signed, retry: false, binaryPng, jsonMetadata })
+    }
+    if(Number(payload?.code)===4401) {
+      const error=new Error('需签署《统一协议》中的《Seedance2.0模型使用承诺书》（code 4401）；生成尚未执行')
+      error.code='API_ERROR';error.apiCode=4401;error.status=response.status
+      const p=payload.data?.protocol
+      if(p && typeof p.required==='boolean' && typeof p.agreed==='boolean')error.protocol={required:p.required,agreed:p.agreed,version:String(p.version || '').slice(0,200),label:'《统一协议》',document_title:'《Seedance2.0模型使用承诺书》'}
+      throw diagnostics(error)
+    }
+    if (!response.ok || payload === null) {
+      const error = new Error(`API 请求失败（HTTP ${response.status}）`)
+      error.status = response.status; error.code = 'API_ERROR'; if (Number.isFinite(payload?.code)) error.apiCode=payload.code; throw diagnostics(error)
+    }
+    try {
+      const result = unwrap(payload)
+      if (binaryPng) throw new Error('处理响应不是PNG；保留原操作，不重发')
+      return jsonMetadata ? {status:response.status,data:result} : result
+    } catch (e) {
+      const error = new Error(`API 拒绝请求（code ${Number(e.code) || 'unknown'}）`)
+      error.code = 'API_ERROR'; error.apiCode = Number(e.code); error.status = response.status
+      throw diagnostics(error)
+    }
+  }
+  async refresh() {
+    if (this.authMode === 'cli') {
+      if (!this.refreshRequestId) {
+        this.refreshRequestId = crypto.randomUUID()
+        await this.save()
+      }
+      const data = await e1Request(this.baseUrl, '/auth/cli/token', { grant_type: 'refresh_token', client_id: CLIENT_ID, device_id: this.deviceId, refresh_token: this.refreshToken, refresh_request_id: this.refreshRequestId }, this.timeout)
+      if (!data.access_token || !data.refresh_token || data.session?.client_type !== 'cli' || data.session?.device_id !== this.deviceId) throw new Error('CLI 刷新响应无效')
+      this.accessToken = data.access_token
+      this.refreshToken = data.refresh_token
+      this.refreshRequestId = ''
+      this.sign = null
+      await this.save()
+      return
+    }
+    const data = await this.raw('/auth/refresh', { method: 'POST', ...(this.refreshToken ? { body: { refresh_token: this.refreshToken } } : {}) }, { signed: false, retry: false })
+    if (!data.access_token) throw new Error('刷新响应缺少 access_token')
+    this.accessToken = data.access_token
+    if (data.refresh_token) this.refreshToken = data.refresh_token
+    else if (this.cookie) this.refreshToken = ''
+    this.sign = null
+    await this.save() // persist rotation immediately, including if the next request fails
+  }
+}

package/src/browser-login.js

@@ -0,0 +1,13 @@
+import { baseUrl } from './api.js'
+
+export function loginTarget(apiAddress, webAddress) {
+  const api = baseUrl(apiAddress)
+  const web = new URL(webAddress || new URL(api).origin)
+  // Require the deployment's explicit API origin; no credential forwarding after redirects.
+  baseUrl(web.origin)
+  if (web.username || web.password || web.hash) throw new Error('登录网站地址不能包含凭据或 fragment')
+  const login = web.pathname === '/' ? new URL('/auth/login?redirect=/workspace', web.origin) : web
+  const redirect = login.searchParams.get('redirect')
+  if (redirect && new URL(redirect, web.origin).origin !== web.origin) throw new Error('登录 redirect 必须指向同一网站')
+  return { api, origin: web.origin, url: login.href }
+}

package/src/callback-page.js

@@ -0,0 +1,44 @@
+import crypto from 'node:crypto'
+import { readFileSync } from 'node:fs'
+
+const favicon = `data:image/png;base64,${readFileSync(new URL('../assets/favicon-uzoo.png', import.meta.url)).toString('base64')}`
+const logo = `data:image/svg+xml;base64,${readFileSync(new URL('../assets/logo-uzoo.svg', import.meta.url)).toString('base64')}`
+const copy = {
+  'zh-CN': {
+    brand: 'UzooAI · CLI 授权',
+    success: ['CLI 登录成功', '授权已完成，登录凭据已安全保存在此电脑。', '返回终端，继续创作', '您可以关闭此标签页。网页会话保持登录。'],
+    received: ['授权已确认', '授权结果已收到，请返回终端查看登录结果。', '返回终端', '您可以关闭此标签页。'],
+    denied: ['已取消授权', '您已拒绝此次 CLI 登录，没有建立新的 CLI 会话。', '如需登录，请在终端重新发起授权', '原有网页会话不受影响。'],
+    failure: ['CLI 登录未完成', '无法完成令牌兑换或保存登录凭据，请查看终端中的错误信息。', '返回终端重试', '网页确认不代表 CLI 已成功登录。'],
+  },
+  en: {
+    brand: 'UzooAI · CLI authorization',
+    success: ['You’re signed in', 'Authorization is complete. Your credentials are securely saved on this computer.', 'Return to your terminal', 'You can close this tab. Your browser stays signed in.'],
+    received: ['Authorization confirmed', 'The response was received. Check your terminal for the sign-in result.', 'Return to your terminal', 'You can close this tab.'],
+    denied: ['Authorization cancelled', 'You declined CLI sign-in. No new CLI session was created.', 'Start a new request in your terminal to sign in', 'Your existing browser session is unaffected.'],
+    failure: ['CLI sign-in incomplete', 'The token exchange or credential save failed. Check your terminal for details.', 'Return to your terminal and try again', 'Browser approval alone does not mean CLI sign-in succeeded.'],
+  },
+}
+
+// Static, local assets only. Never interpolate callback parameters or errors.
+export function callbackPage(status = 'received', acceptLanguage = '') {
+  const lang = /^en\b/i.test(acceptLanguage) ? 'en' : 'zh-CN'
+  const words = copy[lang]
+  const [title, description, action, note] = words[status] || words.failure
+  const nonce = crypto.randomBytes(18).toString('base64')
+  const success = status === 'success' || status === 'received'
+  const symbol = success ? '<path d="m15 25 7 7 14-16"/>' : '<path d="m18 18 14 14m0-14L18 32"/>'
+  return {
+    headers: {
+      'Content-Type': 'text/html; charset=utf-8',
+      'Cache-Control': 'no-store',
+      'Referrer-Policy': 'no-referrer',
+      'X-Content-Type-Options': 'nosniff',
+      'Content-Security-Policy': `default-src 'none'; style-src 'nonce-${nonce}'; script-src 'nonce-${nonce}'; img-src data:; frame-ancestors 'none'; base-uri 'none'; form-action 'none'`,
+    },
+    html: `<!doctype html><html lang="${lang}"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="color-scheme" content="dark"><title>${title} · UzooAI</title><link rel="icon" href="${favicon}"><script nonce="${nonce}">history.replaceState(null, '', location.pathname)</script><style nonce="${nonce}">
+*{box-sizing:border-box}body{margin:0;min-height:100dvh;display:grid;place-items:center;padding:32px 20px;background:#080808;color:#f3f3f3;font-family:system-ui,-apple-system,"Segoe UI","Microsoft YaHei",sans-serif;-webkit-font-smoothing:antialiased}main{width:100%;max-width:460px;text-align:center}.brand{display:flex;align-items:center;justify-content:center;gap:10px;color:#a3a3a3;font-size:13px;letter-spacing:.04em;margin-bottom:44px}.brand img{width:30px;height:30px}.card{padding:38px 28px 30px;background:#111;border:1px solid #282828;border-radius:22px}.status-icon{display:grid;place-items:center;width:64px;height:64px;margin:0 auto 24px;border-radius:50%;background:${success ? '#163227' : '#33261a'};color:${success ? '#7dd8a7' : '#e8bd83'}}svg{width:48px;height:48px;fill:none;stroke:currentColor;stroke-width:2.6;stroke-linecap:round;stroke-linejoin:round}h1{font-size:26px;line-height:1.3;letter-spacing:-.03em;margin:0 0 14px}p{font-size:14px;line-height:1.8;color:#a5a5a5;margin:0;overflow-wrap:anywhere}.terminal{margin-top:28px;padding:15px 18px;border-radius:10px;background:#1d1d1d;font-size:14px;line-height:1.6;color:#e2e2e2}.terminal span{font-family:monospace;color:#888;margin-right:8px}.note{font-size:12px;line-height:1.8;margin-top:24px;color:#777}footer{margin-top:28px;font-size:11px;letter-spacing:.04em;color:#555}@media(max-width:400px){.card{padding:30px 20px}h1{font-size:23px}.brand{margin-bottom:28px}}
+.brand img{width:96px;height:auto}
+</style></head><body><main><div class="brand"><img src="${logo}" alt="UzooAI"><span>${words.brand}</span></div><section class="card" aria-labelledby="result-title"><div class="status-icon"><svg viewBox="0 0 50 50" aria-hidden="true">${symbol}</svg></div><h1 id="result-title">${title}</h1><p>${description}</p><div class="terminal"><span aria-hidden="true">&gt;_</span>${action}</div><p class="note">${note}</p></section><footer>UzooAI · Anime</footer></main></body></html>`,
+  }
+}