@yss123/cage-http 0.2.0 → 0.3.0

package/README.md

@@ -1,19 +1,69 @@
 # @yss123/cage-http
 
-笼子 HTTP 层：Fastify 插件、路由生成、认证、安全基线
+Cage 的 HTTP 与进程装配层。根据 domain 注册表生成业务接口，组合 Cookie 会话、密码/OIDC 认证、CSRF、限流、日志脱敏、系统管理、文件和可选 AI/审批接口。应用只需薄启动入口，业务写操作继续由内核命令执行。
 
-Cage 是通过 TypeScript 声明业务、由框架统一执行权限和数据规则的中后台框架。此包是框架的一部分。
+## 安装
 
-## 使用
+需要 Node.js 24+、已初始化并迁移的 PostgreSQL；框架包保持同版本。在 API 包安装：
 
 ```powershell
 pnpm add @yss123/cage-http
 ```
 
-首次使用建议通过脚手架创建完整项目，所需依赖由模板统一配置。需要 Node.js 24 或更新版本。
+首次使用可执行 `pnpm create @yss123/cage-app my-app --template blank`，模板已配置 API 与独立 worker。
 
-- [完整使用说明](https://github.com/shunshunyue/cage/blob/main/docs/使用说明.md)
-- [框架源码与范例](https://github.com/shunshunyue/cage)
-- [问题反馈](https://github.com/shunshunyue/cage/issues)
+## 启动 API 和 worker
 
-许可证：[MIT](https://github.com/shunshunyue/cage/blob/main/LICENSE)。
+以下文件放在脚手架的 API 包，`@app/domain` 是本应用导出的声明。进程须从应用根目录加载本地 `.env`，或由部署系统注入环境变量。
+
+```ts
+/** API 入口：按领域声明装配接口，启动时不迁移数据库或创建管理员。 */
+import { createServer } from '@yss123/cage-http';
+import * as domain from '@app/domain';
+
+const server = createServer({ domain });
+await server.listen({ port: 3000, host: '127.0.0.1' });
+process.once('SIGINT', () => void server.close());
+process.once('SIGTERM', () => void server.close());
+```
+
+单独运行 worker 入口，消费 outbox、审批启动、连接器出站和定时任务；API 与 worker 使用同一版本、同一 domain 和数据库：
+
+```ts
+/** 后台入口：框架管理调度、重试与连接，退出时等待在途工作收尾。 */
+import { startWorker } from '@yss123/cage-http/worker';
+import * as domain from '@app/domain';
+
+const worker = await startWorker({ domain });
+process.once('SIGINT', () => void worker.stop());
+process.once('SIGTERM', () => void worker.stop());
+```
+
+标准模板使用 `pnpm dev` 同时启动开发进程。手动部署需配置 `CAGE_APP_DATABASE_URL` 和 `CAGE_READ_DATABASE_URL`，指向同一已有数据库的不同账号；生产环境还须注入至少 32 字节的 `CAGE_COOKIE_SECRET`。真实值仅存在部署配置中。
+
+## 常用配置与生命周期
+
+| 入口/选项 | 用途 |
+| --- | --- |
+| `createServer({ domain })` | 自动并入组织模型与声明路由，默认开启 `/admin/` |
+| `server.ready()` / `server.app` | 初始化后用 Fastify `inject` 做 HTTP 集成测试，不必监听端口 |
+| `server.listen()` / `server.close()` | 开始监听及释放 HTTP、扩展、授权监听和连接池 |
+| `server.health()`、`/readyz` | 检查数据库和授权监听是否就绪；`/healthz` 仅表示存活 |
+| `webDir` | 托管已构建业务 SPA；本地开发可由 Vite 提供 Web |
+| `trustProxy` | 配置实际可信代理，默认 `false` |
+| `files` | 私有存储目录、适配器与上传限额 |
+| `adminLabels` | 覆盖系统管理中的中文展示名，不改变真实能力标识 |
+| `routeTable`、`buildOpenApi` | 基于注册表获取路由与接口描述 |
+
+数据库准备顺序是 `cage init` → 审查并执行 `cage migrate` → 显式 `cage bootstrap` → 启动服务；具体初始化参数以模板 README 为准。`createServer` 不承担这些管理操作，`bootstrap: true` 会被拒绝。
+
+不要在 API 入口为普通业务新增手写写路由；修改 domain 并生成契约即可。浏览器使用 `@yss123/cage-client` 和 `@app/contracts`，不导入本包。前端按钮权限、审批选人和连接器回调都不能跳过内核最终授权。
+
+## 文档
+
+- [架构、数据库与权限](https://github.com/shunshunyue/cage/blob/main/docs/ai/architecture.md)
+- [路由与 SPA 部署](https://github.com/shunshunyue/cage/blob/main/docs/ai/routing.md)
+- [私有文件](https://github.com/shunshunyue/cage/blob/main/docs/ai/files.md)
+- [原生 AI 接入](https://github.com/shunshunyue/cage/blob/main/docs/ai/intelligence.md)
+
+源码与反馈：[GitHub](https://github.com/shunshunyue/cage)。许可证：[MIT](https://github.com/shunshunyue/cage/blob/main/LICENSE)。

package/dist/auth.d.ts

@@ -3,17 +3,22 @@ import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';
 import type { CtxCache } from './ctx.js';
 declare module 'fastify' {
     interface FastifyRequest {
+        /** 认证钩子总会设置；未登录请求也有带租户/请求号的匿名上下文。 */
         cageCtx: Ctx;
+        /** id 为数据库中的会话摘要，stepUpAt 为毫秒时间戳；没有有效会话时为 null。 */
         cageSession: {
             id: string;
             userId: string;
             tenantId: string;
             stepUpAt: number | null;
         } | null;
+        /** JSON 解析前的文本，仅为第三方回调验签保留，不应写入日志。 */
         rawBody?: string;
     }
 }
+/** 浏览器认证 Cookie 的固定名称；不是凭据值，也不保存用户角色。 */
 export declare const SESSION_COOKIE = "cage_sid";
+/** 服务端认证策略；缺省值面向普通会话，部署层应显式提供 OIDC 和生产 Cookie 配置。 */
 export interface AuthOptions {
     /** 会话时长（小时），默认 8 */
     sessionHours?: number;
@@ -21,6 +26,11 @@ export interface AuthOptions {
     cookieSecure?: boolean;
     /** 是否开放账号密码登录，默认开启 */
     password?: boolean;
+    /** 单进程正在执行的密码派生上限，默认 4；排队满后返回 RATE_LIMITED。 */
+    passwordConcurrency?: number;
+    /** 等待派生的请求上限，默认 32。 */
+    passwordQueueLimit?: number;
+    /** 可选授权码/PKCE 登录配置；clientSecret 仅保留在服务端，deptClaim 指向部门 code 的 claim 名。 */
     oidc?: {
         issuer: string;
         clientId: string;
@@ -30,29 +40,64 @@ export interface AuthOptions {
         deptClaim?: string;
     };
 }
-export declare function verifyPassword(pw: string, stored: string | null | undefined): boolean;
+/** 异步派生仍消耗有限线程和内存，因此执行和等待队列都必须有上限。 */
+export declare class PasswordVerifier {
+    private readonly concurrency;
+    private readonly queueLimit;
+    private active;
+    private readonly waiting;
+    /** concurrency 是同时派生个数，queueLimit 是额外等待个数；非法配置在启动期抛 CAGE-ENV-002。 */
+    constructor(concurrency?: number, queueLimit?: number);
+    /** 当前进程预算快照，仅用于观测；不是跨实例的全局限流计数。 */
+    get state(): {
+        active: number;
+        queued: number;
+    };
+    /** 先校验长度再占用执行槽；排队满抛 RATE_LIMITED，校验不匹配返回 false，派生异常继续上抛。
+     * finally 把槽直接移交给下一等待者，保证失败请求也会释放容量。
+     */
+    verify(pw: string, stored: string | null | undefined): Promise<boolean>;
+}
+/** 使用模块共享的默认有界校验器；HTTP 实例可另建 PasswordVerifier 使用自己的预算配置。 */
+export declare function verifyPassword(pw: string, stored: string | null | undefined): Promise<boolean>;
+/** 服务端会话持久化。调用方传入原始 sid 做验证/销毁，二次认证更新则使用已验证的数据库摘要 ID。 */
 export declare class Sessions {
     private readonly k;
     private readonly hours;
+    /** hours 为会话寿命小时数；构造函数不创建会话，也不延长已有会话。 */
     constructor(k: Kernel, hours: number);
+    /** 为已认证用户生成 32 字节随机会话并保存摘要/到期时间；原始 sid 仅返回给 Cookie 写入方。 */
     create(userId: string, tenantId: string, req: FastifyRequest): Promise<string>;
+    /** 只读取仍未过期的会话，未命中返回 null；用户是否禁用和当前授权由后续上下文解析复核。 */
     verify(sid: string): Promise<{
         id: string;
         userId: string;
         tenantId: string;
         stepUpAt: number | null;
     } | null>;
+    /** 幂等删除该原始 Cookie 对应的会话；不存在也视为退出完成。 */
     destroy(sid: string): Promise<void>;
+    /** 密码复核成功后记录数据库当前时间，后续命令的 stepUp 约束据此判断认证是否足够新。 */
     stepUp(sessionId: string): Promise<void>;
 }
+/** 交付 HttpOnly 会话 Cookie；maxAge 单位秒，与服务端会话小时数对应。CSRF 仍需独立令牌校验。 */
 export declare function setSessionCookie(reply: FastifyReply, sid: string, opts: AuthOptions): void;
 /** 认证钩子：每个请求最先执行，把会话变成上下文 */
+/** 先建立匿名上下文，再用有效 Cookie 和当前授权补全身份；健康探针/验签回调不解析用户会话。
+ * 无效 Cookie 不在此直接抛错，让各路由按是否需要登录决定拒绝行为；请求元数据不能跨请求缓存。
+ */
 export declare function registerAuthHook(app: FastifyInstance, k: Kernel, sessions: Sessions, cache: CtxCache): void;
+/** 登录专用最小字段查询，包含密码摘要但不返回给前端；租户条件不可省略。 */
 export declare function findLoginUser(k: Kernel, username: string, tenantId?: string): Promise<{
     tenant_id: any;
     id: any;
     password_hash: any;
     status: any;
 } | undefined>;
+/** 提供与 CSRF Cookie 配对的请求令牌；客户端后续写请求将该值放入框架要求的请求头。 */
 export declare function csrfRoute(app: FastifyInstance): void;
+/** 安装密码登录、二次认证、退出和当前用户接口；由 server 的认证限流作用域承载。
+ * 登录失败审计尽力写入但始终拒绝登录；禁用密码登录不会禁用退出或已有会话的 /api/me。
+ * /api/me 公开当前能力与范围供 UI 展示，不能代替后端对下一次操作的重新授权。
+ */
 export declare function authRoutes(app: FastifyInstance, k: Kernel, sessions: Sessions, opts: AuthOptions): void;

package/dist/auth.js

@@ -1,29 +1,101 @@
 // 认证：服务端会话 + 会话 cookie。优先对接公司 SSO（OIDC，见 oidc.ts），没有 SSO 时用账号密码加二次认证。
 // 之后每个请求都由认证钩子把会话变成上下文 ctx。
-import { createHash, randomBytes, scryptSync, timingSafeEqual } from 'node:crypto';
+/** HTTP 认证层只确定“谁在请求”和会话的二次认证时间，不决定某条业务命令是否可执行。
+ * 密码校验使用有界异步队列；Cookie 保存随机原始会话 ID，数据库仅存其 SHA-256。
+ * 业务能力与范围由 CtxCache 当前解析，最终写权限仍在 Kernel.execute 中执行。
+ */
+import { createHash, randomBytes, scrypt, timingSafeEqual } from 'node:crypto';
 import { anonymousCtx, cageError, DEFAULT_TENANT } from '@yss123/cage-kernel';
 import { sql } from 'kysely';
+/** 浏览器认证 Cookie 的固定名称；不是凭据值，也不保存用户角色。 */
 export const SESSION_COOKIE = 'cage_sid';
+/** 以摘要查询/删除会话，避免数据库泄露时原始 Cookie 直接成为可用凭据。 */
 const hashSid = (sid) => createHash('sha256').update(sid).digest('hex');
-export function verifyPassword(pw, stored) {
+/** 将 CPU/内存密集的 scrypt 交给异步实现；调用数量仍须由 PasswordVerifier 约束。 */
+const derivePassword = (pw, salt) => new Promise((resolve, reject) => {
+    scrypt(pw, salt, 32, (error, key) => error ? reject(error) : resolve(key));
+});
+/** 核对 scrypt$salt$hash 格式；缺少账户时仍做派生以减弱计时枚举，摘要采用恒时比较。 */
+async function comparePassword(pw, stored) {
     if (!stored) {
-        scryptSync(pw, 'timing-equalizer', 32); // 用户不存在时也做一次哈希，避免按耗时探测用户名
+        await derivePassword(pw, 'timing-equalizer'); // 用户不存在时也做一次哈希，避免按耗时探测用户名
         return false;
     }
     const [alg, salt, hash] = stored.split('$');
     if (alg !== 'scrypt' || !salt || !hash)
         return false;
-    const got = scryptSync(pw, salt, 32);
+    const got = await derivePassword(pw, salt);
     const want = Buffer.from(hash, 'hex');
     return want.length === got.length && timingSafeEqual(got, want);
 }
+/** 异步派生仍消耗有限线程和内存，因此执行和等待队列都必须有上限。 */
+export class PasswordVerifier {
+    concurrency;
+    queueLimit;
+    active = 0;
+    waiting = [];
+    /** concurrency 是同时派生个数，queueLimit 是额外等待个数；非法配置在启动期抛 CAGE-ENV-002。 */
+    constructor(concurrency = 4, queueLimit = 32) {
+        this.concurrency = concurrency;
+        this.queueLimit = queueLimit;
+        if (!Number.isSafeInteger(concurrency) || concurrency < 1 || !Number.isSafeInteger(queueLimit) || queueLimit < 0) {
+            throw new Error('[CAGE-ENV-002] passwordConcurrency 必须为正整数，passwordQueueLimit 必须为非负整数');
+        }
+    }
+    /** 当前进程预算快照，仅用于观测；不是跨实例的全局限流计数。 */
+    get state() { return { active: this.active, queued: this.waiting.length }; }
+    /** 先校验长度再占用执行槽；排队满抛 RATE_LIMITED，校验不匹配返回 false，派生异常继续上抛。
+     * finally 把槽直接移交给下一等待者，保证失败请求也会释放容量。
+     */
+    async verify(pw, stored) {
+        if (pw.length < 1 || pw.length > 200)
+            throw cageError('INVALID_INPUT', [{ path: 'password', message: '密码长度必须在 1 到 200 个字符之间' }]);
+        if (this.active < this.concurrency)
+            this.active++;
+        else {
+            if (this.waiting.length >= this.queueLimit)
+                throw cageError('RATE_LIMITED');
+            await new Promise((resolve) => this.waiting.push(resolve));
+        }
+        try {
+            return await comparePassword(pw, stored);
+        }
+        finally {
+            const next = this.waiting.shift();
+            if (next)
+                next();
+            else
+                this.active--;
+        }
+    }
+}
+const defaultVerifier = new PasswordVerifier();
+/** 使用模块共享的默认有界校验器；HTTP 实例可另建 PasswordVerifier 使用自己的预算配置。 */
+export function verifyPassword(pw, stored) {
+    return defaultVerifier.verify(pw, stored);
+}
+/** 把登录字段的格式错误统一成路径化 INVALID_INPUT；在任何密码派生前限制输入规模。 */
+function loginInput(raw) {
+    const body = (raw ?? {});
+    const issues = [];
+    if (typeof body.username !== 'string' || body.username.length < 1 || body.username.length > 64)
+        issues.push({ path: 'username', message: '用户名长度必须在 1 到 64 个字符之间' });
+    if (typeof body.password !== 'string' || body.password.length < 1 || body.password.length > 200)
+        issues.push({ path: 'password', message: '密码长度必须在 1 到 200 个字符之间' });
+    if (issues.length)
+        throw cageError('INVALID_INPUT', issues);
+    return body;
+}
+/** 服务端会话持久化。调用方传入原始 sid 做验证/销毁，二次认证更新则使用已验证的数据库摘要 ID。 */
 export class Sessions {
     k;
     hours;
+    /** hours 为会话寿命小时数；构造函数不创建会话，也不延长已有会话。 */
     constructor(k, hours) {
         this.k = k;
         this.hours = hours;
     }
+    /** 为已认证用户生成 32 字节随机会话并保存摘要/到期时间；原始 sid 仅返回给 Cookie 写入方。 */
     async create(userId, tenantId, req) {
         const sid = randomBytes(32).toString('base64url');
         await this.k.app
@@ -35,17 +107,21 @@ export class Sessions {
             .execute();
         return sid;
     }
+    /** 只读取仍未过期的会话，未命中返回 null；用户是否禁用和当前授权由后续上下文解析复核。 */
     async verify(sid) {
         const row = await this.k.app.selectFrom('sys.session').selectAll().where('id', '=', hashSid(sid)).where('expires_at', '>', new Date()).executeTakeFirst();
         return row ? { id: row.id, userId: row.user_id, tenantId: row.tenant_id, stepUpAt: row.step_up_at ? new Date(row.step_up_at).getTime() : null } : null;
     }
+    /** 幂等删除该原始 Cookie 对应的会话；不存在也视为退出完成。 */
     async destroy(sid) {
         await this.k.app.deleteFrom('sys.session').where('id', '=', hashSid(sid)).execute();
     }
+    /** 密码复核成功后记录数据库当前时间，后续命令的 stepUp 约束据此判断认证是否足够新。 */
     async stepUp(sessionId) {
         await this.k.app.updateTable('sys.session').set({ step_up_at: sql `now()` }).where('id', '=', sessionId).execute();
     }
 }
+/** 交付 HttpOnly 会话 Cookie；maxAge 单位秒，与服务端会话小时数对应。CSRF 仍需独立令牌校验。 */
 export function setSessionCookie(reply, sid, opts) {
     reply.setCookie(SESSION_COOKIE, sid, {
         httpOnly: true, // 前端脚本读不到，防 XSS 窃取
@@ -56,6 +132,9 @@ export function setSessionCookie(reply, sid, opts) {
     });
 }
 /** 认证钩子：每个请求最先执行，把会话变成上下文 */
+/** 先建立匿名上下文，再用有效 Cookie 和当前授权补全身份；健康探针/验签回调不解析用户会话。
+ * 无效 Cookie 不在此直接抛错，让各路由按是否需要登录决定拒绝行为；请求元数据不能跨请求缓存。
+ */
 export function registerAuthHook(app, k, sessions, cache) {
     app.decorateRequest('cageCtx', null);
     app.decorateRequest('cageSession', null);
@@ -65,6 +144,8 @@ export function registerAuthHook(app, k, sessions, cache) {
             client: { ip: req.ip, userAgent: String(req.headers['user-agent'] ?? '').slice(0, 300) },
         };
         req.cageCtx = anonymousCtx(DEFAULT_TENANT, base);
+        if (req.url.split('?')[0] === '/healthz' || req.url.split('?')[0] === '/readyz')
+            return;
         if (req.url.startsWith('/hooks/'))
             return; // 第三方回调走签名验证，不走用户登录
         const sid = req.cookies?.[SESSION_COOKIE];
@@ -80,6 +161,7 @@ export function registerAuthHook(app, k, sessions, cache) {
         req.cageCtx = { ...ctx, ...base, stepUpAt: s.stepUpAt, source: 'api' };
     });
 }
+/** 登录专用最小字段查询，包含密码摘要但不返回给前端；租户条件不可省略。 */
 export async function findLoginUser(k, username, tenantId = DEFAULT_TENANT) {
     return k.app
         .selectFrom('sys.user')
@@ -88,22 +170,28 @@ export async function findLoginUser(k, username, tenantId = DEFAULT_TENANT) {
         .where('tenant_id', '=', tenantId)
         .executeTakeFirst();
 }
+/** 提供与 CSRF Cookie 配对的请求令牌；客户端后续写请求将该值放入框架要求的请求头。 */
 export function csrfRoute(app) {
     app.get('/auth/csrf', async (_req, reply) => ({ token: reply.generateCsrf() }));
 }
+/** 安装密码登录、二次认证、退出和当前用户接口；由 server 的认证限流作用域承载。
+ * 登录失败审计尽力写入但始终拒绝登录；禁用密码登录不会禁用退出或已有会话的 /api/me。
+ * /api/me 公开当前能力与范围供 UI 展示，不能代替后端对下一次操作的重新授权。
+ */
 export function authRoutes(app, k, sessions, opts) {
+    const verifier = new PasswordVerifier(opts.passwordConcurrency, opts.passwordQueueLimit);
     if (opts.password !== false) {
         app.post('/auth/login', async (req, reply) => {
-            const body = (req.body ?? {});
-            if (typeof body.username !== 'string' || typeof body.password !== 'string')
-                throw cageError('INVALID_INPUT');
+            const body = loginInput(req.body);
             const u = await findLoginUser(k, body.username);
-            const ok = verifyPassword(body.password, u?.password_hash) && u?.status === 'active';
+            const ok = await verifier.verify(body.password, u?.password_hash) && u?.status === 'active';
             if (!u || !ok) {
                 await k.writeAudit(k.app, {
                     tenantId: DEFAULT_TENANT, actor: u?.id ?? `anonymous:${body.username.slice(0, 64)}`, actorKind: 'anonymous', source: 'api',
                     kind: 'denied', command: 'auth.login', result: 'UNAUTHENTICATED', requestId: String(req.id), client: { ip: req.ip },
-                }).catch(() => { });
+                }).catch((error) => {
+                    k.log.error({ err: error, code: 'AUTH_AUDIT_FAILED', requestId: req.id }, '登录拒绝审计写入失败');
+                });
                 throw cageError('UNAUTHENTICATED');
             }
             const sid = await sessions.create(u.id, u.tenant_id, req);
@@ -114,8 +202,10 @@ export function authRoutes(app, k, sessions, opts) {
             if (!req.cageSession)
                 throw cageError('UNAUTHENTICATED');
             const pw = req.body?.password;
+            if (typeof pw !== 'string' || pw.length < 1 || pw.length > 200)
+                throw cageError('INVALID_INPUT', [{ path: 'password', message: '密码长度必须在 1 到 200 个字符之间' }]);
             const row = await k.app.selectFrom('sys.user').select('password_hash').where('id', '=', req.cageSession.userId).executeTakeFirst();
-            if (typeof pw !== 'string' || !verifyPassword(pw, row?.password_hash))
+            if (!await verifier.verify(pw, row?.password_hash))
                 throw cageError('UNAUTHENTICATED');
             await sessions.stepUp(req.cageSession.id);
             return { ok: true };

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,4BAA4B;AAC5B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAyB,MAAM,qBAAqB,CAAC;AAErG,OAAO,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAW7B,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AAYzC,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEhF,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,MAAiC;IAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,UAAU,CAAC,EAAE,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC,CAAC,0BAA0B;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,OAAO,QAAQ;IACU;IAA4B;IAAzD,YAA6B,CAAS,EAAmB,KAAa;QAAzC,MAAC,GAAD,CAAC,CAAQ;QAAmB,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAE1E,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,QAAgB,EAAE,GAAmB;QAChE,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG;aACb,UAAU,CAAC,aAAa,CAAC;aACzB,MAAM,CAAC;YACN,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;YAChH,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SAC9E,CAAC;aACD,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC1J,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAY,EAAE,MAAM,EAAE,GAAG,CAAC,OAAiB,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAmB,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IACpH,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAmB,EAAE,GAAW,EAAE,IAAiB;IAClF,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE;QACnC,QAAQ,EAAE,IAAI,EAAE,mBAAmB;QACnC,MAAM,EAAE,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QAClE,QAAQ,EAAE,KAAK,EAAE,UAAU;QAC3B,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,IAAI;KACxC,CAAC,CAAC;AACL,CAAC;AAED,6BAA6B;AAC7B,MAAM,UAAU,gBAAgB,CAAC,GAAoB,EAAE,CAAS,EAAE,QAAkB,EAAE,KAAe;IACnG,GAAG,CAAC,eAAe,CAAC,SAAS,EAAE,IAAW,CAAC,CAAC;IAC5C,GAAG,CAAC,eAAe,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrC,MAAM,IAAI,GAAiB;YACzB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACzF,CAAC;QACF,GAAG,CAAC,OAAO,GAAG,YAAY,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,oBAAoB;QAC/D,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC;QACpB,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,CAAS,EAAE,QAAgB,EAAE,QAAQ,GAAG,cAAc;IACxF,OAAO,CAAC,CAAC,GAAG;SACT,UAAU,CAAC,UAAU,CAAC;SACtB,MAAM,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;SACtD,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC;SAChC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,QAAQ,CAAC;SACjC,gBAAgB,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAoB;IAC5C,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAoB,EAAE,CAAS,EAAE,QAAkB,EAAE,IAAiB;IAE/F,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC3C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA+C,CAAC;YAC5E,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;gBAAE,MAAM,SAAS,CAAC,eAAe,CAAC,CAAC;YAC7G,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,QAAQ,CAAC;YACrF,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACd,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE;oBACxB,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,aAAa,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK;oBAC1H,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE;iBACpH,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACnB,MAAM,SAAS,CAAC,iBAAiB,CAAC,CAAC;YACrC,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAC1D,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACnC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACtC,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,MAAM,SAAS,CAAC,iBAAiB,CAAC,CAAC;YACzD,MAAM,EAAE,GAAI,GAAG,CAAC,IAAY,EAAE,QAAQ,CAAC;YACvC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,gBAAgB,EAAE,CAAC;YACnI,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,aAAa,CAAC;gBAAE,MAAM,SAAS,CAAC,iBAAiB,CAAC,CAAC;YAC1G,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC;QAC1C,IAAI,GAAG;YAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,KAAK,CAAC,WAAW,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,MAAM,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC3I,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;YACpF,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY,EAAE,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACjD,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;SAC/B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,4BAA4B;AAC5B;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAyB,MAAM,qBAAqB,CAAC;AAErG,OAAO,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAc7B,yCAAyC;AACzC,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AAkBzC,6CAA6C;AAC7C,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEhF,6DAA6D;AAC7D,MAAM,cAAc,GAAG,CAAC,EAAU,EAAE,IAAY,EAAmB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IACpG,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7E,CAAC,CAAC,CAAC;AAEH,wDAAwD;AACxD,KAAK,UAAU,eAAe,CAAC,EAAU,EAAE,MAAiC;IAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,cAAc,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC,0BAA0B;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAClE,CAAC;AAED,sCAAsC;AACtC,MAAM,OAAO,gBAAgB;IAKE;IAAkC;IAJvD,MAAM,GAAG,CAAC,CAAC;IACF,OAAO,GAAmB,EAAE,CAAC;IAE9C,qEAAqE;IACrE,YAA6B,cAAc,CAAC,EAAmB,aAAa,EAAE;QAAjD,gBAAW,GAAX,WAAW,CAAI;QAAmB,eAAU,GAAV,UAAU,CAAK;QAC5E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACjH,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,IAAI,KAAK,KAAyC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAEhH;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAiC;QACxD,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,SAAS,CAAC,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;QACjI,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW;YAAE,IAAI,CAAC,MAAM,EAAE,CAAC;aAC7C,CAAC;YACJ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU;gBAAE,MAAM,SAAS,CAAC,cAAc,CAAC,CAAC;YAC5E,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC;YAAC,OAAO,MAAM,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;gBACzC,CAAC;YACP,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,IAAI;gBAAE,IAAI,EAAE,CAAC;;gBACZ,IAAI,CAAC,MAAM,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;CACF;AAED,MAAM,eAAe,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAC/C,4DAA4D;AAC5D,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,MAAiC;IAC1E,OAAO,eAAe,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,qDAAqD;AACrD,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;IACpD,MAAM,MAAM,GAAG,EAAE,CAAC;IAClB,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACpK,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACrK,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC5D,OAAO,IAA8C,CAAC;AACxD,CAAC;AAED,yDAAyD;AACzD,MAAM,OAAO,QAAQ;IAEU;IAA4B;IADzD,yCAAyC;IACzC,YAA6B,CAAS,EAAmB,KAAa;QAAzC,MAAC,GAAD,CAAC,CAAQ;QAAmB,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAE1E,2DAA2D;IAC3D,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,QAAgB,EAAE,GAAmB;QAChE,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG;aACb,UAAU,CAAC,aAAa,CAAC;aACzB,MAAM,CAAC;YACN,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;YAChH,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SAC9E,CAAC;aACD,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,CAAC;IACb,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC1J,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAY,EAAE,MAAM,EAAE,GAAG,CAAC,OAAiB,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAmB,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvL,CAAC;IAED,uCAAuC;IACvC,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACtF,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IACpH,CAAC;CACF;AAED,kEAAkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,KAAmB,EAAE,GAAW,EAAE,IAAiB;IAClF,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE;QACnC,QAAQ,EAAE,IAAI,EAAE,mBAAmB;QACnC,MAAM,EAAE,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QAClE,QAAQ,EAAE,KAAK,EAAE,UAAU;QAC3B,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,IAAI;KACxC,CAAC,CAAC;AACL,CAAC;AAED,6BAA6B;AAC7B;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAoB,EAAE,CAAS,EAAE,QAAkB,EAAE,KAAe;IACnG,GAAG,CAAC,eAAe,CAAC,SAAS,EAAE,IAAW,CAAC,CAAC;IAC5C,GAAG,CAAC,eAAe,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrC,MAAM,IAAI,GAAiB;YACzB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACzF,CAAC;QACF,GAAG,CAAC,OAAO,GAAG,YAAY,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO;QACxF,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,oBAAoB;QAC/D,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC;QACpB,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,CAAS,EAAE,QAAgB,EAAE,QAAQ,GAAG,cAAc;IACxF,OAAO,CAAC,CAAC,GAAG;SACT,UAAU,CAAC,UAAU,CAAC;SACtB,MAAM,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;SACtD,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC;SAChC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,QAAQ,CAAC;SACjC,gBAAgB,EAAE,CAAC;AACxB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,SAAS,CAAC,GAAoB;IAC5C,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,GAAoB,EAAE,CAAS,EAAE,QAAkB,EAAE,IAAiB;IAC/F,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAEzF,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,QAAQ,CAAC;YAC5F,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACd,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE;oBACxB,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,aAAa,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK;oBAC1H,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE;iBACpH,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBACjB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC;gBAC1F,CAAC,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,iBAAiB,CAAC,CAAC;YACrC,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAC1D,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACnC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACtC,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,MAAM,SAAS,CAAC,iBAAiB,CAAC,CAAC;YACzD,MAAM,EAAE,GAAI,GAAG,CAAC,IAAY,EAAE,QAAQ,CAAC;YACvC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAM,SAAS,CAAC,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;YAC3J,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,gBAAgB,EAAE,CAAC;YACnI,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,aAAa,CAAC;gBAAE,MAAM,SAAS,CAAC,iBAAiB,CAAC,CAAC;YACvF,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC;QAC1C,IAAI,GAAG;YAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,KAAK,CAAC,WAAW,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,MAAM,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC3I,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;YACpF,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY,EAAE,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACjD,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;SAC/B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/ctx.d.ts

@@ -1,13 +1,30 @@
 import type { Ctx, Kernel } from '@yss123/cage-kernel';
+/** 跨请求复用用户授权上下文，减少正常流量下反复查询组织表的开销。
+ * PostgreSQL 通知用于主动失效；监听不健康时缓存失效并逐请求读库，避免撤权后继续使用旧授权。
+ * generation 让通知前发起、通知后完成的查询无法把旧结果重新写回缓存。
+ */
 export declare class CtxCache {
     private readonly kernel;
     private readonly cache;
     private listener;
     private stopped;
+    private connected;
+    private generation;
+    private retry;
+    private connecting;
+    /** 复用服务的内核和授权解析，不创建额外业务连接池；监听另用专用连接。 */
     constructor(kernel: Kernel);
+    /** 仅代表撤权通知链路可用且尚未停止；数据库读写就绪由服务探针分别检查。 */
+    get healthy(): boolean;
+    /** 按租户和用户查当前授权；不存在返回 null，禁用用户无有效能力，监听失效时不读取/填充缓存。 */
     resolve(userId: string, tenantId: string): Promise<Ctx | null>;
+    /** 通知载荷为用户 ID 或 *；用户 ID 会清除所有匹配租户缓存，且推进查询代次。 */
     invalidate(payload: string): void;
-    /** 进程启动时调用一次；连接断开后自动重连 */
+    /** 建立单个专用 LISTEN 连接，并合并并发连接请求；失败后每五秒重试。
+     * 断线立即切到逐请求授权读取，重连成功才恢复缓存，不能把重试中的状态视为健康。
+     * 重连成功后也清空缓存，覆盖断线期间未收到通知的授权变化。
+     */
     listen(appUrl: string): Promise<void>;
+    /** 先禁止重连和缓存命中，再等待连接尝试并关闭监听；适合服务停止阶段调用。 */
     close(): Promise<void>;
 }

package/dist/ctx.js

@@ -1,24 +1,40 @@
 import { LRUCache } from 'lru-cache';
 import pg from 'pg';
+/** 跨请求复用用户授权上下文，减少正常流量下反复查询组织表的开销。
+ * PostgreSQL 通知用于主动失效；监听不健康时缓存失效并逐请求读库，避免撤权后继续使用旧授权。
+ * generation 让通知前发起、通知后完成的查询无法把旧结果重新写回缓存。
+ */
 export class CtxCache {
     kernel;
     cache = new LRUCache({ max: 5000, ttl: 5 * 60_000 });
     listener = null;
     stopped = false;
+    connected = false;
+    generation = 0;
+    retry = null;
+    connecting = null;
+    /** 复用服务的内核和授权解析，不创建额外业务连接池；监听另用专用连接。 */
     constructor(kernel) {
         this.kernel = kernel;
     }
+    /** 仅代表撤权通知链路可用且尚未停止；数据库读写就绪由服务探针分别检查。 */
+    get healthy() { return this.connected && !this.stopped; }
+    /** 按租户和用户查当前授权；不存在返回 null，禁用用户无有效能力，监听失效时不读取/填充缓存。 */
     async resolve(userId, tenantId) {
         const key = `${tenantId}:${userId}`;
-        const hit = this.cache.get(key);
+        const generation = this.generation;
+        const hit = this.healthy ? this.cache.get(key) : undefined;
         if (hit)
             return hit;
         const ctx = await this.kernel.contextFor(userId, tenantId);
-        if (ctx)
+        // 解析期间收到撤权通知或发生断线，不能把旧的查询结果重新放回缓存。
+        if (ctx && this.healthy && generation === this.generation)
             this.cache.set(key, ctx);
         return ctx;
     }
+    /** 通知载荷为用户 ID 或 *；用户 ID 会清除所有匹配租户缓存，且推进查询代次。 */
     invalidate(payload) {
+        this.generation++;
         if (payload === '*')
             this.cache.clear();
         else
@@ -26,32 +42,67 @@ export class CtxCache {
                 if (k.endsWith(`:${payload}`))
                     this.cache.delete(k);
     }
-    /** 进程启动时调用一次；连接断开后自动重连 */
+    /** 建立单个专用 LISTEN 连接，并合并并发连接请求；失败后每五秒重试。
+     * 断线立即切到逐请求授权读取，重连成功才恢复缓存，不能把重试中的状态视为健康。
+     * 重连成功后也清空缓存，覆盖断线期间未收到通知的授权变化。
+     */
     async listen(appUrl) {
+        if (this.stopped || this.healthy)
+            return;
+        if (this.connecting)
+            return this.connecting;
         const connect = async () => {
-            if (this.stopped)
-                return;
+            const client = new pg.Client({ connectionString: appUrl, application_name: 'cage-grants-listen', connectionTimeoutMillis: 5000 });
+            let failed = false;
+            const disconnected = () => {
+                if (failed)
+                    return;
+                failed = true;
+                if (this.listener === client)
+                    this.listener = null;
+                this.connected = false;
+                this.invalidate('*');
+                void client.end().catch(() => { });
+                if (!this.stopped && !this.retry) {
+                    this.retry = setTimeout(() => {
+                        this.retry = null;
+                        void this.listen(appUrl);
+                    }, 5000);
+                    this.retry.unref();
+                }
+            };
+            client.on('error', disconnected);
+            client.on('end', disconnected);
+            client.on('notification', (notification) => this.invalidate(notification.payload ?? '*'));
             try {
-                const c = new pg.Client({ connectionString: appUrl, application_name: 'cage-grants-listen' });
-                await c.connect();
-                await c.query('LISTEN cage_grants');
-                c.on('notification', (n) => this.invalidate(n.payload ?? '*'));
-                c.on('error', () => {
-                    this.cache.clear();
-                    setTimeout(() => void connect(), 5000);
-                });
-                this.listener = c;
+                await client.connect();
+                await client.query('LISTEN cage_grants');
+                if (this.stopped || failed) {
+                    await client.end();
+                    return;
+                }
+                this.invalidate('*');
+                this.listener = client;
+                this.connected = true;
             }
-            catch (e) {
-                this.kernel.log.warn({ err: String(e) }, '授权变更监听连接失败，5 秒后重试');
-                setTimeout(() => void connect(), 5000);
+            catch (error) {
+                this.kernel.log.warn({ err: error }, '授权变更监听连接失败，实时复核授权并在 5 秒后重试');
+                disconnected();
             }
         };
-        await connect();
+        this.connecting = connect().finally(() => { this.connecting = null; });
+        return this.connecting;
     }
+    /** 先禁止重连和缓存命中，再等待连接尝试并关闭监听；适合服务停止阶段调用。 */
     async close() {
         this.stopped = true;
-        await this.listener?.end().catch(() => { });
+        this.connected = false;
+        this.invalidate('*');
+        if (this.retry)
+            clearTimeout(this.retry);
+        await this.connecting;
+        await this.listener?.end();
+        this.listener = null;
     }
 }
 //# sourceMappingURL=ctx.js.map

package/dist/ctx.js.map

@@ -1 +1 @@
-{"version":3,"file":"ctx.js","sourceRoot":"","sources":["../src/ctx.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,MAAM,OAAO,QAAQ;IAKU;IAJZ,KAAK,GAAG,IAAI,QAAQ,CAAc,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;IAC3E,QAAQ,GAAqB,IAAI,CAAC;IAClC,OAAO,GAAG,KAAK,CAAC;IAExB,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,QAAgB;QAC5C,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QACpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3D,IAAI,GAAG;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAClC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,IAAI,OAAO,KAAK,GAAG;YAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;;YACnC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;oBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACnG,CAAC;IAED,0BAA0B;IAC1B,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;YACzB,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;YACzB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBAC9F,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;gBACpC,CAAC,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC;gBAC/D,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACjB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;oBACnB,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;gBACzC,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;gBAC9D,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;YACzC,CAAC;QACH,CAAC,CAAC;QACF,MAAM,OAAO,EAAE,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;CACF"}
+{"version":3,"file":"ctx.js","sourceRoot":"","sources":["../src/ctx.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB;;;GAGG;AACH,MAAM,OAAO,QAAQ;IAUU;IATZ,KAAK,GAAG,IAAI,QAAQ,CAAc,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;IAC3E,QAAQ,GAAqB,IAAI,CAAC;IAClC,OAAO,GAAG,KAAK,CAAC;IAChB,SAAS,GAAG,KAAK,CAAC;IAClB,UAAU,GAAG,CAAC,CAAC;IACf,KAAK,GAAyC,IAAI,CAAC;IACnD,UAAU,GAAyB,IAAI,CAAC;IAEhD,wCAAwC;IACxC,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,yCAAyC;IACzC,IAAI,OAAO,KAAc,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAElE,sDAAsD;IACtD,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,QAAgB;QAC5C,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QACpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3D,mCAAmC;QACnC,IAAI,GAAG,IAAI,IAAI,CAAC,OAAO,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACpF,OAAO,GAAG,CAAC;IACb,CAAC;IAED,gDAAgD;IAChD,UAAU,CAAC,OAAe;QACxB,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,OAAO,KAAK,GAAG;YAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;;YACnC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;oBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACnG,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzC,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC5C,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;YAClI,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,MAAM,YAAY,GAAG,GAAG,EAAE;gBACxB,IAAI,MAAM;oBAAE,OAAO;gBACnB,MAAM,GAAG,IAAI,CAAC;gBACd,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;oBAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACnD,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;gBACvB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBACrB,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACjC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;wBAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;wBAClB,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBAC3B,CAAC,EAAE,IAAI,CAAC,CAAC;oBACT,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACrB,CAAC;YACH,CAAC,CAAC;YACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YACjC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAC/B,MAAM,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;gBACvB,MAAM,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;gBACzC,IAAI,IAAI,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC;oBAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC3D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBACrB,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;gBACvB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,4BAA4B,CAAC,CAAC;gBACnE,YAAY,EAAE,CAAC;YACjB,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,0CAA0C;IAC1C,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,IAAI,CAAC,KAAK;YAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,UAAU,CAAC;QACtB,MAAM,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;CACF"}

package/dist/files.d.ts

@@ -0,0 +1,12 @@
+import { type FileService } from '@yss123/cage-files';
+import type { FastifyInstance } from 'fastify';
+import type { RouteInfo } from './routes.js';
+/** 上传会话与私有下载的协议清单；具体授权依赖会话和目标对象，无法用单个固定 capability 表达。 */
+export declare const fileRoutes: RouteInfo[];
+/**
+ * 将 HTTP 字节流交给 FileService，统一复用当前请求的登录上下文和全局 CSRF 保护。
+ * 分片要求 Content-Length 与 SHA-256，长度上限使用服务配置；准确字节数和摘要由存储层校验。
+ * 下载仅支持一个闭区间 bytes 范围，非法范围返回 416；有效范围返回 206 和准确 Content-Length。
+ * 元数据读取及实际下载分别复核访问条件，FileService 在交付前记录审计；响应禁止共享缓存并强制附件下载。
+ */
+export declare function registerFiles(app: FastifyInstance, files: FileService): Promise<void>;