weaver-work-cli 0.1.8 → 0.1.21

package/dist/shortcuts/caizhilian/operations/confirm.js

@@ -0,0 +1,75 @@
+import { caizhilianConfirmationError, caizhilianValidationError } from '../errors.js';
+import { fingerprint } from './shared.js';
+/** apply 类写操作必须显式确认。 */
+export function requireConfirm(args, action) {
+    if (args.confirm !== true) {
+        throw caizhilianConfirmationError(action, {
+            hint: `执行 ${action} 必须显式确认：传入 confirm=true（CLI 用 --yes）`,
+        });
+    }
+}
+/**
+ * prepare 阶段签发 continuation。
+ * 环境指纹（baseUrl + 登录账号）写进票据，apply 时校验，避免跨环境/跨账号复用。
+ */
+export async function issueLease(env, action, payload, ttlMs = 10 * 60_000) {
+    const session = await env.host.getSession();
+    const continuation = await env.continuation.issue({
+        operation: action,
+        baseUrl: session.baseUrl,
+        userId: session.userId,
+        ...payload,
+    }, ttlMs);
+    return { continuation, expiresInMs: ttlMs };
+}
+/** apply 阶段校验确认 + continuation，返回 prepare 时写入的快照。 */
+export async function verifyLease(args, action, env) {
+    requireConfirm(args, action);
+    if (typeof args.continuation !== 'string' || !args.continuation.trim()) {
+        throw caizhilianValidationError('continuation_required', `${action} 必须传入 prepare 返回的 continuation`);
+    }
+    const lease = await env.continuation.verify(args.continuation.trim(), action);
+    const session = await env.host.getSession();
+    if ((lease.baseUrl && lease.baseUrl !== session.baseUrl) || (lease.userId && lease.userId !== session.userId)) {
+        throw caizhilianValidationError('continuation_context_mismatch', '确认上下文已变化（环境或登录账号不同），请重新执行 prepare');
+    }
+    return lease;
+}
+/** 校验 apply 入参与 prepare 快照一致，避免目标漂移。 */
+export function assertLeaseTarget(lease, args, keys, action) {
+    for (const key of keys) {
+        if (args[key] === undefined || args[key] === null || args[key] === '')
+            continue;
+        if (String(lease[key] ?? '') !== String(args[key])) {
+            throw caizhilianValidationError('continuation_target_changed', `${action} 的参数 ${key} 与 prepare 时不一致，请重新执行 prepare`);
+        }
+    }
+}
+// ── 入参指纹（通用防漂移）────────────────────────────────
+/** 计算入参指纹时排除的确认控制字段。 */
+const LEASE_ARG_EXCLUDED_KEYS = new Set(['confirm', 'continuation']);
+/** 入参指纹：排除 confirm / continuation 后按 key 排序序列化。 */
+export function leaseArgsFingerprint(args) {
+    const picked = {};
+    for (const key of Object.keys(args).sort()) {
+        if (LEASE_ARG_EXCLUDED_KEYS.has(key))
+            continue;
+        if (args[key] === undefined)
+            continue;
+        picked[key] = args[key];
+    }
+    return fingerprint(picked);
+}
+/** prepare 签发票据：自动附带入参指纹（apply 时由 assertLeaseArgs 校验）。 */
+export async function issueWriteLease(env, action, args, payload, ttlMs = 10 * 60_000) {
+    return issueLease(env, action, { ...payload, argsFingerprint: leaseArgsFingerprint(args) }, ttlMs);
+}
+/** apply 校验整体入参与 prepare 时一致（比 assertLeaseTarget 更严格的全量防漂移）。 */
+export function assertLeaseArgs(lease, args, action) {
+    const expected = typeof lease.argsFingerprint === 'string' ? lease.argsFingerprint : '';
+    if (!expected)
+        return;
+    if (expected !== leaseArgsFingerprint(args)) {
+        throw caizhilianValidationError('continuation_args_changed', `${action} 的入参与 prepare 时不一致，请重新执行 prepare`);
+    }
+}

package/dist/shortcuts/caizhilian/operations/files.js

@@ -0,0 +1,306 @@
+import { createHash } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, stat, writeFile } from 'node:fs/promises';
+import { basename, dirname, extname, join, resolve } from 'node:path';
+import { caizhilianValidationError } from '../errors.js';
+import { CAIZHILAN_MAX_DOWNLOAD_BYTES, CAIZHILAN_TRANSFER_TIMEOUT_MS } from '../host.js';
+import { responseData } from './shared.js';
+/**
+ * 文件传输层：1:1 对应源 Skill 的
+ * `_plugin_helpers.upload_file_to_server` / `_plugin_helpers._download_attachment_stream`
+ * / `http_client.HttpClient._handle_download` / `_utils.read_file_metadata`。
+ */
+/** 源 _plugin_helpers.UPLOAD_DOWNLOAD_TIMEOUT = 120.0 秒。 */
+export const TRANSFER_TIMEOUT_MS = CAIZHILAN_TRANSFER_TIMEOUT_MS;
+/** 源 _plugin_helpers.IMAGE_ALLOWED_EXT。 */
+export const IMAGE_ALLOWED_EXT = ['.bmp', '.gif', '.jpeg', '.jpg', '.png', '.webp'];
+/** 源 document_plugins._EXT_TO_CONTENT_TYPE。 */
+export const EXT_TO_CONTENT_TYPE = {
+    '.doc': 'WORD',
+    '.docx': 'WORD',
+    '.xls': 'EXCEL',
+    '.xlsx': 'EXCEL',
+    '.ppt': 'PPT',
+    '.pptx': 'PPT',
+};
+/** 源 document_plugins.OFFICE_ALLOWED_EXT = set(_EXT_TO_CONTENT_TYPE)。 */
+export const OFFICE_ALLOWED_EXT = Object.keys(EXT_TO_CONTENT_TYPE);
+/** 源 document_plugins._CONTENT_TYPE_EXT_MAP（替换正文时的扩展名白名单）。 */
+export const CONTENT_TYPE_EXT_MAP = {
+    WORD: ['.doc', '.docx'],
+    EXCEL: ['.xls', '.xlsx'],
+    PPT: ['.ppt', '.pptx'],
+    PDF: ['.pdf'],
+    OFD: ['.ofd'],
+};
+/** 源 _plugin_helpers._FIXED_QUERY_PARAMS。 */
+export const FIXED_DOWNLOAD_QUERY = {
+    customParam: '{"fromPCDoc":1}',
+    authModule: 'document',
+    module: 'document',
+};
+/** 源 assets/config.json：http.download.default_dir = ""（未配置默认下载目录）。 */
+export const DOWNLOAD_DEFAULT_DIR = '';
+const MIME_BY_EXT = {
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.webp': 'image/webp',
+    '.bmp': 'image/bmp',
+    '.pdf': 'application/pdf',
+    '.doc': 'application/msword',
+    '.docx': 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    '.xls': 'application/vnd.ms-excel',
+    '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    '.ppt': 'application/vnd.ms-powerpoint',
+    '.pptx': 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+    '.md': 'text/markdown',
+    '.markdown': 'text/markdown',
+    '.txt': 'text/plain',
+    '.json': 'application/json',
+    '.ofd': 'application/ofd',
+};
+/** 1:1 对应源 _utils.read_file_metadata。 */
+export async function readFileMetadata(filePath) {
+    const text = typeof filePath === 'string' ? filePath.trim() : '';
+    if (!text)
+        throw caizhilianValidationError('file_path_invalid', '文件路径无效');
+    let info;
+    try {
+        info = await stat(text);
+    }
+    catch {
+        throw caizhilianValidationError('file_not_found', `文件不存在: ${text}`);
+    }
+    if (!info.isFile())
+        throw caizhilianValidationError('file_not_found', `文件不存在: ${text}`);
+    let content;
+    try {
+        content = await readFile(text);
+    }
+    catch {
+        throw caizhilianValidationError('file_unreadable', `无法读取文件: ${text}`);
+    }
+    const name = basename(text);
+    const ext = extname(name);
+    return {
+        path: resolve(text),
+        name,
+        size: content.length,
+        md5: createHash('md5').update(content).digest('hex'),
+        extName: ext.replace(/^\./, ''),
+        modifyTime: Math.floor(info.mtimeMs),
+        content,
+    };
+}
+/** 1:1 对应源 upload_file_to_server 的 allowed_ext 校验（含 sorted() 提示文案）。 */
+export function assertAllowedExt(meta, allowed) {
+    const ext = extname(meta.name).toLowerCase();
+    if (!allowed.includes(ext)) {
+        throw caizhilianValidationError('file_type_not_allowed', `不支持的文件类型 ${ext}，仅支持: ${[...allowed].sort().join(', ')}`);
+    }
+}
+function multipartField(value) {
+    if (typeof value === 'string')
+        return value;
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return String(value);
+    return JSON.stringify(value);
+}
+/**
+ * 组装 multipart/form-data。源 http_client 把 body 中的普通字段作为表单字段提交，
+ * `_file_fields` 中声明的键作为文件字段提交。
+ */
+export function buildMultipart(fields, file) {
+    const form = new FormData();
+    for (const [key, value] of Object.entries(fields)) {
+        if (value === undefined || value === null)
+            continue;
+        form.append(key, multipartField(value));
+    }
+    if (file) {
+        const mime = MIME_BY_EXT[extname(file.meta.name).toLowerCase()] || 'application/octet-stream';
+        form.append(file.field, new Blob([new Uint8Array(file.meta.content)], { type: mime }), file.meta.name);
+    }
+    return form;
+}
+/** 1:1 对应源 _plugin_helpers.upload_file_to_server（含 MD5 秒传短路）。 */
+export async function uploadFileToServer(host, filePath, options = {}) {
+    const meta = options.preloadedMeta ?? (await readFileMetadata(filePath));
+    if (options.allowedExt)
+        assertAllowedExt(meta, options.allowedExt);
+    const preCheckBody = {
+        compressImg: 'false',
+        module: 'document',
+        size: String(meta.size),
+        name: meta.name,
+        MD5: meta.md5,
+        lastModified: String(meta.modifyTime),
+        lastModifiedDate: String(meta.modifyTime),
+        ...(options.extraBody ?? {}),
+    };
+    const preResponse = await host.request({
+        method: 'POST',
+        path: '/api/file/preUploadCheck',
+        multipart: buildMultipart(preCheckBody),
+        timeoutMs: TRANSFER_TIMEOUT_MS,
+        operation: options.operation ?? 'caizhilian.file.pre-upload-check',
+    });
+    const preData = responseData(preResponse);
+    if (options.requiredPermission) {
+        const permissionType = asRecord(preData.permissionType);
+        if (!permissionType[options.requiredPermission]) {
+            throw caizhilianValidationError('permission_denied', options.permissionDeniedMessage ?? `无上传权限（${options.requiredPermission}）`);
+        }
+    }
+    const moduleDto = asRecord(preData.uploadModuleDto);
+    const moduleFileId = moduleDto.fileid;
+    if (isPositiveId(moduleFileId)) {
+        const result = {
+            file_id: String(moduleFileId),
+            name: moduleDto.name || meta.name,
+            size: moduleDto.size || meta.size,
+            ext_name: moduleDto.extName || '',
+        };
+        for (const field of options.extraResultFields ?? [])
+            result[field] = moduleDto[field] ?? 0;
+        return result;
+    }
+    const preUploadId = preData.preUploadId;
+    const uploadType = preData.uploadType;
+    if (!preUploadId || !uploadType) {
+        throw caizhilianValidationError('upload_precheck_invalid', '预上传检查响应缺少 preUploadId 或 uploadType');
+    }
+    const uploadBody = {
+        ...preCheckBody,
+        preUploadId: String(preUploadId),
+        uploadType: String(uploadType),
+    };
+    const uploadResponse = await host.request({
+        method: 'POST',
+        path: options.uploadPath ?? '/api/file/module/upload',
+        multipart: buildMultipart(uploadBody, { field: 'file', meta }),
+        timeoutMs: TRANSFER_TIMEOUT_MS,
+        operation: options.operation ?? 'caizhilian.file.upload',
+    });
+    const data = responseData(uploadResponse);
+    const result = {
+        file_id: String(data.fileid ?? ''),
+        name: data.name || meta.name,
+        size: data.size || meta.size,
+        ext_name: data.extName || '',
+    };
+    for (const field of options.extraResultFields ?? [])
+        result[field] = data[field] ?? 0;
+    return result;
+}
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function isPositiveId(value) {
+    if (value === undefined || value === null || value === '')
+        return false;
+    const parsed = Number(value);
+    return Number.isFinite(parsed) && parsed > 0;
+}
+/** 1:1 对应源 resolve_download_save_path + _download_attachment_stream + _handle_download。 */
+export async function downloadAttachment(host, request) {
+    const savePath = resolveSavePathArg(request.savePath);
+    const query = { ...FIXED_DOWNLOAD_QUERY, docId: request.docId, ...(request.extraQuery ?? {}) };
+    const path = `/api/file/remotedownload/${encodeURIComponent(request.attachmentId)}/upload/true`;
+    const response = await host.requestBinary({
+        method: 'GET',
+        path,
+        query,
+        timeoutMs: TRANSFER_TIMEOUT_MS,
+        operation: request.operation,
+    });
+    const maxMb = CAIZHILAN_MAX_DOWNLOAD_BYTES / 1024 / 1024;
+    if (response.content.length > CAIZHILAN_MAX_DOWNLOAD_BYTES) {
+        throw caizhilianValidationError('file_too_large', `文件大小超过限制（${(response.content.length / 1024 / 1024).toFixed(1)}MB > ${maxMb.toFixed(0)}MB）`);
+    }
+    const target = renameIfExists(await resolveTargetPath(savePath, response.headers, path));
+    await mkdir(dirname(target), { recursive: true });
+    await writeFile(target, response.content);
+    return { file_path: target, file_name: basename(target), file_size: response.content.length };
+}
+/** 源 resolve_download_save_path：save_path 优先，其次 config 的 default_dir，都没有则报 no_save_path。 */
+export function resolveSavePathArg(savePath) {
+    const text = typeof savePath === 'string' ? savePath.trim() : '';
+    if (text)
+        return text;
+    if (DOWNLOAD_DEFAULT_DIR)
+        return DOWNLOAD_DEFAULT_DIR;
+    throw caizhilianValidationError('no_save_path', '未指定保存路径且未配置默认下载目录。请提供 save_path 参数指定保存位置（可以是完整文件路径，也可以是目录）。', { error_type: 'no_save_path', default_dir_configured: false });
+}
+async function resolveTargetPath(savePath, headers, urlPath) {
+    const absolute = resolve(savePath);
+    const looksLikeDir = savePath.endsWith('/') || savePath.endsWith('\\');
+    if (!looksLikeDir)
+        return absolute;
+    return join(absolute, extractDownloadFilename(headers, urlPath));
+}
+/** 1:1 对应源 http_client._extract_download_filename（已过滤路径穿越）。 */
+export function extractDownloadFilename(headers, urlPath) {
+    const disposition = headers.get('content-disposition') || '';
+    if (disposition.toLowerCase().includes('filename')) {
+        const star = /filename\*\s*=\s*[A-Za-z0-9-]*''["']?([^"';\n]*)["']?/i.exec(disposition);
+        if (star && star[1].trim())
+            return sanitizeFilename(safeDecode(star[1].trim()));
+        const plain = /filename(?!\*)[^;=\n]*=["']?([^"';\n]*)["']?/i.exec(disposition);
+        if (plain && plain[1].trim())
+            return sanitizeFilename(safeDecode(plain[1].trim()));
+    }
+    const fromUrl = basename(urlPath.split('?')[0].replace(/\/+$/, ''));
+    if (fromUrl && fromUrl.includes('.'))
+        return sanitizeFilename(safeDecode(fromUrl));
+    return 'download';
+}
+function safeDecode(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+function sanitizeFilename(value) {
+    const cleaned = basename(value).replace(/[\\/:*?"<>|\u0000-\u001f]/g, '_').replace(/^\.+/, '');
+    return cleaned || 'download';
+}
+/** 源 http_client._rename_if_exists：conflict_strategy 默认 rename。 */
+export function renameIfExists(target) {
+    const dir = dirname(target);
+    const ext = extname(target);
+    const stem = basename(target, ext);
+    let candidate = target;
+    for (let index = 1; index < 1000; index += 1) {
+        if (!existsSyncSafe(candidate))
+            return candidate;
+        candidate = join(dir, `${stem}(${index})${ext}`);
+    }
+    return candidate;
+}
+/** 同步存在性检查：仅用于下载命名冲突处理，异常按“不存在”处理。 */
+function existsSyncSafe(path) {
+    try {
+        return existsSync(path);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * 校验本地文件与 prepare 快照一致（防「prepare 后文件被改动再 apply」）。
+ * lease 中的 file_md5 / file_size 由 prepare 写入。
+ */
+export function assertFileUnchanged(meta, lease, field = 'file_path') {
+    const expectedMd5 = typeof lease.file_md5 === 'string' ? lease.file_md5 : '';
+    const expectedSize = lease.file_size === undefined || lease.file_size === null ? NaN : Number(lease.file_size);
+    const md5Changed = Boolean(expectedMd5) && expectedMd5 !== meta.md5;
+    const sizeChanged = Number.isFinite(expectedSize) && expectedSize !== meta.size;
+    if (md5Changed || sizeChanged) {
+        throw caizhilianValidationError('file_changed', `本地文件在 prepare 之后发生变化（${field}），请重新执行 prepare：${meta.path}`, { field, expected_md5: expectedMd5 || undefined, actual_md5: meta.md5 });
+    }
+}

package/dist/shortcuts/caizhilian/operations/form.js

@@ -0,0 +1,170 @@
+import { asList, asRecord } from './api.js';
+import { isPlainObject, pyInt } from './shared.js';
+/**
+ * 共享/权限表单配置解析（1:1 对应源 scripts/folder_plugins.py 的 _parse_* 系列）。
+ *
+ * 文件夹权限表单（folder_plugins）与文档共享表单（document_plugins.FetchDocShareFormPlugin）
+ * 复用同一套 cascadeRules / items 解析逻辑，因此抽到本模块，避免两份拷贝。
+ */
+/** 源 _DEFAULT_SEC_LEVEL / _DEFAULT_SEC_ALLOWED。 */
+export const DEFAULT_SEC_LEVEL = { min: 0, max: 100 };
+export const DEFAULT_SEC_ALLOWED = { min: -999, max: 999 };
+/** 源 _build_obj_type_list 的 _NO_SHARE_LEVEL_TYPES / _ID_FIELD_PREFIXES。 */
+export const NO_SHARE_LEVEL_TYPES = ['settingPermission', 'newCreateFolderPremisstion'];
+export const ID_FIELD_PREFIXES = ['obj_id'];
+/** 源 layout 遍历：只取 list 分组。 */
+export function layoutGroups(respData) {
+    return asList(respData.layout).filter((group) => Array.isArray(group));
+}
+export function findObjTypeItem(respData) {
+    for (const group of layoutGroups(respData)) {
+        for (const item of group) {
+            if (isPlainObject(item) && item.id === 'objType')
+                return item;
+        }
+    }
+    return undefined;
+}
+/** 源 _parse_cascade_rules。 */
+export function parseCascadeRules(respData) {
+    const item = findObjTypeItem(respData);
+    return item ? asRecord(asRecord(item.cascadeRules).objType) : {};
+}
+/** 源 _parse_cascade_rules_outer。 */
+export function parseCascadeRulesOuter(respData) {
+    const item = findObjTypeItem(respData);
+    return item ? asRecord(asRecord(item.cascadeRulesOuter).objType) : {};
+}
+/** 源 _parse_field_cascade_rules。 */
+export function parseFieldCascadeRules(respData) {
+    const result = {};
+    for (const group of layoutGroups(respData)) {
+        for (const item of group) {
+            if (!isPlainObject(item))
+                continue;
+            const fieldId = item.id;
+            const cascade = item.cascadeRules;
+            if (fieldId && cascade && fieldId !== 'objType')
+                result[String(fieldId)] = cascade;
+        }
+    }
+    return result;
+}
+/** 源 _parse_obj_type_options。 */
+export function parseObjTypeOptions(respData) {
+    const options = asList(asRecord(asRecord(respData.items).objType).options);
+    const nameMap = {};
+    const availableIds = new Set();
+    for (const option of options) {
+        if (!isPlainObject(option))
+            continue;
+        const oid = option.id ?? '';
+        if (!oid)
+            continue;
+        nameMap[String(oid)] = 'content' in option ? option.content : oid;
+        availableIds.add(String(oid));
+    }
+    return { nameMap, availableIds };
+}
+/** 源 _parse_param_options（含 cascadeRules 里补出的隐藏参数）。 */
+export function parseParamOptions(respData, fieldCascadeRules) {
+    const items = asRecord(respData.items);
+    const paramOptions = {};
+    for (const [fieldName, fieldConfig] of Object.entries(items)) {
+        if (fieldName === 'objType')
+            continue;
+        const options = asList(asRecord(fieldConfig).options);
+        if (!options.length)
+            continue;
+        paramOptions[fieldName] = options
+            .filter(isPlainObject)
+            .map((option) => ({ id: option.id ?? '', name: option.content ?? '' }));
+    }
+    if (fieldCascadeRules) {
+        for (const cascade of Object.values(fieldCascadeRules)) {
+            for (const optionRules of Object.values(asRecord(cascade))) {
+                if (!isPlainObject(optionRules))
+                    continue;
+                for (const optionRule of Object.values(optionRules)) {
+                    if (!isPlainObject(optionRule))
+                        continue;
+                    for (const [subField, subDefault] of Object.entries(asRecord(optionRule.datas))) {
+                        if (subField in paramOptions || subField in items)
+                            continue;
+                        if (typeof subDefault === 'string')
+                            paramOptions[subField] = [{ id: subDefault, name: subDefault }];
+                    }
+                }
+            }
+        }
+    }
+    return paramOptions;
+}
+/** 源 _parse_seclevel_allowed。 */
+export function parseSeclevelAllowed(respData) {
+    const seclevelConfig = asRecord(respData.items).seclevel;
+    if (!isPlainObject(seclevelConfig))
+        return { ...DEFAULT_SEC_ALLOWED };
+    const other = seclevelConfig.otherParams;
+    if (!isPlainObject(other))
+        return { ...DEFAULT_SEC_ALLOWED };
+    try {
+        return { min: pyInt(other.min, -999), max: pyInt(other.max, 999) };
+    }
+    catch {
+        return { ...DEFAULT_SEC_ALLOWED };
+    }
+}
+/** 源 _build_obj_type_list：把级联规则整理成对外可见的对象类型清单。 */
+export function buildObjTypeList(input) {
+    const includeShareFields = !NO_SHARE_LEVEL_TYPES.includes(input.permissionType);
+    let hasDownload = false;
+    if (input.fieldCascadeRules && input.fieldCascadeRules.share_level) {
+        for (const rules of Object.values(asRecord(input.fieldCascadeRules.share_level))) {
+            if (!isPlainObject(rules))
+                continue;
+            for (const rule of Object.values(rules)) {
+                if (isPlainObject(rule) && 'download' in asRecord(rule.datas))
+                    hasDownload = true;
+            }
+        }
+    }
+    const result = [];
+    for (const [objType, outerRuleRaw] of Object.entries(input.cascadeRulesOuter)) {
+        if (input.availableIds.size > 0 && !input.availableIds.has(objType))
+            continue;
+        const outerRule = asRecord(outerRuleRaw);
+        const showFields = asList(outerRule.show);
+        const params = showFields.filter((field) => field !== 'objType');
+        const idParams = params.filter((field) => typeof field === 'string' && ID_FIELD_PREFIXES.some((prefix) => field.startsWith(prefix)));
+        const needId = idParams.length > 0;
+        if (includeShareFields && hasDownload && params.includes('share_level') && !params.includes('download')) {
+            params.push('download');
+        }
+        const item = {
+            id: objType,
+            name: objType in input.objTypeNames ? input.objTypeNames[objType] : objType,
+            need_id: needId,
+            params,
+        };
+        if (needId)
+            item.id_param = idParams[0] === undefined ? '' : String(idParams[0]);
+        if (params.includes('seclevel')) {
+            let secDefault = { ...DEFAULT_SEC_LEVEL };
+            const rule = asRecord(input.cascadeRules[objType]);
+            const datas = asRecord(rule.datas);
+            const rawSec = datas.seclevel;
+            if (isPlainObject(rawSec)) {
+                try {
+                    secDefault = { min: pyInt(rawSec.min, DEFAULT_SEC_LEVEL.min), max: pyInt(rawSec.max, DEFAULT_SEC_LEVEL.max) };
+                }
+                catch {
+                    secDefault = { ...DEFAULT_SEC_LEVEL };
+                }
+            }
+            item.seclevel = { default: secDefault, allowed: input.seclevelAllowed ?? { ...DEFAULT_SEC_ALLOWED } };
+        }
+        result.push(item);
+    }
+    return result;
+}