@h-ai/kit 0.1.0-alpha.66 → 0.1.0-alpha.68

package/dist/chunk-2YYRP7HH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kit-auth.ts","../src/client/kit-client.ts","../src/client/kit-client-auth.ts"],"names":["ok"],"mappings":";;;;;;;;AAeA,IAAM,yBAAA,GAA4B,kBAAA;AAOlC,IAAM,SAAA,GAAY;AAAA,EAChB,UAAA,EAAY,yBAAA;AAAA,EACZ,UAAA,EAAY;AACd,CAAA;AAgBO,SAAS,cAAc,MAAA,EAA4E;AACxG,EAAA,IAAI,MAAA,CAAO,UAAA;AACT,IAAA,SAAA,CAAU,aAAa,MAAA,CAAO,UAAA;AAChC,EAAA,IAAI,MAAA,CAAO,UAAA;AACT,IAAA,SAAA,CAAU,aAAa,MAAA,CAAO,UAAA;AAClC;AAiDA,SAAS,sBAAA,GAA4C;AACnD,EAAA,IAAI,KAAA,GAAuB,IAAA;AAC3B,EAAA,OAAO;AAAA,IACL,KAAK,MAAM,KAAA;AAAA,IACX,GAAA,EAAK,CAAC,KAAA,KAAkB;AAAE,MAAA,KAAA,GAAQ,KAAA;AAAA,IAAM,CAAA;AAAA,IACxC,OAAO,MAAM;AAAE,MAAA,KAAA,GAAQ,IAAA;AAAA,IAAK;AAAA,GAC9B;AACF;AAGA,IAAM,2BAA2B,sBAAA,EAAuB;AAYjD,SAAS,2BAAA,GAAiD;AAC/D,EAAA,OAAO,wBAAA;AACT;AAOA,SAAS,0BAA0B,OAAA,EAAiC;AAClE,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACzD,EAAA,IAAI,CAAC,aAAA;AACH,IAAA,OAAO,IAAA;AAET,EAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,aAAA,CAAc,MAAM,GAAG,CAAA;AAC/C,EAAA,IAAI,CAAC,UAAU,CAAC,KAAA;AACd,IAAA,OAAO,IAAA;AAET,EAAA,IAAI,MAAA,CAAO,aAAY,KAAM,QAAA;AAC3B,IAAA,OAAO,IAAA;AAET,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,EAAK;AAC3B,EAAA,OAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,GAAI,OAAA,GAAU,IAAA;AACxC;AAcO,SAAS,cAAA,CAAe,SAAkB,OAAA,EAAuC;AACtF,EAAA,OAAO,0BAA0B,OAAO,CAAA,IAAK,SAAS,GAAA,CAAI,SAAA,CAAU,UAAU,CAAA,IAAK,IAAA;AACrF;AAOA,SAAS,QAAA,CAAS,OAAA,EAAuB,KAAA,EAAe,MAAA,EAAuB;AAC7E,EAAA,OAAA,CAAQ,GAAA,CAAI,SAAA,CAAU,UAAA,EAAY,KAAA,EAAO;AAAA,IACvC,IAAA,EAAM,GAAA;AAAA,IACN,QAAA,EAAU,IAAA;AAAA,IACV,QAAA,EAAU,KAAA;AAAA;AAAA,IAEV,QAAQ,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAA,IAAgB,OAAA,CAAQ,IAAI,YAAA,KAAiB,YAAA;AAAA,IAC9E;AAAA,GACD,CAAA;AACH;AAKA,SAAS,WAAW,OAAA,EAA6B;AAC/C,EAAA,OAAA,CAAQ,OAAO,SAAA,CAAU,UAAA,EAAY,EAAE,IAAA,EAAM,KAAK,CAAA;AACpD;AASA,SAAS,iBAAA,GAA2C;AAClD,EAAA,IAAI,CAAC,SAAA,CAAU,UAAA;AACb,IAAA,OAAO,IAAA;AACT,EAAA,OAAO,OAAO,SAAA,CAAU,UAAA,KAAe,aACnC,SAAA,CAAU,UAAA,KACV,SAAA,CAAU,UAAA;AAChB;AAQA,SAAS,sBAAA,GAA2C;AAClD,EAAA,OAAO,GAAA,CAAI;AAAA,IACT,IAAA,EAAM,yBAAA;AAAA,IACN,OAAA,EAAS,KAAK,uBAAuB;AAAA,GACtC,CAAA;AACH;AASA,eAAe,YAAA,CACb,OAAA,EACA,WAAA,EACA,GAAA,EACgC;AAChC,EAAA,MAAM,MAAM,iBAAA,EAAkB;AAC9B,EAAA,IAAI,CAAC,GAAA;AACH,IAAA,OAAO,sBAAA,EAAuB;AAEhC,EAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,GAAA,EAAK,WAAW,CAAA;AACzC,EAAA,IAAI,OAAO,OAAA,EAAS;AAClB,IAAA,QAAA,CAAS,OAAA,EAAS,OAAO,IAAA,CAAK,MAAA,CAAO,aAAa,MAAA,CAAO,IAAA,CAAK,OAAO,SAAS,CAAA;AAAA,EAChF;AACA,EAAA,OAAO,MAAA;AACT;AAiBA,eAAsB,KAAA,CACpB,SACA,WAAA,EACgC;AAChC,EAAA,OAAO,YAAA,CAAa,SAAS,WAAA,EAAa,CAAC,KAAK,KAAA,KAAU,GAAA,CAAI,KAAA,CAAM,KAAK,CAAC,CAAA;AAC5E;AAiBA,eAAsB,YAAA,CACpB,SACA,WAAA,EACgC;AAChC,EAAA,OAAO,YAAA,CAAa,SAAS,WAAA,EAAa,CAAC,KAAK,KAAA,KAAU,GAAA,CAAI,YAAA,CAAa,KAAK,CAAC,CAAA;AACnF;AAiBA,eAAsB,aAAA,CACpB,SACA,WAAA,EACgC;AAChC,EAAA,OAAO,YAAA,CAAa,SAAS,WAAA,EAAa,CAAC,KAAK,KAAA,KAAU,GAAA,CAAI,aAAA,CAAc,KAAK,CAAC,CAAA;AACpF;AAiBA,eAAsB,eAAA,CACpB,SACA,WAAA,EACgC;AAChC,EAAA,OAAO,YAAA,CAAa,SAAS,WAAA,EAAa,CAAC,KAAK,KAAA,KAAU,GAAA,CAAI,eAAA,CAAgB,KAAK,CAAC,CAAA;AACtF;AAiBA,eAAsB,gBAAA,CACpB,SACA,OAAA,EACgC;AAChC,EAAA,OAAO,YAAA,CAAa,SAAS,OAAA,EAAS,CAAC,KAAK,KAAA,KAAU,GAAA,CAAI,gBAAA,CAAiB,KAAK,CAAC,CAAA;AACnF;AAmBA,eAAsB,MAAA,CACpB,SACA,WAAA,EAC0B;AAC1B,EAAA,IAAI;AACF,IAAA,IAAI,CAAC,WAAA;AACH,MAAA,OAAO,GAAG,KAAA,CAAS,CAAA;AACrB,IAAA,MAAM,MAAM,iBAAA,EAAkB;AAC9B,IAAA,IAAI,CAAC,GAAA;AACH,MAAA,OAAO,sBAAA,EAAuB;AAChC,IAAA,OAAO,MAAM,GAAA,CAAI,MAAA,CAAO,WAAW,CAAA;AAAA,EACrC,CAAA,SACA;AAEE,IAAA,UAAA,CAAW,OAAO,CAAA;AAAA,EACpB;AACF;AAgBO,SAAS,gBAAgB,KAAA,EAAqB;AACnD,EAAA,wBAAA,CAAyB,IAAI,KAAK,CAAA;AACpC;AAWO,SAAS,iBAAA,GAA0B;AACxC,EAAA,wBAAA,CAAyB,KAAA,EAAM;AACjC;ACvYA,IAAM,wBAAA,GAA2B,CAAA,IAAA,EAAO,kBAAA,CAAmB,yBAAyB,CAAA,CAAA;AA0FpF,SAAS,UAAU,IAAA,EAAkC;AACnD,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,OAAO,MAAA;AACT,EAAA,MAAM,KAAA,GAAQ,SAAS,MAAA,CAAO,KAAA,CAAM,IAAI,MAAA,CAAO,CAAA,WAAA,EAAc,IAAI,CAAA,QAAA,CAAU,CAAC,CAAA;AAC5E,EAAA,OAAO,QAAQ,CAAC,CAAA;AAClB;AAYA,SAAS,sBAAsB,IAAA,EAA4C;AACzE,EAAA,OAAO,IAAA,KAAS,MAAA,IAAa,IAAA,KAAS,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA;AAChE;AAWA,SAAS,0BAA0B,OAAA,EAA2B;AAC5D,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,WAAA,EAAY;AAC1C,EAAA,IAAI,MAAA,KAAW,KAAA,IAAS,MAAA,KAAW,MAAA,EAAQ;AACzC,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA;AAC3C,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AACnD,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,kBAAkB,CAAA,EAAG;AAC5C,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OAAO,QAAQ,IAAA,KAAS,IAAA;AAC1B;AAEA,SAAS,gBAAA,GAA2B;AAClC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,MAAA,CAAO,UAAU,MAAA,EAAQ;AAC5D,IAAA,OAAO,OAAO,QAAA,CAAS,MAAA;AAAA,EACzB;AAEA,EAAA,OAAO,kBAAA;AACT;AAEA,SAAS,SAAA,CAAU,OAA0B,IAAA,EAA6B;AACxE,EAAA,IAAI,KAAA,YAAiB,OAAA;AACnB,IAAA,OAAO,IAAA,GAAO,IAAI,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAA,GAAI,KAAA;AAE3C,EAAA,OAAO,IAAI,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAA;AAChC;AAgCO,SAAS,6BAA6B,eAAA,EAA+C;AAC1F,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,CAAC,eAAA;AACpC,IAAA;AAEF,EAAA,MAAM,UAAA,GAAa,UAAA;AACnB,EAAA,IAAI,UAAA,CAAW,+BAAA;AACb,IAAA;AAEF,EAAA,MAAM,gBAAgB,UAAA,CAAW,qBAAA,IAAyB,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAC1F,EAAA,UAAA,CAAW,qBAAA,GAAwB,aAAA;AAEnC,EAAA,MAAM,SAAS,gBAAA,EAAiB;AAChC,EAAA,MAAM,cAAA,GAAiB,IAAI,GAAA,CAAI,eAAA,CAAgB,kBAAkB,wBAAA,EAA0B,MAAM,EAAE,QAAA,EAAS;AAC5G,EAAA,MAAM,eAAA,GAAkB,oBAAA,CAAqB,cAAA,EAAgB,MAAM,CAAA;AACnE,EAAA,MAAM,eAAA,GAAkB,eAAA,CAAgB,MAAA,CAAO,SAAA,CAAU,YAAA,CAAa;AAAA,IACpE,cAAA;AAAA,IACA,KAAA,EAAO;AAAA,GACR,CAAA;AAED,EAAA,MAAM,YAAA,GAA6B,OAAO,KAAA,EAAO,IAAA,KAAS;AACxD,IAAA,MAAM,OAAA,GAAU,SAAA,CAAU,KAAA,EAAO,IAAI,CAAA;AACrC,IAAA,MAAM,UAAA,GAAa,IAAI,GAAA,CAAI,OAAA,CAAQ,KAAK,MAAM,CAAA;AAC9C,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA;AAE3C,IAAA,IAAI,CAAC,yBAAyB,UAAA,EAAY;AAAA,MACxC,MAAA;AAAA,MACA,eAAA;AAAA,MACA,cAAc,eAAA,CAAgB;AAAA,KAC/B,CAAA,EAAG;AACF,MAAA,OAAO,aAAA,CAAc,OAAO,IAAI,CAAA;AAAA,IAClC;AAEA,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,kBAAA,CAAmB,gBAAgB,CAAA;AACjD,MAAA,OAAO,aAAA,CAAc,OAAO,IAAI,CAAA;AAElC,IAAA,IAAI,CAAC,0BAA0B,OAAO,CAAA;AACpC,MAAA,OAAO,aAAA,CAAc,OAAO,IAAI,CAAA;AAElC,IAAA,OAAO,eAAA,CAAgB,eAAe,OAAO,CAAA;AAAA,EAC/C,CAAA;AAEA,EAAA,UAAA,CAAW,KAAA,GAAQ,YAAA;AACnB,EAAA,MAAA,CAAO,KAAA,GAAQ,YAAA;AACf,EAAA,UAAA,CAAW,+BAAA,GAAkC,IAAA;AAC/C;AA0BO,SAAS,uBAAA,CACd,QACA,IAAA,EACM;AACN,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,MAAA,CAAO,SAAA,KAAc,KAAA;AACxD,IAAA;AAIF,EAAA,KAAK,IAAA,CAAK,OAAO,IAAA,EAAK;AAEtB,EAAA,4BAAA,CAA6B;AAAA,IAC3B,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,cAAA,EAAgB,OAAO,SAAA,CAAU,eAAA;AAAA,IACjC,YAAA,EAAc,CAAC,GAAG,MAAA,CAAO,UAAU,YAAY;AAAA,GAChD,CAAA;AACH;AA6BO,SAAS,eAAA,CAAgB,MAAA,GAA0B,EAAC,EAAc;AACvE,EAAA,MAAM;AAAA,IACJ,SAAA,EAAW,eAAA;AAAA,IACX,cAAA,GAAiB,UAAA;AAAA,IACjB,cAAA,GAAiB,cAAA;AAAA,IACjB,IAAA,EAAM;AAAA,GACR,GAAI,MAAA;AAIJ,EAAA,MAAM,YAAsC,UAAA,GACvC,UAAA,KAAe,IAAA,GAAO,2BAAA,KAAgC,UAAA,GACvD,IAAA;AAGJ,EAAA,MAAM,kBAAkB,gBAAA,EAAiB;AACzC,EAAA,MAAM,uBAAA,GAA0B,iBAAiB,cAAA,IAAkB,wBAAA;AACnE,EAAA,MAAM,wBAAA,GAA2B,eAAA,GAC7B,oBAAA,CAAqB,uBAAA,EAAyB,eAAe,CAAA,GAC7D,mCAAA;AACJ,EAAA,MAAM,eAAA,GAA0C,eAAA,GAC5C,eAAA,CAAgB,MAAA,CAAO,UAAU,YAAA,CAAa;AAAA,IAC5C,cAAA,EAAgB,uBAAA;AAAA,IAChB;AAAA,GACD,CAAA,GACD,IAAA;AAKJ,EAAA,eAAe,QAAA,CAAS,GAAA,EAAa,IAAA,GAAoB,EAAC,EAAsB;AAC9E,IAAA,MAAM,MAAA,GAAA,CAAU,IAAA,CAAK,MAAA,IAAU,KAAA,EAAO,WAAA,EAAY;AAClD,IAAA,MAAM,aAAA,GAAgB,CAAC,CAAC,KAAA,EAAO,QAAQ,SAAS,CAAA,CAAE,SAAS,MAAM,CAAA;AACjE,IAAA,MAAM,eAAA,GAAkB,qBAAA,CAAsB,IAAA,CAAK,IAAI,CAAA;AAEvD,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA;AAGxC,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,MAAM,KAAA,GAAQ,UAAU,GAAA,EAAI;AAC5B,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,KAAK,CAAA,CAAE,CAAA;AAAA,MAChD;AAAA,IACF;AAGA,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,MAAM,SAAA,GAAY,UAAU,cAAc,CAAA;AAC1C,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,OAAA,CAAQ,GAAA,CAAI,gBAAgB,SAAS,CAAA;AAAA,MACvC;AAAA,IACF;AAGA,IAAA,IACE,eAAA,IACG,eAAA,IACA,wBAAA,CAAyB,GAAA,EAAK;AAAA,MAC/B,MAAA,EAAQ,eAAA;AAAA,MACR,eAAA,EAAiB,wBAAA;AAAA,MACjB,cAAc,eAAA,EAAiB;AAAA,KAChC,CAAA,EACD;AACA,MAAA,OAAO,gBAAgB,cAAA,CAAe,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,SAAS,CAAA;AAAA,IACjE;AAGA,IAAA,OAAO,MAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,SAAS,CAAA;AAAA,EACxC;AAEA,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,IAAI,KAAA,GAAQ;AAAE,MAAA,OAAO,CAAC,eAAA,IAAmB,eAAA,CAAgB,KAAA,EAAM;AAAA,IAAE,CAAA;AAAA,IACjE,MAAM,IAAA,GAAO;AACX,MAAA,IAAI,CAAC,eAAA;AACH,QAAA;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,eAAA,CAAgB,IAAA,EAAK;AAC1C,MAAA,IAAI,CAAC,MAAA,CAAO,OAAA;AACV,QAAA,MAAM,IAAI,KAAA,CAAM,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA;AAAA,IACxC,CAAA;AAAA,IACA,OAAA,GAAU;AACR,MAAA,eAAA,EAAiB,OAAA,EAAQ;AAAA,IAC3B;AAAA,GACF;AACF;ACnXO,SAAS,oBAAA,CAAqB,OAAA,GAAmE,EAAC,EAAG;AAC1G,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,IAAY,eAAA,EAAgB,CAAE,QAAA;AACvD,EAAA,MAAM,IAAA,GAAO,QAAQ,QAAA,IAAY,WAAA;AACjC,EAAA,eAAe,IAAA,CAAK,MAAc,KAAA,EAA4C;AAC5E,IAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,IAAI,EAAE,MAAA,EAAQ,QAAQ,OAAA,EAAS,EAAE,gBAAgB,kBAAA,EAAmB,EAAG,MAAM,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,EAAG,CAAA;AAEnJ,IAAA,MAAM,MAAA,GAAS,WAAA,CAAY,eAAA,CAAgB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAU,CAAA,CAAE,KAAA,CAAM,MAAM,QAAA,CAAS,MAAM,CAAA;AAC9F,IAAA,OAAO,MAAA,CAAO,OAAA,GAAUA,EAAAA,CAAG,MAAA,CAAO,IAAI,CAAA,GAAI,MAAA;AAAA,EAC5C;AACA,EAAA,OAAO;AAAA,IACL,MAAM,YAAA,GAA2D;AAC/D,MAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,CAAA,EAAG,IAAI,CAAA,OAAA,CAAS,CAAA;AAChD,MAAA,OAAO,WAAA,CAAY,eAAA,CAAgB,qBAAA,CAAsB,QAAA,EAAU,EAAE,KAAA,CAAM,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA;AAAA,IAClG,CAAA;AAAA,IACA,MAAM,KAAA,EAA0F;AAC9F,MAAA,IAAI,MAAM,MAAA,KAAW,MAAA;AACnB,QAAA,OAAO,IAAA,CAAK,cAAc,EAAE,QAAA,EAAU,MAAM,UAAA,EAAY,QAAA,EAAU,KAAA,CAAM,QAAA,EAAU,CAAA;AACpF,MAAA,IAAI,KAAA,CAAM,MAAA,KAAW,OAAA,IAAW,KAAA,CAAM,MAAA,KAAW,KAAA;AAC/C,QAAA,OAAO,IAAA,CAAK,aAAa,EAAE,UAAA,EAAY,MAAM,UAAA,EAAY,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,CAAA;AAC7E,MAAA,OAAO,IAAA,CAAK,SAAS,EAAE,UAAA,EAAY,MAAM,UAAA,EAAY,QAAA,EAAU,KAAA,CAAM,QAAA,EAAU,CAAA;AAAA,IACjF,CAAA;AAAA,IACA,QAAA,EAAU,CAAC,KAAA,KAA4B,IAAA,CAAK,UAAA,EAAY,EAAE,GAAG,KAAA,EAAO,eAAA,EAAiB,KAAA,CAAM,QAAA,EAAU,CAAA;AAAA,IACrG,SAAS,CAAC,UAAA,KAAuB,KAAK,UAAA,EAAY,EAAE,YAAY,CAAA;AAAA,IAChE,sBAAsB,CAAC,UAAA,KAAuB,KAAK,wBAAA,EAA0B,EAAE,YAAY,CAAA;AAAA,IAC3F,oBAAA,EAAsB,CAAC,KAAA,EAAe,WAAA,KAAwB,KAAK,wBAAA,EAA0B,EAAE,KAAA,EAAO,WAAA,EAAa;AAAA,GACrH;AACF","file":"chunk-2YYRP7HH.js","sourcesContent":["/**\n * @h-ai/kit — Bearer 认证工具\n *\n * 提供服务端认证 Cookie 管理（login / logout）与浏览器端 Token 存储工具。\n * @module kit-auth\n */\n\nimport type { HaiResult } from '@h-ai/core'\nimport type { ApiKeyCredentials, AuthResult, LdapCredentials, OtpCredentials, PasswordCredentials, RegisterOptions } from '@h-ai/iam'\nimport type { AuthOperations, AuthOperationsProvider } from './kit-types.js'\nimport process from 'node:process'\nimport { err, ok } from '@h-ai/core'\nimport { kitM } from './kit-i18n.js'\n\n/** 默认 Token Cookie 名 */\nconst DEFAULT_TOKEN_COOKIE_NAME = 'hai_access_token'\n\n/**\n * 应用级认证配置（由 createHandle 一次性初始化，生命周期同进程）\n *\n * 此状态非请求级：仅在 createHandle() 时写入一次，后续所有请求只读访问。\n */\nconst authState = {\n  cookieName: DEFAULT_TOKEN_COOKIE_NAME,\n  operations: null as AuthOperationsProvider | null,\n}\n\n/**\n * 配置认证参数\n *\n * 通常由 `createHandle` 在初始化时自动调用，无需手动调用。\n * @param config - 启动阶段注入的 Cookie 名和认证操作提供器。\n * @param config.cookieName - 认证 Cookie 名。\n * @param config.operations - 已初始化服务的认证操作或惰性提供器。\n * @example 模块内部上下文\n * ```ts\n * function configure(operations: AuthOperationsProvider) {\n *   configureAuth({ cookieName: 'hai_access_token', operations })\n * }\n * ```\n */\nexport function configureAuth(config: { cookieName?: string, operations?: AuthOperationsProvider }): void {\n  if (config.cookieName)\n    authState.cookieName = config.cookieName\n  if (config.operations)\n    authState.operations = config.operations\n}\n\n/**\n * 服务端认证只读 Cookie 依赖；由当前请求提供，不能跨请求缓存。\n * @example 模块内部上下文\n * ```ts\n * const cookies: CookieReader = { get: name => name === 'hai_access_token' ? 'example-only-token' : undefined }\n * const token = getAccessToken(new Request('https://app.example.com/api'), cookies)\n * void token\n * ```\n */\ninterface CookieReader {\n  get: (name: string) => string | undefined\n}\n\n/**\n * 服务端认证写入/删除 Cookie 依赖；由当前请求提供并执行安全属性。\n * @example 模块内部上下文\n * ```ts\n * function signIn(cookies: CookieWriter, credentials: PasswordCredentials) {\n *   return login(cookies, credentials) // 业务调用者检查 success 后消费身份。\n * }\n * ```\n */\ninterface CookieWriter {\n  set: (name: string, value: string, options: {\n    path: string\n    httpOnly: boolean\n    sameSite: 'lax' | 'strict' | 'none'\n    secure: boolean\n    maxAge?: number\n  }) => void\n  delete: (name: string, options: { path: string }) => void\n}\n\n/**\n * 浏览器 Token 存储器；使用页面内存或平台安全存储，禁止写入 Web Storage。\n * @example 模块内部上下文\n * ```ts\n * const store: BrowserTokenStore = getDefaultBrowserTokenStore()\n * store.clear() // 当前页面内存状态；不持有服务端会话真值。\n * ```\n */\nexport interface BrowserTokenStore {\n  get: () => string | null\n  set: (token: string) => void\n  clear: () => void\n}\n\nfunction createMemoryTokenStore(): BrowserTokenStore {\n  let token: string | null = null\n  return {\n    get: () => token,\n    set: (value: string) => { token = value },\n    clear: () => { token = null },\n  }\n}\n\n// 默认浏览器 Token 只保存在当前页面内存中，避免 auth: true 隐式落到 localStorage。\nconst defaultBrowserTokenStore = createMemoryTokenStore()\n\n/**\n * 获取默认浏览器 Token 存储（页面内存，不持久化）。\n * @returns 当前页面的内存令牌存储器；不持有服务端共享状态。\n * @example 模块内部上下文\n * ```ts\n * const store = getDefaultBrowserTokenStore()\n * store.set('example-only-token')\n * store.clear()\n * ```\n */\nexport function getDefaultBrowserTokenStore(): BrowserTokenStore {\n  return defaultBrowserTokenStore\n}\n\n// ─── 内部工具（仅 kit 包内使用） ───\n\n/**\n * 从请求 Authorization 头提取 Bearer Token。\n */\nfunction getBearerTokenFromRequest(request: Request): string | null {\n  const authorization = request.headers.get('authorization')\n  if (!authorization)\n    return null\n\n  const [scheme, token] = authorization.split(' ')\n  if (!scheme || !token)\n    return null\n\n  if (scheme.toLowerCase() !== 'bearer')\n    return null\n\n  const trimmed = token.trim()\n  return trimmed.length > 0 ? trimmed : null\n}\n\n/**\n * 从请求中统一提取 Access Token（Bearer 优先，其次配置的 Cookie 名）。\n * @param request - 当前 HTTP 请求，优先读取 Authorization Bearer。\n * @param cookies - 当前请求的 Cookie 读取器；未提供时仅检查请求头。\n * @returns 解析到的令牌；均无值时为 null。\n * @example 模块内部上下文\n * ```ts\n * const request = new Request('https://app.example.com/api', { headers: { Authorization: 'Bearer example-only-token' } })\n * const token = getAccessToken(request)\n * void token\n * ```\n */\nexport function getAccessToken(request: Request, cookies?: CookieReader): string | null {\n  return getBearerTokenFromRequest(request) ?? cookies?.get(authState.cookieName) ?? null\n}\n\n// ─── 服务端认证 Cookie 管理 ───\n\n/**\n * 写入 Access Token Cookie（内部使用，由 login 自动调用）。\n */\nfunction setToken(cookies: CookieWriter, token: string, maxAge?: number): void {\n  cookies.set(authState.cookieName, token, {\n    path: '/',\n    httpOnly: true,\n    sameSite: 'lax',\n    // 测试开关仅放宽共享状态要求，不降低生产凭证 Cookie 的传输安全。\n    secure: process.env.NODE_ENV === 'production' || process.env.HAI_CORE_ENV === 'production',\n    maxAge,\n  })\n}\n\n/**\n * 清除 Access Token Cookie（内部使用，由 logout 自动调用）。\n */\nfunction clearToken(cookies: CookieWriter): void {\n  cookies.delete(authState.cookieName, { path: '/' })\n}\n\n// ─── 服务端高级认证 API（通过 kit.auth 暴露） ───\n\n/**\n * 获取已注入的认证操作；未配置时返回 null。\n *\n * 公共 API 不应 throw，因此此处用 null 信号配合上层短路返回 HaiResult。\n */\nfunction getAuthOperations(): AuthOperations | null {\n  if (!authState.operations)\n    return null\n  return typeof authState.operations === 'function'\n    ? authState.operations()\n    : authState.operations\n}\n\n/**\n * 构造 \"auth 未配置\" 的标准 HaiResult 错误。\n *\n * 用于公共认证 API 在 `authState.operations` 未注入时返回，\n * 避免向调用方抛出未捕获异常。\n */\nfunction authNotConfiguredError(): HaiResult<never> {\n  return err({\n    code: 'KIT_AUTH_NOT_CONFIGURED',\n    message: kitM('kit_authNotConfigured'),\n  })\n}\n\n/**\n * 执行已配置的认证登录操作，并在成功时写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param credentials - 认证凭证\n * @param run - 具体 IAM 认证操作\n */\nasync function runAuthLogin<TCredentials>(\n  cookies: CookieWriter,\n  credentials: TCredentials,\n  run: (ops: AuthOperations, credentials: TCredentials) => Promise<HaiResult<AuthResult>>,\n): Promise<HaiResult<AuthResult>> {\n  const ops = getAuthOperations()\n  if (!ops)\n    return authNotConfiguredError()\n\n  const result = await run(ops, credentials)\n  if (result.success) {\n    setToken(cookies, result.data.tokens.accessToken, result.data.tokens.expiresIn)\n  }\n  return result\n}\n\n/**\n * 服务端登录（密码）：内部调用 iam.auth.login，成功时自动写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param credentials - 密码凭证（identifier + password）\n * @returns 认证结果（成功时 Cookie 已自动写入）\n * @example 模块内部上下文\n * ```ts\n * async function signIn(cookies: CookieWriter, credentials: PasswordCredentials) {\n *   const result = await login(cookies, credentials)\n *   if (!result.success) return result.error.message\n *   return result.data\n * }\n * ```\n */\nexport async function login(\n  cookies: CookieWriter,\n  credentials: PasswordCredentials,\n): Promise<HaiResult<AuthResult>> {\n  return runAuthLogin(cookies, credentials, (ops, input) => ops.login(input))\n}\n\n/**\n * 服务端登录（OTP 验证码）：内部调用 iam.auth.loginWithOtp，成功时自动写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param credentials - OTP 凭证（identifier + code）\n * @returns 认证结果（成功时 Cookie 已自动写入）\n * @example 模块内部上下文\n * ```ts\n * async function signIn(cookies: CookieWriter, credentials: OtpCredentials) {\n *   const result = await loginWithOtp(cookies, credentials)\n *   if (!result.success) return result.error.message\n *   return result.data\n * }\n * ```\n */\nexport async function loginWithOtp(\n  cookies: CookieWriter,\n  credentials: OtpCredentials,\n): Promise<HaiResult<AuthResult>> {\n  return runAuthLogin(cookies, credentials, (ops, input) => ops.loginWithOtp(input))\n}\n\n/**\n * 服务端登录（LDAP）：内部调用 iam.auth.loginWithLdap，成功时自动写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param credentials - LDAP 凭证（username + password）\n * @returns 认证结果（成功时 Cookie 已自动写入）\n * @example 模块内部上下文\n * ```ts\n * async function signIn(cookies: CookieWriter, credentials: LdapCredentials) {\n *   const result = await loginWithLdap(cookies, credentials)\n *   if (!result.success) return result.error.message\n *   return result.data\n * }\n * ```\n */\nexport async function loginWithLdap(\n  cookies: CookieWriter,\n  credentials: LdapCredentials,\n): Promise<HaiResult<AuthResult>> {\n  return runAuthLogin(cookies, credentials, (ops, input) => ops.loginWithLdap(input))\n}\n\n/**\n * 服务端登录（API Key）：内部调用 iam.auth.loginWithApiKey，成功时自动写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param credentials - API Key 凭证（key）\n * @returns 认证结果（成功时 Cookie 已自动写入）\n * @example 模块内部上下文\n * ```ts\n * async function signIn(cookies: CookieWriter, credentials: ApiKeyCredentials) {\n *   const result = await loginWithApiKey(cookies, credentials)\n *   if (!result.success) return result.error.message\n *   return result.data\n * }\n * ```\n */\nexport async function loginWithApiKey(\n  cookies: CookieWriter,\n  credentials: ApiKeyCredentials,\n): Promise<HaiResult<AuthResult>> {\n  return runAuthLogin(cookies, credentials, (ops, input) => ops.loginWithApiKey(input))\n}\n\n/**\n * 服务端注册并登录：内部调用 iam.auth.registerAndLogin，成功时自动写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param options - 注册选项（username、password、email 等）\n * @returns 认证结果（成功时 Cookie 已自动写入）\n * @example 模块内部上下文\n * ```ts\n * async function signIn(cookies: CookieWriter, credentials: RegisterOptions) {\n *   const result = await registerAndLogin(cookies, credentials)\n *   if (!result.success) return result.error.message\n *   return result.data\n * }\n * ```\n */\nexport async function registerAndLogin(\n  cookies: CookieWriter,\n  options: RegisterOptions,\n): Promise<HaiResult<AuthResult>> {\n  return runAuthLogin(cookies, options, (ops, input) => ops.registerAndLogin(input))\n}\n\n/**\n * 服务端登出：委托 iam.auth.logout 原子撤销凭据，并始终清除当前请求的 Token Cookie。\n * Cookie 清理只代表本地退出；服务端撤销失败仍返回失败，不能由调用端改成成功响应。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param accessToken - 访问令牌（为 null/undefined 时仅清除 Cookie）\n * @returns 服务端撤销结果；无令牌时仅清理 Cookie 并成功，有令牌但未配置认证操作时失败。\n * @remarks 底层控制流异常仍以 Promise 拒绝传播；Cookie 清理不吞掉业务失败。\n * @example 模块内部上下文\n * ```ts\n * async function signOut(cookies: CookieWriter, accessToken: string) {\n *   const result = await logout(cookies, accessToken)\n *   if (!result.success) return result.error.code\n *   return result.data\n * }\n * ```\n */\nexport async function logout(\n  cookies: CookieWriter,\n  accessToken?: string | null,\n): Promise<HaiResult<void>> {\n  try {\n    if (!accessToken)\n      return ok(undefined)\n    const ops = getAuthOperations()\n    if (!ops)\n      return authNotConfiguredError()\n    return await ops.logout(accessToken)\n  }\n  finally {\n    // 本地凭据无论是否撤销确认都要移除，但失败结果仍交给调用者明确提示。\n    clearToken(cookies)\n  }\n}\n\n// ─── 浏览器端 Token 存储（通过 kit.auth 暴露） ───\n\n/**\n * 写入默认浏览器端 Access Token（仅页面内存，不持久化到 localStorage）。\n * @param token - 当前页面内存中使用的 access token，不写入 Web Storage。\n * @example\n * ```ts\n * import { kit } from '@h-ai/kit'\n *\n * kit.auth.setBrowserToken('example-only-token')\n * // 页面注销时同步清除浏览器内存令牌。\n * kit.auth.clearBrowserToken()\n * ```\n */\nexport function setBrowserToken(token: string): void {\n  defaultBrowserTokenStore.set(token)\n}\n\n/**\n * 清除默认浏览器端 Access Token（仅页面内存）。\n * @example\n * ```ts\n * import { kit } from '@h-ai/kit'\n *\n * kit.auth.clearBrowserToken()\n * ```\n */\nexport function clearBrowserToken(): void {\n  defaultBrowserTokenStore.clear()\n}\n","/**\n * @h-ai/kit — 统一客户端\n *\n * 将 CSRF Token 附加与可选传输加密封装为统一 `apiFetch`。\n * 应用层只需调用一次 `createKitClient()`，后续 API 调用即可复用同一套安全能力。\n * @module kit-client\n */\n\nimport type { CryptoFunctions, TransportClient } from '@h-ai/crypto'\nimport type { BrowserTokenStore } from '../kit-auth.js'\nimport type { KitConfig } from '../kit-config.js'\nimport { TRANSPORT_PROTOCOL } from '@h-ai/crypto'\nimport { getDefaultBrowserTokenStore } from '../kit-auth.js'\nimport { DEFAULT_TRANSPORT_KEY_EXCHANGE_PATH, resolveTransportPath, shouldUseTransportForUrl } from '../modules/crypto/kit-transport-paths.js'\n\nconst DEFAULT_KEY_EXCHANGE_URL = `/api${TRANSPORT_PROTOCOL.DEFAULT_KEY_EXCHANGE_PATH}`\n\n// ─── 类型 ───\n\n/**\n * 传输加密客户端配置\n * @example\n * ```ts\n * import type { ClientTransportConfig } from '@h-ai/kit'\n * import { crypto } from '@h-ai/crypto'\n *\n * function configAfterInit(): ClientTransportConfig { return { crypto, excludePaths: ['/api/health'] } }\n * ```\n */\nexport interface ClientTransportConfig {\n  /** @h-ai/crypto 服务实例 */\n  crypto: CryptoFunctions\n  /** 密钥交换端点 URL（默认 `'/api/_hai/key-exchange'`） */\n  keyExchangeUrl?: string\n  /** 排除路径（命中后强制走明文），需与服务端 transport.excludePaths 保持一致 */\n  excludePaths?: string[]\n}\n\n/**\n * Kit 客户端配置\n * @example\n * ```ts\n * import type { KitClientConfig } from '@h-ai/kit'\n *\n * const value: KitClientConfig = { auth: true }\n * void value\n * ```\n */\nexport interface KitClientConfig {\n  /**\n   * 传输加密配置。\n   * - 不提供 / undefined：不启用传输加密，仅 CSRF\n   * - 提供对象：启用传输加密\n   */\n  transport?: ClientTransportConfig\n  /** CSRF Cookie 名称（默认 `'hai_csrf'`） */\n  csrfCookieName?: string\n  /** CSRF Header 名称（默认 `'X-CSRF-Token'`） */\n  csrfHeaderName?: string\n  /**\n   * 认证配置：自动从浏览器存储读取 Access Token 并注入请求头。\n   * - `true`：使用默认页面内存存储（由 `kit.auth.setBrowserToken()` 写入，不读写 localStorage）\n   * - `BrowserTokenStore`：使用自定义存储\n   * - 不提供 / `false`：不自动注入\n   */\n  auth?: boolean | BrowserTokenStore\n}\n\n/**\n * Kit 客户端实例\n * @example\n * ```ts\n * import type { KitClient } from '@h-ai/kit'\n *\n * async function read(client: KitClient) {\n *   const response = await client.apiFetch('/api/health')\n *   if (!response.ok) throw new Error('Request failed')\n *   return response.json()\n * }\n * ```\n */\nexport interface KitClient {\n  /** 统一 API fetch（写请求自动附加 CSRF，启用 transport 时自动加解密） */\n  apiFetch: (url: string, init?: RequestInit) => Promise<Response>\n  /** 传输加密是否就绪（未启用传输加密时始终为 true） */\n  readonly ready: boolean\n  /**\n   * 手动触发密钥交换（transport 启用时）。\n   *\n   * 注意：本方法是 Client 形态的合规例外，密钥协商失败时 `throw`（与 `@h-ai/api-client` 一致），\n   * 调用方需自行 `try/catch`，不返回 `HaiResult`。\n   */\n  init: () => Promise<void>\n  /** 销毁密钥状态 */\n  destroy: () => void\n}\n\n// ─── 工具函数 ───\n\n/**\n * 从 document.cookie 中读取指定名称的 Cookie 值\n *\n * @param name - Cookie 名称\n * @returns Cookie 值；不存在或运行在服务端时返回 undefined\n */\nfunction getCookie(name: string): string | undefined {\n  if (typeof document === 'undefined')\n    return undefined\n  const match = document.cookie.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`))\n  return match?.[1]\n}\n\n/**\n * 判断当前请求体是否可以作为文本载荷进行传输加密。\n *\n * 传输加密中间件会把解密后的明文重新注入 `Request`，当前仅能可靠保留\n * JSON 字符串请求体。`FormData` / `Blob` / `ArrayBuffer` 等二进制或浏览器\n * 自动生成边界的请求体必须保持原样发送，否则文件上传会被序列化成 `{}`。\n *\n * @param body fetch 请求体\n * @returns 是否支持客户端传输加密\n */\nfunction canEncryptRequestBody(body: BodyInit | null | undefined): boolean {\n  return body === undefined || body === null || typeof body === 'string'\n}\n\n/**\n * 判断全局 fetch 包装路径下，某个 `Request` 是否可走传输加密。\n *\n * 与上方 {@link canEncryptRequestBody} 区别：本谓词服务于 {@link installBrowserTransportFetch}\n * 的全局包装路径，输入是完整 `Request`，故可基于 method（GET/HEAD 无 body 安全放行）与\n * `Content-Type`（仅 JSON 可重注入明文）综合判定；而 `canEncryptRequestBody` 服务于\n * `createKitClient` 的 `apiFetch` 路径，仅拿到 `BodyInit`，只能按 body 类型粗判。\n * 两者判定维度不同是有意为之，请勿合并。\n */\nfunction canUseTransportForRequest(request: Request): boolean {\n  const method = request.method.toUpperCase()\n  if (method === 'GET' || method === 'HEAD') {\n    return true\n  }\n\n  const headers = new Headers(request.headers)\n  const contentType = headers.get('Content-Type') ?? ''\n  if (contentType.includes('application/json')) {\n    return true\n  }\n\n  return request.body === null\n}\n\nfunction getCurrentOrigin(): string {\n  if (typeof window !== 'undefined' && window.location?.origin) {\n    return window.location.origin\n  }\n\n  return 'http://localhost'\n}\n\nfunction toRequest(input: RequestInfo | URL, init?: RequestInit): Request {\n  if (input instanceof Request)\n    return init ? new Request(input, init) : input\n\n  return new Request(input, init)\n}\n\n/**\n * 浏览器全局 fetch 包装的幂等安装状态；属于当前浏览器页面。\n * @example 模块内部上下文\n * ```ts\n * const state: BrowserTransportFetchState = globalThis\n * const installed = state.__haiKitTransportFetchInstalled ?? false\n * void installed\n * ```\n */\ntype BrowserTransportFetchState = typeof globalThis & {\n  __haiKitOriginalFetch?: typeof fetch\n  __haiKitTransportFetchInstalled?: boolean\n}\n\n/**\n * 在浏览器启动时安装同源 transport fetch 包装。\n *\n * 该包装作用于同源 `/api/*` 与 SvelteKit `__data.json` 请求，页面文档、\n * 静态资源以及 multipart/form-data 等上传请求保持原样。应用只需安装一次，\n * 后续 `fetch` / SvelteKit 内部 data fetch / `kit.client.create()` 明文发送路径\n * 都会共用这层传输加密能力。\n * @param transportConfig - 已初始化 crypto、同源密钥交换路径及排除路径；省略时不安装包装。\n * @example\n * ```ts\n * import { kit } from '@h-ai/kit'\n *\n * // 不传配置时不安装全局包装；启用时应传已初始化 crypto 与同源端点。\n * kit.client.installBrowserTransportFetch()\n * ```\n */\nexport function installBrowserTransportFetch(transportConfig?: ClientTransportConfig): void {\n  if (typeof window === 'undefined' || !transportConfig)\n    return\n\n  const fetchState = globalThis as BrowserTransportFetchState\n  if (fetchState.__haiKitTransportFetchInstalled)\n    return\n\n  const originalFetch = fetchState.__haiKitOriginalFetch ?? globalThis.fetch.bind(globalThis)\n  fetchState.__haiKitOriginalFetch = originalFetch\n\n  const origin = getCurrentOrigin()\n  const keyExchangeUrl = new URL(transportConfig.keyExchangeUrl ?? DEFAULT_KEY_EXCHANGE_URL, origin).toString()\n  const keyExchangePath = resolveTransportPath(keyExchangeUrl, origin)\n  const transportClient = transportConfig.crypto.transport.createClient({\n    keyExchangeUrl,\n    fetch: originalFetch,\n  })\n\n  const wrappedFetch: typeof fetch = async (input, init) => {\n    const request = toRequest(input, init)\n    const requestUrl = new URL(request.url, origin)\n    const headers = new Headers(request.headers)\n\n    if (!shouldUseTransportForUrl(requestUrl, {\n      origin,\n      keyExchangePath,\n      excludePaths: transportConfig.excludePaths,\n    })) {\n      return originalFetch(input, init)\n    }\n\n    if (headers.has(TRANSPORT_PROTOCOL.CLIENT_ID_HEADER))\n      return originalFetch(input, init)\n\n    if (!canUseTransportForRequest(request))\n      return originalFetch(input, init)\n\n    return transportClient.encryptedFetch(request)\n  }\n\n  globalThis.fetch = wrappedFetch\n  window.fetch = wrappedFetch\n  fetchState.__haiKitTransportFetchInstalled = true\n}\n\n/**\n * 用 `config/_kit.yml` 解析后的 {@link KitConfig} 一次性安装浏览器端传输加密。\n *\n * 行为：\n * - `config.transport === false` 时直接返回（不启用传输加密）；\n * - 否则启动 {@link installBrowserTransportFetch}，并预热 {@link CryptoFunctions} 模块。\n *\n * 应用层（SvelteKit `+layout.svelte` 或浏览器入口）只需调用此函数一次，\n * 之后所有同源 `/api/*` 与 `__data.json` 请求都会自动走传输加密。\n *\n * @param config 已解析的 kit 顶层配置\n * @param deps  外部依赖\n * @param deps.crypto `@h-ai/crypto` 模块实例\n * @example\n * ```ts\n * import { kit } from '@h-ai/kit'\n *\n * import { crypto } from '@h-ai/crypto'\n *\n * function installAfterCryptoInit() {\n *   kit.client.installBrowserTransport({ server: { host: '127.0.0.1', port: 3000 }, transport: { keyExchangePath: '/api/_hai/key-exchange', excludePaths: ['/api/health'] } }, { crypto })\n * }\n * ```\n */\nexport function installBrowserTransport(\n  config: KitConfig,\n  deps: { crypto: CryptoFunctions },\n): void {\n  if (typeof window === 'undefined' || config.transport === false)\n    return\n\n  // crypto.init() 当前为同步副作用（signature 是 async 仅为接口一致性），\n  // 此处不 await，以便 `+layout.svelte` 顶层模块加载阶段就完成初始化。\n  void deps.crypto.init()\n\n  installBrowserTransportFetch({\n    crypto: deps.crypto,\n    keyExchangeUrl: config.transport.keyExchangePath,\n    excludePaths: [...config.transport.excludePaths],\n  })\n}\n\n// ─── 主函数 ───\n\n/**\n * 创建 Kit 客户端\n *\n * 返回统一的 `apiFetch`，内部自动完成：\n * 1. CSRF Token 附加（写方法自动读取 Cookie + 设置 Header）\n * 2. 密钥交换（首次写请求时 lazy init，transport 启用时）\n * 3. 请求体加密（transport 启用时）\n * 4. 响应体解密（transport 启用时）\n *\n * @param config - 客户端配置\n * @returns KitClient 实例\n * @example\n * ```ts\n * import { kit } from '@h-ai/kit'\n *\n * const client = kit.client.create({ auth: true })\n * try {\n *   await client.init() // Client API 使用 Promise 拒绝；不是 HaiResult。\n *   const response = await client.apiFetch('/api/health')\n *   if (!response.ok) throw new Error('Request failed')\n * } finally {\n *   client.destroy()\n * }\n * ```\n */\nexport function createKitClient(config: KitClientConfig = {}): KitClient {\n  const {\n    transport: transportConfig,\n    csrfCookieName = 'hai_csrf',\n    csrfHeaderName = 'X-CSRF-Token',\n    auth: authConfig,\n  } = config\n\n  // ── Auth token store ──\n  // 安全默认：auth:true 只读取页面内存 token，避免隐式 localStorage 持久化敏感凭证。\n  const authStore: BrowserTokenStore | null = authConfig\n    ? (authConfig === true ? getDefaultBrowserTokenStore() : authConfig)\n    : null\n\n  // ── 传输加密状态 ──\n  const transportOrigin = getCurrentOrigin()\n  const transportKeyExchangeUrl = transportConfig?.keyExchangeUrl ?? DEFAULT_KEY_EXCHANGE_URL\n  const transportKeyExchangePath = transportConfig\n    ? resolveTransportPath(transportKeyExchangeUrl, transportOrigin)\n    : DEFAULT_TRANSPORT_KEY_EXCHANGE_PATH\n  const transportClient: TransportClient | null = transportConfig\n    ? transportConfig.crypto.transport.createClient({\n        keyExchangeUrl: transportKeyExchangeUrl,\n        fetch,\n      })\n    : null\n\n  /**\n   * 统一 API fetch\n   */\n  async function apiFetch(url: string, init: RequestInit = {}): Promise<Response> {\n    const method = (init.method ?? 'GET').toUpperCase()\n    const isWriteMethod = !['GET', 'HEAD', 'OPTIONS'].includes(method)\n    const canUseTransport = canEncryptRequestBody(init.body)\n\n    const headers = new Headers(init.headers)\n\n    // ── Auth ──\n    if (authStore) {\n      const token = authStore.get()\n      if (token) {\n        headers.set('Authorization', `Bearer ${token}`)\n      }\n    }\n\n    // ── CSRF ──\n    if (isWriteMethod) {\n      const csrfToken = getCookie(csrfCookieName)\n      if (csrfToken) {\n        headers.set(csrfHeaderName, csrfToken)\n      }\n    }\n\n    // ── 传输加密 ──\n    if (\n      transportClient\n      && canUseTransport\n      && shouldUseTransportForUrl(url, {\n        origin: transportOrigin,\n        keyExchangePath: transportKeyExchangePath,\n        excludePaths: transportConfig?.excludePaths,\n      })\n    ) {\n      return transportClient.encryptedFetch(url, { ...init, headers })\n    }\n\n    // ── 发送（FormData/Blob/Stream 等保持原样，不破坏浏览器边界） ──\n    return fetch(url, { ...init, headers })\n  }\n\n  return {\n    apiFetch,\n    get ready() { return !transportClient || transportClient.ready() },\n    async init() {\n      if (!transportClient)\n        return\n      const result = await transportClient.init()\n      if (!result.success)\n        throw new Error(result.error.message)\n    },\n    destroy() {\n      transportClient?.destroy()\n    },\n  }\n}\n","/** 与标准 Kit 认证端点配套的表单动作；复用已有 CSRF/transport fetch。 */\nimport type { IamLoginInput, IamPublicConfig, IamRegisterInput } from '@h-ai/api-contract'\nimport type { HaiResult } from '@h-ai/core'\nimport type { KitClient } from './kit-client.js'\nimport { apiContract, IamPublicConfigSchema } from '@h-ai/api-contract'\nimport { ok } from '@h-ai/core'\nimport { z } from 'zod'\nimport { createKitClient } from './kit-client.js'\n\n/**\n * 创建标准 Cookie 认证表单动作；复用可选 apiFetch 以保留 CSRF 和传输配置。\n * @param options - 可复用的 apiFetch 和标准认证端点 basePath。\n * @param options.apiFetch - 已装配 CSRF/transport 的 fetch；省略时使用默认 Kit 客户端。\n * @param options.basePath - 同源认证端点前缀，默认 /api/auth。\n * @returns 标准表单动作；业务返回 HaiResult，网络/格式错误会拒绝 Promise。\n * @example\n * ```ts\n * import { kit } from '@h-ai/kit'\n *\n * const actions = kit.client.createAuthActions({ basePath: '/api/auth' })\n * void actions\n * ```\n */\nexport function createKitAuthActions(options: { apiFetch?: KitClient['apiFetch'], basePath?: string } = {}) {\n  const apiFetch = options.apiFetch ?? createKitClient().apiFetch\n  const base = options.basePath ?? '/api/auth'\n  async function post(path: string, input: object): Promise<HaiResult<unknown>> {\n    const response = await apiFetch(`${base}/${path}`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(input) })\n    // void 成功响应在 JSON 中省略 data，统一还原为 HaiResult 的 data: undefined。\n    const result = apiContract.haiResultSchema(z.unknown().optional()).parse(await response.json())\n    return result.success ? ok(result.data) : result\n  }\n  return {\n    async publicConfig(): Promise<HaiResult<IamPublicConfig | null>> {\n      const response = await apiFetch(`${base}/config`)\n      return apiContract.haiResultSchema(IamPublicConfigSchema.nullable()).parse(await response.json())\n    },\n    login(input: IamLoginInput & { method?: 'password' | 'ldap' | 'email' | 'sms', code?: string }) {\n      if (input.method === 'ldap')\n        return post('login/ldap', { username: input.identifier, password: input.password })\n      if (input.method === 'email' || input.method === 'sms')\n        return post('login/otp', { identifier: input.identifier, code: input.code })\n      return post('login', { identifier: input.identifier, password: input.password })\n    },\n    register: (input: IamRegisterInput) => post('register', { ...input, confirmPassword: input.password }),\n    sendOtp: (identifier: string) => post('otp/send', { identifier }),\n    requestPasswordReset: (identifier: string) => post('password-reset/request', { identifier }),\n    confirmPasswordReset: (token: string, newPassword: string) => post('password-reset/confirm', { token, newPassword }),\n  }\n}\n"]}

package/dist/{chunk-MLSP67JF.js → chunk-333FGMGQ.js}

@@ -1,8 +1,7 @@
-import { DEFAULT_TRANSPORT_KEY_EXCHANGE_PATH, shouldHandleTransportPath, shouldExcludeTransportPath } from './chunk-NVYIUBU7.js';
-import { kitM } from './chunk-QHYNL24G.js';
-import { TRANSPORT_PROTOCOL } from '@h-ai/crypto';
+import { DEFAULT_TRANSPORT_KEY_EXCHANGE_PATH, shouldHandleTransportPath, shouldExcludeTransportPath } from './chunk-XC7I2L3G.js';
+import { kitM } from './chunk-OVRZIDCD.js';
+import { TRANSPORT_PROTOCOL, authenticateTransportRequest, readTransportBody, TRANSPORT_BODY_LIMITS, isValidSM2PublicKey } from '@h-ai/crypto';
 
-var MAX_ENCRYPTED_BODY = 1048576;
 var ENCRYPTABLE_RESPONSE_CONTENT_TYPES = ["application/json", "text/sveltekit-data"];
 function transportEncryptionMiddleware(config) {
   if (!config.enabled) {
@@ -10,11 +9,9 @@ function transportEncryptionMiddleware(config) {
   }
   const keyExchangePath = config.keyExchangePath ?? DEFAULT_TRANSPORT_KEY_EXCHANGE_PATH;
   const excludePaths = config.excludePaths ?? [];
-  const encryptResponse = config.encryptResponse ?? true;
-  const requireEncryption = config.requireEncryption ?? true;
   const result = config.crypto.transport.createServer({
-    keyStore: config.keyStore,
-    maxClients: config.maxClients
+    serverKeyRing: config.serverKeyRing,
+    keyStore: config.keyStore
   });
   if (!result.success) {
     return createUnavailableTransportMiddleware(keyExchangePath, excludePaths);
@@ -33,50 +30,48 @@ function transportEncryptionMiddleware(config) {
       return next();
     }
     const clientId = event.request.headers.get(TRANSPORT_PROTOCOL.CLIENT_ID_HEADER);
-    if (!clientId) {
-      if (requireEncryption) {
-        return jsonError(kitM("kit_transportClientIdRequired"), 400);
-      }
-      return next();
-    }
-    const clientPublicKey = await manager.getClientPublicKey(clientId);
-    if (!clientPublicKey) {
-      return jsonError(kitM("kit_transportClientKeyNotFound"), 400);
-    }
-    if (hasBody(event.request.method) && !isRequestBodyEmpty(event.request)) {
-      const decryptResult = await decryptRequestBody(event, manager, requireEncryption);
-      if (decryptResult) {
-        return decryptResult;
-      }
+    if (!clientId)
+      return jsonError(kitM("kit_transportClientIdRequired"), 400);
+    let requestContext;
+    try {
+      const verified = await authenticateTransportRequest(manager, event.request);
+      if (!verified.success)
+        return jsonError(kitM("kit_transportDecryptFailed"), 400);
+      requestContext = verified.data.context;
+      if (event.request.method !== "GET" && event.request.method !== "HEAD")
+        replaceRequestBody(event, verified.data.plaintext);
+    } catch (error) {
+      return jsonError(kitM("kit_transportInvalidPayload"), error instanceof RangeError ? 413 : 400);
     }
     const response = await next();
-    if (!encryptResponse) {
-      return response;
-    }
-    if (isEmptyResponse(response)) {
-      return response;
-    }
+    const bodyless = event.request.method === "HEAD" || isEmptyResponse(response);
+    if (bodyless)
+      void response.body?.cancel().catch(() => {
+      });
     const contentType = response.headers.get("Content-Type") ?? "";
-    if (!canEncryptResponseContentType(contentType)) {
-      return jsonError(kitM("kit_transportEncryptFailed"), 500);
-    }
-    const contentLength = response.headers.get("Content-Length");
-    if (contentLength && Number.parseInt(contentLength, 10) > MAX_ENCRYPTED_BODY) {
+    if (!bodyless && !canEncryptResponseContentType(contentType)) {
+      void response.body?.cancel().catch(() => {
+      });
       return jsonError(kitM("kit_transportEncryptFailed"), 500);
     }
     try {
-      const responseBody = await response.clone().text();
-      if (!responseBody) {
-        return response;
-      }
-      const encryptedPayload = await manager.encryptResponse(clientId, responseBody);
+      const responseBody = bodyless ? "" : await readTransportBody(response.body, {
+        maxBytes: TRANSPORT_BODY_LIMITS.plaintextBytes,
+        signal: event.request.signal
+      });
+      const headers = new Headers(response.headers);
+      headers.delete(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER);
+      headers.delete(TRANSPORT_PROTOCOL.ENVELOPE_HEADER);
+      headers.delete("Content-Length");
+      headers.delete("Content-Encoding");
+      const encryptedPayload = await manager.encryptResponse(requestContext, responseBody, response.status);
       if (!encryptedPayload.success) {
         return jsonError(kitM("kit_transportEncryptFailed"), 500);
       }
-      const headers = new Headers(response.headers);
       headers.set(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER, TRANSPORT_PROTOCOL.ENCRYPTED_HEADER_VALUE);
-      headers.delete("Content-Length");
-      return new Response(JSON.stringify(encryptedPayload.data), {
+      if (bodyless)
+        headers.set(TRANSPORT_PROTOCOL.ENVELOPE_HEADER, JSON.stringify(encryptedPayload.data));
+      return new Response(bodyless ? null : JSON.stringify(encryptedPayload.data), {
         status: response.status,
         statusText: response.statusText,
         headers
@@ -107,7 +102,7 @@ function createUnavailableTransportMiddleware(keyExchangePath, excludePaths) {
 function isEmptyResponse(response) {
   if ([204, 304].includes(response.status))
     return true;
-  return response.headers.get("Content-Length") === "0";
+  return response.body === null;
 }
 function getRequestPathname(request) {
   return new URL(request.url).pathname;
@@ -119,41 +114,42 @@ function jsonError(message, status) {
   });
 }
 async function handleKeyExchange(manager, request) {
+  let body;
+  try {
+    body = JSON.parse(await readTransportBody(request.body, {
+      maxBytes: TRANSPORT_BODY_LIMITS.keyExchangeBytes,
+      signal: request.signal
+    }));
+  } catch (error) {
+    return jsonError(kitM("kit_transportInvalidPayload"), error instanceof RangeError ? 413 : 400);
+  }
+  if (!body || typeof body !== "object" || !("clientPublicKey" in body) || !isValidSM2PublicKey(body.clientPublicKey) || new TextEncoder().encode(body.clientPublicKey).byteLength > TRANSPORT_BODY_LIMITS.publicKeyBytes) {
+    return jsonError(kitM("kit_transportInvalidPayload"), 400);
+  }
   try {
-    const body = await request.json();
-    if (!body.clientPublicKey || typeof body.clientPublicKey !== "string") {
-      return jsonError(kitM("kit_transportInvalidPayload"), 400);
-    }
-    const clientId = await manager.registerClientKey(body.clientPublicKey);
     const serverPublicKey = manager.getServerPublicKey();
+    if (new TextEncoder().encode(serverPublicKey).byteLength > TRANSPORT_BODY_LIMITS.publicKeyBytes)
+      return jsonError(kitM("kit_transportKeyExchangeFailed"), 500);
+    const clientId = await manager.registerClientKey(body.clientPublicKey);
     return new Response(
-      JSON.stringify({ serverPublicKey, clientId }),
+      JSON.stringify({ serverKeyId: manager.getServerKeyId(), serverPublicKey, clientId }),
       { status: 200, headers: { "Content-Type": "application/json" } }
     );
   } catch {
     return jsonError(kitM("kit_transportKeyExchangeFailed"), 500);
   }
 }
-function hasBody(method) {
-  return ["POST", "PUT", "PATCH", "DELETE"].includes(method.toUpperCase());
-}
-function isRequestBodyEmpty(request) {
-  if (request.body === null)
-    return true;
-  const contentLength = request.headers.get("Content-Length");
-  if (contentLength !== null)
-    return Number.parseInt(contentLength, 10) === 0;
-  return false;
-}
 function replaceRequestBody(event, body) {
   const headers = new Headers(event.request.headers);
   headers.delete(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER);
   headers.delete("Content-Length");
+  headers.delete("Content-Encoding");
   headers.set("Content-Type", "application/json; charset=utf-8");
   const newRequest = new Request(event.request.url, {
     method: event.request.method,
     headers,
-    body
+    body,
+    signal: event.request.signal
   });
   Object.defineProperty(event, "request", {
     value: newRequest,
@@ -161,55 +157,7 @@ function replaceRequestBody(event, body) {
     configurable: true
   });
 }
-async function decryptRequestBody(event, manager, requireEncryption) {
-  const isEncrypted = event.request.headers.get(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER) === TRANSPORT_PROTOCOL.ENCRYPTED_HEADER_VALUE;
-  if (!isEncrypted) {
-    if (!requireEncryption)
-      return null;
-    return jsonError(kitM("kit_transportInvalidPayload"), 400);
-  }
-  const contentType = event.request.headers.get("Content-Type") ?? "";
-  if (!contentType.includes("application/json")) {
-    if (!requireEncryption) {
-      return null;
-    }
-    return jsonError(kitM("kit_transportInvalidPayload"), 400);
-  }
-  const bodyText = await event.request.text();
-  if (!bodyText) {
-    return null;
-  }
-  let payload;
-  try {
-    payload = JSON.parse(bodyText);
-  } catch {
-    if (!requireEncryption) {
-      replaceRequestBody(event, bodyText);
-      return null;
-    }
-    return jsonError(kitM("kit_transportDecryptFailed"), 400);
-  }
-  if (!isEncryptedPayloadShape(payload)) {
-    if (!requireEncryption) {
-      replaceRequestBody(event, bodyText);
-      return null;
-    }
-    return jsonError(kitM("kit_transportInvalidPayload"), 400);
-  }
-  const plaintext = manager.decryptRequest(payload);
-  if (!plaintext.success) {
-    return jsonError(kitM("kit_transportDecryptFailed"), 400);
-  }
-  replaceRequestBody(event, plaintext.data);
-  return null;
-}
-function isEncryptedPayloadShape(payload) {
-  if (!payload || typeof payload !== "object")
-    return false;
-  const p = payload;
-  return typeof p.encryptedKey === "string" && typeof p.ciphertext === "string" && typeof p.iv === "string";
-}
 
 export { transportEncryptionMiddleware };
-//# sourceMappingURL=chunk-MLSP67JF.js.map
-//# sourceMappingURL=chunk-MLSP67JF.js.map
+//# sourceMappingURL=chunk-333FGMGQ.js.map
+//# sourceMappingURL=chunk-333FGMGQ.js.map

package/dist/chunk-333FGMGQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/modules/crypto/kit-transport-middleware.ts"],"names":[],"mappings":";;;;AAcA,IAAM,kCAAA,GAAqC,CAAC,kBAAA,EAAoB,qBAAqB,CAAA;AAc9E,SAAS,8BAA8B,MAAA,EAA+C;AAE3F,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,OAAO,OAAO,QAAA,EAAU,IAAA,KAAS,IAAA,EAAK;AAAA,EACxC;AAEA,EAAA,MAAM,eAAA,GAAkB,OAAO,eAAA,IAAmB,mCAAA;AAClD,EAAA,MAAM,YAAA,GAAe,MAAA,CAAO,YAAA,IAAgB,EAAC;AAG7C,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,YAAA,CAAa;AAAA,IAClD,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,UAAU,MAAA,CAAO;AAAA,GAClB,CAAA;AACD,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AAEnB,IAAA,OAAO,oCAAA,CAAqC,iBAAiB,YAAY,CAAA;AAAA,EAC3E;AACA,EAAA,MAAM,UAAU,MAAA,CAAO,IAAA;AAEvB,EAAA,OAAO,OAAO,SAAS,IAAA,KAAS;AAC9B,IAAA,MAAM,EAAE,OAAM,GAAI,OAAA;AAClB,IAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,KAAA,CAAM,OAAO,CAAA;AAGjD,IAAA,IAAI,QAAA,KAAa,eAAA,IAAmB,KAAA,CAAM,OAAA,CAAQ,WAAW,MAAA,EAAQ;AACnE,MAAA,OAAO,iBAAA,CAAkB,OAAA,EAAS,KAAA,CAAM,OAAO,CAAA;AAAA,IACjD;AAIA,IAAA,IAAI,CAAC,yBAAA,CAA0B,QAAA,EAAU,eAAe,CAAA,EAAG;AACzD,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AAGA,IAAA,IAAI,0BAAA,CAA2B,QAAA,EAAU,YAAA,EAAc,eAAe,CAAA,EAAG;AACvE,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AAGA,IAAA,MAAM,WAAW,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,gBAAgB,CAAA;AAC9E,IAAA,IAAI,CAAC,QAAA;AACH,MAAA,OAAO,SAAA,CAAU,IAAA,CAAK,+BAA+B,CAAA,EAAG,GAAG,CAAA;AAI7D,IAAA,IAAI,cAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,4BAAA,CAA6B,OAAA,EAAS,MAAM,OAAO,CAAA;AAC1E,MAAA,IAAI,CAAC,QAAA,CAAS,OAAA;AACZ,QAAA,OAAO,SAAA,CAAU,IAAA,CAAK,4BAA4B,CAAA,EAAG,GAAG,CAAA;AAC1D,MAAA,cAAA,GAAiB,SAAS,IAAA,CAAK,OAAA;AAC/B,MAAA,IAAI,MAAM,OAAA,CAAQ,MAAA,KAAW,KAAA,IAAS,KAAA,CAAM,QAAQ,MAAA,KAAW,MAAA;AAC7D,QAAA,kBAAA,CAAmB,KAAA,EAAO,QAAA,CAAS,IAAA,CAAK,SAAS,CAAA;AAAA,IACrD,SACO,KAAA,EAAO;AACZ,MAAA,OAAO,UAAU,IAAA,CAAK,6BAA6B,GAAG,KAAA,YAAiB,UAAA,GAAa,MAAM,GAAG,CAAA;AAAA,IAC/F;AAGA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,EAAK;AAK5B,IAAA,MAAM,WAAW,KAAA,CAAM,OAAA,CAAQ,MAAA,KAAW,MAAA,IAAU,gBAAgB,QAAQ,CAAA;AAC5E,IAAA,IAAI,QAAA;AACF,MAAA,KAAK,QAAA,CAAS,IAAA,EAAM,MAAA,EAAO,CAAE,MAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AAE7C,IAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC5D,IAAA,IAAI,CAAC,QAAA,IAAY,CAAC,6BAAA,CAA8B,WAAW,CAAA,EAAG;AAC5D,MAAA,KAAK,QAAA,CAAS,IAAA,EAAM,MAAA,EAAO,CAAE,MAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AAC3C,MAAA,OAAO,SAAA,CAAU,IAAA,CAAK,4BAA4B,CAAA,EAAG,GAAG,CAAA;AAAA,IAC1D;AACA,IAAA,IAAI;AACF,MAAA,MAAM,eAAe,QAAA,GACjB,EAAA,GACA,MAAM,iBAAA,CAAkB,SAAS,IAAA,EAAM;AAAA,QACrC,UAAU,qBAAA,CAAsB,cAAA;AAAA,QAChC,MAAA,EAAQ,MAAM,OAAA,CAAQ;AAAA,OACvB,CAAA;AACL,MAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,QAAA,CAAS,OAAO,CAAA;AAC5C,MAAA,OAAA,CAAQ,MAAA,CAAO,mBAAmB,gBAAgB,CAAA;AAClD,MAAA,OAAA,CAAQ,MAAA,CAAO,mBAAmB,eAAe,CAAA;AACjD,MAAA,OAAA,CAAQ,OAAO,gBAAgB,CAAA;AAC/B,MAAA,OAAA,CAAQ,OAAO,kBAAkB,CAAA;AAEjC,MAAA,MAAM,mBAAmB,MAAM,OAAA,CAAQ,gBAAgB,cAAA,EAAgB,YAAA,EAAc,SAAS,MAAM,CAAA;AACpG,MAAA,IAAI,CAAC,iBAAiB,OAAA,EAAS;AAC7B,QAAA,OAAO,SAAA,CAAU,IAAA,CAAK,4BAA4B,CAAA,EAAG,GAAG,CAAA;AAAA,MAC1D;AACA,MAAA,OAAA,CAAQ,GAAA,CAAI,kBAAA,CAAmB,gBAAA,EAAkB,kBAAA,CAAmB,sBAAsB,CAAA;AAC1F,MAAA,IAAI,QAAA;AACF,QAAA,OAAA,CAAQ,IAAI,kBAAA,CAAmB,eAAA,EAAiB,KAAK,SAAA,CAAU,gBAAA,CAAiB,IAAI,CAAC,CAAA;AACvF,MAAA,OAAO,IAAI,SAAS,QAAA,GAAW,IAAA,GAAO,KAAK,SAAA,CAAU,gBAAA,CAAiB,IAAI,CAAA,EAAG;AAAA,QAC3E,QAAQ,QAAA,CAAS,MAAA;AAAA,QACjB,YAAY,QAAA,CAAS,UAAA;AAAA,QACrB;AAAA,OACD,CAAA;AAAA,IACH,CAAA,CAAA,MACM;AACJ,MAAA,OAAO,SAAA,CAAU,IAAA,CAAK,4BAA4B,CAAA,EAAG,GAAG,CAAA;AAAA,IAC1D;AAAA,EACF,CAAA;AACF;AAEA,SAAS,8BAA8B,WAAA,EAA8B;AACnE,EAAA,OAAO,mCAAmC,IAAA,CAAK,CAAA,IAAA,KAAQ,WAAA,CAAY,QAAA,CAAS,IAAI,CAAC,CAAA;AACnF;AAEA,SAAS,oCAAA,CACP,iBACA,YAAA,EACY;AACZ,EAAA,OAAO,OAAO,SAAS,IAAA,KAAS;AAC9B,IAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,OAAA,CAAQ,KAAA,CAAM,OAAO,CAAA;AACzD,IAAA,IAAI,aAAa,eAAA,EAAiB;AAChC,MAAA,OAAO,SAAA,CAAU,IAAA,CAAK,kCAAkC,CAAA,EAAG,GAAG,CAAA;AAAA,IAChE;AACA,IAAA,IAAI,CAAC,yBAAA,CAA0B,QAAA,EAAU,eAAe,CAAA,EAAG;AACzD,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AACA,IAAA,IAAI,0BAAA,CAA2B,QAAA,EAAU,YAAA,EAAc,eAAe,CAAA,EAAG;AACvE,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AACA,IAAA,OAAO,SAAA,CAAU,IAAA,CAAK,kCAAkC,CAAA,EAAG,GAAG,CAAA;AAAA,EAChE,CAAA;AACF;AAEA,SAAS,gBAAgB,QAAA,EAA6B;AACpD,EAAA,IAAI,CAAC,GAAA,EAAK,GAAG,CAAA,CAAE,QAAA,CAAS,SAAS,MAAM,CAAA;AACrC,IAAA,OAAO,IAAA;AAET,EAAA,OAAO,SAAS,IAAA,KAAS,IAAA;AAC3B;AAEA,SAAS,mBAAmB,OAAA,EAA0B;AACpD,EAAA,OAAO,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA,CAAE,QAAA;AAC9B;AAEA,SAAS,SAAA,CAAU,SAAiB,MAAA,EAA0B;AAC5D,EAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG;AAAA,IACtD,MAAA;AAAA,IACA,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,GAC/C,CAAA;AACH;AAWA,eAAe,iBAAA,CACb,SACA,OAAA,EACmB;AACnB,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,MAAM,iBAAA,CAAkB,QAAQ,IAAA,EAAM;AAAA,MACtD,UAAU,qBAAA,CAAsB,gBAAA;AAAA,MAChC,QAAQ,OAAA,CAAQ;AAAA,KACjB,CAAC,CAAA;AAAA,EACJ,SACO,KAAA,EAAO;AACZ,IAAA,OAAO,UAAU,IAAA,CAAK,6BAA6B,GAAG,KAAA,YAAiB,UAAA,GAAa,MAAM,GAAG,CAAA;AAAA,EAC/F;AACA,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,KAAS,YAAY,EAAE,iBAAA,IAAqB,IAAA,CAAA,IAC3D,CAAC,mBAAA,CAAoB,IAAA,CAAK,eAAe,CAAA,IACzC,IAAI,aAAY,CAAE,MAAA,CAAO,KAAK,eAAe,CAAA,CAAE,UAAA,GAAa,qBAAA,CAAsB,cAAA,EAAgB;AACrG,IAAA,OAAO,SAAA,CAAU,IAAA,CAAK,6BAA6B,CAAA,EAAG,GAAG,CAAA;AAAA,EAC3D;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,eAAA,GAAkB,QAAQ,kBAAA,EAAmB;AACnD,IAAA,IAAI,IAAI,WAAA,EAAY,CAAE,OAAO,eAAe,CAAA,CAAE,aAAa,qBAAA,CAAsB,cAAA;AAC/E,MAAA,OAAO,SAAA,CAAU,IAAA,CAAK,gCAAgC,CAAA,EAAG,GAAG,CAAA;AAC9D,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,iBAAA,CAAkB,KAAK,eAAe,CAAA;AAErE,IAAA,OAAO,IAAI,QAAA;AAAA,MACT,IAAA,CAAK,UAAU,EAAE,WAAA,EAAa,QAAQ,cAAA,EAAe,EAAG,eAAA,EAAiB,QAAA,EAAU,CAAA;AAAA,MACnF,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAS,EAAE,cAAA,EAAgB,oBAAmB;AAAE,KACjE;AAAA,EACF,CAAA,CAAA,MACM;AACJ,IAAA,OAAO,SAAA,CAAU,IAAA,CAAK,gCAAgC,CAAA,EAAG,GAAG,CAAA;AAAA,EAC9D;AACF;AAsBA,SAAS,kBAAA,CAAmB,OAAsB,IAAA,EAAoB;AACpE,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,KAAA,CAAM,QAAQ,OAAO,CAAA;AACjD,EAAA,OAAA,CAAQ,MAAA,CAAO,mBAAmB,gBAAgB,CAAA;AAClD,EAAA,OAAA,CAAQ,OAAO,gBAAgB,CAAA;AAC/B,EAAA,OAAA,CAAQ,OAAO,kBAAkB,CAAA;AACjC,EAAA,OAAA,CAAQ,GAAA,CAAI,gBAAgB,iCAAiC,CAAA;AAC7D,EAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,KAAA,CAAM,QAAQ,GAAA,EAAK;AAAA,IAChD,MAAA,EAAQ,MAAM,OAAA,CAAQ,MAAA;AAAA,IACtB,OAAA;AAAA,IACA,IAAA;AAAA,IACA,MAAA,EAAQ,MAAM,OAAA,CAAQ;AAAA,GACvB,CAAA;AACD,EAAA,MAAA,CAAO,cAAA,CAAe,OAAO,SAAA,EAAW;AAAA,IACtC,KAAA,EAAO,UAAA;AAAA,IACP,QAAA,EAAU,IAAA;AAAA,IACV,YAAA,EAAc;AAAA,GACf,CAAA;AACH","file":"chunk-333FGMGQ.js","sourcesContent":["/**\n * @h-ai/kit — 传输加密中间件\n *\n * SvelteKit 中间件，自动对请求/响应进行传输加密解密。\n * @module kit-transport-middleware\n */\n\nimport type { TransportEncryptionManager, TransportMessageContext } from '@h-ai/crypto'\nimport type { Middleware } from '../../kit-types.js'\nimport type { TransportEncryptionConfig } from './kit-crypto-types.js'\nimport { authenticateTransportRequest, isValidSM2PublicKey, readTransportBody, TRANSPORT_BODY_LIMITS, TRANSPORT_PROTOCOL } from '@h-ai/crypto'\nimport { kitM } from '../../kit-i18n.js'\nimport { DEFAULT_TRANSPORT_KEY_EXCHANGE_PATH, shouldExcludeTransportPath, shouldHandleTransportPath } from './kit-transport-paths.js'\n\nconst ENCRYPTABLE_RESPONSE_CONTENT_TYPES = ['application/json', 'text/sveltekit-data']\n\n/**\n * 创建传输加密中间件\n *\n * @param config - 传输加密配置\n * @returns SvelteKit 中间件\n * @example 模块内部上下文\n * ```ts\n * function install(config: TransportEncryptionConfig) {\n *   return transportEncryptionMiddleware(config) // 受管密钥环、共享 keyStore 与 crypto 生命周期由应用管理。\n * }\n * ```\n */\nexport function transportEncryptionMiddleware(config: TransportEncryptionConfig): Middleware {\n  // 未启用时直接透传\n  if (!config.enabled) {\n    return async (_context, next) => next()\n  }\n\n  const keyExchangePath = config.keyExchangePath ?? DEFAULT_TRANSPORT_KEY_EXCHANGE_PATH\n  const excludePaths = config.excludePaths ?? []\n\n  // 初始化传输加密管理器\n  const result = config.crypto.transport.createServer({\n    serverKeyRing: config.serverKeyRing,\n    keyStore: config.keyStore,\n  })\n  if (!result.success) {\n    // 安全策略：transport 已启用但服务端管理器不可用时，受保护路由必须 fail-closed，禁止明文透传。\n    return createUnavailableTransportMiddleware(keyExchangePath, excludePaths)\n  }\n  const manager = result.data\n\n  return async (context, next) => {\n    const { event } = context\n    const pathname = getRequestPathname(event.request)\n\n    // 密钥交换端点：委托给 keyExchangeHandler\n    if (pathname === keyExchangePath && event.request.method === 'POST') {\n      return handleKeyExchange(manager, event.request)\n    }\n\n    // 仅对同源 API endpoint 与 SvelteKit __data 请求启用 transport；\n    // 页面文档、静态资源等仍透传，避免首页 HTML 被误拦截。\n    if (!shouldHandleTransportPath(pathname, keyExchangePath)) {\n      return next()\n    }\n\n    // 排除路径不做加解密\n    if (shouldExcludeTransportPath(pathname, excludePaths, keyExchangePath)) {\n      return next()\n    }\n\n    // 请求头中无 X-Client-Id 时的处理\n    const clientId = event.request.headers.get(TRANSPORT_PROTOCOL.CLIENT_ID_HEADER)\n    if (!clientId)\n      return jsonError(kitM('kit_transportClientIdRequired'), 400)\n\n    // ── 解密请求 ──\n    // 不依赖可伪造/省略的 Content-Length/Type 判空，非 null 流必须进入实际内容检查。\n    let requestContext: TransportMessageContext\n    try {\n      const verified = await authenticateTransportRequest(manager, event.request)\n      if (!verified.success)\n        return jsonError(kitM('kit_transportDecryptFailed'), 400)\n      requestContext = verified.data.context\n      if (event.request.method !== 'GET' && event.request.method !== 'HEAD')\n        replaceRequestBody(event, verified.data.plaintext)\n    }\n    catch (error) {\n      return jsonError(kitM('kit_transportInvalidPayload'), error instanceof RangeError ? 413 : 400)\n    }\n\n    // ── 执行后续中间件/端点 ──\n    const response = await next()\n\n    // ── 加密响应 ──\n\n    // 只允许可安全加密的响应体离开受保护路由；无法加密时 fail-closed，禁止明文泄露。\n    const bodyless = event.request.method === 'HEAD' || isEmptyResponse(response)\n    if (bodyless)\n      void response.body?.cancel().catch(() => {})\n\n    const contentType = response.headers.get('Content-Type') ?? ''\n    if (!bodyless && !canEncryptResponseContentType(contentType)) {\n      void response.body?.cancel().catch(() => {})\n      return jsonError(kitM('kit_transportEncryptFailed'), 500)\n    }\n    try {\n      const responseBody = bodyless\n        ? ''\n        : await readTransportBody(response.body, {\n            maxBytes: TRANSPORT_BODY_LIMITS.plaintextBytes,\n            signal: event.request.signal,\n          })\n      const headers = new Headers(response.headers)\n      headers.delete(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER)\n      headers.delete(TRANSPORT_PROTOCOL.ENVELOPE_HEADER)\n      headers.delete('Content-Length')\n      headers.delete('Content-Encoding')\n\n      const encryptedPayload = await manager.encryptResponse(requestContext, responseBody, response.status)\n      if (!encryptedPayload.success) {\n        return jsonError(kitM('kit_transportEncryptFailed'), 500)\n      }\n      headers.set(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER, TRANSPORT_PROTOCOL.ENCRYPTED_HEADER_VALUE)\n      if (bodyless)\n        headers.set(TRANSPORT_PROTOCOL.ENVELOPE_HEADER, JSON.stringify(encryptedPayload.data))\n      return new Response(bodyless ? null : JSON.stringify(encryptedPayload.data), {\n        status: response.status,\n        statusText: response.statusText,\n        headers,\n      })\n    }\n    catch {\n      return jsonError(kitM('kit_transportEncryptFailed'), 500)\n    }\n  }\n}\n\nfunction canEncryptResponseContentType(contentType: string): boolean {\n  return ENCRYPTABLE_RESPONSE_CONTENT_TYPES.some(type => contentType.includes(type))\n}\n\nfunction createUnavailableTransportMiddleware(\n  keyExchangePath: string,\n  excludePaths: string[],\n): Middleware {\n  return async (context, next) => {\n    const pathname = getRequestPathname(context.event.request)\n    if (pathname === keyExchangePath) {\n      return jsonError(kitM('kit_transportKeyGenerationFailed'), 500)\n    }\n    if (!shouldHandleTransportPath(pathname, keyExchangePath)) {\n      return next()\n    }\n    if (shouldExcludeTransportPath(pathname, excludePaths, keyExchangePath)) {\n      return next()\n    }\n    return jsonError(kitM('kit_transportKeyGenerationFailed'), 500)\n  }\n}\n\nfunction isEmptyResponse(response: Response): boolean {\n  if ([204, 304].includes(response.status))\n    return true\n  // Content-Length 不能证明响应流为空，避免明文伪装零长度后绕过加密。\n  return response.body === null\n}\n\nfunction getRequestPathname(request: Request): string {\n  return new URL(request.url).pathname\n}\n\nfunction jsonError(message: string, status: number): Response {\n  return new Response(JSON.stringify({ error: message }), {\n    status,\n    headers: { 'Content-Type': 'application/json' },\n  })\n}\n\n/**\n * 处理密钥交换 POST 请求\n *\n * 接收客户端公钥，注册并返回服务端公钥与 clientId。\n *\n * @param manager - 传输加密管理器\n * @param request - 原始 Request\n * @returns JSON Response\n */\nasync function handleKeyExchange(\n  manager: TransportEncryptionManager,\n  request: Request,\n): Promise<Response> {\n  let body: unknown\n  try {\n    body = JSON.parse(await readTransportBody(request.body, {\n      maxBytes: TRANSPORT_BODY_LIMITS.keyExchangeBytes,\n      signal: request.signal,\n    }))\n  }\n  catch (error) {\n    return jsonError(kitM('kit_transportInvalidPayload'), error instanceof RangeError ? 413 : 400)\n  }\n  if (!body || typeof body !== 'object' || !('clientPublicKey' in body)\n    || !isValidSM2PublicKey(body.clientPublicKey)\n    || new TextEncoder().encode(body.clientPublicKey).byteLength > TRANSPORT_BODY_LIMITS.publicKeyBytes) {\n    return jsonError(kitM('kit_transportInvalidPayload'), 400)\n  }\n\n  try {\n    const serverPublicKey = manager.getServerPublicKey()\n    if (new TextEncoder().encode(serverPublicKey).byteLength > TRANSPORT_BODY_LIMITS.publicKeyBytes)\n      return jsonError(kitM('kit_transportKeyExchangeFailed'), 500)\n    const clientId = await manager.registerClientKey(body.clientPublicKey)\n\n    return new Response(\n      JSON.stringify({ serverKeyId: manager.getServerKeyId(), serverPublicKey, clientId }),\n      { status: 200, headers: { 'Content-Type': 'application/json' } },\n    )\n  }\n  catch {\n    return jsonError(kitM('kit_transportKeyExchangeFailed'), 500)\n  }\n}\n\n/**\n * 用于替换已验证请求正文的最小可写容器。\n * @example 模块内部上下文\n * ```ts\n * const holder: RequestHolder = { request: new Request('https://app.example.com/api/articles', { method: 'POST', body: '{}' }) }\n * replaceRequestBody(holder, JSON.stringify({ title: 'Example' }))\n * ```\n */\ninterface RequestHolder {\n  request: Request\n}\n\n/**\n * 重建 SvelteKit 事件中的 Request。\n *\n * 有界认证会消费密文 body；只将成功认证的明文恢复给后续端点。\n *\n * @param event SvelteKit 请求事件\n * @param body 新请求体\n */\nfunction replaceRequestBody(event: RequestHolder, body: string): void {\n  const headers = new Headers(event.request.headers)\n  headers.delete(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER)\n  headers.delete('Content-Length')\n  headers.delete('Content-Encoding')\n  headers.set('Content-Type', 'application/json; charset=utf-8')\n  const newRequest = new Request(event.request.url, {\n    method: event.request.method,\n    headers,\n    body,\n    signal: event.request.signal,\n  })\n  Object.defineProperty(event, 'request', {\n    value: newRequest,\n    writable: true,\n    configurable: true,\n  })\n}\n"]}

package/dist/chunk-OVRZIDCD.js

@@ -0,0 +1,175 @@
+import { core } from '@h-ai/core';
+
+// src/kit-i18n.ts
+
+// messages/en-US.json
+var en_US_default = {
+  kit_a2aAuthFailed: "A2A authentication failed",
+  kit_a2aParseError: "Invalid JSON request body",
+  kit_a2aCardUnavailable: "Agent card not available",
+  $schema: "https://inlang.com/schema/inlang-message-format",
+  kit_unauthorized: "Unauthorized",
+  kit_forbidden: "Forbidden: missing {permission} permission",
+  kit_authNotConfigured: "kit.auth is not configured: pass auth.operations in kit.createHandle()",
+  kit_csrfTokenFailed: "Failed to generate CSRF token",
+  kit_csrfVerifyFailed: "CSRF token verification failed",
+  kit_csrfValidationFailed: "Invalid CSRF token",
+  kit_rateLimitExceeded: "Too many requests, please try again later",
+  kit_unsupportedContentType: "Unsupported content type",
+  kit_parseBodyFailed: "Failed to parse request body",
+  kit_encryptFailed: "Encryption failed",
+  kit_transportKeyGenerationFailed: "Transport encryption key generation failed",
+  kit_transportClientKeyNotFound: "Client key not found",
+  kit_transportEncryptFailed: "Transport encryption failed",
+  kit_transportEncryptKeyFailed: "Symmetric key encryption failed",
+  kit_transportDecryptKeyFailed: "Symmetric key decryption failed",
+  kit_transportDecryptFailed: "Transport decryption failed",
+  kit_transportInvalidPayload: "Invalid encrypted payload",
+  kit_transportKeyExchangeFailed: "Key exchange failed",
+  kit_transportClientIdRequired: "Missing X-Client-Id header, key exchange is required for transport encryption",
+  kit_signFailed: "Request signing failed",
+  kit_authRequired: "Authentication required",
+  kit_accessDenied: "Access denied",
+  kit_resourceNotFound: "Resource not found",
+  kit_internalError: "Internal server error",
+  kit_validationFailed: "Validation failed",
+  kit_validationRequired: "This field is required",
+  kit_validationInvalid: "Invalid input format",
+  kit_validationInvalidType: "Invalid field type",
+  kit_validationStringMin: "Enter at least {min} characters",
+  kit_validationStringMax: "Enter at most {max} characters",
+  kit_validationNumberMin: "Value must be at least {min}",
+  kit_validationNumberMax: "Value must be at most {max}",
+  kit_validationArrayMin: "Select at least {min} item(s)",
+  kit_validationArrayMax: "Select at most {max} item(s)",
+  kit_validationTooSmall: "Value must be at least {min}",
+  kit_validationTooBig: "Value must be at most {max}",
+  kit_validationEmail: "Enter a valid email address",
+  kit_validationUrl: "Enter a valid URL",
+  kit_validationUuid: "Enter a valid UUID",
+  kit_validationEnum: "Select a valid option",
+  kit_noGuardsPassed: "No guards passed",
+  kit_requiredRoles: "Required roles: {roles}",
+  kit_requiredPermissions: "Required permissions: {permissions}",
+  kit_idRequired: "ID is required",
+  kit_rateLimitWindowInvalid: "The rate limit window must be an integer from 1 to 2147483647 milliseconds",
+  kit_rateLimitMemoryCapacity: "The development memory rate limit store is full; use a shared backend"
+};
+
+// messages/ja-JP.json
+var ja_JP_default = {
+  kit_a2aAuthFailed: "A2A\u8A8D\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  kit_a2aParseError: "\u30EA\u30AF\u30A8\u30B9\u30C8\u672C\u6587\u304C\u6709\u52B9\u306AJSON\u3067\u306F\u3042\u308A\u307E\u305B\u3093",
+  kit_a2aCardUnavailable: "\u30A8\u30FC\u30B8\u30A7\u30F3\u30C8\u30AB\u30FC\u30C9\u3092\u5229\u7528\u3067\u304D\u307E\u305B\u3093",
+  $schema: "https://inlang.com/schema/inlang-message-format",
+  kit_unauthorized: "\u8A8D\u8A3C\u3055\u308C\u3066\u3044\u307E\u305B\u3093",
+  kit_forbidden: "\u30A2\u30AF\u30BB\u30B9\u304C\u62D2\u5426\u3055\u308C\u307E\u3057\u305F: {permission}\u6A29\u9650\u304C\u3042\u308A\u307E\u305B\u3093",
+  kit_authNotConfigured: "kit.auth\u304C\u8A2D\u5B9A\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002kit.createHandle()\u306Bauth.operations\u3092\u6E21\u3057\u3066\u304F\u3060\u3055\u3044",
+  kit_csrfTokenFailed: "CSRF\u30C8\u30FC\u30AF\u30F3\u306E\u751F\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  kit_csrfVerifyFailed: "CSRF\u30C8\u30FC\u30AF\u30F3\u306E\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  kit_csrfValidationFailed: "CSRF\u30C8\u30FC\u30AF\u30F3\u304C\u7121\u52B9\u3067\u3059",
+  kit_rateLimitExceeded: "\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u591A\u3059\u304E\u307E\u3059\u3002\u3057\u3070\u3089\u304F\u3057\u3066\u304B\u3089\u518D\u8A66\u884C\u3057\u3066\u304F\u3060\u3055\u3044",
+  kit_unsupportedContentType: "\u672A\u5BFE\u5FDC\u306E\u30B3\u30F3\u30C6\u30F3\u30C4\u30BF\u30A4\u30D7\u3067\u3059",
+  kit_parseBodyFailed: "\u30EA\u30AF\u30A8\u30B9\u30C8\u672C\u6587\u306E\u89E3\u6790\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  kit_encryptFailed: "\u6697\u53F7\u5316\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  kit_transportKeyGenerationFailed: "\u901A\u4FE1\u6697\u53F7\u5316\u9375\u306E\u751F\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  kit_transportClientKeyNotFound: "\u30AF\u30E9\u30A4\u30A2\u30F3\u30C8\u9375\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093",
+  kit_transportEncryptFailed: "\u901A\u4FE1\u306E\u6697\u53F7\u5316\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  kit_transportEncryptKeyFailed: "\u5BFE\u79F0\u9375\u306E\u6697\u53F7\u5316\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  kit_transportDecryptKeyFailed: "\u5BFE\u79F0\u9375\u306E\u5FA9\u53F7\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  kit_transportDecryptFailed: "\u901A\u4FE1\u306E\u5FA9\u53F7\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  kit_transportInvalidPayload: "\u6697\u53F7\u5316\u30DA\u30A4\u30ED\u30FC\u30C9\u304C\u7121\u52B9\u3067\u3059",
+  kit_transportKeyExchangeFailed: "\u9375\u4EA4\u63DB\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  kit_transportClientIdRequired: "X-Client-Id\u30D8\u30C3\u30C0\u30FC\u304C\u3042\u308A\u307E\u305B\u3093\u3002\u901A\u4FE1\u6697\u53F7\u5316\u306B\u306F\u9375\u4EA4\u63DB\u304C\u5FC5\u8981\u3067\u3059",
+  kit_signFailed: "\u30EA\u30AF\u30A8\u30B9\u30C8\u306E\u7F72\u540D\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  kit_authRequired: "\u8A8D\u8A3C\u304C\u5FC5\u8981\u3067\u3059",
+  kit_accessDenied: "\u30A2\u30AF\u30BB\u30B9\u304C\u62D2\u5426\u3055\u308C\u307E\u3057\u305F",
+  kit_resourceNotFound: "\u30EA\u30BD\u30FC\u30B9\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093",
+  kit_internalError: "\u30B5\u30FC\u30D0\u30FC\u5185\u90E8\u30A8\u30E9\u30FC",
+  kit_validationFailed: "\u5165\u529B\u5185\u5BB9\u306E\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  kit_validationRequired: "\u3053\u306E\u9805\u76EE\u306F\u5FC5\u9808\u3067\u3059",
+  kit_validationInvalid: "\u5165\u529B\u5F62\u5F0F\u304C\u7121\u52B9\u3067\u3059",
+  kit_validationInvalidType: "\u30D5\u30A3\u30FC\u30EB\u30C9\u306E\u578B\u304C\u7121\u52B9\u3067\u3059",
+  kit_validationStringMin: "{min}\u6587\u5B57\u4EE5\u4E0A\u3067\u5165\u529B\u3057\u3066\u304F\u3060\u3055\u3044",
+  kit_validationStringMax: "{max}\u6587\u5B57\u4EE5\u5185\u3067\u5165\u529B\u3057\u3066\u304F\u3060\u3055\u3044",
+  kit_validationNumberMin: "{min}\u4EE5\u4E0A\u306E\u5024\u3092\u5165\u529B\u3057\u3066\u304F\u3060\u3055\u3044",
+  kit_validationNumberMax: "{max}\u4EE5\u4E0B\u306E\u5024\u3092\u5165\u529B\u3057\u3066\u304F\u3060\u3055\u3044",
+  kit_validationArrayMin: "{min}\u4EF6\u4EE5\u4E0A\u9078\u629E\u3057\u3066\u304F\u3060\u3055\u3044",
+  kit_validationArrayMax: "{max}\u4EF6\u4EE5\u5185\u3067\u9078\u629E\u3057\u3066\u304F\u3060\u3055\u3044",
+  kit_validationTooSmall: "{min}\u4EE5\u4E0A\u306E\u5024\u3092\u5165\u529B\u3057\u3066\u304F\u3060\u3055\u3044",
+  kit_validationTooBig: "{max}\u4EE5\u4E0B\u306E\u5024\u3092\u5165\u529B\u3057\u3066\u304F\u3060\u3055\u3044",
+  kit_validationEmail: "\u6709\u52B9\u306A\u30E1\u30FC\u30EB\u30A2\u30C9\u30EC\u30B9\u3092\u5165\u529B\u3057\u3066\u304F\u3060\u3055\u3044",
+  kit_validationUrl: "\u6709\u52B9\u306AURL\u3092\u5165\u529B\u3057\u3066\u304F\u3060\u3055\u3044",
+  kit_validationUuid: "\u6709\u52B9\u306AUUID\u3092\u5165\u529B\u3057\u3066\u304F\u3060\u3055\u3044",
+  kit_validationEnum: "\u6709\u52B9\u306A\u9078\u629E\u80A2\u3092\u9078\u3093\u3067\u304F\u3060\u3055\u3044",
+  kit_noGuardsPassed: "\u3069\u306E\u30AC\u30FC\u30C9\u3082\u901A\u904E\u3057\u307E\u305B\u3093\u3067\u3057\u305F",
+  kit_requiredRoles: "\u5FC5\u8981\u306A\u30ED\u30FC\u30EB: {roles}",
+  kit_requiredPermissions: "\u5FC5\u8981\u306A\u6A29\u9650: {permissions}",
+  kit_idRequired: "ID\u306F\u5FC5\u9808\u3067\u3059",
+  kit_rateLimitWindowInvalid: "\u30EC\u30FC\u30C8\u5236\u9650\u306E\u671F\u9593\u306F1\u301C2147483647\u30DF\u30EA\u79D2\u306E\u6574\u6570\u3067\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044",
+  kit_rateLimitMemoryCapacity: "\u958B\u767A\u7528\u30E1\u30E2\u30EA\u30FC\u30EC\u30FC\u30C8\u5236\u9650\u30B9\u30C8\u30A2\u304C\u6E80\u676F\u3067\u3059\u3002\u5171\u6709\u30D0\u30C3\u30AF\u30A8\u30F3\u30C9\u3092\u4F7F\u7528\u3057\u3066\u304F\u3060\u3055\u3044"
+};
+
+// messages/zh-CN.json
+var zh_CN_default = {
+  kit_a2aAuthFailed: "A2A \u8EAB\u4EFD\u8BA4\u8BC1\u5931\u8D25",
+  kit_a2aParseError: "\u8BF7\u6C42\u4F53\u4E0D\u662F\u6709\u6548\u7684 JSON",
+  kit_a2aCardUnavailable: "Agent Card \u4E0D\u53EF\u7528",
+  $schema: "https://inlang.com/schema/inlang-message-format",
+  kit_unauthorized: "\u672A\u6388\u6743",
+  kit_forbidden: "\u6743\u9650\u4E0D\u8DB3\uFF1A\u7F3A\u5C11 {permission} \u6743\u9650",
+  kit_authNotConfigured: "kit.auth \u672A\u914D\u7F6E\uFF1A\u8BF7\u5728 kit.createHandle() \u4E2D\u4F20\u5165 auth.operations",
+  kit_csrfTokenFailed: "\u751F\u6210 CSRF Token \u5931\u8D25",
+  kit_csrfVerifyFailed: "CSRF Token \u9A8C\u8BC1\u5931\u8D25",
+  kit_csrfValidationFailed: "CSRF Token \u65E0\u6548",
+  kit_rateLimitExceeded: "\u8BF7\u6C42\u8FC7\u4E8E\u9891\u7E41\uFF0C\u8BF7\u7A0D\u540E\u518D\u8BD5",
+  kit_unsupportedContentType: "\u4E0D\u652F\u6301\u7684\u5185\u5BB9\u7C7B\u578B",
+  kit_parseBodyFailed: "\u8BF7\u6C42\u4F53\u89E3\u6790\u5931\u8D25",
+  kit_encryptFailed: "\u52A0\u5BC6\u5931\u8D25",
+  kit_transportKeyGenerationFailed: "\u4F20\u8F93\u52A0\u5BC6\u5BC6\u94A5\u5BF9\u751F\u6210\u5931\u8D25",
+  kit_transportClientKeyNotFound: "\u5BA2\u6237\u7AEF\u5BC6\u94A5\u672A\u627E\u5230",
+  kit_transportEncryptFailed: "\u4F20\u8F93\u52A0\u5BC6\u5931\u8D25",
+  kit_transportEncryptKeyFailed: "\u5BF9\u79F0\u5BC6\u94A5\u52A0\u5BC6\u5931\u8D25",
+  kit_transportDecryptKeyFailed: "\u5BF9\u79F0\u5BC6\u94A5\u89E3\u5BC6\u5931\u8D25",
+  kit_transportDecryptFailed: "\u4F20\u8F93\u89E3\u5BC6\u5931\u8D25",
+  kit_transportInvalidPayload: "\u65E0\u6548\u7684\u52A0\u5BC6\u8F7D\u8377",
+  kit_transportKeyExchangeFailed: "\u5BC6\u94A5\u4EA4\u6362\u5931\u8D25",
+  kit_transportClientIdRequired: "\u7F3A\u5C11 X-Client-Id \u8BF7\u6C42\u5934\uFF0C\u4F20\u8F93\u52A0\u5BC6\u5FC5\u987B\u5148\u5B8C\u6210\u5BC6\u94A5\u4EA4\u6362",
+  kit_signFailed: "\u8BF7\u6C42\u7B7E\u540D\u5931\u8D25",
+  kit_authRequired: "\u9700\u8981\u8EAB\u4EFD\u8BA4\u8BC1",
+  kit_accessDenied: "\u62D2\u7EDD\u8BBF\u95EE",
+  kit_resourceNotFound: "\u8D44\u6E90\u672A\u627E\u5230",
+  kit_internalError: "\u5185\u90E8\u670D\u52A1\u5668\u9519\u8BEF",
+  kit_validationFailed: "\u6570\u636E\u9A8C\u8BC1\u5931\u8D25",
+  kit_validationRequired: "\u6B64\u5B57\u6BB5\u5FC5\u586B",
+  kit_validationInvalid: "\u8F93\u5165\u683C\u5F0F\u65E0\u6548",
+  kit_validationInvalidType: "\u5B57\u6BB5\u7C7B\u578B\u4E0D\u6B63\u786E",
+  kit_validationStringMin: "\u81F3\u5C11\u8F93\u5165 {min} \u4E2A\u5B57\u7B26",
+  kit_validationStringMax: "\u6700\u591A\u8F93\u5165 {max} \u4E2A\u5B57\u7B26",
+  kit_validationNumberMin: "\u6570\u503C\u4E0D\u80FD\u5C0F\u4E8E {min}",
+  kit_validationNumberMax: "\u6570\u503C\u4E0D\u80FD\u5927\u4E8E {max}",
+  kit_validationArrayMin: "\u81F3\u5C11\u9009\u62E9 {min} \u9879",
+  kit_validationArrayMax: "\u6700\u591A\u9009\u62E9 {max} \u9879",
+  kit_validationTooSmall: "\u4E0D\u80FD\u5C0F\u4E8E {min}",
+  kit_validationTooBig: "\u4E0D\u80FD\u5927\u4E8E {max}",
+  kit_validationEmail: "\u8BF7\u8F93\u5165\u6709\u6548\u7684\u90AE\u7BB1\u5730\u5740",
+  kit_validationUrl: "\u8BF7\u8F93\u5165\u6709\u6548\u7684\u7F51\u5740",
+  kit_validationUuid: "\u8BF7\u8F93\u5165\u6709\u6548\u7684 UUID",
+  kit_validationEnum: "\u8BF7\u9009\u62E9\u6709\u6548\u9009\u9879",
+  kit_noGuardsPassed: "\u6CA1\u6709\u5B88\u536B\u901A\u8FC7",
+  kit_requiredRoles: "\u9700\u8981\u89D2\u8272\uFF1A{roles}",
+  kit_requiredPermissions: "\u9700\u8981\u6743\u9650\uFF1A{permissions}",
+  kit_idRequired: "ID \u4E0D\u80FD\u4E3A\u7A7A",
+  kit_rateLimitWindowInvalid: "\u9650\u6D41\u7A97\u53E3\u5FC5\u987B\u4E3A 1 \u81F3 2147483647 \u7684\u6574\u6570\u6BEB\u79D2",
+  kit_rateLimitMemoryCapacity: "\u5F00\u53D1\u5185\u5B58\u9650\u6D41\u5BB9\u91CF\u5DF2\u6EE1\uFF0C\u8BF7\u4F7F\u7528\u5171\u4EAB\u540E\u7AEF"
+};
+
+// src/kit-i18n.ts
+var kitM = core.i18n.createMessageGetter({ "zh-CN": zh_CN_default, "en-US": en_US_default, "ja-JP": ja_JP_default });
+function setAllModulesLocale(locale) {
+  core.i18n.setGlobalLocale(locale);
+}
+
+export { kitM, setAllModulesLocale };
+//# sourceMappingURL=chunk-OVRZIDCD.js.map
+//# sourceMappingURL=chunk-OVRZIDCD.js.map

package/dist/chunk-OVRZIDCD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../messages/en-US.json","../messages/ja-JP.json","../messages/zh-CN.json","../src/kit-i18n.ts"],"names":[],"mappings":";;;;;AAAA,IAAA,aAAA,GAAA;AAAA,EACE,iBAAA,EAAqB,2BAAA;AAAA,EACrB,iBAAA,EAAqB,2BAAA;AAAA,EACrB,sBAAA,EAA0B,0BAAA;AAAA,EAC1B,OAAA,EAAW,iDAAA;AAAA,EACX,gBAAA,EAAoB,cAAA;AAAA,EACpB,aAAA,EAAiB,4CAAA;AAAA,EACjB,qBAAA,EAAyB,wEAAA;AAAA,EACzB,mBAAA,EAAuB,+BAAA;AAAA,EACvB,oBAAA,EAAwB,gCAAA;AAAA,EACxB,wBAAA,EAA4B,oBAAA;AAAA,EAC5B,qBAAA,EAAyB,2CAAA;AAAA,EACzB,0BAAA,EAA8B,0BAAA;AAAA,EAC9B,mBAAA,EAAuB,8BAAA;AAAA,EACvB,iBAAA,EAAqB,mBAAA;AAAA,EACrB,gCAAA,EAAoC,4CAAA;AAAA,EACpC,8BAAA,EAAkC,sBAAA;AAAA,EAClC,0BAAA,EAA8B,6BAAA;AAAA,EAC9B,6BAAA,EAAiC,iCAAA;AAAA,EACjC,6BAAA,EAAiC,iCAAA;AAAA,EACjC,0BAAA,EAA8B,6BAAA;AAAA,EAC9B,2BAAA,EAA+B,2BAAA;AAAA,EAC/B,8BAAA,EAAkC,qBAAA;AAAA,EAClC,6BAAA,EAAiC,+EAAA;AAAA,EACjC,cAAA,EAAkB,wBAAA;AAAA,EAClB,gBAAA,EAAoB,yBAAA;AAAA,EACpB,gBAAA,EAAoB,eAAA;AAAA,EACpB,oBAAA,EAAwB,oBAAA;AAAA,EACxB,iBAAA,EAAqB,uBAAA;AAAA,EACrB,oBAAA,EAAwB,mBAAA;AAAA,EACxB,sBAAA,EAA0B,wBAAA;AAAA,EAC1B,qBAAA,EAAyB,sBAAA;AAAA,EACzB,yBAAA,EAA6B,oBAAA;AAAA,EAC7B,uBAAA,EAA2B,iCAAA;AAAA,EAC3B,uBAAA,EAA2B,gCAAA;AAAA,EAC3B,uBAAA,EAA2B,8BAAA;AAAA,EAC3B,uBAAA,EAA2B,6BAAA;AAAA,EAC3B,sBAAA,EAA0B,+BAAA;AAAA,EAC1B,sBAAA,EAA0B,8BAAA;AAAA,EAC1B,sBAAA,EAA0B,8BAAA;AAAA,EAC1B,oBAAA,EAAwB,6BAAA;AAAA,EACxB,mBAAA,EAAuB,6BAAA;AAAA,EACvB,iBAAA,EAAqB,mBAAA;AAAA,EACrB,kBAAA,EAAsB,oBAAA;AAAA,EACtB,kBAAA,EAAsB,uBAAA;AAAA,EACtB,kBAAA,EAAsB,kBAAA;AAAA,EACtB,iBAAA,EAAqB,yBAAA;AAAA,EACrB,uBAAA,EAA2B,qCAAA;AAAA,EAC3B,cAAA,EAAkB,gBAAA;AAAA,EAClB,0BAAA,EAA8B,4EAAA;AAAA,EAC9B,2BAAA,EAA+B;AACjC,CAAA;;;ACnDA,IAAA,aAAA,GAAA;AAAA,EACE,iBAAA,EAAqB,2DAAA;AAAA,EACrB,iBAAA,EAAqB,kHAAA;AAAA,EACrB,sBAAA,EAA0B,wGAAA;AAAA,EAC1B,OAAA,EAAW,iDAAA;AAAA,EACX,gBAAA,EAAoB,wDAAA;AAAA,EACpB,aAAA,EAAiB,wIAAA;AAAA,EACjB,qBAAA,EAAyB,mKAAA;AAAA,EACzB,mBAAA,EAAuB,0FAAA;AAAA,EACvB,oBAAA,EAAwB,0FAAA;AAAA,EACxB,wBAAA,EAA4B,4DAAA;AAAA,EAC5B,qBAAA,EAAyB,gLAAA;AAAA,EACzB,0BAAA,EAA8B,sFAAA;AAAA,EAC9B,mBAAA,EAAuB,wGAAA;AAAA,EACvB,iBAAA,EAAqB,8DAAA;AAAA,EACrB,gCAAA,EAAoC,kGAAA;AAAA,EACpC,8BAAA,EAAkC,4FAAA;AAAA,EAClC,0BAAA,EAA8B,gFAAA;AAAA,EAC9B,6BAAA,EAAiC,sFAAA;AAAA,EACjC,6BAAA,EAAiC,gFAAA;AAAA,EACjC,0BAAA,EAA8B,0EAAA;AAAA,EAC9B,2BAAA,EAA+B,gFAAA;AAAA,EAC/B,8BAAA,EAAkC,8DAAA;AAAA,EAClC,6BAAA,EAAiC,yKAAA;AAAA,EACjC,cAAA,EAAkB,4FAAA;AAAA,EAClB,gBAAA,EAAoB,4CAAA;AAAA,EACpB,gBAAA,EAAoB,0EAAA;AAAA,EACpB,oBAAA,EAAwB,0EAAA;AAAA,EACxB,iBAAA,EAAqB,wDAAA;AAAA,EACrB,oBAAA,EAAwB,sFAAA;AAAA,EACxB,sBAAA,EAA0B,wDAAA;AAAA,EAC1B,qBAAA,EAAyB,wDAAA;AAAA,EACzB,yBAAA,EAA6B,0EAAA;AAAA,EAC7B,uBAAA,EAA2B,qFAAA;AAAA,EAC3B,uBAAA,EAA2B,qFAAA;AAAA,EAC3B,uBAAA,EAA2B,qFAAA;AAAA,EAC3B,uBAAA,EAA2B,qFAAA;AAAA,EAC3B,sBAAA,EAA0B,yEAAA;AAAA,EAC1B,sBAAA,EAA0B,+EAAA;AAAA,EAC1B,sBAAA,EAA0B,qFAAA;AAAA,EAC1B,oBAAA,EAAwB,qFAAA;AAAA,EACxB,mBAAA,EAAuB,oHAAA;AAAA,EACvB,iBAAA,EAAqB,6EAAA;AAAA,EACrB,kBAAA,EAAsB,8EAAA;AAAA,EACtB,kBAAA,EAAsB,sFAAA;AAAA,EACtB,kBAAA,EAAsB,4FAAA;AAAA,EACtB,iBAAA,EAAqB,+CAAA;AAAA,EACrB,uBAAA,EAA2B,+CAAA;AAAA,EAC3B,cAAA,EAAkB,kCAAA;AAAA,EAClB,0BAAA,EAA8B,mKAAA;AAAA,EAC9B,2BAAA,EAA+B;AACjC,CAAA;;;ACnDA,IAAA,aAAA,GAAA;AAAA,EACE,iBAAA,EAAqB,0CAAA;AAAA,EACrB,iBAAA,EAAqB,uDAAA;AAAA,EACrB,sBAAA,EAA0B,+BAAA;AAAA,EAC1B,OAAA,EAAW,iDAAA;AAAA,EACX,gBAAA,EAAoB,oBAAA;AAAA,EACpB,aAAA,EAAiB,sEAAA;AAAA,EACjB,qBAAA,EAAyB,qGAAA;AAAA,EACzB,mBAAA,EAAuB,sCAAA;AAAA,EACvB,oBAAA,EAAwB,qCAAA;AAAA,EACxB,wBAAA,EAA4B,yBAAA;AAAA,EAC5B,qBAAA,EAAyB,0EAAA;AAAA,EACzB,0BAAA,EAA8B,kDAAA;AAAA,EAC9B,mBAAA,EAAuB,4CAAA;AAAA,EACvB,iBAAA,EAAqB,0BAAA;AAAA,EACrB,gCAAA,EAAoC,oEAAA;AAAA,EACpC,8BAAA,EAAkC,kDAAA;AAAA,EAClC,0BAAA,EAA8B,sCAAA;AAAA,EAC9B,6BAAA,EAAiC,kDAAA;AAAA,EACjC,6BAAA,EAAiC,kDAAA;AAAA,EACjC,0BAAA,EAA8B,sCAAA;AAAA,EAC9B,2BAAA,EAA+B,4CAAA;AAAA,EAC/B,8BAAA,EAAkC,sCAAA;AAAA,EAClC,6BAAA,EAAiC,iIAAA;AAAA,EACjC,cAAA,EAAkB,sCAAA;AAAA,EAClB,gBAAA,EAAoB,sCAAA;AAAA,EACpB,gBAAA,EAAoB,0BAAA;AAAA,EACpB,oBAAA,EAAwB,gCAAA;AAAA,EACxB,iBAAA,EAAqB,4CAAA;AAAA,EACrB,oBAAA,EAAwB,sCAAA;AAAA,EACxB,sBAAA,EAA0B,gCAAA;AAAA,EAC1B,qBAAA,EAAyB,sCAAA;AAAA,EACzB,yBAAA,EAA6B,4CAAA;AAAA,EAC7B,uBAAA,EAA2B,mDAAA;AAAA,EAC3B,uBAAA,EAA2B,mDAAA;AAAA,EAC3B,uBAAA,EAA2B,4CAAA;AAAA,EAC3B,uBAAA,EAA2B,4CAAA;AAAA,EAC3B,sBAAA,EAA0B,uCAAA;AAAA,EAC1B,sBAAA,EAA0B,uCAAA;AAAA,EAC1B,sBAAA,EAA0B,gCAAA;AAAA,EAC1B,oBAAA,EAAwB,gCAAA;AAAA,EACxB,mBAAA,EAAuB,8DAAA;AAAA,EACvB,iBAAA,EAAqB,kDAAA;AAAA,EACrB,kBAAA,EAAsB,2CAAA;AAAA,EACtB,kBAAA,EAAsB,4CAAA;AAAA,EACtB,kBAAA,EAAsB,sCAAA;AAAA,EACtB,iBAAA,EAAqB,uCAAA;AAAA,EACrB,uBAAA,EAA2B,6CAAA;AAAA,EAC3B,cAAA,EAAkB,6BAAA;AAAA,EAClB,0BAAA,EAA8B,+FAAA;AAAA,EAC9B,2BAAA,EAA+B;AACjC,CAAA;;;ACpBO,IAAM,IAAA,GACT,IAAA,CAAK,IAAA,CAAK,mBAAA,CAAmC,EAAE,OAAA,EAAS,aAAA,EAAc,OAAA,EAAS,aAAA,EAAc,OAAA,EAAS,aAAA,EAAc;AAgBjH,SAAS,oBAAoB,MAAA,EAAsB;AACxD,EAAA,IAAA,CAAK,IAAA,CAAK,gBAAgB,MAAM,CAAA;AAClC","file":"chunk-OVRZIDCD.js","sourcesContent":["{\n  \"kit_a2aAuthFailed\": \"A2A authentication failed\",\n  \"kit_a2aParseError\": \"Invalid JSON request body\",\n  \"kit_a2aCardUnavailable\": \"Agent card not available\",\n  \"$schema\": \"https://inlang.com/schema/inlang-message-format\",\n  \"kit_unauthorized\": \"Unauthorized\",\n  \"kit_forbidden\": \"Forbidden: missing {permission} permission\",\n  \"kit_authNotConfigured\": \"kit.auth is not configured: pass auth.operations in kit.createHandle()\",\n  \"kit_csrfTokenFailed\": \"Failed to generate CSRF token\",\n  \"kit_csrfVerifyFailed\": \"CSRF token verification failed\",\n  \"kit_csrfValidationFailed\": \"Invalid CSRF token\",\n  \"kit_rateLimitExceeded\": \"Too many requests, please try again later\",\n  \"kit_unsupportedContentType\": \"Unsupported content type\",\n  \"kit_parseBodyFailed\": \"Failed to parse request body\",\n  \"kit_encryptFailed\": \"Encryption failed\",\n  \"kit_transportKeyGenerationFailed\": \"Transport encryption key generation failed\",\n  \"kit_transportClientKeyNotFound\": \"Client key not found\",\n  \"kit_transportEncryptFailed\": \"Transport encryption failed\",\n  \"kit_transportEncryptKeyFailed\": \"Symmetric key encryption failed\",\n  \"kit_transportDecryptKeyFailed\": \"Symmetric key decryption failed\",\n  \"kit_transportDecryptFailed\": \"Transport decryption failed\",\n  \"kit_transportInvalidPayload\": \"Invalid encrypted payload\",\n  \"kit_transportKeyExchangeFailed\": \"Key exchange failed\",\n  \"kit_transportClientIdRequired\": \"Missing X-Client-Id header, key exchange is required for transport encryption\",\n  \"kit_signFailed\": \"Request signing failed\",\n  \"kit_authRequired\": \"Authentication required\",\n  \"kit_accessDenied\": \"Access denied\",\n  \"kit_resourceNotFound\": \"Resource not found\",\n  \"kit_internalError\": \"Internal server error\",\n  \"kit_validationFailed\": \"Validation failed\",\n  \"kit_validationRequired\": \"This field is required\",\n  \"kit_validationInvalid\": \"Invalid input format\",\n  \"kit_validationInvalidType\": \"Invalid field type\",\n  \"kit_validationStringMin\": \"Enter at least {min} characters\",\n  \"kit_validationStringMax\": \"Enter at most {max} characters\",\n  \"kit_validationNumberMin\": \"Value must be at least {min}\",\n  \"kit_validationNumberMax\": \"Value must be at most {max}\",\n  \"kit_validationArrayMin\": \"Select at least {min} item(s)\",\n  \"kit_validationArrayMax\": \"Select at most {max} item(s)\",\n  \"kit_validationTooSmall\": \"Value must be at least {min}\",\n  \"kit_validationTooBig\": \"Value must be at most {max}\",\n  \"kit_validationEmail\": \"Enter a valid email address\",\n  \"kit_validationUrl\": \"Enter a valid URL\",\n  \"kit_validationUuid\": \"Enter a valid UUID\",\n  \"kit_validationEnum\": \"Select a valid option\",\n  \"kit_noGuardsPassed\": \"No guards passed\",\n  \"kit_requiredRoles\": \"Required roles: {roles}\",\n  \"kit_requiredPermissions\": \"Required permissions: {permissions}\",\n  \"kit_idRequired\": \"ID is required\",\n  \"kit_rateLimitWindowInvalid\": \"The rate limit window must be an integer from 1 to 2147483647 milliseconds\",\n  \"kit_rateLimitMemoryCapacity\": \"The development memory rate limit store is full; use a shared backend\"\n}\n","{\n  \"kit_a2aAuthFailed\": \"A2A認証に失敗しました\",\n  \"kit_a2aParseError\": \"リクエスト本文が有効なJSONではありません\",\n  \"kit_a2aCardUnavailable\": \"エージェントカードを利用できません\",\n  \"$schema\": \"https://inlang.com/schema/inlang-message-format\",\n  \"kit_unauthorized\": \"認証されていません\",\n  \"kit_forbidden\": \"アクセスが拒否されました: {permission}権限がありません\",\n  \"kit_authNotConfigured\": \"kit.authが設定されていません。kit.createHandle()にauth.operationsを渡してください\",\n  \"kit_csrfTokenFailed\": \"CSRFトークンの生成に失敗しました\",\n  \"kit_csrfVerifyFailed\": \"CSRFトークンの検証に失敗しました\",\n  \"kit_csrfValidationFailed\": \"CSRFトークンが無効です\",\n  \"kit_rateLimitExceeded\": \"リクエストが多すぎます。しばらくしてから再試行してください\",\n  \"kit_unsupportedContentType\": \"未対応のコンテンツタイプです\",\n  \"kit_parseBodyFailed\": \"リクエスト本文の解析に失敗しました\",\n  \"kit_encryptFailed\": \"暗号化に失敗しました\",\n  \"kit_transportKeyGenerationFailed\": \"通信暗号化鍵の生成に失敗しました\",\n  \"kit_transportClientKeyNotFound\": \"クライアント鍵が見つかりません\",\n  \"kit_transportEncryptFailed\": \"通信の暗号化に失敗しました\",\n  \"kit_transportEncryptKeyFailed\": \"対称鍵の暗号化に失敗しました\",\n  \"kit_transportDecryptKeyFailed\": \"対称鍵の復号に失敗しました\",\n  \"kit_transportDecryptFailed\": \"通信の復号に失敗しました\",\n  \"kit_transportInvalidPayload\": \"暗号化ペイロードが無効です\",\n  \"kit_transportKeyExchangeFailed\": \"鍵交換に失敗しました\",\n  \"kit_transportClientIdRequired\": \"X-Client-Idヘッダーがありません。通信暗号化には鍵交換が必要です\",\n  \"kit_signFailed\": \"リクエストの署名に失敗しました\",\n  \"kit_authRequired\": \"認証が必要です\",\n  \"kit_accessDenied\": \"アクセスが拒否されました\",\n  \"kit_resourceNotFound\": \"リソースが見つかりません\",\n  \"kit_internalError\": \"サーバー内部エラー\",\n  \"kit_validationFailed\": \"入力内容の検証に失敗しました\",\n  \"kit_validationRequired\": \"この項目は必須です\",\n  \"kit_validationInvalid\": \"入力形式が無効です\",\n  \"kit_validationInvalidType\": \"フィールドの型が無効です\",\n  \"kit_validationStringMin\": \"{min}文字以上で入力してください\",\n  \"kit_validationStringMax\": \"{max}文字以内で入力してください\",\n  \"kit_validationNumberMin\": \"{min}以上の値を入力してください\",\n  \"kit_validationNumberMax\": \"{max}以下の値を入力してください\",\n  \"kit_validationArrayMin\": \"{min}件以上選択してください\",\n  \"kit_validationArrayMax\": \"{max}件以内で選択してください\",\n  \"kit_validationTooSmall\": \"{min}以上の値を入力してください\",\n  \"kit_validationTooBig\": \"{max}以下の値を入力してください\",\n  \"kit_validationEmail\": \"有効なメールアドレスを入力してください\",\n  \"kit_validationUrl\": \"有効なURLを入力してください\",\n  \"kit_validationUuid\": \"有効なUUIDを入力してください\",\n  \"kit_validationEnum\": \"有効な選択肢を選んでください\",\n  \"kit_noGuardsPassed\": \"どのガードも通過しませんでした\",\n  \"kit_requiredRoles\": \"必要なロール: {roles}\",\n  \"kit_requiredPermissions\": \"必要な権限: {permissions}\",\n  \"kit_idRequired\": \"IDは必須です\",\n  \"kit_rateLimitWindowInvalid\": \"レート制限の期間は1〜2147483647ミリ秒の整数で指定してください\",\n  \"kit_rateLimitMemoryCapacity\": \"開発用メモリーレート制限ストアが満杯です。共有バックエンドを使用してください\"\n}\n","{\n  \"kit_a2aAuthFailed\": \"A2A 身份认证失败\",\n  \"kit_a2aParseError\": \"请求体不是有效的 JSON\",\n  \"kit_a2aCardUnavailable\": \"Agent Card 不可用\",\n  \"$schema\": \"https://inlang.com/schema/inlang-message-format\",\n  \"kit_unauthorized\": \"未授权\",\n  \"kit_forbidden\": \"权限不足：缺少 {permission} 权限\",\n  \"kit_authNotConfigured\": \"kit.auth 未配置：请在 kit.createHandle() 中传入 auth.operations\",\n  \"kit_csrfTokenFailed\": \"生成 CSRF Token 失败\",\n  \"kit_csrfVerifyFailed\": \"CSRF Token 验证失败\",\n  \"kit_csrfValidationFailed\": \"CSRF Token 无效\",\n  \"kit_rateLimitExceeded\": \"请求过于频繁，请稍后再试\",\n  \"kit_unsupportedContentType\": \"不支持的内容类型\",\n  \"kit_parseBodyFailed\": \"请求体解析失败\",\n  \"kit_encryptFailed\": \"加密失败\",\n  \"kit_transportKeyGenerationFailed\": \"传输加密密钥对生成失败\",\n  \"kit_transportClientKeyNotFound\": \"客户端密钥未找到\",\n  \"kit_transportEncryptFailed\": \"传输加密失败\",\n  \"kit_transportEncryptKeyFailed\": \"对称密钥加密失败\",\n  \"kit_transportDecryptKeyFailed\": \"对称密钥解密失败\",\n  \"kit_transportDecryptFailed\": \"传输解密失败\",\n  \"kit_transportInvalidPayload\": \"无效的加密载荷\",\n  \"kit_transportKeyExchangeFailed\": \"密钥交换失败\",\n  \"kit_transportClientIdRequired\": \"缺少 X-Client-Id 请求头，传输加密必须先完成密钥交换\",\n  \"kit_signFailed\": \"请求签名失败\",\n  \"kit_authRequired\": \"需要身份认证\",\n  \"kit_accessDenied\": \"拒绝访问\",\n  \"kit_resourceNotFound\": \"资源未找到\",\n  \"kit_internalError\": \"内部服务器错误\",\n  \"kit_validationFailed\": \"数据验证失败\",\n  \"kit_validationRequired\": \"此字段必填\",\n  \"kit_validationInvalid\": \"输入格式无效\",\n  \"kit_validationInvalidType\": \"字段类型不正确\",\n  \"kit_validationStringMin\": \"至少输入 {min} 个字符\",\n  \"kit_validationStringMax\": \"最多输入 {max} 个字符\",\n  \"kit_validationNumberMin\": \"数值不能小于 {min}\",\n  \"kit_validationNumberMax\": \"数值不能大于 {max}\",\n  \"kit_validationArrayMin\": \"至少选择 {min} 项\",\n  \"kit_validationArrayMax\": \"最多选择 {max} 项\",\n  \"kit_validationTooSmall\": \"不能小于 {min}\",\n  \"kit_validationTooBig\": \"不能大于 {max}\",\n  \"kit_validationEmail\": \"请输入有效的邮箱地址\",\n  \"kit_validationUrl\": \"请输入有效的网址\",\n  \"kit_validationUuid\": \"请输入有效的 UUID\",\n  \"kit_validationEnum\": \"请选择有效选项\",\n  \"kit_noGuardsPassed\": \"没有守卫通过\",\n  \"kit_requiredRoles\": \"需要角色：{roles}\",\n  \"kit_requiredPermissions\": \"需要权限：{permissions}\",\n  \"kit_idRequired\": \"ID 不能为空\",\n  \"kit_rateLimitWindowInvalid\": \"限流窗口必须为 1 至 2147483647 的整数毫秒\",\n  \"kit_rateLimitMemoryCapacity\": \"开发内存限流容量已满，请使用共享后端\"\n}\n","/**\n * @h-ai/kit — i18n 工具\n *\n * Kit 模块的国际化消息工具，从 @h-ai/core 调用 i18n API。\n * @module kit-i18n\n */\n\nimport { core } from '@h-ai/core'\nimport messagesEnUS from '../messages/en-US.json'\nimport messagesJaJP from '../messages/ja-JP.json'\nimport messagesZhCN from '../messages/zh-CN.json'\n\n/**\n * Kit 中英日消息字典的合法 key 联合。\n * @example 模块内部上下文\n * ```ts\n * const key: KitMessageKey = 'kit_accessDenied'\n * const message = kitM(key)\n * void message\n * ```\n */\ntype KitMessageKey = keyof typeof messagesZhCN\n\n/**\n * 获取 Kit 模块的 i18n 消息\n * @example 模块内部上下文\n * ```ts\n * const message = kitM('kit_accessDenied', { locale: 'en-US' })\n * void message\n * ```\n */\nexport const kitM\n  = core.i18n.createMessageGetter<KitMessageKey>({ 'zh-CN': messagesZhCN, 'en-US': messagesEnUS, 'ja-JP': messagesJaJP })\n\n/**\n * 设置浏览器应用语言或 Node 启动默认语言；请求中只更新当前 runWithLocale 上下文。\n *\n * 通过 @h-ai/core 的集中式 locale 管理器，一次调用即可同步所有模块。\n * 各模块的 createMessageGetter 优先读取当前 Node 请求上下文；SSR 必须包裹实际 resolve。\n * @param locale - 支持的应用默认语言；请求中应使用上下文隔离。\n * @example\n * ```ts\n * import { kit } from '@h-ai/kit'\n *\n * // 应用启动时设置默认语言；请求内使用 runWithLocale。\n * kit.i18n.setLocale('en-US')\n * ```\n */\nexport function setAllModulesLocale(locale: string): void {\n  core.i18n.setGlobalLocale(locale)\n}\n"]}

package/dist/{chunk-L7BTMAKX.js → chunk-P6XH7G4N.js}

@@ -75,10 +75,7 @@ var KitTransportConfigInputSchema = z.union([
   z.literal(false),
   z.object({
     keyExchangePath: AbsolutePathSchema.default("/api/_hai/key-exchange"),
-    excludePaths: z.array(AbsolutePathSchema).default([]),
-    requireEncryption: z.boolean().default(true),
-    encryptResponse: z.boolean().default(true),
-    maxClients: z.number().int().positive().default(1e4)
+    excludePaths: z.array(AbsolutePathSchema).default([])
   })
 ]);
 var ServerConfigInputSchema = z.object({
@@ -117,5 +114,5 @@ function resolveKitConfig(input = {}) {
 }
 
 export { KitConfigSchema, defineCrud, resolveKitConfig, resolveKitTransportConfig, resolveOptions, resolveText };
-//# sourceMappingURL=chunk-L7BTMAKX.js.map
-//# sourceMappingURL=chunk-L7BTMAKX.js.map
+//# sourceMappingURL=chunk-P6XH7G4N.js.map
+//# sourceMappingURL=chunk-P6XH7G4N.js.map