vps-work 2.5.0 → 2.5.1

package/dist/packages/vps-work/src/core/cli-root-help.js

@@ -0,0 +1,190 @@
+import { CLI_BIN } from './cli-bin.js';
+/** Lark-cli-style sections appended to `vps-work --help`. */
+export function buildCliRootHelpAfter() {
+    const b = CLI_BIN;
+    return [
+        '',
+        'USAGE:',
+        `    ${b} catalog [--domain sales]`,
+        `    ${b} exec --skill <key> --script <key> [--param k=v]`,
+        `    ${b} vertu-aisales tools | vertu-aisales call --tool <name> --args @params.json`,
+        `    ${b} vertu-erp tools | vertu-erp call --tool <name> --args @params.json`,
+        `    ${b} <domain> +<shortcut> [options]`,
+        `    ${b} auth <subcommand> [options]`,
+        '',
+        'EXAMPLES:',
+        '    # Human interactive sign-in (Agent/Bot/Hermes must use host-injected app_key)',
+        `    ${b} auth login`,
+        `    ${b} auth tenants`,
+        `    ${b} auth use --tenant <uuid>`,
+        `    ${b} catalog --domain sales`,
+        `    ${b} exec --skill vps-dealer-ops --script sales --param period=this_month`,
+        '',
+        '    # Session and API scopes',
+        `    ${b} auth status`,
+        `    ${b} auth scopes`,
+        '',
+        '    # Email (legacy mail +send is IM direct messaging)',
+        `    ${b} mail +messages --unread-only`,
+        `    ${b} mail +mailboxes`,
+        `    ${b} mail +send-email --help`,
+        '',
+        '    # Sales KPI',
+        `    ${b} sales +headline-kpi`,
+        `    ${b} sales +headline-kpi --period this_month --dry-run`,
+        `    ${b} sales +orders --period this_month --logistics-no SF123`,
+        `    ${b} sales +order-logistics --logistics-no SF123`,
+        `    ${b} sales +dept-breakdown --period this_month --group-by salesperson`,
+        '',
+        `    # Desktop Office: discover sessions and native editor tools`,
+        `    ${b} office +status`,
+        `    ${b} office +sessions`,
+        `    ${b} office +tools --session-id <id>`,
+        '',
+        '    # Purchasing (explicit read-only grants)',
+        `    ${b} purchase +requests --start-date 2026-10-01`,
+        `    ${b} purchase +order-lines --id <ERP-order-id>`,
+        '',
+        '    # Store management',
+        `    ${b} store +reception --period this_month`,
+        `    ${b} store +walk-in --period this_month --group-by department,date`,
+        `    ${b} store +inventory --group-by store,product`,
+        `    ${b} store +reception --start-date 2026-08-01 --end-date 2026-08-18 --region 东区`,
+        '',
+        '    # HR identity, organization, personnel, and contracts',
+        `    ${b} hr +me`,
+        `    ${b} hr +org-tree --max-depth 2`,
+        `    ${b} hr +headcount`,
+        `    ${b} hr +profile`,
+        `    ${b} hr +subordinates            # all levels by default; add --direct for direct reports`,
+        `    ${b} hr +manager`,
+        `    ${b} hr +job-details --department-l1 "线下事业部" --job "销售"`,
+        `    ${b} hr +job-responsibilities --department "AI业务" --job "私域销售" --all`,
+        `    ${b} hr +job-responsibilities --name "谭启林" --doc-type all`,
+        `    ${b} hr +contracts`,
+        `    ${b} hr +payslip --name "张三" --salary-month 2026-04`,
+        '',
+        '    # Corporate records, seals, business workflows, and regulations',
+        `    ${b} corporate +partner-list --search "深圳"`,
+        `    ${b} corporate +seal-list --kind contract --status finished`,
+        `    ${b} corporate +business-list --kind business-policy`,
+        `    ${b} corporate +regulation-list`,
+        `    ${b} corporate +attachments --record-type regulation --record-id 53`,
+        '',
+        '    # Product & supply chain (data-view)',
+        `    ${b} product +inventory --product-name "AGENT Q"`,
+        `    ${b} product +inventory --product-subcategory "VERTU ALPHAFOLD" --product-material 小牛皮 --product-color 黑色 --group-by store_detail`,
+        `    ${b} product +price --product-subcategory "VERTU ALPHAFOLD" --product-material 鳄鱼皮 --price-region overseas`,
+        `    ${b} product +delivery --department 线上`,
+        `    ${b} product +kit-materials --product-name IRONFLIP`,
+        `    ${b} product +phone-head-inventory --product-name QUANTUM`,
+        `    ${b} product +abnormal-location --default-selected`,
+        `    ${b} product +abnormal-details --imeis 860000000000001,860000000000002`,
+        '',
+        '    # OKR',
+        `    ${b} okr +dept-okr --okr-period 2026-05`,
+        '',
+        '    # Daily report',
+        `    ${b} report +checkin-missing --date 2026-06-11`,
+        `    ${b} report +mine --user-id 123 --start-time 2026-06-01 --end-time 2026-06-11`,
+        `    ${b} report +tasks --limit 50`,
+        `    ${b} report +submit --task-id 2454 --progress 80 --spent-hours 6 --content '今日进展' --tomorrow '明日计划'`,
+        `    ${b} report +sync`,
+        '',
+        '    # Attendance daily reports',
+        `    ${b} attendance +daily --from-date 2026-08-01 --to-date 2026-08-25`,
+        `    ${b} attendance +daily --from-date 2026-08-01 --to-date 2026-08-25 --managed-departments`,
+        `    ${b} attendance +daily --from-date 2026-08-01 --to-date 2026-08-25 --employee-id 123`,
+        `    ${b} attendance +daily --from-date 2026-08-01 --to-date 2026-08-25 --department-path "总部 / 研发"`,
+        `    ${b} attendance +daily --from-date 2026-08-01 --to-date 2026-08-25 --all`,
+        `    ${b} attendance +schedule-rules`,
+        `    ${b} attendance +schedule-shifts --rule-id <id> --availability all`,
+        `    ${b} attendance +schedule-members --rule-id <id> --from-date 2026-08-26 --to-date 2026-08-31`,
+        `    ${b} attendance +schedule-preview --rule-id <id> --employee-ids 101,102 --from-date 2026-08-26 --to-date 2026-08-31 --shift-template-id <id>`,
+        `    ${b} attendance +schedule-apply --rule-id <id> --items-file plan.json --preview-token <token> --client-request-id <uuid>`,
+        '',
+        '    # Calendar',
+        `    ${b} calendar +mine --start-date 2026-07-20 --end-date 2026-07-26`,
+        `    ${b} calendar +person --name "张三" --start-date 2026-07-23`,
+        `    ${b} calendar +create --title "项目评审" --starts-at "2026-07-24 09:00" --ends-at "2026-07-24 10:00" --reminder-minutes 15m,1h`,
+        `    ${b} calendar +update --event-id <uuid> --location "深圳办公室"`,
+        `    ${b} calendar +respond --event-id <uuid> --status accepted`,
+        `    ${b} calendar +calendars`,
+        `    ${b} calendar +availability --user-ids 12708,12556 --start-date 2026-07-23`,
+        '',
+        '    # Cloud documents',
+        `    ${b} docs +list`,
+        `    ${b} docs +get --doc-id <uuid>`,
+        `    ${b} docs +block-schema`,
+        `    ${b} docs +get-blocks --doc-id <uuid>`,
+        `    ${b} docs +update-block --doc-id <uuid> --block-id <id> --expected-version <version> --type heading --level 2 --align center`,
+        `    ${b} docs +create --title "项目方案" --content-file ./方案.md`,
+        `    ${b} docs +create --title "项目台账" --type sheet`,
+        `    ${b} docs +share --doc-id <uuid> --mode login-view`,
+        `    ${b} docs +send --doc-id <uuid> --permission view`,
+        '',
+        '    # Content creation (AI image / video / audio)',
+        `    ${b} creative +models --type image`,
+        `    ${b} creative +image --model openai/gpt-image-2.5-sunburst --prompt "一只金丝猴在雪山上" --aspect-ratio 16:9`,
+        `    ${b} creative +video --model <id> --prompt "..." --ratio 16:9 --duration 5 --wait`,
+        `    ${b} creative +video-status --model <id> --task-id <task_id>`,
+        `    ${b} creative +tts --model <id> --text "你好，欢迎使用" --voice-id <voice_id>`,
+        `    ${b} creative +music --model <id> --prompt "轻松愉快的爵士乐"`,
+        '',
+        '    # Local V Drive files',
+        `    ${b} drive +list --recursive`,
+        `    ${b} drive +mkdir --name "项目资料"`,
+        `    ${b} drive +upload --parent-id <uuid> --source ./方案.pdf`,
+        `    ${b} drive +read --item-id <uuid>`,
+        `    ${b} drive +download --item-id <uuid> --output ./downloads/`,
+        '',
+        '    # Platform common tools',
+        `    ${b} tools +oss-upload --file ./report.pdf`,
+        `    ${b} tools +oss-upload --file ./logo.png --visibility public`,
+        '',
+        '    # Agent mobile popup',
+        `    ${b} popup +send --title "今日提醒" --content "还有 2 个待办即将到期" --gradient-start "#FCEBE4" --gradient-end "#FFFBFA"`,
+        `    ${b} popup +send --user-id 12708 --title "管理员提醒" --content "请及时查看新的工作安排"`,
+        '',
+        '    # R&D tasks / todos (task-center)',
+        `    ${b} task +tc-tasks`,
+        `    ${b} task +tc-todos`,
+        `    ${b} task +tc-assisted-users`,
+        `    ${b} task +tc-projects`,
+        `    ${b} task +tc-todo-create --title '跟进事项' --project-id <uuid>`,
+        `    ${b} task +tc-todo-update --todo-id <uuid> --status done`,
+        `    ${b} task +my-okr --type mine`,
+        '',
+        '    # IM (Vertu native)',
+        `    ${b} im +chat --user-id 12708`,
+        `    ${b} im +history --channel-id <id> --date-from 2026-06-01 --date-to 2026-06-11`,
+        `    ${b} im +send-user --user-id 12708 --body '你好'`,
+        `    ${b} im +send --channel-id <id> --body '群公告' --attach ./slide.pdf`,
+        `    ${b} im +broadcast --user-ids '12708,12556' --body '通知'`,
+        '',
+        'FLAGS (shortcuts):',
+        '    --params <json>       merge JSON into defaults; also @path or @- (stdin)',
+        '    --params-file <path>  read --params from file (mutually exclusive)',
+        '    --validate-only       preview request payload without executing / querying',
+        '    --dry-run             alias for --validate-only; no network call for execute shortcuts',
+        '    --no-json             plain text instead of formatted JSON',
+        '    --base-url <url>      override Vertu service URL (shortcuts / auth)',
+        '',
+        'AI AGENT SKILLS:',
+        '    Public skills ship inside the package and install with no login:',
+        `        ${b} skill list`,
+        `        ${b} skill install --all --agent all   # cursor / claude-code / hermes / ...`,
+        `        ${b} skill update                      # re-sync after upgrade`,
+        '',
+        `    \`${b} install\` also lays them into detected agent dirs automatically.`,
+        '    Manage personal skills with the current host-injected identity:',
+        `        ${b} skill +create-personal --slug <slug> --title <title> --instructions @file`,
+        `        ${b} skill +update-personal --slug <slug> --skill-md @SKILL.md`,
+        `        ${b} skill +change-category --slug <slug> --category <key>`,
+        `        ${b} skill +request-publication --slug <slug>`,
+        `        ${b} skill +delete-personal --slug <slug>`,
+    ].join('\n');
+}
+export function buildCliRootHelpBefore() {
+    return `${CLI_BIN} — VPS tenant-aware business CLI.\n`;
+}

package/dist/packages/vps-work/src/core/client.js

@@ -0,0 +1,158 @@
+import { request as undiciRequest } from 'undici';
+import { AuthRequiredError, parseRateLimitInfo, RateLimitError, RemoteError, SessionExpiredError, } from './errors.js';
+const DEFAULT_TIMEOUT_MS = 60_000;
+function joinUrl(baseUrl, path, query) {
+    const trimmedBase = baseUrl.replace(/\/+$/, '');
+    const trimmedPath = path.startsWith('/') ? path : `/${path}`;
+    const url = new URL(`${trimmedBase}${trimmedPath}`);
+    if (query) {
+        for (const [key, value] of Object.entries(query)) {
+            if (value !== undefined && value !== null)
+                url.searchParams.set(key, value);
+        }
+    }
+    return url.toString();
+}
+function buildHeaders(opts, internal) {
+    const headers = {
+        accept: 'application/json',
+        ...(opts.headers ?? {}),
+    };
+    if (internal.body !== undefined && internal.contentType) {
+        headers['content-type'] = internal.contentType;
+    }
+    if (opts.auth?.bearer && !internal.noBearer) {
+        headers.authorization = `Bearer ${opts.auth.bearer}`;
+    }
+    if (opts.auth?.sessionId) {
+        const existing = headers.cookie ? `${headers.cookie}; ` : '';
+        headers.cookie = `${existing}session_id=${opts.auth.sessionId}`;
+    }
+    return headers;
+}
+async function readBody(stream) {
+    const chunks = [];
+    for await (const chunk of stream)
+        chunks.push(chunk);
+    return Buffer.concat(chunks);
+}
+async function performRequest(opts, path, internal) {
+    const url = joinUrl(opts.baseUrl, path, internal.query);
+    const method = internal.method ?? (internal.body !== undefined ? 'POST' : 'GET');
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    const headers = buildHeaders(opts, internal);
+    if (process.env.VERTU_DEBUG === '1') {
+        process.stderr.write(`[vps-work] ${method} ${url}\n`);
+    }
+    try {
+        const response = await undiciRequest(url, {
+            method,
+            headers,
+            body: internal.body,
+            signal: controller.signal,
+        });
+        if (process.env.VERTU_DEBUG === '1') {
+            process.stderr.write(`[vps-work]   <- ${response.statusCode}\n`);
+        }
+        const buf = await readBody(response.body);
+        return { status: response.statusCode, body: buf, headers: response.headers };
+    }
+    catch (err) {
+        if (err.name === 'AbortError') {
+            throw new RemoteError(`Request to ${url} timed out`, { hint: 'Try increasing --timeout or check network.' });
+        }
+        throw new RemoteError(`Network error contacting ${url}: ${err.message}`, { hint: 'Check base-url and connectivity.' });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function parseSetCookie(headers) {
+    const raw = headers['set-cookie'];
+    if (!raw)
+        return [];
+    return Array.isArray(raw) ? raw : [raw];
+}
+export class OdooClient {
+    opts;
+    constructor(opts) {
+        if (!opts.baseUrl)
+            throw new Error('OdooClient requires a baseUrl');
+        this.opts = { ...opts };
+    }
+    get baseUrl() {
+        return this.opts.baseUrl;
+    }
+    setAuth(auth) {
+        this.opts.auth = auth;
+    }
+    getAuth() {
+        return this.opts.auth;
+    }
+    /** JSON-RPC POST helper for any Odoo `type="json"` route. */
+    async jsonRpc(path, params = {}, extra) {
+        const body = Buffer.from(JSON.stringify({ jsonrpc: '2.0', method: 'call', params, id: Date.now() }), 'utf8');
+        const res = await performRequest(this.opts, path, {
+            method: 'POST',
+            body,
+            contentType: 'application/json',
+            raw: true,
+            noBearer: extra?.noBearer ?? false,
+        });
+        if (res.status === 401 || res.status === 403) {
+            throw new SessionExpiredError(`Odoo rejected the request (HTTP ${res.status}) on ${path}`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(res.body.toString('utf8'));
+        }
+        catch (err) {
+            throw new RemoteError(`Failed to parse JSON-RPC response from ${path} (HTTP ${res.status}): ${err.message}`, { status: res.status });
+        }
+        if (parsed.error) {
+            const data = parsed.error.data;
+            const message = data?.message ?? parsed.error.message ?? 'Odoo returned an error';
+            const name = data?.name ?? '';
+            if (name.includes('AccessDenied') || name.includes('AccessError') || /not\s+authenticated/i.test(message)) {
+                throw new AuthRequiredError(message);
+            }
+            if (name.includes('AiRateLimitError') || /\bRATE_LIMITED\b/.test(message)) {
+                const info = parseRateLimitInfo(message);
+                throw new RateLimitError(message, {
+                    status: res.status,
+                    code: name || undefined,
+                    data: parsed.error.data,
+                    retryAfterSeconds: info.retryAfterSeconds,
+                    limitType: info.limitType,
+                });
+            }
+            throw new RemoteError(message, {
+                status: res.status,
+                code: name || undefined,
+                data: parsed.error.data,
+            });
+        }
+        if (!('result' in parsed)) {
+            throw new RemoteError(`Unexpected JSON-RPC payload from ${path}: missing "result"`, { status: res.status });
+        }
+        return { result: parsed.result, setCookie: parseSetCookie(res.headers) };
+    }
+    /** Plain HTTP GET (e.g. for /ai/skills/v1/skill_file). */
+    async httpGet(path, query) {
+        const res = await performRequest(this.opts, path, { method: 'GET', query, raw: true });
+        if (res.status === 401 || res.status === 403) {
+            throw new SessionExpiredError(`Odoo rejected GET ${path} (HTTP ${res.status})`);
+        }
+        return res;
+    }
+}
+/** Extract Odoo session_id from a Set-Cookie header array, if present. */
+export function extractSessionIdFromSetCookie(setCookie) {
+    for (const raw of setCookie) {
+        const match = /(?:^|;\s*)session_id=([^;]+)/i.exec(raw);
+        if (match && match[1])
+            return match[1];
+    }
+    return undefined;
+}

package/dist/packages/vps-work/src/core/config.js

@@ -0,0 +1,183 @@
+import { mkdir, writeFile, chmod } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { z } from 'zod';
+import { readUtf8File } from '../utils/read-text.js';
+import { configFilePath, homeDir } from './paths.js';
+const ProfileSchema = z.object({
+    baseUrl: z.string().url(),
+    db: z.string().optional(),
+    login: z.string().optional(),
+    /** Plain-text fallback when keytar is unavailable. */
+    sessionId: z.string().optional(),
+    /** Plain-text fallback when keytar is unavailable. */
+    bearer: z.string().optional(),
+    /** Plain-text fallback when keytar is unavailable; only present when the user opted in to "remember password". */
+    password: z.string().optional(),
+    updatedAt: z.string().optional(),
+});
+const EndpointSchema = z.object({
+    baseUrl: z.string().url(),
+});
+const ConfigSchema = z.object({
+    version: z.literal(1).default(1),
+    defaultBaseUrl: z.string().url().optional(),
+    profiles: z.record(z.string(), ProfileSchema).default({}),
+    /**
+     * Map of alias → endpoint metadata. The primary endpoint is implied by `defaultBaseUrl`
+     * (and is registered as alias `default` on first load). Other entries (e.g. `im`) are
+     * synced automatically from the server-side `endpoint_aliases` capabilities payload.
+     */
+    endpoints: z.record(z.string(), EndpointSchema).default({}),
+});
+export const EMPTY_CONFIG = { version: 1, profiles: {}, endpoints: {} };
+/** Reserved alias used to represent the primary endpoint (i.e. `defaultBaseUrl`). */
+export const PRIMARY_ALIAS = 'default';
+/**
+ * 默认服务环境（Vertu VPS Service 正式环境）。
+ *
+ * 仅供人工兼容 legacy Odoo CLI 时解析旧 endpoint。Agent/Bot/Hermes 不使用该配置，
+ * 必须由宿主注入 vps-service app_key（Hermes 固定 app_id=vertu-hermes-agent）。
+ */
+export const DEFAULT_BASE_URL = 'https://vps-service.vertu.cn';
+/**
+ * 人工 legacy Odoo CLI 的有效 base URL：CLI 全局 `--base-url` > `VERTU_BASE_URL` > config > {@link DEFAULT_BASE_URL}。
+ */
+export function resolveEffectiveBaseUrl(config, opts = {}) {
+    const fromOverride = opts.override?.trim();
+    if (fromOverride)
+        return fromOverride;
+    const fromEnv = opts.envBaseUrl?.trim();
+    if (fromEnv)
+        return fromEnv;
+    if (config.defaultBaseUrl)
+        return config.defaultBaseUrl;
+    return DEFAULT_BASE_URL;
+}
+const ALIAS_RE = /^[a-z][a-z0-9-]*$/;
+export function isValidAlias(alias) {
+    return ALIAS_RE.test(alias);
+}
+async function ensureHomeDir() {
+    await mkdir(homeDir(), { recursive: true });
+}
+async function tryRestrictPermissions(path) {
+    if (process.platform === 'win32')
+        return;
+    try {
+        await chmod(path, 0o600);
+    }
+    catch {
+        /* best-effort */
+    }
+}
+export async function readConfig() {
+    try {
+        const raw = await readUtf8File(configFilePath());
+        const parsed = JSON.parse(raw);
+        return ConfigSchema.parse(parsed);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return { ...EMPTY_CONFIG };
+        throw err;
+    }
+}
+export async function writeConfig(config) {
+    await ensureHomeDir();
+    const path = configFilePath();
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, `${JSON.stringify(config, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    await tryRestrictPermissions(path);
+}
+export function getProfile(config, baseUrl) {
+    return config.profiles[baseUrl];
+}
+export function upsertProfile(config, profile) {
+    return {
+        ...config,
+        defaultBaseUrl: config.defaultBaseUrl ?? profile.baseUrl,
+        profiles: {
+            ...config.profiles,
+            [profile.baseUrl]: { ...profile, updatedAt: new Date().toISOString() },
+        },
+    };
+}
+export function deleteProfile(config, baseUrl) {
+    if (!(baseUrl in config.profiles))
+        return config;
+    const next = { ...config.profiles };
+    delete next[baseUrl];
+    return {
+        ...config,
+        defaultBaseUrl: config.defaultBaseUrl === baseUrl ? undefined : config.defaultBaseUrl,
+        profiles: next,
+    };
+}
+export function setDefaultBaseUrl(config, baseUrl) {
+    return { ...config, defaultBaseUrl: baseUrl };
+}
+export function upsertEndpoint(config, alias, baseUrl) {
+    return {
+        ...config,
+        endpoints: {
+            ...config.endpoints,
+            [alias]: { baseUrl },
+        },
+    };
+}
+export function deleteEndpoint(config, alias) {
+    if (!(alias in config.endpoints))
+        return config;
+    const next = { ...config.endpoints };
+    delete next[alias];
+    return { ...config, endpoints: next };
+}
+/**
+ * Resolve an endpoint alias to its base URL.
+ *
+ * - The reserved alias `default` always resolves to `defaultBaseUrl`, regardless of whether
+ *   it was explicitly registered in the `endpoints` map.
+ * - Other aliases must exist in `endpoints`.
+ * - Returns `undefined` when the alias is not registered (callers decide whether to throw).
+ */
+export function getEndpointBaseUrl(config, alias) {
+    if (alias === PRIMARY_ALIAS)
+        return config.defaultBaseUrl ?? DEFAULT_BASE_URL;
+    return config.endpoints[alias]?.baseUrl;
+}
+/**
+ * Return the alias registered for the given base URL (case-insensitive trailing-slash agnostic),
+ * preferring `default` when the URL matches `defaultBaseUrl`.
+ */
+export function findAliasForBaseUrl(config, baseUrl) {
+    const normalize = (url) => url.replace(/\/+$/, '').toLowerCase();
+    const target = normalize(baseUrl);
+    if (normalize(config.defaultBaseUrl ?? DEFAULT_BASE_URL) === target)
+        return PRIMARY_ALIAS;
+    for (const [alias, entry] of Object.entries(config.endpoints)) {
+        if (normalize(entry.baseUrl) === target)
+            return alias;
+    }
+    return undefined;
+}
+/**
+ * List every known endpoint as `(alias, baseUrl)` pairs. The primary alias (`default`) comes
+ * first when `defaultBaseUrl` is set, then registered endpoints are appended in alphabetical
+ * order. Aliases registered both as primary and explicitly are deduplicated.
+ */
+export function listEndpoints(config) {
+    const out = [];
+    const seenAliases = new Set();
+    if (config.defaultBaseUrl) {
+        out.push({ alias: PRIMARY_ALIAS, baseUrl: config.defaultBaseUrl });
+        seenAliases.add(PRIMARY_ALIAS);
+    }
+    const sorted = Object.entries(config.endpoints).sort(([a], [b]) => a.localeCompare(b));
+    for (const [alias, entry] of sorted) {
+        if (seenAliases.has(alias))
+            continue;
+        out.push({ alias, baseUrl: entry.baseUrl });
+        seenAliases.add(alias);
+    }
+    return out;
+}

package/dist/packages/vps-work/src/core/corporate-client.js

@@ -0,0 +1,52 @@
+import { writeFile } from 'node:fs/promises';
+import { request } from 'undici';
+import { VertuError } from './errors.js';
+import { vpsServiceAuthHeaders } from './vps-service-http.js';
+async function errorMessage(status, text) {
+    try {
+        const payload = JSON.parse(text);
+        return new VertuError(payload.error ? String(payload.error) : `HTTP ${status}`);
+    }
+    catch {
+        return new VertuError(`Corporate request failed: HTTP ${status}`);
+    }
+}
+export async function runCorporateQuery(baseUrl, payload) {
+    const response = await request(`${baseUrl}/v1/corporate/query`, {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/json', accept: 'application/json', ...vpsServiceAuthHeaders(),
+        },
+        body: JSON.stringify(payload),
+    });
+    const text = await response.body.text();
+    if (response.statusCode >= 400)
+        throw await errorMessage(response.statusCode, text);
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new VertuError('Corporate query returned invalid JSON.');
+    }
+}
+export async function downloadCorporateAttachment(baseUrl, selector, output) {
+    const response = await request(`${baseUrl}/v1/corporate/attachment`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', ...vpsServiceAuthHeaders() },
+        body: JSON.stringify(selector),
+    });
+    const bytes = Buffer.from(await response.body.arrayBuffer());
+    if (response.statusCode >= 400)
+        throw await errorMessage(response.statusCode, bytes.toString('utf8'));
+    await writeFile(output, bytes, { flag: 'wx' }).catch((error) => {
+        if (error.code === 'EEXIST')
+            throw new VertuError(`Output already exists: ${output}`);
+        throw error;
+    });
+    return {
+        output,
+        bytes: bytes.length,
+        contentType: typeof response.headers['content-type'] === 'string'
+            ? response.headers['content-type'] : null,
+    };
+}

package/dist/packages/vps-work/src/core/creative-attachment-download.js

@@ -0,0 +1,48 @@
+import { createWriteStream } from 'node:fs';
+import { mkdir, rm } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { pipeline } from 'node:stream/promises';
+import { request } from 'undici';
+import { VertuError } from './errors.js';
+import { vpsServiceAuthHeaders } from './vps-service-http.js';
+export function creativeDownloadPath(baseUrl, input) {
+    if (Boolean(input.storageKey?.trim()) === Boolean(input.url?.trim()))
+        throw new VertuError('--url 与 --storage-key 必须且只能提供一个。');
+    let key = input.storageKey?.trim();
+    if (!key) {
+        const base = new URL(baseUrl), url = new URL(input.url, base);
+        const publicAlias = base.hostname === 'tenant-api' && url.origin === 'https://vps-service.vertu.cn';
+        if ((!publicAlias && url.origin !== base.origin) || url.username || url.password || url.hash
+            || url.pathname !== '/v1/creative/oss' || [...url.searchParams.keys()].some(k => k !== 'key')
+            || url.searchParams.getAll('key').length !== 1)
+            throw new VertuError('仅支持当前 VPS 服务的创意素材地址。');
+        key = url.searchParams.get('key') || '';
+    }
+    if (!key || /[\x00-\x1f\\]/.test(key) || key.split('/').some(p => p === '.' || p === '..'))
+        throw new VertuError('素材 storage key 无效。');
+    return '/v1/creative/oss?key=' + encodeURIComponent(key);
+}
+export async function downloadCreativeAttachment(baseUrl, input) {
+    const source = creativeDownloadPath(baseUrl, input);
+    // Always use the configured account gateway; never fetch the public URL or follow redirects with its credential.
+    const response = await request(new URL(source, baseUrl), { headers: { accept: '*/*', ...vpsServiceAuthHeaders() } });
+    if (response.statusCode !== 200) {
+        await response.body.dump();
+        throw new VertuError(`创意素材下载失败：HTTP ${response.statusCode}`);
+    }
+    const output = resolve(input.output);
+    await mkdir(dirname(output), { recursive: true });
+    const file = createWriteStream(output, { flags: 'wx' });
+    let opened = false, bytes = 0;
+    file.once('open', () => { opened = true; });
+    response.body.on('data', (chunk) => { bytes += chunk.length; });
+    try {
+        await pipeline(response.body, file);
+    }
+    catch (error) {
+        if (opened)
+            await rm(output, { force: true });
+        throw error;
+    }
+    return { output, bytes, content_type: response.headers['content-type'] || null, source_url: source };
+}