@h-ai/iam 1.0.0-beta.2 → 1.0.0-beta.20

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. package/README.en.md +269 -88
  2. package/README.ja.md +272 -91
  3. package/README.md +275 -94
  4. package/dist/browser.d.ts +2 -1
  5. package/dist/browser.js +1 -1
  6. package/dist/{chunk-VR7JW2EW.js → chunk-PDPLBMGN.js} +6 -3
  7. package/dist/chunk-PDPLBMGN.js.map +1 -0
  8. package/dist/index.js +1212 -363
  9. package/dist/index.js.map +1 -1
  10. package/package.json +14 -14
  11. package/dist/chunk-VR7JW2EW.js.map +0 -1
package/dist/chunk-PDPLBMGN.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"sources":["../src/iam-config.ts","../src/iam-types.ts"],"names":[],"mappings":";;;;AAWA,IAAM,eAAe,CAAA,CAAE,GAAA,EAAI,CAAE,MAAA,CAAO,WAAS,CAAC,OAAA,EAAS,QAAQ,CAAA,CAAE,SAAS,IAAI,GAAA,CAAI,KAAK,CAAA,CAAE,QAAQ,CAAC,CAAA;AAqB3F,IAAM,sBAAA,GAAyB,EAAE,IAAA,CAAK,CAAC,YAAY,KAAA,EAAO,MAAA,EAAQ,QAAQ,CAAC;AAuB3E,IAAM,oBAAA,GAAuB,EAAE,MAAA,CAAO;AAAA;AAAA,EAE3C,SAAA,EAAW,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,CAAC,CAAA,CAAE,OAAA,CAAQ,CAAC,CAAA;AAAA;AAAA,EAE5C,SAAA,EAAW,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAQ,GAAG,CAAA;AAAA;AAAA,EAEvD,gBAAA,EAAkB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAE1C,gBAAA,EAAkB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAE1C,aAAA,EAAe,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAEvC,kBAAA,EAAoB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA;AAAA,EAE7C,mBAAA,EAAqB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,QAAQ,CAAC,CAAA;AAAA;AAAA,EAE7D,cAAA,EAAgB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,CAAC,CAAA,CAAE,OAAA,CAAQ,CAAC,CAAA;AAAA;AAAA,EAEjD,mBAAA,EAAqB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA;AAAA,EAE9C,oBAAA,EAAsB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK;AACjD,CAAC,EAAE,MAAA,CAAO,CAAA,MAAA,KAAU,MAAA,CAAO,SAAA,IAAa,OAAO,SAAA,EAAW;AAAA,EACxD,OAAA,EAAS,gCAAA;AAAA,EACT,IAAA,EAAM,CAAC,WAAW;AACpB,CAAC;AAuBM,IAAM,eAAA,GAAkB,EAAE,MAAA,CAAO;AAAA;AAAA,EAEtC,KAAA,EAAO,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,EAC/B,GAAA,EAAK,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAE7B,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,QAAQ,CAAC,CAAA;AAAA;AAAA,EAEhD,SAAA,EAAW,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,EAAE,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AAAA;AAAA,EAE/C,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,CAAC,CAAA,CAAE,OAAA,CAAQ,CAAC,CAAA;AAAA;AAAA,EAE9C,cAAA,EAAgB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,EAAE,CAAA,CAAE,OAAA,CAAQ,EAAE;AACrD,CAAC;AAuBM,IAAM,yBAAA,GAA4B,EAAE,MAAA,CAAO;AAAA;AAAA,EAEhD,IAAA,EAAM,EAAE,IAAA,CAAK,CAAC,SAAS,OAAO,CAAC,CAAA,CAAE,OAAA,CAAQ,OAAO,CAAA;AAAA;AAAA,EAEhD,QAAA,EAAU,aAAa,QAAA,EAAS;AAAA;AAAA,EAEhC,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAEjC,cAAA,EAAgB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAI,CAAA;AAAA;AAAA,EAEtD,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,CAAC,CAAA,CAAE,OAAA,CAAQ,CAAC;AAChD,CAAC;AAyBM,IAAM,gBAAA,GAAmB,EAAE,MAAA,CAAO;AAAA;AAAA,EAEvC,KAAK,CAAA,CAAE,GAAA,EAAI,CAAE,MAAA,CAAO,WAAS,CAAC,OAAA,EAAS,QAAQ,CAAA,CAAE,SAAS,IAAI,GAAA,CAAI,KAAK,CAAA,CAAE,QAAQ,CAAC,CAAA;AAAA;AAAA,EAElF,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAA;AAAA,EAEjB,YAAA,EAAc,EAAE,MAAA,EAAO;AAAA;AAAA,EAEvB,UAAA,EAAY,EAAE,MAAA,EAAO;AAAA;AAAA,EAErB,YAAA,EAAc,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,oBAAoB,CAAA;AAAA;AAAA,EAErD,iBAAA,EAAmB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,KAAK,CAAA;AAAA;AAAA,EAE3C,cAAA,EAAgB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,MAAM,CAAA;AAAA;AAAA,EAEzC,oBAAA,EAAsB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAE7C,MAAA,EAAQ,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA;AAAA,EAEjC,cAAA,EAAgB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,GAAI,CAAA,CAAE,OAAA,CAAQ,GAAI;AACzD,CAAC;AA2BM,IAAM,kBAAA,GAAqB,EAAE,MAAA,CAAO;AAAA;AAAA,EAEzC,cAAA,EAAgB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,CAAC,CAAA,CAAE,OAAA,CAAQ,EAAE,CAAA;AAAA;AAAA,EAElD,qBAAA,EAAuB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,CAAC,CAAA,CAAE,OAAA,CAAQ,CAAC,CAAA;AAAA;AAAA,EAExD,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,MAAM;AACnC,CAAC;AAyBM,IAAM,iBAAA,GAAoB,EAAE,MAAA,CAAO;AAAA;AAAA,EAExC,QAAA,EAAU,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAElC,GAAA,EAAK,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAE7B,IAAA,EAAM,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA;AAAA,EAE/B,MAAA,EAAQ,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK;AACnC,CAAC;AAuBM,IAAM,oBAAA,GAAuB,EAAE,YAAA,CAAa;AAAA;AAAA,EAEjD,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAEjC,oBAAA,EAAsB,EAAE,IAAA,CAAK,CAAC,UAAU,SAAS,CAAC,CAAA,CAAE,OAAA,CAAQ,QAAQ;AACtE,CAAC;AAuBM,IAAM,oBAAA,GAAuB,EAAE,MAAA,CAAO;AAAA;AAAA,EAE3C,cAAA,EAAgB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAExC,aAAA,EAAe,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,OAAQ,CAAA,CAAE,QAAQ,KAAK,CAAA;AAAA;AAAA,EAElE,gBAAA,EAAkB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,CAAC,CAAA,CAAE,OAAA,CAAQ,CAAC,CAAA;AAAA;AAAA,EAEnD,eAAA,EAAiB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,EAAE,CAAA,CAAE,OAAA,CAAQ,GAAG;AACvD,CAAC;AAUM,IAAM,mBAAA,GAAsB,EAAE,MAAA,CAAO;AAAA;AAAA,EAE1C,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA;AAAA,EAElC,UAAA,EAAY,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAQ,GAAG,CAAA;AAAA;AAAA,EAExD,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,GAAA,CAAI,GAAK,CAAA,CAAE,QAAQ,GAAI,CAAA;AAAA;AAAA,EAEvD,UAAA,EAAY,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAI,CAAA,CAAE,QAAQ,GAAG;AAC3D,CAAC;AAoBM,IAAM,uBAAA,GAA0B,sBAAsB,MAAA,CAAO;AAAA;AAAA,EAElE,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK;AACpC,CAAC;AAaM,IAAM,qBAAA,GAAwB,EAAE,MAAA,CAAO;AAAA;AAAA,EAE5C,uBAAuB,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA;AAAA,EAElD,uBAAuB,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA;AAAA,EAElD,gBAAA,EAAkB,aAAa,QAAA,EAAS;AAAA;AAAA,EAExC,gBAAA,EAAkB,aAAa,QAAA,EAAS;AAAA;AAAA,EAExC,cAAA,EAAgB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAExC,WAAA,EAAa,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK;AACxC,CAAC;AAaD,IAAM,kBAAkB,CAAA,CAAE,MAAA,GAAS,MAAA,CAAO,CAAA,KAAA,KAAS,eAAe,IAAA,CAAK,KAAK,CAAA,IAAM,KAAA,CAAM,WAAW,GAAG,CAAA,IAAK,CAAC,KAAA,CAAM,UAAA,CAAW,IAAI,CAAE,CAAA;AAY5H,IAAM,kBAAA,GAAqB,EAAE,MAAA,CAAO;AAAA,EACzC,OAAA,EAAS,EAAE,IAAA,CAAK,CAAC,QAAQ,OAAO,CAAC,CAAA,CAAE,OAAA,CAAQ,MAAM,CAAA;AAAA,EACjD,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC9B,UAAA,EAAY,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAChC,SAAA,EAAW,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,OAAA,EAAS,gBAAgB,QAAA,EAAS;AAAA,EAClC,eAAA,EAAiB,gBAAgB,QAAA;AACnC,CAAC;AAwBM,IAAM,mBAAA,GAAsB,EAAE,MAAA,CAAO;AAAA;AAAA,EAE1C,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,EAAE,CAAA,CAAE,OAAA,CAAQ,KAAK,CAAA;AAAA;AAAA,EAE9C,aAAA,EAAe,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA;AAAA,EAExC,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAEjC,YAAA,EAAc,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA;AAAA,EAEvC,gBAAA,EAAkB,EAAE,IAAA,CAAK,CAAC,WAAW,QAAQ,CAAC,CAAA,CAAE,OAAA,CAAQ,SAAS,CAAA;AAAA;AAAA,EAEjE,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAK,CAAA,CAAE,QAAQ,CAAC,CAAA;AAAA;AAAA,EAEzD,cAAA,EAAgB,CAAA,CAAE,aAAA,CAAc,CAAA,CAAE,IAAA,CAAK,CAAC,KAAA,EAAO,KAAA,EAAO,SAAA,EAAW,KAAK,CAAC,CAAA,EAAG,CAAA,CAAE,QAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAK,CAAC,CAAA,CAAE,OAAA,CAAQ,EAAE,CAAA;AAAA;AAAA,EAExH,iBAAA,EAAmB,EAAE,IAAA,CAAK,CAAC,UAAU,SAAS,CAAC,CAAA,CAAE,OAAA,CAAQ,QAAQ,CAAA;AAAA;AAAA,EAEjE,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,OAAQ,CAAA,CAAE,QAAQ,CAAC,CAAA;AAAA;AAAA,EAE5D,eAAA,EAAiB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,OAAQ,CAAA,CAAE,QAAQ,CAAC,CAAA;AAAA;AAAA,EAEhE,kBAAA,EAAoB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,GAAA,CAAI,IAAI,CAAA,CAAE,OAAA,CAAQ,MAAM;AAC/D,CAAC;AAyBM,IAAM,gBAAA,GAAmB,EAAE,MAAA,CAAO;AAAA;AAAA,EAEvC,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA;AAAA,EAEjC,cAAA,EAAgB,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,aAAa,CAAA;AAAA;AAAA,EAEhD,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAQ,MAAM;AACxC,CAAC;AAoBM,IAAM,mBAAA,GAAsB,EAAE,MAAA,CAAO;AAAA;AAAA,EAE1C,gBAAA,EAAkB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,KAAK,CAAA,CAAE,QAAQ,CAAC,CAAA;AAAA;AAAA,EAE9D,mBAAA,EAAqB,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,EAAE,CAAA,CAAE,GAAA,CAAI,KAAK,CAAA,CAAE,QAAQ,IAAI;AACvE,CAAC;AAeM,IAAM,eAAA,GAAkB,EAAE,MAAA,CAAO;AAAA;AAAA,EAEtC,kBAAA,EAAoB,EAAE,MAAA,CAAO;AAAA;AAAA,IAE3B,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK;AAAA,GACnC,EAAE,QAAA,EAAS;AAAA;AAAA,EAEZ,gBAAA,EAAkB,EAAE,MAAA,CAAO;AAAA;AAAA,IAEzB,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA;AAAA,IAElC,UAAA,EAAY,EAAE,KAAA,CAAM,CAAA,CAAE,QAAO,CAAE,IAAA,GAAO,GAAA,CAAI,CAAC,EAAE,GAAA,CAAI,GAAG,CAAC,CAAA,CAAE,GAAA,CAAI,GAAI,CAAA,CAAE,OAAA,CAAQ,EAAE,CAAA;AAAA;AAAA,IAE3E,UAAA,EAAY,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAQ,GAAG;AAAA,GACzD,EAAE,QAAA,EAAS;AAAA;AAAA,EAEZ,WAAA,EAAa,wBAAwB,QAAA,EAAS;AAAA;AAAA,EAE9C,QAAA,EAAU,oBAAoB,QAAA,EAAS;AAAA;AAAA,EAEvC,EAAA,EAAI,mBAAmB,QAAA,EAAS;AAAA;AAAA;AAAA,EAIhC,QAAA,EAAU,qBAAqB,QAAA,EAAS;AAAA;AAAA,EAGxC,GAAA,EAAK,gBAAgB,QAAA,EAAS;AAAA;AAAA,EAG9B,IAAA,EAAM,iBAAiB,QAAA,EAAS;AAAA;AAAA,EAGhC,MAAA,EAAQ,mBAAmB,QAAA,EAAS;AAAA;AAAA,EAGpC,aAAA,EAAe,0BAA0B,QAAA,EAAS;AAAA;AAAA,EAGlD,KAAA,EAAO,kBAAkB,OAAA,CAAQ;AAAA,IAC/B,QAAA,EAAU,IAAA;AAAA,IACV,GAAA,EAAK,IAAA;AAAA,IACL,IAAA,EAAM,KAAA;AAAA,IACN,MAAA,EAAQ;AAAA,GACT,CAAA;AAAA;AAAA,EAGD,QAAA,EAAU,qBAAqB,OAAA,CAAQ;AAAA,IACrC,OAAA,EAAS,IAAA;AAAA,IACT,oBAAA,EAAsB;AAAA,GACvB,CAAA;AAAA;AAAA,EAGD,UAAA,EAAY,sBAAsB,OAAA,CAAQ;AAAA,IACxC,cAAA,EAAgB,IAAA;AAAA,IAChB,WAAA,EAAa;AAAA,GACd,CAAA;AAAA;AAAA,EAGD,OAAA,EAAS,oBAAoB,OAAA,CAAQ,MAAM,oBAAoB,KAAA,CAAM,EAAE,CAAC,CAAA;AAAA;AAAA,EAGxE,QAAA,EAAU,qBAAqB,OAAA,CAAQ;AAAA,IACrC,cAAA,EAAgB,IAAA;AAAA,IAChB,aAAA,EAAe,KAAA;AAAA,IACf,gBAAA,EAAkB,CAAA;AAAA,IAClB,eAAA,EAAiB;AAAA,GAClB,CAAA;AAAA;AAAA;AAAA,EAKD,OAAA,EAAS,oBAAoB,QAAA,EAAS;AAAA;AAAA;AAAA,EAKtC,IAAA,EAAM,iBAAiB,OAAA,CAAQ,MAAM,iBAAiB,KAAA,CAAM,EAAE,CAAC,CAAA;AAAA;AAAA;AAAA,EAK/D,eAAA,EAAiB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI;AAC3C,CAAC;ACtlBD,IAAM,YAAA,GAAe;AAAA,EACnB,WAAA,EAAa,SAAA;AAAA,EACb,mBAAA,EAAqB,SAAA;AAAA,EACrB,cAAA,EAAgB,SAAA;AAAA,EAChB,mBAAA,EAAqB,SAAA;AAAA,EACrB,WAAA,EAAa,SAAA;AAAA,EACb,mBAAA,EAAqB,SAAA;AAAA,EACrB,gBAAA,EAAkB,SAAA;AAAA,EAClB,yBAAA,EAA2B,SAAA;AAAA,EAC3B,WAAA,EAAa,SAAA;AAAA,EACb,eAAA,EAAiB,SAAA;AAAA,EACjB,mBAAA,EAAqB,SAAA;AAAA,EACrB,cAAA,EAAgB,SAAA;AAAA,EAChB,iBAAA,EAAmB,SAAA;AAAA,EACnB,sBAAA,EAAwB,SAAA;AAAA,EACxB,cAAA,EAAgB,SAAA;AAAA,EAChB,cAAA,EAAgB,SAAA;AAAA,EAChB,eAAA,EAAiB,SAAA;AAAA,EACjB,gBAAA,EAAkB,SAAA;AAAA,EAClB,mBAAA,EAAqB,SAAA;AAAA,EACrB,mBAAA,EAAqB,SAAA;AAAA,EACrB,wBAAA,EAA0B,SAAA;AAAA,EAC1B,WAAA,EAAa,SAAA;AAAA,EACb,aAAA,EAAe,SAAA;AAAA,EACf,uBAAA,EAAyB,SAAA;AAAA,EACzB,wBAAA,EAA0B,SAAA;AAAA,EAC1B,mBAAA,EAAqB,SAAA;AAAA,EACrB,yBAAA,EAA2B,SAAA;AAAA,EAC3B,2BAAA,EAA6B,SAAA;AAAA,EAC7B,mBAAA,EAAqB,SAAA;AAAA,EACrB,gBAAA,EAAkB,SAAA;AAAA,EAClB,eAAA,EAAiB,SAAA;AAAA,EACjB,gBAAA,EAAkB,SAAA;AAAA,EAClB,mBAAA,EAAqB,SAAA;AAAA,EACrB,0BAAA,EAA4B,SAAA;AAAA,EAE5B,iBAAA,EAAmB,SAAA;AAAA,EACnB,eAAA,EAAiB,SAAA;AAAA,EACjB,eAAA,EAAiB,SAAA;AAAA,EACjB,qBAAA,EAAuB,SAAA;AAAA,EACvB,aAAA,EAAe,SAAA;AAAA,EACf,aAAA,EAAe,SAAA;AAAA,EACf,oBAAA,EAAsB,SAAA;AAAA,EACtB,sBAAA,EAAwB,SAAA;AAAA,EAExB,iBAAA,EAAmB,SAAA;AAAA,EACnB,cAAA,EAAgB,SAAA;AAAA,EAChB,oBAAA,EAAsB,SAAA;AAAA,EACtB,mBAAA,EAAqB,SAAA;AAAA,EACrB,yBAAA,EAA2B,SAAA;AAAA,EAE3B,sBAAA,EAAwB,SAAA;AAAA,EACxB,gBAAA,EAAkB,SAAA;AAAA,EAClB,kBAAA,EAAoB,SAAA;AAAA,EAEpB,cAAA,EAAgB,SAAA;AAAA,EAChB,cAAA,EAAgB,SAAA;AAAA,EAChB,mBAAA,EAAqB,SAAA;AAAA,EAErB,gBAAA,EAAkB,SAAA;AAAA,EAClB,SAAA,EAAW,SAAA;AAAA,EACX,QAAA,EAAU,SAAA;AAAA,EAEV,SAAA,EAAW,SAAA;AAAA,EACX,gBAAA,EAAkB,SAAA;AAAA,EAElB,YAAA,EAAc,SAAA;AAAA,EACd,cAAA,EAAgB;AAClB,CAAA;AAaO,IAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,iBAAA,CAAkB,OAAO,YAAY","file":"chunk-PDPLBMGN.js","sourcesContent":["/**\n * @h-ai/iam — 配置 Schema\n *\n * 本文件定义 IAM 模块的配置结构，使用 Zod 进行运行时校验。\n * @module iam-config\n */\n\nimport { AccessConditionSchema } from '@h-ai/core'\nimport { z } from 'zod'\n\n/** 浏览器可访问链接仅接受 HTTP(S)，避免配置被用于脚本协议。 */\nconst WebUrlSchema = z.url().refine(value => ['http:', 'https:'].includes(new URL(value).protocol))\n\n// ─── 认证策略配置 ───\n\n/**\n * 认证策略类型\n *\n * 支持的认证方式：\n * - `password` - 用户名/邮箱 + 密码\n * - `otp` - 邮箱/短信 + 验证码\n * - `ldap` - LDAP 目录认证\n * - `apikey` - API Key 认证并按 scopes 收敛权限\n * @example\n * ```ts\n * import { AuthStrategyTypeSchema } from '@h-ai/iam'\n * const result = AuthStrategyTypeSchema.safeParse('password')\n * if (result.success) {\n * result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const AuthStrategyTypeSchema = z.enum(['password', 'otp', 'ldap', 'apikey'])\n\n/**\n * 认证策略类型\n * @example\n * ```ts\n * import { AuthStrategyTypeSchema, type AuthStrategyType } from '@h-ai/iam'\n * const value: AuthStrategyType = AuthStrategyTypeSchema.parse('password')\n * ```\n */\nexport type AuthStrategyType = z.infer<typeof AuthStrategyTypeSchema>\n\n/**\n * 密码配置 Schema\n * @example\n * ```ts\n * import { PasswordConfigSchema } from '@h-ai/iam'\n * const result = PasswordConfigSchema.safeParse({ minLength: 12, requireSpecialChar: true })\n * if (result.success) {\n * result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const PasswordConfigSchema = z.object({\n /** 新设密码的最少字符数；提高后只约束新建、重置和改密，不会反查已有密码的散列。 */\n minLength: z.number().int().min(1).default(8),\n /** 新设密码的最多字符数，须不小于 minLength；避免超长输入消耗鉴别资源。 */\n maxLength: z.number().int().min(1).max(256).default(128),\n /** 是否必须包含大写字母；与 minCharacterClasses 同时执行，false 仅取消这一项强制要求。 */\n requireUppercase: z.boolean().default(true),\n /** 是否必须包含小写字母；false 不代表取消长度或其他字符类别条件。 */\n requireLowercase: z.boolean().default(true),\n /** 是否必须包含数字；开启后所有服务端设密入口统一拒绝缺少数字的新密码。 */\n requireNumber: z.boolean().default(true),\n /** 是否必须包含特殊字符；开启会增加密码输入要求，不影响已经保存的密码散列。 */\n requireSpecialChar: z.boolean().default(false),\n /** 至少包含的字符类别数（大小写、数字、特殊字符），0 不额外限制。 */\n minCharacterClasses: z.number().int().min(0).max(4).default(0),\n /** 密码过期天数（0 表示不过期） */\n expirationDays: z.number().int().min(0).default(0),\n /** 拒绝新旧密码相同；启用口令期限或首次强改时也始终拒绝相同密码。 */\n preventSamePassword: z.boolean().default(false),\n /** 管理员创建或重置的初始密码必须先更换；不影响用户自行注册设密。 */\n requireInitialChange: z.boolean().default(false),\n}).refine(config => config.maxLength >= config.minLength, {\n message: 'maxLength must be >= minLength',\n path: ['maxLength'],\n})\n\n/**\n * 密码配置类型\n * @example\n * ```ts\n * import { PasswordConfigSchema, type PasswordConfig } from '@h-ai/iam'\n * const value: PasswordConfig = PasswordConfigSchema.parse({ minLength: 12, requireSpecialChar: true })\n * ```\n */\nexport type PasswordConfig = z.infer<typeof PasswordConfigSchema>\n\n/**\n * OTP 配置 Schema\n * @example\n * ```ts\n * import { OtpConfigSchema } from '@h-ai/iam'\n * const result = OtpConfigSchema.safeParse({ email: true, sms: false, length: 6 })\n * if (result.success) {\n * result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const OtpConfigSchema = z.object({\n /** 分别启用邮件、短信验证码 */\n email: z.boolean().default(true),\n sms: z.boolean().default(true),\n /** 验证码长度（默认 6） */\n length: z.number().int().min(4).max(8).default(6),\n /** 验证码过期时间（秒，默认 300） */\n expiresIn: z.number().int().min(60).default(300),\n /** 最大重试次数（默认 3） */\n maxAttempts: z.number().int().min(1).default(3),\n /** 发送间隔（秒，默认 60） */\n resendInterval: z.number().int().min(30).default(60),\n})\n\n/**\n * OTP 配置类型\n * @example\n * ```ts\n * import { OtpConfigSchema, type OtpConfig } from '@h-ai/iam'\n * const value: OtpConfig = OtpConfigSchema.parse({ email: true, sms: false, length: 6 })\n * ```\n */\nexport type OtpConfig = z.infer<typeof OtpConfigSchema>\n\n/**\n * 密码重置配置 Schema\n * @example\n * ```ts\n * import { PasswordResetConfigSchema } from '@h-ai/iam'\n * const result = PasswordResetConfigSchema.safeParse({ enabled: true, mode: 'email', resetUrl: 'https://app.example.com/reset-password' })\n * if (result.success) {\n * result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const PasswordResetConfigSchema = z.object({\n /** 重置通知渠道，phone 使用 password_reset_sms 模板。 */\n mode: z.enum(['email', 'phone']).default('email'),\n /** 重置页面的绝对地址，通知模板可使用 resetUrl。 */\n resetUrl: WebUrlSchema.optional(),\n /** 是否启用密码重置 */\n enabled: z.boolean().default(true),\n /** 重置令牌有效期（秒，默认 3600 = 1小时） */\n tokenExpiresIn: z.number().int().min(300).default(3600),\n /** 最大验证尝试次数（默认 3） */\n maxAttempts: z.number().int().min(1).default(3),\n})\n\n/**\n * 密码重置配置类型\n * @example\n * ```ts\n * import { PasswordResetConfigSchema, type PasswordResetConfig } from '@h-ai/iam'\n * const value: PasswordResetConfig = PasswordResetConfigSchema.parse({ enabled: true, mode: 'email', resetUrl: 'https://app.example.com/reset-password' })\n * ```\n */\nexport type PasswordResetConfig = z.infer<typeof PasswordResetConfigSchema>\n\n/**\n * LDAP 配置 Schema\n * @example\n * ```ts\n * import { LdapConfigSchema } from '@h-ai/iam'\n * const bindPassword = process.env.LDAP_BIND_PASSWORD\n * if (bindPassword) {\n * const result = LdapConfigSchema.safeParse({ url: 'ldaps://directory.example.com', bindDn: 'cn=service,dc=example,dc=com', bindPassword: bindPassword, searchBase: 'ou=users,dc=example,dc=com' })\n * if (result.success)\n * result.data.searchBase\n * }\n * ```\n */\nexport const LdapConfigSchema = z.object({\n /** LDAP 服务器 URL */\n url: z.url().refine(value => ['ldap:', 'ldaps:'].includes(new URL(value).protocol)),\n /** 绑定 DN */\n bindDn: z.string(),\n /** 绑定密码 */\n bindPassword: z.string(),\n /** 搜索基础 DN */\n searchBase: z.string(),\n /** 搜索过滤器（默认使用 uid） */\n searchFilter: z.string().default('(uid={{username}})'),\n /** 用户名属性 */\n usernameAttribute: z.string().default('uid'),\n /** 邮箱属性 */\n emailAttribute: z.string().default('mail'),\n /** 显示名称属性 */\n displayNameAttribute: z.string().default('cn'),\n /** 启用 TLS */\n useTls: z.boolean().default(false),\n /** 连接超时（毫秒） */\n connectTimeout: z.number().int().min(1000).default(5000),\n})\n\n/**\n * LDAP 配置类型\n * @example\n * ```ts\n * import { LdapConfigSchema, type LdapConfig } from '@h-ai/iam'\n * const bindPassword = process.env.LDAP_BIND_PASSWORD\n * if (bindPassword) {\n * const value: LdapConfig = LdapConfigSchema.parse({ url: 'ldaps://directory.example.com', bindDn: 'cn=service,dc=example,dc=com', bindPassword: bindPassword, searchBase: 'ou=users,dc=example,dc=com' })\n * value.url\n * }\n * ```\n */\nexport type LdapConfig = z.infer<typeof LdapConfigSchema>\n\n/**\n * API Key 配置 Schema\n * @example\n * ```ts\n * import { ApiKeyConfigSchema } from '@h-ai/iam'\n * const result = ApiKeyConfigSchema.safeParse({ maxKeysPerUser: 5, defaultExpirationDays: 30 })\n * if (result.success) {\n * result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const ApiKeyConfigSchema = z.object({\n /** 单用户最大 API Key 数量（默认 10） */\n maxKeysPerUser: z.number().int().min(1).default(10),\n /** API Key 默认有效期（天，0 表示永不过期，默认 0） */\n defaultExpirationDays: z.number().int().min(0).default(0),\n /** API Key 前缀（默认 'hai_'） */\n prefix: z.string().default('hai_'),\n})\n\n/**\n * API Key 配置类型\n * @example\n * ```ts\n * import { ApiKeyConfigSchema, type ApiKeyConfig } from '@h-ai/iam'\n * const value: ApiKeyConfig = ApiKeyConfigSchema.parse({ maxKeysPerUser: 5, defaultExpirationDays: 30 })\n * ```\n */\nexport type ApiKeyConfig = z.infer<typeof ApiKeyConfigSchema>\n\n// ─── 登录/注册与安全策略配置 ───\n\n/**\n * 登录类型启用配置\n * @example\n * ```ts\n * import { LoginConfigSchema } from '@h-ai/iam'\n * const result = LoginConfigSchema.safeParse({ password: true, otp: false })\n * if (result.success) {\n * result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const LoginConfigSchema = z.object({\n /** 是否启用密码登录 */\n password: z.boolean().default(true),\n /** 是否启用 OTP 登录 */\n otp: z.boolean().default(true),\n /** 是否启用 LDAP 登录；需要显式开启并提供 ldap 配置。 */\n ldap: z.boolean().default(false),\n /** 是否启用 API Key 登录 */\n apikey: z.boolean().default(false),\n})\n\n/**\n * 登录方式开关配置。\n * @example\n * ```ts\n * import { LoginConfigSchema, type LoginConfig } from '@h-ai/iam'\n * const value: LoginConfig = LoginConfigSchema.parse({ password: true, otp: false })\n * ```\n */\nexport type LoginConfig = z.infer<typeof LoginConfigSchema>\n\n/**\n * 注册配置\n * @example\n * ```ts\n * import { RegisterConfigSchema } from '@h-ai/iam'\n * const result = RegisterConfigSchema.safeParse({ enabled: false })\n * if (result.success) {\n * result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const RegisterConfigSchema = z.strictObject({\n /** 是否允许访客自助注册；关闭后隐藏注册入口并由服务端拒绝注册，不影响已有账号登录或管理员创建账号。 */\n enabled: z.boolean().default(true),\n /** 自助注册的初始生命周期；active 可登录，dormant 等待管理员激活；默认 active。 */\n defaultAccountStatus: z.enum(['active', 'dormant']).default('active'),\n})\n\n/**\n * 注册开关及新用户默认状态。\n * @example\n * ```ts\n * import { RegisterConfigSchema, type RegisterConfig } from '@h-ai/iam'\n * const value: RegisterConfig = RegisterConfigSchema.parse({ enabled: false })\n * ```\n */\nexport type RegisterConfig = z.infer<typeof RegisterConfigSchema>\n\n/**\n * 安全策略配置\n * @example\n * ```ts\n * import { SecurityConfigSchema } from '@h-ai/iam'\n * const result = SecurityConfigSchema.safeParse({ maxLoginAttempts: 5, lockoutDuration: 900 })\n * if (result.success) {\n * result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const SecurityConfigSchema = z.object({\n /** 是否累计失败并暂时锁定密码鉴别；关闭忽略历史锁，成功密码验证会重置计数。 */\n lockoutEnabled: z.boolean().default(true),\n /** 从首次失败开始的固定计数窗口，单位秒；86400 为24小时，不是滚动窗口。 */\n failureWindow: z.number().int().min(1).max(31536000).default(86400),\n /** 固定窗口内达到此失败次数后锁定密码鉴别；验证码失败等独立入口按各自策略处理。 */\n maxLoginAttempts: z.number().int().min(1).default(5),\n /** 达到失败阈值后禁止密码鉴别的秒数；至少60秒，1200表示20分钟，锁定期间正确密码也不能登录。 */\n lockoutDuration: z.number().int().min(60).default(900),\n})\n\n/**\n * 自托管 ALTCHA 计算挑战；默认关闭，强度与有效期由应用设置。\n * @example\n * ```ts\n * import { CaptchaConfigSchema } from '@h-ai/iam'\n * const config = CaptchaConfigSchema.parse({ enabled: true, ttlSeconds: 120 })\n * ```\n */\nexport const CaptchaConfigSchema = z.object({\n /** 是否在认证提交前校验自托管计算挑战；开启会有验证等待，关闭时不加载浏览器求解器。 */\n enabled: z.boolean().default(false),\n /** 挑战证明有效期，单位秒；到期或重复使用需重新计算，不是登录会话期限。 */\n ttlSeconds: z.number().int().min(1).max(600).default(120),\n /** 单次挑战的计算工作量；越高越难自动滥用，但低性能客户端等待也越久。 */\n cost: z.number().int().min(100).max(50000).default(5000),\n /** 求解随机计数范围；与 cost 共同决定客户端计算负担，不是密码失败次数。 */\n maxCounter: z.number().int().min(1).max(2000).default(100),\n})\n\n/**\n * 服务端账户失败计数与锁定策略。\n * @example\n * ```ts\n * import { SecurityConfigSchema, type SecurityConfig } from '@h-ai/iam'\n * const value: SecurityConfig = SecurityConfigSchema.parse({ maxLoginAttempts: 5, lockoutDuration: 900 })\n * ```\n */\nexport type SecurityConfig = z.infer<typeof SecurityConfigSchema>\n\n/**\n * 登录时段与地址策略；空地址/时段列表不限制对应维度。周一为1，周日为7。\n * @example\n * ```ts\n * import { LoginAccessConfigSchema } from '@h-ai/iam'\n * const policy = LoginAccessConfigSchema.parse({ enabled: true, allowIps: ['192.0.2.0/24'], timezone: 'Asia/Shanghai' })\n * ```\n */\nexport const LoginAccessConfigSchema = AccessConditionSchema.extend({\n /** 是否限制新建登录会话；已有会话的每次请求限制由 Serv/Kit 的 access 策略负责。 */\n enabled: z.boolean().default(false),\n})\n\n/**\n * 协议展示配置\n * @example\n * ```ts\n * import { AgreementConfigSchema } from '@h-ai/iam'\n * const result = AgreementConfigSchema.safeParse({ userAgreementUrl: 'https://app.example.com/terms', showOnRegister: true })\n * if (result.success) {\n * result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const AgreementConfigSchema = z.object({\n /** 用户协议 Markdown 正文；同时配置 URL 时优先显示正文。 */\n userAgreementMarkdown: z.string().min(1).optional(),\n /** 隐私协议 Markdown 正文；YAML 使用 | 保留段落和换行。 */\n privacyPolicyMarkdown: z.string().min(1).optional(),\n /** 用户协议 URL */\n userAgreementUrl: WebUrlSchema.optional(),\n /** 隐私协议 URL */\n privacyPolicyUrl: WebUrlSchema.optional(),\n /** 注册时展示协议 */\n showOnRegister: z.boolean().default(true),\n /** 登录时展示协议 */\n showOnLogin: z.boolean().default(false),\n})\n\n/**\n * 登录和注册的协议展示设置。\n * @example\n * ```ts\n * import { AgreementConfigSchema, type AgreementConfig } from '@h-ai/iam'\n * const value: AgreementConfig = AgreementConfigSchema.parse({ userAgreementUrl: 'https://app.example.com/terms', showOnRegister: true })\n * ```\n */\nexport type AgreementConfig = z.infer<typeof AgreementConfigSchema>\n\n/** 认证页面外观；文本由应用配置或 i18n 提供，图片只接受 HTTP(S) 或站内路径。 */\nconst AuthImageSchema = z.string().refine(value => /^https?:\\/\\//.test(value) || (value.startsWith('/') && !value.startsWith('//')))\n/**\n * 认证页面外观 Schema；图片仅接受 HTTP(S) 或站内路径，输出包含默认展示模式。\n * @example\n * ```ts\n * import { AuthUiConfigSchema } from '@h-ai/iam'\n * const result = AuthUiConfigSchema.safeParse({ variant: 'split', logoUrl: '/logo.svg' })\n * if (result.success) {\n * result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const AuthUiConfigSchema = z.object({\n variant: z.enum(['card', 'split']).default('card'),\n title: z.string().optional(),\n subtitle: z.string().optional(),\n brandTitle: z.string().optional(),\n brandText: z.string().optional(),\n logoUrl: AuthImageSchema.optional(),\n illustrationUrl: AuthImageSchema.optional(),\n})\n/**\n * 认证页外观设置；不包含服务端秘密。\n * @example\n * ```ts\n * import { AuthUiConfigSchema, type AuthUiConfig } from '@h-ai/iam'\n * const value: AuthUiConfig = AuthUiConfigSchema.parse({ variant: 'split', logoUrl: '/logo.svg' })\n * ```\n */\nexport type AuthUiConfig = z.infer<typeof AuthUiConfigSchema>\n\n// ─── 会话配置 ───\n\n/**\n * 会话配置 Schema\n * @example\n * ```ts\n * import { SessionConfigSchema } from '@h-ai/iam'\n * const result = SessionConfigSchema.safeParse({ maxAge: 3600, refreshTokenMaxAge: 604800 })\n * if (result.success) {\n * result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const SessionConfigSchema = z.object({\n /** 新会话的默认 access 时长（秒）；创建时可用 maxAge 覆盖，滑动/刷新沿用会话固有时长。 */\n maxAge: z.number().int().min(60).default(86400),\n /** 页面离开时尽力撤销会话；浏览器关闭不可保证，仍应配置服务端闲置/绝对期限。 */\n endOnPageHide: z.boolean().default(false),\n /** 是否滑动窗口（每次访问刷新过期时间） */\n sliding: z.boolean().default(true),\n /** 单设备登录（踢掉其他设备） */\n singleDevice: z.boolean().default(false),\n /** 单设备超限策略：replace 顶旧保新，reject 保留旧会话并拒绝新登录。 */\n singleDeviceMode: z.enum(['replace', 'reject']).default('replace'),\n /** 每个用户的最大有效会话数，0 不限制；包含 access 到期但仍可刷新的会话。 */\n maxSessions: z.number().int().min(0).max(10000).default(0),\n /** 各终端类型的最大会话数，例如 {web:2,app:1}；空对象关闭。启用后未列终端不能新登录，旧会话归为 web；仍受全局上限约束。 */\n terminalLimits: z.partialRecord(z.enum(['web', 'app', 'desktop', 'api']), z.number().int().min(1).max(10000)).default({}),\n /** 终端配额超限时 reject 拒绝新登录；replace 仅替换同类最早会话，不影响其他终端。 */\n terminalLimitMode: z.enum(['reject', 'replace']).default('reject'),\n /** 闲置期限（秒），0 关闭；真实访问记录活动，自动刷新不延长闲置；access/refresh 均执行。 */\n idleTimeout: z.number().int().min(0).max(31536000).default(0),\n /** 从首次登录起的绝对期限（秒），0 关闭；刷新不能重新起算。 */\n absoluteTimeout: z.number().int().min(0).max(31536000).default(0),\n /** refreshToken 独立有效期（秒，默认 604800 = 7天）；从签发时刻起算，access 到期仍可刷新。 */\n refreshTokenMaxAge: z.number().int().min(3600).default(604800),\n})\n\n/**\n * 会话配置类型\n * @example\n * ```ts\n * import { SessionConfigSchema, type SessionConfig } from '@h-ai/iam'\n * const value: SessionConfig = SessionConfigSchema.parse({ maxAge: 3600, refreshTokenMaxAge: 604800 })\n * ```\n */\nexport type SessionConfig = z.infer<typeof SessionConfigSchema>\n\n// ─── RBAC 配置 ───\n\n/**\n * RBAC 配置 Schema\n * @example\n * ```ts\n * import { RbacConfigSchema } from '@h-ai/iam'\n * const result = RbacConfigSchema.safeParse({ enabled: true, defaultRole: 'user' })\n * if (result.success) {\n * result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const RbacConfigSchema = z.object({\n /** 是否启用 RBAC */\n enabled: z.boolean().default(true),\n /** 超级管理员角色代码 */\n superAdminRole: z.string().default('super_admin'),\n /** 默认用户角色 */\n defaultRole: z.string().default('user'),\n})\n\n/**\n * RBAC 配置类型\n * @example\n * ```ts\n * import { RbacConfigSchema, type RbacConfig } from '@h-ai/iam'\n * const value: RbacConfig = RbacConfigSchema.parse({ enabled: true, defaultRole: 'user' })\n * ```\n */\nexport type RbacConfig = z.infer<typeof RbacConfigSchema>\n\n/**\n * 可选账号闲置扫描；0天关闭自动休眠，不影响明确设置的账号状态与到期时间。\n * @example\n * ```ts\n * import { AccountConfigSchema } from '@h-ai/iam'\n * const config = AccountConfigSchema.parse({ dormantAfterDays: 90, scanIntervalSeconds: 3600 })\n * ```\n */\nexport const AccountConfigSchema = z.object({\n /** 连续未成功登录多少天后休眠，0 关闭。未登录账号从创建时间起算。 */\n dormantAfterDays: z.number().int().min(0).max(36500).default(0),\n /** 自动扫描间隔（秒）；开启自动休眠时执行，默认每小时。 */\n scanIntervalSeconds: z.number().int().min(60).max(86400).default(3600),\n})\n\n// ─── 统一配置 ───\n\n/**\n * IAM 统一配置 Schema\n * @example\n * ```ts\n * import { IamConfigSchema } from '@h-ai/iam'\n * const result = IamConfigSchema.safeParse({ seedDefaultData: false, session: { maxAge: 3600 } })\n * if (result.success) {\n * result.data // 输出已应用 Schema 默认值。\n * }\n * ```\n */\nexport const IamConfigSchema = z.object({\n /** 管理端可用单次邀请代替共享初始密码；需要已配置的密码重置通知通道。 */\n initialCredentials: z.object({\n /** 是否通过一次性邀请设密；开启前配置密码重置入口、用户联系方式与真实通知通道，不显示共享初始密码。 */\n enabled: z.boolean().default(false),\n }).optional(),\n /** 指定敏感操作额外验证原密码；凭据短期且单次使用。 */\n reauthentication: z.object({\n /** 是否让已登录用户在敏感动作前弹窗验证当前密码；不创建另一个账号的登录，也不授予额外权限。 */\n enabled: z.boolean().default(false),\n /** 需要二次认证的操作 ID 清单，例如 iam.users.delete；两端须已接入同名守卫，仅添加名字不会保护自定义接口。 */\n operations: z.array(z.string().trim().min(1).max(128)).max(1000).default([]),\n /** 二次认证凭据的有效秒数；仅供当前用户/会话的指定操作单次使用，取消不发送敏感业务请求。 */\n ttlSeconds: z.number().int().min(1).max(900).default(300),\n }).optional(),\n /** 宿主提供可信客户端地址；绝不从凭据 JSON 或任意转发头取得 IP。 */\n loginAccess: LoginAccessConfigSchema.optional(),\n /** 账号自动休眠策略；未配置时不启动扫描。 */\n accounts: AccountConfigSchema.optional(),\n /** 认证页外观 */\n ui: AuthUiConfigSchema.optional(),\n // ─── 认证策略配置 ───\n\n /** 密码配置 */\n password: PasswordConfigSchema.optional(),\n\n /** OTP 配置 */\n otp: OtpConfigSchema.optional(),\n\n /** LDAP 配置 */\n ldap: LdapConfigSchema.optional(),\n\n /** API Key 配置 */\n apikey: ApiKeyConfigSchema.optional(),\n\n /** 密码重置配置 */\n passwordReset: PasswordResetConfigSchema.optional(),\n\n /** 登录启用配置 */\n login: LoginConfigSchema.default({\n password: true,\n otp: true,\n ldap: false,\n apikey: false,\n }),\n\n /** 注册配置 */\n register: RegisterConfigSchema.default({\n enabled: true,\n defaultAccountStatus: 'active',\n }),\n\n /** 协议展示配置 */\n agreements: AgreementConfigSchema.default({\n showOnRegister: true,\n showOnLogin: false,\n }),\n\n /** 可选的自托管交互挑战。 */\n captcha: CaptchaConfigSchema.default(() => CaptchaConfigSchema.parse({})),\n\n /** 安全策略配置 */\n security: SecurityConfigSchema.default({\n lockoutEnabled: true,\n failureWindow: 86400,\n maxLoginAttempts: 5,\n lockoutDuration: 900,\n }),\n\n // ─── 会话配置 ───\n\n /** 会话配置 */\n session: SessionConfigSchema.optional(),\n\n // ─── 授权配置 ───\n\n /** RBAC 配置 */\n rbac: RbacConfigSchema.default(() => RbacConfigSchema.parse({})),\n\n // ─── 运行时选项 ───\n\n /** 是否初始化默认角色和权限（默认 true） */\n seedDefaultData: z.boolean().default(true),\n})\n\n/**\n * IAM 配置类型\n * @example\n * ```ts\n * import { IamConfigSchema, type IamConfig } from '@h-ai/iam'\n * const value: IamConfig = IamConfigSchema.parse({ seedDefaultData: false, session: { maxAge: 3600 } })\n * ```\n */\nexport type IamConfig = z.infer<typeof IamConfigSchema>\n\n/**\n * IAM 配置设置输入类型（仅设置字段，不含运行时依赖）\n *\n * 说明：Zod 的 default 会让输入端字段可省略，但输出端字段为必填。\n * @example\n * ```ts\n * import type { IamConfigSettingsInput } from '@h-ai/iam'\n * const value: IamConfigSettingsInput = { session: { maxAge: 3600 }, seedDefaultData: false }\n * ```\n */\nexport type IamConfigSettingsInput = z.input<typeof IamConfigSchema>\n","/**\n * @h-ai/iam — 公共类型定义\n *\n * 包含：\n * - 错误类型（IamError）\n * - 函数接口（IamFunctions）\n * - 初始化配置（IamConfigInput）\n * - 子功能类型 re-export\n * @module iam-types\n */\n\nimport type { ErrorInfo, HaiResult } from '@h-ai/core'\n\nimport type { ReachFunctions } from '@h-ai/reach'\nimport type { ApiKeyOperations } from './authn/apikey/iam-authn-apikey-types.js'\nimport type { AuthnOperations } from './authn/iam-authn-types.js'\nimport type { LdapClientFactory } from './authn/ldap/iam-authn-ldap-strategy.js'\nimport type { AuthzOperations } from './authz/iam-authz-types.js'\nimport type { IamConfig, IamConfigSettingsInput } from './iam-config.js'\nimport type { IamPublicConfig } from './iam-public-config.js'\nimport type { SessionOperations } from './session/iam-session-types.js'\nimport type { TicketOperations } from './ticket/iam-ticket-types.js'\nimport type { User, UserOperations } from './user/iam-user-types.js'\nimport { core } from '@h-ai/core'\n\n// ─── 错误定义（照 @h-ai/core 范式） ───\n\nconst IamErrorInfo = {\n AUTH_FAILED: '001:401',\n INVALID_CREDENTIALS: '002:401',\n USER_NOT_FOUND: '003:404',\n ACCOUNT_UNAVAILABLE: '004:403',\n USER_LOCKED: '005:403',\n USER_ALREADY_EXISTS: '006:409',\n PASSWORD_EXPIRED: '007:401',\n PASSWORD_POLICY_VIOLATION: '008:400',\n OTP_INVALID: '009:400',\n NOT_INITIALIZED: '010:500',\n OTP_RESEND_TOO_FAST: '011:429',\n LOGIN_DISABLED: '012:400',\n REGISTER_DISABLED: '013:403',\n STRATEGY_NOT_SUPPORTED: '014:400',\n APIKEY_INVALID: '015:401',\n APIKEY_EXPIRED: '016:401',\n APIKEY_DISABLED: '017:403',\n APIKEY_NOT_FOUND: '018:404',\n RESET_TOKEN_INVALID: '019:400',\n RESET_TOKEN_EXPIRED: '020:400',\n RESET_TOKEN_MAX_ATTEMPTS: '021:429',\n OTP_EXPIRED: '022:400',\n SECURITY_BUSY: '023:429',\n PASSWORD_RESET_DISABLED: '024:403',\n PASSWORD_CHANGE_REQUIRED: '025:401',\n LOGIN_ACCESS_DENIED: '026:403',\n REAUTHENTICATION_REQUIRED: '027:401',\n INVITATION_DELIVERY_UNKNOWN: '028:502',\n INVITATION_DISABLED: '029:403',\n CAPTCHA_REQUIRED: '030:400',\n CAPTCHA_INVALID: '031:400',\n CAPTCHA_DISABLED: '032:403',\n CAPTCHA_UNAVAILABLE: '033:503',\n PASSWORD_REUSE_NOT_ALLOWED: '034:400',\n\n SESSION_NOT_FOUND: '101:401',\n SESSION_EXPIRED: '102:401',\n SESSION_INVALID: '103:401',\n SESSION_CREATE_FAILED: '104:500',\n TOKEN_EXPIRED: '105:401',\n TOKEN_INVALID: '106:401',\n TOKEN_REFRESH_FAILED: '107:401',\n SESSION_LIMIT_EXCEEDED: '108:409',\n\n PERMISSION_DENIED: '201:403',\n ROLE_NOT_FOUND: '202:404',\n PERMISSION_NOT_FOUND: '203:404',\n ROLE_ALREADY_EXISTS: '204:409',\n PERMISSION_ALREADY_EXISTS: '205:409',\n\n LDAP_CONNECTION_FAILED: '301:500',\n LDAP_BIND_FAILED: '302:401',\n LDAP_SEARCH_FAILED: '303:500',\n\n TICKET_INVALID: '110:401',\n TICKET_EXPIRED: '111:401',\n TICKET_ISSUE_FAILED: '112:500',\n\n REPOSITORY_ERROR: '401:500',\n NOT_FOUND: '402:404',\n CONFLICT: '403:409',\n\n FORBIDDEN: '501:403',\n INVALID_ARGUMENT: '502:400',\n\n CONFIG_ERROR: '901:500',\n INTERNAL_ERROR: '999:500',\n} as const satisfies ErrorInfo\n\n/**\n * IAM 错误码及 HTTP 状态定义；调用方按 code 分支，底层原因只用于脱敏诊断。\n * @example\n * ```ts\n * import { HaiIamError, iam } from '@h-ai/iam'\n * const result = await iam.auth.verifyToken('token-from-authorization-header')\n * if (!result.success && result.error.code === HaiIamError.SESSION_INVALID.code) {\n * // 由应用的认证边界转为重新登录响应，不泄露底层 cause。\n * }\n * ```\n */\nexport const HaiIamError = core.error.buildHaiErrorsDef('iam', IamErrorInfo)\n\n// ─── 初始化配置 ───\n\n/**\n * 已成功发布的认证通知上下文；发送服务必须按幂等键持久化去重。\n * 回调抛错代表送达结果未知；IAM 不自动重发，也不回滚已经发布的凭据。\n * @example\n * ```ts\n * import type { IamNotificationContext } from '@h-ai/iam'\n * async function deliver(context: IamNotificationContext, enqueue: (key: string, expiresAt: Date) => Promise<void>) {\n * // 接收端持久去重；回调失败代表送达未知，不能擅自生成新的幂等键重发。\n * await enqueue(context.idempotencyKey, context.expiresAt)\n * }\n * ```\n */\nexport interface IamNotificationContext {\n /** 同一次凭据发布的稳定 ID，不包含验证码或明文令牌。 */\n readonly idempotencyKey: string\n /** 凭据过期时间；迟到通知不得延长其有效期。 */\n readonly expiresAt: Date\n}\n\n/**\n * IAM 初始化配置\n *\n * 包含 Zod 校验的设置字段和运行时依赖。\n * 传入 `iam.init()` 的唯一参数。\n * @example\n * ```ts\n * import type { IamConfigInput } from '@h-ai/iam'\n * const value: IamConfigInput = { login: { password: true, otp: false }, register: { enabled: false }, seedDefaultData: false }\n * ```\n */\nexport interface IamConfigInput extends IamConfigSettingsInput {\n /**\n * 可选、已初始化的触达模块；由应用安装并注入，IAM 不导入或关闭该模块。\n * 自动使用 otp_email、otp_sms、password_reset、password_reset_sms 模板；显式发送回调优先。\n */\n reach?: ReachFunctions\n /** LDAP 客户端工厂（可选）；启用 LDAP 且未注入时才加载应用安装的 ldapts。 */\n ldapClientFactory?: LdapClientFactory\n /** LDAP 用户同步开关（默认 true） */\n ldapSyncUser?: boolean\n /**\n * 密码重置令牌回调（可选）\n *\n * 当用户请求密码重置时，框架生成令牌后通过此回调通知业务层，\n * 业务层负责将令牌通过邮件/短信等渠道发送给用户。\n * 也可传入已初始化的 reach 自动发送；两者均未配置时重置功能不可用。\n *\n * @param user - 请求重置的用户信息\n * @param token - 重置令牌（明文，需发送给用户）\n * @param context - 令牌有效期及接收端必须复用的幂等键；发送失败/超时视为结果未知。\n */\n onPasswordResetRequest?: (user: User, token: string, context: IamNotificationContext) => Promise<void>\n\n /**\n * OTP 邮件验证码发送回调（可选）\n *\n * 当用户请求 OTP 验证码时，框架生成验证码后通过此回调通知业务层，\n * 业务层负责将验证码通过邮件发送给用户。\n * 显式回调覆盖 Reach 的 otp_email 模板；两者均不可用时该登录入口关闭。\n * 投递失败须拒绝 Promise，异常由 IAM 转为业务结果，不要在回调中吞掉失败。\n *\n * @param email - 目标邮箱\n * @param code - 验证码\n */\n onOtpSendEmail?: (email: string, code: string, context: IamNotificationContext) => Promise<void>\n\n /**\n * OTP 短信验证码发送回调（可选）\n *\n * 当用户请求 OTP 验证码时，框架生成验证码后通过此回调通知业务层，\n * 业务层负责将验证码通过短信发送给用户。\n * 显式回调覆盖 Reach 的 otp_sms 模板；两者均不可用时该登录入口关闭。\n * 投递失败须拒绝 Promise，异常由 IAM 转为业务结果，不要在回调中吞掉失败。\n *\n * @param phone - 目标手机号\n * @param code - 验证码\n */\n onOtpSendSms?: (phone: string, code: string, context: IamNotificationContext) => Promise<void>\n}\n\n// ─── 函数接口 ───\n\n/**\n * IAM 函数接口\n *\n * 统一聚合所有 IAM 功能。\n * @example\n * ```ts\n * import { iam, type IamFunctions } from '@h-ai/iam'\n * const service: IamFunctions = iam\n * // 应用先初始化 Cache、RelDB、Crypto；关闭时先停止接收请求。\n * const initialized = await service.init({ seedDefaultData: false })\n * if (initialized.success) {\n * const users = await service.user.listUsers({ page: 1, pageSize: 20 })\n * if (!users.success)\n * users.error.code\n * await service.close() // IAM 不关闭应用注入的依赖。\n * }\n * ```\n */\nexport interface IamFunctions {\n /**\n * 初始化 IAM 服务\n *\n * 已初始化时先关闭旧内部状态再重新初始化；并发初始化返回配置错误。\n * 内部按依赖顺序创建 session → authz → authn → user 子功能，\n * 并可选执行种子数据初始化。\n *\n * @param config - IAM 初始化配置（可选 session/password/LDAP 等策略配置）\n * @returns 成功返回 `ok(undefined)`；失败返回含错误码的 `err`\n *\n * @example\n * ```ts\n * import { iam } from '@h-ai/iam'\n * // 共享 RelDB、Cache 已由应用初始化；IAM 会确保 Crypto 可用。\n * const result = await iam.init({ session: { maxAge: 86400 } })\n * if (!result.success)\n * result.error.code // 交给应用统一错误边界，不能继续接收认证请求。\n * ```\n */\n init: (config: IamConfigInput) => Promise<HaiResult<void>>\n\n /**\n * 关闭 IAM 服务\n *\n * 释放所有内部子功能引用，将模块恢复到未初始化状态。\n * 关闭后访问 `iam.auth` 等属性将返回未初始化错误。\n */\n close: () => Promise<void>\n\n /** 当前脱敏后的配置快照（未初始化时为 null） */\n readonly config: IamConfig | null\n /** 安全的文件配置快照；含数据库敏感规则的有效配置使用 getPublicConfig()。 */\n readonly publicConfig: IamPublicConfig | null\n /**\n * 读取包含文件与当前RBAC数据库敏感操作并集的公开配置；数据库读取失败返回失败。\n * @returns 独立公开快照；未初始化或启用策略时数据库故障返回 HaiResult 失败。\n * @example\n * ```ts\n * import { iam } from '@h-ai/iam'\n * const config = await iam.getPublicConfig()\n * if (config.success) config.data.reauthentication.operations\n * ```\n */\n getPublicConfig: () => Promise<HaiResult<IamPublicConfig>>\n /** 是否已初始化 */\n readonly isInitialized: boolean\n /** 注册功能是否启用（未初始化或未配置时默认启用） */\n readonly isRegisterEnabled: boolean\n /** 认证操作（登录、登出、令牌验证等） */\n readonly auth: AuthnOperations\n /** 用户管理（注册、查询、更新、密码管理等） */\n readonly user: UserOperations\n /** 授权管理（角色/权限 CRUD、用户角色分配、权限检查） */\n readonly authz: AuthzOperations\n /** 会话管理（创建、查询、验证、删除会话） */\n readonly session: SessionOperations\n /** API Key 管理（创建、列表、吊销、验证），未启用 apikey 登录时返回未初始化代理 */\n readonly apiKey: ApiKeyOperations\n /** 一次性能力票据（签发 / 原子消费短期票据，用于 WebSocket 等无法携带 Bearer Token 的通道） */\n readonly ticket: TicketOperations\n}\n\n// ─── 子功能类型 re-export ───\n\nexport type { ApiKey, ApiKeyOperations, ApiKeySortDirection, ApiKeySortField, CreateApiKeyOptions, CreateApiKeyResult, ListApiKeysOptions } from './authn/apikey/iam-authn-apikey-types.js'\nexport type { ApiKeyCredentials, AuthnOperations, AuthRequestContext, AuthStrategy, CaptchaOperation, Credentials, IamCaptchaChallenge, LdapCredentials, OtpCredentials, PasswordCredentials } from './authn/iam-authn-types.js'\nexport type { LdapClientFactory } from './authn/ldap/iam-authn-ldap-strategy.js'\nexport type { AuthzOperations, Permission, PermissionQueryOptions, PermissionType, Role } from './authz/iam-authz-types.js'\nexport type { IamPublicConfig } from './iam-public-config.js'\nexport type { AuthResult, CreateSessionOptions, Session, SessionData, SessionFieldUpdates, SessionOperations, TokenPair } from './session/iam-session-types.js'\nexport type { ConsumedTicket, ConsumeTicketOptions, IssuedTicket, IssueTicketOptions, TicketGrant, TicketOperations } from './ticket/iam-ticket-types.js'\nexport type { AgreementDisplay, ListUsersOptions, RegisterOptions, RegisterResult, StoredUser, UpdateCurrentUserInput, User, UserOperations, UserSortDirection, UserSortField } from './user/iam-user-types.js'\n"]}