gaoding-cli 1.0.0-alpha.5

package/dist/src/core/auth/org-manager.js

@@ -0,0 +1,224 @@
+import { SsoClient } from "../../api/sso-client.js";
+import { HubClient } from "../../api/hub-client.js";
+import { CredentialStoreV2 } from "../../auth/credential-store-v2.js";
+import { GDHUB_CLI_CLIENT_ID } from "../../utils/config.js";
+import chalk from "chalk";
+const BIND_TTL_MS = 24 * 60 * 60 * 1000;
+const STRUCTURE_USER_ORGS_PATH = "/structure/user/orgs";
+/**
+ * 组织列表与 bind-org。
+ * Device 模式：组织列表走 Hub 网关代理的 /structure/user/orgs；
+ * 网关不可用时退回本地 current_org 与 SSO identity。
+ */
+export class OrgManager {
+    v2Store;
+    sso;
+    hub;
+    constructor(v2Store, sso, hub) {
+        this.v2Store = v2Store ?? new CredentialStoreV2();
+        this.sso = sso ?? new SsoClient();
+        this.hub = hub ?? new HubClient(undefined, this.v2Store);
+    }
+    async listOrgs() {
+        const v2 = this.v2Store.read();
+        if (!v2)
+            throw new Error("未找到 AK/SK 凭证，请先执行 gd-cli auth login");
+        return (await this.listOrgsWithSource(v2)).orgs;
+    }
+    /** TTY 下选择结构接口返回的组织；接口不可用时允许手输 orgId。 */
+    async switchOrgInteractive() {
+        const orgs = await this.listOrgs();
+        const current = this.getCurrentOrgId();
+        if (orgs.length === 1) {
+            return this.switchOrg(orgs[0].id);
+        }
+        if (orgs.length > 1) {
+            const { Prompt } = await import("../prompt/index.js");
+            const selected = await Prompt.select({
+                message: "选择 CLI 当前组织",
+                choices: orgs.map((o) => ({
+                    name: formatOrgChoice(o, current),
+                    value: o.id,
+                })),
+            });
+            return this.switchOrg(selected);
+        }
+        console.log(chalk.yellow("\nSSO 未返回可切换的组织列表。请从稿定工作台获取 orgId，或使用:\n  gd-cli org switch --org <org-id>\n"));
+        const { Prompt } = await import("../prompt/index.js");
+        const orgId = await Prompt.text({
+            message: "输入要绑定的组织 ID (orgId)",
+            validate: (v) => (v?.trim() ? true : "orgId 不能为空"),
+        });
+        return this.switchOrg(orgId.trim());
+    }
+    async switchOrg(orgId) {
+        const v2 = this.v2Store.read();
+        if (!v2)
+            throw new Error("未找到 AK/SK 凭证，请先执行 gd-cli auth login");
+        const normalizedOrgId = orgId.trim();
+        if (!normalizedOrgId)
+            throw new Error("orgId 不能为空");
+        const listed = await this.listOrgsWithSource(v2);
+        const selected = listed.orgs.find((o) => o.id === normalizedOrgId);
+        if (listed.source === "structure" && !selected) {
+            throw new Error(`组织 ${normalizedOrgId} 不在当前授权用户可绑定组织列表中，请先执行 gd-cli org list 确认 orgId`);
+        }
+        return this.bindOrgDevice(v2, normalizedOrgId, selected);
+    }
+    async bindAuthorizedOrg(orgId) {
+        const v2 = this.v2Store.read();
+        if (!v2)
+            throw new Error("未找到 AK/SK 凭证，请先执行 gd-cli auth login");
+        const normalizedOrgId = orgId.trim();
+        if (!normalizedOrgId)
+            throw new Error("orgId 不能为空");
+        let selected;
+        try {
+            const listed = await this.listOrgsWithSource(v2);
+            selected = listed.orgs.find((o) => o.id === normalizedOrgId);
+        }
+        catch {
+            /* 授权页已给出 orgId，组织列表只用于补充名称，不阻断绑定。 */
+        }
+        return this.bindOrgDevice(v2, normalizedOrgId, selected);
+    }
+    getCurrentOrgId() {
+        const v2 = this.v2Store.read();
+        if (v2?.current_org?.id)
+            return v2.current_org.id;
+        return undefined;
+    }
+    getCurrentOrg() {
+        const v2 = this.v2Store.read();
+        if (!v2?.current_org?.id)
+            return undefined;
+        return {
+            id: v2.current_org.id,
+            name: v2.current_org.name,
+        };
+    }
+    async listOrgsWithSource(v2) {
+        try {
+            const orgs = await this.listStructureOrgs();
+            if (orgs.length > 0)
+                return { orgs, source: "structure" };
+        }
+        catch {
+            /* Fall back to device identity when the organization endpoint is unavailable. */
+        }
+        return {
+            orgs: await this.listOrgsDevice(v2.ak, v2),
+            source: "fallback",
+        };
+    }
+    async listStructureOrgs() {
+        const raw = await this.hub.get(STRUCTURE_USER_ORGS_PATH);
+        if (!Array.isArray(raw))
+            return [];
+        const seen = new Set();
+        const orgs = [];
+        for (const item of raw) {
+            const org = normalizeStructureOrg(item);
+            if (!org || seen.has(org.id))
+                continue;
+            seen.add(org.id);
+            orgs.push(org);
+        }
+        return orgs;
+    }
+    async listOrgsDevice(ak, creds) {
+        const items = [];
+        if (creds.current_org?.id) {
+            items.push({
+                id: creds.current_org.id,
+                name: creds.current_org.name,
+                is_default: true,
+            });
+        }
+        try {
+            const identity = await this.sso.getIdentity(ak);
+            if (identity.orgId) {
+                const id = String(identity.orgId);
+                if (!items.some((o) => o.id === id)) {
+                    items.push({
+                        id,
+                        name: `组织 ${id}`,
+                        is_default: true,
+                    });
+                }
+            }
+        }
+        catch {
+            /* identity 不可用时仅展示本地 current_org */
+        }
+        return items;
+    }
+    async bindOrgDevice(creds, orgId, org) {
+        const result = await this.sso.bindOrg(creds.ak, creds.sk, orgId);
+        assertBindOrgSuccess(result, orgId);
+        const bindExpires = result.bind_expires_at ?? new Date(Date.now() + BIND_TTL_MS).toISOString();
+        const name = org?.name ?? (result.message?.includes("成功") ? `组织 ${orgId}` : orgId);
+        creds.current_org = {
+            id: orgId,
+            name,
+            bind_expires_at: bindExpires,
+        };
+        creds.client_id = GDHUB_CLI_CLIENT_ID;
+        this.v2Store.write(creds);
+        return {
+            ...org,
+            id: creds.current_org.id,
+            name: creds.current_org.name,
+        };
+    }
+}
+function assertBindOrgSuccess(result, orgId) {
+    const code = cleanString(result.code);
+    const message = cleanString(result.message);
+    const text = [code, message].filter(Boolean).join(" ");
+    const hasSuccessSignal = /^(0|200|OK|SUCCESS)$/i.test(code ?? "") ||
+        /成功|success|ok/i.test(text);
+    const hasFailureSignal = /(失败|错误|无效|不允许|未授权|无权限|没有权限|不存在|过期|fail|error|invalid|denied|forbidden|unauthorized|not found)/i
+        .test(text);
+    if (hasFailureSignal && !hasSuccessSignal) {
+        throw new Error(`绑定组织失败：${message ?? code ?? "bind-org 返回失败"}（orgId=${orgId}）`);
+    }
+    if (code && !hasSuccessSignal) {
+        throw new Error(`绑定组织失败：${message ?? `bind-org 返回 code=${code}`}（orgId=${orgId}）`);
+    }
+}
+function formatOrgChoice(org, currentOrgId) {
+    const product = org.product_name ? ` · ${org.product_name}` : "";
+    const current = org.id === currentOrgId ? " ← 当前" : "";
+    return `${org.name} (${org.id})${product}${current}`;
+}
+function normalizeStructureOrg(item) {
+    const id = cleanString(item.org_id) ?? cleanString(item.company?.id);
+    if (!id)
+        return null;
+    const productExpire = numberOrUndefined(item.product?.expire_date);
+    return {
+        id,
+        name: cleanString(item.company?.name) ?? `组织 ${id}`,
+        code: cleanString(item.company?.code),
+        domain: cleanString(item.company?.domain),
+        org_class: cleanString(item.company?.org_class),
+        status: cleanString(item.company?.status),
+        module_code: cleanString(item.module_code),
+        product_name: cleanString(item.product?.product_name),
+        product_type: cleanString(item.product?.product_type),
+        expire_date: numberOrUndefined(item.expire_date) ?? productExpire,
+        last_bind_org: item.last_bind_org === true,
+    };
+}
+function cleanString(value) {
+    if (value === null || value === undefined)
+        return undefined;
+    const s = String(value).trim();
+    return s ? s : undefined;
+}
+function numberOrUndefined(value) {
+    if (typeof value === "number" && Number.isFinite(value))
+        return value;
+    return undefined;
+}

package/dist/src/core/auth/signature.d.ts

@@ -0,0 +1,19 @@
+/** Unix 秒级时间戳（与 SSO / Kong 文档一致） */
+export declare function signatureTimestamp(): string;
+export declare function hmacSha256Hex(secret: string, signString: string): string;
+/** bind-org uses the backend signing contract: GET@<path>@<query>@<timestamp>. */
+export declare function signBindOrg(ak: string, sk: string, orgId: string, timestamp?: string): {
+    signature: string;
+    timestamp: string;
+};
+/**
+ * 业务 API 签名。
+ * @param path 不含域名的路径，如 /hub/v1/tools/cutout/invoke
+ * @param query 已排序且 URL 编码的 query，无 query 传空串
+ */
+export declare function signApiRequest(method: string, path: string, query: string, sk: string, timestamp?: string): {
+    signature: string;
+    timestamp: string;
+};
+/** query 参数按 key 排序后拼接（与网关验签一致） */
+export declare function canonicalQuery(params: Record<string, string>): string;

package/dist/src/core/auth/signature.js

@@ -0,0 +1,33 @@
+import crypto from "node:crypto";
+/** Unix 秒级时间戳（与 SSO / Kong 文档一致） */
+export function signatureTimestamp() {
+    return String(Math.floor(Date.now() / 1000));
+}
+export function hmacSha256Hex(secret, signString) {
+    return crypto.createHmac("sha256", secret).update(signString).digest("hex");
+}
+/** bind-org uses the backend signing contract: GET@<path>@<query>@<timestamp>. */
+export function signBindOrg(ak, sk, orgId, timestamp) {
+    const ts = timestamp ?? signatureTimestamp();
+    const signStr = `GET@/oauth/device/bind-org@ak=${ak}&orgId=${orgId}@${ts}`;
+    return { signature: hmacSha256Hex(sk, signStr), timestamp: ts };
+}
+/**
+ * 业务 API 签名。
+ * @param path 不含域名的路径，如 /hub/v1/tools/cutout/invoke
+ * @param query 已排序且 URL 编码的 query，无 query 传空串
+ */
+export function signApiRequest(method, path, query, sk, timestamp) {
+    const ts = timestamp ?? signatureTimestamp();
+    const signStr = `${method.toUpperCase()}@${path}@${query}@${ts}`;
+    return { signature: hmacSha256Hex(sk, signStr), timestamp: ts };
+}
+/** query 参数按 key 排序后拼接（与网关验签一致） */
+export function canonicalQuery(params) {
+    const keys = Object.keys(params).sort();
+    if (keys.length === 0)
+        return "";
+    return keys
+        .map((k) => `${encodeURIComponent(k)}=${encodeURIComponent(params[k])}`)
+        .join("&");
+}

package/dist/src/core/auth/types.d.ts

@@ -0,0 +1,52 @@
+/** V2 凭证（Device Flow + bind-org） */
+export interface OrgBinding {
+    id: string;
+    name: string;
+    bind_expires_at?: string;
+}
+export interface UserInfo {
+    id: string;
+    name: string;
+}
+export interface CredentialsV2 {
+    version: 2;
+    provider: "gdhub";
+    client_id: string;
+    ak: string;
+    sk: string;
+    scope: string[];
+    expires_at: string;
+    /** 签发时 active_env，切换环境后提示重新登录 */
+    issued_for_env?: import("../../utils/settings-store.js").GdEnvName;
+    current_org?: OrgBinding;
+    user?: UserInfo;
+    created_at: string;
+}
+export type StoredCredentials = CredentialsV2;
+export declare function isCredentialsV2(c: StoredCredentials): c is CredentialsV2;
+export interface OrgSummary {
+    id: string;
+    name: string;
+    role?: string;
+    is_default?: boolean;
+    code?: string;
+    domain?: string;
+    org_class?: string;
+    status?: string;
+    module_code?: string;
+    product_name?: string;
+    product_type?: string;
+    expire_date?: number;
+    last_bind_org?: boolean;
+}
+export type AuthMode = "aksk";
+export interface LoginOptions {
+    orgId?: string;
+    noBrowser?: boolean;
+    scope?: string;
+    env?: string;
+}
+export interface LoginResult {
+    credentials: CredentialsV2;
+    org?: OrgSummary;
+}

package/dist/src/core/auth/types.js

@@ -0,0 +1,3 @@
+export function isCredentialsV2(c) {
+    return c.version === 2 && Boolean(c.ak);
+}

package/dist/src/core/output/cli-error.d.ts

@@ -0,0 +1,5 @@
+import type { CliErrorBody } from "./envelope.js";
+export declare class CliUsageError extends Error {
+    body: CliErrorBody;
+    constructor(body: CliErrorBody);
+}

package/dist/src/core/output/cli-error.js

@@ -0,0 +1,8 @@
+export class CliUsageError extends Error {
+    body;
+    constructor(body) {
+        super(body.message);
+        this.name = "CliUsageError";
+        this.body = body;
+    }
+}

package/dist/src/core/output/detector.d.ts

@@ -0,0 +1,5 @@
+export type OutputMode = "json" | "text" | "table";
+export declare function detectOutputMode(options: {
+    format?: string;
+}): OutputMode;
+export declare function isTTY(): boolean;

package/dist/src/core/output/detector.js

@@ -0,0 +1,14 @@
+export function detectOutputMode(options) {
+    if (options.format === "table")
+        return "table";
+    if (options.format === "text" || options.format === "pretty")
+        return "text";
+    if (!process.stdout.isTTY)
+        return "json";
+    if (options.format === "json")
+        return "json";
+    return "text";
+}
+export function isTTY() {
+    return !!process.stdout.isTTY;
+}

package/dist/src/core/output/engine.d.ts

@@ -0,0 +1,32 @@
+import { LiveDisplay } from "./live-display.js";
+export interface ProgressEvent {
+    type: "progress";
+    current: number;
+    total: number;
+    step: string;
+    status: string;
+    percent: number;
+}
+interface CommandResult {
+    title?: string;
+    status?: "success" | "error" | "info";
+    data: Record<string, unknown>;
+    nextSteps?: string[];
+}
+export declare class OutputEngine {
+    private mode;
+    private liveDisplay;
+    constructor(options?: {
+        format?: string;
+    });
+    get live(): LiveDisplay;
+    get isTTYMode(): boolean;
+    render(result: CommandResult): void;
+    json(data: unknown): void;
+    emitProgress(data: ProgressEvent): void;
+    error(err: Error & {
+        code?: string;
+    }): Promise<void>;
+    private renderTable;
+}
+export {};

package/dist/src/core/output/engine.js

@@ -0,0 +1,77 @@
+import { detectOutputMode, isTTY } from "./detector.js";
+import { LiveDisplay } from "./live-display.js";
+import { ResultCard } from "./result-card.js";
+import Table from "cli-table3";
+export class OutputEngine {
+    mode;
+    liveDisplay;
+    constructor(options = {}) {
+        this.mode = detectOutputMode(options);
+        this.liveDisplay = new LiveDisplay(isTTY());
+    }
+    get live() {
+        return this.liveDisplay;
+    }
+    get isTTYMode() {
+        return isTTY();
+    }
+    render(result) {
+        switch (this.mode) {
+            case "json":
+                console.log(JSON.stringify(result.data, null, 2));
+                break;
+            case "table":
+                this.renderTable(result.data);
+                break;
+            case "text":
+                ResultCard.render({
+                    title: result.title,
+                    status: result.status ?? "success",
+                    data: result.data,
+                    nextSteps: result.nextSteps,
+                });
+                break;
+        }
+    }
+    json(data) {
+        console.log(JSON.stringify(data, null, 2));
+    }
+    emitProgress(data) {
+        if (isTTY())
+            return;
+        process.stderr.write(JSON.stringify(data) + "\n");
+    }
+    async error(err) {
+        this.liveDisplay.stop();
+        if (this.mode === "json") {
+            console.log(JSON.stringify({
+                error: true,
+                code: err.code ?? "UNKNOWN_ERROR",
+                message: err.message,
+            }, null, 2));
+        }
+        else {
+            ResultCard.error({
+                code: err.code ?? "UNKNOWN_ERROR",
+                message: err.message,
+            });
+        }
+    }
+    renderTable(data) {
+        if (!Array.isArray(data)) {
+            ResultCard.render({ status: "info", data: data });
+            return;
+        }
+        if (data.length === 0) {
+            console.log("(empty)");
+            return;
+        }
+        const keys = Object.keys(data[0]);
+        const table = new Table({ head: keys });
+        for (const row of data) {
+            const r = row;
+            table.push(keys.map((k) => String(r[k] ?? "")));
+        }
+        console.log(table.toString());
+    }
+}

package/dist/src/core/output/envelope.d.ts

@@ -0,0 +1,40 @@
+export interface AssetRef {
+    id: string;
+    url: string;
+    cover_url?: string;
+    type?: string;
+    filename?: string;
+    source?: string;
+}
+export interface CliErrorBody {
+    code: string;
+    type: "business" | "auth" | "network" | "validation" | "unknown";
+    message: string;
+    reason?: string;
+    hint?: string;
+    app_id?: string;
+    tool_id?: string;
+    missing_tools?: Array<string | Record<string, unknown>>;
+    retryable?: boolean;
+    detail?: unknown;
+    diagnostic_context?: Record<string, unknown>;
+    next_command?: string;
+    next_steps?: string[];
+    pricing_url?: string;
+    user_action_required?: string;
+    forbidden_actions?: string[];
+    allow_org_check?: boolean;
+    agent_message_template?: string;
+}
+export interface ResultEnvelope<T = unknown> {
+    status: "completed" | "failed" | "pending" | "submitted" | "running";
+    data?: T;
+    assets?: AssetRef[];
+    task_id?: string;
+    meta?: Record<string, unknown>;
+    error?: CliErrorBody | null;
+}
+export declare function wrapEnvelope<T>(payload: T, meta?: Record<string, unknown>): ResultEnvelope<T>;
+export declare function failedEnvelope(error: CliErrorBody, meta?: Record<string, unknown>): ResultEnvelope<null>;
+export declare function emitJson(data: unknown): void;
+export declare function shouldEmitEnvelope(format: string, rootFormat?: string): boolean;

package/dist/src/core/output/envelope.js

@@ -0,0 +1,119 @@
+export function wrapEnvelope(payload, meta) {
+    if (typeof payload === "object" && payload !== null) {
+        const p = payload;
+        const status = normalizeEnvelopeStatus(p.status);
+        const assets = extractAssets(p);
+        return {
+            status,
+            data: payload,
+            assets: assets.length ? assets : undefined,
+            task_id: p.task_id != null ? String(p.task_id) : undefined,
+            meta,
+            error: status === "failed" ? normalizePayloadError(p.error) : null,
+        };
+    }
+    return { status: "completed", data: payload, meta, error: null };
+}
+function normalizeEnvelopeStatus(value) {
+    if (value === "failed" ||
+        value === "pending" ||
+        value === "submitted" ||
+        value === "running") {
+        return value;
+    }
+    return "completed";
+}
+export function failedEnvelope(error, meta) {
+    return { status: "failed", data: null, error, meta };
+}
+function normalizePayloadError(value) {
+    if (!value)
+        return null;
+    if (typeof value === "string") {
+        return {
+            code: "ERROR",
+            type: "unknown",
+            message: value,
+        };
+    }
+    if (typeof value !== "object" || Array.isArray(value)) {
+        return {
+            code: "ERROR",
+            type: "unknown",
+            message: String(value),
+        };
+    }
+    const error = value;
+    const type = error.type;
+    return {
+        code: typeof error.code === "string" ? error.code : "ERROR",
+        type: type === "business" ||
+            type === "auth" ||
+            type === "network" ||
+            type === "validation" ||
+            type === "unknown"
+            ? type
+            : "unknown",
+        message: typeof error.message === "string" ? error.message : JSON.stringify(error),
+        reason: typeof error.reason === "string" ? error.reason : undefined,
+        hint: typeof error.hint === "string" ? error.hint : undefined,
+        app_id: typeof error.app_id === "string" ? error.app_id : undefined,
+        tool_id: typeof error.tool_id === "string" ? error.tool_id : undefined,
+        retryable: typeof error.retryable === "boolean" ? error.retryable : undefined,
+        next_command: typeof error.next_command === "string" ? error.next_command : undefined,
+        next_steps: Array.isArray(error.next_steps) ? error.next_steps.map(String) : undefined,
+        pricing_url: typeof error.pricing_url === "string" ? error.pricing_url : undefined,
+        user_action_required: typeof error.user_action_required === "string" ? error.user_action_required : undefined,
+        forbidden_actions: Array.isArray(error.forbidden_actions) ? error.forbidden_actions.map(String) : undefined,
+        allow_org_check: typeof error.allow_org_check === "boolean" ? error.allow_org_check : undefined,
+        agent_message_template: typeof error.agent_message_template === "string" ? error.agent_message_template : undefined,
+        detail: error,
+    };
+}
+function extractAssets(obj) {
+    const out = [];
+    const push = (a) => {
+        if (!a || typeof a !== "object")
+            return;
+        const o = a;
+        const id = o.asset_id ?? o.id;
+        const url = o.url;
+        if (id && url) {
+            const asset = {
+                id: String(id),
+                url: String(url),
+                cover_url: o.cover_url != null ? String(o.cover_url) : undefined,
+                type: o.type != null ? String(o.type) : undefined,
+                filename: o.filename != null ? String(o.filename) : undefined,
+                source: o.source != null ? String(o.source) : "cli",
+            };
+            if (!out.some((item) => item.id === asset.id && item.url === asset.url)) {
+                out.push(asset);
+            }
+        }
+    };
+    if (obj.asset && typeof obj.asset === "object")
+        push(obj.asset);
+    if (Array.isArray(obj.assets))
+        for (const a of obj.assets)
+            push(a);
+    if (obj.outputs && typeof obj.outputs === "object") {
+        const outputs = obj.outputs;
+        if (outputs.asset)
+            push(outputs.asset);
+        if (Array.isArray(outputs.assets))
+            for (const a of outputs.assets)
+                push(a);
+        if (typeof outputs.asset_id === "string" && typeof outputs.url === "string") {
+            push({ id: outputs.asset_id, url: outputs.url, cover_url: outputs.cover_url });
+        }
+    }
+    return out;
+}
+export function emitJson(data) {
+    console.log(JSON.stringify(data, null, 2));
+}
+export function shouldEmitEnvelope(format, rootFormat) {
+    const f = format || rootFormat || "json";
+    return f === "json";
+}

package/dist/src/core/output/index.d.ts

@@ -0,0 +1,4 @@
+export { OutputEngine, type ProgressEvent } from "./engine.js";
+export { LiveDisplay } from "./live-display.js";
+export { ResultCard } from "./result-card.js";
+export { detectOutputMode, isTTY, type OutputMode } from "./detector.js";

package/dist/src/core/output/index.js

@@ -0,0 +1,4 @@
+export { OutputEngine } from "./engine.js";
+export { LiveDisplay } from "./live-display.js";
+export { ResultCard } from "./result-card.js";
+export { detectOutputMode, isTTY } from "./detector.js";

package/dist/src/core/output/live-display.d.ts

@@ -0,0 +1,15 @@
+export declare class LiveDisplay {
+    private steps;
+    private frameIndex;
+    private timer;
+    private isTTY;
+    private startedAt;
+    constructor(tty?: boolean);
+    addStep(label: string): number;
+    startStep(idx: number): void;
+    completeStep(idx: number): void;
+    failStep(idx: number): void;
+    stop(): void;
+    private render;
+    private emitProgress;
+}