@ai0x0/utils 0.8.0 → 0.10.0

package/.agents/skills/antd/SKILL.md

@@ -239,7 +239,6 @@ setState({ open: false, current: undefined });
 
 - `require-use-form`：受控表单字段必须交给 Form 管理。
 - `require-form-convention`：Form/onFinish/rules/Modal 提交/错误提示约定。
-- `require-pro-components`：ModalForm、ProForm 字段和 submitter 约定。
 - `no-hardcoded-style`：token 样式约定。
 - `no-antd-space`：Flex 替代 Space。
 - `no-use-request-run`：`runAsync` 替代 `run`。

package/.agents/skills/nextjs/SKILL.md

@@ -235,9 +235,9 @@ ESLint 按行数强制分区数量：
 - `ai0x0/no-antd-space`：禁止 `<Space>` / `<Space.Compact>`，使用 `<Flex>`。
 - `ai0x0/require-use-form`：表单字段状态不能用 `useState` / `useSetState` 管。
 - `ai0x0/require-form-convention`：Form 必须 `onFinish`，字段必须 rules，禁止 Modal.onOk 提交。
-- `ai0x0/require-pro-components`：业务表单优先 ProComponents。
 - `ai0x0/no-use-request-run`：禁止解构 `run`，使用 `runAsync` 并在调用处 `await`。
 - `ai0x0/no-consecutive-setstate`：连续 `setState({ ... })` 要合并成一次。
+- scoped（不进 recommended，项目自行按 files 开启）：`ai0x0/api-route-via-nrf`、`ai0x0/no-direct-api-url`、`ai0x0/no-hardcoded-text`（i18n 裸文案闸，legacy 旧账名单经选项传入）。
 
 ## 常用命令
 

package/README.md

@@ -110,7 +110,6 @@ export default [
 | `no-one-letter-vars`      | Forbid single-letter variable names                                     |
 | `no-then`                 | Prefer `async/await` over `.then()`                                     |
 | `no-antd-space`           | Use `<Flex>` instead of `<Space>`                                       |
-| `require-pro-components`  | Require ProComponents usage                                             |
 | `require-section-divider` | Large files need `===` comment dividers                                 |
 | `no-consecutive-setstate` | Merge consecutive `setState` calls                                      |
 | `no-use-request-run`      | Forbid `useRequest.run()`                                               |
@@ -118,6 +117,8 @@ export default [
 | `require-form-convention` | Form naming conventions                                                 |
 | `max-lines`               | Limit each file to 500 code lines and prompt splitting into child files |
 
+Scoped rules (not in `recommended`; enable per-file-glob in your own config): `api-route-via-nrf`, `no-direct-api-url`, `no-hardcoded-text` (i18n hardcoded-text gate with a `legacy` exemption list).
+
 ### Shared restrictions (`eslint-config/`)
 
 Pre-defined `no-restricted-syntax` selectors for antd + ahooks convention enforcement:
@@ -147,7 +148,7 @@ export default [
 ];
 ```
 
-Restrictions cover: `TryStatement`, `as` (non-const), `useState`, `useEffect`, `useMemo`, `useCallback`, native `div/span/p/h` tags, hardcoded colors, `fetch` and `new WebSocket()`.
+Restrictions cover: `TryStatement`, `as` (non-const), `useState`, `useEffect`, `useMemo`, `useCallback`, `memo()`, native `div/span/p/h` tags, hardcoded colors, `fetch` and `new WebSocket()`.
 
 ## Installation
 

package/SKILL.md

@@ -317,6 +317,8 @@ export const { GET } = route({
 - **Fail closed**: if the session is missing → 401; if `scope.value` returns empty → 403. A scope that cannot be resolved is **never** downgraded to "no filter". PUT/DELETE put the scope straight into the `UPDATE`/`DELETE` `where` (one statement, no read-then-write window) and return 404 when it affects zero rows — "does not exist" and "not yours" are deliberately indistinguishable, otherwise the endpoint becomes an existence oracle.
 - **Auto injection**: POST stamps the scope column with the scope value (by default that is `creatorId = session.userId`); PUT writes `editorId = session.userId`; GET/GET_LIST apply the scope as a mandatory `where`.
 - **Session shape** is yours: `getSession` is generic, so resolve "who + which space + what role" once and let `scope.value` / `can` read the same object instead of each querying again.
+- **Built-in error copy** (`未登录` / `没有权限` / `缺少 id` / `未找到编辑(删除)对象，或没有权限` / scope-unresolved 403): thrown from inside the library, so the app's own i18n throw-sites never see them. Register `setHttpErrorMessageResolver(() => ({ unauthenticated: t("..."), ... }))` once at app startup to translate them per request — the resolver may be `async` (e.g. resolving the locale from `next/headers`), is called lazily at each throw site, and falls back to the Chinese defaults when absent or when it throws. Deliberately string-based, not error-code-based: CLI and agent consumers read these messages too and have no translation layer.
+
 - **Date coercion**: any body field ending in `At` is passed through `dayjs(value).toDate()` before write — accept ISO strings from clients.
 - **List filtering** (all querystring values are strings). **A column is filterable only if it appears in `schemas.response`** — the filter surface is the readable surface, so a list that returns `id / title` cannot be probed with `?secret=…` (unknown or unreadable keys are ignored, not rejected). Anything you want filterable belongs in the response schema.
   - `key=a,b,c` → `IN (...)` when the key is `id` or ends with `Id`; otherwise `OR ILIKE %a% OR ILIKE %b%`

package/es/backend/actions/write-action-core.js

@@ -26,7 +26,7 @@ function _asyncToGenerator(fn) { return function () { var self = this, args = ar
 
 import { and, eq } from "drizzle-orm";
 import { NO_SCOPE, scopeCondition } from "../scope.js";
-import { HttpError } from "../errors.js";
+import { HttpError, httpErrorMessages } from "../errors.js";
 import { transformBody } from "./transform-body.js";
 
 /** 核心用得到表的哪一部分：只有 id。dialect 各自的 Table 类型不进来。 */
@@ -49,25 +49,35 @@ export function createPutActionCore(_ref) {
             scope = _ref2.scope;
             id = body.id;
             if (id) {
-              _context.next = 4;
+              _context.next = 8;
               break;
             }
-            throw new HttpError(400, "缺少 id");
-          case 4:
+            _context.t0 = HttpError;
             _context.next = 6;
-            return db.update(table).set(transformBody(body)).where(byId(table, id, scope)).returning();
+            return httpErrorMessages();
           case 6:
+            _context.t1 = _context.sent.missingId;
+            throw new _context.t0(400, _context.t1);
+          case 8:
+            _context.next = 10;
+            return db.update(table).set(transformBody(body)).where(byId(table, id, scope)).returning();
+          case 10:
             _yield$db$update$set$ = _context.sent;
             _yield$db$update$set$2 = _slicedToArray(_yield$db$update$set$, 1);
             data = _yield$db$update$set$2[0];
             if (!(!data && scope !== NO_SCOPE)) {
-              _context.next = 11;
+              _context.next = 19;
               break;
             }
-            throw new HttpError(404, "未找到编辑对象，或没有权限");
-          case 11:
+            _context.t2 = HttpError;
+            _context.next = 17;
+            return httpErrorMessages();
+          case 17:
+            _context.t3 = _context.sent.editNotFound;
+            throw new _context.t2(404, _context.t3);
+          case 19:
             return _context.abrupt("return", data);
-          case 12:
+          case 20:
           case "end":
             return _context.stop();
         }
@@ -90,23 +100,33 @@ export function createDeleteActionCore(_ref4) {
             id = _ref5.id;
             scope = _ref6.scope;
             if (id) {
-              _context2.next = 4;
+              _context2.next = 8;
               break;
             }
-            throw new HttpError(400, "缺少 id");
-          case 4:
+            _context2.t0 = HttpError;
             _context2.next = 6;
-            return db.delete(table).where(byId(table, id, scope)).returning();
+            return httpErrorMessages();
           case 6:
+            _context2.t1 = _context2.sent.missingId;
+            throw new _context2.t0(400, _context2.t1);
+          case 8:
+            _context2.next = 10;
+            return db.delete(table).where(byId(table, id, scope)).returning();
+          case 10:
             rows = _context2.sent;
             if (!(rows.length === 0 && scope !== NO_SCOPE)) {
-              _context2.next = 9;
+              _context2.next = 17;
               break;
             }
-            throw new HttpError(404, "未找到删除对象，或没有权限");
-          case 9:
+            _context2.t2 = HttpError;
+            _context2.next = 15;
+            return httpErrorMessages();
+          case 15:
+            _context2.t3 = _context2.sent.deleteNotFound;
+            throw new _context2.t2(404, _context2.t3);
+          case 17:
             return _context2.abrupt("return", rows);
-          case 10:
+          case 18:
           case "end":
             return _context2.stop();
         }

package/es/backend/errors.d.ts

@@ -2,3 +2,33 @@ export declare class HttpError extends Error {
     status: number;
     constructor(status: number, message: string);
 }
+export interface HttpErrorMessages {
+    /** 401：会话不存在。 */
+    unauthenticated: string;
+    /** 403：access.can 拒绝且没给自定义文案。 */
+    forbidden: string;
+    /** 400：PUT / DELETE 请求体缺 id。 */
+    missingId: string;
+    /** 404：PUT 影响 0 行（不存在或不属于调用者）。 */
+    editNotFound: string;
+    /** 404：DELETE 影响 0 行。 */
+    deleteNotFound: string;
+    /** 403：作用域值解析不出来 —— 多半是配错了列名，但请求照样要被拒绝。 */
+    scopeUnresolved: (column: string) => string;
+}
+export declare const defaultHttpErrorMessages: HttpErrorMessages;
+type HttpErrorMessageResolver = () => Partial<HttpErrorMessages> | Promise<Partial<HttpErrorMessages>>;
+/**
+ * 注册文案解析器，应用启动时调一次（再次调用覆盖；传 undefined 恢复默认）。
+ * 不注册就一直是 defaultHttpErrorMessages 那几句中文 —— 没做国际化的项目零感知。
+ */
+export declare function setHttpErrorMessageResolver(next: HttpErrorMessageResolver | undefined): void;
+/**
+ * 取出当前生效的整份文案。**在抛出点现调**，别在模块顶层缓存 —— 解析器是按请求判
+ * 语言的，缓存住就把上一个请求的语言漏给下一个。
+ *
+ * 解析器自己抛了错（比如语言包没加载到）就回落默认中文：报错文案出不来不该把
+ * 原本那个 401/403 也吞掉。
+ */
+export declare function httpErrorMessages(): Promise<HttpErrorMessages>;
+export {};

package/es/backend/errors.js

@@ -1,4 +1,9 @@
+function _regeneratorRuntime() { "use strict"; /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/facebook/regenerator/blob/main/LICENSE */ _regeneratorRuntime = function _regeneratorRuntime() { return e; }; var t, e = {}, r = Object.prototype, n = r.hasOwnProperty, o = Object.defineProperty || function (t, e, r) { t[e] = r.value; }, i = "function" == typeof Symbol ? Symbol : {}, a = i.iterator || "@@iterator", c = i.asyncIterator || "@@asyncIterator", u = i.toStringTag || "@@toStringTag"; function define(t, e, r) { return Object.defineProperty(t, e, { value: r, enumerable: !0, configurable: !0, writable: !0 }), t[e]; } try { define({}, ""); } catch (t) { define = function define(t, e, r) { return t[e] = r; }; } function wrap(t, e, r, n) { var i = e && e.prototype instanceof Generator ? e : Generator, a = Object.create(i.prototype), c = new Context(n || []); return o(a, "_invoke", { value: makeInvokeMethod(t, r, c) }), a; } function tryCatch(t, e, r) { try { return { type: "normal", arg: t.call(e, r) }; } catch (t) { return { type: "throw", arg: t }; } } e.wrap = wrap; var h = "suspendedStart", l = "suspendedYield", f = "executing", s = "completed", y = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} var p = {}; define(p, a, function () { return this; }); var d = Object.getPrototypeOf, v = d && d(d(values([]))); v && v !== r && n.call(v, a) && (p = v); var g = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(p); function defineIteratorMethods(t) { ["next", "throw", "return"].forEach(function (e) { define(t, e, function (t) { return this._invoke(e, t); }); }); } function AsyncIterator(t, e) { function invoke(r, o, i, a) { var c = tryCatch(t[r], t, o); if ("throw" !== c.type) { var u = c.arg, h = u.value; return h && "object" == _typeof(h) && n.call(h, "__await") ? e.resolve(h.__await).then(function (t) { invoke("next", t, i, a); }, function (t) { invoke("throw", t, i, a); }) : e.resolve(h).then(function (t) { u.value = t, i(u); }, function (t) { return invoke("throw", t, i, a); }); } a(c.arg); } var r; o(this, "_invoke", { value: function value(t, n) { function callInvokeWithMethodAndArg() { return new e(function (e, r) { invoke(t, n, e, r); }); } return r = r ? r.then(callInvokeWithMethodAndArg, callInvokeWithMethodAndArg) : callInvokeWithMethodAndArg(); } }); } function makeInvokeMethod(e, r, n) { var o = h; return function (i, a) { if (o === f) throw new Error("Generator is already running"); if (o === s) { if ("throw" === i) throw a; return { value: t, done: !0 }; } for (n.method = i, n.arg = a;;) { var c = n.delegate; if (c) { var u = maybeInvokeDelegate(c, n); if (u) { if (u === y) continue; return u; } } if ("next" === n.method) n.sent = n._sent = n.arg;else if ("throw" === n.method) { if (o === h) throw o = s, n.arg; n.dispatchException(n.arg); } else "return" === n.method && n.abrupt("return", n.arg); o = f; var p = tryCatch(e, r, n); if ("normal" === p.type) { if (o = n.done ? s : l, p.arg === y) continue; return { value: p.arg, done: n.done }; } "throw" === p.type && (o = s, n.method = "throw", n.arg = p.arg); } }; } function maybeInvokeDelegate(e, r) { var n = r.method, o = e.iterator[n]; if (o === t) return r.delegate = null, "throw" === n && e.iterator.return && (r.method = "return", r.arg = t, maybeInvokeDelegate(e, r), "throw" === r.method) || "return" !== n && (r.method = "throw", r.arg = new TypeError("The iterator does not provide a '" + n + "' method")), y; var i = tryCatch(o, e.iterator, r.arg); if ("throw" === i.type) return r.method = "throw", r.arg = i.arg, r.delegate = null, y; var a = i.arg; return a ? a.done ? (r[e.resultName] = a.value, r.next = e.nextLoc, "return" !== r.method && (r.method = "next", r.arg = t), r.delegate = null, y) : a : (r.method = "throw", r.arg = new TypeError("iterator result is not an object"), r.delegate = null, y); } function pushTryEntry(t) { var e = { tryLoc: t[0] }; 1 in t && (e.catchLoc = t[1]), 2 in t && (e.finallyLoc = t[2], e.afterLoc = t[3]), this.tryEntries.push(e); } function resetTryEntry(t) { var e = t.completion || {}; e.type = "normal", delete e.arg, t.completion = e; } function Context(t) { this.tryEntries = [{ tryLoc: "root" }], t.forEach(pushTryEntry, this), this.reset(!0); } function values(e) { if (e || "" === e) { var r = e[a]; if (r) return r.call(e); if ("function" == typeof e.next) return e; if (!isNaN(e.length)) { var o = -1, i = function next() { for (; ++o < e.length;) if (n.call(e, o)) return next.value = e[o], next.done = !1, next; return next.value = t, next.done = !0, next; }; return i.next = i; } } throw new TypeError(_typeof(e) + " is not iterable"); } return GeneratorFunction.prototype = GeneratorFunctionPrototype, o(g, "constructor", { value: GeneratorFunctionPrototype, configurable: !0 }), o(GeneratorFunctionPrototype, "constructor", { value: GeneratorFunction, configurable: !0 }), GeneratorFunction.displayName = define(GeneratorFunctionPrototype, u, "GeneratorFunction"), e.isGeneratorFunction = function (t) { var e = "function" == typeof t && t.constructor; return !!e && (e === GeneratorFunction || "GeneratorFunction" === (e.displayName || e.name)); }, e.mark = function (t) { return Object.setPrototypeOf ? Object.setPrototypeOf(t, GeneratorFunctionPrototype) : (t.__proto__ = GeneratorFunctionPrototype, define(t, u, "GeneratorFunction")), t.prototype = Object.create(g), t; }, e.awrap = function (t) { return { __await: t }; }, defineIteratorMethods(AsyncIterator.prototype), define(AsyncIterator.prototype, c, function () { return this; }), e.AsyncIterator = AsyncIterator, e.async = function (t, r, n, o, i) { void 0 === i && (i = Promise); var a = new AsyncIterator(wrap(t, r, n, o), i); return e.isGeneratorFunction(r) ? a : a.next().then(function (t) { return t.done ? t.value : a.next(); }); }, defineIteratorMethods(g), define(g, u, "Generator"), define(g, a, function () { return this; }), define(g, "toString", function () { return "[object Generator]"; }), e.keys = function (t) { var e = Object(t), r = []; for (var n in e) r.push(n); return r.reverse(), function next() { for (; r.length;) { var t = r.pop(); if (t in e) return next.value = t, next.done = !1, next; } return next.done = !0, next; }; }, e.values = values, Context.prototype = { constructor: Context, reset: function reset(e) { if (this.prev = 0, this.next = 0, this.sent = this._sent = t, this.done = !1, this.delegate = null, this.method = "next", this.arg = t, this.tryEntries.forEach(resetTryEntry), !e) for (var r in this) "t" === r.charAt(0) && n.call(this, r) && !isNaN(+r.slice(1)) && (this[r] = t); }, stop: function stop() { this.done = !0; var t = this.tryEntries[0].completion; if ("throw" === t.type) throw t.arg; return this.rval; }, dispatchException: function dispatchException(e) { if (this.done) throw e; var r = this; function handle(n, o) { return a.type = "throw", a.arg = e, r.next = n, o && (r.method = "next", r.arg = t), !!o; } for (var o = this.tryEntries.length - 1; o >= 0; --o) { var i = this.tryEntries[o], a = i.completion; if ("root" === i.tryLoc) return handle("end"); if (i.tryLoc <= this.prev) { var c = n.call(i, "catchLoc"), u = n.call(i, "finallyLoc"); if (c && u) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } else if (c) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); } else { if (!u) throw new Error("try statement without catch or finally"); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } } } }, abrupt: function abrupt(t, e) { for (var r = this.tryEntries.length - 1; r >= 0; --r) { var o = this.tryEntries[r]; if (o.tryLoc <= this.prev && n.call(o, "finallyLoc") && this.prev < o.finallyLoc) { var i = o; break; } } i && ("break" === t || "continue" === t) && i.tryLoc <= e && e <= i.finallyLoc && (i = null); var a = i ? i.completion : {}; return a.type = t, a.arg = e, i ? (this.method = "next", this.next = i.finallyLoc, y) : this.complete(a); }, complete: function complete(t, e) { if ("throw" === t.type) throw t.arg; return "break" === t.type || "continue" === t.type ? this.next = t.arg : "return" === t.type ? (this.rval = this.arg = t.arg, this.method = "return", this.next = "end") : "normal" === t.type && e && (this.next = e), y; }, finish: function finish(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.finallyLoc === t) return this.complete(r.completion, r.afterLoc), resetTryEntry(r), y; } }, catch: function _catch(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.tryLoc === t) { var n = r.completion; if ("throw" === n.type) { var o = n.arg; resetTryEntry(r); } return o; } } throw new Error("illegal catch attempt"); }, delegateYield: function delegateYield(e, r, n) { return this.delegate = { iterator: values(e), resultName: r, nextLoc: n }, "next" === this.method && (this.arg = t), y; } }, e; }
+function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 function _typeof(o) { "@babel/helpers - typeof"; return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, _typeof(o); }
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { Promise.resolve(value).then(_next, _throw); } }
+function _asyncToGenerator(fn) { return function () { var self = this, args = arguments; return new Promise(function (resolve, reject) { var gen = fn.apply(self, args); function _next(value) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value); } function _throw(err) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err); } _next(undefined); }); }; }
 function _defineProperties(target, props) { for (var i = 0; i < props.length; i++) { var descriptor = props[i]; descriptor.enumerable = descriptor.enumerable || false; descriptor.configurable = true; if ("value" in descriptor) descriptor.writable = true; Object.defineProperty(target, _toPropertyKey(descriptor.key), descriptor); } }
 function _createClass(Constructor, protoProps, staticProps) { if (protoProps) _defineProperties(Constructor.prototype, protoProps); if (staticProps) _defineProperties(Constructor, staticProps); Object.defineProperty(Constructor, "prototype", { writable: false }); return Constructor; }
 function _classCallCheck(instance, Constructor) { if (!(instance instanceof Constructor)) { throw new TypeError("Cannot call a class as a function"); } }
@@ -28,4 +33,78 @@ export var HttpError = /*#__PURE__*/function (_Error) {
     return _this;
   }
   return _createClass(HttpError);
-}( /*#__PURE__*/_wrapNativeSuper(Error));
+}( /*#__PURE__*/_wrapNativeSuper(Error));
+
+// =============================================================================
+// 框架内建报错的文案 —— 默认中文，调用方可以按请求语言换掉
+// =============================================================================
+// 这几句是从**库内部**抛出去的（准入判定、写动作的兜底），业务自己的报错在业务代码里
+// 渲染（do-tv 是 (backend)/utils/i18n 的 serverT，抛出点就地翻成请求的语言）。库不知道
+// 也不该知道各项目的 i18n 栈（next-intl、react-i18next、自研…），所以不给库塞字典，
+// 只留一个「抛出前问一次」的钩子：谁做国际化，谁在应用启动时注册一个解析器。
+//
+// 为什么不回错误码让前端翻：这些 message 的读者不只是浏览器 —— CLI 与 agent 也读它，
+// 它们没有前端那套翻译层，回个码等于让它们打印一串 `errors.UNAUTHENTICATED`。在服务端
+// 渲染成字符串，所有读者拿到的都是人话。
+//
+// 解析器按**请求**解析（语言藏在 cookie / Accept-Language 里），所以它是每次抛出时现调
+// 的函数，而不是启动时钉死的一份字符串。允许 async —— 各抛出点本来就在 async 函数里，
+// 而「按当前请求取翻译」在 Next 里就得 await（do-tv 的 requestText() 走 next/headers）。
+
+export var defaultHttpErrorMessages = {
+  unauthenticated: "未登录",
+  forbidden: "没有权限",
+  missingId: "缺少 id",
+  editNotFound: "未找到编辑对象，或没有权限",
+  deleteNotFound: "未找到删除对象，或没有权限",
+  scopeUnresolved: function scopeUnresolved(column) {
+    return "\u65E0\u6CD5\u786E\u5B9A\u8FD9\u6B21\u8BF7\u6C42\u7684\u5F52\u5C5E\uFF08".concat(column, "\uFF09\u3002\u8FD9\u4E0D\u662F\u300C\u4E0D\u505A\u9694\u79BB\u300D\u2014\u2014\u8BF7\u6C42\u88AB\u62D2\u7EDD\u3002");
+  }
+};
+var resolver;
+
+/**
+ * 注册文案解析器，应用启动时调一次（再次调用覆盖；传 undefined 恢复默认）。
+ * 不注册就一直是 defaultHttpErrorMessages 那几句中文 —— 没做国际化的项目零感知。
+ */
+export function setHttpErrorMessageResolver(next) {
+  resolver = next;
+}
+
+/**
+ * 取出当前生效的整份文案。**在抛出点现调**，别在模块顶层缓存 —— 解析器是按请求判
+ * 语言的，缓存住就把上一个请求的语言漏给下一个。
+ *
+ * 解析器自己抛了错（比如语言包没加载到）就回落默认中文：报错文案出不来不该把
+ * 原本那个 401/403 也吞掉。
+ */
+export function httpErrorMessages() {
+  return _httpErrorMessages.apply(this, arguments);
+}
+function _httpErrorMessages() {
+  _httpErrorMessages = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee() {
+    var overrides, _resolver;
+    return _regeneratorRuntime().wrap(function _callee$(_context) {
+      while (1) switch (_context.prev = _context.next) {
+        case 0:
+          _context.prev = 0;
+          _context.next = 3;
+          return (_resolver = resolver) === null || _resolver === void 0 ? void 0 : _resolver();
+        case 3:
+          overrides = _context.sent;
+          _context.next = 9;
+          break;
+        case 6:
+          _context.prev = 6;
+          _context.t0 = _context["catch"](0);
+          overrides = undefined;
+        case 9:
+          return _context.abrupt("return", _objectSpread(_objectSpread({}, defaultHttpErrorMessages), overrides));
+        case 10:
+        case "end":
+          return _context.stop();
+      }
+    }, _callee, null, [[0, 6]]);
+  }));
+  return _httpErrorMessages.apply(this, arguments);
+}

package/es/backend/route-operation/operation-common.js

@@ -8,7 +8,7 @@ function _typeof(o) { "@babel/helpers - typeof"; return _typeof = "function" ==
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { Promise.resolve(value).then(_next, _throw); } }
 function _asyncToGenerator(fn) { return function () { var self = this, args = arguments; return new Promise(function (resolve, reject) { var gen = fn.apply(self, args); function _next(value) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value); } function _throw(err) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err); } _next(undefined); }); }; }
 import { TypedNextResponse } from "@ai0x0/next-rest-framework";
-import { HttpError } from "../errors.js";
+import { HttpError, httpErrorMessages } from "../errors.js";
 import { isEmptyScopeValue, NO_SCOPE } from "../scope.js";
 
 // ==============================================================================
@@ -100,52 +100,83 @@ function _resolveAccess() {
         case 9:
           session = _context.t0;
           if (!(access !== null && access !== void 0 && access.can)) {
-            _context.next = 19;
+            _context.next = 33;
             break;
           }
           if (session) {
-            _context.next = 13;
+            _context.next = 17;
             break;
           }
-          throw new HttpError(401, "未登录");
-        case 13:
+          _context.t1 = HttpError;
           _context.next = 15;
+          return httpErrorMessages();
+        case 15:
+          _context.t2 = _context.sent.unauthenticated;
+          throw new _context.t1(401, _context.t2);
+        case 17:
+          _context.next = 19;
           return access.can({
             method: method,
             session: session
           });
-        case 15:
+        case 19:
           verdict = _context.sent;
           if (!(verdict !== true)) {
-            _context.next = 19;
+            _context.next = 33;
             break;
           }
           denial = _typeof(verdict) === "object" ? verdict : {};
-          throw new HttpError((_denial$status = denial.status) !== null && _denial$status !== void 0 ? _denial$status : 403, (_denial$message = denial.message) !== null && _denial$message !== void 0 ? _denial$message : "没有权限");
-        case 19:
+          _context.t3 = HttpError;
+          _context.t4 = (_denial$status = denial.status) !== null && _denial$status !== void 0 ? _denial$status : 403;
+          if (!((_denial$message = denial.message) !== null && _denial$message !== void 0)) {
+            _context.next = 28;
+            break;
+          }
+          _context.t5 = _denial$message;
+          _context.next = 31;
+          break;
+        case 28:
+          _context.next = 30;
+          return httpErrorMessages();
+        case 30:
+          _context.t5 = _context.sent.forbidden;
+        case 31:
+          _context.t6 = _context.t5;
+          throw new _context.t3(_context.t4, _context.t6);
+        case 33:
           if (wantsScope) {
-            _context.next = 21;
+            _context.next = 35;
             break;
           }
           return _context.abrupt("return", {
             scope: NO_SCOPE,
             session: session
           });
-        case 21:
+        case 35:
           if (session) {
-            _context.next = 23;
+            _context.next = 41;
             break;
           }
-          throw new HttpError(401, "未登录");
-        case 23:
+          _context.t7 = HttpError;
+          _context.next = 39;
+          return httpErrorMessages();
+        case 39:
+          _context.t8 = _context.sent.unauthenticated;
+          throw new _context.t7(401, _context.t8);
+        case 41:
           column = (_access$scope$column = access === null || access === void 0 || (_access$scope = access.scope) === null || _access$scope === void 0 ? void 0 : _access$scope.column) !== null && _access$scope$column !== void 0 ? _access$scope$column : DEFAULT_SCOPE_COLUMN;
           value = access !== null && access !== void 0 && access.scope ? access.scope.value(session) : session.userId;
           if (!isEmptyScopeValue(value)) {
-            _context.next = 27;
+            _context.next = 49;
             break;
           }
-          throw new HttpError(403, "\u65E0\u6CD5\u786E\u5B9A\u8FD9\u6B21\u8BF7\u6C42\u7684\u5F52\u5C5E\uFF08".concat(column, "\uFF09\u3002\u8FD9\u4E0D\u662F\u300C\u4E0D\u505A\u9694\u79BB\u300D\u2014\u2014\u8BF7\u6C42\u88AB\u62D2\u7EDD\u3002"));
-        case 27:
+          _context.t9 = HttpError;
+          _context.next = 47;
+          return httpErrorMessages();
+        case 47:
+          _context.t10 = _context.sent.scopeUnresolved(column);
+          throw new _context.t9(403, _context.t10);
+        case 49:
           return _context.abrupt("return", {
             scope: {
               column: column,
@@ -153,7 +184,7 @@ function _resolveAccess() {
             },
             session: session
           });
-        case 28:
+        case 50:
         case "end":
           return _context.stop();
       }

package/eslint-config/index.js

@@ -6,10 +6,15 @@
  *   import { ai0x0, allRestrictions, allRestrictionsWithNetworking }
  *     from "@ai0x0/utils/eslint-config/index.js";
  */
-import localPlugin from "../eslint-rules/index.js";
+import localPlugin, { SCOPED_RULES } from "../eslint-rules/index.js";
 
 export { localPlugin as ai0x0 };
 
+// 不进 recommended、需要调用方按 files 自行开启的规则名单。消费方按规则名全量铺 recommended
+// 之外的规则时（比如自己组装 rules 表），用这个集合过滤，别在调用方手抄一份 —— 手抄的
+// 那份在新增 scoped 规则时不会跟着更新。
+export { SCOPED_RULES };
+
 export const allRestrictions = [
   {
     selector: "TryStatement",
@@ -40,6 +45,12 @@ export const allRestrictions = [
     selector: "CallExpression[callee.name='useCallback']",
     message: "禁止 useCallback。React Compiler 会自动记忆化，无需手动优化。",
   },
+  {
+    selector:
+      ":matches(CallExpression[callee.name='memo'], CallExpression[callee.object.name='React'][callee.property.name='memo'])",
+    message:
+      "禁止 memo()。React Compiler 会自动记忆化；手写 memo 只会多一套独立的 props 浅比较，还容易把热点修在组件边界上、掩盖真正不稳定的 props。",
+  },
   {
     selector: "JSXOpeningElement[name.name=/^(div|span|p|h[1-6])$/]",
     message:

package/eslint-rules/index.js

@@ -5,7 +5,6 @@ import requireSectionDivider from "./require-section-divider.js";
 import noHardcodedStyle from "./no-hardcoded-style.js";
 import requireUseForm from "./require-use-form.js";
 import requireFormConvention from "./require-form-convention.js";
-import requireProComponents from "./require-pro-components.js";
 import noAntdSpace from "./no-antd-space.js";
 import noUseRequestRun from "./no-use-request-run.js";
 import noThen from "./no-then.js";
@@ -14,13 +13,13 @@ import noConsecutiveSetState from "./no-consecutive-setstate.js";
 import maxLines from "./max-lines.js";
 import apiRouteViaNrf from "./api-route-via-nrf.js";
 import noDirectApiUrl from "./no-direct-api-url.js";
+import noHardcodedText from "./no-hardcoded-text.js";
 
 const rules = {
   "require-section-divider": requireSectionDivider,
   "no-hardcoded-style": noHardcodedStyle,
   "require-use-form": requireUseForm,
   "require-form-convention": requireFormConvention,
-  "require-pro-components": requireProComponents,
   "no-antd-space": noAntdSpace,
   "no-use-request-run": noUseRequestRun,
   "no-then": noThen,
@@ -29,14 +28,21 @@ const rules = {
   "max-lines": maxLines,
   "api-route-via-nrf": apiRouteViaNrf,
   "no-direct-api-url": noDirectApiUrl,
+  "no-hardcoded-text": noHardcodedText,
 };
 
-// 这两条只管「特定位置」的代码，不能跟着 recommended 全局开：
+// 这三条只管「特定位置」的代码，不能跟着 recommended 全局开：
 //   · api-route-via-nrf 只该挂在 API 路由文件上（别的文件 export 一个叫 GET 的函数是自由的）；
-//   · no-direct-api-url 只该挂在前端目录上（后端与中间件里出现 "/api/..." 字面量是本分）。
+//   · no-direct-api-url 只该挂在前端目录上（后端与中间件里出现 "/api/..." 字面量是本分）；
+//   · no-hardcoded-text 只该挂在做了国际化的项目上（没接语言包的项目开了就是满屏误报），
+//     且旧账豁免名单由调用方经 legacy 选项传入。
 // 调用方在 flat config 里用 files 圈定范围自行开启，豁免文件用 files override 关掉，
-// 用法写在两条规则各自的文件头。
-const SCOPED_RULES = new Set(["api-route-via-nrf", "no-direct-api-url"]);
+// 用法写在各条规则的文件头。
+export const SCOPED_RULES = new Set([
+  "api-route-via-nrf",
+  "no-direct-api-url",
+  "no-hardcoded-text",
+]);
 
 const plugin = {
   rules,

package/eslint-rules/max-lines.js

@@ -62,7 +62,7 @@ const rule = {
     ],
     messages: {
       tooManyLines:
-        "单文件代码行数过多（{{ lineCount }} 行，最多 {{ max }} 行），请拆分为子文件。",
+        "单文件代码行数过多（{{ lineCount }} 行，最多 {{ max }} 行{{ skipped }}），请拆分为子文件。",
     },
   },
   create(context) {
@@ -97,6 +97,18 @@ const rule = {
           return;
         }
 
+        // 行数口径要写进消息里：默认注释与空行都不算，不说明的话看消息的人会拿
+        // 编辑器底部的总行数去对，对不上。
+        const skippedParts = [];
+        if (options.skipComments) {
+          skippedParts.push("注释");
+        }
+        if (options.skipBlankLines) {
+          skippedParts.push("空行");
+        }
+        const skipped =
+          skippedParts.length > 0 ? `，${skippedParts.join("与")}不计入` : "";
+
         context.report({
           node,
           loc: {
@@ -107,6 +119,7 @@ const rule = {
           data: {
             lineCount,
             max: options.max,
+            skipped,
           },
         });
       },

package/eslint-rules/no-hardcoded-style.js

@@ -450,7 +450,7 @@ const rule = {
     schema: [],
     messages: {
       noHardcoded:
-        "禁止硬编码 `{{ {{key}}: {{value}} }}`。请使用 antd token（如 `token.marginSM`、`token.colorPrimary`）。可参考 node_modules/@ai0x0/utils/.agents/skills/antd/SKILL.md 了解 token 体系。",
+        "禁止硬编码 `{{ {{key}}: {{value}} }}`。请用 antd token：间距用 `token.marginSM` / `token.paddingSM`，颜色用 `token.colorPrimary` / `token.colorText`，圆角用 `token.borderRadius`（经 `theme.useToken()` 或 createStyles 的 token 参数取）。",
     },
   },
   create(context) {

package/eslint-rules/no-hardcoded-text.js

@@ -0,0 +1,157 @@
+// =============================================================================
+// 旧账名单之外的文件里，JSX 正文与文案属性不许写裸中文
+// =============================================================================
+// 国际化迁移要跨好几周，期间新代码还在往里加中文 —— 不拦的话分母是个移动靶，做得再快也
+// 追不上。但把整仓库一起开成 error 是不现实的（当场几千个报错，只会被人整条关掉）。
+//
+// 所以这条规则带一份**只减不增的旧账名单**（由各项目的生成脚本维护，经 options.legacy
+// 传入）：名单里的文件一个字都不报，名单外的一条都不许有。**新建的文件天然在名单外**，
+// 从第一行起就受管；一个文件迁完了就从名单里划掉，划掉之后它再也回不去。
+//
+// 名单是「文件还剩多少没迁」的唯一判据，不能拿「这个文件有没有 import i18n 库」代替 ——
+// 迁移是分批的（先抽共用词表、再按模块走），一个文件很可能刚接上语言包、里头还剩二十条
+// 没动。按 import 判的话，那二十条会在文件刚接上的当天集体变成 error。
+//
+// 只认两个位置 —— JSX 正文与文案属性。这不是偷懒：正是这两处不会与「中文当值用」相混
+//（.describe() 的 API 文档、枚举值、css`` 里的注释都长不到这两个位置上），所以这条规则
+// 不需要那一整套语法位置判断，也就不会误报。
+//
+// **这条规则不进 recommended**（见 index.js 的 SCOPED_RULES）：没做国际化的项目不该被它
+// 扫到。要用的项目在自己的 flat config 里按 files 圈定范围、把自己的旧账名单传给
+// legacy 选项。
+
+const CJK = /[一-鿿]/;
+
+/** 摆文案的属性名。调用方若有配套的文案扫描脚本，两份名单要保持同源。 */
+const TEXT_PROPS = new Set([
+  "label",
+  "title",
+  "placeholder",
+  "tooltip",
+  "desc",
+  "description",
+  "okText",
+  "cancelText",
+  "emptyText",
+  "extra",
+  "header",
+  "footer",
+  "alt",
+  "tip",
+  "subTitle",
+  "content",
+  "message",
+  "hint",
+  "heading",
+  "caption",
+]);
+
+// =============================================================================
+// 取值
+// =============================================================================
+
+/** 一个节点里的中文文本，没有就返回空串。模板串把静态片段拼起来看。 */
+function chineseIn(node) {
+  if (!node) {
+    return "";
+  }
+  if (node.type === "Literal" && typeof node.value === "string") {
+    return CJK.test(node.value) ? node.value : "";
+  }
+  if (node.type === "TemplateLiteral" && node.quasis) {
+    const text = node.quasis.map((part) => part.value.raw).join("${…}");
+    return CJK.test(text) ? text : "";
+  }
+  // JSX 属性里的 `{...}`：真正的值在里头。
+  if (node.type === "JSXExpressionContainer") {
+    return chineseIn(node.expression);
+  }
+  return "";
+}
+
+/** 属性名。标识符（`label:`、`label=`）读 name，字符串键（`"label":`）读 value。 */
+function nameOf(node) {
+  if (!node) {
+    return "";
+  }
+  if (typeof node.name === "string") {
+    return node.name;
+  }
+  if (node.type === "Literal" && typeof node.value === "string") {
+    return node.value;
+  }
+  return "";
+}
+
+// =============================================================================
+// 规则
+// =============================================================================
+
+/** @type {import('eslint').Rule.RuleModule} */
+const rule = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "旧账名单之外的文件里，JSX 正文与文案属性不许写裸中文。",
+    },
+    schema: [
+      {
+        type: "object",
+        properties: {
+          /** 还没迁完的文件（仓库相对路径），这些文件里一个字都不报。 */
+          legacy: { type: "array", items: { type: "string" } },
+        },
+        additionalProperties: false,
+      },
+    ],
+    messages: {
+      hardcoded:
+        "界面文案要走语言包：把「{{text}}」搬进语言包文件，用 i18n 取值函数读取。这个文件不在旧账豁免名单里。",
+    },
+  },
+  create(context) {
+    const options = context.options[0] ?? {};
+    // eslint 给的是绝对路径，名单里存的是仓库相对路径 —— 按后缀比，免得把 cwd 也写进名单
+    //（那样名单换台机器就全失效，而失效的样子是「突然多出几千个报错」）。
+    const here = context.filename.replaceAll("\\", "/");
+    // 测试文件里的中文是**夹具**不是界面文案：被测的输入本身就该是中文。名单是「只减不增」
+    // 的，把测试文件塞进去等于把它变成垃圾桶。
+    const isTest = /\.test\.tsx?$/.test(here);
+    const skipped =
+      isTest || (options.legacy ?? []).some((file) => here.endsWith(file));
+
+    const report = (node, text) => {
+      if (skipped || !text) {
+        return;
+      }
+      context.report({
+        node,
+        messageId: "hardcoded",
+        data: { text: text.replace(/\s+/g, " ").trim().slice(0, 20) },
+      });
+    };
+
+    return {
+      JSXText(node) {
+        const text = node.value ?? "";
+        if (CJK.test(text)) {
+          report(node, text);
+        }
+      },
+      JSXAttribute(node) {
+        if (!TEXT_PROPS.has(nameOf(node.name))) {
+          return;
+        }
+        report(node, chineseIn(node.value));
+      },
+      Property(node) {
+        if (!TEXT_PROPS.has(nameOf(node.key))) {
+          return;
+        }
+        report(node, chineseIn(node.value));
+      },
+    };
+  },
+};
+
+export default rule;

package/eslint-rules/require-use-form.js

@@ -23,7 +23,7 @@ const rule = {
     schema: [],
     messages: {
       useFormRequired:
-        "检测到表单场景使用了 useState/useSetState 管理字段值。请改用 Form.useForm() 或 rc-field-form 的 useForm。详见 node_modules/@ai0x0/utils/.agents/skills/antd/SKILL.md。",
+        "检测到表单场景使用了 useState/useSetState 管理字段值。请改用 Form.useForm()（ProForm 场景直接交给 ProForm 字段），不要手写受控状态。",
     },
   },
   create(context) {

package/lib/backend/actions/write-action-core.js

@@ -39,11 +39,11 @@ function createPutActionCore({
   return async (body, { scope }) => {
     const id = body.id;
     if (!id) {
-      throw new import_errors.HttpError(400, "缺少 id");
+      throw new import_errors.HttpError(400, (await (0, import_errors.httpErrorMessages)()).missingId);
     }
     const [data] = await db.update(table).set((0, import_transform_body.transformBody)(body)).where(byId(table, id, scope)).returning();
     if (!data && scope !== import_scope.NO_SCOPE) {
-      throw new import_errors.HttpError(404, "未找到编辑对象，或没有权限");
+      throw new import_errors.HttpError(404, (await (0, import_errors.httpErrorMessages)()).editNotFound);
     }
     return data;
   };
@@ -54,11 +54,11 @@ function createDeleteActionCore({
 }) {
   return async ({ id }, { scope }) => {
     if (!id) {
-      throw new import_errors.HttpError(400, "缺少 id");
+      throw new import_errors.HttpError(400, (await (0, import_errors.httpErrorMessages)()).missingId);
     }
     const rows = await db.delete(table).where(byId(table, id, scope)).returning();
     if (rows.length === 0 && scope !== import_scope.NO_SCOPE) {
-      throw new import_errors.HttpError(404, "未找到删除对象，或没有权限");
+      throw new import_errors.HttpError(404, (await (0, import_errors.httpErrorMessages)()).deleteNotFound);
     }
     return rows;
   };

package/lib/backend/errors.d.ts

@@ -2,3 +2,33 @@ export declare class HttpError extends Error {
     status: number;
     constructor(status: number, message: string);
 }
+export interface HttpErrorMessages {
+    /** 401：会话不存在。 */
+    unauthenticated: string;
+    /** 403：access.can 拒绝且没给自定义文案。 */
+    forbidden: string;
+    /** 400：PUT / DELETE 请求体缺 id。 */
+    missingId: string;
+    /** 404：PUT 影响 0 行（不存在或不属于调用者）。 */
+    editNotFound: string;
+    /** 404：DELETE 影响 0 行。 */
+    deleteNotFound: string;
+    /** 403：作用域值解析不出来 —— 多半是配错了列名，但请求照样要被拒绝。 */
+    scopeUnresolved: (column: string) => string;
+}
+export declare const defaultHttpErrorMessages: HttpErrorMessages;
+type HttpErrorMessageResolver = () => Partial<HttpErrorMessages> | Promise<Partial<HttpErrorMessages>>;
+/**
+ * 注册文案解析器，应用启动时调一次（再次调用覆盖；传 undefined 恢复默认）。
+ * 不注册就一直是 defaultHttpErrorMessages 那几句中文 —— 没做国际化的项目零感知。
+ */
+export declare function setHttpErrorMessageResolver(next: HttpErrorMessageResolver | undefined): void;
+/**
+ * 取出当前生效的整份文案。**在抛出点现调**，别在模块顶层缓存 —— 解析器是按请求判
+ * 语言的，缓存住就把上一个请求的语言漏给下一个。
+ *
+ * 解析器自己抛了错（比如语言包没加载到）就回落默认中文：报错文案出不来不该把
+ * 原本那个 401/403 也吞掉。
+ */
+export declare function httpErrorMessages(): Promise<HttpErrorMessages>;
+export {};

package/lib/backend/errors.js

@@ -19,7 +19,10 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/backend/errors.ts
 var errors_exports = {};
 __export(errors_exports, {
-  HttpError: () => HttpError
+  HttpError: () => HttpError,
+  defaultHttpErrorMessages: () => defaultHttpErrorMessages,
+  httpErrorMessages: () => httpErrorMessages,
+  setHttpErrorMessageResolver: () => setHttpErrorMessageResolver
 });
 module.exports = __toCommonJS(errors_exports);
 var HttpError = class extends Error {
@@ -29,7 +32,31 @@ var HttpError = class extends Error {
     this.status = status;
   }
 };
+var defaultHttpErrorMessages = {
+  unauthenticated: "未登录",
+  forbidden: "没有权限",
+  missingId: "缺少 id",
+  editNotFound: "未找到编辑对象，或没有权限",
+  deleteNotFound: "未找到删除对象，或没有权限",
+  scopeUnresolved: (column) => `无法确定这次请求的归属（${column}）。这不是「不做隔离」——请求被拒绝。`
+};
+var resolver;
+function setHttpErrorMessageResolver(next) {
+  resolver = next;
+}
+async function httpErrorMessages() {
+  let overrides;
+  try {
+    overrides = await (resolver == null ? void 0 : resolver());
+  } catch {
+    overrides = void 0;
+  }
+  return { ...defaultHttpErrorMessages, ...overrides };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  HttpError
+  HttpError,
+  defaultHttpErrorMessages,
+  httpErrorMessages,
+  setHttpErrorMessageResolver
 });

package/lib/backend/route-operation/operation-common.js

@@ -49,26 +49,29 @@ async function resolveAccess({
   const session = wantsScope || (access == null ? void 0 : access.can) || (access == null ? void 0 : access.stamp) ? await loadSession() : void 0;
   if (access == null ? void 0 : access.can) {
     if (!session) {
-      throw new import_errors.HttpError(401, "未登录");
+      throw new import_errors.HttpError(401, (await (0, import_errors.httpErrorMessages)()).unauthenticated);
     }
     const verdict = await access.can({ method, session });
     if (verdict !== true) {
       const denial = typeof verdict === "object" ? verdict : {};
-      throw new import_errors.HttpError(denial.status ?? 403, denial.message ?? "没有权限");
+      throw new import_errors.HttpError(
+        denial.status ?? 403,
+        denial.message ?? (await (0, import_errors.httpErrorMessages)()).forbidden
+      );
     }
   }
   if (!wantsScope) {
     return { scope: import_scope.NO_SCOPE, session };
   }
   if (!session) {
-    throw new import_errors.HttpError(401, "未登录");
+    throw new import_errors.HttpError(401, (await (0, import_errors.httpErrorMessages)()).unauthenticated);
   }
   const column = ((_a = access == null ? void 0 : access.scope) == null ? void 0 : _a.column) ?? DEFAULT_SCOPE_COLUMN;
   const value = (access == null ? void 0 : access.scope) ? access.scope.value(session) : session.userId;
   if ((0, import_scope.isEmptyScopeValue)(value)) {
     throw new import_errors.HttpError(
       403,
-      `无法确定这次请求的归属（${column}）。这不是「不做隔离」——请求被拒绝。`
+      (await (0, import_errors.httpErrorMessages)()).scopeUnresolved(column)
     );
   }
   return { scope: { column, value }, session };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai0x0/utils",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "AI0x0 utils",
   "keywords": [
     "ai0x0"

package/eslint-rules/require-pro-components.js

@@ -1,131 +0,0 @@
-/**
- * require-pro-components
- * ----------------------
- * 约束前端业务代码：
- * 1. 禁止直接使用 antd <Modal>，必须用 @ant-design/pro-components 的 <ModalForm>
- * 2. 禁止直接使用 <Form.Item>，必须用 @ant-design/pro-components 的 ProForm* 组件
- * 3. ProForm* 组件必须设置 rules 进行校验，否则需要 eslint-disable 注明原因
- *
- * 例外场景：
- * - noStyle 的 Form.Item（仅作布局容器）
- * - ProForm 容器本身（不是字段组件）
- * - ProFormDependency、ProFormFieldSet、ProFormList 等非字段组件
- */
-
-const PROFORM_CONTAINER_COMPONENTS = new Set([
-  "ProForm",
-  "ProFormDependency",
-  "ProFormFieldSet",
-  "ProFormList",
-  "ProFormGrid",
-  "ProFormGroup",
-]);
-
-/** @type {import('eslint').Rule.RuleModule} */
-const rule = {
-  meta: {
-    type: "suggestion",
-    docs: {
-      description:
-        "禁止直接使用 antd <Modal>（用 ModalForm 代替），禁止直接使用 <Form.Item>（用 ProForm* 代替），ProForm* 必须设置 rules",
-    },
-    schema: [],
-    messages: {
-      useModalForm:
-        "禁止直接使用 antd <Modal>，请使用 @ant-design/pro-components 的 <ModalForm> 代替。",
-      useProFormItem:
-        "禁止直接使用 <Form.Item>，请使用 @ant-design/pro-components 的 ProFormText / ProFormSelect / ProFormItem 等组件代替。",
-      needProFormRules:
-        "<{{tag}}> 必须设置 rules 进行校验。如果确实不需要校验，请用 // eslint-disable-next-line 注明原因。",
-      noSubmitHtmlType:
-        '禁止使用 <Button htmlType="submit">，请使用 ProForm 的 submitter 属性提交表单。',
-    },
-  },
-  create(context) {
-    const getTagName = (name) => {
-      if (name.type === "JSXIdentifier") return name.name;
-      if (
-        name.type === "JSXMemberExpression" &&
-        name.object.type === "JSXIdentifier" &&
-        name.property.type === "JSXIdentifier"
-      ) {
-        return `${name.object.name}.${name.property.name}`;
-      }
-      return "";
-    };
-
-    return {
-      JSXOpeningElement(node) {
-        const tagName = getTagName(node.name);
-
-        // <Modal>
-        if (tagName === "Modal") {
-          context.report({
-            node: node,
-            messageId: "useModalForm",
-          });
-        }
-
-        // <Form.Item>
-        if (tagName === "Form.Item") {
-          let isNoStyle = false;
-          for (const attr of node.attributes) {
-            if (attr.type !== "JSXAttribute" || !attr.name) continue;
-            if (attr.name.name === "noStyle") {
-              isNoStyle = true;
-              break;
-            }
-          }
-          if (!isNoStyle) {
-            context.report({
-              node: node,
-              messageId: "useProFormItem",
-            });
-          }
-        }
-
-        // <Button htmlType="submit">
-        if (tagName === "Button") {
-          for (const attr of node.attributes) {
-            if (attr.type !== "JSXAttribute" || !attr.name) continue;
-            if (
-              attr.name.name === "htmlType" &&
-              attr.value &&
-              attr.value.type === "Literal" &&
-              attr.value.value === "submit"
-            ) {
-              context.report({
-                node: attr,
-                messageId: "noSubmitHtmlType",
-              });
-            }
-          }
-        }
-
-        // ProForm* field components must have rules
-        if (
-          tagName.startsWith("ProForm") &&
-          !PROFORM_CONTAINER_COMPONENTS.has(tagName)
-        ) {
-          let hasRules = false;
-          for (const attr of node.attributes) {
-            if (attr.type !== "JSXAttribute" || !attr.name) continue;
-            if (attr.name.name === "rules") {
-              hasRules = true;
-              break;
-            }
-          }
-          if (!hasRules) {
-            context.report({
-              node: node,
-              messageId: "needProFormRules",
-              data: { tag: tagName },
-            });
-          }
-        }
-      },
-    };
-  },
-};
-
-export default rule;