weaver-work-cli 0.1.42 → 0.1.44

package/dist/chunks/{chunk-EKWAQSLU.js → chunk-BCVYBYYT.js}

@@ -1,59 +1,18 @@
 import { createRequire as __esbuildCreateRequire } from 'node:module';
 const require = __esbuildCreateRequire(import.meta.url);
 import {
-  DEFAULT_RESULT_THRESHOLD_BYTES,
-  Output,
-  RefError,
-  bytesOf,
-  listRefs,
-  pickValue,
-  pruneRefs,
-  readRef,
-  refMaxBytes,
-  refMaxCount,
-  resolveRefInput,
-  resultThresholdBytes
-} from "./chunk-ZUX3P6BQ.js";
+  createE10RequestRuntime,
+  isE10SessionExpiredResponse,
+  requireE10Session
+} from "./chunk-ETNJSKMM.js";
 import {
-  refsDir
-} from "./chunk-AJ62BGAW.js";
+  E10_REAUTH_GUIDANCE,
+  E10_SESSION_EXPIRED_MESSAGE,
+  getActiveProfile
+} from "./chunk-UFIT2UU3.js";
 import {
-  clearInvoiceTokenForSession
-} from "./chunk-TTPJJJC4.js";
-import {
-  E10AuthSession,
-  XIAOE_AGENT_TYPE,
-  buildE10CookieHeader,
-  clearProfileAuthFile,
-  createXiaoEUnifiedLoginUnavailableError,
-  extractRawSetCookie,
-  extractSessionTicket,
-  findAuthFile,
-  getActiveProfile,
-  getE10AuthRoot,
-  getProfileAuthPath,
-  getProfileDir,
-  hasXiaoEEnv,
-  inspectXiaoEUnifiedLoginSources,
-  listProfiles,
-  normalizeGlobalOptions,
-  packageFileUrl,
-  packagePath,
-  profileNameFromUrl,
-  readProfileConfig,
-  readTeamsCheckUserInfo,
-  resolveXiaoEPreferredBaseUrl,
-  saveAuthFile,
-  saveProfileConfig,
-  setActiveProfile,
-  switchActiveProfile,
-  tryXiaoEUnifiedLogin
-} from "./chunk-FOAA27U5.js";
-import {
-  CliError,
-  isCliError,
-  toErrorEnvelope
-} from "./chunk-LUSPKZKY.js";
+  CliError
+} from "./chunk-UG5G54VL.js";
 import {
   __commonJS,
   __require,
@@ -1096,7 +1055,7 @@ var require_option = __commonJS({
 var require_suggestSimilar = __commonJS({
   "node_modules/commander/lib/suggestSimilar.js"(exports) {
     var maxDistance = 3;
-    function editDistance2(a, b) {
+    function editDistance(a, b) {
       if (Math.abs(a.length - b.length) > maxDistance)
         return Math.max(a.length, b.length);
       const d = [];
@@ -1142,7 +1101,7 @@ var require_suggestSimilar = __commonJS({
       const minSimilarity = 0.4;
       candidates.forEach((candidate) => {
         if (candidate.length <= 1) return;
-        const distance = editDistance2(word, candidate);
+        const distance = editDistance(word, candidate);
         const length = Math.max(word.length, candidate.length);
         const similarity = (length - distance) / length;
         if (similarity > minSimilarity) {
@@ -1179,7 +1138,7 @@ var require_command = __commonJS({
     var childProcess = __require("node:child_process");
     var path = __require("node:path");
     var fs = __require("node:fs");
-    var process2 = __require("node:process");
+    var process = __require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
     var { Help: Help2, stripColor } = require_help();
@@ -1226,13 +1185,13 @@ var require_command = __commonJS({
         this._showSuggestionAfterError = true;
         this._savedState = null;
         this._outputConfiguration = {
-          writeOut: (str) => process2.stdout.write(str),
-          writeErr: (str) => process2.stderr.write(str),
+          writeOut: (str) => process.stdout.write(str),
+          writeErr: (str) => process.stderr.write(str),
           outputError: (str, write) => write(str),
-          getOutHelpWidth: () => process2.stdout.isTTY ? process2.stdout.columns : void 0,
-          getErrHelpWidth: () => process2.stderr.isTTY ? process2.stderr.columns : void 0,
-          getOutHasColors: () => useColor() ?? (process2.stdout.isTTY && process2.stdout.hasColors?.()),
-          getErrHasColors: () => useColor() ?? (process2.stderr.isTTY && process2.stderr.hasColors?.()),
+          getOutHelpWidth: () => process.stdout.isTTY ? process.stdout.columns : void 0,
+          getErrHelpWidth: () => process.stderr.isTTY ? process.stderr.columns : void 0,
+          getOutHasColors: () => useColor() ?? (process.stdout.isTTY && process.stdout.hasColors?.()),
+          getErrHasColors: () => useColor() ?? (process.stderr.isTTY && process.stderr.hasColors?.()),
           stripColor: (str) => stripColor(str)
         };
         this._hidden = false;
@@ -1615,7 +1574,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._exitCallback) {
           this._exitCallback(new CommanderError2(exitCode, code, message));
         }
-        process2.exit(exitCode);
+        process.exit(exitCode);
       }
       /**
        * Register callback `fn` for the command.
@@ -2013,16 +1972,16 @@ Expecting one of '${allowedValues.join("', '")}'`);
         }
         parseOptions = parseOptions || {};
         if (argv === void 0 && parseOptions.from === void 0) {
-          if (process2.versions?.electron) {
+          if (process.versions?.electron) {
             parseOptions.from = "electron";
           }
-          const execArgv = process2.execArgv ?? [];
+          const execArgv = process.execArgv ?? [];
           if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
             parseOptions.from = "eval";
           }
         }
         if (argv === void 0) {
-          argv = process2.argv;
+          argv = process.argv;
         }
         this.rawArgs = argv.slice();
         let userArgs;
@@ -2033,7 +1992,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
             userArgs = argv.slice(2);
             break;
           case "electron":
-            if (process2.defaultApp) {
+            if (process.defaultApp) {
               this._scriptPath = argv[1];
               userArgs = argv.slice(2);
             } else {
@@ -2220,11 +2179,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         }
         launchWithNode = sourceExt.includes(path.extname(executableFile));
         let proc;
-        if (process2.platform !== "win32") {
+        if (process.platform !== "win32") {
           if (launchWithNode) {
             args.unshift(executableFile);
-            args = incrementNodeInspectorPort(process2.execArgv).concat(args);
-            proc = childProcess.spawn(process2.argv[0], args, { stdio: "inherit" });
+            args = incrementNodeInspectorPort(process.execArgv).concat(args);
+            proc = childProcess.spawn(process.argv[0], args, { stdio: "inherit" });
           } else {
             proc = childProcess.spawn(executableFile, args, { stdio: "inherit" });
           }
@@ -2235,13 +2194,13 @@ Expecting one of '${allowedValues.join("', '")}'`);
             subcommand._name
           );
           args.unshift(executableFile);
-          args = incrementNodeInspectorPort(process2.execArgv).concat(args);
-          proc = childProcess.spawn(process2.execPath, args, { stdio: "inherit" });
+          args = incrementNodeInspectorPort(process.execArgv).concat(args);
+          proc = childProcess.spawn(process.execPath, args, { stdio: "inherit" });
         }
         if (!proc.killed) {
           const signals = ["SIGUSR1", "SIGUSR2", "SIGTERM", "SIGINT", "SIGHUP"];
           signals.forEach((signal) => {
-            process2.on(signal, () => {
+            process.on(signal, () => {
               if (proc.killed === false && proc.exitCode === null) {
                 proc.kill(signal);
               }
@@ -2252,7 +2211,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         proc.on("close", (code) => {
           code = code ?? 1;
           if (!exitCallback) {
-            process2.exit(code);
+            process.exit(code);
           } else {
             exitCallback(
               new CommanderError2(
@@ -2274,7 +2233,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
             throw new Error(`'${executableFile}' not executable`);
           }
           if (!exitCallback) {
-            process2.exit(1);
+            process.exit(1);
           } else {
             const wrappedError = new CommanderError2(
               1,
@@ -2769,13 +2728,13 @@ Expecting one of '${allowedValues.join("', '")}'`);
        */
       _parseOptionsEnv() {
         this.options.forEach((option) => {
-          if (option.envVar && option.envVar in process2.env) {
+          if (option.envVar && option.envVar in process.env) {
             const optionKey = option.attributeName();
             if (this.getOptionValue(optionKey) === void 0 || ["default", "config", "env"].includes(
               this.getOptionValueSource(optionKey)
             )) {
               if (option.required || option.optional) {
-                this.emit(`optionEnv:${option.name()}`, process2.env[option.envVar]);
+                this.emit(`optionEnv:${option.name()}`, process.env[option.envVar]);
               } else {
                 this.emit(`optionEnv:${option.name()}`);
               }
@@ -3230,7 +3189,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        */
       help(contextOptions) {
         this.outputHelp(contextOptions);
-        let exitCode = Number(process2.exitCode ?? 0);
+        let exitCode = Number(process.exitCode ?? 0);
         if (exitCode === 0 && contextOptions && typeof contextOptions !== "function" && contextOptions.error) {
           exitCode = 1;
         }
@@ -3320,9 +3279,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
       });
     }
     function useColor() {
-      if (process2.env.NO_COLOR || process2.env.FORCE_COLOR === "0" || process2.env.FORCE_COLOR === "false")
+      if (process.env.NO_COLOR || process.env.FORCE_COLOR === "0" || process.env.FORCE_COLOR === "false")
         return false;
-      if (process2.env.FORCE_COLOR || process2.env.CLICOLOR_FORCE !== void 0)
+      if (process.env.FORCE_COLOR || process.env.CLICOLOR_FORCE !== void 0)
         return true;
       return void 0;
     }
@@ -3353,2048 +3312,446 @@ var require_commander = __commonJS({
   }
 });
 
-// src/cmd/argv.ts
-var VALUE_TAKING_GLOBAL_OPTIONS = /* @__PURE__ */ new Set([
-  "--config",
-  "--auth",
-  "--profile",
-  "--runtime-agent",
-  "--base-url",
-  "--passport-url"
-]);
-function firstPositionalToken(argv) {
-  for (let index = 0; index < argv.length; index += 1) {
-    const token = argv[index];
-    if (token === void 0) return void 0;
-    if (token === "--") return argv[index + 1];
-    if (token.startsWith("-")) {
-      if (VALUE_TAKING_GLOBAL_OPTIONS.has(token)) index += 1;
-      continue;
-    }
-    return token;
-  }
-  return void 0;
-}
-function toCommandMetadata(commands) {
-  return commands.map((command) => ({
-    name: command.name,
-    description: command.description,
-    category: command.category
-  }));
-}
-
-// src/cmd/commands/index.ts
-var commandsCommand = {
-  name: "commands",
-  description: "Registered command discovery",
-  category: "system",
-  register({ program: program2, action }) {
-    const commands = program2.command("commands").alias("module").description("Inspect registered commands");
-    commands.command("list").description("List registered commands").action(action((ctx) => {
-      ctx.output.write({ commands: ctx.commands, modules: ctx.modules });
-    }));
-  }
-};
-
-// src/cmd/config/index.ts
-function parseValue(value) {
-  if (value === "true") return true;
-  if (value === "false") return false;
-  if (value === "null") return null;
-  if (/^-?\d+(\.\d+)?$/.test(value)) return Number(value);
-  try {
-    return JSON.parse(value);
-  } catch {
-    return value;
-  }
-}
-var configCommand = {
-  name: "config",
-  description: "Generic local configuration commands",
-  category: "system",
-  register({ program: program2, action }) {
-    const config = program2.command("config").description("Manage weaver-work-cli config");
-    config.command("path").description("Print the active config file path").action(action((ctx) => {
-      ctx.output.write({ path: ctx.config.path() }, { text: ctx.config.path() });
-    }));
-    config.command("list").description("Print all config values").action(action((ctx) => {
-      ctx.output.write(ctx.config.all());
-    }));
-    config.command("get").description("Print one config value").argument("<key>", "config key").action(action((ctx, key) => {
-      if (typeof key !== "string") throw new CliError("key must be a string", 2 /* UsageError */);
-      ctx.output.write({ key, value: ctx.config.get(key) });
-    }));
-    config.command("set").description("Set one config value").argument("<key>", "config key").argument("<value>", "config value").action(action((ctx, key, value) => {
-      if (typeof key !== "string" || typeof value !== "string") {
-        throw new CliError("key and value must be strings", 2 /* UsageError */);
-      }
-      const parsed = parseValue(value);
-      ctx.config.set(key, parsed);
-      ctx.output.write({ key, value: parsed, path: ctx.config.path() }, { text: "Saved " + key });
-    }));
-    config.command("delete").description("Delete one config value").argument("<key>", "config key").action(action((ctx, key) => {
-      if (typeof key !== "string") throw new CliError("key must be a string", 2 /* UsageError */);
-      const deleted = ctx.config.delete(key);
-      ctx.output.write({ key, deleted, path: ctx.config.path() }, { text: deleted ? "Deleted " + key : "No value for " + key });
-    }));
-  }
-};
-
-// src/cmd/docs/index.ts
-import { cpSync, existsSync, readdirSync, readFileSync } from "node:fs";
-import { resolve } from "node:path";
-var DOCS_DIR = packagePath("docs");
-var PKG_JSON_URL = packageFileUrl("package.json");
-function packageVersion() {
-  try {
-    return JSON.parse(readFileSync(PKG_JSON_URL, "utf-8")).version;
-  } catch {
-    return "unknown";
-  }
-}
-function countFiles(dir) {
-  let count = 0;
-  for (const entry of readdirSync(dir, { withFileTypes: true })) {
-    const entryPath = resolve(dir, entry.name);
-    count += entry.isDirectory() ? countFiles(entryPath) : 1;
-  }
-  return count;
-}
-function ensureDocs() {
-  if (!existsSync(DOCS_DIR)) {
-    throw new CliError("docs directory does not exist: " + DOCS_DIR);
-  }
-}
-var docsCommand = {
-  name: "docs",
-  description: "Packaged docs and template copy commands",
-  category: "system",
-  register({ program: program2, action }) {
-    const docs = program2.command("docs").description("Read or copy packaged docs");
-    docs.command("root").description("Print packaged docs root path").action(action((ctx) => {
-      ensureDocs();
-      const root = DOCS_DIR.replace(/[\\/]+$/, "");
-      ctx.output.write({ root, version: packageVersion() }, { text: root + "\nversion: " + packageVersion() });
-    }));
-    docs.command("copy").description("Copy packaged docs to <target>/weaver-work-cli-docs").argument("[target]", "target directory", process.cwd()).action(action((ctx, target) => {
-      ensureDocs();
-      const dest = resolve(String(target || process.cwd()), "weaver-work-cli-docs");
-      const sourceRoot = DOCS_DIR.replace(/[\\/]+$/, "");
-      if (dest === sourceRoot || dest.startsWith(sourceRoot + "/") || dest.startsWith(sourceRoot + "\\")) {
-        throw new CliError("target directory is inside docs source: " + dest);
-      }
-      cpSync(DOCS_DIR, dest, { recursive: true });
-      const files = countFiles(dest);
-      ctx.output.write({ files, dest, version: packageVersion() }, { text: "Copied " + files + " files to " + dest });
-    }));
+// src/shortcuts/invoice/errors.ts
+var InvoiceCliError = class extends CliError {
+  type;
+  subtype;
+  code;
+  retryable;
+  stage;
+  details;
+  partialData;
+  constructor(type, subtype, message, options = {}) {
+    super(message, options.exitCode ?? 5 /* InternalError */);
+    this.name = "InvoiceCliError";
+    this.type = type;
+    this.subtype = subtype;
+    this.code = options.code;
+    this.retryable = options.retryable ?? false;
+    this.stage = options.stage;
+    this.details = options.details;
+    this.partialData = options.partialData;
   }
 };
-
-// src/cmd/doctor/index.ts
-import { existsSync as existsSync2 } from "node:fs";
-function versionMajor(version) {
-  return Number(version.replace(/^v/, "").split(".")[0] || 0);
-}
-var doctorCommand = {
-  name: "doctor",
-  description: "Environment diagnostics",
-  category: "system",
-  register({ program: program2, action }) {
-    program2.command("doctor").description("Check local CLI environment").option("--e10", "also check E10 auth file discovery").action(action((ctx, options) => {
-      const opts = options && typeof options === "object" ? options : {};
-      const checks = [
-        {
-          name: "node",
-          ok: versionMajor(process.version) >= 18,
-          detail: process.version
-        },
-        {
-          name: "package",
-          ok: Boolean(ctx.packageInfo.version),
-          detail: ctx.packageInfo.name + "@" + ctx.packageInfo.version
-        },
-        {
-          name: "configPath",
-          ok: true,
-          detail: ctx.config.path()
-        }
-      ];
-      if (opts.e10) {
-        const authFile = findAuthFile(ctx.cwd);
-        checks.push({
-          name: "e10AuthFile",
-          ok: Boolean(authFile && existsSync2(authFile)),
-          detail: authFile || "not found"
-        });
-      }
-      const ok = checks.every((check) => check.ok);
-      ctx.output.write({ ok, checks });
-    }));
-  }
-};
-
-// src/internal/e10/auth/commands.ts
-import { execFile } from "node:child_process";
-import { randomBytes } from "node:crypto";
-import { createServer } from "node:http";
-var DEFAULT_AGENT_TYPE = "weaver-work-cli";
-var EXPLICIT_AGENT_TYPE_ENV_KEYS = [
-  "WORKBUDDY_AGENT_TYPE",
-  "CODEX_AGENT_TYPE",
-  "WEAVER_AGENT_TYPE"
-];
-var AGENT_RETURN_URL_ENV_KEY = "WEAVER_AGENT_RETURN_URL";
-var AGENT_RETURN_PATH = "/agent-return";
-var AGENT_RETURN_TOKEN_HEADER = "x-weaver-agent-return-token";
-var AGENT_RETURN_TIMEOUT_MS = 9e5;
-var OAUTH_CALLBACK_PROTOCOL_MISMATCH_GRACE_MS = 3e4;
-var UNSAFE_AGENT_RETURN_PROTOCOLS = /* @__PURE__ */ new Set([
-  "about:",
-  "blob:",
-  "data:",
-  "file:",
-  "ftp:",
-  "http:",
-  "https:",
-  "javascript:",
-  "mailto:",
-  "sms:",
-  "tel:",
-  "vbscript:",
-  "ws:",
-  "wss:"
-]);
-var BUILT_IN_AGENT_RETURN_TARGETS = [
-  {
-    aliases: ["workbuddy"],
-    label: "WorkBuddy",
-    url: "workbuddy://"
-  },
-  {
-    aliases: ["xiaoe", "xiaoeclient", "\u5C0Fe", "\u667A\u80FD\u5C0Fe"],
-    label: "\u667A\u80FD\u5C0F E",
-    url: "xiaoe-client://"
-  },
-  {
-    aliases: ["codex", "openaicodex"],
-    label: "Codex",
-    url: "codex://"
-  }
-];
-function asOptions(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-function optionString(options, ...keys) {
-  for (const key of keys) {
-    const value = options[key];
-    if (typeof value === "string" && value.trim()) return value.trim();
-  }
-  return "";
-}
-function envString(env, ...keys) {
-  for (const key of keys) {
-    const value = env[key];
-    if (typeof value === "string" && value.trim()) return value.trim();
-  }
-  return "";
-}
-function hasEnvPrefix(env, prefix) {
-  return Object.keys(env).some((key) => key === prefix || key.startsWith(`${prefix}_`));
-}
-function inferAgentTypeFromEnv(env) {
-  if (hasXiaoEEnv(env)) return XIAOE_AGENT_TYPE;
-  if (hasEnvPrefix(env, "WORKBUDDY")) return "workbuddy";
-  if (hasEnvPrefix(env, "CODEX")) return "codex";
-  return "";
-}
-function resolveAgentType(options = {}, env = process.env) {
-  return optionString(options, "agentType", "agent_type") || envString(env, ...EXPLICIT_AGENT_TYPE_ENV_KEYS) || inferAgentTypeFromEnv(env) || DEFAULT_AGENT_TYPE;
-}
-function normalizeAgentKey(value) {
-  return value.toLowerCase().replace(/[^a-z0-9]+/gu, "");
-}
-function normalizeAgentAlias(value) {
-  return value.trim().toLowerCase().replace(/[^\p{Letter}\p{Number}]+/gu, "");
-}
-function builtInAgentReturnTarget(agentType) {
-  const alias = normalizeAgentAlias(agentType);
-  const target = BUILT_IN_AGENT_RETURN_TARGETS.find((candidate) => candidate.aliases.includes(alias));
-  return target ? { label: target.label, url: target.url } : null;
-}
-function conventionalAgentReturnUrl(agentType) {
-  const scheme = agentType.trim().toLowerCase();
-  if (normalizeAgentAlias(agentType) === normalizeAgentAlias(DEFAULT_AGENT_TYPE) || scheme.length > 64 || !/^[a-z][a-z0-9+.-]*$/u.test(scheme) || UNSAFE_AGENT_RETURN_PROTOCOLS.has(`${scheme}:`)) {
-    return "";
-  }
-  return `${scheme}://`;
-}
-function validateAgentReturnUrl(value) {
-  if (value.length > 2048 || /[\u0000-\u001f\u007f\s]/u.test(value) || !/^[a-z][a-z0-9+.-]*:\/\//iu.test(value)) {
-    throw new CliError("Invalid --agent-return-url value", 2 /* UsageError */);
-  }
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new CliError("Invalid --agent-return-url value", 2 /* UsageError */);
-  }
-  if (UNSAFE_AGENT_RETURN_PROTOCOLS.has(url.protocol)) {
-    throw new CliError("--agent-return-url must use a registered desktop application URL scheme.", 2 /* UsageError */);
-  }
-  return value;
-}
-function resolveAgentReturnTarget(options = {}, env = process.env, agentType = resolveAgentType(options, env)) {
-  const builtInTarget = builtInAgentReturnTarget(agentType);
-  const explicitUrl = optionString(options, "agentReturnUrl") || envString(env, AGENT_RETURN_URL_ENV_KEY);
-  if (explicitUrl) {
-    return {
-      label: builtInTarget?.label || agentType,
-      url: validateAgentReturnUrl(explicitUrl)
-    };
-  }
-  if (builtInTarget) return builtInTarget;
-  const conventionalUrl = conventionalAgentReturnUrl(agentType);
-  return conventionalUrl ? { label: agentType, url: conventionalUrl } : null;
-}
-function normalizeUrl(value) {
-  return value.replace(/\/+$/, "");
-}
-function readString(data, ...keys) {
-  for (const key of keys) {
-    const value = data[key];
-    if (typeof value === "string" && value) return value;
-    if (typeof value === "number") return String(value);
-  }
-  return "";
-}
-function cookieString(value) {
-  if (!value) return "";
-  if (typeof value === "string") return value;
-  if (typeof value === "object" && !Array.isArray(value)) {
-    return Object.entries(value).filter(([, cookieValue2]) => cookieValue2 !== void 0 && cookieValue2 !== null && cookieValue2 !== "").map(([name, cookieValue2]) => `${name}=${String(cookieValue2)}`).join("; ");
-  }
-  return "";
-}
-function cookieValue(rawCookie, name) {
-  const match = rawCookie.match(new RegExp(`${name}=([^;]+)`));
-  return match?.[1] || "";
-}
-function formatAuthStatus(status) {
-  if (!status.loggedIn) {
-    return "Not logged in. Select the appropriate authentication method for the current runtime before retrying.";
-  }
-  const lines = [
-    "Logged in.",
-    "userId: " + status.userId,
-    "tenantKey: " + (status.tenantKey || ""),
-    "tenantName: " + (status.tenantName || ""),
-    "department: " + (status.department || ""),
-    "subcompany: " + (status.subcompany || ""),
-    "position: " + (status.position || ""),
-    "version: " + (status.version || ""),
-    "agentType: " + (status.agentType || ""),
-    "baseUrl: " + status.baseUrl,
-    "profile: " + status.profile,
-    "authFile: " + status.authFile,
-    ..."loginSource" in status && status.loginSource ? ["loginSource: " + status.loginSource] : [],
-    ..."credentialSourceStep" in status && status.credentialSourceStep ? ["credentialSourceStep: " + status.credentialSourceStep] : [],
-    ..."credentialSourceType" in status && status.credentialSourceType ? ["credentialSourceType: " + status.credentialSourceType] : [],
-    ..."credentialSourceLabel" in status && status.credentialSourceLabel ? ["credentialSourceLabel: " + status.credentialSourceLabel] : [],
-    ..."expiryTimes" in status && status.expiryTimes ? ["expiryTimes: " + status.expiryTimes] : []
-  ];
-  if ("valid" in status) {
-    lines.push("valid: " + String(status.valid));
-  }
-  return lines.join("\n");
-}
-function formatLoginResult(result) {
-  return [
-    "Saved E10 auth.",
-    "userId: " + result.userId,
-    "tenantKey: " + result.tenantKey,
-    "tenantName: " + result.tenantName,
-    "baseUrl: " + result.baseUrl,
-    "profile: " + result.profile,
-    "authFile: " + result.authFile,
-    ...result.loginSource ? ["loginSource: " + result.loginSource] : [],
-    ...result.credentialSourceStep ? ["credentialSourceStep: " + result.credentialSourceStep] : [],
-    ...result.credentialSourceType ? ["credentialSourceType: " + result.credentialSourceType] : [],
-    ...result.credentialSourceLabel ? ["credentialSourceLabel: " + result.credentialSourceLabel] : [],
-    ...result.expiryTimes ? ["expiryTimes: " + result.expiryTimes] : []
-  ].join("\n");
-}
-async function clearInvoiceTokenCache(profile, authData) {
-  if (!authData.baseUrl || !authData.userId) return;
-  await clearInvoiceTokenForSession({
-    baseUrl: normalizeUrl(authData.baseUrl),
-    profile,
-    userId: authData.userId
-  }).catch(() => false);
-}
-function posixShellQuote(value) {
-  return `'${value.replace(/'/g, "'\\''")}'`;
-}
-function powershellQuote(value) {
-  return `'${value.replace(/'/g, "''")}'`;
-}
-function resolveWeaverEnvShell(shell, platform = process.platform) {
-  if (shell === "auto") return platform === "win32" ? "powershell" : "posix";
-  if (shell === "posix" || shell === "powershell") return shell;
-  throw new CliError("Invalid --shell value. Use auto, posix, or powershell.", 2 /* UsageError */);
-}
-function formatWeaverEnvExports(value, shell = "auto", platform = process.platform) {
-  const resolved = resolveWeaverEnvShell(shell, platform);
-  return Object.entries(value).map(([name, envValue2]) => resolved === "powershell" ? `$env:${name} = ${powershellQuote(envValue2)}` : `export ${name}=${posixShellQuote(envValue2)}`).join("\n");
-}
-function esc(value) {
-  return String(value ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
-function renderE10LoginSuccessPage(userId, returnTarget = null, launchToken = "") {
-  const safeReturnTarget = returnTarget ? { ...returnTarget, url: validateAgentReturnUrl(returnTarget.url) } : null;
-  const agentKey = safeReturnTarget ? normalizeAgentKey(safeReturnTarget.label) || "agent" : "";
-  const returnAction = safeReturnTarget && launchToken ? `<div class="overlay" data-agent-return data-token="${esc(launchToken)}" data-agent-key="${esc(agentKey)}" data-agent-label="${esc(safeReturnTarget.label)}" data-fallback-url="${esc(safeReturnTarget.url)}"><section class="prompt" role="dialog" aria-modal="true" aria-labelledby="agent-return-title"><div class="app-icon" aria-hidden="true"><svg viewBox="0 0 64 64"><defs><linearGradient id="app-gradient" x1="8" y1="4" x2="56" y2="60" gradientUnits="userSpaceOnUse"><stop stop-color="#24d3b5"/><stop offset="1" stop-color="#08aa82"/></linearGradient></defs><rect width="64" height="64" rx="16" fill="url(#app-gradient)"/><path d="M18 21.5 32 13l14 8.5v17L32 47 18 38.5v-17Z" fill="#fff" fill-opacity=".96"/><rect x="23" y="25" width="18" height="15" rx="6" fill="#12b991"/><circle cx="28.5" cy="32.5" r="1.8" fill="#fff"/><circle cx="35.5" cy="32.5" r="1.8" fill="#fff"/></svg></div><h1 id="agent-return-title">\u662F\u5426\u6253\u5F00\u201C${esc(safeReturnTarget.label)}\u201D\uFF1F</h1><p>\u767B\u5F55\u6388\u6743\u5DF2\u5B8C\u6210\uFF0C\u8FD4\u56DE ${esc(safeReturnTarget.label)} \u7EE7\u7EED\u4F7F\u7528\u3002</p><button class="primary" type="button" data-action="open">\u6253\u5F00\u201C${esc(safeReturnTarget.label)}\u201D</button><button class="secondary" type="button" data-action="always">\u59CB\u7EC8\u6253\u5F00\u201C${esc(safeReturnTarget.label)}\u201D</button><button class="secondary" type="button" data-action="cancel">\u53D6\u6D88</button><div class="status" role="status" aria-live="polite"></div></section></div>` : "";
-  const returnScript = safeReturnTarget && launchToken ? `<script nonce="${esc(launchToken)}">(()=>{const root=document.querySelector('[data-agent-return]');if(!root)return;const status=root.querySelector('.status');const buttons=[...root.querySelectorAll('button')];const agentLabel=root.dataset.agentLabel||'\u5E94\u7528';const fallbackUrl=root.dataset.fallbackUrl||'';const storageKey='weaver-work-cli.agent-return.'+root.dataset.agentKey;let busy=false;const setBusy=value=>{busy=value;buttons.forEach(button=>{button.disabled=value;});};const closePrompt=()=>{root.hidden=true;};const savePreference=()=>{try{localStorage.setItem(storageKey,'1');}catch{}};const clearPreference=()=>{try{localStorage.removeItem(storageKey);}catch{}};const hasPreference=()=>{try{return localStorage.getItem(storageKey)==='1';}catch{return false;}};const post=async action=>{let response;try{response=await fetch('${AGENT_RETURN_PATH}?action='+encodeURIComponent(action),{method:'POST',headers:{'${AGENT_RETURN_TOKEN_HEADER}':root.dataset.token}});}catch{return false;}if(!response.ok)throw new Error(await response.text()||'\u8BF7\u6C42\u5931\u8D25');return true;};const openAgent=async persist=>{if(busy)return;setBusy(true);status.textContent='\u6B63\u5728\u6253\u5F00 '+agentLabel+'\u2026';try{const openedLocally=await post('open');if(persist)savePreference();if(!openedLocally){closePrompt();window.location.href=fallbackUrl;return;}closePrompt();}catch(error){if(persist)clearPreference();status.textContent=error instanceof Error?error.message:'\u65E0\u6CD5\u6253\u5F00\u5E94\u7528\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002';setBusy(false);}};root.querySelector('[data-action="open"]').addEventListener('click',()=>openAgent(false));root.querySelector('[data-action="always"]').addEventListener('click',()=>openAgent(true));root.querySelector('[data-action="cancel"]').addEventListener('click',()=>{if(busy)return;clearPreference();closePrompt();post('cancel').catch(()=>{});});if(hasPreference())openAgent(false);})();</script>` : "";
-  return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>weaver-work-cli \u767B\u5F55\u6210\u529F</title><style>:root{color-scheme:light}*{box-sizing:border-box}body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Arial,sans-serif;background:radial-gradient(circle at 50% 18%,#eefbf8 0,#f6f7f9 42%,#eef1f5 100%);color:#20242a;display:grid;place-items:center;min-height:100vh;margin:0}.card{background:rgba(255,255,255,.88);border:1px solid #e6e8ec;border-radius:18px;padding:34px 38px;box-shadow:0 18px 55px rgba(18,24,40,.09);width:min(560px,calc(100vw - 40px));text-align:center}.title{font-size:24px;font-weight:700;margin-bottom:10px}.desc{color:#667085;font-size:15px;line-height:24px}.user{color:#98a2b3;font-size:12px;margin-top:18px}.overlay{position:fixed;inset:0;z-index:10;display:grid;place-items:center;padding:20px;background:rgba(28,34,41,.36);backdrop-filter:blur(5px)}.overlay[hidden]{display:none}.prompt{width:min(410px,calc(100vw - 32px));padding:32px 28px 26px;border:1px solid rgba(255,255,255,.75);border-radius:24px;background:rgba(250,250,251,.97);box-shadow:0 24px 70px rgba(15,23,42,.28);text-align:center}.app-icon{width:74px;height:74px;margin:0 auto 24px;filter:drop-shadow(0 8px 14px rgba(8,170,130,.22))}.app-icon svg{display:block;width:100%;height:100%}.prompt h1{margin:0;font-size:20px;line-height:30px;font-weight:700;letter-spacing:-.2px}.prompt p{margin:10px 0 24px;color:#667085;font-size:14px;line-height:22px}.prompt button{display:block;width:100%;min-height:40px;border:0;border-radius:12px;font:600 16px/22px inherit;cursor:pointer;transition:transform .12s ease,filter .12s ease}.prompt button+button{margin-top:10px}.prompt button:hover{filter:brightness(.98)}.prompt button:active{transform:scale(.99)}.prompt button:disabled{cursor:wait;opacity:.62}.primary{background:linear-gradient(180deg,#2f91ff,#0b74e5);color:#fff;box-shadow:0 8px 18px rgba(11,116,229,.2)}.secondary{background:#e9eaec;color:#22252a}.status{min-height:18px;margin-top:14px;color:#667085;font-size:12px;line-height:18px}</style></head><body><main class="card"><div class="title">\u767B\u5F55\u6388\u6743\u6210\u529F</div><div class="desc">\u4F60\u53EF\u4EE5\u5173\u95ED\u6B64\u9875\u9762\uFF0C\u8FD4\u56DE\u667A\u80FD\u4F53\u6216\u7EC8\u7AEF\u7EE7\u7EED\u4F7F\u7528\u3002</div><div class="user">${esc(userId)}</div></main>${returnAction}${returnScript}</body></html>`;
-}
-function resolveBrowserOpenCommand(url, platform = process.platform) {
-  if (platform === "win32") {
-    return { file: "rundll32.exe", args: ["url.dll,FileProtocolHandler", url] };
-  }
-  if (platform === "darwin") return { file: "open", args: [url] };
-  return { file: "xdg-open", args: [url] };
-}
-function openUrlInBrowser(url, ctx) {
-  const command = resolveBrowserOpenCommand(url);
-  execFile(command.file, command.args, (error) => {
-    if (error) {
-      ctx.logger.warn("Could not open browser automatically. Copy the login URL manually.");
-    }
+function invoiceValidationError(subtype, message, details) {
+  return new InvoiceCliError("validation", subtype, message, {
+    details,
+    exitCode: 2 /* UsageError */
   });
 }
-function openUrlWithSystemHandler(url) {
-  const command = resolveBrowserOpenCommand(url);
-  return new Promise((resolve8, reject) => {
-    execFile(command.file, command.args, (error) => {
-      if (error) reject(error);
-      else resolve8();
-    });
+function invoiceAuthError(subtype, message, details) {
+  return new InvoiceCliError("authentication", subtype, message, {
+    details,
+    exitCode: 3 /* AuthError */
   });
 }
-function buildE10AuthorizeUrl(baseUrl, redirectUri, agentType) {
-  const authorizeParams = new URLSearchParams({
-    redirect_uri: redirectUri,
-    response_type: "code",
-    access_type: "agent",
-    agent_type: agentType,
-    from: agentType
+function invoiceNetworkError(subtype, message, options = {}) {
+  return new InvoiceCliError("network", subtype, message, {
+    ...options,
+    retryable: options.retryable ?? true,
+    exitCode: 4 /* NetworkError */
   });
-  return `${baseUrl}/papi/sso/oauth2.0/authorize?${authorizeParams.toString()}`;
-}
-function isTlsClientHello(error) {
-  if (!error || typeof error !== "object") return false;
-  const rawPacket = error.rawPacket;
-  return Buffer.isBuffer(rawPacket) && rawPacket.length >= 3 && rawPacket[0] === 22 && rawPacket[1] === 3;
 }
-function createOAuthCallbackProtocolMismatchError(port) {
-  return Object.assign(new CliError(
-    `OAuth callback protocol mismatch: the browser connected to https://127.0.0.1:${port}, but the CLI callback listener uses HTTP. Retry the login and, on the callback error page, change only the URL scheme to http:// before reloading; keep the path and query unchanged. The E10 authorization service should preserve HTTP loopback redirect URIs.`,
-    3 /* AuthError */
-  ), {
-    type: "authentication",
-    subtype: "oauth_callback_protocol_mismatch",
-    retryable: false,
-    stage: "oauth_callback"
+function invoiceConfirmationError(action, details) {
+  return new InvoiceCliError("confirmation", "required", "\u8BE5\u64CD\u4F5C\u9700\u8981\u660E\u786E\u786E\u8BA4", {
+    details: { action, ...details },
+    exitCode: 10 /* ConfirmationRequired */
   });
 }
-async function readJsonObject(resp) {
-  const data = await resp.json().catch(() => ({}));
-  return data && typeof data === "object" && !Array.isArray(data) ? data : {};
-}
-async function resolveUserInfo(baseUrl, eteamsId, rawCookie = "", agentType = "") {
-  const resp = await fetch(`${baseUrl}/api/baseserver/layout/teamsCheck?clientType=not_xinchuang&client=WEB&domainName=${encodeURIComponent(baseUrl)}`, {
-    method: "POST",
-    headers: {
-      accept: "application/json",
-      "content-type": "application/json",
-      eteamsid: eteamsId,
-      cookie: buildE10CookieHeader(rawCookie, eteamsId, agentType),
-      "user-agent": agentType ? `AgentType=${agentType},IsAgent=true` : DEFAULT_AGENT_TYPE,
-      origin: baseUrl
-    },
-    redirect: "manual"
+function invoicePartialError(message, partialData, details) {
+  return new InvoiceCliError("partial", "write_uncertain", message, {
+    details,
+    partialData,
+    exitCode: 11 /* Partial */
   });
-  const data = await resp.json().catch(() => ({}));
-  return { userInfo: readTeamsCheckUserInfo(resp, data), setCookie: extractRawSetCookie(resp) };
-}
-async function saveEteamsIdLogin(input) {
-  const baseUrl = normalizeUrl(input.baseUrl);
-  const passportUrl = normalizeUrl(input.passportUrl || baseUrl);
-  const { userInfo, setCookie } = await resolveUserInfo(baseUrl, input.eteamsId, input.rawCookie || "", input.agentType);
-  if (!userInfo.userId) {
-    throw new CliError("Could not resolve userId. Check whether ETEAMSID is valid for this E10 domain.", 3 /* AuthError */);
-  }
-  const tenantKey = userInfo.tenantKey || input.tenantKeyFallback;
-  const profile = input.profileHint || profileNameFromUrl(baseUrl);
-  setActiveProfile(profile);
-  const cookies = { ETEAMSID: input.eteamsId };
-  if (input.rawCookie) cookies.raw = input.rawCookie;
-  const ztSession = extractSessionTicket(setCookie, input.rawCookie || "");
-  const authData = {
-    cookies,
-    userId: userInfo.userId,
-    tenantKey,
-    tenantName: userInfo.tenantName,
-    department: userInfo.department,
-    subcompany: userInfo.subcompany,
-    position: userInfo.position,
-    agentType: input.agentType,
-    version: input.version || "",
-    baseUrl,
-    passportUrl,
-    cookieSavedAt: Date.now(),
-    ...ztSession ? { ztSession } : {}
-  };
-  await clearInvoiceTokenCache(profile, authData);
-  const authFile = saveAuthFile(authData, profile);
-  saveProfileConfig(baseUrl, passportUrl, profile, tenantKey);
-  return {
-    ...userInfo,
-    tenantKey,
-    eteamsId: input.eteamsId,
-    baseUrl,
-    passportUrl,
-    profile,
-    authFile,
-    agentType: input.agentType,
-    version: input.version || ""
-  };
 }
-async function tryXiaoEUnifiedLogin2(ctx, baseUrl, tenantKeyFallback, profileHint, allowTokenScript = false) {
-  const login = await tryXiaoEUnifiedLogin({
-    env: ctx.env,
-    baseUrl,
-    allowBundledEnvScript: true,
-    tenantKeyFallback,
-    profileHint,
-    allowTokenScript,
-    logger: ctx.logger
-  });
-  return login?.result || null;
+function isInvoiceNetworkError(error) {
+  return Boolean(
+    error && typeof error === "object" && "type" in error && error.type === "network"
+  );
 }
-async function oidcExchange(code, redirectUri, baseUrl, tenantKeyFallback, agentTypeFallback, profileHint) {
-  const base = normalizeUrl(baseUrl);
-  const tokenParams = new URLSearchParams({
-    grant_type: "authorization_code",
-    code,
-    redirect_uri: redirectUri
-  });
-  const tokenResp = await fetch(`${base}/papi/sso/oauth2.0/accessToken`, {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: tokenParams.toString(),
-    redirect: "manual"
-  });
-  const tokenData = await readJsonObject(tokenResp);
-  if (tokenResp.status >= 400) {
-    const message = readString(tokenData, "message", "msg", "error_description", "error") || `OAuth token exchange failed: ${tokenResp.status}`;
-    throw new CliError(message, 3 /* AuthError */);
-  }
-  let eteamsId = readString(tokenData, "eteamsId", "eteamsid");
-  let userId = readString(tokenData, "id", "userId", "employeeId");
-  let rawCookies = cookieString(tokenData.cookies || tokenData.cookie) || extractRawSetCookie(tokenResp);
-  let agentType = agentTypeFallback || readString(tokenData, "agentType", "agent_type");
-  let version = readString(tokenData, "version", "baselineVersion");
-  const accessToken = readString(tokenData, "access_token", "accessToken");
-  if (!eteamsId) eteamsId = cookieValue(rawCookies, "ETEAMSID");
-  if (accessToken && (!eteamsId || !userId || !rawCookies || !version || !agentType)) {
-    const profileResp = await fetch(`${base}/papi/sso/oauth2.0/profile?access_token=${encodeURIComponent(accessToken)}`, {
-      method: "POST",
-      headers: { accept: "application/json" },
-      redirect: "manual"
-    });
-    const profileData = await readJsonObject(profileResp);
-    const profileRawCookies = cookieString(profileData.cookies || profileData.cookie) || extractRawSetCookie(profileResp);
-    if (!eteamsId) eteamsId = readString(profileData, "eteamsId", "eteamsid") || cookieValue(profileRawCookies, "ETEAMSID");
-    if (!userId) userId = readString(profileData, "id", "userId", "employeeId");
-    if (!rawCookies) rawCookies = profileRawCookies;
-    if (!agentType) agentType = readString(profileData, "agentType", "agent_type");
-    if (!version) version = readString(profileData, "version", "baselineVersion");
-  }
-  if (!eteamsId) {
-    throw new CliError("Could not resolve ETEAMSID from OAuth response.", 3 /* AuthError */);
+
+// src/shortcuts/invoice/host.ts
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+var MAX_DOWNLOAD_BYTES = 50 * 1024 * 1024;
+var TOKEN_SERVICE = "cn.weaver.weaver-work-cli.invoice-token";
+var INVOICE_SESSION_EXPIRED_CODE = "-2";
+function assertPath(requestPath) {
+  if (typeof requestPath !== "string" || !requestPath.startsWith("/") || requestPath.startsWith("//")) {
+    throw invoiceValidationError("path_invalid", "\u8BF7\u6C42\u8DEF\u5F84\u5FC5\u987B\u662F\u76F8\u5BF9\u7EDD\u5BF9\u8DEF\u5F84");
+  }
+  if (/^https?:/i.test(requestPath) || /[\r\n]/.test(requestPath) || requestPath.includes("/../")) {
+    throw invoiceValidationError("path_invalid", "\u8BF7\u6C42\u8DEF\u5F84\u4E0D\u5141\u8BB8\u8DE8\u57DF\u6216\u8DEF\u5F84\u9003\u9038");
+  }
+  if (!requestPath.startsWith("/api/")) {
+    throw invoiceValidationError("path_not_allowed", "\u4E1A\u7968\u901A\u53EA\u80FD\u8C03\u7528 /api/ \u8DEF\u5F84");
+  }
+}
+function responseRoot(value) {
+  return value?.res_base || value?.data?.res_base || value;
+}
+function responseMessage(value) {
+  const root = responseRoot(value);
+  return typeof root?.message === "string" ? root.message : typeof root?.msg === "string" ? root.msg : "\u6CDB\u5FAE\u63A5\u53E3\u8FD4\u56DE\u4E1A\u52A1\u5931\u8D25";
+}
+function responseCode(value) {
+  const root = responseRoot(value);
+  return root?.ret ?? root?.code;
+}
+function isInvoiceSessionExpired(value) {
+  const code = responseCode(value);
+  return code !== void 0 && String(code) === INVOICE_SESSION_EXPIRED_CODE;
+}
+function tokenAccount(session) {
+  return createHash("sha256").update(`${session.profile}
+${session.baseUrl}
+${session.userId}`).digest("hex");
+}
+function createInvoiceTokenStore(session) {
+  const account = tokenAccount(session);
+  let entryPromise = null;
+  async function entry() {
+    if (!entryPromise) {
+      entryPromise = import("@napi-rs/keyring").then(({ Entry }) => new Entry(TOKEN_SERVICE, account));
+    }
+    return entryPromise;
   }
-  const { userInfo, setCookie } = await resolveUserInfo(base, eteamsId, rawCookies, agentType).catch(() => ({
-    userInfo: {
-      userId: "",
-      tenantKey: "",
-      tenantName: "",
-      department: "",
-      subcompany: "",
-      position: ""
-    },
-    setCookie: ""
-  }));
-  const tenantKey = readString(tokenData, "tenant_key", "tenantKey") || userInfo.tenantKey || tenantKeyFallback;
-  const ztSession = extractSessionTicket(setCookie, rawCookies);
-  const authData = {
-    cookies: { ETEAMSID: eteamsId, raw: rawCookies },
-    userId: userInfo.userId || userId || "unknown",
-    tenantKey,
-    tenantName: userInfo.tenantName,
-    department: userInfo.department,
-    subcompany: userInfo.subcompany,
-    position: userInfo.position,
-    agentType,
-    version,
-    baseUrl: base,
-    passportUrl: base,
-    cookieSavedAt: Date.now(),
-    ...ztSession ? { ztSession } : {}
-  };
-  const profile = profileHint || profileNameFromUrl(base);
-  setActiveProfile(profile);
-  await clearInvoiceTokenCache(profile, authData);
-  const authFile = saveAuthFile(authData, profile);
-  saveProfileConfig(base, base, profile, tenantKey);
   return {
-    userId: authData.userId,
-    tenantKey,
-    tenantName: authData.tenantName || "",
-    department: authData.department || "",
-    subcompany: authData.subcompany || "",
-    position: authData.position || "",
-    eteamsId,
-    baseUrl: base,
-    passportUrl: base,
-    profile,
-    authFile,
-    agentType,
-    version
-  };
-}
-function xiaoEUnifiedLoginUnavailableMessage(baseUrl, attempted) {
-  return [
-    attempted ? "XiaoE \u7EDF\u4E00\u767B\u5F55\u5DF2\u5C1D\u8BD5\uFF0C\u4F46\u672A\u83B7\u53D6\u5230\u53EF\u7528\u4F1A\u8BDD\u3002" : "\u672A\u68C0\u6D4B\u5230\u53EF\u7528\u7684 XiaoE \u7EDF\u4E00\u767B\u5F55\u51ED\u636E\u6E90\uFF0C\u672C\u6B21\u672A\u5C1D\u8BD5\u7EDF\u4E00\u767B\u5F55\u3002",
-    "`auth xiaoe` \u4E0D\u4F1A\u964D\u7EA7\u5230\u6D4F\u89C8\u5668 OAuth\u3002",
-    baseUrl ? `\u5F53\u524D E10 baseUrl: ${baseUrl}\u3002` : "\u672A\u4ECE XiaoE \u51ED\u8BC1\u4E2D\u89E3\u6790\u5230 E10 baseUrl\u3002",
-    attempted ? "CLI \u5DF2\u4F9D\u6B21\u5C1D\u8BD5\u5E73\u53F0\u6CE8\u5165\u51ED\u8BC1\u7684 Node \u6362\u7968\u3001CLI \u5185\u7F6E xiaoe_env.py \u517C\u5BB9\u6362\u7968\u3001\u5BBF\u4E3B xiaoeUserData/tokens.py\u3001\u684C\u9762 XiaoE \u5BA2\u6237\u7AEF\u51ED\u8BC1\uFF08XiaoE/Robots/*/user_settings.json\uFF09\u548C WEAVER_XIAOE_* \u73AF\u5883\u6620\u5C04\u3002" : "CLI \u5DF2\u68C0\u67E5\u5E73\u53F0\u6CE8\u5165\u51ED\u8BC1\u3001\u5BBF\u4E3B xiaoeUserData/tokens.py\u3001\u684C\u9762 XiaoE \u5BA2\u6237\u7AEF\u51ED\u8BC1\uFF08XiaoE/Robots/*/user_settings.json\uFF09\u548C WEAVER_XIAOE_* \u73AF\u5883\u6620\u5C04\u3002",
-    "CLI \u4F1A\u4F18\u5148\u4F7F\u7528 XiaoE \u5BA2\u6237\u7AEF\u5185\u7F6E Python \u6267\u884C tokens.py\uFF1B\u81EA\u52A8\u53D1\u73B0\u4E0D\u53EF\u7528\u65F6\uFF0C\u53EF\u7528 WEAVER_XIAOE_TOKEN_SCRIPT_PYTHON \u6307\u5B9A\u517C\u5BB9\u89E3\u91CA\u5668\u3002"
-  ].join(" ");
-}
-async function runXiaoELogin(ctx, options) {
-  const commandOpts = asOptions(options);
-  const globalOptions = ctx.getGlobalOptions();
-  const profileFromGlobal = globalOptions.profile;
-  const cfg = readProfileConfig(profileFromGlobal || getActiveProfile());
-  const explicitBaseUrl = optionString(commandOpts, "baseUrl") || globalOptions.baseUrl || "";
-  const preferredXiaoEBaseUrl = resolveXiaoEPreferredBaseUrl({
-    explicitBaseUrl,
-    profileBaseUrl: cfg.baseUrl,
-    env: ctx.env
-  });
-  const xiaoESources = inspectXiaoEUnifiedLoginSources({
-    env: ctx.env,
-    baseUrl: preferredXiaoEBaseUrl,
-    profileBaseUrl: cfg.baseUrl,
-    allowTokenScript: true
-  });
-  const useXiaoELogin = xiaoESources.any;
-  const baseUrl = preferredXiaoEBaseUrl;
-  const tenantKey = optionString(commandOpts, "tenantKey");
-  ctx.logger.info([
-    "XiaoE unified login preflight:",
-    "authMode=xiaoe",
-    `credentialSourceDetected=${String(xiaoESources.any)}`,
-    `attempted=${String(useXiaoELogin)}`,
-    `platformCredentialDetected=${String(xiaoESources.platformCredential)}`,
-    `tokenScriptDetected=${String(xiaoESources.tokenScript)}`,
-    `clientSettingsDetected=${String(xiaoESources.clientCredential)}`,
-    `environmentCredentialDetected=${String(xiaoESources.environmentCredential)}`,
-    `clientType=${xiaoESources.clientType || "(unset)"}`,
-    `baseUrl=${baseUrl || "(unresolved)"}`
-  ].join(" "));
-  if (useXiaoELogin) {
-    const xiaoEResult = await tryXiaoEUnifiedLogin2(ctx, baseUrl, tenantKey, profileFromGlobal, true);
-    if (xiaoEResult) return xiaoEResult;
-  }
-  ctx.logger.warn(xiaoEUnifiedLoginUnavailableMessage(baseUrl, useXiaoELogin));
-  throw createXiaoEUnifiedLoginUnavailableError(baseUrl);
-}
-async function runBrowserLogin(ctx, options) {
-  const commandOpts = asOptions(options);
-  const globalOptions = ctx.getGlobalOptions();
-  const profileFromGlobal = globalOptions.profile;
-  const cfg = readProfileConfig(profileFromGlobal || getActiveProfile());
-  const explicitBaseUrl = optionString(commandOpts, "baseUrl") || globalOptions.baseUrl || "";
-  const baseUrl = normalizeUrl(explicitBaseUrl || cfg.baseUrl || "");
-  const tenantKey = optionString(commandOpts, "tenantKey");
-  const portText = optionString(commandOpts, "port") || "19800";
-  const port = Number.parseInt(portText, 10);
-  const explicitAgentType = optionString(commandOpts, "agentType", "agent_type");
-  const agentType = resolveAgentType(commandOpts, ctx.env);
-  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
-    throw new CliError("Invalid --port value", 2 /* UsageError */);
-  }
-  if (!baseUrl) throw new CliError("Missing --base-url", 2 /* UsageError */);
-  const agentReturnTarget = resolveAgentReturnTarget(commandOpts, ctx.env, agentType);
-  const agentReturnToken = agentReturnTarget ? randomBytes(24).toString("base64url") : "";
-  const redirectUri = `http://127.0.0.1:${port}/callback`;
-  const loginUrl = buildE10AuthorizeUrl(baseUrl, redirectUri, agentType);
-  ctx.logger.info("Open browser login: " + loginUrl);
-  ctx.logger.info("Waiting for E10 authorization callback...");
-  return await new Promise((resolve8, reject) => {
-    let settled = false;
-    let timer = null;
-    let pendingLoginResult = null;
-    let tlsCallbackDetected = false;
-    const finish = (error, result) => {
-      if (settled) return;
-      settled = true;
-      if (timer) clearTimeout(timer);
-      const complete = () => {
-        if (error) reject(error);
-        else resolve8(result);
-      };
+    async load() {
       try {
-        server.close(complete);
+        const value = await (await entry()).getPassword();
+        return typeof value === "string" && value.trim() ? value : null;
       } catch {
-        complete();
-      }
-    };
-    const server = createServer(async (req, res) => {
-      const callbackUrl = new URL(req.url || "/", `http://127.0.0.1:${port}`);
-      if (callbackUrl.pathname === AGENT_RETURN_PATH) {
-        const requestToken = req.headers[AGENT_RETURN_TOKEN_HEADER];
-        if (req.method !== "POST" || !agentReturnTarget || !pendingLoginResult || requestToken !== agentReturnToken) {
-          res.writeHead(403, { "cache-control": "no-store", "content-type": "text/plain; charset=utf-8" });
-          res.end("Forbidden");
-          return;
-        }
-        const action = callbackUrl.searchParams.get("action");
-        if (action === "cancel") {
-          const result = pendingLoginResult;
-          res.writeHead(204, { "cache-control": "no-store" });
-          res.end();
-          finish(null, result);
-          return;
-        }
-        if (action !== "open") {
-          res.writeHead(400, { "cache-control": "no-store", "content-type": "text/plain; charset=utf-8" });
-          res.end("Invalid action");
-          return;
-        }
-        try {
-          await openUrlWithSystemHandler(agentReturnTarget.url);
-          const result = pendingLoginResult;
-          res.writeHead(200, { "cache-control": "no-store", "content-type": "application/json; charset=utf-8" });
-          res.end('{"ok":true}');
-          finish(null, result);
-        } catch {
-          ctx.logger.warn(`Could not open ${agentReturnTarget.label} automatically.`);
-          res.writeHead(500, { "cache-control": "no-store", "content-type": "text/plain; charset=utf-8" });
-          res.end(`\u65E0\u6CD5\u6253\u5F00 ${agentReturnTarget.label}\uFF0C\u8BF7\u786E\u8BA4\u5E94\u7528\u5DF2\u5B89\u88C5\u3002`);
-        }
-        return;
-      }
-      if (callbackUrl.pathname !== "/callback") {
-        res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
-        res.end("Not found");
-        return;
-      }
-      const error = callbackUrl.searchParams.get("error");
-      const code = callbackUrl.searchParams.get("code");
-      const redirectAgentType = explicitAgentType || callbackUrl.searchParams.get("agent_type") || callbackUrl.searchParams.get("agentType") || callbackUrl.searchParams.get("from") || agentType;
-      if (error) {
-        const message = callbackUrl.searchParams.get("error_description") || error;
-        res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
-        res.end(`<h1>Authorization failed</h1><p>${esc(message)}</p>`);
-        finish(new CliError("OAuth authorization failed: " + message, 3 /* AuthError */));
-        return;
-      }
-      if (!code) {
-        res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
-        res.end("<h1>Login failed</h1><p>Missing authorization code.</p>");
-        finish(new CliError("No authorization code received.", 3 /* AuthError */));
-        return;
-      }
-      if (tlsCallbackDetected && timer) {
-        clearTimeout(timer);
-        timer = null;
+        return null;
       }
+    },
+    async save(token) {
+      if (!token.trim()) return false;
       try {
-        const result = await oidcExchange(code, redirectUri, baseUrl, tenantKey, redirectAgentType, profileFromGlobal);
-        const responseHeaders = {
-          "cache-control": "no-store",
-          "content-security-policy": agentReturnTarget ? `default-src 'none'; style-src 'unsafe-inline'; script-src 'nonce-${agentReturnToken}'; connect-src 'self'` : `default-src 'none'; style-src 'unsafe-inline'`,
-          "content-type": "text/html; charset=utf-8",
-          "referrer-policy": "no-referrer",
-          "x-content-type-options": "nosniff",
-          "x-frame-options": "DENY"
-        };
-        res.writeHead(200, responseHeaders);
-        res.end(renderE10LoginSuccessPage(result.userId, agentReturnTarget, agentReturnToken));
-        if (!agentReturnTarget) {
-          finish(null, result);
-          return;
-        }
-        pendingLoginResult = result;
-        if (timer) clearTimeout(timer);
-        timer = setTimeout(() => finish(null, result), AGENT_RETURN_TIMEOUT_MS);
-      } catch (exchangeError) {
-        const message = exchangeError instanceof Error ? exchangeError.message : String(exchangeError);
-        res.writeHead(500, { "content-type": "text/html; charset=utf-8" });
-        res.end(`<h1>Login failed</h1><p>${esc(message)}</p>`);
-        finish(exchangeError);
+        await (await entry()).setPassword(token);
+        return true;
+      } catch {
+        return false;
       }
-    });
-    server.on("error", (error) => {
-      const message = error.code === "EADDRINUSE" ? `Port ${port} is already in use. Retry with --port ${port + 1}.` : error.code === "EACCES" ? `Port ${port} is not accessible. Retry with another --port.` : error.message;
-      finish(new CliError(message, 2 /* UsageError */));
-    });
-    server.on("clientError", (error, socket) => {
-      if (isTlsClientHello(error)) {
-        if (!tlsCallbackDetected) {
-          tlsCallbackDetected = true;
-          ctx.logger.warn([
-            `OAuth callback protocol mismatch: the browser used HTTPS for 127.0.0.1:${port}, while the CLI listener is HTTP.`,
-            "\u5728 30 \u79D2\u5185\u628A\u6D4F\u89C8\u5668\u5F53\u524D\u5730\u5740\u5F00\u5934\u660E\u786E\u6539\u4E3A http://\uFF0C\u4FDD\u7559\u540E\u9762\u7684\u5B8C\u6574\u8DEF\u5F84\u548C\u53C2\u6570\uFF0C\u7136\u540E\u56DE\u8F66\u91CD\u8BD5\u3002",
-            "\u4E0D\u8981\u628A\u5730\u5740\u4E2D\u7684\u6388\u6743\u7801\u590D\u5236\u5230\u804A\u5929\u6216\u65E5\u5FD7\u3002"
-          ].join(" "));
-          if (timer) clearTimeout(timer);
-          timer = setTimeout(() => {
-            finish(createOAuthCallbackProtocolMismatchError(port));
-          }, OAUTH_CALLBACK_PROTOCOL_MISMATCH_GRACE_MS);
-        }
-        socket.destroy();
-        return;
+    },
+    async clear() {
+      try {
+        await (await entry()).deletePassword();
+        return true;
+      } catch {
+        return false;
       }
-      socket.destroy();
-    });
-    server.listen(port, "127.0.0.1", () => {
-      ctx.logger.info("Local callback server: " + redirectUri);
-      openUrlInBrowser(loginUrl, ctx);
-    });
-    timer = setTimeout(() => {
-      finish(new CliError("Login timed out after 5 minutes.", 3 /* AuthError */));
-    }, 3e5);
-  });
-}
-function sessionToCachedUser(session, profile) {
-  return {
-    employeeId: session.userId,
-    tenantKey: session.tenantKey,
-    tenantName: session.tenantName,
-    department: session.department,
-    subcompany: session.subcompany,
-    position: session.position,
-    version: session.version,
-    baseUrl: session.getBaseUrl(),
-    profile,
-    eteamsId: session.eteamsId,
-    agentType: session.agentType,
-    cookie: session.cookieHeader(),
-    userAgent: session.uaHeader()
+    }
   };
 }
-function formatWhoami(title, data) {
-  return [
-    title,
-    "employeeId: " + (data.employeeId || ""),
-    "tenantKey: " + (data.tenantKey || ""),
-    "tenantName: " + (data.tenantName || ""),
-    "department: " + (data.department || ""),
-    "subcompany: " + (data.subcompany || ""),
-    "position: " + (data.position || ""),
-    "version: " + (data.version || ""),
-    "baseUrl: " + (data.baseUrl || ""),
-    "profile: " + (data.profile || ""),
-    "ETEAMSID: " + (data.eteamsId || ""),
-    "cookie: " + (data.cookie || ""),
-    "User-Agent: " + (data.userAgent || "")
-  ].join("\n");
-}
-function registerBrowserLoginCommand(auth, action, name, description) {
-  const command = auth.command(name).description(description).option("--base-url <url>", "E10 base URL").option("--tenant-key <key>", "Tenant key fallback after login").option("--port <n>", "Local OAuth callback port", "19800").option("--agent_type <value>", "Agent type sent to E10 authorize endpoint").option("--agent-type <value>", "Alias of --agent_type").option("--agent-return-url <url>", "Desktop application URL linked by the login success page");
-  command.action(action(async (ctx, options) => {
-    const result = await runBrowserLogin(ctx, options);
-    ctx.output.write(result, { text: formatLoginResult(result) });
-  }));
-}
-function registerXiaoELoginCommand(auth, action) {
-  auth.command("xiaoe").description("Use XiaoE unified login without browser OAuth fallback").option("--base-url <url>", "E10 base URL").option("--tenant-key <key>", "Tenant key fallback after login").option("--port <n>", "Deprecated compatibility option; ignored by XiaoE unified login", "19800").option("--agent_type <value>", "Deprecated compatibility option; ignored by XiaoE unified login").option("--agent-type <value>", "Alias of --agent_type").option("--agent-return-url <url>", "Deprecated compatibility option; ignored by XiaoE unified login").action(action(async (ctx, options) => {
-    const result = await runXiaoELogin(ctx, options);
-    ctx.output.write(result, { text: formatLoginResult(result) });
-  }));
-}
-function registerE10AuthCommands(parent, action) {
-  const auth = parent.command("auth").description("E10 auth and profile management");
-  auth.command("root").description("Print the E10 auth root directory").action(action((ctx) => {
-    const root = getE10AuthRoot();
-    ctx.output.write({ root }, { text: root });
-  }));
-  auth.command("status").description("Show E10 login status").option("--no-check", "skip remote session validity check").action(action(async (ctx, options) => {
-    const opts = ctx.getGlobalOptions();
-    const commandOpts = asOptions(options);
-    const authFile = findAuthFile(ctx.cwd, opts);
-    const session = authFile ? E10AuthSession.fromFile(authFile, opts.baseUrl, opts.passportUrl) : null;
-    const valid = session && commandOpts.check !== false ? session.isExpired() ? false : await session.checkValid() : void 0;
-    const status = session ? {
-      loggedIn: true,
-      userId: session.userId,
-      tenantKey: session.tenantKey,
-      tenantName: session.tenantName,
-      department: session.department,
-      subcompany: session.subcompany,
-      position: session.position,
-      version: session.version,
-      agentType: session.agentType,
-      baseUrl: session.getBaseUrl(),
-      passportUrl: session.getPassportUrl(),
-      profile: opts.profile || getActiveProfile(),
-      authFile,
-      hasEteamsId: Boolean(session.eteamsId),
-      ...session.loginSource ? { loginSource: session.loginSource } : {},
-      ...session.credentialSourceStep ? { credentialSourceStep: session.credentialSourceStep } : {},
-      ...session.credentialSourceType ? { credentialSourceType: session.credentialSourceType } : {},
-      ...session.credentialSourceLabel ? { credentialSourceLabel: session.credentialSourceLabel } : {},
-      ...session.expiryTimes ? { expiryTimes: session.expiryTimes } : {},
-      valid
-    } : {
-      loggedIn: false,
-      profile: opts.profile || getActiveProfile(),
-      authFile
-    };
-    ctx.output.write(status, { text: formatAuthStatus(status) });
-  }));
-  auth.command("set").description("Save E10 auth from an ETEAMSID cookie").requiredOption("--eteamsid <id>", "ETEAMSID cookie value").option("--base-url <url>", "E10 base URL").option("--passport-url <url>", "E10 passport URL; defaults to base URL").option("--tenant-key <key>", "Tenant key fallback").option("--agent_type <value>", "Agent type used in cookie and User-Agent").option("--agent-type <value>", "Alias of --agent_type").action(action(async (ctx, options) => {
-    const globalOptions = ctx.getGlobalOptions();
-    const commandOpts = asOptions(options);
-    const profileFromGlobal = globalOptions.profile;
-    const cfg = readProfileConfig(profileFromGlobal || getActiveProfile());
-    const baseUrl = normalizeUrl(optionString(commandOpts, "baseUrl") || globalOptions.baseUrl || cfg.baseUrl || "");
-    const passportUrl = normalizeUrl(optionString(commandOpts, "passportUrl") || globalOptions.passportUrl || cfg.passportUrl || baseUrl);
-    const tenantKeyFallback = optionString(commandOpts, "tenantKey");
-    const agentType = resolveAgentType(commandOpts, ctx.env);
-    const eteamsId = optionString(commandOpts, "eteamsid");
-    if (!baseUrl) throw new CliError("Missing --base-url", 2 /* UsageError */);
-    if (!eteamsId) throw new CliError("Missing --eteamsid", 2 /* UsageError */);
-    ctx.logger.info("Resolving E10 user information...");
-    const result = await saveEteamsIdLogin({
-      baseUrl,
-      passportUrl,
-      eteamsId,
-      tenantKeyFallback,
-      agentType,
-      profileHint: profileFromGlobal
-    });
-    ctx.output.write(result, { text: formatLoginResult(result) });
-  }));
-  registerBrowserLoginCommand(auth, action, "login", "Open browser OAuth2.0 login and save E10 auth");
-  registerBrowserLoginCommand(auth, action, "oidc", "Alias of auth login for OAuth2.0 browser login");
-  registerXiaoELoginCommand(auth, action);
-  auth.command("logout").alias("clear").description("Clear saved E10 auth for the current or selected profile").action(action(async (ctx) => {
-    const opts = ctx.getGlobalOptions();
-    const profile2 = opts.profile || getActiveProfile();
-    const authFile = getProfileAuthPath(profile2);
-    const session = E10AuthSession.fromFile(authFile, opts.baseUrl, opts.passportUrl);
-    if (session) {
-      await clearInvoiceTokenCache(profile2, {
-        baseUrl: session.getBaseUrl(),
-        userId: session.userId
-      });
-    }
-    const result = clearProfileAuthFile(profile2);
-    const text = result.cleared ? "Cleared E10 auth.\nprofile: " + result.profile + "\nauthFile: " + result.authFile : "No E10 auth to clear.\nprofile: " + result.profile + "\nauthFile: " + result.authFile;
-    ctx.output.write(result, { text });
-  }));
-  auth.command("whoami").description("Show cached or live E10 user information").option("--json", "print output as JSON").option("--live", "call teamsCheck for live user information").action(action(async (ctx, options) => {
-    const opts = ctx.getGlobalOptions();
-    const commandOpts = asOptions(options);
-    const json = commandOpts.json === true;
-    const live = commandOpts.live === true;
-    const authFile = findAuthFile(ctx.cwd, opts);
-    const session = authFile ? E10AuthSession.fromFile(authFile, opts.baseUrl, opts.passportUrl) : null;
-    if (!session || !session.eteamsId) throw new CliError("E10 auth not found.", 3 /* AuthError */);
-    const profile2 = opts.profile || getActiveProfile();
-    const cached = sessionToCachedUser(session, profile2);
-    if (!live) {
-      ctx.output.write(cached, {
-        json,
-        text: formatWhoami("Current E10 user (cached)", cached)
-      });
-      return;
+async function clearInvoiceTokenForSession(session) {
+  return createInvoiceTokenStore(session).clear();
+}
+function inferProfile(ctx) {
+  const options = ctx.getGlobalOptions();
+  return options.profile || getActiveProfile();
+}
+function trustedInvoiceHeaders(invoiceToken) {
+  return invoiceToken ? { token: invoiceToken } : {};
+}
+function createInvoiceHost(ctx, dependencies = {}) {
+  let e10Session = null;
+  let sessionContext = null;
+  let invoiceToken = null;
+  let tokenStore = null;
+  const requireSession = dependencies.requireSession || requireE10Session;
+  const tokenStoreFactory = dependencies.tokenStoreFactory || createInvoiceTokenStore;
+  async function ensureSession() {
+    if (!e10Session) {
+      e10Session = await requireSession(ctx);
+      sessionContext = {
+        baseUrl: e10Session.getBaseUrl(),
+        profile: inferProfile(ctx),
+        userId: e10Session.userId
+      };
     }
-    const base = session.getBaseUrl();
-    const resp = await fetch(`${base}/api/baseserver/layout/teamsCheck?clientType=not_xinchuang&client=WEB&domainName=${encodeURIComponent(base)}`, {
-      method: "POST",
-      headers: {
-        accept: "application/json",
-        "content-type": "application/json",
-        eteamsid: session.eteamsId,
-        cookie: session.cookieHeader(),
-        "user-agent": session.uaHeader(),
-        origin: base
-      },
-      redirect: "manual"
+    return e10Session;
+  }
+  async function getSession() {
+    await ensureSession();
+    return sessionContext;
+  }
+  async function ensureInvoiceToken(timeoutMs = 3e4) {
+    await ensureSession();
+    const context = await getSession();
+    tokenStore ||= tokenStoreFactory(context);
+    if (invoiceToken) return invoiceToken;
+    invoiceToken = await tokenStore.load();
+    if (invoiceToken) return invoiceToken;
+    const tokenResponse = await invoiceRequest({
+      method: "GET",
+      path: "/api/inc/proxy/getToken",
+      query: { appType: 1 },
+      needsInvoiceToken: false,
+      timeoutMs
     });
-    const raw = await resp.json().catch(() => ({}));
-    if (json || ctx.getGlobalOptions().json) {
-      ctx.output.write(raw, { json: true });
-      return;
-    }
-    const userInfo = readTeamsCheckUserInfo(resp, raw);
-    const liveData = {
-      ...cached,
-      employeeId: userInfo.userId || cached.employeeId,
-      tenantKey: userInfo.tenantKey || cached.tenantKey,
-      tenantName: userInfo.tenantName || cached.tenantName,
-      department: userInfo.department || cached.department,
-      subcompany: userInfo.subcompany || cached.subcompany,
-      position: userInfo.position || cached.position
-    };
-    ctx.output.write(liveData, { text: formatWhoami("Current E10 user (live)", liveData) });
-  }));
-  auth.command("export-weaver-env").description("Print WEAVER_* shell exports for the active E10 auth").option("--shell <shell>", "Shell syntax: auto, posix, or powershell", "auto").action(action(async (ctx, options) => {
-    const commandOpts = asOptions(options);
-    const session = await E10AuthSession.fromOptions(ctx.getGlobalOptions(), ctx.cwd);
-    if (!session) throw new CliError("E10 auth not found.", 3 /* AuthError */);
-    const value = {
-      WEAVER_BASE_URL: session.getBaseUrl(),
-      WEAVER_ETEAMSID: session.eteamsId,
-      WEAVER_COOKIE: session.cookieHeader(),
-      WEAVER_USER_AGENT: session.uaHeader(),
-      WEAVER_AGENT_TYPE: session.agentType
-    };
-    if (ctx.getGlobalOptions().json) {
-      ctx.output.write(value);
-      return;
+    const token = tokenResponse?.data?.token;
+    if (typeof token !== "string" || !token.trim()) {
+      throw invoiceAuthError("invoice_token_missing", "\u672A\u53D6\u5F97\u4E1A\u7968\u901A\u4E1A\u52A1 Token");
     }
-    const shell = optionString(commandOpts, "shell") || "auto";
-    ctx.output.raw(formatWeaverEnvExports(value, shell));
-  }));
-  const profile = auth.command("profile").description("Manage E10 profiles");
-  profile.command("list").description("List E10 profiles").action(action((ctx) => {
-    const active = getActiveProfile();
-    const profiles = listProfiles().map((name) => ({
-      name,
-      active: name === active,
-      dir: getProfileDir(name)
-    }));
-    ctx.output.write({ active, profiles });
-  }));
-  profile.command("use").description("Switch active E10 profile; creates it if missing").argument("<name>", "profile name").action(action((ctx, name) => {
-    if (typeof name !== "string") throw new CliError("profile name must be a string", 2 /* UsageError */);
-    switchActiveProfile(name);
-    const result = {
-      active: name,
-      dir: getProfileDir(name),
-      authFile: getProfileAuthPath(name)
-    };
-    ctx.output.write(result, { text: "Active E10 profile: " + name + "\ndir: " + result.dir });
-  }));
-  profile.command("current").description("Print active E10 profile").action(action((ctx) => {
-    const active = getActiveProfile();
-    ctx.output.write({ active, dir: getProfileDir(active) }, { text: active });
-  }));
-  return auth;
-}
-
-// src/cmd/e10/index.ts
-var e10Command = {
-  name: "e10",
-  description: "E10 platform adapter: auth, profiles, and shared API client",
-  category: "platform",
-  register({ program: program2, ctx, action }) {
-    registerE10AuthCommands(program2, action);
-    const e10 = program2.command("e10").description("E10 platform commands");
-    registerE10AuthCommands(e10, action);
-    ctx.hooks.register({
-      beforeRun(runCtx) {
-        const authFile = findAuthFile(runCtx.cwd);
-        const session = authFile ? E10AuthSession.fromFile(authFile) : null;
-        if (!session) return;
-        runCtx.env.WEAVER_BASE_URL ||= session.getBaseUrl();
-        runCtx.env.WEAVER_ETEAMSID ||= session.eteamsId;
-        runCtx.env.WEAVER_COOKIE ||= session.cookieHeader();
-        runCtx.env.WEAVER_USER_AGENT ||= session.uaHeader();
-        runCtx.env.WEAVER_AGENT_TYPE ||= session.agentType;
-      }
-    });
-  }
-};
-
-// src/cmd/refs/index.ts
-function parseDuration(value) {
-  const raw = value.trim().toLowerCase();
-  const matched = /^(\d+)\s*([dhms])?$/.exec(raw);
-  if (!matched) {
-    throw new CliError(`\u65E0\u6CD5\u89E3\u6790\u65F6\u957F\uFF1A${value}\uFF08\u793A\u4F8B\uFF1A7d\u300124h\u300130m\uFF09`, 2 /* UsageError */);
-  }
-  const amount = Number(matched[1]);
-  const unit = matched[2] ?? "ms";
-  const factor = unit === "d" ? 864e5 : unit === "h" ? 36e5 : unit === "m" ? 6e4 : 1;
-  return amount * factor;
-}
-function asOptions2(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-var refsCommand = {
-  name: "refs",
-  description: "Inspect and prune persisted large results",
-  category: "system",
-  register({ program: program2, action }) {
-    const refs = program2.command("refs").description("Manage persisted large results");
-    refs.command("path").description("Print the directory holding persisted results").action(action((ctx) => {
-      const path = refsDir(ctx);
-      ctx.output.write({ path }, { text: path });
-    }));
-    refs.command("list").description("List persisted results, newest first").action(action((ctx) => {
-      const now = Date.now();
-      const items = listRefs(ctx).filter((row) => Date.parse(row.expiresAt) > now).map((row) => ({
-        refId: row.refId,
-        operation: row.operation ?? null,
-        bytes: row.bytes,
-        createdAt: row.createdAt,
-        expiresAt: row.expiresAt
-      }));
-      ctx.output.write({ count: items.length, items });
-    }));
-    refs.command("show").description("Print one persisted result in full").argument("<refId>", "reference id").action(action((ctx, refId) => {
-      const id = String(refId ?? "").trim();
-      if (!id) throw new CliError("refId \u4E0D\u80FD\u4E3A\u7A7A", 2 /* UsageError */);
-      const record = readRef(ctx, id);
-      const configuredLimit = resultThresholdBytes(ctx);
-      const displayLimit = configuredLimit > 0 ? configuredLimit : DEFAULT_RESULT_THRESHOLD_BYTES;
-      if (bytesOf(record.envelope) > displayLimit) {
-        throw new CliError(
-          `\u7ED3\u679C\u592A\u5927\uFF0C\u4E0D\u80FD\u5B89\u5168\u5730\u4E00\u6B21\u663E\u793A\u3002\u8BF7\u7528 refs get ${id} <json-path> \u8BFB\u53D6\u9700\u8981\u7684\u5B57\u6BB5\u3002`,
-          2 /* UsageError */
-        );
-      }
-      ctx.output.write(record.envelope, { json: true, persist: false });
-    }));
-    refs.command("get").description("Print one value from a persisted result by JSON path").argument("<refId>", "reference id").argument("<path>", "JSON path, e.g. data.items[0].fid").action(action((ctx, refId, path) => {
-      const id = String(refId ?? "").trim();
-      const jsonPath = String(path ?? "").trim();
-      if (!id || !jsonPath) throw new CliError("refId \u548C JSON \u8DEF\u5F84\u4E0D\u80FD\u4E3A\u7A7A", 2 /* UsageError */);
-      const record = readRef(ctx, id);
-      ctx.output.write(pickValue(record.envelope, jsonPath));
-    }));
-    refs.command("prune").description("Prune persisted results").option("--older-than <duration>", "remove results created before this age, e.g. 7d").option("--all", "remove every persisted result").action(action((ctx, options) => {
-      const opts = asOptions2(options);
-      if (opts.all === true) {
-        const result2 = pruneRefs(ctx, { maxCount: 0, maxBytes: 0 });
-        ctx.output.write({
-          removed: result2.removed,
-          kept: result2.kept,
-          bytes: result2.bytes,
-          cleanupIncomplete: result2.cleanupIncomplete
-        });
-        return;
-      }
-      const olderThanMs = opts.olderThan ? parseDuration(String(opts.olderThan)) : void 0;
-      const result = pruneRefs(ctx, {
-        maxCount: refMaxCount(ctx),
-        maxBytes: refMaxBytes(ctx),
-        ...olderThanMs === void 0 ? {} : { olderThanMs }
-      });
-      ctx.output.write({
-        removed: result.removed,
-        kept: result.kept,
-        bytes: result.bytes,
-        cleanupIncomplete: result.cleanupIncomplete
-      });
-    }));
-  }
-};
-
-// src/cmd/run/index.ts
-import { resolve as resolve2 } from "node:path";
-
-// src/services/command-runner.ts
-import { spawn } from "node:child_process";
-var CommandRunner = class {
-  constructor(ctx) {
-    this.ctx = ctx;
-  }
-  ctx;
-  async run(command, args = [], options = {}) {
-    const runContext = {
-      cwd: options.cwd || this.ctx.cwd,
-      command,
-      args,
-      env: options.env || this.ctx.env,
-      shell: options.shell
-    };
-    await this.ctx.hooks.beforeRun(runContext);
-    const result = await new Promise((resolve8) => {
-      const child = spawn(command, args, {
-        cwd: runContext.cwd,
-        env: runContext.env,
-        shell: runContext.shell,
-        stdio: options.stdio === "inherit" ? "inherit" : "pipe"
-      });
-      const stdout = [];
-      const stderr = [];
-      if (child.stdout) child.stdout.on("data", (chunk) => stdout.push(chunk));
-      if (child.stderr) child.stderr.on("data", (chunk) => stderr.push(chunk));
-      child.on("close", (code, signal) => {
-        resolve8({
-          command,
-          args,
-          cwd: runContext.cwd,
-          code,
-          signal,
-          stdout: Buffer.concat(stdout).toString("utf-8"),
-          stderr: Buffer.concat(stderr).toString("utf-8")
-        });
-      });
-    });
-    await this.ctx.hooks.afterRun(runContext, result);
-    return result;
-  }
-};
-
-// src/cmd/run/index.ts
-var runCommand = {
-  name: "run",
-  description: "Generic external command runner with hooks",
-  category: "system",
-  register({ program: program2, action }) {
-    program2.command("run").description("Run an external command through the shared command runner").argument("<command>", "command to run").argument("[args...]", "command arguments").option("--cwd <dir>", "working directory").option("--shell", "run through the platform shell").option("--inherit", "inherit stdio instead of capturing output").allowUnknownOption(true).action(action(async (ctx, command, args, options) => {
-      if (typeof command !== "string") {
-        throw new CliError("command must be a string", 2 /* UsageError */);
-      }
-      const opts = options && typeof options === "object" ? options : {};
-      const result = await new CommandRunner(ctx).run(command, Array.isArray(args) ? args.map(String) : [], {
-        cwd: opts.cwd ? resolve2(opts.cwd) : void 0,
-        shell: opts.shell,
-        stdio: opts.inherit ? "inherit" : "pipe"
-      });
-      if (!opts.inherit && result.stdout) process.stdout.write(result.stdout);
-      if (!opts.inherit && result.stderr) process.stderr.write(result.stderr);
-      if (result.code && result.code !== 0) {
-        throw new CliError("command exited with code " + result.code, result.code);
-      }
-    }));
-  }
-};
-
-// src/cmd/setup/index.ts
-import { existsSync as existsSync4 } from "node:fs";
-
-// src/internal/skills/install.ts
-import { cpSync as cpSync2, existsSync as existsSync3, mkdirSync, readFileSync as readFileSync2, readdirSync as readdirSync2, statSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { basename, posix, relative, resolve as resolve3, sep, win32 } from "node:path";
-var SKILL_PREFIX = "weaver-e10-";
-var LEGACY_SKILL_PREFIX = "weaver-work-cli-";
-var SHARED_SKILL_NAME = "weaver-e10-shared";
-function envValue(env, name) {
-  const direct = env[name];
-  if (typeof direct === "string" && direct.trim()) return direct.trim();
-  const expected = name.toUpperCase();
-  for (const [key, value] of Object.entries(env)) {
-    if (key.toUpperCase() === expected && typeof value === "string" && value.trim()) return value.trim();
-  }
-  return "";
-}
-function hasEnvFamily(env, prefix, ignoredNames = []) {
-  const expected = `${prefix.toUpperCase()}_`;
-  const ignored = new Set(ignoredNames.map((name) => name.toUpperCase()));
-  return Object.entries(env).some(([key, value]) => key.toUpperCase().startsWith(expected) && !ignored.has(key.toUpperCase()) && typeof value === "string" && Boolean(value.trim()));
-}
-function normalizedAgentType(value) {
-  const normalized = value.trim().toLowerCase();
-  if (normalized === "codex-cli") return "codex";
-  if (normalized === "work-buddy") return "workbuddy";
-  return normalized || "unknown";
-}
-function isKnownSkillsHost(host) {
-  return host === "codex" || host === "workbuddy";
-}
-function resolveSkillsTargetPath(value, options = {}) {
-  const trimmed = value.trim();
-  if (!trimmed) throw new Error("skills target path must not be empty");
-  const platform = options.platform ?? process.platform;
-  const pathApi = platform === "win32" ? win32 : posix;
-  const userHome = options.homeDir ?? homedir();
-  if (trimmed === "~") return pathApi.resolve(userHome);
-  if (/^~[\\/]/u.test(trimmed)) {
-    const segments = trimmed.slice(2).split(/[\\/]+/u).filter(Boolean);
-    return pathApi.resolve(userHome, ...segments);
-  }
-  return pathApi.resolve(trimmed);
-}
-function hostSkillsRoot(host, env, options) {
-  const platform = options.platform ?? process.platform;
-  const pathApi = platform === "win32" ? win32 : posix;
-  const userHome = options.homeDir ?? homedir();
-  const envName = host === "codex" ? "CODEX_HOME" : "WORKBUDDY_HOME";
-  const configuredHome = envValue(env, envName);
-  const hostHome = configuredHome ? resolveSkillsTargetPath(configuredHome, options) : pathApi.resolve(userHome, host === "codex" ? ".codex" : ".workbuddy");
-  return pathApi.resolve(hostHome, "skills");
-}
-function detectSkillsHost(env = process.env) {
-  const explicitAgent = envValue(env, "WEAVER_AGENT_TYPE");
-  if (explicitAgent) return normalizedAgentType(explicitAgent);
-  const hasCodexRuntime = hasEnvFamily(env, "CODEX", ["CODEX_HOME"]);
-  const hasWorkBuddyRuntime = hasEnvFamily(env, "WORKBUDDY", ["WORKBUDDY_HOME"]);
-  if (hasCodexRuntime !== hasWorkBuddyRuntime) return hasCodexRuntime ? "codex" : "workbuddy";
-  const hasCodexHome = Boolean(envValue(env, "CODEX_HOME"));
-  const hasWorkBuddyHome = Boolean(envValue(env, "WORKBUDDY_HOME"));
-  if (hasCodexHome !== hasWorkBuddyHome) return hasCodexHome ? "codex" : "workbuddy";
-  return "unknown";
-}
-function resolveSkillsRoot(env = process.env, options = {}) {
-  const configuredRoot = envValue(env, "WEAVER_SKILLS_ROOT");
-  if (configuredRoot) {
-    const explicitAgent = envValue(env, "WEAVER_AGENT_TYPE");
-    const detectedHost = explicitAgent ? normalizedAgentType(explicitAgent) : detectSkillsHost(env);
-    return {
-      root: resolveSkillsTargetPath(configuredRoot, options),
-      host: detectedHost === "unknown" ? "explicit" : detectedHost,
-      source: "explicit-env",
-      environmentVariable: "WEAVER_SKILLS_ROOT"
-    };
-  }
-  const host = detectSkillsHost(env);
-  if (isKnownSkillsHost(host)) {
-    const environmentVariable = envValue(env, host === "codex" ? "CODEX_HOME" : "WORKBUDDY_HOME") ? host === "codex" ? "CODEX_HOME" : "WORKBUDDY_HOME" : void 0;
-    return {
-      root: hostSkillsRoot(host, env, options),
-      host,
-      source: environmentVariable ? "explicit-env" : "host-detected",
-      ...environmentVariable ? { environmentVariable } : {}
-    };
+    await tokenStore.save(token);
+    invoiceToken = token;
+    return token;
   }
-  const codexRoot = hostSkillsRoot("codex", env, options);
-  const workBuddyRoot = hostSkillsRoot("workbuddy", env, options);
-  const pathExists = options.pathExists ?? existsSync3;
-  if (host === "unknown") {
-    const existing = [
-      { root: codexRoot, host: "codex" },
-      { root: workBuddyRoot, host: "workbuddy" }
-    ].filter((candidate) => pathExists(candidate.root));
-    if (existing.length === 1) {
-      return { ...existing[0], source: "filesystem-detected" };
+  async function ensureContext(needsInvoiceToken, timeoutMs, path) {
+    await ensureSession();
+    const tokenEndpoint = path === "/api/inc/proxy/getToken" || path === "/api/app/inc/proxy/getToken";
+    if (tokenEndpoint) return void 0;
+    if (!needsInvoiceToken) {
     }
-    return {
-      root: codexRoot,
-      host,
-      source: "fallback",
-      requiresExplicitTarget: true,
-      reason: existing.length > 1 ? "ambiguous-host" : "unknown-host",
-      candidates: [codexRoot, workBuddyRoot]
-    };
-  }
-  return {
-    root: codexRoot,
-    host,
-    source: "fallback",
-    requiresExplicitTarget: true,
-    reason: "unsupported-host",
-    candidates: [codexRoot, workBuddyRoot]
-  };
-}
-function unresolvedSkillsRootMessage(resolution, targetOption = "--target-dir") {
-  const reason = resolution.reason === "ambiguous-host" ? "\u68C0\u6D4B\u5230\u591A\u4E2A\u53EF\u80FD\u7684\u5BBF\u4E3B\u76EE\u5F55" : resolution.reason === "unsupported-host" ? `\u68C0\u6D4B\u5230\u5F53\u524D\u667A\u80FD\u4F53 ${resolution.host}\uFF0C\u4F46\u4E0D\u77E5\u9053\u5B83\u7684 skills \u76EE\u5F55` : "\u672A\u68C0\u6D4B\u5230\u5F53\u524D\u667A\u80FD\u4F53\u53CA\u5176 skills \u76EE\u5F55";
-  return [
-    `${reason}\uFF0C\u4E3A\u907F\u514D\u88C5\u9519\u4F4D\u7F6E\uFF0C\u672C\u6B21\u672A\u6267\u884C\u5B89\u88C5\u3002`,
-    `\u8BF7\u4F7F\u7528 ${targetOption} <\u5F53\u524D\u667A\u80FD\u4F53\u7684 skills \u6839\u76EE\u5F55>\uFF0C\u6216\u8BBE\u7F6E WEAVER_SKILLS_ROOT \u540E\u91CD\u8BD5\u3002`,
-    ...resolution.candidates?.length ? [`\u5DF2\u77E5\u5019\u9009\u76EE\u5F55\uFF1A${resolution.candidates.join("\uFF0C")}`] : []
-  ].join("\n");
-}
-function normalizePackagedSkillName(value) {
-  const trimmed = value.trim();
-  if (!trimmed || trimmed === "all") return trimmed;
-  if (trimmed.includes("/") || trimmed.includes("\\") || trimmed === "." || trimmed === "..") {
-    throw new Error(`invalid skill name: ${value}`);
-  }
-  if (!/^[A-Za-z0-9._-]+$/u.test(trimmed)) {
-    throw new Error(`invalid skill name: ${value}`);
+    return ensureInvoiceToken(timeoutMs);
   }
-  if (trimmed.startsWith(LEGACY_SKILL_PREFIX)) {
-    return `${SKILL_PREFIX}${trimmed.slice(LEGACY_SKILL_PREFIX.length)}`;
+  async function clearCachedInvoiceToken() {
+    invoiceToken = null;
+    await tokenStore?.clear().catch(() => false);
   }
-  return trimmed.startsWith(SKILL_PREFIX) ? trimmed : `${SKILL_PREFIX}${trimmed}`;
-}
-function resolvePackagedSkillNames(sourceRoot, requested = "all") {
-  const available = readdirSync2(sourceRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && existsSync3(resolve3(sourceRoot, entry.name, "SKILL.md"))).map((entry) => entry.name).sort();
-  const normalized = normalizePackagedSkillName(requested);
-  if (!normalized || normalized === "all") return available;
-  if (!available.includes(normalized)) {
-    const shortName = normalized.slice(SKILL_PREFIX.length);
-    const suggestions = available.filter((name) => editDistance(shortName, name.replace(/^weaver-e10-/u, "")) <= 2);
-    throw new Error([
-      `unknown packaged skill: ${requested}`,
-      ...suggestions.length ? [`Did you mean: ${suggestions.join(", ")}?`] : [],
-      'Run "weaver-work-cli skills list" to see available skills.'
-    ].join("\n"));
+  async function runtime() {
+    return createE10RequestRuntime(ctx, await ensureSession(), {
+      interceptors: dependencies.interceptors,
+      fetch: dependencies.fetch
+    });
   }
-  const names = [];
-  if (normalized !== SHARED_SKILL_NAME && available.includes(SHARED_SKILL_NAME)) {
-    names.push(SHARED_SKILL_NAME);
+  function businessError(value) {
+    const code = responseCode(value);
+    return new InvoiceCliError("api", "business_error", responseMessage(value), {
+      code: String(code),
+      details: { ret: code },
+      exitCode: 1
+    });
   }
-  names.push(normalized);
-  return names;
-}
-function editDistance(left, right) {
-  let row = Array.from({ length: right.length + 1 }, (_, index) => index);
-  for (let i = 0; i < left.length; i += 1) {
-    const next = [i + 1];
-    for (let j = 0; j < right.length; j += 1) {
-      next.push(Math.min(next[j] + 1, row[j + 1] + 1, row[j] + (left[i] === right[j] ? 0 : 1)));
+  async function handleBusinessResponse(value, retry, canRetry) {
+    const code = responseCode(value);
+    if (code === void 0 || code === 0 || code === 200) return value;
+    if (isInvoiceSessionExpired(value)) {
+      await clearCachedInvoiceToken();
+      if (canRetry) return retry();
+      throw invoiceAuthError(
+        "invoice_session_expired",
+        `\u53D1\u7968\u4E1A\u52A1\u767B\u5F55\u6001\u5DF2\u5931\u6548\uFF0C\u5DF2\u6E05\u7406\u672C\u5730\u53D1\u7968 Token\u3002${E10_REAUTH_GUIDANCE}`,
+        { ret: code }
+      );
     }
-    row = next;
-  }
-  return row[right.length];
-}
-function installPackagedSkills(sourceRoot, targetRoot, requested = "all") {
-  const resolvedSourceRoot = resolve3(sourceRoot);
-  const resolvedTargetRoot = resolve3(targetRoot);
-  const skillNames = resolvePackagedSkillNames(resolvedSourceRoot, requested);
-  const productContent = productMetadataContent(resolvedSourceRoot);
-  mkdirSync(resolvedTargetRoot, { recursive: true, mode: 448 });
-  const installed = skillNames.map((name) => {
-    const source = resolveInside(resolvedSourceRoot, name);
-    const target = resolve3(resolvedTargetRoot, basename(name));
-    statSync(resolve3(source, "SKILL.md"));
-    cpSync2(source, target, {
-      recursive: true,
-      force: true,
-      filter: (entry) => shouldCopy(entry, source, Boolean(productContent))
+    throw businessError(value);
+  }
+  async function invoiceRequest(request, canRetryExpiredToken = true) {
+    const {
+      method = "POST",
+      path,
+      query,
+      headers,
+      body,
+      operation,
+      needsInvoiceToken = true,
+      timeoutMs = 3e4
+    } = request;
+    assertPath(path);
+    const token = await ensureContext(needsInvoiceToken, timeoutMs, path);
+    const response = await (await runtime()).requestJson({
+      module: "invoice",
+      operation,
+      method,
+      path,
+      query,
+      headers,
+      body,
+      timeoutMs,
+      trustedHeaders: trustedInvoiceHeaders(token)
     });
-    writeProductMetadata(target, productContent);
-    const current = {
-      name,
-      source,
-      target,
-      files: countFiles2(target)
-    };
-    return current;
-  });
-  return {
-    sourceRoot: resolvedSourceRoot,
-    targetRoot: resolvedTargetRoot,
-    skillNames,
-    installed
-  };
-}
-function productMetadataContent(sourceRoot) {
-  const productPath = productMetadataPath(sourceRoot);
-  if (!existsSync3(productPath)) return null;
-  const product = JSON.parse(readFileSync2(productPath, "utf8"));
-  const packageInfo = readPackageInfo(resolve3(sourceRoot, "..", "package.json"));
-  const metadata = {
-    schemaVersion: typeof product.schemaVersion === "number" ? product.schemaVersion : 1,
-    product: stringOrEmpty(product.product),
-    productVersion: stringOrEmpty(packageInfo?.version) || stringOrEmpty(product.productVersion),
-    packageName: stringOrEmpty(packageInfo?.name) || stringOrEmpty(product.packageName),
-    command: stringOrEmpty(product.command),
-    nodeEngine: stringOrEmpty(packageInfo?.engines?.node) || stringOrEmpty(product.nodeEngine)
-  };
-  if (metadata.product !== "weaver-work-cli" || metadata.packageName !== "weaver-work-cli" || metadata.command !== "weaver-work-cli" || !metadata.productVersion || !metadata.nodeEngine) {
-    throw new Error("skill-template/product.json or package.json is invalid for weaver-work-cli skills");
-  }
-  return `${JSON.stringify(metadata, null, 2)}
-`;
-}
-function productMetadataPath(sourceRoot) {
-  const templatePath = resolve3(sourceRoot, "..", "skill-template", "product.json");
-  if (existsSync3(templatePath)) return templatePath;
-  return resolve3(sourceRoot, "product.json");
-}
-function readPackageInfo(packagePath2) {
-  if (!existsSync3(packagePath2)) return null;
-  return JSON.parse(readFileSync2(packagePath2, "utf8"));
-}
-function stringOrEmpty(value) {
-  return typeof value === "string" ? value : "";
-}
-function writeProductMetadata(target, productContent) {
-  if (!productContent) return;
-  writeFileSync(resolve3(target, "product.json"), productContent, "utf8");
-}
-function shouldCopy(entry, sourceRoot, skipSkillProduct) {
-  const relativePath = relative(sourceRoot, entry);
-  const name = basename(entry);
-  if (!relativePath) return true;
-  if (skipSkillProduct && relativePath === "product.json") return false;
-  if (name === ".DS_Store" || name.startsWith(".")) return false;
-  const parts = relativePath.split(sep);
-  return !parts.includes("node_modules") && !parts.includes("scripts") && !parts.includes("assets");
-}
-function countFiles2(root) {
-  let count = 0;
-  for (const entry of readdirSync2(root, { withFileTypes: true })) {
-    const child = resolve3(root, entry.name);
-    if (entry.isDirectory()) count += countFiles2(child);
-    if (entry.isFile()) count += 1;
-  }
-  return count;
-}
-function resolveInside(base, subpath = "") {
-  if (subpath.startsWith("/") || subpath.split(/[\\/]/u).includes("..")) {
-    throw new Error(`invalid skill path: ${subpath}`);
-  }
-  const target = resolve3(base, subpath || ".");
-  const rel = relative(base, target);
-  if (rel === ".." || rel.startsWith(`..${sep}`)) {
-    throw new Error(`invalid skill path: ${subpath}`);
-  }
-  return target;
-}
-
-// src/cmd/setup/index.ts
-var SKILLS_DIR = packagePath("skills");
-function versionMajor2(version) {
-  return Number(version.replace(/^v/, "").split(".")[0] || 0);
-}
-var setupCommand = {
-  name: "setup",
-  description: "One-step setup checks for business shortcuts",
-  category: "system",
-  register({ program: program2, action }) {
-    const setup = program2.command("setup").description("One-step setup checks for business shortcuts");
-    setup.command("invoice").description("Check invoice CLI readiness and optionally install Agent skills").option("--install-skill", "install packaged invoice skill into the current Agent skills directory").option("--skill-target-dir <path>", "override target Agent skills directory").action(action((ctx, options) => {
-      const opts = options && typeof options === "object" ? options : {};
-      const authFile = findAuthFile(ctx.cwd, ctx.getGlobalOptions());
-      const packagedSkills = resolvePackagedSkillNames(SKILLS_DIR, "yepiaotong");
-      const checks = [
-        {
-          name: "node",
-          ok: versionMajor2(process.version) >= 18,
-          detail: process.version
-        },
-        {
-          name: "package",
-          ok: true,
-          detail: ctx.packageInfo.name + "@" + ctx.packageInfo.version
-        },
-        {
-          name: "invoiceSkillPackaged",
-          ok: packagedSkills.includes("weaver-e10-yepiaotong"),
-          detail: packagedSkills.join(", ")
-        },
-        {
-          name: "e10Auth",
-          ok: Boolean(authFile && existsSync4(authFile)),
-          detail: authFile || "not found"
-        }
-      ];
-      const specifiedSkillRoot = typeof opts.skillTargetDir === "string" && opts.skillTargetDir.trim() ? resolveSkillsTargetPath(opts.skillTargetDir) : "";
-      const skillResolution = opts.installSkill ? specifiedSkillRoot ? { root: specifiedSkillRoot, host: "explicit", source: "target-dir" } : resolveSkillsRoot(ctx.env) : null;
-      if (skillResolution?.requiresExplicitTarget) {
-        throw new CliError(
-          unresolvedSkillsRootMessage(skillResolution, "--skill-target-dir"),
-          2 /* UsageError */
-        );
+    if (isE10SessionExpiredResponse(response)) {
+      throw invoiceAuthError("session_expired", E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
+    }
+    if (response.parseError) {
+      if (response.status < 200 || response.status >= 300) {
+        throw new InvoiceCliError("api", "http_error", `\u6CDB\u5FAE\u63A5\u53E3 HTTP ${response.status}`, {
+          code: response.status,
+          details: { status: response.status },
+          exitCode: 1
+        });
       }
-      const skillInstall = skillResolution ? {
-        ...installPackagedSkills(SKILLS_DIR, skillResolution.root, "yepiaotong"),
-        skillsHost: skillResolution.host,
-        skillsRootSource: skillResolution.source,
-        warnings: skillResolution.source === "filesystem-detected" ? ["\u76EE\u6807\u76EE\u5F55\u4EC5\u6839\u636E\u672C\u673A\u5DF2\u6709\u76EE\u5F55\u63A8\u65AD\uFF1B\u5982\u4E0E\u5F53\u524D\u667A\u80FD\u4F53\u4E0D\u7B26\uFF0C\u8BF7\u663E\u5F0F\u6307\u5B9A\u3002"] : []
-      } : null;
-      const nextActions = [];
-      if (!checks.find((check) => check.name === "e10Auth")?.ok) {
-        nextActions.push("Authenticate using the method required by the current runtime, then rerun setup.");
-      }
-      if (!skillInstall) {
-        nextActions.push("Optional Agent setup: weaver-work-cli skills install yepiaotong");
-      }
-      nextActions.push("Verify invoice operations: weaver-work-cli invoice schema");
-      const ok = checks.every((check) => check.ok);
-      ctx.output.write({
-        ok,
-        module: "invoice",
-        checks,
-        skillInstall,
-        nextActions
-      }, {
-        text: [
-          ok ? "Invoice setup checks passed." : "Invoice setup needs attention.",
-          ...checks.map((check) => `- ${check.name}: ${check.ok ? "ok" : "missing"} (${check.detail})`),
-          ...skillInstall ? skillInstall.installed.map((entry) => `- installed skill: ${entry.name} -> ${entry.target}`) : [],
-          ...skillInstall ? skillInstall.warnings.map((warning) => `- warning: ${warning}`) : [],
-          "Next:",
-          ...nextActions.map((actionText) => `- ${actionText}`)
-        ].join("\n")
+      throw invoiceNetworkError("protocol", `\u63A5\u53E3\u8FD4\u56DE\u4E0D\u662F\u5408\u6CD5 JSON\uFF08HTTP ${response.status}\uFF09`, { retryable: false });
+    }
+    if (response.status < 200 || response.status >= 300) {
+      throw new InvoiceCliError("api", "http_error", `\u6CDB\u5FAE\u63A5\u53E3 HTTP ${response.status}`, {
+        code: response.status,
+        details: { status: response.status, message: responseMessage(response.value) },
+        exitCode: 1
       });
-    }));
-  }
-};
-
-// src/cmd/skills/index.ts
-import { existsSync as existsSync6 } from "node:fs";
-import { spawnSync } from "node:child_process";
-
-// src/internal/skills/detector.ts
-import { existsSync as existsSync5, readFileSync as readFileSync3 } from "node:fs";
-import { join, resolve as resolve4 } from "node:path";
-var PACKAGED_DETECTOR_VERSION = "1.0.13";
-var PACKAGED_DETECTOR_NAME = `weaver-skill-detector-${PACKAGED_DETECTOR_VERSION}`;
-function packagedDetectorDir() {
-  return packagePath("tools", PACKAGED_DETECTOR_NAME);
-}
-function detectorScriptPath(detectorDir) {
-  return join(detectorDir, "scripts", "validate_skill.py");
-}
-function legacySiblingDetectorDir() {
-  return resolve4(packagedDetectorDir(), "..", "..", "..", PACKAGED_DETECTOR_NAME);
-}
-function detectorVersion(detectorDir) {
-  let version = PACKAGED_DETECTOR_VERSION;
-  const metaPath = join(detectorDir, "_meta.json");
-  if (existsSync5(metaPath)) {
-    try {
-      const meta = JSON.parse(readFileSync3(metaPath, "utf8"));
-      if (typeof meta.version === "string" && meta.version) version = meta.version;
-    } catch {
-      version = PACKAGED_DETECTOR_VERSION;
     }
-  }
-  return version;
-}
-function resolveDetectorInfo(detectorDir) {
-  const candidates = detectorDir ? [resolve4(detectorDir)] : [packagedDetectorDir(), legacySiblingDetectorDir()].map((candidate) => resolve4(candidate));
-  for (const candidate of candidates) {
-    const scriptPath = detectorScriptPath(candidate);
-    if (existsSync5(scriptPath)) {
-      return { detectorDir: candidate, scriptPath, version: detectorVersion(candidate) };
+    let value = response.value;
+    if (request.rewriteJsonText && response.text) {
+      try {
+        value = JSON.parse(request.rewriteJsonText(response.text));
+      } catch {
+        value = response.value;
+      }
     }
-  }
-  throw new CliError(`weaver skill detector is not available; checked: ${candidates.map(detectorScriptPath).join(", ")}`, 2 /* UsageError */);
-}
-
-// src/internal/skills/reader.ts
-import { readFileSync as readFileSync4, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
-import { relative as relative2, resolve as resolve5, sep as sep2 } from "node:path";
-var SKILL_PREFIX2 = "weaver-e10-";
-var LEGACY_SKILL_PREFIX2 = "weaver-work-cli-";
-var SkillReader = class {
-  constructor(root) {
-    this.root = root;
-  }
-  root;
-  list() {
-    return readdirSync3(this.root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => this.skillInfo(entry.name)).filter((entry) => Boolean(entry)).sort((a, b) => a.name.localeCompare(b.name));
-  }
-  listPath(target) {
-    const { name, subpath } = splitTarget(target);
-    const skill = this.resolveSkill(name);
-    const skillRoot = skill.root;
-    const dir = this.resolveInside(skillRoot, subpath);
-    const info = statSync2(dir);
-    if (!info.isDirectory()) {
-      throw new Error(`path is a file, not a directory: ${target}`);
+    return handleBusinessResponse(value, () => invoiceRequest(request, false), canRetryExpiredToken && Boolean(token));
+  }
+  async function invoiceMultipartRequest(request, canRetryExpiredToken = true) {
+    const {
+      method = "POST",
+      path,
+      query,
+      fields = {},
+      file,
+      headers,
+      operation,
+      needsInvoiceToken = true,
+      timeoutMs = 3e4
+    } = request;
+    if (!file && !Object.values(fields).some((value) => value !== void 0 && value !== null && value !== "")) {
+      throw invoiceValidationError("input_invalid", "multipart \u8BF7\u6C42\u9700\u8981\u6587\u4EF6\u3001URL \u6216\u8868\u5355\u5B57\u6BB5");
     }
-    const listed = cleanOutputPath(skill.name, subpath);
-    const entries = readdirSync3(dir, { withFileTypes: true }).map((entry) => ({
-      path: cleanOutputPath(listed, entry.name),
-      isDir: entry.isDirectory()
-    })).sort((a, b) => a.path.localeCompare(b.path));
-    return { path: listed, entries };
-  }
-  read(target, pathArg = "") {
-    const split = splitTarget(target);
-    const skill = this.resolveSkill(split.name);
-    const subpath = pathArg || split.subpath || "SKILL.md";
-    const file = this.resolveInside(skill.root, subpath);
-    const info = statSync2(file);
-    if (info.isDirectory()) {
-      throw new Error(`path is a directory, not a file: ${cleanOutputPath(skill.name, subpath)}`);
+    assertPath(path);
+    const token = await ensureContext(needsInvoiceToken, timeoutMs, path);
+    const form = new FormData();
+    for (const [key, value] of Object.entries(fields)) {
+      if (value === void 0 || value === null) continue;
+      form.append(key, typeof value === "string" ? value : JSON.stringify(value));
     }
-    return {
-      skill: skill.name,
-      path: cleanOutputPath(subpath),
-      content: readFileSync4(file, "utf-8")
-    };
-  }
-  skillInfo(name) {
-    try {
-      const skillRoot = this.ensureSkill(name);
-      const content = readFileSync4(resolve5(skillRoot, "SKILL.md"), "utf-8");
-      const frontmatter = parseFrontmatter(content);
-      return {
-        name,
-        title: frontmatter.name,
-        description: frontmatter.description,
-        version: frontmatter.version
-      };
-    } catch {
-      return null;
+    if (file) {
+      const content = await readFile(file.path);
+      form.append("file", new Blob([content], { type: file.mimeType || "application/octet-stream" }), file.name);
     }
-  }
-  ensureSkill(name) {
-    return this.resolveSkill(name).root;
-  }
-  resolveSkill(name) {
-    if (!name || name.includes("/") || name.includes("\\") || name === "." || name === "..") {
-      throw new Error(`unknown skill: ${name}`);
+    const response = await (await runtime()).requestJson({
+      module: "invoice",
+      operation,
+      method,
+      path,
+      query,
+      headers,
+      formData: form,
+      timeoutMs,
+      trustedHeaders: trustedInvoiceHeaders(token)
+    });
+    if (isE10SessionExpiredResponse(response)) {
+      throw invoiceAuthError("session_expired", E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
     }
-    const skillRoot = this.resolveInside(this.root, name);
-    if (!existsDirectoryWithSkill(skillRoot)) {
-      const normalized = normalizeLegacySkillName(name);
-      if (normalized !== name) {
-        const normalizedRoot = this.resolveInside(this.root, normalized);
-        if (existsDirectoryWithSkill(normalizedRoot)) return { name: normalized, root: normalizedRoot };
-      }
+    if (response.parseError) {
+      throw invoiceNetworkError("protocol", `\u63A5\u53E3\u8FD4\u56DE\u4E0D\u662F\u5408\u6CD5 JSON\uFF08HTTP ${response.status}\uFF09`, { retryable: false });
     }
-    const info = statSync2(skillRoot);
-    if (!info.isDirectory()) throw new Error(`unknown skill: ${name}`);
-    statSync2(resolve5(skillRoot, "SKILL.md"));
-    return { name, root: skillRoot };
-  }
-  resolveInside(base, subpath = "") {
-    const cleaned = subpath.replace(/\\/g, "/");
-    if (cleaned.startsWith("/") || cleaned.split("/").includes("..")) {
-      throw new Error(`invalid skill path: ${subpath}`);
+    if (response.status < 200 || response.status >= 300) {
+      throw new InvoiceCliError("api", "http_error", `\u6CDB\u5FAE\u63A5\u53E3 HTTP ${response.status}`, {
+        code: response.status,
+        details: { status: response.status, message: responseMessage(response.value) },
+        exitCode: 1
+      });
     }
-    const target = resolve5(base, cleaned || ".");
-    const rel = relative2(base, target);
-    if (rel === ".." || rel.startsWith(`..${sep2}`) || resolve5(base) === target && cleaned === "..") {
-      throw new Error(`invalid skill path: ${subpath}`);
+    return handleBusinessResponse(response.value, () => invoiceMultipartRequest(request, false), canRetryExpiredToken && Boolean(token));
+  }
+  async function invoiceFormRequest(request, canRetryExpiredToken = true) {
+    const {
+      method = "POST",
+      path,
+      query,
+      fields = {},
+      operation,
+      needsInvoiceToken = true,
+      timeoutMs = 3e4
+    } = request;
+    assertPath(path);
+    const token = await ensureContext(needsInvoiceToken, timeoutMs, path);
+    const form = new URLSearchParams();
+    for (const [key, value] of Object.entries(fields)) {
+      if (value === void 0 || value === null) continue;
+      form.set(key, typeof value === "string" ? value : JSON.stringify(value));
     }
-    return target;
-  }
-};
-function normalizeLegacySkillName(name) {
-  return name.startsWith(LEGACY_SKILL_PREFIX2) ? `${SKILL_PREFIX2}${name.slice(LEGACY_SKILL_PREFIX2.length)}` : name;
-}
-function existsDirectoryWithSkill(skillRoot) {
-  try {
-    const info = statSync2(skillRoot);
-    if (!info.isDirectory()) return false;
-    statSync2(resolve5(skillRoot, "SKILL.md"));
-    return true;
-  } catch {
-    return false;
-  }
-}
-function splitTarget(target) {
-  const index = target.indexOf("/");
-  if (index === -1) return { name: target, subpath: "" };
-  return {
-    name: target.slice(0, index),
-    subpath: target.slice(index + 1)
-  };
-}
-function cleanOutputPath(...parts) {
-  return parts.filter(Boolean).join("/").replace(/\/+/g, "/").replace(/^\.\//, "");
-}
-function parseFrontmatter(content) {
-  const lines = content.split(/\r?\n/u);
-  if (lines[0] !== "---") return {};
-  const result = {};
-  for (let index = 1; index < lines.length; index += 1) {
-    const line = lines[index];
-    if (line === "---") return result;
-    const match = line.match(/^([A-Za-z][A-Za-z0-9_-]*):\s*(.*)$/u);
-    if (!match) continue;
-    result[match[1]] = match[2].replace(/^['"]|['"]$/g, "");
-  }
-  return {};
-}
-
-// src/cmd/skills/index.ts
-var SKILLS_DIR2 = packagePath("skills");
-function reader() {
-  if (!existsSync6(SKILLS_DIR2)) {
-    throw new CliError("skills directory does not exist: " + SKILLS_DIR2);
-  }
-  return new SkillReader(SKILLS_DIR2);
-}
-function commandOptions(value) {
-  if (!value || typeof value !== "object" || !("opts" in value)) return {};
-  const opts = value.opts();
-  return opts && typeof opts === "object" ? opts : {};
-}
-function describeRoot(resolution) {
-  if (resolution.source === "target-dir") return "\u7531 --target-dir \u6307\u5B9A";
-  if (resolution.source === "explicit-env") {
-    return `\u7531 ${resolution.environmentVariable || "\u5BBF\u4E3B\u73AF\u5883\u53D8\u91CF"} \u6307\u5B9A\uFF08${resolution.host}\uFF09`;
-  }
-  if (resolution.source === "host-detected") return `\u81EA\u52A8\u63A2\u6D4B\u5BBF\u4E3B ${resolution.host}`;
-  if (resolution.source === "filesystem-detected") return `\u7531\u672C\u673A\u552F\u4E00\u5DF2\u5B58\u5728\u7684\u5BBF\u4E3B\u76EE\u5F55\u63A8\u65AD\uFF08${resolution.host}\uFF09`;
-  return "\u65E0\u6CD5\u53EF\u9760\u5224\u65AD\u5BBF\u4E3B";
-}
-function pythonInvocation(opts) {
-  if (opts.python) return { command: opts.python, args: [] };
-  if (process.platform === "win32") return { command: "py", args: ["-3"] };
-  return { command: "python3", args: [] };
-}
-function detectorArgs(target, opts, globalJson) {
-  const args = [target];
-  if (opts.json || globalJson) args.push("--json");
-  if (opts.noHtml || opts.html === false) args.push("--no-html");
-  if (opts.out) args.push("--out", opts.out);
-  if (typeof opts.html === "string") args.push("--html", opts.html);
-  if (opts.platform) args.push("--platform", opts.platform);
-  if (opts.marketCatalog) args.push("--market-catalog", opts.marketCatalog);
-  if (opts.marketLive) args.push("--market-live");
-  return args;
-}
-var skillsCommand = {
-  name: "skills",
-  description: "Read packaged agent skill content",
-  category: "skills",
-  register({ program: program2, action }) {
-    const skills = program2.command("skills").description("Read packaged agent skill content");
-    skills.command("list").description("List skills, or list one layer under a skill path").argument("[target]", "skill name or name/path").option("--json", "accepted for symmetry; output is always JSON").action(action((ctx, target) => {
-      const skillReader = reader();
-      if (typeof target !== "string" || !target) {
-        const listed2 = skillReader.list();
-        ctx.output.write({ ok: true, skills: listed2, count: listed2.length }, { json: true });
-        return;
-      }
-      const listed = skillReader.listPath(target);
-      ctx.output.write({ ok: true, ...listed, count: listed.entries.length }, { json: true });
-    }));
-    skills.command("read").description("Print a skill SKILL.md or a file under the skill").argument("<target>", "skill name or name/path").argument("[path]", "path under the skill").option("--json", "output as a JSON envelope instead of raw markdown").action(action((ctx, target, pathArg, command) => {
-      if (typeof target !== "string") throw new CliError("target must be a string");
-      const opts = commandOptions(command || pathArg);
-      const result = reader().read(target, typeof pathArg === "string" ? pathArg : "");
-      if (opts.json || ctx.getGlobalOptions().json) {
-        ctx.output.write(result, { json: true });
-        return;
-      }
-      ctx.output.raw(result.content);
-    }));
-    skills.command("install").description("Install packaged skills into the current Agent skills directory").argument("[target]", "skill name (weaver-e10-* or legacy weaver-work-cli-*), short name such as skill-maker, or all", "all").option("--target-dir <path>", "override target skills directory").action(action((ctx, target, options) => {
-      const opts = options && typeof options === "object" ? options : {};
-      const specified = typeof opts.targetDir === "string" && opts.targetDir.trim() ? resolveSkillsTargetPath(opts.targetDir) : "";
-      const resolution = specified ? { root: specified, host: "explicit", source: "target-dir" } : resolveSkillsRoot(ctx.env);
-      if (resolution.requiresExplicitTarget) {
-        throw new CliError(unresolvedSkillsRootMessage(resolution), 2 /* UsageError */);
-      }
-      const targetRoot = resolution.root;
-      const result = installPackagedSkills(SKILLS_DIR2, targetRoot, typeof target === "string" ? target : "all");
-      const warnings = resolution.source === "filesystem-detected" ? ["\u63D0\u793A\uFF1A\u8BE5\u76EE\u5F55\u4EC5\u6839\u636E\u672C\u673A\u5DF2\u6709\u76EE\u5F55\u63A8\u65AD\uFF1B\u5982\u4E0E\u5F53\u524D\u667A\u80FD\u4F53\u4E0D\u7B26\uFF0C\u8BF7\u7528 --target-dir \u6216 WEAVER_SKILLS_ROOT \u6307\u5B9A\u3002"] : [];
-      ctx.output.write({
-        ...result,
-        targetRoot,
-        skillsHost: resolution.host,
-        skillsRootSource: resolution.source,
-        warnings
-      }, {
-        text: [
-          `Skills root: ${targetRoot}\uFF08${describeRoot(resolution)}\uFF09`,
-          "Installed packaged skills:",
-          ...result.installed.map((entry) => `- ${entry.name} -> ${entry.target}`),
-          ...warnings
-        ].join("\n")
+    const response = await (await runtime()).requestJson({
+      module: "invoice",
+      operation,
+      method,
+      path,
+      query,
+      form,
+      timeoutMs,
+      trustedHeaders: trustedInvoiceHeaders(token)
+    });
+    if (isE10SessionExpiredResponse(response)) {
+      throw invoiceAuthError("session_expired", E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
+    }
+    if (response.parseError) {
+      throw invoiceNetworkError("protocol", `\u63A5\u53E3\u8FD4\u56DE\u4E0D\u662F\u5408\u6CD5 JSON\uFF08HTTP ${response.status}\uFF09`, { retryable: false });
+    }
+    if (response.status < 200 || response.status >= 300) {
+      throw new InvoiceCliError("api", "http_error", `\u6CDB\u5FAE\u63A5\u53E3 HTTP ${response.status}`, {
+        code: response.status,
+        details: { status: response.status, message: responseMessage(response.value) },
+        exitCode: 1
       });
-    }));
-    skills.command("validate").description("Validate a generated skill using the packaged Weaver skill detector").argument("<target>", "skill directory, SKILL.md, or skill zip").option("--detector-dir <path>", "override detector directory; defaults to the packaged detector").option("--python <path>", "Python executable; defaults to python3, or py -3 on Windows").option("--json", "ask the detector to print JSON").option("--no-html", "disable detector HTML report output").option("--out <path>", "write detector markdown report").option("--html <path>", "write detector HTML report").option("--platform <platform>", "detector platform: weaver or qwenwork").option("--market-catalog <path>", "detector market catalog JSON").option("--market-live", "enable detector live market checks").action(action((ctx, target, options) => {
-      if (typeof target !== "string") throw new CliError("target must be a string");
-      const opts = options && typeof options === "object" ? options : {};
-      const detector = resolveDetectorInfo(opts.detectorDir);
-      const python = pythonInvocation(opts);
-      const child = spawnSync(python.command, [
-        ...python.args,
-        detector.scriptPath,
-        ...detectorArgs(target, opts, Boolean(ctx.getGlobalOptions().json))
-      ], { stdio: "inherit" });
-      if (child.error) throw new CliError(`failed to run Python detector: ${child.error.message}`);
-      if (typeof child.status === "number") {
-        process.exitCode = child.status;
-        return;
-      }
-      if (child.signal) throw new CliError(`detector terminated by signal: ${child.signal}`);
-      throw new CliError("detector exited without a status code");
-    }));
-  }
-};
-
-// src/cmd/index.ts
-var builtinCommands = [
-  configCommand,
-  docsCommand,
-  doctorCommand,
-  commandsCommand,
-  runCommand,
-  refsCommand,
-  e10Command,
-  setupCommand,
-  skillsCommand
-];
-
-// src/core/input.ts
-var FileInputPolicyError = class extends CliError {
-  type = "policy";
-  subtype = "file_input_denied";
-  retryable = false;
-  constructor() {
-    super(
-      "\u4E0D\u5141\u8BB8\u901A\u8FC7 --input <path> \u8BFB\u53D6 JSON \u6587\u4EF6\u3002\u8BF7\u6539\u7528 --input-json\u3001--input -\uFF0C\u6216\u7528 --input-ref \u4F20\u9012\u4E0A\u4E00\u6B65\u7684\u7ED3\u679C\u3002",
-      6 /* PolicyError */
-    );
-    this.name = "FileInputPolicyError";
-  }
-};
-function configuredPolicy(ctx) {
-  const io = ctx.config.get("io");
-  if (io && typeof io === "object" && !Array.isArray(io) && "fileInput" in io) {
-    return io.fileInput;
-  }
-  return ctx.config.get("io.fileInput");
-}
-function resolveFileInputPolicy(ctx, options) {
-  const allow = options.allowFileInput === true;
-  const deny = options.fileInput === false;
-  if (allow && deny) {
-    throw new CliError("\u4E0D\u80FD\u540C\u65F6\u4F20 --allow-file-input \u548C --no-file-input", 2 /* UsageError */);
-  }
-  if (allow) return "allow";
-  if (deny) return "deny";
-  const fromEnv = (ctx.env.WEAVER_WORK_CLI_FILE_INPUT ?? "").trim().toLowerCase();
-  if (fromEnv === "allow" || fromEnv === "warn" || fromEnv === "deny") return fromEnv;
-  const fromConfig = configuredPolicy(ctx);
-  if (fromConfig === "allow" || fromConfig === "warn" || fromConfig === "deny") return fromConfig;
-  return "warn";
-}
-function guardFileInput(ctx, options) {
-  const input = options.input;
-  if (input === void 0 || input === null || String(input).trim() === "" || input === "-") return;
-  const policy = resolveFileInputPolicy(ctx, options);
-  if (policy === "allow") return;
-  if (policy === "deny") throw new FileInputPolicyError();
-  process.stderr.write(
-    "[weaver-work-cli] \u4F7F\u7528 --input <path> \u8BFB\u53D6 JSON \u6587\u4EF6\uFF1B\u591A\u6B65\u4F20\u9012\u8BF7\u4F18\u5148\u7528 --input-ref\uFF0C\u7B80\u5355\u6570\u636E\u8BF7\u7528 --input-json\u3002\n"
-  );
-}
-
-// src/cmd/action.ts
-function commandFromArgs(args) {
-  const last = args[args.length - 1];
-  return last && typeof last === "object" && "name" in last && "opts" in last ? last : void 0;
-}
-function optionsHolderFrom(args) {
-  return args.find((arg) => Boolean(
-    arg && typeof arg === "object" && !Array.isArray(arg) && !("opts" in arg) && ("inputRef" in arg || "pick" in arg || "pickAs" in arg || "allowFileInput" in arg || "fileInput" in arg)
-  ));
-}
-function applyRefInput(ctx, args) {
-  const holder = optionsHolderFrom(args);
-  if (!holder) return;
-  const refId = String(holder.inputRef ?? "").trim();
-  if (!refId) {
-    if (holder.pick || holder.pickAs) {
-      throw new RefError("input_ref_required", "--pick \u548C --pick-as \u5FC5\u987B\u4E0E --input-ref \u4E00\u8D77\u4F7F\u7528");
     }
-    return;
-  }
-  if (holder.inputJson !== void 0 || holder.input !== void 0) {
-    throw new RefError("input_conflict", "\u4E0D\u80FD\u540C\u65F6\u4F20 --input-ref \u4E0E --input/--input-json");
-  }
-  const pick = holder.pick === void 0 || holder.pick === null || holder.pick === "" ? void 0 : String(holder.pick);
-  const pickAs = holder.pickAs === void 0 || holder.pickAs === null || holder.pickAs === "" ? void 0 : String(holder.pickAs);
-  holder.inputJson = JSON.stringify(resolveRefInput(ctx, {
-    refId,
-    ...pick ? { pick } : {},
-    ...pickAs ? { pickAs } : {}
-  }));
-  delete holder.inputRef;
-  delete holder.pick;
-  delete holder.pickAs;
-}
-function cleanupRefs(ctx) {
-  try {
-    pruneRefs(ctx, { maxCount: refMaxCount(ctx), maxBytes: refMaxBytes(ctx) });
-  } catch {
-    process.stderr.write("[weaver-work-cli] \u6682\u5B58\u7ED3\u679C\u6E05\u7406\u5931\u8D25\uFF1B\u672C\u6B21\u547D\u4EE4\u7EE7\u7EED\u6267\u884C\u3002\n");
-  }
-}
-function isRefsShow(command) {
-  const names = [];
-  let current = command;
-  while (current) {
-    const name = current.name();
-    if (name) names.unshift(name);
-    current = current.parent;
-  }
-  return names.slice(-2).join(" ") === "refs show";
-}
-function createAction(ctx) {
-  return (handler) => async (...args) => {
-    const commandCtx = ctx.forCommand(commandFromArgs(args));
-    try {
-      await commandCtx.hooks.beforeCommand(commandCtx);
-      applyRefInput(commandCtx, args);
-      const options = commandCtx.activeCommand?.opts();
-      if (options) guardFileInput(commandCtx, options);
-      if (!isRefsShow(commandCtx.activeCommand)) cleanupRefs(commandCtx);
-      const result = await handler(commandCtx, ...args);
-      await commandCtx.hooks.afterCommand(commandCtx, result);
-    } catch (error) {
-      await commandCtx.hooks.onError(commandCtx, error);
-      if (commandCtx.getGlobalOptions().json) {
-        console.error(JSON.stringify({
-          schemaVersion: 1,
-          ok: false,
-          error: toErrorEnvelope(error)
-        }, null, 2));
-        process.exitCode = isCliError(error) ? error.exitCode : 1 /* GeneralError */;
-        return;
-      }
-      if (isCliError(error)) {
-        commandCtx.logger.error(error.message);
-        process.exitCode = error.exitCode;
-        return;
-      }
-      const message = error instanceof Error ? error.message : String(error);
-      commandCtx.logger.error(message);
-      process.exitCode = 1 /* GeneralError */;
+    return handleBusinessResponse(response.value, () => invoiceFormRequest(request, false), canRetryExpiredToken && Boolean(token));
+  }
+  async function invoiceDownload({ id, fid, needLog = false, operation, timeoutMs = 3e4 }, canRetryExpiredToken = true) {
+    const token = await ensureContext(true, timeoutMs, "/api/inc/file/download");
+    const response = await (await runtime()).requestBinary({
+      module: "invoice",
+      operation,
+      method: "GET",
+      path: "/api/inc/file/download",
+      query: { id, fid, needLog },
+      headers: { Accept: "application/octet-stream, application/pdf, */*" },
+      timeoutMs,
+      trustedHeaders: trustedInvoiceHeaders(token)
+    });
+    if (isE10SessionExpiredResponse(response)) {
+      throw invoiceAuthError("session_expired", E10_SESSION_EXPIRED_MESSAGE, { httpStatus: response.status });
     }
-  };
-}
-
-// src/cmd/register.ts
-var IO_CHANNEL_OPTIONS = [
-  { flags: "--input-ref <ref>", description: "consume a persisted large result reference" },
-  { flags: "--pick <path>", description: "pick a sub path from --input-ref, e.g. items[0].fid" },
-  { flags: "--pick-as <field>", description: "map a scalar picked value to this input field, e.g. fid" },
-  { flags: "--allow-file-input", description: "allow reading JSON input from --input <path>" },
-  { flags: "--no-file-input", description: "reject JSON input from --input <path>" }
-];
-function ensureRefInputOptions(command) {
-  if (command.commands.length === 0) {
-    for (const option of IO_CHANNEL_OPTIONS) {
-      const long = option.flags.split(" ")[0];
-      if (!command.options.some((existing) => existing.long === long)) {
-        command.option(option.flags, option.description);
+    const contentType = response.contentType;
+    const declaredLength = Number(response.headers.get("content-length"));
+    if (Number.isFinite(declaredLength) && declaredLength > MAX_DOWNLOAD_BYTES) {
+      throw invoiceNetworkError("response_too_large", `\u4E0B\u8F7D\u6587\u4EF6\u8D85\u8FC7 ${MAX_DOWNLOAD_BYTES} \u5B57\u8282\u9650\u5236`, { retryable: false });
+    }
+    const content = response.content;
+    const looksLikeJson = /^[\s\r\n]*[\[{]/u.test(content.subarray(0, 64).toString("utf8"));
+    if (response.status < 200 || response.status >= 300 || contentType.includes("json") || looksLikeJson) {
+      let value = {};
+      try {
+        value = JSON.parse(content.toString("utf8"));
+      } catch {
+        value = {};
+      }
+      if (isInvoiceSessionExpired(value)) {
+        await clearCachedInvoiceToken();
+        if (canRetryExpiredToken && token) return invoiceDownload({ id, fid, needLog, operation, timeoutMs }, false);
+        throw invoiceAuthError(
+          "invoice_session_expired",
+          `\u53D1\u7968\u4E1A\u52A1\u767B\u5F55\u6001\u5DF2\u5931\u6548\uFF0C\u5DF2\u6E05\u7406\u672C\u5730\u53D1\u7968 Token\u3002${E10_REAUTH_GUIDANCE}`,
+          { ret: responseCode(value), status: response.status }
+        );
       }
+      throw new InvoiceCliError("api", "download_failed", responseMessage(value) || `\u4E0B\u8F7D\u5931\u8D25\uFF08HTTP ${response.status}\uFF09`, {
+        code: response.status,
+        details: { status: response.status, ret: responseCode(value) },
+        exitCode: 1
+      });
     }
-    return;
-  }
-  for (const child of command.commands) {
-    ensureRefInputOptions(child);
-  }
-}
-async function registerCommands(program2, ctx, commands) {
-  ctx.commands = commands.map((command) => ({
-    name: command.name,
-    description: command.description,
-    category: command.category
-  }));
-  ctx.modules = ctx.commands;
-  for (const command of commands) {
-    if (command.hooks) {
-      ctx.hooks.register(command.hooks);
+    if (!content.length) {
+      throw invoiceNetworkError("protocol", "\u4E0B\u8F7D\u63A5\u53E3\u8FD4\u56DE\u7A7A\u6587\u4EF6", { retryable: false });
     }
+    if (content.length > MAX_DOWNLOAD_BYTES) {
+      throw invoiceNetworkError("response_too_large", `\u4E0B\u8F7D\u6587\u4EF6\u8D85\u8FC7 ${MAX_DOWNLOAD_BYTES} \u5B57\u8282\u9650\u5236`, { retryable: false });
+    }
+    return { content, contentType };
   }
-  const action = createAction(ctx);
-  for (const command of commands) {
-    await command.register({ program: program2, ctx, action });
-  }
-  ensureRefInputOptions(program2);
+  return {
+    invoiceRequest,
+    invoiceMultipartRequest,
+    invoiceFormRequest,
+    invoiceDownload,
+    getSession,
+    invalidateToken() {
+      invoiceToken = null;
+      void clearCachedInvoiceToken();
+    }
+  };
 }
 
-// src/cmd/root.ts
-import { readFileSync as readFileSync6 } from "node:fs";
-
 // node_modules/commander/esm.mjs
 var import_index = __toESM(require_commander(), 1);
 var {
@@ -5412,187 +3769,14 @@ var {
   Help
 } = import_index.default;
 
-// src/core/context.ts
-import { homedir as homedir2 } from "node:os";
-import { resolve as resolve7 } from "node:path";
-
-// src/core/config-store.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname } from "node:path";
-var ConfigStore = class {
-  constructor(getPath) {
-    this.getPath = getPath;
-  }
-  getPath;
-  path() {
-    return this.getPath();
-  }
-  all() {
-    const filePath = this.path();
-    if (!existsSync7(filePath)) return {};
-    try {
-      const value = JSON.parse(readFileSync5(filePath, "utf-8"));
-      return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-    } catch {
-      return {};
-    }
-  }
-  get(key) {
-    return this.all()[key];
-  }
-  set(key, value) {
-    const data = this.all();
-    data[key] = value;
-    this.save(data);
-  }
-  delete(key) {
-    const data = this.all();
-    const existed = Object.prototype.hasOwnProperty.call(data, key);
-    delete data[key];
-    this.save(data);
-    return existed;
-  }
-  save(data) {
-    const filePath = this.path();
-    mkdirSync2(dirname(filePath), { recursive: true });
-    writeFileSync2(filePath, JSON.stringify(data, null, 2) + "\n", "utf-8");
-  }
-};
-
-// src/core/logger.ts
-var Logger = class {
-  constructor(getOptions) {
-    this.getOptions = getOptions;
-  }
-  getOptions;
-  info(message) {
-    const opts = this.getOptions();
-    if (!opts.quiet && !opts.json) {
-      console.log(message);
-    }
-  }
-  warn(message) {
-    const opts = this.getOptions();
-    if (!opts.quiet && !opts.json) {
-      console.warn(message);
-    }
-  }
-  error(message) {
-    console.error(message);
-  }
-  debug(message) {
-    const opts = this.getOptions();
-    if (opts.verbose && !opts.json) {
-      console.error("[debug] " + message);
-    }
-  }
-};
-
-// src/core/context.ts
-function createCliContext(program2, hooks, packageInfo) {
-  const getGlobalOptions = () => normalizeGlobalOptions(program2.opts());
-  const configStore = new ConfigStore(() => {
-    const opts = getGlobalOptions();
-    const home = process.env.WEAVER_WORK_CLI_HOME || process.env.WORK_CLI_HOME || resolve7(homedir2(), ".weaver-work-cli");
-    return opts.config ? resolve7(opts.config) : resolve7(home, "config.json");
-  });
-  const partialCtx = {
-    cwd: process.cwd(),
-    env: process.env,
-    program: program2,
-    hooks,
-    packageInfo,
-    commands: [],
-    modules: [],
-    getGlobalOptions,
-    forCommand(command) {
-      return { ...ctx, activeCommand: command };
-    }
-  };
-  const ctx = partialCtx;
-  ctx.logger = new Logger(getGlobalOptions);
-  ctx.output = new Output(ctx);
-  ctx.config = configStore;
-  return ctx;
-}
-
-// src/core/hooks.ts
-var HookManager = class {
-  hooks = {
-    beforeCommand: [],
-    afterCommand: [],
-    onError: [],
-    beforeRun: [],
-    afterRun: []
-  };
-  e10RequestInterceptors = [];
-  register(hooks) {
-    for (const [name, handler] of Object.entries(hooks)) {
-      if (handler) {
-        this.hooks[name].push(handler);
-      }
-    }
-  }
-  async beforeCommand(ctx) {
-    for (const hook of this.hooks.beforeCommand) {
-      await hook(ctx);
-    }
-  }
-  async afterCommand(ctx, result) {
-    for (const hook of this.hooks.afterCommand) {
-      await hook(ctx, result);
-    }
-  }
-  async onError(ctx, error) {
-    for (const hook of this.hooks.onError) {
-      await hook(ctx, error);
-    }
-  }
-  async beforeRun(ctx) {
-    for (const hook of this.hooks.beforeRun) {
-      await hook(ctx);
-    }
-  }
-  async afterRun(ctx, result) {
-    for (const hook of this.hooks.afterRun) {
-      await hook(ctx, result);
-    }
-  }
-  registerE10RequestInterceptor(interceptor) {
-    this.e10RequestInterceptors.push(interceptor);
-  }
-  getE10RequestInterceptors() {
-    return this.e10RequestInterceptors;
-  }
-};
-
-// src/cmd/root.ts
-var CLI_COMMAND_NAME = "weaver-work-cli";
-function readPackageInfo2() {
-  const pkg = JSON.parse(readFileSync6(packagePath("package.json"), "utf-8"));
-  return {
-    name: pkg.name || CLI_COMMAND_NAME,
-    version: pkg.version || "0.0.0",
-    description: pkg.description
-  };
-}
-function createProgram() {
-  const packageInfo = readPackageInfo2();
-  const program2 = new Command();
-  const hooks = new HookManager();
-  const ctx = createCliContext(program2, hooks, packageInfo);
-  program2.name(CLI_COMMAND_NAME).description(packageInfo.description || "Extensible TypeScript CLI").version(packageInfo.version).option("--json", "print command output as JSON").option("--quiet", "suppress non-error logs").option("--verbose", "print debug logs").option("--config <path>", "use a custom weaver-work-cli config file").option("--auth <path>", "use a specific E10 auth file").option("--profile <name>", "use a specific E10 profile").option("--runtime-agent <name>", "identify the current agent runtime (for example: xiaoe)").option(
-    "--is-connector [value]",
-    "run as the WorkBuddy connector: use the fixed E10 profile managed by the connector"
-  ).option("--base-url <url>", "override E10 base URL").option("--passport-url <url>", "override E10 passport URL");
-  program2.showHelpAfterError();
-  return { program: program2, ctx };
-}
-
 export {
-  firstPositionalToken,
-  toCommandMetadata,
-  builtinCommands,
-  registerCommands,
-  createProgram
+  InvoiceCliError,
+  invoiceValidationError,
+  invoiceConfirmationError,
+  invoicePartialError,
+  isInvoiceNetworkError,
+  clearInvoiceTokenForSession,
+  createInvoiceHost,
+  Command,
+  Option
 };