weaver-work-cli 0.1.1 → 0.1.4

package/dist/shortcuts/esb/operations/shared.js

@@ -0,0 +1,152 @@
+import { esbValidationError } from '../errors.js';
+/** 原型污染防护：禁止出现在输入对象中的键。 */
+const FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+export function asObject(value, field = 'input') {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw esbValidationError('input_not_object', `${field} 必须是 JSON 对象`);
+    }
+    return value;
+}
+export function assertNoForbiddenKeys(input) {
+    for (const key of Object.keys(input)) {
+        if (FORBIDDEN_KEYS.has(key)) {
+            throw esbValidationError('forbidden_key', `输入包含非法字段：${key}`);
+        }
+    }
+}
+/** 顶层输入严格白名单：schema 已声明 additionalProperties: false，运行时同样拒绝未知字段。 */
+export function assertKnownKeys(input, allowed, operation) {
+    const unknown = Object.keys(input).filter((key) => !allowed.includes(key));
+    if (unknown.length > 0) {
+        throw esbValidationError('unknown_field', `${operation} 不支持字段：${unknown.join('、')}`, { unknown });
+    }
+}
+function isFilled(value) {
+    return value !== undefined && value !== null && value !== '';
+}
+export function requiredString(value, field) {
+    if (!isFilled(value)) {
+        throw esbValidationError('field_required', `${field} 必填`);
+    }
+    if (typeof value === 'object') {
+        throw esbValidationError('field_invalid', `${field} 必须是字符串`);
+    }
+    return String(value);
+}
+/** 动作流 ID / applicationId：源资料中为长整型数字串，按字符串传递避免精度丢失。 */
+export function flowIdString(value, field) {
+    const text = requiredString(value, field);
+    if (!/^\d+$/.test(text)) {
+        throw esbValidationError('field_invalid', `${field} 必须是数字 ID（长整型按字符串传递）`);
+    }
+    return text;
+}
+export const TRIGGER_INPUT_KEYS = ['esbFlowId', 'uniqueIndent', 'employeeId', 'customParams', 'moduleSource'];
+/**
+ * 触发入参归一化。esbFlowId / uniqueIndent 二选一：都缺或多传均为结构化校验错误，
+ * 不做静默回退，避免把「唯一值触发」误当「普通触发」发出。
+ */
+export function normalizeTriggerInput(input) {
+    const hasFlowId = isFilled(input.esbFlowId);
+    const hasUniqueIndent = isFilled(input.uniqueIndent);
+    if (!hasFlowId && !hasUniqueIndent) {
+        throw esbValidationError('trigger_target_missing', 'esbFlowId 与 uniqueIndent 二选一必填：普通触发传 esbFlowId，唯一值触发传 uniqueIndent');
+    }
+    if (hasFlowId && hasUniqueIndent) {
+        throw esbValidationError('trigger_target_conflict', 'esbFlowId 与 uniqueIndent 不能同时传入，请二选一');
+    }
+    const employeeId = requiredString(input.employeeId, 'employeeId');
+    const customParams = asObject(input.customParams, 'customParams');
+    const mainTable = customParams.mainTable;
+    if (!mainTable || typeof mainTable !== 'object' || Array.isArray(mainTable)) {
+        throw esbValidationError('custom_params_invalid', 'customParams.mainTable 必须是 JSON 对象');
+    }
+    const moduleSource = isFilled(input.moduleSource) ? requiredString(input.moduleSource, 'moduleSource') : undefined;
+    return {
+        mode: hasFlowId ? 'esbFlowId' : 'uniqueIndent',
+        ...(hasFlowId ? { esbFlowId: flowIdString(input.esbFlowId, 'esbFlowId') } : {}),
+        ...(hasUniqueIndent ? { uniqueIndent: requiredString(input.uniqueIndent, 'uniqueIndent') } : {}),
+        employeeId,
+        customParams,
+        ...(moduleSource === undefined ? {} : { moduleSource }),
+    };
+}
+/** 触发接口请求体：与源接口文档的字段命名保持一致。 */
+export function buildTriggerPayload(target) {
+    return {
+        customParams: target.customParams,
+        ...(target.moduleSource === undefined ? {} : { moduleSource: target.moduleSource }),
+        ...(target.esbFlowId === undefined ? {} : { esbFlowId: target.esbFlowId }),
+        ...(target.uniqueIndent === undefined ? {} : { uniqueIndent: target.uniqueIndent }),
+        employeeId: target.employeeId,
+    };
+}
+const MAX_PLACEHOLDERS = 100;
+/** 收集模板中的 `#可选` 占位路径，告诉 Agent 哪些字段可以删或替换。 */
+export function collectPlaceholders(value, prefix = '', collected = []) {
+    if (collected.length >= MAX_PLACEHOLDERS)
+        return collected;
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => collectPlaceholders(item, `${prefix}[${index}]`, collected));
+        return collected;
+    }
+    if (value && typeof value === 'object') {
+        for (const [key, item] of Object.entries(value)) {
+            collectPlaceholders(item, prefix ? `${prefix}.${key}` : key, collected);
+            if (collected.length >= MAX_PLACEHOLDERS)
+                break;
+        }
+        return collected;
+    }
+    if (typeof value === 'string' && value.trim() === '#可选')
+        collected.push(prefix);
+    return collected;
+}
+const PAGE_ACTIONS = {
+    0: '无需页面操作',
+    1: '刷新页面',
+    2: '关闭页面',
+    3: '跳转页面',
+};
+const REMINDERS = {
+    0: '无提醒',
+    1: '提醒',
+    2: '确认',
+    3: '警告',
+    4: '错误',
+};
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+/**
+ * 触发结果归一化：resultCode 200 已在 host 层校验，这里只做 actionData 解读与后续动作摘要，
+ * 枚举含义取自源接口文档，不新增服务端未返回的字段。
+ */
+export function summarizeTriggerResult(value) {
+    const record = asRecord(value);
+    const actionData = asRecord(record.actionData);
+    const pageAction = Number(actionData.pageAction ?? 0);
+    const reminder = Number(actionData.reminder ?? 0);
+    const hasData = Number(actionData.hasData ?? 0);
+    const followUp = [];
+    if (pageAction !== 0)
+        followUp.push(PAGE_ACTIONS[pageAction] || `页面动作 ${pageAction}`);
+    if (reminder !== 0) {
+        const reminderMsg = typeof actionData.reminderMsg === 'string' && actionData.reminderMsg.trim()
+            ? actionData.reminderMsg.trim()
+            : undefined;
+        followUp.push(`${REMINDERS[reminder] || `提醒 ${reminder}`}${reminderMsg ? `：${reminderMsg}` : ''}`);
+    }
+    if (hasData === 1)
+        followUp.push('动作流返回了业务数据，见 actionData.responseData');
+    if (followUp.length === 0)
+        followUp.push('动作流已执行完成，无需额外页面动作');
+    return {
+        resultCode: 200,
+        resultMsg: typeof record.resultMsg === 'string' ? record.resultMsg : '',
+        ...(record.resultData === undefined ? {} : { resultData: record.resultData }),
+        ...(record.nextAction === undefined ? {} : { nextAction: record.nextAction }),
+        actionData,
+        followUp,
+    };
+}

package/dist/shortcuts/esb/operations/trigger.js

@@ -0,0 +1,76 @@
+import { esbSuccess } from './types.js';
+import { esbValidationError } from '../errors.js';
+import { isEsbFlowUnavailable } from '../host.js';
+import { asObject, buildTriggerPayload, collectPlaceholders, normalizeTriggerInput, requiredString, summarizeTriggerResult, } from './shared.js';
+/** prepare 阶段回查失败的提示文案：只暴露分类，不泄漏请求细节。 */
+function describeLookupFailure(error) {
+    if (error && typeof error === 'object') {
+        const structured = error;
+        const subtype = typeof structured.subtype === 'string' ? structured.subtype : 'unknown';
+        return `subtype=${subtype}`;
+    }
+    return 'cause=unknown';
+}
+export const esbTriggerHandlers = {
+    'esb.trigger.prepare': async (input, { host, continuation }) => {
+        const target = normalizeTriggerInput(input);
+        const warnings = [];
+        let templateFields = null;
+        if (target.mode === 'esbFlowId') {
+            const esbFlowId = target.esbFlowId;
+            try {
+                const raw = await host.inputFormat(esbFlowId);
+                const record = raw && typeof raw === 'object' && !Array.isArray(raw) ? raw : {};
+                templateFields = collectPlaceholders(record.customParams ?? null);
+            }
+            catch (error) {
+                // 目标动作流本身不可用（不存在/未绑定/未启用/回收站）时阻断；其余问题只降级为警告。
+                if (isEsbFlowUnavailable(error))
+                    throw error;
+                warnings.push(`目标动作流入参模板回查未成功（${describeLookupFailure(error)}），已跳过回查；触发是否可用以 apply 返回为准`);
+            }
+        }
+        else {
+            warnings.push('唯一值触发无法按 applicationId 回查：同一租户下存在相同唯一值的多条动作流时，系统只执行 create_time 最新的一条');
+        }
+        const payload = buildTriggerPayload(target);
+        const session = await host.getSession();
+        const token = await continuation.issue({
+            operation: 'esb.trigger.apply',
+            target: { mode: target.mode, value: target.esbFlowId ?? target.uniqueIndent },
+            actor: { userId: session.userId, tenantKey: session.tenantKey, profile: session.profile },
+            payload,
+        });
+        return esbSuccess('esb.trigger.prepare', {
+            target: {
+                mode: target.mode,
+                esbFlowId: target.esbFlowId ?? null,
+                uniqueIndent: target.uniqueIndent ?? null,
+                employeeId: target.employeeId,
+            },
+            requestPreview: payload,
+            templateFields,
+            continuation: token,
+            expiresInSeconds: 600,
+        }, { status: 'PREPARED' }, warnings);
+    },
+    'esb.trigger.apply': async (input, { host, continuation }) => {
+        if (input.confirm !== true) {
+            throw esbValidationError('confirm_required', '触发动作流是高风险写操作：必须显式传 confirm: true 表示用户已确认执行');
+        }
+        const record = await continuation.verify(requiredString(input.continuation, 'continuation'), 'esb.trigger.apply');
+        const session = await host.getSession();
+        const actor = record.actor && typeof record.actor === 'object' ? record.actor : {};
+        if (actor.userId !== session.userId || actor.tenantKey !== session.tenantKey) {
+            throw esbValidationError('continuation_actor_changed', 'continuation 签发时的登录身份与当前会话不一致，请重新执行 esb.trigger.prepare 后再确认');
+        }
+        const payload = asObject(record.payload, 'continuation.payload');
+        // 防御性复核：continuation 由 CLI 签发，但仍校验请求体形状未被破坏。
+        const mainTable = payload.customParams?.mainTable;
+        if (!mainTable || typeof mainTable !== 'object' || Array.isArray(mainTable)) {
+            throw esbValidationError('continuation_payload_invalid', 'continuation 中的 customParams.mainTable 缺失，请重新执行 esb.trigger.prepare');
+        }
+        const result = await host.trigger(payload);
+        return esbSuccess('esb.trigger.apply', summarizeTriggerResult(result), { status: 'COMPLETE' });
+    },
+};

package/dist/shortcuts/esb/operations/types.js

@@ -0,0 +1,21 @@
+export const READ = 'read';
+export const READ_BEFORE_WRITE = 'read-before-write';
+export const HIGH_RISK_WRITE = 'high-risk-write';
+export function esbSuccess(action, data, meta, warnings = []) {
+    const payload = { ok: true, action, data };
+    if (meta && Object.keys(meta).length > 0)
+        payload.meta = meta;
+    if (warnings.length > 0)
+        payload.warnings = warnings;
+    return payload;
+}
+/** 构造「对象类型 + 严格禁止额外字段」的 JSON Schema。 */
+export function schemaOf(properties, options = {}) {
+    return {
+        type: 'object',
+        additionalProperties: false,
+        properties,
+        ...(options.required?.length ? { required: options.required } : {}),
+        ...(options.description ? { description: options.description } : {}),
+    };
+}

package/dist/shortcuts/esb/operations.js

@@ -0,0 +1,15 @@
+import { esbManifest } from './manifest.js';
+import { getEsbOperation } from './operations/registry.js';
+import { assertKnownKeys, assertNoForbiddenKeys, asObject } from './operations/shared.js';
+/** 顶层输入白名单直接取自 manifest：schema 即运行时约束，避免两处规则漂移。 */
+const ALLOWED_KEYS = Object.fromEntries(esbManifest.operations.map((operation) => [
+    operation.name,
+    Object.keys(operation.inputSchema.properties ?? {}),
+]));
+export async function executeEsbOperation(operation, rawInput, context) {
+    const definition = getEsbOperation(operation);
+    const input = asObject(rawInput);
+    assertNoForbiddenKeys(input);
+    assertKnownKeys(input, ALLOWED_KEYS[operation] ?? [], operation);
+    return definition.handler(input, context);
+}

package/dist/shortcuts/fna/continuation.js

@@ -0,0 +1,70 @@
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { resolve } from 'node:path';
+import { fnaValidationError } from './errors.js';
+function stateRoot(ctx) {
+    const configured = ctx?.config?.path();
+    if (configured)
+        return resolve(configured, '..');
+    return process.env.WEAVER_WORK_CLI_HOME || process.env.WORK_CLI_HOME || resolve(homedir(), '.weaver-work-cli');
+}
+async function loadKey(ctx) {
+    const keysDir = resolve(stateRoot(ctx), 'keys');
+    const filename = resolve(keysDir, 'fna-continuation.key');
+    await mkdir(keysDir, { recursive: true, mode: 0o700 });
+    if (existsSync(filename))
+        return readFile(filename);
+    const key = randomBytes(32);
+    try {
+        await writeFile(filename, key, { flag: 'wx', mode: 0o600 });
+        if (process.platform !== 'win32')
+            await chmod(filename, 0o600).catch(() => undefined);
+        return key;
+    }
+    catch {
+        return readFile(filename);
+    }
+}
+function encode(value) {
+    return Buffer.from(JSON.stringify(value)).toString('base64url');
+}
+function signature(payload, key) {
+    return createHmac('sha256', key).update(payload).digest('base64url');
+}
+export function createFnaContinuationSigner(ctx) {
+    return {
+        async issue(payload, ttlMs = 10 * 60_000) {
+            const issuedAt = Date.now();
+            const body = encode({ ...payload, issuedAt, expiresAt: issuedAt + ttlMs });
+            const sig = signature(body, await loadKey(ctx));
+            return `${body}.${sig}`;
+        },
+        async verify(token, expectedOperation) {
+            if (typeof token !== 'string' || !token.includes('.')) {
+                throw fnaValidationError('continuation_invalid', 'continuation 无效');
+            }
+            const [body, provided] = token.split('.');
+            const expected = signature(body, await loadKey(ctx));
+            const valid = provided.length === expected.length
+                && timingSafeEqual(Buffer.from(provided), Buffer.from(expected));
+            if (!valid)
+                throw fnaValidationError('continuation_invalid', 'continuation 签名校验失败');
+            let value;
+            try {
+                value = JSON.parse(Buffer.from(body, 'base64url').toString('utf8'));
+            }
+            catch {
+                throw fnaValidationError('continuation_invalid', 'continuation 内容无法解析');
+            }
+            if (value.operation !== expectedOperation) {
+                throw fnaValidationError('continuation_mismatch', 'continuation 不属于当前操作');
+            }
+            if (!Number.isSafeInteger(value.expiresAt) || value.expiresAt < Date.now()) {
+                throw fnaValidationError('continuation_expired', 'continuation 已过期');
+            }
+            return value;
+        },
+    };
+}

package/dist/shortcuts/fna/errors.js

@@ -0,0 +1,59 @@
+import { CliError, ExitCode } from '../../core/errors.js';
+export class FnaCliError extends CliError {
+    type;
+    subtype;
+    code;
+    retryable;
+    stage;
+    details;
+    partialData;
+    constructor(type, subtype, message, options = {}) {
+        super(message, options.exitCode ?? ExitCode.InternalError);
+        this.name = 'FnaCliError';
+        this.type = type;
+        this.subtype = subtype;
+        this.code = options.code;
+        this.retryable = options.retryable ?? false;
+        this.stage = options.stage;
+        this.details = options.details;
+        this.partialData = options.partialData;
+    }
+}
+export function fnaValidationError(subtype, message, details) {
+    return new FnaCliError('validation', subtype, message, {
+        details,
+        exitCode: ExitCode.UsageError,
+    });
+}
+export function fnaAuthError(subtype, message, details) {
+    return new FnaCliError('authentication', subtype, message, {
+        details,
+        exitCode: ExitCode.AuthError,
+    });
+}
+export function fnaNetworkError(subtype, message, options = {}) {
+    return new FnaCliError('network', subtype, message, {
+        ...options,
+        retryable: options.retryable ?? true,
+        exitCode: ExitCode.NetworkError,
+    });
+}
+export function fnaConfirmationError(action, details) {
+    return new FnaCliError('confirmation', 'required', '该操作需要明确确认', {
+        details: { action, ...details },
+        exitCode: ExitCode.ConfirmationRequired,
+    });
+}
+export function fnaPartialError(message, partialData, details) {
+    return new FnaCliError('partial', 'write_uncertain', message, {
+        details,
+        partialData,
+        exitCode: ExitCode.Partial,
+    });
+}
+export function isFnaNetworkError(error) {
+    return Boolean(error
+        && typeof error === 'object'
+        && 'type' in error
+        && error.type === 'network');
+}

package/dist/shortcuts/fna/host.js

@@ -0,0 +1,146 @@
+import { requireE10Session } from '../../internal/e10/context.js';
+import { getActiveProfile } from '../../internal/e10/auth/session.js';
+import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { FnaCliError, fnaAuthError, fnaNetworkError, fnaValidationError } from './errors.js';
+function inferProfile(ctx) {
+    const options = ctx.getGlobalOptions();
+    return options.profile || getActiveProfile();
+}
+/**
+ * FNA 费控中心返回 WeaResult 外层，但子模块成功字段不统一：
+ * - 费用中心 AI 查询：{ code, msg, success, data }
+ * - 预算 / 借款管理 / 发票核销：{ code, msg, status, fail, data }
+ * 均以 code == 200 为业务成功。
+ */
+export function isBusinessSuccess(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    if (typeof value.success === 'boolean')
+        return value.success;
+    if (typeof value.status === 'boolean')
+        return value.status;
+    if (value.code !== undefined && value.code !== null)
+        return Number(value.code) === 200;
+    return false;
+}
+export function businessMessage(value) {
+    if (!value || typeof value !== 'object')
+        return '泛微接口返回业务失败';
+    const candidates = [value.msg, value.message, value.data?.message];
+    for (const item of candidates) {
+        if (typeof item === 'string' && item.trim())
+            return item;
+    }
+    return '泛微接口返回业务失败';
+}
+function businessCode(value) {
+    if (!value || typeof value !== 'object')
+        return undefined;
+    const code = value.code ?? value.status;
+    if (typeof code === 'string' || typeof code === 'number')
+        return code;
+    return undefined;
+}
+export function assertPath(requestPath) {
+    if (typeof requestPath !== 'string' || !requestPath.startsWith('/') || requestPath.startsWith('//')) {
+        throw fnaValidationError('path_invalid', '请求路径必须是相对绝对路径');
+    }
+    if (/^https?:/i.test(requestPath) || /[\r\n]/.test(requestPath) || requestPath.includes('/../')) {
+        throw fnaValidationError('path_invalid', '请求路径不允许跨域或路径逃逸');
+    }
+    if (!requestPath.startsWith('/api/fna/') && !requestPath.startsWith('/api/app/fna/')) {
+        throw fnaValidationError('path_not_allowed', 'FNA 费控中心只能调用 /api/fna/ 或 /api/app/fna/ 路径');
+    }
+}
+function omitEmptyQueryValues(query) {
+    if (!query)
+        return undefined;
+    return Object.fromEntries(Object.entries(query).filter(([, value]) => value !== ''));
+}
+function mapRuntimeNetworkError(error) {
+    if (error instanceof E10ApiError && error.type === 'network') {
+        throw fnaNetworkError(error.subtype, error.message, {
+            retryable: error.retryable,
+            details: error.details,
+        });
+    }
+    throw error;
+}
+export function createFnaHost(ctx, dependencies = {}) {
+    let e10Session = null;
+    let sessionContext = null;
+    const requireSession = dependencies.requireSession || requireE10Session;
+    async function ensureSession() {
+        if (!e10Session) {
+            e10Session = await requireSession(ctx);
+            sessionContext = {
+                baseUrl: e10Session.getBaseUrl(),
+                profile: inferProfile(ctx),
+                userId: e10Session.userId,
+                tenantKey: e10Session.tenantKey,
+                eteamsId: e10Session.eteamsId,
+            };
+        }
+        return e10Session;
+    }
+    async function getSession() {
+        await ensureSession();
+        return sessionContext;
+    }
+    async function runtime() {
+        return createE10RequestRuntime(ctx, await ensureSession(), {
+            interceptors: dependencies.interceptors,
+            fetch: dependencies.fetch,
+        });
+    }
+    async function request(request) {
+        const { method, path, query, body, operation, headers: extraHeaders = {}, timeoutMs = 30_000, } = request;
+        assertPath(path);
+        const resolvedMethod = method || (body === undefined ? 'GET' : 'POST');
+        let response;
+        try {
+            response = await (await runtime()).requestJson({
+                module: 'fna',
+                operation,
+                method: resolvedMethod,
+                path,
+                query: omitEmptyQueryValues(query),
+                body,
+                headers: { 'X-Requested-With': 'XMLHttpRequest', ...extraHeaders },
+                timeoutMs,
+            });
+        }
+        catch (error) {
+            mapRuntimeNetworkError(error);
+        }
+        if (response.status === 401 || response.status === 302) {
+            throw fnaAuthError('session_expired', 'E10 登录态已失效，请先向用户确认 E10 登录域名，再运行 weaver-work-cli auth login --base-url <域名> 完成登录', { httpStatus: response.status });
+        }
+        if (response.parseError) {
+            if (response.status < 200 || response.status >= 300) {
+                throw new FnaCliError('api', 'http_error', `泛微接口 HTTP ${response.status}`, {
+                    code: response.status,
+                    details: { status: response.status },
+                    exitCode: 1,
+                });
+            }
+            throw fnaNetworkError('protocol', `接口返回不是合法 JSON（HTTP ${response.status}）`, { retryable: false });
+        }
+        if (response.status < 200 || response.status >= 300) {
+            throw new FnaCliError('api', 'http_error', `泛微接口 HTTP ${response.status}`, {
+                code: response.status,
+                details: { status: response.status, message: businessMessage(response.value) },
+                exitCode: 1,
+            });
+        }
+        if (!isBusinessSuccess(response.value)) {
+            throw new FnaCliError('api', 'business_error', businessMessage(response.value), {
+                code: businessCode(response.value),
+                details: { code: businessCode(response.value), message: businessMessage(response.value) },
+                exitCode: 1,
+            });
+        }
+        return response.value;
+    }
+    return { request, getSession };
+}

package/dist/shortcuts/fna/index.js

@@ -0,0 +1,111 @@
+import { readFile } from 'node:fs/promises';
+import { ExitCode, isCliError, toErrorEnvelope } from '../../core/errors.js';
+import { createFnaContinuationSigner } from './continuation.js';
+import { createFnaHost } from './host.js';
+import { fnaManifest } from './manifest.js';
+import { executeFnaOperation } from './operations.js';
+import { fnaValidationError } from './errors.js';
+function asOptions(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+/** Windows PowerShell 管道/Set-Content 会写入 UTF-8 BOM，JSON.parse 前必须剥离。 */
+function stripBom(value) {
+    return value.replace(/^\uFEFF+/, '');
+}
+export async function inputFrom(options, extra = {}) {
+    const opts = asOptions(options);
+    let input = {};
+    if (opts.input && opts.inputJson) {
+        throw fnaValidationError('input_conflict', '不能同时传 --input 和 --input-json');
+    }
+    if (opts.inputJson) {
+        input = parseJsonInput(String(opts.inputJson), '--input-json');
+    }
+    if (opts.input) {
+        let raw;
+        try {
+            raw = stripBom(opts.input === '-' ? await readStdin() : await readFile(String(opts.input), 'utf8'));
+        }
+        catch {
+            throw fnaValidationError('input_unreadable', `无法读取 --input：${String(opts.input)}`);
+        }
+        input = parseJsonInput(raw, '--input');
+    }
+    return {
+        ...input,
+        ...Object.fromEntries(Object.entries(extra).filter(([, value]) => value !== undefined && value !== '')),
+    };
+}
+function parseJsonInput(raw, label) {
+    try {
+        const parsed = JSON.parse(stripBom(raw));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            throw new Error('input must be an object');
+        }
+        return parsed;
+    }
+    catch {
+        throw fnaValidationError('input_invalid', `${label} 不是合法 JSON 对象`);
+    }
+}
+export function successEnvelope(operation, result) {
+    return {
+        schemaVersion: 1,
+        ok: true,
+        operation,
+        data: result.data === undefined ? null : result.data,
+        ...(result.meta ? { meta: result.meta } : {}),
+        warnings: [],
+    };
+}
+function failureEnvelope(error) {
+    const structured = error;
+    return {
+        schemaVersion: 1,
+        ok: false,
+        ...(structured?.partialData === undefined ? {} : { data: structured.partialData }),
+        error: toErrorEnvelope(error),
+    };
+}
+async function executeAndPrint(ctx, operation, input) {
+    try {
+        const result = await executeFnaOperation(operation, input, {
+            ctx,
+            host: createFnaHost(ctx),
+            continuation: createFnaContinuationSigner(ctx),
+        });
+        ctx.output.write(successEnvelope(operation, result), { json: true });
+    }
+    catch (error) {
+        console.error(JSON.stringify(failureEnvelope(error), null, 2));
+        process.exitCode = isCliError(error) ? error.exitCode : ExitCode.GeneralError;
+    }
+}
+export const fnaShortcut = {
+    name: 'fna',
+    description: '泛微E10齐业成费控中心（预算/费用中心/借款管理/发票核销）CLI',
+    category: 'shortcut',
+    register({ program, action }) {
+        const fna = program.command('fna').description('泛微E10齐业成费控中心（预算查询/费用中心/借款管理/发票核销）');
+        fna.command('schema')
+            .description('Print fna operation manifest for agents')
+            .action(action((ctx) => {
+            ctx.output.write(fnaManifest, { json: true });
+        }));
+        fna.command('run')
+            .description('Run an fna operation with JSON input')
+            .argument('<operation>', 'operation name, e.g. fna.expense.reimbursed.sum')
+            .option('--input <path>', 'JSON input file, or - for stdin')
+            .option('--input-json <json>', 'inline JSON input object')
+            .action(action(async (ctx, operation, options) => {
+            await executeAndPrint(ctx, String(operation), await inputFrom(options));
+        }));
+    },
+};