@antares-core/rvs 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 antares-core
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export * from './rvs.types';
+export * from './rvs.tokens';
+export * from './rvs.decorators';
+export * from './rvs.registry';
+export * from './rvs.service';
+export * from './rvs.middleware';
+export * from './rvs.module';

package/dist/index.js

@@ -0,0 +1,24 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./rvs.types"), exports);
+__exportStar(require("./rvs.tokens"), exports);
+__exportStar(require("./rvs.decorators"), exports);
+__exportStar(require("./rvs.registry"), exports);
+__exportStar(require("./rvs.service"), exports);
+__exportStar(require("./rvs.middleware"), exports);
+__exportStar(require("./rvs.module"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAA4B;AAC5B,+CAA6B;AAC7B,mDAAiC;AACjC,iDAA+B;AAC/B,gDAA8B;AAC9B,mDAAiC;AACjC,+CAA6B"}

package/dist/rvs.decorators.d.ts

@@ -0,0 +1,18 @@
+export declare const RVS_SKIP_METADATA = "antares:rvs:skip";
+export declare const RVS_FORCE_METADATA = "antares:rvs:force";
+/**
+ * 跳过该控制器/接口的 RVS 验签与响应加密。
+ * 适用：健康检查、回调通知、公开静态资源。
+ * 优先级低于 @RvsForce；命名与内核 crypto-kit 的 @CryptoSkip 对齐。
+ */
+export declare const RvsSkip: () => ClassDecorator & MethodDecorator;
+/**
+ * 强制验签：即使命中 skipPaths 或类级 @RvsSkip 也执行校验。
+ * 适用：高价值接口在全局放行策略下单独收紧。
+ */
+export declare const RvsForce: () => ClassDecorator & MethodDecorator;
+/**
+ * 取当前请求的验签上下文（req.rvs）。
+ * 上下文含请求级密钥材料，只允许在业务方法内使用，禁止日志输出或透传响应。
+ */
+export declare const RvsCtx: (...dataOrPipes: (string | import("@nestjs/common").PipeTransform<any, any> | import("@nestjs/common").Type<import("@nestjs/common").PipeTransform<any, any>>)[]) => ParameterDecorator;

package/dist/rvs.decorators.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RvsCtx = exports.RvsForce = exports.RvsSkip = exports.RVS_FORCE_METADATA = exports.RVS_SKIP_METADATA = void 0;
+const common_1 = require("@nestjs/common");
+exports.RVS_SKIP_METADATA = 'antares:rvs:skip';
+exports.RVS_FORCE_METADATA = 'antares:rvs:force';
+/**
+ * 跳过该控制器/接口的 RVS 验签与响应加密。
+ * 适用：健康检查、回调通知、公开静态资源。
+ * 优先级低于 @RvsForce；命名与内核 crypto-kit 的 @CryptoSkip 对齐。
+ */
+const RvsSkip = () => (0, common_1.SetMetadata)(exports.RVS_SKIP_METADATA, true);
+exports.RvsSkip = RvsSkip;
+/**
+ * 强制验签：即使命中 skipPaths 或类级 @RvsSkip 也执行校验。
+ * 适用：高价值接口在全局放行策略下单独收紧。
+ */
+const RvsForce = () => (0, common_1.SetMetadata)(exports.RVS_FORCE_METADATA, true);
+exports.RvsForce = RvsForce;
+/**
+ * 取当前请求的验签上下文（req.rvs）。
+ * 上下文含请求级密钥材料，只允许在业务方法内使用，禁止日志输出或透传响应。
+ */
+exports.RvsCtx = (0, common_1.createParamDecorator)((property, ctx) => {
+    const request = ctx.switchToHttp().getRequest();
+    return request?.[property || 'rvs'];
+});
+//# sourceMappingURL=rvs.decorators.js.map

package/dist/rvs.decorators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rvs.decorators.js","sourceRoot":"","sources":["../src/rvs.decorators.ts"],"names":[],"mappings":";;;AAAA,2CAA0F;AAE7E,QAAA,iBAAiB,GAAG,kBAAkB,CAAC;AACvC,QAAA,kBAAkB,GAAG,mBAAmB,CAAC;AAEtD;;;;GAIG;AACI,MAAM,OAAO,GAAG,GAAqC,EAAE,CAAC,IAAA,oBAAW,EAAC,yBAAiB,EAAE,IAAI,CAAC,CAAC;AAAvF,QAAA,OAAO,WAAgF;AAEpG;;;GAGG;AACI,MAAM,QAAQ,GAAG,GAAqC,EAAE,CAAC,IAAA,oBAAW,EAAC,0BAAkB,EAAE,IAAI,CAAC,CAAC;AAAzF,QAAA,QAAQ,YAAiF;AAEtG;;;GAGG;AACU,QAAA,MAAM,GAAG,IAAA,6BAAoB,EAAC,CAAC,QAA4B,EAAE,GAAqB,EAAE,EAAE;IACjG,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;IAChD,OAAO,OAAO,EAAE,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC;AACtC,CAAC,CAAC,CAAC"}

package/dist/rvs.middleware.d.ts

@@ -0,0 +1,30 @@
+import { type NestMiddleware } from '@nestjs/common';
+import { type RvsServer } from 'rand-vec-sig';
+import { RvsRouteRegistry } from './rvs.registry';
+import { type ResolvedRvsOptions } from './rvs.types';
+/**
+ * RVS 全局中间件（Express 壳层）。
+ *
+ * 职责顺序（顺序即安全语义，改动前请先读注释）：
+ *  1. 动态会话端点直通：客户端拿 sessSeed 的引导请求不能要求先验签
+ *  2. @RvsForce 命中 → 无条件验签（覆盖 skipPaths / @RvsSkip）
+ *  3. skipPaths / @RvsSkip 命中 → 直通
+ *  4. tolerant 模式且未携带标识头 → 视为明文请求放行（已带标识头但验签失败仍拒绝）
+ *  5. 安装响应加密出口（包住 res.json，保证拦截器包装后的最终报文被整体加密）
+ *  6. 委托 rand-vec-sig 中间件完成验签/解密/上下文挂载/防重放
+ *
+ * 响应加密必须在 res.json 层完成：客户端按顶层混淆信封（alg="r"）解密，
+ * 因此任何 Nest 拦截器（统一响应壳 / 序列化）产生的最终 body 才是加密输入。
+ */
+export declare class RvsMiddleware implements NestMiddleware {
+    private readonly server;
+    private readonly options;
+    private readonly registry;
+    private readonly expressMiddleware;
+    private readonly identifyHeaderNames;
+    constructor(server: RvsServer, options: ResolvedRvsOptions, registry: RvsRouteRegistry);
+    use(req: Record<string, any>, res: Record<string, any>, next: (err?: unknown) => void): void;
+    private isSessionPath;
+    private hasIdentifyHeaders;
+    private patchResponseJson;
+}

package/dist/rvs.middleware.js

@@ -0,0 +1,145 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RvsMiddleware = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@antares-core/core");
+const rand_vec_sig_1 = require("rand-vec-sig");
+const rvs_registry_1 = require("./rvs.registry");
+const rvs_tokens_1 = require("./rvs.tokens");
+const rvs_types_1 = require("./rvs.types");
+/**
+ * RVS 全局中间件（Express 壳层）。
+ *
+ * 职责顺序（顺序即安全语义，改动前请先读注释）：
+ *  1. 动态会话端点直通：客户端拿 sessSeed 的引导请求不能要求先验签
+ *  2. @RvsForce 命中 → 无条件验签（覆盖 skipPaths / @RvsSkip）
+ *  3. skipPaths / @RvsSkip 命中 → 直通
+ *  4. tolerant 模式且未携带标识头 → 视为明文请求放行（已带标识头但验签失败仍拒绝）
+ *  5. 安装响应加密出口（包住 res.json，保证拦截器包装后的最终报文被整体加密）
+ *  6. 委托 rand-vec-sig 中间件完成验签/解密/上下文挂载/防重放
+ *
+ * 响应加密必须在 res.json 层完成：客户端按顶层混淆信封（alg="r"）解密，
+ * 因此任何 Nest 拦截器（统一响应壳 / 序列化）产生的最终 body 才是加密输入。
+ */
+let RvsMiddleware = class RvsMiddleware {
+    constructor(server, options, registry) {
+        this.server = server;
+        this.options = options;
+        this.registry = registry;
+        this.expressMiddleware = server.middleware({
+            // 跳过判定在 use() 中统一完成（需要叠加装饰器注册表），此处不再传 skipPaths
+            skipPaths: [],
+            contextProperty: options.contextProperty,
+            replaceBody: true,
+            onReject: (result, request) => {
+                core_1.logger.warn('rvs request rejected', {
+                    code: result.code,
+                    status: result.status,
+                    url: request?.url,
+                    method: request?.method,
+                });
+            },
+        });
+        const overrides = options.identifyHeaders ?? {};
+        this.identifyHeaderNames = [
+            (overrides.version ?? rand_vec_sig_1.DEFAULT_IDENTIFY_HEADERS.version).toLowerCase(),
+            (overrides.session ?? rand_vec_sig_1.DEFAULT_IDENTIFY_HEADERS.session).toLowerCase(),
+            (overrides.nonce ?? rand_vec_sig_1.DEFAULT_IDENTIFY_HEADERS.nonce).toLowerCase(),
+        ];
+    }
+    use(req, res, next) {
+        const url = req.originalUrl ?? req.url ?? '';
+        const pathname = url.split('?')[0];
+        // 1) 动态会话端点
+        if (this.options.sessionEndpoint && req.method === 'GET' && this.isSessionPath(pathname)) {
+            try {
+                res.json(this.server.issueSession());
+            }
+            catch (err) {
+                next(err);
+            }
+            return;
+        }
+        // 2) @RvsForce 优先于一切放行规则
+        const forced = this.registry.isForced(url);
+        if (!forced) {
+            // 3) 放行清单
+            if (this.registry.isSkipped(url) || (0, rvs_types_1.matchesAnyPath)(this.options.skipPaths, url)) {
+                next();
+                return;
+            }
+            // 4) 明文请求（tolerant 模式）
+            if (this.options.unprotected === 'tolerant' && !this.hasIdentifyHeaders(req)) {
+                next();
+                return;
+            }
+        }
+        // 5) 响应加密出口
+        if (this.options.responseEncryption)
+            this.patchResponseJson(req, res);
+        // 6) 验签/解密；rand-vec-sig 中间件内部已捕获异常并转 next(error)
+        void this.expressMiddleware(req, res, next);
+    }
+    isSessionPath(pathname) {
+        const endpoint = this.options.sessionEndpoint;
+        return pathname === endpoint || pathname.endsWith(endpoint);
+    }
+    hasIdentifyHeaders(req) {
+        const headers = req.headers;
+        if (!headers)
+            return false;
+        return this.identifyHeaderNames.some((name) => {
+            if (typeof headers.get === 'function') {
+                return Boolean(headers.get(name));
+            }
+            return Boolean(headers[name]);
+        });
+    }
+    patchResponseJson(req, res) {
+        if (typeof res.json !== 'function')
+            return;
+        const original = res.json.bind(res);
+        const property = this.options.contextProperty;
+        res.json = (body) => {
+            const context = req[property];
+            if (!context)
+                return original(body);
+            try {
+                return original(this.server.encryptResponse(body, context));
+            }
+            catch (err) {
+                // 加密失败绝不回退明文（会泄露业务数据）；改为通用错误壳，由客户端按明文错误处理
+                core_1.alertBus.error('rvs:response-encrypt-failed', 'RVS 响应加密失败，已阻止明文业务数据返回', {
+                    reason: err?.message,
+                });
+                try {
+                    res.statusCode = 500;
+                }
+                catch {
+                    /* 头已发出则忽略 */
+                }
+                return original({ code: 'RVS_RESPONSE_ENCRYPT_FAILED', message: 'response encryption failed' });
+            }
+        };
+    }
+};
+exports.RvsMiddleware = RvsMiddleware;
+exports.RvsMiddleware = RvsMiddleware = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(rvs_tokens_1.RVS_SERVER)),
+    __param(1, (0, common_1.Inject)(rvs_tokens_1.RVS_OPTIONS)),
+    __metadata("design:paramtypes", [Object, Object, rvs_registry_1.RvsRouteRegistry])
+], RvsMiddleware);
+//# sourceMappingURL=rvs.middleware.js.map

package/dist/rvs.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rvs.middleware.js","sourceRoot":"","sources":["../src/rvs.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAyE;AACzE,6CAAsD;AACtD,+CAAsH;AACtH,iDAAkD;AAClD,6CAAuD;AACvD,2CAAsE;AAEtE;;;;;;;;;;;;;GAaG;AAEI,IAAM,aAAa,GAAnB,MAAM,aAAa;IAIxB,YACuC,MAAiB,EAChB,OAA2B,EAChD,QAA0B;QAFN,WAAM,GAAN,MAAM,CAAW;QAChB,YAAO,GAAP,OAAO,CAAoB;QAChD,aAAQ,GAAR,QAAQ,CAAkB;QAE3C,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAAC;YACzC,gDAAgD;YAChD,SAAS,EAAE,EAAE;YACb,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;gBAC5B,aAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;oBAClC,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,GAAG,EAAE,OAAO,EAAE,GAAG;oBACjB,MAAM,EAAE,OAAO,EAAE,MAAM;iBACxB,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,mBAAmB,GAAG;YACzB,CAAC,SAAS,CAAC,OAAO,IAAI,uCAAwB,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;YACrE,CAAC,SAAS,CAAC,OAAO,IAAI,uCAAwB,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;YACrE,CAAC,SAAS,CAAC,KAAK,IAAI,uCAAwB,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;SAClE,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,GAAwB,EAAE,GAAwB,EAAE,IAA6B;QACnF,MAAM,GAAG,GAAW,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnC,YAAY;QACZ,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzF,IAAI,CAAC;gBACH,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;YACD,OAAO;QACT,CAAC;QAED,yBAAyB;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,UAAU;YACV,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAA,0BAAc,EAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;gBAChF,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YACD,uBAAuB;YACvB,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7E,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;QAED,YAAY;QACZ,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAEtE,iDAAiD;QACjD,KAAK,IAAI,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAY,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;IAEO,aAAa,CAAC,QAAgB;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAyB,CAAC;QACxD,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAEO,kBAAkB,CAAC,GAAwB;QACjD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAqF,CAAC;QAC1G,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YAC5C,IAAI,OAAQ,OAA6B,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;gBAC7D,OAAO,OAAO,CAAE,OAAgD,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO,OAAO,CAAE,OAAmC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,iBAAiB,CAAC,GAAwB,EAAE,GAAwB;QAC1E,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO;QAC3C,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;QAC9C,GAAG,CAAC,IAAI,GAAG,CAAC,IAAa,EAAE,EAAE;YAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAuC,CAAC;YACpE,IAAI,CAAC,OAAO;gBAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC;gBACH,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,0CAA0C;gBAC1C,eAAQ,CAAC,KAAK,CAAC,6BAA6B,EAAE,wBAAwB,EAAE;oBACtE,MAAM,EAAG,GAAa,EAAE,OAAO;iBAChC,CAAC,CAAC;gBACH,IAAI,CAAC;oBACH,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACvB,CAAC;gBAAC,MAAM,CAAC;oBACP,aAAa;gBACf,CAAC;gBACD,OAAO,QAAQ,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;CACF,CAAA;AA1GY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,uBAAU,CAAC,CAAA;IAClB,WAAA,IAAA,eAAM,EAAC,wBAAW,CAAC,CAAA;qDACO,+BAAgB;GAPlC,aAAa,CA0GzB"}

package/dist/rvs.module.d.ts

@@ -0,0 +1,19 @@
+import { type DynamicModule, type MiddlewareConsumer, type NestModule } from '@nestjs/common';
+import { type ResolvedRvsOptions, type RvsModuleOptions } from './rvs.types';
+/**
+ * RVS 适配模块：全局验签/解密 + 响应加密 + 装饰器粒度控制 + 会话端点。
+ *
+ *   imports: [RvsModule.forRoot({ mode: 'static', serverPrivateKey: env.RVS_RSK, redis: redisClient })]
+ *
+ * 装配注意：
+ *  - 与 crypto-kit 互斥：启用 RVS 时宿主应关闭 cryptoOption.enableCrypto（双加密通道无法共存）
+ *  - 多实例必须传 redis（防重放存储共享），否则启动期告警
+ *  - 响应加密依赖 res.json 出口，@Res() 直写响应不经过加密（与内核 Transform 拦截器的既有约定一致）
+ */
+export declare class RvsModule implements NestModule {
+    private readonly options;
+    constructor(options: ResolvedRvsOptions);
+    configure(consumer: MiddlewareConsumer): void;
+    static forRoot(options: RvsModuleOptions): DynamicModule;
+    static forRootAsync(factory: () => RvsModuleOptions | Promise<RvsModuleOptions>): Promise<DynamicModule>;
+}

package/dist/rvs.module.js

@@ -0,0 +1,119 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RvsModule = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const core_2 = require("@antares-core/core");
+const rand_vec_sig_1 = require("rand-vec-sig");
+const rvs_middleware_1 = require("./rvs.middleware");
+const rvs_registry_1 = require("./rvs.registry");
+const rvs_service_1 = require("./rvs.service");
+const rvs_tokens_1 = require("./rvs.tokens");
+const rvs_types_1 = require("./rvs.types");
+/**
+ * RVS 适配模块：全局验签/解密 + 响应加密 + 装饰器粒度控制 + 会话端点。
+ *
+ *   imports: [RvsModule.forRoot({ mode: 'static', serverPrivateKey: env.RVS_RSK, redis: redisClient })]
+ *
+ * 装配注意：
+ *  - 与 crypto-kit 互斥：启用 RVS 时宿主应关闭 cryptoOption.enableCrypto（双加密通道无法共存）
+ *  - 多实例必须传 redis（防重放存储共享），否则启动期告警
+ *  - 响应加密依赖 res.json 出口，@Res() 直写响应不经过加密（与内核 Transform 拦截器的既有约定一致）
+ */
+let RvsModule = class RvsModule {
+    constructor(options) {
+        this.options = options;
+    }
+    configure(consumer) {
+        consumer.apply(rvs_middleware_1.RvsMiddleware).forRoutes('*');
+    }
+    static forRoot(options) {
+        return buildRvsModule((0, rvs_types_1.resolveRvsOptions)(options));
+    }
+    static async forRootAsync(factory) {
+        return buildRvsModule((0, rvs_types_1.resolveRvsOptions)(await factory()));
+    }
+};
+exports.RvsModule = RvsModule;
+exports.RvsModule = RvsModule = __decorate([
+    (0, common_1.Module)({}),
+    __param(0, (0, common_1.Inject)(rvs_tokens_1.RVS_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], RvsModule);
+function buildRvsModule(options) {
+    return {
+        module: RvsModule,
+        imports: [core_1.DiscoveryModule],
+        providers: [
+            { provide: rvs_tokens_1.RVS_OPTIONS, useValue: options },
+            { provide: rvs_tokens_1.RVS_SERVER, useFactory: () => createRvsServer(options) },
+            rvs_registry_1.RvsRouteRegistry,
+            rvs_service_1.RvsService,
+            rvs_middleware_1.RvsMiddleware,
+        ],
+        exports: [rvs_tokens_1.RVS_SERVER, rvs_tokens_1.RVS_OPTIONS, rvs_service_1.RvsService],
+        global: true,
+    };
+}
+function createRvsServer(options) {
+    if (!options.serverPrivateKey) {
+        throw new Error('RvsModule: serverPrivateKey 缺失。私钥仅允许来自环境变量 / KMS，禁止硬编码');
+    }
+    const processModel = (0, core_2.detectProcessModel)();
+    const replayStore = options.replayStore ?? (options.redis ? (0, rand_vec_sig_1.createRedisReplayStore)(options.redis) : undefined);
+    if (!replayStore && processModel.isCluster) {
+        core_2.alertBus.error('rvs:replay-store-per-process', '多实例未配置共享防重放存储：跨实例重放无法拦截', {
+            instances: processModel.instances,
+            runtime: processModel.runtime,
+            hint: 'RvsModule 传入 redis（共享 ioredis 实例）',
+        });
+    }
+    if (options.mode === 'dynamic' && processModel.isCluster) {
+        core_2.logger.warn('rvs dynamic mode with multiple instances: sessSeed 仅存在进程内存', {
+            instances: processModel.instances,
+            hint: '开启粘性路由，或依赖客户端 410 重试自愈（客户端已内置）',
+        });
+    }
+    const server = (0, rand_vec_sig_1.createRandVecSigServer)({
+        mode: options.mode,
+        serverPrivateKey: options.serverPrivateKey,
+        versionSeed: options.versionSeed,
+        versionSeeds: options.versionSeeds,
+        deploymentId: options.deploymentId,
+        identifyHeaders: options.identifyHeaders,
+        profile: options.profile,
+        allowedPayloadModes: options.allowedPayloadModes,
+        timestampToleranceMs: options.timestampToleranceMs,
+        nonceTtlMs: options.nonceTtlMs,
+        strictSubgroupCheck: options.strictSubgroupCheck,
+        responseEncryption: options.responseEncryption,
+        session: options.session,
+        replayStore,
+        logger: options.logger ??
+            ((event, detail) => core_2.logger.debug(`rvs ${event}`, detail)),
+    });
+    // 四阶段优雅关闭的资源释放阶段：释放会话定时器与存储连接
+    (0, core_2.registerResourceCloser)('rvs-server', () => server.close());
+    core_2.logger.info('rvs module initialized', {
+        mode: options.mode,
+        responseEncryption: Boolean(options.responseEncryption),
+        unprotected: options.unprotected,
+        replayStore: replayStore ? 'shared' : 'memory',
+        sessionEndpoint: options.sessionEndpoint ?? null,
+        instances: processModel.instances,
+    });
+    return server;
+}
+//# sourceMappingURL=rvs.module.js.map

package/dist/rvs.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rvs.module.js","sourceRoot":"","sources":["../src/rvs.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA8G;AAC9G,uCAA+C;AAC/C,6CAAkG;AAClG,+CAA8F;AAC9F,qDAAiD;AACjD,iDAAkD;AAClD,+CAA2C;AAC3C,6CAAuD;AACvD,2CAAgG;AAEhG;;;;;;;;;GASG;AAEI,IAAM,SAAS,GAAf,MAAM,SAAS;IACpB,YAAkD,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAAG,CAAC;IAEjF,SAAS,CAAC,QAA4B;QACpC,QAAQ,CAAC,KAAK,CAAC,8BAAa,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,OAAyB;QACtC,OAAO,cAAc,CAAC,IAAA,6BAAiB,EAAC,OAAO,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAA2D;QACnF,OAAO,cAAc,CAAC,IAAA,6BAAiB,EAAC,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;CACF,CAAA;AAdY,8BAAS;oBAAT,SAAS;IADrB,IAAA,eAAM,EAAC,EAAE,CAAC;IAEI,WAAA,IAAA,eAAM,EAAC,wBAAW,CAAC,CAAA;;GADrB,SAAS,CAcrB;AAED,SAAS,cAAc,CAAC,OAA2B;IACjD,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,CAAC,sBAAe,CAAC;QAC1B,SAAS,EAAE;YACT,EAAE,OAAO,EAAE,wBAAW,EAAE,QAAQ,EAAE,OAAO,EAAE;YAC3C,EAAE,OAAO,EAAE,uBAAU,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE;YACnE,+BAAgB;YAChB,wBAAU;YACV,8BAAa;SACd;QACD,OAAO,EAAE,CAAC,uBAAU,EAAE,wBAAW,EAAE,wBAAU,CAAC;QAC9C,MAAM,EAAE,IAAI;KACb,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAA2B;IAClD,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,YAAY,GAAG,IAAA,yBAAkB,GAAE,CAAC;IAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAA,qCAAsB,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/G,IAAI,CAAC,WAAW,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;QAC3C,eAAQ,CAAC,KAAK,CAAC,8BAA8B,EAAE,yBAAyB,EAAE;YACxE,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,IAAI,EAAE,mCAAmC;SAC1C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;QACzD,aAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE;YACxE,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,IAAI,EAAE,gCAAgC;SACvC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,qCAAsB,EAAC;QACpC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;QAClD,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW;QACX,MAAM,EACJ,OAAO,CAAC,MAAM;YACd,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,aAAM,CAAC,KAAK,CAAC,OAAO,KAAK,EAAE,EAAE,MAA6C,CAAC,CAAC;KACnG,CAAC,CAAC;IAEH,8BAA8B;IAC9B,IAAA,6BAAsB,EAAC,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAE3D,aAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;QACpC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACvD,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QAC9C,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;QAChD,SAAS,EAAE,YAAY,CAAC,SAAS;KAClC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/rvs.registry.d.ts

@@ -0,0 +1,31 @@
+import { type OnApplicationBootstrap, type Type } from '@nestjs/common';
+import { DiscoveryService, Reflector } from '@nestjs/core';
+/** 路由路径转正则：支持 :param 与 * 通配；允许全局前缀（如 /api/health/live 命中 health/live） */
+export declare function pathToRegex(routePath: string): RegExp;
+interface ControllerLike {
+    instance?: object;
+    metatype?: Type<unknown>;
+}
+/**
+ * 扫描控制器元数据，收集 @RvsSkip / @RvsForce 标记的路由正则。
+ * 抽成纯函数以便测试；Nest 容器相关逻辑全部在 RvsRouteRegistry。
+ */
+export declare function collectRvsRouteMatchers(controllers: ControllerLike[], reflector: Pick<Reflector, 'get'>): {
+    skip: RegExp[];
+    force: RegExp[];
+};
+/**
+ * 装饰器路由注册表：应用启动完成后扫描一次。
+ * 中间件在请求期查询；启动完成前不会有请求，因此时序安全。
+ */
+export declare class RvsRouteRegistry implements OnApplicationBootstrap {
+    private readonly discovery;
+    private readonly reflector;
+    private skipMatchers;
+    private forceMatchers;
+    constructor(discovery: DiscoveryService, reflector: Reflector);
+    onApplicationBootstrap(): void;
+    isSkipped(url: string): boolean;
+    isForced(url: string): boolean;
+}
+export {};

package/dist/rvs.registry.js

@@ -0,0 +1,100 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RvsRouteRegistry = void 0;
+exports.pathToRegex = pathToRegex;
+exports.collectRvsRouteMatchers = collectRvsRouteMatchers;
+const common_1 = require("@nestjs/common");
+const constants_1 = require("@nestjs/common/constants");
+const core_1 = require("@nestjs/core");
+const rvs_decorators_1 = require("./rvs.decorators");
+/** 路由路径转正则：支持 :param 与 * 通配；允许全局前缀（如 /api/health/live 命中 health/live） */
+function pathToRegex(routePath) {
+    const normalized = routePath.replace(/^\/+|\/+$/g, '');
+    if (!normalized)
+        return /^.*$/;
+    const pattern = normalized
+        .split('/')
+        .map((segment) => {
+        if (segment === '*')
+            return '.*';
+        if (segment.startsWith(':'))
+            return '[^/]+';
+        return segment.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    })
+        .join('/');
+    return new RegExp(`(?:^|/)${pattern}(?:/)?(?:\\?|#|$)`);
+}
+/**
+ * 扫描控制器元数据，收集 @RvsSkip / @RvsForce 标记的路由正则。
+ * 抽成纯函数以便测试；Nest 容器相关逻辑全部在 RvsRouteRegistry。
+ */
+function collectRvsRouteMatchers(controllers, reflector) {
+    const skip = [];
+    const force = [];
+    for (const wrapper of controllers) {
+        const { instance, metatype } = wrapper;
+        if (!instance || !metatype)
+            continue;
+        const classPath = Reflect.getMetadata(constants_1.PATH_METADATA, metatype) ?? '';
+        const classSkip = reflector.get(rvs_decorators_1.RVS_SKIP_METADATA, metatype);
+        const classForce = reflector.get(rvs_decorators_1.RVS_FORCE_METADATA, metatype);
+        const proto = Object.getPrototypeOf(instance);
+        for (const methodName of Object.getOwnPropertyNames(proto)) {
+            if (methodName === 'constructor')
+                continue;
+            const handler = proto[methodName];
+            if (typeof handler !== 'function')
+                continue;
+            const methodPath = Reflect.getMetadata(constants_1.PATH_METADATA, handler);
+            if (methodPath === undefined)
+                continue; // 非路由方法
+            const joined = [classPath, methodPath].filter((p) => p !== undefined && p !== '').join('/');
+            const forceHit = classForce || reflector.get(rvs_decorators_1.RVS_FORCE_METADATA, handler);
+            const skipHit = classSkip || reflector.get(rvs_decorators_1.RVS_SKIP_METADATA, handler);
+            if (forceHit)
+                force.push(pathToRegex(joined));
+            else if (skipHit)
+                skip.push(pathToRegex(joined));
+        }
+    }
+    return { skip, force };
+}
+/**
+ * 装饰器路由注册表：应用启动完成后扫描一次。
+ * 中间件在请求期查询；启动完成前不会有请求，因此时序安全。
+ */
+let RvsRouteRegistry = class RvsRouteRegistry {
+    constructor(discovery, reflector) {
+        this.discovery = discovery;
+        this.reflector = reflector;
+        this.skipMatchers = [];
+        this.forceMatchers = [];
+    }
+    onApplicationBootstrap() {
+        const { skip, force } = collectRvsRouteMatchers(this.discovery.getControllers(), this.reflector);
+        this.skipMatchers = skip;
+        this.forceMatchers = force;
+    }
+    isSkipped(url) {
+        return this.skipMatchers.some((re) => re.test(url));
+    }
+    isForced(url) {
+        return this.forceMatchers.some((re) => re.test(url));
+    }
+};
+exports.RvsRouteRegistry = RvsRouteRegistry;
+exports.RvsRouteRegistry = RvsRouteRegistry = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.DiscoveryService,
+        core_1.Reflector])
+], RvsRouteRegistry);
+//# sourceMappingURL=rvs.registry.js.map

package/dist/rvs.registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rvs.registry.js","sourceRoot":"","sources":["../src/rvs.registry.ts"],"names":[],"mappings":";;;;;;;;;;;;AAMA,kCAYC;AAWD,0DA2BC;AAxDD,2CAAoF;AACpF,wDAAyD;AACzD,uCAA2D;AAC3D,qDAAyE;AAEzE,yEAAyE;AACzE,SAAgB,WAAW,CAAC,SAAiB;IAC3C,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU;QAAE,OAAO,MAAM,CAAC;IAC/B,MAAM,OAAO,GAAG,UAAU;SACvB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACf,IAAI,OAAO,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC;QAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,IAAI,MAAM,CAAC,UAAU,OAAO,mBAAmB,CAAC,CAAC;AAC1D,CAAC;AAOD;;;GAGG;AACH,SAAgB,uBAAuB,CACrC,WAA6B,EAC7B,SAAiC;IAEjC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QACvC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,SAAS;QACrC,MAAM,SAAS,GAAI,OAAO,CAAC,WAAW,CAAC,yBAAa,EAAE,QAAQ,CAAwB,IAAI,EAAE,CAAC;QAC7F,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAU,kCAAiB,EAAE,QAAQ,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAU,mCAAkB,EAAE,QAAQ,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAA4B,CAAC;QACzE,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,IAAI,UAAU,KAAK,aAAa;gBAAE,SAAS;YAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAuB,CAAC;YACxD,IAAI,OAAO,OAAO,KAAK,UAAU;gBAAE,SAAS;YAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,yBAAa,EAAE,OAAO,CAAuB,CAAC;YACrF,IAAI,UAAU,KAAK,SAAS;gBAAE,SAAS,CAAC,QAAQ;YAChD,MAAM,MAAM,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5F,MAAM,QAAQ,GAAG,UAAU,IAAI,SAAS,CAAC,GAAG,CAAU,mCAAkB,EAAE,OAAO,CAAC,CAAC;YACnF,MAAM,OAAO,GAAG,SAAS,IAAI,SAAS,CAAC,GAAG,CAAU,kCAAiB,EAAE,OAAO,CAAC,CAAC;YAChF,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;iBACzC,IAAI,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED;;;GAGG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAI3B,YACmB,SAA2B,EAC3B,SAAoB;QADpB,cAAS,GAAT,SAAS,CAAkB;QAC3B,cAAS,GAAT,SAAS,CAAW;QAL/B,iBAAY,GAAa,EAAE,CAAC;QAC5B,kBAAa,GAAa,EAAE,CAAC;IAKlC,CAAC;IAEJ,sBAAsB;QACpB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,uBAAuB,CAC7C,IAAI,CAAC,SAAS,CAAC,cAAc,EAAsB,EACnD,IAAI,CAAC,SAAS,CACf,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED,SAAS,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;CACF,CAAA;AAzBY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAMmB,uBAAgB;QAChB,gBAAS;GAN5B,gBAAgB,CAyB5B"}

package/dist/rvs.service.d.ts

@@ -0,0 +1,21 @@
+import type { RvsServer, SessionSeed, VerifyInput, VerifyResult } from 'rand-vec-sig';
+import type { RvsContext } from './rvs.types';
+/**
+ * RvsService：业务侧访问 RVS 能力的唯一出口。
+ * 直接暴露 server 供高级用法（自定义 verify 流程 / internals），常规路径用封装方法。
+ */
+export declare class RvsService {
+    readonly server: RvsServer;
+    constructor(server: RvsServer);
+    /** 手动验签（自定义中间件/网关场景）；不抛异常，失败经 result.ok 判断 */
+    verify(input: VerifyInput): Promise<VerifyResult>;
+    /** 动态模式：签发会话种子（宿主自定义下发渠道时使用） */
+    issueSession(options?: {
+        ttlMs?: number;
+        sessionId?: string;
+    }): SessionSeed;
+    /** 动态模式：吊销会话（登出等场景） */
+    revokeSession(sessionId: string): void;
+    /** 加密响应体（自定义响应出口时使用） */
+    encryptResponse(payload: unknown, context: RvsContext): Record<string, unknown>;
+}

package/dist/rvs.service.js

@@ -0,0 +1,49 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RvsService = void 0;
+const common_1 = require("@nestjs/common");
+const rvs_tokens_1 = require("./rvs.tokens");
+/**
+ * RvsService：业务侧访问 RVS 能力的唯一出口。
+ * 直接暴露 server 供高级用法（自定义 verify 流程 / internals），常规路径用封装方法。
+ */
+let RvsService = class RvsService {
+    constructor(server) {
+        this.server = server;
+    }
+    /** 手动验签（自定义中间件/网关场景）；不抛异常，失败经 result.ok 判断 */
+    verify(input) {
+        return this.server.verify(input);
+    }
+    /** 动态模式：签发会话种子（宿主自定义下发渠道时使用） */
+    issueSession(options) {
+        return this.server.issueSession(options);
+    }
+    /** 动态模式：吊销会话（登出等场景） */
+    revokeSession(sessionId) {
+        this.server.revokeSession(sessionId);
+    }
+    /** 加密响应体（自定义响应出口时使用） */
+    encryptResponse(payload, context) {
+        return this.server.encryptResponse(payload, context);
+    }
+};
+exports.RvsService = RvsService;
+exports.RvsService = RvsService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(rvs_tokens_1.RVS_SERVER)),
+    __metadata("design:paramtypes", [Object])
+], RvsService);
+//# sourceMappingURL=rvs.service.js.map

package/dist/rvs.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rvs.service.js","sourceRoot":"","sources":["../src/rvs.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AAEpD,6CAA0C;AAG1C;;;GAGG;AAEI,IAAM,UAAU,GAAhB,MAAM,UAAU;IACrB,YAAyC,MAAiB;QAAjB,WAAM,GAAN,MAAM,CAAW;IAAG,CAAC;IAE9D,8CAA8C;IAC9C,MAAM,CAAC,KAAkB;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,gCAAgC;IAChC,YAAY,CAAC,OAAgD;QAC3D,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,uBAAuB;IACvB,aAAa,CAAC,SAAiB;QAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,wBAAwB;IACxB,eAAe,CAAC,OAAgB,EAAE,OAAmB;QACnD,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;CACF,CAAA;AAtBY,gCAAU;qBAAV,UAAU;IADtB,IAAA,mBAAU,GAAE;IAEE,WAAA,IAAA,eAAM,EAAC,uBAAU,CAAC,CAAA;;GADpB,UAAU,CAsBtB"}

package/dist/rvs.tokens.d.ts

@@ -0,0 +1,2 @@
+export declare const RVS_SERVER = "ANTARES_RVS_SERVER";
+export declare const RVS_OPTIONS = "ANTARES_RVS_OPTIONS";

package/dist/rvs.tokens.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RVS_OPTIONS = exports.RVS_SERVER = void 0;
+exports.RVS_SERVER = 'ANTARES_RVS_SERVER';
+exports.RVS_OPTIONS = 'ANTARES_RVS_OPTIONS';
+//# sourceMappingURL=rvs.tokens.js.map

package/dist/rvs.tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rvs.tokens.js","sourceRoot":"","sources":["../src/rvs.tokens.ts"],"names":[],"mappings":";;;AAAa,QAAA,UAAU,GAAG,oBAAoB,CAAC;AAClC,QAAA,WAAW,GAAG,qBAAqB,CAAC"}

package/dist/rvs.types.d.ts

@@ -0,0 +1,60 @@
+import type { RedisLikeClient, ReplayStore, ServerRvsConfig, VerifiedRequestContext } from 'rand-vec-sig';
+export type RvsUnprotectedMode = 'strict' | 'tolerant';
+/**
+ * RvsModule 装配选项。
+ * 除 skipPaths / unprotected / contextProperty / sessionEndpoint / redis 外，
+ * 其余字段原样透传给 rand-vec-sig 的 createRandVecSigServer。
+ */
+export interface RvsModuleOptions {
+    /** static（构建期种子，零握手）| dynamic（服务端会话种子，900s，需粘性路由或 410 重试自愈） */
+    mode: 'static' | 'dynamic';
+    /** 服务端长期私钥 Rsk。仅允许来自 env / KMS，禁止硬编码与入库 */
+    serverPrivateKey: string | bigint;
+    /** static 模式版本种子；轮换窗口内可注册两个 */
+    versionSeed?: string;
+    versionSeeds?: string[];
+    /** 部署/租户标识：跨部署重放防护（同种子不同部署） */
+    deploymentId?: string;
+    identifyHeaders?: ServerRvsConfig['identifyHeaders'];
+    /** 混淆档案，必须与客户端完全一致 */
+    profile?: ServerRvsConfig['profile'];
+    allowedPayloadModes?: ServerRvsConfig['allowedPayloadModes'];
+    timestampToleranceMs?: number;
+    nonceTtlMs?: number;
+    strictSubgroupCheck?: boolean;
+    /** 响应加密（客户端需同时开启 responseEncryption） */
+    responseEncryption?: boolean;
+    session?: ServerRvsConfig['session'];
+    /** 多实例防重放：传入共享 ioredis 实例（生产必配）；与 replayStore 二选一 */
+    redis?: RedisLikeClient;
+    /** 自定义防重放存储（优先于 redis） */
+    replayStore?: ReplayStore;
+    /** 跳过验签的路径：字符串为前缀匹配，RegExp 为正则匹配 */
+    skipPaths?: Array<string | RegExp>;
+    /**
+     * dynamic 模式的会话签发端点（客户端用 /rvs/session 拉取 sessSeed）。
+     * 默认 '/rvs/session'；null 关闭内置端点（宿主自行下发）。static 模式恒为 null。
+     */
+    sessionEndpoint?: string | null;
+    /**
+     * 未携带 RVS 标识头的明文请求如何处理：
+     *  - strict：拒绝（默认生产）——报文加密是数据面唯一入口
+     *  - tolerant：放行（默认非生产）——便于 curl / Swagger 调试；已带标识头但验签失败的请求仍拒绝
+     */
+    unprotected?: RvsUnprotectedMode;
+    /** 验签上下文挂载属性名，默认 'rvs' */
+    contextProperty?: string;
+    /** 结构化日志（不会收到密钥材料） */
+    logger?: ServerRvsConfig['logger'];
+}
+export interface ResolvedRvsOptions extends RvsModuleOptions {
+    contextProperty: string;
+    unprotected: RvsUnprotectedMode;
+    skipPaths: Array<string | RegExp>;
+    sessionEndpoint: string | null;
+}
+/** 验签上下文（rand-vec-sig VerifiedRequestContext 的语义别名；含密钥材料，禁止日志输出） */
+export type RvsContext = VerifiedRequestContext;
+export declare function resolveRvsOptions(options: RvsModuleOptions): ResolvedRvsOptions;
+/** 字符串按前缀匹配（与 rand-vec-sig 中间件语义一致），RegExp 按正则匹配 */
+export declare function matchesAnyPath(patterns: Array<string | RegExp>, url: string): boolean;

package/dist/rvs.types.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveRvsOptions = resolveRvsOptions;
+exports.matchesAnyPath = matchesAnyPath;
+function resolveRvsOptions(options) {
+    const isProd = process.env.NODE_ENV === 'production';
+    const sessionEndpoint = options.sessionEndpoint === undefined ? '/rvs/session' : options.sessionEndpoint;
+    return {
+        ...options,
+        contextProperty: options.contextProperty ?? 'rvs',
+        unprotected: options.unprotected ?? (isProd ? 'strict' : 'tolerant'),
+        skipPaths: [...(options.skipPaths ?? [])],
+        sessionEndpoint: options.mode === 'dynamic' ? sessionEndpoint : null,
+    };
+}
+/** 字符串按前缀匹配（与 rand-vec-sig 中间件语义一致），RegExp 按正则匹配 */
+function matchesAnyPath(patterns, url) {
+    return patterns.some((pattern) => typeof pattern === 'string' ? url === pattern || url.startsWith(pattern) : pattern.test(url));
+}
+//# sourceMappingURL=rvs.types.js.map

package/dist/rvs.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rvs.types.js","sourceRoot":"","sources":["../src/rvs.types.ts"],"names":[],"mappings":";;AA8DA,8CAUC;AAGD,wCAIC;AAjBD,SAAgB,iBAAiB,CAAC,OAAyB;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IACrD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACzG,OAAO;QACL,GAAG,OAAO;QACV,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,KAAK;QACjD,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;QACpE,SAAS,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACzC,eAAe,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI;KACrE,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,SAAgB,cAAc,CAAC,QAAgC,EAAE,GAAW;IAC1E,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC/B,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAC7F,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@antares-core/rvs",
+  "version": "1.0.0",
+  "description": "rand-vec-sig 的 NestJS 适配层：全局验签/解密中间件、响应加密管线、装饰器粒度控制、Redis 防重放与会话端点",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "reflect-metadata": "^0.2.2"
+  },
+  "peerDependencies": {
+    "@nestjs/common": "^10.3.7",
+    "@nestjs/core": "^10.3.7",
+    "rand-vec-sig": "^1.0.0",
+    "rxjs": "^7.8.1",
+    "@antares-core/core": "^2.2.0"
+  },
+  "devDependencies": {
+    "@nestjs/common": "^10.3.7",
+    "@nestjs/core": "^10.3.7",
+    "@nestjs/platform-express": "^10.4.15",
+    "@types/express": "^4.17.21",
+    "@types/node": "^20.12.12",
+    "rand-vec-sig": "^1.0.0",
+    "reflect-metadata": "^0.2.2",
+    "rimraf": "^5.0.7",
+    "rxjs": "^7.8.1",
+    "typescript": "^5.4.5",
+    "vitest": "^2.1.8",
+    "@antares-core/core": "2.2.0"
+  },
+  "license": "MIT",
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "clean": "rm -rf dist"
+  }
+}