@h-ai/kit 0.1.0-alpha.67 → 0.1.0-alpha.69

package/dist/index.js

@@ -1,12 +1,15 @@
-import { defineCrud } from './chunk-L7BTMAKX.js';
-export { KitConfigSchema, defineCrud, resolveKitConfig, resolveKitTransportConfig, resolveOptions, resolveText } from './chunk-L7BTMAKX.js';
-import { createTokenStore, clearBrowserToken, setBrowserToken, logout, registerAndLogin, loginWithApiKey, loginWithLdap, loginWithOtp, login, installBrowserTransportFetch, installBrowserTransport, createKitAuthActions, createKitClient, configureAuth, getAccessToken } from './chunk-VOTDAVCB.js';
-import { resolveA2AConfig, handleA2ARequest } from './chunk-DVW7CQ3H.js';
-import { transportEncryptionMiddleware } from './chunk-MLSP67JF.js';
-import './chunk-NVYIUBU7.js';
-import { kitM, setAllModulesLocale } from './chunk-QHYNL24G.js';
-import { core } from '@h-ai/core';
-import { IamConfirmPasswordResetInputSchema, IamRequestPasswordResetInputSchema, IamSendOtpInputSchema, IamRegisterInputSchema, IamOtpLoginInputSchema, IamLdapLoginInputSchema, IamLoginInputSchema } from '@h-ai/api-contract';
+import { defineCrud } from './chunk-Y2YUA3VR.js';
+export { KitConfigSchema, defineCrud, resolveKitConfig, resolveKitTransportConfig, resolveOptions, resolveText } from './chunk-Y2YUA3VR.js';
+import { clearBrowserToken, setBrowserToken, logout, registerAndLogin, loginWithApiKey, loginWithLdap, loginWithOtp, login, installBrowserTransportFetch, installBrowserTransport, createKitAuthActions, createKitClient, configureAuth, getAccessToken } from './chunk-QNLZLTVC.js';
+import { resolveA2AConfig, handleA2ARequest } from './chunk-2PWGJCWX.js';
+import { transportEncryptionMiddleware } from './chunk-UTCS6FR7.js';
+import './chunk-XC7I2L3G.js';
+import { kitM, setAllModulesLocale } from './chunk-OVRZIDCD.js';
+import { core, HaiCommonError } from '@h-ai/core';
+import { createHash } from 'crypto';
+import { isIP } from 'net';
+import process2 from 'process';
+import { IamConfirmPasswordResetInputSchema, IamRequestPasswordResetInputSchema, IamSendOtpInputSchema, IamRegisterInputSchema, IamOtpLoginInputSchema, IamLdapLoginInputSchema, IamLoginInputSchema, FeedbackSubmitInputSchema, FeedbackListInputSchema, FeedbackIdInputSchema, FeedbackEvidenceQuerySchema, FeedbackAppendEvidenceInputSchema, FeedbackSetStatusInputSchema, FeedbackRetryInputSchema, FeedbackCompleteInputSchema, FeedbackExportInputSchema, FeedbackUploadInputSchema, FeedbackAttachmentQuerySchema, FeedbackExportQuerySchema } from '@h-ai/api-contract';
 import { z } from 'zod';
 
 // src/guards/kit-permission.ts
@@ -116,67 +119,93 @@ function loggingMiddleware(config = {}) {
 function redactObject(obj, fields) {
   return core.sanitize.sanitizeSensitiveFields(obj, { matcher: fields });
 }
+function permitsMemory() {
+  return !core.module.requiresSharedState(process2.env);
+}
+function createCacheRateLimitStore(backend, options) {
+  if (!options.namespace || options.namespace.length > 128)
+    throw new TypeError("A rate limit namespace of 1-128 characters is required");
+  return {
+    scope: "shared",
+    async increment(key, windowMs) {
+      if (!backend.config || backend.config.type !== "redis" && !(backend.config.type === "memory" && options.allowMemory && permitsMemory()))
+        throw new Error("Rate limiting requires a shared Redis cache");
+      const digest = createHash("sha256").update(JSON.stringify([options.namespace, windowMs, key])).digest("hex");
+      const cacheKey = `hai:kit:ratelimit:{${digest}}`;
+      for (let attempt = 0; attempt < 64; attempt++) {
+        const read = await backend.kv.get(cacheKey);
+        if (!read.success)
+          throw new Error("Rate limit cache read failed");
+        const old = read.data ?? void 0;
+        if (old && (!Number.isSafeInteger(old.count) || old.count <= 0 || old.count >= Number.MAX_SAFE_INTEGER || !Number.isSafeInteger(old.resetAt)))
+          throw new Error("Invalid rate limit state");
+        const next = old ? { count: old.count + 1, resetAt: old.resetAt } : { count: 1, resetAt: Date.now() + windowMs };
+        const written = await backend.kv.compareAndSwap(cacheKey, old, next, old ? { keepTtl: true } : { px: windowMs });
+        if (!written.success)
+          throw new Error("Rate limit cache commit failed");
+        if (written.data)
+          return next;
+      }
+      throw new Error("Rate limit contention limit exceeded");
+    }
+  };
+}
+function createMemoryRateLimitStore() {
+  if (!permitsMemory())
+    throw new Error("Memory rate limiting is restricted to development and tests");
+  return new MemoryRateLimitStore();
+}
+function clientKey(address) {
+  if (isIP(address) !== 6)
+    return address;
+  const normalized = new URL(`http://[${address}]`).hostname.slice(1, -1);
+  const mapped = /^::ffff:([0-9a-f]+):([0-9a-f]+)$/.exec(normalized);
+  if (!mapped)
+    return normalized;
+  const value = Number.parseInt(mapped[1], 16) * 65536 + Number.parseInt(mapped[2], 16);
+  return [value >>> 24, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
+}
 var MemoryRateLimitStore = class {
+  scope = "memory";
   store = /* @__PURE__ */ new Map();
-  cleanupTimer = null;
+  cleanupCursor;
   /**
-   * 启动定期清理过期条目
-   *
-   * @param intervalMs - 清理间隔（毫秒）
+   * 有界惰性回收；保留迭代位置，避免每次从头扫描使尾部过期项永久滞留。
+   * @param now - 当前请求时间，等于 resetAt 时窗口已经失效。
    */
-  startCleanup(intervalMs) {
-    if (this.cleanupTimer)
-      return;
-    this.cleanupTimer = setInterval(() => {
-      const now = Date.now();
-      for (const [key, entry] of this.store) {
-        if (entry.resetAt < now) {
-          this.store.delete(key);
-        }
+  prune(now) {
+    this.cleanupCursor ??= this.store.entries();
+    for (let index = 0; index < 64; index++) {
+      const next = this.cleanupCursor.next();
+      if (next.done) {
+        this.cleanupCursor = void 0;
+        break;
       }
-    }, intervalMs);
-    if (this.cleanupTimer && typeof this.cleanupTimer === "object" && "unref" in this.cleanupTimer) {
-      this.cleanupTimer.unref();
+      const [key, entry] = next.value;
+      if (entry.resetAt <= now)
+        this.store.delete(key);
     }
   }
-  /**
-   * 停止定期清理并释放定时器资源
-   *
-   * 调用后可再次 startCleanup 重启。进程退出 / 热重载 / 测试拆装场景必须调用以
-   * 避免资源泄漏。
-   */
-  stopCleanup() {
-    if (this.cleanupTimer) {
-      clearInterval(this.cleanupTimer);
-      this.cleanupTimer = null;
-    }
-  }
-  get(key) {
-    return this.store.get(key);
-  }
-  set(key, entry) {
-    this.store.set(key, entry);
-  }
-  delete(key) {
-    this.store.delete(key);
-  }
   /**
    * 原子自增（内存实现为同步操作，天然原子）
    *
    * @param key - 限流键
    * @param windowMs - 窗口时长
-   * @returns 自增后的条目
+   * @returns 自增后的快照，修改返回对象不会改变已保存的计数。
+   * @throws 新 key 超出容量或期限非法；中间件将其转换为 503。
+   * @example store.increment('client', 60_000)
    */
   increment(key, windowMs) {
     const now = Date.now();
-    let entry = this.store.get(key);
-    if (!entry || entry.resetAt < now) {
-      entry = { count: 1, resetAt: now + windowMs };
-    } else {
-      entry.count++;
-    }
+    if (!Number.isSafeInteger(windowMs) || windowMs <= 0 || windowMs > 2147483647)
+      throw new TypeError(kitM("kit_rateLimitWindowInvalid"));
+    this.prune(now);
+    const current = this.store.get(key);
+    if (!current && this.store.size >= 1e4)
+      throw new Error(kitM("kit_rateLimitMemoryCapacity"));
+    const entry = !current || current.resetAt <= now ? { count: 1, resetAt: now + windowMs } : { count: current.count + 1, resetAt: current.resetAt };
     this.store.set(key, entry);
-    return entry;
+    return { ...entry };
   }
 };
 function rateLimitMiddleware(config) {
@@ -185,38 +214,36 @@ function rateLimitMiddleware(config) {
     maxRequests,
     keyGenerator = (event) => {
       try {
-        return event.getClientAddress?.() ?? "unknown";
+        return clientKey(event.getClientAddress?.() ?? "unknown");
       } catch {
         return "unknown";
       }
     },
     onLimitReached
   } = config;
-  const store = config.store ?? (() => {
-    const memStore = new MemoryRateLimitStore();
-    memStore.startCleanup(windowMs);
-    return memStore;
-  })();
+  if (!Number.isSafeInteger(windowMs) || windowMs <= 0 || windowMs > 2147483647 || !Number.isSafeInteger(maxRequests) || maxRequests <= 0)
+    throw new TypeError("Rate limit window/count must be positive integers (window <= 2147483647ms)");
+  const store = config.store;
+  if (!store || typeof store.increment !== "function")
+    throw new TypeError("An atomic rate limit store is required");
+  if (store.scope === "memory" && !permitsMemory())
+    throw new Error("Memory rate limiting is restricted to development and tests");
   return async (context, next) => {
     const { event, requestId } = context;
-    const key = keyGenerator(event);
     const now = Date.now();
     let entry;
-    if (store.increment) {
-      entry = await store.increment(key, windowMs);
-    } else {
-      const existing = await store.get(key);
-      if (!existing || existing.resetAt < now) {
-        entry = { count: 1, resetAt: now + windowMs };
-      } else {
-        entry = { ...existing, count: existing.count + 1 };
-      }
-      await store.set(key, entry);
+    try {
+      entry = await store.increment(keyGenerator(event), windowMs);
+      if (!Number.isSafeInteger(entry.count) || entry.count <= 0 || !Number.isSafeInteger(entry.resetAt))
+        throw new TypeError("Invalid atomic rate limit result");
+    } catch {
+      core.logger.error("Rate limit store unavailable", { requestId });
+      return new Response(JSON.stringify({ success: false, error: { code: "RATE_LIMIT_UNAVAILABLE", message: kitM("kit_internalError") }, requestId }), { status: 503, headers: { "Content-Type": "application/json" } });
     }
     const remaining = Math.max(0, maxRequests - entry.count);
     const resetTime = Math.ceil(entry.resetAt / 1e3);
     if (entry.count > maxRequests) {
-      core.logger.warn("Rate limit exceeded", { key, requestId });
+      core.logger.warn("Rate limit exceeded", { requestId });
       if (onLimitReached) {
         return onLimitReached(event);
       }
@@ -236,7 +263,7 @@ function rateLimitMiddleware(config) {
             "X-RateLimit-Limit": String(maxRequests),
             "X-RateLimit-Remaining": "0",
             "X-RateLimit-Reset": String(resetTime),
-            "Retry-After": String(Math.ceil((entry.resetAt - now) / 1e3))
+            "Retry-After": String(Math.max(1, Math.ceil((entry.resetAt - now) / 1e3)))
           }
         }
       );
@@ -344,6 +371,7 @@ function createHandle(config = {}) {
   }
   if (rateLimitConfig) {
     builtinMiddleware.push(rateLimitMiddleware({
+      ...rateLimitConfig,
       windowMs: rateLimitConfig.windowMs ?? 6e4,
       maxRequests: rateLimitConfig.maxRequests ?? 100
     }));
@@ -352,99 +380,104 @@ function createHandle(config = {}) {
   const transportMiddleware = buildTransportMiddleware(cryptoConfig);
   const cookieProxyConfig = buildCookieProxyConfig(cryptoConfig);
   return async ({ event, resolve }) => {
-    const requestId = generateId("req");
-    const context = {
-      event,
-      requestId
-    };
-    const locals = event.locals;
-    locals.requestId = requestId;
-    if (cookieProxyConfig) {
-      const proxiedCookies = createEncryptedCookieProxy(event.cookies, cookieProxyConfig);
-      Object.defineProperty(event, "cookies", {
-        value: proxiedCookies,
-        writable: true,
-        configurable: true
-      });
-    }
-    const runRequest = async () => {
-      try {
-        if (a2aResolved) {
-          const a2aResponse = await handleA2ARequest(event, requestId, a2aResolved);
-          if (a2aResponse)
-            return a2aResponse;
-        }
-        let session;
-        if (authConfig) {
-          const token = getAccessToken(event.request, event.cookies);
-          if (token) {
-            session = await authConfig.verifyToken(token) ?? void 0;
-            locals.session = session;
-            if (session) {
-              locals.accessToken = token;
-            }
+    const suppliedRequestId = event.request.headers.get("x-request-id");
+    const requestId = suppliedRequestId && /^[\w.:-]{1,128}$/.test(suppliedRequestId) ? suppliedRequestId : generateId("req");
+    return core.context.run({ requestId, userId: void 0, scopeId: void 0, jobId: void 0 }, async () => {
+      const context = {
+        event,
+        requestId
+      };
+      const locals = event.locals;
+      locals.requestId = requestId;
+      if (cookieProxyConfig) {
+        const proxiedCookies = createEncryptedCookieProxy(event.cookies, cookieProxyConfig);
+        Object.defineProperty(event, "cookies", {
+          value: proxiedCookies,
+          writable: true,
+          configurable: true
+        });
+      }
+      const runRequest = async () => {
+        try {
+          if (a2aResolved) {
+            const a2aResponse = await handleA2ARequest(event, requestId, a2aResolved);
+            if (a2aResponse)
+              return a2aResponse;
           }
-        }
-        context.session = session;
-        for (const guardConfig of guards) {
-          const guardResult = await executeGuard(guardConfig, event, session);
-          if (!guardResult.allowed) {
-            if (guardResult.redirect) {
-              return new Response(null, {
-                status: 302,
-                headers: { Location: guardResult.redirect }
-              });
+          let session;
+          if (authConfig) {
+            const token = getAccessToken(event.request, event.cookies);
+            if (token) {
+              session = await authConfig.verifyToken(token) ?? void 0;
+              locals.session = session;
+              if (session) {
+                locals.accessToken = token;
+              }
             }
-            return new Response(
-              JSON.stringify({
-                success: false,
-                error: {
-                  code: "FORBIDDEN",
-                  message: guardResult.message ?? kitM("kit_accessDenied")
-                },
-                requestId
-              }),
-              {
-                status: guardResult.status ?? 403,
-                headers: { "Content-Type": "application/json" }
+          }
+          context.session = session;
+          return await core.context.run({ userId: session?.userId }, async () => {
+            for (const guardConfig of guards) {
+              const guardResult = await executeGuard(guardConfig, event, session);
+              if (!guardResult.allowed) {
+                if (guardResult.redirect) {
+                  return new Response(null, {
+                    status: 302,
+                    headers: { Location: guardResult.redirect }
+                  });
+                }
+                return new Response(
+                  JSON.stringify({
+                    success: false,
+                    error: {
+                      code: "FORBIDDEN",
+                      message: guardResult.message ?? kitM("kit_accessDenied")
+                    },
+                    requestId
+                  }),
+                  {
+                    status: guardResult.status ?? 403,
+                    headers: { "Content-Type": "application/json" }
+                  }
+                );
               }
+            }
+            const response2 = await executeMiddlewareChain(
+              allMiddleware,
+              context,
+              () => resolve(event)
             );
+            return response2;
+          });
+        } catch (error2) {
+          if (isSvelteKitControlFlow(error2)) {
+            throw error2;
           }
-        }
-        const response2 = await executeMiddlewareChain(
-          allMiddleware,
-          context,
-          () => resolve(event)
-        );
-        return response2;
-      } catch (error2) {
-        if (isSvelteKitControlFlow(error2)) {
-          throw error2;
-        }
-        core.logger.error("Request failed", { requestId, error: error2 instanceof Error ? error2.message : error2 });
-        if (onError) {
-          return onError(error2, event);
-        }
-        return new Response(
-          JSON.stringify({
-            success: false,
-            error: {
-              code: "INTERNAL_ERROR",
-              message: kitM("kit_internalError")
-            },
-            requestId
-          }),
-          {
-            status: 500,
-            headers: { "Content-Type": "application/json" }
+          core.logger.error("Request failed", { requestId, error: error2 instanceof Error ? error2.message : error2 });
+          if (onError) {
+            return onError(error2, event);
           }
-        );
-      }
-    };
-    const response = transportMiddleware ? await transportMiddleware(context, runRequest) : await runRequest();
-    applyDefaultSecurityHeaders(response);
-    response.headers.set("X-Request-Id", requestId);
-    return response;
+          return new Response(
+            JSON.stringify({
+              success: false,
+              error: {
+                code: "INTERNAL_ERROR",
+                message: kitM("kit_internalError")
+              },
+              requestId
+            }),
+            {
+              status: 500,
+              headers: { "Content-Type": "application/json" }
+            }
+          );
+        }
+      };
+      const response = transportMiddleware ? await transportMiddleware(context, runRequest) : await runRequest();
+      applyDefaultSecurityHeaders(response);
+      response.headers.set("X-Request-Id", requestId);
+      return response;
+    });
   };
 }
 function buildAuthGuard(verifyToken, loginUrl) {
@@ -506,16 +539,15 @@ function matchPath(pathname, pattern) {
 function buildTransportMiddleware(cryptoConfig) {
   if (!cryptoConfig?.transport)
     return null;
-  const transportOpts = typeof cryptoConfig.transport === "object" ? cryptoConfig.transport : {};
+  const transportOpts = cryptoConfig.transport;
   return transportEncryptionMiddleware({
     enabled: true,
     crypto: cryptoConfig.crypto,
+    serverKeyRing: transportOpts.serverKeyRing,
     keyExchangePath: transportOpts.keyExchangePath,
     excludePaths: transportOpts.excludePaths,
-    encryptResponse: transportOpts.encryptResponse,
     keyStore: transportOpts.keyStore,
-    maxClients: transportOpts.maxClients,
-    requireEncryption: transportOpts.requireEncryption
+    maxPlaintextBytes: transportOpts.maxPlaintextBytes
   });
 }
 function buildCookieProxyConfig(cryptoConfig) {
@@ -540,10 +572,32 @@ function sequence(...handles) {
     return filtered[0];
   }
   return async ({ event, resolve }) => {
-    return filtered.reduceRight(
-      (next, handle) => (event2) => handle({ event: event2, resolve: next }),
-      resolve
-    )(event);
+    function applyHandle(index, currentEvent, options) {
+      if (index === filtered.length)
+        return resolve(currentEvent, options);
+      return filtered[index]({
+        event: currentEvent,
+        resolve: async (nextEvent, nextOptions) => {
+          const merged = {
+            ...options,
+            ...nextOptions,
+            preload: options?.preload ?? nextOptions?.preload,
+            filterSerializedResponseHeaders: options?.filterSerializedResponseHeaders ?? nextOptions?.filterSerializedResponseHeaders
+          };
+          if (options?.transformPageChunk || nextOptions?.transformPageChunk) {
+            merged.transformPageChunk = async ({ html, done }) => {
+              if (nextOptions?.transformPageChunk)
+                html = await nextOptions.transformPageChunk({ html, done }) ?? "";
+              if (options?.transformPageChunk)
+                html = await options.transformPageChunk({ html, done }) ?? "";
+              return html;
+            };
+          }
+          return applyHandle(index + 1, nextEvent, merged);
+        }
+      });
+    }
+    return applyHandle(0, event);
   };
 }
 
@@ -767,9 +821,130 @@ function createAuthApi(iam) {
     })
   };
 }
+function createFeedbackHandler(options) {
+  const basePath = (options.basePath ?? "/api/feedback").replace(/\/+$/, "");
+  return async (event) => {
+    let actor;
+    try {
+      actor = await options.resolveContext(event);
+    } catch {
+      return fromError({ ...HaiCommonError.INTERNAL_ERROR, message: kitM("kit_internalError") });
+    }
+    if (!actor?.scopeId || !actor.userId)
+      return fromError({ ...HaiCommonError.UNAUTHORIZED, message: kitM("kit_unauthorized") });
+    const suffix = event.url.pathname.startsWith(`${basePath}/`) ? event.url.pathname.slice(basePath.length + 1) : "";
+    let parts;
+    try {
+      parts = suffix.split("/").map(decodeURIComponent);
+    } catch {
+      return invalid(400);
+    }
+    if (parts[0] !== "reports" || parts.length > 4)
+      return fromError({ ...HaiCommonError.NOT_FOUND, message: core.i18n.coreM("core_errorNotFound") });
+    let body = {};
+    if (!["GET", "HEAD"].includes(event.request.method)) {
+      if (event.request.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() !== "application/json")
+        return invalid(415);
+      try {
+        body = await readBoundedJson(event.request);
+      } catch (error2) {
+        return invalid(error2 instanceof RangeError ? 413 : 400);
+      }
+    }
+    if (!body || typeof body !== "object" || Array.isArray(body))
+      return invalid(400);
+    const bodyRecord = body;
+    if (parts[1] && Object.hasOwn(bodyRecord, "id") && bodyRecord.id !== parts[1])
+      return invalid(400);
+    const input = { ...Object.fromEntries(event.url.searchParams), ...bodyRecord, ...parts[1] ? { id: parts[1] } : {} };
+    const method = event.request.method;
+    const service = options.feedback;
+    async function execute(schema, operation) {
+      const parsed = schema.safeParse(input);
+      if (!parsed.success)
+        return invalid(400);
+      try {
+        const result = await core.context.run(actor, () => operation(parsed.data));
+        return result.success ? ok(result.data) : fromError(result.error);
+      } catch {
+        return fromError({ ...HaiCommonError.INTERNAL_ERROR, message: kitM("kit_internalError") });
+      }
+    }
+    if (parts.length === 1) {
+      if (method === "POST")
+        return execute(FeedbackSubmitInputSchema, (value) => service.submit(value, actor));
+      if (method === "GET")
+        return execute(FeedbackListInputSchema, (value) => service.list(value, actor));
+    }
+    if (parts.length === 2 && method === "GET")
+      return execute(FeedbackIdInputSchema, (value) => service.get(value.id, actor));
+    if (parts.length === 3) {
+      if (parts[2] === "evidence" && method === "GET")
+        return execute(FeedbackEvidenceQuerySchema, (value) => service.getEvidence(value, actor));
+      if (parts[2] === "evidence" && method === "POST")
+        return execute(FeedbackAppendEvidenceInputSchema, (value) => service.appendEvidence(value, actor));
+      if (parts[2] === "status" && method === "PATCH")
+        return execute(FeedbackSetStatusInputSchema, (value) => service.setStatus(value, actor));
+      if (parts[2] === "retry" && method === "POST")
+        return execute(FeedbackRetryInputSchema, (value) => service.retry(value, actor));
+      if (parts[2] === "complete" && method === "POST")
+        return execute(FeedbackCompleteInputSchema, (value) => service.completeCollection(value, actor));
+      if (parts[2] === "exports" && method === "POST")
+        return execute(FeedbackExportInputSchema, (value) => service.export(value, actor));
+    }
+    if (parts.length === 4 && parts[2] === "attachments") {
+      Object.assign(input, { attachmentId: parts[3] });
+      if (method === "POST")
+        return execute(FeedbackUploadInputSchema, (value) => service.uploadAttachment(value, actor));
+      if (method === "GET")
+        return execute(FeedbackAttachmentQuerySchema, (value) => service.getAttachment(value, actor));
+    }
+    if (parts.length === 4 && parts[2] === "exports" && method === "GET") {
+      Object.assign(input, { jobId: parts[3] });
+      return execute(FeedbackExportQuerySchema, (value) => service.getExport(value, actor));
+    }
+    return fromError({ ...HaiCommonError.NOT_FOUND, message: core.i18n.coreM("core_errorNotFound") });
+  };
+}
+function invalid(status) {
+  return fromError({ ...HaiCommonError.INVALID_REQUEST, httpStatus: status, message: kitM("kit_validationFailed") });
+}
+async function readBoundedJson(request) {
+  const reader = request.body?.getReader();
+  if (!reader)
+    return {};
+  const decoder = new TextDecoder();
+  let length = 0;
+  let text = "";
+  try {
+    while (true) {
+      const chunk = await reader.read();
+      if (chunk.done)
+        break;
+      length += chunk.value.byteLength;
+      if (length > 8 * 1024 * 1024) {
+        await reader.cancel();
+        throw new RangeError("Feedback request is too large");
+      }
+      text += decoder.decode(chunk.value, { stream: true });
+    }
+    text += decoder.decode();
+    return text ? JSON.parse(text) : {};
+  } finally {
+    reader.releaseLock();
+  }
+}
 
 // src/kit-main.ts
 var kit = {
+  /** 创建反馈的受控 catch-all HTTP handler，身份范围由宿主解析。 */
+  createFeedbackHandler,
+  /** 原子限流工厂；共享store生命周期由应用管理。 */
+  middleware: {
+    rateLimit: rateLimitMiddleware,
+    createCacheRateLimitStore,
+    createMemoryRateLimitStore
+  },
   // ─── Handle Hook ───
   /** 创建 SvelteKit Handle Hook（含 auth / logging / rateLimit 内置配置） */
   createHandle,
@@ -863,9 +1038,8 @@ var kit = {
     /** 写入浏览器端 Access Token（客户端 login/register 用） */
     setBrowserToken,
     /** 清除浏览器端 Access Token（客户端 logout 用） */
-    clearBrowserToken,
+    clearBrowserToken
     /** 创建浏览器端 Token 存储器（自定义 key 时使用） */
-    createTokenStore
   },
   // ─── CRUD ───
   crud: {
@@ -875,7 +1049,9 @@ var kit = {
   // ─── i18n ───
   i18n: {
     /** 统一设置所有 hai 模块的默认语言 */
-    setLocale: setAllModulesLocale
+    setLocale: setAllModulesLocale,
+    /** 请求/SSR 语言隔离；异步处理使用同一请求上下文。 */
+    runWithLocale: core.i18n.runWithLocale
   }
 };