@h-ai/kit 1.0.0-beta.18 → 1.0.0-beta.19

package/dist/{kit-a2a-types-ikgvWS3T.d.ts → kit-a2a-types-CeDikRAX.d.ts}

@@ -1,5 +1,5 @@
 import { RequestEvent } from '@sveltejs/kit';
-import { f as HandleA2AOperations, h as HandleConfig } from './kit-types-CnfBC89D.js';
+import { g as HandleA2AOperations, i as HandleConfig } from './kit-types-BUDaKGB0.js';
 
 /**
  * @h-ai/kit — A2A API Key 认证器
@@ -133,4 +133,5 @@ interface KitA2AHandlerConfig {
     authenticate?: 'apiKey' | ((event: RequestEvent) => Promise<Record<string, unknown> | null | undefined>);
 }
 
-export { type A2AApiKeyAuthConfig as A, type KitA2AHandlerConfig as K, type ResolvedA2AConfig as R, createA2AApiKeyAuthenticator as c, handleA2ARequest as h, resolveA2AConfig as r };
+export { createA2AApiKeyAuthenticator as c, handleA2ARequest as h, resolveA2AConfig as r };
+export type { A2AApiKeyAuthConfig as A, KitA2AHandlerConfig as K, ResolvedA2AConfig as R };

package/dist/kit-config-CCksTmi5.d.ts

@@ -0,0 +1,182 @@
+import { o as KitServerConfig, q as KitTransportConfig, m as KitConfigInput, l as KitConfig, r as KitTransportConfigInput } from './kit-types-BUDaKGB0.js';
+import { z } from 'zod';
+
+/**
+ * @h-ai/kit — 宿主配置
+ *
+ * 为 `config/_kit.yml` 提供监听、传输与请求策略的默认值和校验。
+ * 服务端消费完整配置；浏览器仅接收显式投影的 transport 公共字段。
+ * @module kit-config
+ */
+
+/**
+ * `config/_kit.yml` 对应的配置 Schema。
+ * @example
+ * ```ts
+ * import { KitConfigSchema } from '@h-ai/kit'
+ *
+ * const config = KitConfigSchema.parse({ server: { port: 3000 }, transport: false })
+ * void config
+ * ```
+ */
+declare const KitConfigSchema: z.ZodPipe<z.ZodObject<{
+    server: z.ZodOptional<z.ZodObject<{
+        host: z.ZodDefault<z.ZodString>;
+        port: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
+    transport: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
+        maxPlaintextBytes: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<"auto">]>, z.ZodTransform<number | undefined, number | "auto">>>;
+        maxFutureSkewSeconds: z.ZodOptional<z.ZodNumber>;
+        maxRequestAgeSeconds: z.ZodOptional<z.ZodNumber>;
+        routePlaintextBytes: z.ZodOptional<z.ZodRecord<z.ZodCustom<`/${string}`, `/${string}`>, z.ZodNumber>>;
+        keyExchangePath: z.ZodDefault<z.ZodCustom<`/${string}`, `/${string}`>>;
+        excludePaths: z.ZodDefault<z.ZodArray<z.ZodCustom<`/${string}`, `/${string}`>>>;
+    }, z.core.$strip>]>>;
+    trustedProxies: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"auto">, z.ZodArray<z.ZodUnion<readonly [z.ZodIPv4, z.ZodIPv6, z.ZodCIDRv4, z.ZodCIDRv6]>>]>>;
+    access: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
+        file: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        global: z.ZodOptional<z.ZodObject<{
+            allowIps: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodIPv4, z.ZodIPv6, z.ZodCIDRv4, z.ZodCIDRv6]>>>;
+            denyIps: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodIPv4, z.ZodIPv6, z.ZodCIDRv4, z.ZodCIDRv6]>>>;
+            timezone: z.ZodDefault<z.ZodString>;
+            windows: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                days: z.ZodArray<z.ZodNumber>;
+                start: z.ZodString;
+                end: z.ZodString;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
+        rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            allowIps: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodIPv4, z.ZodIPv6, z.ZodCIDRv4, z.ZodCIDRv6]>>>;
+            denyIps: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodIPv4, z.ZodIPv6, z.ZodCIDRv4, z.ZodCIDRv6]>>>;
+            timezone: z.ZodDefault<z.ZodString>;
+            windows: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                days: z.ZodArray<z.ZodNumber>;
+                start: z.ZodString;
+                end: z.ZodString;
+            }, z.core.$strict>>>;
+            id: z.ZodString;
+            paths: z.ZodArray<z.ZodString>;
+            methods: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+                GET: "GET";
+                HEAD: "HEAD";
+                POST: "POST";
+                PUT: "PUT";
+                PATCH: "PATCH";
+                DELETE: "DELETE";
+                OPTIONS: "OPTIONS";
+                CONNECT: "CONNECT";
+                TRACE: "TRACE";
+            }>>>;
+            encryption: z.ZodOptional<z.ZodEnum<{
+                required: "required";
+                disabled: "disabled";
+            }>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>]>>;
+}, z.core.$strip>, z.ZodTransform<{
+    server: KitServerConfig;
+    transport: false | KitTransportConfig;
+    trustedProxies: "auto" | string[];
+    access: false | {
+        file: string;
+    } | {
+        rules: {
+            allowIps: string[];
+            denyIps: string[];
+            timezone: string;
+            windows: {
+                days: number[];
+                start: string;
+                end: string;
+            }[];
+            id: string;
+            paths: string[];
+            methods: ("GET" | "HEAD" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS" | "CONNECT" | "TRACE")[];
+            encryption?: "required" | "disabled" | undefined;
+        }[];
+        global?: {
+            allowIps: string[];
+            denyIps: string[];
+            timezone: string;
+            windows: {
+                days: number[];
+                start: string;
+                end: string;
+            }[];
+        } | undefined;
+    };
+}, {
+    trustedProxies: "auto" | string[];
+    access: false | {
+        file: string;
+    } | {
+        rules: {
+            allowIps: string[];
+            denyIps: string[];
+            timezone: string;
+            windows: {
+                days: number[];
+                start: string;
+                end: string;
+            }[];
+            id: string;
+            paths: string[];
+            methods: ("GET" | "HEAD" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS" | "CONNECT" | "TRACE")[];
+            encryption?: "required" | "disabled" | undefined;
+        }[];
+        global?: {
+            allowIps: string[];
+            denyIps: string[];
+            timezone: string;
+            windows: {
+                days: number[];
+                start: string;
+                end: string;
+            }[];
+        } | undefined;
+    };
+    server?: {
+        host: string;
+        port: number;
+    } | undefined;
+    transport?: false | {
+        keyExchangePath: `/${string}`;
+        excludePaths: `/${string}`[];
+        maxPlaintextBytes?: number | undefined;
+        maxFutureSkewSeconds?: number | undefined;
+        maxRequestAgeSeconds?: number | undefined;
+        routePlaintextBytes?: Record<`/${string}`, number> | undefined;
+    } | undefined;
+}>>;
+/**
+ * 解析 transport 配置并补齐默认值。
+ *
+ * @param input - `config/_kit.yml` 中的 transport 配置
+ * @returns 完整 transport 配置；`false` 表示关闭
+ * @example
+ * ```ts
+ * import { resolveKitTransportConfig } from '@h-ai/kit'
+ *
+ * const transport = resolveKitTransportConfig({ excludePaths: ['/api/health'] })
+ * if (transport) void transport.keyExchangePath
+ * ```
+ */
+declare function resolveKitTransportConfig(input?: false | KitTransportConfigInput): false | KitTransportConfig;
+/**
+ * 解析 `config/_kit.yml` 顶层配置并补齐默认值。
+ *
+ * 适合同一份配置同时供 SvelteKit 服务端 hook 与浏览器端 client 读取。
+ * @param input - Kit 监听和公开 transport 输入；省略字段按 Schema 补默认值。
+ * @returns 已补齐默认值的配置；不合法输入抛出 ZodError。
+ * @example
+ * ```ts
+ * import { resolveKitConfig } from '@h-ai/kit'
+ *
+ * const config = resolveKitConfig({ transport: false })
+ * void config.server.port
+ * ```
+ */
+declare function resolveKitConfig(input?: KitConfigInput): KitConfig;
+
+export { KitConfigSchema as K, resolveKitTransportConfig as a, resolveKitConfig as r };

package/dist/kit-crypto-types-CqFENBqm.d.ts

@@ -0,0 +1,47 @@
+import { TransportServerKeyRing, CryptoFunctions, TransportKeyStore } from '@h-ai/crypto';
+
+/**
+ * @h-ai/kit — 传输加密类型定义
+ *
+ * 仅复用 @h-ai/crypto 的真实公开能力。
+ * @module kit-crypto-types
+ */
+
+/**
+ * 传输加密配置。
+ *
+ * kit 不再维护本地加解密实现；服务端管理器由 `crypto.transport.createServer()` 创建，
+ * 协议常量与载荷类型统一来自 `@h-ai/crypto`。
+ * @example
+ * ```ts
+ * import type { TransportEncryptionConfig } from '@h-ai/kit'
+ *
+ * function publicPaths(config: TransportEncryptionConfig) { return config.excludePaths ?? [] }
+ * ```
+ */
+interface TransportEncryptionConfig {
+    /** 宿主构建挂载目录，默认空字符串；仅作用于 API/data 保护范围。 */
+    basePath?: string;
+    /** 双向业务明文 UTF-8 字节上限；默认 1 MiB，整数范围 1 KiB～64 MiB。 */
+    maxPlaintextBytes?: number;
+    /** 请求时间允许领先服务器的秒数，默认 30，整数范围 0～300。 */
+    maxFutureSkewSeconds?: number;
+    /** 请求从签发起的有效秒数，默认 300，整数范围 1～600。 */
+    maxRequestAgeSeconds?: number;
+    /** 路由明文容量；* 匹配一个完整路径段。 */
+    routePlaintextBytes?: Readonly<Record<string, number>>;
+    /** 受管服务端密钥环，仅从服务端 Secret 注入，不放公开 kit 配置。 */
+    serverKeyRing: TransportServerKeyRing;
+    /** 是否启用传输加密（默认 false） */
+    enabled: boolean;
+    /** @h-ai/crypto 服务实例 */
+    crypto: CryptoFunctions;
+    /** 密钥交换端点路径（默认 `/api/_hai/key-exchange`） */
+    keyExchangePath?: string;
+    /** 排除路径（不加密），支持精确匹配和前缀匹配 */
+    excludePaths?: readonly string[];
+    /** 显式客户端公钥存储；生产使用共享 Redis/reldb，内存仅供开发/测试。 */
+    keyStore: TransportKeyStore;
+}
+
+export type { TransportEncryptionConfig as T };