mslxdff 0.1.199 → 0.1.203

package/src/providers/globalworkbuddy/account-store.js

@@ -1,198 +1,198 @@
-// globalworkbuddy 账号落盘单一源：`auths/globalworkbuddy-<uid>.json`（0600 tmp+rename）+ `state.json` 双写。
-// 结构 vendor 自 `globalqwenwork/account-store.js`（同仓库的多租户先例，ADR-0041），三处命名空间独立：
-//   ① 文件前缀 `globalworkbuddy-`：与 `workbuddy-` **互不为前缀**，故两区凭据同目录也扫不串
-//      （反向亦然：`workbuddy-x.json` 不 startsWith("globalworkbuddy-")）；
-//   ② state 键 `providerConfigs.globalworkbuddy`；
-//   ③ 凭据目录 env 独立 `GLOBALWORKBUDDY_AUTH_DIR`（不与国内版 WORKBUDDY_AUTH_DIR 共享）。
-// ⚠ region 守卫：`state/provider-config.js:14-29` 的 `normalizeAuths` 会把缺失的 domain **默认成 www.codebuddy.cn**。
-//   所以这里写入时必须显式带 domain，读取时又按 `isGlobalDomain` 复核一遍 —— 否则一枚国内号一旦被误写进来，
-//   就会被当国际号发给 .ai（或反向），那是跨产品泄露凭据（参考仓库 auth.ts:377-395 对此直接抛错）。
-import { writeFileSync, mkdirSync, existsSync, renameSync, unlinkSync, readdirSync, readFileSync, chmodSync } from "node:fs";
-import { join, dirname } from "node:path";
-import { tmpdir } from "node:os";
-import { isTestEnv, defaultStateFile } from "../../state/store.js";
-import { DOMAIN, isGlobalDomain } from "./constants.js";
-
-const PROVIDER_ID = "globalworkbuddy";
-const FILE_PREFIX = "globalworkbuddy-";
-
-export function authDirFor({ explicit = "", testEnv = false, stateFile } = {}) {
-  if (explicit) return explicit;
-  if (testEnv) return join(tmpdir(), "mslxdff-test-auths-globalworkbuddy");
-  return join(dirname(stateFile), "auths");
-}
-
-export function resolveAuthDir() {
-  return authDirFor({
-    explicit: process.env.GLOBALWORKBUDDY_AUTH_DIR || "",
-    testEnv: isTestEnv(),
-    stateFile: defaultStateFile(),
-  });
-}
-
-/** 读取候选：主位置优先；显式 env 或测试环境不带 cwd 兜底（防把凭据写进任意目录，教训见 ADR-0025）。 */
-export function resolveAuthDirs() {
-  const primary = resolveAuthDir();
-  const cwdDir = join(process.cwd(), "auths");
-  const explicit = process.env.GLOBALWORKBUDDY_AUTH_DIR || "";
-  if (explicit || isTestEnv() || !cwdDir || cwdDir === primary) return [primary];
-  return [primary, cwdDir];
-}
-
-function parseDoc(fp) {
-  try {
-    const doc = JSON.parse(readFileSync(fp, "utf8"));
-    const uid = doc?.account?.uid;
-    if (!uid || !doc?.auth?.accessToken) return null;
-    return doc;
-  } catch { return null; }
-}
-
-/** 这枚凭据是否属于国际版（domain 判定；缺失即视为国内号，绝不默认放行）。 */
-export function isGlobalDoc(doc) {
-  return isGlobalDomain(doc?.auth?.domain || "");
-}
-
-/**
- * 列国际版账号。**非 global domain 的文件直接跳过并计数**，供上层打一条人话告警：
- * 表现上就是「CN 号被误写进本 provider」的唯一出口。
- */
-export function listAccountDocs({ dirs } = {}) {
-  const out = [];
-  const rejected = [];
-  const seen = new Set();
-  for (const dir of dirs || resolveAuthDirs()) {
-    let files = [];
-    try {
-      if (!existsSync(dir)) continue;
-      files = readdirSync(dir).filter((f) => f.startsWith(FILE_PREFIX) && f.endsWith(".json"));
-    } catch { continue; }
-    for (const f of files) {
-      const fp = join(dir, f);
-      const doc = parseDoc(fp);
-      if (!doc) continue;
-      const uid = String(doc.account.uid);
-      if (seen.has(uid)) continue;
-      if (!isGlobalDoc(doc)) { rejected.push({ uid, file: fp, domain: doc?.auth?.domain || "" }); continue; }
-      seen.add(uid);
-      out.push({ uid, file: fp, dir, doc });
-    }
-  }
-  return { docs: out, rejectedRegionMismatch: rejected };
-}
-
-/** 兼容旧调用面：只要 docs。 */
-export function listAccounts(opts) {
-  return listAccountDocs(opts).docs;
-}
-
-export function findAccountFile(uid) {
-  for (const { file } of listAccounts()) {
-    if (file.endsWith(`${FILE_PREFIX}${uid}.json`)) return file;
-  }
-  return null;
-}
-
-function writeAccountFile({ uid, accessToken, refreshToken = "", expiresAt = 0, domain = DOMAIN, enterpriseId = "", nickname = "" }) {
-  const authDir = resolveAuthDir();
-  mkdirSync(authDir, { recursive: true });
-  const doc = {
-    account: { uid, enterpriseId, nickname },
-    auth: { accessToken, refreshToken, expiresAt, domain },
-  };
-  const fp = join(authDir, `${FILE_PREFIX}${uid}.json`);
-  const tmp = `${fp}.tmp`;
-  writeFileSync(tmp, JSON.stringify(doc, null, 2), { mode: 0o600 });
-  try {
-    if (existsSync(fp)) { try { chmodSync(fp, 0o600); } catch {} unlinkSync(fp); }
-    renameSync(tmp, fp);
-  } catch {
-    writeFileSync(fp, JSON.stringify(doc, null, 2), { mode: 0o600 });
-    try { unlinkSync(tmp); } catch {} // 失败路径别把含凭据的 .tmp 留在盘上
-  }
-  try { chmodSync(fp, 0o600); } catch {}
-  return fp;
-}
-
-/** state 落盘：keys[i] 存裸 accessToken（对话直接当 Bearer 用，与国内版家族一致）。 */
-async function persistAccounts(accounts, file) {
-  const { loadProviderConfigs, saveProviderConfig } = await import("../../state.js");
-  const cfg = (loadProviderConfigs(file ? { file } : {})?.[PROVIDER_ID]) || {};
-  const keys = [...(Array.isArray(cfg.keys) ? cfg.keys : [])];
-  const auths = [...(Array.isArray(cfg.auths) ? cfg.auths : [])];
-  let updated = 0;
-  for (const acc of accounts) {
-    if (!acc?.uid || !acc?.accessToken) continue;
-    const row = {
-      uid: String(acc.uid),
-      domain: acc.domain || DOMAIN, // **必须显式**：normalizeAuths 缺省会填国内域
-      enterpriseId: acc.enterpriseId || "",
-      refreshToken: acc.refreshToken || "",
-    };
-    const idx = auths.findIndex((a) => String(a?.uid) === String(acc.uid));
-    if (idx >= 0) { keys[idx] = acc.accessToken; auths[idx] = row; updated += 1; }
-    else { keys.push(acc.accessToken); auths.push(row); }
-  }
-  saveProviderConfig(PROVIDER_ID, { baseUrl: cfg.baseUrl || "", keys, auths }, file ? { file } : {});
-  return { keys, auths, updated };
-}
-
-export async function saveGlobalworkbuddyAccount({ uid, accessToken, refreshToken = "", expiresAt = 0, domain = DOMAIN, enterpriseId = "", nickname = "", file } = {}) {
-  if (!uid || !accessToken) throw new Error("saveGlobalworkbuddyAccount: 缺少 uid/accessToken");
-  if (!isGlobalDomain(domain)) throw new Error(`saveGlobalworkbuddyAccount: domain=${domain || "(空)"} 不是国际版域，拒绝写入（防跨区串号）`);
-  const fp = writeAccountFile({ uid, accessToken, refreshToken, expiresAt, domain, enterpriseId, nickname });
-  const st = await persistAccounts([{ uid, accessToken, refreshToken, domain, enterpriseId, nickname }], file);
-  return { file: fp, accounts: st.keys.length, updated: st.updated > 0 };
-}
-
-/** 刷新后回写：accessToken 换新的、refreshToken 可能被上游一并轮换、expiresAt 取上游 expiresIn。 */
-export async function applyTokenRefresh({ uid, oldKey = "", accessToken, refreshToken = "", expiresAt = 0, domain = DOMAIN, enterpriseId = "", file } = {}) {
-  if (!uid || !accessToken) return { updated: false, accounts: 0, file: null };
-  const prevDocs = listAccounts();
-  const prev = prevDocs.find((d) => String(d.uid) === String(uid))?.doc || {};
-  const fp = writeAccountFile({
-    uid,
-    accessToken,
-    refreshToken: refreshToken || prev?.auth?.refreshToken || "",
-    expiresAt: expiresAt || 0,
-    domain: prev?.auth?.domain || domain,
-    enterpriseId: enterpriseId || prev?.account?.enterpriseId || "",
-    nickname: prev?.account?.nickname || "",
-  });
-  const st = await persistAccounts([{
-    uid,
-    accessToken,
-    refreshToken: refreshToken || prev?.auth?.refreshToken || "",
-    domain: prev?.auth?.domain || domain,
-    enterpriseId: enterpriseId || prev?.account?.enterpriseId || "",
-  }], file);
-  return { updated: Boolean(oldKey) || st.updated > 0, accounts: st.keys.length, file: fp };
-}
-
-/** 删号：扫全部候选目录，防旧副本「复活」（与国内版同纪律）。 */
-export async function removeAccount(uid) {
-  let removed = 0;
-  for (const dir of resolveAuthDirs()) {
-    const fp = join(dir, `${FILE_PREFIX}${uid}.json`);
-    try { if (existsSync(fp)) { unlinkSync(fp); removed += 1; } } catch {}
-  }
-  const { loadProviderConfigs, saveProviderConfig } = await import("../../state.js");
-  const cfg = loadProviderConfigs()?.[PROVIDER_ID] || {};
-  const rawKeys = Array.isArray(cfg.keys) ? cfg.keys : [];
-  const rawAuths = Array.isArray(cfg.auths) ? cfg.auths : [];
-  // keys[i] ↔ auths[i] 是平行数组：**必须成对摘**。按 uid 命中时整对丢弃，
-  // 否则会出现「keys 少一格、auths 少另一格」的错位串号（比留个孤儿更糟）。
-  const newKeys = [];
-  const newAuths = [];
-  const n = Math.max(rawKeys.length, rawAuths.length);
-  for (let i = 0; i < n; i++) {
-    const a = rawAuths[i];
-    if (a && String(a.uid) === String(uid)) continue;
-    if (rawKeys[i] !== undefined) newKeys.push(rawKeys[i]);
-    if (a !== undefined) newAuths.push(a);
-  }
-  saveProviderConfig(PROVIDER_ID, { baseUrl: cfg.baseUrl || "", keys: newKeys, auths: newAuths }, {});
-  return { removed, accounts: newAuths.length };
-}
-
-export const PROVIDER_ID_FOR_STORE = PROVIDER_ID;
+// globalworkbuddy 账号落盘单一源：`auths/globalworkbuddy-<uid>.json`（0600 tmp+rename）+ `state.json` 双写。
+// 结构 vendor 自 `globalqwenwork/account-store.js`（同仓库的多租户先例，ADR-0041），三处命名空间独立：
+//   ① 文件前缀 `globalworkbuddy-`：与 `workbuddy-` **互不为前缀**，故两区凭据同目录也扫不串
+//      （反向亦然：`workbuddy-x.json` 不 startsWith("globalworkbuddy-")）；
+//   ② state 键 `providerConfigs.globalworkbuddy`；
+//   ③ 凭据目录 env 独立 `GLOBALWORKBUDDY_AUTH_DIR`（不与国内版 WORKBUDDY_AUTH_DIR 共享）。
+// ⚠ region 守卫：`state/provider-config.js:14-29` 的 `normalizeAuths` 会把缺失的 domain **默认成 www.codebuddy.cn**。
+//   所以这里写入时必须显式带 domain，读取时又按 `isGlobalDomain` 复核一遍 —— 否则一枚国内号一旦被误写进来，
+//   就会被当国际号发给 .ai（或反向），那是跨产品泄露凭据（参考仓库 auth.ts:377-395 对此直接抛错）。
+import { writeFileSync, mkdirSync, existsSync, renameSync, unlinkSync, readdirSync, readFileSync, chmodSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { tmpdir } from "node:os";
+import { isTestEnv, defaultStateFile } from "../../state/store.js";
+import { DOMAIN, isGlobalDomain } from "./constants.js";
+
+const PROVIDER_ID = "globalworkbuddy";
+const FILE_PREFIX = "globalworkbuddy-";
+
+export function authDirFor({ explicit = "", testEnv = false, stateFile } = {}) {
+  if (explicit) return explicit;
+  if (testEnv) return join(tmpdir(), "mslxdff-test-auths-globalworkbuddy");
+  return join(dirname(stateFile), "auths");
+}
+
+export function resolveAuthDir() {
+  return authDirFor({
+    explicit: process.env.GLOBALWORKBUDDY_AUTH_DIR || "",
+    testEnv: isTestEnv(),
+    stateFile: defaultStateFile(),
+  });
+}
+
+/** 读取候选：主位置优先；显式 env 或测试环境不带 cwd 兜底（防把凭据写进任意目录，教训见 ADR-0025）。 */
+export function resolveAuthDirs() {
+  const primary = resolveAuthDir();
+  const cwdDir = join(process.cwd(), "auths");
+  const explicit = process.env.GLOBALWORKBUDDY_AUTH_DIR || "";
+  if (explicit || isTestEnv() || !cwdDir || cwdDir === primary) return [primary];
+  return [primary, cwdDir];
+}
+
+function parseDoc(fp) {
+  try {
+    const doc = JSON.parse(readFileSync(fp, "utf8"));
+    const uid = doc?.account?.uid;
+    if (!uid || !doc?.auth?.accessToken) return null;
+    return doc;
+  } catch { return null; }
+}
+
+/** 这枚凭据是否属于国际版（domain 判定；缺失即视为国内号，绝不默认放行）。 */
+export function isGlobalDoc(doc) {
+  return isGlobalDomain(doc?.auth?.domain || "");
+}
+
+/**
+ * 列国际版账号。**非 global domain 的文件直接跳过并计数**，供上层打一条人话告警：
+ * 表现上就是「CN 号被误写进本 provider」的唯一出口。
+ */
+export function listAccountDocs({ dirs } = {}) {
+  const out = [];
+  const rejected = [];
+  const seen = new Set();
+  for (const dir of dirs || resolveAuthDirs()) {
+    let files = [];
+    try {
+      if (!existsSync(dir)) continue;
+      files = readdirSync(dir).filter((f) => f.startsWith(FILE_PREFIX) && f.endsWith(".json"));
+    } catch { continue; }
+    for (const f of files) {
+      const fp = join(dir, f);
+      const doc = parseDoc(fp);
+      if (!doc) continue;
+      const uid = String(doc.account.uid);
+      if (seen.has(uid)) continue;
+      if (!isGlobalDoc(doc)) { rejected.push({ uid, file: fp, domain: doc?.auth?.domain || "" }); continue; }
+      seen.add(uid);
+      out.push({ uid, file: fp, dir, doc });
+    }
+  }
+  return { docs: out, rejectedRegionMismatch: rejected };
+}
+
+/** 兼容旧调用面：只要 docs。 */
+export function listAccounts(opts) {
+  return listAccountDocs(opts).docs;
+}
+
+export function findAccountFile(uid) {
+  for (const { file } of listAccounts()) {
+    if (file.endsWith(`${FILE_PREFIX}${uid}.json`)) return file;
+  }
+  return null;
+}
+
+function writeAccountFile({ uid, accessToken, refreshToken = "", expiresAt = 0, domain = DOMAIN, enterpriseId = "", nickname = "" }) {
+  const authDir = resolveAuthDir();
+  mkdirSync(authDir, { recursive: true });
+  const doc = {
+    account: { uid, enterpriseId, nickname },
+    auth: { accessToken, refreshToken, expiresAt, domain },
+  };
+  const fp = join(authDir, `${FILE_PREFIX}${uid}.json`);
+  const tmp = `${fp}.tmp`;
+  writeFileSync(tmp, JSON.stringify(doc, null, 2), { mode: 0o600 });
+  try {
+    if (existsSync(fp)) { try { chmodSync(fp, 0o600); } catch {} unlinkSync(fp); }
+    renameSync(tmp, fp);
+  } catch {
+    writeFileSync(fp, JSON.stringify(doc, null, 2), { mode: 0o600 });
+    try { unlinkSync(tmp); } catch {} // 失败路径别把含凭据的 .tmp 留在盘上
+  }
+  try { chmodSync(fp, 0o600); } catch {}
+  return fp;
+}
+
+/** state 落盘：keys[i] 存裸 accessToken（对话直接当 Bearer 用，与国内版家族一致）。 */
+async function persistAccounts(accounts, file) {
+  const { loadProviderConfigs, saveProviderConfig } = await import("../../state.js");
+  const cfg = (loadProviderConfigs(file ? { file } : {})?.[PROVIDER_ID]) || {};
+  const keys = [...(Array.isArray(cfg.keys) ? cfg.keys : [])];
+  const auths = [...(Array.isArray(cfg.auths) ? cfg.auths : [])];
+  let updated = 0;
+  for (const acc of accounts) {
+    if (!acc?.uid || !acc?.accessToken) continue;
+    const row = {
+      uid: String(acc.uid),
+      domain: acc.domain || DOMAIN, // **必须显式**：normalizeAuths 缺省会填国内域
+      enterpriseId: acc.enterpriseId || "",
+      refreshToken: acc.refreshToken || "",
+    };
+    const idx = auths.findIndex((a) => String(a?.uid) === String(acc.uid));
+    if (idx >= 0) { keys[idx] = acc.accessToken; auths[idx] = row; updated += 1; }
+    else { keys.push(acc.accessToken); auths.push(row); }
+  }
+  saveProviderConfig(PROVIDER_ID, { baseUrl: cfg.baseUrl || "", keys, auths }, file ? { file } : {});
+  return { keys, auths, updated };
+}
+
+export async function saveGlobalworkbuddyAccount({ uid, accessToken, refreshToken = "", expiresAt = 0, domain = DOMAIN, enterpriseId = "", nickname = "", file } = {}) {
+  if (!uid || !accessToken) throw new Error("saveGlobalworkbuddyAccount: 缺少 uid/accessToken");
+  if (!isGlobalDomain(domain)) throw new Error(`saveGlobalworkbuddyAccount: domain=${domain || "(空)"} 不是国际版域，拒绝写入（防跨区串号）`);
+  const fp = writeAccountFile({ uid, accessToken, refreshToken, expiresAt, domain, enterpriseId, nickname });
+  const st = await persistAccounts([{ uid, accessToken, refreshToken, domain, enterpriseId, nickname }], file);
+  return { file: fp, accounts: st.keys.length, updated: st.updated > 0 };
+}
+
+/** 刷新后回写：accessToken 换新的、refreshToken 可能被上游一并轮换、expiresAt 取上游 expiresIn。 */
+export async function applyTokenRefresh({ uid, oldKey = "", accessToken, refreshToken = "", expiresAt = 0, domain = DOMAIN, enterpriseId = "", file } = {}) {
+  if (!uid || !accessToken) return { updated: false, accounts: 0, file: null };
+  const prevDocs = listAccounts();
+  const prev = prevDocs.find((d) => String(d.uid) === String(uid))?.doc || {};
+  const fp = writeAccountFile({
+    uid,
+    accessToken,
+    refreshToken: refreshToken || prev?.auth?.refreshToken || "",
+    expiresAt: expiresAt || 0,
+    domain: prev?.auth?.domain || domain,
+    enterpriseId: enterpriseId || prev?.account?.enterpriseId || "",
+    nickname: prev?.account?.nickname || "",
+  });
+  const st = await persistAccounts([{
+    uid,
+    accessToken,
+    refreshToken: refreshToken || prev?.auth?.refreshToken || "",
+    domain: prev?.auth?.domain || domain,
+    enterpriseId: enterpriseId || prev?.account?.enterpriseId || "",
+  }], file);
+  return { updated: Boolean(oldKey) || st.updated > 0, accounts: st.keys.length, file: fp };
+}
+
+/** 删号：扫全部候选目录，防旧副本「复活」（与国内版同纪律）。 */
+export async function removeAccount(uid) {
+  let removed = 0;
+  for (const dir of resolveAuthDirs()) {
+    const fp = join(dir, `${FILE_PREFIX}${uid}.json`);
+    try { if (existsSync(fp)) { unlinkSync(fp); removed += 1; } } catch {}
+  }
+  const { loadProviderConfigs, saveProviderConfig } = await import("../../state.js");
+  const cfg = loadProviderConfigs()?.[PROVIDER_ID] || {};
+  const rawKeys = Array.isArray(cfg.keys) ? cfg.keys : [];
+  const rawAuths = Array.isArray(cfg.auths) ? cfg.auths : [];
+  // keys[i] ↔ auths[i] 是平行数组：**必须成对摘**。按 uid 命中时整对丢弃，
+  // 否则会出现「keys 少一格、auths 少另一格」的错位串号（比留个孤儿更糟）。
+  const newKeys = [];
+  const newAuths = [];
+  const n = Math.max(rawKeys.length, rawAuths.length);
+  for (let i = 0; i < n; i++) {
+    const a = rawAuths[i];
+    if (a && String(a.uid) === String(uid)) continue;
+    if (rawKeys[i] !== undefined) newKeys.push(rawKeys[i]);
+    if (a !== undefined) newAuths.push(a);
+  }
+  saveProviderConfig(PROVIDER_ID, { baseUrl: cfg.baseUrl || "", keys: newKeys, auths: newAuths }, {});
+  return { removed, accounts: newAuths.length };
+}
+
+export const PROVIDER_ID_FOR_STORE = PROVIDER_ID;

package/src/providers/globalworkbuddy/auth.js

@@ -1,97 +1,97 @@
-// 国际版 token 生命周期。与国内版 `workbuddy/auth.js` 有两处**有意不同**（都是取证换来的）：
-//  ① 刷新响应里的 `domain` / `expiresIn` **要采纳**（国内版只取 token 对，等于把上游的账号迁移信息丢掉）；
-//  ② 刷新请求**不带 Bearer**（见 `headers.js` 通道隔离），国内版带着可能已过期的 accessToken 打刷新口。
-// ⚠ 只认「明确失败」：拿不到新 accessToken 一律返回 null 交给上层，绝不抛穿对话链路。
-import { compatFetch, timeoutSignal } from "../../compat.js";
-import { joinUrl } from "../base.js";
-import { BASE, REFRESH_PATH, DOMAIN, JSON_TIMEOUT_MS, REFRESH_MARGIN_MS } from "./constants.js";
-import { refreshHeaders } from "./headers.js";
-import { classifyUpstreamError } from "./errors.js";
-
-/** JWT `exp`（秒）；非 JWT/解不出一律 0 = 「不主动刷新」，比猜一个安全。 */
-export function decodeJwtExp(token) {
-  try {
-    const payload = String(token || "").split(".")[1];
-    if (!payload) return 0;
-    let b64 = payload.replace(/-/g, "+").replace(/_/g, "/");
-    const pad = b64.length % 4;
-    if (pad) b64 += "=".repeat(4 - pad);
-    const json = JSON.parse(Buffer.from(b64, "base64").toString("utf8"));
-    return Number(json.exp || 0);
-  } catch { return 0; }
-}
-
-export function createAuthService({
-  baseUrl = BASE,
-  fetchImpl,
-  clock = Date.now,
-  dispatcher,
-  applyRefresh,          // 注入落盘（测试用假实现）；缺省走 account-store.applyTokenRefresh
-  marginMs = REFRESH_MARGIN_MS,
-} = {}) {
-  if (!fetchImpl) fetchImpl = compatFetch;
-  const resolvedBase = String(baseUrl || BASE).trim().replace(/\/+$/, "");
-  const inflight = new Map(); // uid → Promise，同一号并发只刷一次
-
-  async function doRefresh(cred) {
-    const url = joinUrl(resolvedBase, REFRESH_PATH);
-    try {
-      const opts = { method: "POST", headers: refreshHeaders(cred), body: "{}", signal: timeoutSignal(JSON_TIMEOUT_MS) };
-      if (dispatcher) opts.dispatcher = dispatcher;
-      const res = await fetchImpl(url, opts);
-      const text = await res.text();
-      let j;
-      try { j = JSON.parse(text); } catch { return null; }
-      if (j.code !== 0 || !j.data?.accessToken) {
-        // 刷新口自己说「会话死了」才算真死；网络/5xx 之类返回 null 让上层换号，别把 refreshToken 烧光
-        const cls = classifyUpstreamError(res.status, text);
-        if (cls.kind !== "session_dead") {
-          try { console.error(`[globalworkbuddy] refresh 被拒（${cls.code || cls.kind}），保留凭据不换思路重试`); } catch {}
-        }
-        return null;
-      }
-      const out = {
-        accessToken: String(j.data.accessToken),
-        refreshToken: String(j.data.refreshToken || cred.refreshToken || ""),
-        expiresAt: Number(j.data.expiresIn) > 0 ? Math.floor(Date.now() / 1000) + Number(j.data.expiresIn) : 0,
-        domain: String(j.data.domain || cred.domain || DOMAIN),
-      };
-      const persist = applyRefresh || (await import("./account-store.js")).applyTokenRefresh;
-      try {
-        await persist({ uid: cred.uid, oldKey: cred.accessToken, accessToken: out.accessToken, refreshToken: out.refreshToken, expiresAt: out.expiresAt, domain: out.domain, enterpriseId: cred.enterpriseId || "" });
-      } catch (err) {
-        console.error(`[globalworkbuddy] token 落盘失败（刷新已成功，重启将丢失）: ${String(err?.message || err).slice(0, 200)}`);
-      }
-      return out;
-    } catch { return null; }
-  }
-
-  /** 返回新 accessToken（失败 null）。并发去重按 uid。 */
-  async function refreshTokenFor(cred) {
-    if (!cred?.uid || !cred?.refreshToken) return null;
-    const key = String(cred.uid);
-    if (inflight.has(key)) {
-      try { return (await inflight.get(key))?.accessToken || null; } catch { return null; }
-    }
-    const p = doRefresh(cred);
-    inflight.set(key, p);
-    try {
-      const r = await p;
-      return r?.accessToken || null;
-    } finally { inflight.delete(key); }
-  }
-
-  /** 临期（<margin 且未过期太久）先刷，省掉一次 401 往返。 */
-  function maybeProactiveRefresh(cred) {
-    try {
-      const exp = decodeJwtExp(cred?.accessToken);
-      if (!exp) return;
-      const remain = exp * 1000 - clock();
-      if (remain < marginMs && remain > -60 * 60 * 1000) {
-        void refreshTokenFor(cred).catch(() => {});
-      }
-    } catch {}
-  }
-
-  return { refreshTokenFor, maybeProactiveRefresh, decodeJwtExp, _inflight: inflight };
-}
+// 国际版 token 生命周期。与国内版 `workbuddy/auth.js` 有两处**有意不同**（都是取证换来的）：
+//  ① 刷新响应里的 `domain` / `expiresIn` **要采纳**（国内版只取 token 对，等于把上游的账号迁移信息丢掉）；
+//  ② 刷新请求**不带 Bearer**（见 `headers.js` 通道隔离），国内版带着可能已过期的 accessToken 打刷新口。
+// ⚠ 只认「明确失败」：拿不到新 accessToken 一律返回 null 交给上层，绝不抛穿对话链路。
+import { compatFetch, timeoutSignal } from "../../compat.js";
+import { joinUrl } from "../base.js";
+import { BASE, REFRESH_PATH, DOMAIN, JSON_TIMEOUT_MS, REFRESH_MARGIN_MS } from "./constants.js";
+import { refreshHeaders } from "./headers.js";
+import { classifyUpstreamError } from "./errors.js";
+
+/** JWT `exp`（秒）；非 JWT/解不出一律 0 = 「不主动刷新」，比猜一个安全。 */
+export function decodeJwtExp(token) {
+  try {
+    const payload = String(token || "").split(".")[1];
+    if (!payload) return 0;
+    let b64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const pad = b64.length % 4;
+    if (pad) b64 += "=".repeat(4 - pad);
+    const json = JSON.parse(Buffer.from(b64, "base64").toString("utf8"));
+    return Number(json.exp || 0);
+  } catch { return 0; }
+}
+
+export function createAuthService({
+  baseUrl = BASE,
+  fetchImpl,
+  clock = Date.now,
+  dispatcher,
+  applyRefresh,          // 注入落盘（测试用假实现）；缺省走 account-store.applyTokenRefresh
+  marginMs = REFRESH_MARGIN_MS,
+} = {}) {
+  if (!fetchImpl) fetchImpl = compatFetch;
+  const resolvedBase = String(baseUrl || BASE).trim().replace(/\/+$/, "");
+  const inflight = new Map(); // uid → Promise，同一号并发只刷一次
+
+  async function doRefresh(cred) {
+    const url = joinUrl(resolvedBase, REFRESH_PATH);
+    try {
+      const opts = { method: "POST", headers: refreshHeaders(cred), body: "{}", signal: timeoutSignal(JSON_TIMEOUT_MS) };
+      if (dispatcher) opts.dispatcher = dispatcher;
+      const res = await fetchImpl(url, opts);
+      const text = await res.text();
+      let j;
+      try { j = JSON.parse(text); } catch { return null; }
+      if (j.code !== 0 || !j.data?.accessToken) {
+        // 刷新口自己说「会话死了」才算真死；网络/5xx 之类返回 null 让上层换号，别把 refreshToken 烧光
+        const cls = classifyUpstreamError(res.status, text);
+        if (cls.kind !== "session_dead") {
+          try { console.error(`[globalworkbuddy] refresh 被拒（${cls.code || cls.kind}），保留凭据不换思路重试`); } catch {}
+        }
+        return null;
+      }
+      const out = {
+        accessToken: String(j.data.accessToken),
+        refreshToken: String(j.data.refreshToken || cred.refreshToken || ""),
+        expiresAt: Number(j.data.expiresIn) > 0 ? Math.floor(Date.now() / 1000) + Number(j.data.expiresIn) : 0,
+        domain: String(j.data.domain || cred.domain || DOMAIN),
+      };
+      const persist = applyRefresh || (await import("./account-store.js")).applyTokenRefresh;
+      try {
+        await persist({ uid: cred.uid, oldKey: cred.accessToken, accessToken: out.accessToken, refreshToken: out.refreshToken, expiresAt: out.expiresAt, domain: out.domain, enterpriseId: cred.enterpriseId || "" });
+      } catch (err) {
+        console.error(`[globalworkbuddy] token 落盘失败（刷新已成功，重启将丢失）: ${String(err?.message || err).slice(0, 200)}`);
+      }
+      return out;
+    } catch { return null; }
+  }
+
+  /** 返回新 accessToken（失败 null）。并发去重按 uid。 */
+  async function refreshTokenFor(cred) {
+    if (!cred?.uid || !cred?.refreshToken) return null;
+    const key = String(cred.uid);
+    if (inflight.has(key)) {
+      try { return (await inflight.get(key))?.accessToken || null; } catch { return null; }
+    }
+    const p = doRefresh(cred);
+    inflight.set(key, p);
+    try {
+      const r = await p;
+      return r?.accessToken || null;
+    } finally { inflight.delete(key); }
+  }
+
+  /** 临期（<margin 且未过期太久）先刷，省掉一次 401 往返。 */
+  function maybeProactiveRefresh(cred) {
+    try {
+      const exp = decodeJwtExp(cred?.accessToken);
+      if (!exp) return;
+      const remain = exp * 1000 - clock();
+      if (remain < marginMs && remain > -60 * 60 * 1000) {
+        void refreshTokenFor(cred).catch(() => {});
+      }
+    } catch {}
+  }
+
+  return { refreshTokenFor, maybeProactiveRefresh, decodeJwtExp, _inflight: inflight };
+}