@h-ai/kit 0.1.0-alpha.13 → 0.1.0-alpha.16

package/dist/index.js

@@ -1,9 +1,9 @@
-import { defineCrud } from './chunk-FRYJMRTP.js';
-export { defineCrud, resolveOptions, resolveText } from './chunk-FRYJMRTP.js';
-import { createHandleFetch, createTokenStore, clearBrowserToken, setBrowserToken, logout, registerAndLogin, loginWithApiKey, loginWithLdap, loginWithOtp, login, createKitClient, configureAuth, getAccessToken } from './chunk-GRYHRXVC.js';
+import { defineCrud } from './chunk-KJUUEH7I.js';
+export { KitConfigSchema, defineCrud, resolveKitConfig, resolveKitTransportConfig, resolveOptions, resolveText } from './chunk-KJUUEH7I.js';
+import { createTokenStore, clearBrowserToken, setBrowserToken, logout, registerAndLogin, loginWithApiKey, loginWithLdap, loginWithOtp, login, installBrowserTransportFetch, installBrowserTransport, createKitClient, configureAuth, getAccessToken } from './chunk-EMSCTFJJ.js';
 import { resolveA2AConfig, handleA2ARequest } from './chunk-475WECWK.js';
-import { transportEncryptionMiddleware } from './chunk-XTZUGWBY.js';
-import { kitM, setAllModulesLocale } from './chunk-BRZK7V5O.js';
+import { transportEncryptionMiddleware } from './chunk-BM7IP4W5.js';
+import { kitM, setAllModulesLocale } from './chunk-MI65L22O.js';
 import { core } from '@h-ai/core';
 import { z } from 'zod';
 
@@ -52,86 +52,6 @@ function requirePermission(session, permission) {
   }
 }
 
-// src/kit-response.ts
-function ok(data, requestId) {
-  const response = {
-    success: true,
-    data,
-    requestId
-  };
-  return new Response(JSON.stringify(response), {
-    status: 200,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-function created(data, requestId) {
-  const response = {
-    success: true,
-    data,
-    requestId
-  };
-  return new Response(JSON.stringify(response), {
-    status: 201,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-function noContent() {
-  return new Response(null, { status: 204 });
-}
-function error(code, message, status = 400, requestId, details) {
-  const response = {
-    success: false,
-    error: {
-      code,
-      message,
-      details
-    },
-    requestId
-  };
-  return new Response(JSON.stringify(response), {
-    status,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-function badRequest(message, requestId, details) {
-  return error("BAD_REQUEST", message, 400, requestId, details);
-}
-function unauthorized(message, requestId) {
-  return error("UNAUTHORIZED", message ?? kitM("kit_authRequired"), 401, requestId);
-}
-function forbidden(message, requestId) {
-  return error("FORBIDDEN", message ?? kitM("kit_accessDenied"), 403, requestId);
-}
-function notFound(message, requestId) {
-  return error("NOT_FOUND", message ?? kitM("kit_resourceNotFound"), 404, requestId);
-}
-function conflict(message, requestId) {
-  return error("CONFLICT", message, 409, requestId);
-}
-function validationError(errors, requestId) {
-  return error("VALIDATION_ERROR", kitM("kit_validationFailed"), 422, requestId, { errors });
-}
-function internalError(message, requestId) {
-  return error("INTERNAL_ERROR", message ?? kitM("kit_internalError"), 500, requestId);
-}
-function redirect(url, status = 302) {
-  return new Response(null, {
-    status,
-    headers: { Location: url }
-  });
-}
-function fromResult(result, httpStatusMap, requestId) {
-  if (result.success) {
-    return ok(result.data, requestId);
-  }
-  const { code, message } = result.error;
-  const status = httpStatusMap?.[code] ?? 400;
-  return error(String(code), message, status, requestId);
-}
-function fromError(haiError, requestId) {
-  return error(String(haiError.code), haiError.message, haiError.httpStatus ?? 400, requestId);
-}
-
 // src/kit-utils.ts
 function isResponseLike(value) {
   if (value instanceof Response)
@@ -150,63 +70,6 @@ function isSvelteKitControlFlow(value) {
   }
   return false;
 }
-
-// src/kit-handler.ts
-function handler(fn) {
-  return async (event) => {
-    try {
-      return await fn(event);
-    } catch (error2) {
-      if (isResponseLike(error2)) {
-        return error2;
-      }
-      if (isSvelteKitControlFlow(error2)) {
-        throw error2;
-      }
-      const normalizedError = error2 instanceof Error ? {
-        name: error2.name,
-        message: error2.message,
-        stack: error2.stack,
-        cause: error2.cause
-      } : error2;
-      core.logger.error("Request handler error", {
-        error: normalizedError,
-        path: event.url.pathname,
-        method: event.request.method
-      });
-      return internalError();
-    }
-  };
-}
-
-// src/kit-contract.ts
-function defineEndpoint(def) {
-  return def;
-}
-function fromContract(endpoint, fn) {
-  return handler(async (event) => {
-    let raw;
-    if (endpoint.method === "GET") {
-      raw = Object.fromEntries(event.url.searchParams);
-    } else {
-      try {
-        raw = await event.request.json();
-      } catch {
-        raw = {};
-      }
-    }
-    const parsed = endpoint.input.safeParse(raw);
-    if (!parsed.success) {
-      const errors = parsed.error.issues.map((issue) => ({
-        field: issue.path.join(".") || "_",
-        message: issue.message
-      }));
-      return validationError(errors);
-    }
-    const result = await fn(parsed.data, event);
-    return ok(result);
-  });
-}
 function loggingMiddleware(config = {}) {
   const { logBody = false, logResponse = false, redactFields = ["password", "token", "secret", "authorization", "apikey", "api_key", "creditcard", "credit_card"] } = config;
   return async (context, next) => {
@@ -293,6 +156,18 @@ var MemoryRateLimitStore = class {
       this.cleanupTimer.unref();
     }
   }
+  /**
+   * 停止定期清理并释放定时器资源
+   *
+   * 调用后可再次 startCleanup 重启。进程退出 / 热重载 / 测试拆装场景必须调用以
+   * 避免资源泄漏。
+   */
+  stopCleanup() {
+    if (this.cleanupTimer) {
+      clearInterval(this.cleanupTimer);
+      this.cleanupTimer = null;
+    }
+  }
   get(key) {
     return this.store.get(key);
   }
@@ -450,6 +325,11 @@ function generateId(prefix) {
   const random = crypto.randomUUID().replace(/-/g, "").substring(0, 8);
   return `${prefix}_${timestamp}${random}`;
 }
+function applyDefaultSecurityHeaders(response) {
+  response.headers.set("X-Content-Type-Options", "nosniff");
+  response.headers.set("X-Frame-Options", "DENY");
+  response.headers.set("Referrer-Policy", "no-referrer");
+}
 function createHandle(config = {}) {
   const {
     auth: authConfig,
@@ -486,10 +366,14 @@ function createHandle(config = {}) {
     }));
   }
   const allMiddleware = [...builtinMiddleware, ...customMiddleware];
-  const finalMiddleware = buildTransportMiddleware(allMiddleware, cryptoConfig);
+  const transportMiddleware = buildTransportMiddleware(cryptoConfig);
   const cookieProxyConfig = buildCookieProxyConfig(cryptoConfig);
   return async ({ event, resolve }) => {
     const requestId = generateId("req");
+    const context = {
+      event,
+      requestId
+    };
     const locals = event.locals;
     locals.requestId = requestId;
     if (cookieProxyConfig) {
@@ -500,83 +384,84 @@ function createHandle(config = {}) {
         configurable: true
       });
     }
-    try {
-      if (a2aResolved) {
-        const a2aResponse = await handleA2ARequest(event, requestId, a2aResolved);
-        if (a2aResponse)
-          return a2aResponse;
-      }
-      let session;
-      if (authConfig) {
-        const token = getAccessToken(event.request, event.cookies);
-        if (token) {
-          session = await authConfig.verifyToken(token) ?? void 0;
-          locals.session = session;
-          if (session) {
-            locals.accessToken = token;
-          }
+    const runRequest = async () => {
+      try {
+        if (a2aResolved) {
+          const a2aResponse = await handleA2ARequest(event, requestId, a2aResolved);
+          if (a2aResponse)
+            return a2aResponse;
         }
-      }
-      for (const guardConfig of guards) {
-        const guardResult = await executeGuard(guardConfig, event, session);
-        if (!guardResult.allowed) {
-          if (guardResult.redirect) {
-            return new Response(null, {
-              status: 302,
-              headers: { Location: guardResult.redirect }
-            });
+        let session;
+        if (authConfig) {
+          const token = getAccessToken(event.request, event.cookies);
+          if (token) {
+            session = await authConfig.verifyToken(token) ?? void 0;
+            locals.session = session;
+            if (session) {
+              locals.accessToken = token;
+            }
           }
-          return new Response(
-            JSON.stringify({
-              success: false,
-              error: {
-                code: "FORBIDDEN",
-                message: guardResult.message ?? kitM("kit_accessDenied")
-              },
-              requestId
-            }),
-            {
-              status: guardResult.status ?? 403,
-              headers: { "Content-Type": "application/json" }
+        }
+        context.session = session;
+        for (const guardConfig of guards) {
+          const guardResult = await executeGuard(guardConfig, event, session);
+          if (!guardResult.allowed) {
+            if (guardResult.redirect) {
+              return new Response(null, {
+                status: 302,
+                headers: { Location: guardResult.redirect }
+              });
             }
-          );
+            return new Response(
+              JSON.stringify({
+                success: false,
+                error: {
+                  code: "FORBIDDEN",
+                  message: guardResult.message ?? kitM("kit_accessDenied")
+                },
+                requestId
+              }),
+              {
+                status: guardResult.status ?? 403,
+                headers: { "Content-Type": "application/json" }
+              }
+            );
+          }
         }
-      }
-      const context = {
-        event,
-        session,
-        requestId
-      };
-      const response = await executeMiddlewareChain(
-        finalMiddleware,
-        context,
-        () => resolve(event)
-      );
-      response.headers.set("X-Request-Id", requestId);
-      return response;
-    } catch (error2) {
-      if (isSvelteKitControlFlow(error2)) {
-        throw error2;
-      }
-      core.logger.error("Request failed", { requestId, error: error2 instanceof Error ? error2.message : error2 });
-      if (onError) {
-        return onError(error2, event);
-      }
-      return new Response(
-        JSON.stringify({
-          success: false,
-          error: {
-            code: "INTERNAL_ERROR",
-            message: kitM("kit_internalError")
-          },
-          requestId
-        }),
-        {
-          status: 500,
-          headers: { "Content-Type": "application/json" }
+        const response2 = await executeMiddlewareChain(
+          allMiddleware,
+          context,
+          () => resolve(event)
+        );
+        return response2;
+      } catch (error2) {
+        if (isSvelteKitControlFlow(error2)) {
+          throw error2;
         }
-      );
-    }
+        core.logger.error("Request failed", { requestId, error: error2 instanceof Error ? error2.message : error2 });
+        if (onError) {
+          return onError(error2, event);
+        }
+        return new Response(
+          JSON.stringify({
+            success: false,
+            error: {
+              code: "INTERNAL_ERROR",
+              message: kitM("kit_internalError")
+            },
+            requestId
+          }),
+          {
+            status: 500,
+            headers: { "Content-Type": "application/json" }
+          }
+        );
+      }
+    };
+    const response = transportMiddleware ? await transportMiddleware(context, runRequest) : await runRequest();
+    applyDefaultSecurityHeaders(response);
+    response.headers.set("X-Request-Id", requestId);
+    return response;
   };
 }
 function buildAuthGuard(verifyToken, loginUrl) {
@@ -635,19 +520,19 @@ function matchPath(pathname, pattern) {
   }
   return pathname === pattern;
 }
-function buildTransportMiddleware(userMiddleware, cryptoConfig) {
+function buildTransportMiddleware(cryptoConfig) {
   if (!cryptoConfig?.transport)
-    return userMiddleware;
+    return null;
   const transportOpts = typeof cryptoConfig.transport === "object" ? cryptoConfig.transport : {};
-  const transportMw = transportEncryptionMiddleware({
+  return transportEncryptionMiddleware({
     enabled: true,
     crypto: cryptoConfig.crypto,
     keyExchangePath: transportOpts.keyExchangePath,
     excludePaths: transportOpts.excludePaths,
     encryptResponse: transportOpts.encryptResponse,
+    maxClients: transportOpts.maxClients,
     requireEncryption: transportOpts.requireEncryption
   });
-  return [transportMw, ...userMiddleware];
 }
 function buildCookieProxyConfig(cryptoConfig) {
   if (!cryptoConfig?.encryptedCookies?.length)
@@ -678,22 +563,136 @@ function sequence(...handles) {
     )(event);
   };
 }
-function extractZodIssues(error2) {
-  const zodError = error2;
-  return zodError.issues ?? zodError.errors ?? [];
+
+// src/kit-response.ts
+function ok(data, requestId) {
+  const response = {
+    success: true,
+    data,
+    requestId
+  };
+  return new Response(JSON.stringify(response), {
+    status: 200,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function created(data, requestId) {
+  const response = {
+    success: true,
+    data,
+    requestId
+  };
+  return new Response(JSON.stringify(response), {
+    status: 201,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function noContent() {
+  return new Response(null, { status: 204 });
+}
+function error(code, message, status = 400, requestId, details) {
+  const response = {
+    success: false,
+    error: {
+      code,
+      message,
+      details
+    },
+    requestId
+  };
+  return new Response(JSON.stringify(response), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function badRequest(message, requestId, details) {
+  return error("BAD_REQUEST", message, 400, requestId, details);
+}
+function unauthorized(message, requestId) {
+  return error("UNAUTHORIZED", message ?? kitM("kit_authRequired"), 401, requestId);
+}
+function forbidden(message, requestId) {
+  return error("FORBIDDEN", message ?? kitM("kit_accessDenied"), 403, requestId);
+}
+function notFound(message, requestId) {
+  return error("NOT_FOUND", message ?? kitM("kit_resourceNotFound"), 404, requestId);
+}
+function conflict(message, requestId) {
+  return error("CONFLICT", message, 409, requestId);
+}
+function validationError(errors, requestId) {
+  return error("VALIDATION_ERROR", kitM("kit_validationFailed"), 422, requestId, { errors });
+}
+function internalError(message, requestId) {
+  return error("INTERNAL_ERROR", message ?? kitM("kit_internalError"), 500, requestId);
+}
+function redirect(url, status = 302) {
+  return new Response(null, {
+    status,
+    headers: { Location: url }
+  });
 }
-function zodIssuesToFormErrors(issues) {
-  return issues.map((issue) => ({
-    field: issue.path.join("."),
-    message: issue.message
-  }));
+function fromResult(result, httpStatusMap, requestId) {
+  if (result.success) {
+    return ok(result.data, requestId);
+  }
+  const { code, message } = result.error;
+  const status = httpStatusMap?.[code] ?? 400;
+  return error(String(code), message, status, requestId);
+}
+function fromError(haiError, requestId) {
+  return error(String(haiError.code), haiError.message, haiError.httpStatus ?? 400, requestId);
+}
+
+// src/kit-handler.ts
+function handler(fn) {
+  return async (event) => {
+    try {
+      return await fn(event);
+    } catch (error2) {
+      if (isResponseLike(error2)) {
+        return error2;
+      }
+      if (isSvelteKitControlFlow(error2)) {
+        throw error2;
+      }
+      const normalizedError = error2 instanceof Error ? {
+        name: error2.name,
+        message: error2.message,
+        stack: error2.stack,
+        cause: error2.cause
+      } : error2;
+      core.logger.error("Request handler error", {
+        error: normalizedError,
+        path: event.url.pathname,
+        method: event.request.method
+      });
+      return internalError();
+    }
+  };
 }
-function createValidationResult(error2) {
+var getKitZodMessage = core.zodValidation.createPrefixedZodMessageGetter(
+  "kit",
+  (messageKey, params) => kitM(messageKey, { params })
+);
+function validateParsedData(data, schema) {
+  const result = schema.safeParse(data);
+  if (result.success)
+    return { valid: true, data: result.data, errors: [] };
   return {
     valid: false,
-    errors: zodIssuesToFormErrors(extractZodIssues(error2))
+    errors: core.zodValidation.mapZodErrorToFormErrors(result.error, getKitZodMessage)
   };
 }
+function unwrapValidationResultOrThrow(result) {
+  if (result.valid && result.data !== void 0)
+    return result.data;
+  throw badRequest(
+    result.errors[0]?.message ?? kitM("kit_validationFailed"),
+    void 0,
+    { errors: result.errors }
+  );
+}
 async function validateForm(request, schema) {
   try {
     const contentType = request.headers.get("content-type") ?? "";
@@ -709,11 +708,7 @@ async function validateForm(request, schema) {
         errors: [{ field: "_", message: kitM("kit_unsupportedContentType") }]
       };
     }
-    const result = schema.safeParse(data);
-    if (result.success) {
-      return { valid: true, data: result.data, errors: [] };
-    }
-    return createValidationResult(result.error);
+    return validateParsedData(data, schema);
   } catch {
     return {
       valid: false,
@@ -723,51 +718,19 @@ async function validateForm(request, schema) {
 }
 function validateQuery(url, schema) {
   const data = Object.fromEntries(url.searchParams);
-  const result = schema.safeParse(data);
-  if (result.success) {
-    return { valid: true, data: result.data, errors: [] };
-  }
-  return createValidationResult(result.error);
+  return validateParsedData(data, schema);
 }
 function validateParams(params, schema) {
-  const result = schema.safeParse(params);
-  if (result.success) {
-    return { valid: true, data: result.data, errors: [] };
-  }
-  return createValidationResult(result.error);
+  return validateParsedData(params, schema);
 }
 async function validateFormOrFail(request, schema) {
-  const result = await validateForm(request, schema);
-  if (!result.valid || !result.data) {
-    throw badRequest(
-      result.errors[0]?.message ?? kitM("kit_validationFailed"),
-      void 0,
-      { errors: result.errors }
-    );
-  }
-  return result.data;
+  return unwrapValidationResultOrThrow(await validateForm(request, schema));
 }
 function validateQueryOrFail(url, schema) {
-  const result = validateQuery(url, schema);
-  if (!result.valid || !result.data) {
-    throw badRequest(
-      result.errors[0]?.message ?? kitM("kit_validationFailed"),
-      void 0,
-      { errors: result.errors }
-    );
-  }
-  return result.data;
+  return unwrapValidationResultOrThrow(validateQuery(url, schema));
 }
 function validateParamsOrFail(params, schema) {
-  const result = validateParams(params, schema);
-  if (!result.valid || !result.data) {
-    throw badRequest(
-      result.errors[0]?.message ?? kitM("kit_validationFailed"),
-      void 0,
-      { errors: result.errors }
-    );
-  }
-  return result.data;
+  return unwrapValidationResultOrThrow(validateParams(params, schema));
 }
 var IdParamSchema = z.object({
   id: z.string().min(1, kitM("kit_idRequired"))
@@ -788,8 +751,6 @@ var kit = {
   sequence,
   /** API Handler 包装器（自动错误边界） */
   handler,
-  /** 基于 API 契约创建类型安全的路由 handler */
-  fromContract,
   // ─── 路由守卫 ───
   guard: {
     /** 要求权限，不满足时 throw Response（SvelteKit 控制流） */
@@ -844,7 +805,14 @@ var kit = {
   // ─── 客户端工具 ───
   client: {
     /** 创建统一客户端（CSRF + 传输加密透明合并） */
-    create: createKitClient
+    create: createKitClient,
+    /**
+     * 用解析后的 {@link KitConfig} 一键安装浏览器端传输加密
+     * （应用层推荐入口；内部预热 crypto 并调用 installBrowserTransportFetch）
+     */
+    installBrowserTransport,
+    /** 底层入口：直接传 transport 配置安装浏览器全局 fetch 包装 */
+    installBrowserTransportFetch
   },
   // ─── 认证工具 ───
   auth: {
@@ -865,9 +833,7 @@ var kit = {
     /** 清除浏览器端 Access Token（客户端 logout 用） */
     clearBrowserToken,
     /** 创建浏览器端 Token 存储器（自定义 key 时使用） */
-    createTokenStore,
-    /** 创建浏览器端同源请求自动附加 Authorization 的 HandleFetch */
-    createHandleFetch
+    createTokenStore
   },
   // ─── CRUD ───
   crud: {
@@ -881,6 +847,6 @@ var kit = {
   }
 };
 
-export { IdParamSchema, PaginationQuerySchema, defineEndpoint, kit, matchPermission };
+export { IdParamSchema, PaginationQuerySchema, kit, matchPermission };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map