Aicoin Market

#!/usr/bin/env node
// AiCoin Open Data v3 API client — HMAC-SHA1 signed, header auth.
// One unified envelope {ok, data, error, meta}; see catalog for all endpoints.
import { createHmac, randomBytes } from 'node:crypto';
import { readFileSync, existsSync, writeFileSync } from 'node:fs';
import { fileURLToPath } from 'node:url';
import { dirname, resolve } from 'node:path';

const __dirname = dirname(fileURLToPath(import.meta.url));

// ── .env auto-load (OpenClaw exec may not inject env into child processes) ──
const ENV_FILES = [
  resolve(process.cwd(), '.env'),
  resolve(process.env.HOME || '', '.openclaw', 'workspace', '.env'),
  resolve(process.env.HOME || '', '.openclaw', '.env'),
  resolve(process.env.HOME || '', '.hermes', '.env'),
  resolve(process.env.HOME || '', '.workbuddy', '.env'),
];
for (const file of ENV_FILES) {
  if (!existsSync(file)) continue;
  try {
    for (const line of readFileSync(file, 'utf-8').split('\n')) {
      const t = line.trim();
      if (!t || t.startsWith('#')) continue;
      const eq = t.indexOf('=');
      if (eq < 1) continue;
      const k = t.slice(0, eq).trim();
      let v = t.slice(eq + 1).trim();
      if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) v = v.slice(1, -1);
      if (!process.env[k]) process.env[k] = v;
    }
  } catch { /* ignore unreadable .env */ }
}

const defaults = JSON.parse(readFileSync(resolve(__dirname, 'defaults.json'), 'utf-8'));
export const BASE = process.env.AICOIN_BASE_URL || 'https://open.aicoin.com';
export const KEY = process.env.AICOIN_ACCESS_KEY_ID || defaults.accessKeyId;
const SECRET = process.env.AICOIN_ACCESS_SECRET || defaults.accessSecret;
export const USING_OWN_KEY = !!(process.env.AICOIN_ACCESS_KEY_ID && process.env.AICOIN_ACCESS_SECRET);

// HMAC-SHA1(signStr, secret) → hex → base64. The 4 values ride in X-Aic-* headers.
function authHeaders(keyId = KEY, secret = SECRET) {
  const nonce = randomBytes(8).toString('hex');
  const ts = Math.floor(Date.now() / 1000).toString();
  const signStr = `AccessKeyId=${keyId}&SignatureNonce=${nonce}&Timestamp=${ts}`;
  const hex = createHmac('sha1', secret).update(signStr).digest('hex');
  return {
    'X-Aic-AccessKey-Id': keyId,
    'X-Aic-Signature-Nonce': nonce,
    'X-Aic-Timestamp': ts,
    'X-Aic-Signature': Buffer.from(hex).toString('base64'),
  };
}

// Normalize a user-supplied endpoint to a full /api/v3/... path.
//   "market/ticker" / "/market/ticker" / "/api/v3/market/ticker"  → "/api/v3/market/ticker"
export function normalizePath(ep) {
  let p = String(ep || '').trim().replace(/^https?:\/\/[^/]+/, '');
  if (p.startsWith('/api/v3/') || p === '/api/v3') return p;
  p = p.replace(/^\/?(api\/v3\/?)?/, '');
  return '/api/v3/' + p;
}

// endpoints.json — a bundled catalog snapshot. Drives GET/POST selection and
// offline `catalog`. Live catalog is still the source of truth (see fetchCatalog).
let _snapshot = null;
export function snapshotEndpoints() {
  if (_snapshot) return _snapshot;
  try {
    const j = JSON.parse(readFileSync(resolve(__dirname, 'endpoints.json'), 'utf-8'));
    _snapshot = j.endpoints || [];
  } catch { _snapshot = []; }
  return _snapshot;
}

// Pull the live catalog. Falls back to the bundled snapshot when offline.
export async function fetchCatalog() {
  try {
    const { httpStatus, body } = await request('GET', '/api/v3/_catalog');
    if (httpStatus === 200 && body?.data?.endpoints) return { endpoints: body.data.endpoints, live: true };
  } catch { /* fall through to snapshot */ }
  return { endpoints: snapshotEndpoints(), live: false };
}

// Core request. Returns { httpStatus, body }; body is the parsed envelope.
export async function request(method, path, params = {}) {
  const full = normalizePath(path);
  const m = (method || 'GET').toUpperCase();
  const headers = authHeaders();
  let url = `${BASE}${full}`;
  const init = { method: m, headers, signal: AbortSignal.timeout(30000) };
  if (m === 'GET' || m === 'DELETE') {
    const qs = new URLSearchParams();
    for (const [k, v] of Object.entries(params || {})) {
      if (v === undefined || v === null || v === '') continue;
      qs.set(k, Array.isArray(v) ? v.join(',') : String(v));
    }
    const s = qs.toString();
    if (s) url += `?${s}`;
  } else {
    headers['Content-Type'] = 'application/json';
    init.body = JSON.stringify(params || {});
  }
  const res = await fetch(url, init);
  const text = await res.text();
  let body;
  try { body = JSON.parse(text); } catch { body = { ok: false, error: { code: 'bad_response', message: text.slice(0, 300) } }; }
  // v3 business endpoints answer with {ok,...}. Auth / quota errors from the
  // gateway are still legacy-shaped ({success:false,errorCode,error}); fold them
  // into the same envelope so callers only ever branch on `ok`.
  if (body && typeof body === 'object' && typeof body.ok !== 'boolean' && (res.status >= 400 || body.success === false)) {
    body = {
      ok: false,
      data: null,
      error: {
        code: body.errorCode != null ? String(body.errorCode) : String(res.status),
        message: body.error || body.message || body.msg || `HTTP ${res.status}`,
      },
      meta: {},
    };
  }
  return { httpStatus: res.status, body };
}

// Resolve which HTTP method an endpoint uses, from snapshot then live catalog.
export async function resolveMethod(path) {
  const full = normalizePath(path);
  let hit = snapshotEndpoints().find(e => e.path === full);
  if (!hit) {
    const { endpoints } = await fetchCatalog();
    hit = endpoints.find(e => e.path === full);
  }
  return hit ? { method: hit.method, spec: hit } : null;
}

// Persist a new key pair to the workspace .env (validates before writing).
export async function saveKey(keyId, secret) {
  const headers = authHeaders(keyId, secret);
  const res = await fetch(`${BASE}/api/v3/coins/tickers?coin_key=bitcoin`, { headers, signal: AbortSignal.timeout(15000) });
  if (res.status === 401 || res.status === 403) return { ok: false, error: `key 验证失败 (HTTP ${res.status})` };
  if (!res.ok) return { ok: false, error: `验证请求失败 (HTTP ${res.status})` };
  const target = ENV_FILES.find(existsSync) || ENV_FILES[0];
  let lines = existsSync(target) ? readFileSync(target, 'utf-8').split('\n') : [];
  const set = (k, v) => {
    const i = lines.findIndex(l => l.trim().startsWith(k + '='));
    if (i >= 0) lines[i] = `${k}=${v}`; else lines.push(`${k}=${v}`);
  };
  set('AICOIN_ACCESS_KEY_ID', keyId);
  set('AICOIN_ACCESS_SECRET', secret);
  writeFileSync(target, lines.join('\n'));
  return { ok: true, file: target };
}

{
  "comment": "Public free-tier AiCoin API key. IP rate-limited. Users can replace with their own key via env vars.",
  "accessKeyId": "ronJ8uI0Yj2soAfGVs5H1YALUIINbE22",
  "accessSecret": "CWHZcH2us1CLSE7grroR1TpS0Z1JxTwU"
}

{
  "name": "aicoin-market",
  "version": "4.0.0",
  "private": true,
  "type": "module"
}

#!/usr/bin/env node
// AiCoin Open Data v3 — one entry point for every endpoint.
//
//   node scripts/aicoin.mjs <endpoint> ['<json params>']   call any v3 endpoint
//   node scripts/aicoin.mjs catalog [group|endpoint]        list endpoints (the live API menu)
//   node scripts/aicoin.mjs key                             show API key status + access probe
//   node scripts/aicoin.mjs set-key <id> <secret>           validate & save a new key to .env
//
// Endpoint = the path after /api/v3/ , e.g.  market/ticker  ,  hyperliquid/whales/open-positions
// Every call prints the v3 envelope {ok, data, error, meta}. Check `ok` first.
import { request, resolveMethod, fetchCatalog, saveKey, KEY, USING_OWN_KEY } from '../lib/client.mjs';

const out = (o) => console.log(JSON.stringify(o, null, 2));
const groupOf = (p) => p.replace(/^\/api\/v3\//, '').split('/')[0] || '_catalog';
const rel = (p) => p.replace(/^\/api\/v3\//, '');

const HINTS = {
  401: 'HTTP 401 — 签名或鉴权失败，检查 API key 是否正确。',
  403: 'HTTP 403 — 当前 key 没有此接口权限（套餐不够或 key 无效）。不要重试；告诉用户去 https://www.aicoin.com/opendata 升级套餐。',
  404: 'HTTP 404 — 资源不存在，检查 id / 参数是否对。',
  429: 'HTTP 429 — 触发限流，等 30-60 秒再试，或把多个查询合并成一次。',
  500: 'HTTP 500 — 服务端/上游故障，可隔 1-2 分钟重试；持续失败请联系 service@aicoin.com。',
  501: 'HTTP 501 — 该接口尚未实现（数据源未接通），换其他接口。',
  502: 'HTTP 502 — 网关临时故障，隔 1-2 分钟重试。',
  503: 'HTTP 503 — 服务暂时不可用，稍后重试。',
  504: 'HTTP 504 — 网关超时，稍后重试。',
};

async function callEndpoint(endpoint, rawParams) {
  let params = {};
  if (rawParams) {
    try { params = JSON.parse(rawParams); }
    catch { return out({ ok: false, error: { code: 'bad_params', message: `参数不是合法 JSON: ${rawParams}` }, _hint: "参数要用 JSON 对象，例: '{\"coin_key\":\"bitcoin\",\"market\":\"binance\"}'" }); }
  }
  const resolved = await resolveMethod(endpoint);
  if (!resolved) {
    return out({ ok: false, error: { code: 'unknown_endpoint', message: `未知接口: ${endpoint}` }, _hint: '跑 `node scripts/aicoin.mjs catalog` 看全部接口。' });
  }
  let res;
  try { res = await request(resolved.method, endpoint, params); }
  catch (e) { return out({ ok: false, error: { code: 'network', message: e.message }, _hint: '网络/超时错误，稍后重试。' }); }
  const body = (res.body && typeof res.body === 'object') ? res.body : { raw: res.body };
  if (res.httpStatus !== 200 && HINTS[res.httpStatus]) body._hint = HINTS[res.httpStatus];
  out(body);
}

async function showCatalog(filter) {
  const { endpoints, live } = await fetchCatalog();
  endpoints.sort((a, b) => a.path.localeCompare(b.path));

  if (filter) {
    // Group match wins over a same-named bare endpoint (e.g. `indexes` is both
    // the group and the path /api/v3/indexes) — the group view is more useful.
    const inGroup = endpoints.filter((e) => groupOf(e.path) === filter);
    if (inGroup.length) {
      const lines = [`# ${filter} (${inGroup.length} 个接口)　来源: ${live ? '线上' : '本地快照'}\n`];
      for (const e of inGroup) {
        lines.push(`${e.method} ${rel(e.path)}  —  ${e.summary || ''}`);
        for (const p of e.params || []) {
          const bits = [p.in, p.required ? '必填' : '可选', p.type];
          if (p.enum) bits.push('枚举:' + p.enum.join('/'));
          if (p.example) bits.push('例:' + p.example);
          lines.push(`    ${p.name}  (${bits.filter(Boolean).join(', ')})  ${p.desc || ''}`);
        }
        lines.push('');
      }
      return console.log(lines.join('\n'));
    }
    // Not a group — treat the filter as a single endpoint path.
    const exact = endpoints.find((e) => rel(e.path) === filter || e.path === filter);
    if (exact) return out({ source: live ? 'live' : 'snapshot', endpoint: exact });
    return out({ ok: false, error: { code: 'no_match', message: `没有 "${filter}" 分组或接口` }, _hint: '不带参数跑 catalog 看全部分组。' });
  }

  // Full table of contents — grouped, paths + summaries (no params).
  const groups = {};
  for (const e of endpoints) (groups[groupOf(e.path)] ||= []).push(e);
  const lines = [
    `# AiCoin v3 接口清单 — ${endpoints.length} 个，${Object.keys(groups).length} 个分组　(来源: ${live ? '线上' : '本地快照'})`,
    `# 看某分组的参数:  node scripts/aicoin.mjs catalog <分组名>`,
    `# 调用:  node scripts/aicoin.mjs <接口> '<JSON 参数>'\n`,
  ];
  for (const [g, es] of Object.entries(groups)) {
    lines.push(`### ${g} (${es.length})`);
    for (const e of es) lines.push(`  ${e.method.padEnd(4)} ${rel(e.path).padEnd(46)} ${e.summary || ''}`);
    lines.push('');
  }
  console.log(lines.join('\n'));
}

async function showKey() {
  const probes = [
    ['coins/tickers', { coin_key: 'bitcoin' }],
    ['derivatives/funding-rates', { coin_key: 'bitcoin', market: 'binance' }],
    ['market/big-orders', { coin_key: 'bitcoin', market: 'binance' }],
    ['hyperliquid/whales/open-positions', { coin: 'BTC' }],
    ['treasuries/summary', { coin_key: 'bitcoin' }],
  ];
  const access = [];
  for (const [ep, params] of probes) {
    try {
      const { httpStatus, body } = await request('GET', ep, params);
      access.push({ endpoint: ep, http: httpStatus, ok: body?.ok === true });
    } catch (e) { access.push({ endpoint: ep, error: e.message }); }
  }
  out({
    key_id: KEY ? KEY.slice(0, 6) + '…' : null,
    source: USING_OWN_KEY ? '用户自己的 key (.env)' : '内置免费 key',
    access,
    note: '某个接口 http=403 表示当前套餐不覆盖它；要更多权限去 https://www.aicoin.com/opendata。',
  });
}

const USAGE = `AiCoin Open Data v3
  node scripts/aicoin.mjs <接口> '<JSON参数>'   调任意 v3 接口，例:
      node scripts/aicoin.mjs market/ticker '{"coin_key":"bitcoin","market":"binance"}'
      node scripts/aicoin.mjs coins/tickers '{"coin_key":"bitcoin,ethereum"}'
      node scripts/aicoin.mjs hyperliquid/whales/open-positions '{"coin":"BTC"}'
  node scripts/aicoin.mjs catalog [分组]        看接口清单（不确定接口/参数时先跑这个）
  node scripts/aicoin.mjs key                   看 key 状态 + 权限探测
  node scripts/aicoin.mjs set-key <id> <secret> 校验并保存新 key`;

const [cmd, ...rest] = process.argv.slice(2);
(async () => {
  if (!cmd || cmd === 'help' || cmd === '-h' || cmd === '--help') return console.log(USAGE);
  if (cmd === 'catalog') return showCatalog(rest[0]);
  if (cmd === 'key') return showKey();
  if (cmd === 'set-key') {
    let id, secret;
    const raw = rest.join(' ').trim();
    if (raw.startsWith('{')) {
      // JSON 模式:兼容 AiCoin 后台直接拷下来的 {"api_key","access_key"}
      // 注意 AiCoin 后台命名反直觉 —— `api_key` 是公开 ID,`access_key` 才是 SECRET。
      // 也兼容 {"access_key_id","access_secret"} 等更直白的命名。
      try {
        const j = JSON.parse(raw);
        id = j.access_key_id || j.accessKeyId || j.key_id || j.api_key || j.key;
        secret = j.access_secret || j.accessSecret || j.secret_key || j.secret || j.access_key;
      } catch {
        return out({ ok: false, error: { code: 'bad_json', message: '参数不是合法 JSON' } });
      }
    } else if (rest.length >= 2) {
      id = rest[0];
      secret = rest[1];
    }
    if (!id || !secret) {
      return out({ ok: false, error: { code: 'bad_args', message: "用法: set-key <key_id> <secret>  或  set-key '<json>'(JSON 字段名兼容 api_key/access_key、access_key_id/access_secret 等;AiCoin 后台 api_key 是 ID、access_key 是 SECRET)" } });
    }
    const r = await saveKey(id, secret);
    return out(r.ok ? { ok: true, message: `key 已保存到 ${r.file}` } : { ok: false, error: { code: 'invalid_key', message: r.error } });
  }
  return callEndpoint(cmd, rest.join(' ').trim() || null);
})().catch((e) => { out({ ok: false, error: { code: 'fatal', message: e.message } }); process.exit(1); });