@h-ai/kit 0.1.0-alpha.13 → 0.1.0-alpha.16

package/dist/chunk-GRYHRXVC.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/kit-auth.ts","../src/client/kit-client.ts"],"names":["fetch","response"],"mappings":";;;AAeA,IAAM,yBAAA,GAA4B,kBAAA;AAOlC,IAAM,SAAA,GAAY;AAAA,EAChB,UAAA,EAAY,yBAAA;AAAA,EACZ,UAAA,EAAY;AACd,CAAA;AAOO,SAAS,cAAc,MAAA,EAA4E;AACxG,EAAA,IAAI,MAAA,CAAO,UAAA;AACT,IAAA,SAAA,CAAU,aAAa,MAAA,CAAO,UAAA;AAChC,EAAA,IAAI,MAAA,CAAO,UAAA;AACT,IAAA,SAAA,CAAU,aAAa,MAAA,CAAO,UAAA;AAClC;AA+BA,IAAM,2BAA2B,gBAAA,EAAiB;AAO3C,SAAS,0BAA0B,OAAA,EAAiC;AACzE,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACzD,EAAA,IAAI,CAAC,aAAA;AACH,IAAA,OAAO,IAAA;AAET,EAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,aAAA,CAAc,MAAM,GAAG,CAAA;AAC/C,EAAA,IAAI,CAAC,UAAU,CAAC,KAAA;AACd,IAAA,OAAO,IAAA;AAET,EAAA,IAAI,MAAA,CAAO,aAAY,KAAM,QAAA;AAC3B,IAAA,OAAO,IAAA;AAET,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,EAAK;AAC3B,EAAA,OAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,GAAI,OAAA,GAAU,IAAA;AACxC;AAKO,SAAS,cAAA,CAAe,SAAkB,OAAA,EAAuC;AACtF,EAAA,OAAO,0BAA0B,OAAO,CAAA,IAAK,SAAS,GAAA,CAAI,SAAA,CAAU,UAAU,CAAA,IAAK,IAAA;AACrF;AAOA,SAAS,QAAA,CAAS,OAAA,EAAuB,KAAA,EAAe,MAAA,EAAuB;AAC7E,EAAA,OAAA,CAAQ,GAAA,CAAI,SAAA,CAAU,UAAA,EAAY,KAAA,EAAO;AAAA,IACvC,IAAA,EAAM,GAAA;AAAA,IACN,QAAA,EAAU,IAAA;AAAA,IACV,QAAA,EAAU,KAAA;AAAA,IACV,MAAA,EAAQ,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,YAAA;AAAA,IACjC;AAAA,GACD,CAAA;AACH;AAKA,SAAS,WAAW,OAAA,EAA6B;AAC/C,EAAA,OAAA,CAAQ,OAAO,SAAA,CAAU,UAAA,EAAY,EAAE,IAAA,EAAM,KAAK,CAAA;AACpD;AAOA,SAAS,iBAAA,GAAoC;AAC3C,EAAA,IAAI,CAAC,UAAU,UAAA,EAAY;AACzB,IAAA,MAAM,IAAI,KAAA,CAAM,IAAA,CAAK,uBAAuB,CAAC,CAAA;AAAA,EAC/C;AACA,EAAA,OAAO,OAAO,SAAA,CAAU,UAAA,KAAe,aACnC,SAAA,CAAU,UAAA,KACV,SAAA,CAAU,UAAA;AAChB;AAKA,eAAe,YAAA,CACb,SACA,WAAA,EACgC;AAChC,EAAA,MAAM,SAAS,MAAM,WAAA;AACrB,EAAA,IAAI,OAAO,OAAA,EAAS;AAClB,IAAA,QAAA,CAAS,OAAA,EAAS,OAAO,IAAA,CAAK,MAAA,CAAO,aAAa,MAAA,CAAO,IAAA,CAAK,OAAO,SAAS,CAAA;AAAA,EAChF;AACA,EAAA,OAAO,MAAA;AACT;AAgBA,eAAsB,KAAA,CACpB,SACA,WAAA,EACgC;AAChC,EAAA,OAAO,aAAa,OAAA,EAAS,iBAAA,EAAkB,CAAE,KAAA,CAAM,WAAW,CAAC,CAAA;AACrE;AAcA,eAAsB,YAAA,CACpB,SACA,WAAA,EACgC;AAChC,EAAA,OAAO,aAAa,OAAA,EAAS,iBAAA,EAAkB,CAAE,YAAA,CAAa,WAAW,CAAC,CAAA;AAC5E;AAcA,eAAsB,aAAA,CACpB,SACA,WAAA,EACgC;AAChC,EAAA,OAAO,aAAa,OAAA,EAAS,iBAAA,EAAkB,CAAE,aAAA,CAAc,WAAW,CAAC,CAAA;AAC7E;AAeA,eAAsB,eAAA,CACpB,SACA,WAAA,EACgC;AAChC,EAAA,OAAO,aAAa,OAAA,EAAS,iBAAA,EAAkB,CAAE,eAAA,CAAgB,WAAW,CAAC,CAAA;AAC/E;AAcA,eAAsB,gBAAA,CACpB,SACA,OAAA,EACgC;AAChC,EAAA,OAAO,aAAa,OAAA,EAAS,iBAAA,EAAkB,CAAE,gBAAA,CAAiB,OAAO,CAAC,CAAA;AAC5E;AAcA,eAAsB,MAAA,CACpB,SACA,WAAA,EACe;AACf,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,MAAM,iBAAA,EAAkB,CAAE,MAAA,CAAO,WAAW,CAAA;AAAA,EAC9C;AACA,EAAA,UAAA,CAAW,OAAO,CAAA;AACpB;AASO,SAAS,gBAAA,CAAiB,MAAM,yBAAA,EAA8C;AACnF,EAAA,OAAO;AAAA,IACL,GAAA,GAAqB;AACnB,MAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,QAAA,OAAO,IAAA;AAAA,MACT;AACA,MAAA,OAAO,MAAA,CAAO,YAAA,CAAa,OAAA,CAAQ,GAAG,CAAA;AAAA,IACxC,CAAA;AAAA,IACA,IAAI,KAAA,EAAqB;AACvB,MAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,QAAA;AAAA,MACF;AACA,MAAA,MAAA,CAAO,YAAA,CAAa,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAA;AAAA,IACxC,CAAA;AAAA,IACA,KAAA,GAAc;AACZ,MAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,QAAA;AAAA,MACF;AACA,MAAA,MAAA,CAAO,YAAA,CAAa,WAAW,GAAG,CAAA;AAAA,IACpC;AAAA,GACF;AACF;AAKO,SAAS,gBAAgB,KAAA,EAAqB;AACnD,EAAA,wBAAA,CAAyB,IAAI,KAAK,CAAA;AACpC;AAKO,SAAS,iBAAA,GAA0B;AACxC,EAAA,wBAAA,CAAyB,KAAA,EAAM;AACjC;AAOO,SAAS,iBAAA,CAAkB,UAAA,GAAgC,gBAAA,EAAiB,EAAgB;AACjG,EAAA,OAAO,OAAO,EAAE,KAAA,EAAO,OAAA,EAAS,KAAA,EAAAA,QAAM,KAAM;AAC1C,IAAA,MAAM,UAAA,GAAa,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AACtC,IAAA,IAAI,UAAA,CAAW,MAAA,KAAW,KAAA,CAAM,GAAA,CAAI,MAAA;AAClC,MAAA,OAAOA,OAAM,OAAO,CAAA;AAEtB,IAAA,MAAM,KAAA,GAAQ,WAAW,GAAA,EAAI;AAC7B,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAOA,OAAM,OAAO,CAAA;AAEtB,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA;AAC3C,IAAA,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,KAAK,CAAA,CAAE,CAAA;AAE9C,IAAA,OAAOA,OAAM,IAAI,OAAA,CAAQ,SAAS,EAAE,OAAA,EAAS,CAAC,CAAA;AAAA,EAChD,CAAA;AACF;;;ACtQA,SAAS,UAAU,IAAA,EAAkC;AACnD,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,OAAO,MAAA;AACT,EAAA,MAAM,KAAA,GAAQ,SAAS,MAAA,CAAO,KAAA,CAAM,IAAI,MAAA,CAAO,CAAA,WAAA,EAAc,IAAI,CAAA,QAAA,CAAU,CAAC,CAAA;AAC5E,EAAA,OAAO,QAAQ,CAAC,CAAA;AAClB;AAsBO,SAAS,eAAA,CAAgB,MAAA,GAA0B,EAAC,EAAc;AACvE,EAAA,MAAM;AAAA,IACJ,SAAA,EAAW,eAAA;AAAA,IACX,cAAA,GAAiB,UAAA;AAAA,IACjB,cAAA,GAAiB,cAAA;AAAA,IACjB,IAAA,EAAM;AAAA,GACR,GAAI,MAAA;AAGJ,EAAA,MAAM,YAAsC,UAAA,GACvC,UAAA,KAAe,IAAA,GAAO,gBAAA,KAAqB,UAAA,GAC5C,IAAA;AAGJ,EAAA,IAAI,cAAA,GAAiB,KAAA;AACrB,EAAA,IAAI,aAAA,GAAyC,IAAA;AAC7C,EAAA,IAAI,eAAA,GAAiC,IAAA;AACrC,EAAA,IAAI,QAAA,GAA0B,IAAA;AAE9B,EAAA,IAAI,WAAA,GAAoC,IAAA;AAKxC,EAAA,eAAe,aAAA,GAA+B;AAC5C,IAAA,IAAI,CAAC,eAAA;AACH,MAAA;AAEF,IAAA,MAAM,EAAE,MAAA,EAAQ,aAAA,EAAe,cAAA,GAAiB,yBAAwB,GAAI,eAAA;AAG5E,IAAA,MAAM,aAAA,GAAgB,aAAA,CAAc,UAAA,CAAW,eAAA,EAAgB;AAC/D,IAAA,IAAI,CAAC,aAAA,CAAc,OAAA,IAAW,CAAC,cAAc,IAAA,EAAM;AACjD,MAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,IACtD;AACA,IAAA,aAAA,GAAgB,aAAA,CAAc,IAAA;AAG9B,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,cAAA,EAAgB;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,eAAA,EAAiB,aAAA,CAAc,WAAW;AAAA,KAClE,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qBAAA,EAAwB,QAAA,CAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IAC3D;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,IAAI,CAAC,IAAA,CAAK,eAAA,IAAmB,CAAC,KAAK,QAAA,EAAU;AAC3C,MAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,IACjD;AAEA,IAAA,eAAA,GAAkB,IAAA,CAAK,eAAA;AACvB,IAAA,QAAA,GAAW,IAAA,CAAK,QAAA;AAChB,IAAA,cAAA,GAAiB,IAAA;AAAA,EACnB;AAKA,EAAA,eAAe,oBAAA,GAAsC;AACnD,IAAA,IAAI,cAAA;AACF,MAAA;AACF,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,WAAA,GAAc,aAAA,EAAc,CAAE,OAAA,CAAQ,MAAM;AAC1C,QAAA,WAAA,GAAc,IAAA;AAAA,MAChB,CAAC,CAAA;AAAA,IACH;AACA,IAAA,MAAM,WAAA;AAAA,EACR;AAKA,EAAA,SAAS,YAAY,QAAA,EAA0B;AAC7C,IAAA,IAAI,CAAC,mBAAmB,CAAC,eAAA;AACvB,MAAA,OAAO,QAAA;AAET,IAAA,MAAM,EAAE,MAAA,EAAQ,aAAA,EAAc,GAAI,eAAA;AAGlC,IAAA,MAAM,YAAA,GAAe,aAAA,CAAc,SAAA,CAAU,WAAA,EAAY;AAGzD,IAAA,MAAM,SAAA,GAAY,aAAA,CAAc,SAAA,CAAU,aAAA,CAAc,UAAU,YAAY,CAAA;AAC9E,IAAA,IAAI,CAAC,SAAA,CAAU,OAAA,IAAW,CAAC,UAAU,IAAA,EAAM;AACzC,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AAGA,IAAA,MAAM,YAAA,GAAe,aAAA,CAAc,UAAA,CAAW,OAAA,CAAQ,cAAc,eAAe,CAAA;AACnF,IAAA,IAAI,CAAC,YAAA,CAAa,OAAA,IAAW,CAAC,aAAa,IAAA,EAAM;AAC/C,MAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,IACnD;AAEA,IAAA,MAAM,OAAA,GAA4B;AAAA,MAChC,cAAc,YAAA,CAAa,IAAA;AAAA,MAC3B,UAAA,EAAY,UAAU,IAAA,CAAK,UAAA;AAAA,MAC3B,EAAA,EAAI,UAAU,IAAA,CAAK;AAAA,KACrB;AAEA,IAAA,OAAO,IAAA,CAAK,UAAU,OAAO,CAAA;AAAA,EAC/B;AAKA,EAAA,eAAe,gBAAgB,QAAA,EAAuC;AACpE,IAAA,IAAI,CAAC,iBAAiB,CAAC,eAAA;AACrB,MAAA,OAAO,QAAA;AAET,IAAA,MAAM,aAAA,GAAgB,MAAM,QAAA,CAAS,IAAA,EAAK;AAC1C,IAAA,IAAI,CAAC,wBAAwB,aAAa,CAAA;AACxC,MAAA,OAAO,QAAA;AAET,IAAA,MAAM,EAAE,MAAA,EAAQ,aAAA,EAAc,GAAI,eAAA;AAGlC,IAAA,MAAM,eAAe,aAAA,CAAc,UAAA,CAAW,QAAQ,aAAA,CAAc,YAAA,EAAc,cAAc,UAAU,CAAA;AAC1G,IAAA,IAAI,CAAC,YAAA,CAAa,OAAA,IAAW,CAAC,aAAa,IAAA,EAAM;AAC/C,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AAGA,IAAA,MAAM,SAAA,GAAY,cAAc,SAAA,CAAU,aAAA,CAAc,cAAc,UAAA,EAAY,YAAA,CAAa,IAAA,EAAM,aAAA,CAAc,EAAE,CAAA;AACrH,IAAA,IAAI,CAAC,SAAA,CAAU,OAAA,IAAW,OAAO,SAAA,CAAU,SAAS,QAAA,EAAU;AAC5D,MAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,IACnD;AAEA,IAAA,OAAO,IAAI,QAAA,CAAS,SAAA,CAAU,IAAA,EAAM;AAAA,MAClC,QAAQ,QAAA,CAAS,MAAA;AAAA,MACjB,YAAY,QAAA,CAAS,UAAA;AAAA,MACrB,SAAS,QAAA,CAAS;AAAA,KACnB,CAAA;AAAA,EACH;AAKA,EAAA,eAAe,QAAA,CAAS,GAAA,EAAa,IAAA,GAAoB,EAAC,EAAsB;AAC9E,IAAA,MAAM,MAAA,GAAA,CAAU,IAAA,CAAK,MAAA,IAAU,KAAA,EAAO,WAAA,EAAY;AAClD,IAAA,MAAM,aAAA,GAAgB,CAAC,CAAC,KAAA,EAAO,QAAQ,SAAS,CAAA,CAAE,SAAS,MAAM,CAAA;AAEjE,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA;AAGxC,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,MAAM,KAAA,GAAQ,UAAU,GAAA,EAAI;AAC5B,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,KAAK,CAAA,CAAE,CAAA;AAAA,MAChD;AAAA,IACF;AAGA,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,MAAM,SAAA,GAAY,UAAU,cAAc,CAAA;AAC1C,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,OAAA,CAAQ,GAAA,CAAI,gBAAgB,SAAS,CAAA;AAAA,MACvC;AAAA,IACF;AAGA,IAAA,IAAI,eAAA,EAAiB;AACnB,MAAA,MAAM,oBAAA,EAAqB;AAE3B,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,OAAA,CAAQ,GAAA,CAAI,eAAe,QAAQ,CAAA;AAAA,MACrC;AAGA,MAAA,IAAI,IAAA,CAAK,IAAA,KAAS,MAAA,IAAa,IAAA,CAAK,SAAS,IAAA,EAAM;AACjD,QAAA,MAAM,QAAA,GAAW,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,GAAW,KAAK,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AACrF,QAAA,MAAM,SAAA,GAAY,YAAY,QAAQ,CAAA;AACtC,QAAA,OAAA,CAAQ,GAAA,CAAI,gBAAgB,kBAAkB,CAAA;AAE9C,QAAA,IAAIC,SAAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAW,CAAA;AAGrE,QAAA,IAAIA,SAAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,MAAM,MAAA,EAAQ;AAClD,UAAAA,SAAAA,GAAW,MAAM,eAAA,CAAgBA,SAAQ,CAAA;AAAA,QAC3C;AAEA,QAAA,OAAOA,SAAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,SAAS,CAAA;AAGpD,IAAA,IAAI,mBAAmB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,MAAM,MAAA,EAAQ;AACrE,MAAA,QAAA,GAAW,MAAM,gBAAgB,QAAQ,CAAA;AAAA,IAC3C;AAEA,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,IAAI,KAAA,GAAQ;AAAE,MAAA,OAAO,CAAC,eAAA,IAAmB,cAAA;AAAA,IAAe,CAAA;AAAA,IACxD,MAAM,IAAA,GAAO;AACX,MAAA,IAAI,eAAA;AACF,QAAA,MAAM,oBAAA,EAAqB;AAAA,IAC/B,CAAA;AAAA,IACA,OAAA,GAAU;AACR,MAAA,aAAA,GAAgB,IAAA;AAChB,MAAA,eAAA,GAAkB,IAAA;AAClB,MAAA,QAAA,GAAW,IAAA;AACX,MAAA,cAAA,GAAiB,KAAA;AACjB,MAAA,WAAA,GAAc,IAAA;AAAA,IAChB;AAAA,GACF;AACF","file":"chunk-GRYHRXVC.js","sourcesContent":["/**\n * @h-ai/kit — Bearer 认证工具\n *\n * 提供服务端认证 Cookie 管理（login / logout）与浏览器端 Token 存储工具。\n * @module kit-auth\n */\n\nimport type { HaiResult } from '@h-ai/core'\nimport type { ApiKeyCredentials, AuthResult, LdapCredentials, OtpCredentials, PasswordCredentials, RegisterOptions } from '@h-ai/iam'\nimport type { HandleFetch } from '@sveltejs/kit'\nimport type { AuthOperations, AuthOperationsProvider } from './kit-types.js'\nimport process from 'node:process'\nimport { kitM } from './kit-i18n.js'\n\n/** 默认 Token Cookie 名 */\nconst DEFAULT_TOKEN_COOKIE_NAME = 'hai_access_token'\n\n/**\n * 应用级认证配置（由 createHandle 一次性初始化，生命周期同进程）\n *\n * 此状态非请求级：仅在 createHandle() 时写入一次，后续所有请求只读访问。\n */\nconst authState = {\n  cookieName: DEFAULT_TOKEN_COOKIE_NAME,\n  operations: null as AuthOperationsProvider | null,\n}\n\n/**\n * 配置认证参数\n *\n * 通常由 `createHandle` 在初始化时自动调用，无需手动调用。\n */\nexport function configureAuth(config: { cookieName?: string, operations?: AuthOperationsProvider }): void {\n  if (config.cookieName)\n    authState.cookieName = config.cookieName\n  if (config.operations)\n    authState.operations = config.operations\n}\n\n/**\n * 获取当前配置的 Token Cookie 名\n */\nexport function getTokenCookieName(): string {\n  return authState.cookieName\n}\n\ninterface CookieReader {\n  get: (name: string) => string | undefined\n}\n\ninterface CookieWriter {\n  set: (name: string, value: string, options: {\n    path: string\n    httpOnly: boolean\n    sameSite: 'lax' | 'strict' | 'none'\n    secure: boolean\n    maxAge?: number\n  }) => void\n  delete: (name: string, options: { path: string }) => void\n}\n\n/** 浏览器 Token 存储器 */\nexport interface BrowserTokenStore {\n  get: () => string | null\n  set: (token: string) => void\n  clear: () => void\n}\n\nconst defaultBrowserTokenStore = createTokenStore()\n\n// ─── 内部工具（仅 kit 包内使用） ───\n\n/**\n * 从请求 Authorization 头提取 Bearer Token。\n */\nexport function getBearerTokenFromRequest(request: Request): string | null {\n  const authorization = request.headers.get('authorization')\n  if (!authorization)\n    return null\n\n  const [scheme, token] = authorization.split(' ')\n  if (!scheme || !token)\n    return null\n\n  if (scheme.toLowerCase() !== 'bearer')\n    return null\n\n  const trimmed = token.trim()\n  return trimmed.length > 0 ? trimmed : null\n}\n\n/**\n * 从请求中统一提取 Access Token（Bearer 优先，其次配置的 Cookie 名）。\n */\nexport function getAccessToken(request: Request, cookies?: CookieReader): string | null {\n  return getBearerTokenFromRequest(request) ?? cookies?.get(authState.cookieName) ?? null\n}\n\n// ─── 服务端认证 Cookie 管理 ───\n\n/**\n * 写入 Access Token Cookie（内部使用，由 login 自动调用）。\n */\nfunction setToken(cookies: CookieWriter, token: string, maxAge?: number): void {\n  cookies.set(authState.cookieName, token, {\n    path: '/',\n    httpOnly: true,\n    sameSite: 'lax',\n    secure: process.env.NODE_ENV === 'production',\n    maxAge,\n  })\n}\n\n/**\n * 清除 Access Token Cookie（内部使用，由 logout 自动调用）。\n */\nfunction clearToken(cookies: CookieWriter): void {\n  cookies.delete(authState.cookieName, { path: '/' })\n}\n\n// ─── 服务端高级认证 API（通过 kit.auth 暴露） ───\n\n/**\n * 获取已注入的认证操作（未配置时抛出编程错误）\n */\nfunction getAuthOperations(): AuthOperations {\n  if (!authState.operations) {\n    throw new Error(kitM('kit_authNotConfigured'))\n  }\n  return typeof authState.operations === 'function'\n    ? authState.operations()\n    : authState.operations\n}\n\n/**\n * 内部工具：执行认证操作并在成功时写入 Token Cookie。\n */\nasync function executeLogin(\n  cookies: CookieWriter,\n  authPromise: Promise<HaiResult<AuthResult>>,\n): Promise<HaiResult<AuthResult>> {\n  const result = await authPromise\n  if (result.success) {\n    setToken(cookies, result.data.tokens.accessToken, result.data.tokens.expiresIn)\n  }\n  return result\n}\n\n/**\n * 服务端登录（密码）：内部调用 iam.auth.login，成功时自动写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param credentials - 密码凭证（identifier + password）\n * @returns 认证结果（成功时 Cookie 已自动写入）\n *\n * @example\n * ```ts\n * const result = await kit.auth.login(cookies, { identifier, password })\n * if (!result.success) return kit.response.fromError(result.error, IamErrorHttpStatus)\n * const { user, roles, permissions } = result.data\n * ```\n */\nexport async function login(\n  cookies: CookieWriter,\n  credentials: PasswordCredentials,\n): Promise<HaiResult<AuthResult>> {\n  return executeLogin(cookies, getAuthOperations().login(credentials))\n}\n\n/**\n * 服务端登录（OTP 验证码）：内部调用 iam.auth.loginWithOtp，成功时自动写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param credentials - OTP 凭证（identifier + code）\n * @returns 认证结果（成功时 Cookie 已自动写入）\n *\n * @example\n * ```ts\n * const result = await kit.auth.loginWithOtp(cookies, { identifier, code })\n * ```\n */\nexport async function loginWithOtp(\n  cookies: CookieWriter,\n  credentials: OtpCredentials,\n): Promise<HaiResult<AuthResult>> {\n  return executeLogin(cookies, getAuthOperations().loginWithOtp(credentials))\n}\n\n/**\n * 服务端登录（LDAP）：内部调用 iam.auth.loginWithLdap，成功时自动写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param credentials - LDAP 凭证（username + password）\n * @returns 认证结果（成功时 Cookie 已自动写入）\n *\n * @example\n * ```ts\n * const result = await kit.auth.loginWithLdap(cookies, { username, password })\n * ```\n */\nexport async function loginWithLdap(\n  cookies: CookieWriter,\n  credentials: LdapCredentials,\n): Promise<HaiResult<AuthResult>> {\n  return executeLogin(cookies, getAuthOperations().loginWithLdap(credentials))\n}\n\n/**\n * 服务端登录（API Key）：内部调用 iam.auth.loginWithApiKey，成功时自动写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param credentials - API Key 凭证（key）\n * @returns 认证结果（成功时 Cookie 已自动写入）\n *\n * @example\n * ```ts\n * const result = await kit.auth.loginWithApiKey(cookies, { key: apiKey })\n * if (!result.success) return kit.response.fromError(result.error, IamErrorHttpStatus)\n * ```\n */\nexport async function loginWithApiKey(\n  cookies: CookieWriter,\n  credentials: ApiKeyCredentials,\n): Promise<HaiResult<AuthResult>> {\n  return executeLogin(cookies, getAuthOperations().loginWithApiKey(credentials))\n}\n\n/**\n * 服务端注册并登录：内部调用 iam.auth.registerAndLogin，成功时自动写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param options - 注册选项（username、password、email 等）\n * @returns 认证结果（成功时 Cookie 已自动写入）\n *\n * @example\n * ```ts\n * const result = await kit.auth.registerAndLogin(cookies, { username, email, password })\n * ```\n */\nexport async function registerAndLogin(\n  cookies: CookieWriter,\n  options: RegisterOptions,\n): Promise<HaiResult<AuthResult>> {\n  return executeLogin(cookies, getAuthOperations().registerAndLogin(options))\n}\n\n/**\n * 服务端登出：内部调用 iam.auth.logout 使会话失效，并清除 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param accessToken - 访问令牌（为 null/undefined 时仅清除 Cookie）\n *\n * @example\n * ```ts\n * await kit.auth.logout(cookies, locals.accessToken)\n * return kit.response.ok(null)\n * ```\n */\nexport async function logout(\n  cookies: CookieWriter,\n  accessToken?: string | null,\n): Promise<void> {\n  if (accessToken) {\n    await getAuthOperations().logout(accessToken)\n  }\n  clearToken(cookies)\n}\n\n// ─── 浏览器端 Token 存储（通过 kit.auth 暴露） ───\n\n/**\n * 创建浏览器端 Token 存储器（localStorage）。\n *\n * @param key - localStorage 键名，默认 `'hai_access_token'`\n */\nexport function createTokenStore(key = DEFAULT_TOKEN_COOKIE_NAME): BrowserTokenStore {\n  return {\n    get(): string | null {\n      if (typeof window === 'undefined') {\n        return null\n      }\n      return window.localStorage.getItem(key)\n    },\n    set(token: string): void {\n      if (typeof window === 'undefined') {\n        return\n      }\n      window.localStorage.setItem(key, token)\n    },\n    clear(): void {\n      if (typeof window === 'undefined') {\n        return\n      }\n      window.localStorage.removeItem(key)\n    },\n  }\n}\n\n/**\n * 写入浏览器端 Access Token。\n */\nexport function setBrowserToken(token: string): void {\n  defaultBrowserTokenStore.set(token)\n}\n\n/**\n * 清除浏览器端 Access Token。\n */\nexport function clearBrowserToken(): void {\n  defaultBrowserTokenStore.clear()\n}\n\n// ─── HandleFetch 工厂（通过 kit.auth 暴露） ───\n\n/**\n * 创建浏览器端同源请求自动附加 Access Token 的 HandleFetch。\n */\nexport function createHandleFetch(tokenStore: BrowserTokenStore = createTokenStore()): HandleFetch {\n  return async ({ event, request, fetch }) => {\n    const requestUrl = new URL(request.url)\n    if (requestUrl.origin !== event.url.origin)\n      return fetch(request)\n\n    const token = tokenStore.get()\n    if (!token)\n      return fetch(request)\n\n    const headers = new Headers(request.headers)\n    headers.set('Authorization', `Bearer ${token}`)\n\n    return fetch(new Request(request, { headers }))\n  }\n}\n","/**\n * @h-ai/kit — 统一客户端\n *\n * 将 CSRF Token 附加与可选传输加密封装为统一 `apiFetch`。\n * 应用层只需调用一次 `createKitClient()`，后续 API 调用即可复用同一套安全能力。\n * @module kit-client\n */\n\nimport type { BrowserTokenStore } from '../kit-auth.js'\nimport type { EncryptedPayload, TransportCryptoServiceLike, TransportKeyPair } from '../modules/crypto/kit-crypto-types.js'\nimport { createTokenStore } from '../kit-auth.js'\nimport { isValidEncryptedPayload } from '../modules/crypto/kit-transport-encryption.js'\n\n// ─── 类型 ───\n\n/**\n * 传输加密客户端配置\n */\nexport interface ClientTransportConfig {\n  /** 传输加密服务实例（@h-ai/crypto 的 asymmetric + symmetric） */\n  crypto: TransportCryptoServiceLike\n  /** 密钥交换端点 URL（默认 `'/api/kit/key-exchange'`） */\n  keyExchangeUrl?: string\n}\n\n/**\n * Kit 客户端配置\n */\nexport interface KitClientConfig {\n  /**\n   * 传输加密配置。\n   * - 不提供 / undefined：不启用传输加密，仅 CSRF\n   * - 提供对象：启用传输加密\n   */\n  transport?: ClientTransportConfig\n  /** CSRF Cookie 名称（默认 `'hai_csrf'`） */\n  csrfCookieName?: string\n  /** CSRF Header 名称（默认 `'X-CSRF-Token'`） */\n  csrfHeaderName?: string\n  /**\n   * 认证配置：自动从浏览器存储读取 Access Token 并注入请求头。\n   * - `true`：使用默认 localStorage 存储（key = `hai_access_token`）\n   * - `BrowserTokenStore`：使用自定义存储\n   * - 不提供 / `false`：不自动注入\n   */\n  auth?: boolean | BrowserTokenStore\n}\n\n/**\n * Kit 客户端实例\n */\nexport interface KitClient {\n  /** 统一 API fetch（写请求自动附加 CSRF，启用 transport 时自动加解密） */\n  apiFetch: (url: string, init?: RequestInit) => Promise<Response>\n  /** 传输加密是否就绪（未启用传输加密时始终为 true） */\n  readonly ready: boolean\n  /** 手动触发密钥交换（transport 启用时） */\n  init: () => Promise<void>\n  /** 销毁密钥状态 */\n  destroy: () => void\n}\n\n// ─── 工具函数 ───\n\n/**\n * 从 document.cookie 中读取指定名称的 Cookie 值\n *\n * @param name - Cookie 名称\n * @returns Cookie 值；不存在或运行在服务端时返回 undefined\n */\nfunction getCookie(name: string): string | undefined {\n  if (typeof document === 'undefined')\n    return undefined\n  const match = document.cookie.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`))\n  return match?.[1]\n}\n\n// ─── 主函数 ───\n\n/**\n * 创建 Kit 客户端\n *\n * 返回统一的 `apiFetch`，内部自动完成：\n * 1. CSRF Token 附加（写方法自动读取 Cookie + 设置 Header）\n * 2. 密钥交换（首次写请求时 lazy init，transport 启用时）\n * 3. 请求体加密（transport 启用时）\n * 4. 响应体解密（transport 启用时）\n *\n * @param config - 客户端配置\n * @returns KitClient 实例\n *\n * @example\n * ```ts\n * const client = createKitClient({ transport: { crypto } })\n * const res = await client.apiFetch('/api/users', { method: 'POST', body: '{}' })\n * ```\n */\nexport function createKitClient(config: KitClientConfig = {}): KitClient {\n  const {\n    transport: transportConfig,\n    csrfCookieName = 'hai_csrf',\n    csrfHeaderName = 'X-CSRF-Token',\n    auth: authConfig,\n  } = config\n\n  // ── Auth token store ──\n  const authStore: BrowserTokenStore | null = authConfig\n    ? (authConfig === true ? createTokenStore() : authConfig)\n    : null\n\n  // ── 传输加密状态 ──\n  let transportReady = false\n  let clientKeyPair: TransportKeyPair | null = null\n  let serverPublicKey: string | null = null\n  let clientId: string | null = null\n  /** 密钥交换锁，防止并发 init */\n  let initPromise: Promise<void> | null = null\n\n  /**\n   * 执行密钥交换\n   */\n  async function doKeyExchange(): Promise<void> {\n    if (!transportConfig)\n      return\n\n    const { crypto: cryptoService, keyExchangeUrl = '/api/kit/key-exchange' } = transportConfig\n\n    // 1. 生成客户端非对称密钥对\n    const keyPairResult = cryptoService.asymmetric.generateKeyPair()\n    if (!keyPairResult.success || !keyPairResult.data) {\n      throw new Error('Failed to generate client key pair')\n    }\n    clientKeyPair = keyPairResult.data\n\n    // 2. 与服务端交换公钥\n    const response = await fetch(keyExchangeUrl, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({ clientPublicKey: clientKeyPair.publicKey }),\n    })\n\n    if (!response.ok) {\n      throw new Error(`Key exchange failed: ${response.status}`)\n    }\n\n    const data = await response.json() as { serverPublicKey?: string, clientId?: string }\n    if (!data.serverPublicKey || !data.clientId) {\n      throw new Error('Invalid key exchange response')\n    }\n\n    serverPublicKey = data.serverPublicKey\n    clientId = data.clientId\n    transportReady = true\n  }\n\n  /**\n   * 确保密钥交换完成（lazy init + 单例锁）\n   */\n  async function ensureTransportReady(): Promise<void> {\n    if (transportReady)\n      return\n    if (!initPromise) {\n      initPromise = doKeyExchange().finally(() => {\n        initPromise = null\n      })\n    }\n    await initPromise\n  }\n\n  /**\n   * 加密请求体\n   */\n  function encryptBody(bodyText: string): string {\n    if (!transportConfig || !serverPublicKey)\n      return bodyText\n\n    const { crypto: cryptoService } = transportConfig\n\n    // 1. 生成随机对称密钥\n    const symmetricKey = cryptoService.symmetric.generateKey()\n\n    // 2. 对称加密内容\n    const encResult = cryptoService.symmetric.encryptWithIV(bodyText, symmetricKey)\n    if (!encResult.success || !encResult.data) {\n      throw new Error('Request body encryption failed')\n    }\n\n    // 3. 非对称加密对称密钥\n    const keyEncResult = cryptoService.asymmetric.encrypt(symmetricKey, serverPublicKey)\n    if (!keyEncResult.success || !keyEncResult.data) {\n      throw new Error('Symmetric key encryption failed')\n    }\n\n    const payload: EncryptedPayload = {\n      encryptedKey: keyEncResult.data,\n      ciphertext: encResult.data.ciphertext,\n      iv: encResult.data.iv,\n    }\n\n    return JSON.stringify(payload)\n  }\n\n  /**\n   * 解密响应体\n   */\n  async function decryptResponse(response: Response): Promise<Response> {\n    if (!clientKeyPair || !transportConfig)\n      return response\n\n    const encryptedBody = await response.json() as unknown\n    if (!isValidEncryptedPayload(encryptedBody))\n      return response\n\n    const { crypto: cryptoService } = transportConfig\n\n    // 1. 非对称解密对称密钥\n    const keyDecResult = cryptoService.asymmetric.decrypt(encryptedBody.encryptedKey, clientKeyPair.privateKey)\n    if (!keyDecResult.success || !keyDecResult.data) {\n      throw new Error('Response key decryption failed')\n    }\n\n    // 2. 对称解密内容\n    const decResult = cryptoService.symmetric.decryptWithIV(encryptedBody.ciphertext, keyDecResult.data, encryptedBody.iv)\n    if (!decResult.success || typeof decResult.data !== 'string') {\n      throw new Error('Response body decryption failed')\n    }\n\n    return new Response(decResult.data, {\n      status: response.status,\n      statusText: response.statusText,\n      headers: response.headers,\n    })\n  }\n\n  /**\n   * 统一 API fetch\n   */\n  async function apiFetch(url: string, init: RequestInit = {}): Promise<Response> {\n    const method = (init.method ?? 'GET').toUpperCase()\n    const isWriteMethod = !['GET', 'HEAD', 'OPTIONS'].includes(method)\n\n    const headers = new Headers(init.headers)\n\n    // ── Auth ──\n    if (authStore) {\n      const token = authStore.get()\n      if (token) {\n        headers.set('Authorization', `Bearer ${token}`)\n      }\n    }\n\n    // ── CSRF ──\n    if (isWriteMethod) {\n      const csrfToken = getCookie(csrfCookieName)\n      if (csrfToken) {\n        headers.set(csrfHeaderName, csrfToken)\n      }\n    }\n\n    // ── 传输加密 ──\n    if (transportConfig) {\n      await ensureTransportReady()\n\n      if (clientId) {\n        headers.set('X-Client-Id', clientId)\n      }\n\n      // 加密请求体（写方法且有 body 时）\n      if (init.body !== undefined && init.body !== null) {\n        const bodyText = typeof init.body === 'string' ? init.body : JSON.stringify(init.body)\n        const encrypted = encryptBody(bodyText)\n        headers.set('Content-Type', 'application/json')\n\n        let response = await fetch(url, { ...init, headers, body: encrypted })\n\n        // 解密响应\n        if (response.headers.get('X-Encrypted') === 'true') {\n          response = await decryptResponse(response)\n        }\n\n        return response\n      }\n    }\n\n    // ── 发送 ──\n    let response = await fetch(url, { ...init, headers })\n\n    // ── 解密响应（GET/无 body 写请求也可能有加密响应） ──\n    if (transportConfig && response.headers.get('X-Encrypted') === 'true') {\n      response = await decryptResponse(response)\n    }\n\n    return response\n  }\n\n  return {\n    apiFetch,\n    get ready() { return !transportConfig || transportReady },\n    async init() {\n      if (transportConfig)\n        await ensureTransportReady()\n    },\n    destroy() {\n      clientKeyPair = null\n      serverPublicKey = null\n      clientId = null\n      transportReady = false\n      initPromise = null\n    },\n  }\n}\n"]}

package/dist/chunk-XTZUGWBY.js

@@ -1,137 +0,0 @@
-import { createTransportEncryption, kitM, isValidEncryptedPayload } from './chunk-BRZK7V5O.js';
-
-// src/modules/crypto/kit-transport-middleware.ts
-function transportEncryptionMiddleware(config) {
-  if (!config.enabled) {
-    return async (_context, next) => next();
-  }
-  const keyExchangePath = config.keyExchangePath ?? "/api/kit/key-exchange";
-  const excludePaths = config.excludePaths ?? [];
-  const encryptResponse = config.encryptResponse ?? true;
-  const requireEncryption = config.requireEncryption ?? true;
-  const result = createTransportEncryption(config.crypto);
-  if (!result.success) {
-    return async (_context, next) => next();
-  }
-  const manager = result.data;
-  return async (context, next) => {
-    const { event } = context;
-    const pathname = event.url.pathname;
-    if (pathname === keyExchangePath && event.request.method === "POST") {
-      return handleKeyExchange(manager, event.request);
-    }
-    if (shouldExclude(pathname, excludePaths, keyExchangePath)) {
-      return next();
-    }
-    const clientId = event.request.headers.get("X-Client-Id");
-    if (!clientId) {
-      if (requireEncryption) {
-        return new Response(
-          JSON.stringify({ error: kitM("kit_transportClientIdRequired") }),
-          { status: 400, headers: { "Content-Type": "application/json" } }
-        );
-      }
-      return next();
-    }
-    const clientPublicKey = manager.getClientPublicKey(clientId);
-    if (!clientPublicKey) {
-      return new Response(
-        JSON.stringify({ error: kitM("kit_transportClientKeyNotFound") }),
-        { status: 400, headers: { "Content-Type": "application/json" } }
-      );
-    }
-    try {
-      if (hasBody(event.request.method)) {
-        const bodyText = await event.request.text();
-        if (bodyText) {
-          const payload = JSON.parse(bodyText);
-          if (isValidEncryptedPayload(payload)) {
-            const plaintext = manager.decryptRequest(payload);
-            const newRequest = new Request(event.request.url, {
-              method: event.request.method,
-              headers: new Headers(event.request.headers),
-              body: plaintext
-            });
-            Object.defineProperty(event, "request", {
-              value: newRequest,
-              writable: true,
-              configurable: true
-            });
-          }
-        }
-      }
-    } catch {
-      return new Response(
-        JSON.stringify({ error: kitM("kit_transportDecryptFailed") }),
-        { status: 400, headers: { "Content-Type": "application/json" } }
-      );
-    }
-    const response = await next();
-    if (!encryptResponse) {
-      return response;
-    }
-    const contentType = response.headers.get("Content-Type") ?? "";
-    if (!contentType.includes("application/json")) {
-      return response;
-    }
-    const contentLength = response.headers.get("Content-Length");
-    if (contentLength && Number.parseInt(contentLength, 10) > 1048576) {
-      return response;
-    }
-    try {
-      const responseBody = await response.text();
-      if (!responseBody) {
-        return response;
-      }
-      const encryptedPayload = manager.encryptResponse(clientId, responseBody);
-      return new Response(
-        JSON.stringify(encryptedPayload),
-        {
-          status: response.status,
-          statusText: response.statusText,
-          headers: {
-            ...Object.fromEntries(response.headers.entries()),
-            "Content-Type": "application/json",
-            "X-Encrypted": "true"
-          }
-        }
-      );
-    } catch {
-      return response;
-    }
-  };
-}
-async function handleKeyExchange(manager, request) {
-  try {
-    const body = await request.json();
-    if (!body.clientPublicKey || typeof body.clientPublicKey !== "string") {
-      return new Response(
-        JSON.stringify({ error: kitM("kit_transportInvalidPayload") }),
-        { status: 400, headers: { "Content-Type": "application/json" } }
-      );
-    }
-    const clientId = manager.registerClientKey(body.clientPublicKey);
-    const serverPublicKey = manager.getServerPublicKey();
-    return new Response(
-      JSON.stringify({ serverPublicKey, clientId }),
-      { status: 200, headers: { "Content-Type": "application/json" } }
-    );
-  } catch {
-    return new Response(
-      JSON.stringify({ error: kitM("kit_transportKeyExchangeFailed") }),
-      { status: 500, headers: { "Content-Type": "application/json" } }
-    );
-  }
-}
-function shouldExclude(pathname, excludePaths, keyExchangePath) {
-  if (pathname === keyExchangePath)
-    return true;
-  return excludePaths.some((p) => pathname === p || pathname.startsWith(`${p}/`));
-}
-function hasBody(method) {
-  return ["POST", "PUT", "PATCH", "DELETE"].includes(method.toUpperCase());
-}
-
-export { transportEncryptionMiddleware };
-//# sourceMappingURL=chunk-XTZUGWBY.js.map
-//# sourceMappingURL=chunk-XTZUGWBY.js.map

package/dist/chunk-XTZUGWBY.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/modules/crypto/kit-transport-middleware.ts"],"names":[],"mappings":";;;AA6BO,SAAS,8BAA8B,MAAA,EAA+C;AAE3F,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,OAAO,OAAO,QAAA,EAAU,IAAA,KAAS,IAAA,EAAK;AAAA,EACxC;AAEA,EAAA,MAAM,eAAA,GAAkB,OAAO,eAAA,IAAmB,uBAAA;AAClD,EAAA,MAAM,YAAA,GAAe,MAAA,CAAO,YAAA,IAAgB,EAAC;AAC7C,EAAA,MAAM,eAAA,GAAkB,OAAO,eAAA,IAAmB,IAAA;AAClD,EAAA,MAAM,iBAAA,GAAoB,OAAO,iBAAA,IAAqB,IAAA;AAGtD,EAAA,MAAM,MAAA,GAAS,yBAAA,CAA0B,MAAA,CAAO,MAAM,CAAA;AACtD,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AAEnB,IAAA,OAAO,OAAO,QAAA,EAAU,IAAA,KAAS,IAAA,EAAK;AAAA,EACxC;AACA,EAAA,MAAM,UAAU,MAAA,CAAO,IAAA;AAEvB,EAAA,OAAO,OAAO,SAAS,IAAA,KAAS;AAC9B,IAAA,MAAM,EAAE,OAAM,GAAI,OAAA;AAClB,IAAA,MAAM,QAAA,GAAW,MAAM,GAAA,CAAI,QAAA;AAG3B,IAAA,IAAI,QAAA,KAAa,eAAA,IAAmB,KAAA,CAAM,OAAA,CAAQ,WAAW,MAAA,EAAQ;AACnE,MAAA,OAAO,iBAAA,CAAkB,OAAA,EAAS,KAAA,CAAM,OAAO,CAAA;AAAA,IACjD;AAGA,IAAA,IAAI,aAAA,CAAc,QAAA,EAAU,YAAA,EAAc,eAAe,CAAA,EAAG;AAC1D,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AAGA,IAAA,MAAM,QAAA,GAAW,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,IAAI,aAAa,CAAA;AACxD,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,IAAI,iBAAA,EAAmB;AAErB,QAAA,OAAO,IAAI,QAAA;AAAA,UACT,KAAK,SAAA,CAAU,EAAE,OAAO,IAAA,CAAK,+BAA+B,GAAG,CAAA;AAAA,UAC/D,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAS,EAAE,cAAA,EAAgB,oBAAmB;AAAE,SACjE;AAAA,MACF;AAEA,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AAGA,IAAA,MAAM,eAAA,GAAkB,OAAA,CAAQ,kBAAA,CAAmB,QAAQ,CAAA;AAC3D,IAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,MAAA,OAAO,IAAI,QAAA;AAAA,QACT,KAAK,SAAA,CAAU,EAAE,OAAO,IAAA,CAAK,gCAAgC,GAAG,CAAA;AAAA,QAChE,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAS,EAAE,cAAA,EAAgB,oBAAmB;AAAE,OACjE;AAAA,IACF;AAGA,IAAA,IAAI;AACF,MAAA,IAAI,OAAA,CAAQ,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACjC,QAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAK;AAC1C,QAAA,IAAI,QAAA,EAAU;AACZ,UAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA;AACnC,UAAA,IAAI,uBAAA,CAAwB,OAAO,CAAA,EAAG;AACpC,YAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,cAAA,CAAe,OAAO,CAAA;AAEhD,YAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,KAAA,CAAM,QAAQ,GAAA,EAAK;AAAA,cAChD,MAAA,EAAQ,MAAM,OAAA,CAAQ,MAAA;AAAA,cACtB,OAAA,EAAS,IAAI,OAAA,CAAQ,KAAA,CAAM,QAAQ,OAAO,CAAA;AAAA,cAC1C,IAAA,EAAM;AAAA,aACP,CAAA;AAED,YAAA,MAAA,CAAO,cAAA,CAAe,OAAO,SAAA,EAAW;AAAA,cACtC,KAAA,EAAO,UAAA;AAAA,cACP,QAAA,EAAU,IAAA;AAAA,cACV,YAAA,EAAc;AAAA,aACf,CAAA;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAA,CAAA,MACM;AACJ,MAAA,OAAO,IAAI,QAAA;AAAA,QACT,KAAK,SAAA,CAAU,EAAE,OAAO,IAAA,CAAK,4BAA4B,GAAG,CAAA;AAAA,QAC5D,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAS,EAAE,cAAA,EAAgB,oBAAmB;AAAE,OACjE;AAAA,IACF;AAGA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,EAAK;AAG5B,IAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,MAAA,OAAO,QAAA;AAAA,IACT;AAGA,IAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC5D,IAAA,IAAI,CAAC,WAAA,CAAY,QAAA,CAAS,kBAAkB,CAAA,EAAG;AAC7C,MAAA,OAAO,QAAA;AAAA,IACT;AACA,IAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC3D,IAAA,IAAI,iBAAiB,MAAA,CAAO,QAAA,CAAS,aAAA,EAAe,EAAE,IAAI,OAAA,EAAW;AACnE,MAAA,OAAO,QAAA;AAAA,IACT;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,YAAA,GAAe,MAAM,QAAA,CAAS,IAAA,EAAK;AACzC,MAAA,IAAI,CAAC,YAAA,EAAc;AACjB,QAAA,OAAO,QAAA;AAAA,MACT;AAEA,MAAA,MAAM,gBAAA,GAAmB,OAAA,CAAQ,eAAA,CAAgB,QAAA,EAAU,YAAY,CAAA;AACvE,MAAA,OAAO,IAAI,QAAA;AAAA,QACT,IAAA,CAAK,UAAU,gBAAgB,CAAA;AAAA,QAC/B;AAAA,UACE,QAAQ,QAAA,CAAS,MAAA;AAAA,UACjB,YAAY,QAAA,CAAS,UAAA;AAAA,UACrB,OAAA,EAAS;AAAA,YACP,GAAG,MAAA,CAAO,WAAA,CAAY,QAAA,CAAS,OAAA,CAAQ,SAAS,CAAA;AAAA,YAChD,cAAA,EAAgB,kBAAA;AAAA,YAChB,aAAA,EAAe;AAAA;AACjB;AACF,OACF;AAAA,IACF,CAAA,CAAA,MACM;AAEJ,MAAA,OAAO,QAAA;AAAA,IACT;AAAA,EACF,CAAA;AACF;AAWA,eAAe,iBAAA,CACb,SACA,OAAA,EACmB;AACnB,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,IAAA,EAAK;AAEhC,IAAA,IAAI,CAAC,IAAA,CAAK,eAAA,IAAmB,OAAO,IAAA,CAAK,oBAAoB,QAAA,EAAU;AACrE,MAAA,OAAO,IAAI,QAAA;AAAA,QACT,KAAK,SAAA,CAAU,EAAE,OAAO,IAAA,CAAK,6BAA6B,GAAG,CAAA;AAAA,QAC7D,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAS,EAAE,cAAA,EAAgB,oBAAmB;AAAE,OACjE;AAAA,IACF;AAEA,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,iBAAA,CAAkB,IAAA,CAAK,eAAe,CAAA;AAC/D,IAAA,MAAM,eAAA,GAAkB,QAAQ,kBAAA,EAAmB;AAEnD,IAAA,OAAO,IAAI,QAAA;AAAA,MACT,IAAA,CAAK,SAAA,CAAU,EAAE,eAAA,EAAiB,UAAU,CAAA;AAAA,MAC5C,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAS,EAAE,cAAA,EAAgB,oBAAmB;AAAE,KACjE;AAAA,EACF,CAAA,CAAA,MACM;AACJ,IAAA,OAAO,IAAI,QAAA;AAAA,MACT,KAAK,SAAA,CAAU,EAAE,OAAO,IAAA,CAAK,gCAAgC,GAAG,CAAA;AAAA,MAChE,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAS,EAAE,cAAA,EAAgB,oBAAmB;AAAE,KACjE;AAAA,EACF;AACF;AAUA,SAAS,aAAA,CAAc,QAAA,EAAkB,YAAA,EAAwB,eAAA,EAAkC;AACjG,EAAA,IAAI,QAAA,KAAa,eAAA;AACf,IAAA,OAAO,IAAA;AACT,EAAA,OAAO,YAAA,CAAa,IAAA,CAAK,CAAA,CAAA,KAAK,QAAA,KAAa,CAAA,IAAK,SAAS,UAAA,CAAW,CAAA,EAAG,CAAC,CAAA,CAAA,CAAG,CAAC,CAAA;AAC9E;AAQA,SAAS,QAAQ,MAAA,EAAyB;AACxC,EAAA,OAAO,CAAC,QAAQ,KAAA,EAAO,OAAA,EAAS,QAAQ,CAAA,CAAE,QAAA,CAAS,MAAA,CAAO,WAAA,EAAa,CAAA;AACzE","file":"chunk-XTZUGWBY.js","sourcesContent":["/**\n * @h-ai/kit — 传输加密中间件\n *\n * SvelteKit 中间件，自动对请求/响应进行传输加密解密。\n * @module kit-transport-middleware\n */\n\nimport type { Middleware } from '../../kit-types.js'\nimport type { TransportEncryptionConfig, TransportEncryptionManager } from './kit-crypto-types.js'\nimport { kitM } from '../../kit-i18n.js'\nimport { createTransportEncryption, isValidEncryptedPayload } from './kit-transport-encryption.js'\n\n/**\n * 创建传输加密中间件\n *\n * @param config - 传输加密配置\n * @returns SvelteKit 中间件\n *\n * @example\n * ```ts\n * import { crypto } from '@h-ai/crypto'\n * import { kit } from '@h-ai/kit'\n *\n * // 传输加密通过 createHandle 的 crypto 配置自动启用：\n * export const handle = kit.createHandle({\n *   crypto: { crypto, transport: true },\n * })\n * ```\n */\nexport function transportEncryptionMiddleware(config: TransportEncryptionConfig): Middleware {\n  // 未启用时直接透传\n  if (!config.enabled) {\n    return async (_context, next) => next()\n  }\n\n  const keyExchangePath = config.keyExchangePath ?? '/api/kit/key-exchange'\n  const excludePaths = config.excludePaths ?? []\n  const encryptResponse = config.encryptResponse ?? true\n  const requireEncryption = config.requireEncryption ?? true\n\n  // 初始化传输加密管理器\n  const result = createTransportEncryption(config.crypto)\n  if (!result.success) {\n    // 密钥生成失败时降级为透传\n    return async (_context, next) => next()\n  }\n  const manager = result.data\n\n  return async (context, next) => {\n    const { event } = context\n    const pathname = event.url.pathname\n\n    // 密钥交换端点：委托给 keyExchangeHandler\n    if (pathname === keyExchangePath && event.request.method === 'POST') {\n      return handleKeyExchange(manager, event.request)\n    }\n\n    // 排除路径不做加解密\n    if (shouldExclude(pathname, excludePaths, keyExchangePath)) {\n      return next()\n    }\n\n    // 请求头中无 X-Client-Id 时的处理\n    const clientId = event.request.headers.get('X-Client-Id')\n    if (!clientId) {\n      if (requireEncryption) {\n        // 强制加密模式：缺少 X-Client-Id 说明未完成密钥交换，拒绝请求\n        return new Response(\n          JSON.stringify({ error: kitM('kit_transportClientIdRequired') }),\n          { status: 400, headers: { 'Content-Type': 'application/json' } },\n        )\n      }\n      // 非强制模式：透传明文（渐进式迁移兼容）\n      return next()\n    }\n\n    // 检查客户端是否已注册\n    const clientPublicKey = manager.getClientPublicKey(clientId)\n    if (!clientPublicKey) {\n      return new Response(\n        JSON.stringify({ error: kitM('kit_transportClientKeyNotFound') }),\n        { status: 400, headers: { 'Content-Type': 'application/json' } },\n      )\n    }\n\n    // ── 解密请求 ──\n    try {\n      if (hasBody(event.request.method)) {\n        const bodyText = await event.request.text()\n        if (bodyText) {\n          const payload = JSON.parse(bodyText) as unknown\n          if (isValidEncryptedPayload(payload)) {\n            const plaintext = manager.decryptRequest(payload)\n            // 重建请求，替换为解密后的明文\n            const newRequest = new Request(event.request.url, {\n              method: event.request.method,\n              headers: new Headers(event.request.headers),\n              body: plaintext,\n            })\n            // 将解密后的请求注入 locals，供后续中间件/端点使用\n            Object.defineProperty(event, 'request', {\n              value: newRequest,\n              writable: true,\n              configurable: true,\n            })\n          }\n        }\n      }\n    }\n    catch {\n      return new Response(\n        JSON.stringify({ error: kitM('kit_transportDecryptFailed') }),\n        { status: 400, headers: { 'Content-Type': 'application/json' } },\n      )\n    }\n\n    // ── 执行后续中间件/端点 ──\n    const response = await next()\n\n    // ── 加密响应 ──\n    if (!encryptResponse) {\n      return response\n    }\n\n    // 跳过非 JSON 响应和大体积响应（>1MB），避免内存问题\n    const contentType = response.headers.get('Content-Type') ?? ''\n    if (!contentType.includes('application/json')) {\n      return response\n    }\n    const contentLength = response.headers.get('Content-Length')\n    if (contentLength && Number.parseInt(contentLength, 10) > 1_048_576) {\n      return response\n    }\n\n    try {\n      const responseBody = await response.text()\n      if (!responseBody) {\n        return response\n      }\n\n      const encryptedPayload = manager.encryptResponse(clientId, responseBody)\n      return new Response(\n        JSON.stringify(encryptedPayload),\n        {\n          status: response.status,\n          statusText: response.statusText,\n          headers: {\n            ...Object.fromEntries(response.headers.entries()),\n            'Content-Type': 'application/json',\n            'X-Encrypted': 'true',\n          },\n        },\n      )\n    }\n    catch {\n      // 加密失败时返回原始响应\n      return response\n    }\n  }\n}\n\n/**\n * 处理密钥交换 POST 请求\n *\n * 接收客户端公钥，注册并返回服务端公钥与 clientId。\n *\n * @param manager - 传输加密管理器\n * @param request - 原始 Request\n * @returns JSON Response\n */\nasync function handleKeyExchange(\n  manager: TransportEncryptionManager,\n  request: Request,\n): Promise<Response> {\n  try {\n    const body = await request.json() as { clientPublicKey?: string }\n\n    if (!body.clientPublicKey || typeof body.clientPublicKey !== 'string') {\n      return new Response(\n        JSON.stringify({ error: kitM('kit_transportInvalidPayload') }),\n        { status: 400, headers: { 'Content-Type': 'application/json' } },\n      )\n    }\n\n    const clientId = manager.registerClientKey(body.clientPublicKey)\n    const serverPublicKey = manager.getServerPublicKey()\n\n    return new Response(\n      JSON.stringify({ serverPublicKey, clientId }),\n      { status: 200, headers: { 'Content-Type': 'application/json' } },\n    )\n  }\n  catch {\n    return new Response(\n      JSON.stringify({ error: kitM('kit_transportKeyExchangeFailed') }),\n      { status: 500, headers: { 'Content-Type': 'application/json' } },\n    )\n  }\n}\n\n/**\n * 判断路径是否应排除传输加解密\n *\n * @param pathname - 当前请求路径\n * @param excludePaths - 配置的排除列表\n * @param keyExchangePath - 密钥交换端点路径\n * @returns 是否排除\n */\nfunction shouldExclude(pathname: string, excludePaths: string[], keyExchangePath: string): boolean {\n  if (pathname === keyExchangePath)\n    return true\n  return excludePaths.some(p => pathname === p || pathname.startsWith(`${p}/`))\n}\n\n/**\n * 判断 HTTP 方法是否可能携带请求体\n *\n * @param method - HTTP 方法字符串\n * @returns `true` 表示 POST / PUT / PATCH / DELETE\n */\nfunction hasBody(method: string): boolean {\n  return ['POST', 'PUT', 'PATCH', 'DELETE'].includes(method.toUpperCase())\n}\n"]}

package/dist/kit-crypto-types-C-gEvx04.d.ts

@@ -1,253 +0,0 @@
-import { RequestEvent } from '@sveltejs/kit';
-
-/**
- * @h-ai/kit — Crypto 类型定义
- *
- * Crypto 模块集成相关类型
- * @module kit-crypto-types
- */
-
-/**
- * Crypto 服务接口（简化版，与 @h-ai/crypto 兼容）
- */
-interface CryptoServiceLike {
-    hmac: {
-        sign: (data: string, key: string, algorithm?: string) => Promise<{
-            success: boolean;
-            data?: string;
-            error?: {
-                code: number;
-                message: string;
-            };
-        }>;
-        verify: (data: string, key: string, signature: string, algorithm?: string) => Promise<{
-            success: boolean;
-            data?: boolean;
-            error?: {
-                code: number;
-                message: string;
-            };
-        }>;
-    };
-    hash: {
-        digest: (data: string, algorithm?: string) => Promise<{
-            success: boolean;
-            data?: string;
-            error?: {
-                code: number;
-                message: string;
-            };
-        }>;
-        timingSafeEqual: (a: string, b: string) => Promise<{
-            success: boolean;
-            data?: boolean;
-            error?: {
-                code: number;
-                message: string;
-            };
-        }>;
-    };
-    aes: {
-        encrypt: (data: string, key: string) => Promise<{
-            success: boolean;
-            data?: string;
-            error?: {
-                code: number;
-                message: string;
-            };
-        }>;
-        decrypt: (data: string, key: string) => Promise<{
-            success: boolean;
-            data?: string;
-            error?: {
-                code: number;
-                message: string;
-            };
-        }>;
-    };
-    random: {
-        bytes: (length: number) => Promise<{
-            success: boolean;
-            data?: Uint8Array;
-            error?: {
-                code: number;
-                message: string;
-            };
-        }>;
-    };
-}
-/**
- * Webhook 验证配置
- */
-interface WebhookVerifyConfig {
-    /** Crypto 服务实例 */
-    crypto: CryptoServiceLike;
-    /** 请求事件 */
-    event: RequestEvent;
-    /** 签名密钥 */
-    secretKey: string;
-    /** 签名头名称 */
-    signatureHeader?: string;
-    /** 算法 */
-    algorithm?: 'sha256' | 'sha512';
-    /** 编码 */
-    encoding?: 'hex' | 'base64';
-}
-/**
- * CSRF 配置
- */
-interface CryptoCsrfConfig {
-    /** Crypto 服务实例 */
-    crypto: CryptoServiceLike;
-    /** Cookie 名称 */
-    cookieName?: string;
-    /** Header 名称 */
-    headerName?: string;
-    /** 表单字段名称 */
-    formFieldName?: string;
-    /** Token 长度 */
-    tokenLength?: number;
-    /** Cookie 选项 */
-    cookieOptions?: {
-        path?: string;
-        httpOnly?: boolean;
-        secure?: boolean;
-        sameSite?: 'strict' | 'lax' | 'none';
-        maxAge?: number;
-    };
-}
-/**
- * 加密 Cookie 配置
- */
-interface EncryptedCookieConfig {
-    /** Crypto 服务实例 */
-    crypto: CryptoServiceLike;
-    /** 加密密钥 */
-    encryptionKey: string;
-    /** Cookie 选项 */
-    cookieOptions?: {
-        path?: string;
-        httpOnly?: boolean;
-        secure?: boolean;
-        sameSite?: 'strict' | 'lax' | 'none';
-        maxAge?: number;
-    };
-}
-/** SM2 密钥对 */
-interface TransportKeyPair {
-    /** 公钥（十六进制） */
-    publicKey: string;
-    /** 私钥（十六进制） */
-    privateKey: string;
-}
-/**
- * 传输加密服务接口（解耦 @h-ai/crypto）
- *
- * 只声明传输加密所需的非对称 + 对称加密子集，由使用者注入实际实现。
- */
-interface TransportCryptoServiceLike {
-    asymmetric: {
-        /** 生成非对称密钥对 */
-        generateKeyPair: () => {
-            success: boolean;
-            data?: TransportKeyPair;
-            error?: {
-                code: number;
-                message: string;
-            };
-        };
-        /** 非对称加密 */
-        encrypt: (data: string, publicKey: string) => {
-            success: boolean;
-            data?: string;
-            error?: {
-                code: number;
-                message: string;
-            };
-        };
-        /** 非对称解密 */
-        decrypt: (ciphertext: string, privateKey: string) => {
-            success: boolean;
-            data?: string;
-            error?: {
-                code: number;
-                message: string;
-            };
-        };
-    };
-    symmetric: {
-        /** 生成随机对称密钥 */
-        generateKey: () => string;
-        /** 带 IV 加密（CBC 模式，自动生成 IV） */
-        encryptWithIV: (data: string, key: string) => {
-            success: boolean;
-            data?: {
-                ciphertext: string;
-                iv: string;
-            };
-            error?: {
-                code: number;
-                message: string;
-            };
-        };
-        /** 带 IV 解密（CBC 模式） */
-        decryptWithIV: (ciphertext: string, key: string, iv: string) => {
-            success: boolean;
-            data?: string;
-            error?: {
-                code: number;
-                message: string;
-            };
-        };
-    };
-}
-/**
- * 传输加密配置
- */
-interface TransportEncryptionConfig {
-    /** 是否启用传输加密（默认 false） */
-    enabled: boolean;
-    /** 传输加密服务实例 */
-    crypto: TransportCryptoServiceLike;
-    /** 密钥交换端点路径（默认 '/api/kit/key-exchange'） */
-    keyExchangePath?: string;
-    /** 排除路径（不加密），支持精确匹配和前缀匹配 */
-    excludePaths?: string[];
-    /** 是否加密响应（默认 true） */
-    encryptResponse?: boolean;
-    /**
-     * 是否强制要求传输加密（默认 true）
-     *
-     * - `true`：非排除路径上缺少 X-Client-Id 请求头时返回 400，防止绕过加密。
-     * - `false`：缺少 X-Client-Id 时透传明文，适用于渐进式迁移场景。
-     */
-    requireEncryption?: boolean;
-}
-/**
- * 加密载荷（前后端传输的统一格式）
- */
-interface EncryptedPayload {
-    /** SM2 加密后的对称密钥（hex） */
-    encryptedKey: string;
-    /** SM4 加密后的密文（hex） */
-    ciphertext: string;
-    /** SM4 CBC 模式的 IV（hex） */
-    iv: string;
-}
-/**
- * 传输加密管理器接口
- */
-interface TransportEncryptionManager {
-    /** 获取服务端公钥 */
-    getServerPublicKey: () => string;
-    /** 注册客户端公钥，返回分配的 clientId */
-    registerClientKey: (clientPublicKey: string) => string;
-    /** 获取已注册的客户端公钥 */
-    getClientPublicKey: (clientId: string) => string | undefined;
-    /** 加密响应数据（使用指定客户端的公钥） */
-    encryptResponse: (clientId: string, data: string) => EncryptedPayload;
-    /** 解密请求数据（使用服务端私钥） */
-    decryptRequest: (payload: EncryptedPayload) => string;
-}
-
-export type { CryptoCsrfConfig as C, EncryptedCookieConfig as E, TransportCryptoServiceLike as T, WebhookVerifyConfig as W, CryptoServiceLike as a, EncryptedPayload as b, TransportEncryptionConfig as c, TransportEncryptionManager as d, TransportKeyPair as e };