openxiangda-nest 2.0.0-alpha.100

package/README.md

@@ -0,0 +1,158 @@
+# openxiangda-nest
+
+NestJS integration for platform-gateway requests. The global transport guard verifies the gateway assertion and exposes `@CurrentUser()` with the verified user, role union and capability union. `@OpenXiangdaOperation()` binds typed business actions to declared capabilities.
+
+Ordinary CRUD remains in the platform Data API. Use NestJS only for real business actions, and keep the platform as the authoritative identity and authorization owner.
+
+A declared interactive action injects `OpenXiangdaBusinessDataApiService` (or
+`OpenXiangdaStandardOperations`, which uses it). `@OpenXiangdaOperation` checks
+the caller's action capability once at App API ingress. Native Data then runs
+as the trusted backend for that exact application/environment without applying
+the caller's ordinary resource, row and field permissions again. The platform
+retains the initiating user and operation code in records, files, events and
+audit. Do not author or forward an `authorizationJSON` permission mirror.
+
+Start application backends with the canonical bootstrap so gateway signatures
+are verified against the exact incoming request bytes:
+
+```ts
+import 'reflect-metadata';
+import { bootstrapOpenXiangdaApplication } from 'openxiangda-nest';
+import { AppModule } from './app.module.js';
+
+await bootstrapOpenXiangdaApplication(AppModule);
+```
+
+Do not create a separate `NestFactory` or `FastifyAdapter` in application code.
+The standard bootstrap owns raw-body capture, proxy trust, shutdown hooks, and
+the runtime listen contract.
+
+`OpenXiangdaStandardOperations` provides the default transaction patterns for
+meeting interval overlap, course capacity/duplicate selection, and visitor
+duplicate reservation checks. Each pattern submits one stable command to the
+verified Native Data API transaction kernel. Mutable business state is never
+pre-read by the application: record assertions lock their row, bounded integer
+increments update derived counters, and the platform idempotency receipt is
+consulted before guards or mutations.
+
+For a verified Named Action, the SDK propagates the platform Gateway
+`x-request-id` to nested platform calls automatically. Application code must
+not replace it. Reuse the exact transaction payload and `idempotencyKey` after
+a retryable authorization-projection readiness response; a previously
+committed transaction returns its stored result with `replayed: true` without
+duplicating rows or events.
+
+Visitor duplicate detection accepts actual submitted values, not a field-name
+list:
+
+```ts
+await operations.createVisitorReservation({
+  reservationResourceCode: 'visitor-reservations',
+  duplicateMatch: {
+    visitorIdentityNumber: body.visitorIdentityNumber,
+    visitDate: body.visitDate,
+  },
+  data: body,
+  idempotencyKey: body.idempotencyKey,
+  activeStatusField: 'status',
+  activeStatusValues: ['pending', 'approved'],
+});
+```
+
+`duplicateMatch` must be a non-empty object. Its values and `data` come from
+the same immutable request body; the application does not perform a pre-read.
+
+## Standard application notifications
+
+`OpenXiangdaBusinessNotificationService.send()` is the application-facing API
+inside an `@OpenXiangdaOperation`. App Gateway authorizes the current user once,
+then the platform revalidates the immutable operation proof and sends as a
+platform-managed application principal. The original login token never reaches
+the application; the audit retains the initiating user and action. Ordinary
+users do not need `app:notification2:send`.
+
+```ts
+import {
+  OPENXIANGDA_NOTIFICATION_BUSINESS_SEND_V2,
+} from 'openxiangda-contracts';
+import { OpenXiangdaBusinessNotificationService } from 'openxiangda-nest';
+
+await notifications.send({
+  schemaVersion: OPENXIANGDA_NOTIFICATION_BUSINESS_SEND_V2,
+  eventId: request.submittedEventId,
+  correlationId: `purchase:${request.id}`,
+  messageKey: `purchase:${request.id}:applicant`,
+  sourceSequence: request.revision,
+  state: 'informational',
+  recipients: [{ userId: request.applicantUserId }],
+  title: '采购申请已提交',
+  summary: '点击查看申请详情',
+  navigationTarget: {
+    kind: 'APP_ROUTE',
+    appCode: 'purchase_app',
+    routeCodes: {
+      desktop: 'purchase.detail',
+      mobile: 'purchase.detail-mobile',
+    },
+    pathParams: { id: request.id },
+    access: 'AUTHENTICATED',
+  },
+  idempotencyKey: `purchase:${request.id}:revision:${request.revision}`,
+});
+```
+
+The platform-owned `application.informational.standard` template renders
+`title` and optional `summary`. Replaying the same `eventId` or
+`idempotencyKey` returns the existing message. Reuse the same `messageKey` with
+a greater `sourceSequence` and a new `idempotencyKey` to converge state.
+
+In a signed Application Events or date-trigger handler, use
+`notifications.sendFromEvent()`. Declare `recipientPaths`, `titlePath` and an
+optional `summaryPath` beneath the immutable event `data`. The SDK forwards the
+current event/delivery proof with an application credential; Notification Hub
+verifies the active delivery and resolves recipients and presentation itself.
+The event path never accepts caller-supplied recipient IDs or a user identity.
+
+`OpenXiangdaNotificationService` remains the privileged management facade for
+platform administrators that explicitly own `app:notification2:send` and need
+to select an already activated template. It is not the default Named Action
+path.
+
+## Advanced DingTalk cards
+
+`OpenXiangdaNotificationService` exposes the opt-in DingTalk card channel. The
+platform owns the robot credentials and delivery state; application code only
+selects an active binding, supplies its own template ID and string parameters,
+and provides a canonical authenticated detail target. This channel is not the
+default Workflow notification route.
+
+```ts
+import {
+  OPENXIANGDA_NOTIFICATION_DINGTALK_ADVANCED_CARD_SEND_V2,
+} from 'openxiangda-contracts';
+import { OpenXiangdaNotificationService } from 'openxiangda-nest';
+
+await notifications.sendDingTalkCard({
+  schemaVersion: OPENXIANGDA_NOTIFICATION_DINGTALK_ADVANCED_CARD_SEND_V2,
+  bindingCode: 'dingtalk_card_advanced',
+  idempotencyKey: `purchase-created:${request.id}`,
+  title: '采购申请已创建',
+  recipients: [{ userId: approverUserId }],
+  cardTemplateId: 'purchase-result-v2',
+  cardParamMap: { applicant: request.applicantName },
+  navigationTarget: {
+    kind: 'APP_ROUTE',
+    appCode: 'purchase_app',
+    routeCodes: {
+      desktop: 'purchase.detail',
+      mobile: 'purchase.detail-mobile',
+    },
+    pathParams: { id: request.id },
+    access: 'AUTHENTICATED',
+  },
+});
+```
+
+This privileged service is request-scoped and requires the platform permission
+`app:notification2:send`; recipient, parameter, URL and idempotency bounds are
+enforced by Notification Hub 2.0.

package/dist/application-credentials.d.ts

@@ -0,0 +1,19 @@
+import type { OpenXiangdaModuleOptions } from "./types.js";
+export declare class OpenXiangdaApplicationCredentials {
+    private readonly options;
+    private readonly baseUrl;
+    private readonly fetch;
+    private cached;
+    private inFlight;
+    constructor(options: OpenXiangdaModuleOptions);
+    configured(): boolean;
+    getAuthorizationHeader(): Promise<string>;
+    invalidate(expectedAccessToken?: string): void;
+    withAuthorization<T>(operation: (authorization: string) => Promise<T>): Promise<T>;
+    private token;
+    private exchange;
+    private normalizedScopes;
+    private oauthErrorCode;
+    private isUnauthorized;
+}
+//# sourceMappingURL=application-credentials.d.ts.map

package/dist/application-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-credentials.d.ts","sourceRoot":"","sources":["../src/application-credentials.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAmB3D,qBACa,iCAAiC;IAQ1C,OAAO,CAAC,QAAQ,CAAC,OAAO;IAP1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiD;IACvE,OAAO,CAAC,MAAM,CAAqC;IACnD,OAAO,CAAC,QAAQ,CAA8C;gBAI3C,OAAO,EAAE,wBAAwB;IAMpD,UAAU,IAAI,OAAO;IAOf,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI/C,UAAU,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI;IAUxC,iBAAiB,CAAC,CAAC,EACvB,SAAS,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAC/C,OAAO,CAAC,CAAC,CAAC;YAYC,KAAK;YAcL,QAAQ;IAsGtB,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,cAAc;CAOvB"}

package/dist/application-credentials.js

@@ -0,0 +1,158 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { OpenXiangdaPlatformError } from "./platform-client.js";
+import { OPENXIANGDA_MODULE_OPTIONS } from "./tokens.js";
+let OpenXiangdaApplicationCredentials = class OpenXiangdaApplicationCredentials {
+    options;
+    baseUrl;
+    fetch;
+    cached;
+    inFlight;
+    constructor(options) {
+        this.options = options;
+        this.baseUrl = options.platformBaseUrl.replace(/\/+$/, "");
+        this.fetch = options.fetch || globalThis.fetch.bind(globalThis);
+    }
+    configured() {
+        return Boolean(this.options.oauthClient?.clientId &&
+            this.options.oauthClient?.clientSecret);
+    }
+    async getAuthorizationHeader() {
+        return (await this.token()).authorization;
+    }
+    invalidate(expectedAccessToken) {
+        if (expectedAccessToken &&
+            this.cached?.accessToken !== expectedAccessToken) {
+            return;
+        }
+        this.cached = undefined;
+    }
+    async withAuthorization(operation) {
+        const first = await this.token();
+        try {
+            return await operation(first.authorization);
+        }
+        catch (error) {
+            if (!this.isUnauthorized(error))
+                throw error;
+            this.invalidate(first.accessToken);
+            const refreshed = await this.token();
+            return await operation(refreshed.authorization);
+        }
+    }
+    async token() {
+        if (this.cached && Date.now() < this.cached.refreshAt)
+            return this.cached;
+        if (this.inFlight)
+            return await this.inFlight;
+        const pending = this.exchange();
+        this.inFlight = pending;
+        try {
+            const token = await pending;
+            this.cached = token;
+            return token;
+        }
+        finally {
+            if (this.inFlight === pending)
+                this.inFlight = undefined;
+        }
+    }
+    async exchange() {
+        const oauth = this.options.oauthClient;
+        if (!oauth?.clientId || !oauth.clientSecret) {
+            throw new OpenXiangdaPlatformError(503, "APPLICATION_OAUTH_NOT_CONFIGURED", "OpenXiangda 应用后端尚未配置 OAuth2 Client Credentials");
+        }
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.options.requestTimeoutMs || 5000);
+        try {
+            const body = new URLSearchParams({ grant_type: "client_credentials" });
+            const scopes = this.normalizedScopes(oauth.scopes);
+            if (scopes.length)
+                body.set("scope", scopes.join(" "));
+            const basic = Buffer.from(`${oauth.clientId}:${oauth.clientSecret}`, "utf8").toString("base64");
+            const response = await this.fetch(`${this.baseUrl}/openxiangda-api/v2/oauth2/token`, {
+                method: "POST",
+                signal: controller.signal,
+                headers: {
+                    Accept: "application/json",
+                    Authorization: `Basic ${basic}`,
+                    "Content-Type": "application/x-www-form-urlencoded",
+                },
+                body: body.toString(),
+            });
+            let payload;
+            try {
+                payload = (await response.json());
+            }
+            catch {
+                throw new OpenXiangdaPlatformError(response.status, "APPLICATION_OAUTH_RESPONSE_INVALID", "OAuth2 token endpoint 返回的不是有效 JSON");
+            }
+            if (!response.ok || payload.error) {
+                throw new OpenXiangdaPlatformError(response.status || 503, this.oauthErrorCode(payload.error), String(payload.error_description || "OAuth2 token 获取失败"));
+            }
+            const accessToken = String(payload.access_token || "").trim();
+            const tokenType = String(payload.token_type || "").trim();
+            const expiresIn = Math.floor(Number(payload.expires_in));
+            if (!accessToken ||
+                tokenType.toLowerCase() !== "bearer" ||
+                !Number.isFinite(expiresIn) ||
+                expiresIn < 1) {
+                throw new OpenXiangdaPlatformError(502, "APPLICATION_OAUTH_RESPONSE_INVALID", "OAuth2 token endpoint 返回了无效 token");
+            }
+            const now = Date.now();
+            const configuredSkew = Math.max(0, Math.floor(Number(oauth.refreshSkewSeconds ?? 30)));
+            const refreshWindow = Math.min(configuredSkew, Math.max(0, Math.floor(expiresIn / 2)));
+            return {
+                accessToken,
+                authorization: `Bearer ${accessToken}`,
+                scope: String(payload.scope || ""),
+                expiresAt: now + expiresIn * 1000,
+                refreshAt: now + Math.max(1, expiresIn - refreshWindow) * 1000,
+            };
+        }
+        catch (error) {
+            if (error instanceof OpenXiangdaPlatformError)
+                throw error;
+            if (error?.name === "AbortError") {
+                throw new OpenXiangdaPlatformError(504, "APPLICATION_OAUTH_TIMEOUT", "OAuth2 token 获取超时");
+            }
+            throw new OpenXiangdaPlatformError(503, "APPLICATION_OAUTH_UNAVAILABLE", error?.message || "OAuth2 token endpoint 不可用");
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    normalizedScopes(scopes) {
+        return [...new Set((scopes || []).map((scope) => scope.trim()).filter(Boolean))];
+    }
+    oauthErrorCode(error) {
+        const normalized = String(error || "token_exchange_failed")
+            .toUpperCase()
+            .replace(/[^A-Z0-9_]/g, "_")
+            .slice(0, 80);
+        return `APPLICATION_OAUTH_${normalized || "TOKEN_EXCHANGE_FAILED"}`;
+    }
+    isUnauthorized(error) {
+        return ((error instanceof OpenXiangdaPlatformError && error.httpStatus === 401) ||
+            Number(error?.status) === 401 ||
+            Number(error?.statusCode) === 401);
+    }
+};
+OpenXiangdaApplicationCredentials = __decorate([
+    Injectable(),
+    __param(0, Inject(OPENXIANGDA_MODULE_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], OpenXiangdaApplicationCredentials);
+export { OpenXiangdaApplicationCredentials };
+//# sourceMappingURL=application-credentials.js.map

package/dist/application-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-credentials.js","sourceRoot":"","sources":["../src/application-credentials.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAqBlD,IAAM,iCAAiC,GAAvC,MAAM,iCAAiC;IAQzB;IAPF,OAAO,CAAS;IAChB,KAAK,CAAiD;IAC/D,MAAM,CAAqC;IAC3C,QAAQ,CAA8C;IAE9D,YAEmB,OAAiC;QAAjC,YAAO,GAAP,OAAO,CAA0B;QAElD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClE,CAAC;IAED,UAAU;QACR,OAAO,OAAO,CACZ,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ;YAChC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CACzC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,aAAa,CAAC;IAC5C,CAAC;IAED,UAAU,CAAC,mBAA4B;QACrC,IACE,mBAAmB;YACnB,IAAI,CAAC,MAAM,EAAE,WAAW,KAAK,mBAAmB,EAChD,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,SAAgD;QAEhD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC7C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACnC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACrC,OAAO,MAAM,SAAS,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QAC1E,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;YAC5B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;gBAAE,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC3D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,IAAI,wBAAwB,CAChC,GAAG,EACH,kCAAkC,EAClC,gDAAgD,CACjD,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CACxB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,IAAI,CACtC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,MAAM;gBAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,EACzC,MAAM,CACP,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,GAAG,IAAI,CAAC,OAAO,kCAAkC,EACjD;gBACE,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,aAAa,EAAE,SAAS,KAAK,EAAE;oBAC/B,cAAc,EAAE,mCAAmC;iBACpD;gBACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CACF,CAAC;YACF,IAAI,OAA2B,CAAC;YAChC,IAAI,CAAC;gBACH,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,wBAAwB,CAChC,QAAQ,CAAC,MAAM,EACf,oCAAoC,EACpC,oCAAoC,CACrC,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,IAAI,wBAAwB,CAChC,QAAQ,CAAC,MAAM,IAAI,GAAG,EACtB,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,EAClC,MAAM,CAAC,OAAO,CAAC,iBAAiB,IAAI,mBAAmB,CAAC,CACzD,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YACzD,IACE,CAAC,WAAW;gBACZ,SAAS,CAAC,WAAW,EAAE,KAAK,QAAQ;gBACpC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC3B,SAAS,GAAG,CAAC,EACb,CAAC;gBACD,MAAM,IAAI,wBAAwB,CAChC,GAAG,EACH,oCAAoC,EACpC,mCAAmC,CACpC,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAC7B,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,CACnD,CAAC;YACF,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,cAAc,EACd,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CACvC,CAAC;YACF,OAAO;gBACL,WAAW;gBACX,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;gBAClC,SAAS,EAAE,GAAG,GAAG,SAAS,GAAG,IAAI;gBACjC,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,aAAa,CAAC,GAAG,IAAI;aAC/D,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,wBAAwB;gBAAE,MAAM,KAAK,CAAC;YAC3D,IAAK,KAAe,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC5C,MAAM,IAAI,wBAAwB,CAChC,GAAG,EACH,2BAA2B,EAC3B,mBAAmB,CACpB,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,wBAAwB,CAChC,GAAG,EACH,+BAA+B,EAC9B,KAAe,EAAE,OAAO,IAAI,2BAA2B,CACzD,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,MAA4B;QACnD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IAEO,cAAc,CAAC,KAAc;QACnC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,IAAI,uBAAuB,CAAC;aACxD,WAAW,EAAE;aACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;aAC3B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChB,OAAO,qBAAqB,UAAU,IAAI,uBAAuB,EAAE,CAAC;IACtE,CAAC;IAEO,cAAc,CAAC,KAAc;QACnC,OAAO,CACL,CAAC,KAAK,YAAY,wBAAwB,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,CAAC;YACvE,MAAM,CAAE,KAA8B,EAAE,MAAM,CAAC,KAAK,GAAG;YACvD,MAAM,CAAE,KAAkC,EAAE,UAAU,CAAC,KAAK,GAAG,CAChE,CAAC;IACJ,CAAC;CACF,CAAA;AAxLY,iCAAiC;IAD7C,UAAU,EAAE;IAQR,WAAA,MAAM,CAAC,0BAA0B,CAAC,CAAA;;GAP1B,iCAAiC,CAwL7C"}

package/dist/assignee-provider.d.ts

@@ -0,0 +1,35 @@
+import { OnModuleInit } from '@nestjs/common';
+import { DiscoveryService, Reflector } from '@nestjs/core';
+import type { WorkflowAssigneeRequest, WorkflowAssigneeResponse, WorkflowCandidatePrincipal } from 'openxiangda-contracts';
+import type { OpenXiangdaModuleOptions } from './types.js';
+export declare function WorkflowAssigneeProvider(code: string): ClassDecorator;
+export interface WorkflowAssigneeProviderHandler {
+    resolve(request: WorkflowAssigneeRequest): Promise<WorkflowCandidatePrincipal[]> | WorkflowCandidatePrincipal[];
+}
+export declare class OpenXiangdaAssigneeProviderRegistry implements OnModuleInit {
+    private readonly discovery;
+    private readonly reflector;
+    private readonly handlers;
+    constructor(discovery: DiscoveryService, reflector: Reflector);
+    onModuleInit(): void;
+    resolve(code: string, request: WorkflowAssigneeRequest): Promise<WorkflowCandidatePrincipal[]>;
+}
+export declare function normalizeWorkflowCandidates(value: unknown): WorkflowCandidatePrincipal[];
+export declare class OpenXiangdaAssigneeProviderReceiver {
+    private readonly options;
+    private readonly validateRequest;
+    constructor(options: OpenXiangdaModuleOptions);
+    accept(providerCode: string, headers: Record<string, string | string[] | undefined>, rawBody: Buffer | string): WorkflowAssigneeRequest;
+    private assertTimestamp;
+    private assertSignature;
+    private header;
+}
+export declare class OpenXiangdaAssigneeProviderController {
+    private readonly receiver;
+    private readonly registry;
+    constructor(receiver: OpenXiangdaAssigneeProviderReceiver, registry: OpenXiangdaAssigneeProviderRegistry);
+    resolve(providerCode: string, headers: Record<string, string | string[] | undefined>, request: {
+        rawBody?: Buffer;
+    }, body: unknown): Promise<WorkflowAssigneeResponse>;
+}
+//# sourceMappingURL=assignee-provider.d.ts.map

package/dist/assignee-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignee-provider.d.ts","sourceRoot":"","sources":["../src/assignee-provider.ts"],"names":[],"mappings":"AACA,OAAO,EAOL,YAAY,EAMb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE3D,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,uBAAuB,CAAC;AAO/B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAI3D,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAMrE;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,CACL,OAAO,EAAE,uBAAuB,GAE9B,OAAO,CAAC,0BAA0B,EAAE,CAAC,GACrC,0BAA0B,EAAE,CAAC;CAClC;AAED,qBACa,mCAAoC,YAAW,YAAY;IAKpE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAE1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAN5B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsD;gBAI5D,SAAS,EAAE,gBAAgB,EAE3B,SAAS,EAAE,SAAS;IAGvC,YAAY;IAgBN,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB;CAQ7D;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,gCAoCzD;AAED,qBACa,mCAAmC;IAS5C,OAAO,CAAC,QAAQ,CAAC,OAAO;IAR1B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAIU;gBAIvB,OAAO,EAAE,wBAAwB;IAGpD,MAAM,CACJ,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACtD,OAAO,EAAE,MAAM,GAAG,MAAM,GACvB,uBAAuB;IAkC1B,OAAO,CAAC,eAAe;IAcvB,OAAO,CAAC,eAAe;IA+BvB,OAAO,CAAC,MAAM;CAWf;AAED,qBAEa,qCAAqC;IAG9C,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFR,QAAQ,EAAE,mCAAmC,EAE7C,QAAQ,EAAE,mCAAmC;IAI1D,OAAO,CACY,YAAY,EAAE,MAAM,EAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EAC1D,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAC5B,IAAI,EAAE,OAAO,GACpB,OAAO,CAAC,wBAAwB,CAAC;CAUrC"}

package/dist/assignee-provider.js

@@ -0,0 +1,223 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { BadRequestException, Body, Controller, Headers, Inject, Injectable, Param, Post, Req, SetMetadata, UnauthorizedException, } from '@nestjs/common';
+import { DiscoveryService, Reflector } from '@nestjs/core';
+import { Ajv2020 } from 'ajv/dist/2020.js';
+import { SCHEMA_VERSIONS, workflowAssigneeRequestSchema, } from 'openxiangda-contracts';
+import { OpenXiangdaInfrastructureController } from './infrastructure-controller.js';
+import { OPENXIANGDA_MODULE_OPTIONS } from './tokens.js';
+const WORKFLOW_ASSIGNEE_PROVIDER = Symbol('OPENXIANGDA_WORKFLOW_ASSIGNEE_PROVIDER');
+export function WorkflowAssigneeProvider(code) {
+    const normalized = String(code || '').trim();
+    if (!/^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/.test(normalized)) {
+        throw new Error('WorkflowAssigneeProvider code 不合法');
+    }
+    return SetMetadata(WORKFLOW_ASSIGNEE_PROVIDER, normalized);
+}
+let OpenXiangdaAssigneeProviderRegistry = class OpenXiangdaAssigneeProviderRegistry {
+    discovery;
+    reflector;
+    handlers = new Map();
+    constructor(discovery, reflector) {
+        this.discovery = discovery;
+        this.reflector = reflector;
+    }
+    onModuleInit() {
+        for (const wrapper of this.discovery.getProviders()) {
+            const code = wrapper.metatype
+                ? this.reflector.get(WORKFLOW_ASSIGNEE_PROVIDER, wrapper.metatype)
+                : undefined;
+            if (!code || !wrapper.instance)
+                continue;
+            if (typeof wrapper.instance.resolve !== 'function') {
+                throw new Error(`Workflow Assignee Provider ${code} 缺少 resolve()`);
+            }
+            if (this.handlers.has(code)) {
+                throw new Error(`Workflow Assignee Provider 重复: ${code}`);
+            }
+            this.handlers.set(code, wrapper.instance);
+        }
+    }
+    async resolve(code, request) {
+        const handler = this.handlers.get(code);
+        if (!handler) {
+            throw new BadRequestException(`Workflow Assignee Provider 未注册: ${code}`);
+        }
+        const candidates = await handler.resolve(request);
+        return normalizeWorkflowCandidates(candidates);
+    }
+};
+OpenXiangdaAssigneeProviderRegistry = __decorate([
+    Injectable(),
+    __param(0, Inject(DiscoveryService)),
+    __param(1, Inject(Reflector)),
+    __metadata("design:paramtypes", [DiscoveryService,
+        Reflector])
+], OpenXiangdaAssigneeProviderRegistry);
+export { OpenXiangdaAssigneeProviderRegistry };
+export function normalizeWorkflowCandidates(value) {
+    if (!Array.isArray(value) || value.length > 200) {
+        throw new BadRequestException('Workflow Assignee Provider 返回值不合法');
+    }
+    const unique = new Map();
+    for (const item of value) {
+        if (!item || typeof item !== 'object' || Array.isArray(item)) {
+            throw new BadRequestException('Workflow Assignee Provider 候选人不合法');
+        }
+        const source = item;
+        const userId = String(source.userId || '').trim();
+        const candidateSource = String(source.source || '').trim();
+        if (!userId || !candidateSource) {
+            throw new BadRequestException('Workflow Assignee Provider 候选人不合法');
+        }
+        const candidate = {
+            userId,
+            source: candidateSource,
+            ...(source.roleSubjectKey
+                ? { roleSubjectKey: String(source.roleSubjectKey).trim() }
+                : {}),
+            ...(source.roleCode
+                ? { roleCode: String(source.roleCode).trim() }
+                : {}),
+            ...(source.displayName
+                ? { displayName: String(source.displayName).trim() }
+                : {}),
+        };
+        unique.set([candidate.userId, candidate.roleSubjectKey || '', candidate.roleCode || ''].join('\u0000'), candidate);
+    }
+    return [...unique.values()];
+}
+let OpenXiangdaAssigneeProviderReceiver = class OpenXiangdaAssigneeProviderReceiver {
+    options;
+    validateRequest = new Ajv2020({
+        allErrors: true,
+        strict: false,
+        validateFormats: false,
+    }).compile(workflowAssigneeRequestSchema);
+    constructor(options) {
+        this.options = options;
+    }
+    accept(providerCode, headers, rawBody) {
+        const body = Buffer.isBuffer(rawBody)
+            ? rawBody.toString('utf8')
+            : String(rawBody || '');
+        if (!body)
+            throw new BadRequestException('Provider raw body 不能为空');
+        const headerProvider = this.header(headers, 'x-openxiangda-workflow-provider');
+        const timestamp = this.header(headers, 'x-openxiangda-timestamp');
+        const signature = this.header(headers, 'x-openxiangda-signature');
+        this.header(headers, 'x-openxiangda-request-id');
+        if (headerProvider !== providerCode) {
+            throw new UnauthorizedException('Provider code 与请求路径不一致');
+        }
+        this.assertTimestamp(timestamp);
+        this.assertSignature(providerCode, timestamp, signature, body);
+        let value;
+        try {
+            value = JSON.parse(body);
+        }
+        catch {
+            throw new BadRequestException('Provider body 不是有效 JSON');
+        }
+        const request = value;
+        if (!this.validateRequest(value) ||
+            request.providerCode !== providerCode ||
+            request.appCode !== this.options.appCode) {
+            throw new BadRequestException('Provider 请求不符合 v2.1 协议');
+        }
+        return request;
+    }
+    assertTimestamp(value) {
+        const timestamp = Number(value);
+        const maxAgeSeconds = Math.max(30, this.options.workflowAssigneeProviderMaxAgeSeconds || 300);
+        if (!Number.isSafeInteger(timestamp) ||
+            Math.abs(Math.floor(Date.now() / 1000) - timestamp) > maxAgeSeconds) {
+            throw new UnauthorizedException('Provider 签名时间戳无效或已过期');
+        }
+    }
+    assertSignature(providerCode, timestamp, value, body) {
+        const configured = this.options.workflowAssigneeProviderSecrets?.[providerCode];
+        const secrets = (Array.isArray(configured) ? configured : [configured])
+            .map(secret => String(secret || '').trim())
+            .filter(Boolean);
+        if (!secrets.length) {
+            throw new UnauthorizedException('Provider 签名密钥未配置');
+        }
+        const actual = value.startsWith('v1=') ? value.slice(3) : '';
+        const actualBuffer = Buffer.from(actual, 'hex');
+        const valid = secrets.some(secret => {
+            const expected = createHmac('sha256', secret)
+                .update(`${timestamp}.${body}`)
+                .digest('hex');
+            const expectedBuffer = Buffer.from(expected, 'hex');
+            return (actualBuffer.length === expectedBuffer.length &&
+                timingSafeEqual(actualBuffer, expectedBuffer));
+        });
+        if (!valid) {
+            throw new UnauthorizedException('Provider 签名无效');
+        }
+    }
+    header(headers, name) {
+        const value = headers[name] ?? headers[name.toLowerCase()];
+        const normalized = Array.isArray(value) ? value[0] : value;
+        if (!String(normalized || '').trim()) {
+            throw new UnauthorizedException(`缺少 Provider 请求头 ${name}`);
+        }
+        return String(normalized).trim();
+    }
+};
+OpenXiangdaAssigneeProviderReceiver = __decorate([
+    Injectable(),
+    __param(0, Inject(OPENXIANGDA_MODULE_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], OpenXiangdaAssigneeProviderReceiver);
+export { OpenXiangdaAssigneeProviderReceiver };
+let OpenXiangdaAssigneeProviderController = class OpenXiangdaAssigneeProviderController {
+    receiver;
+    registry;
+    constructor(receiver, registry) {
+        this.receiver = receiver;
+        this.registry = registry;
+    }
+    async resolve(providerCode, headers, request, body) {
+        const rawBody = request.rawBody || Buffer.from(JSON.stringify(body));
+        const input = this.receiver.accept(providerCode, headers, rawBody);
+        const candidates = await this.registry.resolve(providerCode, input);
+        return {
+            schemaVersion: SCHEMA_VERSIONS.workflowAssigneeResponse,
+            requestId: input.requestId,
+            candidates,
+        };
+    }
+};
+__decorate([
+    Post('/:providerCode'),
+    __param(0, Param('providerCode')),
+    __param(1, Headers()),
+    __param(2, Req()),
+    __param(3, Body()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object, Object, Object]),
+    __metadata("design:returntype", Promise)
+], OpenXiangdaAssigneeProviderController.prototype, "resolve", null);
+OpenXiangdaAssigneeProviderController = __decorate([
+    OpenXiangdaInfrastructureController(),
+    Controller('/openxiangda/workflow/assignee-providers'),
+    __param(0, Inject(OpenXiangdaAssigneeProviderReceiver)),
+    __param(1, Inject(OpenXiangdaAssigneeProviderRegistry)),
+    __metadata("design:paramtypes", [OpenXiangdaAssigneeProviderReceiver,
+        OpenXiangdaAssigneeProviderRegistry])
+], OpenXiangdaAssigneeProviderController);
+export { OpenXiangdaAssigneeProviderController };
+//# sourceMappingURL=assignee-provider.js.map

package/dist/assignee-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignee-provider.js","sourceRoot":"","sources":["../src/assignee-provider.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EACL,mBAAmB,EACnB,IAAI,EACJ,UAAU,EACV,OAAO,EACP,MAAM,EACN,UAAU,EAEV,KAAK,EACL,IAAI,EACJ,GAAG,EACH,WAAW,EACX,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAM3C,OAAO,EACL,eAAe,EACf,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mCAAmC,EAAE,MAAM,gCAAgC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAGzD,MAAM,0BAA0B,GAAG,MAAM,CAAC,wCAAwC,CAAC,CAAC;AAEpF,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,WAAW,CAAC,0BAA0B,EAAE,UAAU,CAAC,CAAC;AAC7D,CAAC;AAWM,IAAM,mCAAmC,GAAzC,MAAM,mCAAmC;IAK3B;IAEA;IANF,QAAQ,GAAG,IAAI,GAAG,EAA2C,CAAC;IAE/E,YAEmB,SAA2B,EAE3B,SAAoB;QAFpB,cAAS,GAAT,SAAS,CAAkB;QAE3B,cAAS,GAAT,SAAS,CAAW;IACpC,CAAC;IAEJ,YAAY;QACV,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC;YACpD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ;gBAC3B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAS,0BAA0B,EAAE,OAAO,CAAC,QAAQ,CAAC;gBAC1E,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,SAAS;YACzC,IAAI,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,eAAe,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,QAA2C,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,OAAgC;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,OAAO,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACjD,CAAC;CACF,CAAA;AAlCY,mCAAmC;IAD/C,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAExB,WAAA,MAAM,CAAC,SAAS,CAAC,CAAA;qCADU,gBAAgB;QAEhB,SAAS;GAP5B,mCAAmC,CAkC/C;;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAChD,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsC,CAAC;IAC7D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,MAAM,GAAG,IAA2C,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAChC,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,SAAS,GAA+B;YAC5C,MAAM;YACN,MAAM,EAAE,eAAe;YACvB,GAAG,CAAC,MAAM,CAAC,cAAc;gBACvB,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC1D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,QAAQ;gBACjB,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,WAAW;gBACpB,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,MAAM,CAAC,GAAG,CACR,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,cAAc,IAAI,EAAE,EAAE,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAC/E,QAAQ,CACT,EACD,SAAS,CACV,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAGM,IAAM,mCAAmC,GAAzC,MAAM,mCAAmC;IAS3B;IARF,eAAe,GAAG,IAAI,OAAO,CAAC;QAC7C,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,KAAK;QACb,eAAe,EAAE,KAAK;KACvB,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAE1C,YAEmB,OAAiC;QAAjC,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;IAEJ,MAAM,CACJ,YAAoB,EACpB,OAAsD,EACtD,OAAwB;QAExB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YACnC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAChC,OAAO,EACP,iCAAiC,CAClC,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;QACjD,IAAI,cAAc,KAAK,YAAY,EAAE,CAAC;YACpC,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,OAAO,GAAG,KAAyC,CAAC;QAC1D,IACE,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;YAC5B,OAAO,CAAC,YAAY,KAAK,YAAY;YACrC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,EACxC,CAAC;YACD,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,OAAkC,CAAC;IAC5C,CAAC;IAEO,eAAe,CAAC,KAAa;QACnC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,EAAE,EACF,IAAI,CAAC,OAAO,CAAC,qCAAqC,IAAI,GAAG,CAC1D,CAAC;QACF,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,GAAG,aAAa,EACnE,CAAC;YACD,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAEO,eAAe,CACrB,YAAoB,EACpB,SAAiB,EACjB,KAAa,EACb,IAAY;QAEZ,MAAM,UAAU,GACd,IAAI,CAAC,OAAO,CAAC,+BAA+B,EAAE,CAAC,YAAY,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;aACpE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;aAC1C,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;iBAC1C,MAAM,CAAC,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC;iBAC9B,MAAM,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO,CACL,YAAY,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;gBAC7C,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,CAC9C,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,qBAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAEO,MAAM,CACZ,OAAsD,EACtD,IAAY;QAEZ,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,qBAAqB,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,CAAC;CACF,CAAA;AA1GY,mCAAmC;IAD/C,UAAU,EAAE;IASR,WAAA,MAAM,CAAC,0BAA0B,CAAC,CAAA;;GAR1B,mCAAmC,CA0G/C;;AAIM,IAAM,qCAAqC,GAA3C,MAAM,qCAAqC;IAG7B;IAEA;IAJnB,YAEmB,QAA6C,EAE7C,QAA6C;QAF7C,aAAQ,GAAR,QAAQ,CAAqC;QAE7C,aAAQ,GAAR,QAAQ,CAAqC;IAC7D,CAAC;IAGE,AAAN,KAAK,CAAC,OAAO,CACY,YAAoB,EAChC,OAAsD,EAC1D,OAA6B,EAC5B,IAAa;QAErB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACpE,OAAO;YACL,aAAa,EAAE,eAAe,CAAC,wBAAwB;YACvD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU;SACX,CAAC;IACJ,CAAC;CACF,CAAA;AAfO;IADL,IAAI,CAAC,gBAAgB,CAAC;IAEpB,WAAA,KAAK,CAAC,cAAc,CAAC,CAAA;IACrB,WAAA,OAAO,EAAE,CAAA;IACT,WAAA,GAAG,EAAE,CAAA;IACL,WAAA,IAAI,EAAE,CAAA;;;;oEAUR;AAvBU,qCAAqC;IAFjD,mCAAmC,EAAE;IACrC,UAAU,CAAC,0CAA0C,CAAC;IAGlD,WAAA,MAAM,CAAC,mCAAmC,CAAC,CAAA;IAE3C,WAAA,MAAM,CAAC,mCAAmC,CAAC,CAAA;qCADjB,mCAAmC;QAEnC,mCAAmC;GALrD,qCAAqC,CAwBjD"}

package/dist/authz.d.ts

@@ -0,0 +1,28 @@
+import { CanActivate, ExecutionContext } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+import type { NativePrincipal } from "openxiangda-contracts";
+import type { AppApiOperationContract } from "openxiangda-contracts";
+import { OPENXIANGDA_REQUIRED_CAPABILITY } from "./tokens.js";
+import type { OpenXiangdaCurrentUser, OpenXiangdaVerifiedContext } from "./types.js";
+export declare const RequireCapability: (capability: string) => import("@nestjs/common").CustomDecorator<typeof OPENXIANGDA_REQUIRED_CAPABILITY>;
+/**
+ * Binds one controller route to the immutable App API contract and protects it
+ * with the same generated capability constant. The release verifier can inspect
+ * this metadata without bootstrapping application business code.
+ */
+export declare function OpenXiangdaOperation(operation: AppApiOperationContract): (target: object, propertyKey?: string | symbol, descriptor?: TypedPropertyDescriptor<any>) => void;
+export declare const CurrentPrincipal: (...dataOrPipes: unknown[]) => ParameterDecorator;
+export declare const CurrentUser: (...dataOrPipes: unknown[]) => ParameterDecorator;
+export declare function currentUserFromVerifiedContext(verified: OpenXiangdaVerifiedContext): OpenXiangdaCurrentUser;
+export declare function currentUserFromPrincipal(principal: NativePrincipal, roleCodes?: string[]): OpenXiangdaCurrentUser;
+export declare const CurrentPerspective: (...dataOrPipes: unknown[]) => ParameterDecorator;
+export declare const CurrentApplicationPrincipal: (...dataOrPipes: unknown[]) => ParameterDecorator;
+export declare const CurrentOpenXiangdaContext: (...dataOrPipes: unknown[]) => ParameterDecorator;
+export declare class OpenXiangdaAuthzGuard implements CanActivate {
+    private readonly reflector;
+    constructor(reflector: Reflector);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private isVerifiedRoleUnion;
+    private servicePrincipal;
+}
+//# sourceMappingURL=authz.d.ts.map