diffcat-cli 0.2.1

package/dist/config-store.d.ts

@@ -0,0 +1,8 @@
+import type { CliConfig, CliProfileConfig } from './types.js';
+export declare function loadConfig(): Promise<CliConfig>;
+export declare function getProfileConfig(profile: string): Promise<CliProfileConfig | null>;
+export declare function saveProfileConfig(profile: string, value: CliProfileConfig | null): Promise<void>;
+export declare function normalizeServer(value: string): string;
+export declare function buildServerUrl(server: string, path: string): string;
+/** 同一配置的刷新令牌轮换必须跨进程串行，避免并发命令触发旧令牌复用撤销。 */
+export declare function withProfileLock<T>(profile: string, action: () => Promise<T>): Promise<T>;

package/dist/config-store.js

@@ -0,0 +1,100 @@
+import { mkdir, open, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+function configPath() {
+    const root = process.env.DIFFCAT_CONFIG_DIR?.trim() || join(homedir(), '.config', 'diffcat');
+    return join(root, 'config.json');
+}
+export async function loadConfig() {
+    try {
+        const parsed = JSON.parse(await readFile(configPath(), 'utf8'));
+        return parsed && typeof parsed === 'object' && parsed.profiles ? parsed : { profiles: {} };
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { profiles: {} };
+        throw new Error(`无法读取 Diffcat CLI 配置：${String(error)}`);
+    }
+}
+export async function getProfileConfig(profile) {
+    return (await loadConfig()).profiles[profile] ?? null;
+}
+export async function saveProfileConfig(profile, value) {
+    const config = await loadConfig();
+    if (value)
+        config.profiles[profile] = value;
+    else
+        delete config.profiles[profile];
+    const target = configPath();
+    await mkdir(dirname(target), { recursive: true, mode: 0o700 });
+    const temporary = `${target}.${process.pid}.tmp`;
+    await writeFile(temporary, `${JSON.stringify(config, null, 2)}\n`, {
+        mode: 0o600,
+    });
+    await rename(temporary, target);
+}
+export function normalizeServer(value) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new Error('服务地址必须是完整的 http(s) URL');
+    }
+    if (!['http:', 'https:'].includes(parsed.protocol)) {
+        throw new Error('服务地址只允许 http 或 https');
+    }
+    parsed.pathname = parsed.pathname.replace(/\/$/, '');
+    parsed.search = '';
+    parsed.hash = '';
+    return parsed.toString().replace(/\/$/, '');
+}
+export function buildServerUrl(server, path) {
+    const normalizedPath = path.startsWith('/') ? path : `/${path}`;
+    return `${normalizeServer(server)}${normalizedPath}`;
+}
+/** 同一配置的刷新令牌轮换必须跨进程串行，避免并发命令触发旧令牌复用撤销。 */
+export async function withProfileLock(profile, action) {
+    const target = configPath();
+    await mkdir(dirname(target), { recursive: true, mode: 0o700 });
+    const safeProfile = encodeURIComponent(profile).slice(0, 128);
+    const lockPath = `${target}.${safeProfile}.lock`;
+    const deadline = Date.now() + 30_000;
+    while (Date.now() < deadline) {
+        let handle;
+        try {
+            handle = await open(lockPath, 'wx', 0o600);
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            await removeStaleLock(lockPath);
+            await delay(100);
+            continue;
+        }
+        try {
+            await handle.writeFile(`${process.pid}\n`);
+            return await action();
+        }
+        finally {
+            await handle.close();
+            await unlink(lockPath).catch(() => undefined);
+        }
+    }
+    throw new Error(`等待 Diffcat 配置 ${profile} 的进程锁超时`);
+}
+async function removeStaleLock(path) {
+    try {
+        const info = await stat(path);
+        if (Date.now() - info.mtimeMs > 5 * 60_000)
+            await unlink(path);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+}
+function delay(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+//# sourceMappingURL=config-store.js.map

package/dist/config-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../src/config-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG1C,SAAS,UAAU;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC7F,OAAO,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAc,CAAC;QAC7E,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC7F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe;IACpD,OAAO,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,KAA8B;IAE9B,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,KAAK;QAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;;QACvC,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACjD,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QACjE,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;IACjB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,IAAY;IACzD,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAChE,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,cAAc,EAAE,CAAC;AACvD,CAAC;AAED,0CAA0C;AAC1C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAI,OAAe,EAAE,MAAwB;IAChF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,WAAW,OAAO,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;YAChC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YAC3C,OAAO,MAAM,MAAM,EAAE,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iBAAiB,OAAO,SAAS,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,MAAM;YAAE,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,YAAoB;IACjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/credential-store.d.ts

@@ -0,0 +1,4 @@
+import type { StoredCredential } from './types.js';
+export declare function loadCredential(account: string): StoredCredential | null;
+export declare function saveCredential(account: string, credential: StoredCredential): void;
+export declare function deleteCredential(account: string): void;

package/dist/credential-store.js

@@ -0,0 +1,37 @@
+import { Entry } from '@napi-rs/keyring';
+const SERVICE_NAME = 'diffcat-cli';
+function assertInteractiveCredentialStore() {
+    if (process.env.CI && process.env.CI !== 'false') {
+        throw new Error('Diffcat CLI 首期不允许在 CI/容器中使用长期授权');
+    }
+}
+function entry(account) {
+    assertInteractiveCredentialStore();
+    return new Entry(SERVICE_NAME, account);
+}
+export function loadCredential(account) {
+    try {
+        const value = entry(account).getPassword();
+        return value ? JSON.parse(value) : null;
+    }
+    catch (error) {
+        throw new Error(`无法访问系统凭据库；Diffcat CLI 不会降级为明文令牌文件：${String(error)}`);
+    }
+}
+export function saveCredential(account, credential) {
+    try {
+        entry(account).setPassword(JSON.stringify(credential));
+    }
+    catch (error) {
+        throw new Error(`无法写入系统凭据库：${String(error)}`);
+    }
+}
+export function deleteCredential(account) {
+    try {
+        entry(account).deletePassword();
+    }
+    catch (error) {
+        throw new Error(`无法删除系统凭据：${String(error)}`);
+    }
+}
+//# sourceMappingURL=credential-store.js.map

package/dist/credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAGzC,MAAM,YAAY,GAAG,aAAa,CAAC;AAEnC,SAAS,gCAAgC;IACvC,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,OAAe;IAC5B,gCAAgC,EAAE,CAAC;IACnC,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAsB,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,UAA4B;IAC1E,IAAI,CAAC;QACH,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,IAAI,CAAC;QACH,KAAK,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,YAAY,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC"}

package/dist/deployment.d.ts

@@ -0,0 +1,5 @@
+export declare const DIFFCAT_PRODUCTION_ENDPOINTS: {
+    readonly api: "https://diffcat-api.howcat.cn";
+    readonly web: "https://diffcat.howcat.cn";
+    readonly mobile: "https://diffcat-mobile.howcat.cn";
+};

package/dist/deployment.js

@@ -0,0 +1,6 @@
+export const DIFFCAT_PRODUCTION_ENDPOINTS = {
+    api: 'https://diffcat-api.howcat.cn',
+    web: 'https://diffcat.howcat.cn',
+    mobile: 'https://diffcat-mobile.howcat.cn',
+};
+//# sourceMappingURL=deployment.js.map

package/dist/deployment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment.js","sourceRoot":"","sources":["../src/deployment.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,GAAG,EAAE,+BAA+B;IACpC,GAAG,EAAE,2BAA2B;IAChC,MAAM,EAAE,kCAAkC;CAClC,CAAC"}

package/dist/device-login.d.ts

@@ -0,0 +1,6 @@
+export declare function loginWithDeviceFlow(input: {
+    profile: string;
+    server: string;
+    capabilities: string[];
+    deviceName?: string;
+}): Promise<unknown>;

package/dist/device-login.js

@@ -0,0 +1,93 @@
+import { hostname } from 'node:os';
+import { buildServerUrl, saveProfileConfig, withProfileLock } from './config-store.js';
+import { saveCredential } from './credential-store.js';
+import { createDpopKeyPair, createDpopProof } from './dpop.js';
+import { DiffcatApiError, errorMessage, parseResponse } from './client.js';
+import { writeProgress } from './output.js';
+export async function loginWithDeviceFlow(input) {
+    const keys = await createDpopKeyPair();
+    const path = '/agent/v1/oauth/device/code';
+    const deviceUrl = buildServerUrl(input.server, path);
+    const proof = await createDpopProof({
+        method: 'POST',
+        htu: deviceUrl,
+        ...keys,
+    });
+    const response = await fetch(deviceUrl, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', DPoP: proof },
+        body: JSON.stringify({
+            client_id: 'diffcat-cli',
+            device_name: input.deviceName?.trim() || `CLI · ${hostname()}`,
+            capabilities: [...new Set(input.capabilities)],
+            constraints: {},
+        }),
+    });
+    const payload = await parseResponse(response);
+    if (!response.ok) {
+        throw new DiffcatApiError(errorMessage(payload, response.status), response.status, payload);
+    }
+    const device = payload;
+    writeProgress(`请在浏览器中授权：${device.verification_uri_complete}`);
+    writeProgress(`授权码：${device.user_code}`);
+    const deadline = Date.now() + device.expires_in * 1000;
+    let intervalMs = Math.max(device.interval, 5) * 1000;
+    while (Date.now() < deadline) {
+        await delay(intervalMs);
+        const tokenPath = '/agent/v1/oauth/token';
+        const tokenUrl = buildServerUrl(input.server, tokenPath);
+        const tokenProof = await createDpopProof({
+            method: 'POST',
+            htu: tokenUrl,
+            ...keys,
+        });
+        const tokenResponse = await fetch(tokenUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', DPoP: tokenProof },
+            body: JSON.stringify({
+                grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                client_id: 'diffcat-cli',
+                device_code: device.device_code,
+            }),
+        });
+        const tokenPayload = await parseResponse(tokenResponse);
+        if (tokenResponse.ok) {
+            const token = tokenPayload;
+            const keyringAccount = input.profile;
+            const credential = {
+                ...keys,
+                refreshToken: token.refresh_token,
+                accessToken: token.access_token,
+                accessExpiresAt: new Date(Date.now() + token.expires_in * 1000).toISOString(),
+                scope: token.scope.split(' ').filter(Boolean),
+                pendingOperations: {},
+            };
+            await withProfileLock(input.profile, async () => {
+                saveCredential(keyringAccount, credential);
+                await saveProfileConfig(input.profile, {
+                    server: input.server,
+                    keyringAccount,
+                });
+            });
+            return {
+                profile: input.profile,
+                server: input.server,
+                authenticated: true,
+                scope: credential.scope,
+            };
+        }
+        const oauthError = tokenPayload;
+        if (oauthError.error === 'authorization_pending')
+            continue;
+        if (oauthError.error === 'slow_down') {
+            intervalMs += 5_000;
+            continue;
+        }
+        throw new DiffcatApiError(errorMessage(tokenPayload, tokenResponse.status), tokenResponse.status, tokenPayload);
+    }
+    throw new Error('设备授权已超时，请重新运行 diffcat auth login');
+}
+function delay(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+//# sourceMappingURL=device-login.js.map

package/dist/device-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-login.js","sourceRoot":"","sources":["../src/device-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAW5C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAKzC;IACC,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,6BAA6B,CAAC;IAC3C,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC;QAClC,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,SAAS;QACd,GAAG,IAAI;KACR,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;QACtC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,IAAI,EAAE,KAAK,EAAE;QAC5D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,SAAS,EAAE,aAAa;YACxB,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,SAAS,QAAQ,EAAE,EAAE;YAC9D,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC9C,WAAW,EAAE,EAAE;SAChB,CAAC;KACH,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,eAAe,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,MAAM,GAAG,OAA6B,CAAC;IAC7C,aAAa,CAAC,YAAY,MAAM,CAAC,yBAAyB,EAAE,CAAC,CAAC;IAC9D,aAAa,CAAC,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;IACvD,IAAI,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IACrD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;QACxB,MAAM,SAAS,GAAG,uBAAuB,CAAC;QAC1C,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC;YACvC,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,QAAQ;YACb,GAAG,IAAI;SACR,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU,EAAE;YACjE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,8CAA8C;gBAC1D,SAAS,EAAE,aAAa;gBACxB,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC;SACH,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;QACxD,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,YAAkC,CAAC;YACjD,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC;YACrC,MAAM,UAAU,GAAqB;gBACnC,GAAG,IAAI;gBACP,YAAY,EAAE,KAAK,CAAC,aAAa;gBACjC,WAAW,EAAE,KAAK,CAAC,YAAY;gBAC/B,eAAe,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;gBAC7E,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC7C,iBAAiB,EAAE,EAAE;aACtB,CAAC;YACF,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;gBAC9C,cAAc,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;gBAC3C,MAAM,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE;oBACrC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,cAAc;iBACf,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,aAAa,EAAE,IAAI;gBACnB,KAAK,EAAE,UAAU,CAAC,KAAK;aACxB,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,YAAuC,CAAC;QAC3D,IAAI,UAAU,CAAC,KAAK,KAAK,uBAAuB;YAAE,SAAS;QAC3D,IAAI,UAAU,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YACrC,UAAU,IAAI,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,YAAY,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,EAChD,aAAa,CAAC,MAAM,EACpB,YAAY,CACb,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,KAAK,CAAC,YAAoB;IACjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/dpop.d.ts

@@ -0,0 +1,12 @@
+import { type JWK } from 'jose';
+export declare function createDpopKeyPair(): Promise<{
+    privateJwk: JWK;
+    publicJwk: JWK;
+}>;
+export declare function createDpopProof(input: {
+    method: string;
+    htu: string;
+    privateJwk: JWK;
+    publicJwk: JWK;
+    accessToken?: string;
+}): Promise<string>;

package/dist/dpop.js

@@ -0,0 +1,25 @@
+import { SignJWT, exportJWK, generateKeyPair, importJWK } from 'jose';
+import { createHash, randomUUID } from 'node:crypto';
+export async function createDpopKeyPair() {
+    const pair = await generateKeyPair('ES256', { extractable: true });
+    return {
+        privateJwk: await exportJWK(pair.privateKey),
+        publicJwk: await exportJWK(pair.publicKey),
+    };
+}
+export async function createDpopProof(input) {
+    const key = await importJWK(input.privateJwk, 'ES256');
+    const claims = {
+        htm: input.method.toUpperCase(),
+        htu: input.htu,
+        iat: Math.floor(Date.now() / 1000),
+        jti: randomUUID(),
+    };
+    if (input.accessToken) {
+        claims.ath = createHash('sha256').update(input.accessToken, 'utf8').digest('base64url');
+    }
+    return new SignJWT(claims)
+        .setProtectedHeader({ typ: 'dpop+jwt', alg: 'ES256', jwk: input.publicJwk })
+        .sign(key);
+}
+//# sourceMappingURL=dpop.js.map

package/dist/dpop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpop.js","sourceRoot":"","sources":["../src/dpop.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAY,MAAM,MAAM,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,CAAC,KAAK,UAAU,iBAAiB;IAIrC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,OAAO;QACL,UAAU,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAC5C,SAAS,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAMrC;IACC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,MAAM,GAAoC;QAC9C,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;QAC/B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClC,GAAG,EAAE,UAAU,EAAE;KAClB,CAAC;IACF,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,kBAAkB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;SAC3E,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,296 @@
+#!/usr/bin/env node
+import { Command, Option } from 'commander';
+import { spawnSync } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { buildServerUrl, normalizeServer, getProfileConfig, saveProfileConfig, withProfileLock, } from './config-store.js';
+import { deleteCredential, loadCredential } from './credential-store.js';
+import { DiffcatClient, errorMessage, parseResponse } from './client.js';
+import { DIFFCAT_PRODUCTION_ENDPOINTS } from './deployment.js';
+import { loginWithDeviceFlow } from './device-login.js';
+import { parseJsonInput } from './json-input.js';
+import { writeJson } from './output.js';
+const packageVersion = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
+const program = new Command()
+    .name('diffcat')
+    .description('以最小授权调用 Diffcat 已登记能力')
+    .version(packageVersion)
+    .option('-p, --profile <name>', '凭据配置名称', 'default')
+    .option('--pretty', '格式化 JSON 输出', false)
+    .showSuggestionAfterError();
+function globals() {
+    return program.opts();
+}
+function collect(value, previous) {
+    return [...previous, value];
+}
+async function client() {
+    return DiffcatClient.load(globals().profile);
+}
+async function publicCatalog(server) {
+    const response = await fetch(buildServerUrl(server, '/agent/v1/oauth/capabilities'));
+    const payload = await parseResponse(response);
+    if (!response.ok)
+        throw new Error(errorMessage(payload, response.status));
+    return payload;
+}
+function output(value) {
+    writeJson(value, globals().pretty);
+}
+const setup = program.command('setup').description('安装或修复 AI 客户端集成');
+setup
+    .command('codex')
+    .description('从当前 npm 包登记随附的 Codex Plugin 与 Companion Skill')
+    .action(() => {
+    const installer = fileURLToPath(new URL('../scripts/codex-plugin.mjs', import.meta.url));
+    const result = spawnSync(process.execPath, [installer, 'install', '--json'], {
+        stdio: 'inherit',
+        windowsHide: true,
+    });
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0)
+        process.exitCode = result.status ?? 1;
+});
+const auth = program.command('auth').description('登录与凭据管理');
+auth
+    .command('login')
+    .description('通过 OAuth Device Flow 请求用户授权')
+    .option('--server <url>', 'Diffcat API 根地址', DIFFCAT_PRODUCTION_ENDPOINTS.api)
+    .addOption(new Option('-c, --capability <id>', '请求的能力，可重复').argParser(collect).default([]))
+    .addOption(new Option('--preset <id>', '请求服务端能力预设，可重复').argParser(collect).default([]))
+    .option('--device-name <name>', '授权页显示的设备名称')
+    .action(async (options) => {
+    const server = normalizeServer(options.server);
+    const requested = new Set(options.capability);
+    if (options.preset.length > 0) {
+        const catalog = await publicCatalog(server);
+        for (const presetId of options.preset) {
+            const preset = catalog.presets.find((item) => item.id === presetId);
+            if (!preset)
+                throw new Error(`未知能力预设：${presetId}`);
+            for (const id of preset.capabilityIds)
+                requested.add(id);
+        }
+    }
+    if (requested.size === 0) {
+        throw new Error('至少提供一个 --capability 或 --preset；CLI 不会默认申请整组权限');
+    }
+    output(await loginWithDeviceFlow({
+        profile: globals().profile,
+        server,
+        capabilities: [...requested],
+        deviceName: options.deviceName,
+    }));
+});
+auth
+    .command('status')
+    .description('验证当前授权并显示能力范围')
+    .action(async () => {
+    const api = await client();
+    const capabilities = await api.post('/agent/v1/capabilities/list', {});
+    output({ ...api.getStatus(), capabilities: capabilities.list });
+});
+auth
+    .command('logout')
+    .description('撤销当前授权并删除系统凭据')
+    .action(async () => {
+    const profile = globals().profile;
+    const config = await getProfileConfig(profile);
+    if (!config) {
+        output({ profile, authenticated: false, revoked: false });
+        return;
+    }
+    const credential = loadCredential(config.keyringAccount);
+    if (credential) {
+        await withProfileLock(profile, async () => {
+            const latest = loadCredential(config.keyringAccount);
+            if (!latest)
+                return;
+            const response = await fetch(buildServerUrl(config.server, '/agent/v1/oauth/revoke'), {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    token: latest.refreshToken,
+                    client_id: 'diffcat-cli',
+                }),
+            });
+            const payload = await parseResponse(response);
+            if (!response.ok)
+                throw new Error(errorMessage(payload, response.status));
+            deleteCredential(config.keyringAccount);
+        });
+    }
+    await saveProfileConfig(profile, null);
+    output({ profile, authenticated: false, revoked: true });
+});
+const grant = program.command('grant').description('查看或撤销当前 CLI 授权');
+grant
+    .command('list')
+    .description('查看当前 DPoP 授权')
+    .action(async () => output(await (await client()).post('/agent/v1/grant/current', {})));
+grant
+    .command('revoke')
+    .description('撤销当前 DPoP 授权')
+    .action(async () => {
+    const api = await client();
+    const result = await api.post('/agent/v1/grant/revoke', {});
+    const config = await getProfileConfig(globals().profile);
+    if (config) {
+        deleteCredential(config.keyringAccount);
+        await saveProfileConfig(globals().profile, null);
+    }
+    output(result);
+});
+const capability = program.command('capability').description('能力发现与通用调用');
+capability
+    .command('list')
+    .action(async () => output(await (await client()).post('/agent/v1/capabilities/list', {})));
+capability
+    .command('describe <id>')
+    .action(async (id) => output(await (await client()).get('/agent/v1/capabilities/detail', { id })));
+capability
+    .command('invoke <id>')
+    .requiredOption('--input <json|@file|->', 'JSON 对象、@文件或 -（stdin）')
+    .option('--idempotency-key <key>', '显式幂等键')
+    .action(async (id, options) => {
+    output(await (await client()).invoke(id, await parseJsonInput(options.input), {
+        idempotencyKey: options.idempotencyKey,
+    }));
+});
+capability
+    .command('catalog')
+    .description('登录前查看服务端完整能力目录、分组与预设')
+    .option('--server <url>', 'Diffcat API 根地址', DIFFCAT_PRODUCTION_ENDPOINTS.api)
+    .action(async (options) => output(await publicCatalog(normalizeServer(options.server))));
+const resource = program.command('resource').description('通用基础资料查询');
+resource
+    .command('list <resource>')
+    .option('--query <json|@file|->', '列表筛选 JSON', '{}')
+    .action(async (resourceName, options) => output(await (await client()).invoke(`${resourceName}.read`, {
+    action: 'list',
+    query: await parseJsonInput(options.query),
+})));
+resource
+    .command('get <resource> <id>')
+    .addOption(new Option('--include <field>', '附加关系字段，可重复').argParser(collect).default([]))
+    .action(async (resourceName, id, options) => output(await (await client()).invoke(`${resourceName}.read`, {
+    action: 'get',
+    id,
+    ...(options.include.length ? { include: options.include } : {}),
+})));
+const document = program.command('document').description('通用业务单据查询与草稿新建');
+document
+    .command('list <resource>')
+    .option('--query <json|@file|->', '列表筛选 JSON', '{}')
+    .action(async (resourceName, options) => output(await (await client()).invoke(`${resourceName}.read`, {
+    action: 'list',
+    query: await parseJsonInput(options.query),
+})));
+document
+    .command('get <resource> <id>')
+    .addOption(new Option('--include <field>', '附加关系字段，可重复').argParser(collect).default([]))
+    .action(async (resourceName, id, options) => output(await (await client()).invoke(`${resourceName}.read`, {
+    action: 'get',
+    id,
+    ...(options.include.length ? { include: options.include } : {}),
+})));
+document
+    .command('create-draft <resource>')
+    .requiredOption('--input <json|@file|->', '单据草稿 JSON')
+    .option('--idempotency-key <key>', '显式幂等键')
+    .action(async (resourceName, options) => output(await (await client()).invoke(`${resourceName}.create_draft`, await parseJsonInput(options.input), {
+    idempotencyKey: options.idempotencyKey,
+})));
+const project = program.command('project').description('项目查询');
+project
+    .command('list')
+    .option('--query <json|@file|->', '列表筛选 JSON', '{}')
+    .action(async (options) => output(await (await client()).invoke('pm.projects.read', {
+    action: 'list',
+    query: await parseJsonInput(options.query),
+})));
+project
+    .command('get <id>')
+    .action(async (id) => output(await (await client()).invoke('pm.projects.read', { action: 'get', id })));
+const salesOrder = program.command('sales-order').description('销售订单查询与草稿创建');
+salesOrder
+    .command('list')
+    .option('--query <json|@file|->', '列表筛选 JSON', '{}')
+    .action(async (options) => output(await (await client()).invoke('sales.orders.read', {
+    action: 'list',
+    query: await parseJsonInput(options.query),
+})));
+salesOrder
+    .command('get <id>')
+    .action(async (id) => output(await (await client()).invoke('sales.orders.read', { action: 'get', id })));
+salesOrder
+    .command('create-draft')
+    .requiredOption('--input <json|@file|->', '销售订单草稿 JSON')
+    .option('--idempotency-key <key>', '显式幂等键')
+    .action(async (options) => output(await (await client()).invoke('sales.orders.create_draft', await parseJsonInput(options.input), {
+    idempotencyKey: options.idempotencyKey,
+})));
+const stats = program.command('stats').description('数据中心统计查询');
+stats
+    .command('list')
+    .option('--role-id <id>', '目标角色；缺省为当前角色')
+    .action(async (options) => output(await (await client()).invoke('data_center.stats.read', {
+    action: 'list',
+    ...(options.roleId ? { roleId: options.roleId } : {}),
+})));
+stats
+    .command('query')
+    .requiredOption('--input <json|@file|->', '{ roleId, widgets } JSON')
+    .action(async (options) => output(await (await client()).invoke('data_center.stats.read', {
+    action: 'query',
+    ...(await parseJsonInput(options.input)),
+})));
+const task = program.command('task').description('流程任务查询与审批');
+task
+    .command('list')
+    .option('--query <json|@file|->', '任务筛选 JSON', '{}')
+    .action(async (options) => output(await (await client()).invoke('flow.tasks.read', {
+    action: 'list',
+    query: await parseJsonInput(options.query),
+})));
+task
+    .command('get <id>')
+    .action(async (id) => output(await (await client()).invoke('flow.tasks.read', { action: 'get', id })));
+task
+    .command('approve <id>')
+    .option('--comment <text>', '审批意见')
+    .option('--idempotency-key <key>', '显式幂等键')
+    .action(async (id, options) => output(await (await client()).invoke('flow.tasks.approve', {
+    taskId: id,
+    ...(options.comment ? { comment: options.comment } : {}),
+}, { idempotencyKey: options.idempotencyKey })));
+const operation = program.command('operation').description('高风险操作恢复与状态查询');
+operation
+    .command('status <id>')
+    .action(async (id) => output(await (await client()).get('/agent/v1/operations/status', { id })));
+operation
+    .command('resume <id>')
+    .description('用户网页确认后继续执行本地凭据库中的待处理操作')
+    .action(async (id) => {
+    const api = await client();
+    const pending = api.getPendingOperation(id);
+    if (!pending)
+        throw new Error(`系统凭据库中没有操作 ${id} 的待执行输入`);
+    output(await api.invoke(pending.capabilityId, pending.input, {
+        operationId: id,
+        idempotencyKey: pending.idempotencyKey,
+    }));
+});
+program.addHelpText('after', `\n示例:\n  diffcat auth login -c pm.projects.read\n  diffcat project list --query '{"pageSize":20}'\n  diffcat capability invoke flow.tasks.read --input '{"action":"list"}'\n`);
+program.parseAsync().catch((error) => {
+    writeJson({
+        success: false,
+        error: error instanceof Error ? error.name : 'Error',
+        message: error instanceof Error ? error.message : String(error),
+        requestId: randomUUID(),
+    }, globals().pretty);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=index.js.map