@aalis/plugin-authority 0.1.1 → 0.2.0

package/README.md

@@ -1,7 +1,6 @@
 # @aalis/plugin-authority
 
-运行时插件
-
+权限系统：纯能力委托图、跨平台身份绑定、受限能力临时委托
 ## 角色
 
 运行时插件

package/dist/authority-manager.d.ts

@@ -0,0 +1,54 @@
+import type { ConfigManager, Logger } from '@aalis/core';
+import type { AccessConfirmHandler, AccessRequest, AuthorityService, AuthorityUserEntry, AuthorizeRequest, TemporaryGrant, UserCapabilityOverrides, UserIdentity } from '@aalis/plugin-authority-api';
+import type { StorageService } from '@aalis/plugin-storage-api';
+export declare class AuthorityManager implements AuthorityService {
+    private readonly config;
+    private readonly logger;
+    private store;
+    private confirmHandlers;
+    private tempGrants;
+    private grantSeq;
+    /** 临时放行策略（restrictedPolicy）的开启时间戳（运行时态，不持久化；重启即失效） */
+    private policyEnabledAt;
+    constructor(config: ConfigManager, logger: Logger, storage: StorageService);
+    init(): Promise<void>;
+    isOwner(platform: string, userId?: string): boolean;
+    /** 解析用户能力来源：被绑身份的 grant 以主账户为真源，deny 取自身∪主账户并集 */
+    private resolve;
+    /** 一条能力是否为 restricted（命中内置 + config.restrictedCapabilities） */
+    private isRestrictedCap;
+    authorize(identity: {
+        platform: string;
+        userId?: string;
+    }, request: AuthorizeRequest): string | null;
+    setUserCapabilities(granter: UserIdentity | null, target: UserIdentity, caps: UserCapabilityOverrides): void;
+    removeUser(platform: string, userId: string): void;
+    listDelegatees(granter: UserIdentity | null): AuthorityUserEntry[];
+    setConfirmHandler(platform: string, handler: AccessConfirmHandler): void;
+    /**
+     * 该请求是否已被（白名单/会话内临时委托）放行（内部用，requestAccess 调用）。
+     * restrictedPolicy 白名单是管理员全局策略；会话临时授予按 capability + sessionId 匹配
+     * （一次会话的临时批准不跨会话泄漏到其他会话）。
+     */
+    private isTemporarilyAllowed;
+    requestAccess(request: AccessRequest): Promise<boolean>;
+    listTemporaryGrants(): TemporaryGrant[];
+    revokeTemporaryGrant(id: string): boolean;
+    markPolicyEnabled(): void;
+    private normalizeDecision;
+    private consumeTempGrant;
+    private createTempGrant;
+    private pruneTempGrants;
+    listUsers(): AuthorityUserEntry[];
+    setPassword(platform: string, userId: string, password: string): Promise<void>;
+    verifyPassword(platform: string, userId: string, password: string): Promise<boolean>;
+    hasPassword(platform: string, userId: string): boolean;
+    createBindCode(platform: string, userId: string): {
+        code: string;
+        expiresAt: number;
+    };
+    consumeBindCode(code: string, identity: UserIdentity): UserIdentity;
+    unlinkIdentity(platform: string, userId: string): boolean;
+    save(): void;
+}
+//# sourceMappingURL=authority-manager.d.ts.map

package/dist/authority-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-manager.d.ts","sourceRoot":"","sources":["../src/authority-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EACV,oBAAoB,EAEpB,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAEhB,cAAc,EACd,uBAAuB,EACvB,YAAY,EACb,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AA+BhE,qBAAa,gBAAiB,YAAW,gBAAgB;IASrD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IATzB,OAAO,CAAC,KAAK,CAAY;IACzB,OAAO,CAAC,eAAe,CAA2C;IAClE,OAAO,CAAC,UAAU,CAAqC;IACvD,OAAO,CAAC,QAAQ,CAAK;IACrB,sDAAsD;IACtD,OAAO,CAAC,eAAe,CAAuB;gBAG3B,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,EAC/B,OAAO,EAAE,cAAc;IAKzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAKrB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO;IAOnD,kDAAkD;IAClD,OAAO,CAAC,OAAO;IAWf,+DAA+D;IAC/D,OAAO,CAAC,eAAe;IAOvB,SAAS,CAAC,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI;IA4BpG,mBAAmB,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,uBAAuB,GAAG,IAAI;IAkC5G,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAIlD,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,GAAG,kBAAkB,EAAE;IAWlE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,IAAI;IAIxE;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAmBtB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB7D,mBAAmB,IAAI,cAAc,EAAE;IAKvC,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAMzC,iBAAiB,IAAI,IAAI;IAIzB,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,eAAe;IAwBvB,OAAO,CAAC,eAAe;IAQvB,SAAS,IAAI,kBAAkB,EAAE;IA8BjC,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAG9E,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAGpF,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAGtD,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAGrF,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,YAAY;IAGnE,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAGzD,IAAI,IAAI,IAAI;CAGb"}

package/dist/authority-manager.js

@@ -0,0 +1,288 @@
+import { hasCapability, matchAnyCap, rejectedDelegations } from './capability-model.js';
+import { UserStore } from './user-store.js';
+// ════════════════════════════════════════════════════════════
+// AuthorityManager —— 纯能力委托模型的 AuthorityService 实现（策略层）
+//
+// owner=`*`；用户有效能力 = (public ∪ 授予的 restricted) − denied；
+// 委托子集约束（非 owner 只能授予自己持有的）；restricted 能力的临时委托。
+// 数据层（users.json v3 / 绑定 / 密码）委托给 UserStore；纯判定见 capability-model。
+// ════════════════════════════════════════════════════════════
+/** 内置受限能力：写用户表 / 计划任务 / 源码根 —— 默认禁、仅 owner 或被授予者可触达 */
+const BUILTIN_RESTRICTED = [
+    'storage:path:data:/users.json:write',
+    'storage:path:data:/users.json:delete',
+    'storage:path:data:/scheduler-jobs.json:write',
+    'storage:path:data:/scheduler-jobs.json:delete',
+    'storage:aalis:write',
+    'storage:aalis:delete',
+];
+export class AuthorityManager {
+    config;
+    logger;
+    store;
+    confirmHandlers = new Map();
+    tempGrants = new Map();
+    grantSeq = 0;
+    /** 临时放行策略（restrictedPolicy）的开启时间戳（运行时态，不持久化；重启即失效） */
+    policyEnabledAt = null;
+    constructor(config, logger, storage) {
+        this.config = config;
+        this.logger = logger;
+        this.store = new UserStore(storage, this.logger.child('authority'));
+    }
+    init() {
+        return this.store.load();
+    }
+    // ── owner ─────────────────────────────────────────────────
+    isOwner(platform, userId) {
+        if (!userId)
+            return false;
+        if ((platform === 'webui' || platform === 'cli') && userId === 'console')
+            return true;
+        const owners = this.config.get('owners') ?? [];
+        return owners.some((o) => o.platform === platform && o.userId === userId);
+    }
+    /** 解析用户能力来源：被绑身份的 grant 以主账户为真源，deny 取自身∪主账户并集 */
+    resolve(platform, userId) {
+        const isOwner = this.isOwner(platform, userId);
+        const ownKey = userId ? `${platform}:${userId}` : undefined;
+        const ownRecord = ownKey ? this.store.get(ownKey) : undefined;
+        const accountKey = ownKey ? this.store.accountOf(ownKey) : undefined;
+        const accountRecord = accountKey ? this.store.get(accountKey) : undefined;
+        const grants = (accountKey ? accountRecord?.caps?.grant : ownRecord?.caps?.grant) ?? [];
+        const denies = [...(ownRecord?.caps?.deny ?? []), ...(accountRecord?.caps?.deny ?? [])];
+        return { isOwner, grants, denies };
+    }
+    /** 一条能力是否为 restricted（命中内置 + config.restrictedCapabilities） */
+    isRestrictedCap(cap) {
+        if (matchAnyCap(BUILTIN_RESTRICTED, cap))
+            return true;
+        const extra = this.config.get('restrictedCapabilities') ?? [];
+        return matchAnyCap(extra, cap);
+    }
+    // ── 能力统一闸（静态判定；临时委托在 requestAccess）──────────
+    authorize(identity, request) {
+        const res = this.resolve(identity.platform, identity.userId);
+        const denied = this.config.get('deniedCapabilities') ?? [];
+        const check = (cap, restricted) => {
+            // 全局硬禁用：连 owner 都压过
+            if (matchAnyCap(denied, cap))
+                return `已被系统禁用: ${cap}`;
+            // 复用纯模型：deny > owner > (public→放行) > granted
+            const ok = hasCapability({ isOwner: res.isOwner, publicCaps: restricted ? [] : [cap], grants: res.grants, denies: res.denies }, cap);
+            if (ok)
+                return null;
+            return restricted ? `权限不足: "${cap}" 需授予后使用` : `已被禁止: ${cap}`;
+        };
+        // 主能力：可见性由调用方传入（已应用 visibilityOverrides）
+        const primary = check(request.capability, request.visibility === 'restricted');
+        if (primary)
+            return primary;
+        // 资源能力：受限性由 restrictedCapabilities 判定
+        for (const cap of request.resourceCapabilities ?? []) {
+            const rejection = check(cap, this.isRestrictedCap(cap));
+            if (rejection)
+                return rejection;
+        }
+        return null;
+    }
+    // ── 委托（子集约束）────────────────────────────────────────
+    setUserCapabilities(granter, target, caps) {
+        const normalize = (list) => {
+            const cleaned = [...new Set((list ?? []).map(p => p.trim()).filter(Boolean))];
+            return cleaned.length > 0 ? cleaned : undefined;
+        };
+        const grant = normalize(caps.grant);
+        const deny = normalize(caps.deny);
+        // 子集约束：非 owner 授予方只能授予自己持有的能力（单调递减防越权）
+        if (granter && !this.isOwner(granter.platform, granter.userId)) {
+            const gRes = this.resolve(granter.platform, granter.userId);
+            const bad = rejectedDelegations({ isOwner: false, publicCaps: [], grants: gRes.grants, denies: gRes.denies }, grant ?? []);
+            if (bad.length > 0) {
+                throw new Error(`越权：你不持有这些能力，无法授予：${bad.join('、')}`);
+            }
+        }
+        const key = `${target.platform}:${target.userId}`;
+        const existing = this.store.get(key);
+        const grantedBy = granter ? `${granter.platform}:${granter.userId}` : existing?.grantedBy;
+        const next = { ...existing, caps: grant || deny ? { grant, deny } : undefined, grantedBy };
+        if (!next.caps && !next.secret && !next.links) {
+            this.store.delete(key);
+        }
+        else {
+            this.store.set(key, next);
+        }
+        this.logger.debug(`设置能力委托: ${key} grant=${grant?.length ?? 0} deny=${deny?.length ?? 0} by=${grantedBy ?? '-'}`);
+    }
+    removeUser(platform, userId) {
+        if (this.store.delete(`${platform}:${userId}`))
+            this.logger.debug(`删除用户记录: ${platform}:${userId}`);
+    }
+    listDelegatees(granter) {
+        const granterKey = granter ? `${granter.platform}:${granter.userId}` : null;
+        return this.listUsers().filter(u => {
+            const entry = this.store.get(`${u.platform}:${u.userId}`);
+            // owner（null）列顶层：无 grantedBy 且非 owner 自身的用户
+            if (granterKey === null)
+                return !entry?.grantedBy && !u.isOwner;
+            return entry?.grantedBy === granterKey;
+        });
+    }
+    // ── 临时能力委托（restricted 能力的时限/限次放行）──────────────
+    setConfirmHandler(platform, handler) {
+        this.confirmHandlers.set(platform, handler);
+    }
+    /**
+     * 该请求是否已被（白名单/会话内临时委托）放行（内部用，requestAccess 调用）。
+     * restrictedPolicy 白名单是管理员全局策略；会话临时授予按 capability + sessionId 匹配
+     * （一次会话的临时批准不跨会话泄漏到其他会话）。
+     */
+    isTemporarilyAllowed(request) {
+        const policy = this.config.get('restrictedPolicy');
+        if (policy?.allow && policy.allow.length > 0) {
+            if (!policy.duration ||
+                policy.duration <= 0 ||
+                (this.policyEnabledAt && (Date.now() - this.policyEnabledAt) / 1000 <= policy.duration)) {
+                if (matchAnyCap(policy.allow, request.capability))
+                    return true;
+            }
+        }
+        this.pruneTempGrants();
+        for (const g of this.tempGrants.values()) {
+            if (g.sessionId !== request.sessionId)
+                continue;
+            if (g.capability === request.capability || matchAnyCap([g.capability], request.capability))
+                return true;
+        }
+        return false;
+    }
+    async requestAccess(request) {
+        if (this.isTemporarilyAllowed(request)) {
+            this.consumeTempGrant(request);
+            return true;
+        }
+        const handler = this.confirmHandlers.get(request.platform);
+        if (!handler)
+            return false;
+        try {
+            const decision = this.normalizeDecision(await handler(request));
+            if (decision.allowed && decision.grant?.scope === 'session')
+                this.createTempGrant(request, decision);
+            return decision.allowed;
+        }
+        catch (err) {
+            this.logger.warn(`临时委托确认回调异常: ${err}`);
+            return false;
+        }
+    }
+    listTemporaryGrants() {
+        this.pruneTempGrants();
+        return [...this.tempGrants.values()].map(g => ({ ...g }));
+    }
+    revokeTemporaryGrant(id) {
+        const ok = this.tempGrants.delete(id);
+        if (ok)
+            this.logger.info(`已撤销临时能力委托: ${id}`);
+        return ok;
+    }
+    markPolicyEnabled() {
+        this.policyEnabledAt = Date.now();
+    }
+    normalizeDecision(result) {
+        return typeof result === 'boolean' ? { allowed: result } : result;
+    }
+    consumeTempGrant(request) {
+        for (const g of this.tempGrants.values()) {
+            if (g.capability !== request.capability)
+                continue;
+            if (g.sessionId !== request.sessionId)
+                continue;
+            g.used++;
+            if (g.maxUses && g.used >= g.maxUses)
+                this.tempGrants.delete(g.id);
+            return;
+        }
+    }
+    createTempGrant(request, decision) {
+        const spec = decision.grant;
+        if (!spec || spec.scope !== 'session')
+            return;
+        this.pruneTempGrants();
+        const durationSeconds = Math.max(1, Math.min(spec.durationSeconds ?? 600, 3600));
+        const grant = {
+            id: `grant_${this.grantSeq++}_${Date.now()}`,
+            capability: request.capability,
+            name: request.name,
+            type: request.type,
+            sessionId: request.sessionId,
+            platform: request.platform,
+            userId: request.userId,
+            expiresAt: Date.now() + durationSeconds * 1000,
+            maxUses: spec.maxUses,
+            used: 0,
+            createdAt: Date.now(),
+        };
+        this.tempGrants.set(grant.id, grant);
+        this.logger.info(`创建临时能力委托: ${grant.capability} session=${grant.sessionId} ${durationSeconds}s grant=${grant.id}`);
+    }
+    pruneTempGrants() {
+        const now = Date.now();
+        for (const [id, g] of this.tempGrants) {
+            if (g.expiresAt <= now || (g.maxUses && g.used >= g.maxUses))
+                this.tempGrants.delete(id);
+        }
+    }
+    // ── 列表 ──────────────────────────────────────────────────
+    listUsers() {
+        const result = [];
+        for (const [key, record] of this.store.entries()) {
+            const idx = key.indexOf(':');
+            const platform = key.slice(0, idx);
+            const userId = key.slice(idx + 1);
+            result.push({
+                platform,
+                userId,
+                isOwner: this.isOwner(platform, userId),
+                grant: record.caps?.grant,
+                deny: record.caps?.deny,
+                grantedBy: record.grantedBy,
+                hasPassword: record.secret ? true : undefined,
+                links: record.links,
+                linkedTo: this.store.accountOf(key),
+            });
+        }
+        // 无自身记录的被绑身份也可见
+        for (const [identityKey, accountKey] of this.store.links()) {
+            if (this.store.get(identityKey))
+                continue;
+            const idx = identityKey.indexOf(':');
+            const platform = identityKey.slice(0, idx);
+            const userId = identityKey.slice(idx + 1);
+            result.push({ platform, userId, isOwner: this.isOwner(platform, userId), linkedTo: accountKey });
+        }
+        return result;
+    }
+    // ── 密码 / 绑定（委托给 UserStore）──────────────────────────
+    setPassword(platform, userId, password) {
+        return this.store.setPassword(platform, userId, password);
+    }
+    verifyPassword(platform, userId, password) {
+        return this.store.verifyPassword(platform, userId, password);
+    }
+    hasPassword(platform, userId) {
+        return this.store.hasPassword(platform, userId);
+    }
+    createBindCode(platform, userId) {
+        return this.store.createBindCode(platform, userId);
+    }
+    consumeBindCode(code, identity) {
+        return this.store.consumeBindCode(code, identity);
+    }
+    unlinkIdentity(platform, userId) {
+        return this.store.unlinkIdentity(platform, userId);
+    }
+    save() {
+        this.store.save();
+    }
+}
+//# sourceMappingURL=authority-manager.js.map

package/dist/authority-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-manager.js","sourceRoot":"","sources":["../src/authority-manager.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,+DAA+D;AAC/D,wDAAwD;AACxD,EAAE;AACF,yDAAyD;AACzD,gDAAgD;AAChD,mEAAmE;AACnE,+DAA+D;AAE/D,uDAAuD;AACvD,MAAM,kBAAkB,GAAsB;IAC5C,qCAAqC;IACrC,sCAAsC;IACtC,8CAA8C;IAC9C,+CAA+C;IAC/C,qBAAqB;IACrB,sBAAsB;CACvB,CAAC;AAWF,MAAM,OAAO,gBAAgB;IASR;IACA;IATX,KAAK,CAAY;IACjB,eAAe,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC1D,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC/C,QAAQ,GAAG,CAAC,CAAC;IACrB,sDAAsD;IAC9C,eAAe,GAAkB,IAAI,CAAC;IAE9C,YACmB,MAAqB,EACrB,MAAc,EAC/B,OAAuB;QAFN,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAQ;QAG/B,IAAI,CAAC,KAAK,GAAG,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,6DAA6D;IAC7D,OAAO,CAAC,QAAgB,EAAE,MAAe;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,KAAK,CAAC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACtF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAe,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC1F,CAAC;IAED,kDAAkD;IAC1C,OAAO,CAAC,QAAgB,EAAE,MAAe;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACxF,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QACxF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACrC,CAAC;IAED,+DAA+D;IACvD,eAAe,CAAC,GAAiB;QACvC,IAAI,WAAW,CAAC,kBAAkB,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC;QAC9D,OAAO,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,+CAA+C;IAC/C,SAAS,CAAC,QAA+C,EAAE,OAAyB;QAClF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;QAE3D,MAAM,KAAK,GAAG,CAAC,GAAiB,EAAE,UAAmB,EAAiB,EAAE;YACtE,oBAAoB;YACpB,IAAI,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC;gBAAE,OAAO,WAAW,GAAG,EAAE,CAAC;YACtD,6CAA6C;YAC7C,MAAM,EAAE,GAAG,aAAa,CACtB,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EACrG,GAAG,CACJ,CAAC;YACF,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAC;YACpB,OAAO,UAAU,CAAC,CAAC,CAAC,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC;QAC/D,CAAC,CAAC;QAEF,yCAAyC;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC;QAC/E,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,sCAAsC;QACtC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,oBAAoB,IAAI,EAAE,EAAE,CAAC;YACrD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;YACxD,IAAI,SAAS;gBAAE,OAAO,SAAS,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sDAAsD;IACtD,mBAAmB,CAAC,OAA4B,EAAE,MAAoB,EAAE,IAA6B;QACnG,MAAM,SAAS,GAAG,CAAC,IAAe,EAAwB,EAAE;YAC1D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC9E,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAElC,uCAAuC;QACvC,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,mBAAmB,CAC7B,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC5E,KAAK,IAAI,EAAE,CACZ,CAAC;YACF,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC1F,MAAM,IAAI,GAAG,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC;QAC3F,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,WAAW,GAAG,UAAU,KAAK,EAAE,MAAM,IAAI,CAAC,SAAS,IAAI,EAAE,MAAM,IAAI,CAAC,OAAO,SAAS,IAAI,GAAG,EAAE,CAC9F,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,QAAgB,EAAE,MAAc;QACzC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,cAAc,CAAC,OAA4B;QACzC,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1D,4CAA4C;YAC5C,IAAI,UAAU,KAAK,IAAI;gBAAE,OAAO,CAAC,KAAK,EAAE,SAAS,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAChE,OAAO,KAAK,EAAE,SAAS,KAAK,UAAU,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iDAAiD;IACjD,iBAAiB,CAAC,QAAgB,EAAE,OAA6B;QAC/D,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACK,oBAAoB,CAAC,OAAsB;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,MAAM,EAAE,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,IACE,CAAC,MAAM,CAAC,QAAQ;gBAChB,MAAM,CAAC,QAAQ,IAAI,CAAC;gBACpB,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,EACvF,CAAC;gBACD,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC;oBAAE,OAAO,IAAI,CAAC;YACjE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBAAE,SAAS;YAChD,IAAI,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC1G,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAsB;QACxC,IAAI,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;YAChE,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE,KAAK,KAAK,SAAS;gBAAE,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACrG,OAAO,QAAQ,CAAC,OAAO,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,mBAAmB;QACjB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,oBAAoB,CAAC,EAAU;QAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,EAAE;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC7C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,iBAAiB;QACf,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACpC,CAAC;IAEO,iBAAiB,CAAC,MAAgC;QACxD,OAAO,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACpE,CAAC;IAEO,gBAAgB,CAAC,OAAsB;QAC7C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;gBAAE,SAAS;YAClD,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBAAE,SAAS;YAChD,CAAC,CAAC,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO;gBAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,OAAsB,EAAE,QAAwB;QACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QAC9C,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACjF,MAAM,KAAK,GAAmB;YAC5B,EAAE,EAAE,SAAS,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;YAC5C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,GAAG,IAAI;YAC9C,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,CAAC;YACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,aAAa,KAAK,CAAC,UAAU,YAAY,KAAK,CAAC,SAAS,IAAI,eAAe,WAAW,KAAK,CAAC,EAAE,EAAE,CACjG,CAAC;IACJ,CAAC;IAEO,eAAe;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACtC,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC;gBAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,SAAS;QACP,MAAM,MAAM,GAAyB,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ;gBACR,MAAM;gBACN,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACvC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;gBAC7C,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QACD,gBAAgB;QAChB,KAAK,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAC3D,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;YAC1C,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sDAAsD;IACtD,WAAW,CAAC,QAAgB,EAAE,MAAc,EAAE,QAAgB;QAC5D,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5D,CAAC;IACD,cAAc,CAAC,QAAgB,EAAE,MAAc,EAAE,QAAgB;QAC/D,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IACD,WAAW,CAAC,QAAgB,EAAE,MAAc;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IACD,cAAc,CAAC,QAAgB,EAAE,MAAc;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IACD,eAAe,CAAC,IAAY,EAAE,QAAsB;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;IACD,cAAc,CAAC,QAAgB,EAAE,MAAc;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IACD,IAAI;QACF,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;CACF"}

package/dist/capability-model.d.ts

@@ -0,0 +1,31 @@
+/** 单条能力 glob 匹配：`*` 通配任意字符段。pattern 为 glob，value 为具体能力串。 */
+export declare function capMatches(pattern: string, value: string): boolean;
+/** value 是否被 patterns 中任一 glob 命中。 */
+export declare function matchAnyCap(patterns: readonly string[], value: string): boolean;
+/**
+ * 用户的能力解析输入。
+ * - publicCaps：全局声明为 public 的能力集（来自各操作声明，所有人默认拥有）。
+ * - grants：该用户被授予的 restricted 能力 glob（委托加）。
+ * - denies：该用户被禁用的能力 glob（委托减，最高优先）。
+ * - isOwner：owner = `*`，拥有一切。
+ */
+export interface CapabilityResolution {
+    isOwner: boolean;
+    publicCaps: readonly string[];
+    grants: readonly string[];
+    denies: readonly string[];
+}
+/**
+ * 用户对某具体能力是否有效。优先级：deny > owner(*) > public > granted(restricted)。
+ * 注意 deny 高于 owner——owner 也可被显式 deny 某能力（如临时收回）。
+ */
+export declare function hasCapability(res: CapabilityResolution, cap: string): boolean;
+/**
+ * 委托子集约束：授予方把 requested 能力委托给下层是否合法。
+ * owner 可委托一切；非 owner 只能委托「自己当前有效持有」的能力（防越权放大）。
+ * 返回越权（不可委托）的能力项；空数组 = 全部合法。
+ *
+ * 语义：具体能力按 hasCapability 判定；委托更宽的 glob（超出自己持有的）会被拒。
+ */
+export declare function rejectedDelegations(granter: CapabilityResolution, requested: readonly string[]): string[];
+//# sourceMappingURL=capability-model.d.ts.map

package/dist/capability-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-model.d.ts","sourceRoot":"","sources":["../src/capability-model.ts"],"names":[],"mappings":"AAWA,4DAA4D;AAC5D,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAKlE;AAMD,sCAAsC;AACtC,wBAAgB,WAAW,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAG/E;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAI7E;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAGzG"}

package/dist/capability-model.js

@@ -0,0 +1,53 @@
+// ════════════════════════════════════════════════════════════
+// 纯能力委托模型 —— feat/auth-capability 重构基石（纯函数，无副作用，便于单测）
+//
+// 用「能力 + 默认可见性 public/restricted + 委托加减」替代数字等级：
+//   - 能力是 glob 标识（tool:x / command:x / storage:path:...:write / *）。
+//   - 作者为每个操作声明默认可见性：public（默认所有人可用）/ restricted（默认禁，需授予）。
+//   - 用户有效能力 = owner ? 全部 : (所有 public ∪ 被授予的 restricted) − 被禁用的；deny 优先。
+//   - 委托子集约束：非 owner 授予方只能把「自己当前有效持有」的能力委托给下层，
+//     单调递减、天然防越权。owner = `*`，可委托一切。
+// ════════════════════════════════════════════════════════════
+/** 单条能力 glob 匹配：`*` 通配任意字符段。pattern 为 glob，value 为具体能力串。 */
+export function capMatches(pattern, value) {
+    if (pattern === '*' || pattern === value)
+        return true;
+    if (!pattern.includes('*'))
+        return false;
+    const re = new RegExp(`^${pattern.split('*').map(escapeRegExp).join('.*')}$`);
+    return re.test(value);
+}
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/** value 是否被 patterns 中任一 glob 命中。 */
+export function matchAnyCap(patterns, value) {
+    for (const p of patterns)
+        if (capMatches(p, value))
+            return true;
+    return false;
+}
+/**
+ * 用户对某具体能力是否有效。优先级：deny > owner(*) > public > granted(restricted)。
+ * 注意 deny 高于 owner——owner 也可被显式 deny 某能力（如临时收回）。
+ */
+export function hasCapability(res, cap) {
+    if (matchAnyCap(res.denies, cap))
+        return false;
+    if (res.isOwner)
+        return true;
+    return matchAnyCap(res.publicCaps, cap) || matchAnyCap(res.grants, cap);
+}
+/**
+ * 委托子集约束：授予方把 requested 能力委托给下层是否合法。
+ * owner 可委托一切；非 owner 只能委托「自己当前有效持有」的能力（防越权放大）。
+ * 返回越权（不可委托）的能力项；空数组 = 全部合法。
+ *
+ * 语义：具体能力按 hasCapability 判定；委托更宽的 glob（超出自己持有的）会被拒。
+ */
+export function rejectedDelegations(granter, requested) {
+    if (granter.isOwner)
+        return [];
+    return requested.filter(cap => !hasCapability(granter, cap));
+}
+//# sourceMappingURL=capability-model.js.map

package/dist/capability-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-model.js","sourceRoot":"","sources":["../src/capability-model.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,sDAAsD;AACtD,EAAE;AACF,gDAAgD;AAChD,oEAAoE;AACpE,2DAA2D;AAC3D,0EAA0E;AAC1E,+CAA+C;AAC/C,oCAAoC;AACpC,+DAA+D;AAE/D,4DAA4D;AAC5D,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,KAAa;IACvD,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9E,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,WAAW,CAAC,QAA2B,EAAE,KAAa;IACpE,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,IAAI,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAgBD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAyB,EAAE,GAAW;IAClE,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA6B,EAAE,SAA4B;IAC7F,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAC/B,OAAO,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/index.d.ts

@@ -1,91 +1,6 @@
-import type { ConfigManager, Context, Logger, PluginModule } from '@aalis/core';
-import type { UserIdentity } from '@aalis/plugin-authority-api';
-import { type StorageService } from '@aalis/plugin-storage-api';
-import type { AuthorityService, AuthorityUserEntry, AuthorizeRequest, DangerousConfirmHandler, DangerousConfirmRequest, DangerousGrant, UserCapabilityOverrides } from './types.js';
-export type { AuthorityService, DangerousConfirmHandler, DangerousConfirmRequest, DangerousConfirmResult, DangerousGrant, DangerousGrantRequest, } from './types.js';
-export declare class AuthorityManager implements AuthorityService {
-    private users;
-    /** 反向绑定索引：被绑平台身份键 → 主账户键（从 users[].links 重建） */
-    private linkIndex;
-    /** 待消费绑定码（内存态） */
-    private bindCodes;
-    private config;
-    private logger;
-    private storage;
-    private fileUri;
-    private dirty;
-    private saveChain;
-    private confirmHandlers;
-    private dangerousGrants;
-    private grantSeq;
-    /**
-     * dangerous 策略的开启时间（运行时状态，不序列化到 config）。
-     * 进程重启后重置为 null，对限时策略而言等同于「重启即失效」。
-     */
-    private dangerousEnabledAt;
-    constructor(config: ConfigManager, logger: Logger, storage: StorageService);
-    getAuthority(platform: string, userId?: string): number;
-    setAuthority(platform: string, userId: string, level: number): void;
-    removeUser(platform: string, userId: string): void;
-    /** 从 users[].links 重建反向索引（表很小，全量重建即可） */
-    private rebuildLinkIndex;
-    createBindCode(platform: string, userId: string): {
-        code: string;
-        expiresAt: number;
-    };
-    consumeBindCode(code: string, identity: UserIdentity): UserIdentity;
-    unlinkIdentity(platform: string, userId: string): boolean;
-    setPassword(platform: string, userId: string, password: string): Promise<void>;
-    verifyPassword(platform: string, userId: string, password: string): Promise<boolean>;
-    hasPassword(platform: string, userId: string): boolean;
-    setUserCapabilities(platform: string, userId: string, overrides: UserCapabilityOverrides): void;
-    /**
-     * capability 中心统一闸。裁决优先级（per-capability）：
-     * 全局 permissionPolicy > 用户 deny > 用户 grant > 角色链等级门槛。
-     *
-     * 等级门槛 = max(declaredAuthority, requiredAuthorityFor([cap]))——
-     * 即"操作声明的基础等级"与"capability 归属角色包"取较高者，只升不降。
-     */
-    authorize(identity: {
-        platform: string;
-        userId?: string;
-    }, request: AuthorizeRequest): string | null;
-    isDangerousAllowed(name: string, permissions?: string[]): boolean;
-    /** 刷新 dangerous 策略启动时间戳（运行时状态） */
-    markDangerousEnabled(): void;
-    /** 清除 dangerous 策略启动时间戳 */
-    clearDangerousEnabled(): void;
-    setConfirmHandler(platform: string, handler: DangerousConfirmHandler): void;
-    confirmDangerous(request: DangerousConfirmRequest): Promise<boolean>;
-    /**
-     * 计算一组细粒度权限所要求的最低权限等级（参数级动态提权）。
-     *
-     * 例如 file_write 写普通文件只需声明的 authority:3，但写 data:/users.json
-     * （用户权限表）或 data:/scheduler-jobs.json（计划任务，可注入 owner 身份的
-     * actor）这类敏感文件、或写 aalis:/ 源码根（重启后即任意代码执行）时要求
-     * owner 等级，防止低权限用户借文件写入自我提权。
-     *
-     * 默认保护清单可被 config.permissionAuthority 覆盖/扩展（同模式取配置值，
-     * 新模式叠加；命中多个模式时取最大要求）。只提高门槛，不降低声明值。
-     */
-    /** 参数级提权完整清单（内置保护 + config.permissionAuthority 合并后；展示与裁决共用同一真源） */
-    getEscalationMap(): Record<string, number>;
-    requiredAuthorityFor(permissions: string[]): number;
-    checkPermissionPolicy(permissions: string[]): string | null;
-    private matchAny;
-    private matchPattern;
-    listDangerousGrants(): DangerousGrant[];
-    revokeDangerousGrant(id: string): boolean;
-    private normalizeConfirmResult;
-    private consumeDangerousGrant;
-    private createDangerousGrant;
-    private pruneDangerousGrants;
-    private samePermissions;
-    isOwner(platform: string, userId?: string): boolean;
-    listUsers(): AuthorityUserEntry[];
-    save(): void;
-    init(): Promise<void>;
-}
+import type { Context, PluginModule } from '@aalis/core';
+export type { AuthorityService } from '@aalis/plugin-authority-api';
+export { AuthorityManager } from './authority-manager.js';
 export declare const name = "@aalis/plugin-authority";
 export declare const displayName = "\u6743\u9650\u7BA1\u7406";
 export declare const subsystem = "authority";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAc,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,KAAK,EAAsC,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAIpG,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAItF,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EAEvB,cAAc,EACd,uBAAuB,EACxB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,cAAc,EACd,qBAAqB,GACtB,MAAM,YAAY,CAAC;AA4DpB,qBAAa,gBAAiB,YAAW,gBAAgB;IACvD,OAAO,CAAC,KAAK,CAAiC;IAC9C,gDAAgD;IAChD,OAAO,CAAC,SAAS,CAA6B;IAC9C,kBAAkB;IAClB,OAAO,CAAC,SAAS,CAAsC;IACvD,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,SAAS,CAAoC;IACrD,OAAO,CAAC,eAAe,CAA8C;IACrE,OAAO,CAAC,eAAe,CAAqC;IAC5D,OAAO,CAAC,QAAQ,CAAK;IACrB;;;OAGG;IACH,OAAO,CAAC,kBAAkB,CAAuB;gBAErC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc;IAO1E,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM;IAmBvD,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAOnE,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAUlD,yCAAyC;IACzC,OAAO,CAAC,gBAAgB;IAOxB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAerF,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,YAAY;IAqCnE,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAenD,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9E,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAU1F,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAItD,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,uBAAuB,GAAG,IAAI;IAsB/F;;;;;;OAMG;IACH,SAAS,CAAC,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI;IA8BpG,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,GAAE,MAAM,EAAO,GAAG,OAAO;IAerE,kCAAkC;IAClC,oBAAoB,IAAI,IAAI;IAI5B,2BAA2B;IAC3B,qBAAqB,IAAI,IAAI;IAI7B,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,GAAG,IAAI;IAIrE,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IA0B1E;;;;;;;;;;OAUG;IACH,mEAAmE;IACnE,gBAAgB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAa1C,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM;IASnD,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI;IAc3D,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,YAAY;IAMpB,mBAAmB,IAAI,cAAc,EAAE;IAKvC,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAMzC,OAAO,CAAC,sBAAsB;IAI9B,OAAO,CAAC,qBAAqB;IAkB7B,OAAO,CAAC,oBAAoB;IAyB5B,OAAO,CAAC,oBAAoB;IAU5B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO;IAOnD,SAAS,IAAI,kBAAkB,EAAE;IA+BjC,IAAI,IAAI,IAAI;IAmBN,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CA6B5B;AAID,eAAO,MAAM,IAAI,4BAA4B,CAAC;AAC9C,eAAO,MAAM,WAAW,6BAAS,CAAC;AAClC,eAAO,MAAM,SAAS,cAAc,CAAC;AACrC,eAAO,MAAM,QAAQ,UAAgB,CAAC;AACtC,eAAO,MAAM,MAAM;;CAElB,CAAC;AA0CF,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAkIzF;AAID,eAAO,MAAM,OAAO,EAAE,YAAY,CAAC,SAAS,CAikB3C,CAAC;AAMF,eAAO,MAAM,WAAW,EAAE,YAAY,CAAC,aAAa,CAKnD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAgBrE,YAAY,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAI1D,eAAO,MAAM,IAAI,4BAA4B,CAAC;AAC9C,eAAO,MAAM,WAAW,6BAAS,CAAC;AAClC,eAAO,MAAM,SAAS,cAAc,CAAC;AACrC,eAAO,MAAM,QAAQ,UAAgB,CAAC;AACtC,eAAO,MAAM,MAAM;;CAElB,CAAC;AAoCF,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAwIzF;AAUD,eAAO,MAAM,OAAO,EAAE,YAAY,CAAC,SAAS,CAgV3C,CAAC;AAIF,eAAO,MAAM,WAAW,EAAE,YAAY,CAAC,aAAa,CAGnD,CAAC"}