@yss123/cage-cli 0.1.0 → 0.2.0

package/templates/blank/packages/contracts/src/aggregates/user/index.ts

@@ -0,0 +1,89 @@
+// 生成物：由 cage gen 从 domain 声明生成，不要手改。
+/* eslint-disable */
+
+import { z } from 'zod';
+import { client, useCageList, useCageQuery, type TransferTask } from '@yss123/cage-client';
+
+/** 用户：读侧快照（敏感字段是按权限掩码后的值） */
+export const UserSchema = z.object({
+  id: z.string().uuid(),
+  username: z.string(),
+  name: z.string(),
+  deptId: z.string().uuid(),
+  roleIds: z.array(z.string().uuid()),
+  phone: z.string().nullable().optional(),
+  email: z.string().nullable().optional(),
+  ssoSubject: z.string().nullable().optional(),
+  status: z.enum(["active", "disabled"]),
+  version: z.number().int(),
+  createdAt: z.string(),
+  updatedAt: z.string(),
+});
+export type User = z.infer<typeof UserSchema>;
+export type UserStatus = User['status'];
+export const UserStates = ['active', 'disabled'] as const;
+
+/** 命令输入：和后端命令的输入校验完全一致 */
+export const UserInputs = {
+  assignRoles: z.object({ id: z.string().uuid(), roleIds: z.array(z.string().uuid()).max(50) }),
+  create: z.object({ username: z.string().min(2).max(64).regex(new RegExp("^[A-Za-z0-9_.@-]+$")), name: z.string().min(1).max(100), deptId: z.string().uuid(), phone: z.string().max(32).nullable().optional(), email: z.string().email().max(200).nullable().optional(), ssoSubject: z.string().max(200).nullable().optional() }),
+  disable: z.object({ id: z.string().uuid() }),
+  enable: z.object({ id: z.string().uuid() }),
+  setPassword: z.object({ id: z.string().uuid(), password: z.string().min(8).max(200) }),
+  update: z.object({ id: z.string().uuid(), name: z.string().min(1).max(100).optional(), deptId: z.string().uuid().optional(), phone: z.string().max(32).nullable().optional(), email: z.string().email().max(200).nullable().optional() }),
+};
+
+/** User.assignRoles 可能返回的错误码 */
+export type UserAssignRolesError = 'CONFLICT' | 'CONSTRAINT_VIOLATED' | 'DOMAIN_ERROR' | 'FORBIDDEN' | 'INVALID_INPUT' | 'INVALID_TRANSITION' | 'NOT_FOUND';
+/** User.create 可能返回的错误码 */
+export type UserCreateError = 'CONFLICT' | 'CONSTRAINT_VIOLATED' | 'DOMAIN_ERROR' | 'FORBIDDEN' | 'INVALID_INPUT';
+/** User.disable 可能返回的错误码 */
+export type UserDisableError = 'CONFLICT' | 'DOMAIN_ERROR' | 'FORBIDDEN' | 'INVALID_INPUT' | 'INVALID_TRANSITION' | 'NOT_FOUND';
+/** User.enable 可能返回的错误码 */
+export type UserEnableError = 'CONFLICT' | 'DOMAIN_ERROR' | 'FORBIDDEN' | 'INVALID_INPUT' | 'INVALID_TRANSITION' | 'NOT_FOUND';
+/** User.setPassword 可能返回的错误码 */
+export type UserSetPasswordError = 'CONFLICT' | 'DOMAIN_ERROR' | 'FORBIDDEN' | 'INVALID_INPUT' | 'INVALID_TRANSITION' | 'NOT_FOUND';
+/** User.update 可能返回的错误码 */
+export type UserUpdateError = 'CONFLICT' | 'DOMAIN_ERROR' | 'FORBIDDEN' | 'INVALID_INPUT' | 'INVALID_TRANSITION' | 'NOT_FOUND';
+
+export type UserSortKey = 'createdAt' | 'updatedAt' | 'username' | 'name' | 'deptId' | 'phone' | 'email' | 'ssoSubject';
+export interface UserListParams {
+  page?: number;
+  pageSize?: number;
+  /** 排序：字段名，前面加 - 表示倒序 */
+  sort?: UserSortKey | `-${UserSortKey}`;
+  /** 可以逗号分隔多个状态 */
+  status?: string;
+  createdAfter?: string;
+  createdBefore?: string;
+  username?: string | number | boolean;
+  deptId?: string | number | boolean;
+  ssoSubject?: string | number | boolean;
+}
+
+/** 调用方法：每个命令一个；client 自动生成并附带幂等键和 CSRF 令牌 */
+export const user = {
+  /** 设置用户的角色（不能分配包含自己没有的能力的角色） */
+  assignRoles: (id: string, input: Omit<z.input<typeof UserInputs.assignRoles>, 'id'>, expectedVersion?: number) => client.post<User, UserAssignRolesError>(`/api/user/${encodeURIComponent(id)}/assign-roles`, { ...input, expectedVersion }),
+  /** 新建用户（默认没有任何角色） */
+  create: (input: z.input<typeof UserInputs.create>) => client.post<User, UserCreateError>('/api/user/create', input),
+  /** 停用用户 */
+  disable: (id: string, expectedVersion?: number) => client.post<User, UserDisableError>(`/api/user/${encodeURIComponent(id)}/disable`, { expectedVersion }),
+  /** 启用用户 */
+  enable: (id: string, expectedVersion?: number) => client.post<User, UserEnableError>(`/api/user/${encodeURIComponent(id)}/enable`, { expectedVersion }),
+  /** 重置密码 */
+  setPassword: (id: string, input: Omit<z.input<typeof UserInputs.setPassword>, 'id'>, expectedVersion?: number) => client.post<User, UserSetPasswordError>(`/api/user/${encodeURIComponent(id)}/set-password`, { ...input, expectedVersion }),
+  /** 修改用户信息 */
+  update: (id: string, input: Omit<z.input<typeof UserInputs.update>, 'id'>, expectedVersion?: number) => client.post<User, UserUpdateError>(`/api/user/${encodeURIComponent(id)}/update`, { ...input, expectedVersion }),
+  /** 异步导出 CSV：返回任务，使用 client.transfer(id) 查状态，完成后下载。需要 User.export 能力。 */
+  export: (params: UserListParams = {}, options: { idempotencyKey?: string } = {}) => client.post<TransferTask, 'CONFLICT'>('/api/user/export', params, options),
+  get: (id: string) => client.get<User>(`/api/user/${encodeURIComponent(id)}`),
+  list: (params: UserListParams = {}) => client.get<{ items: User[]; total: number; page: number; pageSize: number }>('/api/user', params as Record<string, unknown>),
+};
+
+/** 详情查询 hook：响应也用 schema 校验；范围外返回 NOT_FOUND */
+export const useUser = (id: string) => useCageQuery(['user', id], `/api/user/${encodeURIComponent(id)}`, UserSchema, { enabled: !!id });
+/** 列表查询 hook：走读侧账号与安全视图 */
+export const useUserList = (params: UserListParams = {}) => useCageList(['user'], '/api/user', params as Record<string, unknown>, UserSchema);
+/** 查询缓存键前缀：命令成功后让它失效 */
+export const userKeys = { all: ['user'] as const, one: (id: string) => ['user', id] as const };

package/templates/blank/packages/contracts/src/index.ts

@@ -0,0 +1,55 @@
+// 生成物：由 cage gen 从 domain 声明生成，不要手改。
+/* eslint-disable */
+
+export * from './aggregates/dept';
+export * from './aggregates/role';
+export * from './aggregates/user';
+export * from './queries';
+import { can as baseCan, useCan as baseUseCan } from '@yss123/cage-client';
+import { DeptInputs } from './aggregates/dept';
+import { RoleInputs } from './aggregates/role';
+import { UserInputs } from './aggregates/user';
+export { client, configureClient, loadMe, currentUser, CageQueryError, useTransfer, type CageResult, type CommonError, type TransferTask, type ImportReport } from '@yss123/cage-client';
+
+/** 能力目录（由代码派生）：写错能力点名会编译失败 */
+export const capabilities = [
+  'Dept.archive',
+  'Dept.create',
+  'Dept.export',
+  'Dept.read',
+  'Dept.update',
+  'Role.archive',
+  'Role.create',
+  'Role.export',
+  'Role.grantCapability',
+  'Role.read',
+  'Role.rename',
+  'Role.revokeCapability',
+  'Role.setScope',
+  'Sys.audit.read',
+  'Sys.ops.manage',
+  'Sys.ops.read',
+  'User.assignRoles',
+  'User.create',
+  'User.disable',
+  'User.enable',
+  'User.export',
+  'User.read',
+  'User.setPassword',
+  'User.unmask.email',
+  'User.unmask.name',
+  'User.unmask.phone',
+  'User.update',
+] as const;
+export type Capability = (typeof capabilities)[number];
+
+/** 当前用户有没有某个能力点。只影响界面显示：绕过前端直接调接口，内核一样会拒绝 */
+export const can = (capability: Capability): boolean => baseCan(capability);
+export const useCan = (capability: Capability): boolean => baseUseCan(capability);
+
+/** 各聚合的命令输入 schema：按聚合名、命令名访问，可直接供表单库校验 */
+export const schemas = {
+  Dept: DeptInputs,
+  Role: RoleInputs,
+  User: UserInputs,
+};

package/templates/blank/packages/contracts/src/queries/index.ts

@@ -0,0 +1,13 @@
+// 生成物：由 cage gen 从 domain 声明生成，不要手改。
+/* eslint-disable */
+
+import { z } from 'zod';
+import { client, useCageQuery } from '@yss123/cage-client';
+
+/** 查询输入 */
+export const QueryInputs = {
+};
+
+export const queries = {
+};
+

package/templates/blank/packages/contracts/tsconfig.json

@@ -0,0 +1,5 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": { "module": "ESNext", "moduleResolution": "Bundler", "outDir": "dist", "rootDir": "src" },
+  "include": ["src"]
+}

package/templates/blank/packages/domain/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "@app/domain",
+  "private": true,
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "development": "./src/index.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "dependencies": {
+    "@yss123/cage-kernel": "0.2.0",
+    "@yss123/cage-admin": "0.2.0",
+    "@yss123/cage-approval": "0.2.0",
+    "@yss123/cage-connectors": "0.2.0",
+    "zod": "^4.1.5"
+  }
+}

package/templates/blank/packages/domain/src/index.ts

@@ -0,0 +1,4 @@
+// CLI、API 与 worker 共用这个领域入口。空白项目只注册组织基础模型，
+// 不注册采购示例；新增业务写在同目录的 .ts 文件，再从这里统一导出。
+// 完整采购代码保存在 docs/examples/purchase-admin，仅作离线参考。
+export * from '@yss123/cage-admin/domain';

package/templates/blank/packages/domain/tsconfig.json

@@ -0,0 +1,5 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": { "outDir": "dist", "rootDir": "src" },
+  "include": ["src"], "exclude": ["src/**/*.test.ts"]
+}

package/templates/blank/pnpm-workspace.yaml

@@ -0,0 +1,10 @@
+packages:
+  - apps/*
+  - packages/*
+onlyBuiltDependencies:
+  - esbuild
+  - embedded-postgres
+  - '@embedded-postgres/windows-x64'
+  - '@embedded-postgres/linux-x64'
+  - '@embedded-postgres/darwin-arm64'
+  - '@embedded-postgres/darwin-x64'

package/templates/blank/renovate.json

@@ -0,0 +1,5 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "packageRules": [{ "matchPackageNames": ["@yss123/cage-**"], "groupName": "cage" }]
+}

package/templates/blank/tsconfig.base.json

@@ -0,0 +1,8 @@
+{
+  "compilerOptions": {
+    "target": "ES2023", "lib": ["ES2023", "DOM"],
+    "module": "NodeNext", "moduleResolution": "NodeNext", "strict": true,
+    "esModuleInterop": true, "skipLibCheck": true, "declaration": true,
+    "sourceMap": true, "resolveJsonModule": true, "isolatedModules": true
+  }
+}

package/dist/database.d.ts

@@ -1,5 +0,0 @@
-import { type CageConfig } from './config.js';
-/** 首次为项目生成独立凭证；已有配置保持原样，避免与持久卷中的角色密码失配。 */
-export declare function setupDatabase(cfg: CageConfig): boolean;
-/** Docker 仅负责基础设施，建库、账号权限和迁移仍复用框架现有 migrate 流程。 */
-export declare function database(cfg: CageConfig, action?: string): Promise<number>;

package/dist/database.js

@@ -1,70 +0,0 @@
-// 开发数据库的环境配置与 Docker 生命周期属于框架工具链。
-// 业务仓库只保留 compose.yaml/.env 等部署参数，不维护连接、建库或凭证生成脚本。
-import { existsSync, writeFileSync } from 'node:fs';
-import { randomBytes } from 'node:crypto';
-import { spawn } from 'node:child_process';
-import { abs } from './config.js';
-import { migrate } from './migrate.js';
-/** 首次为项目生成独立凭证；已有配置保持原样，避免与持久卷中的角色密码失配。 */
-export function setupDatabase(cfg) {
-    const target = abs(cfg, '.env');
-    if (existsSync(target))
-        return false;
-    const secret = () => randomBytes(24).toString('hex');
-    const passwords = { postgres: secret(), test: secret(), app: secret(), read: secret(), migrate: secret() };
-    const port = cfg.devDbPort;
-    const url = (user, password, port, database) => `postgresql://${user}:${password}@127.0.0.1:${port}/${database}`;
-    const content = [
-        '# 仅供本地开发，由 cage db setup 生成；不要提交或复制进镜像。',
-        `CAGE_POSTGRES_PORT=${port}`,
-        `CAGE_TEST_POSTGRES_PORT=${port + 1}`,
-        `POSTGRES_PASSWORD=${passwords.postgres}`,
-        `CAGE_TEST_POSTGRES_PASSWORD=${passwords.test}`,
-        `CAGE_SUPER_DATABASE_URL=${url('postgres', passwords.postgres, port, 'postgres')}`,
-        `CAGE_APP_DATABASE_URL=${url('cage_app', passwords.app, port, 'cage_dev')}`,
-        `CAGE_READ_DATABASE_URL=${url('cage_read', passwords.read, port, 'cage_dev')}`,
-        `CAGE_MIGRATE_DATABASE_URL=${url('cage_migrate', passwords.migrate, port, 'cage_dev')}`,
-        '# 测试会初始化集群角色，必须使用独立的可丢弃测试集群。',
-        `CAGE_TEST_DATABASE_URL=${url('postgres', passwords.test, port + 1, 'postgres')}`,
-        `CAGE_COOKIE_SECRET=${secret()}`,
-        'CAGE_STAGE=fake',
-        'CAGE_WEB_PORT=5173',
-        'PORT=3000',
-        'HOST=127.0.0.1',
-        '',
-    ].join('\n');
-    writeFileSync(target, content, { mode: 0o600, flag: 'wx' });
-    return true;
-}
-/** Docker 仅负责基础设施，建库、账号权限和迁移仍复用框架现有 migrate 流程。 */
-export async function database(cfg, action) {
-    if (action === 'setup') {
-        console.log(setupDatabase(cfg)
-            ? '已生成 .env（不输出密码）。随后运行 cage db up、cage db init、cage dev。'
-            : '已有 .env，保留当前数据库配置。');
-        return 0;
-    }
-    if (action === 'init') {
-        await migrate(cfg, true);
-        return 0;
-    }
-    // 参数列表由命令固定，不接受任意 shell 文本；down 不删除持久卷。
-    const actions = {
-        up: ['up', '-d', '--wait'],
-        down: ['down'],
-        status: ['ps'],
-    };
-    if (!action || !actions[action])
-        throw new Error('用法：cage db setup|up|init|status|down');
-    const child = spawn('docker', ['compose', '--profile', 'test', ...actions[action]], {
-        cwd: cfg.root,
-        env: process.env,
-        stdio: 'inherit',
-        windowsHide: true,
-    });
-    return new Promise((resolve, reject) => {
-        child.once('error', reject);
-        child.once('exit', (code) => resolve(code ?? 1));
-    });
-}
-//# sourceMappingURL=database.js.map

package/dist/database.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"database.js","sourceRoot":"","sources":["../src/database.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,mDAAmD;AACnD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,GAAG,EAAmB,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,2CAA2C;AAC3C,MAAM,UAAU,aAAa,CAAC,GAAe;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;IAC3G,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAE,IAAY,EAAE,QAAgB,EAAE,EAAE,CAC7E,gBAAgB,IAAI,IAAI,QAAQ,cAAc,IAAI,IAAI,QAAQ,EAAE,CAAC;IACnE,MAAM,OAAO,GAAG;QACd,yCAAyC;QACzC,sBAAsB,IAAI,EAAE;QAC5B,2BAA2B,IAAI,GAAG,CAAC,EAAE;QACrC,qBAAqB,SAAS,CAAC,QAAQ,EAAE;QACzC,+BAA+B,SAAS,CAAC,IAAI,EAAE;QAC/C,2BAA2B,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE;QAClF,yBAAyB,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE;QAC3E,0BAA0B,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE;QAC9E,6BAA6B,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE;QACvF,8BAA8B;QAC9B,0BAA0B,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,UAAU,CAAC,EAAE;QACjF,sBAAsB,MAAM,EAAE,EAAE;QAChC,iBAAiB;QACjB,oBAAoB;QACpB,WAAW;QACX,gBAAgB;QAChB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAe,EAAE,MAAe;IAC7D,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CACT,aAAa,CAAC,GAAG,CAAC;YAChB,CAAC,CAAC,wDAAwD;YAC1D,CAAC,CAAC,oBAAoB,CACzB,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,wCAAwC;IACxC,MAAM,OAAO,GAA6B;QACxC,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;QAC1B,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,MAAM,EAAE,CAAC,IAAI,CAAC;KACf,CAAC;IACF,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE;QAClF,GAAG,EAAE,GAAG,CAAC,IAAI;QACb,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/managed/errors/CAGE-APPR-001.md

@@ -1,32 +0,0 @@
-# CAGE-APPR-001
-
-## 什么时候出现
-
-命中以下实现中的检查时触发。终端会附具体声明位置、原因和修复方法。
-
-来源：[packages/kernel/src/primitives/flow.ts:134](../../packages/kernel/src/primitives/flow.ts)
-
-```ts
-  for (const f of def.routable) {
-    if (!(f in agg.fields)) throw declError('CAGE-APPR-001', `可路由字段 ${agg.name}.${f} 不存在`);
-  }
-  for (const c of [def.onApproved, def.onRejected]) {
-    if (c.agg !== agg) throw declError('CAGE-APPR-002', `审批结论命令必须属于 ${agg.name}`);
-    if (!c.invokedBy.includes('process')) {
-```
-
-## 怎么修
-
-核对流程绑定、可路由字段、结论命令及审批人配置。结论只能调用所属聚合的 process 命令。
-
-## 正例
-
-```text
-onApproved: approve // approve 声明 invokedBy: 'process'
-```
-
-## 反例
-
-```text
-onApproved: otherAggregateCommand // 结论落到了错误聚合
-```

package/managed/errors/CAGE-APPR-002.md

@@ -1,32 +0,0 @@
-# CAGE-APPR-002
-
-## 什么时候出现
-
-命中以下实现中的检查时触发。终端会附具体声明位置、原因和修复方法。
-
-来源：[packages/kernel/src/primitives/flow.ts:137](../../packages/kernel/src/primitives/flow.ts)
-
-```ts
-  for (const c of [def.onApproved, def.onRejected]) {
-    if (c.agg !== agg) throw declError('CAGE-APPR-002', `审批结论命令必须属于 ${agg.name}`);
-    if (!c.invokedBy.includes('process')) {
-      throw declError('CAGE-APPR-003', `审批结论命令必须声明 invokedBy: 'process'`);
-    }
-  }
-```
-
-## 怎么修
-
-核对流程绑定、可路由字段、结论命令及审批人配置。结论只能调用所属聚合的 process 命令。
-
-## 正例
-
-```text
-onApproved: approve // approve 声明 invokedBy: 'process'
-```
-
-## 反例
-
-```text
-onApproved: otherAggregateCommand // 结论落到了错误聚合
-```

package/managed/errors/CAGE-APPR-003.md

@@ -1,32 +0,0 @@
-# CAGE-APPR-003
-
-## 什么时候出现
-
-命中以下实现中的检查时触发。终端会附具体声明位置、原因和修复方法。
-
-来源：[packages/kernel/src/primitives/flow.ts:139](../../packages/kernel/src/primitives/flow.ts)
-
-```ts
-    if (!c.invokedBy.includes('process')) {
-      throw declError('CAGE-APPR-003', `审批结论命令必须声明 invokedBy: 'process'`);
-    }
-  }
-  return Object.freeze({
-    [APPROVAL]: true as const,
-```
-
-## 怎么修
-
-核对流程绑定、可路由字段、结论命令及审批人配置。结论只能调用所属聚合的 process 命令。
-
-## 正例
-
-```text
-onApproved: approve // approve 声明 invokedBy: 'process'
-```
-
-## 反例
-
-```text
-onApproved: otherAggregateCommand // 结论落到了错误聚合
-```

package/managed/errors/CAGE-APPR-004.md

@@ -1,32 +0,0 @@
-# CAGE-APPR-004
-
-## 什么时候出现
-
-命中以下实现中的检查时触发。终端会附具体声明位置、原因和修复方法。
-
-来源：[packages/approval/src/bridge.ts:8](../../packages/approval/src/bridge.ts)
-
-```ts
-  const binding = k.registry.approvalByProcess(r.process);
-  if (!binding) throw new Error(`[CAGE-APPR-004] 没有流程 ${r.process} 的审批绑定`);
-  const cmd = r.outcome === 'approved' ? binding.a.onApproved : binding.a.onRejected;
-  const ctx = k.processCtx({
-    process: r.process,
-    tenantId: r.tenantId,
-```
-
-## 怎么修
-
-核对流程绑定、可路由字段、结论命令及审批人配置。结论只能调用所属聚合的 process 命令。
-
-## 正例
-
-```text
-onApproved: approve // approve 声明 invokedBy: 'process'
-```
-
-## 反例
-
-```text
-onApproved: otherAggregateCommand // 结论落到了错误聚合
-```

package/managed/errors/CAGE-APPR-005.md

@@ -1,32 +0,0 @@
-# CAGE-APPR-005
-
-## 什么时候出现
-
-命中以下实现中的检查时触发。终端会附具体声明位置、原因和修复方法。
-
-来源：[packages/approval/src/route.ts:96](../../packages/approval/src/route.ts)
-
-```ts
-export function route(process: string, nodes: RouteNode[]): Route {
-  if (!/^[a-z][a-z0-9-]*$/.test(process)) throw declError('CAGE-APPR-005', `流程名 ${process} 必须是小写短横线`);
-  if (nodes.length === 0) throw declError('CAGE-APPR-006', `流程 ${process} 至少需要一个步骤`);
-  const fields = new Set<string>();
-  for (const n of nodes) {
-    const steps = n.kind === 'step' ? [n] : n.steps;
-```
-
-## 怎么修
-
-核对流程绑定、可路由字段、结论命令及审批人配置。结论只能调用所属聚合的 process 命令。
-
-## 正例
-
-```text
-onApproved: approve // approve 声明 invokedBy: 'process'
-```
-
-## 反例
-
-```text
-onApproved: otherAggregateCommand // 结论落到了错误聚合
-```

package/managed/errors/CAGE-APPR-006.md

@@ -1,32 +0,0 @@
-# CAGE-APPR-006
-
-## 什么时候出现
-
-命中以下实现中的检查时触发。终端会附具体声明位置、原因和修复方法。
-
-来源：[packages/approval/src/route.ts:97](../../packages/approval/src/route.ts)
-
-```ts
-  if (!/^[a-z][a-z0-9-]*$/.test(process)) throw declError('CAGE-APPR-005', `流程名 ${process} 必须是小写短横线`);
-  if (nodes.length === 0) throw declError('CAGE-APPR-006', `流程 ${process} 至少需要一个步骤`);
-  const fields = new Set<string>();
-  for (const n of nodes) {
-    const steps = n.kind === 'step' ? [n] : n.steps;
-    if (n.kind === 'when') fields.add(n.cond.field);
-```
-
-## 怎么修
-
-核对流程绑定、可路由字段、结论命令及审批人配置。结论只能调用所属聚合的 process 命令。
-
-## 正例
-
-```text
-onApproved: approve // approve 声明 invokedBy: 'process'
-```
-
-## 反例
-
-```text
-onApproved: otherAggregateCommand // 结论落到了错误聚合
-```

package/managed/errors/CAGE-APPR-007.md

@@ -1,32 +0,0 @@
-# CAGE-APPR-007
-
-## 什么时候出现
-
-命中以下实现中的检查时触发。终端会附具体声明位置、原因和修复方法。
-
-来源：[packages/approval/src/engine.ts:64](../../packages/approval/src/engine.ts)
-
-```ts
-    if (who.length === 0) {
-      throw new Error(`[CAGE-APPR-007] 流程 ${this.route.process} 第 ${index + 1} 步「${s.title}」找不到审批人，请在 /admin 配置部门负责人或角色`);
-    }
-    for (const assignee of new Set(who)) {
-      await tx.insertInto('flow.approval_task').values({ instance_id: instanceId, tenant_id: tenantId, step: index, title: s.title, assignee }).execute();
-    }
-```
-
-## 怎么修
-
-核对流程绑定、可路由字段、结论命令及审批人配置。结论只能调用所属聚合的 process 命令。
-
-## 正例
-
-```text
-onApproved: approve // approve 声明 invokedBy: 'process'
-```
-
-## 反例
-
-```text
-onApproved: otherAggregateCommand // 结论落到了错误聚合
-```

package/managed/errors/CAGE-APPR-010.md

@@ -1,32 +0,0 @@
-# CAGE-APPR-010
-
-## 什么时候出现
-
-命中以下实现中的检查时触发。终端会附具体声明位置、原因和修复方法。
-
-来源：[packages/cli/src/rules.ts:140](../../packages/cli/src/rules.ts)
-
-```ts
-
-/** CAGE-APPR-010：invokedBy 为 process 的命令必须有审批绑定或反应调用它，否则没有人能调用 */
-export function checkProcessCommands(g: Ontology): Finding[] {
-  const { into } = index(g);
-  const findings: Finding[] = [];
-  for (const c of g.nodes.filter((n) => n.kind === 'command')) {
-```
-
-## 怎么修
-
-核对流程绑定、可路由字段、结论命令及审批人配置。结论只能调用所属聚合的 process 命令。
-
-## 正例
-
-```text
-onApproved: approve // approve 声明 invokedBy: 'process'
-```
-
-## 反例
-
-```text
-onApproved: otherAggregateCommand // 结论落到了错误聚合
-```

package/managed/errors/CAGE-AUTH-001.md

@@ -1,32 +0,0 @@
-# CAGE-AUTH-001
-
-## 什么时候出现
-
-命中以下实现中的检查时触发。终端会附具体声明位置、原因和修复方法。
-
-来源：[packages/http/src/oidc.ts:20](../../packages/http/src/oidc.ts)
-
-```ts
-    (disco ??= fetch(new URL('.well-known/openid-configuration', o.issuer.endsWith('/') ? o.issuer : `${o.issuer}/`)).then(async (r) => {
-      if (!r.ok) throw new Error(`[CAGE-AUTH-001] OIDC 发现文档获取失败：${r.status}`);
-      return (await r.json()) as Discovery;
-    }));
-  const secure = opts.cookieSecure ?? process.env.NODE_ENV === 'production';
-
-```
-
-## 怎么修
-
-核对 OIDC 发现文档、issuer 和客户端配置，在部署环境配置所需变量。
-
-## 正例
-
-```text
-OIDC_ISSUER + OIDC_CLIENT_ID + OIDC_REDIRECT_URI
-```
-
-## 反例
-
-```text
-// issuer 不匹配或缺少客户端配置
-```

package/managed/errors/CAGE-BUDGET-001.md

@@ -1,32 +0,0 @@
-# CAGE-BUDGET-001
-
-## 什么时候出现
-
-命中以下实现中的检查时触发。终端会附具体声明位置、原因和修复方法。
-
-来源：[packages/cli/src/budget.ts:45](../../packages/cli/src/budget.ts)
-
-```ts
-    findings.push({
-      code: 'CAGE-BUDGET-001',
-      reason: `内核 ${lines} 行，超过 5000 行预算`,
-      fix: '拆出扩展职责，或提交架构评审调整预算',
-    });
-  if (primitives !== null && primitives > 16)
-```
-
-## 怎么修
-
-减少内核职责，移除不必要的 unsafe；预算调整及基线更新必须经过评审。
-
-## 正例
-
-```text
-node packages/cli/bin/cage.js budget
-```
-
-## 反例
-
-```text
-// 未评审就增加公共原语或 unsafe 数量
-```