weaver-work-cli 0.1.7 → 0.1.20

package/dist/shortcuts/blog/operations/remind.js

@@ -0,0 +1,176 @@
+import { blogConfirmationError, blogPartialError, blogValidationError, isBlogNetworkError } from '../errors.js';
+import { asDate, asInteger, objectFingerprint, remindContent, remindYear, searchUsersByName, sessionMatches, } from './shared.js';
+import { workflow } from './types.js';
+const MAX_TARGETS = 50;
+/** user_ids（数组或逗号分隔字符串）与 names（经 HRM 解析）二选一 */
+async function resolveRemindTargets(input, host) {
+    if (input.user_ids !== undefined && input.names !== undefined) {
+        throw blogValidationError('input_ambiguous', 'user_ids 与 names 只能提供一个');
+    }
+    if (input.user_ids !== undefined) {
+        const raw = typeof input.user_ids === 'string'
+            ? input.user_ids.split(',').map((item) => item.trim()).filter(Boolean)
+            : input.user_ids;
+        if (!Array.isArray(raw) || raw.length === 0) {
+            throw blogValidationError('input_invalid', 'user_ids 必须是非空数组或逗号分隔字符串');
+        }
+        if (raw.length > MAX_TARGETS)
+            throw blogValidationError('input_invalid', `user_ids 单次最多 ${MAX_TARGETS} 人`);
+        return raw.map((item, index) => {
+            const id = String(item);
+            if (!/^[1-9]\d*$/u.test(id)) {
+                throw blogValidationError('input_invalid', `user_ids[${index}] 必须是正整数文本`);
+            }
+            return { user_id: id, name: null };
+        });
+    }
+    if (input.names !== undefined) {
+        const raw = input.names;
+        if (!Array.isArray(raw) || raw.length === 0) {
+            throw blogValidationError('input_invalid', 'names 必须是非空字符串数组');
+        }
+        if (raw.length > MAX_TARGETS)
+            throw blogValidationError('input_invalid', `names 单次最多 ${MAX_TARGETS} 人`);
+        const targets = [];
+        for (const item of raw) {
+            const name = typeof item === 'string' ? item.trim() : '';
+            if (!name)
+                throw blogValidationError('input_invalid', 'names 不能包含空值');
+            const users = await searchUsersByName(host, name);
+            if (users.length === 0)
+                throw blogValidationError('name_not_found', `未找到名为「${name}」的员工`);
+            if (users.length > 1) {
+                throw blogValidationError('name_ambiguous', `「${name}」命中 ${users.length} 名员工，请改用 user_ids 指定`, { candidates: users });
+            }
+            targets.push({ user_id: users[0].id, name: users[0].name });
+        }
+        return targets;
+    }
+    throw blogValidationError('input_invalid', 'user_ids 与 names 必须提供一个');
+}
+/** 自定义文案自检：必须出现「日」，避免提醒指向错误周期；缺省时使用默认文案 */
+function normalizeCustomContent(content, date) {
+    if (content === undefined || content === null)
+        return undefined;
+    const text = typeof content === 'string' ? content.trim() : '';
+    if (!text)
+        return undefined;
+    if (!/日/u.test(text)) {
+        throw blogValidationError('input_invalid', `自定义提醒文案应包含具体日期，例如「${remindContent(date)}」；或省略 content 使用默认文案`);
+    }
+    return text;
+}
+/** 提醒 prepare：解析被提醒人 + 生成默认文案 + 签发 continuation（不发送） */
+export class BlogRemindPrepareOperation {
+    name = 'blog.remind.prepare';
+    async execute(input, { host, continuation }) {
+        const date = asDate(input.date, 'date');
+        const targets = await resolveRemindTargets(input, host);
+        const custom = normalizeCustomContent(input.content, date);
+        const content = custom ?? remindContent(date);
+        const year = asInteger(input.year, 'year', { min: 2000, max: 2100, dflt: remindYear(date) });
+        const session = await host.getSession();
+        const continuationToken = await continuation.issue({
+            operation: 'blog.remind.apply',
+            workflow: workflow('blog.remind', 'AWAITING_CONFIRMATION'),
+            baseUrl: session.baseUrl,
+            profile: session.profile,
+            userId: session.userId,
+            date,
+            content,
+            year,
+            targets,
+            fingerprint: objectFingerprint({ date, content, year, targets }),
+        });
+        return {
+            status: 'AWAITING_CONFIRMATION',
+            data: {
+                targets: targets.map((target) => ({ user_id: target.user_id, name: target.name })),
+                date,
+                content,
+                year,
+                continuation: continuationToken,
+                expires_in_seconds: 600,
+                workflow: workflow('blog.remind', 'AWAITING_CONFIRMATION'),
+                next: '向用户复述被提醒人与文案，用户确认后调用 blog.remind.apply 并传 confirm=true',
+            },
+        };
+    }
+}
+/** 提醒 apply：逐人 POST sendUrge；部分失败返回 PARTIAL，中断返回 partial/write_uncertain */
+export class BlogRemindApplyOperation {
+    name = 'blog.remind.apply';
+    async execute(input, { host, continuation }) {
+        if (input.confirm !== true) {
+            throw blogConfirmationError('blog.remind.apply', { hint: '重新调用时传入 confirm=true' });
+        }
+        const lease = await continuation.verify(input.continuation, 'blog.remind.apply');
+        if (!Array.isArray(lease.targets) || lease.targets.length === 0 || typeof lease.content !== 'string') {
+            throw blogValidationError('continuation_invalid', '提醒 continuation 缺少有效目标或文案');
+        }
+        const session = await host.getSession();
+        if (!sessionMatches(lease, session)) {
+            throw blogValidationError('context_mismatch', '确认上下文已变化，请重新准备提醒');
+        }
+        if (objectFingerprint({ date: lease.date, content: lease.content, year: lease.year, targets: lease.targets }) !== lease.fingerprint) {
+            throw blogValidationError('continuation_invalid', '提醒 continuation 指纹校验失败');
+        }
+        const succeeded = [];
+        const failed = [];
+        // 多人逐个 POST；已发送后中断不自动重试，返回 partial
+        for (const target of lease.targets) {
+            try {
+                await host.blogRequest({
+                    path: '/api/blog/message/sendUrge',
+                    body: {
+                        checkStr: '',
+                        content: lease.content,
+                        definiteType: 'blog',
+                        ids: target.user_id,
+                        targetId: null,
+                        type: 'blog',
+                        year: lease.year,
+                    },
+                    operation: 'blog.remind.apply',
+                });
+                succeeded.push({ user_id: target.user_id, name: target.name });
+            }
+            catch (error) {
+                failed.push({
+                    user_id: target.user_id,
+                    name: target.name,
+                    message: error instanceof Error ? error.message : String(error),
+                });
+                if (isBlogNetworkError(error)) {
+                    throw blogPartialError('提醒发送过程中连接中断，结果不确定，禁止自动重试', {
+                        succeeded,
+                        failed,
+                        workflow: workflow('blog.remind', 'EXECUTING'),
+                    }, { stage: 'urge' });
+                }
+            }
+        }
+        if (failed.length > 0) {
+            return {
+                status: 'PARTIAL',
+                data: {
+                    content: lease.content,
+                    date: lease.date,
+                    succeeded,
+                    failed,
+                    workflow: workflow('blog.remind', failed.length === lease.targets.length ? 'FAILED' : 'PARTIAL_COMPLETE'),
+                },
+            };
+        }
+        return {
+            status: 'COMPLETE',
+            data: {
+                content: lease.content,
+                date: lease.date,
+                succeeded,
+                failed,
+                workflow: workflow('blog.remind', 'COMPLETE'),
+            },
+        };
+    }
+}

package/dist/shortcuts/blog/operations/shared.js

@@ -0,0 +1,330 @@
+import { createHash } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { stat, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { blogValidationError } from '../errors.js';
+const DATE_PATTERN = /^\d{4}-\d{2}-\d{2}$/u;
+/** 单人日报逐日扫描（detailsByDate）的区间上限，防止一次调用打爆接口 */
+export const MAX_RANGE_DAYS = 62;
+const FORBIDDEN_INPUT_KEYS = new Set([
+    'access_token',
+    'app_key',
+    'app_secret',
+    'cookie',
+    'eteamsid',
+    'token',
+    'authorization',
+]);
+const FORBIDDEN_NORMALIZED_KEYS = new Set([...FORBIDDEN_INPUT_KEYS].map((key) => key.toLowerCase()));
+export const USER_TYPES = ['directSubordinate', 'indirectSubordinate', 'allSubordinate', 'myFollow'];
+export function asObject(value, name = '业务输入') {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw blogValidationError('input_invalid', `${name}必须是 JSON 对象`);
+    }
+    return value;
+}
+export function asNonEmptyString(value, name) {
+    if (typeof value !== 'string' || !value.trim()) {
+        throw blogValidationError('input_invalid', `${name} 必须是非空字符串`);
+    }
+    return value.trim();
+}
+export function asPositiveString(value, name) {
+    if (typeof value !== 'string' || !/^\d+$/u.test(value) || value === '0') {
+        throw blogValidationError('input_invalid', `${name} 必须是正整数文本`);
+    }
+    return value;
+}
+export function asInteger(value, name, options) {
+    const { min, max, dflt } = options;
+    if (value === undefined || value === null || value === '') {
+        if (dflt !== undefined)
+            return dflt;
+        throw blogValidationError('input_invalid', `${name} 必须是整数`);
+    }
+    const parsed = typeof value === 'number' ? value : Number(value);
+    if (!Number.isInteger(parsed) || parsed < min || parsed > max) {
+        throw blogValidationError('input_invalid', `${name} 必须是 ${min}~${max} 的整数`);
+    }
+    return parsed;
+}
+export function asDate(value, name) {
+    const text = typeof value === 'string' ? value.trim() : '';
+    if (!DATE_PATTERN.test(text) || Number.isNaN(Date.parse(`${text}T00:00:00+08:00`))) {
+        throw blogValidationError('input_invalid', `${name} 必须是 YYYY-MM-DD 格式日期`);
+    }
+    return text;
+}
+export function normalizeUserType(value) {
+    if (typeof value !== 'string' || !USER_TYPES.includes(value.trim())) {
+        throw blogValidationError('input_invalid', `user_type 必须是 ${USER_TYPES.join(' | ')} 之一`);
+    }
+    return value.trim();
+}
+/** 认证凭据禁止出现在业务输入中（CLI 全权托管 Cookie / ETEAMSID / Token） */
+export function assertNoForbiddenKeys(value, location = 'input') {
+    if (!value || typeof value !== 'object')
+        return;
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => assertNoForbiddenKeys(item, `${location}[${index}]`));
+        return;
+    }
+    for (const [key, child] of Object.entries(value)) {
+        if (FORBIDDEN_INPUT_KEYS.has(key) || FORBIDDEN_NORMALIZED_KEYS.has(key.toLowerCase())) {
+            throw blogValidationError('field_forbidden', `禁止业务输入字段：${location}.${key}`);
+        }
+        assertNoForbiddenKeys(child, `${location}.${key}`);
+    }
+}
+function pad(n) {
+    return String(n).padStart(2, '0');
+}
+/** E10 日报日期是本地时区 0 点的 Unix 毫秒；必须按本地时区格式化，用 toISOString 会差一天 */
+export function localDateStr(ms) {
+    const d = new Date(ms);
+    return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
+}
+export function localDateTimeStr(ms) {
+    const d = new Date(ms);
+    return `${localDateStr(ms)} ${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}`;
+}
+export function dateRange(startInput, endInput, startName = 'start_date', endName = 'end_date') {
+    const start = asDate(startInput, startName);
+    const end = asDate(endInput, endName);
+    const days = [];
+    for (let d = new Date(`${start}T00:00:00`); d <= new Date(`${end}T00:00:00`); d.setDate(d.getDate() + 1)) {
+        days.push(`${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`);
+    }
+    if (days.length === 0)
+        throw blogValidationError('input_invalid', `${startName} 不能晚于 ${endName}`);
+    if (days.length > MAX_RANGE_DAYS) {
+        throw blogValidationError('range_too_large', `日期区间共 ${days.length} 天，超过 ${MAX_RANGE_DAYS} 天上限；请缩小范围后重试`);
+    }
+    return days;
+}
+/** 提醒默认文案（固定以「请填写」开头，日期与 date 入参一致） */
+export function remindContent(date) {
+    const d = new Date(`${date}T00:00:00`);
+    return `请填写 ${d.getFullYear()}年 ${d.getMonth() + 1}月 ${d.getDate()}日 的日报！`;
+}
+export function remindYear(date) {
+    return new Date(`${date}T00:00:00`).getFullYear();
+}
+export function htmlToText(html) {
+    return html.replace(/<[^>]+>/g, '').trim();
+}
+/** 纯文本自动包裹 <p>；HTML 原样保留 */
+export function ensureHtml(content) {
+    return /^\s*</u.test(content) ? content : `<p>${content}</p>`;
+}
+function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    if (value && typeof value === 'object') {
+        return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+/** 业务对象指纹：canonical JSON 的 sha256，用于 prepare/apply 之间的目标一致性校验 */
+export function objectFingerprint(value) {
+    return createHash('sha256').update(canonicalJson(value)).digest('hex');
+}
+export function sessionMatches(lease, session) {
+    return lease.baseUrl === session.baseUrl
+        && (lease.profile ?? '') === (session.profile ?? '')
+        && lease.userId === session.userId;
+}
+/** detailsByDate 原始响应无 found 字段，且无日报时返回空壳 blog 对象 —— 判定看 blog.id */
+export function detailsFound(value) {
+    return Boolean(value?.blog && typeof value.blog === 'object' && value.blog.id);
+}
+/** 补交判定统一用 createTime vs blogTime 是否同日（blogs 接口的 later 字段不可靠） */
+export function submitStatus(blog) {
+    if (blog.create_time === null || blog.blog_time === null)
+        return '补交';
+    return localDateStr(blog.create_time) === localDateStr(blog.blog_time) ? '正常' : '补交';
+}
+export function normalizeBlog(raw) {
+    if (!raw || typeof raw !== 'object' || !raw.id)
+        return null;
+    const createTime = typeof raw.createTime === 'number' ? raw.createTime : null;
+    const blogTime = typeof raw.blogTime === 'number' ? raw.blogTime : null;
+    const content = typeof raw.content === 'string' ? raw.content : '';
+    return {
+        id: String(raw.id),
+        create_time: createTime,
+        create_time_str: createTime === null ? null : localDateTimeStr(createTime),
+        blog_time: blogTime,
+        blog_time_str: blogTime === null ? null : localDateStr(blogTime),
+        content,
+        content_text: htmlToText(content),
+        comment_count: typeof raw.commentCount === 'number' ? raw.commentCount : null,
+        praise_count: typeof raw.praiseCount === 'number' ? raw.praiseCount : null,
+        later: typeof raw.later === 'number' ? raw.later : null,
+    };
+}
+/** blogs 接口返回每人每天一行；未提交的日子是空占位行（blog 为空/无 id） */
+export function normalizeBlogListItem(item) {
+    if (!item || typeof item !== 'object')
+        return null;
+    const date = typeof item.date === 'number' ? item.date : Number(item.date);
+    if (!Number.isFinite(date))
+        return null;
+    const userId = String(item.user?.id ?? '');
+    const username = String(item.user?.username ?? item.user?.name ?? '');
+    const blog = normalizeBlog(item.blog);
+    return {
+        date,
+        date_str: localDateStr(date),
+        user_id: userId,
+        username,
+        blog,
+        submitted: Boolean(blog),
+        submit_status: blog ? submitStatus(blog) : '未提交',
+    };
+}
+/**
+ * HRM 人员搜索（body 为实测必填模板，缺字段会返回 0 行）。
+ * 关键：结果取 `id` 字段，不是 `userid` —— E10 业务接口对 `userid` 全部报 unknowUser。
+ */
+export async function searchUsersByName(host, name) {
+    const body = {
+        browserMultiple: true,
+        authWecahtBook: false,
+        wxDepNeedConvertCount: 0,
+        wxEmpNeedConvertCount: 0,
+        wxTotalNeedConvertCount: 0,
+        cmd: 'all',
+        current: 1,
+        pageSize: 30,
+        formDatas: {
+            username: [{ usernameOpt: 'eq', usernameInput: name }],
+            status: [{ statusSelect: ['normal'] }],
+            subcompany: [{ subcompanyOpt: 'in' }],
+            department: [{ departmentOpt: 'in' }],
+            role: [{ roleOpt: 'in' }],
+            position: [{ positionOpt: 'in' }],
+            superior: [{ superiorOpt: 'in' }],
+        },
+        quickSearchDatas: {},
+        type: 'and',
+        containsNoneAccount: false,
+        containsPartTimeEmployee: false,
+    };
+    const countResp = await host.blogRequest({ path: '/api/hrm/common/browser/count/resource', body, operation: 'blog.resolve_users' });
+    const total = countResp?.data?.total ?? 0;
+    if (!total)
+        return [];
+    const dataResp = await host.blogRequest({ path: '/api/hrm/common/browser/data/resource', body, operation: 'blog.resolve_users' });
+    const rows = Array.isArray(dataResp?.data?.data) ? dataResp.data.data : [];
+    return rows
+        .map((row) => ({
+        id: String(row.id ?? ''),
+        name: String(row.name ?? row.username ?? ''),
+        department: String(row.department ?? ''),
+    }))
+        .filter((user) => user.id);
+}
+/** 按姓名解析唯一 userId；同名多命中抛错并列出候选 */
+export async function resolveUserId(input, host) {
+    if (input.user_id !== undefined && input.name !== undefined) {
+        throw blogValidationError('input_ambiguous', 'user_id 与 name 只能提供一个');
+    }
+    if (input.user_id !== undefined) {
+        return { userId: asPositiveString(input.user_id, 'user_id'), userName: null };
+    }
+    if (input.name !== undefined) {
+        const name = asNonEmptyString(input.name, 'name');
+        const users = await searchUsersByName(host, name);
+        if (users.length === 0) {
+            throw blogValidationError('name_not_found', `未找到名为「${name}」的员工`);
+        }
+        if (users.length > 1) {
+            throw blogValidationError('name_ambiguous', `「${name}」命中 ${users.length} 名员工，请改用 user_id 指定`, { candidates: users });
+        }
+        return { userId: users[0].id, userName: users[0].name };
+    }
+    throw blogValidationError('input_invalid', 'user_id 与 name 必须提供一个');
+}
+/** 目标人员解析：只传 date 不传 user_id/name 时默认当前登录人 */
+export async function resolveTargetUser(input, host) {
+    if (input.user_id === undefined && input.name === undefined) {
+        const session = await host.getSession();
+        return { userId: session.userId, userName: null };
+    }
+    return resolveUserId(input, host);
+}
+/** 查某人某天日报（detailsByDate）；found=false 表示当天无日报 */
+export async function fetchDetailsByDate(host, date, userId) {
+    const value = await host.blogRequest({
+        method: 'GET',
+        path: '/api/blog/prior/detailsByDate',
+        query: { date, userId },
+        operation: 'blog.query_user',
+    });
+    const found = detailsFound(value);
+    return { found, raw: value, blog: found ? normalizeBlog(value.blog) : null };
+}
+/** 目标日报定位：blog_id 直传，或 date + user_id/name 经 detailsByDate 解析 */
+export async function resolveTargetBlog(input, host, action) {
+    if (input.blog_id !== undefined && (input.date !== undefined || input.user_id !== undefined || input.name !== undefined)) {
+        throw blogValidationError('input_ambiguous', 'blog_id 与 date/user_id/name 只能提供一个');
+    }
+    if (input.blog_id !== undefined) {
+        return { blogId: asPositiveString(input.blog_id, 'blog_id'), blog: null, date: null, userId: null };
+    }
+    const date = asDate(input.date, 'date');
+    const { userId, userName } = await resolveTargetUser(input, host);
+    const detail = await fetchDetailsByDate(host, date, userId);
+    if (!detail.found || !detail.blog) {
+        throw blogValidationError('target_missing', `对应日期 ${date} 人员 ${userName ?? userId} 无日报，无法${action}`);
+    }
+    return { blogId: detail.blog.id, blog: detail.blog, date, userId };
+}
+export function normalizeIdList(value, name) {
+    const raw = typeof value === 'string'
+        ? value.split(',').map((item) => item.trim()).filter(Boolean)
+        : value;
+    if (!Array.isArray(raw) || raw.length === 0) {
+        throw blogValidationError('input_invalid', `${name} 必须是非空数组或逗号分隔字符串`);
+    }
+    if (raw.length > 50)
+        throw blogValidationError('input_invalid', `${name} 单次最多支持 50 项`);
+    const ids = raw.map((item, index) => asPositiveString(String(item), `${name}[${index}]`));
+    if (new Set(ids).size !== ids.length)
+        throw blogValidationError('input_invalid', `${name} 不能包含重复 ID`);
+    return ids;
+}
+/** 导出落点校验：父目录必须存在，且拒绝覆盖已存在文件 */
+export async function resolveExportOutput(output) {
+    if (typeof output !== 'string' || !output.trim()) {
+        throw blogValidationError('output_required', 'output 必须是明确的本地文件路径');
+    }
+    const resolved = resolve(output);
+    let parent;
+    try {
+        parent = await stat(dirname(resolved));
+    }
+    catch {
+        throw blogValidationError('output_parent_missing', `输出目录不存在：${dirname(resolved)}`);
+    }
+    if (!parent.isDirectory()) {
+        throw blogValidationError('output_parent_invalid', '输出文件的父路径不是目录');
+    }
+    if (existsSync(resolved)) {
+        throw blogValidationError('output_exists', `输出文件已存在，拒绝覆盖：${resolved}`);
+    }
+    return resolved;
+}
+/** 以 wx 写入，避免 check-then-write 竞态覆盖用户文件 */
+export async function writeExportFile(resolved, content) {
+    try {
+        await writeFile(resolved, content, { flag: 'wx', mode: 0o600 });
+    }
+    catch (error) {
+        if (error && typeof error === 'object' && 'code' in error && error.code === 'EEXIST') {
+            throw blogValidationError('output_exists', `输出文件已存在，拒绝覆盖：${resolved}`);
+        }
+        throw error;
+    }
+}

package/dist/shortcuts/blog/operations/types.js

@@ -0,0 +1,16 @@
+export const READ = 'read';
+/** 构造「对象类型 + 禁止额外字段」的 JSON Schema。 */
+export function schemaOf(properties, options = {}) {
+    return {
+        type: 'object',
+        additionalProperties: false,
+        properties,
+        ...(options.required?.length ? { required: options.required } : {}),
+        ...(options.oneOf ? { oneOf: options.oneOf } : {}),
+        ...(options.anyOf ? { anyOf: options.anyOf } : {}),
+        ...(options.description ? { description: options.description } : {}),
+    };
+}
+export function workflow(name, state) {
+    return { name, state };
+}

package/dist/shortcuts/blog/operations.js

@@ -0,0 +1,9 @@
+import { getBlogOperation } from './operations/registry.js';
+import { asObject, assertNoForbiddenKeys } from './operations/shared.js';
+/** `run <operation>` 统一入口：选 handler、校验输入对象与禁用字段，再交给 handler。 */
+export async function executeBlogOperation(operation, rawInput, context) {
+    const handler = getBlogOperation(operation);
+    const input = asObject(rawInput);
+    assertNoForbiddenKeys(input);
+    return handler.execute(input, context);
+}

package/dist/shortcuts/caizhilian/continuation.js

@@ -0,0 +1,70 @@
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { resolve } from 'node:path';
+import { caizhilianValidationError } from './errors.js';
+function stateRoot(ctx) {
+    const configured = ctx?.config?.path();
+    if (configured)
+        return resolve(configured, '..');
+    return process.env.WEAVER_WORK_CLI_HOME || process.env.WORK_CLI_HOME || resolve(homedir(), '.weaver-work-cli');
+}
+async function loadKey(ctx) {
+    const keysDir = resolve(stateRoot(ctx), 'keys');
+    const filename = resolve(keysDir, 'caizhilian-continuation.key');
+    await mkdir(keysDir, { recursive: true, mode: 0o700 });
+    if (existsSync(filename))
+        return readFile(filename);
+    const key = randomBytes(32);
+    try {
+        await writeFile(filename, key, { flag: 'wx', mode: 0o600 });
+        if (process.platform !== 'win32')
+            await chmod(filename, 0o600).catch(() => undefined);
+        return key;
+    }
+    catch {
+        return readFile(filename);
+    }
+}
+function encode(value) {
+    return Buffer.from(JSON.stringify(value)).toString('base64url');
+}
+function signature(payload, key) {
+    return createHmac('sha256', key).update(payload).digest('base64url');
+}
+export function createCaizhilianContinuationSigner(ctx) {
+    return {
+        async issue(payload, ttlMs = 10 * 60_000) {
+            const issuedAt = Date.now();
+            const body = encode({ ...payload, issuedAt, expiresAt: issuedAt + ttlMs });
+            const sig = signature(body, await loadKey(ctx));
+            return `${body}.${sig}`;
+        },
+        async verify(token, expectedOperation) {
+            if (typeof token !== 'string' || !token.includes('.')) {
+                throw caizhilianValidationError('continuation_invalid', 'continuation 无效');
+            }
+            const [body, provided] = token.split('.');
+            const expected = signature(body, await loadKey(ctx));
+            const valid = provided.length === expected.length
+                && timingSafeEqual(Buffer.from(provided), Buffer.from(expected));
+            if (!valid)
+                throw caizhilianValidationError('continuation_invalid', 'continuation 签名校验失败');
+            let value;
+            try {
+                value = JSON.parse(Buffer.from(body, 'base64url').toString('utf8'));
+            }
+            catch {
+                throw caizhilianValidationError('continuation_invalid', 'continuation 内容无法解析');
+            }
+            if (value.operation !== expectedOperation) {
+                throw caizhilianValidationError('continuation_mismatch', 'continuation 不属于当前操作');
+            }
+            if (!Number.isSafeInteger(value.expiresAt) || value.expiresAt < Date.now()) {
+                throw caizhilianValidationError('continuation_expired', 'continuation 已过期');
+            }
+            return value;
+        },
+    };
+}

package/dist/shortcuts/caizhilian/errors.js

@@ -0,0 +1,53 @@
+import { CliError, ExitCode } from '../../core/errors.js';
+export class CaizhilianCliError extends CliError {
+    type;
+    subtype;
+    code;
+    retryable;
+    stage;
+    details;
+    partialData;
+    constructor(type, subtype, message, options = {}) {
+        super(message, options.exitCode ?? ExitCode.InternalError);
+        this.name = 'CaizhilianCliError';
+        this.type = type;
+        this.subtype = subtype;
+        this.code = options.code;
+        this.retryable = options.retryable ?? false;
+        this.stage = options.stage;
+        this.details = options.details;
+        this.partialData = options.partialData;
+    }
+}
+export function caizhilianValidationError(subtype, message, details) {
+    return new CaizhilianCliError('validation', subtype, message, {
+        details,
+        exitCode: ExitCode.UsageError,
+    });
+}
+export function caizhilianAuthError(subtype, message, details) {
+    return new CaizhilianCliError('authentication', subtype, message, {
+        details,
+        exitCode: ExitCode.AuthError,
+    });
+}
+export function caizhilianNetworkError(subtype, message, options = {}) {
+    return new CaizhilianCliError('network', subtype, message, {
+        ...options,
+        retryable: options.retryable ?? true,
+        exitCode: ExitCode.NetworkError,
+    });
+}
+export function caizhilianConfirmationError(action, details) {
+    return new CaizhilianCliError('confirmation', 'required', '该操作需要明确确认', {
+        details: { action, ...details },
+        exitCode: ExitCode.ConfirmationRequired,
+    });
+}
+export function caizhilianPartialError(message, partialData, details) {
+    return new CaizhilianCliError('partial', 'write_uncertain', message, {
+        details,
+        partialData,
+        exitCode: ExitCode.Partial,
+    });
+}