weaver-work-cli 0.1.8 → 0.1.20

package/dist/shortcuts/caizhilian/operations/types.js

@@ -0,0 +1,57 @@
+export function caizhilianSuccess(action, data, meta, warnings) {
+    const payload = { ok: true, action, data };
+    if (meta && Object.keys(meta).length > 0)
+        payload.meta = meta;
+    if (warnings && warnings.length > 0)
+        payload.warnings = warnings;
+    return payload;
+}
+/** 构造「对象类型 + 严格禁止额外字段」的 JSON Schema。 */
+export function schemaOf(properties, options = {}) {
+    return {
+        type: 'object',
+        additionalProperties: false,
+        properties,
+        ...(options.required?.length ? { required: options.required } : {}),
+        ...(options.description ? { description: options.description } : {}),
+    };
+}
+/** apply 入参 = prepare 入参 + confirm + continuation。 */
+export function applySchemaOf(base, required = []) {
+    const properties = { ...(base.properties || {}) };
+    delete properties.confirm;
+    delete properties.continuation;
+    return {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+            ...properties,
+            confirm: { const: true, description: '必须为 true（CLI 用 --yes）' },
+            continuation: { type: 'string', minLength: 1, description: 'prepare 返回的确认票据' },
+        },
+        required: [...new Set([...required, 'confirm', 'continuation'])],
+        ...(base.description ? { description: base.description } : {}),
+    };
+}
+export const SCHEMA_DOC_ID = { type: 'string', pattern: '^\\d+$', description: '文档 ID' };
+export const SCHEMA_FOLDER_ID = { type: 'string', pattern: '^\\d+$', description: '文件夹 ID' };
+export const SCHEMA_PAGE_NO = { type: 'integer', minimum: 1, default: 1, description: '页码（1-indexed）' };
+export const SCHEMA_PAGE_SIZE = { type: 'integer', minimum: 1, description: '每页条数' };
+export const SCHEMA_FILE_PATH = { type: 'string', minLength: 1, description: '本地文件绝对路径' };
+export function isWriteHandler(entry) {
+    return typeof entry.prepare === 'function';
+}
+/**
+ * prepare 阶段统一返回体：预览 + continuation + 有效期。
+ * apply 必须回传该 continuation 且 confirm=true。
+ */
+export function caizhilianPrepared(action, preview, lease, warnings) {
+    // handler 传入的是 canonical 名（不含 .prepare），两种形态都要指向 <name>.apply。
+    const applyAction = action.endsWith('.prepare') ? `${action.slice(0, -'.prepare'.length)}.apply` : `${action}.apply`;
+    return caizhilianSuccess(action, {
+        ...preview,
+        continuation: lease.continuation,
+        expires_in_ms: lease.expiresInMs,
+        hint: `确认无误后调用 ${applyAction}（必须回传本次 continuation 且 confirm=true，CLI 加 --yes）`,
+    }, { status: 'PREPARED', requiresConfirmation: true, expires_in_ms: lease.expiresInMs }, warnings);
+}

package/dist/shortcuts/caizhilian/operations.js

@@ -0,0 +1,21 @@
+import { caizhilianManifest } from './manifest.js';
+import { getCaizhilianOperation } from './operations/registry.js';
+import { asObject, assertKnownKeys, assertNoForbiddenKeys, assertNoLossyIntegers, normalizeAliases, } from './operations/shared.js';
+/** 顶层输入白名单直接取自 manifest：schema 即运行时约束，避免两处规则漂移。 */
+const ALLOWED_KEYS = Object.fromEntries(caizhilianManifest.operations.map((operation) => [
+    operation.name,
+    Object.keys(operation.inputSchema.properties ?? {}),
+]));
+export async function executeCaizhilianOperation(operation, rawInput, context) {
+    const definition = getCaizhilianOperation(operation);
+    const input = asObject(rawInput);
+    // 归一化必须早于校验与 handler：旧字段映射到 canonical，冲突直接报错。
+    const normalized = definition.deprecatedInputAliases
+        ? normalizeAliases(input, definition.deprecatedInputAliases)
+        : input;
+    assertNoForbiddenKeys(normalized);
+    assertKnownKeys(normalized, ALLOWED_KEYS[operation] ?? [], operation);
+    // 大整数（ID）用 JSON 数字传入会在解析阶段丢精度，必须在进入 handler 前拦下。
+    assertNoLossyIntegers(normalized);
+    return definition.handler(normalized, context);
+}

package/dist/shortcuts/contract/continuation.js

@@ -0,0 +1,70 @@
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { resolve } from 'node:path';
+import { contractValidationError } from './errors.js';
+function stateRoot(ctx) {
+    const configured = ctx?.config?.path();
+    if (configured)
+        return resolve(configured, '..');
+    return process.env.WEAVER_WORK_CLI_HOME || process.env.WORK_CLI_HOME || resolve(homedir(), '.weaver-work-cli');
+}
+async function loadKey(ctx) {
+    const keysDir = resolve(stateRoot(ctx), 'keys');
+    const filename = resolve(keysDir, 'contract-continuation.key');
+    await mkdir(keysDir, { recursive: true, mode: 0o700 });
+    if (existsSync(filename))
+        return readFile(filename);
+    const key = randomBytes(32);
+    try {
+        await writeFile(filename, key, { flag: 'wx', mode: 0o600 });
+        if (process.platform !== 'win32')
+            await chmod(filename, 0o600).catch(() => undefined);
+        return key;
+    }
+    catch {
+        return readFile(filename);
+    }
+}
+function encode(value) {
+    return Buffer.from(JSON.stringify(value)).toString('base64url');
+}
+function signature(payload, key) {
+    return createHmac('sha256', key).update(payload).digest('base64url');
+}
+export function createContractContinuationSigner(ctx) {
+    return {
+        async issue(payload, ttlMs = 10 * 60_000) {
+            const issuedAt = Date.now();
+            const body = encode({ ...payload, issuedAt, expiresAt: issuedAt + ttlMs });
+            const sig = signature(body, await loadKey(ctx));
+            return `${body}.${sig}`;
+        },
+        async verify(token, expectedOperation) {
+            if (typeof token !== 'string' || !token.includes('.')) {
+                throw contractValidationError('continuation_invalid', 'continuation 无效');
+            }
+            const [body, provided] = token.split('.');
+            const expected = signature(body, await loadKey(ctx));
+            const valid = provided.length === expected.length
+                && timingSafeEqual(Buffer.from(provided), Buffer.from(expected));
+            if (!valid)
+                throw contractValidationError('continuation_invalid', 'continuation 签名校验失败');
+            let value;
+            try {
+                value = JSON.parse(Buffer.from(body, 'base64url').toString('utf8'));
+            }
+            catch {
+                throw contractValidationError('continuation_invalid', 'continuation 内容无法解析');
+            }
+            if (value.operation !== expectedOperation) {
+                throw contractValidationError('continuation_mismatch', 'continuation 不属于当前操作');
+            }
+            if (!Number.isSafeInteger(value.expiresAt) || value.expiresAt < Date.now()) {
+                throw contractValidationError('continuation_expired', 'continuation 已过期');
+            }
+            return value;
+        },
+    };
+}

package/dist/shortcuts/contract/errors.js

@@ -0,0 +1,62 @@
+import { CliError, ExitCode } from '../../core/errors.js';
+export class ContractCliError extends CliError {
+    type;
+    subtype;
+    code;
+    retryable;
+    stage;
+    details;
+    partialData;
+    constructor(type, subtype, message, options = {}) {
+        super(message, options.exitCode ?? ExitCode.InternalError);
+        this.name = 'ContractCliError';
+        this.type = type;
+        this.subtype = subtype;
+        this.code = options.code;
+        this.retryable = options.retryable ?? false;
+        this.stage = options.stage;
+        this.details = options.details;
+        this.partialData = options.partialData;
+    }
+}
+export function contractValidationError(subtype, message, details) {
+    return new ContractCliError('validation', subtype, message, {
+        details,
+        exitCode: ExitCode.UsageError,
+    });
+}
+export function contractAuthError(subtype, message, details) {
+    return new ContractCliError('authentication', subtype, message, {
+        details,
+        exitCode: ExitCode.AuthError,
+    });
+}
+export function contractNetworkError(subtype, message, options = {}) {
+    return new ContractCliError('network', subtype, message, {
+        ...options,
+        retryable: options.retryable ?? true,
+        exitCode: ExitCode.NetworkError,
+    });
+}
+export function contractConfirmationError(action, details) {
+    return new ContractCliError('confirmation', 'required', '该操作需要明确确认', {
+        details: { action, ...details },
+        exitCode: ExitCode.ConfirmationRequired,
+    });
+}
+export function contractPolicyError(subtype, message, details) {
+    return new ContractCliError('policy', subtype, message, {
+        details,
+        exitCode: ExitCode.PolicyError,
+    });
+}
+export function contractPartialError(message, partialData, details) {
+    return new ContractCliError('partial', 'write_uncertain', message, {
+        details,
+        partialData,
+        exitCode: ExitCode.Partial,
+    });
+}
+export function isContractTimeoutError(error) {
+    return error instanceof ContractCliError && error.type === 'network' && error.subtype === 'timeout';
+}

package/dist/shortcuts/contract/host.js

@@ -0,0 +1,205 @@
+import { requireE10Session } from '../../internal/e10/context.js';
+import { getActiveProfile } from '../../internal/e10/auth/session.js';
+import { ContractCliError, contractAuthError, contractNetworkError, contractValidationError, } from './errors.js';
+const DEFAULT_TIMEOUT_MS = 30_000;
+function assertPath(requestPath) {
+    if (typeof requestPath !== 'string' || !requestPath.startsWith('/') || requestPath.startsWith('//')) {
+        throw contractValidationError('path_invalid', '请求路径必须是相对绝对路径');
+    }
+    if (/^https?:/i.test(requestPath) || /[\r\n]/.test(requestPath) || requestPath.includes('/../')) {
+        throw contractValidationError('path_invalid', '请求路径不允许跨域或路径逃逸');
+    }
+    if (!requestPath.startsWith('/api/')) {
+        throw contractValidationError('path_not_allowed', '今承达合同管理只能调用 /api/ 路径');
+    }
+}
+function withQuery(baseUrl, requestPath, query = {}) {
+    const url = new URL(`${baseUrl}${requestPath}`);
+    for (const [key, value] of Object.entries(query)) {
+        if (value === undefined || value === null || value === '')
+            continue;
+        if (Array.isArray(value)) {
+            for (const item of value)
+                url.searchParams.append(key, String(item));
+        }
+        else {
+            url.searchParams.set(key, String(value));
+        }
+    }
+    return url;
+}
+async function fetchWithTimeout(url, options, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        return await fetch(url, { ...options, signal: controller.signal, redirect: 'manual' });
+    }
+    catch (error) {
+        if (error instanceof Error && error.name === 'AbortError') {
+            throw contractNetworkError('timeout', `请求超时（${timeoutMs}ms）`, { retryable: false });
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        throw contractNetworkError('transport', `请求失败：${message}`, { retryable: true });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function textOf(value, keys) {
+    for (const key of keys) {
+        const candidate = value?.[key];
+        if (typeof candidate === 'string' && candidate.trim())
+            return candidate;
+    }
+    return undefined;
+}
+/**
+ * 源资料里各接口的成功码字段并不统一，适配层按路径分别判定，不凭 HTTP 200 判定业务成功。
+ * - /api/ebd/contract/**：顶层 code = 0；部分租户/版本（实测 10.0.9807.01）返回 code = 200，
+ *   因此 0 与 200 均视为成功，并辅以 status/fail 判定
+ * - /api/ebuilder/form/obj/getObjsByTag、/api/bs/ebuilder/app/tags/getAppIds、
+ *   /api/ebuilder/common/ds/fields、/api/ebuilder/common/ds/options：顶层 code = 200 且 status 不为 false
+ * - /api/ebuilder/form/dataset/v2/**：message.code = "0"
+ * - /api/workflow/**：message.errcode = "0"（getFieldOption 上游文档示例为 200，同样视为成功）
+ * - /api/workflow/core/flowPage/**、/api/workflow/core/form/**、/api/ebuilder/flow/form/**
+ *   （loadBaseParam / loadFrameParam / getFormLayout 三段式表单接口）：这些响应**没有 message 节点**，
+ *   成功与否要看 `fail`/`status` 与显式 errcode；只有 errcode 出现且非 0/200 才算失败。
+ *   沿用 weaver-e10-workflow 的 extractApiBusinessError 语义。
+ */
+export function contractBusinessStatus(path, value) {
+    const root = (value ?? {});
+    const messageNode = root.message ?? root.data?.message ?? {};
+    if (path.startsWith('/api/ebd/') || path === '/api/ebd/contract/clauseReference/selectData') {
+        const code = root.code ?? messageNode.errcode ?? messageNode.code;
+        const ok = (code === 0 || code === '0' || code === 200 || code === '200') && root.status !== false && root.fail !== true;
+        return { ok, code: code === undefined ? undefined : String(code), message: textOf(root, ['msg', 'message']) ?? textOf(messageNode, ['errmsg', 'msg']) };
+    }
+    if (path === '/api/ebuilder/form/obj/getObjsByTag'
+        || path === '/api/bs/ebuilder/app/tags/getAppIds'
+        || path === '/api/ebuilder/common/ds/fields'
+        || path === '/api/ebuilder/common/ds/options') {
+        const code = root.code;
+        const ok = (code === 200 || code === '200') && root.status !== false && root.fail !== true;
+        return { ok, code: code === undefined ? undefined : String(code), message: textOf(root, ['msg']) };
+    }
+    if (path.startsWith('/api/ebuilder/form/dataset/v2/')) {
+        const code = messageNode.code ?? root.code;
+        const ok = code === '0' || code === 0;
+        return { ok, code: code === undefined ? undefined : String(code), message: textOf(messageNode, ['msg']) ?? textOf(root, ['msg']) };
+    }
+    if (path.startsWith('/api/workflow/core/flowPage/')
+        || path.startsWith('/api/workflow/core/form/')
+        || path.startsWith('/api/ebuilder/flow/form/')) {
+        const errcode = String(messageNode.errcode ?? root.errcode ?? '').trim();
+        if (errcode && !['0', '200'].includes(errcode)) {
+            return { ok: false, code: errcode, message: textOf(messageNode, ['errmsg', 'msg']) ?? textOf(root, ['msg', 'message']) };
+        }
+        if (root.fail === true || root.status === false) {
+            return {
+                ok: false,
+                code: textOf(root, ['code']) ?? '',
+                message: textOf(root, ['msg', 'message', 'error', 'errorMsg']) ?? '泛微接口返回业务失败',
+            };
+        }
+        return { ok: true, code: errcode || undefined, message: textOf(messageNode, ['errmsg', 'msg']) };
+    }
+    const errcode = messageNode.errcode ?? root.errcode;
+    const ok = errcode === '0' || errcode === 0 || errcode === '200' || errcode === 200;
+    return { ok, code: errcode === undefined ? undefined : String(errcode), message: textOf(messageNode, ['errmsg', 'msg']) };
+}
+function inferProfile(ctx) {
+    const options = ctx.getGlobalOptions();
+    return options.profile || getActiveProfile();
+}
+function requestHeaders(session) {
+    return {
+        Accept: 'application/json, text/plain, */*',
+        Cookie: session.cookieHeader(),
+        eteamsid: session.eteamsId,
+        'User-Agent': session.uaHeader(),
+        Origin: session.getBaseUrl(),
+    };
+}
+export function createContractHost(ctx, dependencies = {}) {
+    let e10Session = null;
+    let sessionContext = null;
+    const requireSession = dependencies.requireSession || requireE10Session;
+    async function ensureSession() {
+        if (!e10Session) {
+            e10Session = await requireSession(ctx);
+            sessionContext = {
+                baseUrl: e10Session.getBaseUrl(),
+                profile: inferProfile(ctx),
+                userId: e10Session.userId,
+            };
+        }
+        return e10Session;
+    }
+    async function getSession() {
+        await ensureSession();
+        return sessionContext;
+    }
+    async function contractRequest(request) {
+        const { method = 'POST', path, query = {}, body, form, userIdField, timeoutMs = DEFAULT_TIMEOUT_MS, } = request;
+        assertPath(path);
+        const session = await ensureSession();
+        const context = await getSession();
+        const headers = requestHeaders(session);
+        const finalQuery = { ...query };
+        let finalBody = body;
+        const init = { method, headers };
+        if (userIdField) {
+            if (!context.userId) {
+                throw contractAuthError('user_id_missing', '当前会话没有可用的用户 ID，请确认 E10 登录态');
+            }
+            if (method === 'GET')
+                finalQuery[userIdField] = context.userId;
+            else
+                finalBody = { ...finalBody, [userIdField]: context.userId };
+        }
+        if (form) {
+            const data = new FormData();
+            for (const [key, value] of Object.entries(form))
+                data.append(key, value);
+            init.body = data;
+        }
+        else if (finalBody !== undefined) {
+            headers['Content-Type'] = 'application/json;charset=UTF-8';
+            init.body = JSON.stringify(finalBody);
+        }
+        const url = withQuery(context.baseUrl, path, finalQuery);
+        const response = await fetchWithTimeout(url, init, timeoutMs);
+        if (response.status === 401 || response.status === 302) {
+            throw contractAuthError('session_expired', 'E10 登录态已失效，请先向用户确认 E10 登录域名，再运行 weaver-work-cli auth login --base-url <域名> 完成登录', { httpStatus: response.status, path });
+        }
+        const text = await response.text();
+        let value = {};
+        try {
+            value = text ? JSON.parse(text) : {};
+        }
+        catch {
+            throw contractNetworkError('protocol', `接口返回不是合法 JSON（HTTP ${response.status}）`, {
+                retryable: false,
+                details: { path, status: response.status },
+            });
+        }
+        if (response.status < 200 || response.status >= 300) {
+            throw new ContractCliError('api', 'http_error', `泛微接口 HTTP ${response.status}`, {
+                code: response.status,
+                details: { path, status: response.status },
+                exitCode: 1,
+            });
+        }
+        const status = contractBusinessStatus(path, value);
+        if (!status.ok) {
+            const rawPreview = typeof text === 'string' ? text.slice(0, 500) : '';
+            throw new ContractCliError('api', 'business_error', status.message || '泛微接口返回业务失败', {
+                code: status.code,
+                details: { path, code: status.code, raw: rawPreview },
+                exitCode: 1,
+            });
+        }
+        return value;
+    }
+    return { contractRequest, getSession };
+}