@downcity/agent 1.1.1

package/bin/http/auth/AuthService.d.ts

@@ -0,0 +1,119 @@
+/**
+ * 统一账户服务层。
+ *
+ * 关键点（中文）
+ * - 该模块承接本机 token 初始化、token 校验与 token 管理等业务语义。
+ * - 路由层只调用这里，不直接碰数据库与密码哈希细节。
+ */
+import type { AuthIssuedToken, AuthTokenSummary } from "../../shared/types/auth/AuthToken.js";
+import type { AuthPrincipal } from "../../shared/types/auth/AuthTypes.js";
+import { AuthStore, type AuthStoreOptions } from "./AuthStore.js";
+/**
+ * AuthService 构造参数。
+ */
+export interface AuthServiceOptions extends AuthStoreOptions {
+    /**
+     * 复用外部传入的 store。
+     */
+    store?: AuthStore;
+}
+/**
+ * 登录/初始化后返回的用户摘要。
+ */
+export interface AuthCurrentUserPayload {
+    /**
+     * 用户 ID。
+     */
+    id: string;
+    /**
+     * 用户名。
+     */
+    username: string;
+    /**
+     * 展示名。
+     */
+    displayName?: string;
+    /**
+     * 角色列表。
+     */
+    roles: string[];
+    /**
+     * 权限列表。
+     */
+    permissions: string[];
+}
+/**
+ * AuthService 门面。
+ */
+export declare class AuthService {
+    private readonly store;
+    private readonly ownsStore;
+    constructor(options?: AuthServiceOptions);
+    /**
+     * 关闭底层连接。
+     */
+    close(): void;
+    /**
+     * 判断当前是否已经存在可用的本机 CLI access token。
+     */
+    hasLocalCliAccess(): boolean;
+    /**
+     * 确保存在本机 CLI 主体，并为其签发新的 access token。
+     */
+    ensureLocalCliAccess(input: {
+        tokenName: string;
+        expiresAt?: string;
+    }): {
+        user: AuthCurrentUserPayload;
+        token: AuthIssuedToken;
+    };
+    /**
+     * 读取本机 CLI 主体的 token 列表。
+     */
+    listLocalCliTokens(): AuthTokenSummary[];
+    /**
+     * 为本机 CLI 主体签发新的 access token。
+     */
+    createLocalCliToken(input: {
+        name: string;
+        expiresAt?: string;
+    }): AuthIssuedToken;
+    /**
+     * 删除本机 CLI 主体下的 token。
+     */
+    deleteLocalCliToken(tokenIdInput: string): void;
+    /**
+     * 解析 Authorization 头并返回 principal。
+     */
+    authenticateBearerHeader(headerValue: string | undefined): AuthPrincipal;
+    /**
+     * 返回当前用户信息。
+     */
+    getCurrentUser(principal: AuthPrincipal): AuthCurrentUserPayload;
+    /**
+     * 为当前 Bearer 调用主体创建新的 token。
+     */
+    createToken(principal: AuthPrincipal, input: {
+        name: string;
+        expiresAt?: string;
+    }): AuthIssuedToken;
+    /**
+     * 读取当前用户 token 列表。
+     */
+    listTokens(principal: AuthPrincipal): AuthTokenSummary[];
+    /**
+     * 删除当前用户的 token。
+     */
+    deleteToken(principal: AuthPrincipal, tokenIdInput: string): void;
+    private issueTokenForUser;
+    private ensureUserActive;
+    private isTokenActive;
+    private ensureLocalCliUser;
+    private requireTokenName;
+    private requireUserId;
+    private requireUser;
+    private requireLocalCliUser;
+    private requireLocalCliTokenRecord;
+    private toUserPayload;
+}
+//# sourceMappingURL=AuthService.d.ts.map

package/bin/http/auth/AuthService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthService.d.ts","sourceRoot":"","sources":["../../../src/http/auth/AuthService.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAC1F,OAAO,KAAK,EAAE,aAAa,EAA6B,MAAM,kCAAkC,CAAC;AAGjG,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAOlE;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D;;OAEG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;OAEG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;gBAExB,OAAO,GAAE,kBAAuB;IAU5C;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;OAEG;IACH,iBAAiB,IAAI,OAAO;IAQ5B;;OAEG;IACH,oBAAoB,CAAC,KAAK,EAAE;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG;QAAE,IAAI,EAAE,sBAAsB,CAAC;QAAC,KAAK,EAAE,eAAe,CAAA;KAAE;IAY5D;;OAEG;IACH,kBAAkB,IAAI,gBAAgB,EAAE;IASxC;;OAEG;IACH,mBAAmB,CAAC,KAAK,EAAE;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,eAAe;IAqBnB;;OAEG;IACH,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAkB/C;;OAEG;IACH,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa;IAyBxE;;OAEG;IACH,cAAc,CAAC,SAAS,EAAE,aAAa,GAAG,sBAAsB;IAUhE;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE;QAC3C,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,eAAe;IAoBnB;;OAEG;IACH,UAAU,CAAC,SAAS,EAAE,aAAa,GAAG,gBAAgB,EAAE;IAOxD;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAoBjE,OAAO,CAAC,iBAAiB;IAkBzB,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,kBAAkB;IAoB1B,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,0BAA0B;IAalC,OAAO,CAAC,aAAa;CAStB"}

package/bin/http/auth/AuthService.js

@@ -0,0 +1,307 @@
+/**
+ * 统一账户服务层。
+ *
+ * 关键点（中文）
+ * - 该模块承接本机 token 初始化、token 校验与 token 管理等业务语义。
+ * - 路由层只调用这里，不直接碰数据库与密码哈希细节。
+ */
+import { optionalTrimmedText } from "../../shared/utils/store/StoreShared.js";
+import { AuthError } from "./AuthError.js";
+import { AuthStore } from "./AuthStore.js";
+import { extractBearerToken, generateAccessToken, hashAccessToken } from "./TokenService.js";
+const LOCAL_CLI_USERNAME = "local-cli";
+const LOCAL_CLI_DISPLAY_NAME = "Local CLI";
+const LOCAL_CLI_PASSWORD_HASH = "[token-only-local-cli]";
+/**
+ * AuthService 门面。
+ */
+export class AuthService {
+    store;
+    ownsStore;
+    constructor(options = {}) {
+        if (options.store) {
+            this.store = options.store;
+            this.ownsStore = false;
+            return;
+        }
+        this.store = new AuthStore(options);
+        this.ownsStore = true;
+    }
+    /**
+     * 关闭底层连接。
+     */
+    close() {
+        if (this.ownsStore)
+            this.store.close();
+    }
+    /**
+     * 判断当前是否已经存在可用的本机 CLI access token。
+     */
+    hasLocalCliAccess() {
+        const user = this.store.findUserByUsername(LOCAL_CLI_USERNAME);
+        if (!user)
+            return false;
+        return this.store
+            .listTokensByUserId(user.id)
+            .some((item) => this.isTokenActive(item));
+    }
+    /**
+     * 确保存在本机 CLI 主体，并为其签发新的 access token。
+     */
+    ensureLocalCliAccess(input) {
+        const token = this.createLocalCliToken({
+            name: input.tokenName,
+            expiresAt: input.expiresAt,
+        });
+        const user = this.requireLocalCliUser();
+        return {
+            user: this.toUserPayload(user),
+            token,
+        };
+    }
+    /**
+     * 读取本机 CLI 主体的 token 列表。
+     */
+    listLocalCliTokens() {
+        const user = this.store.findUserByUsername(LOCAL_CLI_USERNAME);
+        if (!user)
+            return [];
+        return this.store
+            .listTokensByUserId(user.id)
+            .filter((item) => !item.revokedAt)
+            .map((item) => this.store.toTokenSummary(item));
+    }
+    /**
+     * 为本机 CLI 主体签发新的 access token。
+     */
+    createLocalCliToken(input) {
+        const user = this.ensureLocalCliUser();
+        const issued = this.issueTokenForUser({
+            user,
+            tokenName: input.name,
+            expiresAt: input.expiresAt,
+        });
+        this.store.insertAuditLog({
+            actorUserId: user.id,
+            resourceType: "auth_token",
+            resourceId: issued.record.id,
+            action: "token_create",
+            result: "success",
+            metaJson: JSON.stringify({
+                name: issued.record.name,
+                source: "local-cli",
+            }),
+        });
+        return issued.token;
+    }
+    /**
+     * 删除本机 CLI 主体下的 token。
+     */
+    deleteLocalCliToken(tokenIdInput) {
+        const user = this.requireLocalCliUser();
+        const record = this.requireLocalCliTokenRecord(tokenIdInput, user.id);
+        const deleted = this.store.deleteToken(record.id);
+        if (!deleted)
+            throw new AuthError("Token not found", 404);
+        this.store.insertAuditLog({
+            actorUserId: user.id,
+            resourceType: "auth_token",
+            resourceId: record.id,
+            action: "token_delete",
+            result: "success",
+            metaJson: JSON.stringify({
+                name: record.name,
+                source: "local-cli",
+            }),
+        });
+    }
+    /**
+     * 解析 Authorization 头并返回 principal。
+     */
+    authenticateBearerHeader(headerValue) {
+        const plainToken = extractBearerToken(headerValue);
+        if (!plainToken)
+            throw new AuthError("Missing bearer token", 401);
+        const record = this.store.findTokenByHash(hashAccessToken(plainToken));
+        if (!record)
+            throw new AuthError("Invalid bearer token", 401);
+        if (record.revokedAt)
+            throw new AuthError("Token is revoked", 401);
+        if (record.expiresAt && new Date(record.expiresAt).getTime() <= Date.now()) {
+            throw new AuthError("Token is expired", 401);
+        }
+        const user = this.store.getUserById(record.userId);
+        if (!user)
+            throw new AuthError("User not found for token", 401);
+        this.ensureUserActive(user);
+        this.store.touchToken(record.id);
+        return {
+            userId: user.id,
+            username: user.username,
+            displayName: user.displayName,
+            status: user.status,
+            tokenId: record.id,
+            tokenName: record.name,
+            roles: this.store.listRoleNamesByUserId(user.id),
+            permissions: this.store.listPermissionKeysByUserId(user.id),
+        };
+    }
+    /**
+     * 返回当前用户信息。
+     */
+    getCurrentUser(principal) {
+        return {
+            id: principal.userId,
+            username: principal.username,
+            displayName: principal.displayName,
+            roles: [...principal.roles],
+            permissions: [...principal.permissions],
+        };
+    }
+    /**
+     * 为当前 Bearer 调用主体创建新的 token。
+     */
+    createToken(principal, input) {
+        const user = this.store.getUserById(principal.userId);
+        if (!user)
+            throw new AuthError("User not found", 404);
+        const issued = this.issueTokenForUser({
+            user,
+            tokenName: input.name,
+            expiresAt: input.expiresAt,
+        });
+        this.store.insertAuditLog({
+            actorUserId: principal.userId,
+            actorTokenId: principal.tokenId,
+            resourceType: "auth_token",
+            resourceId: issued.record.id,
+            action: "token_create",
+            result: "success",
+            metaJson: JSON.stringify({ name: issued.record.name }),
+        });
+        return issued.token;
+    }
+    /**
+     * 读取当前用户 token 列表。
+     */
+    listTokens(principal) {
+        return this.store
+            .listTokensByUserId(principal.userId)
+            .filter((item) => !item.revokedAt)
+            .map((item) => this.store.toTokenSummary(item));
+    }
+    /**
+     * 删除当前用户的 token。
+     */
+    deleteToken(principal, tokenIdInput) {
+        const tokenId = String(tokenIdInput || "").trim();
+        if (!tokenId)
+            throw new AuthError("tokenId is required", 400);
+        const record = this.store.getTokenById(tokenId);
+        if (!record || record.userId !== principal.userId) {
+            throw new AuthError("Token not found", 404);
+        }
+        const deleted = this.store.deleteToken(record.id);
+        if (!deleted)
+            throw new AuthError("Token not found", 404);
+        this.store.insertAuditLog({
+            actorUserId: principal.userId,
+            actorTokenId: principal.tokenId,
+            resourceType: "auth_token",
+            resourceId: tokenId,
+            action: "token_delete",
+            result: "success",
+            metaJson: JSON.stringify({ name: record.name }),
+        });
+    }
+    issueTokenForUser(params) {
+        const plainToken = generateAccessToken();
+        const record = this.store.createToken({
+            userId: params.user.id,
+            name: this.requireTokenName(params.tokenName),
+            tokenHash: hashAccessToken(plainToken),
+            expiresAt: optionalTrimmedText(params.expiresAt),
+        });
+        return {
+            record,
+            token: this.store.toIssuedToken(record, plainToken),
+        };
+    }
+    ensureUserActive(user) {
+        if (user.status !== "active") {
+            throw new AuthError("User is disabled", 403);
+        }
+    }
+    isTokenActive(record) {
+        if (record.revokedAt)
+            return false;
+        if (!record.expiresAt)
+            return true;
+        return new Date(record.expiresAt).getTime() > Date.now();
+    }
+    ensureLocalCliUser() {
+        this.store.ensureDefaultCatalog();
+        const existing = this.store.findUserByUsername(LOCAL_CLI_USERNAME);
+        if (existing) {
+            this.ensureUserActive(existing);
+            return existing;
+        }
+        const user = this.store.createUser({
+            username: LOCAL_CLI_USERNAME,
+            passwordHash: LOCAL_CLI_PASSWORD_HASH,
+            displayName: LOCAL_CLI_DISPLAY_NAME,
+            status: "active",
+        });
+        this.store.assignRoleToUser({
+            userId: user.id,
+            roleName: "admin",
+        });
+        return user;
+    }
+    requireTokenName(value) {
+        const tokenName = String(value || "").trim();
+        if (!tokenName)
+            throw new AuthError("token name is required", 400);
+        return tokenName;
+    }
+    requireUserId(value) {
+        const userId = String(value || "").trim();
+        if (!userId)
+            throw new AuthError("userId is required", 400);
+        return userId;
+    }
+    requireUser(userIdInput) {
+        const userId = this.requireUserId(userIdInput);
+        const user = this.store.getUserById(userId);
+        if (!user)
+            throw new AuthError("User not found", 404);
+        return user;
+    }
+    requireLocalCliUser() {
+        const user = this.store.findUserByUsername(LOCAL_CLI_USERNAME);
+        if (!user)
+            throw new AuthError("Local CLI access is not initialized", 404);
+        this.ensureUserActive(user);
+        return user;
+    }
+    requireLocalCliTokenRecord(tokenIdInput, expectedUserId) {
+        const tokenId = String(tokenIdInput || "").trim();
+        if (!tokenId)
+            throw new AuthError("tokenId is required", 400);
+        const record = this.store.getTokenById(tokenId);
+        if (!record || record.userId !== expectedUserId) {
+            throw new AuthError("Token not found", 404);
+        }
+        return record;
+    }
+    toUserPayload(user) {
+        return {
+            id: user.id,
+            username: user.username,
+            displayName: user.displayName,
+            roles: this.store.listRoleNamesByUserId(user.id),
+            permissions: this.store.listPermissionKeysByUserId(user.id),
+        };
+    }
+}
+//# sourceMappingURL=AuthService.js.map

package/bin/http/auth/AuthService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthService.js","sourceRoot":"","sources":["../../../src/http/auth/AuthService.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAyB,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE7F,MAAM,kBAAkB,GAAG,WAAW,CAAC;AACvC,MAAM,sBAAsB,GAAG,WAAW,CAAC;AAC3C,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AAsCzD;;GAEG;AACH,MAAM,OAAO,WAAW;IACL,KAAK,CAAY;IACjB,SAAS,CAAU;IAEpC,YAAY,UAA8B,EAAE;QAC1C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC3B,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,IAAI,CAAC,KAAK;aACd,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;aAC3B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,KAGpB;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC;YACrC,IAAI,EAAE,KAAK,CAAC,SAAS;YACrB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACxC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YAC9B,KAAK;SACN,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,KAAK;aACd,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;aAC3B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;aACjC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,KAGnB;QACC,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACpC,IAAI;YACJ,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;YACxB,WAAW,EAAE,IAAI,CAAC,EAAE;YACpB,YAAY,EAAE,YAAY;YAC1B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;YAC5B,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;gBACvB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;gBACxB,MAAM,EAAE,WAAW;aACpB,CAAC;SACH,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,YAAoB;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,0BAA0B,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;YACxB,WAAW,EAAE,IAAI,CAAC,EAAE;YACpB,YAAY,EAAE,YAAY;YAC1B,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,WAAW;aACpB,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,wBAAwB,CAAC,WAA+B;QACtD,MAAM,UAAU,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC3E,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,MAAM,CAAC,EAAE;YAClB,SAAS,EAAE,MAAM,CAAC,IAAI;YACtB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;SAC5D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,SAAwB;QACrC,OAAO;YACL,EAAE,EAAE,SAAS,CAAC,MAAM;YACpB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;YAC3B,WAAW,EAAE,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC;SACxC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,SAAwB,EAAE,KAGrC;QACC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACpC,IAAI;YACJ,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;YACxB,WAAW,EAAE,SAAS,CAAC,MAAM;YAC7B,YAAY,EAAE,SAAS,CAAC,OAAO;YAC/B,YAAY,EAAE,YAAY;YAC1B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;YAC5B,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,SAAwB;QACjC,OAAO,IAAI,CAAC,KAAK;aACd,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC;aACpC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;aACjC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,SAAwB,EAAE,YAAoB;QACxD,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;YAClD,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;YACxB,WAAW,EAAE,SAAS,CAAC,MAAM;YAC7B,YAAY,EAAE,SAAS,CAAC,OAAO;YAC/B,YAAY,EAAE,YAAY;YAC1B,UAAU,EAAE,OAAO;YACnB,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IAEO,iBAAiB,CAAC,MAIzB;QACC,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;YACpC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;YACtB,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC;YAC7C,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC;YACtC,SAAS,EAAE,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC;SACjD,CAAC,CAAC;QACH,OAAO;YACL,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC;SACpD,CAAC;IACJ,CAAC;IAEO,gBAAgB,CAAC,IAAc;QACrC,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,MAAwD;QAC5E,IAAI,MAAM,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3D,CAAC;IAEO,kBAAkB;QACxB,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;QACnE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAChC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YACjC,QAAQ,EAAE,kBAAkB;YAC5B,YAAY,EAAE,uBAAuB;YACrC,WAAW,EAAE,sBAAsB;YACnC,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;YAC1B,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,gBAAgB,CAAC,KAAa;QACpC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,aAAa,CAAC,KAAa;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC5D,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,WAAW,CAAC,WAAmB;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,mBAAmB;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;QAC3E,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,0BAA0B,CAChC,YAAoB,EACpB,cAAsB;QAEtB,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YAChD,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,aAAa,CAAC,IAAc;QAClC,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;SAC5D,CAAC;IACJ,CAAC;CACF"}

package/bin/http/auth/AuthStore.d.ts

@@ -0,0 +1,165 @@
+/**
+ * 统一账户存储层。
+ *
+ * 关键点（中文）
+ * - 该模块只负责 `auth_*` 表的读写，不处理密码校验与 HTTP 语义。
+ * - 数据仍落在 console 的 SQLite 中，与现有控制面共享底层存储。
+ */
+import type { AuthIssuedToken, AuthTokenSummary } from "../../shared/types/auth/AuthToken.js";
+import { type AuthDefaultRoleName, type AuthPermissionKey } from "../../shared/types/auth/AuthPermission.js";
+import type { AuthAuditLog, AuthTokenRecord, AuthUser } from "../../shared/types/auth/AuthTypes.js";
+/**
+ * AuthStore 构造参数。
+ */
+export interface AuthStoreOptions {
+    /**
+     * SQLite 数据库路径。
+     */
+    dbPath?: string;
+}
+/**
+ * AuthStore 门面。
+ */
+export declare class AuthStore {
+    private readonly sqlite;
+    private readonly context;
+    constructor(options?: AuthStoreOptions);
+    /**
+     * 关闭数据库连接。
+     */
+    close(): void;
+    /**
+     * 返回当前用户数量。
+     */
+    countUsers(): number;
+    /**
+     * 幂等写入默认角色与权限目录。
+     */
+    ensureDefaultCatalog(): void;
+    /**
+     * 创建用户。
+     */
+    createUser(input: {
+        username: string;
+        passwordHash: string;
+        displayName?: string;
+        status?: "active" | "disabled";
+    }): AuthUser;
+    /**
+     * 根据用户名读取用户。
+     */
+    findUserByUsername(usernameInput: string): AuthUser | null;
+    /**
+     * 根据用户 ID 读取用户。
+     */
+    getUserById(userIdInput: string): AuthUser | null;
+    /**
+     * 读取全部用户列表。
+     */
+    listUsers(): AuthUser[];
+    /**
+     * 更新用户基础资料。
+     */
+    updateUser(params: {
+        userId: string;
+        displayName?: string;
+        status?: "active" | "disabled";
+    }): AuthUser | null;
+    /**
+     * 更新用户密码哈希。
+     */
+    updateUserPasswordHash(params: {
+        userId: string;
+        passwordHash: string;
+    }): AuthUser | null;
+    /**
+     * 给用户绑定角色。
+     */
+    assignRoleToUser(params: {
+        userId: string;
+        roleName: AuthDefaultRoleName | string;
+    }): void;
+    /**
+     * 读取用户角色名列表。
+     */
+    listRoleNamesByUserId(userIdInput: string): string[];
+    /**
+     * 清空用户当前绑定的全部角色。
+     */
+    clearRolesByUserId(userIdInput: string): void;
+    /**
+     * 用新的角色集合覆盖用户角色绑定。
+     */
+    replaceRolesByUserId(params: {
+        userId: string;
+        roleNames: string[];
+    }): string[];
+    /**
+     * 统计拥有指定角色且处于 active 状态的用户数量。
+     */
+    countActiveUsersByRole(roleNameInput: string): number;
+    /**
+     * 读取用户权限 key 列表。
+     */
+    listPermissionKeysByUserId(userIdInput: string): AuthPermissionKey[];
+    /**
+     * 创建 token 记录。
+     */
+    createToken(input: {
+        userId: string;
+        name: string;
+        tokenHash: string;
+        expiresAt?: string;
+    }): AuthTokenRecord;
+    /**
+     * 根据 token 哈希读取记录。
+     */
+    findTokenByHash(tokenHashInput: string): AuthTokenRecord | null;
+    /**
+     * 根据 token ID 读取记录。
+     */
+    getTokenById(tokenIdInput: string): AuthTokenRecord | null;
+    /**
+     * 读取用户 token 列表。
+     */
+    listTokensByUserId(userIdInput: string): AuthTokenRecord[];
+    /**
+     * 更新 token 最后使用时间。
+     */
+    touchToken(tokenIdInput: string): void;
+    /**
+     * 吊销 token。
+     */
+    revokeToken(tokenIdInput: string): AuthTokenRecord | null;
+    /**
+     * 删除 token。
+     */
+    deleteToken(tokenIdInput: string): boolean;
+    /**
+     * 写入审计日志。
+     */
+    insertAuditLog(input: {
+        actorUserId?: string;
+        actorTokenId?: string;
+        resourceType: string;
+        resourceId?: string;
+        action: string;
+        result: string;
+        requestId?: string;
+        ip?: string;
+        userAgent?: string;
+        metaJson?: string;
+    }): AuthAuditLog;
+    /**
+     * 将 token 记录转换为对外摘要。
+     */
+    toTokenSummary(record: AuthTokenRecord): AuthTokenSummary;
+    /**
+     * 将 token 记录与明文 token 合成为一次性返回体。
+     */
+    toIssuedToken(record: AuthTokenRecord, token: string): AuthIssuedToken;
+    private toAuthUser;
+    private toAuthToken;
+    private _unused;
+}
+//# sourceMappingURL=AuthStore.d.ts.map

package/bin/http/auth/AuthStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthStore.d.ts","sourceRoot":"","sources":["../../../src/http/auth/AuthStore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAC1F,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACvB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EACV,YAAY,EAGZ,eAAe,EACf,QAAQ,EACT,MAAM,kCAAkC,CAAC;AAS1C;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID;;GAEG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;gBAElC,OAAO,GAAE,gBAAqB;IAY1C;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;OAEG;IACH,UAAU,IAAI,MAAM;IAOpB;;OAEG;IACH,oBAAoB,IAAI,IAAI;IAmE5B;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;KAChC,GAAG,QAAQ;IAuBZ;;OAEG;IACH,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IAQ1D;;OAEG;IACH,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IAQjD;;OAEG;IACH,SAAS,IAAI,QAAQ,EAAE;IAOvB;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;KAChC,GAAG,QAAQ,GAAG,IAAI;IAenB;;OAEG;IACH,sBAAsB,CAAC,MAAM,EAAE;QAC7B,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;KACtB,GAAG,QAAQ,GAAG,IAAI;IAcnB;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI;IAa1F;;OAEG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE;IAgBpD;;OAEG;IACH,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAO7C;;OAEG;IACH,oBAAoB,CAAC,MAAM,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,GAAG,MAAM,EAAE;IAgBZ;;OAEG;IACH,sBAAsB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM;IAgBrD;;OAEG;IACH,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,EAAE;IAmBpE;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,eAAe;IAuBnB;;OAEG;IACH,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAQ/D;;OAEG;IACH,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAQ1D;;OAEG;IACH,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe,EAAE;IAQ1D;;OAEG;IACH,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAQtC;;OAEG;IACH,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IASzD;;OAEG;IACH,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAQ1C;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,YAAY;IAsChB;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,gBAAgB;IAWzD;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,eAAe;IAOtE,OAAO,CAAC,UAAU;IAYlB,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,OAAO;CAGhB"}