@h-ai/kit 1.0.0-beta.2 → 1.0.0-beta.21

package/dist/chunk-YKJRQCWR.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/kit-auth.ts","../src/client/kit-client.ts","../src/client/kit-client-auth.ts"],"names":["ok","options","core"],"mappings":";;;;;;;AAcA,IAAM,yBAAA,GAA4B,kBAAA;AAOlC,IAAM,SAAA,GAAY;AAAA,EAChB,UAAA,EAAY,yBAAA;AAAA,EACZ,UAAA,EAAY;AACd,CAAA;AAgBO,SAAS,cAAc,MAAA,EAA4E;AACxG,EAAA,IAAI,MAAA,CAAO,UAAA;AACT,IAAA,SAAA,CAAU,aAAa,MAAA,CAAO,UAAA;AAChC,EAAA,IAAI,MAAA,CAAO,UAAA;AACT,IAAA,SAAA,CAAU,aAAa,MAAA,CAAO,UAAA;AAClC;AAiDA,SAAS,sBAAA,GAA4C;AACnD,EAAA,IAAI,KAAA,GAAuB,IAAA;AAC3B,EAAA,OAAO;AAAA,IACL,KAAK,MAAM,KAAA;AAAA,IACX,GAAA,EAAK,CAAC,KAAA,KAAkB;AAAE,MAAA,KAAA,GAAQ,KAAA;AAAA,IAAM,CAAA;AAAA,IACxC,OAAO,MAAM;AAAE,MAAA,KAAA,GAAQ,IAAA;AAAA,IAAK;AAAA,GAC9B;AACF;AAGA,IAAM,2BAA2B,sBAAA,EAAuB;AAYjD,SAAS,2BAAA,GAAiD;AAC/D,EAAA,OAAO,wBAAA;AACT;AAOA,SAAS,0BAA0B,OAAA,EAAiC;AAClE,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACzD,EAAA,IAAI,CAAC,aAAA;AACH,IAAA,OAAO,IAAA;AAET,EAAA,MAAM,CAAC,MAAA,EAAQ,KAAK,CAAA,GAAI,aAAA,CAAc,MAAM,GAAG,CAAA;AAC/C,EAAA,IAAI,CAAC,UAAU,CAAC,KAAA;AACd,IAAA,OAAO,IAAA;AAET,EAAA,IAAI,MAAA,CAAO,aAAY,KAAM,QAAA;AAC3B,IAAA,OAAO,IAAA;AAET,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,EAAK;AAC3B,EAAA,OAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,GAAI,OAAA,GAAU,IAAA;AACxC;AAcO,SAAS,cAAA,CAAe,SAAkB,OAAA,EAAuC;AACtF,EAAA,OAAO,0BAA0B,OAAO,CAAA,IAAK,SAAS,GAAA,CAAI,SAAA,CAAU,UAAU,CAAA,IAAK,IAAA;AACrF;AAOA,SAAS,QAAA,CAAS,OAAA,EAAuB,KAAA,EAAe,MAAA,EAAuB;AAG7E,EAAA,MAAM,MAAA,GAAS,OAAO,OAAA,KAAY,WAAA,IAAe,OAAA,CAAQ,IAAI,QAAA,KAAa,YAAA,IAAgB,OAAA,CAAQ,GAAA,CAAI,YAAA,KAAiB,YAAA;AACvH,EAAA,OAAA,CAAQ,GAAA,CAAI,SAAA,CAAU,UAAA,EAAY,KAAA,EAAO;AAAA,IACvC,IAAA,EAAM,GAAA;AAAA,IACN,QAAA,EAAU,IAAA;AAAA,IACV,QAAA,EAAU,KAAA;AAAA;AAAA,IAEV,MAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAKA,SAAS,WAAW,OAAA,EAA6B;AAC/C,EAAA,OAAA,CAAQ,OAAO,SAAA,CAAU,UAAA,EAAY,EAAE,IAAA,EAAM,KAAK,CAAA;AACpD;AASA,SAAS,iBAAA,GAA2C;AAClD,EAAA,IAAI,CAAC,SAAA,CAAU,UAAA;AACb,IAAA,OAAO,IAAA;AACT,EAAA,OAAO,OAAO,SAAA,CAAU,UAAA,KAAe,aACnC,SAAA,CAAU,UAAA,KACV,SAAA,CAAU,UAAA;AAChB;AAQA,SAAS,sBAAA,GAA2C;AAClD,EAAA,OAAO,GAAA,CAAI;AAAA,IACT,IAAA,EAAM,yBAAA;AAAA,IACN,OAAA,EAAS,KAAK,uBAAuB;AAAA,GACtC,CAAA;AACH;AASA,eAAe,YAAA,CACb,OAAA,EACA,WAAA,EACA,GAAA,EACgC;AAChC,EAAA,MAAM,MAAM,iBAAA,EAAkB;AAC9B,EAAA,IAAI,CAAC,GAAA;AACH,IAAA,OAAO,sBAAA,EAAuB;AAEhC,EAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,GAAA,EAAK,WAAW,CAAA;AACzC,EAAA,IAAI,OAAO,OAAA,EAAS;AAClB,IAAA,QAAA,CAAS,OAAA,EAAS,OAAO,IAAA,CAAK,MAAA,CAAO,aAAa,MAAA,CAAO,IAAA,CAAK,OAAO,SAAS,CAAA;AAAA,EAChF;AACA,EAAA,OAAO,MAAA;AACT;AAkBA,eAAsB,KAAA,CACpB,OAAA,EACA,WAAA,EACA,OAAA,EACgC;AAChC,EAAA,OAAO,YAAA,CAAa,OAAA,EAAS,WAAA,EAAa,CAAC,GAAA,EAAK,UAAU,GAAA,CAAI,KAAA,CAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AACrF;AAkBA,eAAsB,YAAA,CACpB,OAAA,EACA,WAAA,EACA,OAAA,EACgC;AAChC,EAAA,OAAO,YAAA,CAAa,OAAA,EAAS,WAAA,EAAa,CAAC,GAAA,EAAK,UAAU,GAAA,CAAI,YAAA,CAAa,KAAA,EAAO,OAAO,CAAC,CAAA;AAC5F;AAkBA,eAAsB,aAAA,CACpB,OAAA,EACA,WAAA,EACA,OAAA,EACgC;AAChC,EAAA,OAAO,YAAA,CAAa,OAAA,EAAS,WAAA,EAAa,CAAC,GAAA,EAAK,UAAU,GAAA,CAAI,aAAA,CAAc,KAAA,EAAO,OAAO,CAAC,CAAA;AAC7F;AAkBA,eAAsB,eAAA,CACpB,OAAA,EACA,WAAA,EACA,OAAA,EACgC;AAChC,EAAA,OAAO,YAAA,CAAa,OAAA,EAAS,WAAA,EAAa,CAAC,GAAA,EAAK,UAAU,GAAA,CAAI,eAAA,CAAgB,KAAA,EAAO,OAAO,CAAC,CAAA;AAC/F;AAiBA,eAAsB,gBAAA,CACpB,OAAA,EACA,OAAA,EACA,OAAA,EACgC;AAChC,EAAA,OAAO,YAAA,CAAa,OAAA,EAAS,OAAA,EAAS,CAAC,GAAA,EAAK,UAAU,GAAA,CAAI,gBAAA,CAAiB,KAAA,EAAO,OAAO,CAAC,CAAA;AAC5F;AAmBA,eAAsB,MAAA,CACpB,SACA,WAAA,EAC0B;AAC1B,EAAA,IAAI;AACF,IAAA,IAAI,CAAC,WAAA;AACH,MAAA,OAAO,GAAG,KAAA,CAAS,CAAA;AACrB,IAAA,MAAM,MAAM,iBAAA,EAAkB;AAC9B,IAAA,IAAI,CAAC,GAAA;AACH,MAAA,OAAO,sBAAA,EAAuB;AAChC,IAAA,OAAO,MAAM,GAAA,CAAI,MAAA,CAAO,WAAW,CAAA;AAAA,EACrC,CAAA,SACA;AAEE,IAAA,UAAA,CAAW,OAAO,CAAA;AAAA,EACpB;AACF;AAgBO,SAAS,gBAAgB,KAAA,EAAqB;AACnD,EAAA,wBAAA,CAAyB,IAAI,KAAK,CAAA;AACpC;AAWO,SAAS,iBAAA,GAA0B;AACxC,EAAA,wBAAA,CAAyB,KAAA,EAAM;AACjC;AChZA,IAAM,wBAAA,GAA2B,CAAA,IAAA,EAAO,kBAAA,CAAmB,yBAAyB,CAAA,CAAA;AAkGpF,SAAS,UAAU,IAAA,EAAkC;AACnD,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,OAAO,MAAA;AACT,EAAA,MAAM,KAAA,GAAQ,SAAS,MAAA,CAAO,KAAA,CAAM,IAAI,MAAA,CAAO,CAAA,WAAA,EAAc,IAAI,CAAA,QAAA,CAAU,CAAC,CAAA;AAC5E,EAAA,OAAO,QAAQ,CAAC,CAAA;AAClB;AAYA,SAAS,sBAAsB,IAAA,EAA4C;AACzE,EAAA,OAAO,IAAA,KAAS,MAAA,IAAa,IAAA,KAAS,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA;AAChE;AAQA,SAAS,0BAA0B,OAAA,EAAgE;AACjG,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,WAAA,EAAY;AAC1C,EAAA,IAAI,MAAA,KAAW,KAAA,IAAS,MAAA,KAAW,MAAA,EAAQ;AACzC,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA;AAC3C,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AACnD,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,kBAAkB,CAAA,EAAG;AAC5C,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OAAO,QAAQ,IAAA,KAAS,IAAA;AAC1B;AAEA,SAAS,gBAAA,GAA2B;AAClC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,MAAA,CAAO,UAAU,MAAA,EAAQ;AAC5D,IAAA,OAAO,OAAO,QAAA,CAAS,MAAA;AAAA,EACzB;AAEA,EAAA,OAAO,kBAAA;AACT;AAEA,SAAS,SAAA,CAAU,OAA0B,IAAA,EAA6B;AACxE,EAAA,IAAI,KAAA,YAAiB,OAAA;AACnB,IAAA,OAAO,IAAA,GAAO,IAAI,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAA,GAAI,KAAA;AAE3C,EAAA,OAAO,IAAI,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAA;AAChC;AAgCO,SAAS,6BAA6B,eAAA,EAA+C;AAC1F,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,CAAC,eAAA;AACpC,IAAA;AAEF,EAAA,MAAM,UAAA,GAAa,UAAA;AACnB,EAAA,IAAI,UAAA,CAAW,+BAAA;AACb,IAAA;AAEF,EAAA,MAAM,gBAAgB,UAAA,CAAW,qBAAA,IAAyB,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAC1F,EAAA,UAAA,CAAW,qBAAA,GAAwB,aAAA;AAEnC,EAAA,MAAM,SAAS,gBAAA,EAAiB;AAChC,EAAA,MAAM,QAAA,GAAW,0BAAA,CAA2B,eAAA,CAAgB,QAAQ,CAAA;AACpE,EAAA,MAAM,cAAA,GAAiB,IAAI,GAAA,CAAI,eAAA,CAAgB,kBAAkB,wBAAA,EAA0B,MAAM,EAAE,QAAA,EAAS;AAC5G,EAAA,MAAM,eAAA,GAAkB,oBAAA,CAAqB,cAAA,EAAgB,MAAM,CAAA;AACnE,EAAA,MAAM,eAAA,GAAkB,eAAA,CAAgB,MAAA,CAAO,SAAA,CAAU,YAAA,CAAa;AAAA,IACpE,cAAA;AAAA,IACA,KAAA,EAAO,aAAA;AAAA,IACP,mBAAmB,eAAA,CAAgB;AAAA,GACpC,CAAA;AAED,EAAA,MAAM,YAAA,GAA6B,OAAO,KAAA,EAAO,IAAA,KAAS;AACxD,IAAA,MAAM,OAAA,GAAU,SAAA,CAAU,KAAA,EAAO,IAAI,CAAA;AACrC,IAAA,MAAM,UAAA,GAAa,IAAI,GAAA,CAAI,OAAA,CAAQ,KAAK,MAAM,CAAA;AAC9C,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA;AAE3C,IAAA,IAAI,CAAC,yBAAyB,UAAA,EAAY;AAAA,MACxC,MAAA;AAAA,MACA,eAAA;AAAA,MACA,cAAc,eAAA,CAAgB,YAAA;AAAA,MAC9B;AAAA,KACD,CAAA,EAAG;AACF,MAAA,OAAO,aAAA,CAAc,OAAO,IAAI,CAAA;AAAA,IAClC;AAEA,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,kBAAA,CAAmB,gBAAgB,CAAA;AACjD,MAAA,OAAO,aAAA,CAAc,OAAO,IAAI,CAAA;AAElC,IAAA,IAAI,CAAC,0BAA0B,OAAO,CAAA;AACpC,MAAA,OAAO,aAAA,CAAc,OAAO,IAAI,CAAA;AAElC,IAAA,OAAO,eAAA,CAAgB,eAAe,OAAO,CAAA;AAAA,EAC/C,CAAA;AAEA,EAAA,UAAA,CAAW,KAAA,GAAQ,YAAA;AACnB,EAAA,MAAA,CAAO,KAAA,GAAQ,YAAA;AACf,EAAA,UAAA,CAAW,+BAAA,GAAkC,IAAA;AAC/C;AA2BO,SAAS,uBAAA,CACd,QACA,IAAA,EACM;AACN,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,MAAA,CAAO,SAAA,KAAc,KAAA;AACxD,IAAA;AAIF,EAAA,KAAK,IAAA,CAAK,OAAO,IAAA,EAAK;AAEtB,EAAA,4BAAA,CAA6B;AAAA,IAC3B,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,cAAA,EAAgB,OAAO,SAAA,CAAU,eAAA;AAAA,IACjC,YAAA,EAAc,CAAC,GAAG,MAAA,CAAO,UAAU,YAAY;AAAA,GAChD,CAAA;AACH;AA6BO,SAAS,eAAA,CAAgB,MAAA,GAA0B,EAAC,EAAc;AACvE,EAAA,MAAM;AAAA,IACJ,SAAA,EAAW,eAAA;AAAA,IACX,cAAA,GAAiB,UAAA;AAAA,IACjB,cAAA,GAAiB,cAAA;AAAA,IACjB,IAAA,EAAM;AAAA,GACR,GAAI,MAAA;AAIJ,EAAA,MAAM,YAAsC,UAAA,GACvC,UAAA,KAAe,IAAA,GAAO,2BAAA,KAAgC,UAAA,GACvD,IAAA;AAGJ,EAAA,MAAM,kBAAkB,gBAAA,EAAiB;AACzC,EAAA,MAAM,iBAAA,GAAoB,0BAAA,CAA2B,eAAA,EAAiB,QAAQ,CAAA;AAC9E,EAAA,MAAM,uBAAA,GAA0B,iBAAiB,cAAA,IAAkB,wBAAA;AACnE,EAAA,MAAM,wBAAA,GAA2B,eAAA,GAC7B,oBAAA,CAAqB,uBAAA,EAAyB,eAAe,CAAA,GAC7D,mCAAA;AACJ,EAAA,MAAM,eAAA,GAA0C,eAAA,GAC5C,eAAA,CAAgB,MAAA,CAAO,UAAU,YAAA,CAAa;AAAA,IAC5C,cAAA,EAAgB,uBAAA;AAAA,IAChB,KAAA;AAAA,IACA,mBAAmB,eAAA,CAAgB;AAAA,GACpC,CAAA,GACD,IAAA;AAKJ,EAAA,eAAe,YAAA,CAAa,KAAA,EAA0B,IAAA,GAAoB,EAAC,EAAsB;AAC/F,IAAA,MAAM,OAAA,GAAU,KAAA,YAAiB,OAAA,GAAU,KAAA,GAAQ,MAAA;AACnD,IAAA,MAAM,UAAU,IAAA,CAAK,MAAA,IAAU,OAAA,EAAS,MAAA,IAAU,OAAO,WAAA,EAAY;AACrE,IAAA,MAAM,aAAA,GAAgB,CAAC,CAAC,KAAA,EAAO,QAAQ,SAAS,CAAA,CAAE,SAAS,MAAM,CAAA;AACjE,IAAA,MAAM,UAAU,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,SAAS,OAAO,CAAA;AAC5D,IAAA,OAAA,CAAQ,GAAA,CAAI,gBAAA,EAAkB,MAAA,CAAO,YAAA,IAAgB,KAAK,CAAA;AAC1D,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AAC7C,IAAA,MAAM,OAAA,GAAU,cAAc,kBAAA,CAAmB,IAAA,CAAK,UAAU,CAAA,GAAI,UAAA,GAAa,IAAA,CAAK,EAAA,CAAG,IAAA,EAAK;AAC9F,IAAA,OAAA,CAAQ,GAAA,CAAI,gBAAgB,OAAO,CAAA;AAEnC,IAAA,MAAM,kBAAkB,OAAA,IAAW,IAAA,CAAK,IAAA,KAAS,MAAA,GAC7C,0BAA0B,EAAE,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,QAAQ,IAAA,EAAM,CAAA,GACjE,qBAAA,CAAsB,KAAK,IAAI,CAAA;AAGnC,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,MAAM,KAAA,GAAQ,UAAU,GAAA,EAAI;AAC5B,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,KAAK,CAAA,CAAE,CAAA;AAAA,MAChD;AAAA,IACF;AAGA,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,MAAM,SAAA,GAAY,UAAU,cAAc,CAAA;AAC1C,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,OAAA,CAAQ,GAAA,CAAI,gBAAgB,SAAS,CAAA;AAAA,MACvC;AAAA,IACF;AAGA,IAAA,IACE,eAAA,IACG,eAAA,IACA,wBAAA,CAAyB,OAAA,EAAS,GAAA,KAAQ,iBAAiB,GAAA,GAAM,KAAA,GAAQ,MAAA,CAAO,KAAK,CAAA,CAAA,EAAI;AAAA,MAC1F,MAAA,EAAQ,eAAA;AAAA,MACR,eAAA,EAAiB,wBAAA;AAAA,MACjB,cAAc,eAAA,EAAiB,YAAA;AAAA,MAC/B,QAAA,EAAU;AAAA,KACX,CAAA,EACD;AACA,MAAA,OAAO,IAAA,CAAK,MAAM,eAAA,CAAgB,cAAA,CAAe,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,CAAC,CAAA;AAAA,IAC/E;AAGA,IAAA,OAAO,IAAA,CAAK,MAAM,KAAA,CAAM,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,CAAC,CAAA;AAEpD,IAAA,eAAe,KAAK,SAAA,EAAuD;AACzE,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,MAAM,SAAA,EAAU;AACjC,QAAA,IAAI,CAAC,QAAA,CAAS,EAAA;AACZ,UAAA,IAAA,CAAK,MAAA,CAAO,MAAM,qBAAA,EAAuB,EAAE,SAAS,QAAA,CAAS,OAAA,CAAQ,IAAI,YAAY,CAAA,IAAK,SAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,OAAA,EAAS,QAAQ,MAAA,EAAQ,QAAA,CAAS,QAAQ,CAAA;AAC9K,QAAA,OAAO,QAAA;AAAA,MACT,SACO,KAAA,EAAO;AACZ,QAAA,IAAA,CAAK,OAAO,KAAA,CAAM,uBAAA,EAAyB,EAAE,OAAA,EAAS,MAAA,EAAQ,OAAO,CAAA;AACrE,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,QAAA,CAAS,KAAA,EAAO,IAAA,GAAO,IAAI,OAAA,EAAS;AACxC,MAAA,MAAM,OAAA,GAAU,MAAA,CAAO,cAAA,IAAkB,OAAA,EAAS,cAAA,KAAmB,KAAA;AACrE,MAAA,MAAM,WAAW,OAAA,IAAW,OAAA,EAAS,cAAc,IAAI,OAAA,CAAQ,iBAAiB,OAAA,GAAU,KAAA,GAAQ,IAAI,GAAA,CAAI,OAAO,KAAK,CAAA,EAAG,kBAAkB,CAAA,EAAG,IAAI,CAAA,GAAI,MAAA;AACtJ,MAAA,MAAM,KAAA,GAAQ,UAAU,KAAA,EAAM;AAC9B,MAAA,MAAM,QAAA,GAAW,MAAM,YAAA,CAAa,QAAA,IAAY,OAAO,QAAA,GAAW,KAAK,IAAI,CAAA;AAC3E,MAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,MAAA,CAAO,OAAA,IAAW,IAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,MAAA,KAAW,gBAAA,EAAiB;AACnF,QAAA,OAAO,QAAA;AACT,MAAA,IAAI,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,CAAC,OAAA,EAAS,WAAA;AACvC,QAAA,OAAO,QAAA;AACT,MAAA,IAAI,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,CAAC,QAAA,CAAS,QAAQ,GAAA,CAAI,cAAc,CAAA,EAAG,QAAA,CAAS,kBAAkB,CAAA;AAC/F,QAAA,OAAO,QAAA;AACT,MAAA,MAAM,OAAA,GAAmB,MAAM,QAAA,CAAS,KAAA,GAAQ,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM,MAAS,CAAA;AAC5E,MAAA,MAAM,IAAA,GAAO,WAAW,OAAO,OAAA,KAAY,YAAY,SAAA,IAAa,OAAA,IAAW,OAAA,CAAQ,OAAA,KAAY,KAAA,IAAS,OAAA,IAAW,WAAW,OAAA,CAAQ,KAAA,IAAS,OAAO,OAAA,CAAQ,KAAA,KAAU,QAAA,IAAY,UAAU,OAAA,CAAQ,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,IAAA,GAAO,MAAA;AACvO,MAAA,MAAM,aAAA,GAAgB,IAAA,KAAS,aAAA,IAAiB,OAAA,EAAS,WAAA;AACzD,MAAA,IAAI,CAAC,aAAA,KAAkB,CAAC,WAAW,QAAA,CAAS,MAAA,KAAW,OAAQ,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,CAAK,WAAW,UAAU,CAAA,IAAK,CAAC,yBAAA,CAA0B,SAAA,CAAU,IAAI,CAAA,CAAE,OAAA,CAAA;AACnK,QAAA,OAAO,QAAA;AACT,MAAA,IAAI,CAAC,aAAA,IAAiB,CAAC,MAAM,OAAO,cAAA,EAAgB;AAClD,QAAA,OAAO,QAAA;AAET,MAAA,IAAI,MAAM,OAAA,CAAQ,GAAA,CAAI,wBAAwB,CAAA,IAAK,SAAS,WAAA,EAAa;AACvE,QAAA,IAAI,CAAC,OAAA,EAAS,WAAA;AACZ,UAAA,OAAO,QAAA;AACT,QAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,WAAA,EAAY;AACzC,QAAA,IAAI,MAAA,KAAW,IAAA,IAAQ,KAAA,CAAM,MAAA,CAAO,OAAA;AAClC,UAAA,OAAO,QAAA;AACT,QAAA,KAAA,CAAM,OAAA,CAAQ,OAAO,wBAAwB,CAAA;AAC7C,QAAA,IAAI,MAAA;AACF,UAAA,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,wBAAA,EAA0B,MAAM,CAAA;AAAA,MACtD;AAEA,MAAA,OAAO,aAAa,KAAK,CAAA;AAAA,IAC3B,CAAA;AAAA,IACA,IAAI,KAAA,GAAQ;AAAE,MAAA,OAAO,CAAC,eAAA,IAAmB,eAAA,CAAgB,KAAA,EAAM;AAAA,IAAE,CAAA;AAAA,IACjE,MAAM,IAAA,GAAO;AACX,MAAA,IAAI,CAAC,eAAA;AACH,QAAA;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,eAAA,CAAgB,IAAA,EAAK;AAC1C,MAAA,IAAI,CAAC,MAAA,CAAO,OAAA;AACV,QAAA,MAAM,IAAI,KAAA,CAAM,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA;AAAA,IACxC,CAAA;AAAA,IACA,OAAA,GAAU;AACR,MAAA,eAAA,EAAiB,OAAA,EAAQ;AAAA,IAC3B;AAAA,GACF;AACF;ACrbO,SAAS,oBAAA,CAAqB,OAAA,GAAmE,EAAC,EAAG;AAC1G,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,IAAY,eAAA,EAAgB,CAAE,QAAA;AACvD,EAAA,MAAM,IAAA,GAAO,QAAQ,QAAA,IAAY,WAAA;AACjC,EAAA,eAAe,IAAA,CAAK,IAAA,EAAc,KAAA,EAAe,IAAA,GAAuC,EAAC,EAAgC;AACvH,IAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB,EAAG,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,EAAE,EAAG,EAAE,cAAA,EAAgB,KAAA,EAAO,CAAA;AAEvL,IAAA,MAAM,MAAA,GAAS,WAAA,CAAY,eAAA,CAAgB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAU,CAAA,CAAE,KAAA,CAAM,MAAM,QAAA,CAAS,MAAM,CAAA;AAC9F,IAAA,OAAO,MAAA,CAAO,OAAA,GAAUA,EAAAA,CAAG,MAAA,CAAO,IAAI,CAAA,GAAI,MAAA;AAAA,EAC5C;AACA,EAAA,OAAO;AAAA,IACL,YAAA,CAAaC,QAAAA,GAAiC,EAAC,EAAG;AAChD,MAAA,IAAI,CAACA,QAAAA,CAAQ,OAAA,IAAW,OAAO,MAAA,KAAW,WAAA;AACxC,QAAA,OAAO,MAAM;AAAA,QAAC,CAAA;AAChB,MAAA,MAAM,MAAA,GAAS,MAAA;AACf,MAAA,IAAI,IAAA,GAAO,KAAA;AACX,MAAA,MAAM,UAAA,GAAa,CAAC,KAAA,KAA+B;AACjD,QAAA,IAAI,MAAM,SAAA,IAAa,IAAA;AACrB,UAAA;AACF,QAAA,IAAA,GAAO,IAAA;AACP,QAAA,KAAK,IAAA,CAAK,eAAA,EAAiB,EAAC,EAAG,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,KAAW;AACnE,UAAA,IAAI,CAAC,MAAA,CAAO,OAAA;AACV,YAAAC,IAAAA,CAAK,OAAO,IAAA,CAAK,qCAAA,EAAuC,EAAE,SAAA,EAAW,MAAA,CAAO,KAAA,CAAM,IAAA,EAAM,CAAA;AAAA,QAC5F,CAAC,EAAE,KAAA,CAAM,MAAMA,KAAK,MAAA,CAAO,IAAA,CAAK,4CAA4C,CAAC,CAAA;AAAA,MAC/E,CAAA;AACA,MAAA,MAAA,CAAO,gBAAA,CAAiB,YAAY,UAAU,CAAA;AAC9C,MAAA,OAAO,MAAM,MAAA,CAAO,mBAAA,CAAoB,UAAA,EAAY,UAAU,CAAA;AAAA,IAChE,CAAA;AAAA,IACA,MAAM,cAAc,KAAA,EAAoD;AACtE,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,SAAA,EAAW,KAAK,CAAA;AAC1C,MAAA,OAAO,MAAA,CAAO,UAAUF,EAAAA,CAAG,yBAAA,CAA0B,MAAM,MAAA,CAAO,IAAI,CAAC,CAAA,GAAI,MAAA;AAAA,IAC7E,CAAA;AAAA,IACA,MAAM,YAAA,GAA2D;AAC/D,MAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,CAAA,EAAG,IAAI,WAAW,MAAA,EAAW,EAAE,cAAA,EAAgB,KAAA,EAAO,CAAA;AACtF,MAAA,OAAO,WAAA,CAAY,eAAA,CAAgB,qBAAA,CAAsB,QAAA,EAAU,EAAE,KAAA,CAAM,MAAM,QAAA,CAAS,IAAA,EAAM,CAAA;AAAA,IAClG,CAAA;AAAA,IACA,MAAM,KAAA,EAA0F;AAC9F,MAAA,IAAI,MAAM,MAAA,KAAW,MAAA;AACnB,QAAA,OAAO,IAAA,CAAK,YAAA,EAAc,EAAE,QAAA,EAAU,MAAM,UAAA,EAAY,QAAA,EAAU,KAAA,CAAM,QAAA,EAAU,SAAS,KAAA,CAAM,OAAA,EAAS,cAAA,EAAgB,KAAA,CAAM,gBAAgB,CAAA;AAClJ,MAAA,IAAI,KAAA,CAAM,MAAA,KAAW,OAAA,IAAW,KAAA,CAAM,MAAA,KAAW,KAAA;AAC/C,QAAA,OAAO,IAAA,CAAK,WAAA,EAAa,EAAE,UAAA,EAAY,MAAM,UAAA,EAAY,IAAA,EAAM,KAAA,CAAM,IAAA,EAAM,SAAS,KAAA,CAAM,OAAA,EAAS,cAAA,EAAgB,KAAA,CAAM,gBAAgB,CAAA;AAC3I,MAAA,OAAO,IAAA,CAAK,OAAA,EAAS,EAAE,UAAA,EAAY,MAAM,UAAA,EAAY,QAAA,EAAU,KAAA,CAAM,QAAA,EAAU,SAAS,KAAA,CAAM,OAAA,EAAS,cAAA,EAAgB,KAAA,CAAM,gBAAgB,CAAA;AAAA,IAC/I,CAAA;AAAA,IACA,QAAA,EAAU,CAAC,KAAA,KAA4B,IAAA,CAAK,UAAA,EAAY,EAAE,GAAG,KAAA,EAAO,eAAA,EAAiB,KAAA,CAAM,QAAA,EAAU,CAAA;AAAA,IACrG,OAAA,EAAS,CAAC,UAAA,EAAoBC,QAAAA,KAAmC,IAAA,CAAK,YAAY,EAAE,UAAA,EAAY,GAAGA,QAAAA,EAAS,CAAA;AAAA,IAC5G,oBAAA,EAAsB,CAAC,UAAA,EAAoBA,QAAAA,KAAmC,IAAA,CAAK,0BAA0B,EAAE,UAAA,EAAY,GAAGA,QAAAA,EAAS,CAAA;AAAA,IACvI,oBAAA,EAAsB,CAAC,KAAA,EAAe,WAAA,KAAwB,KAAK,wBAAA,EAA0B,EAAE,KAAA,EAAO,WAAA,EAAa,CAAA;AAAA,IACnH,aAAA,EAAe,CAAC,KAAA,KAA2F,IAAA,CAAK,kBAAkB,KAAK,CAAA;AAAA,IACvI,MAAM,cAAA,CAAe,QAAA,EAAkB,SAAA,EAAmB;AACxD,MAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,CAAA,EAAG,IAAI,CAAA,eAAA,CAAA,EAAmB,EAAE,MAAA,EAAQ,MAAA,EAAQ,OAAA,EAAS,EAAE,gBAAgB,kBAAA,EAAmB,EAAG,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,SAAA,EAAW,CAAA,EAAG,CAAA;AAC5K,MAAA,OAAO,WAAA,CAAY,gBAAgB,8BAA8B,CAAA,CAAE,MAAM,MAAM,QAAA,CAAS,MAAM,CAAA;AAAA,IAChG;AAAA,GACF;AACF","file":"chunk-YKJRQCWR.js","sourcesContent":["/**\n * @h-ai/kit — Bearer 认证工具\n *\n * 提供服务端认证 Cookie 管理（login / logout）与浏览器端 Token 存储工具。\n * @module kit-auth\n */\n\nimport type { HaiResult } from '@h-ai/core'\nimport type { ApiKeyCredentials, AuthRequestContext, AuthResult, LdapCredentials, OtpCredentials, PasswordCredentials, RegisterOptions } from '@h-ai/iam'\nimport type { AuthOperations, AuthOperationsProvider } from './kit-types.js'\nimport { err, ok } from '@h-ai/core'\nimport { kitM } from './kit-i18n.js'\n\n/** 默认 Token Cookie 名 */\nconst DEFAULT_TOKEN_COOKIE_NAME = 'hai_access_token'\n\n/**\n * 应用级认证配置（由 createHandle 一次性初始化，生命周期同进程）\n *\n * 此状态非请求级：仅在 createHandle() 时写入一次，后续所有请求只读访问。\n */\nconst authState = {\n  cookieName: DEFAULT_TOKEN_COOKIE_NAME,\n  operations: null as AuthOperationsProvider | null,\n}\n\n/**\n * 配置认证参数\n *\n * 通常由 `createHandle` 在初始化时自动调用，无需手动调用。\n * @param config - 启动阶段注入的 Cookie 名和认证操作提供器。\n * @param config.cookieName - 认证 Cookie 名。\n * @param config.operations - 已初始化服务的认证操作或惰性提供器。\n * @example 模块内部上下文\n * ```ts\n * function configure(operations: AuthOperationsProvider) {\n *   configureAuth({ cookieName: 'hai_access_token', operations })\n * }\n * ```\n */\nexport function configureAuth(config: { cookieName?: string, operations?: AuthOperationsProvider }): void {\n  if (config.cookieName)\n    authState.cookieName = config.cookieName\n  if (config.operations)\n    authState.operations = config.operations\n}\n\n/**\n * 服务端认证只读 Cookie 依赖；由当前请求提供，不能跨请求缓存。\n * @example 模块内部上下文\n * ```ts\n * const cookies: CookieReader = { get: name => name === 'hai_access_token' ? 'example-only-token' : undefined }\n * const token = getAccessToken(new Request('https://app.example.com/api'), cookies)\n * void token\n * ```\n */\ninterface CookieReader {\n  get: (name: string) => string | undefined\n}\n\n/**\n * 服务端认证写入/删除 Cookie 依赖；由当前请求提供并执行安全属性。\n * @example 模块内部上下文\n * ```ts\n * function signIn(cookies: CookieWriter, credentials: PasswordCredentials) {\n *   return login(cookies, credentials) // 业务调用者检查 success 后消费身份。\n * }\n * ```\n */\ninterface CookieWriter {\n  set: (name: string, value: string, options: {\n    path: string\n    httpOnly: boolean\n    sameSite: 'lax' | 'strict' | 'none'\n    secure: boolean\n    maxAge?: number\n  }) => void\n  delete: (name: string, options: { path: string }) => void\n}\n\n/**\n * 浏览器 Token 存储器；使用页面内存或平台安全存储，禁止写入 Web Storage。\n * @example 模块内部上下文\n * ```ts\n * const store: BrowserTokenStore = getDefaultBrowserTokenStore()\n * store.clear() // 当前页面内存状态；不持有服务端会话真值。\n * ```\n */\nexport interface BrowserTokenStore {\n  get: () => string | null\n  set: (token: string) => void\n  clear: () => void\n}\n\nfunction createMemoryTokenStore(): BrowserTokenStore {\n  let token: string | null = null\n  return {\n    get: () => token,\n    set: (value: string) => { token = value },\n    clear: () => { token = null },\n  }\n}\n\n// 默认浏览器 Token 只保存在当前页面内存中，避免 auth: true 隐式落到 localStorage。\nconst defaultBrowserTokenStore = createMemoryTokenStore()\n\n/**\n * 获取默认浏览器 Token 存储（页面内存，不持久化）。\n * @returns 当前页面的内存令牌存储器；不持有服务端共享状态。\n * @example 模块内部上下文\n * ```ts\n * const store = getDefaultBrowserTokenStore()\n * store.set('example-only-token')\n * store.clear()\n * ```\n */\nexport function getDefaultBrowserTokenStore(): BrowserTokenStore {\n  return defaultBrowserTokenStore\n}\n\n// ─── 内部工具（仅 kit 包内使用） ───\n\n/**\n * 从请求 Authorization 头提取 Bearer Token。\n */\nfunction getBearerTokenFromRequest(request: Request): string | null {\n  const authorization = request.headers.get('authorization')\n  if (!authorization)\n    return null\n\n  const [scheme, token] = authorization.split(' ')\n  if (!scheme || !token)\n    return null\n\n  if (scheme.toLowerCase() !== 'bearer')\n    return null\n\n  const trimmed = token.trim()\n  return trimmed.length > 0 ? trimmed : null\n}\n\n/**\n * 从请求中统一提取 Access Token（Bearer 优先，其次配置的 Cookie 名）。\n * @param request - 当前 HTTP 请求，优先读取 Authorization Bearer。\n * @param cookies - 当前请求的 Cookie 读取器；未提供时仅检查请求头。\n * @returns 解析到的令牌；均无值时为 null。\n * @example 模块内部上下文\n * ```ts\n * const request = new Request('https://app.example.com/api', { headers: { Authorization: 'Bearer example-only-token' } })\n * const token = getAccessToken(request)\n * void token\n * ```\n */\nexport function getAccessToken(request: Request, cookies?: CookieReader): string | null {\n  return getBearerTokenFromRequest(request) ?? cookies?.get(authState.cookieName) ?? null\n}\n\n// ─── 服务端认证 Cookie 管理 ───\n\n/**\n * 写入 Access Token Cookie（内部使用，由 login 自动调用）。\n */\nfunction setToken(cookies: CookieWriter, token: string, maxAge?: number): void {\n  // 共享文件也供浏览器内存 Token 使用，不引入 Node 内建模块；未知宿主保持安全默认值。\n  // eslint-disable-next-line node/prefer-global/process\n  const secure = typeof process === 'undefined' || process.env.NODE_ENV === 'production' || process.env.HAI_CORE_ENV === 'production'\n  cookies.set(authState.cookieName, token, {\n    path: '/',\n    httpOnly: true,\n    sameSite: 'lax',\n    // 测试开关仅放宽共享状态要求，不降低生产凭证 Cookie 的传输安全。\n    secure,\n    maxAge,\n  })\n}\n\n/**\n * 清除 Access Token Cookie（内部使用，由 logout 自动调用）。\n */\nfunction clearToken(cookies: CookieWriter): void {\n  cookies.delete(authState.cookieName, { path: '/' })\n}\n\n// ─── 服务端高级认证 API（通过 kit.auth 暴露） ───\n\n/**\n * 获取已注入的认证操作；未配置时返回 null。\n *\n * 公共 API 不应 throw，因此此处用 null 信号配合上层短路返回 HaiResult。\n */\nfunction getAuthOperations(): AuthOperations | null {\n  if (!authState.operations)\n    return null\n  return typeof authState.operations === 'function'\n    ? authState.operations()\n    : authState.operations\n}\n\n/**\n * 构造 \"auth 未配置\" 的标准 HaiResult 错误。\n *\n * 用于公共认证 API 在 `authState.operations` 未注入时返回，\n * 避免向调用方抛出未捕获异常。\n */\nfunction authNotConfiguredError(): HaiResult<never> {\n  return err({\n    code: 'KIT_AUTH_NOT_CONFIGURED',\n    message: kitM('kit_authNotConfigured'),\n  })\n}\n\n/**\n * 执行已配置的认证登录操作，并在成功时写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param credentials - 认证凭证\n * @param run - 具体 IAM 认证操作\n */\nasync function runAuthLogin<TCredentials>(\n  cookies: CookieWriter,\n  credentials: TCredentials,\n  run: (ops: AuthOperations, credentials: TCredentials) => Promise<HaiResult<AuthResult>>,\n): Promise<HaiResult<AuthResult>> {\n  const ops = getAuthOperations()\n  if (!ops)\n    return authNotConfiguredError()\n\n  const result = await run(ops, credentials)\n  if (result.success) {\n    setToken(cookies, result.data.tokens.accessToken, result.data.tokens.expiresIn)\n  }\n  return result\n}\n\n/**\n * 服务端登录（密码）：内部调用 iam.auth.login，成功时自动写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param credentials - 密码凭证（identifier + password）\n * @param context - 宿主提供的可信登录元数据，不从凭据输入复制 IP。\n * @returns 认证结果（成功时 Cookie 已自动写入）\n * @example 模块内部上下文\n * ```ts\n * async function signIn(cookies: CookieWriter, credentials: PasswordCredentials) {\n *   const result = await login(cookies, credentials)\n *   if (!result.success) return result.error.message\n *   return result.data\n * }\n * ```\n */\nexport async function login(\n  cookies: CookieWriter,\n  credentials: PasswordCredentials,\n  context?: AuthRequestContext,\n): Promise<HaiResult<AuthResult>> {\n  return runAuthLogin(cookies, credentials, (ops, input) => ops.login(input, context))\n}\n\n/**\n * 服务端登录（OTP 验证码）：内部调用 iam.auth.loginWithOtp，成功时自动写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param credentials - OTP 凭证（identifier + code）\n * @param context - 宿主提供的可信登录元数据。\n * @returns 认证结果（成功时 Cookie 已自动写入）\n * @example 模块内部上下文\n * ```ts\n * async function signIn(cookies: CookieWriter, credentials: OtpCredentials) {\n *   const result = await loginWithOtp(cookies, credentials)\n *   if (!result.success) return result.error.message\n *   return result.data\n * }\n * ```\n */\nexport async function loginWithOtp(\n  cookies: CookieWriter,\n  credentials: OtpCredentials,\n  context?: AuthRequestContext,\n): Promise<HaiResult<AuthResult>> {\n  return runAuthLogin(cookies, credentials, (ops, input) => ops.loginWithOtp(input, context))\n}\n\n/**\n * 服务端登录（LDAP）：内部调用 iam.auth.loginWithLdap，成功时自动写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param credentials - LDAP 凭证（username + password）\n * @param context - 宿主提供的可信登录元数据。\n * @returns 认证结果（成功时 Cookie 已自动写入）\n * @example 模块内部上下文\n * ```ts\n * async function signIn(cookies: CookieWriter, credentials: LdapCredentials) {\n *   const result = await loginWithLdap(cookies, credentials)\n *   if (!result.success) return result.error.message\n *   return result.data\n * }\n * ```\n */\nexport async function loginWithLdap(\n  cookies: CookieWriter,\n  credentials: LdapCredentials,\n  context?: AuthRequestContext,\n): Promise<HaiResult<AuthResult>> {\n  return runAuthLogin(cookies, credentials, (ops, input) => ops.loginWithLdap(input, context))\n}\n\n/**\n * 服务端登录（API Key）：内部调用 iam.auth.loginWithApiKey，成功时自动写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param credentials - API Key 凭证（key）\n * @param context - 宿主提供的可信登录元数据。\n * @returns 认证结果（成功时 Cookie 已自动写入）\n * @example 模块内部上下文\n * ```ts\n * async function signIn(cookies: CookieWriter, credentials: ApiKeyCredentials) {\n *   const result = await loginWithApiKey(cookies, credentials)\n *   if (!result.success) return result.error.message\n *   return result.data\n * }\n * ```\n */\nexport async function loginWithApiKey(\n  cookies: CookieWriter,\n  credentials: ApiKeyCredentials,\n  context?: AuthRequestContext,\n): Promise<HaiResult<AuthResult>> {\n  return runAuthLogin(cookies, credentials, (ops, input) => ops.loginWithApiKey(input, context))\n}\n\n/**\n * 服务端注册并登录：内部调用 iam.auth.registerAndLogin，成功时自动写入 Token Cookie。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param options - 注册选项（username、password、email 等）\n * @returns 认证结果（成功时 Cookie 已自动写入）\n * @example 模块内部上下文\n * ```ts\n * async function signIn(cookies: CookieWriter, credentials: RegisterOptions) {\n *   const result = await registerAndLogin(cookies, credentials)\n *   if (!result.success) return result.error.message\n *   return result.data\n * }\n * ```\n */\nexport async function registerAndLogin(\n  cookies: CookieWriter,\n  options: RegisterOptions,\n  context?: AuthRequestContext,\n): Promise<HaiResult<AuthResult>> {\n  return runAuthLogin(cookies, options, (ops, input) => ops.registerAndLogin(input, context))\n}\n\n/**\n * 服务端登出：委托 iam.auth.logout 原子撤销凭据，并始终清除当前请求的 Token Cookie。\n * Cookie 清理只代表本地退出；服务端撤销失败仍返回失败，不能由调用端改成成功响应。\n *\n * @param cookies - SvelteKit cookies 对象\n * @param accessToken - 访问令牌（为 null/undefined 时仅清除 Cookie）\n * @returns 服务端撤销结果；无令牌时仅清理 Cookie 并成功，有令牌但未配置认证操作时失败。\n * @remarks 底层控制流异常仍以 Promise 拒绝传播；Cookie 清理不吞掉业务失败。\n * @example 模块内部上下文\n * ```ts\n * async function signOut(cookies: CookieWriter, accessToken: string) {\n *   const result = await logout(cookies, accessToken)\n *   if (!result.success) return result.error.code\n *   return result.data\n * }\n * ```\n */\nexport async function logout(\n  cookies: CookieWriter,\n  accessToken?: string | null,\n): Promise<HaiResult<void>> {\n  try {\n    if (!accessToken)\n      return ok(undefined)\n    const ops = getAuthOperations()\n    if (!ops)\n      return authNotConfiguredError()\n    return await ops.logout(accessToken)\n  }\n  finally {\n    // 本地凭据无论是否撤销确认都要移除，但失败结果仍交给调用者明确提示。\n    clearToken(cookies)\n  }\n}\n\n// ─── 浏览器端 Token 存储（通过 kit.auth 暴露） ───\n\n/**\n * 写入默认浏览器端 Access Token（仅页面内存，不持久化到 localStorage）。\n * @param token - 当前页面内存中使用的 access token，不写入 Web Storage。\n * @example\n * ```ts\n * import { kit } from '@h-ai/kit'\n *\n * kit.auth.setBrowserToken('example-only-token')\n * // 页面注销时同步清除浏览器内存令牌。\n * kit.auth.clearBrowserToken()\n * ```\n */\nexport function setBrowserToken(token: string): void {\n  defaultBrowserTokenStore.set(token)\n}\n\n/**\n * 清除默认浏览器端 Access Token（仅页面内存）。\n * @example\n * ```ts\n * import { kit } from '@h-ai/kit'\n *\n * kit.auth.clearBrowserToken()\n * ```\n */\nexport function clearBrowserToken(): void {\n  defaultBrowserTokenStore.clear()\n}\n","/**\n * @h-ai/kit — 统一客户端\n *\n * 将 CSRF Token 附加与可选传输加密封装为统一 `apiFetch`。\n * 应用层只需调用一次 `createKitClient()`，后续 API 调用即可复用同一套安全能力。\n * @module kit-client\n */\n\nimport type { CryptoFunctions, TransportClient } from '@h-ai/crypto'\nimport type { BrowserTokenStore } from '../kit-auth.js'\nimport type { KitPublicConfig } from '../kit-types.js'\nimport { IamSessionErrorCodeSchema } from '@h-ai/api-contract'\nimport { core } from '@h-ai/core'\nimport { TRANSPORT_PROTOCOL } from '@h-ai/crypto'\nimport { getDefaultBrowserTokenStore } from '../kit-auth.js'\nimport { DEFAULT_TRANSPORT_KEY_EXCHANGE_PATH, normalizeTransportBasePath, resolveTransportPath, shouldUseTransportForUrl } from '../modules/crypto/kit-transport-paths.js'\n\nconst DEFAULT_KEY_EXCHANGE_URL = `/api${TRANSPORT_PROTOCOL.DEFAULT_KEY_EXCHANGE_PATH}`\n\n// ─── 类型 ───\n\n/**\n * 传输加密客户端配置\n * @example\n * ```ts\n * import type { ClientTransportConfig } from '@h-ai/kit'\n * import { crypto } from '@h-ai/crypto'\n *\n * function configAfterInit(): ClientTransportConfig { return { crypto, excludePaths: ['/api/health'] } }\n * ```\n */\nexport interface ClientTransportConfig {\n  /** 宿主构建挂载目录，默认空字符串；SvelteKit 使用 $app/paths.base。 */\n  basePath?: string\n  /** 可选本地明文上限；缺省跟随服务端握手。 */\n  maxPlaintextBytes?: number\n  /** @h-ai/crypto 服务实例 */\n  crypto: CryptoFunctions\n  /** 密钥交换端点 URL（默认 `'/api/_hai/key-exchange'`） */\n  keyExchangeUrl?: string\n  /** 排除路径（命中后强制走明文），需与服务端 transport.excludePaths 保持一致 */\n  excludePaths?: readonly string[]\n}\n\n/**\n * Kit 客户端配置\n * @example\n * ```ts\n * import type { KitClientConfig } from '@h-ai/kit'\n *\n * const value: KitClientConfig = { auth: true }\n * void value\n * ```\n */\nexport interface KitClientConfig {\n  /** 标准鉴别明确失效时原地登录原用户；成功才对被拒绝的请求重试一次。 */\n  recoverSession?: () => Promise<boolean>\n  /** 会话终端分组，默认web；服务端按终端与全局配额共同限制。 */\n  terminalType?: 'web' | 'app' | 'desktop' | 'api'\n  /**\n   * 传输加密配置。\n   * - 不提供 / undefined：不启用传输加密，仅 CSRF\n   * - 提供对象：启用传输加密\n   */\n  transport?: ClientTransportConfig\n  /** CSRF Cookie 名称（默认 `'hai_csrf'`） */\n  csrfCookieName?: string\n  /** CSRF Header 名称（默认 `'X-CSRF-Token'`） */\n  csrfHeaderName?: string\n  /**\n   * 认证配置：自动从浏览器存储读取 Access Token 并注入请求头。\n   * - `true`：使用默认页面内存存储（由 `kit.auth.setBrowserToken()` 写入，不读写 localStorage）\n   * - `BrowserTokenStore`：使用自定义存储\n   * - 不提供 / `false`：不自动注入\n   */\n  auth?: boolean | BrowserTokenStore\n}\n\n/**\n * Kit 客户端实例\n * @example\n * ```ts\n * import type { KitClient } from '@h-ai/kit'\n *\n * async function read(client: KitClient) {\n *   const response = await client.apiFetch('/api/health')\n *   if (!response.ok) throw new Error('Request failed')\n *   return response.json()\n * }\n * ```\n */\nexport interface KitClient {\n  /** 统一 API fetch（写请求自动附加 CSRF，启用 transport 时自动加解密） */\n  apiFetch: (input: RequestInfo | URL, init?: RequestInit, options?: { recoverSession?: boolean, reauthorize?: () => Promise<string | null | undefined> }) => Promise<Response>\n  /** 传输加密是否就绪（未启用传输加密时始终为 true） */\n  readonly ready: boolean\n  /**\n   * 手动触发密钥交换（transport 启用时）。\n   *\n   * 注意：本方法是 Client 形态的合规例外，密钥协商失败时 `throw`（与 `@h-ai/api-client` 一致），\n   * 调用方需自行 `try/catch`，不返回 `HaiResult`。\n   */\n  init: () => Promise<void>\n  /** 销毁密钥状态 */\n  destroy: () => void\n}\n\n// ─── 工具函数 ───\n\n/**\n * 从 document.cookie 中读取指定名称的 Cookie 值\n *\n * @param name - Cookie 名称\n * @returns Cookie 值；不存在或运行在服务端时返回 undefined\n */\nfunction getCookie(name: string): string | undefined {\n  if (typeof document === 'undefined')\n    return undefined\n  const match = document.cookie.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`))\n  return match?.[1]\n}\n\n/**\n * 判断当前请求体是否可以作为文本载荷进行传输加密。\n *\n * 传输加密中间件会把解密后的明文重新注入 `Request`，当前仅能可靠保留\n * JSON 字符串请求体。`FormData` / `Blob` / `ArrayBuffer` 等二进制或浏览器\n * 自动生成边界的请求体必须保持原样发送，否则文件上传会被序列化成 `{}`。\n *\n * @param body fetch 请求体\n * @returns 是否支持客户端传输加密\n */\nfunction canEncryptRequestBody(body: BodyInit | null | undefined): boolean {\n  return body === undefined || body === null || typeof body === 'string'\n}\n\n/**\n * 判断某个 `Request` 的有效方法、请求头与原始正文是否可走传输加密。\n *\n * `Request.body` 已转换为流，必须结合 Content-Type 识别可重注入的 JSON，\n * 避免把 multipart 等二进制正文当文本加密。纯 BodyInit 则仍按原始类型判定。\n */\nfunction canUseTransportForRequest(request: Pick<Request, 'method' | 'headers' | 'body'>): boolean {\n  const method = request.method.toUpperCase()\n  if (method === 'GET' || method === 'HEAD') {\n    return true\n  }\n\n  const headers = new Headers(request.headers)\n  const contentType = headers.get('Content-Type') ?? ''\n  if (contentType.includes('application/json')) {\n    return true\n  }\n\n  return request.body === null\n}\n\nfunction getCurrentOrigin(): string {\n  if (typeof window !== 'undefined' && window.location?.origin) {\n    return window.location.origin\n  }\n\n  return 'http://localhost'\n}\n\nfunction toRequest(input: RequestInfo | URL, init?: RequestInit): Request {\n  if (input instanceof Request)\n    return init ? new Request(input, init) : input\n\n  return new Request(input, init)\n}\n\n/**\n * 浏览器全局 fetch 包装的幂等安装状态；属于当前浏览器页面。\n * @example 模块内部上下文\n * ```ts\n * const state: BrowserTransportFetchState = globalThis\n * const installed = state.__haiKitTransportFetchInstalled ?? false\n * void installed\n * ```\n */\ntype BrowserTransportFetchState = typeof globalThis & {\n  __haiKitOriginalFetch?: typeof fetch\n  __haiKitTransportFetchInstalled?: boolean\n}\n\n/**\n * 在浏览器启动时安装同源 transport fetch 包装。\n *\n * 该包装作用于同源 `/api/*` 与 SvelteKit `__data.json` 请求，页面文档、\n * 静态资源以及 multipart/form-data 等上传请求保持原样。应用只需安装一次，\n * 后续 `fetch` / SvelteKit 内部 data fetch / `kit.client.create()` 明文发送路径\n * 都会共用这层传输加密能力。\n * @param transportConfig - 已初始化 crypto、同源密钥交换路径及排除路径；省略时不安装包装。\n * @example\n * ```ts\n * import { kit } from '@h-ai/kit'\n *\n * // 不传配置时不安装全局包装；启用时应传已初始化 crypto 与同源端点。\n * kit.client.installBrowserTransportFetch()\n * ```\n */\nexport function installBrowserTransportFetch(transportConfig?: ClientTransportConfig): void {\n  if (typeof window === 'undefined' || !transportConfig)\n    return\n\n  const fetchState = globalThis as BrowserTransportFetchState\n  if (fetchState.__haiKitTransportFetchInstalled)\n    return\n\n  const originalFetch = fetchState.__haiKitOriginalFetch ?? globalThis.fetch.bind(globalThis)\n  fetchState.__haiKitOriginalFetch = originalFetch\n\n  const origin = getCurrentOrigin()\n  const basePath = normalizeTransportBasePath(transportConfig.basePath)\n  const keyExchangeUrl = new URL(transportConfig.keyExchangeUrl ?? DEFAULT_KEY_EXCHANGE_URL, origin).toString()\n  const keyExchangePath = resolveTransportPath(keyExchangeUrl, origin)\n  const transportClient = transportConfig.crypto.transport.createClient({\n    keyExchangeUrl,\n    fetch: originalFetch,\n    maxPlaintextBytes: transportConfig.maxPlaintextBytes,\n  })\n\n  const wrappedFetch: typeof fetch = async (input, init) => {\n    const request = toRequest(input, init)\n    const requestUrl = new URL(request.url, origin)\n    const headers = new Headers(request.headers)\n\n    if (!shouldUseTransportForUrl(requestUrl, {\n      origin,\n      keyExchangePath,\n      excludePaths: transportConfig.excludePaths,\n      basePath,\n    })) {\n      return originalFetch(input, init)\n    }\n\n    if (headers.has(TRANSPORT_PROTOCOL.CLIENT_ID_HEADER))\n      return originalFetch(input, init)\n\n    if (!canUseTransportForRequest(request))\n      return originalFetch(input, init)\n\n    return transportClient.encryptedFetch(request)\n  }\n\n  globalThis.fetch = wrappedFetch\n  window.fetch = wrappedFetch\n  fetchState.__haiKitTransportFetchInstalled = true\n}\n\n/**\n * 用 `config/_kit.yml` 解析后的 {@link KitPublicConfig} 公共投影 一次性安装浏览器端传输加密。\n *\n * 行为：\n * - `config.transport === false` 时直接返回（不启用传输加密）；\n * - 否则启动 {@link installBrowserTransportFetch}，并预热 {@link CryptoFunctions} 模块。\n *\n * 应用层（SvelteKit `+layout.svelte` 或浏览器入口）只需调用此函数一次，\n * 之后宿主 basePath 下的同源 `/api/*` 与 `__data.json` 请求都会自动走传输加密。\n *\n * @param config 已解析的 kit 公共传输配置\n * @param deps  外部依赖\n * @param deps.crypto `@h-ai/crypto` 模块实例\n * @param deps.basePath 宿主构建挂载目录，默认空字符串；SvelteKit 使用 $app/paths.base。\n * @example\n * ```ts\n * import { kit } from '@h-ai/kit'\n *\n * import { crypto } from '@h-ai/crypto'\n *\n * function installAfterCryptoInit() {\n *   kit.client.installBrowserTransport({ transport: { keyExchangePath: '/api/_hai/key-exchange', excludePaths: ['/api/health'] } }, { crypto })\n * }\n * ```\n */\nexport function installBrowserTransport(\n  config: KitPublicConfig,\n  deps: { crypto: CryptoFunctions, basePath?: string },\n): void {\n  if (typeof window === 'undefined' || config.transport === false)\n    return\n\n  // crypto.init() 当前为同步副作用（signature 是 async 仅为接口一致性），\n  // 此处不 await，以便 `+layout.svelte` 顶层模块加载阶段就完成初始化。\n  void deps.crypto.init()\n\n  installBrowserTransportFetch({\n    crypto: deps.crypto,\n    basePath: deps.basePath,\n    keyExchangeUrl: config.transport.keyExchangePath,\n    excludePaths: [...config.transport.excludePaths],\n  })\n}\n\n// ─── 主函数 ───\n\n/**\n * 创建 Kit 客户端\n *\n * 返回统一的 `apiFetch`，内部自动完成：\n * 1. CSRF Token 附加（写方法自动读取 Cookie + 设置 Header）\n * 2. 密钥交换（首次写请求时 lazy init，transport 启用时）\n * 3. 请求体加密（transport 启用时）\n * 4. 响应体解密（transport 启用时）\n *\n * @param config - 客户端配置\n * @returns KitClient 实例\n * @example\n * ```ts\n * import { kit } from '@h-ai/kit'\n *\n * const client = kit.client.create({ auth: true })\n * try {\n *   await client.init() // Client API 使用 Promise 拒绝；不是 HaiResult。\n *   const response = await client.apiFetch('/api/health')\n *   if (!response.ok) throw new Error('Request failed')\n * } finally {\n *   client.destroy()\n * }\n * ```\n */\nexport function createKitClient(config: KitClientConfig = {}): KitClient {\n  const {\n    transport: transportConfig,\n    csrfCookieName = 'hai_csrf',\n    csrfHeaderName = 'X-CSRF-Token',\n    auth: authConfig,\n  } = config\n\n  // ── Auth token store ──\n  // 安全默认：auth:true 只读取页面内存 token，避免隐式 localStorage 持久化敏感凭证。\n  const authStore: BrowserTokenStore | null = authConfig\n    ? (authConfig === true ? getDefaultBrowserTokenStore() : authConfig)\n    : null\n\n  // ── 传输加密状态 ──\n  const transportOrigin = getCurrentOrigin()\n  const transportBasePath = normalizeTransportBasePath(transportConfig?.basePath)\n  const transportKeyExchangeUrl = transportConfig?.keyExchangeUrl ?? DEFAULT_KEY_EXCHANGE_URL\n  const transportKeyExchangePath = transportConfig\n    ? resolveTransportPath(transportKeyExchangeUrl, transportOrigin)\n    : DEFAULT_TRANSPORT_KEY_EXCHANGE_PATH\n  const transportClient: TransportClient | null = transportConfig\n    ? transportConfig.crypto.transport.createClient({\n        keyExchangeUrl: transportKeyExchangeUrl,\n        fetch,\n        maxPlaintextBytes: transportConfig.maxPlaintextBytes,\n      })\n    : null\n\n  /**\n   * 统一 API fetch\n   */\n  async function performFetch(input: RequestInfo | URL, init: RequestInit = {}): Promise<Response> {\n    const request = input instanceof Request ? input : undefined\n    const method = (init.method ?? request?.method ?? 'GET').toUpperCase()\n    const isWriteMethod = !['GET', 'HEAD', 'OPTIONS'].includes(method)\n    const headers = new Headers(init.headers ?? request?.headers)\n    headers.set('x-hai-terminal', config.terminalType ?? 'web')\n    const suppliedId = headers.get('x-request-id')\n    const traceId = suppliedId && /^[\\w.:-]{1,128}$/.test(suppliedId) ? suppliedId : core.id.uuid()\n    headers.set('x-request-id', traceId)\n    // 仅检查元数据，不构建/读取 Request，确保透传上传的流与浏览器边界保持可用。\n    const canUseTransport = request && init.body === undefined\n      ? canUseTransportForRequest({ method, headers, body: request.body })\n      : canEncryptRequestBody(init.body)\n\n    // ── Auth ──\n    if (authStore) {\n      const token = authStore.get()\n      if (token) {\n        headers.set('Authorization', `Bearer ${token}`)\n      }\n    }\n\n    // ── CSRF ──\n    if (isWriteMethod) {\n      const csrfToken = getCookie(csrfCookieName)\n      if (csrfToken) {\n        headers.set(csrfHeaderName, csrfToken)\n      }\n    }\n\n    // ── 传输加密 ──\n    if (\n      transportClient\n      && canUseTransport\n      && shouldUseTransportForUrl(request?.url ?? (input instanceof URL ? input : String(input)), {\n        origin: transportOrigin,\n        keyExchangePath: transportKeyExchangePath,\n        excludePaths: transportConfig?.excludePaths,\n        basePath: transportBasePath,\n      })\n    ) {\n      return send(() => transportClient.encryptedFetch(input, { ...init, headers }))\n    }\n\n    // ── 发送（FormData/Blob/Stream 等保持原样，不破坏浏览器边界） ──\n    return send(() => fetch(input, { ...init, headers }))\n\n    async function send(operation: () => Promise<Response>): Promise<Response> {\n      try {\n        const response = await operation()\n        if (!response.ok)\n          core.logger.error('HTTP request failed', { traceId: response.headers.get('x-trace-id') ?? response.headers.get('x-request-id') ?? traceId, method, status: response.status })\n        return response\n      }\n      catch (error) {\n        core.logger.error('HTTP transport failed', { traceId, method, error })\n        throw error\n      }\n    }\n  }\n\n  return {\n    async apiFetch(input, init = {}, options) {\n      const enabled = config.recoverSession && options?.recoverSession !== false\n      const original = enabled || options?.reauthorize ? new Request(input instanceof Request ? input : new URL(String(input), getCurrentOrigin()), init) : undefined\n      const retry = original?.clone()\n      const response = await performFetch(original ?? input, original ? {} : init)\n      if (!retry || retry.signal.aborted || new URL(retry.url).origin !== getCurrentOrigin())\n        return response\n      if (response.status !== 401 && !options?.reauthorize)\n        return response\n      if (response.status !== 401 && !response.headers.get('content-type')?.includes('application/json'))\n        return response\n      const failure: unknown = await response.clone().json().catch(() => undefined)\n      const code = failure && typeof failure === 'object' && 'success' in failure && failure.success === false && 'error' in failure && failure.error && typeof failure.error === 'object' && 'code' in failure.error ? failure.error.code : undefined\n      const proofRejected = code === 'hai:iam:027' && options?.reauthorize\n      if (!proofRejected && (!enabled || response.status !== 401 || (typeof code === 'string' && code.startsWith('hai:iam:') && !IamSessionErrorCodeSchema.safeParse(code).success)))\n        return response\n      if (!proofRejected && !await config.recoverSession!())\n        return response\n      // 新会话不能复用旧用途证明；只在明确拒绝且宿主重新确认后重试一次。\n      if (retry.headers.has('x-hai-reauthentication') || options?.reauthorize) {\n        if (!options?.reauthorize)\n          return response\n        const ticket = await options.reauthorize()\n        if (ticket === null || retry.signal.aborted)\n          return response\n        retry.headers.delete('x-hai-reauthentication')\n        if (ticket)\n          retry.headers.set('x-hai-reauthentication', ticket)\n      }\n      // 认证动作本身必须传 recoverSession:false，避免错误密码再次等待自己。\n      return performFetch(retry)\n    },\n    get ready() { return !transportClient || transportClient.ready() },\n    async init() {\n      if (!transportClient)\n        return\n      const result = await transportClient.init()\n      if (!result.success)\n        throw new Error(result.error.message)\n    },\n    destroy() {\n      transportClient?.destroy()\n    },\n  }\n}\n","/** 与标准 Kit 认证端点配套的表单动作；复用已有 CSRF/transport fetch。 */\nimport type { IamCreateCaptchaInputSchema, IamLoginInput, IamPublicConfig, IamRegisterInput } from '@h-ai/api-contract'\nimport type { HaiResult } from '@h-ai/core'\nimport type { KitClient } from './kit-client.js'\nimport { apiContract, IamCaptchaChallengeSchema, IamPublicConfigSchema, IamReauthenticationProofSchema } from '@h-ai/api-contract'\nimport { core, ok } from '@h-ai/core'\nimport { z } from 'zod'\nimport { createKitClient } from './kit-client.js'\n\n/**\n * 创建标准 Cookie 认证表单动作；复用可选 apiFetch 以保留 CSRF 和传输配置。\n * @param options - 可复用的 apiFetch 和标准认证端点 basePath。\n * @param options.apiFetch - 已装配 CSRF/transport 的 fetch；省略时使用默认 Kit 客户端。\n * @param options.basePath - 同源认证端点前缀，默认 /api/auth。\n * @returns 标准表单动作；业务返回 HaiResult，网络/格式错误会拒绝 Promise。\n * @example\n * ```ts\n * import { kit } from '@h-ai/kit'\n *\n * const actions = kit.client.createAuthActions({ basePath: '/api/auth' })\n * void actions\n * ```\n */\nexport function createKitAuthActions(options: { apiFetch?: KitClient['apiFetch'], basePath?: string } = {}) {\n  const apiFetch = options.apiFetch ?? createKitClient().apiFetch\n  const base = options.basePath ?? '/api/auth'\n  async function post(path: string, input: object, init: Pick<RequestInit, 'keepalive'> = {}): Promise<HaiResult<unknown>> {\n    const response = await apiFetch(`${base}/${path}`, { ...init, method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(input) }, { recoverSession: false })\n    // void 成功响应在 JSON 中省略 data，统一还原为 HaiResult 的 data: undefined。\n    const result = apiContract.haiResultSchema(z.unknown().optional()).parse(await response.json())\n    return result.success ? ok(result.data) : result\n  }\n  return {\n    bindPageExit(options: { enabled?: boolean } = {}) {\n      if (!options.enabled || typeof window === 'undefined')\n        return () => {}\n      const target = window\n      let sent = false\n      const onPageHide = (event: PageTransitionEvent) => {\n        if (event.persisted || sent)\n          return\n        sent = true\n        void post('session/close', {}, { keepalive: true }).then((result) => {\n          if (!result.success)\n            core.logger.warn('Page exit session revocation failed', { errorCode: result.error.code })\n        }).catch(() => core.logger.warn('Page exit session request did not complete'))\n      }\n      target.addEventListener('pagehide', onPageHide)\n      return () => target.removeEventListener('pagehide', onPageHide)\n    },\n    async createCaptcha(input: z.input<typeof IamCreateCaptchaInputSchema>) {\n      const result = await post('captcha', input)\n      return result.success ? ok(IamCaptchaChallengeSchema.parse(result.data)) : result\n    },\n    async publicConfig(): Promise<HaiResult<IamPublicConfig | null>> {\n      const response = await apiFetch(`${base}/config`, undefined, { recoverSession: false })\n      return apiContract.haiResultSchema(IamPublicConfigSchema.nullable()).parse(await response.json())\n    },\n    login(input: IamLoginInput & { method?: 'password' | 'ldap' | 'email' | 'sms', code?: string }) {\n      if (input.method === 'ldap')\n        return post('login/ldap', { username: input.identifier, password: input.password, captcha: input.captcha, expectedUserId: input.expectedUserId })\n      if (input.method === 'email' || input.method === 'sms')\n        return post('login/otp', { identifier: input.identifier, code: input.code, captcha: input.captcha, expectedUserId: input.expectedUserId })\n      return post('login', { identifier: input.identifier, password: input.password, captcha: input.captcha, expectedUserId: input.expectedUserId })\n    },\n    register: (input: IamRegisterInput) => post('register', { ...input, confirmPassword: input.password }),\n    sendOtp: (identifier: string, options?: { captcha?: string }) => post('otp/send', { identifier, ...options }),\n    requestPasswordReset: (identifier: string, options?: { captcha?: string }) => post('password-reset/request', { identifier, ...options }),\n    confirmPasswordReset: (token: string, newPassword: string) => post('password-reset/confirm', { token, newPassword }),\n    renewPassword: (input: { identifier: string, password: string, newPassword: string, captcha?: string }) => post('password/renew', input),\n    async reauthenticate(password: string, operation: string) {\n      const response = await apiFetch(`${base}/reauthenticate`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ password, operation }) })\n      return apiContract.haiResultSchema(IamReauthenticationProofSchema).parse(await response.json())\n    },\n  }\n}\n"]}

package/dist/kit-client-auth-BnhrkzZF.d.ts

@@ -1,422 +0,0 @@
-import { IamCreateCaptchaInputSchema, IamPublicConfig, IamLoginInput, IamRegisterInput } from '@h-ai/api-contract';
-import { HaiResult } from '@h-ai/core';
-import { CryptoFunctions } from '@h-ai/crypto';
-import { PasswordCredentials, AuthRequestContext, AuthResult, OtpCredentials, LdapCredentials, ApiKeyCredentials, RegisterOptions } from '@h-ai/iam';
-import { k as KitPublicConfig } from './kit-types-BkNdyKj8.js';
-import { z } from 'zod';
-
-/**
- * @h-ai/kit — Bearer 认证工具
- *
- * 提供服务端认证 Cookie 管理（login / logout）与浏览器端 Token 存储工具。
- * @module kit-auth
- */
-
-/**
- * 服务端认证写入/删除 Cookie 依赖；由当前请求提供并执行安全属性。
- * @example 模块内部上下文
- * ```ts
- * function signIn(cookies: CookieWriter, credentials: PasswordCredentials) {
- *   return login(cookies, credentials) // 业务调用者检查 success 后消费身份。
- * }
- * ```
- */
-interface CookieWriter {
-    set: (name: string, value: string, options: {
-        path: string;
-        httpOnly: boolean;
-        sameSite: 'lax' | 'strict' | 'none';
-        secure: boolean;
-        maxAge?: number;
-    }) => void;
-    delete: (name: string, options: {
-        path: string;
-    }) => void;
-}
-/**
- * 浏览器 Token 存储器；使用页面内存或平台安全存储，禁止写入 Web Storage。
- * @example 模块内部上下文
- * ```ts
- * const store: BrowserTokenStore = getDefaultBrowserTokenStore()
- * store.clear() // 当前页面内存状态；不持有服务端会话真值。
- * ```
- */
-interface BrowserTokenStore {
-    get: () => string | null;
-    set: (token: string) => void;
-    clear: () => void;
-}
-/**
- * 服务端登录（密码）：内部调用 iam.auth.login，成功时自动写入 Token Cookie。
- *
- * @param cookies - SvelteKit cookies 对象
- * @param credentials - 密码凭证（identifier + password）
- * @param context - 宿主提供的可信登录元数据，不从凭据输入复制 IP。
- * @returns 认证结果（成功时 Cookie 已自动写入）
- * @example 模块内部上下文
- * ```ts
- * async function signIn(cookies: CookieWriter, credentials: PasswordCredentials) {
- *   const result = await login(cookies, credentials)
- *   if (!result.success) return result.error.message
- *   return result.data
- * }
- * ```
- */
-declare function login(cookies: CookieWriter, credentials: PasswordCredentials, context?: AuthRequestContext): Promise<HaiResult<AuthResult>>;
-/**
- * 服务端登录（OTP 验证码）：内部调用 iam.auth.loginWithOtp，成功时自动写入 Token Cookie。
- *
- * @param cookies - SvelteKit cookies 对象
- * @param credentials - OTP 凭证（identifier + code）
- * @param context - 宿主提供的可信登录元数据。
- * @returns 认证结果（成功时 Cookie 已自动写入）
- * @example 模块内部上下文
- * ```ts
- * async function signIn(cookies: CookieWriter, credentials: OtpCredentials) {
- *   const result = await loginWithOtp(cookies, credentials)
- *   if (!result.success) return result.error.message
- *   return result.data
- * }
- * ```
- */
-declare function loginWithOtp(cookies: CookieWriter, credentials: OtpCredentials, context?: AuthRequestContext): Promise<HaiResult<AuthResult>>;
-/**
- * 服务端登录（LDAP）：内部调用 iam.auth.loginWithLdap，成功时自动写入 Token Cookie。
- *
- * @param cookies - SvelteKit cookies 对象
- * @param credentials - LDAP 凭证（username + password）
- * @param context - 宿主提供的可信登录元数据。
- * @returns 认证结果（成功时 Cookie 已自动写入）
- * @example 模块内部上下文
- * ```ts
- * async function signIn(cookies: CookieWriter, credentials: LdapCredentials) {
- *   const result = await loginWithLdap(cookies, credentials)
- *   if (!result.success) return result.error.message
- *   return result.data
- * }
- * ```
- */
-declare function loginWithLdap(cookies: CookieWriter, credentials: LdapCredentials, context?: AuthRequestContext): Promise<HaiResult<AuthResult>>;
-/**
- * 服务端登录（API Key）：内部调用 iam.auth.loginWithApiKey，成功时自动写入 Token Cookie。
- *
- * @param cookies - SvelteKit cookies 对象
- * @param credentials - API Key 凭证（key）
- * @param context - 宿主提供的可信登录元数据。
- * @returns 认证结果（成功时 Cookie 已自动写入）
- * @example 模块内部上下文
- * ```ts
- * async function signIn(cookies: CookieWriter, credentials: ApiKeyCredentials) {
- *   const result = await loginWithApiKey(cookies, credentials)
- *   if (!result.success) return result.error.message
- *   return result.data
- * }
- * ```
- */
-declare function loginWithApiKey(cookies: CookieWriter, credentials: ApiKeyCredentials, context?: AuthRequestContext): Promise<HaiResult<AuthResult>>;
-/**
- * 服务端注册并登录：内部调用 iam.auth.registerAndLogin，成功时自动写入 Token Cookie。
- *
- * @param cookies - SvelteKit cookies 对象
- * @param options - 注册选项（username、password、email 等）
- * @returns 认证结果（成功时 Cookie 已自动写入）
- * @example 模块内部上下文
- * ```ts
- * async function signIn(cookies: CookieWriter, credentials: RegisterOptions) {
- *   const result = await registerAndLogin(cookies, credentials)
- *   if (!result.success) return result.error.message
- *   return result.data
- * }
- * ```
- */
-declare function registerAndLogin(cookies: CookieWriter, options: RegisterOptions, context?: AuthRequestContext): Promise<HaiResult<AuthResult>>;
-/**
- * 服务端登出：委托 iam.auth.logout 原子撤销凭据，并始终清除当前请求的 Token Cookie。
- * Cookie 清理只代表本地退出；服务端撤销失败仍返回失败，不能由调用端改成成功响应。
- *
- * @param cookies - SvelteKit cookies 对象
- * @param accessToken - 访问令牌（为 null/undefined 时仅清除 Cookie）
- * @returns 服务端撤销结果；无令牌时仅清理 Cookie 并成功，有令牌但未配置认证操作时失败。
- * @remarks 底层控制流异常仍以 Promise 拒绝传播；Cookie 清理不吞掉业务失败。
- * @example 模块内部上下文
- * ```ts
- * async function signOut(cookies: CookieWriter, accessToken: string) {
- *   const result = await logout(cookies, accessToken)
- *   if (!result.success) return result.error.code
- *   return result.data
- * }
- * ```
- */
-declare function logout(cookies: CookieWriter, accessToken?: string | null): Promise<HaiResult<void>>;
-/**
- * 写入默认浏览器端 Access Token（仅页面内存，不持久化到 localStorage）。
- * @param token - 当前页面内存中使用的 access token，不写入 Web Storage。
- * @example
- * ```ts
- * import { kit } from '@h-ai/kit'
- *
- * kit.auth.setBrowserToken('example-only-token')
- * // 页面注销时同步清除浏览器内存令牌。
- * kit.auth.clearBrowserToken()
- * ```
- */
-declare function setBrowserToken(token: string): void;
-/**
- * 清除默认浏览器端 Access Token（仅页面内存）。
- * @example
- * ```ts
- * import { kit } from '@h-ai/kit'
- *
- * kit.auth.clearBrowserToken()
- * ```
- */
-declare function clearBrowserToken(): void;
-
-/**
- * @h-ai/kit — 统一客户端
- *
- * 将 CSRF Token 附加与可选传输加密封装为统一 `apiFetch`。
- * 应用层只需调用一次 `createKitClient()`，后续 API 调用即可复用同一套安全能力。
- * @module kit-client
- */
-
-/**
- * 传输加密客户端配置
- * @example
- * ```ts
- * import type { ClientTransportConfig } from '@h-ai/kit'
- * import { crypto } from '@h-ai/crypto'
- *
- * function configAfterInit(): ClientTransportConfig { return { crypto, excludePaths: ['/api/health'] } }
- * ```
- */
-interface ClientTransportConfig {
-    /** 宿主构建挂载目录，默认空字符串；SvelteKit 使用 $app/paths.base。 */
-    basePath?: string;
-    /** 可选本地明文上限；缺省跟随服务端握手。 */
-    maxPlaintextBytes?: number;
-    /** @h-ai/crypto 服务实例 */
-    crypto: CryptoFunctions;
-    /** 密钥交换端点 URL（默认 `'/api/_hai/key-exchange'`） */
-    keyExchangeUrl?: string;
-    /** 排除路径（命中后强制走明文），需与服务端 transport.excludePaths 保持一致 */
-    excludePaths?: readonly string[];
-}
-/**
- * Kit 客户端配置
- * @example
- * ```ts
- * import type { KitClientConfig } from '@h-ai/kit'
- *
- * const value: KitClientConfig = { auth: true }
- * void value
- * ```
- */
-interface KitClientConfig {
-    /** 标准鉴别明确失效时原地登录原用户；成功才对被拒绝的请求重试一次。 */
-    recoverSession?: () => Promise<boolean>;
-    /** 会话终端分组，默认web；服务端按终端与全局配额共同限制。 */
-    terminalType?: 'web' | 'app' | 'desktop' | 'api';
-    /**
-     * 传输加密配置。
-     * - 不提供 / undefined：不启用传输加密，仅 CSRF
-     * - 提供对象：启用传输加密
-     */
-    transport?: ClientTransportConfig;
-    /** CSRF Cookie 名称（默认 `'hai_csrf'`） */
-    csrfCookieName?: string;
-    /** CSRF Header 名称（默认 `'X-CSRF-Token'`） */
-    csrfHeaderName?: string;
-    /**
-     * 认证配置：自动从浏览器存储读取 Access Token 并注入请求头。
-     * - `true`：使用默认页面内存存储（由 `kit.auth.setBrowserToken()` 写入，不读写 localStorage）
-     * - `BrowserTokenStore`：使用自定义存储
-     * - 不提供 / `false`：不自动注入
-     */
-    auth?: boolean | BrowserTokenStore;
-}
-/**
- * Kit 客户端实例
- * @example
- * ```ts
- * import type { KitClient } from '@h-ai/kit'
- *
- * async function read(client: KitClient) {
- *   const response = await client.apiFetch('/api/health')
- *   if (!response.ok) throw new Error('Request failed')
- *   return response.json()
- * }
- * ```
- */
-interface KitClient {
-    /** 统一 API fetch（写请求自动附加 CSRF，启用 transport 时自动加解密） */
-    apiFetch: (input: RequestInfo | URL, init?: RequestInit, options?: {
-        recoverSession?: boolean;
-        reauthorize?: () => Promise<string | null | undefined>;
-    }) => Promise<Response>;
-    /** 传输加密是否就绪（未启用传输加密时始终为 true） */
-    readonly ready: boolean;
-    /**
-     * 手动触发密钥交换（transport 启用时）。
-     *
-     * 注意：本方法是 Client 形态的合规例外，密钥协商失败时 `throw`（与 `@h-ai/api-client` 一致），
-     * 调用方需自行 `try/catch`，不返回 `HaiResult`。
-     */
-    init: () => Promise<void>;
-    /** 销毁密钥状态 */
-    destroy: () => void;
-}
-/**
- * 在浏览器启动时安装同源 transport fetch 包装。
- *
- * 该包装作用于同源 `/api/*` 与 SvelteKit `__data.json` 请求，页面文档、
- * 静态资源以及 multipart/form-data 等上传请求保持原样。应用只需安装一次，
- * 后续 `fetch` / SvelteKit 内部 data fetch / `kit.client.create()` 明文发送路径
- * 都会共用这层传输加密能力。
- * @param transportConfig - 已初始化 crypto、同源密钥交换路径及排除路径；省略时不安装包装。
- * @example
- * ```ts
- * import { kit } from '@h-ai/kit'
- *
- * // 不传配置时不安装全局包装；启用时应传已初始化 crypto 与同源端点。
- * kit.client.installBrowserTransportFetch()
- * ```
- */
-declare function installBrowserTransportFetch(transportConfig?: ClientTransportConfig): void;
-/**
- * 用 `config/_kit.yml` 解析后的 {@link KitPublicConfig} 公共投影 一次性安装浏览器端传输加密。
- *
- * 行为：
- * - `config.transport === false` 时直接返回（不启用传输加密）；
- * - 否则启动 {@link installBrowserTransportFetch}，并预热 {@link CryptoFunctions} 模块。
- *
- * 应用层（SvelteKit `+layout.svelte` 或浏览器入口）只需调用此函数一次，
- * 之后宿主 basePath 下的同源 `/api/*` 与 `__data.json` 请求都会自动走传输加密。
- *
- * @param config 已解析的 kit 公共传输配置
- * @param deps  外部依赖
- * @param deps.crypto `@h-ai/crypto` 模块实例
- * @param deps.basePath 宿主构建挂载目录，默认空字符串；SvelteKit 使用 $app/paths.base。
- * @example
- * ```ts
- * import { kit } from '@h-ai/kit'
- *
- * import { crypto } from '@h-ai/crypto'
- *
- * function installAfterCryptoInit() {
- *   kit.client.installBrowserTransport({ transport: { keyExchangePath: '/api/_hai/key-exchange', excludePaths: ['/api/health'] } }, { crypto })
- * }
- * ```
- */
-declare function installBrowserTransport(config: KitPublicConfig, deps: {
-    crypto: CryptoFunctions;
-    basePath?: string;
-}): void;
-/**
- * 创建 Kit 客户端
- *
- * 返回统一的 `apiFetch`，内部自动完成：
- * 1. CSRF Token 附加（写方法自动读取 Cookie + 设置 Header）
- * 2. 密钥交换（首次写请求时 lazy init，transport 启用时）
- * 3. 请求体加密（transport 启用时）
- * 4. 响应体解密（transport 启用时）
- *
- * @param config - 客户端配置
- * @returns KitClient 实例
- * @example
- * ```ts
- * import { kit } from '@h-ai/kit'
- *
- * const client = kit.client.create({ auth: true })
- * try {
- *   await client.init() // Client API 使用 Promise 拒绝；不是 HaiResult。
- *   const response = await client.apiFetch('/api/health')
- *   if (!response.ok) throw new Error('Request failed')
- * } finally {
- *   client.destroy()
- * }
- * ```
- */
-declare function createKitClient(config?: KitClientConfig): KitClient;
-
-/** 与标准 Kit 认证端点配套的表单动作；复用已有 CSRF/transport fetch。 */
-
-/**
- * 创建标准 Cookie 认证表单动作；复用可选 apiFetch 以保留 CSRF 和传输配置。
- * @param options - 可复用的 apiFetch 和标准认证端点 basePath。
- * @param options.apiFetch - 已装配 CSRF/transport 的 fetch；省略时使用默认 Kit 客户端。
- * @param options.basePath - 同源认证端点前缀，默认 /api/auth。
- * @returns 标准表单动作；业务返回 HaiResult，网络/格式错误会拒绝 Promise。
- * @example
- * ```ts
- * import { kit } from '@h-ai/kit'
- *
- * const actions = kit.client.createAuthActions({ basePath: '/api/auth' })
- * void actions
- * ```
- */
-declare function createKitAuthActions(options?: {
-    apiFetch?: KitClient['apiFetch'];
-    basePath?: string;
-}): {
-    bindPageExit(options?: {
-        enabled?: boolean;
-    }): () => void;
-    createCaptcha(input: z.input<typeof IamCreateCaptchaInputSchema>): Promise<HaiResult<{
-        id: string;
-        challenge: {
-            parameters: {
-                algorithm: "PBKDF2/SHA-256";
-                nonce: string;
-                salt: string;
-                cost: number;
-                keyLength: number;
-                keyPrefix: string;
-                keySignature?: string | undefined;
-                data?: Record<string, string | number | boolean | null> | undefined;
-            };
-            signature?: string | undefined;
-        };
-    }>>;
-    publicConfig(): Promise<HaiResult<IamPublicConfig | null>>;
-    login(input: IamLoginInput & {
-        method?: "password" | "ldap" | "email" | "sms";
-        code?: string;
-    }): Promise<HaiResult<unknown>>;
-    register: (input: IamRegisterInput) => Promise<HaiResult<unknown>>;
-    sendOtp: (identifier: string, options?: {
-        captcha?: string;
-    }) => Promise<HaiResult<unknown>>;
-    requestPasswordReset: (identifier: string, options?: {
-        captcha?: string;
-    }) => Promise<HaiResult<unknown>>;
-    confirmPasswordReset: (token: string, newPassword: string) => Promise<HaiResult<unknown>>;
-    renewPassword: (input: {
-        identifier: string;
-        password: string;
-        newPassword: string;
-        captcha?: string;
-    }) => Promise<HaiResult<unknown>>;
-    reauthenticate(password: string, operation: string): Promise<{
-        success: false;
-        error: {
-            code: string | number;
-            message: string;
-            traceId?: string | undefined;
-            httpStatus?: number | undefined;
-            system?: string | undefined;
-            module?: string | undefined;
-            cause?: unknown;
-            suggestion?: string | undefined;
-            ext?: Record<string, unknown> | undefined;
-        };
-    } | {
-        success: true;
-        data: {
-            ticket: string;
-            expiresAt: number;
-        };
-    }>;
-};
-
-export { type ClientTransportConfig as C, type KitClient as K, createKitAuthActions as a, installBrowserTransportFetch as b, createKitClient as c, clearBrowserToken as d, type KitClientConfig as e, loginWithOtp as f, loginWithLdap as g, loginWithApiKey as h, installBrowserTransport as i, logout as j, login as l, registerAndLogin as r, setBrowserToken as s };