@h-ai/api-contract 0.1.0-alpha.71 → 0.1.0-alpha.73

package/README.en.md

@@ -137,6 +137,16 @@ const contract = apiContract.create({ feedback: apiContract.feedback })
 const path = apiContract.pathOf(contract.feedback.reports.submit)
 ```
 
+## Optional interactive challenges
+
+IamCreateCaptchaInputSchema/IamCaptchaChallengeSchema define POST /auth/captcha purposes and public challenges. Interactive inputs accept optional captcha up to4096 characters; public configuration exposes only enabled, defaulting false. Schemas validate structure; IAM enforces expiry, purpose and one-use consumption server-side.
+
+See policy, defaults and recovery boundaries in [IAM](../iam/README.en.md).
+
+## Page exit session policy
+
+`session.endOnPageHide` defaults to `false`. Hosts call `actions.bindPageExit({ enabled: config.session.endOnPageHide })` and invoke its returned cleanup on unmount; standard admin/H5/fullstack templates already bind it. A non-BFCache `pagehide` (including reload and full document navigation) makes a best effort POST to `/auth/session/close`, revoking the held access and related refresh through the existing CSRF/encrypted transport with `keepalive` and no automatic refresh. This response does not clear cookies/local credentials, avoiding a late old response overwriting a new login. Explicit logout still revokes and clears current credentials normally. Browsers may omit page exit requests; configure server `idleTimeout`/`absoluteTimeout` as appropriate. Immediate revocation on browser close is not guaranteed.
+
 ## Development and testing
 
 ```bash

package/README.ja.md

@@ -137,6 +137,16 @@ const contract = apiContract.create({ feedback: apiContract.feedback })
 const path = apiContract.pathOf(contract.feedback.reports.submit)
 ```
 
+## 任意の対話チャレンジ
+
+IamCreateCaptchaInputSchema/IamCaptchaChallengeSchema は POST /auth/captcha の用途と公開チャレンジを定義します。対話入力の captcha は任意で最大4096文字、公開設定は既定 false の enabled のみです。Schema は構造を検証し、期限・用途・単用消費はサーバー IAM が実行します。
+
+方針・既定値・復旧範囲は次を参照： [IAM](../iam/README.ja.md)。
+
+## ページ離脱時のセッション方針
+
+`session.endOnPageHide` の既定値は `false` です。ホストは `actions.bindPageExit({ enabled: config.session.endOnPageHide })` を呼び、破棄時に戻り値の解除関数を実行します。標準 admin/H5/fullstack テンプレートは接続済みです。BFCache 以外の `pagehide`（再読み込み、文書全体の移動を含む）で POST `/auth/session/close` を最善努力で送信し、保持する access と関連 refresh を失効します。既存の CSRF/暗号化転送を使用し、`keepalive` を付け、自動更新しません。古い応答が新しいログインを上書きしないよう Cookie/ローカル資格情報を消去しません。明示的ログアウトは通常どおり失効と消去を行います。ブラウザーが離脱要求を送らない場合もあるため、業務に応じてサーバーの `idleTimeout`/`absoluteTimeout` を併用してください。閉じた瞬間の失効は保証できません。
+
 ## 開発とテスト
 
 ```bash

package/README.md

@@ -137,6 +137,16 @@ const contract = apiContract.create({ feedback: apiContract.feedback })
 const path = apiContract.pathOf(contract.feedback.reports.submit)
 ```
 
+## 可选交互挑战
+
+IamCreateCaptchaInputSchema / IamCaptchaChallengeSchema 定义 POST /auth/captcha 的用途与可公开挑战，交互鉴别输入允许最多4096字符的可选 captcha。IamPublicConfigSchema.captcha 仅含 enabled，缺省关闭。Schema 校验结构，证明有效期、用途和单次消费由服务端 IAM 执行。
+
+策略、默认值和恢复边界见 [IAM](../iam/README.md)。
+
+## 页面离开会话策略
+
+`session.endOnPageHide` 默认 `false`。启用后宿主调用 `actions.bindPageExit({ enabled: config.session.endOnPageHide })` 并在卸载时调用返回的清理函数；标准 admin/H5/fullstack 模板已经接入。非 BFCache 的 `pagehide`（也包括刷新、整页导航）通过 POST `/auth/session/close` 尽力撤销当前 access 及关联 refresh，沿用 CSRF/传输加密，使用 `keepalive` 且不自动刷新会话。该响应不清 Cookie/本地凭据，避免旧响应覆盖下一次登录。显式退出仍使用正常 logout，可靠撤销并清理当前凭据。浏览器可能不发送页面离开请求，因此必须按业务配合服务端 `idleTimeout`/`absoluteTimeout`；不能据此保证关闭即撤销。
+
 ## 开发测试
 
 ```bash

package/dist/{chunk-DL2OYVLO.js → chunk-QT3QKHRS.js}

@@ -2,6 +2,24 @@ import { PaginationQuerySchema, paginatedSchema } from './chunk-CCCPHO6X.js';
 import { haiResultSchema, route, HaiVoidResultSchema } from './chunk-5UEDYQLG.js';
 import { z } from 'zod';
 
+var captchaProofSchema = z.string().min(1).max(4096).optional();
+var IamCreateCaptchaInputSchema = z.object({ operation: z.enum(["login", "register", "sendOtp", "passwordReset", "renewPassword"]) });
+var IamCaptchaChallengeSchema = z.object({
+  id: z.string().regex(/^[a-f0-9]{64}$/),
+  challenge: z.object({
+    signature: z.string().max(256).optional(),
+    parameters: z.object({
+      algorithm: z.string().refine((value) => value === "PBKDF2/SHA-256"),
+      nonce: z.string().min(1).max(256),
+      salt: z.string().min(1).max(256),
+      cost: z.number().int().min(100).max(5e4),
+      keyLength: z.number().int().min(16).max(64),
+      keyPrefix: z.string().min(1).max(128),
+      keySignature: z.string().max(256).optional(),
+      data: z.record(z.string(), z.union([z.string(), z.number(), z.boolean(), z.null()])).optional()
+    })
+  })
+});
 var IamUserSchema = z.object({
   id: z.string(),
   username: z.string(),
@@ -10,6 +28,11 @@ var IamUserSchema = z.object({
   displayName: z.string().optional(),
   avatarUrl: z.string().optional(),
   enabled: z.boolean(),
+  accountType: z.enum(["permanent", "temporary"]).optional(),
+  accountStatus: z.enum(["active", "dormant", "closed"]).optional(),
+  accountExpiresAt: z.coerce.date().nullable().optional(),
+  lastLoginAt: z.coerce.date().nullable().optional(),
+  mustChangePassword: z.boolean().optional(),
   emailVerified: z.boolean().optional(),
   phoneVerified: z.boolean().optional(),
   createdAt: z.coerce.date(),
@@ -43,23 +66,31 @@ var IamCurrentUserSchema = IamUserSchema.extend({
   permissions: z.array(z.string())
 });
 var IamLoginInputSchema = z.object({
+  captcha: captchaProofSchema,
   identifier: z.string().min(1),
   password: z.string().min(1)
 });
-var IamLdapLoginInputSchema = z.object({ username: z.string().trim().min(1), password: z.string().min(1) });
-var IamRequestPasswordResetInputSchema = z.object({ identifier: z.string().trim().min(1) });
+var IamLdapLoginInputSchema = z.object({ username: z.string().trim().min(1), password: z.string().min(1), captcha: captchaProofSchema });
+var IamRequestPasswordResetInputSchema = z.object({ identifier: z.string().trim().min(1), captcha: captchaProofSchema });
 var IamConfirmPasswordResetInputSchema = z.object({ token: z.string().min(1), newPassword: z.string().min(1) });
+var IamRenewPasswordInputSchema = z.object({ identifier: z.string().trim().min(1), password: z.string().min(1), newPassword: z.string().min(1), captcha: captchaProofSchema });
+var IamReauthenticateInputSchema = z.object({ password: z.string().min(1), operation: z.string().trim().min(1).max(128) });
+var IamReauthenticationProofSchema = z.object({ ticket: z.string().min(1), expiresAt: z.number() });
 var IamPublicConfigSchema = z.object({
-  password: z.object({ minLength: z.number(), maxLength: z.number(), requireUppercase: z.boolean(), requireLowercase: z.boolean(), requireNumber: z.boolean(), requireSpecialChar: z.boolean(), expirationDays: z.number() }),
+  captcha: z.object({ enabled: z.boolean() }).default({ enabled: false }),
+  reauthentication: z.object({ enabled: z.boolean(), operations: z.array(z.string()) }).optional(),
+  initialCredentials: z.object({ enabled: z.boolean() }).optional(),
+  password: z.object({ minLength: z.number(), maxLength: z.number(), requireUppercase: z.boolean(), requireLowercase: z.boolean(), requireNumber: z.boolean(), requireSpecialChar: z.boolean(), expirationDays: z.number(), minCharacterClasses: z.number().optional(), preventSamePassword: z.boolean().optional(), requireInitialChange: z.boolean().optional() }),
   register: z.object({ enabled: z.boolean() }),
   login: z.object({ password: z.boolean(), otp: z.boolean(), ldap: z.boolean(), email: z.boolean(), sms: z.boolean() }),
   passwordReset: z.object({ enabled: z.boolean(), mode: z.enum(["email", "phone"]) }),
   otp: z.object({ length: z.number(), resendInterval: z.number() }),
   agreements: IamAgreementDisplaySchema,
   ui: z.object({ variant: z.enum(["card", "split"]), title: z.string().optional(), subtitle: z.string().optional(), brandTitle: z.string().optional(), brandText: z.string().optional(), logoUrl: z.string().optional(), illustrationUrl: z.string().optional() }),
-  session: z.object({ maxAge: z.number() })
+  session: z.object({ maxAge: z.number(), endOnPageHide: z.boolean().default(false) })
 });
 var IamOtpLoginInputSchema = z.object({
+  captcha: captchaProofSchema,
   identifier: z.string().min(1),
   code: z.string().min(1)
 });
@@ -67,6 +98,7 @@ var IamLogoutInputSchema = z.object({
   accessToken: z.string().min(1).optional()
 });
 var IamSendOtpInputSchema = z.object({
+  captcha: captchaProofSchema,
   identifier: z.string().min(1)
 });
 var IamSendOtpDataSchema = z.object({
@@ -79,6 +111,7 @@ var IamRefreshTokenDataSchema = z.object({
   tokens: IamTokenPairSchema
 });
 var IamRegisterInputSchema = z.object({
+  captcha: captchaProofSchema,
   username: z.string().min(1),
   password: z.string().min(1),
   email: z.string().email().optional(),
@@ -105,6 +138,9 @@ var IamListUsersInputSchema = PaginationQuerySchema.extend({
   enabled: z.enum(["true", "false"]).optional().transform((v) => v === void 0 ? void 0 : v === "true")
 });
 var IamAdminCreateUserInputSchema = z.object({
+  accountType: z.enum(["permanent", "temporary"]).optional(),
+  accountStatus: z.enum(["active", "dormant", "closed"]).optional(),
+  accountExpiresAt: z.coerce.date().optional(),
   username: z.string().min(1),
   email: z.string().email().optional(),
   phone: z.string().optional(),
@@ -114,7 +150,11 @@ var IamAdminCreateUserInputSchema = z.object({
   roleIds: z.array(z.string()).optional(),
   enabled: z.boolean().optional()
 });
+var IamInviteUserInputSchema = IamAdminCreateUserInputSchema.omit({ password: true }).extend({ enabled: z.literal(true).optional(), accountStatus: z.literal("active").optional() });
 var IamAdminUpdateUserInputSchema = z.object({
+  accountType: z.enum(["permanent", "temporary"]).optional(),
+  accountStatus: z.enum(["active", "dormant", "closed"]).optional(),
+  accountExpiresAt: z.coerce.date().nullable().optional(),
   id: z.string().min(1),
   username: z.string().min(1).optional(),
   email: z.string().email().optional(),
@@ -183,13 +223,17 @@ var userOutputSchema = haiResultSchema(IamUserSchema);
 var roleOutputSchema = haiResultSchema(IamRoleSchema);
 var iamContract = {
   auth: {
+    createCaptcha: route({ method: "POST", path: "/auth/captcha", operationId: "iam.auth.createCaptcha", summary: "Create self-hosted security challenge", tags: ["iam", "auth"] }).input(IamCreateCaptchaInputSchema).output(haiResultSchema(IamCaptchaChallengeSchema)),
+    reauthenticate: route({ method: "POST", path: "/auth/reauthenticate", operationId: "iam.auth.reauthenticate", summary: "Verify current password for one sensitive operation", tags: ["iam", "auth"] }).input(IamReauthenticateInputSchema).output(haiResultSchema(IamReauthenticationProofSchema)),
     publicConfig: route({ method: "GET", path: "/auth/config", operationId: "iam.auth.publicConfig", summary: "Public authentication configuration", tags: ["iam", "auth"] }).output(haiResultSchema(IamPublicConfigSchema.nullable())),
+    renewPassword: route({ method: "POST", path: "/auth/password/renew", operationId: "iam.auth.renewPassword", summary: "Change initial or expired password", tags: ["iam", "auth"] }).input(IamRenewPasswordInputSchema).output(HaiVoidResultSchema),
     loginWithLdap: route({ method: "POST", path: "/auth/login/ldap", operationId: "iam.auth.loginWithLdap", summary: "LDAP login", tags: ["iam", "auth"] }).input(IamLdapLoginInputSchema).output(authResultOutputSchema),
     requestPasswordReset: route({ method: "POST", path: "/auth/password-reset/request", operationId: "iam.auth.requestPasswordReset", summary: "Request password reset", tags: ["iam", "auth"] }).input(IamRequestPasswordResetInputSchema).output(HaiVoidResultSchema),
     confirmPasswordReset: route({ method: "POST", path: "/auth/password-reset/confirm", operationId: "iam.auth.confirmPasswordReset", summary: "Confirm password reset", tags: ["iam", "auth"] }).input(IamConfirmPasswordResetInputSchema).output(HaiVoidResultSchema),
     login: route({ method: "POST", path: "/auth/login", operationId: "iam.auth.login", summary: "Password login", tags: ["iam", "auth"] }).input(IamLoginInputSchema).output(authResultOutputSchema),
     loginWithOtp: route({ method: "POST", path: "/auth/login/otp", operationId: "iam.auth.loginWithOtp", summary: "OTP login", tags: ["iam", "auth"] }).input(IamOtpLoginInputSchema).output(authResultOutputSchema),
     logout: route({ method: "POST", path: "/auth/logout", operationId: "iam.auth.logout", summary: "Logout", tags: ["iam", "auth"] }).input(IamLogoutInputSchema).output(HaiVoidResultSchema),
+    closeSession: route({ method: "POST", path: "/auth/session/close", operationId: "iam.auth.closeSession", summary: "Revoke departing client session without clearing newer cookies", tags: ["iam", "auth"] }).input(IamLogoutInputSchema).output(HaiVoidResultSchema),
     currentUser: route({ method: "GET", path: "/auth/me", operationId: "iam.auth.currentUser", summary: "Get current user and access scope", tags: ["iam", "auth"] }).output(haiResultSchema(IamCurrentUserSchema)),
     refresh: route({ method: "POST", path: "/auth/refresh", operationId: "iam.auth.refresh", summary: "Refresh access token", tags: ["iam", "auth"] }).input(IamRefreshTokenInputSchema).output(haiResultSchema(IamRefreshTokenDataSchema)),
     sendOtp: route({ method: "POST", path: "/auth/otp/send", operationId: "iam.auth.sendOtp", summary: "Send OTP", tags: ["iam", "auth"] }).input(IamSendOtpInputSchema).output(haiResultSchema(IamSendOtpDataSchema)),
@@ -198,6 +242,7 @@ var iamContract = {
     updateCurrentUser: route({ method: "PUT", path: "/auth/me", operationId: "iam.auth.updateCurrentUser", summary: "Update current user", tags: ["iam", "auth"] }).input(IamUpdateCurrentUserInputSchema).output(userOutputSchema)
   },
   users: {
+    invite: route({ method: "POST", path: "/iam/users/invite", operationId: "iam.users.invite", summary: "Create account with one-time setup invitation", tags: ["iam", "users"] }).input(IamInviteUserInputSchema).output(userOutputSchema),
     list: route({ method: "GET", path: "/iam/users", operationId: "iam.users.list", summary: "List users", tags: ["iam", "users"] }).input(IamListUsersInputSchema).output(haiResultSchema(paginatedSchema(IamUserSchema))),
     get: route({ method: "GET", path: "/iam/users/{id}", operationId: "iam.users.get", summary: "Get user", tags: ["iam", "users"] }).input(IamUserIdInputSchema).output(haiResultSchema(IamUserSchema.nullable())),
     create: route({ method: "POST", path: "/iam/users", operationId: "iam.users.create", summary: "Create user", tags: ["iam", "users"] }).input(IamAdminCreateUserInputSchema).output(userOutputSchema),
@@ -220,6 +265,6 @@ var iamContract = {
   }
 };
 
-export { IamAdminCreateUserInputSchema, IamAdminResetPasswordInputSchema, IamAdminUpdateUserInputSchema, IamAgreementDisplaySchema, IamAuthResultSchema, IamChangePasswordInputSchema, IamConfirmPasswordResetInputSchema, IamCreatePermissionInputSchema, IamCreateRoleInputSchema, IamCurrentUserSchema, IamLdapLoginInputSchema, IamListPermissionsInputSchema, IamListUsersInputSchema, IamLoginInputSchema, IamLogoutInputSchema, IamOtpLoginInputSchema, IamPermissionSchema, IamPermissionTypeSchema, IamPublicConfigSchema, IamRefreshTokenDataSchema, IamRefreshTokenInputSchema, IamRegisterInputSchema, IamRequestPasswordResetInputSchema, IamRoleSchema, IamSendOtpDataSchema, IamSendOtpInputSchema, IamTokenPairSchema, IamUpdateCurrentUserInputSchema, IamUpdateRoleInputSchema, IamUserIdInputSchema, IamUserSchema, iamContract };
-//# sourceMappingURL=chunk-DL2OYVLO.js.map
-//# sourceMappingURL=chunk-DL2OYVLO.js.map
+export { IamAdminCreateUserInputSchema, IamAdminResetPasswordInputSchema, IamAdminUpdateUserInputSchema, IamAgreementDisplaySchema, IamAuthResultSchema, IamCaptchaChallengeSchema, IamChangePasswordInputSchema, IamConfirmPasswordResetInputSchema, IamCreateCaptchaInputSchema, IamCreatePermissionInputSchema, IamCreateRoleInputSchema, IamCurrentUserSchema, IamInviteUserInputSchema, IamLdapLoginInputSchema, IamListPermissionsInputSchema, IamListUsersInputSchema, IamLoginInputSchema, IamLogoutInputSchema, IamOtpLoginInputSchema, IamPermissionSchema, IamPermissionTypeSchema, IamPublicConfigSchema, IamReauthenticateInputSchema, IamReauthenticationProofSchema, IamRefreshTokenDataSchema, IamRefreshTokenInputSchema, IamRegisterInputSchema, IamRenewPasswordInputSchema, IamRequestPasswordResetInputSchema, IamRoleSchema, IamSendOtpDataSchema, IamSendOtpInputSchema, IamTokenPairSchema, IamUpdateCurrentUserInputSchema, IamUpdateRoleInputSchema, IamUserIdInputSchema, IamUserSchema, iamContract };
+//# sourceMappingURL=chunk-QT3QKHRS.js.map
+//# sourceMappingURL=chunk-QT3QKHRS.js.map

package/dist/chunk-QT3QKHRS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/iam/iam-schemas.ts","../src/iam/iam-contract.ts"],"names":[],"mappings":";;;;AAYA,IAAM,kBAAA,GAAqB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,IAAI,CAAA,CAAE,QAAA,EAAS;AAUzD,IAAM,2BAAA,GAA8B,CAAA,CAAE,MAAA,CAAO,EAAE,WAAW,CAAA,CAAE,IAAA,CAAK,CAAC,OAAA,EAAS,YAAY,SAAA,EAAW,eAAA,EAAiB,eAAe,CAAC,GAAG;AAUtI,IAAM,yBAAA,GAA4B,EAAE,MAAA,CAAO;AAAA,EAChD,EAAA,EAAI,CAAA,CAAE,MAAA,EAAO,CAAE,MAAM,gBAAgB,CAAA;AAAA,EACrC,SAAA,EAAW,EAAE,MAAA,CAAO;AAAA,IAClB,WAAW,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,IACxC,UAAA,EAAY,EAAE,MAAA,CAAO;AAAA,MACnB,WAAW,CAAA,CAAE,MAAA,GAAS,MAAA,CAAO,CAAA,KAAA,KAAS,UAAU,gBAAgB,CAAA;AAAA,MAChE,KAAA,EAAO,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,MAChC,IAAA,EAAM,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,MAC/B,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,GAAG,CAAA,CAAE,GAAA,CAAI,GAAK,CAAA;AAAA,MACzC,SAAA,EAAW,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,EAAE,CAAA,CAAE,GAAA,CAAI,EAAE,CAAA;AAAA,MAC1C,SAAA,EAAW,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,MACpC,cAAc,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,GAAG,EAAE,QAAA,EAAS;AAAA,MAC3C,IAAA,EAAM,CAAA,CAAE,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,CAAA,CAAE,KAAA,CAAM,CAAC,CAAA,CAAE,MAAA,EAAO,EAAG,EAAE,MAAA,EAAO,EAAG,CAAA,CAAE,OAAA,EAAQ,EAAG,CAAA,CAAE,MAAM,CAAC,CAAC,CAAA,CAAE,QAAA;AAAS,KAC/F;AAAA,GACF;AACH,CAAC;AAkBM,IAAM,aAAA,GAAgB,EAAE,MAAA,CAAO;AAAA,EACpC,EAAA,EAAI,EAAE,MAAA,EAAO;AAAA,EACb,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,SAAA,EAAW,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,OAAA,EAAS,EAAE,OAAA,EAAQ;AAAA,EACnB,WAAA,EAAa,EAAE,IAAA,CAAK,CAAC,aAAa,WAAW,CAAC,EAAE,QAAA,EAAS;AAAA,EACzD,aAAA,EAAe,EAAE,IAAA,CAAK,CAAC,UAAU,SAAA,EAAW,QAAQ,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EAChE,kBAAkB,CAAA,CAAE,MAAA,CAAO,MAAK,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EACtD,aAAa,CAAA,CAAE,MAAA,CAAO,MAAK,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EACjD,kBAAA,EAAoB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EACzC,aAAA,EAAe,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EACpC,aAAA,EAAe,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EACpC,SAAA,EAAW,CAAA,CAAE,MAAA,CAAO,IAAA,EAAK;AAAA,EACzB,SAAA,EAAW,CAAA,CAAE,MAAA,CAAO,IAAA,EAAK;AAAA,EACzB,QAAA,EAAU,CAAA,CAAE,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,CAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA;AAC9C,CAAC;AAgBM,IAAM,kBAAA,GAAqB,EAAE,MAAA,CAAO;AAAA,EACzC,WAAA,EAAa,EAAE,MAAA,EAAO;AAAA,EACtB,YAAA,EAAc,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAClC,SAAA,EAAW,EAAE,MAAA,EAAO;AAAA,EACpB,SAAA,EAAW,CAAA,CAAE,OAAA,CAAQ,QAAQ;AAC/B,CAAC;AAeM,IAAM,yBAAA,GAA4B,EAAE,MAAA,CAAO;AAAA;AAAA,EAEhD,uBAAuB,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EAClD,uBAAuB,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EAClD,gBAAA,EAAkB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACtC,gBAAA,EAAkB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACtC,cAAA,EAAgB,EAAE,OAAA,EAAQ;AAAA,EAC1B,WAAA,EAAa,EAAE,OAAA;AACjB,CAAC;AAyBM,IAAM,mBAAA,GAAsB,EAAE,MAAA,CAAO;AAAA,EAC1C,IAAA,EAAM,aAAA;AAAA,EACN,MAAA,EAAQ,kBAAA;AAAA,EACR,KAAA,EAAO,EAAE,KAAA,CAAM,CAAA,CAAE,QAAQ,CAAA,CAAE,OAAA,CAAQ,EAAE,CAAA;AAAA,EACrC,WAAA,EAAa,EAAE,KAAA,CAAM,CAAA,CAAE,QAAQ,CAAA,CAAE,OAAA,CAAQ,EAAE,CAAA;AAAA,EAC3C,UAAA,EAAY,0BAA0B,QAAA;AACxC,CAAC;AAwBM,IAAM,oBAAA,GAAuB,cAAc,MAAA,CAAO;AAAA,EACvD,KAAA,EAAO,CAAA,CAAE,KAAA,CAAM,CAAA,CAAE,QAAQ,CAAA;AAAA,EACzB,WAAA,EAAa,CAAA,CAAE,KAAA,CAAM,CAAA,CAAE,QAAQ;AACjC,CAAC;AAeM,IAAM,mBAAA,GAAsB,EAAE,MAAA,CAAO;AAAA,EAC1C,OAAA,EAAS,kBAAA;AAAA,EACT,UAAA,EAAY,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC5B,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC;AAC5B,CAAC;AAeM,IAAM,uBAAA,GAA0B,EAAE,MAAA,CAAO,EAAE,UAAU,CAAA,CAAE,MAAA,EAAO,CAAE,IAAA,EAAK,CAAE,GAAA,CAAI,CAAC,CAAA,EAAG,QAAA,EAAU,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,EAAG,OAAA,EAAS,kBAAA,EAAoB;AAazI,IAAM,kCAAA,GAAqC,CAAA,CAAE,MAAA,CAAO,EAAE,YAAY,CAAA,CAAE,MAAA,EAAO,CAAE,IAAA,GAAO,GAAA,CAAI,CAAC,CAAA,EAAG,OAAA,EAAS,oBAAoB;AAczH,IAAM,qCAAqC,CAAA,CAAE,MAAA,CAAO,EAAE,KAAA,EAAO,CAAA,CAAE,QAAO,CAAE,GAAA,CAAI,CAAC,CAAA,EAAG,aAAa,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,GAAG;AAUhH,IAAM,2BAAA,GAA8B,CAAA,CAAE,MAAA,CAAO,EAAE,UAAA,EAAY,CAAA,CAAE,MAAA,EAAO,CAAE,IAAA,EAAK,CAAE,GAAA,CAAI,CAAC,CAAA,EAAG,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,EAAG,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,EAAG,OAAA,EAAS,oBAAoB;AAU/K,IAAM,4BAAA,GAA+B,EAAE,MAAA,CAAO,EAAE,UAAU,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,EAAG,WAAW,CAAA,CAAE,MAAA,EAAO,CAAE,IAAA,EAAK,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,EAAG;AAU3H,IAAM,8BAAA,GAAiC,CAAA,CAAE,MAAA,CAAO,EAAE,QAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,EAAG,SAAA,EAAW,CAAA,CAAE,MAAA,IAAU;AAkDpG,IAAM,qBAAA,GAAwB,EAAE,MAAA,CAAO;AAAA,EAC5C,OAAA,EAAS,CAAA,CAAE,MAAA,CAAO,EAAE,SAAS,CAAA,CAAE,OAAA,EAAQ,EAAG,CAAA,CAAE,OAAA,CAAQ,EAAE,OAAA,EAAS,OAAO,CAAA;AAAA,EACtE,kBAAkB,CAAA,CAAE,MAAA,CAAO,EAAE,OAAA,EAAS,EAAE,OAAA,EAAQ,EAAG,UAAA,EAAY,CAAA,CAAE,MAAM,CAAA,CAAE,MAAA,EAAQ,CAAA,EAAG,EAAE,QAAA,EAAS;AAAA,EAC/F,kBAAA,EAAoB,CAAA,CAAE,MAAA,CAAO,EAAE,OAAA,EAAS,EAAE,OAAA,EAAQ,EAAG,CAAA,CAAE,QAAA,EAAS;AAAA,EAChE,QAAA,EAAU,EAAE,MAAA,CAAO,EAAE,WAAW,CAAA,CAAE,MAAA,EAAO,EAAG,SAAA,EAAW,CAAA,CAAE,MAAA,IAAU,gBAAA,EAAkB,CAAA,CAAE,OAAA,EAAQ,EAAG,gBAAA,EAAkB,CAAA,CAAE,SAAQ,EAAG,aAAA,EAAe,CAAA,CAAE,OAAA,EAAQ,EAAG,kBAAA,EAAoB,EAAE,OAAA,EAAQ,EAAG,gBAAgB,CAAA,CAAE,MAAA,IAAU,mBAAA,EAAqB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS,EAAG,qBAAqB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS,EAAG,oBAAA,EAAsB,EAAE,OAAA,EAAQ,CAAE,QAAA,EAAS,EAAG,CAAA;AAAA,EACjW,QAAA,EAAU,EAAE,MAAA,CAAO,EAAE,SAAS,CAAA,CAAE,OAAA,IAAW,CAAA;AAAA,EAC3C,KAAA,EAAO,CAAA,CAAE,MAAA,CAAO,EAAE,QAAA,EAAU,EAAE,OAAA,EAAQ,EAAG,GAAA,EAAK,CAAA,CAAE,OAAA,EAAQ,EAAG,MAAM,CAAA,CAAE,OAAA,EAAQ,EAAG,KAAA,EAAO,CAAA,CAAE,OAAA,IAAW,GAAA,EAAK,CAAA,CAAE,OAAA,EAAQ,EAAG,CAAA;AAAA,EACpH,eAAe,CAAA,CAAE,MAAA,CAAO,EAAE,OAAA,EAAS,EAAE,OAAA,EAAQ,EAAG,IAAA,EAAM,CAAA,CAAE,KAAK,CAAC,OAAA,EAAS,OAAO,CAAC,GAAG,CAAA;AAAA,EAClF,GAAA,EAAK,CAAA,CAAE,MAAA,CAAO,EAAE,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,EAAG,cAAA,EAAgB,CAAA,CAAE,MAAA,EAAO,EAAG,CAAA;AAAA,EAChE,UAAA,EAAY,yBAAA;AAAA,EACZ,EAAA,EAAI,EAAE,MAAA,CAAO,EAAE,SAAS,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,OAAO,CAAC,GAAG,KAAA,EAAO,CAAA,CAAE,QAAO,CAAE,QAAA,IAAY,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS,EAAG,YAAY,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,EAAG,WAAW,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS,EAAG,OAAA,EAAS,EAAE,MAAA,EAAO,CAAE,UAAS,EAAG,eAAA,EAAiB,EAAE,MAAA,EAAO,CAAE,QAAA,EAAS,EAAG,CAAA;AAAA,EAC/P,OAAA,EAAS,CAAA,CAAE,MAAA,CAAO,EAAE,QAAQ,CAAA,CAAE,MAAA,EAAO,EAAG,aAAA,EAAe,EAAE,OAAA,EAAQ,CAAE,OAAA,CAAQ,KAAK,GAAG;AACrF,CAAC;AAeM,IAAM,sBAAA,GAAyB,EAAE,MAAA,CAAO;AAAA,EAC7C,OAAA,EAAS,kBAAA;AAAA,EACT,UAAA,EAAY,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC5B,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC;AACxB,CAAC;AAcM,IAAM,oBAAA,GAAuB,EAAE,MAAA,CAAO;AAAA,EAC3C,aAAa,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA;AACjC,CAAC;AAcM,IAAM,qBAAA,GAAwB,EAAE,MAAA,CAAO;AAAA,EAC5C,OAAA,EAAS,kBAAA;AAAA,EACT,UAAA,EAAY,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC;AAC9B,CAAC;AAcM,IAAM,oBAAA,GAAuB,EAAE,MAAA,CAAO;AAAA,EAC3C,SAAA,EAAW,CAAA,CAAE,MAAA,CAAO,IAAA;AACtB,CAAC;AAcM,IAAM,0BAAA,GAA6B,EAAE,MAAA,CAAO;AAAA,EACjD,YAAA,EAAc,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC;AAChC,CAAC;AAkBM,IAAM,yBAAA,GAA4B,EAAE,MAAA,CAAO;AAAA,EAChD,MAAA,EAAQ;AACV,CAAC;AAeM,IAAM,sBAAA,GAAyB,EAAE,MAAA,CAAO;AAAA,EAC7C,OAAA,EAAS,kBAAA;AAAA,EACT,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC1B,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC1B,OAAO,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,GAAQ,QAAA,EAAS;AAAA,EACnC,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,QAAA,EAAU,CAAA,CAAE,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,CAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA;AAC9C,CAAC;AAeM,IAAM,4BAAA,GAA+B,EAAE,MAAA,CAAO;AAAA,EACnD,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC7B,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC;AAC/B,CAAC;AAYM,IAAM,+BAAA,GAAkC,EAAE,MAAA,CAAO;AAAA,EACtD,UAAU,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EACrC,OAAO,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,GAAQ,QAAA,EAAS;AAAA,EACnC,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,SAAA,EAAW,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,QAAA,EAAU,CAAA,CAAE,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,CAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA;AAC9C,CAAC;AAYM,IAAM,uBAAA,GAA0B,sBAAsB,MAAA,CAAO;AAAA,EAClE,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,IAAA,EAAK,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAA,EAAS;AAAA,EACrD,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA,EAE5B,SAAS,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,OAAO,CAAC,CAAA,CAAE,QAAA,EAAS,CAAE,UAAU,CAAA,CAAA,KAAK,CAAA,KAAM,MAAA,GAAY,MAAA,GAAY,MAAM,MAAM;AACzG,CAAC;AAeM,IAAM,6BAAA,GAAgC,EAAE,MAAA,CAAO;AAAA,EACpD,WAAA,EAAa,EAAE,IAAA,CAAK,CAAC,aAAa,WAAW,CAAC,EAAE,QAAA,EAAS;AAAA,EACzD,aAAA,EAAe,EAAE,IAAA,CAAK,CAAC,UAAU,SAAA,EAAW,QAAQ,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EAChE,gBAAA,EAAkB,CAAA,CAAE,MAAA,CAAO,IAAA,GAAO,QAAA,EAAS;AAAA,EAC3C,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC1B,OAAO,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,GAAQ,QAAA,EAAS;AAAA,EACnC,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC1B,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,QAAA,EAAU,CAAA,CAAE,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,CAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA,EAAS;AAAA,EACrD,SAAS,CAAA,CAAE,KAAA,CAAM,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACtC,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AACvB,CAAC;AAUM,IAAM,wBAAA,GAA2B,6BAAA,CAA8B,IAAA,CAAK,EAAE,QAAA,EAAU,MAAM,CAAA,CAAE,MAAA,CAAO,EAAE,OAAA,EAAS,CAAA,CAAE,QAAQ,IAAI,CAAA,CAAE,QAAA,EAAS,EAAG,aAAA,EAAe,CAAA,CAAE,QAAQ,QAAQ,CAAA,CAAE,QAAA,EAAS,EAAG;AAwBrL,IAAM,6BAAA,GAAgC,EAAE,MAAA,CAAO;AAAA,EACpD,WAAA,EAAa,EAAE,IAAA,CAAK,CAAC,aAAa,WAAW,CAAC,EAAE,QAAA,EAAS;AAAA,EACzD,aAAA,EAAe,EAAE,IAAA,CAAK,CAAC,UAAU,SAAA,EAAW,QAAQ,CAAC,CAAA,CAAE,QAAA,EAAS;AAAA,EAChE,kBAAkB,CAAA,CAAE,MAAA,CAAO,MAAK,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EACtD,EAAA,EAAI,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACpB,UAAU,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EACrC,OAAO,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,GAAQ,QAAA,EAAS;AAAA,EACnC,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,SAAA,EAAW,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,QAAA,EAAU,CAAA,CAAE,MAAA,CAAO,CAAA,CAAE,MAAA,IAAU,CAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA,EAAS;AAAA,EACrD,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC9B,SAAS,CAAA,CAAE,KAAA,CAAM,EAAE,MAAA,EAAQ,EAAE,QAAA;AAC/B,CAAC;AAcM,IAAM,oBAAA,GAAuB,EAAE,MAAA,CAAO;AAAA,EAC3C,EAAA,EAAI,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC;AACtB,CAAC;AAeM,IAAM,gCAAA,GAAmC,EAAE,MAAA,CAAO;AAAA,EACvD,EAAA,EAAI,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACpB,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC;AAC/B,CAAC;AAkBM,IAAM,aAAA,GAAgB,EAAE,MAAA,CAAO;AAAA,EACpC,EAAA,EAAI,EAAE,MAAA,EAAO;AAAA,EACb,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,QAAA,EAAU,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC/B,SAAA,EAAW,CAAA,CAAE,MAAA,CAAO,IAAA,EAAK;AAAA,EACzB,SAAA,EAAW,CAAA,CAAE,MAAA,CAAO,IAAA;AACtB,CAAC;AAeM,IAAM,wBAAA,GAA2B,EAAE,MAAA,CAAO;AAAA,EAC/C,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACtB,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,QAAA,EAAU,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AACxB,CAAC;AAcM,IAAM,wBAAA,GAA2B,EAAE,MAAA,CAAO;AAAA,EAC/C,EAAA,EAAI,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACpB,MAAM,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EACjC,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAC1B,CAAC;AAYM,IAAM,0BAA0B,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,KAAA,EAAO,QAAQ,CAAC;AAkBhE,IAAM,mBAAA,GAAsB,EAAE,MAAA,CAAO;AAAA,EAC1C,EAAA,EAAI,EAAE,MAAA,EAAO;AAAA,EACb,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,IAAA,EAAM,wBAAwB,QAAA,EAAS;AAAA,EACvC,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC9B,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,SAAA,EAAW,CAAA,CAAE,MAAA,CAAO,IAAA,EAAK;AAAA,EACzB,SAAA,EAAW,CAAA,CAAE,MAAA,CAAO,IAAA;AACtB,CAAC;AAYM,IAAM,6BAAA,GAAgC,sBAAsB,MAAA,CAAO;AAAA,EACxE,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,IAAA,EAAM,wBAAwB,QAAA;AAChC,CAAC;AAeM,IAAM,8BAAA,GAAiC,EAAE,MAAA,CAAO;AAAA,EACrD,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACtB,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACtB,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC9B,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,IAAA,EAAM,wBAAwB,QAAA;AAChC,CAAC;;;AC1sBD,IAAM,sBAAA,GAAyB,gBAAgB,mBAAmB,CAAA;AAClE,IAAM,gBAAA,GAAmB,gBAAgB,aAAa,CAAA;AACtD,IAAM,gBAAA,GAAmB,gBAAgB,aAAa,CAAA;AAY/C,IAAM,WAAA,GAAc;AAAA,EACzB,IAAA,EAAM;AAAA,IACJ,aAAA,EAAe,KAAA,CAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,eAAA,EAAiB,WAAA,EAAa,wBAAA,EAA0B,OAAA,EAAS,uCAAA,EAAyC,IAAA,EAAM,CAAC,KAAA,EAAO,MAAM,CAAA,EAAG,CAAA,CAC3K,KAAA,CAAM,2BAA2B,CAAA,CACjC,MAAA,CAAO,eAAA,CAAgB,yBAAyB,CAAC,CAAA;AAAA,IACpD,cAAA,EAAgB,KAAA,CAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,sBAAA,EAAwB,WAAA,EAAa,yBAAA,EAA2B,OAAA,EAAS,qDAAA,EAAuD,IAAA,EAAM,CAAC,KAAA,EAAO,MAAM,CAAA,EAAG,CAAA,CAClM,KAAA,CAAM,4BAA4B,CAAA,CAClC,MAAA,CAAO,eAAA,CAAgB,8BAA8B,CAAC,CAAA;AAAA,IACzD,YAAA,EAAc,MAAM,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,cAAA,EAAgB,WAAA,EAAa,uBAAA,EAAyB,OAAA,EAAS,qCAAA,EAAuC,MAAM,CAAC,KAAA,EAAO,MAAM,CAAA,EAAG,CAAA,CACrK,OAAO,eAAA,CAAgB,qBAAA,CAAsB,QAAA,EAAU,CAAC,CAAA;AAAA,IAC3D,aAAA,EAAe,MAAM,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,sBAAA,EAAwB,WAAA,EAAa,wBAAA,EAA0B,OAAA,EAAS,oCAAA,EAAsC,MAAM,CAAC,KAAA,EAAO,MAAM,CAAA,EAAG,EAC/K,KAAA,CAAM,2BAA2B,CAAA,CACjC,MAAA,CAAO,mBAAmB,CAAA;AAAA,IAC7B,aAAA,EAAe,MAAM,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,kBAAA,EAAoB,WAAA,EAAa,wBAAA,EAA0B,OAAA,EAAS,YAAA,EAAc,MAAM,CAAC,KAAA,EAAO,MAAM,CAAA,EAAG,EACnJ,KAAA,CAAM,uBAAuB,CAAA,CAC7B,MAAA,CAAO,sBAAsB,CAAA;AAAA,IAChC,oBAAA,EAAsB,MAAM,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,8BAAA,EAAgC,WAAA,EAAa,+BAAA,EAAiC,OAAA,EAAS,wBAAA,EAA0B,MAAM,CAAC,KAAA,EAAO,MAAM,CAAA,EAAG,EACzL,KAAA,CAAM,kCAAkC,CAAA,CACxC,MAAA,CAAO,mBAAmB,CAAA;AAAA,IAC7B,oBAAA,EAAsB,MAAM,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,8BAAA,EAAgC,WAAA,EAAa,+BAAA,EAAiC,OAAA,EAAS,wBAAA,EAA0B,MAAM,CAAC,KAAA,EAAO,MAAM,CAAA,EAAG,EACzL,KAAA,CAAM,kCAAkC,CAAA,CACxC,MAAA,CAAO,mBAAmB,CAAA;AAAA,IAC7B,KAAA,EAAO,MAAM,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,aAAA,EAAe,WAAA,EAAa,gBAAA,EAAkB,OAAA,EAAS,gBAAA,EAAkB,MAAM,CAAC,KAAA,EAAO,MAAM,CAAA,EAAG,EAClI,KAAA,CAAM,mBAAmB,CAAA,CACzB,MAAA,CAAO,sBAAsB,CAAA;AAAA,IAChC,YAAA,EAAc,MAAM,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,iBAAA,EAAmB,WAAA,EAAa,uBAAA,EAAyB,OAAA,EAAS,WAAA,EAAa,MAAM,CAAC,KAAA,EAAO,MAAM,CAAA,EAAG,EAC/I,KAAA,CAAM,sBAAsB,CAAA,CAC5B,MAAA,CAAO,sBAAsB,CAAA;AAAA,IAChC,MAAA,EAAQ,MAAM,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,cAAA,EAAgB,WAAA,EAAa,iBAAA,EAAmB,OAAA,EAAS,QAAA,EAAU,MAAM,CAAC,KAAA,EAAO,MAAM,CAAA,EAAG,EAC7H,KAAA,CAAM,oBAAoB,CAAA,CAC1B,MAAA,CAAO,mBAAmB,CAAA;AAAA,IAC7B,YAAA,EAAc,MAAM,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,qBAAA,EAAuB,WAAA,EAAa,uBAAA,EAAyB,OAAA,EAAS,gEAAA,EAAkE,MAAM,CAAC,KAAA,EAAO,MAAM,CAAA,EAAG,EACxM,KAAA,CAAM,oBAAoB,CAAA,CAC1B,MAAA,CAAO,mBAAmB,CAAA;AAAA,IAC7B,WAAA,EAAa,MAAM,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,UAAA,EAAY,aAAa,sBAAA,EAAwB,OAAA,EAAS,qCAAqC,IAAA,EAAM,CAAC,OAAO,MAAM,CAAA,EAAG,CAAA,CAC7J,MAAA,CAAO,eAAA,CAAgB,oBAAoB,CAAC,CAAA;AAAA,IAC/C,OAAA,EAAS,KAAA,CAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,eAAA,EAAiB,WAAA,EAAa,kBAAA,EAAoB,OAAA,EAAS,sBAAA,EAAwB,IAAA,EAAM,CAAC,KAAA,EAAO,MAAM,CAAA,EAAG,CAAA,CAC9I,KAAA,CAAM,0BAA0B,CAAA,CAChC,MAAA,CAAO,eAAA,CAAgB,yBAAyB,CAAC,CAAA;AAAA,IACpD,OAAA,EAAS,KAAA,CAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,gBAAA,EAAkB,WAAA,EAAa,kBAAA,EAAoB,OAAA,EAAS,UAAA,EAAY,IAAA,EAAM,CAAC,KAAA,EAAO,MAAM,CAAA,EAAG,CAAA,CACnI,KAAA,CAAM,qBAAqB,CAAA,CAC3B,MAAA,CAAO,eAAA,CAAgB,oBAAoB,CAAC,CAAA;AAAA,IAC/C,QAAA,EAAU,MAAM,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,gBAAA,EAAkB,WAAA,EAAa,mBAAA,EAAqB,OAAA,EAAS,oBAAA,EAAsB,MAAM,CAAC,KAAA,EAAO,MAAM,CAAA,EAAG,EAC/I,KAAA,CAAM,sBAAsB,CAAA,CAC5B,MAAA,CAAO,sBAAsB,CAAA;AAAA,IAChC,cAAA,EAAgB,MAAM,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,uBAAA,EAAyB,WAAA,EAAa,yBAAA,EAA2B,OAAA,EAAS,8BAAA,EAAgC,MAAM,CAAC,KAAA,EAAO,MAAM,CAAA,EAAG,EAC5K,KAAA,CAAM,4BAA4B,CAAA,CAClC,MAAA,CAAO,mBAAmB,CAAA;AAAA,IAC7B,iBAAA,EAAmB,MAAM,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,UAAA,EAAY,WAAA,EAAa,4BAAA,EAA8B,OAAA,EAAS,qBAAA,EAAuB,MAAM,CAAC,KAAA,EAAO,MAAM,CAAA,EAAG,EAC3J,KAAA,CAAM,+BAA+B,CAAA,CACrC,MAAA,CAAO,gBAAgB;AAAA,GAC5B;AAAA,EACA,KAAA,EAAO;AAAA,IACL,MAAA,EAAQ,MAAM,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,mBAAA,EAAqB,WAAA,EAAa,kBAAA,EAAoB,OAAA,EAAS,+CAAA,EAAiD,MAAM,CAAC,KAAA,EAAO,OAAO,CAAA,EAAG,EAC3K,KAAA,CAAM,wBAAwB,CAAA,CAC9B,MAAA,CAAO,gBAAgB,CAAA;AAAA,IAC1B,IAAA,EAAM,KAAA,CAAM,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,YAAA,EAAc,WAAA,EAAa,gBAAA,EAAkB,OAAA,EAAS,YAAA,EAAc,IAAA,EAAM,CAAC,OAAO,OAAO,CAAA,EAAG,CAAA,CAC5H,KAAA,CAAM,uBAAuB,CAAA,CAC7B,MAAA,CAAO,eAAA,CAAgB,eAAA,CAAgB,aAAa,CAAC,CAAC,CAAA;AAAA,IACzD,GAAA,EAAK,KAAA,CAAM,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,iBAAA,EAAmB,WAAA,EAAa,eAAA,EAAiB,OAAA,EAAS,UAAA,EAAY,IAAA,EAAM,CAAC,OAAO,OAAO,CAAA,EAAG,CAAA,CAC7H,KAAA,CAAM,oBAAoB,CAAA,CAC1B,MAAA,CAAO,eAAA,CAAgB,aAAA,CAAc,QAAA,EAAU,CAAC,CAAA;AAAA,IACnD,MAAA,EAAQ,MAAM,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,YAAA,EAAc,WAAA,EAAa,kBAAA,EAAoB,OAAA,EAAS,aAAA,EAAe,MAAM,CAAC,KAAA,EAAO,OAAO,CAAA,EAAG,EAClI,KAAA,CAAM,6BAA6B,CAAA,CACnC,MAAA,CAAO,gBAAgB,CAAA;AAAA,IAC1B,MAAA,EAAQ,MAAM,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,iBAAA,EAAmB,WAAA,EAAa,kBAAA,EAAoB,OAAA,EAAS,aAAA,EAAe,MAAM,CAAC,KAAA,EAAO,OAAO,CAAA,EAAG,EACtI,KAAA,CAAM,6BAA6B,CAAA,CACnC,MAAA,CAAO,gBAAgB,CAAA;AAAA,IAC1B,MAAA,EAAQ,MAAM,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,iBAAA,EAAmB,WAAA,EAAa,kBAAA,EAAoB,OAAA,EAAS,aAAA,EAAe,MAAM,CAAC,KAAA,EAAO,OAAO,CAAA,EAAG,EACzI,KAAA,CAAM,oBAAoB,CAAA,CAC1B,MAAA,CAAO,mBAAmB,CAAA;AAAA,IAC7B,aAAA,EAAe,MAAM,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,gCAAA,EAAkC,WAAA,EAAa,yBAAA,EAA2B,OAAA,EAAS,qBAAA,EAAuB,MAAM,CAAC,KAAA,EAAO,OAAO,CAAA,EAAG,EAC5K,KAAA,CAAM,gCAAgC,CAAA,CACtC,MAAA,CAAO,mBAAmB;AAAA,GAC/B;AAAA,EACA,KAAA,EAAO;AAAA,IACL,IAAA,EAAM,MAAM,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,YAAA,EAAc,WAAA,EAAa,gBAAA,EAAkB,OAAA,EAAS,YAAA,EAAc,MAAM,CAAC,KAAA,EAAO,OAAO,CAAA,EAAG,CAAA,CAC5H,OAAO,eAAA,CAAgB,eAAA,CAAgB,aAAa,CAAC,CAAC,CAAA;AAAA,IACzD,GAAA,EAAK,KAAA,CAAM,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,iBAAA,EAAmB,WAAA,EAAa,eAAA,EAAiB,OAAA,EAAS,UAAA,EAAY,IAAA,EAAM,CAAC,OAAO,OAAO,CAAA,EAAG,CAAA,CAC7H,KAAA,CAAM,oBAAoB,CAAA,CAC1B,MAAA,CAAO,eAAA,CAAgB,aAAA,CAAc,QAAA,EAAU,CAAC,CAAA;AAAA,IACnD,MAAA,EAAQ,MAAM,EAAE,MAAA,EAAQ,QAAQ,IAAA,EAAM,YAAA,EAAc,WAAA,EAAa,kBAAA,EAAoB,OAAA,EAAS,aAAA,EAAe,MAAM,CAAC,KAAA,EAAO,OAAO,CAAA,EAAG,EAClI,KAAA,CAAM,wBAAwB,CAAA,CAC9B,MAAA,CAAO,gBAAgB,CAAA;AAAA,IAC1B,MAAA,EAAQ,MAAM,EAAE,MAAA,EAAQ,OAAO,IAAA,EAAM,iBAAA,EAAmB,WAAA,EAAa,kBAAA,EAAoB,OAAA,EAAS,aAAA,EAAe,MAAM,CAAC,KAAA,EAAO,OAAO,CAAA,EAAG,EACtI,KAAA,CAAM,wBAAwB,CAAA,CAC9B,MAAA,CAAO,gBAAgB,CAAA;AAAA,IAC1B,MAAA,EAAQ,MAAM,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,iBAAA,EAAmB,WAAA,EAAa,kBAAA,EAAoB,OAAA,EAAS,aAAA,EAAe,MAAM,CAAC,KAAA,EAAO,OAAO,CAAA,EAAG,EACzI,KAAA,CAAM,oBAAoB,CAAA,CAC1B,MAAA,CAAO,mBAAmB;AAAA,GAC/B;AAAA,EACA,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,KAAA,CAAM,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,kBAAA,EAAoB,WAAA,EAAa,sBAAA,EAAwB,OAAA,EAAS,kBAAA,EAAoB,IAAA,EAAM,CAAC,OAAO,aAAa,CAAA,EAAG,CAAA,CACpJ,KAAA,CAAM,6BAA6B,CAAA,CACnC,MAAA,CAAO,eAAA,CAAgB,eAAA,CAAgB,mBAAmB,CAAC,CAAC,CAAA;AAAA,IAC/D,GAAA,EAAK,KAAA,CAAM,EAAE,MAAA,EAAQ,KAAA,EAAO,IAAA,EAAM,uBAAA,EAAyB,WAAA,EAAa,qBAAA,EAAuB,OAAA,EAAS,gBAAA,EAAkB,IAAA,EAAM,CAAC,OAAO,aAAa,CAAA,EAAG,CAAA,CACrJ,KAAA,CAAM,oBAAoB,CAAA,CAC1B,MAAA,CAAO,eAAA,CAAgB,mBAAA,CAAoB,QAAA,EAAU,CAAC,CAAA;AAAA,IACzD,MAAA,EAAQ,KAAA,CAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAM,kBAAA,EAAoB,WAAA,EAAa,wBAAA,EAA0B,OAAA,EAAS,mBAAA,EAAqB,IAAA,EAAM,CAAC,KAAA,EAAO,aAAa,CAAA,EAAG,CAAA,CAC1J,KAAA,CAAM,8BAA8B,CAAA,CACpC,MAAA,CAAO,eAAA,CAAgB,mBAAmB,CAAC,CAAA;AAAA,IAC9C,MAAA,EAAQ,MAAM,EAAE,MAAA,EAAQ,UAAU,IAAA,EAAM,uBAAA,EAAyB,WAAA,EAAa,wBAAA,EAA0B,OAAA,EAAS,mBAAA,EAAqB,MAAM,CAAC,KAAA,EAAO,aAAa,CAAA,EAAG,EACjK,KAAA,CAAM,oBAAoB,CAAA,CAC1B,MAAA,CAAO,mBAAmB;AAAA;AAEjC","file":"chunk-QT3QKHRS.js","sourcesContent":["/**\n * @h-ai/api-contract — IAM 领域 Schema\n *\n * 包含用户、Token、角色、权限以及相关 input/data 的 Zod Schema 定义。\n * 一次性输出包装在 contract 中内联，仅保留跨接口、跨层复用的数据结构。\n * @module iam-schemas\n */\n\nimport type { HaiResult } from '@h-ai/core'\nimport { z } from 'zod'\nimport { PaginationQuerySchema } from '../common/pagination-schemas.js'\n\nconst captchaProofSchema = z.string().min(1).max(4096).optional()\n\n/**\n * 交互挑战生成入参，证明只能用于指定入口。\n * @example\n * ```ts\n * import { IamCreateCaptchaInputSchema } from '@h-ai/api-contract'\n * const input = IamCreateCaptchaInputSchema.parse({ operation: 'login' })\n * ```\n */\nexport const IamCreateCaptchaInputSchema = z.object({ operation: z.enum(['login', 'register', 'sendOtp', 'passwordReset', 'renewPassword']) })\n\n/**\n * 自托管 ALTCHA 可公开挑战；不会返回签名秘密。\n * @example\n * ```ts\n * import { IamCaptchaChallengeSchema } from '@h-ai/api-contract'\n * function parseResponse(value: unknown) { return IamCaptchaChallengeSchema.parse(value) }\n * ```\n */\nexport const IamCaptchaChallengeSchema = z.object({\n  id: z.string().regex(/^[a-f0-9]{64}$/),\n  challenge: z.object({\n    signature: z.string().max(256).optional(),\n    parameters: z.object({\n      algorithm: z.string().refine(value => value === 'PBKDF2/SHA-256'),\n      nonce: z.string().min(1).max(256),\n      salt: z.string().min(1).max(256),\n      cost: z.number().int().min(100).max(50000),\n      keyLength: z.number().int().min(16).max(64),\n      keyPrefix: z.string().min(1).max(128),\n      keySignature: z.string().max(256).optional(),\n      data: z.record(z.string(), z.union([z.string(), z.number(), z.boolean(), z.null()])).optional(),\n    }),\n  }),\n})\n\n/**\n * 用户基础信息 Schema。\n * @example\n * ```ts\n * import { IamUserSchema } from '@h-ai/api-contract'\n *\n * const value = IamUserSchema.parse({\n *   id: 'example-1',\n *   username: 'alice',\n *   enabled: true,\n *   createdAt: null,\n *   updatedAt: null\n * })\n * void value\n * ```\n */\nexport const IamUserSchema = z.object({\n  id: z.string(),\n  username: z.string(),\n  email: z.string().optional(),\n  phone: z.string().optional(),\n  displayName: z.string().optional(),\n  avatarUrl: z.string().optional(),\n  enabled: z.boolean(),\n  accountType: z.enum(['permanent', 'temporary']).optional(),\n  accountStatus: z.enum(['active', 'dormant', 'closed']).optional(),\n  accountExpiresAt: z.coerce.date().nullable().optional(),\n  lastLoginAt: z.coerce.date().nullable().optional(),\n  mustChangePassword: z.boolean().optional(),\n  emailVerified: z.boolean().optional(),\n  phoneVerified: z.boolean().optional(),\n  createdAt: z.coerce.date(),\n  updatedAt: z.coerce.date(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n})\n\n/**\n * Token 对 Schema。\n * @example\n * ```ts\n * import { IamTokenPairSchema } from '@h-ai/api-contract'\n *\n * const value = IamTokenPairSchema.parse({\n *   accessToken: 'example-only-access',\n *   expiresIn: 0,\n *   tokenType: 'Bearer'\n * })\n * void value\n * ```\n */\nexport const IamTokenPairSchema = z.object({\n  accessToken: z.string(),\n  refreshToken: z.string().optional(),\n  expiresIn: z.number(),\n  tokenType: z.literal('Bearer'),\n})\n\n/**\n * 协议展示 Schema。\n * @example\n * ```ts\n * import { IamAgreementDisplaySchema } from '@h-ai/api-contract'\n *\n * const value = IamAgreementDisplaySchema.parse({\n *   showOnRegister: true,\n *   showOnLogin: true\n * })\n * void value\n * ```\n */\nexport const IamAgreementDisplaySchema = z.object({\n  /** 配置中的 Markdown 原文由客户端安全渲染。 */\n  userAgreementMarkdown: z.string().min(1).optional(),\n  privacyPolicyMarkdown: z.string().min(1).optional(),\n  userAgreementUrl: z.string().optional(),\n  privacyPolicyUrl: z.string().optional(),\n  showOnRegister: z.boolean(),\n  showOnLogin: z.boolean(),\n})\n\n/**\n * 登录结果业务数据 Schema。\n * @example\n * ```ts\n * import { IamAuthResultSchema } from '@h-ai/api-contract'\n *\n * const value = IamAuthResultSchema.parse({\n *   user: {\n *     id: 'example-1',\n *     username: 'alice',\n *     enabled: true,\n *     createdAt: null,\n *     updatedAt: null\n *   },\n *   tokens: {\n *     accessToken: 'example-only-access',\n *     expiresIn: 0,\n *     tokenType: 'Bearer'\n *   }\n * })\n * void value\n * ```\n */\nexport const IamAuthResultSchema = z.object({\n  user: IamUserSchema,\n  tokens: IamTokenPairSchema,\n  roles: z.array(z.string()).default([]),\n  permissions: z.array(z.string()).default([]),\n  agreements: IamAgreementDisplaySchema.optional(),\n})\n\n/**\n * 当前会话用户信息；包含服务端重新校验后的角色与权限快照。\n * @example\n * ```ts\n * import { IamCurrentUserSchema } from '@h-ai/api-contract'\n *\n * const value = IamCurrentUserSchema.parse({\n *   id: 'example-1',\n *   username: 'alice',\n *   enabled: true,\n *   createdAt: null,\n *   updatedAt: null,\n *   roles: [\n *     'example'\n *   ],\n *   permissions: [\n *     'example'\n *   ]\n * })\n * void value\n * ```\n */\nexport const IamCurrentUserSchema = IamUserSchema.extend({\n  roles: z.array(z.string()),\n  permissions: z.array(z.string()),\n})\n\n/**\n * 密码登录入参 Schema。\n * @example\n * ```ts\n * import { IamLoginInputSchema } from '@h-ai/api-contract'\n *\n * const value = IamLoginInputSchema.parse({\n *   identifier: 'alice',\n *   password: 'example-only-password'\n * })\n * void value\n * ```\n */\nexport const IamLoginInputSchema = z.object({\n  captcha: captchaProofSchema,\n  identifier: z.string().min(1),\n  password: z.string().min(1),\n})\n\n/**\n * LDAP 登录与密码找回入参。\n * @example\n * ```ts\n * import { IamLdapLoginInputSchema } from '@h-ai/api-contract'\n *\n * const value = IamLdapLoginInputSchema.parse({\n *   username: 'alice',\n *   password: 'example-only-password'\n * })\n * void value\n * ```\n */\nexport const IamLdapLoginInputSchema = z.object({ username: z.string().trim().min(1), password: z.string().min(1), captcha: captchaProofSchema })\n/**\n * IamRequestPasswordResetInput 数据的运行时 Zod 校验约束。\n * @example\n * ```ts\n * import { IamRequestPasswordResetInputSchema } from '@h-ai/api-contract'\n *\n * const value = IamRequestPasswordResetInputSchema.parse({\n *   identifier: 'alice'\n * })\n * void value\n * ```\n */\nexport const IamRequestPasswordResetInputSchema = z.object({ identifier: z.string().trim().min(1), captcha: captchaProofSchema })\n/**\n * IamConfirmPasswordResetInput 数据的运行时 Zod 校验约束。\n * @example\n * ```ts\n * import { IamConfirmPasswordResetInputSchema } from '@h-ai/api-contract'\n *\n * const value = IamConfirmPasswordResetInputSchema.parse({\n *   token: 'example-only-token',\n *   newPassword: 'example-only-password'\n * })\n * void value\n * ```\n */\nexport const IamConfirmPasswordResetInputSchema = z.object({ token: z.string().min(1), newPassword: z.string().min(1) })\n\n/**\n * 无普通会话的首次或过期改密；必须重新验证原密码。\n * @example\n * ```ts\n * import { IamRenewPasswordInputSchema } from '@h-ai/api-contract'\n * const input = IamRenewPasswordInputSchema.parse({ identifier: 'alice', password: 'Initial123!', newPassword: 'Chosen456!' })\n * ```\n */\nexport const IamRenewPasswordInputSchema = z.object({ identifier: z.string().trim().min(1), password: z.string().min(1), newPassword: z.string().min(1), captcha: captchaProofSchema })\n\n/**\n * 对当前会话的指定操作重新鉴别；操作本身仍需独立授权。\n * @example\n * ```ts\n * import { IamReauthenticateInputSchema } from '@h-ai/api-contract'\n * const input = IamReauthenticateInputSchema.parse({ password: 'ChosenPassword123!', operation: 'iam.users.delete' })\n * ```\n */\nexport const IamReauthenticateInputSchema = z.object({ password: z.string().min(1), operation: z.string().trim().min(1).max(128) })\n\n/**\n * 短期、用途绑定的单次操作证明，不能持久化到浏览器存储。\n * @example\n * ```ts\n * import { IamReauthenticationProofSchema } from '@h-ai/api-contract'\n * const proof = IamReauthenticationProofSchema.parse({ ticket: 'example-only-ticket', expiresAt: Date.now() + 300000 })\n * ```\n */\nexport const IamReauthenticationProofSchema = z.object({ ticket: z.string().min(1), expiresAt: z.number() })\n\n/**\n * 认证页面公开配置白名单，独立于服务端连接/凭据配置。\n * @example\n * ```ts\n * import { IamPublicConfigSchema } from '@h-ai/api-contract'\n *\n * const value = IamPublicConfigSchema.parse({\n *   password: {\n *     minLength: 0,\n *     maxLength: 0,\n *     requireUppercase: true,\n *     requireLowercase: true,\n *     requireNumber: true,\n *     requireSpecialChar: true,\n *     expirationDays: 0\n *   },\n *   register: {\n *     enabled: true\n *   },\n *   login: {\n *     password: true,\n *     otp: true,\n *     ldap: true,\n *     email: true,\n *     sms: true\n *   },\n *   passwordReset: {\n *     enabled: true,\n *     mode: 'email'\n *   },\n *   otp: {\n *     length: 0,\n *     resendInterval: 0\n *   },\n *   agreements: {\n *     showOnRegister: true,\n *     showOnLogin: true\n *   },\n *   ui: {\n *     variant: 'card'\n *   },\n *   session: {\n *     maxAge: 0\n *   }\n * })\n * void value\n * ```\n */\nexport const IamPublicConfigSchema = z.object({\n  captcha: z.object({ enabled: z.boolean() }).default({ enabled: false }),\n  reauthentication: z.object({ enabled: z.boolean(), operations: z.array(z.string()) }).optional(),\n  initialCredentials: z.object({ enabled: z.boolean() }).optional(),\n  password: z.object({ minLength: z.number(), maxLength: z.number(), requireUppercase: z.boolean(), requireLowercase: z.boolean(), requireNumber: z.boolean(), requireSpecialChar: z.boolean(), expirationDays: z.number(), minCharacterClasses: z.number().optional(), preventSamePassword: z.boolean().optional(), requireInitialChange: z.boolean().optional() }),\n  register: z.object({ enabled: z.boolean() }),\n  login: z.object({ password: z.boolean(), otp: z.boolean(), ldap: z.boolean(), email: z.boolean(), sms: z.boolean() }),\n  passwordReset: z.object({ enabled: z.boolean(), mode: z.enum(['email', 'phone']) }),\n  otp: z.object({ length: z.number(), resendInterval: z.number() }),\n  agreements: IamAgreementDisplaySchema,\n  ui: z.object({ variant: z.enum(['card', 'split']), title: z.string().optional(), subtitle: z.string().optional(), brandTitle: z.string().optional(), brandText: z.string().optional(), logoUrl: z.string().optional(), illustrationUrl: z.string().optional() }),\n  session: z.object({ maxAge: z.number(), endOnPageHide: z.boolean().default(false) }),\n})\n\n/**\n * OTP 登录入参 Schema。\n * @example\n * ```ts\n * import { IamOtpLoginInputSchema } from '@h-ai/api-contract'\n *\n * const value = IamOtpLoginInputSchema.parse({\n *   identifier: 'alice',\n *   code: 'example-1'\n * })\n * void value\n * ```\n */\nexport const IamOtpLoginInputSchema = z.object({\n  captcha: captchaProofSchema,\n  identifier: z.string().min(1),\n  code: z.string().min(1),\n})\n\n/**\n * 登出入参 Schema。\n * 仅撤销调用方持有的完整 accessToken；省略时使用 Authorization Bearer，二者均无值则失败。\n * access 已到期仍可撤销关联 refresh；此入口不按 userId 撤销，也不授予任何身份权限。\n * @example\n * ```ts\n * import { IamLogoutInputSchema } from '@h-ai/api-contract'\n *\n * const value = IamLogoutInputSchema.parse({})\n * void value\n * ```\n */\nexport const IamLogoutInputSchema = z.object({\n  accessToken: z.string().min(1).optional(),\n})\n\n/**\n * 发送 OTP 入参 Schema。\n * @example\n * ```ts\n * import { IamSendOtpInputSchema } from '@h-ai/api-contract'\n *\n * const value = IamSendOtpInputSchema.parse({\n *   identifier: 'alice'\n * })\n * void value\n * ```\n */\nexport const IamSendOtpInputSchema = z.object({\n  captcha: captchaProofSchema,\n  identifier: z.string().min(1),\n})\n\n/**\n * 发送 OTP 业务数据 Schema。\n * @example\n * ```ts\n * import { IamSendOtpDataSchema } from '@h-ai/api-contract'\n *\n * const value = IamSendOtpDataSchema.parse({\n *   expiresAt: null\n * })\n * void value\n * ```\n */\nexport const IamSendOtpDataSchema = z.object({\n  expiresAt: z.coerce.date(),\n})\n\n/**\n * Token 刷新入参 Schema。\n * @example\n * ```ts\n * import { IamRefreshTokenInputSchema } from '@h-ai/api-contract'\n *\n * const value = IamRefreshTokenInputSchema.parse({\n *   refreshToken: 'example-only-refresh'\n * })\n * void value\n * ```\n */\nexport const IamRefreshTokenInputSchema = z.object({\n  refreshToken: z.string().min(1),\n})\n\n/**\n * Token 刷新业务数据 Schema。\n * @example\n * ```ts\n * import { IamRefreshTokenDataSchema } from '@h-ai/api-contract'\n *\n * const value = IamRefreshTokenDataSchema.parse({\n *   tokens: {\n *     accessToken: 'example-only-access',\n *     expiresIn: 0,\n *     tokenType: 'Bearer'\n *   }\n * })\n * void value\n * ```\n */\nexport const IamRefreshTokenDataSchema = z.object({\n  tokens: IamTokenPairSchema,\n})\n\n/**\n * 注册入参 Schema。\n * @example\n * ```ts\n * import { IamRegisterInputSchema } from '@h-ai/api-contract'\n *\n * const value = IamRegisterInputSchema.parse({\n *   username: 'alice',\n *   password: 'example-only-password'\n * })\n * void value\n * ```\n */\nexport const IamRegisterInputSchema = z.object({\n  captcha: captchaProofSchema,\n  username: z.string().min(1),\n  password: z.string().min(1),\n  email: z.string().email().optional(),\n  phone: z.string().optional(),\n  displayName: z.string().optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n})\n\n/**\n * 修改密码入参 Schema。\n * @example\n * ```ts\n * import { IamChangePasswordInputSchema } from '@h-ai/api-contract'\n *\n * const value = IamChangePasswordInputSchema.parse({\n *   oldPassword: 'example',\n *   newPassword: 'example-only-password'\n * })\n * void value\n * ```\n */\nexport const IamChangePasswordInputSchema = z.object({\n  oldPassword: z.string().min(1),\n  newPassword: z.string().min(1),\n})\n\n/**\n * 当前用户更新入参 Schema。\n * @example\n * ```ts\n * import { IamUpdateCurrentUserInputSchema } from '@h-ai/api-contract'\n *\n * const value = IamUpdateCurrentUserInputSchema.parse({})\n * void value\n * ```\n */\nexport const IamUpdateCurrentUserInputSchema = z.object({\n  username: z.string().min(1).optional(),\n  email: z.string().email().optional(),\n  displayName: z.string().optional(),\n  avatarUrl: z.string().optional(),\n  phone: z.string().optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n})\n\n/**\n * 用户列表查询入参 Schema。\n * @example\n * ```ts\n * import { IamListUsersInputSchema } from '@h-ai/api-contract'\n *\n * const value = IamListUsersInputSchema.parse({})\n * void value\n * ```\n */\nexport const IamListUsersInputSchema = PaginationQuerySchema.extend({\n  roleCode: z.string().trim().min(1).max(100).optional(),\n  search: z.string().optional(),\n  // 注意：HTTP query 是字符串，使用枚举 + transform 避免 z.coerce.boolean 的 'false' → true 陷阱。\n  enabled: z.enum(['true', 'false']).optional().transform(v => v === undefined ? undefined : v === 'true'),\n})\n\n/**\n * Admin 创建用户入参 Schema。\n * @example\n * ```ts\n * import { IamAdminCreateUserInputSchema } from '@h-ai/api-contract'\n *\n * const value = IamAdminCreateUserInputSchema.parse({\n *   username: 'alice',\n *   password: 'example-only-password'\n * })\n * void value\n * ```\n */\nexport const IamAdminCreateUserInputSchema = z.object({\n  accountType: z.enum(['permanent', 'temporary']).optional(),\n  accountStatus: z.enum(['active', 'dormant', 'closed']).optional(),\n  accountExpiresAt: z.coerce.date().optional(),\n  username: z.string().min(1),\n  email: z.string().email().optional(),\n  phone: z.string().optional(),\n  password: z.string().min(1),\n  displayName: z.string().optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n  roleIds: z.array(z.string()).optional(),\n  enabled: z.boolean().optional(),\n})\n\n/**\n * 管理端单次邀请不接收共享初始密码；初始账号必须启用且激活。\n * @example\n * ```ts\n * import { IamInviteUserInputSchema } from '@h-ai/api-contract'\n * const input = IamInviteUserInputSchema.parse({ username: 'alice', email: 'alice@example.com' })\n * ```\n */\nexport const IamInviteUserInputSchema = IamAdminCreateUserInputSchema.omit({ password: true }).extend({ enabled: z.literal(true).optional(), accountStatus: z.literal('active').optional() })\n\n/**\n * 单次邀请的管理端输入。\n * @example\n * ```ts\n * import type { IamInviteUserInput } from '@h-ai/api-contract'\n * const input: IamInviteUserInput = { username: 'alice', email: 'alice@example.com' }\n * ```\n */\nexport type IamInviteUserInput = z.infer<typeof IamInviteUserInputSchema>\n\n/**\n * Admin 更新用户入参 Schema。\n * @example\n * ```ts\n * import { IamAdminUpdateUserInputSchema } from '@h-ai/api-contract'\n *\n * const value = IamAdminUpdateUserInputSchema.parse({\n *   id: 'example-1'\n * })\n * void value\n * ```\n */\nexport const IamAdminUpdateUserInputSchema = z.object({\n  accountType: z.enum(['permanent', 'temporary']).optional(),\n  accountStatus: z.enum(['active', 'dormant', 'closed']).optional(),\n  accountExpiresAt: z.coerce.date().nullable().optional(),\n  id: z.string().min(1),\n  username: z.string().min(1).optional(),\n  email: z.string().email().optional(),\n  phone: z.string().optional(),\n  displayName: z.string().optional(),\n  avatarUrl: z.string().optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n  enabled: z.boolean().optional(),\n  roleIds: z.array(z.string()).optional(),\n})\n\n/**\n * Admin 删除用户入参 Schema。\n * @example\n * ```ts\n * import { IamUserIdInputSchema } from '@h-ai/api-contract'\n *\n * const value = IamUserIdInputSchema.parse({\n *   id: 'example-1'\n * })\n * void value\n * ```\n */\nexport const IamUserIdInputSchema = z.object({\n  id: z.string().min(1),\n})\n\n/**\n * Admin 重置密码入参 Schema。\n * @example\n * ```ts\n * import { IamAdminResetPasswordInputSchema } from '@h-ai/api-contract'\n *\n * const value = IamAdminResetPasswordInputSchema.parse({\n *   id: 'example-1',\n *   newPassword: 'example-only-password'\n * })\n * void value\n * ```\n */\nexport const IamAdminResetPasswordInputSchema = z.object({\n  id: z.string().min(1),\n  newPassword: z.string().min(1),\n})\n\n/**\n * 角色基础信息 Schema。\n * @example\n * ```ts\n * import { IamRoleSchema } from '@h-ai/api-contract'\n *\n * const value = IamRoleSchema.parse({\n *   id: 'example-1',\n *   code: 'example-1',\n *   name: 'Example',\n *   createdAt: null,\n *   updatedAt: null\n * })\n * void value\n * ```\n */\nexport const IamRoleSchema = z.object({\n  id: z.string(),\n  code: z.string(),\n  name: z.string(),\n  description: z.string().optional(),\n  isSystem: z.boolean().optional(),\n  createdAt: z.coerce.date(),\n  updatedAt: z.coerce.date(),\n})\n\n/**\n * 创建角色入参 Schema。\n * @example\n * ```ts\n * import { IamCreateRoleInputSchema } from '@h-ai/api-contract'\n *\n * const value = IamCreateRoleInputSchema.parse({\n *   code: 'example-1',\n *   name: 'Example'\n * })\n * void value\n * ```\n */\nexport const IamCreateRoleInputSchema = z.object({\n  code: z.string().min(1),\n  name: z.string().min(1),\n  description: z.string().optional(),\n  isSystem: z.boolean().optional(),\n})\n\n/**\n * 更新角色入参 Schema。\n * @example\n * ```ts\n * import { IamUpdateRoleInputSchema } from '@h-ai/api-contract'\n *\n * const value = IamUpdateRoleInputSchema.parse({\n *   id: 'example-1'\n * })\n * void value\n * ```\n */\nexport const IamUpdateRoleInputSchema = z.object({\n  id: z.string().min(1),\n  name: z.string().min(1).optional(),\n  description: z.string().optional(),\n})\n\n/**\n * 权限类型 Schema。\n * @example\n * ```ts\n * import { IamPermissionTypeSchema } from '@h-ai/api-contract'\n *\n * const value = IamPermissionTypeSchema.parse('menu')\n * void value\n * ```\n */\nexport const IamPermissionTypeSchema = z.enum(['menu', 'api', 'button'])\n\n/**\n * 权限基础信息 Schema。\n * @example\n * ```ts\n * import { IamPermissionSchema } from '@h-ai/api-contract'\n *\n * const value = IamPermissionSchema.parse({\n *   id: 'example-1',\n *   code: 'example-1',\n *   name: 'Example',\n *   createdAt: null,\n *   updatedAt: null\n * })\n * void value\n * ```\n */\nexport const IamPermissionSchema = z.object({\n  id: z.string(),\n  code: z.string(),\n  name: z.string(),\n  description: z.string().optional(),\n  type: IamPermissionTypeSchema.optional(),\n  resource: z.string().optional(),\n  action: z.string().optional(),\n  createdAt: z.coerce.date(),\n  updatedAt: z.coerce.date(),\n})\n\n/**\n * 权限列表查询入参 Schema。\n * @example\n * ```ts\n * import { IamListPermissionsInputSchema } from '@h-ai/api-contract'\n *\n * const value = IamListPermissionsInputSchema.parse({})\n * void value\n * ```\n */\nexport const IamListPermissionsInputSchema = PaginationQuerySchema.extend({\n  search: z.string().optional(),\n  type: IamPermissionTypeSchema.optional(),\n})\n\n/**\n * 创建权限入参 Schema。\n * @example\n * ```ts\n * import { IamCreatePermissionInputSchema } from '@h-ai/api-contract'\n *\n * const value = IamCreatePermissionInputSchema.parse({\n *   code: 'example-1',\n *   name: 'Example'\n * })\n * void value\n * ```\n */\nexport const IamCreatePermissionInputSchema = z.object({\n  code: z.string().min(1),\n  name: z.string().min(1),\n  description: z.string().optional(),\n  resource: z.string().optional(),\n  action: z.string().optional(),\n  type: IamPermissionTypeSchema.optional(),\n})\n\n/**\n * 账号密码登录请求。\n * @example\n * ```ts\n * import type { IamLoginInput } from '@h-ai/api-contract'\n * import { IamLoginInputSchema } from '@h-ai/api-contract'\n *\n * const value: IamLoginInput = IamLoginInputSchema.parse({\n *   identifier: 'alice',\n *   password: 'example-only-password'\n * })\n * void value\n * ```\n */\nexport type IamLoginInput = z.infer<typeof IamLoginInputSchema>\n/**\n * LDAP 登录请求。\n * @example\n * ```ts\n * import type { IamLdapLoginInput } from '@h-ai/api-contract'\n * import { IamLdapLoginInputSchema } from '@h-ai/api-contract'\n *\n * const value: IamLdapLoginInput = IamLdapLoginInputSchema.parse({\n *   username: 'alice',\n *   password: 'example-only-password'\n * })\n * void value\n * ```\n */\nexport type IamLdapLoginInput = z.infer<typeof IamLdapLoginInputSchema>\n/**\n * 允许下发客户端的身份认证配置。\n * @example\n * ```ts\n * import type { IamPublicConfig } from '@h-ai/api-contract'\n * import { IamPublicConfigSchema } from '@h-ai/api-contract'\n *\n * const value: IamPublicConfig = IamPublicConfigSchema.parse({\n *   password: {\n *     minLength: 0,\n *     maxLength: 0,\n *     requireUppercase: true,\n *     requireLowercase: true,\n *     requireNumber: true,\n *     requireSpecialChar: true,\n *     expirationDays: 0\n *   },\n *   register: {\n *     enabled: true\n *   },\n *   login: {\n *     password: true,\n *     otp: true,\n *     ldap: true,\n *     email: true,\n *     sms: true\n *   },\n *   passwordReset: {\n *     enabled: true,\n *     mode: 'email'\n *   },\n *   otp: {\n *     length: 0,\n *     resendInterval: 0\n *   },\n *   agreements: {\n *     showOnRegister: true,\n *     showOnLogin: true\n *   },\n *   ui: {\n *     variant: 'card'\n *   },\n *   session: {\n *     maxAge: 0\n *   }\n * })\n * void value\n * ```\n */\nexport type IamPublicConfig = z.infer<typeof IamPublicConfigSchema>\n/**\n * 一次性验证码登录请求。\n * @example\n * ```ts\n * import type { IamOtpLoginInput } from '@h-ai/api-contract'\n * import { IamOtpLoginInputSchema } from '@h-ai/api-contract'\n *\n * const value: IamOtpLoginInput = IamOtpLoginInputSchema.parse({\n *   identifier: 'alice',\n *   code: 'example-1'\n * })\n * void value\n * ```\n */\nexport type IamOtpLoginInput = z.infer<typeof IamOtpLoginInputSchema>\n/**\n * 注销当前会话的请求。\n * @example\n * ```ts\n * import type { IamLogoutInput } from '@h-ai/api-contract'\n * import { IamLogoutInputSchema } from '@h-ai/api-contract'\n *\n * const value: IamLogoutInput = IamLogoutInputSchema.parse({})\n * void value\n * ```\n */\nexport type IamLogoutInput = z.infer<typeof IamLogoutInputSchema>\n/**\n * 发送一次性验证码的请求。\n * @example\n * ```ts\n * import type { IamSendOtpInput } from '@h-ai/api-contract'\n * import { IamSendOtpInputSchema } from '@h-ai/api-contract'\n *\n * const value: IamSendOtpInput = IamSendOtpInputSchema.parse({\n *   identifier: 'alice'\n * })\n * void value\n * ```\n */\nexport type IamSendOtpInput = z.infer<typeof IamSendOtpInputSchema>\n/**\n * 以 HaiResult 区分成功业务数据和公共错误的 IamAuthResultOutput 响应。\n * @example\n * ```ts\n * import type { IamAuthResultOutput } from '@h-ai/api-contract'\n * import { IamAuthResultSchema } from '@h-ai/api-contract'\n * import { ok } from '@h-ai/core'\n *\n * const response: IamAuthResultOutput = ok(IamAuthResultSchema.parse({\n *   user: {\n *     id: 'example-1',\n *     username: 'alice',\n *     enabled: true,\n *     createdAt: null,\n *     updatedAt: null\n *   },\n *   tokens: {\n *     accessToken: 'example-only-access',\n *     expiresIn: 0,\n *     tokenType: 'Bearer'\n *   }\n * }))\n * if (response.success) void response.data\n * ```\n */\nexport type IamAuthResultOutput = HaiResult<z.infer<typeof IamAuthResultSchema>>\n/**\n * 当前登录用户及其有效权限。\n * @example\n * ```ts\n * import type { IamCurrentUser } from '@h-ai/api-contract'\n * import { IamCurrentUserSchema } from '@h-ai/api-contract'\n *\n * const value: IamCurrentUser = IamCurrentUserSchema.parse({\n *   id: 'example-1',\n *   username: 'alice',\n *   enabled: true,\n *   createdAt: null,\n *   updatedAt: null,\n *   roles: [\n *     'example'\n *   ],\n *   permissions: [\n *     'example'\n *   ]\n * })\n * void value\n * ```\n */\nexport type IamCurrentUser = z.infer<typeof IamCurrentUserSchema>\n/**\n * 以 HaiResult 区分成功业务数据和公共错误的 IamCurrentUserOutput 响应。\n * @example\n * ```ts\n * import type { IamCurrentUserOutput } from '@h-ai/api-contract'\n * import { IamCurrentUserSchema } from '@h-ai/api-contract'\n * import { ok } from '@h-ai/core'\n *\n * const response: IamCurrentUserOutput = ok(IamCurrentUserSchema.parse({\n *   id: 'example-1',\n *   username: 'alice',\n *   enabled: true,\n *   createdAt: null,\n *   updatedAt: null,\n *   roles: [\n *     'example'\n *   ],\n *   permissions: [\n *     'example'\n *   ]\n * }))\n * if (response.success) void response.data\n * ```\n */\nexport type IamCurrentUserOutput = HaiResult<IamCurrentUser>\n/**\n * 使用刷新凭据换取会话令牌的请求。\n * @example\n * ```ts\n * import type { IamRefreshTokenInput } from '@h-ai/api-contract'\n * import { IamRefreshTokenInputSchema } from '@h-ai/api-contract'\n *\n * const value: IamRefreshTokenInput = IamRefreshTokenInputSchema.parse({\n *   refreshToken: 'example-only-refresh'\n * })\n * void value\n * ```\n */\nexport type IamRefreshTokenInput = z.infer<typeof IamRefreshTokenInputSchema>\n/**\n * 以 HaiResult 区分成功业务数据和公共错误的 IamRefreshTokenOutput 响应。\n * @example\n * ```ts\n * import type { IamRefreshTokenOutput } from '@h-ai/api-contract'\n * import { IamRefreshTokenDataSchema } from '@h-ai/api-contract'\n * import { ok } from '@h-ai/core'\n *\n * const response: IamRefreshTokenOutput = ok(IamRefreshTokenDataSchema.parse({\n *   tokens: {\n *     accessToken: 'example-only-access',\n *     expiresIn: 0,\n *     tokenType: 'Bearer'\n *   }\n * }))\n * if (response.success) void response.data\n * ```\n */\nexport type IamRefreshTokenOutput = HaiResult<z.infer<typeof IamRefreshTokenDataSchema>>\n/**\n * 用户注册请求。\n * @example\n * ```ts\n * import type { IamRegisterInput } from '@h-ai/api-contract'\n * import { IamRegisterInputSchema } from '@h-ai/api-contract'\n *\n * const value: IamRegisterInput = IamRegisterInputSchema.parse({\n *   username: 'alice',\n *   password: 'example-only-password'\n * })\n * void value\n * ```\n */\nexport type IamRegisterInput = z.infer<typeof IamRegisterInputSchema>\n/**\n * 当前用户修改密码的请求。\n * @example\n * ```ts\n * import type { IamChangePasswordInput } from '@h-ai/api-contract'\n * import { IamChangePasswordInputSchema } from '@h-ai/api-contract'\n *\n * const value: IamChangePasswordInput = IamChangePasswordInputSchema.parse({\n *   oldPassword: 'example',\n *   newPassword: 'example-only-password'\n * })\n * void value\n * ```\n */\nexport type IamChangePasswordInput = z.infer<typeof IamChangePasswordInputSchema>\n/**\n * 修改当前用户资料的请求。\n * @example\n * ```ts\n * import type { IamUpdateCurrentUserInput } from '@h-ai/api-contract'\n * import { IamUpdateCurrentUserInputSchema } from '@h-ai/api-contract'\n *\n * const value: IamUpdateCurrentUserInput = IamUpdateCurrentUserInputSchema.parse({})\n * void value\n * ```\n */\nexport type IamUpdateCurrentUserInput = z.infer<typeof IamUpdateCurrentUserInputSchema>\n/**\n * 管理员分页查询用户的请求。\n * @example\n * ```ts\n * import type { IamListUsersInput } from '@h-ai/api-contract'\n * import { IamListUsersInputSchema } from '@h-ai/api-contract'\n *\n * const value: IamListUsersInput = IamListUsersInputSchema.parse({})\n * void value\n * ```\n */\nexport type IamListUsersInput = z.infer<typeof IamListUsersInputSchema>\n/**\n * 管理员创建用户的请求。\n * @example\n * ```ts\n * import type { IamAdminCreateUserInput } from '@h-ai/api-contract'\n * import { IamAdminCreateUserInputSchema } from '@h-ai/api-contract'\n *\n * const value: IamAdminCreateUserInput = IamAdminCreateUserInputSchema.parse({\n *   username: 'alice',\n *   password: 'example-only-password'\n * })\n * void value\n * ```\n */\nexport type IamAdminCreateUserInput = z.infer<typeof IamAdminCreateUserInputSchema>\n/**\n * 管理员修改用户的请求。\n * @example\n * ```ts\n * import type { IamAdminUpdateUserInput } from '@h-ai/api-contract'\n * import { IamAdminUpdateUserInputSchema } from '@h-ai/api-contract'\n *\n * const value: IamAdminUpdateUserInput = IamAdminUpdateUserInputSchema.parse({\n *   id: 'example-1'\n * })\n * void value\n * ```\n */\nexport type IamAdminUpdateUserInput = z.infer<typeof IamAdminUpdateUserInputSchema>\n/**\n * 以用户 ID 定位目标的请求。\n * @example\n * ```ts\n * import type { IamUserIdInput } from '@h-ai/api-contract'\n * import { IamUserIdInputSchema } from '@h-ai/api-contract'\n *\n * const value: IamUserIdInput = IamUserIdInputSchema.parse({\n *   id: 'example-1'\n * })\n * void value\n * ```\n */\nexport type IamUserIdInput = z.infer<typeof IamUserIdInputSchema>\n/**\n * 管理员重置用户密码的请求。\n * @example\n * ```ts\n * import type { IamAdminResetPasswordInput } from '@h-ai/api-contract'\n * import { IamAdminResetPasswordInputSchema } from '@h-ai/api-contract'\n *\n * const value: IamAdminResetPasswordInput = IamAdminResetPasswordInputSchema.parse({\n *   id: 'example-1',\n *   newPassword: 'example-only-password'\n * })\n * void value\n * ```\n */\nexport type IamAdminResetPasswordInput = z.infer<typeof IamAdminResetPasswordInputSchema>\n/**\n * 创建角色的请求。\n * @example\n * ```ts\n * import type { IamCreateRoleInput } from '@h-ai/api-contract'\n * import { IamCreateRoleInputSchema } from '@h-ai/api-contract'\n *\n * const value: IamCreateRoleInput = IamCreateRoleInputSchema.parse({\n *   code: 'example-1',\n *   name: 'Example'\n * })\n * void value\n * ```\n */\nexport type IamCreateRoleInput = z.infer<typeof IamCreateRoleInputSchema>\n/**\n * 修改角色的请求。\n * @example\n * ```ts\n * import type { IamUpdateRoleInput } from '@h-ai/api-contract'\n * import { IamUpdateRoleInputSchema } from '@h-ai/api-contract'\n *\n * const value: IamUpdateRoleInput = IamUpdateRoleInputSchema.parse({\n *   id: 'example-1'\n * })\n * void value\n * ```\n */\nexport type IamUpdateRoleInput = z.infer<typeof IamUpdateRoleInputSchema>\n/**\n * 分页查询权限定义的请求。\n * @example\n * ```ts\n * import type { IamListPermissionsInput } from '@h-ai/api-contract'\n * import { IamListPermissionsInputSchema } from '@h-ai/api-contract'\n *\n * const value: IamListPermissionsInput = IamListPermissionsInputSchema.parse({})\n * void value\n * ```\n */\nexport type IamListPermissionsInput = z.infer<typeof IamListPermissionsInputSchema>\n/**\n * 创建权限定义的请求。\n * @example\n * ```ts\n * import type { IamCreatePermissionInput } from '@h-ai/api-contract'\n * import { IamCreatePermissionInputSchema } from '@h-ai/api-contract'\n *\n * const value: IamCreatePermissionInput = IamCreatePermissionInputSchema.parse({\n *   code: 'example-1',\n *   name: 'Example'\n * })\n * void value\n * ```\n */\nexport type IamCreatePermissionInput = z.infer<typeof IamCreatePermissionInputSchema>\n","/**\n * @h-ai/api-contract — IAM 领域 contract\n *\n * 定义身份认证与权限管理相关 API 的接口边界：\n * - auth：登录、登出、OTP、刷新 Token、注册、修改密码\n * - users：Admin 管理用户（CRUD + 重置密码）\n * - roles：Admin 管理角色（CRUD）\n * - permissions：Admin 管理权限（CRUD）\n *\n * auth.* 入口址前缀为 `/auth`；users/roles/permissions 前缀为 `/iam`。\n * @module iam-contract\n */\n\nimport { paginatedSchema } from '../common/pagination-schemas.js'\nimport { haiResultSchema, HaiVoidResultSchema } from '../common/result-schemas.js'\nimport { route } from '../common/route.js'\nimport {\n  IamAdminCreateUserInputSchema,\n  IamAdminResetPasswordInputSchema,\n  IamAdminUpdateUserInputSchema,\n  IamAuthResultSchema,\n  IamCaptchaChallengeSchema,\n  IamChangePasswordInputSchema,\n  IamConfirmPasswordResetInputSchema,\n  IamCreateCaptchaInputSchema,\n  IamCreatePermissionInputSchema,\n  IamCreateRoleInputSchema,\n  IamCurrentUserSchema,\n  IamInviteUserInputSchema,\n  IamLdapLoginInputSchema,\n  IamListPermissionsInputSchema,\n  IamListUsersInputSchema,\n  IamLoginInputSchema,\n  IamLogoutInputSchema,\n  IamOtpLoginInputSchema,\n  IamPermissionSchema,\n  IamPublicConfigSchema,\n  IamReauthenticateInputSchema,\n  IamReauthenticationProofSchema,\n  IamRefreshTokenDataSchema,\n  IamRefreshTokenInputSchema,\n  IamRegisterInputSchema,\n  IamRenewPasswordInputSchema,\n  IamRequestPasswordResetInputSchema,\n  IamRoleSchema,\n  IamSendOtpDataSchema,\n  IamSendOtpInputSchema,\n  IamUpdateCurrentUserInputSchema,\n  IamUpdateRoleInputSchema,\n  IamUserIdInputSchema,\n  IamUserSchema,\n} from './iam-schemas.js'\n\n// 同一 contract 内被多个接口复用的输出结构保持私有，避免扩大公共 Schema 面。\nconst authResultOutputSchema = haiResultSchema(IamAuthResultSchema)\nconst userOutputSchema = haiResultSchema(IamUserSchema)\nconst roleOutputSchema = haiResultSchema(IamRoleSchema)\n\n/**\n * IAM 领域 oRPC contract。\n * @example\n * ```ts\n * import { apiContract } from '@h-ai/api-contract'\n *\n * const contract = apiContract.iam\n * void contract\n * ```\n */\nexport const iamContract = {\n  auth: {\n    createCaptcha: route({ method: 'POST', path: '/auth/captcha', operationId: 'iam.auth.createCaptcha', summary: 'Create self-hosted security challenge', tags: ['iam', 'auth'] })\n      .input(IamCreateCaptchaInputSchema)\n      .output(haiResultSchema(IamCaptchaChallengeSchema)),\n    reauthenticate: route({ method: 'POST', path: '/auth/reauthenticate', operationId: 'iam.auth.reauthenticate', summary: 'Verify current password for one sensitive operation', tags: ['iam', 'auth'] })\n      .input(IamReauthenticateInputSchema)\n      .output(haiResultSchema(IamReauthenticationProofSchema)),\n    publicConfig: route({ method: 'GET', path: '/auth/config', operationId: 'iam.auth.publicConfig', summary: 'Public authentication configuration', tags: ['iam', 'auth'] })\n      .output(haiResultSchema(IamPublicConfigSchema.nullable())),\n    renewPassword: route({ method: 'POST', path: '/auth/password/renew', operationId: 'iam.auth.renewPassword', summary: 'Change initial or expired password', tags: ['iam', 'auth'] })\n      .input(IamRenewPasswordInputSchema)\n      .output(HaiVoidResultSchema),\n    loginWithLdap: route({ method: 'POST', path: '/auth/login/ldap', operationId: 'iam.auth.loginWithLdap', summary: 'LDAP login', tags: ['iam', 'auth'] })\n      .input(IamLdapLoginInputSchema)\n      .output(authResultOutputSchema),\n    requestPasswordReset: route({ method: 'POST', path: '/auth/password-reset/request', operationId: 'iam.auth.requestPasswordReset', summary: 'Request password reset', tags: ['iam', 'auth'] })\n      .input(IamRequestPasswordResetInputSchema)\n      .output(HaiVoidResultSchema),\n    confirmPasswordReset: route({ method: 'POST', path: '/auth/password-reset/confirm', operationId: 'iam.auth.confirmPasswordReset', summary: 'Confirm password reset', tags: ['iam', 'auth'] })\n      .input(IamConfirmPasswordResetInputSchema)\n      .output(HaiVoidResultSchema),\n    login: route({ method: 'POST', path: '/auth/login', operationId: 'iam.auth.login', summary: 'Password login', tags: ['iam', 'auth'] })\n      .input(IamLoginInputSchema)\n      .output(authResultOutputSchema),\n    loginWithOtp: route({ method: 'POST', path: '/auth/login/otp', operationId: 'iam.auth.loginWithOtp', summary: 'OTP login', tags: ['iam', 'auth'] })\n      .input(IamOtpLoginInputSchema)\n      .output(authResultOutputSchema),\n    logout: route({ method: 'POST', path: '/auth/logout', operationId: 'iam.auth.logout', summary: 'Logout', tags: ['iam', 'auth'] })\n      .input(IamLogoutInputSchema)\n      .output(HaiVoidResultSchema),\n    closeSession: route({ method: 'POST', path: '/auth/session/close', operationId: 'iam.auth.closeSession', summary: 'Revoke departing client session without clearing newer cookies', tags: ['iam', 'auth'] })\n      .input(IamLogoutInputSchema)\n      .output(HaiVoidResultSchema),\n    currentUser: route({ method: 'GET', path: '/auth/me', operationId: 'iam.auth.currentUser', summary: 'Get current user and access scope', tags: ['iam', 'auth'] })\n      .output(haiResultSchema(IamCurrentUserSchema)),\n    refresh: route({ method: 'POST', path: '/auth/refresh', operationId: 'iam.auth.refresh', summary: 'Refresh access token', tags: ['iam', 'auth'] })\n      .input(IamRefreshTokenInputSchema)\n      .output(haiResultSchema(IamRefreshTokenDataSchema)),\n    sendOtp: route({ method: 'POST', path: '/auth/otp/send', operationId: 'iam.auth.sendOtp', summary: 'Send OTP', tags: ['iam', 'auth'] })\n      .input(IamSendOtpInputSchema)\n      .output(haiResultSchema(IamSendOtpDataSchema)),\n    register: route({ method: 'POST', path: '/auth/register', operationId: 'iam.auth.register', summary: 'Register and login', tags: ['iam', 'auth'] })\n      .input(IamRegisterInputSchema)\n      .output(authResultOutputSchema),\n    changePassword: route({ method: 'POST', path: '/auth/change-password', operationId: 'iam.auth.changePassword', summary: 'Change current user password', tags: ['iam', 'auth'] })\n      .input(IamChangePasswordInputSchema)\n      .output(HaiVoidResultSchema),\n    updateCurrentUser: route({ method: 'PUT', path: '/auth/me', operationId: 'iam.auth.updateCurrentUser', summary: 'Update current user', tags: ['iam', 'auth'] })\n      .input(IamUpdateCurrentUserInputSchema)\n      .output(userOutputSchema),\n  },\n  users: {\n    invite: route({ method: 'POST', path: '/iam/users/invite', operationId: 'iam.users.invite', summary: 'Create account with one-time setup invitation', tags: ['iam', 'users'] })\n      .input(IamInviteUserInputSchema)\n      .output(userOutputSchema),\n    list: route({ method: 'GET', path: '/iam/users', operationId: 'iam.users.list', summary: 'List users', tags: ['iam', 'users'] })\n      .input(IamListUsersInputSchema)\n      .output(haiResultSchema(paginatedSchema(IamUserSchema))),\n    get: route({ method: 'GET', path: '/iam/users/{id}', operationId: 'iam.users.get', summary: 'Get user', tags: ['iam', 'users'] })\n      .input(IamUserIdInputSchema)\n      .output(haiResultSchema(IamUserSchema.nullable())),\n    create: route({ method: 'POST', path: '/iam/users', operationId: 'iam.users.create', summary: 'Create user', tags: ['iam', 'users'] })\n      .input(IamAdminCreateUserInputSchema)\n      .output(userOutputSchema),\n    update: route({ method: 'PUT', path: '/iam/users/{id}', operationId: 'iam.users.update', summary: 'Update user', tags: ['iam', 'users'] })\n      .input(IamAdminUpdateUserInputSchema)\n      .output(userOutputSchema),\n    delete: route({ method: 'DELETE', path: '/iam/users/{id}', operationId: 'iam.users.delete', summary: 'Delete user', tags: ['iam', 'users'] })\n      .input(IamUserIdInputSchema)\n      .output(HaiVoidResultSchema),\n    resetPassword: route({ method: 'POST', path: '/iam/users/{id}/reset-password', operationId: 'iam.users.resetPassword', summary: 'Reset user password', tags: ['iam', 'users'] })\n      .input(IamAdminResetPasswordInputSchema)\n      .output(HaiVoidResultSchema),\n  },\n  roles: {\n    list: route({ method: 'GET', path: '/iam/roles', operationId: 'iam.roles.list', summary: 'List roles', tags: ['iam', 'roles'] })\n      .output(haiResultSchema(paginatedSchema(IamRoleSchema))),\n    get: route({ method: 'GET', path: '/iam/roles/{id}', operationId: 'iam.roles.get', summary: 'Get role', tags: ['iam', 'roles'] })\n      .input(IamUserIdInputSchema)\n      .output(haiResultSchema(IamRoleSchema.nullable())),\n    create: route({ method: 'POST', path: '/iam/roles', operationId: 'iam.roles.create', summary: 'Create role', tags: ['iam', 'roles'] })\n      .input(IamCreateRoleInputSchema)\n      .output(roleOutputSchema),\n    update: route({ method: 'PUT', path: '/iam/roles/{id}', operationId: 'iam.roles.update', summary: 'Update role', tags: ['iam', 'roles'] })\n      .input(IamUpdateRoleInputSchema)\n      .output(roleOutputSchema),\n    delete: route({ method: 'DELETE', path: '/iam/roles/{id}', operationId: 'iam.roles.delete', summary: 'Delete role', tags: ['iam', 'roles'] })\n      .input(IamUserIdInputSchema)\n      .output(HaiVoidResultSchema),\n  },\n  permissions: {\n    list: route({ method: 'GET', path: '/iam/permissions', operationId: 'iam.permissions.list', summary: 'List permissions', tags: ['iam', 'permissions'] })\n      .input(IamListPermissionsInputSchema)\n      .output(haiResultSchema(paginatedSchema(IamPermissionSchema))),\n    get: route({ method: 'GET', path: '/iam/permissions/{id}', operationId: 'iam.permissions.get', summary: 'Get permission', tags: ['iam', 'permissions'] })\n      .input(IamUserIdInputSchema)\n      .output(haiResultSchema(IamPermissionSchema.nullable())),\n    create: route({ method: 'POST', path: '/iam/permissions', operationId: 'iam.permissions.create', summary: 'Create permission', tags: ['iam', 'permissions'] })\n      .input(IamCreatePermissionInputSchema)\n      .output(haiResultSchema(IamPermissionSchema)),\n    delete: route({ method: 'DELETE', path: '/iam/permissions/{id}', operationId: 'iam.permissions.delete', summary: 'Delete permission', tags: ['iam', 'permissions'] })\n      .input(IamUserIdInputSchema)\n      .output(HaiVoidResultSchema),\n  },\n}\n\n/**\n * iam 领域公开 procedure 契约的完整类型。\n * @example\n * ```ts\n * import type { IamContract } from '@h-ai/api-contract'\n * import { apiContract } from '@h-ai/api-contract'\n *\n * const contract: IamContract = apiContract.iam\n * void contract\n * ```\n */\nexport type IamContract = typeof iamContract\n"]}