@yijiancaotang/cli 0.0.0-stage → 1.1.0

package/dist/schedule-contract.js

@@ -0,0 +1,289 @@
+export const scheduleRoot = "/api/v1/agent";
+export const scheduleKeyPattern = /^[A-Za-z0-9._:-]{16,128}(?![\s\S])/;
+export const scheduleUUID = (value) => typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}(?![\s\S])/i.test(value);
+const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const scalarText = (value) => ![...value].some(char => { const n = char.codePointAt(0); return n >= 0xd800 && n <= 0xdfff; });
+const trim = (value) => value.replace(/^\p{White_Space}+|\p{White_Space}+$/gu, "");
+export const validScheduleRevision = (value) => typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+export function validScheduleDate(value) {
+    if (typeof value !== "string" || !/^(?!0000)\d{4}-\d{2}-\d{2}(?![\s\S])/.test(value))
+        return false;
+    const date = new Date(value + "T00:00:00Z");
+    return Number.isFinite(date.getTime()) && date.toISOString().slice(0, 10) === value;
+}
+export function validScheduleTime(value) {
+    if (typeof value !== "string" || !/^(?!0000)\d{4}-\d{2}-\d{2}T([01]\d|2[0-3]):[0-5]\d:[0-5]\d(\.\d{1,9})?(Z|[+-]([01]\d|2[0-3]):[0-5]\d)(?![\s\S])/.test(value))
+        return false;
+    return validScheduleDate(value.slice(0, 10)) && Number.isFinite(Date.parse(value));
+}
+export class ScheduleProblem extends Error {
+    code;
+    humanMessage;
+    nextAction;
+    exitCode;
+    details;
+    constructor(code, humanMessage, nextAction, exitCode = 2, details = {}) {
+        super(JSON.stringify({ code, message: humanMessage, next_action: nextAction, ...details }));
+        this.code = code;
+        this.humanMessage = humanMessage;
+        this.nextAction = nextAction;
+        this.exitCode = exitCode;
+        this.details = details;
+    }
+}
+export function scheduleInvalid() {
+    throw new ScheduleProblem("invalid_arguments", "日程命令或参数无效。", "请查看本命令帮助，只提交本人确认的字段；日期用 YYYY-MM-DD，精确时间用带时区偏移的 RFC3339。");
+}
+export function scheduleKey(value) {
+    if (typeof value !== "string" || !scheduleKeyPattern.test(value))
+        return scheduleInvalid();
+    return value;
+}
+export function scheduleID(value) {
+    return scheduleUUID(value) ? value : scheduleInvalid();
+}
+export function scheduleQuery(input) {
+    const allowed = ["view", "status", "group_by", "project_id", "q", "start_date", "end_date", "limit", "offset"];
+    const out = {};
+    for (const [name, value] of Object.entries(input)) {
+        if (!allowed.includes(name))
+            scheduleInvalid();
+        if (value === undefined)
+            continue;
+        if (name === "limit" || name === "offset") {
+            if (typeof value !== "number" || !Number.isSafeInteger(value) || value < (name === "limit" ? 1 : 0) || (name === "limit" && value > 100))
+                scheduleInvalid();
+        }
+        else {
+            if (typeof value !== "string" || value === "" || !scalarText(value) || value.includes("\0"))
+                scheduleInvalid();
+            if (name === "view" && !["pending", "workbench", "recent_completed", "history"].includes(value))
+                scheduleInvalid();
+            if (name === "status" && (!["all", "completed", "cancelled"].includes(value) || input.view !== "history"))
+                scheduleInvalid();
+            if (name === "group_by" && !["date", "project"].includes(value))
+                scheduleInvalid();
+            if (name === "project_id" && value !== "none" && !scheduleUUID(value))
+                scheduleInvalid();
+            if ((name === "start_date" || name === "end_date") && !validScheduleDate(value))
+                scheduleInvalid();
+            if (name === "q" && [...trim(value)].length > 200)
+                scheduleInvalid();
+        }
+        out[name] = value;
+    }
+    if (typeof input.start_date === "string" && typeof input.end_date === "string" && input.start_date > input.end_date)
+        scheduleInvalid();
+    return out;
+}
+export function scheduleBody(operation, value) {
+    if (!record(value))
+        return scheduleInvalid();
+    const fields = operation === "create" || operation === "update" ? ["title", "due_date", "due_at", "project_id", "confirmed"] : ["confirmed"];
+    if (Object.keys(value).some(name => !fields.includes(name)) || value.confirmed !== true)
+        return scheduleInvalid();
+    if (operation === "create" && !Object.hasOwn(value, "title"))
+        scheduleInvalid();
+    if (operation === "update" && !["title", "due_date", "due_at", "project_id"].some(name => Object.hasOwn(value, name)))
+        scheduleInvalid();
+    const out = { ...value };
+    if (Object.hasOwn(value, "title")) {
+        if (typeof value.title !== "string" || !scalarText(value.title))
+            scheduleInvalid();
+        const title = trim(value.title);
+        if (!title || [...title].length > 200 || /[\p{Cc}\u2028\u2029]/u.test(title))
+            scheduleInvalid();
+        out.title = title;
+    }
+    for (const name of ["due_date", "due_at", "project_id"]) {
+        if (!Object.hasOwn(value, name))
+            continue;
+        const item = value[name];
+        if (item === null || item === "")
+            continue;
+        if (name === "due_date" ? !validScheduleDate(item) : name === "due_at" ? !validScheduleTime(item) : !scheduleUUID(item))
+            scheduleInvalid();
+    }
+    if (value.due_date && value.due_at)
+        scheduleInvalid();
+    return out;
+}
+export function scheduleUnknown(key, status) {
+    return new ScheduleProblem("write_outcome_unknown", "日程写入结果未确认，不能视为成功。", "保留原幂等键，用 schedule status 或 get_schedule_write_status 核对同一连接的回执；不要换键、自动重试或执行依赖写入。", 6, { write_status: "unknown", idempotency_key: key, ...(status === undefined ? {} : { http_status: status }) });
+}
+export function scheduleFailure(status, body, capabilities, key) {
+    if (key && (status === 202 || status >= 500))
+        return scheduleUnknown(key, status);
+    const raw = record(body) ? body.code ?? body.error : undefined;
+    const consistent = record(body) && (body.code === undefined || body.code === raw) && (body.error === undefined || body.error === raw);
+    const codes = {
+        400: ["invalid_schedule_query", "invalid_schedule_id", "invalid_idempotency_key", "invalid_schedule_revision", "invalid_schedule_input", "schedule_confirmation_required"],
+        401: ["not_authenticated"], 403: ["token_scope_insufficient", "capability_disabled", "second_confirmation_required", "legal_consent_required", "account_unavailable"],
+        404: ["schedule_not_found"], 409: ["schedule_revision_conflict", "idempotency_conflict", "schedule_closed", "schedule_undo_expired"],
+        415: ["invalid_content_type"], 429: ["rate_limited"], 503: ["schedule_unavailable"]
+    };
+    const code = consistent && typeof raw === "string" && codes[status]?.includes(raw) ? raw : "request_rejected";
+    const details = { http_status: status, ...(key ? { idempotency_key: key } : {}) };
+    if (code === "capability_disabled" && record(body) && typeof body.required_capability === "string" && capabilities.includes(body.required_capability)
+        && (!Object.hasOwn(body, "missing_sections") || Array.isArray(body.missing_sections) && body.missing_sections.length === 0))
+        details.required_capability = body.required_capability;
+    const next = status === 403 ? "请本人在网页核对账号能力、设备只读/读写范围或协议确认；不要重新授权或换入口绕过限制。"
+        : status === 409 ? "请先读取当前版本或到网页核对；撤销只在完成后的约 5 秒内有效，不自动重试或换键。"
+            : "请核对命令输入、服务版本和实际状态，不把失败或权限缺口解释为没有日程，不自动重试写入。";
+    return new ScheduleProblem(code, status === 403 ? "日程操作权限不足。" : status === 409 ? "日程状态或版本冲突，本次未确认写入。" : "日程请求未完成。", next, status === 401 ? 3 : status === 403 ? 4 : status >= 500 ? 7 : 2, details);
+}
+const buckets = ["overdue", "today", "tomorrow", "this_week", "later", "undated"];
+const countNames = [...buckets, "completed", "cancelled"];
+const natural = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+const safeText = (value) => typeof value === "string" && scalarText(value) && !/[\p{Cc}\u2028\u2029]/u.test(value);
+const projectText = (value) => typeof value === "string" && scalarText(value) && [...value].length >= 1 && [...value].length <= 80;
+function readInvalid() {
+    throw new ScheduleProblem("invalid_response", "日程读取回执无法核实。", "请核对服务版本和访问范围，不把异常响应解释为没有日程。", 7);
+}
+function projectItem(value) {
+    if (!record(value) || !scheduleUUID(value.id) || !validScheduleRevision(value.revision)
+        || !safeText(value.title) || !trim(value.title) || [...value.title].length > 200
+        || typeof value.status !== "string" || !["pending", "completed", "cancelled"].includes(value.status)
+        || !validScheduleTime(value.created_at) || !validScheduleTime(value.updated_at))
+        return readInvalid();
+    const out = { id: value.id, title: value.title, status: value.status, revision: value.revision, created_at: value.created_at, updated_at: value.updated_at };
+    for (const name of ["due_date", "due_at", "project_id", "project_title", "project_unavailable_reason", "completed_at", "cancelled_at", "undo_until", "bucket", "closed_actor_kind", "closed_actor_name"]) {
+        if (!Object.hasOwn(value, name))
+            continue;
+        const field = value[name];
+        if (name === "project_title" ? !projectText(field) : !safeText(field) || !field)
+            readInvalid();
+        if (name === "due_date" && !validScheduleDate(field) || name === "project_id" && !scheduleUUID(field)
+            || ["due_at", "completed_at", "cancelled_at", "undo_until"].includes(name) && !validScheduleTime(field)
+            || name === "bucket" && !buckets.includes(field)
+            || name === "project_unavailable_reason" && field !== "project_unavailable")
+            readInvalid();
+        out[name] = field;
+    }
+    if (out.due_date && out.due_at)
+        readInvalid();
+    if (out.project_unavailable_reason) {
+        delete out.project_id;
+        delete out.project_title;
+    }
+    else if (out.project_title && !out.project_id)
+        readInvalid();
+    return out;
+}
+export function scheduleReadResult(status, value, detail) {
+    if (status !== 200 || !record(value) || value.timezone !== "Asia/Shanghai")
+        return readInvalid();
+    if (detail)
+        return { schedule_item: projectItem(value.schedule_item), timezone: "Asia/Shanghai" };
+    if (!Array.isArray(value.items) || !Array.isArray(value.groups) || !record(value.counts)
+        || !natural(value.total) || !natural(value.offset) || !natural(value.limit) || value.limit < 1 || value.limit > 100
+        || typeof value.has_more !== "boolean")
+        return readInvalid();
+    const total = value.total, offset = value.offset, limit = value.limit;
+    const items = value.items.map(projectItem);
+    if (items.length !== Math.min(limit, Math.max(0, total - offset)) || value.has_more !== (offset < total && items.length < total - offset))
+        readInvalid();
+    const counts = {};
+    for (const name of countNames) {
+        if (!natural(value.counts[name]))
+            readInvalid();
+        counts[name] = value.counts[name];
+    }
+    if (Object.values(counts).reduce((sum, count) => sum + count, 0) !== total)
+        readInvalid();
+    const itemMap = new Map(), shownCounts = {};
+    for (const item of items) {
+        if (itemMap.has(item.id) || typeof item.bucket !== "string")
+            readInvalid();
+        itemMap.set(item.id, item);
+        const name = item.status === "pending" ? item.bucket : item.status;
+        shownCounts[name] = (shownCounts[name] ?? 0) + 1;
+        if (shownCounts[name] > counts[name])
+            readInvalid();
+    }
+    const groupKeys = new Set(), groupedIDs = new Set();
+    let groupTotal = 0;
+    const groups = value.groups.map(raw => {
+        if (!record(raw) || !safeText(raw.key) || !raw.key || groupKeys.has(raw.key)
+            || !natural(raw.total) || !natural(raw.shown) || raw.shown < 1 || raw.total < raw.shown || raw.total > total
+            || typeof raw.has_more !== "boolean" || raw.has_more !== (raw.shown < raw.total)
+            || !Array.isArray(raw.items) || raw.items.length !== raw.shown)
+            return readInvalid();
+        groupKeys.add(raw.key);
+        groupTotal += raw.total;
+        const groupItems = raw.items.map(projectItem);
+        for (const item of groupItems) {
+            const id = item.id;
+            if (groupedIDs.has(id) || !itemMap.has(id) || JSON.stringify(itemMap.get(id)) !== JSON.stringify(item))
+                readInvalid();
+            groupedIDs.add(id);
+        }
+        const group = { key: raw.key, total: raw.total, shown: raw.shown, has_more: raw.has_more, items: groupItems };
+        if (Object.hasOwn(raw, "title")) {
+            if (!projectText(raw.title))
+                readInvalid();
+            group.title = raw.title;
+        }
+        if (Object.hasOwn(raw, "project_id")) {
+            if (!scheduleUUID(raw.project_id) || raw.key !== raw.project_id)
+                readInvalid();
+            group.project_id = raw.project_id;
+        }
+        return group;
+    });
+    if (groupedIDs.size !== items.length || groupTotal > total)
+        readInvalid();
+    return { items, groups, counts, total, limit, offset, has_more: value.has_more, timezone: "Asia/Shanghai" };
+}
+export function scheduleReceipt(status, value, key) {
+    if (![200, 201].includes(status) || !record(value) || !scheduleUUID(value.id) || value.write_status !== "confirmed" || typeof value.replayed !== "boolean"
+        || value.code !== undefined || value.error !== undefined
+        || value.read_permission_missing !== undefined && typeof value.read_permission_missing !== "boolean"
+        || value.read_unavailable !== undefined && typeof value.read_unavailable !== "boolean")
+        throw scheduleUnknown(key, status);
+    const out = { id: value.id, write_status: "confirmed", replayed: value.replayed };
+    const missing = value.missing_sections;
+    if (value.read_permission_missing === true || value.read_unavailable === true || Array.isArray(missing) && missing.length > 0) {
+        const unavailable = value.read_unavailable === true;
+        const reason = unavailable ? "read_failed" : "capability_disabled";
+        if (!Array.isArray(missing) || missing.length !== 1 || !record(missing[0]) || missing[0].section !== "schedule_items"
+            || missing[0].required_capability !== "read_workbench" || missing[0].reason !== reason
+            || unavailable && value.read_permission_missing === true)
+            throw scheduleUnknown(key, status);
+        out[unavailable ? "read_unavailable" : "read_permission_missing"] = true;
+        out.missing_sections = [{ section: "schedule_items", required_capability: "read_workbench", reason }];
+    }
+    else {
+        if (missing !== undefined && (!Array.isArray(missing) || missing.length !== 0))
+            throw scheduleUnknown(key, status);
+        try {
+            out.schedule_item = projectItem(value.schedule_item);
+        }
+        catch {
+            throw scheduleUnknown(key, status);
+        }
+        if (out.schedule_item.id !== value.id)
+            throw scheduleUnknown(key, status);
+    }
+    return out;
+}
+export function isScheduleHeaderPath(path, method) {
+    return method === "GET" && path === scheduleRoot + "/m1/schedule-write-status"
+        || method === "POST" && (path === scheduleRoot + "/m2/schedule-items" || /^\/api\/v1\/agent\/m2\/schedule-items\/[^/]+\/(complete|cancel|undo)$/.test(path))
+        || method === "PATCH" && /^\/api\/v1\/agent\/m2\/schedule-items\/[^/]+$/.test(path);
+}
+export function scheduleHeaders(path, method, value) {
+    if (!record(value) || Object.keys(value).some(name => !["Idempotency-Key", "If-Match"].includes(name)))
+        return scheduleInvalid();
+    const headers = { "Idempotency-Key": scheduleKey(value["Idempotency-Key"]) };
+    const revisionRequired = method !== "GET" && path !== scheduleRoot + "/m2/schedule-items";
+    if (revisionRequired) {
+        const revision = value["If-Match"];
+        if (typeof revision !== "string" || !/^"[1-9]\d*"(?![\s\S])/.test(revision) || !validScheduleRevision(Number(revision.slice(1, -1))))
+            return scheduleInvalid();
+        headers["If-Match"] = revision;
+    }
+    else if (value["If-Match"] !== undefined)
+        scheduleInvalid();
+    return headers;
+}

package/dist/schedule-help.js

@@ -0,0 +1,35 @@
+const id = "11111111-1111-4111-8111-111111111111";
+const key = "schedule-example-key-0001";
+const notes = "先复述标题、完整日期和时间（含时区）；没日期明确说“先不定日期”，本人确认后才传 confirmed:true。服务端不能验证口头确认。所有写必须用16-128位安全ASCII幂等键；未知202不是成功，保留原键和连接，用 schedule status 核对，不自动重试、换键或执行依赖写入。读取归 read_workbench，写入归 write_schedule，只读设备不能写；项目标签受 read_projects/read_drafts 限制。没有删除接口。";
+const fields = {
+    title: "create必填，update选填；按Go规则去首尾空白后1-200个Unicode码点，不含控制符。",
+    due_date: "选填，真实YYYY-MM-DD；null或空字符串清除时间，省略保持（create默认不定日期）。",
+    due_at: "选填，RFC3339含Z或明确时区偏移，例如2026-11-09T12:00:00+08:00；可null清除。due_date与due_at不能同时非空。",
+    project_id: "选填，本人项目UUID；null或空字符串解除关联，省略保持。",
+    confirmed: "必填且只能为true；表示调用方已取得本人确认，不代表服务器验证了口头确认。",
+};
+export const scheduleCommandHelp = {
+    "schedule list": {
+        command: "schedule list", usage: "caotang schedule list", description: "读取本人日程/待办，保留服务端排序、分组及分页；取消和完成记录永久保留。",
+        options: ["--view", "--status", "--group-by", "--project", "--q", "--start-date", "--end-date", "--limit", "--offset"],
+        fields: { view: "pending（默认）、workbench、recent_completed或history。", status: "仅view=history可传：all、completed、cancelled。", "group-by": "date（默认）或project。", project: "none表示不属于项目，否则传项目UUID；省略为全部。", "start-date": "北京时间含首尾日期YYYY-MM-DD；只到日期或精确时间，未定日期不进入日期范围。", "end-date": "YYYY-MM-DD，不早于start-date。", limit: "1-100；默认20，workbench默认5。", offset: "0至9007199254740991。", q: "标题关键字，去首尾空白后最多200个Unicode码点。" },
+        example: { command: "caotang schedule list --view history --status cancelled --limit 100" }, notes,
+    },
+    "schedule show": { command: "schedule show", usage: "caotang schedule show <id>", description: "读取一条日程及schedule_item.revision；写入时使用这一版本，不猜版本号。", options: [], example: { command: `caotang schedule show ${id}` }, notes },
+    "schedule status": { command: "schedule status", usage: "caotang schedule status --idempotency-key KEY", description: "只读核对同一连接的原写入回执；原键仅发送为Idempotency-Key header，不在query/body。未知结果退出非0。", options: ["--idempotency-key"], example: { command: `caotang schedule status --idempotency-key ${key}` }, notes },
+};
+for (const operation of ["create", "update", "complete", "cancel", "undo", "add", "done"]) {
+    const create = operation === "create" || operation === "add";
+    const edit = create || operation === "update";
+    const command = `schedule ${operation}`;
+    const suffix = `${create ? "" : " <id>"} --input file|- --idempotency-key KEY${create ? "" : " --revision N"}`;
+    scheduleCommandHelp[command] = {
+        command, usage: `caotang ${command}${suffix}`,
+        description: operation === "add" ? "create兼容别名，确认后新增待办。" : operation === "done" ? "complete兼容别名，确认后标完成。" : operation === "undo" ? "仅撤销刚完成的记录，约5秒窗口；不恢复取消、不删除记录。" : operation === "update" ? "按presence修改待办，只提交确认过的字段，至少一个业务字段。" : `确认后${{ create: "新增待办", complete: "标完成", cancel: "取消待办，保留记录" }[operation]}。`,
+        options: ["--input", "--idempotency-key", ...(create ? [] : ["--revision"])],
+        fields: { ...(edit ? fields : { confirmed: fields.confirmed }), ...(!create ? { revision: "必填--revision N，来自最近读回的正安全整数revision；发送strong If-Match:双引号包围N。冲突后核对，不自动重发。" } : {}) },
+        required_fields: [...(create ? ["title"] : []), "confirmed"],
+        example: { command: `caotang ${command}${create ? "" : ` ${id}`} --input - --idempotency-key ${key}${create ? "" : " --revision 3"}`, input: create ? { title: "本人确认的待办", confirmed: true } : operation === "update" ? { due_date: "2026-11-09", confirmed: true } : { confirmed: true } }, notes,
+    };
+}
+export const scheduleCommandUsages = Object.values(scheduleCommandHelp).map(item => item.usage.replace(/^caotang /, ""));

package/dist/schedule-start-wire.js

@@ -0,0 +1,80 @@
+import { validDate as validDay } from "./query-validation.js";
+const row = (value) => {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw Error();
+    return value;
+};
+const count = (value) => {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0)
+        throw Error();
+    return value;
+};
+const text = (value, max) => {
+    if (typeof value !== "string" || !value || [...value].length > max || /[\p{Cc}\u2028\u2029\uD800-\uDFFF]/u.test(value))
+        throw Error();
+    return value;
+};
+const identity = (value) => {
+    const result = text(value, 36);
+    if (!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(result))
+        throw Error();
+    return result;
+};
+const projectTitle = (value) => {
+    if (typeof value !== "string" || !value || [...value].length > 80 || /[\u0000\uD800-\uDFFF]/u.test(value))
+        throw Error();
+    return value;
+};
+const timestamp = (value) => {
+    const result = text(value, 40);
+    if (!/^[0-9]{4}-[0-9]{2}-[0-9]{2}T(?:[01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9](?:\.[0-9]{1,9})?(?:Z|[+-](?:[01][0-9]|2[0-3]):[0-5][0-9])$/.test(result) || !validDay(result.slice(0, 10)) || !Number.isFinite(Date.parse(result)))
+        throw Error();
+    return result;
+};
+function values(value, cap) {
+    if (!Array.isArray(value) || value.length > cap)
+        throw Error();
+    return value;
+}
+function item(value, bucket) {
+    const r = row(value);
+    if (r.status !== "pending" || r.bucket !== bucket || (r.due_date === undefined) === (r.due_at === undefined))
+        throw Error();
+    let when;
+    if (r.due_date !== undefined) {
+        if (!validDay(r.due_date))
+            throw Error();
+        when = { due_date: r.due_date };
+    }
+    else
+        when = { due_at: timestamp(r.due_at) };
+    const project = r.project_id === undefined ? {} : { project_id: identity(r.project_id), project_title: projectTitle(r.project_title) };
+    if (r.project_id === undefined && r.project_title !== undefined)
+        throw Error();
+    if (r.project_unavailable_reason !== undefined && r.project_unavailable_reason !== "project_unavailable")
+        throw Error();
+    return { id: identity(r.id), title: text(r.title, 80), status: "pending", bucket, ...when, ...project,
+        ...(r.project_unavailable_reason === undefined ? {} : { project_unavailable_reason: r.project_unavailable_reason }) };
+}
+function segment(value, bucket) {
+    const r = row(value), total = count(r.total), items = values(r.items, 8).map(v => item(v, bucket));
+    if (items.length > total || r.has_more !== (items.length < total))
+        throw Error();
+    return { total, items, has_more: r.has_more };
+}
+function titles(value, cap) {
+    const r = row(value), total = count(r.total), titles = values(r.titles, cap).map(v => text(v, 80));
+    if (titles.length > total || r.has_more !== (titles.length < total))
+        throw Error();
+    return { total, titles, has_more: r.has_more };
+}
+export function verifiedScheduleStart(value) {
+    const r = row(value);
+    if (r.timezone !== "Asia/Shanghai" || r.item_limit !== 20)
+        throw Error();
+    const overdue = segment(r.overdue, "overdue"), today = segment(r.today, "today"), undated = titles(r.undated, 3), next = titles(r.next_seven_days, 1), total = count(r.total_stored), later = count(r.later_total);
+    if (overdue.total + today.total + undated.total + next.total + later > total)
+        throw Error();
+    return { timezone: "Asia/Shanghai", as_of: timestamp(r.as_of), item_limit: 20, total_stored: total,
+        overdue, today, undated, next_seven_days: next, later_total: later };
+}

package/dist/schedule.js

@@ -0,0 +1,70 @@
+import { CliError } from "./errors.js";
+import { validateCommandArguments } from "./input-validation.js";
+import { ScheduleProblem, scheduleBody, scheduleFailure, scheduleID, scheduleInvalid, scheduleKey, scheduleQuery, scheduleReadResult, scheduleReceipt, scheduleRoot, scheduleUnknown, validScheduleRevision } from "./schedule-contract.js";
+export async function executeSchedule(args, flags, ctx) {
+    try {
+        validateCommandArguments(args, flags);
+        const operation = args[1] === "add" ? "create" : args[1] === "done" ? "complete" : args[1];
+        let path, options = { method: "GET", token: ctx.token }, key;
+        const detail = operation === "show";
+        if (operation === "list") {
+            const names = { view: "view", status: "status", "group-by": "group_by", project: "project_id", q: "q", "start-date": "start_date", "end-date": "end_date", limit: "limit", offset: "offset" };
+            const input = {};
+            for (const [name, value] of Object.entries(flags)) {
+                if (!Object.hasOwn(names, name))
+                    scheduleInvalid();
+                if (name === "limit" || name === "offset") {
+                    if (typeof value !== "string" || !/^\d+$/.test(value))
+                        scheduleInvalid();
+                    input[names[name]] = Number(value);
+                }
+                else
+                    input[names[name]] = value;
+            }
+            const query = new URLSearchParams(Object.entries(scheduleQuery(input)).map(([name, value]) => [name, String(value)])).toString();
+            path = `${scheduleRoot}/m1/schedule-items${query ? `?${query}` : ""}`;
+        }
+        else if (detail)
+            path = `${scheduleRoot}/m1/schedule-items/${scheduleID(args[2])}`;
+        else if (operation === "status") {
+            key = scheduleKey(flags["idempotency-key"]);
+            path = `${scheduleRoot}/m1/schedule-write-status`;
+            options.headers = { "Idempotency-Key": key };
+        }
+        else {
+            if (!["create", "update", "complete", "cancel", "undo"].includes(operation))
+                return scheduleInvalid();
+            key = scheduleKey(flags["idempotency-key"]);
+            const create = operation === "create";
+            const headers = { "Idempotency-Key": key };
+            if (!create) {
+                const revision = flags.revision;
+                if (typeof revision !== "string" || !/^[1-9]\d*$/.test(revision) || !validScheduleRevision(Number(revision)))
+                    scheduleInvalid();
+                headers["If-Match"] = `"${revision}"`;
+            }
+            if (typeof flags.input !== "string" || !flags.input.trim())
+                scheduleInvalid();
+            const body = scheduleBody(operation, await ctx.readInput(flags.input));
+            path = `${scheduleRoot}/m2/schedule-items${create ? "" : `/${scheduleID(args[2])}${operation === "update" ? "" : `/${operation}`}`}`;
+            options = { ...options, method: operation === "update" ? "PATCH" : "POST", body, headers };
+        }
+        let result;
+        try {
+            result = await ctx.api.request(path, options);
+        }
+        catch {
+            if (key)
+                throw scheduleUnknown(key);
+            throw new ScheduleProblem("network_error", "日程读取未完成。", "检查当前执行环境的网络；不要反复重试或重新授权。", 6);
+        }
+        if (![200, 201].includes(result.status))
+            throw scheduleFailure(result.status, result.body, operation === "list" || detail ? ["read_workbench", "read_projects"] : operation === "status" ? [] : ["write_schedule"], key);
+        return { ...result, body: key ? scheduleReceipt(result.status, result.body, key) : scheduleReadResult(result.status, result.body, detail) };
+    }
+    catch (error) {
+        if (error instanceof ScheduleProblem)
+            throw new CliError(error.code, error.humanMessage, error.nextAction, error.exitCode, error.details);
+        throw error;
+    }
+}

package/dist/skill-assets.js

@@ -0,0 +1,136 @@
+import { agentIdentity, shellWord } from "./agent-identity.js";
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+import { isAbsolute, join, parse, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { asRecord, CliError } from "./errors.js";
+// One release path allowlist, checked against the real package manifest.
+// Never use an arbitrary manifest entry as a filesystem installation target.
+export const skillNames = Object.freeze(["caotang-context", "caotang-save-knowledge", "caotang-project-progress", "caotang-search", "caotang-workday", "caotang-first-connect", "caotang-schedule"]);
+export function completeSkillInventory(names) {
+    return names.length === skillNames.length && new Set(names).size === skillNames.length && names.every(name => skillNames.includes(name));
+}
+const manifestLimit = 16 * 1024;
+const contentLimit = 64 * 1024;
+const invalid = () => new CliError("skill_assets_invalid", "本包技能资源未通过安全或格式检查。", "请使用完整、未修改的一间草堂命令行安装包，不要复制不明技能文件。", 7);
+const sameFile = (a, b) => a.dev === b.dev && a.ino === b.ino;
+const unchanged = (a, b) => sameFile(a, b) && a.size === b.size && a.mtimeMs === b.mtimeMs && a.ctimeMs === b.ctimeMs;
+async function addDirectory(directories, path) {
+    const stat = await lstat(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw invalid();
+    directories.push({ path, stat });
+}
+async function checkDirectories(directories) {
+    for (const directory of directories) {
+        const current = await lstat(directory.path);
+        if (!current.isDirectory() || current.isSymbolicLink() || !sameFile(directory.stat, current))
+            throw invalid();
+    }
+}
+function checkRegular(stat, limit) {
+    if (!stat.isFile() || stat.nlink !== 1 || stat.size < 1 || stat.size > limit)
+        throw invalid();
+}
+async function readAsset(path, limit, directories) {
+    await checkDirectories(directories);
+    const before = await lstat(path);
+    checkRegular(before, limit);
+    const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const opened = await handle.stat();
+        checkRegular(opened, limit);
+        if (!unchanged(before, opened))
+            throw invalid();
+        // Bound the read even if a regular file grows after fstat; never wait on a FIFO.
+        const buffer = Buffer.alloc(limit + 1);
+        let length = 0;
+        while (length < buffer.length) {
+            const { bytesRead } = await handle.read(buffer, length, buffer.length - length, length);
+            if (bytesRead === 0)
+                break;
+            length += bytesRead;
+        }
+        const after = await handle.stat();
+        const current = await lstat(path);
+        checkRegular(after, limit);
+        checkRegular(current, limit);
+        if (length > limit || length !== opened.size || !unchanged(opened, after) || !unchanged(after, current))
+            throw invalid();
+        await checkDirectories(directories);
+        const bytes = buffer.subarray(0, length);
+        const content = bytes.toString("utf8");
+        if (!Buffer.from(content, "utf8").equals(bytes))
+            throw invalid();
+        return content;
+    }
+    finally {
+        await handle.close();
+    }
+}
+function metadata(content) {
+    const manifest = asRecord(JSON.parse(content));
+    if (!manifest || Object.keys(manifest).sort().join(",") !== "formatVersion,skills" || manifest.formatVersion !== 1
+        || !Array.isArray(manifest.skills) || manifest.skills.length !== skillNames.length)
+        throw invalid();
+    const seen = new Set();
+    return manifest.skills.map((value) => {
+        const item = asRecord(value);
+        if (!item || Object.keys(item).sort().join(",") !== "description,name" || typeof item.name !== "string"
+            || !skillNames.some(name => name === item.name) || seen.has(item.name)
+            || typeof item.description !== "string" || !item.description.trim() || item.description.trim() !== item.description
+            || item.description.length > 1000 || /[\x00-\x1f\x7f]/.test(item.description))
+            throw invalid();
+        seen.add(item.name);
+        return { name: item.name, description: item.description };
+    });
+}
+export async function loadSkillAssets(packageRoot) {
+    try {
+        const requested = packageRoot ?? fileURLToPath(new URL("../", import.meta.url));
+        if (typeof requested !== "string" || !requested || !isAbsolute(requested) || requested.includes("\0"))
+            throw invalid();
+        const root = resolve(requested);
+        const directories = [];
+        let path = parse(root).root;
+        await addDirectory(directories, path);
+        for (const part of root.slice(path.length).split(sep).filter(Boolean)) {
+            path = join(path, part);
+            await addDirectory(directories, path);
+        }
+        const skills = join(root, "skills");
+        await addDirectory(directories, skills);
+        const entries = metadata(await readAsset(join(skills, "manifest.json"), manifestLimit, directories));
+        for (const name of skillNames)
+            await addDirectory(directories, join(skills, name));
+        const assets = [];
+        for (const item of entries) {
+            const content = await readAsset(join(skills, item.name, "SKILL.md"), contentLimit, directories);
+            // JSON strings are valid YAML double-quoted scalars; no general YAML parser is needed.
+            const prefix = `---\nname: ${item.name}\ndescription: ${JSON.stringify(item.description)}\n---\n`;
+            if (!content.startsWith(prefix) || !content.slice(prefix.length).trim())
+                throw invalid();
+            assets.push({ ...item, content, sha256: createHash("sha256").update(content, "utf8").digest("hex") });
+        }
+        await checkDirectories(directories);
+        return assets;
+    }
+    catch {
+        throw invalid();
+    }
+}
+// Bind only the files installed into one AI platform; the shared runtime bundle
+// remains byte-for-byte independent of the selected identity.
+export function bindSkillAgent(asset, name) {
+    if (name === undefined)
+        return asset;
+    const agent = agentIdentity(name), word = shellWord(agent.key);
+    const marker = asset.content.indexOf("\n---\n");
+    if (marker < 0)
+        throw invalid();
+    const prefix = asset.content.slice(0, marker + 5);
+    const body = asset.content.slice(marker + 5).replace(/\bcaotang(?=\s+(?:--|[a-z]))/g, `caotang --agent ${word}`);
+    const content = `${prefix}\n本技能使用的 AI 名字是 ${JSON.stringify(agent.key)}。每条草堂命令都必须保留 --agent，不能借用其它 AI 的连接。\n${body}`;
+    return { ...asset, content, sha256: createHash("sha256").update(content, "utf8").digest("hex") };
+}