@aalis/plugin-webui-server 0.4.2 → 0.5.1

package/dist/auth.d.ts

@@ -3,38 +3,22 @@ import type { Logger } from '@aalis/core';
 import type { UserIdentity } from '@aalis/plugin-authority-api';
 import type { ProcessService } from '@aalis/plugin-process-api';
 import type { RequestHandler } from 'express';
-/**
- * 账户校验器 —— auth 系统对 authority 服务的最小依赖面。
- *
- * 以函数注入而非服务引用，调用方应惰性解析（authority 可能晚于 webui-server
- * 激活或被热替换）。
- */
-export interface AccountVerifier {
-    /** 校验账户密码（无账户/不匹配均 false） */
-    verify(username: string, password: string): boolean | Promise<boolean>;
-    /** 是否存在任何可登录账户（决定登录页是否显示账户表单） */
-    hasAccounts(): boolean;
-}
 export interface AuthSystem {
     /** Express 中间件：处理 ?token= 重定向、登录端点、未认证拦截、登录页 */
     middleware: RequestHandler;
     /** 校验 WebSocket 升级请求是否已认证（cookie 读取） */
     verifyWsClient(req: IncomingMessage): boolean;
-    /**
-     * 解析请求的调用者身份：账户 session → `webui:<username>`；
-     * 单 token 模式 → `webui:console`（owner 级，单人模式语义）；未认证 → undefined。
-     */
+    /** 解析调用者身份：单 token 模式 → `webui:console`（owner 级，单人语义）；未认证 → undefined。 */
     identify(req: Pick<IncomingMessage, 'headers'>): UserIdentity | undefined;
 }
 /**
- * 创建认证系统：账户 session + 单 token 双模式。
+ * 创建单 token 认证系统（单 owner）。
  *
- * - 账户登录（username/password）→ 服务端随机 session（内存表，重启失效），
- *   cookie `aalis_webui_session`，身份为 `webui:<username>`
- * - token 登录（向后兼容的单人模式）→ cookie `aalis_webui_token`，身份 `webui:console`
- * - 两者并存时 session 身份优先
+ * - token 由调用方传入（参见 index.ts resolveAuthToken，支持 ephemeral / persist / fixed 三种模式）
+ * - HttpOnly + SameSite=Strict cookie；`?token=` 一键登录；同源 POST /api/auth/login 提交
+ * - 身份恒为 `webui:console`（owner 级，单人模式语义）
  */
-export declare function createAuthSystem(token: string, logger: Logger, accounts?: AccountVerifier, tokenLogin?: () => boolean): AuthSystem;
+export declare function createAuthSystem(token: string, _logger: Logger): AuthSystem;
 /**
  * 跨平台打开默认浏览器到指定 URL（无外部依赖）
  * 失败静默；此为便利功能，不影响服务启动。

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAuG9C;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,6BAA6B;IAC7B,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,iCAAiC;IACjC,WAAW,IAAI,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,gDAAgD;IAChD,UAAU,EAAE,cAAc,CAAC;IAC3B,wCAAwC;IACxC,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC;IAC9C;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,YAAY,GAAG,SAAS,CAAC;CAC3E;AAWD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,eAAe,EAC1B,UAAU,GAAE,MAAM,OAAoB,GACrC,UAAU,CAwJZ;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,IAAI,CAenE"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AA0E9C,MAAM,WAAW,UAAU;IACzB,gDAAgD;IAChD,UAAU,EAAE,cAAc,CAAC;IAC3B,wCAAwC;IACxC,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC;IAC9C,0EAA0E;IAC1E,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,YAAY,GAAG,SAAS,CAAC;CAC3E;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,CA+E3E;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,IAAI,CAenE"}

package/dist/auth.js

@@ -1,5 +1,4 @@
 const TOKEN_COOKIE = 'aalis_webui_token';
-const SESSION_COOKIE = 'aalis_webui_session';
 function parseCookieValue(header, name) {
     if (!header)
         return undefined;
@@ -25,29 +24,9 @@ function buildSetCookie(name, value, maxAgeSec) {
 function buildClearCookie(name) {
     return `${name}=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0`;
 }
-/**
- * 登录页：自包含 HTML，不引入外部资源。
- *
- * 存在账户时默认显示「账户登录」表单（用户名+密码），token 登录折叠为次选
- * （tokenMode=disabled 时整体隐藏）；无账户时只显示 token 表单（兜底，防锁死）。
- * 两种提交都打 POST /api/auth/login。
- */
-function loginPageHtml(hasAccounts, showToken, reason) {
+/** 登录页：自包含 HTML，不引入外部资源；提交 POST /api/auth/login 后刷新到 / */
+function loginPageHtml(reason) {
     const note = reason ? `<p class="note">${escapeHtml(reason)}</p>` : '';
-    const tokenDetails = showToken
-        ? `<details style="margin-top:14px"><summary>使用访问 token 登录</summary>
-<input id="t" type="password" autocomplete="off" placeholder="访问 token" style="margin-top:8px">
-<button type="button" id="tb" style="background:#2a3038">Token 登录</button>
-</details>`
-        : '';
-    const accountForm = hasAccounts
-        ? `<input id="u" type="text" autocomplete="username" placeholder="用户名" autofocus required>
-<input id="p" type="password" autocomplete="current-password" placeholder="密码" required style="margin-top:8px">
-<button type="submit" id="b">登录</button>
-${tokenDetails}`
-        : `<p>请输入启动日志或 data/webui/access.txt 中显示的访问 token。</p>
-<input id="t" type="password" autocomplete="off" placeholder="访问 token" autofocus required>
-<button type="submit" id="b">登录</button>`;
     return `<!DOCTYPE html><html lang="zh-CN"><head>
 <meta charset="utf-8"><title>Aalis WebUI 登录</title>
 <meta name="viewport" content="width=device-width,initial-scale=1">
@@ -59,155 +38,68 @@ body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:c
 h1{margin:0 0 8px;font-size:22px;font-weight:600}
 p{margin:0 0 16px;color:#8b95a1;font-size:14px;line-height:1.5}
 p.note{color:#ffb300}
-summary{color:#8b95a1;font-size:13px;cursor:pointer}
 input{width:100%;padding:10px 12px;font-size:14px;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;background:#0b0d10;color:#e6e8eb;border:1px solid #2a3038;border-radius:6px;outline:none}
 input:focus{border-color:#5b8def}
 button{width:100%;margin-top:12px;padding:10px;font-size:14px;font-weight:500;background:#5b8def;color:#fff;border:0;border-radius:6px;cursor:pointer}
-button:hover{filter:brightness(1.08)}
+button:hover{background:#4a7de0}
 button:disabled{opacity:.5;cursor:wait}
 .err{margin-top:10px;color:#ff6b6b;font-size:13px;min-height:18px}
 </style></head>
 <body><form class="card" id="f">
 <h1>Aalis WebUI</h1>
+<p>请输入启动日志或 data/webui/access.txt 中显示的访问 token。</p>
 ${note}
-${accountForm}
+<input id="t" type="password" autocomplete="off" placeholder="访问 token" autofocus required>
+<button type="submit" id="b">登录</button>
 <div class="err" id="e"></div>
 </form>
 <script>
-const $=id=>document.getElementById(id);
-const f=$('f'),e=$('e');
-async function login(body,btn){
-  e.textContent='';btn.disabled=true;
+const f=document.getElementById('f'),t=document.getElementById('t'),b=document.getElementById('b'),e=document.getElementById('e');
+f.addEventListener('submit',async ev=>{
+  ev.preventDefault();e.textContent='';b.disabled=true;
   try{
-    const r=await fetch('/api/auth/login',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(body)});
-    if(r.ok){location.replace('/');}else{const j=await r.json().catch(()=>({}));e.textContent=j.error||'登录失败';btn.disabled=false;}
-  }catch(err){e.textContent='网络错误';btn.disabled=false;}
-}
-f.addEventListener('submit',ev=>{
-  ev.preventDefault();
-  const u=$('u'),t=$('t');
-  if(u&&u.value.trim()){login({username:u.value.trim(),password:$('p').value},$('b'));}
-  else if(t&&t.value.trim()){login({token:t.value.trim()},$('b'));}
+    const r=await fetch('/api/auth/login',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({token:t.value.trim()})});
+    if(r.ok){location.replace('/');}else{const j=await r.json().catch(()=>({}));e.textContent=j.error||'token 不正确';b.disabled=false;t.select();}
+  }catch(err){e.textContent='网络错误';b.disabled=false;}
 });
-const tb=$('tb');
-if(tb)tb.addEventListener('click',()=>{const t=$('t');if(t.value.trim())login({token:t.value.trim()},tb);});
 </script></body></html>`;
 }
 function escapeHtml(s) {
     return s.replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
 }
-const MAX_FAILURES = 5;
-const LOCK_MS = 60_000;
 /**
- * 创建认证系统：账户 session + 单 token 双模式。
+ * 创建单 token 认证系统（单 owner）。
  *
- * - 账户登录（username/password）→ 服务端随机 session（内存表，重启失效），
- *   cookie `aalis_webui_session`，身份为 `webui:<username>`
- * - token 登录（向后兼容的单人模式）→ cookie `aalis_webui_token`，身份 `webui:console`
- * - 两者并存时 session 身份优先
+ * - token 由调用方传入（参见 index.ts resolveAuthToken，支持 ephemeral / persist / fixed 三种模式）
+ * - HttpOnly + SameSite=Strict cookie；`?token=` 一键登录；同源 POST /api/auth/login 提交
+ * - 身份恒为 `webui:console`（owner 级，单人模式语义）
  */
-export function createAuthSystem(token, logger, accounts, tokenLogin = () => true) {
-    const cookieMaxAge = 30 * 24 * 3600; // 30d；进程重启 token 轮换/session 表清空后无效
-    const sessions = new Map();
-    const failures = new Map();
-    /** token 登录是否可用：宿主开关（tokenMode!=disabled）|| 无账户兜底（防锁死） */
-    function tokenAllowed() {
-        return tokenLogin() || !(accounts?.hasAccounts() ?? false);
-    }
-    function newSession(username) {
-        // 顺带清扫过期 session（登录是低频操作，无需独立 timer——审计 MEDIUM #10）
-        const now = Date.now();
-        for (const [id, s] of sessions)
-            if (s.expiresAt <= now)
-                sessions.delete(id);
-        const id = Buffer.from(crypto.getRandomValues(new Uint8Array(24))).toString('hex');
-        sessions.set(id, { username, expiresAt: now + cookieMaxAge * 1000 });
-        return id;
-    }
-    function sessionUser(req) {
-        const id = parseCookieValue(req.headers.cookie, SESSION_COOKIE);
-        if (!id)
-            return undefined;
-        const s = sessions.get(id);
-        if (!s)
-            return undefined;
-        if (s.expiresAt <= Date.now()) {
-            sessions.delete(id);
-            return undefined;
-        }
-        return s.username;
-    }
+export function createAuthSystem(token, _logger) {
+    const cookieMaxAge = 30 * 24 * 3600; // 30d；进程重启 token 轮换后无效
     function tokenAuthed(req) {
-        if (!tokenAllowed())
-            return false;
         const cookieToken = parseCookieValue(req.headers.cookie, TOKEN_COOKIE);
         return !!cookieToken && cookieToken === token;
     }
     function identify(req) {
-        const username = sessionUser(req);
-        if (username)
-            return { platform: 'webui', userId: username };
-        if (tokenAuthed(req))
-            return { platform: 'webui', userId: 'console' };
-        return undefined;
-    }
-    function checkLocked(username) {
-        const rec = failures.get(username);
-        return !!rec && rec.count >= MAX_FAILURES && rec.lockedUntil > Date.now();
-    }
-    function recordFailure(username) {
-        const rec = failures.get(username);
-        if (rec && rec.lockedUntil > Date.now()) {
-            rec.count += 1;
-            rec.lockedUntil = Date.now() + LOCK_MS;
-        }
-        else {
-            failures.set(username, { count: 1, lockedUntil: Date.now() + LOCK_MS });
-        }
+        return tokenAuthed(req) ? { platform: 'webui', userId: 'console' } : undefined;
     }
-    const middleware = async (req, res, next) => {
+    const middleware = (req, res, next) => {
         const url = req.path;
         const qToken = typeof req.query?.token === 'string' ? req.query.token : undefined;
-        const hasAccounts = accounts?.hasAccounts() ?? false;
         // 1. ?token= 命中 → 设置 cookie → 302 到不带 query 的同路径
-        if (req.method === 'GET' && qToken && tokenAllowed()) {
+        if (req.method === 'GET' && qToken) {
             if (qToken === token) {
                 res.setHeader('Set-Cookie', buildSetCookie(TOKEN_COOKIE, token, cookieMaxAge));
                 res.redirect(302, url);
                 return;
             }
-            // ?token 错误：落到登录页（不向 next 透）
-            res
-                .status(401)
-                .type('html')
-                .send(loginPageHtml(hasAccounts, true, 'URL 中的 token 不正确，请手动输入。'));
+            res.status(401).type('html').send(loginPageHtml('URL 中的 token 不正确，请手动输入。'));
             return;
         }
-        // 2. 登录端点：{username, password}（账户）或 {token}（单人模式）
+        // 2. 登录端点：{token}
         if (url === '/api/auth/login' && req.method === 'POST') {
             const body = req.body ?? {};
-            if (typeof body.username === 'string' && typeof body.password === 'string') {
-                const username = body.username.trim();
-                if (checkLocked(username)) {
-                    res.status(429).json({ ok: false, error: '尝试次数过多，请稍后再试' });
-                    return;
-                }
-                if (username && (await accounts?.verify(username, body.password))) {
-                    failures.delete(username);
-                    res.setHeader('Set-Cookie', buildSetCookie(SESSION_COOKIE, newSession(username), cookieMaxAge));
-                    logger.info(`账户登录: webui:${username}`);
-                    res.json({ ok: true, identity: { platform: 'webui', userId: username } });
-                }
-                else {
-                    recordFailure(username);
-                    res.status(401).json({ ok: false, error: '用户名或密码不正确' });
-                }
-                return;
-            }
-            if (typeof body.token === 'string' && !tokenAllowed()) {
-                res.status(401).json({ ok: false, error: 'token 登录已禁用，请使用账户密码' });
-            }
-            else if (typeof body.token === 'string' && body.token === token) {
+            if (typeof body.token === 'string' && body.token === token) {
                 res.setHeader('Set-Cookie', buildSetCookie(TOKEN_COOKIE, token, cookieMaxAge));
                 res.json({ ok: true, identity: { platform: 'webui', userId: 'console' } });
             }
@@ -222,17 +114,14 @@ export function createAuthSystem(token, logger, accounts, tokenLogin = () => tru
             res.json({ authed: !!identity, identity });
             return;
         }
-        // 4. 注销：清 session 记录与两种 cookie
+        // 4. 注销：清 token cookie
         if (url === '/api/auth/logout' && req.method === 'POST') {
-            const sid = parseCookieValue(req.headers.cookie, SESSION_COOKIE);
-            if (sid)
-                sessions.delete(sid);
-            res.setHeader('Set-Cookie', [buildClearCookie(SESSION_COOKIE), buildClearCookie(TOKEN_COOKIE)]);
+            res.setHeader('Set-Cookie', buildClearCookie(TOKEN_COOKIE));
             res.json({ ok: true });
             return;
         }
         // 5. 已认证 → 放行
-        if (identify(req)) {
+        if (tokenAuthed(req)) {
             next();
             return;
         }
@@ -243,13 +132,13 @@ export function createAuthSystem(token, logger, accounts, tokenLogin = () => tru
         }
         // 7. 未认证 GET：返回内联登录页（覆盖 SPA shell，不暴露任何静态资源）
         if (req.method === 'GET') {
-            res.status(401).type('html').send(loginPageHtml(hasAccounts, tokenAllowed()));
+            res.status(401).type('html').send(loginPageHtml());
             return;
         }
         res.status(401).end();
     };
     function verifyWsClient(req) {
-        return !!identify(req);
+        return tokenAuthed(req);
     }
     return { middleware, verifyWsClient, identify };
 }

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAMA,MAAM,YAAY,GAAG,mBAAmB,CAAC;AACzC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAE7C,SAAS,gBAAgB,CAAC,MAA0B,EAAE,IAAY;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa,EAAE,SAAiB;IACpE,OAAO,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,gDAAgD,SAAS,EAAE,CAAC;AACzG,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,GAAG,IAAI,iDAAiD,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,WAAoB,EAAE,SAAkB,EAAE,MAAe;IAC9E,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,mBAAmB,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,YAAY,GAAG,SAAS;QAC5B,CAAC,CAAC;;;WAGK;QACP,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,WAAW,GAAG,WAAW;QAC7B,CAAC,CAAC;;;EAGJ,YAAY,EAAE;QACZ,CAAC,CAAC;;yCAEmC,CAAC;IACxC,OAAO;;;;;;;;;;;;;;;;;;;;;EAqBP,IAAI;EACJ,WAAW;;;;;;;;;;;;;;;;;;;;;wBAqBW,CAAC;AACzB,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;AACnH,CAAC;AAiCD,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,OAAO,GAAG,MAAM,CAAC;AAEvB;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAa,EACb,MAAc,EACd,QAA0B,EAC1B,aAA4B,GAAG,EAAE,CAAC,IAAI;IAEtC,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,mCAAmC;IACxE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmD,CAAC;IAC5E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAElD,0DAA0D;IAC1D,SAAS,YAAY;QACnB,OAAO,UAAU,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,KAAK,CAAC,CAAC;IAC7D,CAAC;IAED,SAAS,UAAU,CAAC,QAAgB;QAClC,oDAAoD;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,QAAQ;YAAE,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG;gBAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5E,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnF,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,GAAG,YAAY,GAAG,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,SAAS,WAAW,CAAC,GAAqC;QACxD,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAChE,IAAI,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC1B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzB,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,CAAC;IACpB,CAAC;IAED,SAAS,WAAW,CAAC,GAAqC;QACxD,IAAI,CAAC,YAAY,EAAE;YAAE,OAAO,KAAK,CAAC;QAClC,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,WAAW,IAAI,WAAW,KAAK,KAAK,CAAC;IAChD,CAAC;IAED,SAAS,QAAQ,CAAC,GAAqC;QACrD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,QAAQ;YAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC7D,IAAI,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,SAAS,WAAW,CAAC,QAAgB;QACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,IAAI,YAAY,IAAI,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5E,CAAC;IAED,SAAS,aAAa,CAAC,QAAgB;QACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACxC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;YACf,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAmB,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC1D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC;QACrB,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,KAAK,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,KAAK,CAAC,KAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9F,MAAM,WAAW,GAAG,QAAQ,EAAE,WAAW,EAAE,IAAI,KAAK,CAAC;QAErD,iDAAiD;QACjD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,IAAI,YAAY,EAAE,EAAE,CAAC;YACrD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,cAAc,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;gBAC/E,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,6BAA6B;YAC7B,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,kDAAkD;QAClD,IAAI,GAAG,KAAK,iBAAiB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACvD,MAAM,IAAI,GAAI,GAA2E,CAAC,IAAI,IAAI,EAAE,CAAC;YACrG,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACtC,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;oBAC3D,OAAO;gBACT,CAAC;gBACD,IAAI,QAAQ,IAAI,CAAC,MAAM,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;oBAClE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;oBAC1B,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,cAAc,CAAC,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;oBAChG,MAAM,CAAC,IAAI,CAAC,eAAe,QAAQ,EAAE,CAAC,CAAC;oBACvC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC5E,CAAC;qBAAM,CAAC;oBACN,aAAa,CAAC,QAAQ,CAAC,CAAC;oBACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC1D,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;gBACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACpE,CAAC;iBAAM,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAClE,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,cAAc,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;gBAC/E,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO;QACT,CAAC;QAED,yBAAyB;QACzB,IAAI,GAAG,KAAK,kBAAkB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACvD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,+BAA+B;QAC/B,IAAI,GAAG,KAAK,kBAAkB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACxD,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACjE,IAAI,GAAG;gBAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAChG,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QAED,cAAc;QACd,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,oBAAoB;QACpB,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,6CAA6C;QAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC;IAEF,SAAS,cAAc,CAAC,GAAoB;QAC1C,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,IAAoB;IAC3D,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,EAAE;YACpD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACrE,CAAC,CAAC;QACF,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,aAAa,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACxC,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAMA,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAEzC,SAAS,gBAAgB,CAAC,MAA0B,EAAE,IAAY;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa,EAAE,SAAiB;IACpE,OAAO,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,gDAAgD,SAAS,EAAE,CAAC;AACzG,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,GAAG,IAAI,iDAAiD,CAAC;AAClE,CAAC;AAED,0DAA0D;AAC1D,SAAS,aAAa,CAAC,MAAe;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,mBAAmB,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,OAAO;;;;;;;;;;;;;;;;;;;;;EAqBP,IAAI;;;;;;;;;;;;;;wBAckB,CAAC;AACzB,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;AACnH,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,OAAe;IAC7D,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,uBAAuB;IAE5D,SAAS,WAAW,CAAC,GAAqC;QACxD,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,WAAW,IAAI,WAAW,KAAK,KAAK,CAAC;IAChD,CAAC;IAED,SAAS,QAAQ,CAAC,GAAqC;QACrD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC;IAED,MAAM,UAAU,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC;QACrB,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,KAAK,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,KAAK,CAAC,KAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;QAE9F,iDAAiD;QACjD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,EAAE,CAAC;YACnC,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,cAAc,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;gBAC/E,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,kBAAkB;QAClB,IAAI,GAAG,KAAK,iBAAiB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACvD,MAAM,IAAI,GAAI,GAAqC,CAAC,IAAI,IAAI,EAAE,CAAC;YAC/D,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC3D,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,cAAc,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;gBAC/E,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO;QACT,CAAC;QAED,yBAAyB;QACzB,IAAI,GAAG,KAAK,kBAAkB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACvD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,uBAAuB;QACvB,IAAI,GAAG,KAAK,kBAAkB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACxD,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;YAC5D,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QAED,cAAc;QACd,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,oBAAoB;QACpB,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,6CAA6C;QAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC;IAEF,SAAS,cAAc,CAAC,GAAoB;QAC1C,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,IAAoB;IAC3D,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,EAAE;YACpD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACrE,CAAC,CAAC;QACF,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,aAAa,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACxC,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC"}

package/dist/client-discovery.d.ts

@@ -20,5 +20,13 @@ export interface DiscoveryEnv {
  * 默认活跃前端由调用方按 config 或「排序后第一个」决定——本函数不做偏好判断、不认任何具体名字。
  */
 export declare function discoverClients(scanDirs: string[], depIds: string[], env: DiscoveryEnv): ClientCandidate[];
+/**
+ * 扫描本地物理存在的包 → `name → 依赖名[]`（与 discoverClients 共用 scanDirs/env）。
+ * 两用，一次扫盘：① keys 即「本地已装包名」，补市场已装判定（require.resolve 在 pnpm 工作区
+ * 从仓库根解析不到未提升的工作区包）；② values 即各包 `dependencies/peer/optional` 的并集名单，
+ * 供依赖图（谁依赖谁）。**只取依赖名、不看版本区间**（`workspace:^`/`^1.0.0` 一律按名），故无需 semver。
+ * scope 无关（不挑 @aalis）。纯函数便于单测。
+ */
+export declare function collectLocalPackageDeps(scanDirs: string[], env: Pick<DiscoveryEnv, 'existsSync' | 'readdirSync' | 'readJson' | 'join'>): Map<string, string[]>;
 export {};
 //# sourceMappingURL=client-discovery.d.ts.map

package/dist/client-discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-discovery.d.ts","sourceRoot":"","sources":["../src/client-discovery.ts"],"names":[],"mappings":"AAMA,UAAU,eAAe;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,qBAAqB;IACrB,WAAW,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACrC,oCAAoC;IACpC,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IACjC,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/B,mDAAmD;IACnD,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CACpD;AASD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,YAAY,GAAG,eAAe,EAAE,CA2B1G"}
+{"version":3,"file":"client-discovery.d.ts","sourceRoot":"","sources":["../src/client-discovery.ts"],"names":[],"mappings":"AAMA,UAAU,eAAe;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,qBAAqB;IACrB,WAAW,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACrC,oCAAoC;IACpC,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IACjC,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/B,mDAAmD;IACnD,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CACpD;AASD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,YAAY,GAAG,eAAe,EAAE,CA2B1G;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAAE,EAClB,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,GAAG,aAAa,GAAG,UAAU,GAAG,MAAM,CAAC,GAC1E,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAuBvB"}

package/dist/client-discovery.js

@@ -38,4 +38,30 @@ export function discoverClients(scanDirs, depIds, env) {
         consider(env.resolvePkgJson(id));
     return out.sort((a, b) => a.id.localeCompare(b.id));
 }
+/**
+ * 扫描本地物理存在的包 → `name → 依赖名[]`（与 discoverClients 共用 scanDirs/env）。
+ * 两用，一次扫盘：① keys 即「本地已装包名」，补市场已装判定（require.resolve 在 pnpm 工作区
+ * 从仓库根解析不到未提升的工作区包）；② values 即各包 `dependencies/peer/optional` 的并集名单，
+ * 供依赖图（谁依赖谁）。**只取依赖名、不看版本区间**（`workspace:^`/`^1.0.0` 一律按名），故无需 semver。
+ * scope 无关（不挑 @aalis）。纯函数便于单测。
+ */
+export function collectLocalPackageDeps(scanDirs, env) {
+    const out = new Map();
+    for (const base of scanDirs) {
+        if (!env.existsSync(base))
+            continue;
+        for (const entry of env.readdirSync(base)) {
+            const pkg = env.readJson(env.join(base, entry, 'package.json'));
+            if (!pkg || typeof pkg.name !== 'string')
+                continue;
+            const deps = new Set([
+                ...Object.keys(pkg.dependencies ?? {}),
+                ...Object.keys(pkg.peerDependencies ?? {}),
+                ...Object.keys(pkg.optionalDependencies ?? {}),
+            ]);
+            out.set(pkg.name, [...deps]);
+        }
+    }
+    return out;
+}
 //# sourceMappingURL=client-discovery.js.map

package/dist/client-discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-discovery.js","sourceRoot":"","sources":["../src/client-discovery.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,EAAE;AACF,0EAA0E;AAC1E,2DAA2D;AAC3D,8EAA8E;AA2B9E;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,QAAkB,EAAE,MAAgB,EAAE,GAAiB;IACrF,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,MAAM,QAAQ,GAAG,CAAC,WAA+B,EAAQ,EAAE;QACzD,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO;QACzD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAwB,CAAC;QAC7D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QACrG,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAE,OAAO;QACzD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,KAAK,GACT,CAAC,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC;YACxD,CAAC,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC;QACX,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,kEAAkE;IAClE,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACpC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,wDAAwD;IACxD,KAAK,MAAM,EAAE,IAAI,MAAM;QAAE,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC;IAE1D,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC"}
+{"version":3,"file":"client-discovery.js","sourceRoot":"","sources":["../src/client-discovery.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,EAAE;AACF,0EAA0E;AAC1E,2DAA2D;AAC3D,8EAA8E;AA2B9E;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,QAAkB,EAAE,MAAgB,EAAE,GAAiB;IACrF,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,MAAM,QAAQ,GAAG,CAAC,WAA+B,EAAQ,EAAE;QACzD,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO;QACzD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAwB,CAAC;QAC7D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QACrG,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAE,OAAO;QACzD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,KAAK,GACT,CAAC,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC;YACxD,CAAC,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC;QACX,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,kEAAkE;IAClE,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACpC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,wDAAwD;IACxD,KAAK,MAAM,EAAE,IAAI,MAAM;QAAE,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC;IAE1D,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAkB,EAClB,GAA2E;IAE3E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAoB,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACpC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,CAOjD,CAAC;YACd,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;gBAAE,SAAS;YACnD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS;gBAC3B,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;gBACtC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC;gBAC1C,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC;aAC/C,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/client-switch-page.d.ts

@@ -0,0 +1,3 @@
+/** 渲染前端切换恢复页的完整 HTML 文档（无运行时入参，数据由页面自身 fetch）。 */
+export declare function renderClientSwitchPage(): string;
+//# sourceMappingURL=client-switch-page.d.ts.map

package/dist/client-switch-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-switch-page.d.ts","sourceRoot":"","sources":["../src/client-switch-page.ts"],"names":[],"mappings":"AAYA,kDAAkD;AAClD,wBAAgB,sBAAsB,IAAI,MAAM,CA4F/C"}

package/dist/client-switch-page.js

@@ -0,0 +1,106 @@
+// 前端切换「逃生页」——由 webui-server 直出的极简恢复页，独立于任何「可被切换的前端」。
+//
+// 背景：前端切换统一走「服务偏好」下拉框，而该下拉框住在前端里。一旦切到不含该 UI 的极简
+// 前端（如第三方裸前端），就没有切回去的入口（只能改 aalis.config.yaml + 重启）。本页由
+// webui-server 直接托管在 `/__clients`，无论当前活跃前端多裸都可达，是「永不卡死」的恢复入口。
+//
+// 零新增后端逻辑：纯静态 HTML + 同源 fetch 复用既有接口（同源 cookie 自动鉴权）——
+//   · 列表：GET  /api/services                       （取 webui-client 服务的 providers + preferred）
+//   · 切换：POST /api/services/webui-client/prefer    （owner 闸，body {contextId}）
+// 全局 auth 中间件已要求登录方可到达本路由（未认证 GET 直接回登录页），故本页无需自加 gate；
+// 切换动作仍受既有 owner 闸约束。抽成纯函数仅为便于单测——route 只 res.type('html').send(它)。
+/** 渲染前端切换恢复页的完整 HTML 文档（无运行时入参，数据由页面自身 fetch）。 */
+export function renderClientSwitchPage() {
+    return `<!doctype html>
+<html lang="zh-CN">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>切换前端 · Aalis</title>
+<style>
+  :root { color-scheme: light dark; }
+  body { font: 15px/1.6 system-ui, -apple-system, sans-serif; max-width: 32rem; margin: 8vh auto; padding: 0 1.2rem; }
+  h1 { font-size: 1.25rem; margin: 0 0 .25rem; }
+  p.hint { color: #888; margin: .25rem 0 1.25rem; }
+  label { display: block; font-weight: 600; margin-bottom: .4rem; }
+  select, button { font: inherit; padding: .55rem .7rem; border-radius: .5rem; }
+  select { width: 100%; box-sizing: border-box; }
+  button { margin-top: 1rem; cursor: pointer; border: 1px solid currentColor; background: transparent; }
+  button:disabled { opacity: .5; cursor: default; }
+  #msg { margin-top: 1rem; min-height: 1.4em; }
+  #msg.err { color: #c0392b; }
+  #msg.ok { color: #2e7d32; }
+  code { font-family: ui-monospace, monospace; }
+</style>
+</head>
+<body>
+  <h1>切换前端</h1>
+  <p class="hint">这是 Aalis 的前端恢复入口，由 webui-server 直接提供、独立于当前前端——即使当前前端没有切换界面，你也能在这里切回去。</p>
+  <label for="client">可用前端（webui-client）</label>
+  <select id="client"><option>加载中…</option></select>
+  <button id="go" type="button">切换并刷新</button>
+  <div id="msg"></div>
+  <p class="hint">切回原来的前端：在上面选中它，再点「切换并刷新」。</p>
+<script>
+(function () {
+  var SVC = 'webui-client';
+  var PREFER = '/api/services/' + SVC + '/prefer';
+  var sel = document.getElementById('client');
+  var btn = document.getElementById('go');
+  var msg = document.getElementById('msg');
+  function setMsg(t, err) { msg.textContent = t; msg.className = err ? 'err' : 'ok'; }
+  function load() {
+    fetch('/api/services', { headers: { Accept: 'application/json' } })
+      .then(function (r) {
+        if (!r.ok) throw new Error('读取服务列表失败（HTTP ' + r.status + '）');
+        return r.json();
+      })
+      .then(function (data) {
+        var svc = data && data.services && data.services[SVC];
+        var providers = (svc && svc.providers) || [];
+        if (!providers.length) {
+          setMsg('未发现任何前端（webui-client provider）。请先安装一个 aalis.client 包。', true);
+          btn.disabled = true;
+          sel.innerHTML = '';
+          return;
+        }
+        var active = (svc && svc.preferred) || providers[0].contextId;
+        sel.innerHTML = '';
+        providers.forEach(function (p) {
+          var o = document.createElement('option');
+          o.value = p.contextId;
+          o.textContent = (p.displayName || p.label || p.contextId) + (p.contextId === active ? '（当前）' : '');
+          if (p.contextId === active) o.selected = true;
+          sel.appendChild(o);
+        });
+      })
+      .catch(function (e) { setMsg(String((e && e.message) || e), true); });
+  }
+  btn.addEventListener('click', function () {
+    var contextId = sel.value;
+    if (!contextId) return;
+    btn.disabled = true;
+    setMsg('切换中…', false);
+    fetch(PREFER, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ contextId: contextId })
+    })
+      .then(function (r) {
+        if (r.ok) { setMsg('已切换，正在跳转…', false); location.href = '/'; return; }
+        return r.json().catch(function () { return {}; }).then(function (j) {
+          var detail = (j && j.error) || ('HTTP ' + r.status);
+          var hint = (r.status === 401 || r.status === 403) ? '（需要 owner 权限：请用一键登录链接打开 WebUI 后再试）' : '';
+          setMsg('切换失败：' + detail + hint, true);
+          btn.disabled = false;
+        });
+      })
+      .catch(function (e) { setMsg('切换请求出错：' + String((e && e.message) || e), true); btn.disabled = false; });
+  });
+  load();
+})();
+</script>
+</body>
+</html>`;
+}
+//# sourceMappingURL=client-switch-page.js.map

package/dist/client-switch-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-switch-page.js","sourceRoot":"","sources":["../src/client-switch-page.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,EAAE;AACF,gDAAgD;AAChD,wDAAwD;AACxD,8DAA8D;AAC9D,EAAE;AACF,uDAAuD;AACvD,6FAA6F;AAC7F,8EAA8E;AAC9E,wDAAwD;AACxD,oEAAoE;AAEpE,kDAAkD;AAClD,MAAM,UAAU,sBAAsB;IACpC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA0FD,CAAC;AACT,CAAC"}

package/dist/gate.d.ts

@@ -1,5 +1,4 @@
-import type { Context } from '@aalis/core';
-import type { CapabilityVisibility, UserIdentity } from '@aalis/plugin-authority-api';
+import type { UserIdentity } from '@aalis/plugin-authority-api';
 /** 从请求解析调用者身份（auth.ts 的 AuthSystem.identify） */
 type IdentifyFn = (req: {
     headers: {
@@ -18,22 +17,17 @@ interface GateResponse {
 }
 type GateMiddleware = (req: GateRequest, res: GateResponse, next: () => void) => void;
 /**
- * REST 路由能力闸工厂。
+ * REST 路由 owner 闸工厂（单 owner 终态）。
  *
- * 连接级认证（auth middleware）只回答"是否登录"；本闸回答"该身份能否做这件事"——
- * 每条 REST 路由声明一个 capability 与默认可见性，过 authorize 统一闸
- * （deny > owner(*) > public > granted）。owner 拥有一切；可对单账户 grant 某条
- * restricted capability（如 `webui:files:read`）做细粒度委托。
+ * 单 token 模式下「持 token ⟺ webui:console ⟺ owner」，故连接级认证（auth.middleware
+ * 校验 token，未认证一律 401）即等价于 owner 鉴权。本闸是 REST 层的显式 owner 复核
+ * （防御纵深，与 auth.middleware 同义）：身份解析得到即放行，否则 403。
  *
- * 可见性约定（颗粒度由 capability 字符串本身承载，owner 之外的细分靠委托 grant）：
- * - 'public'：公共读（status / pages / 模型列表等，聊天面板可用即可）。
- * - 'restricted'：管理读（插件清单含原始配置、日志、文件浏览——可能含密钥）与
- *   一切变更操作（配置写、插件启停装卸、服务偏好、文件删改）；默认禁，须 owner /
- *   被委托授予。
- *
- * authority 服务缺席时：public 放行、restricted 503（fail-closed，不在权限服务缺位时裸奔）。
+ * 多账户 / 能力委托已剥离，故不再有 per-route capability 与档位裁决——所有需登录的
+ * REST 路由统一是 owner-only。页面/状态等只读路由同样在 auth.middleware 之后，对
+ * 单 owner 无区别。
  */
-export declare function createRouteGate(ctx: Context, identify: IdentifyFn): (capability: string, visibility: CapabilityVisibility) => GateMiddleware;
+export declare function createRouteGate(identify: IdentifyFn): () => GateMiddleware;
 /** createRouteGate 返回的闸生成函数类型（传给各 routes/ 注册器） */
 export type RouteGate = ReturnType<typeof createRouteGate>;
 export {};

package/dist/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAoB,oBAAoB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAExG,gDAAgD;AAChD,KAAK,UAAU,GAAG,CAAC,GAAG,EAAE;IAAE,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,KAAK,YAAY,GAAG,SAAS,CAAC;AAKtF,UAAU,WAAW;IACnB,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9B;AACD,UAAU,YAAY;IACpB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAA;KAAE,CAAC;CACxD;AACD,KAAK,cAAc,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;AAEtF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,IACxD,YAAY,MAAM,EAAE,YAAY,oBAAoB,KAAG,cAAc,CAqB9E;AAED,kDAAkD;AAClD,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE,gDAAgD;AAChD,KAAK,UAAU,GAAG,CAAC,GAAG,EAAE;IAAE,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,KAAK,YAAY,GAAG,SAAS,CAAC;AAKtF,UAAU,WAAW;IACnB,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9B;AACD,UAAU,YAAY;IACpB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAA;KAAE,CAAC;CACxD;AACD,KAAK,cAAc,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;AAEtF;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,UAAU,SACvC,cAAc,CAO1B;AAED,kDAAkD;AAClD,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/gate.js

@@ -1,36 +1,18 @@
 /**
- * REST 路由能力闸工厂。
+ * REST 路由 owner 闸工厂（单 owner 终态）。
  *
- * 连接级认证（auth middleware）只回答"是否登录"；本闸回答"该身份能否做这件事"——
- * 每条 REST 路由声明一个 capability 与默认可见性，过 authorize 统一闸
- * （deny > owner(*) > public > granted）。owner 拥有一切；可对单账户 grant 某条
- * restricted capability（如 `webui:files:read`）做细粒度委托。
+ * 单 token 模式下「持 token ⟺ webui:console ⟺ owner」，故连接级认证（auth.middleware
+ * 校验 token，未认证一律 401）即等价于 owner 鉴权。本闸是 REST 层的显式 owner 复核
+ * （防御纵深，与 auth.middleware 同义）：身份解析得到即放行，否则 403。
  *
- * 可见性约定（颗粒度由 capability 字符串本身承载，owner 之外的细分靠委托 grant）：
- * - 'public'：公共读（status / pages / 模型列表等，聊天面板可用即可）。
- * - 'restricted'：管理读（插件清单含原始配置、日志、文件浏览——可能含密钥）与
- *   一切变更操作（配置写、插件启停装卸、服务偏好、文件删改）；默认禁，须 owner /
- *   被委托授予。
- *
- * authority 服务缺席时：public 放行、restricted 503（fail-closed，不在权限服务缺位时裸奔）。
+ * 多账户 / 能力委托已剥离，故不再有 per-route capability 与档位裁决——所有需登录的
+ * REST 路由统一是 owner-only。页面/状态等只读路由同样在 auth.middleware 之后，对
+ * 单 owner 无区别。
  */
-export function createRouteGate(ctx, identify) {
-    return (capability, visibility) => (req, res, next) => {
-        const authority = ctx.getService('authority');
-        if (!authority) {
-            // authority 缺席（未配置/启动失败/bounce 窗口期）→ 无法裁决。
-            // 公共读放行，受限操作 503（区别于 403：服务暂不可用，非权限不足）。
-            if (visibility === 'restricted') {
-                res.status(503).json({ error: '权限服务不可用，受限操作暂时被拒绝' });
-                return;
-            }
-            next();
-            return;
-        }
-        const caller = identify(req) ?? { platform: 'webui', userId: 'console' };
-        const denied = authority.authorize(caller, { capability, visibility });
-        if (denied) {
-            res.status(403).json({ error: denied });
+export function createRouteGate(identify) {
+    return () => (req, res, next) => {
+        if (!identify(req)) {
+            res.status(403).json({ error: '需要 owner 权限' });
             return;
         }
         next();