@h-ai/kit 0.1.0-alpha.66 → 0.1.0-alpha.68

package/README.md

@@ -4,6 +4,8 @@
 
 [框架首页](../../README.md) · 相关模块：[@h-ai/core](../core/README.md) · [@h-ai/crypto](../crypto/README.md) · [@h-ai/iam](../iam/README.md)
 
+## 简介
+
 `@h-ai/kit` 是 hai-framework 的 SvelteKit 集成模块，提供统一的请求管道与同源 endpoint 工具：
 
 - `kit.createHandle()`：会话解析、路由守卫、中间件链、可选传输加密与 Cookie 加密
@@ -12,15 +14,7 @@
 
 > 公共跨端 HTTP API contract 统一放在 `@h-ai/api-contract`，由 `@h-ai/serv` 挂载，客户端通过 `@h-ai/api-client` typed client 调用；`@h-ai/kit` 不定义也不承载业务 API contract。
 
-## 安装
-
-```bash
-npm install @h-ai/kit
-npm install svelte @sveltejs/kit zod
-npm install -D @sveltejs/vite-plugin-svelte vite
-```
-
-## 支持的能力
+## 核心功能清单
 
 - Handle Hook 组合（`createHandle` / `sequence`）
 - 认证/角色/权限守卫（`guard.require` / `guard.check`）
@@ -32,14 +26,26 @@ npm install -D @sveltejs/vite-plugin-svelte vite
 - A2A 协议集成：默认发现路径 `/.well-known/agent-card.json`；配置 `authenticate` 后 null/undefined 返回 401，仅未配置认证时允许匿名。API Key 参数从完整 Agent Card 的 `securitySchemes.apiKey` 读取。Hook 与显式 A2A 路由共享 JSON-RPC 解析错误和 SSE 取消清理逻辑。
 - 双构建模式（`createAdapter()`）
 
-## 依赖
+## 使用入门
+
+`sequence` 保留并组合 SvelteKit 的 `resolve` 选项：页面转换由内向外执行，`preload` 与序列化响应头过滤使用首个配置，确保 i18n 的 HTML 语言标记正确替换。
+
+### 安装
+
+```bash
+npm install @h-ai/kit @h-ai/core sm-crypto@0.5.7
+npm install svelte @sveltejs/kit zod
+npm install -D @sveltejs/vite-plugin-svelte vite
+```
+
+### 依赖
 
 - `@h-ai/iam` — 身份认证与授权（A2A 认证），可选；使用 A2A 功能时需在 kit 使用前初始化
 - `@h-ai/crypto` — 加密（传输加密 / Cookie 加密），可选；启用加密时需在 kit 使用前初始化
 
-## 快速开始
+### 快速开始
 
-### 项目配置
+#### 项目配置
 
 **svelte.config.js**：
 
@@ -53,7 +59,7 @@ const config = {
   kit: {
     adapter: adapter(),
     // 双构建模式：import { createAdapter } from '@h-ai/kit/adapter'
-    // adapter: createAdapter(),
+    // adapter: await createAdapter(),
   },
 }
 
@@ -70,35 +76,41 @@ import { defineConfig } from 'vite'
 export default defineConfig({
   plugins: [sveltekit(), tailwindcss()],
   optimizeDeps: { exclude: ['bits-ui'] },
-  ssr: { noExternal: [/@h-ai\//] },
+  ssr: { noExternal: ['@h-ai/ui', '@h-ai/kit'], external: ['@h-ai/core', 'sm-crypto'] },
 })
 ```
 
-### 搭建请求管道
+使用 Crypto 或依赖它的 Kit/IAM 时，应用生产依赖需包含 `sm-crypto@0.5.7`。CLI 已配好这一项；手工接入时运行 `pnpm add sm-crypto@0.5.7`。仅设置 external 不够，adapter-node 还需要这项直接依赖声明才能保留原包加载。
+
+#### 搭建请求管道
 
 **src/hooks.server.ts**：
 
 ```typescript
 import type { Handle } from '@sveltejs/kit'
+import { cache } from '@h-ai/cache'
 import { kit } from '@h-ai/kit'
 
 const haiHandle = kit.createHandle({
   auth: {
     verifyToken: async (token) => {
-      return token ? { userId: 'u_1', roles: ['admin'], permissions: ['user:read'] } : null
+      const verified = await iam.auth.verifyToken(token)
+      return verified.success ? verified.data : null
     },
     loginUrl: '/auth/login',
     protectedPaths: ['/admin/*', '/api/*'],
     publicPaths: ['/api/auth/*', '/api/public/*'],
   },
-  rateLimit: { windowMs: 60_000, maxRequests: 100 },
+  rateLimit: { windowMs: 60_000, maxRequests: 100, store: kit.middleware.createCacheRateLimitStore(cache, { namespace: 'app' }) },
   logging: true,
 })
 
 export const handle: Handle = haiHandle
 ```
 
-### API 端点
+限流采用首次成功提交为起点的固定窗口，后续请求不延长 TTL。必须显式传 store；应用先检查共享 Redis 初始化结果，所有节点使用相同 namespace/windowMs/maxRequests。缓存读取/条件提交失败或冲突耗尽返回503，超限429；不会回退 get+set 或本地计数。createMemoryRateLimitStore 仅开发或显式 HAI_E2E/HAI_E2E_MOCK 测试使用，无常驻定时器，丢弃引用即可回收；每次请求最多惰性扫描 64 项，最多保存 10000 个窗口，容量满时对新 key 返回503且不驱逐有效计数，外部 store 生命周期由创建者管理；生产不得设置测试开关。响应重置时间为节点时钟估算，实际窗口由 Redis TTL 决定，须同步时钟。默认键只读取可信 adapter 的 getClientAddress、规范化等价IPv6和IPv4映射地址，不采信原始转发头；代理信任通过部署adapter配置。
+
+#### API 端点
 
 ```typescript
 import { kit } from '@h-ai/kit'
@@ -116,7 +128,7 @@ export const POST = kit.handler(async ({ request, locals }) => {
 })
 ```
 
-### 浏览器客户端
+#### 浏览器客户端
 
 `kit.client.create()` 面向 SvelteKit 同源 endpoint；Web / App / 小程序跨域访问公共 API 时，请使用 `@h-ai/api-client`。
 
@@ -137,20 +149,24 @@ const response = await apiFetch('/api/users', { method: 'GET' })
 
 > CSRF Header 注入由 `apiFetch` 自动处理；`@h-ai/kit` 不提供独立的 CSRF 中间件工厂。
 >
-> 认证建议：同源 SvelteKit endpoint 优先使用 httpOnly Cookie，由服务端读取 Cookie 完成鉴权，浏览器端不需要把敏感 Token 写入 `localStorage`。如确需注入 Bearer Header，请传入自定义 `BrowserTokenStore`，或先用 `kit.auth.setBrowserToken()` 写入页面内存后再使用 `kit.client.create({ auth: true })`。
+> 同源 SvelteKit endpoint 使用 httpOnly Cookie，由服务端读取 Cookie 完成鉴权。浏览器 Bearer Token 使用 `kit.auth.setBrowserToken()` 写入页面内存，再通过 `kit.client.create({ auth: true })` 注入。自定义 `BrowserTokenStore` 也必须使用内存或平台安全存储，禁止将敏感凭据写入 Web Storage。
 
-### 同源传输加密
+#### 同源传输加密
 
-kit 的传输加密也统一委托 `@h-ai/crypto`：服务端通过 `crypto.transport.createServer()` 创建管理器，浏览器端通过 `kit.client.installBrowserTransport(kitConfig, { crypto })` 一行安装同源 fetch 包装。应用层只配置顶层 `crypto` 句柄。
+kit 的传输加密也统一委托 `@h-ai/crypto`：服务端通过 `crypto.transport.createServer({ serverKeyRing, keyStore })` 创建管理器，浏览器端通过 `kit.client.installBrowserTransport(kitConfig, { crypto })` 一行安装同源 fetch 包装。服务端还须注入受管密钥环和共享 registry。
 
 **src/hooks.server.ts**：
 
 ```ts
 import { cache } from '@h-ai/cache'
-import { createRedisTransportKeyStore, crypto } from '@h-ai/crypto'
+import { createRedisTransportKeyStore, crypto, parseTransportServerKeyRing } from '@h-ai/crypto'
 import { kit } from '@h-ai/kit'
 
 await crypto.init()
+const ring = parseTransportServerKeyRing(process.env.HAI_CRYPTO_TRANSPORT_SERVERKEYRING)
+if (!ring.success)
+  throw new Error(ring.error.message)
+const serverKeyRing = ring.data
 await cache.init({ type: 'redis', host: '127.0.0.1', port: 6379 })
 
 export const handle = kit.createHandle({
@@ -162,7 +178,7 @@ export const handle = kit.createHandle({
   crypto: {
     crypto,
     transport: {
-      requireEncryption: true,
+      serverKeyRing,
       keyStore: createRedisTransportKeyStore({ cache, ttlSeconds: 3600 }),
     },
   },
@@ -197,13 +213,17 @@ export const { apiFetch } = kit.client.create()
 
 默认密钥协商路径为 `/api/_hai/key-exchange`。如服务端自定义 `transport.keyExchangePath`，客户端需同步配置 `transport.keyExchangeUrl`。
 
-如需多节点共享客户端公钥，可在运行时为 `kit.createHandle({ crypto: { transport: { keyStore } } })` 注入 `createRedisTransportKeyStore()` 或 `createReldbTransportKeyStore()`；这类对象型依赖**不应**写入 `_kit.yml`，配置文件仍只保存公开路径与开关。
+服务端必须显式注入相同的受管 `serverKeyRing` 和共享 `keyStore`（Redis 或共享数据库）。仅共享客户端公钥不足以跨节点解密。没有隐式进程私钥或内存 registry 回退；开发/测试显式用 `createInMemoryKeyStore(capacity)`。服务端重启后重新加载同一密钥环即可，无需 sticky session。
 
 transport 默认作用于同源 `/api/*` endpoint 与 SvelteKit `__data.json` 页面数据请求（以及密钥协商端点本身）；页面文档与静态资源仍保持明文，不要求携带 `X-Client-Id`。文件上传等 `multipart/form-data` 请求会保持原样发送，需在服务端 `excludePaths` 中显式放行对应上传路径。
 
-安全策略默认 fail-closed：`requireEncryption: true` 时，受保护路径缺少 `X-Client-Id` 会直接返回 400；服务端 transport 管理器不可用、响应体无法加密或超过单次加密上限时返回错误，不会把业务明文响应透传给客户端。`requireEncryption: false` 仅用于迁移期灰度，不建议在生产启用。
+认证协议仅支持 v2：独立随机 SM4-CBC 密钥和 HMAC-SM3 密钥由 SM2 封装，先验签、再验证 MAC，最后解密 CBC。请求由客户端私钥签名，响应由所选服务端版本签名。认证字段包括 version、direction、serverKeyId、clientId、128 位随机 requestId（兼 nonce）、issuedAt、HTTP method、pathname + 原始 search 的 SM3 pathHash，以及响应 status。请求有效期 5 分钟，未来时钟偏差最多 30 秒；共享 registry 原子消费 (clientId, requestId)，nonce 至少保留到 issuedAt + 6 分钟以覆盖节点偏差，存储故障拒绝请求。Redis 必须保留有效 nonce，使用 noeviction/可靠持久化策略；各节点时钟须同步。此能力防止同一传输消息重放，业务重试仍需自己的幂等键。
+
+空 POST 也发送空明文的认证封装；GET/HEAD 将封装放在 X-Hai-Transport 头，204/304/HEAD 等无正文响应也使用同名头承载认证封装。其它请求/响应在 JSON 正文承载封装并带 X-Encrypted: true。客户端必须关联原请求上下文和 HTTP status，缺标记、旧格式或认证失败一律 reject；明文接口只能经 excludePaths 显式排除。CORS 须允许并暴露 X-Hai-Transport。握手公钥的真实性依赖 TLS，不替代 IAM 业务授权。
+
+固定预算与 serv/客户端共享 `@h-ai/crypto` 的 `TRANSPORT_BODY_LIMITS`：握手 JSON 16 KiB，单个公钥 4 KiB，明文 1 MiB，密文 JSON 2 MiB + 32 KiB，均按实际 UTF-8 字节计数。逐块读取原始流，超限/取消立即停止、取消流并释放 reader，不克隆后完整缓冲。请求正文超限返回 413，响应超限返回 500，无效公钥返回 400。重建 Request 时保留 signal，重建请求/响应时移除旧 Content-Length/Content-Encoding。预算不属于 `_kit.yml` 或环境变量配置。
 
-### 使用 `_kit.yml` 统一 transport 配置
+#### 使用 `_kit.yml` 统一 transport 配置
 
 `@h-ai/kit` 提供 `KitConfigSchema` / `resolveKitConfig()`，方便应用用同一份 `_kit.yml`
 同时驱动 `hooks.server.ts` 与浏览器端 `kit.client.installBrowserTransport()`：
@@ -215,13 +235,10 @@ server:
 
 transport:
   keyExchangePath: /api/_hai/key-exchange
-  requireEncryption: true
-  encryptResponse: true
   excludePaths:
     - /api/storage
     - /api/public
     - /api/auth/profile/avatar
-  maxClients: 10000
 ```
 
 ```ts
@@ -236,7 +253,7 @@ export const appKitConfig = resolveKitConfig(parse(rawKitConfig) ?? {})
 如只在服务端读取配置，也可配合 `core.config.validate('kit', KitConfigSchema)` 使用。
 由于浏览器端也可能读取这份配置，`_kit.yml` 只应放公开的 server/transport 路径与开关，不要写入密钥。
 
-## 配置
+### 配置
 
 `kit.createHandle()` 配置项：
 
@@ -253,16 +270,21 @@ export const appKitConfig = resolveKitConfig(parse(rawKitConfig) ?? {})
 
 配置 `crypto.encryptedCookies` 时必须同时提供 `crypto.cookieEncryptionKey`，或设置 `HAI_KIT_COOKIE_KEY`。缺少密钥会在 `createHandle()` 时立即报错；受保护 Cookie 的明文、损坏密文或解密失败都按不存在处理，加密失败也不会回退写入明文。
 
-## 导出路径
+认证 Cookie 的 `Secure` 默认值在 `NODE_ENV` 或 `HAI_CORE_ENV` 为 `production` 时开启，`HAI_E2E` / `HAI_E2E_MOCK` 不降低 Cookie 安全要求。生产限流同样识别这两个环境标志；仅显式测试开关可放宽内存计数器限制。
+
+### 导出路径
+
+子模块运行时方法通过 `kit` 命名空间或明确子路径使用，类型单独导出；浏览器声明不暴露服务端工厂。Vite 配置使用 `@sveltejs/kit/vite`，不存在 `@h-ai/kit/vite` 插件。
 
 - `@h-ai/kit`：主入口，提供 `kit` 命名空间与类型。
 - `@h-ai/kit/client`：浏览器端客户端。
 - `@h-ai/kit/adapter`：双构建 adapter（`createAdapter()`）。
-- `@h-ai/kit/vite`：Vite 插件。
 - `@h-ai/kit/a2a`：A2A 协议集成。
 - `@h-ai/kit/crypto`：加密模块集成。
 
-## 配置驱动认证页面
+### 配置驱动认证页面
+
+密码登录只提交 `identifier` 和 `password`；`AuthPanel` 将 `LoginForm` 的 `username` 映射为 `identifier`。会话有效期由服务端 `session.maxAge` / `session.refreshTokenMaxAge` 配置决定，登录表单不提供按次登录的持久会话选项。
 
 协议支持配置中的 userAgreementMarkdown/privacyPolicyMarkdown 正文及 URL；同主题优先 Markdown，由安全渲染器在弹窗显示。
 
@@ -270,22 +292,32 @@ export const appKitConfig = resolveKitConfig(parse(rawKitConfig) ?? {})
 
 [完整 IAM 配置 / IAM configuration](../iam/README.md)
 
-## 错误处理
+`kit.auth.logout(cookies, accessToken)` 返回 `Promise<HaiResult<void>>`。无令牌时仅清除 Cookie 并成功；有令牌但未配置认证操作时返回失败。无论服务端结果如何都清除本地 Cookie，调用方仍必须把失败转换为错误响应或提示；仅成功结果代表服务端撤销已经确认。底层控制流异常继续传播。
+
+### 错误处理
 
 - 推荐使用 `kit.handler()` 包装 API 端点。
 - `kit.validate.body` / `kit.guard.require` 会抛出 `Response`（SvelteKit 控制流）。
 - 非控制流异常会由 `kit.handler()` 统一转换为 `500 INTERNAL_ERROR` 响应。
 
-## 测试
+### CRUD fields
+
+声明式 CRUD 字段支持 `colSpan: 'auto' | 1 | 2`，供 UI 双列表单决定字段宽度；`validation.message` 支持字符串或 `() => string`，便于随当前语言显示校验错误。UI 布局在 `CrudPage.form` 上配置，服务端仍须独立校验。
+
+### 请求语言隔离
+
+Node 请求与 SSR 使用 `core.i18n.runWithLocale(locale, () => handleRequest())`；SvelteKit 可使用 `kit.i18n.runWithLocale(locale, () => resolve(event))`，serv 自动按请求头建立上下文。异步子任务继承请求语言，优先级为显式 `MessageOptions.locale`、请求语言、进程启动默认语言。`setGlobalLocale` 在请求上下文中只更新当前请求；上下文外仅用于启动默认值，不能在请求 hook 中调用它修改默认值。
+
+浏览器继续使用应用级 `setGlobalLocale` / `createLocaleStore`。SSR 的 UI store 初始化和 setter 只修改自身状态，不写全局语言；UI 消息从请求上下文读取。`runWithLocale` 仅支持 Node 入口，浏览器通过显式 locale 或应用状态翻译。
+
+## 开发测试
 
 ```bash
 pnpm --filter @h-ai/kit test
 ```
 
-## License
+模块无统一 init/close；共享缓存、IAM 与 crypto 由应用启动时初始化并统一关闭。示例使用真实公开入口并作类型检查，见[模块 JSDoc 约定](../../.agents/instructions/module-conventions.md#jsdoc-与示例验证)。请求认证必须调用 iam.auth.verifyToken，不能把非空 token 视为有效身份。
 
-Apache-2.0
-
-## CRUD fields
+## 许可证
 
-声明式 CRUD 字段支持 `colSpan: 'auto' | 1 | 2`，供 UI 双列表单决定字段宽度；`validation.message` 支持字符串或 `() => string`，便于随当前语言显示校验错误。UI 布局在 `CrudPage.form` 上配置，服务端仍须独立校验。
+Apache-2.0

package/dist/adapter/index.d.ts

@@ -13,14 +13,22 @@ import * as _sveltejs_kit from '@sveltejs/kit';
  *
  * export default {
  *   kit: {
- *     adapter: createAdapter(),
+ *     adapter: await createAdapter(),
  *   },
  * }
  * ```
  *
  * @module kit-adapter
  */
-/** 双构建适配器配置 */
+/**
+ * 双构建适配器配置
+ * @example 模块内部上下文
+ * ```ts
+ * const options: AdapterOptions = {}
+ * const adapter = await createAdapter(options)
+ * void adapter
+ * ```
+ */
 interface AdapterOptions {
     /** adapter-node 输出目录，默认 `'build'` */
     nodeBuildDir?: string;
@@ -38,6 +46,13 @@ interface AdapterOptions {
  *
  * **注意**：adapter-node / adapter-static 仍然需要在应用的 devDependencies 中声明。
  * 本函数只做动态 import + 统一配置。
+ * @param options - Node/static 输出目录和 SPA fallback；应用仍需安装对应适配器。
+ * @returns 按 VITE_ADAPTER 选择的 SvelteKit adapter；缺失依赖时拒绝 Promise。
+ * @example 模块内部上下文
+ * ```ts
+ * const adapter = await createAdapter({})
+ * void adapter
+ * ```
  */
 declare function createAdapter(options?: AdapterOptions): Promise<_sveltejs_kit.Adapter>;
 

package/dist/adapter/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/kit-adapter.ts"],"names":[],"mappings":";;;AA2CA,eAAsB,cAAc,OAAA,EAA0B;AAC5D,EAAA,MAAM;AAAA,IACJ,YAAA,GAAe,OAAA;AAAA,IACf,cAAA,GAAiB,cAAA;AAAA,IACjB,cAAA,GAAiB;AAAA,GACnB,GAAI,WAAW,EAAC;AAEhB,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,YAAA,IAAgB,MAAA;AAEzC,EAAA,IAAI,SAAS,QAAA,EAAU;AACrB,IAAA,MAAM,EAAE,OAAA,EAAS,aAAA,EAAc,GAAI,MAAM,OAAO,0BAA0B,CAAA;AAC1E,IAAA,OAAO,aAAA,CAAc;AAAA,MACnB,KAAA,EAAO,cAAA;AAAA,MACP,MAAA,EAAQ,cAAA;AAAA,MACR,QAAA,EAAU,cAAA;AAAA,MACV,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,EACH;AAGA,EAAA,MAAM,EAAE,OAAA,EAAS,WAAA,EAAY,GAAI,MAAM,OAAO,wBAAwB,CAAA;AACtE,EAAA,OAAO,WAAA,CAAY;AAAA,IACjB,GAAA,EAAK;AAAA,GACN,CAAA;AACH","file":"index.js","sourcesContent":["/**\n * SvelteKit 双构建模式 — 适配器工厂\n *\n * 根据 `VITE_ADAPTER` 环境变量自动选择 adapter-node 或 adapter-static，\n * 使同一个 SvelteKit 应用能同时产出 SSR（Web + API）和 SPA（H5/App）两种构建产物。\n *\n * @example\n * ```js\n * // svelte.config.js\n * import { createAdapter } from '@h-ai/kit/adapter'\n *\n * export default {\n *   kit: {\n *     adapter: createAdapter(),\n *   },\n * }\n * ```\n *\n * @module kit-adapter\n */\n\nimport process from 'node:process'\n\n/** 双构建适配器配置 */\nexport interface AdapterOptions {\n  /** adapter-node 输出目录，默认 `'build'` */\n  nodeBuildDir?: string\n  /** adapter-static 输出目录，默认 `'build-static'` */\n  staticBuildDir?: string\n  /** adapter-static 的 SPA fallback 页面，默认 `'index.html'` */\n  staticFallback?: string\n}\n\n/**\n * 根据环境变量 `VITE_ADAPTER` 选择 SvelteKit adapter\n *\n * - `VITE_ADAPTER=node`   → `@sveltejs/adapter-node`（SSR + API）\n * - `VITE_ADAPTER=static` → `@sveltejs/adapter-static`（SPA，可被 Capacitor 包装）\n * - 未设置时默认使用 `node`\n *\n * **注意**：adapter-node / adapter-static 仍然需要在应用的 devDependencies 中声明。\n * 本函数只做动态 import + 统一配置。\n */\nexport async function createAdapter(options?: AdapterOptions) {\n  const {\n    nodeBuildDir = 'build',\n    staticBuildDir = 'build-static',\n    staticFallback = 'index.html',\n  } = options ?? {}\n\n  const mode = process.env.VITE_ADAPTER ?? 'node'\n\n  if (mode === 'static') {\n    const { default: adapterStatic } = await import('@sveltejs/adapter-static')\n    return adapterStatic({\n      pages: staticBuildDir,\n      assets: staticBuildDir,\n      fallback: staticFallback,\n      precompress: false,\n    })\n  }\n\n  // 默认 node\n  const { default: adapterNode } = await import('@sveltejs/adapter-node')\n  return adapterNode({\n    out: nodeBuildDir,\n  })\n}\n"]}
+{"version":3,"sources":["../../src/kit-adapter.ts"],"names":[],"mappings":";;;AA0DA,eAAsB,cAAc,OAAA,EAA0B;AAC5D,EAAA,MAAM;AAAA,IACJ,YAAA,GAAe,OAAA;AAAA,IACf,cAAA,GAAiB,cAAA;AAAA,IACjB,cAAA,GAAiB;AAAA,GACnB,GAAI,WAAW,EAAC;AAEhB,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,YAAA,IAAgB,MAAA;AAEzC,EAAA,IAAI,SAAS,QAAA,EAAU;AACrB,IAAA,MAAM,EAAE,OAAA,EAAS,aAAA,EAAc,GAAI,MAAM,OAAO,0BAA0B,CAAA;AAC1E,IAAA,OAAO,aAAA,CAAc;AAAA,MACnB,KAAA,EAAO,cAAA;AAAA,MACP,MAAA,EAAQ,cAAA;AAAA,MACR,QAAA,EAAU,cAAA;AAAA,MACV,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,EACH;AAGA,EAAA,MAAM,EAAE,OAAA,EAAS,WAAA,EAAY,GAAI,MAAM,OAAO,wBAAwB,CAAA;AACtE,EAAA,OAAO,WAAA,CAAY;AAAA,IACjB,GAAA,EAAK;AAAA,GACN,CAAA;AACH","file":"index.js","sourcesContent":["/**\n * SvelteKit 双构建模式 — 适配器工厂\n *\n * 根据 `VITE_ADAPTER` 环境变量自动选择 adapter-node 或 adapter-static，\n * 使同一个 SvelteKit 应用能同时产出 SSR（Web + API）和 SPA（H5/App）两种构建产物。\n *\n * @example\n * ```js\n * // svelte.config.js\n * import { createAdapter } from '@h-ai/kit/adapter'\n *\n * export default {\n *   kit: {\n *     adapter: await createAdapter(),\n *   },\n * }\n * ```\n *\n * @module kit-adapter\n */\n\nimport process from 'node:process'\n\n/**\n * 双构建适配器配置\n * @example 模块内部上下文\n * ```ts\n * const options: AdapterOptions = {}\n * const adapter = await createAdapter(options)\n * void adapter\n * ```\n */\nexport interface AdapterOptions {\n  /** adapter-node 输出目录，默认 `'build'` */\n  nodeBuildDir?: string\n  /** adapter-static 输出目录，默认 `'build-static'` */\n  staticBuildDir?: string\n  /** adapter-static 的 SPA fallback 页面，默认 `'index.html'` */\n  staticFallback?: string\n}\n\n/**\n * 根据环境变量 `VITE_ADAPTER` 选择 SvelteKit adapter\n *\n * - `VITE_ADAPTER=node`   → `@sveltejs/adapter-node`（SSR + API）\n * - `VITE_ADAPTER=static` → `@sveltejs/adapter-static`（SPA，可被 Capacitor 包装）\n * - 未设置时默认使用 `node`\n *\n * **注意**：adapter-node / adapter-static 仍然需要在应用的 devDependencies 中声明。\n * 本函数只做动态 import + 统一配置。\n * @param options - Node/static 输出目录和 SPA fallback；应用仍需安装对应适配器。\n * @returns 按 VITE_ADAPTER 选择的 SvelteKit adapter；缺失依赖时拒绝 Promise。\n * @example 模块内部上下文\n * ```ts\n * const adapter = await createAdapter({})\n * void adapter\n * ```\n */\nexport async function createAdapter(options?: AdapterOptions) {\n  const {\n    nodeBuildDir = 'build',\n    staticBuildDir = 'build-static',\n    staticFallback = 'index.html',\n  } = options ?? {}\n\n  const mode = process.env.VITE_ADAPTER ?? 'node'\n\n  if (mode === 'static') {\n    const { default: adapterStatic } = await import('@sveltejs/adapter-static')\n    return adapterStatic({\n      pages: staticBuildDir,\n      assets: staticBuildDir,\n      fallback: staticFallback,\n      precompress: false,\n    })\n  }\n\n  // 默认 node\n  const { default: adapterNode } = await import('@sveltejs/adapter-node')\n  return adapterNode({\n    out: nodeBuildDir,\n  })\n}\n"]}

package/dist/browser.d.ts

@@ -1,7 +1,7 @@
-import { c as createKitClient, a as createKitAuthActions, i as installBrowserTransport, b as installBrowserTransportFetch, s as setBrowserToken, d as clearBrowserToken, e as createTokenStore } from './index-B7s-0mZl.js';
-export { C as ClientTransportConfig, K as KitClient, f as KitClientConfig, g as KitConfig, h as KitConfigInput, j as KitConfigSchema, k as KitServerConfig, l as KitServerConfigInput, m as KitTransportConfig, n as KitTransportConfigInput, o as createSvelteKitNavAdapter, r as resolveKitConfig, p as resolveKitTransportConfig } from './index-B7s-0mZl.js';
-import { d as defineCrud, s as setAllModulesLocale } from './kit-i18n-D9Qqk-1k.js';
-export { A as ApiResponse, a as AuthOperations, b as AuthOperationsProvider, C as CorsConfig, F as FormError, c as FormValidationResult, G as GuardConfig, d as GuardResult, H as HaiRequestEvent, e as HandleA2AConfig, f as HandleA2AOperations, g as HandleAuthConfig, h as HandleConfig, i as HookCryptoConfig, M as Middleware, j as MiddlewareContext, R as RateLimitConfig, k as RouteGuard, S as SessionData, l as SessionLike, T as TransportEncryptionOptions } from './kit-types-ByWdbCeO.js';
+import { c as createKitClient, a as createKitAuthActions, i as installBrowserTransport, b as installBrowserTransportFetch, s as setBrowserToken, d as clearBrowserToken } from './kit-client-auth-HnZIYUia.js';
+export { C as ClientTransportConfig, K as KitClient, e as KitClientConfig, f as KitConfig, g as KitConfigInput, h as KitConfigSchema, j as KitServerConfig, k as KitServerConfigInput, l as KitTransportConfig, m as KitTransportConfigInput, r as resolveKitConfig, n as resolveKitTransportConfig } from './kit-client-auth-HnZIYUia.js';
+import { d as defineCrud, s as setAllModulesLocale } from './kit-i18n-DEzmzE5T.js';
+export { A as ApiResponse, a as AuthOperations, b as AuthOperationsProvider, C as CorsConfig, F as FormError, c as FormValidationResult, G as GuardConfig, d as GuardResult, H as HaiRequestEvent, e as HandleA2AConfig, f as HandleA2AOperations, g as HandleAuthConfig, h as HandleConfig, i as HookCryptoConfig, M as Middleware, j as MiddlewareContext, R as RateLimitConfig, k as RouteGuard, S as SessionData, l as SessionLike, T as TransportEncryptionOptions } from './kit-types-CnzhN-AS.js';
 import '@h-ai/api-contract';
 import '@h-ai/core';
 import '@h-ai/crypto';
@@ -18,6 +18,13 @@ import '@sveltejs/kit';
 
 /**
  * 浏览器端 kit 对象（仅暴露 client-safe 能力）
+ * @example
+ * ```ts
+ * import { kit } from '@h-ai/kit'
+ *
+ * const client = kit.client.create({ auth: true })
+ * client.destroy()
+ * ```
  */
 declare const kit: {
     client: {
@@ -32,11 +39,10 @@ declare const kit: {
     auth: {
         setBrowserToken: typeof setBrowserToken;
         clearBrowserToken: typeof clearBrowserToken;
-        createTokenStore: typeof createTokenStore;
     };
     i18n: {
         setLocale: typeof setAllModulesLocale;
     };
 };
 
-export { createKitAuthActions, createKitClient, installBrowserTransport, installBrowserTransportFetch, kit };
+export { kit };

package/dist/browser.js

@@ -1,8 +1,8 @@
-import { defineCrud } from './chunk-L7BTMAKX.js';
-export { KitConfigSchema, resolveKitConfig, resolveKitTransportConfig } from './chunk-L7BTMAKX.js';
-import { createTokenStore, clearBrowserToken, setBrowserToken, installBrowserTransportFetch, installBrowserTransport, createKitAuthActions, createKitClient } from './chunk-VOTDAVCB.js';
-import './chunk-NVYIUBU7.js';
-import { setAllModulesLocale } from './chunk-QHYNL24G.js';
+import { defineCrud } from './chunk-P6XH7G4N.js';
+export { KitConfigSchema, resolveKitConfig, resolveKitTransportConfig } from './chunk-P6XH7G4N.js';
+import { clearBrowserToken, setBrowserToken, installBrowserTransportFetch, installBrowserTransport, createKitAuthActions, createKitClient } from './chunk-2YYRP7HH.js';
+import './chunk-XC7I2L3G.js';
+import { setAllModulesLocale } from './chunk-OVRZIDCD.js';
 
 // src/browser.ts
 var kit = {
@@ -17,8 +17,7 @@ var kit = {
   },
   auth: {
     setBrowserToken,
-    clearBrowserToken,
-    createTokenStore
+    clearBrowserToken
   },
   i18n: {
     setLocale: setAllModulesLocale

package/dist/browser.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/browser.ts"],"names":[],"mappings":";;;;;;;AAiBO,IAAM,GAAA,GAAM;AAAA,EACjB,MAAA,EAAQ;AAAA,IACN,MAAA,EAAQ,eAAA;AAAA,IACR,iBAAA,EAAmB,oBAAA;AAAA,IACnB,uBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,MAAA,EAAQ;AAAA,GACV;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,eAAA;AAAA,IACA,iBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,SAAA,EAAW;AAAA;AAEf","file":"browser.js","sourcesContent":["/**\n * @h-ai/kit — 浏览器入口\n *\n * 为客户端提供精简且安全的运行时导出，避免将服务端 Hook/A2A/IAM 运行时代码打入浏览器包。\n * @module browser\n */\n\nimport { createKitAuthActions } from './client/kit-client-auth.js'\nimport { createKitClient, installBrowserTransport, installBrowserTransportFetch } from './client/kit-client.js'\nimport { defineCrud } from './crud/kit-crud.js'\nimport { clearBrowserToken, createTokenStore, setBrowserToken } from './kit-auth.js'\nimport { KitConfigSchema, resolveKitConfig, resolveKitTransportConfig } from './kit-config.js'\nimport { setAllModulesLocale } from './kit-i18n.js'\n\n/**\n * 浏览器端 kit 对象（仅暴露 client-safe 能力）\n */\nexport const kit = {\n  client: {\n    create: createKitClient,\n    createAuthActions: createKitAuthActions,\n    installBrowserTransport,\n    installBrowserTransportFetch,\n  },\n  crud: {\n    define: defineCrud,\n  },\n  auth: {\n    setBrowserToken,\n    clearBrowserToken,\n    createTokenStore,\n  },\n  i18n: {\n    setLocale: setAllModulesLocale,\n  },\n}\n\nexport { KitConfigSchema, resolveKitConfig, resolveKitTransportConfig }\n\nexport type * from './client/index.js'\nexport type * from './kit-types.js'\n"]}
+{"version":3,"sources":["../src/browser.ts"],"names":[],"mappings":";;;;;;;AAwBO,IAAM,GAAA,GAAM;AAAA,EACjB,MAAA,EAAQ;AAAA,IACN,MAAA,EAAQ,eAAA;AAAA,IACR,iBAAA,EAAmB,oBAAA;AAAA,IACnB,uBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,MAAA,EAAQ;AAAA,GACV;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,eAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,SAAA,EAAW;AAAA;AAEf","file":"browser.js","sourcesContent":["/**\n * @h-ai/kit — 浏览器入口\n *\n * 为客户端提供精简且安全的运行时导出，避免将服务端 Hook/A2A/IAM 运行时代码打入浏览器包。\n * @module browser\n */\n\nimport { createKitAuthActions } from './client/kit-client-auth.js'\nimport { createKitClient, installBrowserTransport, installBrowserTransportFetch } from './client/kit-client.js'\nimport { defineCrud } from './crud/kit-crud.js'\nimport { clearBrowserToken, setBrowserToken } from './kit-auth.js'\nimport { KitConfigSchema, resolveKitConfig, resolveKitTransportConfig } from './kit-config.js'\nimport { setAllModulesLocale } from './kit-i18n.js'\n\n/**\n * 浏览器端 kit 对象（仅暴露 client-safe 能力）\n * @example\n * ```ts\n * import { kit } from '@h-ai/kit'\n *\n * const client = kit.client.create({ auth: true })\n * client.destroy()\n * ```\n */\nexport const kit = {\n  client: {\n    create: createKitClient,\n    createAuthActions: createKitAuthActions,\n    installBrowserTransport,\n    installBrowserTransportFetch,\n  },\n  crud: {\n    define: defineCrud,\n  },\n  auth: {\n    setBrowserToken,\n    clearBrowserToken,\n  },\n  i18n: {\n    setLocale: setAllModulesLocale,\n  },\n}\n\nexport { KitConfigSchema, resolveKitConfig, resolveKitTransportConfig }\n\nexport type {\n  ClientTransportConfig,\n  KitClient,\n  KitClientConfig,\n} from './client/index.js'\nexport type {\n  ApiResponse,\n  AuthOperations,\n  AuthOperationsProvider,\n  CorsConfig,\n  FormError,\n  FormValidationResult,\n  GuardConfig,\n  GuardResult,\n  HaiRequestEvent,\n  HandleA2AConfig,\n  HandleA2AOperations,\n  HandleAuthConfig,\n  HandleConfig,\n  HookCryptoConfig,\n  KitConfig,\n  KitConfigInput,\n  KitServerConfig,\n  KitServerConfigInput,\n  KitTransportConfig,\n  KitTransportConfigInput,\n  Middleware,\n  MiddlewareContext,\n  RateLimitConfig,\n  RouteGuard,\n  SessionData,\n  SessionLike,\n  TransportEncryptionOptions,\n} from './kit-types.js'\n"]}

package/dist/{chunk-DVW7CQ3H.js → chunk-2PWGJCWX.js}

@@ -1,4 +1,4 @@
-import { kitM } from './chunk-QHYNL24G.js';
+import { kitM } from './chunk-OVRZIDCD.js';
 import { iam } from '@h-ai/iam';
 
 function createA2AApiKeyAuthenticator(config) {
@@ -137,5 +137,5 @@ async function handleA2ARequest(event, requestId, config) {
 }
 
 export { createA2AApiKeyAuthenticator, createA2AHandler, createAgentCardHandler, handleA2ARequest, resolveA2AConfig };
-//# sourceMappingURL=chunk-DVW7CQ3H.js.map
-//# sourceMappingURL=chunk-DVW7CQ3H.js.map
+//# sourceMappingURL=chunk-2PWGJCWX.js.map
+//# sourceMappingURL=chunk-2PWGJCWX.js.map

package/dist/chunk-2PWGJCWX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/modules/a2a/kit-a2a-auth.ts","../src/modules/a2a/kit-a2a-helpers.ts","../src/modules/a2a/kit-a2a-handle.ts"],"names":[],"mappings":";;;AA8CO,SAAS,6BACd,MAAA,EACkE;AAClE,EAAA,OAAO,OAAO,KAAA,KAAwB;AACpC,IAAA,MAAM,SAAS,MAAA,CAAO,EAAA,KAAO,QAAA,GACzB,KAAA,CAAM,QAAQ,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,IAAI,IACrC,KAAA,CAAM,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAO,IAAI,CAAA;AAE1C,IAAA,IAAI,CAAC,MAAA;AACH,MAAA,OAAO,IAAA;AAET,IAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,MAAA,CAAO,aAAa,MAAM,CAAA;AACnD,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA;AACV,MAAA,OAAO,IAAA;AAET,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,OAAO,IAAA,CAAK,MAAA;AAAA,MACrB,QAAA,EAAU,OAAO,IAAA,CAAK,EAAA;AAAA,MACtB,MAAA,EAAQ,OAAO,IAAA,CAAK;AAAA,KACtB;AAAA,EACF,CAAA;AACF;;;ACzCO,SAAS,uBACd,YAAA,EACgB;AAChB,EAAA,OAAO,YAAY;AACjB,IAAA,MAAM,OAAO,YAAA,EAAa;AAC1B,IAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG;AAAA,MACxC,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,KAC/C,CAAA;AAAA,EACH,CAAA;AACF;AAkBO,SAAS,gBAAA,CACd,eAKA,MAAA,EACgB;AAChB,EAAA,OAAO,OAAO,KAAA,KAAwB;AAEpC,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI,QAAQ,YAAA,EAAc;AACxB,MAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO,YAAA,KAAiB,UAAA,GAC1C,MAAA,CAAO,YAAA,GACP,4BAAA,CAA6B,EAAE,EAAA,EAAI,QAAA,EAAU,IAAA,EAAM,aAAa,CAAA;AACpE,MAAA,MAAM,UAAA,GAAa,MAAM,MAAA,CAAO,KAAK,CAAA;AACrC,MAAA,IAAI,CAAC,UAAA;AACH,QAAA,OAAO,SAAS,IAAA,CAAK,EAAE,KAAA,EAAO,EAAE,MAAM,iBAAA,EAAmB,OAAA,EAAS,IAAA,CAAK,mBAAmB,GAAE,EAAE,EAAG,EAAE,MAAA,EAAQ,KAAK,CAAA;AAClH,MAAA,OAAA,GAAU,UAAA;AAAA,IACZ;AAGA,IAAA,IAAI,WAAA;AACJ,IAAA,IAAI;AACF,MAAA,WAAA,GAAc,MAAM,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAK;AAAA,IACzC,CAAA,CAAA,MACM;AACJ,MAAA,OAAO,QAAA,CAAS,KAAK,EAAE,OAAA,EAAS,OAAO,EAAA,EAAI,IAAA,EAAM,OAAO,EAAE,IAAA,EAAM,QAAQ,OAAA,EAAS,IAAA,CAAK,mBAAmB,CAAA,EAAE,IAAK,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,IACjI;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,WAAA,EAAa,OAAO,CAAA;AAEvD,IAAA,IAAI,MAAA,CAAO,SAAA,IAAa,MAAA,CAAO,MAAA,EAAQ;AAErC,MAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AACtB,MAAA,MAAM,cAAA,GAAiB,IAAI,cAAA,CAAe;AAAA;AAAA,QAExC,MAAM,KAAK,UAAA,EAAY;AACrB,UAAA,IAAI;AACF,YAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,IAAA,EAAK;AAChC,YAAA,IAAI,KAAA,CAAM,IAAA;AACR,cAAA,UAAA,CAAW,KAAA,EAAM;AAAA;AAEjB,cAAA,UAAA,CAAW,OAAA,CAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,SAAS,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,KAAK,CAAC;;AAAA,CAAM,CAAC,CAAA;AAAA,UAC3F,SACO,KAAA,EAAO;AACZ,YAAA,UAAA,CAAW,MAAM,KAAK,CAAA;AAAA,UACxB;AAAA,QACF,CAAA;AAAA,QACA,MAAM,MAAA,GAAS;AACb,UAAA,MAAM,OAAO,MAAA,EAAO;AAAA,QACtB;AAAA,OACD,CAAA;AAED,MAAA,OAAO,IAAI,SAAS,cAAA,EAAgB;AAAA,QAClC,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,mBAAA;AAAA,UAChB,eAAA,EAAiB,UAAA;AAAA,UACjB,YAAA,EAAc;AAAA;AAChB,OACD,CAAA;AAAA,IACH;AAGA,IAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,IAAI,CAAA,EAAG;AAAA,MAC/C,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,KAC/C,CAAA;AAAA,EACH,CAAA;AACF;;;ACvEO,SAAS,iBACd,KAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,KAAA;AACH,IAAA,OAAO,IAAA;AAGT,EAAA,IAAI,cAAA,IAAkB,KAAA,IAAS,eAAA,IAAmB,KAAA,EAAO;AACvD,IAAA,OAAO;AAAA,MACL,UAAA,EAAY,KAAA;AAAA,MACZ,QAAA,EAAU,8BAAA;AAAA,MACV,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,GAAA,GAAM,KAAA;AACZ,EAAA,OAAO;AAAA,IACL,YAAY,GAAA,CAAI,UAAA;AAAA,IAChB,QAAA,EAAU,IAAI,QAAA,IAAY,8BAAA;AAAA,IAC1B,OAAA,EAAS,IAAI,OAAA,IAAW,MAAA;AAAA,IACxB,YAAA,EAAc,mBAAA,CAAoB,GAAA,CAAI,YAAA,EAAc,IAAI,UAAU;AAAA,GACpE;AACF;AASA,SAAS,mBAAA,CACP,cACA,UAAA,EACmC;AACnC,EAAA,IAAI,CAAC,YAAA;AACH,IAAA,OAAO,MAAA;AAET,EAAA,IAAI,OAAO,YAAA,KAAiB,UAAA;AAC1B,IAAA,OAAO,YAAA;AAGT,EAAA,MAAM,UAAA,GAAa,WAAW,YAAA,EAAa;AAC3C,EAAA,MAAM,kBAAkB,UAAA,CAAW,OAAA,IAAW,WAAW,IAAA,GACpD,UAAA,CAAW,KAA4F,eAAA,GACxG,MAAA;AACJ,EAAA,MAAM,YAAY,eAAA,EAAiB,MAAA;AAEnC,EAAA,OAAO,4BAAA,CAA6B;AAAA,IAClC,EAAA,EAAI,SAAA,EAAW,EAAA,KAAO,OAAA,GAAU,OAAA,GAAU,QAAA;AAAA,IAC1C,IAAA,EAAM,WAAW,IAAA,IAAQ;AAAA,GAC1B,CAAA;AACH;AAqBA,eAAsB,gBAAA,CACpB,KAAA,EACA,SAAA,EACA,MAAA,EAC0B;AAC1B,EAAA,MAAM,EAAE,QAAA,EAAS,GAAI,KAAA,CAAM,GAAA;AAG3B,EAAA,IAAI,aAAa,MAAA,CAAO,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,WAAW,KAAA,EAAO;AAClE,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,UAAA,CAAW,YAAA,EAAa;AAC9C,IAAA,IAAI,OAAO,OAAA,EAAS;AAClB,MAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,IAAI,CAAA,EAAG;AAAA,QAC/C,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,gBAAgB,SAAA;AAAU,OAC1E,CAAA;AAAA,IACH;AACA,IAAA,OAAO,IAAI,QAAA;AAAA,MACT,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,EAAE,IAAA,EAAM,oBAAA,EAAsB,OAAA,EAAS,IAAA,CAAK,wBAAwB,CAAA,EAAE,EAAG,CAAA;AAAA,MACjG,EAAE,QAAQ,GAAA,EAAK,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,cAAA,EAAgB,SAAA,EAAU;AAAE,KAC5F;AAAA,EACF;AAGA,EAAA,IAAI,aAAa,MAAA,CAAO,OAAA,IAAW,KAAA,CAAM,OAAA,CAAQ,WAAW,MAAA,EAAQ;AAElE,IAAA,MAAM,OAAA,GAAU,gBAAA;AAAA,MACd,CAAC,IAAA,EAAM,OAAA,KAAY,OAAO,UAAA,CAAW,aAAA,CAAc,MAAM,OAAO,CAAA;AAAA,MAChE,EAAE,YAAA,EAAc,MAAA,CAAO,YAAA;AAAa,KACtC;AACA,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,KAAK,CAAA;AACpC,IAAA,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAA,EAAgB,SAAS,CAAA;AAC9C,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA;AACT","file":"chunk-2PWGJCWX.js","sourcesContent":["/**\n * @h-ai/kit — A2A API Key 认证器\n *\n * 从请求头或 query 参数中提取 API Key，调用 IAM apiKey.verifyApiKey 验证。\n * @module kit-a2a-auth\n */\n\nimport type { RequestEvent } from '@sveltejs/kit'\nimport { iam } from '@h-ai/iam'\n\n/**\n * A2A API Key 认证器配置\n * @example\n * ```ts\n * import type { A2AApiKeyAuthConfig } from '@h-ai/kit'\n *\n * const value: A2AApiKeyAuthConfig = { in: 'header', name: 'X-Agent-Key' }\n * void value\n * ```\n */\nexport interface A2AApiKeyAuthConfig {\n  /** API Key 的传递位置 */\n  in: 'header' | 'query'\n  /** 参数名 */\n  name: string\n}\n\n/**\n * 创建 A2A API Key 认证函数\n *\n * 根据配置从请求头或 query 参数中提取 API Key，\n * 通过 `iam.apiKey.verifyApiKey()` 验证后返回调用方上下文。\n *\n * - 无 API Key → 返回 `null`（由调用方拒绝请求）\n * - 验证失败 → 返回 `null`（拒绝）\n * - 验证成功 → 返回 `{ agentId, apiKeyId, scopes }`\n *\n * @param config - API Key 提取配置\n * @returns authenticate 函数，可直接赋给 HandleA2AConfig.authenticate\n * @example 模块内部上下文\n * ```ts\n * const authenticate = createA2AApiKeyAuthenticator({ in: 'header', name: 'X-Agent-Key' })\n * // 应用先初始化 IAM；拒绝返回 null，交给路由转为 401。\n * void authenticate\n * ```\n */\nexport function createA2AApiKeyAuthenticator(\n  config: A2AApiKeyAuthConfig,\n): (event: RequestEvent) => Promise<Record<string, unknown> | null> {\n  return async (event: RequestEvent) => {\n    const rawKey = config.in === 'header'\n      ? event.request.headers.get(config.name)\n      : event.url.searchParams.get(config.name)\n\n    if (!rawKey)\n      return null\n\n    const result = await iam.apiKey.verifyApiKey(rawKey)\n    if (!result.success)\n      return null\n\n    return {\n      agentId: result.data.userId,\n      apiKeyId: result.data.id,\n      scopes: result.data.scopes,\n    }\n  }\n}\n","/**\n * @h-ai/kit — A2A 路由处理器\n *\n * 提供 SvelteKit 路由工厂：Agent Card 端点和 JSON-RPC 处理端点。\n * @module kit-a2a-helpers\n */\n\nimport type { RequestEvent, RequestHandler } from '@sveltejs/kit'\n\nimport type { KitA2AHandlerConfig } from './kit-a2a-types.js'\nimport { kitM } from '../../kit-i18n.js'\nimport { createA2AApiKeyAuthenticator } from './kit-a2a-auth.js'\n\n/**\n * 创建 Agent Card GET 处理器\n *\n * 返回当前 Agent 的 Agent Card（JSON），通常挂载在 `/.well-known/agent-card.json`。\n *\n * @param getAgentCard - 获取 Agent Card 的回调（通常调用 `ai.a2a.getAgentCard()`）\n * @returns SvelteKit GET 处理器\n * @example 模块内部上下文\n * ```ts\n * const handler = createAgentCardHandler(() => ({ name: 'Example agent', url: 'https://agent.example.com/a2a' }))\n * void handler\n * ```\n */\nexport function createAgentCardHandler(\n  getAgentCard: () => object,\n): RequestHandler {\n  return async () => {\n    const card = getAgentCard()\n    return new Response(JSON.stringify(card), {\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n}\n\n/**\n * 创建 A2A JSON-RPC POST 处理器\n *\n * 将 SvelteKit Request 转换为 JSON-RPC body，委托给 `handleRequest` 回调处理。\n * 支持单条响应和流式（SSE）响应。\n *\n * @param handleRequest - JSON-RPC 请求处理回调（通常调用 `ai.a2a.handleRequest()`）\n * @param config - 可选配置（认证等）\n * @returns SvelteKit POST 处理器\n * @example 模块内部上下文\n * ```ts\n * function build(operations: Parameters<typeof createA2AHandler>[0]) {\n *   return createA2AHandler(operations, { authenticate: async () => null })\n * }\n * ```\n */\nexport function createA2AHandler(\n  handleRequest: (body: unknown, context?: Record<string, unknown>) => Promise<{\n    streaming: boolean\n    body?: unknown\n    stream?: AsyncGenerator<unknown, void, undefined>\n  }>,\n  config?: KitA2AHandlerConfig,\n): RequestHandler {\n  return async (event: RequestEvent) => {\n    // 可选认证\n    let context: Record<string, unknown> | undefined\n    if (config?.authenticate) {\n      const authFn = typeof config.authenticate === 'function'\n        ? config.authenticate\n        : createA2AApiKeyAuthenticator({ in: 'header', name: 'x-api-key' })\n      const authResult = await authFn(event)\n      if (!authResult)\n        return Response.json({ error: { code: 'A2A_AUTH_FAILED', message: kitM('kit_a2aAuthFailed') } }, { status: 401 })\n      context = authResult\n    }\n\n    // 解析 JSON-RPC 请求体\n    let requestBody: unknown\n    try {\n      requestBody = await event.request.json()\n    }\n    catch {\n      return Response.json({ jsonrpc: '2.0', id: null, error: { code: -32700, message: kitM('kit_a2aParseError') } }, { status: 400 })\n    }\n    const result = await handleRequest(requestBody, context)\n\n    if (result.streaming && result.stream) {\n      // 流式响应：SSE 格式\n      const stream = result.stream\n      const readableStream = new ReadableStream({\n        // 按下游拉取推进迭代，避免 start 中无界预读；断开时释放生成器。\n        async pull(controller) {\n          try {\n            const chunk = await stream.next()\n            if (chunk.done)\n              controller.close()\n            else\n              controller.enqueue(new TextEncoder().encode(`data: ${JSON.stringify(chunk.value)}\\n\\n`))\n          }\n          catch (error) {\n            controller.error(error)\n          }\n        },\n        async cancel() {\n          await stream.return()\n        },\n      })\n\n      return new Response(readableStream, {\n        headers: {\n          'Content-Type': 'text/event-stream',\n          'Cache-Control': 'no-cache',\n          'Connection': 'keep-alive',\n        },\n      })\n    }\n\n    // 单条响应\n    return new Response(JSON.stringify(result.body), {\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n}\n","/**\n * @h-ai/kit — A2A Handle 拦截器\n *\n * 在 SvelteKit Handle Hook 中拦截 A2A 端点（Agent Card 发现 + JSON-RPC 处理），\n * 自动处理请求并返回 Response，不匹配时返回 null 由 Handle 继续后续流程。\n * @module kit-a2a-handle\n */\n\nimport type { RequestEvent } from '@sveltejs/kit'\nimport type { HandleA2AConfig, HandleA2AOperations, HandleConfig } from '../../kit-types.js'\nimport { kitM } from '../../kit-i18n.js'\nimport { createA2AApiKeyAuthenticator } from './kit-a2a-auth.js'\nimport { createA2AHandler } from './kit-a2a-helpers.js'\n\n// ─── 解析后的 A2A 内部配置 ───\n\n/**\n * A2A 解析后的内部配置\n * @example\n * ```ts\n * import type { ResolvedA2AConfig } from '@h-ai/kit'\n *\n * function paths(config: ResolvedA2AConfig) { return [config.cardPath, config.rpcPath] }\n * ```\n */\nexport interface ResolvedA2AConfig {\n  operations: HandleA2AOperations\n  cardPath: string\n  rpcPath: string\n  authenticate?: (event: RequestEvent) => Promise<Record<string, unknown> | null | undefined>\n}\n\n// ─── A2A 配置解析 ───\n\n/**\n * 解析 A2A 配置（简单模式 / 配置模式）\n *\n * - 简单模式：直接传入 `ai.a2a` 操作对象，使用默认路径\n * - 配置模式：传入 `{ operations, rpcPath?, cardPath?, authenticate? }`\n *\n * @param input - HandleConfig.a2a 配置\n * @returns 解析后的配置，或 `null` 表示未配置\n * @example 模块内部上下文\n * ```ts\n * function resolve(operations: HandleA2AOperations) {\n *   return resolveA2AConfig({ operations, rpcPath: '/a2a', authenticate: async () => null })\n * }\n * ```\n */\nexport function resolveA2AConfig(\n  input: HandleConfig['a2a'],\n): ResolvedA2AConfig | null {\n  if (!input)\n    return null\n\n  // 简单模式：直接传入操作对象\n  if ('getAgentCard' in input && 'handleRequest' in input) {\n    return {\n      operations: input as HandleA2AOperations,\n      cardPath: '/.well-known/agent-card.json',\n      rpcPath: '/a2a',\n    }\n  }\n\n  // 配置模式：带 operations 字段\n  const cfg = input as HandleA2AConfig\n  return {\n    operations: cfg.operations,\n    cardPath: cfg.cardPath ?? '/.well-known/agent-card.json',\n    rpcPath: cfg.rpcPath ?? '/a2a',\n    authenticate: resolveAuthenticate(cfg.authenticate, cfg.operations),\n  }\n}\n\n/**\n * 解析 authenticate 配置\n *\n * - `undefined` → 无认证\n * - `'apiKey'` → 从 Agent Card security 配置创建 API Key 认证器\n * - 函数 → 直接使用\n */\nfunction resolveAuthenticate(\n  authenticate: HandleA2AConfig['authenticate'],\n  operations: HandleA2AOperations,\n): ResolvedA2AConfig['authenticate'] {\n  if (!authenticate)\n    return undefined\n\n  if (typeof authenticate === 'function')\n    return authenticate\n\n  // 'apiKey' 快捷方式：从 Agent Card 获取 security 配置\n  const cardResult = operations.getAgentCard()\n  const securitySchemes = cardResult.success && cardResult.data\n    ? (cardResult.data as { securitySchemes?: Record<string, { type: string, in?: string, name?: string }> }).securitySchemes\n    : undefined\n  const apiKeyCfg = securitySchemes?.apiKey\n\n  return createA2AApiKeyAuthenticator({\n    in: apiKeyCfg?.in === 'query' ? 'query' : 'header',\n    name: apiKeyCfg?.name ?? 'x-api-key',\n  })\n}\n\n// ─── A2A 请求处理 ───\n\n/**\n * 处理 A2A 端点请求\n *\n * 匹配 Agent Card GET 和 JSON-RPC POST 端点，返回 Response。\n * 不匹配时返回 `null`，由 Handle 继续后续流程。\n *\n * @param event - SvelteKit RequestEvent\n * @param requestId - 当前请求 ID（用于响应头）\n * @param config - 解析后的 A2A 配置\n * @returns 匹配时返回 Response，不匹配返回 null\n * @example 模块内部上下文\n * ```ts\n * async function handle(event: RequestEvent, config: ResolvedA2AConfig) {\n *   return handleA2ARequest(event, 'req_1', config) // null 表示路径未匹配，交给后续 handle。\n * }\n * ```\n */\nexport async function handleA2ARequest(\n  event: RequestEvent,\n  requestId: string,\n  config: ResolvedA2AConfig,\n): Promise<Response | null> {\n  const { pathname } = event.url\n\n  // Agent Card 发现端点\n  if (pathname === config.cardPath && event.request.method === 'GET') {\n    const result = config.operations.getAgentCard()\n    if (result.success) {\n      return new Response(JSON.stringify(result.data), {\n        headers: { 'Content-Type': 'application/json', 'X-Request-Id': requestId },\n      })\n    }\n    return new Response(\n      JSON.stringify({ error: { code: 'A2A_NOT_CONFIGURED', message: kitM('kit_a2aCardUnavailable') } }),\n      { status: 503, headers: { 'Content-Type': 'application/json', 'X-Request-Id': requestId } },\n    )\n  }\n\n  // A2A JSON-RPC 端点\n  if (pathname === config.rpcPath && event.request.method === 'POST') {\n    // Hook 与显式路由共享认证、JSON-RPC 错误和流式生命周期逻辑。\n    const handler = createA2AHandler(\n      (body, context) => config.operations.handleRequest(body, context),\n      { authenticate: config.authenticate },\n    )\n    const response = await handler(event)\n    response.headers.set('X-Request-Id', requestId)\n    return response\n  }\n\n  return null\n}\n"]}

package/dist/{chunk-VOTDAVCB.js → chunk-2YYRP7HH.js}

@@ -1,5 +1,5 @@
-import { resolveTransportPath, DEFAULT_TRANSPORT_KEY_EXCHANGE_PATH, shouldUseTransportForUrl } from './chunk-NVYIUBU7.js';
-import { kitM } from './chunk-QHYNL24G.js';
+import { resolveTransportPath, DEFAULT_TRANSPORT_KEY_EXCHANGE_PATH, shouldUseTransportForUrl } from './chunk-XC7I2L3G.js';
+import { kitM } from './chunk-OVRZIDCD.js';
 import process from 'process';
 import { ok, err } from '@h-ai/core';
 import { TRANSPORT_PROTOCOL } from '@h-ai/crypto';
@@ -53,7 +53,8 @@ function setToken(cookies, token, maxAge) {
     path: "/",
     httpOnly: true,
     sameSite: "lax",
-    secure: process.env.NODE_ENV === "production",
+    // 测试开关仅放宽共享状态要求，不降低生产凭证 Cookie 的传输安全。
+    secure: process.env.NODE_ENV === "production" || process.env.HAI_CORE_ENV === "production",
     maxAge
   });
 }
@@ -97,33 +98,16 @@ async function registerAndLogin(cookies, options) {
   return runAuthLogin(cookies, options, (ops, input) => ops.registerAndLogin(input));
 }
 async function logout(cookies, accessToken) {
-  const ops = getAuthOperations();
-  if (accessToken && ops) {
-    await ops.logout(accessToken);
+  try {
+    if (!accessToken)
+      return ok(void 0);
+    const ops = getAuthOperations();
+    if (!ops)
+      return authNotConfiguredError();
+    return await ops.logout(accessToken);
+  } finally {
+    clearToken(cookies);
   }
-  clearToken(cookies);
-}
-function createTokenStore(key = DEFAULT_TOKEN_COOKIE_NAME) {
-  return {
-    get() {
-      if (typeof window === "undefined") {
-        return null;
-      }
-      return window.localStorage.getItem(key);
-    },
-    set(token) {
-      if (typeof window === "undefined") {
-        return;
-      }
-      window.localStorage.setItem(key, token);
-    },
-    clear() {
-      if (typeof window === "undefined") {
-        return;
-      }
-      window.localStorage.removeItem(key);
-    }
-  };
 }
 function setBrowserToken(token) {
   defaultBrowserTokenStore.set(token);
@@ -286,7 +270,7 @@ function createKitAuthActions(options = {}) {
         return post("login/ldap", { username: input.identifier, password: input.password });
       if (input.method === "email" || input.method === "sms")
         return post("login/otp", { identifier: input.identifier, code: input.code });
-      return post("login", { identifier: input.identifier, password: input.password, rememberMe: input.rememberMe });
+      return post("login", { identifier: input.identifier, password: input.password });
     },
     register: (input) => post("register", { ...input, confirmPassword: input.password }),
     sendOtp: (identifier) => post("otp/send", { identifier }),
@@ -295,6 +279,6 @@ function createKitAuthActions(options = {}) {
   };
 }
 
-export { clearBrowserToken, configureAuth, createKitAuthActions, createKitClient, createTokenStore, getAccessToken, installBrowserTransport, installBrowserTransportFetch, login, loginWithApiKey, loginWithLdap, loginWithOtp, logout, registerAndLogin, setBrowserToken };
-//# sourceMappingURL=chunk-VOTDAVCB.js.map
-//# sourceMappingURL=chunk-VOTDAVCB.js.map
+export { clearBrowserToken, configureAuth, createKitAuthActions, createKitClient, getAccessToken, installBrowserTransport, installBrowserTransportFetch, login, loginWithApiKey, loginWithLdap, loginWithOtp, logout, registerAndLogin, setBrowserToken };
+//# sourceMappingURL=chunk-2YYRP7HH.js.map
+//# sourceMappingURL=chunk-2YYRP7HH.js.map