@h-ai/kit 1.0.0-beta.18 → 1.0.0-beta.19

package/dist/index.js

@@ -1,16 +1,18 @@
-import { defineCrud } from './chunk-WCMEGLBL.js';
-export { KitConfigSchema, defineCrud, resolveKitConfig, resolveKitTransportConfig, resolveOptions, resolveText } from './chunk-WCMEGLBL.js';
-import { clearBrowserToken, setBrowserToken, logout, registerAndLogin, loginWithApiKey, loginWithLdap, loginWithOtp, login, installBrowserTransportFetch, installBrowserTransport, createKitAuthActions, createKitClient, getAccessToken, configureAuth } from './chunk-5JW3VW4Q.js';
-import { resolveA2AConfig, handleA2ARequest } from './chunk-7EH47MTW.js';
-import { transportEncryptionMiddleware } from './chunk-6KS67QUS.js';
-import './chunk-JRQPMPQC.js';
+import { defineCrud } from './chunk-GQZCU6PC.js';
+export { KitConfigSchema, defineCrud, resolveKitConfig, resolveKitTransportConfig, resolveOptions, resolveText } from './chunk-GQZCU6PC.js';
+import { clearBrowserToken, setBrowserToken, logout, registerAndLogin, loginWithApiKey, loginWithLdap, loginWithOtp, login, installBrowserTransportFetch, installBrowserTransport, createKitAuthActions, createKitClient, getAccessToken, configureAuth } from './chunk-JL2C5ZGQ.js';
+import { resolveA2AConfig, handleA2ARequest } from './chunk-BVGXHIXR.js';
+import { transportEncryptionMiddleware } from './chunk-WYGIKXHE.js';
+import './chunk-BCEBXG4X.js';
 import { kitM, setAllModulesLocale } from './chunk-USFJN7IO.js';
 import { core, HaiCommonError, err } from '@h-ai/core';
+import process from 'process';
 import { audit } from '@h-ai/audit';
 import { TRANSPORT_PROTOCOL } from '@h-ai/crypto';
-import { createHash } from 'crypto';
+import { isHttpError, isRedirect } from '@sveltejs/kit';
+import { createHash, hkdfSync, timingSafeEqual, createHmac } from 'crypto';
 import { isIP } from 'net';
-import process2 from 'process';
+import { Buffer } from 'buffer';
 import { IamConfirmPasswordResetInputSchema, IamRequestPasswordResetInputSchema, IamSendOtpInputSchema, IamRegisterInputSchema, IamOtpLoginInputSchema, IamLdapLoginInputSchema, IamLoginInputSchema, IamRenewPasswordInputSchema, IamReauthenticateInputSchema, IamCreateCaptchaInputSchema, IamLogoutInputSchema, FeedbackSubmitInputSchema, FeedbackListInputSchema, FeedbackIdInputSchema, FeedbackEvidenceQuerySchema, FeedbackAppendEvidenceInputSchema, FeedbackSetStatusInputSchema, FeedbackRetryInputSchema, FeedbackCompleteInputSchema, FeedbackExportInputSchema, FeedbackUploadInputSchema, FeedbackAttachmentQuerySchema, FeedbackExportQuerySchema } from '@h-ai/api-contract';
 import { z } from 'zod';
 
@@ -40,14 +42,28 @@ function hasPermission(session, permission) {
 function assertPermission(session, permission) {
   if (!session) {
     return new Response(
-      JSON.stringify({ success: false, error: kitM("kit_unauthorized") }),
-      { status: 401, headers: { "Content-Type": "application/json" } }
+      JSON.stringify({
+        success: false,
+        error: kitM("kit_unauthorized")
+      }),
+      {
+        status: 401,
+        headers: { "Content-Type": "application/json" }
+      }
     );
   }
   if (!matchPermission(permission, session.permissions ?? [])) {
     return new Response(
-      JSON.stringify({ success: false, error: kitM("kit_forbidden", { params: { permission } }) }),
-      { status: 403, headers: { "Content-Type": "application/json" } }
+      JSON.stringify({
+        success: false,
+        error: kitM("kit_forbidden", {
+          params: { permission }
+        })
+      }),
+      {
+        status: 403,
+        headers: { "Content-Type": "application/json" }
+      }
     );
   }
   return void 0;
@@ -85,42 +101,57 @@ function noContent() {
 }
 function error(code, message, status = 400, requestId, details) {
   const safe = core.error.toPublic({ code, message, httpStatus: status }, requestId);
-  core.logger.error("API request failed", { traceId: safe.traceId, error: { code, message, httpStatus: status, details } });
+  const safeStatus = safe.httpStatus ?? 500;
+  core.logger.error("API request failed", {
+    traceId: safe.traceId,
+    error: {
+      code,
+      message,
+      httpStatus: status,
+      details
+    }
+  });
   const response = {
     success: false,
     error: {
-      code,
+      code: String(safe.code),
       message: safe.message,
       traceId: safe.traceId,
-      details: status < 500 ? core.sanitize.sanitizeSensitiveFields(details) : void 0
+      httpStatus: safeStatus,
+      details: safeStatus < 500 ? core.sanitize.sanitizeSensitiveFields(details) : void 0
     },
-    requestId: requestId ?? core.context.get().requestId ?? safe.traceId
+    requestId: safe.traceId
   };
   return new Response(JSON.stringify(response), {
-    status,
+    status: safeStatus,
     headers: { "Content-Type": "application/json", "X-Trace-Id": safe.traceId }
   });
 }
 function badRequest(message, requestId, details) {
-  return error("BAD_REQUEST", message, 400, requestId, details);
+  return error(HaiCommonError.INVALID_REQUEST.code, message, 400, requestId, details);
 }
 function unauthorized(message, requestId) {
-  return error("UNAUTHORIZED", message ?? kitM("kit_authRequired"), 401, requestId);
+  return error(HaiCommonError.UNAUTHORIZED.code, message ?? kitM("kit_authRequired"), 401, requestId);
 }
 function forbidden(message, requestId) {
-  return error("FORBIDDEN", message ?? kitM("kit_accessDenied"), 403, requestId);
+  return error(HaiCommonError.FORBIDDEN.code, message ?? kitM("kit_accessDenied"), 403, requestId);
 }
 function notFound(message, requestId) {
-  return error("NOT_FOUND", message ?? kitM("kit_resourceNotFound"), 404, requestId);
+  return error(HaiCommonError.NOT_FOUND.code, message ?? kitM("kit_resourceNotFound"), 404, requestId);
 }
 function conflict(message, requestId) {
-  return error("CONFLICT", message, 409, requestId);
+  return error(HaiCommonError.CONFLICT.code, message, 409, requestId);
 }
 function validationError(errors, requestId) {
-  return error("VALIDATION_ERROR", kitM("kit_validationFailed"), 422, requestId, { errors });
+  return fromError({
+    ...HaiCommonError.VALIDATION_ERROR,
+    message: kitM("kit_validationFailed"),
+    httpStatus: 422,
+    cause: errors
+  }, requestId);
 }
 function internalError(message, requestId) {
-  return error("INTERNAL_ERROR", message ?? kitM("kit_internalError"), 500, requestId);
+  return error(HaiCommonError.INTERNAL_ERROR.code, message ?? kitM("kit_internalError"), 500, requestId);
 }
 function redirect(url, status = 302) {
   return new Response(null, {
@@ -132,13 +163,25 @@ function fromResult(result, httpStatusMap, requestId) {
   if (result.success) {
     return ok(result.data, requestId);
   }
-  const status = httpStatusMap?.[result.error.code] ?? (typeof result.error.httpStatus === "number" ? result.error.httpStatus : 400);
+  const status = httpStatusMap?.[result.error.code] ?? (typeof result.error.httpStatus === "number" ? result.error.httpStatus : 500);
   return fromError({ ...result.error, httpStatus: status }, requestId);
 }
 function fromError(haiError, requestId) {
   const safe = core.error.toPublic(haiError, requestId);
   core.logger.error("API operation failed", { traceId: safe.traceId, error: haiError });
-  return error(String(safe.code), safe.message, safe.httpStatus ?? 400, safe.traceId);
+  const response = {
+    success: false,
+    error: {
+      ...safe,
+      code: String(safe.code),
+      httpStatus: safe.httpStatus ?? 500
+    },
+    requestId: safe.traceId
+  };
+  return new Response(JSON.stringify(response), {
+    status: safe.httpStatus ?? 500,
+    headers: { "Content-Type": "application/json", "X-Trace-Id": safe.traceId }
+  });
 }
 
 // src/guards/kit-sensitive.ts
@@ -150,8 +193,6 @@ async function requireSensitiveOperation(iam, event, operation) {
   if (!checked.success)
     throw fromError(checked.error);
 }
-
-// src/kit-utils.ts
 function isResponseLike(value) {
   if (value instanceof Response)
     return true;
@@ -161,16 +202,19 @@ function isResponseLike(value) {
   return false;
 }
 function isSvelteKitControlFlow(value) {
-  if (isResponseLike(value))
-    return false;
-  if (typeof value === "object" && value !== null && "status" in value) {
-    const status = value.status;
-    return typeof status === "number";
-  }
-  return false;
+  return isHttpError(value) || isRedirect(value);
 }
 function loggingMiddleware(config = {}) {
-  const { logBody = false, logResponse = false, redactFields = ["password", "token", "secret", "authorization", "apikey", "api_key", "creditcard", "credit_card"] } = config;
+  const { logBody = false, logResponse = false, redactFields = [
+    "password",
+    "token",
+    "secret",
+    "authorization",
+    "apikey",
+    "api_key",
+    "creditcard",
+    "credit_card"
+  ] } = config;
   return async (context, next) => {
     const { event, requestId } = context;
     const startTime = Date.now();
@@ -215,7 +259,7 @@ function redactObject(obj, fields) {
   return core.sanitize.sanitizeSensitiveFields(obj, { matcher: fields });
 }
 function permitsMemory() {
-  return !core.module.requiresSharedState(process2.env);
+  return !core.module.requiresSharedState(process.env);
 }
 function createCacheRateLimitStore(backend, options) {
   if (!options.namespace || options.namespace.length > 128)
@@ -230,14 +274,14 @@ function createCacheRateLimitStore(backend, options) {
       for (let attempt = 0; attempt < 64; attempt++) {
         const read = await backend.kv.get(cacheKey);
         if (!read.success)
-          throw new Error("Rate limit cache read failed");
+          throw new Error("Rate limit cache read failed", { cause: read.error });
         const old = read.data ?? void 0;
         if (old && (!Number.isSafeInteger(old.count) || old.count <= 0 || old.count >= Number.MAX_SAFE_INTEGER || !Number.isSafeInteger(old.resetAt)))
           throw new Error("Invalid rate limit state");
         const next = old ? { count: old.count + 1, resetAt: old.resetAt } : { count: 1, resetAt: Date.now() + windowMs };
         const written = await backend.kv.compareAndSwap(cacheKey, old, next, old ? { keepTtl: true } : { px: windowMs });
         if (!written.success)
-          throw new Error("Rate limit cache commit failed");
+          throw new Error("Rate limit cache commit failed", { cause: written.error });
         if (written.data)
           return next;
       }
@@ -258,7 +302,12 @@ function clientKey(address) {
   if (!mapped)
     return normalized;
   const value = Number.parseInt(mapped[1], 16) * 65536 + Number.parseInt(mapped[2], 16);
-  return [value >>> 24, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
+  return [
+    value >>> 24,
+    value >>> 16 & 255,
+    value >>> 8 & 255,
+    value & 255
+  ].join(".");
 }
 var MemoryRateLimitStore = class {
   scope = "memory";
@@ -331,37 +380,29 @@ function rateLimitMiddleware(config) {
       entry = await store.increment(keyGenerator(event), windowMs);
       if (!Number.isSafeInteger(entry.count) || entry.count <= 0 || !Number.isSafeInteger(entry.resetAt))
         throw new TypeError("Invalid atomic rate limit result");
-    } catch {
-      core.logger.error("Rate limit store unavailable", { requestId });
-      return new Response(JSON.stringify({ success: false, error: { code: "RATE_LIMIT_UNAVAILABLE", message: kitM("kit_internalError") }, requestId }), { status: 503, headers: { "Content-Type": "application/json" } });
+    } catch (cause) {
+      return fromError({
+        ...HaiCommonError.SERVICE_UNAVAILABLE,
+        message: kitM("kit_internalError"),
+        cause
+      }, requestId);
     }
     const remaining = Math.max(0, maxRequests - entry.count);
     const resetTime = Math.ceil(entry.resetAt / 1e3);
     if (entry.count > maxRequests) {
-      core.logger.warn("Rate limit exceeded", { requestId });
       if (onLimitReached) {
+        core.logger.warn("Rate limit exceeded", { requestId });
         return onLimitReached(event);
       }
-      return new Response(
-        JSON.stringify({
-          success: false,
-          error: {
-            code: "RATE_LIMIT_EXCEEDED",
-            message: kitM("kit_rateLimitExceeded")
-          },
-          requestId
-        }),
-        {
-          status: 429,
-          headers: {
-            "Content-Type": "application/json",
-            "X-RateLimit-Limit": String(maxRequests),
-            "X-RateLimit-Remaining": "0",
-            "X-RateLimit-Reset": String(resetTime),
-            "Retry-After": String(Math.max(1, Math.ceil((entry.resetAt - now) / 1e3)))
-          }
-        }
-      );
+      const response2 = fromError({
+        ...HaiCommonError.RATE_LIMIT_EXCEEDED,
+        message: kitM("kit_rateLimitExceeded")
+      }, requestId);
+      response2.headers.set("X-RateLimit-Limit", String(maxRequests));
+      response2.headers.set("X-RateLimit-Remaining", "0");
+      response2.headers.set("X-RateLimit-Reset", String(resetTime));
+      response2.headers.set("Retry-After", String(Math.max(1, Math.ceil((entry.resetAt - now) / 1e3))));
+      return response2;
     }
     const response = await next();
     response.headers.set("X-RateLimit-Limit", String(maxRequests));
@@ -370,10 +411,16 @@ function rateLimitMiddleware(config) {
     return response;
   };
 }
-var ENCRYPTED_PREFIX = "enc:";
+var ENCRYPTED_PREFIX = "enc:v2:";
 function createEncryptedCookieProxy(cookies, config) {
   const { names, symmetric, encryptionKey } = config;
   const logger = core.logger.child({ module: "kit", scope: "cookie-proxy" });
+  if (!/^[\da-f]{32}$/i.test(encryptionKey))
+    throw new Error("Cookie encryption requires a 32-character hexadecimal key");
+  const keys = Buffer.from(hkdfSync("sha256", Buffer.from(encryptionKey, "hex"), Buffer.alloc(0), "hai:kit:cookie:v2", 48));
+  const cipherKey = keys.subarray(0, 16).toString("hex");
+  const macKey = keys.subarray(16);
+  const authenticate = (name, iv, ciphertext) => createHmac("sha256", macKey).update(JSON.stringify(["v2", name, iv, ciphertext])).digest();
   return new Proxy(cookies, {
     get(target, prop, receiver) {
       if (prop === "get") {
@@ -387,14 +434,17 @@ function createEncryptedCookieProxy(cookies, config) {
           }
           try {
             const ciphertext = raw.slice(ENCRYPTED_PREFIX.length);
-            const separatorIndex = ciphertext.indexOf(":");
-            if (separatorIndex === -1) {
+            const parts = ciphertext.split(":");
+            if (parts.length !== 3 || !/^[\da-f]{64}$/i.test(parts[2])) {
               logger.warn("Encrypted cookie has invalid format", { name });
               return void 0;
             }
-            const iv = ciphertext.slice(0, separatorIndex);
-            const encrypted = ciphertext.slice(separatorIndex + 1);
-            const result = symmetric.decryptWithIV(encrypted, encryptionKey, iv);
+            const [iv, encrypted, signature] = parts;
+            if (!timingSafeEqual(authenticate(name, iv, encrypted), Buffer.from(signature, "hex"))) {
+              logger.warn("Cookie authentication failed", { name });
+              return void 0;
+            }
+            const result = symmetric.decryptWithIV(encrypted, cipherKey, iv);
             if (!result.success || typeof result.data !== "string") {
               logger.warn("Cookie decryption failed", { name });
               return void 0;
@@ -409,12 +459,13 @@ function createEncryptedCookieProxy(cookies, config) {
       if (prop === "set") {
         return (name, value, opts) => {
           if (names.has(name)) {
-            const result = symmetric.encryptWithIV(value, encryptionKey);
+            const result = symmetric.encryptWithIV(value, cipherKey);
             if (!result.success || !result.data) {
               logger.error("Cookie encryption failed", { name });
               throw new Error("Cookie encryption failed");
             }
-            value = `${ENCRYPTED_PREFIX}${result.data.iv}:${result.data.ciphertext}`;
+            const { iv, ciphertext } = result.data;
+            value = `${ENCRYPTED_PREFIX}${iv}:${ciphertext}:${authenticate(name, iv, ciphertext).toString("hex")}`;
           }
           return target.set(name, value, opts);
         };
@@ -475,7 +526,10 @@ function createHandle(config = {}) {
       maxRequests: rateLimitConfig.maxRequests ?? 100
     }));
   }
-  const allMiddleware = [...builtinMiddleware, ...customMiddleware];
+  const allMiddleware = [
+    ...builtinMiddleware,
+    ...customMiddleware
+  ];
   const transportMiddleware = buildTransportMiddleware(cryptoConfig, checkAccess ? checkAccess.encryption : void 0);
   const cookieProxyConfig = buildCookieProxyConfig(cryptoConfig);
   return async ({ event, resolve }) => {
@@ -488,15 +542,23 @@ function createHandle(config = {}) {
     }
     const resolvedAddress = resolveIp(event.request, clientAddress);
     if (resolvedAddress !== clientAddress) {
-      event.getClientAddress = () => {
-        if (!resolvedAddress)
-          throw new Error("Trusted client address is unavailable");
-        return resolvedAddress;
+      event = {
+        ...event,
+        getClientAddress: () => {
+          if (!resolvedAddress)
+            throw new Error("Trusted client address is unavailable");
+          return resolvedAddress;
+        }
       };
     }
     clientAddress = resolvedAddress;
     const accessDecision = checkAccess ? checkAccess(event.url.pathname, event.request.method, clientAddress) : void 0;
-    return core.context.run({ requestId, userId: void 0, scopeId: void 0, jobId: void 0 }, () => audit.withContext({
+    return core.context.run({
+      requestId,
+      userId: void 0,
+      scopeId: void 0,
+      jobId: void 0
+    }, () => audit.withContext({
       actor: null,
       requestId,
       traceId: requestId,
@@ -519,33 +581,49 @@ function createHandle(config = {}) {
           category: /\/(?:auth|iam|audit)(?:\/|$)/.test(resource) ? "system" : "business",
           outcome: guardDenied || [401, 403, 423, 429].includes(status) ? "denied" : requestFailed || status >= 400 ? "failure" : "success",
           details: { method: event.request.method, status }
-        }, { read: ["GET", "HEAD", "OPTIONS"].includes(event.request.method) });
+        }, {
+          read: ["GET", "HEAD", "OPTIONS"].includes(event.request.method)
+        });
         if (!written.success)
           core.logger.error("Request audit failed", { requestId, resource, error: written.error });
       };
+      if (cookieProxyConfig) {
+        event = {
+          ...event,
+          cookies: createEncryptedCookieProxy(event.cookies, cookieProxyConfig)
+        };
+      }
       const context = {
         event,
         requestId
       };
       const locals = event.locals;
       locals.requestId = requestId;
-      if (cookieProxyConfig) {
-        const proxiedCookies = createEncryptedCookieProxy(event.cookies, cookieProxyConfig);
-        Object.defineProperty(event, "cookies", {
-          value: proxiedCookies,
-          writable: true,
-          configurable: true
-        });
-      }
       const runRequest = async () => {
         try {
           if (accessDecision && !accessDecision.allowed) {
             guardDenied = true;
-            core.logger.info("Request access policy denied", { ruleId: accessDecision.ruleId, reason: accessDecision.reason, method: event.request.method, ipAddress: clientAddress });
-            return Response.json({ success: false, error: { ...HaiCommonError.REQUEST_ACCESS_DENIED, message: core.i18n.coreM("core_requestAccessDenied"), traceId: requestId } }, { status: 403 });
+            core.logger.info("Request access policy denied", {
+              ruleId: accessDecision.ruleId,
+              reason: accessDecision.reason,
+              method: event.request.method,
+              ipAddress: clientAddress
+            });
+            return Response.json({
+              success: false,
+              error: {
+                ...HaiCommonError.REQUEST_ACCESS_DENIED,
+                message: core.i18n.coreM("core_requestAccessDenied"),
+                traceId: requestId
+              }
+            }, { status: 403 });
           }
           if (!transportMiddleware && event.request.method !== "OPTIONS" && (event.request.headers.has(TRANSPORT_PROTOCOL.ENCRYPTED_HEADER) || event.request.headers.has(TRANSPORT_PROTOCOL.ENVELOPE_HEADER)) && checkAccess && checkAccess.encryption(event.url.pathname, event.request.method) === "disabled") {
-            return Response.json(err({ ...HaiCommonError.VALIDATION_ERROR, message: kitM("kit_transportPlaintextRequired"), traceId: requestId }), { status: 400 });
+            return Response.json(err({
+              ...HaiCommonError.VALIDATION_ERROR,
+              message: kitM("kit_transportPlaintextRequired"),
+              traceId: requestId
+            }), { status: 400 });
           }
           if (a2aResolved) {
             const a2aResponse = await handleA2ARequest(event, requestId, a2aResolved);
@@ -576,20 +654,11 @@ function createHandle(config = {}) {
                     headers: { Location: guardResult.redirect }
                   });
                 }
-                return new Response(
-                  JSON.stringify({
-                    success: false,
-                    error: {
-                      code: "FORBIDDEN",
-                      message: guardResult.message ?? kitM("kit_accessDenied")
-                    },
-                    requestId
-                  }),
-                  {
-                    status: guardResult.status ?? 403,
-                    headers: { "Content-Type": "application/json" }
-                  }
-                );
+                return fromError({
+                  ...guardResult.status === 401 ? HaiCommonError.UNAUTHORIZED : HaiCommonError.FORBIDDEN,
+                  message: guardResult.message ?? kitM("kit_accessDenied"),
+                  httpStatus: guardResult.status ?? 403
+                }, requestId);
               }
             }
             const response2 = await executeMiddlewareChain(
@@ -606,25 +675,15 @@ function createHandle(config = {}) {
             throw error2;
           }
           requestFailed = true;
-          core.logger.error("Request failed", { requestId, error: error2 });
           if (onError) {
+            core.logger.error("Request failed", { requestId, error: error2 });
             return onError(error2, event);
           }
-          return new Response(
-            JSON.stringify({
-              success: false,
-              error: {
-                code: "INTERNAL_ERROR",
-                message: core.error.formatMessage({ message: kitM("kit_internalError"), traceId: requestId }),
-                traceId: requestId
-              },
-              requestId
-            }),
-            {
-              status: 500,
-              headers: { "Content-Type": "application/json" }
-            }
-          );
+          return fromError({
+            ...HaiCommonError.INTERNAL_ERROR,
+            message: kitM("kit_internalError"),
+            cause: error2
+          }, requestId);
         }
       };
       const keyExchange = cryptoConfig?.transport ? cryptoConfig.transport.keyExchangePath ?? "/api/_hai/key-exchange" : void 0;
@@ -716,10 +775,12 @@ function buildTransportMiddleware(cryptoConfig, encryption) {
 function buildCookieProxyConfig(cryptoConfig) {
   if (!cryptoConfig?.encryptedCookies?.length)
     return null;
-  const key = cryptoConfig.cookieEncryptionKey ?? (typeof process !== "undefined" ? process.env?.HAI_KIT_COOKIE_KEY : void 0);
+  const key = cryptoConfig.cookieEncryptionKey ?? process.env.HAI_KIT_COOKIE_KEY;
   if (!key) {
     throw new Error("Cookie encryption requires crypto.cookieEncryptionKey or HAI_KIT_COOKIE_KEY");
   }
+  if (!/^[\da-f]{32}$/i.test(key))
+    throw new Error("Cookie encryption requires a 32-character hexadecimal key");
   return {
     names: new Set(cryptoConfig.encryptedCookies),
     symmetric: cryptoConfig.crypto.symmetric,
@@ -774,18 +835,13 @@ function handler(fn) {
       if (isSvelteKitControlFlow(error2)) {
         throw error2;
       }
-      const normalizedError = error2 instanceof Error ? {
-        name: error2.name,
-        message: error2.message,
-        stack: error2.stack,
-        cause: error2.cause
-      } : error2;
-      core.logger.error("Request handler error", {
-        error: normalizedError,
-        path: event.url.pathname,
-        method: event.request.method
+      return fromError({
+        ...HaiCommonError.INTERNAL_ERROR,
+        message: kitM("kit_internalError"),
+        // 由 Core 统一规范化原始异常，保留驱动码和 AggregateError 的子错误。
+        cause: error2,
+        ext: { path: event.url.pathname, method: event.request.method }
       });
-      return internalError();
     }
   };
 }
@@ -823,14 +879,24 @@ async function validateForm(request, schema) {
     } else {
       return {
         valid: false,
-        errors: [{ field: "_", message: kitM("kit_unsupportedContentType") }]
+        errors: [
+          {
+            field: "_",
+            message: kitM("kit_unsupportedContentType")
+          }
+        ]
       };
     }
     return validateParsedData(data, schema);
   } catch {
     return {
       valid: false,
-      errors: [{ field: "_", message: kitM("kit_parseBodyFailed") }]
+      errors: [
+        {
+          field: "_",
+          message: kitM("kit_parseBodyFailed")
+        }
+      ]
     };
   }
 }
@@ -861,7 +927,20 @@ var PaginationQuerySchema = z.object({
 });
 
 // src/kit-auth-api.ts
-var authApiPublicPaths = ["/api/auth/session/close", "/api/auth/logout", "/api/auth/captcha", "/api/auth/config", "/api/auth/login", "/api/auth/login/ldap", "/api/auth/login/otp", "/api/auth/register", "/api/auth/otp/send", "/api/auth/password-reset/request", "/api/auth/password-reset/confirm", "/api/auth/password/renew"];
+var authApiPublicPaths = [
+  "/api/auth/session/close",
+  "/api/auth/logout",
+  "/api/auth/captcha",
+  "/api/auth/config",
+  "/api/auth/login",
+  "/api/auth/login/ldap",
+  "/api/auth/login/otp",
+  "/api/auth/register",
+  "/api/auth/otp/send",
+  "/api/auth/password-reset/request",
+  "/api/auth/password-reset/confirm",
+  "/api/auth/password/renew"
+];
 function requestContext(event) {
   let ip;
   try {
@@ -869,7 +948,11 @@ function requestContext(event) {
   } catch {
   }
   const terminal = event.request.headers.get("x-hai-terminal");
-  return { ip, userAgent: event.request.headers.get("user-agent") ?? void 0, terminalType: terminal === "app" || terminal === "desktop" || terminal === "api" ? terminal : "web" };
+  return {
+    ip,
+    userAgent: event.request.headers.get("user-agent") ?? void 0,
+    terminalType: terminal === "app" || terminal === "desktop" || terminal === "api" ? terminal : "web"
+  };
 }
 function createAuthApi(iam) {
   function response(result) {
@@ -932,18 +1015,33 @@ function createAuthApi(iam) {
   };
 }
 function createFeedbackHandler(options) {
-  const basePath = (options.basePath ?? "/api/feedback").replace(/\/+$/, "");
+  const configuredPath = options.basePath ?? "/api/feedback";
+  let pathEnd = configuredPath.length;
+  while (pathEnd > 0 && configuredPath[pathEnd - 1] === "/")
+    pathEnd--;
+  const basePath = configuredPath.slice(0, pathEnd);
   return async (event) => {
     let actor;
     try {
       actor = await options.resolveContext(event);
     } catch {
-      return fromError({ ...HaiCommonError.INTERNAL_ERROR, message: kitM("kit_internalError") });
+      return fromError({
+        ...HaiCommonError.INTERNAL_ERROR,
+        message: kitM("kit_internalError")
+      });
+    }
+    if (!actor?.scopeId || !actor.userId) {
+      return fromError({
+        ...HaiCommonError.UNAUTHORIZED,
+        message: kitM("kit_unauthorized")
+      });
+    }
+    if (options.feedback.isInitialized === false) {
+      return fromError({
+        ...HaiCommonError.SERVICE_UNAVAILABLE,
+        message: kitM("kit_feedbackUnavailable")
+      });
     }
-    if (!actor?.scopeId || !actor.userId)
-      return fromError({ ...HaiCommonError.UNAUTHORIZED, message: kitM("kit_unauthorized") });
-    if (options.feedback.isInitialized === false)
-      return fromError({ ...HaiCommonError.SERVICE_UNAVAILABLE, message: kitM("kit_feedbackUnavailable") });
     const suffix = event.url.pathname.startsWith(`${basePath}/`) ? event.url.pathname.slice(basePath.length + 1) : "";
     let parts;
     try {
@@ -953,8 +1051,12 @@ function createFeedbackHandler(options) {
     }
     if (parts.length === 1 && parts[0] === "policy" && event.request.method === "GET")
       return ok(options.feedback.budget);
-    if (parts[0] !== "reports" || parts.length > 4)
-      return fromError({ ...HaiCommonError.NOT_FOUND, message: core.i18n.coreM("core_errorNotFound") });
+    if (parts[0] !== "reports" || parts.length > 4) {
+      return fromError({
+        ...HaiCommonError.NOT_FOUND,
+        message: core.i18n.coreM("core_errorNotFound")
+      });
+    }
     let body = {};
     if (!["GET", "HEAD"].includes(event.request.method)) {
       if (event.request.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() !== "application/json")
@@ -970,7 +1072,11 @@ function createFeedbackHandler(options) {
     const bodyRecord = body;
     if (parts[1] && Object.hasOwn(bodyRecord, "id") && bodyRecord.id !== parts[1])
       return invalid(400);
-    const input = { ...Object.fromEntries(event.url.searchParams), ...bodyRecord, ...parts[1] ? { id: parts[1] } : {} };
+    const input = {
+      ...Object.fromEntries(event.url.searchParams),
+      ...bodyRecord,
+      ...parts[1] ? { id: parts[1] } : {}
+    };
     const method = event.request.method;
     const service = options.feedback;
     async function execute(schema, operation) {
@@ -981,7 +1087,10 @@ function createFeedbackHandler(options) {
         const result = await core.context.run(actor, () => operation(parsed.data));
         return result.success ? ok(result.data) : fromError(result.error);
       } catch {
-        return fromError({ ...HaiCommonError.INTERNAL_ERROR, message: kitM("kit_internalError") });
+        return fromError({
+          ...HaiCommonError.INTERNAL_ERROR,
+          message: kitM("kit_internalError")
+        });
       }
     }
     if (parts.length === 1) {
@@ -1017,11 +1126,18 @@ function createFeedbackHandler(options) {
       Object.assign(input, { jobId: parts[3] });
       return execute(FeedbackExportQuerySchema, (value) => service.getExport(value, actor));
     }
-    return fromError({ ...HaiCommonError.NOT_FOUND, message: core.i18n.coreM("core_errorNotFound") });
+    return fromError({
+      ...HaiCommonError.NOT_FOUND,
+      message: core.i18n.coreM("core_errorNotFound")
+    });
   };
 }
 function invalid(status) {
-  return fromError({ ...HaiCommonError.INVALID_REQUEST, httpStatus: status, message: kitM("kit_validationFailed") });
+  return fromError({
+    ...HaiCommonError.INVALID_REQUEST,
+    httpStatus: status,
+    message: kitM("kit_validationFailed")
+  });
 }
 async function readBoundedJson(request, maximum) {
   const reader = request.body?.getReader();
@@ -1155,7 +1271,6 @@ var kit = {
     setBrowserToken,
     /** 清除浏览器端 Access Token（客户端 logout 用） */
     clearBrowserToken
-    /** 创建浏览器端 Token 存储器（自定义 key 时使用） */
   },
   // ─── CRUD ───
   crud: {