@uzooai/anime-ai-cli 0.0.0-stage → 0.6.0

package/src/canvas.js

@@ -0,0 +1,105 @@
+import crypto from 'node:crypto'
+import { segment } from './workflows.js'
+
+// Public CLI names map to the persisted API types and roles used by the web canvas.
+export const NODE_TYPES = ['text', 'image', 'video', 'audio', 'image_upload', 'video_upload', 'audio_upload', 'video-repaint']
+function createNode(id, type) {
+  let apiType = type, data = {}
+  if (type.endsWith('_upload')) data = { mediaType: type.slice(0, -7), extra: { node_kind: 'asset' } }
+  if (type === 'video-repaint') {
+    apiType = 'video_repain_begain'
+    data = { extra: { repaint: { role: 'entry', splitMode: 'intelligent' } } }
+  }
+  return { id, type: apiType, position: { x: 120, y: 130 }, data }
+}
+
+const object = v => v !== null && typeof v === 'object' && !Array.isArray(v)
+function isDerivedNode(node) {
+  const data = node.data || {}, extra = data.extra || {}
+  return Boolean(data.videoRemake || extra.video_remake || data.clipRedraw || extra.clip_redraw || data.draftFinalizeGeneration || extra.draft_finalize ||
+    [data.repaint, extra.repaint].some(marker => marker &&
+      (node.type !== 'video_repain_begain' || marker.role !== 'entry')))
+}
+const derivedNodeMessage = '派生节点必须由真实业务流程创建；node add/update 不能独立创建或将普通节点改为视频重拍、分段详情等派生节点'
+function text(value, label, max = Infinity) {
+  if (typeof value !== 'string' || !value.trim() || value.length > max) throw new Error(`${label} 必须为非空字符串（最长 ${max}）`)
+  return value
+}
+function position(value) {
+  if (!object(value) || !Number.isFinite(value.x) || !Number.isFinite(value.y)) throw new Error('position.x/y 必须为有限数字')
+  return value
+}
+function patchNode(node, patch) {
+  if (!object(patch)) throw new Error('节点输入必须是 JSON 对象')
+  for (const key of Object.keys(patch)) if (!['data', 'position', 'width', 'height'].includes(key)) throw new Error(`节点输入不支持 ${key}；id/type 不可修改`)
+  const next = { ...node }
+  if (patch.position !== undefined) next.position = position(patch.position)
+  for (const key of ['width', 'height']) if (patch[key] !== undefined) {
+    if (!Number.isFinite(patch[key]) || patch[key] <= 0) throw new Error(`${key} 必须为正数`)
+    next[key] = patch[key]
+  }
+  if (patch.data !== undefined) {
+    if (!object(patch.data)) throw new Error('data 必须是 JSON 对象')
+    if (patch.data.extra !== undefined && !object(patch.data.extra)) throw new Error('data.extra 必须是 JSON 对象')
+    next.data = { ...node.data, ...patch.data,
+      ...(patch.data.extra ? { extra: { ...node.data.extra, ...patch.data.extra } } : {}) }
+  }
+  return next
+}
+export function spaceContext({ space, teamUid, projectId }) {
+  if (!['personal', 'team'].includes(space)) throw new Error('请先确认使用个人还是团队空间，并传 --space personal 或 --space team --team-uid UID')
+  if (space === 'personal' && (teamUid !== undefined || projectId !== undefined)) throw new Error('个人空间不能传 --team-uid/--project-id；团队空间请显式选择 --space team')
+  if (space === 'team' && (typeof teamUid !== 'string' || !/^\d{12}$/.test(teamUid))) throw new Error('团队空间必须传 --team-uid（账号返回的 12 位团队 UID）')
+  return space === 'team' ? { team_uid: teamUid } : {}
+}
+export async function createCanvas(client, { name, space, teamUid, projectId }) {
+  const context = spaceContext({ space, teamUid, projectId })
+  const body = { name: text(name, '--name', 200), viewport: { x: 0, y: 0, zoom: 1 }, nodes: [], edges: [], meta: {} }
+  Object.assign(body, context)
+  if (projectId !== undefined) {
+    if (!Number.isSafeInteger(projectId) || projectId < 1) throw new Error('--project-id 必须为正整数')
+    body.canvas_project_id = projectId
+  }
+  // Refresh expired credentials using a read before the non-retriable creation.
+  await client.raw('/auth/me')
+  // Creation has no server idempotency contract. Never automatically repeat it.
+  try { return await client.raw('/canvas/docs', { method: 'POST', body }, { retry: false }) }
+  catch (error) {
+    if ((!error.apiCode && !error.status && error.code !== 'API_ERROR') || error.status >= 500) throw new Error('创建画布结果未确认；先 canvas list 核对，勿直接重复创建', { cause: error })
+    throw error
+  }
+}
+export async function writeNode(client, { docId, nodeId, type, patch = {}, update = false, expectedSpace, expectedTeamUid, expectedVersion }) {
+  text(docId, '--doc')
+  if (!update && ['video-remake', 'video-split-detail'].includes(type)) throw new Error(derivedNodeMessage)
+  if (!update && !NODE_TYPES.includes(type)) throw new Error(`--type 必须为 ${NODE_TYPES.join('/')}`)
+  const id = nodeId === undefined && !update ? `${type}-${crypto.randomUUID()}` : text(nodeId, '--node-id')
+  // Validate local input before reading or writing the document.
+  const candidate = patchNode(update ? { id, data: {} } : createNode(id, type), patch)
+  if (!update && isDerivedNode(candidate)) throw new Error(derivedNodeMessage)
+  const endpoint = `/canvas/docs/${segment(docId)}`
+  const doc = await client.raw(endpoint)
+  if(expectedVersion !== undefined && doc.version!==expectedVersion) throw new Error('画布已变化；先读取核对，再恢复原任务')
+  if (expectedSpace !== undefined && String(doc.team_uid || '') !== String(expectedSpace === 'team' ? expectedTeamUid : '')) throw new Error('画布归属与确认空间不一致')
+  if (doc.id !== docId || !Number.isSafeInteger(doc.version) || doc.version < 1 || !Array.isArray(doc.nodes) || !Array.isArray(doc.edges) || !object(doc.viewport) || !object(doc.meta) || typeof doc.name !== 'string') throw new Error('画布快照不完整，停止保存以避免覆盖')
+  if (doc.role && !['owner', 'editor'].includes(doc.role)) throw new Error('画布仅可读，不能写入节点')
+  const matches = doc.nodes.filter(n => n.id === id)
+  if (matches.length > 1) throw new Error('画布已有重复节点 id，停止保存')
+  if (update && !matches.length) throw new Error('节点不存在')
+  if (!update && matches.length) throw new Error('节点 id 已存在；请读取节点确认，勿重复创建')
+  const node = update ? patchNode(matches[0], patch) : candidate
+  if (update && !isDerivedNode(matches[0]) && isDerivedNode(node)) throw new Error(derivedNodeMessage)
+  const nodes = update ? doc.nodes.map(n => n.id === id ? node : n) : [...doc.nodes, node]
+  const body = { version: doc.version, name: doc.name, viewport: doc.viewport, nodes, edges: doc.edges, meta: doc.meta }
+  // Backend CAS protects concurrent website edits. Do not reload and overwrite on conflict.
+  let saved
+  try { saved = await client.raw(endpoint, { method: 'PUT', body }, { retry: false }) }
+  catch (error) {
+    if (error.apiCode === 3002 || error.status === 409) error.message = '画布版本冲突，未自动覆盖；先 canvas get 检查最新内容，再决定是否重新操作'
+    else if ((!error.apiCode && !error.status && error.code !== 'API_ERROR') || error.status >= 500) throw new Error(`节点保存结果未确认；先 canvas get ${docId} 核对节点 ${id}，勿直接重复创建`, { cause: error })
+    throw error
+  }
+  const savedNode = saved?.nodes?.find(n => n.id === id)
+  if (!savedNode || !Number.isSafeInteger(saved.version) || saved.version <= doc.version) throw new Error(`节点保存响应不完整；先 canvas get ${docId} 核对节点 ${id}`)
+  return { doc_id: docId, node_id: id, version: saved.version, node: savedNode }
+}

package/src/cli-authorization.js

@@ -0,0 +1,122 @@
+import crypto from 'node:crypto'
+import http from 'node:http'
+import os from 'node:os'
+import { baseUrl, cancellation, request } from './api.js'
+import { unwrap } from './protocol.js'
+import { openLoginBrowser } from './normal-login.js'
+import { callbackPage } from './callback-page.js'
+
+export const CLIENT_ID = 'uzoo-anime-cli'
+const b64 = value => Buffer.from(value).toString('base64url')
+
+export async function e1Request(api, endpoint, payload, timeout = 30000) {
+  const root = baseUrl(api)
+  const publicResponse = await request(`${root}/auth/public-key`, {}, timeout)
+  const key = unwrap(await publicResponse.json())
+  if (!publicResponse.ok || !key?.pkid || !key?.public_key) throw new Error('无法获取授权加密公钥')
+  const url = new URL(`${root}${endpoint}`)
+  const requestKey = crypto.randomBytes(32)
+  const enc = Buffer.from(crypto.hkdfSync('sha256', requestKey, Buffer.alloc(0), Buffer.from('ENC'), 32))
+  const mac = Buffer.from(crypto.hkdfSync('sha256', requestKey, Buffer.alloc(0), Buffer.from('MAC'), 32))
+  const wrapped = crypto.publicEncrypt({ key: key.public_key, oaepHash: 'sha256', padding: crypto.constants.RSA_PKCS1_OAEP_PADDING }, requestKey)
+  const t = String(Date.now()), k = `E1.${b64(wrapped)}`
+  const aad = Buffer.from(['POST', url.pathname, t, k].join('\n'))
+  const nonce = crypto.randomBytes(12)
+  const cipher = crypto.createCipheriv('aes-256-gcm', enc, nonce)
+  cipher.setAAD(aad)
+  const encrypted = Buffer.concat([cipher.update(JSON.stringify(payload), 'utf8'), cipher.final(), cipher.getAuthTag()])
+  const body = JSON.stringify({ pkid: key.pkid, data: b64(Buffer.concat([nonce, encrypted])) })
+  const bodyHash = crypto.createHash('sha256').update(body).digest('hex')
+  const canonical = ['POST', url.pathname, '', bodyHash, t, k].join('\n')
+  const response = await request(url, { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-T': t, 'X-K': k, 'X-Sign': crypto.createHmac('sha256', mac).update(canonical).digest('base64url'), 'X-Device-Id': payload.device_id }, body }, timeout)
+  const result = await response.json().catch(() => null)
+  if (!result) throw new Error(`授权服务请求失败（HTTP ${response.status}）`)
+  try {
+    const data = unwrap(result)
+    if (!response.ok) throw new Error(`授权服务请求失败（HTTP ${response.status}）`)
+    return data
+  } catch (error) {
+    const messages = { 2010: 'CLI 令牌已失效，请重新运行 auth login', 2011: 'CLI 会话已过期，请重新运行 auth login', 2012: 'CLI 会话已被新的 CLI 登录替换，请重新运行 auth login' }
+    const symbol = error.code === 2110 && /^[a-z_]{1,64}$/.test(result?.data?.error || '') ? result.data.error : ''
+    const e = new Error(messages[error.code] || `授权服务拒绝请求（code ${error.code || 'unknown'}${symbol ? '，' + symbol : ''}）`)
+    e.code = error.code
+    if (symbol) e.protocolError = symbol
+    throw e
+  }
+}
+
+export async function startCallback({ state, timeout = 300000, signal = cancellation.signal, waitForCompletion = false }) {
+  const path = `/cli/callback/${b64(crypto.randomBytes(24))}`
+  let resolveWait, rejectWait, settled = false
+  let pendingResponse, language = ''
+  function sendPage(res, status) {
+    if (res.destroyed || res.writableEnded) return Promise.resolve()
+    const page = callbackPage(status, language)
+    return new Promise(resolve => {
+      res.once('finish', resolve)
+      res.once('close', resolve)
+      res.writeHead(200, page.headers).end(page.html)
+    })
+  }
+  async function complete(status) {
+    if (!pendingResponse) return
+    const res = pendingResponse
+    pendingResponse = null
+    await sendPage(res, status)
+  }
+  const wait = new Promise((resolve, reject) => { resolveWait = resolve; rejectWait = reject })
+  // A timeout can occur while authorization creation is still in flight.
+  wait.catch(() => {})
+  const server = http.createServer((req, res) => {
+    let url
+    try { url = new URL(req.url, 'http://127.0.0.1') } catch { res.writeHead(400).end(); return }
+    if (req.method !== 'GET' || req.headers.host !== `127.0.0.1:${server.address().port}` || url.pathname !== path) { res.writeHead(404).end(); return }
+    const states = url.searchParams.getAll('state'), codes = url.searchParams.getAll('code'), errors = url.searchParams.getAll('error')
+    if ([...url.searchParams.keys()].some(key => !['state', 'code', 'error'].includes(key)) || states.length !== 1 || states[0] !== state || codes.length + errors.length !== 1 || codes.length > 1 || errors.length > 1 || (codes.length && !/^[A-Za-z0-9_-]{43}$/.test(codes[0])) || (errors.length && errors[0] !== 'access_denied')) { res.writeHead(400).end(); return }
+    if (settled) { res.writeHead(409).end(); return }
+    settled = true
+    language = req.headers['accept-language'] || ''
+    if (waitForCompletion && !errors.length) pendingResponse = res
+    else void sendPage(res, errors.length ? 'denied' : 'received')
+    if (errors.length) rejectWait(new Error('用户取消了 CLI 授权'))
+    else resolveWait(codes[0])
+  })
+  server.requestTimeout = 10000
+  server.headersTimeout = 10000
+  await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolve) })
+  const abort = () => { if (!settled) { settled = true; rejectWait(new Error('授权已取消')) } }
+  signal.addEventListener('abort', abort, { once: true })
+  if (signal.aborted) abort()
+  const timer = setTimeout(() => { if (!settled) { settled = true; rejectWait(new Error('等待网页授权超时，请重新登录')) } }, timeout)
+  return { redirectUri: `http://127.0.0.1:${server.address().port}${path}`, wait, complete, close: async () => { clearTimeout(timer); signal.removeEventListener('abort', abort); await complete('failure'); server.closeAllConnections(); await new Promise(resolve => server.close(resolve)) } }
+}
+
+export async function browserAuthorization({ profile, store, webUrl, browser = 'default', timeout = 300000, requestTimeout = 30000, openUrl = openLoginBrowser, onReady = () => {}, onOpenError = () => {} }) {
+  if (!['default', 'msedge', 'chrome'].includes(browser)) throw new Error('--browser 必须是 default、msedge 或 chrome')
+  const api = baseUrl(profile.baseUrl)
+  const website = new URL(webUrl || new URL(api).origin)
+  if (website.username || website.password || website.search || website.hash || website.pathname !== '/') throw new Error('网页登录地址必须是网站根地址')
+  if (website.protocol !== 'https:' && !(website.protocol === 'http:' && ['127.0.0.1', 'localhost'].includes(website.hostname))) throw new Error('远程网页登录必须使用 HTTPS')
+  const deviceId = profile.deviceId || `cli-${crypto.randomUUID()}`
+  const state = b64(crypto.randomBytes(32)), verifier = b64(crypto.randomBytes(48))
+  const bridge = await startCallback({ state, timeout, waitForCompletion: true })
+  try {
+    const authorization = await e1Request(api, '/auth/cli/authorizations', { client_id: CLIENT_ID, request_id: crypto.randomUUID(), redirect_uri: bridge.redirectUri, state, code_challenge: b64(crypto.createHash('sha256').update(verifier).digest()), code_challenge_method: 'S256', device_id: deviceId, device_name: (os.hostname() || 'CLI').replace(/[\x00-\x1f\x7f]/g, '').slice(0, 100) || 'CLI', session_policy: 'web_cli_independent' }, requestTimeout)
+    const target = new URL(authorization.authorize_url)
+    if (target.origin !== website.origin) throw new Error(`授权页面地址与配置的网站不一致：服务端 origin=${target.origin}，当前网站 origin=${website.origin}；请核对部署的 CLI_AUTH_ORIGIN，不会转发凭据或自动切换服务`)
+    if (target.pathname !== '/auth/login' || target.searchParams.get('request_id') !== authorization.authorization_id || !/^car_[A-Za-z0-9_-]{43}$/.test(authorization.authorization_id)) throw new Error('授权页面地址与配置的网站不一致')
+    onReady(target.href)
+    try { await openUrl(target.href, browser) } catch (error) { onOpenError(error.message) }
+    const code = await bridge.wait
+    const grant = { grant_type: 'authorization_code', client_id: CLIENT_ID, authorization_id: authorization.authorization_id, code, code_verifier: verifier, redirect_uri: bridge.redirectUri, device_id: deviceId, exchange_id: crypto.randomUUID() }
+    let pair
+    try { pair = await e1Request(api, '/auth/cli/token', grant, requestTimeout) } catch (error) {
+      if (error.code) throw error
+      pair = await e1Request(api, '/auth/cli/token', grant, requestTimeout)
+    }
+    if (!pair.access_token || !pair.refresh_token || pair.session?.client_type !== 'cli' || pair.session?.device_id !== deviceId) throw new Error('授权令牌响应无效')
+    await store.save({ baseUrl: api, deviceId, accessToken: pair.access_token, refreshToken: pair.refresh_token, authMode: 'cli' })
+    await bridge.complete('success')
+    return { profile: store.name, loggedIn: true, mode: 'cli', cliSessionReplaced: Boolean(pair.cli_session_replaced) }
+  } finally { await bridge.close() }
+}