@h-ai/kit 0.1.0-alpha.13 → 0.1.0-alpha.16

package/README.md

@@ -1,11 +1,13 @@
 # @h-ai/kit
 
-`@h-ai/kit` 是 hai-framework 的 SvelteKit 集成模块，提供统一的请求管道与 API 工具：
+`@h-ai/kit` 是 hai-framework 的 SvelteKit 集成模块，提供统一的请求管道与同源 endpoint 工具：
 
 - `kit.createHandle()`：会话解析、路由守卫、中间件链、可选传输加密与 Cookie 加密
 - `kit.handler()`：API 端点异常边界
 - `kit.guard` / `kit.response` / `kit.validate` / `kit.auth` / `kit.client` / `kit.crud`
 
+> 公共跨端 HTTP API contract 统一放在 `@h-ai/api-contract`，由 `@h-ai/serv` 挂载，客户端通过 `@h-ai/api-client` typed client 调用；`@h-ai/kit` 不定义也不承载业务 API contract。
+
 ## 安装
 
 ```bash
@@ -22,7 +24,6 @@ npm install -D @sveltejs/vite-plugin-svelte vite
 - 统一 API 响应与请求验证（Zod）
 - Bearer Token 工具（服务端 login/logout + 浏览器端 Token 存储）
 - 浏览器端统一客户端（自动 CSRF，支持传输加密）
-- 基于 EndpointDef 的契约模式（`fromContract`）
 - 声明式 CRUD 资源定义（`crud.define`）
 - A2A 协议集成
 - 双构建模式（`createAdapter()`）
@@ -93,14 +94,6 @@ const haiHandle = kit.createHandle({
 export const handle: Handle = haiHandle
 ```
 
-**src/hooks.client.ts**：
-
-```typescript
-import { kit } from '@h-ai/kit'
-
-export const handleFetch = kit.auth.createHandleFetch()
-```
-
 ### API 端点
 
 ```typescript
@@ -119,22 +112,10 @@ export const POST = kit.handler(async ({ request, locals }) => {
 })
 ```
 
-### 契约模式（推荐）
-
-```typescript
-import { iamEndpoints } from '@h-ai/iam/api'
-import { kit } from '@h-ai/kit'
-
-export const POST = kit.fromContract(iamEndpoints.login, async (input) => {
-  const result = await iam.auth.login(input)
-  if (!result.success)
-    return kit.response.unauthorized(result.error.message)
-  return kit.response.ok(result.data)
-})
-```
-
 ### 浏览器客户端
 
+`kit.client.create()` 面向 SvelteKit 同源 endpoint；Web / App / 小程序跨域访问公共 API 时，请使用 `@h-ai/api-client`。
+
 ```typescript
 // src/lib/utils/api.ts — 全应用共享
 import { kit } from '@h-ai/kit'
@@ -152,6 +133,91 @@ const response = await apiFetch('/api/users', { method: 'GET' })
 
 > CSRF Header 注入由 `apiFetch` 自动处理；`@h-ai/kit` 不提供独立的 CSRF 中间件工厂。
 
+### 同源传输加密
+
+kit 的传输加密也统一委托 `@h-ai/crypto`：服务端通过 `crypto.transport.createServer()` 创建管理器，浏览器端通过 `kit.client.installBrowserTransport(kitConfig, { crypto })` 一行安装同源 fetch 包装。应用层只配置顶层 `crypto` 句柄。
+
+**src/hooks.server.ts**：
+
+```ts
+import { crypto } from '@h-ai/crypto'
+import { kit } from '@h-ai/kit'
+
+await crypto.init()
+
+export const handle = kit.createHandle({
+  auth: {
+    verifyToken,
+    protectedPaths: ['/api/*'],
+    publicPaths: ['/api/_hai/*'], // 默认密钥协商端点
+  },
+  crypto: {
+    crypto,
+    transport: { requireEncryption: true },
+  },
+})
+```
+
+**src/routes/+layout.svelte**（推荐入口：浏览器端只需一行）：
+
+```svelte
+<script lang='ts'>
+  import { browser } from '$app/environment'
+  import { appKitConfig } from '$lib/config/kit-config'
+  import { crypto } from '@h-ai/crypto'
+  import { kit } from '@h-ai/kit'
+
+  // 一次性安装：内部按 _kit.yml 决定是否启用 transport，并预热 crypto
+  if (browser) {
+    kit.client.installBrowserTransport(appKitConfig, { crypto })
+  }
+</script>
+```
+
+**src/lib/utils/api.ts**（业务层只看到 `apiFetch`）：
+
+```ts
+import { kit } from '@h-ai/kit'
+
+export const { apiFetch } = kit.client.create()
+```
+
+> 不再需要 `src/hooks.client.ts`：默认 `handleFetch` 行为已经够用，SvelteKit 内部 `__data.json` 请求会自动走上面安装的全局 fetch 包装。同源 Authorization 注入统一通过 `kit.client.create({ auth: true })` 完成，避免浏览器端 hooks 与全局 fetch 包装形成两条链路。
+
+默认密钥协商路径为 `/api/_hai/key-exchange`。如服务端自定义 `transport.keyExchangePath`，客户端需同步配置 `transport.keyExchangeUrl`。
+
+transport 默认作用于同源 `/api/*` endpoint 与 SvelteKit `__data.json` 页面数据请求（以及密钥协商端点本身）；页面文档与静态资源仍保持明文，不要求携带 `X-Client-Id`。文件上传等 `multipart/form-data` 请求会保持原样发送，需在服务端 `excludePaths` 中显式放行对应上传路径。
+
+安全策略默认 fail-closed：`requireEncryption: true` 时，受保护路径缺少 `X-Client-Id` 会直接返回 400；服务端 transport 管理器不可用、响应体无法加密或超过单次加密上限时返回错误，不会把业务明文响应透传给客户端。`requireEncryption: false` 仅用于迁移期灰度，不建议在生产启用。
+
+### 使用 `_kit.yml` 统一 transport 配置
+
+`@h-ai/kit` 提供 `KitConfigSchema` / `resolveKitConfig()`，方便应用用同一份 `_kit.yml`
+同时驱动 `hooks.server.ts` 与浏览器端 `kit.client.installBrowserTransport()`：
+
+```yml
+transport:
+  keyExchangePath: /api/_hai/key-exchange
+  requireEncryption: true
+  encryptResponse: true
+  excludePaths:
+    - /api/storage
+    - /api/public
+    - /api/auth/profile/avatar
+  maxClients: 10000
+```
+
+```ts
+import { resolveKitConfig } from '@h-ai/kit'
+import { parse } from 'yaml'
+import rawKitConfig from '../config/_kit.yml?raw'
+
+export const appKitConfig = resolveKitConfig(parse(rawKitConfig) ?? {})
+```
+
+如只在服务端读取配置，也可配合 `core.config.validate('kit', KitConfigSchema)` 使用。
+由于浏览器端也可能读取这份配置，`_kit.yml` 只应放公开的 transport 路径/开关，不要写入密钥。
+
 ## 配置
 
 `kit.createHandle()` 配置项：
@@ -169,14 +235,12 @@ const response = await apiFetch('/api/users', { method: 'GET' })
 
 ## 导出路径
 
-| 路径                | 用途                                           |
-| ------------------- | ---------------------------------------------- |
-| `@h-ai/kit`         | 主入口：`kit` 命名空间、类型、`defineEndpoint` |
-| `@h-ai/kit/client`  | 浏览器端客户端                                 |
-| `@h-ai/kit/adapter` | 双构建 adapter（`createAdapter()`）            |
-| `@h-ai/kit/vite`    | Vite 插件                                      |
-| `@h-ai/kit/a2a`     | A2A 协议集成                                   |
-| `@h-ai/kit/crypto`  | 加密模块集成                                   |
+- `@h-ai/kit`：主入口，提供 `kit` 命名空间与类型。
+- `@h-ai/kit/client`：浏览器端客户端。
+- `@h-ai/kit/adapter`：双构建 adapter（`createAdapter()`）。
+- `@h-ai/kit/vite`：Vite 插件。
+- `@h-ai/kit/a2a`：A2A 协议集成。
+- `@h-ai/kit/crypto`：加密模块集成。
 
 ## 错误处理
 

package/dist/browser.d.ts

@@ -1,11 +1,12 @@
-import { c as createKitClient, s as setBrowserToken, a as clearBrowserToken, b as createTokenStore, d as createHandleFetch } from './index-BotXLTck.js';
-export { C as ClientTransportConfig, K as KitClient, e as KitClientConfig } from './index-BotXLTck.js';
+import { c as createKitClient, i as installBrowserTransport, a as installBrowserTransportFetch, s as setBrowserToken, b as clearBrowserToken, d as createTokenStore } from './index-M00CsNUR.js';
+export { C as ClientTransportConfig, K as KitClient, e as KitClientConfig, f as KitConfig, g as KitConfigInput, h as KitConfigSchema, j as KitTransportConfig, k as KitTransportConfigInput, l as createSvelteKitNavAdapter, r as resolveKitConfig, m as resolveKitTransportConfig } from './index-M00CsNUR.js';
 import { d as defineCrud, s as setAllModulesLocale } from './kit-i18n-CgpNTh9G.js';
-export { A as ApiResponse, a as AuthOperations, b as AuthOperationsProvider, C as CorsConfig, F as FormError, c as FormValidationResult, G as GuardConfig, d as GuardResult, H as HaiRequestEvent, e as HandleA2AConfig, f as HandleA2AOperations, g as HandleAuthConfig, h as HandleConfig, i as HookCryptoConfig, M as Middleware, j as MiddlewareContext, R as RateLimitConfig, k as RouteGuard, S as SessionData, l as SessionLike, T as TransportEncryptionOptions } from './kit-types-BHlDNNpd.js';
+export { A as ApiResponse, a as AuthOperations, b as AuthOperationsProvider, C as CorsConfig, F as FormError, c as FormValidationResult, G as GuardConfig, d as GuardResult, H as HaiRequestEvent, e as HandleA2AConfig, f as HandleA2AOperations, g as HandleAuthConfig, h as HandleConfig, i as HookCryptoConfig, M as Middleware, j as MiddlewareContext, R as RateLimitConfig, k as RouteGuard, S as SessionData, l as SessionLike, T as TransportEncryptionOptions } from './kit-types-XUMggtk_.js';
+import '@h-ai/crypto';
 import '@h-ai/core';
 import '@h-ai/iam';
+import 'zod';
 import '@sveltejs/kit';
-import './kit-crypto-types-C-gEvx04.js';
 
 /**
  * @h-ai/kit — 浏览器入口
@@ -20,6 +21,8 @@ import './kit-crypto-types-C-gEvx04.js';
 declare const kit: {
     client: {
         create: typeof createKitClient;
+        installBrowserTransport: typeof installBrowserTransport;
+        installBrowserTransportFetch: typeof installBrowserTransportFetch;
     };
     crud: {
         define: typeof defineCrud;
@@ -28,11 +31,10 @@ declare const kit: {
         setBrowserToken: typeof setBrowserToken;
         clearBrowserToken: typeof clearBrowserToken;
         createTokenStore: typeof createTokenStore;
-        createHandleFetch: typeof createHandleFetch;
     };
     i18n: {
         setLocale: typeof setAllModulesLocale;
     };
 };
 
-export { createKitClient, kit };
+export { createKitClient, installBrowserTransport, installBrowserTransportFetch, kit };

package/dist/browser.js

@@ -1,11 +1,14 @@
-import { defineCrud } from './chunk-FRYJMRTP.js';
-import { createHandleFetch, createTokenStore, clearBrowserToken, setBrowserToken, createKitClient } from './chunk-GRYHRXVC.js';
-import { setAllModulesLocale } from './chunk-BRZK7V5O.js';
+import { defineCrud } from './chunk-KJUUEH7I.js';
+export { KitConfigSchema, resolveKitConfig, resolveKitTransportConfig } from './chunk-KJUUEH7I.js';
+import { createTokenStore, clearBrowserToken, setBrowserToken, installBrowserTransportFetch, installBrowserTransport, createKitClient } from './chunk-EMSCTFJJ.js';
+import { setAllModulesLocale } from './chunk-MI65L22O.js';
 
 // src/browser.ts
 var kit = {
   client: {
-    create: createKitClient
+    create: createKitClient,
+    installBrowserTransport,
+    installBrowserTransportFetch
   },
   crud: {
     define: defineCrud
@@ -13,8 +16,7 @@ var kit = {
   auth: {
     setBrowserToken,
     clearBrowserToken,
-    createTokenStore,
-    createHandleFetch
+    createTokenStore
   },
   i18n: {
     setLocale: setAllModulesLocale

package/dist/browser.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/browser.ts"],"names":[],"mappings":";;;;;AAeO,IAAM,GAAA,GAAM;AAAA,EACjB,MAAA,EAAQ;AAAA,IACN,MAAA,EAAQ;AAAA,GACV;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,MAAA,EAAQ;AAAA,GACV;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,eAAA;AAAA,IACA,iBAAA;AAAA,IACA,gBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,SAAA,EAAW;AAAA;AAEf","file":"browser.js","sourcesContent":["/**\n * @h-ai/kit — 浏览器入口\n *\n * 为客户端提供精简且安全的运行时导出，避免将服务端 Hook/A2A/IAM 运行时代码打入浏览器包。\n * @module browser\n */\n\nimport { createKitClient } from './client/kit-client.js'\nimport { defineCrud } from './crud/kit-crud.js'\nimport { clearBrowserToken, createHandleFetch, createTokenStore, setBrowserToken } from './kit-auth.js'\nimport { setAllModulesLocale } from './kit-i18n.js'\n\n/**\n * 浏览器端 kit 对象（仅暴露 client-safe 能力）\n */\nexport const kit = {\n  client: {\n    create: createKitClient,\n  },\n  crud: {\n    define: defineCrud,\n  },\n  auth: {\n    setBrowserToken,\n    clearBrowserToken,\n    createTokenStore,\n    createHandleFetch,\n  },\n  i18n: {\n    setLocale: setAllModulesLocale,\n  },\n}\n\nexport type * from './client/index.js'\nexport type * from './kit-types.js'\n"]}
+{"version":3,"sources":["../src/browser.ts"],"names":[],"mappings":";;;;;;AAgBO,IAAM,GAAA,GAAM;AAAA,EACjB,MAAA,EAAQ;AAAA,IACN,MAAA,EAAQ,eAAA;AAAA,IACR,uBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,MAAA,EAAQ;AAAA,GACV;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,eAAA;AAAA,IACA,iBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,SAAA,EAAW;AAAA;AAEf","file":"browser.js","sourcesContent":["/**\n * @h-ai/kit — 浏览器入口\n *\n * 为客户端提供精简且安全的运行时导出，避免将服务端 Hook/A2A/IAM 运行时代码打入浏览器包。\n * @module browser\n */\n\nimport { createKitClient, installBrowserTransport, installBrowserTransportFetch } from './client/kit-client.js'\nimport { defineCrud } from './crud/kit-crud.js'\nimport { clearBrowserToken, createTokenStore, setBrowserToken } from './kit-auth.js'\nimport { KitConfigSchema, resolveKitConfig, resolveKitTransportConfig } from './kit-config.js'\nimport { setAllModulesLocale } from './kit-i18n.js'\n\n/**\n * 浏览器端 kit 对象（仅暴露 client-safe 能力）\n */\nexport const kit = {\n  client: {\n    create: createKitClient,\n    installBrowserTransport,\n    installBrowserTransportFetch,\n  },\n  crud: {\n    define: defineCrud,\n  },\n  auth: {\n    setBrowserToken,\n    clearBrowserToken,\n    createTokenStore,\n  },\n  i18n: {\n    setLocale: setAllModulesLocale,\n  },\n}\n\nexport { KitConfigSchema, resolveKitConfig, resolveKitTransportConfig }\n\nexport type * from './client/index.js'\nexport type * from './kit-types.js'\n"]}

package/dist/chunk-BM7IP4W5.js

@@ -0,0 +1,211 @@
+import { DEFAULT_TRANSPORT_KEY_EXCHANGE_PATH, shouldHandleTransportPath, shouldExcludeTransportPath, kitM } from './chunk-MI65L22O.js';
+import { TRANSPORT_PROTOCOL } from '@h-ai/crypto';
+
+var MAX_ENCRYPTED_BODY = 1048576;
+var ENCRYPTABLE_RESPONSE_CONTENT_TYPES = ["application/json", "text/sveltekit-data"];
+function transportEncryptionMiddleware(config) {
+  if (!config.enabled) {
+    return async (_context, next) => next();
+  }
+  const keyExchangePath = config.keyExchangePath ?? DEFAULT_TRANSPORT_KEY_EXCHANGE_PATH;
+  const excludePaths = config.excludePaths ?? [];
+  const encryptResponse = config.encryptResponse ?? true;
+  const requireEncryption = config.requireEncryption ?? true;
+  const result = config.crypto.transport.createServer({ maxClients: config.maxClients });
+  if (!result.success) {
+    return createUnavailableTransportMiddleware(keyExchangePath, excludePaths);
+  }
+  const manager = result.data;
+  return async (context, next) => {
+    const { event } = context;
+    const pathname = getRequestPathname(event.request);
+    if (pathname === keyExchangePath && event.request.method === "POST") {
+      return handleKeyExchange(manager, event.request);
+    }
+    if (!shouldHandleTransportPath(pathname, keyExchangePath)) {
+      return next();
+    }
+    if (shouldExcludeTransportPath(pathname, excludePaths, keyExchangePath)) {
+      return next();
+    }
+    const clientId = event.request.headers.get(TRANSPORT_PROTOCOL.CLIENT_ID_HEADER);
+    if (!clientId) {
+      if (requireEncryption) {
+        return jsonError(kitM("kit_transportClientIdRequired"), 400);
+      }
+      return next();
+    }
+    const clientPublicKey = await manager.getClientPublicKey(clientId);
+    if (!clientPublicKey) {
+      return jsonError(kitM("kit_transportClientKeyNotFound"), 400);
+    }
+    if (hasBody(event.request.method) && !isRequestBodyEmpty(event.request)) {
+      const decryptResult = await decryptRequestBody(event, manager, requireEncryption);
+      if (decryptResult) {
+        return decryptResult;
+      }
+    }
+    const response = await next();
+    if (!encryptResponse) {
+      return response;
+    }
+    if (isEmptyResponse(response)) {
+      return response;
+    }
+    const contentType = response.headers.get("Content-Type") ?? "";
+    if (!canEncryptResponseContentType(contentType)) {
+      return jsonError(kitM("kit_transportEncryptFailed"), 500);
+    }
+    const contentLength = response.headers.get("Content-Length");
+    if (contentLength && Number.parseInt(contentLength, 10) > MAX_ENCRYPTED_BODY) {
+      return jsonError(kitM("kit_transportEncryptFailed"), 500);
+    }
+    try {
+      const responseBody = await response.clone().text();
+      if (!responseBody) {
+        return response;
+      }
+      const encryptedPayload = await manager.encryptResponse(clientId, responseBody);
+      if (!encryptedPayload.success) {
+        return jsonError(kitM("kit_transportEncryptFailed"), 500);
+      }
+      const headers = new Headers(response.headers);
+      headers.set(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER, TRANSPORT_PROTOCOL.ENCRYPTED_HEADER_VALUE);
+      headers.delete("Content-Length");
+      return new Response(JSON.stringify(encryptedPayload.data), {
+        status: response.status,
+        statusText: response.statusText,
+        headers
+      });
+    } catch {
+      return jsonError(kitM("kit_transportEncryptFailed"), 500);
+    }
+  };
+}
+function canEncryptResponseContentType(contentType) {
+  return ENCRYPTABLE_RESPONSE_CONTENT_TYPES.some((type) => contentType.includes(type));
+}
+function createUnavailableTransportMiddleware(keyExchangePath, excludePaths) {
+  return async (context, next) => {
+    const pathname = getRequestPathname(context.event.request);
+    if (pathname === keyExchangePath) {
+      return jsonError(kitM("kit_transportKeyGenerationFailed"), 500);
+    }
+    if (!shouldHandleTransportPath(pathname, keyExchangePath)) {
+      return next();
+    }
+    if (shouldExcludeTransportPath(pathname, excludePaths, keyExchangePath)) {
+      return next();
+    }
+    return jsonError(kitM("kit_transportKeyGenerationFailed"), 500);
+  };
+}
+function isEmptyResponse(response) {
+  if ([204, 304].includes(response.status))
+    return true;
+  return response.headers.get("Content-Length") === "0";
+}
+function getRequestPathname(request) {
+  return new URL(request.url).pathname;
+}
+function jsonError(message, status) {
+  return new Response(JSON.stringify({ error: message }), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+async function handleKeyExchange(manager, request) {
+  try {
+    const body = await request.json();
+    if (!body.clientPublicKey || typeof body.clientPublicKey !== "string") {
+      return jsonError(kitM("kit_transportInvalidPayload"), 400);
+    }
+    const clientId = await manager.registerClientKey(body.clientPublicKey);
+    const serverPublicKey = manager.getServerPublicKey();
+    return new Response(
+      JSON.stringify({ serverPublicKey, clientId }),
+      { status: 200, headers: { "Content-Type": "application/json" } }
+    );
+  } catch {
+    return jsonError(kitM("kit_transportKeyExchangeFailed"), 500);
+  }
+}
+function hasBody(method) {
+  return ["POST", "PUT", "PATCH", "DELETE"].includes(method.toUpperCase());
+}
+function isRequestBodyEmpty(request) {
+  if (request.body === null)
+    return true;
+  const contentLength = request.headers.get("Content-Length");
+  if (contentLength !== null)
+    return Number.parseInt(contentLength, 10) === 0;
+  return false;
+}
+function replaceRequestBody(event, body) {
+  const headers = new Headers(event.request.headers);
+  headers.delete(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER);
+  headers.delete("Content-Length");
+  headers.set("Content-Type", "application/json; charset=utf-8");
+  const newRequest = new Request(event.request.url, {
+    method: event.request.method,
+    headers,
+    body
+  });
+  Object.defineProperty(event, "request", {
+    value: newRequest,
+    writable: true,
+    configurable: true
+  });
+}
+async function decryptRequestBody(event, manager, requireEncryption) {
+  const isEncrypted = event.request.headers.get(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER) === TRANSPORT_PROTOCOL.ENCRYPTED_HEADER_VALUE;
+  if (!isEncrypted) {
+    if (!requireEncryption)
+      return null;
+    return jsonError(kitM("kit_transportInvalidPayload"), 400);
+  }
+  const contentType = event.request.headers.get("Content-Type") ?? "";
+  if (!contentType.includes("application/json")) {
+    if (!requireEncryption) {
+      return null;
+    }
+    return jsonError(kitM("kit_transportInvalidPayload"), 400);
+  }
+  const bodyText = await event.request.text();
+  if (!bodyText) {
+    return null;
+  }
+  let payload;
+  try {
+    payload = JSON.parse(bodyText);
+  } catch {
+    if (!requireEncryption) {
+      replaceRequestBody(event, bodyText);
+      return null;
+    }
+    return jsonError(kitM("kit_transportDecryptFailed"), 400);
+  }
+  if (!isEncryptedPayloadShape(payload)) {
+    if (!requireEncryption) {
+      replaceRequestBody(event, bodyText);
+      return null;
+    }
+    return jsonError(kitM("kit_transportInvalidPayload"), 400);
+  }
+  const plaintext = manager.decryptRequest(payload);
+  if (!plaintext.success) {
+    return jsonError(kitM("kit_transportDecryptFailed"), 400);
+  }
+  replaceRequestBody(event, plaintext.data);
+  return null;
+}
+function isEncryptedPayloadShape(payload) {
+  if (!payload || typeof payload !== "object")
+    return false;
+  const p = payload;
+  return typeof p.encryptedKey === "string" && typeof p.ciphertext === "string" && typeof p.iv === "string";
+}
+
+export { transportEncryptionMiddleware };
+//# sourceMappingURL=chunk-BM7IP4W5.js.map
+//# sourceMappingURL=chunk-BM7IP4W5.js.map

package/dist/chunk-BM7IP4W5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/modules/crypto/kit-transport-middleware.ts"],"names":[],"mappings":";;;AAcA,IAAM,kBAAA,GAAqB,OAAA;AAC3B,IAAM,kCAAA,GAAqC,CAAC,kBAAA,EAAoB,qBAAqB,CAAA;AAmB9E,SAAS,8BAA8B,MAAA,EAA+C;AAE3F,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,OAAO,OAAO,QAAA,EAAU,IAAA,KAAS,IAAA,EAAK;AAAA,EACxC;AAEA,EAAA,MAAM,eAAA,GAAkB,OAAO,eAAA,IAAmB,mCAAA;AAClD,EAAA,MAAM,YAAA,GAAe,MAAA,CAAO,YAAA,IAAgB,EAAC;AAC7C,EAAA,MAAM,eAAA,GAAkB,OAAO,eAAA,IAAmB,IAAA;AAClD,EAAA,MAAM,iBAAA,GAAoB,OAAO,iBAAA,IAAqB,IAAA;AAGtD,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO,SAAA,CAAU,aAAa,EAAE,UAAA,EAAY,MAAA,CAAO,UAAA,EAAY,CAAA;AACrF,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AAEnB,IAAA,OAAO,oCAAA,CAAqC,iBAAiB,YAAY,CAAA;AAAA,EAC3E;AACA,EAAA,MAAM,UAAU,MAAA,CAAO,IAAA;AAEvB,EAAA,OAAO,OAAO,SAAS,IAAA,KAAS;AAC9B,IAAA,MAAM,EAAE,OAAM,GAAI,OAAA;AAClB,IAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,KAAA,CAAM,OAAO,CAAA;AAGjD,IAAA,IAAI,QAAA,KAAa,eAAA,IAAmB,KAAA,CAAM,OAAA,CAAQ,WAAW,MAAA,EAAQ;AACnE,MAAA,OAAO,iBAAA,CAAkB,OAAA,EAAS,KAAA,CAAM,OAAO,CAAA;AAAA,IACjD;AAIA,IAAA,IAAI,CAAC,yBAAA,CAA0B,QAAA,EAAU,eAAe,CAAA,EAAG;AACzD,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AAGA,IAAA,IAAI,0BAAA,CAA2B,QAAA,EAAU,YAAA,EAAc,eAAe,CAAA,EAAG;AACvE,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AAGA,IAAA,MAAM,WAAW,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,gBAAgB,CAAA;AAC9E,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,IAAI,iBAAA,EAAmB;AAErB,QAAA,OAAO,SAAA,CAAU,IAAA,CAAK,+BAA+B,CAAA,EAAG,GAAG,CAAA;AAAA,MAC7D;AAEA,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AAGA,IAAA,MAAM,eAAA,GAAkB,MAAM,OAAA,CAAQ,kBAAA,CAAmB,QAAQ,CAAA;AACjE,IAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,MAAA,OAAO,SAAA,CAAU,IAAA,CAAK,gCAAgC,CAAA,EAAG,GAAG,CAAA;AAAA,IAC9D;AAGA,IAAA,IAAI,OAAA,CAAQ,MAAM,OAAA,CAAQ,MAAM,KAAK,CAAC,kBAAA,CAAmB,KAAA,CAAM,OAAO,CAAA,EAAG;AACvE,MAAA,MAAM,aAAA,GAAgB,MAAM,kBAAA,CAAmB,KAAA,EAAO,SAAS,iBAAiB,CAAA;AAChF,MAAA,IAAI,aAAA,EAAe;AACjB,QAAA,OAAO,aAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,EAAK;AAG5B,IAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,MAAA,OAAO,QAAA;AAAA,IACT;AAGA,IAAA,IAAI,eAAA,CAAgB,QAAQ,CAAA,EAAG;AAC7B,MAAA,OAAO,QAAA;AAAA,IACT;AAEA,IAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC5D,IAAA,IAAI,CAAC,6BAAA,CAA8B,WAAW,CAAA,EAAG;AAC/C,MAAA,OAAO,SAAA,CAAU,IAAA,CAAK,4BAA4B,CAAA,EAAG,GAAG,CAAA;AAAA,IAC1D;AACA,IAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC3D,IAAA,IAAI,iBAAiB,MAAA,CAAO,QAAA,CAAS,aAAA,EAAe,EAAE,IAAI,kBAAA,EAAoB;AAC5E,MAAA,OAAO,SAAA,CAAU,IAAA,CAAK,4BAA4B,CAAA,EAAG,GAAG,CAAA;AAAA,IAC1D;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,YAAA,GAAe,MAAM,QAAA,CAAS,KAAA,GAAQ,IAAA,EAAK;AACjD,MAAA,IAAI,CAAC,YAAA,EAAc;AACjB,QAAA,OAAO,QAAA;AAAA,MACT;AAEA,MAAA,MAAM,gBAAA,GAAmB,MAAM,OAAA,CAAQ,eAAA,CAAgB,UAAU,YAAY,CAAA;AAC7E,MAAA,IAAI,CAAC,iBAAiB,OAAA,EAAS;AAC7B,QAAA,OAAO,SAAA,CAAU,IAAA,CAAK,4BAA4B,CAAA,EAAG,GAAG,CAAA;AAAA,MAC1D;AACA,MAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,QAAA,CAAS,OAAO,CAAA;AAC5C,MAAA,OAAA,CAAQ,GAAA,CAAI,kBAAA,CAAmB,gBAAA,EAAkB,kBAAA,CAAmB,sBAAsB,CAAA;AAC1F,MAAA,OAAA,CAAQ,OAAO,gBAAgB,CAAA;AAC/B,MAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,gBAAA,CAAiB,IAAI,CAAA,EAAG;AAAA,QACzD,QAAQ,QAAA,CAAS,MAAA;AAAA,QACjB,YAAY,QAAA,CAAS,UAAA;AAAA,QACrB;AAAA,OACD,CAAA;AAAA,IACH,CAAA,CAAA,MACM;AACJ,MAAA,OAAO,SAAA,CAAU,IAAA,CAAK,4BAA4B,CAAA,EAAG,GAAG,CAAA;AAAA,IAC1D;AAAA,EACF,CAAA;AACF;AAEA,SAAS,8BAA8B,WAAA,EAA8B;AACnE,EAAA,OAAO,mCAAmC,IAAA,CAAK,CAAA,IAAA,KAAQ,WAAA,CAAY,QAAA,CAAS,IAAI,CAAC,CAAA;AACnF;AAEA,SAAS,oCAAA,CACP,iBACA,YAAA,EACY;AACZ,EAAA,OAAO,OAAO,SAAS,IAAA,KAAS;AAC9B,IAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,OAAA,CAAQ,KAAA,CAAM,OAAO,CAAA;AACzD,IAAA,IAAI,aAAa,eAAA,EAAiB;AAChC,MAAA,OAAO,SAAA,CAAU,IAAA,CAAK,kCAAkC,CAAA,EAAG,GAAG,CAAA;AAAA,IAChE;AACA,IAAA,IAAI,CAAC,yBAAA,CAA0B,QAAA,EAAU,eAAe,CAAA,EAAG;AACzD,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AACA,IAAA,IAAI,0BAAA,CAA2B,QAAA,EAAU,YAAA,EAAc,eAAe,CAAA,EAAG;AACvE,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AACA,IAAA,OAAO,SAAA,CAAU,IAAA,CAAK,kCAAkC,CAAA,EAAG,GAAG,CAAA;AAAA,EAChE,CAAA;AACF;AAEA,SAAS,gBAAgB,QAAA,EAA6B;AACpD,EAAA,IAAI,CAAC,GAAA,EAAK,GAAG,CAAA,CAAE,QAAA,CAAS,SAAS,MAAM,CAAA;AACrC,IAAA,OAAO,IAAA;AACT,EAAA,OAAO,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA,KAAM,GAAA;AACpD;AAEA,SAAS,mBAAmB,OAAA,EAA0B;AACpD,EAAA,OAAO,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA,CAAE,QAAA;AAC9B;AAEA,SAAS,SAAA,CAAU,SAAiB,MAAA,EAA0B;AAC5D,EAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG;AAAA,IACtD,MAAA;AAAA,IACA,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,GAC/C,CAAA;AACH;AAWA,eAAe,iBAAA,CACb,SACA,OAAA,EACmB;AACnB,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,IAAA,EAAK;AAEhC,IAAA,IAAI,CAAC,IAAA,CAAK,eAAA,IAAmB,OAAO,IAAA,CAAK,oBAAoB,QAAA,EAAU;AACrE,MAAA,OAAO,SAAA,CAAU,IAAA,CAAK,6BAA6B,CAAA,EAAG,GAAG,CAAA;AAAA,IAC3D;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,iBAAA,CAAkB,KAAK,eAAe,CAAA;AACrE,IAAA,MAAM,eAAA,GAAkB,QAAQ,kBAAA,EAAmB;AAEnD,IAAA,OAAO,IAAI,QAAA;AAAA,MACT,IAAA,CAAK,SAAA,CAAU,EAAE,eAAA,EAAiB,UAAU,CAAA;AAAA,MAC5C,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAS,EAAE,cAAA,EAAgB,oBAAmB;AAAE,KACjE;AAAA,EACF,CAAA,CAAA,MACM;AACJ,IAAA,OAAO,SAAA,CAAU,IAAA,CAAK,gCAAgC,CAAA,EAAG,GAAG,CAAA;AAAA,EAC9D;AACF;AAQA,SAAS,QAAQ,MAAA,EAAyB;AACxC,EAAA,OAAO,CAAC,QAAQ,KAAA,EAAO,OAAA,EAAS,QAAQ,CAAA,CAAE,QAAA,CAAS,MAAA,CAAO,WAAA,EAAa,CAAA;AACzE;AAGA,SAAS,mBAAmB,OAAA,EAA2B;AACrD,EAAA,IAAI,QAAQ,IAAA,KAAS,IAAA;AACnB,IAAA,OAAO,IAAA;AAET,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC1D,EAAA,IAAI,aAAA,KAAkB,IAAA;AACpB,IAAA,OAAO,MAAA,CAAO,QAAA,CAAS,aAAA,EAAe,EAAE,CAAA,KAAM,CAAA;AAEhD,EAAA,OAAO,KAAA;AACT;AAeA,SAAS,kBAAA,CAAmB,OAAsB,IAAA,EAAoB;AACpE,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,KAAA,CAAM,QAAQ,OAAO,CAAA;AACjD,EAAA,OAAA,CAAQ,MAAA,CAAO,mBAAmB,gBAAgB,CAAA;AAClD,EAAA,OAAA,CAAQ,OAAO,gBAAgB,CAAA;AAC/B,EAAA,OAAA,CAAQ,GAAA,CAAI,gBAAgB,iCAAiC,CAAA;AAC7D,EAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,KAAA,CAAM,QAAQ,GAAA,EAAK;AAAA,IAChD,MAAA,EAAQ,MAAM,OAAA,CAAQ,MAAA;AAAA,IACtB,OAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,MAAA,CAAO,cAAA,CAAe,OAAO,SAAA,EAAW;AAAA,IACtC,KAAA,EAAO,UAAA;AAAA,IACP,QAAA,EAAU,IAAA;AAAA,IACV,YAAA,EAAc;AAAA,GACf,CAAA;AACH;AAcA,eAAe,kBAAA,CACb,KAAA,EACA,OAAA,EACA,iBAAA,EAC0B;AAC1B,EAAA,MAAM,WAAA,GAAc,MAAM,OAAA,CAAQ,OAAA,CAAQ,IAAI,kBAAA,CAAmB,gBAAgB,MAC3E,kBAAA,CAAmB,sBAAA;AACzB,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,IAAI,CAAC,iBAAA;AACH,MAAA,OAAO,IAAA;AACT,IAAA,OAAO,SAAA,CAAU,IAAA,CAAK,6BAA6B,CAAA,EAAG,GAAG,CAAA;AAAA,EAC3D;AAEA,EAAA,MAAM,cAAc,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AACjE,EAAA,IAAI,CAAC,WAAA,CAAY,QAAA,CAAS,kBAAkB,CAAA,EAAG;AAC7C,IAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,SAAA,CAAU,IAAA,CAAK,6BAA6B,CAAA,EAAG,GAAG,CAAA;AAAA,EAC3D;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAK;AAC1C,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,IAAA,CAAK,MAAM,QAAQ,CAAA;AAAA,EAC/B,CAAA,CAAA,MACM;AACJ,IAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,MAAA,kBAAA,CAAmB,OAAO,QAAQ,CAAA;AAClC,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,SAAA,CAAU,IAAA,CAAK,4BAA4B,CAAA,EAAG,GAAG,CAAA;AAAA,EAC1D;AAEA,EAAA,IAAI,CAAC,uBAAA,CAAwB,OAAO,CAAA,EAAG;AACrC,IAAA,IAAI,CAAC,iBAAA,EAAmB;AACtB,MAAA,kBAAA,CAAmB,OAAO,QAAQ,CAAA;AAClC,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,SAAA,CAAU,IAAA,CAAK,6BAA6B,CAAA,EAAG,GAAG,CAAA;AAAA,EAC3D;AAEA,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,cAAA,CAAe,OAAO,CAAA;AAChD,EAAA,IAAI,CAAC,UAAU,OAAA,EAAS;AACtB,IAAA,OAAO,SAAA,CAAU,IAAA,CAAK,4BAA4B,CAAA,EAAG,GAAG,CAAA;AAAA,EAC1D;AACA,EAAA,kBAAA,CAAmB,KAAA,EAAO,UAAU,IAAI,CAAA;AACxC,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,wBAAwB,OAAA,EAA+C;AAC9E,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA;AACjC,IAAA,OAAO,KAAA;AACT,EAAA,MAAM,CAAA,GAAI,OAAA;AACV,EAAA,OAAO,OAAO,CAAA,CAAE,YAAA,KAAiB,QAAA,IAAY,OAAO,EAAE,UAAA,KAAe,QAAA,IAAY,OAAO,CAAA,CAAE,EAAA,KAAO,QAAA;AACnG","file":"chunk-BM7IP4W5.js","sourcesContent":["/**\n * @h-ai/kit — 传输加密中间件\n *\n * SvelteKit 中间件，自动对请求/响应进行传输加密解密。\n * @module kit-transport-middleware\n */\n\nimport type { EncryptedPayload, TransportEncryptionManager } from '@h-ai/crypto'\nimport type { Middleware } from '../../kit-types.js'\nimport type { TransportEncryptionConfig } from './kit-crypto-types.js'\nimport { TRANSPORT_PROTOCOL } from '@h-ai/crypto'\nimport { kitM } from '../../kit-i18n.js'\nimport { DEFAULT_TRANSPORT_KEY_EXCHANGE_PATH, shouldExcludeTransportPath, shouldHandleTransportPath } from './kit-transport-paths.js'\n\nconst MAX_ENCRYPTED_BODY = 1_048_576\nconst ENCRYPTABLE_RESPONSE_CONTENT_TYPES = ['application/json', 'text/sveltekit-data']\n\n/**\n * 创建传输加密中间件\n *\n * @param config - 传输加密配置\n * @returns SvelteKit 中间件\n *\n * @example\n * ```ts\n * import { crypto } from '@h-ai/crypto'\n * import { kit } from '@h-ai/kit'\n *\n * // 传输加密通过 createHandle 的 crypto 配置自动启用：\n * export const handle = kit.createHandle({\n *   crypto: { crypto, transport: true },\n * })\n * ```\n */\nexport function transportEncryptionMiddleware(config: TransportEncryptionConfig): Middleware {\n  // 未启用时直接透传\n  if (!config.enabled) {\n    return async (_context, next) => next()\n  }\n\n  const keyExchangePath = config.keyExchangePath ?? DEFAULT_TRANSPORT_KEY_EXCHANGE_PATH\n  const excludePaths = config.excludePaths ?? []\n  const encryptResponse = config.encryptResponse ?? true\n  const requireEncryption = config.requireEncryption ?? true\n\n  // 初始化传输加密管理器\n  const result = config.crypto.transport.createServer({ maxClients: config.maxClients })\n  if (!result.success) {\n    // 安全策略：transport 已启用但服务端管理器不可用时，受保护路由必须 fail-closed，禁止明文透传。\n    return createUnavailableTransportMiddleware(keyExchangePath, excludePaths)\n  }\n  const manager = result.data\n\n  return async (context, next) => {\n    const { event } = context\n    const pathname = getRequestPathname(event.request)\n\n    // 密钥交换端点：委托给 keyExchangeHandler\n    if (pathname === keyExchangePath && event.request.method === 'POST') {\n      return handleKeyExchange(manager, event.request)\n    }\n\n    // 仅对同源 API endpoint 与 SvelteKit __data 请求启用 transport；\n    // 页面文档、静态资源等仍透传，避免首页 HTML 被误拦截。\n    if (!shouldHandleTransportPath(pathname, keyExchangePath)) {\n      return next()\n    }\n\n    // 排除路径不做加解密\n    if (shouldExcludeTransportPath(pathname, excludePaths, keyExchangePath)) {\n      return next()\n    }\n\n    // 请求头中无 X-Client-Id 时的处理\n    const clientId = event.request.headers.get(TRANSPORT_PROTOCOL.CLIENT_ID_HEADER)\n    if (!clientId) {\n      if (requireEncryption) {\n        // 强制加密模式：缺少 X-Client-Id 说明未完成密钥交换，拒绝请求\n        return jsonError(kitM('kit_transportClientIdRequired'), 400)\n      }\n      // 非强制模式：透传明文（渐进式迁移兼容）\n      return next()\n    }\n\n    // 检查客户端是否已注册\n    const clientPublicKey = await manager.getClientPublicKey(clientId)\n    if (!clientPublicKey) {\n      return jsonError(kitM('kit_transportClientKeyNotFound'), 400)\n    }\n\n    // ── 解密请求 ──\n    if (hasBody(event.request.method) && !isRequestBodyEmpty(event.request)) {\n      const decryptResult = await decryptRequestBody(event, manager, requireEncryption)\n      if (decryptResult) {\n        return decryptResult\n      }\n    }\n\n    // ── 执行后续中间件/端点 ──\n    const response = await next()\n\n    // ── 加密响应 ──\n    if (!encryptResponse) {\n      return response\n    }\n\n    // 只允许可安全加密的响应体离开受保护路由；无法加密时 fail-closed，禁止明文泄露。\n    if (isEmptyResponse(response)) {\n      return response\n    }\n\n    const contentType = response.headers.get('Content-Type') ?? ''\n    if (!canEncryptResponseContentType(contentType)) {\n      return jsonError(kitM('kit_transportEncryptFailed'), 500)\n    }\n    const contentLength = response.headers.get('Content-Length')\n    if (contentLength && Number.parseInt(contentLength, 10) > MAX_ENCRYPTED_BODY) {\n      return jsonError(kitM('kit_transportEncryptFailed'), 500)\n    }\n\n    try {\n      const responseBody = await response.clone().text()\n      if (!responseBody) {\n        return response\n      }\n\n      const encryptedPayload = await manager.encryptResponse(clientId, responseBody)\n      if (!encryptedPayload.success) {\n        return jsonError(kitM('kit_transportEncryptFailed'), 500)\n      }\n      const headers = new Headers(response.headers)\n      headers.set(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER, TRANSPORT_PROTOCOL.ENCRYPTED_HEADER_VALUE)\n      headers.delete('Content-Length')\n      return new Response(JSON.stringify(encryptedPayload.data), {\n        status: response.status,\n        statusText: response.statusText,\n        headers,\n      })\n    }\n    catch {\n      return jsonError(kitM('kit_transportEncryptFailed'), 500)\n    }\n  }\n}\n\nfunction canEncryptResponseContentType(contentType: string): boolean {\n  return ENCRYPTABLE_RESPONSE_CONTENT_TYPES.some(type => contentType.includes(type))\n}\n\nfunction createUnavailableTransportMiddleware(\n  keyExchangePath: string,\n  excludePaths: string[],\n): Middleware {\n  return async (context, next) => {\n    const pathname = getRequestPathname(context.event.request)\n    if (pathname === keyExchangePath) {\n      return jsonError(kitM('kit_transportKeyGenerationFailed'), 500)\n    }\n    if (!shouldHandleTransportPath(pathname, keyExchangePath)) {\n      return next()\n    }\n    if (shouldExcludeTransportPath(pathname, excludePaths, keyExchangePath)) {\n      return next()\n    }\n    return jsonError(kitM('kit_transportKeyGenerationFailed'), 500)\n  }\n}\n\nfunction isEmptyResponse(response: Response): boolean {\n  if ([204, 304].includes(response.status))\n    return true\n  return response.headers.get('Content-Length') === '0'\n}\n\nfunction getRequestPathname(request: Request): string {\n  return new URL(request.url).pathname\n}\n\nfunction jsonError(message: string, status: number): Response {\n  return new Response(JSON.stringify({ error: message }), {\n    status,\n    headers: { 'Content-Type': 'application/json' },\n  })\n}\n\n/**\n * 处理密钥交换 POST 请求\n *\n * 接收客户端公钥，注册并返回服务端公钥与 clientId。\n *\n * @param manager - 传输加密管理器\n * @param request - 原始 Request\n * @returns JSON Response\n */\nasync function handleKeyExchange(\n  manager: TransportEncryptionManager,\n  request: Request,\n): Promise<Response> {\n  try {\n    const body = await request.json() as { clientPublicKey?: string }\n\n    if (!body.clientPublicKey || typeof body.clientPublicKey !== 'string') {\n      return jsonError(kitM('kit_transportInvalidPayload'), 400)\n    }\n\n    const clientId = await manager.registerClientKey(body.clientPublicKey)\n    const serverPublicKey = manager.getServerPublicKey()\n\n    return new Response(\n      JSON.stringify({ serverPublicKey, clientId }),\n      { status: 200, headers: { 'Content-Type': 'application/json' } },\n    )\n  }\n  catch {\n    return jsonError(kitM('kit_transportKeyExchangeFailed'), 500)\n  }\n}\n\n/**\n * 判断 HTTP 方法是否可能携带请求体\n *\n * @param method - HTTP 方法字符串\n * @returns `true` 表示 POST / PUT / PATCH / DELETE\n */\nfunction hasBody(method: string): boolean {\n  return ['POST', 'PUT', 'PATCH', 'DELETE'].includes(method.toUpperCase())\n}\n\n/** 判断请求是否真实携带 body，避免空 POST 被误判为非法密文。 */\nfunction isRequestBodyEmpty(request: Request): boolean {\n  if (request.body === null)\n    return true\n\n  const contentLength = request.headers.get('Content-Length')\n  if (contentLength !== null)\n    return Number.parseInt(contentLength, 10) === 0\n\n  return false\n}\n\ninterface RequestHolder {\n  request: Request\n}\n\n/**\n * 重建 SvelteKit 事件中的 Request。\n *\n * `request.text()` 会消费 body；当请求不是加密载荷但允许明文透传时，必须把\n * 原始 body 放回去，避免后续端点再读取时得到空内容。\n *\n * @param event SvelteKit 请求事件\n * @param body 新请求体\n */\nfunction replaceRequestBody(event: RequestHolder, body: string): void {\n  const headers = new Headers(event.request.headers)\n  headers.delete(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER)\n  headers.delete('Content-Length')\n  headers.set('Content-Type', 'application/json; charset=utf-8')\n  const newRequest = new Request(event.request.url, {\n    method: event.request.method,\n    headers,\n    body,\n  })\n  Object.defineProperty(event, 'request', {\n    value: newRequest,\n    writable: true,\n    configurable: true,\n  })\n}\n\n/**\n * 尝试解密请求体。\n *\n * 非 JSON 请求体（例如 multipart/form-data 文件上传）无法承载传输加密 JSON\n * 载荷；在非强制加密模式下应原样透传，不读取 body，避免破坏浏览器生成的\n * multipart 边界。\n *\n * @param event SvelteKit 请求事件\n * @param manager 传输加密管理器\n * @param requireEncryption 是否强制要求请求加密\n * @returns 需要提前返回的错误响应；返回 null 表示继续后续中间件\n */\nasync function decryptRequestBody(\n  event: RequestHolder,\n  manager: TransportEncryptionManager,\n  requireEncryption: boolean,\n): Promise<Response | null> {\n  const isEncrypted = event.request.headers.get(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER)\n    === TRANSPORT_PROTOCOL.ENCRYPTED_HEADER_VALUE\n  if (!isEncrypted) {\n    if (!requireEncryption)\n      return null\n    return jsonError(kitM('kit_transportInvalidPayload'), 400)\n  }\n\n  const contentType = event.request.headers.get('Content-Type') ?? ''\n  if (!contentType.includes('application/json')) {\n    if (!requireEncryption) {\n      return null\n    }\n    return jsonError(kitM('kit_transportInvalidPayload'), 400)\n  }\n\n  const bodyText = await event.request.text()\n  if (!bodyText) {\n    return null\n  }\n\n  let payload: unknown\n  try {\n    payload = JSON.parse(bodyText) as unknown\n  }\n  catch {\n    if (!requireEncryption) {\n      replaceRequestBody(event, bodyText)\n      return null\n    }\n    return jsonError(kitM('kit_transportDecryptFailed'), 400)\n  }\n\n  if (!isEncryptedPayloadShape(payload)) {\n    if (!requireEncryption) {\n      replaceRequestBody(event, bodyText)\n      return null\n    }\n    return jsonError(kitM('kit_transportInvalidPayload'), 400)\n  }\n\n  const plaintext = manager.decryptRequest(payload)\n  if (!plaintext.success) {\n    return jsonError(kitM('kit_transportDecryptFailed'), 400)\n  }\n  replaceRequestBody(event, plaintext.data)\n  return null\n}\n\nfunction isEncryptedPayloadShape(payload: unknown): payload is EncryptedPayload {\n  if (!payload || typeof payload !== 'object')\n    return false\n  const p = payload as Record<string, unknown>\n  return typeof p.encryptedKey === 'string' && typeof p.ciphertext === 'string' && typeof p.iv === 'string'\n}\n"]}