@h-ai/kit 0.1.0-alpha5

package/dist/index.js

@@ -0,0 +1,886 @@
+import { defineCrud } from './chunk-FRYJMRTP.js';
+export { defineCrud, resolveOptions, resolveText } from './chunk-FRYJMRTP.js';
+import { createHandleFetch, createTokenStore, clearBrowserToken, setBrowserToken, logout, registerAndLogin, loginWithApiKey, loginWithLdap, loginWithOtp, login, createKitClient, configureAuth, getAccessToken } from './chunk-PHS7ZD5L.js';
+import { resolveA2AConfig, handleA2ARequest } from './chunk-475WECWK.js';
+import { transportEncryptionMiddleware } from './chunk-AD6S473Y.js';
+import { kitM, setAllModulesLocale } from './chunk-6TMSXG7J.js';
+import { core } from '@h-ai/core';
+import { z } from 'zod';
+
+// src/guards/kit-permission.ts
+function matchPermission(required, userPermissions) {
+  for (const userPerm of userPermissions) {
+    if (userPerm === required) {
+      return true;
+    }
+    if (userPerm === "*") {
+      return true;
+    }
+    if (userPerm.endsWith(":*")) {
+      const prefix = userPerm.slice(0, -1);
+      if (required.startsWith(prefix)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function hasPermission(session, permission) {
+  if (!session)
+    return false;
+  return matchPermission(permission, session.permissions ?? []);
+}
+function assertPermission(session, permission) {
+  if (!session) {
+    return new Response(
+      JSON.stringify({ success: false, error: kitM("kit_unauthorized") }),
+      { status: 401, headers: { "Content-Type": "application/json" } }
+    );
+  }
+  if (!matchPermission(permission, session.permissions ?? [])) {
+    return new Response(
+      JSON.stringify({ success: false, error: kitM("kit_forbidden", { params: { permission } }) }),
+      { status: 403, headers: { "Content-Type": "application/json" } }
+    );
+  }
+  return void 0;
+}
+function requirePermission(session, permission) {
+  const denied = assertPermission(session, permission);
+  if (denied) {
+    throw denied;
+  }
+}
+
+// src/kit-response.ts
+function ok(data, requestId) {
+  const response = {
+    success: true,
+    data,
+    requestId
+  };
+  return new Response(JSON.stringify(response), {
+    status: 200,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function created(data, requestId) {
+  const response = {
+    success: true,
+    data,
+    requestId
+  };
+  return new Response(JSON.stringify(response), {
+    status: 201,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function noContent() {
+  return new Response(null, { status: 204 });
+}
+function error(code, message, status = 400, requestId, details) {
+  const response = {
+    success: false,
+    error: {
+      code,
+      message,
+      details
+    },
+    requestId
+  };
+  return new Response(JSON.stringify(response), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function badRequest(message, requestId, details) {
+  return error("BAD_REQUEST", message, 400, requestId, details);
+}
+function unauthorized(message, requestId) {
+  return error("UNAUTHORIZED", message ?? kitM("kit_authRequired"), 401, requestId);
+}
+function forbidden(message, requestId) {
+  return error("FORBIDDEN", message ?? kitM("kit_accessDenied"), 403, requestId);
+}
+function notFound(message, requestId) {
+  return error("NOT_FOUND", message ?? kitM("kit_resourceNotFound"), 404, requestId);
+}
+function conflict(message, requestId) {
+  return error("CONFLICT", message, 409, requestId);
+}
+function validationError(errors, requestId) {
+  return error("VALIDATION_ERROR", kitM("kit_validationFailed"), 422, requestId, { errors });
+}
+function internalError(message, requestId) {
+  return error("INTERNAL_ERROR", message ?? kitM("kit_internalError"), 500, requestId);
+}
+function redirect(url, status = 302) {
+  return new Response(null, {
+    status,
+    headers: { Location: url }
+  });
+}
+function fromResult(result, httpStatusMap, requestId) {
+  if (result.success) {
+    return ok(result.data, requestId);
+  }
+  const { code, message } = result.error;
+  const status = httpStatusMap?.[code] ?? 400;
+  return error(String(code), message, status, requestId);
+}
+function fromError(haiError, requestId) {
+  return error(String(haiError.code), haiError.message, haiError.httpStatus ?? 400, requestId);
+}
+
+// src/kit-utils.ts
+function isResponseLike(value) {
+  if (value instanceof Response)
+    return true;
+  if (typeof value === "object" && value !== null && "status" in value && "headers" in value && typeof value.text === "function" && typeof value.json === "function") {
+    return true;
+  }
+  return false;
+}
+function isSvelteKitControlFlow(value) {
+  if (isResponseLike(value))
+    return false;
+  if (typeof value === "object" && value !== null && "status" in value) {
+    const status = value.status;
+    return typeof status === "number";
+  }
+  return false;
+}
+
+// src/kit-handler.ts
+function handler(fn) {
+  return async (event) => {
+    try {
+      return await fn(event);
+    } catch (error2) {
+      if (isResponseLike(error2)) {
+        return error2;
+      }
+      if (isSvelteKitControlFlow(error2)) {
+        throw error2;
+      }
+      const normalizedError = error2 instanceof Error ? {
+        name: error2.name,
+        message: error2.message,
+        stack: error2.stack,
+        cause: error2.cause
+      } : error2;
+      core.logger.error("Request handler error", {
+        error: normalizedError,
+        path: event.url.pathname,
+        method: event.request.method
+      });
+      return internalError();
+    }
+  };
+}
+
+// src/kit-contract.ts
+function defineEndpoint(def) {
+  return def;
+}
+function fromContract(endpoint, fn) {
+  return handler(async (event) => {
+    let raw;
+    if (endpoint.method === "GET") {
+      raw = Object.fromEntries(event.url.searchParams);
+    } else {
+      try {
+        raw = await event.request.json();
+      } catch {
+        raw = {};
+      }
+    }
+    const parsed = endpoint.input.safeParse(raw);
+    if (!parsed.success) {
+      const errors = parsed.error.issues.map((issue) => ({
+        field: issue.path.join(".") || "_",
+        message: issue.message
+      }));
+      return validationError(errors);
+    }
+    const result = await fn(parsed.data, event);
+    return ok(result);
+  });
+}
+function loggingMiddleware(config = {}) {
+  const { logBody = false, logResponse = false, redactFields = ["password", "token", "secret", "authorization", "apikey", "api_key", "creditcard", "credit_card"] } = config;
+  return async (context, next) => {
+    const { event, requestId } = context;
+    const startTime = Date.now();
+    let clientIp = "unknown";
+    try {
+      clientIp = event.getClientAddress?.() ?? "unknown";
+    } catch {
+    }
+    const logData = {
+      requestId,
+      method: event.request.method,
+      path: event.url.pathname,
+      query: Object.fromEntries(event.url.searchParams),
+      userAgent: event.request.headers.get("user-agent"),
+      ip: clientIp
+    };
+    if (logBody && event.request.method !== "GET") {
+      try {
+        const clonedRequest = event.request.clone();
+        const body = await clonedRequest.json();
+        logData.body = redactObject(body, redactFields);
+      } catch {
+      }
+    }
+    core.logger.trace("Incoming request", { ...logData });
+    const response = await next();
+    const duration = Date.now() - startTime;
+    const responseLogData = {
+      requestId,
+      status: response.status,
+      duration
+    };
+    if (logResponse) {
+      responseLogData.headers = Object.fromEntries(response.headers);
+    }
+    core.logger.trace("Request completed", { ...responseLogData });
+    return response;
+  };
+}
+function redactObject(obj, fields) {
+  if (typeof obj !== "object" || obj === null) {
+    return obj;
+  }
+  if (Array.isArray(obj)) {
+    return obj.map((item) => redactObject(item, fields));
+  }
+  if (obj instanceof Date || obj instanceof RegExp) {
+    return obj;
+  }
+  const result = {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (fields.includes(key.toLowerCase())) {
+      result[key] = "[REDACTED]";
+    } else if (typeof value === "object" && value !== null) {
+      result[key] = redactObject(value, fields);
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+var MemoryRateLimitStore = class {
+  store = /* @__PURE__ */ new Map();
+  cleanupTimer = null;
+  /**
+   * 启动定期清理过期条目
+   *
+   * @param intervalMs - 清理间隔（毫秒）
+   */
+  startCleanup(intervalMs) {
+    if (this.cleanupTimer)
+      return;
+    this.cleanupTimer = setInterval(() => {
+      const now = Date.now();
+      for (const [key, entry] of this.store) {
+        if (entry.resetAt < now) {
+          this.store.delete(key);
+        }
+      }
+    }, intervalMs);
+    if (this.cleanupTimer && typeof this.cleanupTimer === "object" && "unref" in this.cleanupTimer) {
+      this.cleanupTimer.unref();
+    }
+  }
+  get(key) {
+    return this.store.get(key);
+  }
+  set(key, entry) {
+    this.store.set(key, entry);
+  }
+  delete(key) {
+    this.store.delete(key);
+  }
+  /**
+   * 原子自增（内存实现为同步操作，天然原子）
+   *
+   * @param key - 限流键
+   * @param windowMs - 窗口时长
+   * @returns 自增后的条目
+   */
+  increment(key, windowMs) {
+    const now = Date.now();
+    let entry = this.store.get(key);
+    if (!entry || entry.resetAt < now) {
+      entry = { count: 1, resetAt: now + windowMs };
+    } else {
+      entry.count++;
+    }
+    this.store.set(key, entry);
+    return entry;
+  }
+};
+function rateLimitMiddleware(config) {
+  const {
+    windowMs,
+    maxRequests,
+    keyGenerator = (event) => {
+      try {
+        return event.getClientAddress?.() ?? "unknown";
+      } catch {
+        return "unknown";
+      }
+    },
+    onLimitReached
+  } = config;
+  const store = config.store ?? (() => {
+    const memStore = new MemoryRateLimitStore();
+    memStore.startCleanup(windowMs);
+    return memStore;
+  })();
+  return async (context, next) => {
+    const { event, requestId } = context;
+    const key = keyGenerator(event);
+    const now = Date.now();
+    let entry;
+    if (store.increment) {
+      entry = await store.increment(key, windowMs);
+    } else {
+      const existing = await store.get(key);
+      if (!existing || existing.resetAt < now) {
+        entry = { count: 1, resetAt: now + windowMs };
+      } else {
+        entry = { ...existing, count: existing.count + 1 };
+      }
+      await store.set(key, entry);
+    }
+    const remaining = Math.max(0, maxRequests - entry.count);
+    const resetTime = Math.ceil(entry.resetAt / 1e3);
+    if (entry.count > maxRequests) {
+      core.logger.warn("Rate limit exceeded", { key, requestId });
+      if (onLimitReached) {
+        return onLimitReached(event);
+      }
+      return new Response(
+        JSON.stringify({
+          success: false,
+          error: {
+            code: "RATE_LIMIT_EXCEEDED",
+            message: kitM("kit_rateLimitExceeded")
+          },
+          requestId
+        }),
+        {
+          status: 429,
+          headers: {
+            "Content-Type": "application/json",
+            "X-RateLimit-Limit": String(maxRequests),
+            "X-RateLimit-Remaining": "0",
+            "X-RateLimit-Reset": String(resetTime),
+            "Retry-After": String(Math.ceil((entry.resetAt - now) / 1e3))
+          }
+        }
+      );
+    }
+    const response = await next();
+    response.headers.set("X-RateLimit-Limit", String(maxRequests));
+    response.headers.set("X-RateLimit-Remaining", String(remaining));
+    response.headers.set("X-RateLimit-Reset", String(resetTime));
+    return response;
+  };
+}
+var ENCRYPTED_PREFIX = "enc:";
+function createEncryptedCookieProxy(cookies, config) {
+  const { names, symmetric, encryptionKey } = config;
+  const logger = core.logger.child({ module: "kit", scope: "cookie-proxy" });
+  return new Proxy(cookies, {
+    get(target, prop, receiver) {
+      if (prop === "get") {
+        return (name, opts) => {
+          const raw = target.get(name, opts);
+          if (!raw || !names.has(name))
+            return raw;
+          if (!raw.startsWith(ENCRYPTED_PREFIX))
+            return raw;
+          try {
+            const ciphertext = raw.slice(ENCRYPTED_PREFIX.length);
+            const separatorIndex = ciphertext.indexOf(":");
+            if (separatorIndex === -1)
+              return raw;
+            const iv = ciphertext.slice(0, separatorIndex);
+            const encrypted = ciphertext.slice(separatorIndex + 1);
+            const result = symmetric.decryptWithIV(encrypted, encryptionKey, iv);
+            if (!result.success || typeof result.data !== "string") {
+              logger.warn("Cookie decryption failed, returning raw value", { name });
+              return raw;
+            }
+            return result.data;
+          } catch {
+            logger.warn("Cookie decryption error, returning raw value", { name });
+            return raw;
+          }
+        };
+      }
+      if (prop === "set") {
+        return (name, value, opts) => {
+          if (names.has(name)) {
+            try {
+              const result = symmetric.encryptWithIV(value, encryptionKey);
+              if (result.success && result.data) {
+                value = `${ENCRYPTED_PREFIX}${result.data.iv}:${result.data.ciphertext}`;
+              } else {
+                logger.warn("Cookie encryption failed, storing plaintext", { name });
+              }
+            } catch {
+              logger.warn("Cookie encryption error, storing plaintext", { name });
+            }
+          }
+          return target.set(name, value, opts);
+        };
+      }
+      return Reflect.get(target, prop, receiver);
+    }
+  });
+}
+
+// src/hooks/kit-handle.ts
+function generateId(prefix) {
+  const timestamp = Date.now().toString(36);
+  const random = crypto.randomUUID().replace(/-/g, "").substring(0, 8);
+  return `${prefix}_${timestamp}${random}`;
+}
+function createHandle(config = {}) {
+  const {
+    auth: authConfig,
+    rateLimit: rateLimitConfig,
+    logging: loggingConfig = true,
+    crypto: cryptoConfig,
+    onError,
+    guards: customGuards = [],
+    middleware: customMiddleware = [],
+    a2a: a2aInput
+  } = config;
+  const a2aResolved = resolveA2AConfig(a2aInput);
+  if (authConfig?.cookieName || authConfig?.operations) {
+    configureAuth({ cookieName: authConfig.cookieName, operations: authConfig.operations });
+  }
+  const guards = [];
+  if (authConfig?.protectedPaths?.length) {
+    guards.push({
+      guard: buildAuthGuard(authConfig.verifyToken, authConfig.loginUrl),
+      paths: authConfig.protectedPaths,
+      exclude: authConfig.publicPaths
+    });
+  }
+  guards.push(...customGuards);
+  const builtinMiddleware = [];
+  if (loggingConfig) {
+    const logOpts = typeof loggingConfig === "object" ? loggingConfig : { logBody: false };
+    builtinMiddleware.push(loggingMiddleware(logOpts));
+  }
+  if (rateLimitConfig) {
+    builtinMiddleware.push(rateLimitMiddleware({
+      windowMs: rateLimitConfig.windowMs ?? 6e4,
+      maxRequests: rateLimitConfig.maxRequests ?? 100
+    }));
+  }
+  const allMiddleware = [...builtinMiddleware, ...customMiddleware];
+  const finalMiddleware = buildTransportMiddleware(allMiddleware, cryptoConfig);
+  const cookieProxyConfig = buildCookieProxyConfig(cryptoConfig);
+  return async ({ event, resolve }) => {
+    const requestId = generateId("req");
+    const locals = event.locals;
+    locals.requestId = requestId;
+    if (cookieProxyConfig) {
+      const proxiedCookies = createEncryptedCookieProxy(event.cookies, cookieProxyConfig);
+      Object.defineProperty(event, "cookies", {
+        value: proxiedCookies,
+        writable: true,
+        configurable: true
+      });
+    }
+    try {
+      if (a2aResolved) {
+        const a2aResponse = await handleA2ARequest(event, requestId, a2aResolved);
+        if (a2aResponse)
+          return a2aResponse;
+      }
+      let session;
+      if (authConfig) {
+        const token = getAccessToken(event.request, event.cookies);
+        if (token) {
+          session = await authConfig.verifyToken(token) ?? void 0;
+          locals.session = session;
+          if (session) {
+            locals.accessToken = token;
+          }
+        }
+      }
+      for (const guardConfig of guards) {
+        const guardResult = await executeGuard(guardConfig, event, session);
+        if (!guardResult.allowed) {
+          if (guardResult.redirect) {
+            return new Response(null, {
+              status: 302,
+              headers: { Location: guardResult.redirect }
+            });
+          }
+          return new Response(
+            JSON.stringify({
+              success: false,
+              error: {
+                code: "FORBIDDEN",
+                message: guardResult.message ?? kitM("kit_accessDenied")
+              },
+              requestId
+            }),
+            {
+              status: guardResult.status ?? 403,
+              headers: { "Content-Type": "application/json" }
+            }
+          );
+        }
+      }
+      const context = {
+        event,
+        session,
+        requestId
+      };
+      const response = await executeMiddlewareChain(
+        finalMiddleware,
+        context,
+        () => resolve(event)
+      );
+      response.headers.set("X-Request-Id", requestId);
+      return response;
+    } catch (error2) {
+      if (isSvelteKitControlFlow(error2)) {
+        throw error2;
+      }
+      core.logger.error("Request failed", { requestId, error: error2 instanceof Error ? error2.message : error2 });
+      if (onError) {
+        return onError(error2, event);
+      }
+      return new Response(
+        JSON.stringify({
+          success: false,
+          error: {
+            code: "INTERNAL_ERROR",
+            message: kitM("kit_internalError")
+          },
+          requestId
+        }),
+        {
+          status: 500,
+          headers: { "Content-Type": "application/json" }
+        }
+      );
+    }
+  };
+}
+function buildAuthGuard(verifyToken, loginUrl) {
+  return (event, session) => {
+    if (session) {
+      return { allowed: true };
+    }
+    const isApiRoute = event.url.pathname.startsWith("/api/");
+    if (isApiRoute) {
+      return {
+        allowed: false,
+        message: kitM("kit_authRequired"),
+        status: 401
+      };
+    }
+    if (loginUrl) {
+      const returnUrl = encodeURIComponent(event.url.pathname + event.url.search);
+      return {
+        allowed: false,
+        redirect: `${loginUrl}?returnUrl=${returnUrl}`
+      };
+    }
+    return {
+      allowed: false,
+      message: kitM("kit_authRequired"),
+      status: 401
+    };
+  };
+}
+async function executeGuard(config, event, session) {
+  const { guard, paths, exclude } = config;
+  const pathname = event.url.pathname;
+  if (exclude?.some((pattern) => matchPath(pathname, pattern))) {
+    return { allowed: true };
+  }
+  if (paths && !paths.some((pattern) => matchPath(pathname, pattern))) {
+    return { allowed: true };
+  }
+  return guard(event, session);
+}
+async function executeMiddlewareChain(middleware, context, final) {
+  if (middleware.length === 0) {
+    return final();
+  }
+  const [current, ...rest] = middleware;
+  return current(context, () => executeMiddlewareChain(rest, context, final));
+}
+function matchPath(pathname, pattern) {
+  if (pattern.endsWith("/*")) {
+    const base = pattern.slice(0, -2);
+    return pathname === base || pathname.startsWith(`${base}/`);
+  }
+  if (pattern.endsWith("/**")) {
+    const base = pattern.slice(0, -3);
+    return pathname === base || pathname.startsWith(`${base}/`);
+  }
+  return pathname === pattern;
+}
+function buildTransportMiddleware(userMiddleware, cryptoConfig) {
+  if (!cryptoConfig?.transport)
+    return userMiddleware;
+  const transportOpts = typeof cryptoConfig.transport === "object" ? cryptoConfig.transport : {};
+  const transportMw = transportEncryptionMiddleware({
+    enabled: true,
+    crypto: cryptoConfig.crypto,
+    keyExchangePath: transportOpts.keyExchangePath,
+    excludePaths: transportOpts.excludePaths,
+    encryptResponse: transportOpts.encryptResponse,
+    requireEncryption: transportOpts.requireEncryption
+  });
+  return [transportMw, ...userMiddleware];
+}
+function buildCookieProxyConfig(cryptoConfig) {
+  if (!cryptoConfig?.encryptedCookies?.length)
+    return null;
+  const key = cryptoConfig.cookieEncryptionKey ?? (typeof process !== "undefined" ? process.env?.HAI_KIT_COOKIE_KEY : void 0);
+  if (!key) {
+    core.logger.warn("Cookie encryption configured but no key provided (set crypto.cookieEncryptionKey or HAI_KIT_COOKIE_KEY env)");
+    return null;
+  }
+  return {
+    names: new Set(cryptoConfig.encryptedCookies),
+    symmetric: cryptoConfig.crypto.symmetric,
+    encryptionKey: key
+  };
+}
+function sequence(...handles) {
+  const filtered = handles.filter(Boolean);
+  if (filtered.length === 0) {
+    return ({ event, resolve }) => resolve(event);
+  }
+  if (filtered.length === 1) {
+    return filtered[0];
+  }
+  return async ({ event, resolve }) => {
+    return filtered.reduceRight(
+      (next, handle) => (event2) => handle({ event: event2, resolve: next }),
+      resolve
+    )(event);
+  };
+}
+function extractZodIssues(error2) {
+  const zodError = error2;
+  return zodError.issues ?? zodError.errors ?? [];
+}
+function zodIssuesToFormErrors(issues) {
+  return issues.map((issue) => ({
+    field: issue.path.join("."),
+    message: issue.message
+  }));
+}
+function createValidationResult(error2) {
+  return {
+    valid: false,
+    errors: zodIssuesToFormErrors(extractZodIssues(error2))
+  };
+}
+async function validateForm(request, schema) {
+  try {
+    const contentType = request.headers.get("content-type") ?? "";
+    let data;
+    if (contentType.includes("application/json")) {
+      data = await request.json();
+    } else if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+      const formData = await request.formData();
+      data = Object.fromEntries(formData);
+    } else {
+      return {
+        valid: false,
+        errors: [{ field: "_", message: kitM("kit_unsupportedContentType") }]
+      };
+    }
+    const result = schema.safeParse(data);
+    if (result.success) {
+      return { valid: true, data: result.data, errors: [] };
+    }
+    return createValidationResult(result.error);
+  } catch {
+    return {
+      valid: false,
+      errors: [{ field: "_", message: kitM("kit_parseBodyFailed") }]
+    };
+  }
+}
+function validateQuery(url, schema) {
+  const data = Object.fromEntries(url.searchParams);
+  const result = schema.safeParse(data);
+  if (result.success) {
+    return { valid: true, data: result.data, errors: [] };
+  }
+  return createValidationResult(result.error);
+}
+function validateParams(params, schema) {
+  const result = schema.safeParse(params);
+  if (result.success) {
+    return { valid: true, data: result.data, errors: [] };
+  }
+  return createValidationResult(result.error);
+}
+async function validateFormOrFail(request, schema) {
+  const result = await validateForm(request, schema);
+  if (!result.valid || !result.data) {
+    throw badRequest(
+      result.errors[0]?.message ?? kitM("kit_validationFailed"),
+      void 0,
+      { errors: result.errors }
+    );
+  }
+  return result.data;
+}
+function validateQueryOrFail(url, schema) {
+  const result = validateQuery(url, schema);
+  if (!result.valid || !result.data) {
+    throw badRequest(
+      result.errors[0]?.message ?? kitM("kit_validationFailed"),
+      void 0,
+      { errors: result.errors }
+    );
+  }
+  return result.data;
+}
+function validateParamsOrFail(params, schema) {
+  const result = validateParams(params, schema);
+  if (!result.valid || !result.data) {
+    throw badRequest(
+      result.errors[0]?.message ?? kitM("kit_validationFailed"),
+      void 0,
+      { errors: result.errors }
+    );
+  }
+  return result.data;
+}
+var IdParamSchema = z.object({
+  id: z.string().min(1, kitM("kit_idRequired"))
+});
+var MAX_PAGE_SIZE = 100;
+var PaginationQuerySchema = z.object({
+  page: z.coerce.number().int().min(1).default(1),
+  pageSize: z.coerce.number().int().min(1).max(MAX_PAGE_SIZE).default(20),
+  search: z.string().optional()
+});
+
+// src/kit-main.ts
+var kit = {
+  // ─── Handle Hook ───
+  /** 创建 SvelteKit Handle Hook（含 auth / logging / rateLimit 内置配置） */
+  createHandle,
+  /** 组合多个 Handle */
+  sequence,
+  /** API Handler 包装器（自动错误边界） */
+  handler,
+  /** 基于 API 契约创建类型安全的路由 handler */
+  fromContract,
+  // ─── 路由守卫 ───
+  guard: {
+    /** 要求权限，不满足时 throw Response（SvelteKit 控制流） */
+    require: requirePermission,
+    /** 检查会话是否具有指定权限（布尔） */
+    check: hasPermission
+  },
+  // ─── API 响应 ───
+  response: {
+    /** 200 成功 */
+    ok,
+    /** 201 创建成功 */
+    created,
+    /** 204 无内容 */
+    noContent,
+    /** 自定义错误响应 */
+    error,
+    /** 400 BadRequest */
+    badRequest,
+    /** 401 Unauthorized */
+    unauthorized,
+    /** 403 Forbidden */
+    forbidden,
+    /** 404 NotFound */
+    notFound,
+    /** 409 Conflict */
+    conflict,
+    /** 422 验证错误 */
+    validationError,
+    /** 500 InternalError */
+    internalError,
+    /** 重定向 */
+    redirect,
+    /** 将 HaiResult<T> 转为标准 API Response（支持 httpStatusMap） */
+    fromResult,
+    /** 将模块错误码映射为标准 HTTP Response */
+    fromError
+  },
+  // ─── 验证 ───
+  validate: {
+    /** 验证请求体（JSON/表单），失败 throw Response */
+    body: validateFormOrFail,
+    /** 验证查询参数，失败 throw Response */
+    query: validateQueryOrFail,
+    /** 验证路径参数，失败 throw Response */
+    params: validateParamsOrFail,
+    /** 路径参数 id Schema（{id: string}） */
+    IdParamSchema,
+    /** 通用分页查询 Schema（page / pageSize / search） */
+    PaginationQuerySchema
+  },
+  // ─── 客户端工具 ───
+  client: {
+    /** 创建统一客户端（CSRF + 传输加密透明合并） */
+    create: createKitClient
+  },
+  // ─── 认证工具 ───
+  auth: {
+    /** 服务端登录（密码）：内部调用 iam.auth.login + 自动写入 Token Cookie */
+    login,
+    /** 服务端登录（OTP 验证码）：内部调用 iam.auth.loginWithOtp + 自动写入 Token Cookie */
+    loginWithOtp,
+    /** 服务端登录（LDAP）：内部调用 iam.auth.loginWithLdap + 自动写入 Token Cookie */
+    loginWithLdap,
+    /** 服务端登录（API Key）：内部调用 iam.auth.loginWithApiKey + 自动写入 Token Cookie */
+    loginWithApiKey,
+    /** 服务端注册并登录：内部调用 iam.auth.registerAndLogin + 自动写入 Token Cookie */
+    registerAndLogin,
+    /** 服务端登出：内部调用 iam.auth.logout + 清除 Token Cookie */
+    logout,
+    /** 写入浏览器端 Access Token（客户端 login/register 用） */
+    setBrowserToken,
+    /** 清除浏览器端 Access Token（客户端 logout 用） */
+    clearBrowserToken,
+    /** 创建浏览器端 Token 存储器（自定义 key 时使用） */
+    createTokenStore,
+    /** 创建浏览器端同源请求自动附加 Authorization 的 HandleFetch */
+    createHandleFetch
+  },
+  // ─── CRUD ───
+  crud: {
+    /** 定义 CRUD 资源（声明式配置 → 操作对象） */
+    define: defineCrud
+  },
+  // ─── i18n ───
+  i18n: {
+    /** 统一设置所有 hai 模块的默认语言 */
+    setLocale: setAllModulesLocale
+  }
+};
+
+export { IdParamSchema, PaginationQuerySchema, defineEndpoint, kit, matchPermission };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map