@uzooai/anime-ai-cli 0.0.0-stage → 0.5.0

package/src/review.js

@@ -0,0 +1,435 @@
+import path from 'node:path'
+import crypto from 'node:crypto'
+import { setTimeout as sleep } from 'node:timers/promises'
+import { atomic, json, root, safeName } from './store.js'
+import { cancellation } from './api.js'
+import { scopedCanvas } from './materials.js'
+import { segment } from './workflows.js'
+import { collectGenerationSources, readSource } from './generation-input.js'
+import { sameImageReferences, sameVideoReferences } from './media.js'
+
+const pending = new Set(['queued', 'pending', 'processing', 'reviewing', 'in_review', 'submitted'])
+const digest = (value) => crypto.createHash('sha256').update(JSON.stringify(value)).digest('hex')
+const string = (value) => String(value ?? '').trim()
+const fail = (code, message) => Object.assign(new Error(message), { code })
+export const reviewPath = (profile, operation) =>
+  path.join(root(), 'reviews', safeName(profile), safeName(operation) + '.json')
+function inputOf(input) {
+  if (!input || Array.isArray(input) || typeof input !== 'object')
+    throw new Error('审核输入必须为 JSON 对象')
+  if (
+    Object.keys(input).some(
+      (key) => !['doc_id', 'node_id', 'space', 'team_uid', 'mode'].includes(key)
+    )
+  )
+    throw new Error('审核输入包含未接入字段；不支持 force 重审')
+  if (!string(input.doc_id) || !string(input.node_id)) throw new Error('审核缺少 doc_id/node_id')
+  if (!['current', 'upstream'].includes(input.mode))
+    throw new Error('审核 mode 必须为 current 或 upstream')
+  return { ...input }
+}
+function fileRef(data, url) {
+  const known = [
+    data.resultFileRef,
+    data.fileRef,
+    data.file_ref,
+    data.extra?.file_ref,
+    data.result?.file_ref,
+    data.node_output?.file_ref
+  ]
+    .map(string)
+    .filter(Boolean)
+  if (new Set(known).size > 1) throw new Error('素材引用字段不一致；请先核对当前媒体与任务')
+  const direct =
+    data.resultFileRef ||
+    data.fileRef ||
+    data.file_ref ||
+    data.extra?.file_ref ||
+    data.result?.file_ref ||
+    data.node_output?.file_ref
+  if (direct) return string(direct)
+  const match = string(url).match(/\/api\/v1\/files\/(fr1_[^/?#]+)/)
+  try {
+    return match ? decodeURIComponent(match[1]) : ''
+  } catch {
+    return ''
+  }
+}
+function taskIdOf(data) {
+  const id =
+    data.sourceTaskId ||
+    data.extra?.source_task_id ||
+    data.last_task_id ||
+    data.lastTaskId ||
+    data.result?.task_id ||
+    data.runtime?.taskId
+  if (!/^[1-9]\d*$/.test(string(id)) || !Number.isSafeInteger(Number(id)))
+    throw new Error('审核素材缺少有效的真实任务 ID；不能伪造任务或将素材库 ID 当任务 ID')
+  return Number(id)
+}
+function guardImage(data, task) {
+  const width = Number(data.imageWidth || data.width || task.result?.width) || 0
+  const height = Number(data.imageHeight || data.height || task.result?.height) || 0
+  const match = string(data.aspectRatio || data.aspect_ratio || task.result?.aspect_ratio).match(
+    /^([\d.]+)\s*[:/x×]\s*([\d.]+)$/i
+  )
+  const ratio = width && height ? width / height : match ? Number(match[1]) / Number(match[2]) : 0
+  if (width && (width < 300 || width > 6000)) throw new Error('审核图片宽度须为 300–6000 像素')
+  if (!(ratio >= 0.4 && ratio <= 2.5))
+    throw new Error('审核图片宽高比须在 0.4–2.5；缺少尺寸时先核对原图')
+}
+async function context(client, input) {
+  const doc = await scopedCanvas(client, input.doc_id, input.space, input.team_uid)
+  const target = doc.nodes.find((node) => node.id === input.node_id)
+  if (!target) throw new Error('审核目标节点不存在')
+  if (
+    target.data?.extra?.repaint ||
+    target.data?.extra?.video_remake ||
+    target.data?.extra?.clip_redraw
+  )
+    throw new Error('当前审核只支持普通节点；派生流程须按专用路线接入')
+  const sources =
+    input.mode === 'current'
+      ? [readSource(target)]
+      : collectGenerationSources(doc, target, ['image', 'video']).all
+  const items = []
+  for (const source of sources.filter((source) => ['image', 'video'].includes(source.mediaType))) {
+    const node = doc.nodes.find((node) => node.id === source.id)
+    const reference = source
+    const data = node?.data || reference
+    const taskId = taskIdOf(data)
+    const ref = fileRef(data, source.url)
+    if (!ref || source.uploading || source.uploadError)
+      throw new Error(`审核素材 ${source.id} 缺少已上传的媒体引用`)
+    const task = await client.raw(`/canvas/generations/${segment(taskId)}`)
+    if (
+      String(task.task_id ?? task.id) !== String(taskId) ||
+      task.doc_id !== input.doc_id ||
+      task.segment_type !== source.mediaType ||
+      task.status !== 'completed'
+    )
+      throw new Error('审核任务与素材/当前画布不匹配或尚未完成；跨画布素材审核暂未接入')
+    if (!task.result?.file_ref || !(await (source.mediaType === 'image' ? sameImageReferences : sameVideoReferences)(client, ref, task.result.file_ref)))
+      throw new Error('审核素材引用与原任务结果不一致；先核对素材，不将旧审核套用到新图/视频')
+    if (source.mediaType === 'image') guardImage(data, task)
+    const old = items.find((item) => item.taskId === taskId)
+    if (old) {
+      if (old.ref !== ref || old.mediaType !== source.mediaType)
+        throw new Error('同一审核任务对应不同素材引用')
+      old.sourceIds.push(source.id)
+    } else
+      items.push({
+        taskId,
+        ref,
+        mediaType: source.mediaType,
+        sourceIds: [source.id],
+        url: source.url
+      })
+  }
+  if (!items.length) throw new Error('没有可审核的图片/视频素材')
+  return { doc, target, items }
+}
+function normalizeReview(value, item, docId) {
+  if (
+    !value ||
+    String(value.task_id) !== String(item.taskId) ||
+    value.doc_id !== docId ||
+    !string(value.status)
+  )
+    throw new Error('审核响应的任务/画布绑定不完整')
+  const status = string(value.status).toLowerCase()
+  if (!pending.has(status) && !['active', 'failed', 'rejected'].includes(status))
+    throw new Error('审核返回未知状态，停止并查询原任务')
+  if (
+    status === 'active' &&
+    (!string(value.asset_uri).startsWith('asset://') || !string(value.submission_id))
+  )
+    throw new Error('已通过审核的响应缺少真实资产或提交关联')
+  return {
+    status,
+    taskId: item.taskId,
+    docId,
+    sourceTaskId: item.taskId,
+    mediaType: item.mediaType,
+    ...(item.mediaType === 'image' ? { imageRef: item.ref } : { mediaRef: item.ref }),
+    assetUri: value.asset_uri || null,
+    assetType: value.asset_type || null,
+    groupId: value.group_id || null,
+    submissionId: value.submission_id || null,
+    volcengineAssetId: value.volcengine_asset_id || null,
+    moderation: value.moderation || null,
+    updatedAt: value.updated_at || null,
+    celeryTaskId: value.celery_task_id || null
+  }
+}
+const notFound = (error) => error.status === 404 || error.apiCode === 3001
+async function readReview(client, item, docId) {
+  try {
+    return normalizeReview(
+      await client.raw(`/canvas/seedance/reviews/${segment(item.taskId)}`),
+      item,
+      docId
+    )
+  } catch (error) {
+    if (notFound(error)) return null
+    throw error
+  }
+}
+const result = (record) => ({
+  operation: record.operation,
+  state: record.state,
+  canvas_synced: record.canvasSynced === true,
+  items: record.items.map((item) => ({
+    task_id: item.taskId,
+    source_node_ids: item.sourceIds,
+    status: item.review?.status || item.state,
+    ...(item.lastFailure ? { last_failure: item.lastFailure } : {}),
+    review: item.review || null
+  }))
+})
+async function identity(client) {
+  const me = await client.raw('/auth/me'),
+    owner = string(me.uid ?? me.id)
+  if (!owner) throw new Error('审核账号响应缺少 UID')
+  return owner
+}
+async function bound(client, profile, operation) {
+  const record = await json(reviewPath(profile, operation), null)
+  if (!record) throw new Error('未找到审核 operation')
+  if (record.baseUrl !== client.baseUrl || record.owner !== (await identity(client)))
+    throw new Error('审核 operation 的服务或账号不匹配')
+  const current = await context(client, record.input)
+  if (digest(current.items) !== record.contextHash)
+    throw new Error('审核期间源素材、任务或引用已变化；停止，不修改原审核操作')
+  return { record, current }
+}
+function updateState(record) {
+  const statuses = record.items.map((item) => item.review?.status)
+  record.state = statuses.every((status) => status === 'active')
+    ? 'active'
+    : statuses.some((status) => ['failed', 'rejected'].includes(status))
+      ? 'failed'
+      : 'pending'
+}
+async function synchronize(client, record, doc) {
+  const original = digest([doc.nodes, doc.meta])
+  const patches = record.items
+    .filter((item) => item.review)
+    .map((item) => ({ ...item, ids: new Set(item.sourceIds) }))
+  const patchRefs = (refs) =>
+    Array.isArray(refs)
+      ? refs.map((ref) => {
+          const match = patches.find(
+            (item) => item.ids.has(string(ref.id)) && string(ref.url) === item.url
+          )
+          return match
+            ? { ...ref, seedanceReview: match.review, reviewStatus: match.review.status }
+            : ref
+        })
+      : refs
+  for (const node of doc.nodes) {
+    const source = readSource(node)
+    const match = patches.find(
+      (item) =>
+        (item.ids.has(node.id) && source.url === item.url) ||
+        (source.url === item.url &&
+          source.mediaType === item.mediaType &&
+          fileRef(node.data || {}, source.url) === item.ref)
+    )
+    node.data ||= {}
+    if (match) {
+      node.data.extra = { ...node.data.extra, seedance_review: match.review }
+      if (node.data.seedanceReview) node.data.seedanceReview = match.review
+      if (node.data.seedance_review) node.data.seedance_review = match.review
+    }
+    if (node.data.references) node.data.references = patchRefs(node.data.references)
+    if (node.data.extra?.references)
+      node.data.extra = { ...node.data.extra, references: patchRefs(node.data.extra.references) }
+    if (node.id === record.input.node_id && record.input.mode === 'upstream')
+      node.data.extra = {
+        ...node.data.extra,
+        seedance_material_reviews: {
+          ...node.data.extra?.seedance_material_reviews,
+          ...Object.fromEntries(
+            patches.flatMap((item) => item.sourceIds.map((id) => [id, item.review.status]))
+          )
+        }
+      }
+  }
+  if (doc.meta?.node_references)
+    doc.meta.node_references = Object.fromEntries(
+      Object.entries(doc.meta.node_references).map(([id, refs]) => [id, patchRefs(refs)])
+    )
+  if (digest([doc.nodes, doc.meta]) === original) return
+  if (!Number.isSafeInteger(doc.version) || !Array.isArray(doc.edges) || !doc.viewport || !doc.meta)
+    throw new Error('审核保存的画布快照不完整')
+  let saved
+  try {
+    saved = await client.raw(
+      `/canvas/docs/${segment(doc.id)}`,
+      {
+        method: 'PUT',
+        body: {
+          version: doc.version,
+          name: doc.name,
+          viewport: doc.viewport,
+          nodes: doc.nodes,
+          edges: doc.edges,
+          meta: doc.meta
+        }
+      },
+      { retry: false }
+    )
+  } catch (error) {
+    throw fail(
+      'REVIEW_SYNC_PENDING',
+      error.status === 409 || error.apiCode === 3002
+        ? '审核状态已保存本地，画布版本冲突；核对后 recover 原审核，不重新审核'
+        : '审核已查询，画布保存结果未确认；读回后 recover 原审核，不重新提交'
+    )
+  }
+  if (saved.id !== doc.id || saved.version <= doc.version || !Array.isArray(saved.nodes))
+    throw fail('REVIEW_SYNC_PENDING', '审核画布保存响应不完整；核对后恢复原 operation')
+  for (const item of patches)
+    for (const id of item.sourceIds) {
+      if (!doc.nodes.some((node) => node.id === id)) continue // A persistent reference may have no live node.
+      const node = saved.nodes.find((node) => node.id === id)
+      if (
+        node?.data?.extra?.seedance_review?.submissionId !== item.review.submissionId ||
+        node?.data?.extra?.seedance_review?.status !== item.review.status
+      )
+        throw fail('REVIEW_SYNC_PENDING', '审核状态未在保存响应中核实；不重新审核，先读回画布')
+    }
+}
+export async function startReview(client, profile, input, operation, confirmed) {
+  input = inputOf(input)
+  const file = reviewPath(profile, operation),
+    existing = await json(file, null)
+  const owner = await identity(client)
+  const current = await context(client, input)
+  if (existing) {
+    if (
+      existing.baseUrl !== client.baseUrl ||
+      existing.owner !== owner ||
+      digest(existing.input) !== digest(input) ||
+      existing.contextHash !== digest(current.items)
+    )
+      throw new Error('审核 operation 已绑定其他输入/服务/账号；不能更改原操作')
+    return getReview(client, profile, operation, confirmed) // No POST replay, even when --yes is repeated.
+  }
+  const preview = {
+    operation,
+    submitted: false,
+    mode: input.mode,
+    wallet: { space: input.space, team_uid: input.team_uid || null },
+    generation_submitted: false,
+    items: current.items.map((item) => ({
+      task_id: item.taskId,
+      media_type: item.mediaType,
+      source_node_ids: item.sourceIds
+    })),
+    next: '核对本次审核素材后，加 --yes 提交审核；这不授权视频生成'
+  }
+  if (!confirmed) return preview
+  const record = {
+    operation,
+    owner,
+    baseUrl: client.baseUrl,
+    input,
+    contextHash: digest(current.items),
+    items: current.items.map((item) => ({ ...item, state: 'prepared' })),
+    state: 'prepared',
+    createdAt: new Date().toISOString()
+  }
+  await atomic(file, record)
+  for (const item of record.items) {
+    item.review = await readReview(client, item, input.doc_id)
+    if (item.review) {
+      item.state = item.review.status
+      await atomic(file, record)
+      continue
+    }
+    item.state = 'submitting'
+    await atomic(file, record)
+    try {
+      const response = await client.raw(
+        '/canvas/seedance/reviews',
+        {
+          method: 'POST',
+          body: {
+            task_id: item.taskId,
+            [item.mediaType === 'image' ? 'image_ref' : 'media_ref']: item.ref,
+            force: false
+          }
+        },
+        { retry: false }
+      )
+      item.review = normalizeReview(response, item, input.doc_id)
+      item.state = item.review.status
+    } catch (error) {
+      // Generic business/dispatch errors can occur after the server persisted a review.
+      const rejected =
+        [401, 403, 404, 422].includes(error.status) ||
+        [1000, 2000, 2001, 3001].includes(error.apiCode)
+      item.state = rejected ? 'rejected' : 'unknown'
+      record.state = item.state
+      item.lastFailure = {
+        ...(Number.isInteger(error.status) ? { http_status: error.status } : {}),
+        ...(Number.isFinite(error.apiCode) ? { api_code: error.apiCode } : {}),
+        ...(error.requestId ? { request_id: error.requestId } : {}),
+        code: rejected ? 'REVIEW_REQUEST_REJECTED' : 'REVIEW_SUBMISSION_UNKNOWN'
+      }
+      await atomic(file, record)
+      throw Object.assign(
+        fail(
+          item.lastFailure.code,
+          rejected
+            ? `素材审核请求被接口拒绝；核对 HTTP/业务错误码，仅查询原 operation ${operation}，不自动重提`
+            : `审核提交结果未确认；仅 recover ${operation} 查询原任务，不重发审核或生成`
+        ),
+        { diagnostic: item.lastFailure }
+      )
+    }
+    await atomic(file, record)
+  }
+  return recoverReview(client, profile, operation)
+}
+export async function getReview(client, profile, operation, sync = false) {
+  const { record, current } = await bound(client, profile, operation)
+  let absent = false
+  for (const item of record.items) {
+    const review = await readReview(client, item, record.input.doc_id)
+    if (review) {
+      item.review = review
+      item.state = review.status
+    } else {
+      absent = true
+      item.state = item.lastFailure?.code === 'REVIEW_REQUEST_REJECTED' ? 'rejected' : 'unknown'
+      item.review = null
+    }
+  }
+  updateState(record)
+  if (absent)
+    record.state = record.items.some((item) => item.state === 'rejected') ? 'rejected' : 'unknown'
+  record.canvasSynced = false
+  await atomic(reviewPath(profile, operation), record)
+  if (sync && !absent) {
+    await synchronize(client, record, current.doc)
+    record.canvasSynced = true
+    await atomic(reviewPath(profile, operation), record)
+  }
+  return result(record)
+}
+export const recoverReview = (client, profile, operation) =>
+  getReview(client, profile, operation, true)
+export async function waitReview(client, profile, operation, interval = 3000, timeout = 180000) {
+  const deadline = Date.now() + timeout
+  while (Date.now() < deadline) {
+    const current = await recoverReview(client, profile, operation)
+    if (['active', 'failed', 'rejected', 'unknown'].includes(current.state)) return current
+    await sleep(Math.min(interval, Math.max(1, deadline - Date.now())), undefined, {
+      signal: cancellation.signal
+    })
+  }
+  throw fail('WAIT_TIMEOUT', '审核等待超时；继续 wait/recover 原审核 operation，不重新提交')
+}

package/src/service.js

@@ -0,0 +1,85 @@
+import { request } from './api.js'
+
+// Public same-origin probes do not carry profile credentials or create signing sessions.
+export async function serviceStatus(client, timeout = Math.min(client.timeout || 8000, 8000)) {
+  const probe = async (endpoint) => {
+    try {
+      const response = await request(client.baseUrl + endpoint, {}, timeout)
+      const payload = await response.json().catch(() => null)
+      const data = payload?.data ?? payload
+      const state = ['ok', 'alive', 'ready', 'not_ready'].includes(data?.status)
+        ? data.status
+        : null
+      const checks = Object.fromEntries(
+        ['database', 'redis'].flatMap((key) =>
+          ['ok', 'error'].includes(data?.checks?.[key]) ? [[key, data.checks[key]]] : []
+        )
+      )
+      return {
+        endpoint,
+        http_status: response.status,
+        state,
+        ...(Object.keys(checks).length ? { checks } : {}),
+        ...(Number.isFinite(payload?.code) ? { api_code: payload.code } : {})
+      }
+    } catch (error) {
+      if (error.name === 'AbortError' && error.message?.includes('aborted'))
+        return { endpoint, error: 'cancelled' }
+      return {
+        endpoint,
+        error: ['TimeoutError', 'AbortError'].includes(error.name) ? 'timeout' : 'connection_failed'
+      }
+    }
+  }
+  const [live, ready] = await Promise.all(['/health/live', '/health/ready'].map(probe))
+  const status =
+    ready.http_status === 200 &&
+    ready.state === 'ready' &&
+    (ready.api_code === undefined || ready.api_code === 0) &&
+    ready.checks?.database === 'ok' &&
+    ready.checks?.redis === 'ok'
+      ? 'ready'
+      : ready.state === 'not_ready' || Object.values(ready.checks || {}).includes('error')
+        ? 'not_ready'
+        : [live, ready].every((p) => p.error || [502, 503, 504].includes(p.http_status))
+          ? 'unreachable'
+          : 'unknown'
+  return {
+    status,
+    checked_at: new Date().toISOString(),
+    live,
+    readiness: ready,
+    scope: 'api_database_redis',
+    generation_submitted: false,
+    next:
+      status === 'ready'
+        ? '当前后端就绪；不代表先前没有断线，也不验证对象存储、队列或具体业务接口'
+        : '先处理连接/代理/后端依赖或探针兼容，再查询原操作；不自动重发业务写入'
+  }
+}
+export async function requireServiceReady(client) {
+  const service = await serviceStatus(client)
+  if (service.status === 'ready') return service
+  throw Object.assign(new Error('后端连接或就绪状态未确认；已停止业务提交，先查询原操作'), {
+    code: 'SERVICE_UNAVAILABLE',
+    service
+  })
+}
+export async function diagnoseServiceError(client, error) {
+  if (error.service) return error.service
+  const diagnostic = error.diagnostic || {}
+  const http = error.status ?? diagnostic.http_status ?? error.cause?.status
+  const api = error.apiCode ?? diagnostic.api_code ?? error.cause?.apiCode
+  if (
+    !(
+      http >= 500 ||
+      [3000, 5000].includes(api) ||
+      ['TypeError', 'TimeoutError', 'AbortError'].includes(error.name) ||
+      ['TypeError', 'TimeoutError', 'AbortError'].includes(error.cause?.name) ||
+      (error.code === 'API_ERROR' && !api && http === 200) ||
+      /UNKNOWN|SYNC_PENDING/.test(error.code || '')
+    )
+  )
+    return null
+  return serviceStatus(client)
+}

package/src/store.js

@@ -0,0 +1,100 @@
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import os from 'node:os'
+import crypto from 'node:crypto'
+import { spawn } from 'node:child_process'
+import {setTimeout as sleep} from 'node:timers/promises'
+
+export const root = () => path.join(process.env.APPDATA || path.join(os.homedir(), '.config'), 'uzoo-anime-cli')
+export function safeName(name) {
+  if (!/^[a-zA-Z0-9_-]{1,64}$/.test(name)) throw new Error('名称只能包含字母、数字、下划线和短横线（1–64 位）')
+  return name
+}
+export async function json(file, fallback) {
+  try { return JSON.parse(await fs.readFile(file, 'utf8')) } catch (e) { if (e.code === 'ENOENT') return fallback; throw e }
+}
+export async function atomic(file, value) {
+  await fs.mkdir(path.dirname(file), { recursive: true })
+  const tmp = `${file}.${crypto.randomUUID()}.tmp`
+  try {
+    const handle = await fs.open(tmp, 'wx', 0o600)
+    try { await handle.writeFile(JSON.stringify(value, null, 2) + '\n'); await handle.sync() } finally { await handle.close() }
+    // Windows scanners/readers can briefly prevent replacing a closed file.
+    // Retry only this already-flushed local rename; never remove the old file
+    // or replay the business request that produced this journal entry.
+    const delays=[25,50,100,200,400,800]
+    for(let attempt=0;;attempt++){
+      try{await fs.rename(tmp,file);break}catch(error){
+        if(process.platform!=='win32'||!['EPERM','EACCES','EBUSY'].includes(error.code)||attempt>=delays.length)throw error
+        await sleep(delays[attempt])
+      }
+    }
+  } finally { await fs.rm(tmp, { force: true }) }
+}
+function helper(exe, args, input = '') {
+  return new Promise((resolve, reject) => {
+    const child = spawn(exe, args, { windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'] })
+    const timer = setTimeout(() => { child.kill(); reject(new Error('系统凭据服务超时')) }, 15000)
+    let output = ''
+    child.stdout.on('data', c => { output += c })
+    child.stderr.resume()
+    child.stdin.on('error', () => {})
+    child.on('error', () => { clearTimeout(timer); reject(new Error('系统凭据服务不可用；请安装/启用系统密钥服务')) })
+    child.on('close', code => { clearTimeout(timer); code === 0 ? resolve(output.trim()) : reject(new Error('系统凭据服务失败；不会回退为明文存储')) })
+    child.stdin.end(input)
+  })
+}
+// Windows CurrentUser DPAPI: ciphertext can only be decrypted in this user's OS context.
+async function dpapi(mode, input) {
+  const method = mode === 'protect' ? 'Protect' : 'Unprotect'
+  return helper('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command',
+    `Add-Type -AssemblyName System.Security; $bytes=[Convert]::FromBase64String([Console]::In.ReadToEnd()); [Convert]::ToBase64String([Security.Cryptography.ProtectedData]::${method}($bytes,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser))`], input)
+}
+export class Store {
+  constructor(name) { this.name = safeName(name); this.configFile = path.join(root(), `${name}.json`); this.secretFile = path.join(root(), `${name}.dpapi`); this.service = `uzoo-anime-cli:${name}` }
+  async config() {
+    const saved = await json(this.configFile, {})
+    return { ...(this.name === 'uzooai-online' ? { baseUrl: 'https://uzooai.com/api/v1' } : {}), ...saved }
+  }
+  async secrets(value) {
+    if (process.platform === 'win32') {
+      if (value !== undefined) { await atomic(this.secretFile, { ciphertext: await dpapi('protect', Buffer.from(JSON.stringify(value)).toString('base64')) }); return }
+      const saved = await json(this.secretFile, null)
+      return saved ? JSON.parse(Buffer.from(await dpapi('unprotect', saved.ciphertext), 'base64').toString('utf8')) : {}
+    }
+    if (process.platform === 'darwin') {
+      // macOS security CLI cannot receive add-generic-password secrets via stdin safely.
+      throw new Error('此版本尚未实现 macOS 安全凭据适配器；不会保存明文凭据')
+    }
+    if (value !== undefined) { await helper('secret-tool', ['store', '--label=Uzoo Anime CLI', 'service', this.service], JSON.stringify(value)); return }
+    const result = await helper('secret-tool', ['lookup', 'service', this.service])
+    return result ? JSON.parse(result) : {}
+  }
+  async load() {
+    const config = await this.config()
+    const legacy = ['accessToken', 'refreshToken', 'cookie'].some(k => config[k])
+    if (legacy) {
+      await this.save(config) // migrate before removing plaintext; failure leaves original intact
+      return { ...config, profile: this.name }
+    }
+    return { ...config, ...await this.secrets(), profile: this.name }
+  }
+  async save(value) {
+    const { accessToken = '', refreshToken = '', cookie = '', deviceId = '', baseUrl, authMode = '', refreshRequestId = '' } = value
+    // Keep the binding and credentials in one protected atomic record. If a
+    // subsequent non-secret config write fails, load() still sees a matching pair.
+    await this.secrets({ accessToken, refreshToken, cookie, refreshRequestId, baseUrl, deviceId, authMode })
+    await atomic(this.configFile, { baseUrl, deviceId, authMode })
+  }
+  async clear() {
+    if (process.platform === 'win32') await fs.rm(this.secretFile, { force: true })
+    else if (process.platform === 'linux') await helper('secret-tool', ['clear', 'service', this.service])
+    await fs.rm(this.configFile, { force: true })
+  }
+  async lock() {
+    const file = path.join(root(), `${this.name}.lock`)
+    await fs.mkdir(root(), { recursive: true })
+    try { await fs.mkdir(file) } catch (e) { if (e.code === 'EEXIST') throw new Error('该 profile 正被使用；若上次进程被强制终止，请确认其已退出后删除对应 .lock 目录'); throw e }
+    return () => fs.rmdir(file)
+  }
+}