npm - @h-ai/serv - Versions diffs - 0.1.0-alpha.76 → 1.0.0-beta.2 - Mend

@h-ai/serv 0.1.0-alpha.76 → 1.0.0-beta.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (18) hide show

package/README.en.md +22 -9
package/README.ja.md +22 -9
package/README.md +22 -9
package/dist/{chunk-JAQIEQJS.js → chunk-I3F7RN4I.js} +8 -2
package/dist/chunk-I3F7RN4I.js.map +1 -0
package/dist/{chunk-65XNI7TH.js → chunk-TWMOZPGU.js} +3 -3
package/dist/{chunk-65XNI7TH.js.map → chunk-TWMOZPGU.js.map} +1 -1
package/dist/features/ai.js +1 -1
package/dist/features/feedback.js +1 -1
package/dist/features/iam.d.ts +42 -44
package/dist/features/iam.js +1 -9
package/dist/features/iam.js.map +1 -1
package/dist/features/storage.js +2 -2
package/dist/index.d.ts +85 -13
package/dist/index.js +154 -157
package/dist/index.js.map +1 -1
package/package.json +16 -16
package/dist/chunk-JAQIEQJS.js.map +0 -1

package/README.en.md CHANGED Viewed

@@ -178,7 +178,8 @@ When using `@h-ai/core` and `ServConfigSchema` with `config/_serv.yml`, transpor
 ```yaml
 # config/_serv.yml
 http:
-  trustedProxies: []
+  trustedProxies: auto
+  access: false
   apiPrefix: /api/v1
 transport:
@@ -224,7 +225,7 @@ const app = serv.createApp({
 Only authenticated protocol v2 is accepted. Independent random SM4-CBC and HMAC-SM3 keys are wrapped with SM2; verify the sender signature and MAC before CBC decryption. Clients sign requests and the selected server key version signs responses. Authentication covers version, direction, serverKeyId, clientId, a random 128-bit requestId acting as the nonce, issuedAt, HTTP method, the SM3 pathHash of pathname plus the original search, and response status. Requests have a five-minute lifetime and at most 30 seconds of future clock skew. The shared registry atomically consumes (clientId, requestId), retaining it until at least issuedAt plus six minutes to cover node skew; storage failures reject requests. Synchronize node clocks and use a Redis noeviction/durable policy that preserves live nonces. Transport replay prevention does not replace business idempotency keys.
-Empty POSTs still send an authenticated envelope for empty plaintext. GET/HEAD carry it in X-Hai-Transport; bodyless responses such as 204/304/HEAD use the same header. Other requests/responses carry a JSON envelope and X-Encrypted: true. The client must match the original request context and HTTP status; missing markers, old formats and authentication failures reject. Exclude plaintext endpoints explicitly with excludePaths. CORS must allow and expose X-Hai-Transport. TLS authenticates handshake keys; this protocol does not replace IAM authorization.
+Empty POSTs still send an authenticated envelope for empty plaintext. GET/HEAD carry it in X-Hai-Transport; bodyless responses such as 204/304/HEAD use the same header. Other requests/responses carry a JSON envelope and X-Encrypted: true. The client must match the original request context and HTTP status; missing markers, old formats and authentication failures reject. Serv/Kit hosts explicitly allow plaintext through `encryption: disabled` path rules or host `excludePaths`. Callers must select ordinary requests; API Client/Kit wrappers use their own `excludePaths`. CORS must allow and expose X-Hai-Transport. TLS authenticates handshake keys; this protocol does not replace IAM authorization.
 Set `transport.maxPlaintextBytes` for both request and response JSON plaintext, measured in UTF-8 bytes: default 1 MiB, integer range 1 KiB–64 MiB. Clients learn the server limit during key exchange. `resolveTransportBodyLimits()` derives encrypted/proxy bytes as twice the plaintext limit plus 32 KiB. Handshake, public-key, header and replay constraints remain independent. Oversized streams are cancelled and readers released: requests return 413; oversized responses return an encrypted 500 capacity error, recognized as `TransportBodyTooLargeError` / `hai:crypto:070`. [Transport capacity and upgrade](../crypto/TRANSPORT-CAPACITY.md)。
@@ -351,18 +352,19 @@ const app = serv.createApp({
 Execution order is fixed:
 1. Built-in `securityHeaders`.
-2. Your `middlewares`.
-3. Built-in `transport`, if enabled.
-4. health / refresh-cookie / OpenAPI / RPC / docs / oRPC routes
+2. Built-in CORS response wrapping; access checks for key exchange and preflight.
+3. Built-in `transport`, if enabled, and request access checks.
+4. Your `middlewares`.
+5. health / refresh-cookie / OpenAPI / RPC / docs / oRPC routes
 Notes:
 - `middlewares` register in array order.
 - Omitted `path` defaults to `'*'`.
-- Middleware runs before transport, so CORS preflight or binary endpoints can short-circuit. Responses retain security headers but bypass transport.
+- Ordinary middleware runs after decryption and access checks. Early responses still follow policy and response encryption. Binary endpoints must be listed in `transport.excludePaths`; those exclusions do not bypass access checks.
 - Prefer `serv.storageAssets(...)` for public read-only files. Applications must supply key/MIME allowlists, caching, and CORS; no business concepts such as avatars are built in.
 - Private resources, Range downloads, and dynamic authorization need custom middleware/procedures, not the public asset helper.
-- To read decrypted business bodies, extend context/procedure instead.
+- `c.req.json()` reads decrypted bodies here; built-in `serv.cors(...)` preflight still follows access checks.
 - Expose custom response headers such as `X-Encrypted` explicitly through `serv.cors({ exposedHeaders: [...] })` for browsers.
 - This layer works with HTTP middleware context and returns **HTTP Response**, not `HaiResult`.
@@ -512,6 +514,16 @@ Additional root types / named exports:
 > Transport encryption is a `createApp` option delegated internally to `crypto.transport`, not a flat `serv.xxx` API.
+### Access checks on every request
+Rules accept `encryption: required` or `disabled`; omission inherits the host. Disabled endpoints accept ordinary HTTPS data while retaining IP, time and authentication checks, and reject framework encryption envelopes with HTTP 400. Required mode overrides host `excludePaths` and rejects App creation without transport. Conflicting modes on overlapping paths and methods fail at compilation; there is no automatic downgrade or declaration-order override.
+`http.access` defaults to `false`. To restrict external endpoints only, set `http.access.rules` in `_serv.yml`, for example `{ id: 'external', paths: ['/api/v1/external/**'], allowIps: ['192.0.2.0/24'] }`. `http.access.global` restricts all requests handled by the host, including health checks. Global conditions and every matching rule must pass. Timezones default to UTC; empty lists leave the corresponding dimension unrestricted. Existing sessions are checked on every request; IAM `loginAccess` checks login only.
+Use `http.access: { file: './config/security/request-access.yml' }` for larger policies. Paths resolve from the service working directory. App creation reads the file once, up to 1 MiB; invalid configuration stops startup, and changes require a new App. Denials return HTTP 403 with `hai:common:104`; ordinary transport requests retain encrypted responses. Logs correlate rule ID and denial reason with the request ID without copying policy contents.
+`http.trustedProxies` defaults to `auto`: ordinary hosts ignore forwarded headers; only private managed Compose proxy topologies adopt container networks automatically. Custom ingress uses explicit proxy IPs/CIDRs; `[]` disables trust. Proxies sanitize forwarded headers, and Node listeners or Fetch platforms supply trusted peer metadata. See the [request access handbook](../../docs/usage/configuration/request-access.md) for files, edge proxies and deployment rollback.
 ### Configuration
 `@h-ai/serv` does not scan YAML itself. Load `config/_serv.yml` through `@h-ai/core` and pass the result to `serv.createApp()`.
@@ -552,7 +564,8 @@ server:
   port: 3000
 http:
-  trustedProxies: []
+  trustedProxies: auto
+  access: false
   apiPrefix: /api/v1
   openapi:
     path: /openapi.json
@@ -730,7 +743,7 @@ const app = serv.createApp({
 Native Audio WebSocket uses the same safe error boundary: internal Provider/SDK messages and stacks remain in sanitized logs, while clients receive stable codes, safe messages and traceId. Custom cross-origin configuration must preserve X-Hai-Reauthentication for sensitive actions; Serv/Kit defaults allow it.
-HTTP errors expose localized safe messages followed by `(traceId: …)`, with the same ID in `error.traceId` and `X-Trace-Id`. The framework reuses the request ID to correlate browser and server logs. Sanitized exceptions, stacks and operation context remain in logs; internal cause/ext are not exposed. Field validation returns localized field names and messages only.
+HTTP errors carry safe localized messages and a reference ID. ToastContainer hides the ID by default and reveals it through its diagnostic icon. The same ID remains in `error.traceId` and `X-Trace-Id`. The framework reuses the request ID to correlate browser and server logs. Sanitized exceptions, stacks and operation context remain in logs; internal cause/ext are not exposed. Field validation returns localized field names and messages only.
 Use `core.error.toPublic(error, traceId?)` at HTTP/UI boundaries and `core.error.formatMessage(error)` after translating messages; formatting is idempotent. Pass complete Error objects to logs instead of discarding their context. Database failures log driver codes, sanitized messages/stacks and table/column context; SQL text, bound values and connection credentials are excluded.

package/README.ja.md CHANGED Viewed

@@ -178,7 +178,8 @@ await apiClient.init({
 ```yaml
 # config/_serv.yml
 http:
-  trustedProxies: []
+  trustedProxies: auto
+  access: false
   apiPrefix: /api/v1
 transport:
@@ -224,7 +225,7 @@ const app = serv.createApp({
 認証済み v2 のみを受け付けます。独立したランダム SM4-CBC 鍵と HMAC-SM3 鍵を SM2 で包み、送信者署名、MAC の順に検証してから CBC を復号します。要求はクライアント秘密鍵、応答は選択されたサーバー鍵バージョンで署名します。version、direction、serverKeyId、clientId、nonce を兼ねるランダム 128 ビット requestId、issuedAt、HTTP method、pathname と元の search の SM3 pathHash、応答 status を認証します。要求の有効期限は 5 分、未来方向の時計差は最大 30 秒です。共有 registry が (clientId, requestId) を原子的に消費し、ノード間の時計差を含め issuedAt + 6 分まで保持します。保存障害では拒否します。時計同期と Redis の noeviction/永続化により有効な nonce を保持してください。業務の再試行には別の冪等キーが必要です。
-空の POST も空平文の認証封装を送ります。GET/HEAD は X-Hai-Transport ヘッダー、204/304/HEAD など本文なし応答も同じヘッダーを使います。他の要求・応答は JSON 本文と X-Encrypted: true を使います。クライアントは元の要求コンテキストと HTTP status を照合し、マーカー欠落、旧形式、認証失敗では reject します。平文 endpoint は excludePaths で明示的に除外し、CORS では X-Hai-Transport を許可・公開してください。鍵交換の公開鍵認証は TLS に依存し、IAM の業務認可は別に必要です。
+空の POST も空平文の認証封装を送ります。GET/HEAD は X-Hai-Transport ヘッダー、204/304/HEAD など本文なし応答も同じヘッダーを使います。他の要求・応答は JSON 本文と X-Encrypted: true を使います。クライアントは元の要求コンテキストと HTTP status を照合し、マーカー欠落、旧形式、認証失敗では reject します。平文 endpoint は Serv/Kit の `encryption: disabled` ルールまたはホストの `excludePaths` で明示的に許可し、呼出側も通常の要求を選びます。API Client/Kit のラッパーは自身の `excludePaths` を使用します。CORS では X-Hai-Transport を許可・公開してください。鍵交換の公開鍵認証は TLS に依存し、IAM の業務認可は別に必要です。
 `transport.maxPlaintextBytes` でリクエストとレスポンスの JSON 平文容量を共通設定します。単位は UTF-8 バイト、既定値は 1 MiB、有効範囲は 1 KiB～64 MiB の整数です。クライアントは鍵交換で上限を取得し、`resolveTransportBodyLimits()` が暗号文とプロキシ容量（平文の 2 倍 + 32 KiB）を算出します。鍵交換、公開鍵、認証ヘッダー、防リプレイ制約は独立です。超過時は元ストリームを停止して reader を解放します。要求は 413、応答は暗号化された 500 容量エラーとなり、`TransportBodyTooLargeError` / `hai:crypto:070` で識別できます。 [Transport capacity and upgrade](../crypto/TRANSPORT-CAPACITY.md)。
@@ -351,18 +352,19 @@ const app = serv.createApp({
 実行順は固定です：
 1. 組み込み `securityHeaders`。
-2. 独自の `middlewares`。
-3. 組み込み `transport`（有効時）。
-4. health / refresh-cookie / OpenAPI / RPC / docs / oRPC routes
+2. 組み込み CORS 応答処理；鍵交換と preflight のアクセス判定。
+3. 組み込み `transport`（有効時）と各リクエストのアクセス判定。
+4. 独自の `middlewares`。
+5. health / refresh-cookie / OpenAPI / RPC / docs / oRPC routes
 補足：
 - `middlewares` は配列順に登録。
 - `path` 省略時は `'*'`。
-- middleware は transport より先なので、CORS preflight・バイナリー endpoint は途中で応答できます。安全ヘッダーは残りますが transport は通りません。
+- 通常の middleware は復号とアクセス判定の後に実行し、途中の応答もポリシーと応答暗号化の対象です。バイナリー endpoint は `transport.excludePaths` に明記しますが、アクセス判定は省略されません。
 - 公開読み取り専用ファイルは `serv.storageAssets(...)` を優先。key/MIME 許可リスト・キャッシュ・CORS はアプリが指定し、アバターなどの業務概念は内蔵しません。
 - 非公開リソース・Range ダウンロード・動的認可は独自 middleware/procedure を使い、公開 helper は使いません。
-- 復号済みの業務 body を読む場合は context / procedure 層を拡張。
+- この段階の `c.req.json()` は復号後の本文を読みます。組み込み `serv.cors(...)` の preflight もアクセス判定の対象です。
 - ブラウザーが `X-Encrypted` などを読む場合は `serv.cors({ exposedHeaders: [...] })` で明示的に公開。
 - この層は HTTP middleware context を操作し、`HaiResult` ではなく **HTTP Response** を返します。
@@ -512,6 +514,16 @@ await apiClient.init({
 > 通信暗号化は `createApp` の設定機能で、内部で `crypto.transport` に委譲します。`serv.xxx` の独立 API ではありません。
+### リクエストごとのアクセス制御
+ルールの `encryption` は `required` / `disabled` を指定でき、省略時はホストに従います。disabled は通常の HTTPS データを受け付けますが、IP・時刻・認証は検証し、暗号化信封には 400 を返します。required は `excludePaths` より優先し、transport 未設定では App 作成に失敗します。重複するパスとメソッドの反対指定は装配時に拒否し、宣言順の上書きや自動降格は行いません。
+`http.access` の既定値は `false` です。外部 API だけを制限する場合、`_serv.yml` の `http.access.rules` に `{ id: 'external', paths: ['/api/v1/external/**'], allowIps: ['192.0.2.0/24'] }` などを設定します。`http.access.global` はヘルスチェックを含むホストの全要求を制限します。全体条件と一致するすべてのルールを満たす必要があります。時区は既定 UTC、空のリストは対象の制限なしです。既存セッションも毎回判定し、IAM `loginAccess` はログイン時だけを制限します。
+大きな設定には `http.access: { file: './config/security/request-access.yml' }` を使用します。サービスの作業ディレクトリを基準に、App 生成時だけ最大 1 MiB を読みます。不正な設定では起動を停止し、変更時は App を作り直します。拒否は HTTP 403、`hai:common:104` で、通常の暗号化要求は応答も暗号化します。ポリシー本文をログに複製せず、ルール ID・拒否理由・要求 ID で調査します。
+`http.trustedProxies` は既定 `auto` です。通常のホストでは転送ヘッダーを無視し、管理対象 Compose の非公開バックエンド構成だけでコンテナのネットワークを採用します。独自の代理は実際の IP/CIDR を指定し、`[]` は信頼を無効化します。代理はヘッダーを清掃し、Node・Fetch は信頼できる接続元情報を提供します。独立ファイル・外側の代理・復旧は[リクエスト制御手引き](../../docs/usage/configuration/request-access.md)を参照してください。
 ### 設定
 `@h-ai/serv` 自体は YAML を走査しません。`@h-ai/core` で `config/_serv.yml` を読み、解析結果を `serv.createApp()` に渡してください。
@@ -552,7 +564,8 @@ server:
   port: 3000
 http:
-  trustedProxies: []
+  trustedProxies: auto
+  access: false
   apiPrefix: /api/v1
   openapi:
     path: /openapi.json
@@ -730,7 +743,7 @@ const app = serv.createApp({
 ネイティブ Audio WebSocket も安全なエラー境界を使います。Provider/SDK の内部情報やスタックはマスク済みログだけに残し、クライアントには安定コード、安全な表示、traceId を返します。独自 CORS 設定でも機密操作の X-Hai-Reauthentication を許可してください。Serv/Kit の既定設定には含まれます。
-HTTP エラーはローカライズ済みの安全な表示に `(traceId: …)` を付け、同じ ID を error.traceId と X-Trace-Id に返します。requestId を traceId として共有し、ブラウザーとサーバーのログを関連付けます。脱機密化した例外・スタック・操作情報はログに残し、内部 cause/ext は公開しません。項目検証は翻訳済みの項目名とメッセージだけを返します。
+HTTP エラーには安全な翻訳文と追跡番号を含めます。ToastContainer は番号を既定で非表示にし、調査情報のアイコンから表示・コピーできます。同じ ID を error.traceId と X-Trace-Id に返します。requestId を traceId として共有し、ブラウザーとサーバーのログを関連付けます。脱機密化した例外・スタック・操作情報はログに残し、内部 cause/ext は公開しません。項目検証は翻訳済みの項目名とメッセージだけを返します。
 HTTP/UI 境界には core.error.toPublic(error, traceId?)、再翻訳後の表示には core.error.formatMessage(error) を使い、ID を重複追加しません。ログには完全な Error を渡してください。DB ログにはドライバーコード、脱機密化したメッセージ・スタック、表・列を残し、SQL 本文、バインド値と接続認証情報を記録しません。

package/README.md CHANGED Viewed

@@ -178,7 +178,8 @@ await apiClient.init({
 ```yaml
 # config/_serv.yml
 http:
-  trustedProxies: []
+  trustedProxies: auto
+  access: false
   apiPrefix: /api/v1
 transport:
@@ -224,7 +225,7 @@ const app = serv.createApp({
 认证协议仅支持 v2：独立随机 SM4-CBC 密钥和 HMAC-SM3 密钥由 SM2 封装，先验签、再验证 MAC，最后解密 CBC。请求由客户端私钥签名，响应由所选服务端版本签名。认证字段包括 version、direction、serverKeyId、clientId、128 位随机 requestId（兼 nonce）、issuedAt、HTTP method、pathname + 原始 search 的 SM3 pathHash，以及响应 status。请求有效期 5 分钟，未来时钟偏差最多 30 秒；共享 registry 原子消费 (clientId, requestId)，nonce 至少保留到 issuedAt + 6 分钟以覆盖节点偏差，存储故障拒绝请求。Redis 必须保留有效 nonce，使用 noeviction/可靠持久化策略；各节点时钟须同步。此能力防止同一传输消息重放，业务重试仍需自己的幂等键。
-空 POST 也发送空明文的认证封装；GET/HEAD 将封装放在 X-Hai-Transport 头，204/304/HEAD 等无正文响应也使用同名头承载认证封装。其它请求/响应在 JSON 正文承载封装并带 X-Encrypted: true。客户端必须关联原请求上下文和 HTTP status，缺标记、旧格式或认证失败一律 reject；明文接口只能经 excludePaths 显式排除。CORS 须允许并暴露 X-Hai-Transport。握手公钥的真实性依赖 TLS，不替代 IAM 业务授权。
+空 POST 也发送空明文的认证封装；GET/HEAD 将封装放在 X-Hai-Transport 头，204/304/HEAD 等无正文响应也使用同名头承载认证封装。其它请求/响应在 JSON 正文承载封装并带 X-Encrypted: true。客户端必须关联原请求上下文和 HTTP status，缺标记、旧格式或认证失败一律 reject；明文接口由 Serv/Kit 路径规则 `encryption: disabled` 或宿主 `excludePaths` 显式允许；调用方同步选择普通请求，API Client/Kit 包装器使用自己的 `excludePaths`。CORS 须允许并暴露 X-Hai-Transport。握手公钥的真实性依赖 TLS，不替代 IAM 业务授权。
 业务容量通过 `transport.maxPlaintextBytes` 统一配置：默认 1 MiB，整数范围 1 KiB～64 MiB，请求和响应共用 UTF-8 明文字节预算。客户端从握手自动获取上限，密文与部署代理预算由 `resolveTransportBodyLimits()` 推导（两倍明文 + 32 KiB）。握手、公钥、认证头和防重放约束独立；超限取消原流并释放 reader，请求 413、响应为加密的 500 容量错误，客户端识别 `TransportBodyTooLargeError` / `hai:crypto:070`。 [Transport capacity and upgrade](../crypto/TRANSPORT-CAPACITY.md)。
@@ -351,18 +352,19 @@ const app = serv.createApp({
 执行顺序固定为：
 1. 内置 `securityHeaders`
-2. 你的 `middlewares`
-3. 内置 `transport`（若启用）
-4. health / refresh-cookie / OpenAPI / RPC / docs / oRPC routes
+2. 内置 CORS 响应包装；密钥交换和预检先检查访问策略
+3. 内置 `transport`（若启用）及每次请求访问策略
+4. 你的 `middlewares`
+5. health / refresh-cookie / OpenAPI / RPC / docs / oRPC routes
 说明：
 - `middlewares` 按数组顺序注册
 - `path` 省略时默认 `'*'`
-- 由于 `middlewares` 先于 `transport` 执行，CORS preflight 或二进制端点可以直接短路；短路响应仍带内置安全头，但不会经过 transport
+- 普通 `middlewares` 在解密和访问策略之后执行；提前响应仍受策略约束并经过响应加密。二进制端点须显式列入 `transport.excludePaths`，该排除不会绕过访问策略
 - 公开只读文件优先使用 `serv.storageAssets(...)`；应用仍须显式提供 key/MIME 白名单、缓存与跨域策略，框架不内置头像等业务概念
 - 私有资源、Range 下载或动态授权继续使用自定义 middleware/procedure，不应套用公开资源 helper
-- 若需要读取解密后的业务 body，请改用 context / procedure 层扩展
+- 此时 `c.req.json()` 读取解密后的正文；内置 `serv.cors(...)` 的预检仍检查访问策略
 - 浏览器若需读取自定义响应头（例如 transport 的 `X-Encrypted`），请通过 `serv.cors({ exposedHeaders: [...] })` 显式暴露
 - 这一层直接操作 HTTP middleware context，返回的是 **HTTP Response**，不是 `HaiResult`
@@ -512,6 +514,16 @@ await apiClient.init({
 > 传输加密不作为 `serv.xxx` 扁平 API 暴露；它是 `createApp` 的配置能力，内部委托 `crypto.transport`。
+### 每次请求的访问控制
+路径规则可设置 `encryption: required` 或 `disabled`，省略沿用宿主。disabled 接口接收普通 HTTPS 数据，仍检查 IP、时段和认证；带框架加密信封的请求返回 400。required 优先于宿主 `excludePaths`，未装配 transport 时拒绝创建 App。重叠路径和方法的相反模式在装配时失败；不自动降级或按声明顺序覆盖。
+`http.access` 默认 `false`。需要仅限制对外接口时，在 `_serv.yml` 配置 `http.access.rules`，例如 `{ id: 'external', paths: ['/api/v1/external/**'], allowIps: ['192.0.2.0/24'] }`；`http.access.global` 则约束宿主处理的全部请求，包含健康检查。全局与所有匹配规则同时生效，时间窗口默认 UTC，空列表不限对应维度。已有会话也会在每次请求时重新检查；IAM `loginAccess` 只负责登录。
+较大策略使用 `http.access: { file: './config/security/request-access.yml' }`。文件按服务工作目录解析，仅在创建 App 时读取，最大 1 MiB；无效配置阻止启动，修改后重新创建 App。拒绝返回 HTTP 403、`hai:common:104`，启用 transport 的普通请求保留加密响应。日志用规则 ID、拒绝原因和请求编号定位，不记录策略正文。
+`http.trustedProxies` 默认 `auto`：普通宿主忽略转发头；受管 Compose 的私有代理拓扑才自动采用容器网段。自管代理指定真实 IP/CIDR，`[]` 显式关闭。代理必须清洗转发头，Node 监听器或 Fetch 平台必须提供可信对端元数据。独立文件、外层代理和部署回滚步骤见[请求访问控制手册](../../docs/usage/configuration/request-access.md)。
 ### 配置
 `@h-ai/serv` 本身不主动扫描 YAML；推荐由 `@h-ai/core` 统一加载 `config/_serv.yml`，再把解析结果传给 `serv.createApp()`。
@@ -552,7 +564,8 @@ server:
   port: 3000
 http:
-  trustedProxies: []
+  trustedProxies: auto
+  access: false
   apiPrefix: /api/v1
   openapi:
     path: /openapi.json
@@ -730,7 +743,7 @@ const app = serv.createApp({
 原生 Audio WebSocket 同样使用安全错误边界：内部 Provider/SDK 错误与堆栈只进入脱敏日志，客户端收到稳定错误码、安全提示和 traceId。自定义跨域配置需保留敏感操作使用的 X-Hai-Reauthentication；默认 Serv/Kit 已允许。
-HTTP 错误只向用户返回本地化的安全提示，末尾显示 `(traceId: …)`；响应同时包含 `error.traceId` 和 `X-Trace-Id`。框架复用本次 requestId 作为 traceId，前后端日志自动关联。底层异常、堆栈和操作上下文经凭据脱敏后写入日志，不通过 cause/ext 向用户公开。字段校验只返回本地化的字段名和错误。
+HTTP 错误返回本地化安全文案及追踪编号；ToastContainer 默认隐藏编号，由排查信息图标展开和复制。响应同时包含 `error.traceId` 和 `X-Trace-Id`。框架复用本次 requestId 作为 traceId，前后端日志自动关联。底层异常、堆栈和操作上下文经凭据脱敏后写入日志，不通过 cause/ext 向用户公开。字段校验只返回本地化的字段名和错误。
 `core.error.toPublic(error, traceId?)` 用于接口/UI 边界；`core.error.formatMessage(error)` 用于重新翻译后的提示，重复调用不会重复追加标识。日志传入完整 Error 对象，不能只记录通用标题或提前 String(error) 丢失上下文。数据库失败记录驱动错误码、消息、堆栈及表/列；SQL 原文、绑定值和连接凭据不进入日志。

package/dist/{chunk-JAQIEQJS.js → chunk-I3F7RN4I.js} RENAMED Viewed

@@ -6,11 +6,13 @@ import { audit } from '@h-ai/audit';
 // messages/en-US.json
 var en_US_default = {
+  serv_transportPlaintextRequired: "This endpoint accepts unencrypted application data. Disable transport encryption for this request and retry over HTTPS.",
   $schema: "https://inlang.com/schema/inlang-message-format",
   serv_validationFailed: "Validation failed",
   serv_validationRequired: "This field is required",
   serv_validationInvalid: "Invalid input format",
   serv_validationInvalidType: "Invalid field type",
+  serv_validationUnexpectedFields: "The submitted data contains unsupported fields. Refresh the page and try again.",
   serv_validationStringMin: "Enter at least {min} characters",
   serv_validationStringMax: "Enter at most {max} UTF-8 bytes",
   serv_validationNumberMin: "Value must be at least {min}",
@@ -44,11 +46,13 @@ var en_US_default = {
 // messages/ja-JP.json
 var ja_JP_default = {
+  serv_transportPlaintextRequired: "\u3053\u306E\u30A8\u30F3\u30C9\u30DD\u30A4\u30F3\u30C8\u306F\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\u5C64\u3067\u6697\u53F7\u5316\u3055\u308C\u3066\u3044\u306A\u3044\u30C7\u30FC\u30BF\u3092\u53D7\u3051\u4ED8\u3051\u307E\u3059\u3002\u30EA\u30AF\u30A8\u30B9\u30C8\u306E\u4F1D\u9001\u6697\u53F7\u5316\u3092\u7121\u52B9\u306B\u3057\u3001HTTPS \u3067\u518D\u8A66\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
   $schema: "https://inlang.com/schema/inlang-message-format",
   serv_validationFailed: "\u5165\u529B\u5185\u5BB9\u306E\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
   serv_validationRequired: "\u3053\u306E\u9805\u76EE\u306F\u5FC5\u9808\u3067\u3059",
   serv_validationInvalid: "\u5165\u529B\u5F62\u5F0F\u304C\u7121\u52B9\u3067\u3059",
   serv_validationInvalidType: "\u30D5\u30A3\u30FC\u30EB\u30C9\u306E\u578B\u304C\u7121\u52B9\u3067\u3059",
+  serv_validationUnexpectedFields: "\u9001\u4FE1\u30C7\u30FC\u30BF\u306B\u3053\u306E\u64CD\u4F5C\u3067\u4F7F\u7528\u3067\u304D\u306A\u3044\u9805\u76EE\u304C\u542B\u307E\u308C\u3066\u3044\u307E\u3059\u3002\u30DA\u30FC\u30B8\u3092\u66F4\u65B0\u3057\u3066\u518D\u5EA6\u304A\u8A66\u3057\u304F\u3060\u3055\u3044\u3002",
   serv_validationStringMin: "{min}\u6587\u5B57\u4EE5\u4E0A\u3067\u5165\u529B\u3057\u3066\u304F\u3060\u3055\u3044",
   serv_validationStringMax: "UTF-8 \u3067 {max} \u30D0\u30A4\u30C8\u4EE5\u5185\u3067\u5165\u529B\u3057\u3066\u304F\u3060\u3055\u3044",
   serv_validationNumberMin: "{min}\u4EE5\u4E0A\u306E\u5024\u3092\u5165\u529B\u3057\u3066\u304F\u3060\u3055\u3044",
@@ -82,11 +86,13 @@ var ja_JP_default = {
 // messages/zh-CN.json
 var zh_CN_default = {
+  serv_transportPlaintextRequired: "\u6B64\u63A5\u53E3\u63A5\u6536\u672A\u52A0\u5BC6\u7684\u5E94\u7528\u6570\u636E\uFF0C\u8BF7\u5173\u95ED\u4F20\u8F93\u52A0\u5BC6\u540E\u901A\u8FC7 HTTPS \u91CD\u8BD5\u3002",
   $schema: "https://inlang.com/schema/inlang-message-format",
   serv_validationFailed: "\u6570\u636E\u9A8C\u8BC1\u5931\u8D25",
   serv_validationRequired: "\u6B64\u5B57\u6BB5\u5FC5\u586B",
   serv_validationInvalid: "\u8F93\u5165\u683C\u5F0F\u65E0\u6548",
   serv_validationInvalidType: "\u5B57\u6BB5\u7C7B\u578B\u4E0D\u6B63\u786E",
+  serv_validationUnexpectedFields: "\u63D0\u4EA4\u7684\u6570\u636E\u5305\u542B\u5F53\u524D\u64CD\u4F5C\u4E0D\u652F\u6301\u7684\u5185\u5BB9\uFF0C\u8BF7\u5237\u65B0\u9875\u9762\u540E\u91CD\u8BD5\u3002",
   serv_validationStringMin: "\u81F3\u5C11\u8F93\u5165 {min} \u4E2A\u5B57\u7B26",
   serv_validationStringMax: "\u6700\u591A\u8F93\u5165 {max} \u4E2A UTF-8 \u5B57\u8282",
   serv_validationNumberMin: "\u6570\u503C\u4E0D\u80FD\u5C0F\u4E8E {min}",
@@ -397,5 +403,5 @@ function getHandlerMethod(value) {
 }
 export { WILDCARD_PERMISSION, WILDCARD_ROLE, buildHaiErrorBody, implement, normalizeServLocale, servM };
-//# sourceMappingURL=chunk-JAQIEQJS.js.map
-//# sourceMappingURL=chunk-JAQIEQJS.js.map
+//# sourceMappingURL=chunk-I3F7RN4I.js.map
+//# sourceMappingURL=chunk-I3F7RN4I.js.map

package/dist/chunk-I3F7RN4I.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../messages/en-US.json","../messages/ja-JP.json","../messages/zh-CN.json","../src/serv-i18n.ts","../src/pipelines/serv-pipeline-guard.ts","../src/pipelines/serv-pipeline-helper.ts","../src/serv-router.ts"],"names":["core","HaiCommonError","err","orpcImplement"],"mappings":";;;;;;;AAAA,IAAA,aAAA,GAAA;AAAA,EACE,+BAAA,EAAmC,yHAAA;AAAA,EACnC,OAAA,EAAW,iDAAA;AAAA,EACX,qBAAA,EAAyB,mBAAA;AAAA,EACzB,uBAAA,EAA2B,wBAAA;AAAA,EAC3B,sBAAA,EAA0B,sBAAA;AAAA,EAC1B,0BAAA,EAA8B,oBAAA;AAAA,EAC9B,+BAAA,EAAmC,iFAAA;AAAA,EACnC,wBAAA,EAA4B,iCAAA;AAAA,EAC5B,wBAAA,EAA4B,iCAAA;AAAA,EAC5B,wBAAA,EAA4B,8BAAA;AAAA,EAC5B,wBAAA,EAA4B,6BAAA;AAAA,EAC5B,uBAAA,EAA2B,+BAAA;AAAA,EAC3B,uBAAA,EAA2B,8BAAA;AAAA,EAC3B,uBAAA,EAA2B,8BAAA;AAAA,EAC3B,qBAAA,EAAyB,6BAAA;AAAA,EACzB,oBAAA,EAAwB,6BAAA;AAAA,EACxB,kBAAA,EAAsB,mBAAA;AAAA,EACtB,mBAAA,EAAuB,oBAAA;AAAA,EACvB,mBAAA,EAAuB,uBAAA;AAAA,EACvB,sBAAA,EAA0B,cAAA;AAAA,EAC1B,mBAAA,EAAuB,WAAA;AAAA,EACvB,kBAAA,EAAsB,uBAAA;AAAA,EACtB,uBAAA,EAA2B,+BAAA;AAAA,EAC3B,sBAAA,EAA0B,8CAAA;AAAA,EAC1B,2BAAA,EAA+B,yCAAA;AAAA,EAC/B,0BAAA,EAA8B,oDAAA;AAAA,EAC9B,+BAAA,EAAmC,0CAAA;AAAA,EACnC,4BAAA,EAAgC,qCAAA;AAAA,EAChC,2BAAA,EAA+B,kDAAA;AAAA,EAC/B,8BAAA,EAAkC,mDAAA;AAAA,EAClC,+BAAA,EAAmC,uEAAA;AAAA,EACnC,2BAAA,EAA+B,2BAAA;AAAA,EAC/B,2BAAA,EAA+B,4BAAA;AAAA,EAC/B,+BAAA,EAAmC,qBAAA;AAAA,EACnC,kBAAA,EAAsB,oDAAA;AAAA,EACtB,wBAAA,EAA4B;AAC9B,CAAA;;;ACrCA,IAAA,aAAA,GAAA;AAAA,EACE,+BAAA,EAAmC,gaAAA;AAAA,EACnC,OAAA,EAAW,iDAAA;AAAA,EACX,qBAAA,EAAyB,sFAAA;AAAA,EACzB,uBAAA,EAA2B,wDAAA;AAAA,EAC3B,sBAAA,EAA0B,wDAAA;AAAA,EAC1B,0BAAA,EAA8B,0EAAA;AAAA,EAC9B,+BAAA,EAAmC,sRAAA;AAAA,EACnC,wBAAA,EAA4B,qFAAA;AAAA,EAC5B,wBAAA,EAA4B,yGAAA;AAAA,EAC5B,wBAAA,EAA4B,qFAAA;AAAA,EAC5B,wBAAA,EAA4B,qFAAA;AAAA,EAC5B,uBAAA,EAA2B,yEAAA;AAAA,EAC3B,uBAAA,EAA2B,+EAAA;AAAA,EAC3B,uBAAA,EAA2B,qFAAA;AAAA,EAC3B,qBAAA,EAAyB,qFAAA;AAAA,EACzB,oBAAA,EAAwB,oHAAA;AAAA,EACxB,kBAAA,EAAsB,6EAAA;AAAA,EACtB,mBAAA,EAAuB,8EAAA;AAAA,EACvB,mBAAA,EAAuB,sFAAA;AAAA,EACvB,sBAAA,EAA0B,wDAAA;AAAA,EAC1B,mBAAA,EAAuB,0EAAA;AAAA,EACvB,kBAAA,EAAsB,wDAAA;AAAA,EACtB,uBAAA,EAA2B,0HAAA;AAAA,EAC3B,sBAAA,EAA0B,qIAAA;AAAA,EAC1B,2BAAA,EAA+B,gIAAA;AAAA,EAC/B,0BAAA,EAA8B,yLAAA;AAAA,EAC9B,+BAAA,EAAmC,0HAAA;AAAA,EACnC,4BAAA,EAAgC,8GAAA;AAAA,EAChC,2BAAA,EAA+B,4IAAA;AAAA,EAC/B,8BAAA,EAAkC,+HAAA;AAAA,EAClC,+BAAA,EAAmC,oQAAA;AAAA,EACnC,2BAAA,EAA+B,4FAAA;AAAA,EAC/B,2BAAA,EAA+B,kGAAA;AAAA,EAC/B,+BAAA,EAAmC,8DAAA;AAAA,EACnC,kBAAA,EAAsB,wMAAA;AAAA,EACtB,wBAAA,EAA4B;AAC9B,CAAA;;;ACrCA,IAAA,aAAA,GAAA;AAAA,EACE,+BAAA,EAAmC,2KAAA;AAAA,EACnC,OAAA,EAAW,iDAAA;AAAA,EACX,qBAAA,EAAyB,sCAAA;AAAA,EACzB,uBAAA,EAA2B,gCAAA;AAAA,EAC3B,sBAAA,EAA0B,sCAAA;AAAA,EAC1B,0BAAA,EAA8B,4CAAA;AAAA,EAC9B,+BAAA,EAAmC,oKAAA;AAAA,EACnC,wBAAA,EAA4B,mDAAA;AAAA,EAC5B,wBAAA,EAA4B,0DAAA;AAAA,EAC5B,wBAAA,EAA4B,4CAAA;AAAA,EAC5B,wBAAA,EAA4B,4CAAA;AAAA,EAC5B,uBAAA,EAA2B,uCAAA;AAAA,EAC3B,uBAAA,EAA2B,uCAAA;AAAA,EAC3B,uBAAA,EAA2B,gCAAA;AAAA,EAC3B,qBAAA,EAAyB,gCAAA;AAAA,EACzB,oBAAA,EAAwB,8DAAA;AAAA,EACxB,kBAAA,EAAsB,kDAAA;AAAA,EACtB,mBAAA,EAAuB,2CAAA;AAAA,EACvB,mBAAA,EAAuB,4CAAA;AAAA,EACvB,sBAAA,EAA0B,wDAAA;AAAA,EAC1B,mBAAA,EAAuB,4CAAA;AAAA,EACvB,kBAAA,EAAsB,4CAAA;AAAA,EACtB,uBAAA,EAA2B,2CAAA;AAAA,EAC3B,sBAAA,EAA0B,oEAAA;AAAA,EAC1B,2BAAA,EAA+B,uDAAA;AAAA,EAC/B,0BAAA,EAA8B,0EAAA;AAAA,EAC9B,+BAAA,EAAmC,8DAAA;AAAA,EACnC,4BAAA,EAAgC,oEAAA;AAAA,EAChC,2BAAA,EAA+B,8GAAA;AAAA,EAC/B,8BAAA,EAAkC,mGAAA;AAAA,EAClC,+BAAA,EAAmC,sIAAA;AAAA,EACnC,2BAAA,EAA+B,sCAAA;AAAA,EAC/B,2BAAA,EAA+B,sCAAA;AAAA,EAC/B,+BAAA,EAAmC,sCAAA;AAAA,EACnC,kBAAA,EAAsB,0EAAA;AAAA,EACtB,wBAAA,EAA4B;AAC9B,CAAA;;;ACZA,IAAM,sBAAA,GAAyB,CAAC,OAAA,EAAS,OAAA,EAAS,OAAO,CAAA;AACzD,IAAM,mBAAA,GAAsB,OAAA;AAmBrB,SAAS,oBAAoB,MAAA,EAAoC;AACtE,EAAA,MAAM,YAAY,MAAA,EAAQ,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,GAAG,IAAA,EAAK;AAC9C,EAAA,IAAI,CAAC,SAAA;AACH,IAAA,OAAO,mBAAA;AAET,EAAA,MAAM,KAAA,GAAQ,uBAAuB,IAAA,CAAK,CAAA,IAAA,KAAQ,KAAK,WAAA,EAAY,KAAM,SAAA,CAAU,WAAA,EAAa,CAAA;AAChG,EAAA,IAAI,KAAA;AACF,IAAA,OAAO,KAAA;AAET,EAAA,MAAM,eAAe,SAAA,CAAU,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,GAAG,WAAA,EAAY;AAC1D,EAAA,IAAI,YAAA,KAAiB,IAAA;AACnB,IAAA,OAAO,OAAA;AACT,EAAA,IAAI,YAAA,KAAiB,IAAA;AACnB,IAAA,OAAO,OAAA;AACT,EAAA,IAAI,YAAA,KAAiB,IAAA;AACnB,IAAA,OAAO,OAAA;AAET,EAAA,OAAO,mBAAA;AACT;AAiBO,IAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,mBAAA,CAAoC;AAAA,EACjE,OAAA,EAAS,aAAA;AAAA,EACT,OAAA,EAAS,aAAA;AAAA,EACT,OAAA,EAAS;AACX,CAAC;ACzDM,IAAM,mBAAA,GAAsB;AAa5B,IAAM,aAAA,GAAgB;AA+BtB,SAAS,eAAA,CAOd,cACA,OAAA,EAOwE;AACxE,EAAA,OAAO,OAAO,OAAA,KAAY;AACxB,IAAA,IAAI;AACF,MAAA,IAAI,CAAC,uBAAA,CAAwB,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC7C,QAAA,OAAO,GAAA;AAAA,UACL,cAAA,CAAe,YAAA;AAAA,UACf,MAAM,wBAAA,EAA0B,EAAE,QAAQ,OAAA,CAAQ,OAAA,CAAQ,QAAQ;AAAA,SACpE;AAAA,MACF;AAEA,MAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,OAAA,CAAQ,OAAA;AAC5B,MAAA,IAAI,YAAA,CAAa,aAAa,MAAA,EAAQ;AACpC,QAAA,MAAM,UAAU,OAAA,CAAQ,WAAA,CAAY,SAAS,mBAAmB,CAAA,IAC3D,aAAa,WAAA,CAAY,KAAA;AAAA,UAC1B,CAAA,UAAA,KAAc,OAAA,CAAQ,WAAA,CAAY,QAAA,CAAS,UAAU;AAAA,SACvD;AACF,QAAA,IAAI,CAAC,OAAA,EAAS;AACZ,UAAA,OAAO,GAAA;AAAA,YACL,cAAA,CAAe,SAAA;AAAA,YACf,MAAM,qBAAA,EAAuB,EAAE,QAAQ,OAAA,CAAQ,OAAA,CAAQ,QAAQ;AAAA,WACjE;AAAA,QACF;AAAA,MACF;AAEA,MAAA,IAAI,YAAA,CAAa,OAAO,MAAA,EAAQ;AAC9B,QAAA,MAAM,UAAU,OAAA,CAAQ,KAAA,CAAM,SAAS,aAAa,CAAA,IAC/C,aAAa,KAAA,CAAM,KAAA;AAAA,UACpB,CAAA,IAAA,KAAQ,OAAA,CAAQ,KAAA,CAAM,QAAA,CAAS,IAAI;AAAA,SACrC;AACF,QAAA,IAAI,CAAC,OAAA,EAAS;AACZ,UAAA,OAAO,GAAA;AAAA,YACL,cAAA,CAAe,SAAA;AAAA,YACf,MAAM,qBAAA,EAAuB,EAAE,QAAQ,OAAA,CAAQ,OAAA,CAAQ,QAAQ;AAAA,WACjE;AAAA,QACF;AAAA,MACF;AAEA,MAAA,OAAO,MAAM,OAAA,CAAQ;AAAA,QACnB,GAAG,OAAA;AAAA,QACH,SAAS,OAAA,CAAQ;AAAA,OAClB,CAAA;AAAA,IACH,SACO,KAAA,EAAO;AACZ,MAAA,OAAO,GAAA;AAAA,QACL,cAAA,CAAe,cAAA;AAAA,QACf,MAAM,oBAAA,EAAsB,EAAE,QAAQ,OAAA,CAAQ,OAAA,CAAQ,QAAQ,CAAA;AAAA,QAC9D;AAAA,OACF;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAEA,SAAS,wBACP,OAAA,EAC+C;AAC/C,EAAA,OAAO,OAAA,CAAQ,OAAA,KAAY,MAAA,IAAa,OAAA,CAAQ,OAAA,KAAY,IAAA;AAC9D;ACnGO,SAAS,iBAAA,CAAkB,KAAuB,OAAA,EAAiB;AACxE,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,KAAA;AAAA,IACT,KAAA,EAAO;AAAA,MACL,MAAM,GAAA,CAAI,IAAA;AAAA,MACV,SAASA,IAAAA,CAAK,KAAA,CAAM,aAAA,CAAc,EAAE,SAAS,OAAA,EAASA,IAAAA,CAAK,OAAA,CAAQ,GAAA,GAAM,OAAA,IAAWA,IAAAA,CAAK,QAAQ,GAAA,EAAI,CAAE,WAAW,CAAA;AAAA,MAClH,OAAA,EAASA,KAAK,OAAA,CAAQ,GAAA,GAAM,OAAA,IAAWA,IAAAA,CAAK,OAAA,CAAQ,GAAA,EAAI,CAAE,SAAA;AAAA,MAC1D,YAAY,GAAA,CAAI,UAAA;AAAA,MAChB,QAAQ,GAAA,CAAI,MAAA;AAAA,MACZ,QAAQ,GAAA,CAAI;AAAA;AACd,GACF;AACF;AAiBO,SAAS,YAA6B,OAAA,EAAuF;AAClI,EAAA,OAAO,CAAA,OAAA,KAAW,MAAM,WAAA,CAAY;AAAA,IAClC,KAAA,EAAO,QAAQ,OAAA,CAAQ,OAAA,GAAU,EAAE,EAAA,EAAI,OAAA,CAAQ,QAAQ,OAAA,CAAQ,MAAA,EAAQ,UAAU,OAAA,CAAQ,OAAA,CAAQ,QAAQ,QAAA,EAAU,KAAA,EAAO,QAAQ,OAAA,CAAQ,OAAA,CAAQ,OAAM,GAAI,IAAA;AAAA,IAC5J,SAAA,EAAW,QAAQ,OAAA,CAAQ,SAAA;AAAA,IAC3B,OAAA,EAAS,QAAQ,OAAA,CAAQ,SAAA;AAAA,IACzB,OAAA,EAAS,QAAQ,OAAA,CAAQ,OAAA;AAAA,IACzB,SAAA,EAAW,QAAQ,OAAA,CAAQ,EAAA;AAAA,IAC3B,WAAW,OAAA,CAAQ,OAAA,CAAQ,SAAA,EAAW,KAAA,CAAM,GAAG,IAAI;AAAA,KAClD,YAAY;AACb,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,IAAK,WAAA;AAC3C,IAAA,MAAM,OAAA,GAAU,OAAO,MAAA,EAAgB,UAAA,KAAiC;AACtE,MAAA,IAAI,CAAC,KAAA,CAAM,aAAA;AACT,QAAA;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,KAAA,CAAM,OAAA,CAAQ;AAAA,QAClC,MAAA,EAAQ,iBAAA;AAAA,QACR,QAAA;AAAA,QACA,QAAA,EAAU,6BAAA,CAA8B,IAAA,CAAK,QAAQ,IAAI,QAAA,GAAW,UAAA;AAAA,QACpE,OAAA,EAAS,CAAC,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,GAAI,QAAA,GAAW,MAAA,IAAU,MAAM,SAAA,GAAY,SAAA;AAAA,QACxF,OAAA,EAAS,EAAE,MAAA,EAAQ,OAAA,CAAQ,QAAQ,OAAA,CAAQ,MAAA,EAAQ,MAAA,EAAQ,GAAI,eAAe,MAAA,GAAY,EAAC,GAAI,EAAE,YAAW;AAAG,OACjH,EAAG,EAAE,IAAA,EAAM,CAAC,OAAO,MAAA,EAAQ,SAAS,CAAA,CAAE,QAAA,CAAS,OAAA,CAAQ,OAAA,CAAQ,OAAA,CAAQ,MAAM,GAAG,CAAA;AAChF,MAAA,IAAI,CAAC,OAAA,CAAQ,OAAA;AACX,QAAA,OAAA,CAAQ,OAAA,CAAQ,OAAO,KAAA,CAAM,sBAAA,EAAwB,EAAE,QAAA,EAAU,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAO,CAAA;AAAA,IAC3F,CAAA;AACA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,OAAO,CAAA;AACpC,MAAA,MAAM,OAAA,CAAQ,MAAA,CAAO,OAAA,GAAU,GAAA,GAAM,MAAA,CAAO,KAAA,CAAM,UAAA,IAAc,GAAA,EAAK,MAAA,CAAO,OAAA,GAAU,KAAA,CAAA,GAAY,MAAA,CAAO,MAAM,IAAI,CAAA;AACnH,MAAA,IAAI,MAAA,CAAO,OAAA;AACT,QAAA,OAAO,MAAA;AACT,MAAA,MAAM,KAAA,GAAQA,IAAAA,CAAK,KAAA,CAAM,QAAA,CAAS,MAAA,CAAO,KAAA,EAAO,OAAA,CAAQ,OAAA,CAAQ,SAAA,EAAW,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA;AACjG,MAAA,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,kBAAA,EAAoB,EAAE,OAAA,EAAS,KAAA,CAAM,OAAA,EAAS,KAAA,EAAO,MAAA,CAAO,KAAA,EAAO,CAAA;AAChG,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAM;AAAA,IACjC,SACO,KAAA,EAAO;AAEZ,MAAA,MAAM,IAAA,GAAOA,IAAAA,CAAK,KAAA,CAAM,QAAA,CAAS,EAAE,GAAGC,cAAAA,CAAe,cAAA,EAAgB,OAAA,EAAS,KAAA,CAAM,oBAAA,EAAsB,EAAE,QAAQ,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAA,EAAE,EAAG,QAAQ,OAAA,CAAQ,SAAA,EAAW,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA;AAClM,MAAA,OAAA,CAAQ,OAAA,CAAQ,OAAO,KAAA,CAAM,8BAAA,EAAgC,EAAE,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,KAAA,EAAO,CAAA;AAC7F,MAAA,MAAM,OAAA,CAAQ,GAAA,EAAKA,cAAAA,CAAe,cAAA,CAAe,IAAI,CAAA;AACrD,MAAA,OAAOC,IAAI,IAAI,CAAA;AAAA,IACjB;AAAA,EACF,CAAC,CAAA;AACH;;;ACuYO,SAAS,UACd,QAAA,EAC4B;AAC5B,EAAA,OAAO;AAAA,IACL,SAAS,MAAoC;AAC3C,MAAA,MAAM,MAAA,GAASC,WAAA,CAAc,QAAQ,CAAA,CAAE,QAAA,EAAmB;AAC1D,MAAA,OAAO,uBAAA,CAAwB,UAAU,MAAM,CAAA;AAAA,IACjD;AAAA,GACF;AACF;AAEA,SAAS,uBAAA,CAKP,UACA,WAAA,EACgE;AAChE,EAAA,MAAM,OAAA,GAAU,IAAI,wBAAA,CAAyB,QAAA,EAAU,WAAW,CAAA;AAIlE,EAAA,OAAO,OAAA;AAKT;AAuCA,IAAM,2BAAN,MAA+B;AAAA,EAK7B,WAAA,CACE,UACiB,WAAA,EACjB;AADiB,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAEjB,IAAA,IAAA,CAAK,aAAA,GAAgB,IAAI,GAAA,CAAI,qBAAA,CAAsB,QAAQ,CAAC,CAAA;AAC5D,IAAA,IAAA,CAAK,iBAAA,GAAoB,kBAAkB,QAAQ,CAAA;AAAA,EACrD;AAAA,EAJmB,WAAA;AAAA,EANF,aAAA;AAAA,EACA,iBAAA;AAAA,EACA,eAAA,uBAAsB,GAAA,EAAY;AAAA,EAUnD,KAAA,CAAM,MAAc,OAAA,EAA4B;AAC9C,IAAA,IAAI,OAAA,KAAY,MAAA;AACd,MAAA,OAAO,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,IAAI,OAAO,CAAA;AAExC,IAAA,OAAO,IAAI,4BAAA,CAA6B,IAAA,EAAM,IAAI,CAAA;AAAA,EACpD;AAAA,EAEA,QAAA,CAAS,IAAA,EAAc,MAAA,EAA+B,OAAA,EAAwB;AAC5E,IAAA,IAAI,CAAC,IAAA,CAAK,aAAA,CAAc,GAAA,CAAI,IAAI,CAAA;AAC9B,MAAA,MAAM,IAAI,SAAA,CAAU,CAAA,oCAAA,EAAuC,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,IAAI,IAAA,CAAK,eAAA,CAAgB,GAAA,CAAI,IAAI,CAAA;AAC/B,MAAA,MAAM,IAAI,SAAA,CAAU,CAAA,oCAAA,EAAuC,IAAI,CAAA,CAAE,CAAA;AACnE,IAAA,IAAI,OAAO,OAAA,KAAY,UAAA;AACrB,MAAA,MAAM,IAAI,SAAA,CAAU,CAAA,sCAAA,EAAyC,IAAI,CAAA,CAAE,CAAA;AAErE,IAAA,MAAM,oBAAA,GAAuB,SAAA,CAAU,IAAA,CAAK,WAAA,EAAa,IAAI,CAAA;AAC7D,IAAA,MAAM,gBAAA,GAAmB,iBAAiB,oBAAoB,CAAA;AAC9D,IAAA,IAAI,CAAC,gBAAA;AACH,MAAA,MAAM,IAAI,SAAA,CAAU,CAAA,oCAAA,EAAuC,IAAI,CAAA,CAAE,CAAA;AAInE,IAAA,MAAM,iBAAiB,SAAA,CAAU,MAAM,IACnC,eAAA,CAAgB,MAAA,EAAQ,OAA+C,CAAA,GACvE,OAAA;AACJ,IAAA,MAAM,WAAA,GAAc,YAAY,cAAc,CAAA;AAC9C,IAAA,MAAM,cAAc,OAAA,CAAQ,KAAA;AAAA,MAC1B,gBAAA;AAAA,MACA,oBAAA;AAAA,MACA,CAAC,WAAW;AAAA,KACd;AAEA,IAAA,SAAA,CAAU,IAAA,CAAK,iBAAA,EAAmB,IAAA,EAAM,WAAW,CAAA;AACnD,IAAA,IAAA,CAAK,eAAA,CAAgB,IAAI,IAAI,CAAA;AAC7B,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,KAAA,GAAiB;AACf,IAAA,MAAM,YAAA,GAAe,CAAC,GAAG,IAAA,CAAK,aAAa,CAAA,CACxC,MAAA,CAAO,CAAA,IAAA,KAAQ,CAAC,KAAK,eAAA,CAAgB,GAAA,CAAI,IAAI,CAAC,EAC9C,IAAA,EAAK;AACR,IAAA,IAAI,YAAA,CAAa,SAAS,CAAA,EAAG;AAC3B,MAAA,MAAM,IAAI,SAAA;AAAA,QACR,CAAA,yCAAA,EAA4C,YAAA,CAAa,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,OACrE;AAAA,IACF;AAEA,IAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,aAAa,QAAQ,CAAA;AAC3D,IAAA,IAAI,OAAO,YAAA,KAAiB,UAAA;AAC1B,MAAA,MAAM,IAAI,UAAU,+CAA+C,CAAA;AAErE,IAAA,OAAO,OAAA,CAAQ,MAAM,YAAA,EAAc,IAAA,CAAK,aAAa,CAAC,IAAA,CAAK,iBAAiB,CAAC,CAAA;AAAA,EAC/E;AACF,CAAA;AAEA,IAAM,+BAAN,MAAmC;AAAA,EAKjC,WAAA,CACmB,QACA,IAAA,EACjB;AAFiB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAChB;AAAA,EAFgB,MAAA;AAAA,EACA,IAAA;AAAA,EANX,YAAA,GAAe,KAAA;AAAA,EACN,WAAA,uBAAkB,GAAA,EAAY;AAAA,EAC9B,KAAA,uBAAY,GAAA,EAAY;AAAA,EAOzC,IAAA,GAAa;AACX,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,WAAW,UAAA,EAA0B;AACnC,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,IAAA,IAAA,CAAK,WAAA,CAAY,IAAI,UAAU,CAAA;AAC/B,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,KAAK,IAAA,EAAoB;AACvB,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,IAAA,IAAA,CAAK,KAAA,CAAM,IAAI,IAAI,CAAA;AACnB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,OAAO,OAAA,EAA4C;AACjD,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,IAAA,CAAK,IAAA,EAAM;AAAA,MACrC,MAAM,IAAA,CAAK,YAAA;AAAA,MACX,WAAA,EAAa,CAAC,GAAG,IAAA,CAAK,WAAW,CAAA;AAAA,MACjC,KAAA,EAAO,CAAC,GAAG,IAAA,CAAK,KAAK;AAAA,OACpB,OAAO,CAAA;AAAA,EACZ;AACF,CAAA;AAEA,SAAS,UAAU,MAAA,EAAwC;AACzD,EAAA,OAAO,MAAA,CAAO,IAAA,KAAS,IAAA,IAAA,CACjB,MAAA,CAAO,WAAA,EAAa,MAAA,IAAU,CAAA,IAAK,CAAA,IAAA,CACnC,MAAA,CAAO,KAAA,EAAO,MAAA,IAAU,CAAA,IAAK,CAAA;AACrC;AAEA,SAAS,qBAAA,CACP,QAAA,EACA,MAAA,GAA4B,EAAC,EACnB;AACV,EAAA,IAAI,oBAAoB,QAAQ,CAAA;AAC9B,IAAA,OAAO,MAAA,CAAO,SAAS,CAAA,GAAI,CAAC,OAAO,IAAA,CAAK,GAAG,CAAC,CAAA,GAAI,EAAC;AAEnD,EAAA,OAAO,OAAO,OAAA,CAAQ,QAAQ,CAAA,CAAE,OAAA,CAAQ,CAAC,CAAC,GAAA,EAAK,KAAK,CAAA,KAClD,sBAAsB,KAAA,EAAO,CAAC,GAAG,MAAA,EAAQ,GAAG,CAAC,CAAC,CAAA;AAClD;AAEA,SAAS,oBAAoB,QAAA,EAAiC;AAC5D,EAAA,OAAO,OAAA,IAAW,QAAA;AACpB;AAEA,SAAS,kBAAkB,QAAA,EAAiD;AAC1E,EAAA,MAAM,KAAA,mBAAiC,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA;AAEzD,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACnD,IAAA,IAAI,CAAC,oBAAoB,KAAK,CAAA;AAC5B,MAAA,KAAA,CAAM,GAAG,CAAA,GAAI,iBAAA,CAAkB,KAAK,CAAA;AAAA,EACxC;AAEA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,SAAA,CAAU,MAAc,IAAA,EAAuB;AACtD,EAAA,IAAI,OAAA,GAAmB,IAAA;AAEvB,EAAA,KAAA,MAAW,OAAA,IAAW,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,EAAG;AACrC,IAAA,IACG,OAAO,OAAA,KAAY,QAAA,IAAY,OAAO,OAAA,KAAY,cAChD,OAAA,KAAY,IAAA,IACZ,EAAE,OAAA,IAAW,OAAA,CAAA,EAChB;AACA,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,OAAA,EAAS,OAAO,CAAA;AAAA,EACxC;AAEA,EAAA,OAAO,OAAA;AACT;AAEA,SAAS,SAAA,CAAU,IAAA,EAA+B,IAAA,EAAc,KAAA,EAAsB;AACpF,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC/B,EAAA,MAAM,IAAA,GAAO,SAAS,GAAA,EAAI;AAC1B,EAAA,IAAI,CAAC,IAAA;AACH,IAAA,MAAM,IAAI,UAAU,gCAAgC,CAAA;AAEtD,EAAA,IAAI,OAAA,GAAU,IAAA;AACd,EAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,IAAA,MAAM,QAAA,GAAW,QAAQ,OAAO,CAAA;AAChC,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,MAAM,KAAA,mBAAiC,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA;AACzD,MAAA,OAAA,CAAQ,OAAO,CAAA,GAAI,KAAA;AACnB,MAAA,OAAA,GAAU,KAAA;AACV,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA;AACnC,MAAA,MAAM,IAAI,SAAA,CAAU,CAAA,iDAAA,EAAoD,IAAI,CAAA,CAAE,CAAA;AAEhF,IAAA,OAAA,GAAU,QAAA;AAAA,EACZ;AAEA,EAAA,OAAA,CAAQ,IAAI,CAAA,GAAI,KAAA;AAClB;AAEA,SAAS,iBAAiB,KAAA,EAA6D;AACrF,EAAA,IAAK,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,KAAA,KAAU,cAAe,KAAA,KAAU,IAAA;AAC1E,IAAA,OAAO,MAAA;AAET,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,KAAA,EAAO,SAAS,CAAA;AAC5C,EAAA,OAAO,OAAO,OAAA,KAAY,UAAA,GACtB,OAAA,GACA,MAAA;AACN","file":"chunk-I3F7RN4I.js","sourcesContent":["{\n \"serv_transportPlaintextRequired\": \"This endpoint accepts unencrypted application data. Disable transport encryption for this request and retry over HTTPS.\",\n \"$schema\": \"https://inlang.com/schema/inlang-message-format\",\n \"serv_validationFailed\": \"Validation failed\",\n \"serv_validationRequired\": \"This field is required\",\n \"serv_validationInvalid\": \"Invalid input format\",\n \"serv_validationInvalidType\": \"Invalid field type\",\n \"serv_validationUnexpectedFields\": \"The submitted data contains unsupported fields. Refresh the page and try again.\",\n \"serv_validationStringMin\": \"Enter at least {min} characters\",\n \"serv_validationStringMax\": \"Enter at most {max} UTF-8 bytes\",\n \"serv_validationNumberMin\": \"Value must be at least {min}\",\n \"serv_validationNumberMax\": \"Value must be at most {max}\",\n \"serv_validationArrayMin\": \"Select at least {min} item(s)\",\n \"serv_validationArrayMax\": \"Select at most {max} item(s)\",\n \"serv_validationTooSmall\": \"Value must be at least {min}\",\n \"serv_validationTooBig\": \"Value must be at most {max}\",\n \"serv_validationEmail\": \"Enter a valid email address\",\n \"serv_validationUrl\": \"Enter a valid URL\",\n \"serv_validationUuid\": \"Enter a valid UUID\",\n \"serv_validationEnum\": \"Select a valid option\",\n \"serv_errorUnauthorized\": \"Unauthorized\",\n \"serv_errorForbidden\": \"Forbidden\",\n \"serv_errorInternal\": \"Internal server error\",\n \"serv_storageKeyRequired\": \"Storage key must not be empty\",\n \"serv_storageKeyTooLong\": \"Storage key must not exceed {max} characters\",\n \"serv_storageKeyIllegalChars\": \"Storage key contains illegal characters\",\n \"serv_storageKeyDotSegments\": \"Storage key must not contain . or .. path segments\",\n \"serv_iamCannotDeleteCurrentUser\": \"Cannot delete the current logged-in user\",\n \"serv_transportInvalidPayload\": \"Invalid encrypted transport payload\",\n \"serv_transportUnknownClient\": \"Unknown encryption client; key exchange required\",\n \"serv_transportClientIdRequired\": \"Missing X-Client-Id header; key exchange required\",\n \"serv_transportClientKeyNotFound\": \"Client not registered or session expired; complete key exchange again\",\n \"serv_transportDecryptFailed\": \"Failed to decrypt request\",\n \"serv_transportEncryptFailed\": \"Failed to encrypt response\",\n \"serv_transportKeyExchangeFailed\": \"Key exchange failed\",\n \"serv_transportBusy\": \"Material processing is busy. Please retry shortly.\",\n \"serv_feedbackUnavailable\": \"Feedback is temporarily unavailable. Business features remain available.\"\n}\n","{\n \"serv_transportPlaintextRequired\": \"このエンドポイントはアプリケーション層で暗号化されていないデータを受け付けます。リクエストの伝送暗号化を無効にし、HTTPS で再試行してください。\",\n \"$schema\": \"https://inlang.com/schema/inlang-message-format\",\n \"serv_validationFailed\": \"入力内容の検証に失敗しました\",\n \"serv_validationRequired\": \"この項目は必須です\",\n \"serv_validationInvalid\": \"入力形式が無効です\",\n \"serv_validationInvalidType\": \"フィールドの型が無効です\",\n \"serv_validationUnexpectedFields\": \"送信データにこの操作で使用できない項目が含まれています。ページを更新して再度お試しください。\",\n \"serv_validationStringMin\": \"{min}文字以上で入力してください\",\n \"serv_validationStringMax\": \"UTF-8 で {max} バイト以内で入力してください\",\n \"serv_validationNumberMin\": \"{min}以上の値を入力してください\",\n \"serv_validationNumberMax\": \"{max}以下の値を入力してください\",\n \"serv_validationArrayMin\": \"{min}件以上選択してください\",\n \"serv_validationArrayMax\": \"{max}件以内で選択してください\",\n \"serv_validationTooSmall\": \"{min}以上の値を入力してください\",\n \"serv_validationTooBig\": \"{max}以下の値を入力してください\",\n \"serv_validationEmail\": \"有効なメールアドレスを入力してください\",\n \"serv_validationUrl\": \"有効なURLを入力してください\",\n \"serv_validationUuid\": \"有効なUUIDを入力してください\",\n \"serv_validationEnum\": \"有効な選択肢を選んでください\",\n \"serv_errorUnauthorized\": \"認証されていません\",\n \"serv_errorForbidden\": \"アクセスが拒否されました\",\n \"serv_errorInternal\": \"サーバー内部エラー\",\n \"serv_storageKeyRequired\": \"ストレージキーを空にすることはできません\",\n \"serv_storageKeyTooLong\": \"ストレージキーは{max}文字以内で指定してください\",\n \"serv_storageKeyIllegalChars\": \"ストレージキーに無効な文字が含まれています\",\n \"serv_storageKeyDotSegments\": \"ストレージキーに「.」や「..」のパス要素を含めることはできません\",\n \"serv_iamCannotDeleteCurrentUser\": \"現在ログイン中のユーザーは削除できません\",\n \"serv_transportInvalidPayload\": \"暗号化された通信ペイロードが無効です\",\n \"serv_transportUnknownClient\": \"暗号化クライアントが不明です。鍵交換が必要です\",\n \"serv_transportClientIdRequired\": \"X-Client-Idヘッダーがありません。鍵交換が必要です\",\n \"serv_transportClientKeyNotFound\": \"クライアントが未登録か、セッションの有効期限が切れています。再度鍵交換を行ってください\",\n \"serv_transportDecryptFailed\": \"リクエストの復号に失敗しました\",\n \"serv_transportEncryptFailed\": \"レスポンスの暗号化に失敗しました\",\n \"serv_transportKeyExchangeFailed\": \"鍵交換に失敗しました\",\n \"serv_transportBusy\": \"資料の処理が混み合っています。しばらくしてから再試行してください。\",\n \"serv_feedbackUnavailable\": \"フィードバックは一時的に利用できません。業務機能は引き続き利用できます。\"\n}\n","{\n \"serv_transportPlaintextRequired\": \"此接口接收未加密的应用数据，请关闭传输加密后通过 HTTPS 重试。\",\n \"$schema\": \"https://inlang.com/schema/inlang-message-format\",\n \"serv_validationFailed\": \"数据验证失败\",\n \"serv_validationRequired\": \"此字段必填\",\n \"serv_validationInvalid\": \"输入格式无效\",\n \"serv_validationInvalidType\": \"字段类型不正确\",\n \"serv_validationUnexpectedFields\": \"提交的数据包含当前操作不支持的内容，请刷新页面后重试。\",\n \"serv_validationStringMin\": \"至少输入 {min} 个字符\",\n \"serv_validationStringMax\": \"最多输入 {max} 个 UTF-8 字节\",\n \"serv_validationNumberMin\": \"数值不能小于 {min}\",\n \"serv_validationNumberMax\": \"数值不能大于 {max}\",\n \"serv_validationArrayMin\": \"至少选择 {min} 项\",\n \"serv_validationArrayMax\": \"最多选择 {max} 项\",\n \"serv_validationTooSmall\": \"不能小于 {min}\",\n \"serv_validationTooBig\": \"不能大于 {max}\",\n \"serv_validationEmail\": \"请输入有效的邮箱地址\",\n \"serv_validationUrl\": \"请输入有效的网址\",\n \"serv_validationUuid\": \"请输入有效的 UUID\",\n \"serv_validationEnum\": \"请选择有效选项\",\n \"serv_errorUnauthorized\": \"未登录或登录已失效\",\n \"serv_errorForbidden\": \"无权执行该操作\",\n \"serv_errorInternal\": \"服务器内部错误\",\n \"serv_storageKeyRequired\": \"存储 key 不能为空\",\n \"serv_storageKeyTooLong\": \"存储 key 不能超过 {max} 个字符\",\n \"serv_storageKeyIllegalChars\": \"存储 key 包含非法字符\",\n \"serv_storageKeyDotSegments\": \"存储 key 不能包含 . 或 .. 路径段\",\n \"serv_iamCannotDeleteCurrentUser\": \"不能删除当前登录用户\",\n \"serv_transportInvalidPayload\": \"传输层加密载荷格式无效\",\n \"serv_transportUnknownClient\": \"未识别的加密客户端，请先完成密钥协商\",\n \"serv_transportClientIdRequired\": \"缺少 X-Client-Id 请求头，请先完成密钥协商\",\n \"serv_transportClientKeyNotFound\": \"客户端未注册或会话已过期，请重新完成密钥协商\",\n \"serv_transportDecryptFailed\": \"请求解密失败\",\n \"serv_transportEncryptFailed\": \"响应加密失败\",\n \"serv_transportKeyExchangeFailed\": \"密钥协商失败\",\n \"serv_transportBusy\": \"材料处理繁忙，请稍后重试\",\n \"serv_feedbackUnavailable\": \"问题反馈暂不可用，业务功能可继续使用\"\n}\n","/**\n * @h-ai/serv — i18n 工具\n *\n * Serv 模块的国际化消息工具，从 @h-ai/core 调用 i18n API。\n * 与 kit-i18n 结构对齐，便于跨包统一维护。\n * @module serv-i18n\n */\n\nimport { core } from '@h-ai/core'\nimport messagesEnUS from '../messages/en-US.json'\nimport messagesJaJP from '../messages/ja-JP.json'\nimport messagesZhCN from '../messages/zh-CN.json'\n\n/**\n * Serv 本地化消息的真实 key 联合。\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const key: ServMessageKey = 'serv_errorForbidden'\n * const message = servM(key, { locale: 'en-US' })\n * ```\n */\ntype ServMessageKey = keyof typeof messagesZhCN\n\nconst SUPPORTED_SERV_LOCALES = ['zh-CN', 'en-US', 'ja-JP'] as const\nconst DEFAULT_SERV_LOCALE = 'zh-CN'\n\n/**\n * 规范化 serv 请求 locale。\n *\n * 支持：\n * - 完整 locale：`zh-CN` / `en-US` / `ja-JP`\n * - 简写：`zh` / `en` / `ja`\n * - `Accept-Language` 风格值：`en-US,en;q=0.9`\n *\n * 未识别时回退到默认 `zh-CN`。\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const english = normalizeServLocale('en-US,en;q=0.9')\n * const fallback = normalizeServLocale(undefined)\n * ```\n */\nexport function normalizeServLocale(locale: string | undefined): string {\n const candidate = locale?.split(',')[0]?.trim()\n if (!candidate)\n return DEFAULT_SERV_LOCALE\n\n const exact = SUPPORTED_SERV_LOCALES.find(item => item.toLowerCase() === candidate.toLowerCase())\n if (exact)\n return exact\n\n const baseLanguage = candidate.split('-')[0]?.toLowerCase()\n if (baseLanguage === 'en')\n return 'en-US'\n if (baseLanguage === 'ja')\n return 'ja-JP'\n if (baseLanguage === 'zh')\n return 'zh-CN'\n\n return DEFAULT_SERV_LOCALE\n}\n\n/**\n * 获取 Serv 模块的 i18n 消息。\n *\n * 单次调用可通过 `options.locale` 指定该次调用使用的语言，\n * 用于在请求处理过程中根据 `Accept-Language` 头本地化错误消息，\n * 而不污染全局 locale（多并发请求安全）。\n *\n * @example\n * ```ts\n * import { serv } from '@h-ai/serv'\n *\n * const message = serv.m('serv_validationStringMin', { locale: 'en-US', params: { min: 3 } })\n * // 单次 locale 不修改并发请求的全局语言。\n * ```\n */\nexport const servM = core.i18n.createMessageGetter<ServMessageKey>({\n 'zh-CN': messagesZhCN,\n 'en-US': messagesEnUS,\n 'ja-JP': messagesJaJP,\n})\n\nexport type { ServMessageKey }\n","/**\n * @h-ai/serv — procedure 认证与授权 guard\n *\n * 将认证、权限、角色及异常映射合并为单个 handler 包装层，并在类型上把\n * `context.session` 收窄为非空。\n *\n * @module pipelines/serv-pipeline-guard\n */\n\nimport type { HaiResult } from '@h-ai/core'\nimport type { ErrorMap, Meta, ProcedureHandler } from '@orpc/server'\nimport type { ServContext } from '../serv-context.js'\nimport type { AuthenticatedServContext } from '../serv-router.js'\nimport { err, HaiCommonError } from '@h-ai/core'\nimport { servM } from '../serv-i18n.js'\n\n/**\n * 通配符权限。仅应授予受信任的超级管理员，可通过任意 permission guard。\n *\n * @example\n * ```ts\n * import { serv } from '@h-ai/serv'\n *\n * const wildcard = serv.WILDCARD_PERMISSION\n * // 仅可信超级管理员可拥有通配符 permissions；普通用户使用明确能力列表。\n * ```\n */\nexport const WILDCARD_PERMISSION = '*'\n\n/**\n * 通配符角色。仅应授予受信任的超级管理员，可通过任意 role guard。\n *\n * @example\n * ```ts\n * import { serv } from '@h-ai/serv'\n *\n * const wildcard = serv.WILDCARD_ROLE\n * // 仅可信超级管理员可拥有通配符 roles；普通用户使用明确能力列表。\n * ```\n */\nexport const WILDCARD_ROLE = '*'\n\n/**\n * 内部 route guard 要求；权限/角色检查以可信非空会话为前提。\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const requirements: ServGuardRequirements = { auth: true, permissions: ['reports.read'] }\n * const guarded = applyServGuards(requirements, ({ context }) => ({ success: true, data: { userId: context.session.userId } }))\n * ```\n */\nexport interface ServGuardRequirements {\n readonly auth?: boolean\n readonly permissions?: readonly string[]\n readonly roles?: readonly string[]\n}\n\n/**\n * 将 guard 应用于一个使用 HaiResult 输出的 oRPC handler。\n *\n * 完整保留 oRPC 的 `path`、`procedure`、`signal`、`lastEventId`、`errors` 等\n * options；只在校验成功后把 `context` 收窄为带非空 session 的类型。\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const guarded = applyServGuards({ permissions: ['reports.read'] }, ({ context }) => ({ success: true, data: { userId: context.session.userId } }))\n * // 业务 handler 只在可信 session 满足全部权限后执行。\n * ```\n */\nexport function applyServGuards<\n TContext extends ServContext,\n TInput,\n TData,\n TErrorMap extends ErrorMap,\n TMeta extends Meta,\n>(\n requirements: ServGuardRequirements,\n handler: ProcedureHandler<\n AuthenticatedServContext<TContext>,\n TInput,\n HaiResult<TData>,\n TErrorMap,\n TMeta\n >,\n): ProcedureHandler<TContext, TInput, HaiResult<TData>, TErrorMap, TMeta> {\n return async (options) => {\n try {\n if (!hasAuthenticatedSession(options.context)) {\n return err(\n HaiCommonError.UNAUTHORIZED,\n servM('serv_errorUnauthorized', { locale: options.context.locale }),\n )\n }\n\n const { session } = options.context\n if (requirements.permissions?.length) {\n const allowed = session.permissions.includes(WILDCARD_PERMISSION)\n || requirements.permissions.every(\n permission => session.permissions.includes(permission),\n )\n if (!allowed) {\n return err(\n HaiCommonError.FORBIDDEN,\n servM('serv_errorForbidden', { locale: options.context.locale }),\n )\n }\n }\n\n if (requirements.roles?.length) {\n const allowed = session.roles.includes(WILDCARD_ROLE)\n || requirements.roles.every(\n role => session.roles.includes(role),\n )\n if (!allowed) {\n return err(\n HaiCommonError.FORBIDDEN,\n servM('serv_errorForbidden', { locale: options.context.locale }),\n )\n }\n }\n\n return await handler({\n ...options,\n context: options.context,\n })\n }\n catch (error) {\n return err(\n HaiCommonError.INTERNAL_ERROR,\n servM('serv_errorInternal', { locale: options.context.locale }),\n error,\n )\n }\n }\n}\n\nfunction hasAuthenticatedSession<TContext extends ServContext>(\n context: TContext,\n): context is AuthenticatedServContext<TContext> {\n return context.session !== undefined && context.session !== null\n}\n","/**\n * @h-ai/serv — Pipeline 公共 helper\n *\n * 放置不属于 Hono middleware / route guard 默认实现本身、\n * 但会被多个 pipeline 复用的公共工具。\n * @module pipelines/serv-pipeline-helper\n */\n\nimport type { ServProcedureHandler } from './serv-pipeline-types.js'\nimport { audit } from '@h-ai/audit'\nimport { core, err, HaiCommonError } from '@h-ai/core'\nimport { servM } from '../serv-i18n.js'\n\n/**\n * 构造 `HaiResult` 失败分支同构的 HTTP 错误定义。\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const definition: ServErrorBodyDef = HaiCommonError.UNAUTHORIZED\n * const body = buildHaiErrorBody(definition, servM('serv_errorUnauthorized'))\n * ```\n */\nexport interface ServErrorBodyDef {\n readonly code: string | number\n readonly httpStatus: number\n readonly system: string\n readonly module: string\n}\n\n/**\n * 构造与 `HaiResult` 失败分支同构的 HTTP 响应体。\n *\n * - 字段顺序与 `haiResultSchema()` 输出一致，便于客户端统一解析。\n * - 仅暴露最小信息（code/message/httpStatus），避免泄漏内部细节。\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const body = buildHaiErrorBody(HaiCommonError.FORBIDDEN, servM('serv_errorForbidden'))\n * // HTTP middleware 再设置 status；body 只包含安全的领域错误字段。\n * ```\n */\nexport function buildHaiErrorBody(def: ServErrorBodyDef, message: string) {\n return {\n success: false as const,\n error: {\n code: def.code,\n message: core.error.formatMessage({ message, traceId: core.context.get().traceId ?? core.context.get().requestId }),\n traceId: core.context.get().traceId ?? core.context.get().requestId,\n httpStatus: def.httpStatus,\n system: def.system,\n module: def.module,\n },\n }\n}\n\n/**\n * 捕获未处理异常并转换为 HaiResult。\n *\n * 由 contract router 在注册 handler 时统一应用，业务代码无需手动包装。\n *\n * @param handler - 被包装的 procedure handler\n * @returns 带异常保护的新 handler\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const wrapped = mapHaiError<{ id: string }, { id: string }>(async ({ input }) => ({ success: true, data: { id: input.id } }))\n * // oRPC 原始 options 原样传入；未处理异常在此转换为领域错误。\n * ```\n */\nexport function mapHaiError<TInput, TOutput>(handler: ServProcedureHandler<TInput, TOutput>): ServProcedureHandler<TInput, TOutput> {\n return options => audit.withContext({\n actor: options.context.session ? { id: options.context.session.userId, username: options.context.session.username, roles: options.context.session.roles } : null,\n requestId: options.context.requestId,\n traceId: options.context.requestId,\n scopeId: options.context.scopeId,\n ipAddress: options.context.ip,\n userAgent: options.context.userAgent?.slice(0, 4096),\n }, async () => {\n const resource = options.path.join('.') || 'procedure'\n const capture = async (status: number, reasonCode?: string | number) => {\n if (!audit.isInitialized)\n return\n const written = await audit.capture({\n action: 'request.execute',\n resource,\n category: /^(?:iam|auth|audit)(?:\\.|$)/.test(resource) ? 'system' : 'business',\n outcome: [401, 403, 423, 429].includes(status) ? 'denied' : status >= 400 ? 'failure' : 'success',\n details: { method: options.context.request.method, status, ...(reasonCode === undefined ? {} : { reasonCode }) },\n }, { read: ['GET', 'HEAD', 'OPTIONS'].includes(options.context.request.method) })\n if (!written.success)\n options.context.logger.error('Request audit failed', { resource, error: written.error })\n }\n try {\n const result = await handler(options)\n await capture(result.success ? 200 : result.error.httpStatus ?? 500, result.success ? undefined : result.error.code)\n if (result.success)\n return result\n const error = core.error.toPublic(result.error, options.context.requestId, options.context.locale)\n options.context.logger.error('Procedure failed', { traceId: error.traceId, error: result.error })\n return { success: false, error }\n }\n catch (error) {\n // 所有未捕获异常统一在这里收口，避免直接把异常冒泡到 HTTP 层。\n const safe = core.error.toPublic({ ...HaiCommonError.INTERNAL_ERROR, message: servM('serv_errorInternal', { locale: options.context.locale }) }, options.context.requestId, options.context.locale)\n options.context.logger.error('Procedure threw an exception', { traceId: safe.traceId, error })\n await capture(500, HaiCommonError.INTERNAL_ERROR.code)\n return err(safe)\n }\n })\n}\n","/**\n * @h-ai/serv — contract-first 链式 procedure 实现器\n *\n * 在 oRPC `implement()` 之上提供 route 名只出现一次的链式 DSL。\n * 应用只接触 contract 路径、上下文与 guard，不需要组装 oRPC router 对象。\n *\n * @module serv-router\n */\n\nimport type { HaiResult } from '@h-ai/core'\nimport type {\n Context,\n ContractProcedure,\n ContractRouter,\n ErrorMap,\n Implementer,\n InferSchemaInput,\n InferSchemaOutput,\n Meta,\n ProcedureHandler,\n Router,\n UnlaziedRouter,\n} from '@orpc/server'\nimport type { ServGuardRequirements } from './pipelines/serv-pipeline-guard.js'\nimport type { ServContext } from './serv-context.js'\nimport { implement as orpcImplement } from '@orpc/server'\nimport { applyServGuards } from './pipelines/serv-pipeline-guard.js'\nimport { mapHaiError } from './pipelines/serv-pipeline-helper.js'\n\n/**\n * 内部初始 context 空约束，用于保持 oRPC 推导而不伪造运行时字段。\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const { serv } = await import('@h-ai/serv')\n * const context: ServContext & EmptyContext = serv.parseRequestContext({ request: new Request('https://example.com/ping') })\n * const requestId = context.requestId\n * ```\n */\ntype EmptyContext = Record<never, never>\n/**\n * 提取 contract 的字符串键，排除 symbol/数字索引。\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const { apiContract } = await import('@h-ai/api-contract')\n * const { z } = await import('zod')\n * const { ok } = await import('@h-ai/core')\n * const contract = { ping: apiContract.route({ method: 'GET', path: '/ping' }).output(apiContract.haiResultSchema(z.object({ ready: z.boolean() }))) }\n * const path: StringKey<typeof contract> = 'ping'\n * const procedure = contract[path]\n * ```\n */\ntype StringKey<T> = Extract<keyof T, string>\n/**\n * 内部 contract 泛型边界；真实 procedure 输出须为 HaiResult。\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const { apiContract } = await import('@h-ai/api-contract')\n * const { z } = await import('zod')\n * const { ok } = await import('@h-ai/core')\n * const contract = { ping: apiContract.route({ method: 'GET', path: '/ping' }).output(apiContract.haiResultSchema(z.object({ ready: z.boolean() }))) }\n * const checked = contract satisfies ServContract\n * const procedures = implement(checked).context<ServContext>().route('ping', () => ok({ ready: true })).build()\n * ```\n */\ntype ServContract = ContractRouter<Meta>\n\n/**\n * contract 中所有 procedure 的点分路径。\n *\n * @example\n * ```ts\n * import type { ServRoutePath } from '@h-ai/serv'\n * import type { ServContext } from '@h-ai/serv'\n * import { apiContract } from '@h-ai/api-contract'\n * import { ok } from '@h-ai/core'\n * import { serv } from '@h-ai/serv'\n * import { z } from 'zod'\n *\n * const contract = { ping: apiContract.route({ method: 'GET', path: '/ping' }).output(apiContract.haiResultSchema(z.object({ ready: z.boolean() }))) }\n * const path: ServRoutePath<typeof contract> = 'ping'\n * const procedures = serv.implement(contract).context<ServContext>().route(path, () => ok({ ready: true })).build()\n * ```\n */\nexport type ServRoutePath<TContract extends ServContract>\n = TContract extends ContractProcedure<\n infer _TInputSchema,\n infer _TOutputSchema,\n infer _TErrorMap,\n infer _TMeta\n >\n ? never\n : {\n [K in StringKey<TContract>]: TContract[K] extends ContractProcedure<\n infer _TChildInputSchema,\n infer _TChildOutputSchema,\n infer _TChildErrorMap,\n infer _TChildMeta\n >\n ? K\n : TContract[K] extends ServContract\n ? ServRoutePath<TContract[K]> extends infer TChild extends string\n ? `${K}.${TChild}`\n : never\n : never\n }[StringKey<TContract>]\n\n/**\n * 按点分路径查找原始 contract procedure；不存在的路径推导为 never。\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const { apiContract } = await import('@h-ai/api-contract')\n * const { z } = await import('zod')\n * const { ok } = await import('@h-ai/core')\n * const contract = { ping: apiContract.route({ method: 'GET', path: '/ping' }).output(apiContract.haiResultSchema(z.object({ ready: z.boolean() }))) }\n * const procedure: ContractAtPath<typeof contract, 'ping'> = contract.ping\n * const scoped = implement({ ping: procedure }).context<ServContext>().route('ping', () => ok({ ready: true })).build()\n * ```\n */\ntype ContractAtPath<TContract, TPath extends string>\n = TPath extends `${infer THead}.${infer TTail}`\n ? THead extends keyof TContract\n ? ContractAtPath<TContract[THead], TTail>\n : never\n : TPath extends keyof TContract\n ? TContract[TPath]\n : never\n\n/**\n * 将合法路由路径映射到对应 contract，供 handler 推导复用。\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const { apiContract } = await import('@h-ai/api-contract')\n * const { z } = await import('zod')\n * const { ok } = await import('@h-ai/core')\n * const contract = { ping: apiContract.route({ method: 'GET', path: '/ping' }).output(apiContract.haiResultSchema(z.object({ ready: z.boolean() }))) }\n * const procedure: RouteContract<typeof contract, 'ping'> = contract.ping\n * const scoped = implement({ ping: procedure }).context<ServContext>().route('ping', () => ok({ ready: true })).build()\n * ```\n */\ntype RouteContract<\n TContract extends ServContract,\n TPath extends ServRoutePath<TContract>,\n> = ContractAtPath<TContract, TPath>\n\n/**\n * `.auth()`、`.permission()`、`.role()` 后的非空会话上下文。\n *\n * @example\n * ```ts\n * import type { AuthenticatedServContext } from '@h-ai/serv'\n *\n * function owner(context: AuthenticatedServContext): string {\n * return context.session.userId\n * }\n * // 仅成功 guard 或可信认证结果能建立此上下文，禁止用客户端字段断言。\n * ```\n */\nexport type AuthenticatedServContext<TContext extends ServContext = ServContext>\n = TContext & {\n readonly session: NonNullable<TContext['session']>\n }\n\n/**\n * 内部从具体 procedure 的输入/输出与 context 推导 HaiResult handler。\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const { apiContract } = await import('@h-ai/api-contract')\n * const { z } = await import('zod')\n * const { ok } = await import('@h-ai/core')\n * const contract = { ping: apiContract.route({ method: 'GET', path: '/ping' }).output(apiContract.haiResultSchema(z.object({ ready: z.boolean() }))) }\n * const handler: RouteHandler<typeof contract.ping, ServContext> = () => ok({ ready: true })\n * const procedures = implement(contract).context<ServContext>().route('ping', handler).build()\n * ```\n */\ntype RouteHandler<\n TRouteContract,\n TContext extends Context,\n> = TRouteContract extends ContractProcedure<\n infer TInputSchema,\n infer TOutputSchema,\n infer TErrorMap,\n infer TMeta\n>\n ? InferSchemaInput<TOutputSchema> extends HaiResult<unknown>\n ? ProcedureHandler<\n TContext,\n InferSchemaOutput<TInputSchema>,\n InferSchemaInput<TOutputSchema>,\n TErrorMap,\n TMeta\n >\n : never\n : never\n\n/**\n * 从 contract procedure 精确推导当前 route 的 HaiResult handler。\n *\n * @example\n * ```ts\n * import type { ServRouteHandler } from '@h-ai/serv'\n * import type { ServContext } from '@h-ai/serv'\n * import { apiContract } from '@h-ai/api-contract'\n * import { ok } from '@h-ai/core'\n * import { serv } from '@h-ai/serv'\n * import { z } from 'zod'\n *\n * const contract = { ping: apiContract.route({ method: 'GET', path: '/ping' }).output(apiContract.haiResultSchema(z.object({ ready: z.boolean() }))) }\n * const handler: ServRouteHandler<typeof contract, 'ping', ServContext> = () => ok({ ready: true })\n * const procedures = serv.implement(contract).context<ServContext>().route('ping', handler).build()\n * ```\n */\nexport type ServRouteHandler<\n TContract extends ServContract,\n TPath extends ServRoutePath<TContract>,\n TContext extends Context,\n> = RouteHandler<RouteContract<TContract, TPath>, TContext>\n\n/**\n * 内部认证成功 handler 类型；session 在 guard 之后非空。\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const { apiContract } = await import('@h-ai/api-contract')\n * const { z } = await import('zod')\n * const { ok } = await import('@h-ai/core')\n * const contract = { ping: apiContract.route({ method: 'GET', path: '/ping' }).output(apiContract.haiResultSchema(z.object({ ready: z.boolean() }))) }\n * const handler: ServGuardedRouteHandler<typeof contract, 'ping', ServContext> = ({ context }) => ok({ ready: context.session.userId.length > 0 })\n * const procedures = implement(contract).context<ServContext>().route('ping').auth().handle(handler).build()\n * ```\n */\ntype ServGuardedRouteHandler<\n TContract extends ServContract,\n TPath extends ServRoutePath<TContract>,\n TContext extends ServContext,\n> = RouteHandler<RouteContract<TContract, TPath>, AuthenticatedServContext<TContext>>\n\n/**\n * 一次注册后移除该路径的 builder；全部路径完成才提供 build。\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const { apiContract } = await import('@h-ai/api-contract')\n * const { z } = await import('zod')\n * const { ok } = await import('@h-ai/core')\n * const contract = { ping: apiContract.route({ method: 'GET', path: '/ping' }).output(apiContract.haiResultSchema(z.object({ ready: z.boolean() }))) }\n * const next: NextBuilder<typeof contract, ServContext, ServContext, 'ping', 'ping'> = implement(contract).context<ServContext>().route('ping', () => ok({ ready: true }))\n * const procedures = next.build()\n * ```\n */\ntype NextBuilder<\n TContract extends ServContract,\n TInitialContext extends Context,\n TCurrentContext extends ServContext,\n TRemaining extends ServRoutePath<TContract>,\n TPath extends TRemaining,\n> = ServRouterBuilder<\n TContract,\n TInitialContext,\n TCurrentContext,\n Exclude<TRemaining, TPath>\n>\n\n/**\n * 尚未声明 guard 的单 route 注册器。\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const { apiContract } = await import('@h-ai/api-contract')\n * const { z } = await import('zod')\n * const { ok } = await import('@h-ai/core')\n * const contract = { ping: apiContract.route({ method: 'GET', path: '/ping' }).output(apiContract.haiResultSchema(z.object({ ready: z.boolean() }))) }\n * const route: ServRouteRegistration<typeof contract, ServContext, ServContext, 'ping', 'ping'> = implement(contract).context<ServContext>().route('ping')\n * const procedures = route.auth().handle(() => ok({ ready: true })).build()\n * ```\n */\nexport interface ServRouteRegistration<\n TContract extends ServContract,\n TInitialContext extends Context,\n TCurrentContext extends ServContext,\n TRemaining extends ServRoutePath<TContract>,\n TPath extends TRemaining,\n> {\n readonly auth: () => ServGuardedRouteRegistration<\n TContract,\n TInitialContext,\n TCurrentContext,\n TRemaining,\n TPath\n >\n readonly permission: (permission: string) => ServGuardedRouteRegistration<\n TContract,\n TInitialContext,\n TCurrentContext,\n TRemaining,\n TPath\n >\n readonly role: (role: string) => ServGuardedRouteRegistration<\n TContract,\n TInitialContext,\n TCurrentContext,\n TRemaining,\n TPath\n >\n}\n\n/**\n * 已声明认证或授权 guard 的单 route 注册器。\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const { apiContract } = await import('@h-ai/api-contract')\n * const { z } = await import('zod')\n * const { ok } = await import('@h-ai/core')\n * const contract = { ping: apiContract.route({ method: 'GET', path: '/ping' }).output(apiContract.haiResultSchema(z.object({ ready: z.boolean() }))) }\n * const guarded: ServGuardedRouteRegistration<typeof contract, ServContext, ServContext, 'ping', 'ping'> = implement(contract).context<ServContext>().route('ping').permission('reports.read')\n * const procedures = guarded.handle(() => ok({ ready: true })).build()\n * ```\n */\nexport interface ServGuardedRouteRegistration<\n TContract extends ServContract,\n TInitialContext extends Context,\n TCurrentContext extends ServContext,\n TRemaining extends ServRoutePath<TContract>,\n TPath extends TRemaining,\n> {\n readonly auth: () => ServGuardedRouteRegistration<\n TContract,\n TInitialContext,\n TCurrentContext,\n TRemaining,\n TPath\n >\n readonly permission: (permission: string) => ServGuardedRouteRegistration<\n TContract,\n TInitialContext,\n TCurrentContext,\n TRemaining,\n TPath\n >\n readonly role: (role: string) => ServGuardedRouteRegistration<\n TContract,\n TInitialContext,\n TCurrentContext,\n TRemaining,\n TPath\n >\n readonly handle: (\n handler: ServGuardedRouteHandler<TContract, TPath, TCurrentContext>,\n ) => NextBuilder<TContract, TInitialContext, TCurrentContext, TRemaining, TPath>\n}\n\n/**\n * 内部 route 重载：直接 handler 或先声明 guard，再收窄剩余路径。\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const { apiContract } = await import('@h-ai/api-contract')\n * const { z } = await import('zod')\n * const { ok } = await import('@h-ai/core')\n * const contract = { ping: apiContract.route({ method: 'GET', path: '/ping' }).output(apiContract.haiResultSchema(z.object({ ready: z.boolean() }))) }\n * const route: ServRouteMethod<typeof contract, ServContext, ServContext, 'ping'> = implement(contract).context<ServContext>().route\n * const procedures = route('ping', () => ok({ ready: true })).build()\n * ```\n */\ninterface ServRouteMethod<\n TContract extends ServContract,\n TInitialContext extends Context,\n TCurrentContext extends ServContext,\n TRemaining extends ServRoutePath<TContract>,\n> {\n <TPath extends TRemaining>(\n path: TPath,\n handler: ServRouteHandler<TContract, TPath, TCurrentContext>,\n ): NextBuilder<TContract, TInitialContext, TCurrentContext, TRemaining, TPath>\n <TPath extends TRemaining>(\n path: TPath,\n ): ServRouteRegistration<\n TContract,\n TInitialContext,\n TCurrentContext,\n TRemaining,\n TPath\n >\n}\n\n/**\n * 剩余路径为 never 时才暴露 build，否则仅提供缺失路径类型提示。\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const { apiContract } = await import('@h-ai/api-contract')\n * const { z } = await import('zod')\n * const { ok } = await import('@h-ai/core')\n * const contract = { ping: apiContract.route({ method: 'GET', path: '/ping' }).output(apiContract.haiResultSchema(z.object({ ready: z.boolean() }))) }\n * const complete: ServRouterBuilderBuild<typeof contract, ServContext, never> = implement(contract).context<ServContext>().route('ping', () => ok({ ready: true }))\n * const procedures = complete.build()\n * ```\n */\ntype ServRouterBuilderBuild<\n TContract extends ServContract,\n TInitialContext extends Context,\n TRemaining,\n> = [TRemaining] extends [never]\n ? {\n /** 同步返回完整的普通 router，允许按需选用嵌套的默认 procedures。 */\n readonly build: () => UnlaziedRouter<Router<TContract, TInitialContext>>\n }\n : {\n /** 仅供 TypeScript/IDE 展示尚未实现的 route；运行时不存在。 */\n readonly missingRoutes: TRemaining\n }\n\n/**\n * 链式 router builder。\n *\n * `TRemaining` 会随着 `.route()` 注册逐步收窄；未实现完整 contract 时没有 `.build()`。\n *\n * @example\n * ```ts\n * import type { ServRouterBuilder } from '@h-ai/serv'\n * import type { ServContext } from '@h-ai/serv'\n * import { apiContract } from '@h-ai/api-contract'\n * import { ok } from '@h-ai/core'\n * import { serv } from '@h-ai/serv'\n * import { z } from 'zod'\n *\n * const contract = { ping: apiContract.route({ method: 'GET', path: '/ping' }).output(apiContract.haiResultSchema(z.object({ ready: z.boolean() }))) }\n * const builder: ServRouterBuilder<typeof contract, ServContext, ServContext> = serv.implement(contract).context<ServContext>()\n * const procedures = builder.route('ping', () => ok({ ready: true })).build()\n * ```\n */\nexport type ServRouterBuilder<\n TContract extends ServContract,\n TInitialContext extends Context,\n TCurrentContext extends ServContext,\n TRemaining extends ServRoutePath<TContract> = ServRoutePath<TContract>,\n> = {\n readonly route: ServRouteMethod<\n TContract,\n TInitialContext,\n TCurrentContext,\n TRemaining\n >\n} & ServRouterBuilderBuild<TContract, TInitialContext, TRemaining>\n\n/**\n * hai-framework 链式 contract 实现器。\n *\n * @example\n * ```ts\n * import type { ServImplementer } from '@h-ai/serv'\n * import type { ServContext } from '@h-ai/serv'\n * import { apiContract } from '@h-ai/api-contract'\n * import { ok } from '@h-ai/core'\n * import { serv } from '@h-ai/serv'\n * import { z } from 'zod'\n *\n * const contract = { ping: apiContract.route({ method: 'GET', path: '/ping' }).output(apiContract.haiResultSchema(z.object({ ready: z.boolean() }))) }\n * const implementer: ServImplementer<typeof contract> = serv.implement(contract)\n * const procedures = implementer.context<ServContext>().route('ping', () => ok({ ready: true })).build()\n * ```\n */\nexport interface ServImplementer<TContract extends ServContract> {\n readonly context: <TContext extends ServContext>() => ServRouterBuilder<\n TContract,\n TContext & EmptyContext,\n TContext\n >\n}\n\n/**\n * 创建链式 contract 实现器。\n *\n * @example\n * ```ts\n * import type { ServContext } from '@h-ai/serv'\n * import { apiContract } from '@h-ai/api-contract'\n * import { ok } from '@h-ai/core'\n * import { serv } from '@h-ai/serv'\n * import { z } from 'zod'\n *\n * const contract = { ping: apiContract.route({ method: 'GET', path: '/ping' }).output(apiContract.haiResultSchema(z.object({ ready: z.boolean() }))) }\n * const procedures = serv.implement(contract).context<ServContext>().route('ping', () => ok({ ready: true })).build()\n * ```\n */\nexport function implement<TContract extends ServContract>(\n contract: TContract,\n): ServImplementer<TContract> {\n return {\n context: <TContext extends ServContext>() => {\n const native = orpcImplement(contract).$context<TContext>()\n return createServRouterBuilder(contract, native)\n },\n }\n}\n\nfunction createServRouterBuilder<\n TContract extends ServContract,\n TInitialContext extends Context,\n TCurrentContext extends ServContext,\n>(\n contract: TContract,\n implementer: Implementer<TContract, TInitialContext, TCurrentContext>,\n): ServRouterBuilder<TContract, TInitialContext, TCurrentContext> {\n const runtime = new ServRouterBuilderRuntime(contract, implementer)\n\n // oRPC 的 contract 泛型只能在编译期表示；运行时 builder 由同一 contract\n // 创建并逐项校验路径，因此这里将动态实现收敛到唯一的类型边界。\n return runtime as unknown as ServRouterBuilder<\n TContract,\n TInitialContext,\n TCurrentContext\n >\n}\n\n/**\n * 内部运行时 handler 边界；最终输入/输出验证仍由对应 contract 决定。\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const { ok } = await import('@h-ai/core')\n * const handler: RuntimeProcedureHandler = ({ input }) => ok(input)\n * // 动态装配边界仍由相同 contract 校验路径与 options，不提升未知输入类型。\n * ```\n */\ntype RuntimeProcedureHandler = ProcedureHandler<\n ServContext,\n unknown,\n HaiResult<unknown>,\n ErrorMap,\n Meta\n>\n/**\n * 内部认证后的运行时 handler，原始 oRPC options 与可信 session 保留。\n *\n * @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const { ok } = await import('@h-ai/core')\n * const handler: AuthenticatedRuntimeProcedureHandler = ({ context }) => ok({ userId: context.session.userId })\n * const guarded = applyServGuards({ auth: true }, handler)\n * ```\n */\ntype AuthenticatedRuntimeProcedureHandler = ProcedureHandler<\n AuthenticatedServContext,\n unknown,\n HaiResult<unknown>,\n ErrorMap,\n Meta\n>\n\nclass ServRouterBuilderRuntime {\n private readonly expectedPaths: ReadonlySet<string>\n private readonly implementedRoutes: Record<string, unknown>\n private readonly registeredPaths = new Set<string>()\n\n constructor(\n contract: ServContract,\n private readonly implementer: object,\n ) {\n this.expectedPaths = new Set(collectProcedurePaths(contract))\n this.implementedRoutes = createRouterShape(contract)\n }\n\n route(path: string, handler?: unknown): unknown {\n if (handler !== undefined)\n return this.register(path, {}, handler)\n\n return new ServRouteRegistrationRuntime(this, path)\n }\n\n register(path: string, guards: ServGuardRequirements, handler: unknown): this {\n if (!this.expectedPaths.has(path))\n throw new TypeError(`Contract path is not implementable: ${path}`)\n if (this.registeredPaths.has(path))\n throw new TypeError(`Duplicate procedure implementation: ${path}`)\n if (typeof handler !== 'function')\n throw new TypeError(`Procedure handler must be a function: ${path}`)\n\n const procedureImplementer = getAtPath(this.implementer, path)\n const implementHandler = getHandlerMethod(procedureImplementer)\n if (!implementHandler)\n throw new TypeError(`Contract path is not implementable: ${path}`)\n\n // 点路径反射会丢失单条 contract 的泛型；路径已由 expectedPaths 校验，\n // handler 的精确 input/output 则由公开的 ServRouteHandler 在调用侧保证。\n const guardedHandler = hasGuards(guards)\n ? applyServGuards(guards, handler as AuthenticatedRuntimeProcedureHandler)\n : handler as RuntimeProcedureHandler\n const safeHandler = mapHaiError(guardedHandler)\n const implemented = Reflect.apply(\n implementHandler,\n procedureImplementer,\n [safeHandler],\n )\n\n setAtPath(this.implementedRoutes, path, implemented)\n this.registeredPaths.add(path)\n return this\n }\n\n build(): unknown {\n const missingPaths = [...this.expectedPaths]\n .filter(path => !this.registeredPaths.has(path))\n .sort()\n if (missingPaths.length > 0) {\n throw new TypeError(\n `Cannot build router. Missing procedures: ${missingPaths.join(', ')}`,\n )\n }\n\n const routerMethod = Reflect.get(this.implementer, 'router')\n if (typeof routerMethod !== 'function')\n throw new TypeError('The oRPC implementer does not expose router()')\n\n return Reflect.apply(routerMethod, this.implementer, [this.implementedRoutes])\n }\n}\n\nclass ServRouteRegistrationRuntime {\n private authRequired = false\n private readonly permissions = new Set<string>()\n private readonly roles = new Set<string>()\n\n constructor(\n private readonly parent: ServRouterBuilderRuntime,\n private readonly path: string,\n ) {}\n\n auth(): this {\n this.authRequired = true\n return this\n }\n\n permission(permission: string): this {\n this.authRequired = true\n this.permissions.add(permission)\n return this\n }\n\n role(role: string): this {\n this.authRequired = true\n this.roles.add(role)\n return this\n }\n\n handle(handler: unknown): ServRouterBuilderRuntime {\n return this.parent.register(this.path, {\n auth: this.authRequired,\n permissions: [...this.permissions],\n roles: [...this.roles],\n }, handler)\n }\n}\n\nfunction hasGuards(guards: ServGuardRequirements): boolean {\n return guards.auth === true\n || (guards.permissions?.length ?? 0) > 0\n || (guards.roles?.length ?? 0) > 0\n}\n\nfunction collectProcedurePaths(\n contract: ServContract,\n prefix: readonly string[] = [],\n): string[] {\n if (isContractProcedure(contract))\n return prefix.length > 0 ? [prefix.join('.')] : []\n\n return Object.entries(contract).flatMap(([key, child]) =>\n collectProcedurePaths(child, [...prefix, key]))\n}\n\nfunction isContractProcedure(contract: ServContract): boolean {\n return '~orpc' in contract\n}\n\nfunction createRouterShape(contract: ServContract): Record<string, unknown> {\n const shape: Record<string, unknown> = Object.create(null)\n\n for (const [key, child] of Object.entries(contract)) {\n if (!isContractProcedure(child))\n shape[key] = createRouterShape(child)\n }\n\n return shape\n}\n\nfunction getAtPath(root: object, path: string): unknown {\n let current: unknown = root\n\n for (const segment of path.split('.')) {\n if (\n (typeof current !== 'object' && typeof current !== 'function')\n || current === null\n || !(segment in current)\n ) {\n return undefined\n }\n\n current = Reflect.get(current, segment)\n }\n\n return current\n}\n\nfunction setAtPath(root: Record<string, unknown>, path: string, value: unknown): void {\n const segments = path.split('.')\n const leaf = segments.pop()\n if (!leaf)\n throw new TypeError('Procedure path cannot be empty')\n\n let current = root\n for (const segment of segments) {\n const existing = current[segment]\n if (existing === undefined) {\n const child: Record<string, unknown> = Object.create(null)\n current[segment] = child\n current = child\n continue\n }\n\n if (!existing || typeof existing !== 'object')\n throw new TypeError(`Procedure path conflicts with an existing route: ${path}`)\n\n current = existing as Record<string, unknown>\n }\n\n current[leaf] = value\n}\n\nfunction getHandlerMethod(value: unknown): ((handler: unknown) => unknown) | undefined {\n if ((typeof value !== 'object' && typeof value !== 'function') || value === null)\n return undefined\n\n const handler = Reflect.get(value, 'handler')\n return typeof handler === 'function'\n ? handler as (handler: unknown) => unknown\n : undefined\n}\n"]}

package/dist/{chunk-65XNI7TH.js → chunk-TWMOZPGU.js} RENAMED Viewed

@@ -1,4 +1,4 @@
-import { normalizeServLocale, servM } from './chunk-JAQIEQJS.js';
+import { normalizeServLocale, servM } from './chunk-I3F7RN4I.js';
 import { core, ok, err, HaiCommonError } from '@h-ai/core';
 var DEFAULT_LOCALE = "zh-CN";
@@ -33,5 +33,5 @@ function validateInputOrFail(schema, input, locale = DEFAULT_LOCALE) {
 }
 export { localizeZodError, resolveRequestLocale, validateInputOrFail };
-//# sourceMappingURL=chunk-65XNI7TH.js.map
-//# sourceMappingURL=chunk-65XNI7TH.js.map
+//# sourceMappingURL=chunk-TWMOZPGU.js.map
+//# sourceMappingURL=chunk-TWMOZPGU.js.map

package/dist/{chunk-65XNI7TH.js.map → chunk-TWMOZPGU.js.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/serv-validation.ts"],"names":[],"mappings":";;;AAiBA,IAAM,cAAA,GAAiB,OAAA;AAmDhB,SAAS,qBAAqB,OAAA,EAA+D;AAClG,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,KAAqC;AAChD,IAAA,IAAI,OAAA,YAAmB,OAAA;AACrB,MAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,IAAK,MAAA;AAC9B,IAAA,OAAO,QAAQ,IAAI,CAAA,IAAK,OAAA,CAAQ,IAAA,CAAK,aAAa,CAAA;AAAA,EACpD,CAAA;AAEA,EAAA,MAAM,QAAA,GAAW,IAAI,cAAc,CAAA;AACnC,EAAA,IAAI,QAAA;AACF,IAAA,OAAO,oBAAoB,QAAQ,CAAA;AAErC,EAAA,OAAO,oBAAoB,GAAA,CAAI,iBAAiB,KAAK,GAAA,CAAI,iBAAiB,KAAK,cAAc,CAAA;AAC/F;AAiBO,SAAS,gBAAA,CAAiB,UAAmB,MAAA,EAAuC;AACzF,EAAA,MAAM,cAAA,GAAiB,oBAAoB,MAAM,CAAA;AACjD,EAAA,OAAO,KAAK,aAAA,CAAc,uBAAA;AAAA,IACxB,QAAA;AAAA,IACA,KAAK,aAAA,CAAc,8BAAA;AAAA,MACjB,MAAA;AAAA,MACA,CAAC,YAAY,MAAA,KAAW,KAAA,CAAM,YAAY,EAAE,MAAA,EAAQ,cAAA,EAAgB,MAAA,EAAQ;AAAA;AAC9E,GACF;AACF;AA2CO,SAAS,mBAAA,CACd,MAAA,EACA,KAAA,EACA,MAAA,GAAiB,cAAA,EACG;AACpB,EAAA,MAAM,cAAA,GAAiB,oBAAoB,MAAM,CAAA;AACjD,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,SAAA,CAAU,KAAK,CAAA;AACrC,EAAA,IAAI,MAAA,CAAO,OAAA;AACT,IAAA,OAAO,EAAA,CAAG,OAAO,IAAI,CAAA;AACvB,EAAA,MAAM,MAAA,GAAS,gBAAA,CAAiB,MAAA,CAAO,KAAA,EAAO,cAAc,CAAA;AAC5D,EAAA,OAAO,GAAA,CAAI,cAAA,CAAe,gBAAA,EAAkB,KAAA,CAAM,uBAAA,EAAyB,EAAE,MAAA,EAAQ,cAAA,EAAgB,CAAA,EAAG,MAAM,CAAA;AAChH","file":"chunk-~~65XNI7TH~~.js","sourcesContent":["/*\n @h-ai/serv — 校验工具\n \n 为 API service 提供与 kit 对等的校验 i18n 能力：\n * - {@link resolveRequestLocale}：从请求头（`x-hai-locale` / `Accept-Language`）解析语言。\n * - {@link validateInputOrFail}：在 procedure 内显式校验数据，失败返回 `HaiResult` 错误。\n * - oRPC contract 输入校验失败的自动本地化由 `serv-app.ts` 中的 oRPC 响应拦截器处理。\n \n @module serv-validation\n /\n\nimport type { HaiResult, ValidationFormError } from '@h-ai/core'\nimport type { ZodType } from 'zod'\nimport type { ServMessageKey } from './serv-i18n.js'\nimport { core, err, HaiCommonError, ok } from '@h-ai/core'\nimport { normalizeServLocale, servM } from './serv-i18n.js'\n\nconst DEFAULT_LOCALE = 'zh-CN'\n\n/\n 校验失败响应体（含 i18n 错误列表）。\n \n 复用 `HaiResult` 失败分支结构。字段错误同时在两处出现：\n * - `error.cause`：与 `validateInputOrFail` 输出对齐，HaiResult 标准位置\n * - 顶层 `errors`：保留以兼容已有客户端\n \n @example\n * ```ts\n * import type { ServValidationFailureBody } from '@h-ai/serv'\n * import { serv } from '@h-ai/serv'\n \n function fields(body: ServValidationFailureBody) {\n * return body.error.cause ?? body.errors\n * }\n * // 业务调用先判断 success，字段错误仅包含安全的本地化文案。\n * ```\n /\nexport interface ServValidationFailureBody {\n readonly success: false\n readonly error: {\n readonly code: string \| number\n readonly message: string\n readonly traceId?: string\n readonly httpStatus: number\n readonly system: string\n readonly module: string\n readonly cause?: readonly ValidationFormError[]\n }\n readonly errors: readonly ValidationFormError[]\n}\n\n/\n 从请求头解析客户端期望 locale。\n \n 优先级：`x-hai-locale` > `Accept-Language` 第一个匹配项 > 默认值（`zh-CN`）。\n * 返回值会被规范化为 serv 当前支持的 locale（如 `en` → `en-US`）。\n \n @param headers - 请求头（`Headers` 或与之等价的对象）\n * @returns 解析得到的 locale\n \n @example\n * ```ts\n * import { serv } from '@h-ai/serv'\n \n const locale = serv.resolveRequestLocale(new Headers({ 'x-hai-locale': 'en-US' }))\n * const fallback = serv.resolveRequestLocale(new Headers())\n * ```\n /\nexport function resolveRequestLocale(headers: Headers \| Record<string, string \| undefined>): string {\n const get = (name: string): string \| undefined => {\n if (headers instanceof Headers)\n return headers.get(name) ?? undefined\n return headers[name] ?? headers[name.toLowerCase()]\n }\n\n const explicit = get('x-hai-locale')\n if (explicit)\n return normalizeServLocale(explicit)\n\n return normalizeServLocale(get('accept-language') ?? get('Accept-Language') ?? DEFAULT_LOCALE)\n}\n\n/\n 把 Zod 错误转为本地化的扁平错误列表。\n \n @param zodError - Zod `SafeParseError` 或 `ZodError`\n * @param locale - 期望 locale\n \n @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const { z } = await import('zod')\n * const parsed = z.object({ name: z.string().min(1) }).safeParse({ name: '' })\n * if (parsed.success) return []\n * return localizeZodError(parsed.error, 'en-US')\n * ```\n /\nexport function localizeZodError(zodError: unknown, locale: string): ValidationFormError[] {\n const resolvedLocale = normalizeServLocale(locale)\n return core.zodValidation.mapZodErrorToFormErrors(\n zodError,\n core.zodValidation.createPrefixedZodMessageGetter<ServMessageKey>(\n 'serv',\n (messageKey, params) => servM(messageKey, { locale: resolvedLocale, params }),\n ),\n )\n}\n\n/\n 在 procedure handler 内显式校验数据。\n \n 与 oRPC contract 自动校验不同，本函数用于业务层二次校验（例如对从数据库读到的对象再校验）。\n * 失败时返回 `HaiResult` 错误分支，错误的 `cause` 字段携带 `ValidationFormError[]`。\n \n 推荐使用方式：\n * ```ts\n * import { z } from 'zod'\n * import { serv } from '@h-ai/serv'\n \n const Schema = z.object({ name: z.string().min(1) })\n \n export const procedures = serv\n * .implement(contract)\n * .context<ServContext>()\n * .route('profile.update', ({ input, context }) => {\n * const result = serv.validateInputOrFail(Schema, input, context.locale)\n * if (!result.success) return result\n * return profileService.update(result.data)\n * })\n * .build()\n * ```\n \n @param schema - Zod schema\n * @param input - 待校验数据\n * @param locale - 期望 locale（通常来自请求上下文）\n \n @example\n * ```ts\n * import { serv } from '@h-ai/serv'\n * import { z } from 'zod'\n \n const result = serv.validateInputOrFail(z.object({ name: z.string().min(1) }), { name: '' }, 'en-US')\n * if (!result.success) {\n * const fields = result.error.cause\n * } else {\n * const name = result.data.name\n * }\n * ```\n */\nexport function validateInputOrFail<TOutput>(\n schema: ZodType<TOutput>,\n input: unknown,\n locale: string = DEFAULT_LOCALE,\n): HaiResult<TOutput> {\n const resolvedLocale = normalizeServLocale(locale)\n const result = schema.safeParse(input)\n if (result.success)\n return ok(result.data)\n const errors = localizeZodError(result.error, resolvedLocale)\n return err(HaiCommonError.VALIDATION_ERROR, servM('serv_validationFailed', { locale: resolvedLocale }), errors)\n}\n"]}
1	+ {"version":3,"sources":["../src/serv-validation.ts"],"names":[],"mappings":";;;AAiBA,IAAM,cAAA,GAAiB,OAAA;AAmDhB,SAAS,qBAAqB,OAAA,EAA+D;AAClG,EAAA,MAAM,GAAA,GAAM,CAAC,IAAA,KAAqC;AAChD,IAAA,IAAI,OAAA,YAAmB,OAAA;AACrB,MAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,IAAK,MAAA;AAC9B,IAAA,OAAO,QAAQ,IAAI,CAAA,IAAK,OAAA,CAAQ,IAAA,CAAK,aAAa,CAAA;AAAA,EACpD,CAAA;AAEA,EAAA,MAAM,QAAA,GAAW,IAAI,cAAc,CAAA;AACnC,EAAA,IAAI,QAAA;AACF,IAAA,OAAO,oBAAoB,QAAQ,CAAA;AAErC,EAAA,OAAO,oBAAoB,GAAA,CAAI,iBAAiB,KAAK,GAAA,CAAI,iBAAiB,KAAK,cAAc,CAAA;AAC/F;AAiBO,SAAS,gBAAA,CAAiB,UAAmB,MAAA,EAAuC;AACzF,EAAA,MAAM,cAAA,GAAiB,oBAAoB,MAAM,CAAA;AACjD,EAAA,OAAO,KAAK,aAAA,CAAc,uBAAA;AAAA,IACxB,QAAA;AAAA,IACA,KAAK,aAAA,CAAc,8BAAA;AAAA,MACjB,MAAA;AAAA,MACA,CAAC,YAAY,MAAA,KAAW,KAAA,CAAM,YAAY,EAAE,MAAA,EAAQ,cAAA,EAAgB,MAAA,EAAQ;AAAA;AAC9E,GACF;AACF;AA2CO,SAAS,mBAAA,CACd,MAAA,EACA,KAAA,EACA,MAAA,GAAiB,cAAA,EACG;AACpB,EAAA,MAAM,cAAA,GAAiB,oBAAoB,MAAM,CAAA;AACjD,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,SAAA,CAAU,KAAK,CAAA;AACrC,EAAA,IAAI,MAAA,CAAO,OAAA;AACT,IAAA,OAAO,EAAA,CAAG,OAAO,IAAI,CAAA;AACvB,EAAA,MAAM,MAAA,GAAS,gBAAA,CAAiB,MAAA,CAAO,KAAA,EAAO,cAAc,CAAA;AAC5D,EAAA,OAAO,GAAA,CAAI,cAAA,CAAe,gBAAA,EAAkB,KAAA,CAAM,uBAAA,EAAyB,EAAE,MAAA,EAAQ,cAAA,EAAgB,CAAA,EAAG,MAAM,CAAA;AAChH","file":"chunk-TWMOZPGU.js","sourcesContent":["/*\n @h-ai/serv — 校验工具\n \n 为 API service 提供与 kit 对等的校验 i18n 能力：\n * - {@link resolveRequestLocale}：从请求头（`x-hai-locale` / `Accept-Language`）解析语言。\n * - {@link validateInputOrFail}：在 procedure 内显式校验数据，失败返回 `HaiResult` 错误。\n * - oRPC contract 输入校验失败的自动本地化由 `serv-app.ts` 中的 oRPC 响应拦截器处理。\n \n @module serv-validation\n /\n\nimport type { HaiResult, ValidationFormError } from '@h-ai/core'\nimport type { ZodType } from 'zod'\nimport type { ServMessageKey } from './serv-i18n.js'\nimport { core, err, HaiCommonError, ok } from '@h-ai/core'\nimport { normalizeServLocale, servM } from './serv-i18n.js'\n\nconst DEFAULT_LOCALE = 'zh-CN'\n\n/\n 校验失败响应体（含 i18n 错误列表）。\n \n 复用 `HaiResult` 失败分支结构。字段错误同时在两处出现：\n * - `error.cause`：与 `validateInputOrFail` 输出对齐，HaiResult 标准位置\n * - 顶层 `errors`：保留以兼容已有客户端\n \n @example\n * ```ts\n * import type { ServValidationFailureBody } from '@h-ai/serv'\n * import { serv } from '@h-ai/serv'\n \n function fields(body: ServValidationFailureBody) {\n * return body.error.cause ?? body.errors\n * }\n * // 业务调用先判断 success，字段错误仅包含安全的本地化文案。\n * ```\n /\nexport interface ServValidationFailureBody {\n readonly success: false\n readonly error: {\n readonly code: string \| number\n readonly message: string\n readonly traceId?: string\n readonly httpStatus: number\n readonly system: string\n readonly module: string\n readonly cause?: readonly ValidationFormError[]\n }\n readonly errors: readonly ValidationFormError[]\n}\n\n/\n 从请求头解析客户端期望 locale。\n \n 优先级：`x-hai-locale` > `Accept-Language` 第一个匹配项 > 默认值（`zh-CN`）。\n * 返回值会被规范化为 serv 当前支持的 locale（如 `en` → `en-US`）。\n \n @param headers - 请求头（`Headers` 或与之等价的对象）\n * @returns 解析得到的 locale\n \n @example\n * ```ts\n * import { serv } from '@h-ai/serv'\n \n const locale = serv.resolveRequestLocale(new Headers({ 'x-hai-locale': 'en-US' }))\n * const fallback = serv.resolveRequestLocale(new Headers())\n * ```\n /\nexport function resolveRequestLocale(headers: Headers \| Record<string, string \| undefined>): string {\n const get = (name: string): string \| undefined => {\n if (headers instanceof Headers)\n return headers.get(name) ?? undefined\n return headers[name] ?? headers[name.toLowerCase()]\n }\n\n const explicit = get('x-hai-locale')\n if (explicit)\n return normalizeServLocale(explicit)\n\n return normalizeServLocale(get('accept-language') ?? get('Accept-Language') ?? DEFAULT_LOCALE)\n}\n\n/\n 把 Zod 错误转为本地化的扁平错误列表。\n \n @param zodError - Zod `SafeParseError` 或 `ZodError`\n * @param locale - 期望 locale\n \n @example\n * ```ts\n * // 模块内部上下文：示例复用当前声明所在模块的实际绑定。\n * const { z } = await import('zod')\n * const parsed = z.object({ name: z.string().min(1) }).safeParse({ name: '' })\n * if (parsed.success) return []\n * return localizeZodError(parsed.error, 'en-US')\n * ```\n /\nexport function localizeZodError(zodError: unknown, locale: string): ValidationFormError[] {\n const resolvedLocale = normalizeServLocale(locale)\n return core.zodValidation.mapZodErrorToFormErrors(\n zodError,\n core.zodValidation.createPrefixedZodMessageGetter<ServMessageKey>(\n 'serv',\n (messageKey, params) => servM(messageKey, { locale: resolvedLocale, params }),\n ),\n )\n}\n\n/\n 在 procedure handler 内显式校验数据。\n \n 与 oRPC contract 自动校验不同，本函数用于业务层二次校验（例如对从数据库读到的对象再校验）。\n * 失败时返回 `HaiResult` 错误分支，错误的 `cause` 字段携带 `ValidationFormError[]`。\n \n 推荐使用方式：\n * ```ts\n * import { z } from 'zod'\n * import { serv } from '@h-ai/serv'\n \n const Schema = z.object({ name: z.string().min(1) })\n \n export const procedures = serv\n * .implement(contract)\n * .context<ServContext>()\n * .route('profile.update', ({ input, context }) => {\n * const result = serv.validateInputOrFail(Schema, input, context.locale)\n * if (!result.success) return result\n * return profileService.update(result.data)\n * })\n * .build()\n * ```\n \n @param schema - Zod schema\n * @param input - 待校验数据\n * @param locale - 期望 locale（通常来自请求上下文）\n \n @example\n * ```ts\n * import { serv } from '@h-ai/serv'\n * import { z } from 'zod'\n \n const result = serv.validateInputOrFail(z.object({ name: z.string().min(1) }), { name: '' }, 'en-US')\n * if (!result.success) {\n * const fields = result.error.cause\n * } else {\n * const name = result.data.name\n * }\n * ```\n */\nexport function validateInputOrFail<TOutput>(\n schema: ZodType<TOutput>,\n input: unknown,\n locale: string = DEFAULT_LOCALE,\n): HaiResult<TOutput> {\n const resolvedLocale = normalizeServLocale(locale)\n const result = schema.safeParse(input)\n if (result.success)\n return ok(result.data)\n const errors = localizeZodError(result.error, resolvedLocale)\n return err(HaiCommonError.VALIDATION_ERROR, servM('serv_validationFailed', { locale: resolvedLocale }), errors)\n}\n"]}

package/dist/features/ai.js CHANGED Viewed

@@ -1,5 +1,5 @@
 import { wrapItemsResult } from '../chunk-XKCLD42I.js';
-import { implement, servM } from '../chunk-JAQIEQJS.js';
+import { implement, servM } from '../chunk-I3F7RN4I.js';
 import { apiContract } from '@h-ai/api-contract';
 import { ok, err, HaiCommonError } from '@h-ai/core';

package/dist/features/feedback.js CHANGED Viewed

@@ -1,4 +1,4 @@
-import { implement, servM } from '../chunk-JAQIEQJS.js';
+import { implement, servM } from '../chunk-I3F7RN4I.js';
 import { apiContract } from '@h-ai/api-contract';
 import { err, HaiCommonError, ok, core } from '@h-ai/core';