┌─────────────────────────────────────────────────────────────┐
│                    业务应用层 (各端 App)                      │
├─────────────────────────────────────────────────────────────┤
│  平台适配层  │  iOS Adapter  │  Android Adapter  │  Web Adapter  │ ...
├─────────────────────────────────────────────────────────────┤
│              核心能力层 (共享库 / Rust / C++ / Kotlin Multiplatform)              │
│  ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
│  │ 网络层   │ │ 存储层   │ │ 加密层   │ │ 埋点层   │ │ 业务协议 │ │
│  └──────────┘ └──────────┘ └──────────┘ └──────────┘ └──────────┘ │
├─────────────────────────────────────────────────────────────┤
│                    平台基础设施 (OS / Runtime)                 │
└─────────────────────────────────────────────────────────────┘

// KMP 期望声明
expect class HttpClient {
    suspend fun request(req: HttpRequest): Result<HttpResponse>
    fun addInterceptor(interceptor: Interceptor)
}

// iOS 实际实现 (Swift)
class HttpClientImpl: HttpClient {
    private let session: URLSession
    private var interceptors: [Interceptor] = []
    
    func request(req: HttpRequest) async throws -> HttpResponse {
        var urlReq = req.toURLRequest()
        for interceptor in interceptors { urlReq = interceptor.intercept(urlReq) }
        let (data, resp) = try await session.data(for: urlReq)
        return HttpResponse(data: data, statusCode: (resp as! HTTPURLResponse).statusCode)
    }
}

// 统一事件模型
@Serializable data class TrackEvent(
    val eventId: String,           // 业务唯一标识
    val timestamp: Long = System.currentTimeMillis(),
    val properties: Map<String, String>,
    val userId: String? = UserContext.currentId,
    val deviceInfo: DeviceInfo = DeviceInfo.collect()
)

// 发送策略：批量 + 定时 + 网络感知
class Tracker(private val queue: EventQueue, private val uploader: Uploader) {
    fun track(event: TrackEvent) = queue.offer(event)
    
    @Suppress("UNUSED_PARAMETER")
    fun flush() { /* 批量上报 */ }
}

// Android (build.gradle.kts)
dependencies {
    implementation("com.yourcorp:core-sdk:1.2.3")
    implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.6.0")
}

// iOS (Podspec / Swift Package Manager)
.package(url: "https://github.com/yourcorp/core-sdk-spm.git", from: "1.2.3")

// Web (npm)
npm i @yourcorp/core-sdk-wasm

// 统一配置对象
data class SdkConfig(
    val env: Env = Env.PROD,
    val appId: String,
    val logLevel: LogLevel = LogLevel.INFO,
    val enableEncryptStorage: Boolean = true,
    val customInterceptors: List<Interceptor> = emptyList()
)

// 各端调用
CoreSdk.initialize(context, SdkConfig(appId = "YOUR_APP_ID"))

// 仅引入需要的模块
CoreSdk.enableModule(Module.PAY)
CoreSdk.enableModule(Module.IM)
CoreSdk.enableModule(Module.ANALYTICS)

// Gradle 任务：自动对比 mapping 文件，防止关键类被误混淆
task verifyProguardRules {
    doLast {
        val keepRules = file("proguard-rules.pro").readText()
        val mapping = file("build/outputs/mapping/release/mapping.txt")
        val criticalClasses = listOf("com.yourcorp.core.crypto.", "com.yourcorp.core.protocol.")
        criticalClasses.forEach { prefix ->
            if (!mapping.readText().contains(prefix)) {
                throw GradleException("关键包 $prefix 疑似被混淆，请检查 -keep 规则")
            }
        }
    }
}
tasks.named("assembleRelease").configure { finalizedBy("verifyProguardRules") }

┌────────────────────────────────────────────────────────────┐
│                    业务侧配置下发平台                         │
├────────────────────────────────────────────────────────────┤
│  L1: 远程配置 (Remote Config)  │  启开关、阈值、文案、AB实验  │  实时生效、无审核、全量/灰度  │
│  L2: 动态脚本 (WASM / JS / Lua) │  复杂业务规则、表单校验、埋点 │  签名校验、沙箱隔离、版本管理 │
│  L3: 热修复 / 增量包 (Dex / SO / Bundle) │  修复 Crash、补全逻辑漏洞 │  差分算法、签名一致性、应用市场合规审核 │
└────────────────────────────────────────────────────────────┘

// 统一遥测数据结构 (OpenTelemetry 语义规范子集)
@Serializable data class TelemetryEvent(
    val timestamp: Long = System.currentTimeMillis(),
    val traceId: String,           // W3C TraceContext 标准
    val spanId: String,
    val eventType: EventType,      // METRIC / LOG / CRASH / BIZ
    val serviceName: String = "core-sdk",
    val sdkVersion: String = BuildConfig.VERSION_NAME,
    val platform: Platform,        // ANDROID / IOS / WEB / MINI / DESKTOP
    val attributes: Map<String, AttributeValue>, // 维度：网络类型、前后台、用户分层等
    val metrics: Map<String, Double>? = null,    // 指标：耗时、内存、电量、包大小
    val body: String? = null       // 日志正文 / 异常堆栈 / 业务载荷
)

sequenceDiagram
    participant App as 业务App (iOS/Android/Web)
    participant SDK as Core SDK (Network Layer)
    participant GW as 网关/边缘节点
    participant Svc as 后端微服务
    
    App->>SDK: request(headers: {traceparent: "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01"})
    SDK->>GW: HTTP/2 + 透传 traceparent + baggage (sdk_version, platform, user_tier)
    GW->>Svc: gRPC metadata 透传
    Note right of Svc: 后端日志/指标/链路自动关联<br/>实现"端到端"一次排查

# CI 流水线阶段：生成 SPDX 格式 SBOM
# Android/KMP
./gradlew generateSbom --format=SPDX_JSON --output=sbom.spdx.json

# iOS (使用 syft)
syft packages dir:./build/artifacts -o spdx-json=sbom.spdx.json

# Rust
cargo sbom --format spdx-json > sbom.spdx.json

# 统一上传至制品库，关联 SDK 版本 Tag
curl -X POST "https://artifact.yourcorp.com/api/sbom" 
  -H "Authorization: Bearer $TOKEN" 
  -F "file=@sbom.spdx.json" 
  -F "version=1.2.3" 
  -F "platform=all"

# .github/workflows/release.yml (核心逻辑)
name: Release SDK
on:
  workflow_dispatch:
    inputs:
      version_type:
        type: choice
        options: [patch, minor, major, prerelease]
        description: '语义化版本类型'
      dry_run:
        type: boolean
        default: true

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0, token: ${{ secrets.GH_TOKEN }} }
      
      - name: Setup Toolchains (JDK, Node, Rust, Xcode via macOS runner matrix)
        uses: ./.github/actions/setup-all
      
      - name: Calculate Next Version
        id: version
        run: |
          # 使用 changesets / semantic-release / 自定义脚本
          echo "new_version=$(pnpm changeset version --dry-run ${{ inputs.version_type }})" >> $GITHUB_OUTPUT
      
      - name: Generate Changelog
        run: pnpm changeset generate --version ${{ steps.version.outputs.new_version }}
      
      - name: Build & Test All Platforms (Matrix Strategy)
        # 并行构建 Android AAR / iOS XCFramework / npm WASM / Dart Package
        # 产物上传至制品库 (Maven Central / GitHub Packages / npm / Pub.dev)
      
      - name: Publish (if not dry_run)
        if: ${{ !inputs.dry_run }}
        run: |
          git tag -a v${{ steps.version.outputs.new_version }} -m "Release v${{ steps.version.outputs.new_version }}"
          git push origin v${{ steps.version.outputs.new_version }}
          # 触发各平台发布流水线

// 核心层定义统一账号模型
@Serializable data class UnifiedIdentity(
    val uid: String,                    // 全局唯一 ID (Snowflake / UUID v7)
    val openId: String?,                // 微信/支付宝/苹果/Google 等三方 OpenID
    val unionId: String?,               // 同主体跨应用 UnionID
    val tokenSet: TokenSet,             // access_token / refresh_token / id_token / expires_in
    val realm: Realm,                   // CHINA_MAINLAND / OVERSEAS / ENTERPRISE
    val bindingStatus: BindingStatus,   // ANONYMOUS / BOUND / MIGRATING / CONFLICT
    val riskLevel: RiskLevel            // LOW / MEDIUM / HIGH (风控引擎实时评估)
)

// 适配层职责：仅负责“原生登录流程唤起” → “换取标准 TokenSet” → “回调核心层”
// iOS: ASAuthorizationController (Sign in with Apple) / WXApi / AuthenticationServices
// Android: Google Identity Services / WXEntryActivity / Huawei HMS Account
// Web: OAuth 2.0 PKCE / WebAuthn / 微信网页授权
// 小程序: wx.login / wx.getUserProfile / 插件化登录组件

graph TD
    A[业务发起支付] --> B{核心层风控预检}
    B -- 高风险 --> C[拦截/挑战/人工审核]
    B -- 低风险 --> D[适配层唤起原生支付]
    D --> E[iOS: SKPaymentQueue / Android: BillingClient / Web: Payment Request API / 小程序: wx.requestPayment]
    E --> F[支付结果回调]
    F --> G[核心层统一校验签名/金额/订单状态]
    G --> H[本地落单 + 服务端对账]
    H --> I[埋点上报: pay_success / pay_fail / risk_block]
    
    style C fill:#ffcccc,stroke:#ff0000
    style G fill:#ffffcc,stroke:#ffcc00