@h-ai/serv 0.1.0-alpha.76 → 1.0.0-beta.10

package/dist/features/iam.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/features/serv-feature-iam.ts"],"names":[],"mappings":";;;;;AAsBA,IAAM,cAAc,WAAA,CAAY,GAAA;AAEhC,IAAM,gBAAA,GAAmB,KAAK,MAAA,CAAO,KAAA,CAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,KAAA,EAAO,aAAA,EAAe,CAAA;AAkC5E,SAAS,oBAAoB,IAAA,EAAwB;AAC1D,EAAA,MAAM,EAAE,KAAI,GAAI,IAAA;AAGhB,EAAA,eAAe,SAAA,CAAa,OAAA,EAAsB,SAAA,EAAmB,GAAA,EAAyD;AAC5H,IAAA,MAAM,MAAA,GAAS,IAAI,YAAA,EAAc,gBAAA;AACjC,IAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,MAAA,MAAM,OAAA,GAAU,MAAM,GAAA,CAAI,IAAA,CAAK,wBAAwB,OAAA,CAAQ,WAAA,IAAe,EAAA,EAAI,SAAA,EAAW,QAAQ,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,wBAAwB,KAAK,MAAS,CAAA;AAC/J,MAAA,IAAI,CAAC,OAAA,CAAQ,OAAA;AACX,QAAA,OAAO,OAAA;AAAA,IACX;AACA,IAAA,OAAO,GAAA,EAAI;AAAA,EACb;AAEA,EAAA,OAAO,SAAA,CAAU,WAAW,CAAA,CACzB,OAAA,EAAqB,CAErB,KAAA,CAAM,qBAAqB,CAAA,CAC3B,IAAA,EAAK,CACL,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM,GAAA,CAAI,IAAA,CAAK,cAAA,CAAe,OAAA,CAAQ,WAAA,IAAe,IAAI,KAAA,CAAM,QAAA,EAAU,KAAA,CAAM,SAAS,CAAC,CAAA,CAElH,KAAA,CAAM,YAAA,EAAc,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,KAAA,EAAO,OAAO,CAAC,CAAA,CAC1E,KAAA,CAAM,oBAAA,EAAsB,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,IAAA,CAAK,aAAA,CAAc,KAAK,CAAC,CAAA,CACxE,KAAA,CAAM,mBAAA,EAAqB,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM,GAAA,CAAI,IAAA,CAAK,YAAA,CAAa,KAAA,EAAO,OAAO,CAAC,CAAA,CACxF,KAAA,CAAM,oBAAA,EAAsB,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM,GAAA,CAAI,IAAA,CAAK,aAAA,CAAc,KAAA,EAAO,OAAO,CAAC,CAAA,CAC1F,MAAM,mBAAA,EAAqB,MAAM,GAAA,CAAI,eAAA,EAAiB,CAAA,CACtD,KAAA,CAAM,oBAAA,EAAsB,CAAC,EAAE,KAAA,EAAM,KAAM,GAAA,CAAI,IAAA,CAAK,aAAA,CAAc,KAAK,CAAC,EACxE,KAAA,CAAM,2BAAA,EAA6B,CAAC,EAAE,KAAA,EAAM,KAAM,GAAA,CAAI,IAAA,CAAK,oBAAA,CAAqB,KAAA,CAAM,UAAA,EAAY,KAAK,CAAC,CAAA,CACxG,KAAA,CAAM,2BAAA,EAA6B,CAAC,EAAE,KAAA,EAAM,KAAM,GAAA,CAAI,IAAA,CAAK,oBAAA,CAAqB,KAAA,CAAM,KAAA,EAAO,MAAM,WAAW,CAAC,CAAA,CAE/G,KAAA,CAAM,aAAA,EAAe,CAAC,EAAE,KAAA,EAAO,SAAQ,KAAM;AAE5C,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,WAAA,IAAe,OAAA,CAAQ,WAAA;AAC3C,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AACrG,IAAA,OAAO,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,KAAK,CAAA;AAAA,EAC9B,CAAC,EAEA,KAAA,CAAM,mBAAA,EAAqB,CAAC,EAAE,KAAA,EAAO,SAAQ,KAAM;AAElD,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,WAAA,IAAe,OAAA,CAAQ,WAAA;AAC3C,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AACrG,IAAA,OAAO,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,KAAK,CAAA;AAAA,EAC9B,CAAC,CAAA,CAEA,KAAA,CAAM,kBAAkB,CAAA,CACxB,IAAA,EAAK,CACL,MAAA,CAAO,OAAO,EAAE,OAAA,EAAQ,KAAM;AAC7B,IAAA,MAAM,QAAQ,OAAA,CAAQ,WAAA;AACtB,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AAErG,IAAA,OAAO,YAAA;AAAA,MACL,MAAM,GAAA,CAAI,IAAA,CAAK,cAAA,CAAe,KAAK,CAAA;AAAA,MACnC,CAAA,IAAA,MAAS;AAAA,QACP,GAAG,IAAA;AAAA,QACH,KAAA,EAAO,QAAQ,OAAA,CAAQ,KAAA;AAAA,QACvB,WAAA,EAAa,QAAQ,OAAA,CAAQ;AAAA,OAC/B;AAAA,KACF;AAAA,EACF,CAAC,CAAA,CAEA,KAAA,CAAM,gBAAgB,OAAO,EAAE,OAAM,KAAM;AAC1C,IAAA,OAAO,YAAA,CAAa,MAAM,GAAA,CAAI,OAAA,CAAQ,OAAA,CAAQ,KAAA,CAAM,YAAY,CAAA,EAAG,CAAA,MAAA,MAAW,EAAE,MAAA,EAAO,CAAE,CAAA;AAAA,EAC3F,CAAC,CAAA,CACA,KAAA,CAAM,gBAAgB,CAAC,EAAE,OAAM,KAAM,GAAA,CAAI,IAAA,CAAK,OAAA,CAAQ,MAAM,UAAA,EAAY,KAAK,CAAC,CAAA,CAC9E,KAAA,CAAM,iBAAiB,CAAC,EAAE,KAAA,EAAO,OAAA,OAAc,GAAA,CAAI,IAAA,CAAK,iBAAiB,KAAA,EAAO,OAAO,CAAC,CAAA,CAExF,KAAA,CAAM,qBAAqB,CAAA,CAC3B,MAAK,CACL,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,SAAQ,KAAM;AAC9B,IAAA,MAAM,QAAQ,OAAA,CAAQ,WAAA;AACtB,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AACrG,IAAA,OAAO,IAAI,IAAA,CAAK,yBAAA,CAA0B,OAAO,KAAA,CAAM,WAAA,EAAa,MAAM,WAAW,CAAA;AAAA,EACvF,CAAC,CAAA,CAEA,KAAA,CAAM,wBAAwB,CAAA,CAC9B,IAAA,EAAK,CACL,MAAA,CAAO,OAAO,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AACpC,IAAA,MAAM,QAAQ,OAAA,CAAQ,WAAA;AACtB,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AACrG,IAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,eAAA,EAAgB;AACzC,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA;AACV,MAAA,OAAO,MAAA;AAET,IAAA,MAAM,UAAA,GAAa;AAAA,MACjB,GAAI,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,IAAA,CAAK,CAAA,GAAA,KAAO,GAAA,KAAQ,WAAW,CAAA,GAAI,CAAC,oBAAoB,IAAI,EAAC;AAAA,MACpF,GAAI,KAAA,CAAM,SAAA,KAAc,SAAY,CAAC,oBAAoB,IAAI;AAAC,KAChE;AACA,IAAA,MAAM,SAAA,GAAY,UAAA,CAAW,IAAA,CAAK,CAAA,KAAA,KAAS,OAAO,IAAA,CAAK,gBAAA,CAAiB,UAAA,CAAW,QAAA,CAAS,KAAK,CAAC,CAAA,IAAK,UAAA,CAAW,CAAC,CAAA,IAAK,oBAAA;AACxH,IAAA,OAAO,SAAA,CAAU,SAAS,SAAA,EAAW,MAAM,IAAI,IAAA,CAAK,iBAAA,CAAkB,KAAA,EAAO,KAAK,CAAC,CAAA;AAAA,EACrF,CAAC,CAAA,CAEA,KAAA,CAAM,YAAY,CAAA,CAClB,UAAA,CAAW,gBAAgB,CAAA,CAC3B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAE/C,KAAA,CAAM,WAAW,CAAA,CACjB,UAAA,CAAW,gBAAgB,CAAA,CAC3B,MAAA,CAAO,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,EAAA,EAAI,EAAE,OAAA,EAAS,CAAC,OAAO,CAAA,EAAG,CAAC,CAAA,CAExE,KAAA,CAAM,cAAc,CAAA,CACpB,UAAA,CAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM,SAAA,CAAU,OAAA,EAAS,kBAAA,EAAoB,MAAM,UAAA,CAAW,KAAK,KAAK,CAAC,CAAC,CAAA,CAEnG,KAAA,CAAM,cAAc,CAAA,CACpB,UAAA,CAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM,SAAA,CAAU,OAAA,EAAS,kBAAA,EAAoB,MAAM,UAAA,CAAW,GAAA,EAAK,KAAK,CAAC,CAAC,CAAA,CAEnG,KAAA,CAAM,cAAc,CAAA,CACpB,UAAA,CAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM,SAAA,CAAU,OAAA,EAAS,kBAAA,EAAoB,MAAM,UAAA,CAAW,GAAA,EAAK,KAAK,CAAC,CAAC,CAAA,CAEnG,KAAA,CAAM,cAAc,CAAA,CACpB,UAAA,CAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AAE9B,IAAA,IAAI,OAAA,CAAQ,OAAA,CAAQ,MAAA,KAAW,KAAA,CAAM,EAAA;AACnC,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,SAAA,EAAW,KAAA,CAAM,iCAAA,EAAmC,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AAC3G,IAAA,OAAO,SAAA,CAAU,SAAS,kBAAA,EAAoB,MAAM,IAAI,IAAA,CAAK,UAAA,CAAW,KAAA,CAAM,EAAE,CAAC,CAAA;AAAA,EACnF,CAAC,EAEA,KAAA,CAAM,qBAAqB,EAC3B,UAAA,CAAW,iBAAiB,EAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,OAAc,SAAA,CAAU,OAAA,EAAS,2BAA2B,MAAM,GAAA,CAAI,KAAK,kBAAA,CAAmB,KAAA,CAAM,IAAI,KAAA,CAAM,WAAW,CAAC,CAAC,CAAA,CAE5I,MAAM,YAAY,CAAA,CAClB,WAAW,gBAAgB,CAAA,CAC3B,OAAO,MAAM,GAAA,CAAI,MAAM,WAAA,EAAa,EAEpC,KAAA,CAAM,WAAW,EACjB,UAAA,CAAW,gBAAgB,EAC3B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,EAAE,CAAC,EAEjD,KAAA,CAAM,cAAc,EACpB,UAAA,CAAW,iBAAiB,EAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,OAAc,SAAA,CAAU,OAAA,EAAS,oBAAoB,MAAM,GAAA,CAAI,MAAM,UAAA,CAAW,KAAK,CAAC,CAAC,CAAA,CAExG,MAAM,cAAc,CAAA,CACpB,WAAW,iBAAiB,CAAA,CAC5B,OAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AAC9B,IAAA,MAAM,EAAE,EAAA,EAAI,GAAG,IAAA,EAAK,GAAI,KAAA;AACxB,IAAA,OAAO,SAAA,CAAU,SAAS,kBAAA,EAAoB,MAAM,IAAI,KAAA,CAAM,UAAA,CAAW,EAAA,EAAI,IAAI,CAAC,CAAA;AAAA,EACpF,CAAC,CAAA,CAEA,KAAA,CAAM,cAAc,CAAA,CACpB,UAAA,CAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,SAAQ,KAAM,SAAA,CAAU,OAAA,EAAS,kBAAA,EAAoB,MAAM,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,KAAA,CAAM,EAAE,CAAC,CAAC,CAAA,CAE3G,KAAA,CAAM,kBAAkB,CAAA,CACxB,WAAW,sBAAsB,CAAA,CACjC,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,GAAA,CAAI,KAAA,CAAM,iBAAA,CAAkB,KAAK,CAAC,CAAA,CAExD,KAAA,CAAM,iBAAiB,CAAA,CACvB,WAAW,sBAAsB,CAAA,CACjC,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,GAAA,CAAI,MAAM,aAAA,CAAc,KAAA,CAAM,EAAE,CAAC,CAAA,CAEvD,KAAA,CAAM,oBAAoB,CAAA,CAC1B,WAAW,uBAAuB,CAAA,CAClC,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM,SAAA,CAAU,OAAA,EAAS,wBAAA,EAA0B,MAAM,GAAA,CAAI,KAAA,CAAM,gBAAA,CAAiB,KAAK,CAAC,CAAC,CAAA,CAEpH,KAAA,CAAM,oCAAoC,CAAA,CAC1C,UAAA,CAAW,uBAAuB,CAAA,CAClC,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM,SAAA,CAAU,OAAA,EAAS,uCAAuC,MAAM,GAAA,CAAI,KAAA,CAAM,gCAAA,CAAiC,KAAA,CAAM,EAAA,EAAI,KAAA,CAAM,mBAAmB,CAAC,CAAC,CAAA,CAE/K,KAAA,CAAM,oBAAoB,CAAA,CAC1B,UAAA,CAAW,uBAAuB,EAClC,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM,SAAA,CAAU,OAAA,EAAS,0BAA0B,MAAM,GAAA,CAAI,KAAA,CAAM,gBAAA,CAAiB,KAAA,CAAM,EAAE,CAAC,CAAC,EAEvH,KAAA,EAAM;AACX;AAEA,eAAe,UAAA,CAAW,KAAmB,KAAA,EAA+E;AAC1H,EAAA,MAAM,OAAA,GAAU,EAAE,UAAA,IAAc,KAAA,CAAA;AAChC,EAAA,MAAM,cAAA,GAAiB,UAAA,IAAc,KAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,KAAK,CAAA,GAAI,MAAM,GAAA,CAAI,IAAA,CAAK,WAAW,KAAK,CAAA;AAC/G,EAAA,IAAI,CAAC,cAAA,CAAe,OAAA;AAClB,IAAA,OAAO,cAAA;AAET,EAAA,MAAM,MAAA,GAAS,cAAA,CAAe,IAAA,CAAK,IAAA,CAAK,EAAA;AAGxC,EAAA,eAAe,SAAS,MAAA,EAA+B;AACrD,IAAA,IAAI,OAAA,EAAS;AAEX,MAAA,gBAAA,CAAiB,KAAA,CAAM,+CAAA,EAAiD,EAAE,MAAA,EAAQ,QAAQ,CAAA;AAC1F,MAAA;AAAA,IACF;AACA,IAAA,MAAM,YAAA,GAAe,MAAM,GAAA,CAAI,IAAA,CAAK,WAAW,MAAM,CAAA;AACrD,IAAA,IAAI,CAAC,YAAA,CAAa,OAAA;AAChB,MAAA,gBAAA,CAAiB,KAAA,CAAM,qDAAqD,EAAE,MAAA,EAAQ,QAAQ,KAAA,EAAO,YAAA,CAAa,OAAO,CAAA;AAAA,EAC7H;AAEA,EAAA,IAAI,KAAA,CAAM,YAAY,MAAA,EAAW;AAC/B,IAAA,MAAM,cAAc,MAAM,GAAA,CAAI,MAAM,SAAA,CAAU,MAAA,EAAQ,MAAM,OAAO,CAAA;AACnE,IAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AACxB,MAAA,MAAM,SAAS,kBAAkB,CAAA;AACjC,MAAA,OAAO,WAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,YAAY,KAAA,EAAO;AAC3B,IAAA,MAAM,YAAA,GAAe,MAAM,GAAA,CAAI,IAAA,CAAK,WAAW,MAAA,EAAQ,EAAE,OAAA,EAAS,KAAA,EAAO,CAAA;AACzE,IAAA,IAAI,CAAC,aAAa,OAAA,EAAS;AACzB,MAAA,MAAM,SAAS,wBAAwB,CAAA;AACvC,MAAA,OAAO,YAAA;AAAA,IACT;AACA,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,OAAO,EAAA,CAAG,cAAA,CAAe,IAAA,CAAK,IAAI,CAAA;AACpC;AAEA,eAAe,UAAA,CAAW,KAAmB,KAAA,EAA0D;AACrG,EAAA,MAAM,EAAE,EAAA,EAAI,OAAA,EAAS,GAAG,MAAK,GAAI,KAAA;AACjC,EAAA,MAAM,eAAe,MAAM,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,IAAI,IAAI,CAAA;AACvD,EAAA,IAAI,CAAC,YAAA,CAAa,OAAA;AAChB,IAAA,OAAO,YAAA;AAET,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,MAAM,cAAc,MAAM,GAAA,CAAI,KAAA,CAAM,SAAA,CAAU,IAAI,OAAO,CAAA;AACzD,IAAA,IAAI,CAAC,WAAA,CAAY,OAAA;AACf,MAAA,OAAO,WAAA;AAAA,EACX;AAEA,EAAA,OAAO,YAAA;AACT","file":"iam.js","sourcesContent":["/**\n * @h-ai/serv — IAM 默认 procedures\n *\n * 基于 `@h-ai/iam` 提供开箱即用的 IAM procedures 实现：认证、用户管理、角色权限 CRUD。\n * @module features/serv-feature-iam\n */\n\nimport type {\n  IamAdminCreateUserInput,\n  IamAdminUpdateUserInput,\n  IamCurrentUser,\n  IamInviteUserInput,\n} from '@h-ai/api-contract'\nimport type { HaiResult } from '@h-ai/core'\nimport type { IamFunctions, TokenPair, User } from '@h-ai/iam'\nimport type { ServContext } from '../serv-context.js'\nimport { apiContract } from '@h-ai/api-contract'\nimport { core, err, HaiCommonError, ok } from '@h-ai/core'\nimport { servM } from '../serv-i18n.js'\nimport { implement } from '../serv-router.js'\nimport { mapHaiResult } from './serv-feature-helpers.js'\n\nconst iamContract = apiContract.iam\n\nconst iamFeatureLogger = core.logger.child({ module: 'serv', scope: 'feature-iam' })\n\n/**\n * IAM 默认 procedures 依赖。\n *\n * @example\n * ```ts\n * import { iam } from '@h-ai/iam'\n * import { createIamProcedures } from '@h-ai/serv/features/iam'\n *\n * // 宿主已初始化 IAM 及共享依赖。\n * const procedures = createIamProcedures({ iam })\n * // logout 撤销请求持有的 opaque access token；过期 access 也可撤销 refresh，\n * // 不接收 userId，不要求有效 access 的 auth guard，失败仍检查 HaiResult。\n * ```\n */\nexport interface IamProcedureDeps {\n  readonly iam: IamFunctions\n}\n\n/**\n * 创建默认 IAM procedures；按操作声明认证/权限。logout 只撤销请求持有的完整 opaque token，不要求该 access 尚有效，也不能按 userId 撤销。\n *\n * @example\n * ```ts\n * import { iam } from '@h-ai/iam'\n * import { createIamProcedures } from '@h-ai/serv/features/iam'\n *\n * // 宿主已初始化 IAM 及共享依赖。\n * const procedures = createIamProcedures({ iam })\n * // logout 撤销请求持有的 opaque access token；过期 access 也可撤销 refresh，\n * // 不接收 userId，不要求有效 access 的 auth guard，失败仍检查 HaiResult。\n * ```\n */\nexport function createIamProcedures(deps: IamProcedureDeps) {\n  const { iam } = deps\n\n  // 权限守卫先执行；额外鉴别只绑定已授权操作，不提升原有权限。\n  async function sensitive<T>(context: ServContext, operation: string, run: () => Promise<HaiResult<T>>): Promise<HaiResult<T>> {\n    const policy = iam.publicConfig?.reauthentication\n    if (policy?.enabled) {\n      const checked = await iam.auth.checkSensitiveOperation(context.accessToken ?? '', operation, context.request.headers.get('x-hai-reauthentication') ?? undefined)\n      if (!checked.success)\n        return checked\n    }\n    return run()\n  }\n\n  return implement(iamContract)\n    .context<ServContext>()\n\n    .route('auth.reauthenticate')\n    .auth()\n    .handle(({ input, context }) => iam.auth.reauthenticate(context.accessToken ?? '', input.password, input.operation))\n\n    .route('auth.login', ({ input, context }) => iam.auth.login(input, context))\n    .route('auth.createCaptcha', ({ input }) => iam.auth.createCaptcha(input))\n    .route('auth.loginWithOtp', ({ input, context }) => iam.auth.loginWithOtp(input, context))\n    .route('auth.loginWithLdap', ({ input, context }) => iam.auth.loginWithLdap(input, context))\n    .route('auth.publicConfig', () => iam.getPublicConfig())\n    .route('auth.renewPassword', ({ input }) => iam.user.renewPassword(input))\n    .route('auth.requestPasswordReset', ({ input }) => iam.user.requestPasswordReset(input.identifier, input))\n    .route('auth.confirmPasswordReset', ({ input }) => iam.user.confirmPasswordReset(input.token, input.newPassword))\n\n    .route('auth.logout', ({ input, context }) => {\n      // 仅撤销调用方持有的完整随机令牌；不要求 access 仍有效，也不接受 userId 撤销。\n      const token = input.accessToken ?? context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n      return iam.auth.logout(token)\n    })\n\n    .route('auth.closeSession', ({ input, context }) => {\n      // 页面离开只撤销持有的会话，不清 Cookie，避免迟到响应覆盖下一文档的新登录。\n      const token = input.accessToken ?? context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n      return iam.auth.logout(token)\n    })\n\n    .route('auth.currentUser')\n    .auth()\n    .handle(async ({ context }) => {\n      const token = context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n\n      return mapHaiResult<User, IamCurrentUser>(\n        await iam.user.getCurrentUser(token),\n        user => ({\n          ...user,\n          roles: context.session.roles,\n          permissions: context.session.permissions,\n        }),\n      )\n    })\n\n    .route('auth.refresh', async ({ input }) => {\n      return mapHaiResult(await iam.session.refresh(input.refreshToken), tokens => ({ tokens }))\n    })\n    .route('auth.sendOtp', ({ input }) => iam.auth.sendOtp(input.identifier, input))\n    .route('auth.register', ({ input, context }) => iam.auth.registerAndLogin(input, context))\n\n    .route('auth.changePassword')\n    .auth()\n    .handle(({ input, context }) => {\n      const token = context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n      return iam.user.changeCurrentUserPassword(token, input.oldPassword, input.newPassword)\n    })\n\n    .route('auth.updateCurrentUser')\n    .auth()\n    .handle(async ({ input, context }) => {\n      const token = context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n      const policy = await iam.getPublicConfig()\n      if (!policy.success)\n        return policy\n      // 标准资料入口与独立资料/头像入口共用策略；混合更新优先使用资料用途。\n      const operations = [\n        ...(Object.keys(input).some(key => key !== 'avatarUrl') ? ['iam.profile.update'] : []),\n        ...(input.avatarUrl !== undefined ? ['iam.profile.avatar'] : []),\n      ]\n      const operation = operations.find(value => policy.data.reauthentication.operations.includes(value)) ?? operations[0] ?? 'iam.profile.update'\n      return sensitive(context, operation, () => iam.user.updateCurrentUser(token, input))\n    })\n\n    .route('users.list')\n    .permission('iam.users.read')\n    .handle(({ input }) => iam.user.listUsers(input))\n\n    .route('users.get')\n    .permission('iam.users.read')\n    .handle(({ input }) => iam.user.getUser(input.id, { include: ['roles'] }))\n\n    .route('users.create')\n    .permission('iam.users.write')\n    .handle(({ input, context }) => sensitive(context, 'iam.users.create', () => createUser(iam, input)))\n\n    .route('users.invite')\n    .permission('iam.users.write')\n    .handle(({ input, context }) => sensitive(context, 'iam.users.invite', () => createUser(iam, input)))\n\n    .route('users.update')\n    .permission('iam.users.write')\n    .handle(({ input, context }) => sensitive(context, 'iam.users.update', () => updateUser(iam, input)))\n\n    .route('users.delete')\n    .permission('iam.users.write')\n    .handle(({ input, context }) => {\n      // 防止自删：避免管理员误删自己的账号导致授权锁死。\n      if (context.session.userId === input.id)\n        return err(HaiCommonError.FORBIDDEN, servM('serv_iamCannotDeleteCurrentUser', { locale: context.locale }))\n      return sensitive(context, 'iam.users.delete', () => iam.user.deleteUser(input.id))\n    })\n\n    .route('users.resetPassword')\n    .permission('iam.users.write')\n    .handle(({ input, context }) => sensitive(context, 'iam.users.resetPassword', () => iam.user.adminResetPassword(input.id, input.newPassword)))\n\n    .route('roles.list')\n    .permission('iam.roles.read')\n    .handle(() => iam.authz.getAllRoles())\n\n    .route('roles.get')\n    .permission('iam.roles.read')\n    .handle(({ input }) => iam.authz.getRole(input.id))\n\n    .route('roles.create')\n    .permission('iam.roles.write')\n    .handle(({ input, context }) => sensitive(context, 'iam.roles.create', () => iam.authz.createRole(input)))\n\n    .route('roles.update')\n    .permission('iam.roles.write')\n    .handle(({ input, context }) => {\n      const { id, ...data } = input\n      return sensitive(context, 'iam.roles.update', () => iam.authz.updateRole(id, data))\n    })\n\n    .route('roles.delete')\n    .permission('iam.roles.write')\n    .handle(({ input, context }) => sensitive(context, 'iam.roles.delete', () => iam.authz.deleteRole(input.id)))\n\n    .route('permissions.list')\n    .permission('iam.permissions.read')\n    .handle(({ input }) => iam.authz.getAllPermissions(input))\n\n    .route('permissions.get')\n    .permission('iam.permissions.read')\n    .handle(({ input }) => iam.authz.getPermission(input.id))\n\n    .route('permissions.create')\n    .permission('iam.permissions.write')\n    .handle(({ input, context }) => sensitive(context, 'iam.permissions.create', () => iam.authz.createPermission(input)))\n\n    .route('permissions.setSensitiveOperations')\n    .permission('iam.permissions.write')\n    .handle(({ input, context }) => sensitive(context, 'iam.permissions.sensitiveOperations', () => iam.authz.setPermissionSensitiveOperations(input.id, input.sensitiveOperations)))\n\n    .route('permissions.delete')\n    .permission('iam.permissions.write')\n    .handle(({ input, context }) => sensitive(context, 'iam.permissions.delete', () => iam.authz.deletePermission(input.id)))\n\n    .build()\n}\n\nasync function createUser(iam: IamFunctions, input: IamAdminCreateUserInput | IamInviteUserInput): Promise<HaiResult<User>> {\n  const invited = !('password' in input)\n  const registerResult = 'password' in input ? await iam.user.createUser(input) : await iam.user.inviteUser(input)\n  if (!registerResult.success)\n    return registerResult\n\n  const userId = registerResult.data.user.id\n\n  // 任何后续步骤失败都需要回滚刚创建的用户，以避免重复用户名/邮箱错误阅存。\n  async function rollback(reason: string): Promise<void> {\n    if (invited) {\n      // 邀请可能已经送达，不能回滚外部已发布凭据；保留账号供管理员补齐配置。\n      iamFeatureLogger.error('Invited account requires configuration repair', { userId, reason })\n      return\n    }\n    const deleteResult = await iam.user.deleteUser(userId)\n    if (!deleteResult.success)\n      iamFeatureLogger.error('createUser rollback failed, orphan user may exist', { userId, reason, error: deleteResult.error })\n  }\n\n  if (input.roleIds !== undefined) {\n    const rolesResult = await iam.authz.syncRoles(userId, input.roleIds)\n    if (!rolesResult.success) {\n      await rollback('syncRoles failed')\n      return rolesResult\n    }\n  }\n\n  if (input.enabled === false) {\n    const updateResult = await iam.user.updateUser(userId, { enabled: false })\n    if (!updateResult.success) {\n      await rollback('initial disable failed')\n      return updateResult\n    }\n    return updateResult\n  }\n\n  return ok(registerResult.data.user)\n}\n\nasync function updateUser(iam: IamFunctions, input: IamAdminUpdateUserInput): Promise<HaiResult<User>> {\n  const { id, roleIds, ...data } = input\n  const updateResult = await iam.user.updateUser(id, data)\n  if (!updateResult.success)\n    return updateResult\n\n  if (roleIds) {\n    const rolesResult = await iam.authz.syncRoles(id, roleIds)\n    if (!rolesResult.success)\n      return rolesResult\n  }\n\n  return updateResult\n}\n\n// re-export 类型以便 IDE 跳转\nexport type { TokenPair }\n"]}
+{"version":3,"sources":["../../src/features/serv-feature-iam.ts"],"names":[],"mappings":";;;;;AAsBA,IAAM,cAAc,WAAA,CAAY,GAAA;AAEhC,IAAM,gBAAA,GAAmB,KAAK,MAAA,CAAO,KAAA,CAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,KAAA,EAAO,aAAA,EAAe,CAAA;AAkC5E,SAAS,oBAAoB,IAAA,EAAwB;AAC1D,EAAA,MAAM,EAAE,KAAI,GAAI,IAAA;AAGhB,EAAA,eAAe,SAAA,CAAa,OAAA,EAAsB,SAAA,EAAmB,GAAA,EAAyD;AAC5H,IAAA,MAAM,MAAA,GAAS,IAAI,YAAA,EAAc,gBAAA;AACjC,IAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,MAAA,MAAM,OAAA,GAAU,MAAM,GAAA,CAAI,IAAA,CAAK,wBAAwB,OAAA,CAAQ,WAAA,IAAe,EAAA,EAAI,SAAA,EAAW,QAAQ,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,wBAAwB,KAAK,MAAS,CAAA;AAC/J,MAAA,IAAI,CAAC,OAAA,CAAQ,OAAA;AACX,QAAA,OAAO,OAAA;AAAA,IACX;AACA,IAAA,OAAO,GAAA,EAAI;AAAA,EACb;AAEA,EAAA,OAAO,SAAA,CAAU,WAAW,CAAA,CACzB,OAAA,EAAqB,CAErB,KAAA,CAAM,qBAAqB,CAAA,CAC3B,IAAA,EAAK,CACL,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM,GAAA,CAAI,IAAA,CAAK,cAAA,CAAe,OAAA,CAAQ,WAAA,IAAe,IAAI,KAAA,CAAM,QAAA,EAAU,KAAA,CAAM,SAAS,CAAC,CAAA,CAElH,KAAA,CAAM,YAAA,EAAc,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,KAAA,EAAO,OAAO,CAAC,CAAA,CAC1E,KAAA,CAAM,oBAAA,EAAsB,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,IAAA,CAAK,aAAA,CAAc,KAAK,CAAC,CAAA,CACxE,KAAA,CAAM,mBAAA,EAAqB,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM,GAAA,CAAI,IAAA,CAAK,YAAA,CAAa,KAAA,EAAO,OAAO,CAAC,CAAA,CACxF,KAAA,CAAM,oBAAA,EAAsB,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM,GAAA,CAAI,IAAA,CAAK,aAAA,CAAc,KAAA,EAAO,OAAO,CAAC,CAAA,CAC1F,MAAM,mBAAA,EAAqB,MAAM,GAAA,CAAI,eAAA,EAAiB,CAAA,CACtD,KAAA,CAAM,oBAAA,EAAsB,CAAC,EAAE,KAAA,EAAM,KAAM,GAAA,CAAI,IAAA,CAAK,aAAA,CAAc,KAAK,CAAC,EACxE,KAAA,CAAM,2BAAA,EAA6B,CAAC,EAAE,KAAA,EAAM,KAAM,GAAA,CAAI,IAAA,CAAK,oBAAA,CAAqB,KAAA,CAAM,UAAA,EAAY,KAAK,CAAC,CAAA,CACxG,KAAA,CAAM,2BAAA,EAA6B,CAAC,EAAE,KAAA,EAAM,KAAM,GAAA,CAAI,IAAA,CAAK,oBAAA,CAAqB,KAAA,CAAM,KAAA,EAAO,MAAM,WAAW,CAAC,CAAA,CAE/G,KAAA,CAAM,aAAA,EAAe,CAAC,EAAE,KAAA,EAAO,SAAQ,KAAM;AAE5C,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,WAAA,IAAe,OAAA,CAAQ,WAAA;AAC3C,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AACrG,IAAA,OAAO,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,KAAK,CAAA;AAAA,EAC9B,CAAC,EAEA,KAAA,CAAM,mBAAA,EAAqB,CAAC,EAAE,KAAA,EAAO,SAAQ,KAAM;AAElD,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,WAAA,IAAe,OAAA,CAAQ,WAAA;AAC3C,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AACrG,IAAA,OAAO,GAAA,CAAI,IAAA,CAAK,MAAA,CAAO,KAAK,CAAA;AAAA,EAC9B,CAAC,CAAA,CAEA,KAAA,CAAM,kBAAkB,CAAA,CACxB,IAAA,EAAK,CACL,MAAA,CAAO,OAAO,EAAE,OAAA,EAAQ,KAAM;AAC7B,IAAA,MAAM,QAAQ,OAAA,CAAQ,WAAA;AACtB,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AAErG,IAAA,OAAO,YAAA;AAAA,MACL,MAAM,GAAA,CAAI,IAAA,CAAK,cAAA,CAAe,KAAK,CAAA;AAAA,MACnC,CAAA,IAAA,MAAS;AAAA,QACP,GAAG,IAAA;AAAA,QACH,KAAA,EAAO,QAAQ,OAAA,CAAQ,KAAA;AAAA,QACvB,WAAA,EAAa,QAAQ,OAAA,CAAQ;AAAA,OAC/B;AAAA,KACF;AAAA,EACF,CAAC,CAAA,CAEA,KAAA,CAAM,gBAAgB,OAAO,EAAE,OAAM,KAAM;AAC1C,IAAA,OAAO,YAAA,CAAa,MAAM,GAAA,CAAI,OAAA,CAAQ,OAAA,CAAQ,KAAA,CAAM,YAAY,CAAA,EAAG,CAAA,MAAA,MAAW,EAAE,MAAA,EAAO,CAAE,CAAA;AAAA,EAC3F,CAAC,CAAA,CACA,KAAA,CAAM,gBAAgB,CAAC,EAAE,OAAM,KAAM,GAAA,CAAI,IAAA,CAAK,OAAA,CAAQ,MAAM,UAAA,EAAY,KAAK,CAAC,CAAA,CAC9E,KAAA,CAAM,iBAAiB,CAAC,EAAE,KAAA,EAAO,OAAA,OAAc,GAAA,CAAI,IAAA,CAAK,iBAAiB,KAAA,EAAO,OAAO,CAAC,CAAA,CAExF,KAAA,CAAM,qBAAqB,CAAA,CAC3B,MAAK,CACL,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,SAAQ,KAAM;AAC9B,IAAA,MAAM,QAAQ,OAAA,CAAQ,WAAA;AACtB,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AACrG,IAAA,OAAO,IAAI,IAAA,CAAK,yBAAA,CAA0B,OAAO,KAAA,CAAM,WAAA,EAAa,MAAM,WAAW,CAAA;AAAA,EACvF,CAAC,CAAA,CAEA,KAAA,CAAM,wBAAwB,CAAA,CAC9B,IAAA,EAAK,CACL,MAAA,CAAO,OAAO,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AACpC,IAAA,MAAM,QAAQ,OAAA,CAAQ,WAAA;AACtB,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,KAAA,CAAM,wBAAA,EAA0B,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AACrG,IAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,eAAA,EAAgB;AACzC,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA;AACV,MAAA,OAAO,MAAA;AAET,IAAA,MAAM,UAAA,GAAa;AAAA,MACjB,GAAI,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,IAAA,CAAK,CAAA,GAAA,KAAO,GAAA,KAAQ,WAAW,CAAA,GAAI,CAAC,oBAAoB,IAAI,EAAC;AAAA,MACpF,GAAI,KAAA,CAAM,SAAA,KAAc,SAAY,CAAC,oBAAoB,IAAI;AAAC,KAChE;AACA,IAAA,MAAM,SAAA,GAAY,UAAA,CAAW,IAAA,CAAK,CAAA,KAAA,KAAS,OAAO,IAAA,CAAK,gBAAA,CAAiB,UAAA,CAAW,QAAA,CAAS,KAAK,CAAC,CAAA,IAAK,UAAA,CAAW,CAAC,CAAA,IAAK,oBAAA;AACxH,IAAA,OAAO,SAAA,CAAU,SAAS,SAAA,EAAW,MAAM,IAAI,IAAA,CAAK,iBAAA,CAAkB,KAAA,EAAO,KAAK,CAAC,CAAA;AAAA,EACrF,CAAC,CAAA,CAEA,KAAA,CAAM,YAAY,CAAA,CAClB,UAAA,CAAW,gBAAgB,CAAA,CAC3B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAE/C,KAAA,CAAM,WAAW,CAAA,CACjB,UAAA,CAAW,gBAAgB,CAAA,CAC3B,MAAA,CAAO,CAAC,EAAE,KAAA,OAAY,GAAA,CAAI,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,EAAA,EAAI,EAAE,OAAA,EAAS,CAAC,OAAO,CAAA,EAAG,CAAC,CAAA,CAExE,KAAA,CAAM,cAAc,CAAA,CACpB,UAAA,CAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM,SAAA,CAAU,OAAA,EAAS,kBAAA,EAAoB,MAAM,UAAA,CAAW,KAAK,KAAK,CAAC,CAAC,CAAA,CAEnG,KAAA,CAAM,cAAc,CAAA,CACpB,UAAA,CAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM,SAAA,CAAU,OAAA,EAAS,kBAAA,EAAoB,MAAM,UAAA,CAAW,GAAA,EAAK,KAAK,CAAC,CAAC,CAAA,CAEnG,KAAA,CAAM,cAAc,CAAA,CACpB,UAAA,CAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM,SAAA,CAAU,OAAA,EAAS,kBAAA,EAAoB,MAAM,UAAA,CAAW,GAAA,EAAK,KAAK,CAAC,CAAC,CAAA,CAEnG,KAAA,CAAM,cAAc,CAAA,CACpB,UAAA,CAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AAE9B,IAAA,IAAI,OAAA,CAAQ,OAAA,CAAQ,MAAA,KAAW,KAAA,CAAM,EAAA;AACnC,MAAA,OAAO,GAAA,CAAI,cAAA,CAAe,SAAA,EAAW,KAAA,CAAM,iCAAA,EAAmC,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AAC3G,IAAA,OAAO,SAAA,CAAU,SAAS,kBAAA,EAAoB,MAAM,IAAI,IAAA,CAAK,UAAA,CAAW,KAAA,CAAM,EAAE,CAAC,CAAA;AAAA,EACnF,CAAC,EAEA,KAAA,CAAM,qBAAqB,EAC3B,UAAA,CAAW,iBAAiB,EAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,OAAc,SAAA,CAAU,OAAA,EAAS,2BAA2B,MAAM,GAAA,CAAI,KAAK,kBAAA,CAAmB,KAAA,CAAM,IAAI,KAAA,CAAM,WAAW,CAAC,CAAC,CAAA,CAE5I,MAAM,YAAY,CAAA,CAClB,WAAW,gBAAgB,CAAA,CAC3B,OAAO,MAAM,GAAA,CAAI,MAAM,WAAA,EAAa,EAEpC,KAAA,CAAM,WAAW,EACjB,UAAA,CAAW,gBAAgB,EAC3B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,EAAE,CAAC,EAEjD,KAAA,CAAM,cAAc,EACpB,UAAA,CAAW,iBAAiB,EAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,OAAc,SAAA,CAAU,OAAA,EAAS,oBAAoB,MAAM,GAAA,CAAI,MAAM,UAAA,CAAW,KAAK,CAAC,CAAC,CAAA,CAExG,MAAM,cAAc,CAAA,CACpB,WAAW,iBAAiB,CAAA,CAC5B,OAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM;AAC9B,IAAA,MAAM,EAAE,EAAA,EAAI,GAAG,IAAA,EAAK,GAAI,KAAA;AACxB,IAAA,OAAO,SAAA,CAAU,SAAS,kBAAA,EAAoB,MAAM,IAAI,KAAA,CAAM,UAAA,CAAW,EAAA,EAAI,IAAI,CAAC,CAAA;AAAA,EACpF,CAAC,CAAA,CAEA,KAAA,CAAM,cAAc,CAAA,CACpB,UAAA,CAAW,iBAAiB,CAAA,CAC5B,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,SAAQ,KAAM,SAAA,CAAU,OAAA,EAAS,kBAAA,EAAoB,MAAM,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,KAAA,CAAM,EAAE,CAAC,CAAC,CAAA,CAE3G,KAAA,CAAM,kBAAkB,CAAA,CACxB,WAAW,sBAAsB,CAAA,CACjC,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,GAAA,CAAI,KAAA,CAAM,iBAAA,CAAkB,KAAK,CAAC,CAAA,CAExD,KAAA,CAAM,iBAAiB,CAAA,CACvB,WAAW,sBAAsB,CAAA,CACjC,MAAA,CAAO,CAAC,EAAE,KAAA,EAAM,KAAM,GAAA,CAAI,MAAM,aAAA,CAAc,KAAA,CAAM,EAAE,CAAC,CAAA,CAEvD,KAAA,CAAM,oBAAoB,CAAA,CAC1B,WAAW,uBAAuB,CAAA,CAClC,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM,SAAA,CAAU,OAAA,EAAS,wBAAA,EAA0B,MAAM,GAAA,CAAI,KAAA,CAAM,gBAAA,CAAiB,KAAK,CAAC,CAAC,CAAA,CAEpH,KAAA,CAAM,oCAAoC,CAAA,CAC1C,UAAA,CAAW,uBAAuB,CAAA,CAClC,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM,SAAA,CAAU,OAAA,EAAS,uCAAuC,MAAM,GAAA,CAAI,KAAA,CAAM,gCAAA,CAAiC,KAAA,CAAM,EAAA,EAAI,KAAA,CAAM,mBAAmB,CAAC,CAAC,CAAA,CAE/K,KAAA,CAAM,oBAAoB,CAAA,CAC1B,UAAA,CAAW,uBAAuB,EAClC,MAAA,CAAO,CAAC,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAM,SAAA,CAAU,OAAA,EAAS,0BAA0B,MAAM,GAAA,CAAI,KAAA,CAAM,gBAAA,CAAiB,KAAA,CAAM,EAAE,CAAC,CAAC,EAEvH,KAAA,EAAM;AACX;AAEA,eAAe,UAAA,CAAW,KAAmB,KAAA,EAA+E;AAC1H,EAAA,MAAM,OAAA,GAAU,EAAE,UAAA,IAAc,KAAA,CAAA;AAChC,EAAA,MAAM,cAAA,GAAiB,UAAA,IAAc,KAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,KAAK,CAAA,GAAI,MAAM,GAAA,CAAI,IAAA,CAAK,WAAW,KAAK,CAAA;AAC/G,EAAA,IAAI,CAAC,cAAA,CAAe,OAAA;AAClB,IAAA,OAAO,cAAA;AAET,EAAA,MAAM,MAAA,GAAS,cAAA,CAAe,IAAA,CAAK,IAAA,CAAK,EAAA;AAGxC,EAAA,eAAe,SAAS,MAAA,EAA+B;AACrD,IAAA,IAAI,OAAA,EAAS;AAEX,MAAA,gBAAA,CAAiB,KAAA,CAAM,+CAAA,EAAiD,EAAE,MAAA,EAAQ,QAAQ,CAAA;AAC1F,MAAA;AAAA,IACF;AACA,IAAA,MAAM,YAAA,GAAe,MAAM,GAAA,CAAI,IAAA,CAAK,WAAW,MAAM,CAAA;AACrD,IAAA,IAAI,CAAC,YAAA,CAAa,OAAA;AAChB,MAAA,gBAAA,CAAiB,KAAA,CAAM,qDAAqD,EAAE,MAAA,EAAQ,QAAQ,KAAA,EAAO,YAAA,CAAa,OAAO,CAAA;AAAA,EAC7H;AAEA,EAAA,IAAI,KAAA,CAAM,YAAY,MAAA,EAAW;AAC/B,IAAA,MAAM,cAAc,MAAM,GAAA,CAAI,MAAM,SAAA,CAAU,MAAA,EAAQ,MAAM,OAAO,CAAA;AACnE,IAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AACxB,MAAA,MAAM,SAAS,kBAAkB,CAAA;AACjC,MAAA,OAAO,WAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,OAAO,EAAA,CAAG,cAAA,CAAe,IAAA,CAAK,IAAI,CAAA;AACpC;AAEA,eAAe,UAAA,CAAW,KAAmB,KAAA,EAA0D;AACrG,EAAA,MAAM,EAAE,EAAA,EAAI,OAAA,EAAS,GAAG,MAAK,GAAI,KAAA;AACjC,EAAA,MAAM,eAAe,MAAM,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,IAAI,IAAI,CAAA;AACvD,EAAA,IAAI,CAAC,YAAA,CAAa,OAAA;AAChB,IAAA,OAAO,YAAA;AAET,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,MAAM,cAAc,MAAM,GAAA,CAAI,KAAA,CAAM,SAAA,CAAU,IAAI,OAAO,CAAA;AACzD,IAAA,IAAI,CAAC,WAAA,CAAY,OAAA;AACf,MAAA,OAAO,WAAA;AAAA,EACX;AAEA,EAAA,OAAO,YAAA;AACT","file":"iam.js","sourcesContent":["/**\n * @h-ai/serv — IAM 默认 procedures\n *\n * 基于 `@h-ai/iam` 提供开箱即用的 IAM procedures 实现：认证、用户管理、角色权限 CRUD。\n * @module features/serv-feature-iam\n */\n\nimport type {\n  IamAdminCreateUserInput,\n  IamAdminUpdateUserInput,\n  IamCurrentUser,\n  IamInviteUserInput,\n} from '@h-ai/api-contract'\nimport type { HaiResult } from '@h-ai/core'\nimport type { IamFunctions, TokenPair, User } from '@h-ai/iam'\nimport type { ServContext } from '../serv-context.js'\nimport { apiContract } from '@h-ai/api-contract'\nimport { core, err, HaiCommonError, ok } from '@h-ai/core'\nimport { servM } from '../serv-i18n.js'\nimport { implement } from '../serv-router.js'\nimport { mapHaiResult } from './serv-feature-helpers.js'\n\nconst iamContract = apiContract.iam\n\nconst iamFeatureLogger = core.logger.child({ module: 'serv', scope: 'feature-iam' })\n\n/**\n * IAM 默认 procedures 依赖。\n *\n * @example\n * ```ts\n * import { iam } from '@h-ai/iam'\n * import { createIamProcedures } from '@h-ai/serv/features/iam'\n *\n * // 宿主已初始化 IAM 及共享依赖。\n * const procedures = createIamProcedures({ iam })\n * // logout 撤销请求持有的 opaque access token；过期 access 也可撤销 refresh，\n * // 不接收 userId，不要求有效 access 的 auth guard，失败仍检查 HaiResult。\n * ```\n */\nexport interface IamProcedureDeps {\n  readonly iam: IamFunctions\n}\n\n/**\n * 创建默认 IAM procedures；按操作声明认证/权限。logout 只撤销请求持有的完整 opaque token，不要求该 access 尚有效，也不能按 userId 撤销。\n *\n * @example\n * ```ts\n * import { iam } from '@h-ai/iam'\n * import { createIamProcedures } from '@h-ai/serv/features/iam'\n *\n * // 宿主已初始化 IAM 及共享依赖。\n * const procedures = createIamProcedures({ iam })\n * // logout 撤销请求持有的 opaque access token；过期 access 也可撤销 refresh，\n * // 不接收 userId，不要求有效 access 的 auth guard，失败仍检查 HaiResult。\n * ```\n */\nexport function createIamProcedures(deps: IamProcedureDeps) {\n  const { iam } = deps\n\n  // 权限守卫先执行；额外鉴别只绑定已授权操作，不提升原有权限。\n  async function sensitive<T>(context: ServContext, operation: string, run: () => Promise<HaiResult<T>>): Promise<HaiResult<T>> {\n    const policy = iam.publicConfig?.reauthentication\n    if (policy?.enabled) {\n      const checked = await iam.auth.checkSensitiveOperation(context.accessToken ?? '', operation, context.request.headers.get('x-hai-reauthentication') ?? undefined)\n      if (!checked.success)\n        return checked\n    }\n    return run()\n  }\n\n  return implement(iamContract)\n    .context<ServContext>()\n\n    .route('auth.reauthenticate')\n    .auth()\n    .handle(({ input, context }) => iam.auth.reauthenticate(context.accessToken ?? '', input.password, input.operation))\n\n    .route('auth.login', ({ input, context }) => iam.auth.login(input, context))\n    .route('auth.createCaptcha', ({ input }) => iam.auth.createCaptcha(input))\n    .route('auth.loginWithOtp', ({ input, context }) => iam.auth.loginWithOtp(input, context))\n    .route('auth.loginWithLdap', ({ input, context }) => iam.auth.loginWithLdap(input, context))\n    .route('auth.publicConfig', () => iam.getPublicConfig())\n    .route('auth.renewPassword', ({ input }) => iam.user.renewPassword(input))\n    .route('auth.requestPasswordReset', ({ input }) => iam.user.requestPasswordReset(input.identifier, input))\n    .route('auth.confirmPasswordReset', ({ input }) => iam.user.confirmPasswordReset(input.token, input.newPassword))\n\n    .route('auth.logout', ({ input, context }) => {\n      // 仅撤销调用方持有的完整随机令牌；不要求 access 仍有效，也不接受 userId 撤销。\n      const token = input.accessToken ?? context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n      return iam.auth.logout(token)\n    })\n\n    .route('auth.closeSession', ({ input, context }) => {\n      // 页面离开只撤销持有的会话，不清 Cookie，避免迟到响应覆盖下一文档的新登录。\n      const token = input.accessToken ?? context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n      return iam.auth.logout(token)\n    })\n\n    .route('auth.currentUser')\n    .auth()\n    .handle(async ({ context }) => {\n      const token = context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n\n      return mapHaiResult<User, IamCurrentUser>(\n        await iam.user.getCurrentUser(token),\n        user => ({\n          ...user,\n          roles: context.session.roles,\n          permissions: context.session.permissions,\n        }),\n      )\n    })\n\n    .route('auth.refresh', async ({ input }) => {\n      return mapHaiResult(await iam.session.refresh(input.refreshToken), tokens => ({ tokens }))\n    })\n    .route('auth.sendOtp', ({ input }) => iam.auth.sendOtp(input.identifier, input))\n    .route('auth.register', ({ input, context }) => iam.auth.registerAndLogin(input, context))\n\n    .route('auth.changePassword')\n    .auth()\n    .handle(({ input, context }) => {\n      const token = context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n      return iam.user.changeCurrentUserPassword(token, input.oldPassword, input.newPassword)\n    })\n\n    .route('auth.updateCurrentUser')\n    .auth()\n    .handle(async ({ input, context }) => {\n      const token = context.accessToken\n      if (!token)\n        return err(HaiCommonError.UNAUTHORIZED, servM('serv_errorUnauthorized', { locale: context.locale }))\n      const policy = await iam.getPublicConfig()\n      if (!policy.success)\n        return policy\n      // 标准资料入口与独立资料/头像入口共用策略；混合更新优先使用资料用途。\n      const operations = [\n        ...(Object.keys(input).some(key => key !== 'avatarUrl') ? ['iam.profile.update'] : []),\n        ...(input.avatarUrl !== undefined ? ['iam.profile.avatar'] : []),\n      ]\n      const operation = operations.find(value => policy.data.reauthentication.operations.includes(value)) ?? operations[0] ?? 'iam.profile.update'\n      return sensitive(context, operation, () => iam.user.updateCurrentUser(token, input))\n    })\n\n    .route('users.list')\n    .permission('iam.users.read')\n    .handle(({ input }) => iam.user.listUsers(input))\n\n    .route('users.get')\n    .permission('iam.users.read')\n    .handle(({ input }) => iam.user.getUser(input.id, { include: ['roles'] }))\n\n    .route('users.create')\n    .permission('iam.users.write')\n    .handle(({ input, context }) => sensitive(context, 'iam.users.create', () => createUser(iam, input)))\n\n    .route('users.invite')\n    .permission('iam.users.write')\n    .handle(({ input, context }) => sensitive(context, 'iam.users.invite', () => createUser(iam, input)))\n\n    .route('users.update')\n    .permission('iam.users.write')\n    .handle(({ input, context }) => sensitive(context, 'iam.users.update', () => updateUser(iam, input)))\n\n    .route('users.delete')\n    .permission('iam.users.write')\n    .handle(({ input, context }) => {\n      // 防止自删：避免管理员误删自己的账号导致授权锁死。\n      if (context.session.userId === input.id)\n        return err(HaiCommonError.FORBIDDEN, servM('serv_iamCannotDeleteCurrentUser', { locale: context.locale }))\n      return sensitive(context, 'iam.users.delete', () => iam.user.deleteUser(input.id))\n    })\n\n    .route('users.resetPassword')\n    .permission('iam.users.write')\n    .handle(({ input, context }) => sensitive(context, 'iam.users.resetPassword', () => iam.user.adminResetPassword(input.id, input.newPassword)))\n\n    .route('roles.list')\n    .permission('iam.roles.read')\n    .handle(() => iam.authz.getAllRoles())\n\n    .route('roles.get')\n    .permission('iam.roles.read')\n    .handle(({ input }) => iam.authz.getRole(input.id))\n\n    .route('roles.create')\n    .permission('iam.roles.write')\n    .handle(({ input, context }) => sensitive(context, 'iam.roles.create', () => iam.authz.createRole(input)))\n\n    .route('roles.update')\n    .permission('iam.roles.write')\n    .handle(({ input, context }) => {\n      const { id, ...data } = input\n      return sensitive(context, 'iam.roles.update', () => iam.authz.updateRole(id, data))\n    })\n\n    .route('roles.delete')\n    .permission('iam.roles.write')\n    .handle(({ input, context }) => sensitive(context, 'iam.roles.delete', () => iam.authz.deleteRole(input.id)))\n\n    .route('permissions.list')\n    .permission('iam.permissions.read')\n    .handle(({ input }) => iam.authz.getAllPermissions(input))\n\n    .route('permissions.get')\n    .permission('iam.permissions.read')\n    .handle(({ input }) => iam.authz.getPermission(input.id))\n\n    .route('permissions.create')\n    .permission('iam.permissions.write')\n    .handle(({ input, context }) => sensitive(context, 'iam.permissions.create', () => iam.authz.createPermission(input)))\n\n    .route('permissions.setSensitiveOperations')\n    .permission('iam.permissions.write')\n    .handle(({ input, context }) => sensitive(context, 'iam.permissions.sensitiveOperations', () => iam.authz.setPermissionSensitiveOperations(input.id, input.sensitiveOperations)))\n\n    .route('permissions.delete')\n    .permission('iam.permissions.write')\n    .handle(({ input, context }) => sensitive(context, 'iam.permissions.delete', () => iam.authz.deletePermission(input.id)))\n\n    .build()\n}\n\nasync function createUser(iam: IamFunctions, input: IamAdminCreateUserInput | IamInviteUserInput): Promise<HaiResult<User>> {\n  const invited = !('password' in input)\n  const registerResult = 'password' in input ? await iam.user.createUser(input) : await iam.user.inviteUser(input)\n  if (!registerResult.success)\n    return registerResult\n\n  const userId = registerResult.data.user.id\n\n  // 任何后续步骤失败都需要回滚刚创建的用户，以避免重复用户名/邮箱错误阅存。\n  async function rollback(reason: string): Promise<void> {\n    if (invited) {\n      // 邀请可能已经送达，不能回滚外部已发布凭据；保留账号供管理员补齐配置。\n      iamFeatureLogger.error('Invited account requires configuration repair', { userId, reason })\n      return\n    }\n    const deleteResult = await iam.user.deleteUser(userId)\n    if (!deleteResult.success)\n      iamFeatureLogger.error('createUser rollback failed, orphan user may exist', { userId, reason, error: deleteResult.error })\n  }\n\n  if (input.roleIds !== undefined) {\n    const rolesResult = await iam.authz.syncRoles(userId, input.roleIds)\n    if (!rolesResult.success) {\n      await rollback('syncRoles failed')\n      return rolesResult\n    }\n  }\n\n  return ok(registerResult.data.user)\n}\n\nasync function updateUser(iam: IamFunctions, input: IamAdminUpdateUserInput): Promise<HaiResult<User>> {\n  const { id, roleIds, ...data } = input\n  const updateResult = await iam.user.updateUser(id, data)\n  if (!updateResult.success)\n    return updateResult\n\n  if (roleIds) {\n    const rolesResult = await iam.authz.syncRoles(id, roleIds)\n    if (!rolesResult.success)\n      return rolesResult\n  }\n\n  return updateResult\n}\n\n// re-export 类型以便 IDE 跳转\nexport type { TokenPair }\n"]}

package/dist/features/storage.js

@@ -1,6 +1,6 @@
-import { validateInputOrFail } from '../chunk-65XNI7TH.js';
+import { validateInputOrFail } from '../chunk-IQZQTAEW.js';
 import { mapHaiResult } from '../chunk-XKCLD42I.js';
-import { implement, servM } from '../chunk-JAQIEQJS.js';
+import { implement, servM } from '../chunk-FEG22LCX.js';
 import { apiContract, StorageDeleteSummarySchema } from '@h-ai/api-contract';
 import { err, HaiCommonError, ok } from '@h-ai/core';
 import { getStorageKeyIssue, StorageDeleteKeysSchema, STORAGE_KEY_MAX_BYTES } from '@h-ai/storage/schemas';

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import * as _h_ai_core from '@h-ai/core';
-import { HaiResult, ValidationFormError } from '@h-ai/core';
+import { HaiResult, TrustedProxies, RequestAccessConfigInput, ValidationFormError } from '@h-ai/core';
 import { AIFunctions, AudioWsStartMessage, AudioFormat } from '@h-ai/ai';
 import { AnyContractRouter, OpenAPI } from '@orpc/contract';
 import { ProcedureHandler, ErrorMap, Meta, ProcedureHandlerOptions, ORPCErrorConstructorMap, Router } from '@orpc/server';
@@ -138,7 +138,7 @@ type ServProcedureHandler<TInput, TOutput, TContext extends ServContext = ServCo
 /**
  * @h-ai/serv — HTTP 配置
  *
- * 提供用于控制 API 前缀、OpenAPI、docs、健康检查、内部 RPC 与传输加密策略的配置结构，
+ * 提供用于控制 API 前缀、OpenAPI、docs、健康检查与传输加密策略的配置结构，
  * 并由 zod 负责默认值填充与边界校验。
  * @module serv-config
  */
@@ -217,24 +217,6 @@ interface ServHealthHttpConfig {
     readonly path: `/${string}`;
     readonly readyPath?: `/${string}`;
 }
-/**
- * 内部 RPC endpoint 配置。
- *
- * @example
- * ```ts
- * import type { ServRpcHttpConfig } from '@h-ai/serv'
- * import { serv } from '@h-ai/serv'
- *
- * const rpc: ServRpcHttpConfig = { prefix: '/rpc', access: 'loopback' }
- * // 缺少可信连接信息时拒绝；跨节点来源通过明确网关/网络策略控制。
- * ```
- */
-interface ServRpcHttpConfig {
-    readonly prefix: `/${string}`;
-    readonly access: 'loopback' | 'private-network' | 'gateway-only';
-    readonly gatewayHeader?: string;
-    readonly gatewaySecret?: string;
-}
 /**
  * 传输加密运行时配置（对应 `config/_serv.yml`）。
  *
@@ -281,17 +263,18 @@ interface ServCorsRuntimeConfig {
  * import type { ServHttpConfig } from '@h-ai/serv'
  * import { serv } from '@h-ai/serv'
  *
- * const http: ServHttpConfig = { trustedProxies: [], apiPrefix: '/api/v1', openapi: false, docs: false, health: { path: '/health' }, rpc: false }
+ * const http: ServHttpConfig = { trustedProxies: 'auto', access: false, apiPrefix: '/api/v1', openapi: false, docs: false, health: { path: '/health' } }
  * ```
  */
 interface ServHttpConfig {
-    /** 可信任的连接代理 IP/CIDR；默认空数组，不采纳转发头。 */
-    readonly trustedProxies: readonly string[];
-    readonly apiPrefix: `/api/${string}`;
+    /** auto 仅在受管私有容器代理中采用容器网段；空数组显式忽略转发头。 */
+    readonly trustedProxies: TrustedProxies;
+    /** 每次请求的 IP/时间策略；默认 false，内联与独立文件二选一。 */
+    readonly access: RequestAccessConfigInput;
+    readonly apiPrefix: `/${string}`;
     readonly openapi: false | ServOpenAPIHttpConfig;
     readonly docs: false | ServDocsHttpConfig;
     readonly health: false | ServHealthHttpConfig;
-    readonly rpc: false | ServRpcHttpConfig;
 }
 /**
  * `config/_serv.yml` 的顶层配置结构。
@@ -355,12 +338,12 @@ type ServTransportRuntimeConfigInput = Partial<{
  * ```
  */
 type ServHttpConfigInput = Partial<{
-    readonly trustedProxies: readonly string[];
-    readonly apiPrefix: `/api/${string}`;
+    readonly trustedProxies: TrustedProxies;
+    readonly access: RequestAccessConfigInput;
+    readonly apiPrefix: `/${string}`;
     readonly openapi: false | Partial<ServOpenAPIHttpConfig>;
     readonly docs: false | Partial<ServDocsHttpConfig>;
     readonly health: false | Partial<ServHealthHttpConfig>;
-    readonly rpc: false | Partial<ServRpcHttpConfig>;
 }>;
 /**
  * `config/_serv.yml` 的顶层输入类型。
@@ -402,8 +385,49 @@ declare const ServConfigSchema: z.ZodPipe<z.ZodObject<{
         port: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>;
     http: z.ZodOptional<z.ZodObject<{
-        trustedProxies: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        apiPrefix: z.ZodDefault<z.ZodCustom<`/api/${string}`, `/api/${string}`>>;
+        trustedProxies: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodArray<z.ZodUnion<readonly [z.ZodIPv4, z.ZodIPv6, z.ZodCIDRv4, z.ZodCIDRv6]>>]>>;
+        access: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
+            file: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            global: z.ZodOptional<z.ZodObject<{
+                allowIps: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodIPv4, z.ZodIPv6, z.ZodCIDRv4, z.ZodCIDRv6]>>>;
+                denyIps: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodIPv4, z.ZodIPv6, z.ZodCIDRv4, z.ZodCIDRv6]>>>;
+                timezone: z.ZodDefault<z.ZodString>;
+                windows: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                    days: z.ZodArray<z.ZodNumber>;
+                    start: z.ZodString;
+                    end: z.ZodString;
+                }, z.core.$strict>>>;
+            }, z.core.$strict>>;
+            rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                allowIps: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodIPv4, z.ZodIPv6, z.ZodCIDRv4, z.ZodCIDRv6]>>>;
+                denyIps: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodIPv4, z.ZodIPv6, z.ZodCIDRv4, z.ZodCIDRv6]>>>;
+                timezone: z.ZodDefault<z.ZodString>;
+                windows: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                    days: z.ZodArray<z.ZodNumber>;
+                    start: z.ZodString;
+                    end: z.ZodString;
+                }, z.core.$strict>>>;
+                id: z.ZodString;
+                paths: z.ZodArray<z.ZodString>;
+                methods: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+                    GET: "GET";
+                    HEAD: "HEAD";
+                    POST: "POST";
+                    PUT: "PUT";
+                    PATCH: "PATCH";
+                    DELETE: "DELETE";
+                    OPTIONS: "OPTIONS";
+                    CONNECT: "CONNECT";
+                    TRACE: "TRACE";
+                }>>>;
+                encryption: z.ZodOptional<z.ZodEnum<{
+                    required: "required";
+                    disabled: "disabled";
+                }>>;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>]>>;
+        apiPrefix: z.ZodDefault<z.ZodCustom<`/${string}`, `/${string}`>>;
         openapi: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
             path: z.ZodDefault<z.ZodCustom<`/${string}`, `/${string}`>>;
         }, z.core.$strip>]>>;
@@ -415,16 +439,6 @@ declare const ServConfigSchema: z.ZodPipe<z.ZodObject<{
             path: z.ZodDefault<z.ZodCustom<`/${string}`, `/${string}`>>;
             readyPath: z.ZodDefault<z.ZodOptional<z.ZodCustom<`/${string}`, `/${string}`>>>;
         }, z.core.$strip>]>>;
-        rpc: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
-            prefix: z.ZodDefault<z.ZodCustom<`/${string}`, `/${string}`>>;
-            access: z.ZodDefault<z.ZodEnum<{
-                loopback: "loopback";
-                "private-network": "private-network";
-                "gateway-only": "gateway-only";
-            }>>;
-            gatewayHeader: z.ZodOptional<z.ZodString>;
-            gatewaySecret: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>]>>;
     }, z.core.$strip>>;
     cors: z.ZodOptional<z.ZodObject<{
         origin: z.ZodOptional<z.ZodString>;
@@ -450,8 +464,36 @@ declare const ServConfigSchema: z.ZodPipe<z.ZodObject<{
         port: number;
     } | undefined;
     http?: {
-        trustedProxies: string[];
-        apiPrefix: `/api/${string}`;
+        trustedProxies: string[] | "auto";
+        access: false | {
+            file: string;
+        } | {
+            rules: {
+                allowIps: string[];
+                denyIps: string[];
+                timezone: string;
+                windows: {
+                    days: number[];
+                    start: string;
+                    end: string;
+                }[];
+                id: string;
+                paths: string[];
+                methods: ("GET" | "HEAD" | "OPTIONS" | "POST" | "PUT" | "PATCH" | "DELETE" | "CONNECT" | "TRACE")[];
+                encryption?: "required" | "disabled" | undefined;
+            }[];
+            global?: {
+                allowIps: string[];
+                denyIps: string[];
+                timezone: string;
+                windows: {
+                    days: number[];
+                    start: string;
+                    end: string;
+                }[];
+            } | undefined;
+        };
+        apiPrefix: `/${string}`;
         openapi: false | {
             path: `/${string}`;
         };
@@ -463,12 +505,6 @@ declare const ServConfigSchema: z.ZodPipe<z.ZodObject<{
             path: `/${string}`;
             readyPath: `/${string}`;
         };
-        rpc: false | {
-            prefix: `/${string}`;
-            access: "loopback" | "private-network" | "gateway-only";
-            gatewayHeader?: string | undefined;
-            gatewaySecret?: string | undefined;
-        };
     } | undefined;
     cors?: {
         allowedHeaders: string[];
@@ -531,7 +567,7 @@ interface ServTransportConfig {
  *
  * - `path` 省略时默认挂到 `'*'`
  * - 按数组顺序注册
- * - 注册位置固定在内置 `securityHeaders` 之后、`transport` / 业务路由之前
+ * - 普通 middleware 位于 `transport` 解密和请求访问策略之后、业务路由之前
  *
  * @example
  * ```ts
@@ -539,7 +575,7 @@ interface ServTransportConfig {
  * import { serv } from '@h-ai/serv'
  *
  * const mount: ServMiddlewareMount = { path: '/api/v1/*', middleware: serv.cors({ origin: 'https://app.example.com' }) }
- * // middleware 在 transport 之前运行；短路响应不会经过传输加密。
+ * // 内置 CORS 在外层补充响应头；预检仍执行访问策略。
  * ```
  */
 interface ServMiddlewareMount {
@@ -604,9 +640,9 @@ interface CreateServAppOptions<TContract extends AnyContractRouter, TProcedures
      *
      * 典型用途：请求日志、trace、指标、CORS、限流、租户头校验，以及不适合放入
      * JSON/oRPC contract 的 WebSocket、文件或其它二进制 HTTP 端点。
-     * 这些 middleware 会在内置安全头之后、传输加密与业务路由之前注册；
-     * 因此 CORS preflight 或二进制端点可以直接短路返回。短路响应仍包含内置安全头，
-     * 但不会经过 transport；若需要读取解密后的业务 body，应改用 context / procedure 层扩展。
+     * 普通 middleware 位于传输解密和请求访问策略之后、业务路由之前，读取的是解密正文；
+     * 提前返回仍经过传输响应加密，不能绕过访问策略。二进制端点需显式列入 transport.excludePaths。
+     * 通过 serv.cors 创建的内置 CORS 会在外层补充响应头，预检仍执行请求访问策略。
      */
     readonly middlewares?: readonly ServMiddlewareMount[];
     /**
@@ -1296,7 +1332,7 @@ declare const serv: {
     validateInputOrFail: typeof validateInputOrFail;
     WILDCARD_PERMISSION: string;
     WILDCARD_ROLE: string;
-    m: (key: "$schema" | "serv_validationFailed" | "serv_validationRequired" | "serv_validationInvalid" | "serv_validationInvalidType" | "serv_validationStringMin" | "serv_validationStringMax" | "serv_validationNumberMin" | "serv_validationNumberMax" | "serv_validationArrayMin" | "serv_validationArrayMax" | "serv_validationTooSmall" | "serv_validationTooBig" | "serv_validationEmail" | "serv_validationUrl" | "serv_validationUuid" | "serv_validationEnum" | "serv_errorUnauthorized" | "serv_errorForbidden" | "serv_errorInternal" | "serv_storageKeyRequired" | "serv_storageKeyTooLong" | "serv_storageKeyIllegalChars" | "serv_storageKeyDotSegments" | "serv_iamCannotDeleteCurrentUser" | "serv_transportInvalidPayload" | "serv_transportUnknownClient" | "serv_transportClientIdRequired" | "serv_transportClientKeyNotFound" | "serv_transportDecryptFailed" | "serv_transportEncryptFailed" | "serv_transportKeyExchangeFailed" | "serv_transportBusy" | "serv_feedbackUnavailable", options?: _h_ai_core.MessageOptions) => string;
+    m: (key: "serv_transportPlaintextRequired" | "$schema" | "serv_validationFailed" | "serv_validationRequired" | "serv_validationInvalid" | "serv_validationInvalidType" | "serv_validationUnexpectedFields" | "serv_validationStringMin" | "serv_validationStringMax" | "serv_validationNumberMin" | "serv_validationNumberMax" | "serv_validationArrayMin" | "serv_validationArrayMax" | "serv_validationTooSmall" | "serv_validationTooBig" | "serv_validationEmail" | "serv_validationUrl" | "serv_validationUuid" | "serv_validationEnum" | "serv_errorUnauthorized" | "serv_errorForbidden" | "serv_errorInternal" | "serv_storageKeyRequired" | "serv_storageKeyTooLong" | "serv_storageKeyIllegalChars" | "serv_storageKeyDotSegments" | "serv_iamCannotDeleteCurrentUser" | "serv_transportInvalidPayload" | "serv_transportUnknownClient" | "serv_transportClientIdRequired" | "serv_transportClientKeyNotFound" | "serv_transportDecryptFailed" | "serv_transportEncryptFailed" | "serv_transportKeyExchangeFailed" | "serv_transportBusy" | "serv_feedbackUnavailable" | "serv_invalidApiPrefix", options?: _h_ai_core.MessageOptions) => string;
 };
 
-export { type AudioTicketGrant, type AudioTicketVerification, type AuthorizedAudioRequest, type CreateServAppOptions, CreateServContext, type GenerateOpenAPISpecOptions, RefreshCookieConfig, type ServAudioConfig, type ServConfig, type ServConfigInput, ServConfigSchema, ServContext, type ServCorsConfig, type ServCorsRuntimeConfig, type ServCorsRuntimeConfigInput, type ServDocsHttpConfig, type ServFetchHandler, type ServHealthHttpConfig, type ServHttpApp, type ServHttpConfig, type ServHttpConfigInput, ServIam, type ServListenOptions, type ServMiddleware, type ServMiddlewareFactory, type ServMiddlewareMount, type ServNodeServer, type ServOpenAPIHttpConfig, type ServProcedureHandler, type ServProcedureOptions, ServRequestMetadata, type ServRpcHttpConfig, type ServRuntimeSecurityPolicy, type ServRuntimeSecurityPolicyInput, type ServServerConfig, type ServServerConfigInput, ServSession, type ServStorageAssetsConfig, type ServTransportConfig, type ServTransportRuntimeConfig, type ServTransportRuntimeConfigInput, type ServValidationFailureBody, serv };
+export { type AudioTicketGrant, type AudioTicketVerification, type AuthorizedAudioRequest, type CreateServAppOptions, CreateServContext, type GenerateOpenAPISpecOptions, RefreshCookieConfig, type ServAudioConfig, type ServConfig, type ServConfigInput, ServConfigSchema, ServContext, type ServCorsConfig, type ServCorsRuntimeConfig, type ServCorsRuntimeConfigInput, type ServDocsHttpConfig, type ServFetchHandler, type ServHealthHttpConfig, type ServHttpApp, type ServHttpConfig, type ServHttpConfigInput, ServIam, type ServListenOptions, type ServMiddleware, type ServMiddlewareFactory, type ServMiddlewareMount, type ServNodeServer, type ServOpenAPIHttpConfig, type ServProcedureHandler, type ServProcedureOptions, ServRequestMetadata, type ServRuntimeSecurityPolicy, type ServRuntimeSecurityPolicyInput, type ServServerConfig, type ServServerConfigInput, ServSession, type ServStorageAssetsConfig, type ServTransportConfig, type ServTransportRuntimeConfig, type ServTransportRuntimeConfigInput, type ServValidationFailureBody, serv };