@h-ai/kit 0.1.0-alpha5

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [2026] [idealworld.group]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,121 @@
+# @h-ai/kit
+
+`@h-ai/kit` 是 hai-framework 的 SvelteKit 集成模块，提供统一的请求管道与 API 工具：
+
+- `kit.createHandle()`：会话解析、路由守卫、中间件链、可选传输加密与 Cookie 加密
+- `kit.handler()`：API 端点异常边界
+- `kit.guard` / `kit.response` / `kit.validate` / `kit.auth` / `kit.client` / `kit.crud`
+
+## 支持的能力
+
+- Handle Hook 组合（`createHandle` / `sequence`）
+- 认证/角色/权限守卫（`guard.require` / `guard.check`）
+- 内置 Logging / RateLimit / CORS 中间件（通过 `createHandle` 配置启用）
+- 统一 API 响应与请求验证（Zod）
+- Bearer Token 工具（服务端 login/logout + 浏览器端 Token 存储）
+- 浏览器端统一客户端（自动 CSRF，支持传输加密）
+- 基于 EndpointDef 的契约模式（`fromContract`）
+- 声明式 CRUD 资源定义（`crud.define`）
+- A2A 协议集成
+- 双构建模式（`createAdapter()`）
+
+## 依赖
+
+- `@h-ai/iam` — 身份认证与授权（A2A 认证），可选；使用 A2A 功能时需在 kit 使用前初始化
+- `@h-ai/crypto` — 加密（传输加密 / Cookie 加密），可选；启用加密时需在 kit 使用前初始化
+
+## 快速开始
+
+### 搭建请求管道
+
+```typescript
+import { kit } from '@h-ai/kit'
+
+export const handle = kit.createHandle({
+  auth: {
+    verifyToken: async (token) => {
+      // 返回 SessionData 或 null
+      return token ? { userId: 'u_1', roles: ['admin'], permissions: ['user:read'] } : null
+    },
+    loginUrl: '/auth/login',
+    protectedPaths: ['/admin/*', '/api/*'],
+    publicPaths: ['/api/auth/*', '/api/public/*'],
+  },
+  rateLimit: { windowMs: 60_000, maxRequests: 100 },
+  logging: true,
+})
+```
+
+### API 端点
+
+```typescript
+import { kit } from '@h-ai/kit'
+import { z } from 'zod'
+
+const CreateUserSchema = z.object({
+  name: z.string().min(1),
+  email: z.string().email(),
+})
+
+export const POST = kit.handler(async ({ request, locals }) => {
+  kit.guard.require(locals.session, 'user:create')
+  const payload = await kit.validate.body(request, CreateUserSchema)
+  return kit.response.created(payload)
+})
+```
+
+### 契约模式（推荐）
+
+```typescript
+import { iamEndpoints } from '@h-ai/iam/api'
+import { kit } from '@h-ai/kit'
+
+export const POST = kit.fromContract(iamEndpoints.login, async (input) => {
+  const result = await iam.auth.login(input)
+  if (!result.success)
+    return kit.response.unauthorized(result.error.message)
+  return kit.response.ok(result.data)
+})
+```
+
+### 浏览器客户端（可选）
+
+```typescript
+import { createKitClient } from '@h-ai/kit/client'
+
+const client = createKitClient()
+const response = await client.apiFetch('/api/users', { method: 'GET' })
+```
+
+> CSRF Header 注入由 `createKitClient()` 在浏览器端自动处理；`@h-ai/kit` 不提供独立的 CSRF 中间件工厂。
+
+## 配置
+
+`kit.createHandle()` 配置项：
+
+| 字段         | 类型                                     | 说明                                                              |
+| ------------ | ---------------------------------------- | ----------------------------------------------------------------- |
+| `auth`       | `HandleAuthConfig`                       | 认证配置（verifyToken / protectedPaths / publicPaths / loginUrl） |
+| `rateLimit`  | `object \| false`                        | 速率限制（windowMs / maxRequests）                                |
+| `logging`    | `boolean \| object`                      | 请求日志（默认 `true`，`{ logBody: true }` 记录请求体）           |
+| `crypto`     | `HookCryptoConfig`                       | 传输加密 + Cookie 加密                                            |
+| `guards`     | `GuardConfig[]`                          | 自定义守卫（在 auth 自动守卫之后执行）                            |
+| `middleware` | `Middleware[]`                           | 自定义中间件（在内置中间件之后执行）                              |
+| `a2a`        | `HandleA2AOperations \| HandleA2AConfig` | A2A 协议集成（Agent Card + JSON-RPC）                             |
+| `onError`    | `function`                               | 自定义错误处理                                                    |
+
+## 错误处理
+
+- 推荐使用 `kit.handler()` 包装 API 端点。
+- `kit.validate.body` / `kit.guard.require` 会抛出 `Response`（SvelteKit 控制流）。
+- 非控制流异常会由 `kit.handler()` 统一转换为 `500 INTERNAL_ERROR` 响应。
+
+## 测试
+
+```bash
+pnpm --filter @h-ai/kit test
+```
+
+## License
+
+Apache-2.0

package/dist/adapter/index.d.ts

@@ -0,0 +1,44 @@
+import * as _sveltejs_kit from '@sveltejs/kit';
+
+/**
+ * SvelteKit 双构建模式 — 适配器工厂
+ *
+ * 根据 `VITE_ADAPTER` 环境变量自动选择 adapter-node 或 adapter-static，
+ * 使同一个 SvelteKit 应用能同时产出 SSR（Web + API）和 SPA（H5/App）两种构建产物。
+ *
+ * @example
+ * ```js
+ * // svelte.config.js
+ * import { createAdapter } from '@h-ai/kit/adapter'
+ *
+ * export default {
+ *   kit: {
+ *     adapter: createAdapter(),
+ *   },
+ * }
+ * ```
+ *
+ * @module kit-adapter
+ */
+/** 双构建适配器配置 */
+interface AdapterOptions {
+    /** adapter-node 输出目录，默认 `'build'` */
+    nodeBuildDir?: string;
+    /** adapter-static 输出目录，默认 `'build-static'` */
+    staticBuildDir?: string;
+    /** adapter-static 的 SPA fallback 页面，默认 `'index.html'` */
+    staticFallback?: string;
+}
+/**
+ * 根据环境变量 `VITE_ADAPTER` 选择 SvelteKit adapter
+ *
+ * - `VITE_ADAPTER=node`   → `@sveltejs/adapter-node`（SSR + API）
+ * - `VITE_ADAPTER=static` → `@sveltejs/adapter-static`（SPA，可被 Capacitor 包装）
+ * - 未设置时默认使用 `node`
+ *
+ * **注意**：adapter-node / adapter-static 仍然需要在应用的 devDependencies 中声明。
+ * 本函数只做动态 import + 统一配置。
+ */
+declare function createAdapter(options?: AdapterOptions): Promise<_sveltejs_kit.Adapter>;
+
+export { type AdapterOptions, createAdapter };

package/dist/adapter/index.js

@@ -0,0 +1,28 @@
+import process from 'process';
+
+// src/kit-adapter.ts
+async function createAdapter(options) {
+  const {
+    nodeBuildDir = "build",
+    staticBuildDir = "build-static",
+    staticFallback = "index.html"
+  } = options ?? {};
+  const mode = process.env.VITE_ADAPTER ?? "node";
+  if (mode === "static") {
+    const { default: adapterStatic } = await import('@sveltejs/adapter-static');
+    return adapterStatic({
+      pages: staticBuildDir,
+      assets: staticBuildDir,
+      fallback: staticFallback,
+      precompress: false
+    });
+  }
+  const { default: adapterNode } = await import('@sveltejs/adapter-node');
+  return adapterNode({
+    out: nodeBuildDir
+  });
+}
+
+export { createAdapter };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/adapter/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/kit-adapter.ts"],"names":[],"mappings":";;;AA2CA,eAAsB,cAAc,OAAA,EAA0B;AAC5D,EAAA,MAAM;AAAA,IACJ,YAAA,GAAe,OAAA;AAAA,IACf,cAAA,GAAiB,cAAA;AAAA,IACjB,cAAA,GAAiB;AAAA,GACnB,GAAI,WAAW,EAAC;AAEhB,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,YAAA,IAAgB,MAAA;AAEzC,EAAA,IAAI,SAAS,QAAA,EAAU;AACrB,IAAA,MAAM,EAAE,OAAA,EAAS,aAAA,EAAc,GAAI,MAAM,OAAO,0BAA0B,CAAA;AAC1E,IAAA,OAAO,aAAA,CAAc;AAAA,MACnB,KAAA,EAAO,cAAA;AAAA,MACP,MAAA,EAAQ,cAAA;AAAA,MACR,QAAA,EAAU,cAAA;AAAA,MACV,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,EACH;AAGA,EAAA,MAAM,EAAE,OAAA,EAAS,WAAA,EAAY,GAAI,MAAM,OAAO,wBAAwB,CAAA;AACtE,EAAA,OAAO,WAAA,CAAY;AAAA,IACjB,GAAA,EAAK;AAAA,GACN,CAAA;AACH","file":"index.js","sourcesContent":["/**\n * SvelteKit 双构建模式 — 适配器工厂\n *\n * 根据 `VITE_ADAPTER` 环境变量自动选择 adapter-node 或 adapter-static，\n * 使同一个 SvelteKit 应用能同时产出 SSR（Web + API）和 SPA（H5/App）两种构建产物。\n *\n * @example\n * ```js\n * // svelte.config.js\n * import { createAdapter } from '@h-ai/kit/adapter'\n *\n * export default {\n *   kit: {\n *     adapter: createAdapter(),\n *   },\n * }\n * ```\n *\n * @module kit-adapter\n */\n\nimport process from 'node:process'\n\n/** 双构建适配器配置 */\nexport interface AdapterOptions {\n  /** adapter-node 输出目录，默认 `'build'` */\n  nodeBuildDir?: string\n  /** adapter-static 输出目录，默认 `'build-static'` */\n  staticBuildDir?: string\n  /** adapter-static 的 SPA fallback 页面，默认 `'index.html'` */\n  staticFallback?: string\n}\n\n/**\n * 根据环境变量 `VITE_ADAPTER` 选择 SvelteKit adapter\n *\n * - `VITE_ADAPTER=node`   → `@sveltejs/adapter-node`（SSR + API）\n * - `VITE_ADAPTER=static` → `@sveltejs/adapter-static`（SPA，可被 Capacitor 包装）\n * - 未设置时默认使用 `node`\n *\n * **注意**：adapter-node / adapter-static 仍然需要在应用的 devDependencies 中声明。\n * 本函数只做动态 import + 统一配置。\n */\nexport async function createAdapter(options?: AdapterOptions) {\n  const {\n    nodeBuildDir = 'build',\n    staticBuildDir = 'build-static',\n    staticFallback = 'index.html',\n  } = options ?? {}\n\n  const mode = process.env.VITE_ADAPTER ?? 'node'\n\n  if (mode === 'static') {\n    const { default: adapterStatic } = await import('@sveltejs/adapter-static')\n    return adapterStatic({\n      pages: staticBuildDir,\n      assets: staticBuildDir,\n      fallback: staticFallback,\n      precompress: false,\n    })\n  }\n\n  // 默认 node\n  const { default: adapterNode } = await import('@sveltejs/adapter-node')\n  return adapterNode({\n    out: nodeBuildDir,\n  })\n}\n"]}

package/dist/browser.d.ts

@@ -0,0 +1,38 @@
+import { c as createKitClient, s as setBrowserToken, a as clearBrowserToken, b as createTokenStore, d as createHandleFetch } from './index-BotXLTck.js';
+export { C as ClientTransportConfig, K as KitClient, e as KitClientConfig } from './index-BotXLTck.js';
+import { d as defineCrud, s as setAllModulesLocale } from './kit-i18n-CgpNTh9G.js';
+export { A as ApiResponse, a as AuthOperations, b as AuthOperationsProvider, C as CorsConfig, F as FormError, c as FormValidationResult, G as GuardConfig, d as GuardResult, H as HaiRequestEvent, e as HandleA2AConfig, f as HandleA2AOperations, g as HandleAuthConfig, h as HandleConfig, i as HookCryptoConfig, M as Middleware, j as MiddlewareContext, R as RateLimitConfig, k as RouteGuard, S as SessionData, l as SessionLike, T as TransportEncryptionOptions } from './kit-types-BHlDNNpd.js';
+import '@h-ai/core';
+import '@h-ai/iam';
+import '@sveltejs/kit';
+import './kit-crypto-types-C-gEvx04.js';
+
+/**
+ * @h-ai/kit — 浏览器入口
+ *
+ * 为客户端提供精简且安全的运行时导出，避免将服务端 Hook/A2A/IAM 运行时代码打入浏览器包。
+ * @module browser
+ */
+
+/**
+ * 浏览器端 kit 对象（仅暴露 client-safe 能力）
+ */
+declare const kit: {
+    client: {
+        create: typeof createKitClient;
+    };
+    crud: {
+        define: typeof defineCrud;
+    };
+    auth: {
+        setBrowserToken: typeof setBrowserToken;
+        clearBrowserToken: typeof clearBrowserToken;
+        createTokenStore: typeof createTokenStore;
+        createHandleFetch: typeof createHandleFetch;
+    };
+    i18n: {
+        setLocale: typeof setAllModulesLocale;
+    };
+};
+
+export { createKitClient, kit };

package/dist/browser.js

@@ -0,0 +1,26 @@
+import { defineCrud } from './chunk-FRYJMRTP.js';
+import { createHandleFetch, createTokenStore, clearBrowserToken, setBrowserToken, createKitClient } from './chunk-PHS7ZD5L.js';
+import { setAllModulesLocale } from './chunk-6TMSXG7J.js';
+
+// src/browser.ts
+var kit = {
+  client: {
+    create: createKitClient
+  },
+  crud: {
+    define: defineCrud
+  },
+  auth: {
+    setBrowserToken,
+    clearBrowserToken,
+    createTokenStore,
+    createHandleFetch
+  },
+  i18n: {
+    setLocale: setAllModulesLocale
+  }
+};
+
+export { kit };
+//# sourceMappingURL=browser.js.map
+//# sourceMappingURL=browser.js.map

package/dist/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/browser.ts"],"names":[],"mappings":";;;;;AAeO,IAAM,GAAA,GAAM;AAAA,EACjB,MAAA,EAAQ;AAAA,IACN,MAAA,EAAQ;AAAA,GACV;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,MAAA,EAAQ;AAAA,GACV;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,eAAA;AAAA,IACA,iBAAA;AAAA,IACA,gBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,SAAA,EAAW;AAAA;AAEf","file":"browser.js","sourcesContent":["/**\n * @h-ai/kit — 浏览器入口\n *\n * 为客户端提供精简且安全的运行时导出，避免将服务端 Hook/A2A/IAM 运行时代码打入浏览器包。\n * @module browser\n */\n\nimport { createKitClient } from './client/kit-client.js'\nimport { defineCrud } from './crud/kit-crud.js'\nimport { clearBrowserToken, createHandleFetch, createTokenStore, setBrowserToken } from './kit-auth.js'\nimport { setAllModulesLocale } from './kit-i18n.js'\n\n/**\n * 浏览器端 kit 对象（仅暴露 client-safe 能力）\n */\nexport const kit = {\n  client: {\n    create: createKitClient,\n  },\n  crud: {\n    define: defineCrud,\n  },\n  auth: {\n    setBrowserToken,\n    clearBrowserToken,\n    createTokenStore,\n    createHandleFetch,\n  },\n  i18n: {\n    setLocale: setAllModulesLocale,\n  },\n}\n\nexport type * from './client/index.js'\nexport type * from './kit-types.js'\n"]}

package/dist/chunk-475WECWK.js

@@ -0,0 +1,110 @@
+import { iam } from '@h-ai/iam';
+
+// src/modules/a2a/kit-a2a-auth.ts
+function createA2AApiKeyAuthenticator(config) {
+  return async (event) => {
+    const rawKey = config.in === "header" ? event.request.headers.get(config.name) : event.url.searchParams.get(config.name);
+    if (!rawKey)
+      return null;
+    const result = await iam.apiKey.verifyApiKey(rawKey);
+    if (!result.success)
+      return null;
+    return {
+      agentId: result.data.userId,
+      apiKeyId: result.data.id,
+      scopes: result.data.scopes
+    };
+  };
+}
+
+// src/modules/a2a/kit-a2a-handle.ts
+function resolveA2AConfig(input) {
+  if (!input)
+    return null;
+  if ("getAgentCard" in input && "handleRequest" in input) {
+    return {
+      operations: input,
+      cardPath: "/.well-known/agent.json",
+      rpcPath: "/a2a"
+    };
+  }
+  const cfg = input;
+  return {
+    operations: cfg.operations,
+    cardPath: cfg.cardPath ?? "/.well-known/agent.json",
+    rpcPath: cfg.rpcPath ?? "/a2a",
+    authenticate: resolveAuthenticate(cfg.authenticate, cfg.operations)
+  };
+}
+function resolveAuthenticate(authenticate, operations) {
+  if (!authenticate)
+    return void 0;
+  if (typeof authenticate === "function")
+    return authenticate;
+  const cardResult = operations.getAgentCard();
+  const security = cardResult.success && cardResult.data ? cardResult.data.security : void 0;
+  const apiKeyCfg = security?.apiKey;
+  return createA2AApiKeyAuthenticator({
+    in: apiKeyCfg?.in ?? "header",
+    name: apiKeyCfg?.name ?? "x-api-key"
+  });
+}
+async function handleA2ARequest(event, requestId, config) {
+  const { pathname } = event.url;
+  if (pathname === config.cardPath && event.request.method === "GET") {
+    const result = config.operations.getAgentCard();
+    if (result.success) {
+      return new Response(JSON.stringify(result.data), {
+        headers: { "Content-Type": "application/json", "X-Request-Id": requestId }
+      });
+    }
+    return new Response(
+      JSON.stringify({ error: { code: "A2A_NOT_CONFIGURED", message: "Agent card not available" } }),
+      { status: 503, headers: { "Content-Type": "application/json", "X-Request-Id": requestId } }
+    );
+  }
+  if (pathname === config.rpcPath && event.request.method === "POST") {
+    let context;
+    if (config.authenticate) {
+      const authResult = await config.authenticate(event);
+      if (authResult) {
+        context = authResult;
+      }
+    }
+    const body = await event.request.json();
+    const result = await config.operations.handleRequest(body, context);
+    if (result.streaming && result.stream) {
+      const stream = result.stream;
+      const readable = new ReadableStream({
+        async start(controller) {
+          const encoder = new TextEncoder();
+          try {
+            for await (const chunk of stream) {
+              controller.enqueue(encoder.encode(`data: ${JSON.stringify(chunk)}
+
+`));
+            }
+          } finally {
+            controller.close();
+          }
+        }
+      });
+      return new Response(readable, {
+        headers: {
+          "Content-Type": "text/event-stream",
+          "Cache-Control": "no-cache",
+          "Connection": "keep-alive",
+          "X-Request-Id": requestId
+        }
+      });
+    }
+    return new Response(JSON.stringify(result.body), {
+      headers: { "Content-Type": "application/json", "X-Request-Id": requestId }
+    });
+  }
+  return null;
+}
+
+export { createA2AApiKeyAuthenticator, handleA2ARequest, resolveA2AConfig };
+//# sourceMappingURL=chunk-475WECWK.js.map
+//# sourceMappingURL=chunk-475WECWK.js.map

package/dist/chunk-475WECWK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/modules/a2a/kit-a2a-auth.ts","../src/modules/a2a/kit-a2a-handle.ts"],"names":[],"mappings":";;;AA+BO,SAAS,6BACd,MAAA,EACkE;AAClE,EAAA,OAAO,OAAO,KAAA,KAAwB;AACpC,IAAA,MAAM,SAAS,MAAA,CAAO,EAAA,KAAO,QAAA,GACzB,KAAA,CAAM,QAAQ,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,IAAI,IACrC,KAAA,CAAM,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAO,IAAI,CAAA;AAE1C,IAAA,IAAI,CAAC,MAAA;AACH,MAAA,OAAO,IAAA;AAET,IAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,MAAA,CAAO,aAAa,MAAM,CAAA;AACnD,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA;AACV,MAAA,OAAO,IAAA;AAET,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,OAAO,IAAA,CAAK,MAAA;AAAA,MACrB,QAAA,EAAU,OAAO,IAAA,CAAK,EAAA;AAAA,MACtB,MAAA,EAAQ,OAAO,IAAA,CAAK;AAAA,KACtB;AAAA,EACF,CAAA;AACF;;;ACnBO,SAAS,iBACd,KAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,KAAA;AACH,IAAA,OAAO,IAAA;AAGT,EAAA,IAAI,cAAA,IAAkB,KAAA,IAAS,eAAA,IAAmB,KAAA,EAAO;AACvD,IAAA,OAAO;AAAA,MACL,UAAA,EAAY,KAAA;AAAA,MACZ,QAAA,EAAU,yBAAA;AAAA,MACV,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAGA,EAAA,MAAM,GAAA,GAAM,KAAA;AACZ,EAAA,OAAO;AAAA,IACL,YAAY,GAAA,CAAI,UAAA;AAAA,IAChB,QAAA,EAAU,IAAI,QAAA,IAAY,yBAAA;AAAA,IAC1B,OAAA,EAAS,IAAI,OAAA,IAAW,MAAA;AAAA,IACxB,YAAA,EAAc,mBAAA,CAAoB,GAAA,CAAI,YAAA,EAAc,IAAI,UAAU;AAAA,GACpE;AACF;AASA,SAAS,mBAAA,CACP,cACA,UAAA,EACmC;AACnC,EAAA,IAAI,CAAC,YAAA;AACH,IAAA,OAAO,MAAA;AAET,EAAA,IAAI,OAAO,YAAA,KAAiB,UAAA;AAC1B,IAAA,OAAO,YAAA;AAGT,EAAA,MAAM,UAAA,GAAa,WAAW,YAAA,EAAa;AAC3C,EAAA,MAAM,WAAW,UAAA,CAAW,OAAA,IAAW,WAAW,IAAA,GAC7C,UAAA,CAAW,KAAiC,QAAA,GAC7C,MAAA;AACJ,EAAA,MAAM,YAAY,QAAA,EAAU,MAAA;AAE5B,EAAA,OAAO,4BAAA,CAA6B;AAAA,IAClC,EAAA,EAAI,WAAW,EAAA,IAAM,QAAA;AAAA,IACrB,IAAA,EAAM,WAAW,IAAA,IAAQ;AAAA,GAC1B,CAAA;AACH;AAeA,eAAsB,gBAAA,CACpB,KAAA,EACA,SAAA,EACA,MAAA,EAC0B;AAC1B,EAAA,MAAM,EAAE,QAAA,EAAS,GAAI,KAAA,CAAM,GAAA;AAG3B,EAAA,IAAI,aAAa,MAAA,CAAO,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,WAAW,KAAA,EAAO;AAClE,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,UAAA,CAAW,YAAA,EAAa;AAC9C,IAAA,IAAI,OAAO,OAAA,EAAS;AAClB,MAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,IAAI,CAAA,EAAG;AAAA,QAC/C,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,gBAAgB,SAAA;AAAU,OAC1E,CAAA;AAAA,IACH;AACA,IAAA,OAAO,IAAI,QAAA;AAAA,MACT,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,EAAE,MAAM,oBAAA,EAAsB,OAAA,EAAS,0BAAA,EAA2B,EAAG,CAAA;AAAA,MAC7F,EAAE,QAAQ,GAAA,EAAK,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,cAAA,EAAgB,SAAA,EAAU;AAAE,KAC5F;AAAA,EACF;AAGA,EAAA,IAAI,aAAa,MAAA,CAAO,OAAA,IAAW,KAAA,CAAM,OAAA,CAAQ,WAAW,MAAA,EAAQ;AAElE,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI,OAAO,YAAA,EAAc;AACvB,MAAA,MAAM,UAAA,GAAa,MAAM,MAAA,CAAO,YAAA,CAAa,KAAK,CAAA;AAClD,MAAA,IAAI,UAAA,EAAY;AACd,QAAA,OAAA,GAAU,UAAA;AAAA,MACZ;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAK;AACtC,IAAA,MAAM,SAAS,MAAM,MAAA,CAAO,UAAA,CAAW,aAAA,CAAc,MAAM,OAAO,CAAA;AAElE,IAAA,IAAI,MAAA,CAAO,SAAA,IAAa,MAAA,CAAO,MAAA,EAAQ;AACrC,MAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AACtB,MAAA,MAAM,QAAA,GAAW,IAAI,cAAA,CAAe;AAAA,QAClC,MAAM,MAAM,UAAA,EAAY;AACtB,UAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,UAAA,IAAI;AACF,YAAA,WAAA,MAAiB,SAAS,MAAA,EAAQ;AAChC,cAAA,UAAA,CAAW,QAAQ,OAAA,CAAQ,MAAA,CAAO,SAAS,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC;;AAAA,CAAM,CAAC,CAAA;AAAA,YACzE;AAAA,UACF,CAAA,SACA;AACE,YAAA,UAAA,CAAW,KAAA,EAAM;AAAA,UACnB;AAAA,QACF;AAAA,OACD,CAAA;AACD,MAAA,OAAO,IAAI,SAAS,QAAA,EAAU;AAAA,QAC5B,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,mBAAA;AAAA,UAChB,eAAA,EAAiB,UAAA;AAAA,UACjB,YAAA,EAAc,YAAA;AAAA,UACd,cAAA,EAAgB;AAAA;AAClB,OACD,CAAA;AAAA,IACH;AAEA,IAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,IAAI,CAAA,EAAG;AAAA,MAC/C,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,gBAAgB,SAAA;AAAU,KAC1E,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,IAAA;AACT","file":"chunk-475WECWK.js","sourcesContent":["/**\n * @h-ai/kit — A2A API Key 认证器\n *\n * 从请求头或 query 参数中提取 API Key，调用 IAM apiKey.verifyApiKey 验证。\n * @module kit-a2a-auth\n */\n\nimport type { RequestEvent } from '@sveltejs/kit'\nimport { iam } from '@h-ai/iam'\n\n/** A2A API Key 认证器配置 */\nexport interface A2AApiKeyAuthConfig {\n  /** API Key 的传递位置 */\n  in: 'header' | 'query'\n  /** 参数名 */\n  name: string\n}\n\n/**\n * 创建 A2A API Key 认证函数\n *\n * 根据配置从请求头或 query 参数中提取 API Key，\n * 通过 `iam.apiKey.verifyApiKey()` 验证后返回调用方上下文。\n *\n * - 无 API Key → 返回 `null`（匿名请求）\n * - 验证失败 → 返回 `null`（拒绝）\n * - 验证成功 → 返回 `{ agentId, apiKeyId, scopes }`\n *\n * @param config - API Key 提取配置\n * @returns authenticate 函数，可直接赋给 HandleA2AConfig.authenticate\n */\nexport function createA2AApiKeyAuthenticator(\n  config: A2AApiKeyAuthConfig,\n): (event: RequestEvent) => Promise<Record<string, unknown> | null> {\n  return async (event: RequestEvent) => {\n    const rawKey = config.in === 'header'\n      ? event.request.headers.get(config.name)\n      : event.url.searchParams.get(config.name)\n\n    if (!rawKey)\n      return null\n\n    const result = await iam.apiKey.verifyApiKey(rawKey)\n    if (!result.success)\n      return null\n\n    return {\n      agentId: result.data.userId,\n      apiKeyId: result.data.id,\n      scopes: result.data.scopes,\n    }\n  }\n}\n","/**\n * @h-ai/kit — A2A Handle 拦截器\n *\n * 在 SvelteKit Handle Hook 中拦截 A2A 端点（Agent Card 发现 + JSON-RPC 处理），\n * 自动处理请求并返回 Response，不匹配时返回 null 由 Handle 继续后续流程。\n * @module kit-a2a-handle\n */\n\nimport type { RequestEvent } from '@sveltejs/kit'\nimport type { HandleA2AConfig, HandleA2AOperations, HandleConfig } from '../../kit-types.js'\nimport { createA2AApiKeyAuthenticator } from './kit-a2a-auth.js'\n\n// ─── 解析后的 A2A 内部配置 ───\n\n/** A2A 解析后的内部配置 */\nexport interface ResolvedA2AConfig {\n  operations: HandleA2AOperations\n  cardPath: string\n  rpcPath: string\n  authenticate?: (event: RequestEvent) => Promise<Record<string, unknown> | null | undefined>\n}\n\n// ─── A2A 配置解析 ───\n\n/**\n * 解析 A2A 配置（简单模式 / 配置模式）\n *\n * - 简单模式：直接传入 `ai.a2a` 操作对象，使用默认路径\n * - 配置模式：传入 `{ operations, rpcPath?, cardPath?, authenticate? }`\n *\n * @param input - HandleConfig.a2a 配置\n * @returns 解析后的配置，或 `null` 表示未配置\n */\nexport function resolveA2AConfig(\n  input: HandleConfig['a2a'],\n): ResolvedA2AConfig | null {\n  if (!input)\n    return null\n\n  // 简单模式：直接传入操作对象\n  if ('getAgentCard' in input && 'handleRequest' in input) {\n    return {\n      operations: input as HandleA2AOperations,\n      cardPath: '/.well-known/agent.json',\n      rpcPath: '/a2a',\n    }\n  }\n\n  // 配置模式：带 operations 字段\n  const cfg = input as HandleA2AConfig\n  return {\n    operations: cfg.operations,\n    cardPath: cfg.cardPath ?? '/.well-known/agent.json',\n    rpcPath: cfg.rpcPath ?? '/a2a',\n    authenticate: resolveAuthenticate(cfg.authenticate, cfg.operations),\n  }\n}\n\n/**\n * 解析 authenticate 配置\n *\n * - `undefined` → 无认证\n * - `'apiKey'` → 从 Agent Card security 配置创建 API Key 认证器\n * - 函数 → 直接使用\n */\nfunction resolveAuthenticate(\n  authenticate: HandleA2AConfig['authenticate'],\n  operations: HandleA2AOperations,\n): ResolvedA2AConfig['authenticate'] {\n  if (!authenticate)\n    return undefined\n\n  if (typeof authenticate === 'function')\n    return authenticate\n\n  // 'apiKey' 快捷方式：从 Agent Card 获取 security 配置\n  const cardResult = operations.getAgentCard()\n  const security = cardResult.success && cardResult.data\n    ? (cardResult.data as Record<string, unknown>).security as { apiKey?: { in: 'header' | 'query', name: string } } | undefined\n    : undefined\n  const apiKeyCfg = security?.apiKey\n\n  return createA2AApiKeyAuthenticator({\n    in: apiKeyCfg?.in ?? 'header',\n    name: apiKeyCfg?.name ?? 'x-api-key',\n  })\n}\n\n// ─── A2A 请求处理 ───\n\n/**\n * 处理 A2A 端点请求\n *\n * 匹配 Agent Card GET 和 JSON-RPC POST 端点，返回 Response。\n * 不匹配时返回 `null`，由 Handle 继续后续流程。\n *\n * @param event - SvelteKit RequestEvent\n * @param requestId - 当前请求 ID（用于响应头）\n * @param config - 解析后的 A2A 配置\n * @returns 匹配时返回 Response，不匹配返回 null\n */\nexport async function handleA2ARequest(\n  event: RequestEvent,\n  requestId: string,\n  config: ResolvedA2AConfig,\n): Promise<Response | null> {\n  const { pathname } = event.url\n\n  // Agent Card 发现端点\n  if (pathname === config.cardPath && event.request.method === 'GET') {\n    const result = config.operations.getAgentCard()\n    if (result.success) {\n      return new Response(JSON.stringify(result.data), {\n        headers: { 'Content-Type': 'application/json', 'X-Request-Id': requestId },\n      })\n    }\n    return new Response(\n      JSON.stringify({ error: { code: 'A2A_NOT_CONFIGURED', message: 'Agent card not available' } }),\n      { status: 503, headers: { 'Content-Type': 'application/json', 'X-Request-Id': requestId } },\n    )\n  }\n\n  // A2A JSON-RPC 端点\n  if (pathname === config.rpcPath && event.request.method === 'POST') {\n    // 可选认证\n    let context: Record<string, unknown> | undefined\n    if (config.authenticate) {\n      const authResult = await config.authenticate(event)\n      if (authResult) {\n        context = authResult\n      }\n    }\n\n    const body = await event.request.json()\n    const result = await config.operations.handleRequest(body, context)\n\n    if (result.streaming && result.stream) {\n      const stream = result.stream\n      const readable = new ReadableStream({\n        async start(controller) {\n          const encoder = new TextEncoder()\n          try {\n            for await (const chunk of stream) {\n              controller.enqueue(encoder.encode(`data: ${JSON.stringify(chunk)}\\n\\n`))\n            }\n          }\n          finally {\n            controller.close()\n          }\n        },\n      })\n      return new Response(readable, {\n        headers: {\n          'Content-Type': 'text/event-stream',\n          'Cache-Control': 'no-cache',\n          'Connection': 'keep-alive',\n          'X-Request-Id': requestId,\n        },\n      })\n    }\n\n    return new Response(JSON.stringify(result.body), {\n      headers: { 'Content-Type': 'application/json', 'X-Request-Id': requestId },\n    })\n  }\n\n  return null\n}\n"]}