hunter-mate 0.1.7 → 0.1.11

package/dist/assets/server/governance/governance.ingester.js

@@ -0,0 +1,117 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var GovernanceIngester_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GovernanceIngester = exports.DERIVABLE_ACTIONS = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const recording_event_bus_service_1 = require("../recording/recording-event-bus.service");
+const action_audit_entity_1 = require("./action-audit.entity");
+const governance_service_1 = require("./governance.service");
+exports.DERIVABLE_ACTIONS = new Set([
+    'profile_view',
+    'search_run',
+    'invite',
+    'note_invite',
+    'page_scroll',
+]);
+const MAX_SESSION_MEMORY = 5000;
+let GovernanceIngester = GovernanceIngester_1 = class GovernanceIngester {
+    eventBus;
+    governanceService;
+    auditRepo;
+    logger = new common_1.Logger(GovernanceIngester_1.name);
+    lastUrlBySession = new Map();
+    constructor(eventBus, governanceService, auditRepo) {
+        this.eventBus = eventBus;
+        this.governanceService = governanceService;
+        this.auditRepo = auditRepo;
+    }
+    onModuleInit() {
+        this.eventBus.on('recording.events.persisted', (evt) => {
+            this.ingest(evt.entities).catch((err) => {
+                this.logger.warn(`governance ingest 失败: ${err?.message || err}`);
+            });
+        });
+    }
+    async ingest(events) {
+        let derived = 0;
+        for (const e of events) {
+            if (!e.sourceUrl)
+                continue;
+            const last = this.lastUrlBySession.get(e.sessionId);
+            if (last === e.sourceUrl)
+                continue;
+            this.setLastUrl(e.sessionId, e.sourceUrl);
+            let url;
+            try {
+                url = new URL(e.sourceUrl);
+            }
+            catch {
+                continue;
+            }
+            const host = url.hostname.toLowerCase();
+            const profile = this.governanceService.loadProfile(host);
+            if (!profile?.account_type)
+                continue;
+            const rules = this.governanceService.loadActionDerivation(host);
+            if (!rules)
+                continue;
+            const target = `${url.pathname}${url.search}`;
+            for (const rule of rules) {
+                if (!exports.DERIVABLE_ACTIONS.has(rule.action))
+                    continue;
+                let re;
+                try {
+                    re = new RegExp(rule.path_pattern);
+                }
+                catch {
+                    this.logger.warn(`非法 path_pattern 跳过: ${rule.path_pattern}`);
+                    continue;
+                }
+                if (!re.test(target))
+                    continue;
+                if (await this.governanceService.recentAuditExists(profile.site, rule.action, e.sourceUrl)) {
+                    continue;
+                }
+                await this.auditRepo.save(this.auditRepo.create({
+                    site: profile.site,
+                    accountType: profile.account_type,
+                    actionType: rule.action,
+                    sessionId: e.sessionId,
+                    tabId: e.tabId != null ? String(e.tabId) : null,
+                    detail: JSON.stringify({ derivedFrom: 'recording', url: e.sourceUrl }),
+                }));
+                derived++;
+                break;
+            }
+        }
+        return derived;
+    }
+    setLastUrl(sessionId, url) {
+        if (this.lastUrlBySession.size >= MAX_SESSION_MEMORY)
+            this.lastUrlBySession.clear();
+        this.lastUrlBySession.set(sessionId, url);
+    }
+};
+exports.GovernanceIngester = GovernanceIngester;
+exports.GovernanceIngester = GovernanceIngester = GovernanceIngester_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(2, (0, typeorm_1.InjectRepository)(action_audit_entity_1.ActionAudit)),
+    __metadata("design:paramtypes", [recording_event_bus_service_1.RecordingEventBus,
+        governance_service_1.GovernanceService,
+        typeorm_2.Repository])
+], GovernanceIngester);
+//# sourceMappingURL=governance.ingester.js.map

package/dist/assets/server/governance/governance.ingester.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance.ingester.js","sourceRoot":"","sources":["../../src/governance/governance.ingester.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAeA,2CAAkE;AAClE,6CAAmD;AACnD,qCAAqC;AACrC,0FAA6E;AAE7E,+DAG+B;AAC/B,6DAAyD;AAO5C,QAAA,iBAAiB,GAAG,IAAI,GAAG,CAAS;IAC/C,cAAc;IACd,YAAY;IACZ,QAAQ;IACR,aAAa;IACb,aAAa;CACd,CAAC,CAAC;AAGH,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAGzB,IAAM,kBAAkB,0BAAxB,MAAM,kBAAkB;IAMV;IACA;IAEA;IARF,MAAM,GAAG,IAAI,eAAM,CAAC,oBAAkB,CAAC,IAAI,CAAC,CAAC;IAEtD,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAErD,YACmB,QAA2B,EAC3B,iBAAoC,EAEpC,SAAkC;QAHlC,aAAQ,GAAR,QAAQ,CAAmB;QAC3B,sBAAiB,GAAjB,iBAAiB,CAAmB;QAEpC,cAAS,GAAT,SAAS,CAAyB;IAClD,CAAC;IAEJ,YAAY;QACV,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,4BAA4B,EAAE,CAAC,GAAkC,EAAE,EAAE;YACpF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;YACnE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,MAAM,CAAC,MAAwB;QACnC,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,CAAC,SAAS;gBAAE,SAAS;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,IAAI,KAAK,CAAC,CAAC,SAAS;gBAAE,SAAS;YACnC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;YAE1C,IAAI,GAAQ,CAAC;YACb,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAGxC,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,OAAO,EAAE,YAAY;gBAAE,SAAS;YACrC,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAChE,IAAI,CAAC,KAAK;gBAAE,SAAS;YAErB,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC9C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,yBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;oBAAE,SAAS;gBAClD,IAAI,EAAU,CAAC;gBACf,IAAI,CAAC;oBACH,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;oBAC7D,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;oBAAE,SAAS;gBAG/B,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,MAA8B,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;oBACnH,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;oBACpB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,WAAW,EAAE,OAAO,CAAC,YAAY;oBACjC,UAAU,EAAE,IAAI,CAAC,MAA8B;oBAC/C,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;oBAC/C,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;iBACvE,CAAC,CACH,CAAC;gBACF,OAAO,EAAE,CAAC;gBACV,MAAM;YACR,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,UAAU,CAAC,SAAiB,EAAE,GAAW;QAC/C,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,IAAI,kBAAkB;YAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QACpF,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;CACF,CAAA;AAhFY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;IASR,WAAA,IAAA,0BAAgB,EAAC,iCAAW,CAAC,CAAA;qCAFH,+CAAiB;QACR,sCAAiB;QAEzB,oBAAU;GAT7B,kBAAkB,CAgF9B"}

package/dist/assets/server/governance/governance.module.d.ts

@@ -0,0 +1,2 @@
+export declare class GovernanceModule {
+}

package/dist/assets/server/governance/governance.module.js

@@ -0,0 +1,27 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GovernanceModule = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const action_audit_entity_1 = require("./action-audit.entity");
+const governance_service_1 = require("./governance.service");
+const governance_controller_1 = require("./governance.controller");
+const governance_command_recorder_1 = require("./governance.command-recorder");
+let GovernanceModule = class GovernanceModule {
+};
+exports.GovernanceModule = GovernanceModule;
+exports.GovernanceModule = GovernanceModule = __decorate([
+    (0, common_1.Module)({
+        imports: [typeorm_1.TypeOrmModule.forFeature([action_audit_entity_1.ActionAudit])],
+        controllers: [governance_controller_1.GovernanceController],
+        providers: [governance_service_1.GovernanceService, governance_command_recorder_1.GovernanceCommandRecorder],
+        exports: [governance_service_1.GovernanceService, governance_command_recorder_1.GovernanceCommandRecorder],
+    })
+], GovernanceModule);
+//# sourceMappingURL=governance.module.js.map

package/dist/assets/server/governance/governance.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance.module.js","sourceRoot":"","sources":["../../src/governance/governance.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,6CAAgD;AAChD,+DAAoD;AACpD,6DAAyD;AACzD,mEAA+D;AAC/D,+EAA0E;AAQnE,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAAG,CAAA;AAAnB,4CAAgB;2BAAhB,gBAAgB;IAN5B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,uBAAa,CAAC,UAAU,CAAC,CAAC,iCAAW,CAAC,CAAC,CAAC;QAClD,WAAW,EAAE,CAAC,4CAAoB,CAAC;QACnC,SAAS,EAAE,CAAC,sCAAiB,EAAE,uDAAyB,CAAC;QACzD,OAAO,EAAE,CAAC,sCAAiB,EAAE,uDAAyB,CAAC;KACxD,CAAC;GACW,gBAAgB,CAAG"}

package/dist/assets/server/governance/governance.service.d.ts

@@ -0,0 +1,122 @@
+import { Repository } from 'typeorm';
+import { ActionAudit, GovernanceActionType } from './action-audit.entity';
+export interface RiskQuotaLimit {
+    per_hour?: number;
+    per_day?: number;
+    per_week?: number;
+    per_month?: number;
+    source?: string;
+    confidence?: string;
+}
+export interface RiskSchedule {
+    work_hours_local: [number, number];
+    off_hours_multiplier: number;
+    marathon_session_min: number;
+    advisory_escalation: number;
+}
+export interface RiskPacing {
+    min_action_gap_ms: [number, number];
+    scroll_per_screen_ms: [number, number];
+    page_turn_gap_ms: [number, number];
+}
+export interface RiskHardRules {
+    forbid_api_interception: boolean;
+    forbid_cdp_navigation: boolean;
+    forbid_headless: boolean;
+    captcha_manual_only: boolean;
+}
+export interface RiskStopCode {
+    code: string;
+    dom_signals?: string[];
+    response_signals?: string[];
+    action?: string;
+}
+export interface RiskProfile {
+    site: string;
+    version?: string;
+    account_type?: string;
+    account_quotas: Record<string, Record<string, RiskQuotaLimit>>;
+    schedule: RiskSchedule;
+    pacing: RiskPacing;
+    hard_rules: RiskHardRules;
+    stop_codes?: RiskStopCode[];
+}
+export interface ActionDerivationRule {
+    action: string;
+    path_pattern: string;
+}
+export interface RecordActionDto {
+    site: string;
+    accountType: string;
+    actionType: GovernanceActionType;
+    sessionId: string;
+    tabId?: string | null;
+    detail?: unknown;
+    stopCode?: string | null;
+}
+export interface UsageWindow {
+    window: 'hour' | 'day' | 'week' | 'month';
+    used: number;
+    limit: number | null;
+}
+export interface GovernanceAdvisory {
+    offHours: boolean;
+    marathonMinutes: number;
+    gapMs: number;
+}
+export interface GovernanceCheckResult {
+    allowed: boolean;
+    reason?: string;
+    nextAllowedAt?: string;
+    usage: UsageWindow[];
+    advisory?: GovernanceAdvisory;
+}
+export interface GovernanceStatusResult {
+    available: boolean;
+    reason?: string;
+    reasonCode?: ProfileUnavailableCode;
+    reasonDetail?: string;
+    site: string;
+    accountType: string;
+    actions: Array<{
+        actionType: string;
+        usage: UsageWindow[];
+        basis?: {
+            source?: string;
+            confidence?: string;
+        };
+    }>;
+    advisory: GovernanceAdvisory;
+}
+export declare const RISK_PROFILE_UNAVAILABLE = "risk_profile_unavailable";
+export type ProfileUnavailableCode = 'harness_path_missing' | 'risk_profile_missing' | 'risk_profile_invalid';
+export declare class GovernanceService {
+    private readonly auditRepo;
+    private readonly logger;
+    private readonly profileCache;
+    private readonly derivationCache;
+    constructor(auditRepo: Repository<ActionAudit>);
+    record(dto: RecordActionDto): Promise<ActionAudit>;
+    check(site: string, accountType: string, actionType: GovernanceActionType, harnessPath?: string): Promise<GovernanceCheckResult>;
+    status(site: string, accountType: string, harnessPath?: string): Promise<GovernanceStatusResult>;
+    private windowUsage;
+    private countSince;
+    private buildAdvisory;
+    private marathonMinutesSince;
+    sampleGap(profile: RiskProfile, offHours: boolean, marathonMinutes?: number): number;
+    resolveHarnessPath(harnessPath?: string): string | null;
+    loadProfile(site: string, harnessPath?: string): RiskProfile | null;
+    loadActionDerivation(site: string, harnessPath?: string): ActionDerivationRule[] | null;
+    profileUnavailable(site: string, harnessPath?: string): {
+        code: ProfileUnavailableCode;
+        detail?: string;
+    } | null;
+    recentAuditExists(site: string, actionType: GovernanceActionType, url: string, windowMs?: number): Promise<boolean>;
+    private resolveRiskProfileRef;
+    clearProfileCache(): void;
+}
+export declare function assertHardRules(profile: RiskProfile, site: string): void;
+export declare function startOfHour(d: Date): Date;
+export declare function startOfDay(d: Date): Date;
+export declare function startOfWeek(d: Date): Date;
+export declare function startOfMonth(d: Date): Date;

package/dist/assets/server/governance/governance.service.js

@@ -0,0 +1,398 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var GovernanceService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GovernanceService = exports.RISK_PROFILE_UNAVAILABLE = void 0;
+exports.assertHardRules = assertHardRules;
+exports.startOfHour = startOfHour;
+exports.startOfDay = startOfDay;
+exports.startOfWeek = startOfWeek;
+exports.startOfMonth = startOfMonth;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const fs = require("fs");
+const path = require("path");
+const action_audit_entity_1 = require("./action-audit.entity");
+const harness_overlay_service_1 = require("../extraction/harness-overlay.service");
+const ALL_WINDOWS = ['hour', 'day', 'week', 'month'];
+const HARD_RULE_KEYS = [
+    'forbid_api_interception',
+    'forbid_cdp_navigation',
+    'forbid_headless',
+    'captcha_manual_only',
+];
+exports.RISK_PROFILE_UNAVAILABLE = 'risk_profile_unavailable';
+let GovernanceService = GovernanceService_1 = class GovernanceService {
+    auditRepo;
+    logger = new common_1.Logger(GovernanceService_1.name);
+    profileCache = new Map();
+    derivationCache = new Map();
+    constructor(auditRepo) {
+        this.auditRepo = auditRepo;
+    }
+    async record(dto) {
+        const entity = this.auditRepo.create({
+            site: dto.site,
+            accountType: dto.accountType,
+            actionType: dto.actionType,
+            sessionId: dto.sessionId,
+            tabId: dto.tabId ?? null,
+            detail: dto.detail === undefined ? null : JSON.stringify(dto.detail),
+            stopCode: dto.stopCode ?? null,
+        });
+        return this.auditRepo.save(entity);
+    }
+    async check(site, accountType, actionType, harnessPath) {
+        const profile = this.loadProfile(site, harnessPath);
+        if (!profile) {
+            return { allowed: false, reason: exports.RISK_PROFILE_UNAVAILABLE, usage: [] };
+        }
+        assertHardRules(profile, site);
+        const quotas = profile.account_quotas?.[accountType]?.[actionType];
+        const usage = await this.windowUsage(site, accountType, actionType, profile, quotas);
+        const exceeded = usage.filter((u) => u.limit != null && u.used > u.limit);
+        if (exceeded.length > 0) {
+            const now = new Date();
+            const next = exceeded
+                .map((u) => windowEnd(u.window, now))
+                .reduce((a, b) => (a > b ? a : b));
+            const worst = exceeded.reduce((a, b) => ((a.limit ?? 0) - a.used <= (b.limit ?? 0) - b.used ? a : b));
+            return {
+                allowed: false,
+                reason: `quota_exceeded:${worst.window}`,
+                nextAllowedAt: next.toISOString(),
+                usage,
+                advisory: await this.buildAdvisory(profile, site, accountType),
+            };
+        }
+        return { allowed: true, usage, advisory: await this.buildAdvisory(profile, site, accountType) };
+    }
+    async status(site, accountType, harnessPath) {
+        const profile = this.loadProfile(site, harnessPath);
+        const advisory = profile
+            ? await this.buildAdvisory(profile, site, accountType)
+            : emptyAdvisory();
+        if (!profile) {
+            const un = this.profileUnavailable(site, harnessPath);
+            return {
+                available: false,
+                reason: exports.RISK_PROFILE_UNAVAILABLE,
+                reasonCode: un?.code,
+                reasonDetail: un?.detail,
+                site,
+                accountType,
+                actions: [],
+                advisory,
+            };
+        }
+        const tierQuotas = profile.account_quotas?.[accountType] ?? {};
+        const actions = [];
+        for (const actionType of Object.keys(tierQuotas)) {
+            const usage = await this.windowUsage(site, accountType, actionType, profile, tierQuotas[actionType]);
+            actions.push({
+                actionType,
+                usage,
+                basis: {
+                    source: tierQuotas[actionType]?.source,
+                    confidence: tierQuotas[actionType]?.confidence,
+                },
+            });
+        }
+        return { available: true, site, accountType, actions, advisory };
+    }
+    async windowUsage(site, accountType, actionType, _profile, quota) {
+        const now = new Date();
+        const limits = {
+            hour: quota?.per_hour ?? null,
+            day: quota?.per_day ?? null,
+            week: quota?.per_week ?? null,
+            month: quota?.per_month ?? null,
+        };
+        const starts = {
+            hour: startOfHour(now),
+            day: startOfDay(now),
+            week: startOfWeek(now),
+            month: startOfMonth(now),
+        };
+        const usage = [];
+        for (const w of ALL_WINDOWS) {
+            const used = await this.countSince(site, accountType, actionType, starts[w]);
+            usage.push({ window: w, used, limit: limits[w] });
+        }
+        return usage;
+    }
+    countSince(site, accountType, actionType, since) {
+        return this.auditRepo.count({
+            where: {
+                site,
+                accountType,
+                actionType: actionType,
+                createdAt: (0, typeorm_2.Between)(since, new Date(864000000000000)),
+            },
+        });
+    }
+    async buildAdvisory(profile, site, accountType) {
+        const now = new Date();
+        const [workStart, workEnd] = profile.schedule?.work_hours_local ?? [0, 24];
+        const hour = now.getHours();
+        const offHours = hour < workStart || hour >= workEnd;
+        const marathonMinutes = await this.marathonMinutesSince(site, accountType, startOfDay(now), now);
+        const gapMs = this.sampleGap(profile, offHours, marathonMinutes);
+        return { offHours, marathonMinutes, gapMs };
+    }
+    async marathonMinutesSince(site, accountType, since, now) {
+        const first = await this.auditRepo
+            .createQueryBuilder('a')
+            .select('MIN(a.createdAt)', 'first')
+            .where('a.site = :site', { site })
+            .andWhere('a.accountType = :accountType', { accountType })
+            .andWhere('a.createdAt >= :since', { since })
+            .getRawOne();
+        if (!first?.first)
+            return 0;
+        const ms = now.getTime() - new Date(first.first).getTime();
+        return Math.max(0, Math.floor(ms / 60000));
+    }
+    sampleGap(profile, offHours, marathonMinutes = 0) {
+        const [min, max] = profile.pacing?.min_action_gap_ms ?? [0, 0];
+        let gap = min + Math.random() * Math.max(0, max - min);
+        if (offHours)
+            gap *= profile.schedule?.off_hours_multiplier ?? 1;
+        if (marathonMinutes >= (profile.schedule?.marathon_session_min ?? Number.POSITIVE_INFINITY)) {
+            gap *= 2;
+        }
+        return Math.round(gap);
+    }
+    resolveHarnessPath(harnessPath) {
+        const p = (harnessPath ?? process.env.HUNTER_MATE_HARNESS_PATH ?? '').trim();
+        if (p)
+            return path.resolve(p);
+        try {
+            const home = process.env.HUNTER_MATE_HOME || process.env.HOME || process.env.USERPROFILE || '.';
+            const cfgFile = path.join(home, '.hunter-mate', 'config.json');
+            if (fs.existsSync(cfgFile)) {
+                const cfg = JSON.parse(fs.readFileSync(cfgFile, 'utf-8'));
+                const fromCfg = String(cfg?.harnessPath ?? '').trim();
+                if (fromCfg)
+                    return path.resolve(fromCfg);
+            }
+        }
+        catch {
+        }
+        return null;
+    }
+    loadProfile(site, harnessPath) {
+        const root = this.resolveHarnessPath(harnessPath);
+        if (!root)
+            return null;
+        const cacheKey = `${root}|${site}`;
+        const cached = this.profileCache.get(cacheKey);
+        if (cached)
+            return cached;
+        try {
+            const riskProfileRef = this.resolveRiskProfileRef(site, root);
+            if (!riskProfileRef)
+                return null;
+            const profileFile = path.join(root, 'adapters', riskProfileRef);
+            if (!fs.existsSync(profileFile))
+                return null;
+            const doc = (0, harness_overlay_service_1.parseYamlSubset)(fs.readFileSync(profileFile, 'utf-8'), riskProfileRef);
+            if (!doc || typeof doc !== 'object' || !doc.account_quotas || !doc.schedule || !doc.pacing || !doc.hard_rules) {
+                this.logger.warn(`risk profile 结构不完整(缺 account_quotas/schedule/pacing/hard_rules): ${profileFile}`);
+                return null;
+            }
+            const profile = normalizeProfile(doc);
+            this.profileCache.set(cacheKey, profile);
+            return profile;
+        }
+        catch (e) {
+            this.logger.warn(`risk profile 加载失败(site=${site}): ${e?.message || e}`);
+            return null;
+        }
+    }
+    loadActionDerivation(site, harnessPath) {
+        const root = this.resolveHarnessPath(harnessPath);
+        if (!root)
+            return null;
+        const cacheKey = `${root}|${site}`;
+        if (this.derivationCache.has(cacheKey))
+            return this.derivationCache.get(cacheKey) ?? null;
+        let result = null;
+        try {
+            const riskProfileRef = this.resolveRiskProfileRef(site, root);
+            if (riskProfileRef) {
+                const derivationFile = path.join(root, 'adapters', path.dirname(riskProfileRef), 'action-derivation.yaml');
+                if (fs.existsSync(derivationFile)) {
+                    const doc = (0, harness_overlay_service_1.parseYamlSubset)(fs.readFileSync(derivationFile, 'utf-8'), 'action-derivation.yaml');
+                    const rules = Array.isArray(doc?.url_actions) ? doc.url_actions : [];
+                    const valid = rules
+                        .filter((r) => r && typeof r.action === 'string' && typeof r.path_pattern === 'string')
+                        .map((r) => ({ action: r.action, path_pattern: r.path_pattern }));
+                    if (valid.length > 0)
+                        result = valid;
+                }
+            }
+        }
+        catch (e) {
+            this.logger.warn(`action derivation 加载失败(site=${site}): ${e?.message || e}`);
+        }
+        this.derivationCache.set(cacheKey, result);
+        return result;
+    }
+    profileUnavailable(site, harnessPath) {
+        const root = this.resolveHarnessPath(harnessPath);
+        if (!root)
+            return { code: 'harness_path_missing' };
+        let ref = null;
+        try {
+            ref = this.resolveRiskProfileRef(site, root);
+        }
+        catch {
+            return { code: 'risk_profile_missing' };
+        }
+        if (!ref)
+            return { code: 'risk_profile_missing' };
+        const profileFile = path.join(root, 'adapters', ref);
+        if (!fs.existsSync(profileFile))
+            return { code: 'risk_profile_missing', detail: profileFile };
+        try {
+            const doc = (0, harness_overlay_service_1.parseYamlSubset)(fs.readFileSync(profileFile, 'utf-8'), ref);
+            if (!doc || typeof doc !== 'object' || !doc.account_quotas || !doc.schedule || !doc.pacing || !doc.hard_rules) {
+                return { code: 'risk_profile_invalid', detail: profileFile };
+            }
+        }
+        catch (e) {
+            return { code: 'risk_profile_invalid', detail: `${profileFile}: ${e?.message || e}` };
+        }
+        return null;
+    }
+    async recentAuditExists(site, actionType, url, windowMs = 60 * 60 * 1000) {
+        const since = new Date(Date.now() - windowMs);
+        const escaped = url.replace(/[%_\\]/g, (m) => `\\${m}`);
+        const row = await this.auditRepo
+            .createQueryBuilder('a')
+            .where('a.site = :site', { site })
+            .andWhere('a.actionType = :actionType', { actionType })
+            .andWhere('a.createdAt >= :since', { since })
+            .andWhere("a.detail LIKE :pat ESCAPE '\\'", { pat: `%${escaped}%` })
+            .getOne();
+        return !!row;
+    }
+    resolveRiskProfileRef(site, root) {
+        const adaptersDir = path.join(root, 'adapters');
+        const indexFile = path.join(adaptersDir, 'index.yaml');
+        if (!fs.existsSync(indexFile))
+            return null;
+        const index = (0, harness_overlay_service_1.parseYamlSubset)(fs.readFileSync(indexFile, 'utf-8'), 'index.yaml');
+        const triggers = Array.isArray(index?.triggers) ? index.triggers : [];
+        for (const t of triggers) {
+            if (!t?.hostPattern || !t?.riskProfile)
+                continue;
+            try {
+                if (new RegExp(t.hostPattern).test(site)) {
+                    return String(t.riskProfile);
+                }
+            }
+            catch {
+            }
+        }
+        return null;
+    }
+    clearProfileCache() {
+        this.profileCache.clear();
+        this.derivationCache.clear();
+    }
+};
+exports.GovernanceService = GovernanceService;
+exports.GovernanceService = GovernanceService = GovernanceService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_1.InjectRepository)(action_audit_entity_1.ActionAudit)),
+    __metadata("design:paramtypes", [typeorm_2.Repository])
+], GovernanceService);
+function emptyAdvisory() {
+    return { offHours: false, marathonMinutes: 0, gapMs: 0 };
+}
+function assertHardRules(profile, site) {
+    const rules = profile.hard_rules;
+    const violated = HARD_RULE_KEYS.filter((k) => rules?.[k] !== true);
+    if (violated.length > 0) {
+        throw new Error(`risk_profile_hard_rules_violated(site=${site}): ${violated.join(',')} 必须为 true — 画像不可用,禁止执行动作`);
+    }
+}
+function coercePair(value, fallback) {
+    if (Array.isArray(value) && value.length >= 2) {
+        return [Number(value[0]), Number(value[1])];
+    }
+    if (typeof value === 'string') {
+        const m = value.match(/^\[\s*(-?\d+(?:\.\d+)?)\s*,\s*(-?\d+(?:\.\d+)?)\s*\]$/);
+        if (m)
+            return [Number(m[1]), Number(m[2])];
+    }
+    return fallback;
+}
+function normalizeProfile(raw) {
+    const schedule = raw.schedule ?? {};
+    const pacing = raw.pacing ?? {};
+    return {
+        ...raw,
+        schedule: {
+            ...schedule,
+            work_hours_local: coercePair(schedule.work_hours_local, [0, 24]),
+            off_hours_multiplier: Number(schedule.off_hours_multiplier ?? 1),
+            marathon_session_min: Number(schedule.marathon_session_min ?? 45),
+            advisory_escalation: Number(schedule.advisory_escalation ?? 3),
+        },
+        pacing: {
+            ...pacing,
+            min_action_gap_ms: coercePair(pacing.min_action_gap_ms, [0, 0]),
+            scroll_per_screen_ms: coercePair(pacing.scroll_per_screen_ms, [0, 0]),
+            page_turn_gap_ms: coercePair(pacing.page_turn_gap_ms, [0, 0]),
+        },
+    };
+}
+function startOfHour(d) {
+    return new Date(d.getFullYear(), d.getMonth(), d.getDate(), d.getHours(), 0, 0, 0);
+}
+function startOfDay(d) {
+    return new Date(d.getFullYear(), d.getMonth(), d.getDate(), 0, 0, 0, 0);
+}
+function startOfWeek(d) {
+    const day = (d.getDay() + 6) % 7;
+    const s = startOfDay(d);
+    s.setDate(s.getDate() - day);
+    return s;
+}
+function startOfMonth(d) {
+    return new Date(d.getFullYear(), d.getMonth(), 1, 0, 0, 0, 0);
+}
+function windowEnd(w, now) {
+    const s = {
+        hour: startOfHour(now),
+        day: startOfDay(now),
+        week: startOfWeek(now),
+        month: startOfMonth(now),
+    }[w];
+    const end = new Date(s);
+    if (w === 'hour')
+        end.setHours(end.getHours() + 1);
+    else if (w === 'day')
+        end.setDate(end.getDate() + 1);
+    else if (w === 'week')
+        end.setDate(end.getDate() + 7);
+    else
+        end.setMonth(end.getMonth() + 1);
+    return end;
+}
+//# sourceMappingURL=governance.service.js.map