@downcity/agent 1.1.7 → 1.1.8

package/bin/shared/utils/store/schema.js

@@ -1,81 +0,0 @@
-/**
- * 模型存储表结构（drizzle schema）。
- *
- * 关键点（中文）
- * - providers 与 models 分表，使用 providerId 做关联。
- * - API Key 以密文字段存储（`apiKeyEncrypted`）。
- */
-import { index, integer, primaryKey, real, sqliteTable, text, } from "drizzle-orm/sqlite-core";
-export const modelProvidersTable = sqliteTable("model_providers", {
-    id: text("id").primaryKey(),
-    type: text("type").notNull(),
-    baseUrl: text("base_url"),
-    apiKeyEncrypted: text("api_key_encrypted"),
-    createdAt: text("created_at").notNull(),
-    updatedAt: text("updated_at").notNull(),
-});
-export const modelsTable = sqliteTable("models", {
-    id: text("id").primaryKey(),
-    providerId: text("provider_id").notNull(),
-    name: text("name").notNull(),
-    temperature: real("temperature"),
-    maxTokens: integer("max_tokens"),
-    topP: real("top_p"),
-    frequencyPenalty: real("frequency_penalty"),
-    presencePenalty: real("presence_penalty"),
-    anthropicVersion: text("anthropic_version"),
-    isPaused: integer("is_paused").notNull().default(0),
-    createdAt: text("created_at").notNull(),
-    updatedAt: text("updated_at").notNull(),
-}, (table) => ({
-    providerIdIdx: index("models_provider_id_idx").on(table.providerId),
-}));
-/**
- * 平台 Env 统一存储表。
- *
- * 关键点（中文）
- * - 全局 env 与 agent env 共用一张表，通过 `scope` + `agentId` 区分。
- * - `agentId` 在 `scope=global` 时固定为空字符串，避免 SQLite 复合主键中的 NULL 语义问题。
- * - value 采用密文存储，解密仅在运行时内存中进行。
- */
-export const envEntriesTable = sqliteTable("env_entries", {
-    scope: text("scope").notNull(),
-    agentId: text("agent_id").notNull().default(""),
-    key: text("key").notNull(),
-    description: text("description"),
-    valueEncrypted: text("value_encrypted").notNull(),
-    createdAt: text("created_at").notNull(),
-    updatedAt: text("updated_at").notNull(),
-}, (table) => ({
-    pk: primaryKey({
-        columns: [table.scope, table.agentId, table.key],
-        name: "env_entries_scope_agent_key_pk",
-    }),
-    scopeIdx: index("env_entries_scope_idx").on(table.scope),
-    agentIdIdx: index("env_entries_agent_id_idx").on(table.agentId),
-}));
-/**
- * Channel Account 表。
- *
- * 关键点（中文）
- * - 各渠道敏感字段独立密文列存储。
- * - `downcity.json` 仅保存 channelAccountId 绑定，不直接保存密钥。
- */
-export const channelAccountsTable = sqliteTable("channel_accounts", {
-    id: text("id").primaryKey(),
-    channel: text("channel").notNull(),
-    name: text("name").notNull(),
-    identity: text("identity"),
-    owner: text("owner"),
-    creator: text("creator"),
-    botTokenEncrypted: text("bot_token_encrypted"),
-    appIdEncrypted: text("app_id_encrypted"),
-    appSecretEncrypted: text("app_secret_encrypted"),
-    domain: text("domain"),
-    sandbox: integer("sandbox"),
-    createdAt: text("created_at").notNull(),
-    updatedAt: text("updated_at").notNull(),
-}, (table) => ({
-    channelIdx: index("channel_accounts_channel_idx").on(table.channel),
-}));
-//# sourceMappingURL=schema.js.map

package/bin/shared/utils/store/schema.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../../src/shared/utils/store/schema.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,KAAK,EACL,OAAO,EACP,UAAU,EACV,IAAI,EACJ,WAAW,EACX,IAAI,GACL,MAAM,yBAAyB,CAAC;AAEjC,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC,iBAAiB,EAAE;IAChE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;IACzB,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC;IAC1C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CACpC,QAAQ,EACR;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC;IAChC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC;IACnB,gBAAgB,EAAE,IAAI,CAAC,mBAAmB,CAAC;IAC3C,eAAe,EAAE,IAAI,CAAC,kBAAkB,CAAC;IACzC,gBAAgB,EAAE,IAAI,CAAC,mBAAmB,CAAC;IAC3C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACV,aAAa,EAAE,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;CACpE,CAAC,CACH,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CACxC,aAAa,EACb;IACE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;IAC1B,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC;IAChC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACV,EAAE,EAAE,UAAU,CAAC;QACb,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC;QAChD,IAAI,EAAE,gCAAgC;KACvC,CAAC;IACF,QAAQ,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;IACxD,UAAU,EAAE,KAAK,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;CAChE,CAAC,CACH,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAC7C,kBAAkB,EAClB;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IAClC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;IAC1B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;IACxB,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAAC;IAC9C,cAAc,EAAE,IAAI,CAAC,kBAAkB,CAAC;IACxC,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC;IAChD,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACV,UAAU,EAAE,KAAK,CAAC,8BAA8B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;CACpE,CAAC,CACH,CAAC"}

package/src/http/auth/AuthMiddleware.ts

@@ -1,61 +0,0 @@
-/**
- * Auth 中间件。
- *
- * 关键点（中文）
- * - 当前先服务 `/api/auth/*` 的受保护子路由。
- * - 后续把更多控制面路由切到 Bearer 鉴权时，可直接复用这一层。
- */
-
-import type { Context, MiddlewareHandler } from "hono";
-import type { AuthPrincipal } from "@/shared/types/auth/AuthTypes.js";
-import { isAuthError } from "./AuthError.js";
-import type { AuthService } from "./AuthService.js";
-
-/**
- * Hono Context 中保存 principal 的 key。
- */
-export const AUTH_PRINCIPAL_CONTEXT_KEY = "authPrincipal";
-
-/**
- * Auth 中间件变量映射。
- */
-export interface AuthMiddlewareVariables {
-  /**
-   * 当前请求的认证主体。
-   */
-  authPrincipal: AuthPrincipal;
-}
-
-/**
- * 生成 Bearer 鉴权中间件。
- */
-export function createRequireAuthMiddleware(
-  authService: AuthService,
-): MiddlewareHandler<{ Variables: AuthMiddlewareVariables }> {
-  return async (c, next) => {
-    try {
-      const principal = authService.authenticateBearerHeader(
-      c.req.header("authorization"),
-      );
-      c.set(AUTH_PRINCIPAL_CONTEXT_KEY, principal);
-      await next();
-    } catch (error) {
-      if (isAuthError(error)) {
-        return c.json(
-          { success: false, error: error.message },
-          error.status as 200,
-        );
-      }
-      return c.json({ success: false, error: String(error) }, 500);
-    }
-  };
-}
-
-/**
- * 从 Context 中读取 principal。
- */
-export function getAuthPrincipal(
-  context: Context<{ Variables: AuthMiddlewareVariables }>,
-): AuthPrincipal {
-  return context.get(AUTH_PRINCIPAL_CONTEXT_KEY);
-}

package/src/http/auth/AuthRoutes.ts

@@ -1,100 +0,0 @@
-/**
- * Auth API 路由。
- *
- * 关键点（中文）
- * - 本模块只承接 Bearer Token 模型下的最小认证接口。
- * - 路由层不做领域判断，所有业务逻辑统一委托给 `AuthService`。
- */
-
-import { Hono, type Context } from "hono";
-import type { AuthService } from "./AuthService.js";
-import { AuthService as DefaultAuthService } from "./AuthService.js";
-import { isAuthError } from "./AuthError.js";
-import {
-  createRequireAuthMiddleware,
-  getAuthPrincipal,
-  type AuthMiddlewareVariables,
-} from "./AuthMiddleware.js";
-
-/**
- * 注册 auth 路由。
- */
-export function registerAuthRoutes(params: {
-  app: Hono;
-  authService?: AuthService;
-}): void {
-  const authService = params.authService || new DefaultAuthService();
-  const router = new Hono();
-  const protectedRouter = new Hono<{ Variables: AuthMiddlewareVariables }>();
-  const requireAuth = createRequireAuthMiddleware(authService);
-
-  router.get("/status", (c) => {
-    const initialized = authService.hasLocalCliAccess();
-    return c.json({
-      success: true,
-      initialized,
-      requireToken: initialized,
-    });
-  });
-
-  protectedRouter.get("/me", requireAuth, (c) => {
-    const principal = getAuthPrincipal(c);
-    return c.json({
-      success: true,
-      user: authService.getCurrentUser(principal),
-    });
-  });
-
-  protectedRouter.get("/token/list", requireAuth, (c) => {
-    const principal = getAuthPrincipal(c);
-    return c.json({
-      success: true,
-      tokens: authService.listTokens(principal),
-    });
-  });
-
-  protectedRouter.post("/token/create", requireAuth, async (c) => {
-    try {
-      const principal = getAuthPrincipal(c);
-      const body = (await c.req.json().catch(() => ({}))) as {
-        name?: string;
-        expiresAt?: string;
-      };
-      return c.json({
-        success: true,
-        token: authService.createToken(principal, {
-          name: String(body.name || ""),
-          expiresAt: typeof body.expiresAt === "string" ? body.expiresAt : undefined,
-        }),
-      });
-    } catch (error) {
-      return toErrorResponse(c, error);
-    }
-  });
-
-  protectedRouter.post("/token/delete", requireAuth, async (c) => {
-    try {
-      const principal = getAuthPrincipal(c);
-      const body = (await c.req.json().catch(() => ({}))) as {
-        tokenId?: string;
-      };
-      authService.deleteToken(principal, String(body.tokenId || ""));
-      return c.json({ success: true });
-    } catch (error) {
-      return toErrorResponse(c, error);
-    }
-  });
-
-  router.route("/", protectedRouter);
-  params.app.route("/api/auth", router);
-}
-
-function toErrorResponse(c: Context, error: unknown) {
-  if (isAuthError(error)) {
-    return c.json(
-      { success: false, error: error.message },
-      error.status as 200,
-    );
-  }
-  return c.json({ success: false, error: String(error) }, 500);
-}

package/src/http/auth/AuthService.ts

@@ -1,367 +0,0 @@
-/**
- * 统一账户服务层。
- *
- * 关键点（中文）
- * - 该模块承接本机 token 初始化、token 校验与 token 管理等业务语义。
- * - 路由层只调用这里，不直接碰数据库与密码哈希细节。
- */
-
-import type { AuthIssuedToken, AuthTokenSummary } from "@/shared/types/auth/AuthToken.js";
-import type { AuthPrincipal, AuthTokenRecord, AuthUser } from "@/shared/types/auth/AuthTypes.js";
-import { optionalTrimmedText } from "@/shared/utils/store/StoreShared.js";
-import { AuthError } from "./AuthError.js";
-import { AuthStore, type AuthStoreOptions } from "./AuthStore.js";
-import { extractBearerToken, generateAccessToken, hashAccessToken } from "./TokenService.js";
-
-const LOCAL_CLI_USERNAME = "local-cli";
-const LOCAL_CLI_DISPLAY_NAME = "Local CLI";
-const LOCAL_CLI_PASSWORD_HASH = "[token-only-local-cli]";
-
-/**
- * AuthService 构造参数。
- */
-export interface AuthServiceOptions extends AuthStoreOptions {
-  /**
-   * 复用外部传入的 store。
-   */
-  store?: AuthStore;
-}
-
-/**
- * 登录/初始化后返回的用户摘要。
- */
-export interface AuthCurrentUserPayload {
-  /**
-   * 用户 ID。
-   */
-  id: string;
-  /**
-   * 用户名。
-   */
-  username: string;
-  /**
-   * 展示名。
-   */
-  displayName?: string;
-  /**
-   * 角色列表。
-   */
-  roles: string[];
-  /**
-   * 权限列表。
-   */
-  permissions: string[];
-}
-
-/**
- * AuthService 门面。
- */
-export class AuthService {
-  private readonly store: AuthStore;
-  private readonly ownsStore: boolean;
-
-  constructor(options: AuthServiceOptions = {}) {
-    if (options.store) {
-      this.store = options.store;
-      this.ownsStore = false;
-      return;
-    }
-    this.store = new AuthStore(options);
-    this.ownsStore = true;
-  }
-
-  /**
-   * 关闭底层连接。
-   */
-  close(): void {
-    if (this.ownsStore) this.store.close();
-  }
-
-  /**
-   * 判断当前是否已经存在可用的本机 CLI access token。
-   */
-  hasLocalCliAccess(): boolean {
-    const user = this.store.findUserByUsername(LOCAL_CLI_USERNAME);
-    if (!user) return false;
-    return this.store
-      .listTokensByUserId(user.id)
-      .some((item) => this.isTokenActive(item));
-  }
-
-  /**
-   * 确保存在本机 CLI 主体，并为其签发新的 access token。
-   */
-  ensureLocalCliAccess(input: {
-    tokenName: string;
-    expiresAt?: string;
-  }): { user: AuthCurrentUserPayload; token: AuthIssuedToken } {
-    const token = this.createLocalCliToken({
-      name: input.tokenName,
-      expiresAt: input.expiresAt,
-    });
-    const user = this.requireLocalCliUser();
-    return {
-      user: this.toUserPayload(user),
-      token,
-    };
-  }
-
-  /**
-   * 读取本机 CLI 主体的 token 列表。
-   */
-  listLocalCliTokens(): AuthTokenSummary[] {
-    const user = this.store.findUserByUsername(LOCAL_CLI_USERNAME);
-    if (!user) return [];
-    return this.store
-      .listTokensByUserId(user.id)
-      .filter((item) => !item.revokedAt)
-      .map((item) => this.store.toTokenSummary(item));
-  }
-
-  /**
-   * 为本机 CLI 主体签发新的 access token。
-   */
-  createLocalCliToken(input: {
-    name: string;
-    expiresAt?: string;
-  }): AuthIssuedToken {
-    const user = this.ensureLocalCliUser();
-    const issued = this.issueTokenForUser({
-      user,
-      tokenName: input.name,
-      expiresAt: input.expiresAt,
-    });
-    this.store.insertAuditLog({
-      actorUserId: user.id,
-      resourceType: "auth_token",
-      resourceId: issued.record.id,
-      action: "token_create",
-      result: "success",
-      metaJson: JSON.stringify({
-        name: issued.record.name,
-        source: "local-cli",
-      }),
-    });
-    return issued.token;
-  }
-
-  /**
-   * 删除本机 CLI 主体下的 token。
-   */
-  deleteLocalCliToken(tokenIdInput: string): void {
-    const user = this.requireLocalCliUser();
-    const record = this.requireLocalCliTokenRecord(tokenIdInput, user.id);
-    const deleted = this.store.deleteToken(record.id);
-    if (!deleted) throw new AuthError("Token not found", 404);
-    this.store.insertAuditLog({
-      actorUserId: user.id,
-      resourceType: "auth_token",
-      resourceId: record.id,
-      action: "token_delete",
-      result: "success",
-      metaJson: JSON.stringify({
-        name: record.name,
-        source: "local-cli",
-      }),
-    });
-  }
-
-  /**
-   * 解析 Authorization 头并返回 principal。
-   */
-  authenticateBearerHeader(headerValue: string | undefined): AuthPrincipal {
-    const plainToken = extractBearerToken(headerValue);
-    if (!plainToken) throw new AuthError("Missing bearer token", 401);
-    const record = this.store.findTokenByHash(hashAccessToken(plainToken));
-    if (!record) throw new AuthError("Invalid bearer token", 401);
-    if (record.revokedAt) throw new AuthError("Token is revoked", 401);
-    if (record.expiresAt && new Date(record.expiresAt).getTime() <= Date.now()) {
-      throw new AuthError("Token is expired", 401);
-    }
-    const user = this.store.getUserById(record.userId);
-    if (!user) throw new AuthError("User not found for token", 401);
-    this.ensureUserActive(user);
-    this.store.touchToken(record.id);
-    return {
-      userId: user.id,
-      username: user.username,
-      displayName: user.displayName,
-      status: user.status,
-      tokenId: record.id,
-      tokenName: record.name,
-      roles: this.store.listRoleNamesByUserId(user.id),
-      permissions: this.store.listPermissionKeysByUserId(user.id),
-    };
-  }
-
-  /**
-   * 返回当前用户信息。
-   */
-  getCurrentUser(principal: AuthPrincipal): AuthCurrentUserPayload {
-    return {
-      id: principal.userId,
-      username: principal.username,
-      displayName: principal.displayName,
-      roles: [...principal.roles],
-      permissions: [...principal.permissions],
-    };
-  }
-
-  /**
-   * 为当前 Bearer 调用主体创建新的 token。
-   */
-  createToken(principal: AuthPrincipal, input: {
-    name: string;
-    expiresAt?: string;
-  }): AuthIssuedToken {
-    const user = this.store.getUserById(principal.userId);
-    if (!user) throw new AuthError("User not found", 404);
-    const issued = this.issueTokenForUser({
-      user,
-      tokenName: input.name,
-      expiresAt: input.expiresAt,
-    });
-    this.store.insertAuditLog({
-      actorUserId: principal.userId,
-      actorTokenId: principal.tokenId,
-      resourceType: "auth_token",
-      resourceId: issued.record.id,
-      action: "token_create",
-      result: "success",
-      metaJson: JSON.stringify({ name: issued.record.name }),
-    });
-    return issued.token;
-  }
-
-  /**
-   * 读取当前用户 token 列表。
-   */
-  listTokens(principal: AuthPrincipal): AuthTokenSummary[] {
-    return this.store
-      .listTokensByUserId(principal.userId)
-      .filter((item) => !item.revokedAt)
-      .map((item) => this.store.toTokenSummary(item));
-  }
-
-  /**
-   * 删除当前用户的 token。
-   */
-  deleteToken(principal: AuthPrincipal, tokenIdInput: string): void {
-    const tokenId = String(tokenIdInput || "").trim();
-    if (!tokenId) throw new AuthError("tokenId is required", 400);
-    const record = this.store.getTokenById(tokenId);
-    if (!record || record.userId !== principal.userId) {
-      throw new AuthError("Token not found", 404);
-    }
-    const deleted = this.store.deleteToken(record.id);
-    if (!deleted) throw new AuthError("Token not found", 404);
-    this.store.insertAuditLog({
-      actorUserId: principal.userId,
-      actorTokenId: principal.tokenId,
-      resourceType: "auth_token",
-      resourceId: tokenId,
-      action: "token_delete",
-      result: "success",
-      metaJson: JSON.stringify({ name: record.name }),
-    });
-  }
-
-  private issueTokenForUser(params: {
-    user: AuthUser;
-    tokenName: string;
-    expiresAt?: string;
-  }): { record: ReturnType<AuthStore["createToken"]>; token: AuthIssuedToken } {
-    const plainToken = generateAccessToken();
-    const record = this.store.createToken({
-      userId: params.user.id,
-      name: this.requireTokenName(params.tokenName),
-      tokenHash: hashAccessToken(plainToken),
-      expiresAt: optionalTrimmedText(params.expiresAt),
-    });
-    return {
-      record,
-      token: this.store.toIssuedToken(record, plainToken),
-    };
-  }
-
-  private ensureUserActive(user: AuthUser): void {
-    if (user.status !== "active") {
-      throw new AuthError("User is disabled", 403);
-    }
-  }
-
-  private isTokenActive(record: Pick<AuthTokenRecord, "revokedAt" | "expiresAt">): boolean {
-    if (record.revokedAt) return false;
-    if (!record.expiresAt) return true;
-    return new Date(record.expiresAt).getTime() > Date.now();
-  }
-
-  private ensureLocalCliUser(): AuthUser {
-    this.store.ensureDefaultCatalog();
-    const existing = this.store.findUserByUsername(LOCAL_CLI_USERNAME);
-    if (existing) {
-      this.ensureUserActive(existing);
-      return existing;
-    }
-    const user = this.store.createUser({
-      username: LOCAL_CLI_USERNAME,
-      passwordHash: LOCAL_CLI_PASSWORD_HASH,
-      displayName: LOCAL_CLI_DISPLAY_NAME,
-      status: "active",
-    });
-    this.store.assignRoleToUser({
-      userId: user.id,
-      roleName: "admin",
-    });
-    return user;
-  }
-
-  private requireTokenName(value: string): string {
-    const tokenName = String(value || "").trim();
-    if (!tokenName) throw new AuthError("token name is required", 400);
-    return tokenName;
-  }
-
-  private requireUserId(value: string): string {
-    const userId = String(value || "").trim();
-    if (!userId) throw new AuthError("userId is required", 400);
-    return userId;
-  }
-
-  private requireUser(userIdInput: string): AuthUser {
-    const userId = this.requireUserId(userIdInput);
-    const user = this.store.getUserById(userId);
-    if (!user) throw new AuthError("User not found", 404);
-    return user;
-  }
-
-  private requireLocalCliUser(): AuthUser {
-    const user = this.store.findUserByUsername(LOCAL_CLI_USERNAME);
-    if (!user) throw new AuthError("Local CLI access is not initialized", 404);
-    this.ensureUserActive(user);
-    return user;
-  }
-
-  private requireLocalCliTokenRecord(
-    tokenIdInput: string,
-    expectedUserId: string,
-  ): AuthTokenRecord {
-    const tokenId = String(tokenIdInput || "").trim();
-    if (!tokenId) throw new AuthError("tokenId is required", 400);
-    const record = this.store.getTokenById(tokenId);
-    if (!record || record.userId !== expectedUserId) {
-      throw new AuthError("Token not found", 404);
-    }
-    return record;
-  }
-
-  private toUserPayload(user: AuthUser): AuthCurrentUserPayload {
-    return {
-      id: user.id,
-      username: user.username,
-      displayName: user.displayName,
-      roles: this.store.listRoleNamesByUserId(user.id),
-      permissions: this.store.listPermissionKeysByUserId(user.id),
-    };
-  }
-}