@numa-tech/numa 1.14.51 → 1.15.0

package/dist/cloud/bootstrap.js

@@ -0,0 +1,277 @@
+import { spawn } from "node:child_process";
+import { constants, publicEncrypt } from "node:crypto";
+import { mkdir, mkdtemp, readFile, rm, open, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { z } from "zod";
+import { authenticatedBackendRequest } from "../backend.js";
+import { redactOssSensitiveText } from "../oss/errors.js";
+import { loadConfig } from "../config.js";
+const name = z.string().regex(/^[A-Za-z0-9.@_-]{1,64}$/u);
+export const planSchema = z.object({
+    id: z.uuid(), accountId: z.number().int().positive(), accountUid: z.string().regex(/^\d{8,32}$/u), accountCode: z.string(),
+    region: z.string().regex(/^[a-z0-9-]+$/u), username: name, userArn: z.string(), managementRoleName: name,
+    managementRoleArn: z.string(), entryPolicyName: name, managementPolicyName: name, ownershipMarker: z.string(),
+    entryPolicy: z.record(z.string(), z.unknown()), managementPolicy: z.record(z.string(), z.unknown()), publicKey: z.string(), expiresAt: z.iso.datetime(),
+    userDisplayName: z.string().nullish(), userComments: z.string().nullish(), managementRoleDescription: z.string().nullish()
+});
+export const differenceSchema = z.object({ code: z.string(), resource: z.string(), actual: z.string(), expected: z.string(), blocked: z.boolean() });
+export const reportSchema = z.object({ status: z.enum(["HEALTHY", "DRIFT", "BLOCKED"]), differences: z.array(differenceSchema) });
+export const maintenanceSchema = z.object({ operation: z.enum(["CHECK", "REPAIR"]), sourceSessionId: z.uuid(), accessKeyId: z.string().nullish(), report: reportSchema.nullish(), checkedAt: z.string().nullish(), reportHash: z.string().nullish() });
+export const viewSchema = z.object({ plan: planSchema, state: z.string(), events: z.array(z.object({ stage: z.string(), status: z.string(), time: z.string() })), execution: z.object({ id: z.uuid(), leaseUntil: z.string().nullish() }).nullish(), receiptStored: z.boolean().optional(), lastErrorCode: z.string().nullish(), maintenance: maintenanceSchema.nullish() });
+const root = "/api/v1/admin/aliyun-account-bootstrap";
+export async function platformApi(path, body) {
+    const config = loadConfig("platform");
+    const url = new URL(config.backendBaseUrl);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
+        throw new Error("初始化凭据交付只允许 HTTPS 或本机回环地址。");
+    const response = await authenticatedBackendRequest(config, { method: body === undefined ? "GET" : "POST", path, ...(body === undefined ? {} : { body }) });
+    if (response.status < 200 || response.status >= 300) {
+        const parsed = z.object({ detail: z.string().optional(), message: z.string().optional() }).safeParse(response.body);
+        const fallback = response.status === 401 ? "平台登录已失效，请使用 login 重新登录。"
+            : response.status === 403 ? "当前平台身份缺少此操作的管理员权限。"
+                : response.status === 404 ? "平台记录不存在；accountId 是平台账号记录 ID，不是阿里云 UID。使用 UID 请传 --account-uid。"
+                    : response.status === 409 ? "配置或执行状态冲突，请核对平台账号 ID、账号配置和已有初始化计划。"
+                        : "平台请求失败，请根据 HTTP 状态检查服务或请求参数。";
+        throw new PlatformBootstrapApiError(response.status, parsed.success ? parsed.data.detail || parsed.data.message || fallback : fallback);
+    }
+    return response.body;
+}
+export async function bootstrapApi(path, body) {
+    return platformApi(root + path, body);
+}
+export class PlatformBootstrapApiError extends Error {
+    status;
+    constructor(status, message) {
+        super(redactOssSensitiveText(`平台初始化 API HTTP ${status}: ${message}`));
+        this.status = status;
+    }
+}
+export class CloudCommandError extends Error {
+    action;
+    cloudCode;
+    constructor(action, cloudCode) {
+        super(`阿里云 ${action} 失败：${cloudCode}。未输出云端响应或凭据。`);
+        this.action = action;
+        this.cloudCode = cloudCode;
+    }
+}
+export class AliyunBootstrapCli {
+    binary;
+    configPath;
+    constructor(binary, configPath) {
+        this.binary = binary;
+        this.configPath = configPath;
+    }
+    async execute(args, interactive = false) {
+        const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !["ALIBABA_CLOUD_", "ALIBABACLOUD_", "ALICLOUD_", "ALIYUN_"].some(prefix => key.startsWith(prefix))));
+        // The official CLI owns OAuth tokens; never read its config or extract its credentials.
+        env.ALIBABA_CLOUD_CLI_PLUGIN_AUTO_INSTALL = "true";
+        const child = spawn(this.binary, [...args, "--config-path", this.configPath, "--profile", "bootstrap"], { env, stdio: interactive ? "inherit" : ["ignore", "pipe", "pipe"], shell: false });
+        let stdout = "", stderr = "";
+        child.stdout?.on("data", (chunk) => { stdout += chunk.toString(); if (stdout.length > 2_000_000)
+            child.kill(); });
+        child.stderr?.on("data", (chunk) => { stderr += chunk.toString(); if (stderr.length > 100_000)
+            child.kill(); });
+        const timer = setTimeout(() => child.kill(), interactive ? 15 * 60_000 : 90_000);
+        try {
+            const code = await new Promise((done, reject) => { child.once("error", () => reject(new Error("无法启动阿里云 CLI，请检查 --aliyun-bin 路径。"))); child.once("close", done); });
+            if (code !== 0) {
+                const match = (stdout + stderr).match(/(?:"Code"\s*:\s*"|ErrorCode:\s*|code:\s*)([A-Za-z0-9._-]+)/u);
+                throw new CloudCommandError(args.slice(0, 2).join(" "), match?.[1] ?? "COMMAND_FAILED");
+            }
+            return stdout;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    async login() {
+        const version = await this.execute(["version"]);
+        const match = version.match(/(\d+)\.(\d+)\.(\d+)/u);
+        if (!match || Number(match[1]) < 3 || Number(match[1]) === 3 && Number(match[2]) < 3)
+            throw new Error("阿里云 CLI 需要 3.3.0 或更高版本，请使用 --aliyun-bin 指定支持 OAuth 的本地版本。");
+        await this.execute(["configure", "--mode", "OAuth"], true);
+    }
+    call = async (product, action, args = {}) => {
+        const text = await this.execute([product, action, ...Object.entries(args).flatMap(([k, v]) => ["--" + k, v]), "--yes"]);
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            throw new CloudCommandError(action, "INVALID_RESPONSE");
+        }
+    };
+}
+export function record(value) { if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("阿里云返回的数据结构不完整。"); return value; }
+export function canonical(value) {
+    if (Array.isArray(value))
+        return "[" + value.map(canonical).join(",") + "]";
+    if (value && typeof value === "object")
+        return "{" + Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => JSON.stringify(k) + ":" + canonical(v)).join(",") + "}";
+    return JSON.stringify(value);
+}
+export function policyDocument(value) {
+    if (typeof value !== "string")
+        return value;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        try {
+            return JSON.parse(decodeURIComponent(value));
+        }
+        catch {
+            throw new Error("云端策略文档无法解析。");
+        }
+    }
+}
+export async function optional(call, action, args, key) {
+    try {
+        return record((await call("ram", action, args))[key]);
+    }
+    catch (error) {
+        if (error instanceof CloudCommandError && /^EntityNotExist[.]/u.test(error.cloudCode))
+            return undefined;
+        throw error;
+    }
+}
+export function trust(plan) { return { Version: "1", Statement: [{ Effect: "Allow", Action: "sts:AssumeRole", Principal: { RAM: [plan.userArn] } }] }; }
+export function validateCloudMetadata(plan) {
+    for (const [field, value, max] of [
+        ["DisplayName", plan.userDisplayName ?? "DevOps platform entry", 128],
+        ["Comments", plan.userComments ?? plan.ownershipMarker, 128],
+        ["Role Description", plan.managementRoleDescription ?? plan.ownershipMarker, 1024]
+    ]) {
+        if (!value || Buffer.byteLength(value, "utf8") > max)
+            throw new Error(`计划中的 ${field} 超出本地长度保护限制（${max} UTF-8 字节），请修正服务端计划后继续；未执行云端操作。`);
+    }
+}
+export async function preflight(plan, call, reconcileAttachments = false) {
+    planSchema.parse(plan);
+    validateCloudMetadata(plan);
+    if (Date.parse(plan.expiresAt) <= Date.now())
+        throw new Error("初始化计划已过期。");
+    const caller = await call("sts", "GetCallerIdentity");
+    if (caller.AccountId !== plan.accountUid)
+        throw new Error("阿里云登录账号与计划 UID 不一致，未执行任何云端写入。");
+    const user = await optional(call, "GetUser", { UserName: plan.username }, "User");
+    const role = await optional(call, "GetRole", { RoleName: plan.managementRoleName }, "Role");
+    if (user && user.Comments !== (plan.userComments ?? plan.ownershipMarker) || role && role.Description !== (plan.managementRoleDescription ?? plan.ownershipMarker))
+        throw new Error("同名 RAM 用户或 Role 不属于本平台初始化，停止以避免覆盖。");
+    if (role && canonical(policyDocument(role.AssumeRolePolicyDocument)) !== canonical(trust(plan)))
+        throw new Error("现有管理 Role 信任策略与计划不同，未自动覆盖。");
+    const exists = [];
+    for (const [policyName, document] of [[plan.entryPolicyName, plan.entryPolicy], [plan.managementPolicyName, plan.managementPolicy]]) {
+        const policy = await optional(call, "GetPolicy", { PolicyType: "Custom", PolicyName: policyName }, "Policy");
+        exists.push(!!policy);
+        if (policy) {
+            if (policy.Description !== plan.ownershipMarker || typeof policy.DefaultVersion !== "string")
+                throw new Error("同名策略不属于本平台初始化。");
+            const version = record((await call("ram", "GetPolicyVersion", { PolicyType: "Custom", PolicyName: policyName, VersionId: policy.DefaultVersion })).PolicyVersion);
+            if (canonical(policyDocument(version.PolicyDocument)) !== canonical(document))
+                throw new Error("已有系统策略与计划不同，请先审查差异；不会覆盖策略。");
+        }
+    }
+    if (user) {
+        const keys = record((await call("ram", "ListAccessKeys", { UserName: plan.username })).AccessKeys).AccessKey;
+        if (!Array.isArray(keys) || keys.length)
+            throw new Error("入口用户已有 AK；请恢复原加密回执或检查原初始化记录，不会再次创建密钥。");
+    }
+    const attached = async (action, args, name) => {
+        const result = await call("ram", action, args);
+        const policies = record(result.Policies).Policy;
+        if (!Array.isArray(policies))
+            throw new Error("云端策略绑定响应不完整，无法安全恢复。");
+        return policies.some(value => { const policy = record(value); return policy.PolicyName === name && policy.PolicyType === "Custom"; });
+    };
+    return { userExists: !!user, roleExists: !!role, entryPolicyExists: exists[0], managementPolicyExists: exists[1],
+        ...(reconcileAttachments ? {
+            entryPolicyAttached: !!user && !!exists[0] && await attached("ListPoliciesForUser", { UserName: plan.username }, plan.entryPolicyName),
+            managementPolicyAttached: !!role && !!exists[1] && await attached("ListPoliciesForRole", { RoleName: plan.managementRoleName }, plan.managementPolicyName)
+        } : {}) };
+}
+export async function executePlan(plan, call, checkpoint, handoff, options = {}) {
+    // Re-read after approval so the approved plan cannot overwrite intervening changes.
+    const observed = await preflight(plan, call, options.resume);
+    const step = async (stage, action) => {
+        await checkpoint(stage, "STARTED");
+        try {
+            await action();
+            await checkpoint(stage, "SUCCEEDED");
+        }
+        catch (error) {
+            await checkpoint(stage, "FAILED").catch(() => { });
+            throw error;
+        }
+    };
+    await step("USER", async () => { if (!observed.userExists)
+        await call("ram", "CreateUser", { UserName: plan.username, DisplayName: plan.userDisplayName ?? "DevOps platform entry", Comments: plan.userComments ?? plan.ownershipMarker }); });
+    await step("MANAGEMENT_ROLE", async () => { if (!observed.roleExists)
+        await call("ram", "CreateRole", { RoleName: plan.managementRoleName, Description: plan.managementRoleDescription ?? plan.ownershipMarker, AssumeRolePolicyDocument: JSON.stringify(trust(plan)) }); });
+    await step("MANAGEMENT_POLICY", async () => {
+        if (!observed.managementPolicyExists)
+            await call("ram", "CreatePolicy", { PolicyName: plan.managementPolicyName, Description: plan.ownershipMarker, PolicyDocument: JSON.stringify(plan.managementPolicy) });
+        if (!observed.managementPolicyAttached)
+            await call("ram", "AttachPolicyToRole", { PolicyType: "Custom", PolicyName: plan.managementPolicyName, RoleName: plan.managementRoleName });
+    });
+    await step("ENTRY_POLICY", async () => {
+        if (!observed.entryPolicyExists)
+            await call("ram", "CreatePolicy", { PolicyName: plan.entryPolicyName, Description: plan.ownershipMarker, PolicyDocument: JSON.stringify(plan.entryPolicy) });
+        if (!observed.entryPolicyAttached)
+            await call("ram", "AttachPolicyToUser", { PolicyType: "Custom", PolicyName: plan.entryPolicyName, UserName: plan.username });
+    });
+    await createEncryptedKey(plan, call, checkpoint, handoff);
+}
+export async function createEncryptedKey(plan, call, checkpoint, handoff) {
+    // Do not report success or perform another network operation until the one-time secret is durably encrypted.
+    await checkpoint("KEY", "STARTED");
+    const key = record((await call("ram", "CreateAccessKey", { UserName: plan.username })).AccessKey);
+    if (typeof key.AccessKeyId !== "string" || typeof key.AccessKeySecret !== "string")
+        throw new Error("云端未返回完整入口凭据，需检查该用户 AK 状态。");
+    const ciphertext = publicEncrypt({ key: plan.publicKey, oaepHash: "sha256", padding: constants.RSA_PKCS1_OAEP_PADDING }, Buffer.from(JSON.stringify({ accessKeyId: key.AccessKeyId, accessKeySecret: key.AccessKeySecret }))).toString("base64");
+    await handoff(ciphertext);
+    await checkpoint("KEY", "SUCCEEDED");
+}
+export async function withOAuth(binary, run) {
+    const directory = await mkdtemp(join(tmpdir(), "numa-cloud-bootstrap-"));
+    try {
+        // --config-path is a file. Seed it so configure cannot fall back to the user's default profiles.
+        const configPath = join(directory, "config.json");
+        await writeFile(configPath, JSON.stringify({ current: "bootstrap", profiles: [] }), { flag: "wx", mode: 0o600 });
+        const cli = new AliyunBootstrapCli(binary, configPath);
+        await cli.login();
+        return await run(cli);
+    }
+    finally {
+        await rm(directory, { recursive: true, force: true });
+    }
+}
+export async function saveReceipt(path, id, ciphertext) {
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const file = await open(path, "wx", 0o600);
+    try {
+        await file.writeFile(JSON.stringify({ sessionId: id, ciphertext }));
+        await file.sync();
+    }
+    finally {
+        await file.close();
+    }
+    if (process.platform !== "win32") {
+        const directory = await open(dirname(path), "r");
+        try {
+            await directory.sync();
+        }
+        finally {
+            await directory.close();
+        }
+    }
+}
+export async function readReceipt(path, id) {
+    const parsed = z.object({ sessionId: z.uuid(), ciphertext: z.string().max(1024) }).parse(JSON.parse(await readFile(resolve(path), "utf8")));
+    if (parsed.sessionId !== id)
+        throw new Error("回执不属于本次初始化会话。");
+    return { ciphertext: parsed.ciphertext };
+}
+//# sourceMappingURL=bootstrap.js.map

package/dist/cloud/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/cloud/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAC1D,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1H,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,kBAAkB,EAAE,IAAI;IACxG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7G,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IACrJ,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CAC3H,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,IAAI,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,QAAQ,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,MAAM,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,QAAQ,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,OAAO,EAAC,CAAC,CAAC,OAAO,EAAE,EAAC,CAAC,CAAC;AACxI,MAAM,CAAC,MAAM,YAAY,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAC,OAAO,EAAC,SAAS,CAAC,CAAC,EAAC,WAAW,EAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAC,CAAC,CAAC;AAEzH,MAAM,CAAC,MAAM,iBAAiB,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,SAAS,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAC,QAAQ,CAAC,CAAC,EAAC,eAAe,EAAC,CAAC,CAAC,IAAI,EAAE,EAAC,WAAW,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAC,MAAM,EAAC,YAAY,CAAC,OAAO,EAAE,EAAC,SAAS,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAC,UAAU,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAC,CAAC,CAAC;AACvO,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAC,IAAI,EAAC,UAAU,EAAC,KAAK,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,MAAM,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAC,KAAK,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,MAAM,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,IAAI,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,CAAC,CAAC,EAAC,SAAS,EAAC,CAAC,CAAC,MAAM,CAAC,EAAC,EAAE,EAAC,CAAC,CAAC,IAAI,EAAE,EAAC,UAAU,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAC,CAAC,CAAC,OAAO,EAAE,EAAC,aAAa,EAAC,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAC,aAAa,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAC,WAAW,EAAC,iBAAiB,CAAC,OAAO,EAAE,EAAC,CAAC,CAAC;AAElV,MAAM,IAAI,GAAG,wCAAwC,CAAC;AAEtD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAc;IAC5D,MAAM,MAAM,GAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,GAAG,GAAC,IAAI,GAAG,CAAC,MAAM,CAAC,cAAe,CAAC,CAAC;IAC1C,IAAG,GAAG,CAAC,QAAQ,KAAG,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAG,OAAO,IAAI,CAAC,WAAW,EAAC,WAAW,EAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAClK,MAAM,QAAQ,GAAC,MAAM,2BAA2B,CAAC,MAAM,EAAC,EAAC,MAAM,EAAC,IAAI,KAAG,SAAS,CAAA,CAAC,CAAA,KAAK,CAAA,CAAC,CAAA,MAAM,EAAC,IAAI,EAAC,GAAG,CAAC,IAAI,KAAG,SAAS,CAAA,CAAC,CAAA,EAAE,CAAA,CAAC,CAAA,EAAC,IAAI,EAAC,CAAC,EAAC,CAAC,CAAC;IACrI,IAAG,QAAQ,CAAC,MAAM,GAAC,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAE,GAAG,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAC,OAAO,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7G,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,yBAAyB;YAClE,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,oBAAoB;gBAChD,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,iEAAiE;oBAC7F,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,oCAAoC;wBAChE,CAAC,CAAC,8BAA8B,CAAC;QACnC,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1I,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,IAAc;IAC7D,OAAO,WAAW,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAC7B,MAAM;IAA3B,YAAqB,MAAc,EAAE,OAAe;QAClD,KAAK,CAAC,sBAAsB,CAAC,kBAAkB,MAAM,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC;sBADnD,MAAM;IAE3B,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACrB,MAAM;IAAiB,SAAS;IAArD,YAAqB,MAAa,EAAU,SAAgB;QAAG,KAAK,CAAC,OAAO,MAAM,OAAO,SAAS,cAAc,CAAC,CAAC;sBAA7F,MAAM;yBAAiB,SAAS;IAA6D,CAAC;CACpH;AAGD,MAAM,OAAO,kBAAkB;IACR,MAAM;IAAiB,UAAU;IAAtD,YAAqB,MAAa,EAAU,UAAiB;sBAAxC,MAAM;0BAAiB,UAAU;IAAU,CAAC;IACzD,KAAK,CAAC,OAAO,CAAC,IAAa,EAAC,WAAW,GAAC,KAAK;QACnD,MAAM,GAAG,GAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAC,EAAE,CAAA,CAAC,CAAC,gBAAgB,EAAC,eAAe,EAAC,WAAW,EAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA,EAAE,CAAA,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1K,wFAAwF;QACxF,GAAG,CAAC,qCAAqC,GAAC,MAAM,CAAC;QACjD,MAAM,KAAK,GAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAC,CAAC,GAAG,IAAI,EAAC,eAAe,EAAC,IAAI,CAAC,UAAU,EAAC,WAAW,EAAC,WAAW,CAAC,EAAC,EAAC,GAAG,EAAC,KAAK,EAAC,WAAW,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,CAAC,QAAQ,EAAC,MAAM,EAAC,MAAM,CAAC,EAAC,KAAK,EAAC,KAAK,EAAC,CAAC,CAAC;QACxK,IAAI,MAAM,GAAC,EAAE,EAAC,MAAM,GAAC,EAAE,CAAC;QACxB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAC,CAAC,KAAY,EAAC,EAAE,GAAC,MAAM,IAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA,IAAG,MAAM,CAAC,MAAM,GAAC,SAAS;YAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC;QAC7G,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAC,CAAC,KAAY,EAAC,EAAE,GAAC,MAAM,IAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA,IAAG,MAAM,CAAC,MAAM,GAAC,OAAO;YAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC;QAC3G,MAAM,KAAK,GAAC,UAAU,CAAC,GAAE,EAAE,CAAA,KAAK,CAAC,IAAI,EAAE,EAAC,WAAW,CAAA,CAAC,CAAA,EAAE,GAAC,MAAM,CAAA,CAAC,CAAA,MAAM,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,IAAI,GAAC,MAAM,IAAI,OAAO,CAAc,CAAC,IAAI,EAAC,MAAM,EAAC,EAAE,GAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAC,GAAE,EAAE,CAAA,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,CAAA,KAAK,CAAC,IAAI,CAAC,OAAO,EAAC,IAAI,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;YACpK,IAAG,IAAI,KAAG,CAAC,EAAE,CAAC;gBACZ,MAAM,KAAK,GAAC,CAAC,MAAM,GAAC,MAAM,CAAC,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;gBACjG,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAE,gBAAgB,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YAAA,YAAY,CAAC,KAAK,CAAC,CAAC;QAAA,CAAC;IAClC,CAAC;IACD,KAAK,CAAC,KAAK;QACT,MAAM,OAAO,GAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAClD,IAAG,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC3J,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAC,QAAQ,EAAC,OAAO,CAAC,EAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,GAAW,KAAK,EAAC,OAAO,EAAC,MAAM,EAAC,IAAI,GAAC,EAAE,EAAC,EAAE;QAC5C,MAAM,IAAI,GAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAC,MAAM,EAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC,EAAC,EAAE,CAAA,CAAC,IAAI,GAAC,CAAC,EAAC,CAAC,CAAC,CAAC,EAAC,OAAO,CAAC,CAAC,CAAC;QAC7G,IAAG,CAAC;YAAA,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;QAAA,CAAC;QAAA,MAAK,CAAC;YAAA,MAAM,IAAI,iBAAiB,CAAC,MAAM,EAAC,kBAAkB,CAAC,CAAC;QAAA,CAAC;IACvH,CAAC,CAAC;CACH;AAED,MAAM,UAAU,MAAM,CAAC,KAAa,IAA0B,IAAG,CAAC,KAAK,IAAI,OAAO,KAAK,KAAG,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAA,OAAO,KAA+B,CAAC,CAAA,CAAC;AACrM,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAC,OAAO,GAAG,GAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAC,GAAG,CAAC;IACtE,IAAG,KAAK,IAAI,OAAO,KAAK,KAAG,QAAQ;QAAC,OAAO,GAAG,GAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC,CAAC,EAAC,EAAE,CAAA,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC,EAAC,EAAE,CAAA,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAC,GAAG,GAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAC,GAAG,CAAC;IACxK,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAG,OAAO,KAAK,KAAG,QAAQ;QAAC,OAAO,KAAK,CAAC;IACxC,IAAG,CAAC;QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAAA,CAAC;IAAA,MAAK,CAAC;QAAA,IAAG,CAAC;YAAA,OAAO,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;QAAA,CAAC;QAAA,MAAK,CAAC;YAAA,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QAAA,CAAC;IAAA,CAAC;AAC/H,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAc,EAAC,MAAa,EAAC,IAA0B,EAAC,GAAU;IAC/F,IAAG,CAAC;QAAA,OAAO,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAC,MAAM,EAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAAA,CAAC;IAAA,OAAM,KAAK,EAAC,CAAC;QAAA,IAAG,KAAK,YAAY,iBAAiB,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YAAC,OAAO,SAAS,CAAC;QAAA,MAAM,KAAK,CAAC;IAAA,CAAC;AAC3L,CAAC;AACD,MAAM,UAAU,KAAK,CAAC,IAAkB,IAAG,OAAO,EAAC,OAAO,EAAC,GAAG,EAAC,SAAS,EAAC,CAAC,EAAC,MAAM,EAAC,OAAO,EAAC,MAAM,EAAC,gBAAgB,EAAC,SAAS,EAAC,EAAC,GAAG,EAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAC,EAAC,CAAC,EAAC,CAAC,CAAA,CAAC;AAErJ,MAAM,UAAU,qBAAqB,CAAC,IAAkB;IACtD,KAAI,MAAM,CAAC,KAAK,EAAC,KAAK,EAAC,GAAG,CAAC,IAAI;QAC7B,CAAC,aAAa,EAAC,IAAI,CAAC,eAAe,IAAE,uBAAuB,EAAC,GAAG,CAAC;QACjE,CAAC,UAAU,EAAC,IAAI,CAAC,YAAY,IAAE,IAAI,CAAC,eAAe,EAAC,GAAG,CAAC;QACxD,CAAC,kBAAkB,EAAC,IAAI,CAAC,yBAAyB,IAAE,IAAI,CAAC,eAAe,EAAC,IAAI,CAAC;KACtE,EAAE,CAAC;QACX,IAAG,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAC,MAAM,CAAC,GAAC,GAAG;YAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,eAAe,GAAG,iCAAiC,CAAC,CAAC;IACrI,CAAC;AACH,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAkB,EAAC,IAAc,EAAE,oBAAoB,GAAC,KAAK;IAC3F,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvB,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAE,IAAI,CAAC,GAAG,EAAE;QAAC,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;IACvE,MAAM,MAAM,GAAC,MAAM,IAAI,CAAC,KAAK,EAAC,mBAAmB,CAAC,CAAC;IACnD,IAAG,MAAM,CAAC,SAAS,KAAG,IAAI,CAAC,UAAU;QAAC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACvF,MAAM,IAAI,GAAC,MAAM,QAAQ,CAAC,IAAI,EAAC,SAAS,EAAC,EAAC,QAAQ,EAAC,IAAI,CAAC,QAAQ,EAAC,EAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAC,MAAM,QAAQ,CAAC,IAAI,EAAC,SAAS,EAAC,EAAC,QAAQ,EAAC,IAAI,CAAC,kBAAkB,EAAC,EAAC,MAAM,CAAC,CAAC;IACpF,IAAG,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAG,CAAC,IAAI,CAAC,YAAY,IAAE,IAAI,CAAC,eAAe,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAG,CAAC,IAAI,CAAC,yBAAyB,IAAE,IAAI,CAAC,eAAe,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAChN,IAAG,IAAI,IAAI,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,KAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC3I,MAAM,MAAM,GAAW,EAAE,CAAC;IAC1B,KAAI,MAAM,CAAC,UAAU,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,EAAC,IAAI,CAAC,WAAW,CAAC,EAAC,CAAC,IAAI,CAAC,oBAAoB,EAAC,IAAI,CAAC,gBAAgB,CAAC,CAAU,EAAE,CAAC;QACxI,MAAM,MAAM,GAAC,MAAM,QAAQ,CAAC,IAAI,EAAC,WAAW,EAAC,EAAC,UAAU,EAAC,QAAQ,EAAC,UAAU,EAAC,UAAU,EAAC,EAAC,QAAQ,CAAC,CAAC;QAAA,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACzH,IAAG,MAAM,EAAE,CAAC;YACV,IAAG,MAAM,CAAC,WAAW,KAAG,IAAI,CAAC,eAAe,IAAI,OAAO,MAAM,CAAC,cAAc,KAAG,QAAQ;gBAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAC1H,MAAM,OAAO,GAAC,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAC,kBAAkB,EAAC,EAAC,UAAU,EAAC,QAAQ,EAAC,UAAU,EAAC,UAAU,EAAC,SAAS,EAAC,MAAM,CAAC,cAAc,EAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;YACvJ,IAAG,SAAS,CAAC,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,KAAG,SAAS,CAAC,QAAQ,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC3H,CAAC;IACH,CAAC;IACD,IAAG,IAAI,EAAE,CAAC;QACR,MAAM,IAAI,GAAC,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAC,gBAAgB,EAAC,EAAC,QAAQ,EAAC,IAAI,CAAC,QAAQ,EAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC;QACtG,IAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;YAAC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAE,IAA2B,EAAE,IAAY,EAAoB,EAAE;QACrG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACrE,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,MAAM,GAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,UAAU,KAAG,IAAI,IAAI,MAAM,CAAC,UAAU,KAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAClI,CAAC,CAAC;IACF,OAAO,EAAC,UAAU,EAAC,CAAC,CAAC,IAAI,EAAC,UAAU,EAAC,CAAC,CAAC,IAAI,EAAC,iBAAiB,EAAC,MAAM,CAAC,CAAC,CAAE,EAAC,sBAAsB,EAAC,MAAM,CAAC,CAAC,CAAE;QACxG,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;YACzB,mBAAmB,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAC,QAAQ,EAAC,IAAI,CAAC,QAAQ,EAAC,EAAE,IAAI,CAAC,eAAe,CAAC;YACnI,wBAAwB,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAC,QAAQ,EAAC,IAAI,CAAC,kBAAkB,EAAC,EAAE,IAAI,CAAC,oBAAoB,CAAC;SACxJ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAC,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAkB,EAAC,IAAc,EAAC,UAAsD,EAAC,OAA0C,EAAE,OAAO,GAAmB,EAAE;IACjM,oFAAoF;IACpF,MAAM,QAAQ,GAAC,MAAM,SAAS,CAAC,IAAI,EAAC,IAAI,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,IAAI,GAAC,KAAK,EAAC,KAAY,EAAC,MAA2B,EAAC,EAAE;QAC1D,MAAM,UAAU,CAAC,KAAK,EAAC,SAAS,CAAC,CAAC;QAClC,IAAG,CAAC;YAAA,MAAM,MAAM,EAAE,CAAC;YAAA,MAAM,UAAU,CAAC,KAAK,EAAC,WAAW,CAAC,CAAC;QAAA,CAAC;QAAA,OAAM,KAAK,EAAC,CAAC;YAAA,MAAM,UAAU,CAAC,KAAK,EAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAE,EAAE,GAAC,CAAC,CAAC,CAAC;YAAA,MAAM,KAAK,CAAC;QAAA,CAAC;IACnI,CAAC,CAAC;IACF,MAAM,IAAI,CAAC,MAAM,EAAC,KAAK,IAAE,EAAE,GAAC,IAAG,CAAC,QAAQ,CAAC,UAAU;QAAC,MAAM,IAAI,CAAC,KAAK,EAAC,YAAY,EAAC,EAAC,QAAQ,EAAC,IAAI,CAAC,QAAQ,EAAC,WAAW,EAAC,IAAI,CAAC,eAAe,IAAE,uBAAuB,EAAC,QAAQ,EAAC,IAAI,CAAC,YAAY,IAAE,IAAI,CAAC,eAAe,EAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;IAC1N,MAAM,IAAI,CAAC,iBAAiB,EAAC,KAAK,IAAE,EAAE,GAAC,IAAG,CAAC,QAAQ,CAAC,UAAU;QAAC,MAAM,IAAI,CAAC,KAAK,EAAC,YAAY,EAAC,EAAC,QAAQ,EAAC,IAAI,CAAC,kBAAkB,EAAC,WAAW,EAAC,IAAI,CAAC,yBAAyB,IAAE,IAAI,CAAC,eAAe,EAAC,wBAAwB,EAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;IAC1P,MAAM,IAAI,CAAC,mBAAmB,EAAC,KAAK,IAAE,EAAE;QACtC,IAAG,CAAC,QAAQ,CAAC,sBAAsB;YAAC,MAAM,IAAI,CAAC,KAAK,EAAC,cAAc,EAAC,EAAC,UAAU,EAAC,IAAI,CAAC,oBAAoB,EAAC,WAAW,EAAC,IAAI,CAAC,eAAe,EAAC,cAAc,EAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAC,CAAC,CAAC;QAClM,IAAG,CAAC,QAAQ,CAAC,wBAAwB;YAAE,MAAM,IAAI,CAAC,KAAK,EAAC,oBAAoB,EAAC,EAAC,UAAU,EAAC,QAAQ,EAAC,UAAU,EAAC,IAAI,CAAC,oBAAoB,EAAC,QAAQ,EAAC,IAAI,CAAC,kBAAkB,EAAC,CAAC,CAAC;IAC5K,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,cAAc,EAAC,KAAK,IAAE,EAAE;QACjC,IAAG,CAAC,QAAQ,CAAC,iBAAiB;YAAC,MAAM,IAAI,CAAC,KAAK,EAAC,cAAc,EAAC,EAAC,UAAU,EAAC,IAAI,CAAC,eAAe,EAAC,WAAW,EAAC,IAAI,CAAC,eAAe,EAAC,cAAc,EAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,EAAC,CAAC,CAAC;QACnL,IAAG,CAAC,QAAQ,CAAC,mBAAmB;YAAE,MAAM,IAAI,CAAC,KAAK,EAAC,oBAAoB,EAAC,EAAC,UAAU,EAAC,QAAQ,EAAC,UAAU,EAAC,IAAI,CAAC,eAAe,EAAC,QAAQ,EAAC,IAAI,CAAC,QAAQ,EAAC,CAAC,CAAC;IACxJ,CAAC,CAAC,CAAC;IACH,MAAM,kBAAkB,CAAC,IAAI,EAAC,IAAI,EAAC,UAAU,EAAC,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAkB,EAAC,IAAc,EAAC,UAAsD,EAAC,OAA0C;IAC1K,6GAA6G;IAC7G,MAAM,UAAU,CAAC,KAAK,EAAC,SAAS,CAAC,CAAC;IAClC,MAAM,GAAG,GAAC,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAC,iBAAiB,EAAC,EAAC,QAAQ,EAAC,IAAI,CAAC,QAAQ,EAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3F,IAAG,OAAO,GAAG,CAAC,WAAW,KAAG,QAAQ,IAAI,OAAO,GAAG,CAAC,eAAe,KAAG,QAAQ;QAAC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC3H,MAAM,UAAU,GAAC,aAAa,CAAC,EAAC,GAAG,EAAC,IAAI,CAAC,SAAS,EAAC,QAAQ,EAAC,QAAQ,EAAC,OAAO,EAAC,SAAS,CAAC,sBAAsB,EAAC,EAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,WAAW,EAAC,GAAG,CAAC,WAAW,EAAC,eAAe,EAAC,GAAG,CAAC,eAAe,EAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClO,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1B,MAAM,UAAU,CAAC,KAAK,EAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAI,MAAa,EAAC,GAAwC;IACvF,MAAM,SAAS,GAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAC,uBAAuB,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,iGAAiG;QACjG,MAAM,UAAU,GAAC,IAAI,CAAC,SAAS,EAAC,aAAa,CAAC,CAAC;QAC/C,MAAM,SAAS,CAAC,UAAU,EAAC,IAAI,CAAC,SAAS,CAAC,EAAC,OAAO,EAAC,WAAW,EAAC,QAAQ,EAAC,EAAE,EAAC,CAAC,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;QACrG,MAAM,GAAG,GAAC,IAAI,kBAAkB,CAAC,MAAM,EAAC,UAAU,CAAC,CAAC;QAAA,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QAAA,OAAO,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9F,CAAC;YACO,CAAC;QAAA,MAAM,EAAE,CAAC,SAAS,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC;IAAA,CAAC;AAC5D,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAW,EAAC,EAAS,EAAC,UAAiB;IACvE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;IACvD,MAAM,IAAI,GAAC,MAAM,IAAI,CAAC,IAAI,EAAC,IAAI,EAAC,KAAK,CAAC,CAAC;IACvC,IAAG,CAAC;QAAA,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,SAAS,EAAC,EAAE,EAAC,UAAU,EAAC,CAAC,CAAC,CAAC;QAAA,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAAA,CAAC;YAAO,CAAC;QAAA,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IAAA,CAAC;IACnH,IAAG,OAAO,CAAC,QAAQ,KAAG,OAAO,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,GAAG,CAAC,CAAC;QAC9C,IAAG,CAAC;YAAA,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QAAA,CAAC;gBAAO,CAAC;YAAA,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QAAA,CAAC;IAC/D,CAAC;AACH,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAW,EAAC,EAAS;IACrD,MAAM,MAAM,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,SAAS,EAAC,CAAC,CAAC,IAAI,EAAE,EAAC,UAAU,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpI,IAAG,MAAM,CAAC,SAAS,KAAG,EAAE;QAAC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IAAA,OAAO,EAAC,UAAU,EAAC,MAAM,CAAC,UAAU,EAAC,CAAC;AAClG,CAAC"}

package/dist/cloud/business-bootstrap.d.ts

@@ -0,0 +1,62 @@
+import { z } from "zod";
+import { bootstrapApi } from "./bootstrap.js";
+export declare const businessViewSchema: z.ZodObject<{
+    plan: z.ZodObject<{
+        id: z.ZodUUID;
+        accountId: z.ZodNumber;
+        accountUid: z.ZodString;
+        username: z.ZodString;
+        comments: z.ZodString;
+        userAction: z.ZodString;
+        keyAction: z.ZodString;
+    }, z.core.$strip>;
+    state: z.ZodEnum<{
+        CANCELLED: "CANCELLED";
+        COMPLETE: "COMPLETE";
+        PAUSED: "PAUSED";
+        PLANNED: "PLANNED";
+        RUNNING: "RUNNING";
+    }>;
+    events: z.ZodArray<z.ZodObject<{
+        stage: z.ZodString;
+        status: z.ZodString;
+        time: z.ZodString;
+    }, z.core.$strip>>;
+    keyStored: z.ZodBoolean;
+    errorCode: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    verifiedAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    canResume: z.ZodBoolean;
+}, z.core.$strip>;
+export type BusinessView = z.infer<typeof businessViewSchema>;
+export declare const businessStatusSchema: z.ZodObject<{
+    configured: z.ZodBoolean;
+    latest: z.ZodNullable<z.ZodObject<{
+        plan: z.ZodObject<{
+            id: z.ZodUUID;
+            accountId: z.ZodNumber;
+            accountUid: z.ZodString;
+            username: z.ZodString;
+            comments: z.ZodString;
+            userAction: z.ZodString;
+            keyAction: z.ZodString;
+        }, z.core.$strip>;
+        state: z.ZodEnum<{
+            CANCELLED: "CANCELLED";
+            COMPLETE: "COMPLETE";
+            PAUSED: "PAUSED";
+            PLANNED: "PLANNED";
+            RUNNING: "RUNNING";
+        }>;
+        events: z.ZodArray<z.ZodObject<{
+            stage: z.ZodString;
+            status: z.ZodString;
+            time: z.ZodString;
+        }, z.core.$strip>>;
+        keyStored: z.ZodBoolean;
+        errorCode: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        verifiedAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        canResume: z.ZodBoolean;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare function executeBusinessBootstrap(view: BusinessView, api?: typeof bootstrapApi): Promise<BusinessView>;
+export declare function runBusinessBootstrap(accountId: number, json?: boolean): Promise<boolean>;

package/dist/cloud/business-bootstrap.js

@@ -0,0 +1,51 @@
+import { confirm, isCancel, note, outro, select } from "@clack/prompts";
+import { z } from "zod";
+import { bootstrapApi } from "./bootstrap.js";
+export const businessViewSchema = z.object({ plan: z.object({ id: z.uuid(), accountId: z.number(), accountUid: z.string(), username: z.string(), comments: z.string(), userAction: z.string(), keyAction: z.string() }), state: z.enum(['PLANNED', 'RUNNING', 'PAUSED', 'COMPLETE', 'CANCELLED']), events: z.array(z.object({ stage: z.string(), status: z.string(), time: z.string() })), keyStored: z.boolean(), errorCode: z.string().nullish(), verifiedAt: z.string().nullish(), canResume: z.boolean() });
+export const businessStatusSchema = z.object({ configured: z.boolean(), latest: businessViewSchema.nullable() });
+const stages = { USER: '共享业务 RAM 用户', BOUNDARY: '系统与业务隔离策略', KEY: '业务 AK 加密保存', VERIFY: '验证并绑定云账号' };
+export async function executeBusinessBootstrap(view, api = bootstrapApi) {
+    const result = businessViewSchema.parse(await api(`/business/${view.plan.id}/run`, {}));
+    if (result.state !== 'COMPLETE')
+        throw new Error(`共享业务身份初始化已暂停（${result.errorCode ?? result.state}）。进度已保存在服务器；按同一 UID 重新运行 bootstrap 继续。${result.errorCode === 'KEY_OUTCOME_UNKNOWN' ? 'AK 创建结果未知，必须先核对云端，不会重复创建 AK。' : ''}`);
+    return result;
+}
+export async function runBusinessBootstrap(accountId, json = false) {
+    let view = businessViewSchema.parse(await bootstrapApi(`/accounts/${accountId}/business`, {}));
+    note(`云账号 UID：${view.plan.accountUid}\n共享业务用户：${view.plan.username}\n用户：${view.plan.userAction === 'CREATE' ? '创建' : '复用'}；AK：${view.plan.keyAction === 'REUSE' ? '复用已托管凭据' : '创建并加密保存'}\n\n仅建立共享业务身份，并禁止它扮演系统管理 Role。具体业务 Role 和权限由各模块配置。\n会话：${view.plan.id}`, '共享业务身份 bootstrap', { output: process.stderr });
+    for (const event of view.events)
+        process.stderr.write(`  ${stages[event.stage] ?? event.stage} · ${event.status}\n`);
+    if (view.state === 'COMPLETE')
+        return true;
+    if (view.state === 'RUNNING') {
+        outro('服务端正在执行，请稍后按同一 UID 继续查看。', { output: process.stderr });
+        return false;
+    }
+    const choice = await select({ message: '共享业务身份', output: process.stderr, options: [{ value: 'run', label: view.state === 'PAUSED' ? '继续未完成步骤' : '开始初始化' }, { value: 'later', label: '稍后继续' }, { value: 'cancel', label: '终止本次业务身份任务' }] });
+    if (isCancel(choice) || choice === 'later') {
+        outro('业务身份进度已保留。', { output: process.stderr });
+        return false;
+    }
+    if (choice === 'cancel') {
+        const yes = await confirm({ message: '确认终止？已创建的 RAM 用户和 AK 会保留，请核对云端及托管凭据。', initialValue: false, output: process.stderr });
+        if (!isCancel(yes) && yes) {
+            await bootstrapApi(`/business/${view.plan.id}/cancel`, {});
+            outro('业务身份任务已终止。', { output: process.stderr });
+        }
+        return false;
+    }
+    const yes = await confirm({ message: '按以上范围初始化并设置云账号的默认共享业务身份？', initialValue: false, output: process.stderr });
+    if (isCancel(yes) || !yes) {
+        outro('已保留计划，未开始执行。', { output: process.stderr });
+        return false;
+    }
+    process.stderr.write('平台正在使用系统管理身份执行；断开终端后，仍可通过云账号页面查看服务端进度。\n');
+    view = await executeBusinessBootstrap(view);
+    for (const event of view.events.filter(e => e.status === 'SUCCEEDED'))
+        process.stderr.write(`  ✓ ${stages[event.stage] ?? event.stage}\n`);
+    outro('共享业务身份已验证，并设为云账号默认配置。业务权限由各模块继续配置。', { output: process.stderr });
+    if (json)
+        process.stdout.write(JSON.stringify({ ok: true, business: view }) + '\n');
+    return true;
+}
+//# sourceMappingURL=business-bootstrap.js.map

package/dist/cloud/business-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-bootstrap.js","sourceRoot":"","sources":["../../src/cloud/business-bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,MAAM,CAAC,MAAM,kBAAkB,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,IAAI,EAAC,CAAC,CAAC,MAAM,CAAC,EAAC,EAAE,EAAC,CAAC,CAAC,IAAI,EAAE,EAAC,SAAS,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,UAAU,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,QAAQ,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,QAAQ,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,UAAU,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,SAAS,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,CAAC,EAAC,KAAK,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAC,SAAS,EAAC,QAAQ,EAAC,UAAU,EAAC,WAAW,CAAC,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAC,KAAK,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,MAAM,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,IAAI,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,CAAC,CAAC,EAAC,SAAS,EAAC,CAAC,CAAC,OAAO,EAAE,EAAC,SAAS,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAC,UAAU,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAC,SAAS,EAAC,CAAC,CAAC,OAAO,EAAE,EAAC,CAAC,CAAC;AAErc,MAAM,CAAC,MAAM,oBAAoB,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,UAAU,EAAC,CAAC,CAAC,OAAO,EAAE,EAAC,MAAM,EAAC,kBAAkB,CAAC,QAAQ,EAAE,EAAC,CAAC,CAAC;AAC1G,MAAM,MAAM,GAAuB,EAAC,IAAI,EAAC,aAAa,EAAC,QAAQ,EAAC,WAAW,EAAC,GAAG,EAAC,YAAY,EAAC,MAAM,EAAC,UAAU,EAAC,CAAC;AAChH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAAiB,EAAC,GAAG,GAAC,YAAY;IAChF,MAAM,MAAM,GAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAC,EAAE,CAAC,CAAC,CAAC;IACrF,IAAG,MAAM,CAAC,KAAK,KAAG,UAAU;QAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,CAAC,SAAS,IAAE,MAAM,CAAC,KAAK,yCAAyC,MAAM,CAAC,SAAS,KAAG,qBAAqB,CAAA,CAAC,CAAA,8BAA8B,CAAA,CAAC,CAAA,EAAE,EAAE,CAAC,CAAC;IAClN,OAAO,MAAM,CAAC;AACf,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAgB,EAAC,IAAI,GAAC,KAAK;IACrE,IAAI,IAAI,GAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,aAAa,SAAS,WAAW,EAAC,EAAE,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,UAAU,YAAY,IAAI,CAAC,IAAI,CAAC,QAAQ,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,KAAG,QAAQ,CAAA,CAAC,CAAA,IAAI,CAAA,CAAC,CAAA,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,KAAG,OAAO,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,SAAS,0DAA0D,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAC,kBAAkB,EAAC,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,CAAC,CAAC;IAChS,KAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM;QAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAE,KAAK,CAAC,KAAK,MAAM,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;IACjH,IAAG,IAAI,CAAC,KAAK,KAAG,UAAU;QAAE,OAAO,IAAI,CAAC;IACxC,IAAG,IAAI,CAAC,KAAK,KAAG,SAAS,EAAC,CAAC;QAAA,KAAK,CAAC,0BAA0B,EAAC,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,CAAC,CAAC;QAAA,OAAO,KAAK,CAAC;IAAA,CAAC;IACnG,MAAM,MAAM,GAAC,MAAM,MAAM,CAAC,EAAC,OAAO,EAAC,QAAQ,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,OAAO,EAAC,CAAC,EAAC,KAAK,EAAC,KAAK,EAAC,KAAK,EAAC,IAAI,CAAC,KAAK,KAAG,QAAQ,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,OAAO,EAAC,EAAC,EAAC,KAAK,EAAC,OAAO,EAAC,KAAK,EAAC,MAAM,EAAC,EAAC,EAAC,KAAK,EAAC,QAAQ,EAAC,KAAK,EAAC,YAAY,EAAC,CAAC,EAAC,CAAC,CAAC;IAC3M,IAAG,QAAQ,CAAC,MAAM,CAAC,IAAE,MAAM,KAAG,OAAO,EAAC,CAAC;QAAA,KAAK,CAAC,YAAY,EAAC,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,CAAC,CAAC;QAAA,OAAO,KAAK,CAAC;IAAA,CAAC;IACjG,IAAG,MAAM,KAAG,QAAQ,EAAE,CAAC;QACtB,MAAM,GAAG,GAAC,MAAM,OAAO,CAAC,EAAC,OAAO,EAAC,sCAAsC,EAAC,YAAY,EAAC,KAAK,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,CAAC,CAAC;QACnH,IAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAE,GAAG,EAAC,CAAC;YAAA,MAAM,YAAY,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAC,EAAE,CAAC,CAAC;YAAA,KAAK,CAAC,YAAY,EAAC,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,CAAC,CAAC;QAAA,CAAC;QAAA,OAAO,KAAK,CAAC;IAC7I,CAAC;IACD,MAAM,GAAG,GAAC,MAAM,OAAO,CAAC,EAAC,OAAO,EAAC,0BAA0B,EAAC,YAAY,EAAC,KAAK,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,CAAC,CAAC;IACvG,IAAG,QAAQ,CAAC,GAAG,CAAC,IAAE,CAAC,GAAG,EAAC,CAAC;QAAA,KAAK,CAAC,cAAc,EAAC,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,CAAC,CAAC;QAAA,OAAO,KAAK,CAAC;IAAA,CAAC;IACpF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACjE,IAAI,GAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC1C,KAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,MAAM,KAAG,WAAW,CAAC;QAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IACnI,KAAK,CAAC,oCAAoC,EAAC,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,CAAC,CAAC;IACpE,IAAG,IAAI;QAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,EAAE,EAAC,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,CAAC,GAAC,IAAI,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/cloud/commands.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerCloudCommands(program: Command): void;

package/dist/cloud/commands.js

@@ -0,0 +1,39 @@
+import { z } from "zod";
+import { resolveBootstrapAccount } from "./accounts.js";
+import { runBootstrapWizard } from "./wizard.js";
+import { bootstrapApi, viewSchema, readReceipt } from "./bootstrap.js";
+function print(command, view) {
+    if (command.optsWithGlobals().json)
+        process.stdout.write(JSON.stringify({ ok: true, ...view }, null, 2) + "\n");
+    else
+        process.stdout.write(`初始化 ${view.plan.id}：${view.state}\n云账号：${view.plan.accountCode} (${view.plan.accountUid})\n入口用户：${view.plan.username}\n管理 Role：${view.plan.managementRoleName}\n显示名称：${view.plan.userDisplayName ?? "DevOps platform entry"}\n用户备注：${view.plan.userComments ?? view.plan.ownershipMarker}\n角色说明：${view.plan.managementRoleDescription ?? view.plan.ownershipMarker}\n权限：RAM 管理、云资源清单查询；不创建 OSS 业务权限。\n`);
+}
+export function registerCloudCommands(program) {
+    const bootstrap = program.command("cloud").description("平台云账号管理（固定平台身份源）").command("bootstrap").description("云账号初始化：系统身份、共享业务身份和默认 OSS Role");
+    bootstrap.command("plan [accountId]").description("创建系统初始化计划；accountId 为平台记录 ID（不是阿里云 UID）")
+        .option("--account-uid <uid>", "使用阿里云 UID；已有账号直接生成计划，不存在则交互创建账号")
+        .action(async (id, options, command) => {
+        const account = await resolveBootstrapAccount(id, options.accountUid, {
+            onCreated: accountId => process.stderr.write(`已创建平台云账号，记录 ID：${accountId}。正在生成初始化计划；如生成失败，可用 cloud bootstrap plan ${accountId} 重试。\n`)
+        });
+        print(command, viewSchema.parse(await bootstrapApi(`/accounts/${account}`, {})));
+    });
+    bootstrap.command("status <sessionId>").description("读取初始化计划与逐步执行结果")
+        .action(async (id, _options, command) => print(command, viewSchema.parse(await bootstrapApi(`/sessions/${z.uuid().parse(id)}`))));
+    bootstrap.command("cancel <sessionId>").description("终止初始化会话；不删除已创建的云资源").requiredOption("--yes", "确认终止")
+        .action(async (id, _options, command) => print(command, viewSchema.parse(await bootstrapApi(`/sessions/${z.uuid().parse(id)}/cancel`, {}))));
+    bootstrap.command("run [sessionId]").description("TUI 向导：自动生成或恢复服务端计划并继续初始化")
+        .option("--account-uid <uid>", "按 UID 开始或继续初始化，无需手动 plan")
+        .option("--aliyun-bin <path>", "官方阿里云 CLI 路径")
+        .option("--confirm-account <uid>", "明确批准指定云账号的初始化范围")
+        .action(async (sessionId, options, command) => {
+        await runBootstrapWizard({ ...options, ...(sessionId ? { sessionId: z.uuid().parse(sessionId) } : {}) }, command.optsWithGlobals().json === true);
+    });
+    bootstrap.command("import <sessionId>").description("用原加密回执重试验证和凭据导入，不重新创建云资源")
+        .requiredOption("--receipt <path>", "执行器保存的加密回执文件")
+        .action(async (id, options, command) => {
+        id = z.uuid().parse(id);
+        print(command, viewSchema.parse(await bootstrapApi(`/sessions/${id}/complete`, await readReceipt(options.receipt, id))));
+    });
+}
+//# sourceMappingURL=commands.js.map

package/dist/cloud/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/cloud/commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,YAAY,EAAC,UAAU,EAAC,WAAW,EAAqB,MAAM,gBAAgB,CAAC;AAExF,SAAS,KAAK,CAAC,OAAe,EAAC,IAAkB;IAC/C,IAAG,OAAO,CAAC,eAAe,EAAmB,CAAC,IAAI;QAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,EAAE,EAAC,IAAI,EAAC,GAAG,IAAI,EAAC,EAAC,IAAI,EAAC,CAAC,CAAC,GAAC,IAAI,CAAC,CAAC;;QAClH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,aAAa,IAAI,CAAC,IAAI,CAAC,kBAAkB,UAAU,IAAI,CAAC,IAAI,CAAC,eAAe,IAAE,uBAAuB,UAAU,IAAI,CAAC,IAAI,CAAC,YAAY,IAAE,IAAI,CAAC,IAAI,CAAC,eAAe,UAAU,IAAI,CAAC,IAAI,CAAC,yBAAyB,IAAE,IAAI,CAAC,IAAI,CAAC,eAAe,qCAAqC,CAAC,CAAC;AACha,CAAC;AACD,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,SAAS,GAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,gCAAgC,CAAC,CAAC;IAC5I,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,WAAW,CAAC,yCAAyC,CAAC;SACzF,MAAM,CAAC,qBAAqB,EAAE,iCAAiC,CAAC;SAChE,MAAM,CAAC,KAAK,EAAC,EAAmB,EAAC,OAA4B,EAAC,OAAe,EAAC,EAAE;QAC/E,MAAM,OAAO,GAAC,MAAM,uBAAuB,CAAC,EAAE,EAAC,OAAO,CAAC,UAAU,EAAE;YACjE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,SAAS,4CAA4C,SAAS,QAAQ,CAAC;SACvI,CAAC,CAAC;QACH,KAAK,CAAC,OAAO,EAAC,UAAU,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,aAAa,OAAO,EAAE,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IACL,SAAS,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC;SAClE,MAAM,CAAC,KAAK,EAAC,EAAS,EAAC,QAAQ,EAAC,OAAe,EAAC,EAAE,CAAA,KAAK,CAAC,OAAO,EAAC,UAAU,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7I,SAAS,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,cAAc,CAAC,OAAO,EAAC,MAAM,CAAC;SACrG,MAAM,CAAC,KAAK,EAAC,EAAS,EAAC,QAAQ,EAAC,OAAe,EAAC,EAAE,CAAA,KAAK,CAAC,OAAO,EAAC,UAAU,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvJ,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,WAAW,CAAC,2BAA2B,CAAC;SAC1E,MAAM,CAAC,qBAAqB,EAAC,0BAA0B,CAAC;SACxD,MAAM,CAAC,qBAAqB,EAAC,cAAc,CAAC;SAC5C,MAAM,CAAC,yBAAyB,EAAC,iBAAiB,CAAC;SACnD,MAAM,CAAC,KAAK,EAAC,SAA0B,EAAC,OAAqE,EAAC,OAAe,EAAC,EAAE;QAC/H,MAAM,kBAAkB,CAAC,EAAC,GAAG,OAAO,EAAC,GAAG,CAAC,SAAS,CAAA,CAAC,CAAA,EAAC,SAAS,EAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,EAAC,OAAO,CAAC,eAAe,EAAmB,CAAC,IAAI,KAAG,IAAI,CAAC,CAAC;IACxJ,CAAC,CAAC,CAAC;IACL,SAAS,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,WAAW,CAAC,0BAA0B,CAAC;SAC5E,cAAc,CAAC,kBAAkB,EAAC,cAAc,CAAC;SACjD,MAAM,CAAC,KAAK,EAAC,EAAS,EAAC,OAAwB,EAAC,OAAe,EAAC,EAAE;QACjE,EAAE,GAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAAA,KAAK,CAAC,OAAO,EAAC,UAAU,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,aAAa,EAAE,WAAW,EAAC,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9I,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cloud/maintenance.d.ts

@@ -0,0 +1,78 @@
+import { bootstrapApi, type BootstrapView, type BootstrapPlan, type CloudCall, type CheckReport } from "./bootstrap.js";
+type Action = {
+    stage: string;
+    action: string;
+    args: Record<string, string>;
+};
+export type Inspection = {
+    report: CheckReport;
+    actions: Action[];
+    replaceKey: boolean;
+};
+export declare function inspectMaintenance(plan: BootstrapPlan, keyId: string | null | undefined, call: CloudCall): Promise<Inspection>;
+export declare function executeMaintenanceActions(plan: BootstrapPlan, inspection: Inspection, call: CloudCall, checkpoint: (stage: string, status: string) => Promise<void>, handoff: (value: string) => Promise<void>): Promise<void>;
+type MaintenanceOptions = {
+    binary: string;
+    approve: (view: BootstrapView) => Promise<boolean>;
+    oauthFallback: () => Promise<boolean>;
+    display: (stage: string, status: string) => void;
+};
+export declare function executeMaintenance(current: BootstrapView, options: MaintenanceOptions, deps?: {
+    api?: typeof bootstrapApi;
+    oauth?: <T>(binary: string, run: (cli: {
+        call: CloudCall;
+    }) => Promise<T>) => Promise<T>;
+    receiptPath?: string;
+}): Promise<{
+    plan: {
+        id: string;
+        accountId: number;
+        accountUid: string;
+        accountCode: string;
+        region: string;
+        username: string;
+        userArn: string;
+        managementRoleName: string;
+        managementRoleArn: string;
+        entryPolicyName: string;
+        managementPolicyName: string;
+        ownershipMarker: string;
+        entryPolicy: Record<string, unknown>;
+        managementPolicy: Record<string, unknown>;
+        publicKey: string;
+        expiresAt: string;
+        userDisplayName?: string | null | undefined;
+        userComments?: string | null | undefined;
+        managementRoleDescription?: string | null | undefined;
+    };
+    state: string;
+    events: {
+        stage: string;
+        status: string;
+        time: string;
+    }[];
+    execution?: {
+        id: string;
+        leaseUntil?: string | null | undefined;
+    } | null | undefined;
+    receiptStored?: boolean | undefined;
+    lastErrorCode?: string | null | undefined;
+    maintenance?: {
+        operation: "CHECK" | "REPAIR";
+        sourceSessionId: string;
+        accessKeyId?: string | null | undefined;
+        report?: {
+            status: "BLOCKED" | "DRIFT" | "HEALTHY";
+            differences: {
+                code: string;
+                resource: string;
+                actual: string;
+                expected: string;
+                blocked: boolean;
+            }[];
+        } | null | undefined;
+        checkedAt?: string | null | undefined;
+        reportHash?: string | null | undefined;
+    } | null | undefined;
+}>;
+export {};