bukesiyi-cli 0.0.0-stage → 0.1.0

package/dist/main.js

@@ -0,0 +1,1269 @@
+// src/main.ts
+import { homedir } from "node:os";
+
+// src/cli.ts
+import { parseArgs } from "node:util";
+
+// src/env-proxy.ts
+var DEFAULT_PORTS = { "http:": 80, "https:": 443 };
+function nonEmpty(value) {
+  return value !== void 0 && value.trim() !== "";
+}
+function enabled(env2) {
+  return nonEmpty(env2.NODE_USE_ENV_PROXY) || /(^|\s)--use-env-proxy(=|\s|$)/.test(env2.NODE_OPTIONS ?? "");
+}
+function proxyVariable(protocol, env2) {
+  const forHttp = ["http_proxy", "HTTP_PROXY"];
+  const candidates = protocol === "https:" ? ["https_proxy", "HTTPS_PROXY", ...forHttp] : forHttp;
+  return candidates.find((name2) => nonEmpty(env2[name2])) ?? null;
+}
+function excluded(url, env2) {
+  const value = env2.no_proxy ?? env2.NO_PROXY ?? "";
+  if (value === "*") return true;
+  const hostname = url.host.replace(/:\d*$/, "").toLowerCase();
+  const port = Number.parseInt(url.port, 10) || DEFAULT_PORTS[url.protocol] || 0;
+  return value.split(/[,\s]/).some((entry) => {
+    const withPort = /^(.+):(\d+)$/.exec(entry);
+    const entryPort = withPort?.[2] === void 0 ? 0 : Number.parseInt(withPort[2], 10);
+    return (withPort?.[1] ?? entry).toLowerCase() === hostname && (entryPort === 0 || entryPort === port);
+  });
+}
+function envProxyFor(origin, env2) {
+  if (!enabled(env2)) return null;
+  const url = new URL(origin);
+  const variable = proxyVariable(url.protocol, env2);
+  return variable !== null && !excluded(url, env2) ? variable : null;
+}
+
+// src/exit-codes.ts
+var EXIT = {
+  OK: 0,
+  USAGE: 2,
+  AUTH: 3,
+  FUNDS: 4,
+  SERVER: 5,
+  QUOTE_CHANGED: 6,
+  RETRY_LATER: 7,
+  WAIT_TIMEOUT: 8,
+  TASK_FAILED: 9,
+  NOT_FOUND: 10,
+  INTERRUPTED: 130
+};
+function exitCodeForHttpStatus(status) {
+  if (status === 401 || status === 403) return EXIT.AUTH;
+  if (status === 404) return EXIT.NOT_FOUND;
+  if (status === 429) return EXIT.RETRY_LATER;
+  if (status >= 400 && status < 500) return EXIT.USAGE;
+  return EXIT.SERVER;
+}
+
+// src/errors.ts
+var KEY_LIKE = /bk_[A-Za-z0-9_-]{20,}/g;
+var PUBLIC_PREFIX = /^bk_(?:live|test)_[A-Za-z0-9]{16}$/;
+var SECRET_TAIL = /^bk_[A-Za-z0-9]+_[A-Za-z0-9]+_(.{16,})$/;
+var MIN_SECRET_LENGTH = 8;
+var CONTROL_CHARS = new RegExp("\\p{Cc}+", "gu");
+var MAX_REASON_LENGTH = 200;
+function redactKeys(text, keep = []) {
+  return text.replace(
+    KEY_LIKE,
+    (found) => PUBLIC_PREFIX.test(found) && keep.includes(found) ? found : "bk_[redacted]"
+  );
+}
+function redactSecret(text, secret) {
+  if (secret.length < MIN_SECRET_LENGTH) return text;
+  const withoutWhole = text.split(secret).join("bk_[redacted]");
+  const tail = SECRET_TAIL.exec(secret)?.[1];
+  return tail ? withoutWhole.split(tail).join("[redacted]") : withoutWhole;
+}
+function singleLine(text) {
+  return text.replace(CONTROL_CHARS, " ").trim();
+}
+var CliError = class _CliError extends Error {
+  code;
+  exitCode;
+  retryable;
+  traceId;
+  retryAfterSeconds;
+  httpStatus;
+  hints;
+  constructor(init) {
+    super(redactKeys(init.message));
+    this.name = "CliError";
+    this.code = init.code;
+    this.exitCode = init.exitCode;
+    this.retryable = init.retryable ?? false;
+    this.traceId = init.traceId ?? null;
+    if (init.retryAfterSeconds !== void 0) this.retryAfterSeconds = init.retryAfterSeconds;
+    if (init.httpStatus !== void 0) this.httpStatus = init.httpStatus;
+    this.hints = init.hints ?? [];
+  }
+  withHint(hint) {
+    return new _CliError({
+      code: this.code,
+      message: this.message,
+      exitCode: this.exitCode,
+      retryable: this.retryable,
+      traceId: this.traceId,
+      retryAfterSeconds: this.retryAfterSeconds,
+      httpStatus: this.httpStatus,
+      hints: [...this.hints, hint]
+    });
+  }
+};
+function usageError(message) {
+  return new CliError({ code: "CLI_USAGE", exitCode: EXIT.USAGE, message: `${message}\u3002\u8FD0\u884C buke --help \u770B\u7528\u6CD5` });
+}
+function interruptedError(message = "\u5DF2\u4E2D\u65AD") {
+  return new CliError({ code: "CLI_INTERRUPTED", exitCode: EXIT.INTERRUPTED, message });
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function nonEmptyText(value) {
+  return typeof value === "string" && value.trim() !== "" ? value : void 0;
+}
+function briefReason(error, secrets = []) {
+  const cause = isRecord(error) ? error.cause : void 0;
+  const picked = (isRecord(cause) ? nonEmptyText(cause.code) ?? nonEmptyText(cause.message) : void 0) ?? (isRecord(error) ? nonEmptyText(error.message) : void 0) ?? nonEmptyText(error) ?? "\u539F\u56E0\u4E0D\u660E";
+  return secrets.reduce(redactSecret, redactKeys(singleLine(picked))).slice(0, MAX_REASON_LENGTH);
+}
+function toCliError(error) {
+  if (error instanceof CliError) return error;
+  return new CliError({
+    code: "CLI_INTERNAL",
+    exitCode: EXIT.SERVER,
+    message: `\u51FA\u4E86\u4E00\u4E2A\u6CA1\u6599\u5230\u7684\u9519\uFF1A${briefReason(error)}`
+  });
+}
+
+// src/base-url.ts
+var DEFAULT_BASE_URL = "https://buke41.com";
+var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function invalid(detail) {
+  return new CliError({
+    code: "CLI_BASE_URL_INVALID",
+    exitCode: EXIT.USAGE,
+    message: `\u670D\u52A1\u5730\u5740\u4E0D\u5BF9\uFF1A${detail}`
+  });
+}
+function normalizeBaseUrl(input) {
+  let url;
+  try {
+    url = new URL(input);
+  } catch {
+    throw invalid("\u8981\u5199\u6210\u5B8C\u6574\u7684\u7F51\u5740\uFF0C\u4F8B\u5982 https://buke41.com");
+  }
+  if (url.username !== "" || url.password !== "" || url.pathname.replace(/^\/$/, "") !== "") {
+    throw invalid("\u53EA\u5199\u5230\u57DF\u540D\u4E3A\u6B62\uFF0C\u4F8B\u5982 https://buke41.com");
+  }
+  if (url.search !== "" || url.hash !== "" || url.href.includes("?") || url.href.includes("#")) {
+    throw invalid("\u53EA\u5199\u5230\u57DF\u540D\u4E3A\u6B62\uFF0C\u4F8B\u5982 https://buke41.com");
+  }
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && LOCAL_HOSTS.has(url.hostname))) {
+    throw new CliError({
+      code: "CLI_BASE_URL_INSECURE",
+      exitCode: EXIT.USAGE,
+      message: "\u4E3A\u4E86\u4E0D\u8BA9\u5BC6\u94A5\u660E\u6587\u8FC7\u7F51\uFF0C\u53EA\u63A5\u53D7 https \u5730\u5740\uFF08\u672C\u673A\u8C03\u8BD5\u7684 localhost \u9664\u5916\uFF09"
+    });
+  }
+  return url.origin;
+}
+function assertReachedDirectly(origin, env2) {
+  if (env2 === void 0 || !origin.startsWith("http://")) return;
+  const variable = envProxyFor(origin, env2);
+  if (variable === null) return;
+  throw new CliError({
+    code: "CLI_BASE_URL_INSECURE",
+    exitCode: EXIT.USAGE,
+    message: `\u73AF\u5883\u91CC\u5F00\u7740\u4EE3\u7406\uFF08${variable}\uFF09\uFF0C\u53D1\u5F80 ${origin} \u7684\u8BF7\u6C42\u53EF\u80FD\u4F1A\u8FDE\u540C\u5BC6\u94A5\u660E\u6587\u4EA4\u7ED9\u4EE3\u7406\uFF0C\u6240\u4EE5\u6CA1\u6709\u53D1\u9001\u3002\u672C\u673A\u8C03\u8BD5\u8BF7\u628A\u8FD9\u4E2A\u5730\u5740\u6392\u9664\u5728\u4EE3\u7406\u4E4B\u5916\uFF0C\u4F8B\u5982\u8BBE\u7F6E NO_PROXY='localhost,127.0.0.1,[::1]'`
+  });
+}
+function nonEmpty2(value) {
+  return value !== void 0 && value.trim() !== "" ? value : void 0;
+}
+function explicitBaseUrl(flag, env2) {
+  if (flag !== void 0) return normalizeBaseUrl(flag);
+  const fromEnv = nonEmpty2(env2.BUKE_BASE_URL);
+  return fromEnv === void 0 ? null : normalizeBaseUrl(fromEnv);
+}
+
+// src/key-input.ts
+var DEFAULT_STDIN_TIMEOUT_MS = 3e4;
+var KEY_IN_ARGV = /(^|[^A-Za-z0-9])bk_[A-Za-z0-9_-]{4,}/;
+var KEY_FORMAT = /^bk_[A-Za-z0-9_-]{8,200}$/;
+var CANONICAL_KEY = /^bk_(live|test)_/;
+var PUBLIC_KEY_ID = /^[A-Za-z0-9]{16}$/;
+var MAX_INPUT_BYTES = 8 * 1024;
+var CTRL_C = "";
+var CTRL_D = "";
+var BACKSPACE = "\b";
+var DELETE = "\x7F";
+var ESCAPE = "\x1B";
+var CANCELLED = "\u5DF2\u53D6\u6D88\uFF0C\u6CA1\u6709\u4FDD\u5B58\u4EFB\u4F55\u51ED\u636E";
+function argvContainsKey(argv) {
+  return argv.some((item) => KEY_IN_ARGV.test(item));
+}
+function keyFromEnv(env2) {
+  const value = env2.BUKE_API_KEY?.trim();
+  return value ? value : null;
+}
+function malformedKey() {
+  return new CliError({
+    code: "CLI_KEY_MALFORMED",
+    exitCode: EXIT.USAGE,
+    message: "\u8FD9\u4E0D\u50CF\u4E00\u628A API \u5BC6\u94A5\uFF1A\u5E94\u4EE5 bk_ \u5F00\u5934\uFF0C\u4E2D\u95F4\u6CA1\u6709\u7A7A\u683C\u6216\u6362\u884C"
+  });
+}
+function missingKey(message) {
+  return new CliError({ code: "CLI_KEY_MISSING", exitCode: EXIT.USAGE, message });
+}
+var NO_KEY_READ = "\u6CA1\u6709\u8BFB\u5230\u5BC6\u94A5\u3002\u8BF7\u8BBE\u7F6E\u73AF\u5883\u53D8\u91CF BUKE_API_KEY\uFF0C\u6216\u8005\u901A\u8FC7\u7BA1\u9053\u628A\u5BC6\u94A5\u4F20\u7ED9 buke login";
+function assertKeyFormat(key) {
+  if (!KEY_FORMAT.test(key)) throw malformedKey();
+}
+function displayPrefixOf(apiKey, keyId) {
+  const environment = CANONICAL_KEY.exec(apiKey)?.[1];
+  return environment && PUBLIC_KEY_ID.test(keyId) ? `bk_${environment}_${keyId}` : keyId;
+}
+function formatSeconds(milliseconds) {
+  return String(Math.round(milliseconds / 10) / 100);
+}
+function release(stdin) {
+  stdin.pause();
+  const handle = stdin;
+  if (typeof handle.unref === "function") handle.unref();
+}
+function toBuffer(chunk) {
+  if (typeof chunk === "string") return Buffer.from(chunk, "utf8");
+  return Buffer.from(chunk);
+}
+function readToEnd(stdin, timeoutMs, signal) {
+  return new Promise((resolve2, reject) => {
+    const state = stdin;
+    if (state.readableEnded === true || state.destroyed === true) {
+      resolve2("");
+      return;
+    }
+    const chunks = [];
+    let size = 0;
+    let settled = false;
+    const settle = (deliver) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      stdin.removeListener("data", onData);
+      stdin.removeListener("end", onEnd);
+      stdin.removeListener("close", onEnd);
+      stdin.removeListener("error", onError);
+      signal?.removeEventListener("abort", onAbort);
+      release(stdin);
+      deliver();
+    };
+    const onAbort = () => settle(() => reject(interruptedError(CANCELLED)));
+    const onData = (chunk) => {
+      const piece = toBuffer(chunk);
+      size += piece.length;
+      if (size > MAX_INPUT_BYTES) {
+        settle(() => reject(malformedKey()));
+        return;
+      }
+      chunks.push(piece);
+    };
+    const onEnd = () => settle(() => resolve2(Buffer.concat(chunks).toString("utf8").trim()));
+    const onError = (error) => settle(() => reject(missingKey(`\u6CA1\u6709\u8BFB\u5230\u5BC6\u94A5\uFF1A\u6807\u51C6\u8F93\u5165\u51FA\u9519\uFF08${briefReason(error)}\uFF09`)));
+    const timer = setTimeout(() => {
+      settle(
+        () => reject(
+          missingKey(
+            `\u6CA1\u6709\u8BFB\u5230\u5BC6\u94A5\uFF1A\u7B49\u4E86 ${formatSeconds(timeoutMs)} \u79D2\uFF0C\u6807\u51C6\u8F93\u5165\u4E00\u76F4\u6CA1\u6709\u7ED3\u675F\u3002\u8BF7\u7528 BUKE_API_KEY\uFF0C\u6216\u8005\u8FD9\u6837\u4F20\uFF1Aprintf '%s' "$KEY" | buke login`
+          )
+        )
+      );
+    }, timeoutMs);
+    stdin.on("data", onData);
+    stdin.on("end", onEnd);
+    stdin.on("close", onEnd);
+    stdin.on("error", onError);
+    signal?.addEventListener("abort", onAbort, { once: true });
+    stdin.resume();
+  });
+}
+function readHiddenLine(stdin, signal) {
+  return new Promise((resolve2, reject) => {
+    let typed = "";
+    let escape = "none";
+    let settled = false;
+    const settle = (deliver) => {
+      if (settled) return;
+      settled = true;
+      stdin.removeListener("data", onData);
+      stdin.removeListener("end", onEnd);
+      stdin.removeListener("close", onEnd);
+      stdin.removeListener("error", onError);
+      signal?.removeEventListener("abort", onAbort);
+      deliver();
+    };
+    const onData = (chunk) => {
+      for (const char of toBuffer(chunk).toString("utf8")) {
+        if (char === "\r" || char === "\n" || char === CTRL_C || char === CTRL_D) {
+          escape = "none";
+        } else if (escape === "started" || escape === "carried") {
+          const alone = escape === "carried";
+          if (char === "[" || char === "O" && !alone) {
+            escape = "sequence";
+            continue;
+          }
+          escape = "none";
+          if (!alone) continue;
+        } else if (escape === "sequence") {
+          if (char >= "@" && char <= "~") escape = "none";
+          continue;
+        }
+        if (char === "\r" || char === "\n") {
+          settle(() => resolve2(typed));
+          return;
+        }
+        if (char === CTRL_C) {
+          settle(() => reject(interruptedError(CANCELLED)));
+          return;
+        }
+        if (char === CTRL_D) {
+          settle(() => typed === "" ? reject(missingKey(NO_KEY_READ)) : resolve2(typed));
+          return;
+        }
+        if (char === DELETE || char === BACKSPACE) {
+          typed = typed.slice(0, -1);
+          continue;
+        }
+        if (char === ESCAPE) {
+          escape = "started";
+          continue;
+        }
+        if (char < " ") continue;
+        typed += char;
+        if (typed.length > MAX_INPUT_BYTES) {
+          settle(() => reject(malformedKey()));
+          return;
+        }
+      }
+      if (escape === "started") escape = "carried";
+    };
+    const onEnd = () => settle(() => resolve2(typed));
+    const onError = (error) => settle(() => reject(missingKey(`\u6CA1\u6709\u8BFB\u5230\u5BC6\u94A5\uFF1A\u6807\u51C6\u8F93\u5165\u51FA\u9519\uFF08${briefReason(error)}\uFF09`)));
+    const onAbort = () => settle(() => reject(interruptedError(CANCELLED)));
+    stdin.on("data", onData);
+    stdin.on("end", onEnd);
+    stdin.on("close", onEnd);
+    stdin.on("error", onError);
+    signal?.addEventListener("abort", onAbort, { once: true });
+    stdin.resume();
+  });
+}
+async function promptHidden(io, setRawMode) {
+  io.stderr.write("\u8BF7\u7C98\u8D34 API \u5BC6\u94A5\uFF08\u8F93\u5165\u4E0D\u4F1A\u663E\u793A\uFF09\uFF0C\u56DE\u8F66\u786E\u8BA4\uFF1A");
+  try {
+    setRawMode.call(io.stdin, true);
+    return (await readHiddenLine(io.stdin, io.signal)).trim();
+  } finally {
+    try {
+      setRawMode.call(io.stdin, false);
+    } catch {
+    }
+    release(io.stdin);
+    io.stderr.write("\n");
+  }
+}
+function willPromptForKey(io) {
+  return keyFromEnv(io.env) === null && io.stdin.isTTY === true && typeof io.stdin.setRawMode === "function";
+}
+async function readNewKey(io) {
+  const fromEnv = keyFromEnv(io.env);
+  if (fromEnv !== null) {
+    assertKeyFormat(fromEnv);
+    return { key: fromEnv, source: "env" };
+  }
+  if (io.signal?.aborted) throw interruptedError(CANCELLED);
+  const setRawMode = io.stdin.setRawMode;
+  const interactive = io.stdin.isTTY === true && typeof setRawMode === "function";
+  const key = interactive ? await promptHidden(io, setRawMode) : await readToEnd(io.stdin, io.stdinTimeoutMs ?? DEFAULT_STDIN_TIMEOUT_MS, io.signal);
+  if (key === "") throw missingKey(NO_KEY_READ);
+  assertKeyFormat(key);
+  return { key, source: interactive ? "terminal" : "stdin" };
+}
+
+// package.json
+var name = "bukesiyi-cli";
+var version = "0.1.0";
+
+// src/version.ts
+var PACKAGE_NAME = name;
+var VERSION = version;
+
+// src/client.ts
+var DEFAULT_REQUEST_TIMEOUT_MS = 15e3;
+var ME_PATH = "/api/open/v1/me";
+var MAX_BODY_BYTES = 1024 * 1024;
+var NOT_FOUND_HINT = "\u8FD9\u4E2A\u5730\u5740\u4E0A\u6CA1\u6709\u5F00\u653E\u63A5\u53E3\uFF1A\u53EF\u80FD\u8FD8\u6CA1\u6709\u5BF9\u5916\u5F00\u901A\uFF0C\u6216\u8005 --base-url \u5199\u9519\u4E86";
+function userAgent() {
+  return `${PACKAGE_NAME}/${VERSION} node/${process.versions.node}`;
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function retryableStatus(status) {
+  return status === 429 || status >= 500;
+}
+function unreadableResponse(status) {
+  const retryable = retryableStatus(status);
+  const advice = retryable ? "\u53EF\u80FD\u662F\u7F51\u5173\u6216\u4E2D\u95F4\u5C42\u51FA\u7684\u9519\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5" : "\u53EF\u80FD\u662F\u7F51\u5173\u6216\u4E2D\u95F4\u5C42\u51FA\u7684\u9519\uFF0C\u4E5F\u53EF\u80FD\u662F\u670D\u52A1\u5730\u5740\u6307\u5230\u4E86\u522B\u5904\uFF1B\u91CD\u8BD5\u591A\u534A\u6CA1\u6709\u7528\uFF0C\u8BF7\u5148\u6838\u5BF9\u670D\u52A1\u5730\u5740";
+  return new CliError({
+    code: "CLI_BAD_RESPONSE",
+    exitCode: EXIT.SERVER,
+    retryable,
+    message: `\u670D\u52A1\u5668\u56DE\u4E86\u4E00\u4E2A\u770B\u4E0D\u61C2\u7684\u56DE\u5E94\uFF08HTTP ${status}\uFF09\uFF0C${advice}`,
+    hints: status === 404 ? [NOT_FOUND_HINT] : []
+  });
+}
+function redirectTarget(response, requestUrl) {
+  const location = response.headers?.get("location");
+  if (!location) return null;
+  try {
+    const origin = new URL(location, requestUrl).origin;
+    return origin === "null" ? null : origin;
+  } catch {
+    return null;
+  }
+}
+function discardBody(response) {
+  try {
+    void response.body?.cancel().catch(() => void 0);
+  } catch {
+  }
+}
+async function readBody(response, abandoned) {
+  const body = response.body;
+  if (body === null) return "";
+  if (body === void 0) {
+    const text = await response.text();
+    return Buffer.byteLength(text, "utf8") > MAX_BODY_BYTES ? null : text;
+  }
+  const reader = body.getReader();
+  const release2 = () => void reader.cancel().catch(() => void 0);
+  if (abandoned.aborted) release2();
+  abandoned.addEventListener("abort", release2, { once: true });
+  const chunks = [];
+  let size = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > MAX_BODY_BYTES) {
+        await reader.cancel().catch(() => void 0);
+        return null;
+      }
+      chunks.push(value);
+    }
+  } finally {
+    abandoned.removeEventListener("abort", release2);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+function isTimeout(error) {
+  const name2 = typeof error === "object" && error !== null ? error.name : void 0;
+  return name2 === "TimeoutError" || name2 === "AbortError";
+}
+function proxyHints(origin, deps) {
+  const variable = deps.env ? envProxyFor(origin, deps.env) : null;
+  return variable === null ? [] : [`\u73AF\u5883\u91CC\u5F00\u7740\u4EE3\u7406\uFF08${variable}\uFF09\uFF0C\u8FD9\u6B21\u8BF7\u6C42\u53EF\u80FD\u662F\u7ECF\u5B83\u53D1\u51FA\u7684\uFF1A\u51FA\u95EE\u9898\u7684\u4E5F\u53EF\u80FD\u662F\u4EE3\u7406`];
+}
+async function exchange(url, apiKey, deps, origin) {
+  if (deps.signal?.aborted) throw interruptedError();
+  const timeoutMs = deps.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  const controller = new AbortController();
+  let timedOut = false;
+  let timer;
+  const deadline = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      timedOut = true;
+      const reason = new DOMException("request timed out", "TimeoutError");
+      controller.abort(reason);
+      reject(reason);
+    }, timeoutMs);
+  });
+  let stop = () => void 0;
+  const interrupted = new Promise((_resolve, reject) => {
+    stop = () => {
+      controller.abort();
+      reject(interruptedError());
+    };
+  });
+  deps.signal?.addEventListener("abort", stop, { once: true });
+  const send = deps.fetch;
+  const work = (async () => {
+    const response = await send(url, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        Accept: "application/json",
+        "User-Agent": userAgent()
+      },
+      // 跟着跳转走，密钥就会被带到一个使用者没有点头的地方。
+      redirect: "manual",
+      signal: controller.signal
+    });
+    if (response.status >= 300 && response.status < 400) {
+      discardBody(response);
+      return { status: response.status, redirectedTo: redirectTarget(response, url) };
+    }
+    return { status: response.status, text: await readBody(response, controller.signal) };
+  })();
+  work.catch(() => void 0);
+  try {
+    return await Promise.race([work, deadline, interrupted]);
+  } catch (error) {
+    if (error instanceof CliError) throw error;
+    if (timedOut || isTimeout(error)) {
+      throw new CliError({
+        code: "CLI_TIMEOUT",
+        exitCode: EXIT.SERVER,
+        retryable: true,
+        message: `\u8FDE\u63A5 ${origin} \u8D85\u65F6\uFF08${formatSeconds(timeoutMs)} \u79D2\uFF09`,
+        hints: proxyHints(origin, deps)
+      });
+    }
+    throw new CliError({
+      code: "CLI_NETWORK",
+      exitCode: EXIT.SERVER,
+      retryable: true,
+      // 底层的错有时会把请求头原样抄进原因里；手里这把密钥在这一层就抹掉，不指望调用方。
+      message: `\u8FDE\u4E0D\u4E0A ${origin}\uFF1A${briefReason(error, [apiKey])}`,
+      hints: proxyHints(origin, deps)
+    });
+  } finally {
+    clearTimeout(timer);
+    deps.signal?.removeEventListener("abort", stop);
+  }
+}
+function parseJson(text) {
+  if (text === null) return null;
+  try {
+    return { value: JSON.parse(text) };
+  } catch {
+    return null;
+  }
+}
+function serverError(status, body, apiKey) {
+  const error = isRecord2(body) ? body.error : void 0;
+  if (!isRecord2(error) || typeof error.code !== "string" || typeof error.message !== "string") return null;
+  const retryAfter = error.retryAfterSeconds;
+  return new CliError({
+    code: error.code,
+    // 对面把收到的密钥抄回话里时，在这一层就抹掉。
+    message: error.message.trim() === "" ? `\u670D\u52A1\u5668\u62D2\u7EDD\u4E86\u8FD9\u6B21\u8BF7\u6C42\uFF08HTTP ${status}\uFF09` : redactSecret(error.message, apiKey),
+    exitCode: exitCodeForHttpStatus(status),
+    retryable: typeof error.retryable === "boolean" ? error.retryable : retryableStatus(status),
+    traceId: typeof error.traceId === "string" ? error.traceId : null,
+    retryAfterSeconds: typeof retryAfter === "number" && Number.isFinite(retryAfter) ? retryAfter : void 0,
+    httpStatus: status,
+    hints: status === 404 ? [NOT_FOUND_HINT] : []
+  });
+}
+async function getJson(baseUrl, apiKey, path, deps) {
+  const origin = normalizeBaseUrl(baseUrl);
+  assertKeyFormat(apiKey);
+  assertReachedDirectly(origin, deps.env);
+  const result = await exchange(`${origin}${path}`, apiKey, deps, origin);
+  if ("redirectedTo" in result) {
+    const where = result.redirectedTo ? `\uFF08${result.redirectedTo}\uFF09` : "";
+    throw new CliError({
+      code: "CLI_REDIRECT",
+      exitCode: EXIT.SERVER,
+      retryable: false,
+      message: `\u670D\u52A1\u5668\u628A\u8BF7\u6C42\u8F6C\u5230\u4E86\u522B\u5904${where}\uFF0C\u4E3A\u4E86\u4E0D\u628A\u5BC6\u94A5\u5E26\u8FC7\u53BB\u6CA1\u6709\u8DDF\u968F\u3002\u8BF7\u6838\u5BF9 --base-url`
+    });
+  }
+  const parsed = parseJson(result.text);
+  if (result.status >= 200 && result.status < 300) {
+    if (!parsed) throw unreadableResponse(result.status);
+    return { status: result.status, body: parsed.value };
+  }
+  throw (parsed && serverError(result.status, parsed.value, apiKey)) ?? unreadableResponse(result.status);
+}
+function parseMe(body) {
+  if (!isRecord2(body)) return null;
+  const { key, account, workspace } = body;
+  if (!isRecord2(key) || !isRecord2(account) || !isRecord2(workspace)) return null;
+  const { id, name: name2, scopes, expiresAt } = key;
+  if (typeof id !== "string" || typeof name2 !== "string") return null;
+  if (!Array.isArray(scopes) || !scopes.every((scope) => typeof scope === "string")) return null;
+  if (expiresAt !== null && typeof expiresAt !== "string") return null;
+  if (typeof account.id !== "string") return null;
+  if (typeof workspace.id !== "string" || typeof workspace.role !== "string") return null;
+  return {
+    key: { id, name: name2, scopes: [...scopes], expiresAt },
+    account: { id: account.id },
+    workspace: { id: workspace.id, role: workspace.role }
+  };
+}
+async function getMe(baseUrl, apiKey, deps) {
+  const reply = await getJson(baseUrl, apiKey, ME_PATH, deps);
+  const me = parseMe(reply.body);
+  if (!me) throw unreadableResponse(reply.status);
+  return me;
+}
+
+// src/credentials.ts
+import { randomBytes } from "node:crypto";
+import { constants } from "node:fs";
+import { chmod, lstat, mkdir, open, readdir, rename, stat, unlink } from "node:fs/promises";
+import { dirname, isAbsolute, join } from "node:path";
+var FILE_NAME = "credentials.json";
+var OWNER_ONLY_FILE = 384;
+var OWNER_ONLY_DIR = 448;
+var GROUP_OR_OTHERS = 63;
+var WRITABLE_BY_OTHERS = 18;
+var MAX_FILE_BYTES = 64 * 1024;
+var TEMP_NAME = /^\.credentials\.json\.\d+\.[0-9a-f]{12}\.tmp$/;
+var STALE_TEMP_MS = 6e4;
+var NO_FOLLOW = constants.O_NOFOLLOW ?? 0;
+var NON_BLOCKING = constants.O_NONBLOCK ?? 0;
+var SILENT = () => void 0;
+function nonEmpty3(value) {
+  return value !== void 0 && value.trim() !== "" ? value : void 0;
+}
+function absoluteOnly(value) {
+  return value !== void 0 && isAbsolute(value) ? value : void 0;
+}
+function configDirError(message) {
+  return new CliError({ code: "CLI_CONFIG_DIR_INVALID", exitCode: EXIT.USAGE, message });
+}
+function expandHome(value, io) {
+  if (value === "~") return io.homedir();
+  if (value.startsWith("~/") || io.platform === "win32" && value.startsWith("~\\")) {
+    return join(io.homedir(), value.slice(2));
+  }
+  return value;
+}
+function locate(io) {
+  const chosen = nonEmpty3(io.env.BUKE_CONFIG_DIR);
+  if (chosen !== void 0) {
+    const dir = expandHome(chosen, io);
+    if (!isAbsolute(dir)) {
+      throw configDirError(
+        "BUKE_CONFIG_DIR \u8981\u5199\u7EDD\u5BF9\u8DEF\u5F84\uFF08\u53EF\u4EE5\u7528 ~/ \u5F00\u5934\u8868\u793A\u5BB6\u76EE\u5F55\uFF09\u3002\u76F8\u5BF9\u8DEF\u5F84\u4F1A\u8BA9\u51ED\u636E\u843D\u5728\u5F53\u524D\u76EE\u5F55\u91CC\uFF0C\u6240\u4EE5\u6CA1\u6709\u4F7F\u7528"
+      );
+    }
+    return { dir, ours: false };
+  }
+  const base = absoluteOnly(nonEmpty3(io.env.XDG_CONFIG_HOME)) ?? (io.platform === "win32" ? absoluteOnly(nonEmpty3(io.env.APPDATA)) : void 0);
+  if (base !== void 0) return { dir: join(base, "buke"), ours: true };
+  const home = io.homedir();
+  if (!isAbsolute(home)) {
+    throw configDirError("\u627E\u4E0D\u5230\u5BB6\u76EE\u5F55\uFF0C\u6CA1\u6CD5\u51B3\u5B9A\u51ED\u636E\u4FDD\u5B58\u5728\u54EA\u91CC\u3002\u8BF7\u7528 BUKE_CONFIG_DIR \u6307\u5B9A\u4E00\u4E2A\u7EDD\u5BF9\u8DEF\u5F84");
+  }
+  return { dir: join(home, ".config", "buke"), ours: true };
+}
+function credentialsPath(io) {
+  return join(locate(io).dir, FILE_NAME);
+}
+function errorCode(error) {
+  const code2 = typeof error === "object" && error !== null ? error.code : void 0;
+  return typeof code2 === "string" ? code2 : void 0;
+}
+function systemReason(error) {
+  return briefReason(error).split(", ")[0] ?? "\u539F\u56E0\u4E0D\u660E";
+}
+function isMissing(error) {
+  const code2 = errorCode(error);
+  return code2 === "ENOENT" || code2 === "ENOTDIR";
+}
+async function ensureDir(dir) {
+  await mkdir(dirname(dir), { recursive: true });
+  try {
+    await mkdir(dir, { mode: OWNER_ONLY_DIR });
+    return true;
+  } catch (error) {
+    if (errorCode(error) !== "EEXIST" || !(await stat(dir)).isDirectory()) throw error;
+    return false;
+  }
+}
+async function guardDir(io, { dir, ours }, tighten, warn) {
+  if (io.platform === "win32") return;
+  let mode;
+  try {
+    mode = (await stat(dir)).mode;
+  } catch {
+    return;
+  }
+  if ((mode & GROUP_OR_OTHERS) === 0) return;
+  const exposed = (mode & WRITABLE_BY_OTHERS) !== 0;
+  if (ours && tighten) {
+    try {
+      await chmod(dir, OWNER_ONLY_DIR);
+      if (exposed) warn(`\u4FDD\u5B58\u51ED\u636E\u7684\u76EE\u5F55\u539F\u5148\u522B\u4EBA\u4E5F\u80FD\u5199\uFF0C\u5DF2\u6536\u7D27\u4E3A\u53EA\u6709\u672C\u4EBA\u53EF\u8FDB\u5165\uFF1A${dir}`);
+      return;
+    } catch {
+    }
+  }
+  if (exposed) {
+    warn(`\u4FDD\u5B58\u51ED\u636E\u7684\u76EE\u5F55\u522B\u4EBA\u4E5F\u80FD\u5199\uFF1A${dir}\u3002\u5EFA\u8BAE chmod 700 ${dir}\uFF0C\u6216\u8005\u7528 BUKE_CONFIG_DIR \u6362\u4E00\u4E2A\u53EA\u6709\u672C\u4EBA\u80FD\u5199\u7684\u76EE\u5F55`);
+  }
+}
+async function leftoverTemps(dir) {
+  try {
+    return (await readdir(dir)).filter((name2) => TEMP_NAME.test(name2)).map((name2) => join(dir, name2));
+  } catch {
+    return [];
+  }
+}
+async function sweepStaleTemps(dir) {
+  const cutoff = Date.now() - STALE_TEMP_MS;
+  for (const path of await leftoverTemps(dir)) {
+    try {
+      if ((await lstat(path)).mtimeMs < cutoff) await unlink(path);
+    } catch {
+    }
+  }
+}
+async function writeCredentials(io, credentials, warn = SILENT) {
+  const location = locate(io);
+  const { dir } = location;
+  const path = join(dir, FILE_NAME);
+  const temp = join(dir, `.${FILE_NAME}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`);
+  const content = {
+    version: credentials.version,
+    baseUrl: credentials.baseUrl,
+    apiKey: credentials.apiKey,
+    keyId: credentials.keyId,
+    savedAt: credentials.savedAt
+  };
+  let tempExists = false;
+  try {
+    const created = await ensureDir(dir);
+    if (!created) {
+      await guardDir(io, location, true, warn);
+      await sweepStaleTemps(dir);
+    }
+    const handle = await open(temp, "wx", OWNER_ONLY_FILE);
+    tempExists = true;
+    try {
+      await handle.writeFile(`${JSON.stringify(content, null, 2)}
+`, "utf8");
+    } finally {
+      await handle.close();
+    }
+    await rename(temp, path);
+    tempExists = false;
+    await chmod(path, OWNER_ONLY_FILE);
+    return path;
+  } catch (error) {
+    if (tempExists) await unlink(temp).catch(() => void 0);
+    throw new CliError({
+      code: "CLI_CREDENTIALS_WRITE_FAILED",
+      exitCode: EXIT.SERVER,
+      message: `\u51ED\u636E\u6CA1\u80FD\u4FDD\u5B58\u5230 ${path}\uFF1A${systemReason(error)}`
+    });
+  }
+}
+function unreadable(path) {
+  return new CliError({
+    code: "CLI_CREDENTIALS_UNREADABLE",
+    exitCode: EXIT.SERVER,
+    message: `\u51ED\u636E\u6587\u4EF6\u8BFB\u4E0D\u61C2\uFF1A${path}\u3002\u5220\u6389\u5B83\u540E\u91CD\u65B0 buke login`
+  });
+}
+function cannotRead(path, reason) {
+  return new CliError({
+    code: "CLI_CREDENTIALS_UNREADABLE",
+    exitCode: EXIT.SERVER,
+    message: `\u51ED\u636E\u6587\u4EF6\u8BFB\u4E0D\u4E86\uFF1A${path}\uFF08${reason}\uFF09\u3002\u5220\u6389\u5B83\u540E\u91CD\u65B0 buke login`
+  });
+}
+async function readOwnFile(io, path, warn) {
+  const notRegular = "\u4E0D\u662F\u4E00\u4E2A\u666E\u901A\u6587\u4EF6";
+  if (!(await lstat(path)).isFile()) throw cannotRead(path, notRegular);
+  const handle = await open(path, constants.O_RDONLY | NO_FOLLOW | NON_BLOCKING);
+  try {
+    const info = await handle.stat();
+    if (!info.isFile()) throw cannotRead(path, notRegular);
+    if (info.size > MAX_FILE_BYTES) throw unreadable(path);
+    if (io.platform !== "win32" && (info.mode & GROUP_OR_OTHERS) !== 0) {
+      try {
+        await handle.chmod(OWNER_ONLY_FILE);
+        warn(`\u51ED\u636E\u6587\u4EF6\u7684\u6743\u9650\u8FC7\u5BBD\uFF0C\u5DF2\u6536\u7D27\u4E3A\u53EA\u6709\u672C\u4EBA\u53EF\u8BFB\u5199\uFF1A${path}`);
+      } catch {
+        warn(`\u51ED\u636E\u6587\u4EF6\u7684\u6743\u9650\u8FC7\u5BBD\uFF0C\u6CA1\u80FD\u81EA\u52A8\u6536\u7D27\uFF0C\u8BF7\u624B\u52A8 chmod 600 ${path}`);
+      }
+    }
+    const { buffer, bytesRead } = await handle.read(Buffer.alloc(info.size), 0, info.size, 0);
+    return buffer.subarray(0, bytesRead).toString("utf8");
+  } finally {
+    await handle.close();
+  }
+}
+function parseStored(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const { version: version2, baseUrl, apiKey, keyId, savedAt } = parsed;
+  if (version2 !== 1) return null;
+  if (typeof baseUrl !== "string" || typeof apiKey !== "string") return null;
+  if (typeof keyId !== "string" || typeof savedAt !== "string") return null;
+  try {
+    assertKeyFormat(apiKey);
+    return { version: 1, baseUrl: normalizeBaseUrl(baseUrl), apiKey, keyId, savedAt };
+  } catch {
+    return null;
+  }
+}
+async function readCredentials(io, warn = SILENT) {
+  const location = locate(io);
+  const path = join(location.dir, FILE_NAME);
+  let text;
+  try {
+    text = await readOwnFile(io, path, warn);
+  } catch (error) {
+    if (error instanceof CliError) throw error;
+    if (isMissing(error)) return null;
+    throw cannotRead(path, systemReason(error));
+  }
+  await guardDir(io, location, false, warn);
+  const stored = parseStored(text);
+  if (!stored) throw unreadable(path);
+  return stored;
+}
+async function deleteCredentials(io, warn = SILENT) {
+  const { dir } = locate(io);
+  const path = join(dir, FILE_NAME);
+  let removed = false;
+  try {
+    await unlink(path);
+    removed = true;
+  } catch (error) {
+    if (!isMissing(error)) {
+      throw new CliError({
+        code: "CLI_CREDENTIALS_WRITE_FAILED",
+        exitCode: EXIT.SERVER,
+        message: `\u51ED\u636E\u6587\u4EF6\u6CA1\u80FD\u5220\u9664\uFF1A${path}\uFF08${systemReason(error)}\uFF09`
+      });
+    }
+  }
+  for (const leftover of await leftoverTemps(dir)) {
+    try {
+      await unlink(leftover);
+      removed = true;
+    } catch (error) {
+      if (!isMissing(error)) warn(`\u8FD8\u6709\u4E00\u4E2A\u6CA1\u5199\u5B8C\u7684\u4E34\u65F6\u6587\u4EF6\u6CA1\u80FD\u5220\u9664\uFF0C\u91CC\u9762\u53EF\u80FD\u6709\u5BC6\u94A5\uFF0C\u8BF7\u624B\u52A8\u5220\u9664\uFF1A${leftover}`);
+    }
+  }
+  return removed;
+}
+
+// src/output.ts
+function errorDocument(error) {
+  const document = {
+    error: { code: error.code, message: error.message, retryable: error.retryable, traceId: error.traceId }
+  };
+  if (error.retryAfterSeconds !== void 0) document.error.retryAfterSeconds = error.retryAfterSeconds;
+  if (error.httpStatus !== void 0) document.error.httpStatus = error.httpStatus;
+  return document;
+}
+function errorLines(error) {
+  const details = [`\u9519\u8BEF\u7801 ${singleLine(error.code)}`];
+  if (error.traceId) details.push(`\u8FFD\u8E2A\u7F16\u53F7 ${singleLine(error.traceId)}`);
+  if (error.retryAfterSeconds !== void 0) details.push(`${error.retryAfterSeconds} \u79D2\u540E\u53EF\u4EE5\u91CD\u8BD5`);
+  return [`\u9519\u8BEF\uFF1A${singleLine(error.message)}`, `\uFF08${details.join("\uFF1B")}\uFF09`, ...error.hints];
+}
+function createOutput(streams, json) {
+  const secrets = [];
+  const scrub = (text, keep) => secrets.reduce(redactSecret, redactKeys(text, keep));
+  const toStdout = (text, keep = []) => {
+    streams.stdout.write(scrub(text, keep));
+  };
+  const toStderr = (text) => {
+    streams.stderr.write(scrub(text, []));
+  };
+  let documentWritten = false;
+  return {
+    json,
+    protect(secret) {
+      secrets.push(secret);
+    },
+    result(lines, data, keep = []) {
+      if (!json) {
+        toStdout(`${lines.join("\n")}
+`, keep);
+        return;
+      }
+      toStdout(`${JSON.stringify(data, null, 2)}
+`, keep);
+      documentWritten = true;
+    },
+    notice(line) {
+      toStderr(`${line}
+`);
+    },
+    fail(error) {
+      if (json && !documentWritten) {
+        toStdout(`${JSON.stringify(errorDocument(error), null, 2)}
+`);
+        documentWritten = true;
+        return;
+      }
+      toStderr(`${errorLines(error).join("\n")}
+`);
+    }
+  };
+}
+function identityDocument(baseUrl, me, displayPrefix) {
+  return {
+    baseUrl,
+    key: {
+      id: me.key.id,
+      name: me.key.name,
+      scopes: me.key.scopes,
+      expiresAt: me.key.expiresAt,
+      displayPrefix
+    },
+    account: { id: me.account.id },
+    workspace: { id: me.workspace.id, role: me.workspace.role }
+  };
+}
+function identityLines(me, displayPrefix) {
+  const name2 = singleLine(me.key.name);
+  const prefix = singleLine(displayPrefix);
+  const scopes = me.key.scopes.map(singleLine).filter((scope) => scope !== "");
+  return [
+    name2 === "" ? `\u5BC6\u94A5\uFF1A${prefix}` : `\u5BC6\u94A5\uFF1A${name2}\uFF08${prefix}\uFF09`,
+    `\u5236\u7247\u7A7A\u95F4\uFF1A${singleLine(me.workspace.id)}\uFF08${singleLine(me.workspace.role)}\uFF09`,
+    `\u6743\u9650\uFF1A${scopes.length > 0 ? scopes.join("\u3001") : "\u65E0"}`,
+    `\u6709\u6548\u671F\uFF1A${me.key.expiresAt === null ? "\u957F\u671F\u6709\u6548" : `\u5230 ${singleLine(me.key.expiresAt)} \u4E3A\u6B62`}`
+  ];
+}
+
+// src/commands/login.ts
+async function login({ io, out, baseUrl: flag }) {
+  const explicit = explicitBaseUrl(flag, io.env);
+  const baseUrl = explicit ?? DEFAULT_BASE_URL;
+  credentialsPath(io);
+  assertReachedDirectly(baseUrl, io.env);
+  const fromEnv = flag === void 0 && explicit !== null;
+  const origin = flag !== void 0 ? "\uFF08\u5730\u5740\u6765\u81EA --base-url\uFF09" : fromEnv ? "\uFF08\u5730\u5740\u6765\u81EA\u73AF\u5883\u53D8\u91CF BUKE_BASE_URL\uFF09" : "";
+  if (willPromptForKey(io) || fromEnv && baseUrl !== DEFAULT_BASE_URL) {
+    out.notice(`\u5C06\u767B\u5F55 ${baseUrl}${origin}`);
+  }
+  const { key, source } = await readNewKey(io);
+  out.protect(key);
+  const me = await getMe(baseUrl, key, io);
+  const savedTo = await writeCredentials(
+    io,
+    {
+      version: 1,
+      baseUrl,
+      apiKey: key,
+      keyId: me.key.id,
+      savedAt: (io.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
+    },
+    (line) => out.notice(line)
+  );
+  const displayPrefix = displayPrefixOf(key, me.key.id);
+  const savedLine = io.platform === "win32" ? `\u51ED\u636E\u4FDD\u5B58\u5728 ${savedTo}` : `\u51ED\u636E\u4FDD\u5B58\u5728 ${savedTo}\uFF08\u53EA\u6709\u672C\u4EBA\u53EF\u8BFB\u5199\uFF09`;
+  out.result(
+    [`\u5DF2\u767B\u5F55 ${baseUrl}`, ...identityLines(me, displayPrefix), savedLine],
+    { ...identityDocument(baseUrl, me, displayPrefix), credentialsPath: savedTo },
+    [displayPrefix]
+  );
+  if (source === "env") {
+    out.notice("\u8FD9\u628A\u5BC6\u94A5\u6765\u81EA\u73AF\u5883\u53D8\u91CF BUKE_API_KEY\uFF1B\u5B83\u5DF2\u4FDD\u5B58\u5230\u672C\u673A\uFF0C\u4E4B\u540E\u4E0D\u8BBE\u8FD9\u4E2A\u53D8\u91CF\u4E5F\u80FD\u7528");
+  }
+}
+
+// src/commands/logout.ts
+async function logout({ io, out }) {
+  const removed = await deleteCredentials(io, (line) => out.notice(line));
+  out.result(
+    [removed ? "\u5DF2\u9000\u51FA\u767B\u5F55\uFF0C\u672C\u673A\u4FDD\u5B58\u7684\u5BC6\u94A5\u5DF2\u5220\u9664\u3002\u8FD9\u628A\u5BC6\u94A5\u672C\u8EAB\u4ECD\u7136\u6709\u6548\uFF0C\u8981\u4F5C\u5E9F\u8BF7\u540A\u9500\u5B83" : "\u672C\u673A\u6CA1\u6709\u4FDD\u5B58\u7684\u5BC6\u94A5"],
+    { removed, credentialsPath: credentialsPath(io) }
+  );
+  if (keyFromEnv(io.env) !== null) {
+    out.notice("\u73AF\u5883\u53D8\u91CF BUKE_API_KEY \u8FD8\u8BBE\u7740\uFF0C\u4E4B\u540E\u7684\u547D\u4EE4\u4ECD\u4F1A\u7528\u5B83");
+  }
+}
+
+// src/commands/whoami.ts
+async function resolve({ io, out, baseUrl: flag }) {
+  const explicit = explicitBaseUrl(flag, io.env);
+  const fromEnv = keyFromEnv(io.env);
+  if (fromEnv !== null) {
+    assertKeyFormat(fromEnv);
+    out.protect(fromEnv);
+    return { apiKey: fromEnv, baseUrl: explicit ?? DEFAULT_BASE_URL, source: "env" };
+  }
+  const stored = await readCredentials(io, (line) => out.notice(line));
+  if (!stored) {
+    throw new CliError({
+      code: "CLI_NOT_LOGGED_IN",
+      exitCode: EXIT.AUTH,
+      message: "\u8FD8\u6CA1\u6709\u767B\u5F55\u3002\u5148\u8FD0\u884C buke login\uFF0C\u6216\u8005\u8BBE\u7F6E\u73AF\u5883\u53D8\u91CF BUKE_API_KEY"
+    });
+  }
+  out.protect(stored.apiKey);
+  if (explicit !== null && explicit !== stored.baseUrl) {
+    throw new CliError({
+      code: "CLI_BASE_URL_MISMATCH",
+      exitCode: EXIT.USAGE,
+      message: `\u672C\u673A\u4FDD\u5B58\u7684\u5BC6\u94A5\u662F\u7ED9 ${stored.baseUrl} \u7528\u7684\uFF0C\u4E0D\u4F1A\u53D1\u5230 ${explicit}\u3002\u8981\u6362\u5730\u5740\u8BF7\u91CD\u65B0\u8FD0\u884C buke login --base-url ${explicit}`
+    });
+  }
+  return { apiKey: stored.apiKey, baseUrl: stored.baseUrl, source: "file", credentialsPath: credentialsPath(io) };
+}
+async function whoami(context) {
+  const { io, out } = context;
+  const resolved = await resolve(context);
+  const { apiKey, baseUrl } = resolved;
+  let me;
+  try {
+    me = await getMe(baseUrl, apiKey, io);
+  } catch (error) {
+    if (error instanceof CliError && error.httpStatus === 401) {
+      throw error.withHint(
+        resolved.source === "env" ? "\u8FD9\u628A\u5BC6\u94A5\u6765\u81EA\u73AF\u5883\u53D8\u91CF BUKE_API_KEY\uFF1A\u6362\u4E86\u65B0\u5BC6\u94A5\u7684\u8BDD\uFF0C\u8981\u6539\u7684\u662F\u8FD9\u4E2A\u53D8\u91CF" : "\u5982\u679C\u6362\u4E86\u65B0\u5BC6\u94A5\uFF0C\u91CD\u65B0\u8FD0\u884C buke login"
+      );
+    }
+    throw error;
+  }
+  const displayPrefix = displayPrefixOf(apiKey, me.key.id);
+  const identity = identityDocument(baseUrl, me, displayPrefix);
+  out.result(
+    [
+      `\u5F53\u524D\u767B\u5F55 ${baseUrl}`,
+      ...identityLines(me, displayPrefix),
+      resolved.source === "env" ? "\u5BC6\u94A5\u6765\u81EA\uFF1A\u73AF\u5883\u53D8\u91CF BUKE_API_KEY" : `\u5BC6\u94A5\u6765\u81EA\uFF1A${resolved.credentialsPath}`
+    ],
+    resolved.source === "env" ? { ...identity, source: resolved.source } : { ...identity, source: resolved.source, credentialsPath: resolved.credentialsPath },
+    [displayPrefix]
+  );
+}
+
+// src/cli.ts
+var KEY_HOWTO = [
+  "\u5BC6\u94A5\u600E\u4E48\u7ED9\uFF08\u4E0D\u8981\u5199\u5728\u547D\u4EE4\u884C\u91CC\uFF09\uFF0C\u6309\u987A\u5E8F\u53D6\u7B2C\u4E00\u79CD\uFF1A",
+  "  1. \u73AF\u5883\u53D8\u91CF BUKE_API_KEY",
+  `  2. \u7BA1\u9053\uFF1Aprintf '%s' "$KEY" | buke login`,
+  "  3. \u5728\u7EC8\u7AEF\u91CC\u76F4\u63A5\u8FD0\u884C buke login\uFF0C\u6309\u63D0\u793A\u7C98\u8D34\uFF08\u8F93\u5165\u4E0D\u4F1A\u663E\u793A\uFF09"
+];
+var COMMANDS = {
+  login: {
+    run: login,
+    acceptsBaseUrl: true,
+    help: [
+      "\u7528\u6CD5\uFF1Abuke login [--base-url <\u5730\u5740>] [--json]",
+      "",
+      "\u7528\u4E00\u628A API \u5BC6\u94A5\u767B\u5F55\uFF1A\u5148\u5411\u670D\u52A1\u7AEF\u786E\u8BA4\u8FD9\u628A\u5BC6\u94A5\u53EF\u7528\uFF0C\u518D\u628A\u5B83\u4FDD\u5B58\u5728\u672C\u673A\uFF0C\u4E4B\u540E\u7684\u547D\u4EE4\u4E0D\u7528\u518D\u7ED9\u3002",
+      "\u767B\u5F55\u6CA1\u6210\u529F\u65F6\uFF0C\u672C\u673A\u539F\u6765\u4FDD\u5B58\u7684\u5BC6\u94A5\u4E0D\u53D7\u5F71\u54CD\u3002",
+      "",
+      ...KEY_HOWTO,
+      "",
+      "\u9009\u9879\uFF1A",
+      `  --base-url <\u5730\u5740>   \u670D\u52A1\u5730\u5740\uFF0C\u9ED8\u8BA4 ${DEFAULT_BASE_URL}\uFF1B\u53EA\u5199\u5230\u57DF\u540D\u4E3A\u6B62`,
+      "  --json              \u53EA\u5728\u6807\u51C6\u8F93\u51FA\u6253\u5370\u4E00\u4E2A JSON \u6587\u6863\uFF0C\u65B9\u4FBF\u811A\u672C\u8BFB\u53D6"
+    ].join("\n")
+  },
+  whoami: {
+    run: whoami,
+    acceptsBaseUrl: true,
+    help: [
+      "\u7528\u6CD5\uFF1Abuke whoami [--base-url <\u5730\u5740>] [--json]",
+      "",
+      "\u5411\u670D\u52A1\u7AEF\u786E\u8BA4\u5F53\u524D\u7528\u7684\u662F\u54EA\u628A\u5BC6\u94A5\uFF1A\u5B83\u5C5E\u4E8E\u54EA\u4E2A\u5236\u7247\u7A7A\u95F4\u3001\u6709\u54EA\u4E9B\u6743\u9650\u3001\u4EC0\u4E48\u65F6\u5019\u5230\u671F\u3002",
+      "\u8BBE\u4E86\u73AF\u5883\u53D8\u91CF BUKE_API_KEY \u65F6\u7528\u5B83\uFF0C\u5426\u5219\u7528 buke login \u4FDD\u5B58\u5728\u672C\u673A\u7684\u90A3\u4E00\u628A\u3002",
+      "\u672C\u673A\u4FDD\u5B58\u7684\u5BC6\u94A5\u53EA\u4F1A\u53D1\u5F80\u767B\u5F55\u65F6\u7684\u90A3\u4E2A\u5730\u5740\u3002",
+      "",
+      "\u9009\u9879\uFF1A",
+      "  --base-url <\u5730\u5740>   \u670D\u52A1\u5730\u5740\uFF1B\u4E0D\u7ED9\u65F6\u7528\u767B\u5F55\u65F6\u7684\u5730\u5740",
+      "  --json              \u53EA\u5728\u6807\u51C6\u8F93\u51FA\u6253\u5370\u4E00\u4E2A JSON \u6587\u6863\uFF0C\u65B9\u4FBF\u811A\u672C\u8BFB\u53D6"
+    ].join("\n")
+  },
+  logout: {
+    run: logout,
+    acceptsBaseUrl: false,
+    help: [
+      "\u7528\u6CD5\uFF1Abuke logout [--json]",
+      "",
+      "\u5220\u9664\u672C\u673A\u4FDD\u5B58\u7684\u5BC6\u94A5\u3002\u8FD9\u628A\u5BC6\u94A5\u672C\u8EAB\u4ECD\u7136\u6709\u6548\uFF0C\u8981\u4F5C\u5E9F\u8BF7\u540A\u9500\u5B83\u3002",
+      "",
+      "\u9009\u9879\uFF1A",
+      "  --json              \u53EA\u5728\u6807\u51C6\u8F93\u51FA\u6253\u5370\u4E00\u4E2A JSON \u6587\u6863\uFF0C\u65B9\u4FBF\u811A\u672C\u8BFB\u53D6"
+    ].join("\n")
+  }
+};
+var GENERAL_HELP = [
+  "buke\uFF1A\u300A\u4E0D\u53EF\u601D\u8BAE\u300B\u5F00\u653E\u63A5\u53E3\u7684\u547D\u4EE4\u884C\u5BA2\u6237\u7AEF",
+  "",
+  "\u7528\u6CD5\uFF1A",
+  "  buke login  [--base-url <\u5730\u5740>] [--json]   \u7528\u4E00\u628A API \u5BC6\u94A5\u767B\u5F55\uFF0C\u5E76\u628A\u5B83\u4FDD\u5B58\u5728\u672C\u673A",
+  "  buke whoami [--base-url <\u5730\u5740>] [--json]   \u67E5\u770B\u5F53\u524D\u7528\u7684\u662F\u54EA\u628A\u5BC6\u94A5\u3001\u5C5E\u4E8E\u54EA\u4E2A\u5236\u7247\u7A7A\u95F4",
+  "  buke logout [--json]                       \u9000\u51FA\u767B\u5F55\uFF0C\u5220\u9664\u672C\u673A\u4FDD\u5B58\u7684\u5BC6\u94A5",
+  "  buke --help | -h                           \u663E\u793A\u8FD9\u4EFD\u8BF4\u660E\uFF1Bbuke <\u547D\u4EE4> --help \u770B\u5355\u6761\u547D\u4EE4",
+  "  buke --version | -v                        \u663E\u793A\u7248\u672C\u53F7",
+  "",
+  "\u9009\u9879\uFF1A",
+  `  --base-url <\u5730\u5740>   \u670D\u52A1\u5730\u5740\uFF0C\u9ED8\u8BA4 ${DEFAULT_BASE_URL}\uFF1B\u53EA\u5199\u5230\u57DF\u540D\u4E3A\u6B62`,
+  "  --json              \u53EA\u5728\u6807\u51C6\u8F93\u51FA\u6253\u5370\u4E00\u4E2A JSON \u6587\u6863\uFF0C\u65B9\u4FBF\u811A\u672C\u8BFB\u53D6",
+  "  -h, --help          \u663E\u793A\u8BF4\u660E",
+  "  -v, --version       \u663E\u793A\u7248\u672C\u53F7",
+  "",
+  ...KEY_HOWTO,
+  "",
+  "\u73AF\u5883\u53D8\u91CF\uFF1A",
+  "  BUKE_API_KEY        API \u5BC6\u94A5\uFF1B\u8BBE\u4E86\u5B83\uFF0Clogin \u548C whoami \u90FD\u76F4\u63A5\u7528\u5B83",
+  "  BUKE_BASE_URL       \u670D\u52A1\u5730\u5740\uFF0C\u4F5C\u7528\u540C --base-url",
+  "  BUKE_CONFIG_DIR     \u4FDD\u5B58\u51ED\u636E\u7684\u76EE\u5F55\uFF0C\u8981\u5199\u7EDD\u5BF9\u8DEF\u5F84\u3002\u4E0D\u8BBE\u65F6\u662F $XDG_CONFIG_HOME/buke\uFF1B",
+  "                      \u8FD9\u4E2A\u4E5F\u6CA1\u8BBE\u5C31\u662F ~/.config/buke\uFF08Windows \u4E0A\u662F %APPDATA%\\buke\uFF09",
+  "",
+  "\u9000\u51FA\u7801\uFF1A",
+  "  0     \u6210\u529F",
+  "  2     \u53C2\u6570\u6216\u7528\u6CD5\u4E0D\u5BF9",
+  "  3     \u6CA1\u6709\u767B\u5F55\uFF0C\u6216\u8005\u5BC6\u94A5\u65E0\u6548\u3001\u5DF2\u540A\u9500\u3001\u5DF2\u8FC7\u671F\u3001\u6CA1\u6709\u6743\u9650",
+  "  4     \u4F59\u989D\u6216\u989D\u5EA6\u4E0D\u591F",
+  "  5     \u670D\u52A1\u7AEF\u6216\u7F51\u7EDC\u51FA\u9519\uFF1B\u672C\u673A\u7684\u51ED\u636E\u6587\u4EF6\u8BFB\u4E0D\u4E86\u3001\u5199\u4E0D\u4E86\u4E5F\u662F\u8FD9\u4E2A\u7801",
+  "  6     \u62A5\u4EF7\u53D8\u4E86",
+  "  7     \u8BF7\u6C42\u592A\u9891\u7E41\uFF0C\u7A0D\u540E\u91CD\u8BD5",
+  "  8     \u7B49\u5F85\u8D85\u65F6",
+  "  9     \u4EFB\u52A1\u5931\u8D25",
+  "  10    \u8981\u627E\u7684\u4E1C\u897F\u4E0D\u5B58\u5728",
+  "  130   \u88AB Ctrl-C \u6253\u65AD",
+  "",
+  "\u5F53\u524D\u7248\u672C\u53EA\u6709\u767B\u5F55\u76F8\u5173\u7684\u547D\u4EE4\uFF1B\u4E0B\u5355\u3001\u67E5\u8FDB\u5EA6\u3001\u4E0B\u8F7D\u7B49\u547D\u4EE4\u968F\u5F00\u653E\u63A5\u53E3\u4E0A\u7EBF\u540E\u63D0\u4F9B\u3002"
+].join("\n");
+var MAX_ECHO_LENGTH = 40;
+function echo(item) {
+  return item.length > MAX_ECHO_LENGTH ? `${item.slice(0, MAX_ECHO_LENGTH)}\u2026` : item;
+}
+function parse(argv) {
+  try {
+    const { values, positionals } = parseArgs({
+      args: argv,
+      options: {
+        help: { type: "boolean", short: "h" },
+        version: { type: "boolean", short: "v" },
+        json: { type: "boolean" },
+        "base-url": { type: "string" }
+      },
+      strict: true,
+      allowPositionals: true
+    });
+    return {
+      command: positionals[0],
+      extraPositionals: Math.max(0, positionals.length - 1),
+      help: values.help === true,
+      version: values.version === true,
+      baseUrl: values["base-url"]
+    };
+  } catch (error) {
+    throw usageFromParseError(error);
+  }
+}
+function usageFromParseError(error) {
+  const detail = error;
+  const option = typeof detail.message === "string" ? /'(-{1,2}[A-Za-z0-9-]+)/.exec(detail.message)?.[1] : void 0;
+  if (detail.code === "ERR_PARSE_ARGS_UNKNOWN_OPTION") {
+    return usageError(option ? `\u4E0D\u8BA4\u8BC6\u7684\u9009\u9879 ${echo(option)}` : "\u6709\u4E0D\u8BA4\u8BC6\u7684\u9009\u9879");
+  }
+  if (detail.code === "ERR_PARSE_ARGS_INVALID_OPTION_VALUE") {
+    if (option === "--base-url") return usageError(`--base-url \u540E\u9762\u8981\u8DDF\u4E00\u4E2A\u5730\u5740\uFF0C\u4F8B\u5982 --base-url ${DEFAULT_BASE_URL}`);
+    return usageError(option ? `\u9009\u9879 ${echo(option)} \u540E\u9762\u4E0D\u5E26\u503C` : "\u6709\u9009\u9879\u7684\u5199\u6CD5\u4E0D\u5BF9");
+  }
+  return usageError("\u53C2\u6570\u7684\u5199\u6CD5\u4E0D\u5BF9");
+}
+async function dispatch(argv, io, out) {
+  if (argvContainsKey(argv)) {
+    throw new CliError({
+      code: "CLI_KEY_IN_ARGV",
+      exitCode: EXIT.USAGE,
+      message: "\u5BC6\u94A5\u4E0D\u8981\u5199\u5728\u547D\u4EE4\u884C\u91CC\uFF08\u4F1A\u7559\u5728 shell \u5386\u53F2\u548C\u8FDB\u7A0B\u5217\u8868\u91CC\uFF09\u3002\u8BF7\u7528\u73AF\u5883\u53D8\u91CF BUKE_API_KEY\uFF0C\u6216\u8005\u901A\u8FC7\u7BA1\u9053\u4F20\u7ED9 buke login\u3002\u521A\u624D\u8FD9\u628A\u5982\u679C\u662F\u771F\u7684\uFF0C\u5EFA\u8BAE\u540A\u9500\u540E\u91CD\u5EFA\u3002"
+    });
+  }
+  const parsed = parse(argv);
+  const command = parsed.command !== void 0 && Object.hasOwn(COMMANDS, parsed.command) ? COMMANDS[parsed.command] : void 0;
+  if (parsed.command !== void 0 && !command) throw usageError(`\u4E0D\u8BA4\u8BC6\u7684\u547D\u4EE4 ${echo(parsed.command)}`);
+  if (parsed.extraPositionals > 0) throw usageError(`${parsed.command} \u540E\u9762\u4E0D\u63A5\u522B\u7684\u53C2\u6570`);
+  if (command && !command.acceptsBaseUrl && parsed.baseUrl !== void 0) {
+    throw usageError(`${parsed.command} \u4E0D\u8BA4\u8BC6\u9009\u9879 --base-url`);
+  }
+  if (parsed.help || !command && !parsed.version) {
+    const text = command ? command.help : GENERAL_HELP;
+    out.result([text], { help: text });
+    return;
+  }
+  if (parsed.version) {
+    out.result([`${PACKAGE_NAME}/${VERSION}`], { name: PACKAGE_NAME, version: VERSION });
+    return;
+  }
+  if (command) await command.run({ io, out, baseUrl: parsed.baseUrl });
+}
+async function run(argv, io) {
+  let out;
+  try {
+    out = createOutput(io, argv.includes("--json"));
+    await dispatch(argv, io, out);
+    return EXIT.OK;
+  } catch (error) {
+    const failure = toCliError(error);
+    try {
+      out?.fail(failure);
+    } catch {
+    }
+    return failure.exitCode;
+  }
+}
+
+// src/main.ts
+var SIGNAL_NUMBERS = { SIGHUP: 1, SIGINT: 2, SIGTERM: 15 };
+var outputLost = false;
+for (const stream of [process.stdout, process.stderr]) {
+  stream.on("error", (error) => {
+    if (error.code === "EPIPE" || outputLost) return;
+    outputLost = true;
+    if (stream === process.stdout) process.stderr.write(`\u9519\u8BEF\uFF1A\u7ED3\u679C\u6CA1\u80FD\u5199\u5230\u6807\u51C6\u8F93\u51FA\uFF08${error.code ?? "\u539F\u56E0\u4E0D\u660E"}\uFF09
+`);
+  });
+}
+var interrupt = new AbortController();
+var received;
+for (const name2 of Object.keys(SIGNAL_NUMBERS)) {
+  process.on(name2, () => {
+    if (received !== void 0) process.exit(128 + SIGNAL_NUMBERS[name2]);
+    received = name2;
+    interrupt.abort();
+  });
+}
+var env = process.execArgv.includes("--use-env-proxy") ? { ...process.env, NODE_USE_ENV_PROXY: "1" } : process.env;
+var code = await run(process.argv.slice(2), {
+  env,
+  stdin: process.stdin,
+  stdout: process.stdout,
+  stderr: process.stderr,
+  fetch: globalThis.fetch,
+  homedir,
+  platform: process.platform,
+  signal: interrupt.signal
+});
+function finalCode() {
+  if (received !== void 0 && code === EXIT.INTERRUPTED) return 128 + SIGNAL_NUMBERS[received];
+  return code === EXIT.OK && outputLost ? EXIT.SERVER : code;
+}
+process.exitCode = finalCode();
+var unflushed = 2;
+var leave = () => {
+  unflushed -= 1;
+  if (unflushed === 0) process.exit(finalCode());
+};
+process.stdout.write("", leave);
+process.stderr.write("", leave);