e10-ebuilder-prototype 0.5.0

package/dist/vendor/environment-auth.d.ts

@@ -0,0 +1,61 @@
+export type EnvironmentAuthStatus = {
+    authenticated: boolean;
+    status: 'missing' | 'invalid' | 'expired' | 'tenant-unavailable' | 'authenticated';
+    baseUrl?: string;
+    userId?: string;
+    tenantKey?: string;
+    profile?: string;
+};
+export type E10AuthContext = {
+    baseUrl: string;
+    userId: string;
+    tenantKey: string;
+    eteamsId: string;
+};
+export type EnvironmentAuthProfile = {
+    name: string;
+    active: boolean;
+    configured: boolean;
+};
+export type EnvironmentAuthPaths = {
+    stateRoot: string;
+    authRoot: string;
+    profilesDir: string;
+    activeProfileFile: string;
+    keyFile: string;
+};
+export declare class E10LoginRequiredError extends Error {
+    readonly authStatus: EnvironmentAuthStatus['status'];
+    readonly code = "E10_LOGIN_REQUIRED";
+    constructor(authStatus?: EnvironmentAuthStatus['status'], message?: string);
+}
+export declare function productStateRoot(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, homeDirectory?: string): string;
+export declare function environmentAuthPaths(env?: NodeJS.ProcessEnv): EnvironmentAuthPaths;
+export declare function normalizeEnvironmentBaseUrl(value: string): string;
+export declare function profileNameFromUrl(baseUrl: string): string;
+export declare function readActiveEnvironmentAuthProfile(env?: NodeJS.ProcessEnv): string | undefined;
+export declare function readEnvironmentAuthContext(_statePath?: string, env?: NodeJS.ProcessEnv): E10AuthContext;
+export declare function readEnvironmentAuthStatus(_statePath?: string, env?: NodeJS.ProcessEnv): EnvironmentAuthStatus;
+export declare const readEnvironmentAuthStatusSync: typeof readEnvironmentAuthStatus;
+export declare function readTaskEnvironmentAuthStatus(_projectDir: string, env?: NodeJS.ProcessEnv): EnvironmentAuthStatus;
+export declare const readTaskEnvironmentAuthStatusSync: typeof readTaskEnvironmentAuthStatus;
+export declare function setEnvironmentAuth(options: {
+    baseUrl: string;
+    eteamsId: string;
+    fetchImpl?: typeof fetch;
+    env?: NodeJS.ProcessEnv;
+}): Promise<{
+    profile: string;
+    baseUrl: string;
+    userId: string;
+    tenantKey: string;
+}>;
+export declare function verifyEnvironmentAuth(options?: {
+    fetchImpl?: typeof fetch;
+    env?: NodeJS.ProcessEnv;
+}): Promise<EnvironmentAuthStatus>;
+export declare function listEnvironmentAuthProfiles(env?: NodeJS.ProcessEnv): EnvironmentAuthProfile[];
+export declare function useEnvironmentAuthProfile(name: string, env?: NodeJS.ProcessEnv): E10AuthContext;
+export declare function assertEnvironmentForDataAccess(requestedBaseUrl?: string, _statePath?: string, authContext?: E10AuthContext): EnvironmentAuthStatus;
+export declare function assertEnvironmentAuth(status: EnvironmentAuthStatus): void;
+export declare function environmentAuthGuidance(_statusOrNext: EnvironmentAuthStatus | string, _requestedBaseUrl?: string): string[];

package/dist/vendor/environment-auth.js

@@ -0,0 +1,455 @@
+import { productStateRoot as sharedStateRoot, renameWithRetrySync, reservedWindowsName, environmentValue, } from '../runtime-support.mjs';
+// Adapted from ui-code-agent environment-auth.ts (local 0.1.63), 2026-09-11.
+import { createCipheriv, createDecipheriv, randomBytes, timingSafeEqual } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync, } from 'node:fs';
+import { createRequire } from 'node:module';
+import os from 'node:os';
+import path from 'node:path';
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12;
+const TAG_LENGTH = 16;
+// Stable storage identity preserves authentication across the product rename.
+const KEYCHAIN_SERVICE = 'e10-page-capture';
+const KEYCHAIN_ACCOUNT = 'auth-key';
+const AUTH_TIMEOUT_MS = 30_000;
+const PROFILE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+const require = createRequire(import.meta.url);
+const keyCache = new Map();
+export class E10LoginRequiredError extends Error {
+    authStatus;
+    code = 'E10_LOGIN_REQUIRED';
+    constructor(authStatus = 'missing', message = 'e10-ebuilder-prototype 尚未配置可用的 E10 认证') {
+        super(message);
+        this.authStatus = authStatus;
+        this.name = 'E10LoginRequiredError';
+    }
+}
+export function productStateRoot(env = process.env, platform = process.platform, homeDirectory = os.homedir()) {
+    return sharedStateRoot(env, platform, homeDirectory);
+}
+export function environmentAuthPaths(env = process.env) {
+    const stateRoot = productStateRoot(env);
+    const authRoot = path.join(stateRoot, 'auth');
+    return {
+        stateRoot,
+        authRoot,
+        profilesDir: path.join(authRoot, 'profiles'),
+        activeProfileFile: path.join(authRoot, 'profile'),
+        keyFile: path.join(authRoot, '.key'),
+    };
+}
+export function normalizeEnvironmentBaseUrl(value) {
+    try {
+        const url = new URL(value.trim());
+        if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password)
+            throw new Error();
+        return url.origin;
+    }
+    catch {
+        throw new Error('E10 环境地址必须是有效且不含账号密码的 http/https URL');
+    }
+}
+function validIdentity(value) {
+    return (typeof value === 'string' &&
+        Boolean(value.trim()) &&
+        value.length <= 1024 &&
+        !/[\r\n]/u.test(value));
+}
+function normalizeEteamsId(value) {
+    const normalized = value.trim();
+    if (!normalized || normalized.length > 8192 || /[\s;]/u.test(normalized)) {
+        throw new Error('ETEAMSID 格式无效');
+    }
+    return normalized;
+}
+function secureDirectory(directory) {
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    try {
+        chmodSync(directory, 0o700);
+    }
+    catch {
+        // Windows does not implement POSIX permission bits.
+    }
+}
+function atomicWrite(filename, content, mode = 0o600) {
+    secureDirectory(path.dirname(filename));
+    const temporary = `${filename}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`;
+    try {
+        writeFileSync(temporary, content, { encoding: 'utf8', mode, flag: 'wx' });
+        renameWithRetrySync(temporary, filename);
+        try {
+            chmodSync(filename, mode);
+        }
+        catch {
+            // Windows does not implement POSIX permission bits.
+        }
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
+}
+function validKey(value) {
+    if (!value || !/^[A-Za-z0-9+/=]{40,}$/u.test(value))
+        return undefined;
+    const key = Buffer.from(value, 'base64');
+    return key.length === 32 ? key : undefined;
+}
+function fileEncryptionKey(paths) {
+    if (existsSync(paths.keyFile)) {
+        try {
+            const stored = validKey(readFileSync(paths.keyFile, 'utf8').trim());
+            if (stored)
+                return stored;
+        }
+        catch {
+            // Replace malformed fallback state with a new key.
+        }
+    }
+    const fresh = randomBytes(32);
+    atomicWrite(paths.keyFile, `${fresh.toString('base64')}\n`);
+    return fresh;
+}
+function keychainEncryptionKey() {
+    try {
+        const module = require('@napi-rs/keyring');
+        const entry = new module.Entry(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+        let stored = null;
+        try {
+            stored = entry.getPassword();
+        }
+        catch {
+            // A missing keychain entry is expected on first use.
+        }
+        const existing = validKey(stored);
+        if (existing)
+            return existing;
+        const fresh = randomBytes(32);
+        entry.setPassword(fresh.toString('base64'));
+        return fresh;
+    }
+    catch {
+        return undefined;
+    }
+}
+function encryptionKey(env = process.env) {
+    const paths = environmentAuthPaths(env);
+    const cached = keyCache.get(paths.authRoot);
+    if (cached)
+        return cached;
+    const key = environmentValue(env, 'E10_PAGE_CAPTURE_HOME')?.trim()
+        ? undefined
+        : keychainEncryptionKey();
+    const resolved = key ?? fileEncryptionKey(paths);
+    keyCache.set(paths.authRoot, resolved);
+    return resolved;
+}
+function encryptAuth(data, env = process.env) {
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, encryptionKey(env), iv, {
+        authTagLength: TAG_LENGTH,
+    });
+    const encrypted = Buffer.concat([cipher.update(JSON.stringify(data), 'utf8'), cipher.final()]);
+    return {
+        enc: true,
+        v: 1,
+        data: Buffer.concat([iv, encrypted, cipher.getAuthTag()]).toString('base64'),
+    };
+}
+function decryptAuth(wrapper, env = process.env) {
+    try {
+        const combined = Buffer.from(wrapper.data, 'base64');
+        if (combined.length < IV_LENGTH + TAG_LENGTH + 1)
+            return undefined;
+        const iv = combined.subarray(0, IV_LENGTH);
+        const tag = combined.subarray(combined.length - TAG_LENGTH);
+        const encrypted = combined.subarray(IV_LENGTH, combined.length - TAG_LENGTH);
+        const decipher = createDecipheriv(ALGORITHM, encryptionKey(env), iv, {
+            authTagLength: TAG_LENGTH,
+        });
+        decipher.setAuthTag(tag);
+        return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString('utf8');
+    }
+    catch {
+        return undefined;
+    }
+}
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function profileName(value) {
+    const normalized = value.trim();
+    if (!PROFILE_PATTERN.test(normalized)) {
+        throw new Error('Profile 名称只能包含字母、数字、点、下划线和连字符');
+    }
+    return normalized;
+}
+export function profileNameFromUrl(baseUrl) {
+    const host = new URL(normalizeEnvironmentBaseUrl(baseUrl)).hostname;
+    const parts = host.split('.').filter(Boolean);
+    const candidate = parts.length >= 2 ? parts.at(-2) : host;
+    const normalized = candidate.replace(/[^A-Za-z0-9._-]/gu, '-').slice(0, 64);
+    return profileName(reservedWindowsName(normalized) ? `env-${normalized}` : normalized || 'default');
+}
+function profilePaths(name, env = process.env) {
+    const directory = path.join(environmentAuthPaths(env).profilesDir, profileName(name));
+    return {
+        directory,
+        authFile: path.join(directory, 'auth'),
+        configFile: path.join(directory, 'config.json'),
+    };
+}
+export function readActiveEnvironmentAuthProfile(env = process.env) {
+    const filename = environmentAuthPaths(env).activeProfileFile;
+    if (!existsSync(filename))
+        return undefined;
+    try {
+        return profileName(readFileSync(filename, 'utf8').trim());
+    }
+    catch {
+        throw new E10LoginRequiredError('invalid', '当前 E10 Profile 状态无效');
+    }
+}
+function validateStoredAuth(value) {
+    const record = asRecord(value);
+    const cookies = asRecord(record?.cookies);
+    const eteamsId = typeof cookies?.ETEAMSID === 'string' ? normalizeEteamsId(cookies.ETEAMSID) : '';
+    const userId = validIdentity(record?.userId) ? record.userId.trim() : '';
+    const tenantKey = validIdentity(record?.tenantKey) ? record.tenantKey.trim() : '';
+    const baseUrl = typeof record?.baseUrl === 'string' ? normalizeEnvironmentBaseUrl(record.baseUrl) : '';
+    const passportUrl = typeof record?.passportUrl === 'string'
+        ? normalizeEnvironmentBaseUrl(record.passportUrl)
+        : baseUrl;
+    if (!eteamsId || !userId || !tenantKey || !baseUrl) {
+        throw new E10LoginRequiredError('invalid', '当前 E10 Profile 认证数据无效');
+    }
+    return { cookies: { ETEAMSID: eteamsId }, userId, tenantKey, baseUrl, passportUrl };
+}
+function readStoredAuth(name, env = process.env) {
+    const filename = profilePaths(name, env).authFile;
+    if (!existsSync(filename))
+        throw new E10LoginRequiredError('missing');
+    try {
+        const wrapper = asRecord(JSON.parse(readFileSync(filename, 'utf8')));
+        if (wrapper?.enc !== true || wrapper.v !== 1 || typeof wrapper.data !== 'string') {
+            throw new Error();
+        }
+        const plaintext = decryptAuth(wrapper, env);
+        if (!plaintext)
+            throw new Error();
+        return validateStoredAuth(JSON.parse(plaintext));
+    }
+    catch (error) {
+        if (error instanceof E10LoginRequiredError)
+            throw error;
+        throw new E10LoginRequiredError('invalid', '当前 E10 Profile 无法读取或解密');
+    }
+}
+function writeActiveProfile(name, env = process.env) {
+    atomicWrite(environmentAuthPaths(env).activeProfileFile, `${profileName(name)}\n`);
+}
+function saveStoredAuth(name, data, env = process.env) {
+    const files = profilePaths(name, env);
+    secureDirectory(files.directory);
+    atomicWrite(files.authFile, `${JSON.stringify(encryptAuth(data, env))}\n`);
+    atomicWrite(files.configFile, `${JSON.stringify({
+        baseUrl: data.baseUrl,
+        passportUrl: data.passportUrl,
+        tenantKey: data.tenantKey,
+    }, null, 2)}\n`);
+    writeActiveProfile(name, env);
+}
+export function readEnvironmentAuthContext(_statePath, env = process.env) {
+    const active = readActiveEnvironmentAuthProfile(env);
+    if (!active)
+        throw new E10LoginRequiredError('missing');
+    const data = readStoredAuth(active, env);
+    return {
+        baseUrl: data.baseUrl,
+        userId: data.userId,
+        tenantKey: data.tenantKey,
+        eteamsId: data.cookies.ETEAMSID,
+    };
+}
+export function readEnvironmentAuthStatus(_statePath, env = process.env) {
+    try {
+        const profile = readActiveEnvironmentAuthProfile(env);
+        const auth = readEnvironmentAuthContext(undefined, env);
+        return { authenticated: true, status: 'authenticated', profile, ...auth };
+    }
+    catch (error) {
+        return {
+            authenticated: false,
+            status: error instanceof E10LoginRequiredError ? error.authStatus : 'invalid',
+        };
+    }
+}
+export const readEnvironmentAuthStatusSync = readEnvironmentAuthStatus;
+export function readTaskEnvironmentAuthStatus(_projectDir, env = process.env) {
+    return readEnvironmentAuthStatus(undefined, env);
+}
+export const readTaskEnvironmentAuthStatusSync = readTaskEnvironmentAuthStatus;
+function nestedString(record, pathParts) {
+    let cursor = record;
+    for (const part of pathParts)
+        cursor = asRecord(cursor)?.[part];
+    return validIdentity(cursor) ? cursor.trim() : '';
+}
+function responseFailed(payload) {
+    if (payload.success === false || payload.status === false || payload.fail === true)
+        return true;
+    const code = payload.code ?? payload.statusCode;
+    return code !== undefined && !['0', '200'].includes(String(code));
+}
+function responseMessage(payload) {
+    const message = payload.msg ?? payload.message;
+    return validIdentity(message) ? message.trim().slice(0, 300) : '';
+}
+async function queryAuthIdentity(baseUrl, eteamsId, fetchImpl = fetch) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), AUTH_TIMEOUT_MS);
+    let response;
+    try {
+        const endpoint = new URL('/api/baseserver/layout/teamsCheck', baseUrl);
+        endpoint.search = new URLSearchParams({
+            clientType: 'not_xinchuang',
+            client: 'WEB',
+            domainName: baseUrl,
+        }).toString();
+        response = await fetchImpl(endpoint, {
+            method: 'POST',
+            headers: {
+                accept: 'application/json',
+                'content-type': 'application/json',
+                cookie: `ETEAMSID=${eteamsId}`,
+                origin: baseUrl,
+            },
+            redirect: 'manual',
+            signal: controller.signal,
+        });
+    }
+    catch (error) {
+        const name = error instanceof Error ? error.name : '';
+        throw new Error(name === 'AbortError' ? 'E10 认证检查超时' : '无法连接 E10 环境进行认证检查');
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (response.status >= 300 && response.status < 400) {
+        throw new E10LoginRequiredError('expired', 'ETEAMSID 已失效或环境要求重新登录');
+    }
+    if (!response.ok) {
+        throw new E10LoginRequiredError(response.status === 401 || response.status === 403 ? 'expired' : 'invalid', `E10 认证检查返回 HTTP ${response.status}`);
+    }
+    let payload;
+    try {
+        payload = asRecord(await response.json()) ?? {};
+    }
+    catch {
+        throw new E10LoginRequiredError('invalid', 'E10 认证检查未返回有效 JSON');
+    }
+    if (responseFailed(payload)) {
+        const message = responseMessage(payload);
+        throw new E10LoginRequiredError('expired', message ? `E10 认证检查失败: ${message}` : 'E10 认证检查失败');
+    }
+    const userId = response.headers.get('employeeId')?.trim() ||
+        nestedString(payload, ['data', 'employeeId']) ||
+        nestedString(payload, ['data', 'id']) ||
+        nestedString(payload, ['employeeId']);
+    const tenantKey = nestedString(payload, ['currentUser', 'tenantKey']) ||
+        nestedString(payload, ['currentTenant', 'tenantKey']) ||
+        nestedString(payload, ['data', 'tenantKey']) ||
+        nestedString(payload, ['data', 'tenantkey']) ||
+        nestedString(payload, ['tenantKey']) ||
+        nestedString(payload, ['tenantkey']);
+    if (!validIdentity(userId)) {
+        throw new E10LoginRequiredError('invalid', 'E10 认证检查未返回 userId');
+    }
+    if (!validIdentity(tenantKey)) {
+        throw new E10LoginRequiredError('tenant-unavailable', 'E10 认证检查未返回 tenantKey');
+    }
+    return { userId: userId.trim(), tenantKey: tenantKey.trim() };
+}
+export async function setEnvironmentAuth(options) {
+    const env = options.env ?? process.env;
+    const baseUrl = normalizeEnvironmentBaseUrl(options.baseUrl);
+    const eteamsId = normalizeEteamsId(options.eteamsId);
+    const identity = await queryAuthIdentity(baseUrl, eteamsId, options.fetchImpl);
+    const profile = profileNameFromUrl(baseUrl);
+    saveStoredAuth(profile, {
+        cookies: { ETEAMSID: eteamsId },
+        userId: identity.userId,
+        tenantKey: identity.tenantKey,
+        baseUrl,
+        passportUrl: baseUrl,
+    }, env);
+    return { profile, baseUrl, ...identity };
+}
+function equalIdentity(left, right) {
+    const leftBuffer = Buffer.from(left);
+    const rightBuffer = Buffer.from(right);
+    return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
+}
+export async function verifyEnvironmentAuth(options = {}) {
+    const env = options.env ?? process.env;
+    const profile = readActiveEnvironmentAuthProfile(env);
+    const auth = readEnvironmentAuthContext(undefined, env);
+    const identity = await queryAuthIdentity(auth.baseUrl, auth.eteamsId, options.fetchImpl);
+    if (!equalIdentity(identity.userId, auth.userId) ||
+        !equalIdentity(identity.tenantKey, auth.tenantKey)) {
+        throw new E10LoginRequiredError('invalid', 'E10 当前身份与本地 Profile 不一致，请重新执行 auth set');
+    }
+    return { authenticated: true, status: 'authenticated', profile, ...auth };
+}
+export function listEnvironmentAuthProfiles(env = process.env) {
+    const paths = environmentAuthPaths(env);
+    const active = readActiveEnvironmentAuthProfile(env);
+    if (!existsSync(paths.profilesDir))
+        return [];
+    return readdirSync(paths.profilesDir, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory() && PROFILE_PATTERN.test(entry.name))
+        .map((entry) => ({
+        name: entry.name,
+        active: entry.name === active,
+        configured: existsSync(profilePaths(entry.name, env).authFile),
+    }))
+        .sort((left, right) => left.name.localeCompare(right.name));
+}
+export function useEnvironmentAuthProfile(name, env = process.env) {
+    const normalized = profileName(name);
+    const auth = readStoredAuth(normalized, env);
+    writeActiveProfile(normalized, env);
+    return {
+        baseUrl: auth.baseUrl,
+        userId: auth.userId,
+        tenantKey: auth.tenantKey,
+        eteamsId: auth.cookies.ETEAMSID,
+    };
+}
+export function assertEnvironmentForDataAccess(requestedBaseUrl, _statePath, authContext) {
+    const auth = authContext ?? readEnvironmentAuthContext();
+    if (requestedBaseUrl &&
+        normalizeEnvironmentBaseUrl(requestedBaseUrl) !== normalizeEnvironmentBaseUrl(auth.baseUrl)) {
+        const error = new Error('用户指定的 E10 系统环境与当前 e10-ebuilder-prototype Profile 不一致');
+        error.authStatus = { authenticated: true, status: 'authenticated', ...auth };
+        throw error;
+    }
+    return { authenticated: true, status: 'authenticated', ...auth };
+}
+export function assertEnvironmentAuth(status) {
+    if (!status.authenticated || status.status !== 'authenticated') {
+        throw new E10LoginRequiredError(status.status);
+    }
+}
+export function environmentAuthGuidance(_statusOrNext, _requestedBaseUrl) {
+    return [
+        '# 需要配置 E10 认证',
+        '',
+        '当前命令需要有效的 E10 认证。请使用 e10-ebuilder-prototype 自带的 auth set 配置当前环境。',
+        '不需要安装或调用额外的 E10 登录 Skill。',
+        '',
+        'FIX: E10_LOGIN_REQUIRED: 当前本地 Profile 缺失、无效或认证已失效。',
+        'NEXT: e10-ebuilder-prototype auth set --eteamsid <ETEAMSID> --base-url <E10环境地址>',
+    ];
+}

package/dist/workflow-runtime.d.mts

@@ -0,0 +1,2 @@
+export function workflowRuntime(templates: any): string;
+export function attachWorkflowRuntime(source: any, templates: any): any;