@h-ai/kit 1.0.0-beta.18 → 1.0.0-beta.19

package/dist/chunk-WYGIKXHE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/modules/crypto/kit-transport-middleware.ts"],"names":[],"mappings":";;;;;AAgBA,IAAM,kCAAA,GAAqC,CAAC,kBAAA,EAAoB,qBAAqB,CAAA;AAgB9E,SAAS,6BAAA,CAA8B,QAAmC,UAAA,EAA2D;AAE1I,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,OAAO,OAAO,QAAA,EAAU,IAAA,KAAS,IAAA,EAAK;AAAA,EACxC;AAEA,EAAA,MAAM,eAAA,GAAkB,OAAO,eAAA,IAAmB,mCAAA;AAClD,EAAA,MAAM,QAAA,GAAW,0BAAA,CAA2B,MAAA,CAAO,QAAQ,CAAA;AAC3D,EAAA,MAAM,YAAA,GAAe,MAAA,CAAO,YAAA,IAAgB,EAAC;AAE7C,EAAA,MAAM,MAAA,GAAS,yBAAA,CAA0B,MAAA,CAAO,iBAAA,EAAmB,OAAO,mBAAmB,CAAA;AAG7F,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,YAAA,CAAa;AAAA,IAClD,eAAe,MAAA,CAAO,aAAA;AAAA,IACtB,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,iBAAA,EAAmB,OAAO,OAAA,CAAQ,cAAA;AAAA,IAClC,sBAAsB,MAAA,CAAO,oBAAA;AAAA,IAC7B,sBAAsB,MAAA,CAAO;AAAA,GAC9B,CAAA;AACD,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AAEnB,IAAA,MAAM,IAAA,CAAK,MAAM,iBAAA,CAAkB,cAAA,CAAe,gBAAgB,IAAA,CAAK,kCAAkC,CAAA,EAAG,MAAA,CAAO,KAAK,CAAA;AAAA,EAC1H;AACA,EAAA,MAAM,UAAU,MAAA,CAAO,IAAA;AAEvB,EAAA,OAAO,OAAO,SAAS,IAAA,KAAS;AAC9B,IAAA,MAAM,EAAE,OAAM,GAAI,OAAA;AAClB,IAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,KAAA,CAAM,OAAO,CAAA;AAGjD,IAAA,IAAI,KAAA,CAAM,QAAQ,MAAA,KAAW,SAAA;AAC3B,MAAA,OAAO,IAAA,EAAK;AAGd,IAAA,IAAI,QAAA,KAAa,eAAA,IAAmB,KAAA,CAAM,OAAA,CAAQ,WAAW,MAAA,EAAQ;AACnE,MAAA,OAAO,iBAAA,CAAkB,OAAA,EAAS,KAAA,CAAM,OAAO,CAAA;AAAA,IACjD;AAEA,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,QAAA,EAAU,KAAA,CAAM,QAAQ,MAAM,CAAA;AACxD,IAAA,IAAI,SAAS,UAAA,EAAY;AACvB,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,kBAAA,CAAmB,gBAAgB,CAAA,IAAK,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,kBAAA,CAAmB,eAAe,CAAA,EAAG;AACnI,QAAA,OAAO,QAAA,CAAS,KAAK,GAAA,CAAI;AAAA,UACvB,GAAG,cAAA,CAAe,gBAAA;AAAA,UAClB,OAAA,EAAS,KAAK,gCAAgC,CAAA;AAAA,UAC9C,SAAS,OAAA,CAAQ;AAAA,SAClB,CAAA,EAAG,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,MACrB;AACA,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AAGA,IAAA,IAAI,SAAS,UAAA,IAAc,CAAC,0BAA0B,QAAA,EAAU,eAAA,EAAiB,QAAQ,CAAA,EAAG;AAC1F,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AAGA,IAAA,IAAI,SAAS,UAAA,IAAc,0BAAA,CAA2B,QAAA,EAAU,YAAA,EAAc,eAAe,CAAA,EAAG;AAC9F,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AAGA,IAAA,MAAM,WAAW,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,gBAAgB,CAAA;AAC9E,IAAA,IAAI,CAAC,QAAA;AACH,MAAA,OAAO,SAAA,CAAU,IAAA,CAAK,+BAA+B,CAAA,EAAG,GAAG,CAAA;AAE7D,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAA;AACrC,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,OAAO,SAAA,CAAU,IAAA,CAAK,mBAAmB,CAAA,EAAG,GAAG,CAAA;AACjD,IAAA,IAAI;AAGF,MAAA,IAAI,cAAA;AACJ,MAAA,IAAI;AACF,QAAA,MAAM,WAAW,MAAM,4BAAA,CAA6B,SAAS,KAAA,CAAM,OAAA,EAAS,MAAM,MAAM,CAAA;AACxF,QAAA,IAAI,CAAC,SAAS,OAAA,EAAS;AACrB,UAAA,IAAI,SAAS,KAAA,CAAM,KAAA,YAAiB,kBAAA,IAAsB,QAAA,CAAS,MAAM,KAAA,CAAM,OAAA;AAC7E,YAAA,OAAO,4BAAA,CAA6B,QAAA,CAAS,KAAA,CAAM,KAAA,EAAO,EAAE,OAAA,EAAS,OAAA,EAAS,QAAA,CAAS,KAAA,CAAM,KAAA,CAAM,OAAA,EAAS,CAAA;AAC9G,UAAA,OAAO,SAAA,CAAU,IAAA,CAAK,4BAA4B,CAAA,EAAG,GAAG,CAAA;AAAA,QAC1D;AACA,QAAA,cAAA,GAAiB,SAAS,IAAA,CAAK,OAAA;AAC/B,QAAA,IAAI,MAAM,OAAA,CAAQ,MAAA,KAAW,KAAA,IAAS,KAAA,CAAM,QAAQ,MAAA,KAAW,MAAA;AAC7D,UAAA,kBAAA,CAAmB,KAAA,EAAO,QAAA,CAAS,IAAA,CAAK,SAAS,CAAA;AAAA,MACrD,SACO,KAAA,EAAO;AACZ,QAAA,IAAI,KAAA,YAAiB,0BAAA;AACnB,UAAA,OAAO,6BAA6B,KAAK,CAAA;AAC3C,QAAA,OAAO,UAAU,IAAA,CAAK,6BAA6B,GAAG,KAAA,YAAiB,UAAA,GACnE,MACA,GAAG,CAAA;AAAA,MACT;AAGA,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,EAAK;AAK5B,MAAA,MAAM,WAAW,KAAA,CAAM,OAAA,CAAQ,MAAA,KAAW,MAAA,IAAU,gBAAgB,QAAQ,CAAA;AAC5E,MAAA,IAAI,QAAA;AACF,QAAA,KAAK,QAAA,CAAS,IAAA,EAAM,MAAA,EAAO,CAAE,MAAM,MAAM;AAAA,QAAC,CAAC,CAAA;AAE7C,MAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC5D,MAAA,IAAI,CAAC,QAAA,IAAY,CAAC,6BAAA,CAA8B,WAAW,CAAA,EAAG;AAC5D,QAAA,KAAK,QAAA,CAAS,IAAA,EAAM,MAAA,EAAO,CAAE,MAAM,MAAM;AAAA,QAAC,CAAC,CAAA;AAC3C,QAAA,OAAO,SAAA,CAAU,IAAA,CAAK,4BAA4B,CAAA,EAAG,GAAG,CAAA;AAAA,MAC1D;AACA,MAAA,IAAI;AACF,QAAA,MAAM,eAAe,QAAA,GACjB,EAAA,GACA,MAAM,iBAAA,CAAkB,SAAS,IAAA,EAAM;AAAA,UACrC,QAAA,EAAU,MAAM,MAAA,CAAO,cAAA;AAAA,UACvB,SAAA,EAAW,UAAA;AAAA,UACX,MAAA,EAAQ,MAAM,OAAA,CAAQ;AAAA,SACvB,CAAA;AACL,QAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,QAAA,CAAS,OAAO,CAAA;AAC5C,QAAA,OAAA,CAAQ,MAAA,CAAO,mBAAmB,gBAAgB,CAAA;AAClD,QAAA,OAAA,CAAQ,MAAA,CAAO,mBAAmB,eAAe,CAAA;AACjD,QAAA,OAAA,CAAQ,OAAO,gBAAgB,CAAA;AAC/B,QAAA,OAAA,CAAQ,OAAO,kBAAkB,CAAA;AAEjC,QAAA,MAAM,mBAAmB,MAAM,OAAA,CAAQ,gBAAgB,cAAA,EAAgB,YAAA,EAAc,SAAS,MAAM,CAAA;AACpG,QAAA,IAAI,CAAC,iBAAiB,OAAA,EAAS;AAC7B,UAAA,OAAO,SAAA,CAAU,IAAA,CAAK,4BAA4B,CAAA,EAAG,GAAG,CAAA;AAAA,QAC1D;AACA,QAAA,OAAA,CAAQ,GAAA,CAAI,kBAAA,CAAmB,gBAAA,EAAkB,kBAAA,CAAmB,sBAAsB,CAAA;AAC1F,QAAA,IAAI,QAAA;AACF,UAAA,OAAA,CAAQ,IAAI,kBAAA,CAAmB,eAAA,EAAiB,KAAK,SAAA,CAAU,gBAAA,CAAiB,IAAI,CAAC,CAAA;AACvF,QAAA,OAAO,IAAI,SAAS,QAAA,GAChB,IAAA,GACA,KAAK,SAAA,CAAU,gBAAA,CAAiB,IAAI,CAAA,EAAG;AAAA,UACzC,QAAQ,QAAA,CAAS,MAAA;AAAA,UACjB,YAAY,QAAA,CAAS,UAAA;AAAA,UACrB;AAAA,SACD,CAAA;AAAA,MACH,SACO,KAAA,EAAO;AACZ,QAAA,IAAI,KAAA,YAAiB,0BAAA;AACnB,UAAA,OAAO,6BAA6B,KAAA,EAAO,EAAE,OAAA,EAAS,OAAA,EAAS,gBAAgB,CAAA;AACjF,QAAA,OAAO,SAAA,CAAU,IAAA,CAAK,4BAA4B,CAAA,EAAG,GAAG,CAAA;AAAA,MAC1D;AAAA,IACF,CAAA,SACA;AAAU,MAAA,KAAA,CAAM,OAAA,EAAQ;AAAA,IAAE;AAAA,EAC5B,CAAA;AACF;AAEA,SAAS,8BAA8B,WAAA,EAA8B;AACnE,EAAA,OAAO,mCAAmC,IAAA,CAAK,CAAA,IAAA,KAAQ,WAAA,CAAY,QAAA,CAAS,IAAI,CAAC,CAAA;AACnF;AAEA,SAAS,gBAAgB,QAAA,EAA6B;AACpD,EAAA,IAAI,CAAC,GAAA,EAAK,GAAG,CAAA,CAAE,QAAA,CAAS,SAAS,MAAM,CAAA;AACrC,IAAA,OAAO,IAAA;AAET,EAAA,OAAO,SAAS,IAAA,KAAS,IAAA;AAC3B;AAEA,SAAS,mBAAmB,OAAA,EAA0B;AACpD,EAAA,OAAO,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA,CAAE,QAAA;AAC9B;AAEA,SAAS,SAAA,CAAU,SAAiB,MAAA,EAA0B;AAC5D,EAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG;AAAA,IACtD,MAAA;AAAA,IACA,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,GAC/C,CAAA;AACH;AAWA,eAAe,iBAAA,CACb,SACA,OAAA,EACmB;AACnB,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,MAAM,iBAAA,CAAkB,QAAQ,IAAA,EAAM;AAAA,MACtD,UAAU,qBAAA,CAAsB,gBAAA;AAAA,MAChC,QAAQ,OAAA,CAAQ;AAAA,KACjB,CAAC,CAAA;AAAA,EACJ,SACO,KAAA,EAAO;AACZ,IAAA,OAAO,UAAU,IAAA,CAAK,6BAA6B,GAAG,KAAA,YAAiB,UAAA,GACnE,MACA,GAAG,CAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA,KAAS,YAAY,EAAE,iBAAA,IAAqB,IAAA,CAAA,IAC3D,CAAC,mBAAA,CAAoB,IAAA,CAAK,eAAe,CAAA,IACzC,IAAI,aAAY,CAAE,MAAA,CAAO,KAAK,eAAe,CAAA,CAAE,UAAA,GAAa,qBAAA,CAAsB,cAAA,EAAgB;AACrG,IAAA,OAAO,SAAA,CAAU,IAAA,CAAK,6BAA6B,CAAA,EAAG,GAAG,CAAA;AAAA,EAC3D;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,eAAA,GAAkB,QAAQ,kBAAA,EAAmB;AACnD,IAAA,IAAI,IAAI,WAAA,EAAY,CAAE,OAAO,eAAe,CAAA,CAAE,aAAa,qBAAA,CAAsB,cAAA;AAC/E,MAAA,OAAO,SAAA,CAAU,IAAA,CAAK,gCAAgC,CAAA,EAAG,GAAG,CAAA;AAC9D,IAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,iBAAA,CAAkB,KAAK,eAAe,CAAA;AAErE,IAAA,OAAO,IAAI,QAAA;AAAA,MACT,KAAK,SAAA,CAAU;AAAA,QACb,WAAA,EAAa,QAAQ,cAAA,EAAe;AAAA,QACpC,eAAA;AAAA,QACA,QAAA;AAAA,QACA,iBAAA,EAAmB,QAAQ,UAAA,CAAW;AAAA,OACvC,CAAA;AAAA,MACD;AAAA,QACE,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB;AAChD,KACF;AAAA,EACF,CAAA,CAAA,MACM;AACJ,IAAA,OAAO,SAAA,CAAU,IAAA,CAAK,gCAAgC,CAAA,EAAG,GAAG,CAAA;AAAA,EAC9D;AACF;AAsBA,SAAS,kBAAA,CAAmB,OAAsB,IAAA,EAAoB;AACpE,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,KAAA,CAAM,QAAQ,OAAO,CAAA;AACjD,EAAA,OAAA,CAAQ,MAAA,CAAO,mBAAmB,gBAAgB,CAAA;AAClD,EAAA,OAAA,CAAQ,OAAO,gBAAgB,CAAA;AAC/B,EAAA,OAAA,CAAQ,OAAO,kBAAkB,CAAA;AACjC,EAAA,OAAA,CAAQ,GAAA,CAAI,gBAAgB,iCAAiC,CAAA;AAC7D,EAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,KAAA,CAAM,QAAQ,GAAA,EAAK;AAAA,IAChD,MAAA,EAAQ,MAAM,OAAA,CAAQ,MAAA;AAAA,IACtB,OAAA;AAAA,IACA,IAAA;AAAA,IACA,MAAA,EAAQ,MAAM,OAAA,CAAQ;AAAA,GACvB,CAAA;AACD,EAAA,MAAA,CAAO,cAAA,CAAe,OAAO,SAAA,EAAW;AAAA,IACtC,KAAA,EAAO,UAAA;AAAA,IACP,QAAA,EAAU,IAAA;AAAA,IACV,YAAA,EAAc;AAAA,GACf,CAAA;AACH","file":"chunk-WYGIKXHE.js","sourcesContent":["/**\n * @h-ai/kit — 传输加密中间件\n *\n * SvelteKit 中间件，自动对请求/响应进行传输加密解密。\n * @module kit-transport-middleware\n */\n\nimport type { RequestAccessCheck } from '@h-ai/core'\nimport type { TransportEncryptionManager, TransportMessageContext } from '@h-ai/crypto'\nimport type { Middleware } from '../../kit-types.js'\nimport type { TransportEncryptionConfig } from './kit-crypto-types.js'\nimport { core, err, HaiCommonError } from '@h-ai/core'\nimport { authenticateTransportRequest, createTransportBodyPolicy, createTransportErrorResponse, isValidSM2PublicKey, readTransportBody, TRANSPORT_BODY_LIMITS, TRANSPORT_PROTOCOL, TransportBodyTooLargeError, TransportTimeError } from '@h-ai/crypto'\nimport { kitM } from '../../kit-i18n.js'\nimport { DEFAULT_TRANSPORT_KEY_EXCHANGE_PATH, normalizeTransportBasePath, shouldExcludeTransportPath, shouldHandleTransportPath } from './kit-transport-paths.js'\n\nconst ENCRYPTABLE_RESPONSE_CONTENT_TYPES = ['application/json', 'text/sveltekit-data']\n\n/**\n * 创建传输加密中间件\n *\n * @param config - 传输加密配置\n * @param encryption - 已编译的路径/方法选择器；省略时沿用宿主默认范围。\n * @returns SvelteKit 中间件\n * @throws 显式启用但管理器初始化失败时抛出配置错误，调用方须停止宿主装配。\n * @example 模块内部上下文\n * ```ts\n * function install(config: TransportEncryptionConfig) {\n *   return transportEncryptionMiddleware(config) // 受管密钥环、共享 keyStore 与 crypto 生命周期由应用管理。\n * }\n * ```\n */\nexport function transportEncryptionMiddleware(config: TransportEncryptionConfig, encryption?: RequestAccessCheck['encryption']): Middleware {\n  // 未启用时直接透传\n  if (!config.enabled) {\n    return async (_context, next) => next()\n  }\n\n  const keyExchangePath = config.keyExchangePath ?? DEFAULT_TRANSPORT_KEY_EXCHANGE_PATH\n  const basePath = normalizeTransportBasePath(config.basePath)\n  const excludePaths = config.excludePaths ?? []\n\n  const policy = createTransportBodyPolicy(config.maxPlaintextBytes, config.routePlaintextBytes)\n\n  // 初始化传输加密管理器\n  const result = config.crypto.transport.createServer({\n    serverKeyRing: config.serverKeyRing,\n    keyStore: config.keyStore,\n    maxPlaintextBytes: policy.maximum.plaintextBytes,\n    maxFutureSkewSeconds: config.maxFutureSkewSeconds,\n    maxRequestAgeSeconds: config.maxRequestAgeSeconds,\n  })\n  if (!result.success) {\n    // 与 Serv 一致：静态配置或必需依赖失败即拒绝装配，不能让健康页面掩盖不可用的业务加密。\n    throw core.error.buildHaiErrorInst(HaiCommonError.INTERNAL_ERROR, kitM('kit_transportKeyGenerationFailed'), result.error)\n  }\n  const manager = result.data\n\n  return async (context, next) => {\n    const { event } = context\n    const pathname = getRequestPathname(event.request)\n\n    // CORS 预检没有业务密文，仍交由请求访问策略判断。\n    if (event.request.method === 'OPTIONS')\n      return next()\n\n    // 密钥交换端点：委托给 keyExchangeHandler\n    if (pathname === keyExchangePath && event.request.method === 'POST') {\n      return handleKeyExchange(manager, event.request)\n    }\n\n    const mode = encryption?.(pathname, event.request.method)\n    if (mode === 'disabled') {\n      if (event.request.headers.has(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER) || event.request.headers.has(TRANSPORT_PROTOCOL.ENVELOPE_HEADER)) {\n        return Response.json(err({\n          ...HaiCommonError.VALIDATION_ERROR,\n          message: kitM('kit_transportPlaintextRequired'),\n          traceId: context.requestId,\n        }), { status: 400 })\n      }\n      return next()\n    }\n    // 仅对同源 API endpoint 与 SvelteKit __data 请求启用 transport；\n    // 显式 required 也可保护自定义 JSON 端点；不能拿它包裹 HTML 页面。\n    if (mode !== 'required' && !shouldHandleTransportPath(pathname, keyExchangePath, basePath)) {\n      return next()\n    }\n\n    // 排除路径不做加解密\n    if (mode !== 'required' && shouldExcludeTransportPath(pathname, excludePaths, keyExchangePath)) {\n      return next()\n    }\n\n    // 请求头中无 X-Client-Id 时的处理\n    const clientId = event.request.headers.get(TRANSPORT_PROTOCOL.CLIENT_ID_HEADER)\n    if (!clientId)\n      return jsonError(kitM('kit_transportClientIdRequired'), 400)\n\n    const lease = policy.acquire(pathname)\n    if (!lease)\n      return jsonError(kitM('kit_transportBusy'), 503)\n    try {\n    // ── 解密请求 ──\n    // 不依赖可伪造/省略的 Content-Length/Type 判空，非 null 流必须进入实际内容检查。\n      let requestContext: TransportMessageContext\n      try {\n        const verified = await authenticateTransportRequest(manager, event.request, lease.limits)\n        if (!verified.success) {\n          if (verified.error.cause instanceof TransportTimeError && verified.error.cause.context)\n            return createTransportErrorResponse(verified.error.cause, { manager, context: verified.error.cause.context })\n          return jsonError(kitM('kit_transportDecryptFailed'), 400)\n        }\n        requestContext = verified.data.context\n        if (event.request.method !== 'GET' && event.request.method !== 'HEAD')\n          replaceRequestBody(event, verified.data.plaintext)\n      }\n      catch (error) {\n        if (error instanceof TransportBodyTooLargeError)\n          return createTransportErrorResponse(error)\n        return jsonError(kitM('kit_transportInvalidPayload'), error instanceof RangeError\n          ? 413\n          : 400)\n      }\n\n      // ── 执行后续中间件/端点 ──\n      const response = await next()\n\n      // ── 加密响应 ──\n\n      // 只允许可安全加密的响应体离开受保护路由；无法加密时 fail-closed，禁止明文泄露。\n      const bodyless = event.request.method === 'HEAD' || isEmptyResponse(response)\n      if (bodyless)\n        void response.body?.cancel().catch(() => {})\n\n      const contentType = response.headers.get('Content-Type') ?? ''\n      if (!bodyless && !canEncryptResponseContentType(contentType)) {\n        void response.body?.cancel().catch(() => {})\n        return jsonError(kitM('kit_transportEncryptFailed'), 500)\n      }\n      try {\n        const responseBody = bodyless\n          ? ''\n          : await readTransportBody(response.body, {\n              maxBytes: lease.limits.plaintextBytes,\n              direction: 'response',\n              signal: event.request.signal,\n            })\n        const headers = new Headers(response.headers)\n        headers.delete(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER)\n        headers.delete(TRANSPORT_PROTOCOL.ENVELOPE_HEADER)\n        headers.delete('Content-Length')\n        headers.delete('Content-Encoding')\n\n        const encryptedPayload = await manager.encryptResponse(requestContext, responseBody, response.status)\n        if (!encryptedPayload.success) {\n          return jsonError(kitM('kit_transportEncryptFailed'), 500)\n        }\n        headers.set(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER, TRANSPORT_PROTOCOL.ENCRYPTED_HEADER_VALUE)\n        if (bodyless)\n          headers.set(TRANSPORT_PROTOCOL.ENVELOPE_HEADER, JSON.stringify(encryptedPayload.data))\n        return new Response(bodyless\n          ? null\n          : JSON.stringify(encryptedPayload.data), {\n          status: response.status,\n          statusText: response.statusText,\n          headers,\n        })\n      }\n      catch (error) {\n        if (error instanceof TransportBodyTooLargeError)\n          return createTransportErrorResponse(error, { manager, context: requestContext })\n        return jsonError(kitM('kit_transportEncryptFailed'), 500)\n      }\n    }\n    finally { lease.release() }\n  }\n}\n\nfunction canEncryptResponseContentType(contentType: string): boolean {\n  return ENCRYPTABLE_RESPONSE_CONTENT_TYPES.some(type => contentType.includes(type))\n}\n\nfunction isEmptyResponse(response: Response): boolean {\n  if ([204, 304].includes(response.status))\n    return true\n  // Content-Length 不能证明响应流为空，避免明文伪装零长度后绕过加密。\n  return response.body === null\n}\n\nfunction getRequestPathname(request: Request): string {\n  return new URL(request.url).pathname\n}\n\nfunction jsonError(message: string, status: number): Response {\n  return new Response(JSON.stringify({ error: message }), {\n    status,\n    headers: { 'Content-Type': 'application/json' },\n  })\n}\n\n/**\n * 处理密钥交换 POST 请求\n *\n * 接收客户端公钥，注册并返回服务端公钥与 clientId。\n *\n * @param manager - 传输加密管理器\n * @param request - 原始 Request\n * @returns JSON Response\n */\nasync function handleKeyExchange(\n  manager: TransportEncryptionManager,\n  request: Request,\n): Promise<Response> {\n  let body: unknown\n  try {\n    body = JSON.parse(await readTransportBody(request.body, {\n      maxBytes: TRANSPORT_BODY_LIMITS.keyExchangeBytes,\n      signal: request.signal,\n    }))\n  }\n  catch (error) {\n    return jsonError(kitM('kit_transportInvalidPayload'), error instanceof RangeError\n      ? 413\n      : 400)\n  }\n  if (!body || typeof body !== 'object' || !('clientPublicKey' in body)\n    || !isValidSM2PublicKey(body.clientPublicKey)\n    || new TextEncoder().encode(body.clientPublicKey).byteLength > TRANSPORT_BODY_LIMITS.publicKeyBytes) {\n    return jsonError(kitM('kit_transportInvalidPayload'), 400)\n  }\n\n  try {\n    const serverPublicKey = manager.getServerPublicKey()\n    if (new TextEncoder().encode(serverPublicKey).byteLength > TRANSPORT_BODY_LIMITS.publicKeyBytes)\n      return jsonError(kitM('kit_transportKeyExchangeFailed'), 500)\n    const clientId = await manager.registerClientKey(body.clientPublicKey)\n\n    return new Response(\n      JSON.stringify({\n        serverKeyId: manager.getServerKeyId(),\n        serverPublicKey,\n        clientId,\n        maxPlaintextBytes: manager.bodyLimits.plaintextBytes,\n      }),\n      {\n        status: 200,\n        headers: { 'Content-Type': 'application/json' },\n      },\n    )\n  }\n  catch {\n    return jsonError(kitM('kit_transportKeyExchangeFailed'), 500)\n  }\n}\n\n/**\n * 用于替换已验证请求正文的最小可写容器。\n * @example 模块内部上下文\n * ```ts\n * const holder: RequestHolder = { request: new Request('https://app.example.com/api/articles', { method: 'POST', body: '{}' }) }\n * replaceRequestBody(holder, JSON.stringify({ title: 'Example' }))\n * ```\n */\ninterface RequestHolder {\n  request: Request\n}\n\n/**\n * 重建 SvelteKit 事件中的 Request。\n *\n * 有界认证会消费密文 body；只将成功认证的明文恢复给后续端点。\n *\n * @param event SvelteKit 请求事件\n * @param body 新请求体\n */\nfunction replaceRequestBody(event: RequestHolder, body: string): void {\n  const headers = new Headers(event.request.headers)\n  headers.delete(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER)\n  headers.delete('Content-Length')\n  headers.delete('Content-Encoding')\n  headers.set('Content-Type', 'application/json; charset=utf-8')\n  const newRequest = new Request(event.request.url, {\n    method: event.request.method,\n    headers,\n    body,\n    signal: event.request.signal,\n  })\n  Object.defineProperty(event, 'request', {\n    value: newRequest,\n    writable: true,\n    configurable: true,\n  })\n}\n"]}

package/dist/client/index.d.ts

@@ -1,10 +1,11 @@
-export { C as ClientTransportConfig, K as KitClient, e as KitClientConfig, a as createKitAuthActions, c as createKitClient, i as installBrowserTransport, b as installBrowserTransportFetch } from '../kit-client-auth-DeWmc-1u.js';
-import '@h-ai/api-contract';
+export { C as ClientTransportConfig, K as KitClient, k as KitClientConfig, v as createKitAuthActions, w as createKitClient, x as installBrowserTransport, y as installBrowserTransportFetch } from '../kit-types-BUDaKGB0.js';
 import '@h-ai/core';
 import '@h-ai/crypto';
 import '@h-ai/iam';
-import '../kit-types-CnfBC89D.js';
 import '@sveltejs/kit';
+import '@h-ai/api-contract';
+import '@sveltejs/kit/hooks';
+import '@h-ai/feedback';
 import 'zod';
 
 /**
@@ -34,9 +35,9 @@ import 'zod';
  * SvelteKit `NavAdapter`：
  *
  * - `pathname` 来自 `$app/state` 的 `page.url.pathname`（响应式）。
- * - `navigate` 使用 `$app/navigation` 的 `goto`，并自动 `invalidateAll`，
+ * - `navigate` 使用 `$app/navigation` 的 `goto`，并自动 `refreshAll`，
  *   触发 `+page.server.ts` 的 `load` 重新执行。
- * - `refresh` 调用 `invalidateAll()`，常用于写操作后刷新列表数据。
+ * - `refresh` 调用 `refreshAll()`，常用于写操作后刷新列表数据。
  * @returns 读取当前 pathname 并调用 SvelteKit navigate/refresh 的适配器。
  * @example 模块内部上下文
  * ```ts

package/dist/client/index.js

@@ -1,7 +1,7 @@
-export { createKitAuthActions, createKitClient, installBrowserTransport, installBrowserTransportFetch } from '../chunk-5JW3VW4Q.js';
-import '../chunk-JRQPMPQC.js';
+export { createKitAuthActions, createKitClient, installBrowserTransport, installBrowserTransportFetch } from '../chunk-JL2C5ZGQ.js';
+import '../chunk-BCEBXG4X.js';
 import '../chunk-USFJN7IO.js';
-import { invalidateAll, goto } from '$app/navigation';
+import { refreshAll, goto } from '$app/navigation';
 import { page } from '$app/state';
 
 function createSvelteKitNavAdapter() {
@@ -10,10 +10,10 @@ function createSvelteKitNavAdapter() {
       return page.url.pathname;
     },
     async navigate(url) {
-      await goto(url, { invalidateAll: true });
+      await goto(url, { refreshAll: true });
     },
     async refresh() {
-      await invalidateAll();
+      await refreshAll();
     }
   };
 }

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/client/kit-nav-adapter.ts"],"names":[],"mappings":";;;;;;AA0CO,SAAS,yBAAA,GAId;AACA,EAAA,OAAO;AAAA,IACL,IAAI,QAAA,GAAW;AACb,MAAA,OAAO,KAAK,GAAA,CAAI,QAAA;AAAA,IAClB,CAAA;AAAA,IACA,MAAM,SAAS,GAAA,EAAa;AAC1B,MAAA,MAAM,IAAA,CAAK,GAAA,EAAK,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,IACzC,CAAA;AAAA,IACA,MAAM,OAAA,GAAU;AACd,MAAA,MAAM,aAAA,EAAc;AAAA,IACtB;AAAA,GACF;AACF","file":"index.js","sourcesContent":["/**\n * @h-ai/kit — SvelteKit 路由适配器\n *\n * 此前位于 `@h-ai/ui/sveltekit`，为避免 `@h-ai/ui` 耦合 SvelteKit，迁移至本模块。\n *\n * 为 `@h-ai/ui` 的 `CrudPage` 等需要“宿主路由”的场景组件提供 SvelteKit 实现。\n * 返回值结构与 `@h-ai/ui` 的 `NavAdapter` 完全一致；TS 通过结构类型自动匹配，\n * 无需在 `@h-ai/kit` 中显式依赖 `@h-ai/ui`。\n *\n * @example\n * ```svelte\n * <script lang='ts'>\n *   import { CrudPage } from '@h-ai/ui'\n *   import { createSvelteKitNavAdapter } from '@h-ai/kit/client'\n *\n *   const nav = createSvelteKitNavAdapter()\n * </script>\n *\n * <CrudPage {crud} {data} {nav} />\n * ```\n *\n * @module kit-nav-adapter\n */\n\nimport { goto, invalidateAll } from '$app/navigation'\nimport { page } from '$app/state'\n\n/**\n * SvelteKit `NavAdapter`：\n *\n * - `pathname` 来自 `$app/state` 的 `page.url.pathname`（响应式）。\n * - `navigate` 使用 `$app/navigation` 的 `goto`，并自动 `invalidateAll`，\n *   触发 `+page.server.ts` 的 `load` 重新执行。\n * - `refresh` 调用 `invalidateAll()`，常用于写操作后刷新列表数据。\n * @returns 读取当前 pathname 并调用 SvelteKit navigate/refresh 的适配器。\n * @example 模块内部上下文\n * ```ts\n * const nav = createSvelteKitNavAdapter()\n * // 仅客户端交互中调用导航；URL 由应用路由提供。\n * await nav.navigate('/articles')\n * ```\n */\nexport function createSvelteKitNavAdapter(): {\n  readonly pathname: string\n  readonly navigate: (url: string) => Promise<void>\n  readonly refresh: () => Promise<void>\n} {\n  return {\n    get pathname() {\n      return page.url.pathname\n    },\n    async navigate(url: string) {\n      await goto(url, { invalidateAll: true })\n    },\n    async refresh() {\n      await invalidateAll()\n    },\n  }\n}\n"]}
+{"version":3,"sources":["../../src/client/kit-nav-adapter.ts"],"names":[],"mappings":";;;;;;AA0CO,SAAS,yBAAA,GAId;AACA,EAAA,OAAO;AAAA,IACL,IAAI,QAAA,GAAW;AACb,MAAA,OAAO,KAAK,GAAA,CAAI,QAAA;AAAA,IAClB,CAAA;AAAA,IACA,MAAM,SAAS,GAAA,EAAa;AAC1B,MAAA,MAAM,IAAA,CAAK,GAAA,EAAK,EAAE,UAAA,EAAY,MAAM,CAAA;AAAA,IACtC,CAAA;AAAA,IACA,MAAM,OAAA,GAAU;AACd,MAAA,MAAM,UAAA,EAAW;AAAA,IACnB;AAAA,GACF;AACF","file":"index.js","sourcesContent":["/**\n * @h-ai/kit — SvelteKit 路由适配器\n *\n * 此前位于 `@h-ai/ui/sveltekit`，为避免 `@h-ai/ui` 耦合 SvelteKit，迁移至本模块。\n *\n * 为 `@h-ai/ui` 的 `CrudPage` 等需要“宿主路由”的场景组件提供 SvelteKit 实现。\n * 返回值结构与 `@h-ai/ui` 的 `NavAdapter` 完全一致；TS 通过结构类型自动匹配，\n * 无需在 `@h-ai/kit` 中显式依赖 `@h-ai/ui`。\n *\n * @example\n * ```svelte\n * <script lang='ts'>\n *   import { CrudPage } from '@h-ai/ui'\n *   import { createSvelteKitNavAdapter } from '@h-ai/kit/client'\n *\n *   const nav = createSvelteKitNavAdapter()\n * </script>\n *\n * <CrudPage {crud} {data} {nav} />\n * ```\n *\n * @module kit-nav-adapter\n */\n\nimport { goto, refreshAll } from '$app/navigation'\nimport { page } from '$app/state'\n\n/**\n * SvelteKit `NavAdapter`：\n *\n * - `pathname` 来自 `$app/state` 的 `page.url.pathname`（响应式）。\n * - `navigate` 使用 `$app/navigation` 的 `goto`，并自动 `refreshAll`，\n *   触发 `+page.server.ts` 的 `load` 重新执行。\n * - `refresh` 调用 `refreshAll()`，常用于写操作后刷新列表数据。\n * @returns 读取当前 pathname 并调用 SvelteKit navigate/refresh 的适配器。\n * @example 模块内部上下文\n * ```ts\n * const nav = createSvelteKitNavAdapter()\n * // 仅客户端交互中调用导航；URL 由应用路由提供。\n * await nav.navigate('/articles')\n * ```\n */\nexport function createSvelteKitNavAdapter(): {\n  readonly pathname: string\n  readonly navigate: (url: string) => Promise<void>\n  readonly refresh: () => Promise<void>\n} {\n  return {\n    get pathname() {\n      return page.url.pathname\n    },\n    async navigate(url: string) {\n      await goto(url, { refreshAll: true })\n    },\n    async refresh() {\n      await refreshAll()\n    },\n  }\n}\n"]}