@h-ai/kit 0.1.0-alpha.68 → 0.1.0-alpha.70

package/dist/index.d.ts

@@ -1,21 +1,22 @@
-import { c as createKitClient, a as createKitAuthActions, i as installBrowserTransport, b as installBrowserTransportFetch, o as login, p as loginWithOtp, q as loginWithLdap, t as loginWithApiKey, u as registerAndLogin, v as logout, s as setBrowserToken, d as clearBrowserToken } from './kit-client-auth-HnZIYUia.js';
-export { C as ClientTransportConfig, K as KitClient, e as KitClientConfig, f as KitConfig, g as KitConfigInput, h as KitConfigSchema, j as KitServerConfig, k as KitServerConfigInput, l as KitTransportConfig, m as KitTransportConfigInput, r as resolveKitConfig, n as resolveKitTransportConfig } from './kit-client-auth-HnZIYUia.js';
+import { c as createKitClient, a as createKitAuthActions, i as installBrowserTransport, b as installBrowserTransportFetch, o as login, p as loginWithOtp, q as loginWithLdap, t as loginWithApiKey, u as registerAndLogin, v as logout, s as setBrowserToken, d as clearBrowserToken } from './kit-client-auth-B5y1g5_A.js';
+export { C as ClientTransportConfig, K as KitClient, e as KitClientConfig, f as KitConfig, g as KitConfigInput, h as KitConfigSchema, j as KitServerConfig, k as KitServerConfigInput, l as KitTransportConfig, m as KitTransportConfigInput, r as resolveKitConfig, n as resolveKitTransportConfig } from './kit-client-auth-B5y1g5_A.js';
 import { d as defineCrud, s as setAllModulesLocale } from './kit-i18n-DEzmzE5T.js';
 export { C as CrudApiDef, a as CrudFieldDef, b as CrudFieldOption, c as CrudFieldOptions, e as CrudFieldType, f as CrudFieldValidation, g as CrudFilterParams, h as CrudOperations, i as CrudPaginatedResult, j as CrudPaginationParams, k as CrudResourceDef, l as CrudTableColumn, m as CrudText, r as resolveOptions, n as resolveText } from './kit-i18n-DEzmzE5T.js';
-import { S as SessionData, l as SessionLike, h as HandleConfig, r as rateLimitMiddleware, m as createCacheRateLimitStore, n as createMemoryRateLimitStore } from './kit-types-CnzhN-AS.js';
-export { A as ApiResponse, a as AuthOperations, b as AuthOperationsProvider, C as CorsConfig, F as FormError, c as FormValidationResult, G as GuardConfig, d as GuardResult, H as HaiRequestEvent, e as HandleA2AConfig, f as HandleA2AOperations, g as HandleAuthConfig, i as HookCryptoConfig, o as MemoryRateLimitStore, M as Middleware, j as MiddlewareContext, p as RateLimitCache, R as RateLimitConfig, q as RateLimitEntry, s as RateLimitStore, k as RouteGuard, T as TransportEncryptionOptions } from './kit-types-CnzhN-AS.js';
+import { S as SessionData, l as SessionLike, h as HandleConfig, r as rateLimitMiddleware, m as createCacheRateLimitStore, n as createMemoryRateLimitStore } from './kit-types-DQYqP1Cn.js';
+export { A as ApiResponse, a as AuthOperations, b as AuthOperationsProvider, C as CorsConfig, F as FormError, c as FormValidationResult, G as GuardConfig, d as GuardResult, H as HaiRequestEvent, e as HandleA2AConfig, f as HandleA2AOperations, g as HandleAuthConfig, i as HookCryptoConfig, o as MemoryRateLimitStore, M as Middleware, j as MiddlewareContext, p as RateLimitCache, R as RateLimitConfig, q as RateLimitEntry, s as RateLimitStore, k as RouteGuard, T as TransportEncryptionOptions } from './kit-types-DQYqP1Cn.js';
 import { CryptoFunctions } from '@h-ai/crypto';
 export { EncryptedPayload, TransportEncryptionManager, TransportKeyPair } from '@h-ai/crypto';
+import { FeedbackFunctions, FeedbackContext } from '@h-ai/feedback';
+import * as _sveltejs_kit from '@sveltejs/kit';
+import { Handle, RequestEvent, RequestHandler } from '@sveltejs/kit';
 import * as _h_ai_core from '@h-ai/core';
 import { HaiError } from '@h-ai/core';
 import * as zod_v4_core from 'zod/v4/core';
 import * as zod from 'zod';
 import { z } from 'zod';
-import * as _sveltejs_kit from '@sveltejs/kit';
-import { Handle, RequestEvent, RequestHandler } from '@sveltejs/kit';
 import { IamFunctions } from '@h-ai/iam';
-export { A as A2AApiKeyAuthConfig, K as KitA2AHandlerConfig, R as ResolvedA2AConfig } from './kit-a2a-types-CwT1AFQu.js';
-export { C as CryptoCsrfConfig, a as CryptoServiceLike, E as EncryptedCookieConfig, T as TransportEncryptionConfig, W as WebhookVerifyConfig } from './kit-crypto-types-Dd24aJ4m.js';
+export { A as A2AApiKeyAuthConfig, K as KitA2AHandlerConfig, R as ResolvedA2AConfig } from './kit-a2a-types-DwcmE668.js';
+export { C as CryptoCsrfConfig, a as CryptoServiceLike, E as EncryptedCookieConfig, T as TransportEncryptionConfig, W as WebhookVerifyConfig } from './kit-crypto-types-Cwj9bprV.js';
 import '@h-ai/api-contract';
 
 /**
@@ -246,6 +247,37 @@ declare function createHandle(config?: HandleConfig): Handle;
  */
 declare function sequence(...handles: Handle[]): Handle;
 
+/** 可直接挂到 SvelteKit catch-all 路由的反馈适配，无 serv 或 Svelte UI 依赖。 */
+
+/**
+ * 反馈服务及可信范围解析。resolveContext 必须使用已验证 session/宿主策略。
+ * @example
+ * ```ts
+ * import type { FeedbackHandlerOptions } from '@h-ai/kit'
+ * import { feedback } from '@h-ai/feedback'
+ * const options: FeedbackHandlerOptions = { feedback, resolveContext: () => null }
+ * // 应用实现真实 session 映射；null 拒绝访问，不能从 JSON 取得身份。
+ * ```
+ */
+interface FeedbackHandlerOptions {
+    readonly feedback: FeedbackFunctions;
+    readonly resolveContext: (event: RequestEvent) => FeedbackContext | null | Promise<FeedbackContext | null>;
+    readonly basePath?: string;
+}
+/**
+ * 装配反馈 REST 路由；默认路径 /api/feedback，由宿主 handle 保持 CSRF、认证和传输加密。
+ * @param options - 已初始化服务与可信范围映射。
+ * @returns 可赋值给 catch-all 路由 GET/POST/PATCH 的同一 handler。
+ * @example
+ * ```ts
+ * import { kit } from '@h-ai/kit'
+ * import { feedback } from '@h-ai/feedback'
+ * const handler = kit.createFeedbackHandler({ feedback, resolveContext: () => null })
+ * // 路由 export const GET = handler；真实应用从受信 session 返回范围，null 默认拒绝。
+ * ```
+ */
+declare function createFeedbackHandler(options: FeedbackHandlerOptions): RequestHandler;
+
 /**
  * 应用路由直接导出对应 handler；认证 ops 仍由 createHandle 注入。
  * @param iam - 已由应用初始化的 IAM 服务对象。
@@ -649,6 +681,8 @@ declare const PaginationQuerySchema: z.ZodObject<{
  * ```
  */
 declare const kit: {
+    /** 创建反馈的受控 catch-all HTTP handler，身份范围由宿主解析。 */
+    createFeedbackHandler: typeof createFeedbackHandler;
     /** 原子限流工厂；共享store生命周期由应用管理。 */
     middleware: {
         rateLimit: typeof rateLimitMiddleware;
@@ -789,4 +823,4 @@ interface LoggingMiddlewareConfig {
     redactFields?: string[];
 }
 
-export { type AuthGuardConfig, type CookieProxyConfig, HandleConfig, IdParamSchema, type LoggingMiddlewareConfig, PaginationQuerySchema, type PermissionGuardConfig, type RoleGuardConfig, SessionData, type SessionGuardConfig, SessionLike, defineCrud, kit, matchPermission };
+export { type AuthGuardConfig, type CookieProxyConfig, type FeedbackHandlerOptions, HandleConfig, IdParamSchema, type LoggingMiddlewareConfig, PaginationQuerySchema, type PermissionGuardConfig, type RoleGuardConfig, SessionData, type SessionGuardConfig, SessionLike, defineCrud, kit, matchPermission };

package/dist/index.js

@@ -1,15 +1,15 @@
-import { defineCrud } from './chunk-P6XH7G4N.js';
-export { KitConfigSchema, defineCrud, resolveKitConfig, resolveKitTransportConfig, resolveOptions, resolveText } from './chunk-P6XH7G4N.js';
-import { clearBrowserToken, setBrowserToken, logout, registerAndLogin, loginWithApiKey, loginWithLdap, loginWithOtp, login, installBrowserTransportFetch, installBrowserTransport, createKitAuthActions, createKitClient, configureAuth, getAccessToken } from './chunk-2YYRP7HH.js';
+import { defineCrud } from './chunk-Y2YUA3VR.js';
+export { KitConfigSchema, defineCrud, resolveKitConfig, resolveKitTransportConfig, resolveOptions, resolveText } from './chunk-Y2YUA3VR.js';
+import { clearBrowserToken, setBrowserToken, logout, registerAndLogin, loginWithApiKey, loginWithLdap, loginWithOtp, login, installBrowserTransportFetch, installBrowserTransport, createKitAuthActions, createKitClient, configureAuth, getAccessToken } from './chunk-QNLZLTVC.js';
 import { resolveA2AConfig, handleA2ARequest } from './chunk-2PWGJCWX.js';
-import { transportEncryptionMiddleware } from './chunk-333FGMGQ.js';
+import { transportEncryptionMiddleware } from './chunk-UTCS6FR7.js';
 import './chunk-XC7I2L3G.js';
 import { kitM, setAllModulesLocale } from './chunk-OVRZIDCD.js';
-import { core } from '@h-ai/core';
+import { core, HaiCommonError } from '@h-ai/core';
 import { createHash } from 'crypto';
 import { isIP } from 'net';
 import process2 from 'process';
-import { IamConfirmPasswordResetInputSchema, IamRequestPasswordResetInputSchema, IamSendOtpInputSchema, IamRegisterInputSchema, IamOtpLoginInputSchema, IamLdapLoginInputSchema, IamLoginInputSchema } from '@h-ai/api-contract';
+import { IamConfirmPasswordResetInputSchema, IamRequestPasswordResetInputSchema, IamSendOtpInputSchema, IamRegisterInputSchema, IamOtpLoginInputSchema, IamLdapLoginInputSchema, IamLoginInputSchema, FeedbackSubmitInputSchema, FeedbackListInputSchema, FeedbackIdInputSchema, FeedbackEvidenceQuerySchema, FeedbackAppendEvidenceInputSchema, FeedbackSetStatusInputSchema, FeedbackRetryInputSchema, FeedbackCompleteInputSchema, FeedbackExportInputSchema, FeedbackUploadInputSchema, FeedbackAttachmentQuerySchema, FeedbackExportQuerySchema } from '@h-ai/api-contract';
 import { z } from 'zod';
 
 // src/guards/kit-permission.ts
@@ -380,99 +380,104 @@ function createHandle(config = {}) {
   const transportMiddleware = buildTransportMiddleware(cryptoConfig);
   const cookieProxyConfig = buildCookieProxyConfig(cryptoConfig);
   return async ({ event, resolve }) => {
-    const requestId = generateId("req");
-    const context = {
-      event,
-      requestId
-    };
-    const locals = event.locals;
-    locals.requestId = requestId;
-    if (cookieProxyConfig) {
-      const proxiedCookies = createEncryptedCookieProxy(event.cookies, cookieProxyConfig);
-      Object.defineProperty(event, "cookies", {
-        value: proxiedCookies,
-        writable: true,
-        configurable: true
-      });
-    }
-    const runRequest = async () => {
-      try {
-        if (a2aResolved) {
-          const a2aResponse = await handleA2ARequest(event, requestId, a2aResolved);
-          if (a2aResponse)
-            return a2aResponse;
-        }
-        let session;
-        if (authConfig) {
-          const token = getAccessToken(event.request, event.cookies);
-          if (token) {
-            session = await authConfig.verifyToken(token) ?? void 0;
-            locals.session = session;
-            if (session) {
-              locals.accessToken = token;
-            }
+    const suppliedRequestId = event.request.headers.get("x-request-id");
+    const requestId = suppliedRequestId && /^[\w.:-]{1,128}$/.test(suppliedRequestId) ? suppliedRequestId : generateId("req");
+    return core.context.run({ requestId, userId: void 0, scopeId: void 0, jobId: void 0 }, async () => {
+      const context = {
+        event,
+        requestId
+      };
+      const locals = event.locals;
+      locals.requestId = requestId;
+      if (cookieProxyConfig) {
+        const proxiedCookies = createEncryptedCookieProxy(event.cookies, cookieProxyConfig);
+        Object.defineProperty(event, "cookies", {
+          value: proxiedCookies,
+          writable: true,
+          configurable: true
+        });
+      }
+      const runRequest = async () => {
+        try {
+          if (a2aResolved) {
+            const a2aResponse = await handleA2ARequest(event, requestId, a2aResolved);
+            if (a2aResponse)
+              return a2aResponse;
           }
-        }
-        context.session = session;
-        for (const guardConfig of guards) {
-          const guardResult = await executeGuard(guardConfig, event, session);
-          if (!guardResult.allowed) {
-            if (guardResult.redirect) {
-              return new Response(null, {
-                status: 302,
-                headers: { Location: guardResult.redirect }
-              });
+          let session;
+          if (authConfig) {
+            const token = getAccessToken(event.request, event.cookies);
+            if (token) {
+              session = await authConfig.verifyToken(token) ?? void 0;
+              locals.session = session;
+              if (session) {
+                locals.accessToken = token;
+              }
             }
-            return new Response(
-              JSON.stringify({
-                success: false,
-                error: {
-                  code: "FORBIDDEN",
-                  message: guardResult.message ?? kitM("kit_accessDenied")
-                },
-                requestId
-              }),
-              {
-                status: guardResult.status ?? 403,
-                headers: { "Content-Type": "application/json" }
+          }
+          context.session = session;
+          return await core.context.run({ userId: session?.userId }, async () => {
+            for (const guardConfig of guards) {
+              const guardResult = await executeGuard(guardConfig, event, session);
+              if (!guardResult.allowed) {
+                if (guardResult.redirect) {
+                  return new Response(null, {
+                    status: 302,
+                    headers: { Location: guardResult.redirect }
+                  });
+                }
+                return new Response(
+                  JSON.stringify({
+                    success: false,
+                    error: {
+                      code: "FORBIDDEN",
+                      message: guardResult.message ?? kitM("kit_accessDenied")
+                    },
+                    requestId
+                  }),
+                  {
+                    status: guardResult.status ?? 403,
+                    headers: { "Content-Type": "application/json" }
+                  }
+                );
               }
+            }
+            const response2 = await executeMiddlewareChain(
+              allMiddleware,
+              context,
+              () => resolve(event)
             );
+            return response2;
+          });
+        } catch (error2) {
+          if (isSvelteKitControlFlow(error2)) {
+            throw error2;
           }
-        }
-        const response2 = await executeMiddlewareChain(
-          allMiddleware,
-          context,
-          () => resolve(event)
-        );
-        return response2;
-      } catch (error2) {
-        if (isSvelteKitControlFlow(error2)) {
-          throw error2;
-        }
-        core.logger.error("Request failed", { requestId, error: error2 instanceof Error ? error2.message : error2 });
-        if (onError) {
-          return onError(error2, event);
-        }
-        return new Response(
-          JSON.stringify({
-            success: false,
-            error: {
-              code: "INTERNAL_ERROR",
-              message: kitM("kit_internalError")
-            },
-            requestId
-          }),
-          {
-            status: 500,
-            headers: { "Content-Type": "application/json" }
+          core.logger.error("Request failed", { requestId, error: error2 instanceof Error ? error2.message : error2 });
+          if (onError) {
+            return onError(error2, event);
           }
-        );
-      }
-    };
-    const response = transportMiddleware ? await transportMiddleware(context, runRequest) : await runRequest();
-    applyDefaultSecurityHeaders(response);
-    response.headers.set("X-Request-Id", requestId);
-    return response;
+          return new Response(
+            JSON.stringify({
+              success: false,
+              error: {
+                code: "INTERNAL_ERROR",
+                message: kitM("kit_internalError")
+              },
+              requestId
+            }),
+            {
+              status: 500,
+              headers: { "Content-Type": "application/json" }
+            }
+          );
+        }
+      };
+      const response = transportMiddleware ? await transportMiddleware(context, runRequest) : await runRequest();
+      applyDefaultSecurityHeaders(response);
+      response.headers.set("X-Request-Id", requestId);
+      return response;
+    });
   };
 }
 function buildAuthGuard(verifyToken, loginUrl) {
@@ -541,7 +546,8 @@ function buildTransportMiddleware(cryptoConfig) {
     serverKeyRing: transportOpts.serverKeyRing,
     keyExchangePath: transportOpts.keyExchangePath,
     excludePaths: transportOpts.excludePaths,
-    keyStore: transportOpts.keyStore
+    keyStore: transportOpts.keyStore,
+    maxPlaintextBytes: transportOpts.maxPlaintextBytes
   });
 }
 function buildCookieProxyConfig(cryptoConfig) {
@@ -815,9 +821,124 @@ function createAuthApi(iam) {
     })
   };
 }
+function createFeedbackHandler(options) {
+  const basePath = (options.basePath ?? "/api/feedback").replace(/\/+$/, "");
+  return async (event) => {
+    let actor;
+    try {
+      actor = await options.resolveContext(event);
+    } catch {
+      return fromError({ ...HaiCommonError.INTERNAL_ERROR, message: kitM("kit_internalError") });
+    }
+    if (!actor?.scopeId || !actor.userId)
+      return fromError({ ...HaiCommonError.UNAUTHORIZED, message: kitM("kit_unauthorized") });
+    const suffix = event.url.pathname.startsWith(`${basePath}/`) ? event.url.pathname.slice(basePath.length + 1) : "";
+    let parts;
+    try {
+      parts = suffix.split("/").map(decodeURIComponent);
+    } catch {
+      return invalid(400);
+    }
+    if (parts[0] !== "reports" || parts.length > 4)
+      return fromError({ ...HaiCommonError.NOT_FOUND, message: core.i18n.coreM("core_errorNotFound") });
+    let body = {};
+    if (!["GET", "HEAD"].includes(event.request.method)) {
+      if (event.request.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() !== "application/json")
+        return invalid(415);
+      try {
+        body = await readBoundedJson(event.request);
+      } catch (error2) {
+        return invalid(error2 instanceof RangeError ? 413 : 400);
+      }
+    }
+    if (!body || typeof body !== "object" || Array.isArray(body))
+      return invalid(400);
+    const bodyRecord = body;
+    if (parts[1] && Object.hasOwn(bodyRecord, "id") && bodyRecord.id !== parts[1])
+      return invalid(400);
+    const input = { ...Object.fromEntries(event.url.searchParams), ...bodyRecord, ...parts[1] ? { id: parts[1] } : {} };
+    const method = event.request.method;
+    const service = options.feedback;
+    async function execute(schema, operation) {
+      const parsed = schema.safeParse(input);
+      if (!parsed.success)
+        return invalid(400);
+      try {
+        const result = await core.context.run(actor, () => operation(parsed.data));
+        return result.success ? ok(result.data) : fromError(result.error);
+      } catch {
+        return fromError({ ...HaiCommonError.INTERNAL_ERROR, message: kitM("kit_internalError") });
+      }
+    }
+    if (parts.length === 1) {
+      if (method === "POST")
+        return execute(FeedbackSubmitInputSchema, (value) => service.submit(value, actor));
+      if (method === "GET")
+        return execute(FeedbackListInputSchema, (value) => service.list(value, actor));
+    }
+    if (parts.length === 2 && method === "GET")
+      return execute(FeedbackIdInputSchema, (value) => service.get(value.id, actor));
+    if (parts.length === 3) {
+      if (parts[2] === "evidence" && method === "GET")
+        return execute(FeedbackEvidenceQuerySchema, (value) => service.getEvidence(value, actor));
+      if (parts[2] === "evidence" && method === "POST")
+        return execute(FeedbackAppendEvidenceInputSchema, (value) => service.appendEvidence(value, actor));
+      if (parts[2] === "status" && method === "PATCH")
+        return execute(FeedbackSetStatusInputSchema, (value) => service.setStatus(value, actor));
+      if (parts[2] === "retry" && method === "POST")
+        return execute(FeedbackRetryInputSchema, (value) => service.retry(value, actor));
+      if (parts[2] === "complete" && method === "POST")
+        return execute(FeedbackCompleteInputSchema, (value) => service.completeCollection(value, actor));
+      if (parts[2] === "exports" && method === "POST")
+        return execute(FeedbackExportInputSchema, (value) => service.export(value, actor));
+    }
+    if (parts.length === 4 && parts[2] === "attachments") {
+      Object.assign(input, { attachmentId: parts[3] });
+      if (method === "POST")
+        return execute(FeedbackUploadInputSchema, (value) => service.uploadAttachment(value, actor));
+      if (method === "GET")
+        return execute(FeedbackAttachmentQuerySchema, (value) => service.getAttachment(value, actor));
+    }
+    if (parts.length === 4 && parts[2] === "exports" && method === "GET") {
+      Object.assign(input, { jobId: parts[3] });
+      return execute(FeedbackExportQuerySchema, (value) => service.getExport(value, actor));
+    }
+    return fromError({ ...HaiCommonError.NOT_FOUND, message: core.i18n.coreM("core_errorNotFound") });
+  };
+}
+function invalid(status) {
+  return fromError({ ...HaiCommonError.INVALID_REQUEST, httpStatus: status, message: kitM("kit_validationFailed") });
+}
+async function readBoundedJson(request) {
+  const reader = request.body?.getReader();
+  if (!reader)
+    return {};
+  const decoder = new TextDecoder();
+  let length = 0;
+  let text = "";
+  try {
+    while (true) {
+      const chunk = await reader.read();
+      if (chunk.done)
+        break;
+      length += chunk.value.byteLength;
+      if (length > 8 * 1024 * 1024) {
+        await reader.cancel();
+        throw new RangeError("Feedback request is too large");
+      }
+      text += decoder.decode(chunk.value, { stream: true });
+    }
+    text += decoder.decode();
+    return text ? JSON.parse(text) : {};
+  } finally {
+    reader.releaseLock();
+  }
+}
 
 // src/kit-main.ts
 var kit = {
+  /** 创建反馈的受控 catch-all HTTP handler，身份范围由宿主解析。 */
+  createFeedbackHandler,
   /** 原子限流工厂；共享store生命周期由应用管理。 */
   middleware: {
     rateLimit: rateLimitMiddleware,