@taicode/common-server 4.0.0-beta.2 → 4.0.0-beta.4

package/output/app/middleware/context.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../source/app/middleware/context.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD;;;;;GAKG;AAEH,MAAM,WAAW,wBAAwB;IACvC,iBAAiB;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,wBAA6B,GAAG,cAAc,CAa9F"}

package/output/app/middleware/context.js

@@ -1,15 +0,0 @@
-import { createContext } from '../../context/index.js';
-export function createContextMiddleware(options = {}) {
-    const decorateAs = options.decorateAs ?? 'ctx';
-    return {
-        name: 'context',
-        register: (app) => {
-            app.decorateRequest(decorateAs, null);
-            app.addHook('onRequest', (request, _reply, done) => {
-                ;
-                request[decorateAs] = createContext(request);
-                done();
-            });
-        },
-    };
-}

package/output/app/middleware/cors.d.ts

@@ -1,14 +0,0 @@
-import type { MiddlewareContext, MiddlewareUnit } from '../types.js';
-/**
- * 标准中间件单元 `cors`（可替换）。
- *
- * 不传 `origins` → **每次请求现读**配置的 `cors` 键（配置加载后即生效，不得缓存）；
- * **未配置即放行任意源 + 首次请求 warn 一次**（对齐四家现状）。构造期**不读配置**，
- * 故出 spec 路径（配置不可用）不受影响。
- */
-export interface CorsMiddlewareOptions {
-    origins?: string[] | '*';
-    credentials?: boolean;
-}
-export declare function createCorsMiddleware<C = unknown, S = unknown>(ctx: MiddlewareContext<C, S>, options?: CorsMiddlewareOptions): MiddlewareUnit;
-//# sourceMappingURL=cors.d.ts.map

package/output/app/middleware/cors.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../source/app/middleware/cors.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEpE;;;;;;GAMG;AAEH,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;IACxB,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAOD,wBAAgB,oBAAoB,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,GAAE,qBAA0B,GAAG,cAAc,CA6BhJ"}

package/output/app/middleware/cors.js

@@ -1,30 +0,0 @@
-import cors from '@fastify/cors';
-import { readConfigKey } from '../context.js';
-export function createCorsMiddleware(ctx, options = {}) {
-    return {
-        name: 'cors',
-        register: async (app) => {
-            let warned = false;
-            // 请求期现读：`cors` 配置变化立即生效；构造期不读
-            const resolveOrigins = () => {
-                const configured = readConfigKey(ctx.config, 'cors');
-                return options.origins ?? (configured?.enabled ? configured.origins : undefined);
-            };
-            await app.register(cors, {
-                origin: (origin, callback) => {
-                    const origins = resolveOrigins();
-                    if (origins === undefined || origins === '*') {
-                        if (!warned) {
-                            warned = true;
-                            ctx.log.warn({}, '[middleware] cors origins not configured; allowing any origin');
-                        }
-                        callback(null, true);
-                        return;
-                    }
-                    callback(null, origins.includes(origin ?? ''));
-                },
-                credentials: options.credentials ?? true,
-            });
-        },
-    };
-}

package/output/app/middleware/index.d.ts

@@ -1,17 +0,0 @@
-import type { MiddlewareContext, MiddlewareUnit } from '../types.js';
-export { createCorsMiddleware } from './cors.js';
-export { createContextMiddleware } from './context.js';
-export { createAuthMiddleware, defaultAuthSkip } from './auth.js';
-export { createRateLimitMiddleware } from './rate-limit.js';
-export type { CorsMiddlewareOptions } from './cors.js';
-export type { ContextMiddlewareOptions } from './context.js';
-export type { AccountIntegrationConfig, AuthMiddlewareOptions, AuthSkip, AuthVerifyInput, AuthVerifyMetadata, AuthVerifyResult, } from './auth.js';
-export type { RateLimitMiddlewareOptions } from './rate-limit.js';
-/**
- * 默认中间件预设：`[cors, context, auth]`。
- *
- * 顺序 `cors → context → auth` 只是**预设内容**，不是框架常量：可 `...defaultMiddlewares(ctx)`
- * 后替换 / 插入 / 删除任意项。`rateLimit` **不在**预设内（唯一一个默认不装的项）。
- */
-export declare function defaultMiddlewares<C = unknown, S = unknown>(ctx: MiddlewareContext<C, S>): MiddlewareUnit[];
-//# sourceMappingURL=index.d.ts.map

package/output/app/middleware/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../source/app/middleware/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAE3D,YAAY,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAA;AACtD,YAAY,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAC5D,YAAY,EACV,wBAAwB,EACxB,qBAAqB,EACrB,QAAQ,EACR,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,WAAW,CAAA;AAClB,YAAY,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAA;AAEjE;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EACzD,GAAG,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,GAC3B,cAAc,EAAE,CAElB"}

package/output/app/middleware/index.js

@@ -1,16 +0,0 @@
-import { createAuthMiddleware } from './auth.js';
-import { createContextMiddleware } from './context.js';
-import { createCorsMiddleware } from './cors.js';
-export { createCorsMiddleware } from './cors.js';
-export { createContextMiddleware } from './context.js';
-export { createAuthMiddleware, defaultAuthSkip } from './auth.js';
-export { createRateLimitMiddleware } from './rate-limit.js';
-/**
- * 默认中间件预设：`[cors, context, auth]`。
- *
- * 顺序 `cors → context → auth` 只是**预设内容**，不是框架常量：可 `...defaultMiddlewares(ctx)`
- * 后替换 / 插入 / 删除任意项。`rateLimit` **不在**预设内（唯一一个默认不装的项）。
- */
-export function defaultMiddlewares(ctx) {
-    return [createCorsMiddleware(ctx), createContextMiddleware(), createAuthMiddleware(ctx)];
-}

package/output/app/middleware/rate-limit.d.ts

@@ -1,24 +0,0 @@
-import type { MiddlewareContext, MiddlewareUnit } from '../types.js';
-import type { RateLimitStore } from '../../rate-limiter/types.js';
-/**
- * 标准中间件单元 `rateLimit`（可替换；**不在默认预设内**）。
- *
- * 路由级限流；存储后端由调用方注入（缺省进程内 memory）。`TOO_MANY_REQUESTS` 经 `UserError`
- * 仍映射 **400**。路由未声明 `config.rateLimit` 且未给 `defaultLimit` 时该项空转。
- *
- * 注：中间件的 ctx 看不到 `resources`（中间件不得直连数据层），因此 Redis store 需由调用方
- * 在 `services` 侧构造后注入（`store`），框架不再自行探测 Redis。
- */
-export interface RateLimitMiddlewareOptions {
-    /** 存储后端（缺省进程内 memory） */
-    store?: RateLimitStore;
-    /** 限流键前缀（缺省 `<service>:`） */
-    keyPrefix?: string;
-    /** 缺省规则：路由未声明 `config.rateLimit` 时使用 */
-    defaultLimit?: {
-        max: number;
-        windowMs: number;
-    };
-}
-export declare function createRateLimitMiddleware<C = unknown, S = unknown>(ctx: MiddlewareContext<C, S>, options?: RateLimitMiddlewareOptions): MiddlewareUnit;
-//# sourceMappingURL=rate-limit.d.ts.map

package/output/app/middleware/rate-limit.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../source/app/middleware/rate-limit.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAGjE;;;;;;;;GAQG;AAEH,MAAM,WAAW,0BAA0B;IACzC,yBAAyB;IACzB,KAAK,CAAC,EAAE,cAAc,CAAA;IACtB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,wCAAwC;IACxC,YAAY,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CACjD;AAsBD,wBAAgB,yBAAyB,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,GAAE,0BAA+B,GAAG,cAAc,CA0B1J"}

package/output/app/middleware/rate-limit.js

@@ -1,46 +0,0 @@
-import { createRateLimitKey, RateLimiter } from '../../rate-limiter/rate-limiter.js';
-import { MemoryRateLimitStore } from '../../rate-limiter/memory-store.js';
-import { readServerIdentity } from '../core/identity.js';
-import { UserError } from '../errors.js';
-function resolveRule(request, defaultRule) {
-    const configured = request.routeOptions?.config?.rateLimit;
-    return configured ?? defaultRule;
-}
-function buildKeys(request, keys) {
-    return keys.map((key) => {
-        if (key === 'ip') {
-            return `ip:${request.ip}`;
-        }
-        if (key === 'user') {
-            return `user:${String(request.user?.id ?? 'anonymous')}`;
-        }
-        if (key === 'path') {
-            return `path:${request.routeOptions?.url ?? request.url}`;
-        }
-        return `${key}:${String(request[key] ?? '')}`;
-    });
-}
-export function createRateLimitMiddleware(ctx, options = {}) {
-    void ctx;
-    return {
-        name: 'rateLimit',
-        register: (app) => {
-            const limiter = new RateLimiter({ store: options.store ?? new MemoryRateLimitStore() });
-            const prefix = options.keyPrefix ?? `${readServerIdentity(app)?.service ?? ''}:`;
-            const defaultRule = options.defaultLimit
-                ? { limit: options.defaultLimit.max, window: options.defaultLimit.windowMs / 1000 }
-                : undefined;
-            app.addHook('preValidation', async (request) => {
-                const rule = resolveRule(request, defaultRule);
-                if (!rule) {
-                    return;
-                }
-                const keys = buildKeys(request, rule.keys ?? ['ip']).map((key) => createRateLimitKey(prefix, key));
-                const result = await limiter.checkMultiLimit(keys, { limit: rule.limit, window: rule.window });
-                if (!result.allowed) {
-                    throw new UserError('TOO_MANY_REQUESTS', undefined, '请求过于频繁');
-                }
-            });
-        },
-    };
-}

package/output/app/middleware-order.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=middleware-order.test.d.ts.map

package/output/app/middleware-order.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"middleware-order.test.d.ts","sourceRoot":"","sources":["../../source/app/middleware-order.test.ts"],"names":[],"mappings":""}

package/output/app/middleware-order.test.js

@@ -1,148 +0,0 @@
-import { describe, expect, expectTypeOf, it } from 'vitest';
-import { defineServer, startServer } from './entries.js';
-import { defaultMiddlewares } from './middleware/index.js';
-/**
- * 中间件数组序（N1 §1 / §4）。
- *
- * `middlewares(ctx)` 返回**有序数组**，框架**严格按数组序**注册（无键、无枚举、无内置相对顺序魔法）；
- * `rateLimit` **不在**默认预设内。中间件单元是 `{ name?, register(app) }`：**不参与生命周期**。
- */
-const fakeMiddlewareContext = {
-    app: {},
-    log: { debug: () => { }, info: () => { }, warn: () => { }, error: () => { } },
-    services: {},
-    config: {},
-};
-describe('ctx 可见性（N1 §2）', () => {
-    it('MiddlewareContext 有 app / log / services / config；没有 resources / env / disposer', () => {
-        expectTypeOf().toHaveProperty('app');
-        expectTypeOf().toHaveProperty('services');
-        expectTypeOf().toHaveProperty('config');
-        // @ts-expect-error 中间件看不到 resources（禁直连数据层）
-        void 0..resources;
-        // @ts-expect-error 中间件看不到 env
-        void 0..env;
-        // @ts-expect-error 中间件看不到 disposer（disposer 只属 services）
-        void 0..disposer;
-    });
-});
-describe('默认预设', () => {
-    it('defaultMiddlewares 为 [cors, context, auth]，且不含 rateLimit', () => {
-        const units = defaultMiddlewares(fakeMiddlewareContext);
-        expect(units.map((unit) => unit.name)).toEqual(['cors', 'context', 'auth']);
-        expect(units.map((unit) => unit.name)).not.toContain('rateLimit');
-    });
-});
-describe('数组序即注册序', () => {
-    it('严格按数组序执行每一项注册的钩子', async () => {
-        const calls = [];
-        const makeUnit = (name) => ({
-            name,
-            register: (app) => {
-                app.addHook('preValidation', (_request, _reply, done) => {
-                    calls.push(name);
-                    done();
-                });
-            },
-        });
-        const server = defineServer({
-            app: { service: 'middleware-order', title: 'Middleware Order', version: '1.0.0' },
-            resources: () => ({}),
-            config: () => ({}),
-            services: () => ({}),
-            middlewares: () => [makeUnit('third'), makeUnit('first'), makeUnit('second')],
-            routers: (ctx) => {
-                ctx.app.get('/ping', () => ({ pong: true }));
-            },
-        });
-        const app = await startServer(server, { listen: false });
-        const response = await app.inject({ method: 'GET', url: '/ping' });
-        expect(response.statusCode).toBe(200);
-        expect(calls).toEqual(['third', 'first', 'second']);
-        await app.close();
-    });
-    it('ctx.services 与 services 槽位产物是同一个实例（M5 强类型）', async () => {
-        const servicesValue = { user: { find: (id) => `user:${id}` } };
-        let seen;
-        let seenFind;
-        const server = defineServer({
-            app: { service: 'middleware-services', title: 'Middleware Services', version: '1.0.0' },
-            resources: () => ({}),
-            config: () => ({}),
-            services: () => servicesValue,
-            middlewares: (ctx) => {
-                seen = ctx.services;
-                seenFind = ctx.services.user.find;
-                return [];
-            },
-            routers: (ctx) => {
-                ctx.app.get('/ping', () => ({ pong: true }));
-            },
-        });
-        const app = await startServer(server, { listen: false });
-        expect(seen).toBe(servicesValue);
-        expect(seenFind).toBe(servicesValue.user.find);
-        await app.close();
-    });
-    it('注册的钩子返回 reply → 终止链（后续单元不执行）', async () => {
-        const calls = [];
-        const server = defineServer({
-            app: { service: 'middleware-terminate', title: 'Middleware Terminate', version: '1.0.0' },
-            resources: () => ({}),
-            config: () => ({}),
-            services: () => ({}),
-            middlewares: () => [
-                {
-                    name: 'short',
-                    register: (app) => {
-                        app.addHook('preValidation', (_request, reply, done) => {
-                            calls.push('short');
-                            void reply.status(418).send({ stopped: true });
-                            done();
-                        });
-                    },
-                },
-                {
-                    name: 'after',
-                    register: (app) => {
-                        app.addHook('preValidation', (_request, _reply, done) => {
-                            calls.push('after');
-                            done();
-                        });
-                    },
-                },
-            ],
-            routers: (ctx) => {
-                ctx.app.get('/ping', () => ({ pong: true }));
-            },
-        });
-        const app = await startServer(server, { listen: false });
-        const response = await app.inject({ method: 'GET', url: '/ping' });
-        expect(response.statusCode).toBe(418);
-        expect(calls).toEqual(['short']);
-        await app.close();
-    });
-    it('出 spec 路径也注册中间件（保证 schema 一致）', async () => {
-        const { generateOpenApi } = await import('./entries.js');
-        const calls = [];
-        const server = defineServer({
-            app: { service: 'middleware-openapi', title: 'Middleware OpenApi', version: '1.0.0' },
-            resources: () => ({}),
-            config: () => ({}),
-            services: () => ({}),
-            middlewares: () => [
-                {
-                    name: 'probe',
-                    register: () => {
-                        calls.push('register:probe');
-                    },
-                },
-            ],
-            routers: (ctx) => {
-                ctx.app.get('/ping', () => ({ pong: true }));
-            },
-        });
-        await generateOpenApi(server);
-        expect(calls).toEqual(['register:probe']);
-    });
-});

package/output/app/permission-operations.d.ts

@@ -1,48 +0,0 @@
-import type { FastifyInstance } from 'fastify';
-/**
- * 权限操作提取（设计 §5.2）——**框架内置**。
- *
- * 两条来源：
- *
- * 1. **路由注册表**（`installRegisteredOperations` / `readRegisteredOperations`）：core 装配期
- *    在 root 挂 `onRoute` 钩子，采集每条路由的 `{ method, url, operationId, summary, description, tags }`。
- *    `auth` 的权限自注册只读这张表，**不依赖 `app.swagger()`**（swagger 只负责出文档）。
- * 2. **OpenAPI 文档提取**（`extractPermissionOperations`）：从 `paths` 提取。
- *    各仓的 `onReady` 自注册（如 account 作为签发方走进程内调用）用它与 `app.swagger()` 配合，
- *    **替代各仓自写实现**（已从公共面导出）。
- *
- * 目录元素形状（`{ operation, summary?, description?, tags? }`）与各仓原自写实现一致：
- *
- * - 缺 `operationId` 的条目（如 `parameters` / vendor 扩展 / 文档路由）**跳过**；
- * - 缺 `paths` / 空文档 → 返回 `[]`；
- * - `summary` / `description` / `tags` 缺省分别归一为 `''` / `''` / `[]`。
- */
-/** 单条权限操作（对齐 account `POST /permission/operation/register` 的 `operations` 元素） */
-export interface PermissionOperation {
-    operation: string;
-    summary: string;
-    description: string;
-    tags: string[];
-}
-/** 单条已注册路由的采集项（`onRoute` 期收集；`operationId` 缺省表示该路由未声明） */
-export interface RegisteredOperation {
-    method: string;
-    url: string;
-    operationId?: string;
-    summary?: string;
-    description?: string;
-    tags?: string[];
-}
-/**
- * 在 root 挂 `onRoute` 钩子，收集框架自身可见的**路由注册表**（设计 §5.2）。
- *
- * 必须在**路由注册之前**（core 装配期）调用：钩子挂在 root，随后 `routers` 阶段注册的路由逐条被采集。
- * 该表与 swagger 解耦：swagger 只负责出文档，`auth` 的权限自注册只读这张表。
- */
-export declare function installRegisteredOperations(app: FastifyInstance): void;
-/** 读取 root `onRoute` 采集的路由注册表；未安装（未走框架装配）时返回空数组。 */
-export declare function readRegisteredOperations(app: FastifyInstance): RegisteredOperation[];
-/** 从路由注册表筛出声明了 `operationId` 的项，归一为权限操作目录元素 */
-export declare function toPermissionOperations(operations: readonly RegisteredOperation[]): PermissionOperation[];
-export declare function extractPermissionOperations(openApiSpec: unknown): PermissionOperation[];
-//# sourceMappingURL=permission-operations.d.ts.map

package/output/app/permission-operations.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permission-operations.d.ts","sourceRoot":"","sources":["../../source/app/permission-operations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAe,MAAM,SAAS,CAAA;AAE3D;;;;;;;;;;;;;;;;;GAiBG;AAEH,iFAAiF;AACjF,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,EAAE,CAAA;CACf;AAeD,0DAA0D;AAC1D,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAChB;AAaD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CA+BtE;AAED,oDAAoD;AACpD,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,eAAe,GAAG,mBAAmB,EAAE,CAIpF;AAED,+CAA+C;AAC/C,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE,GAAG,mBAAmB,EAAE,CAcxG;AAED,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,OAAO,GAAG,mBAAmB,EAAE,CAoBvF"}

package/output/app/permission-operations.js

@@ -1,77 +0,0 @@
-/** 路由注册表在 `app` 上的存放键（Symbol，不进公共契约） */
-const REGISTERED_OPERATIONS = Symbol.for('@taicode/common-server/registered-operations');
-/**
- * 在 root 挂 `onRoute` 钩子，收集框架自身可见的**路由注册表**（设计 §5.2）。
- *
- * 必须在**路由注册之前**（core 装配期）调用：钩子挂在 root，随后 `routers` 阶段注册的路由逐条被采集。
- * 该表与 swagger 解耦：swagger 只负责出文档，`auth` 的权限自注册只读这张表。
- */
-export function installRegisteredOperations(app) {
-    const collected = [];
-    Object.defineProperty(app, REGISTERED_OPERATIONS, {
-        value: collected,
-        enumerable: false,
-        configurable: true,
-    });
-    app.addHook('onRoute', (routeOptions) => {
-        const routeConfig = (routeOptions.config ?? {});
-        // 与 `@fastify/swagger` 同口径：Fastify 默认为 GET 自动生成 HEAD 路由；未显式
-        // `config.swagger.exposeHeadRoute = true` 时跳过，避免与 GET 重复（权限目录保持同源）。
-        if (routeOptions.method === 'HEAD' && routeConfig.swagger?.exposeHeadRoute !== true) {
-            return;
-        }
-        const schema = (routeOptions.schema ?? {});
-        const methods = Array.isArray(routeOptions.method)
-            ? routeOptions.method
-            : [routeOptions.method];
-        for (const method of methods) {
-            collected.push({
-                method,
-                url: routeOptions.url,
-                operationId: schema.operationId,
-                summary: schema.summary,
-                description: schema.description,
-                tags: schema.tags,
-            });
-        }
-    });
-}
-/** 读取 root `onRoute` 采集的路由注册表；未安装（未走框架装配）时返回空数组。 */
-export function readRegisteredOperations(app) {
-    return (app[REGISTERED_OPERATIONS] ?? []);
-}
-/** 从路由注册表筛出声明了 `operationId` 的项，归一为权限操作目录元素 */
-export function toPermissionOperations(operations) {
-    const result = [];
-    for (const entry of operations) {
-        if (!entry.operationId) {
-            continue;
-        }
-        result.push({
-            operation: entry.operationId,
-            summary: entry.summary ?? '',
-            description: entry.description ?? '',
-            tags: entry.tags ?? [],
-        });
-    }
-    return result;
-}
-export function extractPermissionOperations(openApiSpec) {
-    // 出 spec 路径拿到的文档是未知形态；只按结构取字段，缺什么就跳过什么
-    const spec = (openApiSpec ?? {});
-    const operations = [];
-    for (const pathItem of Object.values(spec.paths ?? {})) {
-        for (const operation of Object.values(pathItem ?? {})) {
-            if (!operation?.operationId) {
-                continue;
-            }
-            operations.push({
-                operation: operation.operationId,
-                summary: operation.summary ?? '',
-                description: operation.description ?? '',
-                tags: operation.tags ?? [],
-            });
-        }
-    }
-    return operations;
-}

package/output/app/permission-operations.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=permission-operations.test.d.ts.map

package/output/app/permission-operations.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permission-operations.test.d.ts","sourceRoot":"","sources":["../../source/app/permission-operations.test.ts"],"names":[],"mappings":""}

package/output/app/permission-operations.test.js

@@ -1,72 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { extractPermissionOperations } from './permission-operations.js';
-/**
- * `extractPermissionOperations`（设计 §5.2，框架内置）契约。
- *
- * 口径与各仓原自写实现一致：逐 path → 逐 method，缺 `operationId` 跳过；缺 `paths` / 空文档 → `[]`；
- * `summary` / `description` / `tags` 缺省归一为 `''` / `''` / `[]`。
- */
-describe('extractPermissionOperations（设计 §5.2）', () => {
-    it('提取 operationId 与可选元信息（summary / description / tags）', () => {
-        expect(extractPermissionOperations({
-            paths: {
-                '/release/list': {
-                    post: {
-                        operationId: 'listRelease',
-                        summary: 'List releases',
-                        description: 'Returns available releases.',
-                        tags: ['Release'],
-                    },
-                },
-            },
-        })).toEqual([
-            {
-                operation: 'listRelease',
-                summary: 'List releases',
-                description: 'Returns available releases.',
-                tags: ['Release'],
-            },
-        ]);
-    });
-    it('可选元信息缺省归一，且跳过无 operationId 的条目', () => {
-        expect(extractPermissionOperations({
-            paths: {
-                '/release/create': {
-                    post: { operationId: 'createRelease' },
-                    parameters: { description: 'Shared parameters' },
-                },
-            },
-        })).toEqual([
-            {
-                operation: 'createRelease',
-                summary: '',
-                description: '',
-                tags: [],
-            },
-        ]);
-    });
-    it('缺 paths 时返回空数组', () => {
-        expect(extractPermissionOperations({})).toEqual([]);
-    });
-    it('空文档 / 非对象入参返回空数组', () => {
-        expect(extractPermissionOperations({ paths: {} })).toEqual([]);
-        expect(extractPermissionOperations(undefined)).toEqual([]);
-    });
-    it('多路径 + 多方法：按 paths → methods 的遍历序全量提取', () => {
-        expect(extractPermissionOperations({
-            paths: {
-                '/widget/list': {
-                    get: { operationId: 'listWidget', tags: ['Widget'] },
-                    post: { operationId: 'queryWidget' },
-                },
-                '/widget/create': {
-                    post: { operationId: 'createWidget', summary: 'Create widget' },
-                },
-            },
-        })).toEqual([
-            { operation: 'listWidget', summary: '', description: '', tags: ['Widget'] },
-            { operation: 'queryWidget', summary: '', description: '', tags: [] },
-            { operation: 'createWidget', summary: 'Create widget', description: '', tags: [] },
-        ]);
-    });
-});

package/output/app/permission-registration.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=permission-registration.test.d.ts.map

package/output/app/permission-registration.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permission-registration.test.d.ts","sourceRoot":"","sources":["../../source/app/permission-registration.test.ts"],"names":[],"mappings":""}