weaver-work-cli 0.1.25 → 0.1.28

package/dist/internal/e10/client.js

@@ -1,9 +1,14 @@
+import { isE10AuthenticationRequired, sameE10SessionIdentity, } from './auth-recovery.js';
+class E10AuthenticationContextChangedError extends Error {
+}
 export class E10ApiClient {
     auth;
     retries;
-    constructor(auth, retries = 3) {
+    recoverAuthentication;
+    constructor(auth, retries = 3, recoverAuthentication) {
         this.auth = auth;
         this.retries = retries;
+        this.recoverAuthentication = recoverAuthentication;
     }
     getBaseUrl() {
         return this.auth.getBaseUrl();
@@ -56,31 +61,51 @@ export class E10ApiClient {
     }
     async requestRaw(url, init) {
         let lastError = null;
+        let authenticationRecoveryAttempted = false;
         for (let attempt = 1; attempt <= this.retries; attempt++) {
             try {
                 const resp = await fetch(url, { ...init, redirect: 'manual' });
+                const text = await resp.text();
+                let value = null;
+                if (text) {
+                    try {
+                        value = JSON.parse(text);
+                    }
+                    catch {
+                        value = text;
+                    }
+                }
+                if (!authenticationRecoveryAttempted && isE10AuthenticationRequired({
+                    status: resp.status,
+                    headers: resp.headers,
+                    text,
+                    value,
+                })) {
+                    authenticationRecoveryAttempted = true;
+                    const recovered = await this.recoverAuthentication?.(this.auth) || null;
+                    if (recovered) {
+                        if (!sameE10SessionIdentity(this.auth, recovered)) {
+                            throw new E10AuthenticationContextChangedError('XiaoE automatic authentication recovery changed the E10 login context');
+                        }
+                        this.auth.replaceWith(recovered);
+                        refreshAuthenticationHeaders(init, this.auth);
+                        attempt -= 1; // the one authentication retry does not consume the transport retry budget
+                        continue;
+                    }
+                }
+                // Preserve the legacy password-based refresh for non-XiaoE callers.
                 if (resp.status === 302) {
                     const ok = await this.auth.ensureValid();
                     if (!ok)
                         throw new Error('E10 session expired; please login again');
-                    const headers = (init.headers || {});
-                    headers.eteamsid = this.auth.eteamsId;
-                    headers.cookie = this.auth.cookieHeader();
-                    headers['user-agent'] = this.auth.uaHeader();
-                    init.headers = headers;
+                    refreshAuthenticationHeaders(init, this.auth);
                     continue;
                 }
-                const text = await resp.text();
-                if (!text)
-                    return null;
-                try {
-                    return JSON.parse(text);
-                }
-                catch {
-                    return text;
-                }
+                return value;
             }
             catch (error) {
+                if (error instanceof E10AuthenticationContextChangedError)
+                    throw error;
                 lastError = error instanceof Error ? error : new Error(String(error));
                 if (attempt < this.retries) {
                     const delay = Math.min(1000 * Math.pow(2, attempt - 1), 8000);
@@ -102,3 +127,10 @@ export class E10ApiClient {
         return { body, boundary };
     }
 }
+function refreshAuthenticationHeaders(init, session) {
+    const headers = (init.headers || {});
+    headers.eteamsid = session.eteamsId;
+    headers.cookie = session.cookieHeader();
+    headers['user-agent'] = session.uaHeader();
+    init.headers = headers;
+}

package/dist/internal/e10/context.js

@@ -1,48 +1,26 @@
 import { CliError, ExitCode } from '../../core/errors.js';
-import { E10AuthSession, getActiveProfile, readProfileConfig } from './auth/session.js';
-import { createXiaoEUnifiedLoginUnavailableError, hasXiaoEEnv, resolveXiaoEPreferredBaseUrl, shouldUseXiaoEBrowserFallback, tryXiaoEUnifiedLogin, } from './auth/xiaoe.js';
+import { E10_AUTH_REQUIRED_MESSAGE } from './auth/messages.js';
+import { E10AuthSession } from './auth/session.js';
 import { E10ApiClient } from './client.js';
-function shouldPreferXiaoEUnifiedLogin(options, env) {
-    return !options.auth && !options.profile && hasXiaoEEnv(env);
-}
+import { recoverXiaoEAuthSession } from './auth-recovery.js';
 export async function getE10Session(ctx, load = {}) {
     const options = ctx.getGlobalOptions();
-    if (shouldPreferXiaoEUnifiedLogin(options, ctx.env)) {
-        const profileBaseUrl = readProfileConfig(getActiveProfile()).baseUrl;
-        const xiaoELogin = await tryXiaoEUnifiedLogin({
-            env: ctx.env,
-            baseUrl: options.baseUrl,
-            profileBaseUrl,
-            allowBundledEnvScript: true,
-            allowTokenScript: true,
-            logger: ctx.logger,
-        });
-        if (xiaoELogin)
-            return xiaoELogin.session;
-        return null;
-    }
     return E10AuthSession.fromOptions(options, ctx.cwd, load);
 }
 export async function requireE10Session(ctx, load = {}) {
     const session = await getE10Session(ctx, load);
     if (!session) {
-        const options = ctx.getGlobalOptions();
-        if (hasXiaoEEnv(ctx.env) && !shouldUseXiaoEBrowserFallback()) {
-            const baseUrl = resolveXiaoEPreferredBaseUrl({
-                explicitBaseUrl: options.baseUrl,
-                profileBaseUrl: readProfileConfig(getActiveProfile()).baseUrl,
-                env: ctx.env,
-            });
-            throw createXiaoEUnifiedLoginUnavailableError(baseUrl);
-        }
-        throw new CliError('E10 auth not found. In XiaoE, run weaver-work-cli auth xiaoe first; if unified login is unavailable, ask the user for the E10 login domain (base URL), then run: weaver-work-cli auth login --base-url <url> --agent_type <agent_type>.', ExitCode.AuthError);
+        throw new CliError(E10_AUTH_REQUIRED_MESSAGE, ExitCode.AuthError);
     }
     return session;
 }
 export async function getE10Client(ctx) {
     const session = await getE10Session(ctx);
-    return session ? new E10ApiClient(session) : null;
+    return session
+        ? new E10ApiClient(session, 3, (current) => recoverXiaoEAuthSession(ctx, current))
+        : null;
 }
 export async function requireE10Client(ctx) {
-    return new E10ApiClient(await requireE10Session(ctx));
+    const session = await requireE10Session(ctx);
+    return new E10ApiClient(session, 3, (current) => recoverXiaoEAuthSession(ctx, current));
 }

package/dist/internal/e10/index.js

@@ -1,3 +1,4 @@
 export { E10ApiClient } from './client.js';
 export { getE10Client, getE10Session, requireE10Client, requireE10Session } from './context.js';
 export { E10ApiError, E10RequestRuntime, createE10RequestRuntime } from './request-runtime.js';
+export { canAutomaticallyRecoverXiaoE, isE10AuthenticationRequired, recoverXiaoEAuthSession, } from './auth-recovery.js';

package/dist/internal/e10/request-runtime.js

@@ -1,4 +1,5 @@
 import { CliError, ExitCode } from '../../core/errors.js';
+import { isE10AuthenticationRequired, recoverXiaoEAuthSession, sameE10SessionIdentity, } from './auth-recovery.js';
 const DEFAULT_TIMEOUT_MS = 30_000;
 const DEFAULT_BIG_INT_STRINGS = true;
 const RESERVED_HEADERS = [
@@ -29,11 +30,14 @@ export class E10RequestRuntime {
     interceptors;
     fetchFn;
     attachSessionTicket;
+    recoverAuthentication;
     constructor(ctx, session, dependencies = {}) {
         this.ctx = ctx;
         this.session = session;
         this.fetchFn = dependencies.fetch || globalThis.fetch;
         this.attachSessionTicket = dependencies.attachSessionTicket === true;
+        this.recoverAuthentication = dependencies.recoverAuthentication
+            || ((current) => recoverXiaoEAuthSession(this.ctx, current));
         this.interceptors = [
             ...(this.ctx.hooks?.getE10RequestInterceptors?.() || []),
             ...(dependencies.interceptors || []),
@@ -47,9 +51,8 @@ export class E10RequestRuntime {
     }
     async request(request) {
         const mutable = this.prepareRequest(request);
-        const sessionContext = this.sessionContext();
         try {
-            await this.runBeforeRequest(mutable, sessionContext);
+            await this.runBeforeRequest(mutable, this.sessionContext());
             this.assertPath(mutable.path);
             if (mutable.path !== request.path) {
                 throw new E10ApiError('policy', 'path_rewrite_denied', 'E10 API 拦截器不能修改请求路径', {
@@ -58,19 +61,58 @@ export class E10RequestRuntime {
                 });
             }
             stripReservedHeaders(mutable.headers);
-            const url = withQuery(this.session.getBaseUrl(), mutable.path, mutable.query);
-            const headers = this.composeHeaders(mutable, request.trustedHeaders);
-            const init = this.buildFetchInit(mutable, headers);
-            const response = await this.fetchWithTimeout(url, init, mutable.timeoutMs);
-            const parsed = await this.readResponse(response, mutable.responseType, mutable.bigIntStrings, mutable.maxResponseBytes, mutable.timeoutMs);
-            await this.runAfterResponse(mutable, sessionContext, parsed);
+            const requestEteamsId = this.session.eteamsId;
+            let parsed = await this.executeRequest(mutable, request.trustedHeaders);
+            if (!mutable.streamBody
+                && isE10AuthenticationRequired(parsed)
+                && await this.recoverExpiredSession(requestEteamsId)) {
+                // Authentication rejection is a definitive pre-business failure. Retry
+                // exactly once with the new session; never retry transport/partial errors.
+                parsed = await this.executeRequest(mutable, request.trustedHeaders);
+            }
+            await this.runAfterResponse(mutable, this.sessionContext(), parsed);
             return parsed;
         }
         catch (error) {
-            await this.runOnError(mutable, sessionContext, error);
+            await this.runOnError(mutable, this.sessionContext(), error);
             throw error;
         }
     }
+    async executeRequest(request, trustedHeaders = {}) {
+        const url = withQuery(this.session.getBaseUrl(), request.path, request.query);
+        const headers = this.composeHeaders(request, trustedHeaders);
+        const init = this.buildFetchInit(request, headers);
+        const response = await this.fetchWithTimeout(url, init, request.timeoutMs);
+        return this.readResponse(response, request.responseType, request.bigIntStrings, request.maxResponseBytes, request.timeoutMs);
+    }
+    async recoverExpiredSession(requestEteamsId) {
+        // Another concurrent request may already have refreshed the shared session
+        // object while this response was in flight.
+        if (this.session.eteamsId && this.session.eteamsId !== requestEteamsId)
+            return true;
+        let recovered;
+        try {
+            recovered = await this.recoverAuthentication(this.session);
+        }
+        catch {
+            return false;
+        }
+        if (!recovered)
+            return false;
+        if (!sameE10SessionIdentity(this.session, recovered)) {
+            throw new E10ApiError('authentication', 'session_context_changed', 'XiaoE 自动恢复后的登录身份或 E10 环境发生变化，本次请求未重试', { exitCode: ExitCode.AuthError, retryable: false });
+        }
+        const original = this.session;
+        if (typeof original.replaceWith === 'function') {
+            original.replaceWith(recovered);
+            this.session = original;
+        }
+        else {
+            // Structural test doubles and older embedders may not expose replaceWith.
+            this.session = recovered;
+        }
+        return true;
+    }
     prepareRequest(request) {
         return {
             module: request.module,

package/dist/shortcuts/archive/host.js

@@ -1,3 +1,4 @@
+import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js';
 import { requireE10Session } from '../../internal/e10/context.js';
 import { getActiveProfile } from '../../internal/e10/auth/session.js';
 import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
@@ -151,7 +152,7 @@ export function createArchiveHost(ctx, dependencies = {}) {
     async function request(request) {
         const response = await doRequest(request, false).catch((error) => mapRuntimeNetworkError(error));
         if (response.status === 401 || response.status === 302) {
-            throw archiveAuthError('session_expired', 'E10 登录态已失效，请先向用户确认 E10 登录域名，再运行 weaver-work-cli auth login --base-url <域名> 完成登录', { httpStatus: response.status });
+            throw archiveAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.parseError) {
             if (response.status < 200 || response.status >= 300) {
@@ -182,7 +183,7 @@ export function createArchiveHost(ctx, dependencies = {}) {
     async function requestBinary(request) {
         const response = await doRequest(request, true).catch((error) => mapRuntimeNetworkError(error));
         if (response.status === 401 || response.status === 302) {
-            throw archiveAuthError('session_expired', 'E10 登录态已失效，请先登录', { httpStatus: response.status });
+            throw archiveAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
         }
         if (response.status < 200 || response.status >= 300) {
             throw new ArchiveCliError('api', 'http_error', `档案下载 HTTP ${response.status}`, {

package/dist/shortcuts/archive/manifest.js

@@ -20,7 +20,7 @@ export const archiveManifest = {
     capabilities: ['fonds', 'prelib', 'search', 'borrowCar', 'borrowList', 'flow', 'download', 'upload'],
     auth: {
         required: 'e10-session',
-        note: '所有操作都要求已登录 E10（weaver-work-cli auth login --base-url <域名>），未登录时返回 auth_error。',
+        note: '所有操作都要求已登录 E10；未登录时返回 auth_error，调用方应根据当前宿主环境选择登录方式。',
     },
     rules: [
         '写操作（*.apply）必须先执行同名的 prepare 拿到 continuation，再带 confirm=true 执行 apply；CLI 用 --yes 表示确认。',

package/dist/shortcuts/archive-oa/constants.js

@@ -0,0 +1,66 @@
+/**
+ * archive-oa 固定业务参数。
+ *
+ * 泛微商务合同与契约锁协作采纳是两套独立的应用/列表，参数值不同，禁止交叉混用。
+ * 来源：`source/weaver-e10-archive-oa.zip` 内 10 篇接口文档（catalog.md 登记）。
+ */
+/** 加入借阅车 / 发起借阅的单次条数上限（接口侧限制）。 */
+export const MAX_BORROW_ITEMS = 6;
+/** 发起借阅流程创建页的流程 ID（前端 `flowpage/fullCreate/<flowId>`）。 */
+export const BORROW_FLOW_ID = '100003460000002090';
+/** 借阅车记录 `fb` 即界面「分部」列：0 = 泛微、1 = 契约锁。 */
+export const FLOW_FB_LABELS = {
+    '0': '泛微',
+    '1': '契约锁',
+};
+/** 档案系统：按合同号定位档案的自定义接口标识。 */
+export const ARCHIVE_LOCATE_INTERFACE_PK = 'getArcIdByContractNo';
+export const ARCHIVE_LOCATE_PATH = `/api/ebuilder/form/formdata/v2/getFormDataList/${ARCHIVE_LOCATE_INTERFACE_PK}`;
+/** 泛微商务合同（案例台账）。 */
+export const WEAVER_CONTRACT = {
+    source: 'weaver',
+    passId: '850741972510941185',
+    listId: '850741985437786120',
+    filterListId: '850741985437786120',
+    cusMenuId: '5408862605522555751',
+    urlPageTitle: '5rOb5b6u5qGI5L6L',
+};
+export const WEAVER_BORROW_CAR = {
+    source: 'weaver',
+    passId: '882393476189437952',
+    listId: '882393480417296390',
+    cusMenuId: '5408862605522555751',
+    urlPageTitle: '5rOb5b6u5qGI5L6L',
+};
+export const WEAVER_ESB_ADD = {
+    source: 'weaver',
+    esbActionIds: '882395911377174530',
+    objId: '850741972510941185',
+    listId: '850741985437786120',
+    successText: '【加入借阅车】执行成功！',
+};
+/** 契约锁协作采纳（用户常称「案例」）。 */
+export const QYS_CONTRACT = {
+    source: 'qys',
+    passId: '850742853046345728',
+    listId: '1190611964371984450',
+    cusMenuId: '5408862605522555752',
+    urlPageTitle: '5aWR57qm6ZSB5qGI5L6L',
+};
+export const QYS_BORROW_CAR = {
+    source: 'qys',
+    passId: '882393476189437952',
+    listId: '883819516961857839',
+    cusMenuId: '5408862605522555752',
+    urlPageTitle: '5aWR57qm6ZSB5qGI5L6L',
+};
+export const QYS_ESB_ADD = {
+    source: 'qys',
+    esbActionIds: '892706856573648911',
+    objId: '850742853046345728',
+    listId: '1190611964371984450',
+    successText: '【契约锁加入借阅车】执行成功！',
+};
+/** 契约锁默认过滤「处理进度 = 已归档」。 */
+export const QYS_DEFAULT_ARCHIVED_FIELD = 'cljd';
+export const QYS_DEFAULT_ARCHIVED_VALUE = '已归档';

package/dist/shortcuts/archive-oa/continuation.js

@@ -0,0 +1,70 @@
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { resolve } from 'node:path';
+import { archiveOaValidationError } from './errors.js';
+function stateRoot(ctx) {
+    const configured = ctx?.config?.path();
+    if (configured)
+        return resolve(configured, '..');
+    return process.env.WEAVER_WORK_CLI_HOME || process.env.WORK_CLI_HOME || resolve(homedir(), '.weaver-work-cli');
+}
+async function loadKey(ctx) {
+    const keysDir = resolve(stateRoot(ctx), 'keys');
+    const filename = resolve(keysDir, 'archive-oa-continuation.key');
+    await mkdir(keysDir, { recursive: true, mode: 0o700 });
+    if (existsSync(filename))
+        return readFile(filename);
+    const key = randomBytes(32);
+    try {
+        await writeFile(filename, key, { flag: 'wx', mode: 0o600 });
+        if (process.platform !== 'win32')
+            await chmod(filename, 0o600).catch(() => undefined);
+        return key;
+    }
+    catch {
+        return readFile(filename);
+    }
+}
+function encode(value) {
+    return Buffer.from(JSON.stringify(value)).toString('base64url');
+}
+function signature(payload, key) {
+    return createHmac('sha256', key).update(payload).digest('base64url');
+}
+export function createArchiveOaContinuationSigner(ctx) {
+    return {
+        async issue(payload, ttlMs = 10 * 60_000) {
+            const issuedAt = Date.now();
+            const body = encode({ ...payload, issuedAt, expiresAt: issuedAt + ttlMs });
+            const sig = signature(body, await loadKey(ctx));
+            return `${body}.${sig}`;
+        },
+        async verify(token, expectedOperation) {
+            if (typeof token !== 'string' || !token.includes('.')) {
+                throw archiveOaValidationError('continuation_invalid', 'continuation 无效');
+            }
+            const [body, provided] = token.split('.');
+            const expected = signature(body, await loadKey(ctx));
+            const valid = provided.length === expected.length
+                && timingSafeEqual(Buffer.from(provided), Buffer.from(expected));
+            if (!valid)
+                throw archiveOaValidationError('continuation_invalid', 'continuation 签名校验失败');
+            let value;
+            try {
+                value = JSON.parse(Buffer.from(body, 'base64url').toString('utf8'));
+            }
+            catch {
+                throw archiveOaValidationError('continuation_invalid', 'continuation 内容无法解析');
+            }
+            if (value.operation !== expectedOperation) {
+                throw archiveOaValidationError('continuation_mismatch', 'continuation 不属于当前操作');
+            }
+            if (!Number.isSafeInteger(value.expiresAt) || value.expiresAt < Date.now()) {
+                throw archiveOaValidationError('continuation_expired', 'continuation 已过期');
+            }
+            return value;
+        },
+    };
+}

package/dist/shortcuts/archive-oa/errors.js

@@ -0,0 +1,53 @@
+import { CliError, ExitCode } from '../../core/errors.js';
+export class ArchiveOaCliError extends CliError {
+    type;
+    subtype;
+    code;
+    retryable;
+    stage;
+    details;
+    partialData;
+    constructor(type, subtype, message, options = {}) {
+        super(message, options.exitCode ?? ExitCode.InternalError);
+        this.name = 'ArchiveOaCliError';
+        this.type = type;
+        this.subtype = subtype;
+        this.code = options.code;
+        this.retryable = options.retryable ?? false;
+        this.stage = options.stage;
+        this.details = options.details;
+        this.partialData = options.partialData;
+    }
+}
+export function archiveOaValidationError(subtype, message, details) {
+    return new ArchiveOaCliError('validation', subtype, message, {
+        details,
+        exitCode: ExitCode.UsageError,
+    });
+}
+export function archiveOaAuthError(subtype, message, details) {
+    return new ArchiveOaCliError('authentication', subtype, message, {
+        details,
+        exitCode: ExitCode.AuthError,
+    });
+}
+export function archiveOaNetworkError(subtype, message, options = {}) {
+    return new ArchiveOaCliError('network', subtype, message, {
+        ...options,
+        retryable: options.retryable ?? true,
+        exitCode: ExitCode.NetworkError,
+    });
+}
+export function archiveOaConfirmationError(action, details) {
+    return new ArchiveOaCliError('confirmation', 'required', '该操作需要明确确认', {
+        details: { action, ...details },
+        exitCode: ExitCode.ConfirmationRequired,
+    });
+}
+export function archiveOaPartialError(message, partialData, details) {
+    return new ArchiveOaCliError('partial', 'write_uncertain', message, {
+        details,
+        partialData,
+        exitCode: ExitCode.Partial,
+    });
+}

package/dist/shortcuts/archive-oa/host.js

@@ -0,0 +1,158 @@
+import { E10_SESSION_EXPIRED_MESSAGE } from '../../internal/e10/auth/messages.js';
+import { requireE10Session } from '../../internal/e10/context.js';
+import { getActiveProfile } from '../../internal/e10/auth/session.js';
+import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { ArchiveOaCliError, archiveOaAuthError, archiveOaNetworkError, archiveOaValidationError, } from './errors.js';
+/** 本模块允许调用的路径前缀：ebuilder 业务接口与 OpenESB 开放服务。 */
+const ALLOWED_PATH_PREFIXES = ['/api/', '/openserver/'];
+function inferProfile(ctx) {
+    const options = ctx.getGlobalOptions();
+    return options.profile || getActiveProfile();
+}
+/**
+ * 业务成功判定。
+ * - ebuilder 列表/ESB 接口：`{ code: 200, status: true }`
+ * - ebuilder 自定义接口（getFormDataList）：`{ datajson: { status: true } }`
+ * - OpenESB：`{ errcode: "0" }`
+ */
+export function isArchiveOaBusinessSuccess(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    if (value.errcode !== undefined && value.errcode !== null)
+        return String(value.errcode) === '0';
+    if (typeof value.status === 'boolean')
+        return value.status;
+    if (typeof value.success === 'boolean')
+        return value.success;
+    if (value.datajson && typeof value.datajson === 'object' && typeof value.datajson.status === 'boolean') {
+        return value.datajson.status;
+    }
+    if (value.code !== undefined && value.code !== null)
+        return Number(value.code) === 200;
+    return false;
+}
+export function archiveOaBusinessMessage(value) {
+    if (!value || typeof value !== 'object')
+        return 'OA 档案接口返回业务失败';
+    const candidates = [
+        value.errmsg,
+        value.msg,
+        value.message,
+        value.errMsg,
+        value.data?.msg,
+        value.data?.message,
+        value.datajson?.msg,
+        value.datajson?.message,
+    ];
+    for (const item of candidates) {
+        if (typeof item === 'string' && item.trim())
+            return item;
+    }
+    return 'OA 档案接口返回业务失败';
+}
+function archiveOaBusinessCode(value) {
+    if (!value || typeof value !== 'object')
+        return undefined;
+    const code = value.errcode ?? value.code ?? value.status;
+    if (typeof code === 'string' || typeof code === 'number')
+        return code;
+    return undefined;
+}
+export function assertArchiveOaPath(requestPath) {
+    if (typeof requestPath !== 'string' || !requestPath.startsWith('/') || requestPath.startsWith('//')) {
+        throw archiveOaValidationError('path_invalid', '请求路径必须是相对绝对路径');
+    }
+    if (/^https?:/i.test(requestPath) || /[\r\n]/.test(requestPath) || requestPath.includes('/../')) {
+        throw archiveOaValidationError('path_invalid', '请求路径不允许跨域或路径逃逸');
+    }
+    if (!ALLOWED_PATH_PREFIXES.some((prefix) => requestPath.startsWith(prefix))) {
+        throw archiveOaValidationError('path_not_allowed', `archive-oa 只能调用 ${ALLOWED_PATH_PREFIXES.join(' / ')} 路径`);
+    }
+}
+function omitEmptyQueryValues(query) {
+    if (!query)
+        return undefined;
+    return Object.fromEntries(Object.entries(query).filter(([, value]) => value !== undefined && value !== null && value !== ''));
+}
+function mapRuntimeNetworkError(error) {
+    if (error instanceof E10ApiError && error.type === 'network') {
+        throw archiveOaNetworkError(error.subtype, error.message, {
+            retryable: error.retryable,
+            details: error.details,
+        });
+    }
+    throw error;
+}
+export function createArchiveOaHost(ctx, dependencies = {}) {
+    let e10Session = null;
+    let sessionContext = null;
+    const requireSession = dependencies.requireSession || requireE10Session;
+    async function ensureSession() {
+        if (!e10Session) {
+            e10Session = await requireSession(ctx);
+            sessionContext = {
+                baseUrl: e10Session.getBaseUrl(),
+                profile: inferProfile(ctx),
+                userId: e10Session.userId,
+                tenantKey: e10Session.tenantKey,
+                eteamsId: e10Session.eteamsId,
+            };
+        }
+        return e10Session;
+    }
+    async function getSession() {
+        await ensureSession();
+        return sessionContext;
+    }
+    async function request(request) {
+        const { method, path, query, body, operation, headers: extraHeaders = {}, timeoutMs = 60_000, skipBusinessCheck = false, } = request;
+        assertArchiveOaPath(path);
+        const resolvedMethod = method || (body === undefined ? 'GET' : 'POST');
+        const runtime = createE10RequestRuntime(ctx, await ensureSession(), {
+            interceptors: dependencies.interceptors,
+            fetch: dependencies.fetch,
+        });
+        const response = await runtime.requestJson({
+            module: 'archive-oa',
+            operation,
+            method: resolvedMethod,
+            path,
+            query: omitEmptyQueryValues(query),
+            body,
+            headers: { 'X-Requested-With': 'XMLHttpRequest', ...extraHeaders },
+            timeoutMs,
+        }).catch((error) => mapRuntimeNetworkError(error));
+        if (response.status === 401 || response.status === 302) {
+            throw archiveOaAuthError('session_expired', E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
+        }
+        if (response.parseError) {
+            if (response.status < 200 || response.status >= 300) {
+                throw new ArchiveOaCliError('api', 'http_error', `OA 档案接口 HTTP ${response.status}`, {
+                    code: response.status,
+                    details: { status: response.status },
+                    exitCode: 1,
+                });
+            }
+            throw archiveOaNetworkError('protocol', `接口返回不是合法 JSON（HTTP ${response.status}）`, { retryable: false });
+        }
+        if (response.status < 200 || response.status >= 300) {
+            throw new ArchiveOaCliError('api', 'http_error', `OA 档案接口 HTTP ${response.status}`, {
+                code: response.status,
+                details: { status: response.status, message: archiveOaBusinessMessage(response.value) },
+                exitCode: 1,
+            });
+        }
+        if (!skipBusinessCheck && !isArchiveOaBusinessSuccess(response.value)) {
+            throw new ArchiveOaCliError('api', 'business_error', archiveOaBusinessMessage(response.value), {
+                code: archiveOaBusinessCode(response.value),
+                details: {
+                    code: archiveOaBusinessCode(response.value),
+                    message: archiveOaBusinessMessage(response.value),
+                },
+                exitCode: 1,
+            });
+        }
+        return response.value;
+    }
+    return { request, getSession };
+}