@h-ai/serv 0.1.0-alpha.67 → 0.1.0-alpha.68

package/dist/features/ai.js

@@ -1,61 +1,70 @@
-import { wrapItemsResult } from '../chunk-27PCPE37.js';
-import { implement } from '../chunk-R354OMWL.js';
+import { wrapItemsResult } from '../chunk-XKCLD42I.js';
+import { implement, servM } from '../chunk-TWHCU6HT.js';
 import { apiContract } from '@h-ai/api-contract';
-import { ok } from '@h-ai/core';
+import { ok, err, HaiCommonError } from '@h-ai/core';
 
 var aiContract = apiContract.ai;
 function createAiProcedures(deps) {
-  return implement(aiContract).context().route("chats.createCompletion").auth().handle(async ({ input }) => {
-    return mapChatCompletionResult(await deps.ai.llm.chat(toChatCompletionRequest(input)));
-  }).route("chats.sendMessage").auth().handle(({ input }) => sendMessage(deps, input)).route("chats.listHistory").auth().handle(async ({ input }) => {
-    const { objectId, sessionId, limit, order } = input;
+  async function resolveObjectId(operation, context, input) {
+    const objectId = input.objectId ?? context.session.userId;
+    if (objectId !== context.session.userId && await deps.authorizeObject?.({ context, objectId, sessionId: input.sessionId, operation }) !== true) {
+      return err(HaiCommonError.FORBIDDEN, servM("serv_errorForbidden", { locale: context.locale }));
+    }
+    return ok(objectId);
+  }
+  return implement(aiContract).context().route("chats.createCompletion").auth().handle(async ({ input, context }) => {
+    const objectId = await resolveObjectId("completion", context, input);
+    if (!objectId.success)
+      return objectId;
+    return mapChatCompletionResult(await deps.ai.llm.chat({
+      ...toChatCompletionRequest(input),
+      objectId: objectId.data,
+      sessionId: input.sessionId ?? "default",
+      signal: context.request.signal
+    }));
+  }).route("chats.sendMessage").auth().handle(async ({ input, context }) => {
+    const objectId = await resolveObjectId("message", context, input);
+    if (!objectId.success)
+      return objectId;
+    return sendMessage(deps, input, { objectId: objectId.data, sessionId: input.sessionId ?? "default", signal: context.request.signal });
+  }).route("chats.listHistory").auth().handle(async ({ input, context }) => {
+    const objectId = await resolveObjectId("history", context, input);
+    if (!objectId.success)
+      return objectId;
+    const { sessionId, limit, order } = input;
     return mapChatRecordsResult(
-      await deps.ai.llm.getHistory({ objectId, sessionId }, { limit, order })
+      await deps.ai.llm.getHistory({ objectId: objectId.data, sessionId }, { limit, order })
     );
-  }).route("memories.recall").auth().handle(async ({ input }) => {
+  }).route("memories.recall").auth().handle(async ({ input, context }) => {
+    const objectId = await resolveObjectId("memoryRecall", context, input);
+    if (!objectId.success)
+      return objectId;
     const { query, ...options } = input;
-    return wrapItemsResult(await deps.ai.memory.recall(query, options));
-  }).route("memories.list").auth().handle(({ input }) => deps.ai.memory.listPage(input)).route("sessions.list").auth().handle(async ({ input }) => {
-    return wrapItemsResult(await deps.ai.llm.listSessions(input.objectId));
+    return wrapItemsResult(await deps.ai.memory.recall(query, { ...options, objectId: objectId.data }));
+  }).route("memories.list").auth().handle(async ({ input, context }) => {
+    const objectId = await resolveObjectId("memoryList", context, input);
+    if (!objectId.success)
+      return objectId;
+    return deps.ai.memory.listPage({ ...input, objectId: objectId.data });
+  }).route("sessions.list").auth().handle(async ({ input, context }) => {
+    const objectId = await resolveObjectId("sessions", context, input);
+    if (!objectId.success)
+      return objectId;
+    return wrapItemsResult(await deps.ai.llm.listSessions(objectId.data));
   }).build();
 }
 function toChatCompletionRequest(input) {
   return {
-    messages: input.messages.map(toChatMessage),
+    // Schema 已按角色校验完整消息，直接传递以保留 name、图片、tool_calls 和工具结果。
+    messages: input.messages,
     model: input.model,
     temperature: input.temperature,
     top_p: input.top_p,
-    max_tokens: input.max_tokens
-  };
-}
-function toChatMessage(message) {
-  if (message.role === "system") {
-    return { role: "system", content: toMessageText(message.content) };
-  }
-  if (message.role === "user") {
-    return { role: "user", content: message.content ?? "" };
-  }
-  if (message.role === "tool") {
-    return { role: "tool", content: toMessageText(message.content), tool_call_id: message.tool_call_id ?? "" };
-  }
-  return {
-    role: "assistant",
-    content: toAssistantContent(message.content),
-    tool_calls: message.tool_calls
+    max_tokens: input.max_tokens,
+    tools: input.tools,
+    tool_choice: input.tool_choice
   };
 }
-function toMessageText(content) {
-  if (typeof content === "string") {
-    return content;
-  }
-  return content?.map((part) => part.type === "text" ? part.text : part.image_url.url).join("\n") ?? "";
-}
-function toAssistantContent(content) {
-  if (typeof content === "string") {
-    return content;
-  }
-  return content ? toMessageText(content) : null;
-}
 function mapChatCompletionResult(result) {
   if (!result.success) {
     return result;
@@ -124,13 +133,14 @@ function toApiChatMessage(message) {
     return {
       role: "assistant",
       content: toContentText(message.content),
+      name: message.name,
       tool_calls: mapFunctionToolCalls(message.tool_calls)
     };
   }
   if (message.role === "user") {
-    return { role: "user", content: toContentText(message.content) };
+    return { role: "user", content: toContentText(message.content), name: message.name };
   }
-  return { role: "system", content: toContentText(message.content) };
+  return { role: "system", content: toContentText(message.content), name: message.role === "system" || message.role === "developer" ? message.name : void 0 };
 }
 function toContentText(content) {
   if (typeof content === "string") {
@@ -169,11 +179,12 @@ function mapFunctionToolCalls(toolCalls) {
     }];
   });
 }
-async function sendMessage(deps, input) {
+async function sendMessage(deps, input, scope) {
   const result = await deps.ai.llm.ask(input.message, {
     systemPrompt: input.systemPrompt,
     model: input.model,
-    temperature: input.temperature
+    temperature: input.temperature,
+    ...scope
   });
   if (!result.success) {
     return result;

package/dist/features/ai.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/features/serv-feature-ai.ts"],"names":[],"mappings":";;;;;AA2BA,IAAM,aAAa,WAAA,CAAY,EAAA;AAQxB,SAAS,mBAAmB,IAAA,EAAuB;AACxD,EAAA,OAAO,SAAA,CAAU,UAAU,CAAA,CACxB,OAAA,GAEA,KAAA,CAAM,wBAAwB,CAAA,CAC9B,IAAA,EAAK,CACL,MAAA,CAAO,OAAO,EAAE,OAAM,KAAM;AAC3B,IAAA,OAAO,uBAAA,CAAwB,MAAM,IAAA,CAAK,EAAA,CAAG,IAAI,IAAA,CAAK,uBAAA,CAAwB,KAAK,CAAC,CAAC,CAAA;AAAA,EACvF,CAAC,CAAA,CAEA,KAAA,CAAM,mBAAmB,CAAA,CACzB,IAAA,EAAK,CACL,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,WAAA,CAAY,MAAM,KAAK,CAAC,CAAA,CAE9C,KAAA,CAAM,mBAAmB,CAAA,CACzB,IAAA,EAAK,CACL,MAAA,CAAO,OAAO,EAAE,KAAA,EAAM,KAAM;AAC3B,IAAA,MAAM,EAAE,QAAA,EAAU,SAAA,EAAW,KAAA,EAAO,OAAM,GAAI,KAAA;AAC9C,IAAA,OAAO,oBAAA;AAAA,MACL,MAAM,IAAA,CAAK,EAAA,CAAG,GAAA,CAAI,UAAA,CAAW,EAAE,QAAA,EAAU,SAAA,EAAU,EAAG,EAAE,KAAA,EAAO,KAAA,EAAO;AAAA,KACxE;AAAA,EACF,CAAC,CAAA,CAEA,KAAA,CAAM,iBAAiB,CAAA,CACvB,IAAA,EAAK,CACL,MAAA,CAAO,OAAO,EAAE,KAAA,EAAM,KAAM;AAC3B,IAAA,MAAM,EAAE,KAAA,EAAO,GAAG,OAAA,EAAQ,GAAI,KAAA;AAC9B,IAAA,OAAO,eAAA,CAAgB,MAAM,IAAA,CAAK,EAAA,CAAG,OAAO,MAAA,CAAO,KAAA,EAAO,OAAO,CAAC,CAAA;AAAA,EACpE,CAAC,CAAA,CAEA,KAAA,CAAM,eAAe,CAAA,CACrB,IAAA,EAAK,CACL,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,IAAA,CAAK,EAAA,CAAG,MAAA,CAAO,QAAA,CAAS,KAAK,CAAC,CAAA,CAEpD,KAAA,CAAM,eAAe,CAAA,CACrB,IAAA,EAAK,CACL,MAAA,CAAO,OAAO,EAAE,KAAA,EAAM,KAAM;AAC3B,IAAA,OAAO,eAAA,CAAgB,MAAM,IAAA,CAAK,EAAA,CAAG,IAAI,YAAA,CAAa,KAAA,CAAM,QAAQ,CAAC,CAAA;AAAA,EACvE,CAAC,EAEA,KAAA,EAAM;AACX;AAEA,SAAS,wBAAwB,KAAA,EAAqD;AACpF,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,KAAA,CAAM,QAAA,CAAS,GAAA,CAAI,aAAa,CAAA;AAAA,IAC1C,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,aAAa,KAAA,CAAM,WAAA;AAAA,IACnB,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,YAAY,KAAA,CAAM;AAAA,GACpB;AACF;AAEA,SAAS,cAAc,OAAA,EAAiE;AACtF,EAAA,IAAI,OAAA,CAAQ,SAAS,QAAA,EAAU;AAC7B,IAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,SAAS,aAAA,CAAc,OAAA,CAAQ,OAAO,CAAA,EAAE;AAAA,EACnE;AAEA,EAAA,IAAI,OAAA,CAAQ,SAAS,MAAA,EAAQ;AAC3B,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,OAAA,CAAQ,WAAW,EAAA,EAAG;AAAA,EACxD;AAEA,EAAA,IAAI,OAAA,CAAQ,SAAS,MAAA,EAAQ;AAC3B,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,aAAA,CAAc,OAAA,CAAQ,OAAO,CAAA,EAAG,YAAA,EAAc,OAAA,CAAQ,YAAA,IAAgB,EAAA,EAAG;AAAA,EAC3G;AAEA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,WAAA;AAAA,IACN,OAAA,EAAS,kBAAA,CAAmB,OAAA,CAAQ,OAAO,CAAA;AAAA,IAC3C,YAAY,OAAA,CAAQ;AAAA,GACtB;AACF;AAEA,SAAS,cAAc,OAAA,EAAuE;AAC5F,EAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,OAAO,OAAA,EAAS,GAAA,CAAI,CAAA,IAAA,KAAQ,IAAA,CAAK,SAAS,MAAA,GAAS,IAAA,CAAK,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,GAAG,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA,IAAK,EAAA;AACnG;AAEA,SAAS,mBAAmB,OAAA,EAA8E;AACxG,EAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,OAAO,OAAA,GAAU,aAAA,CAAc,OAAO,CAAA,GAAI,IAAA;AAC5C;AAEA,SAAS,wBAAwB,MAAA,EAA4E;AAC3G,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO,EAAA,CAAG;AAAA,IACR,EAAA,EAAI,OAAO,IAAA,CAAK,EAAA;AAAA,IAChB,MAAA,EAAQ,iBAAA;AAAA,IACR,OAAA,EAAS,OAAO,IAAA,CAAK,OAAA;AAAA,IACrB,KAAA,EAAO,OAAO,IAAA,CAAK,KAAA;AAAA,IACnB,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA,MAAA,MAAW;AAAA,MAC1C,OAAO,MAAA,CAAO,KAAA;AAAA,MACd,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,WAAA;AAAA,QACN,OAAA,EAAS,MAAA,CAAO,OAAA,CAAQ,OAAA,IAAW,IAAA;AAAA,QACnC,UAAA,EAAY,oBAAA,CAAqB,MAAA,CAAO,OAAA,CAAQ,UAAU;AAAA,OAC5D;AAAA,MACA,aAAA,EAAe,iBAAA,CAAkB,MAAA,CAAO,aAAa;AAAA,KACvD,CAAE,CAAA;AAAA,IACF,KAAA,EAAO;AAAA,MACL,aAAA,EAAe,MAAA,CAAO,IAAA,CAAK,KAAA,EAAO,aAAA,IAAiB,CAAA;AAAA,MACnD,iBAAA,EAAmB,MAAA,CAAO,IAAA,CAAK,KAAA,EAAO,iBAAA,IAAqB,CAAA;AAAA,MAC3D,YAAA,EAAc,MAAA,CAAO,IAAA,CAAK,KAAA,EAAO,YAAA,IAAgB;AAAA;AACnD,GACD,CAAA;AACH;AAEA,SAAS,kBAAkB,MAAA,EAAiF;AAC1G,EAAA,IAAI,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,YAAA,IAAgB,WAAW,gBAAA,EAAkB;AACjF,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,qBAAqB,MAAA,EAA+F;AAC3H,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO,EAAA,CAAG,EAAE,KAAA,EAAO,MAAA,CAAO,KAAK,GAAA,CAAI,eAAe,GAAG,CAAA;AACvD;AAEA,SAAS,gBAAgB,MAAA,EAAqD;AAC5E,EAAA,OAAO;AAAA,IACL,IAAI,MAAA,CAAO,EAAA;AAAA,IACX,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,OAAA,EAAS;AAAA,MACP,KAAA,EAAO,OAAO,OAAA,CAAQ,KAAA;AAAA,MACtB,QAAA,EAAU,MAAA,CAAO,OAAA,CAAQ,QAAA,CAAS,IAAI,gBAAgB;AAAA,KACxD;AAAA,IACA,QAAA,EAAU;AAAA,MACR,OAAA,EAAS,OAAO,QAAA,CAAS,OAAA;AAAA,MACzB,SAAA,EAAW,oBAAA,CAAqB,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA;AAAA,MACzD,YAAA,EAAc,OAAO,QAAA,CAAS,YAAA;AAAA,MAC9B,KAAA,EAAO;AAAA,QACL,aAAA,EAAe,MAAA,CAAO,QAAA,CAAS,KAAA,CAAM,aAAA;AAAA,QACrC,iBAAA,EAAmB,MAAA,CAAO,QAAA,CAAS,KAAA,CAAM,iBAAA;AAAA,QACzC,YAAA,EAAc,MAAA,CAAO,QAAA,CAAS,KAAA,CAAM;AAAA;AACtC,KACF;AAAA,IACA,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,UAAU,MAAA,CAAO;AAAA,GACnB;AACF;AAEA,SAAS,iBAAiB,OAAA,EAAiE;AACzF,EAAA,IAAI,OAAA,CAAQ,SAAS,MAAA,EAAQ;AAC3B,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,aAAA,CAAc,QAAQ,OAAO,CAAA,EAAG,YAAA,EAAc,OAAA,CAAQ,YAAA,EAAa;AAAA,EACrG;AAEA,EAAA,IAAI,OAAA,CAAQ,SAAS,WAAA,EAAa;AAChC,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,WAAA;AAAA,MACN,OAAA,EAAS,aAAA,CAAc,OAAA,CAAQ,OAAO,CAAA;AAAA,MACtC,UAAA,EAAY,oBAAA,CAAqB,OAAA,CAAQ,UAAU;AAAA,KACrD;AAAA,EACF;AAEA,EAAA,IAAI,OAAA,CAAQ,SAAS,MAAA,EAAQ;AAC3B,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,aAAA,CAAc,OAAA,CAAQ,OAAO,CAAA,EAAE;AAAA,EACjE;AAEA,EAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,SAAS,aAAA,CAAc,OAAA,CAAQ,OAAO,CAAA,EAAE;AACnE;AAEA,SAAS,cAAc,OAAA,EAA0B;AAC/C,EAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC3B,IAAA,OAAO,EAAA;AAAA,EACT;AAEA,EAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,CAAC,IAAA,KAAS;AAC3B,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,KAAS,IAAA,EAAM;AAC7C,MAAA,OAAO,EAAA;AAAA,IACT;AAEA,IAAA,MAAM,MAAA,GAAS,IAAA;AACf,IAAA,IAAI,OAAO,MAAA,CAAO,IAAA,KAAS,QAAA,EAAU;AACnC,MAAA,OAAO,MAAA,CAAO,IAAA;AAAA,IAChB;AAEA,IAAA,IAAI,OAAO,MAAA,CAAO,SAAA,KAAc,QAAA,IAAY,MAAA,CAAO,cAAc,IAAA,EAAM;AACrE,MAAA,MAAM,QAAQ,MAAA,CAAO,SAAA;AACrB,MAAA,OAAO,OAAO,KAAA,CAAM,GAAA,KAAQ,QAAA,GAAW,MAAM,GAAA,GAAM,EAAA;AAAA,IACrD;AAEA,IAAA,OAAO,EAAA;AAAA,EACT,CAAC,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,KAAK,IAAI,CAAA;AAC9B;AAEA,SAAS,qBAAqB,SAAA,EAAmC;AAC/D,EAAA,OAAO,SAAA,EAAW,OAAA,CAAQ,CAAC,QAAA,KAAa;AACtC,IAAA,IAAI,QAAA,CAAS,IAAA,KAAS,UAAA,IAAc,EAAE,cAAc,QAAA,CAAA,EAAW;AAC7D,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,OAAO,CAAC;AAAA,MACN,IAAI,QAAA,CAAS,EAAA;AAAA,MACb,IAAA,EAAM,UAAA;AAAA,MACN,QAAA,EAAU;AAAA,QACR,IAAA,EAAM,SAAS,QAAA,CAAS,IAAA;AAAA,QACxB,SAAA,EAAW,SAAS,QAAA,CAAS;AAAA;AAC/B,KACD,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AAEA,eAAe,WAAA,CACb,MACA,KAAA,EACwD;AACxD,EAAA,MAAM,SAAS,MAAM,IAAA,CAAK,GAAG,GAAA,CAAI,GAAA,CAAI,MAAM,OAAA,EAAS;AAAA,IAClD,cAAc,KAAA,CAAM,YAAA;AAAA,IACpB,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,aAAa,KAAA,CAAM;AAAA,GACpB,CAAA;AAED,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO,EAAA,CAAG;AAAA,IACR,SAAS,MAAA,CAAO,IAAA;AAAA,IAChB,OAAO,KAAA,CAAM,KAAA,IAAS,KAAK,EAAA,CAAG,MAAA,EAAQ,IAAI,KAAA,IAAS;AAAA,GACpD,CAAA;AACH","file":"ai.js","sourcesContent":["/**\n * @h-ai/serv — AI 默认 procedures\n *\n * 基于 `@h-ai/ai` 提供开箱即用的 AI procedures 实现：对话补全、消息发送、聊天历史、记忆管理、会话列表。\n * @module features/serv-feature-ai\n */\n\nimport type {\n  AIFunctions,\n  ChatCompletionRequest,\n  ChatCompletionResponse,\n  ChatMessage,\n  ToolCall,\n} from '@h-ai/ai'\nimport type {\n  AiChatCompletionData,\n  AiChatCompletionInput,\n  AiChatRecord,\n  AiSendMessageInput,\n} from '@h-ai/api-contract'\nimport type { HaiResult } from '@h-ai/core'\nimport type { ServContext } from '../serv-context.js'\nimport { apiContract } from '@h-ai/api-contract'\nimport { ok } from '@h-ai/core'\nimport { implement } from '../serv-router.js'\nimport { wrapItemsResult } from './serv-feature-helpers.js'\n\nconst aiContract = apiContract.ai\n\n/** AI 默认 procedures 依赖。 */\nexport interface AiProcedureDeps {\n  readonly ai: AIFunctions\n}\n\n/** 创建 AI 默认 procedures。 */\nexport function createAiProcedures(deps: AiProcedureDeps) {\n  return implement(aiContract)\n    .context<ServContext>()\n\n    .route('chats.createCompletion')\n    .auth()\n    .handle(async ({ input }) => {\n      return mapChatCompletionResult(await deps.ai.llm.chat(toChatCompletionRequest(input)))\n    })\n\n    .route('chats.sendMessage')\n    .auth()\n    .handle(({ input }) => sendMessage(deps, input))\n\n    .route('chats.listHistory')\n    .auth()\n    .handle(async ({ input }) => {\n      const { objectId, sessionId, limit, order } = input\n      return mapChatRecordsResult(\n        await deps.ai.llm.getHistory({ objectId, sessionId }, { limit, order }),\n      )\n    })\n\n    .route('memories.recall')\n    .auth()\n    .handle(async ({ input }) => {\n      const { query, ...options } = input\n      return wrapItemsResult(await deps.ai.memory.recall(query, options))\n    })\n\n    .route('memories.list')\n    .auth()\n    .handle(({ input }) => deps.ai.memory.listPage(input))\n\n    .route('sessions.list')\n    .auth()\n    .handle(async ({ input }) => {\n      return wrapItemsResult(await deps.ai.llm.listSessions(input.objectId))\n    })\n\n    .build()\n}\n\nfunction toChatCompletionRequest(input: AiChatCompletionInput): ChatCompletionRequest {\n  return {\n    messages: input.messages.map(toChatMessage),\n    model: input.model,\n    temperature: input.temperature,\n    top_p: input.top_p,\n    max_tokens: input.max_tokens,\n  }\n}\n\nfunction toChatMessage(message: AiChatCompletionInput['messages'][number]): ChatMessage {\n  if (message.role === 'system') {\n    return { role: 'system', content: toMessageText(message.content) }\n  }\n\n  if (message.role === 'user') {\n    return { role: 'user', content: message.content ?? '' }\n  }\n\n  if (message.role === 'tool') {\n    return { role: 'tool', content: toMessageText(message.content), tool_call_id: message.tool_call_id ?? '' }\n  }\n\n  return {\n    role: 'assistant',\n    content: toAssistantContent(message.content),\n    tool_calls: message.tool_calls,\n  }\n}\n\nfunction toMessageText(content: AiChatCompletionInput['messages'][number]['content']): string {\n  if (typeof content === 'string') {\n    return content\n  }\n\n  return content?.map(part => part.type === 'text' ? part.text : part.image_url.url).join('\\n') ?? ''\n}\n\nfunction toAssistantContent(content: AiChatCompletionInput['messages'][number]['content']): string | null {\n  if (typeof content === 'string') {\n    return content\n  }\n\n  return content ? toMessageText(content) : null\n}\n\nfunction mapChatCompletionResult(result: HaiResult<ChatCompletionResponse>): HaiResult<AiChatCompletionData> {\n  if (!result.success) {\n    return result\n  }\n\n  return ok({\n    id: result.data.id,\n    object: 'chat.completion',\n    created: result.data.created,\n    model: result.data.model,\n    choices: result.data.choices.map(choice => ({\n      index: choice.index,\n      message: {\n        role: 'assistant',\n        content: choice.message.content ?? null,\n        tool_calls: mapFunctionToolCalls(choice.message.tool_calls),\n      },\n      finish_reason: toApiFinishReason(choice.finish_reason),\n    })),\n    usage: {\n      prompt_tokens: result.data.usage?.prompt_tokens ?? 0,\n      completion_tokens: result.data.usage?.completion_tokens ?? 0,\n      total_tokens: result.data.usage?.total_tokens ?? 0,\n    },\n  })\n}\n\nfunction toApiFinishReason(reason: string | null): AiChatCompletionData['choices'][number]['finish_reason'] {\n  if (reason === 'length' || reason === 'tool_calls' || reason === 'content_filter') {\n    return reason\n  }\n\n  return 'stop'\n}\n\nfunction mapChatRecordsResult(result: HaiResult<Array<import('@h-ai/ai').ChatRecord>>): HaiResult<{ items: AiChatRecord[] }> {\n  if (!result.success) {\n    return result\n  }\n\n  return ok({ items: result.data.map(toApiChatRecord) })\n}\n\nfunction toApiChatRecord(record: import('@h-ai/ai').ChatRecord): AiChatRecord {\n  return {\n    id: record.id,\n    objectId: record.objectId,\n    sessionId: record.sessionId,\n    request: {\n      model: record.request.model,\n      messages: record.request.messages.map(toApiChatMessage),\n    },\n    response: {\n      content: record.response.content,\n      toolCalls: mapFunctionToolCalls(record.response.toolCalls),\n      finishReason: record.response.finishReason,\n      usage: {\n        prompt_tokens: record.response.usage.prompt_tokens,\n        completion_tokens: record.response.usage.completion_tokens,\n        total_tokens: record.response.usage.total_tokens,\n      },\n    },\n    createdAt: record.createdAt,\n    duration: record.duration,\n  }\n}\n\nfunction toApiChatMessage(message: ChatMessage): AiChatCompletionInput['messages'][number] {\n  if (message.role === 'tool') {\n    return { role: 'tool', content: toContentText(message.content), tool_call_id: message.tool_call_id }\n  }\n\n  if (message.role === 'assistant') {\n    return {\n      role: 'assistant',\n      content: toContentText(message.content),\n      tool_calls: mapFunctionToolCalls(message.tool_calls),\n    }\n  }\n\n  if (message.role === 'user') {\n    return { role: 'user', content: toContentText(message.content) }\n  }\n\n  return { role: 'system', content: toContentText(message.content) }\n}\n\nfunction toContentText(content: unknown): string {\n  if (typeof content === 'string') {\n    return content\n  }\n\n  if (!Array.isArray(content)) {\n    return ''\n  }\n\n  return content.map((part) => {\n    if (typeof part !== 'object' || part === null) {\n      return ''\n    }\n\n    const record = part as Record<string, unknown>\n    if (typeof record.text === 'string') {\n      return record.text\n    }\n\n    if (typeof record.image_url === 'object' && record.image_url !== null) {\n      const image = record.image_url as Record<string, unknown>\n      return typeof image.url === 'string' ? image.url : ''\n    }\n\n    return ''\n  }).filter(Boolean).join('\\n')\n}\n\nfunction mapFunctionToolCalls(toolCalls: ToolCall[] | undefined) {\n  return toolCalls?.flatMap((toolCall) => {\n    if (toolCall.type !== 'function' || !('function' in toolCall)) {\n      return []\n    }\n\n    return [{\n      id: toolCall.id,\n      type: 'function' as const,\n      function: {\n        name: toolCall.function.name,\n        arguments: toolCall.function.arguments,\n      },\n    }]\n  })\n}\n\nasync function sendMessage(\n  deps: AiProcedureDeps,\n  input: AiSendMessageInput,\n): Promise<HaiResult<{ content: string, model: string }>> {\n  const result = await deps.ai.llm.ask(input.message, {\n    systemPrompt: input.systemPrompt,\n    model: input.model,\n    temperature: input.temperature,\n  })\n\n  if (!result.success) {\n    return result\n  }\n\n  return ok({\n    content: result.data,\n    model: input.model ?? deps.ai.config?.llm.model ?? 'default',\n  })\n}\n"]}
+{"version":3,"sources":["../../src/features/serv-feature-ai.ts"],"names":[],"mappings":";;;;;AA+BA,IAAM,aAAa,WAAA,CAAY,EAAA;AAgExB,SAAS,mBAAmB,IAAA,EAAuB;AACxD,EAAA,eAAe,eAAA,CACb,SAAA,EACA,OAAA,EACA,KAAA,EAC4B;AAC5B,IAAA,MAAM,QAAA,GAAW,KAAA,CAAM,QAAA,IAAY,OAAA,CAAQ,OAAA,CAAQ,MAAA;AACnD,IAAA,IAAI,aAAa,OAAA,CAAQ,OAAA,CAAQ,MAAA,IAC5B,MAAM,KAAK,eAAA,GAAkB,EAAE,OAAA,EAAS,QAAA,EAAU,WAAW,KAAA,CAAM,SAAA,EAAW,SAAA,EAAW,MAAM,IAAA,EAAM;AACxG,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,SAAA,EAAW,KAAA,CAAM,qBAAA,EAAuB,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AAAA,IAC/F;AACA,IAAA,OAAO,GAAG,QAAQ,CAAA;AAAA,EACpB;AAEA,EAAA,OAAO,SAAA,CAAU,UAAU,CAAA,CACxB,OAAA,GAEA,KAAA,CAAM,wBAAwB,CAAA,CAC9B,IAAA,GACA,MAAA,CAAO,OAAO,EAAE,KAAA,EAAO,SAAQ,KAAM;AACpC,IAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,YAAA,EAAc,SAAS,KAAK,CAAA;AACnE,IAAA,IAAI,CAAC,QAAA,CAAS,OAAA;AACZ,MAAA,OAAO,QAAA;AACT,IAAA,OAAO,uBAAA,CAAwB,MAAM,IAAA,CAAK,EAAA,CAAG,IAAI,IAAA,CAAK;AAAA,MACpD,GAAG,wBAAwB,KAAK,CAAA;AAAA,MAChC,UAAU,QAAA,CAAS,IAAA;AAAA,MACnB,SAAA,EAAW,MAAM,SAAA,IAAa,SAAA;AAAA,MAC9B,MAAA,EAAQ,QAAQ,OAAA,CAAQ;AAAA,KACzB,CAAC,CAAA;AAAA,EACJ,CAAC,CAAA,CAEA,KAAA,CAAM,mBAAmB,CAAA,CACzB,IAAA,EAAK,CACL,MAAA,CAAO,OAAO,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AACpC,IAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,SAAA,EAAW,SAAS,KAAK,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,CAAS,OAAA;AACZ,MAAA,OAAO,QAAA;AACT,IAAA,OAAO,WAAA,CAAY,IAAA,EAAM,KAAA,EAAO,EAAE,UAAU,QAAA,CAAS,IAAA,EAAM,SAAA,EAAW,KAAA,CAAM,aAAa,SAAA,EAAW,MAAA,EAAQ,OAAA,CAAQ,OAAA,CAAQ,QAAQ,CAAA;AAAA,EACtI,CAAC,CAAA,CAEA,KAAA,CAAM,mBAAmB,CAAA,CACzB,IAAA,EAAK,CACL,MAAA,CAAO,OAAO,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AACpC,IAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,SAAA,EAAW,SAAS,KAAK,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,CAAS,OAAA;AACZ,MAAA,OAAO,QAAA;AACT,IAAA,MAAM,EAAE,SAAA,EAAW,KAAA,EAAO,KAAA,EAAM,GAAI,KAAA;AACpC,IAAA,OAAO,oBAAA;AAAA,MACL,MAAM,IAAA,CAAK,EAAA,CAAG,GAAA,CAAI,WAAW,EAAE,QAAA,EAAU,QAAA,CAAS,IAAA,EAAM,SAAA,EAAU,EAAG,EAAE,KAAA,EAAO,OAAO;AAAA,KACvF;AAAA,EACF,CAAC,CAAA,CAEA,KAAA,CAAM,iBAAiB,CAAA,CACvB,IAAA,EAAK,CACL,MAAA,CAAO,OAAO,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AACpC,IAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,cAAA,EAAgB,SAAS,KAAK,CAAA;AACrE,IAAA,IAAI,CAAC,QAAA,CAAS,OAAA;AACZ,MAAA,OAAO,QAAA;AACT,IAAA,MAAM,EAAE,KAAA,EAAO,GAAG,OAAA,EAAQ,GAAI,KAAA;AAC9B,IAAA,OAAO,eAAA,CAAgB,MAAM,IAAA,CAAK,EAAA,CAAG,OAAO,MAAA,CAAO,KAAA,EAAO,EAAE,GAAG,OAAA,EAAS,QAAA,EAAU,QAAA,CAAS,IAAA,EAAM,CAAC,CAAA;AAAA,EACpG,CAAC,CAAA,CAEA,KAAA,CAAM,eAAe,CAAA,CACrB,IAAA,EAAK,CACL,MAAA,CAAO,OAAO,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AACpC,IAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,YAAA,EAAc,SAAS,KAAK,CAAA;AACnE,IAAA,IAAI,CAAC,QAAA,CAAS,OAAA;AACZ,MAAA,OAAO,QAAA;AACT,IAAA,OAAO,IAAA,CAAK,EAAA,CAAG,MAAA,CAAO,QAAA,CAAS,EAAE,GAAG,KAAA,EAAO,QAAA,EAAU,QAAA,CAAS,IAAA,EAAM,CAAA;AAAA,EACtE,CAAC,CAAA,CAEA,KAAA,CAAM,eAAe,CAAA,CACrB,IAAA,EAAK,CACL,MAAA,CAAO,OAAO,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AACpC,IAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,UAAA,EAAY,SAAS,KAAK,CAAA;AACjE,IAAA,IAAI,CAAC,QAAA,CAAS,OAAA;AACZ,MAAA,OAAO,QAAA;AACT,IAAA,OAAO,eAAA,CAAgB,MAAM,IAAA,CAAK,EAAA,CAAG,IAAI,YAAA,CAAa,QAAA,CAAS,IAAI,CAAC,CAAA;AAAA,EACtE,CAAC,EAEA,KAAA,EAAM;AACX;AAEA,SAAS,wBAAwB,KAAA,EAAqD;AACpF,EAAA,OAAO;AAAA;AAAA,IAEL,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,aAAa,KAAA,CAAM,WAAA;AAAA,IACnB,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,aAAa,KAAA,CAAM;AAAA,GACrB;AACF;AAEA,SAAS,wBAAwB,MAAA,EAA4E;AAC3G,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO,EAAA,CAAG;AAAA,IACR,EAAA,EAAI,OAAO,IAAA,CAAK,EAAA;AAAA,IAChB,MAAA,EAAQ,iBAAA;AAAA,IACR,OAAA,EAAS,OAAO,IAAA,CAAK,OAAA;AAAA,IACrB,KAAA,EAAO,OAAO,IAAA,CAAK,KAAA;AAAA,IACnB,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA,MAAA,MAAW;AAAA,MAC1C,OAAO,MAAA,CAAO,KAAA;AAAA,MACd,OAAA,EAAS;AAAA,QACP,IAAA,EAAM,WAAA;AAAA,QACN,OAAA,EAAS,MAAA,CAAO,OAAA,CAAQ,OAAA,IAAW,IAAA;AAAA,QACnC,UAAA,EAAY,oBAAA,CAAqB,MAAA,CAAO,OAAA,CAAQ,UAAU;AAAA,OAC5D;AAAA,MACA,aAAA,EAAe,iBAAA,CAAkB,MAAA,CAAO,aAAa;AAAA,KACvD,CAAE,CAAA;AAAA,IACF,KAAA,EAAO;AAAA,MACL,aAAA,EAAe,MAAA,CAAO,IAAA,CAAK,KAAA,EAAO,aAAA,IAAiB,CAAA;AAAA,MACnD,iBAAA,EAAmB,MAAA,CAAO,IAAA,CAAK,KAAA,EAAO,iBAAA,IAAqB,CAAA;AAAA,MAC3D,YAAA,EAAc,MAAA,CAAO,IAAA,CAAK,KAAA,EAAO,YAAA,IAAgB;AAAA;AACnD,GACD,CAAA;AACH;AAEA,SAAS,kBAAkB,MAAA,EAAiF;AAC1G,EAAA,IAAI,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,YAAA,IAAgB,WAAW,gBAAA,EAAkB;AACjF,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,qBAAqB,MAAA,EAA+F;AAC3H,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO,EAAA,CAAG,EAAE,KAAA,EAAO,MAAA,CAAO,KAAK,GAAA,CAAI,eAAe,GAAG,CAAA;AACvD;AAEA,SAAS,gBAAgB,MAAA,EAAqD;AAC5E,EAAA,OAAO;AAAA,IACL,IAAI,MAAA,CAAO,EAAA;AAAA,IACX,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,OAAA,EAAS;AAAA,MACP,KAAA,EAAO,OAAO,OAAA,CAAQ,KAAA;AAAA,MACtB,QAAA,EAAU,MAAA,CAAO,OAAA,CAAQ,QAAA,CAAS,IAAI,gBAAgB;AAAA,KACxD;AAAA,IACA,QAAA,EAAU;AAAA,MACR,OAAA,EAAS,OAAO,QAAA,CAAS,OAAA;AAAA,MACzB,SAAA,EAAW,oBAAA,CAAqB,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA;AAAA,MACzD,YAAA,EAAc,OAAO,QAAA,CAAS,YAAA;AAAA,MAC9B,KAAA,EAAO;AAAA,QACL,aAAA,EAAe,MAAA,CAAO,QAAA,CAAS,KAAA,CAAM,aAAA;AAAA,QACrC,iBAAA,EAAmB,MAAA,CAAO,QAAA,CAAS,KAAA,CAAM,iBAAA;AAAA,QACzC,YAAA,EAAc,MAAA,CAAO,QAAA,CAAS,KAAA,CAAM;AAAA;AACtC,KACF;AAAA,IACA,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,UAAU,MAAA,CAAO;AAAA,GACnB;AACF;AAEA,SAAS,iBAAiB,OAAA,EAAiE;AACzF,EAAA,IAAI,OAAA,CAAQ,SAAS,MAAA,EAAQ;AAC3B,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,aAAA,CAAc,QAAQ,OAAO,CAAA,EAAG,YAAA,EAAc,OAAA,CAAQ,YAAA,EAAa;AAAA,EACrG;AAEA,EAAA,IAAI,OAAA,CAAQ,SAAS,WAAA,EAAa;AAChC,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,WAAA;AAAA,MACN,OAAA,EAAS,aAAA,CAAc,OAAA,CAAQ,OAAO,CAAA;AAAA,MACtC,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,UAAA,EAAY,oBAAA,CAAqB,OAAA,CAAQ,UAAU;AAAA,KACrD;AAAA,EACF;AAEA,EAAA,IAAI,OAAA,CAAQ,SAAS,MAAA,EAAQ;AAC3B,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,OAAA,EAAS,aAAA,CAAc,QAAQ,OAAO,CAAA,EAAG,IAAA,EAAM,OAAA,CAAQ,IAAA,EAAK;AAAA,EACrF;AAEA,EAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,aAAA,CAAc,QAAQ,OAAO,CAAA,EAAG,IAAA,EAAM,OAAA,CAAQ,SAAS,QAAA,IAAY,OAAA,CAAQ,SAAS,WAAA,GAAc,OAAA,CAAQ,OAAO,MAAA,EAAU;AAC/J;AAEA,SAAS,cAAc,OAAA,EAA0B;AAC/C,EAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC3B,IAAA,OAAO,EAAA;AAAA,EACT;AAEA,EAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,CAAC,IAAA,KAAS;AAC3B,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,KAAS,IAAA,EAAM;AAC7C,MAAA,OAAO,EAAA;AAAA,IACT;AAEA,IAAA,MAAM,MAAA,GAAS,IAAA;AACf,IAAA,IAAI,OAAO,MAAA,CAAO,IAAA,KAAS,QAAA,EAAU;AACnC,MAAA,OAAO,MAAA,CAAO,IAAA;AAAA,IAChB;AAEA,IAAA,IAAI,OAAO,MAAA,CAAO,SAAA,KAAc,QAAA,IAAY,MAAA,CAAO,cAAc,IAAA,EAAM;AACrE,MAAA,MAAM,QAAQ,MAAA,CAAO,SAAA;AACrB,MAAA,OAAO,OAAO,KAAA,CAAM,GAAA,KAAQ,QAAA,GAAW,MAAM,GAAA,GAAM,EAAA;AAAA,IACrD;AAEA,IAAA,OAAO,EAAA;AAAA,EACT,CAAC,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,KAAK,IAAI,CAAA;AAC9B;AAEA,SAAS,qBAAqB,SAAA,EAAmC;AAC/D,EAAA,OAAO,SAAA,EAAW,OAAA,CAAQ,CAAC,QAAA,KAAa;AACtC,IAAA,IAAI,QAAA,CAAS,IAAA,KAAS,UAAA,IAAc,EAAE,cAAc,QAAA,CAAA,EAAW;AAC7D,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,OAAO,CAAC;AAAA,MACN,IAAI,QAAA,CAAS,EAAA;AAAA,MACb,IAAA,EAAM,UAAA;AAAA,MACN,QAAA,EAAU;AAAA,QACR,IAAA,EAAM,SAAS,QAAA,CAAS,IAAA;AAAA,QACxB,SAAA,EAAW,SAAS,QAAA,CAAS;AAAA;AAC/B,KACD,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AAEA,eAAe,WAAA,CACb,IAAA,EACA,KAAA,EACA,KAAA,EACwD;AACxD,EAAA,MAAM,SAAS,MAAM,IAAA,CAAK,GAAG,GAAA,CAAI,GAAA,CAAI,MAAM,OAAA,EAAS;AAAA,IAClD,cAAc,KAAA,CAAM,YAAA;AAAA,IACpB,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,aAAa,KAAA,CAAM,WAAA;AAAA,IACnB,GAAG;AAAA,GACJ,CAAA;AAED,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO,EAAA,CAAG;AAAA,IACR,SAAS,MAAA,CAAO,IAAA;AAAA,IAChB,OAAO,KAAA,CAAM,KAAA,IAAS,KAAK,EAAA,CAAG,MAAA,EAAQ,IAAI,KAAA,IAAS;AAAA,GACpD,CAAA;AACH","file":"ai.js","sourcesContent":["/**\n * @h-ai/serv — AI 默认 procedures\n *\n * 基于 `@h-ai/ai` 提供开箱即用的 AI procedures 实现：对话补全、消息发送、聊天历史、记忆管理、会话列表。\n * 默认将所有读取和写入绑定到认证 session.userId；跨主体访问必须通过显式授权。\n * @module features/serv-feature-ai\n */\n\nimport type {\n  AIFunctions,\n  ChatCompletionRequest,\n  ChatCompletionResponse,\n  ChatMessage,\n  InteractionScope,\n  ToolCall,\n} from '@h-ai/ai'\nimport type {\n  AiChatCompletionData,\n  AiChatCompletionInput,\n  AiChatRecord,\n  AiSendMessageInput,\n} from '@h-ai/api-contract'\nimport type { HaiResult } from '@h-ai/core'\nimport type { ServContext } from '../serv-context.js'\nimport type { AuthenticatedServContext } from '../serv-router.js'\nimport { apiContract } from '@h-ai/api-contract'\nimport { err, HaiCommonError, ok } from '@h-ai/core'\nimport { servM } from '../serv-i18n.js'\nimport { implement } from '../serv-router.js'\nimport { wrapItemsResult } from './serv-feature-helpers.js'\n\nconst aiContract = apiContract.ai\n\n/**\n * 对不同于当前认证用户的 AI 主体进行授权的请求。\n *\n * @example\n * ```ts\n * import type { AiObjectAuthorizationRequest } from '@h-ai/serv/features/ai'\n *\n * const authorize = ({ context, operation }: AiObjectAuthorizationRequest) =>\n *   operation === 'history' && context.session.permissions.includes('ai.history.manage')\n * // 租户型应用还应在此核验目标 objectId 与当前租户的真实关系。\n * ```\n */\nexport interface AiObjectAuthorizationRequest {\n  /** 本次操作；授权可按读写能力分别限制。 */\n  readonly operation: 'completion' | 'message' | 'history' | 'memoryRecall' | 'memoryList' | 'sessions'\n  /** 可信认证上下文；不从客户端输入解析身份。 */\n  readonly context: AuthenticatedServContext\n  /** 请求访问的主体 ID；必须由策略核验所有者/租户关系。 */\n  readonly objectId: string\n  /** 请求指定的会话 ID；始终与 objectId 一起构成作用域。 */\n  readonly sessionId?: string\n}\n\n/**\n * AI 默认 procedures 依赖；只要求实际使用的 AI 能力。\n *\n * @example\n * ```ts\n * import { ai } from '@h-ai/ai'\n * import { createAiProcedures } from '@h-ai/serv/features/ai'\n *\n * // 宿主已初始化 AI 及其共享存储；省略策略时只允许当前 session.userId。\n * const procedures = createAiProcedures({ ai })\n * // 默认 completion 为非流式 JSON；object/session 作用域来自可信认证上下文。\n * ```\n */\nexport interface AiProcedureDeps {\n  readonly ai: Pick<AIFunctions, 'config'> & {\n    readonly llm: Pick<AIFunctions['llm'], 'chat' | 'ask' | 'getHistory' | 'listSessions'>\n    readonly memory: Pick<AIFunctions['memory'], 'recall' | 'listPage'>\n  }\n  /** 跨主体资源授权；省略时仅允许当前 session.userId，必须严格返回 true 才放行。 */\n  readonly authorizeObject?: (request: AiObjectAuthorizationRequest) => boolean | Promise<boolean>\n}\n\n/**\n * 创建以认证用户为默认主体的 AI procedures。\n * 补全仅返回非流式 JSON，完整转发 function 工具和角色消息；工具执行由业务方授权处理。\n *\n * @param deps - 已初始化 AI 能力及可选的跨主体授权策略。\n * @returns AI router；跨主体访问未获授权时返回 FORBIDDEN。\n *\n * @example\n * ```ts\n * import { ai } from '@h-ai/ai'\n * import { createAiProcedures } from '@h-ai/serv/features/ai'\n *\n * // 宿主已初始化 AI 及其共享存储；省略策略时只允许当前 session.userId。\n * const procedures = createAiProcedures({ ai })\n * // 默认 completion 为非流式 JSON；object/session 作用域来自可信认证上下文。\n * ```\n */\nexport function createAiProcedures(deps: AiProcedureDeps) {\n  async function resolveObjectId(\n    operation: AiObjectAuthorizationRequest['operation'],\n    context: AuthenticatedServContext,\n    input: { objectId?: string, sessionId?: string },\n  ): Promise<HaiResult<string>> {\n    const objectId = input.objectId ?? context.session.userId\n    if (objectId !== context.session.userId\n      && await deps.authorizeObject?.({ context, objectId, sessionId: input.sessionId, operation }) !== true) {\n      return err(HaiCommonError.FORBIDDEN, servM('serv_errorForbidden', { locale: context.locale }))\n    }\n    return ok(objectId)\n  }\n\n  return implement(aiContract)\n    .context<ServContext>()\n\n    .route('chats.createCompletion')\n    .auth()\n    .handle(async ({ input, context }) => {\n      const objectId = await resolveObjectId('completion', context, input)\n      if (!objectId.success)\n        return objectId\n      return mapChatCompletionResult(await deps.ai.llm.chat({\n        ...toChatCompletionRequest(input),\n        objectId: objectId.data,\n        sessionId: input.sessionId ?? 'default',\n        signal: context.request.signal,\n      }))\n    })\n\n    .route('chats.sendMessage')\n    .auth()\n    .handle(async ({ input, context }) => {\n      const objectId = await resolveObjectId('message', context, input)\n      if (!objectId.success)\n        return objectId\n      return sendMessage(deps, input, { objectId: objectId.data, sessionId: input.sessionId ?? 'default', signal: context.request.signal })\n    })\n\n    .route('chats.listHistory')\n    .auth()\n    .handle(async ({ input, context }) => {\n      const objectId = await resolveObjectId('history', context, input)\n      if (!objectId.success)\n        return objectId\n      const { sessionId, limit, order } = input\n      return mapChatRecordsResult(\n        await deps.ai.llm.getHistory({ objectId: objectId.data, sessionId }, { limit, order }),\n      )\n    })\n\n    .route('memories.recall')\n    .auth()\n    .handle(async ({ input, context }) => {\n      const objectId = await resolveObjectId('memoryRecall', context, input)\n      if (!objectId.success)\n        return objectId\n      const { query, ...options } = input\n      return wrapItemsResult(await deps.ai.memory.recall(query, { ...options, objectId: objectId.data }))\n    })\n\n    .route('memories.list')\n    .auth()\n    .handle(async ({ input, context }) => {\n      const objectId = await resolveObjectId('memoryList', context, input)\n      if (!objectId.success)\n        return objectId\n      return deps.ai.memory.listPage({ ...input, objectId: objectId.data })\n    })\n\n    .route('sessions.list')\n    .auth()\n    .handle(async ({ input, context }) => {\n      const objectId = await resolveObjectId('sessions', context, input)\n      if (!objectId.success)\n        return objectId\n      return wrapItemsResult(await deps.ai.llm.listSessions(objectId.data))\n    })\n\n    .build()\n}\n\nfunction toChatCompletionRequest(input: AiChatCompletionInput): ChatCompletionRequest {\n  return {\n    // Schema 已按角色校验完整消息，直接传递以保留 name、图片、tool_calls 和工具结果。\n    messages: input.messages,\n    model: input.model,\n    temperature: input.temperature,\n    top_p: input.top_p,\n    max_tokens: input.max_tokens,\n    tools: input.tools,\n    tool_choice: input.tool_choice,\n  }\n}\n\nfunction mapChatCompletionResult(result: HaiResult<ChatCompletionResponse>): HaiResult<AiChatCompletionData> {\n  if (!result.success) {\n    return result\n  }\n\n  return ok({\n    id: result.data.id,\n    object: 'chat.completion',\n    created: result.data.created,\n    model: result.data.model,\n    choices: result.data.choices.map(choice => ({\n      index: choice.index,\n      message: {\n        role: 'assistant',\n        content: choice.message.content ?? null,\n        tool_calls: mapFunctionToolCalls(choice.message.tool_calls),\n      },\n      finish_reason: toApiFinishReason(choice.finish_reason),\n    })),\n    usage: {\n      prompt_tokens: result.data.usage?.prompt_tokens ?? 0,\n      completion_tokens: result.data.usage?.completion_tokens ?? 0,\n      total_tokens: result.data.usage?.total_tokens ?? 0,\n    },\n  })\n}\n\nfunction toApiFinishReason(reason: string | null): AiChatCompletionData['choices'][number]['finish_reason'] {\n  if (reason === 'length' || reason === 'tool_calls' || reason === 'content_filter') {\n    return reason\n  }\n\n  return 'stop'\n}\n\nfunction mapChatRecordsResult(result: HaiResult<Array<import('@h-ai/ai').ChatRecord>>): HaiResult<{ items: AiChatRecord[] }> {\n  if (!result.success) {\n    return result\n  }\n\n  return ok({ items: result.data.map(toApiChatRecord) })\n}\n\nfunction toApiChatRecord(record: import('@h-ai/ai').ChatRecord): AiChatRecord {\n  return {\n    id: record.id,\n    objectId: record.objectId,\n    sessionId: record.sessionId,\n    request: {\n      model: record.request.model,\n      messages: record.request.messages.map(toApiChatMessage),\n    },\n    response: {\n      content: record.response.content,\n      toolCalls: mapFunctionToolCalls(record.response.toolCalls),\n      finishReason: record.response.finishReason,\n      usage: {\n        prompt_tokens: record.response.usage.prompt_tokens,\n        completion_tokens: record.response.usage.completion_tokens,\n        total_tokens: record.response.usage.total_tokens,\n      },\n    },\n    createdAt: record.createdAt,\n    duration: record.duration,\n  }\n}\n\nfunction toApiChatMessage(message: ChatMessage): AiChatCompletionInput['messages'][number] {\n  if (message.role === 'tool') {\n    return { role: 'tool', content: toContentText(message.content), tool_call_id: message.tool_call_id }\n  }\n\n  if (message.role === 'assistant') {\n    return {\n      role: 'assistant',\n      content: toContentText(message.content),\n      name: message.name,\n      tool_calls: mapFunctionToolCalls(message.tool_calls),\n    }\n  }\n\n  if (message.role === 'user') {\n    return { role: 'user', content: toContentText(message.content), name: message.name }\n  }\n\n  return { role: 'system', content: toContentText(message.content), name: message.role === 'system' || message.role === 'developer' ? message.name : undefined }\n}\n\nfunction toContentText(content: unknown): string {\n  if (typeof content === 'string') {\n    return content\n  }\n\n  if (!Array.isArray(content)) {\n    return ''\n  }\n\n  return content.map((part) => {\n    if (typeof part !== 'object' || part === null) {\n      return ''\n    }\n\n    const record = part as Record<string, unknown>\n    if (typeof record.text === 'string') {\n      return record.text\n    }\n\n    if (typeof record.image_url === 'object' && record.image_url !== null) {\n      const image = record.image_url as Record<string, unknown>\n      return typeof image.url === 'string' ? image.url : ''\n    }\n\n    return ''\n  }).filter(Boolean).join('\\n')\n}\n\nfunction mapFunctionToolCalls(toolCalls: ToolCall[] | undefined) {\n  return toolCalls?.flatMap((toolCall) => {\n    if (toolCall.type !== 'function' || !('function' in toolCall)) {\n      return []\n    }\n\n    return [{\n      id: toolCall.id,\n      type: 'function' as const,\n      function: {\n        name: toolCall.function.name,\n        arguments: toolCall.function.arguments,\n      },\n    }]\n  })\n}\n\nasync function sendMessage(\n  deps: AiProcedureDeps,\n  input: AiSendMessageInput,\n  scope: InteractionScope & { signal: AbortSignal },\n): Promise<HaiResult<{ content: string, model: string }>> {\n  const result = await deps.ai.llm.ask(input.message, {\n    systemPrompt: input.systemPrompt,\n    model: input.model,\n    temperature: input.temperature,\n    ...scope,\n  })\n\n  if (!result.success) {\n    return result\n  }\n\n  return ok({\n    content: result.data,\n    model: input.model ?? deps.ai.config?.llm.model ?? 'default',\n  })\n}\n"]}

package/dist/features/iam.d.ts

@@ -4,14 +4,40 @@ import * as zod from 'zod';
 import * as _orpc_contract from '@orpc/contract';
 import { IamFunctions } from '@h-ai/iam';
 export { TokenPair } from '@h-ai/iam';
-import { S as ServContext } from '../serv-context-CWzyrsdq.js';
+import { S as ServContext } from '../serv-context-C48WdBcd.js';
 import '@h-ai/core';
 
-/** IAM 默认 procedures 依赖。 */
+/**
+ * IAM 默认 procedures 依赖。
+ *
+ * @example
+ * ```ts
+ * import { iam } from '@h-ai/iam'
+ * import { createIamProcedures } from '@h-ai/serv/features/iam'
+ *
+ * // 宿主已初始化 IAM 及共享依赖。
+ * const procedures = createIamProcedures({ iam })
+ * // logout 撤销请求持有的 opaque access token；过期 access 也可撤销 refresh，
+ * // 不接收 userId，不要求有效 access 的 auth guard，失败仍检查 HaiResult。
+ * ```
+ */
 interface IamProcedureDeps {
     readonly iam: IamFunctions;
 }
-/** 创建 IAM 默认 procedures。 */
+/**
+ * 创建默认 IAM procedures；按操作声明认证/权限。logout 只撤销请求持有的完整 opaque token，不要求该 access 尚有效，也不能按 userId 撤销。
+ *
+ * @example
+ * ```ts
+ * import { iam } from '@h-ai/iam'
+ * import { createIamProcedures } from '@h-ai/serv/features/iam'
+ *
+ * // 宿主已初始化 IAM 及共享依赖。
+ * const procedures = createIamProcedures({ iam })
+ * // logout 撤销请求持有的 opaque access token；过期 access 也可撤销 refresh，
+ * // 不接收 userId，不要求有效 access 的 auth guard，失败仍检查 HaiResult。
+ * ```
+ */
 declare function createIamProcedures(deps: IamProcedureDeps): {
     auth: {
         publicConfig: _orpc_server.Procedure<ServContext & {}, any, _orpc_contract.Schema<unknown, unknown>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
@@ -174,7 +200,6 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
         login: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
             identifier: zod.ZodString;
             password: zod.ZodString;
-            rememberMe: zod.ZodOptional<zod.ZodBoolean>;
         }, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
             success: zod.ZodLiteral<true>;
             data: zod.ZodObject<{

package/dist/features/iam.js

@@ -1,5 +1,5 @@
-import { mapHaiResult } from '../chunk-27PCPE37.js';
-import { implement, servM } from '../chunk-R354OMWL.js';
+import { mapHaiResult } from '../chunk-XKCLD42I.js';
+import { implement, servM } from '../chunk-TWHCU6HT.js';
 import { apiContract } from '@h-ai/api-contract';
 import { core, ok, err, HaiCommonError } from '@h-ai/core';
 
@@ -7,7 +7,7 @@ var iamContract = apiContract.iam;
 var iamFeatureLogger = core.logger.child({ module: "serv", scope: "feature-iam" });
 function createIamProcedures(deps) {
   const { iam } = deps;
-  return implement(iamContract).context().route("auth.login", ({ input }) => iam.auth.login(input)).route("auth.loginWithOtp", ({ input }) => iam.auth.loginWithOtp(input)).route("auth.loginWithLdap", ({ input }) => iam.auth.loginWithLdap(input)).route("auth.publicConfig", () => ok(iam.publicConfig)).route("auth.requestPasswordReset", ({ input }) => iam.user.requestPasswordReset(input.identifier)).route("auth.confirmPasswordReset", ({ input }) => iam.user.confirmPasswordReset(input.token, input.newPassword)).route("auth.logout").auth().handle(({ input, context }) => {
+  return implement(iamContract).context().route("auth.login", ({ input }) => iam.auth.login(input)).route("auth.loginWithOtp", ({ input }) => iam.auth.loginWithOtp(input)).route("auth.loginWithLdap", ({ input }) => iam.auth.loginWithLdap(input)).route("auth.publicConfig", () => ok(iam.publicConfig)).route("auth.requestPasswordReset", ({ input }) => iam.user.requestPasswordReset(input.identifier)).route("auth.confirmPasswordReset", ({ input }) => iam.user.confirmPasswordReset(input.token, input.newPassword)).route("auth.logout", ({ input, context }) => {
     const token = input.accessToken ?? context.accessToken;
     if (!token)
       return err(HaiCommonError.UNAUTHORIZED, servM("serv_errorUnauthorized", { locale: context.locale }));

package/dist/features/iam.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/features/serv-feature-iam.ts"],"names":[],"mappings":";;;;;AAqBA,IAAM,cAAc,WAAA,CAAY,GAAA;AAEhC,IAAM,gBAAA,GAAmB,KAAK,MAAA,CAAO,KAAA,CAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,KAAA,EAAO,aAAA,EAAe,CAAA;AAQ5E,SAAS,oBAAoB,IAAA,EAAwB;AAC1D,EAAA,MAAM,EAAE,KAAI,GAAI,IAAA;AAEhB,EAAA,OAAO,UAAU,WAAW,CAAA,CACzB,SAAqB,CAErB,KAAA,CAAM,cAAc,CAAC,EAAE,KAAA,EAAM,KAAM,IAAI,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA,CACxD,MAAM,mBAAA,EAAqB,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,IAAA,CAAK,aAAa,KAAK,CAAC,EACtE,KAAA,CAAM,oBAAA,EAAsB,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,IAAA,CAAK,cAAc,KAAK,CAAC,EACxE,KAAA,CAAM,mBAAA,EAAqB,MAAM,EAAA,CAAG,IAAI,YAAY,CAAC,EACrD,KAAA,CAAM,2BAAA,EAA6B,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,IAAA,CAAK,qBAAqB,KAAA,CAAM,UAAU,CAAC,CAAA,CACjG,KAAA,CAAM,6BAA6B,CAAC,EAAE,KAAA,EAAM,KAAM,IAAI,IAAA,CAAK,oBAAA,CAAqB,MAAM,KAAA,EAAO,KAAA,CAAM,WAAW,CAAC,CAAA,CAE/G,MAAM,aAAa,CAAA,CACnB,MAAK,CACL,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,SAAQ,KAAM;AAC9B,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,WAAA,IAAe,OAAA,CAAQ,WAAA;AAC3C,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AACrG,IAAA,OAAO,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,KAAK,CAAA;AAAA,EAC9B,CAAC,CAAA,CAEA,KAAA,CAAM,kBAAkB,CAAA,CACxB,IAAA,EAAK,CACL,MAAA,CAAO,OAAO,EAAE,OAAA,EAAQ,KAAM;AAC7B,IAAA,MAAM,QAAQ,OAAA,CAAQ,WAAA;AACtB,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AAErG,IAAA,OAAO,YAAA;AAAA,MACL,MAAM,GAAA,CAAI,IAAA,CAAK,cAAA,CAAe,KAAK,CAAA;AAAA,MACnC,CAAA,IAAA,MAAS;AAAA,QACP,GAAG,IAAA;AAAA,QACH,KAAA,EAAO,QAAQ,OAAA,CAAQ,KAAA;AAAA,QACvB,WAAA,EAAa,QAAQ,OAAA,CAAQ;AAAA,OAC/B;AAAA,KACF;AAAA,EACF,CAAC,CAAA,CAEA,KAAA,CAAM,gBAAgB,OAAO,EAAE,OAAM,KAAM;AAC1C,IAAA,OAAO,YAAA,CAAa,MAAM,GAAA,CAAI,OAAA,CAAQ,OAAA,CAAQ,KAAA,CAAM,YAAY,CAAA,EAAG,CAAA,MAAA,MAAW,EAAE,MAAA,EAAO,CAAE,CAAA;AAAA,EAC3F,CAAC,CAAA,CACA,KAAA,CAAM,cAAA,EAAgB,CAAC,EAAE,KAAA,EAAM,KAAM,GAAA,CAAI,IAAA,CAAK,QAAQ,KAAA,CAAM,UAAU,CAAC,CAAA,CACvE,MAAM,eAAA,EAAiB,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,IAAA,CAAK,gBAAA,CAAiB,KAAK,CAAC,CAAA,CAEtE,KAAA,CAAM,qBAAqB,CAAA,CAC3B,MAAK,CACL,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,SAAQ,KAAM;AAC9B,IAAA,MAAM,QAAQ,OAAA,CAAQ,WAAA;AACtB,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AACrG,IAAA,OAAO,IAAI,IAAA,CAAK,yBAAA,CAA0B,OAAO,KAAA,CAAM,WAAA,EAAa,MAAM,WAAW,CAAA;AAAA,EACvF,CAAC,CAAA,CAEA,KAAA,CAAM,wBAAwB,CAAA,CAC9B,IAAA,EAAK,CACL,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AAC9B,IAAA,MAAM,QAAQ,OAAA,CAAQ,WAAA;AACtB,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AACrG,IAAA,OAAO,GAAA,CAAI,IAAA,CAAK,iBAAA,CAAkB,KAAA,EAAO,KAAK,CAAA;AAAA,EAChD,CAAC,CAAA,CAEA,KAAA,CAAM,YAAY,CAAA,CAClB,UAAA,CAAW,gBAAgB,CAAA,CAC3B,MAAA,CAAO,CAAC,EAAE,OAAM,KAAM,GAAA,CAAI,KAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAE/C,KAAA,CAAM,WAAW,CAAA,CACjB,WAAW,gBAAgB,CAAA,CAC3B,OAAO,CAAC,EAAE,OAAM,KAAM,GAAA,CAAI,KAAK,OAAA,CAAQ,KAAA,CAAM,IAAI,EAAE,OAAA,EAAS,CAAC,OAAO,CAAA,EAAG,CAAC,CAAA,CAExE,KAAA,CAAM,cAAc,EACpB,UAAA,CAAW,iBAAiB,EAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,UAAA,CAAW,GAAA,EAAK,KAAK,CAAC,CAAA,CAE5C,MAAM,cAAc,CAAA,CACpB,WAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,WAAW,GAAA,EAAK,KAAK,CAAC,CAAA,CAE5C,KAAA,CAAM,cAAc,CAAA,CACpB,UAAA,CAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,SAAQ,KAAM;AAE9B,IAAA,IAAI,OAAA,CAAQ,OAAA,CAAQ,MAAA,KAAW,KAAA,CAAM,EAAA;AACnC,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,SAAA,EAAW,KAAA,CAAM,iCAAA,EAAmC,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AAC3G,IAAA,OAAO,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,KAAA,CAAM,EAAE,CAAA;AAAA,EACrC,CAAC,CAAA,CAEA,KAAA,CAAM,qBAAqB,CAAA,CAC3B,WAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,IAAI,IAAA,CAAK,kBAAA,CAAmB,MAAM,EAAA,EAAI,KAAA,CAAM,WAAW,CAAC,EAE9E,KAAA,CAAM,YAAY,CAAA,CAClB,UAAA,CAAW,gBAAgB,CAAA,CAC3B,MAAA,CAAO,MAAM,GAAA,CAAI,MAAM,WAAA,EAAa,EAEpC,KAAA,CAAM,WAAW,EACjB,UAAA,CAAW,gBAAgB,CAAA,CAC3B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,GAAA,CAAI,MAAM,OAAA,CAAQ,KAAA,CAAM,EAAE,CAAC,EAEjD,KAAA,CAAM,cAAc,EACpB,UAAA,CAAW,iBAAiB,EAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,KAAK,CAAC,CAAA,CAEjD,KAAA,CAAM,cAAc,CAAA,CACpB,WAAW,iBAAiB,CAAA,CAC5B,OAAO,CAAC,EAAE,OAAM,KAAM;AACrB,IAAA,MAAM,EAAE,EAAA,EAAI,GAAG,IAAA,EAAK,GAAI,KAAA;AACxB,IAAA,OAAO,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,EAAA,EAAI,IAAI,CAAA;AAAA,EACtC,CAAC,CAAA,CAEA,KAAA,CAAM,cAAc,CAAA,CACpB,UAAA,CAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,KAAA,CAAM,WAAW,KAAA,CAAM,EAAE,CAAC,CAAA,CAEpD,KAAA,CAAM,kBAAkB,CAAA,CACxB,UAAA,CAAW,sBAAsB,CAAA,CACjC,MAAA,CAAO,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,KAAA,CAAM,kBAAkB,KAAK,CAAC,EAExD,KAAA,CAAM,iBAAiB,EACvB,UAAA,CAAW,sBAAsB,EACjC,MAAA,CAAO,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,KAAA,CAAM,cAAc,KAAA,CAAM,EAAE,CAAC,CAAA,CAEvD,KAAA,CAAM,oBAAoB,CAAA,CAC1B,UAAA,CAAW,uBAAuB,CAAA,CAClC,MAAA,CAAO,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,KAAA,CAAM,iBAAiB,KAAK,CAAC,EAEvD,KAAA,CAAM,oBAAoB,EAC1B,UAAA,CAAW,uBAAuB,EAClC,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,IAAI,KAAA,CAAM,gBAAA,CAAiB,MAAM,EAAE,CAAC,EAE1D,KAAA,EAAM;AACX;AAEA,eAAe,UAAA,CAAW,KAAmB,KAAA,EAA0D;AACrG,EAAA,MAAM,cAAA,GAAiB,MAAM,GAAA,CAAI,IAAA,CAAK,WAAW,KAAK,CAAA;AACtD,EAAA,IAAI,CAAC,cAAA,CAAe,OAAA;AAClB,IAAA,OAAO,cAAA;AAET,EAAA,MAAM,MAAA,GAAS,cAAA,CAAe,IAAA,CAAK,IAAA,CAAK,EAAA;AAGxC,EAAA,eAAe,SAAS,MAAA,EAA+B;AACrD,IAAA,MAAM,YAAA,GAAe,MAAM,GAAA,CAAI,IAAA,CAAK,WAAW,MAAM,CAAA;AACrD,IAAA,IAAI,CAAC,YAAA,CAAa,OAAA;AAChB,MAAA,gBAAA,CAAiB,KAAA,CAAM,qDAAqD,EAAE,MAAA,EAAQ,QAAQ,KAAA,EAAO,YAAA,CAAa,OAAO,CAAA;AAAA,EAC7H;AAEA,EAAA,IAAI,KAAA,CAAM,YAAY,MAAA,EAAW;AAC/B,IAAA,MAAM,cAAc,MAAM,GAAA,CAAI,MAAM,SAAA,CAAU,MAAA,EAAQ,MAAM,OAAO,CAAA;AACnE,IAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AACxB,MAAA,MAAM,SAAS,kBAAkB,CAAA;AACjC,MAAA,OAAO,WAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,YAAY,KAAA,EAAO;AAC3B,IAAA,MAAM,YAAA,GAAe,MAAM,GAAA,CAAI,IAAA,CAAK,WAAW,MAAA,EAAQ,EAAE,OAAA,EAAS,KAAA,EAAO,CAAA;AACzE,IAAA,IAAI,CAAC,aAAa,OAAA,EAAS;AACzB,MAAA,MAAM,SAAS,wBAAwB,CAAA;AACvC,MAAA,OAAO,YAAA;AAAA,IACT;AACA,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,OAAO,EAAA,CAAG,cAAA,CAAe,IAAA,CAAK,IAAI,CAAA;AACpC;AAEA,eAAe,UAAA,CAAW,KAAmB,KAAA,EAA0D;AACrG,EAAA,MAAM,EAAE,EAAA,EAAI,OAAA,EAAS,GAAG,MAAK,GAAI,KAAA;AACjC,EAAA,MAAM,eAAe,MAAM,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,IAAI,IAAI,CAAA;AACvD,EAAA,IAAI,CAAC,YAAA,CAAa,OAAA;AAChB,IAAA,OAAO,YAAA;AAET,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,MAAM,cAAc,MAAM,GAAA,CAAI,KAAA,CAAM,SAAA,CAAU,IAAI,OAAO,CAAA;AACzD,IAAA,IAAI,CAAC,WAAA,CAAY,OAAA;AACf,MAAA,OAAO,WAAA;AAAA,EACX;AAEA,EAAA,OAAO,YAAA;AACT","file":"iam.js","sourcesContent":["/**\n * @h-ai/serv — IAM 默认 procedures\n *\n * 基于 `@h-ai/iam` 提供开箱即用的 IAM procedures 实现：认证、用户管理、角色权限 CRUD。\n * @module features/serv-feature-iam\n */\n\nimport type {\n  IamAdminCreateUserInput,\n  IamAdminUpdateUserInput,\n  IamCurrentUser,\n} from '@h-ai/api-contract'\nimport type { HaiResult } from '@h-ai/core'\nimport type { IamFunctions, TokenPair, User } from '@h-ai/iam'\nimport type { ServContext } from '../serv-context.js'\nimport { apiContract } from '@h-ai/api-contract'\nimport { core, err, HaiCommonError, ok } from '@h-ai/core'\nimport { servM } from '../serv-i18n.js'\nimport { implement } from '../serv-router.js'\nimport { mapHaiResult } from './serv-feature-helpers.js'\n\nconst iamContract = apiContract.iam\n\nconst iamFeatureLogger = core.logger.child({ module: 'serv', scope: 'feature-iam' })\n\n/** IAM 默认 procedures 依赖。 */\nexport interface IamProcedureDeps {\n  readonly iam: IamFunctions\n}\n\n/** 创建 IAM 默认 procedures。 */\nexport function createIamProcedures(deps: IamProcedureDeps) {\n  const { iam } = deps\n\n  return implement(iamContract)\n    .context<ServContext>()\n\n    .route('auth.login', ({ input }) => iam.auth.login(input))\n    .route('auth.loginWithOtp', ({ input }) => iam.auth.loginWithOtp(input))\n    .route('auth.loginWithLdap', ({ input }) => iam.auth.loginWithLdap(input))\n    .route('auth.publicConfig', () => ok(iam.publicConfig))\n    .route('auth.requestPasswordReset', ({ input }) => iam.user.requestPasswordReset(input.identifier))\n    .route('auth.confirmPasswordReset', ({ input }) => iam.user.confirmPasswordReset(input.token, input.newPassword))\n\n    .route('auth.logout')\n    .auth()\n    .handle(({ input, context }) => {\n      const token = input.accessToken ?? context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n      return iam.auth.logout(token)\n    })\n\n    .route('auth.currentUser')\n    .auth()\n    .handle(async ({ context }) => {\n      const token = context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n\n      return mapHaiResult<User, IamCurrentUser>(\n        await iam.user.getCurrentUser(token),\n        user => ({\n          ...user,\n          roles: context.session.roles,\n          permissions: context.session.permissions,\n        }),\n      )\n    })\n\n    .route('auth.refresh', async ({ input }) => {\n      return mapHaiResult(await iam.session.refresh(input.refreshToken), tokens => ({ tokens }))\n    })\n    .route('auth.sendOtp', ({ input }) => iam.auth.sendOtp(input.identifier))\n    .route('auth.register', ({ input }) => iam.auth.registerAndLogin(input))\n\n    .route('auth.changePassword')\n    .auth()\n    .handle(({ input, context }) => {\n      const token = context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n      return iam.user.changeCurrentUserPassword(token, input.oldPassword, input.newPassword)\n    })\n\n    .route('auth.updateCurrentUser')\n    .auth()\n    .handle(({ input, context }) => {\n      const token = context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n      return iam.user.updateCurrentUser(token, input)\n    })\n\n    .route('users.list')\n    .permission('iam.users.read')\n    .handle(({ input }) => iam.user.listUsers(input))\n\n    .route('users.get')\n    .permission('iam.users.read')\n    .handle(({ input }) => iam.user.getUser(input.id, { include: ['roles'] }))\n\n    .route('users.create')\n    .permission('iam.users.write')\n    .handle(({ input }) => createUser(iam, input))\n\n    .route('users.update')\n    .permission('iam.users.write')\n    .handle(({ input }) => updateUser(iam, input))\n\n    .route('users.delete')\n    .permission('iam.users.write')\n    .handle(({ input, context }) => {\n      // 防止自删：避免管理员误删自己的账号导致授权锁死。\n      if (context.session.userId === input.id)\n        return err(HaiCommonError.FORBIDDEN, servM('serv_iamCannotDeleteCurrentUser', { locale: context.locale }))\n      return iam.user.deleteUser(input.id)\n    })\n\n    .route('users.resetPassword')\n    .permission('iam.users.write')\n    .handle(({ input }) => iam.user.adminResetPassword(input.id, input.newPassword))\n\n    .route('roles.list')\n    .permission('iam.roles.read')\n    .handle(() => iam.authz.getAllRoles())\n\n    .route('roles.get')\n    .permission('iam.roles.read')\n    .handle(({ input }) => iam.authz.getRole(input.id))\n\n    .route('roles.create')\n    .permission('iam.roles.write')\n    .handle(({ input }) => iam.authz.createRole(input))\n\n    .route('roles.update')\n    .permission('iam.roles.write')\n    .handle(({ input }) => {\n      const { id, ...data } = input\n      return iam.authz.updateRole(id, data)\n    })\n\n    .route('roles.delete')\n    .permission('iam.roles.write')\n    .handle(({ input }) => iam.authz.deleteRole(input.id))\n\n    .route('permissions.list')\n    .permission('iam.permissions.read')\n    .handle(({ input }) => iam.authz.getAllPermissions(input))\n\n    .route('permissions.get')\n    .permission('iam.permissions.read')\n    .handle(({ input }) => iam.authz.getPermission(input.id))\n\n    .route('permissions.create')\n    .permission('iam.permissions.write')\n    .handle(({ input }) => iam.authz.createPermission(input))\n\n    .route('permissions.delete')\n    .permission('iam.permissions.write')\n    .handle(({ input }) => iam.authz.deletePermission(input.id))\n\n    .build()\n}\n\nasync function createUser(iam: IamFunctions, input: IamAdminCreateUserInput): Promise<HaiResult<User>> {\n  const registerResult = await iam.user.createUser(input)\n  if (!registerResult.success)\n    return registerResult\n\n  const userId = registerResult.data.user.id\n\n  // 任何后续步骤失败都需要回滚刚创建的用户，以避免重复用户名/邮箱错误阅存。\n  async function rollback(reason: string): Promise<void> {\n    const deleteResult = await iam.user.deleteUser(userId)\n    if (!deleteResult.success)\n      iamFeatureLogger.error('createUser rollback failed, orphan user may exist', { userId, reason, error: deleteResult.error })\n  }\n\n  if (input.roleIds !== undefined) {\n    const rolesResult = await iam.authz.syncRoles(userId, input.roleIds)\n    if (!rolesResult.success) {\n      await rollback('syncRoles failed')\n      return rolesResult\n    }\n  }\n\n  if (input.enabled === false) {\n    const updateResult = await iam.user.updateUser(userId, { enabled: false })\n    if (!updateResult.success) {\n      await rollback('initial disable failed')\n      return updateResult\n    }\n    return updateResult\n  }\n\n  return ok(registerResult.data.user)\n}\n\nasync function updateUser(iam: IamFunctions, input: IamAdminUpdateUserInput): Promise<HaiResult<User>> {\n  const { id, roleIds, ...data } = input\n  const updateResult = await iam.user.updateUser(id, data)\n  if (!updateResult.success)\n    return updateResult\n\n  if (roleIds) {\n    const rolesResult = await iam.authz.syncRoles(id, roleIds)\n    if (!rolesResult.success)\n      return rolesResult\n  }\n\n  return updateResult\n}\n\n// re-export 类型以便 IDE 跳转\nexport type { TokenPair }\n"]}
+{"version":3,"sources":["../../src/features/serv-feature-iam.ts"],"names":[],"mappings":";;;;;AAqBA,IAAM,cAAc,WAAA,CAAY,GAAA;AAEhC,IAAM,gBAAA,GAAmB,KAAK,MAAA,CAAO,KAAA,CAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,KAAA,EAAO,aAAA,EAAe,CAAA;AAkC5E,SAAS,oBAAoB,IAAA,EAAwB;AAC1D,EAAA,MAAM,EAAE,KAAI,GAAI,IAAA;AAEhB,EAAA,OAAO,UAAU,WAAW,CAAA,CACzB,OAAA,EAAqB,CAErB,MAAM,YAAA,EAAc,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,IAAA,CAAK,MAAM,KAAK,CAAC,EACxD,KAAA,CAAM,mBAAA,EAAqB,CAAC,EAAE,OAAM,KAAM,GAAA,CAAI,KAAK,YAAA,CAAa,KAAK,CAAC,CAAA,CACtE,KAAA,CAAM,oBAAA,EAAsB,CAAC,EAAE,KAAA,EAAM,KAAM,IAAI,IAAA,CAAK,aAAA,CAAc,KAAK,CAAC,CAAA,CACxE,KAAA,CAAM,mBAAA,EAAqB,MAAM,EAAA,CAAG,GAAA,CAAI,YAAY,CAAC,CAAA,CACrD,MAAM,2BAAA,EAA6B,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,IAAA,CAAK,qBAAqB,KAAA,CAAM,UAAU,CAAC,CAAA,CACjG,KAAA,CAAM,2BAAA,EAA6B,CAAC,EAAE,KAAA,EAAM,KAAM,IAAI,IAAA,CAAK,oBAAA,CAAqB,MAAM,KAAA,EAAO,KAAA,CAAM,WAAW,CAAC,EAE/G,KAAA,CAAM,aAAA,EAAe,CAAC,EAAE,KAAA,EAAO,SAAQ,KAAM;AAE5C,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,WAAA,IAAe,OAAA,CAAQ,WAAA;AAC3C,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AACrG,IAAA,OAAO,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,KAAK,CAAA;AAAA,EAC9B,CAAC,CAAA,CAEA,KAAA,CAAM,kBAAkB,CAAA,CACxB,IAAA,EAAK,CACL,MAAA,CAAO,OAAO,EAAE,OAAA,EAAQ,KAAM;AAC7B,IAAA,MAAM,QAAQ,OAAA,CAAQ,WAAA;AACtB,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AAErG,IAAA,OAAO,YAAA;AAAA,MACL,MAAM,GAAA,CAAI,IAAA,CAAK,cAAA,CAAe,KAAK,CAAA;AAAA,MACnC,CAAA,IAAA,MAAS;AAAA,QACP,GAAG,IAAA;AAAA,QACH,KAAA,EAAO,QAAQ,OAAA,CAAQ,KAAA;AAAA,QACvB,WAAA,EAAa,QAAQ,OAAA,CAAQ;AAAA,OAC/B;AAAA,KACF;AAAA,EACF,CAAC,CAAA,CAEA,KAAA,CAAM,gBAAgB,OAAO,EAAE,OAAM,KAAM;AAC1C,IAAA,OAAO,YAAA,CAAa,MAAM,GAAA,CAAI,OAAA,CAAQ,OAAA,CAAQ,KAAA,CAAM,YAAY,CAAA,EAAG,CAAA,MAAA,MAAW,EAAE,MAAA,EAAO,CAAE,CAAA;AAAA,EAC3F,CAAC,CAAA,CACA,KAAA,CAAM,cAAA,EAAgB,CAAC,EAAE,KAAA,EAAM,KAAM,GAAA,CAAI,IAAA,CAAK,QAAQ,KAAA,CAAM,UAAU,CAAC,CAAA,CACvE,MAAM,eAAA,EAAiB,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,IAAA,CAAK,gBAAA,CAAiB,KAAK,CAAC,CAAA,CAEtE,KAAA,CAAM,qBAAqB,CAAA,CAC3B,MAAK,CACL,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,SAAQ,KAAM;AAC9B,IAAA,MAAM,QAAQ,OAAA,CAAQ,WAAA;AACtB,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AACrG,IAAA,OAAO,IAAI,IAAA,CAAK,yBAAA,CAA0B,OAAO,KAAA,CAAM,WAAA,EAAa,MAAM,WAAW,CAAA;AAAA,EACvF,CAAC,CAAA,CAEA,KAAA,CAAM,wBAAwB,CAAA,CAC9B,IAAA,EAAK,CACL,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AAC9B,IAAA,MAAM,QAAQ,OAAA,CAAQ,WAAA;AACtB,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AACrG,IAAA,OAAO,GAAA,CAAI,IAAA,CAAK,iBAAA,CAAkB,KAAA,EAAO,KAAK,CAAA;AAAA,EAChD,CAAC,CAAA,CAEA,KAAA,CAAM,YAAY,CAAA,CAClB,UAAA,CAAW,gBAAgB,CAAA,CAC3B,MAAA,CAAO,CAAC,EAAE,OAAM,KAAM,GAAA,CAAI,KAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAE/C,KAAA,CAAM,WAAW,CAAA,CACjB,WAAW,gBAAgB,CAAA,CAC3B,OAAO,CAAC,EAAE,OAAM,KAAM,GAAA,CAAI,KAAK,OAAA,CAAQ,KAAA,CAAM,IAAI,EAAE,OAAA,EAAS,CAAC,OAAO,CAAA,EAAG,CAAC,CAAA,CAExE,KAAA,CAAM,cAAc,EACpB,UAAA,CAAW,iBAAiB,EAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,UAAA,CAAW,GAAA,EAAK,KAAK,CAAC,CAAA,CAE5C,MAAM,cAAc,CAAA,CACpB,WAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,WAAW,GAAA,EAAK,KAAK,CAAC,CAAA,CAE5C,KAAA,CAAM,cAAc,CAAA,CACpB,UAAA,CAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,SAAQ,KAAM;AAE9B,IAAA,IAAI,OAAA,CAAQ,OAAA,CAAQ,MAAA,KAAW,KAAA,CAAM,EAAA;AACnC,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,SAAA,EAAW,KAAA,CAAM,iCAAA,EAAmC,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AAC3G,IAAA,OAAO,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,KAAA,CAAM,EAAE,CAAA;AAAA,EACrC,CAAC,CAAA,CAEA,KAAA,CAAM,qBAAqB,CAAA,CAC3B,WAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,IAAI,IAAA,CAAK,kBAAA,CAAmB,MAAM,EAAA,EAAI,KAAA,CAAM,WAAW,CAAC,EAE9E,KAAA,CAAM,YAAY,CAAA,CAClB,UAAA,CAAW,gBAAgB,CAAA,CAC3B,MAAA,CAAO,MAAM,GAAA,CAAI,MAAM,WAAA,EAAa,EAEpC,KAAA,CAAM,WAAW,EACjB,UAAA,CAAW,gBAAgB,CAAA,CAC3B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,GAAA,CAAI,MAAM,OAAA,CAAQ,KAAA,CAAM,EAAE,CAAC,EAEjD,KAAA,CAAM,cAAc,EACpB,UAAA,CAAW,iBAAiB,EAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,KAAK,CAAC,CAAA,CAEjD,KAAA,CAAM,cAAc,CAAA,CACpB,WAAW,iBAAiB,CAAA,CAC5B,OAAO,CAAC,EAAE,OAAM,KAAM;AACrB,IAAA,MAAM,EAAE,EAAA,EAAI,GAAG,IAAA,EAAK,GAAI,KAAA;AACxB,IAAA,OAAO,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,EAAA,EAAI,IAAI,CAAA;AAAA,EACtC,CAAC,CAAA,CAEA,KAAA,CAAM,cAAc,CAAA,CACpB,UAAA,CAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,KAAA,CAAM,WAAW,KAAA,CAAM,EAAE,CAAC,CAAA,CAEpD,KAAA,CAAM,kBAAkB,CAAA,CACxB,UAAA,CAAW,sBAAsB,CAAA,CACjC,MAAA,CAAO,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,KAAA,CAAM,kBAAkB,KAAK,CAAC,EAExD,KAAA,CAAM,iBAAiB,EACvB,UAAA,CAAW,sBAAsB,EACjC,MAAA,CAAO,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,KAAA,CAAM,cAAc,KAAA,CAAM,EAAE,CAAC,CAAA,CAEvD,KAAA,CAAM,oBAAoB,CAAA,CAC1B,UAAA,CAAW,uBAAuB,CAAA,CAClC,MAAA,CAAO,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,KAAA,CAAM,iBAAiB,KAAK,CAAC,EAEvD,KAAA,CAAM,oBAAoB,EAC1B,UAAA,CAAW,uBAAuB,EAClC,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,IAAI,KAAA,CAAM,gBAAA,CAAiB,MAAM,EAAE,CAAC,EAE1D,KAAA,EAAM;AACX;AAEA,eAAe,UAAA,CAAW,KAAmB,KAAA,EAA0D;AACrG,EAAA,MAAM,cAAA,GAAiB,MAAM,GAAA,CAAI,IAAA,CAAK,WAAW,KAAK,CAAA;AACtD,EAAA,IAAI,CAAC,cAAA,CAAe,OAAA;AAClB,IAAA,OAAO,cAAA;AAET,EAAA,MAAM,MAAA,GAAS,cAAA,CAAe,IAAA,CAAK,IAAA,CAAK,EAAA;AAGxC,EAAA,eAAe,SAAS,MAAA,EAA+B;AACrD,IAAA,MAAM,YAAA,GAAe,MAAM,GAAA,CAAI,IAAA,CAAK,WAAW,MAAM,CAAA;AACrD,IAAA,IAAI,CAAC,YAAA,CAAa,OAAA;AAChB,MAAA,gBAAA,CAAiB,KAAA,CAAM,qDAAqD,EAAE,MAAA,EAAQ,QAAQ,KAAA,EAAO,YAAA,CAAa,OAAO,CAAA;AAAA,EAC7H;AAEA,EAAA,IAAI,KAAA,CAAM,YAAY,MAAA,EAAW;AAC/B,IAAA,MAAM,cAAc,MAAM,GAAA,CAAI,MAAM,SAAA,CAAU,MAAA,EAAQ,MAAM,OAAO,CAAA;AACnE,IAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AACxB,MAAA,MAAM,SAAS,kBAAkB,CAAA;AACjC,MAAA,OAAO,WAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,YAAY,KAAA,EAAO;AAC3B,IAAA,MAAM,YAAA,GAAe,MAAM,GAAA,CAAI,IAAA,CAAK,WAAW,MAAA,EAAQ,EAAE,OAAA,EAAS,KAAA,EAAO,CAAA;AACzE,IAAA,IAAI,CAAC,aAAa,OAAA,EAAS;AACzB,MAAA,MAAM,SAAS,wBAAwB,CAAA;AACvC,MAAA,OAAO,YAAA;AAAA,IACT;AACA,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,OAAO,EAAA,CAAG,cAAA,CAAe,IAAA,CAAK,IAAI,CAAA;AACpC;AAEA,eAAe,UAAA,CAAW,KAAmB,KAAA,EAA0D;AACrG,EAAA,MAAM,EAAE,EAAA,EAAI,OAAA,EAAS,GAAG,MAAK,GAAI,KAAA;AACjC,EAAA,MAAM,eAAe,MAAM,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,IAAI,IAAI,CAAA;AACvD,EAAA,IAAI,CAAC,YAAA,CAAa,OAAA;AAChB,IAAA,OAAO,YAAA;AAET,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,MAAM,cAAc,MAAM,GAAA,CAAI,KAAA,CAAM,SAAA,CAAU,IAAI,OAAO,CAAA;AACzD,IAAA,IAAI,CAAC,WAAA,CAAY,OAAA;AACf,MAAA,OAAO,WAAA;AAAA,EACX;AAEA,EAAA,OAAO,YAAA;AACT","file":"iam.js","sourcesContent":["/**\n * @h-ai/serv — IAM 默认 procedures\n *\n * 基于 `@h-ai/iam` 提供开箱即用的 IAM procedures 实现：认证、用户管理、角色权限 CRUD。\n * @module features/serv-feature-iam\n */\n\nimport type {\n  IamAdminCreateUserInput,\n  IamAdminUpdateUserInput,\n  IamCurrentUser,\n} from '@h-ai/api-contract'\nimport type { HaiResult } from '@h-ai/core'\nimport type { IamFunctions, TokenPair, User } from '@h-ai/iam'\nimport type { ServContext } from '../serv-context.js'\nimport { apiContract } from '@h-ai/api-contract'\nimport { core, err, HaiCommonError, ok } from '@h-ai/core'\nimport { servM } from '../serv-i18n.js'\nimport { implement } from '../serv-router.js'\nimport { mapHaiResult } from './serv-feature-helpers.js'\n\nconst iamContract = apiContract.iam\n\nconst iamFeatureLogger = core.logger.child({ module: 'serv', scope: 'feature-iam' })\n\n/**\n * IAM 默认 procedures 依赖。\n *\n * @example\n * ```ts\n * import { iam } from '@h-ai/iam'\n * import { createIamProcedures } from '@h-ai/serv/features/iam'\n *\n * // 宿主已初始化 IAM 及共享依赖。\n * const procedures = createIamProcedures({ iam })\n * // logout 撤销请求持有的 opaque access token；过期 access 也可撤销 refresh，\n * // 不接收 userId，不要求有效 access 的 auth guard，失败仍检查 HaiResult。\n * ```\n */\nexport interface IamProcedureDeps {\n  readonly iam: IamFunctions\n}\n\n/**\n * 创建默认 IAM procedures；按操作声明认证/权限。logout 只撤销请求持有的完整 opaque token，不要求该 access 尚有效，也不能按 userId 撤销。\n *\n * @example\n * ```ts\n * import { iam } from '@h-ai/iam'\n * import { createIamProcedures } from '@h-ai/serv/features/iam'\n *\n * // 宿主已初始化 IAM 及共享依赖。\n * const procedures = createIamProcedures({ iam })\n * // logout 撤销请求持有的 opaque access token；过期 access 也可撤销 refresh，\n * // 不接收 userId，不要求有效 access 的 auth guard，失败仍检查 HaiResult。\n * ```\n */\nexport function createIamProcedures(deps: IamProcedureDeps) {\n  const { iam } = deps\n\n  return implement(iamContract)\n    .context<ServContext>()\n\n    .route('auth.login', ({ input }) => iam.auth.login(input))\n    .route('auth.loginWithOtp', ({ input }) => iam.auth.loginWithOtp(input))\n    .route('auth.loginWithLdap', ({ input }) => iam.auth.loginWithLdap(input))\n    .route('auth.publicConfig', () => ok(iam.publicConfig))\n    .route('auth.requestPasswordReset', ({ input }) => iam.user.requestPasswordReset(input.identifier))\n    .route('auth.confirmPasswordReset', ({ input }) => iam.user.confirmPasswordReset(input.token, input.newPassword))\n\n    .route('auth.logout', ({ input, context }) => {\n      // 仅撤销调用方持有的完整随机令牌；不要求 access 仍有效，也不接受 userId 撤销。\n      const token = input.accessToken ?? context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n      return iam.auth.logout(token)\n    })\n\n    .route('auth.currentUser')\n    .auth()\n    .handle(async ({ context }) => {\n      const token = context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n\n      return mapHaiResult<User, IamCurrentUser>(\n        await iam.user.getCurrentUser(token),\n        user => ({\n          ...user,\n          roles: context.session.roles,\n          permissions: context.session.permissions,\n        }),\n      )\n    })\n\n    .route('auth.refresh', async ({ input }) => {\n      return mapHaiResult(await iam.session.refresh(input.refreshToken), tokens => ({ tokens }))\n    })\n    .route('auth.sendOtp', ({ input }) => iam.auth.sendOtp(input.identifier))\n    .route('auth.register', ({ input }) => iam.auth.registerAndLogin(input))\n\n    .route('auth.changePassword')\n    .auth()\n    .handle(({ input, context }) => {\n      const token = context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n      return iam.user.changeCurrentUserPassword(token, input.oldPassword, input.newPassword)\n    })\n\n    .route('auth.updateCurrentUser')\n    .auth()\n    .handle(({ input, context }) => {\n      const token = context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n      return iam.user.updateCurrentUser(token, input)\n    })\n\n    .route('users.list')\n    .permission('iam.users.read')\n    .handle(({ input }) => iam.user.listUsers(input))\n\n    .route('users.get')\n    .permission('iam.users.read')\n    .handle(({ input }) => iam.user.getUser(input.id, { include: ['roles'] }))\n\n    .route('users.create')\n    .permission('iam.users.write')\n    .handle(({ input }) => createUser(iam, input))\n\n    .route('users.update')\n    .permission('iam.users.write')\n    .handle(({ input }) => updateUser(iam, input))\n\n    .route('users.delete')\n    .permission('iam.users.write')\n    .handle(({ input, context }) => {\n      // 防止自删：避免管理员误删自己的账号导致授权锁死。\n      if (context.session.userId === input.id)\n        return err(HaiCommonError.FORBIDDEN, servM('serv_iamCannotDeleteCurrentUser', { locale: context.locale }))\n      return iam.user.deleteUser(input.id)\n    })\n\n    .route('users.resetPassword')\n    .permission('iam.users.write')\n    .handle(({ input }) => iam.user.adminResetPassword(input.id, input.newPassword))\n\n    .route('roles.list')\n    .permission('iam.roles.read')\n    .handle(() => iam.authz.getAllRoles())\n\n    .route('roles.get')\n    .permission('iam.roles.read')\n    .handle(({ input }) => iam.authz.getRole(input.id))\n\n    .route('roles.create')\n    .permission('iam.roles.write')\n    .handle(({ input }) => iam.authz.createRole(input))\n\n    .route('roles.update')\n    .permission('iam.roles.write')\n    .handle(({ input }) => {\n      const { id, ...data } = input\n      return iam.authz.updateRole(id, data)\n    })\n\n    .route('roles.delete')\n    .permission('iam.roles.write')\n    .handle(({ input }) => iam.authz.deleteRole(input.id))\n\n    .route('permissions.list')\n    .permission('iam.permissions.read')\n    .handle(({ input }) => iam.authz.getAllPermissions(input))\n\n    .route('permissions.get')\n    .permission('iam.permissions.read')\n    .handle(({ input }) => iam.authz.getPermission(input.id))\n\n    .route('permissions.create')\n    .permission('iam.permissions.write')\n    .handle(({ input }) => iam.authz.createPermission(input))\n\n    .route('permissions.delete')\n    .permission('iam.permissions.write')\n    .handle(({ input }) => iam.authz.deletePermission(input.id))\n\n    .build()\n}\n\nasync function createUser(iam: IamFunctions, input: IamAdminCreateUserInput): Promise<HaiResult<User>> {\n  const registerResult = await iam.user.createUser(input)\n  if (!registerResult.success)\n    return registerResult\n\n  const userId = registerResult.data.user.id\n\n  // 任何后续步骤失败都需要回滚刚创建的用户，以避免重复用户名/邮箱错误阅存。\n  async function rollback(reason: string): Promise<void> {\n    const deleteResult = await iam.user.deleteUser(userId)\n    if (!deleteResult.success)\n      iamFeatureLogger.error('createUser rollback failed, orphan user may exist', { userId, reason, error: deleteResult.error })\n  }\n\n  if (input.roleIds !== undefined) {\n    const rolesResult = await iam.authz.syncRoles(userId, input.roleIds)\n    if (!rolesResult.success) {\n      await rollback('syncRoles failed')\n      return rolesResult\n    }\n  }\n\n  if (input.enabled === false) {\n    const updateResult = await iam.user.updateUser(userId, { enabled: false })\n    if (!updateResult.success) {\n      await rollback('initial disable failed')\n      return updateResult\n    }\n    return updateResult\n  }\n\n  return ok(registerResult.data.user)\n}\n\nasync function updateUser(iam: IamFunctions, input: IamAdminUpdateUserInput): Promise<HaiResult<User>> {\n  const { id, roleIds, ...data } = input\n  const updateResult = await iam.user.updateUser(id, data)\n  if (!updateResult.success)\n    return updateResult\n\n  if (roleIds) {\n    const rolesResult = await iam.authz.syncRoles(id, roleIds)\n    if (!rolesResult.success)\n      return rolesResult\n  }\n\n  return updateResult\n}\n\n// re-export 类型以便 IDE 跳转\nexport type { TokenPair }\n"]}

package/dist/features/storage.d.ts

@@ -2,20 +2,80 @@ import * as _orpc_server from '@orpc/server';
 import * as zod_v4_core from 'zod/v4/core';
 import * as zod from 'zod';
 import { StorageFunctions } from '@h-ai/storage';
-import { S as ServContext } from '../serv-context-CWzyrsdq.js';
+import { S as ServContext } from '../serv-context-C48WdBcd.js';
+import { A as AuthenticatedServContext } from '../serv-router-BX8hgYxo.js';
 import '@h-ai/core';
 
-/** Storage 默认 procedures 依赖。 */
+/**
+ * 存储资源授权请求；批量操作只有全部资源获准后才会调用存储。
+ *
+ * @example
+ * ```ts
+ * import { storage } from '@h-ai/storage'
+ * import { createStorageProcedures } from '@h-ai/serv/features/storage'
+ *
+ * // 宿主已初始化 Storage；用户根目录来自可信 session，含尾斜杠形成边界。
+ * const procedures = createStorageProcedures({ storage, authorize: ({ context, keys }) => {
+ *   const root = `users/${encodeURIComponent(context.session.userId)}/`
+ *   return keys.length > 0 && keys.every(key => key.startsWith(root))
+ * } })
+ * // 空列表前缀与相邻用户名前缀均不能匹配此根目录。
+ * ```
+ */
+interface StorageAccessRequest {
+    /** 操作类别；策略可分别授予读取、写入或删除权限。 */
+    readonly operation: 'download' | 'upload' | 'list' | 'metadata' | 'delete' | 'deleteMany';
+    /** 已通过认证的可信请求上下文。 */
+    readonly context: AuthenticatedServContext;
+    /** 单项/批量 key；list 操作仅包含请求的 prefix，未提供 prefix 时为空字符串。 */
+    readonly keys: readonly string[];
+}
+/**
+ * Storage 默认 procedures 依赖。
+ *
+ * @example
+ * ```ts
+ * import { storage } from '@h-ai/storage'
+ * import { createStorageProcedures } from '@h-ai/serv/features/storage'
+ *
+ * // 宿主已初始化 Storage；用户根目录来自可信 session，含尾斜杠形成边界。
+ * const procedures = createStorageProcedures({ storage, authorize: ({ context, keys }) => {
+ *   const root = `users/${encodeURIComponent(context.session.userId)}/`
+ *   return keys.length > 0 && keys.every(key => key.startsWith(root))
+ * } })
+ * // 空列表前缀与相邻用户名前缀均不能匹配此根目录。
+ * ```
+ */
 interface StorageProcedureDeps {
     readonly storage: StorageFunctions;
+    /** 必需的资源授权策略；返回 true 才允许执行，缺失策略时默认拒绝。 */
+    readonly authorize: (request: StorageAccessRequest) => boolean | Promise<boolean>;
 }
-/** 创建 Storage 默认 procedures。 */
+/**
+ * 创建具有认证、路径校验和资源授权的 Storage procedures。
+ *
+ * @param deps - 存储服务及必需的资源授权策略。
+ * @returns 可挂载至 serv.createApp 的存储 router；拒绝访问返回 FORBIDDEN。
+ *
+ * @example
+ * ```ts
+ * import { storage } from '@h-ai/storage'
+ * import { createStorageProcedures } from '@h-ai/serv/features/storage'
+ *
+ * // 宿主已初始化 Storage；用户根目录来自可信 session，含尾斜杠形成边界。
+ * const procedures = createStorageProcedures({ storage, authorize: ({ context, keys }) => {
+ *   const root = `users/${encodeURIComponent(context.session.userId)}/`
+ *   return keys.length > 0 && keys.every(key => key.startsWith(root))
+ * } })
+ * // 空列表前缀与相邻用户名前缀均不能匹配此根目录。
+ * ```
+ */
 declare function createStorageProcedures(deps: StorageProcedureDeps): {
     presignedUrls: {
         createDownload: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
             key: zod.ZodString;
             expiresIn: zod.ZodOptional<zod.ZodNumber>;
-        }, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
+        }, zod_v4_core.$strict>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
             success: zod.ZodLiteral<true>;
             data: zod.ZodObject<{
                 url: zod.ZodString;
@@ -38,9 +98,8 @@ declare function createStorageProcedures(deps: StorageProcedureDeps): {
         createUpload: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
             key: zod.ZodString;
             contentType: zod.ZodOptional<zod.ZodString>;
-            contentLength: zod.ZodOptional<zod.ZodNumber>;
             expiresIn: zod.ZodOptional<zod.ZodNumber>;
-        }, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
+        }, zod_v4_core.$strict>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
             success: zod.ZodLiteral<true>;
             data: zod.ZodObject<{
                 url: zod.ZodString;
@@ -142,7 +201,19 @@ declare function createStorageProcedures(deps: StorageProcedureDeps): {
             keys: zod.ZodArray<zod.ZodString>;
         }, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
             success: zod.ZodLiteral<true>;
-            data: zod.ZodVoid;
+            data: zod.ZodObject<{
+                deletedKeys: zod.ZodArray<zod.ZodString>;
+                failures: zod.ZodArray<zod.ZodObject<{
+                    key: zod.ZodString;
+                    code: zod.ZodString;
+                    retryable: zod.ZodBoolean;
+                    outcome: zod.ZodEnum<{
+                        unknown: "unknown";
+                        failed: "failed";
+                        notAttempted: "notAttempted";
+                    }>;
+                }, zod_v4_core.$strip>>;
+            }, zod_v4_core.$strip>;
         }, zod_v4_core.$strip>, zod.ZodObject<{
             success: zod.ZodLiteral<false>;
             error: zod.ZodObject<{
@@ -153,10 +224,24 @@ declare function createStorageProcedures(deps: StorageProcedureDeps): {
                 module: zod.ZodOptional<zod.ZodString>;
                 cause: zod.ZodOptional<zod.ZodUnknown>;
                 suggestion: zod.ZodOptional<zod.ZodString>;
-                ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
+                ext: zod.ZodOptional<zod.ZodObject<{
+                    deleteMany: zod.ZodOptional<zod.ZodObject<{
+                        deletedKeys: zod.ZodArray<zod.ZodString>;
+                        failures: zod.ZodArray<zod.ZodObject<{
+                            key: zod.ZodString;
+                            code: zod.ZodString;
+                            retryable: zod.ZodBoolean;
+                            outcome: zod.ZodEnum<{
+                                unknown: "unknown";
+                                failed: "failed";
+                                notAttempted: "notAttempted";
+                            }>;
+                        }, zod_v4_core.$strip>>;
+                    }, zod_v4_core.$strip>>;
+                }, zod_v4_core.$catchall<zod.ZodUnknown>>>;
             }, zod_v4_core.$strip>;
         }, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
     };
 };
 
-export { type StorageProcedureDeps, createStorageProcedures };
+export { type StorageAccessRequest, type StorageProcedureDeps, createStorageProcedures };

package/dist/features/storage.js

@@ -1,10 +1,11 @@
-import { mapHaiResult } from '../chunk-27PCPE37.js';
-import { implement, servM } from '../chunk-R354OMWL.js';
+import { validateInputOrFail } from '../chunk-BGWE4S6Z.js';
+import { mapHaiResult } from '../chunk-XKCLD42I.js';
+import { implement, servM } from '../chunk-TWHCU6HT.js';
 import { apiContract } from '@h-ai/api-contract';
-import { ok, err, HaiCommonError } from '@h-ai/core';
+import { err, HaiCommonError, ok } from '@h-ai/core';
+import { getStorageKeyIssue, StorageDeleteKeysSchema, STORAGE_KEY_MAX_BYTES } from '@h-ai/storage/schemas';
 
 var storageContract = apiContract.storage;
-var STORAGE_KEY_MAX_LENGTH = 1024;
 function buildStorageKeyValidationFailure(field, locale, messageKey, params) {
   const message = servM(messageKey, { locale, params });
   return err(
@@ -14,20 +15,24 @@ function buildStorageKeyValidationFailure(field, locale, messageKey, params) {
   );
 }
 function validateStorageKeyOrFail(key, locale, field = "key") {
-  if (key.trim() === "")
+  const issue = getStorageKeyIssue(key);
+  if (issue === "empty")
     return buildStorageKeyValidationFailure(field, locale, "serv_storageKeyRequired");
-  if (key.length > STORAGE_KEY_MAX_LENGTH) {
+  if (issue === "tooLong") {
     return buildStorageKeyValidationFailure(field, locale, "serv_storageKeyTooLong", {
-      max: STORAGE_KEY_MAX_LENGTH
+      max: STORAGE_KEY_MAX_BYTES
     });
   }
-  if (key.startsWith("/") || key.includes("\\") || key.includes("\0"))
+  if (issue === "characters")
     return buildStorageKeyValidationFailure(field, locale, "serv_storageKeyIllegalChars");
-  if (key.split("/").some((seg) => seg === "." || seg === ".."))
+  if (issue === "segments")
     return buildStorageKeyValidationFailure(field, locale, "serv_storageKeyDotSegments");
   return ok(key);
 }
 function validateStorageKeysOrFail(keys, locale) {
+  const parsed = validateInputOrFail(StorageDeleteKeysSchema, keys, locale);
+  if (!parsed.success)
+    return parsed;
   for (const [index, key] of keys.entries()) {
     const keyResult = validateStorageKeyOrFail(key, locale, `keys.${index}`);
     if (!keyResult.success)
@@ -37,10 +42,18 @@ function validateStorageKeysOrFail(keys, locale) {
 }
 function createStorageProcedures(deps) {
   const { storage } = deps;
+  async function authorize(request) {
+    if (typeof deps.authorize !== "function" || await deps.authorize(request) !== true)
+      return err(HaiCommonError.FORBIDDEN, servM("serv_errorForbidden", { locale: request.context.locale }));
+    return ok(void 0);
+  }
   return implement(storageContract).context().route("presignedUrls.createDownload").auth().handle(async ({ input, context }) => {
     const keyResult = validateStorageKeyOrFail(input.key, context.locale);
     if (!keyResult.success)
       return keyResult;
+    const access = await authorize({ context, operation: "download", keys: [keyResult.data] });
+    if (!access.success)
+      return access;
     const expiresIn = input.expiresIn ?? 900;
     return toPresignedResult(
       keyResult.data,
@@ -51,6 +64,9 @@ function createStorageProcedures(deps) {
     const keyResult = validateStorageKeyOrFail(input.key, context.locale);
     if (!keyResult.success)
       return keyResult;
+    const access = await authorize({ context, operation: "upload", keys: [keyResult.data] });
+    if (!access.success)
+      return access;
     const expiresIn = input.expiresIn ?? 900;
     const contentType = input.contentType ?? "application/octet-stream";
     const { key: _, ...options } = input;
@@ -59,20 +75,40 @@ function createStorageProcedures(deps) {
       expiresIn,
       await storage.presign.putUrl(keyResult.data, { ...options, expiresIn, contentType })
     );
-  }).route("files.list").auth().handle(({ input }) => storage.dir.list(input)).route("files.getMetadata").auth().handle(({ input, context }) => {
+  }).route("files.list").auth().handle(async ({ input, context }) => {
+    const prefix = input.prefix ?? "";
+    if (prefix) {
+      const prefixResult = validateStorageKeyOrFail(prefix, context.locale, "prefix");
+      if (!prefixResult.success)
+        return prefixResult;
+    }
+    const access = await authorize({ context, operation: "list", keys: [prefix] });
+    if (!access.success)
+      return access;
+    return storage.dir.list(input);
+  }).route("files.getMetadata").auth().handle(async ({ input, context }) => {
     const keyResult = validateStorageKeyOrFail(input.key, context.locale);
     if (!keyResult.success)
       return keyResult;
+    const access = await authorize({ context, operation: "metadata", keys: [keyResult.data] });
+    if (!access.success)
+      return access;
     return storage.file.head(keyResult.data);
-  }).route("files.delete").auth().handle(({ input, context }) => {
+  }).route("files.delete").auth().handle(async ({ input, context }) => {
     const keyResult = validateStorageKeyOrFail(input.key, context.locale);
     if (!keyResult.success)
       return keyResult;
+    const access = await authorize({ context, operation: "delete", keys: [keyResult.data] });
+    if (!access.success)
+      return access;
     return storage.file.delete(keyResult.data);
-  }).route("files.deleteMany").auth().handle(({ input, context }) => {
+  }).route("files.deleteMany").auth().handle(async ({ input, context }) => {
     const keysResult = validateStorageKeysOrFail(input.keys, context.locale);
     if (!keysResult.success)
       return keysResult;
+    const access = await authorize({ context, operation: "deleteMany", keys: keysResult.data });
+    if (!access.success)
+      return access;
     return storage.file.deleteMany(keysResult.data);
   }).build();
 }