@h-ai/kit 0.1.0-alpha8 → 1.0.0-beta.1

package/dist/index.js

@@ -1,10 +1,17 @@
-import { defineCrud } from './chunk-FRYJMRTP.js';
-export { defineCrud, resolveOptions, resolveText } from './chunk-FRYJMRTP.js';
-import { createHandleFetch, createTokenStore, clearBrowserToken, setBrowserToken, logout, registerAndLogin, loginWithApiKey, loginWithLdap, loginWithOtp, login, createKitClient, configureAuth, getAccessToken } from './chunk-PHS7ZD5L.js';
-import { resolveA2AConfig, handleA2ARequest } from './chunk-475WECWK.js';
-import { transportEncryptionMiddleware } from './chunk-AD6S473Y.js';
-import { kitM, setAllModulesLocale } from './chunk-6TMSXG7J.js';
-import { core } from '@h-ai/core';
+import { defineCrud } from './chunk-5VWPH7DO.js';
+export { KitConfigSchema, defineCrud, resolveKitConfig, resolveKitTransportConfig, resolveOptions, resolveText } from './chunk-5VWPH7DO.js';
+import { clearBrowserToken, setBrowserToken, logout, registerAndLogin, loginWithApiKey, loginWithLdap, loginWithOtp, login, installBrowserTransportFetch, installBrowserTransport, createKitAuthActions, createKitClient, getAccessToken, configureAuth } from './chunk-YKJRQCWR.js';
+import { resolveA2AConfig, handleA2ARequest } from './chunk-7EH47MTW.js';
+import { transportEncryptionMiddleware } from './chunk-3OHUSKHI.js';
+import './chunk-JRQPMPQC.js';
+import { kitM, setAllModulesLocale } from './chunk-USFJN7IO.js';
+import { core, HaiCommonError, err } from '@h-ai/core';
+import { audit } from '@h-ai/audit';
+import { TRANSPORT_PROTOCOL } from '@h-ai/crypto';
+import { createHash } from 'crypto';
+import { isIP } from 'net';
+import process2 from 'process';
+import { IamConfirmPasswordResetInputSchema, IamRequestPasswordResetInputSchema, IamSendOtpInputSchema, IamRegisterInputSchema, IamOtpLoginInputSchema, IamLdapLoginInputSchema, IamLoginInputSchema, IamRenewPasswordInputSchema, IamReauthenticateInputSchema, IamCreateCaptchaInputSchema, IamLogoutInputSchema, FeedbackSubmitInputSchema, FeedbackListInputSchema, FeedbackIdInputSchema, FeedbackEvidenceQuerySchema, FeedbackAppendEvidenceInputSchema, FeedbackSetStatusInputSchema, FeedbackRetryInputSchema, FeedbackCompleteInputSchema, FeedbackExportInputSchema, FeedbackUploadInputSchema, FeedbackAttachmentQuerySchema, FeedbackExportQuerySchema } from '@h-ai/api-contract';
 import { z } from 'zod';
 
 // src/guards/kit-permission.ts
@@ -51,8 +58,6 @@ function requirePermission(session, permission) {
     throw denied;
   }
 }
-
-// src/kit-response.ts
 function ok(data, requestId) {
   const response = {
     success: true,
@@ -79,18 +84,21 @@ function noContent() {
   return new Response(null, { status: 204 });
 }
 function error(code, message, status = 400, requestId, details) {
+  const safe = core.error.toPublic({ code, message, httpStatus: status }, requestId);
+  core.logger.error("API request failed", { traceId: safe.traceId, error: { code, message, httpStatus: status, details } });
   const response = {
     success: false,
     error: {
       code,
-      message,
-      details
+      message: safe.message,
+      traceId: safe.traceId,
+      details: status < 500 ? core.sanitize.sanitizeSensitiveFields(details) : void 0
     },
-    requestId
+    requestId: requestId ?? core.context.get().requestId ?? safe.traceId
   };
   return new Response(JSON.stringify(response), {
     status,
-    headers: { "Content-Type": "application/json" }
+    headers: { "Content-Type": "application/json", "X-Trace-Id": safe.traceId }
   });
 }
 function badRequest(message, requestId, details) {
@@ -124,12 +132,23 @@ function fromResult(result, httpStatusMap, requestId) {
   if (result.success) {
     return ok(result.data, requestId);
   }
-  const { code, message } = result.error;
-  const status = httpStatusMap?.[code] ?? 400;
-  return error(String(code), message, status, requestId);
+  const status = httpStatusMap?.[result.error.code] ?? (typeof result.error.httpStatus === "number" ? result.error.httpStatus : 400);
+  return fromError({ ...result.error, httpStatus: status }, requestId);
 }
 function fromError(haiError, requestId) {
-  return error(String(haiError.code), haiError.message, haiError.httpStatus ?? 400, requestId);
+  const safe = core.error.toPublic(haiError, requestId);
+  core.logger.error("API operation failed", { traceId: safe.traceId, error: haiError });
+  return error(String(safe.code), safe.message, safe.httpStatus ?? 400, safe.traceId);
+}
+
+// src/guards/kit-sensitive.ts
+async function requireSensitiveOperation(iam, event, operation) {
+  const policy = iam.publicConfig?.reauthentication;
+  if (!policy?.enabled)
+    return;
+  const checked = await iam.auth.checkSensitiveOperation(getAccessToken(event.request, event.cookies) ?? "", operation, event.request.headers.get("x-hai-reauthentication") ?? void 0);
+  if (!checked.success)
+    throw fromError(checked.error);
 }
 
 // src/kit-utils.ts
@@ -150,63 +169,6 @@ function isSvelteKitControlFlow(value) {
   }
   return false;
 }
-
-// src/kit-handler.ts
-function handler(fn) {
-  return async (event) => {
-    try {
-      return await fn(event);
-    } catch (error2) {
-      if (isResponseLike(error2)) {
-        return error2;
-      }
-      if (isSvelteKitControlFlow(error2)) {
-        throw error2;
-      }
-      const normalizedError = error2 instanceof Error ? {
-        name: error2.name,
-        message: error2.message,
-        stack: error2.stack,
-        cause: error2.cause
-      } : error2;
-      core.logger.error("Request handler error", {
-        error: normalizedError,
-        path: event.url.pathname,
-        method: event.request.method
-      });
-      return internalError();
-    }
-  };
-}
-
-// src/kit-contract.ts
-function defineEndpoint(def) {
-  return def;
-}
-function fromContract(endpoint, fn) {
-  return handler(async (event) => {
-    let raw;
-    if (endpoint.method === "GET") {
-      raw = Object.fromEntries(event.url.searchParams);
-    } else {
-      try {
-        raw = await event.request.json();
-      } catch {
-        raw = {};
-      }
-    }
-    const parsed = endpoint.input.safeParse(raw);
-    if (!parsed.success) {
-      const errors = parsed.error.issues.map((issue) => ({
-        field: issue.path.join(".") || "_",
-        message: issue.message
-      }));
-      return validationError(errors);
-    }
-    const result = await fn(parsed.data, event);
-    return ok(result);
-  });
-}
 function loggingMiddleware(config = {}) {
   const { logBody = false, logResponse = false, redactFields = ["password", "token", "secret", "authorization", "apikey", "api_key", "creditcard", "credit_card"] } = config;
   return async (context, next) => {
@@ -221,7 +183,8 @@ function loggingMiddleware(config = {}) {
       requestId,
       method: event.request.method,
       path: event.url.pathname,
-      query: Object.fromEntries(event.url.searchParams),
+      // SvelteKit 预渲染禁止读取追踪 URL 的查询；日志只读原请求，不建立页面路由依赖。
+      query: redactObject(Object.fromEntries(new URL(event.request.url).searchParams), redactFields),
       userAgent: event.request.headers.get("user-agent"),
       ip: clientIp
     };
@@ -249,76 +212,95 @@ function loggingMiddleware(config = {}) {
   };
 }
 function redactObject(obj, fields) {
-  if (typeof obj !== "object" || obj === null) {
-    return obj;
-  }
-  if (Array.isArray(obj)) {
-    return obj.map((item) => redactObject(item, fields));
-  }
-  if (obj instanceof Date || obj instanceof RegExp) {
-    return obj;
-  }
-  const result = {};
-  for (const [key, value] of Object.entries(obj)) {
-    if (fields.includes(key.toLowerCase())) {
-      result[key] = "[REDACTED]";
-    } else if (typeof value === "object" && value !== null) {
-      result[key] = redactObject(value, fields);
-    } else {
-      result[key] = value;
+  return core.sanitize.sanitizeSensitiveFields(obj, { matcher: fields });
+}
+function permitsMemory() {
+  return !core.module.requiresSharedState(process2.env);
+}
+function createCacheRateLimitStore(backend, options) {
+  if (!options.namespace || options.namespace.length > 128)
+    throw new TypeError("A rate limit namespace of 1-128 characters is required");
+  return {
+    scope: "shared",
+    async increment(key, windowMs) {
+      if (!backend.config || backend.config.type !== "redis" && !(backend.config.type === "memory" && options.allowMemory && permitsMemory()))
+        throw new Error("Rate limiting requires a shared Redis cache");
+      const digest = createHash("sha256").update(JSON.stringify([options.namespace, windowMs, key])).digest("hex");
+      const cacheKey = `hai:kit:ratelimit:{${digest}}`;
+      for (let attempt = 0; attempt < 64; attempt++) {
+        const read = await backend.kv.get(cacheKey);
+        if (!read.success)
+          throw new Error("Rate limit cache read failed");
+        const old = read.data ?? void 0;
+        if (old && (!Number.isSafeInteger(old.count) || old.count <= 0 || old.count >= Number.MAX_SAFE_INTEGER || !Number.isSafeInteger(old.resetAt)))
+          throw new Error("Invalid rate limit state");
+        const next = old ? { count: old.count + 1, resetAt: old.resetAt } : { count: 1, resetAt: Date.now() + windowMs };
+        const written = await backend.kv.compareAndSwap(cacheKey, old, next, old ? { keepTtl: true } : { px: windowMs });
+        if (!written.success)
+          throw new Error("Rate limit cache commit failed");
+        if (written.data)
+          return next;
+      }
+      throw new Error("Rate limit contention limit exceeded");
     }
-  }
-  return result;
+  };
+}
+function createMemoryRateLimitStore() {
+  if (!permitsMemory())
+    throw new Error("Memory rate limiting is restricted to development and tests");
+  return new MemoryRateLimitStore();
+}
+function clientKey(address) {
+  if (isIP(address) !== 6)
+    return address;
+  const normalized = new URL(`http://[${address}]`).hostname.slice(1, -1);
+  const mapped = /^::ffff:([0-9a-f]+):([0-9a-f]+)$/.exec(normalized);
+  if (!mapped)
+    return normalized;
+  const value = Number.parseInt(mapped[1], 16) * 65536 + Number.parseInt(mapped[2], 16);
+  return [value >>> 24, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
 }
 var MemoryRateLimitStore = class {
+  scope = "memory";
   store = /* @__PURE__ */ new Map();
-  cleanupTimer = null;
+  cleanupCursor;
   /**
-   * 启动定期清理过期条目
-   *
-   * @param intervalMs - 清理间隔（毫秒）
+   * 有界惰性回收；保留迭代位置，避免每次从头扫描使尾部过期项永久滞留。
+   * @param now - 当前请求时间，等于 resetAt 时窗口已经失效。
    */
-  startCleanup(intervalMs) {
-    if (this.cleanupTimer)
-      return;
-    this.cleanupTimer = setInterval(() => {
-      const now = Date.now();
-      for (const [key, entry] of this.store) {
-        if (entry.resetAt < now) {
-          this.store.delete(key);
-        }
+  prune(now) {
+    this.cleanupCursor ??= this.store.entries();
+    for (let index = 0; index < 64; index++) {
+      const next = this.cleanupCursor.next();
+      if (next.done) {
+        this.cleanupCursor = void 0;
+        break;
       }
-    }, intervalMs);
-    if (this.cleanupTimer && typeof this.cleanupTimer === "object" && "unref" in this.cleanupTimer) {
-      this.cleanupTimer.unref();
+      const [key, entry] = next.value;
+      if (entry.resetAt <= now)
+        this.store.delete(key);
     }
   }
-  get(key) {
-    return this.store.get(key);
-  }
-  set(key, entry) {
-    this.store.set(key, entry);
-  }
-  delete(key) {
-    this.store.delete(key);
-  }
   /**
    * 原子自增（内存实现为同步操作，天然原子）
    *
    * @param key - 限流键
    * @param windowMs - 窗口时长
-   * @returns 自增后的条目
+   * @returns 自增后的快照，修改返回对象不会改变已保存的计数。
+   * @throws 新 key 超出容量或期限非法；中间件将其转换为 503。
+   * @example store.increment('client', 60_000)
    */
   increment(key, windowMs) {
     const now = Date.now();
-    let entry = this.store.get(key);
-    if (!entry || entry.resetAt < now) {
-      entry = { count: 1, resetAt: now + windowMs };
-    } else {
-      entry.count++;
-    }
+    if (!Number.isSafeInteger(windowMs) || windowMs <= 0 || windowMs > 2147483647)
+      throw new TypeError(kitM("kit_rateLimitWindowInvalid"));
+    this.prune(now);
+    const current = this.store.get(key);
+    if (!current && this.store.size >= 1e4)
+      throw new Error(kitM("kit_rateLimitMemoryCapacity"));
+    const entry = !current || current.resetAt <= now ? { count: 1, resetAt: now + windowMs } : { count: current.count + 1, resetAt: current.resetAt };
     this.store.set(key, entry);
-    return entry;
+    return { ...entry };
   }
 };
 function rateLimitMiddleware(config) {
@@ -327,38 +309,36 @@ function rateLimitMiddleware(config) {
     maxRequests,
     keyGenerator = (event) => {
       try {
-        return event.getClientAddress?.() ?? "unknown";
+        return clientKey(event.getClientAddress?.() ?? "unknown");
       } catch {
         return "unknown";
       }
     },
     onLimitReached
   } = config;
-  const store = config.store ?? (() => {
-    const memStore = new MemoryRateLimitStore();
-    memStore.startCleanup(windowMs);
-    return memStore;
-  })();
+  if (!Number.isSafeInteger(windowMs) || windowMs <= 0 || windowMs > 2147483647 || !Number.isSafeInteger(maxRequests) || maxRequests <= 0)
+    throw new TypeError("Rate limit window/count must be positive integers (window <= 2147483647ms)");
+  const store = config.store;
+  if (!store || typeof store.increment !== "function")
+    throw new TypeError("An atomic rate limit store is required");
+  if (store.scope === "memory" && !permitsMemory())
+    throw new Error("Memory rate limiting is restricted to development and tests");
   return async (context, next) => {
     const { event, requestId } = context;
-    const key = keyGenerator(event);
     const now = Date.now();
     let entry;
-    if (store.increment) {
-      entry = await store.increment(key, windowMs);
-    } else {
-      const existing = await store.get(key);
-      if (!existing || existing.resetAt < now) {
-        entry = { count: 1, resetAt: now + windowMs };
-      } else {
-        entry = { ...existing, count: existing.count + 1 };
-      }
-      await store.set(key, entry);
+    try {
+      entry = await store.increment(keyGenerator(event), windowMs);
+      if (!Number.isSafeInteger(entry.count) || entry.count <= 0 || !Number.isSafeInteger(entry.resetAt))
+        throw new TypeError("Invalid atomic rate limit result");
+    } catch {
+      core.logger.error("Rate limit store unavailable", { requestId });
+      return new Response(JSON.stringify({ success: false, error: { code: "RATE_LIMIT_UNAVAILABLE", message: kitM("kit_internalError") }, requestId }), { status: 503, headers: { "Content-Type": "application/json" } });
     }
     const remaining = Math.max(0, maxRequests - entry.count);
     const resetTime = Math.ceil(entry.resetAt / 1e3);
     if (entry.count > maxRequests) {
-      core.logger.warn("Rate limit exceeded", { key, requestId });
+      core.logger.warn("Rate limit exceeded", { requestId });
       if (onLimitReached) {
         return onLimitReached(event);
       }
@@ -378,7 +358,7 @@ function rateLimitMiddleware(config) {
             "X-RateLimit-Limit": String(maxRequests),
             "X-RateLimit-Remaining": "0",
             "X-RateLimit-Reset": String(resetTime),
-            "Retry-After": String(Math.ceil((entry.resetAt - now) / 1e3))
+            "Retry-After": String(Math.max(1, Math.ceil((entry.resetAt - now) / 1e3)))
           }
         }
       );
@@ -401,40 +381,40 @@ function createEncryptedCookieProxy(cookies, config) {
           const raw = target.get(name, opts);
           if (!raw || !names.has(name))
             return raw;
-          if (!raw.startsWith(ENCRYPTED_PREFIX))
-            return raw;
+          if (!raw.startsWith(ENCRYPTED_PREFIX)) {
+            logger.warn("Encrypted cookie has invalid format", { name });
+            return void 0;
+          }
           try {
             const ciphertext = raw.slice(ENCRYPTED_PREFIX.length);
             const separatorIndex = ciphertext.indexOf(":");
-            if (separatorIndex === -1)
-              return raw;
+            if (separatorIndex === -1) {
+              logger.warn("Encrypted cookie has invalid format", { name });
+              return void 0;
+            }
             const iv = ciphertext.slice(0, separatorIndex);
             const encrypted = ciphertext.slice(separatorIndex + 1);
             const result = symmetric.decryptWithIV(encrypted, encryptionKey, iv);
             if (!result.success || typeof result.data !== "string") {
-              logger.warn("Cookie decryption failed, returning raw value", { name });
-              return raw;
+              logger.warn("Cookie decryption failed", { name });
+              return void 0;
             }
             return result.data;
           } catch {
-            logger.warn("Cookie decryption error, returning raw value", { name });
-            return raw;
+            logger.warn("Cookie decryption error", { name });
+            return void 0;
           }
         };
       }
       if (prop === "set") {
         return (name, value, opts) => {
           if (names.has(name)) {
-            try {
-              const result = symmetric.encryptWithIV(value, encryptionKey);
-              if (result.success && result.data) {
-                value = `${ENCRYPTED_PREFIX}${result.data.iv}:${result.data.ciphertext}`;
-              } else {
-                logger.warn("Cookie encryption failed, storing plaintext", { name });
-              }
-            } catch {
-              logger.warn("Cookie encryption error, storing plaintext", { name });
+            const result = symmetric.encryptWithIV(value, encryptionKey);
+            if (!result.success || !result.data) {
+              logger.error("Cookie encryption failed", { name });
+              throw new Error("Cookie encryption failed");
             }
+            value = `${ENCRYPTED_PREFIX}${result.data.iv}:${result.data.ciphertext}`;
           }
           return target.set(name, value, opts);
         };
@@ -450,7 +430,14 @@ function generateId(prefix) {
   const random = crypto.randomUUID().replace(/-/g, "").substring(0, 8);
   return `${prefix}_${timestamp}${random}`;
 }
+function applyDefaultSecurityHeaders(response) {
+  response.headers.set("X-Content-Type-Options", "nosniff");
+  response.headers.set("X-Frame-Options", "DENY");
+  response.headers.set("Referrer-Policy", "no-referrer");
+}
 function createHandle(config = {}) {
+  const resolveIp = core.access.createClientIpResolver(config.trustedProxies ?? "auto");
+  const checkAccess = config.access && core.access.createRequestCheck(config.access);
   const {
     auth: authConfig,
     rateLimit: rateLimitConfig,
@@ -461,6 +448,8 @@ function createHandle(config = {}) {
     middleware: customMiddleware = [],
     a2a: a2aInput
   } = config;
+  if (checkAccess && checkAccess.requiresEncryption && !cryptoConfig?.transport)
+    throw new Error("Request access rules require transport encryption, but Kit transport is not configured");
   const a2aResolved = resolveA2AConfig(a2aInput);
   if (authConfig?.cookieName || authConfig?.operations) {
     configureAuth({ cookieName: authConfig.cookieName, operations: authConfig.operations });
@@ -481,102 +470,172 @@ function createHandle(config = {}) {
   }
   if (rateLimitConfig) {
     builtinMiddleware.push(rateLimitMiddleware({
+      ...rateLimitConfig,
       windowMs: rateLimitConfig.windowMs ?? 6e4,
       maxRequests: rateLimitConfig.maxRequests ?? 100
     }));
   }
   const allMiddleware = [...builtinMiddleware, ...customMiddleware];
-  const finalMiddleware = buildTransportMiddleware(allMiddleware, cryptoConfig);
+  const transportMiddleware = buildTransportMiddleware(cryptoConfig, checkAccess ? checkAccess.encryption : void 0);
   const cookieProxyConfig = buildCookieProxyConfig(cryptoConfig);
   return async ({ event, resolve }) => {
-    const requestId = generateId("req");
-    const locals = event.locals;
-    locals.requestId = requestId;
-    if (cookieProxyConfig) {
-      const proxiedCookies = createEncryptedCookieProxy(event.cookies, cookieProxyConfig);
-      Object.defineProperty(event, "cookies", {
-        value: proxiedCookies,
-        writable: true,
-        configurable: true
-      });
-    }
+    const suppliedRequestId = event.request.headers.get("x-request-id");
+    const requestId = suppliedRequestId && /^[\w.:-]{1,128}$/.test(suppliedRequestId) ? suppliedRequestId : generateId("req");
+    let clientAddress;
     try {
-      if (a2aResolved) {
-        const a2aResponse = await handleA2ARequest(event, requestId, a2aResolved);
-        if (a2aResponse)
-          return a2aResponse;
+      clientAddress = event.getClientAddress();
+    } catch {
+    }
+    const resolvedAddress = resolveIp(event.request, clientAddress);
+    if (resolvedAddress !== clientAddress) {
+      event.getClientAddress = () => {
+        if (!resolvedAddress)
+          throw new Error("Trusted client address is unavailable");
+        return resolvedAddress;
+      };
+    }
+    clientAddress = resolvedAddress;
+    const accessDecision = checkAccess ? checkAccess(event.url.pathname, event.request.method, clientAddress) : void 0;
+    return core.context.run({ requestId, userId: void 0, scopeId: void 0, jobId: void 0 }, () => audit.withContext({
+      actor: null,
+      requestId,
+      traceId: requestId,
+      scopeId: void 0,
+      ipAddress: clientAddress,
+      userAgent: event.request.headers.get("user-agent")?.slice(0, 4096)
+    }, async () => {
+      let actor = null;
+      let guardDenied = false;
+      let requestFailed = false;
+      const captureRequest = async (status) => {
+        if (!audit.isInitialized)
+          return;
+        const resource = event.route.id ?? "unmatched";
+        const written = await audit.capture({
+          action: "request.execute",
+          resource,
+          userId: actor?.id ?? null,
+          actorSnapshot: actor,
+          category: /\/(?:auth|iam|audit)(?:\/|$)/.test(resource) ? "system" : "business",
+          outcome: guardDenied || [401, 403, 423, 429].includes(status) ? "denied" : requestFailed || status >= 400 ? "failure" : "success",
+          details: { method: event.request.method, status }
+        }, { read: ["GET", "HEAD", "OPTIONS"].includes(event.request.method) });
+        if (!written.success)
+          core.logger.error("Request audit failed", { requestId, resource, error: written.error });
+      };
+      const context = {
+        event,
+        requestId
+      };
+      const locals = event.locals;
+      locals.requestId = requestId;
+      if (cookieProxyConfig) {
+        const proxiedCookies = createEncryptedCookieProxy(event.cookies, cookieProxyConfig);
+        Object.defineProperty(event, "cookies", {
+          value: proxiedCookies,
+          writable: true,
+          configurable: true
+        });
       }
-      let session;
-      if (authConfig) {
-        const token = getAccessToken(event.request, event.cookies);
-        if (token) {
-          session = await authConfig.verifyToken(token) ?? void 0;
-          locals.session = session;
-          if (session) {
-            locals.accessToken = token;
+      const runRequest = async () => {
+        try {
+          if (accessDecision && !accessDecision.allowed) {
+            guardDenied = true;
+            core.logger.info("Request access policy denied", { ruleId: accessDecision.ruleId, reason: accessDecision.reason, method: event.request.method, ipAddress: clientAddress });
+            return Response.json({ success: false, error: { ...HaiCommonError.REQUEST_ACCESS_DENIED, message: core.i18n.coreM("core_requestAccessDenied"), traceId: requestId } }, { status: 403 });
           }
-        }
-      }
-      for (const guardConfig of guards) {
-        const guardResult = await executeGuard(guardConfig, event, session);
-        if (!guardResult.allowed) {
-          if (guardResult.redirect) {
-            return new Response(null, {
-              status: 302,
-              headers: { Location: guardResult.redirect }
-            });
+          if (!transportMiddleware && event.request.method !== "OPTIONS" && (event.request.headers.has(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER) || event.request.headers.has(TRANSPORT_PROTOCOL.ENVELOPE_HEADER)) && checkAccess && checkAccess.encryption(event.url.pathname, event.request.method) === "disabled") {
+            return Response.json(err({ ...HaiCommonError.VALIDATION_ERROR, message: kitM("kit_transportPlaintextRequired"), traceId: requestId }), { status: 400 });
+          }
+          if (a2aResolved) {
+            const a2aResponse = await handleA2ARequest(event, requestId, a2aResolved);
+            if (a2aResponse)
+              return a2aResponse;
+          }
+          let session;
+          if (authConfig) {
+            const token = getAccessToken(event.request, event.cookies);
+            if (token) {
+              session = await authConfig.verifyToken(token) ?? void 0;
+              locals.session = session;
+              if (session) {
+                locals.accessToken = token;
+              }
+            }
+          }
+          context.session = session;
+          actor = session ? { id: session.userId, username: session.username, roles: session.roles } : null;
+          return await audit.withContext({ actor }, () => core.context.run({ userId: session?.userId }, async () => {
+            for (const guardConfig of guards) {
+              const guardResult = await executeGuard(guardConfig, event, session);
+              if (!guardResult.allowed) {
+                guardDenied = true;
+                if (guardResult.redirect) {
+                  return new Response(null, {
+                    status: 302,
+                    headers: { Location: guardResult.redirect }
+                  });
+                }
+                return new Response(
+                  JSON.stringify({
+                    success: false,
+                    error: {
+                      code: "FORBIDDEN",
+                      message: guardResult.message ?? kitM("kit_accessDenied")
+                    },
+                    requestId
+                  }),
+                  {
+                    status: guardResult.status ?? 403,
+                    headers: { "Content-Type": "application/json" }
+                  }
+                );
+              }
+            }
+            const response2 = await executeMiddlewareChain(
+              allMiddleware,
+              context,
+              () => resolve(event)
+            );
+            return response2;
+          }));
+        } catch (error2) {
+          if (isSvelteKitControlFlow(error2)) {
+            if (typeof error2 === "object" && error2 !== null && "status" in error2 && typeof error2.status === "number")
+              await captureRequest(error2.status);
+            throw error2;
+          }
+          requestFailed = true;
+          core.logger.error("Request failed", { requestId, error: error2 });
+          if (onError) {
+            return onError(error2, event);
           }
           return new Response(
             JSON.stringify({
               success: false,
               error: {
-                code: "FORBIDDEN",
-                message: guardResult.message ?? kitM("kit_accessDenied")
+                code: "INTERNAL_ERROR",
+                message: core.error.formatMessage({ message: kitM("kit_internalError"), traceId: requestId }),
+                traceId: requestId
               },
               requestId
             }),
             {
-              status: guardResult.status ?? 403,
+              status: 500,
               headers: { "Content-Type": "application/json" }
             }
           );
         }
-      }
-      const context = {
-        event,
-        session,
-        requestId
       };
-      const response = await executeMiddlewareChain(
-        finalMiddleware,
-        context,
-        () => resolve(event)
-      );
+      const keyExchange = cryptoConfig?.transport ? cryptoConfig.transport.keyExchangePath ?? "/api/_hai/key-exchange" : void 0;
+      const deniedHandshake = accessDecision && !accessDecision.allowed && event.request.method === "POST" && event.url.pathname === keyExchange;
+      const response = deniedHandshake ? await runRequest() : transportMiddleware ? await transportMiddleware(context, runRequest) : await runRequest();
+      await captureRequest(response.status);
+      applyDefaultSecurityHeaders(response);
       response.headers.set("X-Request-Id", requestId);
+      response.headers.set("X-Trace-Id", requestId);
       return response;
-    } catch (error2) {
-      if (isSvelteKitControlFlow(error2)) {
-        throw error2;
-      }
-      core.logger.error("Request failed", { requestId, error: error2 instanceof Error ? error2.message : error2 });
-      if (onError) {
-        return onError(error2, event);
-      }
-      return new Response(
-        JSON.stringify({
-          success: false,
-          error: {
-            code: "INTERNAL_ERROR",
-            message: kitM("kit_internalError")
-          },
-          requestId
-        }),
-        {
-          status: 500,
-          headers: { "Content-Type": "application/json" }
-        }
-      );
-    }
+    }));
   };
 }
 function buildAuthGuard(verifyToken, loginUrl) {
@@ -584,7 +643,8 @@ function buildAuthGuard(verifyToken, loginUrl) {
     if (session) {
       return { allowed: true };
     }
-    const isApiRoute = event.url.pathname.startsWith("/api/");
+    const routePath = event.route.id?.replace(/\/\([^/]*\)/g, "");
+    const isApiRoute = event.url.pathname.startsWith("/api/") || routePath?.startsWith("/api/") === true;
     if (isApiRoute) {
       return {
         allowed: false,
@@ -635,27 +695,28 @@ function matchPath(pathname, pattern) {
   }
   return pathname === pattern;
 }
-function buildTransportMiddleware(userMiddleware, cryptoConfig) {
+function buildTransportMiddleware(cryptoConfig, encryption) {
   if (!cryptoConfig?.transport)
-    return userMiddleware;
-  const transportOpts = typeof cryptoConfig.transport === "object" ? cryptoConfig.transport : {};
-  const transportMw = transportEncryptionMiddleware({
+    return null;
+  const transportOpts = cryptoConfig.transport;
+  return transportEncryptionMiddleware({
     enabled: true,
     crypto: cryptoConfig.crypto,
+    serverKeyRing: transportOpts.serverKeyRing,
+    basePath: transportOpts.basePath,
     keyExchangePath: transportOpts.keyExchangePath,
     excludePaths: transportOpts.excludePaths,
-    encryptResponse: transportOpts.encryptResponse,
-    requireEncryption: transportOpts.requireEncryption
-  });
-  return [transportMw, ...userMiddleware];
+    keyStore: transportOpts.keyStore,
+    maxPlaintextBytes: transportOpts.maxPlaintextBytes,
+    routePlaintextBytes: transportOpts.routePlaintextBytes
+  }, encryption);
 }
 function buildCookieProxyConfig(cryptoConfig) {
   if (!cryptoConfig?.encryptedCookies?.length)
     return null;
   const key = cryptoConfig.cookieEncryptionKey ?? (typeof process !== "undefined" ? process.env?.HAI_KIT_COOKIE_KEY : void 0);
   if (!key) {
-    core.logger.warn("Cookie encryption configured but no key provided (set crypto.cookieEncryptionKey or HAI_KIT_COOKIE_KEY env)");
-    return null;
+    throw new Error("Cookie encryption requires crypto.cookieEncryptionKey or HAI_KIT_COOKIE_KEY");
   }
   return {
     names: new Set(cryptoConfig.encryptedCookies),
@@ -672,28 +733,82 @@ function sequence(...handles) {
     return filtered[0];
   }
   return async ({ event, resolve }) => {
-    return filtered.reduceRight(
-      (next, handle) => (event2) => handle({ event: event2, resolve: next }),
-      resolve
-    )(event);
+    function applyHandle(index, currentEvent, options) {
+      if (index === filtered.length)
+        return resolve(currentEvent, options);
+      return filtered[index]({
+        event: currentEvent,
+        resolve: async (nextEvent, nextOptions) => {
+          const merged = {
+            ...options,
+            ...nextOptions,
+            preload: options?.preload ?? nextOptions?.preload,
+            filterSerializedResponseHeaders: options?.filterSerializedResponseHeaders ?? nextOptions?.filterSerializedResponseHeaders
+          };
+          if (options?.transformPageChunk || nextOptions?.transformPageChunk) {
+            merged.transformPageChunk = async ({ html, done }) => {
+              if (nextOptions?.transformPageChunk)
+                html = await nextOptions.transformPageChunk({ html, done }) ?? "";
+              if (options?.transformPageChunk)
+                html = await options.transformPageChunk({ html, done }) ?? "";
+              return html;
+            };
+          }
+          return applyHandle(index + 1, nextEvent, merged);
+        }
+      });
+    }
+    return applyHandle(0, event);
   };
 }
-function extractZodIssues(error2) {
-  const zodError = error2;
-  return zodError.issues ?? zodError.errors ?? [];
-}
-function zodIssuesToFormErrors(issues) {
-  return issues.map((issue) => ({
-    field: issue.path.join("."),
-    message: issue.message
-  }));
+function handler(fn) {
+  return async (event) => {
+    try {
+      return await fn(event);
+    } catch (error2) {
+      if (isResponseLike(error2)) {
+        return error2;
+      }
+      if (isSvelteKitControlFlow(error2)) {
+        throw error2;
+      }
+      const normalizedError = error2 instanceof Error ? {
+        name: error2.name,
+        message: error2.message,
+        stack: error2.stack,
+        cause: error2.cause
+      } : error2;
+      core.logger.error("Request handler error", {
+        error: normalizedError,
+        path: event.url.pathname,
+        method: event.request.method
+      });
+      return internalError();
+    }
+  };
 }
-function createValidationResult(error2) {
+var getKitZodMessage = core.zodValidation.createPrefixedZodMessageGetter(
+  "kit",
+  (messageKey, params) => kitM(messageKey, { params })
+);
+function validateParsedData(data, schema) {
+  const result = schema.safeParse(data);
+  if (result.success)
+    return { valid: true, data: result.data, errors: [] };
   return {
     valid: false,
-    errors: zodIssuesToFormErrors(extractZodIssues(error2))
+    errors: core.zodValidation.mapZodErrorToFormErrors(result.error, getKitZodMessage)
   };
 }
+function unwrapValidationResultOrThrow(result) {
+  if (result.valid && result.data !== void 0)
+    return result.data;
+  throw badRequest(
+    result.errors[0]?.message ?? kitM("kit_validationFailed"),
+    void 0,
+    { errors: result.errors }
+  );
+}
 async function validateForm(request, schema) {
   try {
     const contentType = request.headers.get("content-type") ?? "";
@@ -709,11 +824,7 @@ async function validateForm(request, schema) {
         errors: [{ field: "_", message: kitM("kit_unsupportedContentType") }]
       };
     }
-    const result = schema.safeParse(data);
-    if (result.success) {
-      return { valid: true, data: result.data, errors: [] };
-    }
-    return createValidationResult(result.error);
+    return validateParsedData(data, schema);
   } catch {
     return {
       valid: false,
@@ -723,51 +834,19 @@ async function validateForm(request, schema) {
 }
 function validateQuery(url, schema) {
   const data = Object.fromEntries(url.searchParams);
-  const result = schema.safeParse(data);
-  if (result.success) {
-    return { valid: true, data: result.data, errors: [] };
-  }
-  return createValidationResult(result.error);
+  return validateParsedData(data, schema);
 }
 function validateParams(params, schema) {
-  const result = schema.safeParse(params);
-  if (result.success) {
-    return { valid: true, data: result.data, errors: [] };
-  }
-  return createValidationResult(result.error);
+  return validateParsedData(params, schema);
 }
 async function validateFormOrFail(request, schema) {
-  const result = await validateForm(request, schema);
-  if (!result.valid || !result.data) {
-    throw badRequest(
-      result.errors[0]?.message ?? kitM("kit_validationFailed"),
-      void 0,
-      { errors: result.errors }
-    );
-  }
-  return result.data;
+  return unwrapValidationResultOrThrow(await validateForm(request, schema));
 }
 function validateQueryOrFail(url, schema) {
-  const result = validateQuery(url, schema);
-  if (!result.valid || !result.data) {
-    throw badRequest(
-      result.errors[0]?.message ?? kitM("kit_validationFailed"),
-      void 0,
-      { errors: result.errors }
-    );
-  }
-  return result.data;
+  return unwrapValidationResultOrThrow(validateQuery(url, schema));
 }
 function validateParamsOrFail(params, schema) {
-  const result = validateParams(params, schema);
-  if (!result.valid || !result.data) {
-    throw badRequest(
-      result.errors[0]?.message ?? kitM("kit_validationFailed"),
-      void 0,
-      { errors: result.errors }
-    );
-  }
-  return result.data;
+  return unwrapValidationResultOrThrow(validateParams(params, schema));
 }
 var IdParamSchema = z.object({
   id: z.string().min(1, kitM("kit_idRequired"))
@@ -779,8 +858,205 @@ var PaginationQuerySchema = z.object({
   search: z.string().optional()
 });
 
+// src/kit-auth-api.ts
+var authApiPublicPaths = ["/api/auth/session/close", "/api/auth/logout", "/api/auth/captcha", "/api/auth/config", "/api/auth/login", "/api/auth/login/ldap", "/api/auth/login/otp", "/api/auth/register", "/api/auth/otp/send", "/api/auth/password-reset/request", "/api/auth/password-reset/confirm", "/api/auth/password/renew"];
+function requestContext(event) {
+  let ip;
+  try {
+    ip = event.getClientAddress();
+  } catch {
+  }
+  const terminal = event.request.headers.get("x-hai-terminal");
+  return { ip, userAgent: event.request.headers.get("user-agent") ?? void 0, terminalType: terminal === "app" || terminal === "desktop" || terminal === "api" ? terminal : "web" };
+}
+function createAuthApi(iam) {
+  function response(result) {
+    return result.success ? ok(result.data) : fromError(result.error);
+  }
+  return {
+    closeSession: handler(async ({ request, cookies }) => {
+      const input = await validateFormOrFail(request, IamLogoutInputSchema);
+      return response(await iam.auth.logout(input.accessToken ?? getAccessToken(request, cookies) ?? ""));
+    }),
+    createCaptcha: handler(async ({ request }) => {
+      const input = await validateFormOrFail(request, IamCreateCaptchaInputSchema);
+      return response(await iam.auth.createCaptcha(input));
+    }),
+    reauthenticate: handler(async ({ request, cookies }) => {
+      const input = await validateFormOrFail(request, IamReauthenticateInputSchema);
+      return response(await iam.auth.reauthenticate(getAccessToken(request, cookies) ?? "", input.password, input.operation));
+    }),
+    publicConfig: handler(async () => response(await iam.getPublicConfig())),
+    renewPassword: handler(async ({ request }) => {
+      const input = await validateFormOrFail(request, IamRenewPasswordInputSchema);
+      return response(await iam.user.renewPassword(input));
+    }),
+    login: handler(async (event) => {
+      const { request, cookies } = event;
+      const input = await validateFormOrFail(request, IamLoginInputSchema);
+      const result = await login(cookies, input, requestContext(event));
+      return result.success ? ok({ user: result.data.user }) : fromError(result.error);
+    }),
+    loginWithLdap: handler(async (event) => {
+      const { request, cookies } = event;
+      const input = await validateFormOrFail(request, IamLdapLoginInputSchema);
+      const result = await loginWithLdap(cookies, input, requestContext(event));
+      return result.success ? ok({ user: result.data.user }) : fromError(result.error);
+    }),
+    loginWithOtp: handler(async (event) => {
+      const { request, cookies } = event;
+      const input = await validateFormOrFail(request, IamOtpLoginInputSchema);
+      const result = await loginWithOtp(cookies, input, requestContext(event));
+      return result.success ? ok({ user: result.data.user }) : fromError(result.error);
+    }),
+    register: handler(async (event) => {
+      const { request, cookies } = event;
+      const input = await validateFormOrFail(request, IamRegisterInputSchema);
+      const result = await registerAndLogin(cookies, input, requestContext(event));
+      return result.success ? ok({ user: result.data.user }) : fromError(result.error);
+    }),
+    sendOtp: handler(async ({ request }) => {
+      const input = await validateFormOrFail(request, IamSendOtpInputSchema);
+      return response(await iam.auth.sendOtp(input.identifier, input));
+    }),
+    requestPasswordReset: handler(async ({ request }) => {
+      const input = await validateFormOrFail(request, IamRequestPasswordResetInputSchema);
+      return response(await iam.user.requestPasswordReset(input.identifier, input));
+    }),
+    confirmPasswordReset: handler(async ({ request }) => {
+      const input = await validateFormOrFail(request, IamConfirmPasswordResetInputSchema);
+      return response(await iam.user.confirmPasswordReset(input.token, input.newPassword));
+    })
+  };
+}
+function createFeedbackHandler(options) {
+  const basePath = (options.basePath ?? "/api/feedback").replace(/\/+$/, "");
+  return async (event) => {
+    let actor;
+    try {
+      actor = await options.resolveContext(event);
+    } catch {
+      return fromError({ ...HaiCommonError.INTERNAL_ERROR, message: kitM("kit_internalError") });
+    }
+    if (!actor?.scopeId || !actor.userId)
+      return fromError({ ...HaiCommonError.UNAUTHORIZED, message: kitM("kit_unauthorized") });
+    if (options.feedback.isInitialized === false)
+      return fromError({ ...HaiCommonError.SERVICE_UNAVAILABLE, message: kitM("kit_feedbackUnavailable") });
+    const suffix = event.url.pathname.startsWith(`${basePath}/`) ? event.url.pathname.slice(basePath.length + 1) : "";
+    let parts;
+    try {
+      parts = suffix.split("/").map(decodeURIComponent);
+    } catch {
+      return invalid(400);
+    }
+    if (parts.length === 1 && parts[0] === "policy" && event.request.method === "GET")
+      return ok(options.feedback.budget);
+    if (parts[0] !== "reports" || parts.length > 4)
+      return fromError({ ...HaiCommonError.NOT_FOUND, message: core.i18n.coreM("core_errorNotFound") });
+    let body = {};
+    if (!["GET", "HEAD"].includes(event.request.method)) {
+      if (event.request.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() !== "application/json")
+        return invalid(415);
+      try {
+        body = await readBoundedJson(event.request, options.feedback.budget.maxTransportBytes);
+      } catch (error2) {
+        return invalid(error2 instanceof RangeError ? 413 : 400);
+      }
+    }
+    if (!body || typeof body !== "object" || Array.isArray(body))
+      return invalid(400);
+    const bodyRecord = body;
+    if (parts[1] && Object.hasOwn(bodyRecord, "id") && bodyRecord.id !== parts[1])
+      return invalid(400);
+    const input = { ...Object.fromEntries(event.url.searchParams), ...bodyRecord, ...parts[1] ? { id: parts[1] } : {} };
+    const method = event.request.method;
+    const service = options.feedback;
+    async function execute(schema, operation) {
+      const parsed = schema.safeParse(input);
+      if (!parsed.success)
+        return invalid(400);
+      try {
+        const result = await core.context.run(actor, () => operation(parsed.data));
+        return result.success ? ok(result.data) : fromError(result.error);
+      } catch {
+        return fromError({ ...HaiCommonError.INTERNAL_ERROR, message: kitM("kit_internalError") });
+      }
+    }
+    if (parts.length === 1) {
+      if (method === "POST")
+        return execute(FeedbackSubmitInputSchema, (value) => service.submit(value, actor));
+      if (method === "GET")
+        return execute(FeedbackListInputSchema, (value) => service.list(value, actor));
+    }
+    if (parts.length === 2 && method === "GET")
+      return execute(FeedbackIdInputSchema, (value) => service.get(value.id, actor));
+    if (parts.length === 3) {
+      if (parts[2] === "evidence" && method === "GET")
+        return execute(FeedbackEvidenceQuerySchema, (value) => service.getEvidence(value, actor));
+      if (parts[2] === "evidence" && method === "POST")
+        return execute(FeedbackAppendEvidenceInputSchema, (value) => service.appendEvidence(value, actor));
+      if (parts[2] === "status" && method === "PATCH")
+        return execute(FeedbackSetStatusInputSchema, (value) => service.setStatus(value, actor));
+      if (parts[2] === "retry" && method === "POST")
+        return execute(FeedbackRetryInputSchema, (value) => service.retry(value, actor));
+      if (parts[2] === "complete" && method === "POST")
+        return execute(FeedbackCompleteInputSchema, (value) => service.completeCollection(value, actor));
+      if (parts[2] === "exports" && method === "POST")
+        return execute(FeedbackExportInputSchema, (value) => service.export(value, actor));
+    }
+    if (parts.length === 4 && parts[2] === "attachments") {
+      Object.assign(input, { attachmentId: parts[3] });
+      if (method === "POST")
+        return execute(FeedbackUploadInputSchema, (value) => service.uploadAttachment(value, actor));
+      if (method === "GET")
+        return execute(FeedbackAttachmentQuerySchema, (value) => service.getAttachment(value, actor));
+    }
+    if (parts.length === 4 && parts[2] === "exports" && method === "GET") {
+      Object.assign(input, { jobId: parts[3] });
+      return execute(FeedbackExportQuerySchema, (value) => service.getExport(value, actor));
+    }
+    return fromError({ ...HaiCommonError.NOT_FOUND, message: core.i18n.coreM("core_errorNotFound") });
+  };
+}
+function invalid(status) {
+  return fromError({ ...HaiCommonError.INVALID_REQUEST, httpStatus: status, message: kitM("kit_validationFailed") });
+}
+async function readBoundedJson(request, maximum) {
+  const reader = request.body?.getReader();
+  if (!reader)
+    return {};
+  const decoder = new TextDecoder();
+  let length = 0;
+  let text = "";
+  try {
+    while (true) {
+      const chunk = await reader.read();
+      if (chunk.done)
+        break;
+      length += chunk.value.byteLength;
+      if (length > maximum) {
+        await reader.cancel();
+        throw new RangeError("Feedback request is too large");
+      }
+      text += decoder.decode(chunk.value, { stream: true });
+    }
+    text += decoder.decode();
+    return text ? JSON.parse(text) : {};
+  } finally {
+    reader.releaseLock();
+  }
+}
+
 // src/kit-main.ts
 var kit = {
+  /** 创建反馈的受控 catch-all HTTP handler，身份范围由宿主解析。 */
+  createFeedbackHandler,
+  /** 原子限流工厂；共享store生命周期由应用管理。 */
+  middleware: {
+    rateLimit: rateLimitMiddleware,
+    createCacheRateLimitStore,
+    createMemoryRateLimitStore
+  },
   // ─── Handle Hook ───
   /** 创建 SvelteKit Handle Hook（含 auth / logging / rateLimit 内置配置） */
   createHandle,
@@ -788,10 +1064,10 @@ var kit = {
   sequence,
   /** API Handler 包装器（自动错误边界） */
   handler,
-  /** 基于 API 契约创建类型安全的路由 handler */
-  fromContract,
   // ─── 路由守卫 ───
   guard: {
+    /** 选定敏感操作要求单次再鉴别；先调用现有权限与资源守卫。 */
+    requireSensitive: requireSensitiveOperation,
     /** 要求权限，不满足时 throw Response（SvelteKit 控制流） */
     require: requirePermission,
     /** 检查会话是否具有指定权限（布尔） */
@@ -844,10 +1120,23 @@ var kit = {
   // ─── 客户端工具 ───
   client: {
     /** 创建统一客户端（CSRF + 传输加密透明合并） */
-    create: createKitClient
+    create: createKitClient,
+    /** 标准认证表单动作（Cookie 模式）。 */
+    createAuthActions: createKitAuthActions,
+    /**
+     * 用解析后的 {@link KitConfig} 一键安装浏览器端传输加密
+     * （应用层推荐入口；内部预热 crypto 并调用 installBrowserTransportFetch）
+     */
+    installBrowserTransport,
+    /** 底层入口：直接传 transport 配置安装浏览器全局 fetch 包装 */
+    installBrowserTransportFetch
   },
   // ─── 认证工具 ───
   auth: {
+    /** 标准匿名认证端点白名单。 */
+    publicPaths: authApiPublicPaths,
+    /** 标准配置/登录/注册/验证码/重置 handler 集合。 */
+    createApi: createAuthApi,
     /** 服务端登录（密码）：内部调用 iam.auth.login + 自动写入 Token Cookie */
     login,
     /** 服务端登录（OTP 验证码）：内部调用 iam.auth.loginWithOtp + 自动写入 Token Cookie */
@@ -863,11 +1152,8 @@ var kit = {
     /** 写入浏览器端 Access Token（客户端 login/register 用） */
     setBrowserToken,
     /** 清除浏览器端 Access Token（客户端 logout 用） */
-    clearBrowserToken,
+    clearBrowserToken
     /** 创建浏览器端 Token 存储器（自定义 key 时使用） */
-    createTokenStore,
-    /** 创建浏览器端同源请求自动附加 Authorization 的 HandleFetch */
-    createHandleFetch
   },
   // ─── CRUD ───
   crud: {
@@ -877,10 +1163,12 @@ var kit = {
   // ─── i18n ───
   i18n: {
     /** 统一设置所有 hai 模块的默认语言 */
-    setLocale: setAllModulesLocale
+    setLocale: setAllModulesLocale,
+    /** 请求/SSR 语言隔离；异步处理使用同一请求上下文。 */
+    runWithLocale: core.i18n.runWithLocale
   }
 };
 
-export { IdParamSchema, PaginationQuerySchema, defineEndpoint, kit, matchPermission };
+export { IdParamSchema, PaginationQuerySchema, kit, matchPermission };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map