@aalis/plugin-authority 0.4.0 → 0.5.0

package/dist/authority-manager.d.ts

@@ -1,5 +1,5 @@
 import type { ConfigManager, Logger } from '@aalis/core';
-import type { AccessConfirmHandler, AccessRequest, AuthorityService, AuthorityUserEntry, AuthorizeRequest, TemporaryGrant, UserCapabilityOverrides, UserIdentity } from '@aalis/plugin-authority-api';
+import type { AccessConfirmHandler, AccessRequest, AuthorityService, AuthorityUserEntry, AuthorizeRequest, TemporaryGrant, UserIdentity } from '@aalis/plugin-authority-api';
 import type { StorageService } from '@aalis/plugin-storage-api';
 export declare class AuthorityManager implements AuthorityService {
     private readonly config;
@@ -13,24 +13,28 @@ export declare class AuthorityManager implements AuthorityService {
     constructor(config: ConfigManager, logger: Logger, storage: StorageService);
     init(): Promise<void>;
     isOwner(platform: string, userId?: string): boolean;
-    /** 解析用户能力来源：被绑身份的 grant 以主账户为真源，deny 取自身∪主账户并集 */
-    private resolve;
-    /** 一条能力是否为 restricted（命中内置 + config.restrictedCapabilities） */
-    private isRestrictedCap;
+    /** 触发者有效等级（owner→∞；登记等级；无记录→默认 0）。v1 无访问器（onebot 群角色待 sender.role 透传后接线）。 */
+    private level;
     authorize(identity: {
         platform: string;
         userId?: string;
     }, request: AuthorizeRequest): string | null;
-    setUserCapabilities(granter: UserIdentity | null, target: UserIdentity, caps: UserCapabilityOverrides): void;
+    setUserLevel(target: UserIdentity, level: number): void;
     removeUser(platform: string, userId: string): void;
-    listDelegatees(granter: UserIdentity | null): AuthorityUserEntry[];
     setConfirmHandler(platform: string, handler: AccessConfirmHandler): void;
     /**
-     * 该请求是否已被（白名单/会话内临时委托）放行（内部用，requestAccess 调用）。
-     * restrictedPolicy 白名单是管理员全局策略；会话临时授予按 capability + sessionId 匹配
-     * （一次会话的临时批准不跨会话泄漏到其他会话）。
+     * 该请求是否被 owner **预先**放行（白名单 / 该用户在本会话已有的临时授予）——**绝不**含"问发起者本人"。
+     * 先过绝对闸（任何放行都不得绕过）：硬禁 deniedCapabilities。
+     * 再看：restrictedPolicy 全局白名单（自动化免确认）或 会话临时授予。
+     * 临时授予按 **userId + sessionId + capability** 匹配 —— 群内 sessionId 全群共享时，不跨用户泄漏。
      */
     private isTemporarilyAllowed;
+    /**
+     * 守卫「未授权」分支专用闸：请求是否被 owner 预先放行（白名单 / 该用户已有授予），
+     * 且不触犯硬禁 / 资源保护。**绝不询问发起者本人** —— 杜绝低档用户对超档操作自我确认提权。
+     * 守卫拒绝后改调本方法（而非 requestAccess），requestAccess 仅用于「已授权但需意图确认」。
+     */
+    isPreApproved(request: AccessRequest): boolean;
     requestAccess(request: AccessRequest): Promise<boolean>;
     listTemporaryGrants(): TemporaryGrant[];
     revokeTemporaryGrant(id: string): boolean;
@@ -40,15 +44,6 @@ export declare class AuthorityManager implements AuthorityService {
     private createTempGrant;
     private pruneTempGrants;
     listUsers(): AuthorityUserEntry[];
-    setPassword(platform: string, userId: string, password: string): Promise<void>;
-    verifyPassword(platform: string, userId: string, password: string): Promise<boolean>;
-    hasPassword(platform: string, userId: string): boolean;
-    createBindCode(platform: string, userId: string): {
-        code: string;
-        expiresAt: number;
-    };
-    consumeBindCode(code: string, identity: UserIdentity): UserIdentity;
-    unlinkIdentity(platform: string, userId: string): boolean;
     save(): void;
 }
 //# sourceMappingURL=authority-manager.d.ts.map

package/dist/authority-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authority-manager.d.ts","sourceRoot":"","sources":["../src/authority-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EACV,oBAAoB,EAEpB,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAEhB,cAAc,EACd,uBAAuB,EACvB,YAAY,EACb,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AA+BhE,qBAAa,gBAAiB,YAAW,gBAAgB;IASrD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IATzB,OAAO,CAAC,KAAK,CAAY;IACzB,OAAO,CAAC,eAAe,CAA2C;IAClE,OAAO,CAAC,UAAU,CAAqC;IACvD,OAAO,CAAC,QAAQ,CAAK;IACrB,sDAAsD;IACtD,OAAO,CAAC,eAAe,CAAuB;gBAG3B,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,EAC/B,OAAO,EAAE,cAAc;IAKzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAKrB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO;IAOnD,kDAAkD;IAClD,OAAO,CAAC,OAAO;IAWf,+DAA+D;IAC/D,OAAO,CAAC,eAAe;IAOvB,SAAS,CAAC,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI;IA4BpG,mBAAmB,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,uBAAuB,GAAG,IAAI;IAkC5G,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAIlD,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,GAAG,kBAAkB,EAAE;IAWlE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,IAAI;IAIxE;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAmBtB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB7D,mBAAmB,IAAI,cAAc,EAAE;IAKvC,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAMzC,iBAAiB,IAAI,IAAI;IAIzB,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,eAAe;IAwBvB,OAAO,CAAC,eAAe;IAQvB,SAAS,IAAI,kBAAkB,EAAE;IA8BjC,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAG9E,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAGpF,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAGtD,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAGrF,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,YAAY;IAGnE,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAGzD,IAAI,IAAI,IAAI;CAGb"}
+{"version":3,"file":"authority-manager.d.ts","sourceRoot":"","sources":["../src/authority-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EACV,oBAAoB,EAEpB,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACb,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAahE,qBAAa,gBAAiB,YAAW,gBAAgB;IASrD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IATzB,OAAO,CAAC,KAAK,CAAY;IACzB,OAAO,CAAC,eAAe,CAA2C;IAClE,OAAO,CAAC,UAAU,CAAqC;IACvD,OAAO,CAAC,QAAQ,CAAK;IACrB,sDAAsD;IACtD,OAAO,CAAC,eAAe,CAAuB;gBAG3B,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,EAC/B,OAAO,EAAE,cAAc;IAKzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAKrB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO;IAOnD,6EAA6E;IAC7E,OAAO,CAAC,KAAK;IAOb,SAAS,CAAC,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI;IAoBpG,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAYvD,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAKlD,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,IAAI;IAIxE;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAyB5B;;;;OAIG;IACH,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO;IAIxC,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAqB7D,mBAAmB,IAAI,cAAc,EAAE;IAKvC,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAMzC,iBAAiB,IAAI,IAAI;IAIzB,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,eAAe;IAwBvB,OAAO,CAAC,eAAe;IAQvB,SAAS,IAAI,kBAAkB,EAAE;IAiBjC,IAAI,IAAI,IAAI;CAGb"}

package/dist/authority-manager.js

@@ -1,21 +1,13 @@
-import { hasCapability, matchAnyCap, rejectedDelegations } from './capability-model.js';
+import { DEFAULT_AUTHORITY, matchAnyCap, OWNER_RANK, resolveAccess, resolveMinLevel } from './authority-model.js';
 import { UserStore } from './user-store.js';
 // ════════════════════════════════════════════════════════════
-// AuthorityManager —— 纯能力委托模型的 AuthorityService 实现（策略层）
+// AuthorityManager —— 数字等级单轴的 AuthorityService 实现（策略层）
 //
-// owner=`*`；用户有效能力 = (public ∪ 授予的 restricted) − denied；
-// 委托子集约束（非 owner 只能授予自己持有的）；restricted 能力的临时委托。
-// 数据层（users.json v3 / 绑定 / 密码）委托给 UserStore；纯判定见 capability-model。
+// owner=∞；每个外部身份一个登记等级（缺省 0，封禁=负数）；操作一个 minLevel（risk/visibility/authorityOverrides 派生）；
+// 裁决 deniedCapabilities(全局硬禁) > owner > level>=minLevel（纯函数在 authority-model）。
+// confirm 轴 + 临时放行正交保留。
+// 数据层（users.json v5 等级存储）委托给 UserStore。
 // ════════════════════════════════════════════════════════════
-/** 内置受限能力：写用户表 / 计划任务 / 源码根 —— 默认禁、仅 owner 或被授予者可触达 */
-const BUILTIN_RESTRICTED = [
-    'storage:path:data:/users.json:write',
-    'storage:path:data:/users.json:delete',
-    'storage:path:data:/scheduler-jobs.json:write',
-    'storage:path:data:/scheduler-jobs.json:delete',
-    'storage:aalis:write',
-    'storage:aalis:delete',
-];
 export class AuthorityManager {
     config;
     logger;
@@ -42,102 +34,65 @@ export class AuthorityManager {
         const owners = this.config.get('owners') ?? [];
         return owners.some((o) => o.platform === platform && o.userId === userId);
     }
-    /** 解析用户能力来源：被绑身份的 grant 以主账户为真源，deny 取自身∪主账户并集 */
-    resolve(platform, userId) {
-        const isOwner = this.isOwner(platform, userId);
-        const ownKey = userId ? `${platform}:${userId}` : undefined;
-        const ownRecord = ownKey ? this.store.get(ownKey) : undefined;
-        const accountKey = ownKey ? this.store.accountOf(ownKey) : undefined;
-        const accountRecord = accountKey ? this.store.get(accountKey) : undefined;
-        const grants = (accountKey ? accountRecord?.caps?.grant : ownRecord?.caps?.grant) ?? [];
-        const denies = [...(ownRecord?.caps?.deny ?? []), ...(accountRecord?.caps?.deny ?? [])];
-        return { isOwner, grants, denies };
+    /** 触发者有效等级（owner→∞；登记等级；无记录→默认 0）。v1 无访问器（onebot 群角色待 sender.role 透传后接线）。 */
+    level(platform, userId) {
+        if (this.isOwner(platform, userId))
+            return OWNER_RANK;
+        const key = userId ? `${platform}:${userId}` : undefined;
+        return (key ? this.store.get(key)?.level : undefined) ?? DEFAULT_AUTHORITY;
     }
-    /** 一条能力是否为 restricted（命中内置 + config.restrictedCapabilities） */
-    isRestrictedCap(cap) {
-        if (matchAnyCap(BUILTIN_RESTRICTED, cap))
-            return true;
-        const extra = this.config.get('restrictedCapabilities') ?? [];
-        return matchAnyCap(extra, cap);
-    }
-    // ── 能力统一闸（静态判定；临时委托在 requestAccess）──────────
+    // ── 统一权限闸（等级静态判定；临时放行/确认在 requestAccess）──────────
     authorize(identity, request) {
-        const res = this.resolve(identity.platform, identity.userId);
-        const denied = this.config.get('deniedCapabilities') ?? [];
-        const check = (cap, restricted) => {
-            // 全局硬禁用：连 owner 都压过
-            if (matchAnyCap(denied, cap))
-                return `已被系统禁用: ${cap}`;
-            // 复用纯模型：deny > owner > (public→放行) > granted
-            const ok = hasCapability({ isOwner: res.isOwner, publicCaps: restricted ? [] : [cap], grants: res.grants, denies: res.denies }, cap);
-            if (ok)
-                return null;
-            return restricted ? `权限不足: "${cap}" 需授予后使用` : `已被禁止: ${cap}`;
-        };
-        // 主能力：可见性由调用方传入（已应用 visibilityOverrides）
-        const primary = check(request.capability, request.visibility === 'restricted');
-        if (primary)
-            return primary;
-        // 资源能力：受限性由 restrictedCapabilities 判定
-        for (const cap of request.resourceCapabilities ?? []) {
-            const rejection = check(cap, this.isRestrictedCap(cap));
-            if (rejection)
-                return rejection;
+        const level = this.level(identity.platform, identity.userId);
+        const isOwner = this.isOwner(identity.platform, identity.userId);
+        const denied = (this.config.get('deniedCapabilities') ?? []);
+        const authorityOverrides = (this.config.get('authorityOverrides') ?? {});
+        // 主能力：minLevel 由 authorityOverrides > risk > visibility 派生
+        const minLevel = resolveMinLevel(request.capability, {
+            authorityOverrides,
+            risk: request.risk,
+            visibility: request.visibility,
+        });
+        if (!resolveAccess({ level, minLevel, isOwner, denied, capability: request.capability })) {
+            if (matchAnyCap(denied, request.capability))
+                return `已被系统禁用: ${request.capability}`;
+            return `权限不足: "${request.capability}" 需等级 ${minLevel}（当前 ${level}）`;
         }
         return null;
     }
-    // ── 委托（子集约束）────────────────────────────────────────
-    setUserCapabilities(granter, target, caps) {
-        const normalize = (list) => {
-            const cleaned = [...new Set((list ?? []).map(p => p.trim()).filter(Boolean))];
-            return cleaned.length > 0 ? cleaned : undefined;
-        };
-        const grant = normalize(caps.grant);
-        const deny = normalize(caps.deny);
-        // 子集约束：非 owner 授予方只能授予自己持有的能力（单调递减防越权）
-        if (granter && !this.isOwner(granter.platform, granter.userId)) {
-            const gRes = this.resolve(granter.platform, granter.userId);
-            const bad = rejectedDelegations({ isOwner: false, publicCaps: [], grants: gRes.grants, denies: gRes.denies }, grant ?? []);
-            if (bad.length > 0) {
-                throw new Error(`越权：你不持有这些能力，无法授予：${bad.join('、')}`);
-            }
-        }
+    // ── 等级设置（owner 管理；单轴，无 per-user 特批）──────────
+    setUserLevel(target, level) {
         const key = `${target.platform}:${target.userId}`;
         const existing = this.store.get(key);
-        const grantedBy = granter ? `${granter.platform}:${granter.userId}` : existing?.grantedBy;
-        const next = { ...existing, caps: grant || deny ? { grant, deny } : undefined, grantedBy };
-        if (!next.caps && !next.secret && !next.links) {
+        // 默认等级(0)且无备注 → 直接清记录（保持 users.json 精简）
+        if (level === DEFAULT_AUTHORITY && !existing?.note) {
             this.store.delete(key);
         }
         else {
-            this.store.set(key, next);
+            this.store.set(key, { ...existing, level });
         }
-        this.logger.debug(`设置能力委托: ${key} grant=${grant?.length ?? 0} deny=${deny?.length ?? 0} by=${grantedBy ?? '-'}`);
+        this.logger.debug(`设置等级: ${key} → ${level}`);
     }
     removeUser(platform, userId) {
         if (this.store.delete(`${platform}:${userId}`))
             this.logger.debug(`删除用户记录: ${platform}:${userId}`);
     }
-    listDelegatees(granter) {
-        const granterKey = granter ? `${granter.platform}:${granter.userId}` : null;
-        return this.listUsers().filter(u => {
-            const entry = this.store.get(`${u.platform}:${u.userId}`);
-            // owner（null）列顶层：无 grantedBy 且非 owner 自身的用户
-            if (granterKey === null)
-                return !entry?.grantedBy && !u.isOwner;
-            return entry?.grantedBy === granterKey;
-        });
-    }
     // ── 临时能力委托（restricted 能力的时限/限次放行）──────────────
     setConfirmHandler(platform, handler) {
         this.confirmHandlers.set(platform, handler);
     }
     /**
-     * 该请求是否已被（白名单/会话内临时委托）放行（内部用，requestAccess 调用）。
-     * restrictedPolicy 白名单是管理员全局策略；会话临时授予按 capability + sessionId 匹配
-     * （一次会话的临时批准不跨会话泄漏到其他会话）。
+     * 该请求是否被 owner **预先**放行（白名单 / 该用户在本会话已有的临时授予）——**绝不**含"问发起者本人"。
+     * 先过绝对闸（任何放行都不得绕过）：硬禁 deniedCapabilities。
+     * 再看：restrictedPolicy 全局白名单（自动化免确认）或 会话临时授予。
+     * 临时授予按 **userId + sessionId + capability** 匹配 —— 群内 sessionId 全群共享时，不跨用户泄漏。
      */
     isTemporarilyAllowed(request) {
+        const denied = (this.config.get('deniedCapabilities') ?? []);
+        // 硬禁绝对：主能力命中 deniedCapabilities 时，任何放行路径都不得绕过
+        if (matchAnyCap(denied, request.capability))
+            return false;
+        // owner 全局白名单（自动化免确认）
         const policy = this.config.get('restrictedPolicy');
         if (policy?.allow && policy.allow.length > 0) {
             if (!policy.duration ||
@@ -147,26 +102,41 @@ export class AuthorityManager {
                     return true;
             }
         }
+        // 会话临时授予：同一用户 + 同会话 + 同能力（userId 必须匹配，防群内跨用户白嫖）
         this.pruneTempGrants();
         for (const g of this.tempGrants.values()) {
             if (g.sessionId !== request.sessionId)
                 continue;
+            if (g.userId !== request.userId)
+                continue;
             if (g.capability === request.capability || matchAnyCap([g.capability], request.capability))
                 return true;
         }
         return false;
     }
+    /**
+     * 守卫「未授权」分支专用闸：请求是否被 owner 预先放行（白名单 / 该用户已有授予），
+     * 且不触犯硬禁 / 资源保护。**绝不询问发起者本人** —— 杜绝低档用户对超档操作自我确认提权。
+     * 守卫拒绝后改调本方法（而非 requestAccess），requestAccess 仅用于「已授权但需意图确认」。
+     */
+    isPreApproved(request) {
+        return this.isTemporarilyAllowed(request);
+    }
     async requestAccess(request) {
-        if (this.isTemporarilyAllowed(request)) {
+        // confirm='always'：每次都问，不接受白名单/会话记忆（最高危）
+        const always = request.confirm === 'always';
+        if (!always && this.isTemporarilyAllowed(request)) {
             this.consumeTempGrant(request);
             return true;
         }
-        const handler = this.confirmHandlers.get(request.platform);
+        // 精确平台 handler 优先（如 WebUI 的 WS 确认）；否则落到 '*' 通配 fallback
+        // （plugin-session-confirm 注册，经 gateway 总线覆盖 onebot/cli/任何会话型平台）。
+        const handler = this.confirmHandlers.get(request.platform) ?? this.confirmHandlers.get('*');
         if (!handler)
             return false;
         try {
             const decision = this.normalizeDecision(await handler(request));
-            if (decision.allowed && decision.grant?.scope === 'session')
+            if (!always && decision.allowed && decision.grant?.scope === 'session')
                 this.createTempGrant(request, decision);
             return decision.allowed;
         }
@@ -197,6 +167,8 @@ export class AuthorityManager {
                 continue;
             if (g.sessionId !== request.sessionId)
                 continue;
+            if (g.userId !== request.userId)
+                continue;
             g.used++;
             if (g.maxUses && g.used >= g.maxUses)
                 this.tempGrants.delete(g.id);
@@ -243,44 +215,12 @@ export class AuthorityManager {
                 platform,
                 userId,
                 isOwner: this.isOwner(platform, userId),
-                grant: record.caps?.grant,
-                deny: record.caps?.deny,
-                grantedBy: record.grantedBy,
-                hasPassword: record.secret ? true : undefined,
-                links: record.links,
-                linkedTo: this.store.accountOf(key),
+                level: record.level ?? DEFAULT_AUTHORITY,
+                note: record.note,
             });
         }
-        // 无自身记录的被绑身份也可见
-        for (const [identityKey, accountKey] of this.store.links()) {
-            if (this.store.get(identityKey))
-                continue;
-            const idx = identityKey.indexOf(':');
-            const platform = identityKey.slice(0, idx);
-            const userId = identityKey.slice(idx + 1);
-            result.push({ platform, userId, isOwner: this.isOwner(platform, userId), linkedTo: accountKey });
-        }
         return result;
     }
-    // ── 密码 / 绑定（委托给 UserStore）──────────────────────────
-    setPassword(platform, userId, password) {
-        return this.store.setPassword(platform, userId, password);
-    }
-    verifyPassword(platform, userId, password) {
-        return this.store.verifyPassword(platform, userId, password);
-    }
-    hasPassword(platform, userId) {
-        return this.store.hasPassword(platform, userId);
-    }
-    createBindCode(platform, userId) {
-        return this.store.createBindCode(platform, userId);
-    }
-    consumeBindCode(code, identity) {
-        return this.store.consumeBindCode(code, identity);
-    }
-    unlinkIdentity(platform, userId) {
-        return this.store.unlinkIdentity(platform, userId);
-    }
     save() {
         this.store.save();
     }

package/dist/authority-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"authority-manager.js","sourceRoot":"","sources":["../src/authority-manager.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,+DAA+D;AAC/D,wDAAwD;AACxD,EAAE;AACF,yDAAyD;AACzD,gDAAgD;AAChD,mEAAmE;AACnE,+DAA+D;AAE/D,uDAAuD;AACvD,MAAM,kBAAkB,GAAsB;IAC5C,qCAAqC;IACrC,sCAAsC;IACtC,8CAA8C;IAC9C,+CAA+C;IAC/C,qBAAqB;IACrB,sBAAsB;CACvB,CAAC;AAWF,MAAM,OAAO,gBAAgB;IASR;IACA;IATX,KAAK,CAAY;IACjB,eAAe,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC1D,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC/C,QAAQ,GAAG,CAAC,CAAC;IACrB,sDAAsD;IAC9C,eAAe,GAAkB,IAAI,CAAC;IAE9C,YACmB,MAAqB,EACrB,MAAc,EAC/B,OAAuB;QAFN,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAQ;QAG/B,IAAI,CAAC,KAAK,GAAG,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,6DAA6D;IAC7D,OAAO,CAAC,QAAgB,EAAE,MAAe;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,KAAK,CAAC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACtF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAe,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC1F,CAAC;IAED,kDAAkD;IAC1C,OAAO,CAAC,QAAgB,EAAE,MAAe;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACxF,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QACxF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACrC,CAAC;IAED,+DAA+D;IACvD,eAAe,CAAC,GAAiB;QACvC,IAAI,WAAW,CAAC,kBAAkB,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC;QAC9D,OAAO,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,+CAA+C;IAC/C,SAAS,CAAC,QAA+C,EAAE,OAAyB;QAClF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;QAE3D,MAAM,KAAK,GAAG,CAAC,GAAiB,EAAE,UAAmB,EAAiB,EAAE;YACtE,oBAAoB;YACpB,IAAI,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC;gBAAE,OAAO,WAAW,GAAG,EAAE,CAAC;YACtD,6CAA6C;YAC7C,MAAM,EAAE,GAAG,aAAa,CACtB,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EACrG,GAAG,CACJ,CAAC;YACF,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAC;YACpB,OAAO,UAAU,CAAC,CAAC,CAAC,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC;QAC/D,CAAC,CAAC;QAEF,yCAAyC;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC;QAC/E,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,sCAAsC;QACtC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,oBAAoB,IAAI,EAAE,EAAE,CAAC;YACrD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;YACxD,IAAI,SAAS;gBAAE,OAAO,SAAS,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sDAAsD;IACtD,mBAAmB,CAAC,OAA4B,EAAE,MAAoB,EAAE,IAA6B;QACnG,MAAM,SAAS,GAAG,CAAC,IAAe,EAAwB,EAAE;YAC1D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC9E,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAElC,uCAAuC;QACvC,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,mBAAmB,CAC7B,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC5E,KAAK,IAAI,EAAE,CACZ,CAAC;YACF,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC1F,MAAM,IAAI,GAAG,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC;QAC3F,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,WAAW,GAAG,UAAU,KAAK,EAAE,MAAM,IAAI,CAAC,SAAS,IAAI,EAAE,MAAM,IAAI,CAAC,OAAO,SAAS,IAAI,GAAG,EAAE,CAC9F,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,QAAgB,EAAE,MAAc;QACzC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,cAAc,CAAC,OAA4B;QACzC,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1D,4CAA4C;YAC5C,IAAI,UAAU,KAAK,IAAI;gBAAE,OAAO,CAAC,KAAK,EAAE,SAAS,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAChE,OAAO,KAAK,EAAE,SAAS,KAAK,UAAU,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iDAAiD;IACjD,iBAAiB,CAAC,QAAgB,EAAE,OAA6B;QAC/D,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACK,oBAAoB,CAAC,OAAsB;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,MAAM,EAAE,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,IACE,CAAC,MAAM,CAAC,QAAQ;gBAChB,MAAM,CAAC,QAAQ,IAAI,CAAC;gBACpB,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,EACvF,CAAC;gBACD,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC;oBAAE,OAAO,IAAI,CAAC;YACjE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBAAE,SAAS;YAChD,IAAI,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC1G,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAsB;QACxC,IAAI,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;YAChE,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE,KAAK,KAAK,SAAS;gBAAE,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACrG,OAAO,QAAQ,CAAC,OAAO,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,mBAAmB;QACjB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,oBAAoB,CAAC,EAAU;QAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,EAAE;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC7C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,iBAAiB;QACf,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACpC,CAAC;IAEO,iBAAiB,CAAC,MAAgC;QACxD,OAAO,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACpE,CAAC;IAEO,gBAAgB,CAAC,OAAsB;QAC7C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;gBAAE,SAAS;YAClD,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBAAE,SAAS;YAChD,CAAC,CAAC,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO;gBAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,OAAsB,EAAE,QAAwB;QACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QAC9C,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACjF,MAAM,KAAK,GAAmB;YAC5B,EAAE,EAAE,SAAS,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;YAC5C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,GAAG,IAAI;YAC9C,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,CAAC;YACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,aAAa,KAAK,CAAC,UAAU,YAAY,KAAK,CAAC,SAAS,IAAI,eAAe,WAAW,KAAK,CAAC,EAAE,EAAE,CACjG,CAAC;IACJ,CAAC;IAEO,eAAe;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACtC,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC;gBAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,SAAS;QACP,MAAM,MAAM,GAAyB,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ;gBACR,MAAM;gBACN,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACvC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;gBAC7C,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QACD,gBAAgB;QAChB,KAAK,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAC3D,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;YAC1C,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sDAAsD;IACtD,WAAW,CAAC,QAAgB,EAAE,MAAc,EAAE,QAAgB;QAC5D,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5D,CAAC;IACD,cAAc,CAAC,QAAgB,EAAE,MAAc,EAAE,QAAgB;QAC/D,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IACD,WAAW,CAAC,QAAgB,EAAE,MAAc;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IACD,cAAc,CAAC,QAAgB,EAAE,MAAc;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IACD,eAAe,CAAC,IAAY,EAAE,QAAsB;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;IACD,cAAc,CAAC,QAAgB,EAAE,MAAc;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IACD,IAAI;QACF,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;CACF"}
+{"version":3,"file":"authority-manager.js","sourceRoot":"","sources":["../src/authority-manager.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAClH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,+DAA+D;AAC/D,uDAAuD;AACvD,EAAE;AACF,yFAAyF;AACzF,+EAA+E;AAC/E,wBAAwB;AACxB,wCAAwC;AACxC,+DAA+D;AAE/D,MAAM,OAAO,gBAAgB;IASR;IACA;IATX,KAAK,CAAY;IACjB,eAAe,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC1D,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC/C,QAAQ,GAAG,CAAC,CAAC;IACrB,sDAAsD;IAC9C,eAAe,GAAkB,IAAI,CAAC;IAE9C,YACmB,MAAqB,EACrB,MAAc,EAC/B,OAAuB;QAFN,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAQ;QAG/B,IAAI,CAAC,KAAK,GAAG,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,6DAA6D;IAC7D,OAAO,CAAC,QAAgB,EAAE,MAAe;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,KAAK,CAAC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACtF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAe,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC1F,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,QAAgB,EAAE,MAAe;QAC7C,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC;YAAE,OAAO,UAAU,CAAC;QACtD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,iBAAiB,CAAC;IAC7E,CAAC;IAED,oDAAoD;IACpD,SAAS,CAAC,QAA+C,EAAE,OAAyB;QAClF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAa,CAAC;QACzE,MAAM,kBAAkB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAA2B,CAAC;QAEnG,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,EAAE;YACnD,kBAAkB;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;YACzF,IAAI,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC;gBAAE,OAAO,WAAW,OAAO,CAAC,UAAU,EAAE,CAAC;YACpF,OAAO,UAAU,OAAO,CAAC,UAAU,SAAS,QAAQ,OAAO,KAAK,GAAG,CAAC;QACtE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+CAA+C;IAC/C,YAAY,CAAC,MAAoB,EAAE,KAAa;QAC9C,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,wCAAwC;QACxC,IAAI,KAAK,KAAK,iBAAiB,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;YACnD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,UAAU,CAAC,QAAgB,EAAE,MAAc;QACzC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,iDAAiD;IACjD,iBAAiB,CAAC,QAAgB,EAAE,OAA6B;QAC/D,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACK,oBAAoB,CAAC,OAAsB;QACjD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAa,CAAC;QACzE,8CAA8C;QAC9C,IAAI,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1D,sBAAsB;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,MAAM,EAAE,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,IACE,CAAC,MAAM,CAAC,QAAQ;gBAChB,MAAM,CAAC,QAAQ,IAAI,CAAC;gBACpB,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,EACvF,CAAC;gBACD,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC;oBAAE,OAAO,IAAI,CAAC;YACjE,CAAC;QACH,CAAC;QACD,gDAAgD;QAChD,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBAAE,SAAS;YAChD,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;gBAAE,SAAS;YAC1C,IAAI,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC1G,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,OAAsB;QAClC,OAAO,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAsB;QACxC,yCAAyC;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC;QAC5C,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,wDAAwD;QACxD,iEAAiE;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5F,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE,KAAK,KAAK,SAAS;gBAAE,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAChH,OAAO,QAAQ,CAAC,OAAO,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,mBAAmB;QACjB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,oBAAoB,CAAC,EAAU;QAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,EAAE;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC7C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,iBAAiB;QACf,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACpC,CAAC;IAEO,iBAAiB,CAAC,MAAgC;QACxD,OAAO,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACpE,CAAC;IAEO,gBAAgB,CAAC,OAAsB;QAC7C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;gBAAE,SAAS;YAClD,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBAAE,SAAS;YAChD,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;gBAAE,SAAS;YAC1C,CAAC,CAAC,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO;gBAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,OAAsB,EAAE,QAAwB;QACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QAC9C,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACjF,MAAM,KAAK,GAAmB;YAC5B,EAAE,EAAE,SAAS,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;YAC5C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,GAAG,IAAI;YAC9C,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,CAAC;YACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,aAAa,KAAK,CAAC,UAAU,YAAY,KAAK,CAAC,SAAS,IAAI,eAAe,WAAW,KAAK,CAAC,EAAE,EAAE,CACjG,CAAC;IACJ,CAAC;IAEO,eAAe;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACtC,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC;gBAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,SAAS;QACP,MAAM,MAAM,GAAyB,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ;gBACR,MAAM;gBACN,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACvC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,iBAAiB;gBACxC,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI;QACF,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;CACF"}

package/dist/authority-model.d.ts

@@ -0,0 +1,51 @@
+/** owner 等级（∞）：不入等级轴，靠 owners 列表归属；任何有限门槛都压不过它（防自锁）。 */
+export declare const OWNER_RANK: number;
+/** 未登记外部身份的默认等级。 */
+export declare const DEFAULT_AUTHORITY = 0;
+/** 无 risk 声明、仅标 visibility:'restricted' 的操作的兜底最低等级（≈老版「受信」门槛）。 */
+export declare const RESTRICTED_LEVEL = 2;
+/** 风险 → 操作最低等级：safe→0 · sensitive→1 · dangerous→2（owner 可逐条覆盖成任意整数）。 */
+export declare function riskToLevel(risk?: 'safe' | 'sensitive' | 'dangerous'): number;
+export declare function matchAnyCap(patterns: readonly string[], value: string): boolean;
+/**
+ * 操作最低等级解析：authorityOverrides[cap] > risk 派生 > visibility 兜底。
+ * visibility 兜底仅在拿不到 risk 时用（public→0 / restricted→RESTRICTED_LEVEL）。
+ */
+export declare function resolveMinLevel(capability: string, opts: {
+    authorityOverrides?: Record<string, number>;
+    risk?: 'safe' | 'sensitive' | 'dangerous';
+    visibility?: 'public' | 'restricted';
+}): number;
+/** 一次访问裁决的输入（纯数字单轴）。 */
+interface AccessInput {
+    /** 触发者有效等级（owner→OWNER_RANK；= 登记等级，缺省 DEFAULT_AUTHORITY） */
+    level: number;
+    /** 操作最低等级 */
+    minLevel: number;
+    isOwner: boolean;
+    /** 全局硬禁 glob（config.deniedCapabilities，配置总闸，非 per-user） */
+    denied?: readonly string[];
+    /** 被裁决的能力串（command:x / tool:x / storage:...） */
+    capability: string;
+}
+/** 数字等级裁决（见文件头优先级）。true=放行。 */
+export declare function resolveAccess(input: AccessInput): boolean;
+/**
+ * auto 模式（owner 临时免 session 确认，类 Claude Code auto）是否激活。纯函数。
+ * `until`：-1=一直；>now=截止前激活；其余(0/过期)=关。只影响确认轴，不动等级/deny；always 确认不被它跳过（调用方保证）。
+ */
+export declare function autoConfirmActive(until: number, now: number): boolean;
+/**
+ * 确认轴是否可跳过（纯函数）。**`always` 永不可跳**（最高危：必须每次有人确认；cron 无人确认即拒）。
+ * 非 always 的两种正当跳过：① skipConfirm（系统/受信源如 scheduler，无人可点）；
+ * ② auto 模式 且 触发者是 owner 本人。其余一律不跳。
+ */
+export declare function shouldSkipConfirm(opts: {
+    confirm: 'session' | 'always';
+    skipConfirm: boolean;
+    isOwner: boolean;
+    autoConfirmUntil: number;
+    now: number;
+}): boolean;
+export {};
+//# sourceMappingURL=authority-model.d.ts.map

package/dist/authority-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-model.d.ts","sourceRoot":"","sources":["../src/authority-model.ts"],"names":[],"mappings":"AAcA,wDAAwD;AACxD,eAAO,MAAM,UAAU,QAA2B,CAAC;AACnD,oBAAoB;AACpB,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,WAAW,GAAG,MAAM,CAI7E;AAYD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAG/E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IACJ,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,WAAW,CAAC;IAC1C,UAAU,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CACtC,GACA,MAAM,CAKR;AAED,wBAAwB;AACxB,UAAU,WAAW;IACnB,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,aAAa;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,+BAA+B;AAC/B,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAIzD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAErE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC9B,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAIV"}

package/dist/authority-model.js

@@ -0,0 +1,85 @@
+// ════════════════════════════════════════════════════════════
+// authority-model —— 数字等级裁决引擎（纯函数，无副作用，便于单测）
+//
+// 单 owner 个人 bot 的「好管」权限：每个外部身份一个**整数等级**（越大越高，默认 0，
+// 封禁=负数），每个操作一个**最低等级**（由 risk 派生、owner 可逐条覆盖成任意整数）。
+// owner = ∞（不在等级轴上，靠 owners 列表归属），永不被任何门槛锁出。
+// 裁决优先级（首个命中赢，对齐 Claude Code deny→allow 与老版数字等级）：
+//   1. 全局硬禁 deniedCapabilities  → 拒（压过 owner，保 deny>owner 不变量；配置总闸，非 per-user）
+//   2. owner                        → 放行
+//   3. 等级 level >= 操作 minLevel   → 放行；否则拒（封禁=负数自然连 minLevel=0 都不过）
+// 确认轴（confirm/HITL）正交，不在此函数（owner 也吃，防注入借权）。
+// 内含 glob 工具 matchAnyCap（资源能力/硬禁匹配）。
+// ════════════════════════════════════════════════════════════
+/** owner 等级（∞）：不入等级轴，靠 owners 列表归属；任何有限门槛都压不过它（防自锁）。 */
+export const OWNER_RANK = Number.POSITIVE_INFINITY;
+/** 未登记外部身份的默认等级。 */
+export const DEFAULT_AUTHORITY = 0;
+/** 无 risk 声明、仅标 visibility:'restricted' 的操作的兜底最低等级（≈老版「受信」门槛）。 */
+export const RESTRICTED_LEVEL = 2;
+/** 风险 → 操作最低等级：safe→0 · sensitive→1 · dangerous→2（owner 可逐条覆盖成任意整数）。 */
+export function riskToLevel(risk) {
+    if (risk === 'dangerous')
+        return 2;
+    if (risk === 'sensitive')
+        return 1;
+    return DEFAULT_AUTHORITY; // safe / 未声明
+}
+// ── glob（`*` 通配任意字符段）──────────────
+function capMatches(pattern, value) {
+    if (pattern === '*' || pattern === value)
+        return true;
+    if (!pattern.includes('*'))
+        return false;
+    const re = new RegExp(`^${pattern.split('*').map(escapeRegExp).join('.*')}$`);
+    return re.test(value);
+}
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+export function matchAnyCap(patterns, value) {
+    for (const p of patterns)
+        if (capMatches(p, value))
+            return true;
+    return false;
+}
+/**
+ * 操作最低等级解析：authorityOverrides[cap] > risk 派生 > visibility 兜底。
+ * visibility 兜底仅在拿不到 risk 时用（public→0 / restricted→RESTRICTED_LEVEL）。
+ */
+export function resolveMinLevel(capability, opts) {
+    const ov = opts.authorityOverrides?.[capability];
+    if (ov !== undefined)
+        return ov;
+    if (opts.risk)
+        return riskToLevel(opts.risk);
+    return opts.visibility === 'restricted' ? RESTRICTED_LEVEL : DEFAULT_AUTHORITY;
+}
+/** 数字等级裁决（见文件头优先级）。true=放行。 */
+export function resolveAccess(input) {
+    if (matchAnyCap(input.denied ?? [], input.capability))
+        return false; // 1. 全局硬禁，压过 owner
+    if (input.isOwner)
+        return true; // 2. owner（∞）
+    return input.level >= input.minLevel; // 3. 等级门槛（封禁=负数自然不过）
+}
+/**
+ * auto 模式（owner 临时免 session 确认，类 Claude Code auto）是否激活。纯函数。
+ * `until`：-1=一直；>now=截止前激活；其余(0/过期)=关。只影响确认轴，不动等级/deny；always 确认不被它跳过（调用方保证）。
+ */
+export function autoConfirmActive(until, now) {
+    return until === -1 || (until > 0 && now < until);
+}
+/**
+ * 确认轴是否可跳过（纯函数）。**`always` 永不可跳**（最高危：必须每次有人确认；cron 无人确认即拒）。
+ * 非 always 的两种正当跳过：① skipConfirm（系统/受信源如 scheduler，无人可点）；
+ * ② auto 模式 且 触发者是 owner 本人。其余一律不跳。
+ */
+export function shouldSkipConfirm(opts) {
+    if (opts.confirm === 'always')
+        return false;
+    if (opts.skipConfirm)
+        return true;
+    return opts.isOwner && autoConfirmActive(opts.autoConfirmUntil, opts.now);
+}
+//# sourceMappingURL=authority-model.js.map

package/dist/authority-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-model.js","sourceRoot":"","sources":["../src/authority-model.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,6CAA6C;AAC7C,EAAE;AACF,qDAAqD;AACrD,qDAAqD;AACrD,6CAA6C;AAC7C,kDAAkD;AAClD,+EAA+E;AAC/E,yCAAyC;AACzC,mEAAmE;AACnE,6CAA6C;AAC7C,qCAAqC;AACrC,+DAA+D;AAE/D,wDAAwD;AACxD,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;AACnD,oBAAoB;AACpB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,IAAyC;IACnE,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,CAAC,CAAC;IACnC,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,CAAC,CAAC;IACnC,OAAO,iBAAiB,CAAC,CAAC,aAAa;AACzC,CAAC;AAED,qCAAqC;AACrC,SAAS,UAAU,CAAC,OAAe,EAAE,KAAa;IAChD,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9E,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AACD,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,QAA2B,EAAE,KAAa;IACpE,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,IAAI,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,UAAkB,EAClB,IAIC;IAED,MAAM,EAAE,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC;AACjF,CAAC;AAeD,+BAA+B;AAC/B,MAAM,UAAU,aAAa,CAAC,KAAkB;IAC9C,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,mBAAmB;IACxF,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,CAAC,cAAc;IAC9C,OAAO,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,qBAAqB;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,GAAW;IAC1D,OAAO,KAAK,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAMjC;IACC,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5E,CAAC"}

package/dist/capability-model.d.ts

@@ -20,12 +20,4 @@ export interface CapabilityResolution {
  * 注意 deny 高于 owner——owner 也可被显式 deny 某能力（如临时收回）。
  */
 export declare function hasCapability(res: CapabilityResolution, cap: string): boolean;
-/**
- * 委托子集约束：授予方把 requested 能力委托给下层是否合法。
- * owner 可委托一切；非 owner 只能委托「自己当前有效持有」的能力（防越权放大）。
- * 返回越权（不可委托）的能力项；空数组 = 全部合法。
- *
- * 语义：具体能力按 hasCapability 判定；委托更宽的 glob（超出自己持有的）会被拒。
- */
-export declare function rejectedDelegations(granter: CapabilityResolution, requested: readonly string[]): string[];
 //# sourceMappingURL=capability-model.d.ts.map

package/dist/capability-model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-model.d.ts","sourceRoot":"","sources":["../src/capability-model.ts"],"names":[],"mappings":"AAWA,4DAA4D;AAC5D,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAKlE;AAMD,sCAAsC;AACtC,wBAAgB,WAAW,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAG/E;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAI7E;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAGzG"}
+{"version":3,"file":"capability-model.d.ts","sourceRoot":"","sources":["../src/capability-model.ts"],"names":[],"mappings":"AAUA,4DAA4D;AAC5D,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAKlE;AAMD,sCAAsC;AACtC,wBAAgB,WAAW,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAG/E;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAI7E"}

package/dist/capability-model.js

@@ -1,12 +1,11 @@
 // ════════════════════════════════════════════════════════════
 // 纯能力委托模型 —— feat/auth-capability 重构基石（纯函数，无副作用，便于单测）
 //
-// 用「能力 + 默认可见性 public/restricted + 委托加减」替代数字等级：
+// 用「能力 + 默认可见性 public/restricted + owner 授予加减」替代数字等级：
 //   - 能力是 glob 标识（tool:x / command:x / storage:path:...:write / *）。
 //   - 作者为每个操作声明默认可见性：public（默认所有人可用）/ restricted（默认禁，需授予）。
 //   - 用户有效能力 = owner ? 全部 : (所有 public ∪ 被授予的 restricted) − 被禁用的；deny 优先。
-//   - 委托子集约束：非 owner 授予方只能把「自己当前有效持有」的能力委托给下层，
-//     单调递减、天然防越权。owner = `*`，可委托一切。
+//   - 单 owner 终态：权限只由 owner 管理（无委托树/子委托），故无子集约束。
 // ════════════════════════════════════════════════════════════
 /** 单条能力 glob 匹配：`*` 通配任意字符段。pattern 为 glob，value 为具体能力串。 */
 export function capMatches(pattern, value) {
@@ -38,16 +37,4 @@ export function hasCapability(res, cap) {
         return true;
     return matchAnyCap(res.publicCaps, cap) || matchAnyCap(res.grants, cap);
 }
-/**
- * 委托子集约束：授予方把 requested 能力委托给下层是否合法。
- * owner 可委托一切；非 owner 只能委托「自己当前有效持有」的能力（防越权放大）。
- * 返回越权（不可委托）的能力项；空数组 = 全部合法。
- *
- * 语义：具体能力按 hasCapability 判定；委托更宽的 glob（超出自己持有的）会被拒。
- */
-export function rejectedDelegations(granter, requested) {
-    if (granter.isOwner)
-        return [];
-    return requested.filter(cap => !hasCapability(granter, cap));
-}
 //# sourceMappingURL=capability-model.js.map

package/dist/capability-model.js.map

@@ -1 +1 @@
-{"version":3,"file":"capability-model.js","sourceRoot":"","sources":["../src/capability-model.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,sDAAsD;AACtD,EAAE;AACF,gDAAgD;AAChD,oEAAoE;AACpE,2DAA2D;AAC3D,0EAA0E;AAC1E,+CAA+C;AAC/C,oCAAoC;AACpC,+DAA+D;AAE/D,4DAA4D;AAC5D,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,KAAa;IACvD,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9E,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,WAAW,CAAC,QAA2B,EAAE,KAAa;IACpE,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,IAAI,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAgBD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAyB,EAAE,GAAW;IAClE,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA6B,EAAE,SAA4B;IAC7F,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAC/B,OAAO,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"capability-model.js","sourceRoot":"","sources":["../src/capability-model.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,sDAAsD;AACtD,EAAE;AACF,sDAAsD;AACtD,oEAAoE;AACpE,2DAA2D;AAC3D,0EAA0E;AAC1E,iDAAiD;AACjD,+DAA+D;AAE/D,4DAA4D;AAC5D,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,KAAa;IACvD,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9E,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,WAAW,CAAC,QAA2B,EAAE,KAAa;IACpE,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,IAAI,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAgBD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAyB,EAAE,GAAW;IAClE,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC1E,CAAC"}

package/dist/index.d.ts

@@ -10,5 +10,4 @@ export declare const inject: {
 };
 export declare function apply(ctx: Context, _config: Record<string, unknown>): Promise<void>;
 export declare const actions: PluginModule['actions'];
-export declare const actionsMeta: PluginModule['actionsMeta'];
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAgBrE,YAAY,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAI1D,eAAO,MAAM,IAAI,4BAA4B,CAAC;AAC9C,eAAO,MAAM,WAAW,6BAAS,CAAC;AAClC,eAAO,MAAM,SAAS,cAAc,CAAC;AACrC,eAAO,MAAM,QAAQ,UAAgB,CAAC;AACtC,eAAO,MAAM,MAAM;;CAElB,CAAC;AAoCF,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAwIzF;AAUD,eAAO,MAAM,OAAO,EAAE,YAAY,CAAC,SAAS,CAgV3C,CAAC;AAIF,eAAO,MAAM,WAAW,EAAE,YAAY,CAAC,aAAa,CAGnD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAkBrE,YAAY,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAI1D,eAAO,MAAM,IAAI,4BAA4B,CAAC;AAC9C,eAAO,MAAM,WAAW,6BAAS,CAAC;AAClC,eAAO,MAAM,SAAS,cAAc,CAAC;AACrC,eAAO,MAAM,QAAQ,UAAgB,CAAC;AACtC,eAAO,MAAM,MAAM;;CAElB,CAAC;AASF,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA4JzF;AAUD,eAAO,MAAM,OAAO,EAAE,YAAY,CAAC,SAAS,CA4K3C,CAAC"}