@yss123/cage-kernel 0.0.0-stage → 0.1.0

package/dist/kernel.js

@@ -0,0 +1,440 @@
+// 内核：唯一的写入入口 execute。HTTP、审批流程、定时任务、反应、批量导入都调用它，
+// 所以检查只写一遍，顺序永远一样（设计文档第 5 节的 12 关）。
+import { randomUUID } from 'node:crypto';
+import { sql } from 'kysely';
+import { connect } from './db/connect.js';
+import { diffFields, fieldsToColumns } from './db/rows.js';
+import { setSessionVars } from './db/session.js';
+import { CageError, cageError, isDomainError, toCageError } from './errors.js';
+import { auditDiff, maskValue, present } from './mask.js';
+import { loadUserGrants, systemCtx, userCtx } from './org.js';
+import { bindReads, loadScoped } from './pipeline/load.js';
+import { idempotency } from './pipeline/idempotency.js';
+import { defaultPayload } from './primitives/event.js';
+import { ReadSide } from './read.js';
+import { buildRegistry } from './registry.js';
+import { consoleLogger, step, traceCarrier } from './telemetry.js';
+function zodIssues(e) {
+    return e.issues.map((i) => ({ path: i.path.join('.'), message: i.message }));
+}
+export class Kernel {
+    registry;
+    app;
+    readDb;
+    read;
+    log;
+    handles = [];
+    maxDepth;
+    constructor(opts) {
+        this.registry = buildRegistry(opts.domain, opts.registryOptions);
+        this.log = opts.logger ?? consoleLogger;
+        this.maxDepth = opts.maxReactionDepth ?? 5;
+        if (opts.db) {
+            this.app = opts.db.app;
+            this.readDb = opts.db.read;
+        }
+        else if (opts.urls) {
+            const a = connect(opts.urls.app, { max: opts.poolSize, applicationName: 'cage-kernel' });
+            const r = connect(opts.urls.read, { max: opts.poolSize, applicationName: 'cage-read' });
+            this.handles.push(a, r);
+            this.app = a.db;
+            this.readDb = r.db;
+        }
+        else {
+            throw new Error('[CAGE-ENV-001] createKernel 需要 urls 或 db');
+        }
+        this.read = new ReadSide(this);
+    }
+    async close() {
+        for (const h of this.handles)
+            await h.close();
+    }
+    resolve(ref) {
+        const rc = this.registry.command(ref);
+        if (!rc) {
+            throw new Error(`[CAGE-REG-001] 找不到命令 ${typeof ref === 'string' ? ref : ref.agg.name + '.?'}，它是否从 domain 导出了？`);
+        }
+        return rc;
+    }
+    // ---------------- 写入 ----------------
+    /** 执行一个命令（自己开事务）。返回按当前主体掩码后的新快照。 */
+    async execute(ref, raw, ctx) {
+        const rc = this.resolve(ref);
+        try {
+            return await step(`execute ${rc.capability}`, () => this.app.transaction().execute(async (tx) => {
+                const r = await this.run(tx, rc, raw, ctx, 0);
+                return r.replay !== undefined ? r.replay : r.presented;
+            }));
+        }
+        catch (e) {
+            const ce = toCageError(e);
+            if (ce.code === 'INTERNAL')
+                this.log.error({ err: e, capability: rc.capability, requestId: ctx.requestId }, '命令执行异常');
+            if (ce.code === 'FORBIDDEN' || ce.code === 'NOT_FOUND' || ce.code === 'CONSTRAINT_VIOLATED') {
+                void this.auditDenied(rc, raw, ctx, ce);
+            }
+            throw ce;
+        }
+    }
+    /** 在已有事务里执行（同事务反应、审批桥接、批量整批原子模式用）。返回未掩码的快照。 */
+    async executeIn(tx, ref, raw, ctx, depth = 1) {
+        const rc = this.resolve(ref);
+        const r = await this.run(tx, rc, raw, ctx, depth);
+        return (r.next ?? r.replay);
+    }
+    /** 批量写入：每一行都完整走 12 关；默认逐行独立提交，可选整批原子。批量没有快捷路径。 */
+    async executeBatch(ref, rows, ctx, opts = {}) {
+        const rc = this.resolve(ref);
+        const bctx = { ...ctx, source: ctx.source === 'api' ? 'import' : ctx.source, idempotencyKey: undefined };
+        if (!opts.atomic) {
+            const out = [];
+            for (let i = 0; i < rows.length; i++) {
+                try {
+                    out.push({ index: i, ok: true, data: await this.execute(rc.cmd, rows[i], bctx) });
+                }
+                catch (e) {
+                    out.push({ index: i, ok: false, error: toCageError(e).toJSON() });
+                }
+            }
+            return out;
+        }
+        let failedAt = -1;
+        let failure = null;
+        const results = [];
+        try {
+            await this.app.transaction().execute(async (tx) => {
+                for (let i = 0; i < rows.length; i++) {
+                    try {
+                        const r = await this.run(tx, rc, rows[i], bctx, 0);
+                        results.push({ index: i, ok: true, data: r.presented });
+                    }
+                    catch (e) {
+                        failedAt = i;
+                        failure = toCageError(e);
+                        throw e;
+                    }
+                }
+            });
+            return results;
+        }
+        catch {
+            return rows.map((_, i) => ({
+                index: i,
+                ok: false,
+                error: i === failedAt && failure ? failure.toJSON() : { code: 'ABORTED', detail: '整批原子模式：其他行失败，本行已回滚' },
+            }));
+        }
+    }
+    async run(tx, rc, raw, ctx, depth) {
+        const { cmd, capability } = rc;
+        const agg = cmd.agg;
+        if (depth > this.maxDepth)
+            throw new Error(`[CAGE-REACT-002] 同事务反应嵌套超过 ${this.maxDepth} 层`);
+        // 第 1 关：认证
+        if (!ctx.actor || (ctx.actor.kind === 'anonymous' && !cmd.public))
+            throw cageError('UNAUTHENTICATED');
+        // 第 2 关：校验输入
+        const { expectedVersion, rest } = splitRaw(raw);
+        const parsed = cmd.input.safeParse(rest);
+        if (!parsed.success)
+            throw cageError('INVALID_INPUT', zodIssues(parsed.error));
+        const input = parsed.data;
+        // 第 3 关：调用方与能力
+        assertInvoker(cmd, ctx, capability);
+        if (!cmd.public && !ctx.capabilities.has(capability))
+            throw cageError('FORBIDDEN', { capability });
+        // 幂等：先抢占幂等键（键按主体和能力点隔离）
+        const idemKey = depth === 0 && ctx.idempotencyKey ? `${ctx.actor.id}:${capability}:${ctx.idempotencyKey}` : undefined;
+        const claim = await idempotency.claim(tx, idemKey);
+        if (!claim.fresh)
+            return { replay: claim.result };
+        await setSessionVars(tx, ctx);
+        const now = new Date();
+        const actorUserId = ctx.onBehalfOf ?? ctx.userId ?? null;
+        const isNew = cmd.from === 'new';
+        const fieldKeys = Object.keys(agg.fields);
+        let cur;
+        if (isNew) {
+            // 新建：跳过第 4、5 关，由内核生成 id 和初始版本号；输入里的同名字段预填进草稿
+            // 输入里带了 id（确定性主键，例如库存锁用采购单 id）时使用它，重复时报 CONFLICT
+            const givenId = typeof input.id === 'string' ? input.id : undefined;
+            cur = { id: givenId ?? randomUUID(), status: cmd.to, version: 0, createdAt: now.toISOString(), updatedAt: now.toISOString() };
+            for (const k of fieldKeys)
+                cur[k] = k in input ? input[k] : null;
+            if (agg.scope.deptField && agg.scope.deptField !== 'id' && cur[agg.scope.deptField] == null)
+                cur[agg.scope.deptField] = ctx.deptId;
+        }
+        else {
+            if (typeof input.id !== 'string')
+                throw cageError('INVALID_INPUT', [{ path: 'id', message: '缺少 id' }]);
+            // 第 4 关：按范围加载并加行锁；范围外和不存在一律 404
+            const loaded = await step('loadScoped', () => loadScoped(tx, agg, input.id, ctx, true));
+            if (!loaded)
+                throw cageError('NOT_FOUND');
+            cur = loaded;
+            // 第 5 关：状态守卫
+            if (!cmd.from.includes(cur.status)) {
+                throw cageError('INVALID_TRANSITION', { status: cur.status, allowed: cmd.from });
+            }
+            if (expectedVersion !== undefined && expectedVersion !== cur.version)
+                throw cageError('CONFLICT', { expected: expectedVersion, actual: cur.version });
+        }
+        // 第 6 关：硬约束
+        const meta = {
+            capability,
+            capabilitiesOf: (uid) => this.capabilitiesOf(uid, ctx.tenantId),
+            load: async (aggName, id) => {
+                const a = this.registry.aggregate(aggName);
+                return a && /^[0-9a-f-]{36}$/i.test(id) ? loadScoped(tx, a, id, ctx, false) : null;
+            },
+            catalog: () => this.catalogCaps(),
+        };
+        for (const c of cmd.constraints) {
+            const r = await c.check(cur, ctx, input, meta);
+            if (!r.ok)
+                throw new CageError('CONSTRAINT_VIOLATED', { constraint: c.name, message: r.message });
+        }
+        // 第 7 关：只注入 reads 里声明的只读仓储
+        const deps = bindReads(tx, cmd.reads, ctx);
+        // 第 8 关：调用 handler（AI 写的代码）
+        const draft = structuredClone(cur);
+        const result = await step('handler', async () => cmd.handler(draft, input, deps, Object.freeze({ now, actorUserId })));
+        if (isDomainError(result))
+            throw new CageError('DOMAIN_ERROR', result.detail, result.code);
+        const changes = { ...draft, ...(result && typeof result === 'object' ? result : {}) };
+        // 第 9 关：状态只由内核推进；创建人字段只由内核设置
+        const next = { ...cur };
+        for (const k of fieldKeys)
+            if (k in changes)
+                next[k] = changes[k] === undefined ? null : changes[k];
+        const owner = agg.scope.ownerField;
+        if (owner)
+            next[owner] = isNew ? actorUserId ?? changes[owner] ?? null : cur[owner];
+        // 保持状态的命令使用第 4 关加锁读出的状态，而不是 handler 返回值。
+        // 因此晚到的第三方回执可以更新字段，但不能把已取消的单据重新推进到已审批。
+        next.status = cmd.to ?? cur.status;
+        const record = Object.fromEntries(fieldKeys.map((k) => [k, next[k] ?? (agg.fields[k].isOptional ? null : undefined)]));
+        const valid = agg.schema.safeParse(record);
+        if (!valid.success)
+            throw cageError('INVALID_INPUT', zodIssues(valid.error));
+        // 第 10 关：不变量
+        for (const [name, fn] of Object.entries(agg.invariants)) {
+            let holds = false;
+            try {
+                holds = !!fn(next);
+            }
+            catch {
+                holds = false;
+            }
+            if (!holds)
+                throw cageError('INVARIANT_VIOLATED', { invariant: `${agg.name}.${name}` });
+        }
+        // 第 11 关：带版本号写入 + 审计 + outbox + 同事务反应，全部在一个事务里
+        const table = `${agg.table.schema}.${agg.table.name}`;
+        if (isNew) {
+            await tx
+                .insertInto(table)
+                .values({ id: next.id, tenant_id: ctx.tenantId, ...fieldsToColumns(agg, record), status: next.status, version: 1, created_at: now, updated_at: now })
+                .execute();
+            next.version = 1;
+            // 新建的数据也必须在自己的范围内（不能替别的部门建单）
+            const visible = await loadScoped(tx, agg, next.id, ctx, false);
+            if (!visible)
+                throw new CageError('CONSTRAINT_VIOLATED', { constraint: 'scope', message: '新建的数据不在你的数据范围内' });
+        }
+        else {
+            const changed = diffFields(agg, cur, next);
+            const res = await tx
+                .updateTable(table)
+                .set({ ...fieldsToColumns(agg, Object.fromEntries(changed.map((k) => [k, next[k]]))), status: next.status, version: cur.version + 1, updated_at: now })
+                .where('id', '=', cur.id)
+                .where('version', '=', cur.version)
+                .executeTakeFirst();
+            if (Number(res.numUpdatedRows) === 0)
+                throw cageError('CONFLICT');
+            next.version = cur.version + 1;
+        }
+        next.updatedAt = now.toISOString();
+        const changed = isNew ? fieldKeys.filter((k) => next[k] !== null) : diffFields(agg, cur, next);
+        await this.writeAudit(tx, {
+            tenantId: ctx.tenantId,
+            actor: ctx.actor.id,
+            actorKind: ctx.actor.kind,
+            onBehalfOf: ctx.onBehalfOf ?? null,
+            source: ctx.source,
+            kind: 'write',
+            capability,
+            command: capability,
+            aggregate: agg.name,
+            aggregateId: next.id,
+            result: 'ok',
+            diff: auditDiff(agg, isNew ? null : cur, next, changed),
+            requestId: ctx.requestId ?? null,
+            idempotencyKey: ctx.idempotencyKey ?? null,
+            client: ctx.client ?? null,
+        });
+        const events = await this.enqueueEvents(tx, cmd, next, input, ctx, isNew ? null : cur);
+        for (const ev of events) {
+            for (const { r, name } of this.registry.reactionsFor(ev.event)) {
+                if (r.tx !== 'same')
+                    continue;
+                const rin = r.map(ev.payload);
+                if (rin === null || rin === undefined)
+                    continue;
+                const rctx = systemCtx({
+                    kind: 'reaction', name, tenantId: ctx.tenantId, capabilities: [this.registry.capabilityOf(r.command)],
+                    onBehalfOf: actorUserId, requestId: ctx.requestId,
+                });
+                await this.run(tx, this.resolve(r.command), rin, rctx, depth + 1);
+            }
+        }
+        if (agg.options.grants) {
+            // 授权变化：事务提交后通知所有实例清掉上下文缓存（回滚就不会发）
+            const payload = agg.options.grants === 'self' ? String(next.id) : '*';
+            await sql `select pg_notify('cage_grants', ${payload})`.execute(tx);
+        }
+        const presented = present(agg, next, ctx);
+        await idempotency.complete(tx, idemKey, presented);
+        // 第 12 关：函数返回即提交事务；随后由 outbox 投递器异步分发事件
+        return { next, presented };
+    }
+    async enqueueEvents(tx, cmd, next, input, ctx, prev) {
+        const out = [];
+        if (cmd.emits.length === 0)
+            return out;
+        const carrier = traceCarrier();
+        for (const spec of cmd.emits) {
+            const ev = spec.event;
+            const rawPayload = spec.map ? spec.map(next, input, prev) : defaultPayload(ev, next, input);
+            const p = ev.schema.safeParse(rawPayload);
+            if (!p.success) {
+                throw new Error(`[CAGE-EVENT-001] 事件 ${ev.name} 的载荷不符合声明：${JSON.stringify(zodIssues(p.error))}`);
+            }
+            const payload = maskEventPayload(ev, p.data);
+            const row = await tx
+                .insertInto('sys.outbox')
+                .values({
+                tenant_id: ctx.tenantId,
+                event: ev.name,
+                aggregate: cmd.agg.name,
+                aggregate_id: next.id,
+                payload: JSON.stringify(payload),
+                actor: JSON.stringify({ kind: ctx.actor?.kind, id: ctx.actor?.id, userId: ctx.userId, onBehalfOf: ctx.onBehalfOf ?? null }),
+                trace: JSON.stringify(carrier),
+                request_id: ctx.requestId ?? null,
+            })
+                .returning('id')
+                .executeTakeFirstOrThrow();
+            out.push({ outboxId: Number(row.id), event: ev.name, payload });
+        }
+        await sql `select pg_notify('cage_outbox', '')`.execute(tx);
+        return out;
+    }
+    // ---------------- 审计 ----------------
+    async writeAudit(db, e) {
+        await db
+            .insertInto('sys.audit_log')
+            .values({
+            tenant_id: e.tenantId,
+            actor: e.actor,
+            actor_kind: e.actorKind,
+            on_behalf_of: e.onBehalfOf ?? null,
+            source: e.source,
+            kind: e.kind,
+            capability: e.capability ?? null,
+            command: e.command ?? null,
+            aggregate: e.aggregate ?? null,
+            aggregate_id: e.aggregateId ?? null,
+            result: e.result,
+            diff: e.diff === undefined || e.diff === null ? null : JSON.stringify(e.diff),
+            request_id: e.requestId ?? null,
+            idempotency_key: e.idempotencyKey ?? null,
+            client: e.client ? JSON.stringify(e.client) : null,
+        })
+            .execute();
+    }
+    /** 被拒绝的尝试异步记录，用于发现探测和配置问题；记录失败不影响请求 */
+    async auditDenied(rc, raw, ctx, err) {
+        try {
+            const id = raw?.id;
+            await this.writeAudit(this.app, {
+                tenantId: ctx.tenantId,
+                actor: ctx.actor?.id ?? 'anonymous',
+                actorKind: ctx.actor?.kind ?? 'anonymous',
+                onBehalfOf: ctx.onBehalfOf ?? null,
+                source: ctx.source,
+                kind: 'denied',
+                capability: rc.capability,
+                command: rc.capability,
+                aggregate: rc.cmd.agg.name,
+                aggregateId: typeof id === 'string' && /^[0-9a-f-]{36}$/i.test(id) ? id : null,
+                result: err.code,
+                diff: err.detail && typeof err.detail === 'object' ? { detail: err.detail } : null,
+                requestId: ctx.requestId ?? null,
+                client: ctx.client ?? null,
+            });
+        }
+        catch (e) {
+            this.log.warn({ err: String(e) }, '拒绝审计写入失败');
+        }
+    }
+    // ---------------- 上下文 ----------------
+    catalogCache;
+    catalogCaps() {
+        return (this.catalogCache ??= this.registry.capabilityCatalog().map((c) => c.capability));
+    }
+    async capabilitiesOf(userId, tenantId) {
+        const g = await loadUserGrants(this.app, userId, tenantId);
+        return g && g.active ? g.capabilities : new Map();
+    }
+    /** 把一个用户解析成上下文（HTTP 层会加缓存） */
+    async contextFor(userId, tenantId, extra = {}) {
+        const g = await loadUserGrants(this.app, userId, tenantId);
+        return g ? userCtx(g, extra) : null;
+    }
+    /** 审批流程身份：代表最后一位审批人调用结论命令 */
+    processCtx(opts) {
+        return systemCtx({ kind: 'process', name: opts.process, tenantId: opts.tenantId, capabilities: opts.capabilities, onBehalfOf: opts.onBehalfOf, requestId: opts.requestId });
+    }
+}
+export function createKernel(opts) {
+    return new Kernel(opts);
+}
+function splitRaw(raw) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return { rest: raw ?? {} };
+    const { expectedVersion, ...rest } = raw;
+    if (expectedVersion === undefined || expectedVersion === null)
+        return { rest };
+    const v = Number(expectedVersion);
+    if (!Number.isInteger(v))
+        throw cageError('INVALID_INPUT', [{ path: 'expectedVersion', message: '版本号必须是整数' }]);
+    return { expectedVersion: v, rest };
+}
+/** 第 3 关之一：流程专用命令只接受流程身份；用户命令可以被声明过它的系统身份调用 */
+function assertInvoker(cmd, ctx, capability) {
+    const kind = ctx.actor.kind;
+    if (kind === 'system')
+        return;
+    if (kind === 'user' || kind === 'anonymous') {
+        if (!cmd.invokedBy.includes('user')) {
+            throw cageError('FORBIDDEN', { capability, message: `该命令只接受 ${cmd.invokedBy.join('/')} 调用` });
+        }
+        return;
+    }
+    const as = kind === 'reaction' ? 'process' : kind;
+    if (!cmd.invokedBy.includes('user') && !cmd.invokedBy.includes(as)) {
+        throw cageError('FORBIDDEN', { capability, message: `${kind} 身份不能调用该命令` });
+    }
+}
+function maskEventPayload(ev, payload) {
+    const out = { ...payload };
+    for (const [k, f] of Object.entries(ev.fields)) {
+        if (f.sensitiveKind && k in out)
+            out[k] = maskValue(f.sensitiveKind, out[k]);
+        if (f.isHidden)
+            delete out[k];
+    }
+    return out;
+}
+//# sourceMappingURL=kernel.js.map

package/dist/kernel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel.js","sourceRoot":"","sources":["../src/kernel.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,oCAAoC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAE7B,OAAO,EAAE,OAAO,EAAoC,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAIxD,OAAO,EAAiB,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,aAAa,EAA+D,MAAM,eAAe,CAAC;AAC3G,OAAO,EAAE,aAAa,EAAe,IAAI,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAgDhF,SAAS,SAAS,CAAC,CAAa;IAC9B,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,OAAO,MAAM;IACR,QAAQ,CAAW;IACnB,GAAG,CAAc;IACjB,MAAM,CAAc;IACpB,IAAI,CAAW;IACf,GAAG,CAAS;IACJ,OAAO,GAAe,EAAE,CAAC;IACzB,QAAQ,CAAS;IAElC,YAAY,IAAmB;QAC7B,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;QAC7B,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC;YACzF,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,CAAC;YACxF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;IAChD,CAAC;IAED,OAAO,CAAC,GAAwB;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,mBAAmB,CAAC,CAAC;QAClH,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,uCAAuC;IAEvC,oCAAoC;IACpC,KAAK,CAAC,OAAO,CAAC,GAAwB,EAAE,GAAY,EAAE,GAAQ;QAC5D,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,CACjD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC1C,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC9C,OAAO,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC,MAA8B,CAAC,CAAC,CAAC,CAAC,CAAC,SAAU,CAAC;YACnF,CAAC,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,EAAE,CAAC,IAAI,KAAK,UAAU;gBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;YACtH,IAAI,EAAE,CAAC,IAAI,KAAK,WAAW,IAAI,EAAE,CAAC,IAAI,KAAK,WAAW,IAAI,EAAE,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBAC5F,KAAK,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,EAAE,CAAC;QACX,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,SAAS,CAAC,EAAoB,EAAE,GAAwB,EAAE,GAAY,EAAE,GAAQ,EAAE,KAAK,GAAG,CAAC;QAC/F,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,CAAwB,CAAC;IACrD,CAAC;IAED,kDAAkD;IAClD,KAAK,CAAC,YAAY,CAAC,GAAwB,EAAE,IAAe,EAAE,GAAQ,EAAE,OAA6B,EAAE;QACrG,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAQ,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;QAC9G,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,GAAG,GAAkB,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gBACpF,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;QAClB,IAAI,OAAO,GAAqB,IAAI,CAAC;QACrC,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACrC,IAAI,CAAC;wBACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;wBACnD,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;oBAC1D,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,QAAQ,GAAG,CAAC,CAAC;wBACb,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;wBACzB,MAAM,CAAC,CAAC;oBACV,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;YACH,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzB,KAAK,EAAE,CAAC;gBACR,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAE,OAAqB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE;aACvH,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,GAAG,CACf,EAAoB,EACpB,EAAqB,EACrB,GAAY,EACZ,GAAQ,EACR,KAAa;QAEb,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;QAE5F,WAAW;QACX,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAEtG,aAAa;QACb,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,SAAS,CAAC,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,IAA2B,CAAC;QAEjD,eAAe;QACf,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,MAAM,SAAS,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAEnG,wBAAwB;QACxB,MAAM,OAAO,GAAG,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,UAAU,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACtH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAElD,MAAM,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC;QACzD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC;QACjC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAgB,CAAC,CAAC;QACpD,IAAI,GAAwB,CAAC;QAE7B,IAAI,KAAK,EAAE,CAAC;YACV,6CAA6C;YAC7C,iDAAiD;YACjD,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,GAAG,GAAG,EAAE,EAAE,EAAE,OAAO,IAAI,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9H,KAAK,MAAM,CAAC,IAAI,SAAS;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACjE,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI;gBAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;QACrI,CAAC;aAAM,CAAC;YACN,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;gBAAE,MAAM,SAAS,CAAC,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YACvG,gCAAgC;YAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACxF,IAAI,CAAC,MAAM;gBAAE,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;YAC1C,GAAG,GAAG,MAAM,CAAC;YACb,aAAa;YACb,IAAI,CAAE,GAAG,CAAC,IAA0B,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1D,MAAM,SAAS,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,GAAG,CAAC,OAAO;gBAAE,MAAM,SAAS,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxJ,CAAC;QAED,YAAY;QACZ,MAAM,IAAI,GAAmB;YAC3B,UAAU;YACV,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC;YAC/D,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE;gBAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC3C,OAAO,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrF,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE;SAClC,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,MAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACpG,CAAC;QAED,2BAA2B;QAC3B,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAE3C,4BAA4B;QAC5B,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,KAAY,EAAE,KAAY,EAAE,IAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5I,IAAI,aAAa,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAwB,EAAE,GAAG,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAE3G,6BAA6B;QAC7B,MAAM,IAAI,GAAwB,EAAE,GAAG,GAAG,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,IAAI,CAAC,IAAI,OAAO;gBAAE,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACpG,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;QACnC,IAAI,KAAK;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpF,yCAAyC;QACzC,uCAAuC;QACvC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAE,GAAG,CAAC,MAAiB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACnI,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,SAAS,CAAC,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAE7E,aAAa;QACb,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,IAAI,KAAK,GAAG,KAAK,CAAC;YAClB,IAAI,CAAC;gBACH,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,IAAW,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,GAAG,KAAK,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,KAAK;gBAAE,MAAM,SAAS,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,+CAA+C;QAC/C,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACtD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,EAAE;iBACL,UAAU,CAAC,KAAK,CAAC;iBACjB,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;iBACpJ,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;YACjB,6BAA6B;YAC7B,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC/D,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/G,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,KAAK,CAAC;iBAClB,GAAG,CAAC,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;iBACtJ,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;iBACxB,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;iBAClC,gBAAgB,EAAE,CAAC;YACtB,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC;gBAAE,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;YAClE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAEnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/F,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE;YACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE;YACnB,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI;YACzB,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;YAClC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,OAAO;YACb,UAAU;YACV,OAAO,EAAE,UAAU;YACnB,SAAS,EAAE,GAAG,CAAC,IAAI;YACnB,WAAW,EAAE,IAAI,CAAC,EAAE;YACpB,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC;YACvD,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;YAChC,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;YAC1C,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;SAC3B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvF,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;YACxB,KAAK,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/D,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM;oBAAE,SAAS;gBAC9B,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,OAAc,CAAC,CAAC;gBACrC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;oBAAE,SAAS;gBAChD,MAAM,IAAI,GAAG,SAAS,CAAC;oBACrB,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;oBACrG,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS;iBAClD,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACvB,kCAAkC;YAClC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACtE,MAAM,GAAG,CAAA,mCAAmC,OAAO,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1C,MAAM,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACnD,wCAAwC;QACxC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,EAAoB,EAAE,GAAe,EAAE,IAAyB,EAAE,KAA0B,EAAE,GAAQ,EAAE,IAAgC;QAClK,MAAM,GAAG,GAAmB,EAAE,CAAC;QAC/B,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACvC,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;YACtB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC5F,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YAC1C,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC,IAAI,aAAa,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC,IAA+B,CAAC,CAAC;YACxE,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,YAAY,CAAC;iBACxB,MAAM,CAAC;gBACN,SAAS,EAAE,GAAG,CAAC,QAAQ;gBACvB,KAAK,EAAE,EAAE,CAAC,IAAI;gBACd,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI;gBACvB,YAAY,EAAE,IAAI,CAAC,EAAE;gBACrB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAChC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBAC3H,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC9B,UAAU,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;aAClC,CAAC;iBACD,SAAS,CAAC,IAAI,CAAC;iBACf,uBAAuB,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,GAAG,CAAA,qCAAqC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3D,OAAO,GAAG,CAAC;IACb,CAAC;IAED,uCAAuC;IAEvC,KAAK,CAAC,UAAU,CAAC,EAAkC,EAAE,CAAa;QAChE,MAAM,EAAE;aACL,UAAU,CAAC,eAAe,CAAC;aAC3B,MAAM,CAAC;YACN,SAAS,EAAE,CAAC,CAAC,QAAQ;YACrB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,UAAU,EAAE,CAAC,CAAC,SAAS;YACvB,YAAY,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;YAClC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;YAChC,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;YAC1B,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;YAC9B,YAAY,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;YACnC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7E,UAAU,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;YAC/B,eAAe,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;YACzC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;SACnD,CAAC;aACD,OAAO,EAAE,CAAC;IACf,CAAC;IAED,uCAAuC;IACvC,KAAK,CAAC,WAAW,CAAC,EAAqB,EAAE,GAAY,EAAE,GAAQ,EAAE,GAAc;QAC7E,IAAI,CAAC;YACH,MAAM,EAAE,GAAI,GAAW,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC9B,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,WAAW;gBACnC,SAAS,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,IAAI,WAAW;gBACzC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;gBAClC,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE,CAAC,UAAU;gBACzB,OAAO,EAAE,EAAE,CAAC,UAAU;gBACtB,SAAS,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI;gBAC1B,WAAW,EAAE,OAAO,EAAE,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;gBAC9E,MAAM,EAAE,GAAG,CAAC,IAAI;gBAChB,IAAI,EAAE,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI;gBAClF,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;gBAChC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,wCAAwC;IAEhC,YAAY,CAAY;IAChC,WAAW;QACT,OAAO,CAAC,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5F,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,QAAgB;QACnD,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;IACpD,CAAC;IAED,8BAA8B;IAC9B,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,QAAgB,EAAE,QAAsB,EAAE;QACzE,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAED,6BAA6B;IAC7B,UAAU,CAAC,IAA2G;QACpH,OAAO,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9K,CAAC;CACF;AAED,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC9C,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;IACtF,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,EAAE,GAAG,GAA8B,CAAC;IACpE,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC/E,MAAM,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAAE,MAAM,SAAS,CAAC,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAC/G,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,+CAA+C;AAC/C,SAAS,aAAa,CAAC,GAAe,EAAE,GAAQ,EAAE,UAAkB;IAClE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAM,CAAC,IAAI,CAAC;IAC7B,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO;IAC9B,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,SAAS,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAS,CAAC,EAAE,CAAC;QAC1E,MAAM,SAAS,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,IAAI,YAAY,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAY,EAAE,OAAgC;IACtE,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,MAAgB,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,IAAI,GAAG;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/mask.d.ts

@@ -0,0 +1,13 @@
+import { type AnyAggregate } from './primitives/aggregate.js';
+import type { SensitiveKind } from './primitives/fields.js';
+import type { Ctx } from './types.js';
+export declare function maskValue(kind: SensitiveKind | string, val: unknown): unknown;
+/** 能不能看某聚合某种类的明文 */
+export declare function canUnmask(ctx: Ctx | null, aggName: string, kind: string): boolean;
+/** 对外呈现快照：去掉隐藏字段；敏感字段按当前主体掩码（ctx 为 null 时一律掩码） */
+export declare function present(agg: AnyAggregate, snap: Record<string, any>, ctx: Ctx | null): Record<string, any>;
+/** 审计 diff：敏感字段掩码，隐藏字段只记录「已修改」 */
+export declare function auditDiff(agg: AnyAggregate, cur: Record<string, any> | null, next: Record<string, any>, changed: string[]): Record<string, {
+    from: unknown;
+    to: unknown;
+}>;

package/dist/mask.js

@@ -0,0 +1,62 @@
+// 内存掩码：与数据库里的 sys.mask 语义一致，用于命令响应、审计 diff、事件载荷和日志。
+import { hiddenFields, sensitiveFields } from './primitives/aggregate.js';
+export function maskValue(kind, val) {
+    if (val === null || val === undefined)
+        return val;
+    const s = String(val);
+    switch (kind) {
+        case 'phone':
+            return s.length >= 7 ? `${s.slice(0, 3)}****${s.slice(-4)}` : '****';
+        case 'idCard':
+            return s.length >= 8 ? `${s.slice(0, 4)}**********${s.slice(-4)}` : '****';
+        case 'bankCard':
+            return `**** **** **** ${s.slice(-4)}`;
+        case 'email': {
+            const at = s.indexOf('@');
+            return at > 0 ? `${s.slice(0, 1)}***${s.slice(at)}` : '******';
+        }
+        case 'name':
+            return `${s.slice(0, 1)}**`;
+        case 'address':
+            return `${s.slice(0, 6)}******`;
+        default:
+            return '******';
+    }
+}
+/** 能不能看某聚合某种类的明文 */
+export function canUnmask(ctx, aggName, kind) {
+    return !!ctx && (ctx.unmask.includes(`${aggName}.${kind}`) || ctx.unmask.includes(`*.${kind}`));
+}
+/** 对外呈现快照：去掉隐藏字段；敏感字段按当前主体掩码（ctx 为 null 时一律掩码） */
+export function present(agg, snap, ctx) {
+    const out = { ...snap };
+    for (const k of hiddenFields(agg))
+        delete out[k];
+    for (const [k, kind] of Object.entries(sensitiveFields(agg))) {
+        if (k in out && !canUnmask(ctx, agg.name, kind))
+            out[k] = maskValue(kind, out[k]);
+    }
+    delete out.tenantId;
+    return out;
+}
+/** 审计 diff：敏感字段掩码，隐藏字段只记录「已修改」 */
+export function auditDiff(agg, cur, next, changed) {
+    const sens = sensitiveFields(agg);
+    const hidden = new Set(hiddenFields(agg));
+    const diff = {};
+    for (const k of changed) {
+        if (hidden.has(k)) {
+            diff[k] = { from: '[hidden]', to: '[hidden]' };
+            continue;
+        }
+        const kind = sens[k];
+        diff[k] = {
+            from: kind ? maskValue(kind, cur?.[k]) : cur?.[k] ?? null,
+            to: kind ? maskValue(kind, next[k]) : next[k] ?? null,
+        };
+    }
+    if (!cur || cur.status !== next.status)
+        diff.status = { from: cur?.status ?? null, to: next.status };
+    return diff;
+}
+//# sourceMappingURL=mask.js.map

package/dist/mask.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mask.js","sourceRoot":"","sources":["../src/mask.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,OAAO,EAAqB,YAAY,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAI7F,MAAM,UAAU,SAAS,CAAC,IAA4B,EAAE,GAAY;IAClE,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACvE,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7E,KAAK,UAAU;YACb,OAAO,kBAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1B,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjE,CAAC;QACD,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;QAC9B,KAAK,SAAS;YACZ,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAClC;YACE,OAAO,QAAQ,CAAC;IACpB,CAAC;AACH,CAAC;AAED,oBAAoB;AACpB,MAAM,UAAU,SAAS,CAAC,GAAe,EAAE,OAAe,EAAE,IAAY;IACtE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,OAAO,CAAC,GAAiB,EAAE,IAAyB,EAAE,GAAe;IACnF,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IACjD,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kCAAkC;AAClC,MAAM,UAAU,SAAS,CAAC,GAAiB,EAAE,GAA+B,EAAE,IAAyB,EAAE,OAAiB;IACxH,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAmD,EAAE,CAAC;IAChE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,CAAC,CAAC,GAAG;YACR,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI;YACzD,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;SACtD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,IAAI,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACrG,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/org.d.ts

@@ -0,0 +1,46 @@
+import type { Kysely } from 'kysely';
+import type { CapabilityParams, Combinator, Ctx, ScopeGrant } from './types.js';
+export interface RoleGrantRow {
+    capabilities: {
+        capability: string;
+        params?: CapabilityParams;
+    }[];
+    scopes: {
+        aggregate: string;
+        combinator: Combinator;
+        deptIds?: string[];
+    }[];
+}
+/** 多角色能力取并集，数值参数（额度）取最大值 */
+export declare function mergeCaps(roles: RoleGrantRow[]): Map<string, CapabilityParams>;
+/** 多角色范围取并集：同一聚合的多个组合子用 OR 连接；deptSet 的部门合并 */
+export declare function mergeScopes(roles: RoleGrantRow[]): Record<string, ScopeGrant[]>;
+/** 能力点 X.unmask.kind → 明文权限 X.kind */
+export declare function unmaskFrom(caps: Map<string, CapabilityParams>): string[];
+export interface UserGrants {
+    userId: string;
+    tenantId: string;
+    deptId: string | null;
+    deptPath: string | null;
+    capabilities: Map<string, CapabilityParams>;
+    scopes: Record<string, ScopeGrant[]>;
+    unmask: string[];
+    active: boolean;
+}
+/** 从系统表读取一个用户的授权（内核账号） */
+export declare function loadUserGrants(db: Kysely<any>, userId: string, tenantId: string): Promise<UserGrants | null>;
+/** 用户上下文：禁用的用户没有任何能力 */
+export declare function userCtx(g: UserGrants, extra?: Partial<Ctx>): Ctx;
+export declare function anonymousCtx(tenantId: string, extra?: Partial<Ctx>): Ctx;
+/**
+ * 系统身份上下文：能力只包含它声明过的命令；范围为全部（仍受租户约束）。
+ * 审批流程、定时任务、入站回调、反应各自用它。
+ */
+export declare function systemCtx(opts: {
+    kind: 'process' | 'job' | 'external' | 'reaction' | 'system';
+    name: string;
+    tenantId: string;
+    capabilities: string[];
+    onBehalfOf?: string | null;
+    requestId?: string;
+}): Ctx;