qdmp-cli 0.1.26 → 0.1.28

package/actions.js

@@ -5,11 +5,10 @@ import { download } from "./utils/gitClone.js";
 import { printLogo } from "./utils/logHandler.js";
 import chalk from "chalk";
 import table from "table";
-import {
-  inquirerAccountPassword,
-  inquirerVersionDescription,
-} from "./utils/interactive.js";
-import { login, getDeveloperId, getUserInfo } from "./api.js";
+import { inquirerVersionDescription } from "./utils/interactive.js";
+import { ensureInteractiveAuth, interactiveLogin } from "./utils/authFlow.js";
+import { agentLogin } from "./utils/agentLogin.js";
+import { getDeveloperId, getUserInfo } from "./api.js";
 import fs from "fs";
 import path from "path";
 import { createRequire } from "module";
@@ -81,19 +80,31 @@ export const listAction = () => {
 
 export const loginAction = async (option) => {
   try {
-    const { account, password } = await inquirerAccountPassword();
-    const result = await login(account, password, option.env);
-    if (result.success) {
-      success("登录成功");
-    } else {
-      error("登录失败");
+    if (option.agent) {
+      await agentLogin(option.env);
+      return;
+    }
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+      throw new Error(`Agent 对话请执行 qdmp login --agent --env ${option.env} 获取登录链接和图片；CI 请设置 QDMP_TOKEN`);
     }
+    await interactiveLogin(option.env);
+    success("登录成功");
   } catch (e) {
+    if (option.agent) {
+      console.log(JSON.stringify({ type: "error", env: option.env, message: e.message }));
+      process.exitCode = 1;
+      return;
+    }
     error(e.message);
+  } finally {
+    // Inquirer may leave stdin in a flowing state after the localhost callback
+    // resolves. This command has no follow-up prompt, so let Node exit cleanly.
+    if (process.stdin.isTTY) process.stdin.pause();
   }
 };
 export const getMyInfoAction = async (option) => {
   try {
+    await ensureInteractiveAuth(option.env);
     const nickname = await getUserInfo(option.env);
     const appId = await getAppId(option.env);
     const appInfo = await getAppInfo(appId, option.env);
@@ -106,6 +117,7 @@ export const getMyInfoAction = async (option) => {
 
 export async function uploadAction(option) {
   try {
+    await ensureInteractiveAuth(option.env);
     const did = await getDeveloperId(option.env);
     const appId = await getAppId(option.env);
     if (!appId) {
@@ -155,6 +167,7 @@ export async function uploadAction(option) {
 }
 export const initConfigAction = async (option) => {
   try {
+    await ensureInteractiveAuth(option.env);
     const qdmpJsonPath = `${process.cwd()}/qdmp.json`;
     if (fs.existsSync(qdmpJsonPath)) {
       return error(
@@ -163,7 +176,7 @@ export const initConfigAction = async (option) => {
     }
     const appId = option.appId;
     if (!appId) return error("未配置应用ID，请使用-a参数指定应用ID");
-    const appInfo = await getAppInfo(appId);
+    const appInfo = await getAppInfo(appId, option.env);
     const config = {
       name: appInfo.name,
       appId: appInfo.appId,

package/api.js

@@ -1,7 +1,9 @@
-import { getToken, saveToken } from "./utils/authorized.js";
+import { getToken, saveToken, clearToken } from "./utils/authorized.js";
 import fs from "fs";
 import path from "path";
 import { promisify } from "util";
+import { startLocalhostLogin } from "./utils/localhostLogin.js";
+import { signQiandaoRequest } from "./utils/pigeon.js";
 
 const readFile = promisify(fs.readFile);
 
@@ -18,6 +20,9 @@ const API_CONFIG = {
   timeout: 10000,
   headers: {
     "content-type": "application/json",
+    "x-request-package-id": "1036",
+    "x-request-version": "1.0.0",
+    "x-echoing-env": "test-z",
   },
 };
 
@@ -35,28 +40,40 @@ export const request = async (
   env = "prod",
   needAuth = true
 ) => {
+  const { cookieJar, ...requestOptions } = options;
   const config = {
     baseURL: resolveAPIBaseURL(env),
     method: "GET",
     headers: { ...API_CONFIG.headers },
-    ...options,
+    credentials: "include",
+    ...requestOptions,
   };
+  if (cookieJar?.header()) config.headers.cookie = cookieJar.header();
   // 添加认证头（如果需要且如果有 token）
   if (needAuth) {
-    const token = getToken();
+    const token = getToken(env);
     if (!token) {
-      throw new Error("未授权，执行 qdmp-cli login 完成登录");
+      throw Object.assign(new Error("未授权，执行 qdmp-cli login 完成登录"), {
+        code: "AUTH_REQUIRED",
+      });
     }
     config.headers["authorization"] = `Bearer ${token}`;
   }
 
+  const requestURL = `${config.baseURL}${url}`;
+  const signedHeaders = await signQiandaoRequest(requestURL);
+  config.headers = { ...config.headers, ...signedHeaders };
+
   try {
-    const response = await fetch(`${config.baseURL}${url}`, config);
+    const response = await fetch(requestURL, config);
+    cookieJar?.update(response.headers);
 
     // 检查响应状态
     if (!response.ok) {
       if (response.status === 401) {
-        throw new Error("未授权，执行 qdmp-cli login 完成登录");
+        throw Object.assign(new Error("未授权，执行 qdmp-cli login 完成登录"), {
+          code: "AUTH_REQUIRED",
+        });
       }
       if (response.status === 403) {
         throw new Error("你没有该小程序的开发权限，请联系管理员开通后重试");
@@ -179,7 +196,7 @@ export const login = async (username, password, env = "prod") => {
       false // 登录时不需要认证头
     );
     if (result?.data?.token) {
-      saveToken(result.data.token); // 保存token
+      saveToken(result.data.token, env); // 保存指定环境 token
       return { success: true };
     } else {
       throw new Error(result.error || "登录失败");
@@ -188,6 +205,140 @@ export const login = async (username, password, env = "prod") => {
     throw new Error(error.message);
   }
 };
+
+const unwrapData = (result) => result?.data || result;
+
+const qrcodeLoginURL = (qrcodeId) =>
+  `https://qiandao.com/login/scanning/confirm?qrcodeId=${encodeURIComponent(qrcodeId)}`;
+
+export const generateLoginQrcode = async (env = "prod", { signal } = {}) => {
+  const result = await request(
+    "/signin/login/scan/qrcode/generate-id",
+    { method: "POST", body: JSON.stringify({}), signal },
+    env,
+    false,
+  );
+  const data = unwrapData(result);
+  if (!data?.qrcodeId) throw new Error("生成登录二维码失败");
+  return { qrcodeId: String(data.qrcodeId), url: qrcodeLoginURL(data.qrcodeId) };
+};
+
+export const getLoginQrcodeStatus = async (qrcodeId, env = "prod", { signal } = {}) => {
+  const result = await request(
+    "/signin/login/scan/qrcode/status",
+    { method: "POST", body: JSON.stringify({ qrcodeId }), signal },
+    env,
+    false,
+  );
+  const data = unwrapData(result);
+  return {
+    ...data,
+    status: data?.qrcodeStatus || data?.status || "pending",
+    token: data?.accessToken || data?.token,
+  };
+};
+
+export const loginByPlatformURL = async (env = "prod", onUpdate = () => {}) => {
+  const session = await startLocalhostLogin({
+    env,
+    acceptToken: async (token, isActive) => {
+      const result = await request("/mp/v1/user/me", {
+        headers: { ...API_CONFIG.headers, authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(10000),
+      }, env, false);
+      assertSuccessResponse(result, "验证网页登录态");
+      if (!isActive()) throw new Error("网页登录会话已结束");
+      saveToken(token, env);
+    },
+  });
+  try {
+    await onUpdate({ type: "ready", url: session.url });
+    return await session.result;
+  } finally {
+    session.close();
+  }
+};
+
+export const getQiandaoUser = async (token, env = "prod", { signal } = {}) => {
+  const result = await request(
+    "/user/users/me",
+    { headers: { authorization: `Bearer ${token}` }, signal },
+    env,
+    false,
+  );
+  return unwrapData(result);
+};
+
+export const exchangeQiandaoLogin = async (token, user, env = "prod", { signal, persist = true } = {}) => {
+  const userInfo = unwrapData(user) || {};
+  const thirdPartyUserId = userInfo.id ?? userInfo.userId ?? userInfo.openId;
+  if (thirdPartyUserId == null || String(thirdPartyUserId).trim() === "") {
+    throw new Error("扫码登录未获取到用户信息");
+  }
+  const result = await request(
+    "/mp/v1/user/login/mobile",
+    {
+      method: "POST",
+      signal,
+      body: JSON.stringify({
+        thirdPartyUserId: String(thirdPartyUserId),
+        nickname: userInfo.nickName || userInfo.nickname || userInfo.name,
+        avatar: userInfo.avatar || userInfo.avatarUrl,
+      }),
+    },
+    env,
+    false,
+  );
+  const platformToken = unwrapData(result)?.token;
+  if (!platformToken) throw new Error("扫码登录未获取到开放平台 Token");
+  if (persist) saveToken(platformToken, env);
+  return platformToken;
+};
+
+export const loginByQrcode = async (env = "prod", onUpdate = () => {}) => {
+  const session = await generateLoginQrcode(env);
+  await onUpdate({ type: "ready", ...session });
+  const deadline = Date.now() + 2 * 60 * 1000;
+  let previousStatus = "";
+
+  while (Date.now() < deadline) {
+    const result = await getLoginQrcodeStatus(session.qrcodeId, env);
+    if (result.status !== previousStatus) {
+      previousStatus = result.status;
+      await onUpdate({ type: "status", status: result.status });
+    }
+    if (["expired", "cancelled", "canceled", "error"].includes(result.status)) {
+      throw new Error(result.status === "expired" ? "二维码已过期" : "扫码登录已结束");
+    }
+    if (result.status === "success") {
+      const qdToken = result.token;
+      if (!qdToken) throw new Error("扫码登录未返回登录态");
+      const user = await getQiandaoUser(qdToken, env);
+      await exchangeQiandaoLogin(qdToken, user, env);
+      return { ...session, status: "success" };
+    }
+    await new Promise((resolve) => setTimeout(resolve, 1500));
+  }
+  throw new Error("二维码登录超时，请重新登录");
+};
+
+export const isAuthRequiredError = (error) => error?.code === "AUTH_REQUIRED";
+
+export const ensureAuth = async (env = "prod") => {
+  const token = getToken(env);
+  if (!token) {
+    throw Object.assign(new Error("未授权，执行 qdmp-cli login 完成登录"), {
+      code: "AUTH_REQUIRED",
+    });
+  }
+  try {
+    await request("/mp/v1/user/me", {}, env);
+    return token;
+  } catch (error) {
+    if (isAuthRequiredError(error)) clearToken(env);
+    throw error;
+  }
+};
 /**
  * 获取用户信息
  * @returns {Promise} 用户信息

package/index.js

@@ -52,7 +52,8 @@ program
 program
   .command("login")
   .description("登录")
-  .option("-e, --env <env>", "当前环境")
+  .option("-e, --env <env>", "登录环境：prod 或 dev", "prod")
+  .option("--agent", "输出登录链接和 PNG 图片的 JSON 事件，并等待登录（无需终端输入）")
   .action(loginAction);
 program
   .command("getMe")

package/openapi.js

@@ -6,6 +6,7 @@ import {
   resolveOpenAPIManifest,
 } from "./utils/openapiManifest.js";
 import { error, info, success, warn } from "./utils/logHandler.js";
+import { ensureInteractiveAuth } from "./utils/authFlow.js";
 
 const openPlatformBaseURL = (env, override) => {
   const baseURL = override?.trim().replace(/\/+$/, "")
@@ -60,6 +61,7 @@ export const prepareOpenAPIApplication = async ({
 
 export const openAPIApplyURLAction = async (option) => {
   try {
+    await ensureInteractiveAuth(option.env);
     const result = await prepareOpenAPIApplication(option);
     if (option.json) {
       console.log(JSON.stringify(result, null, 2));

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "qdmp-cli",
-    "version": "0.1.26",
+    "version": "0.1.28",
     "description": "qdmp-cli",
     "main": "index.js",
     "type": "module",
@@ -29,16 +29,26 @@
     "dependencies": {
         "@dimina/compiler": "1.0.17",
         "adm-zip": "^0.5.16",
+        "ajax-hook": "2.1.3",
         "chalk": "^5.4.1",
         "commander": "^14.0.0",
         "figlet": "^1.8.1",
         "inquirer": "^12.6.3",
         "is-unicode-supported": "^2.1.0",
+        "js-base64": "3.7.8",
         "ora": "^8.2.0",
+        "qrcode": "^1.5.4",
+        "qrcode-terminal": "^0.12.0",
+        "query-string": "7.1.3",
         "shelljs": "^0.10.0",
-        "table": "^6.9.0"
+        "table": "^6.9.0",
+        "use-singleton": "0.3.0"
     },
     "engines": {
         "node": "^20.19.0 || >=22.12.0"
+    },
+    "publishConfig": {
+        "registry": "https://registry.npmjs.org/",
+        "access": "public"
     }
 }

package/utils/agentLogin.js

@@ -0,0 +1,106 @@
+import { mkdtemp, chmod, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import QRCode from "qrcode";
+import { generateLoginQrcode, getLoginQrcodeStatus, getQiandaoUser, exchangeQiandaoLogin, request } from "../api.js";
+import { saveToken } from "./authorized.js";
+import { normalizeLoginEnv } from "./loginEnvironment.js";
+import { startLocalhostLogin } from "./localhostLogin.js";
+
+// NDJSON keeps stdout machine-readable. The caller renders ready.markdown while
+// this process keeps the loopback callback and App status polling alive.
+export const agentLogin = async (env = "prod", {
+  emit = event => console.log(JSON.stringify(event)),
+  timeoutMs = 120000,
+  pollIntervalMs = 1500,
+} = {}) => {
+  normalizeLoginEnv(env);
+  const controller = new AbortController();
+  const { signal } = controller;
+  const expiresAt = new Date(Date.now() + timeoutMs).toISOString();
+  const timer = setTimeout(() => controller.abort(new Error("登录超时，请重新执行登录命令")), timeoutMs);
+  const interrupt = () => controller.abort(new Error("已取消登录"));
+  process.once("SIGINT", interrupt);
+  process.once("SIGTERM", interrupt);
+  let browserSession;
+  let imageDirectory;
+  let committed = false;
+  const closeBrowser = () => browserSession?.close();
+  signal.addEventListener("abort", closeBrowser, { once: true });
+  const commit = token => {
+    signal.throwIfAborted();
+    if (committed) throw new Error("登录已完成");
+    saveToken(token, env, { quiet: true });
+    committed = true;
+  };
+  const requestSignal = () => AbortSignal.any([signal, AbortSignal.timeout(10000)]);
+  try {
+    browserSession = await startLocalhostLogin({
+      env, timeoutMs,
+      acceptToken: async (token, isActive) => {
+        const result = await request("/mp/v1/user/me", {
+          headers: { authorization: `Bearer ${token}` }, signal: requestSignal(),
+        }, env, false);
+        if (Number(result?.code || 0) !== 0) throw new Error("验证网页登录态失败");
+        if (!isActive()) throw new Error("网页登录会话已结束");
+        commit(token);
+      },
+    });
+    signal.throwIfAborted();
+    const qr = await generateLoginQrcode(env, { signal: requestSignal() });
+    imageDirectory = await mkdtemp(join(tmpdir(), "qdmp-login-"));
+    const qrImagePath = join(imageDirectory, "qrcode.png");
+    await QRCode.toFile(qrImagePath, qr.url, { type: "png", width: 320, margin: 4 });
+    await chmod(qrImagePath, 0o600);
+    signal.throwIfAborted();
+    const loginUrl = browserSession.url;
+    await emit({
+      type: "ready", env, loginUrl, qrImagePath, expiresAt,
+      message: "点击链接前往浏览器登录，或用千岛 App 扫码登录。",
+      markdown: `[点击链接前往浏览器登录](${loginUrl})，或用千岛 App 扫码登录。\n\n![千岛 App 扫码登录](<${qrImagePath}>)`,
+    });
+    const poll = async () => {
+      let previousStatus;
+      while (!signal.aborted && !committed) {
+        const result = await getLoginQrcodeStatus(qr.qrcodeId, env, { signal: requestSignal() });
+        signal.throwIfAborted();
+        if (result.status === "success") {
+          if (!result.token) throw new Error("扫码登录未返回登录态");
+          const user = await getQiandaoUser(result.token, env, { signal: requestSignal() });
+          const token = await exchangeQiandaoLogin(result.token, user, env, { signal: requestSignal(), persist: false });
+          commit(token);
+          return "qrcode";
+        }
+        if (["expired", "canceled", "cancelled", "error"].includes(result.status)) {
+          throw new Error("二维码已过期或登录已取消，可继续使用浏览器链接");
+        }
+        if (previousStatus !== result.status) {
+          previousStatus = result.status;
+          await emit({ type: "status", env, method: "qrcode", status: result.status });
+        }
+        await delay(pollIntervalMs, undefined, { signal });
+      }
+      throw new Error("扫码登录会话已结束");
+    };
+    const lane = (promise, method) => promise.catch(async () => {
+      if (!signal.aborted && !committed) await emit({ type: "unavailable", env, method });
+      throw new Error(`${method} 登录未完成`);
+    });
+    const method = await Promise.any([
+      lane(browserSession.result.then(() => "browser"), "browser"),
+      lane(poll(), "qrcode"),
+    ]).catch(() => {
+      throw signal.reason || new Error("登录未完成，请重新执行登录命令");
+    });
+    await emit({ type: "success", env, method });
+  } finally {
+    controller.abort();
+    clearTimeout(timer);
+    closeBrowser();
+    process.removeListener("SIGINT", interrupt);
+    process.removeListener("SIGTERM", interrupt);
+    signal.removeEventListener("abort", closeBrowser);
+    if (imageDirectory) await rm(imageDirectory, { recursive: true, force: true });
+  }
+};

package/utils/authFlow.js

@@ -0,0 +1,97 @@
+import { execFileSync } from "node:child_process";
+import { error, info, warn } from "./logHandler.js";
+import { inquirerAccountPassword, inquirerLoginMethod } from "./interactive.js";
+import {
+  ensureAuth,
+  isAuthRequiredError,
+  login,
+  loginByQrcode,
+  loginByPlatformURL,
+} from "../api.js";
+
+import { normalizeLoginEnv } from "./loginEnvironment.js";
+
+const openLoginURL = (url) => {
+  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    execFileSync(command, args, { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+const renderTerminalQRCode = async (url) => {
+  try {
+    const module = await import("qrcode-terminal");
+    const renderer = module.default || module;
+    renderer.generate(url, { small: true });
+    return true;
+  } catch {
+    warn("当前环境未安装二维码终端渲染依赖，请复制下方登录 URL 完成登录。");
+    return false;
+  }
+};
+
+const printLoginURL = (url) => {
+  console.log("\n登录地址（可复制）：");
+  console.log(url);
+  console.log("完成登录后，CLI 会自动接收登录结果，无需回到终端确认。\n");
+};
+
+export const interactiveLogin = async (env = "prod") => {
+  normalizeLoginEnv(env);
+  info(`当前登录环境：${env}`);
+  const method = await inquirerLoginMethod();
+  if (method === "password") {
+    const { account, password } = await inquirerAccountPassword();
+    await login(account, password, env);
+    return;
+  }
+
+  const onUpdate = async (event) => {
+    if (event.type === "ready") {
+      if (method === "qrcode") {
+        console.log("\n请使用千岛 App 扫描下方二维码登录：\n");
+        const rendered = await renderTerminalQRCode(event.url);
+        printLoginURL(event.url);
+        if (!rendered) {
+          info("二维码未能在终端显示，请使用上面的 URL 登录。");
+        }
+      } else {
+        printLoginURL(event.url);
+        if (openLoginURL(event.url)) {
+          info("已尝试打开浏览器，请完成登录；成功后 CLI 会自动退出。");
+        } else {
+          info("未能自动打开浏览器，请复制上面的 URL 手动打开。");
+        }
+      }
+    }
+    if (event.type === "status" && event.status === "scanned") {
+      info("已扫码，请在手机或浏览器中确认登录。");
+    }
+  };
+
+  if (method === "qrcode") {
+    // 与 miniapp-h5 的 QRCodeLogin 保持一致：App 扫描后直接进入确认登录弹框。
+    await loginByQrcode(env, onUpdate);
+  } else {
+    await loginByPlatformURL(env, onUpdate);
+  }
+};
+
+export const ensureInteractiveAuth = async (env = "prod") => {
+  try {
+    return await ensureAuth(env);
+  } catch (cause) {
+    if (!isAuthRequiredError(cause)) throw cause;
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+      throw new Error(`当前命令需要登录。Agent 对话请执行 qdmp login --agent --env ${normalizeLoginEnv(env)} 获取登录链接和图片，登录后重试原命令；CI 请设置 QDMP_TOKEN`);
+    }
+    await interactiveLogin(env);
+    return ensureAuth(env);
+  }
+};
+
+export const reportAuthError = (cause) => error(cause?.message || String(cause));

package/utils/authorized.js

@@ -1,26 +1,40 @@
 import fs from "fs";
 import path from "path";
 import os from "os";
+import { normalizeLoginEnv } from "./loginEnvironment.js";
 import { error, info } from "./logHandler.js";
 
 // 获取配置文件路径
 const getConfigPath = () => {
-  return path.join(os.homedir(), ".qdtool.config.json");
+  return process.env.QDMP_CONFIG_PATH?.trim() ||
+    path.join(os.homedir(), ".qdtool.config.json");
 };
 
-/**
- * 保存认证令牌
- * @param {string} token - 认证令牌
- */
-export const saveToken = (token) => {
+const readConfig = () => {
   const configPath = getConfigPath();
-  const config = { token };
+  try {
+    if (!fs.existsSync(configPath)) return {};
+    return JSON.parse(fs.readFileSync(configPath, "utf8"));
+  } catch {
+    return {};
+  }
+};
 
+export const saveToken = (token, env = "prod", { quiet = false } = {}) => {
+  normalizeLoginEnv(env);
+  const configPath = getConfigPath();
+  const config = readConfig();
+  const nextConfig = {
+    ...config,
+    tokens: { ...config.tokens, [env]: token },
+    ...(env === "prod" ? { token } : {}),
+  };
   try {
-    fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
-    info("🔑 认证令牌已安全存储");
+    fs.writeFileSync(configPath, JSON.stringify(nextConfig, null, 2), { mode: 0o600 });
+    fs.chmodSync(configPath, 0o600);
+    if (!quiet) info(`🔑 ${env} 环境认证令牌已安全存储`);
   } catch (err) {
-    error("保存认证令牌失败:", err.message);
+    throw new Error(`保存 ${env} 环境认证令牌失败：${err.message}`);
   }
 };
 
@@ -28,17 +42,24 @@ export const saveToken = (token) => {
  * 获取认证令牌
  * @returns {string} - 认证令牌
  */
-export const getToken = () => {
+export const getToken = (env = "prod") => {
+  normalizeLoginEnv(env);
   const environmentToken = process.env.QDMP_TOKEN?.trim();
   if (environmentToken) return environmentToken;
+  const config = readConfig();
+  return config.tokens?.[env] || (env === "prod" ? config.token : null) || null;
+};
+
+export const clearToken = (env = "prod") => {
+  if (process.env.QDMP_TOKEN?.trim()) return;
+  normalizeLoginEnv(env);
   const configPath = getConfigPath();
+  const config = readConfig();
+  if (config.tokens) delete config.tokens[env];
+  if (env === "prod") delete config.token;
   try {
-    if (fs.existsSync(configPath)) {
-      const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
-      return config.token || null;
-    }
+    fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
   } catch (err) {
-    return null;
+    error(`清理 ${env} 环境认证令牌失败：${err.message}`);
   }
-  return null;
 };

package/utils/interactive.js

@@ -35,6 +35,22 @@ export const inquirerAccountPassword = async (message) => {
   return { account, password };
 };
 
+export const inquirerLoginMethod = async () => {
+  const { method } = await inquirer.prompt([
+    {
+      type: "list",
+      name: "method",
+      message: "请选择登录方式",
+      choices: [
+        { name: "扫码登录（终端显示二维码）", value: "qrcode" },
+        { name: "手动登录 URL（显示可复制地址）", value: "url" },
+        { name: "账号密码登录", value: "password" },
+      ],
+    },
+  ]);
+  return method;
+};
+
 /**
  * 输入版本描述
  * @returns {Promise<string>} 版本描述

package/utils/localhostLogin.js

@@ -0,0 +1,107 @@
+import { createServer } from "node:http";
+import { randomBytes } from "node:crypto";
+import { normalizeLoginEnv, platformLoginURL } from "./loginEnvironment.js";
+
+// Token travels in the fragment (never in HTTP URLs). The landing page removes
+// it from browser history and submits it to this same-origin, single-use endpoint.
+export const startLocalhostLogin = async ({ env = "prod", timeoutMs = 120000, acceptToken }) => {
+  normalizeLoginEnv(env);
+  const state = randomBytes(32).toString("hex");
+  const nonce = randomBytes(24).toString("base64");
+  let origin;
+  let settled = false;
+  let accepting = false;
+  let timer;
+  let resolveResult;
+  let rejectResult;
+  const result = new Promise((resolve, reject) => {
+    resolveResult = resolve;
+    rejectResult = reject;
+  });
+  // The timeout may fire while the browser opener is still running.
+  result.catch(() => {});
+  const finish = (error) => {
+    if (settled) return;
+    settled = true;
+    clearTimeout(timer);
+    process.removeListener("SIGINT", onInterrupt);
+    process.removeListener("SIGTERM", onInterrupt);
+    server.close();
+    server.closeIdleConnections();
+    if (error) rejectResult(error);
+    else resolveResult({ status: "confirmed" });
+  };
+  const onInterrupt = () => finish(new Error("已取消网页登录"));
+  const server = createServer(async (req, res) => {
+    res.setHeader("Cache-Control", "no-store");
+    res.setHeader("Referrer-Policy", "no-referrer");
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("Content-Security-Policy", `default-src 'none'; style-src 'nonce-${nonce}'; script-src 'nonce-${nonce}'; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'`);
+    const reply = (status, text) => { res.writeHead(status); res.end(text); };
+    if (req.headers.host !== new URL(origin).host) return reply(403, "Invalid host");
+    if (settled) return reply(410, "Login expired");
+    const url = new URL(req.url, origin);
+    if (req.method === "GET" && url.pathname === "/callback" && url.searchParams.get("state") === state) {
+      res.setHeader("Content-Type", "text/html; charset=utf-8");
+      return reply(200, `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>千岛 CLI 登录</title><style nonce="${nonce}">
+* { box-sizing: border-box; }
+html, body { margin: 0; min-height: 100%; }
+body { background: #fff; color: #202123; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+.page { min-height: 100vh; display: flex; flex-direction: column; }
+.brand { padding: 24px 28px; font-size: 18px; font-weight: 650; letter-spacing: -.02em; }
+.content { flex: 1; display: flex; flex-direction: column; align-items: center; justify-content: center; padding: 24px; transform: translateY(-5vh); text-align: center; }
+.mark { width: 42px; height: 42px; margin-bottom: 18px; border: 1px solid #e5e7eb; border-radius: 50%; color: #6b7280; display: grid; place-items: center; font-size: 22px; line-height: 1; }
+.mark.success { border-color: #b7e4c7; background: #f0fdf4; color: #15803d; }
+.mark.error { border-color: #fecaca; background: #fef2f2; color: #dc2626; }
+.status { margin: 0; font-size: 16px; line-height: 1.5; font-weight: 500; }
+.status.success { color: #202123; }
+.status.error { color: #b91c1c; }
+.hint { margin: 10px 0 0; color: #6b7280; font-size: 14px; line-height: 1.5; }
+</style></head><body><div class="page"><header class="brand">千岛开放平台</header><main class="content"><div id="mark" class="mark" aria-hidden="true">…</div><p id="status" class="status" aria-live="polite">正在完成登录…</p><p id="hint" class="hint">请稍候，登录状态正在同步到 CLI。</p></main></div><script nonce="${nonce}">
+const token = new URLSearchParams(location.hash.slice(1)).get('token');
+history.replaceState(null, '', '/callback');
+fetch('/complete', {method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({state: '${state}', env: '${env}', token})})
+.then(async response => { if (!response.ok) throw new Error(); document.getElementById('mark').textContent = '✓'; document.getElementById('mark').className = 'mark success'; document.getElementById('status').textContent = '你已登录，可以关闭此标签页'; document.getElementById('status').className = 'status success'; document.getElementById('hint').textContent = 'CLI 已获取登录状态，请返回终端继续操作。'; })
+.catch(() => { document.getElementById('mark').textContent = '!'; document.getElementById('mark').className = 'mark error'; document.getElementById('status').textContent = '登录失败或已超时'; document.getElementById('status').className = 'status error'; document.getElementById('hint').textContent = '请返回终端重新发起登录。'; });
+</script></body></html>`);
+    }
+    if (req.method !== "POST" || url.pathname !== "/complete") return reply(404, "Not found");
+    if (req.headers.origin !== origin || req.headers["content-type"] !== "application/json") return reply(403, "Invalid origin");
+    if (accepting) return reply(409, "Login in progress");
+    try {
+      let body = "";
+      for await (const chunk of req) {
+        body += chunk;
+        if (Buffer.byteLength(body) > 16384) return reply(413, "Request too large");
+      }
+      const data = JSON.parse(body);
+      if (data.state !== state || data.env !== env || typeof data.token !== "string" || !data.token.trim() || data.token.length > 8192) {
+        return reply(400, "Invalid login callback");
+      }
+      if (settled || accepting) return reply(409, "Login no longer available");
+      accepting = true;
+      await acceptToken(data.token, () => !settled);
+      if (settled) return reply(410, "Login expired");
+      reply(200, "OK");
+      finish();
+    } catch (error) {
+      reply(400, "Login failed");
+      if (accepting) finish(error);
+    }
+  });
+  server.requestTimeout = 10000;
+  server.headersTimeout = 10000;
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  // Use the stable localhost name in the browser callback. The listener is
+  // still bound to IPv4 loopback, so the callback never exposes a LAN port.
+  origin = `http://localhost:${server.address().port}`;
+  process.once("SIGINT", onInterrupt);
+  process.once("SIGTERM", onInterrupt);
+  timer = setTimeout(() => finish(new Error("网页登录超时，请重新登录")), timeoutMs);
+  const url = new URL(platformLoginURL(env));
+  url.search = new URLSearchParams({ cli_callback: `${origin}/callback`, cli_state: state, _env: env }).toString();
+  return { url: url.toString(), result, close: () => finish(new Error("已关闭网页登录会话")) };
+};

package/utils/loginEnvironment.js

@@ -0,0 +1,11 @@
+export const normalizeLoginEnv = (env = "prod") => {
+  if (env !== "prod" && env !== "dev") {
+    throw new Error("登录环境仅支持 prod 或 dev");
+  }
+  return env;
+};
+
+export const platformLoginURL = (env = "prod") =>
+  normalizeLoginEnv(env) === "dev"
+    ? "https://dev-open.qiandao.com/login"
+    : "https://open.qiandao.com/login";

package/utils/pigeon.js

@@ -0,0 +1,57 @@
+import { fileURLToPath } from "node:url";
+
+let signerPromise;
+
+const installBrowserGlobals = () => {
+  if (!globalThis.window) {
+    globalThis.window = {
+      location: {
+        protocol: "https:",
+        host: "open.qiandao.com",
+        hostname: "open.qiandao.com",
+      },
+    };
+  }
+  if (!globalThis.document) globalThis.document = {};
+  if (globalThis.XMLHttpRequest) return;
+
+  // @frontend/pigeon 在初始化时会读取 api.qiandao.cn/now 获取时钟偏移。
+  // CLI 使用本地时间即可完成签名，避免为一个时间接口引入额外网络依赖。
+  globalThis.XMLHttpRequest = class NodeXMLHttpRequest {
+    open(method, url, async = true) {
+      this.method = method;
+      this.url = url;
+      this.async = async;
+    }
+
+    setRequestHeader() {}
+
+    send() {
+      queueMicrotask(() => {
+        const response = JSON.stringify({
+          data: { timestamp: Math.floor(Date.now() / 1000) },
+        });
+        this.status = 200;
+        this.readyState = 4;
+        this.response = response;
+        this.responseText = response;
+        this.onreadystatechange?.();
+        this.onload?.();
+        this.onloadend?.();
+      });
+    }
+
+    abort() {}
+  };
+};
+
+export const signQiandaoRequest = async (url) => {
+  if (!/^https?:\/\/(?:dev-)?api\.qiandao\.com\//.test(url)) return {};
+  if (!signerPromise) {
+    installBrowserGlobals();
+    const signerURL = new URL("./vendor/pigeon/browser-base.esm.js", import.meta.url);
+    signerPromise = import(fileURLToPath(signerURL)).then(({ sign }) => sign);
+  }
+  const sign = await signerPromise;
+  return sign(url);
+};

package/utils/vendor/pigeon/browser-base.esm.js

@@ -0,0 +1 @@
+const t=g;!function(t,n){const r=g,e=tt();for(;;)try{if(639296===-parseInt(r(596))/1*(parseInt(r(416))/2)+parseInt(r(585))/3+-parseInt(r(538))/4*(parseInt(r(678))/5)+-parseInt(r(499))/6+-parseInt(r(526))/7+-parseInt(r(649))/8+-parseInt(r(552))/9*(-parseInt(r(558))/10))break;e.push(e.shift())}catch(t){e.push(e.shift())}}();var n=function(t,{withKey:n=!1,immediate:r=!1}={}){const e={};let o,a=e;function s(r){return(a===e||(s=r,!(!n||void 0===s||s===o)))&&(o=r,a=t(o)),a;var s}return r&&s(),s},r={},e=n=>encodeURIComponent(n)[t(588)](/[!'()*]/g,(n=>"%"+n[t(543)](0)[t(482)](16)[t(458)]())),o=new RegExp("%[a-f0-9]{2}","gi"),a=new RegExp("(%[a-f0-9]{2})+","gi");function s(n,r){const e=t;try{return decodeURIComponent(n[e(688)](""))}catch(t){}if(1===n[e(701)])return n;r=r||1;var o=n.slice(0,r),a=n[e(628)](r);return Array[e(689)][e(494)].call([],s(o),s(a))}function c(n){const r=t;try{return decodeURIComponent(n)}catch(t){for(var e=n.match(o),a=1;a<e[r(701)];a++)e=(n=s(e,a)[r(688)]("")).match(o);return n}}var i=function(n){const r=t;if("string"!=typeof n)throw new TypeError(r(432)+typeof n+"`");try{return n=n[r(588)](/\+/g," "),decodeURIComponent(n)}catch(r){return function(n){const r=t;for(var e={"%FE%FF":"\ufffd\ufffd","%FF%FE":"\ufffd\ufffd"},o=a[r(507)](n);o;){try{e[o[0]]=decodeURIComponent(o[0])}catch(t){var s=c(o[0]);s!==o[0]&&(e[o[0]]=s)}o=a[r(507)](n)}e["%C2"]="\ufffd";for(var i=Object[r(677)](e),u=0;u<i[r(701)];u++){var p=i[u];n=n[r(588)](new RegExp(p,"g"),e[p])}return n}(n)}},u=(n,r)=>{const e=t;if(typeof n!==e(444)||typeof r!==e(444))throw new TypeError("Expected the arguments to be of type `string`");if(""===r)return[n];const o=n[e(631)](r);return-1===o?[n]:[n[e(628)](0,o),n[e(628)](o+r[e(701)])]},p=function(n,r){const e=t;for(var o={},a=Object[e(677)](n),s=Array[e(452)](r),c=0;c<a[e(701)];c++){var i=a[c],u=n[i];(s?-1!==r.indexOf(i):r(i,u,n))&&(o[i]=u)}return o};!function(n){const r=t,o=e,a=i,s=u,c=p,f=Symbol(r(517));function l(t){const n=r;if(typeof t!==n(444)||1!==t[n(701)])throw new TypeError(n(504))}function I(t,n){return n[r(424)]?n.strict?o(t):encodeURIComponent(t):t}function y(t,n){return n[r(437)]?a(t):t}function d(t){const n=r;return Array[n(452)](t)?t.sort():"object"==typeof t?d(Object.keys(t)).sort(((t,n)=>Number(t)-Number(n)))[n(582)]((n=>t[n])):t}function m(t){const n=t[r(631)]("#");return-1!==n&&(t=t.slice(0,n)),t}function g(t){const n=r,e=(t=m(t))[n(631)]("?");return-1===e?"":t[n(628)](e+1)}function h(t,n){const e=r;return n[e(454)]&&!Number[e(629)](Number(t))&&typeof t===e(444)&&""!==t[e(706)]()?t=Number(t):n[e(670)]&&null!==t&&("true"===t[e(563)]()||"false"===t[e(563)]())&&(t=t[e(563)]()===e(698)),t}function b(t,n){const e=r;l((n=Object[e(682)]({decode:!0,sort:!0,arrayFormat:"none",arrayFormatSeparator:",",parseNumbers:!1,parseBooleans:!1},n))[e(434)]);const o=function(t){const n=r;let e;switch(t[n(430)]){case n(428):return(t,r,o)=>{e=/\[(\d*)\]$/[n(507)](t),t=t.replace(/\[\d*\]$/,""),e?(void 0===o[t]&&(o[t]={}),o[t][e[1]]=r):o[t]=r};case n(441):return(t,r,o)=>{const a=n;e=/(\[\])$/[a(507)](t),t=t.replace(/\[\]$/,""),e?void 0!==o[t]?o[t]=[][a(494)](o[t],r):o[t]=[r]:o[t]=r};case"colon-list-separator":return(t,r,o)=>{const a=n;e=/(:list)$/[a(507)](t),t=t[a(588)](/:list$/,""),e?void 0!==o[t]?o[t]=[].concat(o[t],r):o[t]=[r]:o[t]=r};case n(607):case n(667):return(r,e,o)=>{const a=n,s="string"==typeof e&&e[a(502)](t.arrayFormatSeparator),c=typeof e===a(444)&&!s&&y(e,t).includes(t[a(434)]);e=c?y(e,t):e;const i=s||c?e.split(t.arrayFormatSeparator).map((n=>y(n,t))):null===e?e:y(e,t);o[r]=i};case n(463):return(r,e,o)=>{const a=n,s=/(\[\])$/[a(549)](r);if(r=r[a(588)](/\[\]$/,""),!s)return void(o[r]=e?y(e,t):e);const c=null===e?[]:e[a(528)](t[a(434)])[a(582)]((n=>y(n,t)));void 0!==o[r]?o[r]=[].concat(o[r],c):o[r]=c};default:return(t,r,e)=>{const o=n;void 0!==e[t]?e[t]=[][o(494)](e[t],r):e[t]=r}}}(n),a=Object[e(660)](null);if(typeof t!==e(444))return a;if(!(t=t[e(706)]()[e(588)](/^[?#&]/,"")))return a;for(const r of t[e(528)]("&")){if(""===r)continue;let[t,c]=s(n[e(437)]?r[e(588)](/\+/g," "):r,"=");c=void 0===c?null:[e(607),e(667),e(463)][e(502)](n[e(430)])?c:y(c,n),o(y(t,n),c,a)}for(const t of Object.keys(a)){const r=a[t];if(typeof r===e(614)&&null!==r)for(const t of Object[e(677)](r))r[t]=h(r[t],n);else a[t]=h(r,n)}return!1===n[e(545)]?a:(!0===n.sort?Object[e(677)](a)[e(545)]():Object[e(677)](a)[e(545)](n.sort))[e(594)](((t,n)=>{const r=e,o=a[n];return Boolean(o)&&typeof o===r(614)&&!Array[r(452)](o)?t[n]=d(o):t[n]=o,t}),Object[e(660)](null))}n[r(663)]=g,n[r(630)]=b,n[r(643)]=(t,n)=>{const e=r;if(!t)return"";l((n=Object[e(682)]({encode:!0,strict:!0,arrayFormat:e(534),arrayFormatSeparator:","},n)).arrayFormatSeparator);const o=function(t){const n=r;switch(t.arrayFormat){case n(428):return r=>(e,o)=>{const a=n,s=e[a(701)];return void 0===o||t.skipNull&&null===o||t[a(615)]&&""===o?e:null===o?[...e,[I(r,t),"[",s,"]"][a(688)]("")]:[...e,[I(r,t),"[",I(s,t),"]=",I(o,t)].join("")]};case n(441):return r=>(e,o)=>{const a=n;return void 0===o||t[a(598)]&&null===o||t[a(615)]&&""===o?e:null===o?[...e,[I(r,t),"[]"][a(688)]("")]:[...e,[I(r,t),a(609),I(o,t)].join("")]};case n(571):return r=>(e,o)=>{const a=n;return void 0===o||t[a(598)]&&null===o||t[a(615)]&&""===o?e:null===o?[...e,[I(r,t),a(533)][a(688)]("")]:[...e,[I(r,t),a(533),I(o,t)][a(688)]("")]};case n(607):case n(667):case"bracket-separator":{const r=t.arrayFormat===n(463)?n(609):"=";return e=>(o,a)=>{const s=n;return void 0===a||t[s(598)]&&null===a||t.skipEmptyString&&""===a?o:(a=null===a?"":a,0===o[s(701)]?[[I(e,t),r,I(a,t)][s(688)]("")]:[[o,I(a,t)][s(688)](t[s(434)])])}}default:return r=>(e,o)=>{const a=n;return void 0===o||t.skipNull&&null===o||t[a(615)]&&""===o?e:null===o?[...e,I(r,t)]:[...e,[I(r,t),"=",I(o,t)][a(688)]("")]}}}(n),a={};for(const r of Object[e(677)](t))s=r,!(n[e(598)]&&null==t[s]||n[e(615)]&&""===t[s])&&(a[r]=t[r]);var s;const c=Object.keys(a);return!1!==n.sort&&c[e(545)](n[e(545)]),c[e(582)]((r=>{const a=e,s=t[r];return void 0===s?"":null===s?I(r,n):Array[a(452)](s)?0===s[a(701)]&&"bracket-separator"===n[a(430)]?I(r,n)+"[]":s.reduce(o(r),[]).join("&"):I(r,n)+"="+I(s,n)}))[e(696)]((t=>t[e(701)]>0))[e(688)]("&")},n[r(562)]=(t,n)=>{const e=r;n=Object[e(682)]({decode:!0},n);const[o,a]=s(t,"#");return Object[e(682)]({url:o.split("?")[0]||"",query:b(g(t),n)},n&&n.parseFragmentIdentifier&&a?{fragmentIdentifier:y(a,n)}:{})},n[r(648)]=(t,e)=>{const o=r;e=Object[o(682)]({encode:!0,strict:!0,[f]:!0},e);const a=m(t.url)[o(528)]("?")[0]||"",s=n[o(663)](t[o(489)]),c=n[o(630)](s,{sort:!1}),i=Object[o(682)](c,t[o(474)]);let u=n[o(643)](i,e);u&&(u="?"+u);let p=function(t){const n=r;let e="";const o=t[n(631)]("#");return-1!==o&&(e=t[n(628)](o)),e}(t[o(489)]);return t[o(690)]&&(p="#"+(e[f]?I(t[o(690)],e):t[o(690)])),""+a+u+p},n[r(676)]=(t,e,o)=>{const a=r;o=Object.assign({parseFragmentIdentifier:!0,[f]:!1},o);const{url:s,query:i,fragmentIdentifier:u}=n[a(562)](t,o);return n[a(648)]({url:s,query:c(i,e),fragmentIdentifier:u},o)},n[r(492)]=(t,e,o)=>{const a=r,s=Array.isArray(e)?t=>!e[a(502)](t):(t,n)=>!e(t,n);return n[a(676)](t,s,o)}}(r);const f=typeof btoa===t(659),l=typeof Buffer===t(659);typeof TextDecoder===t(659)&&new TextDecoder;const I=typeof TextEncoder===t(659)?new TextEncoder:void 0,y=t(410),d=Array[t(689)][t(628)][t(439)](y);(n=>{let r={};d[t(567)](((t,n)=>r[t]=n))})();const m=String[t(496)][t(479)](String);function g(t,n){const r=tt();return(g=function(t,n){return r[t-=408]})(t,n)}typeof Uint8Array[t(423)]===t(659)&&Uint8Array[t(423)].bind(Uint8Array);const h=f?t=>btoa(t):l?n=>Buffer.from(n,"binary").toString(t(623)):n=>{const r=t;let e,o,a,s,c="";const i=n.length%3;for(let t=0;t<n[r(701)];){if((o=n[r(543)](t++))>255||(a=n[r(543)](t++))>255||(s=n.charCodeAt(t++))>255)throw new TypeError(r(684));e=o<<16|a<<8|s,c+=d[e>>18&63]+d[e>>12&63]+d[e>>6&63]+d[63&e]}return i?c[r(628)](0,i-3)+r(522)[r(581)](i):c},b=l?n=>Buffer.from(n)[t(482)]("base64"):n=>{const r=t;let e=[];for(let t=0,o=n[r(701)];t<o;t+=4096)e[r(557)](m[r(436)](null,n[r(675)](t,t+4096)));return h(e.join(""))},v=n=>{const r=t;if(n[r(701)]<2)return(e=n[r(543)](0))<128?n:e<2048?m(192|e>>>6)+m(128|63&e):m(224|e>>>12&15)+m(128|e>>>6&63)+m(128|63&e);var e=65536+1024*(n[r(543)](0)-55296)+(n[r(543)](1)-56320);return m(240|e>>>18&7)+m(128|e>>>12&63)+m(128|e>>>6&63)+m(128|63&e)},w=/[\uD800-\uDBFF][\uDC00-\uDFFFF]|[^\x00-\x7F]/g,k=l?n=>Buffer[t(423)](n,t(580))[t(482)](t(623)):I?n=>b(I[t(424)](n)):n=>h(n[t(588)](w,v)),T=(n,r=!1)=>r?k(n)[t(588)](/=/g,"").replace(/[+\/]/g,(t=>"+"==t?"-":"_")):k(n);function F(){const n=t;var r=[n(559),n(656),n(535),n(592),n(469),n(477),n(500),"len","22833PggbRz",n(681),n(579),n(624),n(613),n(639),n(605),n(604),"012",n(446),n(652),n(687),"cat",n(508),"mCh",n(601),n(468)];return(F=function(){return r})()}!function(n,r){const e=t;for(var o=S,a=F();;)try{if(382809===-parseInt(o(135))/1+-parseInt(o(124))/2+parseInt(o(134))/3*(-parseInt(o(126))/4)+parseInt(o(141))/5+parseInt(o(137))/6+-parseInt(o(136))/7+-parseInt(o(145))/8*(-parseInt(o(147))/9))break;a[e(557)](a.shift())}catch(t){a[e(557)](a[e(658)]())}}();var q=0,j=function(n,r){return function(n){const r=t;var e=S;for(var o,a=q?e(142)+r(685)+e(128)+r(626)+e(143)+"F":r(566)+r(685)+r(535)+r(486)+e(144)+"f",s="",c=0;c<n[r(523)+e(139)];c++)o=n[r(468)+r(656)+e(129)+"t"](c),s+=a[e(125)+e(138)](o>>>4&15)+a["cha"+e(138)](15&o);return s}(function(n,r){const e=t;var o=S,a=R(n);a[o(133)+o(139)]>16&&(a=x(a,8*n[o(133)+o(139)]));for(var s=Array(16),c=Array(16),i=0;i<16;i++)s[i]=909522486^a[i],c[i]=1549556828^a[i];var u=x(s[o(131)+e(542)](R(r)),512+8*r[o(133)+o(139)]);return function(n){const r=t;for(var e=S,o="",a=0;a<32*n[e(133)+e(139)];a+=8)o+=String[e(130)+r(427)+e(140)+e(132)](n[a>>5]>>>24-a%32&255);return o}(x(c[o(131)+o(146)](u),768))}(O(n),O(r)))};function O(n){const r=t;for(var e,o,a=S,s="",c=-1;++c<n[a(133)+a(139)];)e=n[a(125)+a(127)+a(129)+"t"](c),o=c+1<n[a(133)+a(139)]?n[r(468)+a(127)+a(129)+"t"](c+1):0,55296<=e&&e<=56319&&56320<=o&&o<=57343&&(e=65536+((1023&e)<<10)+(1023&o),c++),e<=127?s+=String[a(130)+a(123)+r(605)+"ode"](e):e<=2047?s+=String[a(130)+a(123)+r(605)+a(132)](192|e>>>6&31,128|63&e):e<=65535?s+=String[a(130)+a(123)+r(605)+r(500)](224|e>>>12&15,128|e>>>6&63,128|63&e):e<=2097151&&(s+=String[a(130)+a(123)+a(140)+a(132)](240|e>>>18&7,128|e>>>12&63,128|e>>>6&63,128|63&e));return s}function R(n){const r=t;var e=S,o=Array(n[r(523)+e(139)]>>2);for(let t=0;t<o[r(523)+e(139)];t++)o[t]=0;for(let t=0;t<8*n[e(133)+e(139)];t+=8)o[t>>5]|=(255&n[e(125)+e(127)+r(592)+"t"](t/8))<<24-t%32;return o}function S(t,n){var r=F();return(S=function(t,n){return r[t-=123]})(t,n)}function C(t,n){return t>>>n|t<<32-n}function A(t,n){return t>>>n}var U=[1116352408,1899447441,-1245643825,-373957723,961987163,1508970993,-1841331548,-1424204075,-670586216,310598401,607225278,1426881987,1925078388,-2132889090,-1680079193,-1046744716,-459576895,-272742522,264347078,604807628,770255983,1249150122,1555081692,1996064986,-1740746414,-1473132947,-1341970488,-1084653625,-958395405,-710438585,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,-2117940946,-1838011259,-1564481375,-1474664885,-1035236496,-949202525,-778901479,-694614492,-200395387,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,-2067236844,-1933114872,-1866530822,-1538233109,-1090935817,-965641998];function x(t,n){var r,e,o,a,s,c,i,u,p,f,l,I,y,d,m,g,h,b,v,w,k=S,T=[1779033703,-1150833019,1013904242,-1521486534,1359893119,-1694144372,528734635,1541459225],F=new Array(64);for(t[n>>5]|=128<<24-n%32,t[15+(n+64>>9<<4)]=n,p=0;p<t[k(133)+k(139)];p+=16){for(r=T[0],e=T[1],o=T[2],a=T[3],s=T[4],c=T[5],i=T[6],u=T[7],f=0;f<64;f++)F[f]=f<16?t[f+p]:M(M(M(C(w=F[f-2],17)^C(w,19)^A(w,10),F[f-7]),C(v=F[f-15],7)^C(v,18)^A(v,3)),F[f-16]),l=M(M(M(M(u,C(b=s,6)^C(b,11)^C(b,25)),(h=s)&c^~h&i),U[f]),F[f]),I=M(C(g=r,2)^C(g,13)^C(g,22),(y=r)&(d=e)^y&(m=o)^d&m),u=i,i=c,c=s,s=M(a,l),a=o,o=e,e=r,r=M(l,I);T[0]=M(r,T[0]),T[1]=M(e,T[1]),T[2]=M(o,T[2]),T[3]=M(a,T[3]),T[4]=M(s,T[4]),T[5]=M(c,T[5]),T[6]=M(i,T[6]),T[7]=M(u,T[7])}return T}function M(t,n){var r=(65535&t)+(65535&n);return(t>>16)+(n>>16)+(r>>16)<<16|65535&r}const N=E;function E(t,n){const r=z();return(E=function(t,n){return r[t-=445]})(t,n)}!function(n,r){const e=t,o=E,a=z();for(;;)try{if(394227===-parseInt(o(446))/1*(parseInt(o(452))/2)+-parseInt(o(461))/3*(parseInt(o(447))/4)+-parseInt(o(458))/5+-parseInt(o(453))/6+parseInt(o(449))/7*(parseInt(o(450))/8)+parseInt(o(459))/9+parseInt(o(451))/10)break;a[e(557)](a.shift())}catch(t){a[e(557)](a.shift())}}();const B=/^((http[s]?|ftp):\/)?\/?([^:/\s]+)((\/\w+)*\/)([\w\-.]+[^#?\s]+)(.*)?(#[\w-]+)?$/,Z=[N(456),null,N(448)+N(455)+"ol",N(445)+"t",t(707)+"h",null,t(449)+"e","query",t(447)+"h"];function z(){const n=t,r=[n(453),n(489),n(620),n(560),n(586),n(529),"3009UAAwrI",n(587),n(555),n(570),"pro",n(461),"8FIcGbg",n(440),n(577),n(429),"exe"];return(z=function(){return r})()}const D=L;function L(t,n){const r=Y();return(L=function(t,n){return r[t-=128]})(t,n)}!function(n,r){const e=t,o=L,a=Y();for(;;)try{if(850613===-parseInt(o(158))/1+parseInt(o(144))/2*(parseInt(o(133))/3)+-parseInt(o(139))/4+parseInt(o(148))/5+parseInt(o(152))/6*(-parseInt(o(131))/7)+-parseInt(o(142))/8*(-parseInt(o(130))/9)+parseInt(o(154))/10)break;a[e(557)](a[e(658)]())}catch(t){a[e(557)](a[e(658)]())}}();const V=["qia"+D(143)+D(128)+t(448)+"om",D(150)+t(425)+D(155)+"n",D(153)+t(640)+t(606),D(151)+D(163)+D(156),t(433)+"jie"+D(136)+D(157)+"m",D(150)+D(143)+D(155)+"om",D(134)+"uoa"+D(138)+D(147),D(159)+D(161)+t(679)+"om",D(159)+"iar"+D(132)+"n",D(159)+"i.cn",D(137)+D(149)+D(140)+"t",D(159)+t(637)+D(146)+D(129)];function Y(){const n=t,r=["qia",n(651),"144642nNFKAO",n(606),n(539),n(603),n(488),".co",n(451),n(680),n(503),n(637),n(587),"alh","oap",n(710),"35001zLLvdL","427DJUmdn","t.c","322914qCHpIY",n(612),n(419),n(633),n(654),n(521),n(591),".ar",n(655),n(455),n(425),"4hdWIOs",n(435),"t.w","net",n(497),n(683)];return(Y=function(){return r})()}function J(t,n){var r=W();return(J=function(t,n){return r[t-=416]})(t,n)}function X({signVersion:n,signType:r}){const e=t;var o=J;return{"X-Request-Sign":o(418)+o(440)+o(437)+o(429)+e(411)+"iYW"+o(447)+o(421)+o(420)+"3NT"+o(422)+e(622)+o(423)+o(416)+o(435)+o(436)+e(556)+o(432)+o(427)+o(442)+e(597)+o(425)+o(443)+o(446)+o(430)+o(426)+o(433)+o(417)+o(444)+"=","X-Request-Timestamp":(new Date)[o(438)+"ueOf"]()+"","X-Request-Package-Sign-Version":n,"X-Request-Sign-Version":"v1","X-Request-Sign-Type":r}}function W(){const n=t;var r=[n(565),n(465),"15292jCTRCL",n(694),n(661),n(420),"www",n(617),n(472),n(473),n(491),n(561),n(702),n(665),n(568),n(464),n(530),n(450),n(611),n(506),n(512),n(645),n(509),n(650),"VjY",n(632),n(693),n(669),n(619),n(708),n(476),n(625)];return(W=function(){return r})()}function H(){const n=t;var r=[n(527),"2456JLZcaJ",n(671),n(664),n(431),"177551wLbUqr",n(590),n(578),n(456),"170pKeqPU",n(525),n(510),n(627),n(520),"597WMqdTk",n(475),n(618)];return(H=function(){return r})()}function K(t,n){var r=H();return(K=function(t,n){return r[t-=221]})(t,n)}function P(t,n){const r=Q();return(P=function(t,n){return r[t-=103]})(t,n)}function G(t,n){return t+"">n+""?-1:1}function Q(){const n=t,r=[n(519),n(707),"10bXItph",n(515),n(621),"isA",n(610),"val",n(672),n(691),n(703),"l0b",n(484),n(683),"44ElgMcX",n(695),n(583),n(459),n(408),n(470),n(599),n(595),n(711),n(483),n(642),"ing",n(589),n(657),"web",n(662),n(674),n(699),n(490),n(553)];return(Q=function(){return r})()}!function(n,r){const e=t;for(var o=J,a=W();;)try{if(544237===-parseInt(o(431))/1+parseInt(o(445))/2+parseInt(o(439))/3*(parseInt(o(424))/4)+-parseInt(o(419))/5+parseInt(o(428))/6+parseInt(o(434))/7+parseInt(o(441))/8)break;a[e(557)](a[e(658)]())}catch(t){a[e(557)](a[e(658)]())}}(),function(n,r){const e=t;for(var o=K,a=H();;)try{if(635303===parseInt(o(227))/1*(-parseInt(o(232))/2)+parseInt(o(229))/3*(-parseInt(o(233))/4)+-parseInt(o(225))/5+parseInt(o(222))/6*(-parseInt(o(234))/7)+parseInt(o(230))/8*(parseInt(o(226))/9)+-parseInt(o(224))/10*(parseInt(o(237))/11)+parseInt(o(236))/12)break;a[e(557)](a[e(658)]())}catch(t){a[e(557)](a[e(658)]())}}(),function(n,r){const e=t,o=P,a=Q();for(;;)try{if(843148===parseInt(o(116))/1*(-parseInt(o(112))/2)+-parseInt(o(127))/3*(-parseInt(o(131))/4)+parseInt(o(114))/5*(-parseInt(o(125))/6)+parseInt(o(126))/7+parseInt(o(106))/8*(parseInt(o(136))/9)+parseInt(o(119))/10*(-parseInt(o(135))/11)+-parseInt(o(123))/12)break;a[e(557)](a[e(658)]())}catch(t){a[e(557)](a[e(658)]())}}();function $(t,n){var r=_();return($=function(t,n){return r[t-=147]})(t,n)}function _(){const n=t;var r=[n(438),n(453),"ati",n(442),n(460),n(576),n(524),n(478),n(569),n(546),"sta",n(544),n(646),n(572),n(412),n(593),n(541),n(493),n(651),"pro",n(564),n(467),n(587)];return(_=function(){return r})()}function tt(){const t=["toLowerCase","7979590QFRJdx","JmZ","012","forEach","lYm","21763FKmLpL","304VwiPjv","colon-list-separator","63040510jzjdUv","pi.","one","2TJ","rts","2nDvaaQ","96NrlQDu","4406871TspeYB","utf8","substring","map","ueO","7350EtwmCd","3706851tbCTOD","6376005dODHoR","hos","replace","ogr","duc","2979880tFJwxB","deA","tes","reduce","\u83b7\u53d6s","2961aqyZHV","NTB","skipNull","str","L2n","1036796BOvlFR","als","o.c","1082225ejLpKH","arC","ech","comma","4WUMxTc","[]=","5793132tZSiMb","TA2","qih","rAt","object","skipEmptyString","vK1","OTY","elo","169731pxxpby","Eac","ipr","WM1","base64","501186ZYgCfk","zQ1","9AB","4SGrkBk","slice","isNaN","parse","indexOf","WZh","app","cyv","res","olv","iar","1Tf","gth","o.t","1kSrAxh","red","stringify","HMA","wM2","55185hfjBOs","hRT","stringifyUrl","5598512YLokdl","5412974stsFgr","loc","cde","fun","ten","tna","rCo","ify","shift","function","create","I4Z","430iNiuFd","extract","pme","72zEUTwC","que","separator","3045504LvtPoH","val","parseBooleans","22778UNMRNJ","6LkZoEy","ede","par","subarray","pick","keys","5ZzbQHk","t.c","tus","417069jwMega","assign","sor","invalid character found","345","Iao","112MveLPu","join","prototype","fragmentIdentifier","8968365kiexgV","GI9","fxZ","TY2","uce","filter","74031RzAUpt","true","1243420DYKDlM","sen","length","N2Y","49713TzkqTb","12060351mIbsyz","C_S","trim","pat","yNj","7fDgZeQ","ork","cke","5728591nDpjrU","n/n","ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=","NWR","86Zsztdi","Tim","7VwUbSI","ign","452vSrZBM","rro","1561311POyGFH","cti","1Y2","err","591116JWPjST","from","encode","nda","LUX","mCh","index","2791014XLpOMX","arrayFormat","11648592gnQwCo","Expected `encodedURI` to be of type `string`, got `","lin","arrayFormatSeparator","som","apply","decode","10740etFGCo","call","7731790JTnElv","bracket","36xWcGcc","4066835lFyuBl","string","1311185OoTqii","CDE","has","p.c","fil","1354548ZMaTVQ","848660TicgRU","isArray","toc","parseNumbers","3488YktLKF","tio","htt","toUpperCase","spl","9aytTvJ","1389661SpRBic","YAO","bracket-separator","wXW","ww=","8129bllqUF","2488qUpRiz","cha","fro","9JMGpYT","3qw","5173880HTCqWt","MzA","query","862472xbRmfr","4182008MukRkk","con","Wit","bind","nti","P0G","toString","9270904giMZcI","rep","ore","9ab","wit","ost","url","key","Dkw","exclude","404335TOMKjW","concat","pro","fromCharCode","2609375gvhchA","3Kh","805758NdnuRZ","ode","MW3","includes","ati","arrayFormatSeparator must be single character string","pon","YTE","exec","1426293jfojbI","Rww","81DesQir","0.0","968810OKPvbX","HA2","GJq","min","abs","encodeFragmentIdentifier","1171308LGdQBk","bra","dev","pp.","===","len","36FCqHMB","1497615lzHlLN","3233139RxaMWU","278762oJMPYH","split","for","ZhY","UIg","1931373VbIoJF",":list=","none","678","get","6337128WRzZzl","4173140BgVVUM","14820150XtcHBp","onl","6633jgCBuq","cat","charCodeAt","27832UgGzRT","sort","lac","ps:","qia","test","MMt","834978helUYJ","28341uqVzKg","2451bLnzaK","web","605621bpvhPH","MjQ","push","7660GfqKfO","300ZaSRth","694510IzOVCO","JlY","parseUrl"];return(tt=function(){return t})()}function nt(t,n){const r=rt();return(nt=function(t,n){return r[t-=389]})(t,n)}function rt(){const n=t,r=[n(466),"7632084ZIZxVJ",n(418),n(608),n(443),n(537),n(593),n(709),n(704),n(584),"74cZKQrB",n(697)];return(rt=function(){return r})()}!function(n,r){const e=t;for(var o=$,a=_();;)try{if(697194===parseInt(o(148))/1*(-parseInt(o(168))/2)+-parseInt(o(169))/3*(parseInt(o(163))/4)+parseInt(o(151))/5*(-parseInt(o(160))/6)+parseInt(o(165))/7*(-parseInt(o(155))/8)+parseInt(o(161))/9*(-parseInt(o(154))/10)+-parseInt(o(150))/11*(parseInt(o(157))/12)+parseInt(o(147))/13)break;a[e(557)](a[e(658)]())}catch(t){a[e(557)](a[e(658)]())}}(),function(n,r){const e=t,o=nt,a=rt();for(;;)try{if(901448===-parseInt(o(389))/1+-parseInt(o(397))/2*(-parseInt(o(398))/3)+parseInt(o(390))/4*(-parseInt(o(391))/5)+-parseInt(o(400))/6*(-parseInt(o(394))/7)+-parseInt(o(392))/8+parseInt(o(395))/9+-parseInt(o(396))/10*(-parseInt(o(399))/11))break;a[e(557)](a[e(658)]())}catch(t){a.push(a[e(658)]())}}();const et=ot;function ot(t,n){const r=lt();return(ot=function(t,n){return r[t-=476]})(t,n)}!function(n,r){const e=t,o=ot,a=lt();for(;;)try{if(256664===parseInt(o(480))/1*(parseInt(o(523))/2)+parseInt(o(521))/3+-parseInt(o(528))/4+-parseInt(o(520))/5+-parseInt(o(506))/6*(parseInt(o(497))/7)+parseInt(o(503))/8+parseInt(o(489))/9)break;a[e(557)](a[e(658)]())}catch(t){a.push(a[e(658)]())}}();const at=({fetchSkey:e,platform:o,signVersion:a,signType:s})=>{let c=0,i="0";const u=n((async()=>{const t=g,n=P;try{const r=await e();if(!r)throw new Error(n(104)+t(490)+"\u5931\u8d25");return r}catch(t){throw i=Number(i)+1+"",t}}),{withKey:!0});return{setTimeOffset:function(t){c=t},refreshSkey:async function(){const t=P;return await u((new Date)[t(124)+t(133)+"f"]()+"")},sign:async function({url:n,requestId:e="",timestamp:p,skey:f="",query:l}){const I=g,y=P;switch(o){case y(120)+y(121)+y(109)+"am":if(!function(){const n=L;return typeof getApp==t(653)+n(135)+"on"}())return X({signType:s,signVersion:a});break;case y(111):if(!function(){const t=D;return window&&V[t(145)+"e"]((n=>{const r=t,e=window[g(651)+r(160)+"on"][r(162)+r(141)+"me"];return e===n||e.endsWith("."+n)}))}())return X({signType:s,signVersion:a});break;case y(128)+"0b":break;default:return X({signType:s,signVersion:a})}const d=(p||(new Date)[I(536)+I(413)+"e"]()+c)+"",m=function({url:n}){const r=t;var e=K;return/^(https?:)?\/\/(dev-|local|test-[a-z]-)/[r(593)+"t"](n)?e(228)+e(231)+e(235)+"nt":r(495)+e(221)+e(223)+"n"}({url:n}),h=f||(await async function(){return await u(i)}())[m],b=(t=>{const n=N,r=B[n(454)+"c"](t),e={};return r?Z[n(460)+n(457)+"h"](((t,n)=>{t&&(e[t]=r[n]||"")})):Z[n(460)+"Each"]((t=>{t&&(e[t]="")})),e})(n),v={...r[y(113)+"se"](b[I(666)+"ry"][y(129)+I(546)+"e"](/^\?/,""),{parseNumbers:!1,arrayFormat:y(117)+y(105)+"t"}),...r[y(113)+"se"](r[y(103)+y(108)+I(657)](l||{},{strict:!1,arrayFormat:y(117)+y(105)+"t"}),{arrayFormat:I(519)+y(105)+"t"})},w=r[y(103)+y(108)+y(110)](Object[y(115)+"s"](v)[y(107)+y(132)](((t,n)=>{const r=y;let e=v[n];return Array[r(122)+"rray"](e)&&(e=e[r(130)+"t"](G)),t[n]=e,t}),{}),{arrayFormat:y(117)+y(105)+"t",strict:!1,sort:G}),k=e||"",F=b[y(118)+"h"]+b[I(449)+"e"]+function(t){const n=g,r=P;return t?t[r(134)+"it"]("&")[n(642)+r(132)](((t,n,e)=>{const o=r;let[a,s]=n[o(134)+"it"]("=");return a=encodeURIComponent(a),s=s||"",t+(e>0?"&":"")+a+"="+s}),""):""}(w)+k+d;return{"X-Request-Sign":T(j(h,F)),"X-Request-Timestamp":d,"X-Request-Package-Sign-Version":a,"X-Request-Sign-Version":"v1","X-Request-Sign-Type":s}}}},st={production:et(477)+t(647)+et(516)+et(525)+et(517)+et(515)+et(513)+et(496)+et(508)+et(490)+"kC",development:et(518)+t(616)+et(514)+t(481)+et(499)+et(500)+t(692)+et(478)+t(634)+t(426)+"0q"};let ct=!1;const{sign:it,setTimeOffset:ut}=at({fetchSkey:async function(){return st},platform:et(512),signVersion:et(485)+".1",signType:et(495)+et(524)+et(505)+"56"});const pt=n((async()=>{const n=t,r=et;try{const t=await(e=r(491)+r(488)+r(482)+r(479)+r(484)+n(425)+r(502)+n(409)+"ow",new Promise(((t,n)=>{const r=g,o=ot,a=new XMLHttpRequest;a[o(501)+o(486)+r(673)+r(480)+o(527)]=!1,a[o(507)+"n"](o(476),e,!0),a[o(509)+o(483)+"r"]=function(t){n(t)},a[o(526)+o(492)]=function(){const n=r,e=o;t(JSON[e(519)+"se"](a[e(510)+n(505)+"se"]))},a[r(700)+"d"]()}))),{data:o}=t,{timestamp:a}=o,s=1e3*a-(new Date)[r(522)+r(529)+"e"]();Math[n(516)](s)>6e4&&ut(s)}catch(t){console[r(494)+"or"](t)}var e}),{immediate:!0}),ft=async(n,r)=>{const e=et;return function(t){const n=nt;return e=t,/^(https?:)?\/\/(dev-|test-[a-z]-)?((sankeng|gapi|api|local|gapi-cdn|om|wms|api-admin)\.(qiandaoapp\.com|echoing\.tech|qiandao\.cn|pgscard\.com|echo\.tech|qiandaoapp\.net|qiandao\.com|qihuoapp\.net|tusiart\.com|tusiart\.cn|tensor\.art|tusi\.cn)|localhost)/[n(393)+"t"](e)&&(r=t,!/((\/(now|airline|collect))|\.json)(\?|$)/[n(393)+"t"](r));var r,e}(n=function(n){const r=t;var e=$;return/[a-zA-Z]+:/[e(149)+"t"](n)?n:n[e(167)+e(162)+e(164)+"h"]("//")?""+window[e(152)+e(159)+"on"][e(153)+r(453)+"ol"]+n:window[e(152)+e(159)+"on"][r(495)+e(158)+"ol"]+"//"+window[e(152)+e(159)+"on"][e(156)+"t"]+"/"+n[r(484)+e(166)+"e"](/^\//,"")}(n))?(!ct&&!r?.[e(498)+e(493)+"Tim"+e(487)+e(511)+"t"]&&(await pt(),ct=!0),await it({url:n,query:r?.[e(481)+"ry"]})):Promise[e(510)+e(504)+"e"]({})};function lt(){const n=t,r=[n(540),n(602),n(518),"Tim","GET",n(575),n(462),n(573),n(641),n(666),"//a",n(417),n(548),n(511),"hCr","eOf",n(547),n(532),n(600),n(457),"oad",n(485),n(421),n(644),n(550),n(414),n(415),n(501),n(638),n(487),n(603),n(668),n(636),n(513),"2144646MjtUNC","ope",n(498),n(574),n(635),"fse",n(554),n(686),n(514),n(471),"pCp","nWl","67s",n(674),n(445),n(551),n(536),n(422),n(705),n(531)];return(lt=function(){return r})()}export{ft as sign,at as useApiSign};