@lark-apaas/auth-sdk 0.1.3 → 0.1.5-alpha.0

package/lib/AuthProvider.d.ts

@@ -1,6 +1,6 @@
 import React from 'react';
 import { MongoAbility } from '@casl/ability';
-import type { AuthSdkConfig } from './types';
+import type { AuthSdkConfig, PermissionPointData } from './types';
 /**
  * Ability Context - 用于在组件树中共享 Ability 实例
  */
@@ -11,7 +11,7 @@ export declare const AbilityContext: React.Context<MongoAbility<import("@casl/ab
  */
 interface AuthStateContextValue {
     ability: MongoAbility;
-    permissions: string[];
+    permissions: PermissionPointData[];
     isLoading: boolean;
     error: Error | null;
     fetchPermissions: (userId?: string) => Promise<void>;
@@ -46,13 +46,6 @@ export interface AuthProviderProps {
  * ```
  */
 export declare function AuthProvider({ children, config }: AuthProviderProps): import("react/jsx-runtime").JSX.Element;
-/**
- * 获取 Ability 实例
- *
- * @param permissionApiConfig - 权限 API 配置
- * @returns Ability 实例或错误
- */
-export declare function getAbility(permissionApiConfig: AuthSdkConfig['permissionApi']): Promise<Error | MongoAbility<import("@casl/ability").AbilityTuple, import("@casl/ability").MongoQuery>>;
 /**
  * useAuth Hook - 获取权限数据和加载状态
  *
@@ -74,32 +67,6 @@ export declare function getAbility(permissionApiConfig: AuthSdkConfig['permissio
  * ```
  */
 export declare function useAuth(): AuthStateContextValue;
-/**
- * CASL 原始 Can 组件（内部使用）
- */
-declare const CaslCan: React.FunctionComponent<import("@casl/react").BoundCanProps<MongoAbility<import("@casl/ability").AbilityTuple, import("@casl/ability").MongoQuery>>>;
-/**
- * Can Component - 基于 Ability 实例的条件渲染组件
- *
- * 内置 isLoading 保护：权限加载期间渲染 fallback（默认为 null），
- * 避免因 ability 未就绪而误判为无权限导致内容闪烁。
- *
- * @example
- * ```tsx
- * import { Can } from '@lark-apaas/auth-sdk';
- *
- * function MyComponent() {
- *   return (
- *     <Can I="Admin" a="@role" fallback={<Loading />}>
- *       <TaskList />
- *     </Can>
- *   );
- * }
- * ```
- */
-export declare function Can({ fallback, ...props }: React.ComponentProps<typeof CaslCan> & {
-    fallback?: React.ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
 /**
  * CanRole Component - 基于角色的条件渲染组件
  *
@@ -127,35 +94,46 @@ export declare function CanRole({ children, roles, fallback, }: {
 /**
  * useUserPermissions Hook - 获取当前用户的权限点位列表
  */
-export declare function useUserPermissions(): string[];
+export declare function useUserPermissions(): PermissionPointData[];
 /**
- * useCanPermission Hook - 判断用户是否拥有指定权限点位
+ * useCan Hook - 通过 CASL Ability 判断用户是否拥有指定权限
  *
- * @param permissions - 需要检查的权限点位列表
- * @param match - 匹配模式：'any' 任一匹配即可，'all' 需要全部匹配
+ * @param action - 操作类型，如 'read', 'create'
+ * @param subject - 资源类型，如 'Task', 'Article'；角色检查时传 '@role'
+ *
+ * @example
+ * ```ts
+ * const { allowed: canRead, isLoading } = useCan('read', 'Task');
+ * if (isLoading) return <Loading />;
+ * if (!canRead) return <NoAccess />;
+ * ```
  */
-export declare function useCanPermission(permissions: string[], match?: 'any' | 'all'): boolean;
+export declare function useCan(action: string, subject: string): {
+    allowed: boolean;
+    isLoading: boolean;
+};
 /**
- * CanPermission Component - 基于权限点位的条件渲染组件
+ * Can Component - 基于 CASL Ability 的条件渲染组件
+ * 前后端统一：后端 @Can('read', 'Task')，前端 <Can action="read" subject="Task">
  *
  * @example
  * ```tsx
- * import { CanPermission } from '@lark-apaas/auth-sdk';
+ * import { Can } from '@lark-apaas/auth-sdk';
  *
- * function MyComponent() {
- *   return (
- *     <CanPermission permissions={['task:create', 'task:edit']} match="any">
- *       <TaskEditor />
- *     </CanPermission>
- *   );
- * }
+ * <Can action="read" subject="Task">
+ *   <TaskList />
+ * </Can>
+ *
+ * <Can action="delete" subject="Task" fallback={<Skeleton />}>
+ *   <DeleteButton />
+ * </Can>
  * ```
  */
-export declare function CanPermission({ children, permissions, match, fallback, }: {
+export declare function Can({ children, action, subject, fallback, }: {
     children: React.ReactNode;
-    permissions: string[];
-    match?: 'any' | 'all';
+    action: string;
+    subject: string;
     fallback?: React.ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
+}): import("react/jsx-runtime").JSX.Element | null;
 export {};
 //# sourceMappingURL=AuthProvider.d.ts.map

package/lib/AuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../src/AuthProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,KAMN,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAK7C;;GAEG;AACH,eAAO,MAAM,cAAc,uGAE1B,CAAC;AAOF;;;GAGG;AACH,UAAU,qBAAqB;IAC7B,OAAO,EAAE,YAAY,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,gBAAgB,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAOD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,YAAY,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,iBAAiB,2CA+EnE;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,mBAAmB,EAAE,aAAa,CAAC,eAAe,CAAC,2GAmBpD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,OAAO,IAAI,qBAAqB,CAQ/C;AAED;;GAEG;AACH,QAAA,MAAM,OAAO,sJAA+C,CAAC;AAE7D;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,GAAG,CAAC,EAClB,QAAe,EACf,GAAG,KAAK,EACT,EAAE,KAAK,CAAC,cAAc,CAAC,OAAO,OAAO,CAAC,GAAG;IAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAA;CAAE,2CAKvE;AAoBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,OAAO,CAAC,EACtB,QAAQ,EACR,KAAK,EACL,QAAe,GAChB,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC5B,kDAKA;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAE7C;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EAAE,EACrB,KAAK,GAAE,KAAK,GAAG,KAAa,GAC3B,OAAO,CAOT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,EAC5B,QAAQ,EACR,WAAW,EACX,KAAa,EACb,QAAe,GAChB,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IACtB,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC5B,2CAGA"}
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../src/AuthProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,KAMN,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAIlE;;GAEG;AACH,eAAO,MAAM,cAAc,uGAE1B,CAAC;AAOF;;;GAGG;AACH,UAAU,qBAAqB;IAC7B,OAAO,EAAE,YAAY,CAAC;IACtB,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,gBAAgB,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAOD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,YAAY,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,iBAAiB,2CAuFnE;AAGD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,OAAO,IAAI,qBAAqB,CAQ/C;AAqBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,OAAO,CAAC,EACtB,QAAQ,EACR,KAAK,EACL,QAAe,GAChB,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC5B,kDAKA;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,mBAAmB,EAAE,CAE1D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,MAAM,CACpB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAM1C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,GAAG,CAAC,EAClB,QAAQ,EACR,MAAM,EACN,OAAO,EACP,QAAe,GAChB,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC5B,kDAIA"}

package/lib/AuthProvider.js

@@ -2,10 +2,9 @@ import { Fragment, jsx } from "react/jsx-runtime";
 import { createContext, useCallback, useContext, useEffect, useState } from "react";
 import { ROLE_SUBJECT, createAbility } from "./ability-factory.js";
 import { PermissionClient } from "./permission-client.js";
-import { createContextualCan } from "@casl/react";
 const AbilityContext = /*#__PURE__*/ createContext(createAbility({
-    permissions: [],
-    roles: []
+    roles: [],
+    permissionPoints: []
 }));
 const PermissionsContext = /*#__PURE__*/ createContext([]);
 const AuthStateContext = /*#__PURE__*/ createContext(null);
@@ -16,20 +15,24 @@ function AuthProvider({ children, config }) {
     const [isLoading, setIsLoading] = useState(()=>config?.enable !== false && null !== client);
     const [error, setError] = useState(null);
     const fetchPermissions = useCallback(async ()=>{
-        if (!client) return;
         setIsLoading(true);
         setError(null);
         try {
-            const data = await client.fetchPermissions();
-            const newAbility = createAbility({
-                roles: data.roles
-            });
+            const [rolesResult, permissionPointsResult] = await Promise.allSettled([
+                client ? client.fetchPermissions() : Promise.resolve(null),
+                PermissionClient.fetchPermissionPoints()
+            ]);
+            const data = 'fulfilled' === rolesResult.status ? rolesResult.value : null;
+            const permissionPoints = 'fulfilled' === permissionPointsResult.status ? permissionPointsResult.value : void 0;
+            if (!data && !permissionPoints) throw 'rejected' === rolesResult.status ? rolesResult.reason : new Error('No permission data');
+            if (permissionPoints) setPermissions(permissionPoints);
+            const rawConfig = {
+                roles: data?.roles || [],
+                permissionPoints
+            };
+            const newAbility = createAbility(rawConfig);
             setAbility(newAbility);
-            if (config?.permissionPointsApi) try {
-                const userPermissions = await client.fetchUserPermissions(config.permissionPointsApi);
-                setPermissions(userPermissions);
-            } catch  {}
-            config?.onSuccess?.(data);
+            config?.onSuccess?.(rawConfig);
         } catch (err) {
             const error = err instanceof Error ? err : new Error(String(err));
             setError(error);
@@ -65,35 +68,11 @@ function AuthProvider({ children, config }) {
         })
     });
 }
-async function getAbility(permissionApiConfig) {
-    if (!permissionApiConfig) return new Error('permissionApi config is required');
-    const client = new PermissionClient(permissionApiConfig);
-    try {
-        const data = await client.fetchPermissions();
-        const ability = createAbility({
-            roles: data.roles
-        });
-        return ability;
-    } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err));
-        return error;
-    }
-}
 function useAuth() {
     const context = useContext(AuthStateContext);
     if (!context) throw new Error('useAuth must be used within an AuthProvider');
     return context;
 }
-const CaslCan = createContextualCan(AbilityContext.Consumer);
-function Can({ fallback = null, ...props }) {
-    const authState = useContext(AuthStateContext);
-    if (authState?.isLoading) return /*#__PURE__*/ jsx(Fragment, {
-        children: fallback
-    });
-    return /*#__PURE__*/ jsx(CaslCan, {
-        ...props
-    });
-}
 function useCanRole({ roles }) {
     const ability = useContext(AbilityContext);
     const authState = useContext(AuthStateContext);
@@ -117,18 +96,23 @@ function CanRole({ children, roles, fallback = null }) {
 function useUserPermissions() {
     return useContext(PermissionsContext);
 }
-function useCanPermission(permissions, match = 'any') {
-    const userPermissions = useContext(PermissionsContext);
-    if (!permissions || 0 === permissions.length) return true;
-    const permSet = new Set(userPermissions);
-    return 'all' === match ? permissions.every((p)=>permSet.has(p)) : permissions.some((p)=>permSet.has(p));
+function useCan(action, subject) {
+    const ability = useContext(AbilityContext);
+    const authState = useContext(AuthStateContext);
+    const isLoading = authState?.isLoading ?? false;
+    const allowed = !isLoading && ability.can(action, subject);
+    return {
+        allowed,
+        isLoading
+    };
 }
-function CanPermission({ children, permissions, match = 'any', fallback = null }) {
-    const allowed = useCanPermission(permissions, match);
-    return allowed ? /*#__PURE__*/ jsx(Fragment, {
-        children: children
-    }) : /*#__PURE__*/ jsx(Fragment, {
+function Can({ children, action, subject, fallback = null }) {
+    const { allowed, isLoading } = useCan(action, subject);
+    if (isLoading) return /*#__PURE__*/ jsx(Fragment, {
         children: fallback
     });
+    return allowed ? /*#__PURE__*/ jsx(Fragment, {
+        children: children
+    }) : null;
 }
-export { AbilityContext, AuthProvider, Can, CanPermission, CanRole, getAbility, useAuth, useCanPermission, useUserPermissions };
+export { AbilityContext, AuthProvider, Can, CanRole, useAuth, useCan, useUserPermissions };

package/lib/ability-factory.d.ts

@@ -1,22 +1,22 @@
 import { MongoAbility as Ability } from '@casl/ability';
-import type { Permission, CaslRule } from './types';
+import type { CaslRule, PermissionPointData } from './types';
 export declare const ROLE_SUBJECT = "@role";
 /**
- * 将权限数据转换为 CASL 规则
+ * 将角色和权限点位转换为 CASL 规则
  */
-export declare function convertPermissionsToRules(permissions: Permission[], roles: string[]): CaslRule[];
+export declare function convertPermissionsToRules(roles: string[], permissionPoints?: PermissionPointData[]): CaslRule[];
 /**
  * 创建 MongoAbility 实例
  */
-export declare function createAbility({ permissions, roles, }: {
-    permissions?: Permission[];
+export declare function createAbility({ roles, permissionPoints, }: {
     roles?: string[];
+    permissionPoints?: PermissionPointData[];
 }): Ability;
 /**
  * 更新已存在的 Ability 实例
  */
-export declare function updateAbility(ability: Ability, { permissions, roles }: {
-    permissions?: Permission[];
+export declare function updateAbility(ability: Ability, { roles, permissionPoints }: {
     roles?: string[];
+    permissionPoints?: PermissionPointData[];
 }): void;
 //# sourceMappingURL=ability-factory.d.ts.map

package/lib/ability-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ability-factory.d.ts","sourceRoot":"","sources":["../src/ability-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,IAAI,OAAO,EAGxB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEpD,eAAO,MAAM,YAAY,UAAU,CAAC;AACpC;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,UAAU,EAAE,EACzB,KAAK,EAAE,MAAM,EAAE,GACd,QAAQ,EAAE,CAmBZ;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,EAC5B,WAAW,EACX,KAAK,GACN,EAAE;IACD,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB,GAAG,OAAO,CAkBV;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,OAAO,EAChB,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;IAAE,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACvE,IAAI,CAGN"}
+{"version":3,"file":"ability-factory.d.ts","sourceRoot":"","sources":["../src/ability-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,IAAI,OAAO,EAGxB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAE7D,eAAO,MAAM,YAAY,UAAU,CAAC;AACpC;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,EAAE,EACf,gBAAgB,CAAC,EAAE,mBAAmB,EAAE,GACvC,QAAQ,EAAE,CAkBZ;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,EAC5B,KAAK,EACL,gBAAgB,GACjB,EAAE;IACD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,gBAAgB,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAC1C,GAAG,OAAO,CAiBV;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,OAAO,EAChB,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,CAAC,EAAE,mBAAmB,EAAE,CAAA;CAAE,GAC1F,IAAI,CAGN"}

package/lib/ability-factory.js

@@ -1,26 +1,26 @@
 import { AbilityBuilder, createMongoAbility } from "@casl/ability";
 const ROLE_SUBJECT = '@role';
-function convertPermissionsToRules(permissions, roles) {
+function convertPermissionsToRules(roles, permissionPoints) {
     const rules = [];
-    for (const permission of permissions)for (const action of permission.actions)rules.push({
-        action,
-        subject: permission.sub
-    });
     for (const role of roles)rules.push({
         action: role,
         subject: ROLE_SUBJECT
     });
+    if (permissionPoints) for (const { action, subject } of permissionPoints)rules.push({
+        action,
+        subject
+    });
     return rules;
 }
-function createAbility({ permissions, roles }) {
+function createAbility({ roles, permissionPoints }) {
     const { build, can } = new AbilityBuilder(createMongoAbility);
-    const rules = convertPermissionsToRules(permissions || [], roles || []);
+    const rules = convertPermissionsToRules(roles || [], permissionPoints);
     for (const rule of rules)if (Array.isArray(rule.action)) for (const action of rule.action)can(action, rule.subject, rule.fields);
     else can(rule.action, rule.subject, rule.fields);
     return build();
 }
-function updateAbility(ability, { permissions, roles }) {
-    const rules = convertPermissionsToRules(permissions || [], roles || []);
+function updateAbility(ability, { roles, permissionPoints }) {
+    const rules = convertPermissionsToRules(roles || [], permissionPoints);
     ability.update(rules);
 }
 export { ROLE_SUBJECT, convertPermissionsToRules, createAbility, updateAbility };

package/lib/account/AccountClient.d.ts

@@ -0,0 +1,22 @@
+import SessionService from './services/session-service';
+import UserService from './services/user-service';
+/**
+ * 妙搭账户/会话能力 SDK，零参构造。
+ *
+ * 业务调用方应通过 `authClient` singleton 使用（见 src/index.ts）：
+ *   import { authClient } from '@lark-apaas/auth-sdk';
+ *   await authClient.user.search({ name: '张三' });
+ *
+ * 直接 `new AccountClient()` 仅用于测试或特殊场景（多实例隔离）。
+ *
+ * 构造行为：
+ * - `appId` 从 `globalThis.appId` 读取（与现有 toolkit 的 `getAppId()` 一致）
+ * - HTTP 走相对路径 + `credentials: 'include'`，使用浏览器本域 session cookie
+ * - 不接受任何外部配置（baseUrl/token/brandName/fetch/log/errorHook 全部内化或默认化）
+ */
+export declare class AccountClient {
+    readonly user: UserService;
+    readonly session: SessionService;
+    constructor();
+}
+//# sourceMappingURL=AccountClient.d.ts.map

package/lib/account/AccountClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountClient.d.ts","sourceRoot":"","sources":["../../src/account/AccountClient.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,4BAA4B,CAAC;AACxD,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAElD;;;;;;;;;;;;;GAaG;AACH,qBAAa,aAAa;IACxB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;;CAOlC"}

package/lib/account/AccountClient.js

@@ -0,0 +1,10 @@
+import session_service from "./services/session-service/index.js";
+import user_service from "./services/user-service/index.js";
+class AccountClient {
+    constructor(){
+        const appId = globalThis.appId ?? '';
+        this.user = new user_service(appId);
+        this.session = new session_service(appId);
+    }
+}
+export { AccountClient };

package/lib/account/BaseAccountService.d.ts

@@ -0,0 +1,25 @@
+import { type AccountServiceResponse, type ExtraInfo, type Fetch, type FetchOptions, ServiceName } from './internal/types';
+/**
+ * Base for AC services. Owns the fetch pipeline:
+ * - Injects X-Suda-Csrf-Token from cookie
+ * - Sends body as JSON with credentials: 'include' (session cookie auth)
+ * - Normalizes responses into AccountServiceResponse<T>
+ * - Logs requests/responses in development
+ *
+ * 不暴露 baseUrl/token/brandName/fetch 参数（C5 二轮评审决议）。
+ */
+export default abstract class BaseAccountService {
+    protected baseUrl: string;
+    protected headers: {
+        [key: string]: string;
+    };
+    protected fetch: Fetch;
+    protected logger: boolean;
+    protected serviceName: ServiceName;
+    protected brandId: string;
+    protected bizSource: string;
+    protected appId: string;
+    constructor(appId: string);
+    fetchData<T>(url: string, options: FetchOptions, extras?: ExtraInfo): Promise<AccountServiceResponse<T>>;
+}
+//# sourceMappingURL=BaseAccountService.d.ts.map

package/lib/account/BaseAccountService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseAccountService.d.ts","sourceRoot":"","sources":["../../src/account/BaseAccountService.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,SAAS,EACd,KAAK,KAAK,EACV,KAAK,YAAY,EACjB,WAAW,EACZ,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;GAQG;AACH,MAAM,CAAC,OAAO,CAAC,QAAQ,OAAO,kBAAkB;IAC9C,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,OAAO,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IAC7C,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC;IACvB,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC;IAC1B,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC;IACnC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC;gBAEZ,KAAK,EAAE,MAAM;IAenB,SAAS,CAAC,CAAC,EACf,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,YAAY,EACrB,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;CA8GtC"}

package/lib/account/BaseAccountService.js

@@ -0,0 +1,106 @@
+import { BIZ_SOURCE, BRAND_ID } from "./internal/brand.js";
+import { getCookieByName } from "./internal/helpers.js";
+import { logRequest, logResponse } from "./internal/logger.js";
+import { traceIdGenerator } from "./internal/trace-id.js";
+import { ServiceName } from "./internal/types.js";
+class BaseAccountService {
+    constructor(appId){
+        this.baseUrl = 'undefined' != typeof window ? window.location.origin : '';
+        this.headers = {
+            'X-Suda-Csrf-Token': getCookieByName('suda-csrf-token'),
+            'Content-Type': 'application/json'
+        };
+        this.logger = 'production' !== process.env.NODE_ENV;
+        this.serviceName = ServiceName.DEFAULT;
+        this.brandId = BRAND_ID;
+        this.bizSource = BIZ_SOURCE;
+        this.appId = appId;
+        this.fetch = globalThis.fetch.bind(globalThis);
+    }
+    async fetchData(url, options, extras) {
+        const fetchUrl = `${this.baseUrl}${url}`;
+        let traceId = -1;
+        if (this.logger) {
+            traceId = traceIdGenerator.next();
+            logRequest({
+                traceId,
+                url: fetchUrl,
+                method: options.method,
+                body: options.body
+            }, extras?.psmName);
+        }
+        try {
+            const res = await this.fetch(fetchUrl, {
+                method: options.method,
+                mode: 'cors',
+                redirect: 'manual',
+                credentials: 'include',
+                headers: this.headers,
+                body: JSON.stringify(options.body)
+            });
+            let error = null;
+            let data = null;
+            let status = res.status;
+            let statusText = res.statusText;
+            if (res.ok) {
+                const body = await res.text();
+                const parsedBody = JSON.parse(body);
+                if (parsedBody.status_code && parsedBody.error_msg) {
+                    data = null;
+                    error = {
+                        code: parsedBody.status_code || res.status,
+                        details: '',
+                        hint: '',
+                        message: parsedBody.error_msg || body
+                    };
+                } else {
+                    data = parsedBody.data;
+                    error = null;
+                }
+            } else {
+                const body = await res.text();
+                let parsedBody = {};
+                try {
+                    parsedBody = JSON.parse(body);
+                } catch  {}
+                error = 429 === res.status ? {
+                    code: 429,
+                    message: 'Too many requests received within 5 seconds.',
+                    details: '',
+                    hint: 'Retry after 5 seconds.'
+                } : {
+                    code: parsedBody.status_code || res.status,
+                    message: parsedBody.error_msg || body,
+                    details: '',
+                    hint: ''
+                };
+            }
+            const serviceResponse = {
+                data,
+                error,
+                status,
+                statusText
+            };
+            if (this.logger) logResponse(traceId, serviceResponse, extras?.psmName);
+            return serviceResponse;
+        } catch (e) {
+            const internalError = {
+                error: {
+                    code: 500,
+                    message: e instanceof Error ? e.message : String(e),
+                    details: '',
+                    hint: ''
+                },
+                status: 500,
+                statusText: 'Account Internal Error'
+            };
+            const serviceResponse = {
+                data: null,
+                ...internalError
+            };
+            if (this.logger) logResponse(traceId, serviceResponse, extras?.psmName);
+            return serviceResponse;
+        }
+    }
+}
+export { BaseAccountService as default };

package/lib/account/index.d.ts

@@ -0,0 +1,5 @@
+export { AccountClient } from './AccountClient';
+export type { AccountServiceResponse, AccountServiceError, AccountStatus, UserStatus, } from './internal/types';
+export type { SearchParams, User, UserResponse, I18n as UserI18n, } from './services/user-service/types';
+export type { SignInRedirectionOptions, UserBaseInfo, UserInfoResponse, Avatar, I18n as SessionI18n, I18ns as SessionI18ns, } from './services/session-service/types';
+//# sourceMappingURL=index.d.ts.map

package/lib/account/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/account/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,YAAY,EACV,sBAAsB,EACtB,mBAAmB,EACnB,aAAa,EACb,UAAU,GACX,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,YAAY,EACZ,IAAI,EACJ,YAAY,EACZ,IAAI,IAAI,QAAQ,GACjB,MAAM,+BAA+B,CAAC;AAGvC,YAAY,EACV,wBAAwB,EACxB,YAAY,EACZ,gBAAgB,EAChB,MAAM,EACN,IAAI,IAAI,WAAW,EACnB,KAAK,IAAI,YAAY,GACtB,MAAM,kCAAkC,CAAC"}

package/lib/account/index.js

@@ -0,0 +1,2 @@
+import { AccountClient } from "./AccountClient.js";
+export { AccountClient };

package/lib/account/internal/brand.d.ts

@@ -0,0 +1,8 @@
+/**
+ * 妙搭 (Miaoda) brand constants — hard-coded after C5 review.
+ * 历史上 `brandName` 是参数，serializeSessionBrandId('miaoda') === '1'。
+ * 现 auth-sdk 仅服务妙搭场景，相关常量直接内化。
+ */
+export declare const BIZ_SOURCE = "miaoda";
+export declare const BRAND_ID = "1";
+//# sourceMappingURL=brand.d.ts.map

package/lib/account/internal/brand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brand.d.ts","sourceRoot":"","sources":["../../../src/account/internal/brand.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,UAAU,WAAW,CAAC;AACnC,eAAO,MAAM,QAAQ,MAAM,CAAC"}

package/lib/account/internal/brand.js

@@ -0,0 +1,3 @@
+const BIZ_SOURCE = 'miaoda';
+const BRAND_ID = '1';
+export { BIZ_SOURCE, BRAND_ID };

package/lib/account/internal/helpers.d.ts

@@ -0,0 +1,7 @@
+import { AccountStatus, UserStatus } from './types';
+import type { I18n } from '../services/user-service/types';
+export declare const isBrowser: () => boolean;
+export declare const getCookieByName: (name: string) => string;
+export declare const retrieveNameFromI18n: (i18ns?: I18n) => string;
+export declare const convertUserStatus: (status?: AccountStatus) => UserStatus;
+//# sourceMappingURL=helpers.d.ts.map

package/lib/account/internal/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/account/internal/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gCAAgC,CAAC;AAE3D,eAAO,MAAM,SAAS,eAC4C,CAAC;AAEnE,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,KAAG,MAW9C,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAI,QAAQ,IAAI,WAEhD,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,SAAS,aAAa,KAAG,UAY1D,CAAC"}

package/lib/account/internal/helpers.js

@@ -0,0 +1,14 @@
+import { AccountStatus, UserStatus } from "./types.js";
+const isBrowser = ()=>'undefined' != typeof window && 'undefined' != typeof document;
+const getCookieByName = (name)=>{
+    if (!isBrowser()) return '';
+    const cookies = document.cookie.split(';');
+    return cookies.find((cookie)=>cookie.trim().startsWith(`${name}=`))?.split('=')[1] ?? '';
+};
+const retrieveNameFromI18n = (i18ns)=>i18ns?.zh_cn || i18ns?.en_us || i18ns?.ja_jp || '';
+const convertUserStatus = (status)=>{
+    if (status === AccountStatus.Active || status === AccountStatus.Inactive) return UserStatus.active;
+    if (status === AccountStatus.Disabled || status === AccountStatus.Terminated) return UserStatus.inactive;
+    return UserStatus.active;
+};
+export { convertUserStatus, getCookieByName, isBrowser, retrieveNameFromI18n };

package/lib/account/internal/logger.d.ts

@@ -0,0 +1,15 @@
+import type { FetchMethod } from './types';
+type LogParams = {
+    traceId: number;
+    url: string;
+    method: FetchMethod;
+    body?: unknown;
+};
+export declare const logRequest: (params: LogParams, psmName?: string) => void;
+export declare const logResponse: (traceId: number, response: {
+    data: unknown;
+    error: unknown;
+    status: number;
+}, psmName?: string) => void;
+export {};
+//# sourceMappingURL=logger.d.ts.map

package/lib/account/internal/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../../src/account/internal/logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,KAAK,SAAS,GAAG;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,QAAQ,SAAS,EAAE,UAAS,MAAkB,SAuBxE,CAAC;AAEF,eAAO,MAAM,WAAW,GACtB,SAAS,MAAM,EACf,UAAU;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC3D,UAAS,MAAkB,SA0B5B,CAAC"}

package/lib/account/internal/logger.js

@@ -0,0 +1,18 @@
+const logRequest = (params, psmName = 'Service')=>{
+    const { traceId, url, method, body } = params;
+    const decodedParams = Array.from(new URL(url, 'http://temp.invalid').searchParams.entries()).filter(([key])=>![
+            'count',
+            'tx',
+            'missing',
+            'resolution',
+            'column'
+        ].includes(key)).map(([key, value])=>`${key}=${value}`);
+    console.log(`[Account][${psmName}][Request]`, 'trace id:', traceId, 'method:', method, 'params:', decodedParams.join(','), 'body:', body);
+};
+const logResponse = (traceId, response, psmName = 'Service')=>{
+    const { data, error, status } = response;
+    const hasError = !!error;
+    if (hasError) console.error(`[Account][${psmName}][Response Failed]`, 'trace id:', traceId, 'statusCode:', status, 'error:', error);
+    else console.log(`[Account][${psmName}][Response Success]`, 'trace id:', traceId, 'statusCode:', status, 'data:', data);
+};
+export { logRequest, logResponse };

package/lib/account/internal/slardar.d.ts

@@ -0,0 +1,2 @@
+export declare const reportAccountException: (error: unknown, extra: Record<string, unknown>) => void;
+//# sourceMappingURL=slardar.d.ts.map

package/lib/account/internal/slardar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slardar.d.ts","sourceRoot":"","sources":["../../../src/account/internal/slardar.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,sBAAsB,GACjC,OAAO,OAAO,EACd,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SAa/B,CAAC"}

package/lib/account/internal/slardar.js

@@ -0,0 +1,16 @@
+import { slardar } from "@lark-apaas/internal-slardar";
+const toRecordString = (record)=>Object.fromEntries(Object.entries(record).filter(([, value])=>null != value).map(([key, value])=>[
+            key,
+            String(value)
+        ]));
+const reportAccountException = (error, extra)=>{
+    try {
+        const categories = toRecordString({
+            source: 'auth-sdk',
+            module: 'account',
+            ...extra
+        });
+        slardar.captureException(error, categories);
+    } catch  {}
+};
+export { reportAccountException };