@h-ai/kit 0.1.0-alpha5

package/dist/chunk-6TMSXG7J.js

@@ -0,0 +1,169 @@
+import { core, err, ok } from '@h-ai/core';
+
+// src/kit-i18n.ts
+
+// messages/en-US.json
+var en_US_default = {
+  $schema: "https://inlang.com/schema/inlang-message-format",
+  kit_unauthorized: "Unauthorized",
+  kit_forbidden: "Forbidden: missing {permission} permission",
+  kit_csrfTokenFailed: "Failed to generate CSRF token",
+  kit_csrfVerifyFailed: "CSRF token verification failed",
+  kit_csrfValidationFailed: "Invalid CSRF token",
+  kit_rateLimitExceeded: "Too many requests, please try again later",
+  kit_unsupportedContentType: "Unsupported content type",
+  kit_parseBodyFailed: "Failed to parse request body",
+  kit_encryptFailed: "Encryption failed",
+  kit_transportKeyGenerationFailed: "Transport encryption key generation failed",
+  kit_transportClientKeyNotFound: "Client key not found",
+  kit_transportEncryptFailed: "Transport encryption failed",
+  kit_transportEncryptKeyFailed: "Symmetric key encryption failed",
+  kit_transportDecryptKeyFailed: "Symmetric key decryption failed",
+  kit_transportDecryptFailed: "Transport decryption failed",
+  kit_transportInvalidPayload: "Invalid encrypted payload",
+  kit_transportKeyExchangeFailed: "Key exchange failed",
+  kit_transportClientIdRequired: "Missing X-Client-Id header, key exchange is required for transport encryption",
+  kit_signFailed: "Request signing failed",
+  kit_authRequired: "Authentication required",
+  kit_accessDenied: "Access denied",
+  kit_resourceNotFound: "Resource not found",
+  kit_internalError: "Internal server error",
+  kit_validationFailed: "Validation failed",
+  kit_noGuardsPassed: "No guards passed",
+  kit_requiredRoles: "Required roles: {roles}",
+  kit_requiredPermissions: "Required permissions: {permissions}",
+  kit_idRequired: "ID is required"
+};
+
+// messages/zh-CN.json
+var zh_CN_default = {
+  $schema: "https://inlang.com/schema/inlang-message-format",
+  kit_unauthorized: "\u672A\u6388\u6743",
+  kit_forbidden: "\u6743\u9650\u4E0D\u8DB3\uFF1A\u7F3A\u5C11 {permission} \u6743\u9650",
+  kit_csrfTokenFailed: "\u751F\u6210 CSRF Token \u5931\u8D25",
+  kit_csrfVerifyFailed: "CSRF Token \u9A8C\u8BC1\u5931\u8D25",
+  kit_csrfValidationFailed: "CSRF Token \u65E0\u6548",
+  kit_rateLimitExceeded: "\u8BF7\u6C42\u8FC7\u4E8E\u9891\u7E41\uFF0C\u8BF7\u7A0D\u540E\u518D\u8BD5",
+  kit_unsupportedContentType: "\u4E0D\u652F\u6301\u7684\u5185\u5BB9\u7C7B\u578B",
+  kit_parseBodyFailed: "\u8BF7\u6C42\u4F53\u89E3\u6790\u5931\u8D25",
+  kit_encryptFailed: "\u52A0\u5BC6\u5931\u8D25",
+  kit_transportKeyGenerationFailed: "\u4F20\u8F93\u52A0\u5BC6\u5BC6\u94A5\u5BF9\u751F\u6210\u5931\u8D25",
+  kit_transportClientKeyNotFound: "\u5BA2\u6237\u7AEF\u5BC6\u94A5\u672A\u627E\u5230",
+  kit_transportEncryptFailed: "\u4F20\u8F93\u52A0\u5BC6\u5931\u8D25",
+  kit_transportEncryptKeyFailed: "\u5BF9\u79F0\u5BC6\u94A5\u52A0\u5BC6\u5931\u8D25",
+  kit_transportDecryptKeyFailed: "\u5BF9\u79F0\u5BC6\u94A5\u89E3\u5BC6\u5931\u8D25",
+  kit_transportDecryptFailed: "\u4F20\u8F93\u89E3\u5BC6\u5931\u8D25",
+  kit_transportInvalidPayload: "\u65E0\u6548\u7684\u52A0\u5BC6\u8F7D\u8377",
+  kit_transportKeyExchangeFailed: "\u5BC6\u94A5\u4EA4\u6362\u5931\u8D25",
+  kit_transportClientIdRequired: "\u7F3A\u5C11 X-Client-Id \u8BF7\u6C42\u5934\uFF0C\u4F20\u8F93\u52A0\u5BC6\u5FC5\u987B\u5148\u5B8C\u6210\u5BC6\u94A5\u4EA4\u6362",
+  kit_signFailed: "\u8BF7\u6C42\u7B7E\u540D\u5931\u8D25",
+  kit_authRequired: "\u9700\u8981\u8EAB\u4EFD\u8BA4\u8BC1",
+  kit_accessDenied: "\u62D2\u7EDD\u8BBF\u95EE",
+  kit_resourceNotFound: "\u8D44\u6E90\u672A\u627E\u5230",
+  kit_internalError: "\u5185\u90E8\u670D\u52A1\u5668\u9519\u8BEF",
+  kit_validationFailed: "\u6570\u636E\u9A8C\u8BC1\u5931\u8D25",
+  kit_noGuardsPassed: "\u6CA1\u6709\u5B88\u536B\u901A\u8FC7",
+  kit_requiredRoles: "\u9700\u8981\u89D2\u8272\uFF1A{roles}",
+  kit_requiredPermissions: "\u9700\u8981\u6743\u9650\uFF1A{permissions}",
+  kit_idRequired: "ID \u4E0D\u80FD\u4E3A\u7A7A"
+};
+
+// src/kit-i18n.ts
+var kitM = core.i18n.createMessageGetter({ "zh-CN": zh_CN_default, "en-US": en_US_default });
+function setAllModulesLocale(locale) {
+  core.i18n.setGlobalLocale(locale);
+}
+function createTransportEncryption(cryptoService, maxClients = 1e4) {
+  const keyPairResult = cryptoService.asymmetric.generateKeyPair();
+  if (!keyPairResult.success || !keyPairResult.data) {
+    return err({ code: "KIT_TRANSPORT_KEY_GENERATION_FAILED", message: kitM("kit_transportKeyGenerationFailed") });
+  }
+  const serverKeyPair = keyPairResult.data;
+  const clientKeys = /* @__PURE__ */ new Map();
+  let clientIdCounter = 0;
+  return ok({
+    getServerPublicKey() {
+      return serverKeyPair.publicKey;
+    },
+    registerClientKey(clientPublicKey) {
+      clientIdCounter++;
+      const clientId = `client_${clientIdCounter}_${Date.now()}`;
+      if (clientKeys.size >= maxClients) {
+        const oldestKey = clientKeys.keys().next().value;
+        if (oldestKey !== void 0) {
+          clientKeys.delete(oldestKey);
+        }
+      }
+      clientKeys.set(clientId, clientPublicKey);
+      return clientId;
+    },
+    getClientPublicKey(clientId) {
+      return clientKeys.get(clientId);
+    },
+    encryptResponse(clientId, data) {
+      const clientPublicKey = clientKeys.get(clientId);
+      if (!clientPublicKey) {
+        throw new Error(kitM("kit_transportClientKeyNotFound"));
+      }
+      const symmetricKey = cryptoService.symmetric.generateKey();
+      const encResult = cryptoService.symmetric.encryptWithIV(data, symmetricKey);
+      if (!encResult.success || !encResult.data) {
+        throw new Error(kitM("kit_transportEncryptFailed"));
+      }
+      const keyEncResult = cryptoService.asymmetric.encrypt(symmetricKey, clientPublicKey);
+      if (!keyEncResult.success || !keyEncResult.data) {
+        throw new Error(kitM("kit_transportEncryptKeyFailed"));
+      }
+      return {
+        encryptedKey: keyEncResult.data,
+        ciphertext: encResult.data.ciphertext,
+        iv: encResult.data.iv
+      };
+    },
+    decryptRequest(payload) {
+      const keyDecResult = cryptoService.asymmetric.decrypt(payload.encryptedKey, serverKeyPair.privateKey);
+      if (!keyDecResult.success || !keyDecResult.data) {
+        throw new Error(kitM("kit_transportDecryptKeyFailed"));
+      }
+      const decResult = cryptoService.symmetric.decryptWithIV(payload.ciphertext, keyDecResult.data, payload.iv);
+      if (!decResult.success || typeof decResult.data !== "string") {
+        throw new Error(kitM("kit_transportDecryptFailed"));
+      }
+      return decResult.data;
+    }
+  });
+}
+function createKeyExchangeHandler(manager) {
+  return async (request) => {
+    try {
+      const body = await request.json();
+      if (!body.clientPublicKey || typeof body.clientPublicKey !== "string") {
+        return new Response(
+          JSON.stringify({ error: kitM("kit_transportInvalidPayload") }),
+          { status: 400, headers: { "Content-Type": "application/json" } }
+        );
+      }
+      const clientId = manager.registerClientKey(body.clientPublicKey);
+      const serverPublicKey = manager.getServerPublicKey();
+      return new Response(
+        JSON.stringify({ serverPublicKey, clientId }),
+        { status: 200, headers: { "Content-Type": "application/json" } }
+      );
+    } catch {
+      return new Response(
+        JSON.stringify({ error: kitM("kit_transportKeyExchangeFailed") }),
+        { status: 500, headers: { "Content-Type": "application/json" } }
+      );
+    }
+  };
+}
+function isValidEncryptedPayload(payload) {
+  if (typeof payload !== "object" || payload === null)
+    return false;
+  const p = payload;
+  return typeof p.encryptedKey === "string" && typeof p.ciphertext === "string" && typeof p.iv === "string" && p.encryptedKey.length > 0 && p.ciphertext.length > 0 && p.iv.length > 0;
+}
+
+export { createKeyExchangeHandler, createTransportEncryption, isValidEncryptedPayload, kitM, setAllModulesLocale };
+//# sourceMappingURL=chunk-6TMSXG7J.js.map
+//# sourceMappingURL=chunk-6TMSXG7J.js.map

package/dist/chunk-6TMSXG7J.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../messages/en-US.json","../messages/zh-CN.json","../src/kit-i18n.ts","../src/modules/crypto/kit-transport-encryption.ts"],"names":[],"mappings":";;;;;AAAA,IAAA,aAAA,GAAA;AAAA,EACE,OAAA,EAAW,iDAAA;AAAA,EACX,gBAAA,EAAoB,cAAA;AAAA,EACpB,aAAA,EAAiB,4CAAA;AAAA,EACjB,mBAAA,EAAuB,+BAAA;AAAA,EACvB,oBAAA,EAAwB,gCAAA;AAAA,EACxB,wBAAA,EAA4B,oBAAA;AAAA,EAC5B,qBAAA,EAAyB,2CAAA;AAAA,EACzB,0BAAA,EAA8B,0BAAA;AAAA,EAC9B,mBAAA,EAAuB,8BAAA;AAAA,EACvB,iBAAA,EAAqB,mBAAA;AAAA,EACrB,gCAAA,EAAoC,4CAAA;AAAA,EACpC,8BAAA,EAAkC,sBAAA;AAAA,EAClC,0BAAA,EAA8B,6BAAA;AAAA,EAC9B,6BAAA,EAAiC,iCAAA;AAAA,EACjC,6BAAA,EAAiC,iCAAA;AAAA,EACjC,0BAAA,EAA8B,6BAAA;AAAA,EAC9B,2BAAA,EAA+B,2BAAA;AAAA,EAC/B,8BAAA,EAAkC,qBAAA;AAAA,EAClC,6BAAA,EAAiC,+EAAA;AAAA,EACjC,cAAA,EAAkB,wBAAA;AAAA,EAClB,gBAAA,EAAoB,yBAAA;AAAA,EACpB,gBAAA,EAAoB,eAAA;AAAA,EACpB,oBAAA,EAAwB,oBAAA;AAAA,EACxB,iBAAA,EAAqB,uBAAA;AAAA,EACrB,oBAAA,EAAwB,mBAAA;AAAA,EACxB,kBAAA,EAAsB,kBAAA;AAAA,EACtB,iBAAA,EAAqB,yBAAA;AAAA,EACrB,uBAAA,EAA2B,qCAAA;AAAA,EAC3B,cAAA,EAAkB;AACpB,CAAA;;;AC9BA,IAAA,aAAA,GAAA;AAAA,EACE,OAAA,EAAW,iDAAA;AAAA,EACX,gBAAA,EAAoB,oBAAA;AAAA,EACpB,aAAA,EAAiB,sEAAA;AAAA,EACjB,mBAAA,EAAuB,sCAAA;AAAA,EACvB,oBAAA,EAAwB,qCAAA;AAAA,EACxB,wBAAA,EAA4B,yBAAA;AAAA,EAC5B,qBAAA,EAAyB,0EAAA;AAAA,EACzB,0BAAA,EAA8B,kDAAA;AAAA,EAC9B,mBAAA,EAAuB,4CAAA;AAAA,EACvB,iBAAA,EAAqB,0BAAA;AAAA,EACrB,gCAAA,EAAoC,oEAAA;AAAA,EACpC,8BAAA,EAAkC,kDAAA;AAAA,EAClC,0BAAA,EAA8B,sCAAA;AAAA,EAC9B,6BAAA,EAAiC,kDAAA;AAAA,EACjC,6BAAA,EAAiC,kDAAA;AAAA,EACjC,0BAAA,EAA8B,sCAAA;AAAA,EAC9B,2BAAA,EAA+B,4CAAA;AAAA,EAC/B,8BAAA,EAAkC,sCAAA;AAAA,EAClC,6BAAA,EAAiC,iIAAA;AAAA,EACjC,cAAA,EAAkB,sCAAA;AAAA,EAClB,gBAAA,EAAoB,sCAAA;AAAA,EACpB,gBAAA,EAAoB,0BAAA;AAAA,EACpB,oBAAA,EAAwB,gCAAA;AAAA,EACxB,iBAAA,EAAqB,4CAAA;AAAA,EACrB,oBAAA,EAAwB,sCAAA;AAAA,EACxB,kBAAA,EAAsB,sCAAA;AAAA,EACtB,iBAAA,EAAqB,uCAAA;AAAA,EACrB,uBAAA,EAA2B,6CAAA;AAAA,EAC3B,cAAA,EAAkB;AACpB,CAAA;;;AChBO,IAAM,IAAA,GACT,KAAK,IAAA,CAAK,mBAAA,CAAmC,EAAE,OAAA,EAAS,aAAA,EAAc,OAAA,EAAS,aAAA,EAAc;AAiB1F,SAAS,oBAAoB,MAAA,EAAsB;AACxD,EAAA,IAAA,CAAK,IAAA,CAAK,gBAAgB,MAAM,CAAA;AAClC;ACHO,SAAS,yBAAA,CACd,aAAA,EACA,UAAA,GAAa,GAAA,EAC0B;AAEvC,EAAA,MAAM,aAAA,GAAgB,aAAA,CAAc,UAAA,CAAW,eAAA,EAAgB;AAC/D,EAAA,IAAI,CAAC,aAAA,CAAc,OAAA,IAAW,CAAC,cAAc,IAAA,EAAM;AACjD,IAAA,OAAO,GAAA,CAAI,EAAE,IAAA,EAAM,qCAAA,EAAuC,SAAS,IAAA,CAAK,kCAAkC,GAAG,CAAA;AAAA,EAC/G;AACA,EAAA,MAAM,gBAAkC,aAAA,CAAc,IAAA;AAGtD,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAoB;AAC3C,EAAA,IAAI,eAAA,GAAkB,CAAA;AAEtB,EAAA,OAAO,EAAA,CAAG;AAAA,IACR,kBAAA,GAA6B;AAC3B,MAAA,OAAO,aAAA,CAAc,SAAA;AAAA,IACvB,CAAA;AAAA,IAEA,kBAAkB,eAAA,EAAiC;AACjD,MAAA,eAAA,EAAA;AACA,MAAA,MAAM,WAAW,CAAA,OAAA,EAAU,eAAe,CAAA,CAAA,EAAI,IAAA,CAAK,KAAK,CAAA,CAAA;AAGxD,MAAA,IAAI,UAAA,CAAW,QAAQ,UAAA,EAAY;AACjC,QAAA,MAAM,SAAA,GAAY,UAAA,CAAW,IAAA,EAAK,CAAE,MAAK,CAAE,KAAA;AAC3C,QAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,UAAA,UAAA,CAAW,OAAO,SAAS,CAAA;AAAA,QAC7B;AAAA,MACF;AAEA,MAAA,UAAA,CAAW,GAAA,CAAI,UAAU,eAAe,CAAA;AACxC,MAAA,OAAO,QAAA;AAAA,IACT,CAAA;AAAA,IAEA,mBAAmB,QAAA,EAAsC;AACvD,MAAA,OAAO,UAAA,CAAW,IAAI,QAAQ,CAAA;AAAA,IAChC,CAAA;AAAA,IAEA,eAAA,CAAgB,UAAkB,IAAA,EAAgC;AAChE,MAAA,MAAM,eAAA,GAAkB,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA;AAC/C,MAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,QAAA,MAAM,IAAI,KAAA,CAAM,IAAA,CAAK,gCAAgC,CAAC,CAAA;AAAA,MACxD;AAGA,MAAA,MAAM,YAAA,GAAe,aAAA,CAAc,SAAA,CAAU,WAAA,EAAY;AAGzD,MAAA,MAAM,SAAA,GAAY,aAAA,CAAc,SAAA,CAAU,aAAA,CAAc,MAAM,YAAY,CAAA;AAC1E,MAAA,IAAI,CAAC,SAAA,CAAU,OAAA,IAAW,CAAC,UAAU,IAAA,EAAM;AACzC,QAAA,MAAM,IAAI,KAAA,CAAM,IAAA,CAAK,4BAA4B,CAAC,CAAA;AAAA,MACpD;AAGA,MAAA,MAAM,YAAA,GAAe,aAAA,CAAc,UAAA,CAAW,OAAA,CAAQ,cAAc,eAAe,CAAA;AACnF,MAAA,IAAI,CAAC,YAAA,CAAa,OAAA,IAAW,CAAC,aAAa,IAAA,EAAM;AAC/C,QAAA,MAAM,IAAI,KAAA,CAAM,IAAA,CAAK,+BAA+B,CAAC,CAAA;AAAA,MACvD;AAEA,MAAA,OAAO;AAAA,QACL,cAAc,YAAA,CAAa,IAAA;AAAA,QAC3B,UAAA,EAAY,UAAU,IAAA,CAAK,UAAA;AAAA,QAC3B,EAAA,EAAI,UAAU,IAAA,CAAK;AAAA,OACrB;AAAA,IACF,CAAA;AAAA,IAEA,eAAe,OAAA,EAAmC;AAEhD,MAAA,MAAM,eAAe,aAAA,CAAc,UAAA,CAAW,QAAQ,OAAA,CAAQ,YAAA,EAAc,cAAc,UAAU,CAAA;AACpG,MAAA,IAAI,CAAC,YAAA,CAAa,OAAA,IAAW,CAAC,aAAa,IAAA,EAAM;AAC/C,QAAA,MAAM,IAAI,KAAA,CAAM,IAAA,CAAK,+BAA+B,CAAC,CAAA;AAAA,MACvD;AAGA,MAAA,MAAM,SAAA,GAAY,cAAc,SAAA,CAAU,aAAA,CAAc,QAAQ,UAAA,EAAY,YAAA,CAAa,IAAA,EAAM,OAAA,CAAQ,EAAE,CAAA;AACzG,MAAA,IAAI,CAAC,SAAA,CAAU,OAAA,IAAW,OAAO,SAAA,CAAU,SAAS,QAAA,EAAU;AAC5D,QAAA,MAAM,IAAI,KAAA,CAAM,IAAA,CAAK,4BAA4B,CAAC,CAAA;AAAA,MACpD;AAEA,MAAA,OAAO,SAAA,CAAU,IAAA;AAAA,IACnB;AAAA,GACD,CAAA;AACH;AAiBO,SAAS,yBACd,OAAA,EACyC;AACzC,EAAA,OAAO,OAAO,OAAA,KAAwC;AACpD,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,IAAA,EAAK;AAEhC,MAAA,IAAI,CAAC,IAAA,CAAK,eAAA,IAAmB,OAAO,IAAA,CAAK,oBAAoB,QAAA,EAAU;AACrE,QAAA,OAAO,IAAI,QAAA;AAAA,UACT,KAAK,SAAA,CAAU,EAAE,OAAO,IAAA,CAAK,6BAA6B,GAAG,CAAA;AAAA,UAC7D,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAS,EAAE,cAAA,EAAgB,oBAAmB;AAAE,SACjE;AAAA,MACF;AAEA,MAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,iBAAA,CAAkB,IAAA,CAAK,eAAe,CAAA;AAC/D,MAAA,MAAM,eAAA,GAAkB,QAAQ,kBAAA,EAAmB;AAEnD,MAAA,OAAO,IAAI,QAAA;AAAA,QACT,IAAA,CAAK,SAAA,CAAU,EAAE,eAAA,EAAiB,UAAU,CAAA;AAAA,QAC5C,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAS,EAAE,cAAA,EAAgB,oBAAmB;AAAE,OACjE;AAAA,IACF,CAAA,CAAA,MACM;AACJ,MAAA,OAAO,IAAI,QAAA;AAAA,QACT,KAAK,SAAA,CAAU,EAAE,OAAO,IAAA,CAAK,gCAAgC,GAAG,CAAA;AAAA,QAChE,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAS,EAAE,cAAA,EAAgB,oBAAmB;AAAE,OACjE;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAQO,SAAS,wBAAwB,OAAA,EAA+C;AACrF,EAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,KAAY,IAAA;AAC7C,IAAA,OAAO,KAAA;AACT,EAAA,MAAM,CAAA,GAAI,OAAA;AACV,EAAA,OACE,OAAO,EAAE,YAAA,KAAiB,QAAA,IACvB,OAAO,CAAA,CAAE,UAAA,KAAe,QAAA,IACxB,OAAO,CAAA,CAAE,EAAA,KAAO,YAChB,CAAA,CAAE,YAAA,CAAa,SAAS,CAAA,IACxB,CAAA,CAAE,WAAW,MAAA,GAAS,CAAA,IACtB,CAAA,CAAE,EAAA,CAAG,MAAA,GAAS,CAAA;AAErB","file":"chunk-6TMSXG7J.js","sourcesContent":["{\n  \"$schema\": \"https://inlang.com/schema/inlang-message-format\",\n  \"kit_unauthorized\": \"Unauthorized\",\n  \"kit_forbidden\": \"Forbidden: missing {permission} permission\",\n  \"kit_csrfTokenFailed\": \"Failed to generate CSRF token\",\n  \"kit_csrfVerifyFailed\": \"CSRF token verification failed\",\n  \"kit_csrfValidationFailed\": \"Invalid CSRF token\",\n  \"kit_rateLimitExceeded\": \"Too many requests, please try again later\",\n  \"kit_unsupportedContentType\": \"Unsupported content type\",\n  \"kit_parseBodyFailed\": \"Failed to parse request body\",\n  \"kit_encryptFailed\": \"Encryption failed\",\n  \"kit_transportKeyGenerationFailed\": \"Transport encryption key generation failed\",\n  \"kit_transportClientKeyNotFound\": \"Client key not found\",\n  \"kit_transportEncryptFailed\": \"Transport encryption failed\",\n  \"kit_transportEncryptKeyFailed\": \"Symmetric key encryption failed\",\n  \"kit_transportDecryptKeyFailed\": \"Symmetric key decryption failed\",\n  \"kit_transportDecryptFailed\": \"Transport decryption failed\",\n  \"kit_transportInvalidPayload\": \"Invalid encrypted payload\",\n  \"kit_transportKeyExchangeFailed\": \"Key exchange failed\",\n  \"kit_transportClientIdRequired\": \"Missing X-Client-Id header, key exchange is required for transport encryption\",\n  \"kit_signFailed\": \"Request signing failed\",\n  \"kit_authRequired\": \"Authentication required\",\n  \"kit_accessDenied\": \"Access denied\",\n  \"kit_resourceNotFound\": \"Resource not found\",\n  \"kit_internalError\": \"Internal server error\",\n  \"kit_validationFailed\": \"Validation failed\",\n  \"kit_noGuardsPassed\": \"No guards passed\",\n  \"kit_requiredRoles\": \"Required roles: {roles}\",\n  \"kit_requiredPermissions\": \"Required permissions: {permissions}\",\n  \"kit_idRequired\": \"ID is required\"\n}\n","{\n  \"$schema\": \"https://inlang.com/schema/inlang-message-format\",\n  \"kit_unauthorized\": \"未授权\",\n  \"kit_forbidden\": \"权限不足：缺少 {permission} 权限\",\n  \"kit_csrfTokenFailed\": \"生成 CSRF Token 失败\",\n  \"kit_csrfVerifyFailed\": \"CSRF Token 验证失败\",\n  \"kit_csrfValidationFailed\": \"CSRF Token 无效\",\n  \"kit_rateLimitExceeded\": \"请求过于频繁，请稍后再试\",\n  \"kit_unsupportedContentType\": \"不支持的内容类型\",\n  \"kit_parseBodyFailed\": \"请求体解析失败\",\n  \"kit_encryptFailed\": \"加密失败\",\n  \"kit_transportKeyGenerationFailed\": \"传输加密密钥对生成失败\",\n  \"kit_transportClientKeyNotFound\": \"客户端密钥未找到\",\n  \"kit_transportEncryptFailed\": \"传输加密失败\",\n  \"kit_transportEncryptKeyFailed\": \"对称密钥加密失败\",\n  \"kit_transportDecryptKeyFailed\": \"对称密钥解密失败\",\n  \"kit_transportDecryptFailed\": \"传输解密失败\",\n  \"kit_transportInvalidPayload\": \"无效的加密载荷\",\n  \"kit_transportKeyExchangeFailed\": \"密钥交换失败\",\n  \"kit_transportClientIdRequired\": \"缺少 X-Client-Id 请求头，传输加密必须先完成密钥交换\",\n  \"kit_signFailed\": \"请求签名失败\",\n  \"kit_authRequired\": \"需要身份认证\",\n  \"kit_accessDenied\": \"拒绝访问\",\n  \"kit_resourceNotFound\": \"资源未找到\",\n  \"kit_internalError\": \"内部服务器错误\",\n  \"kit_validationFailed\": \"数据验证失败\",\n  \"kit_noGuardsPassed\": \"没有守卫通过\",\n  \"kit_requiredRoles\": \"需要角色：{roles}\",\n  \"kit_requiredPermissions\": \"需要权限：{permissions}\",\n  \"kit_idRequired\": \"ID 不能为空\"\n}\n","/**\n * @h-ai/kit — i18n 工具\n *\n * Kit 模块的国际化消息工具，从 @h-ai/core 调用 i18n API。\n * @module kit-i18n\n */\n\nimport { core } from '@h-ai/core'\nimport messagesEnUS from '../messages/en-US.json'\nimport messagesZhCN from '../messages/zh-CN.json'\n\ntype KitMessageKey = keyof typeof messagesZhCN\n\n/** 获取 Kit 模块的 i18n 消息 */\nexport const kitM\n  = core.i18n.createMessageGetter<KitMessageKey>({ 'zh-CN': messagesZhCN, 'en-US': messagesEnUS })\n\n/**\n * 统一设置所有 hai 模块的默认语言\n *\n * 通过 @h-ai/core 的集中式 locale 管理器，一次调用即可同步所有模块。\n * 各模块的 createMessageGetter 会读取全局 locale。\n *\n * @example\n * ```ts\n * import { kit } from '@h-ai/kit'\n *\n * // 在 i18n handle 中\n * const locale = event.cookies.get('PARAGLIDE_LOCALE') ?? 'zh-CN'\n * kit.i18n.setLocale(locale)\n * ```\n */\nexport function setAllModulesLocale(locale: string): void {\n  core.i18n.setGlobalLocale(locale)\n}\n","/**\n * @h-ai/kit — 传输加密核心\n *\n * 基于非对称 + 对称的混合传输加密。\n * @module kit-transport-encryption\n */\n\nimport type { HaiResult } from '@h-ai/core'\nimport type {\n  EncryptedPayload,\n  TransportCryptoServiceLike,\n  TransportEncryptionManager,\n  TransportKeyPair,\n} from './kit-crypto-types.js'\nimport { err, ok } from '@h-ai/core'\nimport { kitM } from '../../kit-i18n.js'\n\n/**\n * 创建传输加密管理器\n *\n * 启动时生成服务端非对称密钥对，通过 clientId → publicKey 的内存 Map 管理客户端密钥。\n * 内置 LRU 淘汰机制，超过 maxClients 上限时自动移除最早注册的客户端。\n *\n * 注意：clientKeys 存储在进程内存中，多节点部署时各节点状态独立。\n * 客户端密钥交换后的后续请求必须路由到同一节点（如使用 sticky session），\n * 否则传输加密功能不可用。\n *\n * @param cryptoService - 传输加密服务实例（非对称 + 对称）\n * @param maxClients - 最大客户端数量（默认 10000），超过时淘汰最早注册的\n * @returns 成功返回传输加密管理器，密钥对生成失败时返回错误\n */\nexport function createTransportEncryption(\n  cryptoService: TransportCryptoServiceLike,\n  maxClients = 10000,\n): HaiResult<TransportEncryptionManager> {\n  // 生成服务端密钥对\n  const keyPairResult = cryptoService.asymmetric.generateKeyPair()\n  if (!keyPairResult.success || !keyPairResult.data) {\n    return err({ code: 'KIT_TRANSPORT_KEY_GENERATION_FAILED', message: kitM('kit_transportKeyGenerationFailed') })\n  }\n  const serverKeyPair: TransportKeyPair = keyPairResult.data\n\n  // 客户端公钥存储：clientId → publicKey（Map 保持插入顺序，用于 LRU 淘汰）\n  const clientKeys = new Map<string, string>()\n  let clientIdCounter = 0\n\n  return ok({\n    getServerPublicKey(): string {\n      return serverKeyPair.publicKey\n    },\n\n    registerClientKey(clientPublicKey: string): string {\n      clientIdCounter++\n      const clientId = `client_${clientIdCounter}_${Date.now()}`\n\n      // LRU 淘汰：超过上限时移除最早注册的客户端\n      if (clientKeys.size >= maxClients) {\n        const oldestKey = clientKeys.keys().next().value\n        if (oldestKey !== undefined) {\n          clientKeys.delete(oldestKey)\n        }\n      }\n\n      clientKeys.set(clientId, clientPublicKey)\n      return clientId\n    },\n\n    getClientPublicKey(clientId: string): string | undefined {\n      return clientKeys.get(clientId)\n    },\n\n    encryptResponse(clientId: string, data: string): EncryptedPayload {\n      const clientPublicKey = clientKeys.get(clientId)\n      if (!clientPublicKey) {\n        throw new Error(kitM('kit_transportClientKeyNotFound'))\n      }\n\n      // 1. 生成随机对称密钥\n      const symmetricKey = cryptoService.symmetric.generateKey()\n\n      // 2. 对称加密内容\n      const encResult = cryptoService.symmetric.encryptWithIV(data, symmetricKey)\n      if (!encResult.success || !encResult.data) {\n        throw new Error(kitM('kit_transportEncryptFailed'))\n      }\n\n      // 3. 非对称加密对称密钥（使用客户端公钥）\n      const keyEncResult = cryptoService.asymmetric.encrypt(symmetricKey, clientPublicKey)\n      if (!keyEncResult.success || !keyEncResult.data) {\n        throw new Error(kitM('kit_transportEncryptKeyFailed'))\n      }\n\n      return {\n        encryptedKey: keyEncResult.data,\n        ciphertext: encResult.data.ciphertext,\n        iv: encResult.data.iv,\n      }\n    },\n\n    decryptRequest(payload: EncryptedPayload): string {\n      // 1. 非对称解密对称密钥（使用服务端私钥）\n      const keyDecResult = cryptoService.asymmetric.decrypt(payload.encryptedKey, serverKeyPair.privateKey)\n      if (!keyDecResult.success || !keyDecResult.data) {\n        throw new Error(kitM('kit_transportDecryptKeyFailed'))\n      }\n\n      // 2. 对称解密内容\n      const decResult = cryptoService.symmetric.decryptWithIV(payload.ciphertext, keyDecResult.data, payload.iv)\n      if (!decResult.success || typeof decResult.data !== 'string') {\n        throw new Error(kitM('kit_transportDecryptFailed'))\n      }\n\n      return decResult.data\n    },\n  })\n}\n\n/**\n * 创建密钥交换端点处理器\n *\n * 返回一个标准的 POST 处理函数，用于接收客户端公钥并返回服务端公钥与 clientId。\n *\n * @param manager - 传输加密管理器\n * @returns POST 处理函数，可直接用于 SvelteKit +server.ts\n *\n * @example\n * ```ts\n * // src/routes/api/kit/key-exchange/+server.ts\n * import { keyExchangeHandler } from '$lib/server/transport'\n * export const POST = keyExchangeHandler\n * ```\n */\nexport function createKeyExchangeHandler(\n  manager: TransportEncryptionManager,\n): (request: Request) => Promise<Response> {\n  return async (request: Request): Promise<Response> => {\n    try {\n      const body = await request.json() as { clientPublicKey?: string }\n\n      if (!body.clientPublicKey || typeof body.clientPublicKey !== 'string') {\n        return new Response(\n          JSON.stringify({ error: kitM('kit_transportInvalidPayload') }),\n          { status: 400, headers: { 'Content-Type': 'application/json' } },\n        )\n      }\n\n      const clientId = manager.registerClientKey(body.clientPublicKey)\n      const serverPublicKey = manager.getServerPublicKey()\n\n      return new Response(\n        JSON.stringify({ serverPublicKey, clientId }),\n        { status: 200, headers: { 'Content-Type': 'application/json' } },\n      )\n    }\n    catch {\n      return new Response(\n        JSON.stringify({ error: kitM('kit_transportKeyExchangeFailed') }),\n        { status: 500, headers: { 'Content-Type': 'application/json' } },\n      )\n    }\n  }\n}\n\n/**\n * 校验加密载荷格式是否合法\n *\n * @param payload - 待校验对象\n * @returns 是否为合法的 EncryptedPayload\n */\nexport function isValidEncryptedPayload(payload: unknown): payload is EncryptedPayload {\n  if (typeof payload !== 'object' || payload === null)\n    return false\n  const p = payload as Record<string, unknown>\n  return (\n    typeof p.encryptedKey === 'string'\n    && typeof p.ciphertext === 'string'\n    && typeof p.iv === 'string'\n    && p.encryptedKey.length > 0\n    && p.ciphertext.length > 0\n    && p.iv.length > 0\n  )\n}\n"]}

package/dist/chunk-AD6S473Y.js

@@ -0,0 +1,137 @@
+import { createTransportEncryption, kitM, isValidEncryptedPayload } from './chunk-6TMSXG7J.js';
+
+// src/modules/crypto/kit-transport-middleware.ts
+function transportEncryptionMiddleware(config) {
+  if (!config.enabled) {
+    return async (_context, next) => next();
+  }
+  const keyExchangePath = config.keyExchangePath ?? "/api/kit/key-exchange";
+  const excludePaths = config.excludePaths ?? [];
+  const encryptResponse = config.encryptResponse ?? true;
+  const requireEncryption = config.requireEncryption ?? true;
+  const result = createTransportEncryption(config.crypto);
+  if (!result.success) {
+    return async (_context, next) => next();
+  }
+  const manager = result.data;
+  return async (context, next) => {
+    const { event } = context;
+    const pathname = event.url.pathname;
+    if (pathname === keyExchangePath && event.request.method === "POST") {
+      return handleKeyExchange(manager, event.request);
+    }
+    if (shouldExclude(pathname, excludePaths, keyExchangePath)) {
+      return next();
+    }
+    const clientId = event.request.headers.get("X-Client-Id");
+    if (!clientId) {
+      if (requireEncryption) {
+        return new Response(
+          JSON.stringify({ error: kitM("kit_transportClientIdRequired") }),
+          { status: 400, headers: { "Content-Type": "application/json" } }
+        );
+      }
+      return next();
+    }
+    const clientPublicKey = manager.getClientPublicKey(clientId);
+    if (!clientPublicKey) {
+      return new Response(
+        JSON.stringify({ error: kitM("kit_transportClientKeyNotFound") }),
+        { status: 400, headers: { "Content-Type": "application/json" } }
+      );
+    }
+    try {
+      if (hasBody(event.request.method)) {
+        const bodyText = await event.request.text();
+        if (bodyText) {
+          const payload = JSON.parse(bodyText);
+          if (isValidEncryptedPayload(payload)) {
+            const plaintext = manager.decryptRequest(payload);
+            const newRequest = new Request(event.request.url, {
+              method: event.request.method,
+              headers: new Headers(event.request.headers),
+              body: plaintext
+            });
+            Object.defineProperty(event, "request", {
+              value: newRequest,
+              writable: true,
+              configurable: true
+            });
+          }
+        }
+      }
+    } catch {
+      return new Response(
+        JSON.stringify({ error: kitM("kit_transportDecryptFailed") }),
+        { status: 400, headers: { "Content-Type": "application/json" } }
+      );
+    }
+    const response = await next();
+    if (!encryptResponse) {
+      return response;
+    }
+    const contentType = response.headers.get("Content-Type") ?? "";
+    if (!contentType.includes("application/json")) {
+      return response;
+    }
+    const contentLength = response.headers.get("Content-Length");
+    if (contentLength && Number.parseInt(contentLength, 10) > 1048576) {
+      return response;
+    }
+    try {
+      const responseBody = await response.text();
+      if (!responseBody) {
+        return response;
+      }
+      const encryptedPayload = manager.encryptResponse(clientId, responseBody);
+      return new Response(
+        JSON.stringify(encryptedPayload),
+        {
+          status: response.status,
+          statusText: response.statusText,
+          headers: {
+            ...Object.fromEntries(response.headers.entries()),
+            "Content-Type": "application/json",
+            "X-Encrypted": "true"
+          }
+        }
+      );
+    } catch {
+      return response;
+    }
+  };
+}
+async function handleKeyExchange(manager, request) {
+  try {
+    const body = await request.json();
+    if (!body.clientPublicKey || typeof body.clientPublicKey !== "string") {
+      return new Response(
+        JSON.stringify({ error: kitM("kit_transportInvalidPayload") }),
+        { status: 400, headers: { "Content-Type": "application/json" } }
+      );
+    }
+    const clientId = manager.registerClientKey(body.clientPublicKey);
+    const serverPublicKey = manager.getServerPublicKey();
+    return new Response(
+      JSON.stringify({ serverPublicKey, clientId }),
+      { status: 200, headers: { "Content-Type": "application/json" } }
+    );
+  } catch {
+    return new Response(
+      JSON.stringify({ error: kitM("kit_transportKeyExchangeFailed") }),
+      { status: 500, headers: { "Content-Type": "application/json" } }
+    );
+  }
+}
+function shouldExclude(pathname, excludePaths, keyExchangePath) {
+  if (pathname === keyExchangePath)
+    return true;
+  return excludePaths.some((p) => pathname === p || pathname.startsWith(`${p}/`));
+}
+function hasBody(method) {
+  return ["POST", "PUT", "PATCH", "DELETE"].includes(method.toUpperCase());
+}
+
+export { transportEncryptionMiddleware };
+//# sourceMappingURL=chunk-AD6S473Y.js.map
+//# sourceMappingURL=chunk-AD6S473Y.js.map

package/dist/chunk-AD6S473Y.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/modules/crypto/kit-transport-middleware.ts"],"names":[],"mappings":";;;AA6BO,SAAS,8BAA8B,MAAA,EAA+C;AAE3F,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,OAAO,OAAO,QAAA,EAAU,IAAA,KAAS,IAAA,EAAK;AAAA,EACxC;AAEA,EAAA,MAAM,eAAA,GAAkB,OAAO,eAAA,IAAmB,uBAAA;AAClD,EAAA,MAAM,YAAA,GAAe,MAAA,CAAO,YAAA,IAAgB,EAAC;AAC7C,EAAA,MAAM,eAAA,GAAkB,OAAO,eAAA,IAAmB,IAAA;AAClD,EAAA,MAAM,iBAAA,GAAoB,OAAO,iBAAA,IAAqB,IAAA;AAGtD,EAAA,MAAM,MAAA,GAAS,yBAAA,CAA0B,MAAA,CAAO,MAAM,CAAA;AACtD,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AAEnB,IAAA,OAAO,OAAO,QAAA,EAAU,IAAA,KAAS,IAAA,EAAK;AAAA,EACxC;AACA,EAAA,MAAM,UAAU,MAAA,CAAO,IAAA;AAEvB,EAAA,OAAO,OAAO,SAAS,IAAA,KAAS;AAC9B,IAAA,MAAM,EAAE,OAAM,GAAI,OAAA;AAClB,IAAA,MAAM,QAAA,GAAW,MAAM,GAAA,CAAI,QAAA;AAG3B,IAAA,IAAI,QAAA,KAAa,eAAA,IAAmB,KAAA,CAAM,OAAA,CAAQ,WAAW,MAAA,EAAQ;AACnE,MAAA,OAAO,iBAAA,CAAkB,OAAA,EAAS,KAAA,CAAM,OAAO,CAAA;AAAA,IACjD;AAGA,IAAA,IAAI,aAAA,CAAc,QAAA,EAAU,YAAA,EAAc,eAAe,CAAA,EAAG;AAC1D,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AAGA,IAAA,MAAM,QAAA,GAAW,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,IAAI,aAAa,CAAA;AACxD,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,IAAI,iBAAA,EAAmB;AAErB,QAAA,OAAO,IAAI,QAAA;AAAA,UACT,KAAK,SAAA,CAAU,EAAE,OAAO,IAAA,CAAK,+BAA+B,GAAG,CAAA;AAAA,UAC/D,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAS,EAAE,cAAA,EAAgB,oBAAmB;AAAE,SACjE;AAAA,MACF;AAEA,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AAGA,IAAA,MAAM,eAAA,GAAkB,OAAA,CAAQ,kBAAA,CAAmB,QAAQ,CAAA;AAC3D,IAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,MAAA,OAAO,IAAI,QAAA;AAAA,QACT,KAAK,SAAA,CAAU,EAAE,OAAO,IAAA,CAAK,gCAAgC,GAAG,CAAA;AAAA,QAChE,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAS,EAAE,cAAA,EAAgB,oBAAmB;AAAE,OACjE;AAAA,IACF;AAGA,IAAA,IAAI;AACF,MAAA,IAAI,OAAA,CAAQ,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACjC,QAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAK;AAC1C,QAAA,IAAI,QAAA,EAAU;AACZ,UAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA;AACnC,UAAA,IAAI,uBAAA,CAAwB,OAAO,CAAA,EAAG;AACpC,YAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,cAAA,CAAe,OAAO,CAAA;AAEhD,YAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,KAAA,CAAM,QAAQ,GAAA,EAAK;AAAA,cAChD,MAAA,EAAQ,MAAM,OAAA,CAAQ,MAAA;AAAA,cACtB,OAAA,EAAS,IAAI,OAAA,CAAQ,KAAA,CAAM,QAAQ,OAAO,CAAA;AAAA,cAC1C,IAAA,EAAM;AAAA,aACP,CAAA;AAED,YAAA,MAAA,CAAO,cAAA,CAAe,OAAO,SAAA,EAAW;AAAA,cACtC,KAAA,EAAO,UAAA;AAAA,cACP,QAAA,EAAU,IAAA;AAAA,cACV,YAAA,EAAc;AAAA,aACf,CAAA;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAA,CAAA,MACM;AACJ,MAAA,OAAO,IAAI,QAAA;AAAA,QACT,KAAK,SAAA,CAAU,EAAE,OAAO,IAAA,CAAK,4BAA4B,GAAG,CAAA;AAAA,QAC5D,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAS,EAAE,cAAA,EAAgB,oBAAmB;AAAE,OACjE;AAAA,IACF;AAGA,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,EAAK;AAG5B,IAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,MAAA,OAAO,QAAA;AAAA,IACT;AAGA,IAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC5D,IAAA,IAAI,CAAC,WAAA,CAAY,QAAA,CAAS,kBAAkB,CAAA,EAAG;AAC7C,MAAA,OAAO,QAAA;AAAA,IACT;AACA,IAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA;AAC3D,IAAA,IAAI,iBAAiB,MAAA,CAAO,QAAA,CAAS,aAAA,EAAe,EAAE,IAAI,OAAA,EAAW;AACnE,MAAA,OAAO,QAAA;AAAA,IACT;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,YAAA,GAAe,MAAM,QAAA,CAAS,IAAA,EAAK;AACzC,MAAA,IAAI,CAAC,YAAA,EAAc;AACjB,QAAA,OAAO,QAAA;AAAA,MACT;AAEA,MAAA,MAAM,gBAAA,GAAmB,OAAA,CAAQ,eAAA,CAAgB,QAAA,EAAU,YAAY,CAAA;AACvE,MAAA,OAAO,IAAI,QAAA;AAAA,QACT,IAAA,CAAK,UAAU,gBAAgB,CAAA;AAAA,QAC/B;AAAA,UACE,QAAQ,QAAA,CAAS,MAAA;AAAA,UACjB,YAAY,QAAA,CAAS,UAAA;AAAA,UACrB,OAAA,EAAS;AAAA,YACP,GAAG,MAAA,CAAO,WAAA,CAAY,QAAA,CAAS,OAAA,CAAQ,SAAS,CAAA;AAAA,YAChD,cAAA,EAAgB,kBAAA;AAAA,YAChB,aAAA,EAAe;AAAA;AACjB;AACF,OACF;AAAA,IACF,CAAA,CAAA,MACM;AAEJ,MAAA,OAAO,QAAA;AAAA,IACT;AAAA,EACF,CAAA;AACF;AAWA,eAAe,iBAAA,CACb,SACA,OAAA,EACmB;AACnB,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,IAAA,EAAK;AAEhC,IAAA,IAAI,CAAC,IAAA,CAAK,eAAA,IAAmB,OAAO,IAAA,CAAK,oBAAoB,QAAA,EAAU;AACrE,MAAA,OAAO,IAAI,QAAA;AAAA,QACT,KAAK,SAAA,CAAU,EAAE,OAAO,IAAA,CAAK,6BAA6B,GAAG,CAAA;AAAA,QAC7D,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAS,EAAE,cAAA,EAAgB,oBAAmB;AAAE,OACjE;AAAA,IACF;AAEA,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,iBAAA,CAAkB,IAAA,CAAK,eAAe,CAAA;AAC/D,IAAA,MAAM,eAAA,GAAkB,QAAQ,kBAAA,EAAmB;AAEnD,IAAA,OAAO,IAAI,QAAA;AAAA,MACT,IAAA,CAAK,SAAA,CAAU,EAAE,eAAA,EAAiB,UAAU,CAAA;AAAA,MAC5C,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAS,EAAE,cAAA,EAAgB,oBAAmB;AAAE,KACjE;AAAA,EACF,CAAA,CAAA,MACM;AACJ,IAAA,OAAO,IAAI,QAAA;AAAA,MACT,KAAK,SAAA,CAAU,EAAE,OAAO,IAAA,CAAK,gCAAgC,GAAG,CAAA;AAAA,MAChE,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAS,EAAE,cAAA,EAAgB,oBAAmB;AAAE,KACjE;AAAA,EACF;AACF;AAUA,SAAS,aAAA,CAAc,QAAA,EAAkB,YAAA,EAAwB,eAAA,EAAkC;AACjG,EAAA,IAAI,QAAA,KAAa,eAAA;AACf,IAAA,OAAO,IAAA;AACT,EAAA,OAAO,YAAA,CAAa,IAAA,CAAK,CAAA,CAAA,KAAK,QAAA,KAAa,CAAA,IAAK,SAAS,UAAA,CAAW,CAAA,EAAG,CAAC,CAAA,CAAA,CAAG,CAAC,CAAA;AAC9E;AAQA,SAAS,QAAQ,MAAA,EAAyB;AACxC,EAAA,OAAO,CAAC,QAAQ,KAAA,EAAO,OAAA,EAAS,QAAQ,CAAA,CAAE,QAAA,CAAS,MAAA,CAAO,WAAA,EAAa,CAAA;AACzE","file":"chunk-AD6S473Y.js","sourcesContent":["/**\n * @h-ai/kit — 传输加密中间件\n *\n * SvelteKit 中间件，自动对请求/响应进行传输加密解密。\n * @module kit-transport-middleware\n */\n\nimport type { Middleware } from '../../kit-types.js'\nimport type { TransportEncryptionConfig, TransportEncryptionManager } from './kit-crypto-types.js'\nimport { kitM } from '../../kit-i18n.js'\nimport { createTransportEncryption, isValidEncryptedPayload } from './kit-transport-encryption.js'\n\n/**\n * 创建传输加密中间件\n *\n * @param config - 传输加密配置\n * @returns SvelteKit 中间件\n *\n * @example\n * ```ts\n * import { crypto } from '@h-ai/crypto'\n * import { kit } from '@h-ai/kit'\n *\n * // 传输加密通过 createHandle 的 crypto 配置自动启用：\n * export const handle = kit.createHandle({\n *   crypto: { crypto, transport: true },\n * })\n * ```\n */\nexport function transportEncryptionMiddleware(config: TransportEncryptionConfig): Middleware {\n  // 未启用时直接透传\n  if (!config.enabled) {\n    return async (_context, next) => next()\n  }\n\n  const keyExchangePath = config.keyExchangePath ?? '/api/kit/key-exchange'\n  const excludePaths = config.excludePaths ?? []\n  const encryptResponse = config.encryptResponse ?? true\n  const requireEncryption = config.requireEncryption ?? true\n\n  // 初始化传输加密管理器\n  const result = createTransportEncryption(config.crypto)\n  if (!result.success) {\n    // 密钥生成失败时降级为透传\n    return async (_context, next) => next()\n  }\n  const manager = result.data\n\n  return async (context, next) => {\n    const { event } = context\n    const pathname = event.url.pathname\n\n    // 密钥交换端点：委托给 keyExchangeHandler\n    if (pathname === keyExchangePath && event.request.method === 'POST') {\n      return handleKeyExchange(manager, event.request)\n    }\n\n    // 排除路径不做加解密\n    if (shouldExclude(pathname, excludePaths, keyExchangePath)) {\n      return next()\n    }\n\n    // 请求头中无 X-Client-Id 时的处理\n    const clientId = event.request.headers.get('X-Client-Id')\n    if (!clientId) {\n      if (requireEncryption) {\n        // 强制加密模式：缺少 X-Client-Id 说明未完成密钥交换，拒绝请求\n        return new Response(\n          JSON.stringify({ error: kitM('kit_transportClientIdRequired') }),\n          { status: 400, headers: { 'Content-Type': 'application/json' } },\n        )\n      }\n      // 非强制模式：透传明文（渐进式迁移兼容）\n      return next()\n    }\n\n    // 检查客户端是否已注册\n    const clientPublicKey = manager.getClientPublicKey(clientId)\n    if (!clientPublicKey) {\n      return new Response(\n        JSON.stringify({ error: kitM('kit_transportClientKeyNotFound') }),\n        { status: 400, headers: { 'Content-Type': 'application/json' } },\n      )\n    }\n\n    // ── 解密请求 ──\n    try {\n      if (hasBody(event.request.method)) {\n        const bodyText = await event.request.text()\n        if (bodyText) {\n          const payload = JSON.parse(bodyText) as unknown\n          if (isValidEncryptedPayload(payload)) {\n            const plaintext = manager.decryptRequest(payload)\n            // 重建请求，替换为解密后的明文\n            const newRequest = new Request(event.request.url, {\n              method: event.request.method,\n              headers: new Headers(event.request.headers),\n              body: plaintext,\n            })\n            // 将解密后的请求注入 locals，供后续中间件/端点使用\n            Object.defineProperty(event, 'request', {\n              value: newRequest,\n              writable: true,\n              configurable: true,\n            })\n          }\n        }\n      }\n    }\n    catch {\n      return new Response(\n        JSON.stringify({ error: kitM('kit_transportDecryptFailed') }),\n        { status: 400, headers: { 'Content-Type': 'application/json' } },\n      )\n    }\n\n    // ── 执行后续中间件/端点 ──\n    const response = await next()\n\n    // ── 加密响应 ──\n    if (!encryptResponse) {\n      return response\n    }\n\n    // 跳过非 JSON 响应和大体积响应（>1MB），避免内存问题\n    const contentType = response.headers.get('Content-Type') ?? ''\n    if (!contentType.includes('application/json')) {\n      return response\n    }\n    const contentLength = response.headers.get('Content-Length')\n    if (contentLength && Number.parseInt(contentLength, 10) > 1_048_576) {\n      return response\n    }\n\n    try {\n      const responseBody = await response.text()\n      if (!responseBody) {\n        return response\n      }\n\n      const encryptedPayload = manager.encryptResponse(clientId, responseBody)\n      return new Response(\n        JSON.stringify(encryptedPayload),\n        {\n          status: response.status,\n          statusText: response.statusText,\n          headers: {\n            ...Object.fromEntries(response.headers.entries()),\n            'Content-Type': 'application/json',\n            'X-Encrypted': 'true',\n          },\n        },\n      )\n    }\n    catch {\n      // 加密失败时返回原始响应\n      return response\n    }\n  }\n}\n\n/**\n * 处理密钥交换 POST 请求\n *\n * 接收客户端公钥，注册并返回服务端公钥与 clientId。\n *\n * @param manager - 传输加密管理器\n * @param request - 原始 Request\n * @returns JSON Response\n */\nasync function handleKeyExchange(\n  manager: TransportEncryptionManager,\n  request: Request,\n): Promise<Response> {\n  try {\n    const body = await request.json() as { clientPublicKey?: string }\n\n    if (!body.clientPublicKey || typeof body.clientPublicKey !== 'string') {\n      return new Response(\n        JSON.stringify({ error: kitM('kit_transportInvalidPayload') }),\n        { status: 400, headers: { 'Content-Type': 'application/json' } },\n      )\n    }\n\n    const clientId = manager.registerClientKey(body.clientPublicKey)\n    const serverPublicKey = manager.getServerPublicKey()\n\n    return new Response(\n      JSON.stringify({ serverPublicKey, clientId }),\n      { status: 200, headers: { 'Content-Type': 'application/json' } },\n    )\n  }\n  catch {\n    return new Response(\n      JSON.stringify({ error: kitM('kit_transportKeyExchangeFailed') }),\n      { status: 500, headers: { 'Content-Type': 'application/json' } },\n    )\n  }\n}\n\n/**\n * 判断路径是否应排除传输加解密\n *\n * @param pathname - 当前请求路径\n * @param excludePaths - 配置的排除列表\n * @param keyExchangePath - 密钥交换端点路径\n * @returns 是否排除\n */\nfunction shouldExclude(pathname: string, excludePaths: string[], keyExchangePath: string): boolean {\n  if (pathname === keyExchangePath)\n    return true\n  return excludePaths.some(p => pathname === p || pathname.startsWith(`${p}/`))\n}\n\n/**\n * 判断 HTTP 方法是否可能携带请求体\n *\n * @param method - HTTP 方法字符串\n * @returns `true` 表示 POST / PUT / PATCH / DELETE\n */\nfunction hasBody(method: string): boolean {\n  return ['POST', 'PUT', 'PATCH', 'DELETE'].includes(method.toUpperCase())\n}\n"]}

package/dist/chunk-FRYJMRTP.js

@@ -0,0 +1,71 @@
+// src/crud/kit-crud.ts
+function resolveText(text) {
+  return typeof text === "function" ? text() : text;
+}
+function sortFields(fields) {
+  return [...fields].sort((a, b) => (a.order ?? 0) - (b.order ?? 0));
+}
+function resolveOptions(options) {
+  if (!options)
+    return [];
+  return typeof options === "function" ? options() : options;
+}
+function defineCrud(resource) {
+  const fields = resource.fields;
+  function getListFields() {
+    return sortFields(fields.filter((f) => f.inList !== false));
+  }
+  function getFilterFields() {
+    return sortFields(fields.filter((f) => f.filterable === true));
+  }
+  function getCreateFields() {
+    return sortFields(fields.filter((f) => f.inCreate !== false));
+  }
+  function getEditFields() {
+    return sortFields(fields.filter((f) => f.inEdit !== false));
+  }
+  function getDetailFields() {
+    return sortFields(fields.filter((f) => f.inDetail !== false));
+  }
+  function toTableColumns() {
+    return getListFields().map((f) => ({
+      key: f.id,
+      label: resolveText(f.label),
+      width: f.width,
+      align: f.align,
+      render: f.render ? (item) => f.render(item[f.id], item) : void 0
+    }));
+  }
+  function getDefaultValues() {
+    const defaults = {};
+    for (const f of fields) {
+      if (f.defaultValue !== void 0) {
+        defaults[f.id] = f.defaultValue;
+      } else if (f.type === "boolean" || f.type === "checkbox") {
+        defaults[f.id] = false;
+      } else if (f.type === "multi-select") {
+        defaults[f.id] = [];
+      } else if (f.type === "number") {
+        defaults[f.id] = void 0;
+      } else {
+        defaults[f.id] = "";
+      }
+    }
+    return defaults;
+  }
+  return {
+    resource,
+    getListFields,
+    getFilterFields,
+    getCreateFields,
+    getEditFields,
+    getDetailFields,
+    toTableColumns,
+    getDefaultValues,
+    api: resource.api
+  };
+}
+
+export { defineCrud, resolveOptions, resolveText };
+//# sourceMappingURL=chunk-FRYJMRTP.js.map
+//# sourceMappingURL=chunk-FRYJMRTP.js.map

package/dist/chunk-FRYJMRTP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/crud/kit-crud.ts"],"names":[],"mappings":";AAmBA,SAAS,YAAY,IAAA,EAAwB;AAC3C,EAAA,OAAO,OAAO,IAAA,KAAS,UAAA,GAAa,IAAA,EAAK,GAAI,IAAA;AAC/C;AAKA,SAAS,WAAW,MAAA,EAAwC;AAC1D,EAAA,OAAO,CAAC,GAAG,MAAM,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAA,CAAO,CAAA,CAAE,KAAA,IAAS,CAAA,KAAM,CAAA,CAAE,SAAS,CAAA,CAAE,CAAA;AACnE;AAKA,SAAS,eAAe,OAAA,EAAmG;AACzH,EAAA,IAAI,CAAC,OAAA;AACH,IAAA,OAAO,EAAC;AACV,EAAA,OAAO,OAAO,OAAA,KAAY,UAAA,GAAa,OAAA,EAAQ,GAAI,OAAA;AACrD;AAwBO,SAAS,WACd,QAAA,EACmB;AACnB,EAAA,MAAM,SAAS,QAAA,CAAS,MAAA;AAExB,EAAA,SAAS,aAAA,GAAgC;AACvC,IAAA,OAAO,WAAW,MAAA,CAAO,MAAA,CAAO,OAAK,CAAA,CAAE,MAAA,KAAW,KAAK,CAAC,CAAA;AAAA,EAC1D;AAEA,EAAA,SAAS,eAAA,GAAkC;AACzC,IAAA,OAAO,WAAW,MAAA,CAAO,MAAA,CAAO,OAAK,CAAA,CAAE,UAAA,KAAe,IAAI,CAAC,CAAA;AAAA,EAC7D;AAEA,EAAA,SAAS,eAAA,GAAkC;AACzC,IAAA,OAAO,WAAW,MAAA,CAAO,MAAA,CAAO,OAAK,CAAA,CAAE,QAAA,KAAa,KAAK,CAAC,CAAA;AAAA,EAC5D;AAEA,EAAA,SAAS,aAAA,GAAgC;AACvC,IAAA,OAAO,WAAW,MAAA,CAAO,MAAA,CAAO,OAAK,CAAA,CAAE,MAAA,KAAW,KAAK,CAAC,CAAA;AAAA,EAC1D;AAEA,EAAA,SAAS,eAAA,GAAkC;AACzC,IAAA,OAAO,WAAW,MAAA,CAAO,MAAA,CAAO,OAAK,CAAA,CAAE,QAAA,KAAa,KAAK,CAAC,CAAA;AAAA,EAC5D;AAEA,EAAA,SAAS,cAAA,GAAoC;AAC3C,IAAA,OAAO,aAAA,EAAc,CAAE,GAAA,CAAI,CAAA,CAAA,MAAM;AAAA,MAC/B,KAAK,CAAA,CAAE,EAAA;AAAA,MACP,KAAA,EAAO,WAAA,CAAY,CAAA,CAAE,KAAK,CAAA;AAAA,MAC1B,OAAO,CAAA,CAAE,KAAA;AAAA,MACT,OAAO,CAAA,CAAE,KAAA;AAAA,MACT,MAAA,EAAQ,CAAA,CAAE,MAAA,GACN,CAAC,IAAA,KAAkC,CAAA,CAAE,MAAA,CAAQ,IAAA,CAAK,CAAA,CAAE,EAAE,CAAA,EAAG,IAAI,CAAA,GAC7D;AAAA,KACN,CAAE,CAAA;AAAA,EACJ;AAEA,EAAA,SAAS,gBAAA,GAA4C;AACnD,IAAA,MAAM,WAAoC,EAAC;AAC3C,IAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,MAAA,IAAI,CAAA,CAAE,iBAAiB,MAAA,EAAW;AAChC,QAAA,QAAA,CAAS,CAAA,CAAE,EAAE,CAAA,GAAI,CAAA,CAAE,YAAA;AAAA,MACrB,WACS,CAAA,CAAE,IAAA,KAAS,SAAA,IAAa,CAAA,CAAE,SAAS,UAAA,EAAY;AACtD,QAAA,QAAA,CAAS,CAAA,CAAE,EAAE,CAAA,GAAI,KAAA;AAAA,MACnB,CAAA,MAAA,IACS,CAAA,CAAE,IAAA,KAAS,cAAA,EAAgB;AAClC,QAAA,QAAA,CAAS,CAAA,CAAE,EAAE,CAAA,GAAI,EAAC;AAAA,MACpB,CAAA,MAAA,IACS,CAAA,CAAE,IAAA,KAAS,QAAA,EAAU;AAC5B,QAAA,QAAA,CAAS,CAAA,CAAE,EAAE,CAAA,GAAI,MAAA;AAAA,MACnB,CAAA,MACK;AACH,QAAA,QAAA,CAAS,CAAA,CAAE,EAAE,CAAA,GAAI,EAAA;AAAA,MACnB;AAAA,IACF;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,aAAA;AAAA,IACA,eAAA;AAAA,IACA,eAAA;AAAA,IACA,aAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,gBAAA;AAAA,IACA,KAAK,QAAA,CAAS;AAAA,GAChB;AACF","file":"chunk-FRYJMRTP.js","sourcesContent":["/**\n * @h-ai/kit — CRUD 操作定义\n *\n * 声明式 CRUD 资源定义工厂函数。\n * @module kit-crud\n */\n\nimport type {\n  CrudFieldDef,\n  CrudFieldOptions,\n  CrudOperations,\n  CrudResourceDef,\n  CrudTableColumn,\n  CrudText,\n} from './kit-crud-types.js'\n\n/**\n * 解析 CrudText 为字符串\n */\nfunction resolveText(text: CrudText): string {\n  return typeof text === 'function' ? text() : text\n}\n\n/**\n * 按 order 排序字段\n */\nfunction sortFields(fields: CrudFieldDef[]): CrudFieldDef[] {\n  return [...fields].sort((a, b) => (a.order ?? 0) - (b.order ?? 0))\n}\n\n/**\n * 解析选项列表\n */\nfunction resolveOptions(options: CrudFieldOptions | undefined): Array<{ label: string, value: string | number | boolean }> {\n  if (!options)\n    return []\n  return typeof options === 'function' ? options() : options\n}\n\n/**\n * 定义 CRUD 资源\n *\n * 返回 CrudOperations 对象，包含字段过滤、列构建和 API 代理等能力。\n * 与 @h-ai/ui 的 CrudPage 组件配合使用。\n *\n * @param resource - 资源定义\n * @returns CRUD 操作对象\n *\n * @example\n * ```ts\n * const userCrud = defineCrud({\n *   name: 'user',\n *   label: () => m.users_title(),\n *   fields: [\n *     { id: 'username', label: '用户名', type: 'string', validation: { required: true } },\n *     { id: 'email', label: '邮箱', type: 'email' },\n *   ],\n *   api: { list, get, create, update, remove },\n * })\n * ```\n */\nexport function defineCrud<T = Record<string, unknown>>(\n  resource: CrudResourceDef<T>,\n): CrudOperations<T> {\n  const fields = resource.fields\n\n  function getListFields(): CrudFieldDef[] {\n    return sortFields(fields.filter(f => f.inList !== false))\n  }\n\n  function getFilterFields(): CrudFieldDef[] {\n    return sortFields(fields.filter(f => f.filterable === true))\n  }\n\n  function getCreateFields(): CrudFieldDef[] {\n    return sortFields(fields.filter(f => f.inCreate !== false))\n  }\n\n  function getEditFields(): CrudFieldDef[] {\n    return sortFields(fields.filter(f => f.inEdit !== false))\n  }\n\n  function getDetailFields(): CrudFieldDef[] {\n    return sortFields(fields.filter(f => f.inDetail !== false))\n  }\n\n  function toTableColumns(): CrudTableColumn[] {\n    return getListFields().map(f => ({\n      key: f.id,\n      label: resolveText(f.label),\n      width: f.width,\n      align: f.align,\n      render: f.render\n        ? (item: Record<string, unknown>) => f.render!(item[f.id], item)\n        : undefined,\n    }))\n  }\n\n  function getDefaultValues(): Record<string, unknown> {\n    const defaults: Record<string, unknown> = {}\n    for (const f of fields) {\n      if (f.defaultValue !== undefined) {\n        defaults[f.id] = f.defaultValue\n      }\n      else if (f.type === 'boolean' || f.type === 'checkbox') {\n        defaults[f.id] = false\n      }\n      else if (f.type === 'multi-select') {\n        defaults[f.id] = []\n      }\n      else if (f.type === 'number') {\n        defaults[f.id] = undefined\n      }\n      else {\n        defaults[f.id] = ''\n      }\n    }\n    return defaults\n  }\n\n  return {\n    resource,\n    getListFields,\n    getFilterFields,\n    getCreateFields,\n    getEditFields,\n    getDetailFields,\n    toTableColumns,\n    getDefaultValues,\n    api: resource.api,\n  }\n}\n\n// re-export 解析工具，供 UI 层使用\nexport { resolveOptions, resolveText }\n"]}