@h-ai/iam 0.1.0-alpha.71 → 0.1.0-alpha.73

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@h-ai/iam",
   "type": "module",
-  "version": "0.1.0-alpha.71",
+  "version": "0.1.0-alpha.73",
   "description": "Hai Framework identity and access management module.",
   "license": "Apache-2.0",
   "exports": {
@@ -28,7 +28,7 @@
     "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
   },
   "peerDependencies": {
-    "@h-ai/reach": "0.1.0-alpha.71",
+    "@h-ai/reach": "0.1.0-alpha.73",
     "ldapts": "^9.2.0"
   },
   "peerDependenciesMeta": {
@@ -40,15 +40,16 @@
     }
   },
   "dependencies": {
-    "@h-ai/audit": "0.1.0-alpha.71",
-    "@h-ai/cache": "0.1.0-alpha.71",
-    "@h-ai/core": "0.1.0-alpha.71",
-    "@h-ai/crypto": "0.1.0-alpha.71",
-    "@h-ai/reldb": "0.1.0-alpha.71",
+    "@h-ai/audit": "0.1.0-alpha.73",
+    "@h-ai/cache": "0.1.0-alpha.73",
+    "@h-ai/core": "0.1.0-alpha.73",
+    "@h-ai/crypto": "0.1.0-alpha.73",
+    "@h-ai/reldb": "0.1.0-alpha.73",
+    "altcha": "^3.5.0",
     "zod": "^4.6.5"
   },
   "devDependencies": {
-    "@h-ai/reach": "0.1.0-alpha.71",
+    "@h-ai/reach": "0.1.0-alpha.73",
     "@types/node": "^26.6.5",
     "ldapts": "^9.2.0",
     "rimraf": "^6.1.3",

package/dist/chunk-VCE74BFW.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/iam-config.ts","../src/iam-types.ts"],"names":[],"mappings":";;;;AAUA,IAAM,eAAe,CAAA,CAAE,GAAA,EAAI,CAAE,MAAA,CAAO,WAAS,CAAC,OAAA,EAAS,QAAQ,CAAA,CAAE,SAAS,IAAI,GAAA,CAAI,KAAK,CAAA,CAAE,QAAQ,CAAC,CAAA;AAqB3F,IAAM,sBAAA,GAAyB,EAAE,IAAA,CAAK,CAAC,YAAY,KAAA,EAAO,MAAA,EAAQ,QAAQ,CAAC;AAuB3E,IAAM,oBAAA,GAAuB,EAAE,MAAA,CAAO;AAAA;AAAA,EAE3C,SAAA,EAAW,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,CAAC,CAAA,CAAE,OAAA,CAAQ,CAAC,CAAA;AAAA;AAAA,EAE5C,SAAA,EAAW,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAQ,GAAG,CAAA;AAAA;AAAA,EAEvD,gBAAA,EAAkB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAE1C,gBAAA,EAAkB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAE1C,aAAA,EAAe,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAEvC,kBAAA,EAAoB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA;AAAA,EAE7C,cAAA,EAAgB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,CAAC,CAAA,CAAE,OAAA,CAAQ,CAAC;AACnD,CAAC,CAAA,CAAE,MAAA,CAAO,CAAA,MAAA,KAAU,MAAA,CAAO,aAAa,MAAA,CAAO,SAAA,EAAW,EAAE,OAAA,EAAS,gCAAA,EAAkC,IAAA,EAAM,CAAC,WAAW,GAAG;AAuBrH,IAAM,eAAA,GAAkB,EAAE,MAAA,CAAO;AAAA;AAAA,EAEtC,KAAA,EAAO,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EAC/B,GAAA,EAAK,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAE7B,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,QAAQ,CAAC,CAAA;AAAA;AAAA,EAEhD,SAAA,EAAW,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,EAAE,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AAAA;AAAA,EAE/C,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,CAAC,CAAA,CAAE,OAAA,CAAQ,CAAC,CAAA;AAAA;AAAA,EAE9C,cAAA,EAAgB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,EAAE,CAAA,CAAE,OAAA,CAAQ,EAAE;AACrD,CAAC;AAuBM,IAAM,yBAAA,GAA4B,EAAE,MAAA,CAAO;AAAA;AAAA,EAEhD,IAAA,EAAM,EAAE,IAAA,CAAK,CAAC,SAAS,OAAO,CAAC,CAAA,CAAE,OAAA,CAAQ,OAAO,CAAA;AAAA;AAAA,EAEhD,QAAA,EAAU,aAAa,QAAA,EAAS;AAAA;AAAA,EAEhC,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAEjC,cAAA,EAAgB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAI,CAAA;AAAA;AAAA,EAEtD,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,CAAC,CAAA,CAAE,OAAA,CAAQ,CAAC;AAChD,CAAC;AAyBM,IAAM,gBAAA,GAAmB,EAAE,MAAA,CAAO;AAAA;AAAA,EAEvC,KAAK,CAAA,CAAE,GAAA,EAAI,CAAE,MAAA,CAAO,WAAS,CAAC,OAAA,EAAS,QAAQ,CAAA,CAAE,SAAS,IAAI,GAAA,CAAI,KAAK,CAAA,CAAE,QAAQ,CAAC,CAAA;AAAA;AAAA,EAElF,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAA;AAAA,EAEjB,YAAA,EAAc,EAAE,MAAA,EAAO;AAAA;AAAA,EAEvB,UAAA,EAAY,EAAE,MAAA,EAAO;AAAA;AAAA,EAErB,YAAA,EAAc,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,oBAAoB,CAAA;AAAA;AAAA,EAErD,iBAAA,EAAmB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,KAAK,CAAA;AAAA;AAAA,EAE3C,cAAA,EAAgB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,MAAM,CAAA;AAAA;AAAA,EAEzC,oBAAA,EAAsB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAE7C,MAAA,EAAQ,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA;AAAA,EAEjC,cAAA,EAAgB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,GAAI,CAAA,CAAE,OAAA,CAAQ,GAAI;AACzD,CAAC;AA2BM,IAAM,kBAAA,GAAqB,EAAE,MAAA,CAAO;AAAA;AAAA,EAEzC,cAAA,EAAgB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,CAAC,CAAA,CAAE,OAAA,CAAQ,EAAE,CAAA;AAAA;AAAA,EAElD,qBAAA,EAAuB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,CAAC,CAAA,CAAE,OAAA,CAAQ,CAAC,CAAA;AAAA;AAAA,EAExD,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,MAAM;AACnC,CAAC;AAyBM,IAAM,iBAAA,GAAoB,EAAE,MAAA,CAAO;AAAA;AAAA,EAExC,QAAA,EAAU,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAElC,GAAA,EAAK,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAE7B,IAAA,EAAM,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA;AAAA,EAE/B,MAAA,EAAQ,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK;AACnC,CAAC;AAuBM,IAAM,oBAAA,GAAuB,EAAE,MAAA,CAAO;AAAA;AAAA,EAE3C,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAEjC,cAAA,EAAgB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI;AAC1C,CAAC;AAuBM,IAAM,oBAAA,GAAuB,EAAE,MAAA,CAAO;AAAA;AAAA,EAE3C,gBAAA,EAAkB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,CAAC,CAAA,CAAE,OAAA,CAAQ,CAAC,CAAA;AAAA;AAAA,EAEnD,eAAA,EAAiB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,EAAE,CAAA,CAAE,OAAA,CAAQ,GAAG;AACvD,CAAC;AAuBM,IAAM,qBAAA,GAAwB,EAAE,MAAA,CAAO;AAAA;AAAA,EAE5C,uBAAuB,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA;AAAA,EAElD,uBAAuB,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA;AAAA,EAElD,gBAAA,EAAkB,aAAa,QAAA,EAAS;AAAA;AAAA,EAExC,gBAAA,EAAkB,aAAa,QAAA,EAAS;AAAA;AAAA,EAExC,cAAA,EAAgB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAExC,WAAA,EAAa,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK;AACxC,CAAC;AAaD,IAAM,kBAAkB,CAAA,CAAE,MAAA,GAAS,MAAA,CAAO,CAAA,KAAA,KAAS,eAAe,IAAA,CAAK,KAAK,CAAA,IAAM,KAAA,CAAM,WAAW,GAAG,CAAA,IAAK,CAAC,KAAA,CAAM,UAAA,CAAW,IAAI,CAAE,CAAA;AAY5H,IAAM,kBAAA,GAAqB,EAAE,MAAA,CAAO;AAAA,EACzC,OAAA,EAAS,EAAE,IAAA,CAAK,CAAC,QAAQ,OAAO,CAAC,CAAA,CAAE,OAAA,CAAQ,MAAM,CAAA;AAAA,EACjD,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC9B,UAAA,EAAY,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAChC,SAAA,EAAW,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,OAAA,EAAS,gBAAgB,QAAA,EAAS;AAAA,EAClC,eAAA,EAAiB,gBAAgB,QAAA;AACnC,CAAC;AAwBM,IAAM,mBAAA,GAAsB,EAAE,MAAA,CAAO;AAAA;AAAA,EAE1C,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,EAAE,CAAA,CAAE,OAAA,CAAQ,KAAK,CAAA;AAAA;AAAA,EAE9C,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAEjC,YAAA,EAAc,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA;AAAA,EAEvC,kBAAA,EAAoB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,IAAI,CAAA,CAAE,OAAA,CAAQ,MAAM;AAC/D,CAAC;AAyBM,IAAM,gBAAA,GAAmB,EAAE,MAAA,CAAO;AAAA;AAAA,EAEvC,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAEjC,cAAA,EAAgB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,aAAa,CAAA;AAAA;AAAA,EAEhD,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,MAAM;AACxC,CAAC;AAyBM,IAAM,eAAA,GAAkB,EAAE,MAAA,CAAO;AAAA;AAAA,EAEtC,EAAA,EAAI,mBAAmB,QAAA,EAAS;AAAA;AAAA;AAAA,EAIhC,QAAA,EAAU,qBAAqB,QAAA,EAAS;AAAA;AAAA,EAGxC,GAAA,EAAK,gBAAgB,QAAA,EAAS;AAAA;AAAA,EAG9B,IAAA,EAAM,iBAAiB,QAAA,EAAS;AAAA;AAAA,EAGhC,MAAA,EAAQ,mBAAmB,QAAA,EAAS;AAAA;AAAA,EAGpC,aAAA,EAAe,0BAA0B,QAAA,EAAS;AAAA;AAAA,EAGlD,KAAA,EAAO,kBAAkB,OAAA,CAAQ;AAAA,IAC/B,QAAA,EAAU,IAAA;AAAA,IACV,GAAA,EAAK,IAAA;AAAA,IACL,IAAA,EAAM,KAAA;AAAA,IACN,MAAA,EAAQ;AAAA,GACT,CAAA;AAAA;AAAA,EAGD,QAAA,EAAU,qBAAqB,OAAA,CAAQ;AAAA,IACrC,OAAA,EAAS,IAAA;AAAA,IACT,cAAA,EAAgB;AAAA,GACjB,CAAA;AAAA;AAAA,EAGD,UAAA,EAAY,sBAAsB,OAAA,CAAQ;AAAA,IACxC,cAAA,EAAgB,IAAA;AAAA,IAChB,WAAA,EAAa;AAAA,GACd,CAAA;AAAA;AAAA,EAGD,QAAA,EAAU,qBAAqB,OAAA,CAAQ;AAAA,IACrC,gBAAA,EAAkB,CAAA;AAAA,IAClB,eAAA,EAAiB;AAAA,GAClB,CAAA;AAAA;AAAA;AAAA,EAKD,OAAA,EAAS,oBAAoB,QAAA,EAAS;AAAA;AAAA;AAAA,EAKtC,IAAA,EAAM,iBAAiB,OAAA,CAAQ,MAAM,iBAAiB,KAAA,CAAM,EAAE,CAAC,CAAA;AAAA;AAAA;AAAA,EAK/D,eAAA,EAAiB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI;AAC3C,CAAC;ACpfD,IAAM,YAAA,GAAe;AAAA,EACnB,WAAA,EAAa,SAAA;AAAA,EACb,mBAAA,EAAqB,SAAA;AAAA,EACrB,cAAA,EAAgB,SAAA;AAAA,EAChB,aAAA,EAAe,SAAA;AAAA,EACf,WAAA,EAAa,SAAA;AAAA,EACb,mBAAA,EAAqB,SAAA;AAAA,EACrB,gBAAA,EAAkB,SAAA;AAAA,EAClB,yBAAA,EAA2B,SAAA;AAAA,EAC3B,WAAA,EAAa,SAAA;AAAA,EACb,eAAA,EAAiB,SAAA;AAAA,EACjB,mBAAA,EAAqB,SAAA;AAAA,EACrB,cAAA,EAAgB,SAAA;AAAA,EAChB,iBAAA,EAAmB,SAAA;AAAA,EACnB,sBAAA,EAAwB,SAAA;AAAA,EACxB,cAAA,EAAgB,SAAA;AAAA,EAChB,cAAA,EAAgB,SAAA;AAAA,EAChB,eAAA,EAAiB,SAAA;AAAA,EACjB,gBAAA,EAAkB,SAAA;AAAA,EAClB,mBAAA,EAAqB,SAAA;AAAA,EACrB,mBAAA,EAAqB,SAAA;AAAA,EACrB,wBAAA,EAA0B,SAAA;AAAA,EAC1B,WAAA,EAAa,SAAA;AAAA,EACb,aAAA,EAAe,SAAA;AAAA,EACf,uBAAA,EAAyB,SAAA;AAAA,EAEzB,iBAAA,EAAmB,SAAA;AAAA,EACnB,eAAA,EAAiB,SAAA;AAAA,EACjB,eAAA,EAAiB,SAAA;AAAA,EACjB,qBAAA,EAAuB,SAAA;AAAA,EACvB,aAAA,EAAe,SAAA;AAAA,EACf,aAAA,EAAe,SAAA;AAAA,EACf,oBAAA,EAAsB,SAAA;AAAA,EAEtB,iBAAA,EAAmB,SAAA;AAAA,EACnB,cAAA,EAAgB,SAAA;AAAA,EAChB,oBAAA,EAAsB,SAAA;AAAA,EACtB,mBAAA,EAAqB,SAAA;AAAA,EACrB,yBAAA,EAA2B,SAAA;AAAA,EAE3B,sBAAA,EAAwB,SAAA;AAAA,EACxB,gBAAA,EAAkB,SAAA;AAAA,EAClB,kBAAA,EAAoB,SAAA;AAAA,EAEpB,cAAA,EAAgB,SAAA;AAAA,EAChB,cAAA,EAAgB,SAAA;AAAA,EAChB,mBAAA,EAAqB,SAAA;AAAA,EAErB,gBAAA,EAAkB,SAAA;AAAA,EAClB,SAAA,EAAW,SAAA;AAAA,EACX,QAAA,EAAU,SAAA;AAAA,EAEV,SAAA,EAAW,SAAA;AAAA,EACX,gBAAA,EAAkB,SAAA;AAAA,EAElB,YAAA,EAAc,SAAA;AAAA,EACd,cAAA,EAAgB;AAClB,CAAA;AAaO,IAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,iBAAA,CAAkB,OAAO,YAAY","file":"chunk-VCE74BFW.js","sourcesContent":["/**\n * @h-ai/iam — 配置 Schema\n *\n * 本文件定义 IAM 模块的配置结构，使用 Zod 进行运行时校验。\n * @module iam-config\n */\n\nimport { z } from 'zod'\n\n/** 浏览器可访问链接仅接受 HTTP(S)，避免配置被用于脚本协议。 */\nconst WebUrlSchema = z.url().refine(value => ['http:', 'https:'].includes(new URL(value).protocol))\n\n// ─── 认证策略配置 ───\n\n/**\n * 认证策略类型\n *\n * 支持的认证方式：\n * - `password` - 用户名/邮箱 + 密码\n * - `otp` - 邮箱/短信 + 验证码\n * - `ldap` - LDAP 目录认证\n * - `apikey` - API Key 认证并按 scopes 收敛权限\n * @example\n * ```ts\n * import { AuthStrategyTypeSchema } from '@h-ai/iam'\n * const result = AuthStrategyTypeSchema.safeParse('password')\n * if (result.success) {\n *   result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const AuthStrategyTypeSchema = z.enum(['password', 'otp', 'ldap', 'apikey'])\n\n/**\n * 认证策略类型\n * @example\n * ```ts\n * import { AuthStrategyTypeSchema, type AuthStrategyType } from '@h-ai/iam'\n * const value: AuthStrategyType = AuthStrategyTypeSchema.parse('password')\n * ```\n */\nexport type AuthStrategyType = z.infer<typeof AuthStrategyTypeSchema>\n\n/**\n * 密码配置 Schema\n * @example\n * ```ts\n * import { PasswordConfigSchema } from '@h-ai/iam'\n * const result = PasswordConfigSchema.safeParse({ minLength: 12, requireSpecialChar: true })\n * if (result.success) {\n *   result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const PasswordConfigSchema = z.object({\n  /** 最小长度（默认 8） */\n  minLength: z.number().int().min(1).default(8),\n  /** 最大长度（默认 128） */\n  maxLength: z.number().int().min(1).max(256).default(128),\n  /** 需要大写字母 */\n  requireUppercase: z.boolean().default(true),\n  /** 需要小写字母 */\n  requireLowercase: z.boolean().default(true),\n  /** 需要数字 */\n  requireNumber: z.boolean().default(true),\n  /** 需要特殊字符 */\n  requireSpecialChar: z.boolean().default(false),\n  /** 密码过期天数（0 表示不过期） */\n  expirationDays: z.number().int().min(0).default(0),\n}).refine(config => config.maxLength >= config.minLength, { message: 'maxLength must be >= minLength', path: ['maxLength'] })\n\n/**\n * 密码配置类型\n * @example\n * ```ts\n * import { PasswordConfigSchema, type PasswordConfig } from '@h-ai/iam'\n * const value: PasswordConfig = PasswordConfigSchema.parse({ minLength: 12, requireSpecialChar: true })\n * ```\n */\nexport type PasswordConfig = z.infer<typeof PasswordConfigSchema>\n\n/**\n * OTP 配置 Schema\n * @example\n * ```ts\n * import { OtpConfigSchema } from '@h-ai/iam'\n * const result = OtpConfigSchema.safeParse({ email: true, sms: false, length: 6 })\n * if (result.success) {\n *   result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const OtpConfigSchema = z.object({\n  /** 分别启用邮件、短信验证码 */\n  email: z.boolean().default(true),\n  sms: z.boolean().default(true),\n  /** 验证码长度（默认 6） */\n  length: z.number().int().min(4).max(8).default(6),\n  /** 验证码过期时间（秒，默认 300） */\n  expiresIn: z.number().int().min(60).default(300),\n  /** 最大重试次数（默认 3） */\n  maxAttempts: z.number().int().min(1).default(3),\n  /** 发送间隔（秒，默认 60） */\n  resendInterval: z.number().int().min(30).default(60),\n})\n\n/**\n * OTP 配置类型\n * @example\n * ```ts\n * import { OtpConfigSchema, type OtpConfig } from '@h-ai/iam'\n * const value: OtpConfig = OtpConfigSchema.parse({ email: true, sms: false, length: 6 })\n * ```\n */\nexport type OtpConfig = z.infer<typeof OtpConfigSchema>\n\n/**\n * 密码重置配置 Schema\n * @example\n * ```ts\n * import { PasswordResetConfigSchema } from '@h-ai/iam'\n * const result = PasswordResetConfigSchema.safeParse({ enabled: true, mode: 'email', resetUrl: 'https://app.example.com/reset-password' })\n * if (result.success) {\n *   result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const PasswordResetConfigSchema = z.object({\n  /** 重置通知渠道，phone 使用 password_reset_sms 模板。 */\n  mode: z.enum(['email', 'phone']).default('email'),\n  /** 重置页面的绝对地址，通知模板可使用 resetUrl。 */\n  resetUrl: WebUrlSchema.optional(),\n  /** 是否启用密码重置 */\n  enabled: z.boolean().default(true),\n  /** 重置令牌有效期（秒，默认 3600 = 1小时） */\n  tokenExpiresIn: z.number().int().min(300).default(3600),\n  /** 最大验证尝试次数（默认 3） */\n  maxAttempts: z.number().int().min(1).default(3),\n})\n\n/**\n * 密码重置配置类型\n * @example\n * ```ts\n * import { PasswordResetConfigSchema, type PasswordResetConfig } from '@h-ai/iam'\n * const value: PasswordResetConfig = PasswordResetConfigSchema.parse({ enabled: true, mode: 'email', resetUrl: 'https://app.example.com/reset-password' })\n * ```\n */\nexport type PasswordResetConfig = z.infer<typeof PasswordResetConfigSchema>\n\n/**\n * LDAP 配置 Schema\n * @example\n * ```ts\n * import { LdapConfigSchema } from '@h-ai/iam'\n * const bindPassword = process.env.LDAP_BIND_PASSWORD\n * if (bindPassword) {\n *   const result = LdapConfigSchema.safeParse({ url: 'ldaps://directory.example.com', bindDn: 'cn=service,dc=example,dc=com', bindPassword: bindPassword, searchBase: 'ou=users,dc=example,dc=com' })\n *   if (result.success)\n *     result.data.searchBase\n * }\n * ```\n */\nexport const LdapConfigSchema = z.object({\n  /** LDAP 服务器 URL */\n  url: z.url().refine(value => ['ldap:', 'ldaps:'].includes(new URL(value).protocol)),\n  /** 绑定 DN */\n  bindDn: z.string(),\n  /** 绑定密码 */\n  bindPassword: z.string(),\n  /** 搜索基础 DN */\n  searchBase: z.string(),\n  /** 搜索过滤器（默认使用 uid） */\n  searchFilter: z.string().default('(uid={{username}})'),\n  /** 用户名属性 */\n  usernameAttribute: z.string().default('uid'),\n  /** 邮箱属性 */\n  emailAttribute: z.string().default('mail'),\n  /** 显示名称属性 */\n  displayNameAttribute: z.string().default('cn'),\n  /** 启用 TLS */\n  useTls: z.boolean().default(false),\n  /** 连接超时（毫秒） */\n  connectTimeout: z.number().int().min(1000).default(5000),\n})\n\n/**\n * LDAP 配置类型\n * @example\n * ```ts\n * import { LdapConfigSchema, type LdapConfig } from '@h-ai/iam'\n * const bindPassword = process.env.LDAP_BIND_PASSWORD\n * if (bindPassword) {\n *   const value: LdapConfig = LdapConfigSchema.parse({ url: 'ldaps://directory.example.com', bindDn: 'cn=service,dc=example,dc=com', bindPassword: bindPassword, searchBase: 'ou=users,dc=example,dc=com' })\n *   value.url\n * }\n * ```\n */\nexport type LdapConfig = z.infer<typeof LdapConfigSchema>\n\n/**\n * API Key 配置 Schema\n * @example\n * ```ts\n * import { ApiKeyConfigSchema } from '@h-ai/iam'\n * const result = ApiKeyConfigSchema.safeParse({ maxKeysPerUser: 5, defaultExpirationDays: 30 })\n * if (result.success) {\n *   result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const ApiKeyConfigSchema = z.object({\n  /** 单用户最大 API Key 数量（默认 10） */\n  maxKeysPerUser: z.number().int().min(1).default(10),\n  /** API Key 默认有效期（天，0 表示永不过期，默认 0） */\n  defaultExpirationDays: z.number().int().min(0).default(0),\n  /** API Key 前缀（默认 'hai_'） */\n  prefix: z.string().default('hai_'),\n})\n\n/**\n * API Key 配置类型\n * @example\n * ```ts\n * import { ApiKeyConfigSchema, type ApiKeyConfig } from '@h-ai/iam'\n * const value: ApiKeyConfig = ApiKeyConfigSchema.parse({ maxKeysPerUser: 5, defaultExpirationDays: 30 })\n * ```\n */\nexport type ApiKeyConfig = z.infer<typeof ApiKeyConfigSchema>\n\n// ─── 登录/注册与安全策略配置 ───\n\n/**\n * 登录类型启用配置\n * @example\n * ```ts\n * import { LoginConfigSchema } from '@h-ai/iam'\n * const result = LoginConfigSchema.safeParse({ password: true, otp: false })\n * if (result.success) {\n *   result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const LoginConfigSchema = z.object({\n  /** 是否启用密码登录 */\n  password: z.boolean().default(true),\n  /** 是否启用 OTP 登录 */\n  otp: z.boolean().default(true),\n  /** 是否启用 LDAP 登录；需要显式开启并提供 ldap 配置。 */\n  ldap: z.boolean().default(false),\n  /** 是否启用 API Key 登录 */\n  apikey: z.boolean().default(false),\n})\n\n/**\n * 登录方式开关配置。\n * @example\n * ```ts\n * import { LoginConfigSchema, type LoginConfig } from '@h-ai/iam'\n * const value: LoginConfig = LoginConfigSchema.parse({ password: true, otp: false })\n * ```\n */\nexport type LoginConfig = z.infer<typeof LoginConfigSchema>\n\n/**\n * 注册配置\n * @example\n * ```ts\n * import { RegisterConfigSchema } from '@h-ai/iam'\n * const result = RegisterConfigSchema.safeParse({ enabled: false })\n * if (result.success) {\n *   result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const RegisterConfigSchema = z.object({\n  /** 是否启用注册 */\n  enabled: z.boolean().default(true),\n  /** 新注册用户是否默认启用 */\n  defaultEnabled: z.boolean().default(true),\n})\n\n/**\n * 注册开关及新用户默认状态。\n * @example\n * ```ts\n * import { RegisterConfigSchema, type RegisterConfig } from '@h-ai/iam'\n * const value: RegisterConfig = RegisterConfigSchema.parse({ enabled: false })\n * ```\n */\nexport type RegisterConfig = z.infer<typeof RegisterConfigSchema>\n\n/**\n * 安全策略配置\n * @example\n * ```ts\n * import { SecurityConfigSchema } from '@h-ai/iam'\n * const result = SecurityConfigSchema.safeParse({ maxLoginAttempts: 5, lockoutDuration: 900 })\n * if (result.success) {\n *   result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const SecurityConfigSchema = z.object({\n  /** 最大登录失败次数（默认 5） */\n  maxLoginAttempts: z.number().int().min(1).default(5),\n  /** 锁定时长（秒，默认 900） */\n  lockoutDuration: z.number().int().min(60).default(900),\n})\n\n/**\n * 服务端账户失败计数与锁定策略。\n * @example\n * ```ts\n * import { SecurityConfigSchema, type SecurityConfig } from '@h-ai/iam'\n * const value: SecurityConfig = SecurityConfigSchema.parse({ maxLoginAttempts: 5, lockoutDuration: 900 })\n * ```\n */\nexport type SecurityConfig = z.infer<typeof SecurityConfigSchema>\n\n/**\n * 协议展示配置\n * @example\n * ```ts\n * import { AgreementConfigSchema } from '@h-ai/iam'\n * const result = AgreementConfigSchema.safeParse({ userAgreementUrl: 'https://app.example.com/terms', showOnRegister: true })\n * if (result.success) {\n *   result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const AgreementConfigSchema = z.object({\n  /** 用户协议 Markdown 正文；同时配置 URL 时优先显示正文。 */\n  userAgreementMarkdown: z.string().min(1).optional(),\n  /** 隐私协议 Markdown 正文；YAML 使用 | 保留段落和换行。 */\n  privacyPolicyMarkdown: z.string().min(1).optional(),\n  /** 用户协议 URL */\n  userAgreementUrl: WebUrlSchema.optional(),\n  /** 隐私协议 URL */\n  privacyPolicyUrl: WebUrlSchema.optional(),\n  /** 注册时展示协议 */\n  showOnRegister: z.boolean().default(true),\n  /** 登录时展示协议 */\n  showOnLogin: z.boolean().default(false),\n})\n\n/**\n * 登录和注册的协议展示设置。\n * @example\n * ```ts\n * import { AgreementConfigSchema, type AgreementConfig } from '@h-ai/iam'\n * const value: AgreementConfig = AgreementConfigSchema.parse({ userAgreementUrl: 'https://app.example.com/terms', showOnRegister: true })\n * ```\n */\nexport type AgreementConfig = z.infer<typeof AgreementConfigSchema>\n\n/** 认证页面外观；文本由应用配置或 i18n 提供，图片只接受 HTTP(S) 或站内路径。 */\nconst AuthImageSchema = z.string().refine(value => /^https?:\\/\\//.test(value) || (value.startsWith('/') && !value.startsWith('//')))\n/**\n * 认证页面外观 Schema；图片仅接受 HTTP(S) 或站内路径，输出包含默认展示模式。\n * @example\n * ```ts\n * import { AuthUiConfigSchema } from '@h-ai/iam'\n * const result = AuthUiConfigSchema.safeParse({ variant: 'split', logoUrl: '/logo.svg' })\n * if (result.success) {\n *   result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const AuthUiConfigSchema = z.object({\n  variant: z.enum(['card', 'split']).default('card'),\n  title: z.string().optional(),\n  subtitle: z.string().optional(),\n  brandTitle: z.string().optional(),\n  brandText: z.string().optional(),\n  logoUrl: AuthImageSchema.optional(),\n  illustrationUrl: AuthImageSchema.optional(),\n})\n/**\n * 认证页外观设置；不包含服务端秘密。\n * @example\n * ```ts\n * import { AuthUiConfigSchema, type AuthUiConfig } from '@h-ai/iam'\n * const value: AuthUiConfig = AuthUiConfigSchema.parse({ variant: 'split', logoUrl: '/logo.svg' })\n * ```\n */\nexport type AuthUiConfig = z.infer<typeof AuthUiConfigSchema>\n\n// ─── 会话配置 ───\n\n/**\n * 会话配置 Schema\n * @example\n * ```ts\n * import { SessionConfigSchema } from '@h-ai/iam'\n * const result = SessionConfigSchema.safeParse({ maxAge: 3600, refreshTokenMaxAge: 604800 })\n * if (result.success) {\n *   result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const SessionConfigSchema = z.object({\n  /** 新会话的默认 access 时长（秒）；创建时可用 maxAge 覆盖，滑动/刷新沿用会话固有时长。 */\n  maxAge: z.number().int().min(60).default(86400),\n  /** 是否滑动窗口（每次访问刷新过期时间） */\n  sliding: z.boolean().default(true),\n  /** 单设备登录（踢掉其他设备） */\n  singleDevice: z.boolean().default(false),\n  /** refreshToken 独立有效期（秒，默认 604800 = 7天）；从签发时刻起算，access 到期仍可刷新。 */\n  refreshTokenMaxAge: z.number().int().min(3600).default(604800),\n})\n\n/**\n * 会话配置类型\n * @example\n * ```ts\n * import { SessionConfigSchema, type SessionConfig } from '@h-ai/iam'\n * const value: SessionConfig = SessionConfigSchema.parse({ maxAge: 3600, refreshTokenMaxAge: 604800 })\n * ```\n */\nexport type SessionConfig = z.infer<typeof SessionConfigSchema>\n\n// ─── RBAC 配置 ───\n\n/**\n * RBAC 配置 Schema\n * @example\n * ```ts\n * import { RbacConfigSchema } from '@h-ai/iam'\n * const result = RbacConfigSchema.safeParse({ enabled: true, defaultRole: 'user' })\n * if (result.success) {\n *   result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const RbacConfigSchema = z.object({\n  /** 是否启用 RBAC */\n  enabled: z.boolean().default(true),\n  /** 超级管理员角色代码 */\n  superAdminRole: z.string().default('super_admin'),\n  /** 默认用户角色 */\n  defaultRole: z.string().default('user'),\n})\n\n/**\n * RBAC 配置类型\n * @example\n * ```ts\n * import { RbacConfigSchema, type RbacConfig } from '@h-ai/iam'\n * const value: RbacConfig = RbacConfigSchema.parse({ enabled: true, defaultRole: 'user' })\n * ```\n */\nexport type RbacConfig = z.infer<typeof RbacConfigSchema>\n\n// ─── 统一配置 ───\n\n/**\n * IAM 统一配置 Schema\n * @example\n * ```ts\n * import { IamConfigSchema } from '@h-ai/iam'\n * const result = IamConfigSchema.safeParse({ seedDefaultData: false, session: { maxAge: 3600 } })\n * if (result.success) {\n *   result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const IamConfigSchema = z.object({\n  /** 认证页外观 */\n  ui: AuthUiConfigSchema.optional(),\n  // ─── 认证策略配置 ───\n\n  /** 密码配置 */\n  password: PasswordConfigSchema.optional(),\n\n  /** OTP 配置 */\n  otp: OtpConfigSchema.optional(),\n\n  /** LDAP 配置 */\n  ldap: LdapConfigSchema.optional(),\n\n  /** API Key 配置 */\n  apikey: ApiKeyConfigSchema.optional(),\n\n  /** 密码重置配置 */\n  passwordReset: PasswordResetConfigSchema.optional(),\n\n  /** 登录启用配置 */\n  login: LoginConfigSchema.default({\n    password: true,\n    otp: true,\n    ldap: false,\n    apikey: false,\n  }),\n\n  /** 注册配置 */\n  register: RegisterConfigSchema.default({\n    enabled: true,\n    defaultEnabled: true,\n  }),\n\n  /** 协议展示配置 */\n  agreements: AgreementConfigSchema.default({\n    showOnRegister: true,\n    showOnLogin: false,\n  }),\n\n  /** 安全策略配置 */\n  security: SecurityConfigSchema.default({\n    maxLoginAttempts: 5,\n    lockoutDuration: 900,\n  }),\n\n  // ─── 会话配置 ───\n\n  /** 会话配置 */\n  session: SessionConfigSchema.optional(),\n\n  // ─── 授权配置 ───\n\n  /** RBAC 配置 */\n  rbac: RbacConfigSchema.default(() => RbacConfigSchema.parse({})),\n\n  // ─── 运行时选项 ───\n\n  /** 是否初始化默认角色和权限（默认 true） */\n  seedDefaultData: z.boolean().default(true),\n})\n\n/**\n * IAM 配置类型\n * @example\n * ```ts\n * import { IamConfigSchema, type IamConfig } from '@h-ai/iam'\n * const value: IamConfig = IamConfigSchema.parse({ seedDefaultData: false, session: { maxAge: 3600 } })\n * ```\n */\nexport type IamConfig = z.infer<typeof IamConfigSchema>\n\n/**\n * IAM 配置设置输入类型（仅设置字段，不含运行时依赖）\n *\n * 说明：Zod 的 default 会让输入端字段可省略，但输出端字段为必填。\n * @example\n * ```ts\n * import type { IamConfigSettingsInput } from '@h-ai/iam'\n * const value: IamConfigSettingsInput = { session: { maxAge: 3600 }, seedDefaultData: false }\n * ```\n */\nexport type IamConfigSettingsInput = z.input<typeof IamConfigSchema>\n","/**\n * @h-ai/iam — 公共类型定义\n *\n * 包含：\n * - 错误类型（IamError）\n * - 函数接口（IamFunctions）\n * - 初始化配置（IamConfigInput）\n * - 子功能类型 re-export\n * @module iam-types\n */\n\nimport type { ErrorInfo, HaiResult } from '@h-ai/core'\n\nimport type { ReachFunctions } from '@h-ai/reach'\nimport type { ApiKeyOperations } from './authn/apikey/iam-authn-apikey-types.js'\nimport type { AuthnOperations } from './authn/iam-authn-types.js'\nimport type { LdapClientFactory } from './authn/ldap/iam-authn-ldap-strategy.js'\nimport type { AuthzOperations } from './authz/iam-authz-types.js'\nimport type { IamConfig, IamConfigSettingsInput } from './iam-config.js'\nimport type { IamPublicConfig } from './iam-public-config.js'\nimport type { SessionOperations } from './session/iam-session-types.js'\nimport type { TicketOperations } from './ticket/iam-ticket-types.js'\nimport type { User, UserOperations } from './user/iam-user-types.js'\nimport { core } from '@h-ai/core'\n\n// ─── 错误定义（照 @h-ai/core 范式） ───\n\nconst IamErrorInfo = {\n  AUTH_FAILED: '001:401',\n  INVALID_CREDENTIALS: '002:401',\n  USER_NOT_FOUND: '003:404',\n  USER_DISABLED: '004:403',\n  USER_LOCKED: '005:403',\n  USER_ALREADY_EXISTS: '006:409',\n  PASSWORD_EXPIRED: '007:401',\n  PASSWORD_POLICY_VIOLATION: '008:400',\n  OTP_INVALID: '009:400',\n  NOT_INITIALIZED: '010:500',\n  OTP_RESEND_TOO_FAST: '011:429',\n  LOGIN_DISABLED: '012:400',\n  REGISTER_DISABLED: '013:403',\n  STRATEGY_NOT_SUPPORTED: '014:400',\n  APIKEY_INVALID: '015:401',\n  APIKEY_EXPIRED: '016:401',\n  APIKEY_DISABLED: '017:403',\n  APIKEY_NOT_FOUND: '018:404',\n  RESET_TOKEN_INVALID: '019:400',\n  RESET_TOKEN_EXPIRED: '020:400',\n  RESET_TOKEN_MAX_ATTEMPTS: '021:429',\n  OTP_EXPIRED: '022:400',\n  SECURITY_BUSY: '023:429',\n  PASSWORD_RESET_DISABLED: '024:403',\n\n  SESSION_NOT_FOUND: '101:401',\n  SESSION_EXPIRED: '102:401',\n  SESSION_INVALID: '103:401',\n  SESSION_CREATE_FAILED: '104:500',\n  TOKEN_EXPIRED: '105:401',\n  TOKEN_INVALID: '106:401',\n  TOKEN_REFRESH_FAILED: '107:401',\n\n  PERMISSION_DENIED: '201:403',\n  ROLE_NOT_FOUND: '202:404',\n  PERMISSION_NOT_FOUND: '203:404',\n  ROLE_ALREADY_EXISTS: '204:409',\n  PERMISSION_ALREADY_EXISTS: '205:409',\n\n  LDAP_CONNECTION_FAILED: '301:500',\n  LDAP_BIND_FAILED: '302:401',\n  LDAP_SEARCH_FAILED: '303:500',\n\n  TICKET_INVALID: '110:401',\n  TICKET_EXPIRED: '111:401',\n  TICKET_ISSUE_FAILED: '112:500',\n\n  REPOSITORY_ERROR: '401:500',\n  NOT_FOUND: '402:404',\n  CONFLICT: '403:409',\n\n  FORBIDDEN: '501:403',\n  INVALID_ARGUMENT: '502:400',\n\n  CONFIG_ERROR: '901:500',\n  INTERNAL_ERROR: '999:500',\n} as const satisfies ErrorInfo\n\n/**\n * IAM 错误码及 HTTP 状态定义；调用方按 code 分支，底层原因只用于脱敏诊断。\n * @example\n * ```ts\n * import { HaiIamError, iam } from '@h-ai/iam'\n * const result = await iam.auth.verifyToken('token-from-authorization-header')\n * if (!result.success && result.error.code === HaiIamError.SESSION_INVALID.code) {\n *   // 由应用的认证边界转为重新登录响应，不泄露底层 cause。\n * }\n * ```\n */\nexport const HaiIamError = core.error.buildHaiErrorsDef('iam', IamErrorInfo)\n\n// ─── 初始化配置 ───\n\n/**\n * 已成功发布的认证通知上下文；发送服务必须按幂等键持久化去重。\n * 回调抛错代表送达结果未知；IAM 不自动重发，也不回滚已经发布的凭据。\n * @example\n * ```ts\n * import type { IamNotificationContext } from '@h-ai/iam'\n * async function deliver(context: IamNotificationContext, enqueue: (key: string, expiresAt: Date) => Promise<void>) {\n *   // 接收端持久去重；回调失败代表送达未知，不能擅自生成新的幂等键重发。\n *   await enqueue(context.idempotencyKey, context.expiresAt)\n * }\n * ```\n */\nexport interface IamNotificationContext {\n  /** 同一次凭据发布的稳定 ID，不包含验证码或明文令牌。 */\n  readonly idempotencyKey: string\n  /** 凭据过期时间；迟到通知不得延长其有效期。 */\n  readonly expiresAt: Date\n}\n\n/**\n * IAM 初始化配置\n *\n * 包含 Zod 校验的设置字段和运行时依赖。\n * 传入 `iam.init()` 的唯一参数。\n * @example\n * ```ts\n * import type { IamConfigInput } from '@h-ai/iam'\n * const value: IamConfigInput = { login: { password: true, otp: false }, register: { enabled: false }, seedDefaultData: false }\n * ```\n */\nexport interface IamConfigInput extends IamConfigSettingsInput {\n  /**\n   * 可选、已初始化的触达模块；由应用安装并注入，IAM 不导入或关闭该模块。\n   * 自动使用 otp_email、otp_sms、password_reset、password_reset_sms 模板；显式发送回调优先。\n   */\n  reach?: ReachFunctions\n  /** LDAP 客户端工厂（可选）；启用 LDAP 且未注入时才加载应用安装的 ldapts。 */\n  ldapClientFactory?: LdapClientFactory\n  /** LDAP 用户同步开关（默认 true） */\n  ldapSyncUser?: boolean\n  /**\n   * 密码重置令牌回调（可选）\n   *\n   * 当用户请求密码重置时，框架生成令牌后通过此回调通知业务层，\n   * 业务层负责将令牌通过邮件/短信等渠道发送给用户。\n   * 也可传入已初始化的 reach 自动发送；两者均未配置时重置功能不可用。\n   *\n   * @param user - 请求重置的用户信息\n   * @param token - 重置令牌（明文，需发送给用户）\n   * @param context - 令牌有效期及接收端必须复用的幂等键；发送失败/超时视为结果未知。\n   */\n  onPasswordResetRequest?: (user: User, token: string, context: IamNotificationContext) => Promise<void>\n\n  /**\n   * OTP 邮件验证码发送回调（可选）\n   *\n   * 当用户请求 OTP 验证码时，框架生成验证码后通过此回调通知业务层，\n   * 业务层负责将验证码通过邮件发送给用户。\n   * 显式回调覆盖 Reach 的 otp_email 模板；两者均不可用时该登录入口关闭。\n   * 投递失败须拒绝 Promise，异常由 IAM 转为业务结果，不要在回调中吞掉失败。\n   *\n   * @param email - 目标邮箱\n   * @param code - 验证码\n   */\n  onOtpSendEmail?: (email: string, code: string, context: IamNotificationContext) => Promise<void>\n\n  /**\n   * OTP 短信验证码发送回调（可选）\n   *\n   * 当用户请求 OTP 验证码时，框架生成验证码后通过此回调通知业务层，\n   * 业务层负责将验证码通过短信发送给用户。\n   * 显式回调覆盖 Reach 的 otp_sms 模板；两者均不可用时该登录入口关闭。\n   * 投递失败须拒绝 Promise，异常由 IAM 转为业务结果，不要在回调中吞掉失败。\n   *\n   * @param phone - 目标手机号\n   * @param code - 验证码\n   */\n  onOtpSendSms?: (phone: string, code: string, context: IamNotificationContext) => Promise<void>\n}\n\n// ─── 函数接口 ───\n\n/**\n * IAM 函数接口\n *\n * 统一聚合所有 IAM 功能。\n * @example\n * ```ts\n * import { iam, type IamFunctions } from '@h-ai/iam'\n * const service: IamFunctions = iam\n * // 应用先初始化 Cache、RelDB、Crypto；关闭时先停止接收请求。\n * const initialized = await service.init({ seedDefaultData: false })\n * if (initialized.success) {\n *   const users = await service.user.listUsers({ page: 1, pageSize: 20 })\n *   if (!users.success)\n *     users.error.code\n *   await service.close() // IAM 不关闭应用注入的依赖。\n * }\n * ```\n */\nexport interface IamFunctions {\n  /**\n   * 初始化 IAM 服务\n   *\n   * 已初始化时先关闭旧内部状态再重新初始化；并发初始化返回配置错误。\n   * 内部按依赖顺序创建 session → authz → authn → user 子功能，\n   * 并可选执行种子数据初始化。\n   *\n   * @param config - IAM 初始化配置（可选 session/password/LDAP 等策略配置）\n   * @returns 成功返回 `ok(undefined)`；失败返回含错误码的 `err`\n   *\n   * @example\n   * ```ts\n   * import { iam } from '@h-ai/iam'\n   * // 共享 RelDB、Cache 已由应用初始化；IAM 会确保 Crypto 可用。\n   * const result = await iam.init({ session: { maxAge: 86400 } })\n   * if (!result.success)\n   *   result.error.code // 交给应用统一错误边界，不能继续接收认证请求。\n   * ```\n   */\n  init: (config: IamConfigInput) => Promise<HaiResult<void>>\n\n  /**\n   * 关闭 IAM 服务\n   *\n   * 释放所有内部子功能引用，将模块恢复到未初始化状态。\n   * 关闭后访问 `iam.auth` 等属性将返回未初始化错误。\n   */\n  close: () => Promise<void>\n\n  /** 当前脱敏后的配置快照（未初始化时为 null） */\n  readonly config: IamConfig | null\n  /** 安全且反映实际可用能力的认证页面配置。 */\n  readonly publicConfig: IamPublicConfig | null\n  /** 是否已初始化 */\n  readonly isInitialized: boolean\n  /** 注册功能是否启用（未初始化或未配置时默认启用） */\n  readonly isRegisterEnabled: boolean\n  /** 认证操作（登录、登出、令牌验证等） */\n  readonly auth: AuthnOperations\n  /** 用户管理（注册、查询、更新、密码管理等） */\n  readonly user: UserOperations\n  /** 授权管理（角色/权限 CRUD、用户角色分配、权限检查） */\n  readonly authz: AuthzOperations\n  /** 会话管理（创建、查询、验证、删除会话） */\n  readonly session: SessionOperations\n  /** API Key 管理（创建、列表、吊销、验证），未启用 apikey 登录时返回未初始化代理 */\n  readonly apiKey: ApiKeyOperations\n  /** 一次性能力票据（签发 / 原子消费短期票据，用于 WebSocket 等无法携带 Bearer Token 的通道） */\n  readonly ticket: TicketOperations\n}\n\n// ─── 子功能类型 re-export ───\n\nexport type { ApiKey, ApiKeyOperations, ApiKeySortDirection, ApiKeySortField, CreateApiKeyOptions, CreateApiKeyResult, ListApiKeysOptions } from './authn/apikey/iam-authn-apikey-types.js'\nexport type { ApiKeyCredentials, AuthnOperations, AuthStrategy, Credentials, LdapCredentials, OtpCredentials, PasswordCredentials } from './authn/iam-authn-types.js'\nexport type { LdapClientFactory } from './authn/ldap/iam-authn-ldap-strategy.js'\nexport type { AuthzOperations, Permission, PermissionQueryOptions, PermissionType, Role } from './authz/iam-authz-types.js'\nexport type { IamPublicConfig } from './iam-public-config.js'\nexport type { AuthResult, CreateSessionOptions, Session, SessionData, SessionFieldUpdates, SessionOperations, TokenPair } from './session/iam-session-types.js'\nexport type { ConsumedTicket, ConsumeTicketOptions, IssuedTicket, IssueTicketOptions, TicketGrant, TicketOperations } from './ticket/iam-ticket-types.js'\nexport type { AgreementDisplay, ListUsersOptions, RegisterOptions, RegisterResult, StoredUser, UpdateCurrentUserInput, User, UserOperations, UserSortDirection, UserSortField } from './user/iam-user-types.js'\n"]}