@h-ai/kit 0.1.0-alpha5

package/dist/modules/a2a/index.d.ts

@@ -0,0 +1,150 @@
+import { RequestEvent, RequestHandler } from '@sveltejs/kit';
+import { f as HandleA2AOperations, h as HandleConfig } from '../../kit-types-BHlDNNpd.js';
+import '@h-ai/iam';
+import '../../kit-crypto-types-C-gEvx04.js';
+
+/**
+ * @h-ai/kit — A2A API Key 认证器
+ *
+ * 从请求头或 query 参数中提取 API Key，调用 IAM apiKey.verifyApiKey 验证。
+ * @module kit-a2a-auth
+ */
+
+/** A2A API Key 认证器配置 */
+interface A2AApiKeyAuthConfig {
+    /** API Key 的传递位置 */
+    in: 'header' | 'query';
+    /** 参数名 */
+    name: string;
+}
+/**
+ * 创建 A2A API Key 认证函数
+ *
+ * 根据配置从请求头或 query 参数中提取 API Key，
+ * 通过 `iam.apiKey.verifyApiKey()` 验证后返回调用方上下文。
+ *
+ * - 无 API Key → 返回 `null`（匿名请求）
+ * - 验证失败 → 返回 `null`（拒绝）
+ * - 验证成功 → 返回 `{ agentId, apiKeyId, scopes }`
+ *
+ * @param config - API Key 提取配置
+ * @returns authenticate 函数，可直接赋给 HandleA2AConfig.authenticate
+ */
+declare function createA2AApiKeyAuthenticator(config: A2AApiKeyAuthConfig): (event: RequestEvent) => Promise<Record<string, unknown> | null>;
+
+/**
+ * @h-ai/kit — A2A Handle 拦截器
+ *
+ * 在 SvelteKit Handle Hook 中拦截 A2A 端点（Agent Card 发现 + JSON-RPC 处理），
+ * 自动处理请求并返回 Response，不匹配时返回 null 由 Handle 继续后续流程。
+ * @module kit-a2a-handle
+ */
+
+/** A2A 解析后的内部配置 */
+interface ResolvedA2AConfig {
+    operations: HandleA2AOperations;
+    cardPath: string;
+    rpcPath: string;
+    authenticate?: (event: RequestEvent) => Promise<Record<string, unknown> | null | undefined>;
+}
+/**
+ * 解析 A2A 配置（简单模式 / 配置模式）
+ *
+ * - 简单模式：直接传入 `ai.a2a` 操作对象，使用默认路径
+ * - 配置模式：传入 `{ operations, rpcPath?, cardPath?, authenticate? }`
+ *
+ * @param input - HandleConfig.a2a 配置
+ * @returns 解析后的配置，或 `null` 表示未配置
+ */
+declare function resolveA2AConfig(input: HandleConfig['a2a']): ResolvedA2AConfig | null;
+/**
+ * 处理 A2A 端点请求
+ *
+ * 匹配 Agent Card GET 和 JSON-RPC POST 端点，返回 Response。
+ * 不匹配时返回 `null`，由 Handle 继续后续流程。
+ *
+ * @param event - SvelteKit RequestEvent
+ * @param requestId - 当前请求 ID（用于响应头）
+ * @param config - 解析后的 A2A 配置
+ * @returns 匹配时返回 Response，不匹配返回 null
+ */
+declare function handleA2ARequest(event: RequestEvent, requestId: string, config: ResolvedA2AConfig): Promise<Response | null>;
+
+/**
+ * @h-ai/kit — A2A 类型定义
+ *
+ * Kit A2A 路由处理器相关类型
+ * @module kit-a2a-types
+ */
+
+/** A2A 路由处理器配置 */
+interface KitA2AHandlerConfig {
+    /**
+     * 可选的认证回调
+     *
+     * 验证入站 A2A 请求的身份。返回 null/undefined 表示匿名请求，
+     * 抛出异常或返回 Response 表示认证失败。
+     *
+     * - `'apiKey'`：自动使用 IAM API Key 认证
+     * - 函数：自定义认证回调
+     */
+    authenticate?: 'apiKey' | ((event: RequestEvent) => Promise<Record<string, unknown> | null | undefined>);
+}
+
+/**
+ * @h-ai/kit — A2A 路由处理器
+ *
+ * 提供 SvelteKit 路由工厂：Agent Card 端点和 JSON-RPC 处理端点。
+ * @module kit-a2a-helpers
+ */
+
+/**
+ * 创建 Agent Card GET 处理器
+ *
+ * 返回当前 Agent 的 Agent Card（JSON），通常挂载在 `/.well-known/agent-card.json`。
+ *
+ * @param getAgentCard - 获取 Agent Card 的回调（通常调用 `ai.a2a.getAgentCard()`）
+ * @returns SvelteKit GET 处理器
+ *
+ * @example
+ * ```ts
+ * // src/routes/.well-known/agent-card.json/+server.ts
+ * import { ai } from '@h-ai/ai'
+ * import { createAgentCardHandler } from '@h-ai/kit/a2a'
+ *
+ * export const GET = createAgentCardHandler(() => {
+ *   const result = ai.a2a.getAgentCard()
+ *   if (!result.success) throw new Error(result.error.message)
+ *   return result.data
+ * })
+ * ```
+ */
+declare function createAgentCardHandler(getAgentCard: () => Record<string, unknown>): RequestHandler;
+/**
+ * 创建 A2A JSON-RPC POST 处理器
+ *
+ * 将 SvelteKit Request 转换为 JSON-RPC body，委托给 `handleRequest` 回调处理。
+ * 支持单条响应和流式（SSE）响应。
+ *
+ * @param handleRequest - JSON-RPC 请求处理回调（通常调用 `ai.a2a.handleRequest()`）
+ * @param config - 可选配置（认证等）
+ * @returns SvelteKit POST 处理器
+ *
+ * @example
+ * ```ts
+ * // src/routes/a2a/+server.ts
+ * import { ai } from '@h-ai/ai'
+ * import { createA2AHandler } from '@h-ai/kit/a2a'
+ *
+ * export const POST = createA2AHandler(
+ *   (body, context) => ai.a2a.handleRequest(body, context),
+ * )
+ * ```
+ */
+declare function createA2AHandler(handleRequest: (body: unknown, context?: Record<string, unknown>) => Promise<{
+    streaming: boolean;
+    body?: unknown;
+    stream?: AsyncGenerator<unknown, void, undefined>;
+}>, config?: KitA2AHandlerConfig): RequestHandler;
+
+export { type A2AApiKeyAuthConfig, type KitA2AHandlerConfig, type ResolvedA2AConfig, createA2AApiKeyAuthenticator, createA2AHandler, createAgentCardHandler, handleA2ARequest, resolveA2AConfig };

package/dist/modules/a2a/index.js

@@ -0,0 +1,57 @@
+import { createA2AApiKeyAuthenticator } from '../../chunk-475WECWK.js';
+export { createA2AApiKeyAuthenticator, handleA2ARequest, resolveA2AConfig } from '../../chunk-475WECWK.js';
+
+// src/modules/a2a/kit-a2a-helpers.ts
+function createAgentCardHandler(getAgentCard) {
+  return async () => {
+    const card = getAgentCard();
+    return new Response(JSON.stringify(card), {
+      headers: { "Content-Type": "application/json" }
+    });
+  };
+}
+function createA2AHandler(handleRequest, config) {
+  return async (event) => {
+    let context;
+    if (config?.authenticate) {
+      const authFn = typeof config.authenticate === "function" ? config.authenticate : createA2AApiKeyAuthenticator({ in: "header", name: "x-api-key" });
+      const authResult = await authFn(event);
+      if (authResult) {
+        context = authResult;
+      }
+    }
+    const requestBody = await event.request.json();
+    const result = await handleRequest(requestBody, context);
+    if (result.streaming && result.stream) {
+      const stream = result.stream;
+      const readableStream = new ReadableStream({
+        async start(controller) {
+          const encoder = new TextEncoder();
+          try {
+            for await (const chunk of stream) {
+              controller.enqueue(encoder.encode(`data: ${JSON.stringify(chunk)}
+
+`));
+            }
+          } finally {
+            controller.close();
+          }
+        }
+      });
+      return new Response(readableStream, {
+        headers: {
+          "Content-Type": "text/event-stream",
+          "Cache-Control": "no-cache",
+          "Connection": "keep-alive"
+        }
+      });
+    }
+    return new Response(JSON.stringify(result.body), {
+      headers: { "Content-Type": "application/json" }
+    });
+  };
+}
+
+export { createA2AHandler, createAgentCardHandler };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/modules/a2a/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/modules/a2a/kit-a2a-helpers.ts"],"names":[],"mappings":";;;;AAiCO,SAAS,uBACd,YAAA,EACgB;AAChB,EAAA,OAAO,YAAY;AACjB,IAAA,MAAM,OAAO,YAAA,EAAa;AAC1B,IAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG;AAAA,MACxC,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,KAC/C,CAAA;AAAA,EACH,CAAA;AACF;AAuBO,SAAS,gBAAA,CACd,eAKA,MAAA,EACgB;AAChB,EAAA,OAAO,OAAO,KAAA,KAAwB;AAEpC,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI,QAAQ,YAAA,EAAc;AACxB,MAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO,YAAA,KAAiB,UAAA,GAC1C,MAAA,CAAO,YAAA,GACP,4BAAA,CAA6B,EAAE,EAAA,EAAI,QAAA,EAAU,IAAA,EAAM,aAAa,CAAA;AACpE,MAAA,MAAM,UAAA,GAAa,MAAM,MAAA,CAAO,KAAK,CAAA;AACrC,MAAA,IAAI,UAAA,EAAY;AACd,QAAA,OAAA,GAAU,UAAA;AAAA,MACZ;AAAA,IACF;AAGA,IAAA,MAAM,WAAA,GAAc,MAAM,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAK;AAC7C,IAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,WAAA,EAAa,OAAO,CAAA;AAEvD,IAAA,IAAI,MAAA,CAAO,SAAA,IAAa,MAAA,CAAO,MAAA,EAAQ;AAErC,MAAA,MAAM,SAAS,MAAA,CAAO,MAAA;AACtB,MAAA,MAAM,cAAA,GAAiB,IAAI,cAAA,CAAe;AAAA,QACxC,MAAM,MAAM,UAAA,EAAY;AACtB,UAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,UAAA,IAAI;AACF,YAAA,WAAA,MAAiB,SAAS,MAAA,EAAQ;AAChC,cAAA,UAAA,CAAW,QAAQ,OAAA,CAAQ,MAAA,CAAO,SAAS,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC;;AAAA,CAAM,CAAC,CAAA;AAAA,YACzE;AAAA,UACF,CAAA,SACA;AACE,YAAA,UAAA,CAAW,KAAA,EAAM;AAAA,UACnB;AAAA,QACF;AAAA,OACD,CAAA;AAED,MAAA,OAAO,IAAI,SAAS,cAAA,EAAgB;AAAA,QAClC,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,mBAAA;AAAA,UAChB,eAAA,EAAiB,UAAA;AAAA,UACjB,YAAA,EAAc;AAAA;AAChB,OACD,CAAA;AAAA,IACH;AAGA,IAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,IAAI,CAAA,EAAG;AAAA,MAC/C,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,KAC/C,CAAA;AAAA,EACH,CAAA;AACF","file":"index.js","sourcesContent":["/**\n * @h-ai/kit — A2A 路由处理器\n *\n * 提供 SvelteKit 路由工厂：Agent Card 端点和 JSON-RPC 处理端点。\n * @module kit-a2a-helpers\n */\n\nimport type { RequestEvent, RequestHandler } from '@sveltejs/kit'\n\nimport type { KitA2AHandlerConfig } from './kit-a2a-types.js'\nimport { createA2AApiKeyAuthenticator } from './kit-a2a-auth.js'\n\n/**\n * 创建 Agent Card GET 处理器\n *\n * 返回当前 Agent 的 Agent Card（JSON），通常挂载在 `/.well-known/agent-card.json`。\n *\n * @param getAgentCard - 获取 Agent Card 的回调（通常调用 `ai.a2a.getAgentCard()`）\n * @returns SvelteKit GET 处理器\n *\n * @example\n * ```ts\n * // src/routes/.well-known/agent-card.json/+server.ts\n * import { ai } from '@h-ai/ai'\n * import { createAgentCardHandler } from '@h-ai/kit/a2a'\n *\n * export const GET = createAgentCardHandler(() => {\n *   const result = ai.a2a.getAgentCard()\n *   if (!result.success) throw new Error(result.error.message)\n *   return result.data\n * })\n * ```\n */\nexport function createAgentCardHandler(\n  getAgentCard: () => Record<string, unknown>,\n): RequestHandler {\n  return async () => {\n    const card = getAgentCard()\n    return new Response(JSON.stringify(card), {\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n}\n\n/**\n * 创建 A2A JSON-RPC POST 处理器\n *\n * 将 SvelteKit Request 转换为 JSON-RPC body，委托给 `handleRequest` 回调处理。\n * 支持单条响应和流式（SSE）响应。\n *\n * @param handleRequest - JSON-RPC 请求处理回调（通常调用 `ai.a2a.handleRequest()`）\n * @param config - 可选配置（认证等）\n * @returns SvelteKit POST 处理器\n *\n * @example\n * ```ts\n * // src/routes/a2a/+server.ts\n * import { ai } from '@h-ai/ai'\n * import { createA2AHandler } from '@h-ai/kit/a2a'\n *\n * export const POST = createA2AHandler(\n *   (body, context) => ai.a2a.handleRequest(body, context),\n * )\n * ```\n */\nexport function createA2AHandler(\n  handleRequest: (body: unknown, context?: Record<string, unknown>) => Promise<{\n    streaming: boolean\n    body?: unknown\n    stream?: AsyncGenerator<unknown, void, undefined>\n  }>,\n  config?: KitA2AHandlerConfig,\n): RequestHandler {\n  return async (event: RequestEvent) => {\n    // 可选认证\n    let context: Record<string, unknown> | undefined\n    if (config?.authenticate) {\n      const authFn = typeof config.authenticate === 'function'\n        ? config.authenticate\n        : createA2AApiKeyAuthenticator({ in: 'header', name: 'x-api-key' })\n      const authResult = await authFn(event)\n      if (authResult) {\n        context = authResult\n      }\n    }\n\n    // 解析 JSON-RPC 请求体\n    const requestBody = await event.request.json()\n    const result = await handleRequest(requestBody, context)\n\n    if (result.streaming && result.stream) {\n      // 流式响应：SSE 格式\n      const stream = result.stream\n      const readableStream = new ReadableStream({\n        async start(controller) {\n          const encoder = new TextEncoder()\n          try {\n            for await (const chunk of stream) {\n              controller.enqueue(encoder.encode(`data: ${JSON.stringify(chunk)}\\n\\n`))\n            }\n          }\n          finally {\n            controller.close()\n          }\n        },\n      })\n\n      return new Response(readableStream, {\n        headers: {\n          'Content-Type': 'text/event-stream',\n          'Cache-Control': 'no-cache',\n          'Connection': 'keep-alive',\n        },\n      })\n    }\n\n    // 单条响应\n    return new Response(JSON.stringify(result.body), {\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n}\n"]}

package/dist/modules/crypto/index.d.ts

@@ -0,0 +1,180 @@
+import { Cookies, RequestEvent } from '@sveltejs/kit';
+import { C as CryptoCsrfConfig, E as EncryptedCookieConfig, a as CryptoServiceLike, W as WebhookVerifyConfig, d as TransportEncryptionManager, T as TransportCryptoServiceLike, b as EncryptedPayload, c as TransportEncryptionConfig } from '../../kit-crypto-types-C-gEvx04.js';
+export { e as TransportKeyPair } from '../../kit-crypto-types-C-gEvx04.js';
+import { HaiResult } from '@h-ai/core';
+import { M as Middleware } from '../../kit-types-BHlDNNpd.js';
+import '@h-ai/iam';
+
+/**
+ * @h-ai/kit — Crypto Helpers
+ *
+ * 集成 @h-ai/crypto 的 SvelteKit 工具
+ * @module kit-crypto-helpers
+ */
+
+/**
+ * 验证 Webhook 签名
+ *
+ * 从请求头取出签名，用 HMAC 对原始 Body 进行比较验证。
+ *
+ * @param config - 签名验证配置
+ * @returns 签名是否合法
+ *
+ * @example
+ * ```ts
+ * const valid = await verifyWebhookSignature({
+ *   crypto, event, secretKey: 'wh_secret', signatureHeader: 'X-Signature',
+ * })
+ * if (!valid) return new Response('Invalid signature', { status: 401 })
+ * ```
+ */
+declare function verifyWebhookSignature(config: WebhookVerifyConfig): Promise<boolean>;
+/**
+ * 生成请求 HMAC 签名（用于调用外部服务）
+ *
+ * @param crypto - @h-ai/crypto 服务实例
+ * @param body - 请求体字符串
+ * @param secretKey - 共享密钥
+ * @param algorithm - 哈希算法（默认 `'sha256'`）
+ * @returns 签名字符串
+ * @throws 签名失败时抛出 Error
+ */
+declare function signRequest(crypto: CryptoServiceLike, body: string, secretKey: string, algorithm?: string): Promise<string>;
+/**
+ * 创建 CSRF Token 管理器
+ *
+ * 基于 `@h-ai/crypto` 随机字节 + 时间安全比较，
+ * 提供 token 生成、验证和 SvelteKit handle 中间件。
+ *
+ * @param config - CSRF 配置（crypto 实例、Cookie 名、Header 名等）
+ * @returns `{ generate, verify, createHandle }`
+ *
+ * @example
+ * ```ts
+ * const csrf = createCsrfManager({ crypto })
+ * // 在 load 中生成
+ * const token = await csrf.generate(cookies)
+ * // 在 action 中验证
+ * const ok = await csrf.verify(event)
+ * ```
+ */
+declare function createCsrfManager(config: CryptoCsrfConfig): {
+    /**
+     * 生成新的 CSRF Token 并设置 Cookie
+     */
+    generate(cookies: Cookies): Promise<string>;
+    /**
+     * 验证 CSRF Token
+     */
+    verify(event: RequestEvent): Promise<boolean>;
+    /**
+     * 创建 CSRF 验证中间件
+     */
+    createHandle(): ({ event, resolve }: {
+        event: RequestEvent;
+        resolve: (event: RequestEvent) => Promise<Response>;
+    }) => Promise<Response>;
+};
+/**
+ * 创建加密 Cookie 管理器
+ *
+ * 使用 AES 对 Cookie 值进行加解密，防止客户端篡改。
+ *
+ * @param config - 加密 Cookie 配置（含加密密钥）
+ * @returns `{ set, get, delete }`
+ *
+ * @example
+ * ```ts
+ * const enc = createEncryptedCookie({ crypto, encryptionKey: 'my-32byte-key' })
+ * await enc.set(cookies, 'prefs', { theme: 'dark' })
+ * const prefs = await enc.get(cookies, 'prefs')
+ * ```
+ */
+declare function createEncryptedCookie(config: EncryptedCookieConfig): {
+    /**
+     * 设置加密 Cookie
+     */
+    set(cookies: Cookies, name: string, value: unknown): Promise<void>;
+    /**
+     * 获取并解密 Cookie
+     */
+    get<T = unknown>(cookies: Cookies, name: string): Promise<T | null>;
+    /**
+     * 删除 Cookie
+     */
+    delete(cookies: Cookies, name: string): void;
+};
+
+/**
+ * @h-ai/kit — 传输加密核心
+ *
+ * 基于非对称 + 对称的混合传输加密。
+ * @module kit-transport-encryption
+ */
+
+/**
+ * 创建传输加密管理器
+ *
+ * 启动时生成服务端非对称密钥对，通过 clientId → publicKey 的内存 Map 管理客户端密钥。
+ * 内置 LRU 淘汰机制，超过 maxClients 上限时自动移除最早注册的客户端。
+ *
+ * 注意：clientKeys 存储在进程内存中，多节点部署时各节点状态独立。
+ * 客户端密钥交换后的后续请求必须路由到同一节点（如使用 sticky session），
+ * 否则传输加密功能不可用。
+ *
+ * @param cryptoService - 传输加密服务实例（非对称 + 对称）
+ * @param maxClients - 最大客户端数量（默认 10000），超过时淘汰最早注册的
+ * @returns 成功返回传输加密管理器，密钥对生成失败时返回错误
+ */
+declare function createTransportEncryption(cryptoService: TransportCryptoServiceLike, maxClients?: number): HaiResult<TransportEncryptionManager>;
+/**
+ * 创建密钥交换端点处理器
+ *
+ * 返回一个标准的 POST 处理函数，用于接收客户端公钥并返回服务端公钥与 clientId。
+ *
+ * @param manager - 传输加密管理器
+ * @returns POST 处理函数，可直接用于 SvelteKit +server.ts
+ *
+ * @example
+ * ```ts
+ * // src/routes/api/kit/key-exchange/+server.ts
+ * import { keyExchangeHandler } from '$lib/server/transport'
+ * export const POST = keyExchangeHandler
+ * ```
+ */
+declare function createKeyExchangeHandler(manager: TransportEncryptionManager): (request: Request) => Promise<Response>;
+/**
+ * 校验加密载荷格式是否合法
+ *
+ * @param payload - 待校验对象
+ * @returns 是否为合法的 EncryptedPayload
+ */
+declare function isValidEncryptedPayload(payload: unknown): payload is EncryptedPayload;
+
+/**
+ * @h-ai/kit — 传输加密中间件
+ *
+ * SvelteKit 中间件，自动对请求/响应进行传输加密解密。
+ * @module kit-transport-middleware
+ */
+
+/**
+ * 创建传输加密中间件
+ *
+ * @param config - 传输加密配置
+ * @returns SvelteKit 中间件
+ *
+ * @example
+ * ```ts
+ * import { crypto } from '@h-ai/crypto'
+ * import { kit } from '@h-ai/kit'
+ *
+ * // 传输加密通过 createHandle 的 crypto 配置自动启用：
+ * export const handle = kit.createHandle({
+ *   crypto: { crypto, transport: true },
+ * })
+ * ```
+ */
+declare function transportEncryptionMiddleware(config: TransportEncryptionConfig): Middleware;
+
+export { CryptoCsrfConfig, CryptoServiceLike, EncryptedCookieConfig, EncryptedPayload, TransportCryptoServiceLike, TransportEncryptionConfig, TransportEncryptionManager, WebhookVerifyConfig, createCsrfManager, createEncryptedCookie, createKeyExchangeHandler, createTransportEncryption, isValidEncryptedPayload, signRequest, transportEncryptionMiddleware, verifyWebhookSignature };

package/dist/modules/crypto/index.js

@@ -0,0 +1,151 @@
+export { transportEncryptionMiddleware } from '../../chunk-AD6S473Y.js';
+import { kitM } from '../../chunk-6TMSXG7J.js';
+export { createKeyExchangeHandler, createTransportEncryption, isValidEncryptedPayload } from '../../chunk-6TMSXG7J.js';
+
+// src/modules/crypto/kit-crypto-helpers.ts
+async function verifyWebhookSignature(config) {
+  const {
+    crypto,
+    event,
+    secretKey,
+    signatureHeader = "X-Signature",
+    algorithm = "sha256"
+  } = config;
+  const signature = event.request.headers.get(signatureHeader);
+  if (!signature) {
+    return false;
+  }
+  const body = await event.request.text();
+  try {
+    const result = await crypto.hmac.verify(body, secretKey, signature, algorithm);
+    return result.success && result.data === true;
+  } catch {
+    return false;
+  }
+}
+async function signRequest(crypto, body, secretKey, algorithm = "sha256") {
+  const result = await crypto.hmac.sign(body, secretKey, algorithm);
+  if (!result.success) {
+    throw new Error(result.error?.message || kitM("kit_signFailed"));
+  }
+  return result.data;
+}
+function createCsrfManager(config) {
+  const {
+    crypto,
+    cookieName = "csrf_token",
+    headerName = "X-CSRF-Token",
+    formFieldName = "_csrf",
+    tokenLength = 32,
+    cookieOptions = {}
+  } = config;
+  return {
+    /**
+     * 生成新的 CSRF Token 并设置 Cookie
+     */
+    async generate(cookies) {
+      const result = await crypto.random.bytes(tokenLength);
+      if (!result.success) {
+        throw new Error(kitM("kit_csrfTokenFailed"));
+      }
+      const token = Array.from(result.data).map((b) => b.toString(16).padStart(2, "0")).join("");
+      cookies.set(cookieName, token, {
+        path: "/",
+        httpOnly: true,
+        secure: true,
+        sameSite: "strict",
+        ...cookieOptions
+      });
+      return token;
+    },
+    /**
+     * 验证 CSRF Token
+     */
+    async verify(event) {
+      const cookieToken = event.cookies.get(cookieName);
+      if (!cookieToken) {
+        return false;
+      }
+      let requestToken = event.request.headers.get(headerName);
+      if (!requestToken && event.request.method === "POST") {
+        try {
+          const formData = await event.request.clone().formData();
+          const fieldValue = formData.get(formFieldName);
+          requestToken = typeof fieldValue === "string" ? fieldValue : null;
+        } catch {
+        }
+      }
+      if (!requestToken) {
+        return false;
+      }
+      const result = await crypto.hash.timingSafeEqual(cookieToken, requestToken);
+      return result.success && result.data === true;
+    },
+    /**
+     * 创建 CSRF 验证中间件
+     */
+    createHandle() {
+      return async ({ event, resolve }) => {
+        const safeMethods = ["GET", "HEAD", "OPTIONS"];
+        if (safeMethods.includes(event.request.method)) {
+          return resolve(event);
+        }
+        const isValid = await this.verify(event);
+        if (!isValid) {
+          return new Response(kitM("kit_csrfVerifyFailed"), { status: 403 });
+        }
+        return resolve(event);
+      };
+    }
+  };
+}
+function createEncryptedCookie(config) {
+  const { crypto, encryptionKey, cookieOptions = {} } = config;
+  return {
+    /**
+     * 设置加密 Cookie
+     */
+    async set(cookies, name, value) {
+      const json = JSON.stringify(value);
+      const result = await crypto.aes.encrypt(json, encryptionKey);
+      if (!result.success) {
+        throw new Error(kitM("kit_encryptFailed"));
+      }
+      cookies.set(name, result.data, {
+        path: "/",
+        httpOnly: true,
+        secure: true,
+        sameSite: "lax",
+        ...cookieOptions
+      });
+    },
+    /**
+     * 获取并解密 Cookie
+     */
+    async get(cookies, name) {
+      const encrypted = cookies.get(name);
+      if (!encrypted) {
+        return null;
+      }
+      try {
+        const result = await crypto.aes.decrypt(encrypted, encryptionKey);
+        if (!result.success) {
+          return null;
+        }
+        return JSON.parse(result.data);
+      } catch {
+        return null;
+      }
+    },
+    /**
+     * 删除 Cookie
+     */
+    delete(cookies, name) {
+      cookies.delete(name, { path: "/" });
+    }
+  };
+}
+
+export { createCsrfManager, createEncryptedCookie, signRequest, verifyWebhookSignature };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/modules/crypto/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/modules/crypto/kit-crypto-helpers.ts"],"names":[],"mappings":";;;;;AAgCA,eAAsB,uBAAuB,MAAA,EAA+C;AAC1F,EAAA,MAAM;AAAA,IACJ,MAAA;AAAA,IACA,KAAA;AAAA,IACA,SAAA;AAAA,IACA,eAAA,GAAkB,aAAA;AAAA,IAClB,SAAA,GAAY;AAAA,GACd,GAAI,MAAA;AAEJ,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,IAAI,eAAe,CAAA;AAC3D,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAK;AAEtC,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAAK,OAAO,IAAA,EAAM,SAAA,EAAW,WAAW,SAAS,CAAA;AAC7E,IAAA,OAAO,MAAA,CAAO,OAAA,IAAW,MAAA,CAAO,IAAA,KAAS,IAAA;AAAA,EAC3C,CAAA,CAAA,MACM;AACJ,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAYA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,EACA,SAAA,EACA,YAAY,QAAA,EACK;AACjB,EAAA,MAAM,SAAS,MAAM,MAAA,CAAO,KAAK,IAAA,CAAK,IAAA,EAAM,WAAW,SAAS,CAAA;AAChE,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,MAAM,IAAI,KAAA,CAAM,MAAA,CAAO,OAAO,OAAA,IAAW,IAAA,CAAK,gBAAgB,CAAC,CAAA;AAAA,EACjE;AACA,EAAA,OAAO,MAAA,CAAO,IAAA;AAChB;AAoBO,SAAS,kBAAkB,MAAA,EAA0B;AAC1D,EAAA,MAAM;AAAA,IACJ,MAAA;AAAA,IACA,UAAA,GAAa,YAAA;AAAA,IACb,UAAA,GAAa,cAAA;AAAA,IACb,aAAA,GAAgB,OAAA;AAAA,IAChB,WAAA,GAAc,EAAA;AAAA,IACd,gBAAgB;AAAC,GACnB,GAAI,MAAA;AAEJ,EAAA,OAAO;AAAA;AAAA;AAAA;AAAA,IAIL,MAAM,SAAS,OAAA,EAAmC;AAChD,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAM,WAAW,CAAA;AACpD,MAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,QAAA,MAAM,IAAI,KAAA,CAAM,IAAA,CAAK,qBAAqB,CAAC,CAAA;AAAA,MAC7C;AAEA,MAAA,MAAM,QAAQ,KAAA,CAAM,IAAA,CAAK,OAAO,IAAK,CAAA,CAClC,IAAI,CAAA,CAAA,KAAK,CAAA,CAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CACxC,KAAK,EAAE,CAAA;AAEV,MAAA,OAAA,CAAQ,GAAA,CAAI,YAAY,KAAA,EAAO;AAAA,QAC7B,IAAA,EAAM,GAAA;AAAA,QACN,QAAA,EAAU,IAAA;AAAA,QACV,MAAA,EAAQ,IAAA;AAAA,QACR,QAAA,EAAU,QAAA;AAAA,QACV,GAAG;AAAA,OACJ,CAAA;AAED,MAAA,OAAO,KAAA;AAAA,IACT,CAAA;AAAA;AAAA;AAAA;AAAA,IAKA,MAAM,OAAO,KAAA,EAAuC;AAClD,MAAA,MAAM,WAAA,GAAc,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAChD,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,OAAO,KAAA;AAAA,MACT;AAGA,MAAA,IAAI,YAAA,GAAe,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,IAAI,UAAU,CAAA;AAEvD,MAAA,IAAI,CAAC,YAAA,IAAgB,KAAA,CAAM,OAAA,CAAQ,WAAW,MAAA,EAAQ;AACpD,QAAA,IAAI;AACF,UAAA,MAAM,WAAW,MAAM,KAAA,CAAM,OAAA,CAAQ,KAAA,GAAQ,QAAA,EAAS;AACtD,UAAA,MAAM,UAAA,GAAa,QAAA,CAAS,GAAA,CAAI,aAAa,CAAA;AAC7C,UAAA,YAAA,GAAe,OAAO,UAAA,KAAe,QAAA,GAAW,UAAA,GAAa,IAAA;AAAA,QAC/D,CAAA,CAAA,MACM;AAAA,QAEN;AAAA,MACF;AAEA,MAAA,IAAI,CAAC,YAAA,EAAc;AACjB,QAAA,OAAO,KAAA;AAAA,MACT;AAGA,MAAA,MAAM,SAAS,MAAM,MAAA,CAAO,IAAA,CAAK,eAAA,CAAgB,aAAa,YAAY,CAAA;AAC1E,MAAA,OAAO,MAAA,CAAO,OAAA,IAAW,MAAA,CAAO,IAAA,KAAS,IAAA;AAAA,IAC3C,CAAA;AAAA;AAAA;AAAA;AAAA,IAKA,YAAA,GAAe;AACb,MAAA,OAAO,OAAO,EAAE,KAAA,EAAO,OAAA,EAAQ,KAAoF;AAEjH,QAAA,MAAM,WAAA,GAAc,CAAC,KAAA,EAAO,MAAA,EAAQ,SAAS,CAAA;AAC7C,QAAA,IAAI,WAAA,CAAY,QAAA,CAAS,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAC9C,UAAA,OAAO,QAAQ,KAAK,CAAA;AAAA,QACtB;AAEA,QAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,MAAA,CAAO,KAAK,CAAA;AACvC,QAAA,IAAI,CAAC,OAAA,EAAS;AACZ,UAAA,OAAO,IAAI,SAAS,IAAA,CAAK,sBAAsB,GAAG,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,QACnE;AAEA,QAAA,OAAO,QAAQ,KAAK,CAAA;AAAA,MACtB,CAAA;AAAA,IACF;AAAA,GACF;AACF;AAiBO,SAAS,sBAAsB,MAAA,EAA+B;AACnE,EAAA,MAAM,EAAE,MAAA,EAAQ,aAAA,EAAe,aAAA,GAAgB,IAAG,GAAI,MAAA;AAEtD,EAAA,OAAO;AAAA;AAAA;AAAA;AAAA,IAIL,MAAM,GAAA,CAAI,OAAA,EAAkB,IAAA,EAAc,KAAA,EAA+B;AACvE,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AACjC,MAAA,MAAM,SAAS,MAAM,MAAA,CAAO,GAAA,CAAI,OAAA,CAAQ,MAAM,aAAa,CAAA;AAE3D,MAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,QAAA,MAAM,IAAI,KAAA,CAAM,IAAA,CAAK,mBAAmB,CAAC,CAAA;AAAA,MAC3C;AAEA,MAAA,OAAA,CAAQ,GAAA,CAAI,IAAA,EAAM,MAAA,CAAO,IAAA,EAAO;AAAA,QAC9B,IAAA,EAAM,GAAA;AAAA,QACN,QAAA,EAAU,IAAA;AAAA,QACV,MAAA,EAAQ,IAAA;AAAA,QACR,QAAA,EAAU,KAAA;AAAA,QACV,GAAG;AAAA,OACJ,CAAA;AAAA,IACH,CAAA;AAAA;AAAA;AAAA;AAAA,IAKA,MAAM,GAAA,CAAiB,OAAA,EAAkB,IAAA,EAAiC;AACxE,MAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA;AAClC,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,SAAS,MAAM,MAAA,CAAO,GAAA,CAAI,OAAA,CAAQ,WAAW,aAAa,CAAA;AAChE,QAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,UAAA,OAAO,IAAA;AAAA,QACT;AAEA,QAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAK,CAAA;AAAA,MAChC,CAAA,CAAA,MACM;AACJ,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,IACF,CAAA;AAAA;AAAA;AAAA;AAAA,IAKA,MAAA,CAAO,SAAkB,IAAA,EAAoB;AAC3C,MAAA,OAAA,CAAQ,MAAA,CAAO,IAAA,EAAM,EAAE,IAAA,EAAM,KAAK,CAAA;AAAA,IACpC;AAAA,GACF;AACF","file":"index.js","sourcesContent":["/**\n * @h-ai/kit — Crypto Helpers\n *\n * 集成 @h-ai/crypto 的 SvelteKit 工具\n * @module kit-crypto-helpers\n */\n\nimport type { Cookies, RequestEvent } from '@sveltejs/kit'\nimport type {\n  CryptoCsrfConfig,\n  CryptoServiceLike,\n  EncryptedCookieConfig,\n  WebhookVerifyConfig,\n} from './kit-crypto-types.js'\nimport { kitM } from '../../kit-i18n.js'\n\n/**\n * 验证 Webhook 签名\n *\n * 从请求头取出签名，用 HMAC 对原始 Body 进行比较验证。\n *\n * @param config - 签名验证配置\n * @returns 签名是否合法\n *\n * @example\n * ```ts\n * const valid = await verifyWebhookSignature({\n *   crypto, event, secretKey: 'wh_secret', signatureHeader: 'X-Signature',\n * })\n * if (!valid) return new Response('Invalid signature', { status: 401 })\n * ```\n */\nexport async function verifyWebhookSignature(config: WebhookVerifyConfig): Promise<boolean> {\n  const {\n    crypto,\n    event,\n    secretKey,\n    signatureHeader = 'X-Signature',\n    algorithm = 'sha256',\n  } = config\n\n  const signature = event.request.headers.get(signatureHeader)\n  if (!signature) {\n    return false\n  }\n\n  const body = await event.request.text()\n\n  try {\n    const result = await crypto.hmac.verify(body, secretKey, signature, algorithm)\n    return result.success && result.data === true\n  }\n  catch {\n    return false\n  }\n}\n\n/**\n * 生成请求 HMAC 签名（用于调用外部服务）\n *\n * @param crypto - @h-ai/crypto 服务实例\n * @param body - 请求体字符串\n * @param secretKey - 共享密钥\n * @param algorithm - 哈希算法（默认 `'sha256'`）\n * @returns 签名字符串\n * @throws 签名失败时抛出 Error\n */\nexport async function signRequest(\n  crypto: CryptoServiceLike,\n  body: string,\n  secretKey: string,\n  algorithm = 'sha256',\n): Promise<string> {\n  const result = await crypto.hmac.sign(body, secretKey, algorithm)\n  if (!result.success) {\n    throw new Error(result.error?.message || kitM('kit_signFailed'))\n  }\n  return result.data!\n}\n\n/**\n * 创建 CSRF Token 管理器\n *\n * 基于 `@h-ai/crypto` 随机字节 + 时间安全比较，\n * 提供 token 生成、验证和 SvelteKit handle 中间件。\n *\n * @param config - CSRF 配置（crypto 实例、Cookie 名、Header 名等）\n * @returns `{ generate, verify, createHandle }`\n *\n * @example\n * ```ts\n * const csrf = createCsrfManager({ crypto })\n * // 在 load 中生成\n * const token = await csrf.generate(cookies)\n * // 在 action 中验证\n * const ok = await csrf.verify(event)\n * ```\n */\nexport function createCsrfManager(config: CryptoCsrfConfig) {\n  const {\n    crypto,\n    cookieName = 'csrf_token',\n    headerName = 'X-CSRF-Token',\n    formFieldName = '_csrf',\n    tokenLength = 32,\n    cookieOptions = {},\n  } = config\n\n  return {\n    /**\n     * 生成新的 CSRF Token 并设置 Cookie\n     */\n    async generate(cookies: Cookies): Promise<string> {\n      const result = await crypto.random.bytes(tokenLength)\n      if (!result.success) {\n        throw new Error(kitM('kit_csrfTokenFailed'))\n      }\n\n      const token = Array.from(result.data!)\n        .map(b => b.toString(16).padStart(2, '0'))\n        .join('')\n\n      cookies.set(cookieName, token, {\n        path: '/',\n        httpOnly: true,\n        secure: true,\n        sameSite: 'strict',\n        ...cookieOptions,\n      })\n\n      return token\n    },\n\n    /**\n     * 验证 CSRF Token\n     */\n    async verify(event: RequestEvent): Promise<boolean> {\n      const cookieToken = event.cookies.get(cookieName)\n      if (!cookieToken) {\n        return false\n      }\n\n      // 从 header 或 form data 获取 token\n      let requestToken = event.request.headers.get(headerName)\n\n      if (!requestToken && event.request.method === 'POST') {\n        try {\n          const formData = await event.request.clone().formData()\n          const fieldValue = formData.get(formFieldName)\n          requestToken = typeof fieldValue === 'string' ? fieldValue : null\n        }\n        catch {\n          // 不是 form data\n        }\n      }\n\n      if (!requestToken) {\n        return false\n      }\n\n      // 时间安全的比较\n      const result = await crypto.hash.timingSafeEqual(cookieToken, requestToken)\n      return result.success && result.data === true\n    },\n\n    /**\n     * 创建 CSRF 验证中间件\n     */\n    createHandle() {\n      return async ({ event, resolve }: { event: RequestEvent, resolve: (event: RequestEvent) => Promise<Response> }) => {\n        // 跳过安全方法\n        const safeMethods = ['GET', 'HEAD', 'OPTIONS']\n        if (safeMethods.includes(event.request.method)) {\n          return resolve(event)\n        }\n\n        const isValid = await this.verify(event)\n        if (!isValid) {\n          return new Response(kitM('kit_csrfVerifyFailed'), { status: 403 })\n        }\n\n        return resolve(event)\n      }\n    },\n  }\n}\n\n/**\n * 创建加密 Cookie 管理器\n *\n * 使用 AES 对 Cookie 值进行加解密，防止客户端篡改。\n *\n * @param config - 加密 Cookie 配置（含加密密钥）\n * @returns `{ set, get, delete }`\n *\n * @example\n * ```ts\n * const enc = createEncryptedCookie({ crypto, encryptionKey: 'my-32byte-key' })\n * await enc.set(cookies, 'prefs', { theme: 'dark' })\n * const prefs = await enc.get(cookies, 'prefs')\n * ```\n */\nexport function createEncryptedCookie(config: EncryptedCookieConfig) {\n  const { crypto, encryptionKey, cookieOptions = {} } = config\n\n  return {\n    /**\n     * 设置加密 Cookie\n     */\n    async set(cookies: Cookies, name: string, value: unknown): Promise<void> {\n      const json = JSON.stringify(value)\n      const result = await crypto.aes.encrypt(json, encryptionKey)\n\n      if (!result.success) {\n        throw new Error(kitM('kit_encryptFailed'))\n      }\n\n      cookies.set(name, result.data!, {\n        path: '/',\n        httpOnly: true,\n        secure: true,\n        sameSite: 'lax',\n        ...cookieOptions,\n      })\n    },\n\n    /**\n     * 获取并解密 Cookie\n     */\n    async get<T = unknown>(cookies: Cookies, name: string): Promise<T | null> {\n      const encrypted = cookies.get(name)\n      if (!encrypted) {\n        return null\n      }\n\n      try {\n        const result = await crypto.aes.decrypt(encrypted, encryptionKey)\n        if (!result.success) {\n          return null\n        }\n\n        return JSON.parse(result.data!) as T\n      }\n      catch {\n        return null\n      }\n    },\n\n    /**\n     * 删除 Cookie\n     */\n    delete(cookies: Cookies, name: string): void {\n      cookies.delete(name, { path: '/' })\n    },\n  }\n}\n"]}

package/package.json

@@ -0,0 +1,81 @@
+{
+  "name": "@h-ai/kit",
+  "type": "module",
+  "version": "0.1.0-alpha5",
+  "description": "Hai Framework SvelteKit integration module.",
+  "license": "Apache-2.0",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "browser": "./dist/browser.js",
+      "import": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/client/index.d.ts",
+      "import": "./dist/client/index.js"
+    },
+    "./crypto": {
+      "types": "./dist/modules/crypto/index.d.ts",
+      "import": "./dist/modules/crypto/index.js"
+    },
+    "./vite": {
+      "types": "./dist/vite/index.d.ts",
+      "import": "./dist/vite/index.js"
+    },
+    "./adapter": {
+      "types": "./dist/adapter/index.d.ts",
+      "import": "./dist/adapter/index.js"
+    },
+    "./a2a": {
+      "types": "./dist/modules/a2a/index.d.ts",
+      "import": "./dist/modules/a2a/index.js"
+    }
+  },
+  "main": "./dist/index.js",
+  "browser": "./dist/browser.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "@sveltejs/adapter-node": "^5.0.0",
+    "@sveltejs/adapter-static": "^3.0.0",
+    "@sveltejs/kit": "^2.53.4",
+    "svelte": "^5.53.6"
+  },
+  "peerDependenciesMeta": {
+    "@sveltejs/adapter-node": {
+      "optional": true
+    },
+    "@sveltejs/adapter-static": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "zod": "^4.3.6",
+    "@h-ai/core": "0.1.0-alpha5",
+    "@h-ai/iam": "0.1.0-alpha5"
+  },
+  "devDependencies": {
+    "@sveltejs/kit": "^2.15.0",
+    "@types/node": "^25.1.0",
+    "rimraf": "^6.0.1",
+    "svelte": "^5.53.5",
+    "tsup": "^8.3.5",
+    "typescript": "^5.7.2",
+    "vitest": "^4.0.18"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "clean": "rimraf dist .turbo"
+  }
+}