gaoding-cli 1.0.0-alpha.5

package/dist/src/api/hub-client.d.ts

@@ -0,0 +1,20 @@
+import { CredentialStoreV2 } from "../auth/credential-store-v2.js";
+export declare class HubClient {
+    private baseUrl;
+    private storeV2;
+    constructor(baseUrl?: string, storeV2?: CredentialStoreV2);
+    get<T>(path: string, options?: {
+        auth?: boolean;
+    }): Promise<T>;
+    post<T>(path: string, body?: unknown, options?: {
+        auth?: boolean;
+    }): Promise<T>;
+    private request;
+    private attachAuthHeaders;
+}
+export declare class ApiError extends Error {
+    statusCode: number;
+    body: string;
+    path: string;
+    constructor(statusCode: number, body: string, path: string);
+}

package/dist/src/api/hub-client.js

@@ -0,0 +1,99 @@
+import { CredentialStoreV2 } from "../auth/credential-store-v2.js";
+import { resolveApiBase, CLI_USER_AGENT } from "../utils/config.js";
+import { isCredentialsV2 } from "../core/auth/types.js";
+import { signApiRequest } from "../core/auth/signature.js";
+import { redactSensitiveText } from "../utils/redact.js";
+function collectErrorCodes(err, out) {
+    if (!err || typeof err !== "object")
+        return;
+    const e = err;
+    if (typeof e.code === "string")
+        out.add(e.code);
+    if (e.cause)
+        collectErrorCodes(e.cause, out);
+    if (typeof AggregateError !== "undefined" && err instanceof AggregateError) {
+        for (const sub of err.errors)
+            collectErrorCodes(sub, out);
+    }
+}
+function fetchFailureHint(baseUrl, requestUrl) {
+    return [
+        `请求: ${redactSensitiveText(requestUrl)}`,
+        `当前 API 根: ${redactSensitiveText(baseUrl)}`,
+        "请检查网络连接和 GD_API_BASE 配置。",
+        "请先执行 gd-cli auth login 获取 AK/SK 凭证。",
+        "排查: GD_VERBOSE=1 gd-cli <command>",
+    ].join("\n");
+}
+export class HubClient {
+    baseUrl;
+    storeV2;
+    constructor(baseUrl, storeV2) {
+        this.baseUrl = baseUrl ?? resolveApiBase();
+        this.storeV2 = storeV2 ?? new CredentialStoreV2();
+    }
+    async get(path, options) {
+        return this.request("GET", path, undefined, options);
+    }
+    async post(path, body, options) {
+        return this.request("POST", path, body, options);
+    }
+    async request(method, path, body, options) {
+        const url = new URL(path.replace(/^\//, ""), `${this.baseUrl.replace(/\/$/, "")}/`);
+        const headers = {
+            "Content-Type": "application/json",
+            "User-Agent": CLI_USER_AGENT,
+        };
+        const needsAuth = options?.auth !== false;
+        if (needsAuth) {
+            await this.attachAuthHeaders(headers, method, path);
+        }
+        let response;
+        try {
+            response = await fetch(url, {
+                method,
+                headers,
+                body: body ? JSON.stringify(body) : undefined,
+            });
+        }
+        catch (err) {
+            const codes = new Set();
+            collectErrorCodes(err, codes);
+            const codeSuffix = codes.size > 0 ? ` [${[...codes].join(", ")}]` : "";
+            const base = err instanceof Error ? err.message : String(err);
+            throw new Error(`${redactSensitiveText(base)}${codeSuffix}\n\n${fetchFailureHint(this.baseUrl, url.toString())}`);
+        }
+        if (!response.ok) {
+            const errorBody = await response.text();
+            throw new ApiError(response.status, errorBody, path);
+        }
+        return response.json();
+    }
+    async attachAuthHeaders(headers, method, path) {
+        const v2 = this.storeV2.read();
+        if (v2 && isCredentialsV2(v2)) {
+            const url = new URL(path.replace(/^\//, ""), `${this.baseUrl.replace(/\/$/, "")}/`);
+            const { signature, timestamp } = signApiRequest(method, url.pathname, url.searchParams.toString(), v2.sk);
+            headers["X-AccessKey"] = v2.ak;
+            headers["X-Signature"] = signature;
+            headers["X-Timestamp"] = timestamp;
+            if (v2.current_org?.id) {
+                headers["X-Org-Id"] = v2.current_org.id;
+            }
+            return;
+        }
+        throw new Error("AK/SK 模式需要先登录并绑定组织：\n  gd-cli auth login\n  gd-cli org switch --org <org-id>");
+    }
+}
+export class ApiError extends Error {
+    statusCode;
+    body;
+    path;
+    constructor(statusCode, body, path) {
+        super(redactSensitiveText(`API 请求失败 [${statusCode}] ${path}: ${body}`));
+        this.statusCode = statusCode;
+        this.body = body;
+        this.path = path;
+        this.name = "ApiError";
+    }
+}

package/dist/src/api/sso-client.d.ts

@@ -0,0 +1,60 @@
+export interface DeviceAuthorizationResult {
+    device_code: string;
+    authorize_code?: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}
+export interface DeviceTokenResult {
+    ak: string;
+    sk: string;
+    scope: string | string[];
+    expires_at: string;
+    device_code?: string;
+    agent_name?: string | null;
+    orgId?: string;
+    user?: {
+        id: string;
+        name: string;
+    };
+}
+export interface DeviceIdentityResult {
+    ak: string;
+    userId: string | number;
+    umsId?: string | number;
+    orgId?: string | number;
+    scope?: string;
+    provider?: string;
+}
+export type DeviceTokenPollState = {
+    status: "success";
+    token: DeviceTokenResult;
+} | {
+    status: "pending";
+} | {
+    status: "slow_down";
+} | {
+    status: "failed";
+    code: string;
+    message: string;
+};
+export declare class SsoClient {
+    private readonly baseUrl;
+    constructor(baseUrl?: string);
+    deviceAuthorization(clientId?: string): Promise<DeviceAuthorizationResult>;
+    pollDeviceTokenOnce(deviceCode: string): Promise<DeviceTokenPollState>;
+    pollDeviceToken(deviceCode: string, intervalSec: number, expiresInSec: number, onPending?: () => void): Promise<DeviceTokenResult>;
+    getIdentity(ak: string): Promise<DeviceIdentityResult>;
+    bindOrg(ak: string, sk: string, orgId: string): Promise<{
+        code?: string;
+        message?: string;
+        bind_expires_at?: string;
+    }>;
+}
+export declare class SsoApiError extends Error {
+    statusCode: number;
+    body: string;
+    url: string;
+    constructor(statusCode: number, body: string, url: string);
+}

package/dist/src/api/sso-client.js

@@ -0,0 +1,140 @@
+import { resolveSsoBase, buildDeviceAuthPageUrls, GDHUB_CLI_CLIENT_ID, CLI_USER_AGENT, } from "../utils/config.js";
+import { signBindOrg } from "../core/auth/signature.js";
+import { sleep } from "../utils/sleep.js";
+import { redactSensitiveText } from "../utils/redact.js";
+export class SsoClient {
+    baseUrl;
+    constructor(baseUrl = resolveSsoBase()) {
+        this.baseUrl = baseUrl;
+    }
+    async deviceAuthorization(clientId = GDHUB_CLI_CLIENT_ID) {
+        const url = `${this.baseUrl}/oauth/device-authorization?clientId=${encodeURIComponent(clientId)}`;
+        const res = await fetch(url, {
+            method: "POST",
+            headers: { "User-Agent": CLI_USER_AGENT },
+        });
+        const text = await res.text();
+        if (!res.ok) {
+            throw new SsoApiError(res.status, text, url);
+        }
+        const raw = JSON.parse(text);
+        const code = raw.authorize_code?.trim();
+        if (!code) {
+            throw new SsoApiError(502, "device-authorization 响应缺少 authorize_code", url);
+        }
+        const pages = buildDeviceAuthPageUrls(code);
+        return {
+            ...raw,
+            authorize_code: code,
+            verification_uri: pages.verification_uri,
+            verification_uri_complete: pages.verification_uri_complete,
+        };
+    }
+    async pollDeviceTokenOnce(deviceCode) {
+        const url = `${this.baseUrl}/oauth/device/token?grantType=device_code&deviceCode=${encodeURIComponent(deviceCode)}`;
+        const res = await fetch(url, {
+            method: "POST",
+            headers: { "User-Agent": CLI_USER_AGENT },
+        });
+        const body = (await res.json());
+        const ak = body.ak;
+        const sk = body.sk;
+        if (ak && sk) {
+            return {
+                status: "success",
+                token: {
+                    ak,
+                    sk,
+                    scope: body.scope ?? "scene-executor",
+                    expires_at: String(body.expires_at),
+                    device_code: body.device_code,
+                    agent_name: body.agent_name,
+                    orgId: cleanString(body.orgId ?? body.org_id ?? body.orgID),
+                },
+            };
+        }
+        const err = String(body.error ?? "");
+        const msg = String(body.error_description ?? body.message ?? err ?? "授权失败");
+        if (err === "authorization_pending")
+            return { status: "pending" };
+        if (err === "slow_down")
+            return { status: "slow_down" };
+        return { status: "failed", code: err || String(res.status), message: msg };
+    }
+    async pollDeviceToken(deviceCode, intervalSec, expiresInSec, onPending) {
+        const deadline = Date.now() + expiresInSec * 1000;
+        let intervalMs = Math.max(intervalSec, 2) * 1000;
+        while (Date.now() < deadline) {
+            const state = await this.pollDeviceTokenOnce(deviceCode);
+            if (state.status === "success")
+                return state.token;
+            if (state.status === "pending") {
+                onPending?.();
+                await sleep(intervalMs);
+                continue;
+            }
+            if (state.status === "slow_down") {
+                intervalMs = Math.min(intervalMs * 2, 30_000);
+                await sleep(intervalMs);
+                continue;
+            }
+            throw new Error(mapDeviceTokenError(state.code, state.message));
+        }
+        throw new Error("授权超时。请重新执行: gd-cli auth login（或检查是否已在浏览器完成授权）");
+    }
+    async getIdentity(ak) {
+        const url = `${this.baseUrl}/oauth/device/identity?ak=${encodeURIComponent(ak)}`;
+        const res = await fetch(url, { headers: { "User-Agent": CLI_USER_AGENT } });
+        const text = await res.text();
+        if (!res.ok) {
+            throw new SsoApiError(res.status, text, url);
+        }
+        return JSON.parse(text);
+    }
+    async bindOrg(ak, sk, orgId) {
+        const { signature, timestamp } = signBindOrg(ak, sk, orgId);
+        const q = new URLSearchParams({ ak, orgId, signature, timestamp });
+        const url = `${this.baseUrl}/oauth/device/bind-org?${q}`;
+        const res = await fetch(url, {
+            method: "POST",
+            headers: { "User-Agent": CLI_USER_AGENT },
+        });
+        const text = await res.text();
+        if (!res.ok) {
+            throw new SsoApiError(res.status, text, url);
+        }
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return { message: text };
+        }
+    }
+}
+function cleanString(value) {
+    if (value === null || value === undefined)
+        return undefined;
+    const s = String(value).trim();
+    return s ? s : undefined;
+}
+export class SsoApiError extends Error {
+    statusCode;
+    body;
+    url;
+    constructor(statusCode, body, url) {
+        super(redactSensitiveText(`SSO 请求失败 [${statusCode}] ${url}: ${body}`));
+        this.statusCode = statusCode;
+        this.body = body;
+        this.url = url;
+        this.name = "SsoApiError";
+    }
+}
+function mapDeviceTokenError(code, message) {
+    const hints = {
+        expired: "授权码已过期，请重新执行 gd-cli auth login",
+        authorization_declined: "用户已拒绝授权",
+        invalid_token: "OAuth token 无效，请重新登录",
+    };
+    const hint = hints[code];
+    return hint ? `${hint}（${message}）` : message || `授权失败: ${code}`;
+}

package/dist/src/api/task-poller.d.ts

@@ -0,0 +1,38 @@
+import type { HubClient } from "./hub-client.js";
+export interface TaskResult {
+    task_id: string;
+    status: string;
+    progress?: number;
+    outputs?: unknown;
+    message?: string;
+    error?: unknown;
+    /** `gd-cli workflows run` 成功落盘后：本地交付目录 */
+    deliverable_dir?: string;
+    /** 与 deliverable_dir 同级的 zip 路径 */
+    deliverable_zip?: string;
+    deliverable_readme?: string;
+}
+interface ProgressInfo {
+    current: number;
+    total: number;
+    step_name: string;
+    status: string;
+    progress: number;
+}
+interface PollOptions {
+    timeout?: number;
+    outputDir?: string;
+    onProgress?: (progress: ProgressInfo) => void;
+}
+export declare class TaskPoller {
+    private client;
+    constructor(client: HubClient);
+    waitForCompletion(taskId: string, options?: PollOptions): Promise<TaskResult>;
+    /** 轮询时偶发 ECONNRESET（Server 热重载、瞬时崩溃）时重试若干次 */
+    private getTaskStatusWithRetry;
+    /**
+     * 轮询间隔策略：前 1 次 2s，2-5 次 3s，之后 5s
+     */
+    private getInterval;
+}
+export {};

package/dist/src/api/task-poller.js

@@ -0,0 +1,72 @@
+import { sleep } from "../utils/sleep.js";
+import { isTransientNetworkError } from "../utils/transient-network-error.js";
+export class TaskPoller {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    async waitForCompletion(taskId, options = {}) {
+        const timeout = (options.timeout ?? 600) * 1000;
+        const startTime = Date.now();
+        let pollCount = 0;
+        while (Date.now() - startTime < timeout) {
+            const result = await this.getTaskStatusWithRetry(taskId);
+            if (result.status === "completed") {
+                return {
+                    task_id: result.task_id,
+                    status: "completed",
+                    outputs: result.outputs,
+                };
+            }
+            if (result.status === "failed") {
+                return {
+                    task_id: result.task_id,
+                    status: "failed",
+                    error: result.error,
+                };
+            }
+            if (options.onProgress && result.current_step !== undefined) {
+                options.onProgress({
+                    current: result.current_step,
+                    total: result.total_steps ?? 0,
+                    step_name: result.step_name ?? "",
+                    status: result.status,
+                    progress: result.progress ?? 0,
+                });
+            }
+            pollCount++;
+            const interval = this.getInterval(pollCount);
+            await sleep(interval);
+        }
+        throw new Error(`任务超时 (${options.timeout}s): ${taskId}`);
+    }
+    /** 轮询时偶发 ECONNRESET（Server 热重载、瞬时崩溃）时重试若干次 */
+    async getTaskStatusWithRetry(taskId) {
+        const maxAttempts = 8;
+        let lastErr;
+        for (let attempt = 0; attempt < maxAttempts; attempt++) {
+            try {
+                return await this.client.get(`/tasks/${taskId}`);
+            }
+            catch (err) {
+                lastErr = err;
+                if (!isTransientNetworkError(err) || attempt === maxAttempts - 1) {
+                    throw err;
+                }
+                const backoff = Math.min(500 * (attempt + 1), 4000);
+                await sleep(backoff);
+            }
+        }
+        throw lastErr;
+    }
+    /**
+     * 轮询间隔策略：前 1 次 2s，2-5 次 3s，之后 5s
+     */
+    getInterval(pollCount) {
+        if (pollCount <= 1)
+            return 2000;
+        if (pollCount <= 5)
+            return 3000;
+        return 5000;
+    }
+}

package/dist/src/api/tool-invoker.d.ts

@@ -0,0 +1,12 @@
+import { HubClient } from "./hub-client.js";
+import type { TaskResult } from "./task-poller.js";
+interface InvokeOptions {
+    async?: boolean;
+    timeout?: number;
+}
+export declare class ToolInvoker {
+    private direct;
+    constructor(client?: HubClient);
+    invoke(toolName: string, params: Record<string, unknown>, options?: InvokeOptions): Promise<TaskResult>;
+}
+export {};

package/dist/src/api/tool-invoker.js

@@ -0,0 +1,11 @@
+import { DirectToolInvoker } from "./direct-tools.js";
+export class ToolInvoker {
+    direct;
+    constructor(client) {
+        void client;
+        this.direct = new DirectToolInvoker();
+    }
+    async invoke(toolName, params, options = {}) {
+        return this.direct.invoke(toolName, params, options);
+    }
+}

package/dist/src/api/usage-client.d.ts

@@ -0,0 +1,39 @@
+import { CredentialStoreV2 } from "../auth/credential-store-v2.js";
+declare const RIGHTS_OVERVIEW_ENDPOINT = "/trade/rights-overview";
+declare const GAODOU = "GAODOU";
+export interface UsageCredits {
+    unit: "gaodou";
+    goods_type_enum: string;
+    identifier: string;
+    total: number;
+    used: number;
+    wait: number;
+    surplus: number;
+}
+export interface UsageOverview {
+    status: "completed";
+    organization: {
+        id: string;
+        name: string | null;
+    };
+    credits: UsageCredits;
+    source: {
+        endpoint: typeof RIGHTS_OVERVIEW_ENDPOINT;
+        goods_type_enums: [typeof GAODOU];
+    };
+}
+interface DirectGetClient {
+    get<T>(path: string, options?: {
+        query?: Record<string, string | number | boolean | readonly (string | number | boolean)[]>;
+    }): Promise<T>;
+}
+export declare class UsageClient {
+    private store;
+    private client;
+    constructor(store?: CredentialStoreV2, client?: DirectGetClient);
+    getCreditsOverview(): Promise<UsageOverview>;
+    private fetchRightsOverview;
+    private readUsableCredentials;
+}
+export declare function normalizeUsageCredits(response: unknown): UsageCredits;
+export {};

package/dist/src/api/usage-client.js

@@ -0,0 +1,179 @@
+import { CredentialStoreV2 } from "../auth/credential-store-v2.js";
+import { CliUsageError } from "../core/output/cli-error.js";
+import { DirectApiClient, DirectApiError } from "./direct-client.js";
+const RIGHTS_OVERVIEW_ENDPOINT = "/trade/rights-overview";
+const GAODOU = "GAODOU";
+export class UsageClient {
+    store;
+    client;
+    constructor(store = new CredentialStoreV2(), client = new DirectApiClient(undefined, store)) {
+        this.store = store;
+        this.client = client;
+    }
+    async getCreditsOverview() {
+        const credentials = this.readUsableCredentials();
+        const response = await this.fetchRightsOverview();
+        return {
+            status: "completed",
+            organization: {
+                id: credentials.current_org.id,
+                name: credentials.current_org.name ?? null,
+            },
+            credits: normalizeUsageCredits(response),
+            source: {
+                endpoint: RIGHTS_OVERVIEW_ENDPOINT,
+                goods_type_enums: [GAODOU],
+            },
+        };
+    }
+    async fetchRightsOverview() {
+        try {
+            return await this.client.get(RIGHTS_OVERVIEW_ENDPOINT, {
+                query: { goods_type_enums: GAODOU },
+            });
+        }
+        catch (error) {
+            if (isUnsupportedAuthorizationType(error)) {
+                throw new CliUsageError({
+                    code: "USAGE_ENDPOINT_AUTH_UNSUPPORTED",
+                    type: "business",
+                    message: "稿豆余额接口暂不支持当前 AK/SK 网关鉴权。",
+                    hint: "需要在 gdcli BFF 增加代理接口 GET /api/cli/entitlements/credits 后重试。",
+                    retryable: false,
+                    next_steps: [
+                        "联系管理员确认 /trade/rights-overview 是否允许 AK/SK 签名访问",
+                        "或在 gdcli BFF 增加 GET /api/cli/entitlements/credits 代理接口",
+                    ],
+                    detail: {
+                        endpoint: RIGHTS_OVERVIEW_ENDPOINT,
+                        status_code: error.statusCode,
+                    },
+                });
+            }
+            throw error;
+        }
+    }
+    readUsableCredentials() {
+        const credentials = this.store.read();
+        if (!credentials) {
+            throw new CliUsageError({
+                code: "AUTH_MISSING",
+                type: "auth",
+                message: "未找到 AK/SK 凭证，请先登录。",
+                hint: "请先登录：gd-cli auth login",
+                retryable: false,
+                next_steps: ["gd-cli auth login"],
+            });
+        }
+        if (this.store.isAkExpired()) {
+            throw new CliUsageError({
+                code: "AUTH_EXPIRED",
+                type: "auth",
+                message: "AK/SK 凭证已过期，请重新登录。",
+                hint: "请重新登录：gd-cli auth login",
+                retryable: false,
+                next_steps: ["gd-cli auth login"],
+            });
+        }
+        if (!credentials.current_org?.id) {
+            throw new CliUsageError({
+                code: "ORG_REQUIRED",
+                type: "auth",
+                message: "当前未绑定组织，无法查询稿豆余额。",
+                hint: "请先切换组织：gd-cli org switch",
+                retryable: false,
+                next_steps: ["gd-cli org list", "gd-cli org switch"],
+            });
+        }
+        if (this.store.isBindExpired()) {
+            throw new CliUsageError({
+                code: "ORG_BIND_EXPIRED",
+                type: "auth",
+                message: "当前组织绑定已过期，无法查询稿豆余额。",
+                hint: "请重新切换组织：gd-cli org switch",
+                retryable: false,
+                next_steps: ["gd-cli org switch"],
+            });
+        }
+        return credentials;
+    }
+}
+export function normalizeUsageCredits(response) {
+    const record = findGaodouRecord(response) ?? {};
+    const total = numberField(record, "total");
+    const used = numberField(record, "used");
+    const wait = numberField(record, "wait");
+    return {
+        unit: "gaodou",
+        goods_type_enum: stringField(record, "goods_type_enum") ?? GAODOU,
+        identifier: stringField(record, "identifier") ?? GAODOU,
+        total,
+        used,
+        wait,
+        surplus: total - used,
+    };
+}
+function findGaodouRecord(value) {
+    const records = collectRecords(value);
+    return (records.find((record) => {
+        const goodsType = stringField(record, "goods_type_enum");
+        const identifier = stringField(record, "identifier");
+        return goodsType === GAODOU || identifier === GAODOU;
+    }) ??
+        records[0] ??
+        null);
+}
+function collectRecords(value) {
+    if (Array.isArray(value)) {
+        return value.flatMap((item) => collectRecords(item));
+    }
+    const record = objectRecord(value);
+    if (!record)
+        return [];
+    const nestedKeys = ["data", "list", "items", "records", "rights", "overview"];
+    const nestedRecords = nestedKeys.flatMap((key) => collectRecords(record[key]));
+    if (nestedRecords.length > 0)
+        return nestedRecords;
+    if ("total" in record ||
+        "used" in record ||
+        "wait" in record ||
+        "goods_type_enum" in record ||
+        "identifier" in record) {
+        return [record];
+    }
+    return [];
+}
+function objectRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+function stringField(record, key) {
+    const value = record[key];
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed ? trimmed : undefined;
+}
+function numberField(record, key) {
+    const value = record[key];
+    if (value === undefined || value === null || value === "")
+        return 0;
+    const numeric = Number(value);
+    if (!Number.isFinite(numeric)) {
+        throw new Error(`权益接口字段 ${key} 不是有效数字`);
+    }
+    return numeric;
+}
+function isUnsupportedAuthorizationType(error) {
+    if (!(error instanceof DirectApiError))
+        return false;
+    if (error.statusCode !== 401)
+        return false;
+    const text = typeof error.body === "string"
+        ? error.body
+        : error.body
+            ? JSON.stringify(error.body)
+            : error.message;
+    return /Unsupported Authorization Type/i.test(text);
+}

package/dist/src/auth/credential-store-v2.d.ts

@@ -0,0 +1,12 @@
+import type { CredentialsV2, StoredCredentials } from "../core/auth/types.js";
+export declare class CredentialStoreV2 {
+    private dir;
+    private file;
+    constructor(customDir?: string);
+    read(): CredentialsV2 | null;
+    readAny(): StoredCredentials | null;
+    write(credentials: CredentialsV2): void;
+    delete(): void;
+    isAkExpired(): boolean;
+    isBindExpired(): boolean;
+}