@downcity/agent 1.1.1

package/bin/http/auth/AuthStore.js

@@ -0,0 +1,442 @@
+/**
+ * 统一账户存储层。
+ *
+ * 关键点（中文）
+ * - 该模块只负责 `auth_*` 表的读写，不处理密码校验与 HTTP 语义。
+ * - 数据仍落在 console 的 SQLite 中，与现有控制面共享底层存储。
+ */
+import fs from "fs-extra";
+import path from "node:path";
+import Database from "better-sqlite3";
+import { drizzle } from "drizzle-orm/better-sqlite3";
+import { nanoid } from "nanoid";
+import { getConsoleShipDbPath } from "../../runtime/CityPaths.js";
+import { AUTH_DEFAULT_ROLES, AUTH_PERMISSION_DESCRIPTIONS, AUTH_PERMISSION_KEYS, } from "../../shared/types/auth/AuthPermission.js";
+import { ensureConsoleStoreSchema } from "../../shared/utils/store/StoreSchema.js";
+import { nowIso, normalizeNonEmptyText, optionalTrimmedText, } from "../../shared/utils/store/StoreShared.js";
+/**
+ * AuthStore 门面。
+ */
+export class AuthStore {
+    sqlite;
+    context;
+    constructor(options = {}) {
+        const dbPath = path.resolve(options.dbPath || getConsoleShipDbPath());
+        fs.ensureDirSync(path.dirname(dbPath));
+        this.sqlite = new Database(dbPath);
+        this.sqlite.pragma("journal_mode = WAL");
+        this.context = {
+            sqlite: this.sqlite,
+            db: drizzle(this.sqlite),
+        };
+        ensureConsoleStoreSchema(this.context);
+    }
+    /**
+     * 关闭数据库连接。
+     */
+    close() {
+        this.sqlite.close();
+    }
+    /**
+     * 返回当前用户数量。
+     */
+    countUsers() {
+        const row = this.sqlite.prepare("SELECT COUNT(*) as count FROM auth_users").get();
+        return Number(row?.count || 0);
+    }
+    /**
+     * 幂等写入默认角色与权限目录。
+     */
+    ensureDefaultCatalog() {
+        const now = nowIso();
+        const tx = this.sqlite.transaction(() => {
+            const roleIds = new Map();
+            for (const role of AUTH_DEFAULT_ROLES) {
+                const existing = this.sqlite
+                    .prepare("SELECT id FROM auth_roles WHERE name = ?")
+                    .get(role.name);
+                if (existing?.id) {
+                    this.sqlite
+                        .prepare("UPDATE auth_roles SET description = ?, updated_at = ? WHERE id = ?")
+                        .run(role.description, now, String(existing.id));
+                    roleIds.set(role.name, String(existing.id));
+                }
+                else {
+                    const id = nanoid();
+                    this.sqlite
+                        .prepare("INSERT INTO auth_roles (id, name, description, created_at, updated_at) VALUES (?, ?, ?, ?, ?)")
+                        .run(id, role.name, role.description, now, now);
+                    roleIds.set(role.name, id);
+                }
+            }
+            const permissionIds = new Map();
+            for (const permission of AUTH_PERMISSION_KEYS) {
+                const description = AUTH_PERMISSION_DESCRIPTIONS[permission];
+                const existing = this.sqlite
+                    .prepare("SELECT id FROM auth_permissions WHERE key = ?")
+                    .get(permission);
+                if (existing?.id) {
+                    this.sqlite
+                        .prepare("UPDATE auth_permissions SET description = ?, updated_at = ? WHERE id = ?")
+                        .run(description, now, String(existing.id));
+                    permissionIds.set(permission, String(existing.id));
+                }
+                else {
+                    const id = nanoid();
+                    this.sqlite
+                        .prepare("INSERT INTO auth_permissions (id, key, description, created_at, updated_at) VALUES (?, ?, ?, ?, ?)")
+                        .run(id, permission, description, now, now);
+                    permissionIds.set(permission, id);
+                }
+            }
+            for (const role of AUTH_DEFAULT_ROLES) {
+                const roleId = roleIds.get(role.name);
+                if (!roleId)
+                    continue;
+                for (const permission of role.permissions) {
+                    const permissionId = permissionIds.get(permission);
+                    if (!permissionId)
+                        continue;
+                    this.sqlite
+                        .prepare("INSERT OR IGNORE INTO auth_role_permissions (id, role_id, permission_id, created_at) VALUES (?, ?, ?, ?)")
+                        .run(nanoid(), roleId, permissionId, now);
+                }
+            }
+        });
+        tx();
+    }
+    /**
+     * 创建用户。
+     */
+    createUser(input) {
+        const id = nanoid();
+        const now = nowIso();
+        const username = normalizeNonEmptyText(input.username, "username");
+        const passwordHash = normalizeNonEmptyText(input.passwordHash, "passwordHash");
+        const displayName = optionalTrimmedText(input.displayName);
+        const status = input.status === "disabled" ? "disabled" : "active";
+        this.sqlite
+            .prepare("INSERT INTO auth_users (id, username, password_hash, display_name, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)")
+            .run(id, username, passwordHash, displayName || null, status, now, now);
+        return {
+            id,
+            username,
+            passwordHash,
+            displayName,
+            status,
+            createdAt: now,
+            updatedAt: now,
+        };
+    }
+    /**
+     * 根据用户名读取用户。
+     */
+    findUserByUsername(usernameInput) {
+        const username = normalizeNonEmptyText(usernameInput, "username");
+        const row = this.sqlite
+            .prepare("SELECT * FROM auth_users WHERE username = ?")
+            .get(username);
+        return row ? this.toAuthUser(row) : null;
+    }
+    /**
+     * 根据用户 ID 读取用户。
+     */
+    getUserById(userIdInput) {
+        const userId = normalizeNonEmptyText(userIdInput, "userId");
+        const row = this.sqlite
+            .prepare("SELECT * FROM auth_users WHERE id = ?")
+            .get(userId);
+        return row ? this.toAuthUser(row) : null;
+    }
+    /**
+     * 读取全部用户列表。
+     */
+    listUsers() {
+        const rows = this.sqlite
+            .prepare("SELECT * FROM auth_users ORDER BY username ASC")
+            .all();
+        return rows.map((row) => this.toAuthUser(row));
+    }
+    /**
+     * 更新用户基础资料。
+     */
+    updateUser(params) {
+        const userId = normalizeNonEmptyText(params.userId, "userId");
+        const current = this.getUserById(userId);
+        if (!current)
+            return null;
+        const nextDisplayName = optionalTrimmedText(params.displayName);
+        const nextStatus = params.status === "disabled" ? "disabled" : "active";
+        const updatedAt = nowIso();
+        this.sqlite
+            .prepare("UPDATE auth_users SET display_name = ?, status = ?, updated_at = ? WHERE id = ?")
+            .run(nextDisplayName || null, nextStatus, updatedAt, userId);
+        return this.getUserById(userId);
+    }
+    /**
+     * 更新用户密码哈希。
+     */
+    updateUserPasswordHash(params) {
+        const userId = normalizeNonEmptyText(params.userId, "userId");
+        const passwordHash = normalizeNonEmptyText(params.passwordHash, "passwordHash");
+        const current = this.getUserById(userId);
+        if (!current)
+            return null;
+        const updatedAt = nowIso();
+        this.sqlite
+            .prepare("UPDATE auth_users SET password_hash = ?, updated_at = ? WHERE id = ?")
+            .run(passwordHash, updatedAt, userId);
+        return this.getUserById(userId);
+    }
+    /**
+     * 给用户绑定角色。
+     */
+    assignRoleToUser(params) {
+        const userId = normalizeNonEmptyText(params.userId, "userId");
+        const role = this.sqlite
+            .prepare("SELECT id FROM auth_roles WHERE name = ?")
+            .get(normalizeNonEmptyText(params.roleName, "roleName"));
+        if (!role?.id)
+            throw new Error(`Unknown role: ${params.roleName}`);
+        this.sqlite
+            .prepare("INSERT OR IGNORE INTO auth_user_roles (id, user_id, role_id, created_at) VALUES (?, ?, ?, ?)")
+            .run(nanoid(), userId, String(role.id), nowIso());
+    }
+    /**
+     * 读取用户角色名列表。
+     */
+    listRoleNamesByUserId(userIdInput) {
+        const userId = normalizeNonEmptyText(userIdInput, "userId");
+        const rows = this.sqlite
+            .prepare(`
+          SELECT DISTINCT roles.name as name
+          FROM auth_roles roles
+          INNER JOIN auth_user_roles links ON links.role_id = roles.id
+          WHERE links.user_id = ?
+          ORDER BY roles.name ASC
+        `)
+            .all(userId);
+        return rows.map((row) => String(row.name || "").trim()).filter(Boolean);
+    }
+    /**
+     * 清空用户当前绑定的全部角色。
+     */
+    clearRolesByUserId(userIdInput) {
+        const userId = normalizeNonEmptyText(userIdInput, "userId");
+        this.sqlite
+            .prepare("DELETE FROM auth_user_roles WHERE user_id = ?")
+            .run(userId);
+    }
+    /**
+     * 用新的角色集合覆盖用户角色绑定。
+     */
+    replaceRolesByUserId(params) {
+        const userId = normalizeNonEmptyText(params.userId, "userId");
+        const roleNames = [...new Set(params.roleNames.map((item) => String(item || "").trim()).filter(Boolean))];
+        const tx = this.sqlite.transaction(() => {
+            this.clearRolesByUserId(userId);
+            for (const roleName of roleNames) {
+                this.assignRoleToUser({
+                    userId,
+                    roleName,
+                });
+            }
+        });
+        tx();
+        return this.listRoleNamesByUserId(userId);
+    }
+    /**
+     * 统计拥有指定角色且处于 active 状态的用户数量。
+     */
+    countActiveUsersByRole(roleNameInput) {
+        const roleName = normalizeNonEmptyText(roleNameInput, "roleName");
+        const row = this.sqlite
+            .prepare(`
+          SELECT COUNT(DISTINCT users.id) as count
+          FROM auth_users users
+          INNER JOIN auth_user_roles user_roles ON user_roles.user_id = users.id
+          INNER JOIN auth_roles roles ON roles.id = user_roles.role_id
+          WHERE users.status = 'active' AND roles.name = ?
+        `)
+            .get(roleName);
+        return Number(row?.count || 0);
+    }
+    /**
+     * 读取用户权限 key 列表。
+     */
+    listPermissionKeysByUserId(userIdInput) {
+        const userId = normalizeNonEmptyText(userIdInput, "userId");
+        const rows = this.sqlite
+            .prepare(`
+          SELECT DISTINCT perms.key as key
+          FROM auth_permissions perms
+          INNER JOIN auth_role_permissions rp ON rp.permission_id = perms.id
+          INNER JOIN auth_user_roles ur ON ur.role_id = rp.role_id
+          WHERE ur.user_id = ?
+          ORDER BY perms.key ASC
+        `)
+            .all(userId);
+        return rows
+            .map((row) => String(row.key || "").trim())
+            .filter(Boolean);
+    }
+    /**
+     * 创建 token 记录。
+     */
+    createToken(input) {
+        const id = nanoid();
+        const now = nowIso();
+        const userId = normalizeNonEmptyText(input.userId, "userId");
+        const name = normalizeNonEmptyText(input.name, "name");
+        const tokenHash = normalizeNonEmptyText(input.tokenHash, "tokenHash");
+        const expiresAt = optionalTrimmedText(input.expiresAt);
+        this.sqlite
+            .prepare("INSERT INTO auth_tokens (id, user_id, name, token_hash, expires_at, revoked_at, last_used_at, created_at, updated_at) VALUES (?, ?, ?, ?, ?, NULL, NULL, ?, ?)")
+            .run(id, userId, name, tokenHash, expiresAt || null, now, now);
+        return {
+            id,
+            userId,
+            name,
+            tokenHash,
+            expiresAt,
+            createdAt: now,
+            updatedAt: now,
+        };
+    }
+    /**
+     * 根据 token 哈希读取记录。
+     */
+    findTokenByHash(tokenHashInput) {
+        const tokenHash = normalizeNonEmptyText(tokenHashInput, "tokenHash");
+        const row = this.sqlite
+            .prepare("SELECT * FROM auth_tokens WHERE token_hash = ?")
+            .get(tokenHash);
+        return row ? this.toAuthToken(row) : null;
+    }
+    /**
+     * 根据 token ID 读取记录。
+     */
+    getTokenById(tokenIdInput) {
+        const tokenId = normalizeNonEmptyText(tokenIdInput, "tokenId");
+        const row = this.sqlite
+            .prepare("SELECT * FROM auth_tokens WHERE id = ?")
+            .get(tokenId);
+        return row ? this.toAuthToken(row) : null;
+    }
+    /**
+     * 读取用户 token 列表。
+     */
+    listTokensByUserId(userIdInput) {
+        const userId = normalizeNonEmptyText(userIdInput, "userId");
+        const rows = this.sqlite
+            .prepare("SELECT * FROM auth_tokens WHERE user_id = ? ORDER BY created_at DESC")
+            .all(userId);
+        return rows.map((row) => this.toAuthToken(row));
+    }
+    /**
+     * 更新 token 最后使用时间。
+     */
+    touchToken(tokenIdInput) {
+        const tokenId = normalizeNonEmptyText(tokenIdInput, "tokenId");
+        const now = nowIso();
+        this.sqlite
+            .prepare("UPDATE auth_tokens SET last_used_at = ?, updated_at = ? WHERE id = ?")
+            .run(now, now, tokenId);
+    }
+    /**
+     * 吊销 token。
+     */
+    revokeToken(tokenIdInput) {
+        const tokenId = normalizeNonEmptyText(tokenIdInput, "tokenId");
+        const now = nowIso();
+        this.sqlite
+            .prepare("UPDATE auth_tokens SET revoked_at = ?, updated_at = ? WHERE id = ?")
+            .run(now, now, tokenId);
+        return this.getTokenById(tokenId);
+    }
+    /**
+     * 删除 token。
+     */
+    deleteToken(tokenIdInput) {
+        const tokenId = normalizeNonEmptyText(tokenIdInput, "tokenId");
+        const result = this.sqlite
+            .prepare("DELETE FROM auth_tokens WHERE id = ?")
+            .run(tokenId);
+        return result.changes > 0;
+    }
+    /**
+     * 写入审计日志。
+     */
+    insertAuditLog(input) {
+        const id = nanoid();
+        const createdAt = nowIso();
+        const row = {
+            id,
+            actorUserId: optionalTrimmedText(input.actorUserId),
+            actorTokenId: optionalTrimmedText(input.actorTokenId),
+            resourceType: normalizeNonEmptyText(input.resourceType, "resourceType"),
+            resourceId: optionalTrimmedText(input.resourceId),
+            action: normalizeNonEmptyText(input.action, "action"),
+            result: normalizeNonEmptyText(input.result, "result"),
+            requestId: optionalTrimmedText(input.requestId),
+            ip: optionalTrimmedText(input.ip),
+            userAgent: optionalTrimmedText(input.userAgent),
+            metaJson: optionalTrimmedText(input.metaJson),
+            createdAt,
+        };
+        this.sqlite
+            .prepare("INSERT INTO auth_audit_logs (id, actor_user_id, actor_token_id, resource_type, resource_id, action, result, request_id, ip, user_agent, meta_json, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)")
+            .run(row.id, row.actorUserId || null, row.actorTokenId || null, row.resourceType, row.resourceId || null, row.action, row.result, row.requestId || null, row.ip || null, row.userAgent || null, row.metaJson || null, row.createdAt);
+        return row;
+    }
+    /**
+     * 将 token 记录转换为对外摘要。
+     */
+    toTokenSummary(record) {
+        return {
+            id: record.id,
+            name: record.name,
+            expiresAt: record.expiresAt,
+            lastUsedAt: record.lastUsedAt,
+            createdAt: record.createdAt,
+            updatedAt: record.updatedAt,
+        };
+    }
+    /**
+     * 将 token 记录与明文 token 合成为一次性返回体。
+     */
+    toIssuedToken(record, token) {
+        return {
+            ...this.toTokenSummary(record),
+            token,
+        };
+    }
+    toAuthUser(row) {
+        return {
+            id: String(row.id || ""),
+            username: String(row.username || ""),
+            passwordHash: String(row.password_hash || ""),
+            displayName: optionalTrimmedText(String(row.display_name || "")),
+            status: String(row.status || "active") === "disabled" ? "disabled" : "active",
+            createdAt: String(row.created_at || ""),
+            updatedAt: String(row.updated_at || ""),
+        };
+    }
+    toAuthToken(row) {
+        return {
+            id: String(row.id || ""),
+            userId: String(row.user_id || ""),
+            name: String(row.name || ""),
+            tokenHash: String(row.token_hash || ""),
+            expiresAt: optionalTrimmedText(String(row.expires_at || "")),
+            revokedAt: optionalTrimmedText(String(row.revoked_at || "")),
+            lastUsedAt: optionalTrimmedText(String(row.last_used_at || "")),
+            createdAt: String(row.created_at || ""),
+            updatedAt: String(row.updated_at || ""),
+        };
+    }
+    _unused(_row) {
+        throw new Error("unused");
+    }
+}
+//# sourceMappingURL=AuthStore.js.map

package/bin/http/auth/AuthStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthStore.js","sourceRoot":"","sources":["../../../src/http/auth/AuthStore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,oBAAoB,GAGrB,MAAM,uCAAuC,CAAC;AAQ/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EACL,MAAM,EACN,qBAAqB,EACrB,mBAAmB,GAEpB,MAAM,qCAAqC,CAAC;AAc7C;;GAEG;AACH,MAAM,OAAO,SAAS;IACH,MAAM,CAAoB;IAC1B,OAAO,CAAsB;IAE9C,YAAY,UAA4B,EAAE;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,oBAAoB,EAAE,CAAC,CAAC;QACtE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;SACzB,CAAC;QACF,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,UAAU;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,GAAG,EAElE,CAAC;QACd,OAAO,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,oBAAoB;QAClB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE;YACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA+B,CAAC;YACvD,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;gBACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM;qBACzB,OAAO,CAAC,0CAA0C,CAAC;qBACnD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAiC,CAAC;gBAClD,IAAI,QAAQ,EAAE,EAAE,EAAE,CAAC;oBACjB,IAAI,CAAC,MAAM;yBACR,OAAO,CACN,oEAAoE,CACrE;yBACA,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;oBACnD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC9C,CAAC;qBAAM,CAAC;oBACN,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;oBACpB,IAAI,CAAC,MAAM;yBACR,OAAO,CACN,+FAA+F,CAChG;yBACA,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;oBAClD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAA6B,CAAC;YAC3D,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE,CAAC;gBAC9C,MAAM,WAAW,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;gBAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM;qBACzB,OAAO,CAAC,+CAA+C,CAAC;qBACxD,GAAG,CAAC,UAAU,CAAiC,CAAC;gBACnD,IAAI,QAAQ,EAAE,EAAE,EAAE,CAAC;oBACjB,IAAI,CAAC,MAAM;yBACR,OAAO,CACN,0EAA0E,CAC3E;yBACA,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;oBAC9C,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrD,CAAC;qBAAM,CAAC;oBACN,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;oBACpB,IAAI,CAAC,MAAM;yBACR,OAAO,CACN,oGAAoG,CACrG;yBACA,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;oBAC9C,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;gBACtC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtC,IAAI,CAAC,MAAM;oBAAE,SAAS;gBACtB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC1C,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;oBACnD,IAAI,CAAC,YAAY;wBAAE,SAAS;oBAC5B,IAAI,CAAC,MAAM;yBACR,OAAO,CACN,0GAA0G,CAC3G;yBACA,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QACH,EAAE,EAAE,CAAC;IACP,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,KAKV;QACC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,qBAAqB,CAAC,KAAK,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnE,IAAI,CAAC,MAAM;aACR,OAAO,CACN,iIAAiI,CAClI;aACA,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,IAAI,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1E,OAAO;YACL,EAAE;YACF,QAAQ;YACR,YAAY;YACZ,WAAW;YACX,MAAM;YACN,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,aAAqB;QACtC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM;aACpB,OAAO,CAAC,6CAA6C,CAAC;aACtD,GAAG,CAAC,QAAQ,CAA0B,CAAC;QAC1C,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,WAAmB;QAC7B,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM;aACpB,OAAO,CAAC,uCAAuC,CAAC;aAChD,GAAG,CAAC,MAAM,CAA0B,CAAC;QACxC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,SAAS;QACP,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM;aACrB,OAAO,CAAC,gDAAgD,CAAC;aACzD,GAAG,EAAiB,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,MAIV;QACC,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QACxE,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM;aACR,OAAO,CACN,iFAAiF,CAClF;aACA,GAAG,CAAC,eAAe,IAAI,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,MAGtB;QACC,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9D,MAAM,YAAY,GAAG,qBAAqB,CAAC,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAChF,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM;aACR,OAAO,CACN,sEAAsE,CACvE;aACA,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,MAAkE;QACjF,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM;aACrB,OAAO,CAAC,0CAA0C,CAAC;aACnD,GAAG,CAAC,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAiC,CAAC;QAC3F,IAAI,CAAC,IAAI,EAAE,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM;aACR,OAAO,CACN,8FAA8F,CAC/F;aACA,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,WAAmB;QACvC,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM;aACrB,OAAO,CACN;;;;;;SAMC,CACF;aACA,GAAG,CAAC,MAAM,CAA8B,CAAC;QAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,WAAmB;QACpC,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM;aACR,OAAO,CAAC,+CAA+C,CAAC;aACxD,GAAG,CAAC,MAAM,CAAC,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,MAGpB;QACC,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1G,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE;YACtC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAChC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC,gBAAgB,CAAC;oBACpB,MAAM;oBACN,QAAQ;iBACT,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QACH,EAAE,EAAE,CAAC;QACL,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,aAAqB;QAC1C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM;aACpB,OAAO,CACN;;;;;;SAMC,CACF;aACA,GAAG,CAAC,QAAQ,CAAoC,CAAC;QACpD,OAAO,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,0BAA0B,CAAC,WAAmB;QAC5C,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM;aACrB,OAAO,CACN;;;;;;;SAOC,CACF;aACA,GAAG,CAAC,MAAM,CAA6B,CAAC;QAC3C,OAAO,IAAI;aACR,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;aAC1C,MAAM,CAAC,OAAO,CAAwB,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAKX;QACC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM;aACR,OAAO,CACN,gKAAgK,CACjK;aACA,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,IAAI,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjE,OAAO;YACL,EAAE;YACF,MAAM;YACN,IAAI;YACJ,SAAS;YACT,SAAS;YACT,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,cAAsB;QACpC,MAAM,SAAS,GAAG,qBAAqB,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM;aACpB,OAAO,CAAC,gDAAgD,CAAC;aACzD,GAAG,CAAC,SAAS,CAA0B,CAAC;QAC3C,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,YAAoB;QAC/B,MAAM,OAAO,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM;aACpB,OAAO,CAAC,wCAAwC,CAAC;aACjD,GAAG,CAAC,OAAO,CAA0B,CAAC;QACzC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,WAAmB;QACpC,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM;aACrB,OAAO,CAAC,sEAAsE,CAAC;aAC/E,GAAG,CAAC,MAAM,CAAgB,CAAC;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,YAAoB;QAC7B,MAAM,OAAO,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM;aACR,OAAO,CAAC,sEAAsE,CAAC;aAC/E,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,YAAoB;QAC9B,MAAM,OAAO,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM;aACR,OAAO,CAAC,oEAAoE,CAAC;aAC7E,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,YAAoB;QAC9B,MAAM,OAAO,GAAG,qBAAqB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM;aACvB,OAAO,CAAC,sCAAsC,CAAC;aAC/C,GAAG,CAAC,OAAO,CAAC,CAAC;QAChB,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAWd;QACC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAiB;YACxB,EAAE;YACF,WAAW,EAAE,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC;YACnD,YAAY,EAAE,mBAAmB,CAAC,KAAK,CAAC,YAAY,CAAC;YACrD,YAAY,EAAE,qBAAqB,CAAC,KAAK,CAAC,YAAY,EAAE,cAAc,CAAC;YACvE,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC;YACjD,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC;YACrD,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC;YACrD,SAAS,EAAE,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/C,EAAE,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,SAAS,EAAE,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/C,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC7C,SAAS;SACV,CAAC;QACF,IAAI,CAAC,MAAM;aACR,OAAO,CACN,4MAA4M,CAC7M;aACA,GAAG,CACF,GAAG,CAAC,EAAE,EACN,GAAG,CAAC,WAAW,IAAI,IAAI,EACvB,GAAG,CAAC,YAAY,IAAI,IAAI,EACxB,GAAG,CAAC,YAAY,EAChB,GAAG,CAAC,UAAU,IAAI,IAAI,EACtB,GAAG,CAAC,MAAM,EACV,GAAG,CAAC,MAAM,EACV,GAAG,CAAC,SAAS,IAAI,IAAI,EACrB,GAAG,CAAC,EAAE,IAAI,IAAI,EACd,GAAG,CAAC,SAAS,IAAI,IAAI,EACrB,GAAG,CAAC,QAAQ,IAAI,IAAI,EACpB,GAAG,CAAC,SAAS,CACd,CAAC;QACJ,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,MAAuB;QACpC,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAAuB,EAAE,KAAa;QAClD,OAAO;YACL,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YAC9B,KAAK;SACN,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,GAAc;QAC/B,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;YACxB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;YACpC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;YAC7C,WAAW,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;YAChE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;YAC7E,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;YACvC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;SACxC,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,GAAc;QAChC,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;YACxB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;YACjC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5B,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;YACvC,SAAS,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YAC5D,SAAS,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YAC5D,UAAU,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;YAC/D,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;YACvC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;SACxC,CAAC;IACJ,CAAC;IAEO,OAAO,CAAC,IAAe;QAC7B,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;CACF"}

package/bin/http/auth/CliAuthStateStore.d.ts

@@ -0,0 +1,33 @@
+/**
+ * CLI Bearer Token 解析模块。
+ *
+ * 关键点（中文）
+ * - 只解析显式 token 与环境变量 token，不再读取任何本机持久化默认值。
+ * - 这样远程 HTTP 鉴权始终是显式行为，不会出现本地“兜底复用”。
+ */
+/**
+ * Bearer Token 解析参数。
+ */
+export interface CliAuthStateStoreOptions {
+    /**
+     * 保留参数形状，当前不再使用本地存储。
+     */
+    dbPath?: string;
+}
+/**
+ * 解析当前 CLI 应使用的 Bearer Token。
+ *
+ * 优先级（中文）
+ * 1. 显式传入 token
+ * 2. 环境变量 `DC_AUTH_TOKEN`
+ */
+export declare function resolveCliAuthToken(params?: {
+    explicitToken?: string;
+    env?: NodeJS.ProcessEnv;
+    dbPath?: string;
+}): string | undefined;
+/**
+ * 生成标准 Authorization 头值。
+ */
+export declare function formatCliBearerHeaderValue(tokenInput: string | undefined): string | undefined;
+//# sourceMappingURL=CliAuthStateStore.d.ts.map

package/bin/http/auth/CliAuthStateStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CliAuthStateStore.d.ts","sourceRoot":"","sources":["../../../src/http/auth/CliAuthStateStore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,GAAE;IAC1C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACZ,GAAG,MAAM,GAAG,SAAS,CAO1B;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAE7F"}

package/bin/http/auth/CliAuthStateStore.js

@@ -0,0 +1,30 @@
+/**
+ * CLI Bearer Token 解析模块。
+ *
+ * 关键点（中文）
+ * - 只解析显式 token 与环境变量 token，不再读取任何本机持久化默认值。
+ * - 这样远程 HTTP 鉴权始终是显式行为，不会出现本地“兜底复用”。
+ */
+import { CLI_AUTH_TOKEN_ENV_KEY, formatBearerHeaderValue, resolveInvocationToken, } from "./AuthEnv.js";
+/**
+ * 解析当前 CLI 应使用的 Bearer Token。
+ *
+ * 优先级（中文）
+ * 1. 显式传入 token
+ * 2. 环境变量 `DC_AUTH_TOKEN`
+ */
+export function resolveCliAuthToken(params = {}) {
+    return resolveInvocationToken({
+        explicitToken: params.explicitToken,
+        env: {
+            [CLI_AUTH_TOKEN_ENV_KEY]: params.env?.[CLI_AUTH_TOKEN_ENV_KEY],
+        },
+    });
+}
+/**
+ * 生成标准 Authorization 头值。
+ */
+export function formatCliBearerHeaderValue(tokenInput) {
+    return formatBearerHeaderValue(tokenInput);
+}
+//# sourceMappingURL=CliAuthStateStore.js.map

package/bin/http/auth/CliAuthStateStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CliAuthStateStore.js","sourceRoot":"","sources":["../../../src/http/auth/CliAuthStateStore.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAYtB;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAIhC,EAAE;IACJ,OAAO,sBAAsB,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,GAAG,EAAE;YACH,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC;SAC/D;KACF,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CAAC,UAA8B;IACvE,OAAO,uBAAuB,CAAC,UAAU,CAAC,CAAC;AAC7C,CAAC"}

package/bin/http/auth/PasswordHasher.d.ts

@@ -0,0 +1,16 @@
+/**
+ * 密码哈希工具。
+ *
+ * 关键点（中文）
+ * - V1 先使用 Node 内建 `scryptSync`，避免引入额外依赖。
+ * - 存储格式固定为 `scrypt$<salt>$<hash>`，便于后续平滑升级。
+ */
+/**
+ * 哈希密码。
+ */
+export declare function hashPassword(passwordInput: string): string;
+/**
+ * 校验密码。
+ */
+export declare function verifyPassword(passwordInput: string, passwordHashInput: string): boolean;
+//# sourceMappingURL=PasswordHasher.d.ts.map

package/bin/http/auth/PasswordHasher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordHasher.d.ts","sourceRoot":"","sources":["../../../src/http/auth/PasswordHasher.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;GAEG;AACH,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAK1D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAYxF"}

package/bin/http/auth/PasswordHasher.js

@@ -0,0 +1,37 @@
+/**
+ * 密码哈希工具。
+ *
+ * 关键点（中文）
+ * - V1 先使用 Node 内建 `scryptSync`，避免引入额外依赖。
+ * - 存储格式固定为 `scrypt$<salt>$<hash>`，便于后续平滑升级。
+ */
+import { randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+/**
+ * 哈希密码。
+ */
+export function hashPassword(passwordInput) {
+    const password = String(passwordInput || "");
+    const salt = randomBytes(16).toString("hex");
+    const derived = scryptSync(password, salt, 64).toString("hex");
+    return `scrypt$${salt}$${derived}`;
+}
+/**
+ * 校验密码。
+ */
+export function verifyPassword(passwordInput, passwordHashInput) {
+    const password = String(passwordInput || "");
+    const passwordHash = String(passwordHashInput || "").trim();
+    const parts = passwordHash.split("$");
+    if (parts.length !== 3 || parts[0] !== "scrypt")
+        return false;
+    const salt = parts[1];
+    const expectedHex = parts[2];
+    if (!salt || !expectedHex)
+        return false;
+    const actual = scryptSync(password, salt, 64);
+    const expected = Buffer.from(expectedHex, "hex");
+    if (actual.length !== expected.length)
+        return false;
+    return timingSafeEqual(actual, expected);
+}
+//# sourceMappingURL=PasswordHasher.js.map

package/bin/http/auth/PasswordHasher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordHasher.js","sourceRoot":"","sources":["../../../src/http/auth/PasswordHasher.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,aAAqB;IAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,aAAqB,EAAE,iBAAyB;IAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC"}

package/bin/http/auth/RoutePolicy.d.ts

@@ -0,0 +1,30 @@
+/**
+ * 统一账户路由策略与全局守卫。
+ *
+ * 关键点（中文）
+ * - 这里负责把“哪些接口需要登录、需要什么权限”集中配置。
+ * - 当系统还没有任何统一账户用户时，受保护接口默认放行，避免首次 bootstrap 被锁死。
+ */
+import type { MiddlewareHandler } from "hono";
+import type { AuthRoutePolicy } from "../../shared/types/auth/AuthRoute.js";
+import type { AuthService } from "./AuthService.js";
+import { type AuthMiddlewareVariables } from "./AuthMiddleware.js";
+/**
+ * Server 侧路由权限矩阵。
+ */
+export declare const SERVER_AUTH_ROUTE_POLICIES: AuthRoutePolicy[];
+/**
+ * Console 网关侧路由权限矩阵。
+ */
+export declare const CONSOLE_AUTH_ROUTE_POLICIES: AuthRoutePolicy[];
+/**
+ * 根据路径与方法解析匹配的策略。
+ */
+export declare function resolveAuthRoutePolicy(path: string, method: string, policies: AuthRoutePolicy[]): AuthRoutePolicy | null;
+/**
+ * 创建全局路由鉴权中间件。
+ */
+export declare function createRouteAuthGuardMiddleware(authService: AuthService, policies?: AuthRoutePolicy[]): MiddlewareHandler<{
+    Variables: AuthMiddlewareVariables;
+}>;
+//# sourceMappingURL=RoutePolicy.d.ts.map

package/bin/http/auth/RoutePolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RoutePolicy.d.ts","sourceRoot":"","sources":["../../../src/http/auth/RoutePolicy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAGxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAA8B,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAE/F;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAAE,eAAe,EAoEvD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,2BAA2B,EAAE,eAAe,EA8DxD,CAAC;AAEF;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,eAAe,EAAE,GAC1B,eAAe,GAAG,IAAI,CASxB;AAED;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,WAAW,EACxB,QAAQ,GAAE,eAAe,EAA+B,GACvD,iBAAiB,CAAC;IAAE,SAAS,EAAE,uBAAuB,CAAA;CAAE,CAAC,CA4B3D"}