mslxdff 0.1.203 → 0.1.208

package/src/providers/codearts/models.js

@@ -1,182 +1,182 @@
-// 模型目录（按账号隔离）+ 三路发现（agent-center / builtin / 福利网关）+ 福利 claim。
-// 福利是按账号授予的：目录按 userId 存，isBenefit 只信「发起请求的账号」的目录；
-// 目录里没有的模型回退冷启动种子（少带 maas_type 头 = InferHub.002002009.404）。
-// 算法对齐 HITZY2002/codearts2api internal/upstream/models.go。
-import {
-  SNAP_BASE, BENEFIT_HOST, EP_MODEL_BUILTIN, EP_AGENT_LIST, EP_AGENT_DETAIL,
-  EP_BENEFIT_CONFIG, EP_BENEFIT_CLAIM,
-  SEED_BENEFIT_MODELS, SEED_KNOWN_MODELS, CATALOG_TTL_MS,
-} from "./const.js";
-import { signRequest } from "./sign.js";
-import { compatFetch } from "../../compat.js";
-
-const lower = (s) => String(s || "").trim().toLowerCase();
-
-export function createCatalog() {
-  const known = new Map(); // lower → 精确 ID（种子 + 已发现，大小写归一单点）
-  for (const id of [...SEED_KNOWN_MODELS, ...SEED_BENEFIT_MODELS]) {
-    if (!known.has(lower(id))) known.set(lower(id), id);
-  }
-  const accounts = new Map(); // userId → {models, benefit:Set, knows:Set, lastBenefit:Map, fetched}
-
-  function setAccount(userId, models, { keepBenefit = false, now = Date.now() } = {}) {
-    if (!userId) return;
-    const prev = accounts.get(userId);
-    const ac = { models: [], benefit: new Set(), knows: new Set(), lastBenefit: prev ? new Map(prev.lastBenefit) : new Map(), fetched: now };
-    for (const m of models || []) {
-      if (!m?.id) continue;
-      const key = lower(m.id);
-      ac.knows.add(key);
-      if (m.benefit) { ac.benefit.add(key); ac.lastBenefit.set(key, m); }
-      if (!known.has(key) || m.id !== key) known.set(key, m.id);
-      ac.models.push(m);
-    }
-    if (keepBenefit) {
-      // 福利来源失败但内置成功：上轮福利条目只要内置没明确登记（转正）就保留标记
-      for (const [key, mi] of ac.lastBenefit) {
-        if (ac.knows.has(key)) continue;
-        ac.benefit.add(key);
-        ac.knows.add(key);
-        ac.models.push(mi);
-        if (!known.has(key) || mi.id !== key) known.set(key, mi.id);
-      }
-      ac.models.sort((a, b) => (lower(a.id) < lower(b.id) ? -1 : lower(a.id) > lower(b.id) ? 1 : (a.id < b.id ? -1 : 1)));
-    }
-    accounts.set(userId, ac);
-  }
-
-  // 判定顺序：账号目录标了福利 → true；目录里有但没标 → false（已转正）；目录没有 → 种子兜底。
-  function isBenefit(userId, model) {
-    const key = lower(model);
-    if (!key) return false;
-    const ac = accounts.get(userId);
-    if (ac) {
-      if (ac.benefit.has(key)) return true;
-      if (ac.knows.has(key)) return false;
-    }
-    return SEED_BENEFIT_MODELS.some((m) => lower(m) === key);
-  }
-
-  function canonical(model) {
-    const exact = known.get(lower(model));
-    return exact || null;
-  }
-  function accountModels(userId) {
-    const ac = accounts.get(userId);
-    return ac ? [...ac.models] : [];
-  }
-  function isStale(userId, now = Date.now(), ttlMs = CATALOG_TTL_MS) {
-    const ac = accounts.get(userId);
-    return !ac || now - ac.fetched >= ttlMs;
-  }
-  return { setAccount, isBenefit, canonical, accountModels, isStale };
-}
-
-/** 多路合并：按小写 ID 去重，福利标记取或，参数更全/精确大小写优先，按小写 ID 排序。 */
-export function mergeModels(sets) {
-  const merged = new Map();
-  for (const set of sets || []) {
-    for (const m of set || []) {
-      if (!m?.id) continue;
-      const key = lower(m.id);
-      const cur = merged.get(key);
-      if (!cur) { merged.set(key, { ...m }); continue; }
-      const keep = (m.contextWindow > 0 && !cur.contextWindow) || (m.id !== lower(m.id) && cur.id === lower(cur.id)) ? m : cur;
-      const drop = keep === m ? cur : m;
-      merged.set(key, {
-        ...keep,
-        benefit: !!(keep.benefit || drop.benefit),
-        name: keep.name || drop.name || "",
-        contextWindow: keep.contextWindow || drop.contextWindow || 0,
-        maxTokens: keep.maxTokens || drop.maxTokens || 0,
-        desc: keep.desc || drop.desc || "",
-      });
-    }
-  }
-  return [...merged.values()].sort((a, b) => (lower(a.id) < lower(b.id) ? -1 : lower(a.id) > lower(b.id) ? 1 : (a.id < b.id ? -1 : 1)));
-}
-
-/** 签名 GET 并解析 JSON（Agent-Type 可选；空 body 签名 = sha256("")）。 */
-export async function signedGetJson({ url, cred, agentType, fetchImpl }) {
-  const doFetch = fetchImpl || compatFetch;
-  const headers = { "content-type": "application/json", "x-language": "zh-cn" };
-  if (agentType) headers["agent-type"] = agentType;
-  if (cred?.securityToken) headers["x-security-token"] = cred.securityToken;
-  const { headers: signed } = signRequest({ method: "GET", url, headers, body: "", cred });
-  const res = await doFetch(url, { method: "GET", headers: signed });
-  const raw = await res.text().catch(() => "");
-  if (res.status >= 400) throw new Error(`http ${res.status}: ${String(raw).slice(0, 200)}`);
-  try { return JSON.parse(raw); } catch { throw new Error(`non-JSON body: ${String(raw).slice(0, 120)}`); }
-}
-
-/** 幂等领取限时福利（官方客户端打开模型菜单即调用；error_code "0000" 视为成功）。 */
-export async function claimBenefit({ cred, benefitHost = BENEFIT_HOST, fetchImpl }) {
-  const doFetch = fetchImpl || compatFetch;
-  const url = benefitHost + EP_BENEFIT_CLAIM;
-  const body = "{}";
-  const headers = { "content-type": "application/json", "x-language": "zh-cn" };
-  if (cred?.securityToken) headers["x-security-token"] = cred.securityToken;
-  const { headers: signed } = signRequest({ method: "POST", url, headers, body, cred });
-  const res = await doFetch(url, { method: "POST", headers: signed, body });
-  const raw = await res.text().catch(() => "");
-  if (res.status >= 400) throw new Error(`claim http ${res.status}: ${String(raw).slice(0, 200)}`);
-  const json = JSON.parse(raw);
-  if (String(json?.error_code || "") !== "0000") throw new Error(`claim failed: error_code=${json?.error_code} msg=${json?.error_msg}`);
-  return json;
-}
-
-const toModelInfo = (m, { benefit = false } = {}) => {
-  const id = m?.model_id || m?.model_name || m?.modelAlias || "";
-  if (!id) return null;
-  return {
-    id: String(id),
-    name: String(m?.model_name || id),
-    contextWindow: Number(m?.context_window) || 0,
-    maxTokens: Number(m?.max_tokens) || 0,
-    benefit,
-    desc: String(m?.model_desc || ""),
-  };
-};
-
-/** 三路发现（任一路失败不阻断）→ {models, builtinOk, benefitOk, agentOk}。 */
-export async function discoverAccountModels({ account, snapBase = SNAP_BASE, benefitHost = BENEFIT_HOST, autoClaim = true, fetchImpl } = {}) {
-  const cred = { accessKeyId: account.accessKeyId, secretAccessKey: account.secretAccessKey, securityToken: account.securityToken };
-  const sets = [];
-  let agentOk = false, builtinOk = false, benefitOk = false;
-
-  // 1) agent-center：useragents 找 CodeAgent → detail.gpts.models
-  try {
-    const list = await signedGetJson({ url: `${snapBase}${EP_AGENT_LIST}?offset=0&limit=100&is_primary_agent=true`, cred, agentType: "AgentCenter", fetchImpl });
-    const agents = Array.isArray(list?.agents) ? list.agents : [];
-    const pick = agents.find((a) => a?.agent_name === "CodeAgent" && a?.alias?.alias_zh_cn === "智能体" && a?.show_in_ide)
-      || agents.find((a) => a?.is_primary_agent) || agents[0];
-    if (pick?.agent_id) {
-      const detail = await signedGetJson({ url: `${snapBase}${EP_AGENT_DETAIL}?agent_id=${encodeURIComponent(pick.agent_id)}`, cred, agentType: "AgentCenter", fetchImpl });
-      const models = (Array.isArray(detail?.gpts?.models) ? detail.gpts.models : [])
-        .map((m) => toModelInfo({ model_id: m?.model_id, model_name: m?.model_name || m?.model_alias, context_window: m?.model_parameters?.context_window, max_tokens: m?.model_parameters?.max_tokens, model_desc: m?.model_parameters?.model_desc }))
-        .filter(Boolean);
-      if (models.length) { sets.push(models); agentOk = true; }
-    }
-  } catch { /* agent 路失败不阻断 */ }
-
-  // 2) 内置模型（Agent-Type: PromptCenter）
-  try {
-    const json = await signedGetJson({ url: `${snapBase}${EP_MODEL_BUILTIN}`, cred, agentType: "PromptCenter", fetchImpl });
-    const models = (Array.isArray(json?.builtinModels) ? json.builtinModels : []).map((m) => toModelInfo(m)).filter(Boolean);
-    if (models.length) { sets.push(models); builtinOk = true; }
-  } catch { /* builtin 失败不阻断 */ }
-
-  // 3) 福利网关（先幂等 claim 再拉目录；error_code!=0000 视为该来源失败）
-  try {
-    if (autoClaim) { try { await claimBenefit({ cred, benefitHost, fetchImpl }); } catch { /* 未开通福利套餐时 claim 可能报错，继续拉目录 */ } }
-    const json = await signedGetJson({ url: benefitHost + EP_BENEFIT_CONFIG, cred, fetchImpl });
-    if (String(json?.error_code || "") === "0000") {
-      const models = (Array.isArray(json?.result?.models) ? json.result.models : []).map((m) => toModelInfo(m, { benefit: true })).filter(Boolean);
-      if (models.length) { sets.push(models); benefitOk = true; }
-    }
-  } catch { /* benefit 失败不阻断 */ }
-
-  const models = mergeModels(sets);
-  if (!models.length) throw new Error("codearts models api returned empty list");
-  return { models, agentOk, builtinOk, benefitOk };
-}
+// 模型目录（按账号隔离）+ 三路发现（agent-center / builtin / 福利网关）+ 福利 claim。
+// 福利是按账号授予的：目录按 userId 存，isBenefit 只信「发起请求的账号」的目录；
+// 目录里没有的模型回退冷启动种子（少带 maas_type 头 = InferHub.002002009.404）。
+// 算法对齐 HITZY2002/codearts2api internal/upstream/models.go。
+import {
+  SNAP_BASE, BENEFIT_HOST, EP_MODEL_BUILTIN, EP_AGENT_LIST, EP_AGENT_DETAIL,
+  EP_BENEFIT_CONFIG, EP_BENEFIT_CLAIM,
+  SEED_BENEFIT_MODELS, SEED_KNOWN_MODELS, CATALOG_TTL_MS,
+} from "./const.js";
+import { signRequest } from "./sign.js";
+import { compatFetch } from "../../compat.js";
+
+const lower = (s) => String(s || "").trim().toLowerCase();
+
+export function createCatalog() {
+  const known = new Map(); // lower → 精确 ID（种子 + 已发现，大小写归一单点）
+  for (const id of [...SEED_KNOWN_MODELS, ...SEED_BENEFIT_MODELS]) {
+    if (!known.has(lower(id))) known.set(lower(id), id);
+  }
+  const accounts = new Map(); // userId → {models, benefit:Set, knows:Set, lastBenefit:Map, fetched}
+
+  function setAccount(userId, models, { keepBenefit = false, now = Date.now() } = {}) {
+    if (!userId) return;
+    const prev = accounts.get(userId);
+    const ac = { models: [], benefit: new Set(), knows: new Set(), lastBenefit: prev ? new Map(prev.lastBenefit) : new Map(), fetched: now };
+    for (const m of models || []) {
+      if (!m?.id) continue;
+      const key = lower(m.id);
+      ac.knows.add(key);
+      if (m.benefit) { ac.benefit.add(key); ac.lastBenefit.set(key, m); }
+      if (!known.has(key) || m.id !== key) known.set(key, m.id);
+      ac.models.push(m);
+    }
+    if (keepBenefit) {
+      // 福利来源失败但内置成功：上轮福利条目只要内置没明确登记（转正）就保留标记
+      for (const [key, mi] of ac.lastBenefit) {
+        if (ac.knows.has(key)) continue;
+        ac.benefit.add(key);
+        ac.knows.add(key);
+        ac.models.push(mi);
+        if (!known.has(key) || mi.id !== key) known.set(key, mi.id);
+      }
+      ac.models.sort((a, b) => (lower(a.id) < lower(b.id) ? -1 : lower(a.id) > lower(b.id) ? 1 : (a.id < b.id ? -1 : 1)));
+    }
+    accounts.set(userId, ac);
+  }
+
+  // 判定顺序：账号目录标了福利 → true；目录里有但没标 → false（已转正）；目录没有 → 种子兜底。
+  function isBenefit(userId, model) {
+    const key = lower(model);
+    if (!key) return false;
+    const ac = accounts.get(userId);
+    if (ac) {
+      if (ac.benefit.has(key)) return true;
+      if (ac.knows.has(key)) return false;
+    }
+    return SEED_BENEFIT_MODELS.some((m) => lower(m) === key);
+  }
+
+  function canonical(model) {
+    const exact = known.get(lower(model));
+    return exact || null;
+  }
+  function accountModels(userId) {
+    const ac = accounts.get(userId);
+    return ac ? [...ac.models] : [];
+  }
+  function isStale(userId, now = Date.now(), ttlMs = CATALOG_TTL_MS) {
+    const ac = accounts.get(userId);
+    return !ac || now - ac.fetched >= ttlMs;
+  }
+  return { setAccount, isBenefit, canonical, accountModels, isStale };
+}
+
+/** 多路合并：按小写 ID 去重，福利标记取或，参数更全/精确大小写优先，按小写 ID 排序。 */
+export function mergeModels(sets) {
+  const merged = new Map();
+  for (const set of sets || []) {
+    for (const m of set || []) {
+      if (!m?.id) continue;
+      const key = lower(m.id);
+      const cur = merged.get(key);
+      if (!cur) { merged.set(key, { ...m }); continue; }
+      const keep = (m.contextWindow > 0 && !cur.contextWindow) || (m.id !== lower(m.id) && cur.id === lower(cur.id)) ? m : cur;
+      const drop = keep === m ? cur : m;
+      merged.set(key, {
+        ...keep,
+        benefit: !!(keep.benefit || drop.benefit),
+        name: keep.name || drop.name || "",
+        contextWindow: keep.contextWindow || drop.contextWindow || 0,
+        maxTokens: keep.maxTokens || drop.maxTokens || 0,
+        desc: keep.desc || drop.desc || "",
+      });
+    }
+  }
+  return [...merged.values()].sort((a, b) => (lower(a.id) < lower(b.id) ? -1 : lower(a.id) > lower(b.id) ? 1 : (a.id < b.id ? -1 : 1)));
+}
+
+/** 签名 GET 并解析 JSON（Agent-Type 可选；空 body 签名 = sha256("")）。 */
+export async function signedGetJson({ url, cred, agentType, fetchImpl }) {
+  const doFetch = fetchImpl || compatFetch;
+  const headers = { "content-type": "application/json", "x-language": "zh-cn" };
+  if (agentType) headers["agent-type"] = agentType;
+  if (cred?.securityToken) headers["x-security-token"] = cred.securityToken;
+  const { headers: signed } = signRequest({ method: "GET", url, headers, body: "", cred });
+  const res = await doFetch(url, { method: "GET", headers: signed });
+  const raw = await res.text().catch(() => "");
+  if (res.status >= 400) throw new Error(`http ${res.status}: ${String(raw).slice(0, 200)}`);
+  try { return JSON.parse(raw); } catch { throw new Error(`non-JSON body: ${String(raw).slice(0, 120)}`); }
+}
+
+/** 幂等领取限时福利（官方客户端打开模型菜单即调用；error_code "0000" 视为成功）。 */
+export async function claimBenefit({ cred, benefitHost = BENEFIT_HOST, fetchImpl }) {
+  const doFetch = fetchImpl || compatFetch;
+  const url = benefitHost + EP_BENEFIT_CLAIM;
+  const body = "{}";
+  const headers = { "content-type": "application/json", "x-language": "zh-cn" };
+  if (cred?.securityToken) headers["x-security-token"] = cred.securityToken;
+  const { headers: signed } = signRequest({ method: "POST", url, headers, body, cred });
+  const res = await doFetch(url, { method: "POST", headers: signed, body });
+  const raw = await res.text().catch(() => "");
+  if (res.status >= 400) throw new Error(`claim http ${res.status}: ${String(raw).slice(0, 200)}`);
+  const json = JSON.parse(raw);
+  if (String(json?.error_code || "") !== "0000") throw new Error(`claim failed: error_code=${json?.error_code} msg=${json?.error_msg}`);
+  return json;
+}
+
+const toModelInfo = (m, { benefit = false } = {}) => {
+  const id = m?.model_id || m?.model_name || m?.modelAlias || "";
+  if (!id) return null;
+  return {
+    id: String(id),
+    name: String(m?.model_name || id),
+    contextWindow: Number(m?.context_window) || 0,
+    maxTokens: Number(m?.max_tokens) || 0,
+    benefit,
+    desc: String(m?.model_desc || ""),
+  };
+};
+
+/** 三路发现（任一路失败不阻断）→ {models, builtinOk, benefitOk, agentOk}。 */
+export async function discoverAccountModels({ account, snapBase = SNAP_BASE, benefitHost = BENEFIT_HOST, autoClaim = true, fetchImpl } = {}) {
+  const cred = { accessKeyId: account.accessKeyId, secretAccessKey: account.secretAccessKey, securityToken: account.securityToken };
+  const sets = [];
+  let agentOk = false, builtinOk = false, benefitOk = false;
+
+  // 1) agent-center：useragents 找 CodeAgent → detail.gpts.models
+  try {
+    const list = await signedGetJson({ url: `${snapBase}${EP_AGENT_LIST}?offset=0&limit=100&is_primary_agent=true`, cred, agentType: "AgentCenter", fetchImpl });
+    const agents = Array.isArray(list?.agents) ? list.agents : [];
+    const pick = agents.find((a) => a?.agent_name === "CodeAgent" && a?.alias?.alias_zh_cn === "智能体" && a?.show_in_ide)
+      || agents.find((a) => a?.is_primary_agent) || agents[0];
+    if (pick?.agent_id) {
+      const detail = await signedGetJson({ url: `${snapBase}${EP_AGENT_DETAIL}?agent_id=${encodeURIComponent(pick.agent_id)}`, cred, agentType: "AgentCenter", fetchImpl });
+      const models = (Array.isArray(detail?.gpts?.models) ? detail.gpts.models : [])
+        .map((m) => toModelInfo({ model_id: m?.model_id, model_name: m?.model_name || m?.model_alias, context_window: m?.model_parameters?.context_window, max_tokens: m?.model_parameters?.max_tokens, model_desc: m?.model_parameters?.model_desc }))
+        .filter(Boolean);
+      if (models.length) { sets.push(models); agentOk = true; }
+    }
+  } catch { /* agent 路失败不阻断 */ }
+
+  // 2) 内置模型（Agent-Type: PromptCenter）
+  try {
+    const json = await signedGetJson({ url: `${snapBase}${EP_MODEL_BUILTIN}`, cred, agentType: "PromptCenter", fetchImpl });
+    const models = (Array.isArray(json?.builtinModels) ? json.builtinModels : []).map((m) => toModelInfo(m)).filter(Boolean);
+    if (models.length) { sets.push(models); builtinOk = true; }
+  } catch { /* builtin 失败不阻断 */ }
+
+  // 3) 福利网关（先幂等 claim 再拉目录；error_code!=0000 视为该来源失败）
+  try {
+    if (autoClaim) { try { await claimBenefit({ cred, benefitHost, fetchImpl }); } catch { /* 未开通福利套餐时 claim 可能报错，继续拉目录 */ } }
+    const json = await signedGetJson({ url: benefitHost + EP_BENEFIT_CONFIG, cred, fetchImpl });
+    if (String(json?.error_code || "") === "0000") {
+      const models = (Array.isArray(json?.result?.models) ? json.result.models : []).map((m) => toModelInfo(m, { benefit: true })).filter(Boolean);
+      if (models.length) { sets.push(models); benefitOk = true; }
+    }
+  } catch { /* benefit 失败不阻断 */ }
+
+  const models = mergeModels(sets);
+  if (!models.length) throw new Error("codearts models api returned empty list");
+  return { models, agentOk, builtinOk, benefitOk };
+}

package/src/providers/codearts/sign.js

@@ -1,96 +1,96 @@
-// 华为云 SDK-HMAC-SHA256 请求签名（AK/SK + 可选 STS security token）。
-// 对齐 @huaweicloud/huaweicloud-sdk-core AKSKSigner（逆向参考：HITZY2002/codearts2api internal/upstream/signer.go）：
-//   - SignedHeaders = 请求全部头（小写排序，含 host / x-sdk-content-sha256 / maas_type）
-//   - CanonicalURI 每段 percent-encode 且末尾补 "/"
-//   - payload hash 取 X-Sdk-Content-Sha256（= 请求体原样 sha256 hex）
-import crypto from "node:crypto";
-
-export const SIGN_ALGORITHM = "SDK-HMAC-SHA256";
-
-export function sha256Hex(data) {
-  const buf = typeof data === "string" ? Buffer.from(data, "utf8") : (data || Buffer.alloc(0));
-  return crypto.createHash("sha256").update(buf).digest("hex");
-}
-
-export function hmacHex(key, msg) {
-  return crypto.createHmac("sha256", String(key || "")).update(String(msg || ""), "utf8").digest("hex");
-}
-
-// Go url.PathEscape(encodePathSegment)：仅 / ; , ? 与非 URI 字符转义。
-// 本项目全部端点路径均为纯字母数字（恒等），此处按 RFC3986 pchar 集保守实现。
-const PCHAR = /[^A-Za-z0-9\-._~!$&'()*+,;=:@]/g;
-function escapeSegment(seg) {
-  return String(seg || "").replace(PCHAR, (c) => encodeURIComponent(c));
-}
-
-// 末尾强制补 "/"（对齐 JS SDK CanonicalURI；漏掉即签名失败）。
-export function canonicalUriPath(pathname) {
-  const out = String(pathname || "/").split("/").map(escapeSegment).join("/");
-  return out.endsWith("/") ? out : out + "/";
-}
-
-// Go url.QueryEscape：空格 → "+"；key/value 各自排序。
-const QESC = (s) => encodeURIComponent(s).replace(/%20/g, "+").replace(/[!'()*]/g, (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase());
-function decodeSafe(s) { try { return decodeURIComponent(s); } catch { return s; } }
-
-export function canonicalQuery(rawQuery) {
-  const raw = String(rawQuery || "");
-  if (!raw) return "";
-  const pairs = raw.replace(/^\?/, "").split("&").filter(Boolean).map((p) => {
-    const i = p.indexOf("=");
-    const k = i < 0 ? p : p.slice(0, i);
-    const v = i < 0 ? "" : p.slice(i + 1);
-    return [decodeSafe(k), decodeSafe(v)];
-  });
-  pairs.sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0));
-  return pairs.map(([k, v]) => `${QESC(k)}=${QESC(v)}`).join("&");
-}
-
-// 全部请求头（小写 key 排序；值 TrimSpace）→ canonical 行集 + SignedHeaders 串。
-export function canonicalHeaders(headers) {
-  const canon = {};
-  for (const [k, v] of Object.entries(headers || {})) {
-    if (v === undefined || v === null) continue;
-    canon[k.toLowerCase()] = String(v).trim();
-  }
-  const keys = Object.keys(canon).sort();
-  const lines = keys.map((k) => `${k}:${canon[k]}\n`).join("");
-  return { canonical: lines, signed: keys.join(";"), canon };
-}
-
-/**
- * 给请求补签名头：x-sdk-date / x-security-token / x-sdk-content-sha256 / authorization。
- * @param {object} p
- * @param {string} p.method  HTTP 方法
- * @param {string} p.url     完整 URL（host 取自这里）
- * @param {object} p.headers 签名前已就位的全部业务头（maas_type 必须已含）
- * @param {string|Buffer} [p.body] 请求体原样字节
- * @param {{accessKeyId, secretAccessKey, securityToken?}} p.cred
- * @returns {{headers: object, stringToSign: string, canonicalRequest: string}} 最终待发送头
- */
-export function signRequest({ method, url, headers = {}, body = "", cred, now = new Date() }) {
-  const u = new URL(url);
-  const xDate = now.toISOString().slice(0, 19).replace(/[-:]/g, "") + "Z";
-  const payloadHash = sha256Hex(body);
-  const h = { ...headers };
-  if (cred?.securityToken) h["x-security-token"] = cred.securityToken;
-  h["x-sdk-date"] = xDate;
-  h["x-sdk-content-sha256"] = payloadHash;
-  // host 进签名集（Go 显式 Set("Host")）；fetch 会按 URL 自发同值 Host 头，服务端验签一致。
-  h["host"] = u.host;
-  const { canonical, signed } = canonicalHeaders(h);
-  const canonicalRequest = [
-    String(method || "GET").toUpperCase(),
-    canonicalUriPath(u.pathname),
-    canonicalQuery(u.search),
-    canonical,
-    signed,
-    payloadHash,
-  ].join("\n");
-  const stringToSign = [SIGN_ALGORITHM, xDate, sha256Hex(canonicalRequest)].join("\n");
-  const signature = hmacHex(cred?.secretAccessKey, stringToSign);
-  const finalHeaders = { ...h };
-  delete finalHeaders.host; // host 头由 HTTP 客户端自行发出，不在 fetch 头里透传
-  finalHeaders.authorization = `${SIGN_ALGORITHM} Access=${cred?.accessKeyId || ""}, SignedHeaders=${signed}, Signature=${signature}`;
-  return { headers: finalHeaders, stringToSign, canonicalRequest };
-}
+// 华为云 SDK-HMAC-SHA256 请求签名（AK/SK + 可选 STS security token）。
+// 对齐 @huaweicloud/huaweicloud-sdk-core AKSKSigner（逆向参考：HITZY2002/codearts2api internal/upstream/signer.go）：
+//   - SignedHeaders = 请求全部头（小写排序，含 host / x-sdk-content-sha256 / maas_type）
+//   - CanonicalURI 每段 percent-encode 且末尾补 "/"
+//   - payload hash 取 X-Sdk-Content-Sha256（= 请求体原样 sha256 hex）
+import crypto from "node:crypto";
+
+export const SIGN_ALGORITHM = "SDK-HMAC-SHA256";
+
+export function sha256Hex(data) {
+  const buf = typeof data === "string" ? Buffer.from(data, "utf8") : (data || Buffer.alloc(0));
+  return crypto.createHash("sha256").update(buf).digest("hex");
+}
+
+export function hmacHex(key, msg) {
+  return crypto.createHmac("sha256", String(key || "")).update(String(msg || ""), "utf8").digest("hex");
+}
+
+// Go url.PathEscape(encodePathSegment)：仅 / ; , ? 与非 URI 字符转义。
+// 本项目全部端点路径均为纯字母数字（恒等），此处按 RFC3986 pchar 集保守实现。
+const PCHAR = /[^A-Za-z0-9\-._~!$&'()*+,;=:@]/g;
+function escapeSegment(seg) {
+  return String(seg || "").replace(PCHAR, (c) => encodeURIComponent(c));
+}
+
+// 末尾强制补 "/"（对齐 JS SDK CanonicalURI；漏掉即签名失败）。
+export function canonicalUriPath(pathname) {
+  const out = String(pathname || "/").split("/").map(escapeSegment).join("/");
+  return out.endsWith("/") ? out : out + "/";
+}
+
+// Go url.QueryEscape：空格 → "+"；key/value 各自排序。
+const QESC = (s) => encodeURIComponent(s).replace(/%20/g, "+").replace(/[!'()*]/g, (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase());
+function decodeSafe(s) { try { return decodeURIComponent(s); } catch { return s; } }
+
+export function canonicalQuery(rawQuery) {
+  const raw = String(rawQuery || "");
+  if (!raw) return "";
+  const pairs = raw.replace(/^\?/, "").split("&").filter(Boolean).map((p) => {
+    const i = p.indexOf("=");
+    const k = i < 0 ? p : p.slice(0, i);
+    const v = i < 0 ? "" : p.slice(i + 1);
+    return [decodeSafe(k), decodeSafe(v)];
+  });
+  pairs.sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0));
+  return pairs.map(([k, v]) => `${QESC(k)}=${QESC(v)}`).join("&");
+}
+
+// 全部请求头（小写 key 排序；值 TrimSpace）→ canonical 行集 + SignedHeaders 串。
+export function canonicalHeaders(headers) {
+  const canon = {};
+  for (const [k, v] of Object.entries(headers || {})) {
+    if (v === undefined || v === null) continue;
+    canon[k.toLowerCase()] = String(v).trim();
+  }
+  const keys = Object.keys(canon).sort();
+  const lines = keys.map((k) => `${k}:${canon[k]}\n`).join("");
+  return { canonical: lines, signed: keys.join(";"), canon };
+}
+
+/**
+ * 给请求补签名头：x-sdk-date / x-security-token / x-sdk-content-sha256 / authorization。
+ * @param {object} p
+ * @param {string} p.method  HTTP 方法
+ * @param {string} p.url     完整 URL（host 取自这里）
+ * @param {object} p.headers 签名前已就位的全部业务头（maas_type 必须已含）
+ * @param {string|Buffer} [p.body] 请求体原样字节
+ * @param {{accessKeyId, secretAccessKey, securityToken?}} p.cred
+ * @returns {{headers: object, stringToSign: string, canonicalRequest: string}} 最终待发送头
+ */
+export function signRequest({ method, url, headers = {}, body = "", cred, now = new Date() }) {
+  const u = new URL(url);
+  const xDate = now.toISOString().slice(0, 19).replace(/[-:]/g, "") + "Z";
+  const payloadHash = sha256Hex(body);
+  const h = { ...headers };
+  if (cred?.securityToken) h["x-security-token"] = cred.securityToken;
+  h["x-sdk-date"] = xDate;
+  h["x-sdk-content-sha256"] = payloadHash;
+  // host 进签名集（Go 显式 Set("Host")）；fetch 会按 URL 自发同值 Host 头，服务端验签一致。
+  h["host"] = u.host;
+  const { canonical, signed } = canonicalHeaders(h);
+  const canonicalRequest = [
+    String(method || "GET").toUpperCase(),
+    canonicalUriPath(u.pathname),
+    canonicalQuery(u.search),
+    canonical,
+    signed,
+    payloadHash,
+  ].join("\n");
+  const stringToSign = [SIGN_ALGORITHM, xDate, sha256Hex(canonicalRequest)].join("\n");
+  const signature = hmacHex(cred?.secretAccessKey, stringToSign);
+  const finalHeaders = { ...h };
+  delete finalHeaders.host; // host 头由 HTTP 客户端自行发出，不在 fetch 头里透传
+  finalHeaders.authorization = `${SIGN_ALGORITHM} Access=${cred?.accessKeyId || ""}, SignedHeaders=${signed}, Signature=${signature}`;
+  return { headers: finalHeaders, stringToSign, canonicalRequest };
+}