@h-ai/kit 0.1.0-alpha5

package/dist/chunk-PHS7ZD5L.js

@@ -0,0 +1,274 @@
+import { isValidEncryptedPayload } from './chunk-6TMSXG7J.js';
+import process from 'process';
+
+var DEFAULT_TOKEN_COOKIE_NAME = "hai_access_token";
+var authState = {
+  cookieName: DEFAULT_TOKEN_COOKIE_NAME,
+  operations: null
+};
+function configureAuth(config) {
+  if (config.cookieName)
+    authState.cookieName = config.cookieName;
+  if (config.operations)
+    authState.operations = config.operations;
+}
+var defaultBrowserTokenStore = createTokenStore();
+function getBearerTokenFromRequest(request) {
+  const authorization = request.headers.get("authorization");
+  if (!authorization)
+    return null;
+  const [scheme, token] = authorization.split(" ");
+  if (!scheme || !token)
+    return null;
+  if (scheme.toLowerCase() !== "bearer")
+    return null;
+  const trimmed = token.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function getAccessToken(request, cookies) {
+  return getBearerTokenFromRequest(request) ?? cookies?.get(authState.cookieName) ?? null;
+}
+function setToken(cookies, token, maxAge) {
+  cookies.set(authState.cookieName, token, {
+    path: "/",
+    httpOnly: true,
+    sameSite: "lax",
+    secure: process.env.NODE_ENV === "production",
+    maxAge
+  });
+}
+function clearToken(cookies) {
+  cookies.delete(authState.cookieName, { path: "/" });
+}
+function getAuthOperations() {
+  if (!authState.operations) {
+    throw new Error("kit.auth \u672A\u914D\u7F6E\uFF1A\u8BF7\u5728 kit.createHandle() \u4E2D\u4F20\u5165 auth.operations");
+  }
+  return typeof authState.operations === "function" ? authState.operations() : authState.operations;
+}
+async function executeLogin(cookies, authPromise) {
+  const result = await authPromise;
+  if (result.success) {
+    setToken(cookies, result.data.tokens.accessToken, result.data.tokens.expiresIn);
+  }
+  return result;
+}
+async function login(cookies, credentials) {
+  return executeLogin(cookies, getAuthOperations().login(credentials));
+}
+async function loginWithOtp(cookies, credentials) {
+  return executeLogin(cookies, getAuthOperations().loginWithOtp(credentials));
+}
+async function loginWithLdap(cookies, credentials) {
+  return executeLogin(cookies, getAuthOperations().loginWithLdap(credentials));
+}
+async function loginWithApiKey(cookies, credentials) {
+  return executeLogin(cookies, getAuthOperations().loginWithApiKey(credentials));
+}
+async function registerAndLogin(cookies, options) {
+  return executeLogin(cookies, getAuthOperations().registerAndLogin(options));
+}
+async function logout(cookies, accessToken) {
+  if (accessToken) {
+    await getAuthOperations().logout(accessToken);
+  }
+  clearToken(cookies);
+}
+function createTokenStore(key = DEFAULT_TOKEN_COOKIE_NAME) {
+  return {
+    get() {
+      if (typeof window === "undefined") {
+        return null;
+      }
+      return window.localStorage.getItem(key);
+    },
+    set(token) {
+      if (typeof window === "undefined") {
+        return;
+      }
+      window.localStorage.setItem(key, token);
+    },
+    clear() {
+      if (typeof window === "undefined") {
+        return;
+      }
+      window.localStorage.removeItem(key);
+    }
+  };
+}
+function setBrowserToken(token) {
+  defaultBrowserTokenStore.set(token);
+}
+function clearBrowserToken() {
+  defaultBrowserTokenStore.clear();
+}
+function createHandleFetch(tokenStore = createTokenStore()) {
+  return async ({ event, request, fetch: fetch2 }) => {
+    const requestUrl = new URL(request.url);
+    if (requestUrl.origin !== event.url.origin)
+      return fetch2(request);
+    const token = tokenStore.get();
+    if (!token)
+      return fetch2(request);
+    const headers = new Headers(request.headers);
+    headers.set("Authorization", `Bearer ${token}`);
+    return fetch2(new Request(request, { headers }));
+  };
+}
+
+// src/client/kit-client.ts
+function getCookie(name) {
+  if (typeof document === "undefined")
+    return void 0;
+  const match = document.cookie.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
+  return match?.[1];
+}
+function createKitClient(config = {}) {
+  const {
+    transport: transportConfig,
+    csrfCookieName = "hai_csrf",
+    csrfHeaderName = "X-CSRF-Token",
+    auth: authConfig
+  } = config;
+  const authStore = authConfig ? authConfig === true ? createTokenStore() : authConfig : null;
+  let transportReady = false;
+  let clientKeyPair = null;
+  let serverPublicKey = null;
+  let clientId = null;
+  let initPromise = null;
+  async function doKeyExchange() {
+    if (!transportConfig)
+      return;
+    const { crypto: cryptoService, keyExchangeUrl = "/api/kit/key-exchange" } = transportConfig;
+    const keyPairResult = cryptoService.asymmetric.generateKeyPair();
+    if (!keyPairResult.success || !keyPairResult.data) {
+      throw new Error("Failed to generate client key pair");
+    }
+    clientKeyPair = keyPairResult.data;
+    const response = await fetch(keyExchangeUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ clientPublicKey: clientKeyPair.publicKey })
+    });
+    if (!response.ok) {
+      throw new Error(`Key exchange failed: ${response.status}`);
+    }
+    const data = await response.json();
+    if (!data.serverPublicKey || !data.clientId) {
+      throw new Error("Invalid key exchange response");
+    }
+    serverPublicKey = data.serverPublicKey;
+    clientId = data.clientId;
+    transportReady = true;
+  }
+  async function ensureTransportReady() {
+    if (transportReady)
+      return;
+    if (!initPromise) {
+      initPromise = doKeyExchange().finally(() => {
+        initPromise = null;
+      });
+    }
+    await initPromise;
+  }
+  function encryptBody(bodyText) {
+    if (!transportConfig || !serverPublicKey)
+      return bodyText;
+    const { crypto: cryptoService } = transportConfig;
+    const symmetricKey = cryptoService.symmetric.generateKey();
+    const encResult = cryptoService.symmetric.encryptWithIV(bodyText, symmetricKey);
+    if (!encResult.success || !encResult.data) {
+      throw new Error("Request body encryption failed");
+    }
+    const keyEncResult = cryptoService.asymmetric.encrypt(symmetricKey, serverPublicKey);
+    if (!keyEncResult.success || !keyEncResult.data) {
+      throw new Error("Symmetric key encryption failed");
+    }
+    const payload = {
+      encryptedKey: keyEncResult.data,
+      ciphertext: encResult.data.ciphertext,
+      iv: encResult.data.iv
+    };
+    return JSON.stringify(payload);
+  }
+  async function decryptResponse(response) {
+    if (!clientKeyPair || !transportConfig)
+      return response;
+    const encryptedBody = await response.json();
+    if (!isValidEncryptedPayload(encryptedBody))
+      return response;
+    const { crypto: cryptoService } = transportConfig;
+    const keyDecResult = cryptoService.asymmetric.decrypt(encryptedBody.encryptedKey, clientKeyPair.privateKey);
+    if (!keyDecResult.success || !keyDecResult.data) {
+      throw new Error("Response key decryption failed");
+    }
+    const decResult = cryptoService.symmetric.decryptWithIV(encryptedBody.ciphertext, keyDecResult.data, encryptedBody.iv);
+    if (!decResult.success || typeof decResult.data !== "string") {
+      throw new Error("Response body decryption failed");
+    }
+    return new Response(decResult.data, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: response.headers
+    });
+  }
+  async function apiFetch(url, init = {}) {
+    const method = (init.method ?? "GET").toUpperCase();
+    const isWriteMethod = !["GET", "HEAD", "OPTIONS"].includes(method);
+    const headers = new Headers(init.headers);
+    if (authStore) {
+      const token = authStore.get();
+      if (token) {
+        headers.set("Authorization", `Bearer ${token}`);
+      }
+    }
+    if (isWriteMethod) {
+      const csrfToken = getCookie(csrfCookieName);
+      if (csrfToken) {
+        headers.set(csrfHeaderName, csrfToken);
+      }
+    }
+    if (transportConfig) {
+      await ensureTransportReady();
+      if (clientId) {
+        headers.set("X-Client-Id", clientId);
+      }
+      if (init.body !== void 0 && init.body !== null) {
+        const bodyText = typeof init.body === "string" ? init.body : JSON.stringify(init.body);
+        const encrypted = encryptBody(bodyText);
+        headers.set("Content-Type", "application/json");
+        let response2 = await fetch(url, { ...init, headers, body: encrypted });
+        if (response2.headers.get("X-Encrypted") === "true") {
+          response2 = await decryptResponse(response2);
+        }
+        return response2;
+      }
+    }
+    let response = await fetch(url, { ...init, headers });
+    if (transportConfig && response.headers.get("X-Encrypted") === "true") {
+      response = await decryptResponse(response);
+    }
+    return response;
+  }
+  return {
+    apiFetch,
+    get ready() {
+      return !transportConfig || transportReady;
+    },
+    async init() {
+      if (transportConfig)
+        await ensureTransportReady();
+    },
+    destroy() {
+      clientKeyPair = null;
+      serverPublicKey = null;
+      clientId = null;
+      transportReady = false;
+      initPromise = null;
+    }
+  };
+}
+
+export { clearBrowserToken, configureAuth, createHandleFetch, createKitClient, createTokenStore, getAccessToken, login, loginWithApiKey, loginWithLdap, loginWithOtp, logout, registerAndLogin, setBrowserToken };
+//# sourceMappingURL=chunk-PHS7ZD5L.js.map
+//# sourceMappingURL=chunk-PHS7ZD5L.js.map

package/dist/chunk-PHS7ZD5L.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kit-auth.ts","../src/client/kit-client.ts"],"names":["fetch","response"],"mappings":";;;AAcA,IAAM,yBAAA,GAA4B,kBAAA;AAOlC,IAAM,SAAA,GAAY;AAAA,EAChB,UAAA,EAAY,yBAAA;AAAA,EACZ,UAAA,EAAY;AACd,CAAA;AAOO,SAAS,cAAc,MAAA,EAA4E;AACxG,EAAA,IAAI,MAAA,CAAO,UAAA;AACT,IAAA,SAAA,CAAU,aAAa,MAAA,CAAO,UAAA;AAChC,EAAA,IAAI,MAAA,CAAO,UAAA;AACT,IAAA,SAAA,CAAU,aAAa,MAAA,CAAO,UAAA;AAClC;AA+BA,IAAM,2BAA2B,gBAAA,EAAiB;AAO3C,SAAS,0BAA0B,OAAA,EAAiC;AACzE,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACzD,EAAA,IAAI,CAAC,aAAA;AACH,IAAA,OAAO,IAAA;AAET,EAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,aAAA,CAAc,MAAM,GAAG,CAAA;AAC/C,EAAA,IAAI,CAAC,UAAU,CAAC,KAAA;AACd,IAAA,OAAO,IAAA;AAET,EAAA,IAAI,MAAA,CAAO,aAAY,KAAM,QAAA;AAC3B,IAAA,OAAO,IAAA;AAET,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,EAAK;AAC3B,EAAA,OAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,GAAI,OAAA,GAAU,IAAA;AACxC;AAKO,SAAS,cAAA,CAAe,SAAkB,OAAA,EAAuC;AACtF,EAAA,OAAO,0BAA0B,OAAO,CAAA,IAAK,SAAS,GAAA,CAAI,SAAA,CAAU,UAAU,CAAA,IAAK,IAAA;AACrF;AAOA,SAAS,QAAA,CAAS,OAAA,EAAuB,KAAA,EAAe,MAAA,EAAuB;AAC7E,EAAA,OAAA,CAAQ,GAAA,CAAI,SAAA,CAAU,UAAA,EAAY,KAAA,EAAO;AAAA,IACvC,IAAA,EAAM,GAAA;AAAA,IACN,QAAA,EAAU,IAAA;AAAA,IACV,QAAA,EAAU,KAAA;AAAA,IACV,MAAA,EAAQ,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,YAAA;AAAA,IACjC;AAAA,GACD,CAAA;AACH;AAKA,SAAS,WAAW,OAAA,EAA6B;AAC/C,EAAA,OAAA,CAAQ,OAAO,SAAA,CAAU,UAAA,EAAY,EAAE,IAAA,EAAM,KAAK,CAAA;AACpD;AAOA,SAAS,iBAAA,GAAoC;AAC3C,EAAA,IAAI,CAAC,UAAU,UAAA,EAAY;AACzB,IAAA,MAAM,IAAI,MAAM,qGAAwD,CAAA;AAAA,EAC1E;AACA,EAAA,OAAO,OAAO,SAAA,CAAU,UAAA,KAAe,aACnC,SAAA,CAAU,UAAA,KACV,SAAA,CAAU,UAAA;AAChB;AAKA,eAAe,YAAA,CACb,SACA,WAAA,EACgC;AAChC,EAAA,MAAM,SAAS,MAAM,WAAA;AACrB,EAAA,IAAI,OAAO,OAAA,EAAS;AAClB,IAAA,QAAA,CAAS,OAAA,EAAS,OAAO,IAAA,CAAK,MAAA,CAAO,aAAa,MAAA,CAAO,IAAA,CAAK,OAAO,SAAS,CAAA;AAAA,EAChF;AACA,EAAA,OAAO,MAAA;AACT;AAgBA,eAAsB,KAAA,CACpB,SACA,WAAA,EACgC;AAChC,EAAA,OAAO,aAAa,OAAA,EAAS,iBAAA,EAAkB,CAAE,KAAA,CAAM,WAAW,CAAC,CAAA;AACrE;AAcA,eAAsB,YAAA,CACpB,SACA,WAAA,EACgC;AAChC,EAAA,OAAO,aAAa,OAAA,EAAS,iBAAA,EAAkB,CAAE,YAAA,CAAa,WAAW,CAAC,CAAA;AAC5E;AAcA,eAAsB,aAAA,CACpB,SACA,WAAA,EACgC;AAChC,EAAA,OAAO,aAAa,OAAA,EAAS,iBAAA,EAAkB,CAAE,aAAA,CAAc,WAAW,CAAC,CAAA;AAC7E;AAeA,eAAsB,eAAA,CACpB,SACA,WAAA,EACgC;AAChC,EAAA,OAAO,aAAa,OAAA,EAAS,iBAAA,EAAkB,CAAE,eAAA,CAAgB,WAAW,CAAC,CAAA;AAC/E;AAcA,eAAsB,gBAAA,CACpB,SACA,OAAA,EACgC;AAChC,EAAA,OAAO,aAAa,OAAA,EAAS,iBAAA,EAAkB,CAAE,gBAAA,CAAiB,OAAO,CAAC,CAAA;AAC5E;AAcA,eAAsB,MAAA,CACpB,SACA,WAAA,EACe;AACf,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,MAAM,iBAAA,EAAkB,CAAE,MAAA,CAAO,WAAW,CAAA;AAAA,EAC9C;AACA,EAAA,UAAA,CAAW,OAAO,CAAA;AACpB;AASO,SAAS,gBAAA,CAAiB,MAAM,yBAAA,EAA8C;AACnF,EAAA,OAAO;AAAA,IACL,GAAA,GAAqB;AACnB,MAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,QAAA,OAAO,IAAA;AAAA,MACT;AACA,MAAA,OAAO,MAAA,CAAO,YAAA,CAAa,OAAA,CAAQ,GAAG,CAAA;AAAA,IACxC,CAAA;AAAA,IACA,IAAI,KAAA,EAAqB;AACvB,MAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,QAAA;AAAA,MACF;AACA,MAAA,MAAA,CAAO,YAAA,CAAa,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAA;AAAA,IACxC,CAAA;AAAA,IACA,KAAA,GAAc;AACZ,MAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,QAAA;AAAA,MACF;AACA,MAAA,MAAA,CAAO,YAAA,CAAa,WAAW,GAAG,CAAA;AAAA,IACpC;AAAA,GACF;AACF;AAKO,SAAS,gBAAgB,KAAA,EAAqB;AACnD,EAAA,wBAAA,CAAyB,IAAI,KAAK,CAAA;AACpC;AAKO,SAAS,iBAAA,GAA0B;AACxC,EAAA,wBAAA,CAAyB,KAAA,EAAM;AACjC;AAOO,SAAS,iBAAA,CAAkB,UAAA,GAAgC,gBAAA,EAAiB,EAAgB;AACjG,EAAA,OAAO,OAAO,EAAE,KAAA,EAAO,OAAA,EAAS,KAAA,EAAAA,QAAM,KAAM;AAC1C,IAAA,MAAM,UAAA,GAAa,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AACtC,IAAA,IAAI,UAAA,CAAW,MAAA,KAAW,KAAA,CAAM,GAAA,CAAI,MAAA;AAClC,MAAA,OAAOA,OAAM,OAAO,CAAA;AAEtB,IAAA,MAAM,KAAA,GAAQ,WAAW,GAAA,EAAI;AAC7B,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAOA,OAAM,OAAO,CAAA;AAEtB,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA;AAC3C,IAAA,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,KAAK,CAAA,CAAE,CAAA;AAE9C,IAAA,OAAOA,OAAM,IAAI,OAAA,CAAQ,SAAS,EAAE,OAAA,EAAS,CAAC,CAAA;AAAA,EAChD,CAAA;AACF;;;ACrQA,SAAS,UAAU,IAAA,EAAkC;AACnD,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,OAAO,MAAA;AACT,EAAA,MAAM,KAAA,GAAQ,SAAS,MAAA,CAAO,KAAA,CAAM,IAAI,MAAA,CAAO,CAAA,WAAA,EAAc,IAAI,CAAA,QAAA,CAAU,CAAC,CAAA;AAC5E,EAAA,OAAO,QAAQ,CAAC,CAAA;AAClB;AAsBO,SAAS,eAAA,CAAgB,MAAA,GAA0B,EAAC,EAAc;AACvE,EAAA,MAAM;AAAA,IACJ,SAAA,EAAW,eAAA;AAAA,IACX,cAAA,GAAiB,UAAA;AAAA,IACjB,cAAA,GAAiB,cAAA;AAAA,IACjB,IAAA,EAAM;AAAA,GACR,GAAI,MAAA;AAGJ,EAAA,MAAM,YAAsC,UAAA,GACvC,UAAA,KAAe,IAAA,GAAO,gBAAA,KAAqB,UAAA,GAC5C,IAAA;AAGJ,EAAA,IAAI,cAAA,GAAiB,KAAA;AACrB,EAAA,IAAI,aAAA,GAAyC,IAAA;AAC7C,EAAA,IAAI,eAAA,GAAiC,IAAA;AACrC,EAAA,IAAI,QAAA,GAA0B,IAAA;AAE9B,EAAA,IAAI,WAAA,GAAoC,IAAA;AAKxC,EAAA,eAAe,aAAA,GAA+B;AAC5C,IAAA,IAAI,CAAC,eAAA;AACH,MAAA;AAEF,IAAA,MAAM,EAAE,MAAA,EAAQ,aAAA,EAAe,cAAA,GAAiB,yBAAwB,GAAI,eAAA;AAG5E,IAAA,MAAM,aAAA,GAAgB,aAAA,CAAc,UAAA,CAAW,eAAA,EAAgB;AAC/D,IAAA,IAAI,CAAC,aAAA,CAAc,OAAA,IAAW,CAAC,cAAc,IAAA,EAAM;AACjD,MAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,IACtD;AACA,IAAA,aAAA,GAAgB,aAAA,CAAc,IAAA;AAG9B,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,cAAA,EAAgB;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAC9C,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,eAAA,EAAiB,aAAA,CAAc,WAAW;AAAA,KAClE,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qBAAA,EAAwB,QAAA,CAAS,MAAM,CAAA,CAAE,CAAA;AAAA,IAC3D;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,IAAI,CAAC,IAAA,CAAK,eAAA,IAAmB,CAAC,KAAK,QAAA,EAAU;AAC3C,MAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,IACjD;AAEA,IAAA,eAAA,GAAkB,IAAA,CAAK,eAAA;AACvB,IAAA,QAAA,GAAW,IAAA,CAAK,QAAA;AAChB,IAAA,cAAA,GAAiB,IAAA;AAAA,EACnB;AAKA,EAAA,eAAe,oBAAA,GAAsC;AACnD,IAAA,IAAI,cAAA;AACF,MAAA;AACF,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,WAAA,GAAc,aAAA,EAAc,CAAE,OAAA,CAAQ,MAAM;AAC1C,QAAA,WAAA,GAAc,IAAA;AAAA,MAChB,CAAC,CAAA;AAAA,IACH;AACA,IAAA,MAAM,WAAA;AAAA,EACR;AAKA,EAAA,SAAS,YAAY,QAAA,EAA0B;AAC7C,IAAA,IAAI,CAAC,mBAAmB,CAAC,eAAA;AACvB,MAAA,OAAO,QAAA;AAET,IAAA,MAAM,EAAE,MAAA,EAAQ,aAAA,EAAc,GAAI,eAAA;AAGlC,IAAA,MAAM,YAAA,GAAe,aAAA,CAAc,SAAA,CAAU,WAAA,EAAY;AAGzD,IAAA,MAAM,SAAA,GAAY,aAAA,CAAc,SAAA,CAAU,aAAA,CAAc,UAAU,YAAY,CAAA;AAC9E,IAAA,IAAI,CAAC,SAAA,CAAU,OAAA,IAAW,CAAC,UAAU,IAAA,EAAM;AACzC,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AAGA,IAAA,MAAM,YAAA,GAAe,aAAA,CAAc,UAAA,CAAW,OAAA,CAAQ,cAAc,eAAe,CAAA;AACnF,IAAA,IAAI,CAAC,YAAA,CAAa,OAAA,IAAW,CAAC,aAAa,IAAA,EAAM;AAC/C,MAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,IACnD;AAEA,IAAA,MAAM,OAAA,GAA4B;AAAA,MAChC,cAAc,YAAA,CAAa,IAAA;AAAA,MAC3B,UAAA,EAAY,UAAU,IAAA,CAAK,UAAA;AAAA,MAC3B,EAAA,EAAI,UAAU,IAAA,CAAK;AAAA,KACrB;AAEA,IAAA,OAAO,IAAA,CAAK,UAAU,OAAO,CAAA;AAAA,EAC/B;AAKA,EAAA,eAAe,gBAAgB,QAAA,EAAuC;AACpE,IAAA,IAAI,CAAC,iBAAiB,CAAC,eAAA;AACrB,MAAA,OAAO,QAAA;AAET,IAAA,MAAM,aAAA,GAAgB,MAAM,QAAA,CAAS,IAAA,EAAK;AAC1C,IAAA,IAAI,CAAC,wBAAwB,aAAa,CAAA;AACxC,MAAA,OAAO,QAAA;AAET,IAAA,MAAM,EAAE,MAAA,EAAQ,aAAA,EAAc,GAAI,eAAA;AAGlC,IAAA,MAAM,eAAe,aAAA,CAAc,UAAA,CAAW,QAAQ,aAAA,CAAc,YAAA,EAAc,cAAc,UAAU,CAAA;AAC1G,IAAA,IAAI,CAAC,YAAA,CAAa,OAAA,IAAW,CAAC,aAAa,IAAA,EAAM;AAC/C,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AAGA,IAAA,MAAM,SAAA,GAAY,cAAc,SAAA,CAAU,aAAA,CAAc,cAAc,UAAA,EAAY,YAAA,CAAa,IAAA,EAAM,aAAA,CAAc,EAAE,CAAA;AACrH,IAAA,IAAI,CAAC,SAAA,CAAU,OAAA,IAAW,OAAO,SAAA,CAAU,SAAS,QAAA,EAAU;AAC5D,MAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,IACnD;AAEA,IAAA,OAAO,IAAI,QAAA,CAAS,SAAA,CAAU,IAAA,EAAM;AAAA,MAClC,QAAQ,QAAA,CAAS,MAAA;AAAA,MACjB,YAAY,QAAA,CAAS,UAAA;AAAA,MACrB,SAAS,QAAA,CAAS;AAAA,KACnB,CAAA;AAAA,EACH;AAKA,EAAA,eAAe,QAAA,CAAS,GAAA,EAAa,IAAA,GAAoB,EAAC,EAAsB;AAC9E,IAAA,MAAM,MAAA,GAAA,CAAU,IAAA,CAAK,MAAA,IAAU,KAAA,EAAO,WAAA,EAAY;AAClD,IAAA,MAAM,aAAA,GAAgB,CAAC,CAAC,KAAA,EAAO,QAAQ,SAAS,CAAA,CAAE,SAAS,MAAM,CAAA;AAEjE,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA;AAGxC,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,MAAM,KAAA,GAAQ,UAAU,GAAA,EAAI;AAC5B,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,KAAK,CAAA,CAAE,CAAA;AAAA,MAChD;AAAA,IACF;AAGA,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,MAAM,SAAA,GAAY,UAAU,cAAc,CAAA;AAC1C,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,OAAA,CAAQ,GAAA,CAAI,gBAAgB,SAAS,CAAA;AAAA,MACvC;AAAA,IACF;AAGA,IAAA,IAAI,eAAA,EAAiB;AACnB,MAAA,MAAM,oBAAA,EAAqB;AAE3B,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,OAAA,CAAQ,GAAA,CAAI,eAAe,QAAQ,CAAA;AAAA,MACrC;AAGA,MAAA,IAAI,IAAA,CAAK,IAAA,KAAS,MAAA,IAAa,IAAA,CAAK,SAAS,IAAA,EAAM;AACjD,QAAA,MAAM,QAAA,GAAW,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,GAAW,KAAK,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AACrF,QAAA,MAAM,SAAA,GAAY,YAAY,QAAQ,CAAA;AACtC,QAAA,OAAA,CAAQ,GAAA,CAAI,gBAAgB,kBAAkB,CAAA;AAE9C,QAAA,IAAIC,SAAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAW,CAAA;AAGrE,QAAA,IAAIA,SAAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,MAAM,MAAA,EAAQ;AAClD,UAAAA,SAAAA,GAAW,MAAM,eAAA,CAAgBA,SAAQ,CAAA;AAAA,QAC3C;AAEA,QAAA,OAAOA,SAAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,SAAS,CAAA;AAGpD,IAAA,IAAI,mBAAmB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,MAAM,MAAA,EAAQ;AACrE,MAAA,QAAA,GAAW,MAAM,gBAAgB,QAAQ,CAAA;AAAA,IAC3C;AAEA,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,IAAI,KAAA,GAAQ;AAAE,MAAA,OAAO,CAAC,eAAA,IAAmB,cAAA;AAAA,IAAe,CAAA;AAAA,IACxD,MAAM,IAAA,GAAO;AACX,MAAA,IAAI,eAAA;AACF,QAAA,MAAM,oBAAA,EAAqB;AAAA,IAC/B,CAAA;AAAA,IACA,OAAA,GAAU;AACR,MAAA,aAAA,GAAgB,IAAA;AAChB,MAAA,eAAA,GAAkB,IAAA;AAClB,MAAA,QAAA,GAAW,IAAA;AACX,MAAA,cAAA,GAAiB,KAAA;AACjB,MAAA,WAAA,GAAc,IAAA;AAAA,IAChB;AAAA,GACF;AACF","file":"chunk-PHS7ZD5L.js","sourcesContent":["/**\n * @h-ai/kit — Bearer 认证工具\n *\n * 提供服务端认证 Cookie 管理（login / logout）与浏览器端 Token 存储工具。\n * @module kit-auth\n */\n\nimport type { HaiResult } from '@h-ai/core'\nimport type { ApiKeyCredentials, AuthResult, LdapCredentials, OtpCredentials, PasswordCredentials, RegisterOptions } from '@h-ai/iam'\nimport type { HandleFetch } from '@sveltejs/kit'\nimport type { AuthOperations, AuthOperationsProvider } from './kit-types.js'\nimport process from 'node:process'\n\n/** 默认 Token Cookie 名 */\nconst DEFAULT_TOKEN_COOKIE_NAME = 'hai_access_token'\n\n/**\n * 应用级认证配置（由 createHandle 一次性初始化，生命周期同进程）\n *\n * 此状态非请求级：仅在 createHandle() 时写入一次，后续所有请求只读访问。\n */\nconst authState = {\n  cookieName: DEFAULT_TOKEN_COOKIE_NAME,\n  operations: null as AuthOperationsProvider | null,\n}\n\n/**\n * 配置认证参数\n *\n * 通常由 `createHandle` 在初始化时自动调用，无需手动调用。\n */\nexport function configureAuth(config: { cookieName?: string, operations?: AuthOperationsProvider }): void {\n  if (config.cookieName)\n    authState.cookieName = config.cookieName\n  if (config.operations)\n    authState.operations = config.operations\n}\n\n/**\n * 获取当前配置的 Token Cookie 名\n */\nexport function getTokenCookieName(): string {\n  return authState.cookieName\n}\n\ninterface CookieReader {\n  get: (name: string) => string | undefined\n}\n\ninterface CookieWriter {\n  set: (name: string, value: string, options: {\n    path: string\n    httpOnly: boolean\n    sameSite: 'lax' | 'strict' | 'none'\n    secure: boolean\n    maxAge?: number\n  }) => void\n  delete: (name: string, options: { path: string }) => void\n}\n\n/** 浏览器 Token 存储器 */\nexport interface BrowserTokenStore {\n  get: () => string | null\n  set: (token: string) => void\n  clear: () => void\n}\n\nconst defaultBrowserTokenStore = createTokenStore()\n\n// ─── 内部工具（仅 kit 包内使用） ───\n\n/**\n * 从请求 Authorization 头提取 Bearer Token。\n */\nexport function getBearerTokenFromRequest(request: Request): string | null {\n  const authorization = request.headers.get('authorization')\n  if (!authorization)\n    return null\n\n  const [scheme, token] = authorization.split(' ')\n  if (!scheme || !token)\n    return null\n\n  if (scheme.toLowerCase() !== 'bearer')\n    return null\n\n  const trimmed = token.trim()\n  return trimmed.length > 0 ? trimmed : null\n}\n\n/**\n * 从请求中统一提取 Access Token（Bearer 优先，其次配置的 Cookie 名）。\n */\nexport function getAccessToken(request: Request, cookies?: CookieReader): string | null {\n  return getBearerTokenFromRequest(request) ?? cookies?.get(authState.cookieName) ?? null\n}\n\n// ─── 服务端认证 Cookie 管理 ───\n\n/**\n * 写入 Access Token Cookie（内部使用，由 login 自动调用）。\n */\nfunction setToken(cookies: CookieWriter, token: string, maxAge?: number): void {\n  cookies.set(authState.cookieName, token, {\n    path: '/',\n    httpOnly: true,\n    sameSite: 'lax',\n    secure: process.env.NODE_ENV === 'production',\n    maxAge,\n  })\n}\n\n/**\n * 清除 Access Token Cookie（内部使用，由 logout 自动调用）。\n */\nfunction clearToken(cookies: CookieWriter): void {\n  cookies.delete(authState.cookieName, { path: '/' })\n}\n\n// ─── 服务端高级认证 API（通过 kit.auth 暴露） ───\n\n/**\n * 获取已注入的认证操作（未配置时抛出编程错误）\n */\nfunction getAuthOperations(): AuthOperations {\n  if (!authState.operations) {\n    throw new Error('kit.auth 未配置：请在 kit.createHandle() 中传入 auth.operations')\n  }\n  return typeof authState.operations === 'function'\n    ? authState.operations()\n    : authState.operations\n}\n\n/**\n * 内部工具：执行认证操作并在成功时写入 Token Cookie。\n */\nasync function executeLogin(\n  cookies: CookieWriter,\n  authPromise: Promise<HaiResult<AuthResult>>,\n): Promise<HaiResult<AuthResult>> {\n  const result = await authPromise\n  if (result.success) {\n    setToken(cookies, result.data.tokens.accessToken, result.data.tokens.expiresIn)\n  }\n  return result\n}\n\n/**\n * 服务端登录（密码）：内部调用 iam.auth.login，成功时自动写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param credentials - 密码凭证（identifier + password）\n * @returns 认证结果（成功时 Cookie 已自动写入）\n *\n * @example\n * ```ts\n * const result = await kit.auth.login(cookies, { identifier, password })\n * if (!result.success) return kit.response.fromError(result.error, IamErrorHttpStatus)\n * const { user, roles, permissions } = result.data\n * ```\n */\nexport async function login(\n  cookies: CookieWriter,\n  credentials: PasswordCredentials,\n): Promise<HaiResult<AuthResult>> {\n  return executeLogin(cookies, getAuthOperations().login(credentials))\n}\n\n/**\n * 服务端登录（OTP 验证码）：内部调用 iam.auth.loginWithOtp，成功时自动写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param credentials - OTP 凭证（identifier + code）\n * @returns 认证结果（成功时 Cookie 已自动写入）\n *\n * @example\n * ```ts\n * const result = await kit.auth.loginWithOtp(cookies, { identifier, code })\n * ```\n */\nexport async function loginWithOtp(\n  cookies: CookieWriter,\n  credentials: OtpCredentials,\n): Promise<HaiResult<AuthResult>> {\n  return executeLogin(cookies, getAuthOperations().loginWithOtp(credentials))\n}\n\n/**\n * 服务端登录（LDAP）：内部调用 iam.auth.loginWithLdap，成功时自动写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param credentials - LDAP 凭证（username + password）\n * @returns 认证结果（成功时 Cookie 已自动写入）\n *\n * @example\n * ```ts\n * const result = await kit.auth.loginWithLdap(cookies, { username, password })\n * ```\n */\nexport async function loginWithLdap(\n  cookies: CookieWriter,\n  credentials: LdapCredentials,\n): Promise<HaiResult<AuthResult>> {\n  return executeLogin(cookies, getAuthOperations().loginWithLdap(credentials))\n}\n\n/**\n * 服务端登录（API Key）：内部调用 iam.auth.loginWithApiKey，成功时自动写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param credentials - API Key 凭证（key）\n * @returns 认证结果（成功时 Cookie 已自动写入）\n *\n * @example\n * ```ts\n * const result = await kit.auth.loginWithApiKey(cookies, { key: apiKey })\n * if (!result.success) return kit.response.fromError(result.error, IamErrorHttpStatus)\n * ```\n */\nexport async function loginWithApiKey(\n  cookies: CookieWriter,\n  credentials: ApiKeyCredentials,\n): Promise<HaiResult<AuthResult>> {\n  return executeLogin(cookies, getAuthOperations().loginWithApiKey(credentials))\n}\n\n/**\n * 服务端注册并登录：内部调用 iam.auth.registerAndLogin，成功时自动写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param options - 注册选项（username、password、email 等）\n * @returns 认证结果（成功时 Cookie 已自动写入）\n *\n * @example\n * ```ts\n * const result = await kit.auth.registerAndLogin(cookies, { username, email, password })\n * ```\n */\nexport async function registerAndLogin(\n  cookies: CookieWriter,\n  options: RegisterOptions,\n): Promise<HaiResult<AuthResult>> {\n  return executeLogin(cookies, getAuthOperations().registerAndLogin(options))\n}\n\n/**\n * 服务端登出：内部调用 iam.auth.logout 使会话失效，并清除 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param accessToken - 访问令牌（为 null/undefined 时仅清除 Cookie）\n *\n * @example\n * ```ts\n * await kit.auth.logout(cookies, locals.accessToken)\n * return kit.response.ok(null)\n * ```\n */\nexport async function logout(\n  cookies: CookieWriter,\n  accessToken?: string | null,\n): Promise<void> {\n  if (accessToken) {\n    await getAuthOperations().logout(accessToken)\n  }\n  clearToken(cookies)\n}\n\n// ─── 浏览器端 Token 存储（通过 kit.auth 暴露） ───\n\n/**\n * 创建浏览器端 Token 存储器（localStorage）。\n *\n * @param key - localStorage 键名，默认 `'hai_access_token'`\n */\nexport function createTokenStore(key = DEFAULT_TOKEN_COOKIE_NAME): BrowserTokenStore {\n  return {\n    get(): string | null {\n      if (typeof window === 'undefined') {\n        return null\n      }\n      return window.localStorage.getItem(key)\n    },\n    set(token: string): void {\n      if (typeof window === 'undefined') {\n        return\n      }\n      window.localStorage.setItem(key, token)\n    },\n    clear(): void {\n      if (typeof window === 'undefined') {\n        return\n      }\n      window.localStorage.removeItem(key)\n    },\n  }\n}\n\n/**\n * 写入浏览器端 Access Token。\n */\nexport function setBrowserToken(token: string): void {\n  defaultBrowserTokenStore.set(token)\n}\n\n/**\n * 清除浏览器端 Access Token。\n */\nexport function clearBrowserToken(): void {\n  defaultBrowserTokenStore.clear()\n}\n\n// ─── HandleFetch 工厂（通过 kit.auth 暴露） ───\n\n/**\n * 创建浏览器端同源请求自动附加 Access Token 的 HandleFetch。\n */\nexport function createHandleFetch(tokenStore: BrowserTokenStore = createTokenStore()): HandleFetch {\n  return async ({ event, request, fetch }) => {\n    const requestUrl = new URL(request.url)\n    if (requestUrl.origin !== event.url.origin)\n      return fetch(request)\n\n    const token = tokenStore.get()\n    if (!token)\n      return fetch(request)\n\n    const headers = new Headers(request.headers)\n    headers.set('Authorization', `Bearer ${token}`)\n\n    return fetch(new Request(request, { headers }))\n  }\n}\n","/**\n * @h-ai/kit — 统一客户端\n *\n * 将 CSRF Token 附加与可选传输加密封装为统一 `apiFetch`。\n * 应用层只需调用一次 `createKitClient()`，后续 API 调用即可复用同一套安全能力。\n * @module kit-client\n */\n\nimport type { BrowserTokenStore } from '../kit-auth.js'\nimport type { EncryptedPayload, TransportCryptoServiceLike, TransportKeyPair } from '../modules/crypto/kit-crypto-types.js'\nimport { createTokenStore } from '../kit-auth.js'\nimport { isValidEncryptedPayload } from '../modules/crypto/kit-transport-encryption.js'\n\n// ─── 类型 ───\n\n/**\n * 传输加密客户端配置\n */\nexport interface ClientTransportConfig {\n  /** 传输加密服务实例（@h-ai/crypto 的 asymmetric + symmetric） */\n  crypto: TransportCryptoServiceLike\n  /** 密钥交换端点 URL（默认 `'/api/kit/key-exchange'`） */\n  keyExchangeUrl?: string\n}\n\n/**\n * Kit 客户端配置\n */\nexport interface KitClientConfig {\n  /**\n   * 传输加密配置。\n   * - 不提供 / undefined：不启用传输加密，仅 CSRF\n   * - 提供对象：启用传输加密\n   */\n  transport?: ClientTransportConfig\n  /** CSRF Cookie 名称（默认 `'hai_csrf'`） */\n  csrfCookieName?: string\n  /** CSRF Header 名称（默认 `'X-CSRF-Token'`） */\n  csrfHeaderName?: string\n  /**\n   * 认证配置：自动从浏览器存储读取 Access Token 并注入请求头。\n   * - `true`：使用默认 localStorage 存储（key = `hai_access_token`）\n   * - `BrowserTokenStore`：使用自定义存储\n   * - 不提供 / `false`：不自动注入\n   */\n  auth?: boolean | BrowserTokenStore\n}\n\n/**\n * Kit 客户端实例\n */\nexport interface KitClient {\n  /** 统一 API fetch（写请求自动附加 CSRF，启用 transport 时自动加解密） */\n  apiFetch: (url: string, init?: RequestInit) => Promise<Response>\n  /** 传输加密是否就绪（未启用传输加密时始终为 true） */\n  readonly ready: boolean\n  /** 手动触发密钥交换（transport 启用时） */\n  init: () => Promise<void>\n  /** 销毁密钥状态 */\n  destroy: () => void\n}\n\n// ─── 工具函数 ───\n\n/**\n * 从 document.cookie 中读取指定名称的 Cookie 值\n *\n * @param name - Cookie 名称\n * @returns Cookie 值；不存在或运行在服务端时返回 undefined\n */\nfunction getCookie(name: string): string | undefined {\n  if (typeof document === 'undefined')\n    return undefined\n  const match = document.cookie.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`))\n  return match?.[1]\n}\n\n// ─── 主函数 ───\n\n/**\n * 创建 Kit 客户端\n *\n * 返回统一的 `apiFetch`，内部自动完成：\n * 1. CSRF Token 附加（写方法自动读取 Cookie + 设置 Header）\n * 2. 密钥交换（首次写请求时 lazy init，transport 启用时）\n * 3. 请求体加密（transport 启用时）\n * 4. 响应体解密（transport 启用时）\n *\n * @param config - 客户端配置\n * @returns KitClient 实例\n *\n * @example\n * ```ts\n * const client = createKitClient({ transport: { crypto } })\n * const res = await client.apiFetch('/api/users', { method: 'POST', body: '{}' })\n * ```\n */\nexport function createKitClient(config: KitClientConfig = {}): KitClient {\n  const {\n    transport: transportConfig,\n    csrfCookieName = 'hai_csrf',\n    csrfHeaderName = 'X-CSRF-Token',\n    auth: authConfig,\n  } = config\n\n  // ── Auth token store ──\n  const authStore: BrowserTokenStore | null = authConfig\n    ? (authConfig === true ? createTokenStore() : authConfig)\n    : null\n\n  // ── 传输加密状态 ──\n  let transportReady = false\n  let clientKeyPair: TransportKeyPair | null = null\n  let serverPublicKey: string | null = null\n  let clientId: string | null = null\n  /** 密钥交换锁，防止并发 init */\n  let initPromise: Promise<void> | null = null\n\n  /**\n   * 执行密钥交换\n   */\n  async function doKeyExchange(): Promise<void> {\n    if (!transportConfig)\n      return\n\n    const { crypto: cryptoService, keyExchangeUrl = '/api/kit/key-exchange' } = transportConfig\n\n    // 1. 生成客户端非对称密钥对\n    const keyPairResult = cryptoService.asymmetric.generateKeyPair()\n    if (!keyPairResult.success || !keyPairResult.data) {\n      throw new Error('Failed to generate client key pair')\n    }\n    clientKeyPair = keyPairResult.data\n\n    // 2. 与服务端交换公钥\n    const response = await fetch(keyExchangeUrl, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({ clientPublicKey: clientKeyPair.publicKey }),\n    })\n\n    if (!response.ok) {\n      throw new Error(`Key exchange failed: ${response.status}`)\n    }\n\n    const data = await response.json() as { serverPublicKey?: string, clientId?: string }\n    if (!data.serverPublicKey || !data.clientId) {\n      throw new Error('Invalid key exchange response')\n    }\n\n    serverPublicKey = data.serverPublicKey\n    clientId = data.clientId\n    transportReady = true\n  }\n\n  /**\n   * 确保密钥交换完成（lazy init + 单例锁）\n   */\n  async function ensureTransportReady(): Promise<void> {\n    if (transportReady)\n      return\n    if (!initPromise) {\n      initPromise = doKeyExchange().finally(() => {\n        initPromise = null\n      })\n    }\n    await initPromise\n  }\n\n  /**\n   * 加密请求体\n   */\n  function encryptBody(bodyText: string): string {\n    if (!transportConfig || !serverPublicKey)\n      return bodyText\n\n    const { crypto: cryptoService } = transportConfig\n\n    // 1. 生成随机对称密钥\n    const symmetricKey = cryptoService.symmetric.generateKey()\n\n    // 2. 对称加密内容\n    const encResult = cryptoService.symmetric.encryptWithIV(bodyText, symmetricKey)\n    if (!encResult.success || !encResult.data) {\n      throw new Error('Request body encryption failed')\n    }\n\n    // 3. 非对称加密对称密钥\n    const keyEncResult = cryptoService.asymmetric.encrypt(symmetricKey, serverPublicKey)\n    if (!keyEncResult.success || !keyEncResult.data) {\n      throw new Error('Symmetric key encryption failed')\n    }\n\n    const payload: EncryptedPayload = {\n      encryptedKey: keyEncResult.data,\n      ciphertext: encResult.data.ciphertext,\n      iv: encResult.data.iv,\n    }\n\n    return JSON.stringify(payload)\n  }\n\n  /**\n   * 解密响应体\n   */\n  async function decryptResponse(response: Response): Promise<Response> {\n    if (!clientKeyPair || !transportConfig)\n      return response\n\n    const encryptedBody = await response.json() as unknown\n    if (!isValidEncryptedPayload(encryptedBody))\n      return response\n\n    const { crypto: cryptoService } = transportConfig\n\n    // 1. 非对称解密对称密钥\n    const keyDecResult = cryptoService.asymmetric.decrypt(encryptedBody.encryptedKey, clientKeyPair.privateKey)\n    if (!keyDecResult.success || !keyDecResult.data) {\n      throw new Error('Response key decryption failed')\n    }\n\n    // 2. 对称解密内容\n    const decResult = cryptoService.symmetric.decryptWithIV(encryptedBody.ciphertext, keyDecResult.data, encryptedBody.iv)\n    if (!decResult.success || typeof decResult.data !== 'string') {\n      throw new Error('Response body decryption failed')\n    }\n\n    return new Response(decResult.data, {\n      status: response.status,\n      statusText: response.statusText,\n      headers: response.headers,\n    })\n  }\n\n  /**\n   * 统一 API fetch\n   */\n  async function apiFetch(url: string, init: RequestInit = {}): Promise<Response> {\n    const method = (init.method ?? 'GET').toUpperCase()\n    const isWriteMethod = !['GET', 'HEAD', 'OPTIONS'].includes(method)\n\n    const headers = new Headers(init.headers)\n\n    // ── Auth ──\n    if (authStore) {\n      const token = authStore.get()\n      if (token) {\n        headers.set('Authorization', `Bearer ${token}`)\n      }\n    }\n\n    // ── CSRF ──\n    if (isWriteMethod) {\n      const csrfToken = getCookie(csrfCookieName)\n      if (csrfToken) {\n        headers.set(csrfHeaderName, csrfToken)\n      }\n    }\n\n    // ── 传输加密 ──\n    if (transportConfig) {\n      await ensureTransportReady()\n\n      if (clientId) {\n        headers.set('X-Client-Id', clientId)\n      }\n\n      // 加密请求体（写方法且有 body 时）\n      if (init.body !== undefined && init.body !== null) {\n        const bodyText = typeof init.body === 'string' ? init.body : JSON.stringify(init.body)\n        const encrypted = encryptBody(bodyText)\n        headers.set('Content-Type', 'application/json')\n\n        let response = await fetch(url, { ...init, headers, body: encrypted })\n\n        // 解密响应\n        if (response.headers.get('X-Encrypted') === 'true') {\n          response = await decryptResponse(response)\n        }\n\n        return response\n      }\n    }\n\n    // ── 发送 ──\n    let response = await fetch(url, { ...init, headers })\n\n    // ── 解密响应（GET/无 body 写请求也可能有加密响应） ──\n    if (transportConfig && response.headers.get('X-Encrypted') === 'true') {\n      response = await decryptResponse(response)\n    }\n\n    return response\n  }\n\n  return {\n    apiFetch,\n    get ready() { return !transportConfig || transportReady },\n    async init() {\n      if (transportConfig)\n        await ensureTransportReady()\n    },\n    destroy() {\n      clientKeyPair = null\n      serverPublicKey = null\n      clientId = null\n      transportReady = false\n      initPromise = null\n    },\n  }\n}\n"]}

package/dist/client/index.d.ts

@@ -0,0 +1,5 @@
+export { C as ClientTransportConfig, K as KitClient, e as KitClientConfig, c as createKitClient } from '../index-BotXLTck.js';
+import '@h-ai/core';
+import '@h-ai/iam';
+import '@sveltejs/kit';
+import '../kit-crypto-types-C-gEvx04.js';

package/dist/client/index.js

@@ -0,0 +1,4 @@
+export { createKitClient } from '../chunk-PHS7ZD5L.js';
+import '../chunk-6TMSXG7J.js';
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}

package/dist/index-BotXLTck.d.ts

@@ -0,0 +1,203 @@
+import { HaiResult } from '@h-ai/core';
+import { PasswordCredentials, AuthResult, OtpCredentials, LdapCredentials, ApiKeyCredentials, RegisterOptions } from '@h-ai/iam';
+import { HandleFetch } from '@sveltejs/kit';
+import { T as TransportCryptoServiceLike } from './kit-crypto-types-C-gEvx04.js';
+
+/**
+ * @h-ai/kit — Bearer 认证工具
+ *
+ * 提供服务端认证 Cookie 管理（login / logout）与浏览器端 Token 存储工具。
+ * @module kit-auth
+ */
+
+interface CookieWriter {
+    set: (name: string, value: string, options: {
+        path: string;
+        httpOnly: boolean;
+        sameSite: 'lax' | 'strict' | 'none';
+        secure: boolean;
+        maxAge?: number;
+    }) => void;
+    delete: (name: string, options: {
+        path: string;
+    }) => void;
+}
+/** 浏览器 Token 存储器 */
+interface BrowserTokenStore {
+    get: () => string | null;
+    set: (token: string) => void;
+    clear: () => void;
+}
+/**
+ * 服务端登录（密码）：内部调用 iam.auth.login，成功时自动写入 Token Cookie。
+ *
+ * @param cookies - SvelteKit cookies 对象
+ * @param credentials - 密码凭证（identifier + password）
+ * @returns 认证结果（成功时 Cookie 已自动写入）
+ *
+ * @example
+ * ```ts
+ * const result = await kit.auth.login(cookies, { identifier, password })
+ * if (!result.success) return kit.response.fromError(result.error, IamErrorHttpStatus)
+ * const { user, roles, permissions } = result.data
+ * ```
+ */
+declare function login(cookies: CookieWriter, credentials: PasswordCredentials): Promise<HaiResult<AuthResult>>;
+/**
+ * 服务端登录（OTP 验证码）：内部调用 iam.auth.loginWithOtp，成功时自动写入 Token Cookie。
+ *
+ * @param cookies - SvelteKit cookies 对象
+ * @param credentials - OTP 凭证（identifier + code）
+ * @returns 认证结果（成功时 Cookie 已自动写入）
+ *
+ * @example
+ * ```ts
+ * const result = await kit.auth.loginWithOtp(cookies, { identifier, code })
+ * ```
+ */
+declare function loginWithOtp(cookies: CookieWriter, credentials: OtpCredentials): Promise<HaiResult<AuthResult>>;
+/**
+ * 服务端登录（LDAP）：内部调用 iam.auth.loginWithLdap，成功时自动写入 Token Cookie。
+ *
+ * @param cookies - SvelteKit cookies 对象
+ * @param credentials - LDAP 凭证（username + password）
+ * @returns 认证结果（成功时 Cookie 已自动写入）
+ *
+ * @example
+ * ```ts
+ * const result = await kit.auth.loginWithLdap(cookies, { username, password })
+ * ```
+ */
+declare function loginWithLdap(cookies: CookieWriter, credentials: LdapCredentials): Promise<HaiResult<AuthResult>>;
+/**
+ * 服务端登录（API Key）：内部调用 iam.auth.loginWithApiKey，成功时自动写入 Token Cookie。
+ *
+ * @param cookies - SvelteKit cookies 对象
+ * @param credentials - API Key 凭证（key）
+ * @returns 认证结果（成功时 Cookie 已自动写入）
+ *
+ * @example
+ * ```ts
+ * const result = await kit.auth.loginWithApiKey(cookies, { key: apiKey })
+ * if (!result.success) return kit.response.fromError(result.error, IamErrorHttpStatus)
+ * ```
+ */
+declare function loginWithApiKey(cookies: CookieWriter, credentials: ApiKeyCredentials): Promise<HaiResult<AuthResult>>;
+/**
+ * 服务端注册并登录：内部调用 iam.auth.registerAndLogin，成功时自动写入 Token Cookie。
+ *
+ * @param cookies - SvelteKit cookies 对象
+ * @param options - 注册选项（username、password、email 等）
+ * @returns 认证结果（成功时 Cookie 已自动写入）
+ *
+ * @example
+ * ```ts
+ * const result = await kit.auth.registerAndLogin(cookies, { username, email, password })
+ * ```
+ */
+declare function registerAndLogin(cookies: CookieWriter, options: RegisterOptions): Promise<HaiResult<AuthResult>>;
+/**
+ * 服务端登出：内部调用 iam.auth.logout 使会话失效，并清除 Token Cookie。
+ *
+ * @param cookies - SvelteKit cookies 对象
+ * @param accessToken - 访问令牌（为 null/undefined 时仅清除 Cookie）
+ *
+ * @example
+ * ```ts
+ * await kit.auth.logout(cookies, locals.accessToken)
+ * return kit.response.ok(null)
+ * ```
+ */
+declare function logout(cookies: CookieWriter, accessToken?: string | null): Promise<void>;
+/**
+ * 创建浏览器端 Token 存储器（localStorage）。
+ *
+ * @param key - localStorage 键名，默认 `'hai_access_token'`
+ */
+declare function createTokenStore(key?: string): BrowserTokenStore;
+/**
+ * 写入浏览器端 Access Token。
+ */
+declare function setBrowserToken(token: string): void;
+/**
+ * 清除浏览器端 Access Token。
+ */
+declare function clearBrowserToken(): void;
+/**
+ * 创建浏览器端同源请求自动附加 Access Token 的 HandleFetch。
+ */
+declare function createHandleFetch(tokenStore?: BrowserTokenStore): HandleFetch;
+
+/**
+ * @h-ai/kit — 统一客户端
+ *
+ * 将 CSRF Token 附加与可选传输加密封装为统一 `apiFetch`。
+ * 应用层只需调用一次 `createKitClient()`，后续 API 调用即可复用同一套安全能力。
+ * @module kit-client
+ */
+
+/**
+ * 传输加密客户端配置
+ */
+interface ClientTransportConfig {
+    /** 传输加密服务实例（@h-ai/crypto 的 asymmetric + symmetric） */
+    crypto: TransportCryptoServiceLike;
+    /** 密钥交换端点 URL（默认 `'/api/kit/key-exchange'`） */
+    keyExchangeUrl?: string;
+}
+/**
+ * Kit 客户端配置
+ */
+interface KitClientConfig {
+    /**
+     * 传输加密配置。
+     * - 不提供 / undefined：不启用传输加密，仅 CSRF
+     * - 提供对象：启用传输加密
+     */
+    transport?: ClientTransportConfig;
+    /** CSRF Cookie 名称（默认 `'hai_csrf'`） */
+    csrfCookieName?: string;
+    /** CSRF Header 名称（默认 `'X-CSRF-Token'`） */
+    csrfHeaderName?: string;
+    /**
+     * 认证配置：自动从浏览器存储读取 Access Token 并注入请求头。
+     * - `true`：使用默认 localStorage 存储（key = `hai_access_token`）
+     * - `BrowserTokenStore`：使用自定义存储
+     * - 不提供 / `false`：不自动注入
+     */
+    auth?: boolean | BrowserTokenStore;
+}
+/**
+ * Kit 客户端实例
+ */
+interface KitClient {
+    /** 统一 API fetch（写请求自动附加 CSRF，启用 transport 时自动加解密） */
+    apiFetch: (url: string, init?: RequestInit) => Promise<Response>;
+    /** 传输加密是否就绪（未启用传输加密时始终为 true） */
+    readonly ready: boolean;
+    /** 手动触发密钥交换（transport 启用时） */
+    init: () => Promise<void>;
+    /** 销毁密钥状态 */
+    destroy: () => void;
+}
+/**
+ * 创建 Kit 客户端
+ *
+ * 返回统一的 `apiFetch`，内部自动完成：
+ * 1. CSRF Token 附加（写方法自动读取 Cookie + 设置 Header）
+ * 2. 密钥交换（首次写请求时 lazy init，transport 启用时）
+ * 3. 请求体加密（transport 启用时）
+ * 4. 响应体解密（transport 启用时）
+ *
+ * @param config - 客户端配置
+ * @returns KitClient 实例
+ *
+ * @example
+ * ```ts
+ * const client = createKitClient({ transport: { crypto } })
+ * const res = await client.apiFetch('/api/users', { method: 'POST', body: '{}' })
+ * ```
+ */
+declare function createKitClient(config?: KitClientConfig): KitClient;
+
+export { type ClientTransportConfig as C, type KitClient as K, clearBrowserToken as a, createTokenStore as b, createKitClient as c, createHandleFetch as d, type KitClientConfig as e, loginWithOtp as f, loginWithLdap as g, loginWithApiKey as h, logout as i, login as l, registerAndLogin as r, setBrowserToken as s };