@h-ai/core 1.0.0-beta.2 → 1.0.0-beta.20

package/dist/{chunk-BEGTB6GL.js → chunk-WU6HUTBO.js}

@@ -685,6 +685,7 @@ __export(util_exports, {
   required: () => required,
   safeExtend: () => safeExtend,
   shallowClone: () => shallowClone,
+  sizeCaps: () => sizeCaps,
   slugify: () => slugify,
   stringifyPrimitive: () => stringifyPrimitive,
   toZod: () => toZod,
@@ -1204,6 +1205,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a3;
   for (let i = start; i < issues.length; i++) {
@@ -2624,7 +2637,7 @@ ${content.join("\n")}
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 7
 };
 
 // ../../node_modules/zod/v4/core/schemas.js
@@ -3380,6 +3393,31 @@ var $ZodDate = /* @__PURE__ */ $constructor("$ZodDate", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse3 = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse3(payload, ctx);
+  };
+}
+var arraySize = (input2) => Array.isArray(input2) ? input2.length : -1;
+var mapSize = (input2) => input2 instanceof Map ? input2.size : -1;
+var setSize = (input2) => input2 instanceof Set ? input2.size : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -3423,6 +3461,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input2, optin, optout) {
   const isPresent = key in input2;
@@ -4379,6 +4418,7 @@ var $ZodMap = /* @__PURE__ */ $constructor("$ZodMap", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, mapSize);
 });
 function handleMapResult(keyResult, valueResult, final, key, input2, inst, ctx) {
   if (keyResult.issues.length) {
@@ -4445,6 +4485,7 @@ var $ZodSet = /* @__PURE__ */ $constructor("$ZodSet", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, setSize);
 });
 function handleSetResult(result, final) {
   if (result.issues.length) {
@@ -13969,9 +14010,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
   doc.write(`}`);
   return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+  for (const [max, check2] of sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check2._zod.def.check)}) return INVALID;`);
+  }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
   const def = schema._zod.def;
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
   const outputVar = buildsValue ? newVar(ctx) : null;
   const iVar = newVar(ctx);
   const elemVar = newVar(ctx);
@@ -14371,6 +14418,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
   const valVar = newVar(ctx);
@@ -14387,6 +14435,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);
   doc.write(`const ${outputVar} = new Set();`);
@@ -19694,13 +19743,28 @@ function date4(params) {
 // src/core-access-config.ts
 var TrustedProxiesSchema = external_exports.union([
   external_exports.literal("auto"),
-  external_exports.array(external_exports.union([external_exports.ipv4(), external_exports.ipv6(), external_exports.cidrv4(), external_exports.cidrv6()])).max(1e3)
+  external_exports.array(external_exports.union([
+    external_exports.ipv4(),
+    external_exports.ipv6(),
+    external_exports.cidrv4(),
+    external_exports.cidrv6()
+  ])).max(1e3)
 ]).describe("\u53EF\u4FE1\u4EE3\u7406 IP/CIDR\uFF1B\u9ED8\u8BA4 auto \u5728\u666E\u901A\u5BBF\u4E3B\u5FFD\u7565\u8F6C\u53D1\u5934\uFF0C\u4EC5\u53D7\u7BA1\u79C1\u6709 Compose \u91C7\u7528\u5BB9\u5668\u7F51\u6BB5");
 var AccessConditionSchema = external_exports.strictObject({
   /** 允许的 IPv4/IPv6 地址或 CIDR；非空时只允许匹配的可信客户端地址。 */
-  allowIps: external_exports.array(external_exports.union([external_exports.ipv4(), external_exports.ipv6(), external_exports.cidrv4(), external_exports.cidrv6()])).max(1e3).default([]).describe("\u5141\u8BB8\u7684 IPv4/IPv6 \u5730\u5740\u6216 CIDR\uFF1B\u7A7A\u6570\u7EC4\u4E0D\u9650\uFF0C\u6700\u591A 1000 \u9879"),
+  allowIps: external_exports.array(external_exports.union([
+    external_exports.ipv4(),
+    external_exports.ipv6(),
+    external_exports.cidrv4(),
+    external_exports.cidrv6()
+  ])).max(1e3).default([]).describe("\u5141\u8BB8\u7684 IPv4/IPv6 \u5730\u5740\u6216 CIDR\uFF1B\u7A7A\u6570\u7EC4\u4E0D\u9650\uFF0C\u6700\u591A 1000 \u9879"),
   /** 拒绝的 IP/CIDR；与 allowIps 同时命中时拒绝优先。 */
-  denyIps: external_exports.array(external_exports.union([external_exports.ipv4(), external_exports.ipv6(), external_exports.cidrv4(), external_exports.cidrv6()])).max(1e3).default([]).describe("\u62D2\u7EDD\u7684 IP/CIDR\uFF1B\u62D2\u7EDD\u4F18\u5148\uFF0C\u7A7A\u6570\u7EC4\u4E0D\u9650\uFF0C\u6700\u591A 1000 \u9879"),
+  denyIps: external_exports.array(external_exports.union([
+    external_exports.ipv4(),
+    external_exports.ipv6(),
+    external_exports.cidrv4(),
+    external_exports.cidrv6()
+  ])).max(1e3).default([]).describe("\u62D2\u7EDD\u7684 IP/CIDR\uFF1B\u62D2\u7EDD\u4F18\u5148\uFF0C\u7A7A\u6570\u7EC4\u4E0D\u9650\uFF0C\u6700\u591A 1000 \u9879"),
   /** 时间窗口的 IANA 时区，默认 UTC；不使用客户端时钟。 */
   timezone: external_exports.string().default("UTC").refine((value) => {
     try {
@@ -19734,7 +19798,17 @@ var RequestAccessPolicySchema = external_exports.strictObject({
     /** 完整请求路径；末尾 /** 同时匹配该路径及子路径，大小写敏感。 */
     paths: external_exports.array(requestPathSchema).min(1).max(100).describe("\u5B8C\u6574\u8BF7\u6C42\u8DEF\u5F84\u5217\u8868\uFF0C\u5305\u542B\u90E8\u7F72\u524D\u7F00\uFF1B\u7CBE\u786E\u6216\u672B\u5C3E /**\uFF0C\u6700\u591A 100 \u9879"),
     /** HTTP 方法，空数组表示所有方法；GET 不隐含 HEAD。 */
-    methods: external_exports.array(external_exports.enum(["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "CONNECT", "TRACE"])).max(9).default([]).describe("\u53D7\u8BE5\u89C4\u5219\u7EA6\u675F\u7684 HTTP \u65B9\u6CD5\uFF1B\u7A7A\u6570\u7EC4\u5168\u90E8\u65B9\u6CD5\uFF0CGET \u4E0D\u9690\u542B HEAD"),
+    methods: external_exports.array(external_exports.enum([
+      "GET",
+      "HEAD",
+      "POST",
+      "PUT",
+      "PATCH",
+      "DELETE",
+      "OPTIONS",
+      "CONNECT",
+      "TRACE"
+    ])).max(9).default([]).describe("\u53D7\u8BE5\u89C4\u5219\u7EA6\u675F\u7684 HTTP \u65B9\u6CD5\uFF1B\u7A7A\u6570\u7EC4\u5168\u90E8\u65B9\u6CD5\uFF0CGET \u4E0D\u9690\u542B HEAD"),
     /** 省略沿用宿主；required 强制应用层加密，disabled 要求普通明文请求，HTTPS 仍须启用。 */
     encryption: external_exports.enum(["required", "disabled"]).optional().describe("\u8DEF\u5F84\u7684\u5E94\u7528\u5C42\u52A0\u89E3\u5BC6\u6A21\u5F0F\uFF1B\u7701\u7565\u6CBF\u7528\u5BBF\u4E3B\uFF0Crequired \u5F3A\u5236\u52A0\u5BC6\uFF0Cdisabled \u660E\u6587\uFF1B\u91CD\u53E0\u8DEF\u5F84\u548C\u65B9\u6CD5\u4E0D\u5F97\u51B2\u7A81")
   })).max(1e3).default([]).describe("\u8DEF\u5F84\u8BBF\u95EE\u89C4\u5219\uFF0C\u6700\u591A 1000 \u6761\uFF1B\u5168\u5C40\u548C\u6240\u6709\u5339\u914D\u89C4\u5219\u90FD\u5FC5\u987B\u901A\u8FC7")
@@ -19749,8 +19823,20 @@ var RequestAccessConfigSchema = external_exports.union([
 ]).describe("\u6BCF\u6B21\u8BF7\u6C42\u7684\u8DEF\u5F84/IP/\u65F6\u95F4\u7B56\u7565\uFF1Bfalse \u5173\u95ED\uFF0C\u5185\u8054\u89C4\u5219\u4E0E\u72EC\u7ACB YAML \u6587\u4EF6\u5F15\u7528\u4E0D\u80FD\u6DF7\u7528");
 
 // src/core-config.ts
-var EnvSchema = external_exports.enum(["development", "production", "test", "staging"]);
-var LogLevelSchema = external_exports.enum(["trace", "debug", "info", "warn", "error", "fatal"]);
+var EnvSchema = external_exports.enum([
+  "development",
+  "production",
+  "test",
+  "staging"
+]);
+var LogLevelSchema = external_exports.enum([
+  "trace",
+  "debug",
+  "info",
+  "warn",
+  "error",
+  "fatal"
+]);
 var LogFormatSchema = external_exports.enum(["json", "pretty"]);
 var LoggingConfigSchema = external_exports.object({
   /** 日志级别（默认 'info'） */
@@ -19759,7 +19845,7 @@ var LoggingConfigSchema = external_exports.object({
   format: LogFormatSchema.default("json"),
   /** 默认上下文，会自动添加到每条日志 */
   context: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
-  /** 要脱敏的字段路径列表（如 ['password', 'token']，默认 []） */
+  /** 额外业务隐私的日志字段路径，如 customer.email、recipients[*].phone；* 匹配一层，区分大小写，默认 []。已知密码/令牌始终脱敏。 */
   redact: external_exports.array(external_exports.string()).default([])
 });
 var CoreConfigSchema = external_exports.strictObject({
@@ -19829,6 +19915,7 @@ var en_US_default = {
   core_configNotLoaded: "Config '{name}' is not loaded",
   core_configUnsupportedInBrowser: "Browser does not support file-based config; use core.config on the server or pass browser options through core.init({ logging })",
   core_cryptoRandomUnavailable: "Cryptographic random source is unavailable",
+  core_parallelConcurrencyInvalid: "Concurrency must be a positive safe integer",
   core_runtimeStartFailed: "Module {module} failed to start",
   core_runtimeCloseFailed: "Module {module} failed to close; retry cleanup",
   core_runtimeEnvMissing: "{message}: Required environment variables are not set: {fields}. Please set valid values in the current environment's .env files or process environment, then restart the application.",
@@ -19892,6 +19979,7 @@ var ja_JP_default = {
   core_configNotLoaded: "\u8A2D\u5B9A\u300C{name}\u300D\u304C\u8AAD\u307F\u8FBC\u307E\u308C\u3066\u3044\u307E\u305B\u3093",
   core_configUnsupportedInBrowser: "\u30D6\u30E9\u30A6\u30B6\u30FC\u306F\u30D5\u30A1\u30A4\u30EB\u30D9\u30FC\u30B9\u306E\u8A2D\u5B9A\u306B\u5BFE\u5FDC\u3057\u3066\u3044\u307E\u305B\u3093\u3002\u30B5\u30FC\u30D0\u30FC\u5074\u3067core.config\u3092\u4F7F\u7528\u3059\u308B\u304B\u3001core.init({ logging })\u3067\u30D6\u30E9\u30A6\u30B6\u30FC\u7528\u306E\u30AA\u30D7\u30B7\u30E7\u30F3\u3092\u6E21\u3057\u3066\u304F\u3060\u3055\u3044",
   core_cryptoRandomUnavailable: "\u6697\u53F7\u5B66\u7684\u4E71\u6570\u306E\u751F\u6210\u5143\u3092\u5229\u7528\u3067\u304D\u307E\u305B\u3093",
+  core_parallelConcurrencyInvalid: "\u4E26\u884C\u6570\u306F 0 \u3088\u308A\u5927\u304D\u3044\u5B89\u5168\u306A\u6574\u6570\u306B\u3057\u3066\u304F\u3060\u3055\u3044",
   core_runtimeStartFailed: "\u30E2\u30B8\u30E5\u30FC\u30EB {module} \u306E\u8D77\u52D5\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
   core_runtimeCloseFailed: "\u30E2\u30B8\u30E5\u30FC\u30EB {module} \u306E\u7D42\u4E86\u306B\u5931\u6557\u3057\u307E\u3057\u305F\u3002\u5F8C\u51E6\u7406\u3092\u518D\u8A66\u884C\u3057\u3066\u304F\u3060\u3055\u3044",
   core_runtimeEnvMissing: "{message}\uFF1A\u5FC5\u9808\u306E\u74B0\u5883\u5909\u6570\u304C\u8A2D\u5B9A\u3055\u308C\u3066\u3044\u307E\u305B\u3093\uFF1A{fields}\u3002\u73FE\u5728\u306E\u74B0\u5883\u306E .env \u30D5\u30A1\u30A4\u30EB\u307E\u305F\u306F\u30D7\u30ED\u30BB\u30B9\u74B0\u5883\u306B\u6709\u52B9\u306A\u5024\u3092\u8A2D\u5B9A\u3057\u3066\u3001\u30A2\u30D7\u30EA\u3092\u518D\u8D77\u52D5\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
@@ -19955,6 +20043,7 @@ var zh_CN_default2 = {
   core_configNotLoaded: "\u914D\u7F6E '{name}' \u672A\u52A0\u8F7D",
   core_configUnsupportedInBrowser: "\u6D4F\u89C8\u5668\u73AF\u5883\u4E0D\u652F\u6301\u6587\u4EF6\u914D\u7F6E\uFF0C\u8BF7\u5728\u670D\u52A1\u7AEF\u4F7F\u7528 core.config \u6216\u901A\u8FC7 core.init({ logging }) \u4F20\u5165\u6D4F\u89C8\u5668\u7AEF\u9009\u9879",
   core_cryptoRandomUnavailable: "\u5F53\u524D\u8FD0\u884C\u73AF\u5883\u7F3A\u5C11\u5BC6\u7801\u5B66\u5B89\u5168\u7684\u968F\u673A\u6E90",
+  core_parallelConcurrencyInvalid: "\u5E76\u53D1\u6570\u5FC5\u987B\u662F\u5927\u4E8E 0 \u7684\u5B89\u5168\u6574\u6570",
   core_runtimeStartFailed: "\u6A21\u5757 {module} \u542F\u52A8\u5931\u8D25",
   core_runtimeCloseFailed: "\u6A21\u5757 {module} \u5173\u95ED\u5931\u8D25\uFF0C\u8BF7\u91CD\u8BD5\u6E05\u7406",
   core_runtimeEnvMissing: "{message}\uFF1A\u672A\u8BBE\u7F6E\u5FC5\u9700\u7684\u73AF\u5883\u53D8\u91CF {fields}\u3002\u8BF7\u5728\u5F53\u524D\u73AF\u5883\u7684 .env \u6587\u4EF6\u6216\u8FDB\u7A0B\u73AF\u5883\u4E2D\u8BBE\u7F6E\u6709\u6548\u503C\u540E\u91CD\u65B0\u542F\u52A8\u5E94\u7528\u3002",
@@ -19993,7 +20082,9 @@ function setGlobalLocale(locale) {
 function runWithLocale(locale, operation) {
   if (!requestLocales)
     throw new Error("Request locale context requires the Node.js entry");
-  return requestLocales.run({ locale: normalizeLocale(locale) }, operation);
+  return requestLocales.run({
+    locale: normalizeLocale(locale)
+  }, operation);
 }
 function createMessageGetter(messages) {
   return (key, options) => {
@@ -20075,7 +20166,9 @@ var typeUtils = {
 var CREDENTIAL_TEXT = /\b(?:Bearer|Basic)\s+[\w.~+/-]+=*|\b(?:[\w-]*[_-])?(?:password(?:[_-]?hash)?|passwd|passcode|secret(?:[_-]?key)?|token|session(?:[_-]?id)?|authorization|cookie|csrf|credential|captcha|reauthentication|ticket|api[_-]?key|private[_-]?key|(?:access|refresh|id|csrf)token|(?:otp|totp|verification|verify|captcha|sms|email|auth|one[_-]?time|two[_-]?factor)[_-]?code)(?:\\?["'])?\s*[:=]\s*(?:(?:Bearer|Basic)\s+)?(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\\"(?:[^\\]|\\\\\\\\|\\\\\\"|\\\\[^"\\])*\\"|[^\s,;&}\]]+)/gi;
 function sanitizeText(text, secretValues = []) {
   let result = text;
-  for (const value of [...new Set(secretValues)].filter(Boolean).sort((a, b) => b.length - a.length))
+  for (const value of [
+    ...new Set(secretValues)
+  ].filter(Boolean).sort((a, b) => b.length - a.length))
     result = result.replaceAll(value, "[REDACTED]");
   return result.replace(/\b[a-z][a-z\d+.-]*:\/\/[^\s<>"']+/gi, (url2) => sanitizeUrl(url2)).replace(CREDENTIAL_TEXT, (match) => match.includes("[REDACTED") ? match : "[REDACTED]");
 }
@@ -20165,7 +20258,10 @@ function sanitizeUrlWithContext(url2, context) {
   }
 }
 function isProtectedPropertyKey(key) {
-  return key === "__proto__" || key === "constructor" || key === "prototype";
+  return key === "__proto__" || key === "constructor" || key === "prototype" || key === "toJSON";
+}
+function enumerableDataEntries(value) {
+  return Object.entries(Object.getOwnPropertyDescriptors(value)).filter(([key, descriptor]) => descriptor.enumerable && "value" in descriptor && !isProtectedPropertyKey(key)).map(([key, descriptor]) => [key, descriptor.value]);
 }
 function createSanitizeSensitiveContext(options = {}) {
   const replacement = options.replacement ?? DEFAULT_SENSITIVE_REPLACEMENT;
@@ -20188,13 +20284,20 @@ function sanitizeSensitiveValueWithContext(value, key, context, cache, errorPath
       return isErrorDiagnostic ? sanitizeSensitiveValueWithContext(context.replacement, null, context, cache, errorPath ?? /* @__PURE__ */ new WeakSet(), errorDepth) : context.replacement;
     }
   }
+  if (typeof value === "function" || typeof value === "symbol")
+    return void 0;
+  if (value instanceof Date) {
+    const timestamp = Date.prototype.getTime.call(value);
+    return Number.isFinite(timestamp) ? Date.prototype.toISOString.call(value) : null;
+  }
+  if (value instanceof URL)
+    return sanitizeUrlWithContext(URL.prototype.toString.call(value), context);
   if (isErrorDiagnostic) {
     if (typeof value === "bigint")
       return value.toString();
-    if (typeof value === "function" || typeof value === "symbol")
-      return void 0;
-    if (value === null || typeof value !== "object")
+    if (value === null || typeof value !== "object") {
       return typeof value === "string" ? sanitizeText(value) : value;
+    }
     const activePath = errorPath ?? /* @__PURE__ */ new WeakSet();
     if (activePath.has(value))
       return "[Circular]";
@@ -20203,9 +20306,13 @@ function sanitizeSensitiveValueWithContext(value, key, context, cache, errorPath
     activePath.add(value);
     try {
       if (Array.isArray(value)) {
-        return value.map((item) => sanitizeSensitiveValueWithContext(item, null, context, cache, activePath, errorDepth + 1));
+        return Array.from({ length: value.length }, (_, index) => {
+          const descriptor = Object.getOwnPropertyDescriptor(value, index);
+          const item = descriptor && "value" in descriptor ? descriptor.value : void 0;
+          return sanitizeSensitiveValueWithContext(item, null, context, cache, activePath, errorDepth + 1);
+        });
       }
-      const fields = { ...value };
+      const fields = Object.fromEntries(enumerableDataEntries(value));
       if (errorValue) {
         fields.name = errorValue.name;
         fields.message = errorValue.message;
@@ -20233,21 +20340,20 @@ function sanitizeSensitiveValueWithContext(value, key, context, cache, errorPath
     const sanitizedArray = [];
     cache.set(value, sanitizedArray);
     for (let index = 0; index < value.length; index++) {
-      sanitizedArray[index] = sanitizeSensitiveValueWithContext(value[index], null, context, cache);
+      const descriptor = Object.getOwnPropertyDescriptor(value, index);
+      const item = descriptor && "value" in descriptor ? descriptor.value : void 0;
+      sanitizedArray[index] = sanitizeSensitiveValueWithContext(item, null, context, cache);
     }
     return sanitizedArray;
   }
-  if (isPlainObjectValue) {
+  if (value !== null && typeof value === "object") {
     if (cache.has(value)) {
       return cache.get(value);
     }
     const sanitized = {};
     cache.set(value, sanitized);
-    for (const childKey in value) {
-      if (!Object.hasOwn(value, childKey) || isProtectedPropertyKey(childKey)) {
-        continue;
-      }
-      sanitized[childKey] = sanitizeSensitiveValueWithContext(value[childKey], childKey, context, cache);
+    for (const [childKey, childValue] of enumerableDataEntries(value)) {
+      sanitized[childKey] = sanitizeSensitiveValueWithContext(childValue, childKey, context, cache);
     }
     return sanitized;
   }
@@ -20432,18 +20538,24 @@ function toPublic(error63, traceId, locale) {
   const context = requestContext.get();
   const candidate = traceId ?? context.traceId ?? context.requestId ?? error63.traceId;
   const safeTraceId = candidate && /^[\w.:-]{1,128}$/.test(candidate) ? candidate : id.uuid();
+  const httpStatus = typeof error63.httpStatus === "number" && Number.isInteger(error63.httpStatus) && error63.httpStatus >= 400 && error63.httpStatus <= 599 ? error63.httpStatus : 500;
   const result = {
     code: error63.code,
-    message: (error63.httpStatus ?? 400) >= 500 ? i18n.coreM("core_errorInternal", { locale }) : sanitize.sanitizeText(error63.message),
+    message: httpStatus >= 500 ? i18n.coreM("core_errorInternal", { locale }) : sanitize.sanitizeText(error63.message),
     traceId: safeTraceId,
-    ...error63.httpStatus !== void 0 ? { httpStatus: error63.httpStatus } : {},
+    httpStatus,
     ...error63.system ? { system: error63.system } : {},
     ...error63.module ? { module: error63.module } : {}
   };
   if (error63.publicExt)
     result.ext = sanitize.sanitizeSensitiveFields(error63.publicExt);
-  if ((error63.httpStatus === 400 || error63.httpStatus === 422) && Array.isArray(error63.cause)) {
-    result.cause = error63.cause.flatMap((item) => item && typeof item === "object" && "field" in item && typeof item.field === "string" && "message" in item && typeof item.message === "string" ? [{ field: item.field, message: sanitize.sanitizeText(item.message) }] : []);
+  if ((httpStatus === 400 || httpStatus === 422) && Array.isArray(error63.cause)) {
+    result.cause = error63.cause.flatMap((item) => item && typeof item === "object" && "field" in item && typeof item.field === "string" && "message" in item && typeof item.message === "string" ? [
+      {
+        field: item.field,
+        message: sanitize.sanitizeText(item.message)
+      }
+    ] : []);
   }
   result.message = formatMessage(result);
   return result;
@@ -20525,6 +20637,7 @@ var CommonErrorInfo = {
   VALIDATION_ERROR: "200:400",
   INVALID_REQUEST: "201:400",
   PARAMETER_MISSING: "202:400",
+  RATE_LIMIT_EXCEEDED: "203:429",
   // 300-399: 资源操作
   NOT_FOUND: "300:404",
   ALREADY_EXISTS: "301:409",
@@ -20565,7 +20678,10 @@ function emitLogRecord(record2) {
   try {
     for (const observer of observers) {
       try {
-        const result = observer({ ...record2, context: sanitize.sanitizeSensitiveFields(record2.context) });
+        const result = observer({
+          ...record2,
+          context: sanitize.sanitizeSensitiveFields(record2.context)
+        });
         if (result instanceof Promise)
           void result.catch(() => {
           });
@@ -20721,14 +20837,22 @@ var zodValidation = {
 
 // src/utils/core-util-array.ts
 function unique(arr) {
-  return [...new Set(arr)];
+  return [
+    ...new Set(arr)
+  ];
 }
 function groupBy(arr, fn) {
   const result = {};
   for (const item of arr) {
     const key = fn(item);
-    if (!result[key])
-      result[key] = [];
+    if (!Object.hasOwn(result, key)) {
+      Object.defineProperty(result, key, {
+        value: [],
+        enumerable: true,
+        writable: true,
+        configurable: true
+      });
+    }
     result[key].push(item);
   }
   return result;
@@ -20815,6 +20939,8 @@ async function retry(fn, options = {}) {
   throw lastError;
 }
 async function parallel(items, fn, concurrency = 5) {
+  if (!Number.isSafeInteger(concurrency) || concurrency <= 0)
+    throw new RangeError(i18n.coreM("core_parallelConcurrencyInvalid"));
   const results = [];
   let index = 0;
   async function worker() {
@@ -20824,7 +20950,9 @@ async function parallel(items, fn, concurrency = 5) {
     }
   }
   const workers = Array.from(
-    { length: Math.min(concurrency, items.length) },
+    {
+      length: Math.min(concurrency, items.length)
+    },
     () => worker()
   );
   await Promise.all(workers);
@@ -20874,12 +21002,26 @@ function createNotInitializedKit(codeOrDef, messageFn) {
     if (isHaiErrorDef(codeOrDef)) {
       return error62.buildHaiErrorInst(codeOrDef, messageFn());
     }
-    return { code: codeOrDef, message: messageFn() };
+    return {
+      code: codeOrDef,
+      message: messageFn()
+    };
   };
-  const result = () => ({ success: false, error: error63() });
-  const asyncOp = async () => ({ success: false, error: error63() });
-  const syncOp = () => ({ success: false, error: error63() });
-  const proxy = (mode = "async") => new Proxy({}, { get: () => mode === "sync" ? syncOp : asyncOp });
+  const result = () => ({
+    success: false,
+    error: error63()
+  });
+  const asyncOp = async () => ({
+    success: false,
+    error: error63()
+  });
+  const syncOp = () => ({
+    success: false,
+    error: error63()
+  });
+  const proxy = (mode = "async") => new Proxy({}, {
+    get: () => mode === "sync" ? syncOp : asyncOp
+  });
   return { error: error63, result, proxy };
 }
 function requiresSharedState(environment) {
@@ -20887,6 +21029,12 @@ function requiresSharedState(environment) {
 }
 
 // src/utils/core-util-object.ts
+function isPlainRecord2(value) {
+  if (!typeUtils.isObject(value))
+    return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
 function deepClone(obj) {
   return structuredClone(obj);
 }
@@ -20899,7 +21047,7 @@ function deepMerge(...objects) {
       if (key === "__proto__" || key === "constructor" || key === "prototype")
         continue;
       const val = obj[key];
-      if (typeUtils.isObject(val) && typeUtils.isObject(result[key])) {
+      if (isPlainRecord2(val) && isPlainRecord2(result[key])) {
         result[key] = deepMerge(
           result[key],
           val
@@ -20966,17 +21114,42 @@ function failure2(module, phase, detail) {
     }
   }
   const code = detail && typeof detail === "object" && "code" in detail && (typeof detail.code === "number" || typeof detail.code === "string") ? detail.code : void 0;
-  const uniqueFields = [...new Set(fields)];
-  let message = i18n.coreM(phase === "start" ? "core_runtimeStartFailed" : "core_runtimeCloseFailed", { params: { module } });
+  const uniqueFields = [
+    ...new Set(fields)
+  ];
+  let message = i18n.coreM(phase === "start" ? "core_runtimeStartFailed" : "core_runtimeCloseFailed", {
+    params: { module }
+  });
   if (phase === "start" && uniqueFields.length) {
     const configMessage = code === HaiConfigError.CONFIG_ENV_VAR_MISSING.code ? "core_runtimeEnvMissing" : code === HaiConfigError.CONFIG_VALIDATION_ERROR.code || detail && typeof detail === "object" && "issues" in detail && Array.isArray(detail.issues) ? "core_runtimeConfigInvalid" : "core_runtimeConfigProblem";
-    message = i18n.coreM(configMessage, { params: { message, fields: uniqueFields.join(", ") } });
+    message = i18n.coreM(configMessage, {
+      params: {
+        message,
+        fields: uniqueFields.join(", ")
+      }
+    });
   }
   const diagnostics = [
-    ...code !== void 0 ? [i18n.coreM("core_runtimeErrorCode", { params: { code } })] : [],
+    ...code !== void 0 ? [
+      i18n.coreM("core_runtimeErrorCode", {
+        params: { code }
+      })
+    ] : [],
     ...phase === "close" ? uniqueFields : []
   ].join(", ");
-  return { success: false, error: { ...HaiCommonError.INIT_FAILED, message: diagnostics ? `${message} (${diagnostics})` : message, ext: { module, phase, ...code !== void 0 ? { code } : {}, ...uniqueFields.length ? { fields: uniqueFields } : {} } } };
+  return {
+    success: false,
+    error: {
+      ...HaiCommonError.INIT_FAILED,
+      message: diagnostics ? `${message} (${diagnostics})` : message,
+      ext: {
+        module,
+        phase,
+        ...code !== void 0 ? { code } : {},
+        ...uniqueFields.length ? { fields: uniqueFields } : {}
+      }
+    }
+  };
 }
 function createRuntime(definitions) {
   const steps = definitions.map((step) => ({ ...step }));
@@ -21127,20 +21300,50 @@ function timeAgo(date5) {
   const seconds = Math.floor((Date.now() - date5.getTime()) / 1e3);
   if (seconds < 5)
     return i18n.coreM("core_timeJustNow");
-  if (seconds < 60)
-    return i18n.coreM("core_timeSecondsAgo", { params: { n: seconds } });
-  if (seconds < 3600)
-    return i18n.coreM("core_timeMinutesAgo", { params: { n: Math.floor(seconds / 60) } });
-  if (seconds < 86400)
-    return i18n.coreM("core_timeHoursAgo", { params: { n: Math.floor(seconds / 3600) } });
+  if (seconds < 60) {
+    return i18n.coreM("core_timeSecondsAgo", {
+      params: { n: seconds }
+    });
+  }
+  if (seconds < 3600) {
+    return i18n.coreM("core_timeMinutesAgo", {
+      params: {
+        n: Math.floor(seconds / 60)
+      }
+    });
+  }
+  if (seconds < 86400) {
+    return i18n.coreM("core_timeHoursAgo", {
+      params: {
+        n: Math.floor(seconds / 3600)
+      }
+    });
+  }
   const days = Math.floor(seconds / 86400);
-  if (days < 7)
-    return i18n.coreM("core_timeDaysAgo", { params: { n: days } });
-  if (days < 30)
-    return i18n.coreM("core_timeWeeksAgo", { params: { n: Math.floor(days / 7) } });
-  if (days < 365)
-    return i18n.coreM("core_timeMonthsAgo", { params: { n: Math.floor(days / 30) } });
-  return i18n.coreM("core_timeYearsAgo", { params: { n: Math.floor(days / 365) } });
+  if (days < 7) {
+    return i18n.coreM("core_timeDaysAgo", {
+      params: { n: days }
+    });
+  }
+  if (days < 30) {
+    return i18n.coreM("core_timeWeeksAgo", {
+      params: {
+        n: Math.floor(days / 7)
+      }
+    });
+  }
+  if (days < 365) {
+    return i18n.coreM("core_timeMonthsAgo", {
+      params: {
+        n: Math.floor(days / 30)
+      }
+    });
+  }
+  return i18n.coreM("core_timeYearsAgo", {
+    params: {
+      n: Math.floor(days / 365)
+    }
+  });
 }
 function now() {
   return Date.now();
@@ -21380,6 +21583,6 @@ function createCore(loggerFns) {
   };
 }
 
-export { AccessConditionSchema, CoreConfigSchema, EnvSchema, HaiCommonError, HaiConfigError, LogFormatSchema, LogLevelSchema, LoggingConfigSchema, RequestAccessConfigSchema, RequestAccessPolicySchema, TrustedProxiesSchema, __commonJS, __toESM, createCore, emitLogRecord, err, i18n, installRequestContext, installRequestLocales, ok, requestContext, sanitize, sanitizeLogFields, typeUtils };
-//# sourceMappingURL=chunk-BEGTB6GL.js.map
-//# sourceMappingURL=chunk-BEGTB6GL.js.map
+export { AccessConditionSchema, CoreConfigSchema, EnvSchema, HaiCommonError, HaiConfigError, LogFormatSchema, LogLevelSchema, LoggingConfigSchema, RequestAccessConfigSchema, RequestAccessPolicySchema, TrustedProxiesSchema, __commonJS, __toESM, createCore, emitLogRecord, err, i18n, installRequestContext, installRequestLocales, ok, requestContext, sanitize, sanitizeLogFields };
+//# sourceMappingURL=chunk-WU6HUTBO.js.map
+//# sourceMappingURL=chunk-WU6HUTBO.js.map