weaver-work-cli 0.1.24 → 0.1.26

package/dist/shortcuts/archive-oa/host.js

@@ -0,0 +1,157 @@
+import { requireE10Session } from '../../internal/e10/context.js';
+import { getActiveProfile } from '../../internal/e10/auth/session.js';
+import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { ArchiveOaCliError, archiveOaAuthError, archiveOaNetworkError, archiveOaValidationError, } from './errors.js';
+/** 本模块允许调用的路径前缀：ebuilder 业务接口与 OpenESB 开放服务。 */
+const ALLOWED_PATH_PREFIXES = ['/api/', '/openserver/'];
+function inferProfile(ctx) {
+    const options = ctx.getGlobalOptions();
+    return options.profile || getActiveProfile();
+}
+/**
+ * 业务成功判定。
+ * - ebuilder 列表/ESB 接口：`{ code: 200, status: true }`
+ * - ebuilder 自定义接口（getFormDataList）：`{ datajson: { status: true } }`
+ * - OpenESB：`{ errcode: "0" }`
+ */
+export function isArchiveOaBusinessSuccess(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    if (value.errcode !== undefined && value.errcode !== null)
+        return String(value.errcode) === '0';
+    if (typeof value.status === 'boolean')
+        return value.status;
+    if (typeof value.success === 'boolean')
+        return value.success;
+    if (value.datajson && typeof value.datajson === 'object' && typeof value.datajson.status === 'boolean') {
+        return value.datajson.status;
+    }
+    if (value.code !== undefined && value.code !== null)
+        return Number(value.code) === 200;
+    return false;
+}
+export function archiveOaBusinessMessage(value) {
+    if (!value || typeof value !== 'object')
+        return 'OA 档案接口返回业务失败';
+    const candidates = [
+        value.errmsg,
+        value.msg,
+        value.message,
+        value.errMsg,
+        value.data?.msg,
+        value.data?.message,
+        value.datajson?.msg,
+        value.datajson?.message,
+    ];
+    for (const item of candidates) {
+        if (typeof item === 'string' && item.trim())
+            return item;
+    }
+    return 'OA 档案接口返回业务失败';
+}
+function archiveOaBusinessCode(value) {
+    if (!value || typeof value !== 'object')
+        return undefined;
+    const code = value.errcode ?? value.code ?? value.status;
+    if (typeof code === 'string' || typeof code === 'number')
+        return code;
+    return undefined;
+}
+export function assertArchiveOaPath(requestPath) {
+    if (typeof requestPath !== 'string' || !requestPath.startsWith('/') || requestPath.startsWith('//')) {
+        throw archiveOaValidationError('path_invalid', '请求路径必须是相对绝对路径');
+    }
+    if (/^https?:/i.test(requestPath) || /[\r\n]/.test(requestPath) || requestPath.includes('/../')) {
+        throw archiveOaValidationError('path_invalid', '请求路径不允许跨域或路径逃逸');
+    }
+    if (!ALLOWED_PATH_PREFIXES.some((prefix) => requestPath.startsWith(prefix))) {
+        throw archiveOaValidationError('path_not_allowed', `archive-oa 只能调用 ${ALLOWED_PATH_PREFIXES.join(' / ')} 路径`);
+    }
+}
+function omitEmptyQueryValues(query) {
+    if (!query)
+        return undefined;
+    return Object.fromEntries(Object.entries(query).filter(([, value]) => value !== undefined && value !== null && value !== ''));
+}
+function mapRuntimeNetworkError(error) {
+    if (error instanceof E10ApiError && error.type === 'network') {
+        throw archiveOaNetworkError(error.subtype, error.message, {
+            retryable: error.retryable,
+            details: error.details,
+        });
+    }
+    throw error;
+}
+export function createArchiveOaHost(ctx, dependencies = {}) {
+    let e10Session = null;
+    let sessionContext = null;
+    const requireSession = dependencies.requireSession || requireE10Session;
+    async function ensureSession() {
+        if (!e10Session) {
+            e10Session = await requireSession(ctx);
+            sessionContext = {
+                baseUrl: e10Session.getBaseUrl(),
+                profile: inferProfile(ctx),
+                userId: e10Session.userId,
+                tenantKey: e10Session.tenantKey,
+                eteamsId: e10Session.eteamsId,
+            };
+        }
+        return e10Session;
+    }
+    async function getSession() {
+        await ensureSession();
+        return sessionContext;
+    }
+    async function request(request) {
+        const { method, path, query, body, operation, headers: extraHeaders = {}, timeoutMs = 60_000, skipBusinessCheck = false, } = request;
+        assertArchiveOaPath(path);
+        const resolvedMethod = method || (body === undefined ? 'GET' : 'POST');
+        const runtime = createE10RequestRuntime(ctx, await ensureSession(), {
+            interceptors: dependencies.interceptors,
+            fetch: dependencies.fetch,
+        });
+        const response = await runtime.requestJson({
+            module: 'archive-oa',
+            operation,
+            method: resolvedMethod,
+            path,
+            query: omitEmptyQueryValues(query),
+            body,
+            headers: { 'X-Requested-With': 'XMLHttpRequest', ...extraHeaders },
+            timeoutMs,
+        }).catch((error) => mapRuntimeNetworkError(error));
+        if (response.status === 401 || response.status === 302) {
+            throw archiveOaAuthError('session_expired', 'E10 登录态已失效，请先向用户确认 E10 登录域名，再运行 weaver-work-cli auth login --base-url <域名> 完成登录', { httpStatus: response.status });
+        }
+        if (response.parseError) {
+            if (response.status < 200 || response.status >= 300) {
+                throw new ArchiveOaCliError('api', 'http_error', `OA 档案接口 HTTP ${response.status}`, {
+                    code: response.status,
+                    details: { status: response.status },
+                    exitCode: 1,
+                });
+            }
+            throw archiveOaNetworkError('protocol', `接口返回不是合法 JSON（HTTP ${response.status}）`, { retryable: false });
+        }
+        if (response.status < 200 || response.status >= 300) {
+            throw new ArchiveOaCliError('api', 'http_error', `OA 档案接口 HTTP ${response.status}`, {
+                code: response.status,
+                details: { status: response.status, message: archiveOaBusinessMessage(response.value) },
+                exitCode: 1,
+            });
+        }
+        if (!skipBusinessCheck && !isArchiveOaBusinessSuccess(response.value)) {
+            throw new ArchiveOaCliError('api', 'business_error', archiveOaBusinessMessage(response.value), {
+                code: archiveOaBusinessCode(response.value),
+                details: {
+                    code: archiveOaBusinessCode(response.value),
+                    message: archiveOaBusinessMessage(response.value),
+                },
+                exitCode: 1,
+            });
+        }
+        return response.value;
+    }
+    return { request, getSession };
+}

package/dist/shortcuts/archive-oa/index.js

@@ -0,0 +1,225 @@
+import { readFile } from 'node:fs/promises';
+import { ExitCode, isCliError, toErrorEnvelope } from '../../core/errors.js';
+import { createArchiveOaContinuationSigner } from './continuation.js';
+import { createArchiveOaHost } from './host.js';
+import { archiveOaManifest } from './manifest.js';
+import { executeArchiveOaOperation } from './operations.js';
+import { archiveOaValidationError } from './errors.js';
+const SOURCES = ['weaver', 'qys'];
+function asOptions(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+export async function archiveOaInputFrom(options, extra = {}) {
+    const opts = asOptions(options);
+    let input = {};
+    if (opts.input && opts.inputJson) {
+        throw archiveOaValidationError('input_conflict', '不能同时传 --input 和 --input-json');
+    }
+    if (opts.inputJson) {
+        input = parseJsonInput(String(opts.inputJson), '--input-json');
+    }
+    if (opts.input) {
+        let raw;
+        try {
+            raw = opts.input === '-' ? await readStdin() : await readFile(String(opts.input), 'utf8');
+        }
+        catch {
+            throw archiveOaValidationError('input_unreadable', `无法读取 --input：${String(opts.input)}`);
+        }
+        input = parseJsonInput(raw, '--input');
+    }
+    return {
+        ...input,
+        ...Object.fromEntries(Object.entries(extra).filter(([, value]) => value !== undefined && value !== '')),
+    };
+}
+function parseJsonInput(raw, label) {
+    try {
+        const parsed = JSON.parse(raw.replace(/^\uFEFF/u, ''));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            throw new Error('input must be an object');
+        }
+        return parsed;
+    }
+    catch {
+        throw archiveOaValidationError('input_invalid', `${label} 不是合法 JSON 对象`);
+    }
+}
+function withJsonInputOptions(command) {
+    command
+        .option('--input <path>', 'JSON input file, or - for stdin')
+        .option('--input-json <json>', 'inline JSON input object');
+    return command;
+}
+function intOption(value) {
+    if (value === undefined || value === null || value === '')
+        return undefined;
+    const parsed = Number(value);
+    return Number.isInteger(parsed) ? parsed : undefined;
+}
+function stringOption(value) {
+    if (value === undefined || value === null || value === '')
+        return undefined;
+    return String(value);
+}
+function stringListOption(value) {
+    const text = stringOption(value);
+    if (text === undefined)
+        return undefined;
+    return text.split(',').map((item) => item.trim()).filter((item) => item.length > 0);
+}
+function resolveSource(value) {
+    const text = String(stringOption(value) ?? 'weaver').toLowerCase();
+    if (!SOURCES.includes(text)) {
+        throw archiveOaValidationError('source_invalid', 'source 必须是 weaver 或 qys');
+    }
+    return text;
+}
+function borrowCarOperation(action, source) {
+    return source === 'qys'
+        ? `archive-oa.qys.borrow-car.${action}`
+        : `archive-oa.borrow-car.${action}`;
+}
+function successEnvelope(result) {
+    return {
+        schemaVersion: 1,
+        ok: true,
+        operation: result.action,
+        data: result.data,
+        ...(result.meta ? { meta: result.meta } : {}),
+        warnings: [],
+    };
+}
+function failureEnvelope(error) {
+    const structured = error;
+    return {
+        schemaVersion: 1,
+        ok: false,
+        ...(structured?.partialData === undefined ? {} : { data: structured.partialData }),
+        error: toErrorEnvelope(error),
+    };
+}
+async function executeAndPrint(ctx, operation, input) {
+    try {
+        const result = await executeArchiveOaOperation(operation, input, {
+            ctx,
+            host: createArchiveOaHost(ctx),
+            continuation: createArchiveOaContinuationSigner(ctx),
+        });
+        ctx.output.write(successEnvelope(result), { json: true });
+    }
+    catch (error) {
+        console.error(JSON.stringify(failureEnvelope(error), null, 2));
+        process.exitCode = isCliError(error) ? error.exitCode : ExitCode.GeneralError;
+    }
+}
+export const archiveOaShortcut = {
+    name: 'archive-oa',
+    description: 'E10 档案定位与 OA 商务合同借阅 CLI',
+    category: 'shortcut',
+    register({ program, action }) {
+        const command = program.command('archive-oa').description('E10 档案定位与 OA 商务合同借阅');
+        command.command('schema')
+            .description('Print archive-oa operation manifest for agents')
+            .action(action((ctx) => {
+            ctx.output.write(archiveOaManifest, { json: true });
+        }));
+        withJsonInputOptions(command.command('run')
+            .description('Run an archive-oa operation with JSON input')
+            .argument('<operation>', 'operation name, e.g. archive-oa.contract.list'))
+            .action(action(async (ctx, operation, options) => {
+            await executeAndPrint(ctx, String(operation), await archiveOaInputFrom(options));
+        }));
+        withJsonInputOptions(command.command('locate')
+            .description('Locate archive records by contract number')
+            .option('--contract-no <no>', 'contract number (htbh)')
+            .option('--page-no <page>', 'page number, starts from 1'))
+            .action(action(async (ctx, options) => {
+            const opts = asOptions(options);
+            await executeAndPrint(ctx, 'archive-oa.archive.locate', await archiveOaInputFrom(options, {
+                contractNo: stringOption(opts.contractNo),
+                pageNo: intOption(opts.pageNo),
+            }));
+        }));
+        const contract = command.command('contract').description('Business contract query commands');
+        withJsonInputOptions(contract.command('list')
+            .description('Query Weaver business contracts')
+            .option('--page-no <page>', 'page number, starts from 1'))
+            .action(action(async (ctx, options) => {
+            const opts = asOptions(options);
+            await executeAndPrint(ctx, 'archive-oa.contract.list', await archiveOaInputFrom(options, {
+                pageNo: intOption(opts.pageNo),
+            }));
+        }));
+        contract.command('fields')
+            .description('List searchable fields of Weaver business contracts')
+            .action(action(async (ctx) => {
+            await executeAndPrint(ctx, 'archive-oa.contract.fields', {});
+        }));
+        const qys = command.command('qys').description('Qiyuesuo (case) contract commands');
+        withJsonInputOptions(qys.command('list')
+            .description('Query Qiyuesuo collaboration contracts (default archived only)')
+            .option('--page-no <page>', 'page number, starts from 1'))
+            .action(action(async (ctx, options) => {
+            const opts = asOptions(options);
+            await executeAndPrint(ctx, 'archive-oa.qys.contract.list', await archiveOaInputFrom(options, {
+                pageNo: intOption(opts.pageNo),
+            }));
+        }));
+        const borrowCar = command.command('borrow-car').description('Borrow car commands');
+        withJsonInputOptions(borrowCar.command('list')
+            .description('List contract borrow car entries')
+            .option('--source <source>', 'weaver or qys, default weaver')
+            .option('--page-no <page>', 'page number, starts from 1'))
+            .action(action(async (ctx, options) => {
+            const opts = asOptions(options);
+            const source = resolveSource(opts.source);
+            await executeAndPrint(ctx, borrowCarOperation('list', source), await archiveOaInputFrom(options, {
+                pageNo: intOption(opts.pageNo),
+            }));
+        }));
+        withJsonInputOptions(borrowCar.command('add-prepare')
+            .description('Prepare adding contracts to borrow car (max 6)')
+            .option('--source <source>', 'weaver or qys, default weaver')
+            .option('--data-ids <ids>', 'comma separated contract row ids'))
+            .action(action(async (ctx, options) => {
+            const opts = asOptions(options);
+            const source = resolveSource(opts.source);
+            await executeAndPrint(ctx, borrowCarOperation('add.prepare', source), await archiveOaInputFrom(options, {
+                dataIds: stringListOption(opts.dataIds),
+            }));
+        }));
+        withJsonInputOptions(borrowCar.command('add-apply')
+            .description('Apply adding contracts to borrow car')
+            .option('--continuation <token>', 'continuation token from prepare')
+            .option('--source <source>', 'weaver or qys, default weaver')
+            .option('--yes', 'confirm the write operation'))
+            .action(action(async (ctx, options) => {
+            const opts = asOptions(options);
+            const source = resolveSource(opts.source);
+            await executeAndPrint(ctx, borrowCarOperation('add.apply', source), await archiveOaInputFrom(options, {
+                continuation: stringOption(opts.continuation),
+                confirm: opts.yes === true ? true : undefined,
+            }));
+        }));
+        const borrow = command.command('borrow').description('Borrow workflow commands');
+        withJsonInputOptions(borrow.command('start-url')
+            .description('Build the borrow workflow page URL from borrow car entries')
+            .option('--source <source>', 'weaver or qys, default weaver')
+            .option('--contract-nos <nos>', 'comma separated contract numbers from borrow car, max 6'))
+            .action(action(async (ctx, options) => {
+            const opts = asOptions(options);
+            const source = resolveSource(opts.source);
+            await executeAndPrint(ctx, source === 'qys' ? 'archive-oa.qys.borrow.start.url' : 'archive-oa.borrow.start.url', await archiveOaInputFrom(options, {
+                contractNos: stringListOption(opts.contractNos),
+            }));
+        }));
+    },
+};

package/dist/shortcuts/archive-oa/manifest.js

@@ -0,0 +1,62 @@
+import { archiveOaOperationDefinitions } from './operations/registry.js';
+/** 对外契约：只暴露操作名 / 资源 / 摘要 / 风险 / 是否需确认 / 入参 schema。 */
+export const archiveOaOperations = archiveOaOperationDefinitions().map((definition) => ({
+    name: definition.name,
+    resource: definition.resource,
+    summary: definition.summary,
+    ...(definition.capability ? { capability: definition.capability } : {}),
+    risk: definition.risk,
+    ...(definition.requiresConfirmation ? { requiresConfirmation: true } : {}),
+    inputSchema: definition.inputSchema,
+}));
+export const archiveOaManifest = {
+    schemaVersion: 1,
+    name: 'archive-oa',
+    title: '泛微E10档案定位与OA商务合同借阅',
+    version: '0.1.0',
+    host: 'e10-archive-oa',
+    status: 'builtin',
+    sourceSkill: 'weaver-e10-archive-oa',
+    capabilities: ['archiveLocate', 'contractSearch', 'borrowCar'],
+    auth: {
+        required: 'e10-session',
+        note: '所有操作都要求已登录 E10（weaver-work-cli auth login --base-url <域名>）。发起借阅不在 CLI 能力范围内，由用户在浏览器登录后于界面自己完成。',
+    },
+    rules: [
+        '写操作（*.apply）必须先执行同名的 prepare 拿到 continuation，再带 confirm=true 执行 apply；CLI 用 --yes 表示确认。',
+        '泛微商务合同与契约锁协作采纳（案例）是两套独立应用：passid / listId / esbActionIds / objId / cusMenuId 各不相同，禁止交叉混用。',
+        '加入借阅车每次最多 6 条。',
+        '发起借阅通过 archive-oa.borrow.start.url（契约锁为 archive-oa.qys.borrow.start.url）生成流程创建页 URL（/sp/workflow/flowpage/fullCreate/<flowId>?fb=<fb>&data=<JSON>）：两个 operation 均只读、不写数据、不触发流程、不需要任何后台应用凭据；fb 必须取借阅车记录自身的值（泛微 0、契约锁 1），禁止手工指定；URL 可在浏览器直接打开，由用户完成填写与提交。',
+        '合同行的内部 ID（data[*].id）只用于加入借阅车，不展示给最终用户。',
+    ],
+    operations: archiveOaOperations,
+    withheldOperations: [
+        {
+            name: 'archive-oa.archive.usage-log',
+            reason: '档案操作/利用记录（借阅、下载、浏览）接口源资料尚未收录，业务方提供接口契约后再登记。',
+        },
+        {
+            name: 'archive-oa.qys.contract.fields',
+            reason: '契约锁协作采纳的搜索字段配置接口源资料未收录；构造搜索条件时可参考泛微 showFilters 的字段规则。',
+        },
+        {
+            name: 'archive-oa.borrow.start.prepare',
+            reason: '发起借阅改由用户在浏览器登录后于借阅车界面自己完成，CLI 不提供 OpenESB 触发能力。',
+        },
+        {
+            name: 'archive-oa.borrow.start.apply',
+            reason: '同 prepare：发起借阅不在 CLI operation 范围内，不向用户索要后台应用凭据。',
+        },
+        {
+            name: 'archive-oa.qys.borrow.start.prepare',
+            reason: '契约锁发起借阅同样由用户在浏览器界面自己完成，CLI 不代为触发。',
+        },
+        {
+            name: 'archive-oa.qys.borrow.start.apply',
+            reason: '同 prepare：契约锁发起借阅不在 CLI operation 范围内。',
+        },
+    ],
+};
+export function hasArchiveOaOperationInManifest(operation) {
+    return archiveOaOperations.some((item) => item.name === operation);
+}

package/dist/shortcuts/archive-oa/operations/borrow-car.js

@@ -0,0 +1,159 @@
+import { MAX_BORROW_ITEMS } from '../constants.js';
+import { HIGH_RISK_WRITE, READ, READ_BEFORE_WRITE, archiveOaSuccess, schemaOf, SCHEMA_ID_LIST, SCHEMA_PAGE_NO, } from './types.js';
+import { normalizeListResult, positiveInt, requireIdList, unwrapData, } from './shared.js';
+import { archiveOaPartialError } from '../errors.js';
+import { assertLeaseTarget, issueLease, verifyLease } from './confirm.js';
+const CONTRACT_LIST_PATH = '/api/ebuilder/form/list/getListDatas';
+const RUN_ESB_PATH = '/api/ebuilder/form/esb/runEsb';
+function prefix(source) {
+    return source === 'qys' ? 'archive-oa.qys.borrow-car' : 'archive-oa.borrow-car';
+}
+/** 借阅车列表查询。 */
+function makeListOperation(profile) {
+    const name = `${prefix(profile.source)}.list`;
+    return {
+        name,
+        resource: 'borrow-car',
+        method: 'list',
+        action: name,
+        summary: `查询${profile.source === 'qys' ? '契约锁' : '泛微'}合同借阅车列表`,
+        capability: 'borrow-car',
+        risk: READ,
+        inputSchema: schemaOf({ pageNo: { ...SCHEMA_PAGE_NO, description: '页码，从 1 开始，缺省 1' } }, { description: '查询借阅车列表' }),
+        handler: async (args, env) => {
+            const pageNo = positiveInt(args.pageNo, 'pageNo', 1);
+            const response = await env.host.request({
+                method: 'POST',
+                path: CONTRACT_LIST_PATH,
+                operation: name,
+                query: { passid: profile.passId, cid: profile.passId, sf_request_type: 'ajax' },
+                body: {
+                    current: pageNo,
+                    requiredMatch: 1,
+                    mapResult: '1',
+                    recheckQuery: '1',
+                    cusMenuId: profile.cusMenuId,
+                    urlPageTitle: profile.urlPageTitle,
+                    searchParamData: { searchType: '2', type: 'and', commonSearchFields: {}, groupFields: {} },
+                    listId: profile.listId,
+                    isFollow: 0,
+                    isShareToMe: 0,
+                    filterCondition: {},
+                    browser: 'Chrome',
+                },
+            });
+            const { rows, meta } = normalizeListResult(name, response, profile.source);
+            return archiveOaSuccess(name, { rows }, { ...meta, pageNo });
+        },
+    };
+}
+/** 加入借阅车（ESB 动作）prepare + apply。 */
+function makeAddOperations(carProfile, esb) {
+    const prepareName = `${prefix(carProfile.source)}.add.prepare`;
+    const applyName = `${prefix(carProfile.source)}.add.apply`;
+    const prepare = {
+        name: prepareName,
+        resource: 'borrow-car',
+        method: 'add',
+        action: prepareName,
+        summary: `把${esb.source === 'qys' ? '契约锁' : '泛微'}合同加入借阅车：校验条数并回查借阅车现状（不写数据）`,
+        capability: 'borrow-car',
+        risk: READ_BEFORE_WRITE,
+        inputSchema: schemaOf({
+            dataIds: {
+                ...SCHEMA_ID_LIST,
+                maxItems: MAX_BORROW_ITEMS,
+                description: `合同数据行 id 数组，来自合同查询结果的 data[*].id，最多 ${MAX_BORROW_ITEMS} 条`,
+            },
+        }, { required: ['dataIds'], description: '加入借阅车预检' }),
+        handler: async (args, env) => {
+            const dataIds = requireIdList(args.dataIds, 'dataIds', MAX_BORROW_ITEMS);
+            const current = await env.host.request({
+                method: 'POST',
+                path: CONTRACT_LIST_PATH,
+                operation: prepareName,
+                query: { passid: carProfile.passId, cid: carProfile.passId, sf_request_type: 'ajax' },
+                body: {
+                    current: 1,
+                    requiredMatch: 1,
+                    mapResult: '1',
+                    recheckQuery: '1',
+                    cusMenuId: carProfile.cusMenuId,
+                    urlPageTitle: carProfile.urlPageTitle,
+                    searchParamData: { searchType: '2', type: 'and', commonSearchFields: {}, groupFields: {} },
+                    listId: carProfile.listId,
+                    isFollow: 0,
+                    isShareToMe: 0,
+                    filterCondition: {},
+                    browser: 'Chrome',
+                },
+            });
+            const { rows } = normalizeListResult(prepareName, current, carProfile.source);
+            const { continuation, expiresInMs } = await issueLease(env, applyName, {
+                dataIds,
+                esbActionIds: esb.esbActionIds,
+                objId: esb.objId,
+                listId: esb.listId,
+            });
+            return archiveOaSuccess(prepareName, {
+                preview: {
+                    source: carProfile.source,
+                    count: dataIds.length,
+                    dataIds,
+                    borrowCarBefore: rows.length,
+                },
+                hint: `确认后调用 ${applyName}（CLI：archive-oa borrow-car add-apply --continuation <token> --yes）`,
+                continuation,
+            }, { requiresConfirmation: true, expiresInMs });
+        },
+    };
+    const apply = {
+        name: applyName,
+        resource: 'borrow-car',
+        method: 'add',
+        action: applyName,
+        summary: `把${esb.source === 'qys' ? '契约锁' : '泛微'}合同加入借阅车（写操作）：执行 ESB 动作`,
+        capability: 'borrow-car',
+        risk: HIGH_RISK_WRITE,
+        requiresConfirmation: true,
+        inputSchema: schemaOf({
+            continuation: { type: 'string', description: 'prepare 返回的确认票据' },
+            confirm: { type: 'boolean', description: '必须为 true（CLI --yes）' },
+        }, { required: ['continuation', 'confirm'], description: '加入借阅车' }),
+        handler: async (args, env) => {
+            const lease = await verifyLease(args, applyName, env);
+            assertLeaseTarget(lease, args, ['dataIds'], applyName);
+            const dataIds = Array.isArray(lease.dataIds) ? lease.dataIds.map(String) : [];
+            if (dataIds.length === 0 || dataIds.length > MAX_BORROW_ITEMS) {
+                throw new Error('continuation 缺少合法的 dataIds');
+            }
+            const response = await env.host.request({
+                method: 'POST',
+                path: RUN_ESB_PATH,
+                operation: applyName,
+                query: { sf_request_type: 'ajax' },
+                body: {
+                    dataIds: dataIds.join(','),
+                    esbActionIds: String(lease.esbActionIds ?? esb.esbActionIds),
+                    objId: String(lease.objId ?? esb.objId),
+                    listId: String(lease.listId ?? esb.listId),
+                },
+            });
+            const data = (unwrapData(response) ?? {});
+            const failNum = Number(data.failNum ?? 0);
+            if (failNum > 0) {
+                throw archiveOaPartialError(`加入借阅车部分失败：成功 ${data.successNum ?? 0} 条，失败 ${failNum} 条`, { successNum: data.successNum ?? 0, failNum, failIds: data.failIds ?? [] }, { dataIds, needRefresh: data.needRefresh === true });
+            }
+            return archiveOaSuccess(applyName, {
+                message: String(data.successMsg ?? esb.successText),
+                successNum: data.successNum ?? dataIds.length,
+                failNum,
+                needRefresh: data.needRefresh === true,
+            }, { wrote: true, source: carProfile.source, count: dataIds.length });
+        },
+    };
+    return [prepare, apply];
+}
+export function createBorrowCarOperations(carProfile, esb) {
+    return [makeListOperation(carProfile), ...makeAddOperations(carProfile, esb)];
+}