@h-ai/serv 0.1.0-alpha.46 → 0.1.0-alpha.47

package/dist/features/iam.js

@@ -1,108 +1,49 @@
-import { requirePermission } from '../chunk-YQV2OMQK.js';
 import { mapHaiResult } from '../chunk-27PCPE37.js';
-import { servM, requireAuth } from '../chunk-4QBF4PUG.js';
+import { implement, servM } from '../chunk-KIWHKWLD.js';
 import { apiContract } from '@h-ai/api-contract';
 import { core, err, HaiCommonError, ok } from '@h-ai/core';
-import { implement } from '@orpc/server';
 
 var iamContract = apiContract.iam;
 var iamFeatureLogger = core.logger.child({ module: "serv", scope: "feature-iam" });
 function createIamProcedures(deps) {
-  const p = implement(iamContract).$context();
   const { iam } = deps;
-  return p.router({
-    auth: {
-      login: p.auth.login.handler(({ input }) => iam.auth.login(input)),
-      loginWithOtp: p.auth.loginWithOtp.handler(({ input }) => iam.auth.loginWithOtp(input)),
-      logout: p.auth.logout.handler(requireAuth(({ input, context }) => {
-        const token = input.accessToken ?? context.accessToken;
-        if (!token)
-          return Promise.resolve(err(HaiCommonError.UNAUTHORIZED, servM("serv_errorUnauthorized", { locale: context.locale })));
-        return iam.auth.logout(token);
-      })),
-      currentUser: p.auth.currentUser.handler(requireAuth(async ({ context }) => {
-        const token = context.accessToken;
-        if (!token)
-          return Promise.resolve(err(HaiCommonError.UNAUTHORIZED, servM("serv_errorUnauthorized", { locale: context.locale })));
-        return mapHaiResult(await iam.user.getCurrentUser(token), (user) => ({
-          ...user,
-          roles: context.session?.roles ?? [],
-          permissions: context.session?.permissions ?? []
-        }));
-      })),
-      refresh: p.auth.refresh.handler(async ({ input }) => {
-        return mapHaiResult(await iam.session.refresh(input.refreshToken), (tokens) => ({ tokens }));
-      }),
-      sendOtp: p.auth.sendOtp.handler(({ input }) => iam.auth.sendOtp(input.identifier)),
-      register: p.auth.register.handler(({ input }) => iam.auth.registerAndLogin(input)),
-      changePassword: p.auth.changePassword.handler(requireAuth(({ input, context }) => {
-        const token = context.accessToken;
-        if (!token)
-          return Promise.resolve(err(HaiCommonError.UNAUTHORIZED, servM("serv_errorUnauthorized", { locale: context.locale })));
-        return iam.user.changeCurrentUserPassword(token, input.oldPassword, input.newPassword);
-      })),
-      updateCurrentUser: p.auth.updateCurrentUser.handler(requireAuth(({ input, context }) => {
-        const token = context.accessToken;
-        if (!token)
-          return Promise.resolve(err(HaiCommonError.UNAUTHORIZED, servM("serv_errorUnauthorized", { locale: context.locale })));
-        return iam.user.updateCurrentUser(token, input);
-      }))
-    },
-    users: {
-      list: p.users.list.handler(requirePermission("iam.users.read", ({ input }) => {
-        return iam.user.listUsers(input);
-      })),
-      get: p.users.get.handler(requirePermission("iam.users.read", ({ input }) => {
-        return iam.user.getUser(input.id, { include: ["roles"] });
-      })),
-      create: p.users.create.handler(requirePermission("iam.users.write", ({ input }) => {
-        return createUser(iam, input);
-      })),
-      update: p.users.update.handler(requirePermission("iam.users.write", ({ input }) => {
-        return updateUser(iam, input);
-      })),
-      delete: p.users.delete.handler(requirePermission("iam.users.write", ({ input, context }) => {
-        if (context.session?.userId === input.id)
-          return Promise.resolve(err(HaiCommonError.FORBIDDEN, servM("serv_iamCannotDeleteCurrentUser", { locale: context.locale })));
-        return iam.user.deleteUser(input.id);
-      })),
-      resetPassword: p.users.resetPassword.handler(requirePermission("iam.users.write", ({ input }) => {
-        return iam.user.adminResetPassword(input.id, input.newPassword);
-      }))
-    },
-    roles: {
-      list: p.roles.list.handler(requirePermission("iam.roles.read", () => {
-        return iam.authz.getAllRoles();
-      })),
-      get: p.roles.get.handler(requirePermission("iam.roles.read", ({ input }) => {
-        return iam.authz.getRole(input.id);
-      })),
-      create: p.roles.create.handler(requirePermission("iam.roles.write", ({ input }) => {
-        return iam.authz.createRole(input);
-      })),
-      update: p.roles.update.handler(requirePermission("iam.roles.write", ({ input }) => {
-        const { id, ...data } = input;
-        return iam.authz.updateRole(id, data);
-      })),
-      delete: p.roles.delete.handler(requirePermission("iam.roles.write", ({ input }) => {
-        return iam.authz.deleteRole(input.id);
-      }))
-    },
-    permissions: {
-      list: p.permissions.list.handler(requirePermission("iam.permissions.read", ({ input }) => {
-        return iam.authz.getAllPermissions(input);
-      })),
-      get: p.permissions.get.handler(requirePermission("iam.permissions.read", ({ input }) => {
-        return iam.authz.getPermission(input.id);
-      })),
-      create: p.permissions.create.handler(requirePermission("iam.permissions.write", ({ input }) => {
-        return iam.authz.createPermission(input);
-      })),
-      delete: p.permissions.delete.handler(requirePermission("iam.permissions.write", ({ input }) => {
-        return iam.authz.deletePermission(input.id);
-      }))
-    }
-  });
+  return implement(iamContract).context().route("auth.login", ({ input }) => iam.auth.login(input)).route("auth.loginWithOtp", ({ input }) => iam.auth.loginWithOtp(input)).route("auth.logout").auth().handle(({ input, context }) => {
+    const token = input.accessToken ?? context.accessToken;
+    if (!token)
+      return err(HaiCommonError.UNAUTHORIZED, servM("serv_errorUnauthorized", { locale: context.locale }));
+    return iam.auth.logout(token);
+  }).route("auth.currentUser").auth().handle(async ({ context }) => {
+    const token = context.accessToken;
+    if (!token)
+      return err(HaiCommonError.UNAUTHORIZED, servM("serv_errorUnauthorized", { locale: context.locale }));
+    return mapHaiResult(
+      await iam.user.getCurrentUser(token),
+      (user) => ({
+        ...user,
+        roles: context.session.roles,
+        permissions: context.session.permissions
+      })
+    );
+  }).route("auth.refresh", async ({ input }) => {
+    return mapHaiResult(await iam.session.refresh(input.refreshToken), (tokens) => ({ tokens }));
+  }).route("auth.sendOtp", ({ input }) => iam.auth.sendOtp(input.identifier)).route("auth.register", ({ input }) => iam.auth.registerAndLogin(input)).route("auth.changePassword").auth().handle(({ input, context }) => {
+    const token = context.accessToken;
+    if (!token)
+      return err(HaiCommonError.UNAUTHORIZED, servM("serv_errorUnauthorized", { locale: context.locale }));
+    return iam.user.changeCurrentUserPassword(token, input.oldPassword, input.newPassword);
+  }).route("auth.updateCurrentUser").auth().handle(({ input, context }) => {
+    const token = context.accessToken;
+    if (!token)
+      return err(HaiCommonError.UNAUTHORIZED, servM("serv_errorUnauthorized", { locale: context.locale }));
+    return iam.user.updateCurrentUser(token, input);
+  }).route("users.list").permission("iam.users.read").handle(({ input }) => iam.user.listUsers(input)).route("users.get").permission("iam.users.read").handle(({ input }) => iam.user.getUser(input.id, { include: ["roles"] })).route("users.create").permission("iam.users.write").handle(({ input }) => createUser(iam, input)).route("users.update").permission("iam.users.write").handle(({ input }) => updateUser(iam, input)).route("users.delete").permission("iam.users.write").handle(({ input, context }) => {
+    if (context.session.userId === input.id)
+      return err(HaiCommonError.FORBIDDEN, servM("serv_iamCannotDeleteCurrentUser", { locale: context.locale }));
+    return iam.user.deleteUser(input.id);
+  }).route("users.resetPassword").permission("iam.users.write").handle(({ input }) => iam.user.adminResetPassword(input.id, input.newPassword)).route("roles.list").permission("iam.roles.read").handle(() => iam.authz.getAllRoles()).route("roles.get").permission("iam.roles.read").handle(({ input }) => iam.authz.getRole(input.id)).route("roles.create").permission("iam.roles.write").handle(({ input }) => iam.authz.createRole(input)).route("roles.update").permission("iam.roles.write").handle(({ input }) => {
+    const { id, ...data } = input;
+    return iam.authz.updateRole(id, data);
+  }).route("roles.delete").permission("iam.roles.write").handle(({ input }) => iam.authz.deleteRole(input.id)).route("permissions.list").permission("iam.permissions.read").handle(({ input }) => iam.authz.getAllPermissions(input)).route("permissions.get").permission("iam.permissions.read").handle(({ input }) => iam.authz.getPermission(input.id)).route("permissions.create").permission("iam.permissions.write").handle(({ input }) => iam.authz.createPermission(input)).route("permissions.delete").permission("iam.permissions.write").handle(({ input }) => iam.authz.deletePermission(input.id)).build();
 }
 async function createUser(iam, input) {
   const registerResult = await iam.user.register(input);

package/dist/features/iam.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/features/serv-feature-iam.ts"],"names":[],"mappings":";;;;;;;AAsCA,IAAM,cAAc,WAAA,CAAY,GAAA;AAEhC,IAAM,gBAAA,GAAmB,KAAK,MAAA,CAAO,KAAA,CAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,KAAA,EAAO,aAAA,EAAe,CAAA;AAQ5E,SAAS,oBAAoB,IAAA,EAAwB;AAC1D,EAAA,MAAM,CAAA,GAAI,SAAA,CAAU,WAAW,CAAA,CAAE,QAAA,EAAsB;AACvD,EAAA,MAAM,EAAE,KAAI,GAAI,IAAA;AAEhB,EAAA,OAAO,EAAE,MAAA,CAAO;AAAA,IACd,IAAA,EAAM;AAAA,MACJ,KAAA,EAAO,CAAA,CAAE,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,CAAC,EAAE,KAAA,EAAM,KAAgC,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA;AAAA,MAC1F,YAAA,EAAc,CAAA,CAAE,IAAA,CAAK,YAAA,CAAa,OAAA,CAAQ,CAAC,EAAE,KAAA,EAAM,KAAmC,GAAA,CAAI,IAAA,CAAK,YAAA,CAAa,KAAK,CAAC,CAAA;AAAA,MAClH,MAAA,EAAQ,CAAA,CAAE,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,YAAkC,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AAGtF,QAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,WAAA,IAAe,OAAA,CAAQ,WAAA;AAC3C,QAAA,IAAI,CAAC,KAAA;AACH,UAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAC,CAAA;AACtH,QAAA,OAAO,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,KAAK,CAAA;AAAA,MAC9B,CAAC,CAAC,CAAA;AAAA,MACF,WAAA,EAAa,EAAE,IAAA,CAAK,WAAA,CAAY,QAAQ,WAAA,CAAqC,OAAO,EAAE,OAAA,EAAQ,KAAM;AAClG,QAAA,MAAM,QAAQ,OAAA,CAAQ,WAAA;AACtB,QAAA,IAAI,CAAC,KAAA;AACH,UAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAC,CAAA;AACtH,QAAA,OAAO,aAAmC,MAAM,GAAA,CAAI,KAAK,cAAA,CAAe,KAAK,GAAG,CAAA,IAAA,MAAS;AAAA,UACvF,GAAG,IAAA;AAAA,UACH,KAAA,EAAO,OAAA,CAAQ,OAAA,EAAS,KAAA,IAAS,EAAC;AAAA,UAClC,WAAA,EAAa,OAAA,CAAQ,OAAA,EAAS,WAAA,IAAe;AAAC,SAChD,CAAE,CAAA;AAAA,MACJ,CAAC,CAAC,CAAA;AAAA,MACF,OAAA,EAAS,EAAE,IAAA,CAAK,OAAA,CAAQ,QAAQ,OAAO,EAAE,OAAM,KAA2C;AACxF,QAAA,OAAO,YAAA,CAAa,MAAM,GAAA,CAAI,OAAA,CAAQ,OAAA,CAAQ,KAAA,CAAM,YAAY,CAAA,EAAG,CAAA,MAAA,MAAW,EAAE,MAAA,EAAO,CAAE,CAAA;AAAA,MAC3F,CAAC,CAAA;AAAA,MACD,OAAA,EAAS,CAAA,CAAE,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAC,EAAE,KAAA,EAAM,KAAkC,GAAA,CAAI,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,UAAU,CAAC,CAAA;AAAA,MAC7G,QAAA,EAAU,CAAA,CAAE,IAAA,CAAK,QAAA,CAAS,OAAA,CAAQ,CAAC,EAAE,KAAA,EAAM,KAAmC,GAAA,CAAI,IAAA,CAAK,gBAAA,CAAiB,KAAK,CAAC,CAAA;AAAA,MAC9G,cAAA,EAAgB,CAAA,CAAE,IAAA,CAAK,cAAA,CAAe,OAAA,CAAQ,YAA0C,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AAC9G,QAAA,MAAM,QAAQ,OAAA,CAAQ,WAAA;AACtB,QAAA,IAAI,CAAC,KAAA;AACH,UAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAC,CAAA;AACtH,QAAA,OAAO,IAAI,IAAA,CAAK,yBAAA,CAA0B,OAAO,KAAA,CAAM,WAAA,EAAa,MAAM,WAAW,CAAA;AAAA,MACvF,CAAC,CAAC,CAAA;AAAA,MACF,iBAAA,EAAmB,CAAA,CAAE,IAAA,CAAK,iBAAA,CAAkB,OAAA,CAAQ,YAA6C,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AACvH,QAAA,MAAM,QAAQ,OAAA,CAAQ,WAAA;AACtB,QAAA,IAAI,CAAC,KAAA;AACH,UAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAC,CAAA;AACtH,QAAA,OAAO,GAAA,CAAI,IAAA,CAAK,iBAAA,CAAkB,KAAA,EAAO,KAAK,CAAA;AAAA,MAChD,CAAC,CAAC;AAAA,KACJ;AAAA,IACA,KAAA,EAAO;AAAA,MACL,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,kBAA4D,gBAAA,EAAkB,CAAC,EAAE,KAAA,EAAM,KAAM;AACtH,QAAA,OAAO,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AAAA,MACjC,CAAC,CAAC,CAAA;AAAA,MACF,GAAA,EAAK,CAAA,CAAE,KAAA,CAAM,GAAA,CAAI,OAAA,CAAQ,kBAA+C,gBAAA,EAAkB,CAAC,EAAE,KAAA,EAAM,KAAM;AACvG,QAAA,OAAO,GAAA,CAAI,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,EAAA,EAAI,EAAE,OAAA,EAAS,CAAC,OAAO,CAAA,EAAG,CAAA;AAAA,MAC1D,CAAC,CAAC,CAAA;AAAA,MACF,MAAA,EAAQ,CAAA,CAAE,KAAA,CAAM,MAAA,CAAO,OAAA,CAAQ,kBAAiD,iBAAA,EAAmB,CAAC,EAAE,KAAA,EAAM,KAAM;AAChH,QAAA,OAAO,UAAA,CAAW,KAAK,KAAK,CAAA;AAAA,MAC9B,CAAC,CAAC,CAAA;AAAA,MACF,MAAA,EAAQ,CAAA,CAAE,KAAA,CAAM,MAAA,CAAO,OAAA,CAAQ,kBAAiD,iBAAA,EAAmB,CAAC,EAAE,KAAA,EAAM,KAAM;AAChH,QAAA,OAAO,UAAA,CAAW,KAAK,KAAK,CAAA;AAAA,MAC9B,CAAC,CAAC,CAAA;AAAA,MACF,MAAA,EAAQ,CAAA,CAAE,KAAA,CAAM,MAAA,CAAO,OAAA,CAAQ,iBAAA,CAAwC,iBAAA,EAAmB,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AAEhH,QAAA,IAAI,OAAA,CAAQ,OAAA,EAAS,MAAA,KAAW,KAAA,CAAM,EAAA;AACpC,UAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,cAAA,CAAe,SAAA,EAAW,KAAA,CAAM,iCAAA,EAAmC,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAC,CAAA;AAC5H,QAAA,OAAO,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,KAAA,CAAM,EAAE,CAAA;AAAA,MACrC,CAAC,CAAC,CAAA;AAAA,MACF,aAAA,EAAe,CAAA,CAAE,KAAA,CAAM,aAAA,CAAc,OAAA,CAAQ,kBAAoD,iBAAA,EAAmB,CAAC,EAAE,KAAA,EAAM,KAAM;AACjI,QAAA,OAAO,IAAI,IAAA,CAAK,kBAAA,CAAmB,KAAA,CAAM,EAAA,EAAI,MAAM,WAAW,CAAA;AAAA,MAChE,CAAC,CAAC;AAAA,KACJ;AAAA,IACA,KAAA,EAAO;AAAA,MACL,MAAM,CAAA,CAAE,KAAA,CAAM,KAAK,OAAA,CAAQ,iBAAA,CAAkD,kBAAkB,MAAM;AACnG,QAAA,OAAO,GAAA,CAAI,MAAM,WAAA,EAAY;AAAA,MAC/B,CAAC,CAAC,CAAA;AAAA,MACF,GAAA,EAAK,CAAA,CAAE,KAAA,CAAM,GAAA,CAAI,OAAA,CAAQ,kBAA+C,gBAAA,EAAkB,CAAC,EAAE,KAAA,EAAM,KAAM;AACvG,QAAA,OAAO,GAAA,CAAI,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,EAAE,CAAA;AAAA,MACnC,CAAC,CAAC,CAAA;AAAA,MACF,MAAA,EAAQ,CAAA,CAAE,KAAA,CAAM,MAAA,CAAO,OAAA,CAAQ,kBAA4C,iBAAA,EAAmB,CAAC,EAAE,KAAA,EAAM,KAAM;AAC3G,QAAA,OAAO,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,KAAK,CAAA;AAAA,MACnC,CAAC,CAAC,CAAA;AAAA,MACF,MAAA,EAAQ,CAAA,CAAE,KAAA,CAAM,MAAA,CAAO,OAAA,CAAQ,kBAA4C,iBAAA,EAAmB,CAAC,EAAE,KAAA,EAAM,KAAM;AAC3G,QAAA,MAAM,EAAE,EAAA,EAAI,GAAG,IAAA,EAAK,GAAI,KAAA;AACxB,QAAA,OAAO,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,EAAA,EAAI,IAAI,CAAA;AAAA,MACtC,CAAC,CAAC,CAAA;AAAA,MACF,MAAA,EAAQ,CAAA,CAAE,KAAA,CAAM,MAAA,CAAO,OAAA,CAAQ,kBAAwC,iBAAA,EAAmB,CAAC,EAAE,KAAA,EAAM,KAAM;AACvG,QAAA,OAAO,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,KAAA,CAAM,EAAE,CAAA;AAAA,MACtC,CAAC,CAAC;AAAA,KACJ;AAAA,IACA,WAAA,EAAa;AAAA,MACX,IAAA,EAAM,CAAA,CAAE,WAAA,CAAY,IAAA,CAAK,OAAA,CAAQ,kBAAwE,sBAAA,EAAwB,CAAC,EAAE,KAAA,EAAM,KAAM;AAC9I,QAAA,OAAO,GAAA,CAAI,KAAA,CAAM,iBAAA,CAAkB,KAAK,CAAA;AAAA,MAC1C,CAAC,CAAC,CAAA;AAAA,MACF,GAAA,EAAK,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,OAAA,CAAQ,kBAAqD,sBAAA,EAAwB,CAAC,EAAE,KAAA,EAAM,KAAM;AACzH,QAAA,OAAO,GAAA,CAAI,KAAA,CAAM,aAAA,CAAc,KAAA,CAAM,EAAE,CAAA;AAAA,MACzC,CAAC,CAAC,CAAA;AAAA,MACF,MAAA,EAAQ,CAAA,CAAE,WAAA,CAAY,MAAA,CAAO,OAAA,CAAQ,kBAAwD,uBAAA,EAAyB,CAAC,EAAE,KAAA,EAAM,KAAM;AACnI,QAAA,OAAO,GAAA,CAAI,KAAA,CAAM,gBAAA,CAAiB,KAAK,CAAA;AAAA,MACzC,CAAC,CAAC,CAAA;AAAA,MACF,MAAA,EAAQ,CAAA,CAAE,WAAA,CAAY,MAAA,CAAO,OAAA,CAAQ,kBAAwC,uBAAA,EAAyB,CAAC,EAAE,KAAA,EAAM,KAAM;AACnH,QAAA,OAAO,GAAA,CAAI,KAAA,CAAM,gBAAA,CAAiB,KAAA,CAAM,EAAE,CAAA;AAAA,MAC5C,CAAC,CAAC;AAAA;AACJ,GACD,CAAA;AACH;AAEA,eAAe,UAAA,CAAW,KAAmB,KAAA,EAA0D;AACrG,EAAA,MAAM,cAAA,GAAiB,MAAM,GAAA,CAAI,IAAA,CAAK,SAAS,KAAK,CAAA;AACpD,EAAA,IAAI,CAAC,cAAA,CAAe,OAAA;AAClB,IAAA,OAAO,cAAA;AAET,EAAA,MAAM,MAAA,GAAS,cAAA,CAAe,IAAA,CAAK,IAAA,CAAK,EAAA;AAGxC,EAAA,eAAe,SAAS,MAAA,EAA+B;AACrD,IAAA,MAAM,YAAA,GAAe,MAAM,GAAA,CAAI,IAAA,CAAK,WAAW,MAAM,CAAA;AACrD,IAAA,IAAI,CAAC,YAAA,CAAa,OAAA;AAChB,MAAA,gBAAA,CAAiB,KAAA,CAAM,qDAAqD,EAAE,MAAA,EAAQ,QAAQ,KAAA,EAAO,YAAA,CAAa,OAAO,CAAA;AAAA,EAC7H;AAEA,EAAA,IAAI,KAAA,CAAM,SAAS,MAAA,EAAQ;AACzB,IAAA,MAAM,cAAc,MAAM,GAAA,CAAI,MAAM,SAAA,CAAU,MAAA,EAAQ,MAAM,OAAO,CAAA;AACnE,IAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AACxB,MAAA,MAAM,SAAS,kBAAkB,CAAA;AACjC,MAAA,OAAO,WAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,YAAY,KAAA,EAAO;AAC3B,IAAA,MAAM,YAAA,GAAe,MAAM,GAAA,CAAI,IAAA,CAAK,WAAW,MAAA,EAAQ,EAAE,OAAA,EAAS,KAAA,EAAO,CAAA;AACzE,IAAA,IAAI,CAAC,aAAa,OAAA,EAAS;AACzB,MAAA,MAAM,SAAS,wBAAwB,CAAA;AACvC,MAAA,OAAO,YAAA;AAAA,IACT;AACA,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,OAAO,EAAA,CAAG,cAAA,CAAe,IAAA,CAAK,IAAI,CAAA;AACpC;AAEA,eAAe,UAAA,CAAW,KAAmB,KAAA,EAA0D;AACrG,EAAA,MAAM,EAAE,EAAA,EAAI,OAAA,EAAS,GAAG,MAAK,GAAI,KAAA;AACjC,EAAA,MAAM,eAAe,MAAM,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,IAAI,IAAI,CAAA;AACvD,EAAA,IAAI,CAAC,YAAA,CAAa,OAAA;AAChB,IAAA,OAAO,YAAA;AAET,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,MAAM,cAAc,MAAM,GAAA,CAAI,KAAA,CAAM,SAAA,CAAU,IAAI,OAAO,CAAA;AACzD,IAAA,IAAI,CAAC,WAAA,CAAY,OAAA;AACf,MAAA,OAAO,WAAA;AAAA,EACX;AAEA,EAAA,OAAO,YAAA;AACT","file":"iam.js","sourcesContent":["/**\n * @h-ai/serv — IAM 默认 procedures\n *\n * 基于 `@h-ai/iam` 提供开箱即用的 IAM procedures 实现：认证、用户管理、角色权限 CRUD。\n * 通过 `createIamProcedures(deps)` 组装后直接挂载到 oRPC router。\n * @module features/serv-feature-iam\n */\n\nimport type {\n  IamAdminCreateUserInput,\n  IamAdminResetPasswordInput,\n  IamAdminUpdateUserInput,\n  IamChangePasswordInput,\n  IamCreatePermissionInput,\n  IamCreateRoleInput,\n  IamCurrentUser,\n  IamListPermissionsInput,\n  IamListUsersInput,\n  IamLoginInput,\n  IamLogoutInput,\n  IamOtpLoginInput,\n  IamRegisterInput,\n  IamSendOtpInput,\n  IamUpdateCurrentUserInput,\n  IamUpdateRoleInput,\n  IamUserIdInput,\n} from '@h-ai/api-contract'\nimport type { HaiResult, PaginatedResult } from '@h-ai/core'\nimport type { IamFunctions, Permission, Role, TokenPair, User } from '@h-ai/iam'\nimport type { ServContext } from '../serv-context.js'\nimport { apiContract } from '@h-ai/api-contract'\nimport { core, err, HaiCommonError, ok } from '@h-ai/core'\nimport { implement } from '@orpc/server'\nimport { requireAuth } from '../pipelines/serv-pipeline-require-auth.js'\nimport { requirePermission } from '../pipelines/serv-pipeline-require-permission.js'\nimport { servM } from '../serv-i18n.js'\nimport { mapHaiResult } from './serv-feature-helpers.js'\n\nconst iamContract = apiContract.iam\n\nconst iamFeatureLogger = core.logger.child({ module: 'serv', scope: 'feature-iam' })\n\n/** IAM 默认 procedures 依赖。 */\nexport interface IamProcedureDeps {\n  readonly iam: IamFunctions\n}\n\n/** 创建 IAM 默认 procedures。 */\nexport function createIamProcedures(deps: IamProcedureDeps) {\n  const p = implement(iamContract).$context<ServContext>()\n  const { iam } = deps\n\n  return p.router({\n    auth: {\n      login: p.auth.login.handler(({ input }: { input: IamLoginInput }) => iam.auth.login(input)),\n      loginWithOtp: p.auth.loginWithOtp.handler(({ input }: { input: IamOtpLoginInput }) => iam.auth.loginWithOtp(input)),\n      logout: p.auth.logout.handler(requireAuth<IamLogoutInput, void>(({ input, context }) => {\n        // 不再使用空字符串兜底：requireAuth 已确保 session 存在，但 accessToken 字段可能仍缺失\n        // （例如自定义 createContext 未填充）；此时显式返回 UNAUTHORIZED 而非把空 token 透传给 IAM。\n        const token = input.accessToken ?? context.accessToken\n        if (!token)\n          return Promise.resolve(err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale })))\n        return iam.auth.logout(token)\n      })),\n      currentUser: p.auth.currentUser.handler(requireAuth<unknown, IamCurrentUser>(async ({ context }) => {\n        const token = context.accessToken\n        if (!token)\n          return Promise.resolve(err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale })))\n        return mapHaiResult<User, IamCurrentUser>(await iam.user.getCurrentUser(token), user => ({\n          ...user,\n          roles: context.session?.roles ?? [],\n          permissions: context.session?.permissions ?? [],\n        }))\n      })),\n      refresh: p.auth.refresh.handler(async ({ input }: { input: { refreshToken: string } }) => {\n        return mapHaiResult(await iam.session.refresh(input.refreshToken), tokens => ({ tokens }))\n      }),\n      sendOtp: p.auth.sendOtp.handler(({ input }: { input: IamSendOtpInput }) => iam.auth.sendOtp(input.identifier)),\n      register: p.auth.register.handler(({ input }: { input: IamRegisterInput }) => iam.auth.registerAndLogin(input)),\n      changePassword: p.auth.changePassword.handler(requireAuth<IamChangePasswordInput, void>(({ input, context }) => {\n        const token = context.accessToken\n        if (!token)\n          return Promise.resolve(err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale })))\n        return iam.user.changeCurrentUserPassword(token, input.oldPassword, input.newPassword)\n      })),\n      updateCurrentUser: p.auth.updateCurrentUser.handler(requireAuth<IamUpdateCurrentUserInput, User>(({ input, context }) => {\n        const token = context.accessToken\n        if (!token)\n          return Promise.resolve(err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale })))\n        return iam.user.updateCurrentUser(token, input)\n      })),\n    },\n    users: {\n      list: p.users.list.handler(requirePermission<IamListUsersInput, PaginatedResult<User>>('iam.users.read', ({ input }) => {\n        return iam.user.listUsers(input)\n      })),\n      get: p.users.get.handler(requirePermission<IamUserIdInput, User | null>('iam.users.read', ({ input }) => {\n        return iam.user.getUser(input.id, { include: ['roles'] })\n      })),\n      create: p.users.create.handler(requirePermission<IamAdminCreateUserInput, User>('iam.users.write', ({ input }) => {\n        return createUser(iam, input)\n      })),\n      update: p.users.update.handler(requirePermission<IamAdminUpdateUserInput, User>('iam.users.write', ({ input }) => {\n        return updateUser(iam, input)\n      })),\n      delete: p.users.delete.handler(requirePermission<IamUserIdInput, void>('iam.users.write', ({ input, context }) => {\n        // 防止自删：避免管理员误删自己的账号导致授权锁死。\n        if (context.session?.userId === input.id)\n          return Promise.resolve(err(HaiCommonError.FORBIDDEN, servM('serv_iamCannotDeleteCurrentUser', { locale: context.locale })))\n        return iam.user.deleteUser(input.id)\n      })),\n      resetPassword: p.users.resetPassword.handler(requirePermission<IamAdminResetPasswordInput, void>('iam.users.write', ({ input }) => {\n        return iam.user.adminResetPassword(input.id, input.newPassword)\n      })),\n    },\n    roles: {\n      list: p.roles.list.handler(requirePermission<unknown, PaginatedResult<Role>>('iam.roles.read', () => {\n        return iam.authz.getAllRoles()\n      })),\n      get: p.roles.get.handler(requirePermission<IamUserIdInput, Role | null>('iam.roles.read', ({ input }) => {\n        return iam.authz.getRole(input.id)\n      })),\n      create: p.roles.create.handler(requirePermission<IamCreateRoleInput, Role>('iam.roles.write', ({ input }) => {\n        return iam.authz.createRole(input)\n      })),\n      update: p.roles.update.handler(requirePermission<IamUpdateRoleInput, Role>('iam.roles.write', ({ input }) => {\n        const { id, ...data } = input\n        return iam.authz.updateRole(id, data)\n      })),\n      delete: p.roles.delete.handler(requirePermission<IamUserIdInput, void>('iam.roles.write', ({ input }) => {\n        return iam.authz.deleteRole(input.id)\n      })),\n    },\n    permissions: {\n      list: p.permissions.list.handler(requirePermission<IamListPermissionsInput, PaginatedResult<Permission>>('iam.permissions.read', ({ input }) => {\n        return iam.authz.getAllPermissions(input)\n      })),\n      get: p.permissions.get.handler(requirePermission<IamUserIdInput, Permission | null>('iam.permissions.read', ({ input }) => {\n        return iam.authz.getPermission(input.id)\n      })),\n      create: p.permissions.create.handler(requirePermission<IamCreatePermissionInput, Permission>('iam.permissions.write', ({ input }) => {\n        return iam.authz.createPermission(input)\n      })),\n      delete: p.permissions.delete.handler(requirePermission<IamUserIdInput, void>('iam.permissions.write', ({ input }) => {\n        return iam.authz.deletePermission(input.id)\n      })),\n    },\n  })\n}\n\nasync function createUser(iam: IamFunctions, input: IamAdminCreateUserInput): Promise<HaiResult<User>> {\n  const registerResult = await iam.user.register(input)\n  if (!registerResult.success)\n    return registerResult\n\n  const userId = registerResult.data.user.id\n\n  // 任何后续步骤失败都需要回滚刚创建的用户，以避免重复用户名/邮箱错误阅存。\n  async function rollback(reason: string): Promise<void> {\n    const deleteResult = await iam.user.deleteUser(userId)\n    if (!deleteResult.success)\n      iamFeatureLogger.error('createUser rollback failed, orphan user may exist', { userId, reason, error: deleteResult.error })\n  }\n\n  if (input.roleIds?.length) {\n    const rolesResult = await iam.authz.syncRoles(userId, input.roleIds)\n    if (!rolesResult.success) {\n      await rollback('syncRoles failed')\n      return rolesResult\n    }\n  }\n\n  if (input.enabled === false) {\n    const updateResult = await iam.user.updateUser(userId, { enabled: false })\n    if (!updateResult.success) {\n      await rollback('initial disable failed')\n      return updateResult\n    }\n    return updateResult\n  }\n\n  return ok(registerResult.data.user)\n}\n\nasync function updateUser(iam: IamFunctions, input: IamAdminUpdateUserInput): Promise<HaiResult<User>> {\n  const { id, roleIds, ...data } = input\n  const updateResult = await iam.user.updateUser(id, data)\n  if (!updateResult.success)\n    return updateResult\n\n  if (roleIds) {\n    const rolesResult = await iam.authz.syncRoles(id, roleIds)\n    if (!rolesResult.success)\n      return rolesResult\n  }\n\n  return updateResult\n}\n\n// re-export 类型以便 IDE 跳转\nexport type { TokenPair }\n"]}
+{"version":3,"sources":["../../src/features/serv-feature-iam.ts"],"names":[],"mappings":";;;;;AAqBA,IAAM,cAAc,WAAA,CAAY,GAAA;AAEhC,IAAM,gBAAA,GAAmB,KAAK,MAAA,CAAO,KAAA,CAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,KAAA,EAAO,aAAA,EAAe,CAAA;AAQ5E,SAAS,oBAAoB,IAAA,EAAwB;AAC1D,EAAA,MAAM,EAAE,KAAI,GAAI,IAAA;AAEhB,EAAA,OAAO,UAAU,WAAW,CAAA,CACzB,OAAA,EAAqB,CAErB,MAAM,YAAA,EAAc,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,IAAA,CAAK,MAAM,KAAK,CAAC,EACxD,KAAA,CAAM,mBAAA,EAAqB,CAAC,EAAE,OAAM,KAAM,GAAA,CAAI,KAAK,YAAA,CAAa,KAAK,CAAC,CAAA,CAEtE,KAAA,CAAM,aAAa,CAAA,CACnB,MAAK,CACL,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,SAAQ,KAAM;AAC9B,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,WAAA,IAAe,OAAA,CAAQ,WAAA;AAC3C,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AACrG,IAAA,OAAO,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,KAAK,CAAA;AAAA,EAC9B,CAAC,CAAA,CAEA,KAAA,CAAM,kBAAkB,CAAA,CACxB,IAAA,EAAK,CACL,MAAA,CAAO,OAAO,EAAE,OAAA,EAAQ,KAAM;AAC7B,IAAA,MAAM,QAAQ,OAAA,CAAQ,WAAA;AACtB,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AAErG,IAAA,OAAO,YAAA;AAAA,MACL,MAAM,GAAA,CAAI,IAAA,CAAK,cAAA,CAAe,KAAK,CAAA;AAAA,MACnC,CAAA,IAAA,MAAS;AAAA,QACP,GAAG,IAAA;AAAA,QACH,KAAA,EAAO,QAAQ,OAAA,CAAQ,KAAA;AAAA,QACvB,WAAA,EAAa,QAAQ,OAAA,CAAQ;AAAA,OAC/B;AAAA,KACF;AAAA,EACF,CAAC,CAAA,CAEA,KAAA,CAAM,gBAAgB,OAAO,EAAE,OAAM,KAAM;AAC1C,IAAA,OAAO,YAAA,CAAa,MAAM,GAAA,CAAI,OAAA,CAAQ,OAAA,CAAQ,KAAA,CAAM,YAAY,CAAA,EAAG,CAAA,MAAA,MAAW,EAAE,MAAA,EAAO,CAAE,CAAA;AAAA,EAC3F,CAAC,CAAA,CACA,KAAA,CAAM,cAAA,EAAgB,CAAC,EAAE,KAAA,EAAM,KAAM,GAAA,CAAI,IAAA,CAAK,QAAQ,KAAA,CAAM,UAAU,CAAC,CAAA,CACvE,MAAM,eAAA,EAAiB,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,IAAA,CAAK,gBAAA,CAAiB,KAAK,CAAC,CAAA,CAEtE,KAAA,CAAM,qBAAqB,CAAA,CAC3B,MAAK,CACL,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,SAAQ,KAAM;AAC9B,IAAA,MAAM,QAAQ,OAAA,CAAQ,WAAA;AACtB,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AACrG,IAAA,OAAO,IAAI,IAAA,CAAK,yBAAA,CAA0B,OAAO,KAAA,CAAM,WAAA,EAAa,MAAM,WAAW,CAAA;AAAA,EACvF,CAAC,CAAA,CAEA,KAAA,CAAM,wBAAwB,CAAA,CAC9B,IAAA,EAAK,CACL,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AAC9B,IAAA,MAAM,QAAQ,OAAA,CAAQ,WAAA;AACtB,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AACrG,IAAA,OAAO,GAAA,CAAI,IAAA,CAAK,iBAAA,CAAkB,KAAA,EAAO,KAAK,CAAA;AAAA,EAChD,CAAC,CAAA,CAEA,KAAA,CAAM,YAAY,CAAA,CAClB,UAAA,CAAW,gBAAgB,CAAA,CAC3B,MAAA,CAAO,CAAC,EAAE,OAAM,KAAM,GAAA,CAAI,KAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAE/C,KAAA,CAAM,WAAW,CAAA,CACjB,WAAW,gBAAgB,CAAA,CAC3B,OAAO,CAAC,EAAE,OAAM,KAAM,GAAA,CAAI,KAAK,OAAA,CAAQ,KAAA,CAAM,IAAI,EAAE,OAAA,EAAS,CAAC,OAAO,CAAA,EAAG,CAAC,CAAA,CAExE,KAAA,CAAM,cAAc,EACpB,UAAA,CAAW,iBAAiB,EAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,UAAA,CAAW,GAAA,EAAK,KAAK,CAAC,CAAA,CAE5C,MAAM,cAAc,CAAA,CACpB,WAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,WAAW,GAAA,EAAK,KAAK,CAAC,CAAA,CAE5C,KAAA,CAAM,cAAc,CAAA,CACpB,UAAA,CAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,SAAQ,KAAM;AAE9B,IAAA,IAAI,OAAA,CAAQ,OAAA,CAAQ,MAAA,KAAW,KAAA,CAAM,EAAA;AACnC,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,SAAA,EAAW,KAAA,CAAM,iCAAA,EAAmC,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AAC3G,IAAA,OAAO,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,KAAA,CAAM,EAAE,CAAA;AAAA,EACrC,CAAC,CAAA,CAEA,KAAA,CAAM,qBAAqB,CAAA,CAC3B,WAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,IAAI,IAAA,CAAK,kBAAA,CAAmB,MAAM,EAAA,EAAI,KAAA,CAAM,WAAW,CAAC,EAE9E,KAAA,CAAM,YAAY,CAAA,CAClB,UAAA,CAAW,gBAAgB,CAAA,CAC3B,MAAA,CAAO,MAAM,GAAA,CAAI,MAAM,WAAA,EAAa,EAEpC,KAAA,CAAM,WAAW,EACjB,UAAA,CAAW,gBAAgB,CAAA,CAC3B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,GAAA,CAAI,MAAM,OAAA,CAAQ,KAAA,CAAM,EAAE,CAAC,EAEjD,KAAA,CAAM,cAAc,EACpB,UAAA,CAAW,iBAAiB,EAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,KAAK,CAAC,CAAA,CAEjD,KAAA,CAAM,cAAc,CAAA,CACpB,WAAW,iBAAiB,CAAA,CAC5B,OAAO,CAAC,EAAE,OAAM,KAAM;AACrB,IAAA,MAAM,EAAE,EAAA,EAAI,GAAG,IAAA,EAAK,GAAI,KAAA;AACxB,IAAA,OAAO,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,EAAA,EAAI,IAAI,CAAA;AAAA,EACtC,CAAC,CAAA,CAEA,KAAA,CAAM,cAAc,CAAA,CACpB,UAAA,CAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,KAAA,CAAM,WAAW,KAAA,CAAM,EAAE,CAAC,CAAA,CAEpD,KAAA,CAAM,kBAAkB,CAAA,CACxB,UAAA,CAAW,sBAAsB,CAAA,CACjC,MAAA,CAAO,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,KAAA,CAAM,kBAAkB,KAAK,CAAC,EAExD,KAAA,CAAM,iBAAiB,EACvB,UAAA,CAAW,sBAAsB,EACjC,MAAA,CAAO,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,KAAA,CAAM,cAAc,KAAA,CAAM,EAAE,CAAC,CAAA,CAEvD,KAAA,CAAM,oBAAoB,CAAA,CAC1B,UAAA,CAAW,uBAAuB,CAAA,CAClC,MAAA,CAAO,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,KAAA,CAAM,iBAAiB,KAAK,CAAC,EAEvD,KAAA,CAAM,oBAAoB,EAC1B,UAAA,CAAW,uBAAuB,EAClC,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,IAAI,KAAA,CAAM,gBAAA,CAAiB,MAAM,EAAE,CAAC,EAE1D,KAAA,EAAM;AACX;AAEA,eAAe,UAAA,CAAW,KAAmB,KAAA,EAA0D;AACrG,EAAA,MAAM,cAAA,GAAiB,MAAM,GAAA,CAAI,IAAA,CAAK,SAAS,KAAK,CAAA;AACpD,EAAA,IAAI,CAAC,cAAA,CAAe,OAAA;AAClB,IAAA,OAAO,cAAA;AAET,EAAA,MAAM,MAAA,GAAS,cAAA,CAAe,IAAA,CAAK,IAAA,CAAK,EAAA;AAGxC,EAAA,eAAe,SAAS,MAAA,EAA+B;AACrD,IAAA,MAAM,YAAA,GAAe,MAAM,GAAA,CAAI,IAAA,CAAK,WAAW,MAAM,CAAA;AACrD,IAAA,IAAI,CAAC,YAAA,CAAa,OAAA;AAChB,MAAA,gBAAA,CAAiB,KAAA,CAAM,qDAAqD,EAAE,MAAA,EAAQ,QAAQ,KAAA,EAAO,YAAA,CAAa,OAAO,CAAA;AAAA,EAC7H;AAEA,EAAA,IAAI,KAAA,CAAM,SAAS,MAAA,EAAQ;AACzB,IAAA,MAAM,cAAc,MAAM,GAAA,CAAI,MAAM,SAAA,CAAU,MAAA,EAAQ,MAAM,OAAO,CAAA;AACnE,IAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AACxB,MAAA,MAAM,SAAS,kBAAkB,CAAA;AACjC,MAAA,OAAO,WAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,YAAY,KAAA,EAAO;AAC3B,IAAA,MAAM,YAAA,GAAe,MAAM,GAAA,CAAI,IAAA,CAAK,WAAW,MAAA,EAAQ,EAAE,OAAA,EAAS,KAAA,EAAO,CAAA;AACzE,IAAA,IAAI,CAAC,aAAa,OAAA,EAAS;AACzB,MAAA,MAAM,SAAS,wBAAwB,CAAA;AACvC,MAAA,OAAO,YAAA;AAAA,IACT;AACA,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,OAAO,EAAA,CAAG,cAAA,CAAe,IAAA,CAAK,IAAI,CAAA;AACpC;AAEA,eAAe,UAAA,CAAW,KAAmB,KAAA,EAA0D;AACrG,EAAA,MAAM,EAAE,EAAA,EAAI,OAAA,EAAS,GAAG,MAAK,GAAI,KAAA;AACjC,EAAA,MAAM,eAAe,MAAM,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,IAAI,IAAI,CAAA;AACvD,EAAA,IAAI,CAAC,YAAA,CAAa,OAAA;AAChB,IAAA,OAAO,YAAA;AAET,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,MAAM,cAAc,MAAM,GAAA,CAAI,KAAA,CAAM,SAAA,CAAU,IAAI,OAAO,CAAA;AACzD,IAAA,IAAI,CAAC,WAAA,CAAY,OAAA;AACf,MAAA,OAAO,WAAA;AAAA,EACX;AAEA,EAAA,OAAO,YAAA;AACT","file":"iam.js","sourcesContent":["/**\n * @h-ai/serv — IAM 默认 procedures\n *\n * 基于 `@h-ai/iam` 提供开箱即用的 IAM procedures 实现：认证、用户管理、角色权限 CRUD。\n * @module features/serv-feature-iam\n */\n\nimport type {\n  IamAdminCreateUserInput,\n  IamAdminUpdateUserInput,\n  IamCurrentUser,\n} from '@h-ai/api-contract'\nimport type { HaiResult } from '@h-ai/core'\nimport type { IamFunctions, TokenPair, User } from '@h-ai/iam'\nimport type { ServContext } from '../serv-context.js'\nimport { apiContract } from '@h-ai/api-contract'\nimport { core, err, HaiCommonError, ok } from '@h-ai/core'\nimport { servM } from '../serv-i18n.js'\nimport { implement } from '../serv-router.js'\nimport { mapHaiResult } from './serv-feature-helpers.js'\n\nconst iamContract = apiContract.iam\n\nconst iamFeatureLogger = core.logger.child({ module: 'serv', scope: 'feature-iam' })\n\n/** IAM 默认 procedures 依赖。 */\nexport interface IamProcedureDeps {\n  readonly iam: IamFunctions\n}\n\n/** 创建 IAM 默认 procedures。 */\nexport function createIamProcedures(deps: IamProcedureDeps) {\n  const { iam } = deps\n\n  return implement(iamContract)\n    .context<ServContext>()\n\n    .route('auth.login', ({ input }) => iam.auth.login(input))\n    .route('auth.loginWithOtp', ({ input }) => iam.auth.loginWithOtp(input))\n\n    .route('auth.logout')\n    .auth()\n    .handle(({ input, context }) => {\n      const token = input.accessToken ?? context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n      return iam.auth.logout(token)\n    })\n\n    .route('auth.currentUser')\n    .auth()\n    .handle(async ({ context }) => {\n      const token = context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n\n      return mapHaiResult<User, IamCurrentUser>(\n        await iam.user.getCurrentUser(token),\n        user => ({\n          ...user,\n          roles: context.session.roles,\n          permissions: context.session.permissions,\n        }),\n      )\n    })\n\n    .route('auth.refresh', async ({ input }) => {\n      return mapHaiResult(await iam.session.refresh(input.refreshToken), tokens => ({ tokens }))\n    })\n    .route('auth.sendOtp', ({ input }) => iam.auth.sendOtp(input.identifier))\n    .route('auth.register', ({ input }) => iam.auth.registerAndLogin(input))\n\n    .route('auth.changePassword')\n    .auth()\n    .handle(({ input, context }) => {\n      const token = context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n      return iam.user.changeCurrentUserPassword(token, input.oldPassword, input.newPassword)\n    })\n\n    .route('auth.updateCurrentUser')\n    .auth()\n    .handle(({ input, context }) => {\n      const token = context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n      return iam.user.updateCurrentUser(token, input)\n    })\n\n    .route('users.list')\n    .permission('iam.users.read')\n    .handle(({ input }) => iam.user.listUsers(input))\n\n    .route('users.get')\n    .permission('iam.users.read')\n    .handle(({ input }) => iam.user.getUser(input.id, { include: ['roles'] }))\n\n    .route('users.create')\n    .permission('iam.users.write')\n    .handle(({ input }) => createUser(iam, input))\n\n    .route('users.update')\n    .permission('iam.users.write')\n    .handle(({ input }) => updateUser(iam, input))\n\n    .route('users.delete')\n    .permission('iam.users.write')\n    .handle(({ input, context }) => {\n      // 防止自删：避免管理员误删自己的账号导致授权锁死。\n      if (context.session.userId === input.id)\n        return err(HaiCommonError.FORBIDDEN, servM('serv_iamCannotDeleteCurrentUser', { locale: context.locale }))\n      return iam.user.deleteUser(input.id)\n    })\n\n    .route('users.resetPassword')\n    .permission('iam.users.write')\n    .handle(({ input }) => iam.user.adminResetPassword(input.id, input.newPassword))\n\n    .route('roles.list')\n    .permission('iam.roles.read')\n    .handle(() => iam.authz.getAllRoles())\n\n    .route('roles.get')\n    .permission('iam.roles.read')\n    .handle(({ input }) => iam.authz.getRole(input.id))\n\n    .route('roles.create')\n    .permission('iam.roles.write')\n    .handle(({ input }) => iam.authz.createRole(input))\n\n    .route('roles.update')\n    .permission('iam.roles.write')\n    .handle(({ input }) => {\n      const { id, ...data } = input\n      return iam.authz.updateRole(id, data)\n    })\n\n    .route('roles.delete')\n    .permission('iam.roles.write')\n    .handle(({ input }) => iam.authz.deleteRole(input.id))\n\n    .route('permissions.list')\n    .permission('iam.permissions.read')\n    .handle(({ input }) => iam.authz.getAllPermissions(input))\n\n    .route('permissions.get')\n    .permission('iam.permissions.read')\n    .handle(({ input }) => iam.authz.getPermission(input.id))\n\n    .route('permissions.create')\n    .permission('iam.permissions.write')\n    .handle(({ input }) => iam.authz.createPermission(input))\n\n    .route('permissions.delete')\n    .permission('iam.permissions.write')\n    .handle(({ input }) => iam.authz.deletePermission(input.id))\n\n    .build()\n}\n\nasync function createUser(iam: IamFunctions, input: IamAdminCreateUserInput): Promise<HaiResult<User>> {\n  const registerResult = await iam.user.register(input)\n  if (!registerResult.success)\n    return registerResult\n\n  const userId = registerResult.data.user.id\n\n  // 任何后续步骤失败都需要回滚刚创建的用户，以避免重复用户名/邮箱错误阅存。\n  async function rollback(reason: string): Promise<void> {\n    const deleteResult = await iam.user.deleteUser(userId)\n    if (!deleteResult.success)\n      iamFeatureLogger.error('createUser rollback failed, orphan user may exist', { userId, reason, error: deleteResult.error })\n  }\n\n  if (input.roleIds?.length) {\n    const rolesResult = await iam.authz.syncRoles(userId, input.roleIds)\n    if (!rolesResult.success) {\n      await rollback('syncRoles failed')\n      return rolesResult\n    }\n  }\n\n  if (input.enabled === false) {\n    const updateResult = await iam.user.updateUser(userId, { enabled: false })\n    if (!updateResult.success) {\n      await rollback('initial disable failed')\n      return updateResult\n    }\n    return updateResult\n  }\n\n  return ok(registerResult.data.user)\n}\n\nasync function updateUser(iam: IamFunctions, input: IamAdminUpdateUserInput): Promise<HaiResult<User>> {\n  const { id, roleIds, ...data } = input\n  const updateResult = await iam.user.updateUser(id, data)\n  if (!updateResult.success)\n    return updateResult\n\n  if (roleIds) {\n    const rolesResult = await iam.authz.syncRoles(id, roleIds)\n    if (!rolesResult.success)\n      return rolesResult\n  }\n\n  return updateResult\n}\n\n// re-export 类型以便 IDE 跳转\nexport type { TokenPair }\n"]}

package/dist/features/storage.d.ts

@@ -1,9 +1,8 @@
-import * as _orpc_contract from '@orpc/contract';
+import * as _orpc_server from '@orpc/server';
 import * as zod_v4_core from 'zod/v4/core';
 import * as zod from 'zod';
-import * as _orpc_server from '@orpc/server';
 import { StorageFunctions } from '@h-ai/storage';
-import { a as ServContext } from '../serv-context-BUrtWoFC.js';
+import { a as ServContext } from '../serv-context-jc3rZxbj.js';
 import '@h-ai/core';
 
 /** Storage 默认 procedures 依赖。 */
@@ -12,8 +11,8 @@ interface StorageProcedureDeps {
 }
 /** 创建 Storage 默认 procedures。 */
 declare function createStorageProcedures(deps: StorageProcedureDeps): {
-    presignedUrls: {
-        createDownload: _orpc_server.Procedure<_orpc_server.MergedInitialContext<ServContext & Record<never, never>, ServContext & Record<never, never>, ServContext>, ServContext, zod.ZodObject<{
+    presignedUrls: _orpc_server.Lazyable<{
+        createDownload: _orpc_server.Lazyable<_orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
             key: zod.ZodString;
             expiresIn: zod.ZodOptional<zod.ZodNumber>;
         }, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
@@ -35,8 +34,8 @@ declare function createStorageProcedures(deps: StorageProcedureDeps): {
                 suggestion: zod.ZodOptional<zod.ZodString>;
                 ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
             }, zod_v4_core.$strip>;
-        }, zod_v4_core.$strip>], "success">, _orpc_contract.MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
-        createUpload: _orpc_server.Procedure<_orpc_server.MergedInitialContext<ServContext & Record<never, never>, ServContext & Record<never, never>, ServContext>, ServContext, zod.ZodObject<{
+        }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>>;
+        createUpload: _orpc_server.Lazyable<_orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
             key: zod.ZodString;
             contentType: zod.ZodOptional<zod.ZodString>;
             contentLength: zod.ZodOptional<zod.ZodNumber>;
@@ -60,10 +59,10 @@ declare function createStorageProcedures(deps: StorageProcedureDeps): {
                 suggestion: zod.ZodOptional<zod.ZodString>;
                 ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
             }, zod_v4_core.$strip>;
-        }, zod_v4_core.$strip>], "success">, _orpc_contract.MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
-    };
-    files: {
-        list: _orpc_server.Procedure<_orpc_server.MergedInitialContext<ServContext & Record<never, never>, ServContext & Record<never, never>, ServContext>, ServContext, zod.ZodObject<{
+        }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>>;
+    }>;
+    files: _orpc_server.Lazyable<{
+        list: _orpc_server.Lazyable<_orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
             prefix: zod.ZodOptional<zod.ZodString>;
             maxKeys: zod.ZodOptional<zod.ZodCoercedNumber<unknown>>;
             continuationToken: zod.ZodOptional<zod.ZodString>;
@@ -95,8 +94,8 @@ declare function createStorageProcedures(deps: StorageProcedureDeps): {
                 suggestion: zod.ZodOptional<zod.ZodString>;
                 ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
             }, zod_v4_core.$strip>;
-        }, zod_v4_core.$strip>], "success">, _orpc_contract.MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
-        getMetadata: _orpc_server.Procedure<_orpc_server.MergedInitialContext<ServContext & Record<never, never>, ServContext & Record<never, never>, ServContext>, ServContext, zod.ZodObject<{
+        }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>>;
+        getMetadata: _orpc_server.Lazyable<_orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
             key: zod.ZodString;
         }, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
             success: zod.ZodLiteral<true>;
@@ -120,8 +119,8 @@ declare function createStorageProcedures(deps: StorageProcedureDeps): {
                 suggestion: zod.ZodOptional<zod.ZodString>;
                 ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
             }, zod_v4_core.$strip>;
-        }, zod_v4_core.$strip>], "success">, _orpc_contract.MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
-        delete: _orpc_server.Procedure<_orpc_server.MergedInitialContext<ServContext & Record<never, never>, ServContext & Record<never, never>, ServContext>, ServContext, zod.ZodObject<{
+        }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>>;
+        delete: _orpc_server.Lazyable<_orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
             key: zod.ZodString;
         }, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
             success: zod.ZodLiteral<true>;
@@ -138,8 +137,8 @@ declare function createStorageProcedures(deps: StorageProcedureDeps): {
                 suggestion: zod.ZodOptional<zod.ZodString>;
                 ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
             }, zod_v4_core.$strip>;
-        }, zod_v4_core.$strip>], "success">, _orpc_contract.MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
-        deleteMany: _orpc_server.Procedure<_orpc_server.MergedInitialContext<ServContext & Record<never, never>, ServContext & Record<never, never>, ServContext>, ServContext, zod.ZodObject<{
+        }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>>;
+        deleteMany: _orpc_server.Lazyable<_orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
             keys: zod.ZodArray<zod.ZodString>;
         }, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
             success: zod.ZodLiteral<true>;
@@ -156,8 +155,8 @@ declare function createStorageProcedures(deps: StorageProcedureDeps): {
                 suggestion: zod.ZodOptional<zod.ZodString>;
                 ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
             }, zod_v4_core.$strip>;
-        }, zod_v4_core.$strip>], "success">, _orpc_contract.MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
-    };
+        }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>>;
+    }>;
 };
 
 export { type StorageProcedureDeps, createStorageProcedures };

package/dist/features/storage.js

@@ -1,8 +1,7 @@
 import { mapHaiResult } from '../chunk-27PCPE37.js';
-import { requireAuth, servM } from '../chunk-4QBF4PUG.js';
+import { implement, servM } from '../chunk-KIWHKWLD.js';
 import { apiContract } from '@h-ai/api-contract';
 import { ok, err, HaiCommonError } from '@h-ai/core';
-import { implement } from '@orpc/server';
 
 var storageContract = apiContract.storage;
 var STORAGE_KEY_MAX_LENGTH = 1024;
@@ -37,49 +36,45 @@ function validateStorageKeysOrFail(keys, locale) {
   return ok(keys);
 }
 function createStorageProcedures(deps) {
-  const p = implement(storageContract).$context();
   const { storage } = deps;
-  return p.router({
-    presignedUrls: {
-      createDownload: p.presignedUrls.createDownload.handler(requireAuth(async ({ input, context }) => {
-        const keyResult = validateStorageKeyOrFail(input.key, context.locale);
-        if (!keyResult.success)
-          return keyResult;
-        const expiresIn = input.expiresIn ?? 900;
-        return toPresignedResult(keyResult.data, expiresIn, await storage.presign.getUrl(keyResult.data, { expiresIn }));
-      })),
-      createUpload: p.presignedUrls.createUpload.handler(requireAuth(async ({ input, context }) => {
-        const keyResult = validateStorageKeyOrFail(input.key, context.locale);
-        if (!keyResult.success)
-          return keyResult;
-        const expiresIn = input.expiresIn ?? 900;
-        const contentType = input.contentType ?? "application/octet-stream";
-        const { key: _, ...options } = input;
-        return toPresignedResult(keyResult.data, expiresIn, await storage.presign.putUrl(keyResult.data, { ...options, expiresIn, contentType }));
-      }))
-    },
-    files: {
-      list: p.files.list.handler(requireAuth(({ input }) => storage.dir.list(input))),
-      getMetadata: p.files.getMetadata.handler(requireAuth(({ input, context }) => {
-        const keyResult = validateStorageKeyOrFail(input.key, context.locale);
-        if (!keyResult.success)
-          return keyResult;
-        return storage.file.head(keyResult.data);
-      })),
-      delete: p.files.delete.handler(requireAuth(({ input, context }) => {
-        const keyResult = validateStorageKeyOrFail(input.key, context.locale);
-        if (!keyResult.success)
-          return keyResult;
-        return storage.file.delete(keyResult.data);
-      })),
-      deleteMany: p.files.deleteMany.handler(requireAuth(({ input, context }) => {
-        const keysResult = validateStorageKeysOrFail(input.keys, context.locale);
-        if (!keysResult.success)
-          return keysResult;
-        return storage.file.deleteMany(keysResult.data);
-      }))
-    }
-  });
+  return implement(storageContract).context().route("presignedUrls.createDownload").auth().handle(async ({ input, context }) => {
+    const keyResult = validateStorageKeyOrFail(input.key, context.locale);
+    if (!keyResult.success)
+      return keyResult;
+    const expiresIn = input.expiresIn ?? 900;
+    return toPresignedResult(
+      keyResult.data,
+      expiresIn,
+      await storage.presign.getUrl(keyResult.data, { expiresIn })
+    );
+  }).route("presignedUrls.createUpload").auth().handle(async ({ input, context }) => {
+    const keyResult = validateStorageKeyOrFail(input.key, context.locale);
+    if (!keyResult.success)
+      return keyResult;
+    const expiresIn = input.expiresIn ?? 900;
+    const contentType = input.contentType ?? "application/octet-stream";
+    const { key: _, ...options } = input;
+    return toPresignedResult(
+      keyResult.data,
+      expiresIn,
+      await storage.presign.putUrl(keyResult.data, { ...options, expiresIn, contentType })
+    );
+  }).route("files.list").auth().handle(({ input }) => storage.dir.list(input)).route("files.getMetadata").auth().handle(({ input, context }) => {
+    const keyResult = validateStorageKeyOrFail(input.key, context.locale);
+    if (!keyResult.success)
+      return keyResult;
+    return storage.file.head(keyResult.data);
+  }).route("files.delete").auth().handle(({ input, context }) => {
+    const keyResult = validateStorageKeyOrFail(input.key, context.locale);
+    if (!keyResult.success)
+      return keyResult;
+    return storage.file.delete(keyResult.data);
+  }).route("files.deleteMany").auth().handle(({ input, context }) => {
+    const keysResult = validateStorageKeysOrFail(input.keys, context.locale);
+    if (!keysResult.success)
+      return keysResult;
+    return storage.file.deleteMany(keysResult.data);
+  }).build();
 }
 function toPresignedResult(key, expiresIn, result) {
   return mapHaiResult(result, (url) => ({

package/dist/features/storage.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/features/serv-feature-storage.ts"],"names":[],"mappings":";;;;;;AAkCA,IAAM,kBAAkB,WAAA,CAAY,OAAA;AAEpC,IAAM,sBAAA,GAAyB,IAAA;AAE/B,SAAS,gCAAA,CACP,KAAA,EACA,MAAA,EACA,UAAA,EACA,MAAA,EACkB;AAClB,EAAA,MAAM,UAAU,KAAA,CAAM,UAAA,EAAY,EAAE,MAAA,EAAQ,QAAQ,CAAA;AACpD,EAAA,OAAO,GAAA;AAAA,IACL,cAAA,CAAe,gBAAA;AAAA,IACf,KAAA,CAAM,uBAAA,EAAyB,EAAE,MAAA,EAAQ,CAAA;AAAA,IACzC,CAAC,EAAE,KAAA,EAAO,OAAA,EAAS;AAAA,GACrB;AACF;AAQA,SAAS,wBAAA,CAAyB,GAAA,EAAa,MAAA,EAAgB,KAAA,GAAgB,KAAA,EAA0B;AACvG,EAAA,IAAI,GAAA,CAAI,MAAK,KAAM,EAAA;AACjB,IAAA,OAAO,gCAAA,CAAiC,KAAA,EAAO,MAAA,EAAQ,yBAAyB,CAAA;AAClF,EAAA,IAAI,GAAA,CAAI,SAAS,sBAAA,EAAwB;AACvC,IAAA,OAAO,gCAAA,CAAiC,KAAA,EAAO,MAAA,EAAQ,wBAAA,EAA0B;AAAA,MAC/E,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,EACH;AACA,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,GAAG,CAAA,IAAK,GAAA,CAAI,SAAS,IAAI,CAAA,IAAK,GAAA,CAAI,QAAA,CAAS,IAAI,CAAA;AAChE,IAAA,OAAO,gCAAA,CAAiC,KAAA,EAAO,MAAA,EAAQ,6BAA6B,CAAA;AACtF,EAAA,IAAI,GAAA,CAAI,MAAM,GAAG,CAAA,CAAE,KAAK,CAAA,GAAA,KAAO,GAAA,KAAQ,GAAA,IAAO,GAAA,KAAQ,IAAI,CAAA;AACxD,IAAA,OAAO,gCAAA,CAAiC,KAAA,EAAO,MAAA,EAAQ,4BAA4B,CAAA;AACrF,EAAA,OAAO,GAAG,GAAG,CAAA;AACf;AAEA,SAAS,yBAAA,CAA0B,MAAgB,MAAA,EAAqC;AACtF,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,GAAG,CAAA,IAAK,IAAA,CAAK,SAAQ,EAAG;AACzC,IAAA,MAAM,YAAY,wBAAA,CAAyB,GAAA,EAAK,MAAA,EAAQ,CAAA,KAAA,EAAQ,KAAK,CAAA,CAAE,CAAA;AACvE,IAAA,IAAI,CAAC,SAAA,CAAU,OAAA;AACb,MAAA,OAAO,SAAA;AAAA,EACX;AACA,EAAA,OAAO,GAAG,IAAI,CAAA;AAChB;AAcO,SAAS,wBAAwB,IAAA,EAA4B;AAClE,EAAA,MAAM,CAAA,GAAI,SAAA,CAAU,eAAe,CAAA,CAAE,QAAA,EAAsB;AAC3D,EAAA,MAAM,EAAE,SAAQ,GAAI,IAAA;AAEpB,EAAA,OAAO,EAAE,MAAA,CAAO;AAAA,IACd,aAAA,EAAe;AAAA,MACb,cAAA,EAAgB,CAAA,CAAE,aAAA,CAAc,cAAA,CAAe,OAAA,CAAQ,YAA4D,OAAO,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AAC/I,QAAA,MAAM,SAAA,GAAY,wBAAA,CAAyB,KAAA,CAAM,GAAA,EAAK,QAAQ,MAAM,CAAA;AACpE,QAAA,IAAI,CAAC,SAAA,CAAU,OAAA;AACb,UAAA,OAAO,SAAA;AACT,QAAA,MAAM,SAAA,GAAY,MAAM,SAAA,IAAa,GAAA;AACrC,QAAA,OAAO,iBAAA,CAAkB,SAAA,CAAU,IAAA,EAAM,SAAA,EAAW,MAAM,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,SAAA,CAAU,IAAA,EAAM,EAAE,SAAA,EAAW,CAAC,CAAA;AAAA,MACjH,CAAC,CAAC,CAAA;AAAA,MACF,YAAA,EAAc,CAAA,CAAE,aAAA,CAAc,YAAA,CAAa,OAAA,CAAQ,YAA0D,OAAO,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AACzI,QAAA,MAAM,SAAA,GAAY,wBAAA,CAAyB,KAAA,CAAM,GAAA,EAAK,QAAQ,MAAM,CAAA;AACpE,QAAA,IAAI,CAAC,SAAA,CAAU,OAAA;AACb,UAAA,OAAO,SAAA;AACT,QAAA,MAAM,SAAA,GAAY,MAAM,SAAA,IAAa,GAAA;AACrC,QAAA,MAAM,WAAA,GAAc,MAAM,WAAA,IAAe,0BAAA;AACzC,QAAA,MAAM,EAAE,GAAA,EAAK,CAAA,EAAG,GAAG,SAAQ,GAAI,KAAA;AAC/B,QAAA,OAAO,kBAAkB,SAAA,CAAU,IAAA,EAAM,SAAA,EAAW,MAAM,QAAQ,OAAA,CAAQ,MAAA,CAAO,SAAA,CAAU,IAAA,EAAM,EAAE,GAAG,OAAA,EAAS,SAAA,EAAW,WAAA,EAAa,CAAC,CAAA;AAAA,MAC1I,CAAC,CAAC;AAAA,KACJ;AAAA,IACA,KAAA,EAAO;AAAA,MACL,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,IAAA,CAAK,QAAQ,WAAA,CAA+C,CAAC,EAAE,KAAA,OAAY,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,KAAK,CAAC,CAAC,CAAA;AAAA,MACjH,WAAA,EAAa,CAAA,CAAE,KAAA,CAAM,WAAA,CAAY,OAAA,CAAQ,YAA+C,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AAC9G,QAAA,MAAM,SAAA,GAAY,wBAAA,CAAyB,KAAA,CAAM,GAAA,EAAK,QAAQ,MAAM,CAAA;AACpE,QAAA,IAAI,CAAC,SAAA,CAAU,OAAA;AACb,UAAA,OAAO,SAAA;AACT,QAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAAA,MACzC,CAAC,CAAC,CAAA;AAAA,MACF,MAAA,EAAQ,CAAA,CAAE,KAAA,CAAM,MAAA,CAAO,OAAA,CAAQ,YAAuC,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AAC5F,QAAA,MAAM,SAAA,GAAY,wBAAA,CAAyB,KAAA,CAAM,GAAA,EAAK,QAAQ,MAAM,CAAA;AACpE,QAAA,IAAI,CAAC,SAAA,CAAU,OAAA;AACb,UAAA,OAAO,SAAA;AACT,QAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,IAAI,CAAA;AAAA,MAC3C,CAAC,CAAC,CAAA;AAAA,MACF,UAAA,EAAY,CAAA,CAAE,KAAA,CAAM,UAAA,CAAW,OAAA,CAAQ,YAA2C,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AACxG,QAAA,MAAM,UAAA,GAAa,yBAAA,CAA0B,KAAA,CAAM,IAAA,EAAM,QAAQ,MAAM,CAAA;AACvE,QAAA,IAAI,CAAC,UAAA,CAAW,OAAA;AACd,UAAA,OAAO,UAAA;AACT,QAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,UAAA,CAAW,UAAA,CAAW,IAAI,CAAA;AAAA,MAChD,CAAC,CAAC;AAAA;AACJ,GACD,CAAA;AACH;AAEA,SAAS,iBAAA,CAAkB,GAAA,EAAa,SAAA,EAA+B,MAAA,EAAyD;AAC9H,EAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,GAAA,MAAQ;AAAA,IAClC,GAAA;AAAA,IACA,GAAA;AAAA,IACA,SAAA,EAAW,YAAY,IAAI,IAAA,CAAK,KAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAI,CAAA,GAAI;AAAA,GACnE,CAAE,CAAA;AACJ","file":"storage.js","sourcesContent":["/**\n * @h-ai/serv — Storage 默认 procedures\n *\n * 基于 `@h-ai/storage` 提供开箱即用的 Storage procedures 实现：预签名 URL、列表、元数据、删除。\n * 通过 `createStorageProcedures(deps)` 组装后直接挂载到 oRPC router。\n *\n * **⚠️ 安全说明（必读）：**\n *\n * 1. **路径穿越防护**：内置 `validateStorageKey` 拒绝 `..`、绝对路径、反斜杠、NUL 字节等危险输入。\n * 2. **多租户 / 多用户隔离（需应用层实现）**：默认 procedure 仅做 `requireAuth`，**任何登录用户均可访问任意 key**。\n *    生产环境必须在外层重新装配这些 procedure，以强制用 `context.session.userId` 作为 key 前缀，例如：\n *    `users/${context.session.userId}/...`，并拒绝跳出该前缀的访问。\n * 3. **权限收紧**：推荐用 `serv.requirePermission('storage.files.read'|'storage.files.write')` 替换 `requireAuth`。\n * @module features/serv-feature-storage\n */\n\nimport type {\n  StorageDeleteFilesInput,\n  StorageFileKeyInput,\n  StorageListFilesInput,\n  StoragePresignDownloadInput,\n  StoragePresignUploadInput,\n} from '@h-ai/api-contract'\nimport type { HaiResult } from '@h-ai/core'\nimport type { FileMetadata, ListResult, StorageFunctions } from '@h-ai/storage'\nimport type { ServContext } from '../serv-context.js'\nimport type { ServMessageKey } from '../serv-i18n.js'\nimport { apiContract } from '@h-ai/api-contract'\nimport { err, HaiCommonError, ok } from '@h-ai/core'\nimport { implement } from '@orpc/server'\nimport { requireAuth } from '../pipelines/serv-pipeline-require-auth.js'\nimport { servM } from '../serv-i18n.js'\nimport { mapHaiResult } from './serv-feature-helpers.js'\n\nconst storageContract = apiContract.storage\n\nconst STORAGE_KEY_MAX_LENGTH = 1024\n\nfunction buildStorageKeyValidationFailure(\n  field: string,\n  locale: string,\n  messageKey: ServMessageKey,\n  params?: Record<string, string | number>,\n): HaiResult<never> {\n  const message = servM(messageKey, { locale, params })\n  return err(\n    HaiCommonError.VALIDATION_ERROR,\n    servM('serv_validationFailed', { locale }),\n    [{ field, message }],\n  )\n}\n\n/**\n * 对业务层再次校验存储 key 是否安全。\n *\n * 这里不额外构造 Zod schema，而是直接按业务规则返回统一的\n * `HaiResult + ValidationFormError[]` 形态，避免把简单路径安全规则包装得过重。\n */\nfunction validateStorageKeyOrFail(key: string, locale: string, field: string = 'key'): HaiResult<string> {\n  if (key.trim() === '')\n    return buildStorageKeyValidationFailure(field, locale, 'serv_storageKeyRequired')\n  if (key.length > STORAGE_KEY_MAX_LENGTH) {\n    return buildStorageKeyValidationFailure(field, locale, 'serv_storageKeyTooLong', {\n      max: STORAGE_KEY_MAX_LENGTH,\n    })\n  }\n  if (key.startsWith('/') || key.includes('\\\\') || key.includes('\\0'))\n    return buildStorageKeyValidationFailure(field, locale, 'serv_storageKeyIllegalChars')\n  if (key.split('/').some(seg => seg === '.' || seg === '..'))\n    return buildStorageKeyValidationFailure(field, locale, 'serv_storageKeyDotSegments')\n  return ok(key)\n}\n\nfunction validateStorageKeysOrFail(keys: string[], locale: string): HaiResult<string[]> {\n  for (const [index, key] of keys.entries()) {\n    const keyResult = validateStorageKeyOrFail(key, locale, `keys.${index}`)\n    if (!keyResult.success)\n      return keyResult\n  }\n  return ok(keys)\n}\n\n/** Storage 默认 procedures 依赖。 */\nexport interface StorageProcedureDeps {\n  readonly storage: StorageFunctions\n}\n\ninterface PresignedResponse {\n  readonly url: string\n  readonly key: string\n  readonly expiresAt?: Date\n}\n\n/** 创建 Storage 默认 procedures。 */\nexport function createStorageProcedures(deps: StorageProcedureDeps) {\n  const p = implement(storageContract).$context<ServContext>()\n  const { storage } = deps\n\n  return p.router({\n    presignedUrls: {\n      createDownload: p.presignedUrls.createDownload.handler(requireAuth<StoragePresignDownloadInput, PresignedResponse>(async ({ input, context }) => {\n        const keyResult = validateStorageKeyOrFail(input.key, context.locale)\n        if (!keyResult.success)\n          return keyResult\n        const expiresIn = input.expiresIn ?? 900\n        return toPresignedResult(keyResult.data, expiresIn, await storage.presign.getUrl(keyResult.data, { expiresIn }))\n      })),\n      createUpload: p.presignedUrls.createUpload.handler(requireAuth<StoragePresignUploadInput, PresignedResponse>(async ({ input, context }) => {\n        const keyResult = validateStorageKeyOrFail(input.key, context.locale)\n        if (!keyResult.success)\n          return keyResult\n        const expiresIn = input.expiresIn ?? 900\n        const contentType = input.contentType ?? 'application/octet-stream'\n        const { key: _, ...options } = input\n        return toPresignedResult(keyResult.data, expiresIn, await storage.presign.putUrl(keyResult.data, { ...options, expiresIn, contentType }))\n      })),\n    },\n    files: {\n      list: p.files.list.handler(requireAuth<StorageListFilesInput, ListResult>(({ input }) => storage.dir.list(input))),\n      getMetadata: p.files.getMetadata.handler(requireAuth<StorageFileKeyInput, FileMetadata>(({ input, context }) => {\n        const keyResult = validateStorageKeyOrFail(input.key, context.locale)\n        if (!keyResult.success)\n          return keyResult\n        return storage.file.head(keyResult.data)\n      })),\n      delete: p.files.delete.handler(requireAuth<StorageFileKeyInput, void>(({ input, context }) => {\n        const keyResult = validateStorageKeyOrFail(input.key, context.locale)\n        if (!keyResult.success)\n          return keyResult\n        return storage.file.delete(keyResult.data)\n      })),\n      deleteMany: p.files.deleteMany.handler(requireAuth<StorageDeleteFilesInput, void>(({ input, context }) => {\n        const keysResult = validateStorageKeysOrFail(input.keys, context.locale)\n        if (!keysResult.success)\n          return keysResult\n        return storage.file.deleteMany(keysResult.data)\n      })),\n    },\n  })\n}\n\nfunction toPresignedResult(key: string, expiresIn: number | undefined, result: HaiResult<string>): HaiResult<PresignedResponse> {\n  return mapHaiResult(result, url => ({\n    url,\n    key,\n    expiresAt: expiresIn ? new Date(Date.now() + expiresIn * 1000) : undefined,\n  }))\n}\n"]}
+{"version":3,"sources":["../../src/features/serv-feature-storage.ts"],"names":[],"mappings":";;;;;AAwBA,IAAM,kBAAkB,WAAA,CAAY,OAAA;AACpC,IAAM,sBAAA,GAAyB,IAAA;AAE/B,SAAS,gCAAA,CACP,KAAA,EACA,MAAA,EACA,UAAA,EACA,MAAA,EACkB;AAClB,EAAA,MAAM,UAAU,KAAA,CAAM,UAAA,EAAY,EAAE,MAAA,EAAQ,QAAQ,CAAA;AACpD,EAAA,OAAO,GAAA;AAAA,IACL,cAAA,CAAe,gBAAA;AAAA,IACf,KAAA,CAAM,uBAAA,EAAyB,EAAE,MAAA,EAAQ,CAAA;AAAA,IACzC,CAAC,EAAE,KAAA,EAAO,OAAA,EAAS;AAAA,GACrB;AACF;AAQA,SAAS,wBAAA,CAAyB,GAAA,EAAa,MAAA,EAAgB,KAAA,GAAgB,KAAA,EAA0B;AACvG,EAAA,IAAI,GAAA,CAAI,MAAK,KAAM,EAAA;AACjB,IAAA,OAAO,gCAAA,CAAiC,KAAA,EAAO,MAAA,EAAQ,yBAAyB,CAAA;AAClF,EAAA,IAAI,GAAA,CAAI,SAAS,sBAAA,EAAwB;AACvC,IAAA,OAAO,gCAAA,CAAiC,KAAA,EAAO,MAAA,EAAQ,wBAAA,EAA0B;AAAA,MAC/E,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,EACH;AACA,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,GAAG,CAAA,IAAK,GAAA,CAAI,SAAS,IAAI,CAAA,IAAK,GAAA,CAAI,QAAA,CAAS,IAAI,CAAA;AAChE,IAAA,OAAO,gCAAA,CAAiC,KAAA,EAAO,MAAA,EAAQ,6BAA6B,CAAA;AACtF,EAAA,IAAI,GAAA,CAAI,MAAM,GAAG,CAAA,CAAE,KAAK,CAAA,GAAA,KAAO,GAAA,KAAQ,GAAA,IAAO,GAAA,KAAQ,IAAI,CAAA;AACxD,IAAA,OAAO,gCAAA,CAAiC,KAAA,EAAO,MAAA,EAAQ,4BAA4B,CAAA;AACrF,EAAA,OAAO,GAAG,GAAG,CAAA;AACf;AAEA,SAAS,yBAAA,CAA0B,MAAgB,MAAA,EAAqC;AACtF,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,GAAG,CAAA,IAAK,IAAA,CAAK,SAAQ,EAAG;AACzC,IAAA,MAAM,YAAY,wBAAA,CAAyB,GAAA,EAAK,MAAA,EAAQ,CAAA,KAAA,EAAQ,KAAK,CAAA,CAAE,CAAA;AACvE,IAAA,IAAI,CAAC,SAAA,CAAU,OAAA;AACb,MAAA,OAAO,SAAA;AAAA,EACX;AACA,EAAA,OAAO,GAAG,IAAI,CAAA;AAChB;AAcO,SAAS,wBAAwB,IAAA,EAA4B;AAClE,EAAA,MAAM,EAAE,SAAQ,GAAI,IAAA;AAEpB,EAAA,OAAO,SAAA,CAAU,eAAe,CAAA,CAC7B,OAAA,GAEA,KAAA,CAAM,8BAA8B,CAAA,CACpC,IAAA,GACA,MAAA,CAAO,OAAO,EAAE,KAAA,EAAO,SAAQ,KAAM;AACpC,IAAA,MAAM,SAAA,GAAY,wBAAA,CAAyB,KAAA,CAAM,GAAA,EAAK,QAAQ,MAAM,CAAA;AACpE,IAAA,IAAI,CAAC,SAAA,CAAU,OAAA;AACb,MAAA,OAAO,SAAA;AACT,IAAA,MAAM,SAAA,GAAY,MAAM,SAAA,IAAa,GAAA;AACrC,IAAA,OAAO,iBAAA;AAAA,MACL,SAAA,CAAU,IAAA;AAAA,MACV,SAAA;AAAA,MACA,MAAM,QAAQ,OAAA,CAAQ,MAAA,CAAO,UAAU,IAAA,EAAM,EAAE,WAAW;AAAA,KAC5D;AAAA,EACF,CAAC,CAAA,CAEA,KAAA,CAAM,4BAA4B,CAAA,CAClC,IAAA,EAAK,CACL,MAAA,CAAO,OAAO,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AACpC,IAAA,MAAM,SAAA,GAAY,wBAAA,CAAyB,KAAA,CAAM,GAAA,EAAK,QAAQ,MAAM,CAAA;AACpE,IAAA,IAAI,CAAC,SAAA,CAAU,OAAA;AACb,MAAA,OAAO,SAAA;AACT,IAAA,MAAM,SAAA,GAAY,MAAM,SAAA,IAAa,GAAA;AACrC,IAAA,MAAM,WAAA,GAAc,MAAM,WAAA,IAAe,0BAAA;AACzC,IAAA,MAAM,EAAE,GAAA,EAAK,CAAA,EAAG,GAAG,SAAQ,GAAI,KAAA;AAC/B,IAAA,OAAO,iBAAA;AAAA,MACL,SAAA,CAAU,IAAA;AAAA,MACV,SAAA;AAAA,MACA,MAAM,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,SAAA,CAAU,IAAA,EAAM,EAAE,GAAG,OAAA,EAAS,SAAA,EAAW,WAAA,EAAa;AAAA,KACrF;AAAA,EACF,CAAC,CAAA,CAEA,KAAA,CAAM,YAAY,CAAA,CAClB,IAAA,EAAK,CACL,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,KAAK,CAAC,CAAA,CAE7C,KAAA,CAAM,mBAAmB,CAAA,CACzB,IAAA,EAAK,CACL,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AAC9B,IAAA,MAAM,SAAA,GAAY,wBAAA,CAAyB,KAAA,CAAM,GAAA,EAAK,QAAQ,MAAM,CAAA;AACpE,IAAA,IAAI,CAAC,SAAA,CAAU,OAAA;AACb,MAAA,OAAO,SAAA;AACT,IAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAAA,EACzC,CAAC,CAAA,CAEA,KAAA,CAAM,cAAc,CAAA,CACpB,IAAA,EAAK,CACL,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AAC9B,IAAA,MAAM,SAAA,GAAY,wBAAA,CAAyB,KAAA,CAAM,GAAA,EAAK,QAAQ,MAAM,CAAA;AACpE,IAAA,IAAI,CAAC,SAAA,CAAU,OAAA;AACb,MAAA,OAAO,SAAA;AACT,IAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,SAAA,CAAU,IAAI,CAAA;AAAA,EAC3C,CAAC,CAAA,CAEA,KAAA,CAAM,kBAAkB,CAAA,CACxB,IAAA,EAAK,CACL,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AAC9B,IAAA,MAAM,UAAA,GAAa,yBAAA,CAA0B,KAAA,CAAM,IAAA,EAAM,QAAQ,MAAM,CAAA;AACvE,IAAA,IAAI,CAAC,UAAA,CAAW,OAAA;AACd,MAAA,OAAO,UAAA;AACT,IAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,UAAA,CAAW,UAAA,CAAW,IAAI,CAAA;AAAA,EAChD,CAAC,EAEA,KAAA,EAAM;AACX;AAEA,SAAS,iBAAA,CACP,GAAA,EACA,SAAA,EACA,MAAA,EAC8B;AAC9B,EAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,GAAA,MAAQ;AAAA,IAClC,GAAA;AAAA,IACA,GAAA;AAAA,IACA,SAAA,EAAW,YAAY,IAAI,IAAA,CAAK,KAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAI,CAAA,GAAI;AAAA,GACnE,CAAE,CAAA;AACJ","file":"storage.js","sourcesContent":["/**\n * @h-ai/serv — Storage 默认 procedures\n *\n * 基于 `@h-ai/storage` 提供开箱即用的 Storage procedures 实现：预签名 URL、列表、元数据、删除。\n *\n * **⚠️ 安全说明（必读）：**\n *\n * 1. **路径穿越防护**：内置 `validateStorageKeyOrFail` 拒绝 `..`、绝对路径、反斜杠、NUL 字节等危险输入。\n * 2. **多租户 / 多用户隔离（需应用层实现）**：默认 procedure 仅使用 `.auth()`，任何登录用户均可访问任意 key。\n *    生产环境必须在应用层重新装配这些 procedure，以强制用 `context.session.userId` 作为 key 前缀。\n * 3. **权限收紧**：推荐把 `.auth()` 改成 `.permission('storage.files.read'|'storage.files.write')`。\n * @module features/serv-feature-storage\n */\n\nimport type { HaiResult } from '@h-ai/core'\nimport type { StorageFunctions } from '@h-ai/storage'\nimport type { ServContext } from '../serv-context.js'\nimport type { ServMessageKey } from '../serv-i18n.js'\nimport { apiContract } from '@h-ai/api-contract'\nimport { err, HaiCommonError, ok } from '@h-ai/core'\nimport { servM } from '../serv-i18n.js'\nimport { implement } from '../serv-router.js'\nimport { mapHaiResult } from './serv-feature-helpers.js'\n\nconst storageContract = apiContract.storage\nconst STORAGE_KEY_MAX_LENGTH = 1024\n\nfunction buildStorageKeyValidationFailure(\n  field: string,\n  locale: string,\n  messageKey: ServMessageKey,\n  params?: Record<string, string | number>,\n): HaiResult<never> {\n  const message = servM(messageKey, { locale, params })\n  return err(\n    HaiCommonError.VALIDATION_ERROR,\n    servM('serv_validationFailed', { locale }),\n    [{ field, message }],\n  )\n}\n\n/**\n * 对业务层再次校验存储 key 是否安全。\n *\n * 这里不额外构造 Zod schema，而是直接按业务规则返回统一的\n * `HaiResult + ValidationFormError[]` 形态，避免把简单路径安全规则包装得过重。\n */\nfunction validateStorageKeyOrFail(key: string, locale: string, field: string = 'key'): HaiResult<string> {\n  if (key.trim() === '')\n    return buildStorageKeyValidationFailure(field, locale, 'serv_storageKeyRequired')\n  if (key.length > STORAGE_KEY_MAX_LENGTH) {\n    return buildStorageKeyValidationFailure(field, locale, 'serv_storageKeyTooLong', {\n      max: STORAGE_KEY_MAX_LENGTH,\n    })\n  }\n  if (key.startsWith('/') || key.includes('\\\\') || key.includes('\\0'))\n    return buildStorageKeyValidationFailure(field, locale, 'serv_storageKeyIllegalChars')\n  if (key.split('/').some(seg => seg === '.' || seg === '..'))\n    return buildStorageKeyValidationFailure(field, locale, 'serv_storageKeyDotSegments')\n  return ok(key)\n}\n\nfunction validateStorageKeysOrFail(keys: string[], locale: string): HaiResult<string[]> {\n  for (const [index, key] of keys.entries()) {\n    const keyResult = validateStorageKeyOrFail(key, locale, `keys.${index}`)\n    if (!keyResult.success)\n      return keyResult\n  }\n  return ok(keys)\n}\n\n/** Storage 默认 procedures 依赖。 */\nexport interface StorageProcedureDeps {\n  readonly storage: StorageFunctions\n}\n\ninterface PresignedResponse {\n  readonly url: string\n  readonly key: string\n  readonly expiresAt?: Date\n}\n\n/** 创建 Storage 默认 procedures。 */\nexport function createStorageProcedures(deps: StorageProcedureDeps) {\n  const { storage } = deps\n\n  return implement(storageContract)\n    .context<ServContext>()\n\n    .route('presignedUrls.createDownload')\n    .auth()\n    .handle(async ({ input, context }) => {\n      const keyResult = validateStorageKeyOrFail(input.key, context.locale)\n      if (!keyResult.success)\n        return keyResult\n      const expiresIn = input.expiresIn ?? 900\n      return toPresignedResult(\n        keyResult.data,\n        expiresIn,\n        await storage.presign.getUrl(keyResult.data, { expiresIn }),\n      )\n    })\n\n    .route('presignedUrls.createUpload')\n    .auth()\n    .handle(async ({ input, context }) => {\n      const keyResult = validateStorageKeyOrFail(input.key, context.locale)\n      if (!keyResult.success)\n        return keyResult\n      const expiresIn = input.expiresIn ?? 900\n      const contentType = input.contentType ?? 'application/octet-stream'\n      const { key: _, ...options } = input\n      return toPresignedResult(\n        keyResult.data,\n        expiresIn,\n        await storage.presign.putUrl(keyResult.data, { ...options, expiresIn, contentType }),\n      )\n    })\n\n    .route('files.list')\n    .auth()\n    .handle(({ input }) => storage.dir.list(input))\n\n    .route('files.getMetadata')\n    .auth()\n    .handle(({ input, context }) => {\n      const keyResult = validateStorageKeyOrFail(input.key, context.locale)\n      if (!keyResult.success)\n        return keyResult\n      return storage.file.head(keyResult.data)\n    })\n\n    .route('files.delete')\n    .auth()\n    .handle(({ input, context }) => {\n      const keyResult = validateStorageKeyOrFail(input.key, context.locale)\n      if (!keyResult.success)\n        return keyResult\n      return storage.file.delete(keyResult.data)\n    })\n\n    .route('files.deleteMany')\n    .auth()\n    .handle(({ input, context }) => {\n      const keysResult = validateStorageKeysOrFail(input.keys, context.locale)\n      if (!keysResult.success)\n        return keysResult\n      return storage.file.deleteMany(keysResult.data)\n    })\n\n    .build()\n}\n\nfunction toPresignedResult(\n  key: string,\n  expiresIn: number | undefined,\n  result: HaiResult<string>,\n): HaiResult<PresignedResponse> {\n  return mapHaiResult(result, url => ({\n    url,\n    key,\n    expiresAt: expiresIn ? new Date(Date.now() + expiresIn * 1000) : undefined,\n  }))\n}\n"]}