guanwei 1.2.6 → 1.3.0

package/server/src/index.ts

@@ -53,22 +53,38 @@ const PORT = process.env.PORT || 3018;
 app.use(cors());
 app.use(express.json());
 
-// ─── AI 接口限流（防 BYOK Key 被刷爆）：per-IP 令牌桶 ───
-const AI_RATE_LIMIT = { windowMs: 60_000, max: 30 };  // 每分钟 30 次（本地单用户无感，公网防刷）
-const aiHits = new Map<string, { count: number; resetAt: number }>();
-app.use('/api/ai', (req, res, next) => {
-  const ip = req.ip || req.socket.remoteAddress || 'unknown';
+// ─── 限流（防 BYOK Key 被刷爆 / 无限建占刷库）：per-IP 令牌桶 ───
+// /api/ai：每分钟 30 次（AI 烧 token，重点防护）
+// /api/divine 写：每分钟 60 次（防无限建占刷 SQLite）
+const AI_RATE_LIMIT = { windowMs: 60_000, max: 30 };
+const DIVINE_RATE_LIMIT = { windowMs: 60_000, max: 60 };
+const hits = new Map<string, { count: number; resetAt: number }>();
+// 定期清理过期桶（防内存泄漏，M-NEW3）
+setInterval(() => {
   const now = Date.now();
-  const rec = aiHits.get(ip);
-  if (!rec || now > rec.resetAt) {
-    aiHits.set(ip, { count: 1, resetAt: now + AI_RATE_LIMIT.windowMs });
-    return next();
-  }
-  rec.count++;
-  if (rec.count > AI_RATE_LIMIT.max) {
-    return res.status(429).json({ error: 'AI_RATE_LIMITED', message: '请求过于频繁，请稍后再试' });
-  }
-  next();
+  for (const [k, v] of hits) if (now > v.resetAt) hits.delete(k);
+}, 10 * 60 * 1000).unref();
+
+function rateLimit(limit: { windowMs: number; max: number }) {
+  return (req: any, res: any, next: any) => {
+    const ip = req.ip || req.socket.remoteAddress || 'unknown';
+    const now = Date.now();
+    const rec = hits.get(ip);
+    if (!rec || now > rec.resetAt) {
+      hits.set(ip, { count: 1, resetAt: now + limit.windowMs });
+      return next();
+    }
+    rec.count++;
+    if (rec.count > limit.max) {
+      return res.status(429).json({ error: 'RATE_LIMITED', message: '请求过于频繁，请稍后再试' });
+    }
+    next();
+  };
+}
+app.use('/api/ai', rateLimit(AI_RATE_LIMIT));
+app.use('/api/divine', (req, res, next) => {
+  if (req.method === 'GET') return next();  // 读操作不限制
+  return rateLimit(DIVINE_RATE_LIMIT)(req, res, next);
 });
 
 // 请求日志（联调排查用）

package/server/src/routes/ai.ts

@@ -8,6 +8,8 @@ import { buildMessages, buildReportMessages, buildStep1Messages, buildStep2Messa
 import { chatOnce, chatStream, activeProvider, providerStatus, lastFinishReason } from '../services/llmProvider.js';
 import { getDivination, attachReport, markAiFailed } from '../services/divineStore.js';
 import { verifyRelatives, fixFamilyRelatives } from '../services/relativesCheck.js';
+import { orchestrateZiweiDeep } from '../services/orchestrator.js';
+import { MINGPAN_TEMPLATE } from '../services/promptBuilder.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -22,6 +24,20 @@ function authedUsername(req: any): string | null {
   } catch { return null; }
 }
 
+
+// 解读归属校验（与 divine.resolveOwner 同策略）：正式账号须本人 token，占位账号兼容无 token
+function canReadChart(req: any, recUsername: string, fallbackUsername: string): boolean {
+  const authed = authedUsername(req);
+  if (authed) return authed === recUsername;
+  // 无 token：仅当目标是占位账号（未正式注册）时允许 fallback username
+  if (fallbackUsername && fallbackUsername !== recUsername) return false;
+  try {
+    const db = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'data', 'db.json'), 'utf-8'));
+    const user = db.users.find((u: any) => u.username === recUsername);
+    return !user || !user.passHash;  // 占位账号放行
+  } catch { return true; }
+}
+
 // 非流式：token 优先归属
 const router = Router();
 
@@ -32,7 +48,7 @@ router.get('/providers', (_req, res) => {
 
 // 非流式解读（保底通道）
 router.post('/interpret', async (req, res) => {
-  const { artId, question, divineId, semantic, profile, report, fit, username } = req.body;
+  const { artId, question, divineId, semantic, profile, report, fit, username, orchestrate } = req.body;
   if (!artId) return res.status(400).json({ error: '缺少必要参数' });
   try {
     // 从 SQLite 读排盘数据（v6：不再信任前端直传 resultRaw）
@@ -41,13 +57,29 @@ router.post('/interpret', async (req, res) => {
     if (divineId) {
       const rec = getDivination(divineId);
       if (!rec) return res.status(400).json({ error: 'DIVINE_NOT_FOUND', message: '起占记录不存在，请重新起占' });
-      const authed = authedUsername(req);
-      if (authed ? authed !== rec.username : (username && rec.username !== username)) return res.status(403).json({ error: 'FORBIDDEN' });
+      if (!canReadChart(req, rec.username, String(username || ''))) return res.status(403).json({ error: 'FORBIDDEN' });
       resultRaw = rec.resultRaw;
       recProfile = rec.profile;
     } else {
       return res.status(400).json({ error: 'DIVINE_REQUIRED', message: '请先起占（divineId 缺失）' });
     }
+    // 真·多 Agent 编排模式（v1：紫微深度三步链式）
+    if (orchestrate === 'ziwei-deep' && artId === 'ziwei') {
+      const { full } = await orchestrateZiweiDeep(resultRaw, question, MINGPAN_TEMPLATE, (recProfile as any)?.gender || (profile as any)?.gender);
+      const parsed2 = parseReport(full, 'mingpan');
+      const relErrs2 = verifyRelatives('ziwei', resultRaw, parsed2);
+      if (relErrs2.length && relErrs2.length <= 6) {
+        console.warn('[ai] 六亲表述矛盾，定向修正:', relErrs2.join('；'));
+        const fixed2 = await fixFamilyRelatives('ziwei', resultRaw, parsed2, relErrs2);
+        if (fixed2) parsed2.family = fixed2 as any;
+      }
+      if (parsed2.quality === 'ok') {
+        attachReport(divineId, parsed2, 'ok');
+        return res.json({ provider: activeProvider()?.id, report: parsed2, sections: parseSections(full), orchestrated: true });
+      }
+      markAiFailed(divineId, 'ziwei', 'mingpan', '编排质量未达标', full.slice(0, 4000));
+      return res.status(502).json({ error: 'AI_REPORT_INVALID', message: 'AI 输出不符合报告结构，请重试' });
+    }
     // 统一报告模式：两步管线（Step1 盘面解析 → Step2 深度报告），Step1 失败降级单步
     const kind = ['bazi', 'ziwei', 'astrology'].includes(artId) ? 'mingpan' : 'zhanwen';
     let step1Text = '';
@@ -106,8 +138,7 @@ router.post('/interpret/stream', async (req, res) => {
     res.status(400).json({ error: 'DIVINE_NOT_FOUND', message: '起占记录不存在，请重新起占' });
     return;
   }
-  const authed = authedUsername(req);
-  if (authed ? authed !== rec.username : (username && rec.username !== username)) {
+  if (!canReadChart(req, rec.username, String(username || ''))) {
     res.status(403).json({ error: 'FORBIDDEN' });
     return;
   }

package/server/src/routes/divine.ts

@@ -1,15 +1,6 @@
 // 排盘路由：登录用户起占 → 后端引擎计算 → SQLite 入库 → 返回 resultRaw + display
 import { Router } from 'express';
-import { baziCalc } from '../../../shared/core/engine/bazi.js';
-import { ziweiCalc } from '../../../shared/core/engine/ziwei.js';
-import { astrologyCalc } from '../../../shared/core/engine/astrology.js';
-import { qimenCalc } from '../../../shared/core/engine/qimen.js';
-import { meihuaCalc } from '../../../shared/core/engine/meihua.js';
-import { liuyaoCalc } from '../../../shared/core/engine/liuyao.js';
-import { liurenCalc } from '../../../shared/core/engine/liuren.js';
-import { xiaoliurenCalc } from '../../../shared/core/engine/xiaoliuren.js';
-import { tarotDraw } from '../../../shared/core/engine/tarot.js';
-import { allTarotSpreads } from '../../../shared/core/data/tarotSpreads.js';
+import { chartCalc } from '../../../shared/core/engine/chart.js';
 import { createDivination, listDivinations, getDivination, deleteDivination } from '../services/divineStore.js';
 import fs from 'fs';
 import path from 'path';
@@ -23,20 +14,21 @@ const router = Router();
 const MINGPAN_ARTS = ['bazi', 'ziwei', 'astrology'];
 
 // 宽松建档：前端本地注册的用户在此同步建档（与 users.ts upsert 同策略；建档即发 claimToken 防抢占）
-function ensureUser(username: string): boolean {
-  if (!username || typeof username !== 'string') return false;
+// 返回 null=失败；否则 { existed: 是否已存在, claimToken: 该账号当前 token（新建时返回，供前端保存用于后续注册升级）}
+function ensureUser(username: string): { existed: boolean; claimToken: string } | null {
+  if (!username || typeof username !== 'string') return null;
   try {
     const db = JSON.parse(fs.readFileSync(DB_FILE, 'utf-8'));
     const exist = db.users.find((u: any) => u.username === username);
-    if (exist) return true;
+    if (exist) return { existed: true, claimToken: exist.token || '' };
     const token = crypto.randomBytes(32).toString('hex');
-    db.users.push({ username, passHash: '', createdAt: Date.now(), profile: {}, samples: [], records: [], token });
+    db.users.push({ username, passHash: '', createdAt: Date.now(), profile: {}, samples: [], records: [], token, tokenExpires: Date.now() + 30 * 24 * 3600 * 1000 });
     fs.writeFileSync(DB_FILE, JSON.stringify(db, null, 2));
     console.log('[divine] 自动建档:', username);
-    return true;
+    return { existed: false, claimToken: token };
   } catch (e: any) {
     console.error('[divine] ensureUser 异常:', e?.message || e);
-    return false;
+    return null;
   }
 }
 
@@ -51,110 +43,97 @@ function authedUsername(req: any): string | null {
   } catch { return null; }
 }
 
+// 归属校验统一入口：
+// - 带有效 token → 以 token 用户为准（堵自报 username 越权）
+// - 无 token：
+//   · 目标为占位账号（passHash 空，自动建档/未正式注册）→ 允许（本地单机流程）
+//   · 目标为正式账号（注册过，passHash 非空）→ 401（必须持本人 token，H-NEW1~3）
+// 返回 { owner, isPlaceholder }；null = 校验失败（已 res 响应）
+function resolveOwner(req: any, res: any, fallbackUsername: string): { owner: string; isPlaceholder: boolean } | null {
+  const authed = authedUsername(req);
+  let owner = authed || String(fallbackUsername || '');
+  if (!owner) { res.status(401).json({ error: 'UNAUTHORIZED', message: '请先入馆（登录）' }); return null; }
+  let user: any = null;
+  try {
+    const db = JSON.parse(fs.readFileSync(DB_FILE, 'utf-8'));
+    user = db.users.find((u: any) => u.username === owner) || null;
+  } catch { /* 读失败按占位处理 */ }
+  const isPlaceholder = !user || !user.passHash;
+  if (!authed && !isPlaceholder) {
+    // 无 token 但目标是正式账号 → 拒绝（防自报他人 username 越权）
+    res.status(401).json({ error: 'AUTH_REQUIRED', message: '请先入馆（登录）后操作' });
+    return null;
+  }
+  return { owner, isPlaceholder };
+}
+
 // POST /api/divine —— 起占入库
 router.post('/', (req, res) => {
   const { artId, inputs, profile, question, username, profileId } = req.body || {};
-  const authed = authedUsername(req);
-  const owner = authed || String(username || '');  // 有 token 以 token 为准，防自报他人名
-  // 游客不允许
-  if (!ensureUser(owner)) {
+  const resolved = resolveOwner(req, res, String(username || ''));
+  if (!resolved) return;
+  const owner = resolved.owner;
+  const ensured = ensureUser(owner);
+  if (!ensured) {
     return res.status(401).json({ error: 'UNAUTHORIZED', message: '请先入馆（登录）再起占' });
   }
+  const claimToken = ensured.claimToken;  // 新建占位账号时返回，供前端保存（L-NEW1）
   if (!artId || !inputs) return res.status(400).json({ error: '缺少必要参数' });
 
   let resultRaw: unknown;
   try {
-    switch (artId) {
-      case 'bazi': {
-        const i = inputs as any;
-        resultRaw = baziCalc({ y: i.y, m: i.m, d: i.d, hourIndex: i.hourIndex, time: i.time, gender: i.gender, location: i.location });
-        break;
-      }
-      case 'ziwei': {
-        const i = inputs as any;
-        resultRaw = ziweiCalc({ ganzhi: i.ganzhi, month: i.month, day: i.day, hour: i.hour, time: i.time, location: i.location, gender: i.gender, birthYear: i.birthYear });
-        break;
-      }
-      case 'astrology': {
-        const i = inputs as any;
-        resultRaw = astrologyCalc(i.y, i.m, i.d, i.hour || 0, i.min || 0, i.lng, i.lat);
-        break;
-      }
-      case 'qimen': {
-        resultRaw = qimenCalc({ datetime: (inputs as any).datetime || new Date() });
-        break;
-      }
-      case 'meihua': {
-        const i = inputs as any;
-        resultRaw = meihuaCalc({ mode: i.mode || 'time', n1: i.n1, n2: i.n2, n3: i.n3, now: i.now ? new Date(i.now) : undefined });
-        break;
-      }
-      case 'liuyao': {
-        const now = new Date();
-        resultRaw = liuyaoCalc(undefined, { y: now.getFullYear(), m: now.getMonth() + 1, d: now.getDate() });
-        break;
-      }
-      case 'liuren': {
-        resultRaw = liurenCalc((inputs as any).datetime || new Date());
-        break;
-      }
-      case 'xiaoliuren': {
-        const i = inputs as any;
-        resultRaw = xiaoliurenCalc(i.mode || 'time', i.m, i.d, i.h, i.n1, i.n2, i.n3);
-        break;
-      }
-      case 'tarot': {
-        const i = inputs as any;
-        const cards = tarotDraw(Math.max(1, i.n || 3));
-        const spread = allTarotSpreads().find((s: any) => s.id === i.spread) || allTarotSpreads()[0];
-        resultRaw = { spread: spread || { id: 'three', name: '圣三角', description: '', positions: [] }, cards };
-        break;
-      }
-      default:
-        return res.status(400).json({ error: '术无此名' });
-    }
+    resultRaw = chartCalc(artId, inputs);
   } catch (e: any) {
+    if (e?.message?.includes('术无此名')) return res.status(400).json({ error: '术无此名' });
     console.error('[divine] 推演异常:', e);
     return res.status(500).json({ error: 'DIVINE_FAILED', message: '推演未应机' });
   }
 
   const kind = MINGPAN_ARTS.includes(artId) ? 'mingpan' : 'zhanwen';
   const rec = createDivination({
-    username, artId, kind,
+    username: owner, artId, kind,
     question: question || undefined,
     profileId: profileId || 'main',
     profile: profile || undefined,
     params: inputs,
     resultRaw,
   });
-  res.json({ ok: true, divineId: rec.id, resultRaw, display: rec.display });
+  const authed = authedUsername(req);
+  res.json({
+    ok: true, divineId: rec.id, resultRaw, display: rec.display,
+    // L-NEW1：请求未带 token（本地占位流程）→ 返回 claimToken，前端保存后注册可升级；带 token 则无需
+    claimToken: authed ? undefined : ensured.claimToken,
+  });
 });
 
-// GET /api/divine?username=&page=&pageSize= —— 占卜历史
+// GET /api/divine?username=&page=&pageSize= —— 占卜历史（H-NEW2：正式账号须本人 token）
 router.get('/', (req, res) => {
   const username = String(req.query.username || '');
   const page = Number(req.query.page || 1);
   const pageSize = Number(req.query.pageSize || 20);
-  if (!ensureUser(username)) return res.status(401).json({ error: 'UNAUTHORIZED' });
-  res.json(listDivinations(username, page, pageSize, String(req.query.profileId || '')));
+  const resolved = resolveOwner(req, res, username);
+  if (!resolved) return;
+  if (!ensureUser(resolved.owner)) return res.status(401).json({ error: 'UNAUTHORIZED' });
+  res.json(listDivinations(resolved.owner, page, pageSize, String(req.query.profileId || '')));
 });
 
-// GET /api/divine/:id —— 详情（排盘 + AI 报告）
+// GET /api/divine/:id —— 详情（排盘 + AI 报告；正式账号须本人 token）
 router.get('/:id', (req, res) => {
   const rec = getDivination(req.params.id);
   if (!rec) return res.status(404).json({ error: 'DIVINE_NOT_FOUND' });
-  // 归属校验：token 优先；无 token 时 query username 必须与记录一致（向后兼容本地旧前端）
-  const authed = authedUsername(req);
-  if (authed ? authed !== rec.username : String(req.query.username || '') !== rec.username) {
-    return res.status(403).json({ error: 'FORBIDDEN' });
-  }
+  // 归属校验：token 优先；无 token 仅占位账号可经 query username 访问
+  const resolved = resolveOwner(req, res, String(req.query.username || ''));
+  if (!resolved) return;
+  if (resolved.owner !== rec.username) return res.status(403).json({ error: 'FORBIDDEN' });
   res.json({ ...rec, resultRaw: rec.resultRaw, display: rec.display, report: rec.report || null });
 });
 
-// DELETE /api/divine/:id?username= —— 删除（校验归属）
+// DELETE /api/divine/:id?username= —— 删除（H-NEW3：正式账号须本人 token）
 router.delete('/:id', (req, res) => {
   const username = String(req.query.username || '');
-  const ok = deleteDivination(req.params.id, username);
+  const resolved = resolveOwner(req, res, username);
+  if (!resolved) return;
+  const ok = deleteDivination(req.params.id, resolved.owner);
   if (!ok) return res.status(404).json({ error: 'DIVINE_NOT_FOUND' });
   res.json({ ok: true });
 });

package/server/src/routes/users.ts

@@ -23,6 +23,8 @@ interface DbUser {
   records: Record<string, unknown>[];
   /** 登录态 token（注册/登录时签发，云同步写接口须携带校验归属） */
   token?: string;
+  /** token 过期时间（ms；30 天滚动，登录时轮换续期） */
+  tokenExpires?: number;
 }
 
 interface Db { users: DbUser[] }
@@ -47,13 +49,15 @@ async function hashPassword(pw: string): Promise<string> {
   return 'scrypt$' + salt.toString('hex') + '$' + key.toString('hex');
 }
 
-// 登录态 token：随机 32 字节 hex；写接口（profile/records/samples）须携带且归属匹配
+const TOKEN_TTL = 30 * 24 * 3600 * 1000;  // 30 天
+
 function newToken(): string {
   return crypto.randomBytes(32).toString('hex');
 }
 
 function tokenMatches(user: DbUser, token: string | undefined): boolean {
   if (!token || !user.token) return false;
+  if (user.tokenExpires && Date.now() > user.tokenExpires) return false;  // 过期即失效
   // 恒时比较，防时序侧信道
   const a = Buffer.from(token), b = Buffer.from(user.token);
   return a.length === b.length && crypto.timingSafeEqual(a, b);
@@ -84,7 +88,7 @@ function upsertUser(username: string): DbUser {
   const db = loadDb();
   let user = db.users.find((x: any) => x.username === username);
   if (!user) {
-    user = { username, passHash: '', createdAt: Date.now(), profile: {}, samples: [], records: [], token: newToken() };
+    user = { username, passHash: '', createdAt: Date.now(), profile: {}, samples: [], records: [], token: newToken(), tokenExpires: Date.now() + TOKEN_TTL };
     db.users.push(user);
     saveDb(db);
     console.log(`[users] 自动建档: ${username}`);
@@ -108,13 +112,14 @@ router.post('/register', async (req, res) => {
       }
       existing.passHash = await hashPassword(String(password));
       existing.token = newToken();
+      existing.tokenExpires = Date.now() + TOKEN_TTL;
       if (profile) existing.profile = { ...existing.profile, ...profile };
       saveDb(db);
       return res.json({ ok: true, upgraded: true, token: existing.token, user: { username: existing.username, profile: existing.profile, samples: existing.samples } });
     }
     return res.status(400).json({ error: '此名号已有人用' });
   }
-  const user: DbUser = { username: name, passHash: await hashPassword(String(password)), createdAt: Date.now(), profile: profile || {}, samples: [], records: [], token: newToken() };
+  const user: DbUser = { username: name, passHash: await hashPassword(String(password)), createdAt: Date.now(), profile: profile || {}, samples: [], records: [], token: newToken(), tokenExpires: Date.now() + TOKEN_TTL };
   db.users.push(user);
   saveDb(db);
   res.json({ ok: true, token: user.token, user: { username: user.username, profile: user.profile, samples: user.samples } });
@@ -134,6 +139,10 @@ router.post('/login', async (req, res) => {
     saveDb(db);
     console.log(`[users] 密码哈希已升级为 scrypt: ${user.username}`);
   }
+  // 登录成功 → 轮换 token（旧 token 即失效；防泄露长期有效）
+  user.token = newToken();
+  user.tokenExpires = Date.now() + TOKEN_TTL;
+  saveDb(db);
   res.json({ ok: true, token: user.token, user: { username: user.username, profile: user.profile, samples: user.samples } });
 });
 

package/server/src/services/orchestrator.ts

@@ -0,0 +1,106 @@
+// 真·多 Agent 编排 v1（guanwei-pro 雏形）：
+// 命盘类分步链式推理——Step A 结构解构 → Step B 宫位/星曜专题 → Step C 汇总成报告
+// 与单轮/两步管线区别：每一步独立 LLM 调用、上一步输出作为下一步唯一事实源，步间事实约束
+// 设计：每步 prompt 短而聚焦（降低单次输出幻觉面），关键事实链（chartBrief 十二宫清单）全程逐字引用
+import { chartBrief } from './chartBrief.js';
+import { duanyuPromptBlock } from './duanyu.js';
+import { chatOnce } from './llmProvider.js';
+import { nowFact } from './promptBuilder.js';
+
+export type OrchestrateMode = 'off' | 'ziwei-deep';
+
+// 每步输出 ≤ 400 字的事实性专题，不做人生论断（论断集中在最后汇总步）
+function stepMessages(agentName: string, step: string, brief: string, prior: string[], question?: string): { role: string; content: string }[] {
+  const priorBlock = prior.length
+    ? prior.map((p, i) => `【上一步结论 ${i + 1}】${p}`).join('\n')
+    : '（本步为首步）';
+  const system = [
+    '你是一位' + agentName + '，负责紫微斗数分步推理中的一个环节。',
+    '【最高约束】所有盘面事实（宫位/主星/辅星/四化/亮度）必须逐字引用下方【盘面事实】，不得推算、不得编造。',
+    '【本步任务】' + step,
+    '【输出】只输出一个 JSON 对象 {"points": ["要点1", "要点2", ...]}（3-6 条，每条 ≤80 字，只陈述盘面结构与通义，不做人生论断）。',
+  ].join('\n');
+  const user = [
+    question ? '【所问】' + question + '（仅作背景，本步不回答）' : '',
+    '【盘面事实（不可更改）】',
+    brief,
+    '',
+    nowFact(),
+    '',
+    priorBlock,
+    '',
+    '请输出本步 JSON。',
+  ].filter(Boolean).join('\n');
+  return [
+    { role: 'system', content: system },
+    { role: 'user', content: user },
+  ];
+}
+
+function parsePoints(text: string): string[] {
+  try {
+    const obj = JSON.parse(text);
+    if (Array.isArray(obj.points)) return obj.points.map(String);
+  } catch { /* 非 JSON 时按行切 */ }
+  return text.split('\n').map(l => l.trim()).filter(l => l && !l.startsWith('{') && !l.startsWith('}')).slice(0, 8);
+}
+
+// 汇总步：把前面各步要点 + 盘面事实汇总成完整解读
+function finalMessages(agentName: string, artName: string, schemaTemplate: string, brief: string, steps: string[], question?: string, gender?: string): { role: string; content: string }[] {
+  const stepBlock = steps.map((s, i) => `【分步推演 ${i + 1}】${s}`).join('\n\n');
+  const system = [
+    '你是一位' + agentName + '。',
+    '【任务】基于下面给出的【盘面事实】与【分步推演结论】，生成完整解读报告（JSON）。',
+    '【盘面事实一致性 · 最高约束】所有盘面事实必须与【盘面事实】逐字一致，不得编造或自行推算；六亲/宫位论断须注明盘面依据。',
+    '【质量】内容充实、具体到场景与行为；不作绝对化断言；结尾附免责声明。',
+    '【输出 Schema（字段名不可更改）】' + schemaTemplate,
+  ].join('\n');
+  const user = [
+    '【性别语境】' + (gender || '未录'),
+    question ? '【所问之事】' + question : '',
+    '【盘面事实（不可更改）】',
+    brief,
+    '',
+    stepBlock,
+    '',
+    '请输出完整解读报告 JSON。',
+  ].filter(Boolean).join('\n');
+  return [
+    { role: 'system', content: system },
+    { role: 'user', content: user },
+  ];
+}
+
+/**
+ * 紫微深度编排：三步独立推理后汇总。
+ * 返回 { full, steps }（full 为最终报告文本；steps 为各步要点便于调试/审计）
+ */
+export async function orchestrateZiweiDeep(
+  resultRaw: unknown,
+  question: string | undefined,
+  schemaTemplate: string,
+  gender?: string,
+): Promise<{ full: string; steps: string[] }> {
+  const brief = chartBrief('ziwei', resultRaw);
+  const duanyu = duanyuPromptBlock('ziwei', resultRaw);
+  const steps: string[] = [];
+
+  const STEPS = [
+    '解构命盘骨架：命宫地支/五行局/紫微落宫/身宫/生年四化/主星布局格局，提炼盘的总体气质。',
+    '专题拆解：依十二宫主题（命/兄弟/夫妻/子女/财帛/疾厄/迁移/交友/官禄/田宅/福德/父母）逐宫提炼其星曜组合的侧重，命宫重点。',
+    '行运推演：结合当前大限（年龄段/宫位/主星）与流年宫位，提炼行运主题与关键节点。',
+  ];
+  const prior: string[] = [];
+  for (const [i, step] of STEPS.entries()) {
+    const msgs = stepMessages('紫微斗数专家', step, brief, prior, question);
+    const text = await chatOnce(msgs as any);
+    const pts = parsePoints(text);
+    prior.push(pts.join('；'));
+    steps.push(pts.join('；'));
+    console.log(`[orchestrator] Step ${i + 1} 完成（${pts.length} 要点）`);
+  }
+  // 汇总步：含断语引证
+  const finalSys = finalMessages('紫微斗数专家', '紫微斗数', schemaTemplate, brief + (duanyu ? '\n' + duanyu : ''), prior, question, gender);
+  const full = await chatOnce(finalSys as any);
+  return { full, steps };
+}

package/server/src/services/promptBuilder.ts

@@ -53,7 +53,7 @@ const ZHANWEN_SAMPLE = {
   disclaimer: '免责声明',
   suitability: { suitable: true, note: '适问性说明 2-3 句', suggestion: '换问建议或无' },
 };
-const MINGPAN_TEMPLATE = JSON.stringify(MINGPAN_SAMPLE, null, 2);
+export const MINGPAN_TEMPLATE = JSON.stringify(MINGPAN_SAMPLE, null, 2);
 const ZHANWEN_TEMPLATE = JSON.stringify(ZHANWEN_SAMPLE, null, 2);
 const MINGPAN_ARTS = ['bazi', 'ziwei', 'astrology'];
 
@@ -80,7 +80,7 @@ function hourUnknownNote(profile?: unknown): string {
 
 // 命主已知人生经历 → 解读校准注入（报告须呼应该年份事件、不得与其矛盾）
 // 当前公历时间事实：注入给 AI，防止其自行推算年份（占问类无出生档案，AI 不知道"现在是哪年"）
-function nowFact(): string {
+export function nowFact(): string {
   const d = new Date();
   const p = (n: number) => String(n).padStart(2, '0');
   const week = '日一二三四五六'[d.getDay()];

package/shared/core/engine/chart.ts

@@ -0,0 +1,76 @@
+// 九术排盘统一调度：artId + inputs → resultRaw
+// 唯一算法副本（divine 路由 / packages/guanwei-api / MCP / 未来托管共用，禁止各层另写 switch）
+import { baziCalc } from './bazi.js';
+import { ziweiCalc } from './ziwei.js';
+import { astrologyCalc } from './astrology.js';
+import { qimenCalc } from './qimen.js';
+import { meihuaCalc } from './meihua.js';
+import { liuyaoCalc } from './liuyao.js';
+import { liurenCalc } from './liuren.js';
+import { xiaoliurenCalc } from './xiaoliuren.js';
+import { tarotDraw } from './tarot.js';
+import { allTarotSpreads } from '../data/tarotSpreads.js';
+
+export const CHART_ARTS = ['bazi', 'ziwei', 'astrology', 'qimen', 'meihua', 'liuyao', 'liuren', 'xiaoliuren', 'tarot'] as const;
+export type ChartArtId = typeof CHART_ARTS[number];
+
+/**
+ * 九术排盘（纯函数）：artId + inputs → resultRaw
+ * 抛错：未知术名 / 输入不合法 → Error（调用方转 400）
+ */
+export function chartCalc(artId: string, inputs: any): unknown {
+  switch (artId) {
+    case 'bazi': {
+      const i = inputs || {};
+      if (i.y == null || i.m == null || i.d == null) throw new Error('BaziInput 需 y/m/d');
+      return baziCalc({ y: i.y, m: i.m, d: i.d, hourIndex: i.hourIndex, time: i.time, gender: i.gender, location: i.location });
+    }
+    case 'ziwei': {
+      const i = inputs || {};
+      return ziweiCalc({ ganzhi: i.ganzhi, month: i.month, day: i.day, hour: i.hour, time: i.time, location: i.location, gender: i.gender, birthYear: i.birthYear });
+    }
+    case 'astrology': {
+      const i = inputs || {};
+      return astrologyCalc(i.y, i.m, i.d, i.hour || 0, i.min || 0, i.lng, i.lat);
+    }
+    case 'qimen': {
+      return qimenCalc({ datetime: inputs?.datetime ? new Date(inputs.datetime) : new Date() });
+    }
+    case 'meihua': {
+      const i = inputs || {};
+      return meihuaCalc({ mode: i.mode || 'time', n1: i.n1, n2: i.n2, n3: i.n3, now: i.now ? new Date(i.now) : undefined });
+    }
+    case 'liuyao': {
+      const now = new Date();
+      return liuyaoCalc(undefined, { y: now.getFullYear(), m: now.getMonth() + 1, d: now.getDate() });
+    }
+    case 'liuren': {
+      return liurenCalc(inputs?.datetime ? new Date(inputs.datetime) : new Date());
+    }
+    case 'xiaoliuren': {
+      const i = inputs || {};
+      return xiaoliurenCalc(i.mode || 'time', i.m, i.d, i.h, i.n1, i.n2, i.n3);
+    }
+    case 'tarot': {
+      const i = inputs || {};
+      const cards = tarotDraw(Math.max(1, i.n || 3));
+      const spread = allTarotSpreads().find((s: any) => s.id === i.spread) || allTarotSpreads()[0];
+      return { spread: spread || { id: 'three', name: '圣三角', description: '', positions: [] }, cards };
+    }
+    default:
+      throw new Error('术无此名: ' + artId);
+  }
+}
+
+/** 每术输入参数说明（/v1/arts 能力清单用） */
+export const CHART_INPUT_SCHEMA: Record<string, Record<string, string>> = {
+  bazi: { y: '公历年', m: '公历月', d: '公历日', hourIndex: '时辰 0-11（0=子）', gender: '男/女', location: '{lng,lat,province,city,district}' },
+  ziwei: { ganzhi: '年干支', month: '农历月', day: '农历日', hour: '时辰 0-11', gender: '男/女', location: '{lng,lat}' },
+  astrology: { y: '公历年', m: '月', d: '日', hour: '时 0-23', min: '分', lng: '经度', lat: '纬度' },
+  qimen: { datetime: '起局时刻 ISO 字符串' },
+  meihua: { mode: 'time|number', n1: '报数1', n2: '报数2', n3: '报数3' },
+  liuyao: {},
+  liuren: { datetime: '起课时刻 ISO 字符串' },
+  xiaoliuren: { mode: 'time', m: '农历月', d: '农历日', h: '时辰 0-11' },
+  tarot: { n: '抽牌数（默认3）', spread: '牌阵 id' },
+};