@yss123/cage-admin 0.1.0 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (53) hide show
  1. package/README.md +62 -3
  2. package/dist/bootstrap.d.ts +27 -1
  3. package/dist/bootstrap.js +52 -16
  4. package/dist/bootstrap.js.map +1 -1
  5. package/dist/catalog.d.ts +48 -0
  6. package/dist/catalog.js +96 -0
  7. package/dist/catalog.js.map +1 -0
  8. package/dist/diagnostics.d.ts +14 -0
  9. package/dist/diagnostics.js +163 -0
  10. package/dist/diagnostics.js.map +1 -0
  11. package/dist/domain/constraints.d.ts +23 -0
  12. package/dist/domain/constraints.js +27 -0
  13. package/dist/domain/constraints.js.map +1 -1
  14. package/dist/domain/index.d.ts +5 -0
  15. package/dist/domain/index.js +5 -0
  16. package/dist/domain/index.js.map +1 -1
  17. package/dist/domain/org.d.ts +230 -149
  18. package/dist/domain/org.js +98 -4
  19. package/dist/domain/org.js.map +1 -1
  20. package/dist/http.d.ts +13 -1
  21. package/dist/http.js +28 -13
  22. package/dist/http.js.map +1 -1
  23. package/dist/index.d.ts +6 -0
  24. package/dist/index.js +6 -0
  25. package/dist/index.js.map +1 -1
  26. package/package.json +9 -5
  27. package/ui/dist/app/shell.js +135 -0
  28. package/ui/dist/app.js +34 -0
  29. package/ui/dist/modules/audit/audit-page.js +107 -0
  30. package/ui/dist/modules/audit/index.js +5 -0
  31. package/ui/dist/modules/auth/index.js +5 -0
  32. package/ui/dist/modules/auth/login-page.js +38 -0
  33. package/ui/dist/modules/models/index.js +5 -0
  34. package/ui/dist/modules/models/models-page.js +60 -0
  35. package/ui/dist/modules/operations/index.js +6 -0
  36. package/ui/dist/modules/operations/operations-page.js +110 -0
  37. package/ui/dist/modules/operations/sync-page.js +60 -0
  38. package/ui/dist/modules/org/index.js +5 -0
  39. package/ui/dist/modules/org/org-page.js +243 -0
  40. package/ui/dist/modules/personalities/index.js +5 -0
  41. package/ui/dist/modules/personalities/personalities-page.js +161 -0
  42. package/ui/dist/modules/roles/index.js +5 -0
  43. package/ui/dist/modules/roles/roles-page.js +348 -0
  44. package/ui/dist/modules/tasks/index.js +5 -0
  45. package/ui/dist/modules/tasks/tasks-page.js +68 -0
  46. package/ui/dist/shared/api.js +166 -0
  47. package/ui/dist/shared/dom.js +139 -0
  48. package/ui/dist/shared/labels.js +84 -0
  49. package/ui/dist/shared/navigation.js +14 -0
  50. package/ui/dist/shared/types.js +1 -0
  51. package/ui/index.html +12 -10
  52. package/ui/style.css +1657 -41
  53. package/ui/app.js +0 -339
package/dist/domain/org.d.ts CHANGED
@@ -1,28 +1,43 @@
1
1
  import { z } from 'zod';
2
+ /**
3
+ * 部门组织单元，active 可维护，archived 为终态。
4
+ * 范围字段使用本记录 id，祖先路径供 deptSubtree 判断；leaderId 用于部门负责人审批选人。
5
+ * 当前命令支持创建、资料更新和停用，没有移动部门或重建整棵祖先路径的命令。
6
+ */
2
7
  export declare const Dept: import("@yss123/cage-kernel").Aggregate<"Dept", {
3
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
4
- code: import("@yss123/cage-kernel").Field<z.ZodString, true>;
5
- parentId: import("@yss123/cage-kernel").Field<z.ZodString, true>;
6
- ancestors: import("@yss123/cage-kernel").Field<z.ZodString, false>;
7
- leaderId: import("@yss123/cage-kernel").Field<z.ZodString, true>;
8
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
9
+ code: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
10
+ parentId: import("@yss123/cage-kernel").Field<z.ZodString, true, "ref">;
11
+ ancestors: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
12
+ leaderId: import("@yss123/cage-kernel").Field<z.ZodString, true, "id">;
8
13
  }, string>;
14
+ /**
15
+ * 登录与组织身份聚合，用户名唯一，部门决定基于部门的范围。
16
+ * 角色 ID 列表由 assignRoles 维护；姓名、电话和邮箱按敏感类别掩码。
17
+ * active/disabled 可相互切换，passwordHash 隐藏且可为空：创建用户不等于已经设置本地登录密码。
18
+ */
9
19
  export declare const User: import("@yss123/cage-kernel").Aggregate<"User", {
10
- username: import("@yss123/cage-kernel").Field<z.ZodString, false>;
11
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
12
- deptId: import("@yss123/cage-kernel").Field<z.ZodString, false>;
13
- roleIds: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodString>, false>;
14
- phone: import("@yss123/cage-kernel").Field<z.ZodString, true>;
15
- email: import("@yss123/cage-kernel").Field<z.ZodString, true>;
16
- ssoSubject: import("@yss123/cage-kernel").Field<z.ZodString, true>;
17
- passwordHash: import("@yss123/cage-kernel").Field<z.ZodString, true>;
20
+ username: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
21
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
22
+ deptId: import("@yss123/cage-kernel").Field<z.ZodString, false, "ref">;
23
+ roleIds: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodString>, false, import("@yss123/cage-kernel").FieldKind>;
24
+ phone: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
25
+ email: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
26
+ ssoSubject: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
27
+ passwordHash: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
18
28
  }, string>;
29
+ /**
30
+ * 能力点及范围授权的组合，角色 code 唯一，名称只用于展示。
31
+ * capabilities 保存能力标识及可选参数，scopes 保存聚合范围，星号代表通配聚合。
32
+ * scope.none 只表示没有对象范围字段，不表示匿名可读或无需命令授权；archived 为终态。
33
+ */
19
34
  export declare const Role: import("@yss123/cage-kernel").Aggregate<"Role", {
20
- code: import("@yss123/cage-kernel").Field<z.ZodString, false>;
21
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
35
+ code: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
36
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
22
37
  capabilities: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodObject<{
23
38
  capability: z.ZodString;
24
39
  params: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
25
- }, z.core.$strip>>, false>;
40
+ }, z.core.$strip>>, false, import("@yss123/cage-kernel").FieldKind>;
26
41
  scopes: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodObject<{
27
42
  aggregate: z.ZodString;
28
43
  combinator: z.ZodEnum<{
@@ -33,21 +48,26 @@ export declare const Role: import("@yss123/cage-kernel").Aggregate<"Role", {
33
48
  deptSet: "deptSet";
34
49
  }>;
35
50
  deptIds: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
36
- }, z.core.$strip>>, false>;
51
+ }, z.core.$strip>>, false, import("@yss123/cage-kernel").FieldKind>;
37
52
  }, string>;
53
+ /**
54
+ * 创建 active 部门，使用 reads.depts 查找可访问的父部门并构造含自身的祖先路径。
55
+ * 未指定父部门时从根路径开始；指定但查不到时返回 PARENT_NOT_FOUND。
56
+ * 返回值只补计算字段 ancestors，其余合法输入由命令草稿承接。
57
+ */
38
58
  export declare const createDept: import("@yss123/cage-kernel").Command<import("@yss123/cage-kernel").Aggregate<"Dept", {
39
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
40
- code: import("@yss123/cage-kernel").Field<z.ZodString, true>;
41
- parentId: import("@yss123/cage-kernel").Field<z.ZodString, true>;
42
- ancestors: import("@yss123/cage-kernel").Field<z.ZodString, false>;
43
- leaderId: import("@yss123/cage-kernel").Field<z.ZodString, true>;
59
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
60
+ code: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
61
+ parentId: import("@yss123/cage-kernel").Field<z.ZodString, true, "ref">;
62
+ ancestors: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
63
+ leaderId: import("@yss123/cage-kernel").Field<z.ZodString, true, "id">;
44
64
  }, string>, {
45
65
  depts: import("@yss123/cage-kernel").Aggregate<"Dept", {
46
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
47
- code: import("@yss123/cage-kernel").Field<z.ZodString, true>;
48
- parentId: import("@yss123/cage-kernel").Field<z.ZodString, true>;
49
- ancestors: import("@yss123/cage-kernel").Field<z.ZodString, false>;
50
- leaderId: import("@yss123/cage-kernel").Field<z.ZodString, true>;
66
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
67
+ code: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
68
+ parentId: import("@yss123/cage-kernel").Field<z.ZodString, true, "ref">;
69
+ ancestors: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
70
+ leaderId: import("@yss123/cage-kernel").Field<z.ZodString, true, "id">;
51
71
  }, string>;
52
72
  }, z.ZodObject<{
53
73
  name: z.ZodString;
@@ -55,71 +75,84 @@ export declare const createDept: import("@yss123/cage-kernel").Command<import("@
55
75
  parentId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
56
76
  leaderId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
57
77
  }, z.core.$strip>>;
78
+ /**
79
+ * 更新 active 部门的名称、编码和负责人，保持状态与原有父子关系。
80
+ * 省略字段保留旧值；code/leaderId 显式 null 表示清空。输入没有 parentId，不能借此移动部门。
81
+ */
58
82
  export declare const updateDept: import("@yss123/cage-kernel").Command<import("@yss123/cage-kernel").Aggregate<"Dept", {
59
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
60
- code: import("@yss123/cage-kernel").Field<z.ZodString, true>;
61
- parentId: import("@yss123/cage-kernel").Field<z.ZodString, true>;
62
- ancestors: import("@yss123/cage-kernel").Field<z.ZodString, false>;
63
- leaderId: import("@yss123/cage-kernel").Field<z.ZodString, true>;
83
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
84
+ code: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
85
+ parentId: import("@yss123/cage-kernel").Field<z.ZodString, true, "ref">;
86
+ ancestors: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
87
+ leaderId: import("@yss123/cage-kernel").Field<z.ZodString, true, "id">;
64
88
  }, string>, {}, z.ZodObject<{
65
89
  id: z.ZodString;
66
90
  name: z.ZodOptional<z.ZodString>;
67
91
  code: z.ZodOptional<z.ZodNullable<z.ZodString>>;
68
92
  leaderId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
69
93
  }, z.core.$strip>>;
94
+ /**
95
+ * 停用 active 部门前，通过声明读依赖检查在职用户和活动下级部门。
96
+ * 存在下级返回 HAS_CHILDREN，存在在职用户返回 HAS_USERS；成功后由内核迁入 archived。
97
+ * 不会自动迁移用户、级联停用下级部门或删除历史记录。
98
+ */
70
99
  export declare const archiveDept: import("@yss123/cage-kernel").Command<import("@yss123/cage-kernel").Aggregate<"Dept", {
71
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
72
- code: import("@yss123/cage-kernel").Field<z.ZodString, true>;
73
- parentId: import("@yss123/cage-kernel").Field<z.ZodString, true>;
74
- ancestors: import("@yss123/cage-kernel").Field<z.ZodString, false>;
75
- leaderId: import("@yss123/cage-kernel").Field<z.ZodString, true>;
100
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
101
+ code: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
102
+ parentId: import("@yss123/cage-kernel").Field<z.ZodString, true, "ref">;
103
+ ancestors: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
104
+ leaderId: import("@yss123/cage-kernel").Field<z.ZodString, true, "id">;
76
105
  }, string>, {
77
106
  users: import("@yss123/cage-kernel").Aggregate<"User", {
78
- username: import("@yss123/cage-kernel").Field<z.ZodString, false>;
79
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
80
- deptId: import("@yss123/cage-kernel").Field<z.ZodString, false>;
81
- roleIds: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodString>, false>;
82
- phone: import("@yss123/cage-kernel").Field<z.ZodString, true>;
83
- email: import("@yss123/cage-kernel").Field<z.ZodString, true>;
84
- ssoSubject: import("@yss123/cage-kernel").Field<z.ZodString, true>;
85
- passwordHash: import("@yss123/cage-kernel").Field<z.ZodString, true>;
107
+ username: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
108
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
109
+ deptId: import("@yss123/cage-kernel").Field<z.ZodString, false, "ref">;
110
+ roleIds: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodString>, false, import("@yss123/cage-kernel").FieldKind>;
111
+ phone: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
112
+ email: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
113
+ ssoSubject: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
114
+ passwordHash: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
86
115
  }, string>;
87
116
  depts: import("@yss123/cage-kernel").Aggregate<"Dept", {
88
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
89
- code: import("@yss123/cage-kernel").Field<z.ZodString, true>;
90
- parentId: import("@yss123/cage-kernel").Field<z.ZodString, true>;
91
- ancestors: import("@yss123/cage-kernel").Field<z.ZodString, false>;
92
- leaderId: import("@yss123/cage-kernel").Field<z.ZodString, true>;
117
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
118
+ code: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
119
+ parentId: import("@yss123/cage-kernel").Field<z.ZodString, true, "ref">;
120
+ ancestors: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
121
+ leaderId: import("@yss123/cage-kernel").Field<z.ZodString, true, "id">;
93
122
  }, string>;
94
123
  }, z.ZodObject<{
95
124
  id: z.ZodString;
96
125
  }, z.core.$strip>>;
126
+ /**
127
+ * 创建 active 用户，先检查用户名占用和目标部门是否可读存在。
128
+ * 失败分别返回 USERNAME_TAKEN / DEPT_NOT_FOUND；初始 roleIds 为空，不隐式授权或设置密码。
129
+ */
97
130
  export declare const createUser: import("@yss123/cage-kernel").Command<import("@yss123/cage-kernel").Aggregate<"User", {
98
- username: import("@yss123/cage-kernel").Field<z.ZodString, false>;
99
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
100
- deptId: import("@yss123/cage-kernel").Field<z.ZodString, false>;
101
- roleIds: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodString>, false>;
102
- phone: import("@yss123/cage-kernel").Field<z.ZodString, true>;
103
- email: import("@yss123/cage-kernel").Field<z.ZodString, true>;
104
- ssoSubject: import("@yss123/cage-kernel").Field<z.ZodString, true>;
105
- passwordHash: import("@yss123/cage-kernel").Field<z.ZodString, true>;
131
+ username: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
132
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
133
+ deptId: import("@yss123/cage-kernel").Field<z.ZodString, false, "ref">;
134
+ roleIds: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodString>, false, import("@yss123/cage-kernel").FieldKind>;
135
+ phone: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
136
+ email: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
137
+ ssoSubject: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
138
+ passwordHash: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
106
139
  }, string>, {
107
140
  users: import("@yss123/cage-kernel").Aggregate<"User", {
108
- username: import("@yss123/cage-kernel").Field<z.ZodString, false>;
109
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
110
- deptId: import("@yss123/cage-kernel").Field<z.ZodString, false>;
111
- roleIds: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodString>, false>;
112
- phone: import("@yss123/cage-kernel").Field<z.ZodString, true>;
113
- email: import("@yss123/cage-kernel").Field<z.ZodString, true>;
114
- ssoSubject: import("@yss123/cage-kernel").Field<z.ZodString, true>;
115
- passwordHash: import("@yss123/cage-kernel").Field<z.ZodString, true>;
141
+ username: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
142
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
143
+ deptId: import("@yss123/cage-kernel").Field<z.ZodString, false, "ref">;
144
+ roleIds: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodString>, false, import("@yss123/cage-kernel").FieldKind>;
145
+ phone: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
146
+ email: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
147
+ ssoSubject: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
148
+ passwordHash: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
116
149
  }, string>;
117
150
  depts: import("@yss123/cage-kernel").Aggregate<"Dept", {
118
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
119
- code: import("@yss123/cage-kernel").Field<z.ZodString, true>;
120
- parentId: import("@yss123/cage-kernel").Field<z.ZodString, true>;
121
- ancestors: import("@yss123/cage-kernel").Field<z.ZodString, false>;
122
- leaderId: import("@yss123/cage-kernel").Field<z.ZodString, true>;
151
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
152
+ code: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
153
+ parentId: import("@yss123/cage-kernel").Field<z.ZodString, true, "ref">;
154
+ ancestors: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
155
+ leaderId: import("@yss123/cage-kernel").Field<z.ZodString, true, "id">;
123
156
  }, string>;
124
157
  }, z.ZodObject<{
125
158
  ssoSubject: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -129,22 +162,26 @@ export declare const createUser: import("@yss123/cage-kernel").Command<import("@
129
162
  email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
130
163
  username: z.ZodString;
131
164
  }, z.core.$strip>>;
165
+ /**
166
+ * 更新 active 用户的资料；更换部门前通过 depts 读依赖验证目标。
167
+ * 姓名与部门省略时保留原值，电话/邮箱区分省略与显式清空，角色及密码不在此命令中修改。
168
+ */
132
169
  export declare const updateUser: import("@yss123/cage-kernel").Command<import("@yss123/cage-kernel").Aggregate<"User", {
133
- username: import("@yss123/cage-kernel").Field<z.ZodString, false>;
134
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
135
- deptId: import("@yss123/cage-kernel").Field<z.ZodString, false>;
136
- roleIds: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodString>, false>;
137
- phone: import("@yss123/cage-kernel").Field<z.ZodString, true>;
138
- email: import("@yss123/cage-kernel").Field<z.ZodString, true>;
139
- ssoSubject: import("@yss123/cage-kernel").Field<z.ZodString, true>;
140
- passwordHash: import("@yss123/cage-kernel").Field<z.ZodString, true>;
170
+ username: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
171
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
172
+ deptId: import("@yss123/cage-kernel").Field<z.ZodString, false, "ref">;
173
+ roleIds: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodString>, false, import("@yss123/cage-kernel").FieldKind>;
174
+ phone: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
175
+ email: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
176
+ ssoSubject: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
177
+ passwordHash: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
141
178
  }, string>, {
142
179
  depts: import("@yss123/cage-kernel").Aggregate<"Dept", {
143
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
144
- code: import("@yss123/cage-kernel").Field<z.ZodString, true>;
145
- parentId: import("@yss123/cage-kernel").Field<z.ZodString, true>;
146
- ancestors: import("@yss123/cage-kernel").Field<z.ZodString, false>;
147
- leaderId: import("@yss123/cage-kernel").Field<z.ZodString, true>;
180
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
181
+ code: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
182
+ parentId: import("@yss123/cage-kernel").Field<z.ZodString, true, "ref">;
183
+ ancestors: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
184
+ leaderId: import("@yss123/cage-kernel").Field<z.ZodString, true, "id">;
148
185
  }, string>;
149
186
  }, z.ZodObject<{
150
187
  id: z.ZodString;
@@ -153,23 +190,28 @@ export declare const updateUser: import("@yss123/cage-kernel").Command<import("@
153
190
  phone: z.ZodOptional<z.ZodNullable<z.ZodString>>;
154
191
  email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
155
192
  }, z.core.$strip>>;
193
+ /**
194
+ * 替换 active 用户的完整角色列表，输入最多 50 个 ID，保存前去重。
195
+ * 硬约束先检查新增角色不能使操作者越权，handler 再核对所有角色存在且 active。
196
+ * 任何无效角色使整个命令失败；不会部分分配，也不自动创建缺失角色。
197
+ */
156
198
  export declare const assignRoles: import("@yss123/cage-kernel").Command<import("@yss123/cage-kernel").Aggregate<"User", {
157
- username: import("@yss123/cage-kernel").Field<z.ZodString, false>;
158
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
159
- deptId: import("@yss123/cage-kernel").Field<z.ZodString, false>;
160
- roleIds: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodString>, false>;
161
- phone: import("@yss123/cage-kernel").Field<z.ZodString, true>;
162
- email: import("@yss123/cage-kernel").Field<z.ZodString, true>;
163
- ssoSubject: import("@yss123/cage-kernel").Field<z.ZodString, true>;
164
- passwordHash: import("@yss123/cage-kernel").Field<z.ZodString, true>;
199
+ username: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
200
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
201
+ deptId: import("@yss123/cage-kernel").Field<z.ZodString, false, "ref">;
202
+ roleIds: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodString>, false, import("@yss123/cage-kernel").FieldKind>;
203
+ phone: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
204
+ email: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
205
+ ssoSubject: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
206
+ passwordHash: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
165
207
  }, string>, {
166
208
  roles: import("@yss123/cage-kernel").Aggregate<"Role", {
167
- code: import("@yss123/cage-kernel").Field<z.ZodString, false>;
168
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
209
+ code: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
210
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
169
211
  capabilities: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodObject<{
170
212
  capability: z.ZodString;
171
213
  params: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
172
- }, z.core.$strip>>, false>;
214
+ }, z.core.$strip>>, false, import("@yss123/cage-kernel").FieldKind>;
173
215
  scopes: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodObject<{
174
216
  aggregate: z.ZodString;
175
217
  combinator: z.ZodEnum<{
@@ -180,58 +222,77 @@ export declare const assignRoles: import("@yss123/cage-kernel").Command<import("
180
222
  deptSet: "deptSet";
181
223
  }>;
182
224
  deptIds: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
183
- }, z.core.$strip>>, false>;
225
+ }, z.core.$strip>>, false, import("@yss123/cage-kernel").FieldKind>;
184
226
  }, string>;
185
227
  }, z.ZodObject<{
186
228
  id: z.ZodString;
187
229
  roleIds: z.ZodArray<z.ZodString>;
188
230
  }, z.core.$strip>>;
231
+ /**
232
+ * 将 active 用户转为 disabled，仅声明状态变化；认证和上下文刷新据状态拒绝后续使用。
233
+ */
189
234
  export declare const disableUser: import("@yss123/cage-kernel").Command<import("@yss123/cage-kernel").Aggregate<"User", {
190
- username: import("@yss123/cage-kernel").Field<z.ZodString, false>;
191
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
192
- deptId: import("@yss123/cage-kernel").Field<z.ZodString, false>;
193
- roleIds: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodString>, false>;
194
- phone: import("@yss123/cage-kernel").Field<z.ZodString, true>;
195
- email: import("@yss123/cage-kernel").Field<z.ZodString, true>;
196
- ssoSubject: import("@yss123/cage-kernel").Field<z.ZodString, true>;
197
- passwordHash: import("@yss123/cage-kernel").Field<z.ZodString, true>;
235
+ username: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
236
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
237
+ deptId: import("@yss123/cage-kernel").Field<z.ZodString, false, "ref">;
238
+ roleIds: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodString>, false, import("@yss123/cage-kernel").FieldKind>;
239
+ phone: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
240
+ email: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
241
+ ssoSubject: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
242
+ passwordHash: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
198
243
  }, string>, {}, z.ZodObject<{
199
244
  id: z.ZodString;
200
245
  }, z.core.$strip>>;
246
+ /**
247
+ * 将 disabled 用户恢复为 active，不重置原有角色、资料或密码。
248
+ */
201
249
  export declare const enableUser: import("@yss123/cage-kernel").Command<import("@yss123/cage-kernel").Aggregate<"User", {
202
- username: import("@yss123/cage-kernel").Field<z.ZodString, false>;
203
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
204
- deptId: import("@yss123/cage-kernel").Field<z.ZodString, false>;
205
- roleIds: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodString>, false>;
206
- phone: import("@yss123/cage-kernel").Field<z.ZodString, true>;
207
- email: import("@yss123/cage-kernel").Field<z.ZodString, true>;
208
- ssoSubject: import("@yss123/cage-kernel").Field<z.ZodString, true>;
209
- passwordHash: import("@yss123/cage-kernel").Field<z.ZodString, true>;
250
+ username: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
251
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
252
+ deptId: import("@yss123/cage-kernel").Field<z.ZodString, false, "ref">;
253
+ roleIds: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodString>, false, import("@yss123/cage-kernel").FieldKind>;
254
+ phone: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
255
+ email: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
256
+ ssoSubject: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
257
+ passwordHash: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
210
258
  }, string>, {}, z.ZodObject<{
211
259
  id: z.ZodString;
212
260
  }, z.core.$strip>>;
213
261
  /** 密码哈希：scrypt$盐$哈希（纯计算，不做 IO） */
214
- export declare function hashPassword(pw: string): string;
262
+ /**
263
+ * 以随机 16 字节盐调用异步 scrypt，派生 32 字节结果并编码为认证使用的三段字符串。
264
+ * 输入为待设置的明文密码；长度约束由调用命令执行，本函数不存储或输出明文。
265
+ * 异步 crypto 错误会拒绝 Promise；使用异步计算避免同步哈希长时间阻塞请求事件循环。
266
+ */
267
+ export declare function hashPassword(pw: string): Promise<string>;
268
+ /**
269
+ * 为 active 用户设置新密码，输入长度 8 至 200，handler 只返回隐藏哈希字段。
270
+ * 密码计算失败则命令失败；不返回明文、不修改用户角色，也不通过此命令恢复停用账号。
271
+ */
215
272
  export declare const setPassword: import("@yss123/cage-kernel").Command<import("@yss123/cage-kernel").Aggregate<"User", {
216
- username: import("@yss123/cage-kernel").Field<z.ZodString, false>;
217
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
218
- deptId: import("@yss123/cage-kernel").Field<z.ZodString, false>;
219
- roleIds: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodString>, false>;
220
- phone: import("@yss123/cage-kernel").Field<z.ZodString, true>;
221
- email: import("@yss123/cage-kernel").Field<z.ZodString, true>;
222
- ssoSubject: import("@yss123/cage-kernel").Field<z.ZodString, true>;
223
- passwordHash: import("@yss123/cage-kernel").Field<z.ZodString, true>;
273
+ username: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
274
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
275
+ deptId: import("@yss123/cage-kernel").Field<z.ZodString, false, "ref">;
276
+ roleIds: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodString>, false, import("@yss123/cage-kernel").FieldKind>;
277
+ phone: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
278
+ email: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
279
+ ssoSubject: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
280
+ passwordHash: import("@yss123/cage-kernel").Field<z.ZodString, true, "text">;
224
281
  }, string>, {}, z.ZodObject<{
225
282
  id: z.ZodString;
226
283
  password: z.ZodString;
227
284
  }, z.core.$strip>>;
285
+ /**
286
+ * 创建 active 角色，读依赖核对 code 未占用，否则返回 CODE_TAKEN。
287
+ * 初始能力和范围均为空，后续必须分别调用授权命令配置，角色名字不会隐式赋权。
288
+ */
228
289
  export declare const createRole: import("@yss123/cage-kernel").Command<import("@yss123/cage-kernel").Aggregate<"Role", {
229
- code: import("@yss123/cage-kernel").Field<z.ZodString, false>;
230
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
290
+ code: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
291
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
231
292
  capabilities: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodObject<{
232
293
  capability: z.ZodString;
233
294
  params: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
234
- }, z.core.$strip>>, false>;
295
+ }, z.core.$strip>>, false, import("@yss123/cage-kernel").FieldKind>;
235
296
  scopes: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodObject<{
236
297
  aggregate: z.ZodString;
237
298
  combinator: z.ZodEnum<{
@@ -242,15 +303,15 @@ export declare const createRole: import("@yss123/cage-kernel").Command<import("@
242
303
  deptSet: "deptSet";
243
304
  }>;
244
305
  deptIds: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
245
- }, z.core.$strip>>, false>;
306
+ }, z.core.$strip>>, false, import("@yss123/cage-kernel").FieldKind>;
246
307
  }, string>, {
247
308
  roles: import("@yss123/cage-kernel").Aggregate<"Role", {
248
- code: import("@yss123/cage-kernel").Field<z.ZodString, false>;
249
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
309
+ code: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
310
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
250
311
  capabilities: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodObject<{
251
312
  capability: z.ZodString;
252
313
  params: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
253
- }, z.core.$strip>>, false>;
314
+ }, z.core.$strip>>, false, import("@yss123/cage-kernel").FieldKind>;
254
315
  scopes: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodObject<{
255
316
  aggregate: z.ZodString;
256
317
  combinator: z.ZodEnum<{
@@ -261,19 +322,22 @@ export declare const createRole: import("@yss123/cage-kernel").Command<import("@
261
322
  deptSet: "deptSet";
262
323
  }>;
263
324
  deptIds: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
264
- }, z.core.$strip>>, false>;
325
+ }, z.core.$strip>>, false, import("@yss123/cage-kernel").FieldKind>;
265
326
  }, string>;
266
327
  }, z.ZodObject<{
267
328
  code: z.ZodString;
268
329
  name: z.ZodString;
269
330
  }, z.core.$strip>>;
331
+ /**
332
+ * 只修改 active 角色的展示名称，保持 code、授权集合和状态不变。
333
+ */
270
334
  export declare const renameRole: import("@yss123/cage-kernel").Command<import("@yss123/cage-kernel").Aggregate<"Role", {
271
- code: import("@yss123/cage-kernel").Field<z.ZodString, false>;
272
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
335
+ code: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
336
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
273
337
  capabilities: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodObject<{
274
338
  capability: z.ZodString;
275
339
  params: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
276
- }, z.core.$strip>>, false>;
340
+ }, z.core.$strip>>, false, import("@yss123/cage-kernel").FieldKind>;
277
341
  scopes: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodObject<{
278
342
  aggregate: z.ZodString;
279
343
  combinator: z.ZodEnum<{
@@ -284,18 +348,23 @@ export declare const renameRole: import("@yss123/cage-kernel").Command<import("@
284
348
  deptSet: "deptSet";
285
349
  }>;
286
350
  deptIds: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
287
- }, z.core.$strip>>, false>;
351
+ }, z.core.$strip>>, false, import("@yss123/cage-kernel").FieldKind>;
288
352
  }, string>, {}, z.ZodObject<{
289
353
  id: z.ZodString;
290
354
  name: z.ZodString;
291
355
  }, z.core.$strip>>;
356
+ /**
357
+ * 为 active 角色新增或替换单个能力及其参数。
358
+ * 目录存在性和直接授权防提权约束先执行；handler 移除同名旧项、加入新项并稳定排序。
359
+ * 省略 params 保存 null，表示该能力没有额外参数，而不是继承旧参数。
360
+ */
292
361
  export declare const grantCapability: import("@yss123/cage-kernel").Command<import("@yss123/cage-kernel").Aggregate<"Role", {
293
- code: import("@yss123/cage-kernel").Field<z.ZodString, false>;
294
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
362
+ code: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
363
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
295
364
  capabilities: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodObject<{
296
365
  capability: z.ZodString;
297
366
  params: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
298
- }, z.core.$strip>>, false>;
367
+ }, z.core.$strip>>, false, import("@yss123/cage-kernel").FieldKind>;
299
368
  scopes: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodObject<{
300
369
  aggregate: z.ZodString;
301
370
  combinator: z.ZodEnum<{
@@ -306,19 +375,23 @@ export declare const grantCapability: import("@yss123/cage-kernel").Command<impo
306
375
  deptSet: "deptSet";
307
376
  }>;
308
377
  deptIds: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
309
- }, z.core.$strip>>, false>;
378
+ }, z.core.$strip>>, false, import("@yss123/cage-kernel").FieldKind>;
310
379
  }, string>, {}, z.ZodObject<{
311
380
  id: z.ZodString;
312
381
  capability: z.ZodString;
313
382
  params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
314
383
  }, z.core.$strip>>;
384
+ /**
385
+ * 从 active 角色移除匹配标识的能力，其他能力保留。
386
+ * 目标能力原本不存在时列表不变；用户实际上下文刷新由框架的授权机制负责。
387
+ */
315
388
  export declare const revokeCapability: import("@yss123/cage-kernel").Command<import("@yss123/cage-kernel").Aggregate<"Role", {
316
- code: import("@yss123/cage-kernel").Field<z.ZodString, false>;
317
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
389
+ code: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
390
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
318
391
  capabilities: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodObject<{
319
392
  capability: z.ZodString;
320
393
  params: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
321
- }, z.core.$strip>>, false>;
394
+ }, z.core.$strip>>, false, import("@yss123/cage-kernel").FieldKind>;
322
395
  scopes: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodObject<{
323
396
  aggregate: z.ZodString;
324
397
  combinator: z.ZodEnum<{
@@ -329,18 +402,23 @@ export declare const revokeCapability: import("@yss123/cage-kernel").Command<imp
329
402
  deptSet: "deptSet";
330
403
  }>;
331
404
  deptIds: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
332
- }, z.core.$strip>>, false>;
405
+ }, z.core.$strip>>, false, import("@yss123/cage-kernel").FieldKind>;
333
406
  }, string>, {}, z.ZodObject<{
334
407
  id: z.ZodString;
335
408
  capability: z.ZodString;
336
409
  }, z.core.$strip>>;
410
+ /**
411
+ * 替换 active 角色在单个聚合上的范围，先经 noWiderScope 核对操作者。
412
+ * combinator=null 删除该聚合条目；deptSet 保存显式部门列表，其他组合子不保存部门 ID。
413
+ * 聚合星号可表达通配范围；删除显式范围后的默认行为由内核范围规则决定，不等同于授予 all。
414
+ */
337
415
  export declare const setScope: import("@yss123/cage-kernel").Command<import("@yss123/cage-kernel").Aggregate<"Role", {
338
- code: import("@yss123/cage-kernel").Field<z.ZodString, false>;
339
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
416
+ code: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
417
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
340
418
  capabilities: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodObject<{
341
419
  capability: z.ZodString;
342
420
  params: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
343
- }, z.core.$strip>>, false>;
421
+ }, z.core.$strip>>, false, import("@yss123/cage-kernel").FieldKind>;
344
422
  scopes: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodObject<{
345
423
  aggregate: z.ZodString;
346
424
  combinator: z.ZodEnum<{
@@ -351,7 +429,7 @@ export declare const setScope: import("@yss123/cage-kernel").Command<import("@ys
351
429
  deptSet: "deptSet";
352
430
  }>;
353
431
  deptIds: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
354
- }, z.core.$strip>>, false>;
432
+ }, z.core.$strip>>, false, import("@yss123/cage-kernel").FieldKind>;
355
433
  }, string>, {}, z.ZodObject<{
356
434
  id: z.ZodString;
357
435
  aggregate: z.ZodString;
@@ -364,13 +442,16 @@ export declare const setScope: import("@yss123/cage-kernel").Command<import("@ys
364
442
  }>>;
365
443
  deptIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
366
444
  }, z.core.$strip>>;
445
+ /**
446
+ * 将 active 角色停用为 archived；保留历史授权数据，角色的后续有效性由上下文加载按状态判断。
447
+ */
367
448
  export declare const archiveRole: import("@yss123/cage-kernel").Command<import("@yss123/cage-kernel").Aggregate<"Role", {
368
- code: import("@yss123/cage-kernel").Field<z.ZodString, false>;
369
- name: import("@yss123/cage-kernel").Field<z.ZodString, false>;
449
+ code: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
450
+ name: import("@yss123/cage-kernel").Field<z.ZodString, false, "text">;
370
451
  capabilities: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodObject<{
371
452
  capability: z.ZodString;
372
453
  params: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
373
- }, z.core.$strip>>, false>;
454
+ }, z.core.$strip>>, false, import("@yss123/cage-kernel").FieldKind>;
374
455
  scopes: import("@yss123/cage-kernel").Field<z.ZodArray<z.ZodObject<{
375
456
  aggregate: z.ZodString;
376
457
  combinator: z.ZodEnum<{
@@ -381,7 +462,7 @@ export declare const archiveRole: import("@yss123/cage-kernel").Command<import("
381
462
  deptSet: "deptSet";
382
463
  }>;
383
464
  deptIds: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
384
- }, z.core.$strip>>, false>;
465
+ }, z.core.$strip>>, false, import("@yss123/cage-kernel").FieldKind>;
385
466
  }, string>, {}, z.ZodObject<{
386
467
  id: z.ZodString;
387
468
  }, z.core.$strip>>;